@better-auth-ui/core 1.6.30 → 1.6.32

package/dist/plugins.js

@@ -1,6 +1,22 @@
-import { n as e, r as t, t as n } from "./create-auth-plugin-DcxR23rZ.js";
-//#region src/plugins/api-key/api-key-localization.ts
-var r = {
+import { n as e, r as t, t as n } from "./create-auth-plugin-D4wsYnHD.js";
+//#region src/plugins/admin/admin-localization.ts
+var r = { stopImpersonating: "Stop impersonating" }, i = {
+	all: ["auth", "admin"],
+	stopImpersonating: [
+		"auth",
+		"admin",
+		"stopImpersonating"
+	]
+};
+//#endregion
+//#region src/plugins/admin/admin-plugin.ts
+function a(e) {
+	return !e || typeof e != "object" || !("session" in e) || !e.session || typeof e.session != "object" || !("impersonatedBy" in e.session) ? !1 : typeof e.session.impersonatedBy == "string" && e.session.impersonatedBy.length > 0;
+}
+var o = n("admin", (e = {}) => ({ localization: {
+	...r,
+	...e.localization
+} })), s = {
 	apiKey: "API key",
 	apiKeys: "API keys",
 	apiKeysDescription: "Create an API key for programmatic access to your account.",
@@ -12,7 +28,7 @@ var r = {
 	deleteApiKey: "Delete API key",
 	deleteApiKeyWarning: "This action cannot be undone. Any service using this API key will stop working immediately.",
 	dismissNewKey: "I've saved my key"
-}, i = {
+}, c = {
 	all: ["auth", "apiKey"],
 	create: [
 		"auth",
@@ -24,57 +40,101 @@ var r = {
 		"apiKey",
 		"delete"
 	]
-}, a = n("apiKey", (e = {}) => ({
+}, l = n("apiKey", (e = {}) => ({
 	localization: {
-		...r,
+		...s,
 		...e.localization
 	},
 	organization: e.organization ?? !1
-})), o = {
+})), u = {
 	all: (t) => [...e.user(t), "apiKey"],
-	lists: (e) => [...o.all(e), "list"],
-	list: (e, t) => [...o.lists(e), t ?? null]
-}, s = {
+	lists: (e) => [...u.all(e), "list"],
+	list: (e, t) => [...u.lists(e), t ?? null]
+}, d = {
 	deleteAccount: "Delete account",
 	deleteAccountDescription: "Permanently remove your account and all associated data. This cannot be undone.",
 	deleteUserVerificationSent: "Check your email to confirm account deletion.",
 	deleteUserSuccess: "Your account has been deleted."
-}, c = { deleteUser: ["auth", "deleteUser"] }, l = n("deleteUser", (e = {}) => ({
+}, f = { deleteUser: ["auth", "deleteUser"] }, p = n("deleteUser", (e = {}) => ({
 	localization: {
-		...s,
+		...d,
 		...e.localization
 	},
 	sendDeleteAccountVerification: e.sendDeleteAccountVerification ?? !1
-})), u = {
+})), m = {
+	deviceAuthorization: "Device Authorization",
+	deviceAuthorizationDescription: "Enter the code displayed on your device.",
+	deviceCode: "Device code",
+	invalidDeviceCode: "The code is invalid or has expired.",
+	continue: "Continue",
+	approveDevice: "Approve Device",
+	approveDeviceDescription: "A device is requesting access to your account.",
+	signedInAs: "Signed in as",
+	approve: "Approve",
+	deny: "Deny",
+	deviceApproved: "Device Approved",
+	deviceApprovedDescription: "The device can now access your account. You can return to it and continue.",
+	deviceDenied: "Device Denied",
+	deviceDeniedDescription: "The device was not granted access to your account.",
+	returnToApplication: "Return to application"
+}, h = {
+	all: ["auth", "deviceAuthorization"],
+	verify: [
+		"auth",
+		"deviceAuthorization",
+		"verify"
+	],
+	approve: [
+		"auth",
+		"deviceAuthorization",
+		"approve"
+	],
+	deny: [
+		"auth",
+		"deviceAuthorization",
+		"deny"
+	]
+}, g = 8;
+function _(e) {
+	return e === void 0 || !Number.isFinite(e) ? g : Math.max(1, Math.floor(e));
+}
+var v = n("deviceAuthorization", (e = {}) => ({
+	localization: {
+		...m,
+		...e.localization
+	},
+	userCodeLength: _(e.userCodeLength),
+	viewPaths: { auth: { deviceAuthorization: e.path ?? "device" } }
+})), y = {
 	lastUsed: "Last used",
 	lastUsedShort: "Last"
-}, d = n("lastLoginMethod", (e = {}) => ({ localization: {
-	...u,
+}, b = n("lastLoginMethod", (e = {}) => ({ localization: {
+	...y,
 	...e.localization
-} })), f = {
+} })), x = {
 	magicLink: "Magic Link",
 	sendMagicLink: "Send Magic Link",
 	magicLinkSent: "Check your email for the magic link",
 	magicLinkSentTo: "We sent a magic link to {{email}}"
-}, p = { signIn: [
+}, S = { signIn: [
 	"auth",
 	"signIn",
 	"magicLink"
-] }, m = n("magicLink", (e = {}) => ({
+] }, C = n("magicLink", (e = {}) => ({
 	localization: {
-		...f,
+		...x,
 		...e.localization
 	},
 	viewPaths: { auth: {
 		magicLink: e.path ?? "magic-link",
 		magicLinkSent: e.sentPath ?? "magic-link-sent"
 	} }
-})), h = {
+})), w = {
 	switchAccount: "Switch Account",
 	addAccount: "Add Account",
 	manageAccounts: "Manage accounts",
 	manageAccountsDescription: "Manage your accounts for secure access."
-}, g = {
+}, T = {
 	all: ["auth", "multiSession"],
 	revoke: [
 		"auth",
@@ -86,14 +146,84 @@ var r = {
 		"multiSession",
 		"setActive"
 	]
-}, _ = n("multiSession", (e = {}) => ({ localization: {
-	...h,
+}, E = n("multiSession", (e = {}) => ({ localization: {
+	...w,
 	...e.localization
-} })), v = {
+} })), D = {
 	all: (t) => [...e.user(t), "multiSession"],
-	lists: (e) => [...v.all(e), "list"],
-	list: (e, t) => [...v.lists(e), t ?? null]
-}, y = {
+	lists: (e) => [...D.all(e), "list"],
+	list: (e, t) => [...D.lists(e), t ?? null]
+}, O = {
+	authorize: "Authorize {{client}}",
+	authorizationDescription: "{{client}} wants to access your account.",
+	requestedPermissions: "This will allow {{client}} to:",
+	signedInAs: "Signed in as",
+	allow: "Allow",
+	cancel: "Cancel",
+	privacyPolicy: "Privacy policy",
+	termsOfService: "Terms of service",
+	invalidRequest: "Invalid authorization request",
+	invalidRequestDescription: "This authorization request is missing required information or is no longer valid.",
+	application: "Application"
+}, k = {
+	all: ["auth", "oauthProvider"],
+	consent: [
+		"auth",
+		"oauthProvider",
+		"consent"
+	]
+}, A = {
+	openid: {
+		label: "Verify your identity",
+		description: "Access your unique account identifier."
+	},
+	profile: {
+		label: "View your profile",
+		description: "View your name and profile picture."
+	},
+	email: {
+		label: "View your email address",
+		description: "View your email address and whether it is verified."
+	},
+	offline_access: {
+		label: "Maintain access",
+		description: "Access your data when you are not actively using the application."
+	}
+};
+function j(e) {
+	if (e) try {
+		let t = new URL(e);
+		return t.protocol === "https:" || t.protocol === "http:" ? t.href : void 0;
+	} catch {
+		return;
+	}
+}
+function M(e) {
+	let t = new URLSearchParams(e);
+	return {
+		clientId: t.get("client_id")?.trim() || void 0,
+		scopes: Array.from(new Set((t.get("scope") ?? "").split(/\s+/).map((e) => e.trim()).filter(Boolean)))
+	};
+}
+var N = n("oauthProvider", (e = {}) => ({
+	localization: {
+		...O,
+		...e.localization
+	},
+	scopeMetadata: {
+		...A,
+		...e.scopeMetadata
+	},
+	viewPaths: { auth: { oauthConsent: e.path ?? "consent" } }
+})), P = {
+	all: ["auth", "oauthProvider"],
+	publicClients: [
+		"auth",
+		"oauthProvider",
+		"publicClient"
+	],
+	publicClient: (e) => [...P.publicClients, e ?? null]
+}, F = {
 	accept: "Accept",
 	accepted: "Accepted",
 	actions: "Actions",
@@ -150,7 +280,7 @@ var r = {
 	status: "Status",
 	uploadLogo: "Upload logo",
 	userInvitationsEmptyDescription: "Invitations to join an organization will show up here."
-}, b = {
+}, I = {
 	all: ["auth", "organization"],
 	create: [
 		"auth",
@@ -212,9 +342,9 @@ var r = {
 		"organization",
 		"checkSlug"
 	]
-}, x = n("organization", (e = {}) => {
+}, L = n("organization", (e = {}) => {
 	let n = {
-		...y,
+		...F,
 		...e.localization
 	};
 	return {
@@ -242,38 +372,38 @@ var r = {
 			}
 		}
 	};
-}), S = {
+}), R = {
 	all: (t) => [...e.user(t), "organization"],
-	lists: (e) => [...S.all(e), "list"],
-	list: (e, t) => [...S.lists(e), t ?? null],
-	fullDetails: (e) => [...S.all(e), "fullDetails"],
-	fullDetail: (e, t) => [...S.fullDetails(e), t ?? null],
-	activeOrganizations: (e) => [...S.all(e), "active"],
-	activeOrganization: (e, t) => [...S.activeOrganizations(e), t ?? null],
+	lists: (e) => [...R.all(e), "list"],
+	list: (e, t) => [...R.lists(e), t ?? null],
+	fullDetails: (e) => [...R.all(e), "fullDetails"],
+	fullDetail: (e, t) => [...R.fullDetails(e), t ?? null],
+	activeOrganizations: (e) => [...R.all(e), "active"],
+	activeOrganization: (e, t) => [...R.activeOrganizations(e), t ?? null],
 	members: {
-		all: (e) => [...S.all(e), "members"],
-		lists: (e) => [...S.members.all(e), "list"],
-		list: (e, t) => [...S.members.lists(e), t ?? null]
+		all: (e) => [...R.all(e), "members"],
+		lists: (e) => [...R.members.all(e), "list"],
+		list: (e, t) => [...R.members.lists(e), t ?? null]
 	},
 	invitations: {
-		all: (e) => [...S.all(e), "invitations"],
-		lists: (e) => [...S.invitations.all(e), "list"],
-		list: (e, t) => [...S.invitations.lists(e), t ?? null]
+		all: (e) => [...R.all(e), "invitations"],
+		lists: (e) => [...R.invitations.all(e), "list"],
+		list: (e, t) => [...R.invitations.lists(e), t ?? null]
 	},
 	userInvitations: {
-		all: (e) => [...S.all(e), "userInvitations"],
-		lists: (e) => [...S.userInvitations.all(e), "list"],
-		list: (e, t) => [...S.userInvitations.lists(e), t ?? null]
+		all: (e) => [...R.all(e), "userInvitations"],
+		lists: (e) => [...R.userInvitations.all(e), "list"],
+		list: (e, t) => [...R.userInvitations.lists(e), t ?? null]
 	},
 	permissions: {
-		all: (e) => [...S.all(e), "permissions"],
+		all: (e) => [...R.all(e), "permissions"],
 		has: (e, t) => [
-			...S.permissions.all(e),
+			...R.permissions.all(e),
 			"has",
 			t ?? null
 		]
 	}
-}, C = {
+}, z = {
 	passkey: "Passkey",
 	addPasskey: "Add passkey",
 	deletePasskey: "Delete passkey {{name}}",
@@ -283,7 +413,7 @@ var r = {
 	passkeysDescription: "Create a passkey to securely access your account.",
 	noPasskeys: "No passkeys",
 	name: "Name"
-}, w = {
+}, B = {
 	signIn: [
 		"auth",
 		"signIn",
@@ -299,22 +429,22 @@ var r = {
 		"passkey",
 		"deletePasskey"
 	]
-}, T = n("passkey", (e = {}) => ({ localization: {
-	...C,
+}, V = n("passkey", (e = {}) => ({ localization: {
+	...z,
 	...e.localization
-} })), E = {
+} })), H = {
 	all: (t) => [...e.user(t), "passkey"],
-	lists: (e) => [...E.all(e), "list"],
-	list: (e, t) => [...E.lists(e), t ?? null]
-}, D = {
+	lists: (e) => [...H.all(e), "list"],
+	list: (e, t) => [...H.lists(e), t ?? null]
+}, U = {
 	appearance: "Appearance",
 	theme: "Theme",
 	system: "System",
 	light: "Light",
 	dark: "Dark"
-}, O = n("theme", (e) => ({
+}, W = n("theme", (e) => ({
 	localization: {
-		...D,
+		...U,
 		...e.localization
 	},
 	theme: e.theme ?? "system",
@@ -324,7 +454,7 @@ var r = {
 		"light",
 		"dark"
 	]
-})), k = {
+})), G = {
 	username: "Username",
 	usernamePlaceholder: "Username",
 	usernameOrEmailPlaceholder: "Username or email",
@@ -332,16 +462,16 @@ var r = {
 	usernameTaken: "Username is already taken. Please try another.",
 	displayUsername: "Display Username",
 	displayUsernamePlaceholder: "Display Username"
-}, A = {
+}, K = {
 	signIn: [
 		"auth",
 		"signIn",
 		"username"
 	],
 	isUsernameAvailable: ["auth", "isUsernameAvailable"]
-}, j = n("username", (e = {}) => {
+}, q = n("username", (e = {}) => {
 	let t = e.minUsernameLength ?? 3, n = e.maxUsernameLength ?? 30, r = {
-		...k,
+		...G,
 		...e.localization
 	};
 	return {
@@ -369,4 +499,4 @@ var r = {
 	};
 });
 //#endregion
-export { r as apiKeyLocalization, i as apiKeyMutationKeys, a as apiKeyPlugin, o as apiKeyQueryKeys, s as deleteUserLocalization, c as deleteUserMutationKeys, l as deleteUserPlugin, u as lastLoginMethodLocalization, d as lastLoginMethodPlugin, f as magicLinkLocalization, p as magicLinkMutationKeys, m as magicLinkPlugin, h as multiSessionLocalization, g as multiSessionMutationKeys, _ as multiSessionPlugin, v as multiSessionQueryKeys, y as organizationLocalization, b as organizationMutationKeys, x as organizationPlugin, S as organizationQueryKeys, C as passkeyLocalization, w as passkeyMutationKeys, T as passkeyPlugin, E as passkeyQueryKeys, D as themeLocalization, O as themePlugin, k as usernameLocalization, A as usernameMutationKeys, j as usernamePlugin };
+export { r as adminLocalization, i as adminMutationKeys, o as adminPlugin, s as apiKeyLocalization, c as apiKeyMutationKeys, l as apiKeyPlugin, u as apiKeyQueryKeys, d as deleteUserLocalization, f as deleteUserMutationKeys, p as deleteUserPlugin, m as deviceAuthorizationLocalization, h as deviceAuthorizationMutationKeys, v as deviceAuthorizationPlugin, a as isImpersonatingSession, y as lastLoginMethodLocalization, b as lastLoginMethodPlugin, x as magicLinkLocalization, S as magicLinkMutationKeys, C as magicLinkPlugin, w as multiSessionLocalization, T as multiSessionMutationKeys, E as multiSessionPlugin, D as multiSessionQueryKeys, O as oauthProviderLocalization, k as oauthProviderMutationKeys, N as oauthProviderPlugin, P as oauthProviderQueryKeys, A as oauthProviderScopeMetadata, F as organizationLocalization, I as organizationMutationKeys, L as organizationPlugin, R as organizationQueryKeys, M as parseOAuthAuthorizationRequest, z as passkeyLocalization, B as passkeyMutationKeys, V as passkeyPlugin, H as passkeyQueryKeys, j as sanitizeOAuthClientUrl, U as themeLocalization, W as themePlugin, G as usernameLocalization, K as usernameMutationKeys, q as usernamePlugin };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth-ui/core",
-  "version": "1.6.30",
+  "version": "1.6.32",
   "type": "module",
   "scripts": {
     "build": "vite build",

package/src/index.ts

@@ -2,6 +2,7 @@ export * from "./config"
 export * from "./lib/auth-mutation-keys"
 export * from "./lib/auth-plugin"
 export * from "./lib/auth-query-keys"
+export * from "./lib/auth-redirect"
 export * from "./lib/base-paths"
 export * from "./lib/create-auth-plugin"
 export * from "./lib/deep-partial"

package/src/lib/auth-mutation-keys.ts

@@ -19,10 +19,11 @@
  * package the mutation options factory came from.
  *
  * Plugin-specific mutation keys live alongside their plugin (e.g.
- * `apiKeyMutationKeys`, `organizationMutationKeys`, `passkeyMutationKeys`,
- * `magicLinkMutationKeys`, `multiSessionMutationKeys`, `usernameMutationKeys`,
- * `deleteUserMutationKeys`). Plugin-contributed sign-in strategies stay
- * under the shared `["auth", "signIn", ...]` namespace so
+ * `apiKeyMutationKeys`, `deviceAuthorizationMutationKeys`,
+ * `organizationMutationKeys`, `passkeyMutationKeys`, `magicLinkMutationKeys`,
+ * `multiSessionMutationKeys`, `usernameMutationKeys`, `deleteUserMutationKeys`).
+ * Plugin-contributed sign-in strategies stay under the shared
+ * `["auth", "signIn", ...]` namespace so
  * `useIsMutating({ mutationKey: authMutationKeys.signIn.all })` still
  * matches them.
  *

package/src/lib/auth-redirect.ts

@@ -0,0 +1,105 @@
+const ABSOLUTE_HTTP_URL = /^https?:\/\//i
+
+function hasUnsafeRedirectCharacters(value: string): boolean {
+  for (const character of value) {
+    const codePoint = character.codePointAt(0)
+    if (
+      character === "\\" ||
+      codePoint === undefined ||
+      codePoint <= 31 ||
+      codePoint === 127
+    ) {
+      return true
+    }
+  }
+
+  return false
+}
+
+/**
+ * Normalize a redirect target to a same-origin path.
+ *
+ * Root-relative paths and same-origin HTTP(S) URLs are accepted. Invalid,
+ * cross-origin, protocol-relative, and non-HTTP targets fall back to `/`.
+ *
+ * @param redirectTo - Requested redirect target
+ * @param origin - Origin used to validate and normalize the target
+ * @returns A same-origin path including its query string and hash
+ */
+export function getSafeRedirectTo(
+  redirectTo: string | null | undefined,
+  origin: string
+): string {
+  if (!redirectTo || hasUnsafeRedirectCharacters(redirectTo)) return "/"
+
+  const target = redirectTo.trim()
+  if (
+    !target ||
+    target.startsWith("//") ||
+    (!target.startsWith("/") && !ABSOLUTE_HTTP_URL.test(target))
+  ) {
+    return "/"
+  }
+
+  try {
+    const baseURL = new URL(origin)
+    const targetURL = new URL(target, baseURL)
+
+    if (
+      targetURL.origin !== baseURL.origin ||
+      targetURL.username ||
+      targetURL.password
+    ) {
+      return "/"
+    }
+
+    return `${targetURL.pathname}${targetURL.search}${targetURL.hash}`
+  } catch {
+    return "/"
+  }
+}
+
+export type AuthRedirectAction =
+  | { type: "redirect"; to: string }
+  | { type: "signIn"; to: string }
+
+/**
+ * Resolve the next action for the authenticated redirect view.
+ *
+ * Signed-in users continue to the validated target. Signed-out users are sent
+ * to sign in with the current redirect-view URL preserved, allowing the view
+ * to perform a full-page redirect after authentication.
+ *
+ * @param currentURL - Current redirect-view URL
+ * @param authenticated - Whether the current user has a session
+ * @param signInPath - Same-origin path to the sign-in view
+ * @returns The redirect or sign-in action to perform
+ */
+export function getAuthRedirectAction(
+  currentURL: URL,
+  authenticated: boolean,
+  signInPath: string
+): AuthRedirectAction {
+  const requestedTarget = getSafeRedirectTo(
+    currentURL.searchParams.get("redirectTo"),
+    currentURL.origin
+  )
+  const targetURL = new URL(requestedTarget, currentURL.origin)
+  const redirectTo =
+    targetURL.pathname === currentURL.pathname ? "/" : requestedTarget
+
+  if (authenticated) {
+    return { type: "redirect", to: redirectTo }
+  }
+
+  const signInURL = new URL(signInPath, currentURL.origin)
+  signInURL.searchParams.set(
+    "redirectTo",
+    `${currentURL.pathname}${currentURL.search}${currentURL.hash}`
+  )
+
+  return {
+    type: "signIn",
+    to: `${signInURL.pathname}${signInURL.search}${signInURL.hash}`
+  }
+}

package/src/lib/view-paths.ts

@@ -2,6 +2,11 @@
  * View path segments for authentication routes.
  */
 export interface AuthViewPaths {
+  /**
+   * Path segment for the authenticated redirect view
+   * @default "redirect"
+   */
+  redirect: string
   /**
    * Path segment for the sign-in view
    * @default "sign-in"
@@ -67,6 +72,7 @@ export type ViewPaths = {
 
 export const viewPaths: ViewPaths = {
   auth: {
+    redirect: "redirect",
     signIn: "sign-in",
     signUp: "sign-up",
     forgotPassword: "forgot-password",

package/src/plugins/admin/admin-localization.ts

@@ -0,0 +1,6 @@
+export const adminLocalization = {
+  /** @remarks `"Stop impersonating"` */
+  stopImpersonating: "Stop impersonating"
+}
+
+export type AdminLocalization = typeof adminLocalization

package/src/plugins/admin/admin-mutation-keys.ts

@@ -0,0 +1,9 @@
+/**
+ * Mutation keys contributed by the admin plugin.
+ */
+export const adminMutationKeys = {
+  /** Root key for every admin mutation. */
+  all: ["auth", "admin"] as const,
+  /** Key for `admin.stopImpersonating`. */
+  stopImpersonating: ["auth", "admin", "stopImpersonating"] as const
+} as const

package/src/plugins/admin/admin-plugin.ts

@@ -0,0 +1,52 @@
+import { createAuthPlugin } from "../../lib/create-auth-plugin"
+import { type AdminLocalization, adminLocalization } from "./admin-localization"
+
+export type AdminPluginOptions = {
+  /**
+   * Override the plugin's default localization strings.
+   * @remarks `AdminLocalization`
+   */
+  localization?: Partial<AdminLocalization>
+}
+
+export type ImpersonatingSession = {
+  session: {
+    impersonatedBy: string
+  }
+}
+
+/**
+ * Check whether a Better Auth session belongs to an impersonated user.
+ */
+export function isImpersonatingSession(
+  session: unknown
+): session is ImpersonatingSession {
+  if (
+    !session ||
+    typeof session !== "object" ||
+    !("session" in session) ||
+    !session.session ||
+    typeof session.session !== "object" ||
+    !("impersonatedBy" in session.session)
+  ) {
+    return false
+  }
+
+  return (
+    typeof session.session.impersonatedBy === "string" &&
+    session.session.impersonatedBy.length > 0
+  )
+}
+
+/**
+ * Adds UI integrations for Better Auth's admin plugin.
+ *
+ * Pair this UI plugin with Better Auth's `admin()` server plugin and
+ * `adminClient()` client plugin.
+ */
+export const adminPlugin = createAuthPlugin(
+  "admin",
+  (options: AdminPluginOptions = {}) => ({
+    localization: { ...adminLocalization, ...options.localization }
+  })
+)

package/src/plugins/device-authorization/device-authorization-localization.ts

@@ -0,0 +1,36 @@
+export const deviceAuthorizationLocalization = {
+  /** @remarks `"Device Authorization"` */
+  deviceAuthorization: "Device Authorization",
+  /** @remarks `"Enter the code displayed on your device."` */
+  deviceAuthorizationDescription: "Enter the code displayed on your device.",
+  /** @remarks `"Device code"` */
+  deviceCode: "Device code",
+  /** @remarks `"The code is invalid or has expired."` */
+  invalidDeviceCode: "The code is invalid or has expired.",
+  /** @remarks `"Continue"` */
+  continue: "Continue",
+  /** @remarks `"Approve Device"` */
+  approveDevice: "Approve Device",
+  /** @remarks `"A device is requesting access to your account."` */
+  approveDeviceDescription: "A device is requesting access to your account.",
+  /** @remarks `"Signed in as"` */
+  signedInAs: "Signed in as",
+  /** @remarks `"Approve"` */
+  approve: "Approve",
+  /** @remarks `"Deny"` */
+  deny: "Deny",
+  /** @remarks `"Device Approved"` */
+  deviceApproved: "Device Approved",
+  /** @remarks `"The device can now access your account. You can return to it and continue."` */
+  deviceApprovedDescription:
+    "The device can now access your account. You can return to it and continue.",
+  /** @remarks `"Device Denied"` */
+  deviceDenied: "Device Denied",
+  /** @remarks `"The device was not granted access to your account."` */
+  deviceDeniedDescription: "The device was not granted access to your account.",
+  /** @remarks `"Return to application"` */
+  returnToApplication: "Return to application"
+}
+
+export type DeviceAuthorizationLocalization =
+  typeof deviceAuthorizationLocalization

package/src/plugins/device-authorization/device-authorization-mutation-keys.ts

@@ -0,0 +1,16 @@
+/**
+ * Mutation keys contributed by the device-authorization plugin.
+ *
+ * All keys live under the shared `["auth"]` namespace so global auth
+ * mutation observers handle errors consistently.
+ */
+export const deviceAuthorizationMutationKeys = {
+  /** Prefix matching every device-authorization mutation. */
+  all: ["auth", "deviceAuthorization"] as const,
+  /** Key for verifying and claiming a user code. */
+  verify: ["auth", "deviceAuthorization", "verify"] as const,
+  /** Key for approving a pending device request. */
+  approve: ["auth", "deviceAuthorization", "approve"] as const,
+  /** Key for denying a pending device request. */
+  deny: ["auth", "deviceAuthorization", "deny"] as const
+} as const