@settlemint/dalp-sdk 3.1.10 → 3.1.11-main.33538712635

package/dist/{auth-permissions.d.ts → auth/permissions.d.ts}

@@ -1,7 +1,7 @@
 /**
  * Client-side Better Auth access-control metadata for DALP auth clients.
  *
- * Related: packages/dalp/auth/src/utils/permissions.ts, kit/sdk/src/auth.ts
+ * Related: packages/dapi/auth/src/utils/permissions.ts, kit/sdk/src/auth/live.ts
  *
  * @module
  */
@@ -10,4 +10,3 @@ export declare const accessControl: AccessControl;
 export declare const adminRole: Role;
 export declare const ownerRole: Role;
 export declare const memberRole: Role;
-//# sourceMappingURL=auth-permissions.d.ts.map

package/dist/{auth-wallet-plugins.d.ts → auth/wallet-plugins.d.ts}

@@ -1,3 +1,69 @@
+import type { DalpAuthResult } from "./client.ts";
+export type WalletAuthOperation<TInput, TData> = (input: TInput, options?: unknown) => Promise<DalpAuthResult<TData>>;
+/** Typed client actions supplied by the three DALP wallet-auth plugins. */
+export interface DalpWalletAuthClient {
+    readonly wallet: {
+        readonly pincode: {
+            readonly enable: WalletAuthOperation<{
+                readonly pincode: string;
+                readonly password?: string;
+            }, {
+                readonly success: boolean;
+            }>;
+            readonly update: WalletAuthOperation<{
+                readonly newPincode: string;
+                readonly password: string;
+            }, {
+                readonly success: boolean;
+            }>;
+            readonly disable: WalletAuthOperation<{
+                readonly password: string;
+            }, {
+                readonly success: boolean;
+            }>;
+            readonly reset: WalletAuthOperation<{
+                readonly newPincode: string;
+                readonly recoveryCode: string;
+            }, {
+                readonly success: boolean;
+                readonly recoveryCodes?: ReadonlyArray<string>;
+            }>;
+        };
+        readonly twoFactor: {
+            readonly enable: WalletAuthOperation<{
+                readonly issuer?: string;
+                readonly password?: string;
+            }, {
+                readonly totpURI: string;
+            }>;
+            readonly verify: WalletAuthOperation<{
+                readonly code: string;
+            }, {
+                readonly status: boolean;
+            }>;
+            readonly disable: WalletAuthOperation<{
+                readonly password: string;
+            }, {
+                readonly status: boolean;
+            }>;
+        };
+        readonly secretCodes: {
+            readonly generate: WalletAuthOperation<{
+                readonly password?: string;
+            }, {
+                readonly rotated: boolean;
+                readonly secretCodes: ReadonlyArray<string>;
+                readonly verificationId: string;
+            }>;
+            readonly confirm: WalletAuthOperation<{
+                readonly stored: boolean;
+                readonly verificationId: string;
+            }, {
+                readonly success: boolean;
+            }>;
+        };
+    };
+}
 export declare const walletPincodeClient: () => {
     id: "wallet-pincode";
     $InferServerPlugin: {
@@ -78,9 +144,7 @@ export declare const walletSecretCodesClient: () => {
         signal: "$sessionSignal";
     }[];
 };
-type StripLeadingSlash<T extends string> = T extends `/${infer Rest}` ? Rest : never;
-type WalletPluginPathMethodKeys = keyof ReturnType<typeof walletPincodeClient>["pathMethods"] | keyof ReturnType<typeof walletTwoFactorClient>["pathMethods"] | keyof ReturnType<typeof walletSecretCodesClient>["pathMethods"];
+export type StripLeadingSlash<T extends string> = T extends `/${infer Rest}` ? Rest : never;
+export type WalletPluginPathMethodKeys = keyof ReturnType<typeof walletPincodeClient>["pathMethods"] | keyof ReturnType<typeof walletTwoFactorClient>["pathMethods"] | keyof ReturnType<typeof walletSecretCodesClient>["pathMethods"];
 /** CLI coverage keys for DALP wallet Better Auth plugin endpoints (no leading slash). */
-export type WalletAuthEndpointPath = StripLeadingSlash<WalletPluginPathMethodKeys & string>;
-export {};
-//# sourceMappingURL=auth-wallet-plugins.d.ts.map
+export type WalletAuthEndpointPath = StripLeadingSlash<WalletPluginPathMethodKeys>;

package/dist/auth.d.ts

@@ -1,115 +1,22 @@
-import { DalpCookieStore } from "./cookie-store.js";
-export interface DalpAuthClientConfig {
-    /** Base URL of the DALP API (e.g., `"https://dalp.example.com"`). */
-    url: string;
-    /** API key used for Better Auth API-key-authenticated operations. */
-    apiKey?: string;
-    /** Better Auth session token sent as an Authorization bearer token. */
-    sessionToken?: string;
-    /** Cookie header value for explicit Node/browser-session handoff. */
-    cookie?: string;
-    /** Cookie store for Node-side session persistence across Better Auth calls. */
-    cookieStore?: DalpCookieStore;
-    /**
-     * Organization ID for multi-tenant setups.
-     * Sent as `x-organization-id` when provided.
-     */
-    organizationId?: string;
-    /**
-     * Additional headers merged into every Better Auth request.
-     * Can override defaults like `User-Agent` but cannot override configured security headers.
-     */
-    headers?: Record<string, string>;
-    /**
-     * Custom `fetch` implementation.
-     * Use this to inject logging, proxy configuration, or test doubles.
-     */
-    fetch?: typeof globalThis.fetch;
-}
-export interface DalpAuthError {
-    code?: string;
-    message?: string;
-    status?: number;
-    statusText?: string;
-    [key: string]: unknown;
-}
-export interface DalpAuthResult<TData = unknown, TError = DalpAuthError> {
-    data: TData | null;
-    error: TError | null;
-}
-export type DalpAuthOperation<TInput = Record<string, unknown>, TData = unknown> = (input?: TInput, options?: unknown) => Promise<DalpAuthResult<TData>>;
-export interface DalpAuthClient {
-    signIn: Record<string, DalpAuthOperation> & {
-        email: DalpAuthOperation;
-    };
-    signUp: Record<string, DalpAuthOperation> & {
-        email: DalpAuthOperation;
-    };
-    getSession: DalpAuthOperation;
-    listSessions: DalpAuthOperation;
-    revokeSession: DalpAuthOperation;
-    revokeOtherSessions: DalpAuthOperation;
-    apiKey: Record<string, DalpAuthOperation> & {
-        create: DalpAuthOperation;
-        list: DalpAuthOperation;
-        delete: DalpAuthOperation;
-    };
-    organization: Record<string, DalpAuthOperation> & {
-        create: DalpAuthOperation;
-        list: DalpAuthOperation;
-        setActive: DalpAuthOperation;
-        inviteMember: DalpAuthOperation;
-        acceptInvitation: DalpAuthOperation;
-        listMembers: DalpAuthOperation;
-        addMember: DalpAuthOperation;
-        removeMember: DalpAuthOperation;
-    };
-    admin: Record<string, DalpAuthOperation> & {
-        listUsers: DalpAuthOperation;
-        createUser: DalpAuthOperation;
-        removeUser: DalpAuthOperation;
-        setRole: DalpAuthOperation;
-    };
-    device: Record<string, DalpAuthOperation> & {
-        code: DalpAuthOperation;
-        token: DalpAuthOperation;
-        approve: DalpAuthOperation;
-        deny: DalpAuthOperation;
-    };
-    passkey: Record<string, DalpAuthOperation>;
-    twoFactor: Record<string, DalpAuthOperation> & {
-        enable: DalpAuthOperation;
-        disable: DalpAuthOperation;
-        verifyTotp: DalpAuthOperation;
-        verifyBackupCode: DalpAuthOperation;
-        generateBackupCodes: DalpAuthOperation;
-    };
-    wallet: {
-        pincode: {
-            enable: DalpAuthOperation;
-            disable: DalpAuthOperation;
-            update: DalpAuthOperation;
-            reset: DalpAuthOperation;
-        };
-        twoFactor: {
-            enable: DalpAuthOperation;
-            disable: DalpAuthOperation;
-            verify: DalpAuthOperation;
-        };
-        secretCodes: {
-            generate: DalpAuthOperation;
-            confirm: DalpAuthOperation;
-        };
-        passkey: {
-            register: DalpAuthOperation;
-            complete: DalpAuthOperation;
-            disable: DalpAuthOperation;
-            challenge: DalpAuthOperation;
-            verify: DalpAuthOperation;
-        };
-    };
-    $fetch: (path: string, options?: Record<string, unknown>) => Promise<unknown>;
-    $ERROR_CODES: Record<string, unknown>;
-}
-export declare function createDalpAuthClient(config: DalpAuthClientConfig): DalpAuthClient;
-//# sourceMappingURL=auth.d.ts.map
+/**
+ * The DALP Better Auth client, on its own subpath.
+ *
+ * The generated SDK already exposes every auth REST operation, so nothing here
+ * exists to reach an endpoint. This surface exists for the parts a REST call
+ * cannot express: the session and cookie state machine, the plugin actions that
+ * run in the browser rather than over HTTP — `passkeyClient` drives the WebAuthn
+ * ceremony through `navigator.credentials` — and the access-control model that
+ * evaluates a permission locally instead of round-tripping `has-permission`.
+ *
+ * It is held off the package root because it costs roughly 70 KiB of Better
+ * Auth that a consumer who only calls operations should never pay.
+ *
+ * @module
+ */
+export { createDalpAuthClient, makeDalpAuthClient } from "./auth/live.ts";
+export type { DalpAuthClient } from "./auth/live.ts";
+export { decodeDalpAuthClientConfig } from "./auth/client.ts";
+export type { DalpAuthClientConfig, 
+/** @deprecated Prefer `DalpAuthClient` — this is the typed operation surface, not a separate client. */
+DalpCliAuthClient, DalpAuthError, DalpAuthOperation, DalpAuthResult, DalpOrganizationInvitation, DalpOrganizationInvitationsQuery, DalpOrganizationMember, DalpOrganizationMembersQuery, DecodedDalpAuthClientConfig, } from "./auth/client.ts";
+export type { WalletAuthEndpointPath } from "./auth/wallet-plugins.ts";

package/dist/auth.js

@@ -0,0 +1,248 @@
+import {
+  SDK_USER_AGENT,
+  createCookieStoreFetch,
+  makeCookieStore
+} from "./chunk-p009n1rm.js";
+import {
+  normalizeDalpBaseUrl,
+  secret,
+  unwrapSecret
+} from "./chunk-h12fatty.js";
+import {
+  createDalpSdkConfigurationError
+} from "./chunk-y0d2c7kp.js";
+
+// src/auth/live.ts
+import { apiKeyClient } from "@better-auth/api-key/client";
+import { passkeyClient } from "@better-auth/passkey/client";
+import { createAuthClient as createBetterAuthClient } from "better-auth/client";
+import {
+  adminClient,
+  customSessionClient,
+  deviceAuthorizationClient,
+  inferAdditionalFields,
+  organizationClient,
+  twoFactorClient
+} from "better-auth/client/plugins";
+
+// src/auth/client.ts
+import { z } from "zod";
+var authConfigSchema = z.object({
+  url: z.string().url().refine((value) => ["http:", "https:"].includes(new URL(value).protocol)),
+  apiKey: z.string().trim().min(1).transform(secret).optional(),
+  sessionToken: z.string().trim().min(1).transform(secret).optional(),
+  cookie: z.string().trim().min(1).transform(secret).optional(),
+  cookieStore: z.custom((value) => typeof value === "object" && value !== null && typeof value.header === "function" && typeof value.storeSetCookieHeaders === "function").optional(),
+  organizationId: z.string().trim().min(1).optional(),
+  headers: z.record(z.string(), z.string()).optional(),
+  fetch: z.custom((value) => typeof value === "function").optional()
+}).superRefine((value, context) => {
+  if ([value.apiKey, value.sessionToken, value.cookie].filter(Boolean).length > 1) {
+    context.addIssue({ code: "custom", message: "configure only one auth credential source" });
+  }
+});
+async function decodeDalpAuthClientConfig(input) {
+  try {
+    return await authConfigSchema.parseAsync(input);
+  } catch (error) {
+    throw createDalpSdkConfigurationError({
+      message: "DALP SDK: auth client configuration is invalid.",
+      why: "The auth client received a malformed URL, credential, header map, fetch seam, or cookie store.",
+      fix: "Pass one credential source, an HTTP(S) URL, and valid fetch and cookie-store seams.",
+      cause: error
+    });
+  }
+}
+
+// src/auth/permissions.ts
+import { createAccessControl } from "better-auth/plugins/access";
+import { adminAc, defaultStatements as adminDefaultStatements } from "better-auth/plugins/admin/access";
+import {
+  memberAc,
+  defaultStatements as organizationDefaultStatements,
+  ownerAc
+} from "better-auth/plugins/organization/access";
+var dalPermissions = {
+  organization: ["update", "delete", "list"],
+  setting: ["read", "list", "upsert", "remove", "set-global-theme"],
+  system: ["read", "list", "create"],
+  exchangeRates: ["read", "list"]
+};
+var customPermissions = {
+  ...adminDefaultStatements,
+  ...organizationDefaultStatements,
+  ...dalPermissions
+};
+var narrowAccessControl = createAccessControl(customPermissions);
+var accessControl = createAccessControl({
+  ...adminDefaultStatements,
+  ...organizationDefaultStatements,
+  ...dalPermissions
+});
+var adminRole = narrowAccessControl.newRole({
+  ...adminAc.statements,
+  ...ownerAc.statements,
+  organization: ["update", "delete", "list"],
+  setting: ["read", "list", "upsert", "remove", "set-global-theme"],
+  system: ["read", "list", "create"],
+  exchangeRates: ["read", "list"]
+});
+var ownerRole = narrowAccessControl.newRole({
+  ...ownerAc.statements,
+  user: ["list", "get", "update"],
+  setting: ["read", "list", "upsert", "remove"],
+  system: ["read", "list", "create"],
+  exchangeRates: ["read", "list"]
+});
+var memberRole = narrowAccessControl.newRole({
+  ...memberAc.statements,
+  setting: ["read", "list"],
+  system: ["read", "list"],
+  exchangeRates: ["read", "list"]
+});
+
+// src/auth/wallet-plugins.ts
+import { defineErrorCodes } from "better-auth";
+var WALLET_PINCODE_ERROR_CODES = defineErrorCodes({
+  WALLET_PINCODE_ALREADY_SET: "Wallet pincode already set",
+  WALLET_PINCODE_ALREADY_REMOVED: "Wallet pincode already removed",
+  WALLET_PINCODE_PASSWORD_REQUIRED: "Password is required",
+  WALLET_PINCODE_INVALID_PASSWORD: "Invalid password"
+});
+var WALLET_TWO_FACTOR_ERROR_CODES = defineErrorCodes({
+  WALLET_TWO_FACTOR_PASSWORD_REQUIRED: "Password is required",
+  WALLET_TWO_FACTOR_INVALID_PASSWORD: "Invalid password",
+  WALLET_TWO_FACTOR_INVALID_CODE: "Invalid two factor code"
+});
+var WALLET_SECRET_CODES_ERROR_CODES = defineErrorCodes({
+  WALLET_SECRET_CODES_PASSWORD_REQUIRED: "Password is required",
+  WALLET_SECRET_CODES_INVALID_PASSWORD: "Invalid password",
+  WALLET_SECRET_CODES_VERIFICATION_MISMATCH: "Secret codes verification mismatch"
+});
+var walletPincodeClient = () => ({
+  id: "wallet-pincode",
+  $InferServerPlugin: {
+    id: "wallet-pincode",
+    $ERROR_CODES: WALLET_PINCODE_ERROR_CODES,
+    endpoints: {}
+  },
+  $ERROR_CODES: WALLET_PINCODE_ERROR_CODES,
+  pathMethods: {
+    "/wallet/pincode/enable": "POST",
+    "/wallet/pincode/disable": "POST",
+    "/wallet/pincode/update": "POST",
+    "/wallet/pincode/reset": "POST"
+  },
+  atomListeners: [
+    {
+      matcher: (path) => path.startsWith("/wallet/pincode/"),
+      signal: "$sessionSignal"
+    }
+  ]
+});
+var walletTwoFactorClient = () => ({
+  id: "wallet-two-factor",
+  $InferServerPlugin: {
+    id: "wallet-two-factor",
+    $ERROR_CODES: WALLET_TWO_FACTOR_ERROR_CODES,
+    endpoints: {}
+  },
+  $ERROR_CODES: WALLET_TWO_FACTOR_ERROR_CODES,
+  pathMethods: {
+    "/wallet/two-factor/enable": "POST",
+    "/wallet/two-factor/disable": "POST",
+    "/wallet/two-factor/verify": "POST"
+  },
+  atomListeners: [
+    {
+      matcher: (path) => path.startsWith("/wallet/two-factor/"),
+      signal: "$sessionSignal"
+    }
+  ]
+});
+var walletSecretCodesClient = () => ({
+  id: "wallet-secret-codes",
+  $InferServerPlugin: {
+    id: "wallet-secret-codes",
+    $ERROR_CODES: WALLET_SECRET_CODES_ERROR_CODES,
+    endpoints: {}
+  },
+  $ERROR_CODES: WALLET_SECRET_CODES_ERROR_CODES,
+  pathMethods: {
+    "/wallet/secret-codes/generate": "POST",
+    "/wallet/secret-codes/confirm": "POST"
+  },
+  atomListeners: [
+    {
+      matcher: (path) => path.startsWith("/wallet/secret-codes/"),
+      signal: "$sessionSignal"
+    }
+  ]
+});
+
+// src/auth/live.ts
+var reservedHeaders = new Set(["x-api-key", "authorization", "cookie"]);
+function authHeaders(config) {
+  const headers = { "User-Agent": SDK_USER_AGENT };
+  for (const [name, value] of Object.entries(config.headers ?? {})) {
+    if (!reservedHeaders.has(name.toLowerCase())) {
+      headers[name] = value;
+    }
+  }
+  if (config.apiKey !== undefined) {
+    headers["x-api-key"] = unwrapSecret(config.apiKey);
+  }
+  if (config.sessionToken !== undefined) {
+    const token = unwrapSecret(config.sessionToken);
+    headers.authorization = token.toLowerCase().startsWith("bearer ") ? token : `Bearer ${token}`;
+  }
+  if (config.organizationId !== undefined) {
+    headers["x-organization-id"] = config.organizationId;
+  }
+  return headers;
+}
+function createConfiguredBetterAuthClient(config, cookieStore) {
+  return createBetterAuthClient({
+    baseURL: `${normalizeDalpBaseUrl(config.url)}/api/auth`,
+    fetchOptions: {
+      headers: authHeaders(config),
+      customFetchImpl: createCookieStoreFetch(cookieStore, config.fetch),
+      credentials: "include"
+    },
+    plugins: [
+      customSessionClient(),
+      inferAdditionalFields(),
+      adminClient({ ac: accessControl, roles: { admin: adminRole, owner: ownerRole, member: memberRole } }),
+      apiKeyClient(),
+      passkeyClient(),
+      walletPincodeClient(),
+      walletTwoFactorClient(),
+      walletSecretCodesClient(),
+      twoFactorClient({ onTwoFactorRedirect() {} }),
+      deviceAuthorizationClient(),
+      organizationClient({ ac: accessControl, roles: { owner: ownerRole, member: memberRole } })
+    ]
+  });
+}
+async function createDalpAuthClient(input) {
+  const config = await decodeDalpAuthClientConfig(input);
+  const cookieStore = config.cookieStore ?? makeCookieStore();
+  if (config.cookie !== undefined) {
+    cookieStore.setCookieHeader(unwrapSecret(config.cookie));
+  }
+  const credentialCount = [config.apiKey, config.sessionToken, cookieStore.isEmpty() ? undefined : true].filter(Boolean).length;
+  if (credentialCount > 1) {
+    throw createDalpSdkConfigurationError({
+      message: "DALP SDK: configure only one auth credential source.",
+      why: "The auth client received multiple credential types.",
+      fix: "Use an API key, bearer token, or cookie store, not a combination."
+    });
+  }
+  return createConfiguredBetterAuthClient(config, cookieStore);
+}
+var makeDalpAuthClient = createDalpAuthClient;
+export {
+  createDalpAuthClient,
+  decodeDalpAuthClientConfig,
+  makeDalpAuthClient
+};