cauthy-auth 0.37.0 → 0.38.0

package/README.md

@@ -76,7 +76,7 @@ import { Account, AccountPasskeys } from 'cauthy-auth/react'
 
 `sections` lists the parts shown, in that order: `profile`, `email`, `password`, `linked`, `secondStep`, `phone`, `passkeys`, `agents`, `sessions` (default: all). Each is also its own component: `AccountProfile`, `AccountEmail`, `AccountPassword`, `AccountLinked`, `AccountSecondStep`, `AccountPhone`, `AccountPasskeys`, `AccountAgents`, `AccountSessions`. `onSaved` is called after every change saved, with `{ kind, ... }`: `profile.saved`, `email.change_requested`, `password.changed`, `identity.linked`, `identity.unlinked`, `mfa.enabled`, `mfa.disabled`, `recovery_codes.regenerated`, `phone.added`, `phone.removed`, `passkey.added`, `passkey.removed`, `agent.disconnected`, `sessions.ended`.
 
-Each part shows a form only while what it sets up has nothing set yet: no second step, no phone, no passkey, no name. Once something is set, the part shows it (the name and address, "Your account has a password", the second step on, the masked phone and its channel, the passkeys with their kind and date) with its actions: "Change", "Change email", "Change password", "Turn off", "New recovery codes", "Remove phone", "Add a passkey". The form opens only when one is pressed, with a "Cancel" back; an action that weakens the account asks for the current password there, and runs at once for an account without one. Recovery codes, when made, are listed as text to select, with "Copy all" (to the clipboard, one per line) and "Download .txt" (`recovery-codes.txt`). They go nowhere else: no log, no browser storage.
+Each part shows a form only while what it sets up has nothing set yet: no second step, no phone, no passkey, no name. Once something is set, the part shows it (the name and address, "Your account has a password", the second step on, the masked phone and its channel, the passkeys with their kind and date) with its actions: "Change", "Change email", "Change password", "Turn off", "New recovery codes", "Remove phone", "Add a passkey". The form opens only when one is pressed, with a "Cancel" back; an action that weakens the account asks for the current password there, and runs at once for an account without one. Turning the second step on shows the QR code to scan (drawn by Cauthy, a PNG `data:` image; `classNames.qr` styles it), the key to type by hand, and a link that opens an authenticator app on a phone. Recovery codes, when made, are listed as text to select, with "Copy all" (to the clipboard, one per line) and "Download .txt" (`recovery-codes.txt`). They go nowhere else: no log, no browser storage.
 
 The legal documents a signed-in person still owes (a new version of the terms), with the action that accepts them. It shows nothing when nothing is owed:
 

package/dist/client.d.mts

@@ -403,12 +403,13 @@ interface AccountClient {
         kinds?: string[];
     }): Promise<AuthResult<'accepted'>>;
     mfa: {
-        /** Starts turning the second step on: show `secret` (or `otpauthUri` as a QR code) to add to an authenticator app, then call `verify`. */
+        /** Starts turning the second step on: show `qr` (the `otpauthUri` drawn by Cauthy, a PNG `data:` URI; empty from an older Cauthy) and `secret` to add to an authenticator app, then call `verify`. */
         setup(form: {
             password: string;
         }): Promise<AuthResult<'started', {
             secret: string;
             otpauthUri: string;
+            qr: string;
         }>>;
         /** Turns it on with a code from the app. `recoveryCodes` are shown this once. */
         verify(form: {

package/dist/client.d.ts

@@ -403,12 +403,13 @@ interface AccountClient {
         kinds?: string[];
     }): Promise<AuthResult<'accepted'>>;
     mfa: {
-        /** Starts turning the second step on: show `secret` (or `otpauthUri` as a QR code) to add to an authenticator app, then call `verify`. */
+        /** Starts turning the second step on: show `qr` (the `otpauthUri` drawn by Cauthy, a PNG `data:` URI; empty from an older Cauthy) and `secret` to add to an authenticator app, then call `verify`. */
         setup(form: {
             password: string;
         }): Promise<AuthResult<'started', {
             secret: string;
             otpauthUri: string;
+            qr: string;
         }>>;
         /** Turns it on with a code from the app. `recoveryCodes` are shown this once. */
         verify(form: {