@authowl/core 0.20.0 → 0.21.1

package/dist/{client-C76hiQOA.d.ts → client-DhUE4JL1.d.ts}

@@ -1,4 +1,4 @@
-import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-B05mzhtA.js';
+import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-DSqmZLkN.js';
 
 /**
  * The organization invitation an emailed link is asking this browser to accept.
@@ -71,7 +71,11 @@ type PublicConfig = {
     environmentId: string;
     /** Environment class that determines key prefixes and billing treatment. */
     environmentType: EnvironmentType;
-    /** Canonical authentication endpoint for this environment. */
+    /**
+     * Authentication endpoint used by this SDK instance. Hosted portals and
+     * custom domains keep this same-origin even when the stable JWT issuer uses
+     * the platform's canonical origin.
+     */
     authBaseUrl: string;
     /**
      * Public acquisition mode. Optional only for rolling compatibility with
@@ -174,6 +178,50 @@ type PublicConfig = {
         version: number;
         required: boolean;
     };
+    /** Published, bilingual privacy notices and optional consent purposes. */
+    privacy?: {
+        notices: Array<{
+            noticeId: string;
+            noticeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            body: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            purposeCodes: string[];
+            effectiveFrom: string;
+        }>;
+        consentPurposes: Array<{
+            purposeId: string;
+            purposeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            description: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            dataCategories: string[];
+        }>;
+    };
     /**
      * Whether the project lets signed-in users enrol a second factor (TOTP). A
      * capability flag, not a sign-in method (so it's absent from `enabledMethods`):
@@ -199,8 +247,8 @@ type PublicConfig = {
      * JWT issuer (server contract CONTRACTS §8). Non-null only when the project's
      * issuer toggle is on: exactly what a third-party verifier needs (Convex
      * `auth.config.ts` = `{ type: "customJwt", issuer, jwks: jwksUrl,
-     * applicationID: aud, algorithm: "ES256" }`). `getToken` mints from
-     * `<issuer>/token`.
+     * applicationID: aud, algorithm: "ES256" }`). The issuer remains stable when
+     * `authBaseUrl` follows a hosted or custom account-portal origin.
      */
     jwtIssuer: {
         issuer: string;
@@ -230,38 +278,6 @@ type PublicConfig = {
  */
 declare function getPublicConfig(config: ResolvedAuthConfig): Promise<PublicConfig>;
 
-/** One compatibility boundary for project-controlled authentication UI. */
-type ProjectCapabilities = {
-    emailSignUp: boolean;
-    passwordSignUp: boolean;
-    phoneSignUp: boolean;
-    passwordSignIn: boolean;
-    passwordMinLength: number;
-    passwordMaxLength: number;
-    magicLinkSignIn: boolean;
-    emailOtpSignIn: boolean;
-    phoneSignIn: boolean;
-    usernameSignIn: boolean;
-    collectUsername: boolean;
-    passkeySignIn: boolean;
-    passkeyAdd: boolean;
-    firstLastName: boolean;
-    emailChange: boolean;
-    accountDeletion: boolean;
-    emailVerificationRequired: boolean;
-    emailVerificationMethod: 'link' | 'code';
-    totp: boolean;
-    mfaRequired: boolean;
-    backupCodes: boolean;
-    /** Preserve the pre-plan-35 display-name field only for an older server. */
-    legacyNameField: boolean;
-};
-/**
- * Resolve current and legacy public-config shapes once, rather than spreading
- * compatibility checks through each platform's components.
- */
-declare function resolveProjectCapabilities(config: PublicConfig | null): ProjectCapabilities;
-
 /** Legal-consent status for the signed-in user (server contract: `GET /consent`). */
 type ConsentStatus = {
     /** Whether the project has an active consent gate at all. */
@@ -331,28 +347,6 @@ type TokenClient = {
  */
 declare function createTokenClient(config: ResolvedAuthConfig): TokenClient;
 
-declare const AUTH_CHALLENGE_HEADER = "x-authowl-turnstile-token";
-/**
- * The language this request is being conducted in.
- *
- * Advisory: a server that does not know it ignores it, and one that does
- * falls back to the project default for anything it has no catalogue for.
- */
-declare const AUTH_LOCALE_HEADER = "x-authowl-locale";
-type ResponseDecoder<T> = (value: unknown) => T;
-type AuthHttpRequest<T = unknown> = {
-    method?: 'GET' | 'POST' | 'PATCH';
-    body?: unknown;
-    query?: Record<string, string | number | boolean | undefined>;
-    fetchOptions?: ActionFetchOptions;
-    decode?: ResponseDecoder<T>;
-    credentials?: RequestCredentials;
-};
-interface AuthHttpClient {
-    request<T>(path: string, options?: AuthHttpRequest<T>): Promise<AuthActionResult<T>>;
-}
-declare function createAuthHttpClient(config: ResolvedAuthConfig, baseURL?: string): AuthHttpClient;
-
 type JsonPrimitive = string | number | boolean | null;
 type JsonValue = JsonPrimitive | JsonObject | JsonValue[];
 type JsonObject = {
@@ -801,6 +795,58 @@ interface OrganizationClient {
     }): boolean;
 }
 
+type PrivacyLocale = 'en' | 'ar';
+type PrivacyConsentState = 'granted' | 'refused' | 'withdrawn';
+type PrivacyRightType = 'access' | 'correction' | 'portability' | 'erasure' | 'restriction' | 'objection' | 'consent_withdrawal';
+type PrivacyRightState = 'received' | 'identity_pending' | 'in_progress' | 'restricted' | 'completed' | 'denied' | 'withdrawn';
+interface PrivacyConsentPreference {
+    purposeId: string;
+    purposeVersionId: string;
+    code: string;
+    state: PrivacyConsentState | null;
+    updatedAt: Date | null;
+    decidedAt: Date | null;
+}
+interface PrivacyRightsRequest {
+    id: string;
+    rightType: PrivacyRightType;
+    state: PrivacyRightState;
+    locale: PrivacyLocale;
+    receivedAt: Date;
+    acknowledgedAt: Date | null;
+    fulfilmentDeadline: Date;
+    completedAt: Date | null;
+}
+interface RecordPrivacyConsentOptions {
+    purposeCode: string;
+    purposeVersionId: string;
+    noticeVersionId: string;
+    decision: PrivacyConsentState;
+    locale: PrivacyLocale;
+    /** Stable retry key. A secure UUID is generated when omitted. */
+    correlationId?: string;
+}
+interface CreatePrivacyRightsRequestOptions {
+    rightType: PrivacyRightType;
+    locale: PrivacyLocale;
+}
+interface PrivacyClient {
+    listConsentPreferences(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<{
+        preferences: PrivacyConsentPreference[];
+    }>>;
+    recordConsent(params: RecordPrivacyConsentOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<{
+        recorded: true;
+        decision: PrivacyConsentState;
+        decidedAt: Date;
+    }>>;
+    listRightsRequests(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<{
+        requests: PrivacyRightsRequest[];
+    }>>;
+    createRightsRequest(params: CreatePrivacyRightsRequestOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<{
+        request: PrivacyRightsRequest;
+    }>>;
+}
+
 /**
  * The narrow, portable surface of the underlying auth client that this SDK
  * depends on and re-exports.
@@ -1040,6 +1086,24 @@ interface EmailSignUpOptions {
      * this automatically when it renders the consent checkbox.
      */
     consentVersion?: number;
+    /**
+     * Exact published notice versions rendered by the sign-up surface, together
+     * with purpose-specific choices. Current <SignUp/> builds this from public
+     * config automatically; headless clients should echo the same projection.
+     */
+    privacyEvidence?: {
+        locale: 'en' | 'ar';
+        correlationId: string;
+        noticeVersionIds: string[];
+        consentDecisions: Array<{
+            purposeCode: string;
+            purposeVersionId: string;
+            noticeVersionId: string;
+            decision: 'granted' | 'refused';
+            guardianRequired: boolean;
+            guardianEvidenceId: string | null;
+        }>;
+    };
 }
 interface WaitlistJoinOptions {
     email: string;
@@ -1390,6 +1454,8 @@ interface AuthOwlClient {
     account: AccountClient;
     /** Signed-in organization, membership, role, and invitation actions. */
     organization: OrganizationClient;
+    /** Signed-in privacy preferences and data-subject-rights actions. */
+    privacy: PrivacyClient;
     signIn: {
         /**
          * Email + password sign-in. For a two-factor-enrolled user the result is a
@@ -1521,4 +1587,4 @@ interface AuthOwlClient {
  */
 declare function createAuthOwlClient(config: ResolvedAuthConfig): AuthOwlClient;
 
-export { type JsonObject as $, type AkedlyShieldStartProof as A, type DeleteOrganizationOptions as B, type ChangeEmailOptions as C, type DeleteAccountData as D, type DeletePasskeyData as E, type DeletePasskeyOptions as F, type DisableTwoFactorOptions as G, type EmailAuthData as H, type EmailOtpAuthData as I, type EmailOtpSignInOptions as J, type EmailOtpType as K, type EmailSignInOptions as L, type EmailSignUpData as M, type EmailSignUpOptions as N, type EnableTwoFactorOptions as O, type PhoneOtpChallengeData as P, type EnvironmentType as Q, type GenerateBackupCodesOptions as R, type GetOrganizationInvitationOptions as S, type GetOrganizationOptions as T, type GetToken as U, type GetTokenOptions as V, INVITATION_CLAIM_MAX_AGE_MS as W, INVITATION_QUERY_PARAM as X, type InvitationClaim as Y, type InvitationRecipientHint as Z, type InviteOrganizationMemberOptions as _, AUTH_CHALLENGE_HEADER as a, type TwoFactorBackupCodesData as a$, type JsonPrimitive as a0, type JsonValue as a1, type LeaveOrganizationOptions as a2, type LinkSocialData as a3, type LinkSocialOptions as a4, type ListOrganizationInvitationsOptions as a5, type ListOrganizationMembersOptions as a6, type ListOrganizationRolesOptions as a7, type ListOrganizationTeamMembersOptions as a8, type ListOrganizationTeamsOptions as a9, type PhoneOtpVerifyOptions as aA, type ProjectCapabilities as aB, type PublicConfig as aC, type RejectOrganizationInvitationData as aD, type RemoveOrganizationMemberData as aE, type RemoveOrganizationMemberOptions as aF, type RemoveOrganizationTeamData as aG, type RemoveOrganizationTeamMemberData as aH, type RemoveOrganizationTeamMemberOptions as aI, type RemoveOrganizationTeamOptions as aJ, type RequestPasswordResetOptions as aK, type ResetPasswordOptions as aL, type RevokeSessionOptions as aM, type SendOtpData as aN, type SendTwoFactorOtpData as aO, type SendTwoFactorOtpOptions as aP, type SendVerificationOtpOptions as aQ, type SessionState as aR, type SessionStore as aS, type SetActiveOrganizationOptions as aT, type SetActiveTeamOptions as aU, type SignOutData as aV, type SocialAccount as aW, type SocialAuthData as aX, type SocialIdTokenOptions as aY, type SocialSignInOptions as aZ, type TokenClient as a_, type MagicLinkData as aa, type MagicLinkSignInOptions as ab, type Organization as ac, type OrganizationClient as ad, type OrganizationDetails as ae, type OrganizationFilterOperator as af, type OrganizationInvitation as ag, type OrganizationInvitationActionOptions as ah, type OrganizationInvitationDetails as ai, type OrganizationInvitationStatus as aj, type OrganizationMember as ak, type OrganizationMemberUser as al, type OrganizationMemberWithUser as am, type OrganizationMembersData as an, type OrganizationRoleSummary as ao, type OrganizationSelector as ap, type OrganizationTeam as aq, type OrganizationTeamMember as ar, type OrganizationUserInvitation as as, type PasskeyAuthData as at, type PasskeySignInOptions as au, type PasswordResetData as av, type PhoneAuthUser as aw, type PhoneOtpStartData as ax, type PhoneOtpStartOptions as ay, type PhoneOtpVerifyData as az, AUTH_LOCALE_HEADER as b, type TwoFactorEnableData as b0, type TwoFactorRedirectData as b1, type TwoFactorStatusData as b2, type TwoFactorVerifyData as b3, type UnlinkSocialOptions as b4, type UpdateOrganizationMemberRoleOptions as b5, type UpdateOrganizationOptions as b6, type UpdateOrganizationTeamOptions as b7, type UpdatePasskeyData as b8, type UpdatePasskeyOptions as b9, type UpdateProfileOptions as ba, type UpdateUnsafeMetadataOptions as bb, type UserMetadata as bc, type UsernameSignInOptions as bd, type VerifyBackupCodeOptions as be, type VerifyEmailOtpData as bf, type VerifyEmailOtpOptions as bg, type VerifyTotpOptions as bh, type VerifyTwoFactorOtpOptions as bi, type WaitlistJoinData as bj, type WaitlistJoinOptions as bk, acceptConsent as bl, captureInvitationClaim as bm, clearInvitationClaim as bn, createAuthOwlClient as bo, createTokenClient as bp, getConsentStatus as bq, getPublicConfig as br, readInvitationClaim as bs, resolveProjectCapabilities as bt, createAuthHttpClient as bu, type AuthHttpClient as bv, type AcceptOrganizationInvitationData as c, type AccountClient as d, type AccountSession as e, type AccountStatusData as f, type ActionFetchOptions as g, type AddOrganizationTeamMemberOptions as h, type AddPasskeyOptions as i, type AuthActionResult as j, type AuthClientError as k, type AuthErrorContext as l, type AuthOwlClient as m, type AuthOwlErrorCode as n, type AuthPasskey as o, type AuthRequestContext as p, type AuthResponseContext as q, type AuthSession as r, type AuthUser as s, type ChangePasswordData as t, type ChangePasswordOptions as u, type ConsentAcceptResult as v, type ConsentStatus as w, type CreateOrganizationOptions as x, type CreateOrganizationTeamOptions as y, type DeleteAccountOptions as z };
+export { type EmailAuthData as $, type ActionFetchOptions as A, type AccountClient as B, type CreatePrivacyRightsRequestOptions as C, type AccountSession as D, type AccountStatusData as E, type AddOrganizationTeamMemberOptions as F, type AuthErrorContext as G, type AuthOwlErrorCode as H, type AuthRequestContext as I, type AuthResponseContext as J, type ChangeEmailOptions as K, type ChangePasswordData as L, type ChangePasswordOptions as M, type ConsentAcceptResult as N, type Organization as O, type PublicConfig as P, type ConsentStatus as Q, type RecordPrivacyConsentOptions as R, type SocialIdTokenOptions as S, type CreateOrganizationOptions as T, type CreateOrganizationTeamOptions as U, type DeleteAccountData as V, type DeleteAccountOptions as W, type DeleteOrganizationOptions as X, type DeletePasskeyData as Y, type DeletePasskeyOptions as Z, type DisableTwoFactorOptions as _, type AuthActionResult as a, type SendTwoFactorOtpOptions as a$, type EmailOtpAuthData as a0, type EmailOtpSignInOptions as a1, type EmailOtpType as a2, type EmailSignInOptions as a3, type EmailSignUpData as a4, type EmailSignUpOptions as a5, type EnableTwoFactorOptions as a6, type EnvironmentType as a7, type GenerateBackupCodesOptions as a8, type GetOrganizationInvitationOptions as a9, type OrganizationMember as aA, type OrganizationMemberUser as aB, type OrganizationMemberWithUser as aC, type OrganizationMembersData as aD, type OrganizationRoleSummary as aE, type OrganizationSelector as aF, type OrganizationTeam as aG, type OrganizationTeamMember as aH, type OrganizationUserInvitation as aI, type PasswordResetData as aJ, type PhoneAuthUser as aK, type PhoneOtpStartData as aL, type PhoneOtpStartOptions as aM, type PhoneOtpVerifyData as aN, type PhoneOtpVerifyOptions as aO, type RejectOrganizationInvitationData as aP, type RemoveOrganizationMemberData as aQ, type RemoveOrganizationMemberOptions as aR, type RemoveOrganizationTeamData as aS, type RemoveOrganizationTeamMemberData as aT, type RemoveOrganizationTeamMemberOptions as aU, type RemoveOrganizationTeamOptions as aV, type RequestPasswordResetOptions as aW, type ResetPasswordOptions as aX, type RevokeSessionOptions as aY, type SendOtpData as aZ, type SendTwoFactorOtpData as a_, type GetOrganizationOptions as aa, type GetToken as ab, type GetTokenOptions as ac, INVITATION_CLAIM_MAX_AGE_MS as ad, INVITATION_QUERY_PARAM as ae, type InvitationClaim as af, type InvitationRecipientHint as ag, type InviteOrganizationMemberOptions as ah, type JsonObject as ai, type JsonPrimitive as aj, type JsonValue as ak, type LeaveOrganizationOptions as al, type LinkSocialData as am, type LinkSocialOptions as an, type ListOrganizationInvitationsOptions as ao, type ListOrganizationMembersOptions as ap, type ListOrganizationRolesOptions as aq, type ListOrganizationTeamMembersOptions as ar, type ListOrganizationTeamsOptions as as, type MagicLinkData as at, type MagicLinkSignInOptions as au, type OrganizationFilterOperator as av, type OrganizationInvitation as aw, type OrganizationInvitationActionOptions as ax, type OrganizationInvitationDetails as ay, type OrganizationInvitationStatus as az, type AuthOwlClient as b, type SendVerificationOtpOptions as b0, type SetActiveTeamOptions as b1, type SignOutData as b2, type SocialAccount as b3, type SocialSignInOptions as b4, type TokenClient as b5, type TwoFactorBackupCodesData as b6, type TwoFactorEnableData as b7, type TwoFactorRedirectData as b8, type TwoFactorStatusData as b9, type TwoFactorVerifyData as ba, type UnlinkSocialOptions as bb, type UpdateOrganizationMemberRoleOptions as bc, type UpdateOrganizationOptions as bd, type UpdateOrganizationTeamOptions as be, type UpdatePasskeyData as bf, type UpdatePasskeyOptions as bg, type UpdateProfileOptions as bh, type UpdateUnsafeMetadataOptions as bi, type UserMetadata as bj, type UsernameSignInOptions as bk, type VerifyBackupCodeOptions as bl, type VerifyEmailOtpData as bm, type VerifyEmailOtpOptions as bn, type VerifyTotpOptions as bo, type VerifyTwoFactorOtpOptions as bp, type WaitlistJoinData as bq, type WaitlistJoinOptions as br, acceptConsent as bs, captureInvitationClaim as bt, clearInvitationClaim as bu, createAuthOwlClient as bv, createTokenClient as bw, getConsentStatus as bx, readInvitationClaim as by, type PasskeySignInOptions as c, type PasskeyAuthData as d, type AddPasskeyOptions as e, type AuthPasskey as f, type AuthClientError as g, type AuthSession as h, type AuthUser as i, type OrganizationClient as j, type OrganizationDetails as k, type PrivacyClient as l, type PrivacyConsentPreference as m, type PrivacyConsentState as n, type PrivacyLocale as o, type PrivacyRightState as p, type PrivacyRightType as q, type PrivacyRightsRequest as r, type SessionState as s, type SessionStore as t, type SetActiveOrganizationOptions as u, type SocialAuthData as v, getPublicConfig as w, type PhoneOtpChallengeData as x, type AkedlyShieldStartProof as y, type AcceptOrganizationInvitationData as z };

package/dist/cookie-BqcfagTw.d.cts

@@ -0,0 +1,30 @@
+/**
+ * The exact session-cookie name the auth server sets for a given project.
+ *
+ * Single source of truth for the cookie name across the SDK. The server
+ * (the AuthOwl server project factory) configures
+ * `advanced.cookiePrefix = "p_" + <projectId without dashes>` and
+ * `useSecureCookies` in production; the auth engine then names the session
+ * cookie `${securePrefix}${cookiePrefix}.session_token`, where `securePrefix`
+ * is `__Secure-` for secure cookies and empty otherwise:
+ *
+ *   dev  (http):  p_<idNoDashes>.session_token
+ *   prod (https): __Secure-p_<idNoDashes>.session_token
+ *
+ * Verified 2026-07-06 against the auth engine's `getCookies()` with the server's
+ * real config (see CONTRACTS section 5 and `cookie.test.ts`). Note the engine
+ * joins the prefix and name with a dot (`.`), not an underscore, and uses the
+ * `__Secure-` (not `__Host-`) prefix - both are easy to get wrong by hand, and
+ * getting them wrong makes `auth()` forward a cookie the server never set. If an
+ * auth-engine upgrade changes cookie naming, re-verify and update this function,
+ * the `cookie.test.ts` fixtures, and CONTRACTS section 5 together.
+ *
+ * `secure` must reflect the SERVER's cookie mode: callers holding the auth API
+ * URL derive it from the protocol (`https:` => secure). Callers that cannot
+ * know it (the UX-only redirect middleware) should check both variants.
+ */
+declare function sessionCookieName(projectId: string, opts?: {
+    secure?: boolean;
+}): string;
+
+export { sessionCookieName as s };

package/dist/cookie-BqcfagTw.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The exact session-cookie name the auth server sets for a given project.
+ *
+ * Single source of truth for the cookie name across the SDK. The server
+ * (the AuthOwl server project factory) configures
+ * `advanced.cookiePrefix = "p_" + <projectId without dashes>` and
+ * `useSecureCookies` in production; the auth engine then names the session
+ * cookie `${securePrefix}${cookiePrefix}.session_token`, where `securePrefix`
+ * is `__Secure-` for secure cookies and empty otherwise:
+ *
+ *   dev  (http):  p_<idNoDashes>.session_token
+ *   prod (https): __Secure-p_<idNoDashes>.session_token
+ *
+ * Verified 2026-07-06 against the auth engine's `getCookies()` with the server's
+ * real config (see CONTRACTS section 5 and `cookie.test.ts`). Note the engine
+ * joins the prefix and name with a dot (`.`), not an underscore, and uses the
+ * `__Secure-` (not `__Host-`) prefix - both are easy to get wrong by hand, and
+ * getting them wrong makes `auth()` forward a cookie the server never set. If an
+ * auth-engine upgrade changes cookie naming, re-verify and update this function,
+ * the `cookie.test.ts` fixtures, and CONTRACTS section 5 together.
+ *
+ * `secure` must reflect the SERVER's cookie mode: callers holding the auth API
+ * URL derive it from the protocol (`https:` => secure). Callers that cannot
+ * know it (the UX-only redirect middleware) should check both variants.
+ */
+declare function sessionCookieName(projectId: string, opts?: {
+    secure?: boolean;
+}): string;
+
+export { sessionCookieName as s };

package/dist/idempotency-DmDFUS3e.d.ts

@@ -0,0 +1,61 @@
+import { P as PublicConfig, A as ActionFetchOptions, a as AuthActionResult } from './client-DhUE4JL1.js';
+import { R as ResolvedAuthConfig } from './organization-membership-DSqmZLkN.js';
+
+/** One compatibility boundary for project-controlled authentication UI. */
+type ProjectCapabilities = {
+    emailSignUp: boolean;
+    passwordSignUp: boolean;
+    phoneSignUp: boolean;
+    passwordSignIn: boolean;
+    passwordMinLength: number;
+    passwordMaxLength: number;
+    magicLinkSignIn: boolean;
+    emailOtpSignIn: boolean;
+    phoneSignIn: boolean;
+    usernameSignIn: boolean;
+    collectUsername: boolean;
+    passkeySignIn: boolean;
+    passkeyAdd: boolean;
+    firstLastName: boolean;
+    emailChange: boolean;
+    accountDeletion: boolean;
+    emailVerificationRequired: boolean;
+    emailVerificationMethod: 'link' | 'code';
+    totp: boolean;
+    mfaRequired: boolean;
+    backupCodes: boolean;
+    /** Preserve the pre-plan-35 display-name field only for an older server. */
+    legacyNameField: boolean;
+};
+/**
+ * Resolve current and legacy public-config shapes once, rather than spreading
+ * compatibility checks through each platform's components.
+ */
+declare function resolveProjectCapabilities(config: PublicConfig | null): ProjectCapabilities;
+
+declare const AUTH_CHALLENGE_HEADER = "x-authowl-turnstile-token";
+/**
+ * The language this request is being conducted in.
+ *
+ * Advisory: a server that does not know it ignores it, and one that does
+ * falls back to the project default for anything it has no catalogue for.
+ */
+declare const AUTH_LOCALE_HEADER = "x-authowl-locale";
+type ResponseDecoder<T> = (value: unknown) => T;
+type AuthHttpRequest<T = unknown> = {
+    method?: 'GET' | 'POST' | 'PATCH';
+    body?: unknown;
+    query?: Record<string, string | number | boolean | undefined>;
+    fetchOptions?: ActionFetchOptions;
+    decode?: ResponseDecoder<T>;
+    credentials?: RequestCredentials;
+};
+interface AuthHttpClient {
+    request<T>(path: string, options?: AuthHttpRequest<T>): Promise<AuthActionResult<T>>;
+}
+declare function createAuthHttpClient(config: ResolvedAuthConfig, baseURL?: string): AuthHttpClient;
+
+/** Create a cryptographically random RFC 4122 v4 key for retry-safe write actions. */
+declare function createIdempotencyKey(): string;
+
+export { type AuthHttpClient as A, type ProjectCapabilities as P, createIdempotencyKey as a, AUTH_CHALLENGE_HEADER as b, createAuthHttpClient as c, AUTH_LOCALE_HEADER as d, resolveProjectCapabilities as r };

package/dist/idempotency-kuv3HQVN.d.cts

@@ -0,0 +1,61 @@
+import { P as PublicConfig, A as ActionFetchOptions, a as AuthActionResult } from './client-BRDFS1ln.cjs';
+import { R as ResolvedAuthConfig } from './organization-membership-DSqmZLkN.cjs';
+
+/** One compatibility boundary for project-controlled authentication UI. */
+type ProjectCapabilities = {
+    emailSignUp: boolean;
+    passwordSignUp: boolean;
+    phoneSignUp: boolean;
+    passwordSignIn: boolean;
+    passwordMinLength: number;
+    passwordMaxLength: number;
+    magicLinkSignIn: boolean;
+    emailOtpSignIn: boolean;
+    phoneSignIn: boolean;
+    usernameSignIn: boolean;
+    collectUsername: boolean;
+    passkeySignIn: boolean;
+    passkeyAdd: boolean;
+    firstLastName: boolean;
+    emailChange: boolean;
+    accountDeletion: boolean;
+    emailVerificationRequired: boolean;
+    emailVerificationMethod: 'link' | 'code';
+    totp: boolean;
+    mfaRequired: boolean;
+    backupCodes: boolean;
+    /** Preserve the pre-plan-35 display-name field only for an older server. */
+    legacyNameField: boolean;
+};
+/**
+ * Resolve current and legacy public-config shapes once, rather than spreading
+ * compatibility checks through each platform's components.
+ */
+declare function resolveProjectCapabilities(config: PublicConfig | null): ProjectCapabilities;
+
+declare const AUTH_CHALLENGE_HEADER = "x-authowl-turnstile-token";
+/**
+ * The language this request is being conducted in.
+ *
+ * Advisory: a server that does not know it ignores it, and one that does
+ * falls back to the project default for anything it has no catalogue for.
+ */
+declare const AUTH_LOCALE_HEADER = "x-authowl-locale";
+type ResponseDecoder<T> = (value: unknown) => T;
+type AuthHttpRequest<T = unknown> = {
+    method?: 'GET' | 'POST' | 'PATCH';
+    body?: unknown;
+    query?: Record<string, string | number | boolean | undefined>;
+    fetchOptions?: ActionFetchOptions;
+    decode?: ResponseDecoder<T>;
+    credentials?: RequestCredentials;
+};
+interface AuthHttpClient {
+    request<T>(path: string, options?: AuthHttpRequest<T>): Promise<AuthActionResult<T>>;
+}
+declare function createAuthHttpClient(config: ResolvedAuthConfig, baseURL?: string): AuthHttpClient;
+
+/** Create a cryptographically random RFC 4122 v4 key for retry-safe write actions. */
+declare function createIdempotencyKey(): string;
+
+export { type AuthHttpClient as A, type ProjectCapabilities as P, createIdempotencyKey as a, AUTH_CHALLENGE_HEADER as b, createAuthHttpClient as c, AUTH_LOCALE_HEADER as d, resolveProjectCapabilities as r };

package/dist/{index-hIdXOzRp.d.ts → index-DgVPDEYx.d.cts}

@@ -12,4 +12,4 @@ declare function directionFor(locale: Locale): 'ltr' | 'rtl';
 /** Narrow an arbitrary string (e.g. public-config `locale`) to a supported Locale. */
 declare function isLocale(value: unknown): value is Locale;
 
-export { LOCALES as L, type Locale as a, directionFor as d, isLocale as i };
+export { type Locale as L, LOCALES as a, directionFor as d, isLocale as i };

package/dist/{index-hIdXOzRp.d.cts → index-DgVPDEYx.d.ts}

@@ -12,4 +12,4 @@ declare function directionFor(locale: Locale): 'ltr' | 'rtl';
 /** Narrow an arbitrary string (e.g. public-config `locale`) to a supported Locale. */
 declare function isLocale(value: unknown): value is Locale;
 
-export { LOCALES as L, type Locale as a, directionFor as d, isLocale as i };
+export { type Locale as L, LOCALES as a, directionFor as d, isLocale as i };