@atlasauth/js 0.5.0 → 0.6.0

package/dist/captcha-widget.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Per-flow captcha rendering for the prebuilt sign-in / sign-up surfaces.
+ *
+ * The server tells the browser, per flow, which provider to render and in what
+ * mode (`GET /v1/appearance` → `captchaFlows`). This module loads that
+ * provider's script once, renders (or executes) its widget into a container,
+ * and resolves the token the flow's request then carries as `captcha_token`.
+ *
+ * Shared by `@atlasauth/react`'s `<SignIn>`/`<SignUp>` and the
+ * `@atlasauth/embed` widget, so both draw the same widget the same way.
+ *
+ * Only providers that expose a standard browser widget are renderable;
+ * score/edge/fingerprint providers (SEON, PerimeterX, Akamai, Kasada, Incapsula,
+ * mCaptcha, AWS WAF, …) are verified server-side from a token a custom
+ * integration supplies, so the prebuilt UIs do not draw them —
+ * {@link isRenderableCaptcha} is false and the caller proceeds without a token
+ * (the server still fails closed if it required one).
+ *
+ * Everything is SSR-safe: nothing touches `window`/`document` until a call that
+ * renders into a DOM element.
+ */
+/** The flows `captchaFlows` covers. */
+export type CaptchaFlowKey = 'signUp' | 'signIn' | 'guest' | 'passwordReset';
+/** How a widget-drawing provider renders. */
+export type CaptchaWidgetMode = 'invisible' | 'managed' | 'visible';
+/**
+ * One flow's public captcha settings, exactly as `/v1/appearance` →
+ * `captchaFlows[flow]` returns them. No secrets: the provider secret never
+ * leaves the server. `enabled` means "this flow ALWAYS requires a token"; the
+ * provider is still reported when it is false so a risk-triggered sign-in
+ * challenge can be drawn.
+ */
+export interface FlowCaptcha {
+    enabled: boolean;
+    provider?: string;
+    siteKey?: string | null;
+    widget?: CaptchaWidgetMode;
+}
+/** Whether the prebuilt UIs can draw this provider's widget. */
+export declare function isRenderableCaptcha(provider?: string | null): boolean;
+/** True when this flow always needs a rendered token before its request can proceed. */
+export declare function flowNeedsCaptcha(flow: FlowCaptcha | null | undefined): flow is FlowCaptcha;
+/** The two captcha error codes the Frontend API answers a gated request with. */
+export declare const CAPTCHA_ERROR_CODES: readonly string[];
+/** Whether a Frontend API error is a captcha refusal (missing or rejected token). */
+export declare function isCaptchaError(error: {
+    code?: string;
+} | null | undefined): boolean;
+type Win = Window & Record<string, unknown>;
+/**
+ * Load a provider's script and resolve its global. Idempotent: a second call for
+ * the same provider reuses the in-flight or resolved load. When the global is
+ * already present (a prior load, or a test that preset it) it resolves at once.
+ */
+export declare function loadCaptchaProvider(provider: string, siteKey: string, win: Win): Promise<unknown>;
+/** A widget rendered into a container: its eventual token, and a way to take it down. */
+export interface CaptchaWidgetHandle {
+    /** Resolves with the solved token; rejects on provider error/timeout or removal. */
+    token: Promise<string>;
+    /**
+     * Remove the widget (provider teardown + empty the container). Tokens are
+     * single-use, so call this after a submit spent the token and render a fresh
+     * widget for the next try.
+     */
+    remove(): void;
+}
+/**
+ * Render a flow's captcha widget into `container` and return a handle on its
+ * token. Loads the provider, renders/executes the right widget for the mode.
+ * `container` is where a visible/managed widget draws; score providers draw
+ * nothing there.
+ */
+export declare function renderCaptchaWidget(flow: FlowCaptcha, container: HTMLElement): CaptchaWidgetHandle;
+/**
+ * Obtain a captcha token for a flow: render the widget into `container` and
+ * resolve its token. Rejects on provider error/timeout — the caller decides
+ * whether to surface it or let the (fail-closed) server reject the tokenless
+ * request.
+ */
+export declare function getCaptchaToken(flow: FlowCaptcha, container: HTMLElement): Promise<string>;
+export {};

package/dist/captcha-widget.js

@@ -0,0 +1,263 @@
+"use strict";
+/**
+ * Per-flow captcha rendering for the prebuilt sign-in / sign-up surfaces.
+ *
+ * The server tells the browser, per flow, which provider to render and in what
+ * mode (`GET /v1/appearance` → `captchaFlows`). This module loads that
+ * provider's script once, renders (or executes) its widget into a container,
+ * and resolves the token the flow's request then carries as `captcha_token`.
+ *
+ * Shared by `@atlasauth/react`'s `<SignIn>`/`<SignUp>` and the
+ * `@atlasauth/embed` widget, so both draw the same widget the same way.
+ *
+ * Only providers that expose a standard browser widget are renderable;
+ * score/edge/fingerprint providers (SEON, PerimeterX, Akamai, Kasada, Incapsula,
+ * mCaptcha, AWS WAF, …) are verified server-side from a token a custom
+ * integration supplies, so the prebuilt UIs do not draw them —
+ * {@link isRenderableCaptcha} is false and the caller proceeds without a token
+ * (the server still fails closed if it required one).
+ *
+ * Everything is SSR-safe: nothing touches `window`/`document` until a call that
+ * renders into a DOM element.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CAPTCHA_ERROR_CODES = void 0;
+exports.isRenderableCaptcha = isRenderableCaptcha;
+exports.flowNeedsCaptcha = flowNeedsCaptcha;
+exports.isCaptchaError = isCaptchaError;
+exports.loadCaptchaProvider = loadCaptchaProvider;
+exports.renderCaptchaWidget = renderCaptchaWidget;
+exports.getCaptchaToken = getCaptchaToken;
+/** The providers the prebuilt UIs can natively render. */
+const RENDERABLE = new Set([
+    'turnstile',
+    'hcaptcha',
+    'recaptcha',
+    'recaptcha_v3',
+    'recaptcha_enterprise',
+]);
+/** Whether the prebuilt UIs can draw this provider's widget. */
+function isRenderableCaptcha(provider) {
+    return !!provider && RENDERABLE.has(provider);
+}
+/** True when this flow always needs a rendered token before its request can proceed. */
+function flowNeedsCaptcha(flow) {
+    return !!flow && flow.enabled === true && isRenderableCaptcha(flow.provider);
+}
+/** The two captcha error codes the Frontend API answers a gated request with. */
+exports.CAPTCHA_ERROR_CODES = ['CAPTCHA_REQUIRED', 'CAPTCHA_FAILED'];
+/** Whether a Frontend API error is a captcha refusal (missing or rejected token). */
+function isCaptchaError(error) {
+    return !!error && typeof error.code === 'string' && exports.CAPTCHA_ERROR_CODES.includes(error.code);
+}
+const SCRIPTS = {
+    turnstile: {
+        src: () => 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit',
+        global: 'turnstile',
+    },
+    hcaptcha: {
+        src: () => 'https://js.hcaptcha.com/1/api.js?render=explicit',
+        global: 'hcaptcha',
+    },
+    recaptcha: {
+        src: () => 'https://www.google.com/recaptcha/api.js?render=explicit',
+        global: 'grecaptcha',
+    },
+    recaptcha_v3: {
+        src: (siteKey) => `https://www.google.com/recaptcha/api.js?render=${encodeURIComponent(siteKey)}`,
+        global: 'grecaptcha',
+    },
+    recaptcha_enterprise: {
+        src: (siteKey) => `https://www.google.com/recaptcha/enterprise.js?render=${encodeURIComponent(siteKey)}`,
+        global: 'grecaptcha',
+    },
+};
+/**
+ * Load a provider's script and resolve its global. Idempotent: a second call for
+ * the same provider reuses the in-flight or resolved load. When the global is
+ * already present (a prior load, or a test that preset it) it resolves at once.
+ */
+function loadCaptchaProvider(provider, siteKey, win) {
+    const spec = SCRIPTS[provider];
+    if (!spec)
+        return Promise.reject(new Error(`captcha: ${provider} is not renderable`));
+    if (win[spec.global])
+        return Promise.resolve(win[spec.global]);
+    const doc = win.document;
+    const cacheKey = `__atlasCaptchaLoad_${provider}`;
+    const existing = win[cacheKey];
+    if (existing)
+        return existing;
+    const promise = new Promise((resolve, reject) => {
+        const done = () => {
+            if (win[spec.global])
+                resolve(win[spec.global]);
+            else
+                reject(new Error(`captcha: ${provider} script loaded but global missing`));
+        };
+        const src = spec.src(siteKey);
+        // Reuse a script tag another flow may have injected for the same src.
+        let el = doc.querySelector(`script[src="${src}"]`);
+        if (el) {
+            if (win[spec.global])
+                return resolve(win[spec.global]);
+            el.addEventListener('load', done, { once: true });
+            el.addEventListener('error', () => reject(new Error(`captcha: ${provider} script failed`)), {
+                once: true,
+            });
+            return;
+        }
+        el = doc.createElement('script');
+        el.src = src;
+        el.async = true;
+        el.defer = true;
+        el.addEventListener('load', done, { once: true });
+        el.addEventListener('error', () => reject(new Error(`captcha: ${provider} script failed`)), {
+            once: true,
+        });
+        (doc.head ?? doc.body ?? doc.documentElement).appendChild(el);
+    });
+    win[cacheKey] = promise;
+    // A failed load must not poison every later attempt (a flaky network, a
+    // content blocker toggled off): forget it so the next render retries.
+    promise.catch(() => {
+        if (win[cacheKey] === promise)
+            delete win[cacheKey];
+    });
+    return promise;
+}
+/** Cloudflare Turnstile: render into the container, resolve on the callback. */
+function turnstileToken(api, el, siteKey, mode, onTeardown) {
+    return new Promise((resolve, reject) => {
+        const id = api.render(el, {
+            sitekey: siteKey,
+            // Turnstile's own modes map cleanly onto ours.
+            appearance: mode === 'invisible' ? 'interaction-only' : 'always',
+            callback: (token) => resolve(token),
+            'error-callback': () => reject(new Error('captcha: turnstile error')),
+            'timeout-callback': () => reject(new Error('captcha: turnstile timeout')),
+        });
+        onTeardown(() => api.remove?.(id));
+        if (mode === 'invisible' && api.execute)
+            api.execute(id);
+    });
+}
+/** hCaptcha: render, then execute for invisible; resolve on the callback. */
+function hcaptchaToken(api, el, siteKey, mode, onTeardown) {
+    return new Promise((resolve, reject) => {
+        const id = api.render(el, {
+            sitekey: siteKey,
+            size: mode === 'invisible' ? 'invisible' : 'normal',
+            callback: (token) => resolve(token),
+            'error-callback': () => reject(new Error('captcha: hcaptcha error')),
+        });
+        onTeardown(() => api.remove?.(id));
+        if (mode === 'invisible') {
+            const r = api.execute(id, { async: true });
+            if (r && typeof r.then === 'function') {
+                r.then((v) => resolve(v.response), reject);
+            }
+        }
+    });
+}
+/** reCAPTCHA v2 (checkbox/invisible): render, resolve on callback. */
+function recaptchaV2Token(api, el, siteKey, mode, onTeardown) {
+    return new Promise((resolve, reject) => {
+        const id = api.render(el, {
+            sitekey: siteKey,
+            size: mode === 'invisible' ? 'invisible' : 'normal',
+            callback: (token) => resolve(token),
+            'error-callback': () => reject(new Error('captcha: recaptcha error')),
+        });
+        // reCAPTCHA has no remove(); reset frees the widget, the container is cleared.
+        onTeardown(() => api.reset?.(id));
+        if (mode === 'invisible' && api.execute) {
+            const r = api.execute(undefined, { widgetId: id });
+            if (r && typeof r.then === 'function') {
+                r.then(resolve, reject);
+            }
+        }
+    });
+}
+/** reCAPTCHA v3 / Enterprise (score): execute programmatically, no visible widget. */
+function recaptchaV3Token(api, siteKey) {
+    const run = () => {
+        const r = api.execute(siteKey, { action: 'submit' });
+        return r && typeof r.then === 'function'
+            ? r
+            : Promise.reject(new Error('captcha: recaptcha v3 execute returned no promise'));
+    };
+    return new Promise((resolve, reject) => {
+        if (api.ready)
+            api.ready(() => run().then(resolve, reject));
+        else
+            run().then(resolve, reject);
+    });
+}
+/**
+ * Render a flow's captcha widget into `container` and return a handle on its
+ * token. Loads the provider, renders/executes the right widget for the mode.
+ * `container` is where a visible/managed widget draws; score providers draw
+ * nothing there.
+ */
+function renderCaptchaWidget(flow, container) {
+    const provider = flow.provider ?? '';
+    const siteKey = flow.siteKey ?? '';
+    const mode = flow.widget ?? 'managed';
+    const win = (container.ownerDocument?.defaultView ?? globalThis);
+    let removed = false;
+    let teardown = null;
+    let cancel = null;
+    const onTeardown = (t) => {
+        teardown = t;
+    };
+    const token = new Promise((resolve, reject) => {
+        cancel = reject;
+        loadCaptchaProvider(provider, siteKey, win)
+            .then((api) => {
+            if (removed)
+                throw new Error('captcha: widget removed');
+            switch (provider) {
+                case 'turnstile':
+                    return turnstileToken(api, container, siteKey, mode, onTeardown);
+                case 'hcaptcha':
+                    return hcaptchaToken(api, container, siteKey, mode, onTeardown);
+                case 'recaptcha':
+                    return recaptchaV2Token(api, container, siteKey, mode, onTeardown);
+                case 'recaptcha_v3':
+                case 'recaptcha_enterprise':
+                    return recaptchaV3Token(api, siteKey);
+                default:
+                    throw new Error(`captcha: ${provider} is not renderable`);
+            }
+        })
+            .then(resolve, reject);
+    });
+    return {
+        token,
+        remove() {
+            if (removed)
+                return;
+            removed = true;
+            try {
+                teardown?.();
+            }
+            catch {
+                /* a vendor that already tore itself down */
+            }
+            while (container.firstChild)
+                container.removeChild(container.firstChild);
+            cancel?.(new Error('captcha: widget removed'));
+        },
+    };
+}
+/**
+ * Obtain a captcha token for a flow: render the widget into `container` and
+ * resolve its token. Rejects on provider error/timeout — the caller decides
+ * whether to surface it or let the (fail-closed) server reject the tokenless
+ * request.
+ */
+async function getCaptchaToken(flow, container) {
+    return renderCaptchaWidget(flow, container).token;
+}
+//# sourceMappingURL=captcha-widget.js.map

package/dist/captcha-widget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"captcha-widget.js","sourceRoot":"","sources":["../src/captcha-widget.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AAgCH,kDAEC;AAGD,4CAEC;AAMD,wCAEC;AAoDD,kDA2CC;AA8GD,kDAiDC;AAQD,0CAEC;AAjSD,0DAA0D;AAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,WAAW;IACX,UAAU;IACV,WAAW;IACX,cAAc;IACd,sBAAsB;CACvB,CAAC,CAAC;AAEH,gEAAgE;AAChE,SAAgB,mBAAmB,CAAC,QAAwB;IAC1D,OAAO,CAAC,CAAC,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,wFAAwF;AACxF,SAAgB,gBAAgB,CAAC,IAAoC;IACnE,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC/E,CAAC;AAED,iFAAiF;AACpE,QAAA,mBAAmB,GAAsB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;AAE7F,qFAAqF;AACrF,SAAgB,cAAc,CAAC,KAA2C;IACxE,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,2BAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC/F,CAAC;AAuBD,MAAM,OAAO,GAAyE;IACpF,SAAS,EAAE;QACT,GAAG,EAAE,GAAG,EAAE,CAAC,uEAAuE;QAClF,MAAM,EAAE,WAAW;KACpB;IACD,QAAQ,EAAE;QACR,GAAG,EAAE,GAAG,EAAE,CAAC,kDAAkD;QAC7D,MAAM,EAAE,UAAU;KACnB;IACD,SAAS,EAAE;QACT,GAAG,EAAE,GAAG,EAAE,CAAC,yDAAyD;QACpE,MAAM,EAAE,YAAY;KACrB;IACD,YAAY,EAAE;QACZ,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,kDAAkD,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACjG,MAAM,EAAE,YAAY;KACrB;IACD,oBAAoB,EAAE;QACpB,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CACf,yDAAyD,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACxF,MAAM,EAAE,YAAY;KACrB;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,QAAgB,EAAE,OAAe,EAAE,GAAQ;IAC7E,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,QAAQ,oBAAoB,CAAC,CAAC,CAAC;IACtF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC;IACzB,MAAM,QAAQ,GAAG,sBAAsB,QAAQ,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAiC,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;;gBAC3C,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,QAAQ,mCAAmC,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,sEAAsE;QACtE,IAAI,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC,eAAe,GAAG,IAAI,CAA6B,CAAC;QAC/E,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACvD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,QAAQ,gBAAgB,CAAC,CAAC,EAAE;gBAC1F,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACjC,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC;QACb,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC;QAChB,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC;QAChB,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,QAAQ,gBAAgB,CAAC,CAAC,EAAE;YAC1F,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;IACxB,wEAAwE;IACxE,sEAAsE;IACtE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;QACjB,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAKD,gFAAgF;AAChF,SAAS,cAAc,CACrB,GAAiB,EACjB,EAAe,EACf,OAAe,EACf,IAAuB,EACvB,UAAiC;IAEjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;YACxB,OAAO,EAAE,OAAO;YAChB,+CAA+C;YAC/C,UAAU,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ;YAChE,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;YAC3C,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACrE,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;SAC1E,CAAC,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,OAAO;YAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CACpB,GAAgB,EAChB,EAAe,EACf,OAAe,EACf,IAAuB,EACvB,UAAiC;IAEjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;YACxB,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YACnD,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;YAC3C,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;SACrE,CAAC,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,OAAQ,CAAmC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxE,CAAmC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CACvB,GAAkB,EAClB,EAAe,EACf,OAAe,EACf,IAAuB,EACvB,UAAiC;IAEjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;YACxB,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YACnD,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;YAC3C,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;SACtE,CAAC,CAAC;QACH,+EAA+E;QAC/E,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,OAAQ,CAAqB,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC1D,CAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,GAAkB,EAAE,OAAe;IAC3D,MAAM,GAAG,GAAG,GAAG,EAAE;QACf,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,OAAQ,CAAqB,CAAC,IAAI,KAAK,UAAU;YAC3D,CAAC,CAAE,CAAqB;YACxB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC;IACF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,GAAG,CAAC,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;;YACvD,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAcD;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,IAAiB,EAAE,SAAsB;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAsB,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,WAAW,IAAI,UAAU,CAAmB,CAAC;IAEnF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,MAAM,GAAgC,IAAI,CAAC;IAC/C,MAAM,UAAU,GAAG,CAAC,CAAW,EAAE,EAAE;QACjC,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpD,MAAM,GAAG,MAAM,CAAC;QAChB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC;aACxC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACxD,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,WAAW;oBACd,OAAO,cAAc,CAAC,GAAmB,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;gBACnF,KAAK,UAAU;oBACb,OAAO,aAAa,CAAC,GAAkB,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;gBACjF,KAAK,WAAW;oBACd,OAAO,gBAAgB,CAAC,GAAoB,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;gBACtF,KAAK,cAAc,CAAC;gBACpB,KAAK,sBAAsB;oBACzB,OAAO,gBAAgB,CAAC,GAAoB,EAAE,OAAO,CAAC,CAAC;gBACzD;oBACE,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,oBAAoB,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC,CAAC;aACD,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,MAAM;YACJ,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACF,QAA4B,EAAE,EAAE,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;YAC9C,CAAC;YACD,OAAO,SAAS,CAAC,UAAU;gBAAE,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACxE,MAAsC,EAAE,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAClF,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CAAC,IAAiB,EAAE,SAAsB;IAC7E,OAAO,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Provider configuration checks shared by every framework SDK that wraps this
+ * package (React, Vue, Svelte, Angular, Solid, Qwik, React Native, …).
+ *
+ * The one that matters is `frontendApi`. The publishable key encodes the
+ * instance id but NOT a host, so the Frontend API origin cannot be derived from
+ * it. An SDK that quietly fell back to `''` sent every request to a relative
+ * path on the app's own origin — a 404 (or the app's HTML) that looked exactly
+ * like "signed out", with nothing in the console to say why. Every provider now
+ * resolves the value through {@link resolveFrontendApi}, which throws a clear
+ * {@link AtlasConfigError} at mount instead.
+ */
+/** The codes an {@link AtlasConfigError} carries. */
+export type AtlasConfigErrorCode = 'FRONTEND_API_REQUIRED' | 'FRONTEND_API_INVALID';
+/**
+ * A misconfigured provider. Thrown synchronously at mount/initialisation, so
+ * the mistake surfaces in development rather than as a silent signed-out state.
+ * Check `error.code` (or `instanceof AtlasConfigError`) to tell it apart.
+ */
+export declare class AtlasConfigError extends Error {
+    readonly code: AtlasConfigErrorCode;
+    constructor(code: AtlasConfigErrorCode, message: string);
+}
+/**
+ * The explicit value for a same-origin / reverse-proxy setup, where the Frontend
+ * API is served under the app's own origin. Resolves to relative request paths.
+ */
+export declare const SAME_ORIGIN_FRONTEND_API = "same-origin";
+export interface ResolveFrontendApiOptions {
+    /** Name used in the error message, e.g. `"<AtlasProvider>"`. */
+    component?: string;
+    /**
+     * Whether a same-origin value (`"same-origin"` or a path such as `"/atlas"`)
+     * is meaningful. `false` for native apps, which have no origin of their own.
+     * Default `true`.
+     */
+    allowSameOrigin?: boolean;
+}
+/**
+ * Validate a provider's `frontendApi` and return the base URL requests are
+ * built from (`${base}/v1/client`). Throws an {@link AtlasConfigError} when it
+ * is missing, non-string, blank, or not an absolute `https:` URL (`http:` is accepted for
+ * localhost and local development hosts).
+ *
+ * Accepted:
+ *  - an absolute URL, e.g. `"https://auth.example.com"` (a trailing slash is
+ *    dropped; a path prefix such as `"https://example.com/auth"` is kept);
+ *  - `"same-origin"` → `""`, for a reverse proxy serving the Frontend API on
+ *    the app's own origin;
+ *  - a root-relative path prefix such as `"/atlas"` → `"/atlas"`, for a reverse
+ *    proxy under a path;
+ *  - DEPRECATED: `""` → `""`, the original same-origin spelling. Still works
+ *    (with a one-time console warning pointing at `"same-origin"`) so existing
+ *    reverse-proxy setups keep running; refused when `allowSameOrigin` is false.
+ *
+ * Missing (`undefined`/`null`), non-string and whitespace-only values always
+ * throw `FRONTEND_API_REQUIRED`.
+ */
+export declare function resolveFrontendApi(value: unknown, options?: ResolveFrontendApiOptions): string;

package/dist/config.js

@@ -0,0 +1,146 @@
+"use strict";
+/**
+ * Provider configuration checks shared by every framework SDK that wraps this
+ * package (React, Vue, Svelte, Angular, Solid, Qwik, React Native, …).
+ *
+ * The one that matters is `frontendApi`. The publishable key encodes the
+ * instance id but NOT a host, so the Frontend API origin cannot be derived from
+ * it. An SDK that quietly fell back to `''` sent every request to a relative
+ * path on the app's own origin — a 404 (or the app's HTML) that looked exactly
+ * like "signed out", with nothing in the console to say why. Every provider now
+ * resolves the value through {@link resolveFrontendApi}, which throws a clear
+ * {@link AtlasConfigError} at mount instead.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAME_ORIGIN_FRONTEND_API = exports.AtlasConfigError = void 0;
+exports.resolveFrontendApi = resolveFrontendApi;
+/**
+ * A misconfigured provider. Thrown synchronously at mount/initialisation, so
+ * the mistake surfaces in development rather than as a silent signed-out state.
+ * Check `error.code` (or `instanceof AtlasConfigError`) to tell it apart.
+ */
+class AtlasConfigError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'AtlasConfigError';
+        this.code = code;
+    }
+}
+exports.AtlasConfigError = AtlasConfigError;
+/**
+ * The explicit value for a same-origin / reverse-proxy setup, where the Frontend
+ * API is served under the app's own origin. Resolves to relative request paths.
+ */
+exports.SAME_ORIGIN_FRONTEND_API = 'same-origin';
+const EXAMPLES = '"https://atlasauth.net" (before you verify a custom domain) or your verified custom domain, e.g. "https://auth.example.com"';
+/** Hosts where plain `http:` is accepted: loopback and local development names. */
+function isLocalDevHost(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    if (host.endsWith('.local') || host.endsWith('.test'))
+        return true;
+    if (host === '::1')
+        return true;
+    const v4 = host.match(/^(\d{1,3})\.(\d{1,3})\.\d{1,3}\.\d{1,3}$/);
+    if (!v4)
+        return false;
+    const a = Number(v4[1]);
+    const b = Number(v4[2]);
+    return a === 127 || a === 10 || (a === 192 && b === 168) || (a === 172 && b >= 16 && b <= 31);
+}
+function show(value) {
+    if (value === undefined)
+        return 'undefined';
+    if (value === null)
+        return 'null';
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    return typeof value;
+}
+/**
+ * Validate a provider's `frontendApi` and return the base URL requests are
+ * built from (`${base}/v1/client`). Throws an {@link AtlasConfigError} when it
+ * is missing, non-string, blank, or not an absolute `https:` URL (`http:` is accepted for
+ * localhost and local development hosts).
+ *
+ * Accepted:
+ *  - an absolute URL, e.g. `"https://auth.example.com"` (a trailing slash is
+ *    dropped; a path prefix such as `"https://example.com/auth"` is kept);
+ *  - `"same-origin"` → `""`, for a reverse proxy serving the Frontend API on
+ *    the app's own origin;
+ *  - a root-relative path prefix such as `"/atlas"` → `"/atlas"`, for a reverse
+ *    proxy under a path;
+ *  - DEPRECATED: `""` → `""`, the original same-origin spelling. Still works
+ *    (with a one-time console warning pointing at `"same-origin"`) so existing
+ *    reverse-proxy setups keep running; refused when `allowSameOrigin` is false.
+ *
+ * Missing (`undefined`/`null`), non-string and whitespace-only values always
+ * throw `FRONTEND_API_REQUIRED`.
+ */
+function resolveFrontendApi(value, options = {}) {
+    const component = options.component ?? 'The Atlas provider';
+    const allowSameOrigin = options.allowSameOrigin !== false;
+    const sameOriginHint = allowSameOrigin
+        ? ` If you serve the Frontend API from your own origin through a reverse proxy, pass "${exports.SAME_ORIGIN_FRONTEND_API}" (or its path, e.g. "/atlas").`
+        : '';
+    if (value === '' && allowSameOrigin) {
+        warnEmptyFrontendApiOnce(component);
+        return '';
+    }
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new AtlasConfigError('FRONTEND_API_REQUIRED', `${component} needs \`frontendApi\`: the absolute URL of your instance's Frontend API, ` +
+            `such as ${EXAMPLES}. It cannot be derived from the publishable key. Got ${show(value)}.` +
+            sameOriginHint);
+    }
+    const raw = value.trim();
+    const invalid = (why) => new AtlasConfigError('FRONTEND_API_INVALID', `${component} got an invalid \`frontendApi\` ${JSON.stringify(raw)}: ${why} ` +
+        `Use an absolute https URL such as ${EXAMPLES}.` +
+        sameOriginHint);
+    if (raw === exports.SAME_ORIGIN_FRONTEND_API) {
+        if (!allowSameOrigin)
+            throw invalid('a native app has no origin of its own.');
+        return '';
+    }
+    if (raw.startsWith('/') && !raw.startsWith('//')) {
+        if (!allowSameOrigin)
+            throw invalid('a native app has no origin of its own.');
+        if (/[?#]/.test(raw))
+            throw invalid('it must not carry a query string or fragment.');
+        return raw.replace(/\/+$/, '');
+    }
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw invalid('it is not an absolute URL.');
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+        throw invalid(`the ${url.protocol} scheme is not supported.`);
+    }
+    if (url.protocol === 'http:' && !isLocalDevHost(url.hostname)) {
+        throw invalid('plain http is only accepted for localhost and local development hosts.');
+    }
+    if (url.username || url.password)
+        throw invalid('it must not carry credentials.');
+    if (url.search || url.hash)
+        throw invalid('it must not carry a query string or fragment.');
+    return `${url.origin}${url.pathname.replace(/\/+$/, '')}`;
+}
+let warnedEmpty = false;
+/**
+ * `frontendApi=""` was the documented same-origin spelling. It keeps working,
+ * but an empty string is also what an unset environment variable looks like —
+ * the explicit `"same-origin"` says what was meant. Warned once per page.
+ */
+function warnEmptyFrontendApiOnce(component) {
+    if (warnedEmpty || typeof console === 'undefined')
+        return;
+    warnedEmpty = true;
+    console.warn(`[Atlas] ${component}: \`frontendApi=""\` is deprecated. It still means same-origin ` +
+        `(requests go to relative paths on this origin), but pass "${exports.SAME_ORIGIN_FRONTEND_API}" to say so ` +
+        `explicitly, or your Frontend API URL, e.g. "https://atlasauth.net".`);
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAgFH,gDA4DC;AAvID;;;;GAIG;AACH,MAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAuB;IAEpC,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AARD,4CAQC;AAED;;;GAGG;AACU,QAAA,wBAAwB,GAAG,aAAa,CAAC;AAatD,MAAM,QAAQ,GACZ,6HAA6H,CAAC;AAEhI,mFAAmF;AACnF,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAClE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,kBAAkB,CAChC,KAAc,EACd,UAAqC,EAAE;IAEvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,oBAAoB,CAAC;IAC5D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC;IAC1D,MAAM,cAAc,GAAG,eAAe;QACpC,CAAC,CAAC,sFAAsF,gCAAwB,iCAAiC;QACjJ,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,KAAK,KAAK,EAAE,IAAI,eAAe,EAAE,CAAC;QACpC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,gBAAgB,CACxB,uBAAuB,EACvB,GAAG,SAAS,4EAA4E;YACtF,WAAW,QAAQ,wDAAwD,IAAI,CAAC,KAAK,CAAC,GAAG;YACzF,cAAc,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAC9B,IAAI,gBAAgB,CAClB,sBAAsB,EACtB,GAAG,SAAS,mCAAmC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG;QAC3E,qCAAqC,QAAQ,GAAG;QAChD,cAAc,CACjB,CAAC;IAEJ,IAAI,GAAG,KAAK,gCAAwB,EAAE,CAAC;QACrC,IAAI,CAAC,eAAe;YAAE,MAAM,OAAO,CAAC,wCAAwC,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,eAAe;YAAE,MAAM,OAAO,CAAC,wCAAwC,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,OAAO,CAAC,+CAA+C,CAAC,CAAC;QACrF,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,OAAO,CAAC,OAAO,GAAG,CAAC,QAAQ,2BAA2B,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,CAAC,wEAAwE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAClF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,MAAM,OAAO,CAAC,+CAA+C,CAAC,CAAC;IAE3F,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,SAAiB;IACjD,IAAI,WAAW,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO;IAC1D,WAAW,GAAG,IAAI,CAAC;IACnB,OAAO,CAAC,IAAI,CACV,WAAW,SAAS,iEAAiE;QACnF,6DAA6D,gCAAwB,cAAc;QACnG,qEAAqE,CACxE,CAAC;AACJ,CAAC"}

package/dist/frontchannel-logout.d.ts

@@ -22,6 +22,13 @@ export interface SignOutOptions {
      * (hidden iframes, capped at 5 s). Default `true`; pass `false` to skip it.
      */
     frontchannel?: boolean;
+    /**
+     * Reject with a `SignOutError` when the Frontend API could not revoke the
+     * session (after one retry). The local sign-out still happens either way.
+     * Default `false`: `signOut()` resolves and reports `revoked: false` instead.
+     * Honoured by `@atlasauth/react`.
+     */
+    strict?: boolean;
 }
 /** The default wait for front-channel logout frames. */
 export declare const FRONTCHANNEL_LOGOUT_TIMEOUT_MS = 5000;

package/dist/frontchannel-logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontchannel-logout.js","sourceRoot":"","sources":["../src/frontchannel-logout.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA0BH,wDAgBC;AAOD,sDAuDC;AAOD,8EAaC;AA5GD,wDAAwD;AAC3C,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAEnD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,IAAa;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,MAAM,IAAI,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACnC,IAAa,EACb,UAAqC,EAAE;IAEvC,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sCAA8B,CAAC;IAEtE,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,KAAgD,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/C,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;gBAC7B,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBAC1C,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACrC,iEAAiE;gBACjE,iEAAiE;gBACjE,qEAAqE;gBACrE,kEAAkE;gBAClE,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;gBACnD,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iCAAiC,CACrD,QAAqC,EACrC,UAAqC,EAAE;IAEvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO;IACtC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAI,IAAsD,EAAE,wBAAwB,CAAC;IAC/F,MAAM,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"frontchannel-logout.js","sourceRoot":"","sources":["../src/frontchannel-logout.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAiCH,wDAgBC;AAOD,sDAuDC;AAOD,8EAaC;AA5GD,wDAAwD;AAC3C,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAEnD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,IAAa;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,MAAM,IAAI,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACnC,IAAa,EACb,UAAqC,EAAE;IAEvC,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sCAA8B,CAAC;IAEtE,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,KAAgD,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/C,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;gBAC7B,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBAC1C,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACrC,iEAAiE;gBACjE,iEAAiE;gBACjE,qEAAqE;gBACrE,kEAAkE;gBAClE,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;gBACnD,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iCAAiC,CACrD,QAAqC,EACrC,UAAqC,EAAE;IAEvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO;IACtC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAI,IAAsD,EAAE,wBAAwB,CAAC;IAC/F,MAAM,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+export * from './config';
+export * from './sign-out';
 export * from './token-cache';
 export * from './tab-election';
 export * from './attempt';
@@ -10,9 +12,13 @@ export * from './telegram';
 export * from './siwe';
 export * from './telemetry';
 export * from './reauth';
+export * from './api-keys';
 export * from './connect';
 export * from './password-reset';
 export * from './check-session';
 export * from './frontchannel-logout';
 export * from './captcha';
+export * from './captcha-widget';
+export * from './captcha-controller';
+export * from './instance-settings';
 export { type AuthzClaims, type ProtectCondition, type ProtectOutcome, type ProtectReason, evaluate, hasFromClaims, protectFromClaims, ForbiddenError, ROLE_KEY_PATTERN, PERMISSION_KEY_PATTERN, isRoleKey, isPermissionKey, } from '@atlasauth/authz';