@cauthyhq/node 0.0.0 → 1.0.0

package/dist/hono.js

@@ -0,0 +1,51 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/hono.ts
+var hono_exports = {};
+__export(hono_exports, {
+  cauthyHono: () => cauthyHono,
+  requireSession: () => requireSession
+});
+module.exports = __toCommonJS(hono_exports);
+function cauthyHono(auth) {
+  const base = auth.options.basePath;
+  const key = auth.pact?.contract.jwksPath;
+  return async (c, next) => {
+    const path = new URL(c.req.url).pathname;
+    if (path === base || path.startsWith(`${base}/`) || path === key) return auth.handler(c.req.raw);
+    const resolved = await auth.resolve(c.req.raw);
+    c.set("session", resolved.session);
+    await next();
+    for (const cookie of resolved.cookies) c.header("set-cookie", cookie, { append: true });
+  };
+}
+var requireSession = async (c, next) => {
+  if (c.get("session") === null || c.get("session") === void 0) {
+    c.header("x-cauthy-session", "none");
+    return c.json({ error: "unauthenticated" }, 401);
+  }
+  await next();
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  cauthyHono,
+  requireSession
+});
+//# sourceMappingURL=hono.js.map

package/dist/hono.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hono.ts"],"sourcesContent":["// Hono: the routes, and who is signed in on every request.\n//\n//   const app = new Hono<{ Variables: CauthyVariables }>()\n//   app.use(cauthyHono(auth))\n//\n//   app.get('/api/me', (c) => {\n//     const session = c.get('session')\n//     return session ? c.json(session.user) : c.json({ error: 'unauthenticated' }, 401)\n//   })\n//\n//   app.get('/api/books', requireSession, (c) => { … })\n//\n// A session that needs renewing is renewed on the spot, and its new cookie\n// leaves with whatever the route answers. It runs wherever Hono does.\n\nimport type { MiddlewareHandler } from 'hono'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\n/** What the middleware keeps on the context: `new Hono<{ Variables: CauthyVariables }>()`. */\nexport interface CauthyVariables {\n  /** Who is signed in, or null. */\n  session: Session | null\n}\n\ntype Env = { Variables: CauthyVariables }\n\n/**\n * Serves the routes under the handler's `basePath` (and, by contract, the\n * application's published key), and sets `session` for\n * every other request. Mount it once, before the routes that use it.\n */\nexport function cauthyHono(auth: Cauthy): MiddlewareHandler<Env> {\n  const base = auth.options.basePath\n  // By contract the application also publishes its key, outside basePath.\n  const key = auth.pact?.contract.jwksPath\n  return async (c, next) => {\n    const path = new URL(c.req.url).pathname\n    if (path === base || path.startsWith(`${base}/`) || path === key) return auth.handler(c.req.raw)\n\n    const resolved = await auth.resolve(c.req.raw)\n    c.set('session', resolved.session)\n    await next()\n    for (const cookie of resolved.cookies) c.header('set-cookie', cookie, { append: true })\n  }\n}\n\n/** For a route only a signed-in person may call: answers 401 otherwise. Needs `cauthyHono` mounted before it. */\nexport const requireSession: MiddlewareHandler<Env> = async (c, next) => {\n  if (c.get('session') === null || c.get('session') === undefined) {\n    c.header('x-cauthy-session', 'none')\n    return c.json({ error: 'unauthenticated' }, 401)\n  }\n  await next()\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgCO,SAAS,WAAW,MAAsC;AAC/D,QAAM,OAAO,KAAK,QAAQ;AAE1B,QAAM,MAAM,KAAK,MAAM,SAAS;AAChC,SAAO,OAAO,GAAG,SAAS;AACxB,UAAM,OAAO,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AAChC,QAAI,SAAS,QAAQ,KAAK,WAAW,GAAG,IAAI,GAAG,KAAK,SAAS,IAAK,QAAO,KAAK,QAAQ,EAAE,IAAI,GAAG;AAE/F,UAAM,WAAW,MAAM,KAAK,QAAQ,EAAE,IAAI,GAAG;AAC7C,MAAE,IAAI,WAAW,SAAS,OAAO;AACjC,UAAM,KAAK;AACX,eAAW,UAAU,SAAS,QAAS,GAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;AAAA,EACxF;AACF;AAGO,IAAM,iBAAyC,OAAO,GAAG,SAAS;AACvE,MAAI,EAAE,IAAI,SAAS,MAAM,QAAQ,EAAE,IAAI,SAAS,MAAM,QAAW;AAC/D,MAAE,OAAO,oBAAoB,MAAM;AACnC,WAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;AAAA,EACjD;AACA,QAAM,KAAK;AACb;","names":[]}

package/dist/hono.mjs

@@ -0,0 +1,25 @@
+// src/hono.ts
+function cauthyHono(auth) {
+  const base = auth.options.basePath;
+  const key = auth.pact?.contract.jwksPath;
+  return async (c, next) => {
+    const path = new URL(c.req.url).pathname;
+    if (path === base || path.startsWith(`${base}/`) || path === key) return auth.handler(c.req.raw);
+    const resolved = await auth.resolve(c.req.raw);
+    c.set("session", resolved.session);
+    await next();
+    for (const cookie of resolved.cookies) c.header("set-cookie", cookie, { append: true });
+  };
+}
+var requireSession = async (c, next) => {
+  if (c.get("session") === null || c.get("session") === void 0) {
+    c.header("x-cauthy-session", "none");
+    return c.json({ error: "unauthenticated" }, 401);
+  }
+  await next();
+};
+export {
+  cauthyHono,
+  requireSession
+};
+//# sourceMappingURL=hono.mjs.map

package/dist/hono.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hono.ts"],"sourcesContent":["// Hono: the routes, and who is signed in on every request.\n//\n//   const app = new Hono<{ Variables: CauthyVariables }>()\n//   app.use(cauthyHono(auth))\n//\n//   app.get('/api/me', (c) => {\n//     const session = c.get('session')\n//     return session ? c.json(session.user) : c.json({ error: 'unauthenticated' }, 401)\n//   })\n//\n//   app.get('/api/books', requireSession, (c) => { … })\n//\n// A session that needs renewing is renewed on the spot, and its new cookie\n// leaves with whatever the route answers. It runs wherever Hono does.\n\nimport type { MiddlewareHandler } from 'hono'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\n/** What the middleware keeps on the context: `new Hono<{ Variables: CauthyVariables }>()`. */\nexport interface CauthyVariables {\n  /** Who is signed in, or null. */\n  session: Session | null\n}\n\ntype Env = { Variables: CauthyVariables }\n\n/**\n * Serves the routes under the handler's `basePath` (and, by contract, the\n * application's published key), and sets `session` for\n * every other request. Mount it once, before the routes that use it.\n */\nexport function cauthyHono(auth: Cauthy): MiddlewareHandler<Env> {\n  const base = auth.options.basePath\n  // By contract the application also publishes its key, outside basePath.\n  const key = auth.pact?.contract.jwksPath\n  return async (c, next) => {\n    const path = new URL(c.req.url).pathname\n    if (path === base || path.startsWith(`${base}/`) || path === key) return auth.handler(c.req.raw)\n\n    const resolved = await auth.resolve(c.req.raw)\n    c.set('session', resolved.session)\n    await next()\n    for (const cookie of resolved.cookies) c.header('set-cookie', cookie, { append: true })\n  }\n}\n\n/** For a route only a signed-in person may call: answers 401 otherwise. Needs `cauthyHono` mounted before it. */\nexport const requireSession: MiddlewareHandler<Env> = async (c, next) => {\n  if (c.get('session') === null || c.get('session') === undefined) {\n    c.header('x-cauthy-session', 'none')\n    return c.json({ error: 'unauthenticated' }, 401)\n  }\n  await next()\n}\n"],"mappings":";AAgCO,SAAS,WAAW,MAAsC;AAC/D,QAAM,OAAO,KAAK,QAAQ;AAE1B,QAAM,MAAM,KAAK,MAAM,SAAS;AAChC,SAAO,OAAO,GAAG,SAAS;AACxB,UAAM,OAAO,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AAChC,QAAI,SAAS,QAAQ,KAAK,WAAW,GAAG,IAAI,GAAG,KAAK,SAAS,IAAK,QAAO,KAAK,QAAQ,EAAE,IAAI,GAAG;AAE/F,UAAM,WAAW,MAAM,KAAK,QAAQ,EAAE,IAAI,GAAG;AAC7C,MAAE,IAAI,WAAW,SAAS,OAAO;AACjC,UAAM,KAAK;AACX,eAAW,UAAU,SAAS,QAAS,GAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;AAAA,EACxF;AACF;AAGO,IAAM,iBAAyC,OAAO,GAAG,SAAS;AACvE,MAAI,EAAE,IAAI,SAAS,MAAM,QAAQ,EAAE,IAAI,SAAS,MAAM,QAAW;AAC/D,MAAE,OAAO,oBAAoB,MAAM;AACnC,WAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;AAAA,EACjD;AACA,QAAM,KAAK;AACb;","names":[]}

package/dist/index.d.mts

@@ -0,0 +1,138 @@
+export { A as AttributeType, a as CatalogResource, C as Cauthy, b as CauthyApiError, c as CauthyConfigError, d as CauthyEvent, e as CauthyOptions, f as CauthyPact, g as CauthySystem, h as CauthyTokenError, i as CauthyUnavailableError, j as CauthyWebhookError, k as CheckOf, l as CheckQuestion, m as CheckResult, n as CheckRule, o as ConditionalPermission, p as ContractOptions, J as JsonValue, M as MountTarget, N as NewMember, O as Organization, q as OrganizationMember, r as OrganizationRef, P as PactItem, s as PactStatus, t as PermissionOf, u as Permitted, v as Policy, w as PolicyDefinition, x as PolicyPermission, y as PolicyRole, z as PublicSession, B as PushPolicyOptions, R as ReplayStore, D as Resolved, E as ResolvedContract, F as RoleOf, G as STANDARD_VARIABLES, S as Session, H as SessionOrganization, I as SessionStatus, K as SessionUser, L as SystemKey, Q as SystemOptions, T as SystemPolicy, U as TokenIdentity, V as TokenRefusal, W as VerifyTokenOptions, X as VerifyWebhookOptions, Y as can, Z as createCauthy, _ as createSystem, $ as createTokenVerifier, a0 as definePolicy, a1 as failClosed, a2 as memoryReplayStore, a3 as policySource, a4 as pullCatalog, a5 as pullPolicy, a6 as pushCatalog, a7 as pushPolicy, a8 as readContract, a9 as remoteKeys, aa as verifyToken, ab as verifyWebhook } from './cauthy-ClP5orP4.mjs';
+export { K as KeyStore, P as PactKeys, S as StoredKey } from './keys-D5k0omTb.mjs';
+export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, StackmythTokens, ThemeFont, ThemeTexts, pushTheme, themeFromStackmyth, tokensFromStackmyth } from './theme.mjs';
+import 'jose';
+
+interface ConnectOptions {
+    /** The system's name, as its organizations are filed under: lowercase, digits, - or _. */
+    system: string;
+    /** The application's public address: `https://app.example.com`, or `http://localhost:3000` while developing. */
+    appUrl: string;
+    /** Shown to people on Cauthy's pages. Default: the system's name. */
+    name?: string;
+    /** Where the application serves the return from a sign-in. Default: `/api/auth/callback`. */
+    callbackPath?: string;
+    /** An https address of the application that receives Cauthy's events. */
+    eventsUrl?: string;
+    /** The events to receive. Default: all of them. */
+    events?: string[];
+    /** Where the application publishes its keys, to prove itself without a secret. */
+    jwksUri?: string;
+    /** Cauthy's address. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The workspace's slug. Default: `CAUTHY_TENANT`. */
+    tenant?: string;
+    /** A personal access token with `systems:connect`. Default: `CAUTHY_TOKEN`. */
+    token?: string;
+    fetch?: typeof fetch;
+    /** How long the call may take, in milliseconds, before it fails with a `TimeoutError`. Default: 5000. */
+    timeoutMs?: number;
+}
+interface Connected {
+    system: string;
+    clientId: string;
+    /** Shown this once: Cauthy keeps only its hash. */
+    clientSecret: string;
+    redirectUris: string[];
+    /**
+     * The subscription to events, when `eventsUrl` was given. Its `secret` signs
+     * the HMAC header (X-Cauthy-Signature) and is shown this once; `auth.webhook`
+     * does not need it, as it verifies by Cauthy's published keys.
+     */
+    webhook: {
+        id: string;
+        url: string;
+        events: string[];
+        secret: string;
+    } | null;
+    /**
+     * Everything the application sets: what Cauthy answered, plus CAUTHY_SECRET,
+     * the key of the session cookie, generated here and known to nobody else.
+     */
+    env: Record<string, string>;
+}
+/** @deprecated Connect a system with the cauthy CLI (`npx cauthy init`); leaves in 2.0. */
+declare function connectSystem(o: ConnectOptions): Promise<Connected>;
+
+type AuthField = 'email' | 'password' | 'newPassword' | 'name' | 'code' | 'organization';
+/** A value of a form that cannot be sent as it is. */
+interface FieldProblem {
+    field: AuthField;
+    /**
+     * Stable, for translating: `required`, `invalid_email`, `too_short`,
+     * `too_long`, and for a new password the rule of the workspace it fails:
+     * `needs_lowercase`, `needs_uppercase`, `needs_digit`, `needs_symbol`,
+     * `needs_classes`.
+     */
+    code: 'required' | 'invalid_email' | PasswordReason;
+    message: string;
+}
+/** The shortest password Cauthy takes by default: a workspace's policy may ask otherwise (`methods().password`). */
+declare const MIN_PASSWORD = 12;
+/** A kind of character a workspace's password policy can ask for. */
+type PasswordClass = 'lowercase' | 'uppercase' | 'digit' | 'symbol';
+/** Why a new password is refused: the API's `weak_password` `meta.reasons`. */
+type PasswordReason = 'too_short' | 'too_long' | 'needs_lowercase' | 'needs_uppercase' | 'needs_digit' | 'needs_symbol' | 'needs_classes' | 'breached';
+/**
+ * What a new password must be in the workspace, as `methods().password` says
+ * it. Length is counted in bytes of UTF-8, as Cauthy counts it. A symbol is
+ * any character that is neither a letter nor a digit, a space included.
+ */
+interface PasswordPolicy {
+    min: number;
+    max: number;
+    /** The kinds the password must each carry at least once. */
+    requires: PasswordClass[];
+    /** At least this many of the four kinds; 0 asks none. */
+    min_classes: number;
+    /** Cauthy refuses a password found in a published breach (checked by Cauthy alone). */
+    reject_breached: boolean;
+}
+/** The policy of a workspace that set none: what every one asked before they could choose. */
+declare const DEFAULT_PASSWORD_POLICY: PasswordPolicy;
+/**
+ * A password policy as Cauthy sent it — `{ min_length, max_length, … }` from
+ * the sign-in settings, or `{ min, max, … }` from `methods()` — made safe to
+ * use: the defaults where nothing is said, and never outside 8–128.
+ */
+declare function passwordPolicyOf(raw: unknown): PasswordPolicy;
+/**
+ * Every rule of the policy a new password fails, as the API names them;
+ * empty when it meets them all. Whether it was in a breach only Cauthy knows.
+ */
+declare function passwordProblems(value: string, policy?: PasswordPolicy): PasswordReason[];
+/** The languages the rule is said in. */
+type PasswordLocale = 'en' | 'es';
+/** What a new password must be, said for the person choosing it: "Between 12 and 128 characters. Include a digit." */
+declare function describePasswordPolicy(policy?: PasswordPolicy, locale?: PasswordLocale): string;
+/** Why a new password was refused, rule by rule, for the person who typed it. */
+declare function explainPasswordProblems(reasons: readonly string[], policy?: PasswordPolicy, locale?: PasswordLocale): string;
+declare function checkEmail(value: unknown): FieldProblem | null;
+/** A password being typed to sign in: only that there is one. */
+declare function checkPassword(value: unknown): FieldProblem | null;
+/**
+ * A password being chosen for a new account, or a new one for an account.
+ * Held to the workspace's policy when it is given (`methods().password`),
+ * otherwise to the defaults: 12 to 128 characters.
+ */
+declare function checkNewPassword(value: unknown, policy?: PasswordPolicy | null): FieldProblem | null;
+declare function checkName(value: unknown): FieldProblem | null;
+declare function checkCode(value: unknown): FieldProblem | null;
+
+declare const PROTOCOL_VERSION = "1";
+/**
+ * What the screen does after a sign-in answer:
+ *
+ * - `done`: signed in; go on.
+ * - `mfa`: ask for the second step (the code, or the push's approval).
+ * - `verify_email`: the address must be confirmed first.
+ * - `code`: a code (or link) was mailed; ask for the code.
+ * - `passkey`: run the passkey ceremony with the options in the answer.
+ * - `one_tap`: show Google's prompt with the client and nonce in the answer,
+ *   then post the credential it gives.
+ * - `redirect`: go to the URL the answer carries. Reserved for answers that
+ *   have one; no route of version 1 answers it yet.
+ */
+type NextStep = 'done' | 'mfa' | 'verify_email' | 'code' | 'passkey' | 'one_tap' | 'redirect';
+
+export { type AuthField, type ConnectOptions, type Connected, DEFAULT_PASSWORD_POLICY, type FieldProblem, MIN_PASSWORD, type NextStep, PROTOCOL_VERSION, type PasswordClass, type PasswordLocale, type PasswordPolicy, type PasswordReason, checkCode, checkEmail, checkName, checkNewPassword, checkPassword, connectSystem, describePasswordPolicy, explainPasswordProblems, passwordPolicyOf, passwordProblems };

package/dist/index.d.ts

@@ -0,0 +1,138 @@
+export { A as AttributeType, a as CatalogResource, C as Cauthy, b as CauthyApiError, c as CauthyConfigError, d as CauthyEvent, e as CauthyOptions, f as CauthyPact, g as CauthySystem, h as CauthyTokenError, i as CauthyUnavailableError, j as CauthyWebhookError, k as CheckOf, l as CheckQuestion, m as CheckResult, n as CheckRule, o as ConditionalPermission, p as ContractOptions, J as JsonValue, M as MountTarget, N as NewMember, O as Organization, q as OrganizationMember, r as OrganizationRef, P as PactItem, s as PactStatus, t as PermissionOf, u as Permitted, v as Policy, w as PolicyDefinition, x as PolicyPermission, y as PolicyRole, z as PublicSession, B as PushPolicyOptions, R as ReplayStore, D as Resolved, E as ResolvedContract, F as RoleOf, G as STANDARD_VARIABLES, S as Session, H as SessionOrganization, I as SessionStatus, K as SessionUser, L as SystemKey, Q as SystemOptions, T as SystemPolicy, U as TokenIdentity, V as TokenRefusal, W as VerifyTokenOptions, X as VerifyWebhookOptions, Y as can, Z as createCauthy, _ as createSystem, $ as createTokenVerifier, a0 as definePolicy, a1 as failClosed, a2 as memoryReplayStore, a3 as policySource, a4 as pullCatalog, a5 as pullPolicy, a6 as pushCatalog, a7 as pushPolicy, a8 as readContract, a9 as remoteKeys, aa as verifyToken, ab as verifyWebhook } from './cauthy-B6Sm3T8M.js';
+export { K as KeyStore, P as PactKeys, S as StoredKey } from './keys-D5k0omTb.js';
+export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, StackmythTokens, ThemeFont, ThemeTexts, pushTheme, themeFromStackmyth, tokensFromStackmyth } from './theme.js';
+import 'jose';
+
+interface ConnectOptions {
+    /** The system's name, as its organizations are filed under: lowercase, digits, - or _. */
+    system: string;
+    /** The application's public address: `https://app.example.com`, or `http://localhost:3000` while developing. */
+    appUrl: string;
+    /** Shown to people on Cauthy's pages. Default: the system's name. */
+    name?: string;
+    /** Where the application serves the return from a sign-in. Default: `/api/auth/callback`. */
+    callbackPath?: string;
+    /** An https address of the application that receives Cauthy's events. */
+    eventsUrl?: string;
+    /** The events to receive. Default: all of them. */
+    events?: string[];
+    /** Where the application publishes its keys, to prove itself without a secret. */
+    jwksUri?: string;
+    /** Cauthy's address. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The workspace's slug. Default: `CAUTHY_TENANT`. */
+    tenant?: string;
+    /** A personal access token with `systems:connect`. Default: `CAUTHY_TOKEN`. */
+    token?: string;
+    fetch?: typeof fetch;
+    /** How long the call may take, in milliseconds, before it fails with a `TimeoutError`. Default: 5000. */
+    timeoutMs?: number;
+}
+interface Connected {
+    system: string;
+    clientId: string;
+    /** Shown this once: Cauthy keeps only its hash. */
+    clientSecret: string;
+    redirectUris: string[];
+    /**
+     * The subscription to events, when `eventsUrl` was given. Its `secret` signs
+     * the HMAC header (X-Cauthy-Signature) and is shown this once; `auth.webhook`
+     * does not need it, as it verifies by Cauthy's published keys.
+     */
+    webhook: {
+        id: string;
+        url: string;
+        events: string[];
+        secret: string;
+    } | null;
+    /**
+     * Everything the application sets: what Cauthy answered, plus CAUTHY_SECRET,
+     * the key of the session cookie, generated here and known to nobody else.
+     */
+    env: Record<string, string>;
+}
+/** @deprecated Connect a system with the cauthy CLI (`npx cauthy init`); leaves in 2.0. */
+declare function connectSystem(o: ConnectOptions): Promise<Connected>;
+
+type AuthField = 'email' | 'password' | 'newPassword' | 'name' | 'code' | 'organization';
+/** A value of a form that cannot be sent as it is. */
+interface FieldProblem {
+    field: AuthField;
+    /**
+     * Stable, for translating: `required`, `invalid_email`, `too_short`,
+     * `too_long`, and for a new password the rule of the workspace it fails:
+     * `needs_lowercase`, `needs_uppercase`, `needs_digit`, `needs_symbol`,
+     * `needs_classes`.
+     */
+    code: 'required' | 'invalid_email' | PasswordReason;
+    message: string;
+}
+/** The shortest password Cauthy takes by default: a workspace's policy may ask otherwise (`methods().password`). */
+declare const MIN_PASSWORD = 12;
+/** A kind of character a workspace's password policy can ask for. */
+type PasswordClass = 'lowercase' | 'uppercase' | 'digit' | 'symbol';
+/** Why a new password is refused: the API's `weak_password` `meta.reasons`. */
+type PasswordReason = 'too_short' | 'too_long' | 'needs_lowercase' | 'needs_uppercase' | 'needs_digit' | 'needs_symbol' | 'needs_classes' | 'breached';
+/**
+ * What a new password must be in the workspace, as `methods().password` says
+ * it. Length is counted in bytes of UTF-8, as Cauthy counts it. A symbol is
+ * any character that is neither a letter nor a digit, a space included.
+ */
+interface PasswordPolicy {
+    min: number;
+    max: number;
+    /** The kinds the password must each carry at least once. */
+    requires: PasswordClass[];
+    /** At least this many of the four kinds; 0 asks none. */
+    min_classes: number;
+    /** Cauthy refuses a password found in a published breach (checked by Cauthy alone). */
+    reject_breached: boolean;
+}
+/** The policy of a workspace that set none: what every one asked before they could choose. */
+declare const DEFAULT_PASSWORD_POLICY: PasswordPolicy;
+/**
+ * A password policy as Cauthy sent it — `{ min_length, max_length, … }` from
+ * the sign-in settings, or `{ min, max, … }` from `methods()` — made safe to
+ * use: the defaults where nothing is said, and never outside 8–128.
+ */
+declare function passwordPolicyOf(raw: unknown): PasswordPolicy;
+/**
+ * Every rule of the policy a new password fails, as the API names them;
+ * empty when it meets them all. Whether it was in a breach only Cauthy knows.
+ */
+declare function passwordProblems(value: string, policy?: PasswordPolicy): PasswordReason[];
+/** The languages the rule is said in. */
+type PasswordLocale = 'en' | 'es';
+/** What a new password must be, said for the person choosing it: "Between 12 and 128 characters. Include a digit." */
+declare function describePasswordPolicy(policy?: PasswordPolicy, locale?: PasswordLocale): string;
+/** Why a new password was refused, rule by rule, for the person who typed it. */
+declare function explainPasswordProblems(reasons: readonly string[], policy?: PasswordPolicy, locale?: PasswordLocale): string;
+declare function checkEmail(value: unknown): FieldProblem | null;
+/** A password being typed to sign in: only that there is one. */
+declare function checkPassword(value: unknown): FieldProblem | null;
+/**
+ * A password being chosen for a new account, or a new one for an account.
+ * Held to the workspace's policy when it is given (`methods().password`),
+ * otherwise to the defaults: 12 to 128 characters.
+ */
+declare function checkNewPassword(value: unknown, policy?: PasswordPolicy | null): FieldProblem | null;
+declare function checkName(value: unknown): FieldProblem | null;
+declare function checkCode(value: unknown): FieldProblem | null;
+
+declare const PROTOCOL_VERSION = "1";
+/**
+ * What the screen does after a sign-in answer:
+ *
+ * - `done`: signed in; go on.
+ * - `mfa`: ask for the second step (the code, or the push's approval).
+ * - `verify_email`: the address must be confirmed first.
+ * - `code`: a code (or link) was mailed; ask for the code.
+ * - `passkey`: run the passkey ceremony with the options in the answer.
+ * - `one_tap`: show Google's prompt with the client and nonce in the answer,
+ *   then post the credential it gives.
+ * - `redirect`: go to the URL the answer carries. Reserved for answers that
+ *   have one; no route of version 1 answers it yet.
+ */
+type NextStep = 'done' | 'mfa' | 'verify_email' | 'code' | 'passkey' | 'one_tap' | 'redirect';
+
+export { type AuthField, type ConnectOptions, type Connected, DEFAULT_PASSWORD_POLICY, type FieldProblem, MIN_PASSWORD, type NextStep, PROTOCOL_VERSION, type PasswordClass, type PasswordLocale, type PasswordPolicy, type PasswordReason, checkCode, checkEmail, checkName, checkNewPassword, checkPassword, connectSystem, describePasswordPolicy, explainPasswordProblems, passwordPolicyOf, passwordProblems };