@atlasauth/js 0.1.0

package/dist/native.js

@@ -0,0 +1,201 @@
+"use strict";
+/**
+ * §6 native / One-Tap sign-in — the client half.
+ *
+ * The SDK does not make HTTP calls (the app owns fetch + cookies), so this
+ * module is two pure helpers for the request/response shape plus a
+ * framework-agnostic Google Identity Services loader that resolves a credential
+ * id_token. The app posts that to `/v1/client/sign_ins/id_token` and then reads
+ * the result exactly like any other attempt (nextStep / a returned ticket).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeSignInBody = nativeSignInBody;
+exports.parseNativeSignInResponse = parseNativeSignInResponse;
+exports.loadGoogleIdentityServices = loadGoogleIdentityServices;
+exports.resetGoogleIdentityServices = resetGoogleIdentityServices;
+exports.requestGoogleCredential = requestGoogleCredential;
+exports.renderGoogleButton = renderGoogleButton;
+exports.renderGoogleOverlayButton = renderGoogleOverlayButton;
+/** Build the POST body for `/v1/client/sign_ins/id_token`. */
+function nativeSignInBody(input) {
+    return {
+        provider: input.provider,
+        id_token: input.idToken,
+        ...(input.nonce ? { nonce: input.nonce } : {}),
+    };
+}
+/**
+ * Parse the native sign-in response. A `ticket` means complete; a status
+ * without a ticket (e.g. `needs_second_factor`) means a factor is still owed —
+ * the same contract the redirect flow uses, so callers must not treat it as
+ * signed-in.
+ */
+function parseNativeSignInResponse(body) {
+    if (!body || typeof body !== 'object')
+        return null;
+    const b = body;
+    if (typeof b.id !== 'string' || typeof b.status !== 'string')
+        return null;
+    return {
+        attemptId: b.id,
+        status: b.status,
+        ...(typeof b.ticket === 'string' ? { ticket: b.ticket } : {}),
+    };
+}
+/* ---- Google Identity Services (One-Tap / GSI) ---------------------------- */
+const GSI_SRC = 'https://accounts.google.com/gsi/client';
+let gsiLoad = null;
+/** Inject the GSI script once; resolves when it is ready. */
+function loadGoogleIdentityServices(doc) {
+    if (gsiLoad)
+        return gsiLoad;
+    gsiLoad = new Promise((resolve, reject) => {
+        if (doc.querySelector(`script[src="${GSI_SRC}"]`)) {
+            resolve();
+            return;
+        }
+        const script = doc.createElement('script');
+        script.src = GSI_SRC;
+        script.async = true;
+        script.defer = true;
+        script.addEventListener('load', () => resolve());
+        script.addEventListener('error', () => reject(new Error('Failed to load Google Identity Services.')));
+        doc.head.appendChild(script);
+    });
+    return gsiLoad;
+}
+/** Reset the one-shot loader (tests). */
+function resetGoogleIdentityServices() {
+    gsiLoad = null;
+}
+/**
+ * Load GSI and resolve a Google credential (an OIDC id_token) from One-Tap.
+ * The nonce, when supplied, is embedded in the credential and MUST be echoed to
+ * the server so it can bind the token to this request.
+ */
+async function requestGoogleCredential(opts) {
+    const host = opts.host ?? window;
+    await loadGoogleIdentityServices(host.document);
+    const id = host.google?.accounts?.id;
+    if (!id)
+        throw new Error('Google Identity Services unavailable.');
+    return new Promise((resolve, reject) => {
+        id.initialize({
+            client_id: opts.clientId,
+            nonce: opts.nonce,
+            auto_select: opts.autoSelect ?? false,
+            callback: (response) => {
+                if (response.credential)
+                    resolve(response.credential);
+                else
+                    reject(new Error('Google returned no credential.'));
+            },
+        });
+        id.prompt();
+    });
+}
+/**
+ * Render the official "Sign in with Google" BUTTON into `parent` (and, when
+ * `oneTap` is set, also show the One-Tap prompt). Each resolved credential
+ * id_token is handed to `onCredential`, which the app posts to
+ * /v1/client/sign_ins/id_token. Unlike {@link requestGoogleCredential} this does
+ * not resolve once — a button can be clicked repeatedly — so it takes a
+ * callback. Framework-agnostic: the caller owns the DOM node and the fetch.
+ */
+async function renderGoogleButton(opts) {
+    const host = opts.host ?? window;
+    await loadGoogleIdentityServices(host.document);
+    const id = host.google?.accounts?.id;
+    if (!id)
+        throw new Error('Google Identity Services unavailable.');
+    id.initialize({
+        client_id: opts.clientId,
+        nonce: opts.nonce,
+        callback: (response) => {
+            if (response.credential)
+                opts.onCredential(response.credential);
+            else
+                opts.onError?.(new Error('Google returned no credential.'));
+        },
+    });
+    id.renderButton(opts.parent, opts.buttonOptions ?? { theme: 'outline', size: 'large', text: 'continue_with', width: 320 });
+    if (opts.oneTap)
+        id.prompt();
+}
+/**
+ * Render YOUR uniform button, backed by Google's real (but invisible) GSI button.
+ *
+ * Google refuses to let you style its button, and One-Tap is FedCM-flaky — so to
+ * show your OWN button while still using the secretless id_token flow, you overlay
+ * Google's real button, at opacity 0, exactly on top of your styled one. The user
+ * sees your button; the click lands on Google's, which mints the id_token. No
+ * secret, no redirect.
+ *
+ * The failure mode people hit is misalignment — the invisible button not covering
+ * the visible one, so clicks miss. This guards against it: the overlay fills the
+ * wrapper, and a ResizeObserver keeps Google's button width matched to yours so
+ * the whole surface stays clickable as the layout changes.
+ *
+ * `wrapper` is YOUR styled button (or its container); it is made position:relative
+ * if it is not already positioned. Returns `{ destroy }` to tear the overlay down.
+ */
+async function renderGoogleOverlayButton(opts) {
+    const host = opts.host ?? window;
+    const doc = host.document;
+    await loadGoogleIdentityServices(doc);
+    const id = host.google?.accounts?.id;
+    if (!id)
+        throw new Error('Google Identity Services unavailable.');
+    id.initialize({
+        client_id: opts.clientId,
+        nonce: opts.nonce,
+        callback: (response) => {
+            if (response.credential)
+                opts.onCredential(response.credential);
+            else
+                opts.onError?.(new Error('Google returned no credential.'));
+        },
+    });
+    // Ensure the wrapper can anchor an absolutely-positioned overlay.
+    const hadPosition = opts.wrapper.style.position !== '';
+    if (!hadPosition)
+        opts.wrapper.style.position = 'relative';
+    const overlay = doc.createElement('div');
+    overlay.setAttribute('aria-hidden', 'true');
+    // On top, transparent, click-catching, and it clips Google's fixed-size button
+    // to the wrapper so nothing pokes out even at opacity 0.
+    overlay.style.cssText =
+        'position:absolute;inset:0;z-index:2;opacity:0;overflow:hidden;' +
+            'display:flex;align-items:center;justify-content:center;';
+    opts.wrapper.appendChild(overlay);
+    const draw = () => {
+        // Google's button width must track the wrapper so every click lands on it;
+        // width is fixed at render time, so re-render on resize. Clamp to GSI's range.
+        const measured = Math.round(opts.wrapper.getBoundingClientRect().width) || 320;
+        const width = Math.max(200, Math.min(400, measured));
+        overlay.replaceChildren();
+        id.renderButton(overlay, {
+            type: 'standard',
+            theme: 'outline',
+            size: opts.size ?? 'large',
+            text: 'continue_with',
+            width,
+        });
+    };
+    draw();
+    let observer;
+    const RO = host.ResizeObserver ?? (typeof ResizeObserver !== 'undefined' ? ResizeObserver : undefined);
+    if (RO) {
+        observer = new RO(() => draw());
+        observer.observe(opts.wrapper);
+    }
+    return {
+        destroy: () => {
+            observer?.disconnect();
+            overlay.remove();
+            if (!hadPosition)
+                opts.wrapper.style.position = '';
+        },
+    };
+}
+//# sourceMappingURL=native.js.map

package/dist/native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AASH,4CAUC;AAeD,8DASC;AAoBD,gEAgBC;AAGD,kEAEC;AAOD,0DAuBC;AAUD,gDA8BC;AAmBD,8DAmEC;AAxOD,8DAA8D;AAC9D,SAAgB,gBAAgB,CAAC,KAIhC;IACC,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC;AASD;;;;;GAKG;AACH,SAAgB,yBAAyB,CAAC,IAAa;IACrD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAA4D,CAAC;IACvE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,MAAM,OAAO,GAAG,wCAAwC,CAAC;AACzD,IAAI,OAAO,GAAyB,IAAI,CAAC;AAczC,6DAA6D;AAC7D,SAAgB,0BAA0B,CAAC,GAAa;IACtD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9C,IAAI,GAAG,CAAC,aAAa,CAAC,eAAe,OAAO,IAAI,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC;QACrB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC,CAAC;QACtG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yCAAyC;AACzC,SAAgB,2BAA2B;IACzC,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,uBAAuB,CAAC,IAK7C;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAK,MAA6B,CAAC;IACzD,MAAM,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;IACrC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAElE,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,EAAE,CAAC,UAAU,CAAC;YACZ,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,KAAK;YACrC,QAAQ,EAAE,CAAC,QAAiC,EAAE,EAAE;gBAC9C,IAAI,QAAQ,CAAC,UAAU;oBAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;;oBACjD,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YAC3D,CAAC;SACF,CAAC,CAAC;QACH,EAAE,CAAC,MAAM,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CAAC,IAWxC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAK,MAA6B,CAAC;IACzD,MAAM,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;IACrC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAElE,EAAE,CAAC,UAAU,CAAC;QACZ,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,CAAC,QAAiC,EAAE,EAAE;YAC9C,IAAI,QAAQ,CAAC,UAAU;gBAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;;gBAC3D,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;QACnE,CAAC;KACF,CAAC,CAAC;IACH,EAAE,CAAC,YAAY,CACb,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,aAAa,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAC7F,CAAC;IACF,IAAI,IAAI,CAAC,MAAM;QAAE,EAAE,CAAC,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,UAAU,yBAAyB,CAAC,IAQ/C;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAK,MAA6B,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC1B,MAAM,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;IACrC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAElE,EAAE,CAAC,UAAU,CAAC;QACZ,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,CAAC,QAAiC,EAAE,EAAE;YAC9C,IAAI,QAAQ,CAAC,UAAU;gBAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;;gBAC3D,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;QACnE,CAAC;KACF,CAAC,CAAC;IAEH,kEAAkE;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,EAAE,CAAC;IACvD,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,UAAU,CAAC;IAE3D,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC5C,+EAA+E;IAC/E,yDAAyD;IACzD,OAAO,CAAC,KAAK,CAAC,OAAO;QACnB,gEAAgE;YAChE,yDAAyD,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAElC,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,2EAA2E;QAC3E,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,eAAe,EAAE,CAAC;QAC1B,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE;YACvB,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO;YAC1B,IAAI,EAAE,eAAe;YACrB,KAAK;SACN,CAAC,CAAC;IACL,CAAC,CAAC;IACF,IAAI,EAAE,CAAC;IAEP,IAAI,QAAoC,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvG,IAAI,EAAE,EAAE,CAAC;QACP,QAAQ,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAChC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,QAAQ,EAAE,UAAU,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,WAAW;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/passkey.d.ts

@@ -0,0 +1,70 @@
+/**
+ * §5.5 passkeys / WebAuthn — the client half.
+ *
+ * The browser ceremony (navigator.credentials.create / .get) can only run on the
+ * client, so these helpers turn a server `begin` response into the arguments for
+ * that ceremony, run it, and produce the `finish` POST body. The caller owns the
+ * two HTTP calls (begin → helper → finish), matching the SDK's "the app owns
+ * fetch + cookies" model (see native.ts). Everything is injectable via `host`,
+ * so it is unit-testable without a real authenticator or DOM.
+ *
+ * Server routes these pair with:
+ *   register: POST /v1/client/me/passkeys/begin → create → /finish
+ *   sign in : POST /v1/client/sign_ins/passkey/begin → get → /finish
+ */
+/** The slice of `navigator` these helpers need — injectable for tests. */
+export interface WebAuthnHost {
+    credentials: {
+        create(options: {
+            publicKey: PublicKeyCredentialCreationOptions;
+            signal?: AbortSignal;
+        }): Promise<Credential | null>;
+        get(options: {
+            publicKey: PublicKeyCredentialRequestOptions;
+            mediation?: 'silent' | 'optional' | 'conditional' | 'required';
+            signal?: AbortSignal;
+        }): Promise<Credential | null>;
+    };
+}
+/** ArrayBuffer/Uint8Array → base64url (no padding). */
+export declare function bufferToBase64Url(buf: ArrayBuffer | Uint8Array): string;
+/** base64url (padded or not) → ArrayBuffer. */
+export declare function base64UrlToBuffer(value: string): ArrayBuffer;
+/** True when the runtime supports the WebAuthn API. */
+export declare function passkeysSupported(host?: unknown): boolean;
+/** Whether conditional-UI (autofill) discovery is available (best-effort). */
+export declare function conditionalUiAvailable(): Promise<boolean>;
+/** The POST body for /v1/client/me/passkeys/finish. */
+export interface PasskeyRegistrationBody {
+    challenge: string;
+    attestation_object: string;
+    client_data_json: string;
+    name?: string;
+}
+/**
+ * Run navigator.credentials.create from a `/passkeys/begin` response and return
+ * the `/finish` body. `begin` is the JSON the server sent (challenge, rp, user,
+ * pubKeyCredParams, excludeCredentials, … — all base64url where it is bytes).
+ */
+export declare function createPasskey(begin: Record<string, unknown>, opts?: {
+    name?: string;
+    host?: WebAuthnHost;
+}): Promise<PasskeyRegistrationBody>;
+/** The POST body for /v1/client/sign_ins/passkey/finish. */
+export interface PasskeyAssertionBody {
+    handle: string;
+    challenge: string;
+    credential_id: string;
+    authenticator_data: string;
+    client_data_json: string;
+    signature: string;
+}
+/**
+ * Run navigator.credentials.get from a `/sign_ins/passkey/begin` response and
+ * return the `/finish` body. Pass `mediation: 'conditional'` for autofill UI.
+ */
+export declare function getPasskeyAssertion(begin: Record<string, unknown>, opts?: {
+    host?: WebAuthnHost;
+    mediation?: 'optional' | 'conditional';
+    signal?: AbortSignal;
+}): Promise<PasskeyAssertionBody>;

package/dist/passkey.js

@@ -0,0 +1,126 @@
+"use strict";
+/**
+ * §5.5 passkeys / WebAuthn — the client half.
+ *
+ * The browser ceremony (navigator.credentials.create / .get) can only run on the
+ * client, so these helpers turn a server `begin` response into the arguments for
+ * that ceremony, run it, and produce the `finish` POST body. The caller owns the
+ * two HTTP calls (begin → helper → finish), matching the SDK's "the app owns
+ * fetch + cookies" model (see native.ts). Everything is injectable via `host`,
+ * so it is unit-testable without a real authenticator or DOM.
+ *
+ * Server routes these pair with:
+ *   register: POST /v1/client/me/passkeys/begin → create → /finish
+ *   sign in : POST /v1/client/sign_ins/passkey/begin → get → /finish
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bufferToBase64Url = bufferToBase64Url;
+exports.base64UrlToBuffer = base64UrlToBuffer;
+exports.passkeysSupported = passkeysSupported;
+exports.conditionalUiAvailable = conditionalUiAvailable;
+exports.createPasskey = createPasskey;
+exports.getPasskeyAssertion = getPasskeyAssertion;
+const defaultHost = () => {
+    const nav = globalThis.navigator;
+    if (!nav || !nav.credentials) {
+        throw new Error('WebAuthn is not available in this environment.');
+    }
+    return nav;
+};
+/** ArrayBuffer/Uint8Array → base64url (no padding). */
+function bufferToBase64Url(buf) {
+    const bytes = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
+    let bin = '';
+    for (let i = 0; i < bytes.length; i += 1)
+        bin += String.fromCharCode(bytes[i]);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** base64url (padded or not) → ArrayBuffer. */
+function base64UrlToBuffer(value) {
+    const norm = value.replace(/-/g, '+').replace(/_/g, '/');
+    const pad = norm.length % 4 === 0 ? '' : '='.repeat(4 - (norm.length % 4));
+    const bin = atob(norm + pad);
+    const bytes = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i += 1)
+        bytes[i] = bin.charCodeAt(i);
+    return bytes.buffer;
+}
+/** True when the runtime supports the WebAuthn API. */
+function passkeysSupported(host) {
+    const h = host ?? globalThis.PublicKeyCredential;
+    return typeof h !== 'undefined';
+}
+/** Whether conditional-UI (autofill) discovery is available (best-effort). */
+async function conditionalUiAvailable() {
+    const PK = globalThis
+        .PublicKeyCredential;
+    try {
+        return (await PK?.isConditionalMediationAvailable?.()) === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Run navigator.credentials.create from a `/passkeys/begin` response and return
+ * the `/finish` body. `begin` is the JSON the server sent (challenge, rp, user,
+ * pubKeyCredParams, excludeCredentials, … — all base64url where it is bytes).
+ */
+async function createPasskey(begin, opts = {}) {
+    const host = opts.host ?? defaultHost();
+    const user = begin.user;
+    const exclude = begin.excludeCredentials ?? [];
+    const publicKey = {
+        challenge: base64UrlToBuffer(begin.challenge),
+        rp: begin.rp,
+        user: { ...user, id: base64UrlToBuffer(user.id) },
+        pubKeyCredParams: begin.pubKeyCredParams,
+        excludeCredentials: exclude.map((c) => ({ type: c.type, id: base64UrlToBuffer(c.id) })),
+        authenticatorSelection: begin.authenticatorSelection,
+        timeout: begin.timeout,
+        attestation: begin.attestation,
+    };
+    const credential = (await host.credentials.create({ publicKey }));
+    if (!credential)
+        throw new Error('Passkey registration was cancelled.');
+    const response = credential.response;
+    return {
+        // Echo the server's challenge string — the server matched/stored it.
+        challenge: begin.challenge,
+        attestation_object: bufferToBase64Url(response.attestationObject),
+        client_data_json: bufferToBase64Url(response.clientDataJSON),
+        ...(opts.name ? { name: opts.name } : {}),
+    };
+}
+/**
+ * Run navigator.credentials.get from a `/sign_ins/passkey/begin` response and
+ * return the `/finish` body. Pass `mediation: 'conditional'` for autofill UI.
+ */
+async function getPasskeyAssertion(begin, opts = {}) {
+    const host = opts.host ?? defaultHost();
+    const allow = begin.allowCredentials ?? [];
+    const publicKey = {
+        challenge: base64UrlToBuffer(begin.challenge),
+        rpId: begin.rpId,
+        allowCredentials: allow.map((c) => ({ type: c.type, id: base64UrlToBuffer(c.id) })),
+        userVerification: begin.userVerification,
+        timeout: begin.timeout,
+    };
+    const credential = (await host.credentials.get({
+        publicKey,
+        ...(opts.mediation ? { mediation: opts.mediation } : {}),
+        ...(opts.signal ? { signal: opts.signal } : {}),
+    }));
+    if (!credential)
+        throw new Error('Passkey sign-in was cancelled.');
+    const response = credential.response;
+    return {
+        handle: begin.handle,
+        challenge: begin.challenge,
+        credential_id: bufferToBase64Url(credential.rawId),
+        authenticator_data: bufferToBase64Url(response.authenticatorData),
+        client_data_json: bufferToBase64Url(response.clientDataJSON),
+        signature: bufferToBase64Url(response.signature),
+    };
+}
+//# sourceMappingURL=passkey.js.map

package/dist/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../src/passkey.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAuBH,8CAKC;AAGD,8CAOC;AAGD,8CAGC;AAGD,wDAQC;AAeD,sCA8BC;AAgBD,kDA+BC;AArID,MAAM,WAAW,GAAG,GAAiB,EAAE;IACrC,MAAM,GAAG,GAAI,UAAsC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,GAAG,IAAI,CAAE,GAAiC,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAA8B,CAAC;AACxC,CAAC,CAAC;AAEF,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,GAA6B;IAC7D,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,IAAc;IAC9C,MAAM,CAAC,GAAG,IAAI,IAAK,UAAgD,CAAC,mBAAmB,CAAC;IACxF,OAAO,OAAO,CAAC,KAAK,WAAW,CAAC;AAClC,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,sBAAsB;IAC1C,MAAM,EAAE,GAAI,UAAqG;SAC9G,mBAAmB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,EAAE,+BAA+B,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACI,KAAK,UAAU,aAAa,CACjC,KAA8B,EAC9B,OAA+C,EAAE;IAEjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAyD,CAAC;IAC7E,MAAM,OAAO,GAAI,KAAK,CAAC,kBAAiE,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QACjD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;KACkB,CAAC;IAEnD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAA+B,CAAC;IAChG,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA4C,CAAC;IAEzE,OAAO;QACL,qEAAqE;QACrE,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,KAA8B,EAC9B,OAA8F,EAAE;IAEhG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,KAAK,GAAI,KAAK,CAAC,gBAA+D,IAAI,EAAE,CAAC;IAE3F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnF,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO;KACyB,CAAC;IAElD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7C,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA0C,CAAC;IAEvE,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAgB;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC;QAClD,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC"}

package/dist/password-reset.d.ts

@@ -0,0 +1,41 @@
+/**
+ * §5.4 Password reset ("forgot password").
+ *
+ * A standalone flow, separate from sign-in: the user proves control of their
+ * inbox with an emailed code, clears any second factor (a reset must NOT bypass
+ * MFA), then sets a new password and ends up signed in. It drives the
+ * `/v1/client/password_resets/*` endpoints, which mirror the sign-in steps but on
+ * their own attempt, so it cannot be expressed through the sign-in `advance`.
+ *
+ * Statuses, in order: `needs_email_verification` → (`needs_second_factor`) →
+ * `needs_new_password` → `complete` (carrying a session ticket, so a completed
+ * reset signs the user in through the normal cookie exchange).
+ */
+import type { FieldError } from './attempt';
+import type { FapiClient } from './fapi';
+export interface ResetAttempt {
+    id: string;
+    status: string;
+}
+export interface ResetFlowState {
+    attempt: ResetAttempt | null;
+    errors: FieldError[];
+    busy: boolean;
+    /** Present once the reset completes — exchange it for session cookies. */
+    ticket: string | null;
+}
+export declare const initialResetFlow: ResetFlowState;
+/** Begin a reset: email the code. Returns a flow parked at `needs_email_verification`. */
+export declare function startPasswordReset(client: FapiClient, email: string, captchaToken?: string): Promise<ResetFlowState>;
+/**
+ * Advance the reset by one step, routing on the current status: the emailed code
+ * → verification, a 2FA code → second factor, a new password → set-password. On
+ * completion the returned state carries a ticket to exchange for cookies.
+ */
+export declare function advancePasswordReset(client: FapiClient, state: ResetFlowState, values: {
+    code?: string;
+    password?: string;
+}): Promise<ResetFlowState>;
+/** The step a reset flow is on — what the UI should collect next. */
+export type ResetStep = 'request' | 'collect_email_code' | 'collect_second_factor' | 'collect_new_password' | 'done' | 'unknown';
+export declare function resetStep(state: ResetFlowState): ResetStep;

package/dist/password-reset.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initialResetFlow = void 0;
+exports.startPasswordReset = startPasswordReset;
+exports.advancePasswordReset = advancePasswordReset;
+exports.resetStep = resetStep;
+exports.initialResetFlow = {
+    attempt: null,
+    errors: [],
+    busy: false,
+    ticket: null,
+};
+/** Begin a reset: email the code. Returns a flow parked at `needs_email_verification`. */
+async function startPasswordReset(client, email, captchaToken) {
+    const res = await client.post('/v1/client/password_resets', {
+        email_address: email,
+        captcha_token: captchaToken,
+    });
+    if (!res.ok || !res.data)
+        return { ...exports.initialResetFlow, errors: res.errors };
+    return { attempt: res.data, errors: [], busy: false, ticket: null };
+}
+/**
+ * Advance the reset by one step, routing on the current status: the emailed code
+ * → verification, a 2FA code → second factor, a new password → set-password. On
+ * completion the returned state carries a ticket to exchange for cookies.
+ */
+async function advancePasswordReset(client, state, values) {
+    const attempt = state.attempt;
+    if (!attempt)
+        return state;
+    let path = null;
+    let body = {};
+    switch (attempt.status) {
+        case 'needs_email_verification':
+            path = `/v1/client/password_resets/${attempt.id}/attempt_verification`;
+            body = { code: values.code ?? '' };
+            break;
+        case 'needs_second_factor':
+            path = `/v1/client/password_resets/${attempt.id}/attempt_second_factor`;
+            body = { code: values.code ?? '' };
+            break;
+        case 'needs_new_password':
+            path = `/v1/client/password_resets/${attempt.id}/set_new_password`;
+            body = { password: values.password ?? '' };
+            break;
+        default:
+            return state;
+    }
+    const res = await client.post(path, body);
+    if (!res.ok || !res.data) {
+        // Keep the attempt on failure (a wrong code must not drop the whole flow),
+        // exactly like the sign-in advance.
+        return { ...state, busy: false, errors: res.errors };
+    }
+    return {
+        attempt: { id: res.data.id, status: res.data.status },
+        errors: [],
+        busy: false,
+        ticket: res.data.ticket ?? null,
+    };
+}
+function resetStep(state) {
+    const status = state.attempt?.status;
+    if (!status)
+        return 'request';
+    switch (status) {
+        case 'needs_email_verification':
+            return 'collect_email_code';
+        case 'needs_second_factor':
+            return 'collect_second_factor';
+        case 'needs_new_password':
+            return 'collect_new_password';
+        case 'complete':
+            return 'done';
+        default:
+            return 'unknown';
+    }
+}
+//# sourceMappingURL=password-reset.js.map

package/dist/password-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.js","sourceRoot":"","sources":["../src/password-reset.ts"],"names":[],"mappings":";;;AAqCA,gDAWC;AAOD,oDAuCC;AAWD,8BAeC;AA3FY,QAAA,gBAAgB,GAAmB;IAC9C,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,0FAA0F;AACnF,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,KAAa,EACb,YAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAe,4BAA4B,EAAE;QACxE,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,wBAAgB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC7E,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,KAAqB,EACrB,MAA4C;IAE5C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,0BAA0B;YAC7B,IAAI,GAAG,8BAA8B,OAAO,CAAC,EAAE,uBAAuB,CAAC;YACvE,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM;QACR,KAAK,qBAAqB;YACxB,IAAI,GAAG,8BAA8B,OAAO,CAAC,EAAE,wBAAwB,CAAC;YACxE,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM;QACR,KAAK,oBAAoB;YACvB,IAAI,GAAG,8BAA8B,OAAO,CAAC,EAAE,mBAAmB,CAAC;YACnE,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM;QACR;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAqC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,2EAA2E;QAC3E,oCAAoC;QACpC,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE;QACrD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KAChC,CAAC;AACJ,CAAC;AAWD,SAAgB,SAAS,CAAC,KAAqB;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,0BAA0B;YAC7B,OAAO,oBAAoB,CAAC;QAC9B,KAAK,qBAAqB;YACxB,OAAO,uBAAuB,CAAC;QACjC,KAAK,oBAAoB;YACvB,OAAO,sBAAsB,CAAC;QAChC,KAAK,UAAU;YACb,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/reauth.d.ts

@@ -0,0 +1,29 @@
+/**
+ * §5.6 Step-up re-authentication.
+ *
+ * A signed-in user re-proves a credential to refresh the "recent sign-in"
+ * window IN PLACE — no sign-out, no new session — so the app can immediately
+ * perform a security-sensitive action (changing 2FA) that requires it. This is
+ * the SDK call a frontend makes when a step-up-gated request returns
+ * `STEP_UP_REQUIRED`; retry the original action after it resolves.
+ */
+export type ReauthInput = {
+    strategy: 'password';
+    password: string;
+} | {
+    strategy: 'id_token';
+    provider: string;
+    idToken: string;
+};
+export interface ReauthOptions {
+    /** FAPI base, e.g. 'https://accounts.acme.com' or '' for same-origin. */
+    api: string;
+    publishableKey: string;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Re-authenticate the current session. Resolves on success; throws with the
+ * server's message (and a `.code`) on failure — `STEP_UP_REQUIRED` cannot recur
+ * here, but a wrong password surfaces as a 401.
+ */
+export declare function reauthenticate(input: ReauthInput, opts: ReauthOptions): Promise<void>;

package/dist/reauth.js

@@ -0,0 +1,45 @@
+"use strict";
+/**
+ * §5.6 Step-up re-authentication.
+ *
+ * A signed-in user re-proves a credential to refresh the "recent sign-in"
+ * window IN PLACE — no sign-out, no new session — so the app can immediately
+ * perform a security-sensitive action (changing 2FA) that requires it. This is
+ * the SDK call a frontend makes when a step-up-gated request returns
+ * `STEP_UP_REQUIRED`; retry the original action after it resolves.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reauthenticate = reauthenticate;
+/**
+ * Re-authenticate the current session. Resolves on success; throws with the
+ * server's message (and a `.code`) on failure — `STEP_UP_REQUIRED` cannot recur
+ * here, but a wrong password surfaces as a 401.
+ */
+async function reauthenticate(input, opts) {
+    const body = input.strategy === 'password'
+        ? { strategy: 'password', password: input.password }
+        : { strategy: 'id_token', provider: input.provider, id_token: input.idToken };
+    const doFetch = opts.fetchImpl ?? fetch;
+    const res = await doFetch(`${opts.api}/v1/client/me/reauthenticate`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', 'x-publishable-key': opts.publishableKey },
+        credentials: 'include',
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        let message = 'Re-authentication failed.';
+        let code;
+        try {
+            const parsed = (await res.json());
+            message = parsed.errors?.[0]?.message ?? message;
+            code = parsed.errors?.[0]?.code;
+        }
+        catch {
+            /* keep the default */
+        }
+        const err = new Error(message);
+        err.code = code;
+        throw err;
+    }
+}
+//# sourceMappingURL=reauth.js.map

package/dist/reauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reauth.js","sourceRoot":"","sources":["../src/reauth.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAkBH,wCA2BC;AAhCD;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,KAAkB,EAAE,IAAmB;IAC1E,MAAM,IAAI,GACR,KAAK,CAAC,QAAQ,KAAK,UAAU;QAC3B,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;QACpD,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAElF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,8BAA8B,EAAE;QACnE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,IAAI,CAAC,cAAc,EAAE;QACzF,WAAW,EAAE,SAAS;QACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,OAAO,GAAG,2BAA2B,CAAC;QAC1C,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuD,CAAC;YACxF,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,OAAO,CAAC;YACjD,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,GAAyB,CAAC,IAAI,GAAG,IAAI,CAAC;QACvC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}