@lowdefy/actions-core 6.1.0 → 7.0.0

package/dist/actions/MagicLinkVerify/schema.js

@@ -0,0 +1,64 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ const callbackTargetProperties = {
+    home: {
+        type: 'boolean',
+        description: "Land on the app's home page."
+    },
+    pageId: {
+        type: 'string',
+        description: 'The pageId to land on.'
+    },
+    url: {
+        type: 'string',
+        description: 'The URL to land on. An absolute URL is not basePath-prefixed, so it can be an external landing page.'
+    },
+    urlQuery: {
+        type: 'object',
+        description: 'The urlQuery to set on the destination.'
+    },
+    pathParams: {
+        type: 'object',
+        description: "Values for the placeholders in the destination page's path, by placeholder name."
+    }
+};
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters for spending the magic-link token. All are optional: the sign-in email links to the landing page named by "auth.authPages.magicLink" with the token and the callback destinations already on its URL query, and this action reads its defaults from there. Set a parameter only to override what the email carried.',
+        properties: {
+            token: {
+                type: 'string',
+                description: 'The single-use magic-link token. Defaults to the "token" URL query parameter of the landing page. The action fails when neither is a string, because there is nothing to verify.'
+            },
+            callbackUrl: {
+                type: 'object',
+                description: 'Where a successful sign-in lands. Defaults to the "callbackURL" URL query parameter the sign-in email carried onto the landing page, and to BetterAuth\'s own default when that is absent too. "false" is not valid here - verification redirects through a hop the app does not control, so there is no staying put.',
+                properties: callbackTargetProperties
+            },
+            newUserCallbackUrl: {
+                type: 'object',
+                description: 'Where a sign-in that creates a new account lands, for a first-run or onboarding page. Defaults to the "newUserCallbackURL" URL query parameter, and to callbackUrl when neither is set.',
+                properties: callbackTargetProperties
+            },
+            errorCallbackUrl: {
+                type: 'object',
+                description: 'Where a failed verification lands, with the reason in "?error=". Defaults to the "errorCallbackURL" URL query parameter, then to the app\'s "auth.authPages.error" page.',
+                properties: callbackTargetProperties
+            }
+        }
+    }
+};

package/dist/actions/OAuthConsent/OAuthConsent.js

@@ -0,0 +1,24 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Approves or denies the pending OAuth authorization request. The signed
+// authorization query the consent page arrived with is not passed as params
+// - the auth client lifts it from the page URL, so the action must run
+// before any navigation drops that query. Returns the OAuth client's
+// redirect URI (carrying a code on accept, error=access_denied on deny) for
+// page config to navigate to.
+function OAuthConsent({ methods: { oauth2Consent }, params }) {
+    return oauth2Consent(params);
+}
+export default OAuthConsent;

package/dist/actions/OAuthConsent/schema.js

@@ -0,0 +1,38 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters for responding to the pending OAuth authorization request. The signed authorization query the consent page was redirected with is read from the page URL automatically, so the action must be called while the page still holds it.',
+        required: [
+            'accept'
+        ],
+        properties: {
+            accept: {
+                type: 'boolean',
+                description: 'Approve (true) or deny (false) the authorization request. On deny the returned redirect URI carries the access_denied OAuth error.'
+            },
+            scope: {
+                type: 'string',
+                description: 'Space-separated subset of the requested scopes to grant. When omitted, all requested scopes are granted.'
+            },
+            claims: {
+                type: 'object',
+                description: 'Subset of the requested OIDC claims to grant. When omitted, all requested claims are granted.'
+            }
+        }
+    }
+};

package/dist/actions/OAuthContinue/OAuthContinue.js

@@ -0,0 +1,27 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Resumes the pending OAuth authorization after the post-login choice - the
+// organization the grant acts in. The page runs SetActiveOrganization for the
+// chosen organization first, then this: the authorization server reads the
+// choice from the session's active organization and proceeds to consent (or
+// straight to the client when consent for that organization already stands).
+// The signed authorization query the page arrived with is not passed as
+// params - the auth client lifts it from the page URL, so the action must run
+// before any navigation drops that query. Returns the next URL for page
+// config to navigate to.
+function OAuthContinue({ methods: { oauth2Continue }, params }) {
+    return oauth2Continue(params);
+}
+export default OAuthContinue;

package/dist/actions/OAuthContinue/schema.js

@@ -0,0 +1,22 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters for resuming the pending OAuth authorization after the post-login organization choice. The signed authorization query the page was redirected with is read from the page URL automatically, so the action must be called while the page still holds it. Run SetActiveOrganization for the chosen organization first.',
+        properties: {}
+    }
+};

package/dist/actions/PasskeyDelete/PasskeyDelete.js

@@ -0,0 +1,18 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ function PasskeyDelete({ methods: { passkeyDelete }, params }) {
+    return passkeyDelete(params);
+}
+export default PasskeyDelete;

package/dist/actions/PasskeyDelete/schema.js

@@ -0,0 +1,16 @@
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters identifying the passkey to delete.',
+        required: [
+            'passkeyId'
+        ],
+        properties: {
+            passkeyId: {
+                type: 'string',
+                description: 'Id of the passkey to delete.'
+            }
+        }
+    }
+};

package/dist/actions/PasskeyRegister/PasskeyRegister.js

@@ -0,0 +1,21 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // The WebAuthn browser ceremony runs inside the action - the method fetches
+// the registration options, prompts the authenticator and verifies the
+// result. Returns the registered passkey as confirmation.
+function PasskeyRegister({ methods: { passkeyRegister }, params }) {
+    return passkeyRegister(params);
+}
+export default PasskeyRegister;

package/dist/actions/PasskeyRegister/schema.js

@@ -0,0 +1,21 @@
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the passkey register method.',
+        properties: {
+            name: {
+                type: 'string',
+                description: 'A display name for the passkey.'
+            },
+            authenticatorAttachment: {
+                type: 'string',
+                enum: [
+                    'platform',
+                    'cross-platform'
+                ],
+                description: 'Restrict the authenticator type used for registration.'
+            }
+        }
+    }
+};

package/dist/actions/PasskeySignIn/PasskeySignIn.js

@@ -0,0 +1,21 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Passkey sign-in - public. The WebAuthn assertion ceremony runs inside the
+// action (options fetch, navigator.credentials.get(), verification); the
+// method navigates to callbackUrl on the session-bearing success.
+function PasskeySignIn({ methods: { passkeySignIn }, params }) {
+    return passkeySignIn(params);
+}
+export default PasskeySignIn;

package/dist/actions/PasskeySignIn/schema.js

@@ -0,0 +1,59 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the passkey sign-in method.',
+        properties: {
+            callbackUrl: {
+                oneOf: [
+                    {
+                        type: 'object',
+                        description: "Structured callback target for where a successful passkey sign-in lands, basePath-prefixed. Defaults to the app's home page when omitted and no ?callbackUrl= query is present; a ?callbackUrl= query set by the unauthenticated-page redirect wins over that default, and this param wins over both.",
+                        properties: {
+                            home: {
+                                type: 'boolean',
+                                description: "Land on the app's home page."
+                            },
+                            pageId: {
+                                type: 'string',
+                                description: 'The pageId to land on.'
+                            },
+                            url: {
+                                type: 'string',
+                                description: 'The URL to land on. An absolute URL is not basePath-prefixed, so it can be an external landing page.'
+                            },
+                            urlQuery: {
+                                type: 'object',
+                                description: 'The urlQuery to set on the destination.'
+                            },
+                            pathParams: {
+                                type: 'object',
+                                description: "Values for the placeholders in the destination page's path, by placeholder name."
+                            }
+                        }
+                    },
+                    {
+                        enum: [
+                            false
+                        ],
+                        description: 'Do not navigate - the session store re-renders the page with the new user in place, for a re-authentication prompt in a modal or an embedded panel.'
+                    }
+                ]
+            }
+        }
+    }
+};

package/dist/actions/PasskeyUpdate/PasskeyUpdate.js

@@ -0,0 +1,18 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ function PasskeyUpdate({ methods: { passkeyUpdate }, params }) {
+    return passkeyUpdate(params);
+}
+export default PasskeyUpdate;

package/dist/actions/PasskeyUpdate/schema.js

@@ -0,0 +1,21 @@
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters identifying the passkey to rename and its new name.',
+        required: [
+            'passkeyId',
+            'name'
+        ],
+        properties: {
+            passkeyId: {
+                type: 'string',
+                description: 'Id of the passkey to rename.'
+            },
+            name: {
+                type: 'string',
+                description: 'New name for the passkey.'
+            }
+        }
+    }
+};

package/dist/actions/PhoneNumberSendOtp/PhoneNumberSendOtp.js

@@ -0,0 +1,20 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Sends a sign-in/verification OTP to the phone number over SMS, dispatched
+// through the app's "phone.otp.send" auth hook binding.
+function PhoneNumberSendOtp({ methods: { phoneNumberSendOtp }, params }) {
+    return phoneNumberSendOtp(params);
+}
+export default PhoneNumberSendOtp;

package/dist/actions/PhoneNumberSendOtp/schema.js

@@ -0,0 +1,20 @@
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the phone-number send-OTP method.',
+        required: [
+            'phoneNumber'
+        ],
+        properties: {
+            phoneNumber: {
+                type: 'string',
+                description: 'Phone number to send the OTP to, in E.164 format (e.g. "+27831234567").'
+            },
+            captchaToken: {
+                type: 'string',
+                description: 'Captcha token minted by a Captcha block, sent as the x-captcha-response header when auth.captcha is enabled. Tokens are single-use - reset the Captcha block in onError for retries.'
+            }
+        }
+    }
+};

package/dist/actions/PhoneNumberVerify/PhoneNumberVerify.js

@@ -0,0 +1,22 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Verifies a phone OTP - the OTP sign-in. On success the session cookie is
+// set (and the account is created under signUpOnVerification). Like
+// TwoFactorVerify it does not auto-navigate - verify serves sign-in, sign-up
+// and phone-change confirmation, so navigation after is the app's business.
+function PhoneNumberVerify({ methods: { phoneNumberVerify }, params }) {
+    return phoneNumberVerify(params);
+}
+export default PhoneNumberVerify;

package/dist/actions/PhoneNumberVerify/schema.js

@@ -0,0 +1,79 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the phone-number verify method.',
+        required: [
+            'phoneNumber',
+            'code'
+        ],
+        properties: {
+            phoneNumber: {
+                type: 'string',
+                description: 'Phone number the OTP was sent to, in E.164 format.'
+            },
+            code: {
+                type: 'string',
+                description: 'The OTP code received over SMS.'
+            },
+            disableSession: {
+                type: 'boolean',
+                description: 'Verify without creating a session.'
+            },
+            updatePhoneNumber: {
+                type: 'boolean',
+                description: 'Update the signed-in user to this phone number on verify - the phone change confirmation flow.'
+            },
+            callbackUrl: {
+                oneOf: [
+                    {
+                        type: 'object',
+                        description: "Structured callback target for where a successful verification lands, basePath-prefixed. Defaults to the app's home page when omitted and no ?callbackUrl= query is present; a ?callbackUrl= query set by the unauthenticated-page redirect wins over that default, and this param wins over both. Ignored when the verification creates no session: with disableSession: true, and with updatePhoneNumber: true, where a signed-in user is confirming a new number and stays where they are.",
+                        properties: {
+                            home: {
+                                type: 'boolean',
+                                description: "Land on the app's home page."
+                            },
+                            pageId: {
+                                type: 'string',
+                                description: 'The pageId to land on.'
+                            },
+                            url: {
+                                type: 'string',
+                                description: 'The URL to land on. An absolute URL is not basePath-prefixed, so it can be an external landing page.'
+                            },
+                            urlQuery: {
+                                type: 'object',
+                                description: 'The urlQuery to set on the destination.'
+                            },
+                            pathParams: {
+                                type: 'object',
+                                description: "Values for the placeholders in the destination page's path, by placeholder name."
+                            }
+                        }
+                    },
+                    {
+                        enum: [
+                            false
+                        ],
+                        description: 'Do not navigate - the session store re-renders the page with the new user in place, for a verify form in a modal or an embedded panel.'
+                    }
+                ]
+            }
+        }
+    }
+};

package/dist/actions/RemoveLocalStorage/RemoveLocalStorage.js

@@ -0,0 +1,38 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { UserError } from '@lowdefy/errors';
+import { type } from '@lowdefy/helpers';
+import validateStorageKey from '../../localStorage/validateStorageKey.js';
+function RemoveLocalStorage({ globals, methods, params }) {
+    if (!type.isObject(params)) {
+        throw new Error('RemoveLocalStorage params should be an object.');
+    }
+    const { key } = params;
+    validateStorageKey({
+        actionType: 'RemoveLocalStorage',
+        key
+    });
+    try {
+        globals.window.localStorage.removeItem(methods.getAppStorageKey(key));
+        // A value set before keys were kept per app would otherwise be moved back on the next read.
+        globals.window.localStorage.removeItem(key);
+    } catch (error) {
+        // Blocked storage (SecurityError) comes from the user's browser, not the app config.
+        throw new UserError(`RemoveLocalStorage could not remove "${key}" from local storage. Local storage is blocked in this browser.`, {
+            cause: error
+        });
+    }
+}
+export default RemoveLocalStorage;

package/dist/actions/RemoveLocalStorage/schema.js

@@ -0,0 +1,32 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        required: [
+            'key'
+        ],
+        properties: {
+            key: {
+                type: 'string',
+                minLength: 1,
+                pattern: '^(?!lowdefy_|lf-)',
+                description: 'The local storage key to remove. Keys starting with "lowdefy_" or "lf-" are reserved for Lowdefy.'
+            }
+        },
+        additionalProperties: false
+    }
+};

package/dist/actions/RequestPasswordReset/RequestPasswordReset.js

@@ -0,0 +1,18 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ function RequestPasswordReset({ methods: { requestPasswordReset }, params }) {
+    return requestPasswordReset(params);
+}
+export default RequestPasswordReset;

package/dist/actions/RequestPasswordReset/schema.js

@@ -0,0 +1,25 @@
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the request-password-reset method. One of email or phoneNumber is required.',
+        properties: {
+            email: {
+                type: 'string',
+                description: 'Email address of the account to send the password reset email to.'
+            },
+            phoneNumber: {
+                type: 'string',
+                description: 'Phone number of the account to send the password reset otp to over SMS, in E.164 format.'
+            },
+            redirectTo: {
+                type: 'string',
+                description: 'URL of the app page where the user resets their password - the emailed link redirects here with the reset token as a query parameter (?token=), or with ?error=INVALID_TOKEN when the link is invalid or expired. Defaults to the auth.authPages.resetPassword page.'
+            },
+            captchaToken: {
+                type: 'string',
+                description: 'Captcha token minted by a Captcha block, sent as the x-captcha-response header when auth.captcha is enabled. Tokens are single-use - reset the Captcha block in onError for retries.'
+            }
+        }
+    }
+};