@authsome/ui-core 1.7.2 → 1.8.1

package/dist/index.d.ts

@@ -40,7 +40,8 @@ interface AdminCreateAppRequest {
 }
 interface AdminCreateConnectionRequest {
     acs_url?: string;
-    app_id: string;
+    allowed_domains?: string[];
+    app_id?: string;
     attribute_mappings?: Record<string, unknown>;
     client_id?: string;
     client_secret?: string;
@@ -55,6 +56,7 @@ interface AdminCreateConnectionRequest {
     protocol: string;
     provider: string;
     sign_requests?: boolean;
+    trusted_federation?: boolean;
 }
 interface AdminCreateConnectionResponse {
     active: boolean;
@@ -148,6 +150,7 @@ interface AdminStatsResponse {
 interface AdminUpdateConnectionRequest {
     acs_url?: string;
     active?: boolean;
+    allowed_domains?: string[];
     attribute_mappings?: Record<string, unknown>;
     client_id?: string;
     client_secret?: string;
@@ -160,6 +163,7 @@ interface AdminUpdateConnectionRequest {
     metadata_url?: string;
     provider?: string;
     sign_requests?: boolean;
+    trusted_federation?: boolean;
 }
 interface AdminUpdateUserRequest {
     email_verified?: boolean;
@@ -381,6 +385,7 @@ interface CloneEnvironmentResponse {
 interface Connection {
     acs_url?: string;
     active: boolean;
+    allowed_domains?: string[];
     app_id: string;
     attribute_mappings?: Record<string, unknown>;
     client_id?: string;
@@ -401,6 +406,7 @@ interface Connection {
     provider: string;
     sign_requests?: boolean;
     sp_certificate?: string;
+    trusted_federation?: boolean;
     updated_at: string;
 }
 interface Consent {
@@ -440,6 +446,7 @@ interface CouponResponse {
 interface CreateClientRequest {
     app_id: string;
     dpop_mode?: string;
+    first_party?: boolean;
     grant_types?: string[];
     name: string;
     public?: boolean;
@@ -540,6 +547,10 @@ interface CreateWebhookRequest {
     events: string[];
     url: string;
 }
+interface CreateWebhookResponse {
+    secret: string;
+    webhook: unknown;
+}
 interface CredentialInfo {
     created_at: string;
     display_name: string;
@@ -654,6 +665,7 @@ interface EnforceSettingRequest {
     value: string;
 }
 interface EnrollRequest {
+    code?: string;
     method?: string;
     phone?: string;
 }
@@ -718,6 +730,13 @@ interface GrantConsentRequest {
     purpose: string;
     version?: string;
 }
+interface GrantView {
+    client_id: string;
+    client_name: string;
+    created_at: string;
+    scopes: string[];
+    updated_at: string;
+}
 interface GroupRef {
     $ref?: string;
     display?: string;
@@ -749,6 +768,7 @@ interface IntrospectResponse {
     env_id?: string;
     expires_at?: string;
     org_id?: string;
+    scope?: string;
     session_id?: string;
     user?: IntrospectUser;
     user_id?: string;
@@ -772,6 +792,7 @@ interface Invitation {
 }
 interface InvitationListResponse {
     invitations: Invitation[];
+    next_cursor?: string;
 }
 interface InvoiceResponse {
     currency: string;
@@ -808,6 +829,9 @@ interface ListDefinitionsResponse {
     groups: DefinitionGroup[];
     total: number;
 }
+interface ListGrantsResponse {
+    grants: GrantView[];
+}
 interface ListInvoicesResponse {
     invoices: InvoiceResponse[];
     total: number;
@@ -888,6 +912,7 @@ interface Member {
 }
 interface MemberListResponse {
     members: Member[];
+    next_cursor?: string;
 }
 interface MemberRef {
     $ref?: string;
@@ -927,6 +952,7 @@ interface OAuth2Client {
     created_at: string;
     dpop_mode?: string;
     dynamically_registered: boolean;
+    first_party: boolean;
     grant_types: string[];
     id: string;
     metadata?: Record<string, unknown>;
@@ -958,6 +984,7 @@ interface ObjectFieldDef {
     sensitive?: boolean;
 }
 interface OrgListResponse {
+    next_cursor?: string;
     organizations: Organization[];
 }
 interface Organization {
@@ -1136,6 +1163,9 @@ interface RotateClientSecretResponse {
     client_secret: string;
     id: string;
 }
+interface RotateWebhookSecretResponse {
+    secret: string;
+}
 interface SMSSendRequest {
     phone?: string;
 }
@@ -1183,6 +1213,7 @@ interface SendResponse {
 interface ServiceProviderConfig {
 }
 interface SessionListResponse {
+    next_cursor?: string;
     sessions: Record<string, unknown>[];
 }
 interface SetAppClientConfigRequest {
@@ -1303,6 +1334,7 @@ interface Team {
     updated_at: string;
 }
 interface TeamListResponse {
+    next_cursor?: string;
     teams: Team[];
 }
 interface TokenExchangeRequest {
@@ -1339,6 +1371,7 @@ interface UnlinkAuthMethodResponse {
 interface UpdateClientRequest {
     app_id?: string;
     client_id?: string;
+    first_party?: boolean;
     grant_types?: string[];
     name?: string;
     public?: boolean;
@@ -1514,6 +1547,7 @@ interface Webhook {
     env_id: string;
     events: string[];
     id: string;
+    relay_endpoint_id?: string;
     updated_at: string;
     url: string;
 }
@@ -1566,6 +1600,7 @@ type Oauth2TokenRequest = {
     device_code?: string;
     grant_type: string;
     redirect_uri?: string;
+    refresh_token?: string;
     requested_token_type?: string;
     resource?: string[];
     scope?: string;
@@ -1754,6 +1789,8 @@ interface SignupFieldConfig {
  * can auto-configure their UI without manual props.
  */
 interface ClientConfig {
+    /** Whether new accounts can be created. Defaults to true when omitted. */
+    signup_enabled?: boolean;
     version?: string;
     app_id?: string;
     branding?: {
@@ -2119,7 +2156,7 @@ declare class AuthClient$1 {
      * List SSO connections for an app (admin)
      * GET /v1/admin/sso/connections
      */
-    ssoAdminListConnections(app_id: string, token: string): Promise<AdminListConnectionsResponse>;
+    ssoAdminListConnections(token: string, app_id?: string): Promise<AdminListConnectionsResponse>;
     /**
      * Create SSO connection (admin)
      * POST /v1/admin/sso/connections
@@ -2185,6 +2222,11 @@ declare class AuthClient$1 {
      * POST /v1/admin/users/{userId}/unban
      */
     adminUnbanUser(userId: string, token: string): Promise<ApiStatusResponse>;
+    /**
+     * Unlock user (admin)
+     * POST /v1/admin/users/{userId}/unlock
+     */
+    adminUnlockUser(userId: string, token: string): Promise<ApiStatusResponse>;
     /**
      * List coupons
      * GET /v1/billing/coupons
@@ -2450,6 +2492,16 @@ declare class AuthClient$1 {
      * GET /v1/me/export
      */
     exportMyData(token: string): Promise<Record<string, unknown>>;
+    /**
+     * List my OAuth2 grants
+     * GET /v1/me/oauth/grants
+     */
+    oauth2ListMyGrants(token: string): Promise<ListGrantsResponse>;
+    /**
+     * Revoke an OAuth2 grant
+     * DELETE /v1/me/oauth/grants/{clientId}
+     */
+    oauth2RevokeMyGrant(clientId: string, token: string): Promise<void>;
     /**
      * Switch active organization
      * POST /v1/me/switch-org
@@ -2499,7 +2551,17 @@ declare class AuthClient$1 {
      * OAuth2 Authorization
      * GET /v1/oauth/authorize
      */
-    oauth2Authorize(response_type: string, client_id: string, redirect_uri?: string, scope?: string, state?: string, code_challenge?: string, code_challenge_method?: string, resource?: string[]): Promise<void>;
+    oauth2Authorize(response_type: string, client_id: string, redirect_uri?: string, scope?: string, state?: string, code_challenge?: string, code_challenge_method?: string, resource?: string[], prompt?: string): Promise<void>;
+    /**
+     * OAuth2 consent
+     * GET /v1/oauth/consent
+     */
+    oauth2ConsentPage(token: string): Promise<void>;
+    /**
+     * OAuth2 consent decision
+     * POST /v1/oauth/consent
+     */
+    oauth2ConsentDecision(token: string): Promise<void>;
     /**
      * Device Authorization
      * POST /v1/oauth/device/authorize
@@ -2549,7 +2611,7 @@ declare class AuthClient$1 {
      * List organizations
      * GET /v1/orgs
      */
-    listOrganizations(token: string): Promise<OrgListResponse>;
+    listOrganizations(token: string, limit?: number, cursor?: string): Promise<OrgListResponse>;
     /**
      * Create organization
      * POST /v1/orgs
@@ -2589,7 +2651,7 @@ declare class AuthClient$1 {
      * List invitations
      * GET /v1/orgs/{orgId}/invitations
      */
-    listInvitations(orgId: string, token: string): Promise<InvitationListResponse>;
+    listInvitations(orgId: string, token: string, limit?: number, cursor?: string): Promise<InvitationListResponse>;
     /**
      * Create invitation
      * POST /v1/orgs/{orgId}/invitations
@@ -2599,7 +2661,7 @@ declare class AuthClient$1 {
      * List members
      * GET /v1/orgs/{orgId}/members
      */
-    listMembers(orgId: string, token: string): Promise<MemberListResponse>;
+    listMembers(orgId: string, token: string, limit?: number, cursor?: string): Promise<MemberListResponse>;
     /**
      * Add member
      * POST /v1/orgs/{orgId}/members
@@ -2619,7 +2681,7 @@ declare class AuthClient$1 {
      * List teams
      * GET /v1/orgs/{orgId}/teams
      */
-    listTeams(orgId: string, token: string): Promise<TeamListResponse>;
+    listTeams(orgId: string, token: string, limit?: number, cursor?: string): Promise<TeamListResponse>;
     /**
      * Create team
      * POST /v1/orgs/{orgId}/teams
@@ -2754,7 +2816,12 @@ declare class AuthClient$1 {
      * List sessions
      * GET /v1/sessions
      */
-    listSessions(token: string): Promise<SessionListResponse>;
+    listSessions(token: string, limit?: number, cursor?: string): Promise<SessionListResponse>;
+    /**
+     * Revoke other sessions
+     * DELETE /v1/sessions
+     */
+    revokeOtherSessions(token: string): Promise<ApiStatusResponse>;
     /**
      * Revoke session
      * DELETE /v1/sessions/{sessionId}
@@ -2849,7 +2916,7 @@ declare class AuthClient$1 {
      * Create webhook
      * POST /v1/webhooks
      */
-    createWebhook(body: CreateWebhookRequest, token: string): Promise<Webhook>;
+    createWebhook(body: CreateWebhookRequest, token: string): Promise<CreateWebhookResponse>;
     /**
      * Get webhook
      * GET /v1/webhooks/{webhookId}
@@ -2865,6 +2932,11 @@ declare class AuthClient$1 {
      * DELETE /v1/webhooks/{webhookId}
      */
     deleteWebhook(webhookId: string, token: string): Promise<ApiStatusResponse>;
+    /**
+     * Rotate webhook secret
+     * POST /v1/webhooks/{webhookId}/rotate-secret
+     */
+    rotateWebhookSecret(webhookId: string, token: string): Promise<RotateWebhookSecretResponse>;
     private request;
 }
 declare class AuthClientError extends Error {
@@ -2893,6 +2965,27 @@ interface ListResponse<T> {
     items: T[];
     total: number;
 }
+/** The organization list as the UI hooks expose it. */
+interface OrganizationList {
+    organizations: Organization[];
+    /** Cursor for the next page, when the server has more. */
+    nextCursor?: string;
+    /** How many organizations this list holds. */
+    total: number;
+}
+/**
+ * Reads a GET /v1/orgs response. The API pages the list as
+ * `{ organizations, next_cursor }`; servers before that answered
+ * `{ items, total }`. Either shape gives the same result, and anything else
+ * reads as an empty list.
+ */
+declare function readOrganizationList(res: unknown): OrganizationList;
+/** The signup decision returned by the app's waitlist. */
+type WaitlistStatus = "pending" | "approved" | "rejected";
+interface WaitlistJoinResponse {
+    email: string;
+    status: WaitlistStatus;
+}
 /**
  * AuthClient extends the auto-generated client with backward-compatible
  * convenience methods that auth.ts depends on.
@@ -2902,6 +2995,14 @@ interface ListResponse<T> {
  * the auth state machine.
  */
 declare class AuthClient extends AuthClient$1 {
+    private readonly waitlistURL;
+    private readonly waitlistFetch;
+    constructor(config: AuthClientConfig);
+    /** Join the waitlist, or return the existing entry and its approval status. */
+    joinWaitlist(body: {
+        email: string;
+        name?: string;
+    }): Promise<WaitlistJoinResponse>;
     /**
      * Refresh session tokens.
      *
@@ -2918,56 +3019,24 @@ declare class AuthClient extends AuthClient$1 {
      * than breaking callers outside this package.
      */
     signOut(bodyOrToken: unknown, token?: string): Promise<ApiStatusResponse>;
-    /**
-     * MFA challenge — bridge for auth.ts.
-     *
-     * auth.ts calls `mfaChallenge({ enrollment_id, code })` and expects
-     * an AuthResponse back.  The generated client uses `challengeMFA`.
-     */
-    mfaChallenge(body: {
+    /** @deprecated Use challengeMFA with the ticket from sign-in. */
+    mfaChallenge(body: ChallengeMFARequest | {
         enrollment_id?: string;
         code: string;
-    }): Promise<any>;
-    /**
-     * Verify an MFA recovery code.
-     *
-     * Accepts a raw code string (used by auth.ts) or the full request body.
-     */
-    verifyRecoveryCode(body: {
-        code: string;
-    } | string): Promise<any>;
-    /**
-     * Send an SMS code for MFA — bridge for auth.ts.
-     *
-     * Simplifies the call-site by accepting just the session token.
-     */
-    sendSMSCodeForMFA(token: string): Promise<any>;
-    /**
-     * Verify an SMS code for MFA — bridge for auth.ts.
-     *
-     * Simplifies the call-site by accepting code + token directly.
-     */
-    verifySMSCodeForMFA(code: string, token: string): Promise<any>;
-    /**
-     * Complete a device authorization (RFC 8628).
-     *
-     * Approves or denies a device code. Requires an authenticated session —
-     * pass the session token so the backend can identify the user.
-     */
-    completeDeviceAuthorization(userCode: string, action: "approve" | "deny", token?: string): Promise<{
-        status: string;
-    }>;
+    }): Promise<ChallengeResponse>;
+    /** Verify a recovery code in an existing cookie-authenticated session. */
+    verifyRecoveryCode(body: VerifyRecoveryCodeRequest | string): Promise<RecoveryVerifyResponse>;
+    /** Send an SMS code for the authenticated session. */
+    sendSMSCodeForMFA(token: string): Promise<SMSSendResponse>;
+    /** Verify an SMS code without issuing a session. */
+    verifySMSCodeForMFA(code: string, token: string): Promise<SMSVerifyResponse>;
+    /** Approve or deny a device using a bearer token or the existing session cookie. */
+    completeDeviceAuthorization(userCode: string, action: "approve" | "deny", token?: string): Promise<DeviceCompleteResponse>;
     /**
      * Fetch the client configuration from the backend.
      *
      * The config describes which auth methods are enabled so SDK
      * components can auto-configure without manual props.
-     *
-     * Reads `baseURL` and `fetchFn` directly off the generated parent
-     * class — earlier generator templates kept a `this.config` ref but
-     * the current embedded template stores fields individually, so the
-     * old `(this as any).config.baseURL` shape produced `undefined` and
-     * the URL constructor threw.
      */
     fetchClientConfig(publishableKey?: string): Promise<ClientConfig>;
 }
@@ -3015,9 +3084,15 @@ declare class AuthManager {
     private storage;
     private state;
     private listeners;
+    private initializePromise;
+    private refreshPromise;
+    private refreshLockKey;
+    private active;
+    private smsCeremonyVersion;
     private refreshTimer;
     private onError?;
     private publishableKey?;
+    private configCacheKey;
     private clientConfig;
     private configListeners;
     private configFetchPromise;
@@ -3034,6 +3109,7 @@ declare class AuthManager {
      * Call this once on app start.
      */
     initialize(): Promise<void>;
+    private restoreSession;
     /**
      * Resolves the state when hydrating a stored session failed.
      *
@@ -3052,6 +3128,22 @@ declare class AuthManager {
     private handleInitFailure;
     /** Sign in with email & password. */
     signIn(credentials: SignInRequest): Promise<void>;
+    /**
+     * Begin an SSO login against one of the app's configured connections.
+     *
+     * Resolves to the IdP `login_url`; the caller navigates the browser there.
+     * `returnUrl` is where the backend lands the browser after the IdP round
+     * trip, with `?code=` on success or `?sso_error=` on failure. It must be an
+     * allowlisted https origin (or localhost). Omit it to use the server's
+     * default `/sso/callback` landing.
+     */
+    startSSOLogin(connectionId: string, returnUrl?: string): Promise<string>;
+    /**
+     * Finish an SSO login by exchanging the one-time `code` from the callback
+     * URL for a session. The exchange is publishable-key authed, so no bearer
+     * token is sent.
+     */
+    completeSSOLogin(code: string): Promise<void>;
     /** Sign up with email & password. */
     signUp(data: SignUpRequest): Promise<void>;
     /**
@@ -3084,16 +3176,18 @@ declare class AuthManager {
      * build, but the enrollmentId argument is now ignored.
      */
     submitMFACode(_enrollmentId: string, code: string): Promise<void>;
-    /** Submit an MFA recovery code. */
+    /** Submit a recovery code against the active login ticket. */
     submitRecoveryCode(code: string): Promise<void>;
-    /** Send an SMS code for MFA verification. Returns masked phone + expiry info. */
+    /** Send an SMS code for an already authenticated session. */
     sendSMSCode(): Promise<{
         sent: boolean;
         phone_masked: string;
         expires_in_seconds: number;
     }>;
-    /** Submit an SMS verification code during MFA challenge. */
+    /** Verify an SMS ceremony without replacing the authenticated session. */
     submitSMSCode(code: string): Promise<void>;
+    private requireSMSAuthState;
+    private checkSMSAuthState;
     /** Refresh the current session manually. */
     refreshNow(): Promise<void>;
     /**
@@ -3123,19 +3217,8 @@ declare class AuthManager {
     /** Tear down: clear timers and listeners. */
     destroy(): void;
     private handleAuthResponse;
-    /**
-     * Exchanges the refresh token for a new session.
-     *
-     * On failure the two cases are separated, as they are in initialize: a
-     * rejected token means signed out, anything else means no verdict and is
-     * worth retrying.
-     *
-     * `attempt` was previously accepted and never read, and the retry path
-     * called back in without it — so a permanently-invalid token retried every
-     * 30s for as long as the tab stayed open, and the user was never signed out.
-     * It now bounds the retries and backs off between them.
-     */
     private refreshSession;
+    private exchangeSession;
     private scheduleRefresh;
     private clearRefreshTimer;
     private persistSession;
@@ -3238,4 +3321,4 @@ declare function prepareRequestOptions(options: Record<string, unknown>): Public
  */
 declare function serializeCredential(credential: Credential): Record<string, unknown>;
 
-export { type APIError, type KeyListItem as APIKey, type AddMemberRequest, type AdminBanUserRequest, AuthClient, type AuthClientConfig, AuthClientError, type AuthConfig, AuthManager, type AuthResponse, type AuthState, type ChallengeMFARequest, type ChangePasswordRequest, type ClientConfig, type CreateAPIKeyRequest, type CreateInvitationRequest, type CreateOrganizationRequest as CreateOrgRequest, type CreateOrganizationRequest, type Device, type EnrollMFARequest, type EnrollResponse, type ForgotPasswordRequest, type Invitation, type KeyListItem, type ListOptions, type ListResponse, type EnrollResponse as MFAEnrollment, type SendMagicLinkRequest as MagicLinkSendRequest, type VerifyMagicLinkRequest as MagicLinkVerifyRequest, type Member, type ChallengeMFARequest as MfaChallengeRequest, type EnrollMFARequest as MfaEnrollRequest, type SendSMSCodeRequest as MfaSMSSendRequest, type VerifySMSCodeRequest as MfaSMSVerifyRequest, type VerifyMFARequest as MfaVerifyRequest, type Organization, type PasskeyLoginFinishRequest, type PasskeyRegisterFinishRequest, type RefreshRequest, type ResetPasswordRequest, SESSION_STORAGE_KEY, type SSOConnectionConfig, type SafeRedirectOptions, type SendMagicLinkRequest, type SendSMSCodeRequest, type Session, type SignInRequest, type SignUpRequest, type SignupFieldConfig, type SignupFieldOption, type SignupFieldValidation, type SocialProviderConfig, type ApiTokenResponse as TokenResponse, type TokenStorage, type UpdateMeRequest, type UpdateOrganizationRequest as UpdateOrgRequest, type UpdateOrganizationRequest, type User, type VerifyEmailRequest, type VerifyMFARequest, type VerifyMagicLinkRequest, type VerifyRecoveryCodeRequest, type VerifySMSCodeRequest, base64urlToBuffer, bufferToBase64url, createLocalStorage, isSafeRedirect, prepareCreationOptions, prepareRequestOptions, safeRedirectTarget, serializeCredential };
+export { type APIError, type KeyListItem as APIKey, type AddMemberRequest, type AdminBanUserRequest, AuthClient, type AuthClientConfig, AuthClientError, type AuthConfig, AuthManager, type AuthResponse, type AuthState, type ChallengeMFARequest, type ChangePasswordRequest, type ClientConfig, type CreateAPIKeyRequest, type CreateInvitationRequest, type CreateOrganizationRequest as CreateOrgRequest, type CreateOrganizationRequest, type Device, type EnrollMFARequest, type EnrollResponse, type ForgotPasswordRequest, type Invitation, type KeyListItem, type ListOptions, type ListResponse, type EnrollResponse as MFAEnrollment, type SendMagicLinkRequest as MagicLinkSendRequest, type VerifyMagicLinkRequest as MagicLinkVerifyRequest, type Member, type ChallengeMFARequest as MfaChallengeRequest, type EnrollMFARequest as MfaEnrollRequest, type SendSMSCodeRequest as MfaSMSSendRequest, type VerifySMSCodeRequest as MfaSMSVerifyRequest, type VerifyMFARequest as MfaVerifyRequest, type Organization, type OrganizationList, type PasskeyLoginFinishRequest, type PasskeyRegisterFinishRequest, type RefreshRequest, type ResetPasswordRequest, SESSION_STORAGE_KEY, type SSOConnectionConfig, type SafeRedirectOptions, type SendMagicLinkRequest, type SendSMSCodeRequest, type Session, type SignInRequest, type SignUpRequest, type SignupFieldConfig, type SignupFieldOption, type SignupFieldValidation, type SocialProviderConfig, type ApiTokenResponse as TokenResponse, type TokenStorage, type UpdateMeRequest, type UpdateOrganizationRequest as UpdateOrgRequest, type UpdateOrganizationRequest, type User, type VerifyEmailRequest, type VerifyMFARequest, type VerifyMagicLinkRequest, type VerifyRecoveryCodeRequest, type VerifySMSCodeRequest, type WaitlistJoinResponse, type WaitlistStatus, base64urlToBuffer, bufferToBase64url, createLocalStorage, isSafeRedirect, prepareCreationOptions, prepareRequestOptions, readOrganizationList, safeRedirectTarget, serializeCredential };