@atlasauth/expo 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @atlasauth/expo changelog
 
+## 0.9.0 — 2026-11-14
+
+- `useSignInScreen()` and `useSecuritySection(kind)` drive your own native sign-in and account-security screens, with step-up handled inside.
+
+## 0.8.0 — 2026-11-14
+
+- `useStepUp()` / `withStepUp(fn)` re-verify the bearer session with the factors the account holds (passkey through `@atlasauth/expo-passkeys`) and retry the wrapped call.
+- `useAccountSecurity` / `createAccountSecurityActions` carry the security-page helpers from `@atlasauth/js`.
+- New entry `@atlasauth/expo/account-security`: no React Native import, `sideEffects: false`, usable in plain Node.
+
 ## 0.7.0 — 2026-11-13
 
 - `useAccountSecurity` / `createAccountSecurityActions` add `revokeAllTrustedDevices`.
@@ -20,6 +30,12 @@
 
 ## Unreleased
 
+## 0.10.0 — 2026-11-14
+
+- `usePushDevices()` registers a phone for "Approve in your app" without enrolling push as a second factor.
+- `useStepUp` offers a texted code (`phone_code`) when the account has a verified phone.
+- Requires `@atlasauth/js` 0.44.0 or later.
+
 ### Added
 
 - `useAppApproval(id)`: approve-in-your-app for the signed-in app. Reads the pending request, polls while it is pending, and offers `approve(number)` and `deny()` with the shuffled number choices.

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export * from './policies';
 export * from './social';
 export * from './bridge';
 export * from './app-approval';
+export * from './push-devices';
 export * from './account-security';
 export { getCaptchaToken, solveAtlasChallengeNative, atlasHeadlessCaptchaSolver, installAtlasCaptchaSolver, type SolveCaptchaOptions, type GetCaptchaTokenOptions, } from '@atlasauth/react-native';
 export * from './account-security-hook';

package/dist/index.js

@@ -50,6 +50,7 @@ __exportStar(require("./policies"), exports);
 __exportStar(require("./social"), exports);
 __exportStar(require("./bridge"), exports);
 __exportStar(require("./app-approval"), exports);
+__exportStar(require("./push-devices"), exports);
 __exportStar(require("./account-security"), exports);
 // Captcha with no browser: the proof-of-work solver for Hermes/JSC. Importing this
 // package installs it as the headless solver, so the sign-in / sign-up / reset

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,2EAA2E;AAC3E,kEAAkE;AAClE,gDAA8B;AAC9B,gDAA8B;AAC9B,kDAAgC;AAEhC,8EAA8E;AAC9E,mDAAiC;AAEjC;;;;;;;;;;GAUG;AACH,0CAW0B;AAVxB,gGAAA,OAAO,OAAA;AACP,gGAAA,OAAO,OAAA;AACP,mGAAA,UAAU,OAAA;AACV,uGAAA,cAAc,OAAA;AACd,wGAAA,eAAe,OAAA;AACf,iGAAA,QAAQ,OAAA;AACR,kGAAA,SAAS,OAAA;AACT,gGAAA,OAAO,OAAA;AACP,qGAAA,YAAY,OAAA;AACZ,oGAAA,WAAW,OAAA;AAGb,oGAAoG;AACpG,6CAA2B;AAE3B,mGAAmG;AACnG,2CAAyB;AACzB,2CAAyB;AACzB,iDAA+B;AAC/B,qDAAmC;AAEnC,mFAAmF;AACnF,+EAA+E;AAC/E,4DAA4D;AAC5D,wDAOiC;AAN/B,+GAAA,eAAe,OAAA;AACf,yHAAA,yBAAyB,OAAA;AACzB,0HAAA,0BAA0B,OAAA;AAC1B,yHAAA,yBAAyB,OAAA;AAI3B,0DAAwC;AACxC,4CAA0B;AAE1B,8GAA8G;AAC9G,4CAA0B;AAC1B,iDAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,2EAA2E;AAC3E,kEAAkE;AAClE,gDAA8B;AAC9B,gDAA8B;AAC9B,kDAAgC;AAEhC,8EAA8E;AAC9E,mDAAiC;AAEjC;;;;;;;;;;GAUG;AACH,0CAW0B;AAVxB,gGAAA,OAAO,OAAA;AACP,gGAAA,OAAO,OAAA;AACP,mGAAA,UAAU,OAAA;AACV,uGAAA,cAAc,OAAA;AACd,wGAAA,eAAe,OAAA;AACf,iGAAA,QAAQ,OAAA;AACR,kGAAA,SAAS,OAAA;AACT,gGAAA,OAAO,OAAA;AACP,qGAAA,YAAY,OAAA;AACZ,oGAAA,WAAW,OAAA;AAGb,oGAAoG;AACpG,6CAA2B;AAE3B,mGAAmG;AACnG,2CAAyB;AACzB,2CAAyB;AACzB,iDAA+B;AAC/B,iDAA+B;AAC/B,qDAAmC;AAEnC,mFAAmF;AACnF,+EAA+E;AAC/E,4DAA4D;AAC5D,wDAOiC;AAN/B,+GAAA,eAAe,OAAA;AACf,yHAAA,yBAAyB,OAAA;AACzB,0HAAA,0BAA0B,OAAA;AAC1B,yHAAA,yBAAyB,OAAA;AAI3B,0DAAwC;AACxC,4CAA0B;AAE1B,8GAA8G;AAC9G,4CAA0B;AAC1B,iDAA+B"}

package/dist/push-devices.d.ts

@@ -0,0 +1,35 @@
+import { type FapiClient, type PendingPushDevice, type PushDevice } from '@atlasauth/js';
+export interface PushDevicesController {
+    /** The device just registered, awaiting its number. Show `pending.number` to the person. */
+    pending: PendingPushDevice | null;
+    error: string | null;
+    /** Register an Expo (or native) push token for approvals only. */
+    register(input: {
+        deviceToken: string;
+        platform: PushDevice['platform'];
+        label?: string;
+    }): Promise<boolean>;
+    /** Confirm with the number the person tapped. */
+    confirm(number: string): Promise<boolean>;
+    list(): Promise<PushDevice[]>;
+    remove(id: string): Promise<boolean>;
+}
+/** Controller logic, separated from React so it is testable with a fake client. */
+export declare function createPushDeviceActions(client: FapiClient): {
+    register: (input: {
+        deviceToken: string;
+        platform: PushDevice["platform"];
+        label?: string;
+    }) => Promise<{
+        pending: PendingPushDevice | null;
+        response: import("@atlasauth/js").FapiResponse<import("@atlasauth/js").PushDeviceWire & {
+            challenge_id: string;
+            number_match: string;
+            expires_at: number;
+        }>;
+    }>;
+    confirm: (challengeId: string, number: string) => Promise<boolean>;
+    list: () => Promise<PushDevice[]>;
+    remove: (id: string) => Promise<boolean>;
+};
+export declare function usePushDevices(): PushDevicesController;

package/dist/push-devices.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPushDeviceActions = createPushDeviceActions;
+exports.usePushDevices = usePushDevices;
+/**
+ * Register this phone for "Approve in your app" pushes, without enrolling push
+ * as a second factor. A thin hook over the `@atlasauth/js` calls, bound to the
+ * provider's bearer-authenticated client.
+ */
+const react_1 = require("react");
+const js_1 = require("@atlasauth/js");
+const policies_1 = require("./policies");
+/** Controller logic, separated from React so it is testable with a fake client. */
+function createPushDeviceActions(client) {
+    return {
+        register: (input) => (0, js_1.registerApprovalDevice)(client, input),
+        confirm: async (challengeId, number) => (await (0, js_1.respondToPushDevice)(client, { challengeId, number })).ok,
+        list: () => (0, js_1.listPushDevices)(client),
+        remove: async (id) => (await (0, js_1.removePushDevice)(client, id)).ok,
+    };
+}
+function usePushDevices() {
+    const client = (0, policies_1.useExpoFapiClient)();
+    const [pending, setPending] = (0, react_1.useState)(null);
+    const [error, setError] = (0, react_1.useState)(null);
+    const actions = createPushDeviceActions(client);
+    const register = (0, react_1.useCallback)(async (input) => {
+        const { pending: next, response } = await createPushDeviceActions(client).register(input);
+        setPending(next);
+        setError(next ? null : (response.errors[0]?.message ?? 'The device could not be registered.'));
+        return next !== null;
+    }, [client]);
+    const confirm = (0, react_1.useCallback)(async (number) => {
+        if (!pending)
+            return false;
+        const ok = await createPushDeviceActions(client).confirm(pending.challengeId, number);
+        setError(ok ? null : 'The number was not accepted.');
+        if (ok)
+            setPending(null);
+        return ok;
+    }, [client, pending]);
+    return { pending, error, register, confirm, list: actions.list, remove: actions.remove };
+}
+//# sourceMappingURL=push-devices.js.map

package/dist/push-devices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-devices.js","sourceRoot":"","sources":["../src/push-devices.ts"],"names":[],"mappings":";;AAsBA,0DAOC;AAED,wCAsBC;AArDD;;;;GAIG;AACH,iCAA8C;AAC9C,sCAAyK;AACzK,yCAA+C;AAc/C,mFAAmF;AACnF,SAAgB,uBAAuB,CAAC,MAAkB;IACxD,OAAO;QACL,QAAQ,EAAE,CAAC,KAAgF,EAAE,EAAE,CAAC,IAAA,2BAAsB,EAAC,MAAM,EAAE,KAAK,CAAC;QACrI,OAAO,EAAE,KAAK,EAAE,WAAmB,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC,MAAM,IAAA,wBAAmB,EAAC,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;QACvH,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,oBAAe,EAAC,MAAM,CAAC;QACnC,MAAM,EAAE,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,CAAC,MAAM,IAAA,qBAAgB,EAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;KACtE,CAAC;AACJ,CAAC;AAED,SAAgB,cAAc;IAC5B,MAAM,MAAM,GAAG,IAAA,4BAAiB,GAAE,CAAC;IACnC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAA,gBAAQ,EAA2B,IAAI,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAAC,KAAK,EAAE,KAAgF,EAAE,EAAE;QACtH,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1F,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,qCAAqC,CAAC,CAAC,CAAC;QAC/F,OAAO,IAAI,KAAK,IAAI,CAAC;IACvB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAEb,MAAM,OAAO,GAAG,IAAA,mBAAW,EAAC,KAAK,EAAE,MAAc,EAAE,EAAE;QACnD,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACtF,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;QACrD,IAAI,EAAE;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAC3F,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/expo",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -29,7 +29,7 @@
     "@atlasauth/react-native": "^0.8.0"
   },
   "peerDependencies": {
-    "@atlasauth/js": ">=0.43.0 <1.0.0",
+    "@atlasauth/js": ">=0.44.0 <1.0.0",
     "react": ">=18",
     "react-native": ">=0.73",
     "expo-secure-store": ">=12",
@@ -58,7 +58,7 @@
     "react": "^18.3.1",
     "typescript": "^5.6.3",
     "vitest": "^3.2.7",
-    "@atlasauth/js": "0.43.0"
+    "@atlasauth/js": "0.44.0"
   },
   "publishConfig": {
     "access": "public"