@lowdefy/actions-core 6.1.0 → 7.1.0

package/dist/actions/AcceptInvitation/AcceptInvitation.js

@@ -0,0 +1,21 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Accepts an organization invitation. The action does not re-check that the
+// session email matches the invitation email - BetterAuth's endpoint
+// enforces it.
+function AcceptInvitation({ methods: { acceptInvitation }, params }) {
+    return acceptInvitation(params);
+}
+export default AcceptInvitation;

package/dist/actions/AcceptInvitation/schema.js

@@ -0,0 +1,16 @@
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters identifying the invitation to accept.',
+        required: [
+            'invitationId'
+        ],
+        properties: {
+            invitationId: {
+                type: 'string',
+                description: 'Id of the invitation to accept.'
+            }
+        }
+    }
+};

package/dist/actions/ChangePassword/ChangePassword.js

@@ -0,0 +1,18 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ function ChangePassword({ methods: { changePassword }, params }) {
+    return changePassword(params);
+}
+export default ChangePassword;

package/dist/actions/ChangePassword/schema.js

@@ -0,0 +1,25 @@
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the change-password method.',
+        required: [
+            'currentPassword',
+            'newPassword'
+        ],
+        properties: {
+            currentPassword: {
+                type: 'string',
+                description: 'The current password of the signed-in user.'
+            },
+            newPassword: {
+                type: 'string',
+                description: 'The new password to set.'
+            },
+            revokeOtherSessions: {
+                type: 'boolean',
+                description: 'Revoke all other sessions after the password change.'
+            }
+        }
+    }
+};

package/dist/actions/EmailOtpSend/EmailOtpSend.js

@@ -0,0 +1,21 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Sends a one-time sign-in code to the email address. The code-only entry
+// point: when magicLink is also enabled, Login with magicLink: true already
+// sends one email carrying both the link and the code.
+function EmailOtpSend({ methods: { emailOtpSend }, params }) {
+    return emailOtpSend(params);
+}
+export default EmailOtpSend;

package/dist/actions/EmailOtpSend/schema.js

@@ -0,0 +1,34 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the email one-time-code send method.',
+        required: [
+            'email'
+        ],
+        properties: {
+            email: {
+                type: 'string',
+                description: 'Email address to send the sign-in code to.'
+            },
+            captchaToken: {
+                type: 'string',
+                description: 'Captcha token minted by a Captcha block, sent as the x-captcha-response header when auth.captcha is enabled. Tokens are single-use - reset the Captcha block in onError for retries.'
+            }
+        }
+    }
+};

package/dist/actions/EmailOtpVerify/EmailOtpVerify.js

@@ -0,0 +1,22 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Signs the user in with the emailed one-time code. On success the session
+// cookie is set (creating the user on first sign-in unless disableSignUp) and
+// the browser lands on the resolved callbackUrl - or on the two-factor
+// challenge page when the user is enrolled.
+function EmailOtpVerify({ methods: { emailOtpVerify }, params }) {
+    return emailOtpVerify(params);
+}
+export default EmailOtpVerify;

package/dist/actions/EmailOtpVerify/schema.js

@@ -0,0 +1,71 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the email one-time-code verify method.',
+        required: [
+            'email',
+            'otp'
+        ],
+        properties: {
+            email: {
+                type: 'string',
+                description: 'Email address the code was sent to.'
+            },
+            otp: {
+                type: 'string',
+                description: 'The one-time code from the email.'
+            },
+            callbackUrl: {
+                oneOf: [
+                    {
+                        type: 'object',
+                        description: "Structured callback target for where a successful sign-in lands, basePath-prefixed. Defaults to the app's home page when omitted and no ?callbackUrl= query is present; a ?callbackUrl= query set by the unauthenticated-page redirect wins over that default, and this param wins over both.",
+                        properties: {
+                            home: {
+                                type: 'boolean',
+                                description: "Land on the app's home page."
+                            },
+                            pageId: {
+                                type: 'string',
+                                description: 'The pageId to land on.'
+                            },
+                            url: {
+                                type: 'string',
+                                description: 'The URL to land on. An absolute URL is not basePath-prefixed, so it can be an external landing page.'
+                            },
+                            urlQuery: {
+                                type: 'object',
+                                description: 'The urlQuery to set on the destination.'
+                            },
+                            pathParams: {
+                                type: 'object',
+                                description: "Values for the placeholders in the destination page's path, by placeholder name."
+                            }
+                        }
+                    },
+                    {
+                        enum: [
+                            false
+                        ],
+                        description: 'Do not navigate - the session store re-renders the page with the new user in place, for a sign-in form in a modal or an embedded panel.'
+                    }
+                ]
+            }
+        }
+    }
+};

package/dist/actions/GetLocalStorage/GetLocalStorage.js

@@ -0,0 +1,45 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import parseStoredValue from '../../localStorage/parseStoredValue.js';
+import readAppStorageItem from '../../localStorage/readAppStorageItem.js';
+import validateStorageKey from '../../localStorage/validateStorageKey.js';
+function GetLocalStorage({ globals, methods, params }) {
+    if (!type.isObject(params)) {
+        throw new Error('GetLocalStorage params should be an object.');
+    }
+    const { key } = params;
+    validateStorageKey({
+        actionType: 'GetLocalStorage',
+        key
+    });
+    let item;
+    try {
+        item = readAppStorageItem({
+            appKey: methods.getAppStorageKey(key),
+            key,
+            storage: globals.window.localStorage
+        });
+    } catch  {
+        // The browser blocks storage access (e.g. Safari with site data disabled), so read it as
+        // not set - the user's browser settings are not an app config error.
+        return params.default;
+    }
+    if (type.isNone(item)) {
+        return params.default;
+    }
+    return parseStoredValue(item);
+}
+export default GetLocalStorage;

package/dist/actions/GetLocalStorage/schema.js

@@ -0,0 +1,35 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        required: [
+            'key'
+        ],
+        properties: {
+            key: {
+                type: 'string',
+                minLength: 1,
+                pattern: '^(?!lowdefy_|lf-)',
+                description: 'The local storage key to read. Keys starting with "lowdefy_" or "lf-" are reserved for Lowdefy.'
+            },
+            default: {
+                description: 'The value returned when the key is not set in local storage.'
+            }
+        },
+        additionalProperties: false
+    }
+};

package/dist/actions/LeaveOrganization/LeaveOrganization.js

@@ -0,0 +1,22 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Removes the caller's own membership from their active organization - the
+// active org id is resolved from the session, so the action takes no params.
+// Membership and roles resolve server-side - chain UpdateSession after to
+// re-sync the client.
+function LeaveOrganization({ methods: { leaveOrganization } }) {
+    return leaveOrganization();
+}
+export default LeaveOrganization;

package/dist/actions/LeaveOrganization/schema.js

@@ -0,0 +1,3 @@
+export default {
+    type: 'object'
+};

package/dist/actions/Link/schema.js

@@ -1,4 +1,18 @@
-export default {
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
     type: 'object',
     params: {
         oneOf: [
@@ -26,6 +40,10 @@ export default {
                         type: 'object',
                         description: 'URL query parameters.'
                     },
+                    pathParams: {
+                        type: 'object',
+                        description: "Values for the placeholders in the page's path, by placeholder name."
+                    },
                     input: {
                         type: 'object',
                         description: 'Input to pass to the linked page.'

package/dist/actions/ListOrganizations/ListOrganizations.js

@@ -0,0 +1,21 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Returns the signed-in user's own organization memberships from BetterAuth
+// - keyed on the session alone, not the active organization, so a page can
+// list every workspace the caller belongs to. The action takes no params.
+function ListOrganizations({ methods: { listOrganizations } }) {
+    return listOrganizations();
+}
+export default ListOrganizations;

package/dist/actions/ListOrganizations/schema.js

@@ -0,0 +1,17 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object'
+};

package/dist/actions/Login/schema.js

@@ -1,4 +1,18 @@
-export default {
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
     type: 'object',
     params: {
         type: 'object',
@@ -8,9 +22,113 @@ export default {
                 type: 'string',
                 description: 'The authentication provider ID.'
             },
+            email: {
+                type: 'string',
+                description: 'Email address for email and password or magic-link sign-in.'
+            },
+            password: {
+                type: 'string',
+                description: 'Password for email and password or phone and password sign-in.'
+            },
+            phoneNumber: {
+                type: 'string',
+                description: 'Phone number for phone and password sign-in, in E.164 format (e.g. "+27831234567").'
+            },
+            magicLink: {
+                type: 'boolean',
+                description: 'Send a magic sign-in link to the email address instead of using a password.'
+            },
             callbackUrl: {
+                oneOf: [
+                    {
+                        type: 'object',
+                        description: "Structured callback target for where a successful sign-in lands, basePath-prefixed. Defaults to the app's home page when omitted and no ?callbackUrl= query is present; a ?callbackUrl= query set by the unauthenticated-page redirect wins over that default, and this param wins over both.",
+                        properties: {
+                            home: {
+                                type: 'boolean',
+                                description: "Land on the app's home page."
+                            },
+                            pageId: {
+                                type: 'string',
+                                description: 'The pageId to land on.'
+                            },
+                            url: {
+                                type: 'string',
+                                description: 'The URL to land on. An absolute URL is not basePath-prefixed, so it can be an external landing page.'
+                            },
+                            urlQuery: {
+                                type: 'object',
+                                description: 'The urlQuery to set on the destination.'
+                            },
+                            pathParams: {
+                                type: 'object',
+                                description: "Values for the placeholders in the destination page's path, by placeholder name."
+                            }
+                        }
+                    },
+                    {
+                        enum: [
+                            false
+                        ],
+                        description: 'Do not navigate - the session store re-renders the page with the new user in place, for a login form in a modal or an embedded panel. Not valid for magic-link or social/OAuth sign-in, which redirect through an external hop.'
+                    }
+                ]
+            },
+            newUserCallbackUrl: {
+                type: 'object',
+                description: 'Structured callback target for where a first-time user lands after a magic link (or social/OAuth sign-in) creates their account. Resolved like callbackUrl - basePath-prefixed. When omitted, BetterAuth defaults it to callbackUrl. Ignored by email and phone sign-in.',
+                properties: {
+                    home: {
+                        type: 'boolean',
+                        description: "Land on the app's home page."
+                    },
+                    pageId: {
+                        type: 'string',
+                        description: 'The pageId to land on.'
+                    },
+                    url: {
+                        type: 'string',
+                        description: 'The URL to land on. An absolute URL is not basePath-prefixed, so it can be an external landing page.'
+                    },
+                    urlQuery: {
+                        type: 'object',
+                        description: 'The urlQuery to set on the destination.'
+                    },
+                    pathParams: {
+                        type: 'object',
+                        description: "Values for the placeholders in the destination page's path, by placeholder name."
+                    }
+                }
+            },
+            errorCallbackUrl: {
+                type: 'object',
+                description: "Structured callback target for where a failed or expired magic link (or social/OAuth sign-in) lands, carrying the ?error= reason. Resolved like callbackUrl - basePath-prefixed. When omitted, defaults to the app's authPages.error page (basePath-prefixed); if authPages.error is unset, BetterAuth's own fallback stands. Ignored by email and phone sign-in.",
+                properties: {
+                    home: {
+                        type: 'boolean',
+                        description: "Land on the app's home page."
+                    },
+                    pageId: {
+                        type: 'string',
+                        description: 'The pageId to land on.'
+                    },
+                    url: {
+                        type: 'string',
+                        description: 'The URL to land on. An absolute URL is not basePath-prefixed, so it can be an external landing page.'
+                    },
+                    urlQuery: {
+                        type: 'object',
+                        description: 'The urlQuery to set on the destination.'
+                    },
+                    pathParams: {
+                        type: 'object',
+                        description: "Values for the placeholders in the destination page's path, by placeholder name."
+                    }
+                }
+            },
+            captchaToken: {
                 type: 'string',
-                description: 'URL to redirect to after login.'
+                description: 'Captcha token minted by a Captcha block, sent as the x-captcha-response header when auth.captcha is enabled. Tokens are single-use - reset the Captcha block in onError for retries.'
             }
         }
     }

package/dist/actions/Logout/schema.js

@@ -1,6 +1,49 @@
-export default {
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
     type: 'object',
     params: {
-        description: 'Parameters passed to the logout method.'
+        type: 'object',
+        description: 'Parameters passed to the logout method.',
+        properties: {
+            callbackUrl: {
+                type: 'object',
+                description: 'Structured callback target for where a signed-out user lands, basePath-prefixed. Unlike the sign-in actions this has no default and does not read the ?callbackUrl= query: with no target the session provider reloads the page and the server re-applies the page auth fork, which sends a protected page to the sign-in page.',
+                properties: {
+                    home: {
+                        type: 'boolean',
+                        description: "Land on the app's home page."
+                    },
+                    pageId: {
+                        type: 'string',
+                        description: 'The pageId to land on.'
+                    },
+                    url: {
+                        type: 'string',
+                        description: 'The URL to land on. An absolute URL is not basePath-prefixed, so it can be an external logout landing page.'
+                    },
+                    urlQuery: {
+                        type: 'object',
+                        description: 'The urlQuery to set on the destination.'
+                    },
+                    pathParams: {
+                        type: 'object',
+                        description: "Values for the placeholders in the destination page's path, by placeholder name."
+                    }
+                }
+            }
+        }
     }
 };

package/dist/actions/MagicLinkVerify/MagicLinkVerify.js

@@ -0,0 +1,24 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Spends the magic-link token from the landing page the sign-in email points
+// at (auth.authPages.magicLink). The browser navigates to BetterAuth's verify
+// endpoint, which sets the session cookie and redirects on, so the event chain
+// ends here. Bind it to a real click: the landing page exists precisely because
+// mail-security link scanners fetch the page, and a token spent on mount would
+// be consumed by the scanner all the same.
+function MagicLinkVerify({ methods: { magicLinkVerify }, params }) {
+    return magicLinkVerify(params);
+}
+export default MagicLinkVerify;