herald-auth-web 0.6.9 → 0.7.0

package/dist/index.js

@@ -878,6 +878,22 @@ var handlePasskeyVerify = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
+var smsOtpSend = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/login/sms-otp/send",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var smsOtpVerify = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/login/sms-otp/verify",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
 var handleVerifyTotp = (options) => (options.client ?? client).post({
   url: "/api/auth/{realmId}/login/verify-totp",
   ...options,
@@ -1324,6 +1340,76 @@ function createAuth(deps) {
         return toLoginResult(body, deps);
       }
     },
+    loginWithSmsOtp: {
+      /**
+       * Send a passwordless SMS login code. The single 409 control-flow
+       * outcome — `phone_not_registered` (no account matches; no code is sent
+       * and none is created, DEC-phone-login-001) — resolves as
+       * `{ kind: 'conflict' }` instead of throwing. SMS OTP has no
+       * auto-register consent branch, unlike `loginWithEmailOtp.send`. All
+       * other HTTP failures throw `HeraldError`.
+       */
+      async send(payload) {
+        const { data, error, response } = await smsOtpSend({
+          client: client2,
+          path: { realmId },
+          body: {
+            clientId: deps.clientId,
+            phone: payload.phone,
+            ...payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {}
+          }
+        });
+        if (data) {
+          return {
+            kind: "sent",
+            message: data.message,
+            expiresInSeconds: data.expiresInSeconds,
+            maskedPhone: data.maskedPhone
+          };
+        }
+        const body = error ?? {};
+        if (response?.status === 409 && body["code"] === "phone_not_registered") {
+          return {
+            kind: "conflict",
+            code: String(body["code"]),
+            message: String(body["message"] ?? "")
+          };
+        }
+        throw toHeraldError(error, response);
+      },
+      /**
+       * Verify an SMS login code. On success the issued token set is applied
+       * internally and the result mirrors the other `loginWith*` verify
+       * methods. The documented 409 `phone_not_registered` (the account was
+       * anonymized between send and verify, backend `sms_otp.rs`) resolves as
+       * `{ kind: 'conflict' }` — the same shape as `send` — instead of
+       * throwing. All other HTTP failures throw `HeraldError`.
+       */
+      async verify(payload) {
+        const { data, error, response } = await smsOtpVerify({
+          client: client2,
+          path: { realmId },
+          body: {
+            clientId: deps.clientId,
+            phone: payload.phone,
+            code: payload.code,
+            ...payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {}
+          }
+        });
+        if (data) {
+          return toLoginResult(data, deps);
+        }
+        const errBody = error ?? {};
+        if (response?.status === 409 && errBody["code"] === "phone_not_registered") {
+          return {
+            kind: "conflict",
+            code: String(errBody["code"]),
+            message: String(errBody["message"] ?? "")
+          };
+        }
+        throw toHeraldError(error, response);
+      }
+    },
     async getStatus() {
       const data = await resolveOp(status({ client: client2 }));
       deps.session.emit({ type: "authenticated", session: sessionFromStatus(data, deps) });