@atlasauth/js 0.22.0 → 0.23.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @atlasauth/js changelog
 
+## Unreleased
+
+## 0.23.0 — 2026-10-25
+
+- `stepUp(client, { strategy, … })` and `sendStepUpEmailCode(client)`: re-authenticate the signed-in user in place (`POST /v1/client/me/step_up`) and get a token with a fresh `auth_time`; `authenticatedWithin(claims, maxAgeSeconds)` checks it.
+
 ## 0.22.0 — 2026-10-24
 
 - Per-call integration audiences (`getToken({ for, cbid })`), partner platforms, operator tokens for partner products.

package/dist/index.d.ts

@@ -29,6 +29,7 @@ export * from './mfa-enrollment';
 export * from './passkey-sign-in';
 export * from './passkey-sign-up';
 export * from './email-code-check';
+export * from './step-up';
 export * from './telegram';
 export * from './siwe';
 export * from './telemetry';

package/dist/index.js

@@ -72,6 +72,7 @@ __exportStar(require("./passkey-sign-in"), exports);
 __exportStar(require("./passkey-sign-up"), exports);
 // Check an emailed one-time code without using it up (sign-in, sign-up, step-up, email verification).
 __exportStar(require("./email-code-check"), exports);
+__exportStar(require("./step-up"), exports);
 __exportStar(require("./telegram"), exports);
 __exportStar(require("./siwe"), exports);
 __exportStar(require("./telemetry"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,uEAAuE;AACvE,6CAA2B;AAC3B,mGAAmG;AACnG,2DAAyC;AACzC,4GAA4G;AAC5G,sDAAoC;AACpC,+CAA6B;AAC7B,+EAA+E;AAC/E,6CAA2B;AAC3B,8DAA4C;AAC5C,gGAAgG;AAChG,6CAA0G;AAAjG,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClF,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,0GAA0G;AAC1G,mDAAiC;AACjC,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,sGAAsG;AACtG,qDAAmC;AACnC,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,yDAAuC;AACvC,kDAAgC;AAChC,kDAAgC;AAChC,+DAA+D;AAC/D,kDAAgC;AAChC,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,gGAAgG;AAChG,uDAAqC;AACrC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,oDAAkC;AAClC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,uEAAuE;AACvE,6CAA2B;AAC3B,mGAAmG;AACnG,2DAAyC;AACzC,4GAA4G;AAC5G,sDAAoC;AACpC,+CAA6B;AAC7B,+EAA+E;AAC/E,6CAA2B;AAC3B,8DAA4C;AAC5C,gGAAgG;AAChG,6CAA0G;AAAjG,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClF,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,0GAA0G;AAC1G,mDAAiC;AACjC,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,sGAAsG;AACtG,qDAAmC;AACnC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,yDAAuC;AACvC,kDAAgC;AAChC,kDAAgC;AAChC,+DAA+D;AAC/D,kDAAgC;AAChC,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,gGAAgG;AAChG,uDAAqC;AACrC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,oDAAkC;AAClC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}

package/dist/step-up.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Step-up: re-authenticate the signed-in user in place, without a new session.
+ *
+ * A sensitive action ("re-authenticated within 5 minutes") reads `auth_time`
+ * on the session token: {@link authenticatedWithin} answers it. When it is too
+ * old, prove a credential again with {@link stepUp}; the response carries a
+ * fresh session token whose `auth_time` is now, `amr` names the method and
+ * `acr` is `urn:atlas:acr:step_up`. The refresh token is not rotated.
+ *
+ *   password      POST /v1/client/me/step_up { strategy: 'password', password }
+ *   totp          POST /v1/client/me/step_up { strategy: 'totp', code }
+ *   backup_code   POST /v1/client/me/step_up { strategy: 'backup_code', code }
+ *   email_code    POST /v1/client/me/step_up/email_code, then { strategy: 'email_code', code }
+ *   passkey       POST /v1/client/me/step_up/passkey (challenge), then the assertion
+ */
+import type { FapiClient, FapiResponse } from './fapi';
+export type StepUpInput = {
+    strategy: 'password';
+    password: string;
+} | {
+    strategy: 'totp' | 'backup_code' | 'email_code';
+    code: string;
+} | {
+    strategy: 'passkey';
+    challenge: string;
+    credential_id: string;
+    authenticator_data: string;
+    client_data_json: string;
+    signature: string;
+};
+export interface StepUpResult {
+    object: 'client';
+    stepped_up: true;
+    /** Seconds since the epoch: the step-up just performed. */
+    auth_time: number;
+    amr: string[];
+    acr: string;
+    /** The re-minted session token carrying the fresh auth_time/amr/acr. */
+    jwt: string;
+    expires_in_seconds: number;
+}
+/** Prove a credential of the current session again. A wrong credential is a 401. */
+export declare function stepUp(client: FapiClient, input: StepUpInput): Promise<FapiResponse<StepUpResult>>;
+/** Email a one-time step-up code to the user's primary address (then `stepUp({ strategy: 'email_code', code })`). */
+export declare function sendStepUpEmailCode(client: FapiClient): Promise<FapiResponse<unknown>>;
+/**
+ * Whether the token's `auth_time` (first-factor sign-in or the last step-up)
+ * is within `maxAgeSeconds` of now. A token without `auth_time` never is.
+ */
+export declare function authenticatedWithin(claims: {
+    auth_time?: unknown;
+}, maxAgeSeconds: number, nowMs?: number): boolean;

package/dist/step-up.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stepUp = stepUp;
+exports.sendStepUpEmailCode = sendStepUpEmailCode;
+exports.authenticatedWithin = authenticatedWithin;
+/** Prove a credential of the current session again. A wrong credential is a 401. */
+function stepUp(client, input) {
+    return client.post('/v1/client/me/step_up', input);
+}
+/** Email a one-time step-up code to the user's primary address (then `stepUp({ strategy: 'email_code', code })`). */
+function sendStepUpEmailCode(client) {
+    return client.post('/v1/client/me/step_up/email_code', {});
+}
+/**
+ * Whether the token's `auth_time` (first-factor sign-in or the last step-up)
+ * is within `maxAgeSeconds` of now. A token without `auth_time` never is.
+ */
+function authenticatedWithin(claims, maxAgeSeconds, nowMs = Date.now()) {
+    const at = claims.auth_time;
+    if (typeof at !== 'number' || !Number.isFinite(at))
+        return false;
+    return nowMs / 1000 - at <= maxAgeSeconds;
+}
+//# sourceMappingURL=step-up.js.map

package/dist/step-up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../src/step-up.ts"],"names":[],"mappings":";;AA0CA,wBAEC;AAGD,kDAEC;AAMD,kDAIC;AAlBD,oFAAoF;AACpF,SAAgB,MAAM,CAAC,MAAkB,EAAE,KAAkB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAe,uBAAuB,EAAE,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,qHAAqH;AACrH,SAAgB,mBAAmB,CAAC,MAAkB;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAA+B,EAAE,aAAqB,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IACpH,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI,aAAa,CAAC;AAC5C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/js",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -33,7 +33,7 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck": "tsgo -p tsconfig.json --noEmit --module preserve --moduleResolution bundler --incremental --tsBuildInfoFile node_modules/.cache/typecheck.tsbuildinfo",
     "test": "vitest run"
   }
 }