@atlasauth/js 0.37.0 → 0.38.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 
 
+## 0.38.0 — 2026-11-12
+
+- `createSignInFlow` / `createSignUpFlow` (headless typed steps with captcha wired to the right flow), `requireStepUp` / `retryWithStepUp`, `reasonMessage`, `createDpopClient`, `hasToken`, `createDeveloperPortal`, `revokeAllAgentAccess`.
+
 ## 0.37.0 — 2026-11-11
 
 - New app-approval sign-in: `prepareAppApproval`, `prepareAppApprovalSecondFactor`, `pollAppApprovalSecondFactor`, and for the approving app `getAppApproval`, `approveSignIn`, `denySignIn`.

package/dist/attempt.d.ts

@@ -130,6 +130,8 @@ export interface AttemptView {
     /** The resource type the server stamps on every attempt view. */
     object?: 'sign_in_attempt' | 'sign_up_attempt';
     status: string;
+    /** On the `needs_captcha` marker: why the token you sent was refused (`captcha_failed`, `captcha_wrong_flow`); absent when none was sent. */
+    reason?: string;
     /** The identifier the attempt was started with; `null` before one is collected. */
     identifier?: string | null;
     supported_first_factors?: string[];

package/dist/attempt.js.map

@@ -1 +1 @@
-{"version":3,"file":"attempt.js","sourceRoot":"","sources":["../src/attempt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AA4IH,4BA2DC;AAGD,gCAEC;AA6BD,kCAiBC;AAGD,8BAEC;AAGD,gCAEC;AAxHD,SAAgB,QAAQ,CAAC,OAAoB;IAC3C,QAAQ,OAAO,CAAC,MAAuB,EAAE,CAAC;QACxC,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,oBAAoB;YACvB,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,sEAAsE;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,wCAAwC;gBACxC,UAAU,EAAE,OAAO,CAAC,uBAAuB,IAAI,EAAE;aAClD,CAAC;QAEJ,KAAK,qBAAqB;YACxB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QAE3C;;;;;WAKG;QACH,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,0BAA0B;YAC7B,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAErC,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAEjC,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,yBAAyB;YAC5B,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAE/E,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,OAAO,CAAC,wBAAwB,IAAI,EAAE,EAAE,CAAC;QAE/F,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;QAEzE,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAElD;YACE;;;;eAIG;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,OAAoB;IAC7C,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC;AACzE,CAAC;AA6BD,SAAgB,WAAW,CAAC,IAAa;IACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,KAAK,EAAuB,EAAE;QACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAQ,KAAoB,CAAC,OAAO,KAAK,QAAQ,CAAC;IAC7E,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACzF,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;QACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACrE,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,GAAG,IAA+B,CAAC;QACzG,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8DAA8D;AAC9D,SAAgB,SAAS,CAAC,MAA6B,EAAE,KAAa;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,SAAgB,UAAU,CAAC,MAA6B;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"attempt.js","sourceRoot":"","sources":["../src/attempt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AA8IH,4BA2DC;AAGD,gCAEC;AA6BD,kCAiBC;AAGD,8BAEC;AAGD,gCAEC;AAxHD,SAAgB,QAAQ,CAAC,OAAoB;IAC3C,QAAQ,OAAO,CAAC,MAAuB,EAAE,CAAC;QACxC,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,oBAAoB;YACvB,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,sEAAsE;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,wCAAwC;gBACxC,UAAU,EAAE,OAAO,CAAC,uBAAuB,IAAI,EAAE;aAClD,CAAC;QAEJ,KAAK,qBAAqB;YACxB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QAE3C;;;;;WAKG;QACH,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,0BAA0B;YAC7B,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAErC,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAEjC,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,yBAAyB;YAC5B,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAE/E,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,OAAO,CAAC,wBAAwB,IAAI,EAAE,EAAE,CAAC;QAE/F,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;QAEzE,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAElD;YACE;;;;eAIG;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,OAAoB;IAC7C,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC;AACzE,CAAC;AA6BD,SAAgB,WAAW,CAAC,IAAa;IACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,KAAK,EAAuB,EAAE;QACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAQ,KAAoB,CAAC,OAAO,KAAK,QAAQ,CAAC;IAC7E,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACzF,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;QACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACrE,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,GAAG,IAA+B,CAAC;QACzG,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8DAA8D;AAC9D,SAAgB,SAAS,CAAC,MAA6B,EAAE,KAAa;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,SAAgB,UAAU,CAAC,MAA6B;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}

package/dist/authorized-apps.d.ts

@@ -40,3 +40,11 @@ export declare function disconnectAuthorizedApp(client: FapiClient, consentId: s
 export declare function revokeAppGrant(client: FapiClient, grantId: string): Promise<{
     tokensEnded: number;
 }>;
+/**
+ * Revoke all agent access in one step: disconnects every app connected through dynamic registration (MCP clients and
+ * AI assistants) and switches off every agent registered to the user. Needs a signed-in session.
+ */
+export declare function revokeAllAgentAccess(client: FapiClient): Promise<{
+    appsDisconnected: number;
+    agentsDisabled: number;
+}>;

package/dist/authorized-apps.js

@@ -4,6 +4,7 @@ exports.AuthorizedAppsError = void 0;
 exports.listAuthorizedApps = listAuthorizedApps;
 exports.disconnectAuthorizedApp = disconnectAuthorizedApp;
 exports.revokeAppGrant = revokeAppGrant;
+exports.revokeAllAgentAccess = revokeAllAgentAccess;
 /** A refused request; `code` is the server's stable error code. */
 class AuthorizedAppsError extends Error {
     status;
@@ -38,4 +39,12 @@ async function revokeAppGrant(client, grantId) {
     const body = await call(client, `/v1/client/me/managed_grants/${encodeURIComponent(grantId)}`, { method: 'DELETE' });
     return { tokensEnded: body.tokens_ended ?? 0 };
 }
+/**
+ * Revoke all agent access in one step: disconnects every app connected through dynamic registration (MCP clients and
+ * AI assistants) and switches off every agent registered to the user. Needs a signed-in session.
+ */
+async function revokeAllAgentAccess(client) {
+    const body = await call(client, '/v1/client/me/agent_access/revoke_all', { method: 'POST' });
+    return { appsDisconnected: body.apps_disconnected ?? 0, agentsDisabled: body.agents_disabled ?? 0 };
+}
 //# sourceMappingURL=authorized-apps.js.map

package/dist/authorized-apps.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorized-apps.js","sourceRoot":"","sources":["../src/authorized-apps.ts"],"names":[],"mappings":";;;AAsDA,gDAGC;AAGD,0DAEC;AAGD,wCAGC;AApCD,mEAAmE;AACnE,MAAa,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AATD,kDASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,kBAAkB,CAAC,MAAkB;IACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAA6B,MAAM,EAAE,4BAA4B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7G,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,uBAAuB,CAAC,MAAkB,EAAE,SAAiB;IACjF,MAAM,IAAI,CAAC,MAAM,EAAE,8BAA8B,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED,8GAA8G;AACvG,KAAK,UAAU,cAAc,CAAC,MAAkB,EAAE,OAAe;IACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAA4B,MAAM,EAAE,gCAAgC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChJ,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;AACjD,CAAC"}
+{"version":3,"file":"authorized-apps.js","sourceRoot":"","sources":["../src/authorized-apps.ts"],"names":[],"mappings":";;;AAsDA,gDAGC;AAGD,0DAEC;AAGD,wCAGC;AAMD,oDAGC;AA7CD,mEAAmE;AACnE,MAAa,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AATD,kDASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,kBAAkB,CAAC,MAAkB;IACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAA6B,MAAM,EAAE,4BAA4B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7G,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,uBAAuB,CAAC,MAAkB,EAAE,SAAiB;IACjF,MAAM,IAAI,CAAC,MAAM,EAAE,8BAA8B,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED,8GAA8G;AACvG,KAAK,UAAU,cAAc,CAAC,MAAkB,EAAE,OAAe;IACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAA4B,MAAM,EAAE,gCAAgC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChJ,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,oBAAoB,CAAC,MAAkB;IAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAA2D,MAAM,EAAE,uCAAuC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvJ,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC;AACtG,CAAC"}

package/dist/developer-portal.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Headless developer-portal kit: build your own "register an app" pages on top of dynamic client registration.
+ * The instance gives a developer an initial access token (`oauth_initial_access_token`, bound to them); registering
+ * returns the app plus a registration access token that manages that one app afterwards. Call these from your
+ * server (or a trusted back end) so neither token reaches a browser you do not control.
+ */
+export interface DeveloperPortalOptions {
+    /** The instance's issuer (its frontend API host), e.g. `https://auth.example.com`. */
+    issuer: string;
+    fetchImpl?: typeof fetch;
+}
+/** One registered app, as the registration endpoint reports it. */
+export interface DeveloperApp {
+    /** The Atlas id (oac_...) the Backend API takes. Present on the registration response. */
+    id?: string;
+    client_id: string;
+    client_name?: string;
+    client_secret?: string;
+    client_secret_expires_at?: number;
+    redirect_uris: string[];
+    scope?: string;
+    grant_types?: string[];
+    token_endpoint_auth_method?: string;
+    status?: string;
+    /** Returned once, on registration: keep it to manage the app later. */
+    registration_access_token?: string;
+    registration_client_uri?: string;
+    [key: string]: unknown;
+}
+export interface DeveloperAppUsage {
+    object: 'oauth_client_usage';
+    client_id: string;
+    rate_limit_per_minute: number | null;
+    totals: {
+        calls: number;
+        token_issuances: number;
+        errors: number;
+        rate_limited: number;
+    };
+    data: Array<{
+        day: string;
+        calls: number;
+        token_issuances: number;
+        active_users: number;
+        errors: number;
+        rate_limited: number;
+    }>;
+}
+/** A refused request; `error` is the OAuth error code (`invalid_redirect_uri`, `invalid_client_metadata`, `invalid_token`...). */
+export declare class DeveloperPortalError extends Error {
+    readonly status: number;
+    readonly error: string;
+    constructor(status: number, error: string, message: string);
+}
+export interface DeveloperPortal {
+    /** Register an app with the developer's initial access token. Returns the app, its secret and registration_access_token (shown once). */
+    registerApp(developerToken: string, app: {
+        client_name: string;
+        redirect_uris: string[];
+        scope?: string;
+        grant_types?: string[];
+        token_endpoint_auth_method?: string;
+        logo_uri?: string;
+    }): Promise<DeveloperApp>;
+    getApp(clientId: string, registrationToken: string): Promise<DeveloperApp>;
+    /** Replace the app's redirect URIs (the instance's rules apply: https, and https only for some developers). */
+    setRedirectUris(clientId: string, registrationToken: string, redirectUris: string[]): Promise<DeveloperApp>;
+    /** Ask for scopes. The standard scopes are applied at once; others are refused until the instance allows them for the app. */
+    requestScopes(clientId: string, registrationToken: string, scopes: string[]): Promise<DeveloperApp>;
+    /** Issue a new secret; the previous one keeps working for a short overlap. */
+    rotateSecret(clientId: string, registrationToken: string): Promise<{
+        client_id: string;
+        client_secret: string;
+        client_secret_expires_at: number;
+    }>;
+    deleteApp(clientId: string, registrationToken: string): Promise<void>;
+    /** Per-day token endpoint usage for the app (default last 30 days, at most 90). */
+    getUsage(clientId: string, registrationToken: string, days?: number): Promise<DeveloperAppUsage>;
+}
+export declare function createDeveloperPortal(options: DeveloperPortalOptions): DeveloperPortal;

package/dist/developer-portal.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * Headless developer-portal kit: build your own "register an app" pages on top of dynamic client registration.
+ * The instance gives a developer an initial access token (`oauth_initial_access_token`, bound to them); registering
+ * returns the app plus a registration access token that manages that one app afterwards. Call these from your
+ * server (or a trusted back end) so neither token reaches a browser you do not control.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeveloperPortalError = void 0;
+exports.createDeveloperPortal = createDeveloperPortal;
+/** A refused request; `error` is the OAuth error code (`invalid_redirect_uri`, `invalid_client_metadata`, `invalid_token`...). */
+class DeveloperPortalError extends Error {
+    status;
+    error;
+    constructor(status, error, message) {
+        super(message);
+        this.name = 'DeveloperPortalError';
+        this.status = status;
+        this.error = error;
+    }
+}
+exports.DeveloperPortalError = DeveloperPortalError;
+function createDeveloperPortal(options) {
+    const base = options.issuer.replace(/\/+$/, '');
+    const doFetch = options.fetchImpl ?? ((...a) => fetch(...a));
+    async function call(path, method, token, body) {
+        const res = await doFetch(`${base}${path}`, {
+            method,
+            headers: { authorization: `Bearer ${token}`, ...(body !== undefined ? { 'content-type': 'application/json' } : {}) },
+            body: body !== undefined ? JSON.stringify(body) : undefined,
+        });
+        if (res.status === 204)
+            return undefined;
+        const data = (await res.json().catch(() => ({})));
+        if (!res.ok)
+            throw new DeveloperPortalError(res.status, String(data.error ?? 'request_failed'), String(data.error_description ?? 'The request failed.'));
+        return data;
+    }
+    const own = (clientId) => `/oauth2/register/${encodeURIComponent(clientId)}`;
+    return {
+        registerApp: (developerToken, app) => call('/oauth2/register', 'POST', developerToken, app),
+        getApp: (clientId, token) => call(own(clientId), 'GET', token),
+        setRedirectUris: (clientId, token, redirect_uris) => call(own(clientId), 'PUT', token, { redirect_uris }),
+        requestScopes: (clientId, token, scopes) => call(own(clientId), 'PUT', token, { scope: scopes.join(' ') }),
+        rotateSecret: (clientId, token) => call(`${own(clientId)}/secret`, 'POST', token),
+        deleteApp: (clientId, token) => call(own(clientId), 'DELETE', token),
+        getUsage: (clientId, token, days) => call(`${own(clientId)}/usage${days ? `?days=${days}` : ''}`, 'GET', token),
+    };
+}
+//# sourceMappingURL=developer-portal.js.map

package/dist/developer-portal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-portal.js","sourceRoot":"","sources":["../src/developer-portal.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA8DH,sDA0BC;AArDD,kIAAkI;AAClI,MAAa,oBAAqB,SAAQ,KAAK;IACpC,MAAM,CAAS;IACf,KAAK,CAAS;IACvB,YAAY,MAAc,EAAE,KAAa,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AATD,oDASC;AAiBD,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAA2B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEvF,KAAK,UAAU,IAAI,CAAI,IAAY,EAAE,MAAc,EAAE,KAAa,EAAE,IAAc;QAChF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YAC1C,MAAM;YACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACpH,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,qBAAqB,CAAC,CAAC,CAAC;QACzJ,OAAO,IAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAErF,OAAO;QACL,WAAW,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC;QAC3F,MAAM,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC;QAC9D,eAAe,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,CAAC;QACzG,aAAa,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1G,YAAY,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC;QACjF,SAAS,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC;QACpE,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC;KAChH,CAAC;AACJ,CAAC"}

package/dist/dpop.d.ts

@@ -0,0 +1,30 @@
+/**
+ * DPoP (RFC 9449) for browsers and agents: a non-extractable ES256 key the page
+ * generates once, a proof for every request, and a fetch wrapper that attaches
+ * both and answers a server's `DPoP-Nonce` demand. Tokens issued against the
+ * proof's key carry `cnf.jkt`, so a copied token is useless without this key.
+ */
+export interface DpopKeyStore {
+    get(): Promise<CryptoKeyPair | undefined>;
+    set(pair: CryptoKeyPair): Promise<void>;
+}
+export interface DpopClientOptions {
+    /** Keep the key pair across reloads (a CryptoKey can live in IndexedDB). Default: memory only. */
+    store?: DpopKeyStore;
+    /** The fetch to wrap. Default: global fetch. */
+    fetch?: typeof fetch;
+}
+export interface DpopClient {
+    /** RFC 7638 thumbprint of the public key: the value a bound token carries as `cnf.jkt`. */
+    thumbprint(): Promise<string>;
+    /** A proof JWT for one request. Pass `accessToken` at resource servers (adds `ath`), none at the token endpoint. */
+    proof(method: string, url: string, opts?: {
+        accessToken?: string;
+        nonce?: string;
+    }): Promise<string>;
+    /** `fetch` that sends `Authorization: DPoP <token>` plus a fresh proof, retrying once on `use_dpop_nonce`. */
+    fetch(input: string | URL, init?: RequestInit & {
+        accessToken?: string;
+    }): Promise<Response>;
+}
+export declare function createDpopClient(options?: DpopClientOptions): DpopClient;

package/dist/dpop.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDpopClient = createDpopClient;
+const passkey_1 = require("./passkey");
+const enc = (o) => (0, passkey_1.bufferToBase64Url)(new TextEncoder().encode(JSON.stringify(o)));
+const ALG = { name: 'ECDSA', namedCurve: 'P-256' };
+// htu is the request URL without query or fragment (RFC 9449 §4.2).
+const htuOf = (url) => {
+    const u = new URL(String(url));
+    return `${u.origin}${u.pathname}`;
+};
+function createDpopClient(options = {}) {
+    const doFetch = options.fetch ?? ((...a) => fetch(...a));
+    let pair;
+    const nonces = new Map();
+    const keys = () => (pair ??= (async () => {
+        const saved = await options.store?.get();
+        if (saved)
+            return saved;
+        // extractable:false keeps the private key unreadable by script; the public half stays exportable.
+        const fresh = await crypto.subtle.generateKey(ALG, false, ['sign', 'verify']);
+        await options.store?.set(fresh);
+        return fresh;
+    })());
+    const publicJwk = async () => {
+        const { kty, crv, x, y } = (await crypto.subtle.exportKey('jwk', (await keys()).publicKey));
+        return { kty, crv, x, y };
+    };
+    const thumbprint = async () => {
+        // RFC 7638 canonical member order for EC keys.
+        const j = await publicJwk();
+        const canon = JSON.stringify({ crv: j.crv, kty: j.kty, x: j.x, y: j.y });
+        return (0, passkey_1.bufferToBase64Url)(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(canon)));
+    };
+    const proof = async (method, url, opts = {}) => {
+        const payload = {
+            jti: crypto.randomUUID(),
+            htm: method.toUpperCase(),
+            htu: htuOf(url),
+            iat: Math.floor(Date.now() / 1000),
+        };
+        if (opts.nonce)
+            payload.nonce = opts.nonce;
+        if (opts.accessToken) {
+            payload.ath = (0, passkey_1.bufferToBase64Url)(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(opts.accessToken)));
+        }
+        const signingInput = `${enc({ typ: 'dpop+jwt', alg: 'ES256', jwk: await publicJwk() })}.${enc(payload)}`;
+        const sig = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, (await keys()).privateKey, new TextEncoder().encode(signingInput));
+        return `${signingInput}.${(0, passkey_1.bufferToBase64Url)(sig)}`;
+    };
+    const send = async (input, init = {}) => {
+        const { accessToken, ...rest } = init;
+        const method = rest.method ?? 'GET';
+        const origin = new URL(String(input)).origin;
+        const attempt = async () => {
+            const headers = new Headers(rest.headers);
+            headers.set('DPoP', await proof(method, String(input), { accessToken, nonce: nonces.get(origin) }));
+            if (accessToken)
+                headers.set('Authorization', `DPoP ${accessToken}`);
+            const res = await doFetch(input, { ...rest, headers });
+            const next = res.headers.get('DPoP-Nonce');
+            if (next)
+                nonces.set(origin, next);
+            return { res, next };
+        };
+        const first = await attempt();
+        // RFC 9449 §8/§9: a server that wants a nonce answers 400/401 with DPoP-Nonce; retry once with it.
+        if (first.next && (first.res.status === 400 || first.res.status === 401))
+            return (await attempt()).res;
+        return first.res;
+    };
+    return { thumbprint, proof, fetch: send };
+}
+//# sourceMappingURL=dpop.js.map

package/dist/dpop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop.js","sourceRoot":"","sources":["../src/dpop.ts"],"names":[],"mappings":";;AAsCA,4CAqEC;AA3GD,uCAA8C;AA6B9C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,IAAA,2BAAiB,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;AAE5D,oEAAoE;AACpE,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAE,EAAE;IAClC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;AACpC,CAAC,CAAC;AAEF,SAAgB,gBAAgB,CAAC,UAA6B,EAAE;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAA2B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,IAAwC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,CAAC,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACzC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,kGAAkG;QAClG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9E,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,EAAE,CAAC,CAAC;IAER,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE;QAC3B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAe,CAAC;QAC1G,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;QAC5B,+CAA+C;QAC/C,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,IAAA,2BAAiB,EAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC,CAAC;IAEF,MAAM,KAAK,GAAwB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;QAClE,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;YACxB,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE;YACzB,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;YACf,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnC,CAAC;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,GAAG,IAAA,2BAAiB,EAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACzG,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,UAAU,EACzB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CACvC,CAAC;QACF,OAAO,GAAG,YAAY,IAAI,IAAA,2BAAiB,EAAC,GAAG,CAAC,EAAE,CAAC;IACrD,CAAC,CAAC;IAEF,MAAM,IAAI,GAAwB,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;QAC3D,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACpG,IAAI,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,WAAW,EAAE,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3C,IAAI,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;QAC9B,mGAAmG;QACnG,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC;QACvG,OAAO,KAAK,CAAC,GAAG,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC"}

package/dist/errors.d.ts

@@ -13,7 +13,7 @@
  * `error.<reason>` keys. Listed for docs and coverage checks; a reason missing
  * from this list still renders (as the server's `message`).
  */
-export declare const ERROR_REASONS: readonly ["form_password_incorrect", "form_code_incorrect", "form_code_already_used", "form_code_expired", "form_code_max_attempts", "form_link_invalid", "form_identifier_not_found", "form_identifier_exists", "form_password_pwned", "form_password_too_short", "form_password_too_long", "form_password_requires_uppercase", "form_password_requires_lowercase", "form_password_requires_number", "form_password_requires_symbol", "form_password_not_allowed", "form_password_contains_identifier", "form_password_same_as_current", "form_password_reused", "password_expired", "email_not_verified", "mfa_setup_unavailable", "sign_in_token_invalid", "too_many_attempts", "too_many_requests", "captcha_required", "captcha_failed", "captcha_unavailable", "email_delivery_unavailable", "email_address_unreachable", "strategy_disabled", "sign_up_restricted", "sign_up_denied", "password_not_yet_usable", "account_deleted", "waitlisted", "identifier_not_allowed", "disposable_email_blocked", "sso_required", "sign_ins_disabled", "sign_ups_disabled", "high_risk_blocked", "sms_region_blocked", "github_team_required", "app_approval_denied", "app_approval_expired"];
+export declare const ERROR_REASONS: readonly ["form_password_incorrect", "form_code_incorrect", "form_code_already_used", "form_code_expired", "form_code_max_attempts", "form_link_invalid", "form_identifier_not_found", "form_identifier_exists", "form_password_pwned", "form_password_too_short", "form_password_too_long", "form_password_requires_uppercase", "form_password_requires_lowercase", "form_password_requires_number", "form_password_requires_symbol", "form_password_not_allowed", "form_password_contains_identifier", "form_password_same_as_current", "form_password_reused", "password_expired", "email_not_verified", "mfa_setup_unavailable", "sign_in_token_invalid", "too_many_attempts", "too_many_requests", "captcha_required", "captcha_failed", "captcha_unavailable", "email_delivery_unavailable", "email_address_unreachable", "strategy_disabled", "sign_up_restricted", "sign_up_denied", "password_not_yet_usable", "account_deleted", "waitlisted", "identifier_not_allowed", "disposable_email_blocked", "sso_required", "sign_ins_disabled", "sign_ups_disabled", "high_risk_blocked", "sms_region_blocked", "github_team_required", "app_approval_denied", "app_approval_expired", "captcha_wrong_flow"];
 /** A reason with a string in every shipped catalog. */
 export type ErrorReason = (typeof ERROR_REASONS)[number];
 /** The catalog key for a reason: `error.<reason>`. */
@@ -56,3 +56,10 @@ export declare function localizedErrorMessage(error: ErrorLike | string | null |
  * `localization` bundle use it as the `Accept-Language` they send.
  */
 export declare function catalogLocale(catalog: object | null | undefined): string | undefined;
+/**
+ * The sentence for a stable `reason` in the app's language: the catalog string
+ * `error.<reason>` from `localization` (a `@atlasauth/localizations` bundle or a
+ * lookup function), else `fallback`, else a generic sentence. Never empty.
+ * For headless sign-in: `reasonMessage(flow.getSnapshot().reason, esES)`.
+ */
+export declare function reasonMessage(reason: string | null | undefined, localization?: ErrorStrings | null, fallback?: string): string;

package/dist/errors.js

@@ -14,6 +14,7 @@ exports.ERROR_REASONS = void 0;
 exports.errorReasonKey = errorReasonKey;
 exports.localizedErrorMessage = localizedErrorMessage;
 exports.catalogLocale = catalogLocale;
+exports.reasonMessage = reasonMessage;
 /**
  * The reasons the Frontend API sends that every shipped catalog translates, as
  * `error.<reason>` keys. Listed for docs and coverage checks; a reason missing
@@ -66,6 +67,7 @@ exports.ERROR_REASONS = Object.freeze([
     'github_team_required',
     'app_approval_denied',
     'app_approval_expired',
+    'captcha_wrong_flow',
 ]);
 /** The catalog key for a reason: `error.<reason>`. */
 function errorReasonKey(reason) {
@@ -148,4 +150,13 @@ function catalogLocale(catalog) {
     const tag = catalog.locale;
     return typeof tag === 'string' && tag.trim() !== '' ? tag : undefined;
 }
+/**
+ * The sentence for a stable `reason` in the app's language: the catalog string
+ * `error.<reason>` from `localization` (a `@atlasauth/localizations` bundle or a
+ * lookup function), else `fallback`, else a generic sentence. Never empty.
+ * For headless sign-in: `reasonMessage(flow.getSnapshot().reason, esES)`.
+ */
+function reasonMessage(reason, localization, fallback) {
+    return localizedErrorMessage({ reason, message: fallback }, localization);
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AA4DH,wCAEC;AAyED,sDAcC;AAOD,sCAIC;AA9JD;;;;GAIG;AACU,QAAA,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,yBAAyB;IACzB,qBAAqB;IACrB,wBAAwB;IACxB,mBAAmB;IACnB,wBAAwB;IACxB,mBAAmB;IACnB,2BAA2B;IAC3B,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,wBAAwB;IACxB,kCAAkC;IAClC,kCAAkC;IAClC,+BAA+B;IAC/B,+BAA+B;IAC/B,2BAA2B;IAC3B,mCAAmC;IACnC,+BAA+B;IAC/B,sBAAsB;IACtB,kBAAkB;IAClB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,qBAAqB;IACrB,4BAA4B;IAC5B,2BAA2B;IAC3B,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;IAChB,yBAAyB;IACzB,iBAAiB;IACjB,YAAY;IACZ,wBAAwB;IACxB,0BAA0B;IAC1B,cAAc;IACd,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;CACd,CAAC,CAAC;AAKZ,sDAAsD;AACtD,SAAgB,cAAc,CAAC,MAAc;IAC3C,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAqBD,yEAAyE;AACzE,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAEhE,4EAA4E;AAC5E,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAuB;IAC5D,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,QAAQ,GAAG,KAAK,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,MAAM,CAAC,OAAwC,EAAE,GAAW;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,KAAc,CAAC;IACnB,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,KAAK,GAAI,OAAoC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;YACxD,CAAC,CAAE,OAAmC,CAAC,GAAG,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,qBAAqB,CACnC,KAA4C,EAC5C,OAA6B,EAC7B,QAA8B;IAE9B,MAAM,GAAG,GAAc,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACrF,OAAO,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,aAAa,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAAkC;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,GAAG,GAAI,OAAgC,CAAC,MAAM,CAAC;IACrD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AA6DH,wCAEC;AAyED,sDAcC;AAOD,sCAIC;AAQD,sCAEC;AAzKD;;;;GAIG;AACU,QAAA,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,yBAAyB;IACzB,qBAAqB;IACrB,wBAAwB;IACxB,mBAAmB;IACnB,wBAAwB;IACxB,mBAAmB;IACnB,2BAA2B;IAC3B,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,wBAAwB;IACxB,kCAAkC;IAClC,kCAAkC;IAClC,+BAA+B;IAC/B,+BAA+B;IAC/B,2BAA2B;IAC3B,mCAAmC;IACnC,+BAA+B;IAC/B,sBAAsB;IACtB,kBAAkB;IAClB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,qBAAqB;IACrB,4BAA4B;IAC5B,2BAA2B;IAC3B,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;IAChB,yBAAyB;IACzB,iBAAiB;IACjB,YAAY;IACZ,wBAAwB;IACxB,0BAA0B;IAC1B,cAAc;IACd,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;IACtB,oBAAoB;CACZ,CAAC,CAAC;AAKZ,sDAAsD;AACtD,SAAgB,cAAc,CAAC,MAAc;IAC3C,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAqBD,yEAAyE;AACzE,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAEhE,4EAA4E;AAC5E,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAuB;IAC5D,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,QAAQ,GAAG,KAAK,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,MAAM,CAAC,OAAwC,EAAE,GAAW;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,KAAc,CAAC;IACnB,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,KAAK,GAAI,OAAoC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;YACxD,CAAC,CAAE,OAAmC,CAAC,GAAG,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,qBAAqB,CACnC,KAA4C,EAC5C,OAA6B,EAC7B,QAA8B;IAE9B,MAAM,GAAG,GAAc,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACrF,OAAO,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,aAAa,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAAkC;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,GAAG,GAAI,OAAgC,CAAC,MAAM,CAAC;IACrD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,MAAiC,EAAE,YAAkC,EAAE,QAAiB;IACpH,OAAO,qBAAqB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;AAC5E,CAAC"}

package/dist/has-token.d.ts

@@ -0,0 +1,7 @@
+import { type ProtectCondition } from '@atlasauth/authz';
+/**
+ * `has({ feature })`, `has({ plan })`, `has({ role })` … against a token you
+ * already hold (the session token or an access token). The payload is decoded,
+ * not verified: use it to show or hide UI, and verify on the server to enforce.
+ */
+export declare function hasToken(token: string | null | undefined, condition: ProtectCondition): boolean;

package/dist/has-token.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasToken = hasToken;
+const authz_1 = require("@atlasauth/authz");
+const compat_1 = require("./compat");
+/**
+ * `has({ feature })`, `has({ plan })`, `has({ role })` … against a token you
+ * already hold (the session token or an access token). The payload is decoded,
+ * not verified: use it to show or hide UI, and verify on the server to enforce.
+ */
+function hasToken(token, condition) {
+    const claims = token ? (0, compat_1.decodeJwtPayload)(token) : null;
+    return (0, authz_1.hasFromClaims)(claims, condition);
+}
+//# sourceMappingURL=has-token.js.map

package/dist/has-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"has-token.js","sourceRoot":"","sources":["../src/has-token.ts"],"names":[],"mappings":";;AAQA,4BAGC;AAXD,4CAA0F;AAC1F,qCAA4C;AAE5C;;;;GAIG;AACH,SAAgB,QAAQ,CAAC,KAAgC,EAAE,SAA2B;IACpF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,yBAAgB,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,OAAO,IAAA,qBAAa,EAAC,MAA4B,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC"}

package/dist/index.d.ts

@@ -37,6 +37,7 @@ export * from './passkey-sign-up';
 export * from './email-code-check';
 export * from './srp';
 export * from './step-up';
+export * from './sign-in-flow';
 export * from './org-step-up';
 export * from './telegram';
 export * from './siwe';
@@ -44,6 +45,7 @@ export * from './telemetry';
 export * from './reauth';
 export * from './api-keys';
 export * from './authorized-apps';
+export * from './developer-portal';
 export * from './ciba';
 export * from './device-authorization';
 export * from './app-launcher';
@@ -76,6 +78,8 @@ export * from './atlas-captcha';
 export * from './captcha-controller';
 export * from './instance-settings';
 export * from './environment';
+export * from './dpop';
+export { hasToken } from './has-token';
 export { type AuthzClaims, type ProtectCondition, type ProtectOutcome, type ProtectReason, evaluate, hasFromClaims, protectFromClaims, ForbiddenError, ROLE_KEY_PATTERN, PERMISSION_KEY_PATTERN, isRoleKey, isPermissionKey, } from '@atlasauth/authz';
 export * from './journey-redirect';
 export * from './delegated-ui';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isPermissionKey = exports.isRoleKey = exports.PERMISSION_KEY_PATTERN = exports.ROLE_KEY_PATTERN = exports.ForbiddenError = exports.protectFromClaims = exports.hasFromClaims = exports.evaluate = exports.configureAttribution = exports.detectReferralSource = exports.detectConsentProvider = exports.detectConsent = exports.canonicalCategory = exports.REFERRAL_BROWSER_SOURCES = exports.CONSENT_PROVIDERS = exports.withDevBrowser = exports.setPersistence = exports.forgetDevBrowserToken = exports.devBrowserToken = exports.devBrowserEnabled = void 0;
+exports.isPermissionKey = exports.isRoleKey = exports.PERMISSION_KEY_PATTERN = exports.ROLE_KEY_PATTERN = exports.ForbiddenError = exports.protectFromClaims = exports.hasFromClaims = exports.evaluate = exports.hasToken = exports.configureAttribution = exports.detectReferralSource = exports.detectConsentProvider = exports.detectConsent = exports.canonicalCategory = exports.REFERRAL_BROWSER_SOURCES = exports.CONSENT_PROVIDERS = exports.withDevBrowser = exports.setPersistence = exports.forgetDevBrowserToken = exports.devBrowserToken = exports.devBrowserEnabled = void 0;
 // Provider configuration checks (frontendApi) shared by every framework SDK.
 __exportStar(require("./config"), exports);
 __exportStar(require("./sign-out"), exports);
@@ -84,6 +84,7 @@ __exportStar(require("./email-code-check"), exports);
 // SRP-6a sign-in (RFC 5054, 3072-bit group, SHA-256): the password never leaves the browser.
 __exportStar(require("./srp"), exports);
 __exportStar(require("./step-up"), exports);
+__exportStar(require("./sign-in-flow"), exports);
 __exportStar(require("./org-step-up"), exports);
 __exportStar(require("./telegram"), exports);
 __exportStar(require("./siwe"), exports);
@@ -93,6 +94,8 @@ __exportStar(require("./reauth"), exports);
 __exportStar(require("./api-keys"), exports);
 // The apps a user authorized, with the OpenID Grant Management grants each holds.
 __exportStar(require("./authorized-apps"), exports);
+// Headless developer portal: register an app, rotate its secret, manage redirect URIs, request scopes, read usage.
+__exportStar(require("./developer-portal"), exports);
 __exportStar(require("./ciba"), exports);
 __exportStar(require("./device-authorization"), exports);
 __exportStar(require("./app-launcher"), exports);
@@ -141,6 +144,9 @@ __exportStar(require("./captcha-controller"), exports);
 __exportStar(require("./instance-settings"), exports);
 // `GET /v1/client/environment`, typed, and the `email_delivery` facts.
 __exportStar(require("./environment"), exports);
+__exportStar(require("./dpop"), exports);
+var has_token_1 = require("./has-token");
+Object.defineProperty(exports, "hasToken", { enumerable: true, get: function () { return has_token_1.hasToken; } });
 // Framework-agnostic authorization primitive — `has()`/`evaluate` for any
 // non-React/Next consumer reading org_role/org_permissions off its session.
 var authz_1 = require("@atlasauth/authz");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,mDAAiC;AACjC,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,uEAAuE;AACvE,6CAA2B;AAC3B,mGAAmG;AACnG,2DAAyC;AACzC,4GAA4G;AAC5G,sDAAoC;AACpC,+CAA6B;AAC7B,+EAA+E;AAC/E,6CAA2B;AAC3B,8DAA4C;AAC5C,gGAAgG;AAChG,6CAAgJ;AAAvI,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClG,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,2FAA2F;AAC3F,gDAA8B;AAC9B,+CAA6B;AAC7B,0GAA0G;AAC1G,mDAAiC;AACjC,+CAA6B;AAC7B,iFAAiF;AACjF,gDAA8B;AAC9B,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,sGAAsG;AACtG,qDAAmC;AACnC,6FAA6F;AAC7F,wCAAsB;AACtB,4CAA0B;AAC1B,gDAA8B;AAC9B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,kFAAkF;AAClF,oDAAkC;AAClC,yCAAuB;AACvB,yDAAuC;AACvC,iDAA+B;AAC/B,wDAAsC;AACtC,kDAAgC;AAChC,uDAAqC;AACrC,4CAA0B;AAC1B,8CAA4B;AAC5B,2DAA6G;AAApG,0HAAA,oBAAoB,OAAA;AAC7B,kDAAgC;AAChC,oDAAkC;AAClC,+DAA+D;AAC/D,kDAAgC;AAChC,qDAAmC;AACnC,sFAAsF;AACtF,0DAAwC;AACxC,2CAAyB;AACzB,kEAAkE;AAClE,wCAAsB;AACtB,qDAAmC;AACnC,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,gDAA8B;AAC9B,mDAAiC;AACjC,kDAAgC;AAChC,gGAAgG;AAChG,uDAAqC;AACrC,+DAA6C;AAC7C,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,oDAAkC;AAClC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAEjB,qDAAmC;AAEnC,yGAAyG;AACzG,iDAA+B;AAE/B,kFAAkF;AAClF,sDAAoC;AAEpC,2FAA2F;AAC3F,gDAA8B;AAC9B,wCAAsB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,mDAAiC;AACjC,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,uEAAuE;AACvE,6CAA2B;AAC3B,mGAAmG;AACnG,2DAAyC;AACzC,4GAA4G;AAC5G,sDAAoC;AACpC,+CAA6B;AAC7B,+EAA+E;AAC/E,6CAA2B;AAC3B,8DAA4C;AAC5C,gGAAgG;AAChG,6CAAgJ;AAAvI,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClG,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,2FAA2F;AAC3F,gDAA8B;AAC9B,+CAA6B;AAC7B,0GAA0G;AAC1G,mDAAiC;AACjC,+CAA6B;AAC7B,iFAAiF;AACjF,gDAA8B;AAC9B,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,sGAAsG;AACtG,qDAAmC;AACnC,6FAA6F;AAC7F,wCAAsB;AACtB,4CAA0B;AAC1B,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,kFAAkF;AAClF,oDAAkC;AAClC,mHAAmH;AACnH,qDAAmC;AACnC,yCAAuB;AACvB,yDAAuC;AACvC,iDAA+B;AAC/B,wDAAsC;AACtC,kDAAgC;AAChC,uDAAqC;AACrC,4CAA0B;AAC1B,8CAA4B;AAC5B,2DAA6G;AAApG,0HAAA,oBAAoB,OAAA;AAC7B,kDAAgC;AAChC,oDAAkC;AAClC,+DAA+D;AAC/D,kDAAgC;AAChC,qDAAmC;AACnC,sFAAsF;AACtF,0DAAwC;AACxC,2CAAyB;AACzB,kEAAkE;AAClE,wCAAsB;AACtB,qDAAmC;AACnC,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,gDAA8B;AAC9B,mDAAiC;AACjC,kDAAgC;AAChC,gGAAgG;AAChG,uDAAqC;AACrC,+DAA6C;AAC7C,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,oDAAkC;AAClC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,yCAAuB;AACvB,yCAAuC;AAA9B,qGAAA,QAAQ,OAAA;AACjB,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAEjB,qDAAmC;AAEnC,yGAAyG;AACzG,iDAA+B;AAE/B,kFAAkF;AAClF,sDAAoC;AAEpC,2FAA2F;AAC3F,gDAA8B;AAC9B,wCAAsB"}

package/dist/passkey.d.ts

@@ -178,6 +178,8 @@ export interface PasskeyPromptDecision {
     eligible: boolean;
     variant: string;
     cooldown_days: number;
+    /** Set when a running passkey campaign is why the prompt is due. */
+    campaign_id?: string;
 }
 /** Eligible by the server and not dismissed within the cooldown on this device. */
 export declare function passkeyPromptDue(decision: PasskeyPromptDecision, store?: Pick<Storage, 'getItem'> | undefined, now?: number): boolean;

package/dist/passkey.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../src/passkey.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAyBH,8CAKC;AAGD,8CAOC;AAGD,8CAGC;AAGD,wDAQC;AAQD,gDAOC;AAGD,gEAEC;AAkED,wDAaC;AAMD,oDAeC;AAeD,sCAyCC;AAgBD,kDAkCC;AAyCD,gDAeC;AAGD,oDAQC;AAaD,4CAQC;AAGD,oDAKC;AAUD,4DAWC;AAOD,oDAWC;AAOD,sDAUC;AAnaD,MAAM,WAAW,GAAG,GAAiB,EAAE;IACrC,MAAM,GAAG,GAAI,UAAsC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,GAAG,IAAI,CAAE,GAAiC,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAA8B,CAAC;AACxC,CAAC,CAAC;AAEF,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,GAA6B;IAC7D,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,IAAc;IAC9C,MAAM,CAAC,GAAG,IAAI,IAAK,UAAgD,CAAC,mBAAmB,CAAC;IACxF,OAAO,OAAO,CAAC,KAAK,WAAW,CAAC;AAClC,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,sBAAsB;IAC1C,MAAM,EAAE,GAAI,UAAqG;SAC9G,mBAAmB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,EAAE,+BAA+B,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB;IACtC,MAAM,EAAE,GAAI,UAA2G,CAAC,mBAAmB,CAAC;IAC5I,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,EAAE,qBAAqB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8HAA8H;AACvH,KAAK,UAAU,0BAA0B;IAC9C,OAAO,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI,CAAC;AACjE,CAAC;AAuDD,SAAS,SAAS,CAAC,IAAoB;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,IAAI,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,CAAmB;IACpC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED,sFAAsF;AACtF,SAAgB,sBAAsB,CACpC,GAAkC,EAClC,QAA0B;IAE1B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,GAAG,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC/C,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAA0B,EAAE,CACrD,CAAC,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE1I,oEAAoE;AACpE,SAAgB,oBAAoB,CAAC,UAA+B;IAClE,MAAM,GAAG,GAAI,UAAuF,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC;IACzI,MAAM,GAAG,GAA4B,EAAE,YAAY,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3F,MAAM,GAAG,GAAG,GAAG,CAAC,GAAyF,CAAC;IAC1G,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,GAAG;YACR,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAyC,CAAC;IAChE,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,GAAG,CAAC,SAAS,GAAG,OAAO,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9H,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;;GAIG;AACI,KAAK,UAAU,aAAa,CACjC,KAA8B,EAC9B,OAAuI,EAAE;IAEzI,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAyD,CAAC;IAC7E,MAAM,OAAO,GAAI,KAAK,CAAC,kBAAiE,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QACjD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,gFAAgF;QAChF,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;KACjC,CAAC;IAEnD,qHAAqH;IACrH,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QAChD,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA4C,CAAC;IACzE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,IAAI,CAAC,kBAAkB;QAAE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,qEAAqE;QACrE,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,KAA8B,EAC9B,OAAsI,EAAE;IAExI,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,KAAK,GAAI,KAAK,CAAC,gBAA+D,IAAI,EAAE,CAAC;IAE3F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnF,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;KAC/B,CAAC;IAElD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7C,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA0C,CAAC;IACvE,IAAI,IAAI,CAAC,kBAAkB;QAAE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAgB;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC;QAClD,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,GAAwC,EACxC,MAAe;IAEf,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpI,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;AACnE,CAAC;AAmBD,MAAM,UAAU,GAAG,GAAsB,EAAE,CACzC,CAAE,UAAgD,CAAC,mBAAmB,IAAI,EAAE,CAAsB,CAAC;AAErG;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CAAC,KAAyB,EAAE,OAA0B,UAAU,EAAE;IACxG,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,EAAqC,EAAE,EAAE;QACxE,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC,CAAC;IACF,MAAM,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,4BAA4B,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,wBAAwB,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACvL,MAAM,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAClL,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2FAA2F;AACpF,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,YAAoB,EAAE,OAA0B,UAAU,EAAE;IACnH,IAAI,CAAC,IAAI,CAAC,uBAAuB;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AASD,MAAM,UAAU,GAAG,gCAAgC,CAAC;AACpD,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,mFAAmF;AACnF,SAAgB,gBAAgB,CAC9B,QAA+B,EAC/B,QAA+C,UAAyC,CAAC,YAAY,EACrG,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE,GAAG,QAAQ,CAAC,aAAa,GAAG,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,mEAAmE;AACnE,SAAgB,oBAAoB,CAClC,QAA+C,UAAyC,CAAC,YAAY,EACrG,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAKD;;;;GAIG;AACI,KAAK,UAAU,wBAAwB,CAC5C,MAAkB,EAClB,KAAyB,EACzB,WAA6C;IAE7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxI,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,UAAkB,EAClB,SAA4B,OAAO;IAEnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiB,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,EAAE,uBAAuB,EAAE;QAChG,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;KAC3D,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAE,QAAoD,CAAC;AAC9H,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACnC,MAAkB,EAClB,SAAiB,EACjB,IAAY,EACZ,SAA4B,OAAO;IAEnC,OAAO,MAAM,CAAC,IAAI,CAAC,uBAAuB,SAAS,uBAAuB,EAAE;QAC1E,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;QAC1D,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../src/passkey.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAyBH,8CAKC;AAGD,8CAOC;AAGD,8CAGC;AAGD,wDAQC;AAQD,gDAOC;AAGD,gEAEC;AAkED,wDAaC;AAMD,oDAeC;AAeD,sCAyCC;AAgBD,kDAkCC;AAyCD,gDAeC;AAGD,oDAQC;AAeD,4CAQC;AAGD,oDAKC;AAUD,4DAWC;AAOD,oDAWC;AAOD,sDAUC;AAraD,MAAM,WAAW,GAAG,GAAiB,EAAE;IACrC,MAAM,GAAG,GAAI,UAAsC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,GAAG,IAAI,CAAE,GAAiC,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAA8B,CAAC;AACxC,CAAC,CAAC;AAEF,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,GAA6B;IAC7D,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,IAAc;IAC9C,MAAM,CAAC,GAAG,IAAI,IAAK,UAAgD,CAAC,mBAAmB,CAAC;IACxF,OAAO,OAAO,CAAC,KAAK,WAAW,CAAC;AAClC,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,sBAAsB;IAC1C,MAAM,EAAE,GAAI,UAAqG;SAC9G,mBAAmB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,EAAE,+BAA+B,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB;IACtC,MAAM,EAAE,GAAI,UAA2G,CAAC,mBAAmB,CAAC;IAC5I,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,EAAE,qBAAqB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8HAA8H;AACvH,KAAK,UAAU,0BAA0B;IAC9C,OAAO,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI,CAAC;AACjE,CAAC;AAuDD,SAAS,SAAS,CAAC,IAAoB;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,IAAI,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,CAAmB;IACpC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED,sFAAsF;AACtF,SAAgB,sBAAsB,CACpC,GAAkC,EAClC,QAA0B;IAE1B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,GAAG,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC/C,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAA0B,EAAE,CACrD,CAAC,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE1I,oEAAoE;AACpE,SAAgB,oBAAoB,CAAC,UAA+B;IAClE,MAAM,GAAG,GAAI,UAAuF,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC;IACzI,MAAM,GAAG,GAA4B,EAAE,YAAY,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3F,MAAM,GAAG,GAAG,GAAG,CAAC,GAAyF,CAAC;IAC1G,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,GAAG;YACR,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAyC,CAAC;IAChE,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,GAAG,CAAC,SAAS,GAAG,OAAO,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9H,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;;GAIG;AACI,KAAK,UAAU,aAAa,CACjC,KAA8B,EAC9B,OAAuI,EAAE;IAEzI,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAyD,CAAC;IAC7E,MAAM,OAAO,GAAI,KAAK,CAAC,kBAAiE,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QACjD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,gFAAgF;QAChF,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;KACjC,CAAC;IAEnD,qHAAqH;IACrH,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QAChD,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA4C,CAAC;IACzE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,IAAI,CAAC,kBAAkB;QAAE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,qEAAqE;QACrE,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,KAA8B,EAC9B,OAAsI,EAAE;IAExI,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,KAAK,GAAI,KAAK,CAAC,gBAA+D,IAAI,EAAE,CAAC;IAE3F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnF,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;KAC/B,CAAC;IAElD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7C,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA0C,CAAC;IACvE,IAAI,IAAI,CAAC,kBAAkB;QAAE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAgB;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC;QAClD,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,GAAwC,EACxC,MAAe;IAEf,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpI,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;AACnE,CAAC;AAmBD,MAAM,UAAU,GAAG,GAAsB,EAAE,CACzC,CAAE,UAAgD,CAAC,mBAAmB,IAAI,EAAE,CAAsB,CAAC;AAErG;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CAAC,KAAyB,EAAE,OAA0B,UAAU,EAAE;IACxG,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,EAAqC,EAAE,EAAE;QACxE,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC,CAAC;IACF,MAAM,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,4BAA4B,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,wBAAwB,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACvL,MAAM,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAClL,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2FAA2F;AACpF,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,YAAoB,EAAE,OAA0B,UAAU,EAAE;IACnH,IAAI,CAAC,IAAI,CAAC,uBAAuB;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,GAAG,gCAAgC,CAAC;AACpD,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,mFAAmF;AACnF,SAAgB,gBAAgB,CAC9B,QAA+B,EAC/B,QAA+C,UAAyC,CAAC,YAAY,EACrG,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE,GAAG,QAAQ,CAAC,aAAa,GAAG,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,mEAAmE;AACnE,SAAgB,oBAAoB,CAClC,QAA+C,UAAyC,CAAC,YAAY,EACrG,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAKD;;;;GAIG;AACI,KAAK,UAAU,wBAAwB,CAC5C,MAAkB,EAClB,KAAyB,EACzB,WAA6C;IAE7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxI,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,UAAkB,EAClB,SAA4B,OAAO;IAEnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiB,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,EAAE,uBAAuB,EAAE;QAChG,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;KAC3D,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAE,QAAoD,CAAC;AAC9H,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACnC,MAAkB,EAClB,SAAiB,EACjB,IAAY,EACZ,SAA4B,OAAO;IAEnC,OAAO,MAAM,CAAC,IAAI,CAAC,uBAAuB,SAAS,uBAAuB,EAAE;QAC1E,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;QAC1D,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/sign-in-flow.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Headless sign-in and sign-up: one typed step at a time, no UI.
+ *
+ * `createSignInFlow()` / `createSignUpFlow()` wrap the same requests the
+ * prebuilt components send. You render whatever the current `step` asks for and
+ * call the matching method; the flow never decides the next step itself, the
+ * server does. Captcha is handled for you: when the server asks for one the step
+ * is `needs_captcha`, and `solveCaptcha(container)` draws the widget for the
+ * right flow and submits its token.
+ *
+ * Errors carry a stable `reason` (`form_password_incorrect`, `captcha_wrong_flow`,
+ * …). Turn it into a sentence in the app's language with `reasonMessage`.
+ */
+import { type FieldError, type PendingPolicy } from './attempt';
+import { type PolicyAcceptance } from './policies';
+import { type CaptchaFlowKey, type FlowCaptcha } from './captcha-widget';
+import { type FapiClient } from './fapi';
+/** Second-factor strategies the server accepts. Not narrowed per account: that would reveal what the account has. */
+export declare const SECOND_FACTOR_STRATEGIES: readonly ["totp", "backup_code", "sms", "email_code"];
+export type FlowStep = {
+    type: 'needs_identifier';
+} | {
+    type: 'needs_captcha';
+    flow: CaptchaFlowKey;
+    captcha: FlowCaptcha | null;
+} | {
+    type: 'needs_first_factor';
+    factors: string[];
+} | {
+    type: 'needs_second_factor';
+    factors: string[];
+} | {
+    type: 'needs_policy_acceptance';
+    policies: PendingPolicy[];
+} | {
+    type: 'needs_email_verification';
+}
+/** Send the browser to `url` (OAuth); it comes back signed in. */
+ | {
+    type: 'redirect';
+    url: string;
+}
+/** A step this flow does not drive (MFA enrolment, a required action, an unknown status): hand over to the prebuilt component. */
+ | {
+    type: 'needs_other';
+    status: string;
+} | {
+    type: 'complete';
+    sessionId: string | null;
+};
+export interface FlowSnapshot {
+    step: FlowStep;
+    /** The errors of the last call. Each has a stable `reason`. */
+    errors: FieldError[];
+    /** The first error's stable reason, or the captcha refusal's. */
+    reason: string | null;
+    busy: boolean;
+}
+export interface FlowOptions {
+    client: FapiClient;
+}
+interface Core {
+    /** The current step, errors and busy flag. */
+    getSnapshot(): FlowSnapshot;
+    subscribe(listener: (snapshot: FlowSnapshot) => void): () => void;
+    /** Draw the captcha widget for this flow into `container`, then submit its token. */
+    solveCaptcha(container: HTMLElement): Promise<FlowSnapshot>;
+    /** Submit a captcha token you obtained yourself. */
+    submitCaptcha(token: string): Promise<FlowSnapshot>;
+    /** Send the browser to a social provider; the step becomes `redirect`. */
+    startOAuth(provider: string, redirectUrl: string): Promise<FlowSnapshot>;
+    /** Accept the policies a `needs_policy_acceptance` step lists. */
+    acceptPolicies(acceptances: PolicyAcceptance[]): Promise<FlowSnapshot>;
+    /** Forget everything and go back to the first step. */
+    reset(): FlowSnapshot;
+}
+export interface SignInFlow extends Core {
+    /** `needs_identifier`: start with an email, username or phone number. */
+    submitIdentifier(identifier: string): Promise<FlowSnapshot>;
+    /** `needs_first_factor`: the password. */
+    submitPassword(password: string): Promise<FlowSnapshot>;
+    /** `needs_first_factor`: email the person a code (then `submitEmailCode`). */
+    sendEmailCode(): Promise<FlowSnapshot>;
+    /** `needs_first_factor`: the emailed code. */
+    submitEmailCode(code: string): Promise<FlowSnapshot>;
+    /** Sign in with a passkey (starts at `needs_identifier`; needs no identifier). */
+    signInWithPasskey(): Promise<FlowSnapshot>;
+    /** `needs_second_factor`: a code for `strategy` (default: authenticator app). */
+    submitSecondFactor(code: string, strategy?: (typeof SECOND_FACTOR_STRATEGIES)[number], options?: {
+        rememberDevice?: boolean;
+    }): Promise<FlowSnapshot>;
+    /** `needs_second_factor`: send a text or emailed code, then `submitSecondFactor(code, 'sms' | 'email_code')`. */
+    sendSecondFactorCode(strategy: 'sms' | 'email_code'): Promise<FlowSnapshot>;
+}
+export declare function createSignInFlow(opts: FlowOptions): SignInFlow;
+export interface SignUpInput {
+    email: string;
+    password: string;
+    /** The extra fields the instance collects (name, company, …). */
+    fields?: Record<string, string>;
+    username?: string;
+    /** The legal-consent tick, when the instance requires it. */
+    consent?: boolean;
+    unsafeMetadata?: Record<string, unknown>;
+    policyAcceptances?: PolicyAcceptance[];
+}
+export interface SignUpFlow extends Core {
+    /** `needs_identifier`: create the account. */
+    submit(input: SignUpInput): Promise<FlowSnapshot>;
+    /** `needs_email_verification`: the emailed code. */
+    submitEmailCode(code: string): Promise<FlowSnapshot>;
+    /** `needs_email_verification`: send the code again. */
+    resendEmailCode(): Promise<FlowSnapshot>;
+}
+export declare function createSignUpFlow(opts: FlowOptions): SignUpFlow;
+export {};

package/dist/sign-in-flow.js

@@ -0,0 +1,232 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECOND_FACTOR_STRATEGIES = void 0;
+exports.createSignInFlow = createSignInFlow;
+exports.createSignUpFlow = createSignUpFlow;
+/**
+ * Headless sign-in and sign-up: one typed step at a time, no UI.
+ *
+ * `createSignInFlow()` / `createSignUpFlow()` wrap the same requests the
+ * prebuilt components send. You render whatever the current `step` asks for and
+ * call the matching method; the flow never decides the next step itself, the
+ * server does. Captcha is handled for you: when the server asks for one the step
+ * is `needs_captcha`, and `solveCaptcha(container)` draws the widget for the
+ * right flow and submits its token.
+ *
+ * Errors carry a stable `reason` (`form_password_incorrect`, `captcha_wrong_flow`,
+ * …). Turn it into a sentence in the app's language with `reasonMessage`.
+ */
+const attempt_1 = require("./attempt");
+const instance_settings_1 = require("./instance-settings");
+const policies_1 = require("./policies");
+const passkey_sign_in_1 = require("./passkey-sign-in");
+const redirect_1 = require("./redirect");
+const captcha_widget_1 = require("./captcha-widget");
+const fapi_1 = require("./fapi");
+/** Second-factor strategies the server accepts. Not narrowed per account: that would reveal what the account has. */
+exports.SECOND_FACTOR_STRATEGIES = ['totp', 'backup_code', 'sms', 'email_code'];
+const CAPTCHA_CODES = ['CAPTCHA_REQUIRED', 'CAPTCHA_FAILED'];
+function makeCore(opts, captchaFlow) {
+    const { client } = opts;
+    let flow = fapi_1.initialFlow;
+    let step = { type: 'needs_identifier' };
+    let busy = false;
+    let errors = [];
+    let reason = null;
+    let captchaToken = null;
+    let captchaSettings;
+    let redirect = null;
+    const listeners = new Set();
+    const snapshot = () => ({ step, errors, reason, busy });
+    const emit = () => {
+        const s = snapshot();
+        for (const l of listeners)
+            l(s);
+        return s;
+    };
+    const loadCaptcha = async () => {
+        if (captchaSettings === undefined) {
+            const settings = await (0, instance_settings_1.fetchInstanceSettings)(client);
+            captchaSettings = settings?.captchaFlows[captchaFlow] ?? null;
+        }
+        return captchaSettings;
+    };
+    const stepFor = async (attempt) => {
+        if (redirect)
+            return { type: 'redirect', url: redirect };
+        if (!attempt)
+            return { type: 'needs_identifier' };
+        const next = (0, attempt_1.nextStep)(attempt);
+        switch (next.kind) {
+            case 'collect_identifier':
+            case 'restart':
+                return { type: 'needs_identifier' };
+            case 'collect_captcha':
+                return { type: 'needs_captcha', flow: captchaFlow, captcha: await loadCaptcha() };
+            case 'collect_first_factor':
+                return { type: 'needs_first_factor', factors: next.strategies };
+            case 'collect_second_factor':
+                return { type: 'needs_second_factor', factors: [...exports.SECOND_FACTOR_STRATEGIES] };
+            case 'accept_policies':
+                return { type: 'needs_policy_acceptance', policies: next.policies };
+            case 'collect_email_code':
+                return { type: 'needs_email_verification' };
+            case 'done':
+                return { type: 'complete', sessionId: next.sessionId };
+            case 'await_oauth':
+            case 'enroll_second_factor':
+            case 'collect_new_password':
+            case 'complete_required_action':
+            case 'unknown':
+                return { type: 'needs_other', status: attempt.status };
+        }
+    };
+    /** Run one call, fold its resulting FlowState in, exchange a completion ticket, and publish. */
+    const run = async (call) => {
+        busy = true;
+        emit();
+        let next = await call();
+        if (next.ticket && next.attempt?.id) {
+            const exchanged = await client.post('/v1/client/tickets/exchange', { attempt_id: next.attempt.id, ticket: next.ticket });
+            next = exchanged.ok ? { ...next, ticket: null } : { ...next, errors: exchanged.errors };
+        }
+        flow = next;
+        errors = next.errors;
+        reason = errors[0]?.reason ?? next.attempt?.reason ?? null;
+        busy = false;
+        step = await stepFor(next.attempt);
+        return emit();
+    };
+    /** A captcha error on a call that has no attempt yet becomes the captcha step. */
+    const captchaStepFromErrors = async () => {
+        if (!errors.some((e) => CAPTCHA_CODES.includes(e.code)))
+            return false;
+        step = { type: 'needs_captcha', flow: captchaFlow, captcha: await loadCaptcha() };
+        emit();
+        return true;
+    };
+    return {
+        get flow() { return flow; },
+        get captchaToken() { return captchaToken; },
+        takeCaptchaToken() { const t = captchaToken; captchaToken = null; return t; },
+        setCaptchaToken(t) { captchaToken = t; },
+        get errors() { return errors; },
+        run,
+        captchaStepFromErrors,
+        setRedirect(url) { redirect = url; },
+        api(extra) {
+            return {
+                getSnapshot: snapshot,
+                subscribe(l) { listeners.add(l); return () => void listeners.delete(l); },
+                submitCaptcha: extra.submitCaptcha,
+                async solveCaptcha(container) {
+                    const settings = await loadCaptcha();
+                    if (!settings) {
+                        errors = [{ code: 'CAPTCHA_UNAVAILABLE', reason: 'captcha_unavailable', message: 'No captcha is configured for this flow.' }];
+                        reason = 'captcha_unavailable';
+                        return emit();
+                    }
+                    try {
+                        return await extra.submitCaptcha(await (0, captcha_widget_1.renderCaptchaWidget)(settings, container).token);
+                    }
+                    catch {
+                        errors = [{ code: 'CAPTCHA_FAILED', reason: 'captcha_failed', message: 'The security check did not complete.' }];
+                        reason = 'captcha_failed';
+                        return emit();
+                    }
+                },
+                async startOAuth(provider, redirectUrl) {
+                    const started = await (0, redirect_1.startOauthRedirect)(client, { provider, redirectUrl });
+                    if (!started) {
+                        errors = [{ code: 'OAUTH_START_FAILED', reason: 'oauth_start_failed', message: 'Could not start the social sign-in.' }];
+                        reason = 'oauth_start_failed';
+                        return emit();
+                    }
+                    redirect = started.authorizationUrl;
+                    step = { type: 'redirect', url: started.authorizationUrl };
+                    errors = [];
+                    reason = null;
+                    return emit();
+                },
+                acceptPolicies: (acceptances) => run(() => (0, policies_1.acceptAttemptPolicies)(client, flow, acceptances)),
+                reset() {
+                    flow = fapi_1.initialFlow;
+                    step = { type: 'needs_identifier' };
+                    errors = [];
+                    reason = null;
+                    captchaToken = null;
+                    redirect = null;
+                    return emit();
+                },
+            };
+        },
+    };
+}
+function createSignInFlow(opts) {
+    const core = makeCore(opts, 'signIn');
+    const { client } = opts;
+    let identifier = '';
+    const attemptId = () => core.flow.attempt?.id ?? '';
+    const start = (id) => {
+        identifier = id;
+        return core.run(() => (0, fapi_1.advance)(client, { ...fapi_1.initialFlow }, { identifier: id, ...(core.captchaToken ? { captcha_token: core.takeCaptchaToken() } : {}) }));
+    };
+    // A captcha asked for by the passkey button is answered by trying the passkey again, not by an identifier.
+    let viaPasskey = false;
+    const passkey = async () => {
+        viaPasskey = true;
+        const snap = await core.run(() => (0, passkey_sign_in_1.signInWithPasskey)(client, { captcha: core.captchaToken ? async () => core.takeCaptchaToken() : null }));
+        viaPasskey = await core.captchaStepFromErrors();
+        return viaPasskey ? api.getSnapshot() : snap;
+    };
+    const submitCaptcha = async (token) => {
+        core.setCaptchaToken(token);
+        return viaPasskey ? passkey() : start(core.flow.attempt?.identifier ?? identifier);
+    };
+    const api = core.api({ submitCaptcha });
+    return {
+        ...api,
+        submitIdentifier: (id) => {
+            viaPasskey = false;
+            return start(id);
+        },
+        submitPassword: (password) => core.run(() => (0, fapi_1.advance)(client, core.flow, { password })),
+        sendEmailCode: () => core.run(() => (0, fapi_1.prepareFactor)(client, core.flow, 'email_code')),
+        submitEmailCode: (code) => core.run(() => (0, fapi_1.advance)(client, core.flow, { code })),
+        signInWithPasskey: passkey,
+        submitSecondFactor: (code, strategy = 'totp', options = {}) => core.run(() => (0, fapi_1.advance)(client, core.flow, {
+            code,
+            ...(strategy === 'email_code' ? { strategy } : {}),
+            ...(options.rememberDevice ? { remember_device: 'true' } : {}),
+        })),
+        async sendSecondFactorCode(strategy) {
+            const res = await client.post(`/v1/client/sign_ins/${encodeURIComponent(attemptId())}/prepare_second_factor`, { strategy });
+            return core.run(async () => ({ ...core.flow, errors: res.ok ? [] : res.errors }));
+        },
+    };
+}
+function createSignUpFlow(opts) {
+    const core = makeCore(opts, 'signUp');
+    const { client } = opts;
+    let last = null;
+    const submit = async (input) => {
+        last = input;
+        const token = core.takeCaptchaToken();
+        const snap = await core.run(() => (0, fapi_1.startSignUp)(client, { ...input, ...(token ? { captchaToken: token } : {}) }));
+        if (!(await core.captchaStepFromErrors()))
+            return snap;
+        return api.getSnapshot();
+    };
+    const submitCaptcha = async (token) => {
+        core.setCaptchaToken(token);
+        return last ? submit(last) : api.getSnapshot();
+    };
+    const api = core.api({ submitCaptcha });
+    return {
+        ...api,
+        submit,
+        submitEmailCode: (code) => core.run(() => (0, fapi_1.advance)(client, core.flow, { code })),
+        resendEmailCode: () => core.run(() => (0, fapi_1.resendSignUpVerification)(client, core.flow)),
+    };
+}
+//# sourceMappingURL=sign-in-flow.js.map

package/dist/sign-in-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-flow.js","sourceRoot":"","sources":["../src/sign-in-flow.ts"],"names":[],"mappings":";;;AAkOA,4CAiDC;AAuBD,4CAuBC;AAjUD;;;;;;;;;;;;GAYG;AACH,uCAA4F;AAC5F,2DAA4D;AAC5D,yCAA0E;AAC1E,uDAAsD;AACtD,yCAAgD;AAChD,qDAA8F;AAC9F,iCAQgB;AAEhB,qHAAqH;AACxG,QAAA,wBAAwB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,CAAU,CAAC;AA4C9F,MAAM,aAAa,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;AAE7D,SAAS,QAAQ,CAAC,IAAiB,EAAE,WAA2B;IAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,IAAI,GAAc,kBAAW,CAAC;IAClC,IAAI,IAAI,GAAa,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAClD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,MAAM,GAAiB,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,eAA+C,CAAC;IACpD,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEvD,MAAM,QAAQ,GAAG,GAAiB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,IAAiC,EAAE;QAC1D,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,IAAA,yCAAqB,EAAC,MAAM,CAAC,CAAC;YACrD,eAAe,GAAG,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAChE,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,OAA2B,EAAqB,EAAE;QACvE,IAAI,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,OAAO,CAAC,CAAC;QAC/B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,oBAAoB,CAAC;YAC1B,KAAK,SAAS;gBACZ,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;YACtC,KAAK,iBAAiB;gBACpB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAC;YACpF,KAAK,sBAAsB;gBACzB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;YAClE,KAAK,uBAAuB;gBAC1B,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,GAAG,gCAAwB,CAAC,EAAE,CAAC;YACjF,KAAK,iBAAiB;gBACpB,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtE,KAAK,oBAAoB;gBACvB,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;YAC9C,KAAK,MAAM;gBACT,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACzD,KAAK,aAAa,CAAC;YACnB,KAAK,sBAAsB,CAAC;YAC5B,KAAK,sBAAsB,CAAC;YAC5B,KAAK,0BAA0B,CAAC;YAChC,KAAK,SAAS;gBACZ,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;IAEF,gGAAgG;IAChG,MAAM,GAAG,GAAG,KAAK,EAAE,IAA8B,EAAyB,EAAE;QAC1E,IAAI,GAAG,IAAI,CAAC;QACZ,IAAI,EAAE,CAAC;QACP,IAAI,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACzH,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,GAAG,IAAI,CAAC;QACZ,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QACrB,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC;QAC3D,IAAI,GAAG,KAAK,CAAC;QACb,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,kFAAkF;IAClF,MAAM,qBAAqB,GAAG,KAAK,IAAsB,EAAE;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAC;QAClF,IAAI,EAAE,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;QAC3B,IAAI,YAAY,KAAK,OAAO,YAAY,CAAC,CAAC,CAAC;QAC3C,gBAAgB,KAAK,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7E,eAAe,CAAC,CAAS,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC;QAC/B,GAAG;QACH,qBAAqB;QACrB,WAAW,CAAC,GAAW,IAAI,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5C,GAAG,CAAC,KAA8D;YAChE,OAAO;gBACL,WAAW,EAAE,QAAQ;gBACrB,SAAS,CAAC,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzE,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,KAAK,CAAC,YAAY,CAAC,SAAS;oBAC1B,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;oBACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;wBAC9H,MAAM,GAAG,qBAAqB,CAAC;wBAC/B,OAAO,IAAI,EAAE,CAAC;oBAChB,CAAC;oBACD,IAAI,CAAC;wBACH,OAAO,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,IAAA,oCAAmB,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC;oBACzF,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;wBACjH,MAAM,GAAG,gBAAgB,CAAC;wBAC1B,OAAO,IAAI,EAAE,CAAC;oBAChB,CAAC;gBACH,CAAC;gBACD,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,WAAW;oBACpC,MAAM,OAAO,GAAG,MAAM,IAAA,6BAAkB,EAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;wBACxH,MAAM,GAAG,oBAAoB,CAAC;wBAC9B,OAAO,IAAI,EAAE,CAAC;oBAChB,CAAC;oBACD,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;oBACpC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;oBAC3D,MAAM,GAAG,EAAE,CAAC;oBACZ,MAAM,GAAG,IAAI,CAAC;oBACd,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,cAAc,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,gCAAqB,EAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;gBAC5F,KAAK;oBACH,IAAI,GAAG,kBAAW,CAAC;oBAAC,IAAI,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;oBAAC,MAAM,GAAG,EAAE,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC;oBAAC,YAAY,GAAG,IAAI,CAAC;oBAAC,QAAQ,GAAG,IAAI,CAAC;oBAC1H,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAmBD,SAAgB,gBAAgB,CAAC,IAAiB;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC;IAEpD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE;QAC3B,UAAU,GAAG,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,cAAO,EAAC,MAAM,EAAE,EAAE,GAAG,kBAAW,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5J,CAAC,CAAC;IACF,2GAA2G;IAC3G,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,UAAU,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAC/B,IAAA,mCAAiB,EAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CACvG,CAAC;QACF,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAChD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE;QAC5C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,CAAC;IACrF,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;IAExC,OAAO;QACL,GAAG,GAAG;QACN,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE;YACvB,UAAU,GAAG,KAAK,CAAC;YACnB,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,cAAO,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtF,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,oBAAa,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACnF,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,cAAO,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,iBAAiB,EAAE,OAAO;QAC1B,kBAAkB,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CACZ,IAAA,cAAO,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE;YACzB,IAAI;YACJ,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CACH;QACH,KAAK,CAAC,oBAAoB,CAAC,QAAQ;YACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,uBAAuB,kBAAkB,CAAC,SAAS,EAAE,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5H,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;KACF,CAAC;AACJ,CAAC;AAuBD,SAAgB,gBAAgB,CAAC,IAAiB;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,IAAI,GAAuB,IAAI,CAAC;IAEpC,MAAM,MAAM,GAAG,KAAK,EAAE,KAAkB,EAAE,EAAE;QAC1C,IAAI,GAAG,KAAK,CAAC;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,kBAAW,EAAC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAChH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE;QAC5C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;IACxC,OAAO;QACL,GAAG,GAAG;QACN,MAAM;QACN,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,cAAO,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,eAAe,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,+BAAwB,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;KACnF,CAAC;AACJ,CAAC"}

package/dist/step-up.d.ts

@@ -13,6 +13,7 @@
  *   email_code    POST /v1/client/me/step_up/email_code, then { strategy: 'email_code', code }
  *   passkey       POST /v1/client/me/step_up/passkey (challenge), then the assertion
  */
+import type { FieldError } from './attempt';
 import type { FapiClient, FapiResponse } from './fapi';
 export type StepUpInput = {
     strategy: 'password';
@@ -50,3 +51,48 @@ export declare function sendStepUpEmailCode(client: FapiClient): Promise<FapiRes
 export declare function authenticatedWithin(claims: {
     auth_time?: unknown;
 }, maxAgeSeconds: number, nowMs?: number): boolean;
+/** What a STEP_UP_REQUIRED refusal asks for, read off the refusal alone. */
+export interface StepUpRequirement {
+    /** The action that was refused (`email_change`, `api_key_create`, …), when the server named it. */
+    action: string | null;
+    /** The factor strategies `stepUp()` accepts for it, e.g. `password`, `passkey`, `totp`. */
+    acceptedFactors: string[];
+    /** How recent the proof must be, in seconds; null when any multi-factor sign-in on the session counts. */
+    maxAgeSeconds: number | null;
+}
+/** The step-up a refusal asks for, or null when `errors` holds no STEP_UP_REQUIRED. */
+export declare function stepUpRequirement(errors: readonly FieldError[]): StepUpRequirement | null;
+/** What your prompt is asked to collect. */
+export interface StepUpPrompt extends StepUpRequirement {
+    /** The previous credential was wrong: show this error and ask again. */
+    error: FieldError | null;
+    /** Email the step-up code (for the `email_code` factor). */
+    sendEmailCode(): Promise<FapiResponse<unknown>>;
+}
+/** Thrown by {@link requireStepUp} when the prompt gives up (returns null). */
+export declare class StepUpCancelledError extends Error {
+    readonly code = "STEP_UP_CANCELLED";
+    constructor();
+}
+export interface RequireStepUpOptions {
+    client: FapiClient;
+    /** Ask the person for a credential; return null to cancel. */
+    prompt: (request: StepUpPrompt) => Promise<StepUpInput | null> | StepUpInput | null;
+    /** The refusal that triggered this, so the prompt knows the factors and window. */
+    requirement?: StepUpRequirement;
+    /** Wrong credentials allowed before the last error is thrown. Default 3. */
+    maxAttempts?: number;
+}
+/**
+ * Re-authenticate for `action`: ask `prompt` for a credential, send it to
+ * `POST /v1/client/me/step_up`, and resolve once the server accepts it. A wrong
+ * credential asks again (up to `maxAttempts`). Throws {@link StepUpCancelledError}
+ * when the prompt returns null.
+ */
+export declare function requireStepUp(action: string, opts: RequireStepUpOptions): Promise<StepUpResult>;
+/**
+ * Run `call`; if the server refuses it with STEP_UP_REQUIRED, re-authenticate
+ * with {@link requireStepUp} (using the refusal's own factors and window) and
+ * run it once more. Any other outcome is returned as is.
+ */
+export declare function retryWithStepUp<T>(call: () => Promise<FapiResponse<T>>, opts: Omit<RequireStepUpOptions, 'requirement'>): Promise<FapiResponse<T>>;

package/dist/step-up.js

@@ -1,8 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.StepUpCancelledError = void 0;
 exports.stepUp = stepUp;
 exports.sendStepUpEmailCode = sendStepUpEmailCode;
 exports.authenticatedWithin = authenticatedWithin;
+exports.stepUpRequirement = stepUpRequirement;
+exports.requireStepUp = requireStepUp;
+exports.retryWithStepUp = retryWithStepUp;
 /** Prove a credential of the current session again. A wrong credential is a 401. */
 function stepUp(client, input) {
     return client.post('/v1/client/me/step_up', input);
@@ -21,4 +25,60 @@ function authenticatedWithin(claims, maxAgeSeconds, nowMs = Date.now()) {
         return false;
     return nowMs / 1000 - at <= maxAgeSeconds;
 }
+const DEFAULT_FACTORS = ['password', 'passkey', 'totp', 'backup_code', 'email_code'];
+/** The step-up a refusal asks for, or null when `errors` holds no STEP_UP_REQUIRED. */
+function stepUpRequirement(errors) {
+    const error = errors.find((e) => e.code === 'STEP_UP_REQUIRED');
+    if (!error)
+        return null;
+    const meta = error.meta ?? {};
+    const factors = Array.isArray(meta.accepted_factors) ? meta.accepted_factors.filter((f) => typeof f === 'string') : [];
+    return {
+        action: typeof meta.action === 'string' ? meta.action : null,
+        acceptedFactors: factors.length ? factors : [...DEFAULT_FACTORS],
+        maxAgeSeconds: typeof meta.max_age_seconds === 'number' ? meta.max_age_seconds : null,
+    };
+}
+/** Thrown by {@link requireStepUp} when the prompt gives up (returns null). */
+class StepUpCancelledError extends Error {
+    code = 'STEP_UP_CANCELLED';
+    constructor() {
+        super('The re-authentication was cancelled.');
+        this.name = 'StepUpCancelledError';
+    }
+}
+exports.StepUpCancelledError = StepUpCancelledError;
+/**
+ * Re-authenticate for `action`: ask `prompt` for a credential, send it to
+ * `POST /v1/client/me/step_up`, and resolve once the server accepts it. A wrong
+ * credential asks again (up to `maxAttempts`). Throws {@link StepUpCancelledError}
+ * when the prompt returns null.
+ */
+async function requireStepUp(action, opts) {
+    const base = opts.requirement ?? { action, acceptedFactors: [...DEFAULT_FACTORS], maxAgeSeconds: null };
+    let error = null;
+    for (let attempt = 0; attempt < (opts.maxAttempts ?? 3); attempt++) {
+        const input = await opts.prompt({ ...base, action: base.action ?? action, error, sendEmailCode: () => sendStepUpEmailCode(opts.client) });
+        if (!input)
+            throw new StepUpCancelledError();
+        const res = await stepUp(opts.client, input);
+        if (res.ok && res.data)
+            return res.data;
+        error = res.errors[0] ?? { code: 'UNAUTHENTICATED', message: 'Re-authentication failed.' };
+    }
+    throw Object.assign(new Error(error?.message ?? 'Re-authentication failed.'), { code: error?.code, reason: error?.reason });
+}
+/**
+ * Run `call`; if the server refuses it with STEP_UP_REQUIRED, re-authenticate
+ * with {@link requireStepUp} (using the refusal's own factors and window) and
+ * run it once more. Any other outcome is returned as is.
+ */
+async function retryWithStepUp(call, opts) {
+    const first = await call();
+    const requirement = first.ok ? null : stepUpRequirement(first.errors);
+    if (!requirement)
+        return first;
+    await requireStepUp(requirement.action ?? 'sensitive_action', { ...opts, requirement });
+    return call();
+}
 //# sourceMappingURL=step-up.js.map

package/dist/step-up.js.map

@@ -1 +1 @@
-{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../src/step-up.ts"],"names":[],"mappings":";;AA0CA,wBAEC;AAGD,kDAEC;AAMD,kDAIC;AAlBD,oFAAoF;AACpF,SAAgB,MAAM,CAAC,MAAkB,EAAE,KAAkB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAe,uBAAuB,EAAE,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,qHAAqH;AACrH,SAAgB,mBAAmB,CAAC,MAAkB;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAA+B,EAAE,aAAqB,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IACpH,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI,aAAa,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../src/step-up.ts"],"names":[],"mappings":";;;AA2CA,wBAEC;AAGD,kDAEC;AAMD,kDAIC;AAeD,8CAUC;AAmCD,sCAWC;AAOD,0CASC;AAzGD,oFAAoF;AACpF,SAAgB,MAAM,CAAC,MAAkB,EAAE,KAAkB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAe,uBAAuB,EAAE,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,qHAAqH;AACrH,SAAgB,mBAAmB,CAAC,MAAkB;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAA+B,EAAE,aAAqB,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IACpH,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI,aAAa,CAAC;AAC5C,CAAC;AAYD,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE9F,uFAAuF;AACvF,SAAgB,iBAAiB,CAAC,MAA6B;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpI,OAAO;QACL,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAC5D,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC;QAChE,aAAa,EAAE,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI;KACtF,CAAC;AACJ,CAAC;AAUD,+EAA+E;AAC/E,MAAa,oBAAqB,SAAQ,KAAK;IACpC,IAAI,GAAG,mBAAmB,CAAC;IACpC;QACE,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAND,oDAMC;AAYD;;;;;GAKG;AACI,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,IAA0B;IAC5E,MAAM,IAAI,GAAsB,IAAI,CAAC,WAAW,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC3H,IAAI,KAAK,GAAsB,IAAI,CAAC;IACpC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1I,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QACxC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,2BAA2B,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAC9H,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,eAAe,CACnC,IAAoC,EACpC,IAA+C;IAE/C,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,aAAa,CAAC,WAAW,CAAC,MAAM,IAAI,kBAAkB,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACxF,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * package.json at runtime) so the bundle stays dependency-free and tests stay
  * deterministic; `version.test.ts` fails when it drifts from package.json.
  */
-export declare const ATLAS_JS_VERSION = "0.37.0";
+export declare const ATLAS_JS_VERSION = "0.38.0";

package/dist/version.js

@@ -7,5 +7,5 @@ exports.ATLAS_JS_VERSION = void 0;
  * package.json at runtime) so the bundle stays dependency-free and tests stay
  * deterministic; `version.test.ts` fails when it drifts from package.json.
  */
-exports.ATLAS_JS_VERSION = '0.37.0';
+exports.ATLAS_JS_VERSION = '0.38.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/js",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {