@atlasauth/js 0.15.0 → 0.17.0

package/dist/device-authorization.d.ts

@@ -0,0 +1,70 @@
+import type { FapiClient } from './fapi';
+/**
+ * Device sign-in (OAuth 2.0 Device Authorization Grant, RFC 8628) from YOUR app:
+ * the signed-in user types — or scans — the code their TV, console or CLI shows,
+ * and your own page approves it. The alternative to sending them to Atlas's
+ * hosted `/oauth2/device` page.
+ *
+ *   const auth = await lookupDeviceAuthorization(client, typedCode);
+ *   // show auth.client.name and auth.scopes, then:
+ *   await approveDeviceAuthorization(client, auth);   // or denyDeviceAuthorization
+ *
+ * The calls use the signed-in session (the cookie, or a native app's session
+ * token). When the application requires a recent re-authentication to approve a
+ * device (`requiresStepUp`), a stale session gets a
+ * {@link DeviceAuthorizationError} with `needsReverification` — re-authenticate
+ * (`reauthenticate()`), then approve again.
+ */
+export interface DeviceAuthorizationScope {
+    scope: string;
+    /** A human description for the consent text. */
+    description: string;
+}
+export interface DeviceAuthorization {
+    object: 'device_authorization';
+    id: string;
+    /** The code as the device shows it, e.g. `WDJB-MJHT`. */
+    userCode: string;
+    status: 'pending' | 'approved' | 'denied';
+    client: {
+        clientId: string;
+        name: string;
+        logoUrl: string | null;
+        homepageUrl: string | null;
+        firstParty: boolean;
+    };
+    scopes: DeviceAuthorizationScope[];
+    /** The API the device asked for a token for, if any. */
+    audience: string | null;
+    /** Approving needs a recent re-authentication. */
+    requiresStepUp: boolean;
+    createdAt: number;
+    expiresAt: number;
+}
+/** A refused request. `code` is the server's stable error code (`NOT_FOUND`, `RATE_LIMITED`, `STEP_UP_REQUIRED`, …). */
+export declare class DeviceAuthorizationError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly param?: string;
+    readonly reason?: string;
+    readonly meta?: Record<string, unknown>;
+    constructor(status: number, code: string, message: string, param?: string, reason?: string, meta?: Record<string, unknown>);
+    /** True when approving needs a fresh re-authentication first. */
+    get needsReverification(): boolean;
+    /** True when the code is unknown, expired or already used. */
+    get isInvalidCode(): boolean;
+}
+/**
+ * Normalise what a person typed into the `XXXX-XXXX` form devices show:
+ * uppercase, spaces and dashes ignored. Returns the input unchanged when it is
+ * not 8 letters or digits, so the server answers "not valid".
+ */
+export declare function formatUserCode(input: string): string;
+/** Read a `user_code` from a verification URL the device displayed (`?user_code=`), if any. */
+export declare function userCodeFromUrl(url: string | URL): string | null;
+/** Look up a pending device sign-in by the code the device shows. */
+export declare function lookupDeviceAuthorization(client: FapiClient, userCode: string): Promise<DeviceAuthorization>;
+/** Approve the device sign-in for the signed-in user. The device's next poll receives its tokens. */
+export declare function approveDeviceAuthorization(client: FapiClient, authorization: Pick<DeviceAuthorization, 'id' | 'userCode'>): Promise<DeviceAuthorization>;
+/** Deny the device sign-in. The device's next poll is told `access_denied`. */
+export declare function denyDeviceAuthorization(client: FapiClient, authorization: Pick<DeviceAuthorization, 'id' | 'userCode'>): Promise<DeviceAuthorization>;

package/dist/device-authorization.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceAuthorizationError = void 0;
+exports.formatUserCode = formatUserCode;
+exports.userCodeFromUrl = userCodeFromUrl;
+exports.lookupDeviceAuthorization = lookupDeviceAuthorization;
+exports.approveDeviceAuthorization = approveDeviceAuthorization;
+exports.denyDeviceAuthorization = denyDeviceAuthorization;
+/** A refused request. `code` is the server's stable error code (`NOT_FOUND`, `RATE_LIMITED`, `STEP_UP_REQUIRED`, …). */
+class DeviceAuthorizationError extends Error {
+    code;
+    status;
+    param;
+    reason;
+    meta;
+    constructor(status, code, message, param, reason, meta) {
+        super(message);
+        this.name = 'DeviceAuthorizationError';
+        this.status = status;
+        this.code = code;
+        this.param = param;
+        if (reason)
+            this.reason = reason;
+        if (meta)
+            this.meta = meta;
+    }
+    /** True when approving needs a fresh re-authentication first. */
+    get needsReverification() {
+        return this.code === 'STEP_UP_REQUIRED';
+    }
+    /** True when the code is unknown, expired or already used. */
+    get isInvalidCode() {
+        return this.status === 404 || this.status === 409;
+    }
+}
+exports.DeviceAuthorizationError = DeviceAuthorizationError;
+const BASE = '/v1/client/me/device_authorizations';
+function fromWire(w) {
+    return {
+        object: 'device_authorization',
+        id: w.id,
+        userCode: w.user_code,
+        status: w.status,
+        client: {
+            clientId: w.client.client_id,
+            name: w.client.name,
+            logoUrl: w.client.logo_url ?? null,
+            homepageUrl: w.client.homepage_url ?? null,
+            firstParty: w.client.first_party === true,
+        },
+        scopes: w.scopes ?? [],
+        audience: w.audience ?? null,
+        requiresStepUp: w.requires_step_up === true,
+        createdAt: w.created_at,
+        expiresAt: w.expires_at,
+    };
+}
+async function call(client, path, body) {
+    const res = await client.request(path, { method: 'POST', body: JSON.stringify(body) });
+    if (!res.ok || !res.data) {
+        const first = res.errors[0];
+        throw new DeviceAuthorizationError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.', first?.param, first?.reason, first?.meta);
+    }
+    return fromWire(res.data);
+}
+/**
+ * Normalise what a person typed into the `XXXX-XXXX` form devices show:
+ * uppercase, spaces and dashes ignored. Returns the input unchanged when it is
+ * not 8 letters or digits, so the server answers "not valid".
+ */
+function formatUserCode(input) {
+    const cleaned = input.toUpperCase().replace(/[^A-Z0-9]/g, '');
+    return cleaned.length === 8 ? `${cleaned.slice(0, 4)}-${cleaned.slice(4)}` : input.trim();
+}
+/** Read a `user_code` from a verification URL the device displayed (`?user_code=`), if any. */
+function userCodeFromUrl(url) {
+    try {
+        const value = new URL(String(url)).searchParams.get('user_code');
+        return value ? formatUserCode(value) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Look up a pending device sign-in by the code the device shows. */
+async function lookupDeviceAuthorization(client, userCode) {
+    return call(client, `${BASE}/lookup`, { user_code: formatUserCode(userCode) });
+}
+/** Approve the device sign-in for the signed-in user. The device's next poll receives its tokens. */
+async function approveDeviceAuthorization(client, authorization) {
+    return call(client, `${BASE}/${encodeURIComponent(authorization.id)}/approve`, { user_code: authorization.userCode });
+}
+/** Deny the device sign-in. The device's next poll is told `access_denied`. */
+async function denyDeviceAuthorization(client, authorization) {
+    return call(client, `${BASE}/${encodeURIComponent(authorization.id)}/deny`, { user_code: authorization.userCode });
+}
+//# sourceMappingURL=device-authorization.js.map

package/dist/device-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-authorization.js","sourceRoot":"","sources":["../src/device-authorization.ts"],"names":[],"mappings":";;;AAqIA,wCAGC;AAGD,0CAOC;AAGD,8DAEC;AAGD,gEAKC;AAGD,0DAKC;AAxHD,wHAAwH;AACxH,MAAa,wBAAyB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,MAAM,CAAS;IACf,KAAK,CAAU;IACf,MAAM,CAAU;IAChB,IAAI,CAA2B;IAExC,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,KAAc,EAAE,MAAe,EAAE,IAA8B;QACxH,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACjC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,iEAAiE;IACjE,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC;IAC1C,CAAC;IAED,8DAA8D;IAC9D,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC;IACpD,CAAC;CACF;AA1BD,4DA0BC;AAeD,MAAM,IAAI,GAAG,qCAAqC,CAAC;AAEnD,SAAS,QAAQ,CAAC,CAA0B;IAC1C,OAAO;QACL,MAAM,EAAE,sBAAsB;QAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;YAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;YACnB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI;YAClC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI;YAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI;SAC1C;QACD,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,cAAc,EAAE,CAAC,CAAC,gBAAgB,KAAK,IAAI;QAC3C,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,MAAkB,EAAE,IAAY,EAAE,IAA6B;IACjF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAA0B,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,wBAAwB,CAChC,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,IAAI,IAAI,SAAS,EACxB,KAAK,EAAE,OAAO,IAAI,qBAAqB,EACvC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CACZ,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,KAAa;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAC5F,CAAC;AAED,+FAA+F;AAC/F,SAAgB,eAAe,CAAC,GAAiB;IAC/C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qEAAqE;AAC9D,KAAK,UAAU,yBAAyB,CAAC,MAAkB,EAAE,QAAgB;IAClF,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,qGAAqG;AAC9F,KAAK,UAAU,0BAA0B,CAC9C,MAAkB,EAClB,aAA2D;IAE3D,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxH,CAAC;AAED,+EAA+E;AACxE,KAAK,UAAU,uBAAuB,CAC3C,MAAkB,EAClB,aAA2D;IAE3D,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;AACrH,CAAC"}

package/dist/email-code-check.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Check an emailed one-time code WITHOUT using it up.
+ *
+ * Every email-code step has a `check` endpoint beside its `attempt` endpoint:
+ * the server answers whether the code is right and still live (and until when),
+ * and leaves it redeemable, so a form can show "code accepted" as the user
+ * types and only submit the step when they confirm. A wrong code spends one of
+ * the code's attempts exactly like a submission — checking is no way around the
+ * lockout — and the check endpoints share the credential-verify rate budget.
+ *
+ *   sign-in first factor   POST /v1/client/sign_ins/:id/check_first_factor
+ *   sign-in second factor  POST /v1/client/sign_ins/:id/check_second_factor
+ *   sign-up verification   POST /v1/client/sign_ups/:id/check_verification
+ *   step-up                POST /v1/client/me/step_up/check
+ *   add-email verification POST /v1/client/me/email_addresses/:id/check_verification
+ */
+import type { FapiClient, FapiResponse } from './fapi';
+import { type AttemptView } from './attempt';
+/** A right, live code. */
+export interface EmailCodeCheck {
+    object: 'email_code_check';
+    valid: true;
+    /** When the code stops working (ISO 8601). */
+    expires_at: string;
+    /** Wrong entries left before the code is locked. */
+    attempts_remaining: number;
+}
+/** Where the code being checked belongs. */
+export type EmailCodeTarget = {
+    kind: 'sign_in_first_factor';
+    attemptId: string;
+} | {
+    kind: 'sign_in_second_factor';
+    attemptId: string;
+} | {
+    kind: 'sign_up_verification';
+    attemptId: string;
+} | {
+    kind: 'step_up';
+} | {
+    kind: 'email_address';
+    emailAddressId: string;
+};
+/** The check endpoint and body for a target. */
+export declare function emailCodeCheckRequest(target: EmailCodeTarget, code: string): {
+    path: string;
+    body: Record<string, unknown>;
+};
+/**
+ * Check a code. `ok` with `data` for a right, live code; otherwise the server's
+ * errors — `VERIFICATION_FAILED` (wrong, expired or unknown) or
+ * `TOO_MANY_ATTEMPTS` (the code is locked; request a new one).
+ */
+export declare function checkEmailCode(client: FapiClient, target: EmailCodeTarget, code: string): Promise<FapiResponse<EmailCodeCheck>>;
+/**
+ * The check target for the code step a flow is on, or null when the current
+ * step takes no emailed code. An emailed code on the first-factor step, the
+ * email second factor, and sign-up verification are covered.
+ */
+export declare function emailCodeTargetForAttempt(attempt: AttemptView | null | undefined): EmailCodeTarget | null;

package/dist/email-code-check.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emailCodeCheckRequest = emailCodeCheckRequest;
+exports.checkEmailCode = checkEmailCode;
+exports.emailCodeTargetForAttempt = emailCodeTargetForAttempt;
+const attempt_1 = require("./attempt");
+/** The check endpoint and body for a target. */
+function emailCodeCheckRequest(target, code) {
+    const id = (v) => encodeURIComponent(v);
+    switch (target.kind) {
+        case 'sign_in_first_factor':
+            return { path: `/v1/client/sign_ins/${id(target.attemptId)}/check_first_factor`, body: { strategy: 'email_code', code } };
+        case 'sign_in_second_factor':
+            return { path: `/v1/client/sign_ins/${id(target.attemptId)}/check_second_factor`, body: { strategy: 'email_code', code } };
+        case 'sign_up_verification':
+            return { path: `/v1/client/sign_ups/${id(target.attemptId)}/check_verification`, body: { strategy: 'email_code', code } };
+        case 'step_up':
+            return { path: '/v1/client/me/step_up/check', body: { strategy: 'email_code', code } };
+        case 'email_address':
+            return { path: `/v1/client/me/email_addresses/${id(target.emailAddressId)}/check_verification`, body: { code } };
+    }
+}
+/**
+ * Check a code. `ok` with `data` for a right, live code; otherwise the server's
+ * errors — `VERIFICATION_FAILED` (wrong, expired or unknown) or
+ * `TOO_MANY_ATTEMPTS` (the code is locked; request a new one).
+ */
+function checkEmailCode(client, target, code) {
+    const { path, body } = emailCodeCheckRequest(target, code);
+    return client.post(path, body);
+}
+/**
+ * The check target for the code step a flow is on, or null when the current
+ * step takes no emailed code. An emailed code on the first-factor step, the
+ * email second factor, and sign-up verification are covered.
+ */
+function emailCodeTargetForAttempt(attempt) {
+    if (!attempt?.id)
+        return null;
+    switch ((0, attempt_1.nextStep)(attempt).kind) {
+        case 'collect_first_factor':
+            return { kind: 'sign_in_first_factor', attemptId: attempt.id };
+        case 'collect_second_factor':
+            return { kind: 'sign_in_second_factor', attemptId: attempt.id };
+        case 'collect_email_code':
+            return { kind: 'sign_up_verification', attemptId: attempt.id };
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=email-code-check.js.map

package/dist/email-code-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-code-check.js","sourceRoot":"","sources":["../src/email-code-check.ts"],"names":[],"mappings":";;AAsCA,sDAcC;AAOD,wCAGC;AAOD,8DAYC;AAhED,uCAAuD;AAoBvD,gDAAgD;AAChD,SAAgB,qBAAqB,CAAC,MAAuB,EAAE,IAAY;IACzE,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5H,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7H,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5H,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QACzF,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;IACrH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,MAAkB,EAAE,MAAuB,EAAE,IAAY;IACtF,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAiB,IAAI,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAgB,yBAAyB,CAAC,OAAuC;IAC/E,IAAI,CAAC,OAAO,EAAE,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,QAAQ,IAAA,kBAAQ,EAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACjE,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QAClE,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACjE;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/environment.d.ts

@@ -41,6 +41,53 @@ export declare function emailDeliveryFrom(body: unknown): EmailDelivery;
  * `delivery` (not loaded yet) the list is returned unchanged.
  */
 export declare function offeredFirstFactors(strategies: readonly string[], delivery: EmailDelivery | null | undefined): string[];
+/** The username rule an instance enforces (from `account.username`). */
+export interface UsernameRule {
+    minLength: number;
+    maxLength: number;
+    /** `default` = letters, digits and `. _ -`. */
+    charset: 'default' | 'alphanumeric' | 'alphanumeric_underscore';
+    requiredAtSignUp: boolean;
+}
+/** How an emailed proof arrives: a code to type, a link to click, or either. */
+export type EmailProofDelivery = 'code' | 'link' | 'both';
+/** `account`: what a sign-in / sign-up form needs to draw itself. */
+export interface AccountUx {
+    /** Null while usernames are off. */
+    username: UsernameRule | null;
+    /** Badge the method this browser last signed in with as "Last used". */
+    lastSignInMethod: boolean;
+    emailVerification: EmailProofDelivery;
+    passwordReset: EmailProofDelivery;
+    /** The second-factor step may offer "email me a code" ({@link prepareEmailSecondFactor}). */
+    emailSecondFactor: boolean;
+    /**
+     * Passkey-only sign-up ({@link startPasskeySignUp}), when the instance offers
+     * it: whether the form collects an email address. Null when not offered.
+     */
+    passkeySignUp: {
+        email: 'off' | 'optional' | 'required';
+    } | null;
+    /**
+     * The second factors a sign-in may set up or use, when the server says
+     * (`account.mfa`): an authenticator app, texted codes (on AND the app can
+     * text), and how many authenticator codes enrolment asks for. Absent on a
+     * server that does not say: the MFA steps then offer the authenticator app
+     * only (see `mfaChoicesFrom`).
+     */
+    mfa?: {
+        totp: boolean;
+        sms: boolean;
+        totpCodes: 1 | 2;
+    };
+}
+/**
+ * What an older server (no `account`) is taken to mean: no usernames at
+ * sign-up, codes only, and no "Last used" hint (it has no endpoint for one).
+ */
+export declare const ACCOUNT_UX_DEFAULT: Readonly<AccountUx>;
+/** Read `account` from a `/v1/client/environment` or `/v1/appearance` body. */
+export declare function accountUxFrom(body: unknown): AccountUx;
 /** One entry of the environment's `social_providers`. */
 export interface EnvironmentSocialProvider {
     provider: string;
@@ -72,6 +119,7 @@ export interface ClientEnvironment {
     strategies: Record<string, unknown>;
     emailDelivery: EmailDelivery;
     socialProviders: EnvironmentSocialProvider[];
+    account: AccountUx;
 }
 /** Read a `/v1/client/environment` body. Defensive: malformed parts read as empty. */
 export declare function clientEnvironmentFrom(body: unknown): ClientEnvironment;

package/dist/environment.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EMAIL_FIRST_FACTORS = exports.EMAIL_UNAVAILABLE_MESSAGE = exports.EMAIL_DELIVERY_UNKNOWN = void 0;
+exports.ACCOUNT_UX_DEFAULT = exports.EMAIL_FIRST_FACTORS = exports.EMAIL_UNAVAILABLE_MESSAGE = exports.EMAIL_DELIVERY_UNKNOWN = void 0;
 exports.emailDeliveryFrom = emailDeliveryFrom;
 exports.offeredFirstFactors = offeredFirstFactors;
+exports.accountUxFrom = accountUxFrom;
 exports.clientEnvironmentFrom = clientEnvironmentFrom;
 exports.fetchClientEnvironment = fetchClientEnvironment;
 /**
@@ -47,6 +48,57 @@ function offeredFirstFactors(strategies, delivery) {
         return [...strategies];
     return strategies.filter((s) => !exports.EMAIL_FIRST_FACTORS.includes(s));
 }
+/**
+ * What an older server (no `account`) is taken to mean: no usernames at
+ * sign-up, codes only, and no "Last used" hint (it has no endpoint for one).
+ */
+exports.ACCOUNT_UX_DEFAULT = Object.freeze({
+    username: null,
+    lastSignInMethod: false,
+    emailVerification: 'code',
+    passwordReset: 'code',
+    emailSecondFactor: false,
+    passkeySignUp: null,
+});
+const proof = (v) => (v === 'link' || v === 'both' ? v : 'code');
+/** Read `account` from a `/v1/client/environment` or `/v1/appearance` body. */
+function accountUxFrom(body) {
+    const raw = isRecord(body) && isRecord(body.account) ? body.account : null;
+    if (!raw)
+        return { ...exports.ACCOUNT_UX_DEFAULT };
+    const u = isRecord(raw.username) ? raw.username : null;
+    const n = (v, d) => (typeof v === 'number' && Number.isInteger(v) ? v : d);
+    return {
+        username: u
+            ? {
+                minLength: n(u.min_length, 3),
+                maxLength: n(u.max_length, 30),
+                charset: u.charset === 'alphanumeric' || u.charset === 'alphanumeric_underscore' ? u.charset : 'default',
+                requiredAtSignUp: u.required_at_sign_up === true,
+            }
+            : null,
+        lastSignInMethod: raw.last_sign_in_method === true,
+        emailVerification: proof(raw.email_verification),
+        passwordReset: proof(raw.password_reset),
+        emailSecondFactor: raw.email_second_factor === true,
+        ...(isRecord(raw.mfa)
+            ? {
+                mfa: {
+                    totp: raw.mfa.totp !== false,
+                    sms: raw.mfa.sms === true,
+                    totpCodes: Number(raw.mfa.totp_codes ?? raw.mfa.totpCodes) >= 2 ? 2 : 1,
+                },
+            }
+            : {}),
+        passkeySignUp: isRecord(raw.passkey_sign_up)
+            ? {
+                email: raw.passkey_sign_up.email === 'off' || raw.passkey_sign_up.email === 'optional'
+                    ? raw.passkey_sign_up.email
+                    : 'required',
+            }
+            : null,
+    };
+}
 /** Read a `/v1/client/environment` body. Defensive: malformed parts read as empty. */
 function clientEnvironmentFrom(body) {
     const root = isRecord(body) ? body : {};
@@ -59,6 +111,7 @@ function clientEnvironmentFrom(body) {
         socialProviders: Array.isArray(root.social_providers)
             ? root.social_providers.filter((p) => isRecord(p) && typeof p.provider === 'string')
             : [],
+        account: accountUxFrom(root),
     };
 }
 /** Fetch the client environment. Null when the server can't be reached or errors. */

package/dist/environment.js.map

@@ -1 +1 @@
-{"version":3,"file":"environment.js","sourceRoot":"","sources":["../src/environment.ts"],"names":[],"mappings":";;;AAiDA,8CAWC;AAQD,kDAMC;AAkCD,sDAcC;AAGD,wDAOC;AA5GD;;;GAGG;AACU,QAAA,sBAAsB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAEH,iEAAiE;AACpD,QAAA,yBAAyB,GACpC,2FAA2F,CAAC;AAE9F,4DAA4D;AAC/C,QAAA,mBAAmB,GAAsB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,IAAa;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,IAAI,gBAAgB,IAAI,GAAG,IAAI,kBAAkB,IAAI,GAAG,CAAC,EAAE,CAAC;QACpG,OAAO,EAAE,GAAG,8BAAsB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;QACvC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,UAA6B,EAC7B,QAA0C;IAE1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS;QAAE,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;IAC5D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,2BAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAiCD,sFAAsF;AACtF,SAAgB,qBAAqB,CAAC,IAAa;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;YAC7C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACtE,CAAC,CAAC,EAAE;QACN,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;QACnE,aAAa,EAAE,iBAAiB,CAAC,IAAI,CAAC;QACtC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACnD,CAAC,CAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CACV;YAC9C,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,sBAAsB,CAAC,MAAkB;IAC7D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAU,wBAAwB,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../src/environment.ts"],"names":[],"mappings":";;;AAiDA,8CAWC;AAQD,kDAMC;AAuDD,sCAqCC;AAmCD,sDAeC;AAGD,wDAOC;AA1MD;;;GAGG;AACU,QAAA,sBAAsB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAEH,iEAAiE;AACpD,QAAA,yBAAyB,GACpC,2FAA2F,CAAC;AAE9F,4DAA4D;AAC/C,QAAA,mBAAmB,GAAsB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,IAAa;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,IAAI,gBAAgB,IAAI,GAAG,IAAI,kBAAkB,IAAI,GAAG,CAAC,EAAE,CAAC;QACpG,OAAO,EAAE,GAAG,8BAAsB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;QACvC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,UAA6B,EAC7B,QAA0C;IAE1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS;QAAE,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;IAC5D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,2BAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAuCD;;;GAGG;AACU,QAAA,kBAAkB,GAAwB,MAAM,CAAC,MAAM,CAAC;IACnE,QAAQ,EAAE,IAAI;IACd,gBAAgB,EAAE,KAAK;IACvB,iBAAiB,EAAE,MAAM;IACzB,aAAa,EAAE,MAAM;IACrB,iBAAiB,EAAE,KAAK;IACxB,aAAa,EAAE,IAAI;CACpB,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9F,+EAA+E;AAC/E,SAAgB,aAAa,CAAC,IAAa;IACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,GAAG,0BAAkB,EAAE,CAAC;IAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,MAAM,CAAC,GAAG,CAAC,CAAU,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,OAAO;QACL,QAAQ,EAAE,CAAC;YACT,CAAC,CAAC;gBACE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC7B,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC9B,OAAO,EACL,CAAC,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,CAAC,OAAO,KAAK,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACjG,gBAAgB,EAAE,CAAC,CAAC,mBAAmB,KAAK,IAAI;aACjD;YACH,CAAC,CAAC,IAAI;QACR,gBAAgB,EAAE,GAAG,CAAC,mBAAmB,KAAK,IAAI;QAClD,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAChD,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,iBAAiB,EAAE,GAAG,CAAC,mBAAmB,KAAK,IAAI;QACnD,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,CAAC,CAAC;gBACE,GAAG,EAAE;oBACH,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK;oBAC5B,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI;oBACzB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC/D;aACX;YACH,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,CAAC,CAAC;gBACE,KAAK,EACH,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK,UAAU;oBAC7E,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK;oBAC3B,CAAC,CAAC,UAAU;aACjB;YACH,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAkCD,sFAAsF;AACtF,SAAgB,qBAAqB,CAAC,IAAa;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;YAC7C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACtE,CAAC,CAAC,EAAE;QACN,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;QACnE,aAAa,EAAE,iBAAiB,CAAC,IAAI,CAAC;QACtC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACnD,CAAC,CAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CACV;YAC9C,CAAC,CAAC,EAAE;QACN,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,sBAAsB,CAAC,MAAkB;IAC7D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAU,wBAAwB,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/fapi.d.ts

@@ -66,6 +66,12 @@ export interface FapiResponse<T> {
     data: T | null;
     errors: FieldError[];
 }
+/**
+ * The starts that can create an account, and so carry the SDK's stable device
+ * id for the accounts-per-device abuse limit. Password and passwordless
+ * sign-ins never create one and do not send it.
+ */
+export declare const DEVICE_ID_ROUTES: ReadonlySet<string>;
 export declare class FapiClient {
     private readonly options;
     constructor(options: FapiClientOptions);
@@ -155,6 +161,14 @@ export interface FlowState {
      * unknown, and for a sign-in completed on another device.
      */
     sessionKept?: boolean;
+    /**
+     * The one-time recovery codes a mid-sign-in MFA enrolment came with
+     * (`attempt_mfa_enrollment`'s `backup_codes`). Kept here, in memory only and
+     * never in `attempt` or any storage, until the user says they saved them
+     * (`pendingRecoveryCodes` / `acknowledgeRecoveryCodes`): the prebuilt
+     * components show them before exchanging the ticket.
+     */
+    recoveryCodes?: string[] | null;
 }
 export declare const initialFlow: FlowState;
 /**
@@ -195,7 +209,22 @@ export declare function startSignUp(client: FapiClient, input: {
     fields?: Record<string, string>;
     consent?: boolean;
     captchaToken?: string;
+    /** The username to claim, when the instance offers usernames. */
+    username?: string;
 }): Promise<FlowState>;
+/**
+ * Resend a sign-up's emailed proof (a code, a link, or both — whatever the
+ * instance sends): `POST /v1/client/sign_ups/:id/prepare_verification`. The
+ * earlier code / link stops working. A refusal (a 429 with `retry_after`)
+ * comes back as `errors` with the attempt kept.
+ */
+export declare function resendSignUpVerification(client: FapiClient, state: FlowState): Promise<FlowState>;
+/**
+ * Whether a sign-up attempt is waiting on an emailed LINK only (no code to
+ * type): the form says "check your email" and the tab polls. `emailVerification`
+ * is the instance's `account.emailVerification`.
+ */
+export declare function awaitingSignUpLink(attempt: AttemptView | null | undefined, emailVerification: string | null | undefined): boolean;
 /** §5.3: ask the server to send a code or a magic link. */
 export declare function prepareFactor(client: FapiClient, state: FlowState, strategy: 'email_code' | 'email_link'): Promise<FlowState>;
 /**