mnfst 0.5.224 → 0.5.225

package/lib/manifest.appwrite.auth.js

@@ -70,6 +70,7 @@ async function getAppwriteConfig() {
 
     const magicEnabled = authMethods.includes("magic");
     const otpEnabled = authMethods.includes("otp");
+    const phoneEnabled = authMethods.includes("phone");
     const oauthEnabled = authMethods.includes("oauth");
 
     // Teams (presence of teams object enables it)
@@ -92,7 +93,7 @@ async function getAppwriteConfig() {
         : toBool(appwriteConfig.auth.teams.authenticated);
 
     // Guest upgrade: preserve the anonymous account + teams on sign-in (magic/oauth;
-    // OTP can't convert anonymous accounts). Defaults to guestTeams.
+    // email/phone OTP can't convert anonymous accounts). Defaults to guestTeams.
     const guestUpgrade = appwriteConfig.auth?.guestUpgrade !== undefined
         ? toBool(appwriteConfig.auth.guestUpgrade)
         : guestTeams;
@@ -135,6 +136,7 @@ async function getAppwriteConfig() {
         anonymous: guestAuto, // back-compat alias
         magic: magicEnabled,
         otp: otpEnabled,
+        phone: phoneEnabled,
         oauth: oauthEnabled,
         teams: teamsEnabled,
         permanentTeams: permanentTeams,
@@ -329,10 +331,10 @@ function initializeAuthStore() {
         error: null,
         magicLinkSent: false,
         magicLinkExpired: false,
-        otpSent: false, // Email OTP: a code has been emailed and is awaiting entry
-        otpExpired: false, // Email OTP: the entered code was wrong/expired
-        otpPhrase: null, // Email OTP: security phrase to display (when enabled)
-        _otpUserId: null, // Email OTP: userId returned by createEmailToken, used by verifyOTP
+        otpSent: false, // OTP (email/phone): a code has been sent and is awaiting entry
+        otpExpired: false, // OTP (email/phone): the entered code was wrong/expired
+        otpPhrase: null, // Email OTP: security phrase to display (when enabled; phone has none)
+        _otpUserId: null, // OTP: userId returned by createEmailToken/createPhoneToken, used by verifyOTP
         teams: [], // List of user's teams
         currentTeam: null, // Currently selected/active team
         _teamsPollInterval: null, // Interval ID for teams polling (deprecated, use realtime instead)
@@ -933,7 +935,7 @@ function initializeAuthStore() {
                 this.magicLinkSent = false;
                 this.magicLinkExpired = false;
 
-                // Clear email OTP flags
+                // Clear OTP flags (email/phone)
                 this.otpSent = false;
                 this.otpExpired = false;
                 this.otpPhrase = null;
@@ -6294,7 +6296,8 @@ window.ManifestAppwriteAuthMagicLinks = {
 /* Auth email OTP (one-time passcode) */
 
 // Two-step in-page flow (no redirect): createEmailOTP(email) emails a code + returns
-// a userId, verifyOTP(code) creates the session.
+// a userId, verifyOTP(code) creates the session. verifyOTP/submitOTP are shared
+// with phone OTP (users.phone.js).
 // Gotcha: Appwrite can't convert an anonymous guest via OTP — a guest verifying an OTP
 // gets a fresh account (guest teams lost). Use magic links for guest upgrade.
 
@@ -6364,17 +6367,20 @@ function initializeEmailOTP() {
                     this._appwrite = await config.getAppwriteClient();
                 }
                 if (!this._appwrite) {
-                    return { success: false, error: 'Appwrite not configured' };
+                    this.error = 'Appwrite not configured';
+                    return { success: false, error: this.error };
                 }
 
                 // Don't allow OTP request if already signed in (non-anonymous)
                 if (this.isAuthenticated && !this.isAnonymous) {
-                    return { success: false, error: 'Already signed in. Please logout first.' };
+                    this.error = 'Already signed in. Please logout first.';
+                    return { success: false, error: this.error };
                 }
 
                 const appwriteConfig = await config.getAppwriteConfig();
                 if (appwriteConfig && !appwriteConfig.otp) {
-                    return { success: false, error: 'Email OTP authentication is not enabled' };
+                    this.error = 'Email OTP authentication is not enabled';
+                    return { success: false, error: this.error };
                 }
 
                 // OTP can't convert a guest — warn so lost guest teams aren't a surprise.
@@ -6384,10 +6390,8 @@ function initializeEmailOTP() {
 
                 const account = this._appwrite.account;
                 if (typeof account.createEmailToken !== 'function') {
-                    return {
-                        success: false,
-                        error: 'Email OTP method not available. Please ensure you are using a recent Appwrite SDK.'
-                    };
+                    this.error = 'Email OTP method not available. Please ensure you are using a recent Appwrite SDK.';
+                    return { success: false, error: this.error };
                 }
 
                 this.inProgress = true;
@@ -6433,7 +6437,8 @@ function initializeEmailOTP() {
                 const { email, inputEl, dataObj } = resolveEmailInput(emailInputOrRef);
 
                 if (!email || !email.trim()) {
-                    return { success: false, error: 'Email is required' };
+                    this.error = 'Email is required';
+                    return { success: false, error: this.error };
                 }
 
                 const result = await this.createEmailOTP(email.trim(), options);
@@ -6607,6 +6612,197 @@ window.ManifestAppwriteAuthEmailOTP = {
 };
 
 
+/* Auth phone OTP (SMS one-time passcode) */
+
+// Two-step in-page flow (no redirect): createPhoneOTP(phone) texts a code + returns
+// a userId, then the shared verifyOTP(code)/submitOTP() (users.otp.js) creates the
+// session. Phone numbers must be E.164 (+ country code).
+// Gotcha: like email OTP, Appwrite can't convert an anonymous guest via phone OTP —
+// a guest verifying a code gets a fresh account. Use magic links for guest upgrade.
+
+function initializePhoneOTP() {
+    if (typeof Alpine === 'undefined') {
+        return;
+    }
+
+    const config = window.ManifestAppwriteAuthConfig;
+    if (!config) {
+        return;
+    }
+
+    // Resolve a phone from an input/selector/{ phone } object/string, or auto-find
+    // the nearest tel input. Returns { phone, inputEl, dataObj }.
+    function resolvePhoneInput(phoneInputOrRef) {
+        let phone = null;
+        let inputEl = null;
+        let dataObj = null;
+
+        if (phoneInputOrRef === undefined || phoneInputOrRef === null) {
+            let eventTarget = (typeof window !== 'undefined' && window.event) ? window.event.target : null;
+            if (eventTarget) {
+                const form = eventTarget.closest('form');
+                const scope = form || eventTarget.parentElement;
+                if (scope) {
+                    inputEl = scope.querySelector('input[type="tel"]');
+                    if (inputEl) phone = inputEl.value;
+                }
+            }
+            if (!inputEl) {
+                inputEl = document.querySelector('input[type="tel"]');
+                if (inputEl) phone = inputEl.value;
+            }
+        } else if (typeof phoneInputOrRef === 'string') {
+            try {
+                const element = document.querySelector(phoneInputOrRef);
+                if (element && element.tagName === 'INPUT' && element.type === 'tel') {
+                    inputEl = element;
+                    phone = element.value;
+                } else {
+                    phone = phoneInputOrRef; // Treat as a direct phone string
+                }
+            } catch (e) {
+                phone = phoneInputOrRef; // Invalid selector -> treat as phone string
+            }
+        } else if (phoneInputOrRef && typeof phoneInputOrRef === 'object') {
+            if (phoneInputOrRef.tagName === 'INPUT' || phoneInputOrRef.matches?.('input[type="tel"]')) {
+                inputEl = phoneInputOrRef;
+                phone = inputEl.value;
+            } else if ('phone' in phoneInputOrRef) {
+                phone = phoneInputOrRef.phone;
+                dataObj = phoneInputOrRef;
+            }
+        }
+
+        return { phone, inputEl, dataObj };
+    }
+
+    const waitForStore = () => {
+        const store = Alpine.store('auth');
+        if (store && !store.createPhoneOTP) {
+            // Step 1: text a passcode. Verification reuses verifyOTP/submitOTP.
+            store.createPhoneOTP = async function (phone) {
+                if (!this._appwrite) {
+                    this._appwrite = await config.getAppwriteClient();
+                }
+                if (!this._appwrite) {
+                    this.error = 'Appwrite not configured';
+                    return { success: false, error: this.error };
+                }
+
+                // Don't allow OTP request if already signed in (non-anonymous)
+                if (this.isAuthenticated && !this.isAnonymous) {
+                    this.error = 'Already signed in. Please logout first.';
+                    return { success: false, error: this.error };
+                }
+
+                const appwriteConfig = await config.getAppwriteConfig();
+                if (appwriteConfig && !appwriteConfig.phone) {
+                    this.error = 'Phone OTP authentication is not enabled';
+                    return { success: false, error: this.error };
+                }
+
+                // Normalize to E.164: strip separators, require the country code.
+                const normalized = String(phone).replace(/[\s().-]/g, '');
+                if (!/^\+\d{6,15}$/.test(normalized)) {
+                    this.error = 'Phone number must be in international format, e.g. +14155550123';
+                    return { success: false, error: this.error };
+                }
+
+                // Phone OTP can't convert a guest — warn so lost guest teams aren't a surprise.
+                if (this.isAnonymous && appwriteConfig?.guestUpgrade) {
+                    console.warn('[Manifest Appwrite Auth] Phone OTP cannot upgrade a guest account (Appwrite limitation); the guest session and any guest-created teams will be replaced. Use magic links for guest upgrade.');
+                }
+
+                const account = this._appwrite.account;
+                if (typeof account.createPhoneToken !== 'function') {
+                    this.error = 'Phone OTP method not available. Please ensure you are using a recent Appwrite SDK.';
+                    return { success: false, error: this.error };
+                }
+
+                this.inProgress = true;
+                this.error = null;
+                this.otpExpired = false;
+
+                try {
+                    const uniqueId = (window.Appwrite?.ID?.unique) ? window.Appwrite.ID.unique() : 'unique()';
+                    const token = await account.createPhoneToken(uniqueId, normalized);
+
+                    // Stash the userId Appwrite assigned; verifyOTP needs it to complete login.
+                    this._otpUserId = token.userId;
+                    this.otpPhrase = null; // phone tokens have no security phrase
+                    this.otpSent = true;
+                    this.otpExpired = false;
+                    this.error = null;
+
+                    window.dispatchEvent(new CustomEvent('manifest:auth:otp-sent', {
+                        detail: { phone: normalized }
+                    }));
+
+                    return { success: true, message: 'OTP sent by SMS' };
+                } catch (error) {
+                    // Appwrite returns 501 when phone auth/SMS isn't set up — surface an
+                    // actionable message rather than the raw error.
+                    const code = error.code || error.statusCode;
+                    const notEnabled = code === 501 || /not implemented/i.test(error.message || '');
+                    this.error = notEnabled
+                        ? 'Phone OTP is not enabled for this Appwrite project. Enable Phone under Auth → Settings and configure an SMS provider under Messaging.'
+                        : error.message;
+                    this.otpSent = false;
+                    this.otpExpired = false;
+                    return { success: false, error: this.error };
+                } finally {
+                    this.inProgress = false;
+                }
+            };
+
+            // Convenience: resolve the phone from an input/selector/object/string and send.
+            // Clears the phone input on success (mirrors sendEmailOTP).
+            store.sendPhoneOTP = async function (phoneInputOrRef) {
+                const { phone, inputEl, dataObj } = resolvePhoneInput(phoneInputOrRef);
+
+                if (!phone || !String(phone).trim()) {
+                    this.error = 'Phone number is required';
+                    return { success: false, error: this.error };
+                }
+
+                const result = await this.createPhoneOTP(String(phone).trim());
+
+                if (result.success) {
+                    Promise.resolve().then(() => {
+                        if (inputEl) {
+                            inputEl.value = '';
+                            inputEl.dispatchEvent(new Event('input', { bubbles: true }));
+                        } else if (dataObj) {
+                            dataObj.phone = '';
+                        }
+                    });
+                }
+
+                return result;
+            };
+        } else if (!store) {
+            setTimeout(waitForStore, 50);
+        }
+    };
+
+    setTimeout(waitForStore, 100);
+}
+
+// Initialize when Alpine is ready
+document.addEventListener('alpine:init', () => {
+    try {
+        initializePhoneOTP();
+    } catch (error) {
+        // Failed to initialize phone OTP
+    }
+});
+
+// Export phone OTP interface
+window.ManifestAppwriteAuthPhoneOTP = {
+    initialize: initializePhoneOTP
+};
+
+
 /* Auth OAuth */
 
 // Add OAuth methods to auth store

package/lib/manifest.appwrite.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.224';
+const MANIFEST_BUILD_VERSION = '0.5.225';
 
 /* Manifest Data Sources - Appwrite Integration */
 

package/lib/manifest.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.224';
+const MANIFEST_BUILD_VERSION = '0.5.225';
 
 /* Manifest Data Sources - Configuration */
 

package/lib/manifest.integrity.json

@@ -1,6 +1,6 @@
 {
-  "manifest.appwrite.auth.js": "sha384-tcpyR3WJvAL3TenZRsevGCGCHUrGgbU5wHuOYG5Emvny/wukRiaPEagrXiH5v7R6",
-  "manifest.appwrite.data.js": "sha384-gnniX4ojmePGmJsC3KRZqP+jdIGe852Sr/XSkO+HJWljiNMeZVph5LYgYdcwoRNf",
+  "manifest.appwrite.auth.js": "sha384-eJ46LQV0lAoY48Zy1J8iecrK9azn/407FdeXz9+dwsuAJESUugOzlEBdTCw+i3m5",
+  "manifest.appwrite.data.js": "sha384-uWy++AIY+DZbiEm+Qhkqxc6OJ3E0NSzx5Mq+8TCaAAI+cCV6PSbrS84JRjYV2jNF",
   "manifest.appwrite.presences.js": "sha384-JyVDWFT69b7Svq8J8p9tNWe2v9PZNQBY5UyhtOl1vnuHFAX0CRQ3MA9SiKq5wzNh",
   "manifest.bindings.js": "sha384-lPtMf8Ykaic9gNVZKq8Scia1881ZeMAyxer3WCIkUNwwrgzGBWto1OXADUwjvORF",
   "manifest.charts.js": "sha384-gEAv/98+29RbhvNkiNWTNyBPbLTFr2Ld15wLu29FLCL57j1cwGChRrL9Pfk7dBtT",
@@ -11,7 +11,7 @@
   "manifest.combobox.js": "sha384-MILTkrgsTzsYUjGo4ZuADqV85Xs4GmfB4xexfe9vbJMIoQTZ42W4zs+DTaVSPEsx",
   "manifest.components.js": "sha384-4bc3HgPvF9DHMiOG08w+nWXI7Hho01RuAPAUL9xyLxOiS2igeZpulCVcvr5aT9v6",
   "manifest.computed.js": "sha384-GYML/e81gQfN+iDbqhPUgny8bINCyL+SrbTofoGk4hlCnLLjv51mCv42JMqq+ku5",
-  "manifest.data.js": "sha384-5kg35XDQb/nTD4oED1HxAkyAhCpfieoUhaY1oCO/vLTc6oPXiPATzyW6/95KSPLw",
+  "manifest.data.js": "sha384-YljhDHjZ6BCU7qjoeecMvG1mgC7FwR7vw1EWBAyd6ZcMAlc3nmiztv3swRckN320",
   "manifest.datepicker.js": "sha384-XnbeURni2X91ozVzatQcSjYYIS4MoW12dBRJnYAGBr0nCQ624heH5s+xtQSpLZX6",
   "manifest.defer.js": "sha384-WcCf8YQ1bKIXCLSZ24a0bJwepbYntYc8TzQM50hklo5VMIH8AtzDnwl6WU4prRv1",
   "manifest.device.js": "sha384-g+txmrEszYtuOvRelTp/c1wSNR2AtllVI9rx5NPPD7DzhVUnMNughonZykv2xlBW",
@@ -28,7 +28,7 @@
   "manifest.slides.js": "sha384-3uRTkyK9XPLmnxI2+igZlpi4EyPlU/7IHj5j3BZJJ2KN455vXyk99fiXV3feO/XY",
   "manifest.status.js": "sha384-MBO345ab7H6Uq1X2dZLt4Ge1Gcra+Z2qYApvlAeIV8CJhDDJrz2FPXpp+Kcp8zcM",
   "manifest.svg.js": "sha384-qr/8H9+2cIhSXNbRWRtIdrDlTOxKlNJqwEefHvCYoiBNW/kKhPTFa109Orv/EBnb",
-  "manifest.sw.js": "sha384-AQB+zglu9/quyKkdAo2oIiWzfgCH7UqiOmFwrS2hqfzYsaSpYeDpmjb5d2tl/RTB",
+  "manifest.sw.js": "sha384-hEYCjpYM1VHGJLc/RnSyUsmhBx/XrGhxCA31U6kW/TpFadcUZ0Uz96Rqm0uFbr+I",
   "manifest.tabs.js": "sha384-OIIcyaQnGS0eNYk4zgAFEDboNYect7THvUd9D0V6nqCeDOxQcoiqLrBEmmWVTTet",
   "manifest.tailwind.js": "sha384-r/Jvqb+Piz21jUts10BbVAJoKkShOdJRVFpywyi4HPIi/OfOJq5CtPyWAPbdkMgt",
   "manifest.text.edit.js": "sha384-RzOvLQE8GbmI6gntAwiotDewYT/08OHcd7sJ5hLon8e8u1Xbq1D7VfEGuaRVd2CE",

package/lib/manifest.sw.js

@@ -16,7 +16,7 @@
 
 // Build stamps the published version here; unstamped (dev) falls back to the
 // registration URL's `v`, then 'dev'.
-const BUILD_VERSION = '0.5.224';
+const BUILD_VERSION = '0.5.225';
 const CACHE_PREFIX = 'mnfst-sw:';
 const META_CACHE = CACHE_PREFIX + 'meta';
 // Sized to hold a full precache.json warm-up (PRECACHE_MAX_ENTRIES server-side)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mnfst",
-    "version": "0.5.224",
+    "version": "0.5.225",
     "private": false,
     "workspaces": [
         "templates/starter",