@baliola/auth-sdk 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -2,6 +2,84 @@
 
 All notable changes to `@baliola/auth-sdk` are documented here.
 
+## 0.7.0
+
+Self-service roles and a stricter login contract. baliola-auth added `POST /auth/roles/apply` and
+`GET /auth/roles/status` (issue #61), dropped `flow` and `methods` from the send-login-code
+response so it can no longer reveal whether an email is registered, and is making `clientId`
+mandatory on every login and register body (issue #60) so that only the Console client can mint a
+token carrying global roles.
+
+### New features
+
+- feat(client): `auth.roles.apply({ roleName })` posts a self-service application for an
+  allowlisted global role and returns the account role row (`RoleApplicationStatus`);
+  `auth.roles.status()` returns one `RoleStatus` per self-applicable role, with `status: 'none'`
+  when the account never applied. Both need a session. Conflicts surface as `AuthError` with
+  `code` `role_already_active` or `application_pending`.
+- feat(types): `ApplyRoleInput`, `RoleApplicationState`, `RoleApplicationStatus`, `RoleStatus`,
+  and `RolesNamespace` are exported from the root and the `./types` subpath.
+- feat(errors): `ValidationError` (`code: 'validation_error'`, 400) with
+  `issues: ValidationIssue[]`, one `{ path, message }` per rejected request field.
+  baliola-auth now routes every request validation failure through the standard error
+  envelope under this code, so a login body without `clientId` or an `apply` with a role name
+  outside the allowlist is an `instanceof ValidationError`. Exported from the root and the
+  `./errors` subpath, together with the `ValidationIssue` type.
+- Admin role management (`/admin/roles/*`: approve, revoke, list applications) is deliberately not
+  in this SDK. It is a client library for end-user apps; the Baliola Console keeps its own direct
+  client for `/admin/*`. This closes the open question on issue #61.
+
+### Breaking changes
+
+- feat(client)!: `clientId` is now a required option of `createAuthClient`. Construction throws
+  `Error('createAuthClient: clientId is required')` when it is missing or empty, the same way
+  `baseUrl` is handled. Every login and register body always carries it, and
+  `auth.google.startUrl` no longer has its own `clientId` check. The "central" multi-project login
+  that omitted `clientId` is gone on the server side, so there is nothing to migrate to: pass the
+  client id of the project the app belongs to.
+- chore(types)!: `SendLoginCodeResult` is narrowed to `{ otp: OtpInfo }`. The `flow` and `methods`
+  fields are removed because the server no longer sends them (baliola-auth commit `7f29126`);
+  whether the email is a login or a signup is only known after `verifyLoginCode`.
+- Per `RELEASING.md` these are pre-1.0 breaks shipped as a minor with this explicit callout.
+
+## 0.6.0
+
+Hosted Google login. baliola-auth now runs the Google OAuth round trip itself
+(`GET /auth/google/start`, `GET /auth/google/callback`, `POST /auth/google/exchange`),
+so an app can offer "Sign in with Google" without loading Google Identity Services. The
+browser only ever sees a one-time code, never a token.
+
+- feat(client): `auth.google.signInWithPopup(opts?)` opens the hosted login in a popup,
+  waits for the exit message, exchanges the one-time code, and stores the session.
+  `opts.returnTo` (default: current href without hash) and `opts.popup.width` /
+  `opts.popup.height` (default 500 x 640). Browser only.
+- feat(client): `auth.google.completeRedirect(opts?)` finishes a hosted login started in
+  `redirect` mode on the `returnTo` page: resolves `null` when the URL carries no `code`
+  or `error`, verifies the nonce saved by `startUrl`, strips `code`, `error`, and `nonce`
+  from the URL before exchanging. Browser only.
+- feat(client): `auth.google.startUrl({ mode, returnTo?, nonce })` builds the
+  `/auth/google/start` URL from the client's `clientId`, and `auth.google.exchange({ code })`
+  posts the one-time code and stores the session like every other login method. Both are
+  the manual path underneath the two methods above.
+- feat(errors): `GoogleSignInCancelledError` (`code: 'oauth_cancelled'`,
+  `reason: 'popup_blocked' | 'popup_closed' | 'access_denied'`) and `GoogleSignInError`
+  (`code` is the exit or exchange failure: `invalid_google_code`, `email_unverified`,
+  `invalid_oauth_state`, `oauth_unexpected`, or the SDK-side `oauth_nonce_mismatch`).
+  `authErrorFromResponse` now maps server `invalid_google_code` and `email_unverified` to
+  `GoogleSignInError`; `status` and `code` are unchanged, so `instanceof AuthError` and
+  `err.code` branches keep working.
+- feat(types): `GoogleExchangeInput`, `GoogleStartMode`, `GoogleStartOptions`,
+  `GoogleSignInWithPopupOptions`, `GoogleCompleteRedirectOptions`, and
+  `GoogleSignInCancelledReason` are exported from the root and the `./types` (or
+  `./errors`) subpath.
+- feat(client)!: **Breaking.** `auth.google.login` accepts `{ idToken }` only.
+  `LoginWithGoogleInput` is narrowed from `{ idToken: string } | { code: string }` to
+  `{ idToken: string }`. The server no longer accepts `{ code }` on `/auth/google/login`
+  (it is a 400 now); apps that used the Google Identity Services code client should move
+  to `auth.google.signInWithPopup()`. `RELEASING.md` would call this removal a major
+  bump; the user chose 0.6.0 under the pre-1.0 rule that breaks ship as minors with an
+  explicit CHANGELOG callout, which this bullet is.
+
 ## 0.5.0
 
 - feat(types): `auth.getProfile()` now returns `account.hasPassword`, a boolean

package/README.md

@@ -1,6 +1,6 @@
 # @baliola/auth-sdk
 
-Client SDK for the Baliola Auth service. Two clearly separated email flows (passwordless OTP, password + verification OTP) plus Google login, with typed methods, typed errors, auto-refresh, and cross-tab sync.
+Client SDK for the Baliola Auth service. Two clearly separated email flows (passwordless OTP, password + verification OTP) plus Google login (hosted popup, hosted redirect, or Google Identity Services), with typed methods, typed errors, auto-refresh, and cross-tab sync.
 
 Guides:
 
@@ -31,7 +31,7 @@ import { createAuthClient, localStorageStore, OtpInvalidError } from '@baliola/a
 
 const auth = createAuthClient({
   baseUrl: AUTH_URL,
-  clientId: 'your-project-client-id', // omit for a central multi-project login
+  clientId: 'your-project-client-id', // required; scopes every login to this project
   store: localStorageStore(), // omit for in-memory (server-side / tests)
 });
 await auth.loadSession(); // rehydrate from store at app boot
@@ -66,7 +66,7 @@ The SDK is namespaced by flow so that each method's purpose is unambiguous at th
 
 ```ts
 auth.emailOtp.sendLoginCode({ email, captchaToken });
-//   → { flow: 'login'|'signup', methods: ('password'|'passwordless')[], otp: OtpInfo }
+//   → { otp: OtpInfo }  (never says whether the email is registered)
 
 auth.emailOtp.verifyLoginCode({ email, code });
 //   → AuthSession  (also populates the session mirror)
@@ -98,15 +98,44 @@ auth.emailPassword.changePassword({ currentPassword, newPassword });
 
 ### `auth.google`
 
+Three ways in. The hosted flow needs a `clientId` on the client and a `returnTo` whose origin is
+one of the project's `allowedOrigins`. Google Identity Services is not loaded in your page.
+
 ```ts
-// idToken comes from the Google Identity Services button or One Tap.
-auth.google.login({ idToken }); // → AuthSession
+import { GoogleSignInCancelledError, GoogleSignInError } from '@baliola/auth-sdk';
+
+// 1. Hosted popup (recommended). Opens the auth server's Google login in a popup,
+//    exchanges the one-time code it posts back, and stores the session.
+try {
+  const session = await auth.google.signInWithPopup();
+  // optional: { returnTo: '/auth/callback', popup: { width: 500, height: 640 } }
+} catch (e) {
+  if (e instanceof GoogleSignInCancelledError) return; // e.reason: 'popup_blocked' | 'popup_closed' | 'access_denied'
+  if (e instanceof GoogleSignInError) return showError(e.code); // 'email_unverified', 'invalid_google_code', ...
+  throw e;
+}
+
+// 2. Hosted redirect. Send the tab to Google, then finish on the returnTo page.
+location.assign(auth.google.startUrl({ mode: 'redirect', nonce: crypto.randomUUID() }));
+// ...on the returnTo page, at boot:
+const session = await auth.google.completeRedirect(); // null when the URL has no code or error
 
-// code comes from the OAuth popup code flow (google.accounts.oauth2.initCodeClient).
-// The server exchanges it for the ID token with its client secret.
-auth.google.login({ code }); // → AuthSession
+// 3. Google Identity Services. idToken comes from the GIS button or One Tap.
+auth.google.login({ idToken }); // → AuthSession
 ```
 
+Manual control: `startUrl({ mode: 'popup' | 'redirect', returnTo?, nonce })` builds
+`GET {baseUrl}/auth/google/start`, and `exchange({ code })` turns the one-time code from the exit into
+a stored session. Both are what `signInWithPopup` and `completeRedirect` use internally.
+
+How the popup exit reaches you: the auth server's callback page runs
+`window.opener.postMessage({ type: 'baliola-auth:google', nonce, code }, returnToOrigin)` on success,
+or `{ type: 'baliola-auth:google', nonce, error }` on failure, then closes. `signInWithPopup` accepts
+a message only when `event.origin` is the auth server origin, `type` matches, and `nonce` is the one
+it generated. In `redirect` mode the exit is a 302 to `returnTo` with `code` and `nonce` (or `error`
+and `nonce`) query params; `completeRedirect` checks `nonce` against the value `startUrl` saved in
+`sessionStorage` and strips all three params from the URL before exchanging.
+
 ### Custodial wallet (smart-account signer)
 
 ```ts
@@ -114,7 +143,7 @@ import { createAuthClient } from '@baliola/auth-sdk';
 import { createRemoteSigner } from '@baliola/auth-sdk/wallet';
 import { toSmartAccount } from '@baliola/smart-account-sdk';
 
-const auth = createAuthClient({ baseUrl });
+const auth = createAuthClient({ baseUrl, clientId });
 await auth.emailOtp.verifyLoginCode({ email, code }); // authenticated session
 
 const owner = await createRemoteSigner(auth);          // viem LocalAccount, signs server-side
@@ -123,6 +152,22 @@ const account = await toSmartAccount({ owner, chain: 'macTestnet' });
 
 The private key never leaves baliola-auth; `owner.signMessage({ raw })` calls `POST /auth/wallet/sign`.
 
+### `auth.roles` (self-service role applications)
+
+```ts
+const app = await auth.roles.apply({ roleName: 'module_deployer' }); // POST /auth/roles/apply
+// app = { id, accountId, roleId, projectId, status: 'pending_approval', assignedBy, assignedAt, approvedAt, revokedAt }
+
+const rows = await auth.roles.status(); // GET /auth/roles/status
+// rows = [{ roleName, displayName, status: 'none'|'pending_approval'|'active'|'revoked', accountRoleId, assignedAt, approvedAt, revokedAt }]
+```
+
+Both need a session. `apply` rejects with `AuthError` whose `code` is `role_already_active` or
+`application_pending` (409) when there is nothing to do, and with a 400 when the role name is not
+on the server's self-applicable allowlist (`ValidationError`, `issues[0].path === 'roleName'`). Approving, revoking, and listing applications are `/admin/*` endpoints and are
+deliberately not part of this SDK; an admin surface such as the Baliola Console calls them with
+its own client.
+
 ### Profile (identity read)
 
 ```ts
@@ -196,6 +241,8 @@ import {
   RateLimitedError,
   InvalidPasswordError,
   InvalidEmailError,
+  GoogleSignInCancelledError,
+  GoogleSignInError,
 } from '@baliola/auth-sdk';
 
 try {
@@ -213,19 +260,22 @@ try {
 | Error class                    | `code`                       | Status | Carries                                    |
 | ------------------------------ | ---------------------------- | ------ | ------------------------------------------ |
 | `OtpInvalidError`              | `otp_invalid`                | 400    | `attemptsRemaining`, `canResendInSeconds`  |
-| `OtpExpiredError`              | `otp_expired`                | 400    | —                                          |
+| `OtpExpiredError`              | `otp_expired`                | 400    | none                                       |
 | `MaxAttemptsError`             | `max_attempts_exceeded`      | 429    | `retryAfterSeconds`                        |
-| `NoPendingOtpError`            | `no_pending_otp`             | 400    | —                                          |
+| `NoPendingOtpError`            | `no_pending_otp`             | 400    | none                                       |
 | `ResendCooldownError`          | `resend_cooldown`            | 429    | `canResendInSeconds`                       |
-| `MaxResendsError`              | `max_resends_exceeded`       | 429    | —                                          |
-| `InvalidCredentialsError`      | `invalid_credentials`        | 401    | —                                          |
-| `NoPasswordSetError`           | `no_password_set`            | 400    | —                                          |
-| `AccountSuspendedError`        | `account_suspended`          | 403    | —                                          |
-| `EmailAlreadyHasPasswordError` | `email_already_has_password` | 409    | —                                          |
-| `CaptchaFailedError`           | `captcha_failed`             | 400    | —                                          |
+| `MaxResendsError`              | `max_resends_exceeded`       | 429    | none                                       |
+| `InvalidCredentialsError`      | `invalid_credentials`        | 401    | none                                       |
+| `NoPasswordSetError`           | `no_password_set`            | 400    | none                                       |
+| `AccountSuspendedError`        | `account_suspended`          | 403    | none                                       |
+| `EmailAlreadyHasPasswordError` | `email_already_has_password` | 409    | none                                       |
+| `CaptchaFailedError`           | `captcha_failed`             | 400    | none                                       |
 | `InvalidPasswordError`         | `invalid_password`           | 400    | `reason: 'too_short'\|'no_uppercase'\|...` |
-| `InvalidEmailError`            | `invalid_email`              | 400    | —                                          |
+| `InvalidEmailError`            | `invalid_email`              | 400    | none                                       |
 | `RateLimitedError`             | (legacy 429)                 | 429    | `retryAfterSeconds`, `retryAfterHuman`     |
+| `GoogleSignInCancelledError`   | `oauth_cancelled`            | 0      | `reason: 'popup_blocked'\|'popup_closed'\|'access_denied'` |
+| `GoogleSignInError`            | `invalid_google_code`, `email_unverified`, `invalid_oauth_state`, `oauth_unexpected`, `oauth_nonce_mismatch` | 401 / 400 / 0 | none |
+| `ValidationError`              | `validation_error`           | 400    | `issues: { path, message }[]`              |
 | `AuthError` (base)             | varies                       | varies | `status: 0` for network/timeout            |
 
 ## Stores
@@ -249,7 +299,7 @@ Cross-tab sync (login / logout / refresh) is automatic via `BroadcastChannel`, r
 ```ts
 createAuthClient({
   baseUrl: AUTH_URL, // required, no trailing slash
-  clientId: 'your-project-client-id', // optional; scopes the session to one project. Omit for a central login that carries every project the account has active roles in.
+  clientId: 'your-project-client-id', // required; sent on every login and register body
   store: memoryStore(), // default; or localStorageStore() / custom
   fetch: globalThis.fetch, // override for tests / interceptors
   timeoutMs: 15_000, // per-request, default 15s
@@ -258,7 +308,8 @@ createAuthClient({
 });
 ```
 
-`clientId` is constructor-only — there is no per-call override. To switch projects, create a new client.
+`clientId` is constructor-only, there is no per-call override. To switch projects, create a new client.
+`createAuthClient` throws a plain `Error` when `clientId` is missing or empty, the same way it does for `baseUrl`.
 
 ## Decoding the JWT
 
@@ -272,7 +323,7 @@ const session = auth.getSession();
 if (session) {
   const claims = decodeJwt<AccessTokenPayload>(session.accessToken);
   // claims.accountId, claims.email
-  // claims.projects: { id, name, clientId }[]   // single entry for a scoped login; many for a central login
+  // claims.projects: { id, name, clientId }[]   // the project the login was scoped to; the Console client also carries global roles
   // claims.roles?: string[]; claims.permissions?: string[]
 }
 ```
@@ -285,8 +336,6 @@ if (session) {
 
 ```json
 {
-  "flow": "signup",
-  "methods": ["passwordless"],
   "otp": {
     "expiresInSeconds": 300,
     "expiresAt": "2026-05-04T12:05:00.000Z",
@@ -309,7 +358,7 @@ if (session) {
 }
 ```
 
-**`auth.emailOtp.verifyLoginCode` / `auth.emailPassword.verifyRegistrationCode` / `auth.emailPassword.login` / `auth.google.login` success (`AuthSession`):**
+**`auth.emailOtp.verifyLoginCode` / `auth.emailPassword.verifyRegistrationCode` / `auth.emailPassword.login` / `auth.google.login` / `auth.google.exchange` success (`AuthSession`):**
 
 ```json
 {
@@ -332,6 +381,38 @@ if (session) {
 }
 ```
 
+**`auth.roles.apply` success (`RoleApplicationStatus`, HTTP 201):**
+
+```json
+{
+  "id": "6f1c2d3e-0000-4000-8000-000000000001",
+  "accountId": "6f1c2d3e-0000-4000-8000-0000000000aa",
+  "roleId": "6f1c2d3e-0000-4000-8000-0000000000bb",
+  "projectId": null,
+  "status": "pending_approval",
+  "assignedBy": null,
+  "assignedAt": "2026-09-04T00:00:00.000Z",
+  "approvedAt": null,
+  "revokedAt": null
+}
+```
+
+**`auth.roles.status` success (`RoleStatus[]`):**
+
+```json
+[
+  {
+    "roleName": "module_deployer",
+    "displayName": "Module Deployer",
+    "status": "none",
+    "accountRoleId": null,
+    "assignedAt": null,
+    "approvedAt": null,
+    "revokedAt": null
+  }
+]
+```
+
 **Verify-code failure (e.g. `OtpInvalidError`):**
 
 ```json
@@ -349,6 +430,19 @@ if (session) {
 }
 ```
 
+**`auth.google.exchange` failure (`GoogleSignInError`, 401):**
+
+```json
+{
+  "message": "Invalid or expired login code",
+  "data": null,
+  "error": {
+    "code": "invalid_google_code",
+    "details": { "name": "UnauthorizedError", "requestId": "..." }
+  }
+}
+```
+
 ## License
 
 Proprietary — see [LICENSE](./LICENSE).

package/dist/{authError-CYUAl2Jt.js → authError-BPxMHQK2.js}

@@ -131,6 +131,54 @@ var InvalidEmailError = class extends AuthError {
 		this.name = "InvalidEmailError";
 	}
 };
+/**
+* The hosted Google sign-in ended without a session because of the user or
+* the browser: the popup was blocked, the popup was closed early, or the
+* user cancelled on Google's account chooser. `code` is always
+* `oauth_cancelled`; branch on `reason` for the specific cause.
+*/
+var GoogleSignInCancelledError = class extends AuthError {
+	reason;
+	constructor(init) {
+		super({
+			status: 0,
+			code: "oauth_cancelled",
+			serverMessage: `Google sign-in cancelled: ${init.reason}`,
+			...init.cause !== void 0 && { cause: init.cause }
+		});
+		this.name = "GoogleSignInCancelledError";
+		this.reason = init.reason;
+	}
+};
+/**
+* The hosted Google sign-in failed. `code` is the failure code the exit or
+* the exchange returned: `invalid_oauth_state`, `invalid_google_code`,
+* `email_unverified`, `oauth_unexpected`, or the SDK-side
+* `oauth_nonce_mismatch`. `status` is the HTTP status when the exchange
+* request failed, otherwise `0`.
+*/
+var GoogleSignInError = class extends AuthError {
+	constructor(init) {
+		super({
+			...init,
+			status: init.status ?? 0,
+			serverMessage: init.serverMessage ?? `Google sign-in failed: ${init.code}`
+		});
+		this.name = "GoogleSignInError";
+	}
+};
+/**
+* Request validation failed. Thrown for `validation_error` (400) on any
+* endpoint; `issues` names each rejected field.
+*/
+var ValidationError = class extends AuthError {
+	issues;
+	constructor(init) {
+		super(init);
+		this.name = "ValidationError";
+		this.issues = init.issues;
+	}
+};
 function num(d, key, fallback = 0) {
 	const v = d?.[key];
 	return typeof v === "number" ? v : fallback;
@@ -139,6 +187,21 @@ function str(d, key, fallback = "") {
 	const v = d?.[key];
 	return typeof v === "string" ? v : fallback;
 }
+function issues(d) {
+	const raw = d?.["issues"];
+	if (!Array.isArray(raw)) return [];
+	const out = [];
+	for (const entry of raw) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const record = entry;
+		if (typeof record["path"] !== "string" || typeof record["message"] !== "string") continue;
+		out.push({
+			path: record["path"],
+			message: record["message"]
+		});
+	}
+	return out;
+}
 /**
 * Map a backend error response onto the right AuthError subclass.
 * Falls back to `AuthError` (with status + code preserved) for unknown codes.
@@ -189,6 +252,15 @@ async function authErrorFromResponse(response) {
 			});
 		}
 		case "invalid_email": return new InvalidEmailError(init);
+		case "invalid_google_code":
+		case "email_unverified": return new GoogleSignInError({
+			...init,
+			code
+		});
+		case "validation_error": return new ValidationError({
+			...init,
+			issues: issues(details)
+		});
 		default:
 			if (response.status === 429) {
 				const retryAfterSeconds = num(details, "retryAfter") || num(details, "retryAfterSeconds") || Number(response.headers.get("Retry-After") ?? 0);
@@ -212,4 +284,4 @@ function authErrorFromFetchFailure(cause, isTimeout = false) {
 	});
 }
 //#endregion
-export { authErrorFromResponse as _, InvalidCredentialsError as a, MaxAttemptsError as c, NoPendingOtpError as d, OtpExpiredError as f, authErrorFromFetchFailure as g, ResendCooldownError as h, EmailAlreadyHasPasswordError as i, MaxResendsError as l, RateLimitedError as m, AuthError as n, InvalidEmailError as o, OtpInvalidError as p, CaptchaFailedError as r, InvalidPasswordError as s, AccountSuspendedError as t, NoPasswordSetError as u };
+export { ResendCooldownError as _, GoogleSignInCancelledError as a, authErrorFromResponse as b, InvalidEmailError as c, MaxResendsError as d, NoPasswordSetError as f, RateLimitedError as g, OtpInvalidError as h, EmailAlreadyHasPasswordError as i, InvalidPasswordError as l, OtpExpiredError as m, AuthError as n, GoogleSignInError as o, NoPendingOtpError as p, CaptchaFailedError as r, InvalidCredentialsError as s, AccountSuspendedError as t, MaxAttemptsError as u, ValidationError as v, authErrorFromFetchFailure as y };

package/dist/{authError-DgPEjTfW.d.ts → authError-E11ZMcID.d.ts}

@@ -92,6 +92,47 @@ declare class InvalidPasswordError extends AuthError {
 declare class InvalidEmailError extends AuthError {
   constructor(init: AuthErrorInit);
 }
+type GoogleSignInCancelledReason = 'popup_blocked' | 'popup_closed' | 'access_denied';
+/**
+ * The hosted Google sign-in ended without a session because of the user or
+ * the browser: the popup was blocked, the popup was closed early, or the
+ * user cancelled on Google's account chooser. `code` is always
+ * `oauth_cancelled`; branch on `reason` for the specific cause.
+ */
+declare class GoogleSignInCancelledError extends AuthError {
+  readonly reason: GoogleSignInCancelledReason;
+  constructor(init: {
+    reason: GoogleSignInCancelledReason;
+    cause?: unknown;
+  });
+}
+/**
+ * The hosted Google sign-in failed. `code` is the failure code the exit or
+ * the exchange returned: `invalid_oauth_state`, `invalid_google_code`,
+ * `email_unverified`, `oauth_unexpected`, or the SDK-side
+ * `oauth_nonce_mismatch`. `status` is the HTTP status when the exchange
+ * request failed, otherwise `0`.
+ */
+declare class GoogleSignInError extends AuthError {
+  constructor(init: {
+    code: string;
+  } & Partial<AuthErrorInit>);
+}
+/** One failing request field, as reported by the server's validation hook. */
+type ValidationIssue = {
+  /** Dot-joined path of the field, for example `clientId` or `otp`. */path: string;
+  message: string;
+};
+/**
+ * Request validation failed. Thrown for `validation_error` (400) on any
+ * endpoint; `issues` names each rejected field.
+ */
+declare class ValidationError extends AuthError {
+  readonly issues: ValidationIssue[];
+  constructor(init: AuthErrorInit & {
+    issues: ValidationIssue[];
+  });
+}
 /**
  * Map a backend error response onto the right AuthError subclass.
  * Falls back to `AuthError` (with status + code preserved) for unknown codes.
@@ -100,4 +141,4 @@ declare function authErrorFromResponse(response: Response): Promise<AuthError>;
 /** Network/timeout failures land here. */
 declare function authErrorFromFetchFailure(cause: unknown, isTimeout?: boolean): AuthError;
 //#endregion
-export { authErrorFromFetchFailure as _, EmailAlreadyHasPasswordError as a, InvalidPasswordError as c, NoPasswordSetError as d, NoPendingOtpError as f, ResendCooldownError as g, RateLimitedError as h, CaptchaFailedError as i, MaxAttemptsError as l, OtpInvalidError as m, AuthError as n, InvalidCredentialsError as o, OtpExpiredError as p, AuthErrorInit as r, InvalidEmailError as s, AccountSuspendedError as t, MaxResendsError as u, authErrorFromResponse as v };
+export { authErrorFromResponse as C, authErrorFromFetchFailure as S, OtpInvalidError as _, EmailAlreadyHasPasswordError as a, ValidationError as b, GoogleSignInError as c, InvalidPasswordError as d, MaxAttemptsError as f, OtpExpiredError as g, NoPendingOtpError as h, CaptchaFailedError as i, InvalidCredentialsError as l, NoPasswordSetError as m, AuthError as n, GoogleSignInCancelledError as o, MaxResendsError as p, AuthErrorInit as r, GoogleSignInCancelledReason as s, AccountSuspendedError as t, InvalidEmailError as u, RateLimitedError as v, ValidationIssue as x, ResendCooldownError as y };

package/dist/client/index.d.ts

@@ -1,2 +1,2 @@
-import { a as GoogleNamespace, c as WalletNamespace, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient, u as AuthFetchInit } from "../index-URk8yf8l.js";
-export { AuthClient, AuthFetchInit, CreateAuthClientOptions, EmailOtpNamespace, EmailPasswordNamespace, GoogleNamespace, ProactiveRefreshConfig, SubscribeOptions, WalletNamespace, createAuthClient };
+import { a as GoogleNamespace, c as SubscribeOptions, d as AuthFetchInit, i as EmailPasswordNamespace, l as WalletNamespace, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as RolesNamespace, t as AuthClient, u as createAuthClient } from "../index-DwFEdFaS.js";
+export { AuthClient, AuthFetchInit, CreateAuthClientOptions, EmailOtpNamespace, EmailPasswordNamespace, GoogleNamespace, ProactiveRefreshConfig, RolesNamespace, SubscribeOptions, WalletNamespace, createAuthClient };

package/dist/client/index.js

@@ -1,2 +1,2 @@
-import { t as createAuthClient } from "../client-DxhQkQcE.js";
+import { t as createAuthClient } from "../client-Dlhhdp-T.js";
 export { createAuthClient };

package/dist/{client-DxhQkQcE.js → client-Dlhhdp-T.js}

@@ -1,5 +1,142 @@
-import { _ as authErrorFromResponse, g as authErrorFromFetchFailure, n as AuthError } from "./authError-CYUAl2Jt.js";
+import { a as GoogleSignInCancelledError, b as authErrorFromResponse, n as AuthError, o as GoogleSignInError, y as authErrorFromFetchFailure } from "./authError-BPxMHQK2.js";
 import { n as memoryStore } from "./sessionStore-DD6lON9W.js";
+//#region src/client/googleHosted.ts
+const NONCE_STORAGE_KEY = "baliola-auth:google:nonce";
+const MESSAGE_TYPE = "baliola-auth:google";
+const POPUP_WINDOW_NAME = "baliola-auth-google";
+const DEFAULT_POPUP_WIDTH = 500;
+const DEFAULT_POPUP_HEIGHT = 640;
+const POPUP_POLL_INTERVAL_MS = 500;
+function browserWindow() {
+	return typeof globalThis.window === "undefined" ? null : globalThis.window;
+}
+function requireBrowserWindow(method) {
+	const win = browserWindow();
+	if (!win) throw new Error(`google.${method}: only available in a browser (window is undefined)`);
+	return win;
+}
+function parseExitMessage(data) {
+	if (typeof data !== "object" || data === null) return null;
+	const record = data;
+	if (record["type"] !== MESSAGE_TYPE) return null;
+	const nonce = record["nonce"];
+	return {
+		nonce: typeof nonce === "string" ? nonce : null,
+		...typeof record["code"] === "string" && { code: record["code"] },
+		...typeof record["error"] === "string" && { error: record["error"] }
+	};
+}
+function exitError(code) {
+	if (code === "access_denied") return new GoogleSignInCancelledError({ reason: "access_denied" });
+	return new GoogleSignInError({ code });
+}
+function createGoogleHosted(ctx) {
+	const authOrigin = new URL(ctx.baseUrl).origin;
+	function resolveReturnTo(returnTo) {
+		if (returnTo !== void 0 && /^https?:\/\//i.test(returnTo)) return returnTo;
+		const win = browserWindow();
+		if (!win) throw new Error("google.startUrl: returnTo must be an absolute URL outside a browser (window is undefined)");
+		if (returnTo === void 0) {
+			const current = new URL(win.location.href);
+			current.hash = "";
+			return current.toString();
+		}
+		return new URL(returnTo, win.location.href).toString();
+	}
+	function saveRedirectNonce(nonce) {
+		if (typeof globalThis.sessionStorage === "undefined") throw new Error("google.startUrl: sessionStorage is required for redirect mode");
+		globalThis.sessionStorage.setItem(NONCE_STORAGE_KEY, nonce);
+	}
+	function startUrl(opts) {
+		const url = new URL(`${ctx.baseUrl}/auth/google/start`);
+		url.searchParams.set("clientId", ctx.clientId);
+		url.searchParams.set("returnTo", resolveReturnTo(opts.returnTo));
+		url.searchParams.set("mode", opts.mode);
+		url.searchParams.set("nonce", opts.nonce);
+		if (opts.mode === "redirect") saveRedirectNonce(opts.nonce);
+		return url.toString();
+	}
+	function signInWithPopup(opts = {}) {
+		return new Promise((resolve, reject) => {
+			const win = requireBrowserWindow("signInWithPopup");
+			const nonce = crypto.randomUUID();
+			const url = startUrl({
+				mode: "popup",
+				nonce,
+				...opts.returnTo !== void 0 && { returnTo: opts.returnTo }
+			});
+			const width = opts.popup?.width ?? DEFAULT_POPUP_WIDTH;
+			const height = opts.popup?.height ?? DEFAULT_POPUP_HEIGHT;
+			const popup = win.open(url, POPUP_WINDOW_NAME, `popup,width=${width},height=${height}`);
+			if (!popup) {
+				reject(new GoogleSignInCancelledError({ reason: "popup_blocked" }));
+				return;
+			}
+			let settled = false;
+			let closeTimer = null;
+			const cleanup = () => {
+				settled = true;
+				win.removeEventListener("message", onMessage);
+				clearInterval(pollTimer);
+				if (closeTimer !== null) clearTimeout(closeTimer);
+			};
+			const onMessage = (event) => {
+				if (settled || event.origin !== authOrigin) return;
+				const message = parseExitMessage(event.data);
+				if (!message || message.nonce !== nonce) return;
+				cleanup();
+				if (message.code !== void 0) {
+					ctx.exchange({ code: message.code }).then(resolve, reject);
+					return;
+				}
+				reject(exitError(message.error ?? "oauth_unexpected"));
+			};
+			const pollTimer = setInterval(() => {
+				if (settled || !popup.closed || closeTimer !== null) return;
+				closeTimer = setTimeout(() => {
+					if (settled) return;
+					cleanup();
+					reject(new GoogleSignInCancelledError({ reason: "popup_closed" }));
+				}, POPUP_POLL_INTERVAL_MS);
+			}, POPUP_POLL_INTERVAL_MS);
+			win.addEventListener("message", onMessage);
+		});
+	}
+	function takeRedirectNonce() {
+		if (typeof globalThis.sessionStorage === "undefined") return null;
+		const saved = globalThis.sessionStorage.getItem(NONCE_STORAGE_KEY);
+		globalThis.sessionStorage.removeItem(NONCE_STORAGE_KEY);
+		return saved;
+	}
+	function stripExitParams(url) {
+		for (const key of [
+			"code",
+			"error",
+			"nonce"
+		]) url.searchParams.delete(key);
+		if (typeof globalThis.history === "undefined") return;
+		globalThis.history.replaceState(globalThis.history.state, "", url.toString());
+	}
+	async function completeRedirect(opts = {}) {
+		const win = requireBrowserWindow("completeRedirect");
+		const url = new URL(opts.url ?? win.location.href);
+		const code = url.searchParams.get("code");
+		const error = url.searchParams.get("error");
+		if (code === null && error === null) return null;
+		const nonce = url.searchParams.get("nonce");
+		const saved = takeRedirectNonce();
+		stripExitParams(url);
+		if (saved === null || nonce !== saved) throw new GoogleSignInError({ code: "oauth_nonce_mismatch" });
+		if (code === null) throw exitError(error ?? "oauth_unexpected");
+		return ctx.exchange({ code });
+	}
+	return {
+		startUrl,
+		signInWithPopup,
+		completeRedirect
+	};
+}
+//#endregion
 //#region src/client/methods.ts
 function toAuthSession(data) {
 	const issuedAt = Date.now();
@@ -16,13 +153,10 @@ function toAuthSession(data) {
 	};
 }
 function createMethods(ctx) {
-	const withClientId = (body) => {
-		if (ctx.clientId === void 0) return body;
-		return {
-			...body,
-			clientId: ctx.clientId
-		};
-	};
+	const withClientId = (body) => ({
+		...body,
+		clientId: ctx.clientId
+	});
 	return {
 		/** emailOtp.* (passwordless) */
 		async sendLoginCode(input) {
@@ -130,7 +264,15 @@ function createMethods(ctx) {
 				path: "/auth/google/login",
 				method: "POST",
 				authMode: "none",
-				body: withClientId("idToken" in input ? { idToken: input.idToken } : { code: input.code })
+				body: withClientId({ idToken: input.idToken })
+			}));
+		},
+		async googleExchange(input) {
+			return toAuthSession(await ctx.transport.request({
+				path: "/auth/google/exchange",
+				method: "POST",
+				authMode: "none",
+				body: { code: input.code }
 			}));
 		},
 		/** wallet.* */
@@ -149,6 +291,22 @@ function createMethods(ctx) {
 				body: { hash }
 			});
 		},
+		/** roles.* */
+		async applyRole(input) {
+			return ctx.transport.request({
+				path: "/auth/roles/apply",
+				method: "POST",
+				authMode: "bearer+session",
+				body: { roleName: input.roleName }
+			});
+		},
+		async getRoleStatus() {
+			return ctx.transport.request({
+				path: "/auth/roles/status",
+				method: "GET",
+				authMode: "bearer+session"
+			});
+		},
 		/** profile */
 		async getProfile() {
 			return ctx.transport.request({
@@ -381,7 +539,9 @@ const DEFAULT_PROACTIVE_LEAD_TIME_MS = 6e4;
 const BROADCAST_CHANNEL_NAME = "baliola.auth.session.v1";
 function createAuthClient(options) {
 	if (!options.baseUrl) throw new Error("createAuthClient: baseUrl is required");
+	if (!options.clientId) throw new Error("createAuthClient: clientId is required");
 	const baseUrl = options.baseUrl.replace(/\/+$/, "");
+	const clientId = options.clientId;
 	const store = options.store ?? memoryStore();
 	const fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
@@ -439,39 +599,61 @@ function createAuthClient(options) {
 	});
 	const methods = createMethods({
 		transport,
-		...options.clientId !== void 0 && { clientId: options.clientId }
+		clientId
 	});
-	return {
-		emailOtp: {
-			sendLoginCode: (input) => methods.sendLoginCode(input),
-			async verifyLoginCode(input) {
-				const session = await methods.verifyLoginCode(input);
-				await setSession(session);
-				return session;
-			},
-			resendLoginCode: (input) => methods.resendLoginCode(input)
+	const emailOtp = {
+		sendLoginCode: (input) => methods.sendLoginCode(input),
+		async verifyLoginCode(input) {
+			const session = await methods.verifyLoginCode(input);
+			await setSession(session);
+			return session;
 		},
-		emailPassword: {
-			register: (input) => methods.register(input),
-			async verifyRegistrationCode(input) {
-				const session = await methods.verifyRegistrationCode(input);
-				await setSession(session);
-				return session;
-			},
-			resendRegistrationCode: (input) => methods.resendRegistrationCode(input),
+		resendLoginCode: (input) => methods.resendLoginCode(input)
+	};
+	const emailPassword = {
+		register: (input) => methods.register(input),
+		async verifyRegistrationCode(input) {
+			const session = await methods.verifyRegistrationCode(input);
+			await setSession(session);
+			return session;
+		},
+		resendRegistrationCode: (input) => methods.resendRegistrationCode(input),
+		async login(input) {
+			const session = await methods.loginWithPassword(input);
+			await setSession(session);
+			return session;
+		},
+		setPassword: (input) => methods.setPassword(input),
+		changePassword: (input) => methods.changePassword(input)
+	};
+	async function googleExchange(input) {
+		const session = await methods.googleExchange(input);
+		await setSession(session);
+		return session;
+	}
+	const googleHosted = createGoogleHosted({
+		baseUrl,
+		clientId,
+		exchange: googleExchange
+	});
+	return {
+		emailOtp,
+		emailPassword,
+		google: {
 			async login(input) {
-				const session = await methods.loginWithPassword(input);
+				const session = await methods.loginWithGoogle(input);
 				await setSession(session);
 				return session;
 			},
-			setPassword: (input) => methods.setPassword(input),
-			changePassword: (input) => methods.changePassword(input)
+			startUrl: (opts) => googleHosted.startUrl(opts),
+			exchange: googleExchange,
+			signInWithPopup: (opts) => googleHosted.signInWithPopup(opts),
+			completeRedirect: (opts) => googleHosted.completeRedirect(opts)
+		},
+		roles: {
+			apply: (input) => methods.applyRole(input),
+			status: () => methods.getRoleStatus()
 		},
-		google: { async login(input) {
-			const session = await methods.loginWithGoogle(input);
-			await setSession(session);
-			return session;
-		} },
 		wallet: {
 			getAddress: async () => (await methods.getWalletAddress()).address,
 			signHash: async (hash) => (await methods.signWalletHash(hash)).signature

package/dist/errors/index.d.ts

@@ -1,2 +1,2 @@
-import { _ as authErrorFromFetchFailure, a as EmailAlreadyHasPasswordError, c as InvalidPasswordError, d as NoPasswordSetError, f as NoPendingOtpError, g as ResendCooldownError, h as RateLimitedError, i as CaptchaFailedError, l as MaxAttemptsError, m as OtpInvalidError, n as AuthError, o as InvalidCredentialsError, p as OtpExpiredError, r as AuthErrorInit, s as InvalidEmailError, t as AccountSuspendedError, u as MaxResendsError, v as authErrorFromResponse } from "../authError-DgPEjTfW.js";
-export { AccountSuspendedError, AuthError, type AuthErrorInit, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse };
+import { C as authErrorFromResponse, S as authErrorFromFetchFailure, _ as OtpInvalidError, a as EmailAlreadyHasPasswordError, b as ValidationError, c as GoogleSignInError, d as InvalidPasswordError, f as MaxAttemptsError, g as OtpExpiredError, h as NoPendingOtpError, i as CaptchaFailedError, l as InvalidCredentialsError, m as NoPasswordSetError, n as AuthError, o as GoogleSignInCancelledError, p as MaxResendsError, r as AuthErrorInit, s as GoogleSignInCancelledReason, t as AccountSuspendedError, u as InvalidEmailError, v as RateLimitedError, x as ValidationIssue, y as ResendCooldownError } from "../authError-E11ZMcID.js";
+export { AccountSuspendedError, AuthError, type AuthErrorInit, CaptchaFailedError, EmailAlreadyHasPasswordError, GoogleSignInCancelledError, type GoogleSignInCancelledReason, GoogleSignInError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, ValidationError, type ValidationIssue, authErrorFromFetchFailure, authErrorFromResponse };

package/dist/errors/index.js

@@ -1,2 +1,2 @@
-import { _ as authErrorFromResponse, a as InvalidCredentialsError, c as MaxAttemptsError, d as NoPendingOtpError, f as OtpExpiredError, g as authErrorFromFetchFailure, h as ResendCooldownError, i as EmailAlreadyHasPasswordError, l as MaxResendsError, m as RateLimitedError, n as AuthError, o as InvalidEmailError, p as OtpInvalidError, r as CaptchaFailedError, s as InvalidPasswordError, t as AccountSuspendedError, u as NoPasswordSetError } from "../authError-CYUAl2Jt.js";
-export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse };
+import { _ as ResendCooldownError, a as GoogleSignInCancelledError, b as authErrorFromResponse, c as InvalidEmailError, d as MaxResendsError, f as NoPasswordSetError, g as RateLimitedError, h as OtpInvalidError, i as EmailAlreadyHasPasswordError, l as InvalidPasswordError, m as OtpExpiredError, n as AuthError, o as GoogleSignInError, p as NoPendingOtpError, r as CaptchaFailedError, s as InvalidCredentialsError, t as AccountSuspendedError, u as MaxAttemptsError, v as ValidationError, y as authErrorFromFetchFailure } from "../authError-BPxMHQK2.js";
+export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, GoogleSignInCancelledError, GoogleSignInError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, ValidationError, authErrorFromFetchFailure, authErrorFromResponse };

package/dist/{index-URk8yf8l.d.ts → index-DwFEdFaS.d.ts}

@@ -1,6 +1,6 @@
-import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
-import { n as SessionStore } from "./sessionStore-BDdEpbL8.js";
-import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, m as ProfileResult, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, u as VerifyLoginCodeInput } from "./requests-jRLgNXyf.js";
+import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, u as SessionChangeHandler } from "./session-flM0yXx2.js";
+import { n as SessionStore } from "./sessionStore-D2kXjvNM.js";
+import { C as ProfileResult, _ as SendLoginCodeInput, b as VerifyRegistrationCodeInput, c as GoogleExchangeInput, d as GoogleStartOptions, f as LoginWithGoogleInput, g as ResendRegistrationCodeInput, h as ResendLoginCodeInput, i as RoleStatus, l as GoogleSignInWithPopupOptions, m as RegisterInput, o as ChangePasswordInput, p as LoginWithPasswordInput, r as RoleApplicationStatus, s as GoogleCompleteRedirectOptions, t as ApplyRoleInput, v as SetPasswordInput, y as VerifyLoginCodeInput } from "./roles-BZecOymZ.js";
 
 //#region src/client/transport.d.ts
 type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
@@ -31,8 +31,13 @@ type ProactiveRefreshConfig = false | {
   /** Refresh proactively if `expiresAt - now < leadTimeMs`. Defaults to 60_000 (60s). */leadTimeMs?: number;
 };
 type CreateAuthClientOptions = {
-  /** Base URL of the Baliola Auth server (no trailing slash). */baseUrl: string; /** Optional clientId, applied to every auth request that accepts one. */
-  clientId?: string;
+  /** Base URL of the Baliola Auth server (no trailing slash). */baseUrl: string;
+  /**
+   * The project's client id. Sent on every login and register body and used
+   * to build the hosted Google login URL. baliola-auth rejects login and
+   * register requests without one.
+   */
+  clientId: string;
   /**
    * Pluggable session store. Defaults to `memoryStore()`. Use
    * `localStorageStore()` in browsers for persistence across reloads.
@@ -65,10 +70,12 @@ type EmailOtpNamespace = {
    * Send a 6-digit one-time code to the email. Used for passwordless
    * login (existing accounts) or signup (creates a new account on verify).
    *
+   * The response never says whether the email is registered; the login
+   * versus signup branch is resolved by `verifyLoginCode`.
+   *
    * @example
    * const r = await auth.emailOtp.sendLoginCode({ email, captchaToken })
-   * // r = { flow: 'login'|'signup', methods: ['password','passwordless'],
-   * //       otp: { expiresInSeconds, expiresAt, canResendInSeconds, resendsRemaining } }
+   * // r = { otp: { expiresInSeconds, expiresAt, canResendInSeconds, resendsRemaining } }
    *
    * @throws CaptchaFailedError, RateLimitedError, InvalidEmailError, AuthError.
    */
@@ -118,19 +125,92 @@ type EmailPasswordNamespace = {
 /** Google flow. */
 type GoogleNamespace = {
   /**
-   * Sign in with Google. Pass `{ idToken }` from the Google Identity Services
-   * button or One Tap, or `{ code }` from the OAuth popup code flow
-   * (`google.accounts.oauth2.initCodeClient`), which the server exchanges
-   * for the ID token using its client secret.
+   * Sign in with a Google ID token from the Google Identity Services button
+   * or One Tap. Apps that do not load Google Identity Services should use
+   * `signInWithPopup` instead.
    *
-   * @throws AuthError with code `invalid_google_code` (401) when the exchange
-   *         fails, `google_code_unsupported` (400) when the server has no
-   *         client secret configured, AccountSuspendedError, AuthError.
-   * @example
-   * await auth.google.login({ idToken });
-   * await auth.google.login({ code });
+   * @throws AuthError (401) when the ID token fails verification,
+   *         GoogleSignInError with code `email_unverified`,
+   *         AccountSuspendedError, AuthError.
    */
   login(input: LoginWithGoogleInput): Promise<AuthSession>;
+  /**
+   * Build the `GET /auth/google/start` URL for the hosted login. Use it to
+   * drive the redirect flow yourself (`location.assign(url)`), or a custom
+   * popup. In `redirect` mode the nonce is saved in `sessionStorage` for
+   * `completeRedirect` to verify.
+   *
+   * @throws Error when `returnTo` is relative outside a browser, or when
+   *         `sessionStorage` is missing in `redirect` mode.
+   */
+  startUrl(opts: GoogleStartOptions & {
+    nonce: string;
+  }): string;
+  /**
+   * Exchange the one-time `code` from a hosted login exit for a session.
+   * `signInWithPopup` and `completeRedirect` call this for you; call it
+   * yourself only when driving `startUrl` manually.
+   *
+   * @throws GoogleSignInError with code `invalid_google_code` (401) when the
+   *         code is unknown, expired (60 s), or already used;
+   *         AccountSuspendedError, AuthError.
+   */
+  exchange(input: GoogleExchangeInput): Promise<AuthSession>;
+  /**
+   * Sign in with Google through the auth-hosted flow in a popup. Opens
+   * `startUrl` in a popup window, waits for the exit message, exchanges the
+   * one-time code, and stores the session. Browser only.
+   *
+   * @throws GoogleSignInCancelledError (`reason`: `popup_blocked`,
+   *         `popup_closed`, or `access_denied`), GoogleSignInError with the
+   *         exit or exchange code, Error outside a browser.
+   * @example
+   * try {
+   *   const session = await auth.google.signInWithPopup();
+   * } catch (e) {
+   *   if (e instanceof GoogleSignInCancelledError) return; // user backed out
+   *   throw e;
+   * }
+   */
+  signInWithPopup(opts?: GoogleSignInWithPopupOptions): Promise<AuthSession>;
+  /**
+   * Finish a hosted Google login started in `redirect` mode. Call it on the
+   * `returnTo` page. Resolves `null` when the URL carries no `code` or
+   * `error`, otherwise verifies the nonce saved by `startUrl`, strips
+   * `code`, `error`, and `nonce` from the URL, and exchanges the code.
+   * Browser only.
+   *
+   * @throws GoogleSignInError (`oauth_nonce_mismatch`, or the exit or
+   *         exchange code), GoogleSignInCancelledError (`access_denied`),
+   *         Error outside a browser.
+   * @example
+   * const session = await auth.google.completeRedirect();
+   * if (session) router.replace('/dashboard');
+   */
+  completeRedirect(opts?: GoogleCompleteRedirectOptions): Promise<AuthSession | null>;
+};
+/** Self-service role applications (`/auth/roles/*`). */
+type RolesNamespace = {
+  /**
+   * Apply for a self-applicable global role. The application lands at
+   * `pending_approval` until an admin approves it.
+   *
+   * @throws AuthError with `code` `role_already_active` or
+   *         `application_pending` (409), `role_not_self_applicable` (403),
+   *         a 400 for a role name outside the allowlist, a 401 for a missing
+   *         or expired session, and other API errors.
+   * @example
+   * const app = await auth.roles.apply({ roleName: 'module_deployer' });
+   * // app.status === 'pending_approval'
+   */
+  apply(input: ApplyRoleInput): Promise<RoleApplicationStatus>;
+  /**
+   * Application status for every self-applicable role. Always one row per
+   * role; `status` is `none` when the account has never applied.
+   *
+   * @throws AuthError on 401 (missing or expired session) and other API errors.
+   */
+  status(): Promise<RoleStatus[]>;
 };
 /** Custodial wallet (Console tier). */
 type WalletNamespace = {
@@ -141,6 +221,7 @@ type AuthClient = {
   emailOtp: EmailOtpNamespace;
   emailPassword: EmailPasswordNamespace;
   google: GoogleNamespace;
+  roles: RolesNamespace;
   wallet: WalletNamespace;
   /**
    * Fetch the token holder's identity: account (id, email, live status,
@@ -167,4 +248,4 @@ type AuthClient = {
 };
 declare function createAuthClient(options: CreateAuthClientOptions): AuthClient;
 //#endregion
-export { GoogleNamespace as a, WalletNamespace as c, EmailPasswordNamespace as i, createAuthClient as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, SubscribeOptions as s, AuthClient as t, AuthFetchInit as u };
+export { GoogleNamespace as a, SubscribeOptions as c, AuthFetchInit as d, EmailPasswordNamespace as i, WalletNamespace as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, RolesNamespace as s, AuthClient as t, createAuthClient as u };

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
-import { a as GoogleNamespace, c as WalletNamespace, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient, u as AuthFetchInit } from "./index-URk8yf8l.js";
-import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "./sessionStore-BDdEpbL8.js";
-import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, f as Profile, i as LoginWithPasswordInput, l as SetPasswordInput, m as ProfileResult, n as ChangePasswordInput, o as ResendLoginCodeInput, p as ProfileAccount, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, t as CaptchaArgs, u as VerifyLoginCodeInput } from "./requests-jRLgNXyf.js";
-import { _ as authErrorFromFetchFailure, a as EmailAlreadyHasPasswordError, c as InvalidPasswordError, d as NoPasswordSetError, f as NoPendingOtpError, g as ResendCooldownError, h as RateLimitedError, i as CaptchaFailedError, l as MaxAttemptsError, m as OtpInvalidError, n as AuthError, o as InvalidCredentialsError, p as OtpExpiredError, r as AuthErrorInit, s as InvalidEmailError, t as AccountSuspendedError, u as MaxResendsError, v as authErrorFromResponse } from "./authError-DgPEjTfW.js";
+import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-flM0yXx2.js";
+import { a as GoogleNamespace, c as SubscribeOptions, d as AuthFetchInit, i as EmailPasswordNamespace, l as WalletNamespace, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as RolesNamespace, t as AuthClient, u as createAuthClient } from "./index-DwFEdFaS.js";
+import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "./sessionStore-D2kXjvNM.js";
+import { C as ProfileResult, S as ProfileAccount, _ as SendLoginCodeInput, a as CaptchaArgs, b as VerifyRegistrationCodeInput, c as GoogleExchangeInput, d as GoogleStartOptions, f as LoginWithGoogleInput, g as ResendRegistrationCodeInput, h as ResendLoginCodeInput, i as RoleStatus, l as GoogleSignInWithPopupOptions, m as RegisterInput, n as RoleApplicationState, o as ChangePasswordInput, p as LoginWithPasswordInput, r as RoleApplicationStatus, s as GoogleCompleteRedirectOptions, t as ApplyRoleInput, u as GoogleStartMode, v as SetPasswordInput, x as Profile, y as VerifyLoginCodeInput } from "./roles-BZecOymZ.js";
+import { C as authErrorFromResponse, S as authErrorFromFetchFailure, _ as OtpInvalidError, a as EmailAlreadyHasPasswordError, b as ValidationError, c as GoogleSignInError, d as InvalidPasswordError, f as MaxAttemptsError, g as OtpExpiredError, h as NoPendingOtpError, i as CaptchaFailedError, l as InvalidCredentialsError, m as NoPasswordSetError, n as AuthError, o as GoogleSignInCancelledError, p as MaxResendsError, r as AuthErrorInit, s as GoogleSignInCancelledReason, t as AccountSuspendedError, u as InvalidEmailError, v as RateLimitedError, x as ValidationIssue, y as ResendCooldownError } from "./authError-E11ZMcID.js";
 import { n as AccessTokenPayloadProject, t as AccessTokenPayload } from "./tokens-BXrPLi5B.js";
 
 //#region src/types/wallet.d.ts
@@ -16,4 +16,4 @@ type SignHashResult = {
   address: string;
 };
 //#endregion
-export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleNamespace, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Profile, type ProfileAccount, type ProfileResult, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SignHashResult, type SubscribeOptions, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, type WalletAddressResult, type WalletNamespace, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };
+export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type ApplyRoleInput, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleCompleteRedirectOptions, type GoogleExchangeInput, type GoogleNamespace, GoogleSignInCancelledError, type GoogleSignInCancelledReason, GoogleSignInError, type GoogleSignInWithPopupOptions, type GoogleStartMode, type GoogleStartOptions, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Profile, type ProfileAccount, type ProfileResult, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type RoleApplicationState, type RoleApplicationStatus, type RoleStatus, type RolesNamespace, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SignHashResult, type SubscribeOptions, ValidationError, type ValidationIssue, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, type WalletAddressResult, type WalletNamespace, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { t as createAuthClient } from "./client-DxhQkQcE.js";
-import { _ as authErrorFromResponse, a as InvalidCredentialsError, c as MaxAttemptsError, d as NoPendingOtpError, f as OtpExpiredError, g as authErrorFromFetchFailure, h as ResendCooldownError, i as EmailAlreadyHasPasswordError, l as MaxResendsError, m as RateLimitedError, n as AuthError, o as InvalidEmailError, p as OtpInvalidError, r as CaptchaFailedError, s as InvalidPasswordError, t as AccountSuspendedError, u as NoPasswordSetError } from "./authError-CYUAl2Jt.js";
+import { _ as ResendCooldownError, a as GoogleSignInCancelledError, b as authErrorFromResponse, c as InvalidEmailError, d as MaxResendsError, f as NoPasswordSetError, g as RateLimitedError, h as OtpInvalidError, i as EmailAlreadyHasPasswordError, l as InvalidPasswordError, m as OtpExpiredError, n as AuthError, o as GoogleSignInError, p as NoPendingOtpError, r as CaptchaFailedError, s as InvalidCredentialsError, t as AccountSuspendedError, u as MaxAttemptsError, v as ValidationError, y as authErrorFromFetchFailure } from "./authError-BPxMHQK2.js";
+import { t as createAuthClient } from "./client-Dlhhdp-T.js";
 import { n as memoryStore, t as localStorageStore } from "./sessionStore-DD6lON9W.js";
-export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };
+export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, GoogleSignInCancelledError, GoogleSignInError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, ValidationError, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/roles-BZecOymZ.d.ts

@@ -0,0 +1,123 @@
+import { t as Account } from "./session-flM0yXx2.js";
+
+//#region src/types/profile.d.ts
+/** The account's profile record; every field is user-editable and nullable. */
+type Profile = {
+  displayName: string | null;
+  avatarUrl: string | null;
+  primaryEmail: string | null;
+  primaryPhone: string | null;
+};
+/** The account as returned by `auth.getProfile`, with sign-in capability flags. */
+type ProfileAccount = Account & {
+  /**
+   * `true` when the account can sign in with a password; `false` for
+   * Google-only or code-only accounts, which should call
+   * `auth.emailPassword.setPassword` rather than `changePassword`.
+   */
+  hasPassword: boolean;
+};
+/** Result of `auth.getProfile`, the identity read for the token holder. */
+type ProfileResult = {
+  /** `status` is the live account status, not a token-time snapshot. */account: ProfileAccount; /** `null` when the account has no profile row yet. */
+  profile: Profile | null;
+};
+//#endregion
+//#region src/types/requests.d.ts
+/** Optional captcha argument shared by every public unauthenticated entrypoint. */
+type CaptchaArgs = {
+  /** Cloudflare Turnstile token. Required when captcha is enabled on the server. */captchaToken?: string;
+};
+type SendLoginCodeInput = {
+  email: string;
+} & CaptchaArgs;
+type VerifyLoginCodeInput = {
+  email: string;
+  code: string;
+};
+type ResendLoginCodeInput = {
+  email: string;
+} & CaptchaArgs;
+type RegisterInput = {
+  email: string;
+  password: string;
+} & CaptchaArgs;
+type VerifyRegistrationCodeInput = {
+  email: string;
+  code: string;
+};
+type ResendRegistrationCodeInput = {
+  email: string;
+} & CaptchaArgs;
+type LoginWithPasswordInput = {
+  email: string;
+  password: string;
+} & CaptchaArgs;
+type SetPasswordInput = {
+  password: string;
+};
+type ChangePasswordInput = {
+  currentPassword: string;
+  newPassword: string;
+};
+/** `idToken` comes from Google Identity Services (`renderButton` / One Tap). */
+type LoginWithGoogleInput = {
+  idToken: string;
+};
+/** The one-time code handed to the app by the hosted Google login exit. */
+type GoogleExchangeInput = {
+  code: string;
+};
+type GoogleStartMode = 'popup' | 'redirect';
+type GoogleStartOptions = {
+  /**
+   * Where the browser lands after Google. Absolute URL or a path resolved
+   * against `window.location`. Its origin must be one of the project's
+   * `allowedOrigins`. Default: the current href without its hash.
+   */
+  returnTo?: string; /** `popup` posts the result to `window.opener`; `redirect` 302s back to `returnTo`. */
+  mode: GoogleStartMode; /** Opaque value echoed back on the exit. Supplied by `signInWithPopup`; callers normally omit it. */
+  nonce?: string;
+};
+type GoogleSignInWithPopupOptions = {
+  /** See `GoogleStartOptions.returnTo`. Default: the current href without its hash. */returnTo?: string;
+  popup?: {
+    /** Popup width in CSS pixels. Default: 500. */width?: number; /** Popup height in CSS pixels. Default: 640. */
+    height?: number;
+  };
+};
+type GoogleCompleteRedirectOptions = {
+  /** URL to read `code`, `error`, and `nonce` from. Default: `window.location.href`. */url?: string;
+};
+//#endregion
+//#region src/types/roles.d.ts
+/** Lifecycle of a role application, as stored on the server. */
+type RoleApplicationState = 'pending_approval' | 'active' | 'revoked';
+/** Input of `auth.roles.apply`. */
+type ApplyRoleInput = {
+  /** Role to apply for. Only names on the server's self-applicable allowlist are accepted. */roleName: string;
+};
+/** Result of `auth.roles.apply`: the account role row the server created. */
+type RoleApplicationStatus = {
+  id: string;
+  accountId: string;
+  roleId: string; /** `null` for a global role. */
+  projectId: string | null;
+  status: RoleApplicationState; /** Account id that created the row: an admin, or the applicant for a self-service application. */
+  assignedBy: string | null;
+  assignedAt: string;
+  approvedAt: string | null;
+  revokedAt: string | null;
+};
+/** One row of `auth.roles.status`, from the caller's point of view. */
+type RoleStatus = {
+  roleName: string;
+  displayName: string | null; /** `none` when the account has never applied for this role. */
+  status: RoleApplicationState | 'none'; /** `null` until the account applies. */
+  accountRoleId: string | null;
+  assignedAt: string | null;
+  approvedAt: string | null;
+  revokedAt: string | null;
+};
+//#endregion
+export { ProfileResult as C, ProfileAccount as S, SendLoginCodeInput as _, CaptchaArgs as a, VerifyRegistrationCodeInput as b, GoogleExchangeInput as c, GoogleStartOptions as d, LoginWithGoogleInput as f, ResendRegistrationCodeInput as g, ResendLoginCodeInput as h, RoleStatus as i, GoogleSignInWithPopupOptions as l, RegisterInput as m, RoleApplicationState as n, ChangePasswordInput as o, LoginWithPasswordInput as p, RoleApplicationStatus as r, GoogleCompleteRedirectOptions as s, ApplyRoleInput as t, GoogleStartMode as u, SetPasswordInput as v, Profile as x, VerifyLoginCodeInput as y };

package/dist/{session-Cs_P7ojF.d.ts → session-flM0yXx2.d.ts}

@@ -28,11 +28,13 @@ type OtpInfo = {
   canResendInSeconds: number; /** Resend attempts left for this OTP record. */
   resendsRemaining: number;
 };
-/** Result of `auth.emailOtp.sendLoginCode`. */
+/**
+ * Result of `auth.emailOtp.sendLoginCode`. Carries only OTP timing: the
+ * server does not reveal whether the email is registered, so login versus
+ * signup is only known after `verifyLoginCode`.
+ */
 type SendLoginCodeResult = {
-  /** Whether the BE recognizes the email as an existing account or a new signup. */flow: 'login' | 'signup'; /** Available login methods for this email. */
-  methods: ('password' | 'passwordless')[]; /** OTP timing metadata. */
-  otp: OtpInfo;
+  /** OTP timing metadata. */otp: OtpInfo;
 };
 /** Result of any resend method (`emailOtp.resendLoginCode`, `emailPassword.resendRegistrationCode`). */
 type ResendCodeResult = {

package/dist/{sessionStore-BDdEpbL8.d.ts → sessionStore-D2kXjvNM.d.ts}

@@ -1,4 +1,4 @@
-import { n as AuthSession } from "./session-Cs_P7ojF.js";
+import { n as AuthSession } from "./session-flM0yXx2.js";
 
 //#region src/store/sessionStore.d.ts
 /**

package/dist/store/index.d.ts

@@ -1,2 +1,2 @@
-import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "../sessionStore-BDdEpbL8.js";
+import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "../sessionStore-D2kXjvNM.js";
 export { type LocalStorageStoreOptions, type SessionStore, localStorageStore, memoryStore };

package/dist/types/index.d.ts

@@ -1,4 +1,4 @@
-import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "../session-Cs_P7ojF.js";
-import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, f as Profile, i as LoginWithPasswordInput, l as SetPasswordInput, m as ProfileResult, n as ChangePasswordInput, o as ResendLoginCodeInput, p as ProfileAccount, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, t as CaptchaArgs, u as VerifyLoginCodeInput } from "../requests-jRLgNXyf.js";
+import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "../session-flM0yXx2.js";
+import { C as ProfileResult, S as ProfileAccount, _ as SendLoginCodeInput, a as CaptchaArgs, b as VerifyRegistrationCodeInput, c as GoogleExchangeInput, d as GoogleStartOptions, f as LoginWithGoogleInput, g as ResendRegistrationCodeInput, h as ResendLoginCodeInput, i as RoleStatus, l as GoogleSignInWithPopupOptions, m as RegisterInput, n as RoleApplicationState, o as ChangePasswordInput, p as LoginWithPasswordInput, r as RoleApplicationStatus, s as GoogleCompleteRedirectOptions, t as ApplyRoleInput, u as GoogleStartMode, v as SetPasswordInput, x as Profile, y as VerifyLoginCodeInput } from "../roles-BZecOymZ.js";
 import { n as AccessTokenPayloadProject, t as AccessTokenPayload } from "../tokens-BXrPLi5B.js";
-export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, type AuthSession, type CaptchaArgs, type ChangePasswordInput, type ErrorHandler, type ErrorSource, type LoginWithGoogleInput, type LoginWithPasswordInput, type OtpInfo, type Profile, type ProfileAccount, type ProfileResult, type Project, type RegisterInput, type RegisterResult, type ResendCodeResult, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SetPasswordInput, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput };
+export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, type ApplyRoleInput, type AuthSession, type CaptchaArgs, type ChangePasswordInput, type ErrorHandler, type ErrorSource, type GoogleCompleteRedirectOptions, type GoogleExchangeInput, type GoogleSignInWithPopupOptions, type GoogleStartMode, type GoogleStartOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, type OtpInfo, type Profile, type ProfileAccount, type ProfileResult, type Project, type RegisterInput, type RegisterResult, type ResendCodeResult, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type RoleApplicationState, type RoleApplicationStatus, type RoleStatus, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SetPasswordInput, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput };

package/dist/wallet/index.d.ts

@@ -1,4 +1,4 @@
-import { t as AuthClient } from "../index-URk8yf8l.js";
+import { t as AuthClient } from "../index-DwFEdFaS.js";
 import { LocalAccount } from "viem";
 
 //#region src/wallet/index.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baliola/auth-sdk",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Client SDK for Baliola Auth",
   "keywords": [
     "auth",

package/dist/requests-jRLgNXyf.d.ts

@@ -1,75 +0,0 @@
-import { t as Account } from "./session-Cs_P7ojF.js";
-
-//#region src/types/profile.d.ts
-/** The account's profile record; every field is user-editable and nullable. */
-type Profile = {
-  displayName: string | null;
-  avatarUrl: string | null;
-  primaryEmail: string | null;
-  primaryPhone: string | null;
-};
-/** The account as returned by `auth.getProfile`, with sign-in capability flags. */
-type ProfileAccount = Account & {
-  /**
-   * `true` when the account can sign in with a password; `false` for
-   * Google-only or code-only accounts, which should call
-   * `auth.emailPassword.setPassword` rather than `changePassword`.
-   */
-  hasPassword: boolean;
-};
-/** Result of `auth.getProfile`, the identity read for the token holder. */
-type ProfileResult = {
-  /** `status` is the live account status, not a token-time snapshot. */account: ProfileAccount; /** `null` when the account has no profile row yet. */
-  profile: Profile | null;
-};
-//#endregion
-//#region src/types/requests.d.ts
-/** Optional captcha argument shared by every public unauthenticated entrypoint. */
-type CaptchaArgs = {
-  /** Cloudflare Turnstile token. Required when captcha is enabled on the server. */captchaToken?: string;
-};
-type SendLoginCodeInput = {
-  email: string;
-} & CaptchaArgs;
-type VerifyLoginCodeInput = {
-  email: string;
-  code: string;
-};
-type ResendLoginCodeInput = {
-  email: string;
-} & CaptchaArgs;
-type RegisterInput = {
-  email: string;
-  password: string;
-} & CaptchaArgs;
-type VerifyRegistrationCodeInput = {
-  email: string;
-  code: string;
-};
-type ResendRegistrationCodeInput = {
-  email: string;
-} & CaptchaArgs;
-type LoginWithPasswordInput = {
-  email: string;
-  password: string;
-} & CaptchaArgs;
-type SetPasswordInput = {
-  password: string;
-};
-type ChangePasswordInput = {
-  currentPassword: string;
-  newPassword: string;
-};
-/**
- * Exactly one of the two shapes. `idToken` comes from Google Identity Services
- * (`renderButton` / One Tap). `code` is the authorization code from
- * `google.accounts.oauth2.initCodeClient` in popup mode; the server exchanges
- * it for the ID token, so the client secret never reaches the browser.
- */
-type LoginWithGoogleInput = {
-  idToken: string;
-} | {
-  code: string;
-};
-//#endregion
-export { RegisterInput as a, SendLoginCodeInput as c, VerifyRegistrationCodeInput as d, Profile as f, LoginWithPasswordInput as i, SetPasswordInput as l, ProfileResult as m, ChangePasswordInput as n, ResendLoginCodeInput as o, ProfileAccount as p, LoginWithGoogleInput as r, ResendRegistrationCodeInput as s, CaptchaArgs as t, VerifyLoginCodeInput as u };