@baliola/auth-sdk 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to `@baliola/auth-sdk` are documented here.
 
+## 0.5.0
+
+- feat(types): `auth.getProfile()` now returns `account.hasPassword`, a boolean
+  that is `true` when the account can sign in with a password and `false` for
+  Google-only or code-only accounts. Use it to decide between
+  `emailPassword.setPassword` and `emailPassword.changePassword`. `ProfileResult.account`
+  is typed as the new exported `ProfileAccount` (`Account & { hasPassword }`);
+  `Account` itself is unchanged. Requires baliola-auth with `hasPassword` on
+  `GET /profile`.
+- feat(client): `auth.google.login` accepts `{ code }` in addition to
+  `{ idToken }`. `code` is the authorization code from Google's OAuth popup
+  code flow (`google.accounts.oauth2.initCodeClient`, `ux_mode: 'popup'`), which
+  the server exchanges for the ID token with its client secret.
+  `LoginWithGoogleInput` is now `{ idToken: string } | { code: string }`. The
+  server answers `invalid_google_code` (401) when the exchange fails and
+  `google_code_unsupported` (400) when it has no client secret configured; both
+  surface as `AuthError` with `code` preserved.
+- types: `Profile`, `ProfileAccount`, and `ProfileResult` are now also exported
+  from the `./types` subpath, matching the root entry.
+
 ## 0.4.1
 
 - chore(sdk): internal cleanup, no public API change. Removed dead code (the

package/README.md

@@ -99,8 +99,12 @@ auth.emailPassword.changePassword({ currentPassword, newPassword });
 ### `auth.google`
 
 ```ts
-// idToken is obtained from Google Sign-In on the frontend.
+// idToken comes from the Google Identity Services button or One Tap.
 auth.google.login({ idToken }); // → AuthSession
+
+// code comes from the OAuth popup code flow (google.accounts.oauth2.initCodeClient).
+// The server exchanges it for the ID token with its client secret.
+auth.google.login({ code }); // → AuthSession
 ```
 
 ### Custodial wallet (smart-account signer)
@@ -123,8 +127,10 @@ The private key never leaves baliola-auth; `owner.signMessage({ raw })` calls `P
 
 ```ts
 const { account, profile } = await auth.getProfile(); // GET /profile (authenticated)
-// account = { id, email, status }   — status is live, not a token-time snapshot
+// account = { id, email, status, hasPassword }   (status is live, not a token-time snapshot)
 // profile = { displayName, avatarUrl, primaryEmail, primaryPhone } | null
+
+// hasPassword is false for Google-only or code-only accounts: offer setPassword, not changePassword.
 ```
 
 ### Session lifecycle
@@ -317,6 +323,15 @@ if (session) {
 }
 ```
 
+**`auth.getProfile` success (`ProfileResult`):**
+
+```json
+{
+  "account": { "id": "...", "email": "user@example.com", "status": "active", "hasPassword": true },
+  "profile": { "displayName": "Ada", "avatarUrl": null, "primaryEmail": "user@example.com", "primaryPhone": null }
+}
+```
+
 **Verify-code failure (e.g. `OtpInvalidError`):**
 
 ```json

package/dist/client/index.d.ts

@@ -1,2 +1,2 @@
-import { a as GoogleNamespace, c as WalletNamespace, f as AuthFetchInit, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient } from "../index-B2RuGLX_.js";
+import { a as GoogleNamespace, c as WalletNamespace, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient, u as AuthFetchInit } from "../index-URk8yf8l.js";
 export { AuthClient, AuthFetchInit, CreateAuthClientOptions, EmailOtpNamespace, EmailPasswordNamespace, GoogleNamespace, ProactiveRefreshConfig, SubscribeOptions, WalletNamespace, createAuthClient };

package/dist/client/index.js

@@ -1,2 +1,2 @@
-import { t as createAuthClient } from "../client-DU_DerYi.js";
+import { t as createAuthClient } from "../client-DxhQkQcE.js";
 export { createAuthClient };

package/dist/{client-DU_DerYi.js → client-DxhQkQcE.js}

@@ -130,7 +130,7 @@ function createMethods(ctx) {
 				path: "/auth/google/login",
 				method: "POST",
 				authMode: "none",
-				body: withClientId({ idToken: input.idToken })
+				body: withClientId("idToken" in input ? { idToken: input.idToken } : { code: input.code })
 			}));
 		},
 		/** wallet.* */

package/dist/{index-B2RuGLX_.d.ts → index-URk8yf8l.d.ts}

@@ -1,6 +1,6 @@
-import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
+import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
 import { n as SessionStore } from "./sessionStore-BDdEpbL8.js";
-import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, u as VerifyLoginCodeInput } from "./requests-eTORIjY5.js";
+import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, m as ProfileResult, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, u as VerifyLoginCodeInput } from "./requests-jRLgNXyf.js";
 
 //#region src/client/transport.d.ts
 type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
@@ -26,20 +26,6 @@ type AuthFetchInit = RequestInit & {
   disableRefresh?: boolean;
 };
 //#endregion
-//#region src/types/profile.d.ts
-/** The account's profile record; every field is user-editable and nullable. */
-type Profile = {
-  displayName: string | null;
-  avatarUrl: string | null;
-  primaryEmail: string | null;
-  primaryPhone: string | null;
-};
-/** Result of `auth.getProfile` — identity read for the token holder. */
-type ProfileResult = {
-  /** `status` is the live account status, not a token-time snapshot. */account: Account; /** `null` when the account has no profile row yet. */
-  profile: Profile | null;
-};
-//#endregion
 //#region src/client/index.d.ts
 type ProactiveRefreshConfig = false | {
   /** Refresh proactively if `expiresAt - now < leadTimeMs`. Defaults to 60_000 (60s). */leadTimeMs?: number;
@@ -131,6 +117,19 @@ type EmailPasswordNamespace = {
 };
 /** Google flow. */
 type GoogleNamespace = {
+  /**
+   * Sign in with Google. Pass `{ idToken }` from the Google Identity Services
+   * button or One Tap, or `{ code }` from the OAuth popup code flow
+   * (`google.accounts.oauth2.initCodeClient`), which the server exchanges
+   * for the ID token using its client secret.
+   *
+   * @throws AuthError with code `invalid_google_code` (401) when the exchange
+   *         fails, `google_code_unsupported` (400) when the server has no
+   *         client secret configured, AccountSuspendedError, AuthError.
+   * @example
+   * await auth.google.login({ idToken });
+   * await auth.google.login({ code });
+   */
   login(input: LoginWithGoogleInput): Promise<AuthSession>;
 };
 /** Custodial wallet (Console tier). */
@@ -144,8 +143,10 @@ type AuthClient = {
   google: GoogleNamespace;
   wallet: WalletNamespace;
   /**
-   * Fetch the token holder's identity: account (id, email, live status) plus
-   * its profile record (`profile: null` when none exists yet).
+   * Fetch the token holder's identity: account (id, email, live status,
+   * `hasPassword`) plus its profile record (`profile: null` when none exists
+   * yet). Use `account.hasPassword` to choose between
+   * `emailPassword.setPassword` and `emailPassword.changePassword`.
    *
    * @throws AuthError on 401 (missing/expired session) and other API errors.
    */
@@ -166,4 +167,4 @@ type AuthClient = {
 };
 declare function createAuthClient(options: CreateAuthClientOptions): AuthClient;
 //#endregion
-export { GoogleNamespace as a, WalletNamespace as c, ProfileResult as d, AuthFetchInit as f, EmailPasswordNamespace as i, createAuthClient as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, SubscribeOptions as s, AuthClient as t, Profile as u };
+export { GoogleNamespace as a, WalletNamespace as c, EmailPasswordNamespace as i, createAuthClient as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, SubscribeOptions as s, AuthClient as t, AuthFetchInit as u };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
-import { a as GoogleNamespace, c as WalletNamespace, d as ProfileResult, f as AuthFetchInit, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient, u as Profile } from "./index-B2RuGLX_.js";
+import { a as GoogleNamespace, c as WalletNamespace, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient, u as AuthFetchInit } from "./index-URk8yf8l.js";
 import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "./sessionStore-BDdEpbL8.js";
-import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, t as CaptchaArgs, u as VerifyLoginCodeInput } from "./requests-eTORIjY5.js";
+import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, f as Profile, i as LoginWithPasswordInput, l as SetPasswordInput, m as ProfileResult, n as ChangePasswordInput, o as ResendLoginCodeInput, p as ProfileAccount, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, t as CaptchaArgs, u as VerifyLoginCodeInput } from "./requests-jRLgNXyf.js";
 import { _ as authErrorFromFetchFailure, a as EmailAlreadyHasPasswordError, c as InvalidPasswordError, d as NoPasswordSetError, f as NoPendingOtpError, g as ResendCooldownError, h as RateLimitedError, i as CaptchaFailedError, l as MaxAttemptsError, m as OtpInvalidError, n as AuthError, o as InvalidCredentialsError, p as OtpExpiredError, r as AuthErrorInit, s as InvalidEmailError, t as AccountSuspendedError, u as MaxResendsError, v as authErrorFromResponse } from "./authError-DgPEjTfW.js";
 import { n as AccessTokenPayloadProject, t as AccessTokenPayload } from "./tokens-BXrPLi5B.js";
 
@@ -16,4 +16,4 @@ type SignHashResult = {
   address: string;
 };
 //#endregion
-export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleNamespace, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Profile, type ProfileResult, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SignHashResult, type SubscribeOptions, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, type WalletAddressResult, type WalletNamespace, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };
+export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleNamespace, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Profile, type ProfileAccount, type ProfileResult, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SignHashResult, type SubscribeOptions, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, type WalletAddressResult, type WalletNamespace, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { t as createAuthClient } from "./client-DU_DerYi.js";
+import { t as createAuthClient } from "./client-DxhQkQcE.js";
 import { _ as authErrorFromResponse, a as InvalidCredentialsError, c as MaxAttemptsError, d as NoPendingOtpError, f as OtpExpiredError, g as authErrorFromFetchFailure, h as ResendCooldownError, i as EmailAlreadyHasPasswordError, l as MaxResendsError, m as RateLimitedError, n as AuthError, o as InvalidEmailError, p as OtpInvalidError, r as CaptchaFailedError, s as InvalidPasswordError, t as AccountSuspendedError, u as NoPasswordSetError } from "./authError-CYUAl2Jt.js";
 import { n as memoryStore, t as localStorageStore } from "./sessionStore-DD6lON9W.js";
 export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/requests-jRLgNXyf.d.ts

@@ -0,0 +1,75 @@
+import { t as Account } from "./session-Cs_P7ojF.js";
+
+//#region src/types/profile.d.ts
+/** The account's profile record; every field is user-editable and nullable. */
+type Profile = {
+  displayName: string | null;
+  avatarUrl: string | null;
+  primaryEmail: string | null;
+  primaryPhone: string | null;
+};
+/** The account as returned by `auth.getProfile`, with sign-in capability flags. */
+type ProfileAccount = Account & {
+  /**
+   * `true` when the account can sign in with a password; `false` for
+   * Google-only or code-only accounts, which should call
+   * `auth.emailPassword.setPassword` rather than `changePassword`.
+   */
+  hasPassword: boolean;
+};
+/** Result of `auth.getProfile`, the identity read for the token holder. */
+type ProfileResult = {
+  /** `status` is the live account status, not a token-time snapshot. */account: ProfileAccount; /** `null` when the account has no profile row yet. */
+  profile: Profile | null;
+};
+//#endregion
+//#region src/types/requests.d.ts
+/** Optional captcha argument shared by every public unauthenticated entrypoint. */
+type CaptchaArgs = {
+  /** Cloudflare Turnstile token. Required when captcha is enabled on the server. */captchaToken?: string;
+};
+type SendLoginCodeInput = {
+  email: string;
+} & CaptchaArgs;
+type VerifyLoginCodeInput = {
+  email: string;
+  code: string;
+};
+type ResendLoginCodeInput = {
+  email: string;
+} & CaptchaArgs;
+type RegisterInput = {
+  email: string;
+  password: string;
+} & CaptchaArgs;
+type VerifyRegistrationCodeInput = {
+  email: string;
+  code: string;
+};
+type ResendRegistrationCodeInput = {
+  email: string;
+} & CaptchaArgs;
+type LoginWithPasswordInput = {
+  email: string;
+  password: string;
+} & CaptchaArgs;
+type SetPasswordInput = {
+  password: string;
+};
+type ChangePasswordInput = {
+  currentPassword: string;
+  newPassword: string;
+};
+/**
+ * Exactly one of the two shapes. `idToken` comes from Google Identity Services
+ * (`renderButton` / One Tap). `code` is the authorization code from
+ * `google.accounts.oauth2.initCodeClient` in popup mode; the server exchanges
+ * it for the ID token, so the client secret never reaches the browser.
+ */
+type LoginWithGoogleInput = {
+  idToken: string;
+} | {
+  code: string;
+};
+//#endregion
+export { RegisterInput as a, SendLoginCodeInput as c, VerifyRegistrationCodeInput as d, Profile as f, LoginWithPasswordInput as i, SetPasswordInput as l, ProfileResult as m, ChangePasswordInput as n, ResendLoginCodeInput as o, ProfileAccount as p, LoginWithGoogleInput as r, ResendRegistrationCodeInput as s, CaptchaArgs as t, VerifyLoginCodeInput as u };

package/dist/types/index.d.ts

@@ -1,4 +1,4 @@
 import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "../session-Cs_P7ojF.js";
-import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, t as CaptchaArgs, u as VerifyLoginCodeInput } from "../requests-eTORIjY5.js";
+import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, f as Profile, i as LoginWithPasswordInput, l as SetPasswordInput, m as ProfileResult, n as ChangePasswordInput, o as ResendLoginCodeInput, p as ProfileAccount, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, t as CaptchaArgs, u as VerifyLoginCodeInput } from "../requests-jRLgNXyf.js";
 import { n as AccessTokenPayloadProject, t as AccessTokenPayload } from "../tokens-BXrPLi5B.js";
-export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, type AuthSession, type CaptchaArgs, type ChangePasswordInput, type ErrorHandler, type ErrorSource, type LoginWithGoogleInput, type LoginWithPasswordInput, type OtpInfo, type Project, type RegisterInput, type RegisterResult, type ResendCodeResult, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SetPasswordInput, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput };
+export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, type AuthSession, type CaptchaArgs, type ChangePasswordInput, type ErrorHandler, type ErrorSource, type LoginWithGoogleInput, type LoginWithPasswordInput, type OtpInfo, type Profile, type ProfileAccount, type ProfileResult, type Project, type RegisterInput, type RegisterResult, type ResendCodeResult, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SetPasswordInput, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput };

package/dist/wallet/index.d.ts

@@ -1,4 +1,4 @@
-import { t as AuthClient } from "../index-B2RuGLX_.js";
+import { t as AuthClient } from "../index-URk8yf8l.js";
 import { LocalAccount } from "viem";
 
 //#region src/wallet/index.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baliola/auth-sdk",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Client SDK for Baliola Auth",
   "keywords": [
     "auth",

package/dist/requests-eTORIjY5.d.ts

@@ -1,42 +0,0 @@
-//#region src/types/requests.d.ts
-/** Optional captcha argument shared by every public unauthenticated entrypoint. */
-type CaptchaArgs = {
-  /** Cloudflare Turnstile token. Required when captcha is enabled on the server. */captchaToken?: string;
-};
-type SendLoginCodeInput = {
-  email: string;
-} & CaptchaArgs;
-type VerifyLoginCodeInput = {
-  email: string;
-  code: string;
-};
-type ResendLoginCodeInput = {
-  email: string;
-} & CaptchaArgs;
-type RegisterInput = {
-  email: string;
-  password: string;
-} & CaptchaArgs;
-type VerifyRegistrationCodeInput = {
-  email: string;
-  code: string;
-};
-type ResendRegistrationCodeInput = {
-  email: string;
-} & CaptchaArgs;
-type LoginWithPasswordInput = {
-  email: string;
-  password: string;
-} & CaptchaArgs;
-type SetPasswordInput = {
-  password: string;
-};
-type ChangePasswordInput = {
-  currentPassword: string;
-  newPassword: string;
-};
-type LoginWithGoogleInput = {
-  idToken: string;
-};
-//#endregion
-export { RegisterInput as a, SendLoginCodeInput as c, VerifyRegistrationCodeInput as d, LoginWithPasswordInput as i, SetPasswordInput as l, ChangePasswordInput as n, ResendLoginCodeInput as o, LoginWithGoogleInput as r, ResendRegistrationCodeInput as s, CaptchaArgs as t, VerifyLoginCodeInput as u };