@edgespark/web 0.0.0-beta.8b6c080

package/dist/auth/local-dev.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Is the web app running in local-dev mode?
+ *
+ * Reads a `<meta name="edgespark-local-dev" content="true">` tag that
+ * the `edgespark dev` reverse proxy splices into every HTML response.
+ * The dev proxy only runs under `edgespark dev`; the meta tag is absent
+ * on deployed apps (served through the CF dispatcher, which doesn't
+ * inject).
+ *
+ * Uses a <meta> tag rather than an inline <script> so the signal works
+ * under strict CSP — `script-src 'self'` without `'unsafe-inline'`
+ * would silently drop a script-based marker. Meta tags carry no
+ * script-src constraint.
+ *
+ * No server round-trip, no build-time macro, no hostname heuristic, no
+ * framework assumptions. Survives SDK pre-bundling — the SDK reads the
+ * DOM at call time, not a value captured at build time.
+ */
+export declare function isLocalDev(): boolean;
+/**
+ * Auto-verify email in local dev. The server reads the pending verification
+ * token from D1, drives Better Auth's verify-email handler, and returns with
+ * the session cookie already set. Single round-trip — no token round-trip on
+ * the client.
+ */
+export declare function autoVerifyLocalDev(email: string): Promise<boolean>;
+/**
+ * Fetch the pending OTP for password reset in local dev.
+ * Returns the OTP string or null if not available.
+ */
+export declare function fetchOtpLocalDev(email: string): Promise<string | null>;
+/**
+ * Fetch the pending OTP for email sign-in in local dev.
+ * Returns the OTP string or null if not available.
+ */
+export declare function fetchSignInOtpLocalDev(email: string): Promise<string | null>;

package/dist/auth/types.d.ts

@@ -0,0 +1,84 @@
+import { createAuthClient } from 'better-auth/client';
+/**
+ * Direct better-auth client instance returned by createAuthClient().
+ */
+export type BetterAuthClientInstance = ReturnType<typeof createAuthClient>;
+export type SessionResult = Awaited<ReturnType<BetterAuthClientInstance["getSession"]>>;
+export type AuthSession = NonNullable<SessionResult["data"]>;
+export type AuthUser = AuthSession["user"];
+export type SessionChangeCallback = (session: AuthSession | null) => void;
+export interface AuthEndpointError {
+    code?: string;
+    message?: string;
+    status?: number;
+}
+export interface AuthEndpointResult<TData = unknown> {
+    data?: TData | null;
+    error?: AuthEndpointError | null;
+}
+/**
+ * EdgeSpark keeps the auth API shape aligned with better-auth while adding a
+ * small set of session helpers on top.
+ *
+ * Most upstream auth methods remain available on the familiar better-auth
+ * shape. Some upstream methods may still be intentionally unsupported by the
+ * current EdgeSpark platform capability set even though they exist on the
+ * underlying better-auth client surface. In those cases, the facade throws an
+ * `EdgeSparkAuthError` with code `UNSUPPORTED_AUTH_METHOD` instead of deferring
+ * to a platform-specific 400/404 response.
+ */
+export type EdgeSparkAuth = BetterAuthClientInstance & {
+    /**
+     * Resolves with the current session, or throws when the browser is not authenticated.
+     *
+     * Use this for route guards and other flows where nullable session checks add noise.
+     *
+     * If the session lookup itself fails (offline, 5xx, etc.), this throws an
+     * `EdgeSparkAuthError` that preserves the upstream error code/status instead
+     * of collapsing the failure into `UNAUTHENTICATED`.
+     */
+    requireSession(): Promise<AuthSession>;
+    /**
+     * Subscribes to session changes for the current browser context.
+     *
+     * The first emission is hydration-safe: it waits for the initial server
+     * session lookup to complete before firing, so subscribers never receive a
+     * premature `null` while a cookie session is still settling.
+     *
+     * After hydration, successful session atom updates are forwarded immediately.
+     * Successful auth mutations that create or clear a session in the current
+     * tab also prompt other tabs to refetch their session state, so logout and
+     * same-tab sign-in/sign-up converge quickly across tabs.
+     *
+     * Transient lookup failures that temporarily clear the atom to `null` are
+     * ignored so subscribers do not mistake a backend error for a real sign-out.
+     *
+     * Returns an unsubscribe function.
+     */
+    onSessionChange(callback: SessionChangeCallback): () => void;
+    /**
+     * Signs out and then best-effort synchronizes session state for the current
+     * tab and other open tabs.
+     *
+     * The underlying better-auth result is returned unchanged.
+     */
+    signOut(...args: Parameters<BetterAuthClientInstance["signOut"]>): ReturnType<BetterAuthClientInstance["signOut"]>;
+    /**
+     * Currently unsupported by EdgeSpark platform auth.
+     *
+     * The method remains present to preserve the familiar better-auth API shape,
+     * but the facade throws `UNSUPPORTED_AUTH_METHOD` until the platform enables
+     * this capability. For browser auth, prefer supported `client.auth` methods
+     * or `authUI.mount()` instead of dropping to raw `/api/_es/auth/*` routes.
+     */
+    changeEmail(...args: Parameters<BetterAuthClientInstance["changeEmail"]>): ReturnType<BetterAuthClientInstance["changeEmail"]>;
+    /**
+     * Currently unsupported by EdgeSpark platform auth.
+     *
+     * The method remains present to preserve the familiar better-auth API shape,
+     * but the facade throws `UNSUPPORTED_AUTH_METHOD` until the platform enables
+     * this capability. Handle account removal through your own app flow until the
+     * platform adds first-class support.
+     */
+    deleteUser(...args: Parameters<BetterAuthClientInstance["deleteUser"]>): ReturnType<BetterAuthClientInstance["deleteUser"]>;
+};

package/dist/auth-ui/ManagedAuthUI.d.ts

@@ -0,0 +1,105 @@
+import { BetterAuthClientInstance } from '../auth/types';
+import { NormalizedAuthUIConfig } from './config';
+import { AuthUIModuleRuntimeOptions } from './mount';
+import { MountAuthUIOptions, MountedAuthUI } from './types';
+/**
+ * Internal managed auth UI implementation.
+ *
+ * The public API only exposes `authUI.mount(...)`; this class owns the DOM,
+ * form flows, and lifecycle.
+ *
+ * DOM ownership: the instance owns a single root element it appends to the
+ * mount container. It never writes to `container.innerHTML`. This keeps
+ * tear-down safe when the container is a DOM node a reconciling framework
+ * (React/Vue/Solid) reuses across conditional branches — wiping the
+ * container would erase sibling content the framework just rendered.
+ */
+export declare class ManagedAuthUI implements MountedAuthUI {
+    private readonly container;
+    private readonly auth;
+    private readonly options;
+    private readonly loadConfig;
+    private readonly runtimeOptions?;
+    private readonly fieldIdPrefix;
+    private readonly labels;
+    private readonly root;
+    private readonly state;
+    private destroyed;
+    private terminalActionInProgress;
+    private config;
+    private countdownUntil;
+    private countdownTimer;
+    private pendingFocusSnapshot;
+    private focusRestoreTimer;
+    private verificationCompletionAction;
+    constructor(container: HTMLElement, auth: BetterAuthClientInstance, options: MountAuthUIOptions, loadConfig: () => Promise<NormalizedAuthUIConfig>, runtimeOptions?: AuthUIModuleRuntimeOptions | undefined);
+    destroy(): void;
+    private initialize;
+    private redirectAfterManagedReturnLookupFailure;
+    private navigateToRedirect;
+    private readMountSession;
+    private render;
+    private renderLoading;
+    private renderDevModeBanner;
+    private renderStatus;
+    private renderCurrentView;
+    private renderSignInView;
+    private renderSignUpView;
+    private renderVerifyEmailView;
+    private renderForgotPasswordView;
+    private renderResetPasswordView;
+    private renderOAuthProviders;
+    private renderInput;
+    private bindDOM;
+    private switchView;
+    private handleSignIn;
+    private handleEmailOtpSignIn;
+    private sendSignInOtp;
+    private resendSignInCode;
+    private handleSignUp;
+    private handleOAuthSignIn;
+    private handleForgotPassword;
+    private resendResetCode;
+    private handleResetPassword;
+    private resendVerificationEmail;
+    /**
+     * Drive the local-dev auto-verify endpoint and, on success, complete the
+     * auth flow. Returns whether auto-verify completed — callers decide what
+     * to do on `false` (sign-up falls through to a retry UI; resend throws).
+     */
+    private tryDevAutoVerify;
+    private sendVerificationEmail;
+    private completeAuth;
+    private retryAuthCompletionDataIfNeeded;
+    private syncPublicSessionBestEffort;
+    private resolveAuthCompletionData;
+    private completePasswordReset;
+    private handleExistingSessionOnMount;
+    private runAction;
+    private maybeHandleVerificationRequired;
+    private handleVerificationEmailSent;
+    private invokeRedirectModeSuccessHook;
+    private handleError;
+    private failValidation;
+    private getManagedReturnURL;
+    private consumeManagedReturnContext;
+    private startCountdown;
+    private updateCountdownControls;
+    private clearCountdown;
+    private captureFocusSnapshot;
+    private scheduleFocusRestore;
+    private clearFocusRestoreTimer;
+    private passwordResetEndpoints;
+    private emailOtpSignInEndpoints;
+    private resolveInitialSignInMethod;
+    private setSignInMethod;
+    private canUseEmailOtpSignIn;
+    private extractRedirectURL;
+    private extractUser;
+    private canUsePasswordResetEmailOtp;
+    private handleSessionlessManagedReturn;
+    private isCountdownActive;
+    private getCountdownSecondsRemaining;
+    private countdownText;
+    private escape;
+}

package/dist/auth-ui/appearance.d.ts

@@ -0,0 +1,64 @@
+export declare const AUTH_UI_THEME: {
+    readonly LIGHT: "light";
+    readonly DARK: "dark";
+};
+export declare const AUTH_UI_THEME_LIGHT: "light";
+export declare const AUTH_UI_THEME_DARK: "dark";
+export declare const AUTH_UI_THEMES: readonly ["light", "dark"];
+export declare const AUTH_UI_DEFAULT_THEME: "light";
+export type AuthUITheme = (typeof AUTH_UI_THEME)[keyof typeof AUTH_UI_THEME];
+export declare const AUTH_UI_APPEARANCE_VARIABLE: {
+    readonly BACKGROUND: "--edgespark-auth-bg";
+    readonly BACKGROUND_MUTED: "--edgespark-auth-bg-muted";
+    readonly CARD_BACKGROUND: "--edgespark-auth-card-bg";
+    readonly BORDER: "--edgespark-auth-border";
+    readonly TEXT: "--edgespark-auth-text";
+    readonly TEXT_MUTED: "--edgespark-auth-text-muted";
+    readonly DIVIDER_BACKGROUND: "--edgespark-auth-divider-bg";
+    readonly PRIMARY: "--edgespark-auth-primary";
+    readonly PRIMARY_HOVER: "--edgespark-auth-primary-hover";
+    readonly PRIMARY_CONTRAST: "--edgespark-auth-primary-contrast";
+    readonly ERROR: "--edgespark-auth-error";
+    readonly INFO: "--edgespark-auth-info";
+    readonly CARD_RADIUS: "--edgespark-auth-radius-card";
+    readonly CONTROL_RADIUS: "--edgespark-auth-radius-control";
+    readonly SHADOW: "--edgespark-auth-shadow";
+    readonly FONT: "--edgespark-auth-font";
+    readonly MODAL_BACKDROP: "--edgespark-auth-modal-backdrop";
+    readonly MODAL_CARD_BACKGROUND: "--edgespark-auth-modal-card-bg";
+    readonly MODAL_SHADOW: "--edgespark-auth-modal-shadow";
+};
+export type AuthUIAppearanceVariableName = (typeof AUTH_UI_APPEARANCE_VARIABLE)[keyof typeof AUTH_UI_APPEARANCE_VARIABLE];
+export declare const AUTH_UI_APPEARANCE_VARIABLE_NAMES: readonly AuthUIAppearanceVariableName[];
+export type AuthUIAppearanceVariables = Partial<Record<AuthUIAppearanceVariableName, string>>;
+export interface AuthUIAppearance {
+    /**
+     * Built-in visual preset for the managed auth UI root.
+     *
+     * Defaults to `"light"` when omitted. Variable overrides apply on top of the
+     * selected preset instead of replacing the entire theme contract.
+     */
+    theme?: AuthUITheme;
+    /**
+     * Optional class applied to the managed auth UI root container.
+     *
+     * Use this to scope additional app-level CSS around the stable root element.
+     */
+    className?: string;
+    /**
+     * Stable CSS custom properties supported by the managed auth UI.
+     *
+     * This is the supported appearance contract for light-touch theming. When a
+     * variable is omitted, the current theme preset keeps its default value.
+     */
+    variables?: AuthUIAppearanceVariables;
+}
+interface NormalizedAuthUIAppearance {
+    theme: AuthUITheme;
+    className: string;
+    variables: AuthUIAppearanceVariables;
+}
+export declare function isAuthUITheme(value: unknown): value is AuthUITheme;
+export declare function isAuthUIAppearanceVariableName(value: string): value is AuthUIAppearanceVariableName;
+export declare function normalizeAuthUIAppearance(appearance?: AuthUIAppearance): NormalizedAuthUIAppearance;
+export {};

package/dist/auth-ui/config.d.ts

@@ -0,0 +1,54 @@
+export type OAuthProviderId = "google" | "apple" | "microsoft" | "github" | "gitlab" | "discord";
+interface OAuthProviderConfig {
+    /**
+     * OAuth Client ID resolved server-side. Present only when both the Client
+     * ID var and the corresponding secret resolve, so a non-empty value is
+     * the "this provider is fully wired browser-side" signal.
+     */
+    clientId?: string;
+}
+interface OAuthProviderBlock {
+    enabled?: boolean;
+    config?: OAuthProviderConfig;
+}
+interface ProviderEmailPassword {
+    enabled?: boolean;
+    config?: {
+        minPasswordLength?: number;
+        requireEmailVerification?: boolean;
+        requirePasswordResetEmailVerification?: boolean;
+    };
+}
+interface ProviderEmailOtp {
+    enabled?: boolean;
+}
+interface AuthConfigResponse {
+    disableSignUp?: boolean;
+    providerEmailPassword?: ProviderEmailPassword;
+    providerEmailOtp?: ProviderEmailOtp;
+    providerGoogle?: OAuthProviderBlock;
+    providerApple?: OAuthProviderBlock;
+    providerMicrosoft?: OAuthProviderBlock;
+    providerGithub?: OAuthProviderBlock;
+    providerGitlab?: OAuthProviderBlock;
+    providerDiscord?: OAuthProviderBlock;
+}
+export interface NormalizedAuthUIConfig {
+    disableSignUp: boolean;
+    emailPasswordEnabled: boolean;
+    emailOtpSignInEnabled: boolean;
+    minPasswordLength: number;
+    requireEmailVerification: boolean;
+    passwordResetEmailOtpEnabled: boolean;
+    oauthProviders: OAuthProviderId[];
+    /**
+     * Resolved Google OAuth Client ID when Google is enabled and both
+     * credentials resolved server-side; `null` otherwise. Signals that
+     * Google client-side wiring is ready.
+     */
+    googleClientId: string | null;
+    isLocalDev: boolean;
+}
+export declare function loadNormalizedAuthUIConfig(): Promise<NormalizedAuthUIConfig>;
+export declare function normalizeAuthUIConfig(config: AuthConfigResponse, isLocalDev?: boolean): NormalizedAuthUIConfig;
+export {};

package/dist/auth-ui/default-labels.d.ts

@@ -0,0 +1,2 @@
+import { AuthUILabelOverrides, AuthUILabels } from './types';
+export declare function mergeAuthUILabels(base: AuthUILabels, overrides?: AuthUILabelOverrides): AuthUILabels;

package/dist/auth-ui/google-one-tap.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Minimal helpers for driving Google Identity Services (One Tap) from the
+ * managed auth UI. Loads the GIS client script on demand and exposes a tiny
+ * typed surface around the global `google.accounts.id` namespace.
+ *
+ * GIS is treated as a UX enhancement: any load failure falls back silently
+ * to the regular "Continue with Google" OAuth button.
+ */
+interface GsiCredentialResponse {
+    credential: string;
+    select_by?: string;
+}
+interface GsiInitializeOptions {
+    client_id: string;
+    callback: (response: GsiCredentialResponse) => void;
+    auto_select?: boolean;
+    cancel_on_tap_outside?: boolean;
+    use_fedcm_for_prompt?: boolean;
+    context?: "signin" | "signup" | "use";
+}
+/**
+ * Subset of Google's `PromptMomentNotification`. Methods are optional because
+ * GIS's FedCM-era roadmap retires some of them, and EdgeSpark does not depend
+ * on `@types/google.accounts` for the full type surface.
+ */
+interface GsiPromptNotification {
+    isNotDisplayed?: () => boolean;
+    isSkippedMoment?: () => boolean;
+    isDismissedMoment?: () => boolean;
+    getDismissedReason?: () => string | undefined;
+}
+interface GsiIdAccounts {
+    initialize(options: GsiInitializeOptions): void;
+    prompt(notificationCallback?: (notification: GsiPromptNotification) => void): void;
+    cancel(): void;
+    disableAutoSelect(): void;
+}
+/**
+ * Loads `accounts.google.com/gsi/client` once per page and resolves with
+ * the `google.accounts.id` namespace. Subsequent calls return the same
+ * promise; load failures reject and reset so a caller can retry next mount.
+ */
+export declare function loadGoogleIdentityServices(): Promise<GsiIdAccounts>;
+export type GoogleIdentityServices = GsiIdAccounts;
+export type GoogleCredentialResponse = GsiCredentialResponse;
+export type GooglePromptNotification = GsiPromptNotification;
+export {};

package/dist/auth-ui/index.d.ts

@@ -0,0 +1,4 @@
+export { createAuthUIModule } from './mount';
+export { AUTH_UI_APPEARANCE_VARIABLE, AUTH_UI_APPEARANCE_VARIABLE_NAMES, AUTH_UI_THEME, AUTH_UI_DEFAULT_THEME, AUTH_UI_THEME_DARK, AUTH_UI_THEME_LIGHT, AUTH_UI_THEMES, } from './appearance';
+export type { AuthUIAppearance, AuthUIAppearanceVariableName, AuthUIAppearanceVariables, AuthUITheme, } from './appearance';
+export type { AuthenticatedAuthSuccessEvent, AuthSuccessEvent, AuthUILabelOverrides, AuthUILabels, ControlledAuthUIOptions, EdgeSparkAuthUI, MountAuthUIOptions, MountedAuthUI, OneTapPromptHandle, PromptGoogleOneTapOptions, RedirectAuthUIOptions, } from './types';

package/dist/auth-ui/mount.d.ts

@@ -0,0 +1,22 @@
+import { BetterAuthClientInstance } from '../auth/types';
+import { EdgeSparkAuthUI } from './types';
+/**
+ * Internal runtime config for the auth-UI module factory. Threads cross-cutting
+ * auth wiring into `ManagedAuthUI` (modal/redirect flows) and
+ * `promptGoogleOneTap` (page-load One Tap prompt).
+ */
+export interface AuthUIModuleRuntimeOptions {
+    /**
+     * Best-effort hook to nudge the public auth session after the managed UI
+     * completes a sign-in. Used by `ManagedAuthUI`'s email and OAuth flows.
+     */
+    syncPublicSession?: () => Promise<void> | void;
+    /**
+     * The public auth client used by `promptGoogleOneTap` for credential
+     * exchange. Routing One Tap through the same client as `signIn`/`signUp`
+     * keeps session updates and `onSessionChange` consistent across all
+     * sign-in methods.
+     */
+    publicAuthClient: BetterAuthClientInstance;
+}
+export declare function createAuthUIModule(auth: BetterAuthClientInstance, runtimeOptions: AuthUIModuleRuntimeOptions): EdgeSparkAuthUI;

package/dist/auth-ui/prompt-google-one-tap.d.ts

@@ -0,0 +1,43 @@
+import { BetterAuthClientInstance } from '../auth/types';
+import { EdgeSparkAuthError } from '../errors';
+import { NormalizedAuthUIConfig } from './config';
+import { AuthenticatedAuthSuccessEvent } from './types';
+export interface PromptGoogleOneTapOptions {
+    /**
+     * Fires when Google One Tap sign-in completes.
+     *
+     * **Most apps should prefer `client.auth.onSessionChange`** as the single
+     * source of truth — it fires for One Tap, modal sign-in, sign-out, and
+     * cross-tab session changes. Use `onSuccess` only for flow-local concerns
+     * scoped to this specific prompt (e.g., per-flow analytics).
+     */
+    onSuccess?: (event: AuthenticatedAuthSuccessEvent) => void;
+    /**
+     * Fires on credential-exchange or post-sign-in errors.
+     */
+    onError?: (error: EdgeSparkAuthError) => void;
+    /**
+     * Fires when Google declines to display the prompt — e.g., FedCM cooldown,
+     * no eligible accounts, or browser permission denied. Use this to render a
+     * fallback "Sign in with Google" button.
+     */
+    onUnavailable?: () => void;
+}
+export interface OneTapPromptHandle {
+    /**
+     * Dismiss the prompt and suppress any pending callbacks. Idempotent and
+     * safe to call after the prompt has already closed.
+     */
+    cancel(): void;
+}
+interface PromptRuntime {
+    /**
+     * The wrapped public auth client. Calls flow through its path-proxy so
+     * `oneTap.callback` triggers the same session-atom refresh and
+     * `onSessionChange` emit as `signIn`/`signUp`.
+     */
+    authClient: BetterAuthClientInstance;
+    loadConfig: () => Promise<NormalizedAuthUIConfig>;
+}
+export declare function createPromptGoogleOneTap(runtime: PromptRuntime): (options?: PromptGoogleOneTapOptions) => OneTapPromptHandle;
+export {};

package/dist/auth-ui/runtime.d.ts

@@ -0,0 +1,7 @@
+import { AuthSession, AuthUser, BetterAuthClientInstance } from '../auth/types';
+import { EdgeSparkAuthError } from '../errors';
+export declare function normalizeAuthError(error: unknown, fallbackMessage?: string): EdgeSparkAuthError;
+export declare function readCurrentSession(auth: BetterAuthClientInstance): Promise<{
+    user: AuthUser | null;
+    session: AuthSession | null;
+}>;

package/dist/auth-ui/types.d.ts

@@ -0,0 +1,187 @@
+import { AuthSession, AuthUser } from '../auth/types';
+import { EdgeSparkAuthError } from '../errors';
+import { RedirectTarget } from '../redirect';
+import { DeepPartial } from '../shared/types';
+import { AuthUIAppearance } from './appearance';
+import { OneTapPromptHandle, PromptGoogleOneTapOptions } from './prompt-google-one-tap';
+export type { OneTapPromptHandle, PromptGoogleOneTapOptions } from './prompt-google-one-tap';
+/** Sign-in or sign-up completed with an authenticated session. */
+export type AuthenticatedAuthSuccessEvent = {
+    action: "sign-in";
+    user: AuthUser;
+    session: AuthSession;
+} | {
+    action: "sign-up";
+    user: AuthUser;
+    session: AuthSession;
+};
+/** Password was reset. No session — the user must sign in again. */
+export interface PasswordResetSuccessEvent {
+    action: "password-reset";
+    user: null;
+    session: null;
+}
+/**
+ * Payload emitted by `onSuccess` after a managed auth flow completes.
+ *
+ * Switch on `event.action` to narrow `user` and `session`:
+ * - `"sign-in"` / `"sign-up"` → `user: AuthUser`, `session: AuthSession`
+ * - `"password-reset"` → `user: null`, `session: null`
+ */
+export type AuthSuccessEvent = AuthenticatedAuthSuccessEvent | PasswordResetSuccessEvent;
+export interface AuthUILabels {
+    common: {
+        loading: string;
+        redirecting: string;
+        backToSignIn: string;
+    };
+    signIn: {
+        title: string;
+        subtitle: string;
+        emailLabel: string;
+        emailPlaceholder?: string;
+        codePlaceholder?: string;
+        sendingCode?: string;
+        signingIn?: string;
+        passwordLabel: string;
+        codeLabel?: string;
+        submitButton: string;
+        sendCodeButton?: string;
+        verifyCodeButton?: string;
+        resendCodeButton?: string;
+        resendCountdown?: string;
+        passwordTab?: string;
+        codeTab?: string;
+        forgotPassword: string;
+        switchToSignUp: string;
+        signUpPrompt: string;
+    };
+    signUp: {
+        title: string;
+        subtitle: string;
+        nameLabel: string;
+        emailLabel: string;
+        passwordLabel: string;
+        confirmPasswordLabel: string;
+        submitButton: string;
+        switchToSignIn: string;
+        signInPrompt: string;
+    };
+    verifyEmail: {
+        title: string;
+        subtitle: string;
+        sentToLabel: string;
+        resendButton: string;
+        resendCountdown: string;
+        changeEmailButton: string;
+    };
+    forgotPassword: {
+        title: string;
+        subtitle: string;
+        emailLabel: string;
+        submitButton: string;
+    };
+    resetPassword: {
+        title: string;
+        subtitle: string;
+        codeLabel: string;
+        newPasswordLabel: string;
+        confirmPasswordLabel: string;
+        submitButton: string;
+        resendCodeButton: string;
+        resendCountdown: string;
+    };
+    oauth: {
+        dividerText: string;
+        continueWith: string;
+        /** Use {provider} for the provider display name. */
+        redirecting?: string;
+    };
+    errors: {
+        invalidEmail: string;
+        requiredField: string;
+        passwordTooShort: string;
+        passwordMismatch: string;
+        invalidCode: string;
+        generic: string;
+    };
+}
+export type AuthUILabelOverrides = DeepPartial<AuthUILabels>;
+interface BaseAuthUIOptions {
+    onError?: (error: EdgeSparkAuthError) => void;
+    labels?: AuthUILabelOverrides;
+    /**
+     * Optional, constrained visual customization for the managed auth UI.
+     *
+     * This is intentionally smaller than the headless auth path. Use
+     * `client.auth` when the app needs full UI ownership.
+     */
+    appearance?: AuthUIAppearance;
+}
+/**
+ * Redirect mode — use when the auth UI is a full-page login gate.
+ *
+ * After successful auth the SDK navigates to `redirectTo` automatically.
+ * This is the common case: dedicated `/login` page → redirect to `/dashboard`.
+ *
+ * `onSuccess` is optional and fires *before* the redirect (useful for analytics).
+ */
+export interface RedirectAuthUIOptions extends BaseAuthUIOptions {
+    redirectTo: RedirectTarget;
+    onSuccess?: (event: AuthSuccessEvent) => void;
+}
+/**
+ * Controlled mode — use when the app owns what happens after auth.
+ *
+ * The SDK will not navigate. Instead, `onSuccess` fires with the auth event
+ * and the app decides the next step (close a modal, update state, navigate
+ * programmatically via a router, etc.).
+ *
+ * Use this for: modals, embedded auth widgets, SPA routing, onboarding flows.
+ */
+export interface ControlledAuthUIOptions extends BaseAuthUIOptions {
+    onSuccess: (event: AuthSuccessEvent) => void;
+    redirectTo?: never;
+}
+/**
+ * Two post-auth strategies — pick one:
+ *
+ * - **Redirect mode** (`{ redirectTo }`) — SDK navigates after auth.
+ *   Best for dedicated login pages.
+ *
+ * - **Controlled mode** (`{ onSuccess }`) — app handles post-auth behavior.
+ *   Best for modals, embedded widgets, or SPA routing.
+ */
+export type MountAuthUIOptions = RedirectAuthUIOptions | ControlledAuthUIOptions;
+export interface MountedAuthUI {
+    /**
+     * Removes the mounted UI and clears internal timers/listeners.
+     */
+    destroy(): void;
+}
+export interface EdgeSparkAuthUI {
+    /**
+     * Mounts the managed auth UI into a container element.
+     *
+     * Pass `redirectTo` for the common login-page case, or `onSuccess` when the
+     * surrounding app wants to control routing/state after auth completes.
+     */
+    mount(container: HTMLElement, options: MountAuthUIOptions): MountedAuthUI;
+    /**
+     * Triggers a Google One Tap prompt. Calling the function is the opt-in —
+     * there is no separate server config or option flag.
+     *
+     * The prompt shows only when Google is fully wired server-side (the
+     * project's `auth-config.yaml` enables Google with resolvable credentials).
+     * Otherwise the call logs a clear error to the console and returns an
+     * inert handle.
+     *
+     * @example
+     * useEffect(() => {
+     *   if (session) return;
+     *   const prompt = client.authUI.promptGoogleOneTap();
+     *   return () => prompt.cancel();
+     * }, [session]);
+     */
+    promptGoogleOneTap(options?: PromptGoogleOneTapOptions): OneTapPromptHandle;
+}

package/dist/browser.d.ts

@@ -0,0 +1,2 @@
+export declare function assertBrowserRuntime(): void;
+export declare function getBrowserOrigin(): string;