mnfst 0.5.224 → 0.5.226

package/lib/manifest.appwrite.auth.js

@@ -70,6 +70,7 @@ async function getAppwriteConfig() {
 
     const magicEnabled = authMethods.includes("magic");
     const otpEnabled = authMethods.includes("otp");
+    const phoneEnabled = authMethods.includes("phone");
     const oauthEnabled = authMethods.includes("oauth");
 
     // Teams (presence of teams object enables it)
@@ -92,7 +93,7 @@ async function getAppwriteConfig() {
         : toBool(appwriteConfig.auth.teams.authenticated);
 
     // Guest upgrade: preserve the anonymous account + teams on sign-in (magic/oauth;
-    // OTP can't convert anonymous accounts). Defaults to guestTeams.
+    // email/phone OTP can't convert anonymous accounts). Defaults to guestTeams.
     const guestUpgrade = appwriteConfig.auth?.guestUpgrade !== undefined
         ? toBool(appwriteConfig.auth.guestUpgrade)
         : guestTeams;
@@ -135,6 +136,7 @@ async function getAppwriteConfig() {
         anonymous: guestAuto, // back-compat alias
         magic: magicEnabled,
         otp: otpEnabled,
+        phone: phoneEnabled,
         oauth: oauthEnabled,
         teams: teamsEnabled,
         permanentTeams: permanentTeams,
@@ -253,6 +255,19 @@ function initializeAuthStore() {
         'deviceBrand', 'deviceModel', 'countryCode', 'countryName'
     ];
 
+    // User id in a mirrored state ('' / null when signed out)
+    function mirroredUserId(raw) {
+        try { const saved = JSON.parse(raw || 'null'); return saved?.isAuthenticated ? (saved.user?.$id || null) : null; } catch { return null; }
+    }
+
+    // Identity this tab is showing data for: while unverified, the last one mirrored
+    function shownUserId(store, mirrored) {
+        if (store.user?.$id) return store.user.$id;
+        if (!store._sessionUnverified) return null;
+        if (mirrored === undefined) { try { mirrored = localStorage.getItem(STORAGE_KEY); } catch { mirrored = null; } }
+        return mirroredUserId(mirrored);
+    }
+
     function sanitizeSessionForStorage(session) {
         if (!session || typeof session !== 'object') return session;
         const safe = {};
@@ -269,7 +284,8 @@ function initializeAuthStore() {
                 const state = JSON.parse(e.newValue);
                 const store = Alpine.store('auth');
                 if (store) {
-                    const prevId = store.user?.$id || null;
+                    const prevId = shownUserId(store, e.oldValue);
+                    const wasAuthenticated = store.isAuthenticated === true;
                     // Update store state from other tab
                     store._authEpoch++;
                     if (state.isAuthenticated) markVerified(store);
@@ -281,6 +297,8 @@ function initializeAuthStore() {
                     store.magicLinkExpired = state.magicLinkExpired || false;
                     store.otpSent = state.otpSent || false;
                     store.otpExpired = state.otpExpired || false;
+                    // A code row shown here must be verifiable here
+                    if (state.otpSent && state.otpUserId) store._otpUserId = state.otpUserId;
                     store.error = state.error;
                     // Identity ended or changed in another tab: scoped data must drop this tab's rows
                     const nextId = state.isAuthenticated ? (state.user?.$id || null) : null;
@@ -290,6 +308,9 @@ function initializeAuthStore() {
                             store.currentTeam = null;
                         }
                         window.dispatchEvent(new CustomEvent('manifest:auth:session-cleared'));
+                    } else if (nextId && !wasAuthenticated) {
+                        // Signed in from another tab: this tab's identity-bound data reloads
+                        window.dispatchEvent(new CustomEvent(state.isAnonymous ? 'manifest:auth:anonymous' : 'manifest:auth:login', { detail: { user: state.user, crossTab: true } }));
                     }
                 }
             } catch (error) {
@@ -312,6 +333,7 @@ function initializeAuthStore() {
                 magicLinkExpired: store.magicLinkExpired,
                 otpSent: store.otpSent,
                 otpExpired: store.otpExpired,
+                otpUserId: store.otpSent ? store._otpUserId : null,
                 error: store.error
             };
             localStorage.setItem(STORAGE_KEY, JSON.stringify(state));
@@ -329,10 +351,11 @@ function initializeAuthStore() {
         error: null,
         magicLinkSent: false,
         magicLinkExpired: false,
-        otpSent: false, // Email OTP: a code has been emailed and is awaiting entry
-        otpExpired: false, // Email OTP: the entered code was wrong/expired
-        otpPhrase: null, // Email OTP: security phrase to display (when enabled)
-        _otpUserId: null, // Email OTP: userId returned by createEmailToken, used by verifyOTP
+        otpSent: false, // OTP (email/phone): a code has been sent and is awaiting entry
+        otpExpired: false, // OTP (email/phone): the entered code was wrong/expired
+        otpPhrase: null, // Email OTP: security phrase to display (when enabled; phone has none)
+        _otpUserId: null, // OTP: userId returned by createEmailToken/createPhoneToken, used by verifyOTP
+        _otpMigrationTicket: null, // OTP: { ticket, userId } guest-migration ticket, kept across failed verify attempts
         teams: [], // List of user's teams
         currentTeam: null, // Currently selected/active team
         _teamsPollInterval: null, // Interval ID for teams polling (deprecated, use realtime instead)
@@ -711,9 +734,12 @@ function initializeAuthStore() {
             } catch (error) {
                 if (!current()) return;
                 if (!isNoSession(error)) { scheduleRecheck(this); return; }
+                const prevId = shownUserId(this);
                 this._clearIdentity();
                 markVerified(this);
                 syncStateToStorage(this);
+                // Rows shown for the last-known user drop
+                if (prevId) window.dispatchEvent(new CustomEvent('manifest:auth:session-cleared'));
                 if (this._guestAuto && this._createAnonymousSession) await this._createAnonymousSession();
                 return;
             } finally {
@@ -905,6 +931,9 @@ function initializeAuthStore() {
                 return { success: false, error: 'Appwrite not configured' };
             }
 
+            // A ticket kept from a failed guest OTP must not outlive an explicit logout
+            this._otpMigrationTicket = null;
+
             // If not authenticated, nothing to logout from
             if (!this.isAuthenticated) {
                 return { success: true };
@@ -933,7 +962,7 @@ function initializeAuthStore() {
                 this.magicLinkSent = false;
                 this.magicLinkExpired = false;
 
-                // Clear email OTP flags
+                // Clear OTP flags (email/phone)
                 this.otpSent = false;
                 this.otpExpired = false;
                 this.otpPhrase = null;
@@ -1078,12 +1107,18 @@ function initializeAuthStore() {
                 return this.user;
             } catch (error) {
                 if (!isNoSession(error)) throw error;
+                const prevId = shownUserId(this);
                 markVerified(this);
                 this.isAuthenticated = false;
                 this.isAnonymous = false;
                 this.user = null;
                 this.session = null;
                 syncStateToStorage(this);
+                if (prevId) {
+                    this.teams = [];
+                    this.currentTeam = null;
+                    window.dispatchEvent(new CustomEvent('manifest:auth:session-cleared'));
+                }
                 throw error;
             }
         }
@@ -6294,7 +6329,8 @@ window.ManifestAppwriteAuthMagicLinks = {
 /* Auth email OTP (one-time passcode) */
 
 // Two-step in-page flow (no redirect): createEmailOTP(email) emails a code + returns
-// a userId, verifyOTP(code) creates the session.
+// a userId, verifyOTP(code) creates the session. verifyOTP/submitOTP are shared
+// with phone OTP (users.phone.js).
 // Gotcha: Appwrite can't convert an anonymous guest via OTP — a guest verifying an OTP
 // gets a fresh account (guest teams lost). Use magic links for guest upgrade.
 
@@ -6364,17 +6400,20 @@ function initializeEmailOTP() {
                     this._appwrite = await config.getAppwriteClient();
                 }
                 if (!this._appwrite) {
-                    return { success: false, error: 'Appwrite not configured' };
+                    this.error = 'Appwrite not configured';
+                    return { success: false, error: this.error };
                 }
 
                 // Don't allow OTP request if already signed in (non-anonymous)
                 if (this.isAuthenticated && !this.isAnonymous) {
-                    return { success: false, error: 'Already signed in. Please logout first.' };
+                    this.error = 'Already signed in. Please logout first.';
+                    return { success: false, error: this.error };
                 }
 
                 const appwriteConfig = await config.getAppwriteConfig();
                 if (appwriteConfig && !appwriteConfig.otp) {
-                    return { success: false, error: 'Email OTP authentication is not enabled' };
+                    this.error = 'Email OTP authentication is not enabled';
+                    return { success: false, error: this.error };
                 }
 
                 // OTP can't convert a guest — warn so lost guest teams aren't a surprise.
@@ -6384,10 +6423,8 @@ function initializeEmailOTP() {
 
                 const account = this._appwrite.account;
                 if (typeof account.createEmailToken !== 'function') {
-                    return {
-                        success: false,
-                        error: 'Email OTP method not available. Please ensure you are using a recent Appwrite SDK.'
-                    };
+                    this.error = 'Email OTP method not available. Please ensure you are using a recent Appwrite SDK.';
+                    return { success: false, error: this.error };
                 }
 
                 this.inProgress = true;
@@ -6433,7 +6470,8 @@ function initializeEmailOTP() {
                 const { email, inputEl, dataObj } = resolveEmailInput(emailInputOrRef);
 
                 if (!email || !email.trim()) {
-                    return { success: false, error: 'Email is required' };
+                    this.error = 'Email is required';
+                    return { success: false, error: this.error };
                 }
 
                 const result = await this.createEmailOTP(email.trim(), options);
@@ -6469,26 +6507,33 @@ function initializeEmailOTP() {
 
                 this.inProgress = true;
                 this.error = null;
+                let guestEnded = false;
 
                 try {
                     const appwriteConfig = await config.getAppwriteConfig();
                     const wasGuest = this.isAnonymous;
 
-                    // Guest team carryover: issue the migration ticket now, while the guest
-                    // session is still authenticated; redeemed after the new session exists.
-                    let migrationTicket = null;
+                    // Guest team carryover: issue the migration ticket while the guest session
+                    // still authenticates. Kept on the store, bound to this code's account, so a
+                    // retry after a wrong code redeems it and no other sign-in can.
                     if (wasGuest && appwriteConfig?.guestMigrationFunctionId && this._callGuestMigration) {
                         const prep = await this._callGuestMigration('/prepare', {});
-                        if (prep?.ok && prep.ticket) migrationTicket = prep.ticket;
+                        if (prep?.ok && prep.ticket) {
+                            this._otpMigrationTicket = { ticket: prep.ticket, userId: this._otpUserId };
+                        }
                     }
+                    const kept = this._otpMigrationTicket;
+                    const migrationTicket = kept?.userId === this._otpUserId ? kept.ticket : null;
 
-                    // Appwrite can't convert anonymous accounts via OTP, so delete the
-                    // guest session first to avoid a "session prohibited" conflict.
+                    // Appwrite refuses createSession while any session is active, before it
+                    // checks the code, so the guest session must go first.
                     if (this.session && this.isAnonymous) {
                         try {
                             await this._appwrite.account.deleteSession(this.session.$id);
+                            guestEnded = true;
                         } catch (deleteError) {
-                            // Could not delete anonymous session
+                            const status = deleteError?.code || deleteError?.statusCode;
+                            guestEnded = status === 401 || status === 404;
                         }
                     }
 
@@ -6511,6 +6556,7 @@ function initializeEmailOTP() {
 
                     // Redeem the migration ticket as the new account to carry teams over.
                     // Best-effort; failure never blocks the already-successful sign-in.
+                    this._otpMigrationTicket = null;
                     if (migrationTicket && this._callGuestMigration) {
                         await this._callGuestMigration('/commit', { ticket: migrationTicket });
                     }
@@ -6536,7 +6582,7 @@ function initializeEmailOTP() {
                 } catch (error) {
                     const errorMessage = error.message || '';
                     const errorCode = error.code || error.statusCode || '';
-                    const isExpiredOrInvalid = errorMessage && (
+                    const isExpiredOrInvalid = error.type !== 'user_session_already_exists' && errorMessage && (
                         errorMessage.includes('expired') ||
                         errorMessage.includes('Invalid token') ||
                         errorMessage.includes('invalid') ||
@@ -6546,14 +6592,30 @@ function initializeEmailOTP() {
 
                     this.otpExpired = !!isExpiredOrInvalid;
                     this.error = isExpiredOrInvalid ? null : error.message;
-                    this.isAuthenticated = false;
-                    this.isAnonymous = false;
+
+                    // Guest session is gone though sign-in failed: drop its identity and teams.
+                    // otpSent, the code's userId and the migration ticket stay for a retry.
+                    if (guestEnded) {
+                        this.isAuthenticated = false;
+                        this.isAnonymous = false;
+                        this.user = null;
+                        this.session = null;
+                        if (this._resetTeamsState) {
+                            this._resetTeamsState();
+                        }
+                    }
 
                     if (this._syncStateToStorage) {
                         this._syncStateToStorage(this);
                     }
 
-                    return { success: false, error: error.message };
+                    if (guestEnded) {
+                        window.dispatchEvent(new CustomEvent('manifest:auth:session-cleared', {
+                            detail: { reason: 'otp-failed' }
+                        }));
+                    }
+
+                    return { success: false, error: error.message, guestEnded };
                 } finally {
                     this.inProgress = false;
                 }
@@ -6607,6 +6669,197 @@ window.ManifestAppwriteAuthEmailOTP = {
 };
 
 
+/* Auth phone OTP (SMS one-time passcode) */
+
+// Two-step in-page flow (no redirect): createPhoneOTP(phone) texts a code + returns
+// a userId, then the shared verifyOTP(code)/submitOTP() (users.otp.js) creates the
+// session. Phone numbers must be E.164 (+ country code).
+// Gotcha: like email OTP, Appwrite can't convert an anonymous guest via phone OTP —
+// a guest verifying a code gets a fresh account. Use magic links for guest upgrade.
+
+function initializePhoneOTP() {
+    if (typeof Alpine === 'undefined') {
+        return;
+    }
+
+    const config = window.ManifestAppwriteAuthConfig;
+    if (!config) {
+        return;
+    }
+
+    // Resolve a phone from an input/selector/{ phone } object/string, or auto-find
+    // the nearest tel input. Returns { phone, inputEl, dataObj }.
+    function resolvePhoneInput(phoneInputOrRef) {
+        let phone = null;
+        let inputEl = null;
+        let dataObj = null;
+
+        if (phoneInputOrRef === undefined || phoneInputOrRef === null) {
+            let eventTarget = (typeof window !== 'undefined' && window.event) ? window.event.target : null;
+            if (eventTarget) {
+                const form = eventTarget.closest('form');
+                const scope = form || eventTarget.parentElement;
+                if (scope) {
+                    inputEl = scope.querySelector('input[type="tel"]');
+                    if (inputEl) phone = inputEl.value;
+                }
+            }
+            if (!inputEl) {
+                inputEl = document.querySelector('input[type="tel"]');
+                if (inputEl) phone = inputEl.value;
+            }
+        } else if (typeof phoneInputOrRef === 'string') {
+            try {
+                const element = document.querySelector(phoneInputOrRef);
+                if (element && element.tagName === 'INPUT' && element.type === 'tel') {
+                    inputEl = element;
+                    phone = element.value;
+                } else {
+                    phone = phoneInputOrRef; // Treat as a direct phone string
+                }
+            } catch (e) {
+                phone = phoneInputOrRef; // Invalid selector -> treat as phone string
+            }
+        } else if (phoneInputOrRef && typeof phoneInputOrRef === 'object') {
+            if (phoneInputOrRef.tagName === 'INPUT' || phoneInputOrRef.matches?.('input[type="tel"]')) {
+                inputEl = phoneInputOrRef;
+                phone = inputEl.value;
+            } else if ('phone' in phoneInputOrRef) {
+                phone = phoneInputOrRef.phone;
+                dataObj = phoneInputOrRef;
+            }
+        }
+
+        return { phone, inputEl, dataObj };
+    }
+
+    const waitForStore = () => {
+        const store = Alpine.store('auth');
+        if (store && !store.createPhoneOTP) {
+            // Step 1: text a passcode. Verification reuses verifyOTP/submitOTP.
+            store.createPhoneOTP = async function (phone) {
+                if (!this._appwrite) {
+                    this._appwrite = await config.getAppwriteClient();
+                }
+                if (!this._appwrite) {
+                    this.error = 'Appwrite not configured';
+                    return { success: false, error: this.error };
+                }
+
+                // Don't allow OTP request if already signed in (non-anonymous)
+                if (this.isAuthenticated && !this.isAnonymous) {
+                    this.error = 'Already signed in. Please logout first.';
+                    return { success: false, error: this.error };
+                }
+
+                const appwriteConfig = await config.getAppwriteConfig();
+                if (appwriteConfig && !appwriteConfig.phone) {
+                    this.error = 'Phone OTP authentication is not enabled';
+                    return { success: false, error: this.error };
+                }
+
+                // Normalize to E.164: strip separators, require the country code.
+                const normalized = String(phone).replace(/[\s().-]/g, '');
+                if (!/^\+\d{6,15}$/.test(normalized)) {
+                    this.error = 'Phone number must be in international format, e.g. +14155550123';
+                    return { success: false, error: this.error };
+                }
+
+                // Phone OTP can't convert a guest — warn so lost guest teams aren't a surprise.
+                if (this.isAnonymous && appwriteConfig?.guestUpgrade) {
+                    console.warn('[Manifest Appwrite Auth] Phone OTP cannot upgrade a guest account (Appwrite limitation); the guest session and any guest-created teams will be replaced. Use magic links for guest upgrade.');
+                }
+
+                const account = this._appwrite.account;
+                if (typeof account.createPhoneToken !== 'function') {
+                    this.error = 'Phone OTP method not available. Please ensure you are using a recent Appwrite SDK.';
+                    return { success: false, error: this.error };
+                }
+
+                this.inProgress = true;
+                this.error = null;
+                this.otpExpired = false;
+
+                try {
+                    const uniqueId = (window.Appwrite?.ID?.unique) ? window.Appwrite.ID.unique() : 'unique()';
+                    const token = await account.createPhoneToken(uniqueId, normalized);
+
+                    // Stash the userId Appwrite assigned; verifyOTP needs it to complete login.
+                    this._otpUserId = token.userId;
+                    this.otpPhrase = null; // phone tokens have no security phrase
+                    this.otpSent = true;
+                    this.otpExpired = false;
+                    this.error = null;
+
+                    window.dispatchEvent(new CustomEvent('manifest:auth:otp-sent', {
+                        detail: { phone: normalized }
+                    }));
+
+                    return { success: true, message: 'OTP sent by SMS' };
+                } catch (error) {
+                    // Appwrite returns 501 when phone auth/SMS isn't set up — surface an
+                    // actionable message rather than the raw error.
+                    const code = error.code || error.statusCode;
+                    const notEnabled = code === 501 || /not implemented/i.test(error.message || '');
+                    this.error = notEnabled
+                        ? 'Phone OTP is not enabled for this Appwrite project. Enable Phone under Auth → Settings and configure an SMS provider under Messaging.'
+                        : error.message;
+                    this.otpSent = false;
+                    this.otpExpired = false;
+                    return { success: false, error: this.error };
+                } finally {
+                    this.inProgress = false;
+                }
+            };
+
+            // Convenience: resolve the phone from an input/selector/object/string and send.
+            // Clears the phone input on success (mirrors sendEmailOTP).
+            store.sendPhoneOTP = async function (phoneInputOrRef) {
+                const { phone, inputEl, dataObj } = resolvePhoneInput(phoneInputOrRef);
+
+                if (!phone || !String(phone).trim()) {
+                    this.error = 'Phone number is required';
+                    return { success: false, error: this.error };
+                }
+
+                const result = await this.createPhoneOTP(String(phone).trim());
+
+                if (result.success) {
+                    Promise.resolve().then(() => {
+                        if (inputEl) {
+                            inputEl.value = '';
+                            inputEl.dispatchEvent(new Event('input', { bubbles: true }));
+                        } else if (dataObj) {
+                            dataObj.phone = '';
+                        }
+                    });
+                }
+
+                return result;
+            };
+        } else if (!store) {
+            setTimeout(waitForStore, 50);
+        }
+    };
+
+    setTimeout(waitForStore, 100);
+}
+
+// Initialize when Alpine is ready
+document.addEventListener('alpine:init', () => {
+    try {
+        initializePhoneOTP();
+    } catch (error) {
+        // Failed to initialize phone OTP
+    }
+});
+
+// Export phone OTP interface
+window.ManifestAppwriteAuthPhoneOTP = {
+    initialize: initializePhoneOTP
+};
+
+
 /* Auth OAuth */
 
 // Add OAuth methods to auth store

package/lib/manifest.appwrite.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.224';
+const MANIFEST_BUILD_VERSION = '0.5.226';
 
 /* Manifest Data Sources - Appwrite Integration */
 

package/lib/manifest.d.ts

@@ -434,7 +434,7 @@ export interface ManifestTextEdit {
 export type ManifestDirective =
     | 'x-route' | 'x-anchors'
     | 'x-icon' | 'x-svg' | 'x-markdown' | 'x-code' | 'x-code-group'
-    | 'x-toast' | 'x-tooltip' | 'x-carousel' | 'x-virtual' | 'x-resize' | 'x-computed' | 'x-defer'
+    | 'x-toast' | 'x-tooltip' | 'x-carousel' | 'x-virtual' | 'x-computed' | 'x-defer'
     | 'x-chart' | 'x-date' | 'x-color' | 'x-colorpicker' | 'x-combobox'
     | 'x-export' | 'x-import' | 'x-pay' | 'x-files' | 'x-data-files'
     | 'x-edit' | 'x-text-edit';