@authowl/react 0.14.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AuthOwl
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,79 @@
+# @authowl/react
+
+React provider, hooks, and drop-in components for [AuthOwl](https://authowl.dev),
+the multi-tenant auth service. Publishable-key based, zero CSS setup.
+
+```bash
+pnpm add @authowl/react
+```
+
+```tsx
+import { AuthOwlProvider, GoogleOneTap, SignIn, useUser } from '@authowl/react';
+import '@authowl/react/styles.css';
+
+function App() {
+  return (
+    <AuthOwlProvider publishableKey={import.meta.env.VITE_AUTHOWL_PK} apiUrl="https://auth.yourdomain.com">
+      <GoogleOneTap />
+      <Page />
+    </AuthOwlProvider>
+  );
+}
+
+function Page() {
+  const { user, isLoaded, isSignedIn } = useUser();
+  if (!isLoaded) return null;
+  return isSignedIn ? <p>Hi, {user.email ?? user.phoneNumber}</p> : <SignIn />;
+}
+```
+
+**Components**: `<SignIn />`, `<SignUp />`, `<PhoneOTP />`, `<SocialButtons />`, `<MagicLinkForm />`,
+`<EmailOtpForm />`, `<PasskeyButton />`, `<PasskeyManager />`, `<ForgotPassword />`,
+`<ResetPassword />`, `<VerifyEmail />`, `<VerificationPending />`, `<MFAEnrollment />`,
+`<MFAChallenge />`, `<Waitlist />`, `<ConsentGate />`, `<UserButton />`, `<SignOutButton />`,
+`<SignedIn>`/`<SignedOut>`/`<Protect>`, `<AuthOwlBadge />`, `<UserProfile />`,
+`<OrganizationSwitcher />`, `<OrganizationList />`, `<CreateOrganization />`,
+`<OrganizationProfile />`, `<GoogleOneTap />`.
+
+**Hooks**: `useUser`, `useSession`, `useSignIn`, `useSignUp`, `useSignOut`,
+`usePasskeys`, `usePasswordReset`, `useEmailVerification`, `useMFA`, `useConsent`,
+`usePublicConfig`, `useWaitlist`.
+
+When the environment's acquisition mode is `waitlist`, `<SignUp />` automatically
+renders email enrollment instead of account-creation methods. `<Waitlist />` is
+also available as a standalone surface. Both use the same public endpoint,
+privacy-safe accepted state, and action-bound Turnstile challenge.
+
+The sign-up, sign-in, and account-management components also follow the
+project's identity lifecycle policy. This includes separate sign-up and sign-in
+permissions, username sign-in, optional username and first/last-name collection,
+link or code email verification, passkey registration, email changes, account
+deletion, and TOTP backup-code availability. Existing credentials remain
+manageable even when creating another credential of that type is disabled.
+
+When phone OTP is enabled, `<SignIn />` adds the localized phone flow automatically.
+`<PhoneOTP />` is also available as a standalone surface. Production hosts must allow
+Cloudflare Turnstile's challenge script in their Content Security Policy. Local and CI
+servers use AuthOwl's documented dummy-token path when no public site key is configured.
+
+When broad auth protection is enabled, the sign-in, sign-up, magic-link, email
+OTP, password-reset, and verification components automatically run an
+action-bound Turnstile challenge. Each attempt receives a fresh single-use token,
+including retries, and provider failures are announced accessibly in English or
+Arabic. No extra component wiring is required.
+
+`<GoogleOneTap />` reads the enabled Google provider and its public OAuth client id from
+project config, renders no DOM, and does nothing for an existing session. Hosts with a
+Content Security Policy must allow Google Identity Services as documented in Google's
+[CSP guide](https://developers.google.com/identity/gsi/web/guides/get-google-api-clientid#content_security_policy).
+
+Publishable keys (`pk_test_…` in development, `pk_live_…` in production) are
+safe to embed in client code. Durable session tokens live only in `HttpOnly` +
+`Secure` + `SameSite=None` cookies. `useSession()` and `<UserProfile />` use
+token-free session ids and safe device metadata.
+
+See the full integration guide in the AuthOwl app repo (`INTEGRATION.md`).
+
+## License
+
+MIT

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,36 @@
+# Third-party notices
+
+`@authowl/react` bundles third-party components into its published `dist/`. Each
+is redistributed under its own license, with the required copyright and
+permission notices reproduced in full below, grouped by copyright holder. This
+file is generated by `scripts/gen-notices.mjs`; do not edit by hand.
+
+---
+
+## Kazuhiko Arase
+
+License: MIT
+
+```
+MIT License
+
+Copyright (c) 2009 Kazuhiko Arase
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```