@authrim/sveltekit 0.1.0

package/dist/direct-auth/consent.js

@@ -0,0 +1,57 @@
+/**
+ * Consent API Implementation
+ *
+ * Provides methods for fetching consent screen data and submitting consent decisions.
+ * This is a thin API wrapper — no business logic, just HTTP calls.
+ */
+// =============================================================================
+// Implementation
+// =============================================================================
+export class ConsentApiImpl {
+    issuer;
+    http;
+    constructor(config) {
+        this.issuer = config.issuer;
+        this.http = config.http;
+    }
+    /**
+     * Fetch consent screen data
+     */
+    async getData(challengeId) {
+        const url = `${this.issuer}/auth/consent?challenge_id=${encodeURIComponent(challengeId)}`;
+        const response = await this.http.fetch(url, {
+            method: "GET",
+            headers: { Accept: "application/json" },
+            credentials: "include",
+        });
+        if (!response.ok || !response.data) {
+            const errorMsg = response.data
+                ?.error_description || "Failed to load consent data";
+            throw new Error(errorMsg);
+        }
+        return response.data;
+    }
+    /**
+     * Submit consent decision (approve or deny)
+     */
+    async submit(challengeId, options) {
+        const url = `${this.issuer}/auth/consent`;
+        const response = await this.http.fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            credentials: "include",
+            body: JSON.stringify({
+                challenge_id: challengeId,
+                approved: options.approve,
+                selected_org_id: options.selectedOrgId,
+                acting_as_user_id: options.actingAsUserId,
+            }),
+        });
+        if (!response.ok || !response.data) {
+            const errorMsg = response.data
+                ?.error_description || "Failed to submit consent";
+            throw new Error(errorMsg);
+        }
+        return response.data;
+    }
+}

package/dist/direct-auth/device-flow.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Device Flow API Implementation
+ *
+ * Provides methods for device code verification (RFC 8628).
+ * This is a thin API wrapper — no business logic, just HTTP calls.
+ */
+import type { HttpClient } from "@authrim/core";
+export interface DeviceFlowData {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+    expires_in: number;
+    interval: number;
+}
+export interface DeviceFlowSubmitResult {
+    message: string;
+}
+export interface DeviceFlowError {
+    error: string;
+    error_description?: string;
+}
+export interface DeviceFlowApiConfig {
+    issuer: string;
+    http: HttpClient;
+}
+export declare class DeviceFlowApiImpl {
+    private readonly issuer;
+    private readonly http;
+    constructor(config: DeviceFlowApiConfig);
+    /**
+     * Verify and submit device code (approve or deny)
+     */
+    submit(userCode: string, approve?: boolean): Promise<DeviceFlowSubmitResult>;
+}
+export declare class DeviceFlowVerificationError extends Error {
+    readonly errorCode: string;
+    constructor(message: string, errorCode: string);
+}
+//# sourceMappingURL=device-flow.d.ts.map

package/dist/direct-auth/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/lib/direct-auth/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,eAAe,CAAC;AAW7D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAMD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,UAAU,CAAC;CAClB;AAMD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;gBAEtB,MAAM,EAAE,mBAAmB;IAKvC;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,MAAM,EAChB,OAAO,UAAO,GACb,OAAO,CAAC,sBAAsB,CAAC;CAwBnC;AAED,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,SAAgB,SAAS,EAAE,MAAM,CAAC;gBAEtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAK/C"}

package/dist/direct-auth/device-flow.js

@@ -0,0 +1,45 @@
+/**
+ * Device Flow API Implementation
+ *
+ * Provides methods for device code verification (RFC 8628).
+ * This is a thin API wrapper — no business logic, just HTTP calls.
+ */
+// =============================================================================
+// Implementation
+// =============================================================================
+export class DeviceFlowApiImpl {
+    issuer;
+    http;
+    constructor(config) {
+        this.issuer = config.issuer;
+        this.http = config.http;
+    }
+    /**
+     * Verify and submit device code (approve or deny)
+     */
+    async submit(userCode, approve = true) {
+        const url = `${this.issuer}/api/device/verify`;
+        const response = await this.http.fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            credentials: "include",
+            body: JSON.stringify({
+                user_code: userCode,
+                approved: approve,
+            }),
+        });
+        if (!response.ok) {
+            const errorData = response.data;
+            throw new DeviceFlowVerificationError(errorData?.error_description || "Failed to verify device code", errorData?.error || "verification_failed");
+        }
+        return response.data;
+    }
+}
+export class DeviceFlowVerificationError extends Error {
+    errorCode;
+    constructor(message, errorCode) {
+        super(message);
+        this.name = "DeviceFlowVerificationError";
+        this.errorCode = errorCode;
+    }
+}

package/dist/direct-auth/email-code.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Email Code Authentication (OTP)
+ *
+ * IMPORTANT: Multi-tab limitation
+ * The pending verification state (codeVerifier, attemptId) is stored in memory.
+ * This means that if a user opens multiple tabs:
+ * - Each tab has its own EmailCodeAuthImpl instance
+ * - send() in Tab A creates state only in Tab A
+ * - verify() in Tab B will fail because Tab B has no state
+ *
+ * For multi-tab support, consider using BroadcastChannel or SharedWorker.
+ * For most use cases, this limitation is acceptable.
+ */
+import { type HttpClient, type CryptoProvider, type EmailCodeAuth, type EmailCodeSendOptions, type EmailCodeSendResult, type EmailCodeVerifyOptions, type AuthResult, type Session, type User } from '@authrim/core';
+export interface EmailCodeAuthOptions {
+    issuer: string;
+    clientId: string;
+    http: HttpClient;
+    crypto: CryptoProvider;
+    exchangeToken: (authCode: string, codeVerifier: string) => Promise<{
+        session?: Session;
+        user?: User;
+    }>;
+}
+export declare class EmailCodeAuthImpl implements EmailCodeAuth {
+    private readonly issuer;
+    private readonly clientId;
+    private readonly http;
+    private readonly pkce;
+    private readonly exchangeToken;
+    private pendingVerifications;
+    private cleanupTimer;
+    constructor(options: EmailCodeAuthOptions);
+    private startCleanupTimer;
+    private pruneExpiredVerifications;
+    stopCleanupTimer(): void;
+    /**
+     * Cleanup resources (must be called when the auth client is destroyed)
+     */
+    destroy(): void;
+    send(email: string, options?: EmailCodeSendOptions): Promise<EmailCodeSendResult>;
+    verify(email: string, code: string, _options?: EmailCodeVerifyOptions): Promise<AuthResult>;
+    hasPendingVerification(email: string): boolean;
+    getRemainingTime(email: string): number;
+    clearPendingVerification(email: string): void;
+    private isValidEmail;
+}
+//# sourceMappingURL=email-code.d.ts.map

package/dist/direct-auth/email-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-code.d.ts","sourceRoot":"","sources":["../../src/lib/direct-auth/email-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EAKf,KAAK,OAAO,EACZ,KAAK,IAAI,EACV,MAAM,eAAe,CAAC;AAQvB,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,aAAa,EAAE,CACb,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,KACjB,OAAO,CAAC;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC,CAAC;CACJ;AAWD,qBAAa,iBAAkB,YAAW,aAAa;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwC;IACtE,OAAO,CAAC,oBAAoB,CAA0C;IACtE,OAAO,CAAC,YAAY,CAA+C;gBAEvD,OAAO,EAAE,oBAAoB;IASzC,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,yBAAyB;IAUjC,gBAAgB,IAAI,IAAI;IAOxB;;OAEG;IACH,OAAO,IAAI,IAAI;IAST,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAyDjF,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,sBAAsB,GAChC,OAAO,CAAC,UAAU,CAAC;IAuJtB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAY9C,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAQvC,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI7C,OAAO,CAAC,YAAY;CAIrB"}

package/dist/direct-auth/email-code.js

@@ -0,0 +1,265 @@
+/**
+ * Email Code Authentication (OTP)
+ *
+ * IMPORTANT: Multi-tab limitation
+ * The pending verification state (codeVerifier, attemptId) is stored in memory.
+ * This means that if a user opens multiple tabs:
+ * - Each tab has its own EmailCodeAuthImpl instance
+ * - send() in Tab A creates state only in Tab A
+ * - verify() in Tab B will fail because Tab B has no state
+ *
+ * For multi-tab support, consider using BroadcastChannel or SharedWorker.
+ * For most use cases, this limitation is acceptable.
+ */
+import { AuthrimError, PKCEHelper, } from '@authrim/core';
+import { getAuthrimCode, mapSeverity } from '../utils/error-mapping.js';
+const ENDPOINTS = {
+    EMAIL_CODE_SEND: '/api/v1/auth/direct/email-code/send',
+    EMAIL_CODE_VERIFY: '/api/v1/auth/direct/email-code/verify',
+};
+const CLEANUP_INTERVAL = 5 * 60 * 1000;
+export class EmailCodeAuthImpl {
+    issuer;
+    clientId;
+    http;
+    pkce;
+    exchangeToken;
+    pendingVerifications = new Map();
+    cleanupTimer = null;
+    constructor(options) {
+        this.issuer = options.issuer;
+        this.clientId = options.clientId;
+        this.http = options.http;
+        this.pkce = new PKCEHelper(options.crypto);
+        this.exchangeToken = options.exchangeToken;
+        this.startCleanupTimer();
+    }
+    startCleanupTimer() {
+        if (typeof window === 'undefined')
+            return;
+        this.cleanupTimer = setInterval(() => {
+            this.pruneExpiredVerifications();
+        }, CLEANUP_INTERVAL);
+    }
+    pruneExpiredVerifications() {
+        const now = Date.now();
+        for (const [email, state] of this.pendingVerifications.entries()) {
+            if (now > state.expiresAt) {
+                state.codeVerifier = '';
+                this.pendingVerifications.delete(email);
+            }
+        }
+    }
+    stopCleanupTimer() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+        }
+    }
+    /**
+     * Cleanup resources (must be called when the auth client is destroyed)
+     */
+    destroy() {
+        this.stopCleanupTimer();
+        // Clear all pending verifications and their codeVerifiers
+        for (const state of this.pendingVerifications.values()) {
+            state.codeVerifier = '';
+        }
+        this.pendingVerifications.clear();
+    }
+    async send(email, options) {
+        if (!this.isValidEmail(email)) {
+            throw new AuthrimError('invalid_request', 'Invalid email address format');
+        }
+        const { codeVerifier, codeChallenge } = await this.pkce.generatePKCE();
+        const request = {
+            client_id: this.clientId,
+            email,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+            locale: options?.locale,
+        };
+        const response = await this.http.fetch(`${this.issuer}${ENDPOINTS.EMAIL_CODE_SEND}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(request),
+        });
+        if (!response.ok || !response.data) {
+            if (response.status === 429) {
+                const retryAfter = response.headers?.['retry-after'];
+                throw new AuthrimError('email_code_too_many_attempts', 'Too many email code requests. Please wait before trying again.', {
+                    details: {
+                        retryAfter: retryAfter ? parseInt(retryAfter, 10) : 300,
+                    },
+                });
+            }
+            throw new AuthrimError('network_error', 'Failed to send email code');
+        }
+        const { attempt_id, expires_in, masked_email } = response.data;
+        this.pendingVerifications.set(email.toLowerCase(), {
+            email,
+            attemptId: attempt_id,
+            codeVerifier,
+            expiresAt: Date.now() + expires_in * 1000,
+        });
+        return {
+            attemptId: attempt_id,
+            expiresIn: expires_in,
+            maskedEmail: masked_email,
+        };
+    }
+    async verify(email, code, _options) {
+        if (!/^\d{6,8}$/.test(code)) {
+            return {
+                success: false,
+                error: {
+                    error: 'email_code_invalid',
+                    error_description: 'Invalid code format. Please enter a 6-digit code.',
+                    code: 'AR002001',
+                    meta: { retryable: true, severity: 'warn' },
+                },
+            };
+        }
+        const state = this.pendingVerifications.get(email.toLowerCase());
+        if (!state) {
+            return {
+                success: false,
+                error: {
+                    error: 'challenge_invalid',
+                    error_description: 'No pending verification found. Please request a new code.',
+                    code: 'AR002004',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            };
+        }
+        if (Date.now() > state.expiresAt) {
+            this.pendingVerifications.delete(email.toLowerCase());
+            return {
+                success: false,
+                error: {
+                    error: 'email_code_expired',
+                    error_description: 'Verification code has expired. Please request a new code.',
+                    code: 'AR002002',
+                    meta: { retryable: false, severity: 'warn' },
+                },
+            };
+        }
+        try {
+            const request = {
+                attempt_id: state.attemptId,
+                code,
+                code_verifier: state.codeVerifier,
+            };
+            const response = await this.http.fetch(`${this.issuer}${ENDPOINTS.EMAIL_CODE_VERIFY}`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(request),
+            });
+            if (!response.ok || !response.data) {
+                if (response.status === 400) {
+                    const errorData = response.data;
+                    if (errorData?.error === 'invalid_code') {
+                        return {
+                            success: false,
+                            error: {
+                                error: 'email_code_invalid',
+                                error_description: 'Invalid verification code. Please check and try again.',
+                                code: 'AR002001',
+                                meta: { retryable: true, severity: 'warn' },
+                            },
+                        };
+                    }
+                    if (errorData?.error === 'code_expired') {
+                        this.pendingVerifications.delete(email.toLowerCase());
+                        return {
+                            success: false,
+                            error: {
+                                error: 'email_code_expired',
+                                error_description: 'Verification code has expired.',
+                                code: 'AR002002',
+                                meta: { retryable: false, severity: 'warn' },
+                            },
+                        };
+                    }
+                    if (errorData?.error === 'too_many_attempts') {
+                        this.pendingVerifications.delete(email.toLowerCase());
+                        return {
+                            success: false,
+                            error: {
+                                error: 'email_code_too_many_attempts',
+                                error_description: 'Too many incorrect attempts. Please request a new code.',
+                                code: 'AR002003',
+                                meta: { retryable: false, retry_after: 300, severity: 'error' },
+                            },
+                        };
+                    }
+                }
+                throw new AuthrimError('network_error', 'Failed to verify email code');
+            }
+            // Copy codeVerifier before clearing for security
+            const codeVerifier = state.codeVerifier;
+            state.codeVerifier = ''; // Clear immediately before exchangeToken
+            this.pendingVerifications.delete(email.toLowerCase());
+            const { auth_code } = response.data;
+            const { session, user } = await this.exchangeToken(auth_code, codeVerifier);
+            return {
+                success: true,
+                session,
+                user,
+            };
+        }
+        catch (error) {
+            // Ensure codeVerifier is cleared on error (may already be cleared above)
+            if (state && state.codeVerifier) {
+                state.codeVerifier = '';
+            }
+            if (error instanceof AuthrimError) {
+                return {
+                    success: false,
+                    error: {
+                        error: error.code,
+                        error_description: error.message,
+                        code: getAuthrimCode(error.code, 'AR002000'),
+                        meta: {
+                            retryable: error.meta.retryable,
+                            severity: mapSeverity(error.meta.severity),
+                        },
+                    },
+                };
+            }
+            return {
+                success: false,
+                error: {
+                    error: 'network_error',
+                    error_description: error instanceof Error ? error.message : 'Unknown error',
+                    code: 'AR001001',
+                    meta: { retryable: true, severity: 'error' },
+                },
+            };
+        }
+    }
+    hasPendingVerification(email) {
+        const state = this.pendingVerifications.get(email.toLowerCase());
+        if (!state)
+            return false;
+        if (Date.now() > state.expiresAt) {
+            this.pendingVerifications.delete(email.toLowerCase());
+            return false;
+        }
+        return true;
+    }
+    getRemainingTime(email) {
+        const state = this.pendingVerifications.get(email.toLowerCase());
+        if (!state)
+            return 0;
+        const remaining = Math.floor((state.expiresAt - Date.now()) / 1000);
+        return Math.max(0, remaining);
+    }
+    clearPendingVerification(email) {
+        this.pendingVerifications.delete(email.toLowerCase());
+    }
+    isValidEmail(email) {
+        const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+        return emailRegex.test(email);
+    }
+}

package/dist/direct-auth/index.d.ts

@@ -0,0 +1,9 @@
+export { PasskeyAuthImpl, type PasskeyAuthOptions } from "./passkey.js";
+export { EmailCodeAuthImpl, type EmailCodeAuthOptions } from "./email-code.js";
+export { SocialAuthImpl, type SocialAuthOptions } from "./social.js";
+export { SessionAuthImpl, type SessionManagerOptions } from "./session.js";
+export { ConsentApiImpl, type ConsentApiConfig } from "./consent.js";
+export { DeviceFlowApiImpl, type DeviceFlowApiConfig, DeviceFlowVerificationError, } from "./device-flow.js";
+export { CIBAApiImpl, type CIBAApiConfig } from "./ciba.js";
+export { LoginChallengeApiImpl, type LoginChallengeApiConfig, } from "./login-challenge.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/direct-auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/direct-auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,qBAAqB,EACrB,KAAK,uBAAuB,GAC7B,MAAM,sBAAsB,CAAC"}

package/dist/direct-auth/index.js

@@ -0,0 +1,8 @@
+export { PasskeyAuthImpl } from "./passkey.js";
+export { EmailCodeAuthImpl } from "./email-code.js";
+export { SocialAuthImpl } from "./social.js";
+export { SessionAuthImpl } from "./session.js";
+export { ConsentApiImpl } from "./consent.js";
+export { DeviceFlowApiImpl, DeviceFlowVerificationError, } from "./device-flow.js";
+export { CIBAApiImpl } from "./ciba.js";
+export { LoginChallengeApiImpl, } from "./login-challenge.js";

package/dist/direct-auth/login-challenge.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Login Challenge API Implementation
+ *
+ * Provides methods for fetching login challenge data (OAuth client metadata).
+ * This is a thin API wrapper — no business logic, just HTTP calls.
+ */
+import type { HttpClient } from "@authrim/core";
+export interface LoginChallengeClientInfo {
+    client_id: string;
+    client_name: string;
+    logo_uri?: string;
+    client_uri?: string;
+    policy_uri?: string;
+    tos_uri?: string;
+    redirect_uris: string[];
+    scope: string;
+    response_type: string;
+}
+export interface LoginChallengeData {
+    challenge_id: string;
+    client: LoginChallengeClientInfo;
+    requested_scopes: string[];
+    login_hint?: string;
+    prompt?: string;
+    max_age?: number;
+    acr_values?: string[];
+}
+export interface LoginChallengeApiConfig {
+    issuer: string;
+    http: HttpClient;
+}
+export declare class LoginChallengeApiImpl {
+    private readonly issuer;
+    private readonly http;
+    constructor(config: LoginChallengeApiConfig);
+    /**
+     * Fetch login challenge data by challenge ID
+     */
+    getData(challengeId: string): Promise<LoginChallengeData>;
+}
+//# sourceMappingURL=login-challenge.d.ts.map

package/dist/direct-auth/login-challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-challenge.d.ts","sourceRoot":"","sources":["../../src/lib/direct-auth/login-challenge.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,eAAe,CAAC;AAW7D,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,wBAAwB,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAMD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,UAAU,CAAC;CAClB;AAMD,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;gBAEtB,MAAM,EAAE,uBAAuB;IAK3C;;OAEG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAiBhE"}

package/dist/direct-auth/login-challenge.js

@@ -0,0 +1,34 @@
+/**
+ * Login Challenge API Implementation
+ *
+ * Provides methods for fetching login challenge data (OAuth client metadata).
+ * This is a thin API wrapper — no business logic, just HTTP calls.
+ */
+// =============================================================================
+// Implementation
+// =============================================================================
+export class LoginChallengeApiImpl {
+    issuer;
+    http;
+    constructor(config) {
+        this.issuer = config.issuer;
+        this.http = config.http;
+    }
+    /**
+     * Fetch login challenge data by challenge ID
+     */
+    async getData(challengeId) {
+        const url = `${this.issuer}/auth/login-challenge?challenge_id=${encodeURIComponent(challengeId)}`;
+        const response = await this.http.fetch(url, {
+            method: "GET",
+            headers: { Accept: "application/json" },
+            credentials: "include",
+        });
+        if (!response.ok || !response.data) {
+            const errorMsg = response.data
+                ?.error_description || "Failed to load login challenge data";
+            throw new Error(errorMsg);
+        }
+        return response.data;
+    }
+}

package/dist/direct-auth/passkey.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Passkey Authentication (WebAuthn)
+ */
+import { type HttpClient, type CryptoProvider, type PasskeyAuth, type PasskeyLoginOptions, type PasskeySignUpOptions, type PasskeyRegisterOptions, type PasskeyCredential, type AuthResult, type Session, type User } from '@authrim/core';
+export interface PasskeyAuthOptions {
+    issuer: string;
+    clientId: string;
+    http: HttpClient;
+    crypto: CryptoProvider;
+    exchangeToken: (authCode: string, codeVerifier: string) => Promise<{
+        session?: Session;
+        user?: User;
+    }>;
+}
+export declare class PasskeyAuthImpl implements PasskeyAuth {
+    private readonly issuer;
+    private readonly clientId;
+    private readonly http;
+    private readonly pkce;
+    private readonly exchangeToken;
+    private conditionalAbortController;
+    constructor(options: PasskeyAuthOptions);
+    isSupported(): boolean;
+    isConditionalUIAvailable(): Promise<boolean>;
+    login(options?: PasskeyLoginOptions): Promise<AuthResult>;
+    signUp(options: PasskeySignUpOptions): Promise<AuthResult>;
+    register(options?: PasskeyRegisterOptions): Promise<PasskeyCredential>;
+    cancelConditionalUI(): void;
+}
+//# sourceMappingURL=passkey.d.ts.map

package/dist/direct-auth/passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../src/lib/direct-auth/passkey.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EAUf,KAAK,OAAO,EACZ,KAAK,IAAI,EACV,MAAM,eAAe,CAAC;AAkBvB,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,aAAa,EAAE,CACb,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,KACjB,OAAO,CAAC;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,eAAgB,YAAW,WAAW;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IACpE,OAAO,CAAC,0BAA0B,CAAgC;gBAEtD,OAAO,EAAE,kBAAkB;IAQvC,WAAW,IAAI,OAAO;IAQhB,wBAAwB,IAAI,OAAO,CAAC,OAAO,CAAC;IAa5C,KAAK,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC;IAoKzD,MAAM,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC;IAyJ1D,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAiF5E,mBAAmB,IAAI,IAAI;CAM5B"}