@edgespark/web 0.0.2 → 0.0.4

package/auth/styles/styles.css

@@ -258,6 +258,16 @@
   background: var(--edgespark-auth-bg-muted);
 }
 
+.edgespark-auth__dev-banner {
+  background: #fef3c7;
+  color: #92400e;
+  padding: 0.5rem 1rem;
+  border-radius: 6px;
+  font-size: 0.8rem;
+  text-align: center;
+  margin-bottom: 0.75rem;
+}
+
 @media (max-width: 480px) {
   .edgespark-auth__card {
     padding: 18px;

package/dist/auth/local-dev.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Is the web app running in local-dev mode?
+ *
+ * Reads a `<meta name="edgespark-local-dev" content="true">` tag that
+ * the `edgespark dev` reverse proxy splices into every HTML response.
+ * The dev proxy only runs under `edgespark dev`; the meta tag is absent
+ * on deployed apps (served through the CF dispatcher, which doesn't
+ * inject).
+ *
+ * Uses a <meta> tag rather than an inline <script> so the signal works
+ * under strict CSP — `script-src 'self'` without `'unsafe-inline'`
+ * would silently drop a script-based marker. Meta tags carry no
+ * script-src constraint.
+ *
+ * No server round-trip, no build-time macro, no hostname heuristic, no
+ * framework assumptions. Survives SDK pre-bundling — the SDK reads the
+ * DOM at call time, not a value captured at build time.
+ */
+export declare function isLocalDev(): boolean;
+/**
+ * Auto-verify email in local dev. The server reads the pending verification
+ * token from D1, drives Better Auth's verify-email handler, and returns with
+ * the session cookie already set. Single round-trip — no token round-trip on
+ * the client.
+ */
+export declare function autoVerifyLocalDev(email: string): Promise<boolean>;
+/**
+ * Fetch the pending OTP for password reset in local dev.
+ * Returns the OTP string or null if not available.
+ */
+export declare function fetchOtpLocalDev(email: string): Promise<string | null>;

package/dist/auth-ui/ManagedAuthUI.d.ts

@@ -1,14 +1,18 @@
 import { BetterAuthClientInstance } from '../auth/types';
 import { NormalizedAuthUIConfig } from './config';
+import { AuthUIModuleRuntimeOptions } from './mount';
 import { MountAuthUIOptions, MountedAuthUI } from './types';
-export interface ManagedAuthUIRuntimeOptions {
-    syncPublicSession?: () => Promise<void> | void;
-}
 /**
  * Internal managed auth UI implementation.
  *
  * The public API only exposes `authUI.mount(...)`; this class owns the DOM,
  * form flows, and lifecycle.
+ *
+ * DOM ownership: the instance owns a single root element it appends to the
+ * mount container. It never writes to `container.innerHTML`. This keeps
+ * tear-down safe when the container is a DOM node a reconciling framework
+ * (React/Vue/Solid) reuses across conditional branches — wiping the
+ * container would erase sibling content the framework just rendered.
  */
 export declare class ManagedAuthUI implements MountedAuthUI {
     private readonly container;
@@ -27,7 +31,7 @@ export declare class ManagedAuthUI implements MountedAuthUI {
     private pendingFocusSnapshot;
     private focusRestoreTimer;
     private verificationCompletionAction;
-    constructor(container: HTMLElement, auth: BetterAuthClientInstance, options: MountAuthUIOptions, loadConfig: () => Promise<NormalizedAuthUIConfig>, runtimeOptions?: ManagedAuthUIRuntimeOptions | undefined);
+    constructor(container: HTMLElement, auth: BetterAuthClientInstance, options: MountAuthUIOptions, loadConfig: () => Promise<NormalizedAuthUIConfig>, runtimeOptions?: AuthUIModuleRuntimeOptions | undefined);
     destroy(): void;
     private initialize;
     private redirectAfterManagedReturnLookupFailure;
@@ -35,6 +39,7 @@ export declare class ManagedAuthUI implements MountedAuthUI {
     private readMountSession;
     private render;
     private renderLoading;
+    private renderDevModeBanner;
     private renderStatus;
     private renderCurrentView;
     private renderSignInView;
@@ -53,6 +58,12 @@ export declare class ManagedAuthUI implements MountedAuthUI {
     private resendResetCode;
     private handleResetPassword;
     private resendVerificationEmail;
+    /**
+     * Drive the local-dev auto-verify endpoint and, on success, complete the
+     * auth flow. Returns whether auto-verify completed — callers decide what
+     * to do on `false` (sign-up falls through to a retry UI; resend throws).
+     */
+    private tryDevAutoVerify;
     private sendVerificationEmail;
     private completeAuth;
     private retryAuthCompletionDataIfNeeded;

package/dist/auth-ui/config.d.ts

@@ -1,6 +1,15 @@
 export type OAuthProviderId = "google" | "apple" | "microsoft" | "github" | "gitlab" | "discord";
+interface OAuthProviderConfig {
+    /**
+     * OAuth Client ID resolved server-side. Present only when both the Client
+     * ID var and the corresponding secret resolve, so a non-empty value is
+     * the "this provider is fully wired browser-side" signal.
+     */
+    clientId?: string;
+}
 interface OAuthProviderBlock {
     enabled?: boolean;
+    config?: OAuthProviderConfig;
 }
 interface ProviderEmailPassword {
     enabled?: boolean;
@@ -27,7 +36,14 @@ export interface NormalizedAuthUIConfig {
     requireEmailVerification: boolean;
     passwordResetEmailOtpEnabled: boolean;
     oauthProviders: OAuthProviderId[];
+    /**
+     * Resolved Google OAuth Client ID when Google is enabled and both
+     * credentials resolved server-side; `null` otherwise. Signals that
+     * Google client-side wiring is ready.
+     */
+    googleClientId: string | null;
+    isLocalDev: boolean;
 }
 export declare function loadNormalizedAuthUIConfig(): Promise<NormalizedAuthUIConfig>;
-export declare function normalizeAuthUIConfig(config: AuthConfigResponse): NormalizedAuthUIConfig;
+export declare function normalizeAuthUIConfig(config: AuthConfigResponse, isLocalDev?: boolean): NormalizedAuthUIConfig;
 export {};

package/dist/auth-ui/google-one-tap.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Minimal helpers for driving Google Identity Services (One Tap) from the
+ * managed auth UI. Loads the GIS client script on demand and exposes a tiny
+ * typed surface around the global `google.accounts.id` namespace.
+ *
+ * GIS is treated as a UX enhancement: any load failure falls back silently
+ * to the regular "Continue with Google" OAuth button.
+ */
+interface GsiCredentialResponse {
+    credential: string;
+    select_by?: string;
+}
+interface GsiInitializeOptions {
+    client_id: string;
+    callback: (response: GsiCredentialResponse) => void;
+    auto_select?: boolean;
+    cancel_on_tap_outside?: boolean;
+    use_fedcm_for_prompt?: boolean;
+    context?: "signin" | "signup" | "use";
+}
+/**
+ * Subset of Google's `PromptMomentNotification`. Methods are optional because
+ * GIS's FedCM-era roadmap retires some of them, and EdgeSpark does not depend
+ * on `@types/google.accounts` for the full type surface.
+ */
+interface GsiPromptNotification {
+    isNotDisplayed?: () => boolean;
+    isSkippedMoment?: () => boolean;
+    isDismissedMoment?: () => boolean;
+    getDismissedReason?: () => string | undefined;
+}
+interface GsiIdAccounts {
+    initialize(options: GsiInitializeOptions): void;
+    prompt(notificationCallback?: (notification: GsiPromptNotification) => void): void;
+    cancel(): void;
+    disableAutoSelect(): void;
+}
+/**
+ * Loads `accounts.google.com/gsi/client` once per page and resolves with
+ * the `google.accounts.id` namespace. Subsequent calls return the same
+ * promise; load failures reject and reset so a caller can retry next mount.
+ */
+export declare function loadGoogleIdentityServices(): Promise<GsiIdAccounts>;
+export type GoogleIdentityServices = GsiIdAccounts;
+export type GoogleCredentialResponse = GsiCredentialResponse;
+export type GooglePromptNotification = GsiPromptNotification;
+export {};

package/dist/auth-ui/index.d.ts

@@ -1,4 +1,4 @@
 export { createAuthUIModule } from './mount';
 export { AUTH_UI_APPEARANCE_VARIABLE, AUTH_UI_APPEARANCE_VARIABLE_NAMES, AUTH_UI_THEME, AUTH_UI_DEFAULT_THEME, AUTH_UI_THEME_DARK, AUTH_UI_THEME_LIGHT, AUTH_UI_THEMES, } from './appearance';
 export type { AuthUIAppearance, AuthUIAppearanceVariableName, AuthUIAppearanceVariables, AuthUITheme, } from './appearance';
-export type { AuthSuccessEvent, AuthUILabelOverrides, AuthUILabels, ControlledAuthUIOptions, EdgeSparkAuthUI, MountAuthUIOptions, MountedAuthUI, RedirectAuthUIOptions, } from './types';
+export type { AuthenticatedAuthSuccessEvent, AuthSuccessEvent, AuthUILabelOverrides, AuthUILabels, ControlledAuthUIOptions, EdgeSparkAuthUI, MountAuthUIOptions, MountedAuthUI, OneTapPromptHandle, PromptGoogleOneTapOptions, RedirectAuthUIOptions, } from './types';

package/dist/auth-ui/mount.d.ts

@@ -1,4 +1,22 @@
 import { BetterAuthClientInstance } from '../auth/types';
-import { ManagedAuthUIRuntimeOptions } from './ManagedAuthUI';
 import { EdgeSparkAuthUI } from './types';
-export declare function createAuthUIModule(auth: BetterAuthClientInstance, runtimeOptions?: ManagedAuthUIRuntimeOptions): EdgeSparkAuthUI;
+/**
+ * Internal runtime config for the auth-UI module factory. Threads cross-cutting
+ * auth wiring into `ManagedAuthUI` (modal/redirect flows) and
+ * `promptGoogleOneTap` (page-load One Tap prompt).
+ */
+export interface AuthUIModuleRuntimeOptions {
+    /**
+     * Best-effort hook to nudge the public auth session after the managed UI
+     * completes a sign-in. Used by `ManagedAuthUI`'s email and OAuth flows.
+     */
+    syncPublicSession?: () => Promise<void> | void;
+    /**
+     * The public auth client used by `promptGoogleOneTap` for credential
+     * exchange. Routing One Tap through the same client as `signIn`/`signUp`
+     * keeps session updates and `onSessionChange` consistent across all
+     * sign-in methods.
+     */
+    publicAuthClient: BetterAuthClientInstance;
+}
+export declare function createAuthUIModule(auth: BetterAuthClientInstance, runtimeOptions: AuthUIModuleRuntimeOptions): EdgeSparkAuthUI;

package/dist/auth-ui/prompt-google-one-tap.d.ts

@@ -0,0 +1,43 @@
+import { BetterAuthClientInstance } from '../auth/types';
+import { EdgeSparkAuthError } from '../errors';
+import { NormalizedAuthUIConfig } from './config';
+import { AuthenticatedAuthSuccessEvent } from './types';
+export interface PromptGoogleOneTapOptions {
+    /**
+     * Fires when Google One Tap sign-in completes.
+     *
+     * **Most apps should prefer `client.auth.onSessionChange`** as the single
+     * source of truth — it fires for One Tap, modal sign-in, sign-out, and
+     * cross-tab session changes. Use `onSuccess` only for flow-local concerns
+     * scoped to this specific prompt (e.g., per-flow analytics).
+     */
+    onSuccess?: (event: AuthenticatedAuthSuccessEvent) => void;
+    /**
+     * Fires on credential-exchange or post-sign-in errors.
+     */
+    onError?: (error: EdgeSparkAuthError) => void;
+    /**
+     * Fires when Google declines to display the prompt — e.g., FedCM cooldown,
+     * no eligible accounts, or browser permission denied. Use this to render a
+     * fallback "Sign in with Google" button.
+     */
+    onUnavailable?: () => void;
+}
+export interface OneTapPromptHandle {
+    /**
+     * Dismiss the prompt and suppress any pending callbacks. Idempotent and
+     * safe to call after the prompt has already closed.
+     */
+    cancel(): void;
+}
+interface PromptRuntime {
+    /**
+     * The wrapped public auth client. Calls flow through its path-proxy so
+     * `oneTap.callback` triggers the same session-atom refresh and
+     * `onSessionChange` emit as `signIn`/`signUp`.
+     */
+    authClient: BetterAuthClientInstance;
+    loadConfig: () => Promise<NormalizedAuthUIConfig>;
+}
+export declare function createPromptGoogleOneTap(runtime: PromptRuntime): (options?: PromptGoogleOneTapOptions) => OneTapPromptHandle;
+export {};

package/dist/auth-ui/types.d.ts

@@ -3,6 +3,8 @@ import { EdgeSparkAuthError } from '../errors';
 import { RedirectTarget } from '../redirect';
 import { DeepPartial } from '../shared/types';
 import { AuthUIAppearance } from './appearance';
+import { OneTapPromptHandle, PromptGoogleOneTapOptions } from './prompt-google-one-tap';
+export type { OneTapPromptHandle, PromptGoogleOneTapOptions } from './prompt-google-one-tap';
 /** Sign-in or sign-up completed with an authenticated session. */
 export type AuthenticatedAuthSuccessEvent = {
     action: "sign-in";
@@ -152,5 +154,21 @@ export interface EdgeSparkAuthUI {
      * surrounding app wants to control routing/state after auth completes.
      */
     mount(container: HTMLElement, options: MountAuthUIOptions): MountedAuthUI;
+    /**
+     * Triggers a Google One Tap prompt. Calling the function is the opt-in —
+     * there is no separate server config or option flag.
+     *
+     * The prompt shows only when Google is fully wired server-side (the
+     * project's `auth-config.yaml` enables Google with resolvable credentials).
+     * Otherwise the call logs a clear error to the console and returns an
+     * inert handle.
+     *
+     * @example
+     * useEffect(() => {
+     *   if (session) return;
+     *   const prompt = client.authUI.promptGoogleOneTap();
+     *   return () => prompt.cancel();
+     * }, [session]);
+     */
+    promptGoogleOneTap(options?: PromptGoogleOneTapOptions): OneTapPromptHandle;
 }
-export {};