cauthy-auth 0.10.0 → 0.12.0

package/README.md

@@ -101,10 +101,11 @@ import 'cauthy-auth/styles.css'
 
 Or draw them with your own `components` and `classNames`, and pass `unstyled`. The dashboard can start the look from your stylesheet (shadcn/ui and Tailwind, Stackmyth, or variables of your own); `npx cauthy-auth theme --css src/app/globals.css` reads it the same way from a terminal.
 
-Connect your application to Cauthy in one step, from Cauthy's dashboard ("Connect a System") or from a terminal. It makes the client, registers `https://<your app>/api/auth/callback`, and prints every variable to set, `CAUTHY_SECRET` included:
+Connect your application to Cauthy in one step, from Cauthy's dashboard ("Connect a System") or from a terminal. In the application's folder, `init` reads its framework (Next.js, TanStack Start, SvelteKit, Express, Hono, Fastify), makes the client, writes every variable to its env file, `CAUTHY_SECRET` included, and lays down the route and a sign-in page, never over a file that is there:
 
 ```bash
-npx cauthy-auth init --system ledger --app-url https://app.example.com
+npx cauthy-auth init
+npx cauthy-auth init --system ledger --app-url https://app.example.com   # production
 ```
 
 The same client is your application's own identity: it manages its organizations with no person's token.

package/dist/cli.js

@@ -3,6 +3,7 @@
 
 // src/cli.ts
 var import_node_fs = require("fs");
+var import_node_path2 = require("path");
 
 // src/connect.ts
 function sessionSecret() {
@@ -51,6 +52,206 @@ function envFile(env2) {
   return Object.entries(env2).map(([k, v]) => `${k}=${v}`).join("\n") + "\n";
 }
 
+// src/scaffold.ts
+var import_node_path = require("path");
+var FRAMEWORK_NAMES = {
+  next: "Next.js",
+  "tanstack-start": "TanStack Start",
+  sveltekit: "SvelteKit",
+  express: "Express",
+  hono: "Hono",
+  fastify: "Fastify"
+};
+function detect(pkg, has) {
+  const deps = { ...pkg.devDependencies, ...pkg.dependencies };
+  const framework = deps.next ? "next" : deps["@tanstack/react-start"] ? "tanstack-start" : deps["@sveltejs/kit"] ? "sveltekit" : deps.hono ? "hono" : deps.fastify ? "fastify" : deps.express ? "express" : null;
+  const port = framework === "sveltekit" ? 5173 : 3e3;
+  let root = has("src") ? "src" : "";
+  let nextPagesOnly = false;
+  if (framework === "next") {
+    root = has("src/app") ? "src" : has("app") ? "" : has("src/pages") ? "src" : "";
+    nextPagesOnly = !has("src/app") && !has("app");
+  }
+  if (framework === "tanstack-start" || framework === "sveltekit") root = "src";
+  const major = /(\d+)/.exec(deps.next ?? "");
+  return {
+    framework,
+    ...nextPagesOnly ? { nextPagesOnly } : {},
+    root,
+    typescript: has("tsconfig.json") || Boolean(deps.typescript),
+    esm: pkg.type === "module",
+    ...framework === "next" && major ? { nextMajor: Number(major[1]) } : {},
+    devUrl: `http://localhost:${port}`,
+    system: systemName(pkg.name),
+    installed: Boolean(deps["cauthy-auth"]),
+    packageManager: has("pnpm-lock.yaml") ? "pnpm" : has("yarn.lock") ? "yarn" : has("bun.lockb") || has("bun.lock") ? "bun" : "npm"
+  };
+}
+function systemName(pkgName) {
+  const bare = (pkgName ?? "").replace(/^@[^/]+\//, "");
+  const name = bare.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^[-_]+|[-_]+$/g, "");
+  return name || "app";
+}
+var join = (...parts) => import_node_path.posix.join(...parts.filter(Boolean));
+function importPath(from, to) {
+  const rel = import_node_path.posix.relative(import_node_path.posix.dirname(from), to).replace(/\.(ts|tsx|js|jsx)$/, "");
+  return rel.startsWith(".") ? rel : `./${rel}`;
+}
+function scaffold(d) {
+  const ext = d.typescript ? "ts" : "js";
+  const jsx = d.typescript ? "tsx" : "jsx";
+  const install = `${d.packageManager === "npm" ? "npm install" : `${d.packageManager} add`} cauthy-auth`;
+  const dev = `${d.packageManager === "npm" ? "npm run" : d.packageManager} dev`;
+  const steps = d.installed ? [] : [`Install the package: ${install}`];
+  const files = [];
+  const signIn = `${d.devUrl}/sign-in`;
+  const hosted = `${d.devUrl}/api/auth/login`;
+  switch (d.framework) {
+    case "next": {
+      const authFile = join(d.root, "lib", `auth.${ext}`);
+      files.push({ path: authFile, content: NEXT_AUTH });
+      if (d.nextPagesOnly) {
+        steps.push('The pages router is not written for you: serve auth.handler(request) under /api/auth/* (see the Auth SDK guide, "Mount the route").');
+        return { files, steps, envFile: ".env.local", open: hosted };
+      }
+      const route = join(d.root, "app/api/auth/[...cauthy]", `route.${ext}`);
+      files.push({ path: route, content: `// Serves cauthy-auth: sign-in, return, session, sign-out.
+import { cauthy } from '${importPath(route, authFile)}'
+
+export const { GET, POST } = cauthy
+` });
+      const before = join(d.root, `${(d.nextMajor ?? 15) >= 16 ? "proxy" : "middleware"}.${ext}`);
+      files.push({ path: before, content: `// Keeps the session renewed. To send anybody not signed in away from some
+// pages: cauthy.middleware({ protect: (path) => path.startsWith('/app') }).
+import { cauthy } from '${importPath(before, authFile)}'
+
+export default cauthy.middleware()
+
+export const config = { matcher: ['/((?!_next/|favicon.ico).*)'] }
+` });
+      files.push({ path: join(d.root, "app/sign-in", `page.${jsx}`), content: reactSignInPage(`'use client'
+
+`, "export default function SignInPage") });
+      steps.push(`Start the application: ${dev}`, `Open ${signIn}`);
+      return { files, steps, envFile: ".env.local", open: signIn };
+    }
+    case "tanstack-start": {
+      const authFile = join(d.root, `auth.${ext}`);
+      files.push({ path: authFile, content: PLAIN_AUTH });
+      const route = join(d.root, "routes/api/auth", `$.${ext}`);
+      files.push({ path: route, content: `// Serves cauthy-auth: sign-in, return, session, sign-out.
+import { createFileRoute } from '@tanstack/react-router'
+import { auth } from '${importPath(route, authFile)}'
+
+export const Route = createFileRoute('/api/auth/$')({
+  server: {
+    handlers: {
+      GET: ({ request }) => auth.handler(request),
+      POST: ({ request }) => auth.handler(request),
+    },
+  },
+})
+` });
+      files.push({ path: join(d.root, "routes", `sign-in.${jsx}`), content: reactSignInPage(`import { createFileRoute } from '@tanstack/react-router'
+`, "function SignInPage", `
+export const Route = createFileRoute('/sign-in')({ component: SignInPage })
+`) });
+      steps.push(`Start the application: ${dev}`, `Open ${signIn}`);
+      return { files, steps, envFile: ".env", open: signIn };
+    }
+    case "sveltekit": {
+      const authFile = join(d.root, "lib/server", `auth.${ext}`);
+      files.push({ path: authFile, content: PLAIN_AUTH });
+      const route = join(d.root, "routes/api/auth/[...cauthy]", `+server.${ext}`);
+      const param = d.typescript ? "{ request }: { request: Request }" : "{ request }";
+      files.push({ path: route, content: `// Serves cauthy-auth: sign-in, return, session, sign-out.
+import { auth } from '$lib/server/auth'
+
+export const GET = (${param}) => auth.handler(request)
+export const POST = (${param}) => auth.handler(request)
+` });
+      steps.push(`Start the application: ${dev}`, `Open ${hosted}: Cauthy's sign-in page, and back. For screens of your own, see createCauthySession in cauthy-auth/svelte.`);
+      return { files, steps, envFile: ".env", open: hosted };
+    }
+    case "express":
+    case "hono":
+    case "fastify": {
+      const authFile = join(d.root, `auth.${ext}`);
+      const cjs = !d.typescript && !d.esm;
+      files.push({ path: authFile, content: cjs ? PLAIN_AUTH_CJS : PLAIN_AUTH });
+      steps.push(`Add to your server, where the app is made:
+
+${serverLines(d.framework, cjs)}`, `Start the application: ${dev}`, `Open ${hosted}`);
+      return { files, steps, envFile: ".env", open: hosted };
+    }
+    default:
+      steps.push('Serve auth.handler(request) under /api/auth/* (see the Auth SDK guide, "Mount the route").');
+      return { files, steps, envFile: ".env", open: hosted };
+  }
+}
+function serverLines(f, cjs) {
+  const from = "./auth";
+  if (f === "express") {
+    return cjs ? `  const { cauthyExpress } = require('cauthy-auth/express')
+  const { auth } = require('${from}')
+  app.use(cauthyExpress(auth))` : `  import { cauthyExpress } from 'cauthy-auth/express'
+  import { auth } from '${from}'
+  app.use(cauthyExpress(auth))`;
+  }
+  if (f === "hono") {
+    return cjs ? `  const { cauthyHono } = require('cauthy-auth/hono')
+  const { auth } = require('${from}')
+  app.use(cauthyHono(auth))` : `  import { cauthyHono } from 'cauthy-auth/hono'
+  import { auth } from '${from}'
+  app.use(cauthyHono(auth))`;
+  }
+  return cjs ? `  const { cauthyFastify } = require('cauthy-auth/fastify')
+  const { auth } = require('${from}')
+  await app.register(cauthyFastify, { auth })` : `  import { cauthyFastify } from 'cauthy-auth/fastify'
+  import { auth } from '${from}'
+  await app.register(cauthyFastify, { auth })`;
+}
+var NEXT_AUTH = `// createCauthy() reads CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_CLIENT_SECRET,
+// CAUTHY_SECRET and CAUTHY_TENANT from the environment.
+import { createCauthy } from 'cauthy-auth'
+import { cauthyNext } from 'cauthy-auth/next'
+
+export const auth = createCauthy()
+export const cauthy = cauthyNext(auth)
+`;
+var PLAIN_AUTH = `// createCauthy() reads CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_CLIENT_SECRET,
+// CAUTHY_SECRET and CAUTHY_TENANT from the environment.
+import { createCauthy } from 'cauthy-auth'
+
+export const auth = createCauthy()
+`;
+var PLAIN_AUTH_CJS = `// createCauthy() reads CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_CLIENT_SECRET,
+// CAUTHY_SECRET and CAUTHY_TENANT from the environment.
+const { createCauthy } = require('cauthy-auth')
+
+exports.auth = createCauthy()
+`;
+function reactSignInPage(head, declaration, tail = "") {
+  return `${head}// The application's own sign-in page. <SignIn /> is the ready-made form: the
+// workspace's providers, passkeys, the second step and a sign-in link, drawn
+// with the look set in Cauthy's dashboard. useAuth() has the same functions
+// for a form of your own. Move <CauthyProvider> to the application's root
+// to read the session on every page.
+import { CauthyProvider, SignIn } from 'cauthy-auth/react'
+import 'cauthy-auth/styles.css'
+${tail}
+${declaration}() {
+  return (
+    <main style={{ maxWidth: 380, margin: '64px auto', padding: '0 16px' }}>
+      <CauthyProvider>
+        <SignIn returnTo="/" />
+      </CauthyProvider>
+    </main>
+  )
+}
+`;
+}
+
 // src/permissions.ts
 var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 function policySource(system, roles) {
@@ -707,14 +908,19 @@ function createSystem(given = {}) {
 }
 
 // src/cli.ts
-var INIT_HELP = `cauthy-auth init --system <name> --app-url <address> [options]
+var INIT_HELP = `cauthy-auth init [options]
 
-Connects an application to Cauthy: makes its client, registers where its people
-come back to and where it hears events, and prints the variables to set.
+Connects an application to Cauthy and leaves signing in working. Run it in
+the application's folder: it reads which framework the application is made
+with (Next.js, TanStack Start, SvelteKit, Express, Hono, Fastify), makes its
+client in Cauthy, writes the variables to its env file, and lays down the
+route and a sign-in page. A file that is already there is never written over.
 
   --system <name>         The system's name: lowercase letters, digits, - or _.
+                          Default: the package's name.
   --app-url <address>     The application's public address: https://app.example.com,
-                          or http://localhost:3000 while developing.
+                          or http://localhost:3000 while developing. Default: the
+                          framework's address while developing.
   --name <name>           Shown to people on Cauthy's pages. Default: the system's name.
   --callback-path <path>  Where the application serves the return from a sign-in.
                           Default: /api/auth/callback.
@@ -722,35 +928,78 @@ come back to and where it hears events, and prints the variables to set.
                           Cauthy's events (verify them with auth.webhook).
   --jwks-uri <address>    Where the application publishes its keys, to prove
                           itself with a signature instead of its secret.
-  --write <file>          Append the variables to this file instead of printing
-                          them (they include the client's secret, shown once).
+  --write <file>          The env file to add the variables to. Default: .env.local
+                          for Next.js, .env otherwise.
+  --print                 Print the variables instead of writing them.
+  --no-files              Connect only: write no route and no page.
+  --reconnect             Connect again although the env file has Cauthy's
+                          variables: a new client, with a new secret.
 
 Needs CAUTHY_ISSUER, CAUTHY_TENANT (the workspace's slug) and CAUTHY_TOKEN (a
 personal access token with systems:connect).
 `;
+function readJson(file) {
+  try {
+    return JSON.parse((0, import_node_fs.readFileSync)(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function ignored(file) {
+  let lines;
+  try {
+    lines = (0, import_node_fs.readFileSync)(".gitignore", "utf8").split(/\r?\n/).map((l) => l.trim().replace(/^\//, ""));
+  } catch {
+    return false;
+  }
+  return lines.some((l) => l === file || l === ".env*" || l === "*.env" || file.endsWith(".local") && (l === "*.local" || l === ".env*.local"));
+}
 async function init(argv) {
   if (argv.includes("--help") || argv.includes("-h")) {
     process.stdout.write(INIT_HELP);
     return;
   }
   const given = {};
-  const flags = ["--system", "--app-url", "--name", "--callback-path", "--events-url", "--jwks-uri", "--write"];
+  const valued = ["--system", "--app-url", "--name", "--callback-path", "--events-url", "--jwks-uri", "--write"];
+  const switches = ["--print", "--no-files", "--reconnect"];
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
-    if (!flags.includes(arg)) fail(`unknown option ${arg}
+    if (switches.includes(arg)) given[arg] = "yes";
+    else if (valued.includes(arg)) given[arg] = argv[++i] ?? fail(`${arg} needs a value`);
+    else fail(`unknown option ${arg}
 
 ${INIT_HELP}`);
-    given[arg] = argv[++i] ?? fail(`${arg} needs a value`);
   }
-  if (!given["--system"] || !given["--app-url"]) fail("give --system and --app-url\n\n" + INIT_HELP);
+  const pkg = readJson("package.json");
+  const found = pkg ? detect(pkg, import_node_fs.existsSync) : null;
+  const plan = found ? scaffold(found) : null;
+  const system = given["--system"] ?? found?.system;
+  const appUrl = given["--app-url"] ?? found?.devUrl;
+  if (!system || !appUrl) fail("no package.json here: give --system and --app-url\n\n" + INIT_HELP);
+  if (found?.framework) process.stdout.write(`Found ${FRAMEWORK_NAMES[found.framework]}.
+`);
+  const target = given["--write"] ?? plan?.envFile;
+  let had = "";
+  try {
+    had = target ? (0, import_node_fs.readFileSync)(target, "utf8") : "";
+  } catch {
+  }
+  const already = /^CAUTHY_CLIENT_ID=/m.test(had);
+  if (already && !given["--reconnect"]) {
+    process.stdout.write(`Already connected: ${target} has Cauthy's variables. (--reconnect makes a new client.)
+`);
+    return writeFiles(plan, given["--no-files"] !== void 0);
+  }
   const done = await connectSystem({
-    system: given["--system"],
-    appUrl: given["--app-url"],
+    system,
+    appUrl,
     name: given["--name"],
     callbackPath: given["--callback-path"],
     eventsUrl: given["--events-url"],
     jwksUri: given["--jwks-uri"]
   });
+  const tenant = process.env.CAUTHY_TENANT;
+  if (tenant && !done.env.CAUTHY_TENANT) done.env.CAUTHY_TENANT = tenant;
   const vars = envFile(done.env);
   process.stdout.write(`Connected: the system ${done.system} is the client ${done.clientId}.
 `);
@@ -758,25 +1007,55 @@ ${INIT_HELP}`);
 `);
   if (done.webhook) process.stdout.write(`  events are sent to   ${done.webhook.url}
 `);
-  if (given["--write"]) {
-    (0, import_node_fs.appendFileSync)(given["--write"], vars, { mode: 384 });
-    process.stdout.write(`
-The variables were added to ${given["--write"]}. Keep that file out of the repository.
+  if (given["--print"] || !target || already) {
+    if (already) process.stdout.write(`
+${target} already has Cauthy's variables: replace them with these by hand.
 `);
-  } else {
     process.stdout.write(`
 Set these where the application runs. The secret is shown this once:
 
 ${vars}`);
+  } else {
+    (0, import_node_fs.appendFileSync)(target, (had && !had.endsWith("\n") ? "\n" : "") + vars, { mode: 384 });
+    process.stdout.write(`
+The variables were added to ${target}.
+`);
+    if (!ignored(target)) {
+      (0, import_node_fs.appendFileSync)(".gitignore", `${(0, import_node_fs.existsSync)(".gitignore") ? "\n" : ""}${target}
+`);
+      process.stdout.write(`${target} was added to .gitignore: it holds the client's secret.
+`);
+    }
   }
-  process.stdout.write(`
+  writeFiles(plan, given["--no-files"] !== void 0);
+}
+function writeFiles(plan, none) {
+  if (!plan || none) {
+    process.stdout.write(`
 Then, in the application:
 
   import { createCauthy } from 'cauthy-auth'
   export const auth = createCauthy()
 
-and serve auth.handler(request) under ${(given["--callback-path"] ?? "/api/auth/callback").replace(/\/callback$/, "")}/*.
+and serve auth.handler(request) under /api/auth/*.
+`);
+    return;
+  }
+  process.stdout.write("\n");
+  for (const f of plan.files) {
+    if ((0, import_node_fs.existsSync)(f.path)) {
+      process.stdout.write(`  left as it was  ${f.path} (it is already there)
 `);
+      continue;
+    }
+    (0, import_node_fs.mkdirSync)((0, import_node_path2.dirname)(f.path) || ".", { recursive: true });
+    (0, import_node_fs.writeFileSync)(f.path, f.content);
+    process.stdout.write(`  wrote           ${f.path}
+`);
+  }
+  process.stdout.write("\nWhat is left:\n\n");
+  plan.steps.forEach((step, i) => process.stdout.write(`${i + 1}. ${step}
+`));
 }
 var POLICY_HELP = `cauthy-auth policy --pull [--out <file.ts>] [--system <name>]
 cauthy-auth policy --file <roles.json> [--system <name>] [--push]
@@ -869,7 +1148,7 @@ ${POLICY_HELP}`);
     process.stdout.write("Not sent. Add --push to give it to Cauthy.\n");
   }
 }
-var HELP = `cauthy-auth init \u2026     connect an application to Cauthy (cauthy-auth init --help)
+var HELP = `cauthy-auth init \u2026     connect an application and leave signing in working (cauthy-auth init --help)
 cauthy-auth policy \u2026   load a system's catalog of roles (cauthy-auth policy --help)
 cauthy-auth theme [options]
 

package/dist/client.d.mts

@@ -4,6 +4,15 @@ import { A as AuthField } from './validate-B_iC-4y8.mjs';
 export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-B_iC-4y8.mjs';
 import 'jose';
 
+/** Whether this browser can use a passkey at all. */
+declare function canUsePasskeys(): boolean;
+/**
+ * Whether this browser offers passkeys in the autofill of a field marked
+ * `autocomplete="username webauthn"`, so the person picks one without
+ * looking for a button.
+ */
+declare function canAutofillPasskeys(): Promise<boolean>;
+
 interface SessionState {
     /** The signed-in person and their organizations, or null. */
     session: PublicSession | null;
@@ -70,8 +79,29 @@ interface AuthMethods {
     /** Whether people may create an account themselves. */
     signUp: boolean;
     magicLink: boolean;
-    /** Whether to offer a passkey. It is asked for on Cauthy's page: the person goes there for that step and comes back signed in. */
+    /** Whether to offer a passkey. */
     passkey: boolean;
+    /**
+     * Whether the passkey is used on this page itself. False: `signIn.passkey`
+     * sends the person to Cauthy's page for that step alone, and they come back
+     * signed in. That happens only when this page is outside the domain the
+     * workspace's passkeys belong to.
+     */
+    passkeyHere: boolean;
+    /**
+     * Whether Cauthy's page can use the passkey, for that step alone: where a
+     * page that cannot, or a browser that refuses to here, sends the person.
+     */
+    passkeyOnCauthy: boolean;
+}
+/** A passkey of the signed-in account. Moments are UTC. */
+interface Passkey {
+    id: string;
+    /** What the person called it ("My laptop"), or "". */
+    name: string;
+    createdAt: string;
+    /** When it last signed the person in, or null. */
+    lastUsedAt: string | null;
 }
 /** A person's own account, as their account screen shows it. */
 interface Account {
@@ -175,6 +205,22 @@ interface AccountClient {
     sessions(): Promise<AccountSession[]>;
     /** Signs the account out everywhere, here too. */
     signOutEverywhere(): Promise<AuthResult<'signed_out'>>;
+    /** The account's passkeys. */
+    passkeys(): Promise<Passkey[]>;
+    /**
+     * Makes a passkey on this device, on this page: the browser asks the person
+     * for their fingerprint, face or screen lock. An account with a password
+     * proves it again first. `cancelled`: the person closed the browser's prompt.
+     */
+    addPasskey(form?: {
+        password?: string;
+        name?: string;
+    }): Promise<AuthResult<'added', {
+        passkey: Passkey;
+    }>>;
+    removePasskey(id: string): Promise<AuthResult<'removed', {
+        id: string;
+    }>>;
 }
 interface AuthClient {
     signIn: {
@@ -207,12 +253,49 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** Sends the browser to Cauthy's page to use a passkey; it comes back signed in, at `returnTo`. */
+        /**
+         * Signs in with a passkey, on this page: the browser asks the person for
+         * their fingerprint, face or screen lock. When this page cannot use the
+         * workspace's passkeys (`methods().passkeyHere` is false), the browser goes
+         * to Cauthy's page for that step alone and comes back signed in, at
+         * `returnTo`: then the answer is `redirected`. `cancelled`: the person
+         * closed the browser's prompt.
+         */
         passkey(options?: {
             returnTo?: string;
             locale?: string;
-        }): void;
-        /** Where `passkey` sends the browser, for a plain link. */
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }> | AuthResult<'redirected'>>;
+        /**
+         * Offers the person's passkeys in the browser's autofill of the email
+         * field, which must carry `autocomplete="username webauthn"`, and signs in
+         * with the one they pick. It waits until they pick one or `signal`
+         * aborts: abort it before calling `passkey` or sending the form.
+         * `cancelled`: aborted, or this browser or page cannot (then there is
+         * nothing to offer, and the passkey button still works).
+         */
+        passkeyAutofill(options?: {
+            signal?: AbortSignal;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
+        /**
+         * Google One Tap: Google's prompt over the page offers the Google account
+         * the browser already has, and signs in with it in one tap, as the Google
+         * sign-in does (the same account). Needs the workspace's Google sign-in,
+         * and the page's address among the Google client's authorized JavaScript
+         * origins. Waits until the person picks an account or closes the prompt
+         * (`cancelled`), or `signal` aborts. `one_tap_unavailable`: the workspace
+         * has no Google sign-in.
+         */
+        googleOneTap(options?: {
+            signal?: AbortSignal;
+            context?: 'signin' | 'signup' | 'use';
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
+        /** Where `passkey` sends the browser when this page cannot use the passkey itself. */
         passkeyUrl(options?: {
             returnTo?: string;
             locale?: string;
@@ -277,4 +360,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type LinkedIdentity, type SessionState, type SessionStore, type SessionStoreOptions, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type LinkedIdentity, type Passkey, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.d.ts

@@ -4,6 +4,15 @@ import { A as AuthField } from './validate-B_iC-4y8.js';
 export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-B_iC-4y8.js';
 import 'jose';
 
+/** Whether this browser can use a passkey at all. */
+declare function canUsePasskeys(): boolean;
+/**
+ * Whether this browser offers passkeys in the autofill of a field marked
+ * `autocomplete="username webauthn"`, so the person picks one without
+ * looking for a button.
+ */
+declare function canAutofillPasskeys(): Promise<boolean>;
+
 interface SessionState {
     /** The signed-in person and their organizations, or null. */
     session: PublicSession | null;
@@ -70,8 +79,29 @@ interface AuthMethods {
     /** Whether people may create an account themselves. */
     signUp: boolean;
     magicLink: boolean;
-    /** Whether to offer a passkey. It is asked for on Cauthy's page: the person goes there for that step and comes back signed in. */
+    /** Whether to offer a passkey. */
     passkey: boolean;
+    /**
+     * Whether the passkey is used on this page itself. False: `signIn.passkey`
+     * sends the person to Cauthy's page for that step alone, and they come back
+     * signed in. That happens only when this page is outside the domain the
+     * workspace's passkeys belong to.
+     */
+    passkeyHere: boolean;
+    /**
+     * Whether Cauthy's page can use the passkey, for that step alone: where a
+     * page that cannot, or a browser that refuses to here, sends the person.
+     */
+    passkeyOnCauthy: boolean;
+}
+/** A passkey of the signed-in account. Moments are UTC. */
+interface Passkey {
+    id: string;
+    /** What the person called it ("My laptop"), or "". */
+    name: string;
+    createdAt: string;
+    /** When it last signed the person in, or null. */
+    lastUsedAt: string | null;
 }
 /** A person's own account, as their account screen shows it. */
 interface Account {
@@ -175,6 +205,22 @@ interface AccountClient {
     sessions(): Promise<AccountSession[]>;
     /** Signs the account out everywhere, here too. */
     signOutEverywhere(): Promise<AuthResult<'signed_out'>>;
+    /** The account's passkeys. */
+    passkeys(): Promise<Passkey[]>;
+    /**
+     * Makes a passkey on this device, on this page: the browser asks the person
+     * for their fingerprint, face or screen lock. An account with a password
+     * proves it again first. `cancelled`: the person closed the browser's prompt.
+     */
+    addPasskey(form?: {
+        password?: string;
+        name?: string;
+    }): Promise<AuthResult<'added', {
+        passkey: Passkey;
+    }>>;
+    removePasskey(id: string): Promise<AuthResult<'removed', {
+        id: string;
+    }>>;
 }
 interface AuthClient {
     signIn: {
@@ -207,12 +253,49 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** Sends the browser to Cauthy's page to use a passkey; it comes back signed in, at `returnTo`. */
+        /**
+         * Signs in with a passkey, on this page: the browser asks the person for
+         * their fingerprint, face or screen lock. When this page cannot use the
+         * workspace's passkeys (`methods().passkeyHere` is false), the browser goes
+         * to Cauthy's page for that step alone and comes back signed in, at
+         * `returnTo`: then the answer is `redirected`. `cancelled`: the person
+         * closed the browser's prompt.
+         */
         passkey(options?: {
             returnTo?: string;
             locale?: string;
-        }): void;
-        /** Where `passkey` sends the browser, for a plain link. */
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }> | AuthResult<'redirected'>>;
+        /**
+         * Offers the person's passkeys in the browser's autofill of the email
+         * field, which must carry `autocomplete="username webauthn"`, and signs in
+         * with the one they pick. It waits until they pick one or `signal`
+         * aborts: abort it before calling `passkey` or sending the form.
+         * `cancelled`: aborted, or this browser or page cannot (then there is
+         * nothing to offer, and the passkey button still works).
+         */
+        passkeyAutofill(options?: {
+            signal?: AbortSignal;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
+        /**
+         * Google One Tap: Google's prompt over the page offers the Google account
+         * the browser already has, and signs in with it in one tap, as the Google
+         * sign-in does (the same account). Needs the workspace's Google sign-in,
+         * and the page's address among the Google client's authorized JavaScript
+         * origins. Waits until the person picks an account or closes the prompt
+         * (`cancelled`), or `signal` aborts. `one_tap_unavailable`: the workspace
+         * has no Google sign-in.
+         */
+        googleOneTap(options?: {
+            signal?: AbortSignal;
+            context?: 'signin' | 'signup' | 'use';
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
+        /** Where `passkey` sends the browser when this page cannot use the passkey itself. */
         passkeyUrl(options?: {
             returnTo?: string;
             locale?: string;
@@ -277,4 +360,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type LinkedIdentity, type SessionState, type SessionStore, type SessionStoreOptions, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type LinkedIdentity, type Passkey, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };