@calimero-network/mero-js 29.7.6 → 29.8.0

package/README.md

@@ -104,7 +104,7 @@ Pinned measurements go through `policy.verifyQuote` (`createQuoteVerifier`).
 - **Apps**: `createApp`, `listApps`, `getApp`, `deleteApp`, `setAccess`, `setAppMetadata`, `appStorage`, `appAbi`, `upgradeApp`, `transferApp`.
 - **Calls**: `call`, `callConfirmed`, `view`, `events`. A call always carries an idempotency key, and is sent again with it while the node answers `503`, then to the next node.
 - **Blobs and presence**: `uploadBlob`, `downloadBlob`, `listBlobs`, `blobInfo`, `deleteBlob`; `publishPresence`, `presence`, `presenceStream`.
-- **Organizations**: `createOrg`, `getOrg`, `deleteOrg`, `setOrgMetadata`, `setMember`, `removeMember`, `setMemberMetadata`, `setCapabilities` (`ORG_CAPABILITIES`), teams, `invite`, `redeemInvite`, recovery (`setRecoveryKey`, `startRecovery`, `cancelRecovery`, `finishRecovery`; `newRecoverySeed`, `recoveryPublicKey`). Setting or removing a member or team member, capabilities and invites are approved with the caller's passkey; redeeming an invite is not.
+- **Organizations**: `createOrg`, `getOrg`, `deleteOrg`, `setOrgMetadata`, `setMember`, `removeMember`, `setMemberMetadata`, `setCapabilities` (`ORG_CAPABILITIES`), `setTeamDefaultCapabilities`, teams, app teams (`listAppTeams`, `scopeApps`), `invite`, `redeemInvite`, `listInvites`, `revokeInvite`, recovery (`setRecoveryKey`, `startRecovery`, `cancelRecovery`, `finishRecovery`; `newRecoverySeed`, `recoveryPublicKey`). Setting or removing a member or team member, capabilities, invites (minting and revoking) and scoping apps are approved with the caller's passkey; redeeming an invite is not.
 - **Owner decisions** (passkey approval, never from an app's frontend): `upgradeOrg`, `upgradeRun`, `retryUpgradeRun`, `approveRelease`, `approveOutbound`, `bindPublisher`, `upgradePublished`.
 - **Approvals from an app**: `appsReport`, `releaseRules`, `pendingApprovals`, then `requestConsent` / `openConsentPage` to send the user to the node's consent page, and `consentResult`. Show the answer's `code` to the user before sending them to `url` (`openConsentPage`'s `confirm` hook); they should see the same code on the page (`confirmationCode(requestId)` checks it). See [Ask your users to approve node images and app upgrades](https://calimero-network.github.io/mero-js/guides/user-approvals/).
 - **Operator** (ops token): `opsApps`, `opsOrgs`, `opsServedOrigins` (every custom domain the log holds, by package label), `setReleaseDeadline`, `liftReleaseDeadline`.

package/dist/cloud-v2/client.d.ts

@@ -133,6 +133,119 @@ export interface OrgInfo extends Record<string, unknown> {
     } | null;
     /** The recovery key and any recovery under way; absent while the organization has none. */
     recovery?: OrgRecovery;
+    /** How it holds its apps ({@link OrgMode}); absent from nodes before app teams. */
+    mode?: OrgMode;
+}
+/**
+ * How an organization holds its apps, derived from its app teams (core
+ * `OrgMode`): `legacy` has none (its apps use organization access),
+ * `standalone` has only open ones (everyone has every app), `shared` has a
+ * closed one (each app lists who is in it).
+ */
+export type OrgMode = 'legacy' | 'standalone' | 'shared';
+/** One app team, as `GET /orgs/{org}/app-teams` lists it ({@link CalimeroClient.listAppTeams}). */
+export interface AppTeam {
+    /** The package this team is the app team of (one per package per organization). */
+    package: string;
+    teamId: string;
+    name: string;
+    /** `everyone` (open) or `invite` (closed). */
+    join: 'everyone' | 'invite';
+    /** How many of the organization's people are in the team. */
+    memberCount: number;
+    /** Capability bits everyone in the team holds there ({@link ORG_CAPABILITIES}); `null` when unset. */
+    defaultCapabilities: number | null;
+    /** Whether the caller is in the team. */
+    member: boolean;
+    /** Whether the caller manages it (its lead, an ancestor's lead, or an admin). */
+    manages: boolean;
+}
+/** `GET /orgs/{org}/app-teams`: the organization's mode and its app teams. A guest sees only the app teams they are in. */
+export interface AppTeams {
+    mode: OrgMode;
+    appTeams: AppTeam[];
+}
+/** One package to give an app team ({@link CalimeroClient.scopeApps}, core `ScopeApp`). */
+export interface ScopeApp {
+    package: string;
+    /** The team's name when one is made, 1..64 characters (absent: the package's display name, else the package id). */
+    name?: string;
+    /**
+     * The instances to move onto the team (absent: every organization-access
+     * instance of the package here; `[]`: none, for a fresh install).
+     */
+    instances?: string[];
+}
+/** What {@link CalimeroClient.scopeApps} asks for; every field absent takes the node's default. */
+export interface ScopeAppsOptions {
+    /** At most 64 packages (absent: every package with an organization-access instance here). */
+    apps?: ScopeApp[];
+    /** Close every app team (absent: when the organization then holds two or more). */
+    shared?: boolean;
+}
+/** One package's app team after {@link CalimeroClient.scopeApps}. */
+export interface ScopedAppTeam {
+    package: string;
+    teamId: string;
+    /** Whether the team was made now (`false`: it existed already). */
+    created: boolean;
+    /** The instances moved onto it. */
+    apps: string[];
+    /** How many rows were added for people who reached those instances. */
+    added: number;
+}
+/** `POST /orgs/{org}/app-teams`: the organization's mode after, and each package's team. */
+export interface ScopeAppsResult {
+    mode: OrgMode;
+    teams: ScopedAppTeam[];
+}
+/** A pending organization invite, as `GET /orgs/{org}/invites` lists it (never its token). */
+export interface OrgInvite {
+    /** The invite's key, which {@link CalimeroClient.revokeInvite} takes. */
+    inviteKey: string;
+    role: 'guest' | 'member' | 'admin';
+    /** The teams it adds its holder to. */
+    teams: string[];
+    usesLeft: number;
+    /** Unix seconds. */
+    expiresAt: number;
+    /** Listed until revoked, even past `expiresAt`. */
+    expired: boolean;
+    /** The account that made it; `null` for invites made before core recorded it. */
+    createdBy: string | null;
+    /** Unix seconds; `null` for invites made before core recorded it. */
+    createdAt: number | null;
+}
+/** One direct row of a team ({@link TeamInfo}). */
+export interface TeamMemberInfo {
+    account: string;
+    role: 'lead' | 'member' | 'readOnly';
+    /** Their effective bits there: their row's own, else the organization's with the team's default on top. */
+    capabilities: number;
+}
+/** `GET /orgs/{org}/teams/{team}` ({@link CalimeroClient.getTeam}). */
+export interface TeamInfo extends Record<string, unknown> {
+    teamId: string;
+    name: string;
+    parent: string | null;
+    join: 'everyone' | 'invite';
+    metadata: unknown;
+    /** The package it is the app team of (`metadata.app.package` on a top-level team), else `null`. */
+    package?: string | null;
+    /** Capability bits everyone in the team holds there on top of their own; `null` when unset. */
+    defaultCapabilities?: number | null;
+    members: TeamMemberInfo[];
+    /** The child teams the caller sees. */
+    children: string[];
+    apps: Array<{
+        appId: string;
+        name: string;
+        contextId: string;
+    }>;
+    /** The caller's direct row's role, if any. */
+    myRole: 'lead' | 'member' | 'readOnly' | null;
+    /** Whether the caller is in the team. */
+    member: boolean;
 }
 /** An organization's recovery key (core `Org::recovery`). */
 export interface OrgRecovery {
@@ -408,6 +521,13 @@ export interface ServedOrigins {
  */
 export interface SignInOptions {
     origin?: string | null;
+    /**
+     * Closes an open passkey prompt when it aborts (a Cancel button): the
+     * ceremony then rejects as a dismissed prompt does (`NotAllowedError`; in a
+     * sign-up's confirmation, {@link ConfirmCancelled}). Given to the
+     * {@link PasskeyProvider} as `signal`.
+     */
+    signal?: AbortSignal;
 }
 /**
  * {@link SignInOptions} for a sign-up, and the invite it is made with: an
@@ -648,9 +768,21 @@ export declare class CalimeroClient {
      */
     refresh(): Promise<CalimeroSession>;
     private exchangeRefresh;
+    /**
+     * End this session. The client is signed out whether or not the node
+     * answers: the revoke (`POST /auth/logout`) is attempted, and its failure
+     * (the node unreachable, say) is thrown after the session is dropped, so a
+     * caller can say the server may still hold it, but no request after this
+     * one carries its token.
+     */
     signOut(): Promise<void>;
-    /** End every session of the signed-in account, on every device, this one too. */
+    /**
+     * End every session of the signed-in account, on every device, this one
+     * too. Like {@link signOut}, this client is signed out even when the
+     * request fails, and the failure is thrown.
+     */
     signOutEverywhere(): Promise<void>;
+    private signingOut;
     /** Who the credential is: the account, how it signed in, and the package (`app`) and `origin` a session is bound to. */
     me(): Promise<MeInfo>;
     /**
@@ -1093,15 +1225,30 @@ export declare class CalimeroClient {
     removeMember(org: string, account: string, passkey: PasskeyProvider): Promise<Record<string, unknown>>;
     /**
      * Set capability bits ({@link ORG_CAPABILITIES}): for a member (`account`),
-     * for a member of one team (`account` and `team`), or the organization's
-     * default (neither). Approved with the caller's `passkey`.
+     * for a member of one team (`account` and `team`), a team's default
+     * (`team` alone, {@link setTeamDefaultCapabilities}), or the
+     * organization's default (neither). Approved with the caller's `passkey`.
      */
     setCapabilities(org: string, capabilities: number, passkey: PasskeyProvider, at?: {
         account?: string;
         team?: string;
     }): Promise<void>;
+    /**
+     * Set the capability bits everyone in `team` holds there on top of their
+     * own, unless their row sets its own (`POST /orgs/{org}/capabilities` with
+     * `team` and no `account`): `ORG_CAPABILITIES.INVITE_MEMBERS` is "members
+     * may invite others to this app". The team's managers, or whoever holds
+     * `MANAGE_MEMBERS` on it; approved with the caller's `passkey`
+     * (`__set_default_capabilities { team, capabilities }`).
+     */
+    setTeamDefaultCapabilities(org: string, team: string, capabilities: number, passkey: PasskeyProvider): Promise<void>;
     createTeam(org: string, name: string, join: 'everyone' | 'invite', parent?: string): Promise<string>;
-    getTeam(org: string, team: string): Promise<Record<string, unknown>>;
+    /**
+     * A team the caller sees: its rows (each with its effective capabilities),
+     * children, apps, the package it is the app team of and its default
+     * capabilities.
+     */
+    getTeam(org: string, team: string): Promise<TeamInfo>;
     /**
      * Rename, change who may join, set the app's metadata, or move the team:
      * `parent: null` moves it to the top, an absent `parent` leaves it.
@@ -1135,6 +1282,35 @@ export declare class CalimeroClient {
         uses?: number;
     }): Promise<string>;
     redeemInvite(token: string): Promise<Record<string, unknown>>;
+    /**
+     * The organization's pending invites the caller may see (never a token):
+     * every one for an owner or admin, their own, and those naming only teams
+     * they manage. Expired ones are listed (`expired: true`) until revoked. A
+     * caller outside the organization: {@link NotFound}.
+     */
+    listInvites(org: string): Promise<OrgInvite[]>;
+    /**
+     * Withdraw an invite by its key ({@link listInvites}), approved with the
+     * caller's `passkey` (`__revoke_invite { inviteKey }`). One the caller may
+     * not see: {@link NotFound}.
+     */
+    revokeInvite(org: string, inviteKey: string, passkey: PasskeyProvider): Promise<void>;
+    /**
+     * The organization's mode and its app teams (one per package), for any
+     * member; a guest sees only those they are in. A caller outside the
+     * organization: {@link NotFound}.
+     */
+    listAppTeams(org: string): Promise<AppTeams>;
+    /**
+     * Give apps their own access lists in one step (owner or admin): find or
+     * make each package's app team, add everyone who reaches its instances now,
+     * and move those instances onto it; with `shared`, close every app team.
+     * Idempotent per package. Approved with the caller's `passkey`
+     * (`__scope_apps { apps, shared }`); a refusal is `400 REJECTED` with the
+     * node's reason. For a fresh standalone install pass
+     * `{ apps: [{ package, name, instances: [] }] }`.
+     */
+    scopeApps(org: string, passkey: PasskeyProvider, options?: ScopeAppsOptions): Promise<ScopeAppsResult>;
     /**
      * The web origins `{package}`'s managers registered so a frontend they host
      * themselves can sign users in with passkeys ({@link PackageOrigins}).

package/dist/cloud-v2/client.js

@@ -511,13 +511,14 @@ export class CalimeroClient {
         const origin = this.pageOrigin(options);
         const invite = options.invite ? { invite: options.invite } : {};
         const begin = await this.begin('auth/passkey/register/begin', origin === undefined ? { name, ...invite } : { name, origin, ...invite }, origin);
-        const registration = await passkey.create(begin.options);
+        const signal = options.signal;
+        const registration = await (signal ? passkey.create(begin.options, { signal }) : passkey.create(begin.options));
         // The node checks the sign-up's confirmation with the user present, not
         // verified (core `api.rs`: `rp(node)`, `require_uv: false`), as it made
         // the passkey with `preferred`: asking `required` here would refuse a
         // security key without a PIN after it has made the passkey, leaving a
         // passkey with no account.
-        const session = await this.confirmed('POST', 'auth/passkey/register/finish', { challengeId: begin.challengeId, registration, ...invite }, passkey, undefined, 'preferred');
+        const session = await this.confirmed('POST', 'auth/passkey/register/finish', { challengeId: begin.challengeId, registration, ...invite }, passkey, undefined, 'preferred', signal);
         this.useSession(session);
         return session;
     }
@@ -537,7 +538,10 @@ export class CalimeroClient {
         const origin = this.pageOrigin(options);
         const begin = await this.begin('auth/passkey/login/begin', origin === undefined ? undefined : { origin }, origin);
         const rpId = begin.options.rpId ?? begin.options.rp?.id ?? '';
-        const assertion = await passkey.get(fromB64url(begin.options.challenge), rpId);
+        const challenge = fromB64url(begin.options.challenge);
+        const assertion = await (options.signal
+            ? passkey.get(challenge, rpId, undefined, { signal: options.signal })
+            : passkey.get(challenge, rpId));
         const session = await this.post('auth/passkey/login/finish', {
             challengeId: begin.challengeId,
             assertion,
@@ -617,16 +621,32 @@ export class CalimeroClient {
             this.useSession(session);
         return session;
     }
+    /**
+     * End this session. The client is signed out whether or not the node
+     * answers: the revoke (`POST /auth/logout`) is attempted, and its failure
+     * (the node unreachable, say) is thrown after the session is dropped, so a
+     * caller can say the server may still hold it, but no request after this
+     * one carries its token.
+     */
     async signOut() {
-        await this.post('auth/logout');
-        this.auth = undefined;
-        this.current = undefined;
+        await this.signingOut('auth/logout');
     }
-    /** End every session of the signed-in account, on every device, this one too. */
+    /**
+     * End every session of the signed-in account, on every device, this one
+     * too. Like {@link signOut}, this client is signed out even when the
+     * request fails, and the failure is thrown.
+     */
     async signOutEverywhere() {
-        await this.post('auth/logout-all');
-        this.auth = undefined;
-        this.current = undefined;
+        await this.signingOut('auth/logout-all');
+    }
+    async signingOut(path) {
+        try {
+            await this.post(path);
+        }
+        finally {
+            this.auth = undefined;
+            this.current = undefined;
+        }
     }
     /** Who the credential is: the account, how it signed in, and the package (`app`) and `origin` a session is bound to. */
     me() {
@@ -915,7 +935,7 @@ export class CalimeroClient {
     deleteConfirmed(path, passkey, body = {}) {
         return this.confirmed('DELETE', path, body, passkey);
     }
-    async confirmed(method, path, body, passkey, send = (b) => this.json(method, path, b), userVerification = 'required') {
+    async confirmed(method, path, body, passkey, send = (b) => this.json(method, path, b), userVerification = 'required', signal) {
         try {
             return await send(body);
         }
@@ -931,6 +951,7 @@ export class CalimeroClient {
                 // requirement the node names itself wins.
                 assertion = await passkey.get(fromB64url(d.challenge), d.rpId, d.allowCredentials, {
                     userVerification: userVerificationOf(d.userVerification, userVerification),
+                    ...(signal ? { signal } : {}),
                 });
             }
             catch (declined) {
@@ -1318,16 +1339,33 @@ export class CalimeroClient {
     }
     /**
      * Set capability bits ({@link ORG_CAPABILITIES}): for a member (`account`),
-     * for a member of one team (`account` and `team`), or the organization's
-     * default (neither). Approved with the caller's `passkey`.
+     * for a member of one team (`account` and `team`), a team's default
+     * (`team` alone, {@link setTeamDefaultCapabilities}), or the
+     * organization's default (neither). Approved with the caller's `passkey`.
      */
     async setCapabilities(org, capabilities, passkey, at = {}) {
         await this.postConfirmed(`orgs/${seg(org)}/capabilities`, { capabilities, ...at }, passkey);
     }
+    /**
+     * Set the capability bits everyone in `team` holds there on top of their
+     * own, unless their row sets its own (`POST /orgs/{org}/capabilities` with
+     * `team` and no `account`): `ORG_CAPABILITIES.INVITE_MEMBERS` is "members
+     * may invite others to this app". The team's managers, or whoever holds
+     * `MANAGE_MEMBERS` on it; approved with the caller's `passkey`
+     * (`__set_default_capabilities { team, capabilities }`).
+     */
+    async setTeamDefaultCapabilities(org, team, capabilities, passkey) {
+        await this.postConfirmed(`orgs/${seg(org)}/capabilities`, { team, capabilities }, passkey);
+    }
     async createTeam(org, name, join, parent) {
         const { teamId } = await this.post(`orgs/${seg(org)}/teams`, { name, join, parent });
         return teamId;
     }
+    /**
+     * A team the caller sees: its rows (each with its effective capabilities),
+     * children, apps, the package it is the app team of and its default
+     * capabilities.
+     */
     getTeam(org, team) {
         return this.get(`orgs/${seg(org)}/teams/${seg(team)}`);
     }
@@ -1365,6 +1403,52 @@ export class CalimeroClient {
     redeemInvite(token) {
         return this.post(`invites/${seg(token)}/redeem`);
     }
+    /**
+     * The organization's pending invites the caller may see (never a token):
+     * every one for an owner or admin, their own, and those naming only teams
+     * they manage. Expired ones are listed (`expired: true`) until revoked. A
+     * caller outside the organization: {@link NotFound}.
+     */
+    async listInvites(org) {
+        const { invites } = await this.get(`orgs/${seg(org)}/invites`);
+        return invites;
+    }
+    /**
+     * Withdraw an invite by its key ({@link listInvites}), approved with the
+     * caller's `passkey` (`__revoke_invite { inviteKey }`). One the caller may
+     * not see: {@link NotFound}.
+     */
+    async revokeInvite(org, inviteKey, passkey) {
+        await this.deleteConfirmed(`orgs/${seg(org)}/invites/${seg(inviteKey)}`, passkey);
+    }
+    // ---------------------------------------------------------------- app teams
+    /**
+     * The organization's mode and its app teams (one per package), for any
+     * member; a guest sees only those they are in. A caller outside the
+     * organization: {@link NotFound}.
+     */
+    listAppTeams(org) {
+        return this.get(`orgs/${seg(org)}/app-teams`);
+    }
+    /**
+     * Give apps their own access lists in one step (owner or admin): find or
+     * make each package's app team, add everyone who reaches its instances now,
+     * and move those instances onto it; with `shared`, close every app team.
+     * Idempotent per package. Approved with the caller's `passkey`
+     * (`__scope_apps { apps, shared }`); a refusal is `400 REJECTED` with the
+     * node's reason. For a fresh standalone install pass
+     * `{ apps: [{ package, name, instances: [] }] }`.
+     */
+    scopeApps(org, passkey, options = {}) {
+        // The node refuses unknown fields and reads an absent one as its default,
+        // so only the fields given go.
+        const body = {};
+        if (options.apps !== undefined)
+            body.apps = options.apps;
+        if (options.shared !== undefined)
+            body.shared = options.shared;
+        return this.postConfirmed(`orgs/${seg(org)}/app-teams`, body, passkey);
+    }
     // ---------------------------------------------------------------- deployers
     /**
      * Let an account or organization install apps where the cluster's

package/dist/cloud-v2/index.d.ts

@@ -3,12 +3,12 @@ export { DEFAULT_DIRECTORY, DirectoryError } from './directory.js';
 export type { DirectoryFailure } from './directory.js';
 export { AppError, ArgsTooLarge, BadOrigin, CalimeroError, ClusterNotUpgraded, ConfirmCancelled, ConfirmPromptBlocked, ConfirmRequired, IdempotencyMismatch, LoginRequired, ConsentStale, NotFound, NotServing, OriginNotRegistered, OriginTaken, PasskeyUnknownHere, QuotaExceeded, RecoveryNotReady, ReleaseDeadlineError, SignUpRefused, TrapError, UnavailableError, WrongNode, WrongRecoveryCode, errorFrom, } from './errors.js';
 export type { Committed, SignUpRefusal } from './errors.js';
-export type { AppInfo, AppXcalls, BlobContent, BlobInfo, DeadLetter, Deployer, DeployerGrant, DeployersInfo, DeploymentInfo, DeploymentOffer, DeploymentOrgs, FrontendManifest, MeInfo, PackageOrigin, PackageOriginAdded, PackageOriginRemoved, PackageOrigins, ServedOrigin, ServedOrigins, SignInOptions, AccountRecovery, SignUpOptions, SignUpPolicy, PublicDeployment, CallResult, CalimeroClientOptions, CalimeroConnectOptions, CloudEvent, CalimeroSession, PackageInfo, PackageInstalled, CloudRetryOptions, OrgInfo, OrgRecovery, RecoveryTimes, OrgUpgradeTarget, PresenceEntry, UpgradeRun, ViewResult, } from './client.js';
+export type { AppInfo, AppTeam, AppTeams, AppXcalls, BlobContent, BlobInfo, DeadLetter, Deployer, DeployerGrant, DeployersInfo, DeploymentInfo, DeploymentOffer, DeploymentOrgs, FrontendManifest, MeInfo, PackageOrigin, PackageOriginAdded, PackageOriginRemoved, PackageOrigins, ServedOrigin, ServedOrigins, SignInOptions, AccountRecovery, SignUpOptions, SignUpPolicy, PublicDeployment, CallResult, CalimeroClientOptions, CalimeroConnectOptions, CloudEvent, CalimeroSession, PackageInfo, PackageInstalled, CloudRetryOptions, OrgInfo, OrgInvite, OrgMode, OrgRecovery, RecoveryTimes, OrgUpgradeTarget, PresenceEntry, ScopeApp, ScopeAppsOptions, ScopeAppsResult, ScopedAppTeam, TeamInfo, TeamMemberInfo, UpgradeRun, ViewResult, } from './client.js';
 export { claimedRelease, fetchAttestedKey, freshCollateral, MOCK_QUOTE_HEADER } from './attestation.js';
 export type { AttestationDoc, CloudPolicy, CloudReleasePolicy } from './attestation.js';
 export { browserPasskey, b64url, fromB64url } from './passkey.js';
 export { MAX_RECOVERY_NONCE_BYTES, RECOVERY_DOMAIN, newRecoverySeed, parseRecoverySeed, recoveryMessage, recoveryPublicKey, recoverySeedText, signRecovery, } from './recovery.js';
-export type { AssertionJSON, PasskeyGetOptions, PasskeyProvider, PasskeyUserVerification, RegistrationJSON, } from './passkey.js';
+export type { AssertionJSON, PasskeyCreateOptions, PasskeyGetOptions, PasskeyProvider, PasskeyUserVerification, RegistrationJSON, } from './passkey.js';
 export { MAX_REPORT_PAGE, RELEASE_VERIFIER, compareVersions, confirmationCode, consentReturn, pageQuery, pendingApprovalsFrom, publisherBindingBytes, publisherBindingMessage, releaseConsent, releaseNotesUrl, stalledBy, upgradeConsent, verifyReleaseUrl, withdrawConsent, } from './approvals.js';
 export type { ActorKind, AppsReport, Authority, ClusterRelease, ConsentReleaseModel, ConsentRequest, ConsentResult, ConsentScope, ConsentStarted, ConsentStatus, OpenConsentOptions, Governance, LastUpgrade, OpsAppsReport, OpsOrgsReport, PageOptions, PendingApprovals, PendingRelease, PendingUpgrade, PublisherBindingInfo, PublisherProof, ReleaseDeadline, ReleaseRules, ReportScope, ReportedApp, ReportedBundle, ReportedRelease, ReportedReplica, UpgradeAuthority, } from './approvals.js';
 export { DEFAULT_ORG_CAPABILITIES, ORG_CAPABILITIES, orgCapabilities } from './capabilities.js';

package/dist/cloud-v2/passkey.d.ts

@@ -26,16 +26,32 @@ export interface PasskeyGetOptions {
      * `"preferred"` is enough.
      */
     userVerification?: PasskeyUserVerification;
+    /**
+     * Closes the open prompt when it aborts (a Cancel button, a page leaving).
+     * The browser provider then rejects as a dismissed prompt does
+     * (`NotAllowedError`), so the caller treats it as a cancel.
+     */
+    signal?: AbortSignal;
+}
+/** What a passkey creation takes beyond the node's options. */
+export interface PasskeyCreateOptions {
+    /** As {@link PasskeyGetOptions.signal}: aborting closes the prompt, rejecting as a cancel (`NotAllowedError`). */
+    signal?: AbortSignal;
 }
 /** Something that holds a passkey. */
 export interface PasskeyProvider {
-    /** Answer `navigator.credentials.create` for the node's options. */
-    create(options: Record<string, unknown>): Promise<RegistrationJSON>;
+    /**
+     * Answer `navigator.credentials.create` for the node's options.
+     * `createOptions.signal` closes the prompt when it aborts; a provider with
+     * no prompt to close may ignore it.
+     */
+    create(options: Record<string, unknown>, createOptions?: PasskeyCreateOptions): Promise<RegistrationJSON>;
     /**
      * Sign `challenge` (an assertion), optionally limited to
      * `allowCredentials`. `options.userVerification` is `"required"` when the
      * client answers a step-up confirmation (`"preferred"` for the sign-up's);
      * a provider that always verifies the user may ignore it.
+     * `options.signal` closes the prompt when it aborts.
      */
     get(challenge: Uint8Array, rpId: string, allowCredentials?: string[], options?: PasskeyGetOptions): Promise<AssertionJSON>;
 }

package/dist/cloud-v2/passkey.js

@@ -25,11 +25,22 @@ function cancelled(message) {
     error.name = "NotAllowedError";
     return error;
 }
-async function ask(method, options) {
+async function ask(method, options, signal, what) {
     const container = navigator.credentials;
     const own = globalThis.CredentialsContainer?.prototype?.[method];
     const call = own ?? container[method];
-    return call.call(container, options);
+    try {
+        return await call.call(container, signal ? { ...options, signal } : options);
+    }
+    catch (error) {
+        // An aborted `signal` rejects with its reason (an `AbortError` unless the
+        // caller gave another): the prompt was closed on purpose, so it reads as
+        // a dismissed one.
+        if (signal?.aborted || error?.name === "AbortError") {
+            throw Object.assign(cancelled(`${what} was cancelled`), { cause: error });
+        }
+        throw error;
+    }
 }
 /**
  * The node's algorithms with ES256 alone when it is among them. Some password
@@ -48,7 +59,7 @@ export function es256First(params) {
 /** The platform authenticator (Touch ID, Face ID, Windows Hello, a security key, a synced passkey). */
 export function browserPasskey() {
     return {
-        async create(options) {
+        async create(options, createOptions) {
             const o = options;
             const cred = (await ask("create", {
                 publicKey: {
@@ -64,7 +75,7 @@ export function browserPasskey() {
                     attestation: "none",
                     timeout: o.timeout,
                 },
-            }));
+            }, createOptions?.signal, "passkey creation"));
             if (!cred)
                 throw cancelled("passkey creation was cancelled");
             const r = cred.response;
@@ -84,7 +95,7 @@ export function browserPasskey() {
                         id: buf(fromB64url(id)),
                     })),
                 },
-            }));
+            }, options?.signal, "passkey sign-in"));
             if (!cred)
                 throw cancelled("passkey sign-in was cancelled");
             const r = cred.response;