@atlasauth/js 0.23.1 → 0.24.0

package/dist/organization-admin.d.ts

@@ -0,0 +1,192 @@
+import type { FapiClient } from './fapi';
+/**
+ * The org-admin Frontend API behind the in-app admin widgets
+ * (`<OrganizationSsoConnection/>`, `<OrganizationDirectory/>`,
+ * `<OrganizationDomains/>`, `<OrganizationLogStreams/>`, `<OrganizationApiKeys/>`,
+ * `<OrganizationIpAllowlist/>`, `<OrganizationWebhooks/>`). Every call is scoped
+ * to the ACTIVE organization and needs the manage-members permission; a refused
+ * call throws {@link OrganizationRequestError} (404 for another organization,
+ * 403 for a member without the permission).
+ */
+export interface OrganizationSsoConnection {
+    id: string;
+    type: 'oidc' | 'saml';
+    status: string;
+    oidc_issuer: string | null;
+    oidc_client_id: string | null;
+    has_secret: boolean;
+    saml_idp_entity_id: string | null;
+    saml_idp_sso_url: string | null;
+    has_saml_certificate: boolean;
+    saml_single_logout: boolean;
+    saml_idp_slo_url: string | null;
+}
+/** The service-provider details an IdP admin copies into their identity provider. */
+export interface OrganizationSsoServiceProvider {
+    acs_url: string;
+    oidc_redirect_uri: string;
+    sp_entity_id: string | null;
+    saml_metadata_url: string | null;
+    saml_slo_url: string | null;
+}
+export interface OrganizationSsoView {
+    object: 'organization_sso_connection';
+    connection: OrganizationSsoConnection | null;
+    sp: OrganizationSsoServiceProvider;
+}
+export interface OrganizationSsoInput {
+    type: 'oidc' | 'saml';
+    oidc_issuer?: string;
+    oidc_client_id?: string;
+    /** Write-only; leave blank to keep the stored secret. */
+    oidc_client_secret?: string;
+    saml_metadata_xml?: string;
+    saml_idp_entity_id?: string;
+    saml_idp_sso_url?: string;
+    /** Write-only PEM; leave blank to keep the stored certificate. */
+    saml_idp_certificate?: string;
+    saml_idp_slo_url?: string;
+    saml_single_logout?: boolean;
+}
+export interface OrganizationScimToken {
+    object: 'scim_token';
+    id: string;
+    name: string | null;
+    prefix: string;
+    last_used_at: number | null;
+    expires_at: number | null;
+    created_at: number;
+}
+export interface OrganizationDirectory {
+    object: 'organization_directory';
+    base_url: string;
+    tokens: OrganizationScimToken[];
+}
+export interface OrganizationDomain {
+    object: 'org_domain';
+    id: string;
+    domain: string;
+    status: string;
+    verification: {
+        record_type: 'TXT';
+        record_name: string;
+        record_value: string;
+    };
+}
+export interface OrganizationLogStream {
+    object: 'org_audit_stream';
+    id: string;
+    organization_id: string;
+    url: string;
+    format: string;
+    active: boolean;
+    has_secret: boolean;
+    created_at: number;
+}
+export interface OrganizationApiKey {
+    object: 'api_key';
+    id: string;
+    name: string | null;
+    prefix: string;
+    expires_at: number | null;
+    last_used_at: number | null;
+    created_at: number;
+}
+export interface OrganizationIpAllowlist {
+    object: 'organization_ip_allowlist';
+    entries: string[];
+    /** The caller's own address, so a UI can offer "add my IP". */
+    your_ip: string;
+}
+export interface OrganizationWebhookEndpoint {
+    object: 'webhook_endpoint';
+    id: string;
+    url: string;
+    description: string | null;
+    enabled_events: string[];
+    active: boolean;
+    health: 'healthy' | 'failing' | 'disabled' | string;
+    created_at: number;
+}
+export interface OrganizationWebhookDelivery {
+    object: 'webhook_delivery';
+    id: string;
+    event_type: string | null;
+    status: string;
+    http_status: number | null;
+    attempt_number: number;
+    created_at: number;
+}
+export declare const organizationAdmin: {
+    getSso: (c: FapiClient, org: string) => Promise<OrganizationSsoView>;
+    saveSso: (c: FapiClient, org: string, input: OrganizationSsoInput) => Promise<OrganizationSsoView>;
+    getDirectory: (c: FapiClient, org: string) => Promise<OrganizationDirectory>;
+    /** The returned `token` is shown once. */
+    createDirectoryToken: (c: FapiClient, org: string) => Promise<OrganizationScimToken & {
+        token: string;
+    }>;
+    revokeDirectoryToken: (c: FapiClient, org: string, tokenId: string) => Promise<{
+        id: string;
+        revoked: true;
+    }>;
+    listDomains: (c: FapiClient, org: string) => Promise<OrganizationDomain[]>;
+    addDomain: (c: FapiClient, org: string, domain: string) => Promise<OrganizationDomain>;
+    verifyDomain: (c: FapiClient, org: string, domainId: string) => Promise<OrganizationDomain & {
+        verified: boolean;
+    }>;
+    removeDomain: (c: FapiClient, org: string, domainId: string) => Promise<{
+        id: string;
+        deleted: true;
+    }>;
+    listLogStreams: (c: FapiClient, org: string) => Promise<OrganizationLogStream[]>;
+    /** The returned `secret` signs deliveries and is shown once. */
+    addLogStream: (c: FapiClient, org: string, input: {
+        url: string;
+        format?: string;
+    }) => Promise<OrganizationLogStream & {
+        secret: string;
+    }>;
+    removeLogStream: (c: FapiClient, org: string, streamId: string) => Promise<{
+        id: string;
+        deleted: true;
+    }>;
+    listApiKeys: (c: FapiClient, org: string) => Promise<OrganizationApiKey[]>;
+    /** The returned `secret` is shown once. */
+    createApiKey: (c: FapiClient, org: string, input?: {
+        name?: string;
+        expires_in_seconds?: number;
+    }) => Promise<OrganizationApiKey & {
+        secret: string;
+    }>;
+    revokeApiKey: (c: FapiClient, org: string, keyId: string) => Promise<{
+        id: string;
+        revoked: true;
+    }>;
+    getIpAllowlist: (c: FapiClient, org: string) => Promise<OrganizationIpAllowlist>;
+    /** An empty list clears it; a list that excludes the caller's own IP is refused. */
+    setIpAllowlist: (c: FapiClient, org: string, entries: string[]) => Promise<OrganizationIpAllowlist>;
+    listWebhooks: (c: FapiClient, org: string) => Promise<OrganizationWebhookEndpoint[]>;
+    /** The returned `secret` is shown once. */
+    createWebhook: (c: FapiClient, org: string, input: {
+        url: string;
+        enabled_events?: string[];
+        description?: string;
+    }) => Promise<OrganizationWebhookEndpoint & {
+        secret: string;
+    }>;
+    updateWebhook: (c: FapiClient, org: string, endpointId: string, input: {
+        url?: string;
+        enabled_events?: string[];
+        description?: string | null;
+        active?: boolean;
+    }) => Promise<OrganizationWebhookEndpoint>;
+    deleteWebhook: (c: FapiClient, org: string, endpointId: string) => Promise<{
+        id: string;
+        deleted: true;
+    }>;
+    rotateWebhookSecret: (c: FapiClient, org: string, endpointId: string) => Promise<{
+        secret: string;
+        overlap_seconds: number;
+    }>;
+    webhookDeliveries: (c: FapiClient, org: string, endpointId: string) => Promise<OrganizationWebhookDelivery[]>;
+};

package/dist/organization-admin.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.organizationAdmin = void 0;
+const organizations_1 = require("./organizations");
+const enc = encodeURIComponent;
+const base = (organizationId) => `/v1/client/organizations/${enc(organizationId)}`;
+async function call(client, path, init = {}) {
+    const res = await client.request(path, init);
+    if (!res.ok || !res.data) {
+        const first = res.errors[0];
+        throw new organizations_1.OrganizationRequestError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.', first?.param, first?.reason, first?.meta);
+    }
+    return res.data;
+}
+const send = (method, body) => body === undefined ? { method } : { method, body: JSON.stringify(body) };
+exports.organizationAdmin = {
+    /* SSO connection */
+    getSso: (c, org) => call(c, `${base(org)}/sso_connection`, send('GET')),
+    saveSso: (c, org, input) => call(c, `${base(org)}/sso_connection`, send('PATCH', input)),
+    /* Directory sync (SCIM) */
+    getDirectory: (c, org) => call(c, `${base(org)}/directory`, send('GET')),
+    /** The returned `token` is shown once. */
+    createDirectoryToken: (c, org) => call(c, `${base(org)}/directory/tokens`, send('POST')),
+    revokeDirectoryToken: (c, org, tokenId) => call(c, `${base(org)}/directory/tokens/${enc(tokenId)}`, send('DELETE')),
+    /* Domains */
+    listDomains: async (c, org) => (await call(c, `${base(org)}/domains`, send('GET'))).data,
+    addDomain: (c, org, domain) => call(c, `${base(org)}/domains`, send('POST', { domain })),
+    verifyDomain: (c, org, domainId) => call(c, `${base(org)}/domains/${enc(domainId)}/verify`, send('POST')),
+    removeDomain: (c, org, domainId) => call(c, `${base(org)}/domains/${enc(domainId)}`, send('DELETE')),
+    /* Log streams */
+    listLogStreams: async (c, org) => (await call(c, `${base(org)}/log_streams`, send('GET'))).data,
+    /** The returned `secret` signs deliveries and is shown once. */
+    addLogStream: (c, org, input) => call(c, `${base(org)}/log_streams`, send('POST', input)),
+    removeLogStream: (c, org, streamId) => call(c, `${base(org)}/log_streams/${enc(streamId)}`, send('DELETE')),
+    /* API keys */
+    listApiKeys: async (c, org) => (await call(c, `${base(org)}/api_keys`, send('GET'))).data,
+    /** The returned `secret` is shown once. */
+    createApiKey: (c, org, input = {}) => call(c, `${base(org)}/api_keys`, send('POST', input)),
+    revokeApiKey: (c, org, keyId) => call(c, `${base(org)}/api_keys/${enc(keyId)}`, send('DELETE')),
+    /* Sign-in IP allowlist */
+    getIpAllowlist: (c, org) => call(c, `${base(org)}/ip_allowlist`, send('GET')),
+    /** An empty list clears it; a list that excludes the caller's own IP is refused. */
+    setIpAllowlist: (c, org, entries) => call(c, `${base(org)}/ip_allowlist`, send('PATCH', { entries })),
+    /* Webhook endpoints */
+    listWebhooks: async (c, org) => (await call(c, `${base(org)}/webhook_endpoints`, send('GET'))).data,
+    /** The returned `secret` is shown once. */
+    createWebhook: (c, org, input) => call(c, `${base(org)}/webhook_endpoints`, send('POST', input)),
+    updateWebhook: (c, org, endpointId, input) => call(c, `${base(org)}/webhook_endpoints/${enc(endpointId)}`, send('PATCH', input)),
+    deleteWebhook: (c, org, endpointId) => call(c, `${base(org)}/webhook_endpoints/${enc(endpointId)}`, send('DELETE')),
+    rotateWebhookSecret: (c, org, endpointId) => call(c, `${base(org)}/webhook_endpoints/${enc(endpointId)}/rotate_secret`, send('POST')),
+    webhookDeliveries: async (c, org, endpointId) => (await call(c, `${base(org)}/webhook_endpoints/${enc(endpointId)}/deliveries`, send('GET'))).data,
+};
+//# sourceMappingURL=organization-admin.js.map

package/dist/organization-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-admin.js","sourceRoot":"","sources":["../src/organization-admin.ts"],"names":[],"mappings":";;;AACA,mDAA2D;AAiI3D,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAC/B,MAAM,IAAI,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,4BAA4B,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAE3F,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,OAAoB,EAAE;IAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,wCAAwB,CAChC,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,IAAI,IAAI,SAAS,EACxB,KAAK,EAAE,OAAO,IAAI,qBAAqB,EACvC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CACZ,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAc,EAAe,EAAE,CAC3D,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;AAI9D,QAAA,iBAAiB,GAAG;IAC/B,oBAAoB;IACpB,MAAM,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,EAAE,CAAC,IAAI,CAAsB,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAChH,OAAO,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,KAA2B,EAAE,EAAE,CACnE,IAAI,CAAsB,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEnF,2BAA2B;IAC3B,YAAY,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,EAAE,CAAC,IAAI,CAAwB,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnH,0CAA0C;IAC1C,oBAAoB,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,EAAE,CACnD,IAAI,CAA4C,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnG,oBAAoB,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,OAAe,EAAE,EAAE,CACpE,IAAI,CAAgC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEzG,aAAa;IACb,WAAW,EAAE,KAAK,EAAE,CAAa,EAAE,GAAW,EAAE,EAAE,CAChD,CAAC,MAAM,IAAI,CAA2B,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;IACrF,SAAS,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,MAAc,EAAE,EAAE,CACxD,IAAI,CAAqB,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,QAAgB,EAAE,EAAE,CAC7D,IAAI,CAA6C,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnH,YAAY,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,QAAgB,EAAE,EAAE,CAC7D,IAAI,CAAgC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEjG,iBAAiB;IACjB,cAAc,EAAE,KAAK,EAAE,CAAa,EAAE,GAAW,EAAE,EAAE,CACnD,CAAC,MAAM,IAAI,CAA8B,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;IAC5F,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,KAAuC,EAAE,EAAE,CACpF,IAAI,CAA6C,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtG,eAAe,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,QAAgB,EAAE,EAAE,CAChE,IAAI,CAAgC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAErG,cAAc;IACd,WAAW,EAAE,KAAK,EAAE,CAAa,EAAE,GAAW,EAAE,EAAE,CAChD,CAAC,MAAM,IAAI,CAA2B,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;IACtF,2CAA2C;IAC3C,YAAY,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,QAAwD,EAAE,EAAE,EAAE,CACvG,IAAI,CAA0C,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChG,YAAY,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,KAAa,EAAE,EAAE,CAC1D,IAAI,CAAgC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE/F,0BAA0B;IAC1B,cAAc,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,EAAE,CAC7C,IAAI,CAA0B,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,oFAAoF;IACpF,cAAc,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,OAAiB,EAAE,EAAE,CAChE,IAAI,CAA0B,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE3F,uBAAuB;IACvB,YAAY,EAAE,KAAK,EAAE,CAAa,EAAE,GAAW,EAAE,EAAE,CACjD,CAAC,MAAM,IAAI,CAAoC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;IACxG,2CAA2C;IAC3C,aAAa,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,KAAuE,EAAE,EAAE,CACrH,IAAI,CAAmD,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClH,aAAa,EAAE,CACb,CAAa,EACb,GAAW,EACX,UAAkB,EAClB,KAAiG,EACjG,EAAE,CAAC,IAAI,CAA8B,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,sBAAsB,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpH,aAAa,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,UAAkB,EAAE,EAAE,CAChE,IAAI,CAAgC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,sBAAsB,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7G,mBAAmB,EAAE,CAAC,CAAa,EAAE,GAAW,EAAE,UAAkB,EAAE,EAAE,CACtE,IAAI,CAA8C,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,sBAAsB,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACvI,iBAAiB,EAAE,KAAK,EAAE,CAAa,EAAE,GAAW,EAAE,UAAkB,EAAE,EAAE,CAC1E,CAAC,MAAM,IAAI,CAAoC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,sBAAsB,GAAG,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;CACvI,CAAC"}

package/dist/passkey.d.ts

@@ -12,6 +12,7 @@
  *   register: POST /v1/client/me/passkeys/begin → create → /finish
  *   sign in : POST /v1/client/sign_ins/passkey/begin → get → /finish
  */
+import type { FapiClient, FapiResponse } from './fapi';
 /** The slice of `navigator` these helpers need — injectable for tests. */
 export interface WebAuthnHost {
     credentials: {
@@ -21,7 +22,7 @@ export interface WebAuthnHost {
         }): Promise<Credential | null>;
         get(options: {
             publicKey: PublicKeyCredentialRequestOptions;
-            mediation?: 'silent' | 'optional' | 'conditional' | 'required';
+            mediation?: 'silent' | 'optional' | 'conditional' | 'required' | 'immediate';
             signal?: AbortSignal;
         }): Promise<Credential | null>;
     };
@@ -121,6 +122,74 @@ export interface PasskeyAssertionBody {
  */
 export declare function getPasskeyAssertion(begin: Record<string, unknown>, opts?: {
     host?: WebAuthnHost;
-    mediation?: 'optional' | 'conditional';
+    mediation?: 'optional' | 'conditional' | 'immediate';
     signal?: AbortSignal;
 } & PasskeyExtensionOptions): Promise<PasskeyAssertionBody>;
+/** The `GET /v1/client/me/passkeys/signal` response. */
+export interface PasskeySignalInput {
+    enabled: boolean;
+    rp_id: string;
+    user_id: string;
+    name: string;
+    display_name: string;
+    credential_ids: string[];
+}
+/** The slice of `PublicKeyCredential` the Signal API calls need — injectable for tests. */
+export interface PasskeySignalHost {
+    signalAllAcceptedCredentials?(o: {
+        rpId: string;
+        userId: string;
+        allAcceptedCredentialIds: string[];
+    }): Promise<void>;
+    signalCurrentUserDetails?(o: {
+        rpId: string;
+        userId: string;
+        name: string;
+        displayName: string;
+    }): Promise<void>;
+    signalUnknownCredential?(o: {
+        rpId: string;
+        credentialId: string;
+    }): Promise<void>;
+}
+/**
+ * Tell the user's password manager what the server still accepts, so removed
+ * passkeys disappear from its list and renamed accounts update. Best-effort:
+ * browsers without the Signal API, or a signal the instance has off, do nothing.
+ * Returns the names of the signals sent.
+ */
+export declare function sendPasskeySignals(input: PasskeySignalInput, host?: PasskeySignalHost): Promise<string[]>;
+/** Report a credential the server rejected as unknown (after a failed passkey sign-in). */
+export declare function signalUnknownPasskey(rpId: string, credentialId: string, host?: PasskeySignalHost): Promise<boolean>;
+/** The `GET /v1/client/me/passkeys/prompt` response. */
+export interface PasskeyPromptDecision {
+    eligible: boolean;
+    variant: string;
+    cooldown_days: number;
+}
+/** Eligible by the server and not dismissed within the cooldown on this device. */
+export declare function passkeyPromptDue(decision: PasskeyPromptDecision, store?: Pick<Storage, 'getItem'> | undefined, now?: number): boolean;
+/** Start the cooldown (call when the user dismisses the nudge). */
+export declare function dismissPasskeyPrompt(store?: Pick<Storage, 'setItem'> | undefined, now?: number): void;
+/** What the user did with the nudge. */
+export type PasskeyPromptEvent = 'shown' | 'dismissed' | 'accepted';
+/**
+ * Report what the user did with the passkey nudge. The server records it with the rollout
+ * variant it computed itself (`passkey_prompt.shown|dismissed|accepted` in the audit log), so
+ * conversion per variant is readable without trusting the client. Best-effort: never throws.
+ */
+export declare function reportPasskeyPromptEvent(client: FapiClient, event: PasskeyPromptEvent, deviceClass?: 'desktop' | 'mobile' | 'tablet'): Promise<boolean>;
+/**
+ * Passkey recovery, step 1: an account whose only sign-in is a passkey (no password) that lost it
+ * gets a code at a verified email or phone. Needs `accountUx.passkeyAdoption.recovery` on. The
+ * answer is the same whether or not the account exists. Returns the sign-in attempt id for step 2.
+ */
+export declare function startPasskeyRecovery(client: FapiClient, identifier: string, method?: 'email' | 'phone'): Promise<FapiResponse<{
+    id: string;
+}>>;
+/**
+ * Passkey recovery, step 2: submit the code. A correct one completes the sign-in as usual (the
+ * response carries the `ticket` to exchange for a session, or the next step if the account has
+ * MFA). The user then adds a new passkey with the normal add flow, since the sign-in is fresh.
+ */
+export declare function finishPasskeyRecovery(client: FapiClient, attemptId: string, code: string, method?: 'email' | 'phone'): Promise<FapiResponse<Record<string, unknown>>>;

package/dist/passkey.js

@@ -22,6 +22,13 @@ exports.passkeyExtensionsInput = passkeyExtensionsInput;
 exports.readExtensionResults = readExtensionResults;
 exports.createPasskey = createPasskey;
 exports.getPasskeyAssertion = getPasskeyAssertion;
+exports.sendPasskeySignals = sendPasskeySignals;
+exports.signalUnknownPasskey = signalUnknownPasskey;
+exports.passkeyPromptDue = passkeyPromptDue;
+exports.dismissPasskeyPrompt = dismissPasskeyPrompt;
+exports.reportPasskeyPromptEvent = reportPasskeyPromptEvent;
+exports.startPasskeyRecovery = startPasskeyRecovery;
+exports.finishPasskeyRecovery = finishPasskeyRecovery;
 const defaultHost = () => {
     const nav = globalThis.navigator;
     if (!nav || !nav.credentials) {
@@ -184,4 +191,94 @@ function extensionsMember(app, server) {
         return {};
     return { extensions: { ...(fromServer ?? {}), ...(app ?? {}) } };
 }
+const signalHost = () => (globalThis.PublicKeyCredential ?? {});
+/**
+ * Tell the user's password manager what the server still accepts, so removed
+ * passkeys disappear from its list and renamed accounts update. Best-effort:
+ * browsers without the Signal API, or a signal the instance has off, do nothing.
+ * Returns the names of the signals sent.
+ */
+async function sendPasskeySignals(input, host = signalHost()) {
+    if (!input.enabled)
+        return [];
+    const sent = [];
+    const run = async (name, fn) => {
+        if (!fn)
+            return;
+        try {
+            await fn();
+            sent.push(name);
+        }
+        catch {
+            // A signal is a hint; a rejected one (wrong rpId, stale handle) never blocks sign-in.
+        }
+    };
+    await run('signalAllAcceptedCredentials', host.signalAllAcceptedCredentials?.bind(host, { rpId: input.rp_id, userId: input.user_id, allAcceptedCredentialIds: input.credential_ids }));
+    await run('signalCurrentUserDetails', host.signalCurrentUserDetails?.bind(host, { rpId: input.rp_id, userId: input.user_id, name: input.name, displayName: input.display_name }));
+    return sent;
+}
+/** Report a credential the server rejected as unknown (after a failed passkey sign-in). */
+async function signalUnknownPasskey(rpId, credentialId, host = signalHost()) {
+    if (!host.signalUnknownCredential)
+        return false;
+    try {
+        await host.signalUnknownCredential({ rpId, credentialId });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const PROMPT_KEY = 'atlas.passkeyPromptDismissedAt';
+const DAY_MS = 86_400_000;
+/** Eligible by the server and not dismissed within the cooldown on this device. */
+function passkeyPromptDue(decision, store = globalThis.localStorage, now = Date.now()) {
+    if (!decision.eligible)
+        return false;
+    const at = Number(store?.getItem(PROMPT_KEY));
+    return !(at > 0 && now - at < decision.cooldown_days * DAY_MS);
+}
+/** Start the cooldown (call when the user dismisses the nudge). */
+function dismissPasskeyPrompt(store = globalThis.localStorage, now = Date.now()) {
+    store?.setItem(PROMPT_KEY, String(now));
+}
+/**
+ * Report what the user did with the passkey nudge. The server records it with the rollout
+ * variant it computed itself (`passkey_prompt.shown|dismissed|accepted` in the audit log), so
+ * conversion per variant is readable without trusting the client. Best-effort: never throws.
+ */
+async function reportPasskeyPromptEvent(client, event, deviceClass) {
+    try {
+        const res = await client.post('/v1/client/me/passkeys/prompt/events', { event, ...(deviceClass ? { device_class: deviceClass } : {}) });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Passkey recovery, step 1: an account whose only sign-in is a passkey (no password) that lost it
+ * gets a code at a verified email or phone. Needs `accountUx.passkeyAdoption.recovery` on. The
+ * answer is the same whether or not the account exists. Returns the sign-in attempt id for step 2.
+ */
+async function startPasskeyRecovery(client, identifier, method = 'email') {
+    const attempt = await client.post('/v1/client/sign_ins', { identifier });
+    if (!attempt.ok || !attempt.data)
+        return attempt;
+    const prepared = await client.post(`/v1/client/sign_ins/${attempt.data.id}/prepare_first_factor`, {
+        strategy: method === 'email' ? 'email_code' : 'phone_code',
+    });
+    return prepared.ok ? { ...prepared, data: { id: attempt.data.id } } : prepared;
+}
+/**
+ * Passkey recovery, step 2: submit the code. A correct one completes the sign-in as usual (the
+ * response carries the `ticket` to exchange for a session, or the next step if the account has
+ * MFA). The user then adds a new passkey with the normal add flow, since the sign-in is fresh.
+ */
+function finishPasskeyRecovery(client, attemptId, code, method = 'email') {
+    return client.post(`/v1/client/sign_ins/${attemptId}/attempt_first_factor`, {
+        strategy: method === 'email' ? 'email_code' : 'phone_code',
+        code,
+    });
+}
 //# sourceMappingURL=passkey.js.map

package/dist/passkey.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../src/passkey.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAuBH,8CAKC;AAGD,8CAOC;AAGD,8CAGC;AAGD,wDAQC;AAkED,wDAaC;AAMD,oDAeC;AAeD,sCAkCC;AAgBD,kDAiCC;AA/OD,MAAM,WAAW,GAAG,GAAiB,EAAE;IACrC,MAAM,GAAG,GAAI,UAAsC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,GAAG,IAAI,CAAE,GAAiC,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAA8B,CAAC;AACxC,CAAC,CAAC;AAEF,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,GAA6B;IAC7D,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,IAAc;IAC9C,MAAM,CAAC,GAAG,IAAI,IAAK,UAAgD,CAAC,mBAAmB,CAAC;IACxF,OAAO,OAAO,CAAC,KAAK,WAAW,CAAC;AAClC,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,sBAAsB;IAC1C,MAAM,EAAE,GAAI,UAAqG;SAC9G,mBAAmB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,EAAE,+BAA+B,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAuDD,SAAS,SAAS,CAAC,IAAoB;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,IAAI,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,CAAmB;IACpC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED,sFAAsF;AACtF,SAAgB,sBAAsB,CACpC,GAAkC,EAClC,QAA0B;IAE1B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,GAAG,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC/C,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAA0B,EAAE,CACrD,CAAC,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE1I,oEAAoE;AACpE,SAAgB,oBAAoB,CAAC,UAA+B;IAClE,MAAM,GAAG,GAAI,UAAuF,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC;IACzI,MAAM,GAAG,GAA4B,EAAE,YAAY,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3F,MAAM,GAAG,GAAG,GAAG,CAAC,GAAyF,CAAC;IAC1G,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,GAAG;YACR,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAyC,CAAC;IAChE,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,GAAG,CAAC,SAAS,GAAG,OAAO,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9H,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;;GAIG;AACI,KAAK,UAAU,aAAa,CACjC,KAA8B,EAC9B,OAAyE,EAAE;IAE3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAyD,CAAC;IAC7E,MAAM,OAAO,GAAI,KAAK,CAAC,kBAAiE,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QACjD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;KACjC,CAAC;IAEnD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAA+B,CAAC;IAChG,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA4C,CAAC;IACzE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,IAAI,CAAC,kBAAkB;QAAE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,qEAAqE;QACrE,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,KAA8B,EAC9B,OAAwH,EAAE;IAE1H,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,KAAK,GAAI,KAAK,CAAC,gBAA+D,IAAI,EAAE,CAAC;IAE3F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnF,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;KAC/B,CAAC;IAElD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7C,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA0C,CAAC;IACvE,IAAI,IAAI,CAAC,kBAAkB;QAAE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAgB;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC;QAClD,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,GAAwC,EACxC,MAAe;IAEf,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpI,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;AACnE,CAAC"}
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../src/passkey.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAyBH,8CAKC;AAGD,8CAOC;AAGD,8CAGC;AAGD,wDAQC;AAkED,wDAaC;AAMD,oDAeC;AAeD,sCAkCC;AAgBD,kDAiCC;AAyCD,gDAeC;AAGD,oDAQC;AAaD,4CAQC;AAGD,oDAKC;AAUD,4DAWC;AAOD,oDAWC;AAOD,sDAUC;AAvYD,MAAM,WAAW,GAAG,GAAiB,EAAE;IACrC,MAAM,GAAG,GAAI,UAAsC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,GAAG,IAAI,CAAE,GAAiC,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAA8B,CAAC;AACxC,CAAC,CAAC;AAEF,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,GAA6B;IAC7D,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,IAAc;IAC9C,MAAM,CAAC,GAAG,IAAI,IAAK,UAAgD,CAAC,mBAAmB,CAAC;IACxF,OAAO,OAAO,CAAC,KAAK,WAAW,CAAC;AAClC,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,sBAAsB;IAC1C,MAAM,EAAE,GAAI,UAAqG;SAC9G,mBAAmB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,EAAE,+BAA+B,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAuDD,SAAS,SAAS,CAAC,IAAoB;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,IAAI,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,CAAmB;IACpC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED,sFAAsF;AACtF,SAAgB,sBAAsB,CACpC,GAAkC,EAClC,QAA0B;IAE1B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,GAAG,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC/C,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAA0B,EAAE,CACrD,CAAC,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE1I,oEAAoE;AACpE,SAAgB,oBAAoB,CAAC,UAA+B;IAClE,MAAM,GAAG,GAAI,UAAuF,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC;IACzI,MAAM,GAAG,GAA4B,EAAE,YAAY,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3F,MAAM,GAAG,GAAG,GAAG,CAAC,GAAyF,CAAC;IAC1G,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,GAAG;YACR,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAyC,CAAC;IAChE,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,GAAG,CAAC,SAAS,GAAG,OAAO,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9H,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;;GAIG;AACI,KAAK,UAAU,aAAa,CACjC,KAA8B,EAC9B,OAAyE,EAAE;IAE3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAyD,CAAC;IAC7E,MAAM,OAAO,GAAI,KAAK,CAAC,kBAAiE,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QACjD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;KACjC,CAAC;IAEnD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAA+B,CAAC;IAChG,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA4C,CAAC;IACzE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,IAAI,CAAC,kBAAkB;QAAE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,qEAAqE;QACrE,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,KAA8B,EAC9B,OAAsI,EAAE;IAExI,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,KAAK,GAAI,KAAK,CAAC,gBAA+D,IAAI,EAAE,CAAC;IAE3F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnF,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;KAC/B,CAAC;IAElD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7C,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA0C,CAAC;IACvE,IAAI,IAAI,CAAC,kBAAkB;QAAE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAgB;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC;QAClD,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,GAAwC,EACxC,MAAe;IAEf,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpI,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;AACnE,CAAC;AAmBD,MAAM,UAAU,GAAG,GAAsB,EAAE,CACzC,CAAE,UAAgD,CAAC,mBAAmB,IAAI,EAAE,CAAsB,CAAC;AAErG;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CAAC,KAAyB,EAAE,OAA0B,UAAU,EAAE;IACxG,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,EAAqC,EAAE,EAAE;QACxE,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC,CAAC;IACF,MAAM,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,4BAA4B,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,wBAAwB,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACvL,MAAM,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAClL,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2FAA2F;AACpF,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,YAAoB,EAAE,OAA0B,UAAU,EAAE;IACnH,IAAI,CAAC,IAAI,CAAC,uBAAuB;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AASD,MAAM,UAAU,GAAG,gCAAgC,CAAC;AACpD,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,mFAAmF;AACnF,SAAgB,gBAAgB,CAC9B,QAA+B,EAC/B,QAA+C,UAAyC,CAAC,YAAY,EACrG,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE,GAAG,QAAQ,CAAC,aAAa,GAAG,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,mEAAmE;AACnE,SAAgB,oBAAoB,CAClC,QAA+C,UAAyC,CAAC,YAAY,EACrG,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAKD;;;;GAIG;AACI,KAAK,UAAU,wBAAwB,CAC5C,MAAkB,EAClB,KAAyB,EACzB,WAA6C;IAE7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxI,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,UAAkB,EAClB,SAA4B,OAAO;IAEnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiB,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,EAAE,uBAAuB,EAAE;QAChG,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;KAC3D,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAE,QAAoD,CAAC;AAC9H,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACnC,MAAkB,EAClB,SAAiB,EACjB,IAAY,EACZ,SAA4B,OAAO;IAEnC,OAAO,MAAM,CAAC,IAAI,CAAC,uBAAuB,SAAS,uBAAuB,EAAE;QAC1E,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;QAC1D,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/password-reset.d.ts

@@ -29,6 +29,11 @@ export interface ResetFlowState {
     busy: boolean;
     /** Present once the reset completes — exchange it for session cookies. */
     ticket: string | null;
+    /**
+     * At `needs_new_password`: the security questions the user must answer first (they set some;
+     * recovery only). Empty or absent when none are required. Send the answers as `securityAnswers`.
+     */
+    securityQuestions?: string[];
 }
 export declare const initialResetFlow: ResetFlowState;
 /** Begin a reset: email the code. Returns a flow parked at `needs_email_verification`. */
@@ -41,6 +46,14 @@ export declare function startPasswordReset(client: FapiClient, email: string, ca
 export declare function advancePasswordReset(client: FapiClient, state: ResetFlowState, values: {
     code?: string;
     password?: string;
+    securityAnswers?: Array<{
+        question: string;
+        answer: string;
+    }>;
+}, 
+/** `askQuestions`: look up the user's security questions on reaching the new-password step (`account.mfa.securityQuestions`). */
+opts?: {
+    askQuestions?: boolean;
 }): Promise<ResetFlowState>;
 /** The step a reset flow is on — what the UI should collect next. */
 export type ResetStep = 'request' | 'collect_email_code' | 'collect_second_factor' | 'collect_new_password' | 'done' | 'unknown';
@@ -50,4 +63,6 @@ export declare function resetStep(state: ResetFlowState): ResetStep;
  * flow at its current status (`needs_new_password` / `needs_second_factor`
  * once it was); unchanged while still waiting or when the server can't say.
  */
-export declare function pollPasswordReset(client: FapiClient, state: ResetFlowState): Promise<ResetFlowState>;
+export declare function pollPasswordReset(client: FapiClient, state: ResetFlowState, opts?: {
+    askQuestions?: boolean;
+}): Promise<ResetFlowState>;

package/dist/password-reset.js

@@ -5,6 +5,7 @@ exports.startPasswordReset = startPasswordReset;
 exports.advancePasswordReset = advancePasswordReset;
 exports.resetStep = resetStep;
 exports.pollPasswordReset = pollPasswordReset;
+const mfa_factors_1 = require("./mfa-factors");
 exports.initialResetFlow = {
     attempt: null,
     errors: [],
@@ -26,7 +27,9 @@ async function startPasswordReset(client, email, captchaToken) {
  * → verification, a 2FA code → second factor, a new password → set-password. On
  * completion the returned state carries a ticket to exchange for cookies.
  */
-async function advancePasswordReset(client, state, values) {
+async function advancePasswordReset(client, state, values, 
+/** `askQuestions`: look up the user's security questions on reaching the new-password step (`account.mfa.securityQuestions`). */
+opts = {}) {
     const attempt = state.attempt;
     if (!attempt)
         return state;
@@ -43,7 +46,7 @@ async function advancePasswordReset(client, state, values) {
             break;
         case 'needs_new_password':
             path = `/v1/client/password_resets/${attempt.id}/set_new_password`;
-            body = { password: values.password ?? '' };
+            body = { password: values.password ?? '', ...(values.securityAnswers?.length ? { security_answers: values.securityAnswers } : {}) };
             break;
         default:
             return state;
@@ -59,8 +62,16 @@ async function advancePasswordReset(client, state, values) {
         errors: [],
         busy: false,
         ticket: res.data.ticket ?? null,
+        ...(opts.askQuestions ? await questionsFor(client, res.data.id, res.data.status) : {}),
     };
 }
+/** The security questions a reset owes once it reaches the new-password step. */
+async function questionsFor(client, id, status) {
+    if (status !== 'needs_new_password')
+        return {};
+    const asked = await (0, mfa_factors_1.getResetSecurityQuestions)(client, id);
+    return asked?.required ? { securityQuestions: asked.questions } : {};
+}
 function resetStep(state) {
     const status = state.attempt?.status;
     if (!status)
@@ -83,13 +94,17 @@ function resetStep(state) {
  * flow at its current status (`needs_new_password` / `needs_second_factor`
  * once it was); unchanged while still waiting or when the server can't say.
  */
-async function pollPasswordReset(client, state) {
+async function pollPasswordReset(client, state, opts = {}) {
     const attempt = state.attempt;
     if (!attempt?.poll_secret)
         return state;
     const res = await client.get(`/v1/client/password_resets/${attempt.id}?poll_secret=${encodeURIComponent(attempt.poll_secret)}`);
     if (!res.ok || !res.data)
         return state;
-    return { ...state, attempt: { id: res.data.id, status: res.data.status, poll_secret: attempt.poll_secret } };
+    return {
+        ...state,
+        attempt: { id: res.data.id, status: res.data.status, poll_secret: attempt.poll_secret },
+        ...(opts.askQuestions ? await questionsFor(client, res.data.id, res.data.status) : {}),
+    };
 }
 //# sourceMappingURL=password-reset.js.map

package/dist/password-reset.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.js","sourceRoot":"","sources":["../src/password-reset.ts"],"names":[],"mappings":";;;AA2CA,gDAWC;AAOD,oDAuCC;AAWD,8BAeC;AAOD,8CAQC;AA1GY,QAAA,gBAAgB,GAAmB;IAC9C,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,0FAA0F;AACnF,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,KAAa,EACb,YAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAe,4BAA4B,EAAE;QACxE,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,wBAAgB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC7E,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,KAAqB,EACrB,MAA4C;IAE5C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,0BAA0B;YAC7B,IAAI,GAAG,8BAA8B,OAAO,CAAC,EAAE,uBAAuB,CAAC;YACvE,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM;QACR,KAAK,qBAAqB;YACxB,IAAI,GAAG,8BAA8B,OAAO,CAAC,EAAE,wBAAwB,CAAC;YACxE,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM;QACR,KAAK,oBAAoB;YACvB,IAAI,GAAG,8BAA8B,OAAO,CAAC,EAAE,mBAAmB,CAAC;YACnE,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM;QACR;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAqC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,2EAA2E;QAC3E,oCAAoC;QACpC,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE;QACrD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KAChC,CAAC;AACJ,CAAC;AAWD,SAAgB,SAAS,CAAC,KAAqB;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,0BAA0B;YAC7B,OAAO,oBAAoB,CAAC;QAC9B,KAAK,qBAAqB;YACxB,OAAO,uBAAuB,CAAC;QACjC,KAAK,oBAAoB;YACvB,OAAO,sBAAsB,CAAC;QAChC,KAAK,UAAU;YACb,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iBAAiB,CAAC,MAAkB,EAAE,KAAqB;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,WAAW;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAC1B,8BAA8B,OAAO,CAAC,EAAE,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAClG,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;AAC/G,CAAC"}
+{"version":3,"file":"password-reset.js","sourceRoot":"","sources":["../src/password-reset.ts"],"names":[],"mappings":";;;AAiDA,gDAWC;AAOD,oDA0CC;AAkBD,8BAeC;AAOD,8CAYC;AAlJD,+CAA0D;AA0B7C,QAAA,gBAAgB,GAAmB;IAC9C,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,0FAA0F;AACnF,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,KAAa,EACb,YAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAe,4BAA4B,EAAE;QACxE,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,wBAAgB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC7E,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,KAAqB,EACrB,MAA2G;AAC3G,iIAAiI;AACjI,OAAmC,EAAE;IAErC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,0BAA0B;YAC7B,IAAI,GAAG,8BAA8B,OAAO,CAAC,EAAE,uBAAuB,CAAC;YACvE,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM;QACR,KAAK,qBAAqB;YACxB,IAAI,GAAG,8BAA8B,OAAO,CAAC,EAAE,wBAAwB,CAAC;YACxE,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM;QACR,KAAK,oBAAoB;YACvB,IAAI,GAAG,8BAA8B,OAAO,CAAC,EAAE,mBAAmB,CAAC;YACnE,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACpI,MAAM;QACR;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAqC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,2EAA2E;QAC3E,oCAAoC;QACpC,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE;QACrD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;QAC/B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,YAAY,CAAC,MAAkB,EAAE,EAAU,EAAE,MAAc;IACxE,IAAI,MAAM,KAAK,oBAAoB;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,IAAA,uCAAyB,EAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,OAAO,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAWD,SAAgB,SAAS,CAAC,KAAqB;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,0BAA0B;YAC7B,OAAO,oBAAoB,CAAC;QAC9B,KAAK,qBAAqB;YACxB,OAAO,uBAAuB,CAAC;QACjC,KAAK,oBAAoB;YACvB,OAAO,sBAAsB,CAAC;QAChC,KAAK,UAAU;YACb,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iBAAiB,CAAC,MAAkB,EAAE,KAAqB,EAAE,OAAmC,EAAE;IACtH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,WAAW;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAC1B,8BAA8B,OAAO,CAAC,EAAE,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAClG,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;QACvF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC;AACJ,CAAC"}