@lowdefy/actions-core 6.1.0 → 7.1.0

package/dist/actions/ResetPassword/ResetPassword.js

@@ -0,0 +1,18 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ function ResetPassword({ methods: { resetPassword }, params }) {
+    return resetPassword(params);
+}
+export default ResetPassword;

package/dist/actions/ResetPassword/schema.js

@@ -0,0 +1,28 @@
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the reset-password method. Resets with the emailed token, or with the SMS otp when phoneNumber is set.',
+        required: [
+            'newPassword'
+        ],
+        properties: {
+            newPassword: {
+                type: 'string',
+                description: 'The new password to set.'
+            },
+            token: {
+                type: 'string',
+                description: 'The reset token from the emailed password reset link.'
+            },
+            phoneNumber: {
+                type: 'string',
+                description: 'Phone number the reset otp was sent to, in E.164 format.'
+            },
+            otp: {
+                type: 'string',
+                description: 'The reset code received over SMS, used with phoneNumber instead of token.'
+            }
+        }
+    }
+};

package/dist/actions/ResetValidation/schema.js

@@ -12,6 +12,48 @@ export default {
                     type: 'string'
                 },
                 description: 'An array of blockIds to reset validation for.'
+            },
+            {
+                type: 'boolean',
+                description: 'true matches every block on the page.'
+            },
+            {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    blockIds: {
+                        description: 'A blockId, a list of blockIds, or true for every block.',
+                        oneOf: [
+                            {
+                                type: 'string'
+                            },
+                            {
+                                type: 'array',
+                                items: {
+                                    type: 'string'
+                                }
+                            },
+                            {
+                                type: 'boolean'
+                            }
+                        ]
+                    },
+                    regex: {
+                        description: 'A regular expression, or a list of them, matched against block ids.',
+                        oneOf: [
+                            {
+                                type: 'string'
+                            },
+                            {
+                                type: 'array',
+                                items: {
+                                    type: 'string'
+                                }
+                            }
+                        ]
+                    }
+                },
+                description: 'Blocks to match by id and by regular expression.'
             }
         ]
     }

package/dist/actions/RevokeOtherSessions/RevokeOtherSessions.js

@@ -0,0 +1,20 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Revokes every session except the current one. Per-session revoke is
+// deliberately excluded - it would put session tokens in config reach.
+function RevokeOtherSessions({ methods: { revokeOtherSessions } }) {
+    return revokeOtherSessions();
+}
+export default RevokeOtherSessions;

package/dist/actions/RevokeOtherSessions/schema.js

@@ -0,0 +1,6 @@
+export default {
+    type: 'object',
+    params: {
+        description: 'RevokeOtherSessions takes no parameters.'
+    }
+};

package/dist/actions/SendVerificationEmail/SendVerificationEmail.js

@@ -0,0 +1,20 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Resends the verification email for an unverified account. Public - an
+// unverified user holds no session.
+function SendVerificationEmail({ methods: { sendVerificationEmail }, params }) {
+    return sendVerificationEmail(params);
+}
+export default SendVerificationEmail;

package/dist/actions/SendVerificationEmail/schema.js

@@ -0,0 +1,60 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the send-verification-email method.',
+        required: [
+            'email'
+        ],
+        properties: {
+            email: {
+                type: 'string',
+                description: 'Email address of the unverified account to send the verification email to.'
+            },
+            callbackUrl: {
+                type: 'object',
+                description: 'Structured callback target for where the emailed verification link lands after verifying, basePath-prefixed. Defaults to the auth.authPages.verifyEmail page, which receives ?error= when the link is invalid or expired. A false value is not valid here: the destination belongs to a redirect hop this action cannot suppress.',
+                properties: {
+                    home: {
+                        type: 'boolean',
+                        description: "Land on the app's home page."
+                    },
+                    pageId: {
+                        type: 'string',
+                        description: 'The pageId to land on.'
+                    },
+                    url: {
+                        type: 'string',
+                        description: 'The URL to land on. An absolute URL is not basePath-prefixed, so it can be an external landing page.'
+                    },
+                    urlQuery: {
+                        type: 'object',
+                        description: 'The urlQuery to set on the destination.'
+                    },
+                    pathParams: {
+                        type: 'object',
+                        description: "Values for the placeholders in the destination page's path, by placeholder name."
+                    }
+                }
+            },
+            captchaToken: {
+                type: 'string',
+                description: 'Captcha token minted by a Captcha block, sent as the x-captcha-response header when auth.captcha is enabled. Tokens are single-use - reset the Captcha block in onError for retries.'
+            }
+        }
+    }
+};

package/dist/actions/SetActiveOrganization/SetActiveOrganization.js

@@ -0,0 +1,21 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Switches the session's active organization. Roles and attributes resolve
+// from the new active membership server-side - chain UpdateSession after to
+// re-sync the client.
+function SetActiveOrganization({ methods: { setActiveOrganization }, params }) {
+    return setActiveOrganization(params);
+}
+export default SetActiveOrganization;

package/dist/actions/SetActiveOrganization/schema.js

@@ -0,0 +1,17 @@
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters identifying the organization to set active. One of organizationId or organizationSlug is required.',
+        properties: {
+            organizationId: {
+                type: 'string',
+                description: 'Id of the organization to set as the active organization.'
+            },
+            organizationSlug: {
+                type: 'string',
+                description: 'Slug of the organization to set as the active organization.'
+            }
+        }
+    }
+};

package/dist/actions/SetDarkMode/SetDarkMode.js

@@ -19,7 +19,8 @@
 };
 function SetDarkMode({ globals, methods, params }) {
     const { window } = globals;
-    const currentPreference = window.localStorage?.getItem('lowdefy_darkMode') ?? 'system';
+    // The client keeps the preference it reads from storage, under the app's key.
+    const currentPreference = window.__lowdefy_darkModePreference ?? 'system';
     const newPreference = params?.darkMode ?? cycleOrder[currentPreference] ?? 'light';
     window.__lowdefy_setDarkMode?.(newPreference);
     // Trigger engine update cascade so _media: darkMode re-evaluates in all blocks

package/dist/actions/SetLocalStorage/SetLocalStorage.js

@@ -0,0 +1,43 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { UserError } from '@lowdefy/errors';
+import { serializer, type } from '@lowdefy/helpers';
+import validateStorageKey from '../../localStorage/validateStorageKey.js';
+function SetLocalStorage({ globals, methods, params }) {
+    if (!type.isObject(params)) {
+        throw new Error('SetLocalStorage params should be an object.');
+    }
+    const { key, value } = params;
+    validateStorageKey({
+        actionType: 'SetLocalStorage',
+        key
+    });
+    if (type.isUndefined(value)) {
+        throw new Error('SetLocalStorage "value" is required.');
+    }
+    const serialized = serializer.serializeToString(value);
+    try {
+        globals.window.localStorage.setItem(methods.getAppStorageKey(key), serialized);
+        // A value set before keys were kept per app must not outlive the new one.
+        globals.window.localStorage.removeItem(key);
+    } catch (error) {
+        // Blocked storage (SecurityError) or a full quota (QuotaExceededError) comes from the
+        // user's browser, not the app config.
+        throw new UserError(`SetLocalStorage could not write "${key}" to local storage. Local storage is blocked or full in this browser.`, {
+            cause: error
+        });
+    }
+}
+export default SetLocalStorage;

package/dist/actions/SetLocalStorage/schema.js

@@ -0,0 +1,36 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        required: [
+            'key',
+            'value'
+        ],
+        properties: {
+            key: {
+                type: 'string',
+                minLength: 1,
+                pattern: '^(?!lowdefy_|lf-)',
+                description: 'The local storage key to write to. Keys starting with "lowdefy_" or "lf-" are reserved for Lowdefy.'
+            },
+            value: {
+                description: 'The value to store. Values are serialized, so dates are preserved when read back with GetLocalStorage.'
+            }
+        },
+        additionalProperties: false
+    }
+};

package/dist/actions/SignUp/SignUp.js

@@ -0,0 +1,18 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ function SignUp({ methods: { signUp }, params }) {
+    return signUp(params);
+}
+export default SignUp;

package/dist/actions/SignUp/schema.js

@@ -0,0 +1,65 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the sign-up method (email/password only).',
+        properties: {
+            email: {
+                type: 'string',
+                description: 'Email address of the account to create.'
+            },
+            password: {
+                type: 'string',
+                description: 'Password for the new account.'
+            },
+            name: {
+                type: 'string',
+                description: 'Name of the user.'
+            },
+            callbackUrl: {
+                type: 'object',
+                description: 'Structured callback target for where the new account lands - both where the emailed verification link goes and, when the response carries a session, where the browser navigates. basePath-prefixed. When omitted, the verification link lands on the auth.authPages.verifyEmail page (with ?error= when the link is invalid or expired), and a session-bearing response navigates to the ?callbackUrl= query, else the home page. A false value is not valid here: the same value is the emailed link destination, which SignUp cannot suppress.',
+                properties: {
+                    home: {
+                        type: 'boolean',
+                        description: "Land on the app's home page."
+                    },
+                    pageId: {
+                        type: 'string',
+                        description: 'The pageId to land on.'
+                    },
+                    url: {
+                        type: 'string',
+                        description: 'The URL to land on. An absolute URL is not basePath-prefixed, so it can be an external landing page.'
+                    },
+                    urlQuery: {
+                        type: 'object',
+                        description: 'The urlQuery to set on the destination.'
+                    },
+                    pathParams: {
+                        type: 'object',
+                        description: "Values for the placeholders in the destination page's path, by placeholder name."
+                    }
+                }
+            },
+            captchaToken: {
+                type: 'string',
+                description: 'Captcha token minted by a Captcha block, sent as the x-captcha-response header when auth.captcha is enabled. Tokens are single-use - reset the Captcha block in onError for retries.'
+            }
+        }
+    }
+};

package/dist/actions/TwoFactorDisable/TwoFactorDisable.js

@@ -0,0 +1,18 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ function TwoFactorDisable({ methods: { twoFactorDisable }, params }) {
+    return twoFactorDisable(params);
+}
+export default TwoFactorDisable;

package/dist/actions/TwoFactorDisable/schema.js

@@ -0,0 +1,16 @@
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the two-factor disable method.',
+        required: [
+            'password'
+        ],
+        properties: {
+            password: {
+                type: 'string',
+                description: 'The password of the signed-in user - disabling two-factor is password-gated.'
+            }
+        }
+    }
+};

package/dist/actions/TwoFactorEnable/TwoFactorEnable.js

@@ -0,0 +1,21 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Returns the totpURI and backup codes the page must render once - read them
+// via _actions.<id>.response later in the same event chain. Enrolment
+// completes when TwoFactorVerify confirms a TOTP code.
+function TwoFactorEnable({ methods: { twoFactorEnable }, params }) {
+    return twoFactorEnable(params);
+}
+export default TwoFactorEnable;

package/dist/actions/TwoFactorEnable/schema.js

@@ -0,0 +1,16 @@
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the two-factor enable method.',
+        required: [
+            'password'
+        ],
+        properties: {
+            password: {
+                type: 'string',
+                description: 'The password of the signed-in user - enabling two-factor is password-gated.'
+            }
+        }
+    }
+};

package/dist/actions/TwoFactorGenerateBackupCodes/TwoFactorGenerateBackupCodes.js

@@ -0,0 +1,21 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Returns the new backup codes the page must render once - read them via
+// _actions.<id>.response later in the same event chain. Rotates recovery
+// codes only; the TOTP secret and enrolment are untouched.
+function TwoFactorGenerateBackupCodes({ methods: { twoFactorGenerateBackupCodes }, params }) {
+    return twoFactorGenerateBackupCodes(params);
+}
+export default TwoFactorGenerateBackupCodes;

package/dist/actions/TwoFactorGenerateBackupCodes/schema.js

@@ -0,0 +1,16 @@
+export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the two-factor generate-backup-codes method.',
+        required: [
+            'password'
+        ],
+        properties: {
+            password: {
+                type: 'string',
+                description: 'The password of the signed-in user - generating backup codes is password-gated.'
+            }
+        }
+    }
+};

package/dist/actions/TwoFactorVerify/TwoFactorVerify.js

@@ -0,0 +1,21 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Verifies a TOTP code or a backup code - both the enrolment confirmation
+// and the sign-in challenge. The sign-in challenge verify completes the
+// session itself; navigation after is the app's business.
+function TwoFactorVerify({ methods: { twoFactorVerify }, params }) {
+    return twoFactorVerify(params);
+}
+export default TwoFactorVerify;

package/dist/actions/TwoFactorVerify/schema.js

@@ -0,0 +1,71 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    type: 'object',
+    params: {
+        type: 'object',
+        description: 'Parameters passed to the two-factor verify method. One of code or backupCode is required.',
+        properties: {
+            code: {
+                type: 'string',
+                description: 'The TOTP code from the authenticator app.'
+            },
+            backupCode: {
+                type: 'string',
+                description: 'A backup code, used instead of a TOTP code.'
+            },
+            trustDevice: {
+                type: 'boolean',
+                description: 'Trust this device for 30 days - no two-factor challenge on sign-in.'
+            },
+            callbackUrl: {
+                oneOf: [
+                    {
+                        type: 'object',
+                        description: "Structured callback target for where a successful challenge lands, basePath-prefixed. Defaults to the app's home page when omitted and no ?callbackUrl= query is present; the ?callbackUrl= query the sign-in method put on the challenge page wins over that default, and this param wins over both.",
+                        properties: {
+                            home: {
+                                type: 'boolean',
+                                description: "Land on the app's home page."
+                            },
+                            pageId: {
+                                type: 'string',
+                                description: 'The pageId to land on.'
+                            },
+                            url: {
+                                type: 'string',
+                                description: 'The URL to land on. An absolute URL is not basePath-prefixed, so it can be an external landing page.'
+                            },
+                            urlQuery: {
+                                type: 'object',
+                                description: 'The urlQuery to set on the destination.'
+                            },
+                            pathParams: {
+                                type: 'object',
+                                description: "Values for the placeholders in the destination page's path, by placeholder name."
+                            }
+                        }
+                    },
+                    {
+                        enum: [
+                            false
+                        ],
+                        description: 'Do not navigate - for a challenge page that renders its own post-challenge state instead.'
+                    }
+                ]
+            }
+        }
+    }
+};