central-auth-js-sdk 1.0.10

package/core/api.js

@@ -0,0 +1,226 @@
+/**
+ * Central Auth API client
+ * Matches endpoints from central_auth_collection.json
+ * All signup/login bodies sent as FormData per collection
+ */
+
+const DEFAULT_BASE = 'http://localhost:8080';
+
+/**
+ * @param {string} baseUrl - e.g. 'http://localhost:8080'
+ * @param {Object} options - reserved (entity derived from email in backend)
+ */
+export function createApi(baseUrl = DEFAULT_BASE, options = {}) {
+  const base = baseUrl.replace(/\/$/, '');
+
+  async function request(method, path, body = null, isFormData = true) {
+    const url = path.startsWith('http') ? path : `${base}${path}`;
+    const headers = {};
+    if (!isFormData && body && typeof body === 'object' && !(body instanceof FormData)) {
+      headers['Content-Type'] = 'application/json';
+    }
+
+    const config = { method, headers };
+    if (body) {
+      if (body instanceof FormData) {
+        config.body = body;
+      } else if (typeof body === 'object') {
+        config.body = isFormData ? toFormData(body) : JSON.stringify(body);
+      }
+    }
+
+    const res = await fetch(url, config);
+    const text = await res.text();
+    let data = null;
+    try {
+      data = text ? JSON.parse(text) : null;
+    } catch {
+      data = { _raw: text };
+    }
+
+    if (!res.ok) {
+      const err = new Error(data?.message || data?.error || `HTTP ${res.status}`);
+      err.status = res.status;
+      err.data = data;
+      throw err;
+    }
+    return data;
+  }
+
+  return {
+    /** POST /signup/start — Email entry: send email OTP */
+    async signupStart(email) {
+      return request('POST', '/signup/start', { email });
+    },
+
+    /** POST /signup/email/verify — Email verify: OTP + names (entity auto-detected from email in backend) */
+    async signupEmailVerify({ email, otp, first_name, last_name }) {
+      return request('POST', '/signup/email/verify', {
+        email,
+        otp,
+        first_name,
+        last_name,
+      });
+    },
+
+    /** POST /signup/mobile/send_otp — Mobile entry: send mobile OTP */
+    async signupMobileSendOtp(email, mobile) {
+      return request('POST', '/signup/mobile/send_otp', { email, mobile });
+    },
+
+    /** POST /signup/mobile/verify — Mobile verify */
+    async signupMobileVerify(email, mobile, otp) {
+      return request('POST', '/signup/mobile/verify', { email, mobile, otp });
+    },
+
+    /** POST /signup/password/set — Password step */
+    async signupPasswordSet(email, password) {
+      return request('POST', '/signup/password/set', { email, password });
+    },
+
+    /** POST /signup/fr/enroll — Face enroll (optional). fr_image, fr_image2 as File or blob data URL */
+    async signupFrEnroll(email, frImageFile1, frImageFile2 = null) {
+      const fd = new FormData();
+      fd.append('email', email);
+      fd.append('fr_image', frImageFile1);
+      fd.append('fr_image2', frImageFile2 || frImageFile1);
+      return request('POST', '/signup/fr/enroll', fd);
+    },
+
+    // --- Social (Google / Microsoft) ---
+
+    /** GET redirect URL for Google OAuth. app_identifier only added when appIdentifier is provided. */
+    getGoogleStartUrl(redirectUri, appIdentifier) {
+      const params = new URLSearchParams({ redirect_uri: redirectUri });
+      if (appIdentifier) params.set('app_identifier', appIdentifier);
+      return `${base}/login/google/start?${params}`;
+    },
+
+    /** GET redirect URL for Microsoft OAuth. app_identifier only added when appIdentifier is provided. */
+    getMicrosoftStartUrl(redirectUri, appIdentifier) {
+      const params = new URLSearchParams({ redirect_uri: redirectUri });
+      if (appIdentifier) params.set('app_identifier', appIdentifier);
+      return `${base}/login/microsoft/start?${params}`;
+    },
+
+    /** POST /login/google/mobile/send — after OAuth, send mobile OTP. app_identifier only when provided. */
+    async googleMobileSend(loginToken, mobile, appIdentifier) {
+      const body = { login_token: loginToken, mobile };
+      if (appIdentifier) body.app_identifier = appIdentifier;
+      return request('POST', '/login/google/mobile/send', body);
+    },
+
+    async googleMobileVerify(loginToken, mobile, otp, appIdentifier) {
+      const body = { login_token: loginToken, mobile, otp };
+      if (appIdentifier) body.app_identifier = appIdentifier;
+      return request('POST', '/login/google/mobile/verify', body);
+    },
+
+    async googleFrEnroll(loginToken, frImageFile1, frImageFile2 = null, appIdentifier) {
+      const fd = new FormData();
+      fd.append('login_token', loginToken);
+      fd.append('fr_image', frImageFile1);
+      fd.append('fr_image2', frImageFile2 || frImageFile1);
+      if (appIdentifier) fd.append('app_identifier', appIdentifier);
+      return request('POST', '/login/google/fr/enroll', fd);
+    },
+
+    async microsoftMobileSend(loginToken, mobile, appIdentifier) {
+      const body = { login_token: loginToken, mobile };
+      if (appIdentifier) body.app_identifier = appIdentifier;
+      return request('POST', '/login/microsoft/mobile/send', body);
+    },
+
+    async microsoftMobileVerify(loginToken, mobile, otp, appIdentifier) {
+      const body = { login_token: loginToken, mobile, otp };
+      if (appIdentifier) body.app_identifier = appIdentifier;
+      return request('POST', '/login/microsoft/mobile/verify', body);
+    },
+
+    async microsoftFrEnroll(loginToken, frImageFile1, frImageFile2 = null, appIdentifier) {
+      const fd = new FormData();
+      fd.append('login_token', loginToken);
+      fd.append('fr_image', frImageFile1);
+      fd.append('fr_image2', frImageFile2 || frImageFile1);
+      if (appIdentifier) fd.append('app_identifier', appIdentifier);
+      return request('POST', '/login/microsoft/fr/enroll', fd);
+    },
+
+    // --- Login (custom, OTP, email+FR) ---
+
+    /** POST /login/custom — Email or mobile + password; optional fr_image, fr_image2 for FRS. app_identifier only when provided. */
+    async loginCustom(identifier, password, appIdentifier, frImageFiles = null) {
+      const body = { identifier, password };
+      if (appIdentifier) body.app_identifier = appIdentifier;
+      if (frImageFiles && frImageFiles.length) {
+        const fd = new FormData();
+        fd.append('identifier', identifier);
+        fd.append('password', password);
+        if (appIdentifier) fd.append('app_identifier', appIdentifier);
+        fd.append('fr_image', frImageFiles[0]);
+        fd.append('fr_image2', frImageFiles[1] || frImageFiles[0]);
+        return request('POST', '/login/custom', fd);
+      }
+      return request('POST', '/login/custom', body);
+    },
+
+    /** POST /otp/send — identifier (email or mobile), domain, channel (e.g. sms, email) */
+    async otpSend(identifier, domain, channel = 'sms') {
+      return request('POST', '/otp/send', { identifier, domain, channel });
+    },
+
+    /** POST /otp/verify — optional frImageFiles for 2FA */
+    async otpVerify(identifier, domain, channel, otp, frImageFiles = null) {
+      if (frImageFiles && frImageFiles.length) {
+        const fd = new FormData();
+        fd.append('identifier', identifier);
+        if (domain) fd.append('domain', domain);
+        fd.append('channel', channel);
+        fd.append('otp', otp);
+        fd.append('fr_image', frImageFiles[0]);
+        fd.append('fr_image2', frImageFiles[1] || frImageFiles[0]);
+        return request('POST', '/otp/verify', fd);
+      }
+      return request('POST', '/otp/verify', { identifier, domain, channel, otp });
+    },
+
+    /** POST /login/email/fr — Email + face only (no password). app_identifier only when provided. */
+    async loginEmailFr(email, frImageFile1, frImageFile2 = null, appIdentifier) {
+      const fd = new FormData();
+      fd.append('email', email);
+      fd.append('fr_image', frImageFile1);
+      fd.append('fr_image2', frImageFile2 || frImageFile1);
+      if (appIdentifier) fd.append('app_identifier', appIdentifier);
+      return request('POST', '/login/email/fr', fd);
+    },
+  };
+}
+
+function toFormData(obj) {
+  const fd = new FormData();
+  for (const [k, v] of Object.entries(obj)) {
+    if (v == null) continue;
+    if (v instanceof File || v instanceof Blob) {
+      fd.append(k, v);
+    } else {
+      fd.append(k, String(v));
+    }
+  }
+  return fd;
+}
+
+/**
+ * Convert a data URL (e.g. from canvas.toDataURL('image/jpeg')) to a File for FormData
+ */
+export function dataUrlToFile(dataUrl, filename = 'capture.jpg') {
+  if (!dataUrl || typeof dataUrl !== 'string' || !dataUrl.startsWith('data:')) {
+    return null;
+  }
+  const arr = dataUrl.split(',');
+  const mime = arr[0].match(/:(.*?);/)?.[1] || 'image/jpeg';
+  const bstr = atob(arr[1]);
+  let n = bstr.length;
+  const u8 = new Uint8Array(n);
+  while (n--) u8[n] = bstr.charCodeAt(n);
+  return new File([u8], filename, { type: mime });
+}

package/core/env-config.js

@@ -0,0 +1,25 @@
+/**
+ * Environment → API base URL mapping.
+ * Parent app can pass env: 'local' | 'dev' | 'staging' | 'prod' when initializing
+ * so the SDK hits the correct backend without hardcoding URLs.
+ */
+
+const DEFAULT_BASE = 'http://localhost:8080';
+
+/** @type {Record<string, string>} */
+export const ENV_API_URLS = {
+  local: 'http://localhost:8080',
+  dev: 'https://central-auth-dev.soham.ai/apis',
+  staging: 'https://central-auth-staging.soham.ai/apis',
+  prod: 'https://central-auth.soham.ai/apis',
+};
+
+/**
+ * Resolve API base URL from env. Only env is supported; defaults to 'local' if missing/invalid.
+ * @param {Object} config - Must have env: 'local' | 'dev' | 'staging' | 'prod'
+ * @returns {string} Base URL (no trailing slash)
+ */
+export function resolveApiBaseUrl(config = {}) {
+  const env = (config.env && String(config.env).toLowerCase()) || 'local';
+  return ENV_API_URLS[env] || DEFAULT_BASE;
+}

package/core/events.js

@@ -0,0 +1,28 @@
+/**
+ * Event Bus - Decouples UI from business logic
+ * UI emits events; core handles them; APIs integrate in handlers
+ */
+
+export function createEventBus() {
+  const handlers = new Map();
+
+  return {
+    on(event, handler) {
+      if (!handlers.has(event)) handlers.set(event, new Set());
+      handlers.get(event).add(handler);
+      return () => handlers.get(event)?.delete(handler);
+    },
+
+    emit(event, payload) {
+      handlers.get(event)?.forEach((fn) => fn(payload));
+    },
+
+    off(event, handler) {
+      if (handler) {
+        handlers.get(event)?.delete(handler);
+      } else {
+        handlers.delete(event);
+      }
+    },
+  };
+}

package/core/flow.js

@@ -0,0 +1,131 @@
+/**
+ * Flow Controller - Business logic for signup flow
+ * Keeps UI layer separate; APIs can be integrated here later
+ */
+
+export const STEPS = {
+  EMAIL: 'email',
+  EMAIL_VERIFY: 'emailVerify',
+  MOBILE: 'mobile',
+  MOBILE_VERIFY: 'mobileVerify',
+  PASSWORD: 'password',
+  FACE: 'face',
+  SUCCESS: 'success',
+};
+
+export const FLOW_TYPES = {
+  STANDARD: 'standard',
+  SOCIAL: 'social',
+};
+
+const STEP_ORDER = {
+  [FLOW_TYPES.STANDARD]: [
+    STEPS.EMAIL,
+    STEPS.EMAIL_VERIFY,
+    STEPS.MOBILE,
+    STEPS.MOBILE_VERIFY,
+    STEPS.PASSWORD,
+    STEPS.FACE,
+    STEPS.SUCCESS,
+  ],
+  [FLOW_TYPES.SOCIAL]: [
+    STEPS.EMAIL,
+    STEPS.MOBILE,
+    STEPS.MOBILE_VERIFY,
+    STEPS.FACE,
+    STEPS.SUCCESS,
+  ],
+};
+
+/**
+ * Flow controller - manages step navigation and flow type
+ * API integration points are stubbed for later implementation
+ */
+export class FlowController {
+  constructor() {
+    this.flowType = FLOW_TYPES.STANDARD;
+    this.currentStep = STEPS.EMAIL;
+    this.listeners = new Set();
+  }
+
+  getSteps() {
+    return [...STEP_ORDER[this.flowType]];
+  }
+
+  getStepIndex() {
+    return this.getSteps().indexOf(this.currentStep);
+  }
+
+  getCurrentStep() {
+    return this.currentStep;
+  }
+
+  getTotalSteps() {
+    return this.getSteps().length;
+  }
+
+  getProgress() {
+    const idx = this.getStepIndex();
+    const total = this.getTotalSteps();
+    return { current: idx + 1, total };
+  }
+
+  canGoNext() {
+    return this.getStepIndex() < this.getTotalSteps() - 1;
+  }
+
+  canGoBack() {
+    return this.getStepIndex() > 0;
+  }
+
+  goNext() {
+    if (this.canGoNext()) {
+      const steps = this.getSteps();
+      this.currentStep = steps[this.getStepIndex() + 1];
+      this._notify();
+      return true;
+    }
+    return false;
+  }
+
+  goBack() {
+    if (this.canGoBack()) {
+      const steps = this.getSteps();
+      this.currentStep = steps[this.getStepIndex() - 1];
+      this._notify();
+      return true;
+    }
+    return false;
+  }
+
+  setStep(step) {
+    if (this.getSteps().includes(step)) {
+      this.currentStep = step;
+      this._notify();
+      return true;
+    }
+    return false;
+  }
+
+  setSocialFlow(email) {
+    this.flowType = FLOW_TYPES.SOCIAL;
+    this.currentStep = STEPS.MOBILE;
+    this._notify();
+    return email;
+  }
+
+  setStandardFlow() {
+    this.flowType = FLOW_TYPES.STANDARD;
+    this.currentStep = STEPS.EMAIL;
+    this._notify();
+  }
+
+  subscribe(fn) {
+    this.listeners.add(fn);
+    return () => this.listeners.delete(fn);
+  }
+
+  _notify() {
+    this.listeners.forEach((fn) => fn(this));
+  }
+}

package/core/login-config.js

@@ -0,0 +1,73 @@
+/**
+ * Login configuration — which methods are enabled (set by parent app)
+ */
+
+export const LOGIN_METHODS = {
+  EMAIL_PASSWORD: 'email_password',
+  MOBILE_PASSWORD: 'mobile_password',
+  EMAIL_OTP: 'email_otp',
+  MOBILE_OTP: 'mobile_otp',
+  SOCIAL_GOOGLE: 'social_google',
+  SOCIAL_MICROSOFT: 'social_microsoft',
+  EMAIL_FRS: 'email_frs',
+};
+
+/** Default: all methods off; parent must enable explicitly */
+export function getDefaultLoginConfig() {
+  return {
+    emailPassword: false,
+    mobilePassword: false,
+    emailOtp: false,
+    mobileOtp: false,
+    social: { google: false, microsoft: false },
+    emailFrs: false,
+    frsAsSecondFactor: false,
+    appIdentifier: undefined,
+  };
+}
+
+/**
+ * Normalize and validate config from parent
+ * @param {Object} config - from mount(container, { loginMethods: {...}, frsAsSecondFactor: true })
+ * @returns {Object} normalized config
+ */
+export function normalizeLoginConfig(config = {}) {
+  const defaults = getDefaultLoginConfig();
+  const loginMethods = config.loginMethods && typeof config.loginMethods === 'object' ? config.loginMethods : {};
+  const c = {
+    ...defaults,
+    ...loginMethods,
+    ...config,
+    social: {
+      ...defaults.social,
+      ...(loginMethods.social && typeof loginMethods.social === 'object' ? loginMethods.social : {}),
+      ...(config.social && typeof config.social === 'object' ? config.social : {}),
+    },
+  };
+  return {
+    emailPassword: !!c.emailPassword,
+    mobilePassword: !!c.mobilePassword,
+    emailOtp: !!c.emailOtp,
+    mobileOtp: !!c.mobileOtp,
+    social: {
+      google: !!((c.social && c.social.google) || c.socialGoogle),
+      microsoft: !!((c.social && c.social.microsoft) || c.socialMicrosoft),
+    },
+    emailFrs: !!c.emailFrs,
+    frsAsSecondFactor: !!c.frsAsSecondFactor,
+    appIdentifier: c.appIdentifier !== undefined && c.appIdentifier !== '' ? c.appIdentifier : undefined,
+  };
+}
+
+/** List of method keys that are enabled for the method picker */
+export function getEnabledLoginMethods(config) {
+  const methods = [];
+  if (config.emailPassword) methods.push({ id: LOGIN_METHODS.EMAIL_PASSWORD, label: 'Email + Password', icon: 'mail' });
+  if (config.mobilePassword) methods.push({ id: LOGIN_METHODS.MOBILE_PASSWORD, label: 'Mobile + Password', icon: 'phone' });
+  if (config.emailOtp) methods.push({ id: LOGIN_METHODS.EMAIL_OTP, label: 'Email + OTP', icon: 'mail' });
+  if (config.mobileOtp) methods.push({ id: LOGIN_METHODS.MOBILE_OTP, label: 'Mobile + OTP', icon: 'phone' });
+  if (config.social.google) methods.push({ id: LOGIN_METHODS.SOCIAL_GOOGLE, label: 'Google', icon: 'google' });
+  if (config.social.microsoft) methods.push({ id: LOGIN_METHODS.SOCIAL_MICROSOFT, label: 'Microsoft', icon: 'microsoft' });
+  if (config.emailFrs) methods.push({ id: LOGIN_METHODS.EMAIL_FRS, label: 'Email + Face', icon: 'face' });
+  return methods;
+}

package/core/login-flow.js

@@ -0,0 +1,148 @@
+/**
+ * Login flow controller — step sequence depends on selected method and FRS config
+ */
+
+import { LOGIN_METHODS } from './login-config.js';
+
+// Step ids used by login screens
+export const LOGIN_STEPS = {
+  METHOD_SELECT: 'method_select',
+  IDENTIFIER_EMAIL: 'identifier_email',
+  IDENTIFIER_MOBILE: 'identifier_mobile',
+  PASSWORD: 'password',
+  OTP: 'otp',
+  FRS: 'frs',
+  SUCCESS: 'success',
+};
+
+/** Steps for each method (without FRS); FRS step inserted before SUCCESS when frsAsSecondFactor */
+function getStepsForMethod(methodId, frsAsSecondFactor) {
+  const frsStep = frsAsSecondFactor ? [LOGIN_STEPS.FRS] : [];
+  switch (methodId) {
+    case LOGIN_METHODS.EMAIL_PASSWORD:
+      return [LOGIN_STEPS.IDENTIFIER_EMAIL, LOGIN_STEPS.PASSWORD, ...frsStep, LOGIN_STEPS.SUCCESS];
+    case LOGIN_METHODS.MOBILE_PASSWORD:
+      return [LOGIN_STEPS.IDENTIFIER_MOBILE, LOGIN_STEPS.PASSWORD, ...frsStep, LOGIN_STEPS.SUCCESS];
+    case LOGIN_METHODS.EMAIL_OTP:
+      return [LOGIN_STEPS.IDENTIFIER_EMAIL, LOGIN_STEPS.OTP, ...frsStep, LOGIN_STEPS.SUCCESS];
+    case LOGIN_METHODS.MOBILE_OTP:
+      return [LOGIN_STEPS.IDENTIFIER_MOBILE, LOGIN_STEPS.OTP, ...frsStep, LOGIN_STEPS.SUCCESS];
+    case LOGIN_METHODS.EMAIL_FRS:
+      return [LOGIN_STEPS.IDENTIFIER_EMAIL, LOGIN_STEPS.FRS, LOGIN_STEPS.SUCCESS];
+    case LOGIN_METHODS.SOCIAL_GOOGLE:
+    case LOGIN_METHODS.SOCIAL_MICROSOFT:
+      return [...frsStep, LOGIN_STEPS.SUCCESS]; // redirect first; after callback we may land on FRS or SUCCESS
+    default:
+      return [];
+  }
+}
+
+export class LoginFlowController {
+  constructor(config) {
+    this.config = config;
+    this.currentMethod = null;
+    this.steps = [];
+    this.stepIndex = 0;
+    this.listeners = new Set();
+  }
+
+  getCurrentStep() {
+    if (this.currentMethod === null) return LOGIN_STEPS.METHOD_SELECT;
+    if (this.steps.length === 0) return LOGIN_STEPS.METHOD_SELECT;
+    return this.steps[this.stepIndex] ?? LOGIN_STEPS.METHOD_SELECT;
+  }
+
+  getSteps() {
+    if (this.currentMethod === null) return [LOGIN_STEPS.METHOD_SELECT];
+    return [...this.steps];
+  }
+
+  getStepIndex() {
+    if (this.currentMethod === null) return 0;
+    return this.stepIndex;
+  }
+
+  getTotalSteps() {
+    return this.steps.length;
+  }
+
+  getProgress() {
+    const total = this.steps.length;
+    const current = this.stepIndex + 1;
+    return { current, total };
+  }
+
+  selectMethod(methodId) {
+    this.currentMethod = methodId;
+    this.steps = getStepsForMethod(methodId, this.config.frsAsSecondFactor);
+    this.stepIndex = 0;
+    this._notify();
+  }
+
+  goNext() {
+    if (this.stepIndex < this.steps.length - 1) {
+      this.stepIndex++;
+      this._notify();
+      return true;
+    }
+    return false;
+  }
+
+  goBack() {
+    if (this.stepIndex > 0) {
+      this.stepIndex--;
+      this._notify();
+      return true;
+    }
+    this.currentMethod = null;
+    this.steps = [];
+    this.stepIndex = 0;
+    this._notify();
+    return true;
+  }
+
+  setStep(stepId) {
+    const idx = this.steps.indexOf(stepId);
+    if (idx !== -1) {
+      this.stepIndex = idx;
+      this._notify();
+      return true;
+    }
+    return false;
+  }
+
+  /** After social OAuth callback: we're in social flow, optionally at FRS */
+  setSocialCallback(provider) {
+    this.currentMethod = provider === 'microsoft' ? LOGIN_METHODS.SOCIAL_MICROSOFT : LOGIN_METHODS.SOCIAL_GOOGLE;
+    this.steps = getStepsForMethod(this.currentMethod, this.config.frsAsSecondFactor);
+    this.stepIndex = 0;
+    this._notify();
+  }
+
+  /** Dynamically inject FRS step after the current step (used when the backend requires 2FA that wasn't anticipated by config) */
+  injectFrsStep() {
+    const currentIdx = this.stepIndex;
+    const nextIdx = currentIdx + 1;
+    if (this.steps[nextIdx] === LOGIN_STEPS.FRS) return;
+    this.steps.splice(nextIdx, 0, LOGIN_STEPS.FRS);
+    this.stepIndex = nextIdx;
+    this._notify();
+  }
+
+  /** Switch from Email+FRS to Email+OTP (e.g. no webcam); keeps identifier, sends OTP and shows OTP step */
+  switchToEmailOtp() {
+    this.currentMethod = LOGIN_METHODS.EMAIL_OTP;
+    this.steps = getStepsForMethod(this.currentMethod, this.config.frsAsSecondFactor);
+    this.stepIndex = 1;
+    this._notify();
+  }
+
+  subscribe(fn) {
+    this.listeners.add(fn);
+    return () => this.listeners.delete(fn);
+  }
+
+  _notify() {
+    this.listeners.forEach((fn) => fn(this));
+  }
+}

package/core/login-state.js

@@ -0,0 +1,50 @@
+/**
+ * Login state — identifier (email/mobile), password, otp, face capture, social token
+ */
+
+export class LoginStateManager {
+  constructor() {
+    this.data = {
+      identifier: '',
+      password: '',
+      otp: '',
+      otpChannel: 'sms',
+      faceCapture: null,
+      loginToken: null,
+      socialProvider: null,
+      error: '',
+    };
+    this.listeners = new Set();
+  }
+
+  get(key) {
+    return this.data[key];
+  }
+
+  set(key, value) {
+    this.data[key] = value;
+    this._notify(key, value);
+  }
+
+  setMultiple(updates) {
+    Object.assign(this.data, updates);
+    this._notify('*', updates);
+  }
+
+  getAll() {
+    return { ...this.data };
+  }
+
+  clearError() {
+    this.set('error', '');
+  }
+
+  subscribe(fn) {
+    this.listeners.add(fn);
+    return () => this.listeners.delete(fn);
+  }
+
+  _notify(key, value) {
+    this.listeners.forEach((fn) => fn(key, value, this.data));
+  }
+}

package/core/progress-storage.js

@@ -0,0 +1,17 @@
+/**
+ * Signup progress is not persisted in browser storage or cache.
+ * Status is always derived from the API response only (e.g. next_step from signup/verify endpoints).
+ * These exports remain as no-ops for backwards compatibility if referenced elsewhere.
+ */
+
+export function saveProgress() {
+  /* no-op: do not store in localStorage or cache */
+}
+
+export function getProgress() {
+  return null;
+}
+
+export function clearProgress() {
+  /* no-op */
+}