@atlasauth/js 0.33.1 → 0.34.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @atlasauth/js changelog
 
+## 0.34.0 — 2026-11-06
+
+- Breaking: `previewCrossDeviceLink` no longer returns a match code. Flow state carries `matchCode`, the tab stores its secret for the link page, and enrolment supports HOTP, YubiKey, Duo and passkey. A sign-up resend rotates the secret; `finished_elsewhere` ends the wait.
+
 ## 0.33.1 — 2026-11-05
 
 - A sign-up polls only while it waits for a proof, so a poll can no longer collect a ticket past the recovery codes.

package/dist/attempt.d.ts

@@ -114,6 +114,8 @@ export interface AttemptIdentityVerification {
 export interface AttemptView {
     /** A sign-in link proved the address of an account whose password was on hold. No session was made: the password signs in now. */
     password_hold_released?: boolean;
+    /** A repeat sign-up whose earlier attempt finished: no ticket comes here; the person signs in. */
+    finished_elsewhere?: boolean;
     /** The code just proved an address on an existing account: the password typed at sign-up was not saved. Only on that response; `FlowState.existingAccount` keeps it. */
     existing_account?: boolean;
     /**

package/dist/attempt.js.map

@@ -1 +1 @@
-{"version":3,"file":"attempt.js","sourceRoot":"","sources":["../src/attempt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AA0IH,4BA2DC;AAGD,gCAEC;AA6BD,kCAiBC;AAGD,8BAEC;AAGD,gCAEC;AAxHD,SAAgB,QAAQ,CAAC,OAAoB;IAC3C,QAAQ,OAAO,CAAC,MAAuB,EAAE,CAAC;QACxC,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,oBAAoB;YACvB,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,sEAAsE;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,wCAAwC;gBACxC,UAAU,EAAE,OAAO,CAAC,uBAAuB,IAAI,EAAE;aAClD,CAAC;QAEJ,KAAK,qBAAqB;YACxB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QAE3C;;;;;WAKG;QACH,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,0BAA0B;YAC7B,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAErC,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAEjC,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,yBAAyB;YAC5B,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAE/E,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,OAAO,CAAC,wBAAwB,IAAI,EAAE,EAAE,CAAC;QAE/F,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;QAEzE,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAElD;YACE;;;;eAIG;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,OAAoB;IAC7C,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC;AACzE,CAAC;AA6BD,SAAgB,WAAW,CAAC,IAAa;IACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,KAAK,EAAuB,EAAE;QACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAQ,KAAoB,CAAC,OAAO,KAAK,QAAQ,CAAC;IAC7E,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACzF,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;QACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACrE,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,GAAG,IAA+B,CAAC;QACzG,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8DAA8D;AAC9D,SAAgB,SAAS,CAAC,MAA6B,EAAE,KAAa;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,SAAgB,UAAU,CAAC,MAA6B;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"attempt.js","sourceRoot":"","sources":["../src/attempt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AA4IH,4BA2DC;AAGD,gCAEC;AA6BD,kCAiBC;AAGD,8BAEC;AAGD,gCAEC;AAxHD,SAAgB,QAAQ,CAAC,OAAoB;IAC3C,QAAQ,OAAO,CAAC,MAAuB,EAAE,CAAC;QACxC,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,oBAAoB;YACvB,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,sEAAsE;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,wCAAwC;gBACxC,UAAU,EAAE,OAAO,CAAC,uBAAuB,IAAI,EAAE;aAClD,CAAC;QAEJ,KAAK,qBAAqB;YACxB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QAE3C;;;;;WAKG;QACH,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,0BAA0B;YAC7B,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAErC,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAEjC,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,yBAAyB;YAC5B,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAE/E,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,OAAO,CAAC,wBAAwB,IAAI,EAAE,EAAE,CAAC;QAE/F,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;QAEzE,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAElD;YACE;;;;eAIG;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,OAAoB;IAC7C,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC;AACzE,CAAC;AA6BD,SAAgB,WAAW,CAAC,IAAa;IACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,KAAK,EAAuB,EAAE;QACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAQ,KAAoB,CAAC,OAAO,KAAK,QAAQ,CAAC;IAC7E,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACzF,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;QACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACrE,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,GAAG,IAA+B,CAAC;QACzG,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8DAA8D;AAC9D,SAAgB,SAAS,CAAC,MAA6B,EAAE,KAAa;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,SAAgB,UAAU,CAAC,MAA6B;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}

package/dist/email-link.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Emailed links, both ends. A mailed link completes nothing by being opened: the
+ * opener must prove a tie to the tab that started the flow, or anyone who starts
+ * a flow with someone else's address would collect the session when they click.
+ *
+ *   - Starting tab: the sign-up / sign-in response carries `poll_secret` and
+ *     `match_code`. {@link rememberLinkProof} stores the secret for this browser;
+ *     the flow shows the code (`FlowState.matchCode`) and polls as usual. An
+ *     answer that mailed nothing has a secret and no code: nothing is stored or shown.
+ *   - Link page: {@link createEmailLinkConfirmation} checks the link, tries the
+ *     stored secret (same browser AND same origin: one click, no typing), and
+ *     otherwise asks the person to type the code from the starting tab. Storage is
+ *     per origin, so a flow started on another origin always types. The server never sends the
+ *     code to this page. A success gives the opener nothing to sign in with: the
+ *     starting tab collects the ticket by polling.
+ */
+import type { FieldError } from './attempt';
+import type { FapiClient } from './fapi';
+/** Keep a mailed link's poll secret for this browser. Returns the code to show, or null when no link was mailed. */
+export declare function rememberLinkProof(attemptId: string, response: {
+    poll_secret?: unknown;
+    match_code?: unknown;
+}): string | null;
+/** The poll secret this browser holds for an attempt, if it started it. */
+export declare function readLinkSecret(attemptId: string): string | null;
+/** Forget an attempt's poll secret (it completed, or the link was confirmed). */
+export declare function forgetLinkSecret(attemptId: string): void;
+/** Which route a mailed link belongs to: attempt ids don't say. */
+export type EmailLinkFlow = 'sign_in' | 'sign_up' | 'password_reset';
+/** A mailed link, as its page reads it. */
+export interface EmailLink {
+    attempt: string;
+    token: string;
+    /** Default `sign_in`. */
+    flow?: EmailLinkFlow;
+}
+/**
+ * The mailed link in a URL (`?attempt=sia_…&token=…`), or null. The id's prefix
+ * keeps an app's own `?attempt=&token=` params from being taken for a link.
+ */
+export declare function emailLinkFromUrl(href?: string, flow?: EmailLinkFlow): EmailLink | null;
+/** Whether a mailed link is still live. Spends and completes nothing, so a mail scanner's visit is harmless. Null when refused. */
+export declare function previewCrossDeviceLink(client: FapiClient, link: EmailLink): Promise<{
+    requiresConfirmation: boolean;
+} | null>;
+/** Exactly one proof: the secret this browser stored, or the code the person typed. */
+export type EmailLinkProof = {
+    pollSecret: string;
+    matchCode?: never;
+} | {
+    matchCode: string;
+    pollSecret?: never;
+};
+/**
+ * Confirm a mailed link. The starting tab's `pollAttempt` then returns the ticket.
+ * A wrong code burns the link; a wrong secret does not, so the page can ask for the code.
+ */
+export declare function confirmCrossDeviceLink(client: FapiClient, link: EmailLink & EmailLinkProof): Promise<boolean>;
+export interface EmailLinkConfirmationState {
+    /** `checking`, then `confirmed`, `needs_code` (draw the typed input) or `invalid` (the single refusal, for every failure). */
+    status: 'checking' | 'needs_code' | 'confirmed' | 'invalid';
+    busy: boolean;
+    /** Why a typed code could not be checked (rate limit, network). The link is still live. */
+    errors: FieldError[];
+    /** `confirmed`, a sign-up on an address with an account: where to reset its password. */
+    resetUrl?: string;
+}
+export interface EmailLinkConfirmation {
+    readonly state: EmailLinkConfirmationState;
+    /** Called after every state change; returns the unsubscribe. */
+    subscribe(listener: (state: EmailLinkConfirmationState) => void): () => void;
+    /** Check the link and try this browser's secret. Runs once, however often it is called. */
+    start(): Promise<void>;
+    /** Confirm with the code typed at `needs_code`. */
+    submitCode(code: string): Promise<void>;
+}
+/** The link page's state and requests, independent of any framework. */
+export declare function createEmailLinkConfirmation(client: FapiClient, link: EmailLink): EmailLinkConfirmation;

package/dist/email-link.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rememberLinkProof = rememberLinkProof;
+exports.readLinkSecret = readLinkSecret;
+exports.forgetLinkSecret = forgetLinkSecret;
+exports.emailLinkFromUrl = emailLinkFromUrl;
+exports.previewCrossDeviceLink = previewCrossDeviceLink;
+exports.confirmCrossDeviceLink = confirmCrossDeviceLink;
+exports.createEmailLinkConfirmation = createEmailLinkConfirmation;
+const storageKey = (attemptId) => `atlas_link_${attemptId}`;
+function storage() {
+    try {
+        return globalThis.localStorage ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Keep a mailed link's poll secret for this browser. Returns the code to show, or null when no link was mailed. */
+function rememberLinkProof(attemptId, response) {
+    const code = typeof response.match_code === 'string' && response.match_code ? response.match_code : null;
+    if (code && typeof response.poll_secret === 'string' && response.poll_secret) {
+        try {
+            storage()?.setItem(storageKey(attemptId), response.poll_secret);
+        }
+        catch {
+            // Storage full or blocked: the link page falls back to the typed code.
+        }
+    }
+    return code;
+}
+/** The poll secret this browser holds for an attempt, if it started it. */
+function readLinkSecret(attemptId) {
+    try {
+        return storage()?.getItem(storageKey(attemptId)) ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Forget an attempt's poll secret (it completed, or the link was confirmed). */
+function forgetLinkSecret(attemptId) {
+    try {
+        storage()?.removeItem(storageKey(attemptId));
+    }
+    catch {
+        // Nothing to clean up where storage is blocked.
+    }
+}
+/**
+ * The mailed link in a URL (`?attempt=sia_…&token=…`), or null. The id's prefix
+ * keeps an app's own `?attempt=&token=` params from being taken for a link.
+ */
+function emailLinkFromUrl(href, flow = 'sign_in') {
+    const url = href ?? globalThis.location?.href;
+    if (!url)
+        return null;
+    try {
+        const params = new URL(url).searchParams;
+        const attempt = params.get('attempt');
+        const token = params.get('token');
+        return attempt?.startsWith('sia_') && token ? { attempt, token, flow } : null;
+    }
+    catch {
+        return null;
+    }
+}
+const verifyPath = (link) => `/v1/client/${link.flow === 'sign_up' ? 'sign_ups' : link.flow === 'password_reset' ? 'password_resets' : 'sign_ins'}/verify`;
+/** Whether a mailed link is still live. Spends and completes nothing, so a mail scanner's visit is harmless. Null when refused. */
+async function previewCrossDeviceLink(client, link) {
+    const response = await client.get(`${verifyPath(link)}?attempt=${encodeURIComponent(link.attempt)}&token=${encodeURIComponent(link.token)}`);
+    if (!response.ok || !response.data)
+        return null;
+    return { requiresConfirmation: response.data.requires_confirmation === true };
+}
+function postConfirmation(client, link) {
+    return client.post(`${verifyPath(link)}/confirm`, {
+        attempt: link.attempt,
+        token: link.token,
+        ...(link.pollSecret ? { poll_secret: link.pollSecret } : { match_code: link.matchCode }),
+    });
+}
+/**
+ * Confirm a mailed link. The starting tab's `pollAttempt` then returns the ticket.
+ * A wrong code burns the link; a wrong secret does not, so the page can ask for the code.
+ */
+async function confirmCrossDeviceLink(client, link) {
+    return (await postConfirmation(client, link)).ok;
+}
+/** The link page's state and requests, independent of any framework. */
+function createEmailLinkConfirmation(client, link) {
+    let state = { status: 'checking', busy: false, errors: [] };
+    let started = false;
+    const listeners = new Set();
+    const set = (patch) => {
+        state = { ...state, ...patch };
+        for (const listener of listeners)
+            listener(state);
+    };
+    const confirmed = (response) => {
+        forgetLinkSecret(link.attempt);
+        const resetUrl = response.data?.reset_url;
+        // Only a page a link can safely go to.
+        set({ status: 'confirmed', busy: false, errors: [], ...(typeof resetUrl === 'string' && /^https:\/\//i.test(resetUrl) ? { resetUrl } : {}) });
+    };
+    return {
+        get state() {
+            return state;
+        },
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+        async start() {
+            if (started)
+                return;
+            started = true;
+            const preview = await previewCrossDeviceLink(client, link);
+            if (!preview?.requiresConfirmation) {
+                set({ status: 'invalid' });
+                return;
+            }
+            const pollSecret = readLinkSecret(link.attempt);
+            if (pollSecret) {
+                const response = await postConfirmation(client, { ...link, pollSecret });
+                if (response.ok) {
+                    confirmed(response);
+                    return;
+                }
+            }
+            set({ status: 'needs_code' });
+        },
+        async submitCode(code) {
+            const matchCode = code.replace(/\s+/g, '');
+            // An empty submit must not reach the server: a wrong code burns the link.
+            if (state.status !== 'needs_code' || state.busy || !matchCode)
+                return;
+            set({ busy: true, errors: [] });
+            const response = await postConfirmation(client, { ...link, matchCode });
+            if (response.ok) {
+                confirmed(response);
+            }
+            else if (response.status === 0 || response.status === 429) {
+                // Never reached the check, so the link wasn't burned: let them try again.
+                set({ busy: false, errors: response.errors });
+            }
+            else {
+                set({ status: 'invalid', busy: false, errors: [] });
+            }
+        },
+    };
+}
+//# sourceMappingURL=email-link.js.map

package/dist/email-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-link.js","sourceRoot":"","sources":["../src/email-link.ts"],"names":[],"mappings":";;AA8BA,8CAUC;AAGD,wCAMC;AAGD,4CAMC;AAiBD,4CAWC;AAMD,wDAMC;AAiBD,wDAEC;AAuBD,kEAwDC;AAjLD,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,cAAc,SAAS,EAAE,CAAC;AAEpE,SAAS,OAAO;IACd,IAAI,CAAC;QACH,OAAQ,UAAyC,CAAC,YAAY,IAAI,IAAI,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oHAAoH;AACpH,SAAgB,iBAAiB,CAAC,SAAiB,EAAE,QAAyD;IAC5G,MAAM,IAAI,GAAG,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACzG,IAAI,IAAI,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,SAAgB,cAAc,CAAC,SAAiB;IAC9C,IAAI,CAAC;QACH,OAAO,OAAO,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAaD;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,IAAa,EAAE,OAAsB,SAAS;IAC7E,MAAM,GAAG,GAAG,IAAI,IAAK,UAA+C,CAAC,QAAQ,EAAE,IAAI,CAAC;IACpF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAe,EAAE,EAAE,CACrC,cAAc,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,SAAS,CAAC;AAEhI,mIAAmI;AAC5H,KAAK,UAAU,sBAAsB,CAAC,MAAkB,EAAE,IAAe;IAC9E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAC1G,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,EAAE,oBAAoB,EAAE,QAAQ,CAAC,IAAI,CAAC,qBAAqB,KAAK,IAAI,EAAE,CAAC;AAChF,CAAC;AAKD,SAAS,gBAAgB,CAAC,MAAkB,EAAE,IAAgC;IAC5E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE;QAChD,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;KACzF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,sBAAsB,CAAC,MAAkB,EAAE,IAAgC;IAC/F,OAAO,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAsBD,wEAAwE;AACxE,SAAgB,2BAA2B,CAAC,MAAkB,EAAE,IAAe;IAC7E,IAAI,KAAK,GAA+B,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;IACrE,MAAM,GAAG,GAAG,CAAC,KAA0C,EAAE,EAAE;QACzD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,QAA+C,EAAE,EAAE;QACpE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1C,uCAAuC;QACvC,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChJ,CAAC,CAAC;IACF,OAAO;QACL,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,QAAQ;YAChB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,KAAK;YACT,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC;gBACnC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;gBACzE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,SAAS,CAAC,QAAQ,CAAC,CAAC;oBACpB,OAAO;gBACT,CAAC;YACH,CAAC;YACD,GAAG,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3C,0EAA0E;YAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO;YACtE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACxE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,SAAS,CAAC,QAAQ,CAAC,CAAC;YACtB,CAAC;iBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5D,0EAA0E;gBAC1E,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/environment.d.ts

@@ -85,6 +85,8 @@ export interface AccountUx {
         hotp?: boolean;
         yubikey?: boolean;
         duo?: boolean;
+        /** A verified passkey as the second factor. */
+        passkey?: boolean;
         securityQuestions?: boolean;
         smartCard?: boolean;
     };

package/dist/environment.js

@@ -91,6 +91,7 @@ function accountUxFrom(body) {
                     ...(raw.mfa.hotp === true ? { hotp: true } : {}),
                     ...(raw.mfa.yubikey === true ? { yubikey: true } : {}),
                     ...(raw.mfa.duo === true ? { duo: true } : {}),
+                    ...(raw.mfa.passkey === true ? { passkey: true } : {}),
                     ...(raw.mfa.security_questions === true ? { securityQuestions: true } : {}),
                     ...(raw.mfa.smart_card === true ? { smartCard: true } : {}),
                 },

package/dist/environment.js.map

@@ -1 +1 @@
-{"version":3,"file":"environment.js","sourceRoot":"","sources":["../src/environment.ts"],"names":[],"mappings":";;;AAiDA,8CAWC;AAQD,kDAMC;AAmED,sCA2CC;AAmCD,sDAeC;AAGD,wDAOC;AA5ND;;;GAGG;AACU,QAAA,sBAAsB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAEH,iEAAiE;AACpD,QAAA,yBAAyB,GACpC,2FAA2F,CAAC;AAE9F,4DAA4D;AAC/C,QAAA,mBAAmB,GAAsB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,IAAa;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,IAAI,gBAAgB,IAAI,GAAG,IAAI,kBAAkB,IAAI,GAAG,CAAC,EAAE,CAAC;QACpG,OAAO,EAAE,GAAG,8BAAsB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;QACvC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,UAA6B,EAC7B,QAA0C;IAE1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS;QAAE,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;IAC5D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,2BAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAmDD;;;GAGG;AACU,QAAA,kBAAkB,GAAwB,MAAM,CAAC,MAAM,CAAC;IACnE,QAAQ,EAAE,IAAI;IACd,gBAAgB,EAAE,KAAK;IACvB,iBAAiB,EAAE,MAAM;IACzB,aAAa,EAAE,MAAM;IACrB,iBAAiB,EAAE,KAAK;IACxB,aAAa,EAAE,IAAI;CACpB,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9F,+EAA+E;AAC/E,SAAgB,aAAa,CAAC,IAAa;IACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,GAAG,0BAAkB,EAAE,CAAC;IAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,MAAM,CAAC,GAAG,CAAC,CAAU,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,OAAO;QACL,QAAQ,EAAE,CAAC;YACT,CAAC,CAAC;gBACE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC7B,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC9B,OAAO,EACL,CAAC,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,CAAC,OAAO,KAAK,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACjG,gBAAgB,EAAE,CAAC,CAAC,mBAAmB,KAAK,IAAI;aACjD;YACH,CAAC,CAAC,IAAI;QACR,gBAAgB,EAAE,GAAG,CAAC,mBAAmB,KAAK,IAAI;QAClD,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAChD,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,iBAAiB,EAAE,GAAG,CAAC,mBAAmB,KAAK,IAAI;QACnD,GAAG,CAAC,GAAG,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,CAAC,CAAC;gBACE,GAAG,EAAE;oBACH,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK;oBAC5B,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI;oBACzB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnD;aACX;YACH,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,CAAC,CAAC;gBACE,KAAK,EACH,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK,UAAU;oBAC7E,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK;oBAC3B,CAAC,CAAC,UAAU;aACjB;YACH,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAkCD,sFAAsF;AACtF,SAAgB,qBAAqB,CAAC,IAAa;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;YAC7C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACtE,CAAC,CAAC,EAAE;QACN,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;QACnE,aAAa,EAAE,iBAAiB,CAAC,IAAI,CAAC;QACtC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACnD,CAAC,CAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CACV;YAC9C,CAAC,CAAC,EAAE;QACN,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,sBAAsB,CAAC,MAAkB;IAC7D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAU,wBAAwB,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../src/environment.ts"],"names":[],"mappings":";;;AAiDA,8CAWC;AAQD,kDAMC;AAqED,sCA4CC;AAmCD,sDAeC;AAGD,wDAOC;AA/ND;;;GAGG;AACU,QAAA,sBAAsB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAEH,iEAAiE;AACpD,QAAA,yBAAyB,GACpC,2FAA2F,CAAC;AAE9F,4DAA4D;AAC/C,QAAA,mBAAmB,GAAsB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,IAAa;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,IAAI,gBAAgB,IAAI,GAAG,IAAI,kBAAkB,IAAI,GAAG,CAAC,EAAE,CAAC;QACpG,OAAO,EAAE,GAAG,8BAAsB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;QACvC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,UAA6B,EAC7B,QAA0C;IAE1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS;QAAE,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;IAC5D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,2BAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAqDD;;;GAGG;AACU,QAAA,kBAAkB,GAAwB,MAAM,CAAC,MAAM,CAAC;IACnE,QAAQ,EAAE,IAAI;IACd,gBAAgB,EAAE,KAAK;IACvB,iBAAiB,EAAE,MAAM;IACzB,aAAa,EAAE,MAAM;IACrB,iBAAiB,EAAE,KAAK;IACxB,aAAa,EAAE,IAAI;CACpB,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9F,+EAA+E;AAC/E,SAAgB,aAAa,CAAC,IAAa;IACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,GAAG,0BAAkB,EAAE,CAAC;IAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,MAAM,CAAC,GAAG,CAAC,CAAU,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,OAAO;QACL,QAAQ,EAAE,CAAC;YACT,CAAC,CAAC;gBACE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC7B,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC9B,OAAO,EACL,CAAC,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,CAAC,OAAO,KAAK,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACjG,gBAAgB,EAAE,CAAC,CAAC,mBAAmB,KAAK,IAAI;aACjD;YACH,CAAC,CAAC,IAAI;QACR,gBAAgB,EAAE,GAAG,CAAC,mBAAmB,KAAK,IAAI;QAClD,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAChD,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,iBAAiB,EAAE,GAAG,CAAC,mBAAmB,KAAK,IAAI;QACnD,GAAG,CAAC,GAAG,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,CAAC,CAAC;gBACE,GAAG,EAAE;oBACH,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK;oBAC5B,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI;oBACzB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnD;aACX;YACH,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,CAAC,CAAC;gBACE,KAAK,EACH,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK,UAAU;oBAC7E,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK;oBAC3B,CAAC,CAAC,UAAU;aACjB;YACH,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAkCD,sFAAsF;AACtF,SAAgB,qBAAqB,CAAC,IAAa;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;YAC7C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACtE,CAAC,CAAC,EAAE;QACN,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;QACnE,aAAa,EAAE,iBAAiB,CAAC,IAAI,CAAC;QACtC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACnD,CAAC,CAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CACV;YAC9C,CAAC,CAAC,EAAE;QACN,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,sBAAsB,CAAC,MAAkB;IAC7D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAU,wBAAwB,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/errors.d.ts

@@ -13,7 +13,7 @@
  * `error.<reason>` keys. Listed for docs and coverage checks; a reason missing
  * from this list still renders (as the server's `message`).
  */
-export declare const ERROR_REASONS: readonly ["form_password_incorrect", "form_code_incorrect", "form_code_already_used", "form_code_expired", "form_code_max_attempts", "form_link_invalid", "form_identifier_not_found", "form_identifier_exists", "form_password_pwned", "form_password_too_short", "form_password_too_long", "form_password_requires_uppercase", "form_password_requires_lowercase", "form_password_requires_number", "form_password_requires_symbol", "form_password_not_allowed", "form_password_contains_identifier", "form_password_same_as_current", "form_password_reused", "password_expired", "email_not_verified", "sign_in_token_invalid", "too_many_attempts", "too_many_requests", "captcha_required", "captcha_failed", "captcha_unavailable", "email_delivery_unavailable", "strategy_disabled", "sign_up_restricted", "sign_up_denied", "password_not_yet_usable", "account_deleted", "waitlisted", "identifier_not_allowed", "disposable_email_blocked", "sso_required", "sign_ins_disabled", "sign_ups_disabled", "high_risk_blocked", "sms_region_blocked", "github_team_required"];
+export declare const ERROR_REASONS: readonly ["form_password_incorrect", "form_code_incorrect", "form_code_already_used", "form_code_expired", "form_code_max_attempts", "form_link_invalid", "form_identifier_not_found", "form_identifier_exists", "form_password_pwned", "form_password_too_short", "form_password_too_long", "form_password_requires_uppercase", "form_password_requires_lowercase", "form_password_requires_number", "form_password_requires_symbol", "form_password_not_allowed", "form_password_contains_identifier", "form_password_same_as_current", "form_password_reused", "password_expired", "email_not_verified", "mfa_setup_unavailable", "sign_in_token_invalid", "too_many_attempts", "too_many_requests", "captcha_required", "captcha_failed", "captcha_unavailable", "email_delivery_unavailable", "strategy_disabled", "sign_up_restricted", "sign_up_denied", "password_not_yet_usable", "account_deleted", "waitlisted", "identifier_not_allowed", "disposable_email_blocked", "sso_required", "sign_ins_disabled", "sign_ups_disabled", "high_risk_blocked", "sms_region_blocked", "github_team_required"];
 /** A reason with a string in every shipped catalog. */
 export type ErrorReason = (typeof ERROR_REASONS)[number];
 /** The catalog key for a reason: `error.<reason>`. */

package/dist/errors.js

@@ -41,6 +41,7 @@ exports.ERROR_REASONS = Object.freeze([
     'form_password_reused',
     'password_expired',
     'email_not_verified',
+    'mfa_setup_unavailable',
     'sign_in_token_invalid',
     'too_many_attempts',
     'too_many_requests',

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAwDH,wCAEC;AAyED,sDAcC;AAOD,sCAIC;AA1JD;;;;GAIG;AACU,QAAA,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,yBAAyB;IACzB,qBAAqB;IACrB,wBAAwB;IACxB,mBAAmB;IACnB,wBAAwB;IACxB,mBAAmB;IACnB,2BAA2B;IAC3B,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,wBAAwB;IACxB,kCAAkC;IAClC,kCAAkC;IAClC,+BAA+B;IAC/B,+BAA+B;IAC/B,2BAA2B;IAC3B,mCAAmC;IACnC,+BAA+B;IAC/B,sBAAsB;IACtB,kBAAkB;IAClB,oBAAoB;IACpB,uBAAuB;IACvB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,qBAAqB;IACrB,4BAA4B;IAC5B,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;IAChB,yBAAyB;IACzB,iBAAiB;IACjB,YAAY;IACZ,wBAAwB;IACxB,0BAA0B;IAC1B,cAAc;IACd,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,sBAAsB;CACd,CAAC,CAAC;AAKZ,sDAAsD;AACtD,SAAgB,cAAc,CAAC,MAAc;IAC3C,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAqBD,yEAAyE;AACzE,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAEhE,4EAA4E;AAC5E,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAuB;IAC5D,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,QAAQ,GAAG,KAAK,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,MAAM,CAAC,OAAwC,EAAE,GAAW;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,KAAc,CAAC;IACnB,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,KAAK,GAAI,OAAoC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;YACxD,CAAC,CAAE,OAAmC,CAAC,GAAG,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,qBAAqB,CACnC,KAA4C,EAC5C,OAA6B,EAC7B,QAA8B;IAE9B,MAAM,GAAG,GAAc,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACrF,OAAO,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,aAAa,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAAkC;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,GAAG,GAAI,OAAgC,CAAC,MAAM,CAAC;IACrD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAyDH,wCAEC;AAyED,sDAcC;AAOD,sCAIC;AA3JD;;;;GAIG;AACU,QAAA,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,yBAAyB;IACzB,qBAAqB;IACrB,wBAAwB;IACxB,mBAAmB;IACnB,wBAAwB;IACxB,mBAAmB;IACnB,2BAA2B;IAC3B,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,wBAAwB;IACxB,kCAAkC;IAClC,kCAAkC;IAClC,+BAA+B;IAC/B,+BAA+B;IAC/B,2BAA2B;IAC3B,mCAAmC;IACnC,+BAA+B;IAC/B,sBAAsB;IACtB,kBAAkB;IAClB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,qBAAqB;IACrB,4BAA4B;IAC5B,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;IAChB,yBAAyB;IACzB,iBAAiB;IACjB,YAAY;IACZ,wBAAwB;IACxB,0BAA0B;IAC1B,cAAc;IACd,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,sBAAsB;CACd,CAAC,CAAC;AAKZ,sDAAsD;AACtD,SAAgB,cAAc,CAAC,MAAc;IAC3C,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAqBD,yEAAyE;AACzE,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAEhE,4EAA4E;AAC5E,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAuB;IAC5D,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,QAAQ,GAAG,KAAK,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,MAAM,CAAC,OAAwC,EAAE,GAAW;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,KAAc,CAAC;IACnB,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,KAAK,GAAI,OAAoC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;YACxD,CAAC,CAAE,OAAmC,CAAC,GAAG,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,qBAAqB,CACnC,KAA4C,EAC5C,OAA6B,EAC7B,QAA8B;IAE9B,MAAM,GAAG,GAAc,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACrF,OAAO,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,aAAa,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAAkC;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,GAAG,GAAI,OAAgC,CAAC,MAAM,CAAC;IACrD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC"}

package/dist/fapi.d.ts

@@ -253,7 +253,7 @@ export interface FlowState {
      * server returns a new attempt.
      */
     prepared?: 'email_code' | 'email_link' | null;
-    /** Cross-device link: the code to show on this device; the device that opens the link shows the same one. */
+    /** A mailed link: the code to show on this device, which a person opening the link on another device must type there. */
     matchCode?: string | null;
     /**
      * After a sign-in completed here: true when this browser now holds the
@@ -342,7 +342,9 @@ export declare function startSignUp(client: FapiClient, input: {
  * Resend a sign-up's emailed proof (a code, a link, or both — whatever the
  * instance sends): `POST /v1/client/sign_ups/:id/prepare_verification`. The
  * earlier code / link stops working. A refusal (a 429 with `retry_after`)
- * comes back as `errors` with the attempt kept.
+ * comes back as `errors` with the attempt kept. A new link rotates the poll
+ * secret (the old one stops working) and comes with a new code: both replace the
+ * old ones, here and in this browser's storage.
  */
 export declare function resendSignUpVerification(client: FapiClient, state: FlowState): Promise<FlowState>;
 /**
@@ -360,31 +362,11 @@ export declare function attemptPasswordHoldProof(client: FapiClient, state: Flow
  */
 export declare function awaitingSignUpLink(attempt: AttemptView | null | undefined, emailVerification: string | null | undefined): boolean;
 /** §5.3: ask the server to send a code or a magic link. */
-export declare function prepareFactor(client: FapiClient, state: FlowState, strategy: 'email_code' | 'email_link', opts?: {
+export declare function prepareFactor(client: FapiClient, state: FlowState, strategy: 'email_code' | 'email_link', 
+/** @deprecated Every mailed link now needs a tie to this tab; this changes nothing. */
+_opts?: {
     crossDevice?: boolean;
 }): Promise<FlowState>;
-/** What the page the cross-device link opens needs: whether to ask for confirmation, and the code to compare. */
-export interface CrossDeviceLinkPreview {
-    requiresConfirmation: boolean;
-    matchCode: string | null;
-}
-/**
- * Cross-device magic link, second device: read the code from the opened link (`?attempt=&token=&cross_device=1`)
- * so the page can show it next to the prompt "does this match the code on your other device?". Completes nothing.
- */
-export declare function previewCrossDeviceLink(client: FapiClient, link: {
-    attempt: string;
-    token: string;
-}): Promise<CrossDeviceLinkPreview | null>;
-/**
- * Cross-device magic link, second device: confirm with the code both devices show. The first device's
- * `pollAttempt` then returns the ticket. One use; a wrong code invalidates the link.
- */
-export declare function confirmCrossDeviceLink(client: FapiClient, link: {
-    attempt: string;
-    token: string;
-    matchCode: string;
-}): Promise<boolean>;
 /**
  * §5.3 polling. Returns the updated flow, and a ticket once the link has been
  * opened somewhere.
@@ -407,7 +389,8 @@ export declare function acknowledgeExistingAccount(state: FlowState): FlowState;
 /**
  * A sign-up's emailed link proved the address and made no session, so this tab
  * can only go and sign in. The tab's poll secret proves nothing about the mailbox:
- * say the same thing whichever account the address belongs to.
+ * say the same thing whichever account the address belongs to. So too a repeat
+ * sign-up whose earlier attempt finished (`finished_elsewhere`).
  */
 export declare function signUpProvedByLink(attempt: AttemptView | null | undefined): boolean;
 /**

package/dist/fapi.js

@@ -17,8 +17,6 @@ exports.preparePasswordHoldProof = preparePasswordHoldProof;
 exports.attemptPasswordHoldProof = attemptPasswordHoldProof;
 exports.awaitingSignUpLink = awaitingSignUpLink;
 exports.prepareFactor = prepareFactor;
-exports.previewCrossDeviceLink = previewCrossDeviceLink;
-exports.confirmCrossDeviceLink = confirmCrossDeviceLink;
 exports.pollAttempt = pollAttempt;
 exports.shouldKeepPolling = shouldKeepPolling;
 exports.pendingExistingAccountNotice = pendingExistingAccountNotice;
@@ -31,6 +29,7 @@ const policies_1 = require("./policies");
 const attempt_1 = require("./attempt");
 const sdk_advisory_1 = require("./sdk-advisory");
 const dev_browser_1 = require("./dev-browser");
+const email_link_1 = require("./email-link");
 const mfa_enrollment_1 = require("./mfa-enrollment");
 const referral_1 = require("./referral");
 const telemetry_1 = require("./telemetry");
@@ -432,6 +431,19 @@ function requestForStep(attempt, values) {
                     body: { factor_id: values.factorId ?? '', code: values.code ?? '' },
                 };
             }
+            if (values.enrollStrategy === 'hotp' || values.enrollStrategy === 'duo' || values.enrollStrategy === 'yubikey' || values.enrollStrategy === 'passkey') {
+                const strategy = values.enrollStrategy;
+                return {
+                    path: `/v1/client/sign_ins/${id}/attempt_mfa_enrollment`,
+                    body: strategy === 'hotp'
+                        ? { strategy, factor_id: values.factorId ?? '', code: values.code ?? '' }
+                        : strategy === 'duo'
+                            ? { strategy, factor_id: values.factorId ?? '' }
+                            : strategy === 'yubikey'
+                                ? { strategy, otp: values.otp ?? '' }
+                                : { strategy, challenge: values.challenge ?? '', attestation_object: values.attestation_object ?? '', client_data_json: values.client_data_json ?? '' },
+                };
+            }
             return {
                 path: `/v1/client/sign_ins/${id}/attempt_mfa_enrollment`,
                 body: {
@@ -568,6 +580,8 @@ async function advance(client, state, values) {
     const { backup_codes: backupCodes, ...view } = response.data;
     const recoveryCodes = (0, mfa_enrollment_1.recoveryCodesFrom)(backupCodes);
     const sameAttempt = view.id === state.attempt?.id && view.status === state.attempt?.status;
+    if (state.attempt?.id && (0, attempt_1.isTerminal)(view))
+        (0, email_link_1.forgetLinkSecret)(state.attempt.id);
     return {
         attempt: view,
         errors: [],
@@ -576,6 +590,7 @@ async function advance(client, state, values) {
         // A completion response carries the ticket to exchange for cookies.
         ticket: view.ticket ?? null,
         prepared: sameAttempt ? (state.prepared ?? null) : null,
+        ...(sameAttempt && state.matchCode ? { matchCode: state.matchCode } : {}),
         ...(view.existing_account || state.existingAccount ? { existingAccount: true } : {}),
         ...(recoveryCodes ? { recoveryCodes } : {}),
         ...(view.policy_acceptance_token || view.required_action_token
@@ -610,6 +625,7 @@ async function startSignUp(client, input) {
     if (!response.ok || !response.data) {
         return { ...exports.initialFlow, busy: false, errors: response.errors };
     }
+    const matchCode = (0, email_link_1.rememberLinkProof)(response.data.id ?? '', response.data);
     return {
         attempt: response.data,
         errors: [],
@@ -618,6 +634,7 @@ async function startSignUp(client, input) {
         // tab collects the session by polling with the secret the create returned.
         pollSecret: response.data.poll_secret ?? exports.initialFlow.pollSecret,
         ticket: response.data.ticket ?? null,
+        ...(matchCode ? { matchCode } : {}),
         ...(response.data.policy_acceptance_token || response.data.required_action_token ? { policyToken: response.data.policy_acceptance_token ?? response.data.required_action_token } : {}),
     };
 }
@@ -625,14 +642,26 @@ async function startSignUp(client, input) {
  * Resend a sign-up's emailed proof (a code, a link, or both — whatever the
  * instance sends): `POST /v1/client/sign_ups/:id/prepare_verification`. The
  * earlier code / link stops working. A refusal (a 429 with `retry_after`)
- * comes back as `errors` with the attempt kept.
+ * comes back as `errors` with the attempt kept. A new link rotates the poll
+ * secret (the old one stops working) and comes with a new code: both replace the
+ * old ones, here and in this browser's storage.
  */
 async function resendSignUpVerification(client, state) {
     const id = state.attempt?.id;
     if (!id)
         return state;
     const response = await client.post(`/v1/client/sign_ups/${id}/prepare_verification`, {});
-    return response.ok ? { ...state, busy: false, errors: [] } : { ...state, busy: false, errors: response.errors };
+    if (!response.ok)
+        return { ...state, busy: false, errors: response.errors };
+    const pollSecret = response.data?.poll_secret;
+    // No new secret: only a code went out, and the tab's wait is unchanged.
+    if (!pollSecret)
+        return { ...state, busy: false, errors: [] };
+    const matchCode = (0, email_link_1.rememberLinkProof)(id, response.data ?? {});
+    // Rotated with nothing mailed: the stored secret is dead, and there's no code to show.
+    if (!matchCode)
+        (0, email_link_1.forgetLinkSecret)(id);
+    return { ...state, busy: false, errors: [], pollSecret, matchCode };
 }
 /**
  * Email the proof that lifts a password hold (`FlowState.passwordHold`), through
@@ -646,12 +675,14 @@ async function preparePasswordHoldProof(client, state, via = 'email_code') {
     const response = await client.post(`/v1/client/sign_ups/${hold.attemptId}/prepare_verification`, {});
     if (!response.ok)
         return { ...state, busy: false, errors: response.errors };
+    const matchCode = (0, email_link_1.rememberLinkProof)(hold.attemptId, response.data ?? {});
     return {
         ...state,
         busy: false,
         errors: [],
         pollSecret: null,
         prepared: via,
+        ...(matchCode ? { matchCode } : {}),
         passwordHold: { ...hold, email: response.data?.identifier ?? null },
     };
 }
@@ -677,11 +708,13 @@ function awaitingSignUpLink(attempt, emailVerification) {
         emailVerification === 'link');
 }
 /** §5.3: ask the server to send a code or a magic link. */
-async function prepareFactor(client, state, strategy, opts = {}) {
+async function prepareFactor(client, state, strategy, 
+/** @deprecated Every mailed link now needs a tie to this tab; this changes nothing. */
+_opts = {}) {
     const id = state.attempt?.id;
     if (!id)
         return state;
-    const response = await client.post(`/v1/client/sign_ins/${id}/prepare_first_factor`, { strategy, ...(opts.crossDevice && strategy === 'email_link' ? { cross_device: true } : {}) });
+    const response = await client.post(`/v1/client/sign_ins/${id}/prepare_first_factor`, { strategy });
     if (!response.ok)
         return { ...state, busy: false, errors: response.errors };
     return {
@@ -693,27 +726,9 @@ async function prepareFactor(client, state, strategy, opts = {}) {
         // there is nothing to poll for.
         pollSecret: strategy === 'email_link' ? (response.data?.poll_secret ?? null) : null,
         prepared: strategy,
-        matchCode: response.data?.match_code ?? null,
+        matchCode: strategy === 'email_link' ? (0, email_link_1.rememberLinkProof)(id, response.data ?? {}) : null,
     };
 }
-/**
- * Cross-device magic link, second device: read the code from the opened link (`?attempt=&token=&cross_device=1`)
- * so the page can show it next to the prompt "does this match the code on your other device?". Completes nothing.
- */
-async function previewCrossDeviceLink(client, link) {
-    const response = await client.get(`/v1/client/sign_ins/verify?attempt=${encodeURIComponent(link.attempt)}&token=${encodeURIComponent(link.token)}&cross_device=1`);
-    if (!response.ok || !response.data)
-        return null;
-    return { requiresConfirmation: response.data.requires_confirmation === true, matchCode: response.data.match_code ?? null };
-}
-/**
- * Cross-device magic link, second device: confirm with the code both devices show. The first device's
- * `pollAttempt` then returns the ticket. One use; a wrong code invalidates the link.
- */
-async function confirmCrossDeviceLink(client, link) {
-    const response = await client.post('/v1/client/sign_ins/verify/confirm', { attempt: link.attempt, token: link.token, match_code: link.matchCode });
-    return response.ok;
-}
 /**
  * §5.3 polling. Returns the updated flow, and a ticket once the link has been
  * opened somewhere.
@@ -731,15 +746,18 @@ async function pollAttempt(client, state) {
     // no session: the password signs in now, so stop polling and ask for it.
     if (response.data.password_hold_released) {
         const email = response.data.identifier ?? null;
+        (0, email_link_1.forgetLinkSecret)(id);
         return {
-            state: { ...state, attempt: response.data, pollSecret: null, prepared: null, passwordHold: { attemptId: id, email, released: true } },
+            state: { ...state, attempt: response.data, pollSecret: null, prepared: null, matchCode: null, passwordHold: { attemptId: id, email, released: true } },
             ticket: null,
         };
     }
-    return {
-        state: { ...state, attempt: response.data },
-        ticket: response.data.ticket ?? null,
-    };
+    const next = { ...state, attempt: response.data };
+    if (shouldKeepPolling(next))
+        return { state: next, ticket: response.data.ticket ?? null };
+    // The wait is over, one way or another: the code and the stored secret are done with.
+    (0, email_link_1.forgetLinkSecret)(id);
+    return { state: { ...next, matchCode: null }, ticket: response.data.ticket ?? null };
 }
 /** Whether polling should continue, so a tab does not poll a dead attempt forever. */
 function shouldKeepPolling(state) {
@@ -748,6 +766,9 @@ function shouldKeepPolling(state) {
     // A sign-up polls for its link only. Past that this tab drives every step (the passkey,
     // MFA set-up, policies), and a poll that collected a ticket would skip the recovery codes.
     const a = state.attempt;
+    // An earlier sign-up for this address finished: no ticket will ever come here.
+    if (a.finished_elsewhere)
+        return false;
     return !(a.object === 'sign_up_attempt' && a.status !== 'needs_email_verification');
 }
 /**
@@ -766,13 +787,14 @@ function acknowledgeExistingAccount(state) {
 /**
  * A sign-up's emailed link proved the address and made no session, so this tab
  * can only go and sign in. The tab's poll secret proves nothing about the mailbox:
- * say the same thing whichever account the address belongs to.
+ * say the same thing whichever account the address belongs to. So too a repeat
+ * sign-up whose earlier attempt finished (`finished_elsewhere`).
  */
 function signUpProvedByLink(attempt) {
     return (!!attempt &&
         attempt.object === 'sign_up_attempt' &&
-        attempt.status === 'needs_first_factor' &&
-        !(attempt.supported_first_factors ?? []).includes('passkey'));
+        (attempt.finished_elsewhere === true ||
+            (attempt.status === 'needs_first_factor' && !(attempt.supported_first_factors ?? []).includes('passkey'))));
 }
 /**
  * Where `signUpProvedByLink`'s "Sign in" goes: `url` when the app has its own page,