@atlasauth/js 0.23.1 → 0.25.0

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isPermissionKey = exports.isRoleKey = exports.PERMISSION_KEY_PATTERN = exports.ROLE_KEY_PATTERN = exports.ForbiddenError = exports.protectFromClaims = exports.hasFromClaims = exports.evaluate = exports.detectReferralSource = exports.detectConsentProvider = exports.detectConsent = exports.canonicalCategory = exports.REFERRAL_BROWSER_SOURCES = exports.CONSENT_PROVIDERS = exports.withDevBrowser = exports.forgetDevBrowserToken = exports.devBrowserToken = exports.devBrowserEnabled = void 0;
+exports.isPermissionKey = exports.isRoleKey = exports.PERMISSION_KEY_PATTERN = exports.ROLE_KEY_PATTERN = exports.ForbiddenError = exports.protectFromClaims = exports.hasFromClaims = exports.evaluate = exports.detectReferralSource = exports.detectConsentProvider = exports.detectConsent = exports.canonicalCategory = exports.REFERRAL_BROWSER_SOURCES = exports.CONSENT_PROVIDERS = exports.withDevBrowser = exports.setPersistence = exports.forgetDevBrowserToken = exports.devBrowserToken = exports.devBrowserEnabled = void 0;
 // Provider configuration checks (frontendApi) shared by every framework SDK.
 __exportStar(require("./config"), exports);
 __exportStar(require("./sign-out"), exports);
@@ -48,6 +48,7 @@ var dev_browser_1 = require("./dev-browser");
 Object.defineProperty(exports, "devBrowserEnabled", { enumerable: true, get: function () { return dev_browser_1.devBrowserEnabled; } });
 Object.defineProperty(exports, "devBrowserToken", { enumerable: true, get: function () { return dev_browser_1.devBrowserToken; } });
 Object.defineProperty(exports, "forgetDevBrowserToken", { enumerable: true, get: function () { return dev_browser_1.forgetDevBrowserToken; } });
+Object.defineProperty(exports, "setPersistence", { enumerable: true, get: function () { return dev_browser_1.setPersistence; } });
 Object.defineProperty(exports, "withDevBrowser", { enumerable: true, get: function () { return dev_browser_1.withDevBrowser; } });
 var referral_detect_1 = require("./referral-detect");
 Object.defineProperty(exports, "CONSENT_PROVIDERS", { enumerable: true, get: function () { return referral_detect_1.CONSENT_PROVIDERS; } });
@@ -64,14 +65,21 @@ __exportStar(require("./sign-out-events"), exports);
 __exportStar(require("./native"), exports);
 __exportStar(require("./native-session"), exports);
 __exportStar(require("./passkey"), exports);
+// Device-bound biometric sign-in for native apps (register a device key, sign in with it).
+__exportStar(require("./attestation"), exports);
+__exportStar(require("./device-key"), exports);
 // The sign-in's MFA steps: second-factor setup (authenticator app / texts) and the texted / emailed code.
 __exportStar(require("./mfa-enrollment"), exports);
+// HOTP, YubiKey (Yubico OTP), Duo, security questions (password-reset recovery).
+__exportStar(require("./mfa-factors"), exports);
 // Passkey sign-in's ceremony start, carrying the sign-in captcha when one is required.
 __exportStar(require("./passkey-sign-in"), exports);
 // Passkey-only sign-up (the account is created when its passkey registers).
 __exportStar(require("./passkey-sign-up"), exports);
 // Check an emailed one-time code without using it up (sign-in, sign-up, step-up, email verification).
 __exportStar(require("./email-code-check"), exports);
+// SRP-6a sign-in (RFC 5054, 3072-bit group, SHA-256): the password never leaves the browser.
+__exportStar(require("./srp"), exports);
 __exportStar(require("./step-up"), exports);
 __exportStar(require("./telegram"), exports);
 __exportStar(require("./siwe"), exports);
@@ -79,18 +87,32 @@ __exportStar(require("./telemetry"), exports);
 __exportStar(require("./reauth"), exports);
 // End-user API key self-service (`/v1/client/me/api_keys`).
 __exportStar(require("./api-keys"), exports);
+// The apps a user authorized, with the OpenID Grant Management grants each holds.
+__exportStar(require("./authorized-apps"), exports);
 __exportStar(require("./device-authorization"), exports);
+__exportStar(require("./app-launcher"), exports);
 __exportStar(require("./organizations"), exports);
+__exportStar(require("./organization-admin"), exports);
+__exportStar(require("./pricing"), exports);
+__exportStar(require("./marketing"), exports);
 __exportStar(require("./phone-numbers"), exports);
+__exportStar(require("./email-addresses"), exports);
 // Username availability + the "Last used" sign-in method hint.
 __exportStar(require("./account-hints"), exports);
+__exportStar(require("./custom-challenge"), exports);
+// Identity verification (document and selfie) through the app's verification service.
+__exportStar(require("./identity-verification"), exports);
+// Identity governance: request access, approve, review, delegate.
+__exportStar(require("./iga"), exports);
 // Self-service profile update (incl. user-editable identity traits).
 __exportStar(require("./profile"), exports);
 __exportStar(require("./connect"), exports);
+__exportStar(require("./connections"), exports);
 __exportStar(require("./password-reset"), exports);
 __exportStar(require("./check-session"), exports);
 // Moving from Better Auth: exchange a readable Better Auth session cookie for an Atlas session.
 __exportStar(require("./better-auth-bridge"), exports);
+__exportStar(require("./migration-browser-sessions"), exports);
 // OIDC Front-Channel Logout after a browser sign-out.
 __exportStar(require("./frontchannel-logout"), exports);
 // RP-initiated logout at an upstream OpenID provider after a browser sign-out.
@@ -120,4 +142,12 @@ Object.defineProperty(exports, "ROLE_KEY_PATTERN", { enumerable: true, get: func
 Object.defineProperty(exports, "PERMISSION_KEY_PATTERN", { enumerable: true, get: function () { return authz_1.PERMISSION_KEY_PATTERN; } });
 Object.defineProperty(exports, "isRoleKey", { enumerable: true, get: function () { return authz_1.isRoleKey; } });
 Object.defineProperty(exports, "isPermissionKey", { enumerable: true, get: function () { return authz_1.isPermissionKey; } });
+__exportStar(require("./journey-redirect"), exports);
+// Bring-your-own login / consent pages: read the challenge, call your backend proxy, follow redirect_to.
+__exportStar(require("./delegated-ui"), exports);
+// Passkeys for a user store you own (via your backend and the Atlas Passkey API).
+__exportStar(require("./external-passkeys"), exports);
+// Wallet-side helpers for verifiable credentials (receive an offer, present an SD-JWT VC).
+__exportStar(require("./credentials"), exports);
+__exportStar(require("./uma"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,uEAAuE;AACvE,6CAA2B;AAC3B,mGAAmG;AACnG,2DAAyC;AACzC,4GAA4G;AAC5G,sDAAoC;AACpC,+CAA6B;AAC7B,+EAA+E;AAC/E,6CAA2B;AAC3B,8DAA4C;AAC5C,gGAAgG;AAChG,6CAA0G;AAAjG,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClF,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,0GAA0G;AAC1G,mDAAiC;AACjC,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,sGAAsG;AACtG,qDAAmC;AACnC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,yDAAuC;AACvC,kDAAgC;AAChC,kDAAgC;AAChC,+DAA+D;AAC/D,kDAAgC;AAChC,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,gGAAgG;AAChG,uDAAqC;AACrC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,oDAAkC;AAClC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,uEAAuE;AACvE,6CAA2B;AAC3B,mGAAmG;AACnG,2DAAyC;AACzC,4GAA4G;AAC5G,sDAAoC;AACpC,+CAA6B;AAC7B,+EAA+E;AAC/E,6CAA2B;AAC3B,8DAA4C;AAC5C,gGAAgG;AAChG,6CAAgJ;AAAvI,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClG,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,2FAA2F;AAC3F,gDAA8B;AAC9B,+CAA6B;AAC7B,0GAA0G;AAC1G,mDAAiC;AACjC,iFAAiF;AACjF,gDAA8B;AAC9B,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,sGAAsG;AACtG,qDAAmC;AACnC,6FAA6F;AAC7F,wCAAsB;AACtB,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,kFAAkF;AAClF,oDAAkC;AAClC,yDAAuC;AACvC,iDAA+B;AAC/B,kDAAgC;AAChC,uDAAqC;AACrC,4CAA0B;AAC1B,8CAA4B;AAC5B,kDAAgC;AAChC,oDAAkC;AAClC,+DAA+D;AAC/D,kDAAgC;AAChC,qDAAmC;AACnC,sFAAsF;AACtF,0DAAwC;AACxC,kEAAkE;AAClE,wCAAsB;AACtB,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,gDAA8B;AAC9B,mDAAiC;AACjC,kDAAgC;AAChC,gGAAgG;AAChG,uDAAqC;AACrC,+DAA6C;AAC7C,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,oDAAkC;AAClC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAEjB,qDAAmC;AAEnC,yGAAyG;AACzG,iDAA+B;AAE/B,kFAAkF;AAClF,sDAAoC;AAEpC,2FAA2F;AAC3F,gDAA8B;AAC9B,wCAAsB"}

package/dist/journey-redirect.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The ticket exchange answers with `redirect_url` when the instance's sign-in
+ * journey names where the user goes after signing in. Only an https URL is
+ * honoured; anything else is ignored.
+ */
+export declare function journeyRedirectUrl(body: unknown): string | null;
+/** Read `redirect_url` off a ticket-exchange Response without consuming it. */
+export declare function journeyRedirectFrom(response: Response | undefined | null): Promise<string | null>;

package/dist/journey-redirect.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.journeyRedirectUrl = journeyRedirectUrl;
+exports.journeyRedirectFrom = journeyRedirectFrom;
+/**
+ * The ticket exchange answers with `redirect_url` when the instance's sign-in
+ * journey names where the user goes after signing in. Only an https URL is
+ * honoured; anything else is ignored.
+ */
+function journeyRedirectUrl(body) {
+    const url = body && typeof body === 'object' ? body.redirect_url : undefined;
+    if (typeof url !== 'string')
+        return null;
+    try {
+        return new URL(url).protocol === 'https:' ? url : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Read `redirect_url` off a ticket-exchange Response without consuming it. */
+async function journeyRedirectFrom(response) {
+    if (!response || !response.ok)
+        return null;
+    try {
+        return journeyRedirectUrl(await response.clone().json());
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=journey-redirect.js.map

package/dist/journey-redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journey-redirect.js","sourceRoot":"","sources":["../src/journey-redirect.ts"],"names":[],"mappings":";;AAKA,gDAQC;AAGD,kDAOC;AAvBD;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAAa;IAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAmC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7G,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AACxE,KAAK,UAAU,mBAAmB,CAAC,QAAqC;IAC7E,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/marketing.d.ts

@@ -0,0 +1,81 @@
+import type { FapiClient } from './fapi';
+import { type AppConsent } from './referral-detect';
+/**
+ * Marketing attribution: capture the UTM tags and ad click ids a visitor arrived
+ * with, keep them (only with consent) until they sign up, and attach them to the
+ * new user's private metadata (`marketing.first_touch` / `last_touch`) and to
+ * lead-form submissions. The instance decides which parameters are captured
+ * (`GET /v1/client/marketing`); the server re-validates everything it receives.
+ *
+ * Consent: the page's consent manager decides for the instance's category (default
+ * `marketing`), else the app's own `consent`. With no decision nothing is stored.
+ */
+export interface MarketingConfig {
+    enabled: boolean;
+    params: string[];
+    consentCategory: string;
+}
+export interface MarketingTouch {
+    params: Record<string, string>;
+    landing_url: string | null;
+    referrer: string | null;
+    captured_at: string;
+}
+export interface StoredMarketing {
+    first_touch: MarketingTouch;
+    last_touch: MarketingTouch;
+    /** The attribution has been sent to the server for the user who signed up. */
+    sent?: boolean;
+}
+export interface MarketingOptions {
+    /** Your own consent decision, used when no consent manager is on the page. */
+    consent?: AppConsent;
+    /** Where the capture is kept. Default `localStorage`. */
+    storage?: Pick<Storage, 'getItem' | 'setItem' | 'removeItem'> | null;
+    /** The page (default `window`), for tests and non-browser hosts. */
+    win?: {
+        location?: {
+            search?: string;
+            origin?: string;
+            pathname?: string;
+        };
+        document?: {
+            referrer?: string;
+        };
+    } | null;
+}
+export declare const MARKETING_STORAGE_KEY = "atlas_marketing";
+/** Forget the cached per-instance config (tests). */
+export declare function resetMarketingCapture(): void;
+export declare function loadMarketingConfig(client: FapiClient): Promise<MarketingConfig>;
+/** The touch a page URL carries: its allowed parameters, the landing page and the referrer. Null when it carries none. */
+export declare function marketingTouchFromPage(config: MarketingConfig, win: NonNullable<MarketingOptions['win']>, now?: Date): MarketingTouch | null;
+/** What has been captured so far, or null. */
+export declare function storedMarketing(options?: MarketingOptions): StoredMarketing | null;
+/**
+ * Capture the current page's campaign parameters, when the instance captures them
+ * and the visitor has consented. The first touch is kept; the last touch follows
+ * the newest. Resolves true when something was stored.
+ */
+export declare function captureMarketing(client: FapiClient, options?: MarketingOptions): Promise<boolean>;
+/**
+ * Send what was captured to the server for the signed-in user (call after a
+ * sign-up completes). The server attributes only a recently created user, so an
+ * existing user is untouched. Sent once; resolves true when the server recorded it.
+ */
+export declare function flushMarketing(client: FapiClient, options?: MarketingOptions): Promise<boolean>;
+export interface LeadInput {
+    email: string;
+    name?: string;
+    /** Which form this is (default `default`); one row per email per form. */
+    form?: string;
+    /** The person agreed to be contacted (a checkbox, or an implicit subscribe). */
+    consent?: boolean;
+    /** A hidden honeypot field's value: a person leaves it empty. */
+    website?: string;
+}
+/** Submit a lead / subscribe form, with the captured attribution when there is some. */
+export declare function submitLead(client: FapiClient, input: LeadInput, options?: MarketingOptions): Promise<{
+    ok: boolean;
+    error?: string;
+}>;

package/dist/marketing.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MARKETING_STORAGE_KEY = void 0;
+exports.resetMarketingCapture = resetMarketingCapture;
+exports.loadMarketingConfig = loadMarketingConfig;
+exports.marketingTouchFromPage = marketingTouchFromPage;
+exports.storedMarketing = storedMarketing;
+exports.captureMarketing = captureMarketing;
+exports.flushMarketing = flushMarketing;
+exports.submitLead = submitLead;
+const referral_detect_1 = require("./referral-detect");
+exports.MARKETING_STORAGE_KEY = 'atlas_marketing';
+const TTL_MS = 90 * 24 * 60 * 60_000;
+const DISABLED = { enabled: false, params: [], consentCategory: 'marketing' };
+const configs = new Map();
+/** Forget the cached per-instance config (tests). */
+function resetMarketingCapture() {
+    configs.clear();
+}
+function loadMarketingConfig(client) {
+    const key = client.referralCacheKey;
+    let cached = configs.get(key);
+    if (!cached) {
+        cached = client
+            .get('/v1/client/marketing')
+            .then((res) => {
+            const c = res.ok ? res.data?.capture : undefined;
+            if (!c?.enabled)
+                return DISABLED;
+            const params = Array.isArray(c.params) ? c.params.filter((p) => typeof p === 'string') : [];
+            return { enabled: true, params, consentCategory: typeof c.consent_category === 'string' ? c.consent_category : 'marketing' };
+        })
+            .catch(() => DISABLED);
+        configs.set(key, cached);
+    }
+    return cached;
+}
+const defaultWindow = () => (typeof window === 'undefined' ? null : window);
+const defaultStorage = () => {
+    try {
+        return typeof localStorage === 'undefined' ? null : localStorage;
+    }
+    catch {
+        return null;
+    }
+};
+/** origin + path of a URL (no query, no fragment), or null. */
+const originPath = (raw) => {
+    if (!raw)
+        return null;
+    try {
+        const u = new URL(raw);
+        return u.protocol === 'http:' || u.protocol === 'https:' ? `${u.origin}${u.pathname}` : null;
+    }
+    catch {
+        return null;
+    }
+};
+/** The touch a page URL carries: its allowed parameters, the landing page and the referrer. Null when it carries none. */
+function marketingTouchFromPage(config, win, now = new Date()) {
+    const search = new URLSearchParams(win.location?.search ?? '');
+    const params = {};
+    for (const name of config.params.length ? config.params : []) {
+        const v = search.get(name);
+        if (v && v.trim())
+            params[name] = v.trim().slice(0, 200);
+    }
+    if (Object.keys(params).length === 0)
+        return null;
+    const landing = win.location?.origin ? `${win.location.origin}${win.location.pathname ?? '/'}` : null;
+    return { params, landing_url: originPath(landing), referrer: originPath(win.document?.referrer), captured_at: now.toISOString() };
+}
+const read = (storage) => {
+    try {
+        const raw = storage?.getItem(exports.MARKETING_STORAGE_KEY);
+        if (!raw)
+            return null;
+        const v = JSON.parse(raw);
+        if (v.expires_at !== undefined && v.expires_at < Date.now()) {
+            storage?.removeItem(exports.MARKETING_STORAGE_KEY);
+            return null;
+        }
+        return v.first_touch && v.last_touch ? v : null;
+    }
+    catch {
+        return null;
+    }
+};
+/** What has been captured so far, or null. */
+function storedMarketing(options = {}) {
+    return read(options.storage === undefined ? defaultStorage() : options.storage);
+}
+function consentFor(config, win, options) {
+    return (0, referral_detect_1.detectConsent)(win, [config.consentCategory], { provider: 'auto', appConsent: options.consent });
+}
+/**
+ * Capture the current page's campaign parameters, when the instance captures them
+ * and the visitor has consented. The first touch is kept; the last touch follows
+ * the newest. Resolves true when something was stored.
+ */
+async function captureMarketing(client, options = {}) {
+    const win = options.win === undefined ? defaultWindow() : options.win;
+    const storage = options.storage === undefined ? defaultStorage() : options.storage;
+    if (!win || !storage)
+        return false;
+    // A touch needs a query parameter; without one there is nothing to capture, so skip the config request.
+    if (!win.location?.search || win.location.search === '?')
+        return false;
+    const config = await loadMarketingConfig(client);
+    if (!config.enabled)
+        return false;
+    const touch = marketingTouchFromPage(config, win);
+    if (!touch)
+        return false;
+    if (!consentFor(config, win, options).granted)
+        return false;
+    const prior = read(storage);
+    const next = { first_touch: prior?.first_touch ?? touch, last_touch: touch, expires_at: Date.now() + TTL_MS };
+    try {
+        storage.setItem(exports.MARKETING_STORAGE_KEY, JSON.stringify(next));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Send what was captured to the server for the signed-in user (call after a
+ * sign-up completes). The server attributes only a recently created user, so an
+ * existing user is untouched. Sent once; resolves true when the server recorded it.
+ */
+async function flushMarketing(client, options = {}) {
+    const storage = options.storage === undefined ? defaultStorage() : options.storage;
+    const stored = read(storage);
+    if (!stored || stored.sent)
+        return false;
+    const res = await client.post('/v1/client/me/marketing', { ...stored.last_touch, first_touch: stored.first_touch });
+    if (!res.ok)
+        return false;
+    // Whatever the server said (recorded or "not a new user"), do not keep asking.
+    try {
+        storage?.setItem(exports.MARKETING_STORAGE_KEY, JSON.stringify({ ...stored, sent: true, expires_at: Date.now() + TTL_MS }));
+    }
+    catch {
+        /* best effort */
+    }
+    return res.data?.recorded === true;
+}
+/** Submit a lead / subscribe form, with the captured attribution when there is some. */
+async function submitLead(client, input, options = {}) {
+    const stored = storedMarketing(options);
+    const res = await client.post('/v1/client/marketing/leads', {
+        email: input.email,
+        ...(input.name ? { name: input.name } : {}),
+        ...(input.form ? { form: input.form } : {}),
+        consent: input.consent === true,
+        ...(input.website ? { website: input.website } : {}),
+        ...(stored ? { marketing: { ...stored.first_touch } } : {}),
+    });
+    return res.ok ? { ok: true } : { ok: false, error: res.errors[0]?.message ?? 'Could not submit.' };
+}
+//# sourceMappingURL=marketing.js.map

package/dist/marketing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketing.js","sourceRoot":"","sources":["../src/marketing.ts"],"names":[],"mappings":";;;AAiDA,sDAEC;AAED,kDAgBC;AAuBD,wDAUC;AAkBD,0CAEC;AAWD,4CAmBC;AAOD,wCAaC;AAcD,gCAWC;AApMD,uDAAyF;AA0C5E,QAAA,qBAAqB,GAAG,iBAAiB,CAAC;AACvD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AACrC,MAAM,QAAQ,GAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC;AAC/F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;AAE5D,qDAAqD;AACrD,SAAgB,qBAAqB;IACnC,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,SAAgB,mBAAmB,CAAC,MAAkB;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACpC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,MAAM;aACZ,GAAG,CAAoF,sBAAsB,CAAC;aAC9G,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACjD,IAAI,CAAC,CAAC,EAAE,OAAO;gBAAE,OAAO,QAAQ,CAAC;YACjC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/H,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,MAA0D,CAAC,CAAC;AACjI,MAAM,cAAc,GAAG,GAAG,EAAE;IAC1B,IAAI,CAAC;QACH,OAAO,OAAO,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,GAAG,CAAC,GAA8B,EAAiB,EAAE;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,0HAA0H;AAC1H,SAAgB,sBAAsB,CAAC,MAAuB,EAAE,GAAyC,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACzH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;AACpI,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,OAAoC,EAA0B,EAAE;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,EAAE,OAAO,CAAC,6BAAqB,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8C,CAAC;QACvE,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5D,OAAO,EAAE,UAAU,CAAC,6BAAqB,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,8CAA8C;AAC9C,SAAgB,eAAe,CAAC,UAA4B,EAAE;IAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,UAAU,CAAC,MAAuB,EAAE,GAAY,EAAE,OAAyB;IAClF,OAAO,IAAA,+BAAa,EAAC,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,gBAAgB,CAAC,MAAkB,EAAE,UAA4B,EAAE;IACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACnF,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACnC,wGAAwG;IACxG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC9G,IAAI,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,6BAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,MAAkB,EAAE,UAA4B,EAAE;IACrF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACnF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAyB,yBAAyB,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5I,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1B,+EAA+E;IAC/E,IAAI,CAAC;QACH,OAAO,EAAE,OAAO,CAAC,6BAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;AACrC,CAAC;AAaD,wFAAwF;AACjF,KAAK,UAAU,UAAU,CAAC,MAAkB,EAAE,KAAgB,EAAE,UAA4B,EAAE;IACnG,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;QAC1D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI;QAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,mBAAmB,EAAE,CAAC;AACrG,CAAC"}

package/dist/mfa-enrollment.d.ts

@@ -36,6 +36,8 @@ export interface MfaChoices {
     emailCode: boolean;
     /** How many authenticator codes enrolment asks for. */
     totpCodes: 1 | 2;
+    /** "Use Duo instead" at the second factor (see `prepareDuo`). */
+    duo?: boolean;
 }
 /**
  * The MFA choices from the instance's settings (`InstanceSettings.account`).

package/dist/mfa-enrollment.js

@@ -27,6 +27,7 @@ function mfaChoicesFrom(account) {
         sms: mfa ? mfa.sms : false,
         emailCode: account?.emailSecondFactor === true,
         totpCodes: mfa ? mfa.totpCodes : 2,
+        ...(mfa?.duo === true ? { duo: true } : {}),
     };
 }
 /** `POST /v1/client/sign_ins/:id/prepare_mfa_enrollment`. */

package/dist/mfa-enrollment.js.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-enrollment.js","sourceRoot":"","sources":["../src/mfa-enrollment.ts"],"names":[],"mappings":";;AAiDA,wCAQC;AAiBD,oDAyBC;AAGD,sCAEC;AAmDD,kDAyGC;AAOD,kDAIC;AASD,0DAgBC;AAMD,8CAIC;AASD,oDAGC;AAGD,4DAEC;AAGD,8CAEC;AAGD,8CAUC;AAGD,4DAOC;AAMD,sDAkBC;AA7UD;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,OAAwE;IACrG,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC3B,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;QAC1B,SAAS,EAAE,OAAO,EAAE,iBAAiB,KAAK,IAAI;QAC9C,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;KACnC,CAAC;AACJ,CAAC;AAgBD,6DAA6D;AACtD,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,SAAiB,EACjB,KAAuE;IAEvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,yBAAyB,EAC7E,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CACxG,CAAC;IACF,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzE,MAAM,UAAU,GAAkB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;IACtF,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5C,4CAA4C;QAC5C,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC;IAC7D,CAAC;SAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,yEAAyE;AACzE,SAAgB,aAAa,CAAC,MAAc;IAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,MAAoB,EAAE,MAAc;IAC7D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;AACtF,CAAC;AAyCD,6EAA6E;AAC7E,SAAgB,mBAAmB,CACjC,MAAkB,EAClB,OAAwC;IAExC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,CAAC,CAAa,EAA2B,EAAE;QACzD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAClC,uEAAuE;QACvE,qEAAqE;QACrE,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAuB,EAAE;QACrC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;IAClH,CAAC,CAAC;IAEF,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;IACpB,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,KAAkC,EAAE,EAAE;QACjD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,KAAuE,EAAE,EAAE;QAChG,MAAM,EAAE,GAAG,SAAS,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,MAAM,GAAG,GAAG,UAAU,CAAC;QACvB,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,GAAG,KAAK,UAAU;YAAE,OAAO,CAAC,8BAA8B;QAC9D,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1E,mEAAmE;YACnE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClE,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,MAAM,UAAU,GAA4B;QAC1C,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,QAAQ;YAChB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,EAAE;YACN,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAO;YAC7B,UAAU,IAAI,CAAC,CAAC;YAChB,SAAS,GAAG,EAAE,CAAC;YACf,KAAK,GAAG,EAAE,CAAC;YACX,KAAK,GAAG,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,EAAE,CAAC,CAAC;YACR,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO;YAC5C,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,KAAK;YACnB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,6BAA6B,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1G,OAAO;YACT,CAAC;YACD,KAAK,GAAG,MAAM,CAAC;YACf,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,CAAC,MAAM;YACV,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK;gBAAE,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBACvD,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;YAC3B,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,MAAM,GAAG,GACP,CAAC,CAAC,QAAQ,KAAK,YAAY;gBAC3B,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE;gBACjF,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC3F,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK;YACH,UAAU,IAAI,CAAC,CAAC;YAChB,SAAS,GAAG,IAAI,CAAC;YACjB,KAAK,GAAG,EAAE,CAAC;YACX,KAAK,GAAG,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,EAAE,CAAC,CAAC;QACV,CAAC;KACF,CAAC;IACF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,KAAyB;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,cAAc,CAAC;IAC9E,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,uBAAuB,CAC3C,MAAkB,EAClB,SAAiB,EACjB,QAA8B;IAE9B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,wBAAwB,EAC5E,EAAE,QAAQ,EAAE,CACb,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,0BAA0B,CAA8B,CAAC;QACnG,IAAI,KAAK,EAAE,IAAI;YAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,KAAmD;IACtF,IAAI,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AACxF,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,KAAgB;IACvD,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,yDAAyD;AACzD,SAAgB,iBAAiB,CAAC,KAAwB;IACxD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,iBAAiB,CAAC,KAAwB;IAC9D,MAAM,SAAS,GAAI,UAA0F,CAAC,SAAS;QACrH,EAAE,SAAS,CAAC;IACd,IAAI,CAAC,SAAS,EAAE,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAgB,wBAAwB;IACtC,OAAO,CACL,OAAO,QAAQ,KAAK,WAAW;QAC/B,OAAO,IAAI,KAAK,WAAW;QAC3B,OAAO,GAAG,KAAK,WAAW;QAC1B,OAAO,GAAG,CAAC,eAAe,KAAK,UAAU,CAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,KAAwB,EAAE,QAAQ,GAAG,oBAAoB;IAC7F,IAAI,CAAC,wBAAwB,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;QACb,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACtB,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC;QACnB,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;QACzB,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,KAAK,EAAE,CAAC;QACV,CAAC,CAAC,MAAM,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}
+{"version":3,"file":"mfa-enrollment.js","sourceRoot":"","sources":["../src/mfa-enrollment.ts"],"names":[],"mappings":";;AAmDA,wCASC;AAiBD,oDAyBC;AAGD,sCAEC;AAmDD,kDAyGC;AAOD,kDAIC;AASD,0DAgBC;AAMD,8CAIC;AASD,oDAGC;AAGD,4DAEC;AAGD,8CAEC;AAGD,8CAUC;AAGD,4DAOC;AAMD,sDAkBC;AA9UD;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,OAAwE;IACrG,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC3B,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;QAC1B,SAAS,EAAE,OAAO,EAAE,iBAAiB,KAAK,IAAI;QAC9C,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAClC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC;AAgBD,6DAA6D;AACtD,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,SAAiB,EACjB,KAAuE;IAEvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,yBAAyB,EAC7E,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CACxG,CAAC;IACF,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzE,MAAM,UAAU,GAAkB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;IACtF,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5C,4CAA4C;QAC5C,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC;IAC7D,CAAC;SAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,yEAAyE;AACzE,SAAgB,aAAa,CAAC,MAAc;IAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,MAAoB,EAAE,MAAc;IAC7D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;AACtF,CAAC;AAyCD,6EAA6E;AAC7E,SAAgB,mBAAmB,CACjC,MAAkB,EAClB,OAAwC;IAExC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,CAAC,CAAa,EAA2B,EAAE;QACzD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAClC,uEAAuE;QACvE,qEAAqE;QACrE,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAuB,EAAE;QACrC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;IAClH,CAAC,CAAC;IAEF,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;IACpB,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,KAAkC,EAAE,EAAE;QACjD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,KAAuE,EAAE,EAAE;QAChG,MAAM,EAAE,GAAG,SAAS,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,MAAM,GAAG,GAAG,UAAU,CAAC;QACvB,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,GAAG,KAAK,UAAU;YAAE,OAAO,CAAC,8BAA8B;QAC9D,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1E,mEAAmE;YACnE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClE,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,MAAM,UAAU,GAA4B;QAC1C,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,QAAQ;YAChB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,EAAE;YACN,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAO;YAC7B,UAAU,IAAI,CAAC,CAAC;YAChB,SAAS,GAAG,EAAE,CAAC;YACf,KAAK,GAAG,EAAE,CAAC;YACX,KAAK,GAAG,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,EAAE,CAAC,CAAC;YACR,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO;YAC5C,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,KAAK;YACnB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,6BAA6B,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1G,OAAO;YACT,CAAC;YACD,KAAK,GAAG,MAAM,CAAC;YACf,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,CAAC,MAAM;YACV,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK;gBAAE,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBACvD,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;YAC3B,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,MAAM,GAAG,GACP,CAAC,CAAC,QAAQ,KAAK,YAAY;gBAC3B,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE;gBACjF,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC3F,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK;YACH,UAAU,IAAI,CAAC,CAAC;YAChB,SAAS,GAAG,IAAI,CAAC;YACjB,KAAK,GAAG,EAAE,CAAC;YACX,KAAK,GAAG,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,EAAE,CAAC,CAAC;QACV,CAAC;KACF,CAAC;IACF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,KAAyB;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,cAAc,CAAC;IAC9E,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,uBAAuB,CAC3C,MAAkB,EAClB,SAAiB,EACjB,QAA8B;IAE9B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,wBAAwB,EAC5E,EAAE,QAAQ,EAAE,CACb,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,0BAA0B,CAA8B,CAAC;QACnG,IAAI,KAAK,EAAE,IAAI;YAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,KAAmD;IACtF,IAAI,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AACxF,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,KAAgB;IACvD,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,yDAAyD;AACzD,SAAgB,iBAAiB,CAAC,KAAwB;IACxD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,iBAAiB,CAAC,KAAwB;IAC9D,MAAM,SAAS,GAAI,UAA0F,CAAC,SAAS;QACrH,EAAE,SAAS,CAAC;IACd,IAAI,CAAC,SAAS,EAAE,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAgB,wBAAwB;IACtC,OAAO,CACL,OAAO,QAAQ,KAAK,WAAW;QAC/B,OAAO,IAAI,KAAK,WAAW;QAC3B,OAAO,GAAG,KAAK,WAAW;QAC1B,OAAO,GAAG,CAAC,eAAe,KAAK,UAAU,CAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,KAAwB,EAAE,QAAQ,GAAG,oBAAoB;IAC7F,IAAI,CAAC,wBAAwB,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;QACb,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACtB,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC;QACnB,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;QACzB,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,KAAK,EAAE,CAAC;QACV,CAAC,CAAC,MAAM,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/mfa-factors.d.ts

@@ -0,0 +1,109 @@
+/**
+ * The additional authentication factors, client half: counter-based tokens (HOTP), YubiKeys
+ * (Yubico OTP), Duo, security questions for password reset, and smart card sign-in. The
+ * signed-in calls below need a recent sign-in (the same step-up gate as every 2FA change).
+ *
+ * HOTP and Yubico OTP codes are typed into the ordinary second-factor `code` field at
+ * sign-in, so they need no extra call there. Duo is a redirect: see {@link prepareDuo}.
+ */
+import type { FapiClient, FapiResponse } from './fapi';
+interface EnrolledFactor {
+    object: 'mfa_factor';
+    id: string;
+    type: string;
+    verified: boolean;
+    backup_codes?: string[];
+}
+export interface HotpEnrollment extends EnrolledFactor {
+    /** The base32 secret, shown once. Program it into the token or app. */
+    secret: string;
+    /** The `otpauth://hotp/` URI (for a QR code). */
+    uri: string;
+    digits: number;
+}
+/** Start HOTP enrolment: returns the secret and URI once. Confirm with {@link verifyHotp}. */
+export declare function startHotp(client: FapiClient): Promise<FapiResponse<HotpEnrollment>>;
+/** Confirm HOTP enrolment with the token's next code; the response carries the recovery codes once. */
+export declare function verifyHotp(client: FapiClient, factorId: string, code: string): Promise<FapiResponse<EnrolledFactor>>;
+/** Re-synchronise a token whose counter ran far ahead, from two consecutive codes. */
+export declare function resyncHotp(client: FapiClient, factorId: string, codes: [string, string]): Promise<FapiResponse<{
+    resynced: true;
+}>>;
+/** Enrol a YubiKey: the user touches the key into a field and you pass the typed OTP. */
+export declare function enrollYubikey(client: FapiClient, otp: string): Promise<FapiResponse<EnrolledFactor & {
+    public_id: string;
+}>>;
+/** A string a YubiKey could have typed (modhex, 32 to 48 characters). Handy to route a field's input. */
+export declare const looksLikeYubicoOtp: (value: string) => boolean;
+export interface DuoPrompt {
+    /** Send the browser here. Duo returns it to the Frontend API, then to `returnUrl` when given. */
+    authorizationUrl: string;
+}
+/** Begin Duo enrolment. After the redirect back, call {@link finishDuoEnrollment} with the returned `factorId`. */
+export declare function startDuoEnrollment(client: FapiClient, opts?: {
+    returnUrl?: string;
+}): Promise<FapiResponse<EnrolledFactor & {
+    authorization_url: string;
+}>>;
+/** Complete Duo enrolment after the user approved Duo's prompt. Answers 400 until Duo has confirmed. */
+export declare function finishDuoEnrollment(client: FapiClient, factorId: string): Promise<FapiResponse<EnrolledFactor>>;
+/** At the second-factor step: get Duo's authorization URL for this sign-in attempt. */
+export declare function prepareDuo(client: FapiClient, attemptId: string, opts?: {
+    returnUrl?: string;
+}): Promise<{
+    prompt: DuoPrompt | null;
+    response: FapiResponse<{
+        authorization_url: string;
+    }>;
+}>;
+/**
+ * Poll the sign-in after sending the user to Duo. Returns the attempt as it stands: the
+ * status stays `needs_second_factor` until Duo's callback has recorded an approval for this
+ * attempt, then `complete`.
+ */
+export declare function pollDuo(client: FapiClient, attemptId: string): Promise<FapiResponse<Record<string, unknown>>>;
+export interface SecurityQuestions {
+    enabled: boolean;
+    /** How many questions the user answers. */
+    required: number;
+    availableQuestions: string[];
+    /** The questions the user chose (never the answers). */
+    answeredQuestions: string[];
+}
+interface SecurityQuestionsWire {
+    enabled: boolean;
+    required: number;
+    available_questions: string[];
+    answered_questions: string[];
+}
+/** The offered questions and the signed-in user's chosen ones. */
+export declare function getSecurityQuestions(client: FapiClient): Promise<SecurityQuestions | null>;
+/** Set (replace) the answers. `answers` has exactly `required` distinct questions from the offered list. */
+export declare function setSecurityQuestions(client: FapiClient, answers: Array<{
+    question: string;
+    answer: string;
+}>): Promise<{
+    questions: SecurityQuestions | null;
+    response: FapiResponse<SecurityQuestionsWire>;
+}>;
+export declare function removeSecurityQuestions(client: FapiClient): Promise<FapiResponse<{
+    deleted: boolean;
+}>>;
+/**
+ * During a password reset, once the emailed code (and any second factor) is accepted: the
+ * questions the user must answer before choosing a password. Send the answers as
+ * `security_answers` with `set_new_password`.
+ */
+export declare function getResetSecurityQuestions(client: FapiClient, resetId: string): Promise<{
+    required: boolean;
+    questions: string[];
+} | null>;
+/**
+ * Smart card / PIV / CAC sign-in. The browser presents the card's certificate in the TLS
+ * handshake to a Frontend API host that requests client certificates; your proxy forwards the
+ * result and Atlas signs the user in. Resolves like a passkey sign-in: a completed attempt
+ * (`status: "complete"`, with the session set), or `needs_second_factor` when the account's
+ * MFA is still owed.
+ */
+export declare function signInWithSmartCard(client: FapiClient): Promise<FapiResponse<Record<string, unknown>>>;
+export {};