@authowl/core 0.22.1 → 0.24.0

package/dist/public-config-BfuiC8Ph.d.ts

@@ -0,0 +1,241 @@
+import { R as ResolvedAuthConfig } from './config-ZhNp65dI.js';
+
+type EnvironmentType = 'development' | 'production';
+/**
+ * The public, publishable-key-safe project config the SDK renders its sign-in
+ * UI from (server contract CONTRACTS §2, `GET /api/projects/:id/public-config`).
+ * Nothing here is secret. Method slugs are canonical snake_case.
+ */
+/**
+ * A project's configured bot challenge.
+ *
+ * `provider` is deliberately a plain string rather than a union of the ones this
+ * SDK can render. A project may be switched to a provider that predates the
+ * copy of the SDK an application is running, and the difference between
+ * "no challenge configured" and "a challenge this build cannot render" is the
+ * difference between signing in and a silent 403 the user cannot act on. Keeping
+ * the slug lets the renderer say which provider it does not know.
+ */
+interface CaptchaConfig {
+    provider: string;
+    siteKey: string;
+}
+type PublicConfig = {
+    /** Stable workspace product container shared by its environments. */
+    applicationId: string;
+    /** Stable tenant id for the exact environment selected by the publishable key. */
+    environmentId: string;
+    /** Environment class that determines key prefixes and billing treatment. */
+    environmentType: EnvironmentType;
+    /**
+     * Authentication endpoint used by this SDK instance. Hosted portals and
+     * custom domains keep this same-origin even when the stable JWT issuer uses
+     * the platform's canonical origin.
+     */
+    authBaseUrl: string;
+    /**
+     * Public acquisition mode. Optional only for rolling compatibility with
+     * servers released before waitlist support.
+     */
+    signUp?: {
+        mode: 'open' | 'restricted' | 'allowlist' | 'waitlist';
+    };
+    /**
+     * Identity and credential lifecycle policy. Optional only for rolling
+     * compatibility with AuthOwl servers released before plan 35.
+     */
+    authentication?: {
+        email: {
+            signUp: boolean;
+            signIn: Array<'password' | 'magic_link' | 'email_otp'>;
+        };
+        phone: {
+            signUp: boolean;
+            signIn: boolean;
+        };
+        password: {
+            signUp: boolean;
+            add: boolean;
+            /** Server-owned password length policy. Optional for rolling compatibility. */
+            minLength?: number;
+            maxLength?: number;
+        };
+        passkey: {
+            signIn: boolean;
+            add: boolean;
+            /**
+             * The domain this environment binds passkeys to. Absent or null means the
+             * server derives it from the auth host, which is what every server before
+             * this field did - so treating both the same keeps a new SDK correct
+             * against an older server.
+             */
+            relyingPartyId?: string | null;
+        };
+        username: {
+            collectOnSignUp: boolean;
+            signIn: boolean;
+        };
+    };
+    /** Email ownership ceremony selected by the project. */
+    emailVerification?: {
+        required: boolean;
+        method: 'link' | 'code';
+    };
+    /** End-user profile fields and self-service permissions. */
+    userModel?: {
+        requireEmail: boolean;
+        firstLastName: boolean;
+        emailChange: boolean;
+        accountDeletion: boolean;
+    };
+    /**
+     * MFA presentation contract. Backup codes follow TOTP and are not an
+     * independently configurable authentication method.
+     */
+    mfa?: {
+        totp: boolean;
+        required: boolean;
+        backupCodes: boolean;
+        /** Whether an emailed code may recover a TOTP challenge. Defaults to true for older servers. */
+        emailOtpFallback?: boolean;
+        /** Whether a successful challenge may remember this browser. Defaults to true for older servers. */
+        trustDevice?: boolean;
+    };
+    branding: {
+        appName?: string;
+        logoUrl?: string;
+        /** Whether the application name is visible beside the logo. */
+        showAppName?: boolean;
+        /** Alignment of the brand identity within managed component headers. */
+        alignment?: 'left' | 'center' | 'right';
+        primaryColor?: string;
+        theme?: 'light' | 'dark' | 'system';
+    };
+    /** Canonical method slugs, e.g. "password", "magic_link", "passkey". */
+    enabledMethods: string[];
+    /** Configured social provider ids, e.g. "google". */
+    socialProviders: string[];
+    /**
+     * Public OAuth client ids keyed by provider. Optional for rolling compatibility
+     * with servers released before Google One Tap support.
+     */
+    socialProviderClientIds?: Record<string, string>;
+    /**
+     * When true, an email/password sign-up does not create a session - the user
+     * must confirm their address first. <SignUp/> shows a "check your email" state
+     * instead of redirecting. Always false unless password sign-up is enabled.
+     */
+    requireEmailVerification: boolean;
+    /**
+     * Legal consent gate. When `required`, <SignUp/> shows an acceptance checkbox
+     * linking `termsUrl`/`privacyUrl` and blocks sign-up until it's checked, echoing
+     * `version` back so the server records and enforces it. `required` is true only
+     * when the project both requires consent and has a document URL to link.
+     */
+    legal: {
+        termsUrl?: string;
+        privacyUrl?: string;
+        version: number;
+        required: boolean;
+    };
+    /** Published, bilingual privacy notices and optional consent purposes. */
+    privacy?: {
+        notices: Array<{
+            noticeId: string;
+            noticeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            body: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            purposeCodes: string[];
+            effectiveFrom: string;
+        }>;
+        consentPurposes: Array<{
+            purposeId: string;
+            purposeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            description: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            dataCategories: string[];
+        }>;
+    };
+    /**
+     * Whether the project lets signed-in users enrol a second factor (TOTP). A
+     * capability flag, not a sign-in method (so it's absent from `enabledMethods`):
+     * gate an "enable two-factor" affordance / <MFAEnrollment/> on it. The sign-in
+     * 2FA challenge is handled by <SignIn/> regardless of this flag.
+     */
+    twoFactor: boolean;
+    /** Whether enrolled MFA is mandatory rather than optional for this project. */
+    mfaRequired: boolean;
+    /** Whether signed-in users may delete their own account. */
+    accountDeletion: boolean;
+    /** Whether organization routes and components are available for this project. */
+    organizations: boolean;
+    /**
+     * Whether inbound enterprise SSO is enabled for this project. SSO IS a sign-in
+     * method, so when true the server also pushes `'sso'` into `enabledMethods`;
+     * this flag mirrors the server capability (matching the `twoFactor`
+     * convention). <SignIn/> gates the SSO affordance on `enabledMethods`, not on
+     * this flag, so the two never drift.
+     */
+    sso: boolean;
+    /**
+     * JWT issuer (server contract CONTRACTS §8). Non-null only when the project's
+     * issuer toggle is on: exactly what a third-party verifier needs (Convex
+     * `auth.config.ts` = `{ type: "customJwt", issuer, jwks: jwksUrl,
+     * applicationID: aud, algorithm: "ES256" }`). The issuer remains stable when
+     * `authBaseUrl` follows a hosted or custom account-portal origin.
+     */
+    jwtIssuer: {
+        issuer: string;
+        jwksUrl: string;
+        aud: string;
+    } | null;
+    /**
+     * The bot challenge a project has configured, provider-agnostic.
+     *
+     * Prefer this over the two Turnstile fields below, which predate provider
+     * choice and remain populated whenever the provider IS Turnstile.
+     */
+    captcha: CaptchaConfig | null;
+    /** Public Cloudflare Turnstile site key for the phone OTP challenge. */
+    turnstileSiteKey: string | null;
+    /** Public Cloudflare Turnstile site key for protected sign-up/sign-in actions. */
+    authTurnstileSiteKey: string | null;
+    locale: string;
+    badge: boolean;
+    configVersion: number;
+};
+/**
+ * Fetch a project's public config. Publishable-key gated server-side; sent
+ * without cookies (the payload is public, so no session is needed). Throws on a
+ * non-2xx response so the caller can distinguish "config unavailable" from a
+ * project that simply has a method disabled.
+ */
+declare function getPublicConfig(config: ResolvedAuthConfig): Promise<PublicConfig>;
+
+export { type EnvironmentType as E, type PublicConfig as P, getPublicConfig as g };

package/dist/public-config-DdTDwDF7.d.cts

@@ -0,0 +1,241 @@
+import { R as ResolvedAuthConfig } from './config-ZhNp65dI.cjs';
+
+type EnvironmentType = 'development' | 'production';
+/**
+ * The public, publishable-key-safe project config the SDK renders its sign-in
+ * UI from (server contract CONTRACTS §2, `GET /api/projects/:id/public-config`).
+ * Nothing here is secret. Method slugs are canonical snake_case.
+ */
+/**
+ * A project's configured bot challenge.
+ *
+ * `provider` is deliberately a plain string rather than a union of the ones this
+ * SDK can render. A project may be switched to a provider that predates the
+ * copy of the SDK an application is running, and the difference between
+ * "no challenge configured" and "a challenge this build cannot render" is the
+ * difference between signing in and a silent 403 the user cannot act on. Keeping
+ * the slug lets the renderer say which provider it does not know.
+ */
+interface CaptchaConfig {
+    provider: string;
+    siteKey: string;
+}
+type PublicConfig = {
+    /** Stable workspace product container shared by its environments. */
+    applicationId: string;
+    /** Stable tenant id for the exact environment selected by the publishable key. */
+    environmentId: string;
+    /** Environment class that determines key prefixes and billing treatment. */
+    environmentType: EnvironmentType;
+    /**
+     * Authentication endpoint used by this SDK instance. Hosted portals and
+     * custom domains keep this same-origin even when the stable JWT issuer uses
+     * the platform's canonical origin.
+     */
+    authBaseUrl: string;
+    /**
+     * Public acquisition mode. Optional only for rolling compatibility with
+     * servers released before waitlist support.
+     */
+    signUp?: {
+        mode: 'open' | 'restricted' | 'allowlist' | 'waitlist';
+    };
+    /**
+     * Identity and credential lifecycle policy. Optional only for rolling
+     * compatibility with AuthOwl servers released before plan 35.
+     */
+    authentication?: {
+        email: {
+            signUp: boolean;
+            signIn: Array<'password' | 'magic_link' | 'email_otp'>;
+        };
+        phone: {
+            signUp: boolean;
+            signIn: boolean;
+        };
+        password: {
+            signUp: boolean;
+            add: boolean;
+            /** Server-owned password length policy. Optional for rolling compatibility. */
+            minLength?: number;
+            maxLength?: number;
+        };
+        passkey: {
+            signIn: boolean;
+            add: boolean;
+            /**
+             * The domain this environment binds passkeys to. Absent or null means the
+             * server derives it from the auth host, which is what every server before
+             * this field did - so treating both the same keeps a new SDK correct
+             * against an older server.
+             */
+            relyingPartyId?: string | null;
+        };
+        username: {
+            collectOnSignUp: boolean;
+            signIn: boolean;
+        };
+    };
+    /** Email ownership ceremony selected by the project. */
+    emailVerification?: {
+        required: boolean;
+        method: 'link' | 'code';
+    };
+    /** End-user profile fields and self-service permissions. */
+    userModel?: {
+        requireEmail: boolean;
+        firstLastName: boolean;
+        emailChange: boolean;
+        accountDeletion: boolean;
+    };
+    /**
+     * MFA presentation contract. Backup codes follow TOTP and are not an
+     * independently configurable authentication method.
+     */
+    mfa?: {
+        totp: boolean;
+        required: boolean;
+        backupCodes: boolean;
+        /** Whether an emailed code may recover a TOTP challenge. Defaults to true for older servers. */
+        emailOtpFallback?: boolean;
+        /** Whether a successful challenge may remember this browser. Defaults to true for older servers. */
+        trustDevice?: boolean;
+    };
+    branding: {
+        appName?: string;
+        logoUrl?: string;
+        /** Whether the application name is visible beside the logo. */
+        showAppName?: boolean;
+        /** Alignment of the brand identity within managed component headers. */
+        alignment?: 'left' | 'center' | 'right';
+        primaryColor?: string;
+        theme?: 'light' | 'dark' | 'system';
+    };
+    /** Canonical method slugs, e.g. "password", "magic_link", "passkey". */
+    enabledMethods: string[];
+    /** Configured social provider ids, e.g. "google". */
+    socialProviders: string[];
+    /**
+     * Public OAuth client ids keyed by provider. Optional for rolling compatibility
+     * with servers released before Google One Tap support.
+     */
+    socialProviderClientIds?: Record<string, string>;
+    /**
+     * When true, an email/password sign-up does not create a session - the user
+     * must confirm their address first. <SignUp/> shows a "check your email" state
+     * instead of redirecting. Always false unless password sign-up is enabled.
+     */
+    requireEmailVerification: boolean;
+    /**
+     * Legal consent gate. When `required`, <SignUp/> shows an acceptance checkbox
+     * linking `termsUrl`/`privacyUrl` and blocks sign-up until it's checked, echoing
+     * `version` back so the server records and enforces it. `required` is true only
+     * when the project both requires consent and has a document URL to link.
+     */
+    legal: {
+        termsUrl?: string;
+        privacyUrl?: string;
+        version: number;
+        required: boolean;
+    };
+    /** Published, bilingual privacy notices and optional consent purposes. */
+    privacy?: {
+        notices: Array<{
+            noticeId: string;
+            noticeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            body: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            purposeCodes: string[];
+            effectiveFrom: string;
+        }>;
+        consentPurposes: Array<{
+            purposeId: string;
+            purposeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            description: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            dataCategories: string[];
+        }>;
+    };
+    /**
+     * Whether the project lets signed-in users enrol a second factor (TOTP). A
+     * capability flag, not a sign-in method (so it's absent from `enabledMethods`):
+     * gate an "enable two-factor" affordance / <MFAEnrollment/> on it. The sign-in
+     * 2FA challenge is handled by <SignIn/> regardless of this flag.
+     */
+    twoFactor: boolean;
+    /** Whether enrolled MFA is mandatory rather than optional for this project. */
+    mfaRequired: boolean;
+    /** Whether signed-in users may delete their own account. */
+    accountDeletion: boolean;
+    /** Whether organization routes and components are available for this project. */
+    organizations: boolean;
+    /**
+     * Whether inbound enterprise SSO is enabled for this project. SSO IS a sign-in
+     * method, so when true the server also pushes `'sso'` into `enabledMethods`;
+     * this flag mirrors the server capability (matching the `twoFactor`
+     * convention). <SignIn/> gates the SSO affordance on `enabledMethods`, not on
+     * this flag, so the two never drift.
+     */
+    sso: boolean;
+    /**
+     * JWT issuer (server contract CONTRACTS §8). Non-null only when the project's
+     * issuer toggle is on: exactly what a third-party verifier needs (Convex
+     * `auth.config.ts` = `{ type: "customJwt", issuer, jwks: jwksUrl,
+     * applicationID: aud, algorithm: "ES256" }`). The issuer remains stable when
+     * `authBaseUrl` follows a hosted or custom account-portal origin.
+     */
+    jwtIssuer: {
+        issuer: string;
+        jwksUrl: string;
+        aud: string;
+    } | null;
+    /**
+     * The bot challenge a project has configured, provider-agnostic.
+     *
+     * Prefer this over the two Turnstile fields below, which predate provider
+     * choice and remain populated whenever the provider IS Turnstile.
+     */
+    captcha: CaptchaConfig | null;
+    /** Public Cloudflare Turnstile site key for the phone OTP challenge. */
+    turnstileSiteKey: string | null;
+    /** Public Cloudflare Turnstile site key for protected sign-up/sign-in actions. */
+    authTurnstileSiteKey: string | null;
+    locale: string;
+    badge: boolean;
+    configVersion: number;
+};
+/**
+ * Fetch a project's public config. Publishable-key gated server-side; sent
+ * without cookies (the payload is public, so no session is needed). Throws on a
+ * non-2xx response so the caller can distinguish "config unavailable" from a
+ * project that simply has a method disabled.
+ */
+declare function getPublicConfig(config: ResolvedAuthConfig): Promise<PublicConfig>;
+
+export { type EnvironmentType as E, type PublicConfig as P, getPublicConfig as g };