@petrarca/sonnet-shell 0.4.2 → 0.6.0

package/dist/auth/index.d.ts

@@ -1,43 +1,50 @@
 import { ReactNode } from 'react';
 
 /**
- * TenantSelection -- shown after authentication when the user has
- * multiple tenants and no default is set. The user must pick a tenant
- * before the app loads.
+ * OrgSelection -- shown after authentication when the user belongs to
+ * multiple organizations and no default is set. The user selects which
+ * organization context to act in before the app loads.
+ *
+ * "Organization" is used generically: in Sestina this is an org-unit; in
+ * another app it could be a tenant, workspace, team, or company. The
+ * consumer maps their domain type to OrgOption.
  *
  * Fully props-driven with no app-specific imports.
  * Target package: @petrarca/sonnet-shell
  */
-/** Minimal tenant descriptor. Consumers map their domain type to this shape. */
-interface TenantOption {
+/** Minimal organization descriptor. Consumers map their domain type to this shape. */
+interface OrgOption {
     id: string;
     name: string;
 }
-interface TenantSelectionProps {
-    tenants: TenantOption[];
+interface OrgSelectionProps {
+    orgs: OrgOption[];
     isLoading: boolean;
     error: string | null;
     onSelect: (id: string) => void;
 }
-declare function TenantSelection({ tenants, isLoading, error, onSelect, }: TenantSelectionProps): React.ReactElement;
+declare function OrgSelection({ orgs, isLoading, error, onSelect, }: OrgSelectionProps): React.ReactElement;
 
 /**
  * Login -- multi-step authentication flow.
  *
- * Step 1: Credentials (local auth form or OIDC redirect)
- * Step 2: Tenant selection (if user has multiple tenants and no default)
+ * Steps:
+ *   identifier    -- email/username entry (when onDiscover is provided)
+ *   auth          -- resolved providers: password form first, SSO buttons below
+ *   credentials   -- legacy single-screen (no onDiscover)
+ *   org-selection -- organization picker after successful auth
+ *
+ * When onDiscover is NOT provided, falls back to the legacy single-screen
+ * behaviour. Backward compatible.
  *
- * Steps are shown conditionally. If the user has a default tenant,
- * step 2 is skipped and the app loads immediately.
+ * All async operations are injected via props. The component knows nothing
+ * about OIDC, PKCE, Sestina, or discover endpoints.
  *
- * ProtectedRoute passes a `step` hint in location.state so this
- * component always opens on the correct step when redirected.
+ * Design: centered card on gray-100, white card with elevated shadow,
+ * consistent with Auth0 Universal Login / WorkOS AuthKit visual language.
  *
- * All auth state and operations are injected via props -- no direct
- * store or context imports.
  * Target package: @petrarca/sonnet-shell
  */
-/** Auth feature flags and provider configuration. Consumer-supplied. */
 interface AuthConfig {
     enabled: boolean;
     features: {
@@ -55,30 +62,35 @@ interface AuthConfig {
         direct_redirect: string | null;
     };
 }
+interface LoginProvider {
+    type: "local" | "external";
+    name: string;
+    label: string;
+}
 interface LoginProps {
-    /** Auth feature flags and OAuth provider config. */
     config: AuthConfig | null;
-    /** Whether the user is currently authenticated (token present). */
     isAuthenticated: boolean;
-    /** Active tenant id, null when not yet selected. */
     activeTenantId: string | null;
-    /** Whether an async operation is in flight. */
     isLoading: boolean;
-    /** Auth error message to display, null when none. */
     error: string | null;
-    /** The authenticated user's available tenants. */
-    tenants: TenantOption[] | null;
-    /** Perform credential login. Throws on failure. */
+    orgs: OrgOption[] | null;
     onLogin: (credentials: {
         identifier: string;
         password: string;
     }) => Promise<void>;
-    /** Fetch the current user after login to resolve tenant state. */
     onFetchCurrentUser: () => Promise<void>;
-    /** Switch to the given tenant. Throws on failure. */
-    onSwitchTenant: (id: string) => Promise<void>;
-    /** Clear the current auth error. */
+    onSelectOrg: (id: string) => Promise<void>;
     onClearError: () => void;
+    /** Application name shown above the card as a brand label. */
+    appName?: string;
+    /** Logo URL shown above the card. If provided, appName is used as alt text. */
+    logoUrl?: string;
+    /** Enables identifier-first flow. App calls discover endpoint and returns providers. */
+    onDiscover?: (identifier: string) => Promise<LoginProvider[]>;
+    /** Called when user clicks an external provider button. App handles PKCE + redirect. */
+    onExternalLogin?: (provider: LoginProvider) => Promise<void> | void;
+    /** Whether discovery is in flight. */
+    isDiscovering?: boolean;
 }
 declare function Login(props: LoginProps): React.ReactElement | null;
 
@@ -114,4 +126,4 @@ interface ProtectedRouteProps {
 }
 declare function ProtectedRoute({ children, authEnabled, authConfigLoading, isAuthenticated, accessToken, activeTenantId, initializeAuth, }: ProtectedRouteProps): React.ReactElement;
 
-export { type AuthConfig, Login, type LoginProps, ProtectedRoute, type ProtectedRouteProps, type TenantOption, TenantSelection };
+export { type AuthConfig, Login, type LoginProps, type LoginProvider, type OrgOption, OrgSelection, ProtectedRoute, type ProtectedRouteProps };