cauthy-auth 0.11.0 → 0.13.0

package/README.md

@@ -101,10 +101,11 @@ import 'cauthy-auth/styles.css'
 
 Or draw them with your own `components` and `classNames`, and pass `unstyled`. The dashboard can start the look from your stylesheet (shadcn/ui and Tailwind, Stackmyth, or variables of your own); `npx cauthy-auth theme --css src/app/globals.css` reads it the same way from a terminal.
 
-Connect your application to Cauthy in one step, from Cauthy's dashboard ("Connect a System") or from a terminal. It makes the client, registers `https://<your app>/api/auth/callback`, and prints every variable to set, `CAUTHY_SECRET` included:
+Connect your application to Cauthy in one step, from Cauthy's dashboard ("Connect a System") or from a terminal. In the application's folder, `init` reads its framework (Next.js, TanStack Start, SvelteKit, Express, Hono, Fastify), makes the client, writes every variable to its env file, `CAUTHY_SECRET` included, and lays down the route and a sign-in page, never over a file that is there:
 
 ```bash
-npx cauthy-auth init --system ledger --app-url https://app.example.com
+npx cauthy-auth init
+npx cauthy-auth init --system ledger --app-url https://app.example.com   # production
 ```
 
 The same client is your application's own identity: it manages its organizations with no person's token.

package/dist/cli.js

@@ -3,6 +3,7 @@
 
 // src/cli.ts
 var import_node_fs = require("fs");
+var import_node_path2 = require("path");
 
 // src/connect.ts
 function sessionSecret() {
@@ -51,6 +52,206 @@ function envFile(env2) {
   return Object.entries(env2).map(([k, v]) => `${k}=${v}`).join("\n") + "\n";
 }
 
+// src/scaffold.ts
+var import_node_path = require("path");
+var FRAMEWORK_NAMES = {
+  next: "Next.js",
+  "tanstack-start": "TanStack Start",
+  sveltekit: "SvelteKit",
+  express: "Express",
+  hono: "Hono",
+  fastify: "Fastify"
+};
+function detect(pkg, has) {
+  const deps = { ...pkg.devDependencies, ...pkg.dependencies };
+  const framework = deps.next ? "next" : deps["@tanstack/react-start"] ? "tanstack-start" : deps["@sveltejs/kit"] ? "sveltekit" : deps.hono ? "hono" : deps.fastify ? "fastify" : deps.express ? "express" : null;
+  const port = framework === "sveltekit" ? 5173 : 3e3;
+  let root = has("src") ? "src" : "";
+  let nextPagesOnly = false;
+  if (framework === "next") {
+    root = has("src/app") ? "src" : has("app") ? "" : has("src/pages") ? "src" : "";
+    nextPagesOnly = !has("src/app") && !has("app");
+  }
+  if (framework === "tanstack-start" || framework === "sveltekit") root = "src";
+  const major = /(\d+)/.exec(deps.next ?? "");
+  return {
+    framework,
+    ...nextPagesOnly ? { nextPagesOnly } : {},
+    root,
+    typescript: has("tsconfig.json") || Boolean(deps.typescript),
+    esm: pkg.type === "module",
+    ...framework === "next" && major ? { nextMajor: Number(major[1]) } : {},
+    devUrl: `http://localhost:${port}`,
+    system: systemName(pkg.name),
+    installed: Boolean(deps["cauthy-auth"]),
+    packageManager: has("pnpm-lock.yaml") ? "pnpm" : has("yarn.lock") ? "yarn" : has("bun.lockb") || has("bun.lock") ? "bun" : "npm"
+  };
+}
+function systemName(pkgName) {
+  const bare = (pkgName ?? "").replace(/^@[^/]+\//, "");
+  const name = bare.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^[-_]+|[-_]+$/g, "");
+  return name || "app";
+}
+var join = (...parts) => import_node_path.posix.join(...parts.filter(Boolean));
+function importPath(from, to) {
+  const rel = import_node_path.posix.relative(import_node_path.posix.dirname(from), to).replace(/\.(ts|tsx|js|jsx)$/, "");
+  return rel.startsWith(".") ? rel : `./${rel}`;
+}
+function scaffold(d) {
+  const ext = d.typescript ? "ts" : "js";
+  const jsx = d.typescript ? "tsx" : "jsx";
+  const install = `${d.packageManager === "npm" ? "npm install" : `${d.packageManager} add`} cauthy-auth`;
+  const dev = `${d.packageManager === "npm" ? "npm run" : d.packageManager} dev`;
+  const steps = d.installed ? [] : [`Install the package: ${install}`];
+  const files = [];
+  const signIn = `${d.devUrl}/sign-in`;
+  const hosted = `${d.devUrl}/api/auth/login`;
+  switch (d.framework) {
+    case "next": {
+      const authFile = join(d.root, "lib", `auth.${ext}`);
+      files.push({ path: authFile, content: NEXT_AUTH });
+      if (d.nextPagesOnly) {
+        steps.push('The pages router is not written for you: serve auth.handler(request) under /api/auth/* (see the Auth SDK guide, "Mount the route").');
+        return { files, steps, envFile: ".env.local", open: hosted };
+      }
+      const route = join(d.root, "app/api/auth/[...cauthy]", `route.${ext}`);
+      files.push({ path: route, content: `// Serves cauthy-auth: sign-in, return, session, sign-out.
+import { cauthy } from '${importPath(route, authFile)}'
+
+export const { GET, POST } = cauthy
+` });
+      const before = join(d.root, `${(d.nextMajor ?? 15) >= 16 ? "proxy" : "middleware"}.${ext}`);
+      files.push({ path: before, content: `// Keeps the session renewed. To send anybody not signed in away from some
+// pages: cauthy.middleware({ protect: (path) => path.startsWith('/app') }).
+import { cauthy } from '${importPath(before, authFile)}'
+
+export default cauthy.middleware()
+
+export const config = { matcher: ['/((?!_next/|favicon.ico).*)'] }
+` });
+      files.push({ path: join(d.root, "app/sign-in", `page.${jsx}`), content: reactSignInPage(`'use client'
+
+`, "export default function SignInPage") });
+      steps.push(`Start the application: ${dev}`, `Open ${signIn}`);
+      return { files, steps, envFile: ".env.local", open: signIn };
+    }
+    case "tanstack-start": {
+      const authFile = join(d.root, `auth.${ext}`);
+      files.push({ path: authFile, content: PLAIN_AUTH });
+      const route = join(d.root, "routes/api/auth", `$.${ext}`);
+      files.push({ path: route, content: `// Serves cauthy-auth: sign-in, return, session, sign-out.
+import { createFileRoute } from '@tanstack/react-router'
+import { auth } from '${importPath(route, authFile)}'
+
+export const Route = createFileRoute('/api/auth/$')({
+  server: {
+    handlers: {
+      GET: ({ request }) => auth.handler(request),
+      POST: ({ request }) => auth.handler(request),
+    },
+  },
+})
+` });
+      files.push({ path: join(d.root, "routes", `sign-in.${jsx}`), content: reactSignInPage(`import { createFileRoute } from '@tanstack/react-router'
+`, "function SignInPage", `
+export const Route = createFileRoute('/sign-in')({ component: SignInPage })
+`) });
+      steps.push(`Start the application: ${dev}`, `Open ${signIn}`);
+      return { files, steps, envFile: ".env", open: signIn };
+    }
+    case "sveltekit": {
+      const authFile = join(d.root, "lib/server", `auth.${ext}`);
+      files.push({ path: authFile, content: PLAIN_AUTH });
+      const route = join(d.root, "routes/api/auth/[...cauthy]", `+server.${ext}`);
+      const param = d.typescript ? "{ request }: { request: Request }" : "{ request }";
+      files.push({ path: route, content: `// Serves cauthy-auth: sign-in, return, session, sign-out.
+import { auth } from '$lib/server/auth'
+
+export const GET = (${param}) => auth.handler(request)
+export const POST = (${param}) => auth.handler(request)
+` });
+      steps.push(`Start the application: ${dev}`, `Open ${hosted}: Cauthy's sign-in page, and back. For screens of your own, see createCauthySession in cauthy-auth/svelte.`);
+      return { files, steps, envFile: ".env", open: hosted };
+    }
+    case "express":
+    case "hono":
+    case "fastify": {
+      const authFile = join(d.root, `auth.${ext}`);
+      const cjs = !d.typescript && !d.esm;
+      files.push({ path: authFile, content: cjs ? PLAIN_AUTH_CJS : PLAIN_AUTH });
+      steps.push(`Add to your server, where the app is made:
+
+${serverLines(d.framework, cjs)}`, `Start the application: ${dev}`, `Open ${hosted}`);
+      return { files, steps, envFile: ".env", open: hosted };
+    }
+    default:
+      steps.push('Serve auth.handler(request) under /api/auth/* (see the Auth SDK guide, "Mount the route").');
+      return { files, steps, envFile: ".env", open: hosted };
+  }
+}
+function serverLines(f, cjs) {
+  const from = "./auth";
+  if (f === "express") {
+    return cjs ? `  const { cauthyExpress } = require('cauthy-auth/express')
+  const { auth } = require('${from}')
+  app.use(cauthyExpress(auth))` : `  import { cauthyExpress } from 'cauthy-auth/express'
+  import { auth } from '${from}'
+  app.use(cauthyExpress(auth))`;
+  }
+  if (f === "hono") {
+    return cjs ? `  const { cauthyHono } = require('cauthy-auth/hono')
+  const { auth } = require('${from}')
+  app.use(cauthyHono(auth))` : `  import { cauthyHono } from 'cauthy-auth/hono'
+  import { auth } from '${from}'
+  app.use(cauthyHono(auth))`;
+  }
+  return cjs ? `  const { cauthyFastify } = require('cauthy-auth/fastify')
+  const { auth } = require('${from}')
+  await app.register(cauthyFastify, { auth })` : `  import { cauthyFastify } from 'cauthy-auth/fastify'
+  import { auth } from '${from}'
+  await app.register(cauthyFastify, { auth })`;
+}
+var NEXT_AUTH = `// createCauthy() reads CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_CLIENT_SECRET,
+// CAUTHY_SECRET and CAUTHY_TENANT from the environment.
+import { createCauthy } from 'cauthy-auth'
+import { cauthyNext } from 'cauthy-auth/next'
+
+export const auth = createCauthy()
+export const cauthy = cauthyNext(auth)
+`;
+var PLAIN_AUTH = `// createCauthy() reads CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_CLIENT_SECRET,
+// CAUTHY_SECRET and CAUTHY_TENANT from the environment.
+import { createCauthy } from 'cauthy-auth'
+
+export const auth = createCauthy()
+`;
+var PLAIN_AUTH_CJS = `// createCauthy() reads CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_CLIENT_SECRET,
+// CAUTHY_SECRET and CAUTHY_TENANT from the environment.
+const { createCauthy } = require('cauthy-auth')
+
+exports.auth = createCauthy()
+`;
+function reactSignInPage(head, declaration, tail = "") {
+  return `${head}// The application's own sign-in page. <SignIn /> is the ready-made form: the
+// workspace's providers, passkeys, the second step and a sign-in link, drawn
+// with the look set in Cauthy's dashboard. useAuth() has the same functions
+// for a form of your own. Move <CauthyProvider> to the application's root
+// to read the session on every page.
+import { CauthyProvider, SignIn } from 'cauthy-auth/react'
+import 'cauthy-auth/styles.css'
+${tail}
+${declaration}() {
+  return (
+    <main style={{ maxWidth: 380, margin: '64px auto', padding: '0 16px' }}>
+      <CauthyProvider>
+        <SignIn returnTo="/" />
+      </CauthyProvider>
+    </main>
+  )
+}
+`;
+}
+
 // src/permissions.ts
 var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 function policySource(system, roles) {
@@ -707,14 +908,19 @@ function createSystem(given = {}) {
 }
 
 // src/cli.ts
-var INIT_HELP = `cauthy-auth init --system <name> --app-url <address> [options]
+var INIT_HELP = `cauthy-auth init [options]
 
-Connects an application to Cauthy: makes its client, registers where its people
-come back to and where it hears events, and prints the variables to set.
+Connects an application to Cauthy and leaves signing in working. Run it in
+the application's folder: it reads which framework the application is made
+with (Next.js, TanStack Start, SvelteKit, Express, Hono, Fastify), makes its
+client in Cauthy, writes the variables to its env file, and lays down the
+route and a sign-in page. A file that is already there is never written over.
 
   --system <name>         The system's name: lowercase letters, digits, - or _.
+                          Default: the package's name.
   --app-url <address>     The application's public address: https://app.example.com,
-                          or http://localhost:3000 while developing.
+                          or http://localhost:3000 while developing. Default: the
+                          framework's address while developing.
   --name <name>           Shown to people on Cauthy's pages. Default: the system's name.
   --callback-path <path>  Where the application serves the return from a sign-in.
                           Default: /api/auth/callback.
@@ -722,35 +928,78 @@ come back to and where it hears events, and prints the variables to set.
                           Cauthy's events (verify them with auth.webhook).
   --jwks-uri <address>    Where the application publishes its keys, to prove
                           itself with a signature instead of its secret.
-  --write <file>          Append the variables to this file instead of printing
-                          them (they include the client's secret, shown once).
+  --write <file>          The env file to add the variables to. Default: .env.local
+                          for Next.js, .env otherwise.
+  --print                 Print the variables instead of writing them.
+  --no-files              Connect only: write no route and no page.
+  --reconnect             Connect again although the env file has Cauthy's
+                          variables: a new client, with a new secret.
 
 Needs CAUTHY_ISSUER, CAUTHY_TENANT (the workspace's slug) and CAUTHY_TOKEN (a
 personal access token with systems:connect).
 `;
+function readJson(file) {
+  try {
+    return JSON.parse((0, import_node_fs.readFileSync)(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function ignored(file) {
+  let lines;
+  try {
+    lines = (0, import_node_fs.readFileSync)(".gitignore", "utf8").split(/\r?\n/).map((l) => l.trim().replace(/^\//, ""));
+  } catch {
+    return false;
+  }
+  return lines.some((l) => l === file || l === ".env*" || l === "*.env" || file.endsWith(".local") && (l === "*.local" || l === ".env*.local"));
+}
 async function init(argv) {
   if (argv.includes("--help") || argv.includes("-h")) {
     process.stdout.write(INIT_HELP);
     return;
   }
   const given = {};
-  const flags = ["--system", "--app-url", "--name", "--callback-path", "--events-url", "--jwks-uri", "--write"];
+  const valued = ["--system", "--app-url", "--name", "--callback-path", "--events-url", "--jwks-uri", "--write"];
+  const switches = ["--print", "--no-files", "--reconnect"];
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
-    if (!flags.includes(arg)) fail(`unknown option ${arg}
+    if (switches.includes(arg)) given[arg] = "yes";
+    else if (valued.includes(arg)) given[arg] = argv[++i] ?? fail(`${arg} needs a value`);
+    else fail(`unknown option ${arg}
 
 ${INIT_HELP}`);
-    given[arg] = argv[++i] ?? fail(`${arg} needs a value`);
   }
-  if (!given["--system"] || !given["--app-url"]) fail("give --system and --app-url\n\n" + INIT_HELP);
+  const pkg = readJson("package.json");
+  const found = pkg ? detect(pkg, import_node_fs.existsSync) : null;
+  const plan = found ? scaffold(found) : null;
+  const system = given["--system"] ?? found?.system;
+  const appUrl = given["--app-url"] ?? found?.devUrl;
+  if (!system || !appUrl) fail("no package.json here: give --system and --app-url\n\n" + INIT_HELP);
+  if (found?.framework) process.stdout.write(`Found ${FRAMEWORK_NAMES[found.framework]}.
+`);
+  const target = given["--write"] ?? plan?.envFile;
+  let had = "";
+  try {
+    had = target ? (0, import_node_fs.readFileSync)(target, "utf8") : "";
+  } catch {
+  }
+  const already = /^CAUTHY_CLIENT_ID=/m.test(had);
+  if (already && !given["--reconnect"]) {
+    process.stdout.write(`Already connected: ${target} has Cauthy's variables. (--reconnect makes a new client.)
+`);
+    return writeFiles(plan, given["--no-files"] !== void 0);
+  }
   const done = await connectSystem({
-    system: given["--system"],
-    appUrl: given["--app-url"],
+    system,
+    appUrl,
     name: given["--name"],
     callbackPath: given["--callback-path"],
     eventsUrl: given["--events-url"],
     jwksUri: given["--jwks-uri"]
   });
+  const tenant = process.env.CAUTHY_TENANT;
+  if (tenant && !done.env.CAUTHY_TENANT) done.env.CAUTHY_TENANT = tenant;
   const vars = envFile(done.env);
   process.stdout.write(`Connected: the system ${done.system} is the client ${done.clientId}.
 `);
@@ -758,25 +1007,55 @@ ${INIT_HELP}`);
 `);
   if (done.webhook) process.stdout.write(`  events are sent to   ${done.webhook.url}
 `);
-  if (given["--write"]) {
-    (0, import_node_fs.appendFileSync)(given["--write"], vars, { mode: 384 });
-    process.stdout.write(`
-The variables were added to ${given["--write"]}. Keep that file out of the repository.
+  if (given["--print"] || !target || already) {
+    if (already) process.stdout.write(`
+${target} already has Cauthy's variables: replace them with these by hand.
 `);
-  } else {
     process.stdout.write(`
 Set these where the application runs. The secret is shown this once:
 
 ${vars}`);
+  } else {
+    (0, import_node_fs.appendFileSync)(target, (had && !had.endsWith("\n") ? "\n" : "") + vars, { mode: 384 });
+    process.stdout.write(`
+The variables were added to ${target}.
+`);
+    if (!ignored(target)) {
+      (0, import_node_fs.appendFileSync)(".gitignore", `${(0, import_node_fs.existsSync)(".gitignore") ? "\n" : ""}${target}
+`);
+      process.stdout.write(`${target} was added to .gitignore: it holds the client's secret.
+`);
+    }
   }
-  process.stdout.write(`
+  writeFiles(plan, given["--no-files"] !== void 0);
+}
+function writeFiles(plan, none) {
+  if (!plan || none) {
+    process.stdout.write(`
 Then, in the application:
 
   import { createCauthy } from 'cauthy-auth'
   export const auth = createCauthy()
 
-and serve auth.handler(request) under ${(given["--callback-path"] ?? "/api/auth/callback").replace(/\/callback$/, "")}/*.
+and serve auth.handler(request) under /api/auth/*.
+`);
+    return;
+  }
+  process.stdout.write("\n");
+  for (const f of plan.files) {
+    if ((0, import_node_fs.existsSync)(f.path)) {
+      process.stdout.write(`  left as it was  ${f.path} (it is already there)
 `);
+      continue;
+    }
+    (0, import_node_fs.mkdirSync)((0, import_node_path2.dirname)(f.path) || ".", { recursive: true });
+    (0, import_node_fs.writeFileSync)(f.path, f.content);
+    process.stdout.write(`  wrote           ${f.path}
+`);
+  }
+  process.stdout.write("\nWhat is left:\n\n");
+  plan.steps.forEach((step, i) => process.stdout.write(`${i + 1}. ${step}
+`));
 }
 var POLICY_HELP = `cauthy-auth policy --pull [--out <file.ts>] [--system <name>]
 cauthy-auth policy --file <roles.json> [--system <name>] [--push]
@@ -869,7 +1148,7 @@ ${POLICY_HELP}`);
     process.stdout.write("Not sent. Add --push to give it to Cauthy.\n");
   }
 }
-var HELP = `cauthy-auth init \u2026     connect an application to Cauthy (cauthy-auth init --help)
+var HELP = `cauthy-auth init \u2026     connect an application and leave signing in working (cauthy-auth init --help)
 cauthy-auth policy \u2026   load a system's catalog of roles (cauthy-auth policy --help)
 cauthy-auth theme [options]
 

package/dist/client.d.mts

@@ -6,6 +6,12 @@ import 'jose';
 
 /** Whether this browser can use a passkey at all. */
 declare function canUsePasskeys(): boolean;
+/**
+ * Whether this browser offers passkeys in the autofill of a field marked
+ * `autocomplete="username webauthn"`, so the person picks one without
+ * looking for a button.
+ */
+declare function canAutofillPasskeys(): Promise<boolean>;
 
 interface SessionState {
     /** The signed-in person and their organizations, or null. */
@@ -87,6 +93,13 @@ interface AuthMethods {
      * page that cannot, or a browser that refuses to here, sends the person.
      */
     passkeyOnCauthy: boolean;
+    /**
+     * The workspace's Cloudflare Turnstile site key, when it asks for the
+     * challenge: signing in, creating an account, and asking for a sign-in link
+     * or a new password then take its answer (`captchaToken`). The ready-made
+     * forms show it themselves.
+     */
+    captchaSiteKey?: string;
 }
 /** A passkey of the signed-in account. Moments are UTC. */
 interface Passkey {
@@ -128,6 +141,17 @@ interface LinkedIdentity {
     /** When it was linked, in UTC (ISO 8601). */
     linkedAt: string;
 }
+/** How an account takes its second step. */
+interface SecondStep {
+    totp: boolean;
+    /** The phone codes are sent to, masked (`+57 ••• ••• 4567`). */
+    phone: {
+        number: string;
+        channel: string;
+    } | null;
+    /** The ways the workspace sends codes to phones. */
+    phoneChannels: string[];
+}
 interface AccountClient {
     /** The account, or null when nobody is signed in. */
     get(): Promise<Account | null>;
@@ -166,6 +190,30 @@ interface AccountClient {
         }): Promise<AuthResult<'renewed', {
             recoveryCodes: string[];
         }>>;
+        /**
+         * How the account takes its second step: an authenticator app, a phone
+         * (masked), and the ways the workspace sends codes to phones (`sms`,
+         * `whatsapp`; none when it has no Twilio account for it).
+         */
+        factors(): Promise<SecondStep | null>;
+        /** Adds a phone as the second step: a code is sent to it, for `verifyPhone`. */
+        addPhone(form: {
+            phone: string;
+            channel: 'sms' | 'whatsapp';
+            password: string;
+        }): Promise<AuthResult<'sent', {
+            sentTo: string;
+            channel: string;
+        }>>;
+        /** Proves the phone with the code it received. `recoveryCodes` come with a first second step, shown this once. */
+        verifyPhone(form: {
+            code: string;
+        }): Promise<AuthResult<'enabled', {
+            recoveryCodes: string[];
+        }>>;
+        removePhone(form: {
+            password: string;
+        }): Promise<AuthResult<'removed'>>;
     };
     /**
      * Asks to sign in with another address. Nothing changes yet: the new address
@@ -222,6 +270,7 @@ interface AuthClient {
         email(form: {
             email: string;
             password: string;
+            captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'mfa_required'>>;
@@ -231,9 +280,23 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
+        /** While the second step is asked for: whether the account has an authenticator app, and the phone (masked) a code can be sent to. */
+        mfaMethods(): Promise<AuthResult<'ok', {
+            totp: boolean;
+            phone: {
+                number: string;
+                channel: string;
+            } | null;
+        }>>;
+        /** Sends a code to the account's phone, by SMS or WhatsApp; `mfa` takes it. A few per sign-in. */
+        mfaSendCode(): Promise<AuthResult<'sent', {
+            sentTo: string;
+            channel: string;
+        }>>;
         /** Mails a link that signs the person in. The answer is the same whether or not the address has an account. */
         magicLink(form: {
             email: string;
+            captchaToken?: string;
         }): Promise<AuthResult<'sent'>>;
         /** Signs in with the token the mailed link opened the page with (`ml_token`). */
         magicLinkVerify(form: {
@@ -261,6 +324,34 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'redirected'>>;
+        /**
+         * Offers the person's passkeys in the browser's autofill of the email
+         * field, which must carry `autocomplete="username webauthn"`, and signs in
+         * with the one they pick. It waits until they pick one or `signal`
+         * aborts: abort it before calling `passkey` or sending the form.
+         * `cancelled`: aborted, or this browser or page cannot (then there is
+         * nothing to offer, and the passkey button still works).
+         */
+        passkeyAutofill(options?: {
+            signal?: AbortSignal;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
+        /**
+         * Google One Tap: Google's prompt over the page offers the Google account
+         * the browser already has, and signs in with it in one tap, as the Google
+         * sign-in does (the same account). Needs the workspace's Google sign-in,
+         * and the page's address among the Google client's authorized JavaScript
+         * origins. Waits until the person picks an account or closes the prompt
+         * (`cancelled`), or `signal` aborts. `one_tap_unavailable`: the workspace
+         * has no Google sign-in.
+         */
+        googleOneTap(options?: {
+            signal?: AbortSignal;
+            context?: 'signin' | 'signup' | 'use';
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
         /** Where `passkey` sends the browser when this page cannot use the passkey itself. */
         passkeyUrl(options?: {
             returnTo?: string;
@@ -281,6 +372,7 @@ interface AuthClient {
             email: string;
             password: string;
             name?: string;
+            captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'verification_required', {
@@ -290,6 +382,7 @@ interface AuthClient {
     /** Mails a link to choose a new password. The answer is the same whether or not the address has an account. */
     forgotPassword(form: {
         email: string;
+        captchaToken?: string;
     }): Promise<AuthResult<'sent'>>;
     /** Sets the new password, with the token the mailed link opened the page with (`token`). */
     resetPassword(form: {
@@ -326,4 +419,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type LinkedIdentity, type Passkey, type SessionState, type SessionStore, type SessionStoreOptions, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type LinkedIdentity, type Passkey, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };