@dbx-tools/shared-auth 0.9.131 → 0.9.133

package/README.md

@@ -1,16 +1,16 @@
-# `@dbx-tools/shared-auth`
+# @dbx-tools/shared-auth
 
-Keep passwordless sign-in, passkey controls, and Databricks profile selectors
-consistent across browser and server packages. The package provides shared
-schemas for validating responses at the network boundary plus browser helpers
-that work with `@dbx-tools/auth-gate`.
+Validate passwordless sign-in, passkey, Databricks profile, and resolved-client
+data at browser and server boundaries. The package also provides browser helpers
+for the routes owned by
+[@dbx-tools/auth-gate](../../node/auth-gate).
 
-## Read Authentication Status
+## Read authentication status
 
 ```ts
 import { authStatusSchema } from "@dbx-tools/shared-auth";
 
-const response = await fetch("/api/auth/status", { credentials: "include" });
+const response = await fetch("/api/email/auth/status", { credentials: "include" });
 const status = authStatusSchema.parse(await response.json());
 
 if (status.enabled && !status.authenticated) {
@@ -21,7 +21,7 @@ if (status.enabled && !status.authenticated) {
 Use the request, verification, logout, and status schemas when custom UI or
 transport code calls the auth gate directly.
 
-## Build A Profile Selector
+## Build a profile selector
 
 Profile summaries never include tokens or client secrets. Validate values before
 rendering or persisting a selection:
@@ -32,33 +32,55 @@ import {
   databricksProfileSelectionSchema,
 } from "@dbx-tools/shared-auth";
 
-const profiles = databricksProfileListSchema.parse(await response.json());
-const selection = databricksProfileSelectionSchema.parse({
-  kind: "profile",
-  profile: profiles[0].name,
-});
+export function selectFirstProfile(input: unknown) {
+  const profiles = databricksProfileListSchema.parse(input);
+  return databricksProfileSelectionSchema.parse({
+    kind: "profile",
+    profile: profiles[0]!.name,
+  });
+}
 ```
 
 Use `{ kind: "ambient" }` when the consuming runtime should choose its normal
 Databricks authentication source.
 
-## Use Browser Sign-In Helpers
+## Use browser sign-in helpers
 
-The `browser` module requests and verifies email OTPs, starts passkey sign-in or
-enrollment, manages enrolled passkeys, reads gate status, and logs out through
-the server-provided same-origin redirect.
+The `browser` module requests and verifies email one-time passwords (OTPs),
+starts passkey sign-in or enrollment, manages enrolled passkeys, reads gate
+status, and logs out through the server-provided same-origin redirect.
 
 ```ts
 import { requestEmailOtp, verifyEmailOtp } from "@dbx-tools/shared-auth/browser";
 
-await requestEmailOtp("person@example.com");
-await verifyEmailOtp("person@example.com", code, "Person");
+export async function requestCode(email: string) {
+  return requestEmailOtp(email);
+}
+
+export async function submitCode(email: string, code: string, name: string) {
+  return verifyEmailOtp(email, code, name);
+}
 ```
 
-## Package API
+Browser helpers use same-origin `/api/email/auth` routes and include the session
+cookie. Email one-time passwords and logout require the auth-gate server routes.
+Passkey operations also require a browser with WebAuthn support. A direct auth
+runtime mounted elsewhere must use the same base path before these helpers can
+call it.
+
+## Runtime boundary
+
+The Zod schemas and secret-free profile types are safe for shared code. The
+`./browser` subpath performs browser network and WebAuthn operations. This
+package doesn't resolve credentials, mint Databricks tokens, or register server
+routes. Use [@dbx-tools/auth](../../node/auth) for Databricks credential
+resolution and [@dbx-tools/auth-gate](../../node/auth-gate) for passwordless
+server routes.
+
+## Package exports
 
-- `auth` validates passwordless gate requests and responses.
-- `browser` performs email OTP, passkey, status, and logout operations.
-- `config` defines Databricks authentication and target values.
-- `profile` validates secret-free profile lists and selections.
-- `client` validates resolved, secret-free Databricks client information.
+- `auth`: validates passwordless gate requests and responses.
+- `browser`: performs email OTP, passkey, status, and logout operations.
+- `config`: defines Databricks authentication and target values.
+- `profile`: validates secret-free profile lists and selections.
+- `client`: validates resolved, secret-free Databricks client information.

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/shared-auth";
-export const PACKAGE_VERSION = "0.9.131";
+export const PACKAGE_VERSION = "0.9.133";
 export * as auth from "./src/auth.ts";
 export * as browser from "./src/browser.ts";
 export * as client from "./src/client.ts";

package/lib/index.d.ts

@@ -1,5 +1,5 @@
 export declare const PACKAGE_IDENTIFIER = "@dbx-tools/shared-auth";
-export declare const PACKAGE_VERSION = "0.9.131";
+export declare const PACKAGE_VERSION = "0.9.133";
 export * as auth from "./src/auth.ts";
 export * as browser from "./src/browser.ts";
 export * as client from "./src/client.ts";

package/lib/index.js

@@ -2,7 +2,7 @@
 // Regenerated from the exporting modules in ./src.
 // Hand edits are overwritten on the next watch; this file is read-only.
 export const PACKAGE_IDENTIFIER = "@dbx-tools/shared-auth";
-export const PACKAGE_VERSION = "0.9.131";
+export const PACKAGE_VERSION = "0.9.133";
 export * as auth from "./src/auth.js";
 export * as browser from "./src/browser.js";
 export * as client from "./src/client.js";
@@ -14,4 +14,4 @@ export { RUNTIME_AUTH_TYPE, databricksAuthClientInfoSchema } from "./src/client.
 export { AuthType, TargetKind } from "./src/config.js";
 export { authTypeSchema, targetKindSchema } from "./src/config-schema.js";
 export { databricksProfileSummarySchema, databricksProfileListSchema, databricksProfileSelectionSchema } from "./src/profile.js";
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyx3QkFBd0IsQ0FBQztBQUMzRCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsU0FBUyxDQUFDO0FBQ3pDLE9BQU8sS0FBSyxJQUFJLE1BQU0sZUFBZSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFDNUMsT0FBTyxLQUFLLE1BQU0sTUFBTSxpQkFBaUIsQ0FBQztBQUMxQyxPQUFPLEtBQUssTUFBTSxNQUFNLGlCQUFpQixDQUFDO0FBQzFDLE9BQU8sS0FBSyxZQUFZLE1BQU0sd0JBQXdCLENBQUM7QUFDdkQsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUM1QyxPQUFPLEVBQUUsY0FBYyxFQUFFLG1CQUFtQixFQUFFLGlCQUFpQixFQUFFLHVCQUF1QixFQUFFLGdCQUFnQixFQUFFLHNCQUFzQixFQUFFLHNCQUFzQixFQUFFLGdCQUFnQixFQUFFLE1BQU0sZUFBZSxDQUFDO0FBR3BNLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSw4QkFBOEIsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBRXBGLE9BQU8sRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDdkQsT0FBTyxFQUFFLGNBQWMsRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQzFFLE9BQU8sRUFBRSw4QkFBOEIsRUFBRSwyQkFBMkIsRUFBRSxnQ0FBZ0MsRUFBRSxNQUFNLGtCQUFrQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gR0VORVJBVEVEIGJ5IHByb2plbiB3YXRjaCAtIERPIE5PVCBFRElULlxuLy8gUmVnZW5lcmF0ZWQgZnJvbSB0aGUgZXhwb3J0aW5nIG1vZHVsZXMgaW4gLi9zcmMuXG4vLyBIYW5kIGVkaXRzIGFyZSBvdmVyd3JpdHRlbiBvbiB0aGUgbmV4dCB3YXRjaDsgdGhpcyBmaWxlIGlzIHJlYWQtb25seS5cblxuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfSURFTlRJRklFUiA9IFwiQGRieC10b29scy9zaGFyZWQtYXV0aFwiO1xuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfVkVSU0lPTiA9IFwiMC45LjEzMVwiO1xuZXhwb3J0ICogYXMgYXV0aCBmcm9tIFwiLi9zcmMvYXV0aC50c1wiO1xuZXhwb3J0ICogYXMgYnJvd3NlciBmcm9tIFwiLi9zcmMvYnJvd3Nlci50c1wiO1xuZXhwb3J0ICogYXMgY2xpZW50IGZyb20gXCIuL3NyYy9jbGllbnQudHNcIjtcbmV4cG9ydCAqIGFzIGNvbmZpZyBmcm9tIFwiLi9zcmMvY29uZmlnLnRzXCI7XG5leHBvcnQgKiBhcyBjb25maWdTY2hlbWEgZnJvbSBcIi4vc3JjL2NvbmZpZy1zY2hlbWEudHNcIjtcbmV4cG9ydCAqIGFzIHByb2ZpbGUgZnJvbSBcIi4vc3JjL3Byb2ZpbGUudHNcIjtcbmV4cG9ydCB7IEFVVEhfQkFTRV9QQVRILCBTRVNTSU9OX0NPT0tJRV9OQU1FLCBhdXRoUmVxdWVzdFNjaGVtYSwgYXV0aFJlcXVlc3RSZXN1bHRTY2hlbWEsIGF1dGhWZXJpZnlTY2hlbWEsIGF1dGhWZXJpZnlSZXN1bHRTY2hlbWEsIGF1dGhMb2dvdXRSZXN1bHRTY2hlbWEsIGF1dGhTdGF0dXNTY2hlbWEgfSBmcm9tIFwiLi9zcmMvYXV0aC50c1wiO1xuZXhwb3J0IHR5cGUgeyBBdXRoUmVxdWVzdCwgQXV0aFJlcXVlc3RSZXN1bHQsIEF1dGhWZXJpZnksIEF1dGhWZXJpZnlSZXN1bHQsIEF1dGhMb2dvdXRSZXN1bHQsIEF1dGhTdGF0dXMgfSBmcm9tIFwiLi9zcmMvYXV0aC50c1wiO1xuZXhwb3J0IHR5cGUgeyBQYXNza2V5T3BlcmF0aW9uIH0gZnJvbSBcIi4vc3JjL2Jyb3dzZXIudHNcIjtcbmV4cG9ydCB7IFJVTlRJTUVfQVVUSF9UWVBFLCBkYXRhYnJpY2tzQXV0aENsaWVudEluZm9TY2hlbWEgfSBmcm9tIFwiLi9zcmMvY2xpZW50LnRzXCI7XG5leHBvcnQgdHlwZSB7IERhdGFicmlja3NBdXRoQ2xpZW50SW5mbyB9IGZyb20gXCIuL3NyYy9jbGllbnQudHNcIjtcbmV4cG9ydCB7IEF1dGhUeXBlLCBUYXJnZXRLaW5kIH0gZnJvbSBcIi4vc3JjL2NvbmZpZy50c1wiO1xuZXhwb3J0IHsgYXV0aFR5cGVTY2hlbWEsIHRhcmdldEtpbmRTY2hlbWEgfSBmcm9tIFwiLi9zcmMvY29uZmlnLXNjaGVtYS50c1wiO1xuZXhwb3J0IHsgZGF0YWJyaWNrc1Byb2ZpbGVTdW1tYXJ5U2NoZW1hLCBkYXRhYnJpY2tzUHJvZmlsZUxpc3RTY2hlbWEsIGRhdGFicmlja3NQcm9maWxlU2VsZWN0aW9uU2NoZW1hIH0gZnJvbSBcIi4vc3JjL3Byb2ZpbGUudHNcIjtcbmV4cG9ydCB0eXBlIHsgRGF0YWJyaWNrc1Byb2ZpbGVTdW1tYXJ5LCBEYXRhYnJpY2tzUHJvZmlsZUxpc3QsIERhdGFicmlja3NQcm9maWxlU2VsZWN0aW9uIH0gZnJvbSBcIi4vc3JjL3Byb2ZpbGUudHNcIjtcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyx3QkFBd0IsQ0FBQztBQUMzRCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsU0FBUyxDQUFDO0FBQ3pDLE9BQU8sS0FBSyxJQUFJLE1BQU0sZUFBZSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFDNUMsT0FBTyxLQUFLLE1BQU0sTUFBTSxpQkFBaUIsQ0FBQztBQUMxQyxPQUFPLEtBQUssTUFBTSxNQUFNLGlCQUFpQixDQUFDO0FBQzFDLE9BQU8sS0FBSyxZQUFZLE1BQU0sd0JBQXdCLENBQUM7QUFDdkQsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUM1QyxPQUFPLEVBQUUsY0FBYyxFQUFFLG1CQUFtQixFQUFFLGlCQUFpQixFQUFFLHVCQUF1QixFQUFFLGdCQUFnQixFQUFFLHNCQUFzQixFQUFFLHNCQUFzQixFQUFFLGdCQUFnQixFQUFFLE1BQU0sZUFBZSxDQUFDO0FBR3BNLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSw4QkFBOEIsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBRXBGLE9BQU8sRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDdkQsT0FBTyxFQUFFLGNBQWMsRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQzFFLE9BQU8sRUFBRSw4QkFBOEIsRUFBRSwyQkFBMkIsRUFBRSxnQ0FBZ0MsRUFBRSxNQUFNLGtCQUFrQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gR0VORVJBVEVEIGJ5IHByb2plbiB3YXRjaCAtIERPIE5PVCBFRElULlxuLy8gUmVnZW5lcmF0ZWQgZnJvbSB0aGUgZXhwb3J0aW5nIG1vZHVsZXMgaW4gLi9zcmMuXG4vLyBIYW5kIGVkaXRzIGFyZSBvdmVyd3JpdHRlbiBvbiB0aGUgbmV4dCB3YXRjaDsgdGhpcyBmaWxlIGlzIHJlYWQtb25seS5cblxuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfSURFTlRJRklFUiA9IFwiQGRieC10b29scy9zaGFyZWQtYXV0aFwiO1xuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfVkVSU0lPTiA9IFwiMC45LjEzM1wiO1xuZXhwb3J0ICogYXMgYXV0aCBmcm9tIFwiLi9zcmMvYXV0aC50c1wiO1xuZXhwb3J0ICogYXMgYnJvd3NlciBmcm9tIFwiLi9zcmMvYnJvd3Nlci50c1wiO1xuZXhwb3J0ICogYXMgY2xpZW50IGZyb20gXCIuL3NyYy9jbGllbnQudHNcIjtcbmV4cG9ydCAqIGFzIGNvbmZpZyBmcm9tIFwiLi9zcmMvY29uZmlnLnRzXCI7XG5leHBvcnQgKiBhcyBjb25maWdTY2hlbWEgZnJvbSBcIi4vc3JjL2NvbmZpZy1zY2hlbWEudHNcIjtcbmV4cG9ydCAqIGFzIHByb2ZpbGUgZnJvbSBcIi4vc3JjL3Byb2ZpbGUudHNcIjtcbmV4cG9ydCB7IEFVVEhfQkFTRV9QQVRILCBTRVNTSU9OX0NPT0tJRV9OQU1FLCBhdXRoUmVxdWVzdFNjaGVtYSwgYXV0aFJlcXVlc3RSZXN1bHRTY2hlbWEsIGF1dGhWZXJpZnlTY2hlbWEsIGF1dGhWZXJpZnlSZXN1bHRTY2hlbWEsIGF1dGhMb2dvdXRSZXN1bHRTY2hlbWEsIGF1dGhTdGF0dXNTY2hlbWEgfSBmcm9tIFwiLi9zcmMvYXV0aC50c1wiO1xuZXhwb3J0IHR5cGUgeyBBdXRoUmVxdWVzdCwgQXV0aFJlcXVlc3RSZXN1bHQsIEF1dGhWZXJpZnksIEF1dGhWZXJpZnlSZXN1bHQsIEF1dGhMb2dvdXRSZXN1bHQsIEF1dGhTdGF0dXMgfSBmcm9tIFwiLi9zcmMvYXV0aC50c1wiO1xuZXhwb3J0IHR5cGUgeyBQYXNza2V5T3BlcmF0aW9uIH0gZnJvbSBcIi4vc3JjL2Jyb3dzZXIudHNcIjtcbmV4cG9ydCB7IFJVTlRJTUVfQVVUSF9UWVBFLCBkYXRhYnJpY2tzQXV0aENsaWVudEluZm9TY2hlbWEgfSBmcm9tIFwiLi9zcmMvY2xpZW50LnRzXCI7XG5leHBvcnQgdHlwZSB7IERhdGFicmlja3NBdXRoQ2xpZW50SW5mbyB9IGZyb20gXCIuL3NyYy9jbGllbnQudHNcIjtcbmV4cG9ydCB7IEF1dGhUeXBlLCBUYXJnZXRLaW5kIH0gZnJvbSBcIi4vc3JjL2NvbmZpZy50c1wiO1xuZXhwb3J0IHsgYXV0aFR5cGVTY2hlbWEsIHRhcmdldEtpbmRTY2hlbWEgfSBmcm9tIFwiLi9zcmMvY29uZmlnLXNjaGVtYS50c1wiO1xuZXhwb3J0IHsgZGF0YWJyaWNrc1Byb2ZpbGVTdW1tYXJ5U2NoZW1hLCBkYXRhYnJpY2tzUHJvZmlsZUxpc3RTY2hlbWEsIGRhdGFicmlja3NQcm9maWxlU2VsZWN0aW9uU2NoZW1hIH0gZnJvbSBcIi4vc3JjL3Byb2ZpbGUudHNcIjtcbmV4cG9ydCB0eXBlIHsgRGF0YWJyaWNrc1Byb2ZpbGVTdW1tYXJ5LCBEYXRhYnJpY2tzUHJvZmlsZUxpc3QsIERhdGFicmlja3NQcm9maWxlU2VsZWN0aW9uIH0gZnJvbSBcIi4vc3JjL3Byb2ZpbGUudHNcIjtcbiJdfQ==

package/package.json

@@ -23,7 +23,7 @@
   },
   "dependencies": {
     "@better-auth/passkey": "1.7.6",
-    "@dbx-tools/shared-core": "^0.9.131",
+    "@dbx-tools/shared-core": "^0.9.133",
     "@simplewebauthn/browser": "13.3.0",
     "better-auth": "1.7.6",
     "zod": "4.3.6"
@@ -70,7 +70,7 @@
       "./package.json": "./package.json"
     }
   },
-  "version": "0.9.131",
+  "version": "0.9.133",
   "types": "./lib/index.d.ts",
   "dbxToolsConfig": {
     "tags": [