@atlasauth/js 0.16.0 → 0.17.0

package/dist/compat.js

@@ -0,0 +1,363 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Auth0CompatClient = exports.Auth0CompatError = void 0;
+exports.decodeJwtPayload = decodeJwtPayload;
+exports.auth0UserFromClient = auth0UserFromClient;
+exports.createAuth0CompatClient = createAuth0CompatClient;
+/**
+ * `@atlasauth/js/compat` — a drop-in for `@auth0/auth0-spa-js` on Atlas, for
+ * framework-free browser apps (what `atlas migrate code --from auth0` rewrites
+ * `createAuth0Client` / `new Auth0Client` onto).
+ *
+ * The client keeps auth0-spa-js's method names and result shapes —
+ * `loginWithRedirect`, `handleRedirectCallback`, `isAuthenticated`, `getUser`,
+ * `getTokenSilently`, `logout`, … — on top of the Atlas Frontend API: the session
+ * lives in Atlas's own cookies, sign-in happens on your instance's hosted pages
+ * (or straight at a social provider when `authorizationParams.connection` is
+ * given), and tokens are Atlas session tokens. Move call sites to the native
+ * `@atlasauth/js` APIs at your own pace.
+ */
+const fapi_1 = require("./fapi");
+const redirect_1 = require("./redirect");
+const sign_out_1 = require("./sign-out");
+const dev_browser_1 = require("./dev-browser");
+/** auth0-spa-js-style errors: `error` carries the OAuth-ish code apps branch on. */
+class Auth0CompatError extends Error {
+    error;
+    constructor(error, message) {
+        super(message);
+        this.error = error;
+        this.name = 'Auth0CompatError';
+    }
+}
+exports.Auth0CompatError = Auth0CompatError;
+/** Auth0 connection names → Atlas provider keys (others pass through). */
+const CONNECTIONS = {
+    'google-oauth2': 'google',
+    windowslive: 'microsoft',
+    'microsoft-account': 'microsoft',
+    github: 'github',
+    apple: 'apple',
+    facebook: 'facebook',
+    linkedin: 'linkedin',
+    twitter: 'twitter',
+    discord: 'discord',
+    gitlab: 'gitlab',
+    bitbucket: 'bitbucket',
+};
+const APP_STATE_KEY = 'atlas:compat:appState';
+/** Decode a JWT's payload (no verification: it came from our own FAPI). */
+function decodeJwtPayload(jwt) {
+    const part = jwt.split('.')[1];
+    if (!part)
+        return null;
+    try {
+        const b64 = part.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(part.length / 4) * 4, '=');
+        const json = decodeURIComponent(Array.from(atob(b64), (c) => `%${c.charCodeAt(0).toString(16).padStart(2, '0')}`).join(''));
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+/** Project the Frontend API user onto the OIDC profile shape. */
+function auth0UserFromClient(user) {
+    if (!user)
+        return undefined;
+    const emails = user.email_addresses ?? [];
+    const email = emails.find((e) => e.primary) ?? emails.find((e) => e.verified) ?? emails[0];
+    const out = { sub: user.id };
+    const name = [user.first_name, user.last_name].filter(Boolean).join(' ') || user.username;
+    if (name)
+        out.name = name;
+    if (user.first_name)
+        out.given_name = user.first_name;
+    if (user.last_name)
+        out.family_name = user.last_name;
+    if (user.username)
+        out.nickname = user.username;
+    if (user.image_url)
+        out.picture = user.image_url;
+    if (email) {
+        out.email = email.email_address;
+        out.email_verified = email.verified;
+    }
+    return out;
+}
+function frontendApiFrom(options) {
+    const raw = options.frontendApi ?? options.domain ?? '';
+    if (!raw)
+        return '';
+    const withScheme = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
+    return withScheme.replace(/\/+$/, '');
+}
+function withRedirect(url, redirectUrl) {
+    if (!redirectUrl)
+        return url;
+    return `${url}${url.includes('?') ? '&' : '?'}redirect_url=${encodeURIComponent(redirectUrl)}`;
+}
+function currentHref() {
+    return typeof window === 'undefined' ? undefined : window.location.href;
+}
+function storage() {
+    try {
+        return typeof window === 'undefined' ? null : window.sessionStorage;
+    }
+    catch {
+        return null;
+    }
+}
+/** The auth0-spa-js `Auth0Client`, on Atlas. */
+class Auth0CompatClient {
+    publishableKey;
+    frontendApi;
+    fapi;
+    raw;
+    options;
+    state = null;
+    token = null;
+    constructor(options) {
+        const publishableKey = options.publishableKey ?? options.clientId;
+        if (!publishableKey)
+            throw new Error('Auth0CompatClient: publishableKey is required.');
+        this.publishableKey = publishableKey;
+        this.frontendApi = frontendApiFrom(options);
+        this.options = options;
+        const fetchImpl = options.fetchImpl ?? ((...args) => fetch(...args));
+        this.fapi = new fapi_1.FapiClient({ publishableKey, baseUrl: this.frontendApi, fetchImpl });
+        const doFetch = (0, dev_browser_1.withDevBrowser)(publishableKey, fetchImpl);
+        this.raw = (path, init = {}) => doFetch(`${this.frontendApi}${path}`, {
+            ...init,
+            credentials: 'include',
+            headers: {
+                'x-publishable-key': publishableKey,
+                ...(init.body ? { 'content-type': 'application/json' } : {}),
+                ...init.headers,
+            },
+        });
+    }
+    signInUrl(signUp = false) {
+        if (signUp)
+            return this.options.signUpUrl ?? `${this.frontendApi}/hosted/sign-up`;
+        return this.options.signInUrl ?? `${this.frontendApi}/hosted/sign-in`;
+    }
+    /** Read the Frontend API client state (session, user, token). */
+    async load(force = false) {
+        if (!force && this.state && Date.now() - this.state.at < 2_000)
+            return this.state.body;
+        const response = await this.raw('/v1/client');
+        if (!response.ok)
+            throw new Error(`Atlas: could not read the session (HTTP ${response.status}).`);
+        const body = (await response.json());
+        this.state = { body, at: Date.now() };
+        if (body.session && body.jwt)
+            this.keepToken(body.jwt, body.session.id);
+        if (!body.session)
+            this.token = null;
+        return body;
+    }
+    keepToken(jwt, sessionId) {
+        const exp = Number(decodeJwtPayload(jwt)?.exp ?? 0) * 1000;
+        this.token = { jwt, exp, sessionId };
+    }
+    /** `checkSession()`: refresh the local view of the session; never throws. */
+    async checkSession() {
+        try {
+            await this.load(true);
+        }
+        catch {
+            // auth0-spa-js swallows login_required here too.
+        }
+    }
+    async isAuthenticated() {
+        const body = await this.load();
+        return Boolean(body.session && body.user);
+    }
+    async getUser() {
+        const body = await this.load();
+        return body.session ? auth0UserFromClient(body.user) : undefined;
+    }
+    async getIdTokenClaims() {
+        const jwt = await this.getTokenSilently().catch(() => null);
+        if (typeof jwt !== 'string')
+            return undefined;
+        const claims = decodeJwtPayload(jwt);
+        return claims ? { ...claims, __raw: jwt } : undefined;
+    }
+    async getTokenSilently(options = {}) {
+        const body = await this.load(options.cacheMode === 'off');
+        if (!body.session)
+            throw new Auth0CompatError('login_required', 'Login required');
+        let jwt = null;
+        let expiresIn = 0;
+        if (options.template) {
+            const t = await (0, fapi_1.getTemplateToken)(this.fapi, body.session.id, options.template);
+            if (!t)
+                throw new Auth0CompatError('login_required', `No token for template ${options.template}`);
+            jwt = t.jwt;
+            expiresIn = t.expiresIn;
+        }
+        else {
+            const usable = this.token && this.token.sessionId === body.session.id && this.token.exp - Date.now() > 10_000;
+            if (!usable || options.cacheMode === 'off') {
+                if (options.cacheMode === 'cache-only')
+                    throw new Auth0CompatError('login_required', 'No cached token');
+                const response = await this.raw(`/v1/client/sessions/${encodeURIComponent(body.session.id)}/tokens`, { method: 'POST' });
+                if (!response.ok)
+                    throw new Auth0CompatError('login_required', 'Login required');
+                const minted = (await response.json());
+                this.keepToken(minted.jwt, minted.session_id);
+            }
+            jwt = this.token.jwt;
+            expiresIn = Math.max(0, Math.floor((this.token.exp - Date.now()) / 1000));
+        }
+        return options.detailedResponse ? { access_token: jwt, id_token: jwt, expires_in: expiresIn } : jwt;
+    }
+    /** Sign in in a popup when needed, then return a token. */
+    async getTokenWithPopup(options = {}) {
+        if (!(await this.isAuthenticated()))
+            await this.loginWithPopup(options);
+        return this.getTokenSilently({ ...options, detailedResponse: false });
+    }
+    /**
+     * Navigate to sign-in. With `authorizationParams.connection` the user goes
+     * straight to that social provider; otherwise to the instance's hosted page.
+     * `appState` comes back from {@link handleRedirectCallback}.
+     */
+    async loginWithRedirect(options = {}) {
+        const params = options.authorizationParams ?? {};
+        const returnTo = params.redirect_uri ?? this.options.authorizationParams?.redirect_uri ?? currentHref();
+        if (options.appState !== undefined)
+            storage()?.setItem(APP_STATE_KEY, JSON.stringify(options.appState));
+        let url;
+        if (params.connection) {
+            const started = await (0, redirect_1.startOauthRedirect)(this.fapi, {
+                provider: CONNECTIONS[params.connection] ?? params.connection,
+                redirectUrl: returnTo ?? '/',
+            });
+            if (!started)
+                throw new Auth0CompatError('start_failed', `Could not start sign-in with ${params.connection}.`);
+            url = started.authorizationUrl;
+        }
+        else {
+            url = withRedirect(this.signInUrl(params.screen_hint === 'signup'), returnTo);
+        }
+        if (options.openUrl)
+            await options.openUrl(url);
+        else if (typeof window !== 'undefined')
+            window.location.assign(url);
+    }
+    /**
+     * Finish a redirect sign-in on the page you came back to: exchanges the
+     * one-time ticket in the URL (if any), removes it from the address bar, and
+     * returns the `appState` passed to `loginWithRedirect`.
+     */
+    async handleRedirectCallback(url) {
+        const href = url ?? currentHref() ?? '';
+        const search = href.includes('?') ? href.slice(href.indexOf('?')) : '';
+        const result = (0, redirect_1.readRedirectResult)(search.split('#')[0] ?? '');
+        if (result?.ticket) {
+            const response = await this.raw('/v1/client/tickets/exchange', {
+                method: 'POST',
+                body: JSON.stringify({ attempt_id: result.attemptId, ticket: result.ticket }),
+            });
+            if (!response.ok)
+                throw new Auth0CompatError('login_required', 'The sign-in could not be completed.');
+        }
+        else if (result?.status && result.status !== 'complete') {
+            throw new Auth0CompatError('login_required', `Sign-in needs another step (${result.status}).`);
+        }
+        if (!url && typeof window !== 'undefined' && result) {
+            window.history.replaceState({}, document.title, (0, redirect_1.stripRedirectParams)(window.location.href));
+        }
+        await this.load(true);
+        const raw = storage()?.getItem(APP_STATE_KEY);
+        storage()?.removeItem(APP_STATE_KEY);
+        let appState;
+        try {
+            appState = raw ? JSON.parse(raw) : undefined;
+        }
+        catch {
+            appState = undefined;
+        }
+        return appState === undefined ? {} : { appState };
+    }
+    /**
+     * Sign in in a popup: straight at a social provider with
+     * `authorizationParams.connection`, otherwise the hosted sign-in page (this
+     * waits until a session appears or the popup is closed, up to 5 minutes).
+     */
+    async loginWithPopup(options = {}) {
+        const params = options.authorizationParams ?? {};
+        if (params.connection) {
+            const outcome = await (0, redirect_1.startOauthPopup)(this.fapi, {
+                provider: CONNECTIONS[params.connection] ?? params.connection,
+                redirectUrl: currentHref() ?? '/',
+            });
+            if (outcome.blocked)
+                throw new Auth0CompatError('popup_blocked', 'The sign-in popup was blocked.');
+            if (outcome.ticket && outcome.attemptId) {
+                await this.raw('/v1/client/tickets/exchange', {
+                    method: 'POST',
+                    body: JSON.stringify({ attempt_id: outcome.attemptId, ticket: outcome.ticket }),
+                });
+            }
+            else if (!outcome.sessionDetected) {
+                throw new Auth0CompatError(outcome.error === 'popup_closed' ? 'popup_closed' : 'start_failed', outcome.error ?? 'Sign-in did not complete.');
+            }
+            await this.load(true);
+            return;
+        }
+        const popup = typeof window !== 'undefined' ? window.open(this.signInUrl(params.screen_hint === 'signup'), 'atlas-sign-in', 'width=500,height=650') : null;
+        if (!popup)
+            throw new Auth0CompatError('popup_blocked', 'The sign-in popup was blocked.');
+        const deadline = Date.now() + (options.timeoutInSeconds ?? 300) * 1000;
+        for (;;) {
+            await new Promise((r) => setTimeout(r, 1_000));
+            if (await this.isSignedInNow()) {
+                try {
+                    popup.close();
+                }
+                catch {
+                    /* cross-origin close */
+                }
+                return;
+            }
+            if (popup.closed)
+                throw new Auth0CompatError('popup_closed', 'The sign-in popup was closed.');
+            if (Date.now() > deadline)
+                throw new Auth0CompatError('timeout', 'Timed out waiting for sign-in.');
+        }
+    }
+    async isSignedInNow() {
+        try {
+            return Boolean((await this.load(true)).session);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Sign out (revokes the Atlas session), then go to `logoutParams.returnTo` (default: this site). */
+    async logout(options = {}) {
+        const body = this.state?.body ?? (await this.load().catch(() => null));
+        if (body?.session)
+            await (0, sign_out_1.revokeSession)(this.raw, body.session.id);
+        this.state = null;
+        this.token = null;
+        const url = options.logoutParams?.returnTo ?? (typeof window !== 'undefined' ? window.location.origin : '/');
+        if (options.openUrl === false)
+            return;
+        if (typeof options.openUrl === 'function')
+            await options.openUrl(url);
+        else if (typeof window !== 'undefined')
+            window.location.assign(url);
+    }
+}
+exports.Auth0CompatClient = Auth0CompatClient;
+/** `createAuth0Client(options)`: a client that has already checked the session. */
+async function createAuth0CompatClient(options) {
+    const client = new Auth0CompatClient(options);
+    await client.checkSession();
+    return client;
+}
+//# sourceMappingURL=compat.js.map

package/dist/compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat.js","sourceRoot":"","sources":["../src/compat.ts"],"names":[],"mappings":";;;AAwHA,4CAYC;AAGD,kDAgBC;AAoQD,0DAIC;AA/ZD;;;;;;;;;;;;GAYG;AACH,iCAAsD;AACtD,yCAA0G;AAC1G,yCAA2C;AAC3C,+CAA+C;AA8D/C,oFAAoF;AACpF,MAAa,gBAAiB,SAAQ,KAAK;IAE9B;IADX,YACW,KAA+G,EACxH,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,UAAK,GAAL,KAAK,CAA0G;QAIxH,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AARD,4CAQC;AAeD,0EAA0E;AAC1E,MAAM,WAAW,GAA2B;IAC1C,eAAe,EAAE,QAAQ;IACzB,WAAW,EAAE,WAAW;IACxB,mBAAmB,EAAE,WAAW;IAChC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;CACvB,CAAC;AAEF,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C,2EAA2E;AAC3E,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,kBAAkB,CAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAC3F,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,SAAgB,mBAAmB,CAAC,IAA6B;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAoB,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC;IAC1F,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1B,IAAI,IAAI,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACtD,IAAI,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChD,IAAI,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;IACjD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC;QAChC,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,OAAiC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC;IACtE,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,WAA+B;IAChE,IAAI,CAAC,WAAW;QAAE,OAAO,GAAG,CAAC;IAC7B,OAAO,GAAG,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,gBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,OAAO;IACd,IAAI,CAAC;QACH,OAAO,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gDAAgD;AAChD,MAAa,iBAAiB;IACnB,cAAc,CAAS;IACvB,WAAW,CAAS;IACZ,IAAI,CAAa;IACjB,GAAG,CAA0D;IAC7D,OAAO,CAA2B;IAC3C,KAAK,GAAiD,IAAI,CAAC;IAC3D,KAAK,GAA2D,IAAI,CAAC;IAE7E,YAAY,OAAiC;QAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;QAClE,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACvF,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAA8B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,IAAI,GAAG,IAAI,iBAAU,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,IAAA,4BAAc,EAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAC7B,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,EAAE,EAAE;YACpC,GAAG,IAAI;YACP,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE;gBACP,mBAAmB,EAAE,cAAc;gBACnC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAI,IAAI,CAAC,OAA8C;aACxD;SACF,CAAC,CAAC;IACP,CAAC;IAEO,SAAS,CAAC,MAAM,GAAG,KAAK;QAC9B,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,IAAI,CAAC,WAAW,iBAAiB,CAAC;QAClF,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,IAAI,CAAC,WAAW,iBAAiB,CAAC;IACxE,CAAC;IAED,iEAAiE;IACzD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK;QAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAClG,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,SAAS,CAAC,GAAW,EAAE,SAAiB;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3D,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAKD,KAAK,CAAC,gBAAgB,CAAC,UAAmC,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAClF,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,MAAM,IAAA,uBAAgB,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC/E,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,yBAAyB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClG,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;YACZ,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;YAC9G,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAC,SAAS,KAAK,YAAY;oBAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;gBACxG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,uBAAuB,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzH,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;gBACjF,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwC,CAAC;gBAC9E,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAChD,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,KAAM,CAAC,GAAG,CAAC;YACtB,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACtG,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,iBAAiB,CAAC,UAAgE,EAAE;QACxF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAAE,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,UAAsC,EAAE;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAI,MAAM,CAAC,YAAmC,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,YAAY,IAAI,WAAW,EAAE,CAAC;QAChI,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxG,IAAI,GAAW,CAAC;QAChB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,IAAA,6BAAkB,EAAC,IAAI,CAAC,IAAI,EAAE;gBAClD,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU;gBAC7D,WAAW,EAAE,QAAQ,IAAI,GAAG;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,gCAAgC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;YAC/G,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;aAC3C,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,sBAAsB,CAAC,GAAY;QACvC,MAAM,IAAI,GAAG,GAAG,IAAI,WAAW,EAAE,IAAI,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,IAAA,6BAAkB,EAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,6BAA6B,EAAE;gBAC7D,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAC9E,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;QACxG,CAAC;aAAM,IAAI,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1D,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,+BAA+B,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,GAAG,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,EAAE,CAAC;YACpD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAA,8BAAmB,EAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,OAAO,EAAE,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9C,OAAO,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QACrC,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QACD,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,UAAsE,EAAE;QAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,IAAA,0BAAe,EAAC,IAAI,CAAC,IAAI,EAAE;gBAC/C,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU;gBAC7D,WAAW,EAAE,WAAW,EAAE,IAAI,GAAG;aAClC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;YACnG,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACxC,MAAM,IAAI,CAAC,GAAG,CAAC,6BAA6B,EAAE;oBAC5C,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;iBAChF,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;gBACpC,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,IAAI,2BAA2B,CAAC,CAAC;YAC/I,CAAC;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3J,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;QACvE,SAAS,CAAC;YACR,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/C,IAAI,MAAM,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC;YAC9F,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;gBAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,MAAM,CAAC,UAAoC,EAAE;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,IAAI,EAAE,OAAO;YAAE,MAAM,IAAA,wBAAa,EAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7G,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO;QACtC,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU;YAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;aACjE,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;CACF;AAtOD,8CAsOC;AAED,mFAAmF;AAC5E,KAAK,UAAU,uBAAuB,CAAC,OAAiC;IAC7E,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/device-authorization.d.ts

@@ -0,0 +1,70 @@
+import type { FapiClient } from './fapi';
+/**
+ * Device sign-in (OAuth 2.0 Device Authorization Grant, RFC 8628) from YOUR app:
+ * the signed-in user types — or scans — the code their TV, console or CLI shows,
+ * and your own page approves it. The alternative to sending them to Atlas's
+ * hosted `/oauth2/device` page.
+ *
+ *   const auth = await lookupDeviceAuthorization(client, typedCode);
+ *   // show auth.client.name and auth.scopes, then:
+ *   await approveDeviceAuthorization(client, auth);   // or denyDeviceAuthorization
+ *
+ * The calls use the signed-in session (the cookie, or a native app's session
+ * token). When the application requires a recent re-authentication to approve a
+ * device (`requiresStepUp`), a stale session gets a
+ * {@link DeviceAuthorizationError} with `needsReverification` — re-authenticate
+ * (`reauthenticate()`), then approve again.
+ */
+export interface DeviceAuthorizationScope {
+    scope: string;
+    /** A human description for the consent text. */
+    description: string;
+}
+export interface DeviceAuthorization {
+    object: 'device_authorization';
+    id: string;
+    /** The code as the device shows it, e.g. `WDJB-MJHT`. */
+    userCode: string;
+    status: 'pending' | 'approved' | 'denied';
+    client: {
+        clientId: string;
+        name: string;
+        logoUrl: string | null;
+        homepageUrl: string | null;
+        firstParty: boolean;
+    };
+    scopes: DeviceAuthorizationScope[];
+    /** The API the device asked for a token for, if any. */
+    audience: string | null;
+    /** Approving needs a recent re-authentication. */
+    requiresStepUp: boolean;
+    createdAt: number;
+    expiresAt: number;
+}
+/** A refused request. `code` is the server's stable error code (`NOT_FOUND`, `RATE_LIMITED`, `STEP_UP_REQUIRED`, …). */
+export declare class DeviceAuthorizationError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly param?: string;
+    readonly reason?: string;
+    readonly meta?: Record<string, unknown>;
+    constructor(status: number, code: string, message: string, param?: string, reason?: string, meta?: Record<string, unknown>);
+    /** True when approving needs a fresh re-authentication first. */
+    get needsReverification(): boolean;
+    /** True when the code is unknown, expired or already used. */
+    get isInvalidCode(): boolean;
+}
+/**
+ * Normalise what a person typed into the `XXXX-XXXX` form devices show:
+ * uppercase, spaces and dashes ignored. Returns the input unchanged when it is
+ * not 8 letters or digits, so the server answers "not valid".
+ */
+export declare function formatUserCode(input: string): string;
+/** Read a `user_code` from a verification URL the device displayed (`?user_code=`), if any. */
+export declare function userCodeFromUrl(url: string | URL): string | null;
+/** Look up a pending device sign-in by the code the device shows. */
+export declare function lookupDeviceAuthorization(client: FapiClient, userCode: string): Promise<DeviceAuthorization>;
+/** Approve the device sign-in for the signed-in user. The device's next poll receives its tokens. */
+export declare function approveDeviceAuthorization(client: FapiClient, authorization: Pick<DeviceAuthorization, 'id' | 'userCode'>): Promise<DeviceAuthorization>;
+/** Deny the device sign-in. The device's next poll is told `access_denied`. */
+export declare function denyDeviceAuthorization(client: FapiClient, authorization: Pick<DeviceAuthorization, 'id' | 'userCode'>): Promise<DeviceAuthorization>;

package/dist/device-authorization.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceAuthorizationError = void 0;
+exports.formatUserCode = formatUserCode;
+exports.userCodeFromUrl = userCodeFromUrl;
+exports.lookupDeviceAuthorization = lookupDeviceAuthorization;
+exports.approveDeviceAuthorization = approveDeviceAuthorization;
+exports.denyDeviceAuthorization = denyDeviceAuthorization;
+/** A refused request. `code` is the server's stable error code (`NOT_FOUND`, `RATE_LIMITED`, `STEP_UP_REQUIRED`, …). */
+class DeviceAuthorizationError extends Error {
+    code;
+    status;
+    param;
+    reason;
+    meta;
+    constructor(status, code, message, param, reason, meta) {
+        super(message);
+        this.name = 'DeviceAuthorizationError';
+        this.status = status;
+        this.code = code;
+        this.param = param;
+        if (reason)
+            this.reason = reason;
+        if (meta)
+            this.meta = meta;
+    }
+    /** True when approving needs a fresh re-authentication first. */
+    get needsReverification() {
+        return this.code === 'STEP_UP_REQUIRED';
+    }
+    /** True when the code is unknown, expired or already used. */
+    get isInvalidCode() {
+        return this.status === 404 || this.status === 409;
+    }
+}
+exports.DeviceAuthorizationError = DeviceAuthorizationError;
+const BASE = '/v1/client/me/device_authorizations';
+function fromWire(w) {
+    return {
+        object: 'device_authorization',
+        id: w.id,
+        userCode: w.user_code,
+        status: w.status,
+        client: {
+            clientId: w.client.client_id,
+            name: w.client.name,
+            logoUrl: w.client.logo_url ?? null,
+            homepageUrl: w.client.homepage_url ?? null,
+            firstParty: w.client.first_party === true,
+        },
+        scopes: w.scopes ?? [],
+        audience: w.audience ?? null,
+        requiresStepUp: w.requires_step_up === true,
+        createdAt: w.created_at,
+        expiresAt: w.expires_at,
+    };
+}
+async function call(client, path, body) {
+    const res = await client.request(path, { method: 'POST', body: JSON.stringify(body) });
+    if (!res.ok || !res.data) {
+        const first = res.errors[0];
+        throw new DeviceAuthorizationError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.', first?.param, first?.reason, first?.meta);
+    }
+    return fromWire(res.data);
+}
+/**
+ * Normalise what a person typed into the `XXXX-XXXX` form devices show:
+ * uppercase, spaces and dashes ignored. Returns the input unchanged when it is
+ * not 8 letters or digits, so the server answers "not valid".
+ */
+function formatUserCode(input) {
+    const cleaned = input.toUpperCase().replace(/[^A-Z0-9]/g, '');
+    return cleaned.length === 8 ? `${cleaned.slice(0, 4)}-${cleaned.slice(4)}` : input.trim();
+}
+/** Read a `user_code` from a verification URL the device displayed (`?user_code=`), if any. */
+function userCodeFromUrl(url) {
+    try {
+        const value = new URL(String(url)).searchParams.get('user_code');
+        return value ? formatUserCode(value) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Look up a pending device sign-in by the code the device shows. */
+async function lookupDeviceAuthorization(client, userCode) {
+    return call(client, `${BASE}/lookup`, { user_code: formatUserCode(userCode) });
+}
+/** Approve the device sign-in for the signed-in user. The device's next poll receives its tokens. */
+async function approveDeviceAuthorization(client, authorization) {
+    return call(client, `${BASE}/${encodeURIComponent(authorization.id)}/approve`, { user_code: authorization.userCode });
+}
+/** Deny the device sign-in. The device's next poll is told `access_denied`. */
+async function denyDeviceAuthorization(client, authorization) {
+    return call(client, `${BASE}/${encodeURIComponent(authorization.id)}/deny`, { user_code: authorization.userCode });
+}
+//# sourceMappingURL=device-authorization.js.map

package/dist/device-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-authorization.js","sourceRoot":"","sources":["../src/device-authorization.ts"],"names":[],"mappings":";;;AAqIA,wCAGC;AAGD,0CAOC;AAGD,8DAEC;AAGD,gEAKC;AAGD,0DAKC;AAxHD,wHAAwH;AACxH,MAAa,wBAAyB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,MAAM,CAAS;IACf,KAAK,CAAU;IACf,MAAM,CAAU;IAChB,IAAI,CAA2B;IAExC,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,KAAc,EAAE,MAAe,EAAE,IAA8B;QACxH,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACjC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,iEAAiE;IACjE,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC;IAC1C,CAAC;IAED,8DAA8D;IAC9D,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC;IACpD,CAAC;CACF;AA1BD,4DA0BC;AAeD,MAAM,IAAI,GAAG,qCAAqC,CAAC;AAEnD,SAAS,QAAQ,CAAC,CAA0B;IAC1C,OAAO;QACL,MAAM,EAAE,sBAAsB;QAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;YAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;YACnB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI;YAClC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI;YAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI;SAC1C;QACD,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,cAAc,EAAE,CAAC,CAAC,gBAAgB,KAAK,IAAI;QAC3C,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,MAAkB,EAAE,IAAY,EAAE,IAA6B;IACjF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAA0B,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,wBAAwB,CAChC,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,IAAI,IAAI,SAAS,EACxB,KAAK,EAAE,OAAO,IAAI,qBAAqB,EACvC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CACZ,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,KAAa;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAC5F,CAAC;AAED,+FAA+F;AAC/F,SAAgB,eAAe,CAAC,GAAiB;IAC/C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qEAAqE;AAC9D,KAAK,UAAU,yBAAyB,CAAC,MAAkB,EAAE,QAAgB;IAClF,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,qGAAqG;AAC9F,KAAK,UAAU,0BAA0B,CAC9C,MAAkB,EAClB,aAA2D;IAE3D,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxH,CAAC;AAED,+EAA+E;AACxE,KAAK,UAAU,uBAAuB,CAC3C,MAAkB,EAClB,aAA2D;IAE3D,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;AACrH,CAAC"}

package/dist/email-code-check.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Check an emailed one-time code WITHOUT using it up.
+ *
+ * Every email-code step has a `check` endpoint beside its `attempt` endpoint:
+ * the server answers whether the code is right and still live (and until when),
+ * and leaves it redeemable, so a form can show "code accepted" as the user
+ * types and only submit the step when they confirm. A wrong code spends one of
+ * the code's attempts exactly like a submission — checking is no way around the
+ * lockout — and the check endpoints share the credential-verify rate budget.
+ *
+ *   sign-in first factor   POST /v1/client/sign_ins/:id/check_first_factor
+ *   sign-in second factor  POST /v1/client/sign_ins/:id/check_second_factor
+ *   sign-up verification   POST /v1/client/sign_ups/:id/check_verification
+ *   step-up                POST /v1/client/me/step_up/check
+ *   add-email verification POST /v1/client/me/email_addresses/:id/check_verification
+ */
+import type { FapiClient, FapiResponse } from './fapi';
+import { type AttemptView } from './attempt';
+/** A right, live code. */
+export interface EmailCodeCheck {
+    object: 'email_code_check';
+    valid: true;
+    /** When the code stops working (ISO 8601). */
+    expires_at: string;
+    /** Wrong entries left before the code is locked. */
+    attempts_remaining: number;
+}
+/** Where the code being checked belongs. */
+export type EmailCodeTarget = {
+    kind: 'sign_in_first_factor';
+    attemptId: string;
+} | {
+    kind: 'sign_in_second_factor';
+    attemptId: string;
+} | {
+    kind: 'sign_up_verification';
+    attemptId: string;
+} | {
+    kind: 'step_up';
+} | {
+    kind: 'email_address';
+    emailAddressId: string;
+};
+/** The check endpoint and body for a target. */
+export declare function emailCodeCheckRequest(target: EmailCodeTarget, code: string): {
+    path: string;
+    body: Record<string, unknown>;
+};
+/**
+ * Check a code. `ok` with `data` for a right, live code; otherwise the server's
+ * errors — `VERIFICATION_FAILED` (wrong, expired or unknown) or
+ * `TOO_MANY_ATTEMPTS` (the code is locked; request a new one).
+ */
+export declare function checkEmailCode(client: FapiClient, target: EmailCodeTarget, code: string): Promise<FapiResponse<EmailCodeCheck>>;
+/**
+ * The check target for the code step a flow is on, or null when the current
+ * step takes no emailed code. An emailed code on the first-factor step, the
+ * email second factor, and sign-up verification are covered.
+ */
+export declare function emailCodeTargetForAttempt(attempt: AttemptView | null | undefined): EmailCodeTarget | null;