@settlemint/dalp-sdk 3.1.17 → 3.1.18-main.33796544973

package/dist/{auth-permissions.d.ts → auth/permissions.d.ts}

@@ -1,7 +1,7 @@
 /**
  * Client-side Better Auth access-control metadata for DALP auth clients.
  *
- * Related: packages/dalp/auth/src/utils/permissions.ts, kit/sdk/src/auth.ts
+ * Related: packages/dapi/auth/src/utils/permissions.ts, kit/sdk/src/auth/live.ts
  *
  * @module
  */
@@ -10,4 +10,3 @@ export declare const accessControl: AccessControl;
 export declare const adminRole: Role;
 export declare const ownerRole: Role;
 export declare const memberRole: Role;
-//# sourceMappingURL=auth-permissions.d.ts.map

package/dist/{auth-wallet-plugins.d.ts → auth/wallet-plugins.d.ts}

@@ -1,3 +1,69 @@
+import type { DalpAuthResult } from "./client.ts";
+export type WalletAuthOperation<TInput, TData> = (input: TInput, options?: unknown) => Promise<DalpAuthResult<TData>>;
+/** Typed client actions supplied by the three DALP wallet-auth plugins. */
+export interface DalpWalletAuthClient {
+    readonly wallet: {
+        readonly pincode: {
+            readonly enable: WalletAuthOperation<{
+                readonly pincode: string;
+                readonly password?: string;
+            }, {
+                readonly success: boolean;
+            }>;
+            readonly update: WalletAuthOperation<{
+                readonly newPincode: string;
+                readonly password: string;
+            }, {
+                readonly success: boolean;
+            }>;
+            readonly disable: WalletAuthOperation<{
+                readonly password: string;
+            }, {
+                readonly success: boolean;
+            }>;
+            readonly reset: WalletAuthOperation<{
+                readonly newPincode: string;
+                readonly recoveryCode: string;
+            }, {
+                readonly success: boolean;
+                readonly recoveryCodes?: ReadonlyArray<string>;
+            }>;
+        };
+        readonly twoFactor: {
+            readonly enable: WalletAuthOperation<{
+                readonly issuer?: string;
+                readonly password?: string;
+            }, {
+                readonly totpURI: string;
+            }>;
+            readonly verify: WalletAuthOperation<{
+                readonly code: string;
+            }, {
+                readonly status: boolean;
+            }>;
+            readonly disable: WalletAuthOperation<{
+                readonly password: string;
+            }, {
+                readonly status: boolean;
+            }>;
+        };
+        readonly secretCodes: {
+            readonly generate: WalletAuthOperation<{
+                readonly password?: string;
+            }, {
+                readonly rotated: boolean;
+                readonly secretCodes: ReadonlyArray<string>;
+                readonly verificationId: string;
+            }>;
+            readonly confirm: WalletAuthOperation<{
+                readonly stored: boolean;
+                readonly verificationId: string;
+            }, {
+                readonly success: boolean;
+            }>;
+        };
+    };
+}
 export declare const walletPincodeClient: () => {
     id: "wallet-pincode";
     $InferServerPlugin: {
@@ -78,9 +144,7 @@ export declare const walletSecretCodesClient: () => {
         signal: "$sessionSignal";
     }[];
 };
-type StripLeadingSlash<T extends string> = T extends `/${infer Rest}` ? Rest : never;
-type WalletPluginPathMethodKeys = keyof ReturnType<typeof walletPincodeClient>["pathMethods"] | keyof ReturnType<typeof walletTwoFactorClient>["pathMethods"] | keyof ReturnType<typeof walletSecretCodesClient>["pathMethods"];
+export type StripLeadingSlash<T extends string> = T extends `/${infer Rest}` ? Rest : never;
+export type WalletPluginPathMethodKeys = keyof ReturnType<typeof walletPincodeClient>["pathMethods"] | keyof ReturnType<typeof walletTwoFactorClient>["pathMethods"] | keyof ReturnType<typeof walletSecretCodesClient>["pathMethods"];
 /** CLI coverage keys for DALP wallet Better Auth plugin endpoints (no leading slash). */
-export type WalletAuthEndpointPath = StripLeadingSlash<WalletPluginPathMethodKeys & string>;
-export {};
-//# sourceMappingURL=auth-wallet-plugins.d.ts.map
+export type WalletAuthEndpointPath = StripLeadingSlash<WalletPluginPathMethodKeys>;

package/dist/auth.d.ts

@@ -1,115 +1,22 @@
-import { DalpCookieStore } from "./cookie-store.js";
-export interface DalpAuthClientConfig {
-    /** Base URL of the DALP API (e.g., `"https://dalp.example.com"`). */
-    url: string;
-    /** API key used for Better Auth API-key-authenticated operations. */
-    apiKey?: string;
-    /** Better Auth session token sent as an Authorization bearer token. */
-    sessionToken?: string;
-    /** Cookie header value for explicit Node/browser-session handoff. */
-    cookie?: string;
-    /** Cookie store for Node-side session persistence across Better Auth calls. */
-    cookieStore?: DalpCookieStore;
-    /**
-     * Organization ID for multi-tenant setups.
-     * Sent as `x-organization-id` when provided.
-     */
-    organizationId?: string;
-    /**
-     * Additional headers merged into every Better Auth request.
-     * Can override defaults like `User-Agent` but cannot override configured security headers.
-     */
-    headers?: Record<string, string>;
-    /**
-     * Custom `fetch` implementation.
-     * Use this to inject logging, proxy configuration, or test doubles.
-     */
-    fetch?: typeof globalThis.fetch;
-}
-export interface DalpAuthError {
-    code?: string;
-    message?: string;
-    status?: number;
-    statusText?: string;
-    [key: string]: unknown;
-}
-export interface DalpAuthResult<TData = unknown, TError = DalpAuthError> {
-    data: TData | null;
-    error: TError | null;
-}
-export type DalpAuthOperation<TInput = Record<string, unknown>, TData = unknown> = (input?: TInput, options?: unknown) => Promise<DalpAuthResult<TData>>;
-export interface DalpAuthClient {
-    signIn: Record<string, DalpAuthOperation> & {
-        email: DalpAuthOperation;
-    };
-    signUp: Record<string, DalpAuthOperation> & {
-        email: DalpAuthOperation;
-    };
-    getSession: DalpAuthOperation;
-    listSessions: DalpAuthOperation;
-    revokeSession: DalpAuthOperation;
-    revokeOtherSessions: DalpAuthOperation;
-    apiKey: Record<string, DalpAuthOperation> & {
-        create: DalpAuthOperation;
-        list: DalpAuthOperation;
-        delete: DalpAuthOperation;
-    };
-    organization: Record<string, DalpAuthOperation> & {
-        create: DalpAuthOperation;
-        list: DalpAuthOperation;
-        setActive: DalpAuthOperation;
-        inviteMember: DalpAuthOperation;
-        acceptInvitation: DalpAuthOperation;
-        listMembers: DalpAuthOperation;
-        addMember: DalpAuthOperation;
-        removeMember: DalpAuthOperation;
-    };
-    admin: Record<string, DalpAuthOperation> & {
-        listUsers: DalpAuthOperation;
-        createUser: DalpAuthOperation;
-        removeUser: DalpAuthOperation;
-        setRole: DalpAuthOperation;
-    };
-    device: Record<string, DalpAuthOperation> & {
-        code: DalpAuthOperation;
-        token: DalpAuthOperation;
-        approve: DalpAuthOperation;
-        deny: DalpAuthOperation;
-    };
-    passkey: Record<string, DalpAuthOperation>;
-    twoFactor: Record<string, DalpAuthOperation> & {
-        enable: DalpAuthOperation;
-        disable: DalpAuthOperation;
-        verifyTotp: DalpAuthOperation;
-        verifyBackupCode: DalpAuthOperation;
-        generateBackupCodes: DalpAuthOperation;
-    };
-    wallet: {
-        pincode: {
-            enable: DalpAuthOperation;
-            disable: DalpAuthOperation;
-            update: DalpAuthOperation;
-            reset: DalpAuthOperation;
-        };
-        twoFactor: {
-            enable: DalpAuthOperation;
-            disable: DalpAuthOperation;
-            verify: DalpAuthOperation;
-        };
-        secretCodes: {
-            generate: DalpAuthOperation;
-            confirm: DalpAuthOperation;
-        };
-        passkey: {
-            register: DalpAuthOperation;
-            complete: DalpAuthOperation;
-            disable: DalpAuthOperation;
-            challenge: DalpAuthOperation;
-            verify: DalpAuthOperation;
-        };
-    };
-    $fetch: (path: string, options?: Record<string, unknown>) => Promise<unknown>;
-    $ERROR_CODES: Record<string, unknown>;
-}
-export declare function createDalpAuthClient(config: DalpAuthClientConfig): DalpAuthClient;
-//# sourceMappingURL=auth.d.ts.map
+/**
+ * The DALP Better Auth client, on its own subpath.
+ *
+ * The generated SDK already exposes every auth REST operation, so nothing here
+ * exists to reach an endpoint. This surface exists for the parts a REST call
+ * cannot express: the session and cookie state machine, the plugin actions that
+ * run in the browser rather than over HTTP — `passkeyClient` drives the WebAuthn
+ * ceremony through `navigator.credentials` — and the access-control model that
+ * evaluates a permission locally instead of round-tripping `has-permission`.
+ *
+ * It is held off the package root because it costs roughly 70 KiB of Better
+ * Auth that a consumer who only calls operations should never pay.
+ *
+ * @module
+ */
+export { createDalpAuthClient, makeDalpAuthClient } from "./auth/live.ts";
+export type { DalpAuthClient } from "./auth/live.ts";
+export { decodeDalpAuthClientConfig } from "./auth/client.ts";
+export type { DalpAuthClientConfig, 
+/** @deprecated Prefer `DalpAuthClient` — this is the typed operation surface, not a separate client. */
+DalpCliAuthClient, DalpAuthError, DalpAuthOperation, DalpAuthResult, DalpOrganizationInvitation, DalpOrganizationInvitationsQuery, DalpOrganizationMember, DalpOrganizationMembersQuery, DecodedDalpAuthClientConfig, } from "./auth/client.ts";
+export type { WalletAuthEndpointPath } from "./auth/wallet-plugins.ts";

package/dist/auth.js

@@ -0,0 +1,329 @@
+import {
+  SDK_USER_AGENT,
+  createCookieStoreFetch,
+  makeCookieStore
+} from "./chunk-rzmr29dq.js";
+import {
+  normalizeDalpBaseUrl,
+  secret,
+  unwrapSecret
+} from "./chunk-h12fatty.js";
+import {
+  createDalpSdkConfigurationError
+} from "./chunk-y0d2c7kp.js";
+
+// src/auth/live.ts
+import { apiKeyClient } from "@better-auth/api-key/client";
+import { passkeyClient } from "@better-auth/passkey/client";
+import { createAuthClient as createBetterAuthClient } from "better-auth/client";
+import {
+  adminClient,
+  customSessionClient,
+  deviceAuthorizationClient,
+  inferAdditionalFields,
+  organizationClient,
+  twoFactorClient
+} from "better-auth/client/plugins";
+
+// src/auth/client.ts
+class AuthConfigError extends Error {
+  constructor(field, requirement) {
+    super(`\`${field}\` ${requirement}`);
+    this.name = "AuthConfigError";
+  }
+}
+function optionalText(value, field) {
+  if (value === undefined) {
+    return;
+  }
+  if (typeof value !== "string") {
+    return handleNonString(field);
+  }
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    throw new AuthConfigError(field, "must not be blank");
+  }
+  return trimmed;
+}
+function handleNonString(field) {
+  throw new AuthConfigError(field, "must be a string");
+}
+function requiredUrl(value) {
+  if (typeof value !== "string") {
+    return handleNonString("url");
+  }
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new AuthConfigError("url", "must be a valid URL");
+  }
+  if (!["http:", "https:"].includes(parsed.protocol)) {
+    throw new AuthConfigError("url", "must use http or https");
+  }
+  return value;
+}
+function optionalHeaders(value) {
+  if (value === undefined) {
+    return;
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new AuthConfigError("headers", "must be an object of strings");
+  }
+  const headers = {};
+  for (const [name, header] of Object.entries(value)) {
+    if (typeof header !== "string") {
+      throw new AuthConfigError("headers", "must be an object of strings");
+    }
+    headers[name] = header;
+  }
+  return headers;
+}
+function optionalFetch(value) {
+  if (value === undefined) {
+    return;
+  }
+  if (typeof value !== "function") {
+    throw new AuthConfigError("fetch", "must be a function");
+  }
+  return value;
+}
+function optionalCookieStore(value) {
+  if (value === undefined) {
+    return;
+  }
+  const store = value;
+  if (typeof value !== "object" || value === null || typeof store.header !== "function" || typeof store.storeSetCookieHeaders !== "function") {
+    throw new AuthConfigError("cookieStore", "must expose header and storeSetCookieHeaders");
+  }
+  return store;
+}
+function decodeAuthConfig(input) {
+  const raw = input;
+  const apiKey = optionalText(raw.apiKey, "apiKey");
+  const sessionToken = optionalText(raw.sessionToken, "sessionToken");
+  const cookie = optionalText(raw.cookie, "cookie");
+  if ([apiKey, sessionToken, cookie].filter((credential) => credential !== undefined).length > 1) {
+    throw new AuthConfigError("apiKey/sessionToken/cookie", "configure only one auth credential source");
+  }
+  const url = requiredUrl(raw.url);
+  const cookieStore = optionalCookieStore(raw.cookieStore);
+  const organizationId = optionalText(raw.organizationId, "organizationId");
+  const headers = optionalHeaders(raw.headers);
+  const configuredFetch = optionalFetch(raw.fetch);
+  return {
+    url,
+    ...apiKey === undefined ? {} : { apiKey: secret(apiKey) },
+    ...sessionToken === undefined ? {} : { sessionToken: secret(sessionToken) },
+    ...cookie === undefined ? {} : { cookie: secret(cookie) },
+    ...cookieStore === undefined ? {} : { cookieStore },
+    ...organizationId === undefined ? {} : { organizationId },
+    ...headers === undefined ? {} : { headers },
+    ...configuredFetch === undefined ? {} : { fetch: configuredFetch }
+  };
+}
+async function decodeDalpAuthClientConfig(input) {
+  try {
+    return decodeAuthConfig(input);
+  } catch (error) {
+    throw createDalpSdkConfigurationError({
+      message: "DALP SDK: auth client configuration is invalid.",
+      why: "The auth client received a malformed URL, credential, header map, fetch seam, or cookie store.",
+      fix: "Pass one credential source, an HTTP(S) URL, and valid fetch and cookie-store seams.",
+      cause: error
+    });
+  }
+}
+
+// src/auth/permissions.ts
+import { createAccessControl } from "better-auth/plugins/access";
+import { adminAc, defaultStatements as adminDefaultStatements } from "better-auth/plugins/admin/access";
+import {
+  memberAc,
+  defaultStatements as organizationDefaultStatements,
+  ownerAc
+} from "better-auth/plugins/organization/access";
+var dalPermissions = {
+  organization: ["update", "delete", "list"],
+  setting: ["read", "list", "upsert", "remove", "set-global-theme"],
+  system: ["read", "list", "create"],
+  exchangeRates: ["read", "list"]
+};
+var customPermissions = {
+  ...adminDefaultStatements,
+  ...organizationDefaultStatements,
+  ...dalPermissions
+};
+var narrowAccessControl = createAccessControl(customPermissions);
+var accessControl = createAccessControl({
+  ...adminDefaultStatements,
+  ...organizationDefaultStatements,
+  ...dalPermissions
+});
+var adminRole = narrowAccessControl.newRole({
+  ...adminAc.statements,
+  ...ownerAc.statements,
+  organization: ["update", "delete", "list"],
+  setting: ["read", "list", "upsert", "remove", "set-global-theme"],
+  system: ["read", "list", "create"],
+  exchangeRates: ["read", "list"]
+});
+var ownerRole = narrowAccessControl.newRole({
+  ...ownerAc.statements,
+  user: ["list", "get", "update"],
+  setting: ["read", "list", "upsert", "remove"],
+  system: ["read", "list", "create"],
+  exchangeRates: ["read", "list"]
+});
+var memberRole = narrowAccessControl.newRole({
+  ...memberAc.statements,
+  setting: ["read", "list"],
+  system: ["read", "list"],
+  exchangeRates: ["read", "list"]
+});
+
+// src/auth/wallet-plugins.ts
+import { defineErrorCodes } from "better-auth";
+var WALLET_PINCODE_ERROR_CODES = defineErrorCodes({
+  WALLET_PINCODE_ALREADY_SET: "Wallet pincode already set",
+  WALLET_PINCODE_ALREADY_REMOVED: "Wallet pincode already removed",
+  WALLET_PINCODE_PASSWORD_REQUIRED: "Password is required",
+  WALLET_PINCODE_INVALID_PASSWORD: "Invalid password"
+});
+var WALLET_TWO_FACTOR_ERROR_CODES = defineErrorCodes({
+  WALLET_TWO_FACTOR_PASSWORD_REQUIRED: "Password is required",
+  WALLET_TWO_FACTOR_INVALID_PASSWORD: "Invalid password",
+  WALLET_TWO_FACTOR_INVALID_CODE: "Invalid two factor code"
+});
+var WALLET_SECRET_CODES_ERROR_CODES = defineErrorCodes({
+  WALLET_SECRET_CODES_PASSWORD_REQUIRED: "Password is required",
+  WALLET_SECRET_CODES_INVALID_PASSWORD: "Invalid password",
+  WALLET_SECRET_CODES_VERIFICATION_MISMATCH: "Secret codes verification mismatch"
+});
+var walletPincodeClient = () => ({
+  id: "wallet-pincode",
+  $InferServerPlugin: {
+    id: "wallet-pincode",
+    $ERROR_CODES: WALLET_PINCODE_ERROR_CODES,
+    endpoints: {}
+  },
+  $ERROR_CODES: WALLET_PINCODE_ERROR_CODES,
+  pathMethods: {
+    "/wallet/pincode/enable": "POST",
+    "/wallet/pincode/disable": "POST",
+    "/wallet/pincode/update": "POST",
+    "/wallet/pincode/reset": "POST"
+  },
+  atomListeners: [
+    {
+      matcher: (path) => path.startsWith("/wallet/pincode/"),
+      signal: "$sessionSignal"
+    }
+  ]
+});
+var walletTwoFactorClient = () => ({
+  id: "wallet-two-factor",
+  $InferServerPlugin: {
+    id: "wallet-two-factor",
+    $ERROR_CODES: WALLET_TWO_FACTOR_ERROR_CODES,
+    endpoints: {}
+  },
+  $ERROR_CODES: WALLET_TWO_FACTOR_ERROR_CODES,
+  pathMethods: {
+    "/wallet/two-factor/enable": "POST",
+    "/wallet/two-factor/disable": "POST",
+    "/wallet/two-factor/verify": "POST"
+  },
+  atomListeners: [
+    {
+      matcher: (path) => path.startsWith("/wallet/two-factor/"),
+      signal: "$sessionSignal"
+    }
+  ]
+});
+var walletSecretCodesClient = () => ({
+  id: "wallet-secret-codes",
+  $InferServerPlugin: {
+    id: "wallet-secret-codes",
+    $ERROR_CODES: WALLET_SECRET_CODES_ERROR_CODES,
+    endpoints: {}
+  },
+  $ERROR_CODES: WALLET_SECRET_CODES_ERROR_CODES,
+  pathMethods: {
+    "/wallet/secret-codes/generate": "POST",
+    "/wallet/secret-codes/confirm": "POST"
+  },
+  atomListeners: [
+    {
+      matcher: (path) => path.startsWith("/wallet/secret-codes/"),
+      signal: "$sessionSignal"
+    }
+  ]
+});
+
+// src/auth/live.ts
+var reservedHeaders = new Set(["x-api-key", "authorization", "cookie"]);
+function authHeaders(config) {
+  const headers = { "User-Agent": SDK_USER_AGENT };
+  for (const [name, value] of Object.entries(config.headers ?? {})) {
+    if (!reservedHeaders.has(name.toLowerCase())) {
+      headers[name] = value;
+    }
+  }
+  if (config.apiKey !== undefined) {
+    headers["x-api-key"] = unwrapSecret(config.apiKey);
+  }
+  if (config.sessionToken !== undefined) {
+    const token = unwrapSecret(config.sessionToken);
+    headers.authorization = token.toLowerCase().startsWith("bearer ") ? token : `Bearer ${token}`;
+  }
+  if (config.organizationId !== undefined) {
+    headers["x-organization-id"] = config.organizationId;
+  }
+  return headers;
+}
+function createConfiguredBetterAuthClient(config, cookieStore) {
+  return createBetterAuthClient({
+    baseURL: `${normalizeDalpBaseUrl(config.url)}/api/auth`,
+    fetchOptions: {
+      headers: authHeaders(config),
+      customFetchImpl: createCookieStoreFetch(cookieStore, config.fetch),
+      credentials: "include"
+    },
+    plugins: [
+      customSessionClient(),
+      inferAdditionalFields(),
+      adminClient({ ac: accessControl, roles: { admin: adminRole, owner: ownerRole, member: memberRole } }),
+      apiKeyClient(),
+      passkeyClient(),
+      walletPincodeClient(),
+      walletTwoFactorClient(),
+      walletSecretCodesClient(),
+      twoFactorClient({ onTwoFactorRedirect() {} }),
+      deviceAuthorizationClient(),
+      organizationClient({ ac: accessControl, roles: { owner: ownerRole, member: memberRole } })
+    ]
+  });
+}
+async function createDalpAuthClient(input) {
+  const config = await decodeDalpAuthClientConfig(input);
+  const cookieStore = config.cookieStore ?? makeCookieStore();
+  if (config.cookie !== undefined) {
+    cookieStore.setCookieHeader(unwrapSecret(config.cookie));
+  }
+  const credentialCount = [config.apiKey, config.sessionToken, cookieStore.isEmpty() ? undefined : true].filter(Boolean).length;
+  if (credentialCount > 1) {
+    throw createDalpSdkConfigurationError({
+      message: "DALP SDK: configure only one auth credential source.",
+      why: "The auth client received multiple credential types.",
+      fix: "Use an API key, bearer token, or cookie store, not a combination."
+    });
+  }
+  return createConfiguredBetterAuthClient(config, cookieStore);
+}
+var makeDalpAuthClient = createDalpAuthClient;
+export {
+  createDalpAuthClient,
+  decodeDalpAuthClientConfig,
+  makeDalpAuthClient
+};