@atlasauth/js 0.16.0 → 0.18.0

package/dist/device-authorization.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceAuthorizationError = void 0;
+exports.formatUserCode = formatUserCode;
+exports.userCodeFromUrl = userCodeFromUrl;
+exports.lookupDeviceAuthorization = lookupDeviceAuthorization;
+exports.approveDeviceAuthorization = approveDeviceAuthorization;
+exports.denyDeviceAuthorization = denyDeviceAuthorization;
+/** A refused request. `code` is the server's stable error code (`NOT_FOUND`, `RATE_LIMITED`, `STEP_UP_REQUIRED`, …). */
+class DeviceAuthorizationError extends Error {
+    code;
+    status;
+    param;
+    reason;
+    meta;
+    constructor(status, code, message, param, reason, meta) {
+        super(message);
+        this.name = 'DeviceAuthorizationError';
+        this.status = status;
+        this.code = code;
+        this.param = param;
+        if (reason)
+            this.reason = reason;
+        if (meta)
+            this.meta = meta;
+    }
+    /** True when approving needs a fresh re-authentication first. */
+    get needsReverification() {
+        return this.code === 'STEP_UP_REQUIRED';
+    }
+    /** True when the code is unknown, expired or already used. */
+    get isInvalidCode() {
+        return this.status === 404 || this.status === 409;
+    }
+}
+exports.DeviceAuthorizationError = DeviceAuthorizationError;
+const BASE = '/v1/client/me/device_authorizations';
+function fromWire(w) {
+    return {
+        object: 'device_authorization',
+        id: w.id,
+        userCode: w.user_code,
+        status: w.status,
+        client: {
+            clientId: w.client.client_id,
+            name: w.client.name,
+            logoUrl: w.client.logo_url ?? null,
+            homepageUrl: w.client.homepage_url ?? null,
+            firstParty: w.client.first_party === true,
+        },
+        scopes: w.scopes ?? [],
+        audience: w.audience ?? null,
+        requiresStepUp: w.requires_step_up === true,
+        createdAt: w.created_at,
+        expiresAt: w.expires_at,
+    };
+}
+async function call(client, path, body) {
+    const res = await client.request(path, { method: 'POST', body: JSON.stringify(body) });
+    if (!res.ok || !res.data) {
+        const first = res.errors[0];
+        throw new DeviceAuthorizationError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.', first?.param, first?.reason, first?.meta);
+    }
+    return fromWire(res.data);
+}
+/**
+ * Normalise what a person typed into the `XXXX-XXXX` form devices show:
+ * uppercase, spaces and dashes ignored. Returns the input unchanged when it is
+ * not 8 letters or digits, so the server answers "not valid".
+ */
+function formatUserCode(input) {
+    const cleaned = input.toUpperCase().replace(/[^A-Z0-9]/g, '');
+    return cleaned.length === 8 ? `${cleaned.slice(0, 4)}-${cleaned.slice(4)}` : input.trim();
+}
+/** Read a `user_code` from a verification URL the device displayed (`?user_code=`), if any. */
+function userCodeFromUrl(url) {
+    try {
+        const value = new URL(String(url)).searchParams.get('user_code');
+        return value ? formatUserCode(value) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Look up a pending device sign-in by the code the device shows. */
+async function lookupDeviceAuthorization(client, userCode) {
+    return call(client, `${BASE}/lookup`, { user_code: formatUserCode(userCode) });
+}
+/** Approve the device sign-in for the signed-in user. The device's next poll receives its tokens. */
+async function approveDeviceAuthorization(client, authorization) {
+    return call(client, `${BASE}/${encodeURIComponent(authorization.id)}/approve`, { user_code: authorization.userCode });
+}
+/** Deny the device sign-in. The device's next poll is told `access_denied`. */
+async function denyDeviceAuthorization(client, authorization) {
+    return call(client, `${BASE}/${encodeURIComponent(authorization.id)}/deny`, { user_code: authorization.userCode });
+}
+//# sourceMappingURL=device-authorization.js.map

package/dist/device-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-authorization.js","sourceRoot":"","sources":["../src/device-authorization.ts"],"names":[],"mappings":";;;AAqIA,wCAGC;AAGD,0CAOC;AAGD,8DAEC;AAGD,gEAKC;AAGD,0DAKC;AAxHD,wHAAwH;AACxH,MAAa,wBAAyB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,MAAM,CAAS;IACf,KAAK,CAAU;IACf,MAAM,CAAU;IAChB,IAAI,CAA2B;IAExC,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,KAAc,EAAE,MAAe,EAAE,IAA8B;QACxH,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACjC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,iEAAiE;IACjE,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC;IAC1C,CAAC;IAED,8DAA8D;IAC9D,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC;IACpD,CAAC;CACF;AA1BD,4DA0BC;AAeD,MAAM,IAAI,GAAG,qCAAqC,CAAC;AAEnD,SAAS,QAAQ,CAAC,CAA0B;IAC1C,OAAO;QACL,MAAM,EAAE,sBAAsB;QAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE;YACN,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;YAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;YACnB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI;YAClC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI;YAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI;SAC1C;QACD,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,cAAc,EAAE,CAAC,CAAC,gBAAgB,KAAK,IAAI;QAC3C,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,MAAkB,EAAE,IAAY,EAAE,IAA6B;IACjF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAA0B,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,wBAAwB,CAChC,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,IAAI,IAAI,SAAS,EACxB,KAAK,EAAE,OAAO,IAAI,qBAAqB,EACvC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CACZ,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,KAAa;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAC5F,CAAC;AAED,+FAA+F;AAC/F,SAAgB,eAAe,CAAC,GAAiB;IAC/C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qEAAqE;AAC9D,KAAK,UAAU,yBAAyB,CAAC,MAAkB,EAAE,QAAgB;IAClF,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,qGAAqG;AAC9F,KAAK,UAAU,0BAA0B,CAC9C,MAAkB,EAClB,aAA2D;IAE3D,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxH,CAAC;AAED,+EAA+E;AACxE,KAAK,UAAU,uBAAuB,CAC3C,MAAkB,EAClB,aAA2D;IAE3D,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;AACrH,CAAC"}

package/dist/email-code-check.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Check an emailed one-time code WITHOUT using it up.
+ *
+ * Every email-code step has a `check` endpoint beside its `attempt` endpoint:
+ * the server answers whether the code is right and still live (and until when),
+ * and leaves it redeemable, so a form can show "code accepted" as the user
+ * types and only submit the step when they confirm. A wrong code spends one of
+ * the code's attempts exactly like a submission — checking is no way around the
+ * lockout — and the check endpoints share the credential-verify rate budget.
+ *
+ *   sign-in first factor   POST /v1/client/sign_ins/:id/check_first_factor
+ *   sign-in second factor  POST /v1/client/sign_ins/:id/check_second_factor
+ *   sign-up verification   POST /v1/client/sign_ups/:id/check_verification
+ *   step-up                POST /v1/client/me/step_up/check
+ *   add-email verification POST /v1/client/me/email_addresses/:id/check_verification
+ */
+import type { FapiClient, FapiResponse } from './fapi';
+import { type AttemptView } from './attempt';
+/** A right, live code. */
+export interface EmailCodeCheck {
+    object: 'email_code_check';
+    valid: true;
+    /** When the code stops working (ISO 8601). */
+    expires_at: string;
+    /** Wrong entries left before the code is locked. */
+    attempts_remaining: number;
+}
+/** Where the code being checked belongs. */
+export type EmailCodeTarget = {
+    kind: 'sign_in_first_factor';
+    attemptId: string;
+} | {
+    kind: 'sign_in_second_factor';
+    attemptId: string;
+} | {
+    kind: 'sign_up_verification';
+    attemptId: string;
+} | {
+    kind: 'step_up';
+} | {
+    kind: 'email_address';
+    emailAddressId: string;
+};
+/** The check endpoint and body for a target. */
+export declare function emailCodeCheckRequest(target: EmailCodeTarget, code: string): {
+    path: string;
+    body: Record<string, unknown>;
+};
+/**
+ * Check a code. `ok` with `data` for a right, live code; otherwise the server's
+ * errors — `VERIFICATION_FAILED` (wrong, expired or unknown) or
+ * `TOO_MANY_ATTEMPTS` (the code is locked; request a new one).
+ */
+export declare function checkEmailCode(client: FapiClient, target: EmailCodeTarget, code: string): Promise<FapiResponse<EmailCodeCheck>>;
+/**
+ * The check target for the code step a flow is on, or null when the current
+ * step takes no emailed code. An emailed code on the first-factor step, the
+ * email second factor, and sign-up verification are covered.
+ */
+export declare function emailCodeTargetForAttempt(attempt: AttemptView | null | undefined): EmailCodeTarget | null;

package/dist/email-code-check.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emailCodeCheckRequest = emailCodeCheckRequest;
+exports.checkEmailCode = checkEmailCode;
+exports.emailCodeTargetForAttempt = emailCodeTargetForAttempt;
+const attempt_1 = require("./attempt");
+/** The check endpoint and body for a target. */
+function emailCodeCheckRequest(target, code) {
+    const id = (v) => encodeURIComponent(v);
+    switch (target.kind) {
+        case 'sign_in_first_factor':
+            return { path: `/v1/client/sign_ins/${id(target.attemptId)}/check_first_factor`, body: { strategy: 'email_code', code } };
+        case 'sign_in_second_factor':
+            return { path: `/v1/client/sign_ins/${id(target.attemptId)}/check_second_factor`, body: { strategy: 'email_code', code } };
+        case 'sign_up_verification':
+            return { path: `/v1/client/sign_ups/${id(target.attemptId)}/check_verification`, body: { strategy: 'email_code', code } };
+        case 'step_up':
+            return { path: '/v1/client/me/step_up/check', body: { strategy: 'email_code', code } };
+        case 'email_address':
+            return { path: `/v1/client/me/email_addresses/${id(target.emailAddressId)}/check_verification`, body: { code } };
+    }
+}
+/**
+ * Check a code. `ok` with `data` for a right, live code; otherwise the server's
+ * errors — `VERIFICATION_FAILED` (wrong, expired or unknown) or
+ * `TOO_MANY_ATTEMPTS` (the code is locked; request a new one).
+ */
+function checkEmailCode(client, target, code) {
+    const { path, body } = emailCodeCheckRequest(target, code);
+    return client.post(path, body);
+}
+/**
+ * The check target for the code step a flow is on, or null when the current
+ * step takes no emailed code. An emailed code on the first-factor step, the
+ * email second factor, and sign-up verification are covered.
+ */
+function emailCodeTargetForAttempt(attempt) {
+    if (!attempt?.id)
+        return null;
+    switch ((0, attempt_1.nextStep)(attempt).kind) {
+        case 'collect_first_factor':
+            return { kind: 'sign_in_first_factor', attemptId: attempt.id };
+        case 'collect_second_factor':
+            return { kind: 'sign_in_second_factor', attemptId: attempt.id };
+        case 'collect_email_code':
+            return { kind: 'sign_up_verification', attemptId: attempt.id };
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=email-code-check.js.map

package/dist/email-code-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-code-check.js","sourceRoot":"","sources":["../src/email-code-check.ts"],"names":[],"mappings":";;AAsCA,sDAcC;AAOD,wCAGC;AAOD,8DAYC;AAhED,uCAAuD;AAoBvD,gDAAgD;AAChD,SAAgB,qBAAqB,CAAC,MAAuB,EAAE,IAAY;IACzE,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5H,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7H,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5H,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QACzF,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;IACrH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,MAAkB,EAAE,MAAuB,EAAE,IAAY;IACtF,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAiB,IAAI,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAgB,yBAAyB,CAAC,OAAuC;IAC/E,IAAI,CAAC,OAAO,EAAE,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,QAAQ,IAAA,kBAAQ,EAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACjE,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QAClE,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACjE;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/frontchannel-logout.d.ts

@@ -29,6 +29,42 @@ export interface SignOutOptions {
      * Honoured by every framework provider.
      */
     strict?: boolean;
+    /**
+     * Follow the upstream provider's end-session URL after signing out locally,
+     * when the session came from a custom OAuth/OIDC provider or enterprise OIDC
+     * connection with RP-initiated logout on. Default `true`; `false` leaves it
+     * to you (`result.upstreamLogoutUrl`).
+     */
+    upstreamLogout?: boolean;
+    /**
+     * Where the user lands after that upstream logout. Must be on an allowed
+     * origin of the instance; otherwise the provider's configured post-logout
+     * page is used. Also used for SAML Single Logout when
+     * `samlLogoutRedirectUrl` is not set.
+     */
+    returnUrl?: string;
+    /**
+     * SAML Single Logout. When the session came from a SAML connection with
+     * Single Logout on, the sign-out response carries a `saml_logout_url`; by
+     * default the browser is then sent there (after the local sign-out) so the
+     * identity provider's session ends too. Pass `false` to stay on the page and
+     * handle `SignOutResult.samlLogoutUrl` yourself.
+     *
+     * A browser can follow only one logout redirect. In the (unusual) case that
+     * the response carries both `upstream_logout_url` and `saml_logout_url`, the
+     * upstream OpenID provider's URL is followed (it has no server-to-server
+     * fallback) and the SAML identity provider is told server-to-server through
+     * SOAP back-channel logout when its connection has a SOAP endpoint;
+     * `samlLogoutUrl` is still reported. With `upstreamLogout: false`, the SAML
+     * URL is followed instead.
+     */
+    samlLogout?: boolean;
+    /**
+     * SAML Single Logout: where the identity provider returns the browser once it
+     * has signed the user out. Must be on one of the instance's allowed origins.
+     * Defaults to `returnUrl`, else the page that signed out.
+     */
+    samlLogoutRedirectUrl?: string;
 }
 /** The default wait for front-channel logout frames. */
 export declare const FRONTCHANNEL_LOGOUT_TIMEOUT_MS = 5000;

package/dist/frontchannel-logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontchannel-logout.js","sourceRoot":"","sources":["../src/frontchannel-logout.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAiCH,wDAgBC;AAOD,sDAuDC;AAOD,8EAaC;AA5GD,wDAAwD;AAC3C,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAEnD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,IAAa;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,MAAM,IAAI,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACnC,IAAa,EACb,UAAqC,EAAE;IAEvC,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sCAA8B,CAAC;IAEtE,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,KAAgD,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/C,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;gBAC7B,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBAC1C,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACrC,iEAAiE;gBACjE,iEAAiE;gBACjE,qEAAqE;gBACrE,kEAAkE;gBAClE,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;gBACnD,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iCAAiC,CACrD,QAAqC,EACrC,UAAqC,EAAE;IAEvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO;IACtC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAI,IAAsD,EAAE,wBAAwB,CAAC;IAC/F,MAAM,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"frontchannel-logout.js","sourceRoot":"","sources":["../src/frontchannel-logout.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAqEH,wDAgBC;AAOD,sDAuDC;AAOD,8EAaC;AA5GD,wDAAwD;AAC3C,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAEnD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,IAAa;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,MAAM,IAAI,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACnC,IAAa,EACb,UAAqC,EAAE;IAEvC,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sCAA8B,CAAC;IAEtE,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,KAAgD,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/C,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;gBAC7B,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBAC1C,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACrC,iEAAiE;gBACjE,iEAAiE;gBACjE,qEAAqE;gBACrE,kEAAkE;gBAClE,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;gBACnD,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iCAAiC,CACrD,QAAqC,EACrC,UAAqC,EAAE;IAEvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO;IACtC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAI,IAAsD,EAAE,wBAAwB,CAAC;IAC/F,MAAM,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/index.d.ts

@@ -24,11 +24,13 @@ export * from './passkey';
 export * from './mfa-enrollment';
 export * from './passkey-sign-in';
 export * from './passkey-sign-up';
+export * from './email-code-check';
 export * from './telegram';
 export * from './siwe';
 export * from './telemetry';
 export * from './reauth';
 export * from './api-keys';
+export * from './device-authorization';
 export * from './organizations';
 export * from './phone-numbers';
 export * from './account-hints';
@@ -36,7 +38,9 @@ export * from './profile';
 export * from './connect';
 export * from './password-reset';
 export * from './check-session';
+export * from './better-auth-bridge';
 export * from './frontchannel-logout';
+export * from './upstream-logout';
 export * from './captcha';
 export * from './captcha-widget';
 export * from './atlas-captcha';

package/dist/index.js

@@ -64,12 +64,15 @@ __exportStar(require("./mfa-enrollment"), exports);
 __exportStar(require("./passkey-sign-in"), exports);
 // Passkey-only sign-up (the account is created when its passkey registers).
 __exportStar(require("./passkey-sign-up"), exports);
+// Check an emailed one-time code without using it up (sign-in, sign-up, step-up, email verification).
+__exportStar(require("./email-code-check"), exports);
 __exportStar(require("./telegram"), exports);
 __exportStar(require("./siwe"), exports);
 __exportStar(require("./telemetry"), exports);
 __exportStar(require("./reauth"), exports);
 // End-user API key self-service (`/v1/client/me/api_keys`).
 __exportStar(require("./api-keys"), exports);
+__exportStar(require("./device-authorization"), exports);
 __exportStar(require("./organizations"), exports);
 __exportStar(require("./phone-numbers"), exports);
 // Username availability + the "Last used" sign-in method hint.
@@ -79,8 +82,12 @@ __exportStar(require("./profile"), exports);
 __exportStar(require("./connect"), exports);
 __exportStar(require("./password-reset"), exports);
 __exportStar(require("./check-session"), exports);
+// Moving from Better Auth: exchange a readable Better Auth session cookie for an Atlas session.
+__exportStar(require("./better-auth-bridge"), exports);
 // OIDC Front-Channel Logout after a browser sign-out.
 __exportStar(require("./frontchannel-logout"), exports);
+// RP-initiated logout at an upstream OpenID provider after a browser sign-out.
+__exportStar(require("./upstream-logout"), exports);
 // §5 "captcha anywhere" — fetch the central widget config, render the provider
 // widget, and verify a solved token, all without hardcoding provider keys.
 __exportStar(require("./captcha"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,mGAAmG;AACnG,2DAAyC;AACzC,+EAA+E;AAC/E,6CAA2B;AAC3B,gGAAgG;AAChG,6CAA0G;AAAjG,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClF,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,0GAA0G;AAC1G,mDAAiC;AACjC,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,kDAAgC;AAChC,kDAAgC;AAChC,+DAA+D;AAC/D,kDAAgC;AAChC,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,mGAAmG;AACnG,2DAAyC;AACzC,+EAA+E;AAC/E,6CAA2B;AAC3B,gGAAgG;AAChG,6CAA0G;AAAjG,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClF,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,0GAA0G;AAC1G,mDAAiC;AACjC,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,sGAAsG;AACtG,qDAAmC;AACnC,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,yDAAuC;AACvC,kDAAgC;AAChC,kDAAgC;AAChC,+DAA+D;AAC/D,kDAAgC;AAChC,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,gGAAgG;AAChG,uDAAqC;AACrC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,oDAAkC;AAClC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}

package/dist/passkey-sign-up.d.ts

@@ -17,7 +17,7 @@
  */
 import { type FapiClient, type FlowState } from './fapi';
 import type { AttemptView } from './attempt';
-import { type WebAuthnHost } from './passkey';
+import { type PasskeyExtensionOptions, type WebAuthnHost } from './passkey';
 export interface PasskeySignUpInput {
     /** Collected when the instance's `account.passkeySignUp.email` is not `off`. */
     email?: string;
@@ -43,4 +43,4 @@ export declare function awaitingPasskey(attempt: AttemptView | null | undefined)
 export declare function registerSignUpPasskey(client: FapiClient, state: FlowState, opts?: {
     name?: string;
     host?: WebAuthnHost;
-}): Promise<FlowState>;
+} & PasskeyExtensionOptions): Promise<FlowState>;

package/dist/passkey-sign-up.js

@@ -66,7 +66,13 @@ async function registerSignUpPasskey(client, state, opts = {}) {
         return { ...state, busy: false, errors: begin.errors };
     let body;
     try {
-        body = await (0, passkey_1.createPasskey)(begin.data, { host: opts.host, ...(opts.name ? { name: opts.name } : {}) });
+        body = await (0, passkey_1.createPasskey)(begin.data, {
+            host: opts.host,
+            ...(opts.name ? { name: opts.name } : {}),
+            // PRF (client-side keys): the salts go to the authenticator, the outputs to the app only.
+            ...(opts.prf ? { prf: opts.prf } : {}),
+            ...(opts.onExtensionResults ? { onExtensionResults: opts.onExtensionResults } : {}),
+        });
     }
     catch (error) {
         return {

package/dist/passkey-sign-up.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-sign-up.js","sourceRoot":"","sources":["../src/passkey-sign-up.ts"],"names":[],"mappings":";;AAmCA,gDAgBC;AAGD,0CAOC;AAQD,sDA2CC;AAhHD;;;;;;;;;;;;;;;;GAgBG;AACH,iCAAsE;AAEtE,uCAA6D;AAe7D,uFAAuF;AAChF,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,KAAyB;IACpF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAA0D,6BAA6B,EAAE;QACzH,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,kBAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACvF,OAAO;QACL,GAAG,kBAAW;QACd,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,0EAA0E;QAC1E,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;KAC9C,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAgB,eAAe,CAAC,OAAuC;IACrE,OAAO,CACL,CAAC,CAAC,OAAO;QACT,OAAO,CAAC,MAAM,KAAK,iBAAiB;QACpC,OAAO,CAAC,MAAM,KAAK,oBAAoB;QACvC,CAAC,OAAO,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CACzC,MAAkB,EAClB,KAAgB,EAChB,OAA+C,EAAE;IAEjD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC7B,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,EAAE,CAAC;IAC1H,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAA0B,uBAAuB,EAAE,gBAAgB,EAAE;QAClG,WAAW,EAAE,KAAK,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAErF,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAA,uBAAa,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,GAAG,KAAK;YACR,IAAI,EAAE,KAAK;YACX,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,mBAAmB;oBACzB,gFAAgF;oBAChF,OAAO,EAAE,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;iBAClG;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAoC,uBAAuB,EAAE,iBAAiB,EAAE;QAC9G,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,GAAG,IAAI;KACR,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACxF,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"passkey-sign-up.js","sourceRoot":"","sources":["../src/passkey-sign-up.ts"],"names":[],"mappings":";;AAmCA,gDAgBC;AAGD,0CAOC;AAQD,sDAiDC;AAtHD;;;;;;;;;;;;;;;;GAgBG;AACH,iCAAsE;AAEtE,uCAA2F;AAe3F,uFAAuF;AAChF,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,KAAyB;IACpF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAA0D,6BAA6B,EAAE;QACzH,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,kBAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACvF,OAAO;QACL,GAAG,kBAAW;QACd,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,0EAA0E;QAC1E,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;KAC9C,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAgB,eAAe,CAAC,OAAuC;IACrE,OAAO,CACL,CAAC,CAAC,OAAO;QACT,OAAO,CAAC,MAAM,KAAK,iBAAiB;QACpC,OAAO,CAAC,MAAM,KAAK,oBAAoB;QACvC,CAAC,OAAO,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CACzC,MAAkB,EAClB,KAAgB,EAChB,OAAyE,EAAE;IAE3E,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC7B,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,EAAE,CAAC;IAC1H,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAA0B,uBAAuB,EAAE,gBAAgB,EAAE;QAClG,WAAW,EAAE,KAAK,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAErF,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAA,uBAAa,EAAC,KAAK,CAAC,IAAI,EAAE;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,0FAA0F;YAC1F,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,GAAG,KAAK;YACR,IAAI,EAAE,KAAK;YACX,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,mBAAmB;oBACzB,gFAAgF;oBAChF,OAAO,EAAE,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;iBAClG;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAoC,uBAAuB,EAAE,iBAAiB,EAAE;QAC9G,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,GAAG,IAAI;KACR,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACxF,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC"}

package/dist/passkey.d.ts

@@ -34,6 +34,62 @@ export declare function base64UrlToBuffer(value: string): ArrayBuffer;
 export declare function passkeysSupported(host?: unknown): boolean;
 /** Whether conditional-UI (autofill) discovery is available (best-effort). */
 export declare function conditionalUiAvailable(): Promise<boolean>;
+/**
+ * A PRF salt: bytes, or a string (encoded as UTF-8). Use a fixed, app-chosen
+ * salt per purpose (for example `"myapp:vault-key:v1"`), so the same passkey
+ * always yields the same secret for that purpose.
+ */
+export type PasskeyPrfSalt = ArrayBuffer | ArrayBufferView | string;
+/** The salts for one PRF evaluation (`second` asks for a second, independent output). */
+export interface PasskeyPrfValues {
+    first: PasskeyPrfSalt;
+    second?: PasskeyPrfSalt;
+}
+/**
+ * Ask the authenticator for the WebAuthn `prf` extension: a secret derived from
+ * the passkey and your salt, which never leaves the browser. Use it to derive a
+ * client-side encryption key. `eval` applies to any credential;
+ * `evalByCredential` (sign-in only) gives per-credential salts keyed by
+ * base64url credential id.
+ */
+export interface PasskeyPrfRequest {
+    eval?: PasskeyPrfValues;
+    evalByCredential?: Record<string, PasskeyPrfValues>;
+}
+/** What the browser answered for `prf`. */
+export interface PasskeyPrfResult {
+    /** Registration: whether the new passkey supports PRF. */
+    enabled?: boolean;
+    /** The PRF outputs (32 bytes each), when the authenticator evaluated them. */
+    results?: {
+        first: Uint8Array;
+        second?: Uint8Array;
+    };
+}
+/**
+ * The client extension results of a ceremony — returned to YOUR code only. They
+ * are never sent to Atlas: the `finish` body is unchanged.
+ */
+export interface PasskeyExtensionResults {
+    /** The credential the ceremony used (base64url). */
+    credentialId: string;
+    prf?: PasskeyPrfResult;
+    /** Registration: whether a discoverable credential (passkey) was created, when the browser says. */
+    credProps?: {
+        rk?: boolean;
+    };
+}
+/** Options shared by both ceremonies for client extensions. */
+export interface PasskeyExtensionOptions {
+    /** Request the `prf` extension (the salts are sent to the authenticator, not to Atlas). */
+    prf?: PasskeyPrfRequest;
+    /** Receives the client extension results (PRF outputs) after a successful ceremony. */
+    onExtensionResults?: (results: PasskeyExtensionResults) => void;
+}
+/** The `extensions` member for a ceremony, or undefined when nothing is requested. */
+export declare function passkeyExtensionsInput(prf: PasskeyPrfRequest | undefined, ceremony: 'create' | 'get'): Record<string, unknown> | undefined;
+/** Read (and normalise) a credential's client extension results. */
+export declare function readExtensionResults(credential: PublicKeyCredential): PasskeyExtensionResults;
 /** The POST body for /v1/client/me/passkeys/finish. */
 export interface PasskeyRegistrationBody {
     challenge: string;
@@ -49,7 +105,7 @@ export interface PasskeyRegistrationBody {
 export declare function createPasskey(begin: Record<string, unknown>, opts?: {
     name?: string;
     host?: WebAuthnHost;
-}): Promise<PasskeyRegistrationBody>;
+} & PasskeyExtensionOptions): Promise<PasskeyRegistrationBody>;
 /** The POST body for /v1/client/sign_ins/passkey/finish. */
 export interface PasskeyAssertionBody {
     handle: string;
@@ -67,4 +123,4 @@ export declare function getPasskeyAssertion(begin: Record<string, unknown>, opts
     host?: WebAuthnHost;
     mediation?: 'optional' | 'conditional';
     signal?: AbortSignal;
-}): Promise<PasskeyAssertionBody>;
+} & PasskeyExtensionOptions): Promise<PasskeyAssertionBody>;

package/dist/passkey.js

@@ -18,6 +18,8 @@ exports.bufferToBase64Url = bufferToBase64Url;
 exports.base64UrlToBuffer = base64UrlToBuffer;
 exports.passkeysSupported = passkeysSupported;
 exports.conditionalUiAvailable = conditionalUiAvailable;
+exports.passkeyExtensionsInput = passkeyExtensionsInput;
+exports.readExtensionResults = readExtensionResults;
 exports.createPasskey = createPasskey;
 exports.getPasskeyAssertion = getPasskeyAssertion;
 const defaultHost = () => {
@@ -61,6 +63,47 @@ async function conditionalUiAvailable() {
         return false;
     }
 }
+function saltBytes(salt) {
+    if (typeof salt === 'string')
+        return new TextEncoder().encode(salt);
+    if (salt instanceof ArrayBuffer)
+        return new Uint8Array(salt);
+    return new Uint8Array(salt.buffer, salt.byteOffset, salt.byteLength);
+}
+function prfValues(v) {
+    return { first: saltBytes(v.first), ...(v.second !== undefined ? { second: saltBytes(v.second) } : {}) };
+}
+/** The `extensions` member for a ceremony, or undefined when nothing is requested. */
+function passkeyExtensionsInput(prf, ceremony) {
+    if (!prf)
+        return undefined;
+    const out = {};
+    if (prf.eval)
+        out.eval = prfValues(prf.eval);
+    if (ceremony === 'get' && prf.evalByCredential) {
+        out.evalByCredential = Object.fromEntries(Object.entries(prf.evalByCredential).map(([id, v]) => [id, prfValues(v)]));
+    }
+    return { prf: out };
+}
+const toBytes = (v) => v instanceof ArrayBuffer ? new Uint8Array(v) : ArrayBuffer.isView(v) ? new Uint8Array(v.buffer, v.byteOffset, v.byteLength) : undefined;
+/** Read (and normalise) a credential's client extension results. */
+function readExtensionResults(credential) {
+    const raw = credential.getClientExtensionResults?.() ?? {};
+    const out = { credentialId: bufferToBase64Url(credential.rawId) };
+    const prf = raw.prf;
+    if (prf && typeof prf === 'object') {
+        const first = toBytes(prf.results?.first);
+        const second = toBytes(prf.results?.second);
+        out.prf = {
+            ...(typeof prf.enabled === 'boolean' ? { enabled: prf.enabled } : {}),
+            ...(first ? { results: { first, ...(second ? { second } : {}) } } : {}),
+        };
+    }
+    const credProps = raw.credProps;
+    if (credProps && typeof credProps === 'object')
+        out.credProps = typeof credProps.rk === 'boolean' ? { rk: credProps.rk } : {};
+    return out;
+}
 /**
  * Run navigator.credentials.create from a `/passkeys/begin` response and return
  * the `/finish` body. `begin` is the JSON the server sent (challenge, rp, user,
@@ -79,11 +122,16 @@ async function createPasskey(begin, opts = {}) {
         authenticatorSelection: begin.authenticatorSelection,
         timeout: begin.timeout,
         attestation: begin.attestation,
+        ...extensionsMember(passkeyExtensionsInput(opts.prf, 'create'), begin.extensions),
     };
     const credential = (await host.credentials.create({ publicKey }));
     if (!credential)
         throw new Error('Passkey registration was cancelled.');
     const response = credential.response;
+    // Client extension results (PRF outputs) go to the app's callback only —
+    // never into the finish body, so Atlas never sees them.
+    if (opts.onExtensionResults)
+        opts.onExtensionResults(readExtensionResults(credential));
     return {
         // Echo the server's challenge string — the server matched/stored it.
         challenge: begin.challenge,
@@ -105,6 +153,7 @@ async function getPasskeyAssertion(begin, opts = {}) {
         allowCredentials: allow.map((c) => ({ type: c.type, id: base64UrlToBuffer(c.id) })),
         userVerification: begin.userVerification,
         timeout: begin.timeout,
+        ...extensionsMember(passkeyExtensionsInput(opts.prf, 'get'), begin.extensions),
     };
     const credential = (await host.credentials.get({
         publicKey,
@@ -114,6 +163,8 @@ async function getPasskeyAssertion(begin, opts = {}) {
     if (!credential)
         throw new Error('Passkey sign-in was cancelled.');
     const response = credential.response;
+    if (opts.onExtensionResults)
+        opts.onExtensionResults(readExtensionResults(credential));
     return {
         handle: begin.handle,
         challenge: begin.challenge,
@@ -123,4 +174,14 @@ async function getPasskeyAssertion(begin, opts = {}) {
         signature: bufferToBase64Url(response.signature),
     };
 }
+/**
+ * The ceremony's `extensions`: what the server's begin response asked for
+ * (when it asks for any), with the app's PRF request merged in.
+ */
+function extensionsMember(app, server) {
+    const fromServer = server && typeof server === 'object' && !Array.isArray(server) ? server : undefined;
+    if (!app && !fromServer)
+        return {};
+    return { extensions: { ...(fromServer ?? {}), ...(app ?? {}) } };
+}
 //# sourceMappingURL=passkey.js.map

package/dist/passkey.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../src/passkey.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAuBH,8CAKC;AAGD,8CAOC;AAGD,8CAGC;AAGD,wDAQC;AAeD,sCA8BC;AAgBD,kDA+BC;AArID,MAAM,WAAW,GAAG,GAAiB,EAAE;IACrC,MAAM,GAAG,GAAI,UAAsC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,GAAG,IAAI,CAAE,GAAiC,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAA8B,CAAC;AACxC,CAAC,CAAC;AAEF,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,GAA6B;IAC7D,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,IAAc;IAC9C,MAAM,CAAC,GAAG,IAAI,IAAK,UAAgD,CAAC,mBAAmB,CAAC;IACxF,OAAO,OAAO,CAAC,KAAK,WAAW,CAAC;AAClC,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,sBAAsB;IAC1C,MAAM,EAAE,GAAI,UAAqG;SAC9G,mBAAmB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,EAAE,+BAA+B,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACI,KAAK,UAAU,aAAa,CACjC,KAA8B,EAC9B,OAA+C,EAAE;IAEjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAyD,CAAC;IAC7E,MAAM,OAAO,GAAI,KAAK,CAAC,kBAAiE,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QACjD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;KACkB,CAAC;IAEnD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAA+B,CAAC;IAChG,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA4C,CAAC;IAEzE,OAAO;QACL,qEAAqE;QACrE,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,KAA8B,EAC9B,OAA8F,EAAE;IAEhG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,KAAK,GAAI,KAAK,CAAC,gBAA+D,IAAI,EAAE,CAAC;IAE3F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnF,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO;KACyB,CAAC;IAElD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7C,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA0C,CAAC;IAEvE,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAgB;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC;QAClD,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../src/passkey.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAuBH,8CAKC;AAGD,8CAOC;AAGD,8CAGC;AAGD,wDAQC;AAkED,wDAaC;AAMD,oDAeC;AAeD,sCAkCC;AAgBD,kDAiCC;AA/OD,MAAM,WAAW,GAAG,GAAiB,EAAE;IACrC,MAAM,GAAG,GAAI,UAAsC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,GAAG,IAAI,CAAE,GAAiC,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAA8B,CAAC;AACxC,CAAC,CAAC;AAEF,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,GAA6B;IAC7D,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,IAAc;IAC9C,MAAM,CAAC,GAAG,IAAI,IAAK,UAAgD,CAAC,mBAAmB,CAAC;IACxF,OAAO,OAAO,CAAC,KAAK,WAAW,CAAC;AAClC,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,sBAAsB;IAC1C,MAAM,EAAE,GAAI,UAAqG;SAC9G,mBAAmB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,EAAE,+BAA+B,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAuDD,SAAS,SAAS,CAAC,IAAoB;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,IAAI,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,CAAmB;IACpC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED,sFAAsF;AACtF,SAAgB,sBAAsB,CACpC,GAAkC,EAClC,QAA0B;IAE1B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,GAAG,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC/C,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAA0B,EAAE,CACrD,CAAC,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE1I,oEAAoE;AACpE,SAAgB,oBAAoB,CAAC,UAA+B;IAClE,MAAM,GAAG,GAAI,UAAuF,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC;IACzI,MAAM,GAAG,GAA4B,EAAE,YAAY,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3F,MAAM,GAAG,GAAG,GAAG,CAAC,GAAyF,CAAC;IAC1G,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,GAAG;YACR,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAyC,CAAC;IAChE,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,GAAG,CAAC,SAAS,GAAG,OAAO,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9H,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;;GAIG;AACI,KAAK,UAAU,aAAa,CACjC,KAA8B,EAC9B,OAAyE,EAAE;IAE3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAyD,CAAC;IAC7E,MAAM,OAAO,GAAI,KAAK,CAAC,kBAAiE,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QACjD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;KACjC,CAAC;IAEnD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAA+B,CAAC;IAChG,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA4C,CAAC;IACzE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,IAAI,CAAC,kBAAkB;QAAE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,qEAAqE;QACrE,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,KAA8B,EAC9B,OAAwH,EAAE;IAE1H,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,KAAK,GAAI,KAAK,CAAC,gBAA+D,IAAI,EAAE,CAAC;IAE3F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnF,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;KAC/B,CAAC;IAElD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7C,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA0C,CAAC;IACvE,IAAI,IAAI,CAAC,kBAAkB;QAAE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAgB;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC;QAClD,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,GAAwC,EACxC,MAAe;IAEf,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpI,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;AACnE,CAAC"}

package/dist/sign-out-guard.d.ts

@@ -43,6 +43,12 @@ export interface SignOutGuardOptions {
     retryDelaysMs?: number[];
     /** Skip front-channel logout entirely (runtimes without a DOM). */
     frontChannelLogout?: boolean;
+    /**
+     * How to open the upstream end-session URL or the SAML Single Logout URL
+     * (default: `window.location.assign`).
+     * Native SDKs pass their system-browser opener.
+     */
+    navigate?: (href: string) => void;
 }
 /** What {@link SignOutGuard.revoke} did on the server. */
 export interface SignOutAttempt {
@@ -60,6 +66,7 @@ export declare class SignOutGuard {
     private readonly request;
     private readonly retryDelaysMs;
     private readonly frontChannelLogout;
+    private readonly navigate?;
     /** Sessions with a background revoke in flight or scheduled. */
     private readonly retrying;
     private readonly timers;