@edgespark/web 0.0.3 → 0.0.5

package/auth/styles/styles.css

@@ -96,6 +96,40 @@
   gap: 8px;
 }
 
+.edgespark-auth__tabs {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 4px;
+  min-height: 44px;
+  padding: 4px;
+  border: 1px solid var(--edgespark-auth-border);
+  border-radius: var(--edgespark-auth-radius-control);
+  background: var(--edgespark-auth-bg-muted);
+}
+
+.edgespark-auth__tab {
+  min-width: 0;
+  border: 0;
+  border-radius: calc(var(--edgespark-auth-radius-control) - 4px);
+  background: transparent;
+  color: var(--edgespark-auth-text-muted);
+  cursor: pointer;
+  font: inherit;
+  font-size: 0.92rem;
+  font-weight: 600;
+}
+
+.edgespark-auth__tab--active {
+  background: var(--edgespark-auth-bg);
+  color: var(--edgespark-auth-text);
+  box-shadow: 0 1px 2px rgba(15, 23, 42, 0.08);
+}
+
+.edgespark-auth__tab:disabled {
+  cursor: not-allowed;
+  opacity: 0.6;
+}
+
 .edgespark-auth__label {
   font-size: 0.9rem;
   font-weight: 600;
@@ -119,7 +153,8 @@
 }
 
 .edgespark-auth__button,
-.edgespark-auth__link {
+.edgespark-auth__link,
+.edgespark-auth__text-action {
   font: inherit;
 }
 
@@ -136,7 +171,8 @@
 }
 
 .edgespark-auth__button:disabled,
-.edgespark-auth__link:disabled {
+.edgespark-auth__link:disabled,
+.edgespark-auth__text-action:disabled {
   cursor: not-allowed;
   opacity: 0.6;
 }
@@ -174,6 +210,27 @@
   cursor: pointer;
 }
 
+.edgespark-auth__text-action {
+  justify-self: center;
+  padding: 2px 4px;
+  border: 0;
+  background: transparent;
+  color: var(--edgespark-auth-primary);
+  cursor: pointer;
+  font-size: 0.95rem;
+  font-weight: 600;
+  line-height: 1.4;
+}
+
+.edgespark-auth__text-action:hover:not(:disabled) {
+  color: var(--edgespark-auth-primary-hover);
+}
+
+.edgespark-auth__text-action:disabled {
+  color: var(--edgespark-auth-text-muted);
+  opacity: 1;
+}
+
 .edgespark-auth__divider {
   position: relative;
   text-align: center;

package/dist/auth/local-dev.d.ts

@@ -29,3 +29,8 @@ export declare function autoVerifyLocalDev(email: string): Promise<boolean>;
  * Returns the OTP string or null if not available.
  */
 export declare function fetchOtpLocalDev(email: string): Promise<string | null>;
+/**
+ * Fetch the pending OTP for email sign-in in local dev.
+ * Returns the OTP string or null if not available.
+ */
+export declare function fetchSignInOtpLocalDev(email: string): Promise<string | null>;

package/dist/auth-ui/ManagedAuthUI.d.ts

@@ -1,14 +1,18 @@
 import { BetterAuthClientInstance } from '../auth/types';
 import { NormalizedAuthUIConfig } from './config';
+import { AuthUIModuleRuntimeOptions } from './mount';
 import { MountAuthUIOptions, MountedAuthUI } from './types';
-export interface ManagedAuthUIRuntimeOptions {
-    syncPublicSession?: () => Promise<void> | void;
-}
 /**
  * Internal managed auth UI implementation.
  *
  * The public API only exposes `authUI.mount(...)`; this class owns the DOM,
  * form flows, and lifecycle.
+ *
+ * DOM ownership: the instance owns a single root element it appends to the
+ * mount container. It never writes to `container.innerHTML`. This keeps
+ * tear-down safe when the container is a DOM node a reconciling framework
+ * (React/Vue/Solid) reuses across conditional branches — wiping the
+ * container would erase sibling content the framework just rendered.
  */
 export declare class ManagedAuthUI implements MountedAuthUI {
     private readonly container;
@@ -27,7 +31,7 @@ export declare class ManagedAuthUI implements MountedAuthUI {
     private pendingFocusSnapshot;
     private focusRestoreTimer;
     private verificationCompletionAction;
-    constructor(container: HTMLElement, auth: BetterAuthClientInstance, options: MountAuthUIOptions, loadConfig: () => Promise<NormalizedAuthUIConfig>, runtimeOptions?: ManagedAuthUIRuntimeOptions | undefined);
+    constructor(container: HTMLElement, auth: BetterAuthClientInstance, options: MountAuthUIOptions, loadConfig: () => Promise<NormalizedAuthUIConfig>, runtimeOptions?: AuthUIModuleRuntimeOptions | undefined);
     destroy(): void;
     private initialize;
     private redirectAfterManagedReturnLookupFailure;
@@ -48,6 +52,9 @@ export declare class ManagedAuthUI implements MountedAuthUI {
     private bindDOM;
     private switchView;
     private handleSignIn;
+    private handleEmailOtpSignIn;
+    private sendSignInOtp;
+    private resendSignInCode;
     private handleSignUp;
     private handleOAuthSignIn;
     private handleForgotPassword;
@@ -81,6 +88,10 @@ export declare class ManagedAuthUI implements MountedAuthUI {
     private scheduleFocusRestore;
     private clearFocusRestoreTimer;
     private passwordResetEndpoints;
+    private emailOtpSignInEndpoints;
+    private resolveInitialSignInMethod;
+    private setSignInMethod;
+    private canUseEmailOtpSignIn;
     private extractRedirectURL;
     private extractUser;
     private canUsePasswordResetEmailOtp;

package/dist/auth-ui/config.d.ts

@@ -1,6 +1,15 @@
 export type OAuthProviderId = "google" | "apple" | "microsoft" | "github" | "gitlab" | "discord";
+interface OAuthProviderConfig {
+    /**
+     * OAuth Client ID resolved server-side. Present only when both the Client
+     * ID var and the corresponding secret resolve, so a non-empty value is
+     * the "this provider is fully wired browser-side" signal.
+     */
+    clientId?: string;
+}
 interface OAuthProviderBlock {
     enabled?: boolean;
+    config?: OAuthProviderConfig;
 }
 interface ProviderEmailPassword {
     enabled?: boolean;
@@ -10,9 +19,13 @@ interface ProviderEmailPassword {
         requirePasswordResetEmailVerification?: boolean;
     };
 }
+interface ProviderEmailOtp {
+    enabled?: boolean;
+}
 interface AuthConfigResponse {
     disableSignUp?: boolean;
     providerEmailPassword?: ProviderEmailPassword;
+    providerEmailOtp?: ProviderEmailOtp;
     providerGoogle?: OAuthProviderBlock;
     providerApple?: OAuthProviderBlock;
     providerMicrosoft?: OAuthProviderBlock;
@@ -23,10 +36,17 @@ interface AuthConfigResponse {
 export interface NormalizedAuthUIConfig {
     disableSignUp: boolean;
     emailPasswordEnabled: boolean;
+    emailOtpSignInEnabled: boolean;
     minPasswordLength: number;
     requireEmailVerification: boolean;
     passwordResetEmailOtpEnabled: boolean;
     oauthProviders: OAuthProviderId[];
+    /**
+     * Resolved Google OAuth Client ID when Google is enabled and both
+     * credentials resolved server-side; `null` otherwise. Signals that
+     * Google client-side wiring is ready.
+     */
+    googleClientId: string | null;
     isLocalDev: boolean;
 }
 export declare function loadNormalizedAuthUIConfig(): Promise<NormalizedAuthUIConfig>;

package/dist/auth-ui/google-one-tap.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Minimal helpers for driving Google Identity Services (One Tap) from the
+ * managed auth UI. Loads the GIS client script on demand and exposes a tiny
+ * typed surface around the global `google.accounts.id` namespace.
+ *
+ * GIS is treated as a UX enhancement: any load failure falls back silently
+ * to the regular "Continue with Google" OAuth button.
+ */
+interface GsiCredentialResponse {
+    credential: string;
+    select_by?: string;
+}
+interface GsiInitializeOptions {
+    client_id: string;
+    callback: (response: GsiCredentialResponse) => void;
+    auto_select?: boolean;
+    cancel_on_tap_outside?: boolean;
+    use_fedcm_for_prompt?: boolean;
+    context?: "signin" | "signup" | "use";
+}
+/**
+ * Subset of Google's `PromptMomentNotification`. Methods are optional because
+ * GIS's FedCM-era roadmap retires some of them, and EdgeSpark does not depend
+ * on `@types/google.accounts` for the full type surface.
+ */
+interface GsiPromptNotification {
+    isNotDisplayed?: () => boolean;
+    isSkippedMoment?: () => boolean;
+    isDismissedMoment?: () => boolean;
+    getDismissedReason?: () => string | undefined;
+}
+interface GsiIdAccounts {
+    initialize(options: GsiInitializeOptions): void;
+    prompt(notificationCallback?: (notification: GsiPromptNotification) => void): void;
+    cancel(): void;
+    disableAutoSelect(): void;
+}
+/**
+ * Loads `accounts.google.com/gsi/client` once per page and resolves with
+ * the `google.accounts.id` namespace. Subsequent calls return the same
+ * promise; load failures reject and reset so a caller can retry next mount.
+ */
+export declare function loadGoogleIdentityServices(): Promise<GsiIdAccounts>;
+export type GoogleIdentityServices = GsiIdAccounts;
+export type GoogleCredentialResponse = GsiCredentialResponse;
+export type GooglePromptNotification = GsiPromptNotification;
+export {};

package/dist/auth-ui/index.d.ts

@@ -1,4 +1,4 @@
 export { createAuthUIModule } from './mount';
 export { AUTH_UI_APPEARANCE_VARIABLE, AUTH_UI_APPEARANCE_VARIABLE_NAMES, AUTH_UI_THEME, AUTH_UI_DEFAULT_THEME, AUTH_UI_THEME_DARK, AUTH_UI_THEME_LIGHT, AUTH_UI_THEMES, } from './appearance';
 export type { AuthUIAppearance, AuthUIAppearanceVariableName, AuthUIAppearanceVariables, AuthUITheme, } from './appearance';
-export type { AuthSuccessEvent, AuthUILabelOverrides, AuthUILabels, ControlledAuthUIOptions, EdgeSparkAuthUI, MountAuthUIOptions, MountedAuthUI, RedirectAuthUIOptions, } from './types';
+export type { AuthenticatedAuthSuccessEvent, AuthSuccessEvent, AuthUILabelOverrides, AuthUILabels, ControlledAuthUIOptions, EdgeSparkAuthUI, MountAuthUIOptions, MountedAuthUI, OneTapPromptHandle, PromptGoogleOneTapOptions, RedirectAuthUIOptions, } from './types';

package/dist/auth-ui/mount.d.ts

@@ -1,4 +1,22 @@
 import { BetterAuthClientInstance } from '../auth/types';
-import { ManagedAuthUIRuntimeOptions } from './ManagedAuthUI';
 import { EdgeSparkAuthUI } from './types';
-export declare function createAuthUIModule(auth: BetterAuthClientInstance, runtimeOptions?: ManagedAuthUIRuntimeOptions): EdgeSparkAuthUI;
+/**
+ * Internal runtime config for the auth-UI module factory. Threads cross-cutting
+ * auth wiring into `ManagedAuthUI` (modal/redirect flows) and
+ * `promptGoogleOneTap` (page-load One Tap prompt).
+ */
+export interface AuthUIModuleRuntimeOptions {
+    /**
+     * Best-effort hook to nudge the public auth session after the managed UI
+     * completes a sign-in. Used by `ManagedAuthUI`'s email and OAuth flows.
+     */
+    syncPublicSession?: () => Promise<void> | void;
+    /**
+     * The public auth client used by `promptGoogleOneTap` for credential
+     * exchange. Routing One Tap through the same client as `signIn`/`signUp`
+     * keeps session updates and `onSessionChange` consistent across all
+     * sign-in methods.
+     */
+    publicAuthClient: BetterAuthClientInstance;
+}
+export declare function createAuthUIModule(auth: BetterAuthClientInstance, runtimeOptions: AuthUIModuleRuntimeOptions): EdgeSparkAuthUI;

package/dist/auth-ui/prompt-google-one-tap.d.ts

@@ -0,0 +1,43 @@
+import { BetterAuthClientInstance } from '../auth/types';
+import { EdgeSparkAuthError } from '../errors';
+import { NormalizedAuthUIConfig } from './config';
+import { AuthenticatedAuthSuccessEvent } from './types';
+export interface PromptGoogleOneTapOptions {
+    /**
+     * Fires when Google One Tap sign-in completes.
+     *
+     * **Most apps should prefer `client.auth.onSessionChange`** as the single
+     * source of truth — it fires for One Tap, modal sign-in, sign-out, and
+     * cross-tab session changes. Use `onSuccess` only for flow-local concerns
+     * scoped to this specific prompt (e.g., per-flow analytics).
+     */
+    onSuccess?: (event: AuthenticatedAuthSuccessEvent) => void;
+    /**
+     * Fires on credential-exchange or post-sign-in errors.
+     */
+    onError?: (error: EdgeSparkAuthError) => void;
+    /**
+     * Fires when Google declines to display the prompt — e.g., FedCM cooldown,
+     * no eligible accounts, or browser permission denied. Use this to render a
+     * fallback "Sign in with Google" button.
+     */
+    onUnavailable?: () => void;
+}
+export interface OneTapPromptHandle {
+    /**
+     * Dismiss the prompt and suppress any pending callbacks. Idempotent and
+     * safe to call after the prompt has already closed.
+     */
+    cancel(): void;
+}
+interface PromptRuntime {
+    /**
+     * The wrapped public auth client. Calls flow through its path-proxy so
+     * `oneTap.callback` triggers the same session-atom refresh and
+     * `onSessionChange` emit as `signIn`/`signUp`.
+     */
+    authClient: BetterAuthClientInstance;
+    loadConfig: () => Promise<NormalizedAuthUIConfig>;
+}
+export declare function createPromptGoogleOneTap(runtime: PromptRuntime): (options?: PromptGoogleOneTapOptions) => OneTapPromptHandle;
+export {};

package/dist/auth-ui/types.d.ts

@@ -3,6 +3,8 @@ import { EdgeSparkAuthError } from '../errors';
 import { RedirectTarget } from '../redirect';
 import { DeepPartial } from '../shared/types';
 import { AuthUIAppearance } from './appearance';
+import { OneTapPromptHandle, PromptGoogleOneTapOptions } from './prompt-google-one-tap';
+export type { OneTapPromptHandle, PromptGoogleOneTapOptions } from './prompt-google-one-tap';
 /** Sign-in or sign-up completed with an authenticated session. */
 export type AuthenticatedAuthSuccessEvent = {
     action: "sign-in";
@@ -38,7 +40,14 @@ export interface AuthUILabels {
         subtitle: string;
         emailLabel: string;
         passwordLabel: string;
+        codeLabel?: string;
         submitButton: string;
+        sendCodeButton?: string;
+        verifyCodeButton?: string;
+        resendCodeButton?: string;
+        resendCountdown?: string;
+        passwordTab?: string;
+        codeTab?: string;
         forgotPassword: string;
         switchToSignUp: string;
         signUpPrompt: string;
@@ -152,5 +161,21 @@ export interface EdgeSparkAuthUI {
      * surrounding app wants to control routing/state after auth completes.
      */
     mount(container: HTMLElement, options: MountAuthUIOptions): MountedAuthUI;
+    /**
+     * Triggers a Google One Tap prompt. Calling the function is the opt-in —
+     * there is no separate server config or option flag.
+     *
+     * The prompt shows only when Google is fully wired server-side (the
+     * project's `auth-config.yaml` enables Google with resolvable credentials).
+     * Otherwise the call logs a clear error to the console and returns an
+     * inert handle.
+     *
+     * @example
+     * useEffect(() => {
+     *   if (session) return;
+     *   const prompt = client.authUI.promptGoogleOneTap();
+     *   return () => prompt.cancel();
+     * }, [session]);
+     */
+    promptGoogleOneTap(options?: PromptGoogleOneTapOptions): OneTapPromptHandle;
 }
-export {};