@finueva/auth 0.7.0 → 0.8.0

package/README.md

@@ -16,6 +16,8 @@ const auth = createAuthClient({
   appOrigin: window.location.origin,
 });
 
+if (auth._type !== "browser") throw new Error("Expected a browser Auth client");
+
 const stop = auth.onAuthStateChange((state) => {
   if (state.status === "cached") renderSessionHint(state.session);
   if (state.status === "authenticated") renderVerifiedSession(state.session);
@@ -117,6 +119,7 @@ const auth = createDeviceAuth({
   authOrigin: "https://auth.finueva.com",
   clientId: "finueva-cli",
 });
+if (auth._type !== "device") throw new Error("Expected a device Auth client");
 const authorization = await auth.requestAuthorization();
 showCode(authorization.userCode, authorization.verificationUri);
 const token = await auth.pollForToken(authorization, { signal });
@@ -134,6 +137,8 @@ Polling starts at the server-provided interval, adds five seconds after each RFC
 
 The token is memory-only by default. Secure persistence is opt-in through a structural adapter implementing `read`, atomic `replace`, and `delete`; every operation receives an `AbortSignal`. The SDK serializes polling, account changes, expiry synchronization, and revocation, including persistence calls. Malformed non-null persisted authority is best-effort deleted before hydration fails, allowing a later process to start without the bad value. The caller owns encryption and platform credential storage. Adapter and authority failures are value-free and never include device codes or tokens. This export uses standard expiring/revocable Better Auth sessions and does not implement refresh tokens.
 
+Browser and device clients expose the literal `_type` values `"browser"` and `"device"`. Use that discriminant to narrow a union before invoking runtime-specific methods; do not infer the client type from environment globals.
+
 Direct email and social signup/sign-in are intended for registered first-party mobile or Tauri clients. The SDK verifies the opaque token through bearer `get-session`, derives its expiry from that authoritative session, atomically replaces secure persistence, and only then publishes it in memory. Verification or replacement failure triggers best-effort revocation of the new session and retains the previous token only after current authority verifies it. A successful account switch best-effort revokes the replaced current-device session after publishing the new token. Password replacement follows the same rule; when Better Auth returns no replacement token, the current token is retained only after an authoritative session check. `getSession()` synchronizes changed authoritative expiry back to persistence.
 
 For Tauri, implement `DeviceTokenPersistence` in Rust commands backed by the operating system credential vault (Keychain, Credential Manager, or Secret Service). Store the complete `DeviceToken` as one encrypted/versioned item, make replacement atomic, and restrict access to this application identity. An `AbortSignal` cannot cancel a native `invoke` that has already been dispatched. The SDK retains an internal persistence queue after public timeout, runs compensating deletion after a late replacement, and rejects later authority operations with `state_conflict` until that queue settles. The process can still terminate between a native commit and compensation; production adapters need a native pending-operation journal or equivalent startup cleanup before returning a stored token. This process-crash recovery remains outside SDK qualification. Do not use WebView local storage, a plaintext file, Tauri Store, logs, crash metadata, or frontend state. Drive credentials remain memory-only even when the Better Auth session uses secure OS persistence; the device client keeps only one selected workspace credential and renews it with two minutes remaining. It permits at most one issuance request: an exact same-workspace non-forced call may share that request, while a workspace switch or forced refresh returns `state_conflict` until it settles.

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { C as AuthErrorStatus, S as AuthErrorCode, _ as SocialIdTokenInput, l as DriveCredential, o as AuthSession, u as DriveCredentialInput, v as SocialIdTokenProvider, x as AuthError, y as UpdateProfileInput } from "./types-B1SZbs6Z.js";
+import { C as AuthErrorStatus, S as AuthErrorCode, _ as SocialIdTokenInput, l as DriveCredential, o as AuthSession, u as DriveCredentialInput, v as SocialIdTokenProvider, x as AuthError, y as UpdateProfileInput } from "./types-DDopQNZR.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {
@@ -37,6 +37,7 @@ interface PollDeviceOptions {
   signal?: AbortSignal;
 }
 interface DeviceAuthClient {
+  readonly _type: "device";
   requestAuthorization(options?: {
     signal?: AbortSignal;
   }): Promise<DeviceAuthorization>;

package/dist/device.js

@@ -1101,6 +1101,7 @@ function createDeviceAuth(options) {
 		}
 	}
 	return {
+		_type: "device",
 		requestAuthorization,
 		pollForToken(authorization, pollOptions) {
 			let signal;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { C as AuthErrorStatus, S as AuthErrorCode, _ as SocialIdTokenInput, a as AuthPersistenceDriver, b as WorkspaceSelection, c as AuthUser, d as FinuevaAuthClient, f as InvitationAcceptance, g as SignInInput, h as SendVerificationEmailInput, i as AuthPersistence, l as DriveCredential, m as PersonalWorkspaceSelection, n as AuthClientOptions, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as DriveCredentialInput, v as SocialIdTokenProvider, x as AuthError, y as UpdateProfileInput } from "./types-B1SZbs6Z.js";
+import { C as AuthErrorStatus, S as AuthErrorCode, _ as SocialIdTokenInput, a as AuthPersistenceDriver, b as WorkspaceSelection, c as AuthUser, d as FinuevaAuthClient, f as InvitationAcceptance, g as SignInInput, h as SendVerificationEmailInput, i as AuthPersistence, l as DriveCredential, m as PersonalWorkspaceSelection, n as AuthClientOptions, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as DriveCredentialInput, v as SocialIdTokenProvider, x as AuthError, y as UpdateProfileInput } from "./types-DDopQNZR.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion

package/dist/index.js

@@ -3535,6 +3535,7 @@ function createAuthClient(options) {
 		})).value;
 	}
 	return {
+		_type: "browser",
 		acceptInvitation(input) {
 			let invitation;
 			try {

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { C as AuthErrorStatus, S as AuthErrorCode, _ as SocialIdTokenInput, b as WorkspaceSelection, c as AuthUser, f as InvitationAcceptance, l as DriveCredential, m as PersonalWorkspaceSelection, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, t as AcceptInvitationInput, u as DriveCredentialInput, v as SocialIdTokenProvider, x as AuthError } from "./types-B1SZbs6Z.js";
+import { C as AuthErrorStatus, S as AuthErrorCode, _ as SocialIdTokenInput, b as WorkspaceSelection, c as AuthUser, f as InvitationAcceptance, l as DriveCredential, m as PersonalWorkspaceSelection, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, t as AcceptInvitationInput, u as DriveCredentialInput, v as SocialIdTokenProvider, x as AuthError } from "./types-DDopQNZR.js";
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;

package/dist/{types-B1SZbs6Z.d.ts → types-DDopQNZR.d.ts}

@@ -102,6 +102,7 @@ interface AuthClientOptions {
   timeoutMs?: number;
 }
 interface FinuevaAuthClient {
+  readonly _type: "browser";
   acceptInvitation(input: AcceptInvitationInput): Promise<InvitationAcceptance>;
   getSession(): Promise<AuthSession | null>;
   listOrganizations(): Promise<AuthOrganization[]>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,