@wow-two-beta/fe-identity 0.0.0-stage → 0.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sultonbek Rakhimov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,44 @@
-# Temporary Holding Version
+# @wow-two-beta/fe-identity
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The Identity domain's UI: one component per sign-in method and password step, the same ones the service's hosted
+pages render. Each calls the consumer's own backend (Form 1, the default same-origin client) or the running Identity
+service (Forms 2 and 3, `baseUrl`), and signs in by cookie session.
+
+```bash
+pnpm add @wow-two-beta/fe-identity @wow-two-beta/fe vue
+```
+
+```vue
+<script setup lang="ts">
+import { PasswordSignIn, PhoneCodeSignIn } from '@wow-two-beta/fe-identity/kit';
+</script>
+
+<template>
+  <PasswordSignIn base-url="https://id.example.com" @signed-in="onSignedIn" />
+  <PhoneCodeSignIn base-url="https://id.example.com" :countries="['UZ']" @signed-in="onSignedIn" />
+</template>
+```
+
+The components are styled with Tailwind utilities on the fe sdk theme; add the package to the consumer's Tailwind
+sources. Messages resolve through the fe sdk `LocaleProvider` under `IdentityKit.*`, with English fallbacks.
+
+```css
+@source '../../node_modules/@wow-two-beta/fe-identity/dist';
+```
+
+| Export | Holds |
+|---|---|
+| `./contracts` | the account API's request and answer shapes, the sign-in declaration (`SignInOptionsDto`, `SignInMethodIdConstants`), `AccountRouteConstants`, `HostedPageRouteConstants`, `PasswordChangeConfirmationType` |
+| `./kit` | `createAccountClient` (with `getSignInOptions`); `PasswordSignIn`, `PhoneCodeSignIn`, `SignUpForm`, `ForgotPasswordForm`, `ResetPasswordForm`, `ChangePasswordForm` |
+
+- `getSignInOptions({ clientId, locale })` reads `GET /api/account/sign-in-options`: the hosted pages' look, whether
+  sign-up is open, and each enabled method in layout order with its fields and fe sdk rules, the messages in the
+  request's locale; an unknown `clientId` answers the instance's own look.
+- a cross-origin `baseUrl` sends the session cookie (`credentials: 'include'`); the service's CORS policy must allow
+  the consumer's origin.
+- `PhoneCodeSignIn` shows an "Open Telegram" step when the phone has no linked chat; the bot sends the code once the
+  person shares the contact.
+- `ChangePasswordForm` follows the instance's confirmation: the form at once (`None`), the form with a sent code
+  (`Code`), or a sent link (`Link`) whose page passes the link's `token`. A sign-in whose password breaks the current
+  rules emits `passwordChangeRequired` with a `ticket` and sets no session: pass `ticket` and `confirmation` to the
+  form, then sign in again with the new password.

package/dist/chunks/PasswordChangeConfirmationType-xUIFj0b9.js

@@ -0,0 +1,51 @@
+const AccountRouteConstants = {
+  /** The account API's mount point. */
+  base: "/api/account",
+  /** `POST`: creates an account while sign-up is on. */
+  register: "/register",
+  /** `POST`: signs in with a login and password. */
+  login: "/login",
+  /** `GET`: confirms an email with the emailed `userId` and `token`. */
+  confirmEmail: "/confirm-email",
+  /** `POST`: sends the confirmation email again; always `204`. */
+  resendConfirmationEmail: "/resend-confirmation-email",
+  /** `POST`: sends a password reset email; always `204`. */
+  forgotPassword: "/forgot-password",
+  /** `POST`: sets a new password with the emailed reset token. */
+  resetPassword: "/reset-password",
+  /** `GET`: the signed-in account. */
+  manageInfo: "/manage/info",
+  /** `POST`: starts a password change, signed in or with a ticket, and answers how it is confirmed. */
+  managePasswordConfirmation: "/manage/password/confirmation",
+  /** `POST`: changes the password of the signed-in person or of the one a ticket names. */
+  managePassword: "/manage/password",
+  /** `POST`: changes a password with the one-time token a change link carries; anonymous. */
+  passwordChange: "/password/change",
+  /** `POST`: sends a phone sign-in code. */
+  phoneSignInSend: "/phone-sign-in/send",
+  /** `POST`: signs in with a phone and the code sent to it. */
+  phoneSignIn: "/phone-sign-in",
+  /** `POST`: ends the cookie's session. */
+  logout: "/logout",
+  /** `GET`, anonymous: the sign-in declaration, the look and the enabled methods with their rules; `?clientId=`, `?locale=`. */
+  signInOptions: "/sign-in-options",
+  /** The query parameter that asks a sign-in route for a cookie instead of a bearer session. */
+  useCookiesParameter: "useCookies",
+  /** The query parameter that names the OIDC client a sign-in serves, for the sign-in log and the app's look. */
+  clientIdParameter: "clientId",
+  /** The query parameter that picks the locale of the declaration's messages: `uz`, `ru` or `en`. */
+  localeParameter: "locale"
+};
+const PasswordChangeConfirmationType = {
+  /** The current password is the only proof; the change form opens at once. */
+  None: "None",
+  /** A one-time code, sent to a verified channel, is entered beside the new password. */
+  Code: "Code",
+  /** A one-time link, sent to a verified channel, is the only way to the change form. */
+  Link: "Link"
+};
+export {
+  AccountRouteConstants as A,
+  PasswordChangeConfirmationType as P
+};
+//# sourceMappingURL=PasswordChangeConfirmationType-xUIFj0b9.js.map

package/dist/chunks/PasswordChangeConfirmationType-xUIFj0b9.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordChangeConfirmationType-xUIFj0b9.js","sources":["../../src/contracts/AccountRouteConstants.ts","../../src/contracts/PasswordChangeConfirmationType.ts"],"sourcesContent":["/** Mirrors the account API's routes: relative to the service or consumer origin, under the contract's HTTP mirror. */\nexport const AccountRouteConstants = {\n  /** The account API's mount point. */\n  base: '/api/account',\n  /** `POST`: creates an account while sign-up is on. */\n  register: '/register',\n  /** `POST`: signs in with a login and password. */\n  login: '/login',\n  /** `GET`: confirms an email with the emailed `userId` and `token`. */\n  confirmEmail: '/confirm-email',\n  /** `POST`: sends the confirmation email again; always `204`. */\n  resendConfirmationEmail: '/resend-confirmation-email',\n  /** `POST`: sends a password reset email; always `204`. */\n  forgotPassword: '/forgot-password',\n  /** `POST`: sets a new password with the emailed reset token. */\n  resetPassword: '/reset-password',\n  /** `GET`: the signed-in account. */\n  manageInfo: '/manage/info',\n  /** `POST`: starts a password change, signed in or with a ticket, and answers how it is confirmed. */\n  managePasswordConfirmation: '/manage/password/confirmation',\n  /** `POST`: changes the password of the signed-in person or of the one a ticket names. */\n  managePassword: '/manage/password',\n  /** `POST`: changes a password with the one-time token a change link carries; anonymous. */\n  passwordChange: '/password/change',\n  /** `POST`: sends a phone sign-in code. */\n  phoneSignInSend: '/phone-sign-in/send',\n  /** `POST`: signs in with a phone and the code sent to it. */\n  phoneSignIn: '/phone-sign-in',\n  /** `POST`: ends the cookie's session. */\n  logout: '/logout',\n  /** `GET`, anonymous: the sign-in declaration, the look and the enabled methods with their rules; `?clientId=`, `?locale=`. */\n  signInOptions: '/sign-in-options',\n  /** The query parameter that asks a sign-in route for a cookie instead of a bearer session. */\n  useCookiesParameter: 'useCookies',\n  /** The query parameter that names the OIDC client a sign-in serves, for the sign-in log and the app's look. */\n  clientIdParameter: 'clientId',\n  /** The query parameter that picks the locale of the declaration's messages: `uz`, `ru` or `en`. */\n  localeParameter: 'locale',\n} as const;\n","/** Mirrors `PasswordChangeConfirmationType` of the be contract: how a password change is confirmed. */\nexport const PasswordChangeConfirmationType = {\n  /** The current password is the only proof; the change form opens at once. */\n  None: 'None',\n  /** A one-time code, sent to a verified channel, is entered beside the new password. */\n  Code: 'Code',\n  /** A one-time link, sent to a verified channel, is the only way to the change form. */\n  Link: 'Link',\n} as const;\nexport type PasswordChangeConfirmationType =\n  (typeof PasswordChangeConfirmationType)[keyof typeof PasswordChangeConfirmationType];\n"],"names":[],"mappings":"AACO,MAAM,wBAAwB;AAAA;AAAA,EAEnC,MAAM;AAAA;AAAA,EAEN,UAAU;AAAA;AAAA,EAEV,OAAO;AAAA;AAAA,EAEP,cAAc;AAAA;AAAA,EAEd,yBAAyB;AAAA;AAAA,EAEzB,gBAAgB;AAAA;AAAA,EAEhB,eAAe;AAAA;AAAA,EAEf,YAAY;AAAA;AAAA,EAEZ,4BAA4B;AAAA;AAAA,EAE5B,gBAAgB;AAAA;AAAA,EAEhB,gBAAgB;AAAA;AAAA,EAEhB,iBAAiB;AAAA;AAAA,EAEjB,aAAa;AAAA;AAAA,EAEb,QAAQ;AAAA;AAAA,EAER,eAAe;AAAA;AAAA,EAEf,qBAAqB;AAAA;AAAA,EAErB,mBAAmB;AAAA;AAAA,EAEnB,iBAAiB;AACnB;ACrCO,MAAM,iCAAiC;AAAA;AAAA,EAE5C,MAAM;AAAA;AAAA,EAEN,MAAM;AAAA;AAAA,EAEN,MAAM;AACR;"}

package/dist/contracts/AccountInfoDto.d.ts

@@ -0,0 +1,13 @@
+/** Mirrors `AccountInfoDto` of the be contract: the signed-in account. */
+export interface AccountInfoDto {
+    /** The user id. */
+    readonly userId: string;
+    /** The login name. */
+    readonly userName: string | null;
+    /** The email address. */
+    readonly email: string | null;
+    /** Whether the email is confirmed. */
+    readonly isEmailConfirmed: boolean;
+    /** Whether two-factor authentication is enabled. */
+    readonly isTwoFactorEnabled: boolean;
+}

package/dist/contracts/AccountRouteConstants.d.ts

@@ -0,0 +1,39 @@
+/** Mirrors the account API's routes: relative to the service or consumer origin, under the contract's HTTP mirror. */
+export declare const AccountRouteConstants: {
+    /** The account API's mount point. */
+    readonly base: "/api/account";
+    /** `POST`: creates an account while sign-up is on. */
+    readonly register: "/register";
+    /** `POST`: signs in with a login and password. */
+    readonly login: "/login";
+    /** `GET`: confirms an email with the emailed `userId` and `token`. */
+    readonly confirmEmail: "/confirm-email";
+    /** `POST`: sends the confirmation email again; always `204`. */
+    readonly resendConfirmationEmail: "/resend-confirmation-email";
+    /** `POST`: sends a password reset email; always `204`. */
+    readonly forgotPassword: "/forgot-password";
+    /** `POST`: sets a new password with the emailed reset token. */
+    readonly resetPassword: "/reset-password";
+    /** `GET`: the signed-in account. */
+    readonly manageInfo: "/manage/info";
+    /** `POST`: starts a password change, signed in or with a ticket, and answers how it is confirmed. */
+    readonly managePasswordConfirmation: "/manage/password/confirmation";
+    /** `POST`: changes the password of the signed-in person or of the one a ticket names. */
+    readonly managePassword: "/manage/password";
+    /** `POST`: changes a password with the one-time token a change link carries; anonymous. */
+    readonly passwordChange: "/password/change";
+    /** `POST`: sends a phone sign-in code. */
+    readonly phoneSignInSend: "/phone-sign-in/send";
+    /** `POST`: signs in with a phone and the code sent to it. */
+    readonly phoneSignIn: "/phone-sign-in";
+    /** `POST`: ends the cookie's session. */
+    readonly logout: "/logout";
+    /** `GET`, anonymous: the sign-in declaration, the look and the enabled methods with their rules; `?clientId=`, `?locale=`. */
+    readonly signInOptions: "/sign-in-options";
+    /** The query parameter that asks a sign-in route for a cookie instead of a bearer session. */
+    readonly useCookiesParameter: "useCookies";
+    /** The query parameter that names the OIDC client a sign-in serves, for the sign-in log and the app's look. */
+    readonly clientIdParameter: "clientId";
+    /** The query parameter that picks the locale of the declaration's messages: `uz`, `ru` or `en`. */
+    readonly localeParameter: "locale";
+};

package/dist/contracts/ConfirmEmailApiRequest.d.ts

@@ -0,0 +1,7 @@
+/** Mirrors the `confirm-email` route's query: the account and the token its confirmation link carries. */
+export interface ConfirmEmailApiRequest {
+    /** The account id. */
+    readonly userId: string;
+    /** The emailed confirmation token. */
+    readonly token: string;
+}

package/dist/contracts/EmailAddressApiRequest.d.ts

@@ -0,0 +1,5 @@
+/** Mirrors `EmailAddressApiRequest` of the be contract: names the account an email is sent to. */
+export interface EmailAddressApiRequest {
+    /** The account email. */
+    readonly email: string;
+}

package/dist/contracts/HostedPageRouteConstants.d.ts

@@ -0,0 +1,27 @@
+/** Holds the hosted pages the service serves and the parameters each one reads. */
+export declare const HostedPageRouteConstants: {
+    /** Signs a person in by every enabled method, then continues to `returnUrl`. */
+    readonly signIn: "/sign-in";
+    /** Creates an account while sign-up is on. */
+    readonly signUp: "/sign-up";
+    /** Confirms an email from the emailed link (`userId`, `token`). */
+    readonly confirmEmail: "/confirm-email";
+    /** Sends a password reset email. */
+    readonly forgotPassword: "/forgot-password";
+    /** Sets a new password from the emailed reset link (`email`, `token`). */
+    readonly resetPassword: "/reset-password";
+    /** Spends a password change link; the token travels in the URL fragment (`#token=`). */
+    readonly changePassword: "/change-password";
+    /** The signed-in person's security settings: the password change. */
+    readonly accountSecurity: "/account/security";
+    /** The query parameter that carries the local path a page continues to. */
+    readonly returnUrlParameter: "returnUrl";
+    /** The query parameter of an OIDC authorization request that names its client. */
+    readonly clientIdParameter: "client_id";
+    /** The query parameter that carries an account id. */
+    readonly userIdParameter: "userId";
+    /** The query parameter that carries an email address. */
+    readonly emailParameter: "email";
+    /** The query or fragment parameter that carries a one-time token. */
+    readonly tokenParameter: "token";
+};

package/dist/contracts/PasswordChangeApiRequest.d.ts

@@ -0,0 +1,11 @@
+/** Mirrors `PasswordChangeApiRequest` of the be contract: changes the password of a signed-in or ticketed person. */
+export interface PasswordChangeApiRequest {
+    /** The current password; not asked of a person holding the ticket, whose sign-in just verified it. */
+    readonly currentPassword?: string;
+    /** The replacement password. */
+    readonly newPassword: string;
+    /** The one-time code sent under the `Code` confirmation. */
+    readonly code?: string;
+    /** The ticket a sign-in answered with when the password breaks the current rules; omitted when signed in. */
+    readonly ticket?: string;
+}

package/dist/contracts/PasswordChangeConfirmationApiRequest.d.ts

@@ -0,0 +1,5 @@
+/** Mirrors `PasswordChangeConfirmationApiRequest` of the be contract: asks for a change's code or link. */
+export interface PasswordChangeConfirmationApiRequest {
+    /** The ticket a sign-in answered with when the password breaks the current rules; omitted when signed in. */
+    readonly ticket?: string;
+}

package/dist/contracts/PasswordChangeConfirmationDto.d.ts

@@ -0,0 +1,8 @@
+import type { PasswordChangeConfirmationType } from './PasswordChangeConfirmationType';
+/** Mirrors `PasswordChangeConfirmationDto` of the be contract: how a change is confirmed, and whether a code or link went out. */
+export interface PasswordChangeConfirmationDto {
+    /** How the change is confirmed. */
+    readonly confirmation: PasswordChangeConfirmationType;
+    /** Whether a code or link was sent; always `false` under `None`. */
+    readonly isSent: boolean;
+}

package/dist/contracts/PasswordChangeConfirmationType.d.ts

@@ -0,0 +1,10 @@
+/** Mirrors `PasswordChangeConfirmationType` of the be contract: how a password change is confirmed. */
+export declare const PasswordChangeConfirmationType: {
+    /** The current password is the only proof; the change form opens at once. */
+    readonly None: "None";
+    /** A one-time code, sent to a verified channel, is entered beside the new password. */
+    readonly Code: "Code";
+    /** A one-time link, sent to a verified channel, is the only way to the change form. */
+    readonly Link: "Link";
+};
+export type PasswordChangeConfirmationType = (typeof PasswordChangeConfirmationType)[keyof typeof PasswordChangeConfirmationType];

package/dist/contracts/PasswordChangeLinkApiRequest.d.ts

@@ -0,0 +1,7 @@
+/** Mirrors `PasswordChangeLinkApiRequest` of the be contract: a change link's one-time token and the new password. */
+export interface PasswordChangeLinkApiRequest {
+    /** The one-time token from the link's fragment. */
+    readonly token: string;
+    /** The replacement password. */
+    readonly newPassword: string;
+}

package/dist/contracts/PasswordChangeRequiredDto.d.ts

@@ -0,0 +1,13 @@
+import type { PasswordChangeConfirmationType } from './PasswordChangeConfirmationType';
+/**
+ * Mirrors `PasswordChangeRequiredDto` of the be contract: a sign-in whose password matched but breaks the current
+ * rules. It carries no session, only the ticket that opens the change routes.
+ */
+export interface PasswordChangeRequiredDto {
+    /** Always `true`; tells this answer from a signed-in one. */
+    readonly isPasswordChangeRequired: true;
+    /** How the change is confirmed. */
+    readonly confirmation: PasswordChangeConfirmationType;
+    /** The ticket the change routes take; a change spends it. */
+    readonly ticket: string;
+}

package/dist/contracts/PhoneSignInApiRequest.d.ts

@@ -0,0 +1,7 @@
+/** Mirrors `PhoneSignInApiRequest` of the be contract: the phone and the code sent to it. */
+export interface PhoneSignInApiRequest {
+    /** The phone in E.164 form. */
+    readonly phone: string;
+    /** The one-time code. */
+    readonly code: string;
+}

package/dist/contracts/PhoneSignInSendApiRequest.d.ts

@@ -0,0 +1,5 @@
+/** Mirrors `PhoneSignInSendApiRequest` of the be contract: the phone a code goes to. */
+export interface PhoneSignInSendApiRequest {
+    /** The phone in E.164 form. */
+    readonly phone: string;
+}

package/dist/contracts/PhoneSignInSentDto.d.ts

@@ -0,0 +1,7 @@
+/** Mirrors `PhoneSignInSentDto` of the be contract: what a phone sign-in send answers. */
+export interface PhoneSignInSentDto {
+    /** Whether a code went out. */
+    readonly isCodeSent: boolean;
+    /** The bot's start link when the phone has no linked chat yet: the code follows once the person shares the contact. */
+    readonly telegramLinkUrl: string | null;
+}

package/dist/contracts/RegisterAccountApiRequest.d.ts

@@ -0,0 +1,9 @@
+/** Mirrors `RegisterAccountApiRequest` of the be contract: registers an account with an email and password. */
+export interface RegisterAccountApiRequest {
+    /** The account email. */
+    readonly email: string;
+    /** The initial password. */
+    readonly password: string;
+    /** The login name; the email when omitted. */
+    readonly userName?: string;
+}

package/dist/contracts/RegisteredAccountDto.d.ts

@@ -0,0 +1,7 @@
+/** Mirrors `RegisteredAccountDto` of the be contract: the account a registration created. */
+export interface RegisteredAccountDto {
+    /** The new user id. */
+    readonly userId: string;
+    /** Whether a confirmation email was sent. */
+    readonly isConfirmationSent: boolean;
+}

package/dist/contracts/ResetPasswordApiRequest.d.ts

@@ -0,0 +1,9 @@
+/** Mirrors `ResetPasswordApiRequest` of the be contract: resets a forgotten password with the emailed token. */
+export interface ResetPasswordApiRequest {
+    /** The account email. */
+    readonly email: string;
+    /** The token from the reset email. */
+    readonly resetToken: string;
+    /** The replacement password. */
+    readonly newPassword: string;
+}

package/dist/contracts/SignInApiRequest.d.ts

@@ -0,0 +1,7 @@
+/** Mirrors `SignInApiRequest` of the be contract: signs in with a login and password. */
+export interface SignInApiRequest {
+    /** The user name or email. */
+    readonly login: string;
+    /** The password. */
+    readonly password: string;
+}

package/dist/contracts/SignInFieldDto.d.ts

@@ -0,0 +1,12 @@
+import type { SignInRuleDto } from './SignInRuleDto';
+/** Mirrors `SignInFieldDto` of the be contract: one field of a method's form, named as its request names it. */
+export interface SignInFieldDto {
+    /** The request property the field fills, such as `login`, `password`, `phone` or `code`. */
+    readonly name: string;
+    /** The input the field takes: `text`, `password`, `phone` or `pin`. */
+    readonly kind: string;
+    /** A phone field's allowed ISO country codes, every country when empty; `null` for other kinds. */
+    readonly countries: ReadonlyArray<string> | null;
+    /** The rules in the order a form checks them. */
+    readonly rules: ReadonlyArray<SignInRuleDto>;
+}

package/dist/contracts/SignInMethodDto.d.ts

@@ -0,0 +1,16 @@
+import type { SignInFieldDto } from './SignInFieldDto';
+import type { SignInRuleDto } from './SignInRuleDto';
+/** Mirrors `SignInMethodDto` of the be contract: one enabled sign-in method and the fields its form renders. */
+export interface SignInMethodDto {
+    /** The method, a `SignInMethodIdConstants` value; a client skips ids it does not know. */
+    readonly id: string;
+    /** The channels a code goes out over, such as `telegram`; empty for a method without codes. */
+    readonly channels: ReadonlyArray<string>;
+    /** The sign-in form's fields, in order. */
+    readonly fields: ReadonlyArray<SignInFieldDto>;
+    /**
+     * The rules a new password meets on sign-up, reset and change; the password method only, `null` for any other. The
+     * sign-in form's own password field only requires a value.
+     */
+    readonly passwordRules: ReadonlyArray<SignInRuleDto> | null;
+}

package/dist/contracts/SignInMethodIdConstants.d.ts

@@ -0,0 +1,7 @@
+/** Mirrors `SignInMethodIdConstants` of the be contract: the method ids the declaration lists, one kit component each. */
+export declare const SignInMethodIdConstants: {
+    /** A login and password (`PasswordSignIn`). */
+    readonly password: "password";
+    /** A code sent to a phone's linked channel, the instance's Telegram bot (`PhoneCodeSignIn`). */
+    readonly phoneCode: "phone-code";
+};

package/dist/contracts/SignInOptionsDto.d.ts

@@ -0,0 +1,24 @@
+import type { SignInMethodDto } from './SignInMethodDto';
+import type { SignInRequirementsDto } from './SignInRequirementsDto';
+/**
+ * Mirrors `SignInOptionsDto` of the be contract, the sign-in declaration `GET sign-in-options` answers: the hosted pages'
+ * look, whether anyone may sign up, and each enabled method in layout order with its fields and rules.
+ */
+export interface SignInOptionsDto {
+    /** The name the pages show, the instance owner's brand. */
+    readonly brandName: string;
+    /** The fe sdk theme by its registry id: the app's own, else the instance's. */
+    readonly theme: string;
+    /** The image behind the card, a same-origin path or an HTTPS URL; `null` for the theme's own backdrop. */
+    readonly backgroundUrl: string | null;
+    /** Whether anyone may create an account. */
+    readonly isSignUpEnabled: boolean;
+    /** The locale the rule messages are in: `uz`, `ru` or `en`. */
+    readonly locale: string;
+    /** The locales the pages offer, in display order. */
+    readonly locales: ReadonlyArray<string>;
+    /** The enabled methods, in the order the pages lay them out. */
+    readonly methods: ReadonlyArray<SignInMethodDto>;
+    /** The verifications a sign-in needs. */
+    readonly requirements: SignInRequirementsDto;
+}

package/dist/contracts/SignInRequirementsDto.d.ts

@@ -0,0 +1,9 @@
+/** Mirrors `SignInRequirementsDto` of the be contract: the verifications a sign-in needs before any token. */
+export interface SignInRequirementsDto {
+    /** Whether the email must be confirmed. */
+    readonly isConfirmedEmailRequired: boolean;
+    /** Whether the phone number must be confirmed. */
+    readonly isConfirmedPhoneNumberRequired: boolean;
+    /** Whether everyone needs a second factor. */
+    readonly isSecondFactorRequired: boolean;
+}

package/dist/contracts/SignInRuleDto.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Mirrors `SignInRuleDto` of the be contract: one rule a declared field meets, a fe sdk `ValidationCodes` code with its
+ * operands and its message in the request's locale; the server's answer for the same rule says the same.
+ */
+export interface SignInRuleDto {
+    /** The rule code, such as `required`, `min`, `length`, `pattern`, `notEqual` or `custom`. */
+    readonly code: string;
+    /** The rule's operands under the vocabulary's names, such as `{ min: 15, unit: 'characters' }`; `null` when none. */
+    readonly params: Readonly<Record<string, unknown>> | null;
+    /** The text a person reads when the value breaks the rule. */
+    readonly message: string;
+}

package/dist/contracts/index.d.ts

@@ -0,0 +1,24 @@
+export type { AccountInfoDto } from './AccountInfoDto';
+export { AccountRouteConstants } from './AccountRouteConstants';
+export type { ConfirmEmailApiRequest } from './ConfirmEmailApiRequest';
+export type { EmailAddressApiRequest } from './EmailAddressApiRequest';
+export { HostedPageRouteConstants } from './HostedPageRouteConstants';
+export type { PasswordChangeApiRequest } from './PasswordChangeApiRequest';
+export type { PasswordChangeConfirmationApiRequest } from './PasswordChangeConfirmationApiRequest';
+export type { PasswordChangeConfirmationDto } from './PasswordChangeConfirmationDto';
+export { PasswordChangeConfirmationType } from './PasswordChangeConfirmationType';
+export type { PasswordChangeLinkApiRequest } from './PasswordChangeLinkApiRequest';
+export type { PasswordChangeRequiredDto } from './PasswordChangeRequiredDto';
+export type { PhoneSignInApiRequest } from './PhoneSignInApiRequest';
+export type { PhoneSignInSendApiRequest } from './PhoneSignInSendApiRequest';
+export type { PhoneSignInSentDto } from './PhoneSignInSentDto';
+export type { RegisterAccountApiRequest } from './RegisterAccountApiRequest';
+export type { RegisteredAccountDto } from './RegisteredAccountDto';
+export type { ResetPasswordApiRequest } from './ResetPasswordApiRequest';
+export type { SignInApiRequest } from './SignInApiRequest';
+export type { SignInFieldDto } from './SignInFieldDto';
+export type { SignInMethodDto } from './SignInMethodDto';
+export { SignInMethodIdConstants } from './SignInMethodIdConstants';
+export type { SignInOptionsDto } from './SignInOptionsDto';
+export type { SignInRequirementsDto } from './SignInRequirementsDto';
+export type { SignInRuleDto } from './SignInRuleDto';

package/dist/contracts/index.js

@@ -0,0 +1,40 @@
+import { A, P } from "../chunks/PasswordChangeConfirmationType-xUIFj0b9.js";
+const HostedPageRouteConstants = {
+  /** Signs a person in by every enabled method, then continues to `returnUrl`. */
+  signIn: "/sign-in",
+  /** Creates an account while sign-up is on. */
+  signUp: "/sign-up",
+  /** Confirms an email from the emailed link (`userId`, `token`). */
+  confirmEmail: "/confirm-email",
+  /** Sends a password reset email. */
+  forgotPassword: "/forgot-password",
+  /** Sets a new password from the emailed reset link (`email`, `token`). */
+  resetPassword: "/reset-password",
+  /** Spends a password change link; the token travels in the URL fragment (`#token=`). */
+  changePassword: "/change-password",
+  /** The signed-in person's security settings: the password change. */
+  accountSecurity: "/account/security",
+  /** The query parameter that carries the local path a page continues to. */
+  returnUrlParameter: "returnUrl",
+  /** The query parameter of an OIDC authorization request that names its client. */
+  clientIdParameter: "client_id",
+  /** The query parameter that carries an account id. */
+  userIdParameter: "userId",
+  /** The query parameter that carries an email address. */
+  emailParameter: "email",
+  /** The query or fragment parameter that carries a one-time token. */
+  tokenParameter: "token"
+};
+const SignInMethodIdConstants = {
+  /** A login and password (`PasswordSignIn`). */
+  password: "password",
+  /** A code sent to a phone's linked channel, the instance's Telegram bot (`PhoneCodeSignIn`). */
+  phoneCode: "phone-code"
+};
+export {
+  A as AccountRouteConstants,
+  HostedPageRouteConstants,
+  P as PasswordChangeConfirmationType,
+  SignInMethodIdConstants
+};
+//# sourceMappingURL=index.js.map

package/dist/contracts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../src/contracts/HostedPageRouteConstants.ts","../../src/contracts/SignInMethodIdConstants.ts"],"sourcesContent":["/** Holds the hosted pages the service serves and the parameters each one reads. */\nexport const HostedPageRouteConstants = {\n  /** Signs a person in by every enabled method, then continues to `returnUrl`. */\n  signIn: '/sign-in',\n  /** Creates an account while sign-up is on. */\n  signUp: '/sign-up',\n  /** Confirms an email from the emailed link (`userId`, `token`). */\n  confirmEmail: '/confirm-email',\n  /** Sends a password reset email. */\n  forgotPassword: '/forgot-password',\n  /** Sets a new password from the emailed reset link (`email`, `token`). */\n  resetPassword: '/reset-password',\n  /** Spends a password change link; the token travels in the URL fragment (`#token=`). */\n  changePassword: '/change-password',\n  /** The signed-in person's security settings: the password change. */\n  accountSecurity: '/account/security',\n  /** The query parameter that carries the local path a page continues to. */\n  returnUrlParameter: 'returnUrl',\n  /** The query parameter of an OIDC authorization request that names its client. */\n  clientIdParameter: 'client_id',\n  /** The query parameter that carries an account id. */\n  userIdParameter: 'userId',\n  /** The query parameter that carries an email address. */\n  emailParameter: 'email',\n  /** The query or fragment parameter that carries a one-time token. */\n  tokenParameter: 'token',\n} as const;\n","/** Mirrors `SignInMethodIdConstants` of the be contract: the method ids the declaration lists, one kit component each. */\nexport const SignInMethodIdConstants = {\n  /** A login and password (`PasswordSignIn`). */\n  password: 'password',\n  /** A code sent to a phone's linked channel, the instance's Telegram bot (`PhoneCodeSignIn`). */\n  phoneCode: 'phone-code',\n} as const;\n"],"names":[],"mappings":";AACO,MAAM,2BAA2B;AAAA;AAAA,EAEtC,QAAQ;AAAA;AAAA,EAER,QAAQ;AAAA;AAAA,EAER,cAAc;AAAA;AAAA,EAEd,gBAAgB;AAAA;AAAA,EAEhB,eAAe;AAAA;AAAA,EAEf,gBAAgB;AAAA;AAAA,EAEhB,iBAAiB;AAAA;AAAA,EAEjB,oBAAoB;AAAA;AAAA,EAEpB,mBAAmB;AAAA;AAAA,EAEnB,iBAAiB;AAAA;AAAA,EAEjB,gBAAgB;AAAA;AAAA,EAEhB,gBAAgB;AAClB;ACzBO,MAAM,0BAA0B;AAAA;AAAA,EAErC,UAAU;AAAA;AAAA,EAEV,WAAW;AACb;"}

package/dist/kit/account/CreateAccountClient.d.ts

@@ -0,0 +1,73 @@
+import { type ApiFailure } from '@wow-two-beta/fe/foundation/http';
+import { type Result } from '@wow-two-beta/fe/foundation/results';
+import { type AccountInfoDto, type ConfirmEmailApiRequest, type EmailAddressApiRequest, type PasswordChangeApiRequest, type PasswordChangeConfirmationApiRequest, type PasswordChangeConfirmationDto, type PasswordChangeLinkApiRequest, type PasswordChangeRequiredDto, type PhoneSignInApiRequest, type PhoneSignInSendApiRequest, type PhoneSignInSentDto, type RegisterAccountApiRequest, type RegisteredAccountDto, type ResetPasswordApiRequest, type SignInApiRequest, type SignInOptionsDto } from '../../contracts';
+/** Configures where the account API is reached. */
+export interface AccountClientOptions {
+    /** The origin serving the API: empty for the consumer's own backend (Form 1), the service's URL otherwise. */
+    readonly baseUrl?: string;
+    /**
+     * Whether the browser sends the session cookie. Default `same-origin`, or `include` when `baseUrl` is set, which
+     * the service's CORS policy must allow.
+     */
+    readonly credentials?: RequestCredentials;
+    /** Replaces the global fetch, for tests. */
+    readonly fetch?: typeof globalThis.fetch;
+}
+/** Describes a sign-in call beyond its body. */
+export interface AccountSignInOptions {
+    /** The OIDC client the sign-in serves, recorded by the sign-in log. */
+    readonly clientId?: string | null;
+    /** Cancels the request. */
+    readonly signal?: AbortSignal;
+}
+/** Describes a sign-in declaration request. */
+export interface SignInOptionsQuery {
+    /** The OIDC client the sign-in serves: its own theme and background replace the instance's. */
+    readonly clientId?: string | null;
+    /** The locale of the rule messages (`uz`, `ru`, `en`); the browser's `Accept-Language` when omitted. */
+    readonly locale?: string | null;
+    /** Cancels the request. */
+    readonly signal?: AbortSignal;
+}
+/** Calls the account API over HTTP, signing in with cookie sessions. */
+export interface AccountClient {
+    /**
+     * Reads the sign-in declaration: the hosted pages' look, whether sign-up is open, and each enabled method in layout
+     * order with its fields and rules. An unknown `clientId` answers the instance's own look.
+     */
+    getSignInOptions(query?: SignInOptionsQuery): Promise<Result<SignInOptionsDto, ApiFailure>>;
+    /** Creates an account while sign-up is on; `403` while it is closed. */
+    register(request: RegisterAccountApiRequest, signal?: AbortSignal): Promise<Result<RegisteredAccountDto, ApiFailure>>;
+    /**
+     * Signs in with a login and password: `null` once the session cookie is set, or the ticket of a required password
+     * change, which sets no session.
+     */
+    signIn(request: SignInApiRequest, options?: AccountSignInOptions): Promise<Result<PasswordChangeRequiredDto | null, ApiFailure>>;
+    /** Confirms an email with the emailed token. */
+    confirmEmail(request: ConfirmEmailApiRequest, signal?: AbortSignal): Promise<Result<void, ApiFailure>>;
+    /** Sends the confirmation email again; succeeds whether or not the account exists. */
+    resendConfirmationEmail(request: EmailAddressApiRequest, signal?: AbortSignal): Promise<Result<void, ApiFailure>>;
+    /** Sends a password reset email; succeeds whether or not the account exists. */
+    forgotPassword(request: EmailAddressApiRequest, signal?: AbortSignal): Promise<Result<void, ApiFailure>>;
+    /** Sets a new password with the emailed reset token. */
+    resetPassword(request: ResetPasswordApiRequest, signal?: AbortSignal): Promise<Result<void, ApiFailure>>;
+    /** Reads the signed-in account; `401` when nobody is signed in. */
+    getAccountInfo(signal?: AbortSignal): Promise<Result<AccountInfoDto, ApiFailure>>;
+    /**
+     * Starts a password change, signed in or with a required change's ticket: answers how it is confirmed, and sends the
+     * code or link the setting asks for.
+     */
+    startPasswordChange(request?: PasswordChangeConfirmationApiRequest, signal?: AbortSignal): Promise<Result<PasswordChangeConfirmationDto, ApiFailure>>;
+    /** Changes the password of the signed-in person, or of the one a required change's ticket names. */
+    changePassword(request: PasswordChangeApiRequest, signal?: AbortSignal): Promise<Result<void, ApiFailure>>;
+    /** Changes a password with the one-time token a change link carries. */
+    changePasswordWithLink(request: PasswordChangeLinkApiRequest, signal?: AbortSignal): Promise<Result<void, ApiFailure>>;
+    /** Sends a phone sign-in code, or answers the Telegram link that sends one once the contact is shared. */
+    sendPhoneSignInCode(request: PhoneSignInSendApiRequest, signal?: AbortSignal): Promise<Result<PhoneSignInSentDto, ApiFailure>>;
+    /** Signs in with a phone and its code and sets the session cookie. */
+    signInWithPhone(request: PhoneSignInApiRequest, options?: AccountSignInOptions): Promise<Result<void, ApiFailure>>;
+    /** Ends the cookie's session. */
+    signOut(signal?: AbortSignal): Promise<Result<void, ApiFailure>>;
+}
+/** Creates a client for the account API at `baseUrl` (same origin by default). */
+export declare function createAccountClient(options?: AccountClientOptions): AccountClient;

package/dist/kit/account/hooks/UseAccountClient.d.ts

@@ -0,0 +1,10 @@
+import { type AccountClient } from '../CreateAccountClient';
+/** Names where a kit component reaches the account API. */
+export interface AccountClientSource {
+    /** The client to call; built from `baseUrl` when omitted. */
+    readonly client?: AccountClient;
+    /** The service's origin; the consumer's own origin (Form 1) when omitted. */
+    readonly baseUrl?: string;
+}
+/** Returns the component's account client, read once at setup: the given one, or one for `baseUrl`. */
+export declare function useAccountClient(source: AccountClientSource): AccountClient;

package/dist/kit/account/hooks/UseAccountForm.d.ts

@@ -0,0 +1,2 @@
+/** Pins the fe sdk house form engine for the kit's scalar forms; components import the engine from here only. */
+export { useAppForm as useAccountForm } from '@wow-two-beta/fe/forms-engine/house';