@atlasauth/js 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # @atlasauth/js changelog
 
+## 0.8.0
+- **New: `SignOutGuard`** — the safer sign-out every framework provider now drives, so they all behave like
+  `@atlasauth/react`: `new SignOutGuard({ request, frontendApi?, store?, tombstones?, retryDelaysMs?,
+  frontChannelLogout? })` (`SignOutGuardOptions`). Methods: `revoke(sessionId, { frontchannel?, request? })` →
+  `SignOutAttempt` (`{ sessionId, outcome }`; finds the cookie session with `GET /v1/client` when the id is unknown,
+  tombstones it before revoking, revokes with one retry, runs front-channel logout, and re-tries a failed revoke in
+  the background after 15 s, 1 min and 5 min); `settle(attempt, { strict? })` → `SignOutResult` (throws
+  `SignOutError` under `strict`); `promoted(attempt)` → the server-promoted session id to adopt, or null;
+  `refuse(sessionId)` → whether a booted session must not be adopted (re-tries its revoke in the background and
+  removes the tombstone once it lands); `isSignedOut(id)`; `signal(attempt)` / `learn(message)` for the cross-tab
+  `{ signedOut: string[] }` message; `watch(current, onSignedOut)` (another tab signed out of this session);
+  `ready`; `dispose()`; `tombstones`. **Added types** `FapiRequest`, `SignOutGuardOptions`, `SignOutAttempt`,
+  `SignedOutSignal`.
+- **Tombstones on platforms without `localStorage`.** `SessionTombstonesOptions.store?: TombstoneStore` (new type:
+  `{ getItem(key), setItem(key, value) }`, sync or async) keeps the tombstones in the platform's own store
+  (AsyncStorage, `expo-secure-store`, `chrome.storage`, Capacitor Preferences…). **Added**
+  `SessionTombstones.ready: Promise<void>` (settles once the store has been read; immediate for `localStorage`).
+- **Email delivery.** `InstanceSettings.emailDelivery: EmailDelivery` (new type: `{ available, passwordReset,
+  passwordSignUp }`, read from `email_delivery` on `GET /v1/appearance`; all `true` on a server that does not send
+  it). **New helpers:** `emailDeliveryFrom(body)` (an environment / appearance body or the object itself),
+  `offeredFirstFactors(strategies, delivery)` (drops `email_code` / `email_link` while email can't be delivered),
+  and the constants `EMAIL_DELIVERY_UNKNOWN`, `EMAIL_UNAVAILABLE_MESSAGE`, `EMAIL_FIRST_FACTORS`.
+- **New: typed client environment.** `fetchClientEnvironment(client)` → `ClientEnvironment | null` and
+  `clientEnvironmentFrom(body)` for `GET /v1/client/environment`: `{ firstFactors, strategies, emailDelivery,
+  socialProviders }`, with the new `EnvironmentSocialProvider` type (`provider`, `native`, `mode`, `label`,
+  `display_name`, `icon`, `allow_sign_in`, `allow_sign_up`, `client_id?`, `bot_username?`).
+
+## 0.7.0
+- **Popup OAuth completes when the opener page sends `Cross-Origin-Opener-Policy: same-origin`.** That
+  header puts the provider popup in another browsing-context group: `popup.closed` reads `true` at once and
+  the popup has no `window.opener`, so the result could never be posted back and the flow settled as a
+  cancel while the popup stayed open. Now the popup lands back on your page with the result in the URL
+  fragment (`#atlas_popup_result=…`, never the query string), the SDK there hands it to the opener over
+  `BroadcastChannel('atlas:oauth:<nonce>')` (a `localStorage` `storage` event where BroadcastChannel is
+  missing) and closes the popup.
+- **Changed `startOauthPopup` cancel semantics.** `popup.closed` turning true within 1.5 s of opening means
+  the opener link was severed, not that the user closed it: the flow keeps waiting, probing `GET /v1/client`
+  with back-off, for up to 5 minutes, and settles as `popup_closed` only on that timeout, an explicit error
+  result, `signal` aborting, or a newer popup flow starting. A close after 1.5 s is a cancel after one final
+  session probe (as before).
+- **Changed `startOauthPopup` request.** It now sends `popup_nonce` and `opener_origin`
+  (`window.location.origin`) with `mode: 'popup'`, and opens the popup with the window name `atlas:oauth`.
+- **Added** to `startOauthPopup`: `input.signal?: AbortSignal`, `handlers.onSevered?: () => void`,
+  `PopupStartResult.severed?: boolean`; new `OAuthPopupInput` type; `POPUP_SEVERED_WINDOW_MS` (1500) and
+  `POPUP_SEVERED_TIMEOUT_MS` (300000); `mapOAuthPopupPayload(data)` (the payload half of
+  `parseOAuthPopupMessage`).
+- **Added popup channel helpers:** `completeOAuthPopupLanding({ win?, ackTimeoutMs? })` →
+  `PopupLanding | null` (`{ payload, delivered }`; reads and scrubs the fragment, relays the result and
+  closes once the opener acknowledges — call it on startup), `closeOAuthPopupAfterSignIn({ win?, ackTimeoutMs? })`
+  (a page that finished a sign-in inside the Atlas popup closes itself when an opener is waiting),
+  `listenForPopupResult(nonce, { onResult, onSignedIn? })`, `readPopupLanding(hash)`, `popupChannelName(nonce)`,
+  `createPopupNonce()`, `PopupRelayMessage`, and the constants `OAUTH_POPUP_WINDOW_NAME`
+  (`'atlas:oauth'`), `POPUP_RESULT_FRAGMENT` (`'atlas_popup_result'`), `POPUP_SIGNAL_CHANNEL`.
+- **Sign-out tombstones are shared by every tab.** `SessionTombstones` moved from `sessionStorage` to
+  `localStorage`, so after a failed revoke a newly opened tab no longer re-adopts the session. Entries are
+  `{ id, at }`, at most 20, kept 30 days, pruned on every read, and keyed per Frontend API origin
+  (`atlas:signed-out-sessions:<origin>`). `sessionStorage` is used only when `localStorage` throws; tombstones
+  an earlier version kept in `sessionStorage` are carried over.
+- **Changed** `new SessionTombstones(options?)`: accepts `{ frontendApi?, storageKey?, now? }`
+  (`SessionTombstonesOptions`); a bare storage-key string is still accepted. **Added** `remove(...ids)` (forget
+  a tombstone once a later revoke is confirmed) and `subscribe(listener)` (another tab's changes, via the
+  `storage` event). `has()`/`list()` re-read storage, so other tabs' changes are seen.
+
 ## 0.6.0
 - **Per-flow captcha widget rendering**, shared by the prebuilt sign-in / sign-up UIs:
   `renderCaptchaWidget(flow, container)` → `{ token: Promise<string>, remove() }`,

package/dist/environment.d.ts

@@ -0,0 +1,79 @@
+import type { FapiClient } from './fapi';
+/**
+ * The client environment (`GET /v1/client/environment`) and the email-delivery
+ * facts both it and `GET /v1/appearance` publish.
+ *
+ * An app that cannot deliver email (a production instance with no email
+ * provider) cannot send a reset code, an email sign-in code or link, or a
+ * sign-up verification code. The server already stops offering email code / link
+ * and refuses those requests; `email_delivery` lets a sign-in UI say so up front
+ * instead: hide "Forgot password?" and email-code options, and show a "can't
+ * send email" state where a sign-up would need one.
+ */
+/** `email_delivery`: what works given whether the app can deliver email. */
+export interface EmailDelivery {
+    /** The app can send email (its own provider, or the shared development sender). */
+    available: boolean;
+    /** "Forgot password?" can work: password sign-in is on and reset emails can be delivered. */
+    passwordReset: boolean;
+    /** Email + password sign-up can complete (email can be delivered, or verification is not required). */
+    passwordSignUp: boolean;
+}
+/**
+ * What an older server (no `email_delivery`) is taken to mean: everything works.
+ * The server still refuses whatever it cannot deliver.
+ */
+export declare const EMAIL_DELIVERY_UNKNOWN: Readonly<EmailDelivery>;
+/** The default English copy for the "can't send email" state. */
+export declare const EMAIL_UNAVAILABLE_MESSAGE = "This app can't send email right now. Try another sign-in method or contact the app owner.";
+/** The first factors that need the app to deliver email. */
+export declare const EMAIL_FIRST_FACTORS: readonly string[];
+/**
+ * Read `email_delivery` from a `/v1/client/environment` or `/v1/appearance`
+ * body — or from the `email_delivery` object itself. A missing object or field
+ * reads as available (see {@link EMAIL_DELIVERY_UNKNOWN}).
+ */
+export declare function emailDeliveryFrom(body: unknown): EmailDelivery;
+/**
+ * The first factors a sign-in UI should offer: `strategies` without email code /
+ * link while the app cannot deliver email. A capability of the app, not of the
+ * user, so it never narrows the server's uniform list per identifier. With no
+ * `delivery` (not loaded yet) the list is returned unchanged.
+ */
+export declare function offeredFirstFactors(strategies: readonly string[], delivery: EmailDelivery | null | undefined): string[];
+/** One entry of the environment's `social_providers`. */
+export interface EnvironmentSocialProvider {
+    provider: string;
+    /** Whether the provider signs in natively (One Tap etc.) on this instance. */
+    native: boolean;
+    mode: 'native' | 'redirect';
+    /** The full button text, or null for the SDK's own label. */
+    label: string | null;
+    display_name: string | null;
+    icon: {
+        type: 'url' | 'svg';
+        value: string;
+    } | null;
+    allow_sign_in: boolean;
+    allow_sign_up: boolean;
+    /** Public client id, for native providers only. */
+    client_id?: string;
+    /** Telegram's bot username. */
+    bot_username?: string;
+}
+/** `GET /v1/client/environment`, typed. */
+export interface ClientEnvironment {
+    /** The enabled first factors (`password`, `email_code`, `passkey`, …). */
+    firstFactors: string[];
+    /**
+     * The offered strategies, camelCase as the server sends them (`password`,
+     * `emailCode`, `emailLink`, `passkey`, `phoneCode`, …, `oauthProviders`).
+     */
+    strategies: Record<string, unknown>;
+    emailDelivery: EmailDelivery;
+    socialProviders: EnvironmentSocialProvider[];
+}
+/** Read a `/v1/client/environment` body. Defensive: malformed parts read as empty. */
+export declare function clientEnvironmentFrom(body: unknown): ClientEnvironment;
+/** Fetch the client environment. Null when the server can't be reached or errors. */
+export declare function fetchClientEnvironment(client: FapiClient): Promise<ClientEnvironment | null>;

package/dist/environment.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMAIL_FIRST_FACTORS = exports.EMAIL_UNAVAILABLE_MESSAGE = exports.EMAIL_DELIVERY_UNKNOWN = void 0;
+exports.emailDeliveryFrom = emailDeliveryFrom;
+exports.offeredFirstFactors = offeredFirstFactors;
+exports.clientEnvironmentFrom = clientEnvironmentFrom;
+exports.fetchClientEnvironment = fetchClientEnvironment;
+/**
+ * What an older server (no `email_delivery`) is taken to mean: everything works.
+ * The server still refuses whatever it cannot deliver.
+ */
+exports.EMAIL_DELIVERY_UNKNOWN = Object.freeze({
+    available: true,
+    passwordReset: true,
+    passwordSignUp: true,
+});
+/** The default English copy for the "can't send email" state. */
+exports.EMAIL_UNAVAILABLE_MESSAGE = "This app can't send email right now. Try another sign-in method or contact the app owner.";
+/** The first factors that need the app to deliver email. */
+exports.EMAIL_FIRST_FACTORS = ['email_code', 'email_link'];
+const isRecord = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+/**
+ * Read `email_delivery` from a `/v1/client/environment` or `/v1/appearance`
+ * body — or from the `email_delivery` object itself. A missing object or field
+ * reads as available (see {@link EMAIL_DELIVERY_UNKNOWN}).
+ */
+function emailDeliveryFrom(body) {
+    const raw = isRecord(body) && isRecord(body.email_delivery) ? body.email_delivery : body;
+    if (!isRecord(raw) || !('available' in raw || 'password_reset' in raw || 'password_sign_up' in raw)) {
+        return { ...exports.EMAIL_DELIVERY_UNKNOWN };
+    }
+    const flag = (v) => (typeof v === 'boolean' ? v : true);
+    return {
+        available: flag(raw.available),
+        passwordReset: flag(raw.password_reset),
+        passwordSignUp: flag(raw.password_sign_up),
+    };
+}
+/**
+ * The first factors a sign-in UI should offer: `strategies` without email code /
+ * link while the app cannot deliver email. A capability of the app, not of the
+ * user, so it never narrows the server's uniform list per identifier. With no
+ * `delivery` (not loaded yet) the list is returned unchanged.
+ */
+function offeredFirstFactors(strategies, delivery) {
+    if (!delivery || delivery.available)
+        return [...strategies];
+    return strategies.filter((s) => !exports.EMAIL_FIRST_FACTORS.includes(s));
+}
+/** Read a `/v1/client/environment` body. Defensive: malformed parts read as empty. */
+function clientEnvironmentFrom(body) {
+    const root = isRecord(body) ? body : {};
+    return {
+        firstFactors: Array.isArray(root.first_factors)
+            ? root.first_factors.filter((f) => typeof f === 'string')
+            : [],
+        strategies: isRecord(root.strategies) ? { ...root.strategies } : {},
+        emailDelivery: emailDeliveryFrom(root),
+        socialProviders: Array.isArray(root.social_providers)
+            ? root.social_providers.filter((p) => isRecord(p) && typeof p.provider === 'string')
+            : [],
+    };
+}
+/** Fetch the client environment. Null when the server can't be reached or errors. */
+async function fetchClientEnvironment(client) {
+    try {
+        const response = await client.get('/v1/client/environment');
+        return response.ok ? clientEnvironmentFrom(response.data) : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=environment.js.map

package/dist/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../src/environment.ts"],"names":[],"mappings":";;;AAiDA,8CAWC;AAQD,kDAMC;AAkCD,sDAcC;AAGD,wDAOC;AA5GD;;;GAGG;AACU,QAAA,sBAAsB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAEH,iEAAiE;AACpD,QAAA,yBAAyB,GACpC,2FAA2F,CAAC;AAE9F,4DAA4D;AAC/C,QAAA,mBAAmB,GAAsB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,IAAa;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,IAAI,gBAAgB,IAAI,GAAG,IAAI,kBAAkB,IAAI,GAAG,CAAC,EAAE,CAAC;QACpG,OAAO,EAAE,GAAG,8BAAsB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;QACvC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,UAA6B,EAC7B,QAA0C;IAE1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS;QAAE,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;IAC5D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,2BAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAiCD,sFAAsF;AACtF,SAAgB,qBAAqB,CAAC,IAAa;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;YAC7C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACtE,CAAC,CAAC,EAAE;QACN,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;QACnE,aAAa,EAAE,iBAAiB,CAAC,IAAI,CAAC;QACtC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACnD,CAAC,CAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CACV;YAC9C,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,sBAAsB,CAAC,MAAkB;IAC7D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAU,wBAAwB,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/frontchannel-logout.d.ts

@@ -26,7 +26,7 @@ export interface SignOutOptions {
      * Reject with a `SignOutError` when the Frontend API could not revoke the
      * session (after one retry). The local sign-out still happens either way.
      * Default `false`: `signOut()` resolves and reports `revoked: false` instead.
-     * Honoured by `@atlasauth/react`.
+     * Honoured by every framework provider.
      */
     strict?: boolean;
 }

package/dist/index.d.ts

@@ -1,9 +1,11 @@
 export * from './config';
 export * from './sign-out';
+export * from './sign-out-guard';
 export * from './token-cache';
 export * from './tab-election';
 export * from './attempt';
 export * from './redirect';
+export * from './popup-channel';
 export * from './fapi';
 export * from './native';
 export * from './native-session';
@@ -21,4 +23,5 @@ export * from './captcha';
 export * from './captcha-widget';
 export * from './captcha-controller';
 export * from './instance-settings';
+export * from './environment';
 export { type AuthzClaims, type ProtectCondition, type ProtectOutcome, type ProtectReason, evaluate, hasFromClaims, protectFromClaims, ForbiddenError, ROLE_KEY_PATTERN, PERMISSION_KEY_PATTERN, isRoleKey, isPermissionKey, } from '@atlasauth/authz';

package/dist/index.js

@@ -18,10 +18,14 @@ exports.isPermissionKey = exports.isRoleKey = exports.PERMISSION_KEY_PATTERN = e
 // Provider configuration checks (frontendApi) shared by every framework SDK.
 __exportStar(require("./config"), exports);
 __exportStar(require("./sign-out"), exports);
+// The safer sign-out every framework provider drives (tombstones, background revoke).
+__exportStar(require("./sign-out-guard"), exports);
 __exportStar(require("./token-cache"), exports);
 __exportStar(require("./tab-election"), exports);
 __exportStar(require("./attempt"), exports);
 __exportStar(require("./redirect"), exports);
+// §oauth popup mode: the same-origin hand-back for a popup whose opener was severed.
+__exportStar(require("./popup-channel"), exports);
 __exportStar(require("./fapi"), exports);
 __exportStar(require("./native"), exports);
 __exportStar(require("./native-session"), exports);
@@ -47,6 +51,8 @@ __exportStar(require("./captcha-widget"), exports);
 // sign-in / sign-up settings (`/v1/appearance`) they are driven by.
 __exportStar(require("./captcha-controller"), exports);
 __exportStar(require("./instance-settings"), exports);
+// `GET /v1/client/environment`, typed, and the `email_delivery` facts.
+__exportStar(require("./environment"), exports);
 // Framework-agnostic authorization primitive — `has()`/`evaluate` for any
 // non-React/Next consumer reading org_role/org_permissions off its session.
 var authz_1 = require("@atlasauth/authz");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}

package/dist/instance-settings.d.ts

@@ -1,4 +1,5 @@
 import type { CaptchaFlowKey, FlowCaptcha } from './captcha-widget';
+import { type EmailDelivery } from './environment';
 import type { FapiClient } from './fapi';
 /**
  * The instance's public sign-in / sign-up settings, read from
@@ -19,6 +20,14 @@ export interface InstanceSettings {
         privacyUrl: string | null;
         required: boolean;
     };
+    /**
+     * Whether the app can deliver email, and what that allows: hide "Forgot
+     * password?" when `passwordReset` is false, email code / link options when
+     * `available` is false, and show a "can't send email" state instead of the
+     * password sign-up form when `passwordSignUp` is false. All true on an older
+     * server that does not say.
+     */
+    emailDelivery: EmailDelivery;
 }
 /** One configurable sign-up field, exactly as `/v1/appearance` resolves it. */
 export interface PublicSignUpField {

package/dist/instance-settings.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.instanceSettingsFrom = instanceSettingsFrom;
 exports.fetchInstanceSettings = fetchInstanceSettings;
 exports.toSignUpInput = toSignUpInput;
+const environment_1 = require("./environment");
 const NO_LEGAL = { termsUrl: null, privacyUrl: null, required: false };
 const isRecord = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 /**
@@ -40,7 +41,7 @@ function instanceSettingsFrom(body) {
             required: legalRaw.required === true,
         }
         : NO_LEGAL;
-    return { captchaFlows, signUpFields, legal };
+    return { captchaFlows, signUpFields, legal, emailDelivery: (0, environment_1.emailDeliveryFrom)(root) };
 }
 /**
  * Fetch the instance's public settings (`GET /v1/appearance`). Null when the

package/dist/instance-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance-settings.js","sourceRoot":"","sources":["../src/instance-settings.ts"],"names":[],"mappings":";;AAoDA,oDAoCC;AAOD,sDAOC;AASD,sCAeC;AApFD,MAAM,QAAQ,GAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAElG,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAAa;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,MAAM,YAAY,GAAqC,EAAE,CAAC;IAC1D,IAAI,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAU,EAAE,CAAC;YAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC9B,YAAY,CAAC,GAAG,CAAC,GAAG;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI;gBAC9B,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;oBACvF,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;oBACzB,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QACzD,CAAC,CAAE,UAAU,CAAC,YAAY,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CACvD;QAC3B,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC;YACE,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAC1E,UAAU,EAAE,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YAChF,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI;SACrC;QACH,CAAC,CAAC,QAAQ,CAAC;IAEb,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,qBAAqB,CAAC,MAAkB;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAU,gBAAgB,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAC3B,MAA8B,EAC9B,OAAgB,EAChB,YAA4B;IAQ5B,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACtD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAChF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC"}
+{"version":3,"file":"instance-settings.js","sourceRoot":"","sources":["../src/instance-settings.ts"],"names":[],"mappings":";;AA6DA,oDAoCC;AAOD,sDAOC;AASD,sCAeC;AAtID,+CAAsE;AAkDtE,MAAM,QAAQ,GAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAElG,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAAa;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,MAAM,YAAY,GAAqC,EAAE,CAAC;IAC1D,IAAI,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAU,EAAE,CAAC;YAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC9B,YAAY,CAAC,GAAG,CAAC,GAAG;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI;gBAC9B,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;oBACvF,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;oBACzB,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QACzD,CAAC,CAAE,UAAU,CAAC,YAAY,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CACvD;QAC3B,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC;YACE,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAC1E,UAAU,EAAE,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YAChF,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI;SACrC;QACH,CAAC,CAAC,QAAQ,CAAC;IAEb,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAA,+BAAiB,EAAC,IAAI,CAAC,EAAE,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,qBAAqB,CAAC,MAAkB;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAU,gBAAgB,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAC3B,MAA8B,EAC9B,OAAgB,EAChB,YAA4B;IAQ5B,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACtD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAChF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC"}

package/dist/popup-channel.d.ts

@@ -0,0 +1,95 @@
+/**
+ * §oauth popup mode — the same-origin hand-back for a popup whose
+ * `window.opener` was severed.
+ *
+ * When the page that opens the sign-in popup sends a restrictive
+ * Cross-Origin-Opener-Policy (`same-origin`), the browser puts the cross-origin
+ * popup in another browsing-context group: `popup.closed` reads `true` to the
+ * opener almost at once and `window.opener` is `null` inside the popup, so the
+ * Frontend API's `postMessage` can never arrive. The Frontend API then sends the
+ * popup back to the OPENER's own page with the result in the URL fragment
+ * (`#atlas_popup_result=…`, never the query). That page runs the SDK, which:
+ *
+ *   1. reads and scrubs the fragment ({@link completeOAuthPopupLanding}),
+ *   2. relays the result to the opener over
+ *      `BroadcastChannel('atlas:oauth:<nonce>')` (a `localStorage` `storage`
+ *      event where BroadcastChannel is missing) — both are same-origin, so
+ *      they connect where `window.opener` cannot,
+ *   3. closes the popup once the opener acknowledges.
+ *
+ * Nothing here carries a token: the result is the same one-time ticket (or
+ * continuation) the redirect flow puts in its URL, and the opener exchanges it.
+ */
+/** The window name {@link startOauthPopup} opens the popup with. */
+export declare const OAUTH_POPUP_WINDOW_NAME = "atlas:oauth";
+/** The fragment key the Frontend API lands the popup result in. */
+export declare const POPUP_RESULT_FRAGMENT = "atlas_popup_result";
+/** The channel a page that finished sign-in inside the popup announces on. */
+export declare const POPUP_SIGNAL_CHANNEL = "atlas:oauth";
+/** The per-flow channel: `atlas:oauth:<nonce>`. */
+export declare function popupChannelName(nonce: string): string;
+/** A fresh base64url channel nonce (22 characters). */
+export declare function createPopupNonce(): string;
+/** The messages on the popup channels. */
+export type PopupRelayMessage = {
+    type: 'atlas:oauth:result';
+    id: string;
+    result: Record<string, unknown>;
+} | {
+    type: 'atlas:oauth:signed_in';
+    id: string;
+} | {
+    type: 'atlas:oauth:ack';
+    id: string;
+};
+/**
+ * Opener side: listen on the flow's channel (and the shared signal channel) for
+ * the popup's result. Every message is acknowledged so the popup can close.
+ * Returns the stop function.
+ */
+export declare function listenForPopupResult(nonce: string, handlers: {
+    /** The landing page relayed the Frontend API's result payload. */
+    onResult: (payload: Record<string, unknown>) => void;
+    /** A page in the popup finished the sign-in itself (cookies are set). */
+    onSignedIn?: () => void;
+}): () => void;
+/** The popup result the Frontend API put in a URL fragment, or null. */
+export declare function readPopupLanding(hash: string): {
+    nonce: string;
+    payload: Record<string, unknown>;
+} | null;
+/** What {@link completeOAuthPopupLanding} did with a landed popup result. */
+export interface PopupLanding {
+    /** The Frontend API's result payload (`type`, `ticket`, `attemptId`, …). */
+    payload: Record<string, unknown>;
+    /**
+     * True when the opener acknowledged the result: it completes the sign-in and
+     * this window is being closed. False when nobody was listening (the opener tab
+     * was closed, or is on another origin) — the caller should complete the
+     * sign-in on this page instead, exactly like a redirect.
+     */
+    delivered: boolean;
+}
+/**
+ * Popup side, run on startup: if this page is the landing of a severed popup
+ * (`#atlas_popup_result=…` in the URL — normally with `window.name ===
+ * 'atlas:oauth'`, though a browser may clear the name when the opener's COOP
+ * switched browsing-context groups, so the fragment alone is decisive), scrub
+ * the fragment, relay the result to the opener and close this window once the
+ * opener acknowledges. Returns null when this is not such a landing.
+ */
+export declare function completeOAuthPopupLanding(options?: {
+    win?: Window;
+    ackTimeoutMs?: number;
+}): Promise<PopupLanding | null>;
+/**
+ * Popup side, after a sign-in completed ON this page (the redirect flow ran in
+ * the popup — e.g. an SDK or provider path without the channel): when this is
+ * the Atlas popup window, tell the waiting opener and close. It closes only when
+ * an opener is there to take over (it acknowledged, or `window.opener` is live),
+ * never stranding a user whose opener tab is gone. Resolves whether it closed.
+ */
+export declare function closeOAuthPopupAfterSignIn(options?: {
+    win?: Window;
+    ackTimeoutMs?: number;
+}): Promise<boolean>;