@atlasauth/js 0.37.0 → 0.39.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 
 
+## 0.39.0 — 2026-11-12
+
+- API key types: `createApiKey` takes `type`, keys carry `type`, `listApiKeys({ type })` filters.
+- Headless flow: typed `needs_mfa_enrollment` (`startTotpEnrollment`, `sendEnrollmentPhone`, `submitEnrollmentCode`), `show_recovery_codes` (`acknowledgeRecoveryCodes`) and `needs_required_action` steps (`updatePassword`, `sendEmailVerification`, `submitEmailVerificationCode`, `updateProfile`, `submitRequiredFields`, `startIdentityVerification`, `checkIdentityVerification`); `completeRequiredAction` takes `redirect_url` and `step: 'start'`.
+
+## 0.38.0 — 2026-11-12
+
+- `createSignInFlow` / `createSignUpFlow` (headless typed steps with captcha wired to the right flow), `requireStepUp` / `retryWithStepUp`, `reasonMessage`, `createDpopClient`, `hasToken`, `createDeveloperPortal`, `revokeAllAgentAccess`.
+
 ## 0.37.0 — 2026-11-11
 
 - New app-approval sign-in: `prepareAppApproval`, `prepareAppApprovalSecondFactor`, `pollAppApprovalSecondFactor`, and for the approving app `getAppApproval`, `approveSignIn`, `denySignIn`.

package/dist/api-keys.d.ts

@@ -18,6 +18,8 @@ export interface UserApiKey {
     name: string | null;
     /** The public `ak_…` head — recognises a key, cannot be used as one. */
     prefix: string;
+    /** The key type segment (e.g. `sk`), or null for an untyped key. */
+    type?: string | null;
     claims: Record<string, unknown>;
     scopes: string[] | null;
     /** Usage limits on the key, when the application sets them. */
@@ -61,6 +63,8 @@ export interface CreateUserApiKeyInput {
     claims?: Record<string, unknown>;
     /** Create the key for this (active) organization instead of the user. */
     organizationId?: string;
+    /** Key type (e.g. `sk`); required when the application sets `keyTypes`. */
+    type?: string;
 }
 /** A refused request. `code` is the server's stable error code. */
 export declare class ApiKeyRequestError extends Error {
@@ -82,6 +86,7 @@ export declare class ApiKeyRequestError extends Error {
 /** List the user's keys (or the active organization's, with `organizationId`). */
 export declare function listApiKeys(client: FapiClient, options?: {
     organizationId?: string;
+    type?: string;
 }): Promise<UserApiKeyList>;
 /** Create a key. The returned `secret` is shown exactly once. */
 export declare function createApiKey(client: FapiClient, input?: CreateUserApiKeyInput): Promise<CreatedUserApiKey>;

package/dist/api-keys.js

@@ -48,9 +48,12 @@ async function call(client, path, init = {}) {
 }
 /** List the user's keys (or the active organization's, with `organizationId`). */
 async function listApiKeys(client, options = {}) {
-    const query = options.organizationId
-        ? `?organization_id=${encodeURIComponent(options.organizationId)}`
-        : '';
+    const params = new URLSearchParams();
+    if (options.organizationId)
+        params.set('organization_id', options.organizationId);
+    if (options.type)
+        params.set('type', options.type);
+    const query = params.size ? `?${params}` : '';
     const body = await call(client, `${BASE}${query}`, { method: 'GET' });
     return {
         data: body.data ?? [],
@@ -76,6 +79,8 @@ async function createApiKey(client, input = {}) {
         body.claims = input.claims;
     if (input.organizationId !== undefined)
         body.organization_id = input.organizationId;
+    if (input.type !== undefined)
+        body.type = input.type;
     return call(client, BASE, { method: 'POST', body: JSON.stringify(body) });
 }
 /** Rename a key (`null` clears the name). */

package/dist/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../src/api-keys.ts"],"names":[],"mappings":";;;AA8HA,kCAuBC;AAGD,oCAYC;AAGD,oCASC;AAGD,oCASC;AAOD,sCAuBC;AAeD,8BAcC;AAjLD,mEAAmE;AACnE,MAAa,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAS;IACb,MAAM,CAAS;IACf,KAAK,CAAU;IACxB;;;;OAIG;IACM,MAAM,CAAU;IACzB,mEAAmE;IAC1D,IAAI,CAA2B;IAExC,YACE,MAAc,EACd,IAAY,EACZ,OAAe,EACf,KAAc,EACd,MAAe,EACf,IAA8B;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACjC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,kEAAkE;IAClE,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC;IAC1C,CAAC;CACF;AAlCD,gDAkCC;AAED,MAAM,IAAI,GAAG,wBAAwB,CAAC;AAEtC,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,OAAoB,EAAE;IAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC1B,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,IAAI,IAAI,SAAS,EACxB,KAAK,EAAE,OAAO,IAAI,qBAAqB,EACvC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CACZ,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,UAAuC,EAAE;IAEzC,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc;QAClC,CAAC,CAAC,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE;QAClE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,IAAI,GAAG,MAAM,IAAI,CAOpB,MAAM,EAAE,GAAG,IAAI,GAAG,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;QACxC,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;QACxC,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,IAAI,EAAE;QAChD,aAAa,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC;QACxC,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,iEAAiE;AAC1D,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,QAA+B,EAAE;IAEjC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACrD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IACrE,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC3F,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,cAAc,CAAC;IACpF,OAAO,IAAI,CAAoB,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,EAAU,EACV,KAA8B;IAE9B,OAAO,IAAI,CAAa,MAAM,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,EAAU;IAEV,OAAO,IAAI,CACT,MAAM,EACN,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAC1C,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,QAA2B,EAC3B,YAAsC,EACtC,gBAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,EAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACX,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AASD;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,aAAgC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAqB,CAAC,GAAG,KAAK,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC"}
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../src/api-keys.ts"],"names":[],"mappings":";;;AAkIA,kCAwBC;AAGD,oCAaC;AAGD,oCASC;AAGD,oCASC;AAOD,sCAuBC;AAeD,8BAcC;AAnLD,mEAAmE;AACnE,MAAa,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAS;IACb,MAAM,CAAS;IACf,KAAK,CAAU;IACxB;;;;OAIG;IACM,MAAM,CAAU;IACzB,mEAAmE;IAC1D,IAAI,CAA2B;IAExC,YACE,MAAc,EACd,IAAY,EACZ,OAAe,EACf,KAAc,EACd,MAAe,EACf,IAA8B;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACjC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,kEAAkE;IAClE,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC;IAC1C,CAAC;CACF;AAlCD,gDAkCC;AAED,MAAM,IAAI,GAAG,wBAAwB,CAAC;AAEtC,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,OAAoB,EAAE;IAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC1B,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,IAAI,IAAI,SAAS,EACxB,KAAK,EAAE,OAAO,IAAI,qBAAqB,EACvC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CACZ,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,UAAsD,EAAE;IAExD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAOpB,MAAM,EAAE,GAAG,IAAI,GAAG,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;QACxC,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;QACxC,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,IAAI,EAAE;QAChD,aAAa,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC;QACxC,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,iEAAiE;AAC1D,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,QAA+B,EAAE;IAEjC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACrD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IACrE,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC3F,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,cAAc,CAAC;IACpF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACrD,OAAO,IAAI,CAAoB,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,EAAU,EACV,KAA8B;IAE9B,OAAO,IAAI,CAAa,MAAM,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,EAAU;IAEV,OAAO,IAAI,CACT,MAAM,EACN,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAC1C,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,QAA2B,EAC3B,YAAsC,EACtC,gBAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,EAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACX,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AASD;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,aAAgC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAqB,CAAC,GAAG,KAAK,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC"}

package/dist/attempt.d.ts

@@ -130,6 +130,8 @@ export interface AttemptView {
     /** The resource type the server stamps on every attempt view. */
     object?: 'sign_in_attempt' | 'sign_up_attempt';
     status: string;
+    /** On the `needs_captcha` marker: why the token you sent was refused (`captcha_failed`, `captcha_wrong_flow`); absent when none was sent. */
+    reason?: string;
     /** The identifier the attempt was started with; `null` before one is collected. */
     identifier?: string | null;
     supported_first_factors?: string[];

package/dist/attempt.js.map

@@ -1 +1 @@
-{"version":3,"file":"attempt.js","sourceRoot":"","sources":["../src/attempt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AA4IH,4BA2DC;AAGD,gCAEC;AA6BD,kCAiBC;AAGD,8BAEC;AAGD,gCAEC;AAxHD,SAAgB,QAAQ,CAAC,OAAoB;IAC3C,QAAQ,OAAO,CAAC,MAAuB,EAAE,CAAC;QACxC,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,oBAAoB;YACvB,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,sEAAsE;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,wCAAwC;gBACxC,UAAU,EAAE,OAAO,CAAC,uBAAuB,IAAI,EAAE;aAClD,CAAC;QAEJ,KAAK,qBAAqB;YACxB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QAE3C;;;;;WAKG;QACH,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,0BAA0B;YAC7B,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAErC,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAEjC,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,yBAAyB;YAC5B,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAE/E,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,OAAO,CAAC,wBAAwB,IAAI,EAAE,EAAE,CAAC;QAE/F,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;QAEzE,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAElD;YACE;;;;eAIG;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,OAAoB;IAC7C,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC;AACzE,CAAC;AA6BD,SAAgB,WAAW,CAAC,IAAa;IACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,KAAK,EAAuB,EAAE;QACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAQ,KAAoB,CAAC,OAAO,KAAK,QAAQ,CAAC;IAC7E,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACzF,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;QACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACrE,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,GAAG,IAA+B,CAAC;QACzG,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8DAA8D;AAC9D,SAAgB,SAAS,CAAC,MAA6B,EAAE,KAAa;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,SAAgB,UAAU,CAAC,MAA6B;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"attempt.js","sourceRoot":"","sources":["../src/attempt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AA8IH,4BA2DC;AAGD,gCAEC;AA6BD,kCAiBC;AAGD,8BAEC;AAGD,gCAEC;AAxHD,SAAgB,QAAQ,CAAC,OAAoB;IAC3C,QAAQ,OAAO,CAAC,MAAuB,EAAE,CAAC;QACxC,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,oBAAoB;YACvB,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,sEAAsE;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,wCAAwC;gBACxC,UAAU,EAAE,OAAO,CAAC,uBAAuB,IAAI,EAAE;aAClD,CAAC;QAEJ,KAAK,qBAAqB;YACxB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QAE3C;;;;;WAKG;QACH,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,0BAA0B;YAC7B,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAExC,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAErC,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAEjC,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;QAE1C,KAAK,yBAAyB;YAC5B,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAE/E,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,OAAO,CAAC,wBAAwB,IAAI,EAAE,EAAE,CAAC;QAE/F,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;QAEzE,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAElD;YACE;;;;eAIG;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,OAAoB;IAC7C,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC;AACzE,CAAC;AA6BD,SAAgB,WAAW,CAAC,IAAa;IACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,KAAK,EAAuB,EAAE;QACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAQ,KAAoB,CAAC,OAAO,KAAK,QAAQ,CAAC;IAC7E,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACzF,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;QACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACrE,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,GAAG,IAA+B,CAAC;QACzG,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8DAA8D;AAC9D,SAAgB,SAAS,CAAC,MAA6B,EAAE,KAAa;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,SAAgB,UAAU,CAAC,MAA6B;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}

package/dist/authorized-apps.d.ts

@@ -40,3 +40,11 @@ export declare function disconnectAuthorizedApp(client: FapiClient, consentId: s
 export declare function revokeAppGrant(client: FapiClient, grantId: string): Promise<{
     tokensEnded: number;
 }>;
+/**
+ * Revoke all agent access in one step: disconnects every app connected through dynamic registration (MCP clients and
+ * AI assistants) and switches off every agent registered to the user. Needs a signed-in session.
+ */
+export declare function revokeAllAgentAccess(client: FapiClient): Promise<{
+    appsDisconnected: number;
+    agentsDisabled: number;
+}>;

package/dist/authorized-apps.js

@@ -4,6 +4,7 @@ exports.AuthorizedAppsError = void 0;
 exports.listAuthorizedApps = listAuthorizedApps;
 exports.disconnectAuthorizedApp = disconnectAuthorizedApp;
 exports.revokeAppGrant = revokeAppGrant;
+exports.revokeAllAgentAccess = revokeAllAgentAccess;
 /** A refused request; `code` is the server's stable error code. */
 class AuthorizedAppsError extends Error {
     status;
@@ -38,4 +39,12 @@ async function revokeAppGrant(client, grantId) {
     const body = await call(client, `/v1/client/me/managed_grants/${encodeURIComponent(grantId)}`, { method: 'DELETE' });
     return { tokensEnded: body.tokens_ended ?? 0 };
 }
+/**
+ * Revoke all agent access in one step: disconnects every app connected through dynamic registration (MCP clients and
+ * AI assistants) and switches off every agent registered to the user. Needs a signed-in session.
+ */
+async function revokeAllAgentAccess(client) {
+    const body = await call(client, '/v1/client/me/agent_access/revoke_all', { method: 'POST' });
+    return { appsDisconnected: body.apps_disconnected ?? 0, agentsDisabled: body.agents_disabled ?? 0 };
+}
 //# sourceMappingURL=authorized-apps.js.map

package/dist/authorized-apps.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorized-apps.js","sourceRoot":"","sources":["../src/authorized-apps.ts"],"names":[],"mappings":";;;AAsDA,gDAGC;AAGD,0DAEC;AAGD,wCAGC;AApCD,mEAAmE;AACnE,MAAa,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AATD,kDASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,kBAAkB,CAAC,MAAkB;IACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAA6B,MAAM,EAAE,4BAA4B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7G,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,uBAAuB,CAAC,MAAkB,EAAE,SAAiB;IACjF,MAAM,IAAI,CAAC,MAAM,EAAE,8BAA8B,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED,8GAA8G;AACvG,KAAK,UAAU,cAAc,CAAC,MAAkB,EAAE,OAAe;IACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAA4B,MAAM,EAAE,gCAAgC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChJ,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;AACjD,CAAC"}
+{"version":3,"file":"authorized-apps.js","sourceRoot":"","sources":["../src/authorized-apps.ts"],"names":[],"mappings":";;;AAsDA,gDAGC;AAGD,0DAEC;AAGD,wCAGC;AAMD,oDAGC;AA7CD,mEAAmE;AACnE,MAAa,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AATD,kDASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,kBAAkB,CAAC,MAAkB;IACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAA6B,MAAM,EAAE,4BAA4B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7G,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,uBAAuB,CAAC,MAAkB,EAAE,SAAiB;IACjF,MAAM,IAAI,CAAC,MAAM,EAAE,8BAA8B,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED,8GAA8G;AACvG,KAAK,UAAU,cAAc,CAAC,MAAkB,EAAE,OAAe;IACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAA4B,MAAM,EAAE,gCAAgC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChJ,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,oBAAoB,CAAC,MAAkB;IAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAA2D,MAAM,EAAE,uCAAuC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvJ,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC;AACtG,CAAC"}

package/dist/developer-portal.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Headless developer-portal kit: build your own "register an app" pages on top of dynamic client registration.
+ * The instance gives a developer an initial access token (`oauth_initial_access_token`, bound to them); registering
+ * returns the app plus a registration access token that manages that one app afterwards. Call these from your
+ * server (or a trusted back end) so neither token reaches a browser you do not control.
+ */
+export interface DeveloperPortalOptions {
+    /** The instance's issuer (its frontend API host), e.g. `https://auth.example.com`. */
+    issuer: string;
+    fetchImpl?: typeof fetch;
+}
+/** One registered app, as the registration endpoint reports it. */
+export interface DeveloperApp {
+    /** The Atlas id (oac_...) the Backend API takes. Present on the registration response. */
+    id?: string;
+    client_id: string;
+    client_name?: string;
+    client_secret?: string;
+    client_secret_expires_at?: number;
+    redirect_uris: string[];
+    scope?: string;
+    grant_types?: string[];
+    token_endpoint_auth_method?: string;
+    status?: string;
+    /** Returned once, on registration: keep it to manage the app later. */
+    registration_access_token?: string;
+    registration_client_uri?: string;
+    [key: string]: unknown;
+}
+export interface DeveloperAppUsage {
+    object: 'oauth_client_usage';
+    client_id: string;
+    rate_limit_per_minute: number | null;
+    totals: {
+        calls: number;
+        token_issuances: number;
+        errors: number;
+        rate_limited: number;
+    };
+    data: Array<{
+        day: string;
+        calls: number;
+        token_issuances: number;
+        active_users: number;
+        errors: number;
+        rate_limited: number;
+    }>;
+}
+/** A refused request; `error` is the OAuth error code (`invalid_redirect_uri`, `invalid_client_metadata`, `invalid_token`...). */
+export declare class DeveloperPortalError extends Error {
+    readonly status: number;
+    readonly error: string;
+    constructor(status: number, error: string, message: string);
+}
+export interface DeveloperPortal {
+    /** Register an app with the developer's initial access token. Returns the app, its secret and registration_access_token (shown once). */
+    registerApp(developerToken: string, app: {
+        client_name: string;
+        redirect_uris: string[];
+        scope?: string;
+        grant_types?: string[];
+        token_endpoint_auth_method?: string;
+        logo_uri?: string;
+    }): Promise<DeveloperApp>;
+    getApp(clientId: string, registrationToken: string): Promise<DeveloperApp>;
+    /** Replace the app's redirect URIs (the instance's rules apply: https, and https only for some developers). */
+    setRedirectUris(clientId: string, registrationToken: string, redirectUris: string[]): Promise<DeveloperApp>;
+    /** Ask for scopes. The standard scopes are applied at once; others are refused until the instance allows them for the app. */
+    requestScopes(clientId: string, registrationToken: string, scopes: string[]): Promise<DeveloperApp>;
+    /** Issue a new secret; the previous one keeps working for a short overlap. */
+    rotateSecret(clientId: string, registrationToken: string): Promise<{
+        client_id: string;
+        client_secret: string;
+        client_secret_expires_at: number;
+    }>;
+    deleteApp(clientId: string, registrationToken: string): Promise<void>;
+    /** Per-day token endpoint usage for the app (default last 30 days, at most 90). */
+    getUsage(clientId: string, registrationToken: string, days?: number): Promise<DeveloperAppUsage>;
+}
+export declare function createDeveloperPortal(options: DeveloperPortalOptions): DeveloperPortal;

package/dist/developer-portal.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * Headless developer-portal kit: build your own "register an app" pages on top of dynamic client registration.
+ * The instance gives a developer an initial access token (`oauth_initial_access_token`, bound to them); registering
+ * returns the app plus a registration access token that manages that one app afterwards. Call these from your
+ * server (or a trusted back end) so neither token reaches a browser you do not control.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeveloperPortalError = void 0;
+exports.createDeveloperPortal = createDeveloperPortal;
+/** A refused request; `error` is the OAuth error code (`invalid_redirect_uri`, `invalid_client_metadata`, `invalid_token`...). */
+class DeveloperPortalError extends Error {
+    status;
+    error;
+    constructor(status, error, message) {
+        super(message);
+        this.name = 'DeveloperPortalError';
+        this.status = status;
+        this.error = error;
+    }
+}
+exports.DeveloperPortalError = DeveloperPortalError;
+function createDeveloperPortal(options) {
+    const base = options.issuer.replace(/\/+$/, '');
+    const doFetch = options.fetchImpl ?? ((...a) => fetch(...a));
+    async function call(path, method, token, body) {
+        const res = await doFetch(`${base}${path}`, {
+            method,
+            headers: { authorization: `Bearer ${token}`, ...(body !== undefined ? { 'content-type': 'application/json' } : {}) },
+            body: body !== undefined ? JSON.stringify(body) : undefined,
+        });
+        if (res.status === 204)
+            return undefined;
+        const data = (await res.json().catch(() => ({})));
+        if (!res.ok)
+            throw new DeveloperPortalError(res.status, String(data.error ?? 'request_failed'), String(data.error_description ?? 'The request failed.'));
+        return data;
+    }
+    const own = (clientId) => `/oauth2/register/${encodeURIComponent(clientId)}`;
+    return {
+        registerApp: (developerToken, app) => call('/oauth2/register', 'POST', developerToken, app),
+        getApp: (clientId, token) => call(own(clientId), 'GET', token),
+        setRedirectUris: (clientId, token, redirect_uris) => call(own(clientId), 'PUT', token, { redirect_uris }),
+        requestScopes: (clientId, token, scopes) => call(own(clientId), 'PUT', token, { scope: scopes.join(' ') }),
+        rotateSecret: (clientId, token) => call(`${own(clientId)}/secret`, 'POST', token),
+        deleteApp: (clientId, token) => call(own(clientId), 'DELETE', token),
+        getUsage: (clientId, token, days) => call(`${own(clientId)}/usage${days ? `?days=${days}` : ''}`, 'GET', token),
+    };
+}
+//# sourceMappingURL=developer-portal.js.map

package/dist/developer-portal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-portal.js","sourceRoot":"","sources":["../src/developer-portal.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA8DH,sDA0BC;AArDD,kIAAkI;AAClI,MAAa,oBAAqB,SAAQ,KAAK;IACpC,MAAM,CAAS;IACf,KAAK,CAAS;IACvB,YAAY,MAAc,EAAE,KAAa,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AATD,oDASC;AAiBD,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAA2B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEvF,KAAK,UAAU,IAAI,CAAI,IAAY,EAAE,MAAc,EAAE,KAAa,EAAE,IAAc;QAChF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YAC1C,MAAM;YACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACpH,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,qBAAqB,CAAC,CAAC,CAAC;QACzJ,OAAO,IAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAErF,OAAO;QACL,WAAW,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC;QAC3F,MAAM,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC;QAC9D,eAAe,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,CAAC;QACzG,aAAa,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1G,YAAY,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC;QACjF,SAAS,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC;QACpE,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC;KAChH,CAAC;AACJ,CAAC"}

package/dist/dpop.d.ts

@@ -0,0 +1,30 @@
+/**
+ * DPoP (RFC 9449) for browsers and agents: a non-extractable ES256 key the page
+ * generates once, a proof for every request, and a fetch wrapper that attaches
+ * both and answers a server's `DPoP-Nonce` demand. Tokens issued against the
+ * proof's key carry `cnf.jkt`, so a copied token is useless without this key.
+ */
+export interface DpopKeyStore {
+    get(): Promise<CryptoKeyPair | undefined>;
+    set(pair: CryptoKeyPair): Promise<void>;
+}
+export interface DpopClientOptions {
+    /** Keep the key pair across reloads (a CryptoKey can live in IndexedDB). Default: memory only. */
+    store?: DpopKeyStore;
+    /** The fetch to wrap. Default: global fetch. */
+    fetch?: typeof fetch;
+}
+export interface DpopClient {
+    /** RFC 7638 thumbprint of the public key: the value a bound token carries as `cnf.jkt`. */
+    thumbprint(): Promise<string>;
+    /** A proof JWT for one request. Pass `accessToken` at resource servers (adds `ath`), none at the token endpoint. */
+    proof(method: string, url: string, opts?: {
+        accessToken?: string;
+        nonce?: string;
+    }): Promise<string>;
+    /** `fetch` that sends `Authorization: DPoP <token>` plus a fresh proof, retrying once on `use_dpop_nonce`. */
+    fetch(input: string | URL, init?: RequestInit & {
+        accessToken?: string;
+    }): Promise<Response>;
+}
+export declare function createDpopClient(options?: DpopClientOptions): DpopClient;

package/dist/dpop.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDpopClient = createDpopClient;
+const passkey_1 = require("./passkey");
+const enc = (o) => (0, passkey_1.bufferToBase64Url)(new TextEncoder().encode(JSON.stringify(o)));
+const ALG = { name: 'ECDSA', namedCurve: 'P-256' };
+// htu is the request URL without query or fragment (RFC 9449 §4.2).
+const htuOf = (url) => {
+    const u = new URL(String(url));
+    return `${u.origin}${u.pathname}`;
+};
+function createDpopClient(options = {}) {
+    const doFetch = options.fetch ?? ((...a) => fetch(...a));
+    let pair;
+    const nonces = new Map();
+    const keys = () => (pair ??= (async () => {
+        const saved = await options.store?.get();
+        if (saved)
+            return saved;
+        // extractable:false keeps the private key unreadable by script; the public half stays exportable.
+        const fresh = await crypto.subtle.generateKey(ALG, false, ['sign', 'verify']);
+        await options.store?.set(fresh);
+        return fresh;
+    })());
+    const publicJwk = async () => {
+        const { kty, crv, x, y } = (await crypto.subtle.exportKey('jwk', (await keys()).publicKey));
+        return { kty, crv, x, y };
+    };
+    const thumbprint = async () => {
+        // RFC 7638 canonical member order for EC keys.
+        const j = await publicJwk();
+        const canon = JSON.stringify({ crv: j.crv, kty: j.kty, x: j.x, y: j.y });
+        return (0, passkey_1.bufferToBase64Url)(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(canon)));
+    };
+    const proof = async (method, url, opts = {}) => {
+        const payload = {
+            jti: crypto.randomUUID(),
+            htm: method.toUpperCase(),
+            htu: htuOf(url),
+            iat: Math.floor(Date.now() / 1000),
+        };
+        if (opts.nonce)
+            payload.nonce = opts.nonce;
+        if (opts.accessToken) {
+            payload.ath = (0, passkey_1.bufferToBase64Url)(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(opts.accessToken)));
+        }
+        const signingInput = `${enc({ typ: 'dpop+jwt', alg: 'ES256', jwk: await publicJwk() })}.${enc(payload)}`;
+        const sig = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, (await keys()).privateKey, new TextEncoder().encode(signingInput));
+        return `${signingInput}.${(0, passkey_1.bufferToBase64Url)(sig)}`;
+    };
+    const send = async (input, init = {}) => {
+        const { accessToken, ...rest } = init;
+        const method = rest.method ?? 'GET';
+        const origin = new URL(String(input)).origin;
+        const attempt = async () => {
+            const headers = new Headers(rest.headers);
+            headers.set('DPoP', await proof(method, String(input), { accessToken, nonce: nonces.get(origin) }));
+            if (accessToken)
+                headers.set('Authorization', `DPoP ${accessToken}`);
+            const res = await doFetch(input, { ...rest, headers });
+            const next = res.headers.get('DPoP-Nonce');
+            if (next)
+                nonces.set(origin, next);
+            return { res, next };
+        };
+        const first = await attempt();
+        // RFC 9449 §8/§9: a server that wants a nonce answers 400/401 with DPoP-Nonce; retry once with it.
+        if (first.next && (first.res.status === 400 || first.res.status === 401))
+            return (await attempt()).res;
+        return first.res;
+    };
+    return { thumbprint, proof, fetch: send };
+}
+//# sourceMappingURL=dpop.js.map

package/dist/dpop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop.js","sourceRoot":"","sources":["../src/dpop.ts"],"names":[],"mappings":";;AAsCA,4CAqEC;AA3GD,uCAA8C;AA6B9C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,IAAA,2BAAiB,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;AAE5D,oEAAoE;AACpE,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAE,EAAE;IAClC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;AACpC,CAAC,CAAC;AAEF,SAAgB,gBAAgB,CAAC,UAA6B,EAAE;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAA2B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,IAAwC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,CAAC,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACzC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,kGAAkG;QAClG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9E,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,EAAE,CAAC,CAAC;IAER,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE;QAC3B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAe,CAAC;QAC1G,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;QAC5B,+CAA+C;QAC/C,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,IAAA,2BAAiB,EAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC,CAAC;IAEF,MAAM,KAAK,GAAwB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;QAClE,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;YACxB,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE;YACzB,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;YACf,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnC,CAAC;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,GAAG,IAAA,2BAAiB,EAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACzG,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,UAAU,EACzB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CACvC,CAAC;QACF,OAAO,GAAG,YAAY,IAAI,IAAA,2BAAiB,EAAC,GAAG,CAAC,EAAE,CAAC;IACrD,CAAC,CAAC;IAEF,MAAM,IAAI,GAAwB,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;QAC3D,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACpG,IAAI,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,WAAW,EAAE,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3C,IAAI,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;QAC9B,mGAAmG;QACnG,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC;QACvG,OAAO,KAAK,CAAC,GAAG,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC"}

package/dist/errors.d.ts

@@ -13,7 +13,7 @@
  * `error.<reason>` keys. Listed for docs and coverage checks; a reason missing
  * from this list still renders (as the server's `message`).
  */
-export declare const ERROR_REASONS: readonly ["form_password_incorrect", "form_code_incorrect", "form_code_already_used", "form_code_expired", "form_code_max_attempts", "form_link_invalid", "form_identifier_not_found", "form_identifier_exists", "form_password_pwned", "form_password_too_short", "form_password_too_long", "form_password_requires_uppercase", "form_password_requires_lowercase", "form_password_requires_number", "form_password_requires_symbol", "form_password_not_allowed", "form_password_contains_identifier", "form_password_same_as_current", "form_password_reused", "password_expired", "email_not_verified", "mfa_setup_unavailable", "sign_in_token_invalid", "too_many_attempts", "too_many_requests", "captcha_required", "captcha_failed", "captcha_unavailable", "email_delivery_unavailable", "email_address_unreachable", "strategy_disabled", "sign_up_restricted", "sign_up_denied", "password_not_yet_usable", "account_deleted", "waitlisted", "identifier_not_allowed", "disposable_email_blocked", "sso_required", "sign_ins_disabled", "sign_ups_disabled", "high_risk_blocked", "sms_region_blocked", "github_team_required", "app_approval_denied", "app_approval_expired"];
+export declare const ERROR_REASONS: readonly ["form_password_incorrect", "form_code_incorrect", "form_code_already_used", "form_code_expired", "form_code_max_attempts", "form_link_invalid", "form_identifier_not_found", "form_identifier_exists", "form_password_pwned", "form_password_too_short", "form_password_too_long", "form_password_requires_uppercase", "form_password_requires_lowercase", "form_password_requires_number", "form_password_requires_symbol", "form_password_not_allowed", "form_password_contains_identifier", "form_password_same_as_current", "form_password_reused", "password_expired", "email_not_verified", "mfa_setup_unavailable", "sign_in_token_invalid", "too_many_attempts", "too_many_requests", "captcha_required", "captcha_failed", "captcha_unavailable", "email_delivery_unavailable", "email_address_unreachable", "strategy_disabled", "sign_up_restricted", "sign_up_denied", "password_not_yet_usable", "account_deleted", "waitlisted", "identifier_not_allowed", "disposable_email_blocked", "sso_required", "sign_ins_disabled", "sign_ups_disabled", "high_risk_blocked", "sms_region_blocked", "github_team_required", "app_approval_denied", "app_approval_expired", "captcha_wrong_flow"];
 /** A reason with a string in every shipped catalog. */
 export type ErrorReason = (typeof ERROR_REASONS)[number];
 /** The catalog key for a reason: `error.<reason>`. */
@@ -56,3 +56,10 @@ export declare function localizedErrorMessage(error: ErrorLike | string | null |
  * `localization` bundle use it as the `Accept-Language` they send.
  */
 export declare function catalogLocale(catalog: object | null | undefined): string | undefined;
+/**
+ * The sentence for a stable `reason` in the app's language: the catalog string
+ * `error.<reason>` from `localization` (a `@atlasauth/localizations` bundle or a
+ * lookup function), else `fallback`, else a generic sentence. Never empty.
+ * For headless sign-in: `reasonMessage(flow.getSnapshot().reason, esES)`.
+ */
+export declare function reasonMessage(reason: string | null | undefined, localization?: ErrorStrings | null, fallback?: string): string;

package/dist/errors.js

@@ -14,6 +14,7 @@ exports.ERROR_REASONS = void 0;
 exports.errorReasonKey = errorReasonKey;
 exports.localizedErrorMessage = localizedErrorMessage;
 exports.catalogLocale = catalogLocale;
+exports.reasonMessage = reasonMessage;
 /**
  * The reasons the Frontend API sends that every shipped catalog translates, as
  * `error.<reason>` keys. Listed for docs and coverage checks; a reason missing
@@ -66,6 +67,7 @@ exports.ERROR_REASONS = Object.freeze([
     'github_team_required',
     'app_approval_denied',
     'app_approval_expired',
+    'captcha_wrong_flow',
 ]);
 /** The catalog key for a reason: `error.<reason>`. */
 function errorReasonKey(reason) {
@@ -148,4 +150,13 @@ function catalogLocale(catalog) {
     const tag = catalog.locale;
     return typeof tag === 'string' && tag.trim() !== '' ? tag : undefined;
 }
+/**
+ * The sentence for a stable `reason` in the app's language: the catalog string
+ * `error.<reason>` from `localization` (a `@atlasauth/localizations` bundle or a
+ * lookup function), else `fallback`, else a generic sentence. Never empty.
+ * For headless sign-in: `reasonMessage(flow.getSnapshot().reason, esES)`.
+ */
+function reasonMessage(reason, localization, fallback) {
+    return localizedErrorMessage({ reason, message: fallback }, localization);
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AA4DH,wCAEC;AAyED,sDAcC;AAOD,sCAIC;AA9JD;;;;GAIG;AACU,QAAA,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,yBAAyB;IACzB,qBAAqB;IACrB,wBAAwB;IACxB,mBAAmB;IACnB,wBAAwB;IACxB,mBAAmB;IACnB,2BAA2B;IAC3B,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,wBAAwB;IACxB,kCAAkC;IAClC,kCAAkC;IAClC,+BAA+B;IAC/B,+BAA+B;IAC/B,2BAA2B;IAC3B,mCAAmC;IACnC,+BAA+B;IAC/B,sBAAsB;IACtB,kBAAkB;IAClB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,qBAAqB;IACrB,4BAA4B;IAC5B,2BAA2B;IAC3B,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;IAChB,yBAAyB;IACzB,iBAAiB;IACjB,YAAY;IACZ,wBAAwB;IACxB,0BAA0B;IAC1B,cAAc;IACd,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;CACd,CAAC,CAAC;AAKZ,sDAAsD;AACtD,SAAgB,cAAc,CAAC,MAAc;IAC3C,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAqBD,yEAAyE;AACzE,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAEhE,4EAA4E;AAC5E,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAuB;IAC5D,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,QAAQ,GAAG,KAAK,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,MAAM,CAAC,OAAwC,EAAE,GAAW;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,KAAc,CAAC;IACnB,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,KAAK,GAAI,OAAoC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;YACxD,CAAC,CAAE,OAAmC,CAAC,GAAG,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,qBAAqB,CACnC,KAA4C,EAC5C,OAA6B,EAC7B,QAA8B;IAE9B,MAAM,GAAG,GAAc,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACrF,OAAO,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,aAAa,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAAkC;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,GAAG,GAAI,OAAgC,CAAC,MAAM,CAAC;IACrD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AA6DH,wCAEC;AAyED,sDAcC;AAOD,sCAIC;AAQD,sCAEC;AAzKD;;;;GAIG;AACU,QAAA,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,yBAAyB;IACzB,qBAAqB;IACrB,wBAAwB;IACxB,mBAAmB;IACnB,wBAAwB;IACxB,mBAAmB;IACnB,2BAA2B;IAC3B,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,wBAAwB;IACxB,kCAAkC;IAClC,kCAAkC;IAClC,+BAA+B;IAC/B,+BAA+B;IAC/B,2BAA2B;IAC3B,mCAAmC;IACnC,+BAA+B;IAC/B,sBAAsB;IACtB,kBAAkB;IAClB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,qBAAqB;IACrB,4BAA4B;IAC5B,2BAA2B;IAC3B,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;IAChB,yBAAyB;IACzB,iBAAiB;IACjB,YAAY;IACZ,wBAAwB;IACxB,0BAA0B;IAC1B,cAAc;IACd,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;IACtB,oBAAoB;CACZ,CAAC,CAAC;AAKZ,sDAAsD;AACtD,SAAgB,cAAc,CAAC,MAAc;IAC3C,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAqBD,yEAAyE;AACzE,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAEhE,4EAA4E;AAC5E,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAuB;IAC5D,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,QAAQ,GAAG,KAAK,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,MAAM,CAAC,OAAwC,EAAE,GAAW;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,KAAc,CAAC;IACnB,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,KAAK,GAAI,OAAoC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;YACxD,CAAC,CAAE,OAAmC,CAAC,GAAG,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,qBAAqB,CACnC,KAA4C,EAC5C,OAA6B,EAC7B,QAA8B;IAE9B,MAAM,GAAG,GAAc,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACrF,OAAO,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,aAAa,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAAkC;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,GAAG,GAAI,OAAgC,CAAC,MAAM,CAAC;IACrD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,MAAiC,EAAE,YAAkC,EAAE,QAAiB;IACpH,OAAO,qBAAqB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;AAC5E,CAAC"}

package/dist/fapi.d.ts

@@ -446,8 +446,10 @@ export declare function completeRequiredAction(client: FapiClient, state: FlowSt
     first_name?: string;
     last_name?: string;
     username?: string;
-    step?: 'send' | 'verify';
+    step?: 'send' | 'verify' | 'start';
     code?: string;
+    /** `identity_verification` with `step: 'start'`: where the person returns to. */
+    redirect_url?: string;
     /** `complete_profile`: values by field key. */
     fields?: Record<string, string>;
     /** `complete_profile`: ask again later (optional fields only). */