@atlasauth/js 0.23.1 → 0.24.0

package/dist/credentials.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * Wallet-side helpers for Atlas verifiable credentials (OpenID4VCI / OpenID4VP,
+ * SD-JWT VC): redeem a credential offer, hold the credential with its device
+ * key, and build a selective presentation. For web wallets, tests and demos.
+ * Uses WebCrypto (ES256) only. mdoc credentials are received as-is
+ * (`format: 'mso_mdoc'`); building an mdoc DeviceResponse is a native-wallet job.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCredentialOffer = parseCredentialOffer;
+exports.generateHolderKey = generateHolderKey;
+exports.receiveCredential = receiveCredential;
+exports.presentSdJwt = presentSdJwt;
+const PRE_AUTH = 'urn:ietf:params:oauth:grant-type:pre-authorized_code';
+/** The offer inside an `openid-credential-offer://` link (or an https link carrying `credential_offer`). */
+function parseCredentialOffer(link) {
+    const raw = new URL(link).searchParams.get('credential_offer');
+    if (!raw)
+        throw new Error('The link does not carry a credential_offer.');
+    const offer = JSON.parse(raw);
+    if (typeof offer.credential_issuer !== 'string' || !Array.isArray(offer.credential_configuration_ids)) {
+        throw new Error('Malformed credential offer.');
+    }
+    return offer;
+}
+const enc = new TextEncoder();
+const b64u = (b) => {
+    const bytes = b instanceof Uint8Array ? b : new Uint8Array(b);
+    let s = '';
+    for (const x of bytes)
+        s += String.fromCharCode(x);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+const b64uJson = (v) => b64u(enc.encode(JSON.stringify(v)));
+/** A fresh P-256 device key. */
+async function generateHolderKey() {
+    const pair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
+    const publicJwk = await crypto.subtle.exportKey('jwk', pair.publicKey);
+    return { privateJwk: await crypto.subtle.exportKey('jwk', pair.privateKey), publicJwk: { ...publicJwk, alg: 'ES256' } };
+}
+async function signJwt(header, payload, privateJwk) {
+    const key = await crypto.subtle.importKey('jwk', privateJwk, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']);
+    const input = `${b64uJson({ alg: 'ES256', ...header })}.${b64uJson(payload)}`;
+    const sig = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, key, enc.encode(input));
+    return `${input}.${b64u(sig)}`;
+}
+async function json(res) {
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok)
+        throw new Error(body.error_description ?? body.error ?? `Request failed (${res.status}).`);
+    return body;
+}
+/** Redeem an offer (pre-authorized code flow) and receive the credential bound to a new device key. */
+async function receiveCredential(offer, opts = {}) {
+    const f = opts.fetch ?? ((...a) => fetch(...a));
+    const code = offer.grants?.[PRE_AUTH]?.['pre-authorized_code'];
+    if (!code)
+        throw new Error('The offer has no pre-authorized code.');
+    const issuer = offer.credential_issuer.replace(/\/$/, '');
+    const meta = await json(await f(`${issuer}/.well-known/openid-credential-issuer`));
+    const asBase = (meta.authorization_servers?.[0] ?? issuer).replace(/\/$/, '');
+    const as = await json(await f(`${asBase}/.well-known/oauth-authorization-server`));
+    const configurationId = opts.configurationId ?? offer.credential_configuration_ids[0];
+    const token = await json(await f(as.token_endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ grant_type: PRE_AUTH, 'pre-authorized_code': code, ...(opts.txCode ? { tx_code: opts.txCode } : {}) }).toString(),
+    }));
+    const key = opts.key ?? (await generateHolderKey());
+    const proof = await signJwt({ typ: 'openid4vci-proof+jwt', jwk: { kty: key.publicJwk.kty, crv: key.publicJwk.crv, x: key.publicJwk.x, y: key.publicJwk.y, alg: 'ES256' } }, { aud: issuer, iat: Math.floor(Date.now() / 1000), nonce: token.c_nonce }, key.privateJwk);
+    const issued = await json(await f(meta.credential_endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', authorization: `Bearer ${token.access_token}` },
+        body: JSON.stringify({ credential_configuration_id: configurationId, proof: { proof_type: 'jwt', jwt: proof } }),
+    }));
+    return { ...key, credential: issued.credential, format: issued.format ?? meta.credential_configurations_supported?.[configurationId]?.format ?? 'dc+sd-jwt' };
+}
+/**
+ * Build an SD-JWT VC presentation revealing only the claims in `reveal`, with a
+ * key-binding JWT over `aud` and `nonce` (from the verifier's request object).
+ */
+async function presentSdJwt(input) {
+    const [jwt, ...rest] = input.credential.split('~').filter(Boolean);
+    if (!jwt)
+        throw new Error('Not an SD-JWT credential.');
+    const shown = rest.filter((d) => {
+        const name = JSON.parse(atob(d.replace(/-/g, '+').replace(/_/g, '/')));
+        return input.reveal.includes(String(name[1]));
+    });
+    const base = `${[jwt, ...shown].join('~')}~`;
+    const digest = await crypto.subtle.digest('SHA-256', enc.encode(base));
+    const kb = await signJwt({ typ: 'kb+jwt' }, { aud: input.aud, nonce: input.nonce, iat: Math.floor(Date.now() / 1000), sd_hash: b64u(digest) }, input.privateJwk);
+    return `${base}${kb}`;
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAWH,oDAQC;AAiBD,8CAIC;AAqBD,8CAqCC;AAMD,oCAeC;AA/GD,MAAM,QAAQ,GAAG,sDAAsD,CAAC;AAExE,4GAA4G;AAC5G,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC/D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IACjD,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,IAAI,GAAG,CAAC,CAA2B,EAAU,EAAE;IACnD,MAAM,KAAK,GAAG,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAOrE,gCAAgC;AACzB,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/G,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvE,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;AAC1H,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAA+B,EAAE,OAAgC,EAAE,UAAsB;IAC9G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACtH,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjG,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACjC,CAAC;AAOD,KAAK,UAAU,IAAI,CAAI,GAAa;IAClC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuD,CAAC;IACxG,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,mBAAmB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACxG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uGAAuG;AAChG,KAAK,UAAU,iBAAiB,CACrC,KAAsB,EACtB,OAA6F,EAAE;IAE/F,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAA2B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,MAAM,CAAC,CAAC,GAAG,MAAM,uCAAuC,CAAC,CAC1D,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,EAAE,GAAG,MAAM,IAAI,CAA6B,MAAM,CAAC,CAAC,GAAG,MAAM,yCAAyC,CAAC,CAAC,CAAC;IAC/G,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAE,CAAC;IAEvF,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,MAAM,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE;QACzB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC9I,CAAC,CACH,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,OAAO,CACzB,EAAE,GAAG,EAAE,sBAAsB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAC9I,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EACzE,GAAG,CAAC,UAAU,CACf,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE;QAC9F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,2BAA2B,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;KACjH,CAAC,CACH,CAAC;IACF,OAAO,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAK,IAAI,CAAC,mCAAmC,EAAE,CAAC,eAAe,CAAC,EAAE,MAAsB,IAAI,WAAW,EAAE,CAAC;AACjL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAAC,KAAmG;IACpI,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAc,CAAC;QACpF,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,MAAM,OAAO,CACtB,EAAE,GAAG,EAAE,QAAQ,EAAE,EACjB,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EACjG,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,OAAO,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC;AACxB,CAAC"}

package/dist/custom-challenge.d.ts

@@ -0,0 +1,13 @@
+import type { FapiClient } from './fapi';
+/**
+ * The application's own second factor (a question, a code sent elsewhere, an
+ * identity check): ask Atlas to run the application's challenge for this
+ * sign-in attempt, show the prompt, then submit the answer as the attempt's
+ * `code` with `strategy: 'custom_challenge'` (e.g. `submit({ code, strategy:
+ * 'custom_challenge' })`). Offered when `account.customSecondFactor` is true.
+ */
+export declare function prepareCustomChallenge(client: FapiClient, attemptId: string): Promise<{
+    prompt: string;
+    hint: string | null;
+    expiresAt: number;
+}>;

package/dist/custom-challenge.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareCustomChallenge = prepareCustomChallenge;
+/**
+ * The application's own second factor (a question, a code sent elsewhere, an
+ * identity check): ask Atlas to run the application's challenge for this
+ * sign-in attempt, show the prompt, then submit the answer as the attempt's
+ * `code` with `strategy: 'custom_challenge'` (e.g. `submit({ code, strategy:
+ * 'custom_challenge' })`). Offered when `account.customSecondFactor` is true.
+ */
+async function prepareCustomChallenge(client, attemptId) {
+    const response = await client.post(`/v1/client/sign_ins/${encodeURIComponent(attemptId)}/prepare_second_factor`, { strategy: 'custom_challenge' });
+    if (!response.ok) {
+        const first = response.errors[0];
+        const error = new Error(first?.message ?? 'Could not start the challenge.');
+        if (first?.code)
+            error.code = first.code;
+        throw error;
+    }
+    const d = response.data;
+    return {
+        prompt: typeof d?.prompt === 'string' ? d.prompt : '',
+        hint: typeof d?.hint === 'string' ? d.hint : null,
+        expiresAt: typeof d?.expires_at === 'number' ? d.expires_at : 0,
+    };
+}
+//# sourceMappingURL=custom-challenge.js.map

package/dist/custom-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-challenge.js","sourceRoot":"","sources":["../src/custom-challenge.ts"],"names":[],"mappings":";;AASA,wDAoBC;AA3BD;;;;;;GAMG;AACI,KAAK,UAAU,sBAAsB,CAC1C,MAAkB,EAClB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,wBAAwB,EAC5E,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CACjC,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,gCAAgC,CAA8B,CAAC;QACzG,IAAI,KAAK,EAAE,IAAI;YAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;IACxB,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACrD,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACjD,SAAS,EAAE,OAAO,CAAC,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;KAChE,CAAC;AACJ,CAAC"}

package/dist/delegated-ui.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Bring-your-own login and consent pages. Atlas sends the browser to your page
+ * with `?login_challenge=` or `?consent_challenge=`. Reading, accepting and
+ * rejecting the challenge needs a secret key, so your page talks to YOUR
+ * backend (see `delegatedUiProxy` in @atlasauth/backend), and then follows the
+ * `redirect_to` Atlas returned.
+ */
+export type DelegatedChallenge = {
+    type: 'login' | 'consent';
+    challenge: string;
+};
+/** The challenge on the current page URL, or null when the page was not reached from Atlas. */
+export declare function readDelegatedChallenge(href: string | URL | {
+    href: string;
+}): DelegatedChallenge | null;
+export interface DelegatedLoginRequest {
+    client: {
+        id: string;
+        client_id: string;
+        name: string;
+    };
+    requested_scope: string[];
+    audience: string | null;
+    page: 'sign-in' | 'sign-up';
+    session_subject: string | null;
+    ui_locales: string | null;
+    login_hint: string | null;
+    expires_at: number;
+}
+export interface DelegatedConsentRequest {
+    subject: string;
+    client: {
+        id: string;
+        client_id: string;
+        name: string;
+        first_party?: boolean;
+    };
+    requested_scope: string[];
+    audience: string | null;
+    authorization_details: unknown[];
+    organization_id: string | null;
+    redirect_uri: string;
+    expires_at: number;
+}
+export interface DelegatedUiClientOptions {
+    /** Base URL of your backend routes that proxy the Atlas calls, e.g. `/atlas/oauth`. */
+    baseUrl: string;
+    fetch?: typeof fetch;
+    headers?: Record<string, string>;
+}
+/**
+ * Calls your backend's proxy routes (`GET {baseUrl}/login`, `POST {baseUrl}/login/accept`, …),
+ * each taking the challenge as a query parameter. Errors throw with the server's message.
+ */
+export declare function createDelegatedUiClient(opts: DelegatedUiClientOptions): {
+    getLoginRequest: (challenge: string) => Promise<DelegatedLoginRequest>;
+    /** `subject` is the Atlas user id your backend authenticated the visitor as. */
+    acceptLogin: (challenge: string, body: {
+        subject: string;
+        remember?: boolean;
+        amr?: string[];
+        acr?: string;
+    }) => Promise<{
+        redirect_to: string;
+    }>;
+    rejectLogin: (challenge: string, body?: {
+        error?: string;
+        error_description?: string;
+    }) => Promise<{
+        redirect_to: string;
+    }>;
+    getConsentRequest: (challenge: string) => Promise<DelegatedConsentRequest>;
+    acceptConsent: (challenge: string, body?: {
+        grant_scope?: string[];
+        remember?: boolean;
+    }) => Promise<{
+        redirect_to: string;
+    }>;
+    rejectConsent: (challenge: string, body?: {
+        error?: string;
+        error_description?: string;
+    }) => Promise<{
+        redirect_to: string;
+    }>;
+};
+/**
+ * Send the browser on to the `redirect_to` Atlas returned. Refuses anything that
+ * is not https (or an allowed origin), so a tampered response cannot redirect elsewhere.
+ */
+export declare function continueDelegatedFlow(redirectTo: string, opts?: {
+    allowedOrigins?: string[];
+    navigate?: (url: string) => void;
+}): void;

package/dist/delegated-ui.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * Bring-your-own login and consent pages. Atlas sends the browser to your page
+ * with `?login_challenge=` or `?consent_challenge=`. Reading, accepting and
+ * rejecting the challenge needs a secret key, so your page talks to YOUR
+ * backend (see `delegatedUiProxy` in @atlasauth/backend), and then follows the
+ * `redirect_to` Atlas returned.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readDelegatedChallenge = readDelegatedChallenge;
+exports.createDelegatedUiClient = createDelegatedUiClient;
+exports.continueDelegatedFlow = continueDelegatedFlow;
+/** The challenge on the current page URL, or null when the page was not reached from Atlas. */
+function readDelegatedChallenge(href) {
+    const url = new URL(typeof href === 'string' ? href : href instanceof URL ? href.href : href.href);
+    const login = url.searchParams.get('login_challenge');
+    if (login)
+        return { type: 'login', challenge: login };
+    const consent = url.searchParams.get('consent_challenge');
+    return consent ? { type: 'consent', challenge: consent } : null;
+}
+/**
+ * Calls your backend's proxy routes (`GET {baseUrl}/login`, `POST {baseUrl}/login/accept`, …),
+ * each taking the challenge as a query parameter. Errors throw with the server's message.
+ */
+function createDelegatedUiClient(opts) {
+    const f = opts.fetch ?? ((...a) => fetch(...a));
+    const base = opts.baseUrl.replace(/\/$/, '');
+    async function call(method, path, kind, challenge, body) {
+        const res = await f(`${base}/${path}?${kind}_challenge=${encodeURIComponent(challenge)}`, {
+            method,
+            credentials: 'same-origin',
+            headers: { ...(body !== undefined ? { 'content-type': 'application/json' } : {}), ...opts.headers },
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+        });
+        const json = (await res.json().catch(() => ({})));
+        if (!res.ok)
+            throw new Error(json.error?.message ?? json.message ?? `Request failed (${res.status}).`);
+        return json;
+    }
+    return {
+        getLoginRequest: (challenge) => call('GET', 'login', 'login', challenge),
+        /** `subject` is the Atlas user id your backend authenticated the visitor as. */
+        acceptLogin: (challenge, body) => call('POST', 'login/accept', 'login', challenge, body),
+        rejectLogin: (challenge, body = {}) => call('POST', 'login/reject', 'login', challenge, body),
+        getConsentRequest: (challenge) => call('GET', 'consent', 'consent', challenge),
+        acceptConsent: (challenge, body = {}) => call('POST', 'consent/accept', 'consent', challenge, body),
+        rejectConsent: (challenge, body = {}) => call('POST', 'consent/reject', 'consent', challenge, body),
+    };
+}
+/**
+ * Send the browser on to the `redirect_to` Atlas returned. Refuses anything that
+ * is not https (or an allowed origin), so a tampered response cannot redirect elsewhere.
+ */
+function continueDelegatedFlow(redirectTo, opts = {}) {
+    const url = new URL(redirectTo);
+    const ok = opts.allowedOrigins ? opts.allowedOrigins.includes(url.origin) : url.protocol === 'https:';
+    if (!ok)
+        throw new Error('Refusing to follow an unexpected redirect.');
+    (opts.navigate ?? ((u) => window.location.assign(u)))(url.toString());
+}
+//# sourceMappingURL=delegated-ui.js.map

package/dist/delegated-ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-ui.js","sourceRoot":"","sources":["../src/delegated-ui.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAKH,wDAMC;AAkCD,0DA2BC;AAMD,sDAQC;AAlFD,+FAA+F;AAC/F,SAAgB,sBAAsB,CAAC,IAAqC;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AA8BD;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,IAA8B;IACpE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAA2B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,KAAK,UAAU,IAAI,CAAI,MAAsB,EAAE,IAAY,EAAE,IAAyB,EAAE,SAAiB,EAAE,IAAc;QACvH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE;YACxF,MAAM;YACN,WAAW,EAAE,aAAa;YAC1B,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE;YACnG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA2D,CAAC;QAC5G,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,mBAAmB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;QACvG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,eAAe,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,IAAI,CAAwB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;QACvG,gFAAgF;QAChF,WAAW,EAAE,CAAC,SAAiB,EAAE,IAA2E,EAAE,EAAE,CAC9G,IAAI,CAA0B,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC;QACjF,WAAW,EAAE,CAAC,SAAiB,EAAE,OAAuD,EAAE,EAAE,EAAE,CAC5F,IAAI,CAA0B,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC;QACjF,iBAAiB,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,IAAI,CAA0B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;QAC/G,aAAa,EAAE,CAAC,SAAiB,EAAE,OAAuD,EAAE,EAAE,EAAE,CAC9F,IAAI,CAA0B,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC;QACrF,aAAa,EAAE,CAAC,SAAiB,EAAE,OAAuD,EAAE,EAAE,EAAE,CAC9F,IAAI,CAA0B,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC;KACtF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CACnC,UAAkB,EAClB,OAAwE,EAAE;IAE1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACtG,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACvE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChF,CAAC"}

package/dist/dev-browser.d.ts

@@ -21,6 +21,15 @@
  * The cookies are still set and sent where the browser allows them; the
  * header is only read when there is no cookie.
  */
+/**
+ * Where the dev-browser refresh token is kept: `local` (default, survives restarts and is shared
+ * by every tab), `session` (this tab only) or `memory` (this page load only, nothing written).
+ */
+export type PersistenceMode = 'local' | 'session' | 'memory';
+/** Choose the storage for this page. The FAPI client calls it from its `persistence` option. */
+export declare function setPersistence(next: PersistenceMode | undefined): void;
+/** The storage in force (`local` unless set). Exposed for tests. */
+export declare function getPersistence(): PersistenceMode;
 /** Whether the dev browser applies: a development instance's key, in a browser with storage. */
 export declare function devBrowserEnabled(publishableKey: string): boolean;
 /** The stored refresh token for a development instance, or null. */

package/dist/dev-browser.js

@@ -23,6 +23,8 @@
  * header is only read when there is no cookie.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.setPersistence = setPersistence;
+exports.getPersistence = getPersistence;
 exports.devBrowserEnabled = devBrowserEnabled;
 exports.devBrowserToken = devBrowserToken;
 exports.forgetDevBrowserToken = forgetDevBrowserToken;
@@ -32,9 +34,27 @@ const EXCHANGE = '/v1/client/tickets/exchange';
 const BOOT = '/v1/client';
 const REFRESH = /^\/v1\/client\/sessions\/[^/]+\/tokens$/;
 const REVOKE = /^\/v1\/client\/sessions\/[^/]+\/revoke$/;
+const memory = new Map();
+const memoryStore = {
+    getItem: (k) => memory.get(k) ?? null,
+    setItem: (k, v) => void memory.set(k, v),
+    removeItem: (k) => void memory.delete(k),
+};
+let mode = 'local';
+/** Choose the storage for this page. The FAPI client calls it from its `persistence` option. */
+function setPersistence(next) {
+    mode = next ?? 'local';
+}
+/** The storage in force (`local` unless set). Exposed for tests. */
+function getPersistence() {
+    return mode;
+}
 function storage() {
+    if (mode === 'memory')
+        return memoryStore;
     try {
-        const s = globalThis.localStorage;
+        const g = globalThis;
+        const s = mode === 'session' ? g.sessionStorage : g.localStorage;
         return s && typeof s.getItem === 'function' ? s : null;
     }
     catch {

package/dist/dev-browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"dev-browser.js","sourceRoot":"","sources":["../src/dev-browser.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;AAoBH,8CAEC;AAGD,0CAMC;AAuBD,sDAOC;AAgCD,wCAgDC;AA3ID,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAC9C,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,IAAI,GAAG,YAAY,CAAC;AAC1B,MAAM,OAAO,GAAG,yCAAyC,CAAC;AAC1D,MAAM,MAAM,GAAG,yCAAyC,CAAC;AAIzD,SAAS,OAAO;IACd,IAAI,CAAC;QACH,MAAM,CAAC,GAAI,UAAuC,CAAC,YAAY,CAAC;QAChE,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,SAAgB,iBAAiB,CAAC,cAAsB;IACtD,OAAO,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AACrE,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAAC,cAAsB;IACpD,IAAI,CAAC;QACH,OAAO,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC,IAAI,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,SAAS,QAAQ,CAAC,cAAsB,EAAE,KAAc,EAAE,SAAkB;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO;IAChD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,GAAG,cAAc,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS;YAAE,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,GAAG,cAAc,GAAG,cAAc,EAAE,SAAS,CAAC,CAAC;IAClI,CAAC;IAAC,MAAM,CAAC;QACP,oFAAoF;IACtF,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,cAAsB;IAC7C,IAAI,CAAC;QACH,OAAO,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,GAAG,cAAc,GAAG,cAAc,CAAC,IAAI,IAAI,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,SAAgB,qBAAqB,CAAC,cAAsB;IAC1D,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,UAAU,CAAC,cAAc,GAAG,cAAc,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,UAAU,CAAC,cAAc,GAAG,cAAc,GAAG,cAAc,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAwB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAC9F,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAkB;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAY,CAAC;QACrD,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAE/C,SAAgB,cAAc,CAAC,cAAsB,EAAE,SAAuB;IAC5E,kFAAkF;IAClF,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,IAAK,SAAgD,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3H,MAAM,OAAO,GAAG,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAqB,EAAE;QACxF,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC;YAAE,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7E,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAY,CAAC;gBAC9C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7D,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAI,IAAgC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC;YACxG,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YAC3E,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;YACpC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC;QAC3B,IAAI,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,EAAE;gBAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;iBACjG,IAAI,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,SAAS,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;gBAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAC3E,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,+EAA+E;YAC/E,MAAM,GAAG,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,WAAW,CAAC,IAAI,CAAC;gBAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACD,OAA8C,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAChE,OAAO,OAAuB,CAAC;AACjC,CAAC"}
+{"version":3,"file":"dev-browser.js","sourceRoot":"","sources":["../src/dev-browser.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;AA0BH,wCAEC;AAGD,wCAEC;AAcD,8CAEC;AAGD,0CAMC;AAuBD,sDAOC;AAgCD,wCAgDC;AAtKD,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAC9C,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,IAAI,GAAG,YAAY,CAAC;AAC1B,MAAM,OAAO,GAAG,yCAAyC,CAAC;AAC1D,MAAM,MAAM,GAAG,yCAAyC,CAAC;AAUzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;AACzC,MAAM,WAAW,GAAU;IACzB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI;IACrC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;CACzC,CAAC;AAEF,IAAI,IAAI,GAAoB,OAAO,CAAC;AAEpC,gGAAgG;AAChG,SAAgB,cAAc,CAAC,IAAiC;IAC9D,IAAI,GAAG,IAAI,IAAI,OAAO,CAAC;AACzB,CAAC;AAED,oEAAoE;AACpE,SAAgB,cAAc;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO;IACd,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,UAA8D,CAAC;QACzE,MAAM,CAAC,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QACjE,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,SAAgB,iBAAiB,CAAC,cAAsB;IACtD,OAAO,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AACrE,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAAC,cAAsB;IACpD,IAAI,CAAC;QACH,OAAO,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC,IAAI,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,SAAS,QAAQ,CAAC,cAAsB,EAAE,KAAc,EAAE,SAAkB;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO;IAChD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,GAAG,cAAc,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS;YAAE,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,GAAG,cAAc,GAAG,cAAc,EAAE,SAAS,CAAC,CAAC;IAClI,CAAC;IAAC,MAAM,CAAC;QACP,oFAAoF;IACtF,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,cAAsB;IAC7C,IAAI,CAAC;QACH,OAAO,OAAO,EAAE,EAAE,OAAO,CAAC,cAAc,GAAG,cAAc,GAAG,cAAc,CAAC,IAAI,IAAI,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,SAAgB,qBAAqB,CAAC,cAAsB;IAC1D,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,UAAU,CAAC,cAAc,GAAG,cAAc,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,UAAU,CAAC,cAAc,GAAG,cAAc,GAAG,cAAc,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAwB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAC9F,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAkB;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAY,CAAC;QACrD,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAE/C,SAAgB,cAAc,CAAC,cAAsB,EAAE,SAAuB;IAC5E,kFAAkF;IAClF,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,IAAK,SAAgD,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3H,MAAM,OAAO,GAAG,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAqB,EAAE;QACxF,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC;YAAE,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7E,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAY,CAAC;gBAC9C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7D,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAI,IAAgC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC;YACxG,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YAC3E,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;YACpC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC;QAC3B,IAAI,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,EAAE;gBAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;iBACjG,IAAI,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,SAAS,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;gBAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAC3E,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,+EAA+E;YAC/E,MAAM,GAAG,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,WAAW,CAAC,IAAI,CAAC;gBAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACD,OAA8C,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAChE,OAAO,OAAuB,CAAC;AACjC,CAAC"}

package/dist/device-key.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Device-bound biometric sign-in — the client half.
+ *
+ * A native app keeps an ES256 keypair in the OS secure hardware (Secure Enclave
+ * / Android Keystore), unlocked by Face ID / fingerprint. The public half is
+ * registered once while signed in; later the app signs in by signing a server
+ * challenge with the private half. The keystore is the app's: it supplies a
+ * {@link DeviceKeySigner} (`createKey` + `sign` behind a biometric prompt).
+ * {@link webCryptoSigner} is a software signer for tests and web/RN-polyfill use.
+ *
+ * Server routes: POST /v1/client/me/device_keys/challenge → /device_keys,
+ * POST /v1/client/sign_ins/device_key/challenge → /finish.
+ */
+import type { FapiClient, FapiResponse } from './fapi';
+export interface DeviceKeyJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+}
+export interface DeviceKeySigner {
+    /** Creates the keypair and returns its public JWK. `biometric` asks for a key that needs the OS biometric prompt to use. */
+    createKey(opts: {
+        biometric: boolean;
+    }): Promise<DeviceKeyJwk>;
+    /** Signs the UTF-8 message with ES256, returning base64url IEEE-P1363 (r||s). Shows the biometric prompt for a biometric key. */
+    sign(message: string): Promise<string>;
+}
+export type DeviceKeyPurpose = 'register' | 'sign_in';
+/** The exact string the device signs; mirrors the server so a signature is bound to its use, tenant and key. */
+export declare function deviceKeyMessage(input: {
+    purpose: DeviceKeyPurpose;
+    instanceId: string;
+    keyId: string;
+    nonce: string;
+}): string;
+export interface RegisterDeviceKeyOptions {
+    client: FapiClient;
+    signer: DeviceKeySigner;
+    /** Your instance id (`ins_…`), as shown in the dashboard. */
+    instanceId: string;
+    label?: string;
+    platform?: 'ios' | 'android' | 'other';
+    /** Whether the key needs biometrics to use. Default true. */
+    biometric?: boolean;
+}
+/** Registers this device's key for the signed-in user (needs a recent re-authentication). Returns the `device_key` resource. */
+export declare function registerDeviceKey(opts: RegisterDeviceKeyOptions): Promise<FapiResponse<{
+    id: string;
+}>>;
+export interface SignInWithDeviceKeyOptions {
+    client: FapiClient;
+    signer: DeviceKeySigner;
+    instanceId: string;
+    /** The `id` returned by {@link registerDeviceKey}, which the app stores. */
+    deviceKeyId: string;
+}
+/**
+ * Signs in with the registered device key. The response is the usual sign-in
+ * attempt: `complete` with a session, or `needs_second_factor` when the instance
+ * does not let a device key stand in for MFA.
+ */
+export declare function signInWithDeviceKey(opts: SignInWithDeviceKeyOptions): Promise<FapiResponse<Record<string, unknown>>>;
+/** A software signer on WebCrypto — no hardware or biometric binding; for tests and prototypes. */
+export declare function webCryptoSigner(subtle?: SubtleCrypto): DeviceKeySigner;

package/dist/device-key.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deviceKeyMessage = deviceKeyMessage;
+exports.registerDeviceKey = registerDeviceKey;
+exports.signInWithDeviceKey = signInWithDeviceKey;
+exports.webCryptoSigner = webCryptoSigner;
+/** The exact string the device signs; mirrors the server so a signature is bound to its use, tenant and key. */
+function deviceKeyMessage(input) {
+    return `atlas-device-key:v1:${input.purpose}:${input.instanceId}:${input.keyId}:${input.nonce}`;
+}
+/** Registers this device's key for the signed-in user (needs a recent re-authentication). Returns the `device_key` resource. */
+async function registerDeviceKey(opts) {
+    const { client, signer, instanceId } = opts;
+    const biometric = opts.biometric ?? true;
+    const challenge = await client.post('/v1/client/me/device_keys/challenge', {});
+    if (!challenge.ok || !challenge.data)
+        return challenge;
+    const jwk = await signer.createKey({ biometric });
+    // Proof of possession: the register message names the key by its x coordinate.
+    const signature = await signer.sign(deviceKeyMessage({ purpose: 'register', instanceId, keyId: jwk.x, nonce: challenge.data.nonce }));
+    return client.post('/v1/client/me/device_keys', {
+        nonce: challenge.data.nonce,
+        public_key: jwk,
+        signature,
+        biometric_bound: biometric,
+        ...(opts.label ? { label: opts.label } : {}),
+        ...(opts.platform ? { platform: opts.platform } : {}),
+    });
+}
+/**
+ * Signs in with the registered device key. The response is the usual sign-in
+ * attempt: `complete` with a session, or `needs_second_factor` when the instance
+ * does not let a device key stand in for MFA.
+ */
+async function signInWithDeviceKey(opts) {
+    const { client, signer, instanceId, deviceKeyId } = opts;
+    const challenge = await client.post('/v1/client/sign_ins/device_key/challenge', { device_key_id: deviceKeyId });
+    if (!challenge.ok || !challenge.data)
+        return challenge;
+    const signature = await signer.sign(deviceKeyMessage({ purpose: 'sign_in', instanceId, keyId: deviceKeyId, nonce: challenge.data.nonce }));
+    return client.post('/v1/client/sign_ins/device_key/finish', {
+        device_key_id: deviceKeyId,
+        nonce: challenge.data.nonce,
+        signature,
+    });
+}
+const toB64u = (bytes) => btoa(String.fromCharCode(...new Uint8Array(bytes))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+/** A software signer on WebCrypto — no hardware or biometric binding; for tests and prototypes. */
+function webCryptoSigner(subtle = globalThis.crypto.subtle) {
+    let pair;
+    return {
+        async createKey() {
+            pair = await subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']);
+            const jwk = await subtle.exportKey('jwk', pair.publicKey);
+            return { kty: 'EC', crv: 'P-256', x: jwk.x, y: jwk.y };
+        },
+        async sign(message) {
+            if (!pair)
+                throw new Error('No device key has been created.');
+            return toB64u(await subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, pair.privateKey, new TextEncoder().encode(message)));
+        },
+    };
+}
+//# sourceMappingURL=device-key.js.map

package/dist/device-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-key.js","sourceRoot":"","sources":["../src/device-key.ts"],"names":[],"mappings":";;AAgCA,4CAEC;AAmBD,8CAgBC;AAeD,kDAUC;AAMD,0CAaC;AAlFD,gHAAgH;AAChH,SAAgB,gBAAgB,CAAC,KAAsF;IACrH,OAAO,uBAAuB,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;AAClG,CAAC;AAkBD,gIAAgI;AACzH,KAAK,UAAU,iBAAiB,CAAC,IAA8B;IACpE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAY,qCAAqC,EAAE,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;QAAE,OAAO,SAAoD,CAAC;IAClG,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAClD,+EAA+E;IAC/E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtI,OAAO,MAAM,CAAC,IAAI,CAAiB,2BAA2B,EAAE;QAC9D,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;QAC3B,UAAU,EAAE,GAAG;QACf,SAAS;QACT,eAAe,EAAE,SAAS;QAC1B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAUD;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CAAC,IAAgC;IACxE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAY,0CAA0C,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3H,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;QAAE,OAAO,SAA6D,CAAC;IAC3G,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3I,OAAO,MAAM,CAAC,IAAI,CAA0B,uCAAuC,EAAE;QACnF,aAAa,EAAE,WAAW;QAC1B,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;QAC3B,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAkB,EAAU,EAAE,CAC5C,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAEjH,mGAAmG;AACnG,SAAgB,eAAe,CAAC,SAAuB,UAAU,CAAC,MAAM,CAAC,MAAM;IAC7E,IAAI,IAA+B,CAAC;IACpC,OAAO;QACL,KAAK,CAAC,SAAS;YACb,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACnG,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1D,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAE,EAAE,CAAC;QAC3D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YAC9D,OAAO,MAAM,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3H,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/email-addresses.d.ts

@@ -0,0 +1,24 @@
+import type { FapiClient } from './fapi';
+/**
+ * Secure primary-email change. Making a different verified address primary
+ * answers `status: 'pending_old_address_confirmation'` when the instance sets
+ * `accountUx.emailChange.requireOldAddressConfirm`: a code was mailed to the
+ * current primary address, and {@link confirmPrimaryEmailAddress} finishes the switch.
+ */
+export interface PrimaryEmailResult {
+    object: 'email_address';
+    id: string;
+    primary: boolean;
+    status?: 'pending_old_address_confirmation';
+    /** Masked current primary address that received the code. */
+    old_address?: string;
+}
+export declare class EmailAddressRequestError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/** Make a verified address primary. Check `result.status` for a pending old-address confirmation. */
+export declare function setPrimaryEmailAddress(client: FapiClient, id: string): Promise<PrimaryEmailResult>;
+/** Finish a pending switch with the code mailed to the old primary address. */
+export declare function confirmPrimaryEmailAddress(client: FapiClient, id: string, code: string): Promise<PrimaryEmailResult>;

package/dist/email-addresses.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EmailAddressRequestError = void 0;
+exports.setPrimaryEmailAddress = setPrimaryEmailAddress;
+exports.confirmPrimaryEmailAddress = confirmPrimaryEmailAddress;
+class EmailAddressRequestError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'EmailAddressRequestError';
+    }
+}
+exports.EmailAddressRequestError = EmailAddressRequestError;
+async function call(client, id, action, body) {
+    const res = await client.request(`/v1/client/me/email_addresses/${encodeURIComponent(id)}/${action}`, {
+        method: 'POST',
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    });
+    if (!res.ok || !res.data) {
+        const first = res.errors[0];
+        throw new EmailAddressRequestError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.');
+    }
+    return res.data;
+}
+/** Make a verified address primary. Check `result.status` for a pending old-address confirmation. */
+function setPrimaryEmailAddress(client, id) {
+    return call(client, id, 'primary');
+}
+/** Finish a pending switch with the code mailed to the old primary address. */
+function confirmPrimaryEmailAddress(client, id, code) {
+    return call(client, id, 'confirm_primary', { code });
+}
+//# sourceMappingURL=email-addresses.js.map

package/dist/email-addresses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-addresses.js","sourceRoot":"","sources":["../src/email-addresses.ts"],"names":[],"mappings":";;;AAqCA,wDAEC;AAGD,gEAEC;AA3BD,MAAa,wBAAyB,SAAQ,KAAK;IAC5B;IAAyB;IAA9C,YAAqB,MAAc,EAAW,IAAY,EAAE,OAAe;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,WAAM,GAAN,MAAM,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAQ;QAExD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AALD,4DAKC;AAED,KAAK,UAAU,IAAI,CAAC,MAAkB,EAAE,EAAU,EAAE,MAAc,EAAE,IAAc;IAChF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAqB,iCAAiC,kBAAkB,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,EAAE;QACxH,MAAM,EAAE,MAAM;QACd,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;KAC9D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,qGAAqG;AACrG,SAAgB,sBAAsB,CAAC,MAAkB,EAAE,EAAU;IACnE,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,SAAgB,0BAA0B,CAAC,MAAkB,EAAE,EAAU,EAAE,IAAY;IACrF,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/environment.d.ts

@@ -61,6 +61,8 @@ export interface AccountUx {
     passwordReset: EmailProofDelivery;
     /** The second-factor step may offer "email me a code" ({@link prepareEmailSecondFactor}). */
     emailSecondFactor: boolean;
+    /** The instance offers the custom challenge second factor (set only when true). */
+    customSecondFactor?: boolean;
     /**
      * Passkey-only sign-up ({@link startPasskeySignUp}), when the instance offers
      * it: whether the form collects an email address. Null when not offered.
@@ -79,6 +81,12 @@ export interface AccountUx {
         totp: boolean;
         sms: boolean;
         totpCodes: 1 | 2;
+        /** Counter tokens, YubiKeys, Duo, recovery questions and smart card sign-in. False/absent from an older server. */
+        hotp?: boolean;
+        yubikey?: boolean;
+        duo?: boolean;
+        securityQuestions?: boolean;
+        smartCard?: boolean;
     };
 }
 /**