@authowl/core 0.22.1 → 0.23.0

package/dist/native.d.ts

@@ -1,10 +1,9 @@
-import { R as ResolvedAuthConfig, A as AuthConfig } from './organization-membership-BIify9hZ.js';
-export { D as DecodedPublishableKey, H as HasParams, O as OrganizationMembership, c as createMembershipHas, d as decodePublishableKey, r as resolveConfig } from './organization-membership-BIify9hZ.js';
-import { b as AuthOwlClient, S as SocialIdTokenOptions, c as PasskeySignInOptions, A as ActionFetchOptions, a as AuthActionResult, d as PasskeyAuthData, e as AddPasskeyOptions, f as AuthPasskey } from './client-DXypEWpf.js';
-export { g as AuthClientError, h as AuthSession, i as AuthUser, C as CreatePrivacyRightsRequestOptions, O as Organization, j as OrganizationClient, k as OrganizationDetails, l as PrivacyClient, m as PrivacyConsentPreference, n as PrivacyConsentState, o as PrivacyLocale, p as PrivacyRightState, q as PrivacyRightType, r as PrivacyRightsRequest, P as PublicConfig, R as RecordPrivacyConsentOptions, s as SessionState, t as SessionStore, u as SetActiveOrganizationOptions, v as SocialAuthData, w as getPublicConfig } from './client-DXypEWpf.js';
-import { c as createAuthHttpClient, A as AuthHttpClient } from './idempotency-BWMPd3B7.js';
-export { P as ProjectCapabilities, a as createIdempotencyKey, r as resolveProjectCapabilities } from './idempotency-BWMPd3B7.js';
+import { b as AuthOwlClient, S as SocialIdTokenOptions, R as ResolvedAuthConfig, P as PasskeySignInOptions, A as ActionFetchOptions, a as AuthActionResult, c as PasskeyAuthData, d as AddPasskeyOptions, e as AuthPasskey, f as AuthConfig } from './config-CyUwyJ9B.js';
+export { g as AuthClientError, h as AuthSession, i as AuthUser, C as CreatePrivacyRightsRequestOptions, D as DecodedPublishableKey, H as HasParams, O as Organization, j as OrganizationClient, k as OrganizationDetails, l as OrganizationMembership, m as PrivacyClient, n as PrivacyConsentPreference, o as PrivacyConsentState, p as PrivacyLocale, q as PrivacyRightState, r as PrivacyRightType, s as PrivacyRightsRequest, t as RecordPrivacyConsentOptions, u as SessionState, v as SessionStore, w as SetActiveOrganizationOptions, x as SocialAuthData, y as createMembershipHas, z as decodePublishableKey, B as resolveConfig } from './config-CyUwyJ9B.js';
+import { c as createAuthHttpClient, A as AuthHttpClient } from './idempotency-fDhUiiGz.js';
+export { P as ProjectCapabilities, a as createIdempotencyKey, r as resolveProjectCapabilities } from './idempotency-fDhUiiGz.js';
 import { startAuthentication, startRegistration } from '@simplewebauthn/browser';
+export { P as PublicConfig, g as getPublicConfig } from './public-config-Drxchm7N.js';
 export { a as LOCALES, L as Locale, d as directionFor, i as isLocale } from './index-DgVPDEYx.js';
 export { buildPrivacySignUpEvidence } from './privacy.js';
 export { s as sessionCookieName } from './cookie-BqcfagTw.js';
@@ -24,7 +23,7 @@ interface PasskeyCeremonyClient {
     signIn: AuthActionClient['signIn']['passkey'];
     add: AuthActionClient['passkey']['addPasskey'];
 }
-type PasskeyCeremonyClientFactory = (http: ReturnType<typeof createAuthHttpClient>, sessionChanged: () => void) => PasskeyCeremonyClient;
+type PasskeyCeremonyClientFactory = (http: ReturnType<typeof createAuthHttpClient>, sessionChanged: () => void | Promise<void>) => PasskeyCeremonyClient;
 /**
  * Auth actions that can execute without browser navigation or WebAuthn.
  *
@@ -118,7 +117,7 @@ interface PasskeyCeremony {
      */
     errorCode?(error: unknown): string | undefined;
 }
-declare function createPasskeyClient(http: AuthHttpClient, sessionChanged: () => void, ceremony: PasskeyCeremony): {
+declare function createPasskeyClient(http: AuthHttpClient, sessionChanged: () => void | Promise<void>, ceremony: PasskeyCeremony): {
     signIn(options?: PasskeySignInOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<PasskeyAuthData>>;
     add(options?: AddPasskeyOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AuthPasskey>>;
 };

package/dist/native.js

@@ -1 +1 @@
-import {l}from'./chunk-DVVGVPDH.js';export{l as createNativeAuthClient,m as createPasskeyClient,n as getPublicConfig,a as resolveProjectCapabilities}from'./chunk-DVVGVPDH.js';export{a as LOCALES,b as directionFor,c as isLocale}from'./chunk-M4QJVSXT.js';export{a as buildPrivacySignUpEvidence}from'./chunk-MW6RNUTR.js';export{a as createIdempotencyKey}from'./chunk-5NL5GJW6.js';import {n}from'./chunk-IB6TFQFD.js';export{F as createMembershipHas,a as decodePublishableKey,n as resolveConfig,b as sessionCookieName}from'./chunk-IB6TFQFD.js';import'./chunk-T5SH3ZZP.js';function P(i,o){return l(n(i),o)}export{P as createNativeClient};
+import {l}from'./chunk-LBCOMERN.js';export{l as createNativeAuthClient,m as createPasskeyClient,n as getPublicConfig,a as resolveProjectCapabilities}from'./chunk-LBCOMERN.js';export{a as LOCALES,b as directionFor,c as isLocale}from'./chunk-M4QJVSXT.js';export{a as buildPrivacySignUpEvidence}from'./chunk-MW6RNUTR.js';export{a as createIdempotencyKey}from'./chunk-5NL5GJW6.js';import {o}from'./chunk-YL2FF2VS.js';export{G as createMembershipHas,a as decodePublishableKey,o as resolveConfig,b as sessionCookieName}from'./chunk-YL2FF2VS.js';import'./chunk-T5SH3ZZP.js';function P(i,o$1){return l(o(i),o$1)}export{P as createNativeClient};

package/dist/privacy.d.cts

@@ -1,5 +1,5 @@
-import { P as PublicConfig, o as PrivacyLocale } from './client-BwZ1bqU4.cjs';
-import './organization-membership-BIify9hZ.cjs';
+import { P as PublicConfig } from './public-config-DojOd5F7.cjs';
+import { p as PrivacyLocale } from './config-CyUwyJ9B.cjs';
 
 type PrivacyPublicConfig = NonNullable<PublicConfig['privacy']>;
 /**

package/dist/privacy.d.ts

@@ -1,5 +1,5 @@
-import { P as PublicConfig, o as PrivacyLocale } from './client-DXypEWpf.js';
-import './organization-membership-BIify9hZ.js';
+import { P as PublicConfig } from './public-config-Drxchm7N.js';
+import { p as PrivacyLocale } from './config-CyUwyJ9B.js';
 
 type PrivacyPublicConfig = NonNullable<PublicConfig['privacy']>;
 /**

package/dist/public-config-DojOd5F7.d.cts

@@ -0,0 +1,241 @@
+import { R as ResolvedAuthConfig } from './config-CyUwyJ9B.cjs';
+
+type EnvironmentType = 'development' | 'production';
+/**
+ * The public, publishable-key-safe project config the SDK renders its sign-in
+ * UI from (server contract CONTRACTS §2, `GET /api/projects/:id/public-config`).
+ * Nothing here is secret. Method slugs are canonical snake_case.
+ */
+/**
+ * A project's configured bot challenge.
+ *
+ * `provider` is deliberately a plain string rather than a union of the ones this
+ * SDK can render. A project may be switched to a provider that predates the
+ * copy of the SDK an application is running, and the difference between
+ * "no challenge configured" and "a challenge this build cannot render" is the
+ * difference between signing in and a silent 403 the user cannot act on. Keeping
+ * the slug lets the renderer say which provider it does not know.
+ */
+interface CaptchaConfig {
+    provider: string;
+    siteKey: string;
+}
+type PublicConfig = {
+    /** Stable workspace product container shared by its environments. */
+    applicationId: string;
+    /** Stable tenant id for the exact environment selected by the publishable key. */
+    environmentId: string;
+    /** Environment class that determines key prefixes and billing treatment. */
+    environmentType: EnvironmentType;
+    /**
+     * Authentication endpoint used by this SDK instance. Hosted portals and
+     * custom domains keep this same-origin even when the stable JWT issuer uses
+     * the platform's canonical origin.
+     */
+    authBaseUrl: string;
+    /**
+     * Public acquisition mode. Optional only for rolling compatibility with
+     * servers released before waitlist support.
+     */
+    signUp?: {
+        mode: 'open' | 'restricted' | 'allowlist' | 'waitlist';
+    };
+    /**
+     * Identity and credential lifecycle policy. Optional only for rolling
+     * compatibility with AuthOwl servers released before plan 35.
+     */
+    authentication?: {
+        email: {
+            signUp: boolean;
+            signIn: Array<'password' | 'magic_link' | 'email_otp'>;
+        };
+        phone: {
+            signUp: boolean;
+            signIn: boolean;
+        };
+        password: {
+            signUp: boolean;
+            add: boolean;
+            /** Server-owned password length policy. Optional for rolling compatibility. */
+            minLength?: number;
+            maxLength?: number;
+        };
+        passkey: {
+            signIn: boolean;
+            add: boolean;
+            /**
+             * The domain this environment binds passkeys to. Absent or null means the
+             * server derives it from the auth host, which is what every server before
+             * this field did - so treating both the same keeps a new SDK correct
+             * against an older server.
+             */
+            relyingPartyId?: string | null;
+        };
+        username: {
+            collectOnSignUp: boolean;
+            signIn: boolean;
+        };
+    };
+    /** Email ownership ceremony selected by the project. */
+    emailVerification?: {
+        required: boolean;
+        method: 'link' | 'code';
+    };
+    /** End-user profile fields and self-service permissions. */
+    userModel?: {
+        requireEmail: boolean;
+        firstLastName: boolean;
+        emailChange: boolean;
+        accountDeletion: boolean;
+    };
+    /**
+     * MFA presentation contract. Backup codes follow TOTP and are not an
+     * independently configurable authentication method.
+     */
+    mfa?: {
+        totp: boolean;
+        required: boolean;
+        backupCodes: boolean;
+        /** Whether an emailed code may recover a TOTP challenge. Defaults to true for older servers. */
+        emailOtpFallback?: boolean;
+        /** Whether a successful challenge may remember this browser. Defaults to true for older servers. */
+        trustDevice?: boolean;
+    };
+    branding: {
+        appName?: string;
+        logoUrl?: string;
+        /** Whether the application name is visible beside the logo. */
+        showAppName?: boolean;
+        /** Alignment of the brand identity within managed component headers. */
+        alignment?: 'left' | 'center' | 'right';
+        primaryColor?: string;
+        theme?: 'light' | 'dark' | 'system';
+    };
+    /** Canonical method slugs, e.g. "password", "magic_link", "passkey". */
+    enabledMethods: string[];
+    /** Configured social provider ids, e.g. "google". */
+    socialProviders: string[];
+    /**
+     * Public OAuth client ids keyed by provider. Optional for rolling compatibility
+     * with servers released before Google One Tap support.
+     */
+    socialProviderClientIds?: Record<string, string>;
+    /**
+     * When true, an email/password sign-up does not create a session - the user
+     * must confirm their address first. <SignUp/> shows a "check your email" state
+     * instead of redirecting. Always false unless password sign-up is enabled.
+     */
+    requireEmailVerification: boolean;
+    /**
+     * Legal consent gate. When `required`, <SignUp/> shows an acceptance checkbox
+     * linking `termsUrl`/`privacyUrl` and blocks sign-up until it's checked, echoing
+     * `version` back so the server records and enforces it. `required` is true only
+     * when the project both requires consent and has a document URL to link.
+     */
+    legal: {
+        termsUrl?: string;
+        privacyUrl?: string;
+        version: number;
+        required: boolean;
+    };
+    /** Published, bilingual privacy notices and optional consent purposes. */
+    privacy?: {
+        notices: Array<{
+            noticeId: string;
+            noticeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            body: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            purposeCodes: string[];
+            effectiveFrom: string;
+        }>;
+        consentPurposes: Array<{
+            purposeId: string;
+            purposeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            description: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            dataCategories: string[];
+        }>;
+    };
+    /**
+     * Whether the project lets signed-in users enrol a second factor (TOTP). A
+     * capability flag, not a sign-in method (so it's absent from `enabledMethods`):
+     * gate an "enable two-factor" affordance / <MFAEnrollment/> on it. The sign-in
+     * 2FA challenge is handled by <SignIn/> regardless of this flag.
+     */
+    twoFactor: boolean;
+    /** Whether enrolled MFA is mandatory rather than optional for this project. */
+    mfaRequired: boolean;
+    /** Whether signed-in users may delete their own account. */
+    accountDeletion: boolean;
+    /** Whether organization routes and components are available for this project. */
+    organizations: boolean;
+    /**
+     * Whether inbound enterprise SSO is enabled for this project. SSO IS a sign-in
+     * method, so when true the server also pushes `'sso'` into `enabledMethods`;
+     * this flag mirrors the server capability (matching the `twoFactor`
+     * convention). <SignIn/> gates the SSO affordance on `enabledMethods`, not on
+     * this flag, so the two never drift.
+     */
+    sso: boolean;
+    /**
+     * JWT issuer (server contract CONTRACTS §8). Non-null only when the project's
+     * issuer toggle is on: exactly what a third-party verifier needs (Convex
+     * `auth.config.ts` = `{ type: "customJwt", issuer, jwks: jwksUrl,
+     * applicationID: aud, algorithm: "ES256" }`). The issuer remains stable when
+     * `authBaseUrl` follows a hosted or custom account-portal origin.
+     */
+    jwtIssuer: {
+        issuer: string;
+        jwksUrl: string;
+        aud: string;
+    } | null;
+    /**
+     * The bot challenge a project has configured, provider-agnostic.
+     *
+     * Prefer this over the two Turnstile fields below, which predate provider
+     * choice and remain populated whenever the provider IS Turnstile.
+     */
+    captcha: CaptchaConfig | null;
+    /** Public Cloudflare Turnstile site key for the phone OTP challenge. */
+    turnstileSiteKey: string | null;
+    /** Public Cloudflare Turnstile site key for protected sign-up/sign-in actions. */
+    authTurnstileSiteKey: string | null;
+    locale: string;
+    badge: boolean;
+    configVersion: number;
+};
+/**
+ * Fetch a project's public config. Publishable-key gated server-side; sent
+ * without cookies (the payload is public, so no session is needed). Throws on a
+ * non-2xx response so the caller can distinguish "config unavailable" from a
+ * project that simply has a method disabled.
+ */
+declare function getPublicConfig(config: ResolvedAuthConfig): Promise<PublicConfig>;
+
+export { type EnvironmentType as E, type PublicConfig as P, getPublicConfig as g };

package/dist/public-config-Drxchm7N.d.ts

@@ -0,0 +1,241 @@
+import { R as ResolvedAuthConfig } from './config-CyUwyJ9B.js';
+
+type EnvironmentType = 'development' | 'production';
+/**
+ * The public, publishable-key-safe project config the SDK renders its sign-in
+ * UI from (server contract CONTRACTS §2, `GET /api/projects/:id/public-config`).
+ * Nothing here is secret. Method slugs are canonical snake_case.
+ */
+/**
+ * A project's configured bot challenge.
+ *
+ * `provider` is deliberately a plain string rather than a union of the ones this
+ * SDK can render. A project may be switched to a provider that predates the
+ * copy of the SDK an application is running, and the difference between
+ * "no challenge configured" and "a challenge this build cannot render" is the
+ * difference between signing in and a silent 403 the user cannot act on. Keeping
+ * the slug lets the renderer say which provider it does not know.
+ */
+interface CaptchaConfig {
+    provider: string;
+    siteKey: string;
+}
+type PublicConfig = {
+    /** Stable workspace product container shared by its environments. */
+    applicationId: string;
+    /** Stable tenant id for the exact environment selected by the publishable key. */
+    environmentId: string;
+    /** Environment class that determines key prefixes and billing treatment. */
+    environmentType: EnvironmentType;
+    /**
+     * Authentication endpoint used by this SDK instance. Hosted portals and
+     * custom domains keep this same-origin even when the stable JWT issuer uses
+     * the platform's canonical origin.
+     */
+    authBaseUrl: string;
+    /**
+     * Public acquisition mode. Optional only for rolling compatibility with
+     * servers released before waitlist support.
+     */
+    signUp?: {
+        mode: 'open' | 'restricted' | 'allowlist' | 'waitlist';
+    };
+    /**
+     * Identity and credential lifecycle policy. Optional only for rolling
+     * compatibility with AuthOwl servers released before plan 35.
+     */
+    authentication?: {
+        email: {
+            signUp: boolean;
+            signIn: Array<'password' | 'magic_link' | 'email_otp'>;
+        };
+        phone: {
+            signUp: boolean;
+            signIn: boolean;
+        };
+        password: {
+            signUp: boolean;
+            add: boolean;
+            /** Server-owned password length policy. Optional for rolling compatibility. */
+            minLength?: number;
+            maxLength?: number;
+        };
+        passkey: {
+            signIn: boolean;
+            add: boolean;
+            /**
+             * The domain this environment binds passkeys to. Absent or null means the
+             * server derives it from the auth host, which is what every server before
+             * this field did - so treating both the same keeps a new SDK correct
+             * against an older server.
+             */
+            relyingPartyId?: string | null;
+        };
+        username: {
+            collectOnSignUp: boolean;
+            signIn: boolean;
+        };
+    };
+    /** Email ownership ceremony selected by the project. */
+    emailVerification?: {
+        required: boolean;
+        method: 'link' | 'code';
+    };
+    /** End-user profile fields and self-service permissions. */
+    userModel?: {
+        requireEmail: boolean;
+        firstLastName: boolean;
+        emailChange: boolean;
+        accountDeletion: boolean;
+    };
+    /**
+     * MFA presentation contract. Backup codes follow TOTP and are not an
+     * independently configurable authentication method.
+     */
+    mfa?: {
+        totp: boolean;
+        required: boolean;
+        backupCodes: boolean;
+        /** Whether an emailed code may recover a TOTP challenge. Defaults to true for older servers. */
+        emailOtpFallback?: boolean;
+        /** Whether a successful challenge may remember this browser. Defaults to true for older servers. */
+        trustDevice?: boolean;
+    };
+    branding: {
+        appName?: string;
+        logoUrl?: string;
+        /** Whether the application name is visible beside the logo. */
+        showAppName?: boolean;
+        /** Alignment of the brand identity within managed component headers. */
+        alignment?: 'left' | 'center' | 'right';
+        primaryColor?: string;
+        theme?: 'light' | 'dark' | 'system';
+    };
+    /** Canonical method slugs, e.g. "password", "magic_link", "passkey". */
+    enabledMethods: string[];
+    /** Configured social provider ids, e.g. "google". */
+    socialProviders: string[];
+    /**
+     * Public OAuth client ids keyed by provider. Optional for rolling compatibility
+     * with servers released before Google One Tap support.
+     */
+    socialProviderClientIds?: Record<string, string>;
+    /**
+     * When true, an email/password sign-up does not create a session - the user
+     * must confirm their address first. <SignUp/> shows a "check your email" state
+     * instead of redirecting. Always false unless password sign-up is enabled.
+     */
+    requireEmailVerification: boolean;
+    /**
+     * Legal consent gate. When `required`, <SignUp/> shows an acceptance checkbox
+     * linking `termsUrl`/`privacyUrl` and blocks sign-up until it's checked, echoing
+     * `version` back so the server records and enforces it. `required` is true only
+     * when the project both requires consent and has a document URL to link.
+     */
+    legal: {
+        termsUrl?: string;
+        privacyUrl?: string;
+        version: number;
+        required: boolean;
+    };
+    /** Published, bilingual privacy notices and optional consent purposes. */
+    privacy?: {
+        notices: Array<{
+            noticeId: string;
+            noticeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            body: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            purposeCodes: string[];
+            effectiveFrom: string;
+        }>;
+        consentPurposes: Array<{
+            purposeId: string;
+            purposeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            description: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            dataCategories: string[];
+        }>;
+    };
+    /**
+     * Whether the project lets signed-in users enrol a second factor (TOTP). A
+     * capability flag, not a sign-in method (so it's absent from `enabledMethods`):
+     * gate an "enable two-factor" affordance / <MFAEnrollment/> on it. The sign-in
+     * 2FA challenge is handled by <SignIn/> regardless of this flag.
+     */
+    twoFactor: boolean;
+    /** Whether enrolled MFA is mandatory rather than optional for this project. */
+    mfaRequired: boolean;
+    /** Whether signed-in users may delete their own account. */
+    accountDeletion: boolean;
+    /** Whether organization routes and components are available for this project. */
+    organizations: boolean;
+    /**
+     * Whether inbound enterprise SSO is enabled for this project. SSO IS a sign-in
+     * method, so when true the server also pushes `'sso'` into `enabledMethods`;
+     * this flag mirrors the server capability (matching the `twoFactor`
+     * convention). <SignIn/> gates the SSO affordance on `enabledMethods`, not on
+     * this flag, so the two never drift.
+     */
+    sso: boolean;
+    /**
+     * JWT issuer (server contract CONTRACTS §8). Non-null only when the project's
+     * issuer toggle is on: exactly what a third-party verifier needs (Convex
+     * `auth.config.ts` = `{ type: "customJwt", issuer, jwks: jwksUrl,
+     * applicationID: aud, algorithm: "ES256" }`). The issuer remains stable when
+     * `authBaseUrl` follows a hosted or custom account-portal origin.
+     */
+    jwtIssuer: {
+        issuer: string;
+        jwksUrl: string;
+        aud: string;
+    } | null;
+    /**
+     * The bot challenge a project has configured, provider-agnostic.
+     *
+     * Prefer this over the two Turnstile fields below, which predate provider
+     * choice and remain populated whenever the provider IS Turnstile.
+     */
+    captcha: CaptchaConfig | null;
+    /** Public Cloudflare Turnstile site key for the phone OTP challenge. */
+    turnstileSiteKey: string | null;
+    /** Public Cloudflare Turnstile site key for protected sign-up/sign-in actions. */
+    authTurnstileSiteKey: string | null;
+    locale: string;
+    badge: boolean;
+    configVersion: number;
+};
+/**
+ * Fetch a project's public config. Publishable-key gated server-side; sent
+ * without cookies (the payload is public, so no session is needed). Throws on a
+ * non-2xx response so the caller can distinguish "config unavailable" from a
+ * project that simply has a method disabled.
+ */
+declare function getPublicConfig(config: ResolvedAuthConfig): Promise<PublicConfig>;
+
+export { type EnvironmentType as E, type PublicConfig as P, getPublicConfig as g };