@atlasauth/js 0.41.0 → 0.43.0

package/dist/account-security.d.ts

@@ -6,6 +6,7 @@
  */
 import type { FieldError } from './attempt';
 import type { FapiClient } from './fapi';
+import { type StepUpRequirement } from './step-up';
 export type PasswordChangeResult = {
     ok: true;
     userId: string;
@@ -81,3 +82,158 @@ export type RevokeAllTrustedDevicesResult = {
 };
 /** Forget every device this user trusted: each must pass two-factor again on its next sign-in. `count` is how many were forgotten. */
 export declare function revokeAllTrustedDevices(client: FapiClient): Promise<RevokeAllTrustedDevicesResult>;
+/**
+ * A refused security-page call. `stepUpRequired` is true when the server answered `STEP_UP_REQUIRED` (the session
+ * must prove a credential again first); `stepUp` says which factors it accepts. Re-authenticate with `stepUp()`
+ * (or `retryWithStepUp`) and call again.
+ */
+export interface SecurityFailure {
+    ok: false;
+    errors: FieldError[];
+    status: number;
+    stepUpRequired: boolean;
+    stepUp?: StepUpRequirement;
+}
+/** One of the user's sessions (a signed-in device). */
+export interface AccountSession {
+    id: string;
+    status: string;
+    /** The session making this call. Cookie and session-token (bearer) callers both get it marked. */
+    current: boolean;
+    lastActiveAt: number;
+    expiresAt: number;
+    createdAt: number;
+    ipAddress: string | null;
+    deviceLabel: string | null;
+    browser: string | null;
+    os: string | null;
+    deviceType: string | null;
+    location: string | null;
+}
+export type AccountSessionsResult = {
+    ok: true;
+    sessions: AccountSession[];
+} | SecurityFailure;
+/** The signed-in user's sessions, newest activity first as the server orders them. */
+export declare function listSessions(client: FapiClient): Promise<AccountSessionsResult>;
+export type RevokeSessionResult = {
+    ok: true;
+} | SecurityFailure;
+/** Sign one session out. Revoking the current session signs this device out too. */
+export declare function revokeAccountSession(client: FapiClient, id: string): Promise<RevokeSessionResult>;
+export type RevokeOtherSessionsResult = {
+    ok: true;
+    count: number;
+} | SecurityFailure;
+/** Sign every OTHER session out; this one stays. `count` is how many ended. */
+export declare function revokeAllSessions(client: FapiClient): Promise<RevokeOtherSessionsResult>;
+/** A second factor on the account. `phone` is masked; the secret is never returned after enrolment. */
+export interface MfaFactorSummary {
+    id: string;
+    /** `totp`, `sms`, `hotp`, `yubikey`, `duo`, `push`, ... */
+    type: string;
+    verified: boolean;
+    phone?: string;
+    publicId?: string;
+    createdAt: number;
+}
+export type MfaFactorsResult = {
+    ok: true;
+    factors: MfaFactorSummary[];
+    backupCodesRemaining: number;
+} | SecurityFailure;
+/** The user's second factors and how many recovery codes are left. */
+export declare function listMfaFactors(client: FapiClient): Promise<MfaFactorsResult>;
+/** A started authenticator-app enrolment. The secret is shown once: render `qrSvg` (trusted markup from the server) or `uri`, then verify. */
+export interface TotpEnrollment {
+    factorId: string;
+    secret: string;
+    /** The `otpauth://` URI. */
+    uri: string;
+    /** The URI as an inline SVG QR code. */
+    qrSvg: string;
+    /** How many consecutive codes {@link verifyTotp} must send (1 or 2). */
+    requiredCodes: number;
+}
+export type StartTotpResult = {
+    ok: true;
+    enrollment: TotpEnrollment;
+} | SecurityFailure;
+/** Begin adding an authenticator app. Needs a recent sign-in: a stale session answers `stepUpRequired`. */
+export declare function startTotp(client: FapiClient): Promise<StartTotpResult>;
+export type VerifyFactorResult = {
+    ok: true;
+    factor: MfaFactorSummary;
+    /** One-time recovery codes, present when this factor was the account's first: show them now, they are not shown again. */
+    backupCodes?: string[];
+} | SecurityFailure;
+/** Confirm an authenticator app with the code(s) it shows (`requiredCodes` consecutive ones). */
+export declare function verifyTotp(client: FapiClient, factorId: string, codes: string[]): Promise<VerifyFactorResult>;
+export type StartSmsResult = {
+    ok: true;
+    factorId: string; /** The number the code went to, masked. */
+    phone: string;
+} | SecurityFailure;
+/** Begin texted codes: texts a code to `phone` (E.164). Refused when the app offers no SMS factor. */
+export declare function startSms(client: FapiClient, phone: string): Promise<StartSmsResult>;
+/** Confirm the texted number with the code that arrived. */
+export declare function verifySms(client: FapiClient, factorId: string, code: string): Promise<VerifyFactorResult>;
+export type RemoveMfaFactorResult = {
+    ok: true;
+} | SecurityFailure;
+/** Remove a second factor. Always needs a recent sign-in. */
+export declare function removeMfaFactor(client: FapiClient, factorId: string): Promise<RemoveMfaFactorResult>;
+export type RegenerateBackupCodesResult = {
+    ok: true;
+    codes: string[];
+} | SecurityFailure;
+/** Replace the recovery codes with a new set (the old ones stop working at once). Show them now: they are not shown again. Always needs a recent sign-in. */
+export declare function regenerateBackupCodes(client: FapiClient): Promise<RegenerateBackupCodesResult>;
+/** A passkey on the account (the credential id and key are never exposed). */
+export interface AccountPasskey {
+    id: string;
+    name: string | null;
+    backedUp: boolean;
+    lastUsedAt: number | null;
+    createdAt: number;
+    /** The authenticator model's name and icon, when the instance resolves them. */
+    authenticator: {
+        name: string | null;
+        icon: string | null;
+    } | null;
+}
+export type AccountPasskeysResult = {
+    ok: true;
+    passkeys: AccountPasskey[];
+} | SecurityFailure;
+/** The signed-in user's passkeys. */
+export declare function listPasskeys(client: FapiClient): Promise<AccountPasskeysResult>;
+export type RemovePasskeyResult = {
+    ok: true;
+} | SecurityFailure;
+/** Remove a passkey. Needs a recent sign-in. */
+export declare function removePasskey(client: FapiClient, id: string): Promise<RemovePasskeyResult>;
+export type UnlinkExternalAccountResult = {
+    ok: true;
+} | SecurityFailure;
+/**
+ * Unlink a connected sign-in provider. Needs a recent sign-in, and answers 409 `LAST_AUTH_METHOD`
+ * when it is the account's only way in (set a password or connect another provider first).
+ */
+export declare function unlinkExternalAccount(client: FapiClient, id: string): Promise<UnlinkExternalAccountResult>;
+/** One security-notification category and whether this user gets it. */
+export interface NotificationPreference {
+    category: string;
+    label: string;
+    enabled: boolean;
+    /** False for a category that cannot be turned off (grey the toggle out). */
+    optional: boolean;
+}
+export type NotificationPreferencesResult = {
+    ok: true;
+    preferences: NotificationPreference[];
+} | SecurityFailure;
+/** The user's security-notification preferences, every category included. */
+export declare function getNotificationPreferences(client: FapiClient): Promise<NotificationPreferencesResult>;
+/** Turn categories on or off, e.g. `{ new_device: false }`; returns the full resulting set. An unknown or non-optional category answers 400. */
+export declare function updateNotificationPreferences(client: FapiClient, preferences: Record<string, boolean>): Promise<NotificationPreferencesResult>;

package/dist/account-security.js

@@ -5,6 +5,22 @@ exports.setPassword = setPassword;
 exports.listTrustedDevices = listTrustedDevices;
 exports.revokeTrustedDevice = revokeTrustedDevice;
 exports.revokeAllTrustedDevices = revokeAllTrustedDevices;
+exports.listSessions = listSessions;
+exports.revokeAccountSession = revokeAccountSession;
+exports.revokeAllSessions = revokeAllSessions;
+exports.listMfaFactors = listMfaFactors;
+exports.startTotp = startTotp;
+exports.verifyTotp = verifyTotp;
+exports.startSms = startSms;
+exports.verifySms = verifySms;
+exports.removeMfaFactor = removeMfaFactor;
+exports.regenerateBackupCodes = regenerateBackupCodes;
+exports.listPasskeys = listPasskeys;
+exports.removePasskey = removePasskey;
+exports.unlinkExternalAccount = unlinkExternalAccount;
+exports.getNotificationPreferences = getNotificationPreferences;
+exports.updateNotificationPreferences = updateNotificationPreferences;
+const step_up_1 = require("./step-up");
 /**
  * Change the password of the signed-in user. Proves the CURRENT password (no recent sign-in needed),
  * applies the sign-up password policy, and signs the user's other sessions out unless the instance opted out.
@@ -56,4 +72,137 @@ async function revokeAllTrustedDevices(client) {
     const res = await client.request('/v1/client/me/trusted_devices', { method: 'DELETE' });
     return res.ok ? { ok: true, count: typeof res.data?.count === 'number' ? res.data.count : 0 } : { ok: false, errors: res.errors, status: res.status };
 }
+function failure(res) {
+    const stepUp = (0, step_up_1.stepUpRequirement)(res.errors);
+    return { ok: false, errors: res.errors, status: res.status, stepUpRequired: stepUp !== null, ...(stepUp ? { stepUp } : {}) };
+}
+/** The signed-in user's sessions, newest activity first as the server orders them. */
+async function listSessions(client) {
+    const res = await client.get('/v1/client/sessions');
+    if (!res.ok || !res.data)
+        return failure(res);
+    return {
+        ok: true,
+        sessions: res.data.data.map((s) => ({
+            id: s.id,
+            status: s.status,
+            current: s.current === true,
+            lastActiveAt: s.last_active_at,
+            expiresAt: s.expire_at,
+            createdAt: s.created_at,
+            ipAddress: s.ip_address ?? null,
+            deviceLabel: s.device_label ?? null,
+            browser: s.browser ?? null,
+            os: s.os ?? null,
+            deviceType: s.device_type ?? null,
+            location: s.location ?? null,
+        })),
+    };
+}
+/** Sign one session out. Revoking the current session signs this device out too. */
+async function revokeAccountSession(client, id) {
+    const res = await client.post(`/v1/client/sessions/${encodeURIComponent(id)}/revoke`, {});
+    return res.ok ? { ok: true } : failure(res);
+}
+/** Sign every OTHER session out; this one stays. `count` is how many ended. */
+async function revokeAllSessions(client) {
+    const res = await client.post('/v1/client/sessions/revoke_all', {});
+    return res.ok ? { ok: true, count: typeof res.data?.sessions_revoked === 'number' ? res.data.sessions_revoked : 0 } : failure(res);
+}
+const factorOf = (f) => ({
+    id: f.id,
+    type: f.type,
+    verified: f.verified,
+    ...(f.phone ? { phone: f.phone } : {}),
+    ...(f.public_id ? { publicId: f.public_id } : {}),
+    createdAt: f.created_at,
+});
+/** The user's second factors and how many recovery codes are left. */
+async function listMfaFactors(client) {
+    const res = await client.get('/v1/client/me/mfa');
+    if (!res.ok || !res.data)
+        return failure(res);
+    return { ok: true, factors: res.data.data.map(factorOf), backupCodesRemaining: res.data.backup_codes_remaining ?? 0 };
+}
+/** Begin adding an authenticator app. Needs a recent sign-in: a stale session answers `stepUpRequired`. */
+async function startTotp(client) {
+    const res = await client.post('/v1/client/me/mfa/totp', {});
+    if (!res.ok || !res.data)
+        return failure(res);
+    const d = res.data;
+    return { ok: true, enrollment: { factorId: d.id, secret: d.secret, uri: d.uri, qrSvg: d.qr_svg, requiredCodes: d.required_codes ?? 1 } };
+}
+const verified = (d) => ({
+    ok: true,
+    factor: factorOf(d),
+    ...(d.backup_codes?.length ? { backupCodes: d.backup_codes } : {}),
+});
+/** Confirm an authenticator app with the code(s) it shows (`requiredCodes` consecutive ones). */
+async function verifyTotp(client, factorId, codes) {
+    const res = await client.post(`/v1/client/me/mfa/totp/${encodeURIComponent(factorId)}/verify`, { codes });
+    return res.ok && res.data ? verified(res.data) : failure(res);
+}
+/** Begin texted codes: texts a code to `phone` (E.164). Refused when the app offers no SMS factor. */
+async function startSms(client, phone) {
+    const res = await client.post('/v1/client/me/mfa/sms', { phone });
+    return res.ok && res.data ? { ok: true, factorId: res.data.id, phone: res.data.phone ?? '' } : failure(res);
+}
+/** Confirm the texted number with the code that arrived. */
+async function verifySms(client, factorId, code) {
+    const res = await client.post(`/v1/client/me/mfa/sms/${encodeURIComponent(factorId)}/verify`, { code });
+    return res.ok && res.data ? verified(res.data) : failure(res);
+}
+/** Remove a second factor. Always needs a recent sign-in. */
+async function removeMfaFactor(client, factorId) {
+    const res = await client.request(`/v1/client/me/mfa/${encodeURIComponent(factorId)}`, { method: 'DELETE' });
+    return res.ok ? { ok: true } : failure(res);
+}
+/** Replace the recovery codes with a new set (the old ones stop working at once). Show them now: they are not shown again. Always needs a recent sign-in. */
+async function regenerateBackupCodes(client) {
+    const res = await client.post('/v1/client/me/mfa/backup_codes', {});
+    return res.ok && res.data ? { ok: true, codes: res.data.codes } : failure(res);
+}
+/** The signed-in user's passkeys. */
+async function listPasskeys(client) {
+    const res = await client.get('/v1/client/me/passkeys');
+    if (!res.ok || !res.data)
+        return failure(res);
+    return {
+        ok: true,
+        passkeys: res.data.data.map((p) => ({
+            id: p.id,
+            name: p.name,
+            backedUp: p.backed_up,
+            lastUsedAt: p.last_used_at,
+            createdAt: p.created_at,
+            authenticator: p.authenticator ?? null,
+        })),
+    };
+}
+/** Remove a passkey. Needs a recent sign-in. */
+async function removePasskey(client, id) {
+    const res = await client.request(`/v1/client/me/passkeys/${encodeURIComponent(id)}`, { method: 'DELETE' });
+    return res.ok ? { ok: true } : failure(res);
+}
+/**
+ * Unlink a connected sign-in provider. Needs a recent sign-in, and answers 409 `LAST_AUTH_METHOD`
+ * when it is the account's only way in (set a password or connect another provider first).
+ */
+async function unlinkExternalAccount(client, id) {
+    const res = await client.request(`/v1/client/me/external_accounts/${encodeURIComponent(id)}`, { method: 'DELETE' });
+    return res.ok ? { ok: true } : failure(res);
+}
+/** The user's security-notification preferences, every category included. */
+async function getNotificationPreferences(client) {
+    const res = await client.get('/v1/client/me/notification_preferences');
+    return res.ok && res.data ? { ok: true, preferences: res.data.preferences } : failure(res);
+}
+/** Turn categories on or off, e.g. `{ new_device: false }`; returns the full resulting set. An unknown or non-optional category answers 400. */
+async function updateNotificationPreferences(client, preferences) {
+    const res = await client.request('/v1/client/me/notification_preferences', {
+        method: 'PATCH',
+        body: JSON.stringify({ preferences }),
+    });
+    return res.ok && res.data ? { ok: true, preferences: res.data.preferences } : failure(res);
+}
 //# sourceMappingURL=account-security.js.map

package/dist/account-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-security.js","sourceRoot":"","sources":["../src/account-security.ts"],"names":[],"mappings":";;AA2BA,wCAYC;AASD,kCAIC;AAsBD,gDAOC;AAKD,kDAGC;AAKD,0DAGC;AA5ED;;;;;GAKG;AACI,KAAK,UAAU,cAAc,CAAC,MAAkB,EAAE,KAAuD;IAC9G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAyF,+BAA+B,EAAE;QACrJ,gBAAgB,EAAE,KAAK,CAAC,eAAe;QACvC,YAAY,EAAE,KAAK,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACvF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;QACnB,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC;QAC/C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5G,CAAC;AACJ,CAAC;AAID;;;;GAIG;AACI,KAAK,UAAU,WAAW,CAAC,MAAkB,EAAE,QAAgB;IACpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAqC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9G,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAqBD,4CAA4C;AACrC,KAAK,UAAU,kBAAkB,CAAC,MAAkB;IACzD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAgC,+BAA+B,CAAC,CAAC;IAC7F,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACvF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;KACxJ,CAAC;AACJ,CAAC;AAID,2GAA2G;AACpG,KAAK,UAAU,mBAAmB,CAAC,MAAkB,EAAE,EAAU;IACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,iCAAiC,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3H,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACvF,CAAC;AAID,sIAAsI;AAC/H,KAAK,UAAU,uBAAuB,CAAC,MAAkB;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAqB,+BAA+B,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5G,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACxJ,CAAC"}
+{"version":3,"file":"account-security.js","sourceRoot":"","sources":["../src/account-security.ts"],"names":[],"mappings":";;AA4BA,wCAYC;AASD,kCAIC;AAsBD,gDAOC;AAKD,kDAGC;AAKD,0DAGC;AAyDD,oCAoBC;AAKD,oDAGC;AAKD,8CAGC;AAoCD,wCAIC;AAiBD,8BAKC;AAsBD,gCAGC;AAKD,4BAGC;AAGD,8BAGC;AAKD,0CAGC;AAKD,sDAGC;AA2BD,oCAcC;AAKD,sCAGC;AAQD,sDAGC;AAgBD,gEAGC;AAGD,sEAMC;AApYD,uCAAsE;AActE;;;;;GAKG;AACI,KAAK,UAAU,cAAc,CAAC,MAAkB,EAAE,KAAuD;IAC9G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAyF,+BAA+B,EAAE;QACrJ,gBAAgB,EAAE,KAAK,CAAC,eAAe;QACvC,YAAY,EAAE,KAAK,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACvF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;QACnB,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC;QAC/C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5G,CAAC;AACJ,CAAC;AAID;;;;GAIG;AACI,KAAK,UAAU,WAAW,CAAC,MAAkB,EAAE,QAAgB;IACpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAqC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9G,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAqBD,4CAA4C;AACrC,KAAK,UAAU,kBAAkB,CAAC,MAAkB;IACzD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAgC,+BAA+B,CAAC,CAAC;IAC7F,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACvF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;KACxJ,CAAC;AACJ,CAAC;AAID,2GAA2G;AACpG,KAAK,UAAU,mBAAmB,CAAC,MAAkB,EAAE,EAAU;IACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,iCAAiC,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3H,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACvF,CAAC;AAID,sIAAsI;AAC/H,KAAK,UAAU,uBAAuB,CAAC,MAAkB;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAqB,+BAA+B,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5G,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACxJ,CAAC;AAeD,SAAS,OAAO,CAAC,GAA0B;IACzC,MAAM,MAAM,GAAG,IAAA,2BAAiB,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/H,CAAC;AAsCD,sFAAsF;AAC/E,KAAK,UAAU,YAAY,CAAC,MAAkB;IACnD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAA0B,qBAAqB,CAAC,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI;YAC3B,YAAY,EAAE,CAAC,CAAC,cAAc;YAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;YAC/B,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;YACnC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;YAC1B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI;YAChB,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;YACjC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;SAC7B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAID,oFAAoF;AAC7E,KAAK,UAAU,oBAAoB,CAAC,MAAkB,EAAE,EAAU;IACvE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAU,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnG,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAID,+EAA+E;AACxE,KAAK,UAAU,iBAAiB,CAAC,MAAkB;IACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAgC,gCAAgC,EAAE,EAAE,CAAC,CAAC;IACnG,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,IAAI,EAAE,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACrI,CAAC;AAwBD,MAAM,QAAQ,GAAG,CAAC,CAAgB,EAAoB,EAAE,CAAC,CAAC;IACxD,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,UAAU;CACxB,CAAC,CAAC;AAIH,sEAAsE;AAC/D,KAAK,UAAU,cAAc,CAAC,MAAkB;IACrD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAA6D,mBAAmB,CAAC,CAAC;IAC9G,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,EAAE,CAAC;AACxH,CAAC;AAgBD,2GAA2G;AACpG,KAAK,UAAU,SAAS,CAAC,MAAkB;IAChD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAuF,wBAAwB,EAAE,EAAE,CAAC,CAAC;IAClJ,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;IACnB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,EAAE,EAAE,CAAC;AAC3I,CAAC;AAeD,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAAsB,EAAE,CAAC,CAAC;IAC/D,EAAE,EAAE,IAAI;IACR,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnB,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAEH,iGAAiG;AAC1F,KAAK,UAAU,UAAU,CAAC,MAAkB,EAAE,QAAgB,EAAE,KAAe;IACpF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAqB,0BAA0B,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9H,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAID,sGAAsG;AAC/F,KAAK,UAAU,QAAQ,CAAC,MAAkB,EAAE,KAAa;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAgB,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC9G,CAAC;AAED,4DAA4D;AACrD,KAAK,UAAU,SAAS,CAAC,MAAkB,EAAE,QAAgB,EAAE,IAAY;IAChF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAqB,yBAAyB,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5H,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAID,6DAA6D;AACtD,KAAK,UAAU,eAAe,CAAC,MAAkB,EAAE,QAAgB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrH,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAID,6JAA6J;AACtJ,KAAK,UAAU,qBAAqB,CAAC,MAAkB;IAC5D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAsB,gCAAgC,EAAE,EAAE,CAAC,CAAC;IACzF,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACjF,CAAC;AA0BD,qCAAqC;AAC9B,KAAK,UAAU,YAAY,CAAC,MAAkB;IACnD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAA0B,wBAAwB,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,UAAU,EAAE,CAAC,CAAC,YAAY;YAC1B,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI;SACvC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAID,gDAAgD;AACzC,KAAK,UAAU,aAAa,CAAC,MAAkB,EAAE,EAAU;IAChE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,0BAA0B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpH,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAID;;;GAGG;AACI,KAAK,UAAU,qBAAqB,CAAC,MAAkB,EAAE,EAAU;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,mCAAmC,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7H,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAeD,6EAA6E;AACtE,KAAK,UAAU,0BAA0B,CAAC,MAAkB;IACjE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAA4C,wCAAwC,CAAC,CAAC;IAClH,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,gJAAgJ;AACzI,KAAK,UAAU,6BAA6B,CAAC,MAAkB,EAAE,WAAoC;IAC1G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAA4C,wCAAwC,EAAE;QACpH,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC"}

package/dist/api-keys.d.ts

@@ -27,6 +27,12 @@ export interface UserApiKey {
     last_used_at: number | null;
     expires_at: number | null;
     revoked_at: number | null;
+    /** Why it was revoked when you did not: `membership_ended`, `creator_departed` or `organization_deleted`. */
+    revoked_reason?: string | null;
+    /** The organization a key of yours is bound to (it ends when you leave that organization); null = unbound. */
+    organization_id?: string | null;
+    /** The member who created an organization key. */
+    created_by_user_id?: string | null;
     created_at: number;
 }
 /** The create response: the key plus its one-time `secret`. */
@@ -61,8 +67,14 @@ export interface CreateUserApiKeyInput {
     scopes?: string[];
     /** Only claim names the application allows (`allowedClaims`). */
     claims?: Record<string, unknown>;
-    /** Create the key for this (active) organization instead of the user. */
+    /** Create the key for this (active) organization instead of the user. With `bindToOrganization`, the id of the organization to bind YOUR key to instead. */
     organizationId?: string;
+    /**
+     * With `organizationId`: make your own key BOUND to that organization (you must be a
+     * member) instead of the organization's key. It carries only what your role there
+     * allows and is revoked when you leave the organization.
+     */
+    bindToOrganization?: boolean;
     /** Key type (e.g. `sk`); required when the application sets `keyTypes`. */
     type?: string;
 }
@@ -87,6 +99,7 @@ export declare class ApiKeyRequestError extends Error {
 export declare function listApiKeys(client: FapiClient, options?: {
     organizationId?: string;
     type?: string;
+    bound?: boolean;
 }): Promise<UserApiKeyList>;
 /** Create a key. The returned `secret` is shown exactly once. */
 export declare function createApiKey(client: FapiClient, input?: CreateUserApiKeyInput): Promise<CreatedUserApiKey>;

package/dist/api-keys.js

@@ -51,6 +51,9 @@ async function listApiKeys(client, options = {}) {
     const params = new URLSearchParams();
     if (options.organizationId)
         params.set('organization_id', options.organizationId);
+    // With organizationId: your own keys bound to that organization, not the organization's keys.
+    if (options.bound && options.organizationId)
+        params.set('subject_type', 'user');
     if (options.type)
         params.set('type', options.type);
     const query = params.size ? `?${params}` : '';
@@ -79,6 +82,8 @@ async function createApiKey(client, input = {}) {
         body.claims = input.claims;
     if (input.organizationId !== undefined)
         body.organization_id = input.organizationId;
+    if (input.bindToOrganization)
+        body.subject_type = 'user';
     if (input.type !== undefined)
         body.type = input.type;
     return call(client, BASE, { method: 'POST', body: JSON.stringify(body) });

package/dist/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../src/api-keys.ts"],"names":[],"mappings":";;;AAkIA,kCAwBC;AAGD,oCAaC;AAGD,oCASC;AAGD,oCASC;AAOD,sCAuBC;AAeD,8BAcC;AAnLD,mEAAmE;AACnE,MAAa,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAS;IACb,MAAM,CAAS;IACf,KAAK,CAAU;IACxB;;;;OAIG;IACM,MAAM,CAAU;IACzB,mEAAmE;IAC1D,IAAI,CAA2B;IAExC,YACE,MAAc,EACd,IAAY,EACZ,OAAe,EACf,KAAc,EACd,MAAe,EACf,IAA8B;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACjC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,kEAAkE;IAClE,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC;IAC1C,CAAC;CACF;AAlCD,gDAkCC;AAED,MAAM,IAAI,GAAG,wBAAwB,CAAC;AAEtC,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,OAAoB,EAAE;IAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC1B,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,IAAI,IAAI,SAAS,EACxB,KAAK,EAAE,OAAO,IAAI,qBAAqB,EACvC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CACZ,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,UAAsD,EAAE;IAExD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAOpB,MAAM,EAAE,GAAG,IAAI,GAAG,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;QACxC,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;QACxC,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,IAAI,EAAE;QAChD,aAAa,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC;QACxC,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,iEAAiE;AAC1D,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,QAA+B,EAAE;IAEjC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACrD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IACrE,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC3F,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,cAAc,CAAC;IACpF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACrD,OAAO,IAAI,CAAoB,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,EAAU,EACV,KAA8B;IAE9B,OAAO,IAAI,CAAa,MAAM,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,EAAU;IAEV,OAAO,IAAI,CACT,MAAM,EACN,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAC1C,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,QAA2B,EAC3B,YAAsC,EACtC,gBAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,EAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACX,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AASD;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,aAAgC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAqB,CAAC,GAAG,KAAK,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC"}
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../src/api-keys.ts"],"names":[],"mappings":";;;AA8IA,kCA0BC;AAGD,oCAcC;AAGD,oCASC;AAGD,oCASC;AAOD,sCAuBC;AAeD,8BAcC;AAtLD,mEAAmE;AACnE,MAAa,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAS;IACb,MAAM,CAAS;IACf,KAAK,CAAU;IACxB;;;;OAIG;IACM,MAAM,CAAU;IACzB,mEAAmE;IAC1D,IAAI,CAA2B;IAExC,YACE,MAAc,EACd,IAAY,EACZ,OAAe,EACf,KAAc,EACd,MAAe,EACf,IAA8B;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACjC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,kEAAkE;IAClE,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC;IAC1C,CAAC;CACF;AAlCD,gDAkCC;AAED,MAAM,IAAI,GAAG,wBAAwB,CAAC;AAEtC,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,OAAoB,EAAE;IAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC1B,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,IAAI,IAAI,SAAS,EACxB,KAAK,EAAE,OAAO,IAAI,qBAAqB,EACvC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CACZ,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,UAAuE,EAAE;IAEzE,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAClF,8FAA8F;IAC9F,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAOpB,MAAM,EAAE,GAAG,IAAI,GAAG,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;QACxC,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;QACxC,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,IAAI,EAAE;QAChD,aAAa,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC;QACxC,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,iEAAiE;AAC1D,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,QAA+B,EAAE;IAEjC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACrD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IACrE,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC3F,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,cAAc,CAAC;IACpF,IAAI,KAAK,CAAC,kBAAkB;QAAE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACrD,OAAO,IAAI,CAAoB,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,EAAU,EACV,KAA8B;IAE9B,OAAO,IAAI,CAAa,MAAM,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,EAAU;IAEV,OAAO,IAAI,CACT,MAAM,EACN,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAC1C,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,QAA2B,EAC3B,YAAsC,EACtC,gBAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,EAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACX,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AASD;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,aAAgC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAqB,CAAC,GAAG,KAAK,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC"}

package/dist/index.d.ts

@@ -89,3 +89,7 @@ export * from './delegated-ui';
 export * from './external-passkeys';
 export * from './credentials';
 export * from './uma';
+export * from './step-up-flow';
+export * from './sign-in-screen';
+export * from './security-section';
+export * from './machine-enrolment';

package/dist/index.js

@@ -170,4 +170,11 @@ __exportStar(require("./external-passkeys"), exports);
 // Wallet-side helpers for verifiable credentials (receive an offer, present an SD-JWT VC).
 __exportStar(require("./credentials"), exports);
 __exportStar(require("./uma"), exports);
+// Step-up with no DOM: choose a held factor, re-verify, retry the refused call (bearer sessions included).
+__exportStar(require("./step-up-flow"), exports);
+// Sign-in and account-security screens as framework-free view-models (steps, methods, fields, human errors, step-up inside).
+__exportStar(require("./sign-in-screen"), exports);
+__exportStar(require("./security-section"), exports);
+// Mint a short enrolment code for a device the signed-in user owns.
+__exportStar(require("./machine-enrolment"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,mDAAiC;AACjC,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,uEAAuE;AACvE,6CAA2B;AAC3B,mGAAmG;AACnG,2DAAyC;AACzC,4GAA4G;AAC5G,sDAAoC;AACpC,+CAA6B;AAC7B,+EAA+E;AAC/E,6CAA2B;AAC3B,8DAA4C;AAC5C,gGAAgG;AAChG,6CAAgJ;AAAvI,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClG,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,2FAA2F;AAC3F,gDAA8B;AAC9B,+CAA6B;AAC7B,0GAA0G;AAC1G,mDAAiC;AACjC,+CAA6B;AAC7B,iFAAiF;AACjF,gDAA8B;AAC9B,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,sGAAsG;AACtG,qDAAmC;AACnC,6FAA6F;AAC7F,wCAAsB;AACtB,4CAA0B;AAC1B,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,kFAAkF;AAClF,oDAAkC;AAClC,mHAAmH;AACnH,qDAAmC;AACnC,yCAAuB;AACvB,yDAAuC;AACvC,iDAA+B;AAC/B,wDAAsC;AACtC,kDAAgC;AAChC,uDAAqC;AACrC,4CAA0B;AAC1B,8CAA4B;AAC5B,2DAA6G;AAApG,0HAAA,oBAAoB,OAAA;AAC7B,kDAAgC;AAChC,oDAAkC;AAClC,+DAA+D;AAC/D,kDAAgC;AAChC,qDAAmC;AACnC,iFAAiF;AACjF,iDAA+B;AAC/B,sFAAsF;AACtF,0DAAwC;AACxC,2CAAyB;AACzB,qDAAmC;AACnC,0DAAwC;AACxC,kEAAkE;AAClE,wCAAsB;AACtB,qDAAmC;AACnC,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,gDAA8B;AAC9B,mDAAiC;AACjC,kDAAgC;AAChC,gGAAgG;AAChG,uDAAqC;AACrC,+DAA6C;AAC7C,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,oDAAkC;AAClC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,yCAAuB;AACvB,yCAAuC;AAA9B,qGAAA,QAAQ,OAAA;AACjB,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAEjB,qDAAmC;AAEnC,yGAAyG;AACzG,iDAA+B;AAE/B,kFAAkF;AAClF,sDAAoC;AAEpC,2FAA2F;AAC3F,gDAA8B;AAC9B,wCAAsB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,mDAAiC;AACjC,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,uEAAuE;AACvE,6CAA2B;AAC3B,mGAAmG;AACnG,2DAAyC;AACzC,4GAA4G;AAC5G,sDAAoC;AACpC,+CAA6B;AAC7B,+EAA+E;AAC/E,6CAA2B;AAC3B,8DAA4C;AAC5C,gGAAgG;AAChG,6CAAgJ;AAAvI,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClG,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,2FAA2F;AAC3F,gDAA8B;AAC9B,+CAA6B;AAC7B,0GAA0G;AAC1G,mDAAiC;AACjC,+CAA6B;AAC7B,iFAAiF;AACjF,gDAA8B;AAC9B,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,sGAAsG;AACtG,qDAAmC;AACnC,6FAA6F;AAC7F,wCAAsB;AACtB,4CAA0B;AAC1B,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,kFAAkF;AAClF,oDAAkC;AAClC,mHAAmH;AACnH,qDAAmC;AACnC,yCAAuB;AACvB,yDAAuC;AACvC,iDAA+B;AAC/B,wDAAsC;AACtC,kDAAgC;AAChC,uDAAqC;AACrC,4CAA0B;AAC1B,8CAA4B;AAC5B,2DAA6G;AAApG,0HAAA,oBAAoB,OAAA;AAC7B,kDAAgC;AAChC,oDAAkC;AAClC,+DAA+D;AAC/D,kDAAgC;AAChC,qDAAmC;AACnC,iFAAiF;AACjF,iDAA+B;AAC/B,sFAAsF;AACtF,0DAAwC;AACxC,2CAAyB;AACzB,qDAAmC;AACnC,0DAAwC;AACxC,kEAAkE;AAClE,wCAAsB;AACtB,qDAAmC;AACnC,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,gDAA8B;AAC9B,mDAAiC;AACjC,kDAAgC;AAChC,gGAAgG;AAChG,uDAAqC;AACrC,+DAA6C;AAC7C,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,oDAAkC;AAClC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,yCAAuB;AACvB,yCAAuC;AAA9B,qGAAA,QAAQ,OAAA;AACjB,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAEjB,qDAAmC;AAEnC,yGAAyG;AACzG,iDAA+B;AAE/B,kFAAkF;AAClF,sDAAoC;AAEpC,2FAA2F;AAC3F,gDAA8B;AAC9B,wCAAsB;AAEtB,2GAA2G;AAC3G,iDAA+B;AAE/B,6HAA6H;AAC7H,mDAAiC;AACjC,qDAAmC;AACnC,oEAAoE;AACpE,sDAAoC"}

package/dist/machine-enrolment.d.ts

@@ -0,0 +1,26 @@
+/** A short code a signed-in user mints for a device of their own; the device redeems it to enrol. */
+import type { FieldError } from './attempt';
+import type { FapiClient } from './fapi';
+import { type StepUpRequirement } from './step-up';
+export type MachineEnrolmentCodeResult = {
+    ok: true;
+    /** The code to type on the device (`XXXX-XXXX`). Shown once. */
+    code: string;
+    id: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+    expiresIn: number;
+} | {
+    ok: false;
+    errors: FieldError[];
+    status: number;
+    stepUpRequired: boolean;
+    stepUp?: StepUpRequirement;
+};
+/**
+ * Mint a single-use enrolment code for a device the signed-in user owns. Needs a session (not a token);
+ * `expiresInSeconds` is 300 to 900 (default 600). A refused call that needs a fresh sign-in sets `stepUpRequired`.
+ */
+export declare function createMachineEnrolmentCode(client: FapiClient, opts?: {
+    expiresInSeconds?: number;
+}): Promise<MachineEnrolmentCodeResult>;

package/dist/machine-enrolment.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMachineEnrolmentCode = createMachineEnrolmentCode;
+const step_up_1 = require("./step-up");
+/**
+ * Mint a single-use enrolment code for a device the signed-in user owns. Needs a session (not a token);
+ * `expiresInSeconds` is 300 to 900 (default 600). A refused call that needs a fresh sign-in sets `stepUpRequired`.
+ */
+async function createMachineEnrolmentCode(client, opts = {}) {
+    const res = await client.post('/v1/client/me/machine_enrolment_codes', opts.expiresInSeconds === undefined ? {} : { expires_in_seconds: opts.expiresInSeconds });
+    if (!res.ok || !res.data) {
+        const stepUp = (0, step_up_1.stepUpRequirement)(res.errors);
+        return { ok: false, errors: res.errors, status: res.status, stepUpRequired: stepUp !== null, ...(stepUp ? { stepUp } : {}) };
+    }
+    return { ok: true, code: res.data.user_code, id: res.data.id, expiresAt: res.data.expires_at, expiresIn: res.data.expires_in };
+}
+//# sourceMappingURL=machine-enrolment.js.map

package/dist/machine-enrolment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-enrolment.js","sourceRoot":"","sources":["../src/machine-enrolment.ts"],"names":[],"mappings":";;AAqBA,gEAUC;AA5BD,uCAAsE;AActE;;;GAGG;AACI,KAAK,UAAU,0BAA0B,CAAC,MAAkB,EAAE,OAAsC,EAAE;IAC3G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,uCAAuC,EACvC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CACzF,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAA,2BAAiB,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/H,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;AACjI,CAAC"}

package/dist/organizations.d.ts

@@ -36,6 +36,12 @@ export interface OrganizationMember {
         last_name: string | null;
         image_url: string | null;
     } | null;
+    /** The seat's public metadata. */
+    public_metadata?: Record<string, unknown>;
+    /** Extra permissions on top of the role. Only for callers who manage members. */
+    permissions?: string[];
+    /** Sign-in methods whose sessions carry this organization's claims; null = any. Only for callers who manage members. */
+    allowed_sign_in_methods?: string[] | null;
 }
 export interface OrganizationInvitation {
     object: 'organization_invitation';
@@ -47,6 +53,14 @@ export interface OrganizationInvitation {
     inviter_user_id: string | null;
     expires_at: number;
     created_at: number;
+    delivery?: 'email' | 'link';
+    accept_by?: 'link' | 'verified_email' | null;
+    permissions?: string[];
+    allowed_sign_in_methods?: string[] | null;
+    /** Link delivery, on create and resend only, shown once: the single-use token. */
+    accept_token?: string;
+    /** Link delivery, on create only, shown once: `redirectUrl` with `?invitation_token=` appended. */
+    accept_url?: string | null;
 }
 /** What an accept page shows before the invitee signs in. */
 export interface PublicOrganizationInvitation {
@@ -209,6 +223,24 @@ export declare function updateMemberRole(client: FapiClient, organizationId: str
     user_id: string;
     role: string;
 }>;
+/**
+ * Change what a member's seat carries beyond the role: the full list of extra
+ * `permissions` (you may add only permissions you hold yourself) and/or the
+ * `allowedSignInMethods` whose sessions carry this organization's claims
+ * (`null` clears the restriction). Needs member management.
+ */
+export declare function updateMemberAccess(client: FapiClient, organizationId: string, userId: string, input: {
+    role?: string;
+    permissions?: string[];
+    allowedSignInMethods?: string[] | null;
+}): Promise<{
+    object: 'organization_membership';
+    organization_id: string;
+    user_id: string;
+    role: string;
+    permissions: string[];
+    allowed_sign_in_methods: string[] | null;
+}>;
 export declare function removeMember(client: FapiClient, organizationId: string, userId: string): Promise<unknown>;
 export declare function listOrganizationInvitations(client: FapiClient, organizationId: string, options?: {
     status?: string;
@@ -216,6 +248,15 @@ export declare function listOrganizationInvitations(client: FapiClient, organiza
 export declare function inviteMember(client: FapiClient, organizationId: string, input: {
     emailAddress: string;
     role: string;
+    /** `link`: nothing is sent; `accept_token` (and `accept_url` with `redirectUrl`) come back once. Default `email`. */
+    delivery?: 'email' | 'link';
+    /** Link delivery: who may accept by link. Default: the instance setting. */
+    acceptBy?: 'link' | 'verified_email';
+    /** Link delivery: a page in your app (an allowed origin) that reads `invitation_token`. */
+    redirectUrl?: string;
+    /** Extra permissions on top of the role; only ones you hold yourself. */
+    permissions?: string[];
+    allowedSignInMethods?: string[] | null;
 }): Promise<OrganizationInvitation>;
 export declare function revokeInvitation(client: FapiClient, organizationId: string, invitationId: string): Promise<OrganizationInvitation>;
 export declare function resendInvitation(client: FapiClient, organizationId: string, invitationId: string): Promise<OrganizationInvitation>;
@@ -223,6 +264,29 @@ export declare function resendInvitation(client: FapiClient, organizationId: str
 export declare function getOrganizationInvitation(client: FapiClient, invitationId: string): Promise<PublicOrganizationInvitation>;
 /** Accept an invitation by id as the signed-in user. */
 export declare function acceptOrganizationInvitation(client: FapiClient, invitationId: string): Promise<unknown>;
+/** The seat created by {@link acceptOrganizationInvitationByToken}. */
+export interface AcceptedInvitationMembership {
+    object: 'organization_membership';
+    id: string;
+    organization_id: string;
+    user_id: string;
+    role_id: string;
+    invitation_id: string;
+    invited_email_address: string;
+    /** The verified address of the accepting user (null when they hold none). */
+    accepted_email_address: string | null;
+    /** True when the accepting user's address differs from the invited one (link-holder acceptance). */
+    email_mismatch: boolean;
+    created_at: number;
+}
+/**
+ * Accept an invitation by the single-use token from its link
+ * (`delivery: "link"`), as the signed-in user. Pass the `invitation_token`
+ * your accept page received. Rate limited; a used, expired or unknown token
+ * fails (404 / 400), and who may accept follows the instance's
+ * `organizations.invitationAccept` or the invitation's `accept_by`.
+ */
+export declare function acceptOrganizationInvitationByToken(client: FapiClient, token: string): Promise<AcceptedInvitationMembership>;
 /** Invitations addressed to the signed-in user. */
 export declare function listMyOrganizationInvitations(client: FapiClient): Promise<OrganizationPage<Record<string, unknown>>>;
 export declare function acceptMyOrganizationInvitation(client: FapiClient, invitationId: string): Promise<unknown>;