@foir/sdk 0.30.0 → 0.31.0

package/dist/auth/auth.d.ts

@@ -3,8 +3,8 @@
  * lifecycle, and guards.
  *
  * Session I/O is injected via {@link SessionAdapter} (no Hydrogen/React-Router
- * coupling). Pre-login flows authenticate with the project `x-api-key`;
- * post-login reads add the user's bearer. Anything project-specific about the
+ * coupling). Flows before sign-in authenticate with the project `x-api-key`;
+ * signed-in reads add the user's bearer. Anything project-specific about the
  * user (a profile record, say) is resolved by a consumer-supplied
  * `resolveUser`: the SDK never hardcodes a per-project profile shape.
  *
@@ -17,7 +17,8 @@
  */
 import { type FoirEnv } from '../graphql/foir-request';
 import { type AuthOpName, type AuthOpOptions } from './ops';
-import { type AuthConfig, type AuthProviderPublic, type CurrentUser, type AuthResult, type DefaultAuthProvider, type AuthorizedApp, type DeleteAccountResult, type MyOrganization, type MyOrganizationChoices, type MyProfile, type MyProfileChange, type MySession, type MyAddress, type MyDataExport, type MyFactor, type StepUp, type FactorEnrollment, type MySignInMethod, type NewPersonalAccessToken, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type ProviderToken, type SignupContext } from './operations';
+import { type FoirAccountStep, type FoirSignInStep } from './steps';
+import { type AuthConfig, type AuthProviderPublic, type CurrentUser, type AuthResult, type DefaultAuthProvider, type AuthorizedApp, type DeleteAccountResult, type MyOrganization, type MyOrganizationChoices, type MyProfile, type MyProfileChange, type MySession, type MyAddress, type MyDataExport, type MyFactor, type StepUp, type FactorEnrollment, type MySignInMethod, type NewPersonalAccessToken, type ProviderCallbackInput, type ProviderSignInInput, type ProviderSignInResult, type ProviderToken, type SignupContext } from './operations';
 import type { TypedDocumentNode } from '@graphql-typed-document-node/core';
 /** An access token + its rotating refresh token. */
 export interface FoirAuthTokens {
@@ -38,39 +39,27 @@ export interface SessionAdapter {
     set(key: string, value: string): void | Promise<void>;
     unset(key: string): void | Promise<void>;
 }
-/** Login with email + password. Requires the project to have passwords enabled. */
-export declare function login(env: FoirEnv, vars: {
-    email: string;
-    password: string;
-}): Promise<AuthResult>;
 /**
- * Start an account with email + password. The address is mailed a code, and
- * signing in with it ({@link loginWithOTP}) proves the address and finishes
- * the account. Answered the same whether or not the address has an account
- * already, or the project takes nobody new: its holder is told by email.
+ * Email the user a one-time code to sign in with. Answers the step the code
+ * is brought back to with {@link signInWithOTP}, for every address alike.
  */
-export declare function register(env: FoirEnv, vars: {
-    email: string;
-    password: string;
-}): Promise<boolean>;
-/** Request a one-time password be emailed to the user. */
-export declare function requestOTP(env: FoirEnv, email: string): Promise<boolean>;
-/** Complete an OTP login. */
-export declare function loginWithOTP(env: FoirEnv, vars: {
-    email: string;
-    otp: string;
-}): Promise<AuthResult>;
-/** Rotate an access token using a refresh token. */
-export declare function refreshTokens(env: FoirEnv, refreshToken: string): Promise<AuthResult>;
+export declare function requestOTP(env: FoirEnv, email: string): Promise<FoirSignInStep>;
+/**
+ * Start a provider (OAuth/OIDC) sign-in. Answers the provider's address to send
+ * the user to, and keeps the step its finish is brought back to in the session
+ * store, across the redirect, for {@link finishProviderSignIn}.
+ */
+export declare function signInWithProvider(adapter: SessionAdapter, env: FoirEnv, input: ProviderSignInInput): Promise<ProviderSignInResult>;
 /**
- * Initiate provider (OAuth/OIDC) login — returns a `redirectUrl` to send the
- * user to, or an inline `token` for non-redirect providers.
+ * Finish a provider sign-in on your callback: bring the provider's `code` and
+ * `state` back to the step {@link signInWithProvider} kept, and persist the
+ * session. The route is built from your configured API address.
+ *
+ * When the sign-in named an address somebody already holds and a code was sent
+ * to it ({@link providerSignInRefusalOf} says `link_code_sent`),
+ * {@link confirmProviderLink} brings the code back to the same step.
  */
-export declare function loginWithProvider(env: FoirEnv, input: ProviderLoginInput): Promise<ProviderLoginResult>;
-/** Complete a provider login from the OAuth callback (`code`/`state`). */
-export declare function providerCallback(env: FoirEnv, input: ProviderCallbackInput): Promise<AuthResult>;
-/** Verify an OTP issued by an external provider. */
-export declare function providerVerifyOTP(env: FoirEnv, input: ProviderOTPVerifyInput): Promise<AuthResult>;
+export declare function finishProviderSignIn(adapter: SessionAdapter, env: FoirEnv, input: ProviderCallbackInput): Promise<FoirUser>;
 /**
  * Why a provider sign-in did not finish, as the platform said it: a stable code
  * your app shows its own words for (`signup_closed`, `provider_named_no_address`,
@@ -87,41 +76,42 @@ export declare function providerSignInRefusalOf(error: unknown): {
 /**
  * Why a sign-in your app's own form sent was refused, as the platform said it:
  * a stable code your app shows its own words for. `password_sign_in_off` from
- * {@link login} or {@link register} where the project, or the app the sign-in
- * came through, takes no password; `code_sign_in_off` from {@link requestOTP}
- * or {@link loginWithOTP} where it takes no code. Null for any other failure.
+ * {@link signInWithPassword} or {@link signUpWithPassword} where the project,
+ * or the app the sign-in came through, takes no password; `code_sign_in_off`
+ * from {@link requestOTP} or {@link signInWithOTP} where it takes no code.
+ * Null for any other failure.
  */
 export declare function signInRefusalOf(error: unknown): {
     code: string;
 } | null;
 /**
  * Finish a provider sign-in that is waiting for the code sent to its address,
- * connecting the provider to the account that holds the address. See
- * {@link providerSignInRefusalOf}.
+ * connecting the provider to the account that holds the address, and persist
+ * the session. See {@link providerSignInRefusalOf}.
  */
-export declare function confirmProviderLink(env: FoirEnv, input: {
+export declare function confirmProviderLink(adapter: SessionAdapter, env: FoirEnv, input: {
     pending: string;
     code: string;
-}): Promise<AuthResult>;
+}): Promise<FoirUser>;
 /**
  * Send a new code for a provider sign-in that is waiting for one. The new code
  * replaces the one before, and the answer names the new wait.
  */
-export declare function resendProviderLinkCode(env: FoirEnv, input: {
+export declare function resendProviderLinkCode(adapter: SessionAdapter, env: FoirEnv, input: {
     pending: string;
 }): Promise<{
     pending: string;
 }>;
-/** List the project's configured auth providers (for a login UI). */
+/** List the project's configured auth providers (for a sign-in UI). */
 export declare function getAuthProviders(env: FoirEnv): Promise<AuthProviderPublic[]>;
 /**
  * Read the project's public auth configuration — which built-in methods are
- * enabled and which external providers to offer. This is what a login screen
+ * enabled and which external providers to offer. This is what a sign-in screen
  * renders itself from, before any user token exists.
  */
 export declare function getAuthConfig(env: FoirEnv): Promise<AuthConfig>;
 /**
- * The provider a login screen should default to, or `null` when the project has
+ * The provider a sign-in screen should default to, or `null` when the project has
  * configured none.
  */
 export declare function getDefaultAuthProvider(env: FoirEnv): Promise<DefaultAuthProvider | null>;
@@ -150,15 +140,6 @@ export declare function joinWaitlist(env: FoirEnv, email: string): Promise<boole
 export declare function requestPasswordReset(env: FoirEnv, email: string, options?: {
     clientId?: string;
 }): Promise<boolean>;
-/**
- * Redeem an emailed reset token and set a new password. Returns a fresh session
- * (resetting a password signs the user in), so pair it with
- * {@link saveSession}, or use {@link resetPasswordAndSignIn} which does both.
- */
-export declare function resetPassword(env: FoirEnv, vars: {
-    token: string;
-    newPassword: string;
-}): Promise<AuthResult>;
 /**
  * Change the calling user's password. Requires the current password as well
  * as the bearer, so a stolen token alone cannot take the account over.
@@ -188,12 +169,6 @@ export declare function currentUser(env: FoirEnv, options?: AuthOpOptions): Prom
 export declare function myProviderToken(env: FoirEnv, providerKey: string, options?: AuthOpOptions & {
     forceRefresh?: boolean;
 }): Promise<ProviderToken | null>;
-/**
- * End the sign-in's provider tokens server-side: this device's, and no other
- * device's. This does NOT clear local session state — {@link signOut} is the
- * pairing that does both.
- */
-export declare function logout(env: FoirEnv, options?: AuthOpOptions): Promise<boolean>;
 /**
  * Delete the calling user's account and their owned records and files.
  * Irreversible. `password` is required for an account that holds one. An
@@ -260,23 +235,27 @@ export declare function createPersonalAccessToken(env: FoirEnv, vars: {
 export declare function myAddresses(env: FoirEnv, options?: AuthOpOptions): Promise<MyAddress[]>;
 /**
  * Send a code to an address the calling user is adding to their account, and
- * answer when it stops working (ISO-8601, ten minutes on). The address is kept
- * by {@link proveMyAddress}. `password` is their current one; an account with
- * none needs a sign-in in the last ten minutes instead. At most five codes an
+ * answer the step the code is brought back to with {@link proveMyAddress},
+ * within ten minutes. `password` is their current one; an account with none
+ * needs a sign-in in the last ten minutes instead. At most five codes an
  * hour.
  */
 export declare function addMyAddress(env: FoirEnv, vars: {
     email: string;
     password?: string;
-}, options?: AuthOpOptions): Promise<string>;
+}, options?: AuthOpOptions): Promise<FoirAccountStep>;
 /**
- * Keep the address a code was sent to, as proven. Refused where another
- * account in the project holds the address: nobody's address is taken.
+ * Keep the address a step's code was sent to, as proven: bring the code back
+ * to the step {@link addMyAddress} answered, with that step's token. The route
+ * is built from your configured API address, and the post carries no key and
+ * no session: the step's token says whose account it is. Refused once the
+ * session that began the step has ended, and where another account in the
+ * project holds the address: nobody's address is taken.
  */
 export declare function proveMyAddress(env: FoirEnv, vars: {
-    email: string;
+    step: FoirAccountStep;
     code: string;
-}, options?: AuthOpOptions): Promise<MyAddress>;
+}): Promise<MyAddress>;
 /** Make one of the calling user's proven addresses the one their account uses. */
 export declare function makeMyAddressPrimary(env: FoirEnv, email: string, options?: AuthOpOptions): Promise<MyAddress>;
 /**
@@ -307,47 +286,39 @@ export declare function disconnectSignInMethod(env: FoirEnv, provider: string, o
 /** The second factors, passkeys and recovery codes the calling user holds. */
 export declare function myFactors(env: FoirEnv, options?: AuthOpOptions): Promise<MyFactor[]>;
 /**
- * Begin proving a second factor with the calling user's password.
- * {@link completeStepUp} finishes it; for a user who holds none, the answer's
- * `elevatedHandle` is already the proof.
+ * Begin proving the calling user's session again, on Fóir's hosted step-up
+ * page: their password, and their second factor where they hold one. Send the
+ * user to the answer's `url`, with `return_to` added to its query to have them
+ * sent back (it is admitted only under your app's own origins). The proof pays
+ * for one change to their factors in the next ten minutes, and a second factor
+ * also lifts the session to two factors. A factor change refused for want of a
+ * proof names the same page: see `stepUpRequired`.
  */
-export declare function beginStepUp(env: FoirEnv, password: string, options?: AuthOpOptions): Promise<StepUp>;
-/**
- * Prove a second factor with exactly one of a passkey's or security key's
- * assertion, an authenticator app's code or a recovery code, which is then
- * spent. The session making the request counts as two factors from here, and
- * the answer is an elevated handle for one change to the user's factors in
- * the next ten minutes.
- */
-export declare function completeStepUp(env: FoirEnv, vars: {
-    handle: string;
-    webauthnAssertionJson?: string;
-    totpCode?: string;
-    recoveryCode?: string;
-}, options?: AuthOpOptions): Promise<string>;
+export declare function stepUp(env: FoirEnv, options?: AuthOpOptions): Promise<StepUp>;
 /**
  * Begin adding `totp` (an authenticator app), `webauthn` (a security key held
  * as a second factor) or `passkey` (a passkey that signs the user in on its
- * own), with the `elevatedHandle` {@link beginStepUp} or
- * {@link completeStepUp} answered.
+ * own), spending the session's {@link stepUp} proof.
  */
 export declare function beginFactorEnrollment(env: FoirEnv, vars: {
     method: 'webauthn' | 'totp' | 'passkey';
-    elevatedHandle: string;
 }, options?: AuthOpOptions): Promise<FactorEnrollment>;
 /**
- * Finish adding a second factor, with the `navigator.credentials.create`
- * result or the authenticator app's code.
+ * Finish adding a second factor: bring the `navigator.credentials.create`
+ * result or the authenticator app's code back to the step
+ * {@link beginFactorEnrollment} answered, with that step's token. The route is
+ * built from your configured API address, and the post carries no key and no
+ * session: the step's token says whose account it is. Refused once the session
+ * that began the step has ended.
  */
 export declare function completeFactorEnrollment(env: FoirEnv, vars: {
-    handle: string;
+    step: FoirAccountStep;
     webauthnAttestationJson?: string;
     totpCode?: string;
     name?: string;
-}, options?: AuthOpOptions): Promise<boolean>;
-/** Remove one of the calling user's factors, with an elevated handle from {@link completeStepUp}. */
+}): Promise<boolean>;
+/** Remove one of the calling user's factors, spending the session's {@link stepUp} proof. */
 export declare function removeFactor(env: FoirEnv, vars: {
-    elevatedHandle: string;
     kind: string;
     id: string;
 }, options?: AuthOpOptions): Promise<boolean>;
@@ -361,10 +332,10 @@ export declare function renameFactor(env: FoirEnv, vars: {
     name: string;
 }, options?: AuthOpOptions): Promise<MyFactor>;
 /**
- * Make the calling user new recovery codes, with an elevated handle from
- * {@link completeStepUp}. They replace any held and are answered here once.
+ * Make the calling user new recovery codes, spending the session's
+ * {@link stepUp} proof. They replace any held and are answered here once.
  */
-export declare function makeRecoveryCodes(env: FoirEnv, elevatedHandle: string, options?: AuthOpOptions): Promise<string[]>;
+export declare function makeRecoveryCodes(env: FoirEnv, options?: AuthOpOptions): Promise<string[]>;
 /**
  * The organizations this user may stand in.
  *
@@ -448,23 +419,31 @@ export declare function clearSession(adapter: SessionAdapter): Promise<void>;
 export declare function getSessionToken(adapter: SessionAdapter): Promise<string | null>;
 /** Read the stored user (null when signed out). */
 export declare function getSessionUser(adapter: SessionAdapter): Promise<FoirUser | null>;
-/** Login with email + password and persist the session. */
+/**
+ * Sign in with email + password and persist the session. Requires the project
+ * to have passwords on.
+ */
 export declare function signInWithPassword(adapter: SessionAdapter, env: FoirEnv, vars: {
     email: string;
     password: string;
 }): Promise<FoirUser>;
 /**
  * Start a sign-up with email + password: the address is mailed a code, and
- * {@link signInWithOTP} with it finishes the account and persists the
- * session. Nobody is signed in until then.
+ * {@link signInWithOTP} with it and the step this answers proves the address,
+ * finishes the account and persists the session. Nobody is signed in until
+ * then. Answered the same whether or not the address has an account already,
+ * or the project takes nobody new: its holder is told by email.
  */
 export declare function signUpWithPassword(env: FoirEnv, vars: {
     email: string;
     password: string;
-}): Promise<void>;
-/** Complete an OTP login and persist the session. */
+}): Promise<FoirSignInStep>;
+/**
+ * Complete a code sign-in and persist the session: bring the code back to the
+ * step {@link requestOTP} or {@link signUpWithPassword} answered.
+ */
 export declare function signInWithOTP(adapter: SessionAdapter, env: FoirEnv, vars: {
-    email: string;
+    step: FoirSignInStep;
     otp: string;
 }): Promise<FoirUser>;
 /**

package/dist/auth/hosted.d.ts

@@ -12,14 +12,14 @@
  * Every URL/cookie/path is CONFIG, not a constant, so a domain restructure
  * is a config change, not a code change.
  */
-export interface HostedLoginConfig {
+export interface HostedSignInConfig {
     /** White-label front-door origin, e.g. `https://login.example.com`. */
     loginOrigin: string;
     /** Session cookie name set on the registrable domain. Default `foir_session`. */
     cookieName?: string;
     /** Session-exchange path on the front door. Default `/session/token`. */
     sessionPath?: string;
-    /** RP-initiated logout path on the front door. Default `/session/end-session`. */
+    /** RP-initiated sign-out path on the front door. Default `/session/end-session`. */
     endSessionPath?: string;
     /**
      * The app the bearer is for, when it is not the app the login domain fronts.
@@ -28,7 +28,7 @@ export interface HostedLoginConfig {
     clientId?: string;
 }
 /** What a sign-in started at the hosted front door is for. */
-export interface HostedLoginOptions {
+export interface HostedSignInOptions {
     /**
      * The organization the person signs in to, when one auth client serves an
      * address per organization. It decides the branding, the pool, and which
@@ -50,27 +50,27 @@ export interface HostedLoginOptions {
  * Build the redirect URL to the hosted front door, forwarding an absolute
  * `returnTo` and, where the app names one, the organization the sign-in is for.
  */
-export declare function hostedLoginUrl(config: HostedLoginConfig, returnTo?: string, options?: HostedLoginOptions): string;
+export declare function hostedSignInUrl(config: HostedSignInConfig, returnTo?: string, options?: HostedSignInOptions): string;
 /**
  * Build the redirect URL that ENDS the hosted session — the mirror of
- * `hostedLoginUrl`, and the only thing that actually signs a user out on
+ * `hostedSignInUrl`, and the only thing that actually signs a user out on
  * this flow.
  *
  * The cookie is the durable credential. Disposing of a bearer, clearing a
- * local session, or calling the `logout` mutation (which clears
+ * local session, or calling the `signOut` mutation (which clears
  * upstream provider tokens and nothing else) all leave it in place, and the
  * next request re-establishes the user from it. This URL points at the
  * front door's end-session endpoint, which revokes the session row and clears
  * the cookie before returning the browser to `returnTo`.
  *
  * A URL builder, deliberately: no transport, no CORS surface, no CSRF header,
- * and no JavaScript required at the consumer. Server-side logout is
- * `return redirect(hostedLogoutUrl(config, clientId, returnTo))`.
+ * and no JavaScript required at the consumer. Signing out server-side is
+ * `return redirect(hostedSignOutUrl(config, clientId, returnTo))`.
  *
  * `returnTo` must be an absolute URL on an origin registered for `clientId`;
  * the platform refuses anything else. Omit it for a bare 204 with no redirect.
  */
-export declare function hostedLogoutUrl(config: HostedLoginConfig, clientId: string, returnTo?: string): string;
+export declare function hostedSignOutUrl(config: HostedSignInConfig, clientId: string, returnTo?: string): string;
 /** The identity + bearer returned by a successful hosted-session exchange. */
 export interface HostedSession {
     token: string;
@@ -115,7 +115,7 @@ export type HostedSessionResult =
 }
 /**
  * The user is signed out. Act on it: clear any local session and send
- * them to `hostedLoginUrl`.
+ * them to `hostedSignInUrl`.
  *
  * `no-cookie` — nothing to exchange. `rejected` — the front door refused the
  * cookie (401) and has already cleared it itself.
@@ -143,14 +143,14 @@ export type HostedSessionResult =
     cause?: unknown;
 };
 /**
- * Exchange the hosted-login cookie on an incoming request for a user
+ * Exchange the hosted sign-in cookie on an incoming request for a user
  * bearer + identity (server-to-server: forwards the cookie to the front door's
  * session endpoint with the CSRF header).
  *
  * See `HostedSessionResult` for why this reports an outcome rather than
  * returning `null` for everything that is not a success.
  */
-export declare function fetchHostedSession(request: Request, config: HostedLoginConfig): Promise<HostedSessionResult>;
+export declare function fetchHostedSession(request: Request, config: HostedSignInConfig): Promise<HostedSessionResult>;
 /**
  * What hosted sign-in said beside the code when it sent someone back to your
  * app. A sign-in it refused carries a stable code (`foir_error`); one that

package/dist/auth/index.d.ts

@@ -1,26 +1,30 @@
 /**
  * `@foir/sdk/auth`: framework-agnostic sign-in for your app's users.
  *
- * The whole sign-in surface (login, register, OTP, external providers,
+ * The whole sign-in surface (password, sign-up, code, external providers,
  * refresh, password management, email verification and account deletion) over
- * the server's generated `auth` namespace, plus token lifecycle with an
- * injected `SessionAdapter`, guards, and the optional hosted-login bridge.
+ * the server's generated `auth` namespace. Each sign-in flow keeps its session
+ * in an injected `SessionAdapter`; there are guards, and the optional hosted
+ * sign-in bridge.
  *
  * There are no operation documents here any more. The flows address root fields
  * the caller's own manifest advertises, through the same op transport
  * `@foir/sdk/data` uses, so `graphql` is not on this module's path at all.
  */
-export { login, register, requestOTP, loginWithOTP, refreshTokens, loginWithProvider, providerCallback, providerVerifyOTP, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, resetPassword, updatePassword, currentUser, myProviderToken, logout, deleteMyAccount, deleteMyAccountAndSignOut, leaveMembership, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, myAddresses, addMyAddress, proveMyAddress, makeMyAddressPrimary, removeMyAddress, exportMyData, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, beginStepUp, completeStepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, renameFactor, makeRecoveryCodes, myOrganizations, myOrganizationChoices, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
+export { requestOTP, signInWithProvider, finishProviderSignIn, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, updatePassword, currentUser, myProviderToken, deleteMyAccount, deleteMyAccountAndSignOut, leaveMembership, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, myAddresses, addMyAddress, proveMyAddress, makeMyAddressPrimary, removeMyAddress, exportMyData, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, stepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, renameFactor, makeRecoveryCodes, myOrganizations, myOrganizationChoices, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
 export type { FoirAuthTokens, FoirUser, SessionAdapter, RequireAuthOptions, } from './auth';
 export { userAccess, getSessionAccess, hasRole, hasScope, requireRole, requireScope, FoirAccessDeniedError, } from './access';
 export type { FoirAccess, FoirAccessDenial } from './access';
 export { FoirAuthDowngradedError, FoirSessionExpiredError } from '../graphql/foir-request';
+export { stepUpRequired } from '../transport/foir-http';
+export type { FoirStepUp, FoirStepUpAsk } from '../transport/foir-http';
 export { AUTH_OPS } from './ops';
 export type { AuthOpName, AuthOpOptions } from './ops';
-export { hostedLoginUrl, hostedLogoutUrl, fetchHostedSession, hostedSignInNoticeOf } from './hosted';
+export type { FoirAccountStep, FoirSignInStep } from './steps';
+export { hostedSignInUrl, hostedSignOutUrl, fetchHostedSession, hostedSignInNoticeOf } from './hosted';
 export { beginSignIn, completeSignIn, CodeFlowError } from './code-flow';
 export type { CodeFlowConfig, BeginSignInOptions, PendingSignIn, CodeFlowTokens } from './code-flow';
-export type { HostedLoginConfig, HostedLoginOptions, HostedSession, HostedSessionResult, HostedSignInNotice } from './hosted';
+export type { HostedSignInConfig, HostedSignInOptions, HostedSession, HostedSessionResult, HostedSignInNotice } from './hosted';
 export { createFoirSessionClient } from './session-client';
 export type { FoirSessionClient, FoirSessionConfig, FoirSessionUser, } from './session-client';
-export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyOrganizationChoice, MyOrganizationChoices, MyProfile, MyProfileChange, AuthorizedApp, MySession, MyAddress, MyDataExport, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';
+export type { AuthResult, ProviderSignInResult, AuthProviderPublic, ProviderSignInInput, ProviderCallbackInput, SignupContext, SignupMode, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyOrganizationChoice, MyOrganizationChoices, MyProfile, MyProfileChange, AuthorizedApp, MySession, MyAddress, MyDataExport, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';

package/dist/auth/operations.d.ts

@@ -1,8 +1,8 @@
 /**
  * Foir sign-in result and input types.
  *
- * These are PLATFORM-STABLE primitives — login / register / refresh / OTP /
- * provider login / password management / account lifecycle are fixed-shape
+ * These are PLATFORM-STABLE primitives: sign-in, register, refresh, OTP,
+ * provider sign-in, password management and account lifecycle are fixed-shape
  * operations served by api-public for every project (gated per-project by the
  * password / OTP / provider flags, but identical in shape when present). Unlike
  * per-project model types they do not vary by configured models, so the SDK
@@ -29,19 +29,18 @@
  * here: that shape varies per project, so it stays consumer-injected (see
  * `requireAuth`'s `resolveUser`).
  */
-/** The common auth result every login/register/refresh mutation returns. */
+import type { FoirAccountStep } from './steps';
+/** The tokens and user a sign-in or refresh answers, which `saveSession` keeps. */
 export interface AuthResult {
     token: string;
     refreshToken: string;
     userId: string;
     email: string;
 }
-/** Result of initiating a provider login — a redirect URL or an inline token. */
-export interface ProviderLoginResult {
-    /** OAuth/OIDC authorization URL to redirect the user to (redirect flows). */
+/** A provider sign-in started: where to send the user. */
+export interface ProviderSignInResult {
+    /** The provider's authorization address to send the user to. */
     redirectUrl: string | null;
-    /** Inline access token (non-redirect provider flows). */
-    token: string | null;
 }
 /** A configured auth provider, as exposed to unauthenticated callers. */
 export interface AuthProviderPublic {
@@ -51,9 +50,8 @@ export interface AuthProviderPublic {
     type: string;
     isDefault: boolean | null;
 }
-export interface ProviderLoginInput {
+export interface ProviderSignInInput {
     providerKey: string;
-    email?: string;
     returnTo?: string;
     /** Override the provider's default redirect_uri (must be allow-listed). */
     redirectUri?: string;
@@ -62,13 +60,6 @@ export interface ProviderCallbackInput {
     providerKey: string;
     code?: string;
     state?: string;
-    email?: string;
-    idToken?: string;
-}
-export interface ProviderOTPVerifyInput {
-    providerKey: string;
-    email: string;
-    otp: string;
 }
 /** The project's signup mode. */
 export type SignupMode = 'PUBLIC' | 'RESTRICTED' | 'WAITLIST' | 'CLOSED';
@@ -85,8 +76,8 @@ export interface AuthConfigProvider {
 }
 /**
  * The project's public auth configuration: which built-in methods are on, and
- * which external providers a login screen should offer. Readable before any
- * user token exists: it is what a login screen renders itself from.
+ * which external providers a sign-in screen should offer. Readable before any
+ * user token exists: it is what a sign-in screen renders itself from.
  */
 export interface AuthConfig {
     passwordEnabled: boolean;
@@ -94,7 +85,7 @@ export interface AuthConfig {
     providers: AuthConfigProvider[] | null;
 }
 /**
- * The provider a login screen should default to, or `null` when the project has
+ * The provider a sign-in screen should default to, or `null` when the project has
  * configured none.
  */
 export interface DefaultAuthProvider {
@@ -289,21 +280,15 @@ export interface MyFactor {
  * factor, or, for a user who holds none, already proven by the password.
  */
 export interface StepUp {
-    /** What {@link completeStepUp} takes, for a user who holds a second factor. */
-    handle: string | null;
-    /** For a user who holds no second factor: the proof their password is, for one change to their factors. */
-    elevatedHandle: string | null;
-    /** Whether a security key or passkey can prove it. */
-    webauthn: boolean;
-    /** Whether an authenticator app's code can prove it. */
-    totp: boolean;
-    /** The publicKey options for `navigator.credentials.get`, as JSON. */
-    webauthnOptionsJson: string | null;
+    /** Fóir's hosted step-up page. Its token is in the fragment; add `return_to` to its query. */
+    url: string;
+    /** When the page stops working (RFC 3339). */
+    expiresAt: string;
 }
 /** A second factor being added, waiting for the browser or the authenticator app. */
 export interface FactorEnrollment {
-    /** What {@link completeFactorEnrollment} takes. */
-    handle: string;
+    /** The step what the authenticator makes is brought back to, with {@link completeFactorEnrollment}. */
+    step: FoirAccountStep;
     /** For a security key or passkey: the publicKey options for `navigator.credentials.create`, as JSON. */
     webauthnOptionsJson: string | null;
     /** For an authenticator app: the key to enter by hand. */

package/dist/auth/ops.d.ts

@@ -45,15 +45,13 @@ export declare const AUTH_OPS: {
     readonly currentUser: "currentUser";
     readonly myProviderToken: "myProviderToken";
     readonly whoami: "whoami";
-    readonly login: "login";
+    readonly signIn: "signIn";
     readonly register: "register";
     readonly requestOTP: "requestOTP";
-    readonly loginWithOTP: "loginWithOTP";
     readonly refreshToken: "refreshToken";
-    readonly logout: "logout";
+    readonly signOut: "signOut";
     readonly joinWaitlist: "joinWaitlist";
     readonly requestPasswordReset: "requestPasswordReset";
-    readonly resetPassword: "resetPassword";
     readonly updatePassword: "updatePassword";
     readonly deleteMyAccount: "deleteMyAccount";
     readonly leaveMembership: "leaveMembership";
@@ -65,7 +63,6 @@ export declare const AUTH_OPS: {
     readonly signOutEverywhere: "signOutEverywhere";
     readonly myAddresses: "myAddresses";
     readonly addMyAddress: "addMyAddress";
-    readonly proveMyAddress: "proveMyAddress";
     readonly makeMyAddressPrimary: "makeMyAddressPrimary";
     readonly removeMyAddress: "removeMyAddress";
     readonly exportMyData: "exportMyData";
@@ -74,21 +71,15 @@ export declare const AUTH_OPS: {
     readonly connectSignInMethod: "connectSignInMethod";
     readonly disconnectSignInMethod: "disconnectSignInMethod";
     readonly myFactors: "myFactors";
-    readonly beginStepUp: "beginStepUp";
-    readonly completeStepUp: "completeStepUp";
+    readonly stepUp: "stepUp";
     readonly beginFactorEnrollment: "beginFactorEnrollment";
-    readonly completeFactorEnrollment: "completeFactorEnrollment";
     readonly removeFactor: "removeFactor";
     readonly renameFactor: "renameFactor";
     readonly makeRecoveryCodes: "makeRecoveryCodes";
     readonly myOrganizations: "myOrganizations";
     readonly myOrganizationChoices: "myOrganizationChoices";
     readonly registerOrganization: "registerOrganization";
-    readonly loginWithProvider: "loginWithProvider";
-    readonly providerCallback: "providerCallback";
-    readonly providerVerifyOTP: "providerVerifyOTP";
-    readonly confirmProviderLink: "confirmProviderLink";
-    readonly resendProviderLinkCode: "resendProviderLinkCode";
+    readonly signInWithProvider: "signInWithProvider";
 };
 /** One of the auth namespace's root field names. */
 export type AuthOpName = (typeof AUTH_OPS)[keyof typeof AUTH_OPS];

package/dist/auth/session-client.d.ts

@@ -27,7 +27,7 @@
  * api.foir.dev but a browser cannot reach them there — the cookie would be
  * cross-site, and that CORS surface deliberately refuses credentials.
  */
-import type { HostedLoginOptions } from './hosted';
+import type { HostedSignInOptions } from './hosted';
 export interface FoirSessionConfig {
     /**
      * Your verified custom login domain, e.g. `https://login.acme.com`. Must share
@@ -36,8 +36,8 @@ export interface FoirSessionConfig {
     loginOrigin: string;
     /** Session-exchange path. Default `/session/token`. */
     sessionPath?: string;
-    /** Logout path. Default `/session/logout`. */
-    logoutPath?: string;
+    /** Sign-out path. Default `/session/logout`. */
+    signOutPath?: string;
     /**
      * The app the bearer is for, when it is not the app the login domain fronts.
      * Default: the domain's own app.
@@ -72,7 +72,7 @@ export interface FoirSessionClient {
      * for with `options.org` when one auth client serves an address per
      * organization.
      */
-    signInUrl(returnTo?: string, options?: HostedLoginOptions): string;
+    signInUrl(returnTo?: string, options?: HostedSignInOptions): string;
     /** Observe session changes. Returns an unsubscribe function. */
     subscribe(listener: (user: FoirSessionUser | null) => void): () => void;
     /** Cancel the refresh timer. Call on unmount. */