@hanzo/iam 0.6.1 → 0.7.0

package/dist/auth.d.ts

@@ -1,7 +1,7 @@
 /**
  * JWT validation using jose library + OIDC JWKS discovery.
  *
- * Validates access/ID tokens issued by Hanzo IAM (Casdoor).
+ * Validates access/ID tokens issued by Hanzo IAM.
  */
 import type { IamConfig, IamAuthResult } from "./types.js";
 /** Clear cached JWKS key sets (useful for testing or key rotation). */

package/dist/auth.js

@@ -1,7 +1,7 @@
 /**
  * JWT validation using jose library + OIDC JWKS discovery.
  *
- * Validates access/ID tokens issued by Hanzo IAM (Casdoor).
+ * Validates access/ID tokens issued by Hanzo IAM.
  */
 import { createRemoteJWKSet, jwtVerify } from "jose";
 // ---------------------------------------------------------------------------
@@ -90,7 +90,7 @@ export async function validateToken(token, config) {
             return { ok: false, reason: "iam_token_expired" };
         }
         if (message.includes("audience")) {
-            // Retry without audience check - some Casdoor configs don't set aud
+            // Retry without audience check - some IAM configs don't set aud
             try {
                 const result = await jwtVerify(token, keySet, {
                     issuer,
@@ -115,7 +115,7 @@ export async function validateToken(token, config) {
     if (!sub) {
         return { ok: false, reason: "iam_subject_missing" };
     }
-    // Casdoor sub format is "org/username" - extract owner
+    // IAM sub format is "org/username" - extract owner
     const parts = sub.split("/");
     const owner = parts.length > 1 ? parts[0] : config.orgName ?? "unknown";
     return {

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAGtE,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE1E,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc;IAC5B,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAOD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC1D,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC,KAAK,UAAU,cAAc,CAAC,SAAiB;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,gBAAgB,EAAE,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,mCAAmC,EAAE;YACrE,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2C,CAAC;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,MAAiB;IAEjB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAC5B,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;YAC5C,MAAM;YACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,EAAE,EAAE,iBAAiB;SACtC,CAAC,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,oEAAoE;YACpE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;oBAC5C,MAAM;oBACN,cAAc,EAAE,EAAE;iBACnB,CAAC,CAAC;gBACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,OAAkC,CAAC;IAElD,2DAA2D;IAC3D,MAAM,GAAG,GACP,MAAM,CAAC,GAAG;QACV,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAClE,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE;YAClC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IAED,uDAAuD;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC;IAExE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAClE,IAAI,EACF,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC7B,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ;gBAC7C,CAAC,CAAC,MAAM,CAAC,kBAAkB;gBAC3B,CAAC,CAAC,SAAS;QACjB,MAAM,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACvE,KAAK;QACL,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAGtE,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE1E,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc;IAC5B,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAOD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC1D,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC,KAAK,UAAU,cAAc,CAAC,SAAiB;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,gBAAgB,EAAE,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,mCAAmC,EAAE;YACrE,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2C,CAAC;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,MAAiB;IAEjB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAC5B,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;YAC5C,MAAM;YACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,EAAE,EAAE,iBAAiB;SACtC,CAAC,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,gEAAgE;YAChE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;oBAC5C,MAAM;oBACN,cAAc,EAAE,EAAE;iBACnB,CAAC,CAAC;gBACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,OAAkC,CAAC;IAElD,2DAA2D;IAC3D,MAAM,GAAG,GACP,MAAM,CAAC,GAAG;QACV,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAClE,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE;YAClC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IAED,mDAAmD;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC;IAExE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAClE,IAAI,EACF,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC7B,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ;gBAC7C,CAAC,CAAC,MAAM,CAAC,kBAAkB;gBAC3B,CAAC,CAAC,SAAS;QACjB,MAAM,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACvE,KAAK;QACL,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/betterauth.d.ts

@@ -0,0 +1,67 @@
+/**
+ * BetterAuth SSO provider configuration for IAM.
+ *
+ * Returns a provider config object compatible with BetterAuth's
+ * `socialProviders` or generic OAuth plugin.
+ *
+ * @example
+ * ```ts
+ * import { betterAuth } from "better-auth";
+ * import { iamProvider } from "@hanzo/iam/betterauth";
+ *
+ * export const auth = betterAuth({
+ *   socialProviders: [
+ *     iamProvider({
+ *       serverUrl: process.env.IAM_SERVER_URL!,
+ *       clientId: process.env.IAM_CLIENT_ID!,
+ *       clientSecret: process.env.IAM_CLIENT_SECRET!,
+ *     }),
+ *   ],
+ * });
+ * ```
+ *
+ * @packageDocumentation
+ */
+import type { IamConfig } from "./types.js";
+export interface IamSocialProvider {
+    id: string;
+    name: string;
+    type: "oidc";
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    authorization: {
+        url: string;
+        params: {
+            scope: string;
+        };
+    };
+    token: {
+        url: string;
+    };
+    userinfo: {
+        url: string;
+    };
+    profile: (profile: Record<string, unknown>) => {
+        id: string;
+        name: string;
+        email: string;
+        image: string | null;
+    };
+}
+/**
+ * Create a BetterAuth-compatible social provider for IAM.
+ *
+ * Works with BetterAuth's SSO plugin or generic OAuth integration.
+ * Uses standard OIDC endpoints.
+ */
+export declare function iamProvider(config: IamConfig & {
+    redirectUri?: string;
+}): IamSocialProvider;
+/** @deprecated Use iamProvider instead */
+export { iamProvider as hanzoIamProvider };
+/** @deprecated Use iamProvider instead */
+export { iamProvider as hanzoIamSocialProvider };
+/** @deprecated Use IamSocialProvider instead */
+export type { IamSocialProvider as HanzoIamSocialProvider };
+//# sourceMappingURL=betterauth.d.ts.map

package/dist/betterauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"betterauth.d.ts","sourceRoot":"","sources":["../src/betterauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC1D,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK;QAC7C,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC;CACH;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,SAAS,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C,iBAAiB,CA6BnB;AAGD,0CAA0C;AAC1C,OAAO,EAAE,WAAW,IAAI,gBAAgB,EAAE,CAAC;AAC3C,0CAA0C;AAC1C,OAAO,EAAE,WAAW,IAAI,sBAAsB,EAAE,CAAC;AACjD,gDAAgD;AAChD,YAAY,EAAE,iBAAiB,IAAI,sBAAsB,EAAE,CAAC"}

package/dist/betterauth.js

@@ -0,0 +1,64 @@
+/**
+ * BetterAuth SSO provider configuration for IAM.
+ *
+ * Returns a provider config object compatible with BetterAuth's
+ * `socialProviders` or generic OAuth plugin.
+ *
+ * @example
+ * ```ts
+ * import { betterAuth } from "better-auth";
+ * import { iamProvider } from "@hanzo/iam/betterauth";
+ *
+ * export const auth = betterAuth({
+ *   socialProviders: [
+ *     iamProvider({
+ *       serverUrl: process.env.IAM_SERVER_URL!,
+ *       clientId: process.env.IAM_CLIENT_ID!,
+ *       clientSecret: process.env.IAM_CLIENT_SECRET!,
+ *     }),
+ *   ],
+ * });
+ * ```
+ *
+ * @packageDocumentation
+ */
+/**
+ * Create a BetterAuth-compatible social provider for IAM.
+ *
+ * Works with BetterAuth's SSO plugin or generic OAuth integration.
+ * Uses standard OIDC endpoints.
+ */
+export function iamProvider(config) {
+    const baseUrl = config.serverUrl.replace(/\/+$/, "");
+    return {
+        id: "iam",
+        name: "IAM",
+        type: "oidc",
+        issuer: baseUrl,
+        clientId: config.clientId,
+        clientSecret: config.clientSecret,
+        authorization: {
+            url: `${baseUrl}/oauth/authorize`,
+            params: { scope: "openid profile email" },
+        },
+        token: { url: `${baseUrl}/oauth/token` },
+        userinfo: { url: `${baseUrl}/oauth/userinfo` },
+        profile(profile) {
+            return {
+                id: profile.sub ?? profile.id ?? "",
+                name: profile.displayName ??
+                    profile.name ??
+                    profile.preferred_username ??
+                    "",
+                email: profile.email ?? "",
+                image: profile.avatar ?? profile.picture ?? null,
+            };
+        },
+    };
+}
+// Backwards-compatible aliases
+/** @deprecated Use iamProvider instead */
+export { iamProvider as hanzoIamProvider };
+/** @deprecated Use iamProvider instead */
+export { iamProvider as hanzoIamSocialProvider };
+//# sourceMappingURL=betterauth.js.map

package/dist/betterauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"betterauth.js","sourceRoot":"","sources":["../src/betterauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAsBH;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,MAA4C;IAE5C,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAErD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE;YACb,GAAG,EAAE,GAAG,OAAO,kBAAkB;YACjC,MAAM,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE;SAC1C;QACD,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,cAAc,EAAE;QACxC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,iBAAiB,EAAE;QAC9C,OAAO,CAAC,OAAgC;YACtC,OAAO;gBACL,EAAE,EAAG,OAAO,CAAC,GAAc,IAAK,OAAO,CAAC,EAAa,IAAI,EAAE;gBAC3D,IAAI,EACD,OAAO,CAAC,WAAsB;oBAC9B,OAAO,CAAC,IAAe;oBACvB,OAAO,CAAC,kBAA6B;oBACtC,EAAE;gBACJ,KAAK,EAAG,OAAO,CAAC,KAAgB,IAAI,EAAE;gBACtC,KAAK,EAAG,OAAO,CAAC,MAAiB,IAAK,OAAO,CAAC,OAAkB,IAAI,IAAI;aACzE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+BAA+B;AAC/B,0CAA0C;AAC1C,OAAO,EAAE,WAAW,IAAI,gBAAgB,EAAE,CAAC;AAC3C,0CAA0C;AAC1C,OAAO,EAAE,WAAW,IAAI,sBAAsB,EAAE,CAAC"}

package/dist/browser.d.ts

@@ -4,10 +4,10 @@
  * Provides PKCE-based login redirect, code exchange, token refresh,
  * popup signin, and silent signin for single-page applications.
  *
- * Adapted and modernized from casdoor-js-sdk.
+ * Adapted and modernized for Hanzo IAM.
  */
 import type { IamConfig, TokenResponse } from "./types.js";
-export type BrowserIamConfig = IamConfig & {
+export type IAMConfig = IamConfig & {
     /** OAuth2 redirect URI (e.g. "https://app.hanzo.bot/auth/callback"). */
     redirectUri: string;
     /** OAuth2 scopes (default: "openid profile email"). */
@@ -23,11 +23,11 @@ export type BrowserIamConfig = IamConfig & {
      */
     proxyBaseUrl?: string;
 };
-export declare class BrowserIamSdk {
+export declare class IAM {
     private readonly config;
     private readonly storage;
     private discoveryCache;
-    constructor(config: BrowserIamConfig);
+    constructor(config: IAMConfig);
     private getDiscovery;
     /**
      * Start the OAuth2 PKCE login flow by redirecting to the IAM authorize endpoint.
@@ -87,5 +87,88 @@ export declare class BrowserIamSdk {
     }): string;
     /** Build the user profile URL on the IAM server. */
     getUserProfileUrl(username: string): string;
+    /**
+     * Send a verification code to a phone or email destination.
+     *
+     * @param contact `{ phone, countryCode }` for SMS, `{ email }` for email.
+     * @param method  Casdoor method: `login`, `signup`, `forget`, `mfaSetup`, etc.
+     */
+    sendVerificationCode(contact: {
+        phone: string;
+        countryCode: string;
+    } | {
+        email: string;
+    }, method?: "login" | "signup" | "forget" | "mfaSetup"): Promise<{
+        ok: boolean;
+        error?: string;
+    }>;
+    /**
+     * Look up whether a phone number is registered. Returns `{ exists: false }`
+     * on 404 or unknown numbers; `{ exists: true }` when Casdoor confirms a user.
+     */
+    lookupPhoneUser(phone: string, countryCode: string): Promise<{
+        exists: boolean;
+        error?: string;
+    }>;
+    /**
+     * Casdoor REST signup. Returns the new user's id on success.
+     *
+     * Phone signup flow: send phoneCode via `sendVerificationCode`, then call
+     * this with the OTP in `phoneCode`. Casdoor verifies the code internally.
+     * Email signup flow: same with `email` + `emailCode`.
+     */
+    signup(params: {
+        method: "email" | "phone";
+        name: string;
+        username?: string;
+        email?: string;
+        phone?: string;
+        countryCode?: string;
+        password?: string;
+        emailCode?: string;
+        phoneCode?: string;
+    }): Promise<{
+        id?: string;
+        ok: boolean;
+        error?: string;
+    }>;
+    /**
+     * REST login that returns an authorization code (Casdoor `/login`).
+     *
+     * Use this when you want the caller to drive the PKCE flow without a
+     * full redirect — collect credentials in your own UI, get a code back,
+     * then call `exchangeCodeForToken` to land tokens.
+     */
+    loginWithCredentials(params: {
+        username: string;
+        password: string;
+        type?: "code" | "token";
+        redirectUri?: string;
+    }): Promise<{
+        code?: string;
+        ok: boolean;
+        error?: string;
+    }>;
+    /**
+     * Exchange an authorization code for tokens using the stored PKCE verifier.
+     * Pairs with `loginWithCredentials` for a code → tokens round-trip.
+     */
+    exchangeCodeForToken(code: string, redirectUri?: string): Promise<TokenResponse>;
+    /**
+     * Phone OTP login: tries the numbered username variants Casdoor accepts
+     * (`{phone}`, `{countryCode}{phone}`), exchanges the resulting code for
+     * tokens. Returns the token response, or throws on failure.
+     */
+    loginWithPhoneOTP(params: {
+        phone: string;
+        countryCode: string;
+        code: string;
+        redirectUri?: string;
+    }): Promise<TokenResponse>;
+    /**
+     * Logout via Casdoor REST `/logout` (clears server-side session) and
+     * the local storage.
+     */
+    logout(): Promise<void>;
 }
 //# sourceMappingURL=browser.d.ts.map

package/dist/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAiB,MAAM,YAAY,CAAC;AAmB1E,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG;IACzC,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,cAAc,CAA8B;gBAExC,MAAM,EAAE,gBAAgB;YAStB,YAAY;IAqC1B;;;;;OAKG;IACG,cAAc,CAAC,MAAM,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B3F;;;;;;OAMG;IACG,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAgFlE,+DAA+D;IACzD,kBAAkB,IAAI,OAAO,CAAC,aAAa,CAAC;IAqClD;;;OAGG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC3C,GAAG,OAAO,CAAC,aAAa,CAAC;IAiE1B;;;;OAIG;IACG,YAAY,CAAC,SAAS,SAAO,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA4DnE,OAAO,CAAC,WAAW;IAcnB,oDAAoD;IACpD,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B,oCAAoC;IACpC,eAAe,IAAI,MAAM,GAAG,IAAI;IAIhC,+BAA+B;IAC/B,UAAU,IAAI,MAAM,GAAG,IAAI;IAI3B,mDAAmD;IACnD,cAAc,IAAI,OAAO;IAMzB;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAgBnD,wCAAwC;IACxC,WAAW,IAAI,IAAI;IAanB,qFAAqF;IAC/E,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAsBrD,+CAA+C;IAC/C,YAAY,CAAC,MAAM,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM;IAW3D,oDAAoD;IACpD,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;CAK5C"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAiB,MAAM,YAAY,CAAC;AAmB1E,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG;IAClC,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,qBAAa,GAAG;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,cAAc,CAA8B;gBAExC,MAAM,EAAE,SAAS;YASf,YAAY;IAqC1B;;;;;OAKG;IACG,cAAc,CAAC,MAAM,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B3F;;;;;;OAMG;IACG,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAgFlE,+DAA+D;IACzD,kBAAkB,IAAI,OAAO,CAAC,aAAa,CAAC;IAqClD;;;OAGG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC3C,GAAG,OAAO,CAAC,aAAa,CAAC;IAiE1B;;;;OAIG;IACG,YAAY,CAAC,SAAS,SAAO,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA4DnE,OAAO,CAAC,WAAW;IAcnB,oDAAoD;IACpD,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B,oCAAoC;IACpC,eAAe,IAAI,MAAM,GAAG,IAAI;IAIhC,+BAA+B;IAC/B,UAAU,IAAI,MAAM,GAAG,IAAI;IAI3B,mDAAmD;IACnD,cAAc,IAAI,OAAO;IAMzB;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAgBnD,wCAAwC;IACxC,WAAW,IAAI,IAAI;IAanB,qFAAqF;IAC/E,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAsBrD,+CAA+C;IAC/C,YAAY,CAAC,MAAM,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM;IAW3D,oDAAoD;IACpD,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAqB3C;;;;;OAKG;IACG,oBAAoB,CACxB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EACnE,MAAM,GAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAoB,GAC3D,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA4B3C;;;OAGG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAgBvG;;;;;;OAMG;IACG,MAAM,CAAC,MAAM,EAAE;QACnB,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAiCzD;;;;;;OAMG;IACG,oBAAoB,CAAC,MAAM,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA6B3D;;;OAGG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAiCtF;;;;OAIG;IACG,iBAAiB,CAAC,MAAM,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,aAAa,CAAC;IAiB1B;;;OAGG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAY9B"}

package/dist/browser.js

@@ -4,9 +4,9 @@
  * Provides PKCE-based login redirect, code exchange, token refresh,
  * popup signin, and silent signin for single-page applications.
  *
- * Adapted and modernized from casdoor-js-sdk.
+ * Adapted and modernized for Hanzo IAM.
  */
-import { generatePkceChallenge, generateState } from "./pkce.js";
+import { generatePKCEChallenge, generateState } from "./pkce.js";
 // ---------------------------------------------------------------------------
 // Storage keys
 // ---------------------------------------------------------------------------
@@ -17,7 +17,7 @@ const KEY_ACCESS_TOKEN = `${STORAGE_PREFIX}access_token`;
 const KEY_REFRESH_TOKEN = `${STORAGE_PREFIX}refresh_token`;
 const KEY_ID_TOKEN = `${STORAGE_PREFIX}id_token`;
 const KEY_EXPIRES_AT = `${STORAGE_PREFIX}expires_at`;
-export class BrowserIamSdk {
+export class IAM {
     config;
     storage;
     discoveryCache = null;
@@ -34,7 +34,7 @@ export class BrowserIamSdk {
         const baseUrl = this.config.serverUrl.replace(/\/+$/, "");
         // Try fetching the OIDC discovery document. If it fails (e.g. due to
         // CORS when the IAM server doesn't send Access-Control-Allow-Origin),
-        // construct a fallback from well-known Casdoor/Hanzo IAM endpoint paths.
+        // construct a fallback from well-known Hanzo IAM endpoint paths.
         try {
             const res = await fetch(`${baseUrl}/.well-known/openid-configuration`, {
                 headers: { Accept: "application/json" },
@@ -49,7 +49,7 @@ export class BrowserIamSdk {
         }
         this.discoveryCache = {
             issuer: baseUrl,
-            authorization_endpoint: `${baseUrl}/login/oauth/authorize`,
+            authorization_endpoint: `${baseUrl}/oauth/authorize`,
             token_endpoint: `${baseUrl}/oauth/token`,
             userinfo_endpoint: `${baseUrl}/oauth/userinfo`,
             jwks_uri: `${baseUrl}/.well-known/jwks`,
@@ -70,7 +70,7 @@ export class BrowserIamSdk {
      */
     async signinRedirect(params) {
         const discovery = await this.getDiscovery();
-        const { codeVerifier, codeChallenge } = await generatePkceChallenge();
+        const { codeVerifier, codeChallenge } = await generatePKCEChallenge();
         const state = generateState();
         this.storage.setItem(KEY_STATE, state);
         this.storage.setItem(KEY_CODE_VERIFIER, codeVerifier);
@@ -202,7 +202,7 @@ export class BrowserIamSdk {
      */
     async signinPopup(params) {
         const discovery = await this.getDiscovery();
-        const { codeVerifier, codeChallenge } = await generatePkceChallenge();
+        const { codeVerifier, codeChallenge } = await generatePKCEChallenge();
         const state = generateState();
         this.storage.setItem(KEY_STATE, state);
         this.storage.setItem(KEY_CODE_VERIFIER, codeVerifier);
@@ -260,7 +260,7 @@ export class BrowserIamSdk {
      */
     async signinSilent(timeoutMs = 5000) {
         const discovery = await this.getDiscovery();
-        const { codeVerifier, codeChallenge } = await generatePkceChallenge();
+        const { codeVerifier, codeChallenge } = await generatePKCEChallenge();
         const state = generateState();
         this.storage.setItem(KEY_STATE, state);
         this.storage.setItem(KEY_CODE_VERIFIER, codeVerifier);
@@ -409,5 +409,226 @@ export class BrowserIamSdk {
         const org = this.config.orgName ?? "built-in";
         return `${base}/users/${org}/${username}`;
     }
+    // -----------------------------------------------------------------------
+    // Casdoor REST surface (signup, OTP, REST login, phone lookup)
+    //
+    // The OIDC layer covers redirect/PKCE, token exchange, refresh, userinfo.
+    // These methods cover the Casdoor-native endpoints that don't have an OIDC
+    // analogue: phone/email OTP, custom signup with verification codes, and
+    // direct REST login that returns an authorization code in one round-trip
+    // (used as the bridge between OTP collection and `exchangeCode`).
+    //
+    // All paths are gateway-canonical (`/login`, `/signup`,
+    // `/send-verification-code`, `/get-phone-user`) — point `serverUrl` at the
+    // gateway prefix (e.g. `https://api.dev.satschel.com/v1/iam`) and the
+    // gateway proxies to Casdoor's `/api/*` internally.
+    // -----------------------------------------------------------------------
+    /**
+     * Send a verification code to a phone or email destination.
+     *
+     * @param contact `{ phone, countryCode }` for SMS, `{ email }` for email.
+     * @param method  Casdoor method: `login`, `signup`, `forget`, `mfaSetup`, etc.
+     */
+    async sendVerificationCode(contact, method = "login") {
+        const isPhone = "phone" in contact;
+        const dest = isPhone ? contact.phone : contact.email;
+        const params = {
+            applicationId: `admin/${this.config.appName ?? "app"}`,
+            dest,
+            type: isPhone ? "phone" : "email",
+            method,
+            captchaType: "none",
+            captchaToken: "",
+        };
+        if (isPhone)
+            params.countryCode = contact.countryCode;
+        const url = `${this.config.serverUrl.replace(/\/+$/, "")}/send-verification-code`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams(params).toString(),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (data.status === "ok")
+            return { ok: true };
+        const msg = data.msg || `send-verification-code failed (${res.status})`;
+        // Provider misconfig is treated as soft success in dev — Casdoor still
+        // generates the code and stores it for verification.
+        if (msg.includes("SMS provider") || msg.includes("provider"))
+            return { ok: true };
+        return { ok: false, error: msg };
+    }
+    /**
+     * Look up whether a phone number is registered. Returns `{ exists: false }`
+     * on 404 or unknown numbers; `{ exists: true }` when Casdoor confirms a user.
+     */
+    async lookupPhoneUser(phone, countryCode) {
+        const url = `${this.config.serverUrl.replace(/\/+$/, "")}/get-phone-user`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                application: this.config.appName ?? "app",
+                phone,
+                countryCode,
+            }),
+        });
+        if (res.status === 404)
+            return { exists: false };
+        if (!res.ok)
+            return { exists: false, error: `lookupPhoneUser failed (${res.status})` };
+        return { exists: true };
+    }
+    /**
+     * Casdoor REST signup. Returns the new user's id on success.
+     *
+     * Phone signup flow: send phoneCode via `sendVerificationCode`, then call
+     * this with the OTP in `phoneCode`. Casdoor verifies the code internally.
+     * Email signup flow: same with `email` + `emailCode`.
+     */
+    async signup(params) {
+        const username = params.username ?? params.name;
+        const password = params.password ?? `Liq${Date.now()}!`;
+        const body = {
+            application: this.config.appName ?? "app",
+            organization: this.config.orgName ?? "built-in",
+            name: params.name,
+            username,
+            password,
+            confirm: password,
+            agreement: true,
+        };
+        if (params.method === "email") {
+            body.email = params.email;
+            if (params.emailCode)
+                body.emailCode = params.emailCode;
+        }
+        else {
+            body.phone = params.phone;
+            body.countryCode = params.countryCode;
+            if (params.phoneCode)
+                body.phoneCode = params.phoneCode;
+            if (params.email)
+                body.email = params.email;
+            if (params.emailCode)
+                body.emailCode = params.emailCode;
+        }
+        const url = `${this.config.serverUrl.replace(/\/+$/, "")}/signup`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (data.status === "ok")
+            return { ok: true, id: data.data2 || data.data };
+        return { ok: false, error: data.msg || `signup failed (${res.status})` };
+    }
+    /**
+     * REST login that returns an authorization code (Casdoor `/login`).
+     *
+     * Use this when you want the caller to drive the PKCE flow without a
+     * full redirect — collect credentials in your own UI, get a code back,
+     * then call `exchangeCodeForToken` to land tokens.
+     */
+    async loginWithCredentials(params) {
+        const { codeVerifier, codeChallenge } = await generatePKCEChallenge();
+        this.storage.setItem(KEY_CODE_VERIFIER, codeVerifier);
+        const url = new URL(`${this.config.serverUrl.replace(/\/+$/, "")}/login`);
+        url.searchParams.set("code_challenge", codeChallenge);
+        url.searchParams.set("code_challenge_method", "S256");
+        const res = await fetch(url.toString(), {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                application: this.config.appName ?? "app",
+                organization: this.config.orgName ?? "built-in",
+                username: params.username,
+                password: params.password,
+                type: params.type ?? "code",
+                clientId: this.config.clientId,
+                redirectUri: params.redirectUri ?? this.config.redirectUri,
+                codeChallenge,
+                codeChallengeMethod: "S256",
+                autoSignin: true,
+            }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (data.status === "ok" && data.data)
+            return { ok: true, code: data.data };
+        return { ok: false, error: data.msg || `login failed (${res.status})` };
+    }
+    /**
+     * Exchange an authorization code for tokens using the stored PKCE verifier.
+     * Pairs with `loginWithCredentials` for a code → tokens round-trip.
+     */
+    async exchangeCodeForToken(code, redirectUri) {
+        const codeVerifier = this.storage.getItem(KEY_CODE_VERIFIER);
+        if (!codeVerifier) {
+            throw new Error("Missing PKCE verifier — call loginWithCredentials() first");
+        }
+        this.storage.removeItem(KEY_CODE_VERIFIER);
+        const discovery = await this.getDiscovery();
+        const tokenUrl = this.config.proxyBaseUrl
+            ? `${this.config.proxyBaseUrl.replace(/\/+$/, "")}/auth/token`
+            : discovery.token_endpoint;
+        const body = new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: this.config.clientId,
+            code,
+            redirect_uri: redirectUri ?? this.config.redirectUri,
+            code_verifier: codeVerifier,
+        });
+        const res = await fetch(tokenUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: body.toString(),
+        });
+        if (!res.ok) {
+            const err = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));
+            throw new Error(err.error_description || err.error || "Token exchange failed");
+        }
+        const tokens = (await res.json());
+        this.storeTokens(tokens);
+        return tokens;
+    }
+    /**
+     * Phone OTP login: tries the numbered username variants Casdoor accepts
+     * (`{phone}`, `{countryCode}{phone}`), exchanges the resulting code for
+     * tokens. Returns the token response, or throws on failure.
+     */
+    async loginWithPhoneOTP(params) {
+        const usernames = [params.phone, `${params.countryCode}${params.phone}`];
+        let lastError = "";
+        for (const username of usernames) {
+            const result = await this.loginWithCredentials({
+                username,
+                password: params.code,
+                redirectUri: params.redirectUri,
+            });
+            if (result.ok && result.code) {
+                return this.exchangeCodeForToken(result.code, params.redirectUri);
+            }
+            lastError = result.error ?? lastError;
+        }
+        throw new Error(lastError || "Phone OTP login failed");
+    }
+    /**
+     * Logout via Casdoor REST `/logout` (clears server-side session) and
+     * the local storage.
+     */
+    async logout() {
+        const token = this.storage.getItem(KEY_ACCESS_TOKEN);
+        try {
+            await fetch(`${this.config.serverUrl.replace(/\/+$/, "")}/oauth/logout`, {
+                method: "POST",
+                headers: token ? { Authorization: `Bearer ${token}` } : {},
+            });
+        }
+        catch {
+            // best-effort — local cleanup is what matters
+        }
+        this.clearTokens();
+    }
 }
 //# sourceMappingURL=browser.js.map