@settlemint/dalp-sdk 3.1.33 → 3.2.0-rc.1

package/dist/auth/client.d.ts

@@ -0,0 +1,114 @@
+import type { DalpFetch } from "../client/ssr-fetch.ts";
+import type { DalpAuthSurface } from "../auth-surface.ts";
+import type { AuthGetApiKeyListResponse, AuthGetOrganizationListResponse, AuthPostApiKeyCreateData, AuthPostApiKeyCreateResponse, AuthPostApiKeyDeleteData, AuthPostApiKeyDeleteResponse, AuthPostOrganizationCreateData, AuthPostOrganizationCreateResponse, AuthPostRevokeOtherSessionsResponse, AuthPostRevokeSessionData, AuthPostRevokeSessionResponse, AuthPostTwoFactorDisableData, AuthPostTwoFactorDisableResponse, AuthPostTwoFactorEnableData, AuthPostTwoFactorEnableResponse, AuthPostTwoFactorVerifyBackupCodeData, AuthPostTwoFactorVerifyBackupCodeResponse, AuthPostTwoFactorVerifyTotpData, AuthPostTwoFactorVerifyTotpResponse, CreateOrganizationInvitationData, CreateOrganizationInvitationResponse, GetSessionResponse, ListUserSessionsResponse, Member, SetActiveOrganizationData, SetActiveOrganizationResponse } from "../generated/api-types.ts";
+import { Secret } from "../secret.ts";
+import type { CookieStoreShape } from "../transport/cookie-store.ts";
+import type { DalpRuntime } from "../runtime.ts";
+import type { DalpPasskeyCeremony } from "./native-passkey.ts";
+export interface DalpAuthClientConfig {
+    readonly url: string;
+    readonly apiKey?: string;
+    readonly cookie?: string;
+    readonly cookieStore?: CookieStoreShape;
+    readonly authSurface?: DalpAuthSurface;
+    readonly headers?: Record<string, string>;
+    readonly fetch?: DalpFetch;
+    readonly runtime?: DalpRuntime;
+    readonly passkey?: DalpPasskeyCeremony;
+}
+export interface DecodedDalpAuthClientConfig extends Omit<DalpAuthClientConfig, "apiKey" | "cookie"> {
+    readonly apiKey?: Secret;
+    readonly cookie?: Secret;
+}
+export interface DalpAuthError {
+    readonly code?: string;
+    readonly message?: string;
+    readonly status?: number;
+    readonly statusText?: string;
+    readonly [key: string]: unknown;
+}
+export interface DalpAuthResult<TData = unknown, TError = DalpAuthError> {
+    readonly data: TData | null;
+    readonly error: TError | null;
+}
+export type DalpAuthOperation<TInput, TData = unknown> = (input?: TInput, options?: unknown) => Promise<DalpAuthResult<TData>>;
+export type DalpRequiredAuthOperation<TInput, TData> = (input: TInput, options?: unknown) => Promise<DalpAuthResult<TData>>;
+export type DalpNoInputAuthOperation<TData> = (options?: unknown) => Promise<DalpAuthResult<TData>>;
+export type RequestBody<TData> = TData;
+export type DalpTwoFactorSendOtpData = {
+    readonly trustDevice?: boolean;
+    readonly fetchOptions?: unknown;
+};
+export type DalpTwoFactorVerifyOtpData = {
+    readonly code: string;
+    readonly trustDevice?: boolean;
+    readonly fetchOptions?: unknown;
+};
+export interface DalpOrganizationMember extends Member {
+    readonly user: {
+        readonly id: string;
+        readonly email: string;
+        readonly name: string;
+        readonly image?: string;
+    };
+}
+export interface DalpOrganizationMembersQuery {
+    readonly limit?: string | number;
+    readonly offset?: string | number;
+    readonly sortBy?: string;
+    readonly sortDirection?: "asc" | "desc";
+    readonly filterField?: string;
+    readonly filterValue?: string | number | boolean | ReadonlyArray<string> | ReadonlyArray<number>;
+    readonly filterOperator?: "eq" | "ne" | "gt" | "gte" | "lt" | "lte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with";
+    readonly organizationId?: string;
+    readonly organizationSlug?: string;
+}
+export interface DalpOrganizationInvitation {
+    readonly id: string;
+    readonly organizationId: string;
+    readonly email: string;
+    readonly role?: string;
+    readonly status: string;
+    readonly expiresAt: string | Date;
+}
+export interface DalpOrganizationInvitationsQuery {
+    readonly organizationId?: string;
+}
+export interface DalpCliAuthClient {
+    readonly getSession: DalpNoInputAuthOperation<GetSessionResponse>;
+    readonly listSessions: DalpNoInputAuthOperation<ListUserSessionsResponse>;
+    readonly revokeSession: DalpRequiredAuthOperation<RequestBody<AuthPostRevokeSessionData>, AuthPostRevokeSessionResponse>;
+    readonly revokeOtherSessions: DalpNoInputAuthOperation<AuthPostRevokeOtherSessionsResponse>;
+    readonly apiKey: {
+        readonly list: DalpNoInputAuthOperation<AuthGetApiKeyListResponse>;
+        readonly create: DalpRequiredAuthOperation<RequestBody<AuthPostApiKeyCreateData>, AuthPostApiKeyCreateResponse>;
+        readonly delete: DalpRequiredAuthOperation<RequestBody<AuthPostApiKeyDeleteData>, AuthPostApiKeyDeleteResponse>;
+    };
+    readonly organization: {
+        readonly list: DalpNoInputAuthOperation<AuthGetOrganizationListResponse>;
+        readonly setActive: DalpRequiredAuthOperation<RequestBody<SetActiveOrganizationData>, SetActiveOrganizationResponse>;
+        readonly create: DalpRequiredAuthOperation<RequestBody<AuthPostOrganizationCreateData>, AuthPostOrganizationCreateResponse>;
+        readonly inviteMember: DalpRequiredAuthOperation<RequestBody<CreateOrganizationInvitationData>, CreateOrganizationInvitationResponse>;
+        readonly listMembers: DalpRequiredAuthOperation<{
+            readonly query?: DalpOrganizationMembersQuery;
+        }, {
+            readonly members: ReadonlyArray<DalpOrganizationMember>;
+            readonly total: number;
+        }>;
+        readonly listInvitations: DalpAuthOperation<{
+            readonly query?: DalpOrganizationInvitationsQuery;
+        }, ReadonlyArray<DalpOrganizationInvitation>>;
+        readonly listUserInvitations: DalpNoInputAuthOperation<ReadonlyArray<DalpOrganizationInvitation>>;
+    };
+    readonly twoFactor: {
+        readonly enable: DalpRequiredAuthOperation<RequestBody<AuthPostTwoFactorEnableData>, AuthPostTwoFactorEnableResponse>;
+        readonly disable: DalpRequiredAuthOperation<RequestBody<AuthPostTwoFactorDisableData>, AuthPostTwoFactorDisableResponse>;
+        readonly verifyTotp: DalpRequiredAuthOperation<RequestBody<AuthPostTwoFactorVerifyTotpData>, AuthPostTwoFactorVerifyTotpResponse>;
+        readonly verifyBackupCode: DalpRequiredAuthOperation<RequestBody<AuthPostTwoFactorVerifyBackupCodeData>, AuthPostTwoFactorVerifyBackupCodeResponse>;
+        readonly sendOtp: DalpRequiredAuthOperation<DalpTwoFactorSendOtpData, {
+            readonly status: boolean;
+        }>;
+        readonly verifyOtp: DalpRequiredAuthOperation<DalpTwoFactorVerifyOtpData, unknown>;
+    };
+}
+export declare function decodeDalpAuthClientConfig(input: DalpAuthClientConfig): Promise<DecodedDalpAuthClientConfig>;

package/dist/auth/invite-step-up.d.ts

@@ -0,0 +1,2 @@
+import type { CookieStoreFetch } from "../transport/cookie-store.ts";
+export declare function withInviteStepUp(fetchImpl: CookieStoreFetch, baseUrl: string): CookieStoreFetch;

package/dist/auth/live.d.ts

@@ -0,0 +1,47 @@
+import { apiKeyClient } from "@better-auth/api-key/client";
+import { passkeyClient } from "@better-auth/passkey/client";
+import { type AuthClient, type BetterAuthClientOptions } from "better-auth/client";
+import { adminClient, customSessionClient, deviceAuthorizationClient, inferAdditionalFields, organizationClient, twoFactorClient } from "better-auth/client/plugins";
+import { type DalpAuthClientConfig, type DalpCliAuthClient } from "./client.ts";
+import { type DalpWalletAuthClient, walletPincodeClient, walletSecretCodesClient, walletTwoFactorClient } from "./wallet-plugins.ts";
+declare const adminPluginOptions: {
+    ac: import("better-auth/plugins").AccessControl;
+    roles: {
+        admin: import("better-auth/plugins").Role;
+        owner: import("better-auth/plugins").Role;
+        member: import("better-auth/plugins").Role;
+    };
+};
+declare const organizationPluginOptions: {
+    ac: import("better-auth/plugins").AccessControl;
+    roles: {
+        owner: import("better-auth/plugins").Role;
+        member: import("better-auth/plugins").Role;
+    };
+};
+type ConfiguredBetterAuthPluginTuple = [
+    ReturnType<typeof customSessionClient>,
+    ReturnType<typeof inferAdditionalFields>,
+    ReturnType<typeof adminClient<typeof adminPluginOptions>>,
+    ReturnType<typeof apiKeyClient>,
+    ReturnType<typeof passkeyClient>,
+    ReturnType<typeof walletPincodeClient>,
+    ReturnType<typeof walletTwoFactorClient>,
+    ReturnType<typeof walletSecretCodesClient>,
+    ReturnType<typeof twoFactorClient>,
+    ReturnType<typeof deviceAuthorizationClient>,
+    ReturnType<typeof organizationClient<typeof organizationPluginOptions>>
+];
+type ConfiguredBetterAuthClientOptions = Omit<BetterAuthClientOptions, "plugins"> & {
+    plugins: ConfiguredBetterAuthPluginTuple;
+};
+export type InferredBetterAuthClient = AuthClient<ConfiguredBetterAuthClientOptions>;
+type UnservedAuthClientMembers = "deleteUser" | "revokeSessions" | "sendVerificationEmail";
+interface DalpDeviceAuthClient {
+    readonly device: Omit<InferredBetterAuthClient["device"], "approve" | "deny">;
+    readonly passkey: Omit<InferredBetterAuthClient["passkey"], "updatePasskey">;
+}
+export type DalpAuthClient = Omit<InferredBetterAuthClient, keyof DalpCliAuthClient | keyof DalpWalletAuthClient | keyof DalpDeviceAuthClient | UnservedAuthClientMembers> & DalpDeviceAuthClient & DalpCliAuthClient & DalpWalletAuthClient;
+export declare function createDalpAuthClient(input: DalpAuthClientConfig): Promise<DalpAuthClient>;
+export declare const makeDalpAuthClient: typeof createDalpAuthClient;
+export {};

package/dist/auth/native-passkey.d.ts

@@ -0,0 +1,8 @@
+import { passkeyClient, type AuthenticationResponseJSON, type PublicKeyCredentialCreationOptionsJSON, type PublicKeyCredentialRequestOptionsJSON, type RegistrationResponseJSON } from "@better-auth/passkey/client";
+export interface DalpPasskeyCeremony {
+    readonly authenticate: (options: PublicKeyCredentialRequestOptionsJSON) => Promise<AuthenticationResponseJSON>;
+    readonly register: (options: PublicKeyCredentialCreationOptionsJSON) => Promise<RegistrationResponseJSON>;
+}
+type PasskeyClientPlugin = ReturnType<typeof passkeyClient>;
+export declare function ceremonyPasskeyClient(ceremony: DalpPasskeyCeremony): PasskeyClientPlugin;
+export {};

package/dist/{auth-permissions.d.ts → auth/permissions.d.ts}

@@ -1,13 +1,5 @@
-/**
- * Client-side Better Auth access-control metadata for DALP auth clients.
- *
- * Related: packages/dalp/auth/src/utils/permissions.ts, kit/sdk/src/auth.ts
- *
- * @module
- */
 import { type AccessControl, type Role } from "better-auth/plugins/access";
 export declare const accessControl: AccessControl;
 export declare const adminRole: Role;
 export declare const ownerRole: Role;
 export declare const memberRole: Role;
-//# sourceMappingURL=auth-permissions.d.ts.map

package/dist/auth/wallet-plugins.d.ts

@@ -0,0 +1,196 @@
+import type { DalpAuthResult } from "./client.ts";
+export type WalletAuthOperation<TInput, TData> = (input: TInput, options?: unknown) => Promise<DalpAuthResult<TData>>;
+export type WalletStepUpMethod = "PINCODE" | "OTP" | "SECRET_CODES" | "OIDC_MFA";
+export interface WalletStepUpVerification {
+    readonly secretVerificationCode: string;
+    readonly verificationType?: WalletStepUpMethod;
+}
+export interface WalletStepUp {
+    readonly walletVerification?: WalletStepUpVerification;
+}
+export interface WalletStepUpRequired {
+    readonly walletVerification: WalletStepUpVerification;
+}
+export interface DalpWalletAuthClient {
+    readonly wallet: {
+        readonly pincode: {
+            readonly enable: WalletAuthOperation<WalletStepUp & {
+                readonly pincode: string;
+            }, {
+                readonly success: boolean;
+            }>;
+            readonly update: WalletAuthOperation<WalletStepUpRequired & {
+                readonly newPincode: string;
+            }, {
+                readonly success: boolean;
+            }>;
+            readonly disable: WalletAuthOperation<WalletStepUpRequired, {
+                readonly success: boolean;
+            }>;
+            readonly recover: WalletAuthOperation<{
+                readonly newPincode: string;
+            }, {
+                readonly success: boolean;
+            }>;
+            readonly reset: WalletAuthOperation<{
+                readonly newPincode: string;
+                readonly recoveryCode: string;
+            }, {
+                readonly success: boolean;
+                readonly recoveryCodes?: ReadonlyArray<string>;
+            }>;
+        };
+        readonly twoFactor: {
+            readonly enable: WalletAuthOperation<WalletStepUp & {
+                readonly issuer?: string;
+            }, {
+                readonly totpURI: string;
+            }>;
+            readonly verify: WalletAuthOperation<{
+                readonly code: string;
+            }, {
+                readonly status: boolean;
+            }>;
+            readonly disable: WalletAuthOperation<WalletStepUpRequired, {
+                readonly status: boolean;
+            }>;
+        };
+        readonly secretCodes: {
+            readonly generate: WalletAuthOperation<WalletStepUp, {
+                readonly rotated: boolean;
+                readonly secretCodes: ReadonlyArray<string>;
+                readonly verificationId: string;
+            }>;
+            readonly confirm: WalletAuthOperation<{
+                readonly stored: boolean;
+                readonly verificationId: string;
+            }, {
+                readonly success: boolean;
+            }>;
+        };
+    };
+}
+export declare const walletPincodeClient: () => {
+    id: "wallet-pincode";
+    $InferServerPlugin: {
+        id: "wallet-pincode";
+        $ERROR_CODES: {
+            WALLET_CREDENTIAL_LOCKED: import("better-auth").RawError<"WALLET_CREDENTIAL_LOCKED">;
+            WALLET_LAST_SIGNING_FACTOR: import("better-auth").RawError<"WALLET_LAST_SIGNING_FACTOR">;
+            WALLET_PINCODE_ALREADY_REMOVED: import("better-auth").RawError<"WALLET_PINCODE_ALREADY_REMOVED">;
+            WALLET_PINCODE_ALREADY_SET: import("better-auth").RawError<"WALLET_PINCODE_ALREADY_SET">;
+            WALLET_PINCODE_FRESH_SSO_REQUIRED: import("better-auth").RawError<"WALLET_PINCODE_FRESH_SSO_REQUIRED">;
+            WALLET_PINCODE_INVALID_RECOVERY_CODE: import("better-auth").RawError<"WALLET_PINCODE_INVALID_RECOVERY_CODE">;
+            WALLET_PINCODE_NO_RECOVERY_CODES_REMAINING: import("better-auth").RawError<"WALLET_PINCODE_NO_RECOVERY_CODES_REMAINING">;
+            WALLET_PINCODE_PASSWORD_REQUIRED: import("better-auth").RawError<"WALLET_PINCODE_PASSWORD_REQUIRED">;
+            WALLET_PINCODE_RECOVERY_NOT_CONFIGURED: import("better-auth").RawError<"WALLET_PINCODE_RECOVERY_NOT_CONFIGURED">;
+            WALLET_VERIFICATION_FACTOR_UNAVAILABLE: import("better-auth").RawError<"WALLET_VERIFICATION_FACTOR_UNAVAILABLE">;
+            WALLET_VERIFICATION_INVALID_CODE: import("better-auth").RawError<"WALLET_VERIFICATION_INVALID_CODE">;
+            WALLET_VERIFICATION_NOT_CONFIGURED: import("better-auth").RawError<"WALLET_VERIFICATION_NOT_CONFIGURED">;
+            WALLET_VERIFICATION_UNAVAILABLE: import("better-auth").RawError<"WALLET_VERIFICATION_UNAVAILABLE">;
+        };
+        endpoints: {};
+    };
+    $ERROR_CODES: {
+        WALLET_CREDENTIAL_LOCKED: import("better-auth").RawError<"WALLET_CREDENTIAL_LOCKED">;
+        WALLET_LAST_SIGNING_FACTOR: import("better-auth").RawError<"WALLET_LAST_SIGNING_FACTOR">;
+        WALLET_PINCODE_ALREADY_REMOVED: import("better-auth").RawError<"WALLET_PINCODE_ALREADY_REMOVED">;
+        WALLET_PINCODE_ALREADY_SET: import("better-auth").RawError<"WALLET_PINCODE_ALREADY_SET">;
+        WALLET_PINCODE_FRESH_SSO_REQUIRED: import("better-auth").RawError<"WALLET_PINCODE_FRESH_SSO_REQUIRED">;
+        WALLET_PINCODE_INVALID_RECOVERY_CODE: import("better-auth").RawError<"WALLET_PINCODE_INVALID_RECOVERY_CODE">;
+        WALLET_PINCODE_NO_RECOVERY_CODES_REMAINING: import("better-auth").RawError<"WALLET_PINCODE_NO_RECOVERY_CODES_REMAINING">;
+        WALLET_PINCODE_PASSWORD_REQUIRED: import("better-auth").RawError<"WALLET_PINCODE_PASSWORD_REQUIRED">;
+        WALLET_PINCODE_RECOVERY_NOT_CONFIGURED: import("better-auth").RawError<"WALLET_PINCODE_RECOVERY_NOT_CONFIGURED">;
+        WALLET_VERIFICATION_FACTOR_UNAVAILABLE: import("better-auth").RawError<"WALLET_VERIFICATION_FACTOR_UNAVAILABLE">;
+        WALLET_VERIFICATION_INVALID_CODE: import("better-auth").RawError<"WALLET_VERIFICATION_INVALID_CODE">;
+        WALLET_VERIFICATION_NOT_CONFIGURED: import("better-auth").RawError<"WALLET_VERIFICATION_NOT_CONFIGURED">;
+        WALLET_VERIFICATION_UNAVAILABLE: import("better-auth").RawError<"WALLET_VERIFICATION_UNAVAILABLE">;
+    };
+    pathMethods: {
+        "/wallet/pincode/enable": "POST";
+        "/wallet/pincode/disable": "POST";
+        "/wallet/pincode/update": "POST";
+        "/wallet/pincode/recover": "POST";
+        "/wallet/pincode/reset": "POST";
+    };
+    atomListeners: {
+        matcher: (path: string) => boolean;
+        signal: "$sessionSignal";
+    }[];
+};
+export declare const walletTwoFactorClient: () => {
+    id: "wallet-two-factor";
+    $InferServerPlugin: {
+        id: "wallet-two-factor";
+        $ERROR_CODES: {
+            WALLET_CREDENTIAL_LOCKED: import("better-auth").RawError<"WALLET_CREDENTIAL_LOCKED">;
+            WALLET_LAST_SIGNING_FACTOR: import("better-auth").RawError<"WALLET_LAST_SIGNING_FACTOR">;
+            WALLET_TWO_FACTOR_AUTHENTICATOR_PROOF_REQUIRED: import("better-auth").RawError<"WALLET_TWO_FACTOR_AUTHENTICATOR_PROOF_REQUIRED">;
+            WALLET_TWO_FACTOR_INVALID_CODE: import("better-auth").RawError<"WALLET_TWO_FACTOR_INVALID_CODE">;
+            WALLET_TWO_FACTOR_PASSWORD_REQUIRED: import("better-auth").RawError<"WALLET_TWO_FACTOR_PASSWORD_REQUIRED">;
+            WALLET_VERIFICATION_FACTOR_UNAVAILABLE: import("better-auth").RawError<"WALLET_VERIFICATION_FACTOR_UNAVAILABLE">;
+            WALLET_VERIFICATION_INVALID_CODE: import("better-auth").RawError<"WALLET_VERIFICATION_INVALID_CODE">;
+            WALLET_VERIFICATION_NOT_CONFIGURED: import("better-auth").RawError<"WALLET_VERIFICATION_NOT_CONFIGURED">;
+            WALLET_VERIFICATION_UNAVAILABLE: import("better-auth").RawError<"WALLET_VERIFICATION_UNAVAILABLE">;
+        };
+        endpoints: {};
+    };
+    $ERROR_CODES: {
+        WALLET_CREDENTIAL_LOCKED: import("better-auth").RawError<"WALLET_CREDENTIAL_LOCKED">;
+        WALLET_LAST_SIGNING_FACTOR: import("better-auth").RawError<"WALLET_LAST_SIGNING_FACTOR">;
+        WALLET_TWO_FACTOR_AUTHENTICATOR_PROOF_REQUIRED: import("better-auth").RawError<"WALLET_TWO_FACTOR_AUTHENTICATOR_PROOF_REQUIRED">;
+        WALLET_TWO_FACTOR_INVALID_CODE: import("better-auth").RawError<"WALLET_TWO_FACTOR_INVALID_CODE">;
+        WALLET_TWO_FACTOR_PASSWORD_REQUIRED: import("better-auth").RawError<"WALLET_TWO_FACTOR_PASSWORD_REQUIRED">;
+        WALLET_VERIFICATION_FACTOR_UNAVAILABLE: import("better-auth").RawError<"WALLET_VERIFICATION_FACTOR_UNAVAILABLE">;
+        WALLET_VERIFICATION_INVALID_CODE: import("better-auth").RawError<"WALLET_VERIFICATION_INVALID_CODE">;
+        WALLET_VERIFICATION_NOT_CONFIGURED: import("better-auth").RawError<"WALLET_VERIFICATION_NOT_CONFIGURED">;
+        WALLET_VERIFICATION_UNAVAILABLE: import("better-auth").RawError<"WALLET_VERIFICATION_UNAVAILABLE">;
+    };
+    pathMethods: {
+        "/wallet/two-factor/enable": "POST";
+        "/wallet/two-factor/disable": "POST";
+        "/wallet/two-factor/verify": "POST";
+    };
+    atomListeners: {
+        matcher: (path: string) => boolean;
+        signal: "$sessionSignal";
+    }[];
+};
+export declare const walletSecretCodesClient: () => {
+    id: "wallet-secret-codes";
+    $InferServerPlugin: {
+        id: "wallet-secret-codes";
+        $ERROR_CODES: {
+            WALLET_CREDENTIAL_LOCKED: import("better-auth").RawError<"WALLET_CREDENTIAL_LOCKED">;
+            WALLET_SECRET_CODES_AUTHENTICATOR_PROOF_REQUIRED: import("better-auth").RawError<"WALLET_SECRET_CODES_AUTHENTICATOR_PROOF_REQUIRED">;
+            WALLET_SECRET_CODES_PIN_PROOF_REQUIRED: import("better-auth").RawError<"WALLET_SECRET_CODES_PIN_PROOF_REQUIRED">;
+            WALLET_SECRET_CODES_VERIFICATION_MISMATCH: import("better-auth").RawError<"WALLET_SECRET_CODES_VERIFICATION_MISMATCH">;
+            WALLET_VERIFICATION_FACTOR_UNAVAILABLE: import("better-auth").RawError<"WALLET_VERIFICATION_FACTOR_UNAVAILABLE">;
+            WALLET_VERIFICATION_INVALID_CODE: import("better-auth").RawError<"WALLET_VERIFICATION_INVALID_CODE">;
+            WALLET_VERIFICATION_NOT_CONFIGURED: import("better-auth").RawError<"WALLET_VERIFICATION_NOT_CONFIGURED">;
+            WALLET_VERIFICATION_UNAVAILABLE: import("better-auth").RawError<"WALLET_VERIFICATION_UNAVAILABLE">;
+        };
+        endpoints: {};
+    };
+    $ERROR_CODES: {
+        WALLET_CREDENTIAL_LOCKED: import("better-auth").RawError<"WALLET_CREDENTIAL_LOCKED">;
+        WALLET_SECRET_CODES_AUTHENTICATOR_PROOF_REQUIRED: import("better-auth").RawError<"WALLET_SECRET_CODES_AUTHENTICATOR_PROOF_REQUIRED">;
+        WALLET_SECRET_CODES_PIN_PROOF_REQUIRED: import("better-auth").RawError<"WALLET_SECRET_CODES_PIN_PROOF_REQUIRED">;
+        WALLET_SECRET_CODES_VERIFICATION_MISMATCH: import("better-auth").RawError<"WALLET_SECRET_CODES_VERIFICATION_MISMATCH">;
+        WALLET_VERIFICATION_FACTOR_UNAVAILABLE: import("better-auth").RawError<"WALLET_VERIFICATION_FACTOR_UNAVAILABLE">;
+        WALLET_VERIFICATION_INVALID_CODE: import("better-auth").RawError<"WALLET_VERIFICATION_INVALID_CODE">;
+        WALLET_VERIFICATION_NOT_CONFIGURED: import("better-auth").RawError<"WALLET_VERIFICATION_NOT_CONFIGURED">;
+        WALLET_VERIFICATION_UNAVAILABLE: import("better-auth").RawError<"WALLET_VERIFICATION_UNAVAILABLE">;
+    };
+    pathMethods: {
+        "/wallet/secret-codes/generate": "POST";
+        "/wallet/secret-codes/confirm": "POST";
+    };
+    atomListeners: {
+        matcher: (path: string) => boolean;
+        signal: "$sessionSignal";
+    }[];
+};
+export type StripLeadingSlash<T extends string> = T extends `/${infer Rest}` ? Rest : never;
+export type WalletPluginPathMethodKeys = keyof ReturnType<typeof walletPincodeClient>["pathMethods"] | keyof ReturnType<typeof walletTwoFactorClient>["pathMethods"] | keyof ReturnType<typeof walletSecretCodesClient>["pathMethods"];
+export type WalletAuthEndpointPath = StripLeadingSlash<WalletPluginPathMethodKeys>;

package/dist/auth-surface.d.ts

@@ -0,0 +1,2 @@
+export type DalpAuthSurface = "console" | "portal";
+export declare const DALP_AUTH_SURFACE_HEADER = "X-Dalp-Auth-Surface";

package/dist/auth.d.ts

@@ -1,115 +1,8 @@
-import { DalpCookieStore } from "./cookie-store.js";
-export interface DalpAuthClientConfig {
-    /** Base URL of the DALP API (e.g., `"https://dalp.example.com"`). */
-    url: string;
-    /** API key used for Better Auth API-key-authenticated operations. */
-    apiKey?: string;
-    /** Better Auth session token sent as an Authorization bearer token. */
-    sessionToken?: string;
-    /** Cookie header value for explicit Node/browser-session handoff. */
-    cookie?: string;
-    /** Cookie store for Node-side session persistence across Better Auth calls. */
-    cookieStore?: DalpCookieStore;
-    /**
-     * Organization ID for multi-tenant setups.
-     * Sent as `x-organization-id` when provided.
-     */
-    organizationId?: string;
-    /**
-     * Additional headers merged into every Better Auth request.
-     * Can override defaults like `User-Agent` but cannot override configured security headers.
-     */
-    headers?: Record<string, string>;
-    /**
-     * Custom `fetch` implementation.
-     * Use this to inject logging, proxy configuration, or test doubles.
-     */
-    fetch?: typeof globalThis.fetch;
-}
-export interface DalpAuthError {
-    code?: string;
-    message?: string;
-    status?: number;
-    statusText?: string;
-    [key: string]: unknown;
-}
-export interface DalpAuthResult<TData = unknown, TError = DalpAuthError> {
-    data: TData | null;
-    error: TError | null;
-}
-export type DalpAuthOperation<TInput = Record<string, unknown>, TData = unknown> = (input?: TInput, options?: unknown) => Promise<DalpAuthResult<TData>>;
-export interface DalpAuthClient {
-    signIn: Record<string, DalpAuthOperation> & {
-        email: DalpAuthOperation;
-    };
-    signUp: Record<string, DalpAuthOperation> & {
-        email: DalpAuthOperation;
-    };
-    getSession: DalpAuthOperation;
-    listSessions: DalpAuthOperation;
-    revokeSession: DalpAuthOperation;
-    revokeOtherSessions: DalpAuthOperation;
-    apiKey: Record<string, DalpAuthOperation> & {
-        create: DalpAuthOperation;
-        list: DalpAuthOperation;
-        delete: DalpAuthOperation;
-    };
-    organization: Record<string, DalpAuthOperation> & {
-        create: DalpAuthOperation;
-        list: DalpAuthOperation;
-        setActive: DalpAuthOperation;
-        inviteMember: DalpAuthOperation;
-        acceptInvitation: DalpAuthOperation;
-        listMembers: DalpAuthOperation;
-        addMember: DalpAuthOperation;
-        removeMember: DalpAuthOperation;
-    };
-    admin: Record<string, DalpAuthOperation> & {
-        listUsers: DalpAuthOperation;
-        createUser: DalpAuthOperation;
-        removeUser: DalpAuthOperation;
-        setRole: DalpAuthOperation;
-    };
-    device: Record<string, DalpAuthOperation> & {
-        code: DalpAuthOperation;
-        token: DalpAuthOperation;
-        approve: DalpAuthOperation;
-        deny: DalpAuthOperation;
-    };
-    passkey: Record<string, DalpAuthOperation>;
-    twoFactor: Record<string, DalpAuthOperation> & {
-        enable: DalpAuthOperation;
-        disable: DalpAuthOperation;
-        verifyTotp: DalpAuthOperation;
-        verifyBackupCode: DalpAuthOperation;
-        generateBackupCodes: DalpAuthOperation;
-    };
-    wallet: {
-        pincode: {
-            enable: DalpAuthOperation;
-            disable: DalpAuthOperation;
-            update: DalpAuthOperation;
-            reset: DalpAuthOperation;
-        };
-        twoFactor: {
-            enable: DalpAuthOperation;
-            disable: DalpAuthOperation;
-            verify: DalpAuthOperation;
-        };
-        secretCodes: {
-            generate: DalpAuthOperation;
-            confirm: DalpAuthOperation;
-        };
-        passkey: {
-            register: DalpAuthOperation;
-            complete: DalpAuthOperation;
-            disable: DalpAuthOperation;
-            challenge: DalpAuthOperation;
-            verify: DalpAuthOperation;
-        };
-    };
-    $fetch: (path: string, options?: Record<string, unknown>) => Promise<unknown>;
-    $ERROR_CODES: Record<string, unknown>;
-}
-export declare function createDalpAuthClient(config: DalpAuthClientConfig): DalpAuthClient;
-//# sourceMappingURL=auth.d.ts.map
+export { createDalpAuthClient, makeDalpAuthClient } from "./auth/live.ts";
+export type { DalpAuthClient } from "./auth/live.ts";
+export { decodeDalpAuthClientConfig } from "./auth/client.ts";
+export type { DalpAuthSurface } from "./auth-surface.ts";
+export type { DalpAuthClientConfig, DalpCliAuthClient, DalpAuthError, DalpAuthOperation, DalpAuthResult, DalpOrganizationInvitation, DalpOrganizationInvitationsQuery, DalpOrganizationMember, DalpOrganizationMembersQuery, DecodedDalpAuthClientConfig, } from "./auth/client.ts";
+export type { DalpPasskeyCeremony } from "./auth/native-passkey.ts";
+export type { DalpRuntime } from "./runtime.ts";
+export type { WalletAuthEndpointPath } from "./auth/wallet-plugins.ts";