@cboxdk/id-js 0.14.0 → 0.17.0

package/dist/nextjs.cjs

@@ -46,12 +46,181 @@ async function oauthError(response, fallback) {
     }
   } catch {
   }
-  const detail = code ?? (body.trim() === "" ? `HTTP ${response.status}` : body.slice(0, 200));
+  const detail = code ?? `HTTP ${response.status}`;
   const retryAfterHeader = response.headers.get("retry-after");
   const retryAfter = retryAfterHeader !== null && /^\d+$/.test(retryAfterHeader.trim()) ? Number(retryAfterHeader.trim()) : void 0;
   return new AuthenticationError(`${fallback}: ${detail}`, code, description, response.status, retryAfter);
 }
 
+// src/issuer.ts
+function assertSecureIssuer(issuer) {
+  let url;
+  try {
+    url = new URL(issuer);
+  } catch {
+    throw new ConfigurationError("Cbox ID config `issuer` is not a valid URL.");
+  }
+  if (url.protocol === "https:") {
+    return;
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1";
+  if (url.protocol === "http:" && loopback) {
+    return;
+  }
+  throw new ConfigurationError(
+    `Cbox ID config \`issuer\` must be https (got ${url.protocol}//${url.hostname}).`
+  );
+}
+
+// src/api-keys.ts
+var MAX_API_KEY_CACHE_TTL_MS = 6e4;
+var MAX_CACHE_ENTRIES = 1e3;
+var ORGANIZATION_ROLES = /* @__PURE__ */ new Set([
+  "owner",
+  "admin",
+  "developer",
+  "member",
+  "viewer"
+]);
+var ApiKeyVerifier = class {
+  constructor(config) {
+    this.config = config;
+    if (typeof globalThis.document !== "undefined") {
+      throw new ConfigurationError(
+        "API key verification uses your client secret and must run on your server, never in a browser."
+      );
+    }
+    if (!config.issuer || !config.clientId || !config.clientSecret) {
+      throw new ConfigurationError("Verifying API keys needs issuer, clientId and clientSecret.");
+    }
+    assertSecureIssuer(config.issuer);
+    const cacheTtlMs = config.cacheTtlMs ?? 0;
+    if (!Number.isFinite(cacheTtlMs) || cacheTtlMs < 0 || cacheTtlMs > MAX_API_KEY_CACHE_TTL_MS) {
+      throw new ConfigurationError(
+        `cacheTtlMs must be between 0 and ${MAX_API_KEY_CACHE_TTL_MS}: a cached answer keeps a revoked key working for that long.`
+      );
+    }
+    this.endpoint = `${config.issuer.replace(/\/$/, "")}/oauth/api-keys/verify`;
+    this.timeoutMs = config.timeoutMs ?? 1e4;
+    this.cacheTtlMs = cacheTtlMs;
+  }
+  config;
+  endpoint;
+  timeoutMs;
+  cacheTtlMs;
+  cache = /* @__PURE__ */ new Map();
+  /**
+   * Ask Cbox ID whether `key` is good for this app, and what it may do.
+   *
+   * Resolves `{ active: false }` for every kind of bad key, without a request for an empty
+   * one. Throws `AuthenticationError` when the call itself fails (wrong client
+   * credentials, an unreachable instance) or when the answer cannot be trusted — one that
+   * names another app's `client_id`, or does not have the promised shape. Both mean "do
+   * not let this request in"; the difference is that a throw is something to look at.
+   */
+  async verifyApiKey(key) {
+    if (typeof key !== "string" || key.trim() === "") {
+      return { active: false };
+    }
+    const cacheKey = this.cacheTtlMs > 0 ? await digest(key) : null;
+    if (cacheKey !== null) {
+      const hit = this.cache.get(cacheKey);
+      if (hit && hit.until > Date.now()) {
+        return hit.answer;
+      }
+      this.cache.delete(cacheKey);
+    }
+    const answer = this.parse(await this.request(key));
+    if (cacheKey !== null && answer.active) {
+      this.remember(cacheKey, answer);
+    }
+    return answer;
+  }
+  async request(key) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let response;
+    try {
+      response = await fetch(this.endpoint, {
+        method: "POST",
+        headers: {
+          authorization: `Basic ${btoa(`${this.config.clientId}:${this.config.clientSecret}`)}`,
+          accept: "application/json",
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({ key }),
+        signal: controller.signal
+      });
+    } catch (error) {
+      throw new AuthenticationError(`API key verification request failed: ${String(error)}`);
+    } finally {
+      clearTimeout(timer);
+    }
+    if (!response.ok) {
+      throw await oauthError(response, "API key verification failed");
+    }
+    return response.json().catch(() => null);
+  }
+  parse(body) {
+    if (typeof body !== "object" || body === null) {
+      throw new AuthenticationError("API key verification returned a body that is not a JSON object.");
+    }
+    const record = body;
+    if (record["active"] !== true) {
+      return { active: false };
+    }
+    const keyId = record["key_id"];
+    const sub = record["sub"];
+    const org = record["org"];
+    const clientId = record["client_id"];
+    const expiresAt = record["expires_at"];
+    const permissions2 = record["permissions"];
+    if (!nonEmpty(keyId) || !nonEmpty(sub) || !nonEmpty(org) || !nonEmpty(clientId) || !Array.isArray(permissions2) || expiresAt !== null && expiresAt !== void 0 && typeof expiresAt !== "string") {
+      throw new AuthenticationError("API key verification returned an active answer without the promised fields.");
+    }
+    if (clientId !== this.config.clientId) {
+      throw new AuthenticationError(
+        `API key verification answered for client ${clientId}, not this app (${this.config.clientId}); refusing it.`
+      );
+    }
+    if (typeof expiresAt === "string") {
+      const expiry = Date.parse(expiresAt);
+      if (Number.isNaN(expiry) || expiry <= Date.now()) {
+        return { active: false };
+      }
+    }
+    const role = record["org_role"];
+    return {
+      active: true,
+      key_id: keyId,
+      sub,
+      org,
+      org_role: typeof role === "string" && ORGANIZATION_ROLES.has(role) ? role : null,
+      permissions: permissions2.filter((value) => nonEmpty(value)),
+      client_id: clientId,
+      expires_at: typeof expiresAt === "string" ? expiresAt : null
+    };
+  }
+  remember(cacheKey, answer) {
+    const expiry = answer.expires_at === null ? Number.POSITIVE_INFINITY : Date.parse(answer.expires_at);
+    const until = Math.min(Date.now() + this.cacheTtlMs, expiry);
+    if (this.cache.size >= MAX_CACHE_ENTRIES) {
+      const oldest = this.cache.keys().next();
+      if (!oldest.done) {
+        this.cache.delete(oldest.value);
+      }
+    }
+    this.cache.set(cacheKey, { answer, until });
+  }
+};
+function nonEmpty(value) {
+  return typeof value === "string" && value !== "";
+}
+async function digest(key) {
+  const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(key));
+  return Array.from(new Uint8Array(bytes), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
 // src/discovery.ts
 var Discovery = class {
   constructor(issuer, timeoutMs, cacheTtlMs, now = Date.now) {
@@ -69,7 +238,7 @@ var Discovery = class {
     if (this.cached && this.cached.expiresAt > this.now()) {
       return this.cached.doc;
     }
-    const url = `${this.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+    const url = `${trimSlash(this.issuer)}/.well-known/openid-configuration`;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     let doc;
@@ -90,6 +259,11 @@ var Discovery = class {
     if (typeof doc.issuer !== "string" || doc.issuer === "") {
       throw new AuthenticationError("The discovery document was missing an issuer.");
     }
+    if (trimSlash(doc.issuer) !== trimSlash(this.issuer)) {
+      throw new AuthenticationError(
+        `The discovery document is for a different issuer (${doc.issuer}).`
+      );
+    }
     this.cached = { doc, expiresAt: this.now() + this.cacheTtlMs };
     return doc;
   }
@@ -107,6 +281,9 @@ var Discovery = class {
     return typeof value === "string" && value !== "" ? value : null;
   }
 };
+function trimSlash(value) {
+  return value.replace(/\/+$/, "");
+}
 
 // src/pkce.ts
 function base64url(bytes) {
@@ -123,8 +300,68 @@ function createVerifier() {
   return randomToken(32);
 }
 async function challenge(verifier) {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  return base64url(new Uint8Array(digest));
+  const digest2 = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url(new Uint8Array(digest2));
+}
+
+// src/claims.ts
+var ORGANIZATION_ROLES2 = /* @__PURE__ */ new Set([
+  "owner",
+  "admin",
+  "developer",
+  "member",
+  "viewer"
+]);
+function organization(source) {
+  const claims = claimsOf(source);
+  const id = claims["org"];
+  if (typeof id !== "string" || id === "") {
+    return null;
+  }
+  const name = claims["org_name"];
+  const role = claims["org_role"];
+  return {
+    id,
+    name: typeof name === "string" && name !== "" ? name : null,
+    role: typeof role === "string" && ORGANIZATION_ROLES2.has(role) ? role : null
+  };
+}
+function actor(source) {
+  return parseActor(claimsOf(source)["act"], 0);
+}
+function sessionId(source) {
+  const sid = claimsOf(source)["sid"];
+  return typeof sid === "string" && sid !== "" ? sid : null;
+}
+function roles(source) {
+  return stringList(claimsOf(source)["roles"]);
+}
+function permissions(source) {
+  return stringList(claimsOf(source)["permissions"]);
+}
+var MAX_ACTOR_DEPTH = 8;
+function parseActor(claim, depth) {
+  if (claim === void 0 || claim === null) {
+    return null;
+  }
+  if (typeof claim !== "object" || Array.isArray(claim)) {
+    return { sub: null, actor: null };
+  }
+  const record = claim;
+  const sub = record["sub"];
+  return {
+    sub: typeof sub === "string" && sub !== "" ? sub : null,
+    actor: depth + 1 < MAX_ACTOR_DEPTH ? parseActor(record["act"], depth + 1) : null
+  };
+}
+function stringList(claim) {
+  return Array.isArray(claim) ? claim.filter((value) => typeof value === "string" && value !== "") : [];
+}
+function claimsOf(source) {
+  return isUser(source) ? source.claims : source;
+}
+function isUser(source) {
+  return typeof source["claims"] === "object" && source["claims"] !== null && typeof source["accessToken"] === "string";
 }
 
 // src/vault.ts
@@ -272,9 +509,7 @@ var CboxIdClient = class {
     if (!config.clientId) {
       throw new ConfigurationError("Cbox ID config `clientId` is required.");
     }
-    if (!config.redirectUri) {
-      throw new ConfigurationError("Cbox ID config `redirectUri` is required.");
-    }
+    assertSecureIssuer(config.issuer);
     this.discovery = new Discovery(
       config.issuer,
       config.timeoutMs ?? 1e4,
@@ -290,21 +525,29 @@ var CboxIdClient = class {
    * to {@link authenticate} on the callback.
    */
   async createAuthorizationRequest(options = {}) {
+    const prompt = promptValue(options.prompt);
+    assertOrganizationOptions(options, prompt);
     const codeVerifier = createVerifier();
     const state = options.state ?? randomToken(16);
     const nonce = randomToken(16);
+    const redirectUri = options.redirectUri ?? this.config.redirectUri;
+    if (redirectUri === void 0 || redirectUri === "") {
+      throw new ConfigurationError(
+        "A `redirectUri` is required to start the browser sign-in flow. Set it in the config, or pass it to createAuthorizationRequest."
+      );
+    }
     const params = new URLSearchParams({
       response_type: "code",
       client_id: this.config.clientId,
-      redirect_uri: options.redirectUri ?? this.config.redirectUri,
+      redirect_uri: redirectUri,
       scope: (options.scopes ?? this.scopes()).join(" "),
       state,
       nonce,
       code_challenge: await challenge(codeVerifier),
       code_challenge_method: "S256"
     });
-    if (options.prompt) {
-      params.set("prompt", options.prompt);
+    if (prompt.length > 0) {
+      params.set("prompt", prompt.join(" "));
     }
     if (options.loginHint) {
       params.set("login_hint", options.loginHint);
@@ -312,6 +555,12 @@ var CboxIdClient = class {
     if (typeof options.maxAge === "number") {
       params.set("max_age", String(options.maxAge));
     }
+    if (options.organization !== void 0) {
+      params.set("organization", options.organization);
+    }
+    if (options.organizationHint !== void 0) {
+      params.set("organization_hint", options.organizationHint);
+    }
     const endpoint = await this.discovery.endpoint("authorization_endpoint");
     return {
       url: `${endpoint}?${params.toString()}`,
@@ -320,9 +569,27 @@ var CboxIdClient = class {
       nonce,
       // Carried through so authenticate() can hold the instance to it. Only present
       // when requested (exactOptionalPropertyTypes).
-      ...typeof options.maxAge === "number" ? { maxAge: options.maxAge } : {}
+      ...typeof options.maxAge === "number" ? { maxAge: options.maxAge } : {},
+      ...options.organization !== void 0 ? { organization: options.organization } : {}
     };
   }
+  /**
+   * Switch the signed-in person to another organization: a new authorization bound to
+   * `organizationId`. Persist and redirect exactly as for
+   * {@link createAuthorizationRequest} — it is one, with `organization` set.
+   *
+   * Cbox ID already holds the person's session, so this is normally a redirect there and
+   * straight back with no sign-in form. The tokens that come back carry the new `org`,
+   * `org_role`, `roles` and `permissions`; replace your session with them rather than
+   * patching the old one, because every one of those can differ between organizations.
+   *
+   * A person who is not (or is no longer) an active member of that organization comes
+   * back with `error=access_denied`, which {@link authenticate} throws as an
+   * `AuthenticationError` with `error === 'access_denied'`.
+   */
+  switchOrganization(organizationId, options = {}) {
+    return this.createAuthorizationRequest({ ...options, organization: organizationId });
+  }
   /**
    * Complete login on your callback route: verify state, exchange the code with the
    * PKCE verifier, verify the id_token, and return the authenticated user.
@@ -337,7 +604,9 @@ var CboxIdClient = class {
     }
     if (params.error) {
       throw new AuthenticationError(
-        `Cbox ID returned an error: ${params.error}${params.error_description ? ` (${params.error_description})` : ""}`
+        `Cbox ID returned an error: ${params.error}${params.error_description ? ` (${params.error_description})` : ""}`,
+        params.error,
+        params.error_description ?? void 0
       );
     }
     if (!params.code) {
@@ -359,6 +628,24 @@ var CboxIdClient = class {
         "A max_age was requested but no id_token was returned, so the authentication age could not be verified."
       );
     }
+    const user = await this.identityFrom(tokens, verified);
+    if (stored.organization !== void 0 && user.organizationId !== stored.organization) {
+      throw new AuthenticationError(
+        `The sign-in was bound to organization ${stored.organization}, but the tokens are for ${user.organizationId ?? "no organization"}. The instance may not support organization selection.`
+      );
+    }
+    return user;
+  }
+  /**
+   * Turn a token response into the verified {@link CboxUser} every flow returns.
+   *
+   * Shared by the browser flow and the device flow rather than written twice: the checks
+   * in here — the UserInfo subject matching the id_token's, the merge that lets UserInfo
+   * enrich but never overwrite signed claims — are the ones that decide whether an
+   * identity is trustworthy. A second copy is a second place for one of them to be
+   * quietly missing, and the flow it was missing from would look exactly as correct.
+   */
+  async identityFrom(tokens, verified) {
     const profile = await this.userinfo(tokens.access_token);
     const verifiedSub = verified["sub"];
     const profileSub = profile["sub"];
@@ -376,6 +663,11 @@ var CboxIdClient = class {
       email: typeof claims["email"] === "string" ? claims["email"] : null,
       name: typeof claims["name"] === "string" ? claims["name"] : null,
       organizationId: typeof claims["org"] === "string" ? claims["org"] : null,
+      organization: organization(claims),
+      roles: roles(claims),
+      permissions: permissions(claims),
+      actor: actor(claims),
+      sessionId: sessionId(claims),
       // Only present when the instance emitted the claim (exactOptionalPropertyTypes).
       ...organizations ? { organizations } : {},
       claims,
@@ -385,6 +677,118 @@ var CboxIdClient = class {
       expiresIn: typeof tokens.expires_in === "number" ? tokens.expires_in : 0
     };
   }
+  /**
+   * Start the device authorization grant (RFC 8628) — the flow for a program with no
+   * browser of its own: a CLI, a CI job, a container, a TV.
+   *
+   * Print `userCode` and `verificationUri`, then call
+   * {@link CboxIdClient.pollDeviceToken}. If the machine has a desktop you may also open
+   * `verificationUriComplete`, which fills the code in — but print the code anyway: the
+   * machine running your program is often not the one the person is looking at.
+   *
+   * The scopes are bounded by what the app is REGISTERED for. A device request naming one
+   * outside that ceiling is refused with `invalid_scope` rather than quietly reduced,
+   * because no browser is in front of it to notice a smaller grant.
+   *
+   * @throws ConfigurationError when the instance advertises no device endpoint.
+   */
+  async requestDeviceAuthorization(scopes) {
+    const endpoint = await this.discovery.optionalEndpoint("device_authorization_endpoint");
+    if (endpoint === null) {
+      throw new ConfigurationError(
+        "This instance does not advertise a device_authorization_endpoint, so it does not support CLI sign-in."
+      );
+    }
+    const body = new URLSearchParams({
+      client_id: this.config.clientId,
+      scope: (scopes ?? this.scopes()).join(" ")
+    });
+    if (this.config.clientSecret) {
+      body.set("client_secret", this.config.clientSecret);
+    }
+    const response = await this.post(endpoint, body);
+    if (!response.ok) {
+      throw await oauthError(response, "Device authorization request failed");
+    }
+    const payload = await response.json();
+    const deviceCode = payload["device_code"];
+    const userCode = payload["user_code"];
+    const verificationUri = payload["verification_uri"];
+    if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string") {
+      throw new AuthenticationError("The device authorization response was incomplete.");
+    }
+    return {
+      deviceCode,
+      userCode,
+      verificationUri,
+      verificationUriComplete: typeof payload["verification_uri_complete"] === "string" ? payload["verification_uri_complete"] : null,
+      expiresIn: typeof payload["expires_in"] === "number" ? payload["expires_in"] : 600,
+      // RFC 8628 §3.2: absent means 5 seconds. Polling faster than the server allows is
+      // answered with `slow_down`, so the default is the one the server assumes too.
+      interval: typeof payload["interval"] === "number" ? payload["interval"] : 5
+    };
+  }
+  /**
+   * Poll until the person approves, and return them.
+   *
+   * Blocks. It honours the server's `interval`, backs off permanently by five seconds on
+   * `slow_down` (RFC 8628 §3.5), and stops on the three answers that are final: they
+   * declined, the code expired, or tokens arrived. Pass an `AbortSignal` to give up
+   * early — a CLI should let Ctrl-C work.
+   *
+   * @throws AuthenticationError when the person declines or the code expires.
+   */
+  async pollDeviceToken(authorization, options = {}) {
+    const endpoint = await this.discovery.endpoint("token_endpoint");
+    const deadline = Date.now() + authorization.expiresIn * 1e3;
+    let intervalMs = authorization.interval * 1e3;
+    for (; ; ) {
+      if (options.signal?.aborted === true) {
+        throw new AuthenticationError("Device sign-in was cancelled.");
+      }
+      if (Date.now() > deadline) {
+        throw new AuthenticationError(
+          "The device code expired before it was approved. Start the sign-in again."
+        );
+      }
+      await sleep(intervalMs, options.signal);
+      const body = new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: authorization.deviceCode,
+        client_id: this.config.clientId
+      });
+      if (this.config.clientSecret) {
+        body.set("client_secret", this.config.clientSecret);
+      }
+      const response = await this.post(endpoint, body);
+      if (response.ok) {
+        const tokens = await response.json();
+        if (!tokens.access_token) {
+          throw new AuthenticationError("The device token response carried no access token.");
+        }
+        const verified = tokens.id_token ? await this.verifyIdToken(tokens.id_token, "") : {};
+        return await this.identityFrom(tokens, verified);
+      }
+      const payload = await response.json().catch(() => ({}));
+      const error = typeof payload["error"] === "string" ? payload["error"] : "invalid_request";
+      if (error === "authorization_pending") {
+        continue;
+      }
+      if (error === "slow_down") {
+        intervalMs += 5e3;
+        continue;
+      }
+      if (error === "access_denied") {
+        throw new AuthenticationError("Sign-in was declined.");
+      }
+      if (error === "expired_token") {
+        throw new AuthenticationError(
+          "The device code expired before it was approved. Start the sign-in again."
+        );
+      }
+      throw await oauthError(response, "Device sign-in failed");
+    }
+  }
   /**
    * Exchange a refresh token for a fresh access token (OAuth 2.0 `refresh_token`
    * grant). Cbox ID rotates refresh tokens and detects reuse, so ALWAYS persist the
@@ -410,6 +814,9 @@ var CboxIdClient = class {
     if (!tokens.access_token) {
       throw new AuthenticationError("The refresh response carried no access token.");
     }
+    if (tokens.id_token) {
+      await this.verifyIdToken(tokens.id_token, "");
+    }
     return {
       accessToken: tokens.access_token,
       // Keep the presented token when the server does not rotate (OAuth 2.0 §6);
@@ -429,6 +836,25 @@ var CboxIdClient = class {
     const base = `${this.config.issuer.replace(/\/$/, "")}${this.accountPath()}`;
     return returnTo ? `${base}?${new URLSearchParams({ return_to: returnTo }).toString()}` : base;
   }
+  /**
+   * The hosted page where a person creates and revokes API keys for your API — Cbox ID's
+   * `/account/api-keys`, preselected to this app (or `clientId`). Keys made there are
+   * checked with `ApiKeyVerifier` from `@cboxdk/id-js/server`.
+   *
+   * `returnTo` becomes a link back to your app, honoured only for an origin the app
+   * registered. `organization` picks which of the person's organizations the keys act in;
+   * omitted, the page uses the one they are in.
+   */
+  apiKeysUrl(options = {}) {
+    const params = new URLSearchParams({ client_id: options.clientId ?? this.config.clientId });
+    if (options.returnTo) {
+      params.set("return_to", options.returnTo);
+    }
+    if (options.organization) {
+      params.set("organization", options.organization);
+    }
+    return `${this.config.issuer.replace(/\/$/, "")}/account/api-keys?${params.toString()}`;
+  }
   /**
    * The RP-initiated logout URL, or null when the instance advertises none.
    *
@@ -568,10 +994,16 @@ var CboxIdClient = class {
     return new VaultClient(this.config.issuer, accessToken, this.config.timeoutMs ?? 1e4);
   }
   async exchange(code, verifier, redirectUri) {
+    const callback = redirectUri ?? this.config.redirectUri;
+    if (callback === void 0 || callback === "") {
+      throw new ConfigurationError(
+        "A `redirectUri` is required to exchange an authorization code. It must be the same one the authorization request used."
+      );
+    }
     const body = new URLSearchParams({
       grant_type: "authorization_code",
       code,
-      redirect_uri: redirectUri ?? this.config.redirectUri,
+      redirect_uri: callback,
       client_id: this.config.clientId,
       code_verifier: verifier
     });
@@ -655,6 +1087,37 @@ var CboxIdClient = class {
     }
   }
 };
+function promptValue(prompt) {
+  if (prompt === void 0) {
+    return [];
+  }
+  const values = [...new Set(typeof prompt === "string" ? [prompt] : prompt)];
+  if (values.includes("none") && values.length > 1) {
+    throw new ConfigurationError("`prompt: 'none'` cannot be combined with another prompt value.");
+  }
+  return values;
+}
+function assertOrganizationOptions(options, prompt) {
+  if (options.organization === "") {
+    throw new ConfigurationError("`organization` is empty. Omit it to sign in without binding to an organization.");
+  }
+  if (options.organizationHint === "") {
+    throw new ConfigurationError("`organizationHint` is empty. Omit it when you have no organization to suggest.");
+  }
+  if (options.organization === void 0) {
+    return;
+  }
+  if (prompt.includes("select_organization")) {
+    throw new ConfigurationError(
+      "`organization` binds the sign-in to one organization, so `prompt: 'select_organization'` has nothing to choose. Use `organizationHint` to preselect an organization in the picker instead."
+    );
+  }
+  if (prompt.includes("create_organization")) {
+    throw new ConfigurationError(
+      "`organization` binds the sign-in to an existing organization and `prompt: 'create_organization'` creates a new one. Send one or the other."
+    );
+  }
+}
 function timingSafeEqualString(a, b) {
   if (a.length !== b.length) {
     return false;
@@ -683,6 +1146,23 @@ function parseOrganizations(claim) {
   }
   return orgs;
 }
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted === true) {
+      reject(new AuthenticationError("Device sign-in was cancelled."));
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new AuthenticationError("Device sign-in was cancelled."));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
 
 // src/nextjs.ts
 var COOKIE = {
@@ -691,12 +1171,15 @@ var COOKIE = {
   nonce: "cbox_id_nonce",
   // The step-up requirement has to survive the redirect like the nonce does: a
   // `maxAge` the callback cannot see is a `maxAge` nothing verifies.
-  maxAge: "cbox_id_max_age"
+  maxAge: "cbox_id_max_age",
+  // Likewise the organization a switch bound to: the callback refuses tokens for another.
+  organization: "cbox_id_organization"
 };
 var TEMP_COOKIE_MAX_AGE = 600;
 function createCboxId(config) {
   const resolved = resolveConfig(config);
   const client = new CboxIdClient(resolved);
+  let apiKeys;
   const tempCookieOptions = {
     httpOnly: true,
     secure: true,
@@ -704,22 +1187,33 @@ function createCboxId(config) {
     path: "/",
     maxAge: TEMP_COOKIE_MAX_AGE
   };
+  const redirectTo = (request) => {
+    const response = server.NextResponse.redirect(request.url);
+    response.cookies.set(COOKIE.state, request.state, tempCookieOptions);
+    response.cookies.set(COOKIE.verifier, request.codeVerifier, tempCookieOptions);
+    response.cookies.set(COOKIE.nonce, request.nonce, tempCookieOptions);
+    if (typeof request.maxAge === "number") {
+      response.cookies.set(COOKIE.maxAge, String(request.maxAge), tempCookieOptions);
+    }
+    if (request.organization !== void 0) {
+      response.cookies.set(COOKIE.organization, request.organization, tempCookieOptions);
+    } else {
+      response.cookies.delete(COOKIE.organization);
+    }
+    return response;
+  };
   return {
     client,
     async signIn(options = {}) {
-      const request = await client.createAuthorizationRequest(options);
-      const response = server.NextResponse.redirect(request.url);
-      response.cookies.set(COOKIE.state, request.state, tempCookieOptions);
-      response.cookies.set(COOKIE.verifier, request.codeVerifier, tempCookieOptions);
-      response.cookies.set(COOKIE.nonce, request.nonce, tempCookieOptions);
-      if (typeof request.maxAge === "number") {
-        response.cookies.set(COOKIE.maxAge, String(request.maxAge), tempCookieOptions);
-      }
-      return response;
+      return redirectTo(await client.createAuthorizationRequest(options));
+    },
+    async switchOrganization(organizationId, options = {}) {
+      return redirectTo(await client.switchOrganization(organizationId, options));
     },
     async callback(request) {
       const storedMaxAge = request.cookies.get(COOKIE.maxAge)?.value;
       const maxAge = storedMaxAge !== void 0 ? Number(storedMaxAge) : void 0;
+      const organization2 = request.cookies.get(COOKIE.organization)?.value;
       return client.authenticate({
         params: {
           code: request.nextUrl.searchParams.get("code"),
@@ -731,7 +1225,8 @@ function createCboxId(config) {
           state: request.cookies.get(COOKIE.state)?.value ?? "",
           codeVerifier: request.cookies.get(COOKIE.verifier)?.value ?? "",
           nonce: request.cookies.get(COOKIE.nonce)?.value ?? "",
-          ...maxAge !== void 0 && Number.isFinite(maxAge) ? { maxAge } : {}
+          ...maxAge !== void 0 && Number.isFinite(maxAge) ? { maxAge } : {},
+          ...organization2 !== void 0 && organization2 !== "" ? { organization: organization2 } : {}
         }
       });
     },
@@ -741,6 +1236,18 @@ function createCboxId(config) {
     profileRedirect(returnTo) {
       return server.NextResponse.redirect(client.profileUrl(returnTo));
     },
+    apiKeysUrl(options) {
+      return client.apiKeysUrl(options);
+    },
+    verifyApiKey(key) {
+      apiKeys ??= new ApiKeyVerifier({
+        issuer: resolved.issuer,
+        clientId: resolved.clientId,
+        clientSecret: resolved.clientSecret ?? "",
+        ...resolved.timeoutMs ? { timeoutMs: resolved.timeoutMs } : {}
+      });
+      return apiKeys.verifyApiKey(key);
+    },
     signOutUrl(returnTo, idTokenHint) {
       return client.logoutUrl(returnTo, idTokenHint);
     }