@netlify/identity 0.1.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Netlify
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,15 @@
+# @netlify/identity
+
+Add authentication to your Netlify site with a few lines of code.
+
+> **Status:** Beta. The API may change before 1.0.
+
+## Installation
+
+```bash
+npm install @netlify/identity
+```
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,174 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AuthError: () => AuthError,
+  MissingIdentityError: () => MissingIdentityError,
+  getIdentityConfig: () => getIdentityConfig,
+  getSettings: () => getSettings,
+  getUser: () => getUser,
+  isAuthenticated: () => isAuthenticated,
+  toUser: () => toUser
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/environment.ts
+var import_gotrue_js = __toESM(require("gotrue-js"), 1);
+var goTrueClient = null;
+var cachedApiUrl;
+var warnedMissingUrl = false;
+var isBrowser = () => typeof window !== "undefined";
+var discoverApiUrl = () => {
+  if (cachedApiUrl !== void 0) return cachedApiUrl;
+  if (isBrowser()) {
+    cachedApiUrl = `${window.location.origin}/.netlify/identity`;
+  } else {
+    const identityContext = getIdentityContext();
+    if (identityContext?.url) {
+      cachedApiUrl = identityContext.url;
+    }
+  }
+  return cachedApiUrl ?? null;
+};
+var getGoTrueClient = () => {
+  if (goTrueClient) return goTrueClient;
+  const apiUrl = discoverApiUrl();
+  if (!apiUrl) {
+    if (!warnedMissingUrl) {
+      console.warn(
+        "@netlify/identity: Could not determine the Identity endpoint URL. Make sure your site has Netlify Identity enabled, or run your app with `netlify dev`."
+      );
+      warnedMissingUrl = true;
+    }
+    return null;
+  }
+  goTrueClient = new import_gotrue_js.default({ APIUrl: apiUrl, setCookie: isBrowser() });
+  return goTrueClient;
+};
+var getIdentityContext = () => {
+  const identityContext = globalThis.netlifyIdentityContext;
+  if (!identityContext?.url) return null;
+  return { url: identityContext.url, token: identityContext.token };
+};
+
+// src/user.ts
+var toUser = (userData) => {
+  const name = userData.user_metadata.full_name || userData.user_metadata.name;
+  const pictureUrl = userData.user_metadata.avatar_url;
+  return {
+    id: userData.id,
+    email: userData.email,
+    emailVerified: !!userData.confirmed_at,
+    createdAt: userData.created_at,
+    updatedAt: userData.updated_at,
+    provider: userData.app_metadata.provider,
+    name: typeof name === "string" ? name : void 0,
+    pictureUrl: typeof pictureUrl === "string" ? pictureUrl : void 0,
+    metadata: userData.user_metadata,
+    rawGoTrueData: { ...userData }
+  };
+};
+var getUser = () => {
+  if (isBrowser()) {
+    const client = getGoTrueClient();
+    const currentUser = client?.currentUser() ?? null;
+    if (!currentUser) return null;
+    return toUser(currentUser);
+  }
+  const identityContext = globalThis.netlifyIdentityContext;
+  if (!identityContext?.user) return null;
+  return toUser(identityContext.user);
+};
+var isAuthenticated = () => getUser() !== null;
+
+// src/errors.ts
+var AuthError = class extends Error {
+  constructor(message, status, options) {
+    super(message);
+    this.name = "AuthError";
+    this.status = status;
+    if (options?.cause) {
+      this.cause = options.cause;
+    }
+  }
+};
+var MissingIdentityError = class extends Error {
+  constructor(message = "Identity is not available in this environment") {
+    super(message);
+    this.name = "MissingIdentityError";
+  }
+};
+
+// src/config.ts
+var getIdentityConfig = () => {
+  if (isBrowser()) {
+    return { url: `${window.location.origin}/.netlify/identity` };
+  }
+  return getIdentityContext();
+};
+var getSettings = async () => {
+  const client = getGoTrueClient();
+  if (!client) throw new MissingIdentityError();
+  try {
+    const raw = await client.settings();
+    const external = raw.external ?? {};
+    return {
+      autoconfirm: raw.autoconfirm,
+      disableSignup: raw.disable_signup,
+      providers: {
+        google: external.google ?? false,
+        github: external.github ?? false,
+        gitlab: external.gitlab ?? false,
+        bitbucket: external.bitbucket ?? false,
+        facebook: external.facebook ?? false,
+        email: external.email ?? false,
+        saml: false
+      }
+    };
+  } catch (err) {
+    throw new AuthError(
+      err instanceof Error ? err.message : "Failed to fetch identity settings",
+      502,
+      { cause: err }
+    );
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthError,
+  MissingIdentityError,
+  getIdentityConfig,
+  getSettings,
+  getUser,
+  isAuthenticated,
+  toUser
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/environment.ts","../src/user.ts","../src/errors.ts","../src/config.ts"],"sourcesContent":["export type { User } from './user.js'\nexport { toUser, getUser, isAuthenticated } from './user.js'\nexport { getIdentityConfig, getSettings } from './config.js'\nexport type { JWTClaims } from './auth.js'\nexport { AuthError, MissingIdentityError } from './errors.js'\nexport type { AppMetadata, AuthProvider, IdentityConfig, Settings } from './types.js'\n","import GoTrue from 'gotrue-js'\n\nimport type { IdentityConfig } from './types.js'\n\nlet goTrueClient: GoTrue | null = null\nlet cachedApiUrl: string | null | undefined\nlet warnedMissingUrl = false\n\nexport const isBrowser = (): boolean => typeof window !== 'undefined'\n\n/**\n * Discovers and caches the GoTrue API URL.\n *\n * Browser: uses `window.location.origin` + `/.netlify/identity`.\n * Server: reads from `globalThis.netlifyIdentityContext`.\n */\nconst discoverApiUrl = (): string | null => {\n  if (cachedApiUrl !== undefined) return cachedApiUrl\n\n  if (isBrowser()) {\n    cachedApiUrl = `${window.location.origin}/.netlify/identity`\n  } else {\n    const identityContext = getIdentityContext()\n    if (identityContext?.url) {\n      cachedApiUrl = identityContext.url\n    }\n  }\n\n  return cachedApiUrl ?? null\n}\n\n/**\n * Returns (and lazily creates) a singleton gotrue-js client.\n * Returns `null` and logs a warning if no identity URL can be discovered.\n */\nexport const getGoTrueClient = (): GoTrue | null => {\n  if (goTrueClient) return goTrueClient\n\n  const apiUrl = discoverApiUrl()\n  if (!apiUrl) {\n    if (!warnedMissingUrl) {\n      console.warn(\n        '@netlify/identity: Could not determine the Identity endpoint URL. ' +\n          'Make sure your site has Netlify Identity enabled, or run your app with `netlify dev`.',\n      )\n      warnedMissingUrl = true\n    }\n    return null\n  }\n\n  goTrueClient = new GoTrue({ APIUrl: apiUrl, setCookie: isBrowser() })\n  return goTrueClient\n}\n\n/**\n * Reads the server-side identity context set by the Netlify bootstrap.\n * Returns `null` outside the Netlify serverless environment.\n */\nexport const getIdentityContext = (): IdentityConfig | null => {\n  const identityContext = globalThis.netlifyIdentityContext\n  if (!identityContext?.url) return null\n  return { url: identityContext.url, token: identityContext.token }\n}\n\n/** Reset cached state for tests. */\nexport const resetTestGoTrueClient = (): void => {\n  goTrueClient = null\n  cachedApiUrl = undefined\n  warnedMissingUrl = false\n}\n","import type { UserData } from 'gotrue-js'\nimport type { AuthProvider } from './types.js'\nimport { getGoTrueClient, isBrowser } from './environment.js'\n\nexport interface User {\n  id: string\n  email?: string\n  emailVerified?: boolean\n  createdAt?: string\n  updatedAt?: string\n  provider?: AuthProvider\n  name?: string\n  pictureUrl?: string\n  metadata?: Record<string, unknown>\n  rawGoTrueData?: Record<string, unknown>\n}\n\nexport const toUser = (userData: UserData): User => {\n  const name = userData.user_metadata.full_name || userData.user_metadata.name\n  const pictureUrl = userData.user_metadata.avatar_url\n\n  return {\n    id: userData.id,\n    email: userData.email,\n    emailVerified: !!userData.confirmed_at,\n    createdAt: userData.created_at,\n    updatedAt: userData.updated_at,\n    provider: userData.app_metadata.provider as AuthProvider,\n    name: typeof name === 'string' ? name : undefined,\n    pictureUrl: typeof pictureUrl === 'string' ? pictureUrl : undefined,\n    metadata: userData.user_metadata,\n    rawGoTrueData: { ...userData },\n  }\n}\n\n/**\n * Returns the currently authenticated user, or `null` if not logged in.\n * Synchronous. Never throws.\n */\nexport const getUser = (): User | null => {\n  if (isBrowser()) {\n    const client = getGoTrueClient()\n    const currentUser = client?.currentUser() ?? null\n    if (!currentUser) return null\n    return toUser(currentUser)\n  }\n\n  const identityContext = globalThis.netlifyIdentityContext\n  if (!identityContext?.user) return null\n  return toUser(identityContext.user)\n}\n\n/**\n * Returns `true` if a user is currently authenticated.\n */\nexport const isAuthenticated = (): boolean => getUser() !== null\n\n","export class AuthError extends Error {\n  override name = 'AuthError'\n  status?: number\n  declare cause?: unknown\n\n  constructor(message: string, status?: number, options?: { cause?: unknown }) {\n    super(message)\n    this.status = status\n    if (options?.cause) {\n      this.cause = options.cause\n    }\n  }\n}\n\nexport class MissingIdentityError extends Error {\n  override name = 'MissingIdentityError'\n\n  constructor(message = 'Identity is not available in this environment') {\n    super(message)\n  }\n}\n","import type { IdentityConfig, Settings } from './types.js'\nimport { AuthError, MissingIdentityError } from './errors.js'\nimport { getGoTrueClient, getIdentityContext, isBrowser } from './environment.js'\n\n/**\n * Returns the identity configuration for the current environment.\n * Browser: always returns `{ url }` derived from `window.location.origin`.\n * Server: returns `{ url, token }` from the identity context, or `null` if unavailable.\n * Never throws.\n */\nexport const getIdentityConfig = (): IdentityConfig | null => {\n  if (isBrowser()) {\n    return { url: `${window.location.origin}/.netlify/identity` }\n  }\n\n  return getIdentityContext()\n}\n\n/**\n * Fetches the GoTrue `/settings` endpoint.\n * Throws `MissingIdentityError` if Identity is not configured.\n * Throws `AuthError` if the endpoint is unreachable.\n */\nexport const getSettings = async (): Promise<Settings> => {\n  const client = getGoTrueClient()\n  if (!client) throw new MissingIdentityError()\n\n  try {\n    const raw = await client.settings()\n    const external = raw.external ?? {}\n    return {\n      autoconfirm: raw.autoconfirm,\n      disableSignup: raw.disable_signup,\n      providers: {\n        google: external.google ?? false,\n        github: external.github ?? false,\n        gitlab: external.gitlab ?? false,\n        bitbucket: external.bitbucket ?? false,\n        facebook: external.facebook ?? false,\n        email: external.email ?? false,\n        saml: false,\n      },\n    }\n  } catch (err) {\n    throw new AuthError(\n      err instanceof Error ? err.message : 'Failed to fetch identity settings',\n      502,\n      { cause: err },\n    )\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,uBAAmB;AAInB,IAAI,eAA8B;AAClC,IAAI;AACJ,IAAI,mBAAmB;AAEhB,IAAM,YAAY,MAAe,OAAO,WAAW;AAQ1D,IAAM,iBAAiB,MAAqB;AAC1C,MAAI,iBAAiB,OAAW,QAAO;AAEvC,MAAI,UAAU,GAAG;AACf,mBAAe,GAAG,OAAO,SAAS,MAAM;AAAA,EAC1C,OAAO;AACL,UAAM,kBAAkB,mBAAmB;AAC3C,QAAI,iBAAiB,KAAK;AACxB,qBAAe,gBAAgB;AAAA,IACjC;AAAA,EACF;AAEA,SAAO,gBAAgB;AACzB;AAMO,IAAM,kBAAkB,MAAqB;AAClD,MAAI,aAAc,QAAO;AAEzB,QAAM,SAAS,eAAe;AAC9B,MAAI,CAAC,QAAQ;AACX,QAAI,CAAC,kBAAkB;AACrB,cAAQ;AAAA,QACN;AAAA,MAEF;AACA,yBAAmB;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,IAAI,iBAAAA,QAAO,EAAE,QAAQ,QAAQ,WAAW,UAAU,EAAE,CAAC;AACpE,SAAO;AACT;AAMO,IAAM,qBAAqB,MAA6B;AAC7D,QAAM,kBAAkB,WAAW;AACnC,MAAI,CAAC,iBAAiB,IAAK,QAAO;AAClC,SAAO,EAAE,KAAK,gBAAgB,KAAK,OAAO,gBAAgB,MAAM;AAClE;;;AC7CO,IAAM,SAAS,CAAC,aAA6B;AAClD,QAAM,OAAO,SAAS,cAAc,aAAa,SAAS,cAAc;AACxE,QAAM,aAAa,SAAS,cAAc;AAE1C,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,OAAO,SAAS;AAAA,IAChB,eAAe,CAAC,CAAC,SAAS;AAAA,IAC1B,WAAW,SAAS;AAAA,IACpB,WAAW,SAAS;AAAA,IACpB,UAAU,SAAS,aAAa;AAAA,IAChC,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,IACxC,YAAY,OAAO,eAAe,WAAW,aAAa;AAAA,IAC1D,UAAU,SAAS;AAAA,IACnB,eAAe,EAAE,GAAG,SAAS;AAAA,EAC/B;AACF;AAMO,IAAM,UAAU,MAAmB;AACxC,MAAI,UAAU,GAAG;AACf,UAAM,SAAS,gBAAgB;AAC/B,UAAM,cAAc,QAAQ,YAAY,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO;AACzB,WAAO,OAAO,WAAW;AAAA,EAC3B;AAEA,QAAM,kBAAkB,WAAW;AACnC,MAAI,CAAC,iBAAiB,KAAM,QAAO;AACnC,SAAO,OAAO,gBAAgB,IAAI;AACpC;AAKO,IAAM,kBAAkB,MAAe,QAAQ,MAAM;;;ACvDrD,IAAM,YAAN,cAAwB,MAAM;AAAA,EAKnC,YAAY,SAAiB,QAAiB,SAA+B;AAC3E,UAAM,OAAO;AALf,SAAS,OAAO;AAMd,SAAK,SAAS;AACd,QAAI,SAAS,OAAO;AAClB,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;AAEO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAG9C,YAAY,UAAU,iDAAiD;AACrE,UAAM,OAAO;AAHf,SAAS,OAAO;AAAA,EAIhB;AACF;;;ACVO,IAAM,oBAAoB,MAA6B;AAC5D,MAAI,UAAU,GAAG;AACf,WAAO,EAAE,KAAK,GAAG,OAAO,SAAS,MAAM,qBAAqB;AAAA,EAC9D;AAEA,SAAO,mBAAmB;AAC5B;AAOO,IAAM,cAAc,YAA+B;AACxD,QAAM,SAAS,gBAAgB;AAC/B,MAAI,CAAC,OAAQ,OAAM,IAAI,qBAAqB;AAE5C,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,SAAS;AAClC,UAAM,WAAW,IAAI,YAAY,CAAC;AAClC,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,MACjB,eAAe,IAAI;AAAA,MACnB,WAAW;AAAA,QACT,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ,SAAS,UAAU;AAAA,QAC3B,WAAW,SAAS,aAAa;AAAA,QACjC,UAAU,SAAS,YAAY;AAAA,QAC/B,OAAO,SAAS,SAAS;AAAA,QACzB,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,eAAe,QAAQ,IAAI,UAAU;AAAA,MACrC;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAAA,EACF;AACF;","names":["GoTrue"]}

package/dist/index.d.cts

@@ -0,0 +1,79 @@
+import { UserData } from 'gotrue-js';
+
+type AuthProvider = 'google' | 'github' | 'gitlab' | 'bitbucket' | 'facebook' | 'saml' | 'email';
+interface AppMetadata {
+    provider: AuthProvider;
+    roles?: string[];
+    [key: string]: unknown;
+}
+interface IdentityConfig {
+    url: string;
+    token?: string;
+}
+interface Settings {
+    autoconfirm: boolean;
+    disableSignup: boolean;
+    providers: Record<AuthProvider, boolean>;
+}
+
+interface User {
+    id: string;
+    email?: string;
+    emailVerified?: boolean;
+    createdAt?: string;
+    updatedAt?: string;
+    provider?: AuthProvider;
+    name?: string;
+    pictureUrl?: string;
+    metadata?: Record<string, unknown>;
+    rawGoTrueData?: Record<string, unknown>;
+}
+declare const toUser: (userData: UserData) => User;
+/**
+ * Returns the currently authenticated user, or `null` if not logged in.
+ * Synchronous. Never throws.
+ */
+declare const getUser: () => User | null;
+/**
+ * Returns `true` if a user is currently authenticated.
+ */
+declare const isAuthenticated: () => boolean;
+
+/**
+ * Returns the identity configuration for the current environment.
+ * Browser: always returns `{ url }` derived from `window.location.origin`.
+ * Server: returns `{ url, token }` from the identity context, or `null` if unavailable.
+ * Never throws.
+ */
+declare const getIdentityConfig: () => IdentityConfig | null;
+/**
+ * Fetches the GoTrue `/settings` endpoint.
+ * Throws `MissingIdentityError` if Identity is not configured.
+ * Throws `AuthError` if the endpoint is unreachable.
+ */
+declare const getSettings: () => Promise<Settings>;
+
+interface JWTClaims {
+    sub: string;
+    email: string;
+    exp: number;
+    iat: number;
+    aud: string;
+    app_metadata: AppMetadata;
+    user_metadata: Record<string, unknown>;
+}
+
+declare class AuthError extends Error {
+    name: string;
+    status?: number;
+    cause?: unknown;
+    constructor(message: string, status?: number, options?: {
+        cause?: unknown;
+    });
+}
+declare class MissingIdentityError extends Error {
+    name: string;
+    constructor(message?: string);
+}
+
+export { type AppMetadata, AuthError, type AuthProvider, type IdentityConfig, type JWTClaims, MissingIdentityError, type Settings, type User, getIdentityConfig, getSettings, getUser, isAuthenticated, toUser };

package/dist/index.d.ts

@@ -0,0 +1,79 @@
+import { UserData } from 'gotrue-js';
+
+type AuthProvider = 'google' | 'github' | 'gitlab' | 'bitbucket' | 'facebook' | 'saml' | 'email';
+interface AppMetadata {
+    provider: AuthProvider;
+    roles?: string[];
+    [key: string]: unknown;
+}
+interface IdentityConfig {
+    url: string;
+    token?: string;
+}
+interface Settings {
+    autoconfirm: boolean;
+    disableSignup: boolean;
+    providers: Record<AuthProvider, boolean>;
+}
+
+interface User {
+    id: string;
+    email?: string;
+    emailVerified?: boolean;
+    createdAt?: string;
+    updatedAt?: string;
+    provider?: AuthProvider;
+    name?: string;
+    pictureUrl?: string;
+    metadata?: Record<string, unknown>;
+    rawGoTrueData?: Record<string, unknown>;
+}
+declare const toUser: (userData: UserData) => User;
+/**
+ * Returns the currently authenticated user, or `null` if not logged in.
+ * Synchronous. Never throws.
+ */
+declare const getUser: () => User | null;
+/**
+ * Returns `true` if a user is currently authenticated.
+ */
+declare const isAuthenticated: () => boolean;
+
+/**
+ * Returns the identity configuration for the current environment.
+ * Browser: always returns `{ url }` derived from `window.location.origin`.
+ * Server: returns `{ url, token }` from the identity context, or `null` if unavailable.
+ * Never throws.
+ */
+declare const getIdentityConfig: () => IdentityConfig | null;
+/**
+ * Fetches the GoTrue `/settings` endpoint.
+ * Throws `MissingIdentityError` if Identity is not configured.
+ * Throws `AuthError` if the endpoint is unreachable.
+ */
+declare const getSettings: () => Promise<Settings>;
+
+interface JWTClaims {
+    sub: string;
+    email: string;
+    exp: number;
+    iat: number;
+    aud: string;
+    app_metadata: AppMetadata;
+    user_metadata: Record<string, unknown>;
+}
+
+declare class AuthError extends Error {
+    name: string;
+    status?: number;
+    cause?: unknown;
+    constructor(message: string, status?: number, options?: {
+        cause?: unknown;
+    });
+}
+declare class MissingIdentityError extends Error {
+    name: string;
+    constructor(message?: string);
+}
+
+export { type AppMetadata, AuthError, type AuthProvider, type IdentityConfig, type JWTClaims, MissingIdentityError, type Settings, type User, getIdentityConfig, getSettings, getUser, isAuthenticated, toUser };

package/dist/index.js

@@ -0,0 +1,131 @@
+// src/environment.ts
+import GoTrue from "gotrue-js";
+var goTrueClient = null;
+var cachedApiUrl;
+var warnedMissingUrl = false;
+var isBrowser = () => typeof window !== "undefined";
+var discoverApiUrl = () => {
+  if (cachedApiUrl !== void 0) return cachedApiUrl;
+  if (isBrowser()) {
+    cachedApiUrl = `${window.location.origin}/.netlify/identity`;
+  } else {
+    const identityContext = getIdentityContext();
+    if (identityContext?.url) {
+      cachedApiUrl = identityContext.url;
+    }
+  }
+  return cachedApiUrl ?? null;
+};
+var getGoTrueClient = () => {
+  if (goTrueClient) return goTrueClient;
+  const apiUrl = discoverApiUrl();
+  if (!apiUrl) {
+    if (!warnedMissingUrl) {
+      console.warn(
+        "@netlify/identity: Could not determine the Identity endpoint URL. Make sure your site has Netlify Identity enabled, or run your app with `netlify dev`."
+      );
+      warnedMissingUrl = true;
+    }
+    return null;
+  }
+  goTrueClient = new GoTrue({ APIUrl: apiUrl, setCookie: isBrowser() });
+  return goTrueClient;
+};
+var getIdentityContext = () => {
+  const identityContext = globalThis.netlifyIdentityContext;
+  if (!identityContext?.url) return null;
+  return { url: identityContext.url, token: identityContext.token };
+};
+
+// src/user.ts
+var toUser = (userData) => {
+  const name = userData.user_metadata.full_name || userData.user_metadata.name;
+  const pictureUrl = userData.user_metadata.avatar_url;
+  return {
+    id: userData.id,
+    email: userData.email,
+    emailVerified: !!userData.confirmed_at,
+    createdAt: userData.created_at,
+    updatedAt: userData.updated_at,
+    provider: userData.app_metadata.provider,
+    name: typeof name === "string" ? name : void 0,
+    pictureUrl: typeof pictureUrl === "string" ? pictureUrl : void 0,
+    metadata: userData.user_metadata,
+    rawGoTrueData: { ...userData }
+  };
+};
+var getUser = () => {
+  if (isBrowser()) {
+    const client = getGoTrueClient();
+    const currentUser = client?.currentUser() ?? null;
+    if (!currentUser) return null;
+    return toUser(currentUser);
+  }
+  const identityContext = globalThis.netlifyIdentityContext;
+  if (!identityContext?.user) return null;
+  return toUser(identityContext.user);
+};
+var isAuthenticated = () => getUser() !== null;
+
+// src/errors.ts
+var AuthError = class extends Error {
+  constructor(message, status, options) {
+    super(message);
+    this.name = "AuthError";
+    this.status = status;
+    if (options?.cause) {
+      this.cause = options.cause;
+    }
+  }
+};
+var MissingIdentityError = class extends Error {
+  constructor(message = "Identity is not available in this environment") {
+    super(message);
+    this.name = "MissingIdentityError";
+  }
+};
+
+// src/config.ts
+var getIdentityConfig = () => {
+  if (isBrowser()) {
+    return { url: `${window.location.origin}/.netlify/identity` };
+  }
+  return getIdentityContext();
+};
+var getSettings = async () => {
+  const client = getGoTrueClient();
+  if (!client) throw new MissingIdentityError();
+  try {
+    const raw = await client.settings();
+    const external = raw.external ?? {};
+    return {
+      autoconfirm: raw.autoconfirm,
+      disableSignup: raw.disable_signup,
+      providers: {
+        google: external.google ?? false,
+        github: external.github ?? false,
+        gitlab: external.gitlab ?? false,
+        bitbucket: external.bitbucket ?? false,
+        facebook: external.facebook ?? false,
+        email: external.email ?? false,
+        saml: false
+      }
+    };
+  } catch (err) {
+    throw new AuthError(
+      err instanceof Error ? err.message : "Failed to fetch identity settings",
+      502,
+      { cause: err }
+    );
+  }
+};
+export {
+  AuthError,
+  MissingIdentityError,
+  getIdentityConfig,
+  getSettings,
+  getUser,
+  isAuthenticated,
+  toUser
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/environment.ts","../src/user.ts","../src/errors.ts","../src/config.ts"],"sourcesContent":["import GoTrue from 'gotrue-js'\n\nimport type { IdentityConfig } from './types.js'\n\nlet goTrueClient: GoTrue | null = null\nlet cachedApiUrl: string | null | undefined\nlet warnedMissingUrl = false\n\nexport const isBrowser = (): boolean => typeof window !== 'undefined'\n\n/**\n * Discovers and caches the GoTrue API URL.\n *\n * Browser: uses `window.location.origin` + `/.netlify/identity`.\n * Server: reads from `globalThis.netlifyIdentityContext`.\n */\nconst discoverApiUrl = (): string | null => {\n  if (cachedApiUrl !== undefined) return cachedApiUrl\n\n  if (isBrowser()) {\n    cachedApiUrl = `${window.location.origin}/.netlify/identity`\n  } else {\n    const identityContext = getIdentityContext()\n    if (identityContext?.url) {\n      cachedApiUrl = identityContext.url\n    }\n  }\n\n  return cachedApiUrl ?? null\n}\n\n/**\n * Returns (and lazily creates) a singleton gotrue-js client.\n * Returns `null` and logs a warning if no identity URL can be discovered.\n */\nexport const getGoTrueClient = (): GoTrue | null => {\n  if (goTrueClient) return goTrueClient\n\n  const apiUrl = discoverApiUrl()\n  if (!apiUrl) {\n    if (!warnedMissingUrl) {\n      console.warn(\n        '@netlify/identity: Could not determine the Identity endpoint URL. ' +\n          'Make sure your site has Netlify Identity enabled, or run your app with `netlify dev`.',\n      )\n      warnedMissingUrl = true\n    }\n    return null\n  }\n\n  goTrueClient = new GoTrue({ APIUrl: apiUrl, setCookie: isBrowser() })\n  return goTrueClient\n}\n\n/**\n * Reads the server-side identity context set by the Netlify bootstrap.\n * Returns `null` outside the Netlify serverless environment.\n */\nexport const getIdentityContext = (): IdentityConfig | null => {\n  const identityContext = globalThis.netlifyIdentityContext\n  if (!identityContext?.url) return null\n  return { url: identityContext.url, token: identityContext.token }\n}\n\n/** Reset cached state for tests. */\nexport const resetTestGoTrueClient = (): void => {\n  goTrueClient = null\n  cachedApiUrl = undefined\n  warnedMissingUrl = false\n}\n","import type { UserData } from 'gotrue-js'\nimport type { AuthProvider } from './types.js'\nimport { getGoTrueClient, isBrowser } from './environment.js'\n\nexport interface User {\n  id: string\n  email?: string\n  emailVerified?: boolean\n  createdAt?: string\n  updatedAt?: string\n  provider?: AuthProvider\n  name?: string\n  pictureUrl?: string\n  metadata?: Record<string, unknown>\n  rawGoTrueData?: Record<string, unknown>\n}\n\nexport const toUser = (userData: UserData): User => {\n  const name = userData.user_metadata.full_name || userData.user_metadata.name\n  const pictureUrl = userData.user_metadata.avatar_url\n\n  return {\n    id: userData.id,\n    email: userData.email,\n    emailVerified: !!userData.confirmed_at,\n    createdAt: userData.created_at,\n    updatedAt: userData.updated_at,\n    provider: userData.app_metadata.provider as AuthProvider,\n    name: typeof name === 'string' ? name : undefined,\n    pictureUrl: typeof pictureUrl === 'string' ? pictureUrl : undefined,\n    metadata: userData.user_metadata,\n    rawGoTrueData: { ...userData },\n  }\n}\n\n/**\n * Returns the currently authenticated user, or `null` if not logged in.\n * Synchronous. Never throws.\n */\nexport const getUser = (): User | null => {\n  if (isBrowser()) {\n    const client = getGoTrueClient()\n    const currentUser = client?.currentUser() ?? null\n    if (!currentUser) return null\n    return toUser(currentUser)\n  }\n\n  const identityContext = globalThis.netlifyIdentityContext\n  if (!identityContext?.user) return null\n  return toUser(identityContext.user)\n}\n\n/**\n * Returns `true` if a user is currently authenticated.\n */\nexport const isAuthenticated = (): boolean => getUser() !== null\n\n","export class AuthError extends Error {\n  override name = 'AuthError'\n  status?: number\n  declare cause?: unknown\n\n  constructor(message: string, status?: number, options?: { cause?: unknown }) {\n    super(message)\n    this.status = status\n    if (options?.cause) {\n      this.cause = options.cause\n    }\n  }\n}\n\nexport class MissingIdentityError extends Error {\n  override name = 'MissingIdentityError'\n\n  constructor(message = 'Identity is not available in this environment') {\n    super(message)\n  }\n}\n","import type { IdentityConfig, Settings } from './types.js'\nimport { AuthError, MissingIdentityError } from './errors.js'\nimport { getGoTrueClient, getIdentityContext, isBrowser } from './environment.js'\n\n/**\n * Returns the identity configuration for the current environment.\n * Browser: always returns `{ url }` derived from `window.location.origin`.\n * Server: returns `{ url, token }` from the identity context, or `null` if unavailable.\n * Never throws.\n */\nexport const getIdentityConfig = (): IdentityConfig | null => {\n  if (isBrowser()) {\n    return { url: `${window.location.origin}/.netlify/identity` }\n  }\n\n  return getIdentityContext()\n}\n\n/**\n * Fetches the GoTrue `/settings` endpoint.\n * Throws `MissingIdentityError` if Identity is not configured.\n * Throws `AuthError` if the endpoint is unreachable.\n */\nexport const getSettings = async (): Promise<Settings> => {\n  const client = getGoTrueClient()\n  if (!client) throw new MissingIdentityError()\n\n  try {\n    const raw = await client.settings()\n    const external = raw.external ?? {}\n    return {\n      autoconfirm: raw.autoconfirm,\n      disableSignup: raw.disable_signup,\n      providers: {\n        google: external.google ?? false,\n        github: external.github ?? false,\n        gitlab: external.gitlab ?? false,\n        bitbucket: external.bitbucket ?? false,\n        facebook: external.facebook ?? false,\n        email: external.email ?? false,\n        saml: false,\n      },\n    }\n  } catch (err) {\n    throw new AuthError(\n      err instanceof Error ? err.message : 'Failed to fetch identity settings',\n      502,\n      { cause: err },\n    )\n  }\n}\n"],"mappings":";AAAA,OAAO,YAAY;AAInB,IAAI,eAA8B;AAClC,IAAI;AACJ,IAAI,mBAAmB;AAEhB,IAAM,YAAY,MAAe,OAAO,WAAW;AAQ1D,IAAM,iBAAiB,MAAqB;AAC1C,MAAI,iBAAiB,OAAW,QAAO;AAEvC,MAAI,UAAU,GAAG;AACf,mBAAe,GAAG,OAAO,SAAS,MAAM;AAAA,EAC1C,OAAO;AACL,UAAM,kBAAkB,mBAAmB;AAC3C,QAAI,iBAAiB,KAAK;AACxB,qBAAe,gBAAgB;AAAA,IACjC;AAAA,EACF;AAEA,SAAO,gBAAgB;AACzB;AAMO,IAAM,kBAAkB,MAAqB;AAClD,MAAI,aAAc,QAAO;AAEzB,QAAM,SAAS,eAAe;AAC9B,MAAI,CAAC,QAAQ;AACX,QAAI,CAAC,kBAAkB;AACrB,cAAQ;AAAA,QACN;AAAA,MAEF;AACA,yBAAmB;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,IAAI,OAAO,EAAE,QAAQ,QAAQ,WAAW,UAAU,EAAE,CAAC;AACpE,SAAO;AACT;AAMO,IAAM,qBAAqB,MAA6B;AAC7D,QAAM,kBAAkB,WAAW;AACnC,MAAI,CAAC,iBAAiB,IAAK,QAAO;AAClC,SAAO,EAAE,KAAK,gBAAgB,KAAK,OAAO,gBAAgB,MAAM;AAClE;;;AC7CO,IAAM,SAAS,CAAC,aAA6B;AAClD,QAAM,OAAO,SAAS,cAAc,aAAa,SAAS,cAAc;AACxE,QAAM,aAAa,SAAS,cAAc;AAE1C,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,OAAO,SAAS;AAAA,IAChB,eAAe,CAAC,CAAC,SAAS;AAAA,IAC1B,WAAW,SAAS;AAAA,IACpB,WAAW,SAAS;AAAA,IACpB,UAAU,SAAS,aAAa;AAAA,IAChC,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,IACxC,YAAY,OAAO,eAAe,WAAW,aAAa;AAAA,IAC1D,UAAU,SAAS;AAAA,IACnB,eAAe,EAAE,GAAG,SAAS;AAAA,EAC/B;AACF;AAMO,IAAM,UAAU,MAAmB;AACxC,MAAI,UAAU,GAAG;AACf,UAAM,SAAS,gBAAgB;AAC/B,UAAM,cAAc,QAAQ,YAAY,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO;AACzB,WAAO,OAAO,WAAW;AAAA,EAC3B;AAEA,QAAM,kBAAkB,WAAW;AACnC,MAAI,CAAC,iBAAiB,KAAM,QAAO;AACnC,SAAO,OAAO,gBAAgB,IAAI;AACpC;AAKO,IAAM,kBAAkB,MAAe,QAAQ,MAAM;;;ACvDrD,IAAM,YAAN,cAAwB,MAAM;AAAA,EAKnC,YAAY,SAAiB,QAAiB,SAA+B;AAC3E,UAAM,OAAO;AALf,SAAS,OAAO;AAMd,SAAK,SAAS;AACd,QAAI,SAAS,OAAO;AAClB,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;AAEO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAG9C,YAAY,UAAU,iDAAiD;AACrE,UAAM,OAAO;AAHf,SAAS,OAAO;AAAA,EAIhB;AACF;;;ACVO,IAAM,oBAAoB,MAA6B;AAC5D,MAAI,UAAU,GAAG;AACf,WAAO,EAAE,KAAK,GAAG,OAAO,SAAS,MAAM,qBAAqB;AAAA,EAC9D;AAEA,SAAO,mBAAmB;AAC5B;AAOO,IAAM,cAAc,YAA+B;AACxD,QAAM,SAAS,gBAAgB;AAC/B,MAAI,CAAC,OAAQ,OAAM,IAAI,qBAAqB;AAE5C,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,SAAS;AAClC,UAAM,WAAW,IAAI,YAAY,CAAC;AAClC,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,MACjB,eAAe,IAAI;AAAA,MACnB,WAAW;AAAA,QACT,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ,SAAS,UAAU;AAAA,QAC3B,WAAW,SAAS,aAAa;AAAA,QACjC,UAAU,SAAS,YAAY;AAAA,QAC/B,OAAO,SAAS,SAAS;AAAA,QACzB,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,eAAe,QAAQ,IAAI,UAAU;AAAA,MACrC;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@netlify/identity",
+  "version": "0.1.0-alpha.0",
+  "type": "module",
+  "description": "Add authentication to your Netlify site with a few lines of code",
+  "main": "./dist/index.cjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.cjs",
+    "dist/**/*.d.ts",
+    "dist/**/*.d.cts",
+    "dist/**/*.map"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint src test",
+    "format": "prettier --check .",
+    "format:fix": "prettier --write .",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run test"
+  },
+  "keywords": [
+    "netlify",
+    "identity",
+    "authentication",
+    "jwt"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/netlify/identity.git"
+  },
+  "bugs": {
+    "url": "https://github.com/netlify/identity/issues"
+  },
+  "author": "Netlify Inc.",
+  "devDependencies": {
+    "eslint": "^9.0.0",
+    "jsdom": "^28.1.0",
+    "prettier": "^3.0.0",
+    "tsup": "^8.5.0",
+    "typescript": "^5.0.0",
+    "typescript-eslint": "^8.0.0",
+    "vitest": "^4.0.0"
+  },
+  "dependencies": {
+    "gotrue-js": "^1.0.1"
+  }
+}