@atlasauth/js 0.14.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @atlasauth/js changelog
 
+## 0.16.0 — 2026-10-23
+
+### Added
+
+- `createOrganizationAuditLog(client, { pageSize, action })`: the framework-agnostic pager behind every SDK's `<OrganizationAuditLog/>`, with `organizationAuditLogPath`, `describeAuditAction` and the `OrganizationAuditLogEntry` type.
+- Sign-up starts, and every start that can create an account (social, enterprise SSO and SAML, DiscourseConnect, native id_token, external JWT, LDAP, Telegram and wallet sign-ins), send the stable device id, so an instance's accounts-per-device limit counts devices rather than networks, across email and social sign-ups alike. `DEVICE_ID_ROUTES` lists them.
+- The recovery codes an MFA enrolment completes the sign-in with: `advance` moves `backup_codes` off the attempt into `FlowState.recoveryCodes` (memory only), and the components show them before exchanging the ticket with `pendingRecoveryCodes`, `acknowledgeRecoveryCodes`, `copyRecoveryCodes`, `downloadRecoveryCodes` / `canDownloadRecoveryCodes` (a `recovery-codes.txt` file), `recoveryCodesText` and `recoveryCodesFrom`.
+- The sign-in's MFA steps, shared by every framework SDK: `createMfaEnrollment` (the enrolment step's state and requests: authenticator app with `qrCode`, or a texted code), `prepareMfaEnrollment`, `enrollmentSubmitKey`, `groupSetupKey`, `prepareSecondFactorCode` (`sms` or `email_code`) and `mfaChoicesFrom`.
+- `requestForStep` posts a texted enrolment as `{ factor_id, code }` (values with `enrollStrategy: 'phone_code'`).
+- `AccountUx.mfa` (`{ totp, sms, totpCodes }`), read from `account.mfa` when the server sends it.
+- `beginPasskeySignIn(client, { captcha })`: the passkey sign-in start (`sign_ins/passkey/begin`) with the sign-in captcha folded in. It sends `captcha_token` when the token source has one, and after a `CAPTCHA_REQUIRED` / `CAPTCHA_FAILED` refusal asks once for a fresh token and retries once.
+
+## 0.15.0
+
+### Added
+
+- Referral capture works with any referral program and any consent manager: it reads Referally, Rewardful, Tolt, PromoteKit, FirstPromoter, PartnerStack and Dub (the instance's `browser_sources`), and asks Cookie Munch, OneTrust, Cookiebot, Didomi, Usercentrics, Osano, CookieYes, Complianz, Klaro, any IAB TCF v2 manager or Google Consent Mode for consent (the instance's `consent_provider`).
+- `referralSource` (client option, `configureReferralCapture`, and `source` on `signIn` / `referralParams`): your own reader for any other program.
+- `detectConsent`, `detectConsentProvider`, `detectReferralSource`, `REFERRAL_BROWSER_SOURCES` and `CONSENT_PROVIDERS` are exported.
+- A captured referral says where it came from (`source`) and who decided consent (`consent_by`), also as `ref_source` / `ref_consent_by` on redirects, for the delivery log.
+
+### Changed
+
+- A consent manager on the page decides; `referralConsent` applies when there is none (or when the instance's `consent_provider` is `app`).
+
+### Fixed
+
+- Development instances: sign-in from `localhost` keeps working where the browser blocks the instance's cookie as third-party (Chrome, Safari). On a `pk_test_` key the SDK keeps the session's refresh token in `localStorage` and sends it as `x-refresh-token`; production keys never do.
+- After a sign-in completes, the panel says "You're signed in" only once this browser holds the session, and says plainly when the browser didn't keep it, instead of "you are signed in where you started". That message is now shown only for a sign-in completed on another device.
+- `withDevBrowser`, `devBrowserEnabled`, `devBrowserToken` and `forgetDevBrowserToken` are exported for custom fetch layers.
+
 ## 0.14.0
 - **Referral capture v2.** One source per referral, in precedence order and never mixed: the page's referral script (`window.aff.getReferral()` → `{code, clickId, anonId, ts}`), explicit `ref_*` URL parameters (`ref`, `ref_click_id`, `ref_anon_id`, `ref_consent`, `ref_captured_at`), a code in the instance's URL parameters, then the tracking cookie. A URL code no longer travels with the cookie's click id. Click and anonymous ids are sent only with consent (Cookie Munch, `referralConsent`, or `ref_consent=granted` on the URL); without it only the code goes. The cookie may carry `ts` (becomes `captured_at`) and `exp` (an expired cookie is ignored).
 - **New redirect helpers:** `signIn({ url | frontendApi, redirectUrl?, referral?: false | 'auto', consent?, config?, navigate? })` / `signUp(...)` go to the hosted page (or any URL, e.g. `/oauth2/authorize`) with the referral as `ref_*` query parameters; `referralParams(options)` and `withReferralParams(url, options)` for your own redirects.

package/dist/account-hints.d.ts

@@ -0,0 +1,53 @@
+import type { FapiClient } from './fapi';
+import type { UsernameRule } from './environment';
+/**
+ * Sign-up / sign-in form hints: whether a username is free (a live hint beside
+ * the field) and which method this browser last signed in with (the "Last used"
+ * badge). Both are hints only — the server enforces everything on submit.
+ */
+/** `POST /v1/client/usernames/availability`. */
+export interface UsernameAvailability {
+    username: string;
+    /** Meets the instance's username rule. */
+    valid: boolean;
+    /** Valid and nobody holds it. */
+    available: boolean;
+    /** The rule it breaks, when not valid. */
+    message?: string;
+}
+/**
+ * Ask whether a username is free. Null when the server cannot say (usernames
+ * off, rate-limited, unreachable) — a form then simply shows no hint.
+ */
+export declare function checkUsernameAvailability(client: FapiClient, username: string): Promise<UsernameAvailability | null>;
+/** Check a username against the rule locally (before asking the server). */
+export declare function usernameMeetsRule(username: string, rule: UsernameRule): boolean;
+/**
+ * The method this browser last signed in with, as the server recorded it
+ * (`password`, `email_code`, `email_link`, `passkey`, `phone_code`,
+ * `oauth_google`, …). Null when none is remembered, the instance turned the
+ * hint off, or the server cannot be reached.
+ */
+export declare function fetchLastSignInMethod(client: FapiClient): Promise<string | null>;
+/**
+ * Whether a sign-in option is the one last used. `option` is a first factor
+ * (`password`, `email_code`, `passkey`, …) or a social provider id (`google`).
+ * Email code and email link count as one ("email"), as do the OAuth and the
+ * native flow of a provider.
+ */
+export declare function isLastUsed(lastMethod: string | null | undefined, option: string): boolean;
+/**
+ * The label a sign-in form shows for a first-party "Last used" method
+ * (`Last used: Password`), or null for social / enterprise methods (badged on
+ * their own buttons) and anything unrecognised. `t` is the form's translator.
+ */
+export declare function lastUsedMethodLabel(lastMethod: string | null | undefined, t: (key: string) => string): string | null;
+/**
+ * Email OTP second factor: mail a code to the user's verified address for this
+ * sign-in attempt (on its `needs_second_factor` step). Resolves the masked
+ * address it went to; the code is then submitted like any second-factor code.
+ * Throws with the server's message when the factor is not offered.
+ */
+export declare function prepareEmailSecondFactor(client: FapiClient, attemptId: string): Promise<{
+    sentTo: string;
+}>;

package/dist/account-hints.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkUsernameAvailability = checkUsernameAvailability;
+exports.usernameMeetsRule = usernameMeetsRule;
+exports.fetchLastSignInMethod = fetchLastSignInMethod;
+exports.isLastUsed = isLastUsed;
+exports.lastUsedMethodLabel = lastUsedMethodLabel;
+exports.prepareEmailSecondFactor = prepareEmailSecondFactor;
+/**
+ * Ask whether a username is free. Null when the server cannot say (usernames
+ * off, rate-limited, unreachable) — a form then simply shows no hint.
+ */
+async function checkUsernameAvailability(client, username) {
+    try {
+        const response = await client.post('/v1/client/usernames/availability', { username });
+        const d = response.data;
+        if (!response.ok || !d)
+            return null;
+        return {
+            username: typeof d.username === 'string' ? d.username : username.trim(),
+            valid: d.valid === true,
+            available: d.available === true,
+            ...(typeof d.message === 'string' ? { message: d.message } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+const CHARSET_RE = {
+    default: /^[A-Za-z0-9._-]+$/,
+    alphanumeric: /^[A-Za-z0-9]+$/,
+    alphanumeric_underscore: /^[A-Za-z0-9_]+$/,
+};
+/** Check a username against the rule locally (before asking the server). */
+function usernameMeetsRule(username, rule) {
+    const v = username.trim();
+    return v.length >= rule.minLength && v.length <= rule.maxLength && CHARSET_RE[rule.charset].test(v);
+}
+/**
+ * The method this browser last signed in with, as the server recorded it
+ * (`password`, `email_code`, `email_link`, `passkey`, `phone_code`,
+ * `oauth_google`, …). Null when none is remembered, the instance turned the
+ * hint off, or the server cannot be reached.
+ */
+async function fetchLastSignInMethod(client) {
+    try {
+        const response = await client.get('/v1/client/last_sign_in_method');
+        const m = response.ok ? response.data?.method : null;
+        return typeof m === 'string' && m ? m : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether a sign-in option is the one last used. `option` is a first factor
+ * (`password`, `email_code`, `passkey`, …) or a social provider id (`google`).
+ * Email code and email link count as one ("email"), as do the OAuth and the
+ * native flow of a provider.
+ */
+function isLastUsed(lastMethod, option) {
+    if (!lastMethod)
+        return false;
+    const norm = (m) => {
+        if (m.startsWith('oauth_'))
+            return `oauth:${m.slice(6)}`;
+        if (m.startsWith('id_token_'))
+            return `oauth:${m.slice(9)}`;
+        if (m === 'email_code' || m === 'email_link')
+            return 'email';
+        return m;
+    };
+    const last = norm(lastMethod);
+    return last === norm(option) || last === `oauth:${option}`;
+}
+/**
+ * The label a sign-in form shows for a first-party "Last used" method
+ * (`Last used: Password`), or null for social / enterprise methods (badged on
+ * their own buttons) and anything unrecognised. `t` is the form's translator.
+ */
+function lastUsedMethodLabel(lastMethod, t) {
+    switch (lastMethod) {
+        case 'password':
+            return t('signIn.passwordLabel');
+        case 'email_code':
+        case 'email_link':
+            return t('signIn.identifierLabel');
+        case 'passkey':
+            return 'Passkey';
+        case 'phone_code':
+            return 'Phone';
+        default:
+            return null;
+    }
+}
+/**
+ * Email OTP second factor: mail a code to the user's verified address for this
+ * sign-in attempt (on its `needs_second_factor` step). Resolves the masked
+ * address it went to; the code is then submitted like any second-factor code.
+ * Throws with the server's message when the factor is not offered.
+ */
+async function prepareEmailSecondFactor(client, attemptId) {
+    const response = await client.post(`/v1/client/sign_ins/${encodeURIComponent(attemptId)}/prepare_second_factor`, { strategy: 'email_code' });
+    if (!response.ok) {
+        const first = response.errors[0];
+        const error = new Error(first?.message ?? 'Could not send the code.');
+        if (first?.code)
+            error.code = first.code;
+        throw error;
+    }
+    return { sentTo: typeof response.data?.sent_to === 'string' ? response.data.sent_to : '' };
+}
+//# sourceMappingURL=account-hints.js.map

package/dist/account-hints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-hints.js","sourceRoot":"","sources":["../src/account-hints.ts"],"names":[],"mappings":";;AAwBA,8DAsBC;AASD,8CAGC;AAQD,sDAQC;AAQD,gCAUC;AAOD,kDAiBC;AAQD,4DAeC;AAvHD;;;GAGG;AACI,KAAK,UAAU,yBAAyB,CAC7C,MAAkB,EAClB,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAK/B,mCAAmC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;YACvE,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI;YACvB,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,IAAI;YAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAA4C;IAC1D,OAAO,EAAE,mBAAmB;IAC5B,YAAY,EAAE,gBAAgB;IAC9B,uBAAuB,EAAE,iBAAiB;CAC3C,CAAC;AAEF,4EAA4E;AAC5E,SAAgB,iBAAiB,CAAC,QAAgB,EAAE,IAAkB;IACpE,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CAAC,MAAkB;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAuB,gCAAgC,CAAC,CAAC;QAC1F,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,UAAqC,EAAE,MAAc;IAC9E,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE;QACzB,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,YAAY;YAAE,OAAO,OAAO,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9B,OAAO,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,SAAS,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,UAAqC,EACrC,CAA0B;IAE1B,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,YAAY,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,CAAC,CAAC,wBAAwB,CAAC,CAAC;QACrC,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,YAAY;YACf,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,wBAAwB,CAC5C,MAAkB,EAClB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,wBAAwB,EAC5E,EAAE,QAAQ,EAAE,YAAY,EAAE,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,0BAA0B,CAA8B,CAAC;QACnG,IAAI,KAAK,EAAE,IAAI;YAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC7F,CAAC"}

package/dist/attempt.d.ts

@@ -54,11 +54,13 @@ export interface AttemptView {
      */
     id: string | null;
     /** The resource type the server stamps on every attempt view. */
-    object?: 'sign_in_attempt';
+    object?: 'sign_in_attempt' | 'sign_up_attempt';
     status: string;
     /** The identifier the attempt was started with; `null` before one is collected. */
     identifier?: string | null;
     supported_first_factors?: string[];
+    /** `passkey` on a passkey-only sign-up (see `awaitingPasskey`). */
+    strategy?: string;
     created_session_id?: string | null;
     /** Attempt expiry (epoch ms); `null` on the pre-attempt challenge marker. */
     expires_at?: number | null;

package/dist/attempt.js.map

@@ -1 +1 @@
-{"version":3,"file":"attempt.js","sourceRoot":"","sources":["../src/attempt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAkDH,4BAqDC;AAGD,gCAEC;AA6BD,kCAiBC;AAGD,8BAEC;AAGD,gCAEC;AAlHD,SAAgB,QAAQ,CAAC,OAAoB;IAC3C,QAAQ,OAAO,CAAC,MAAuB,EAAE,CAAC;QACxC,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,oBAAoB;YACvB,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,sEAAsE;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,wCAAwC;gBACxC,UAAU,EAAE,OAAO,CAAC,uBAAuB,IAAI,EAAE;aAClD,CAAC;QAEJ,KAAK,qBAAqB;YACxB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QAE3C;;;;;WAKG;QACH,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,0BAA0B;YAC7B,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAErC,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAEjC,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;QAEzE,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAElD;YACE;;;;eAIG;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,OAAoB;IAC7C,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC;AACzE,CAAC;AA6BD,SAAgB,WAAW,CAAC,IAAa;IACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,KAAK,EAAuB,EAAE;QACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAQ,KAAoB,CAAC,OAAO,KAAK,QAAQ,CAAC;IAC7E,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACzF,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;QACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACrE,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,GAAG,IAA+B,CAAC;QACzG,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8DAA8D;AAC9D,SAAgB,SAAS,CAAC,MAA6B,EAAE,KAAa;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,SAAgB,UAAU,CAAC,MAA6B;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"attempt.js","sourceRoot":"","sources":["../src/attempt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAoDH,4BAqDC;AAGD,gCAEC;AA6BD,kCAiBC;AAGD,8BAEC;AAGD,gCAEC;AAlHD,SAAgB,QAAQ,CAAC,OAAoB;IAC3C,QAAQ,OAAO,CAAC,MAAuB,EAAE,CAAC;QACxC,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,oBAAoB;YACvB,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,sEAAsE;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,wCAAwC;gBACxC,UAAU,EAAE,OAAO,CAAC,uBAAuB,IAAI,EAAE;aAClD,CAAC;QAEJ,KAAK,qBAAqB;YACxB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QAE3C;;;;;WAKG;QACH,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,0BAA0B;YAC7B,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAErC,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAEjC,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;QAEzE,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAElD;YACE;;;;eAIG;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,OAAoB;IAC7C,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC;AACzE,CAAC;AA6BD,SAAgB,WAAW,CAAC,IAAa;IACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,KAAK,EAAuB,EAAE;QACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAQ,KAAoB,CAAC,OAAO,KAAK,QAAQ,CAAC;IAC7E,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACzF,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;QACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACrE,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,GAAG,IAA+B,CAAC;QACzG,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8DAA8D;AAC9D,SAAgB,SAAS,CAAC,MAA6B,EAAE,KAAa;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,SAAgB,UAAU,CAAC,MAA6B;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}

package/dist/captcha-controller.d.ts

@@ -1,5 +1,6 @@
 import { type FieldError } from './attempt';
 import { type FapiClient, type FlowState } from './fapi';
+import type { WebAuthnHost } from './passkey';
 import type { AtlasCaptchaLabels } from './atlas-captcha';
 import { type FlowCaptcha } from './captcha-widget';
 /**
@@ -103,3 +104,23 @@ export declare function createSignUp(client: FapiClient, values: Record<string,
     captcha?: CaptchaController | null;
     t: (key: string) => string;
 }): Promise<FlowState>;
+/**
+ * {@link createSignUp} for a passkey-only sign-up (`account.passkeySignUp`):
+ * POSTs `/v1/client/sign_ups/passkey` with the email (when the form collected
+ * one) and the configured sign-up fields — never a password. No account exists
+ * until {@link finishPasskeySignUp} registers the passkey.
+ */
+export declare function createPasskeySignUp(client: FapiClient, values: Record<string, string>, opts: {
+    consent: boolean;
+    captcha?: CaptchaController | null;
+    t: (key: string) => string;
+}): Promise<FlowState>;
+/**
+ * The passkey-only sign-up's last step, for a prebuilt form: run the browser
+ * ceremony, and the server creates the account when it verifies. A cancelled
+ * prompt reads `signUp.passkeyCancelled` from the form's catalog.
+ */
+export declare function finishPasskeySignUp(client: FapiClient, state: FlowState, opts: {
+    t: (key: string) => string;
+    host?: WebAuthnHost;
+}): Promise<FlowState>;

package/dist/captcha-controller.js

@@ -5,9 +5,12 @@ exports.localizeCaptchaErrors = localizeCaptchaErrors;
 exports.signInCaptchaOptions = signInCaptchaOptions;
 exports.advanceWithCaptcha = advanceWithCaptcha;
 exports.createSignUp = createSignUp;
+exports.createPasskeySignUp = createPasskeySignUp;
+exports.finishPasskeySignUp = finishPasskeySignUp;
 const attempt_1 = require("./attempt");
 const fapi_1 = require("./fapi");
 const instance_settings_1 = require("./instance-settings");
+const passkey_sign_up_1 = require("./passkey-sign-up");
 const captcha_widget_1 = require("./captcha-widget");
 function createCaptchaController(initial, settings = {}) {
     let options = initial ?? { flow: undefined, active: false };
@@ -204,4 +207,36 @@ async function createSignUp(client, values, opts) {
         opts.captcha.reset();
     return next;
 }
+/**
+ * {@link createSignUp} for a passkey-only sign-up (`account.passkeySignUp`):
+ * POSTs `/v1/client/sign_ups/passkey` with the email (when the form collected
+ * one) and the configured sign-up fields — never a password. No account exists
+ * until {@link finishPasskeySignUp} registers the passkey.
+ */
+async function createPasskeySignUp(client, values, opts) {
+    const token = opts.captcha ? await opts.captcha.getToken() : null;
+    const { email, fields, consent } = (0, instance_settings_1.toSignUpInput)(values, opts.consent, token);
+    let next = await (0, passkey_sign_up_1.startPasskeySignUp)(client, {
+        ...(email ? { email } : {}),
+        fields,
+        consent,
+        ...(token ? { captchaToken: token } : {}),
+    });
+    next = { ...next, errors: localizeCaptchaErrors(next.errors, opts.t).errors };
+    if (next.errors.length > 0 && opts.captcha?.needed)
+        opts.captcha.reset();
+    return next;
+}
+/**
+ * The passkey-only sign-up's last step, for a prebuilt form: run the browser
+ * ceremony, and the server creates the account when it verifies. A cancelled
+ * prompt reads `signUp.passkeyCancelled` from the form's catalog.
+ */
+async function finishPasskeySignUp(client, state, opts) {
+    const next = await (0, passkey_sign_up_1.registerSignUpPasskey)(client, state, opts.host ? { host: opts.host } : {});
+    return {
+        ...next,
+        errors: next.errors.map((e) => (e.code === 'PASSKEY_CANCELLED' ? { ...e, message: opts.t('signUp.passkeyCancelled') } : e)),
+    };
+}
 //# sourceMappingURL=captcha-controller.js.map

package/dist/captcha-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"captcha-controller.js","sourceRoot":"","sources":["../src/captcha-controller.ts"],"names":[],"mappings":";;AAmEA,0DA0FC;AAQD,sDAcC;AAUD,oDAYC;AAaD,gDA8CC;AAQD,oCAUC;AAtRD,uCAAsD;AACtD,iCAA+E;AAC/E,2DAAoD;AAEpD,qDAO0B;AAwD1B,SAAgB,uBAAuB,CACrC,OAAkC,EAClC,WAAsC,EAAE;IAExC,IAAI,OAAO,GAA6B,OAAO,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACtF,IAAI,SAAS,GAAuB,IAAI,CAAC;IACzC,IAAI,MAAM,GAA+B,IAAI,CAAC;IAC9C,4EAA4E;IAC5E,wCAAwC;IACxC,IAAI,KAAK,GAA+B,IAAI,CAAC;IAC7C,2EAA2E;IAC3E,6BAA6B;IAC7B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IAEnC,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,IAAA,oCAAmB,EAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,MAAM,KAAK,WAAW,CAAC;IAC1E,MAAM,GAAG,GAAG,GAAG,EAAE;QACf,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;QACvB,OAAO,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,CAAC;IAC9F,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,MAAM,GAAG,IAAI,CAAC;QACd,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,GAA+B,EAAE;QAC7C,MAAM,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,CAAC,GAAG,IAAA,oCAAmB,EAAC,IAAI,EAAE,SAAS,EAAE;YAC7C,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7E,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,CAAC;QACX,QAAQ,GAAG,GAAG,EAAE,CAAC;QACjB,kEAAkE;QAClE,+DAA+D;QAC/D,CAAC,CAAC,KAAK,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC,EACD,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,EAAE,CAAC;QACT,IAAI,MAAM,EAAE,IAAI,KAAK,EAAE;YAAE,KAAK,EAAE,CAAC;IACnC,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,MAAM;YACR,OAAO,MAAM,EAAE,CAAC;QAClB,CAAC;QACD,SAAS,CAAC,IAAI;YACZ,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC,SAAS;gBAAE,OAAO;YACvB,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;gBAAE,MAAM,EAAE,CAAC;iBAC/B,IAAI,QAAQ,KAAK,GAAG,EAAE;gBAAE,KAAK,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,EAAE;YACP,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAO;YAC7B,MAAM,EAAE,CAAC;YACT,SAAS,GAAG,EAAE,CAAC;YACf,IAAI,EAAE,IAAI,MAAM,EAAE,IAAI,KAAK,EAAE;gBAAE,KAAK,EAAE,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,IAAI,CAAC,MAAM,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC3B,IAAI,CAAC,GAAG,MAAM,CAAC;YACf,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBAAE,CAAC,GAAG,KAAK,EAAE,CAAC;YAClD,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC;gBAC5B,KAAK,GAAG,CAAC,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;gBACpE,IAAI,MAAM,KAAK,CAAC;oBAAE,KAAK,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK;QACL,OAAO;YACL,MAAM,EAAE,CAAC;YACT,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,MAAoB,EACpB,CAA0B;IAE1B,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/B,IAAI,CAAC,IAAA,+BAAc,EAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC;SACtF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAClC,IAAoC,EACpC,KAAgB,EAChB,iBAA6B;IAE7B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,kBAAQ,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACjF,MAAM,UAAU,GAAG,IAAI,KAAK,iBAAiB,CAAC;IAC9C,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,UAAU,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAA,iCAAgB,EAAC,IAAI,CAAC,CAAC;QAC/E,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,KAAgB,EAChB,MAA8B,EAC9B,IAA6F;IAE7F,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC;IAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,kBAAQ,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACjF,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACvC,IAAI,KAAK,GAAG,MAAM,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAChE,IAAI,MAAM,CAAC,UAAU;YAAE,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACtD,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG;oBACN,GAAG,MAAM;oBACT,UAAU,EACR,UAAU,IAAI,CAAE,KAAK,CAAC,OAAiD,EAAE,UAAU,IAAI,EAAE,CAAC;oBAC5F,aAAa,EAAE,KAAK;iBACrB,CAAC;gBACF,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;iBAAM,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACtC,mDAAmD;gBACnD,OAAO;oBACL,KAAK,EAAE;wBACL,GAAG,KAAK;wBACR,IAAI,EAAE,KAAK;wBACX,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC;qBACvE;oBACD,UAAU;iBACX,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,GAAG,MAAM,IAAA,cAAO,EAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAA,kBAAQ,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC;IACzF,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;QAC9B,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzE,IAAI,SAAS,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,MAA8B,EAC9B,IAA0F;IAE1F,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,IAAI,GAAG,MAAM,IAAA,kBAAW,EAAC,MAAM,EAAE,IAAA,iCAAa,EAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACjF,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9E,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"captcha-controller.js","sourceRoot":"","sources":["../src/captcha-controller.ts"],"names":[],"mappings":";;AAqEA,0DA0FC;AAQD,sDAcC;AAUD,oDAYC;AAaD,gDA8CC;AAQD,oCAUC;AAQD,kDAgBC;AAOD,kDAUC;AAjUD,uCAAsD;AACtD,iCAA+E;AAC/E,2DAAoD;AACpD,uDAA8E;AAG9E,qDAO0B;AAwD1B,SAAgB,uBAAuB,CACrC,OAAkC,EAClC,WAAsC,EAAE;IAExC,IAAI,OAAO,GAA6B,OAAO,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACtF,IAAI,SAAS,GAAuB,IAAI,CAAC;IACzC,IAAI,MAAM,GAA+B,IAAI,CAAC;IAC9C,4EAA4E;IAC5E,wCAAwC;IACxC,IAAI,KAAK,GAA+B,IAAI,CAAC;IAC7C,2EAA2E;IAC3E,6BAA6B;IAC7B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IAEnC,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,IAAA,oCAAmB,EAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,MAAM,KAAK,WAAW,CAAC;IAC1E,MAAM,GAAG,GAAG,GAAG,EAAE;QACf,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;QACvB,OAAO,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,CAAC;IAC9F,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,MAAM,GAAG,IAAI,CAAC;QACd,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,GAA+B,EAAE;QAC7C,MAAM,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,CAAC,GAAG,IAAA,oCAAmB,EAAC,IAAI,EAAE,SAAS,EAAE;YAC7C,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7E,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,CAAC;QACX,QAAQ,GAAG,GAAG,EAAE,CAAC;QACjB,kEAAkE;QAClE,+DAA+D;QAC/D,CAAC,CAAC,KAAK,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC,EACD,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,EAAE,CAAC;QACT,IAAI,MAAM,EAAE,IAAI,KAAK,EAAE;YAAE,KAAK,EAAE,CAAC;IACnC,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,MAAM;YACR,OAAO,MAAM,EAAE,CAAC;QAClB,CAAC;QACD,SAAS,CAAC,IAAI;YACZ,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC,SAAS;gBAAE,OAAO;YACvB,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;gBAAE,MAAM,EAAE,CAAC;iBAC/B,IAAI,QAAQ,KAAK,GAAG,EAAE;gBAAE,KAAK,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,EAAE;YACP,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAO;YAC7B,MAAM,EAAE,CAAC;YACT,SAAS,GAAG,EAAE,CAAC;YACf,IAAI,EAAE,IAAI,MAAM,EAAE,IAAI,KAAK,EAAE;gBAAE,KAAK,EAAE,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,IAAI,CAAC,MAAM,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC3B,IAAI,CAAC,GAAG,MAAM,CAAC;YACf,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBAAE,CAAC,GAAG,KAAK,EAAE,CAAC;YAClD,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC;gBAC5B,KAAK,GAAG,CAAC,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;gBACpE,IAAI,MAAM,KAAK,CAAC;oBAAE,KAAK,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK;QACL,OAAO;YACL,MAAM,EAAE,CAAC;YACT,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,MAAoB,EACpB,CAA0B;IAE1B,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/B,IAAI,CAAC,IAAA,+BAAc,EAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC;SACtF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAClC,IAAoC,EACpC,KAAgB,EAChB,iBAA6B;IAE7B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,kBAAQ,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACjF,MAAM,UAAU,GAAG,IAAI,KAAK,iBAAiB,CAAC;IAC9C,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,UAAU,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAA,iCAAgB,EAAC,IAAI,CAAC,CAAC;QAC/E,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,KAAgB,EAChB,MAA8B,EAC9B,IAA6F;IAE7F,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC;IAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,kBAAQ,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACjF,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACvC,IAAI,KAAK,GAAG,MAAM,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAChE,IAAI,MAAM,CAAC,UAAU;YAAE,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACtD,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG;oBACN,GAAG,MAAM;oBACT,UAAU,EACR,UAAU,IAAI,CAAE,KAAK,CAAC,OAAiD,EAAE,UAAU,IAAI,EAAE,CAAC;oBAC5F,aAAa,EAAE,KAAK;iBACrB,CAAC;gBACF,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;iBAAM,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACtC,mDAAmD;gBACnD,OAAO;oBACL,KAAK,EAAE;wBACL,GAAG,KAAK;wBACR,IAAI,EAAE,KAAK;wBACX,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC;qBACvE;oBACD,UAAU;iBACX,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,GAAG,MAAM,IAAA,cAAO,EAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAA,kBAAQ,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC;IACzF,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;QAC9B,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzE,IAAI,SAAS,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,MAA8B,EAC9B,IAA0F;IAE1F,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,IAAI,GAAG,MAAM,IAAA,kBAAW,EAAC,MAAM,EAAE,IAAA,iCAAa,EAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACjF,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9E,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,mBAAmB,CACvC,MAAkB,EAClB,MAA8B,EAC9B,IAA0F;IAE1F,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,iCAAa,EAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9E,IAAI,IAAI,GAAG,MAAM,IAAA,oCAAkB,EAAC,MAAM,EAAE;QAC1C,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,MAAM;QACN,OAAO;QACP,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IACH,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9E,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CACvC,MAAkB,EAClB,KAAgB,EAChB,IAAyD;IAEzD,MAAM,IAAI,GAAG,MAAM,IAAA,uCAAqB,EAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC5H,CAAC;AACJ,CAAC"}

package/dist/dev-browser.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The "dev browser": sign-in on a development instance from an app on
+ * `localhost`.
+ *
+ * The session lives in cookies on the instance's Frontend API host. From
+ * `localhost` that host is cross-site, so a browser that blocks third-party
+ * cookies (Chrome, Safari) drops them: the sign-in completes, then the next
+ * boot finds no session. On a development instance (a `pk_test_` key) the SDK
+ * therefore also keeps the session's refresh token in `localStorage` and
+ * presents it as `x-refresh-token`, which development instances accept in
+ * place of the cookie. Production keys never do this: a token readable by
+ * page scripts is fine for local development, not for real users.
+ *
+ * {@link withDevBrowser} wraps a `fetch`, so every Frontend API caller (the
+ * FAPI client and each framework provider) behaves the same:
+ *  - `POST /v1/client/tickets/exchange` asks for the refresh token
+ *    (`return_refresh_token: true`) and keeps it;
+ *  - `GET /v1/client` and `POST /v1/client/sessions/:id/tokens` present it;
+ *    the rotated token a refresh returns replaces it;
+ *  - a boot that finds no session, a refused refresh, or a sign-out forgets it.
+ * The cookies are still set and sent where the browser allows them; the
+ * header is only read when there is no cookie.
+ */
+/** Whether the dev browser applies: a development instance's key, in a browser with storage. */
+export declare function devBrowserEnabled(publishableKey: string): boolean;
+/** The stored refresh token for a development instance, or null. */
+export declare function devBrowserToken(publishableKey: string): string | null;
+/** Forget the stored refresh token (sign-out; tests). */
+export declare function forgetDevBrowserToken(publishableKey: string): void;
+export declare function withDevBrowser(publishableKey: string, fetchImpl: typeof fetch): typeof fetch;

package/dist/dev-browser.js

@@ -0,0 +1,175 @@
+"use strict";
+/**
+ * The "dev browser": sign-in on a development instance from an app on
+ * `localhost`.
+ *
+ * The session lives in cookies on the instance's Frontend API host. From
+ * `localhost` that host is cross-site, so a browser that blocks third-party
+ * cookies (Chrome, Safari) drops them: the sign-in completes, then the next
+ * boot finds no session. On a development instance (a `pk_test_` key) the SDK
+ * therefore also keeps the session's refresh token in `localStorage` and
+ * presents it as `x-refresh-token`, which development instances accept in
+ * place of the cookie. Production keys never do this: a token readable by
+ * page scripts is fine for local development, not for real users.
+ *
+ * {@link withDevBrowser} wraps a `fetch`, so every Frontend API caller (the
+ * FAPI client and each framework provider) behaves the same:
+ *  - `POST /v1/client/tickets/exchange` asks for the refresh token
+ *    (`return_refresh_token: true`) and keeps it;
+ *  - `GET /v1/client` and `POST /v1/client/sessions/:id/tokens` present it;
+ *    the rotated token a refresh returns replaces it;
+ *  - a boot that finds no session, a refused refresh, or a sign-out forgets it.
+ * The cookies are still set and sent where the browser allows them; the
+ * header is only read when there is no cookie.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.devBrowserEnabled = devBrowserEnabled;
+exports.devBrowserToken = devBrowserToken;
+exports.forgetDevBrowserToken = forgetDevBrowserToken;
+exports.withDevBrowser = withDevBrowser;
+const STORAGE_PREFIX = '__atlas_dev_session:';
+const EXCHANGE = '/v1/client/tickets/exchange';
+const BOOT = '/v1/client';
+const REFRESH = /^\/v1\/client\/sessions\/[^/]+\/tokens$/;
+const REVOKE = /^\/v1\/client\/sessions\/[^/]+\/revoke$/;
+function storage() {
+    try {
+        const s = globalThis.localStorage;
+        return s && typeof s.getItem === 'function' ? s : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Whether the dev browser applies: a development instance's key, in a browser with storage. */
+function devBrowserEnabled(publishableKey) {
+    return publishableKey.startsWith('pk_test_') && storage() !== null;
+}
+/** The stored refresh token for a development instance, or null. */
+function devBrowserToken(publishableKey) {
+    try {
+        return storage()?.getItem(STORAGE_PREFIX + publishableKey) ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+const SESSION_SUFFIX = ':sid';
+function remember(publishableKey, token, sessionId) {
+    if (typeof token !== 'string' || !token)
+        return;
+    try {
+        storage()?.setItem(STORAGE_PREFIX + publishableKey, token);
+        if (typeof sessionId === 'string' && sessionId)
+            storage()?.setItem(STORAGE_PREFIX + publishableKey + SESSION_SUFFIX, sessionId);
+    }
+    catch {
+        // Storage full or blocked: the cookie path still works where the browser allows it.
+    }
+}
+function storedSessionId(publishableKey) {
+    try {
+        return storage()?.getItem(STORAGE_PREFIX + publishableKey + SESSION_SUFFIX) ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Forget the stored refresh token (sign-out; tests). */
+function forgetDevBrowserToken(publishableKey) {
+    try {
+        storage()?.removeItem(STORAGE_PREFIX + publishableKey);
+        storage()?.removeItem(STORAGE_PREFIX + publishableKey + SESSION_SUFFIX);
+    }
+    catch {
+        // nothing to forget
+    }
+}
+function pathOf(input) {
+    try {
+        const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+        return new URL(url, 'https://invalid.example').pathname;
+    }
+    catch {
+        return null;
+    }
+}
+/** The session id in `/v1/client/sessions/:id/…`. */
+function sessionIdIn(path) {
+    const m = /^\/v1\/client\/sessions\/([^/]+)\//.exec(path);
+    return m ? decodeURIComponent(m[1]) : null;
+}
+async function bodyOf(response) {
+    try {
+        const b = (await response.clone().json());
+        return b && typeof b === 'object' && !Array.isArray(b) ? b : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * `fetchImpl` with the dev browser for `publishableKey`. Returns `fetchImpl`
+ * unchanged for a production key or where there is no storage.
+ */
+const WRAPPED = Symbol.for('atlas.devBrowser');
+function withDevBrowser(publishableKey, fetchImpl) {
+    // A provider hands its (already wrapped) fetch to the FAPI client too: wrap once.
+    if (!publishableKey.startsWith('pk_test_') || fetchImpl[WRAPPED])
+        return fetchImpl;
+    const wrapped = async (input, init) => {
+        if (!devBrowserEnabled(publishableKey))
+            return fetchImpl(input, init);
+        const path = pathOf(input);
+        const method = (init?.method ?? 'GET').toUpperCase();
+        let nextInit = init;
+        let presented = false;
+        if (path === EXCHANGE && method === 'POST' && typeof init?.body === 'string') {
+            try {
+                const body = JSON.parse(init.body);
+                if (body && typeof body === 'object' && !Array.isArray(body)) {
+                    nextInit = { ...init, body: JSON.stringify({ ...body, return_refresh_token: true }) };
+                }
+            }
+            catch {
+                // not JSON: send it as it is
+            }
+        }
+        const token = devBrowserToken(publishableKey);
+        if (token && ((path === BOOT && method === 'GET') || (path && REFRESH.test(path) && method === 'POST'))) {
+            const headers = new Headers(nextInit?.headers);
+            if (!headers.has('x-refresh-token'))
+                headers.set('x-refresh-token', token);
+            nextInit = { ...nextInit, headers };
+            presented = true;
+        }
+        const response = await fetchImpl(input, nextInit);
+        if (!path)
+            return response;
+        if (path === EXCHANGE && response.ok) {
+            const body = await bodyOf(response);
+            remember(publishableKey, body?.refresh_token, body?.id);
+        }
+        else if (path && REFRESH.test(path)) {
+            if (response.ok)
+                remember(publishableKey, (await bodyOf(response))?.refresh_token, sessionIdIn(path));
+            else if (presented && response.status === 401)
+                forgetDevBrowserToken(publishableKey);
+        }
+        else if (path === BOOT && presented && response.ok) {
+            const body = await bodyOf(response);
+            if (body && body.session === null)
+                forgetDevBrowserToken(publishableKey);
+        }
+        else if (path && REVOKE.test(path) && (response.ok || response.status === 404)) {
+            // Only this browser's own session: revoking another device keeps us signed in.
+            const sid = storedSessionId(publishableKey);
+            if (!sid || sid === sessionIdIn(path))
+                forgetDevBrowserToken(publishableKey);
+        }
+        return response;
+    };
+    wrapped[WRAPPED] = true;
+    return wrapped;
+}
+//# sourceMappingURL=dev-browser.js.map

package/dist/dev-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-browser.js","sourceRoot":"","sources":["../src/dev-browser.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;AAoBH,8CAEC;AAGD,0CAMC;AAuBD,sDAOC;AAgCD,wCAgDC;AA3ID,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAC9C,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,IAAI,GAAG,YAAY,CAAC;AAC1B,MAAM,OAAO,GAAG,yCAAyC,CAAC;AAC1D,MAAM,MAAM,GAAG,yCAAyC,CAAC;AAIzD,SAAS,OAAO;IACd,IAAI,CAAC;QACH,MAAM,CAAC,GAAI,UAAuC,CAAC,YAAY,CAAC;QAChE,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,SAAgB,iBAAiB,CAAC,cAAsB;IACtD,OAAO,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AACrE,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAAC,cAAsB;IACpD,IAAI,CAAC;QACH,OAAO,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC,IAAI,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,SAAS,QAAQ,CAAC,cAAsB,EAAE,KAAc,EAAE,SAAkB;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO;IAChD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,GAAG,cAAc,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS;YAAE,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,GAAG,cAAc,GAAG,cAAc,EAAE,SAAS,CAAC,CAAC;IAClI,CAAC;IAAC,MAAM,CAAC;QACP,oFAAoF;IACtF,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,cAAsB;IAC7C,IAAI,CAAC;QACH,OAAO,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,GAAG,cAAc,GAAG,cAAc,CAAC,IAAI,IAAI,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,SAAgB,qBAAqB,CAAC,cAAsB;IAC1D,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,UAAU,CAAC,cAAc,GAAG,cAAc,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,UAAU,CAAC,cAAc,GAAG,cAAc,GAAG,cAAc,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAwB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAC9F,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAkB;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAY,CAAC;QACrD,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAE/C,SAAgB,cAAc,CAAC,cAAsB,EAAE,SAAuB;IAC5E,kFAAkF;IAClF,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,IAAK,SAAgD,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3H,MAAM,OAAO,GAAG,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAqB,EAAE;QACxF,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC;YAAE,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7E,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAY,CAAC;gBAC9C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7D,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAI,IAAgC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC;YACxG,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YAC3E,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;YACpC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC;QAC3B,IAAI,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,EAAE;gBAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;iBACjG,IAAI,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,SAAS,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;gBAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAC3E,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,+EAA+E;YAC/E,MAAM,GAAG,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,WAAW,CAAC,IAAI,CAAC;gBAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACD,OAA8C,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAChE,OAAO,OAAuB,CAAC;AACjC,CAAC"}

package/dist/environment.d.ts

@@ -41,6 +41,53 @@ export declare function emailDeliveryFrom(body: unknown): EmailDelivery;
  * `delivery` (not loaded yet) the list is returned unchanged.
  */
 export declare function offeredFirstFactors(strategies: readonly string[], delivery: EmailDelivery | null | undefined): string[];
+/** The username rule an instance enforces (from `account.username`). */
+export interface UsernameRule {
+    minLength: number;
+    maxLength: number;
+    /** `default` = letters, digits and `. _ -`. */
+    charset: 'default' | 'alphanumeric' | 'alphanumeric_underscore';
+    requiredAtSignUp: boolean;
+}
+/** How an emailed proof arrives: a code to type, a link to click, or either. */
+export type EmailProofDelivery = 'code' | 'link' | 'both';
+/** `account`: what a sign-in / sign-up form needs to draw itself. */
+export interface AccountUx {
+    /** Null while usernames are off. */
+    username: UsernameRule | null;
+    /** Badge the method this browser last signed in with as "Last used". */
+    lastSignInMethod: boolean;
+    emailVerification: EmailProofDelivery;
+    passwordReset: EmailProofDelivery;
+    /** The second-factor step may offer "email me a code" ({@link prepareEmailSecondFactor}). */
+    emailSecondFactor: boolean;
+    /**
+     * Passkey-only sign-up ({@link startPasskeySignUp}), when the instance offers
+     * it: whether the form collects an email address. Null when not offered.
+     */
+    passkeySignUp: {
+        email: 'off' | 'optional' | 'required';
+    } | null;
+    /**
+     * The second factors a sign-in may set up or use, when the server says
+     * (`account.mfa`): an authenticator app, texted codes (on AND the app can
+     * text), and how many authenticator codes enrolment asks for. Absent on a
+     * server that does not say: the MFA steps then offer the authenticator app
+     * only (see `mfaChoicesFrom`).
+     */
+    mfa?: {
+        totp: boolean;
+        sms: boolean;
+        totpCodes: 1 | 2;
+    };
+}
+/**
+ * What an older server (no `account`) is taken to mean: no usernames at
+ * sign-up, codes only, and no "Last used" hint (it has no endpoint for one).
+ */
+export declare const ACCOUNT_UX_DEFAULT: Readonly<AccountUx>;
+/** Read `account` from a `/v1/client/environment` or `/v1/appearance` body. */
+export declare function accountUxFrom(body: unknown): AccountUx;
 /** One entry of the environment's `social_providers`. */
 export interface EnvironmentSocialProvider {
     provider: string;
@@ -72,6 +119,7 @@ export interface ClientEnvironment {
     strategies: Record<string, unknown>;
     emailDelivery: EmailDelivery;
     socialProviders: EnvironmentSocialProvider[];
+    account: AccountUx;
 }
 /** Read a `/v1/client/environment` body. Defensive: malformed parts read as empty. */
 export declare function clientEnvironmentFrom(body: unknown): ClientEnvironment;