@baliola/auth-sdk 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 All notable changes to `@baliola/auth-sdk` are documented here.
 
+## 0.7.0
+
+Self-service roles and a stricter login contract. baliola-auth added `POST /auth/roles/apply` and
+`GET /auth/roles/status` (issue #61), dropped `flow` and `methods` from the send-login-code
+response so it can no longer reveal whether an email is registered, and is making `clientId`
+mandatory on every login and register body (issue #60) so that only the Console client can mint a
+token carrying global roles.
+
+### New features
+
+- feat(client): `auth.roles.apply({ roleName })` posts a self-service application for an
+  allowlisted global role and returns the account role row (`RoleApplicationStatus`);
+  `auth.roles.status()` returns one `RoleStatus` per self-applicable role, with `status: 'none'`
+  when the account never applied. Both need a session. Conflicts surface as `AuthError` with
+  `code` `role_already_active` or `application_pending`.
+- feat(types): `ApplyRoleInput`, `RoleApplicationState`, `RoleApplicationStatus`, `RoleStatus`,
+  and `RolesNamespace` are exported from the root and the `./types` subpath.
+- feat(errors): `ValidationError` (`code: 'validation_error'`, 400) with
+  `issues: ValidationIssue[]`, one `{ path, message }` per rejected request field.
+  baliola-auth now routes every request validation failure through the standard error
+  envelope under this code, so a login body without `clientId` or an `apply` with a role name
+  outside the allowlist is an `instanceof ValidationError`. Exported from the root and the
+  `./errors` subpath, together with the `ValidationIssue` type.
+- Admin role management (`/admin/roles/*`: approve, revoke, list applications) is deliberately not
+  in this SDK. It is a client library for end-user apps; the Baliola Console keeps its own direct
+  client for `/admin/*`. This closes the open question on issue #61.
+
+### Breaking changes
+
+- feat(client)!: `clientId` is now a required option of `createAuthClient`. Construction throws
+  `Error('createAuthClient: clientId is required')` when it is missing or empty, the same way
+  `baseUrl` is handled. Every login and register body always carries it, and
+  `auth.google.startUrl` no longer has its own `clientId` check. The "central" multi-project login
+  that omitted `clientId` is gone on the server side, so there is nothing to migrate to: pass the
+  client id of the project the app belongs to.
+- chore(types)!: `SendLoginCodeResult` is narrowed to `{ otp: OtpInfo }`. The `flow` and `methods`
+  fields are removed because the server no longer sends them (baliola-auth commit `7f29126`);
+  whether the email is a login or a signup is only known after `verifyLoginCode`.
+- Per `RELEASING.md` these are pre-1.0 breaks shipped as a minor with this explicit callout.
+
 ## 0.6.0
 
 Hosted Google login. baliola-auth now runs the Google OAuth round trip itself

package/README.md

@@ -31,7 +31,7 @@ import { createAuthClient, localStorageStore, OtpInvalidError } from '@baliola/a
 
 const auth = createAuthClient({
   baseUrl: AUTH_URL,
-  clientId: 'your-project-client-id', // omit for a central multi-project login
+  clientId: 'your-project-client-id', // required; scopes every login to this project
   store: localStorageStore(), // omit for in-memory (server-side / tests)
 });
 await auth.loadSession(); // rehydrate from store at app boot
@@ -66,7 +66,7 @@ The SDK is namespaced by flow so that each method's purpose is unambiguous at th
 
 ```ts
 auth.emailOtp.sendLoginCode({ email, captchaToken });
-//   → { flow: 'login'|'signup', methods: ('password'|'passwordless')[], otp: OtpInfo }
+//   → { otp: OtpInfo }  (never says whether the email is registered)
 
 auth.emailOtp.verifyLoginCode({ email, code });
 //   → AuthSession  (also populates the session mirror)
@@ -143,7 +143,7 @@ import { createAuthClient } from '@baliola/auth-sdk';
 import { createRemoteSigner } from '@baliola/auth-sdk/wallet';
 import { toSmartAccount } from '@baliola/smart-account-sdk';
 
-const auth = createAuthClient({ baseUrl });
+const auth = createAuthClient({ baseUrl, clientId });
 await auth.emailOtp.verifyLoginCode({ email, code }); // authenticated session
 
 const owner = await createRemoteSigner(auth);          // viem LocalAccount, signs server-side
@@ -152,6 +152,22 @@ const account = await toSmartAccount({ owner, chain: 'macTestnet' });
 
 The private key never leaves baliola-auth; `owner.signMessage({ raw })` calls `POST /auth/wallet/sign`.
 
+### `auth.roles` (self-service role applications)
+
+```ts
+const app = await auth.roles.apply({ roleName: 'module_deployer' }); // POST /auth/roles/apply
+// app = { id, accountId, roleId, projectId, status: 'pending_approval', assignedBy, assignedAt, approvedAt, revokedAt }
+
+const rows = await auth.roles.status(); // GET /auth/roles/status
+// rows = [{ roleName, displayName, status: 'none'|'pending_approval'|'active'|'revoked', accountRoleId, assignedAt, approvedAt, revokedAt }]
+```
+
+Both need a session. `apply` rejects with `AuthError` whose `code` is `role_already_active` or
+`application_pending` (409) when there is nothing to do, and with a 400 when the role name is not
+on the server's self-applicable allowlist (`ValidationError`, `issues[0].path === 'roleName'`). Approving, revoking, and listing applications are `/admin/*` endpoints and are
+deliberately not part of this SDK; an admin surface such as the Baliola Console calls them with
+its own client.
+
 ### Profile (identity read)
 
 ```ts
@@ -259,6 +275,7 @@ try {
 | `RateLimitedError`             | (legacy 429)                 | 429    | `retryAfterSeconds`, `retryAfterHuman`     |
 | `GoogleSignInCancelledError`   | `oauth_cancelled`            | 0      | `reason: 'popup_blocked'\|'popup_closed'\|'access_denied'` |
 | `GoogleSignInError`            | `invalid_google_code`, `email_unverified`, `invalid_oauth_state`, `oauth_unexpected`, `oauth_nonce_mismatch` | 401 / 400 / 0 | none |
+| `ValidationError`              | `validation_error`           | 400    | `issues: { path, message }[]`              |
 | `AuthError` (base)             | varies                       | varies | `status: 0` for network/timeout            |
 
 ## Stores
@@ -282,7 +299,7 @@ Cross-tab sync (login / logout / refresh) is automatic via `BroadcastChannel`, r
 ```ts
 createAuthClient({
   baseUrl: AUTH_URL, // required, no trailing slash
-  clientId: 'your-project-client-id', // optional; scopes the session to one project. Omit for a central login that carries every project the account has active roles in.
+  clientId: 'your-project-client-id', // required; sent on every login and register body
   store: memoryStore(), // default; or localStorageStore() / custom
   fetch: globalThis.fetch, // override for tests / interceptors
   timeoutMs: 15_000, // per-request, default 15s
@@ -291,7 +308,8 @@ createAuthClient({
 });
 ```
 
-`clientId` is constructor-only — there is no per-call override. To switch projects, create a new client.
+`clientId` is constructor-only, there is no per-call override. To switch projects, create a new client.
+`createAuthClient` throws a plain `Error` when `clientId` is missing or empty, the same way it does for `baseUrl`.
 
 ## Decoding the JWT
 
@@ -305,7 +323,7 @@ const session = auth.getSession();
 if (session) {
   const claims = decodeJwt<AccessTokenPayload>(session.accessToken);
   // claims.accountId, claims.email
-  // claims.projects: { id, name, clientId }[]   // single entry for a scoped login; many for a central login
+  // claims.projects: { id, name, clientId }[]   // the project the login was scoped to; the Console client also carries global roles
   // claims.roles?: string[]; claims.permissions?: string[]
 }
 ```
@@ -318,8 +336,6 @@ if (session) {
 
 ```json
 {
-  "flow": "signup",
-  "methods": ["passwordless"],
   "otp": {
     "expiresInSeconds": 300,
     "expiresAt": "2026-05-04T12:05:00.000Z",
@@ -365,6 +381,38 @@ if (session) {
 }
 ```
 
+**`auth.roles.apply` success (`RoleApplicationStatus`, HTTP 201):**
+
+```json
+{
+  "id": "6f1c2d3e-0000-4000-8000-000000000001",
+  "accountId": "6f1c2d3e-0000-4000-8000-0000000000aa",
+  "roleId": "6f1c2d3e-0000-4000-8000-0000000000bb",
+  "projectId": null,
+  "status": "pending_approval",
+  "assignedBy": null,
+  "assignedAt": "2026-09-04T00:00:00.000Z",
+  "approvedAt": null,
+  "revokedAt": null
+}
+```
+
+**`auth.roles.status` success (`RoleStatus[]`):**
+
+```json
+[
+  {
+    "roleName": "module_deployer",
+    "displayName": "Module Deployer",
+    "status": "none",
+    "accountRoleId": null,
+    "assignedAt": null,
+    "approvedAt": null,
+    "revokedAt": null
+  }
+]
+```
+
 **Verify-code failure (e.g. `OtpInvalidError`):**
 
 ```json

package/dist/{authError-CUQ1rFAr.js → authError-BPxMHQK2.js}

@@ -167,6 +167,18 @@ var GoogleSignInError = class extends AuthError {
 		this.name = "GoogleSignInError";
 	}
 };
+/**
+* Request validation failed. Thrown for `validation_error` (400) on any
+* endpoint; `issues` names each rejected field.
+*/
+var ValidationError = class extends AuthError {
+	issues;
+	constructor(init) {
+		super(init);
+		this.name = "ValidationError";
+		this.issues = init.issues;
+	}
+};
 function num(d, key, fallback = 0) {
 	const v = d?.[key];
 	return typeof v === "number" ? v : fallback;
@@ -175,6 +187,21 @@ function str(d, key, fallback = "") {
 	const v = d?.[key];
 	return typeof v === "string" ? v : fallback;
 }
+function issues(d) {
+	const raw = d?.["issues"];
+	if (!Array.isArray(raw)) return [];
+	const out = [];
+	for (const entry of raw) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const record = entry;
+		if (typeof record["path"] !== "string" || typeof record["message"] !== "string") continue;
+		out.push({
+			path: record["path"],
+			message: record["message"]
+		});
+	}
+	return out;
+}
 /**
 * Map a backend error response onto the right AuthError subclass.
 * Falls back to `AuthError` (with status + code preserved) for unknown codes.
@@ -230,6 +257,10 @@ async function authErrorFromResponse(response) {
 			...init,
 			code
 		});
+		case "validation_error": return new ValidationError({
+			...init,
+			issues: issues(details)
+		});
 		default:
 			if (response.status === 429) {
 				const retryAfterSeconds = num(details, "retryAfter") || num(details, "retryAfterSeconds") || Number(response.headers.get("Retry-After") ?? 0);
@@ -253,4 +284,4 @@ function authErrorFromFetchFailure(cause, isTimeout = false) {
 	});
 }
 //#endregion
-export { ResendCooldownError as _, GoogleSignInCancelledError as a, InvalidEmailError as c, MaxResendsError as d, NoPasswordSetError as f, RateLimitedError as g, OtpInvalidError as h, EmailAlreadyHasPasswordError as i, InvalidPasswordError as l, OtpExpiredError as m, AuthError as n, GoogleSignInError as o, NoPendingOtpError as p, CaptchaFailedError as r, InvalidCredentialsError as s, AccountSuspendedError as t, MaxAttemptsError as u, authErrorFromFetchFailure as v, authErrorFromResponse as y };
+export { ResendCooldownError as _, GoogleSignInCancelledError as a, authErrorFromResponse as b, InvalidEmailError as c, MaxResendsError as d, NoPasswordSetError as f, RateLimitedError as g, OtpInvalidError as h, EmailAlreadyHasPasswordError as i, InvalidPasswordError as l, OtpExpiredError as m, AuthError as n, GoogleSignInError as o, NoPendingOtpError as p, CaptchaFailedError as r, InvalidCredentialsError as s, AccountSuspendedError as t, MaxAttemptsError as u, ValidationError as v, authErrorFromFetchFailure as y };

package/dist/{authError-CDoEEOP_.d.ts → authError-E11ZMcID.d.ts}

@@ -118,6 +118,21 @@ declare class GoogleSignInError extends AuthError {
     code: string;
   } & Partial<AuthErrorInit>);
 }
+/** One failing request field, as reported by the server's validation hook. */
+type ValidationIssue = {
+  /** Dot-joined path of the field, for example `clientId` or `otp`. */path: string;
+  message: string;
+};
+/**
+ * Request validation failed. Thrown for `validation_error` (400) on any
+ * endpoint; `issues` names each rejected field.
+ */
+declare class ValidationError extends AuthError {
+  readonly issues: ValidationIssue[];
+  constructor(init: AuthErrorInit & {
+    issues: ValidationIssue[];
+  });
+}
 /**
  * Map a backend error response onto the right AuthError subclass.
  * Falls back to `AuthError` (with status + code preserved) for unknown codes.
@@ -126,4 +141,4 @@ declare function authErrorFromResponse(response: Response): Promise<AuthError>;
 /** Network/timeout failures land here. */
 declare function authErrorFromFetchFailure(cause: unknown, isTimeout?: boolean): AuthError;
 //#endregion
-export { OtpInvalidError as _, EmailAlreadyHasPasswordError as a, authErrorFromFetchFailure as b, GoogleSignInError as c, InvalidPasswordError as d, MaxAttemptsError as f, OtpExpiredError as g, NoPendingOtpError as h, CaptchaFailedError as i, InvalidCredentialsError as l, NoPasswordSetError as m, AuthError as n, GoogleSignInCancelledError as o, MaxResendsError as p, AuthErrorInit as r, GoogleSignInCancelledReason as s, AccountSuspendedError as t, InvalidEmailError as u, RateLimitedError as v, authErrorFromResponse as x, ResendCooldownError as y };
+export { authErrorFromResponse as C, authErrorFromFetchFailure as S, OtpInvalidError as _, EmailAlreadyHasPasswordError as a, ValidationError as b, GoogleSignInError as c, InvalidPasswordError as d, MaxAttemptsError as f, OtpExpiredError as g, NoPendingOtpError as h, CaptchaFailedError as i, InvalidCredentialsError as l, NoPasswordSetError as m, AuthError as n, GoogleSignInCancelledError as o, MaxResendsError as p, AuthErrorInit as r, GoogleSignInCancelledReason as s, AccountSuspendedError as t, InvalidEmailError as u, RateLimitedError as v, ValidationIssue as x, ResendCooldownError as y };

package/dist/client/index.d.ts

@@ -1,2 +1,2 @@
-import { a as GoogleNamespace, c as WalletNamespace, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient, u as AuthFetchInit } from "../index-CFXMA6WD.js";
-export { AuthClient, AuthFetchInit, CreateAuthClientOptions, EmailOtpNamespace, EmailPasswordNamespace, GoogleNamespace, ProactiveRefreshConfig, SubscribeOptions, WalletNamespace, createAuthClient };
+import { a as GoogleNamespace, c as SubscribeOptions, d as AuthFetchInit, i as EmailPasswordNamespace, l as WalletNamespace, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as RolesNamespace, t as AuthClient, u as createAuthClient } from "../index-DwFEdFaS.js";
+export { AuthClient, AuthFetchInit, CreateAuthClientOptions, EmailOtpNamespace, EmailPasswordNamespace, GoogleNamespace, ProactiveRefreshConfig, RolesNamespace, SubscribeOptions, WalletNamespace, createAuthClient };

package/dist/client/index.js

@@ -1,2 +1,2 @@
-import { t as createAuthClient } from "../client-Bk9WIMVc.js";
+import { t as createAuthClient } from "../client-Dlhhdp-T.js";
 export { createAuthClient };

package/dist/{client-Bk9WIMVc.js → client-Dlhhdp-T.js}

@@ -1,4 +1,4 @@
-import { a as GoogleSignInCancelledError, n as AuthError, o as GoogleSignInError, v as authErrorFromFetchFailure, y as authErrorFromResponse } from "./authError-CUQ1rFAr.js";
+import { a as GoogleSignInCancelledError, b as authErrorFromResponse, n as AuthError, o as GoogleSignInError, y as authErrorFromFetchFailure } from "./authError-BPxMHQK2.js";
 import { n as memoryStore } from "./sessionStore-DD6lON9W.js";
 //#region src/client/googleHosted.ts
 const NONCE_STORAGE_KEY = "baliola-auth:google:nonce";
@@ -48,7 +48,6 @@ function createGoogleHosted(ctx) {
 		globalThis.sessionStorage.setItem(NONCE_STORAGE_KEY, nonce);
 	}
 	function startUrl(opts) {
-		if (ctx.clientId === void 0) throw new Error("google.startUrl: clientId is required");
 		const url = new URL(`${ctx.baseUrl}/auth/google/start`);
 		url.searchParams.set("clientId", ctx.clientId);
 		url.searchParams.set("returnTo", resolveReturnTo(opts.returnTo));
@@ -154,13 +153,10 @@ function toAuthSession(data) {
 	};
 }
 function createMethods(ctx) {
-	const withClientId = (body) => {
-		if (ctx.clientId === void 0) return body;
-		return {
-			...body,
-			clientId: ctx.clientId
-		};
-	};
+	const withClientId = (body) => ({
+		...body,
+		clientId: ctx.clientId
+	});
 	return {
 		/** emailOtp.* (passwordless) */
 		async sendLoginCode(input) {
@@ -295,6 +291,22 @@ function createMethods(ctx) {
 				body: { hash }
 			});
 		},
+		/** roles.* */
+		async applyRole(input) {
+			return ctx.transport.request({
+				path: "/auth/roles/apply",
+				method: "POST",
+				authMode: "bearer+session",
+				body: { roleName: input.roleName }
+			});
+		},
+		async getRoleStatus() {
+			return ctx.transport.request({
+				path: "/auth/roles/status",
+				method: "GET",
+				authMode: "bearer+session"
+			});
+		},
 		/** profile */
 		async getProfile() {
 			return ctx.transport.request({
@@ -527,7 +539,9 @@ const DEFAULT_PROACTIVE_LEAD_TIME_MS = 6e4;
 const BROADCAST_CHANNEL_NAME = "baliola.auth.session.v1";
 function createAuthClient(options) {
 	if (!options.baseUrl) throw new Error("createAuthClient: baseUrl is required");
+	if (!options.clientId) throw new Error("createAuthClient: clientId is required");
 	const baseUrl = options.baseUrl.replace(/\/+$/, "");
+	const clientId = options.clientId;
 	const store = options.store ?? memoryStore();
 	const fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
@@ -585,7 +599,7 @@ function createAuthClient(options) {
 	});
 	const methods = createMethods({
 		transport,
-		...options.clientId !== void 0 && { clientId: options.clientId }
+		clientId
 	});
 	const emailOtp = {
 		sendLoginCode: (input) => methods.sendLoginCode(input),
@@ -619,7 +633,7 @@ function createAuthClient(options) {
 	}
 	const googleHosted = createGoogleHosted({
 		baseUrl,
-		...options.clientId !== void 0 && { clientId: options.clientId },
+		clientId,
 		exchange: googleExchange
 	});
 	return {
@@ -636,6 +650,10 @@ function createAuthClient(options) {
 			signInWithPopup: (opts) => googleHosted.signInWithPopup(opts),
 			completeRedirect: (opts) => googleHosted.completeRedirect(opts)
 		},
+		roles: {
+			apply: (input) => methods.applyRole(input),
+			status: () => methods.getRoleStatus()
+		},
 		wallet: {
 			getAddress: async () => (await methods.getWalletAddress()).address,
 			signHash: async (hash) => (await methods.signWalletHash(hash)).signature

package/dist/errors/index.d.ts

@@ -1,2 +1,2 @@
-import { _ as OtpInvalidError, a as EmailAlreadyHasPasswordError, b as authErrorFromFetchFailure, c as GoogleSignInError, d as InvalidPasswordError, f as MaxAttemptsError, g as OtpExpiredError, h as NoPendingOtpError, i as CaptchaFailedError, l as InvalidCredentialsError, m as NoPasswordSetError, n as AuthError, o as GoogleSignInCancelledError, p as MaxResendsError, r as AuthErrorInit, s as GoogleSignInCancelledReason, t as AccountSuspendedError, u as InvalidEmailError, v as RateLimitedError, x as authErrorFromResponse, y as ResendCooldownError } from "../authError-CDoEEOP_.js";
-export { AccountSuspendedError, AuthError, type AuthErrorInit, CaptchaFailedError, EmailAlreadyHasPasswordError, GoogleSignInCancelledError, type GoogleSignInCancelledReason, GoogleSignInError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse };
+import { C as authErrorFromResponse, S as authErrorFromFetchFailure, _ as OtpInvalidError, a as EmailAlreadyHasPasswordError, b as ValidationError, c as GoogleSignInError, d as InvalidPasswordError, f as MaxAttemptsError, g as OtpExpiredError, h as NoPendingOtpError, i as CaptchaFailedError, l as InvalidCredentialsError, m as NoPasswordSetError, n as AuthError, o as GoogleSignInCancelledError, p as MaxResendsError, r as AuthErrorInit, s as GoogleSignInCancelledReason, t as AccountSuspendedError, u as InvalidEmailError, v as RateLimitedError, x as ValidationIssue, y as ResendCooldownError } from "../authError-E11ZMcID.js";
+export { AccountSuspendedError, AuthError, type AuthErrorInit, CaptchaFailedError, EmailAlreadyHasPasswordError, GoogleSignInCancelledError, type GoogleSignInCancelledReason, GoogleSignInError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, ValidationError, type ValidationIssue, authErrorFromFetchFailure, authErrorFromResponse };

package/dist/errors/index.js

@@ -1,2 +1,2 @@
-import { _ as ResendCooldownError, a as GoogleSignInCancelledError, c as InvalidEmailError, d as MaxResendsError, f as NoPasswordSetError, g as RateLimitedError, h as OtpInvalidError, i as EmailAlreadyHasPasswordError, l as InvalidPasswordError, m as OtpExpiredError, n as AuthError, o as GoogleSignInError, p as NoPendingOtpError, r as CaptchaFailedError, s as InvalidCredentialsError, t as AccountSuspendedError, u as MaxAttemptsError, v as authErrorFromFetchFailure, y as authErrorFromResponse } from "../authError-CUQ1rFAr.js";
-export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, GoogleSignInCancelledError, GoogleSignInError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse };
+import { _ as ResendCooldownError, a as GoogleSignInCancelledError, b as authErrorFromResponse, c as InvalidEmailError, d as MaxResendsError, f as NoPasswordSetError, g as RateLimitedError, h as OtpInvalidError, i as EmailAlreadyHasPasswordError, l as InvalidPasswordError, m as OtpExpiredError, n as AuthError, o as GoogleSignInError, p as NoPendingOtpError, r as CaptchaFailedError, s as InvalidCredentialsError, t as AccountSuspendedError, u as MaxAttemptsError, v as ValidationError, y as authErrorFromFetchFailure } from "../authError-BPxMHQK2.js";
+export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, GoogleSignInCancelledError, GoogleSignInError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, ValidationError, authErrorFromFetchFailure, authErrorFromResponse };

package/dist/{index-CFXMA6WD.d.ts → index-DwFEdFaS.d.ts}

@@ -1,6 +1,6 @@
-import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
-import { n as SessionStore } from "./sessionStore-BDdEpbL8.js";
-import { a as GoogleSignInWithPopupOptions, c as LoginWithGoogleInput, d as ResendLoginCodeInput, f as ResendRegistrationCodeInput, g as VerifyRegistrationCodeInput, h as VerifyLoginCodeInput, i as GoogleExchangeInput, l as LoginWithPasswordInput, m as SetPasswordInput, n as ChangePasswordInput, p as SendLoginCodeInput, r as GoogleCompleteRedirectOptions, s as GoogleStartOptions, u as RegisterInput, y as ProfileResult } from "./requests-C0WoK341.js";
+import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, u as SessionChangeHandler } from "./session-flM0yXx2.js";
+import { n as SessionStore } from "./sessionStore-D2kXjvNM.js";
+import { C as ProfileResult, _ as SendLoginCodeInput, b as VerifyRegistrationCodeInput, c as GoogleExchangeInput, d as GoogleStartOptions, f as LoginWithGoogleInput, g as ResendRegistrationCodeInput, h as ResendLoginCodeInput, i as RoleStatus, l as GoogleSignInWithPopupOptions, m as RegisterInput, o as ChangePasswordInput, p as LoginWithPasswordInput, r as RoleApplicationStatus, s as GoogleCompleteRedirectOptions, t as ApplyRoleInput, v as SetPasswordInput, y as VerifyLoginCodeInput } from "./roles-BZecOymZ.js";
 
 //#region src/client/transport.d.ts
 type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
@@ -31,8 +31,13 @@ type ProactiveRefreshConfig = false | {
   /** Refresh proactively if `expiresAt - now < leadTimeMs`. Defaults to 60_000 (60s). */leadTimeMs?: number;
 };
 type CreateAuthClientOptions = {
-  /** Base URL of the Baliola Auth server (no trailing slash). */baseUrl: string; /** Optional clientId, applied to every auth request that accepts one. */
-  clientId?: string;
+  /** Base URL of the Baliola Auth server (no trailing slash). */baseUrl: string;
+  /**
+   * The project's client id. Sent on every login and register body and used
+   * to build the hosted Google login URL. baliola-auth rejects login and
+   * register requests without one.
+   */
+  clientId: string;
   /**
    * Pluggable session store. Defaults to `memoryStore()`. Use
    * `localStorageStore()` in browsers for persistence across reloads.
@@ -65,10 +70,12 @@ type EmailOtpNamespace = {
    * Send a 6-digit one-time code to the email. Used for passwordless
    * login (existing accounts) or signup (creates a new account on verify).
    *
+   * The response never says whether the email is registered; the login
+   * versus signup branch is resolved by `verifyLoginCode`.
+   *
    * @example
    * const r = await auth.emailOtp.sendLoginCode({ email, captchaToken })
-   * // r = { flow: 'login'|'signup', methods: ['password','passwordless'],
-   * //       otp: { expiresInSeconds, expiresAt, canResendInSeconds, resendsRemaining } }
+   * // r = { otp: { expiresInSeconds, expiresAt, canResendInSeconds, resendsRemaining } }
    *
    * @throws CaptchaFailedError, RateLimitedError, InvalidEmailError, AuthError.
    */
@@ -133,9 +140,8 @@ type GoogleNamespace = {
    * popup. In `redirect` mode the nonce is saved in `sessionStorage` for
    * `completeRedirect` to verify.
    *
-   * @throws Error when the client has no `clientId`, when `returnTo` is
-   *         relative outside a browser, or when `sessionStorage` is missing
-   *         in `redirect` mode.
+   * @throws Error when `returnTo` is relative outside a browser, or when
+   *         `sessionStorage` is missing in `redirect` mode.
    */
   startUrl(opts: GoogleStartOptions & {
     nonce: string;
@@ -183,6 +189,29 @@ type GoogleNamespace = {
    */
   completeRedirect(opts?: GoogleCompleteRedirectOptions): Promise<AuthSession | null>;
 };
+/** Self-service role applications (`/auth/roles/*`). */
+type RolesNamespace = {
+  /**
+   * Apply for a self-applicable global role. The application lands at
+   * `pending_approval` until an admin approves it.
+   *
+   * @throws AuthError with `code` `role_already_active` or
+   *         `application_pending` (409), `role_not_self_applicable` (403),
+   *         a 400 for a role name outside the allowlist, a 401 for a missing
+   *         or expired session, and other API errors.
+   * @example
+   * const app = await auth.roles.apply({ roleName: 'module_deployer' });
+   * // app.status === 'pending_approval'
+   */
+  apply(input: ApplyRoleInput): Promise<RoleApplicationStatus>;
+  /**
+   * Application status for every self-applicable role. Always one row per
+   * role; `status` is `none` when the account has never applied.
+   *
+   * @throws AuthError on 401 (missing or expired session) and other API errors.
+   */
+  status(): Promise<RoleStatus[]>;
+};
 /** Custodial wallet (Console tier). */
 type WalletNamespace = {
   /** The account's custodial EOA address (provisioned on first read). */getAddress(): Promise<string>; /** Sign a 32-byte userOp hash; returns a 65-byte recoverable signature. */
@@ -192,6 +221,7 @@ type AuthClient = {
   emailOtp: EmailOtpNamespace;
   emailPassword: EmailPasswordNamespace;
   google: GoogleNamespace;
+  roles: RolesNamespace;
   wallet: WalletNamespace;
   /**
    * Fetch the token holder's identity: account (id, email, live status,
@@ -218,4 +248,4 @@ type AuthClient = {
 };
 declare function createAuthClient(options: CreateAuthClientOptions): AuthClient;
 //#endregion
-export { GoogleNamespace as a, WalletNamespace as c, EmailPasswordNamespace as i, createAuthClient as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, SubscribeOptions as s, AuthClient as t, AuthFetchInit as u };
+export { GoogleNamespace as a, SubscribeOptions as c, AuthFetchInit as d, EmailPasswordNamespace as i, WalletNamespace as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, RolesNamespace as s, AuthClient as t, createAuthClient as u };

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
-import { a as GoogleNamespace, c as WalletNamespace, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient, u as AuthFetchInit } from "./index-CFXMA6WD.js";
-import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "./sessionStore-BDdEpbL8.js";
-import { _ as Profile, a as GoogleSignInWithPopupOptions, c as LoginWithGoogleInput, d as ResendLoginCodeInput, f as ResendRegistrationCodeInput, g as VerifyRegistrationCodeInput, h as VerifyLoginCodeInput, i as GoogleExchangeInput, l as LoginWithPasswordInput, m as SetPasswordInput, n as ChangePasswordInput, o as GoogleStartMode, p as SendLoginCodeInput, r as GoogleCompleteRedirectOptions, s as GoogleStartOptions, t as CaptchaArgs, u as RegisterInput, v as ProfileAccount, y as ProfileResult } from "./requests-C0WoK341.js";
-import { _ as OtpInvalidError, a as EmailAlreadyHasPasswordError, b as authErrorFromFetchFailure, c as GoogleSignInError, d as InvalidPasswordError, f as MaxAttemptsError, g as OtpExpiredError, h as NoPendingOtpError, i as CaptchaFailedError, l as InvalidCredentialsError, m as NoPasswordSetError, n as AuthError, o as GoogleSignInCancelledError, p as MaxResendsError, r as AuthErrorInit, s as GoogleSignInCancelledReason, t as AccountSuspendedError, u as InvalidEmailError, v as RateLimitedError, x as authErrorFromResponse, y as ResendCooldownError } from "./authError-CDoEEOP_.js";
+import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-flM0yXx2.js";
+import { a as GoogleNamespace, c as SubscribeOptions, d as AuthFetchInit, i as EmailPasswordNamespace, l as WalletNamespace, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as RolesNamespace, t as AuthClient, u as createAuthClient } from "./index-DwFEdFaS.js";
+import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "./sessionStore-D2kXjvNM.js";
+import { C as ProfileResult, S as ProfileAccount, _ as SendLoginCodeInput, a as CaptchaArgs, b as VerifyRegistrationCodeInput, c as GoogleExchangeInput, d as GoogleStartOptions, f as LoginWithGoogleInput, g as ResendRegistrationCodeInput, h as ResendLoginCodeInput, i as RoleStatus, l as GoogleSignInWithPopupOptions, m as RegisterInput, n as RoleApplicationState, o as ChangePasswordInput, p as LoginWithPasswordInput, r as RoleApplicationStatus, s as GoogleCompleteRedirectOptions, t as ApplyRoleInput, u as GoogleStartMode, v as SetPasswordInput, x as Profile, y as VerifyLoginCodeInput } from "./roles-BZecOymZ.js";
+import { C as authErrorFromResponse, S as authErrorFromFetchFailure, _ as OtpInvalidError, a as EmailAlreadyHasPasswordError, b as ValidationError, c as GoogleSignInError, d as InvalidPasswordError, f as MaxAttemptsError, g as OtpExpiredError, h as NoPendingOtpError, i as CaptchaFailedError, l as InvalidCredentialsError, m as NoPasswordSetError, n as AuthError, o as GoogleSignInCancelledError, p as MaxResendsError, r as AuthErrorInit, s as GoogleSignInCancelledReason, t as AccountSuspendedError, u as InvalidEmailError, v as RateLimitedError, x as ValidationIssue, y as ResendCooldownError } from "./authError-E11ZMcID.js";
 import { n as AccessTokenPayloadProject, t as AccessTokenPayload } from "./tokens-BXrPLi5B.js";
 
 //#region src/types/wallet.d.ts
@@ -16,4 +16,4 @@ type SignHashResult = {
   address: string;
 };
 //#endregion
-export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleCompleteRedirectOptions, type GoogleExchangeInput, type GoogleNamespace, GoogleSignInCancelledError, type GoogleSignInCancelledReason, GoogleSignInError, type GoogleSignInWithPopupOptions, type GoogleStartMode, type GoogleStartOptions, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Profile, type ProfileAccount, type ProfileResult, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SignHashResult, type SubscribeOptions, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, type WalletAddressResult, type WalletNamespace, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };
+export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type ApplyRoleInput, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleCompleteRedirectOptions, type GoogleExchangeInput, type GoogleNamespace, GoogleSignInCancelledError, type GoogleSignInCancelledReason, GoogleSignInError, type GoogleSignInWithPopupOptions, type GoogleStartMode, type GoogleStartOptions, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Profile, type ProfileAccount, type ProfileResult, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type RoleApplicationState, type RoleApplicationStatus, type RoleStatus, type RolesNamespace, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SignHashResult, type SubscribeOptions, ValidationError, type ValidationIssue, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, type WalletAddressResult, type WalletNamespace, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { _ as ResendCooldownError, a as GoogleSignInCancelledError, c as InvalidEmailError, d as MaxResendsError, f as NoPasswordSetError, g as RateLimitedError, h as OtpInvalidError, i as EmailAlreadyHasPasswordError, l as InvalidPasswordError, m as OtpExpiredError, n as AuthError, o as GoogleSignInError, p as NoPendingOtpError, r as CaptchaFailedError, s as InvalidCredentialsError, t as AccountSuspendedError, u as MaxAttemptsError, v as authErrorFromFetchFailure, y as authErrorFromResponse } from "./authError-CUQ1rFAr.js";
-import { t as createAuthClient } from "./client-Bk9WIMVc.js";
+import { _ as ResendCooldownError, a as GoogleSignInCancelledError, b as authErrorFromResponse, c as InvalidEmailError, d as MaxResendsError, f as NoPasswordSetError, g as RateLimitedError, h as OtpInvalidError, i as EmailAlreadyHasPasswordError, l as InvalidPasswordError, m as OtpExpiredError, n as AuthError, o as GoogleSignInError, p as NoPendingOtpError, r as CaptchaFailedError, s as InvalidCredentialsError, t as AccountSuspendedError, u as MaxAttemptsError, v as ValidationError, y as authErrorFromFetchFailure } from "./authError-BPxMHQK2.js";
+import { t as createAuthClient } from "./client-Dlhhdp-T.js";
 import { n as memoryStore, t as localStorageStore } from "./sessionStore-DD6lON9W.js";
-export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, GoogleSignInCancelledError, GoogleSignInError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };
+export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, GoogleSignInCancelledError, GoogleSignInError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, ValidationError, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/{requests-C0WoK341.d.ts → roles-BZecOymZ.d.ts}

@@ -1,4 +1,4 @@
-import { t as Account } from "./session-Cs_P7ojF.js";
+import { t as Account } from "./session-flM0yXx2.js";
 
 //#region src/types/profile.d.ts
 /** The account's profile record; every field is user-editable and nullable. */
@@ -90,4 +90,34 @@ type GoogleCompleteRedirectOptions = {
   /** URL to read `code`, `error`, and `nonce` from. Default: `window.location.href`. */url?: string;
 };
 //#endregion
-export { Profile as _, GoogleSignInWithPopupOptions as a, LoginWithGoogleInput as c, ResendLoginCodeInput as d, ResendRegistrationCodeInput as f, VerifyRegistrationCodeInput as g, VerifyLoginCodeInput as h, GoogleExchangeInput as i, LoginWithPasswordInput as l, SetPasswordInput as m, ChangePasswordInput as n, GoogleStartMode as o, SendLoginCodeInput as p, GoogleCompleteRedirectOptions as r, GoogleStartOptions as s, CaptchaArgs as t, RegisterInput as u, ProfileAccount as v, ProfileResult as y };
+//#region src/types/roles.d.ts
+/** Lifecycle of a role application, as stored on the server. */
+type RoleApplicationState = 'pending_approval' | 'active' | 'revoked';
+/** Input of `auth.roles.apply`. */
+type ApplyRoleInput = {
+  /** Role to apply for. Only names on the server's self-applicable allowlist are accepted. */roleName: string;
+};
+/** Result of `auth.roles.apply`: the account role row the server created. */
+type RoleApplicationStatus = {
+  id: string;
+  accountId: string;
+  roleId: string; /** `null` for a global role. */
+  projectId: string | null;
+  status: RoleApplicationState; /** Account id that created the row: an admin, or the applicant for a self-service application. */
+  assignedBy: string | null;
+  assignedAt: string;
+  approvedAt: string | null;
+  revokedAt: string | null;
+};
+/** One row of `auth.roles.status`, from the caller's point of view. */
+type RoleStatus = {
+  roleName: string;
+  displayName: string | null; /** `none` when the account has never applied for this role. */
+  status: RoleApplicationState | 'none'; /** `null` until the account applies. */
+  accountRoleId: string | null;
+  assignedAt: string | null;
+  approvedAt: string | null;
+  revokedAt: string | null;
+};
+//#endregion
+export { ProfileResult as C, ProfileAccount as S, SendLoginCodeInput as _, CaptchaArgs as a, VerifyRegistrationCodeInput as b, GoogleExchangeInput as c, GoogleStartOptions as d, LoginWithGoogleInput as f, ResendRegistrationCodeInput as g, ResendLoginCodeInput as h, RoleStatus as i, GoogleSignInWithPopupOptions as l, RegisterInput as m, RoleApplicationState as n, ChangePasswordInput as o, LoginWithPasswordInput as p, RoleApplicationStatus as r, GoogleCompleteRedirectOptions as s, ApplyRoleInput as t, GoogleStartMode as u, SetPasswordInput as v, Profile as x, VerifyLoginCodeInput as y };

package/dist/{session-Cs_P7ojF.d.ts → session-flM0yXx2.d.ts}

@@ -28,11 +28,13 @@ type OtpInfo = {
   canResendInSeconds: number; /** Resend attempts left for this OTP record. */
   resendsRemaining: number;
 };
-/** Result of `auth.emailOtp.sendLoginCode`. */
+/**
+ * Result of `auth.emailOtp.sendLoginCode`. Carries only OTP timing: the
+ * server does not reveal whether the email is registered, so login versus
+ * signup is only known after `verifyLoginCode`.
+ */
 type SendLoginCodeResult = {
-  /** Whether the BE recognizes the email as an existing account or a new signup. */flow: 'login' | 'signup'; /** Available login methods for this email. */
-  methods: ('password' | 'passwordless')[]; /** OTP timing metadata. */
-  otp: OtpInfo;
+  /** OTP timing metadata. */otp: OtpInfo;
 };
 /** Result of any resend method (`emailOtp.resendLoginCode`, `emailPassword.resendRegistrationCode`). */
 type ResendCodeResult = {

package/dist/{sessionStore-BDdEpbL8.d.ts → sessionStore-D2kXjvNM.d.ts}

@@ -1,4 +1,4 @@
-import { n as AuthSession } from "./session-Cs_P7ojF.js";
+import { n as AuthSession } from "./session-flM0yXx2.js";
 
 //#region src/store/sessionStore.d.ts
 /**

package/dist/store/index.d.ts

@@ -1,2 +1,2 @@
-import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "../sessionStore-BDdEpbL8.js";
+import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "../sessionStore-D2kXjvNM.js";
 export { type LocalStorageStoreOptions, type SessionStore, localStorageStore, memoryStore };

package/dist/types/index.d.ts

@@ -1,4 +1,4 @@
-import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "../session-Cs_P7ojF.js";
-import { _ as Profile, a as GoogleSignInWithPopupOptions, c as LoginWithGoogleInput, d as ResendLoginCodeInput, f as ResendRegistrationCodeInput, g as VerifyRegistrationCodeInput, h as VerifyLoginCodeInput, i as GoogleExchangeInput, l as LoginWithPasswordInput, m as SetPasswordInput, n as ChangePasswordInput, o as GoogleStartMode, p as SendLoginCodeInput, r as GoogleCompleteRedirectOptions, s as GoogleStartOptions, t as CaptchaArgs, u as RegisterInput, v as ProfileAccount, y as ProfileResult } from "../requests-C0WoK341.js";
+import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "../session-flM0yXx2.js";
+import { C as ProfileResult, S as ProfileAccount, _ as SendLoginCodeInput, a as CaptchaArgs, b as VerifyRegistrationCodeInput, c as GoogleExchangeInput, d as GoogleStartOptions, f as LoginWithGoogleInput, g as ResendRegistrationCodeInput, h as ResendLoginCodeInput, i as RoleStatus, l as GoogleSignInWithPopupOptions, m as RegisterInput, n as RoleApplicationState, o as ChangePasswordInput, p as LoginWithPasswordInput, r as RoleApplicationStatus, s as GoogleCompleteRedirectOptions, t as ApplyRoleInput, u as GoogleStartMode, v as SetPasswordInput, x as Profile, y as VerifyLoginCodeInput } from "../roles-BZecOymZ.js";
 import { n as AccessTokenPayloadProject, t as AccessTokenPayload } from "../tokens-BXrPLi5B.js";
-export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, type AuthSession, type CaptchaArgs, type ChangePasswordInput, type ErrorHandler, type ErrorSource, type GoogleCompleteRedirectOptions, type GoogleExchangeInput, type GoogleSignInWithPopupOptions, type GoogleStartMode, type GoogleStartOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, type OtpInfo, type Profile, type ProfileAccount, type ProfileResult, type Project, type RegisterInput, type RegisterResult, type ResendCodeResult, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SetPasswordInput, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput };
+export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, type ApplyRoleInput, type AuthSession, type CaptchaArgs, type ChangePasswordInput, type ErrorHandler, type ErrorSource, type GoogleCompleteRedirectOptions, type GoogleExchangeInput, type GoogleSignInWithPopupOptions, type GoogleStartMode, type GoogleStartOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, type OtpInfo, type Profile, type ProfileAccount, type ProfileResult, type Project, type RegisterInput, type RegisterResult, type ResendCodeResult, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type RoleApplicationState, type RoleApplicationStatus, type RoleStatus, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SetPasswordInput, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput };

package/dist/wallet/index.d.ts

@@ -1,4 +1,4 @@
-import { t as AuthClient } from "../index-CFXMA6WD.js";
+import { t as AuthClient } from "../index-DwFEdFaS.js";
 import { LocalAccount } from "viem";
 
 //#region src/wallet/index.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baliola/auth-sdk",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Client SDK for Baliola Auth",
   "keywords": [
     "auth",