@runlot/auth 0.1.0-rc.16 → 0.1.0-rc.161

package/dist/client.d.ts

@@ -1,37 +1,144 @@
 import { type User } from "./index.js";
+import { type AuthApiErrorCode } from "./errors.js";
+export { AUTH_API_ERROR_CODES, AUTH_ERROR_CODES, authErrorMessage, isAuthApiErrorCode, isAuthErrorCode, parseAuthError, stripAuthError, withoutAuthError, } from "./errors.js";
+export type { AuthApiErrorCode, AuthErrorCode, AuthLang, ParsedAuthError } from "./errors.js";
 export interface NextOpts {
     next?: string;
 }
-/** 프로젝트가 등록할 수 있는 소셜 프로바이더 (docs/auth.md §9). */
-export type AuthProvider = "github" | "google" | "kakao";
-/** 로그인 페이지. 프로바이더를 주면 그 프로바이더의 authorize 로 바로 간다. */
+/**
+ * A provider id: `"github"`, `"google"`, `"runlot"`, or the id of one of the
+ * project's OIDC providers (docs/auth-access-unify.md §5).
+ */
+export type AuthProvider = "github" | "google" | "runlot" | (string & {});
+/** A Runlot ID method the app can deep-link to (docs/custom-sign-in.md §3.1). */
+export type RunlotMethod = "password" | "google" | "github" | "passkey";
+/** Options only `signInUrl("runlot", …)` takes (§12.1). */
+export interface RunlotSignInOpts extends NextOpts {
+    /** Skip the chooser and go straight to this method. */
+    idp?: RunlotMethod;
+    /** Prefills the email on the Runlot form; never trusted for anything. */
+    loginHint?: string;
+    /** Where errors return to instead of `next`. Same-origin path. */
+    errorNext?: string;
+    /** `"none"`: sign in with no page if already consented, else `login_required`. */
+    prompt?: "none";
+}
+/** The sign-in page. Given a provider, it goes straight to that provider's
+ *  authorize. `idp`, `loginHint`, `errorNext` and `prompt` exist only for
+ *  `"runlot"`. */
+export declare function signInUrl(provider: "runlot", opts?: RunlotSignInOpts): string;
 export declare function signInUrl(provider?: AuthProvider, opts?: NextOpts): string;
 /**
- * 가입 페이지.
+ * The sign-up page.
  *
- * **프로바이더 인자가 없다.** 소셜은 가입과 로그인이 한 길이라
- * (docs/auth.md §5 — `GET sign-in/{provider}` 하나뿐이고 신원 upsert 가 §6 의
- * 연결 규칙을 탄다) `signUpUrl("github")` 같은 주소는 서버에 없다. 소셜로
- * 가입시키려면 `signInUrl(provider)` 를 쓴다.
+ * **There is no provider argument.** For social logins, signing up and signing
+ * in are one path (docs/auth.md §5 — there is only `GET sign-in/{provider}`,
+ * and the identity upsert rides the linking rules of §6), so a URL like
+ * `signUpUrl("github")` does not exist on the server. To sign somebody up with
+ * a social provider, use `signInUrl(provider)`.
  */
 export declare function signUpUrl(opts?: NextOpts): string;
 /**
- * 로그아웃.
+ * Sign-out.
  *
- * **링크가 아니라 POST 대상이다** (docs/auth.md §5). `<form method="post"
- * action={signOutUrl()}>` 로 쓴다 — GET 으로 로그아웃되면 남의 페이지에 박힌
- * `<img>` 하나가 사용자를 내보낼 수 있다.
+ * **It is a POST target, not a link** (docs/auth.md §5). Use it as `<form
+ * method="post" action={signOutUrl()}>` — if a GET could sign somebody out, a
+ * single `<img>` embedded in somebody else's page could throw the user out.
  */
 export declare function signOutUrl(opts?: NextOpts): string;
 /**
- * 지금 로그인한 사람. 클라이언트 렌더 앱이 부팅할 때 부르는 자리다.
+ * One sign-in provider the project has turned on. `kind` is `builtin` for the
+ * project's own GitHub or Google app, `oidc` for a generic OpenID Connect
+ * provider, `runlot` for "Continue with Runlot". `name` is the button label and
+ * `icon` an icon URL (empty when there is none).
+ */
+export interface AuthProviderInfo {
+    id: string;
+    kind: "builtin" | "oidc" | "runlot";
+    name: string;
+    icon: string;
+    /** For the `runlot` row only: the Runlot ID methods the chooser offers,
+     *  each usable as `signInUrl("runlot", { idp })` (§12.3). */
+    methods?: RunlotMethod[];
+}
+/**
+ * What the sign-in page needs to know about the project, from
+ * `GET /__runlot/auth/config`. No secrets: what is here is what the hosted
+ * page already shows.
+ */
+export interface AuthConfig {
+    brand: {
+        name: string;
+        logo: string;
+        color: string;
+    };
+    /** Only the providers that are turned on — draw a button for each and no other. */
+    providers: AuthProviderInfo[];
+    password: boolean;
+    magicLink: boolean;
+    /** Off means only existing users can sign in, by any method including social. */
+    allowSignup: boolean;
+}
+/**
+ * The project's sign-in configuration, for a custom login page.
+ *
+ * **It throws on anything but a 200** — unlike `session()`, there is no answer
+ * that means "nothing": a 404 is a project whose login is off, and a page that
+ * drew zero buttons from it would hide that.
+ */
+export declare function config(fetchImpl?: typeof fetch): Promise<AuthConfig>;
+/** The turned-on providers, so a custom page never draws a button that answers `provider_not_configured`. */
+export declare function providers(fetchImpl?: typeof fetch): Promise<AuthProviderInfo[]>;
+/**
+ * Who is signed in right now. This is what a client-rendered app calls while
+ * booting.
  *
- * 답이 200 이 아니면 `{ user: null }` 이다 — 로그아웃 상태는 예외가 아니라
- * 답이고(401 도 답이다), 던지면 모든 페이지가 try/catch 가 된다.
+ * Anything other than a 200 gives `{ user: null }` — being signed out is an
+ * answer, not an exception (a 401 is an answer too), and throwing would turn
+ * every page into a try/catch.
  *
- * `fetchImpl` 은 시험이 가짜를 넣는 구멍이다.
+ * `fetchImpl` is the hole through which the tests inject a fake.
  */
 export declare function session(fetchImpl?: typeof fetch): Promise<{
     user: User | null;
 }>;
+export type AuthApiResult<T> = ({
+    ok: true;
+} & T) | {
+    ok: false;
+    error: AuthApiErrorCode;
+    status: number;
+    retryAfter: number | null;
+};
+/** Project-local password sign-in from the app's own form. Sets the session cookie on success. */
+export declare function signInWithPassword(input: {
+    email: string;
+    password: string;
+}, fetchImpl?: typeof fetch): Promise<AuthApiResult<{
+    user: User;
+}>>;
+/** Project-local sign-up. `check_email` means a verification mail was (or would have been) sent. */
+export declare function signUp(input: {
+    email: string;
+    password: string;
+    name?: string;
+}, fetchImpl?: typeof fetch): Promise<AuthApiResult<{
+    user?: User;
+}>>;
+/** Sends a reset mail. Always succeeds (202) for any address — no enumeration. */
+export declare function requestReset(input: {
+    email: string;
+}, fetchImpl?: typeof fetch): Promise<AuthApiResult<object>>;
+/** Sets a new password with the token from the reset mail. */
+export declare function confirmReset(input: {
+    token: string;
+    password: string;
+}, fetchImpl?: typeof fetch): Promise<AuthApiResult<{
+    user?: User;
+}>>;
+/** Sends a magic sign-in link. Always 202. `next` is filtered like every other `next`. */
+export declare function sendMagicLink(input: {
+    email: string;
+    next?: string;
+}, fetchImpl?: typeof fetch): Promise<AuthApiResult<object>>;
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAa,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAqBzD,qDAAqD;AACrD,wBAAgB,SAAS,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAEjD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAElD;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAAC,CAKtF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,OAAO,EAAa,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,KAAK,gBAAgB,EAAsB,MAAM,aAAa,CAAC;AAExE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9F,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAyB1E,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExE,2DAA2D;AAC3D,MAAM,WAAW,gBAAiB,SAAQ,QAAQ;IAChD,uDAAuD;IACvD,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAaD;;kBAEkB;AAClB,wBAAgB,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC;AAC/E,wBAAgB,SAAS,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;AAY5E;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAEjD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;iEAC6D;IAC7D,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,mFAAmF;IACnF,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,iFAAiF;IACjF,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAK1E;AAED,6GAA6G;AAC7G,wBAAsB,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAErF;AAED;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAAC,CAKtF;AAID,MAAM,MAAM,aAAa,CAAC,CAAC,IACvB,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,CAAC,CAAC,GAClB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAgCtF,kGAAkG;AAClG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC1C,SAAS,CAAC,EAAE,OAAO,KAAK,GACvB,OAAO,CAAC,aAAa,CAAC;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,CAExC;AAED,oGAAoG;AACpG,wBAAgB,MAAM,CACpB,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACzD,SAAS,CAAC,EAAE,OAAO,KAAK,GACvB,OAAO,CAAC,aAAa,CAAC;IAAE,IAAI,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,CAEzC;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAE/G;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAC1B,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC1C,SAAS,CAAC,EAAE,OAAO,KAAK,GACvB,OAAO,CAAC,aAAa,CAAC;IAAE,IAAI,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,CAEzC;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAC3B,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACvC,SAAS,CAAC,EAAE,OAAO,KAAK,GACvB,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAGhC"}

package/dist/client.js

@@ -1,12 +1,16 @@
-// 브라우저 도우미 (docs/auth.md §10). 링크를 짓는 일과 `GET /session` 한 번이
-// 전부라 의존성이 0 이고, 서버가 아는 것을 다시 안다고 주장하지 않는다.
+// Browser helpers (docs/auth.md §10). Building links and one `GET /session` is
+// all there is, so it has zero dependencies, and it does not claim to know
+// again what the server already knows.
 import { AUTH_BASE } from "./index.js";
-// `next` 는 같은 오리진의 상대 경로만 통과시킨다 — docs/auth.md §5 의 `safeNext`
-// 와 같은 규칙이다. `/` 로 시작해야 하고 `//` 로 시작하면 안 된다: `//evil.example`
-// 은 브라우저가 절대 URL 로 읽으므로 열린 리다이렉트가 된다.
+import { isAuthApiErrorCode } from "./errors.js";
+export { AUTH_API_ERROR_CODES, AUTH_ERROR_CODES, authErrorMessage, isAuthApiErrorCode, isAuthErrorCode, parseAuthError, stripAuthError, withoutAuthError, } from "./errors.js";
+// `next` lets through only a same-origin relative path — the same rule as
+// `safeNext` in docs/auth.md §5. It has to start with `/` and must not start
+// with `//`: the browser reads `//evil.example` as an absolute URL, which makes
+// it an open redirect.
 //
-// 여기서 거르는 것은 편의일 뿐 보안 경계가 아니다. 링크는 손으로도 만들 수 있으니
-// 서버가 같은 검사를 다시 한다.
+// Filtering here is a convenience, not a security boundary. A link can also be
+// made by hand, so the server runs the same check again.
 function safeNext(next) {
     if (next === undefined || next === "")
         return null;
@@ -16,43 +20,84 @@ function safeNext(next) {
         return null;
     return next;
 }
-function authUrl(path, provider, opts) {
+function authUrl(path, provider, params) {
     const base = `${AUTH_BASE}/${path}${provider ? `/${provider}` : ""}`;
-    const next = safeNext(opts?.next);
-    return next === null ? base : `${base}?next=${encodeURIComponent(next)}`;
+    const q = Object.entries(params ?? {})
+        .filter((e) => e[1] !== null)
+        .map(([k, v]) => `${k}=${encodeURIComponent(v)}`)
+        .join("&");
+    return q === "" ? base : `${base}?${q}`;
+}
+const METHODS = ["password", "google", "github", "passkey"];
+// Same shape as the worker's `normEmail` filter — anything else is dropped,
+// which is what the server would do anyway.
+function safeHint(v) {
+    if (v === undefined)
+        return null;
+    const s = v.trim();
+    if (s === "" || s.length > 320 || !/^[^\s@]+@[^\s@]+$/.test(s))
+        return null;
+    return s;
 }
-/** 로그인 페이지. 프로바이더를 주면 그 프로바이더의 authorize 로 바로 간다. */
 export function signInUrl(provider, opts) {
-    return authUrl("sign-in", provider, opts);
+    const params = { next: safeNext(opts?.next) };
+    if (provider === "runlot" && opts) {
+        params.idp = opts.idp !== undefined && METHODS.includes(opts.idp) ? opts.idp : null;
+        params.login_hint = safeHint(opts.loginHint);
+        params.error_next = safeNext(opts.errorNext);
+        params.prompt = opts.prompt === "none" ? "none" : null;
+    }
+    return authUrl("sign-in", provider, params);
 }
 /**
- * 가입 페이지.
+ * The sign-up page.
  *
- * **프로바이더 인자가 없다.** 소셜은 가입과 로그인이 한 길이라
- * (docs/auth.md §5 — `GET sign-in/{provider}` 하나뿐이고 신원 upsert 가 §6 의
- * 연결 규칙을 탄다) `signUpUrl("github")` 같은 주소는 서버에 없다. 소셜로
- * 가입시키려면 `signInUrl(provider)` 를 쓴다.
+ * **There is no provider argument.** For social logins, signing up and signing
+ * in are one path (docs/auth.md §5 — there is only `GET sign-in/{provider}`,
+ * and the identity upsert rides the linking rules of §6), so a URL like
+ * `signUpUrl("github")` does not exist on the server. To sign somebody up with
+ * a social provider, use `signInUrl(provider)`.
  */
 export function signUpUrl(opts) {
-    return authUrl("sign-up", undefined, opts);
+    return authUrl("sign-up", undefined, { next: safeNext(opts?.next) });
 }
 /**
- * 로그아웃.
+ * Sign-out.
  *
- * **링크가 아니라 POST 대상이다** (docs/auth.md §5). `<form method="post"
- * action={signOutUrl()}>` 로 쓴다 — GET 으로 로그아웃되면 남의 페이지에 박힌
- * `<img>` 하나가 사용자를 내보낼 수 있다.
+ * **It is a POST target, not a link** (docs/auth.md §5). Use it as `<form
+ * method="post" action={signOutUrl()}>` — if a GET could sign somebody out, a
+ * single `<img>` embedded in somebody else's page could throw the user out.
  */
 export function signOutUrl(opts) {
-    return authUrl("sign-out", undefined, opts);
+    return authUrl("sign-out", undefined, { next: safeNext(opts?.next) });
+}
+/**
+ * The project's sign-in configuration, for a custom login page.
+ *
+ * **It throws on anything but a 200** — unlike `session()`, there is no answer
+ * that means "nothing": a 404 is a project whose login is off, and a page that
+ * drew zero buttons from it would hide that.
+ */
+export async function config(fetchImpl) {
+    const f = fetchImpl ?? fetch;
+    const res = await f(`${AUTH_BASE}/config`, { credentials: "same-origin" });
+    if (!res.ok)
+        throw new Error(`GET ${AUTH_BASE}/config → ${res.status}`);
+    return (await res.json());
+}
+/** The turned-on providers, so a custom page never draws a button that answers `provider_not_configured`. */
+export async function providers(fetchImpl) {
+    return (await config(fetchImpl)).providers;
 }
 /**
- * 지금 로그인한 사람. 클라이언트 렌더 앱이 부팅할 때 부르는 자리다.
+ * Who is signed in right now. This is what a client-rendered app calls while
+ * booting.
  *
- * 답이 200 이 아니면 `{ user: null }` 이다 — 로그아웃 상태는 예외가 아니라
- * 답이고(401 도 답이다), 던지면 모든 페이지가 try/catch 가 된다.
+ * Anything other than a 200 gives `{ user: null }` — being signed out is an
+ * answer, not an exception (a 401 is an answer too), and throwing would turn
+ * every page into a try/catch.
  *
- * `fetchImpl` 은 시험이 가짜를 넣는 구멍이다.
+ * `fetchImpl` is the hole through which the tests inject a fake.
  */
 export async function session(fetchImpl) {
     const f = fetchImpl ?? fetch;
@@ -61,4 +106,58 @@ export async function session(fetchImpl) {
         return { user: null };
     return (await res.json());
 }
+async function api(path, body, fetchImpl) {
+    const f = fetchImpl ?? fetch;
+    let res;
+    try {
+        res = await f(`${AUTH_BASE}/api/${path}`, {
+            method: "POST",
+            credentials: "same-origin",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+        });
+    }
+    catch {
+        return { ok: false, error: "server_error", status: 0, retryAfter: null };
+    }
+    let json = {};
+    try {
+        const text = await res.text();
+        if (text !== "")
+            json = JSON.parse(text);
+    }
+    catch {
+        json = {};
+    }
+    if (res.ok)
+        return { ok: true, ...json };
+    const ra = Number(res.headers.get("retry-after"));
+    return {
+        ok: false,
+        error: isAuthApiErrorCode(json.error) ? json.error : res.status === 429 ? "rate_limited" : "server_error",
+        status: res.status,
+        retryAfter: Number.isFinite(ra) && ra > 0 ? ra : null,
+    };
+}
+/** Project-local password sign-in from the app's own form. Sets the session cookie on success. */
+export function signInWithPassword(input, fetchImpl) {
+    return api("password/sign-in", input, fetchImpl);
+}
+/** Project-local sign-up. `check_email` means a verification mail was (or would have been) sent. */
+export function signUp(input, fetchImpl) {
+    return api("password/sign-up", input, fetchImpl);
+}
+/** Sends a reset mail. Always succeeds (202) for any address — no enumeration. */
+export function requestReset(input, fetchImpl) {
+    return api("password/reset", input, fetchImpl);
+}
+/** Sets a new password with the token from the reset mail. */
+export function confirmReset(input, fetchImpl) {
+    return api("password/reset/confirm", input, fetchImpl);
+}
+/** Sends a magic sign-in link. Always 202. `next` is filtered like every other `next`. */
+export function sendMagicLink(input, fetchImpl) {
+    const next = safeNext(input.next);
+    return api("magic-link", next === null ? { email: input.email } : { email: input.email, next }, fetchImpl);
+}
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,4CAA4C;AAE5C,OAAO,EAAE,SAAS,EAAa,MAAM,YAAY,CAAC;AASlD,+DAA+D;AAC/D,8DAA8D;AAC9D,sCAAsC;AACtC,EAAE;AACF,iDAAiD;AACjD,oBAAoB;AACpB,SAAS,QAAQ,CAAC,IAAwB;IACxC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,QAAuB,EAAE,IAAe;IACrE,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,SAAS,CAAC,QAAuB,EAAE,IAAe;IAChE,OAAO,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,IAAe;IACvC,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAe;IACxC,OAAO,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAwB;IACpD,MAAM,CAAC,GAAG,SAAS,IAAI,KAAK,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,UAAU,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;AACrD,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,2EAA2E;AAC3E,uCAAuC;AAEvC,OAAO,EAAE,SAAS,EAAa,MAAM,YAAY,CAAC;AAClD,OAAO,EAAyB,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAarB,0EAA0E;AAC1E,6EAA6E;AAC7E,gFAAgF;AAChF,uBAAuB;AACvB,EAAE;AACF,+EAA+E;AAC/E,yDAAyD;AACzD,SAAS,QAAQ,CAAC,IAAwB;IACxC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,QAAuB,EAAE,MAAsC;IAC5F,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrE,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AAC1C,CAAC;AAiBD,MAAM,OAAO,GAAsB,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAE/E,4EAA4E;AAC5E,4CAA4C;AAC5C,SAAS,QAAQ,CAAC,CAAqB;IACrC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,CAAC,CAAC;AACX,CAAC;AAOD,MAAM,UAAU,SAAS,CAAC,QAAuB,EAAE,IAAuB;IACxE,MAAM,MAAM,GAAkC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IAC7E,IAAI,QAAQ,KAAK,QAAQ,IAAI,IAAI,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,IAAe;IACvC,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAe;IACxC,OAAO,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAiCD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,SAAwB;IACnD,MAAM,CAAC,GAAG,SAAS,IAAI,KAAK,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,SAAS,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,SAAS,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAC;AAC1C,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAwB;IACtD,OAAO,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAwB;IACpD,MAAM,CAAC,GAAG,SAAS,IAAI,KAAK,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,UAAU,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;AACrD,CAAC;AAQD,KAAK,UAAU,GAAG,CAAI,IAAY,EAAE,IAAa,EAAE,SAAwB;IACzE,MAAM,CAAC,GAAG,SAAS,IAAI,KAAK,CAAC;IAC7B,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,QAAQ,IAAI,EAAE,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,aAAa;YAC1B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,KAAK,EAAE;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAI,IAAU,EAAE,CAAC;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAClD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc;QACzG,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;KACtD,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,kBAAkB,CAChC,KAA0C,EAC1C,SAAwB;IAExB,OAAO,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,MAAM,CACpB,KAAyD,EACzD,SAAwB;IAExB,OAAO,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,KAAwB,EAAE,SAAwB;IAC7E,OAAO,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAC1B,KAA0C,EAC1C,SAAwB;IAExB,OAAO,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAC3B,KAAuC,EACvC,SAAwB;IAExB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,YAAY,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;AAC7G,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,34 @@
+/** Codes the broker or the auth worker returns to the app on a redirect. */
+export declare const AUTH_ERROR_CODES: readonly ["cancelled", "signup_closed", "email_unverified", "provider_unavailable", "rate_limited", "expired", "consent_denied", "login_required", "account_exists", "server_error"];
+/** Extra codes only the project-local JSON API answers with (§12.6). */
+export declare const AUTH_API_ERROR_CODES: readonly ["invalid_credentials", "weak_password", "check_email", "csrf"];
+export type AuthErrorCode = (typeof AUTH_ERROR_CODES)[number];
+export type AuthApiErrorCode = AuthErrorCode | (typeof AUTH_API_ERROR_CODES)[number];
+export type AuthLang = "ko" | "en" | "ja";
+export declare function isAuthErrorCode(v: unknown): v is AuthErrorCode;
+export declare function isAuthApiErrorCode(v: unknown): v is AuthApiErrorCode;
+/** The default message for a code. Korean when `lang` is omitted or unknown. */
+export declare function authErrorMessage(code: AuthApiErrorCode, lang?: AuthLang | (string & {})): string;
+export interface ParsedAuthError {
+    code: AuthErrorCode;
+    /** The start id support looks up; `null` when absent. */
+    request: string | null;
+}
+/**
+ * Reads `auth_error` / `auth_request` from a URL (or `location`). `null` when
+ * there is no error. An unknown code is reported as `server_error`.
+ */
+export declare function parseAuthError(url: string | URL | {
+    href: string;
+}): ParsedAuthError | null;
+/** `url` without `auth_error` and `auth_request`, as a path+query+hash string. */
+export declare function withoutAuthError(url: string | URL | {
+    href: string;
+}): string;
+/**
+ * Removes `auth_error` / `auth_request` from the address bar with
+ * `history.replaceState`, so a reload does not show the error again. A no-op
+ * outside a browser or when there is nothing to strip.
+ */
+export declare function stripAuthError(): void;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAQA,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,sLAWnB,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,oBAAoB,0EAA2E,CAAC;AAE7G,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC9D,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AACrF,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AA2E1C,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,aAAa,CAE9D;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAEpE;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,CAGhG;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,yDAAyD;IACzD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAYD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,GAAG,IAAI,CAM3F;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAO7E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAUrC"}

package/dist/errors.js

@@ -0,0 +1,154 @@
+// Structured sign-in errors (docs/custom-sign-in.md §3.3, §12.2, §12.6).
+//
+// Every non-success return of `/__runlot/auth/sign-in/runlot` comes back to the
+// app's `next` (or `error_next`) as `?auth_error=<code>&auth_request=<start id>`.
+// The codes are a closed enum: an unknown value is reported as `server_error`
+// rather than passed through, so the app never renders a string it did not
+// expect. The messages are the product surface (ko/en/ja, Korean-primary).
+/** Codes the broker or the auth worker returns to the app on a redirect. */
+export const AUTH_ERROR_CODES = [
+    "cancelled",
+    "signup_closed",
+    "email_unverified",
+    "provider_unavailable",
+    "rate_limited",
+    "expired",
+    "consent_denied",
+    "login_required",
+    "account_exists",
+    "server_error",
+];
+/** Extra codes only the project-local JSON API answers with (§12.6). */
+export const AUTH_API_ERROR_CODES = ["invalid_credentials", "weak_password", "check_email", "csrf"];
+const MESSAGES = {
+    cancelled: {
+        ko: "로그인이 취소되었습니다.",
+        en: "Sign-in was cancelled.",
+        ja: "ログインがキャンセルされました。",
+    },
+    signup_closed: {
+        ko: "지금은 새 계정을 만들 수 없습니다. 기존 계정으로 로그인해 주세요.",
+        en: "New sign-ups are closed. Please sign in with an existing account.",
+        ja: "現在、新規登録は受け付けていません。既存のアカウントでログインしてください。",
+    },
+    email_unverified: {
+        ko: "이메일 인증이 필요합니다. 인증된 이메일로 다시 시도해 주세요.",
+        en: "Your email address is not verified. Verify it and try again.",
+        ja: "メールアドレスが未確認です。確認してから再度お試しください。",
+    },
+    provider_unavailable: {
+        ko: "이 로그인 방법은 지금 사용할 수 없습니다. 다른 방법을 선택해 주세요.",
+        en: "This sign-in method is not available right now. Please choose another.",
+        ja: "このログイン方法は現在利用できません。別の方法を選んでください。",
+    },
+    rate_limited: {
+        ko: "시도가 너무 많습니다. 잠시 후 다시 시도해 주세요.",
+        en: "Too many attempts. Please try again in a moment.",
+        ja: "試行回数が多すぎます。しばらくしてから再度お試しください。",
+    },
+    expired: {
+        ko: "로그인 요청이 만료되었습니다. 처음부터 다시 시도해 주세요.",
+        en: "The sign-in request expired. Please start again.",
+        ja: "ログインリクエストの有効期限が切れました。最初からやり直してください。",
+    },
+    consent_denied: {
+        ko: "동의하지 않아 로그인하지 않았습니다.",
+        en: "You declined, so you were not signed in.",
+        ja: "同意されなかったため、ログインしませんでした。",
+    },
+    login_required: {
+        ko: "로그인이 필요합니다.",
+        en: "Please sign in to continue.",
+        ja: "ログインが必要です。",
+    },
+    account_exists: {
+        ko: "같은 이메일로 만든 계정이 이미 있습니다. 원래 쓰던 방법으로 로그인해 주세요.",
+        en: "An account with this email already exists. Sign in with the method you used before.",
+        ja: "このメールアドレスのアカウントは既に存在します。以前の方法でログインしてください。",
+    },
+    server_error: {
+        ko: "로그인 중 문제가 생겼습니다. 잠시 후 다시 시도해 주세요.",
+        en: "Something went wrong while signing in. Please try again.",
+        ja: "ログイン中に問題が発生しました。しばらくしてから再度お試しください。",
+    },
+    invalid_credentials: {
+        ko: "이메일 또는 비밀번호가 올바르지 않습니다.",
+        en: "The email or password is incorrect.",
+        ja: "メールアドレスまたはパスワードが正しくありません。",
+    },
+    weak_password: {
+        ko: "비밀번호가 너무 약합니다. 더 길고 복잡하게 만들어 주세요.",
+        en: "That password is too weak. Use a longer, less guessable one.",
+        ja: "パスワードが弱すぎます。より長く推測されにくいものにしてください。",
+    },
+    check_email: {
+        ko: "이메일을 확인해 주세요.",
+        en: "Check your email.",
+        ja: "メールをご確認ください。",
+    },
+    csrf: {
+        ko: "요청을 확인할 수 없습니다. 페이지를 새로고침한 뒤 다시 시도해 주세요.",
+        en: "The request could not be verified. Reload the page and try again.",
+        ja: "リクエストを確認できませんでした。ページを再読み込みしてからお試しください。",
+    },
+};
+export function isAuthErrorCode(v) {
+    return typeof v === "string" && AUTH_ERROR_CODES.includes(v);
+}
+export function isAuthApiErrorCode(v) {
+    return isAuthErrorCode(v) || (typeof v === "string" && AUTH_API_ERROR_CODES.includes(v));
+}
+/** The default message for a code. Korean when `lang` is omitted or unknown. */
+export function authErrorMessage(code, lang) {
+    const l = lang === "en" ? "en" : lang === "ja" ? "ja" : "ko";
+    return (MESSAGES[code] ?? MESSAGES.server_error)[l];
+}
+function toURL(url) {
+    try {
+        if (url instanceof URL)
+            return url;
+        const s = typeof url === "string" ? url : url.href;
+        return new URL(s, "http://x.invalid");
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Reads `auth_error` / `auth_request` from a URL (or `location`). `null` when
+ * there is no error. An unknown code is reported as `server_error`.
+ */
+export function parseAuthError(url) {
+    const u = toURL(url);
+    const raw = u?.searchParams.get("auth_error");
+    if (!u || raw === null || raw === undefined || raw === "")
+        return null;
+    const request = u.searchParams.get("auth_request");
+    return { code: isAuthErrorCode(raw) ? raw : "server_error", request: request || null };
+}
+/** `url` without `auth_error` and `auth_request`, as a path+query+hash string. */
+export function withoutAuthError(url) {
+    const u = toURL(url);
+    if (!u)
+        return typeof url === "string" ? url : String(url);
+    u.searchParams.delete("auth_error");
+    u.searchParams.delete("auth_request");
+    const q = u.searchParams.toString();
+    return `${u.pathname}${q ? `?${q}` : ""}${u.hash}`;
+}
+/**
+ * Removes `auth_error` / `auth_request` from the address bar with
+ * `history.replaceState`, so a reload does not show the error again. A no-op
+ * outside a browser or when there is nothing to strip.
+ */
+export function stripAuthError() {
+    // Read through globalThis so the module also typechecks without the DOM lib
+    // (the CLI and workers import the codes from here).
+    const g = globalThis;
+    if (!g.location || !g.history)
+        return;
+    if (!parseAuthError(g.location.href))
+        return;
+    g.history.replaceState(g.history.state, "", withoutAuthError(g.location.href));
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,gFAAgF;AAChF,kFAAkF;AAClF,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAE3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,sBAAsB;IACtB,cAAc;IACd,SAAS;IACT,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,cAAc;CACN,CAAC;AAEX,wEAAwE;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,CAAU,CAAC;AAM7G,MAAM,QAAQ,GAAuD;IACnE,SAAS,EAAE;QACT,EAAE,EAAE,eAAe;QACnB,EAAE,EAAE,wBAAwB;QAC5B,EAAE,EAAE,kBAAkB;KACvB;IACD,aAAa,EAAE;QACb,EAAE,EAAE,wCAAwC;QAC5C,EAAE,EAAE,mEAAmE;QACvE,EAAE,EAAE,wCAAwC;KAC7C;IACD,gBAAgB,EAAE;QAChB,EAAE,EAAE,qCAAqC;QACzC,EAAE,EAAE,8DAA8D;QAClE,EAAE,EAAE,gCAAgC;KACrC;IACD,oBAAoB,EAAE;QACpB,EAAE,EAAE,0CAA0C;QAC9C,EAAE,EAAE,wEAAwE;QAC5E,EAAE,EAAE,kCAAkC;KACvC;IACD,YAAY,EAAE;QACZ,EAAE,EAAE,+BAA+B;QACnC,EAAE,EAAE,kDAAkD;QACtD,EAAE,EAAE,+BAA+B;KACpC;IACD,OAAO,EAAE;QACP,EAAE,EAAE,mCAAmC;QACvC,EAAE,EAAE,kDAAkD;QACtD,EAAE,EAAE,qCAAqC;KAC1C;IACD,cAAc,EAAE;QACd,EAAE,EAAE,sBAAsB;QAC1B,EAAE,EAAE,0CAA0C;QAC9C,EAAE,EAAE,yBAAyB;KAC9B;IACD,cAAc,EAAE;QACd,EAAE,EAAE,aAAa;QACjB,EAAE,EAAE,6BAA6B;QACjC,EAAE,EAAE,YAAY;KACjB;IACD,cAAc,EAAE;QACd,EAAE,EAAE,8CAA8C;QAClD,EAAE,EAAE,qFAAqF;QACzF,EAAE,EAAE,2CAA2C;KAChD;IACD,YAAY,EAAE;QACZ,EAAE,EAAE,mCAAmC;QACvC,EAAE,EAAE,0DAA0D;QAC9D,EAAE,EAAE,oCAAoC;KACzC;IACD,mBAAmB,EAAE;QACnB,EAAE,EAAE,yBAAyB;QAC7B,EAAE,EAAE,qCAAqC;QACzC,EAAE,EAAE,2BAA2B;KAChC;IACD,aAAa,EAAE;QACb,EAAE,EAAE,mCAAmC;QACvC,EAAE,EAAE,8DAA8D;QAClE,EAAE,EAAE,mCAAmC;KACxC;IACD,WAAW,EAAE;QACX,EAAE,EAAE,eAAe;QACnB,EAAE,EAAE,mBAAmB;QACvB,EAAE,EAAE,cAAc;KACnB;IACD,IAAI,EAAE;QACJ,EAAE,EAAE,0CAA0C;QAC9C,EAAE,EAAE,mEAAmE;QACvE,EAAE,EAAE,wCAAwC;KAC7C;CACF,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,OAAO,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAK,oBAA0C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,IAAsB,EAAE,IAA+B;IACtF,MAAM,CAAC,GAAa,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAQD,SAAS,KAAK,CAAC,GAAoC;IACjD,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,GAAG;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACnD,OAAO,IAAI,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAoC;IACjE,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,GAAG,GAAG,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;AACzF,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,GAAoC;IACnE,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC,CAAC;QAAE,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;IACpC,OAAO,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,CAAC,GAAG,UAGT,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO;IACtC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACjF,CAAC"}

package/dist/index.d.ts

@@ -1,26 +1,28 @@
-/** 시스템 워커가 종단하는 경로 접두 (docs/auth.md §5). */
+/** The path prefix the system worker terminates (docs/auth.md §5). */
 export declare const AUTH_BASE = "/__runlot/auth";
 export interface User {
-    /** uuid — `runlot_auth.users` 의 PK 이자 RLS 가 보는 값. */
+    /** uuid — the PK of `runlot_auth.users` and the value RLS looks at. */
     id: string;
     email: string | null;
     emailVerified: boolean;
     name: string | null;
     avatarUrl: string | null;
-    /** 이 사용자에 연결된 로그인 수단. 예: `["password", "github"]`. */
+    /** The sign-in methods linked to this user. For example:
+     *  `["password", "github"]`. */
     providers: string[];
     /** ISO 8601. */
     createdAt: string;
-    /** ISO 8601. 한 번도 로그인하지 않았으면 `null`. */
+    /** ISO 8601. `null` if they have never signed in. */
     lastSignInAt: string | null;
 }
 /**
- * `signOut` 이 돌려주는 삭제 쿠키 한 줄. `HeadersInit` 으로 그대로 쓴다.
+ * The one deletion-cookie line `signOut` returns. Used as a `HeadersInit` as
+ * is.
  */
 export interface SignOutHeaders {
     "set-cookie": string;
 }
-/** `users.list` 의 한 쪽. `cursor` 가 `null` 이면 마지막 쪽이다. */
+/** One page of `users.list`. A `null` `cursor` means it is the last page. */
 export interface UserPage {
     users: User[];
     cursor: string | null;
@@ -28,10 +30,11 @@ export interface UserPage {
 export interface UserUpdate {
     name?: string | null;
     avatarUrl?: string | null;
-    /** `true` 는 그 사용자의 세션 전부 폐기를 겸한다 (docs/auth.md §4). */
+    /** `true` also revokes every session of that user (docs/auth.md §4). */
     banned?: boolean;
 }
-/** 관리 조회·수정. 게이트웨이를 안 거치고 `DB` 바인딩으로 직접 읽는다. */
+/** Administrative reads and writes. They do not go through the gateway; they
+ *  read directly through the `DB` binding. */
 export interface AuthUsers {
     get(id: string): Promise<User | null>;
     getByEmail(email: string): Promise<User | null>;
@@ -40,29 +43,37 @@ export interface AuthUsers {
         limit?: number;
     }): Promise<UserPage>;
     update(id: string, patch: UserUpdate): Promise<User>;
-    /** 사용자·신원·세션·토큰. 앱의 표는 앱이 `ON DELETE` 로 잇는다. */
+    /** The user, the identities, the sessions and the tokens. The app's own
+     *  tables are joined up by the app with `ON DELETE`. */
     delete(id: string): Promise<void>;
+    /**
+     * Moves every identity of `from` onto `into`, deletes `from`'s sessions and
+     * then `from` itself, in one transaction (docs/custom-sign-in.md §12.6). The
+     * app's own rows that reference `from` are the app's job.
+     */
+    merge(from: string, into: string): Promise<void>;
 }
 export interface AuthSessions {
-    /** 비밀번호 변경 뒤의 관용구. */
+    /** The idiom after a password change. */
     revokeAll(userId: string): Promise<void>;
 }
 export interface AuthBinding {
     /**
-     * 쿠키 → 세션 → 사용자. 없으면 `null`.
-     * **던지지 않는다** — 로그인 안 한 상태는 오류가 아니다.
+     * Cookie → session → user. `null` when there is none.
+     * **It does not throw** — not being signed in is not an error.
      */
     user(request: Request): Promise<User | null>;
     /**
-     * 그 세션을 지우고 삭제 쿠키를 돌려준다. 응답에 얹는 것은 호출자의 몫이다.
+     * Erases that session and returns the deletion cookie. Putting it on the
+     * response is the caller's job.
      *
      * ```ts
      * return new Response(null, { headers: await env.auth.signOut(request) });
      * ```
      *
-     * `Headers` 가 아니라 평범한 객체인 이유는 실측이다 — `Headers` 는 RPC
-     * 경계를 못 넘는다 (docs/auth.md §4). 그래도 `HeadersInit` 이라 위처럼 그대로
-     * 얹힌다.
+     * It is a plain object rather than a `Headers` because of a measurement —
+     * `Headers` cannot cross the RPC boundary (docs/auth.md §4). It is still a
+     * `HeadersInit`, so it goes on exactly as above.
      */
     signOut(request: Request): Promise<SignOutHeaders>;
     users: AuthUsers;
@@ -75,10 +86,11 @@ export interface AuthBinding {
     }): Promise<UserPage>;
     updateUser?(id: string, patch: UserUpdate): Promise<User>;
     deleteUser?(id: string): Promise<void>;
+    mergeUsers?(from: string, into: string): Promise<void>;
     revokeSessions?(userId: string): Promise<void>;
 }
 /**
- * 자기 `Env` 에 붙이는 조각.
+ * The fragment to attach to your own `Env`.
  *
  * ```ts
  * interface Env extends AuthEnv {
@@ -89,4 +101,6 @@ export interface AuthBinding {
 export interface AuthEnv {
     auth: AuthBinding;
 }
+export { AUTH_API_ERROR_CODES, AUTH_ERROR_CODES, authErrorMessage, isAuthApiErrorCode, isAuthErrorCode, parseAuthError, stripAuthError, withoutAuthError, } from "./errors.js";
+export type { AuthApiErrorCode, AuthErrorCode, AuthLang, ParsedAuthError } from "./errors.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,4CAA4C;AAC5C,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAE1C,MAAM,WAAW,IAAI;IACnB,qDAAqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,sDAAsD;IACtD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wDAAwD;AACxD,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uDAAuD;IACvD,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,gDAAgD;AAChD,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACtC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gDAAgD;IAChD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B,sBAAsB;IACtB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC7C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnD,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,YAAY,CAAC;IAMvB,OAAO,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC3C,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACrD,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1E,UAAU,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,UAAU,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,cAAc,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,WAAW,CAAC;CACnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAeA,sEAAsE;AACtE,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAE1C,MAAM,WAAW,IAAI;IACnB,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;oCACgC;IAChC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;8CAC8C;AAC9C,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACtC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;4DACwD;IACxD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;;;;OAIG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC7C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnD,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,YAAY,CAAC;IAOvB,OAAO,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC3C,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACrD,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1E,UAAU,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,UAAU,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,cAAc,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,15 +1,18 @@
-// `env.auth` 의 타입 (docs/auth.md §4, §10).
+// The types for `env.auth` (docs/auth.md §4, §10).
 //
-// 이 패키지는 런타임을 싣지 않는다. 바인딩은 workerd 안에서 auth 시스템 워커가
-// 주입하므로, 사용자가 npm 에서 받을 것은 자기 `Env` 에 붙일 타입과 브라우저에서
-// 부르는 도우미(`@runlot/auth/client`) 둘뿐이다. 의존성 0 인 이유도 같다 —
-// 워커 번들에 한 바이트도 더하지 않아야 한다.
+// This package ships no runtime. The binding is injected by the auth system
+// worker inside workerd, so all a user gets from npm is the type to attach to
+// their own `Env` and the helpers called from the browser
+// (`@runlot/auth/client`). That is also why it has zero dependencies — it must
+// not add a single byte to the worker bundle.
 //
-// `user(request)` 가 요청을 받는 것은 취향이 아니라 제약이다 (docs/access.md §4.2
-// 의 논거 그대로): `env` 는 워커 수명 동안 고정된 묶음이고 신원은 요청마다 다른
-// 값이다. 인자 없이 부르는 모양은 요청을 `AsyncLocalStorage` 로 숨겨 주는 회차 6
-// 의 Next.js 어댑터 안에서만 성립하고, 그 밖에서는 `TypeError` 다 — "안 됨" 이
-// 조용히 `null` 이 되면 모든 페이지가 로그아웃 상태로 보인다.
-/** 시스템 워커가 종단하는 경로 접두 (docs/auth.md §5). */
+// `user(request)` taking a request is a constraint, not a taste (the same
+// argument as docs/access.md §4.2): `env` is a bundle fixed for the lifetime of
+// the worker, and the identity is a different value on every request. The
+// argument-free shape only holds inside round 6's Next.js adapter, which hides
+// the request in `AsyncLocalStorage`; anywhere else it is a `TypeError` — if
+// "cannot be done" quietly became `null`, every page would look logged out.
+/** The path prefix the system worker terminates (docs/auth.md §5). */
 export const AUTH_BASE = "/__runlot/auth";
+export { AUTH_API_ERROR_CODES, AUTH_ERROR_CODES, authErrorMessage, isAuthApiErrorCode, isAuthErrorCode, parseAuthError, stripAuthError, withoutAuthError, } from "./errors.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,oDAAoD;AACpD,oDAAoD;AACpD,wDAAwD;AACxD,4BAA4B;AAC5B,EAAE;AACF,gEAAgE;AAChE,mDAAmD;AACnD,0DAA0D;AAC1D,0DAA0D;AAC1D,wCAAwC;AAExC,4CAA4C;AAC5C,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,0DAA0D;AAC1D,+EAA+E;AAC/E,8CAA8C;AAC9C,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAE5E,sEAAsE;AACtE,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AA+G1C,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC"}

package/dist/react.d.ts

@@ -0,0 +1,14 @@
+import { type SignInMethod } from "./ui.js";
+export interface RunlotSignInProps {
+    next?: string;
+    lang?: "ko" | "en" | "ja";
+    methods?: SignInMethod[] | string;
+    guest?: boolean;
+    errorNext?: string;
+    loginHint?: string;
+    className?: string;
+    /** Fired when the guest button is pressed (the `runlot-guest` event). */
+    onGuest?: () => void;
+}
+export declare function RunlotSignIn(props: RunlotSignInProps): import("react").DOMElement<Record<string, unknown>, Element>;
+//# sourceMappingURL=react.d.ts.map

package/dist/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAKA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAEhE,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,gEAsBpD"}

package/dist/react.js

@@ -0,0 +1,37 @@
+// A thin React wrapper around `<runlot-sign-in>` (docs/custom-sign-in.md §7.1).
+// React is an optional peer: only this subpath imports it. Written with
+// `createElement` so the package needs no JSX configuration.
+import { createElement, useEffect, useRef } from "react";
+import { defineRunlotSignIn } from "./ui.js";
+export function RunlotSignIn(props) {
+    const ref = useRef(null);
+    const { onGuest } = props;
+    useEffect(() => {
+        defineRunlotSignIn();
+    }, []);
+    useEffect(() => {
+        const el = ref.current;
+        if (!el || !onGuest)
+            return;
+        const h = () => onGuest();
+        el.addEventListener("runlot-guest", h);
+        return () => el.removeEventListener("runlot-guest", h);
+    }, [onGuest]);
+    const attrs = { ref };
+    if (props.next)
+        attrs.next = props.next;
+    if (props.lang)
+        attrs.lang = props.lang;
+    if (props.methods)
+        attrs.methods = Array.isArray(props.methods) ? props.methods.join(" ") : props.methods;
+    if (props.guest)
+        attrs.guest = "";
+    if (props.errorNext)
+        attrs["error-next"] = props.errorNext;
+    if (props.loginHint)
+        attrs["login-hint"] = props.loginHint;
+    if (props.className)
+        attrs.class = props.className;
+    return createElement("runlot-sign-in", attrs);
+}
+//# sourceMappingURL=react.js.map

package/dist/react.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wEAAwE;AACxE,6DAA6D;AAE7D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,SAAS,CAAC;AAchE,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,MAAM,GAAG,GAAG,MAAM,CAAqB,IAAI,CAAC,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,SAAS,CAAC,GAAG,EAAE;QACb,kBAAkB,EAAE,CAAC;IACvB,CAAC,EAAE,EAAE,CAAC,CAAC;IACP,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;QACvB,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO;YAAE,OAAO;QAC5B,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC1B,EAAE,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QACvC,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,mBAAmB,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACd,MAAM,KAAK,GAA4B,EAAE,GAAG,EAAE,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IAC1G,IAAI,KAAK,CAAC,KAAK;QAAE,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,SAAS;QAAE,KAAK,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;IAC3D,IAAI,KAAK,CAAC,SAAS;QAAE,KAAK,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;IAC3D,IAAI,KAAK,CAAC,SAAS;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC;IACnD,OAAO,aAAa,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC"}

package/dist/ui.d.ts

@@ -0,0 +1,25 @@
+import { type AuthConfig, type RunlotMethod } from "./client.js";
+import { type AuthLang } from "./errors.js";
+/** A token of the `methods` attribute: a Runlot ID method, or `runlot` for the plain chooser button. */
+export type SignInMethod = RunlotMethod | "runlot";
+export interface SignInRenderInput {
+    lang?: string | null;
+    next?: string | null;
+    errorNext?: string | null;
+    loginHint?: string | null;
+    /** The `methods` attribute, space-separated; `null` = what the project offers. */
+    methods?: string | null;
+    guest?: boolean;
+    /** `null` while loading or when config failed. */
+    config?: AuthConfig | null;
+    /** The message to show, already resolved. */
+    error?: string | null;
+}
+export declare function resolveLang(lang: string | null | undefined): AuthLang;
+/** Which buttons to draw: the asked-for tokens ∩ what the project's `runlot` provider offers. */
+export declare function resolveMethods(cfg: AuthConfig | null | undefined, attr: string | null | undefined): SignInMethod[];
+/** The shadow-root HTML. Pure, so it is testable without a DOM. */
+export declare function renderSignIn(i: SignInRenderInput): string;
+/** Defines the element (idempotent). Called on import when `customElements` exists. */
+export declare function defineRunlotSignIn(tag?: string): void;
+//# sourceMappingURL=ui.d.ts.map

package/dist/ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,KAAK,UAAU,EAAqB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,KAAK,QAAQ,EAAoD,MAAM,aAAa,CAAC;AAE9F,wGAAwG;AACxG,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,QAAQ,CAAC;AA+BnD,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kDAAkD;IAClD,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC3B,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,CAGrE;AAED,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,EAAE,CAclH;AAYD,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAgBzD;AAID,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,GAAG,SAAmB,GAAG,IAAI,CAmD/D"}

package/dist/ui.js

@@ -0,0 +1,144 @@
+// `<runlot-sign-in>` — a dependency-free custom element that draws a sign-in
+// block from `config()` (docs/custom-sign-in.md §7.1, §12.5).
+//
+//   <runlot-sign-in next="/chat" lang="ko" methods="google github password" guest></runlot-sign-in>
+//
+// Every element carries a `part` (`::part(button-google)`), colours, radius and
+// font come from CSS custom properties, and the shadow styles are all
+// overridable through those two. Buttons are plain links built by `signInUrl`,
+// so the credential is always typed on a Runlot origin (I1). Importing this
+// module in Node or a worker is safe: the element is defined only when
+// `customElements` exists. Budget: ≤ 6 KiB gzip with its imports.
+import { config, signInUrl } from "./client.js";
+import { authErrorMessage, parseAuthError, stripAuthError } from "./errors.js";
+const ALL = ["google", "github", "password", "passkey", "runlot"];
+const LABELS = {
+    ko: {
+        google: "Google로 계속하기",
+        github: "GitHub로 계속하기",
+        password: "이메일로 계속하기",
+        passkey: "패스키로 계속하기",
+        runlot: "Runlot으로 계속하기",
+        guest: "게스트로 둘러보기",
+    },
+    en: {
+        google: "Continue with Google",
+        github: "Continue with GitHub",
+        password: "Continue with email",
+        passkey: "Continue with a passkey",
+        runlot: "Continue with Runlot",
+        guest: "Continue as guest",
+    },
+    ja: {
+        google: "Googleで続行",
+        github: "GitHubで続行",
+        password: "メールで続行",
+        passkey: "パスキーで続行",
+        runlot: "Runlotで続行",
+        guest: "ゲストとして続行",
+    },
+};
+export function resolveLang(lang) {
+    const l = (lang ?? "").slice(0, 2).toLowerCase();
+    return l === "en" || l === "ja" ? l : "ko";
+}
+/** Which buttons to draw: the asked-for tokens ∩ what the project's `runlot` provider offers. */
+export function resolveMethods(cfg, attr) {
+    const p = cfg?.providers.find((x) => x.kind === "runlot");
+    if (!p)
+        return [];
+    const offered = p.methods && p.methods.length > 0 ? [...p.methods] : ["runlot"];
+    offered.push("runlot");
+    const want = attr == null || attr.trim() === "" ? null : attr.trim().split(/[\s,]+/);
+    const list = want ?? (p.methods && p.methods.length > 0 ? p.methods : ["runlot"]);
+    const out = [];
+    for (const m of list) {
+        if (ALL.includes(m) && offered.includes(m) && !out.includes(m)) {
+            out.push(m);
+        }
+    }
+    return out;
+}
+const esc = (s) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+const STYLE = `:host{display:block;font:var(--runlot-font,inherit);color:var(--runlot-text,inherit)}
+[part~=root]{display:flex;flex-direction:column;gap:var(--runlot-gap,.5rem)}
+[part~=button]{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:100%;padding:var(--runlot-padding,.625rem 1rem);border:1px solid var(--runlot-border,#d4d4d8);border-radius:var(--runlot-radius,.5rem);background:var(--runlot-bg,#fff);color:var(--runlot-button-text,#18181b);font:inherit;text-decoration:none;cursor:pointer}
+[part~=button]:hover{background:var(--runlot-bg-hover,#f4f4f5)}
+[part~=button-runlot]{background:var(--runlot-brand,#18181b);color:var(--runlot-brand-text,#fff);border-color:transparent}
+[part~=error]{padding:.5rem .75rem;border-radius:var(--runlot-radius,.5rem);background:var(--runlot-error-bg,#fef2f2);color:var(--runlot-error,#b91c1c)}`;
+/** The shadow-root HTML. Pure, so it is testable without a DOM. */
+export function renderSignIn(i) {
+    const lang = resolveLang(i.lang);
+    const L = LABELS[lang];
+    let h = `<style>${STYLE}</style><div part="root"><slot name="header"></slot>`;
+    if (i.error)
+        h += `<div part="error" role="alert">${esc(i.error)}</div>`;
+    for (const m of resolveMethods(i.config, i.methods)) {
+        const href = signInUrl("runlot", {
+            ...(i.next ? { next: i.next } : {}),
+            ...(i.errorNext ? { errorNext: i.errorNext } : {}),
+            ...(i.loginHint ? { loginHint: i.loginHint } : {}),
+            ...(m !== "runlot" ? { idp: m } : {}),
+        });
+        h += `<a part="button button-${m}" href="${esc(href)}">${esc(L[m])}</a>`;
+    }
+    if (i.guest)
+        h += `<button part="button button-guest" type="button">${esc(L.guest)}</button>`;
+    return `${h}<slot name="footer"></slot></div>`;
+}
+const ATTRS = ["next", "lang", "methods", "guest", "error-next", "login-hint"];
+/** Defines the element (idempotent). Called on import when `customElements` exists. */
+export function defineRunlotSignIn(tag = "runlot-sign-in") {
+    if (typeof customElements === "undefined" || customElements.get(tag))
+        return;
+    class RunlotSignIn extends HTMLElement {
+        static observedAttributes = ATTRS;
+        #cfg = null;
+        #error = null;
+        #code = null;
+        constructor() {
+            super();
+            const root = this.attachShadow({ mode: "open" });
+            root.addEventListener("click", (e) => {
+                const t = e.target;
+                if (t?.closest?.('[part~="button-guest"]')) {
+                    this.dispatchEvent(new CustomEvent("runlot-guest", { bubbles: true, composed: true }));
+                }
+            });
+        }
+        connectedCallback() {
+            if (typeof location !== "undefined") {
+                this.#code = parseAuthError(location.href);
+                if (this.#code)
+                    stripAuthError();
+            }
+            this.#paint();
+            config().then((c) => {
+                this.#cfg = c;
+                this.#paint();
+            }, () => this.#paint());
+        }
+        attributeChangedCallback() {
+            if (this.isConnected)
+                this.#paint();
+        }
+        #paint() {
+            const a = (n) => this.getAttribute(n);
+            const lang = a("lang") ?? (typeof document !== "undefined" ? document.documentElement.lang : null);
+            this.#error = this.#code ? authErrorMessage(this.#code.code, resolveLang(lang)) : null;
+            this.shadowRoot.innerHTML = renderSignIn({
+                lang,
+                next: a("next"),
+                errorNext: a("error-next"),
+                loginHint: a("login-hint"),
+                methods: a("methods"),
+                guest: this.hasAttribute("guest"),
+                config: this.#cfg,
+                error: this.#error,
+            });
+        }
+    }
+    customElements.define(tag, RunlotSignIn);
+}
+defineRunlotSignIn();
+//# sourceMappingURL=ui.js.map

package/dist/ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8DAA8D;AAC9D,EAAE;AACF,oGAAoG;AACpG,EAAE;AACF,gFAAgF;AAChF,sEAAsE;AACtE,+EAA+E;AAC/E,4EAA4E;AAC5E,uEAAuE;AACvE,kEAAkE;AAElE,OAAO,EAAmB,MAAM,EAAE,SAAS,EAAqB,MAAM,aAAa,CAAC;AACpF,OAAO,EAAiB,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAK9F,MAAM,GAAG,GAA4B,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAE3F,MAAM,MAAM,GAA6D;IACvE,EAAE,EAAE;QACF,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE,eAAe;QACvB,KAAK,EAAE,WAAW;KACnB;IACD,EAAE,EAAE;QACF,MAAM,EAAE,sBAAsB;QAC9B,MAAM,EAAE,sBAAsB;QAC9B,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,yBAAyB;QAClC,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE,mBAAmB;KAC3B;IACD,EAAE,EAAE;QACF,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,UAAU;KAClB;CACF,CAAC;AAgBF,MAAM,UAAU,WAAW,CAAC,IAA+B;IACzD,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,GAAkC,EAAE,IAA+B;IAChG,MAAM,CAAC,GAAG,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,OAAO,GAAmB,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClF,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAiB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAiB,CAAC,EAAE,CAAC;YAC/G,GAAG,CAAC,IAAI,CAAC,CAAiB,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CACxB,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAExD,MAAM,KAAK,GAAG;;;;;yJAK2I,CAAC;AAE1J,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,CAAoB;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,GAAG,UAAU,KAAK,sDAAsD,CAAC;IAC9E,IAAI,CAAC,CAAC,KAAK;QAAE,CAAC,IAAI,kCAAkC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE;YAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;QACH,CAAC,IAAI,0BAA0B,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,CAAC,KAAK;QAAE,CAAC,IAAI,oDAAoD,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC9F,OAAO,GAAG,CAAC,mCAAmC,CAAC;AACjD,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAE/E,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,GAAG,GAAG,gBAAgB;IACvD,IAAI,OAAO,cAAc,KAAK,WAAW,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7E,MAAM,YAAa,SAAQ,WAAW;QACpC,MAAM,CAAC,kBAAkB,GAAG,KAAK,CAAC;QAClC,IAAI,GAAsB,IAAI,CAAC;QAC/B,MAAM,GAAkB,IAAI,CAAC;QAC7B,KAAK,GAAsC,IAAI,CAAC;QAChD;YACE,KAAK,EAAE,CAAC;YACR,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAwB,CAAC;gBACrC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC;oBAC3C,IAAI,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,iBAAiB;YACf,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACpC,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,IAAI,CAAC,KAAK;oBAAE,cAAc,EAAE,CAAC;YACnC,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,MAAM,EAAE,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,EAAE;gBACJ,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;gBACd,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CACpB,CAAC;QACJ,CAAC;QACD,wBAAwB;YACtB,IAAI,IAAI,CAAC,WAAW;gBAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACtC,CAAC;QACD,MAAM;YACJ,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACnG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvF,IAAI,CAAC,UAAW,CAAC,SAAS,GAAG,YAAY,CAAC;gBACxC,IAAI;gBACJ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACf,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC;gBAC1B,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC;gBAC1B,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;gBACrB,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;gBACjC,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,KAAK,EAAE,IAAI,CAAC,MAAM;aACnB,CAAC,CAAC;QACL,CAAC;;IAEH,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED,kBAAkB,EAAE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@runlot/auth",
-  "version": "0.1.0-rc.16",
-  "description": "env.auth 타입과 브라우저 도우미 — 런타임은 시스템 워커가 준다 (docs/auth.md §10)",
+  "version": "0.1.0-rc.161",
+  "description": "Types and browser helpers for env.auth — Runlot provides the runtime",
   "publishConfig": {
     "access": "public"
   },
@@ -21,6 +21,14 @@
     "./client": {
       "types": "./dist/client.d.ts",
       "default": "./dist/client.js"
+    },
+    "./ui": {
+      "types": "./dist/ui.d.ts",
+      "default": "./dist/ui.js"
+    },
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "default": "./dist/react.js"
     }
   },
   "files": [
@@ -30,11 +38,26 @@
     "@types/node": "^22.10.2",
     "esbuild": "^0.24.2",
     "typescript": "^5.7.2",
-    "@runlot/config": "0.1.0-rc.16"
+    "@types/react": "^19.2.18",
+    "react": "^19.2.8",
+    "@runlot/config": "0.1.0-rc.161"
+  },
+  "peerDependencies": {
+    "react": ">=18"
   },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "sideEffects": [
+    "./src/ui.ts",
+    "./dist/ui.js"
+  ],
   "scripts": {
     "test": "node build.mjs",
     "typecheck": "tsc --noEmit",
-    "build": "tsc -p tsconfig.build.json"
+    "build": "tsc -p tsconfig.build.json",
+    "size": "node size.mjs"
   }
 }