@atlasauth/js 0.5.0 → 0.6.0

package/dist/index.js

@@ -15,6 +15,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isPermissionKey = exports.isRoleKey = exports.PERMISSION_KEY_PATTERN = exports.ROLE_KEY_PATTERN = exports.ForbiddenError = exports.protectFromClaims = exports.hasFromClaims = exports.evaluate = void 0;
+// Provider configuration checks (frontendApi) shared by every framework SDK.
+__exportStar(require("./config"), exports);
+__exportStar(require("./sign-out"), exports);
 __exportStar(require("./token-cache"), exports);
 __exportStar(require("./tab-election"), exports);
 __exportStar(require("./attempt"), exports);
@@ -27,6 +30,8 @@ __exportStar(require("./telegram"), exports);
 __exportStar(require("./siwe"), exports);
 __exportStar(require("./telemetry"), exports);
 __exportStar(require("./reauth"), exports);
+// End-user API key self-service (`/v1/client/me/api_keys`).
+__exportStar(require("./api-keys"), exports);
 __exportStar(require("./connect"), exports);
 __exportStar(require("./password-reset"), exports);
 __exportStar(require("./check-session"), exports);
@@ -35,6 +40,13 @@ __exportStar(require("./frontchannel-logout"), exports);
 // §5 "captcha anywhere" — fetch the central widget config, render the provider
 // widget, and verify a solved token, all without hardcoding provider keys.
 __exportStar(require("./captcha"), exports);
+// Per-flow captcha widget rendering shared by the prebuilt sign-in / sign-up UIs.
+__exportStar(require("./captcha-widget"), exports);
+// The framework-agnostic captcha lifecycle + sign-in / sign-up submit helpers the
+// prebuilt forms of every framework SDK share, and the instance's public
+// sign-in / sign-up settings (`/v1/appearance`) they are driven by.
+__exportStar(require("./captcha-controller"), exports);
+__exportStar(require("./instance-settings"), exports);
 // Framework-agnostic authorization primitive — `has()`/`evaluate` for any
 // non-React/Next consumer reading org_role/org_permissions off its session.
 var authz_1 = require("@atlasauth/authz");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}

package/dist/instance-settings.d.ts

@@ -0,0 +1,58 @@
+import type { CaptchaFlowKey, FlowCaptcha } from './captcha-widget';
+import type { FapiClient } from './fapi';
+/**
+ * The instance's public sign-in / sign-up settings, read from
+ * `GET /v1/appearance`. Public data only — the captcha provider + site key +
+ * render mode per flow, the extra fields the create-account form collects, and
+ * the legal-consent policy. The prebuilt sign-in / sign-up components of every
+ * framework SDK read it so that turning a setting on in the dashboard (e.g.
+ * captcha on sign-up) takes effect with no code change.
+ */
+export interface InstanceSettings {
+    /** Per-flow captcha (`{ enabled: false }` when a flow draws nothing). */
+    captchaFlows: Partial<Record<CaptchaFlowKey, FlowCaptcha>>;
+    /** Extra fields the create-account form collects, in display order. */
+    signUpFields: PublicSignUpField[];
+    /** Terms / privacy links and whether agreement is required on sign-up. */
+    legal: {
+        termsUrl: string | null;
+        privacyUrl: string | null;
+        required: boolean;
+    };
+}
+/** One configurable sign-up field, exactly as `/v1/appearance` resolves it. */
+export interface PublicSignUpField {
+    key: string;
+    label: string;
+    type: 'text' | 'email' | 'tel' | 'url' | 'number' | 'date' | 'textarea' | 'checkbox' | 'select' | 'radio' | 'multiselect';
+    required: boolean;
+    placeholder: string | null;
+    options: string[];
+    builtin: boolean;
+}
+/**
+ * Read the settings out of a `/v1/appearance` body. Defensive: an older server
+ * (no `captchaFlows`) or a malformed body yields empty settings, so the
+ * components behave exactly as they did before these settings existed.
+ */
+export declare function instanceSettingsFrom(body: unknown): InstanceSettings;
+/**
+ * Fetch the instance's public settings (`GET /v1/appearance`). Null when the
+ * server can't be reached or answers with an error — the components then fall
+ * back to their defaults, and the server still enforces every gate.
+ */
+export declare function fetchInstanceSettings(client: FapiClient): Promise<InstanceSettings | null>;
+/**
+ * Split a create-account form's values into the `startSignUp` input: `email` and
+ * `password` are the credentials, everything else is a configured sign-up field
+ * (blank optional fields are dropped, so the server never sees empty strings).
+ * `consent` is the legal-consent tick (send `true` when no agreement is
+ * required — the server only enforces it when the instance opts in).
+ */
+export declare function toSignUpInput(values: Record<string, string>, consent: boolean, captchaToken?: string | null): {
+    email: string;
+    password: string;
+    fields: Record<string, string>;
+    consent: boolean;
+    captchaToken?: string;
+};

package/dist/instance-settings.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.instanceSettingsFrom = instanceSettingsFrom;
+exports.fetchInstanceSettings = fetchInstanceSettings;
+exports.toSignUpInput = toSignUpInput;
+const NO_LEGAL = { termsUrl: null, privacyUrl: null, required: false };
+const isRecord = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+/**
+ * Read the settings out of a `/v1/appearance` body. Defensive: an older server
+ * (no `captchaFlows`) or a malformed body yields empty settings, so the
+ * components behave exactly as they did before these settings existed.
+ */
+function instanceSettingsFrom(body) {
+    const root = isRecord(body) ? body : {};
+    const appearance = isRecord(root.appearance) ? root.appearance : {};
+    const captchaFlows = {};
+    if (isRecord(root.captchaFlows)) {
+        for (const key of ['signUp', 'signIn', 'guest', 'passwordReset']) {
+            const flow = root.captchaFlows[key];
+            if (!isRecord(flow))
+                continue;
+            captchaFlows[key] = {
+                enabled: flow.enabled === true,
+                ...(typeof flow.provider === 'string' ? { provider: flow.provider } : {}),
+                ...(typeof flow.siteKey === 'string' ? { siteKey: flow.siteKey } : {}),
+                ...(flow.widget === 'invisible' || flow.widget === 'managed' || flow.widget === 'visible'
+                    ? { widget: flow.widget }
+                    : {}),
+            };
+        }
+    }
+    const signUpFields = Array.isArray(appearance.signUpFields)
+        ? appearance.signUpFields.filter((f) => isRecord(f) && typeof f.key === 'string' && typeof f.label === 'string')
+        : [];
+    const legalRaw = isRecord(appearance.legal) ? appearance.legal : null;
+    const legal = legalRaw
+        ? {
+            termsUrl: typeof legalRaw.termsUrl === 'string' ? legalRaw.termsUrl : null,
+            privacyUrl: typeof legalRaw.privacyUrl === 'string' ? legalRaw.privacyUrl : null,
+            required: legalRaw.required === true,
+        }
+        : NO_LEGAL;
+    return { captchaFlows, signUpFields, legal };
+}
+/**
+ * Fetch the instance's public settings (`GET /v1/appearance`). Null when the
+ * server can't be reached or answers with an error — the components then fall
+ * back to their defaults, and the server still enforces every gate.
+ */
+async function fetchInstanceSettings(client) {
+    try {
+        const response = await client.get('/v1/appearance');
+        return response.ok ? instanceSettingsFrom(response.data) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Split a create-account form's values into the `startSignUp` input: `email` and
+ * `password` are the credentials, everything else is a configured sign-up field
+ * (blank optional fields are dropped, so the server never sees empty strings).
+ * `consent` is the legal-consent tick (send `true` when no agreement is
+ * required — the server only enforces it when the instance opts in).
+ */
+function toSignUpInput(values, consent, captchaToken) {
+    const { email = '', password = '', ...rest } = values;
+    const fields = {};
+    for (const [key, value] of Object.entries(rest))
+        if (value)
+            fields[key] = value;
+    return { email, password, fields, consent, ...(captchaToken ? { captchaToken } : {}) };
+}
+//# sourceMappingURL=instance-settings.js.map

package/dist/instance-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-settings.js","sourceRoot":"","sources":["../src/instance-settings.ts"],"names":[],"mappings":";;AAoDA,oDAoCC;AAOD,sDAOC;AASD,sCAeC;AApFD,MAAM,QAAQ,GAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAElG,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAAa;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,MAAM,YAAY,GAAqC,EAAE,CAAC;IAC1D,IAAI,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAU,EAAE,CAAC;YAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC9B,YAAY,CAAC,GAAG,CAAC,GAAG;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI;gBAC9B,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;oBACvF,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;oBACzB,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QACzD,CAAC,CAAE,UAAU,CAAC,YAAY,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CACvD;QAC3B,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC;YACE,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAC1E,UAAU,EAAE,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YAChF,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI;SACrC;QACH,CAAC,CAAC,QAAQ,CAAC;IAEb,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,qBAAqB,CAAC,MAAkB;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAU,gBAAgB,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAC3B,MAA8B,EAC9B,OAAgB,EAChB,YAA4B;IAQ5B,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACtD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAChF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC"}

package/dist/redirect.d.ts

@@ -73,6 +73,14 @@ export interface PopupStartResult extends PopupOutcome {
     /** True when the popup was blocked — the caller falls back to a full redirect. */
     blocked?: boolean;
     authorizationUrl?: string;
+    /**
+     * Set (with `error: 'popup_closed'`) when the popup closed without posting a
+     * result but the Frontend API now reports a signed-in session — e.g. the
+     * browser severed `window.opener`, so the popup finished the sign-in itself.
+     * The caller should re-boot its session state rather than treat it as a
+     * cancel.
+     */
+    sessionDetected?: boolean;
 }
 /**
  * Start a POPUP OAuth sign-in (GSI-style). Opens the provider authorize URL in a

package/dist/redirect.js

@@ -133,13 +133,32 @@ async function startOauthPopup(client, input, handlers = {}) {
             settle(outcome);
         };
         // The user closing the popup without finishing is a cancellation, not a hang.
+        // But a popup can also close (or look closed to us) after completing the
+        // sign-in itself: when a browser severs `window.opener` (a Cross-Origin-
+        // Opener-Policy on some hop, a privacy feature), the callback page cannot
+        // post back and finishes via the ordinary redirect instead, which sets the
+        // session cookies. So check the session once before calling it a cancel.
+        let probing = false;
         const timer = setInterval(() => {
-            if (popup && popup.closed)
-                settle({ error: 'popup_closed' });
+            if (!popup || !popup.closed || probing || done)
+                return;
+            probing = true;
+            clearInterval(timer);
+            void probeSession(client).then((signedIn) => settle(signedIn ? { error: 'popup_closed', sessionDetected: true } : { error: 'popup_closed' }));
         }, 500);
         window.addEventListener('message', onMessage);
     });
 }
+/** One `GET /v1/client`: is there a signed-in session on this browser now? */
+async function probeSession(client) {
+    try {
+        const res = await client.get('/v1/client');
+        return Boolean(res.ok && res.data?.session && res.data?.user);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Read Atlas's redirect params from a query string (`window.location.search`).
  *

package/dist/redirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAcH,gDAUC;AAiCD,wDAuBC;AAiCD,0CAsDC;AASD,gDAcC;AAQD,kDAIC;AAtMY,QAAA,eAAe,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAU,CAAC;AAEhG;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,KAAgD;IAEhD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiC,2BAA2B,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AA0BD;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,WAAmB,EACnB,cAAsB,EACtB,IAAa;IAEb,IAAI,WAAW,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,sBAAsB;YACzB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,KAAK,mBAAmB;YACtB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;QACpF,KAAK,sBAAsB;YACzB,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;gBACrB,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3B,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;aACxC,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAgBD,SAAS,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAW,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAW,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,CAAC;IAC1E,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe,CAAC,YAAY,IAAI,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,eAAe,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,KAAgD,EAChD,WAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiC,2BAA2B,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,gBAAgB;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAE1E,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,QAAQ,CAAC,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAC7C,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAEpB,OAAO,MAAM,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;QACrD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAE,EAAE;YACrC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjD,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;YACD,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,EAAgB,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,IAAI,OAAO,CAAC,MAAM;gBAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACpG,IAAI,OAAO,CAAC,KAAK;gBAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,8EAA8E;QAC9E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;gBAAE,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/D,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO;QACL,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,uBAAe;QAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAcH,gDAUC;AAiCD,wDAuBC;AAyCD,0CAiEC;AAmBD,gDAcC;AAQD,kDAIC;AAnOY,QAAA,eAAe,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAU,CAAC;AAEhG;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,KAAgD;IAEhD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiC,2BAA2B,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AA0BD;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,WAAmB,EACnB,cAAsB,EACtB,IAAa;IAEb,IAAI,WAAW,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,sBAAsB;YACzB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,KAAK,mBAAmB;YACtB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;QACpF,KAAK,sBAAsB;YACzB,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;gBACrB,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3B,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;aACxC,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAwBD,SAAS,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAW,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAW,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,CAAC;IAC1E,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe,CAAC,YAAY,IAAI,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,eAAe,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,KAAgD,EAChD,WAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiC,2BAA2B,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,gBAAgB;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAE1E,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,QAAQ,CAAC,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAC7C,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAEpB,OAAO,MAAM,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;QACrD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAE,EAAE;YACrC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjD,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;YACD,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,EAAgB,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,IAAI,OAAO,CAAC,MAAM;gBAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACpG,IAAI,OAAO,CAAC,KAAK;gBAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,8EAA8E;QAC9E,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO;YACvD,OAAO,GAAG,IAAI,CAAC;YACf,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,KAAK,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAChG,CAAC;QACJ,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,YAAY,CAAC,MAAkB;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAwC,YAAY,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO;QACL,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,uBAAe;QAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}

package/dist/sign-out.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Sign-out that cannot be silently undone.
+ *
+ * A browser sign-out has two halves: revoke the session on the Frontend API
+ * (which also clears the HttpOnly session cookies), and drop the local state.
+ * If the first half fails — a network blip, a 5xx — the refresh cookie is still
+ * valid, and the very next `reload()` (a tab regaining focus, a sibling tab's
+ * broadcast, a failed token refresh) re-boots straight back into the session
+ * the user just signed out of.
+ *
+ * These helpers close that gap: {@link revokeSession} retries once and reports
+ * what the server did (including the parked session it promoted, if any), and
+ * {@link SessionTombstones} remembers the ids of sessions this tab signed out of
+ * so a reload never re-adopts one, even when the revoke never reached the
+ * server.
+ */
+/** What `signOut()` resolves with. */
+export interface SignOutResult {
+    /**
+     * Whether the Frontend API confirmed the session was revoked. `false` means
+     * the local sign-out happened but the server could not be reached (or
+     * refused); the session id is remembered so this browser never re-adopts it.
+     */
+    revoked: boolean;
+    /**
+     * Set when another account signed in on this browser was promoted to active
+     * (multi-session). The SDK adopts it, so the user stays signed in as it.
+     */
+    activeSessionId?: string;
+}
+/** The error `signOut({ strict: true })` rejects with when the revoke fails. */
+export declare class SignOutError extends Error {
+    readonly code: "SIGN_OUT_REVOKE_FAILED";
+    /** The session that could not be revoked. */
+    readonly sessionId: string;
+    /** The last HTTP status from the Frontend API, or `0` for a network failure. */
+    readonly status: number;
+    constructor(sessionId: string, status: number);
+}
+/** The outcome of {@link revokeSession}. */
+export interface RevokeSessionOutcome {
+    revoked: boolean;
+    /** The last HTTP status (`0` when the request never got a response). */
+    status: number;
+    /** The successful response, for front-channel logout. */
+    response?: Response;
+    /** A parked session the server promoted to active, if any. */
+    activeSessionId?: string;
+}
+/**
+ * `POST /v1/client/sessions/:id/revoke`, retried once on a network failure or a
+ * 5xx/429. A 4xx other than 429 is not retried: the server understood and said
+ * no. A 404 counts as revoked — the session is already gone.
+ *
+ * `request` is the caller's credentialed FAPI fetch (cookies included), so the
+ * server can clear the session cookies on this browser.
+ */
+export declare function revokeSession(request: (path: string, init?: RequestInit) => Promise<Response>, sessionId: string, options?: {
+    retries?: number;
+}): Promise<RevokeSessionOutcome>;
+/**
+ * The ids of sessions this tab signed out of. Held in memory and mirrored to
+ * `sessionStorage` (so a page reload in the same tab remembers them); sibling
+ * tabs learn them through the SDK's cross-tab session broadcast. Never holds a
+ * token — a session id is not a credential.
+ */
+export declare class SessionTombstones {
+    private readonly storageKey;
+    private readonly ids;
+    constructor(storageKey?: string);
+    has(sessionId: string | null | undefined): boolean;
+    add(...sessionIds: (string | null | undefined)[]): void;
+    list(): string[];
+}

package/dist/sign-out.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Sign-out that cannot be silently undone.
+ *
+ * A browser sign-out has two halves: revoke the session on the Frontend API
+ * (which also clears the HttpOnly session cookies), and drop the local state.
+ * If the first half fails — a network blip, a 5xx — the refresh cookie is still
+ * valid, and the very next `reload()` (a tab regaining focus, a sibling tab's
+ * broadcast, a failed token refresh) re-boots straight back into the session
+ * the user just signed out of.
+ *
+ * These helpers close that gap: {@link revokeSession} retries once and reports
+ * what the server did (including the parked session it promoted, if any), and
+ * {@link SessionTombstones} remembers the ids of sessions this tab signed out of
+ * so a reload never re-adopts one, even when the revoke never reached the
+ * server.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionTombstones = exports.SignOutError = void 0;
+exports.revokeSession = revokeSession;
+/** The error `signOut({ strict: true })` rejects with when the revoke fails. */
+class SignOutError extends Error {
+    code = 'SIGN_OUT_REVOKE_FAILED';
+    /** The session that could not be revoked. */
+    sessionId;
+    /** The last HTTP status from the Frontend API, or `0` for a network failure. */
+    status;
+    constructor(sessionId, status) {
+        super(status === 0
+            ? 'Signed out locally, but the Atlas Frontend API could not be reached to end the session.'
+            : `Signed out locally, but the Atlas Frontend API refused to end the session (HTTP ${status}).`);
+        this.name = 'SignOutError';
+        this.sessionId = sessionId;
+        this.status = status;
+    }
+}
+exports.SignOutError = SignOutError;
+/**
+ * `POST /v1/client/sessions/:id/revoke`, retried once on a network failure or a
+ * 5xx/429. A 4xx other than 429 is not retried: the server understood and said
+ * no. A 404 counts as revoked — the session is already gone.
+ *
+ * `request` is the caller's credentialed FAPI fetch (cookies included), so the
+ * server can clear the session cookies on this browser.
+ */
+async function revokeSession(request, sessionId, options = {}) {
+    const retries = Math.max(0, options.retries ?? 1);
+    let status = 0;
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        let response;
+        try {
+            response = await request(`/v1/client/sessions/${encodeURIComponent(sessionId)}/revoke`, {
+                method: 'POST',
+            });
+        }
+        catch {
+            status = 0;
+            continue;
+        }
+        status = response.status;
+        if (response.ok) {
+            let activeSessionId;
+            try {
+                const body = (await response.clone().json());
+                if (typeof body?.active_session_id === 'string')
+                    activeSessionId = body.active_session_id;
+            }
+            catch {
+                // A body we cannot read still means the revoke succeeded.
+            }
+            return { revoked: true, status, response, ...(activeSessionId ? { activeSessionId } : {}) };
+        }
+        if (status === 404)
+            return { revoked: true, status };
+        if (status < 500 && status !== 429)
+            break;
+    }
+    return { revoked: false, status };
+}
+const TOMBSTONE_KEY = 'atlas:signed-out-sessions';
+const TOMBSTONE_LIMIT = 20;
+/**
+ * The ids of sessions this tab signed out of. Held in memory and mirrored to
+ * `sessionStorage` (so a page reload in the same tab remembers them); sibling
+ * tabs learn them through the SDK's cross-tab session broadcast. Never holds a
+ * token — a session id is not a credential.
+ */
+class SessionTombstones {
+    storageKey;
+    ids;
+    constructor(storageKey = TOMBSTONE_KEY) {
+        this.storageKey = storageKey;
+        this.ids = readStored(storageKey);
+    }
+    has(sessionId) {
+        return typeof sessionId === 'string' && this.ids.includes(sessionId);
+    }
+    add(...sessionIds) {
+        let changed = false;
+        for (const id of sessionIds) {
+            if (typeof id !== 'string' || !id || this.ids.includes(id))
+                continue;
+            this.ids.push(id);
+            changed = true;
+        }
+        if (!changed)
+            return;
+        while (this.ids.length > TOMBSTONE_LIMIT)
+            this.ids.shift();
+        try {
+            globalThis.sessionStorage?.setItem(this.storageKey, JSON.stringify(this.ids));
+        }
+        catch {
+            // Private mode / storage disabled: memory still protects this tab.
+        }
+    }
+    list() {
+        return [...this.ids];
+    }
+}
+exports.SessionTombstones = SessionTombstones;
+function readStored(key) {
+    try {
+        const raw = globalThis.sessionStorage?.getItem(key);
+        const parsed = raw ? JSON.parse(raw) : [];
+        return Array.isArray(parsed)
+            ? parsed.filter((v) => typeof v === 'string').slice(-TOMBSTONE_LIMIT)
+            : [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=sign-out.js.map

package/dist/sign-out.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-out.js","sourceRoot":"","sources":["../src/sign-out.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAwDH,sCAgCC;AAvED,gFAAgF;AAChF,MAAa,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,wBAAiC,CAAC;IAClD,6CAA6C;IACpC,SAAS,CAAS;IAC3B,gFAAgF;IACvE,MAAM,CAAS;IAExB,YAAY,SAAiB,EAAE,MAAc;QAC3C,KAAK,CACH,MAAM,KAAK,CAAC;YACV,CAAC,CAAC,yFAAyF;YAC3F,CAAC,CAAC,mFAAmF,MAAM,IAAI,CAClG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAjBD,oCAiBC;AAaD;;;;;;;GAOG;AACI,KAAK,UAAU,aAAa,CACjC,OAAgE,EAChE,SAAiB,EACjB,UAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;IAClD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,SAAS,EAAE;gBACtF,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACzB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,eAAmC,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAA2C,CAAC;gBACvF,IAAI,OAAO,IAAI,EAAE,iBAAiB,KAAK,QAAQ;oBAAE,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9F,CAAC;QACD,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACrD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;IAC5C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;GAKG;AACH,MAAa,iBAAiB;IAGC;IAFZ,GAAG,CAAW;IAE/B,YAA6B,aAAqB,aAAa;QAAlC,eAAU,GAAV,UAAU,CAAwB;QAC7D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED,GAAG,CAAC,SAAoC;QACtC,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,GAAG,CAAC,GAAG,UAAyC;QAC9C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,SAAS;YACrE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,eAAe;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;CACF;AA9BD,8CA8BC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,MAAM,GAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC;YAClF,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/js",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "devDependencies": {
@@ -16,7 +16,8 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",