@kaiz11/stack-client 0.0.14

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,aAAa;AACb,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,cAAc;AACd,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,gBAAgB;AAChB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA2DlD,iCAAiC;AACjC,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC"}

package/dist/auth/methods/admin.d.ts

@@ -0,0 +1,59 @@
+import type { HttpClient } from "../../lib/http.js";
+import type { User } from "../types.js";
+/**
+ * Admin invite options
+ */
+export interface AdminInviteOptions {
+    /** Email address of the user to invite */
+    email: string;
+    /** Custom user data to include with the invitation */
+    data?: Record<string, unknown>;
+    /** URL to redirect to after the user accepts the invite */
+    redirectTo?: string;
+}
+/**
+ * Invited user response
+ */
+export interface InvitedUser extends User {
+    /** Timestamp when the invitation was sent */
+    invitedAt: string | null;
+    /** Timestamp when the confirmation email was sent */
+    confirmationSentAt: string | null;
+}
+/**
+ * Admin authentication methods
+ *
+ * These methods require a service_role JWT and are for server-side use only.
+ */
+export declare class AdminMethods {
+    private readonly http;
+    private readonly tenantId;
+    constructor(http: HttpClient, tenantId: string);
+    /**
+     * Invite a new user by email
+     *
+     * Sends an invitation email to the specified address. The user will receive
+     * a link to complete their account setup.
+     *
+     * **Requires service_role JWT** - This method will fail with a 403 error
+     * if called with a regular user token.
+     *
+     * @example
+     * ```typescript
+     * // Server-side with service role token
+     * const adminClient = createTenantClient({
+     *   baseUrl: "https://stack.example.com",
+     *   tenantId: "my-tenant",
+     *   tokenStore: "memory",
+     *   accessToken: process.env.SERVICE_ROLE_TOKEN,
+     * });
+     *
+     * const invitedUser = await adminClient.auth.admin.inviteUserByEmail({
+     *   email: "newuser@example.com",
+     *   data: { role: "admin", department: "Engineering" },
+     * });
+     * ```
+     */
+    inviteUserByEmail(options: AdminInviteOptions): Promise<InvitedUser>;
+}
+//# sourceMappingURL=admin.d.ts.map

package/dist/auth/methods/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/auth/methods/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,KAAK,EAAc,IAAI,EAAE,MAAM,aAAa,CAAC;AAGpD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAY,SAAQ,IAAI;IACvC,6CAA6C;IAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qDAAqD;IACrD,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAUD;;;;GAIG;AACH,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM;IAGnC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC;CAe3E"}

package/dist/auth/methods/admin.js

@@ -0,0 +1,55 @@
+import { authPath } from "../../lib/paths.js";
+import { normalizeUser } from "../types.js";
+/**
+ * Admin authentication methods
+ *
+ * These methods require a service_role JWT and are for server-side use only.
+ */
+export class AdminMethods {
+    http;
+    tenantId;
+    constructor(http, tenantId) {
+        this.http = http;
+        this.tenantId = tenantId;
+    }
+    /**
+     * Invite a new user by email
+     *
+     * Sends an invitation email to the specified address. The user will receive
+     * a link to complete their account setup.
+     *
+     * **Requires service_role JWT** - This method will fail with a 403 error
+     * if called with a regular user token.
+     *
+     * @example
+     * ```typescript
+     * // Server-side with service role token
+     * const adminClient = createTenantClient({
+     *   baseUrl: "https://stack.example.com",
+     *   tenantId: "my-tenant",
+     *   tokenStore: "memory",
+     *   accessToken: process.env.SERVICE_ROLE_TOKEN,
+     * });
+     *
+     * const invitedUser = await adminClient.auth.admin.inviteUserByEmail({
+     *   email: "newuser@example.com",
+     *   data: { role: "admin", department: "Engineering" },
+     * });
+     * ```
+     */
+    async inviteUserByEmail(options) {
+        const path = authPath(this.tenantId, "/invite");
+        const response = await this.http.post(path, {
+            email: options.email,
+            data: options.data,
+            redirect_to: options.redirectTo,
+        });
+        const user = normalizeUser(response);
+        return {
+            ...user,
+            invitedAt: response.invited_at ?? null,
+            confirmationSentAt: response.confirmation_sent_at ?? null,
+        };
+    }
+}
+//# sourceMappingURL=admin.js.map

package/dist/auth/methods/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../src/auth/methods/admin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAgC5C;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAEJ;IACA;IAFnB,YACmB,IAAgB,EAChB,QAAgB;QADhB,SAAI,GAAJ,IAAI,CAAY;QAChB,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAA2B;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAuB,IAAI,EAAE;YAChE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,UAAU;SAChC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI;YACtC,kBAAkB,EAAE,QAAQ,CAAC,oBAAoB,IAAI,IAAI;SAC1D,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/methods/index.d.ts

@@ -0,0 +1,9 @@
+export { PasswordMethods } from "./password.js";
+export { OAuthMethods } from "./oauth.js";
+export { MagicLinkMethods } from "./magic-link.js";
+export { OtpMethods } from "./otp.js";
+export { RecoveryMethods } from "./recovery.js";
+export { MfaMethods } from "./mfa.js";
+export { AdminMethods } from "./admin.js";
+export type { AdminInviteOptions, InvitedUser } from "./admin.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/methods/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/methods/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/auth/methods/index.js

@@ -0,0 +1,8 @@
+export { PasswordMethods } from "./password.js";
+export { OAuthMethods } from "./oauth.js";
+export { MagicLinkMethods } from "./magic-link.js";
+export { OtpMethods } from "./otp.js";
+export { RecoveryMethods } from "./recovery.js";
+export { MfaMethods } from "./mfa.js";
+export { AdminMethods } from "./admin.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/methods/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/methods/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/auth/methods/magic-link.d.ts

@@ -0,0 +1,27 @@
+import type { HttpClient } from "../../lib/http.js";
+import type { MagicLinkOptions } from "../types.js";
+/**
+ * Magic link authentication methods
+ */
+export declare class MagicLinkMethods {
+    private readonly http;
+    private readonly tenantId;
+    constructor(http: HttpClient, tenantId: string);
+    /**
+     * Send a magic link to the user's email
+     *
+     * The user will receive an email with a link to sign in.
+     * When they click the link, they'll be redirected to your app with a session.
+     *
+     * @example
+     * ```typescript
+     * await client.auth.signInWithMagicLink({
+     *   email: "user@example.com",
+     *   redirectTo: "https://myapp.com/auth/callback",
+     * });
+     * // User receives email, clicks link, lands on callback URL with session
+     * ```
+     */
+    signInWithMagicLink(options: MagicLinkOptions): Promise<void>;
+}
+//# sourceMappingURL=magic-link.d.ts.map

package/dist/auth/methods/magic-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-link.d.ts","sourceRoot":"","sources":["../../../src/auth/methods/magic-link.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;GAEG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM;IAGnC;;;;;;;;;;;;;;OAcG;IACG,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;CAcpE"}

package/dist/auth/methods/magic-link.js

@@ -0,0 +1,37 @@
+import { authPath } from "../../lib/paths.js";
+/**
+ * Magic link authentication methods
+ */
+export class MagicLinkMethods {
+    http;
+    tenantId;
+    constructor(http, tenantId) {
+        this.http = http;
+        this.tenantId = tenantId;
+    }
+    /**
+     * Send a magic link to the user's email
+     *
+     * The user will receive an email with a link to sign in.
+     * When they click the link, they'll be redirected to your app with a session.
+     *
+     * @example
+     * ```typescript
+     * await client.auth.signInWithMagicLink({
+     *   email: "user@example.com",
+     *   redirectTo: "https://myapp.com/auth/callback",
+     * });
+     * // User receives email, clicks link, lands on callback URL with session
+     * ```
+     */
+    async signInWithMagicLink(options) {
+        const path = authPath(this.tenantId, "/magiclink");
+        await this.http.post(path, {
+            email: options.email,
+            redirect_to: options.redirectTo,
+            create_user: options.shouldCreateUser ?? false,
+            data: options.data,
+        }, { noAuth: true });
+    }
+}
+//# sourceMappingURL=magic-link.js.map

package/dist/auth/methods/magic-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-link.js","sourceRoot":"","sources":["../../../src/auth/methods/magic-link.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAU9C;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAER;IACA;IAFnB,YACmB,IAAgB,EAChB,QAAgB;QADhB,SAAI,GAAJ,IAAI,CAAY;QAChB,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAAyB;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAEnD,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAClB,IAAI,EACJ;YACE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,UAAU;YAC/B,WAAW,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;YAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,EACD,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/methods/mfa.d.ts

@@ -0,0 +1,92 @@
+import type { HttpClient } from "../../lib/http.js";
+import type { TokenManager } from "../token-manager.js";
+import type { EnrollFactorOptions, EnrollFactorResult, ChallengeFactorOptions, ChallengeFactorResult, VerifyFactorOptions, Factor, Session } from "../types.js";
+/**
+ * MFA (Multi-Factor Authentication) methods
+ */
+export declare class MfaMethods {
+    private readonly http;
+    private readonly tokenManager;
+    private readonly tenantId;
+    constructor(http: HttpClient, tokenManager: TokenManager, tenantId: string);
+    /**
+     * Enroll a new MFA factor
+     *
+     * @example
+     * ```typescript
+     * // Enroll TOTP (authenticator app)
+     * const { id, totpUri, qrCode } = await client.auth.mfa.enroll({
+     *   type: "totp",
+     *   friendlyName: "My Authenticator",
+     * });
+     *
+     * // Display QR code for user to scan
+     * // Then verify with challenge/verify flow
+     * ```
+     */
+    enroll(options: EnrollFactorOptions): Promise<EnrollFactorResult>;
+    /**
+     * Create a challenge for an MFA factor
+     *
+     * @example
+     * ```typescript
+     * const { id: challengeId, expiresAt } = await client.auth.mfa.challenge({
+     *   factorId: "factor-id",
+     * });
+     *
+     * // User enters code from authenticator app
+     * const session = await client.auth.mfa.verify({
+     *   factorId: "factor-id",
+     *   challengeId,
+     *   code: "123456",
+     * });
+     * ```
+     */
+    challenge(options: ChallengeFactorOptions): Promise<ChallengeFactorResult>;
+    /**
+     * Verify an MFA challenge
+     *
+     * @example
+     * ```typescript
+     * const session = await client.auth.mfa.verify({
+     *   factorId: "factor-id",
+     *   challengeId: "challenge-id",
+     *   code: "123456",
+     * });
+     * ```
+     */
+    verify(options: VerifyFactorOptions): Promise<Session>;
+    /**
+     * Unenroll (remove) an MFA factor
+     *
+     * @example
+     * ```typescript
+     * await client.auth.mfa.unenroll("factor-id");
+     * ```
+     */
+    unenroll(factorId: string): Promise<void>;
+    /**
+     * List all enrolled MFA factors
+     *
+     * @example
+     * ```typescript
+     * const factors = await client.auth.mfa.listFactors();
+     * for (const factor of factors) {
+     *   console.log(factor.type, factor.friendlyName, factor.status);
+     * }
+     * ```
+     */
+    listFactors(): Promise<Factor[]>;
+    /**
+     * Get the authenticator assurance level
+     *
+     * Returns the current AAL (Authenticator Assurance Level):
+     * - aal1: Single factor (password only)
+     * - aal2: Two factors (password + MFA)
+     */
+    getAuthenticatorAssuranceLevel(): {
+        currentLevel: "aal1" | "aal2" | null;
+        nextLevel: "aal1" | "aal2" | null;
+    };
+}
+//# sourceMappingURL=mfa.d.ts.map

package/dist/auth/methods/mfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../../../src/auth/methods/mfa.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,MAAM,EAEN,OAAO,EAGR,MAAM,aAAa,CAAC;AAwBrB;;GAEG;AACH,qBAAa,UAAU;IAEnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,IAAI,EAAE,UAAU,EAChB,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,MAAM;IAGnC;;;;;;;;;;;;;;OAcG;IACG,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiBvE;;;;;;;;;;;;;;;;OAgBG;IACG,SAAS,CACb,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC;IAgBjC;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAa5D;;;;;;;OAOG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/C;;;;;;;;;;OAUG;IACG,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAMtC;;;;;;OAMG;IACH,8BAA8B,IAAI;QAChC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;QACrC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;KACnC;CA0BF"}

package/dist/auth/methods/mfa.js

@@ -0,0 +1,153 @@
+import { authPath } from "../../lib/paths.js";
+import { normalizeSession, normalizeFactor } from "../types.js";
+/**
+ * MFA (Multi-Factor Authentication) methods
+ */
+export class MfaMethods {
+    http;
+    tokenManager;
+    tenantId;
+    constructor(http, tokenManager, tenantId) {
+        this.http = http;
+        this.tokenManager = tokenManager;
+        this.tenantId = tenantId;
+    }
+    /**
+     * Enroll a new MFA factor
+     *
+     * @example
+     * ```typescript
+     * // Enroll TOTP (authenticator app)
+     * const { id, totpUri, qrCode } = await client.auth.mfa.enroll({
+     *   type: "totp",
+     *   friendlyName: "My Authenticator",
+     * });
+     *
+     * // Display QR code for user to scan
+     * // Then verify with challenge/verify flow
+     * ```
+     */
+    async enroll(options) {
+        const path = authPath(this.tenantId, "/factors");
+        const response = await this.http.post(path, {
+            factor_type: options.type,
+            friendly_name: options.friendlyName,
+            phone: options.phone,
+        });
+        return {
+            id: response.id,
+            type: options.type,
+            totpUri: response.totp?.uri,
+            qrCode: response.totp?.qr_code,
+        };
+    }
+    /**
+     * Create a challenge for an MFA factor
+     *
+     * @example
+     * ```typescript
+     * const { id: challengeId, expiresAt } = await client.auth.mfa.challenge({
+     *   factorId: "factor-id",
+     * });
+     *
+     * // User enters code from authenticator app
+     * const session = await client.auth.mfa.verify({
+     *   factorId: "factor-id",
+     *   challengeId,
+     *   code: "123456",
+     * });
+     * ```
+     */
+    async challenge(options) {
+        const path = authPath(this.tenantId, `/factors/${options.factorId}/challenge`);
+        const response = await this.http.post(path, {
+            channel: options.channel,
+        });
+        return {
+            id: response.id,
+            expiresAt: response.expires_at,
+        };
+    }
+    /**
+     * Verify an MFA challenge
+     *
+     * @example
+     * ```typescript
+     * const session = await client.auth.mfa.verify({
+     *   factorId: "factor-id",
+     *   challengeId: "challenge-id",
+     *   code: "123456",
+     * });
+     * ```
+     */
+    async verify(options) {
+        const path = authPath(this.tenantId, `/factors/${options.factorId}/verify`);
+        const response = await this.http.post(path, {
+            challenge_id: options.challengeId,
+            code: options.code,
+        });
+        const session = normalizeSession(response);
+        this.tokenManager.setSession(session, "MFA_CHALLENGE_VERIFIED");
+        return session;
+    }
+    /**
+     * Unenroll (remove) an MFA factor
+     *
+     * @example
+     * ```typescript
+     * await client.auth.mfa.unenroll("factor-id");
+     * ```
+     */
+    async unenroll(factorId) {
+        const path = authPath(this.tenantId, `/factors/${factorId}`);
+        await this.http.delete(path);
+    }
+    /**
+     * List all enrolled MFA factors
+     *
+     * @example
+     * ```typescript
+     * const factors = await client.auth.mfa.listFactors();
+     * for (const factor of factors) {
+     *   console.log(factor.type, factor.friendlyName, factor.status);
+     * }
+     * ```
+     */
+    async listFactors() {
+        const path = authPath(this.tenantId, "/factors");
+        const response = await this.http.get(path);
+        return response.map(normalizeFactor);
+    }
+    /**
+     * Get the authenticator assurance level
+     *
+     * Returns the current AAL (Authenticator Assurance Level):
+     * - aal1: Single factor (password only)
+     * - aal2: Two factors (password + MFA)
+     */
+    getAuthenticatorAssuranceLevel() {
+        const session = this.tokenManager.getSession();
+        if (!session) {
+            return { currentLevel: null, nextLevel: null };
+        }
+        // Decode JWT to check AAL claim
+        try {
+            const parts = session.accessToken.split(".");
+            if (parts.length !== 3) {
+                return { currentLevel: "aal1", nextLevel: null };
+            }
+            const payload = JSON.parse(atob(parts[1]));
+            const currentLevel = payload.aal || "aal1";
+            const factors = session.user.factors || [];
+            const hasVerifiedFactor = factors.some((f) => f.status === "verified");
+            return {
+                currentLevel,
+                nextLevel: currentLevel === "aal1" && hasVerifiedFactor ? "aal2" : null,
+            };
+        }
+        catch {
+            return { currentLevel: "aal1", nextLevel: null };
+        }
+    }
+}
+//# sourceMappingURL=mfa.js.map

package/dist/auth/methods/mfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.js","sourceRoot":"","sources":["../../../src/auth/methods/mfa.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAc9C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAuBhE;;GAEG;AACH,MAAM,OAAO,UAAU;IAEF;IACA;IACA;IAHnB,YACmB,IAAgB,EAChB,YAA0B,EAC1B,QAAgB;QAFhB,SAAI,GAAJ,IAAI,CAAY;QAChB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,MAAM,CAAC,OAA4B;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAuB,IAAI,EAAE;YAChE,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,IAAI,EAAE,OAAO,CAAC,IAAkB;YAChC,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG;YAC3B,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,SAAS,CACb,OAA+B;QAE/B,MAAM,IAAI,GAAG,QAAQ,CACnB,IAAI,CAAC,QAAQ,EACb,YAAY,OAAO,CAAC,QAAQ,YAAY,CACzC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAA0B,IAAI,EAAE;YACnE,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,SAAS,EAAE,QAAQ,CAAC,UAAU;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,MAAM,CAAC,OAA4B;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,OAAO,CAAC,QAAQ,SAAS,CAAC,CAAC;QAE5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,IAAI,EAAE;YAC/D,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;QAChE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,QAAQ,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAiB,IAAI,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,8BAA8B;QAI5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACnD,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC;YAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YAC3C,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;YAEvE,OAAO;gBACL,YAAY;gBACZ,SAAS,EAAE,YAAY,KAAK,MAAM,IAAI,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;aACxE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;CACF"}

package/dist/auth/methods/oauth.d.ts

@@ -0,0 +1,62 @@
+import type { HttpClient } from "../../lib/http.js";
+import type { TokenManager } from "../token-manager.js";
+import type { OAuthSignInOptions, Session } from "../types.js";
+/**
+ * OAuth authentication methods
+ */
+export declare class OAuthMethods {
+    private readonly http;
+    private readonly tokenManager;
+    private readonly tenantId;
+    constructor(http: HttpClient, tokenManager: TokenManager, tenantId: string);
+    /**
+     * Get the base URL for OAuth redirects
+     */
+    private getBaseUrl;
+    /**
+     * Sign in with OAuth provider
+     *
+     * In browser: Redirects to provider's auth page
+     * With skipBrowserRedirect: Returns URL for manual redirect
+     *
+     * @example
+     * ```typescript
+     * // Browser redirect
+     * await client.auth.signInWithOAuth({
+     *   provider: "google",
+     *   redirectTo: "https://myapp.com/auth/callback",
+     * });
+     *
+     * // Get URL without redirect
+     * const { url } = await client.auth.signInWithOAuth({
+     *   provider: "github",
+     *   skipBrowserRedirect: true,
+     * });
+     * ```
+     */
+    signInWithOAuth(options: OAuthSignInOptions): Promise<{
+        url: string;
+        provider: string;
+    }>;
+    /**
+     * Handle OAuth callback
+     *
+     * Call this on your callback page to exchange the authorization code for a session.
+     * Also handles email verification callbacks which use URL hash fragments.
+     *
+     * @example
+     * ```typescript
+     * // On /auth/callback page or in AuthProvider on mount
+     * const session = await client.auth.handleOAuthCallback();
+     * if (session) {
+     *   router.push("/dashboard");
+     * }
+     * ```
+     */
+    handleOAuthCallback(): Promise<Session | null>;
+    /**
+     * Exchange authorization code for session (PKCE flow)
+     */
+    private exchangeCodeForSession;
+}
+//# sourceMappingURL=oauth.d.ts.map

package/dist/auth/methods/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/auth/methods/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,kBAAkB,EAClB,OAAO,EAER,MAAM,aAAa,CAAC;AAGrB;;GAEG;AACH,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,IAAI,EAAE,UAAU,EAChB,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,MAAM;IAGnC;;OAEG;IACH,OAAO,CAAC,UAAU;IAIlB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,eAAe,CACnB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IA2B7C;;;;;;;;;;;;;;OAcG;IACG,mBAAmB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAkFpD;;OAEG;YACW,sBAAsB;CAcrC"}