cauthy-auth 0.30.0 → 0.32.0

package/README.md

@@ -47,21 +47,38 @@ const { signIn } = useAuth()
 const r = await signIn.email({ email, password })   // r.ok, r.status, r.error.field
 ```
 
-What Cauthy mails opens your pages too: a new password, a confirmed address, a sign-in link.
+What Cauthy mails opens your pages too: a new password, a confirmed address, a sign-in link, an invitation.
 
 ```ts
-export const auth = createCauthy({ pages: { signIn: '/sign-in', resetPassword: '/new-password', verifyEmail: '/confirm' } })
+export const auth = createCauthy({ pages: { signIn: '/sign-in', resetPassword: '/new-password', verifyEmail: '/confirm', acceptInvite: '/accept-invite' } })
 ```
 
 ```tsx
-import { ResetPassword, VerifyEmail } from 'cauthy-auth/react'
+import { AcceptInvite, ResetPassword, VerifyEmail } from 'cauthy-auth/react'
+<AcceptInvite links={{ signIn: '/sign-in' }} returnTo="/" />   // "You've been invited to Acme", a password, signed in
+<AcceptInvite onSaved={(e) => track(e.kind)} />                // 'invitation.accepted', with the address
+
+const { invitation, acceptInvitation } = useAuth()               // or with your own form
 ```
 
+The forms follow what the workspace turned on in Cauthy's dashboard: each provider's button carries its logo (`classNames.providerIcon` styles it), and a workspace that turned off the password or passkeys does not see them offered. `methods()` says so: `passwordSignIn`, `passkey`, `providers[].iconUrl`.
+
 And the person's account, in your application: name, password, second step, sessions.
 
 ```tsx
-import { Account } from 'cauthy-auth/react'
+import { Account, AccountPasskeys } from 'cauthy-auth/react'
 <Account />                                  // or: const { account } = useAuth()
+<Account sections={['profile', 'password', 'sessions']} onSaved={(e) => toast(e.kind)} />
+<AccountPasskeys />                          // each part on its own card
+```
+
+`sections` lists the parts shown, in that order: `profile`, `email`, `password`, `linked`, `secondStep`, `phone`, `passkeys`, `agents`, `sessions` (default: all). Each is also its own component: `AccountProfile`, `AccountEmail`, `AccountPassword`, `AccountLinked`, `AccountSecondStep`, `AccountPhone`, `AccountPasskeys`, `AccountAgents`, `AccountSessions`. `onSaved` is called after every change saved, with `{ kind, ... }`: `profile.saved`, `email.change_requested`, `password.changed`, `identity.linked`, `identity.unlinked`, `mfa.enabled`, `mfa.disabled`, `recovery_codes.regenerated`, `phone.added`, `phone.removed`, `passkey.added`, `passkey.removed`, `agent.disconnected`, `sessions.ended`.
+
+The legal documents a signed-in person still owes (a new version of the terms), with the action that accepts them. It shows nothing when nothing is owed:
+
+```tsx
+import { PendingTerms } from 'cauthy-auth/react'
+<PendingTerms onSuccess={() => refresh()} />  // or: account.legal(), account.acceptLegal()
 ```
 
 And the person's organizations, run by their own members: the people of one, and the organization itself. Cauthy decides each change by the person's role in the system's catalog, with their own session:
@@ -69,6 +86,12 @@ And the person's organizations, run by their own members: the people of one, and
 ```tsx
 import { OrganizationMembers } from 'cauthy-auth/react'
 <OrganizationMembers organizationId={org.id} />   // shows only what the person's role allows
+<OrganizationMembers
+  organizationId={org.id}
+  roles={(role) => role !== 'billing'}             // the roles offered when adding or changing one
+  hide={['archive', 'delete']}                    // never offered: 'archive', 'delete', 'rename', 'leave'
+  onSaved={(e) => toast(e.kind)}                  // member.added, member.role_changed, member.removed, member.left,
+/>                                                // member.invited_again, organization.renamed, .archived, .deleted
 
 const { organizations } = useAuth()
 const [org] = await organizations.list()         // org.can: { readMembers, manageMembers, removeMembers, update, archive, delete }
@@ -150,7 +173,27 @@ The ready-made forms wear the look set for your application in Cauthy's dashboar
 import 'cauthy-auth/styles.css'
 ```
 
-Or draw them with your own `components` and `classNames`, and pass `unstyled`. The dashboard can start the look from your stylesheet (shadcn/ui and Tailwind, Stackmyth, or variables of your own); `npx cauthy-auth theme --css src/app/globals.css` reads it the same way from a terminal.
+Or draw them with your own `components` and `classNames`, and pass `unstyled`. Every part the forms draw can be yours; a part not given is drawn as before. With every part given and `unstyled`, the forms add only structural wrappers (`div`, `form`, `section`, lists):
+
+```tsx
+<SignIn unstyled components={{ Button, Input, Checkbox, Select, Field, Text, Badge, Link, Divider, Alert, Confirm }} />
+```
+
+| Part | Is given |
+| --- | --- |
+| `Button` | `type`, `disabled`, `className`, `onClick`, `children` |
+| `Input` | `id`, `name`, `type`, `value`, `autoComplete`, `required`, `className`, `aria-invalid`, `aria-describedby`, `onChange(e)` |
+| `Checkbox` | `id`, `name`, `checked`, `required`, `disabled`, `className`, `onChange(checked)`, `children` (its label) |
+| `Select` | `id`, `name`, `value`, `options: { value, label }[]`, `disabled`, `className`, `aria-label`, `onChange(value)` |
+| `Field` | `id`, `label`, `aside`, `help`, `error`, `required`, `className`, `children` (the control). Give the help the id `${id}-hint` and the error `${id}-error` |
+| `Text` | `as` (`p`, `span`, `h2`), `tone` (`muted`, `danger`, `success`), `size` (`sm`, `md`, `lg`), `children` |
+| `Badge` | `tone` (`neutral`, `success`, `warning`, `danger`), `children` |
+| `Link` | `href`, `onClick`, `newTab`, `children` |
+| `Divider` | `label` |
+| `Alert` | `tone` (`danger`, `info`, `success`), `children`. Announce it: `role="alert"` or `role="status"` |
+| `Confirm` | A function, `({ title, body, confirmLabel, cancelLabel, danger }) => Promise<boolean>`: your own dialog before removing a member, leaving, archiving or deleting. Without it, the question shows inline |
+
+`texts` changes any sentence. Its keys are stable: `email`, `password`, `name`, `code`, `signIn`, `signUp`, `continueWith`, `orWithEmail`, `forgotPassword`, `noAccount`, `createAccount`, `company`, `iAccept`, `and`, `termsOfService`, `privacyPolicy`, `haveAccount`, `sendLink`, `linkSent`, `codeHelp`, `codeHelpPhone`, `codeHelpEmail`, `sendEmailAgain`, `sendCodeSms`, `sendCodeWhatsapp`, `codeSent`, `pushSend`, `pushPick`, `pushWaiting`, `phone`, `phoneHelp`, `phoneOn`, `phoneOff`, `addPhone`, `removePhone`, `bySms`, `byWhatsapp`, `channel`, `verify`, `checkEmail`, `backToSignIn`, `emailMeALink`, `usePasskey`, `codeFromMail`, `signInLinkSent`, `newPassword`, `savePassword`, `passwordChanged`, `confirming`, `emailConfirmed`, `invitedTo`, `invitedToOrganization`, `invitedAs`, `choosePassword`, `acceptInvite`, `openingInvitation`, `invitationInvalid`, `profile`, `save`, `saved`, `currentPassword`, `changePassword`, `passwordChangedHere`, `secondStep`, `secondStepOn`, `secondStepOff`, `turnOn`, `turnOff`, `addToApp`, `openInApp`, `recoveryCodes`, `newRecoveryCodes`, `keepCodes`, `passkeys`, `managePasskeys`, `passkeysHelp`, `noPasskeys`, `passkeyName`, `addPasskey` (unused), `addPasskeyDevice`, `addSecurityKey`, `passkeyKinds`, `removePasskey`, `passkeyAdded`, `passkeyUnnamed`, `sessions`, `signOutEverywhere`, `agents`, `agentsHelp`, `disconnect`, `anAgent`, `unknownDevice`, `emailAddress`, `newEmail`, `changeEmail`, `emailSent`, `linkedAccounts`, `noLinkedAccounts`, `linkWith`, `unlink`, `linked`, `ssoOnly`, `members`, `membersHidden`, `organizationMissing`, `memberYou`, `memberInvited`, `memberManager`, `memberRole`, `memberAdd`, `memberAdded`, `memberRemove`, `memberRemoveConfirm`, `memberLeave`, `memberLeaveConfirm`, `memberInviteAgain`, `memberInvitationSent`, `organization`, `organizationRename`, `organizationRenamed`, `organizationArchive`, `organizationArchiveConfirm`, `organizationArchived`, `organizationDelete`, `organizationDeleteConfirm`, `organizationDeleted`, `yes`, `cancel`, `termsChanged`, `termsChangedHelp`, `acceptTerms`, and `errors` by error code. Built in: English and Spanish (`locale`). The dashboard can start the look from your stylesheet (shadcn/ui and Tailwind, Stackmyth, or variables of your own); `npx cauthy-auth theme --css src/app/globals.css` reads it the same way from a terminal.
 
 Connect your application to Cauthy in one step, from Cauthy's dashboard ("Connect a System") or from a terminal. In the application's folder, `init` reads its framework (Next.js, TanStack Start, React Router or Remix, SvelteKit, Vite + React, Express, Hono, Fastify), makes the client, writes every variable to its env file, `CAUTHY_SECRET` included, and lays down the route and a sign-in page, never over a file that is there:
 
@@ -166,6 +209,8 @@ const org = await auth.system.organizations.create({ name: 'Acme' })
 await auth.system.members.add(org.id, { role: 'owner', email: 'ana@acme.com' })
 ```
 
+Its invitations open your `pages.acceptInvite` when the application knows its public origin (`baseURL`, `CAUTHY_BASE_URL`); otherwise Cauthy's own page.
+
 A backend that is handed a Cauthy access token checks it with Cauthy's published keys: no secret, no call per request.
 
 ```ts

package/dist/{cauthy-BXgsZ-Um.d.mts → cauthy-2jtP2LVQ.d.mts}

@@ -1,4 +1,4 @@
-import { J as JsonValue, S as Session, t as SessionStatus, s as SessionOrganization, f as CheckQuestion, k as OrganizationRef, g as CheckResult, d as CauthySystem, q as PublicSession, c as CauthyOptions } from './system-0mHrdAgO.mjs';
+import { J as JsonValue, S as Session, t as SessionStatus, s as SessionOrganization, f as CheckQuestion, k as OrganizationRef, g as CheckResult, d as CauthySystem, q as PublicSession, c as CauthyOptions } from './system-BrrJsrFW.mjs';
 import { JWTVerifyGetKey } from 'jose';
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */

package/dist/{cauthy-CHENs452.d.ts → cauthy-CKfvvv_i.d.ts}

@@ -1,4 +1,4 @@
-import { J as JsonValue, S as Session, t as SessionStatus, s as SessionOrganization, f as CheckQuestion, k as OrganizationRef, g as CheckResult, d as CauthySystem, q as PublicSession, c as CauthyOptions } from './system-BIYbS7h2.js';
+import { J as JsonValue, S as Session, t as SessionStatus, s as SessionOrganization, f as CheckQuestion, k as OrganizationRef, g as CheckResult, d as CauthySystem, q as PublicSession, c as CauthyOptions } from './system-BvvoNs2y.js';
 import { JWTVerifyGetKey } from 'jose';
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */

package/dist/cli.js

@@ -989,6 +989,8 @@ function createSystem(given = {}) {
   const envKey = env("CAUTHY_SYSTEM_KEY");
   const key = given.key ?? (envKey ? { privateKey: envKey, keyId: env("CAUTHY_SYSTEM_KEY_ID") ?? "" } : void 0);
   const ownSystem = given.system ?? env("CAUTHY_SYSTEM") ?? "";
+  const acceptInviteUrl = given.acceptInviteUrl ?? env("CAUTHY_ACCEPT_INVITE_URL") ?? "";
+  const inviteHeaders = /^https?:\/\//.test(acceptInviteUrl) ? { "x-cauthy-client-id": clientId, "x-cauthy-link-to": acceptInviteUrl } : {};
   const doFetch = (...args) => (given.fetch ?? fetch)(...args);
   const tokenEndpoint = `${issuer}/v1/oauth/token`;
   function configured() {
@@ -1031,10 +1033,10 @@ function createSystem(given = {}) {
       asking = void 0;
     });
   }
-  async function call(method, path, body) {
+  async function call(method, path, body, extra = {}) {
     const send = async () => doFetch(`${issuer}${path}`, {
       method,
-      headers: { authorization: `Bearer ${await token()}`, ...body === void 0 ? {} : { "content-type": "application/json" } },
+      headers: { authorization: `Bearer ${await token()}`, ...extra, ...body === void 0 ? {} : { "content-type": "application/json" } },
       body: body === void 0 ? void 0 : JSON.stringify(body)
     });
     let res = await send();
@@ -1045,7 +1047,7 @@ function createSystem(given = {}) {
     if (!res.ok) await fail2(res, `${method} ${path}`);
     return res.status === 204 ? void 0 : res.json();
   }
-  const data = async (method, path, body) => (await call(method, path, body))?.data;
+  const data = async (method, path, body, extra) => (await call(method, path, body, extra))?.data;
   const id = encodeURIComponent;
   return {
     token,
@@ -1082,7 +1084,8 @@ function createSystem(given = {}) {
         return toMember(await data(
           "POST",
           `/v1/organizations/${id(orgId)}/members`,
-          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId }
+          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId },
+          inviteHeaders
         ));
       },
       async setRole(orgId, userId, role) {
@@ -1093,7 +1096,7 @@ function createSystem(given = {}) {
       }
     },
     async invite(person) {
-      const u = await data("POST", "/v1/users", { ...person, client_id: clientId });
+      const u = await data("POST", "/v1/users", { ...person, client_id: clientId }, inviteHeaders);
       return { id: u.id, email: u.email };
     },
     theme: {

package/dist/client.d.mts

@@ -1,6 +1,6 @@
 import { CauthyTheme } from './theme.mjs';
-import { q as PublicSession, f as CheckQuestion, k as OrganizationRef, g as CheckResult } from './system-0mHrdAgO.mjs';
-export { h as CheckRule } from './system-0mHrdAgO.mjs';
+import { q as PublicSession, f as CheckQuestion, k as OrganizationRef, g as CheckResult } from './system-BrrJsrFW.mjs';
+export { h as CheckRule } from './system-BrrJsrFW.mjs';
 import { A as AuthField, b as PasswordPolicy } from './validate-sEXG82po.mjs';
 export { D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.mjs';
 import 'jose';
@@ -74,11 +74,25 @@ type AuthResult<S extends string, More = unknown> = ({
 };
 /** What the screen may offer. */
 interface AuthMethods {
-    /** The providers the workspace signs people in with: `{ id: 'google', name: 'Google' }`. */
+    /**
+     * The providers the workspace signs people in with and has turned on:
+     * `{ id: 'google', name: 'Google', iconUrl: 'https://…/v1/social/icons/google.svg' }`.
+     * `iconUrl` is the provider's logo, served by Cauthy; absent from a Cauthy
+     * that does not serve logos.
+     */
     providers: {
         id: string;
         name: string;
+        iconUrl?: string;
     }[];
+    /**
+     * Whether the workspace signs people in with a password. False: the
+     * password field, "forgot your password" and a sign-up with a password are
+     * not offered, and Cauthy refuses them (`password_disabled`). True from a
+     * server that does not say. (`password` is something else: the policy a new
+     * password must meet.)
+     */
+    passwordSignIn: boolean;
     /** Whether people may create an account themselves. */
     signUp: boolean;
     /** Set when the application's system makes an organization per sign-up: the form asks the company's name. */
@@ -87,7 +101,7 @@ interface AuthMethods {
         required: boolean;
     };
     magicLink: boolean;
-    /** Whether to offer a passkey. */
+    /** Whether to offer a passkey. False when the workspace turned passkeys off. */
     passkey: boolean;
     /**
      * Whether the passkey is used on this page itself. False: `signIn.passkey`
@@ -139,6 +153,15 @@ interface AuthMethods {
      */
     password?: PasswordPolicy;
 }
+/** An invitation, as its page shows it before the person chooses a password. */
+interface Invitation {
+    /** The address invited: the account the person signs in as. */
+    email: string;
+    /** The workspace's name. */
+    workspace: string;
+    /** The organization the person was invited to, when there is one. */
+    organization?: string;
+}
 /** A legal document the person owes: not yet accepted in its current version. */
 interface PendingLegal {
     kind: string;
@@ -730,7 +753,25 @@ interface AuthClient {
         token: string;
         password: string;
     }): Promise<AuthResult<'changed'>>;
-    /** Confirms the address, with the token the mailed link opened the page with (`token`). */
+    /**
+     * Who an invitation is for and to what, with the token the mailed link
+     * opened the page with (`token`). Reading it does not spend it.
+     * `invalid_token`: unknown, spent or expired.
+     */
+    invitation(token: string): Promise<AuthResult<'ok', {
+        invitation: Invitation;
+    }>>;
+    /**
+     * Accepts an invitation with the password the person chose (the workspace's
+     * policy, as for a sign-up) and signs them in. `mfa_required`: the account
+     * owes a second step; ask for the code and call `signIn.mfa`, as after
+     * `signIn.email`. A password refused leaves the invitation good.
+     */
+    acceptInvitation(token: string, password: string): Promise<AuthResult<'signed_in', {
+        session: PublicSession;
+    }> | AuthResult<'mfa_required', {
+        method?: 'email';
+    }>>;
     /** Confirms the address a mailed link is for. The person is signed in from the link when their account asks no second step. */
     verifyEmail(form: {
         token: string;
@@ -765,4 +806,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, CheckQuestion, CheckResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, OrganizationRef, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, PasswordPolicy, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, CheckQuestion, CheckResult, type ConnectedAgent, type Invitation, type LinkedIdentity, type OrganizationPerson, OrganizationRef, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, PasswordPolicy, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.d.ts

@@ -1,6 +1,6 @@
 import { CauthyTheme } from './theme.js';
-import { q as PublicSession, f as CheckQuestion, k as OrganizationRef, g as CheckResult } from './system-BIYbS7h2.js';
-export { h as CheckRule } from './system-BIYbS7h2.js';
+import { q as PublicSession, f as CheckQuestion, k as OrganizationRef, g as CheckResult } from './system-BvvoNs2y.js';
+export { h as CheckRule } from './system-BvvoNs2y.js';
 import { A as AuthField, b as PasswordPolicy } from './validate-sEXG82po.js';
 export { D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.js';
 import 'jose';
@@ -74,11 +74,25 @@ type AuthResult<S extends string, More = unknown> = ({
 };
 /** What the screen may offer. */
 interface AuthMethods {
-    /** The providers the workspace signs people in with: `{ id: 'google', name: 'Google' }`. */
+    /**
+     * The providers the workspace signs people in with and has turned on:
+     * `{ id: 'google', name: 'Google', iconUrl: 'https://…/v1/social/icons/google.svg' }`.
+     * `iconUrl` is the provider's logo, served by Cauthy; absent from a Cauthy
+     * that does not serve logos.
+     */
     providers: {
         id: string;
         name: string;
+        iconUrl?: string;
     }[];
+    /**
+     * Whether the workspace signs people in with a password. False: the
+     * password field, "forgot your password" and a sign-up with a password are
+     * not offered, and Cauthy refuses them (`password_disabled`). True from a
+     * server that does not say. (`password` is something else: the policy a new
+     * password must meet.)
+     */
+    passwordSignIn: boolean;
     /** Whether people may create an account themselves. */
     signUp: boolean;
     /** Set when the application's system makes an organization per sign-up: the form asks the company's name. */
@@ -87,7 +101,7 @@ interface AuthMethods {
         required: boolean;
     };
     magicLink: boolean;
-    /** Whether to offer a passkey. */
+    /** Whether to offer a passkey. False when the workspace turned passkeys off. */
     passkey: boolean;
     /**
      * Whether the passkey is used on this page itself. False: `signIn.passkey`
@@ -139,6 +153,15 @@ interface AuthMethods {
      */
     password?: PasswordPolicy;
 }
+/** An invitation, as its page shows it before the person chooses a password. */
+interface Invitation {
+    /** The address invited: the account the person signs in as. */
+    email: string;
+    /** The workspace's name. */
+    workspace: string;
+    /** The organization the person was invited to, when there is one. */
+    organization?: string;
+}
 /** A legal document the person owes: not yet accepted in its current version. */
 interface PendingLegal {
     kind: string;
@@ -730,7 +753,25 @@ interface AuthClient {
         token: string;
         password: string;
     }): Promise<AuthResult<'changed'>>;
-    /** Confirms the address, with the token the mailed link opened the page with (`token`). */
+    /**
+     * Who an invitation is for and to what, with the token the mailed link
+     * opened the page with (`token`). Reading it does not spend it.
+     * `invalid_token`: unknown, spent or expired.
+     */
+    invitation(token: string): Promise<AuthResult<'ok', {
+        invitation: Invitation;
+    }>>;
+    /**
+     * Accepts an invitation with the password the person chose (the workspace's
+     * policy, as for a sign-up) and signs them in. `mfa_required`: the account
+     * owes a second step; ask for the code and call `signIn.mfa`, as after
+     * `signIn.email`. A password refused leaves the invitation good.
+     */
+    acceptInvitation(token: string, password: string): Promise<AuthResult<'signed_in', {
+        session: PublicSession;
+    }> | AuthResult<'mfa_required', {
+        method?: 'email';
+    }>>;
     /** Confirms the address a mailed link is for. The person is signed in from the link when their account asks no second step. */
     verifyEmail(form: {
         token: string;
@@ -765,4 +806,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, CheckQuestion, CheckResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, OrganizationRef, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, PasswordPolicy, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, CheckQuestion, CheckResult, type ConnectedAgent, type Invitation, type LinkedIdentity, type OrganizationPerson, OrganizationRef, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, PasswordPolicy, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.js

@@ -492,11 +492,11 @@ function createAuthClient(options = {}) {
       if (res.ok) {
         const m = await res.json();
         if (m.password) policy = passwordPolicyOf(m.password);
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passwordSignIn: m.passwordSignIn !== false, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
+    return { providers: [], signUp: true, passwordSignIn: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -643,6 +643,20 @@ function createAuthClient(options = {}) {
     forgotPassword: (f) => post("/forgot-password", { email: f.email }, checkEmail(f.email), f.captchaToken),
     resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password, policy)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
+    async invitation(token) {
+      const bad = { ok: false, error: { code: "invalid_token", message: "This invitation is not valid, or it has expired." } };
+      if (typeof token !== "string" || token.trim() === "") return bad;
+      try {
+        const res = await doFetch(`${base}/invitation?token=${encodeURIComponent(token.trim())}`, { credentials: "same-origin", headers: { accept: "application/json" } });
+        const body = await res.json().catch(() => null);
+        if (res.ok && body?.invitation) return { ok: true, status: "ok", invitation: body.invitation };
+        const e = body?.error;
+        return { ok: false, error: e && typeof e.code === "string" ? { code: e.code, message: String(e.message ?? "") } : UNAVAILABLE };
+      } catch {
+        return { ok: false, error: UNAVAILABLE };
+      }
+    },
+    acceptInvitation: (token, password) => post("/invitation/accept", { token, password }, checkNewPassword(password, policy)),
     signOut: () => post("/sign-out", {}, null),
     organizations: {
       async list(system) {