@atlasauth/js 0.41.0 → 0.43.0

package/dist/sign-in-screen.js

@@ -0,0 +1,298 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSignInScreen = createSignInScreen;
+/**
+ * The view-model of a sign-in screen, with no UI and no framework.
+ *
+ * `createSignInScreen()` drives `createSignInFlow()` and answers the questions a
+ * screen asks: which step am I on, which methods can the person use, which
+ * fields do I draw, what do I show when it fails. You render `getView()`, call
+ * the actions, and re-render on `subscribe`. The server still decides the next
+ * step; this only shapes the flow's answers for a form. Errors come back as
+ * sentences in the app's language (`localization`), never as codes.
+ *
+ * The steps after the credentials are driven too: setting up a second factor
+ * (authenticator app with its QR code, or texts), saving the recovery codes,
+ * accepting policies and the required actions (new password, verify email,
+ * profile, a server-driven form, identity verification). `other` is only a step
+ * this SDK does not know yet; `flow` is there for it.
+ */
+const errors_1 = require("./errors");
+const sign_in_flow_1 = require("./sign-in-flow");
+const FIRST_FACTOR_METHODS = ['password', 'email_code'];
+const SECOND_FACTOR_METHODS = ['totp', 'backup_code', 'sms', 'email_code', 'passkey'];
+/** Dismissing a system sheet or a passkey prompt is the person's choice, not an error to show. */
+const SILENT = new Set(['passkey_cancelled', 'native_cancelled']);
+const FIELDS = {
+    identifier: { name: 'identifier', kind: 'text', autoComplete: 'username', secure: false },
+    password: { name: 'password', kind: 'password', autoComplete: 'current-password', secure: true },
+    code: { name: 'code', kind: 'code', autoComplete: 'one-time-code', secure: false },
+    backup: { name: 'code', kind: 'code', autoComplete: 'off', secure: false },
+};
+const FIELD_CODE = FIELDS.code;
+const FIELD_SECOND_CODE = { name: 'second_code', kind: 'code', autoComplete: 'one-time-code', secure: false };
+const FIELD_PHONE = { name: 'phone', kind: 'phone', autoComplete: 'tel', secure: false };
+const FIELD_NEW_PASSWORD = { name: 'new_password', kind: 'password', autoComplete: 'new-password', secure: true };
+const profileField = (f) => ({
+    name: f.key,
+    kind: f.type === 'password' ? 'password' : 'text',
+    autoComplete: f.type === 'password' ? 'new-password' : 'off',
+    secure: f.type === 'password',
+    label: f.label,
+    required: f.required,
+    ...(f.options?.length ? { options: f.options } : {}),
+});
+const screenStep = (step) => {
+    switch (step.type) {
+        case 'needs_identifier': return 'identifier';
+        case 'needs_first_factor': return 'first_factor';
+        case 'needs_second_factor': return 'second_factor';
+        case 'needs_captcha': return 'captcha';
+        case 'redirect': return 'redirect';
+        case 'complete': return 'complete';
+        case 'needs_mfa_enrollment': return 'enroll_second_factor';
+        case 'show_recovery_codes': return 'recovery_codes';
+        case 'needs_policy_acceptance': return 'policies';
+        case 'needs_email_verification': return 'email_verification';
+        case 'needs_required_action': return 'required_action';
+        default: return 'other';
+    }
+};
+function createSignInScreen(opts) {
+    const flow = (0, sign_in_flow_1.createSignInFlow)(opts);
+    const native = opts.nativeSignIn ?? {};
+    const listeners = new Set();
+    let selected = null;
+    let sentFor = null;
+    let lastStep = 'identifier';
+    const alternatives = () => {
+        const out = [];
+        if (native.passkey)
+            out.push('passkey');
+        if (native.apple)
+            out.push('apple');
+        if (native.google)
+            out.push('google');
+        return out;
+    };
+    const build = (snap) => {
+        const step = screenStep(snap.step);
+        if (step !== lastStep) {
+            lastStep = step;
+            selected = null;
+            sentFor = null;
+        }
+        const fs = snap.step;
+        const methods = fs.type === 'needs_first_factor'
+            ? FIRST_FACTOR_METHODS.filter((m) => fs.factors.includes(m))
+            : fs.type === 'needs_second_factor'
+                ? SECOND_FACTOR_METHODS.filter((m) => fs.factors.includes(m))
+                : fs.type === 'needs_mfa_enrollment'
+                    ? fs.methods.map((m) => (m === 'phone_code' ? 'sms' : 'totp'))
+                    : [];
+        const method = methods.length ? (selected && methods.includes(selected) ? selected : methods[0]) : null;
+        const enrolling = fs.type === 'needs_mfa_enrollment' ? fs.enrollment : null;
+        const enrollment = fs.type === 'needs_mfa_enrollment'
+            ? {
+                totp: enrolling?.strategy === 'totp' && enrolling.secret ? { secret: enrolling.secret, uri: enrolling.uri ?? '', qrSvg: enrolling.qrSvg ?? null, qrCode: enrolling.qrCode ?? null } : null,
+                totpCodes: fs.totpCodes,
+                phone: enrolling?.strategy === 'phone_code' ? (enrolling.phone ?? null) : null,
+            }
+            : null;
+        const action = fs.type === 'needs_required_action' ? fs.action : null;
+        const requiredAction = fs.type === 'needs_required_action' && action
+            ? {
+                kind: action.kind,
+                title: action.kind === 'journey_form' ? action.title : null,
+                intro: action.kind === 'journey_form' ? action.intro : null,
+                url: action.kind === 'identity_verification' || action.kind === 'custom' ? action.url : null,
+                status: action.kind === 'identity_verification' ? action.status : null,
+                remaining: fs.remaining,
+                skippable: action.kind === 'complete_profile' && action.fields.every((f) => !f.required),
+            }
+            : null;
+        let fields = [];
+        if (step === 'identifier')
+            fields = [FIELDS.identifier];
+        else if (step === 'first_factor' || step === 'second_factor') {
+            fields = method === 'password' ? [FIELDS.password] : method === 'backup_code' ? [FIELDS.backup] : method && method !== 'passkey' ? [FIELDS.code] : [];
+        }
+        else if (step === 'enroll_second_factor') {
+            if (method === 'sms')
+                fields = enrollment?.phone ? [FIELD_CODE] : [FIELD_PHONE];
+            else if (method === 'totp' && enrollment?.totp)
+                fields = enrollment.totpCodes === 2 ? [FIELD_CODE, FIELD_SECOND_CODE] : [FIELD_CODE];
+        }
+        else if (step === 'email_verification')
+            fields = [FIELD_CODE];
+        else if (action) {
+            switch (action.kind) {
+                case 'update_password':
+                    fields = [FIELD_NEW_PASSWORD];
+                    break;
+                case 'verify_email':
+                    fields = [FIELD_CODE];
+                    break;
+                case 'update_profile':
+                    fields = [
+                        { name: 'first_name', kind: 'text', autoComplete: 'off', secure: false },
+                        { name: 'last_name', kind: 'text', autoComplete: 'off', secure: false },
+                        { name: 'username', kind: 'text', autoComplete: 'username', secure: false },
+                    ];
+                    break;
+                case 'complete_profile':
+                case 'journey_form':
+                    fields = action.fields.map(profileField);
+                    break;
+                default: break;
+            }
+        }
+        const sends = method === 'email_code' || (method === 'sms' && step === 'second_factor');
+        const failure = snap.errors[0];
+        const silent = failure && SILENT.has((failure.reason ?? failure.code).toLowerCase());
+        return {
+            step,
+            methods,
+            method,
+            alternatives: step === 'identifier' ? alternatives() : [],
+            fields,
+            needsSend: (sends && sentFor !== method) || (action?.kind === 'verify_email' && sentFor === null),
+            codeSent: (sends && sentFor === method) || (action?.kind === 'verify_email' && sentFor !== null),
+            sentTo: snap.sentTo,
+            busy: snap.busy,
+            error: failure && !silent ? (0, errors_1.localizedErrorMessage)(failure, opts.localization) : snap.reason && !failure ? (0, errors_1.localizedErrorMessage)({ reason: snap.reason }, opts.localization) : null,
+            reason: failure ? (silent ? null : (failure.reason ?? snap.reason)) : snap.reason,
+            attemptId: snap.attemptId,
+            enrollment,
+            recoveryCodes: fs.type === 'show_recovery_codes' ? fs.codes : null,
+            policies: fs.type === 'needs_policy_acceptance' ? fs.policies : [],
+            requiredAction,
+            flowStep: snap.step,
+        };
+    };
+    let view = build(flow.getSnapshot());
+    flow.subscribe((snap) => {
+        view = build(snap);
+        for (const l of listeners)
+            l(view);
+        maybeAutoStart(view);
+    });
+    const refresh = () => {
+        view = build(flow.getSnapshot());
+        for (const l of listeners)
+            l(view);
+    };
+    const done = async (p) => void (await p);
+    const sendCode = async () => {
+        const { method, step, requiredAction } = view;
+        if (requiredAction?.kind === 'verify_email') {
+            sentFor = 'email_code';
+            return done(flow.sendEmailVerification());
+        }
+        if (step === 'enroll_second_factor')
+            return;
+        if (method !== 'email_code' && method !== 'sms')
+            return;
+        sentFor = method;
+        await done(step === 'first_factor' ? flow.sendEmailCode() : flow.sendSecondFactorCode(method));
+    };
+    // A lone authenticator-app option has nothing to choose: start its setup once per attempt.
+    let autoStarted = null;
+    const maybeAutoStart = (v) => {
+        if (v.step === 'enroll_second_factor' && v.method === 'totp' && !v.enrollment?.totp && !v.busy && autoStarted !== v.attemptId && v.methods.length === 1) {
+            autoStarted = v.attemptId;
+            void flow.startTotpEnrollment();
+        }
+    };
+    maybeAutoStart(view);
+    return {
+        getView: () => view,
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => void listeners.delete(listener);
+        },
+        flow,
+        async selectMethod(method) {
+            if (!view.methods.includes(method))
+                return;
+            selected = method;
+            refresh();
+            if (view.step === 'enroll_second_factor' && method === 'totp' && !view.enrollment?.totp)
+                await done(flow.startTotpEnrollment());
+        },
+        sendCode,
+        resend: sendCode,
+        async submit(values = {}) {
+            const { step, method } = view;
+            const code = (values.code ?? '').trim();
+            if (step === 'identifier')
+                return done(flow.submitIdentifier((values.identifier ?? '').trim()));
+            if (step === 'first_factor') {
+                if (method === 'password')
+                    return done(flow.submitPassword(values.password ?? ''));
+                if (method === 'email_code')
+                    return done(flow.submitEmailCode(code));
+                return;
+            }
+            if (step === 'enroll_second_factor') {
+                if (method === 'sms' && !view.enrollment?.phone)
+                    return done(flow.sendEnrollmentPhone((values.phone ?? '').trim()));
+                if (method === 'totp' || method === 'sms')
+                    return done(flow.submitEnrollmentCode(code, (values.second_code ?? '').trim()));
+                return;
+            }
+            if (step === 'email_verification')
+                return done(flow.submitEmailCode(code));
+            if (step === 'required_action') {
+                const kind = view.requiredAction?.kind;
+                if (kind === 'update_password')
+                    return done(flow.updatePassword(values.new_password ?? ''));
+                if (kind === 'verify_email')
+                    return done(flow.submitEmailVerificationCode(code));
+                if (kind === 'update_profile') {
+                    return done(flow.updateProfile({
+                        ...(values.first_name !== undefined ? { firstName: values.first_name } : {}),
+                        ...(values.last_name !== undefined ? { lastName: values.last_name } : {}),
+                        ...(values.username !== undefined ? { username: values.username } : {}),
+                    }));
+                }
+                if (kind === 'complete_profile' || kind === 'journey_form') {
+                    const { skip, ...rest } = values;
+                    return done(flow.submitRequiredFields(rest, skip === 'true' ? { skip: true } : {}));
+                }
+                return;
+            }
+            if (step === 'second_factor') {
+                if (method === 'passkey')
+                    return done(flow.submitPasskeySecondFactor(values.remember_device === 'true' ? { rememberDevice: true } : {}));
+                if (method === 'totp' || method === 'backup_code' || method === 'sms' || method === 'email_code') {
+                    return done(flow.submitSecondFactor(code, method, values.remember_device === 'true' ? { rememberDevice: true } : {}));
+                }
+            }
+        },
+        acknowledgeRecoveryCodes: () => done(flow.acknowledgeRecoveryCodes()),
+        acceptPolicies(options = {}) {
+            const acceptances = view.policies
+                .filter((p) => !options.only || options.only.includes(p.policy))
+                .map((p) => ({
+                policy: p.policy,
+                version_id: p.version_id,
+                content_sha256: p.content_sha256,
+                ...(p.display === 'checkbox' || p.display === 'scroll' || p.display === 'link' ? { display: p.display } : {}),
+                ...(options.scrolledToEnd ? { scrolled_to_end: true } : {}),
+                ...(options.viewMs !== undefined ? { view_ms: options.viewMs } : {}),
+            }));
+            return done(flow.acceptPolicies(acceptances));
+        },
+        startIdentityVerification: (redirectUrl) => done(flow.startIdentityVerification(redirectUrl)),
+        checkIdentityVerification: () => done(flow.checkIdentityVerification()),
+        signInWithPasskey: () => done(flow.signInWithPasskey()),
+        signInWithApple: () => done(flow.signInNative('apple')),
+        signInWithGoogle: () => done(flow.signInNative('google')),
+        submitCaptcha: (token) => done(flow.submitCaptcha(token)),
+        reset() {
+            flow.reset();
+        },
+    };
+}
+//# sourceMappingURL=sign-in-screen.js.map

package/dist/sign-in-screen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-screen.js","sourceRoot":"","sources":["../src/sign-in-screen.ts"],"names":[],"mappings":";;AA6MA,gDA2NC;AAxaD;;;;;;;;;;;;;;;GAeG;AACH,qCAAoE;AAGpE,iDAAgJ;AA+IhJ,MAAM,oBAAoB,GAAmB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AACxE,MAAM,qBAAqB,GAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AACtG,kGAAkG;AAClG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAElE,MAAM,MAAM,GAAuE;IACjF,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE;IACzF,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE;IAChG,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE;IAClF,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;CAC3E,CAAC;AAEF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;AAC/B,MAAM,iBAAiB,GAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3H,MAAM,WAAW,GAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACtG,MAAM,kBAAkB,GAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC/H,MAAM,YAAY,GAAG,CAAC,CAAyB,EAAe,EAAE,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,CAAC,GAAG;IACX,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;IACjD,YAAY,EAAE,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK;IAC5D,MAAM,EAAE,CAAC,CAAC,IAAI,KAAK,UAAU;IAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACrD,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,IAAc,EAAoB,EAAE;IACtD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,kBAAkB,CAAC,CAAC,OAAO,YAAY,CAAC;QAC7C,KAAK,oBAAoB,CAAC,CAAC,OAAO,cAAc,CAAC;QACjD,KAAK,qBAAqB,CAAC,CAAC,OAAO,eAAe,CAAC;QACnD,KAAK,eAAe,CAAC,CAAC,OAAO,SAAS,CAAC;QACvC,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;QACnC,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;QACnC,KAAK,sBAAsB,CAAC,CAAC,OAAO,sBAAsB,CAAC;QAC3D,KAAK,qBAAqB,CAAC,CAAC,OAAO,gBAAgB,CAAC;QACpD,KAAK,yBAAyB,CAAC,CAAC,OAAO,UAAU,CAAC;QAClD,KAAK,0BAA0B,CAAC,CAAC,OAAO,oBAAoB,CAAC;QAC7D,KAAK,uBAAuB,CAAC,CAAC,OAAO,iBAAiB,CAAC;QACvD,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;IAC1B,CAAC;AACH,CAAC,CAAC;AAEF,SAAgB,kBAAkB,CAAC,IAAyB;IAC1D,MAAM,IAAI,GAAG,IAAA,+BAAgB,EAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC3D,IAAI,QAAQ,GAAwB,IAAI,CAAC;IACzC,IAAI,OAAO,GAAwB,IAAI,CAAC;IACxC,IAAI,QAAQ,GAAqB,YAAY,CAAC;IAE9C,MAAM,YAAY,GAAG,GAAmB,EAAE;QACxC,MAAM,GAAG,GAAmB,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,IAAkB,EAAoB,EAAE;QACrD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QACrB,MAAM,OAAO,GACX,EAAE,CAAC,IAAI,KAAK,oBAAoB;YAC9B,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,qBAAqB;gBACjC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC7D,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,sBAAsB;oBAClC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;oBAC5E,CAAC,CAAC,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzG,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,MAAM,UAAU,GACd,EAAE,CAAC,IAAI,KAAK,sBAAsB;YAChC,CAAC,CAAC;gBACE,IAAI,EAAE,SAAS,EAAE,QAAQ,KAAK,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC1L,SAAS,EAAE,EAAE,CAAC,SAAS;gBACvB,KAAK,EAAE,SAAS,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;aAC/E;YACH,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,MAAM,cAAc,GAClB,EAAE,CAAC,IAAI,KAAK,uBAAuB,IAAI,MAAM;YAC3C,CAAC,CAAC;gBACE,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;gBAC3D,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;gBAC3D,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,uBAAuB,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;gBAC5F,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;gBACtE,SAAS,EAAE,EAAE,CAAC,SAAS;gBACvB,SAAS,EAAE,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;aACzF;YACH,CAAC,CAAC,IAAI,CAAC;QAEX,IAAI,MAAM,GAAkB,EAAE,CAAC;QAC/B,IAAI,IAAI,KAAK,YAAY;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;aACnD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7D,MAAM,GAAG,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxJ,CAAC;aAAM,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC3C,IAAI,MAAM,KAAK,KAAK;gBAAE,MAAM,GAAG,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;iBAC3E,IAAI,MAAM,KAAK,MAAM,IAAI,UAAU,EAAE,IAAI;gBAAE,MAAM,GAAG,UAAU,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvI,CAAC;aAAM,IAAI,IAAI,KAAK,oBAAoB;YAAE,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC;aAC3D,IAAI,MAAM,EAAE,CAAC;YAChB,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,iBAAiB;oBAAE,MAAM,GAAG,CAAC,kBAAkB,CAAC,CAAC;oBAAC,MAAM;gBAC7D,KAAK,cAAc;oBAAE,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC;oBAAC,MAAM;gBAClD,KAAK,gBAAgB;oBACnB,MAAM,GAAG;wBACP,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;wBACxE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;wBACvE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE;qBAC5E,CAAC;oBACF,MAAM;gBACR,KAAK,kBAAkB,CAAC;gBACxB,KAAK,cAAc;oBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBAAC,MAAM;gBACrE,OAAO,CAAC,CAAC,MAAM;YACjB,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,KAAK,YAAY,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,eAAe,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACrF,OAAO;YACL,IAAI;YACJ,OAAO;YACP,MAAM;YACN,YAAY,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE;YACzD,MAAM;YACN,SAAS,EAAE,CAAC,KAAK,IAAI,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,cAAc,IAAI,OAAO,KAAK,IAAI,CAAC;YACjG,QAAQ,EAAE,CAAC,KAAK,IAAI,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,cAAc,IAAI,OAAO,KAAK,IAAI,CAAC;YAChG,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,8BAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,8BAAqB,EAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;YAClL,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;YACjF,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU;YACV,aAAa,EAAE,EAAE,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;YAClE,QAAQ,EAAE,EAAE,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAClE,cAAc;YACd,QAAQ,EAAE,IAAI,CAAC,IAAI;SACpB,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE;QACtB,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACnC,cAAc,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAE,CAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QAC9C,IAAI,cAAc,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5C,OAAO,GAAG,YAAY,CAAC;YACvB,OAAO,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,KAAK,sBAAsB;YAAE,OAAO;QAC5C,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO;QACxD,OAAO,GAAG,MAAM,CAAC;QACjB,MAAM,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC;IAEF,2FAA2F;IAC3F,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,MAAM,cAAc,GAAG,CAAC,CAAmB,EAAE,EAAE;QAC7C,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxJ,WAAW,GAAG,CAAC,CAAC,SAAS,CAAC;YAC1B,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;IACF,cAAc,CAAC,IAAI,CAAC,CAAC;IAErB,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;QACnB,SAAS,CAAC,QAAQ;YAChB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI;QACJ,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO;YAC3C,QAAQ,GAAG,MAAM,CAAC;YAClB,OAAO,EAAE,CAAC;YACV,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAClI,CAAC;QACD,QAAQ;QACR,MAAM,EAAE,QAAQ;QAChB,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE;YACtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,KAAK,YAAY;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAChG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,IAAI,MAAM,KAAK,UAAU;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;gBACnF,IAAI,MAAM,KAAK,YAAY;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;gBACpC,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACpH,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC3H,OAAO;YACT,CAAC;YACD,IAAI,IAAI,KAAK,oBAAoB;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC;gBACvC,IAAI,IAAI,KAAK,iBAAiB;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC5F,IAAI,IAAI,KAAK,cAAc;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjF,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBAC9B,OAAO,IAAI,CACT,IAAI,CAAC,aAAa,CAAC;wBACjB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC5E,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACzE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACxE,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;oBAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;oBACjC,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACtF,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC7B,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzI,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;oBACjG,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACxH,CAAC;YACH,CAAC;QACH,CAAC;QACD,wBAAwB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACrE,cAAc,CAAC,OAAO,GAAG,EAAE;YACzB,MAAM,WAAW,GAAuB,IAAI,CAAC,QAAQ;iBAClD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;iBAC/D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAsC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5I,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC,CAAC;YACN,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,yBAAyB,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAC7F,yBAAyB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACvE,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvD,eAAe,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACvD,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzD,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACzD,KAAK;YACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/step-up-flow.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Step-up with no DOM: re-authenticate a signed-in session (cookie or bearer)
+ * by asking YOUR code for a credential, then retry the call that was refused.
+ *
+ * `createStepUp({ client, choose })` returns `withStepUp(call)`: it runs `call`,
+ * and when the server refuses it with STEP_UP_REQUIRED it asks `choose` for one
+ * of the factors the account holds (and the refusal accepts), re-verifies with
+ * `POST /v1/client/me/step_up`, and runs `call` once more. A passkey is run by
+ * `passkeyAssertion` (React Native: `nativePasskeyAssertion(Passkey)` from
+ * `@atlasauth/expo-passkeys`); everything else is a code or password you collect.
+ */
+import type { FieldError } from './attempt';
+import type { FapiClient, FapiResponse } from './fapi';
+import { type PasskeyAssertionProvider } from './passkey-second-factor';
+import { type StepUpResult } from './step-up';
+export type StepUpFactor = 'password' | 'passkey' | 'totp' | 'backup_code' | 'email_code';
+/** What the person picked. A passkey needs no input here: the platform prompt runs next. */
+export type StepUpChoice = {
+    strategy: 'password';
+    password: string;
+} | {
+    strategy: 'totp' | 'backup_code' | 'email_code';
+    code: string;
+} | {
+    strategy: 'passkey';
+};
+/** What `choose` is asked for. */
+export interface StepUpRequest {
+    /** The refused action (`email_change`, …), when the server named it. */
+    action: string | null;
+    /** The factors to offer: held by the account and accepted for this action. Never empty. */
+    factors: StepUpFactor[];
+    maxAgeSeconds: number | null;
+    /** The previous try failed (wrong code, cancelled passkey): show it and ask again. */
+    error: FieldError | null;
+    /** Email the step-up code (for the `email_code` factor). */
+    sendEmailCode(): Promise<FapiResponse<unknown>>;
+}
+export interface StepUpFlowOptions {
+    client: FapiClient;
+    /** Ask the person which factor to use and collect it; return null to cancel. */
+    choose: (request: StepUpRequest) => Promise<StepUpChoice | null> | StepUpChoice | null;
+    /** Runs the passkey prompt where there is no WebAuthn. Without it the browser's WebAuthn is used. */
+    passkeyAssertion?: PasskeyAssertionProvider;
+    /** Wrong credentials allowed before the last error is thrown. Default 3. */
+    maxAttempts?: number;
+}
+/**
+ * The step-up factors the signed-in account holds, or null when that cannot be
+ * read (the caller then offers everything the refusal accepts).
+ * `email_code` is always held: it goes to the primary address.
+ */
+export declare function heldStepUpFactors(client: FapiClient): Promise<StepUpFactor[] | null>;
+export declare function createStepUp(opts: StepUpFlowOptions): {
+    /** Run `call`; on STEP_UP_REQUIRED re-authenticate and run it once more. Throws `StepUpCancelledError` when `choose` returns null. */
+    withStepUp<T>(call: () => Promise<FapiResponse<T>>): Promise<FapiResponse<T>>;
+    /** Re-authenticate now (for example before opening a security page). */
+    reauthenticate(action?: string): Promise<StepUpResult>;
+};

package/dist/step-up-flow.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.heldStepUpFactors = heldStepUpFactors;
+exports.createStepUp = createStepUp;
+const passkey_second_factor_1 = require("./passkey-second-factor");
+const step_up_1 = require("./step-up");
+/**
+ * The step-up factors the signed-in account holds, or null when that cannot be
+ * read (the caller then offers everything the refusal accepts).
+ * `email_code` is always held: it goes to the primary address.
+ */
+async function heldStepUpFactors(client) {
+    const [me, mfa, passkeys] = await Promise.all([
+        client.get('/v1/client/me'),
+        client.get('/v1/client/me/mfa'),
+        client.get('/v1/client/me/passkeys'),
+    ]);
+    if (!me.ok || !mfa.ok)
+        return null;
+    const held = [];
+    if (me.data?.has_password === true)
+        held.push('password');
+    if (passkeys.ok && (passkeys.data?.data?.length ?? 0) > 0)
+        held.push('passkey');
+    if (mfa.data?.data?.some((f) => f.type === 'totp' && f.verified !== false))
+        held.push('totp');
+    if ((mfa.data?.backup_codes_remaining ?? 0) > 0)
+        held.push('backup_code');
+    held.push('email_code');
+    return held;
+}
+const KNOWN = ['password', 'passkey', 'totp', 'backup_code', 'email_code'];
+function createStepUp(opts) {
+    const { client } = opts;
+    /** Passkey step-up: the server's challenge, the platform prompt, the assertion body. Returns the input, or the error to show. */
+    const passkeyInput = async () => {
+        const started = await client.post('/v1/client/me/step_up/passkey', {});
+        if (!started.ok || !started.data)
+            return started.errors[0] ?? { code: 'UNAUTHENTICATED', message: 'Could not start the passkey check.' };
+        try {
+            const a = await (0, passkey_second_factor_1.passkeySecondFactorAssertion)(started.data, opts.passkeyAssertion ? { passkeyAssertion: opts.passkeyAssertion } : {});
+            return { strategy: 'passkey', challenge: a.challenge, credential_id: a.credential_id, authenticator_data: a.authenticator_data, client_data_json: a.client_data_json, signature: a.signature };
+        }
+        catch (e) {
+            return { code: 'passkey_cancelled', reason: 'passkey_cancelled', message: e instanceof Error ? e.message : 'The passkey prompt was cancelled.' };
+        }
+    };
+    /** One prompt per refusal: the held factors are read once, then every retry of the prompt reuses them. */
+    const makePrompt = () => {
+        let held;
+        return async (p) => {
+            held ??= heldStepUpFactors(client);
+            const mine = await held;
+            const accepted = p.acceptedFactors.filter((f) => KNOWN.includes(f));
+            const narrowed = mine ? accepted.filter((f) => mine.includes(f)) : accepted;
+            // Never trap the person with nothing to pick: if the read and the refusal disagree, offer what the refusal accepts.
+            const factors = narrowed.length ? narrowed : accepted;
+            let error = p.error;
+            for (;;) {
+                const choice = await opts.choose({ action: p.action, factors, maxAgeSeconds: p.maxAgeSeconds, error, sendEmailCode: p.sendEmailCode });
+                if (!choice)
+                    return null;
+                if (choice.strategy !== 'passkey')
+                    return choice;
+                const input = await passkeyInput();
+                if ('strategy' in input)
+                    return input;
+                error = input;
+            }
+        };
+    };
+    return {
+        /** Run `call`; on STEP_UP_REQUIRED re-authenticate and run it once more. Throws `StepUpCancelledError` when `choose` returns null. */
+        withStepUp(call) {
+            return (0, step_up_1.retryWithStepUp)(call, { client, prompt: makePrompt(), ...(opts.maxAttempts ? { maxAttempts: opts.maxAttempts } : {}) });
+        },
+        /** Re-authenticate now (for example before opening a security page). */
+        reauthenticate(action = 'sensitive_action') {
+            return (0, step_up_1.requireStepUp)(action, { client, prompt: makePrompt(), ...(opts.maxAttempts ? { maxAttempts: opts.maxAttempts } : {}) });
+        },
+    };
+}
+//# sourceMappingURL=step-up-flow.js.map

package/dist/step-up-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-flow.js","sourceRoot":"","sources":["../src/step-up-flow.ts"],"names":[],"mappings":";;AAoDA,8CAcC;AAID,oCA+CC;AAxGD,mEAAsG;AACtG,uCAAmH;AAiCnH;;;;GAIG;AACI,KAAK,UAAU,iBAAiB,CAAC,MAAkB;IACxD,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5C,MAAM,CAAC,GAAG,CAA6B,eAAe,CAAC;QACvD,MAAM,CAAC,GAAG,CAA2F,mBAAmB,CAAC;QACzH,MAAM,CAAC,GAAG,CAAuB,wBAAwB,CAAC;KAC3D,CAAC,CAAC;IACH,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,IAAI,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9F,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,sBAAsB,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,KAAK,GAAmB,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AAE3F,SAAgB,YAAY,CAAC,IAAuB;IAClD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAExB,iIAAiI;IACjI,MAAM,YAAY,GAAG,KAAK,IAAuC,EAAE;QACjE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAA0B,+BAA+B,EAAE,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;QACzI,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAA,oDAA4B,EAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrI,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QACjM,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,EAAE,CAAC;QACnJ,CAAC;IACH,CAAC,CAAC;IAEF,0GAA0G;IAC1G,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,IAAI,IAAgD,CAAC;QACrD,OAAO,KAAK,EAAE,CAAe,EAA+B,EAAE;YAC5D,IAAI,KAAK,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAiB,CAAC,CAAC,CAAC;YACvG,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC5E,oHAAoH;YACpH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtD,IAAI,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACpB,SAAS,CAAC;gBACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;gBACvI,IAAI,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAC;gBACzB,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;oBAAE,OAAO,MAAM,CAAC;gBACjD,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;gBACnC,IAAI,UAAU,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBACtC,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,sIAAsI;QACtI,UAAU,CAAI,IAAoC;YAChD,OAAO,IAAA,yBAAe,EAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,wEAAwE;QACxE,cAAc,CAAC,MAAM,GAAG,kBAAkB;YACxC,OAAO,IAAA,uBAAa,EAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACjI,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * package.json at runtime) so the bundle stays dependency-free and tests stay
  * deterministic; `version.test.ts` fails when it drifts from package.json.
  */
-export declare const ATLAS_JS_VERSION = "0.41.0";
+export declare const ATLAS_JS_VERSION = "0.43.0";

package/dist/version.js

@@ -7,5 +7,5 @@ exports.ATLAS_JS_VERSION = void 0;
  * package.json at runtime) so the bundle stays dependency-free and tests stay
  * deterministic; `version.test.ts` fails when it drifts from package.json.
  */
-exports.ATLAS_JS_VERSION = '0.41.0';
+exports.ATLAS_JS_VERSION = '0.43.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/js",
-  "version": "0.41.0",
+  "version": "0.43.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {