@axinom/mosaic-user-auth 0.29.0-rc.6 → 0.29.0-rc.7

package/dist/cjs/UserServiceClient/UserServiceClient.d.ts

@@ -1,4 +1,4 @@
-import { type CheckPasswordResetOtpResponse, type CheckUserSignUpOtpResponse, type CompletePasswordResetResponse, type CompleteUserSignUpResponse, type DecryptNativeCookieResponse, type IdpConfiguration, type InitiatePasswordResetResponse, type SignInResponse, type UserSignUpResponse } from '@axinom/mosaic-user-auth-utils';
+import { type CheckPasswordResetOtpResponse, type CheckUserSignUpOtpResponse, type CompletePasswordResetResponse, type CompleteUserSignUpResponse, type DecryptNativeCookieResponse, type DeviceApprovalResponse, type DeviceAuthorizationRequest, type DeviceAuthorizationResponse, type DevicePollResponse, type DeviceVerificationResponse, type IdpConfiguration, type InitiatePasswordResetResponse, type SignInResponse, type TokenResponse as UserAuthTokenResponse, type UserSignUpResponse } from '@axinom/mosaic-user-auth-utils';
 import { TokenRenewalMethod } from '../common/enums.js';
 import type { AuthenticateEndUserApplicationResponse, SignInRequest, TokenChangedCallback, TokenResponse, UserAuthConfig, UserProfileActivateResponse, UserProfileCreateResponse, UserProfileDeleteResponse, UserProfileResponse, UserProfileUpdateInput, UserProfileUpdateResponse, UserProfilesResponse, UserServiceConfig } from '../common/types.js';
 import type { CheckEndUserPasswordResetOtpInput, CheckEndUserSignUpOtpInput, CompleteEndUserPasswordResetInput, CompleteEndUserSignUpInput, InitiateEndUserSignUpInput } from '../generated/ax-auth-management-graphql.types.js';
@@ -25,6 +25,17 @@ export interface IUserServiceClient {
     deleteUserProfile(endUserAccessToken: string, userProfileId: string): Promise<UserProfileDeleteResponse>;
     authenticateEndUserApplication(authenticateEndUserApplicationRequest: AuthenticateEndUserApplicationInput): Promise<AuthenticateEndUserApplicationResponse>;
     decryptNativeCookie(encryptedCookie: string, key: string): Promise<DecryptNativeCookieResponse>;
+    requestDeviceAuthorization(request?: DeviceAuthorizationRequest): Promise<DeviceAuthorizationResponse>;
+    requestDeviceRefreshToken(deviceCode: string): Promise<DevicePollResponse>;
+    pollDeviceRefreshToken(deviceCode: string, options: {
+        intervalSeconds: number;
+        signal?: AbortSignal;
+        onPending?: (response: DevicePollResponse) => void;
+    }): Promise<DevicePollResponse>;
+    getDeviceAccessToken(refreshToken: string): Promise<UserAuthTokenResponse>;
+    getDeviceVerification(userCode: string): Promise<DeviceVerificationResponse>;
+    approveDevice(endUserAccessToken: string, userCode: string): Promise<DeviceApprovalResponse>;
+    denyDevice(endUserAccessToken: string, userCode: string): Promise<DeviceApprovalResponse>;
     getAuthUrl(idpConnectionId: string, redirectUrl: string): URL;
     getNativeAuthUrl(idpConnectionId: string, redirectUri: string, encryptionKey: string): URL;
 }
@@ -186,6 +197,69 @@ export declare class UserServiceClient implements IUserServiceClient {
      * @returns
      */
     decryptNativeCookie: (encryptedCookie: string, key: string) => Promise<DecryptNativeCookieResponse>;
+    /**
+     * Starts the Device Authorization grant for the device (a NATIVE application).
+     * Returns the `userCode` / `verificationUri` to show the user and the `deviceCode` to poll with.
+     *
+     * NOTE: The device flow is headless and does NOT use the `AX_REFRESH_TOKEN` cookie — the
+     * device's tokens are carried explicitly. @see {@link pollDeviceRefreshToken} / {@link getDeviceAccessToken}.
+     *
+     * @param request Optional request body (a display-only `deviceLabel`).
+     */
+    requestDeviceAuthorization: (request?: DeviceAuthorizationRequest) => Promise<DeviceAuthorizationResponse>;
+    /**
+     * Performs a single poll. Prefer {@link pollDeviceRefreshToken} for the polling loop. On SUCCESS
+     * the response carries the device `refreshToken`; pass it to {@link getDeviceAccessToken}.
+     *
+     * @param deviceCode The secret returned by {@link requestDeviceAuthorization}.
+     */
+    requestDeviceRefreshToken: (deviceCode: string) => Promise<DevicePollResponse>;
+    /**
+     * Polls `device/poll` honouring the server interval and `SLOW_DOWN` back-off until the
+     * authorization reaches a terminal state (SUCCESS / ACCESS_DENIED / EXPIRED). On SUCCESS the
+     * response carries the device `refreshToken` — store it, then call {@link getDeviceAccessToken}
+     * to obtain an access token.
+     *
+     * @param deviceCode The secret returned by {@link requestDeviceAuthorization}.
+     * @param options.intervalSeconds Initial seconds between polls (from the authorize response).
+     * @param options.signal Optional `AbortSignal` to cancel polling.
+     * @param options.onPending Optional callback invoked on each non-terminal poll.
+     */
+    pollDeviceRefreshToken: (deviceCode: string, options: {
+        intervalSeconds: number;
+        signal?: AbortSignal;
+        onPending?: (response: DevicePollResponse) => void;
+    }) => Promise<DevicePollResponse>;
+    /**
+     * Gets an access token for a device session from its refresh token — used for the
+     * first access token (right after the poll succeeds) and for every renewal. The refresh token is
+     * presented as a `Bearer` header, since the device cannot use the browser cookie.
+     *
+     * @param refreshToken The device refresh token from the SUCCESS device poll.
+     */
+    getDeviceAccessToken: (refreshToken: string) => Promise<UserAuthTokenResponse>;
+    /**
+     * Reads what a given `userCode` is about to authorize (for the activation page). Anonymous and
+     * read-only — it never approves anything.
+     *
+     * @param userCode The short code the user typed on the activation page.
+     */
+    getDeviceVerification: (userCode: string) => Promise<DeviceVerificationResponse>;
+    /**
+     * Approves a device authorization on behalf of the signed-in user. Requires the end-user
+     * access token (the same `Bearer` credential used for every other end-user API).
+     *
+     * @param endUserAccessToken The signed-in user's access token (JWT).
+     * @param userCode The short code shown on the device.
+     */
+    approveDevice: (endUserAccessToken: string, userCode: string) => Promise<DeviceApprovalResponse>;
+    /**
+     * Denies a device authorization on behalf of the signed-in user.
+     *
+     * @param endUserAccessToken The signed-in user's access token (JWT).
+     * @param userCode The short code shown on the device.
+     */
+    denyDevice: (endUserAccessToken: string, userCode: string) => Promise<DeviceApprovalResponse>;
     /**
      * Returns the authentication URL for web based applications.
      *

package/dist/cjs/UserServiceClient/UserServiceClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserServiceClient.d.ts","sourceRoot":"","sources":["../../../src/UserServiceClient/UserServiceClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAE/B,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,6BAA6B,EAElC,KAAK,cAAc,EAGnB,KAAK,kBAAkB,EAExB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EACV,sCAAsC,EACtC,aAAa,EAEb,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EACV,iCAAiC,EACjC,0BAA0B,EAC1B,iCAAiC,EACjC,0BAA0B,EAC1B,0BAA0B,EAC3B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,uDAAuD,CAAC;AAkBjH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C,qBAAqB,CAAC,aAAa,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE7E,kBAAkB,CAChB,iBAAiB,EAAE,IAAI,CAAC,0BAA0B,EAAE,eAAe,CAAC,GACnE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B,kBAAkB,CAChB,yBAAyB,EAAE,0BAA0B,GACpD,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC,kBAAkB,CAChB,yBAAyB,EAAE,0BAA0B,GACpD,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE1C,qBAAqB,CACnB,4BAA4B,EAAE,iCAAiC,GAC9D,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE1C,qBAAqB,CACnB,4BAA4B,EAAE,iCAAiC,GAC9D,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE1C,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAEnC,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAE7D,yBAAyB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAEhE,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEpD,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/B,gBAAgB,CACd,kBAAkB,EAAE,MAAM,EAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC,cAAc,CACZ,kBAAkB,EAAE,MAAM,EAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC,eAAe,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE3E,iBAAiB,CACf,kBAAkB,EAAE,MAAM,EAC1B,WAAW,EAAE,MAAM,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC,iBAAiB,CACf,kBAAkB,EAAE,MAAM,EAC1B,mBAAmB,EAAE,sBAAsB,GAC1C,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC,iBAAiB,CACf,kBAAkB,EAAE,MAAM,EAC1B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC,8BAA8B,CAC5B,qCAAqC,EAAE,mCAAmC,GACzE,OAAO,CAAC,sCAAsC,CAAC,CAAC;IAEnD,mBAAmB,CACjB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC,UAAU,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC;IAE9D,gBAAgB,CACd,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,GAAG,CAAC;CACR;AAED,qBAAa,iBAAkB,YAAW,kBAAkB;IAexD,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,iBAAiB;IACzB,OAAO,CAAC,kBAAkB;IAhB5B,OAAO,CAAC,qBAAqB,CAA8B;IAC3D,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,sCAAsC,CAEpB;IAC1B,OAAO,CAAC,gBAAgB,CAAkD;IAE1E;;;;;OAKG;gBAEO,cAAc,EAAE,cAAc,EAC9B,iBAAiB,EAAE,iBAAiB,EACpC,kBAAkB,GAAE,kBAAiD;IAG/E,OAAO,KAAK,aAAa,GAExB;IAED,OAAO,KAAK,aAAa,QAOxB;IAED,OAAO,CAAC,gBAAgB,CAEtB;IAEF,OAAO,CAAC,kBAAkB,CAkBxB;IAEF,OAAO,CAAC,iCAAiC,CAcrC;IAEJ;;OAEG;IACH,OAAO,CAAC,UAAU,CAyBhB;IAIF,OAAO,CAAC,uBAAuB,CAAS;IAExC;;OAEG;IACH,OAAO,CAAC,uBAAuB,CAY7B;IAEF;;;;;;;;OAQG;IACH,wBAAwB,QAAa,OAAO,CAAC,OAAO,CAAC,CAGnD;IAEF;;;;;OAKG;IACH,qBAAqB,GACnB,eAAe,aAAa,KAC3B,OAAO,CAAC,cAAc,CAAC,CAexB;IAEF;;;;;OAKG;IACH,kBAAkB,GAChB,mBAAmB,IAAI,CAAC,0BAA0B,EAAE,eAAe,CAAC,KACnE,OAAO,CAAC,kBAAkB,CAAC,CAwB5B;IAEF;;;;;OAKG;IACH,kBAAkB,GAChB,2BAA2B,0BAA0B,KACpD,OAAO,CAAC,0BAA0B,CAAC,CAoBpC;IAEF;;;;;;;OAOG;IACH,kBAAkB,GAChB,2BAA2B,0BAA0B,KACpD,OAAO,CAAC,0BAA0B,CAAC,CAgBpC;IAEF;;;;;;;;OAQG;IACH,qBAAqB,GACnB,OAAO,MAAM,EACb,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KACnC,OAAO,CAAC,6BAA6B,CAAC,CAsBvC;IAEF;;;;;OAKG;IACH,qBAAqB,GACnB,8BAA8B,iCAAiC,KAC9D,OAAO,CAAC,6BAA6B,CAAC,CAoBvC;IAEF;;;;;;OAMG;IACH,qBAAqB,GACnB,8BAA8B,iCAAiC,KAC9D,OAAO,CAAC,6BAA6B,CAAC,CAevC;IAEF;;;;;OAKG;IACH,QAAQ,QAAa,OAAO,CAAC,aAAa,CAAC,CAuBzC;IAEF;;;OAGG;IACH,sBAAsB,GAAI,UAAU,oBAAoB,KAAG,IAAI,CAE7D;IAEF;;OAEG;IACH,yBAAyB,GAAI,UAAU,oBAAoB,KAAG,IAAI,CAIhE;IAEF;;;;OAIG;IACH,oBAAoB,QAAa,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAM1D;IAEF;;OAEG;IACH,UAAU,QAAa,OAAO,CAAC,OAAO,CAAC,CAOrC;IAEF;;OAEG;IACH,gBAAgB,GACd,oBAAoB,MAAM,EAC1B,WAAW,MAAM,KAChB,OAAO,CAAC,2BAA2B,CAAC,CAiBrC;IAEF;;OAEG;IACH,cAAc,GACZ,oBAAoB,MAAM,EAC1B,WAAW,MAAM,KAChB,OAAO,CAAC,mBAAmB,CAAC,CAW7B;IAEF;;OAEG;IACH,eAAe,GACb,oBAAoB,MAAM,KACzB,OAAO,CAAC,oBAAoB,CAAC,CAU9B;IAEF;;OAEG;IACH,iBAAiB,GACf,oBAAoB,MAAM,EAC1B,aAAa,MAAM,EACnB,mBAAmB,MAAM,KACxB,OAAO,CAAC,yBAAyB,CAAC,CAYnC;IAEF;;;OAGG;IACH,iBAAiB,GACf,oBAAoB,MAAM,EAC1B,qBAAqB,sBAAsB,KAC1C,OAAO,CAAC,yBAAyB,CAAC,CAWnC;IAEF;;OAEG;IACH,iBAAiB,GACf,oBAAoB,MAAM,EAC1B,eAAe,MAAM,KACpB,OAAO,CAAC,yBAAyB,CAAC,CAWnC;IAEF;;;;OAIG;IACH,8BAA8B,GAC5B,uCAAuC,mCAAmC,KACzE,OAAO,CAAC,sCAAsC,CAAC,CAKhD;IAEF;;;;;OAKG;IACH,mBAAmB,GACjB,iBAAiB,MAAM,EACvB,KAAK,MAAM,KACV,OAAO,CAAC,2BAA2B,CAAC,CAMrC;IAEF;;;;;;OAMG;IACH,UAAU,GAAI,iBAAiB,MAAM,EAAE,WAAW,MAAM,KAAG,GAAG,CAE5D;IAEF;;;;;;;OAOG;IACH,gBAAgB,GACd,iBAAiB,MAAM,EACvB,WAAW,MAAM,EACjB,eAAe,MAAM,KACpB,GAAG,CAQJ;CACH"}
+{"version":3,"file":"UserServiceClient.d.ts","sourceRoot":"","sources":["../../../src/UserServiceClient/UserServiceClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAE/B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,KAAK,6BAA6B,EAElC,KAAK,cAAc,EAGnB,KAAK,aAAa,IAAI,qBAAqB,EAC3C,KAAK,kBAAkB,EAExB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EACV,sCAAsC,EACtC,aAAa,EAEb,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EACV,iCAAiC,EACjC,0BAA0B,EAC1B,iCAAiC,EACjC,0BAA0B,EAC1B,0BAA0B,EAC3B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,uDAAuD,CAAC;AAmBjH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C,qBAAqB,CAAC,aAAa,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE7E,kBAAkB,CAChB,iBAAiB,EAAE,IAAI,CAAC,0BAA0B,EAAE,eAAe,CAAC,GACnE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B,kBAAkB,CAChB,yBAAyB,EAAE,0BAA0B,GACpD,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC,kBAAkB,CAChB,yBAAyB,EAAE,0BAA0B,GACpD,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE1C,qBAAqB,CACnB,4BAA4B,EAAE,iCAAiC,GAC9D,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE1C,qBAAqB,CACnB,4BAA4B,EAAE,iCAAiC,GAC9D,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE1C,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAEnC,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAE7D,yBAAyB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAEhE,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEpD,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/B,gBAAgB,CACd,kBAAkB,EAAE,MAAM,EAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC,cAAc,CACZ,kBAAkB,EAAE,MAAM,EAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC,eAAe,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE3E,iBAAiB,CACf,kBAAkB,EAAE,MAAM,EAC1B,WAAW,EAAE,MAAM,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC,iBAAiB,CACf,kBAAkB,EAAE,MAAM,EAC1B,mBAAmB,EAAE,sBAAsB,GAC1C,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC,iBAAiB,CACf,kBAAkB,EAAE,MAAM,EAC1B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC,8BAA8B,CAC5B,qCAAqC,EAAE,mCAAmC,GACzE,OAAO,CAAC,sCAAsC,CAAC,CAAC;IAEnD,mBAAmB,CACjB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC,0BAA0B,CACxB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE3E,sBAAsB,CACpB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;QACP,eAAe,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,IAAI,CAAC;KACpD,GACA,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAE3E,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAE7E,aAAa,CACX,kBAAkB,EAAE,MAAM,EAC1B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEnC,UAAU,CACR,kBAAkB,EAAE,MAAM,EAC1B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEnC,UAAU,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC;IAE9D,gBAAgB,CACd,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,GAAG,CAAC;CACR;AAED,qBAAa,iBAAkB,YAAW,kBAAkB;IAexD,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,iBAAiB;IACzB,OAAO,CAAC,kBAAkB;IAhB5B,OAAO,CAAC,qBAAqB,CAA8B;IAC3D,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,sCAAsC,CAEpB;IAC1B,OAAO,CAAC,gBAAgB,CAAkD;IAE1E;;;;;OAKG;gBAEO,cAAc,EAAE,cAAc,EAC9B,iBAAiB,EAAE,iBAAiB,EACpC,kBAAkB,GAAE,kBAAiD;IAG/E,OAAO,KAAK,aAAa,GAExB;IAED,OAAO,KAAK,aAAa,QAOxB;IAED,OAAO,CAAC,gBAAgB,CAEtB;IAEF,OAAO,CAAC,kBAAkB,CAkBxB;IAEF,OAAO,CAAC,iCAAiC,CAcrC;IAEJ;;OAEG;IACH,OAAO,CAAC,UAAU,CAyBhB;IAIF,OAAO,CAAC,uBAAuB,CAAS;IAExC;;OAEG;IACH,OAAO,CAAC,uBAAuB,CAY7B;IAEF;;;;;;;;OAQG;IACH,wBAAwB,QAAa,OAAO,CAAC,OAAO,CAAC,CAGnD;IAEF;;;;;OAKG;IACH,qBAAqB,GACnB,eAAe,aAAa,KAC3B,OAAO,CAAC,cAAc,CAAC,CAexB;IAEF;;;;;OAKG;IACH,kBAAkB,GAChB,mBAAmB,IAAI,CAAC,0BAA0B,EAAE,eAAe,CAAC,KACnE,OAAO,CAAC,kBAAkB,CAAC,CAwB5B;IAEF;;;;;OAKG;IACH,kBAAkB,GAChB,2BAA2B,0BAA0B,KACpD,OAAO,CAAC,0BAA0B,CAAC,CAoBpC;IAEF;;;;;;;OAOG;IACH,kBAAkB,GAChB,2BAA2B,0BAA0B,KACpD,OAAO,CAAC,0BAA0B,CAAC,CAgBpC;IAEF;;;;;;;;OAQG;IACH,qBAAqB,GACnB,OAAO,MAAM,EACb,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KACnC,OAAO,CAAC,6BAA6B,CAAC,CAsBvC;IAEF;;;;;OAKG;IACH,qBAAqB,GACnB,8BAA8B,iCAAiC,KAC9D,OAAO,CAAC,6BAA6B,CAAC,CAoBvC;IAEF;;;;;;OAMG;IACH,qBAAqB,GACnB,8BAA8B,iCAAiC,KAC9D,OAAO,CAAC,6BAA6B,CAAC,CAevC;IAEF;;;;;OAKG;IACH,QAAQ,QAAa,OAAO,CAAC,aAAa,CAAC,CAuBzC;IAEF;;;OAGG;IACH,sBAAsB,GAAI,UAAU,oBAAoB,KAAG,IAAI,CAE7D;IAEF;;OAEG;IACH,yBAAyB,GAAI,UAAU,oBAAoB,KAAG,IAAI,CAIhE;IAEF;;;;OAIG;IACH,oBAAoB,QAAa,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAM1D;IAEF;;OAEG;IACH,UAAU,QAAa,OAAO,CAAC,OAAO,CAAC,CAOrC;IAEF;;OAEG;IACH,gBAAgB,GACd,oBAAoB,MAAM,EAC1B,WAAW,MAAM,KAChB,OAAO,CAAC,2BAA2B,CAAC,CAiBrC;IAEF;;OAEG;IACH,cAAc,GACZ,oBAAoB,MAAM,EAC1B,WAAW,MAAM,KAChB,OAAO,CAAC,mBAAmB,CAAC,CAW7B;IAEF;;OAEG;IACH,eAAe,GACb,oBAAoB,MAAM,KACzB,OAAO,CAAC,oBAAoB,CAAC,CAU9B;IAEF;;OAEG;IACH,iBAAiB,GACf,oBAAoB,MAAM,EAC1B,aAAa,MAAM,EACnB,mBAAmB,MAAM,KACxB,OAAO,CAAC,yBAAyB,CAAC,CAYnC;IAEF;;;OAGG;IACH,iBAAiB,GACf,oBAAoB,MAAM,EAC1B,qBAAqB,sBAAsB,KAC1C,OAAO,CAAC,yBAAyB,CAAC,CAWnC;IAEF;;OAEG;IACH,iBAAiB,GACf,oBAAoB,MAAM,EAC1B,eAAe,MAAM,KACpB,OAAO,CAAC,yBAAyB,CAAC,CAWnC;IAEF;;;;OAIG;IACH,8BAA8B,GAC5B,uCAAuC,mCAAmC,KACzE,OAAO,CAAC,sCAAsC,CAAC,CAKhD;IAEF;;;;;OAKG;IACH,mBAAmB,GACjB,iBAAiB,MAAM,EACvB,KAAK,MAAM,KACV,OAAO,CAAC,2BAA2B,CAAC,CAMrC;IAEF;;;;;;;;OAQG;IACH,0BAA0B,GACxB,UAAS,0BAA+B,KACvC,OAAO,CAAC,2BAA2B,CAAC,CAKrC;IAEF;;;;;OAKG;IACH,yBAAyB,GACvB,YAAY,MAAM,KACjB,OAAO,CAAC,kBAAkB,CAAC,CAK5B;IAEF;;;;;;;;;;OAUG;IACH,sBAAsB,GACpB,YAAY,MAAM,EAClB,SAAS;QACP,eAAe,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,IAAI,CAAC;KACpD,KACA,OAAO,CAAC,kBAAkB,CAAC,CAM5B;IAEF;;;;;;OAMG;IACH,oBAAoB,GAClB,cAAc,MAAM,KACnB,OAAO,CAAC,qBAAqB,CAAC,CAK/B;IAEF;;;;;OAKG;IACH,qBAAqB,GACnB,UAAU,MAAM,KACf,OAAO,CAAC,0BAA0B,CAAC,CAEpC;IAEF;;;;;;OAMG;IACH,aAAa,GACX,oBAAoB,MAAM,EAC1B,UAAU,MAAM,KACf,OAAO,CAAC,sBAAsB,CAAC,CAMhC;IAEF;;;;;OAKG;IACH,UAAU,GACR,oBAAoB,MAAM,EAC1B,UAAU,MAAM,KACf,OAAO,CAAC,sBAAsB,CAAC,CAMhC;IAEF;;;;;;OAMG;IACH,UAAU,GAAI,iBAAiB,MAAM,EAAE,WAAW,MAAM,KAAG,GAAG,CAE5D;IAEF;;;;;;;OAOG;IACH,gBAAgB,GACd,iBAAiB,MAAM,EACvB,WAAW,MAAM,EACjB,eAAe,MAAM,KACpB,GAAG,CAQJ;CACH"}

package/dist/cjs/index.d.ts

@@ -1,5 +1,7 @@
-export type { IdpConfiguration } from '@axinom/mosaic-user-auth-utils';
+export type { DeviceApprovalRequest, DeviceApprovalResponse, DeviceAuthorizationRequest, DeviceAuthorizationResponse, DevicePollRequest, DevicePollResponse, DeviceVerificationResponse, IdpConfiguration, } from '@axinom/mosaic-user-auth-utils';
+export { DeviceApprovalResponseCode, DeviceAuthorizationResponseCode, DeviceAuthorizationStatus, DevicePollResponseCode, DeviceVerificationResponseCode, } from '@axinom/mosaic-user-auth-utils';
 export * from './common/enums.js';
 export * from './common/types.js';
+export type { IUserServiceClient } from './UserServiceClient/UserServiceClient.js';
 export * from './UserServiceProvider/UserServiceProvider.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,8CAA8C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,YAAY,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,cAAc,8CAA8C,CAAC"}

package/dist/cjs/index.js

@@ -5,38 +5,25 @@ Object.defineProperty(exports, '__esModule', { value: true });
 var React = require('react');
 
 function _interopNamespace(e) {
-  if (e && e.__esModule) return e;
-  var n = Object.create(null);
-  if (e) {
-    Object.keys(e).forEach(function (k) {
-      if (k !== 'default') {
-        var d = Object.getOwnPropertyDescriptor(e, k);
-        Object.defineProperty(n, k, d.get ? d : {
-          enumerable: true,
-          get: function () { return e[k]; }
+    if (e && e.__esModule) return e;
+    var n = Object.create(null);
+    if (e) {
+        Object.keys(e).forEach(function (k) {
+            if (k !== 'default') {
+                var d = Object.getOwnPropertyDescriptor(e, k);
+                Object.defineProperty(n, k, d.get ? d : {
+                    enumerable: true,
+                    get: function () { return e[k]; }
+                });
+            }
         });
-      }
-    });
-  }
-  n["default"] = e;
-  return Object.freeze(n);
+    }
+    n["default"] = e;
+    return Object.freeze(n);
 }
 
 var React__namespace = /*#__PURE__*/_interopNamespace(React);
 
-exports.TokenRenewalMethod = void 0;
-(function (TokenRenewalMethod) {
-    /**
-     * The token is continuously renewed just before expiry.
-     * A `TokenChangedCallback` can be registered using `addTokenChangedHandler` method to get notified when the token changes.
-     */
-    TokenRenewalMethod[TokenRenewalMethod["PRE_EMPTIVE"] = 0] = "PRE_EMPTIVE";
-    /**
-     * The token is renewed only if needed upon calling `getToken` method.
-     */
-    TokenRenewalMethod[TokenRenewalMethod["ON_DEMAND"] = 1] = "ON_DEMAND";
-})(exports.TokenRenewalMethod || (exports.TokenRenewalMethod = {}));
-
 /**
  * This is the Error Type that the REST middleware will respond when there's an error
  * from the User Service that does not belong to Token/SignOut or IDPConfiguration responses.
@@ -137,6 +124,67 @@ var CheckOtpResponseCode;
     CheckOtpResponseCode["ERROR"] = "ERROR";
     CheckOtpResponseCode["SERVICE_CONFIGURATION_ERROR"] = "SERVICE_CONFIGURATION_ERROR";
 })(CheckOtpResponseCode || (CheckOtpResponseCode = {}));
+/**
+ * Response code for the Device Authorization request (the device starts the flow).
+ */
+exports.DeviceAuthorizationResponseCode = void 0;
+(function (DeviceAuthorizationResponseCode) {
+    DeviceAuthorizationResponseCode["SUCCESS"] = "SUCCESS";
+    DeviceAuthorizationResponseCode["DEVICE_FLOW_NOT_ENABLED"] = "DEVICE_FLOW_NOT_ENABLED";
+    DeviceAuthorizationResponseCode["APPLICATION_NOT_ACTIVE"] = "APPLICATION_NOT_ACTIVE";
+    DeviceAuthorizationResponseCode["BAD_REQUEST"] = "BAD_REQUEST";
+    DeviceAuthorizationResponseCode["INTERNAL_SERVER_ERROR"] = "INTERNAL_SERVER_ERROR";
+})(exports.DeviceAuthorizationResponseCode || (exports.DeviceAuthorizationResponseCode = {}));
+/**
+ * Response code for the Device poll (the device polls until the user approves; on approval it
+ * receives its refresh token).
+ */
+exports.DevicePollResponseCode = void 0;
+(function (DevicePollResponseCode) {
+    DevicePollResponseCode["SUCCESS"] = "SUCCESS";
+    DevicePollResponseCode["AUTHORIZATION_PENDING"] = "AUTHORIZATION_PENDING";
+    DevicePollResponseCode["SLOW_DOWN"] = "SLOW_DOWN";
+    DevicePollResponseCode["ACCESS_DENIED"] = "ACCESS_DENIED";
+    DevicePollResponseCode["EXPIRED"] = "EXPIRED";
+    DevicePollResponseCode["BAD_REQUEST"] = "BAD_REQUEST";
+    DevicePollResponseCode["INTERNAL_SERVER_ERROR"] = "INTERNAL_SERVER_ERROR";
+})(exports.DevicePollResponseCode || (exports.DevicePollResponseCode = {}));
+/**
+ * Response code for the Device Verification lookup (the activation page reads what a user code authorizes).
+ */
+exports.DeviceVerificationResponseCode = void 0;
+(function (DeviceVerificationResponseCode) {
+    DeviceVerificationResponseCode["SUCCESS"] = "SUCCESS";
+    DeviceVerificationResponseCode["NOT_FOUND"] = "NOT_FOUND";
+    DeviceVerificationResponseCode["EXPIRED"] = "EXPIRED";
+    DeviceVerificationResponseCode["BAD_REQUEST"] = "BAD_REQUEST";
+    DeviceVerificationResponseCode["INTERNAL_SERVER_ERROR"] = "INTERNAL_SERVER_ERROR";
+})(exports.DeviceVerificationResponseCode || (exports.DeviceVerificationResponseCode = {}));
+/**
+ * Response code for Device Approval / Denial (the signed-in user approves or denies a device).
+ */
+exports.DeviceApprovalResponseCode = void 0;
+(function (DeviceApprovalResponseCode) {
+    DeviceApprovalResponseCode["SUCCESS"] = "SUCCESS";
+    DeviceApprovalResponseCode["NOT_FOUND"] = "NOT_FOUND";
+    DeviceApprovalResponseCode["EXPIRED"] = "EXPIRED";
+    DeviceApprovalResponseCode["ALREADY_USED"] = "ALREADY_USED";
+    DeviceApprovalResponseCode["ACCESS_TOKEN_EXPIRED"] = "ACCESS_TOKEN_EXPIRED";
+    DeviceApprovalResponseCode["NEEDS_LOGIN"] = "NEEDS_LOGIN";
+    DeviceApprovalResponseCode["BAD_REQUEST"] = "BAD_REQUEST";
+    DeviceApprovalResponseCode["INTERNAL_SERVER_ERROR"] = "INTERNAL_SERVER_ERROR";
+})(exports.DeviceApprovalResponseCode || (exports.DeviceApprovalResponseCode = {}));
+/**
+ * Lifecycle status of a device authorization record.
+ */
+exports.DeviceAuthorizationStatus = void 0;
+(function (DeviceAuthorizationStatus) {
+    DeviceAuthorizationStatus["PENDING"] = "PENDING";
+    DeviceAuthorizationStatus["APPROVED"] = "APPROVED";
+    DeviceAuthorizationStatus["DENIED"] = "DENIED";
+    DeviceAuthorizationStatus["EXPIRED"] = "EXPIRED";
+    DeviceAuthorizationStatus["REDEEMED"] = "REDEEMED";
+})(exports.DeviceAuthorizationStatus || (exports.DeviceAuthorizationStatus = {}));
 /**
  * IDP Protocol categories
  */
@@ -209,6 +257,19 @@ var AuthenticateEndUserApplicationResponseCode;
     },
 });
 
+exports.TokenRenewalMethod = void 0;
+(function (TokenRenewalMethod) {
+    /**
+     * The token is continuously renewed just before expiry.
+     * A `TokenChangedCallback` can be registered using `addTokenChangedHandler` method to get notified when the token changes.
+     */
+    TokenRenewalMethod[TokenRenewalMethod["PRE_EMPTIVE"] = 0] = "PRE_EMPTIVE";
+    /**
+     * The token is renewed only if needed upon calling `getToken` method.
+     */
+    TokenRenewalMethod[TokenRenewalMethod["ON_DEMAND"] = 1] = "ON_DEMAND";
+})(exports.TokenRenewalMethod || (exports.TokenRenewalMethod = {}));
+
 /**
  * Ensures that an error is an actual instance of an error.
  *
@@ -245,6 +306,213 @@ class UserAuthError extends Error {
     }
 }
 
+/**
+ * Builds an application-scoped User Service Auth endpoint URL.
+ *
+ * NOTE: The device flow is headless — none of these calls rely on the `AX_REFRESH_TOKEN`
+ * cookie that the web flow uses. The device's refresh token is carried explicitly (in the
+ * response body / a `Bearer` header), which is why every fetch here uses `credentials: 'omit'`.
+ * This keeps the device token path fully separate from the browser cookie path.
+ */
+const buildDeviceEndpointUrl = (userAuthConfig, action) => new URL(`${userAuthConfig.tenantId}/${userAuthConfig.environmentId}/${userAuthConfig.applicationId}/${action}`, userAuthConfig.userAuthBaseUrl);
+/**
+ * Starts the device authorization flow (called by the device — a NATIVE application). Returns the
+ * `deviceCode` to poll with and the `userCode` / `verificationUri` to show the user.
+ *
+ * @param userAuthConfig An object containing user authentication info.
+ * @param request Optional request body (a display-only `deviceLabel`).
+ */
+const requestDeviceAuthorization = async (userAuthConfig, request = {}) => {
+    try {
+        return (await (await fetch(buildDeviceEndpointUrl(userAuthConfig, 'device/authorize').href, {
+            method: 'POST',
+            cache: 'no-cache',
+            credentials: 'omit',
+            redirect: 'follow',
+            referrerPolicy: 'origin',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(request),
+        })).json());
+    }
+    catch (e) {
+        return {
+            code: exports.DeviceAuthorizationResponseCode.INTERNAL_SERVER_ERROR,
+            message: ensureError(e).message,
+        };
+    }
+};
+/**
+ * Performs a single poll (called by the device). The endpoint always returns HTTP 200
+ * with a `{ code }` body — poll states (AUTHORIZATION_PENDING / SLOW_DOWN) are NOT HTTP errors.
+ * On SUCCESS it returns the device's `refreshToken`; call {@link getDeviceAccessToken} with it to
+ * obtain an access token. Use {@link pollDeviceRefreshToken} for the convenience polling loop.
+ *
+ * @param userAuthConfig An object containing user authentication info.
+ * @param deviceCode The secret returned by {@link requestDeviceAuthorization}.
+ */
+const requestDeviceRefreshToken = async (userAuthConfig, deviceCode) => {
+    try {
+        const request = { deviceCode };
+        return (await (await fetch(buildDeviceEndpointUrl(userAuthConfig, 'device/poll').href, {
+            method: 'POST',
+            cache: 'no-cache',
+            credentials: 'omit',
+            redirect: 'follow',
+            referrerPolicy: 'origin',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(request),
+        })).json());
+    }
+    catch (e) {
+        return {
+            code: exports.DevicePollResponseCode.INTERNAL_SERVER_ERROR,
+            message: ensureError(e).message,
+        };
+    }
+};
+const sleep = (ms, signal) => new Promise((resolve, reject) => {
+    if (signal?.aborted === true) {
+        reject(new DOMException('Aborted', 'AbortError'));
+        return;
+    }
+    const timer = setTimeout(() => {
+        signal?.removeEventListener('abort', onAbort);
+        resolve();
+    }, ms);
+    const onAbort = () => {
+        clearTimeout(timer);
+        reject(new DOMException('Aborted', 'AbortError'));
+    };
+    signal?.addEventListener('abort', onAbort, { once: true });
+});
+/**
+ * Convenience poller for the device: repeatedly polls `device/poll` honouring the
+ * server's `interval`, backing off on `SLOW_DOWN`, until the authorization reaches a terminal
+ * state (SUCCESS / ACCESS_DENIED / EXPIRED) or an error occurs. Resolves with that terminal
+ * response; on SUCCESS it carries the `refreshToken` (pass it to {@link getDeviceAccessToken}).
+ *
+ * @param userAuthConfig An object containing user authentication info.
+ * @param deviceCode The secret returned by {@link requestDeviceAuthorization}.
+ * @param options.intervalSeconds Initial seconds between polls (from the authorize response).
+ * @param options.signal Optional `AbortSignal` to cancel polling (rejects with `AbortError`).
+ * @param options.onPending Optional callback invoked on each non-terminal poll.
+ */
+const pollDeviceRefreshToken = async (userAuthConfig, deviceCode, options) => {
+    // On SLOW_DOWN, back off by an extra 5 seconds (common device-flow convention).
+    const slowDownIncrementSeconds = 5;
+    let intervalSeconds = options.intervalSeconds;
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        await sleep(intervalSeconds * 1000, options.signal);
+        const response = await requestDeviceRefreshToken(userAuthConfig, deviceCode);
+        if (response.code === exports.DevicePollResponseCode.AUTHORIZATION_PENDING ||
+            response.code === exports.DevicePollResponseCode.SLOW_DOWN) {
+            if (response.code === exports.DevicePollResponseCode.SLOW_DOWN) {
+                intervalSeconds += slowDownIncrementSeconds;
+            }
+            options.onPending?.(response);
+            continue;
+        }
+        // SUCCESS / ACCESS_DENIED / EXPIRED / BAD_REQUEST / INTERNAL_SERVER_ERROR are terminal.
+        return response;
+    }
+};
+/**
+ * Gets an access token for a device session from its refresh token — used both for
+ * the first access token (right after {@link pollDeviceRefreshToken} succeeds) and for every
+ * subsequent renewal. The device cannot use the `AX_REFRESH_TOKEN` cookie, so it presents the
+ * refresh token as an `Authorization: Bearer <refreshToken>` header against the standard `/token`
+ * endpoint. The refresh token itself is not rotated, so it can be reused for each renewal.
+ *
+ * @param userAuthConfig An object containing user authentication info.
+ * @param refreshToken The device refresh token (returned by the SUCCESS device poll).
+ */
+const getDeviceAccessToken = async (userAuthConfig, refreshToken) => {
+    try {
+        return (await (await fetch(buildDeviceEndpointUrl(userAuthConfig, 'token').href, {
+            method: 'GET',
+            cache: 'no-cache',
+            credentials: 'omit',
+            redirect: 'follow',
+            referrerPolicy: 'origin',
+            headers: { authorization: `Bearer ${refreshToken}` },
+        })).json());
+    }
+    catch (e) {
+        return {
+            code: TokenResponseCode.INTERNAL_SERVER_ERROR,
+            message: ensureError(e).message,
+        };
+    }
+};
+/**
+ * Reads what a given `userCode` is about to authorize (called by the activation page). Anonymous
+ * and read-only — it never approves anything. Returns the device label and status.
+ *
+ * @param userAuthConfig An object containing user authentication info.
+ * @param userCode The short code the user typed on the activation page.
+ */
+const getDeviceVerification = async (userAuthConfig, userCode) => {
+    try {
+        const url = buildDeviceEndpointUrl(userAuthConfig, 'device/verify');
+        url.searchParams.set('userCode', userCode);
+        return (await (await fetch(url.href, {
+            method: 'GET',
+            cache: 'no-cache',
+            credentials: 'omit',
+            redirect: 'follow',
+            referrerPolicy: 'origin',
+        })).json());
+    }
+    catch (e) {
+        return {
+            code: exports.DeviceVerificationResponseCode.INTERNAL_SERVER_ERROR,
+            message: ensureError(e).message,
+        };
+    }
+};
+/**
+ * Approves or denies a device authorization (called from the activation page by the signed-in user). Requires the
+ * end-user access token — the same `Bearer` credential used for every other end-user API —
+ * which the server resolves to the approving user's session.
+ *
+ * @param userAuthConfig An object containing user authentication info.
+ * @param endUserAccessToken The signed-in user's access token (JWT).
+ * @param userCode The short code shown on the device.
+ * @param action Whether to `approve` or `deny` the device.
+ */
+const submitDeviceApproval = async (userAuthConfig, endUserAccessToken, userCode, action) => {
+    try {
+        const request = { userCode };
+        return (await (await fetch(buildDeviceEndpointUrl(userAuthConfig, `device/${action}`).href, {
+            method: 'POST',
+            cache: 'no-cache',
+            credentials: 'omit',
+            redirect: 'follow',
+            referrerPolicy: 'origin',
+            headers: {
+                'content-type': 'application/json',
+                authorization: `Bearer ${endUserAccessToken}`,
+            },
+            body: JSON.stringify(request),
+        })).json());
+    }
+    catch (e) {
+        return {
+            code: exports.DeviceApprovalResponseCode.INTERNAL_SERVER_ERROR,
+            message: ensureError(e).message,
+        };
+    }
+};
+/**
+ * Approves a device authorization on behalf of the signed-in user. @see {@link submitDeviceApproval}
+ */
+const approveDevice = (userAuthConfig, endUserAccessToken, userCode) => submitDeviceApproval(userAuthConfig, endUserAccessToken, userCode, 'approve');
+/**
+ * Denies a device authorization on behalf of the signed-in user. @see {@link submitDeviceApproval}
+ */
+const denyDevice = (userAuthConfig, endUserAccessToken, userCode) => submitDeviceApproval(userAuthConfig, endUserAccessToken, userCode, 'deny');
+
 // istanbul ignore next (See: 'https://github.com/graphql/graphql-js/issues/2317')
 var nodejsCustomInspectSymbol = typeof Symbol === 'function' && typeof Symbol.for === 'function' ? Symbol.for('nodejs.util.inspect.custom') : undefined;
 var nodejsCustomInspectSymbol$1 = nodejsCustomInspectSymbol;
@@ -3028,6 +3296,79 @@ class UserServiceClient {
     decryptNativeCookie = async (encryptedCookie, key) => {
         return decryptNativeCookie(encryptedCookie, key, `${this.userServiceConfig.userServiceBaseUrl}/graphql-management`);
     };
+    /**
+     * Starts the Device Authorization grant for the device (a NATIVE application).
+     * Returns the `userCode` / `verificationUri` to show the user and the `deviceCode` to poll with.
+     *
+     * NOTE: The device flow is headless and does NOT use the `AX_REFRESH_TOKEN` cookie — the
+     * device's tokens are carried explicitly. @see {@link pollDeviceRefreshToken} / {@link getDeviceAccessToken}.
+     *
+     * @param request Optional request body (a display-only `deviceLabel`).
+     */
+    requestDeviceAuthorization = async (request = {}) => {
+        return requestDeviceAuthorization(this.userAuthConfig, request);
+    };
+    /**
+     * Performs a single poll. Prefer {@link pollDeviceRefreshToken} for the polling loop. On SUCCESS
+     * the response carries the device `refreshToken`; pass it to {@link getDeviceAccessToken}.
+     *
+     * @param deviceCode The secret returned by {@link requestDeviceAuthorization}.
+     */
+    requestDeviceRefreshToken = async (deviceCode) => {
+        return requestDeviceRefreshToken(this.userAuthConfig, deviceCode);
+    };
+    /**
+     * Polls `device/poll` honouring the server interval and `SLOW_DOWN` back-off until the
+     * authorization reaches a terminal state (SUCCESS / ACCESS_DENIED / EXPIRED). On SUCCESS the
+     * response carries the device `refreshToken` — store it, then call {@link getDeviceAccessToken}
+     * to obtain an access token.
+     *
+     * @param deviceCode The secret returned by {@link requestDeviceAuthorization}.
+     * @param options.intervalSeconds Initial seconds between polls (from the authorize response).
+     * @param options.signal Optional `AbortSignal` to cancel polling.
+     * @param options.onPending Optional callback invoked on each non-terminal poll.
+     */
+    pollDeviceRefreshToken = async (deviceCode, options) => {
+        return pollDeviceRefreshToken(this.userAuthConfig, deviceCode, options);
+    };
+    /**
+     * Gets an access token for a device session from its refresh token — used for the
+     * first access token (right after the poll succeeds) and for every renewal. The refresh token is
+     * presented as a `Bearer` header, since the device cannot use the browser cookie.
+     *
+     * @param refreshToken The device refresh token from the SUCCESS device poll.
+     */
+    getDeviceAccessToken = async (refreshToken) => {
+        return getDeviceAccessToken(this.userAuthConfig, refreshToken);
+    };
+    /**
+     * Reads what a given `userCode` is about to authorize (for the activation page). Anonymous and
+     * read-only — it never approves anything.
+     *
+     * @param userCode The short code the user typed on the activation page.
+     */
+    getDeviceVerification = async (userCode) => {
+        return getDeviceVerification(this.userAuthConfig, userCode);
+    };
+    /**
+     * Approves a device authorization on behalf of the signed-in user. Requires the end-user
+     * access token (the same `Bearer` credential used for every other end-user API).
+     *
+     * @param endUserAccessToken The signed-in user's access token (JWT).
+     * @param userCode The short code shown on the device.
+     */
+    approveDevice = async (endUserAccessToken, userCode) => {
+        return approveDevice(this.userAuthConfig, endUserAccessToken, userCode);
+    };
+    /**
+     * Denies a device authorization on behalf of the signed-in user.
+     *
+     * @param endUserAccessToken The signed-in user's access token (JWT).
+     * @param userCode The short code shown on the device.
+     */
+    denyDevice = async (endUserAccessToken, userCode) => {
+        return denyDevice(this.userAuthConfig, endUserAccessToken, userCode);
+    };
     /**
      * Returns the authentication URL for web based applications.
      *