@cboxdk/id-js 0.17.0 → 0.19.0

package/dist/index.d.cts

@@ -1,5 +1,6 @@
-export { a as CallbackParams, C as CboxIdClient, S as StoreSecretInput, b as StoredAuthState, V as VaultClient, c as VaultLease, d as VaultSecretRef, e as VerifyWebhookOptions, v as verifyWebhook } from './client-CEXddiCR.cjs';
-export { c as AuthorizationPrompt, b as AuthorizationRequest, A as AuthorizationRequestOptions, d as CboxActiveOrganization, e as CboxActor, a as CboxIdConfig, f as CboxOrganization, C as CboxUser, g as ClaimSource, D as DeviceAuthorization, h as DiscoveryDocument, O as OrganizationRole, R as RefreshedTokens, i as TokenResponse, T as TokenTypeHint, j as actor, k as hasPermission, l as hasRole, m as isSupportSession, o as organization, p as permissions, r as roles, s as sessionId } from './types-BYZldock.cjs';
+export { A as AuthenticationError, C as CboxIdError, a as ConfigurationError, F as FrontendApiError, I as InvalidStateError } from './errors-D61xljZE.cjs';
+export { a as CallbackParams, C as CboxIdClient, P as PipeConnectOptions, b as PipeLeaseDeniedError, c as PipeLeaseError, d as PipeNotConnectedError, e as PipeProvider, f as PipeReauthorizationRequiredError, g as PipeTemporarilyUnavailableError, h as PipeToken, S as StoreSecretInput, i as StoredAuthState, V as VaultClient, j as VaultLease, k as VaultSecretRef, l as VerifyStandardWebhookOptions, m as VerifyWebhookOptions, W as WebhookHeaders, p as pipeConnectUrl, v as verifyStandardWebhook, n as verifyWebhook, w as withConnectReturn } from './client-BT-jOm0p.cjs';
+export { c as AuthorizationPrompt, b as AuthorizationRequest, A as AuthorizationRequestOptions, d as CboxActiveOrganization, e as CboxActor, a as CboxIdConfig, f as CboxOrganization, C as CboxUser, g as ClaimSource, D as DeviceAuthorization, h as DiscoveryDocument, F as FEATURE_FLAGS_SCOPE, O as OrganizationRole, R as RefreshedTokens, i as TokenResponse, T as TokenTypeHint, j as actor, k as featureFlags, l as hasFeature, m as hasPermission, n as hasRole, o as isSupportSession, p as organization, q as permissions, r as roles, s as sessionId } from './types-CC1bz68x.cjs';
 
 /**
  * The handler on YOUR side of a legacy migration.
@@ -129,9 +130,35 @@ interface FrontendConfig {
         end_session: string;
         jwks: string;
     };
+    /**
+     * The social buttons to draw, exactly as the hosted sign-in page would: the environment's
+     * own providers, or — with `config({ organization })` — that organization's.
+     */
     social: SocialProvider[];
     appearance?: Appearance;
+    /**
+     * Which other sign-in methods are switched on, so a box does not draw a button whose
+     * endpoint answers 403. Absent from instances that predate it.
+     */
+    methods?: {
+        passkeys: boolean;
+        magic_link: boolean;
+    };
+}
+/** Options for {@link CboxIdFrontend.config}. */
+interface FrontendConfigOptions {
+    /**
+     * The organization the box is for, by id or slug — the way a hosted page is addressed.
+     * `social` is then exactly what that organization's sign-in page offers. An organization
+     * the environment does not have is answered as no hint at all.
+     */
+    organization?: string;
 }
+/**
+ * A second factor the person can answer an `mfa_required` with. Kinds only — the server
+ * never says which number a text would go to before one is sent.
+ */
+type SecondFactorKind = 'totp' | 'sms' | 'recovery_code';
 /** What a sign-in attempt produced. */
 type SignInResult = {
     status: 'ok';
@@ -140,6 +167,11 @@ type SignInResult = {
 } | {
     status: 'mfa_required';
     mfaToken: string;
+    /**
+     * The factors this person can answer with (laravel-id 1.24+). Absent when the
+     * instance predates the list — then only an authenticator or a recovery code works.
+     */
+    factors?: SecondFactorKind[];
 } | {
     status: 'otp_required';
     mfaToken: string;
@@ -151,6 +183,30 @@ type SignInResult = {
     status: 'rate_limited';
     retryAfter: number | undefined;
 };
+/** What asking for a texted sign-in code produced. */
+type SmsCodeResult = 
+/** Sent. `to` is the number masked (`+45 ******78`); the code lasts `expiresIn` seconds. */
+{
+    status: 'sent';
+    to: string;
+    expiresIn: number;
+}
+/** Too soon, or a sending limit was hit. Waiting `retryAfter` seconds may help. */
+ | {
+    status: 'rate_limited';
+    retryAfter: number | undefined;
+}
+/** The text provider failed. Try again shortly, or offer another factor. */
+ | {
+    status: 'unavailable';
+}
+/**
+ * Refused: an unknown or spent token, no number on file, a country texts are not sent
+ * to, or no attempts left. One answer for every reason, like a wrong password.
+ */
+ | {
+    status: 'invalid';
+};
 /** What a browser needs to ask an authenticator for a passkey assertion. */
 interface PasskeyOptions {
     challenge: string;
@@ -196,7 +252,7 @@ declare class CboxIdFrontend {
      * fetches of the same immutable document is a waste the SDK should absorb rather than
      * ask every consumer to.
      */
-    private configPromise;
+    private readonly configPromises;
     constructor(options: FrontendClientOptions);
     /** Whether this key drives real sign-ins. Handy for a "test mode" badge in your own UI. */
     get isLive(): boolean;
@@ -206,8 +262,9 @@ declare class CboxIdFrontend {
      * Fetched once per client instance. The document is small and changes when somebody
      * edits it in the console, so a long-lived page picks changes up on its next full load
      * rather than mid-session — which is the right trade for something that decides layout.
+     * Each `organization` is fetched and cached on its own.
      */
-    config(): Promise<FrontendConfig>;
+    config(options?: FrontendConfigOptions): Promise<FrontendConfig>;
     /**
      * Who is signed in, given an access token your app already holds.
      *
@@ -255,8 +312,29 @@ declare class CboxIdFrontend {
      *
      * A wrong code costs an attempt, not the sign-in: five are allowed before the token
      * dies and the person starts from the password again.
+     *
+     * `method` says which challenge the code answers: `'mfa'` for an authenticator or
+     * recovery code, `'otp'` for an emailed code (`otp_required`), `'sms'` for a code sent
+     * with {@link sendSmsCode}. A texted code is six digits like an authenticator's, so the
+     * server cannot tell them apart by shape — answering one as the other is refused.
      */
-    submitSecondFactor(mfaToken: string, code: string, method?: 'mfa' | 'otp'): Promise<SignInResult>;
+    submitSecondFactor(mfaToken: string, code: string, method?: 'mfa' | 'otp' | 'sms'): Promise<SignInResult>;
+    /**
+     * Text the person a sign-in code, when `mfa_required` listed `'sms'` in `factors`.
+     * Then finish with `submitSecondFactor(mfaToken, code, 'sms')`.
+     *
+     * Only call it when the person asks ("Text me a code"), never on page load: each send
+     * spends one of the token's five attempts — that is what bounds how many texts one
+     * proved password can cause — and every text costs the customer money.
+     *
+     * ```ts
+     * if (result.status === 'mfa_required' && result.factors?.includes('sms')) {
+     *   const sent = await frontend.sendSmsCode(result.mfaToken)
+     *   if (sent.status === 'sent') showCodeField(`We texted ${sent.to}`)
+     * }
+     * ```
+     */
+    sendSmsCode(mfaToken: string): Promise<SmsCodeResult>;
     /**
      * The WebAuthn options for a passkey sign-in, and the handle that carries the challenge.
      *
@@ -282,92 +360,6 @@ declare class CboxIdFrontend {
     private attempt;
 }
 
-/**
- * Base class for every error this SDK throws, so callers can `catch (e) { if (e
- * instanceof CboxIdError) ... }` in one branch.
- */
-declare class CboxIdError extends Error {
-    constructor(message: string);
-}
-/** The client is misconfigured (a required option is missing or empty). */
-declare class ConfigurationError extends CboxIdError {
-}
-/**
- * The login `state` did not match what was stored — the callback is forged or
- * stale. Treat as a fresh start, not an error to surface to the user.
- */
-declare class InvalidStateError extends CboxIdError {
-}
-/**
- * Login could not be completed: the provider returned an error, the callback was
- * missing a code, or a token / id_token failed verification.
- *
- * `error` carries the RFC 6749 §5.2 code the authorization server sent, when it sent one.
- * It used to be discarded at every back-channel boundary, leaving a single message string
- * for outcomes that need opposite responses: `invalid_grant` on a refresh means the
- * session is over and the person has to sign in again, while `temporarily_unavailable`
- * means try the same token in a moment. A caller reduced to matching on prose either
- * retries what can never succeed, or signs out somebody who did not need to be.
- */
-declare class AuthenticationError extends CboxIdError {
-    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */
-    readonly error?: string | undefined;
-    /** The server's `error_description`, verbatim. Not end-user copy. */
-    readonly errorDescription?: string | undefined;
-    /** HTTP status, for the cases where the body says nothing useful. */
-    readonly status?: number | undefined;
-    /**
-     * Seconds to wait, off the `Retry-After` header — set only on a 429.
-     *
-     * The distinction it carries is the one a caller most needs and could least infer:
-     * a 429 is the ONLY back-channel failure where the same request will succeed
-     * unchanged if you simply wait. Every other one needs a different request, or a new
-     * sign-in. Without this the SDK reported "token refresh failed" and a caller with a
-     * retry loop hammered a limiter that was already telling it exactly how long to stop.
-     */
-    readonly retryAfter?: number | undefined;
-    constructor(message: string, 
-    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */
-    error?: string | undefined, 
-    /** The server's `error_description`, verbatim. Not end-user copy. */
-    errorDescription?: string | undefined, 
-    /** HTTP status, for the cases where the body says nothing useful. */
-    status?: number | undefined, 
-    /**
-     * Seconds to wait, off the `Retry-After` header — set only on a 429.
-     *
-     * The distinction it carries is the one a caller most needs and could least infer:
-     * a 429 is the ONLY back-channel failure where the same request will succeed
-     * unchanged if you simply wait. Every other one needs a different request, or a new
-     * sign-in. Without this the SDK reported "token refresh failed" and a caller with a
-     * retry loop hammered a limiter that was already telling it exactly how long to stop.
-     */
-    retryAfter?: number | undefined);
-    /** Whether waiting `retryAfter` seconds and repeating the same request is worth it. */
-    get isRateLimited(): boolean;
-}
-/**
- * The Frontend API refused, or could not be reached.
- *
- * Carries a `code` because the four ways this goes wrong need four different responses
- * from the caller, and telling them apart from a message string is the kind of thing
- * that works until somebody rewords the message:
- *
- *  - `origin_not_allowed` — the overwhelmingly likely cause of a refusal, and a
- *    configuration problem the developer fixes once in the console.
- *  - `rate_limited` — back off; `retryAfter` says for how long, when the server said.
- *  - `unavailable` — the network, or a 5xx. Transient by assumption; already retried.
- *  - `malformed` — a 200 whose body is not the document we expect, which means something
- *    between the page and us is rewriting responses (a proxy, an extension, a captive
- *    portal). Worth distinguishing, because retrying it never helps.
- */
-declare class FrontendApiError extends CboxIdError {
-    readonly code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed';
-    readonly status?: number | undefined;
-    readonly retryAfter?: number | undefined;
-    constructor(message: string, code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed', status?: number | undefined, retryAfter?: number | undefined);
-}
-
 /**
  * PKCE (RFC 7636) and the random values the login flow needs, built on Web Crypto
  * (`globalThis.crypto`) so the same code runs on Node, edge runtimes and browsers.
@@ -527,4 +519,4 @@ declare function buildManifest(declaration: AuthzDeclaration): Promise<AuthzMani
  */
 declare function publishManifest(config: ManifestPublisherConfig, declaration: AuthzDeclaration): Promise<ManifestSyncSummary>;
 
-export { type Appearance, AuthenticationError, type AuthzDeclaration, type AuthzManifest, CboxIdError, CboxIdFrontend, ConfigurationError, FrontendApiError, type FrontendClientOptions, type FrontendConfig, type FrontendSession, InvalidStateError, type LegacyUser, type LegacyVerifierOptions, type ManifestPermission, type ManifestPublisherConfig, type ManifestRole, type ManifestSyncSummary, type PasskeyOptions, type PermissionDefinition, type RoleDefinition, type SignInResult, type SocialProvider, buildManifest, challenge, createLegacyVerifier, createVerifier, defineAuthz, publishManifest, randomToken };
+export { type Appearance, type AuthzDeclaration, type AuthzManifest, CboxIdFrontend, type FrontendClientOptions, type FrontendConfig, type FrontendConfigOptions, type FrontendSession, type LegacyUser, type LegacyVerifierOptions, type ManifestPermission, type ManifestPublisherConfig, type ManifestRole, type ManifestSyncSummary, type PasskeyOptions, type PermissionDefinition, type RoleDefinition, type SecondFactorKind, type SignInResult, type SmsCodeResult, type SocialProvider, buildManifest, challenge, createLegacyVerifier, createVerifier, defineAuthz, publishManifest, randomToken };

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-export { a as CallbackParams, C as CboxIdClient, S as StoreSecretInput, b as StoredAuthState, V as VaultClient, c as VaultLease, d as VaultSecretRef, e as VerifyWebhookOptions, v as verifyWebhook } from './client-CdwdigzG.js';
-export { c as AuthorizationPrompt, b as AuthorizationRequest, A as AuthorizationRequestOptions, d as CboxActiveOrganization, e as CboxActor, a as CboxIdConfig, f as CboxOrganization, C as CboxUser, g as ClaimSource, D as DeviceAuthorization, h as DiscoveryDocument, O as OrganizationRole, R as RefreshedTokens, i as TokenResponse, T as TokenTypeHint, j as actor, k as hasPermission, l as hasRole, m as isSupportSession, o as organization, p as permissions, r as roles, s as sessionId } from './types-BYZldock.js';
+export { A as AuthenticationError, C as CboxIdError, a as ConfigurationError, F as FrontendApiError, I as InvalidStateError } from './errors-D61xljZE.js';
+export { a as CallbackParams, C as CboxIdClient, P as PipeConnectOptions, b as PipeLeaseDeniedError, c as PipeLeaseError, d as PipeNotConnectedError, e as PipeProvider, f as PipeReauthorizationRequiredError, g as PipeTemporarilyUnavailableError, h as PipeToken, S as StoreSecretInput, i as StoredAuthState, V as VaultClient, j as VaultLease, k as VaultSecretRef, l as VerifyStandardWebhookOptions, m as VerifyWebhookOptions, W as WebhookHeaders, p as pipeConnectUrl, v as verifyStandardWebhook, n as verifyWebhook, w as withConnectReturn } from './client-xlEJalu8.js';
+export { c as AuthorizationPrompt, b as AuthorizationRequest, A as AuthorizationRequestOptions, d as CboxActiveOrganization, e as CboxActor, a as CboxIdConfig, f as CboxOrganization, C as CboxUser, g as ClaimSource, D as DeviceAuthorization, h as DiscoveryDocument, F as FEATURE_FLAGS_SCOPE, O as OrganizationRole, R as RefreshedTokens, i as TokenResponse, T as TokenTypeHint, j as actor, k as featureFlags, l as hasFeature, m as hasPermission, n as hasRole, o as isSupportSession, p as organization, q as permissions, r as roles, s as sessionId } from './types-CC1bz68x.js';
 
 /**
  * The handler on YOUR side of a legacy migration.
@@ -129,9 +130,35 @@ interface FrontendConfig {
         end_session: string;
         jwks: string;
     };
+    /**
+     * The social buttons to draw, exactly as the hosted sign-in page would: the environment's
+     * own providers, or — with `config({ organization })` — that organization's.
+     */
     social: SocialProvider[];
     appearance?: Appearance;
+    /**
+     * Which other sign-in methods are switched on, so a box does not draw a button whose
+     * endpoint answers 403. Absent from instances that predate it.
+     */
+    methods?: {
+        passkeys: boolean;
+        magic_link: boolean;
+    };
+}
+/** Options for {@link CboxIdFrontend.config}. */
+interface FrontendConfigOptions {
+    /**
+     * The organization the box is for, by id or slug — the way a hosted page is addressed.
+     * `social` is then exactly what that organization's sign-in page offers. An organization
+     * the environment does not have is answered as no hint at all.
+     */
+    organization?: string;
 }
+/**
+ * A second factor the person can answer an `mfa_required` with. Kinds only — the server
+ * never says which number a text would go to before one is sent.
+ */
+type SecondFactorKind = 'totp' | 'sms' | 'recovery_code';
 /** What a sign-in attempt produced. */
 type SignInResult = {
     status: 'ok';
@@ -140,6 +167,11 @@ type SignInResult = {
 } | {
     status: 'mfa_required';
     mfaToken: string;
+    /**
+     * The factors this person can answer with (laravel-id 1.24+). Absent when the
+     * instance predates the list — then only an authenticator or a recovery code works.
+     */
+    factors?: SecondFactorKind[];
 } | {
     status: 'otp_required';
     mfaToken: string;
@@ -151,6 +183,30 @@ type SignInResult = {
     status: 'rate_limited';
     retryAfter: number | undefined;
 };
+/** What asking for a texted sign-in code produced. */
+type SmsCodeResult = 
+/** Sent. `to` is the number masked (`+45 ******78`); the code lasts `expiresIn` seconds. */
+{
+    status: 'sent';
+    to: string;
+    expiresIn: number;
+}
+/** Too soon, or a sending limit was hit. Waiting `retryAfter` seconds may help. */
+ | {
+    status: 'rate_limited';
+    retryAfter: number | undefined;
+}
+/** The text provider failed. Try again shortly, or offer another factor. */
+ | {
+    status: 'unavailable';
+}
+/**
+ * Refused: an unknown or spent token, no number on file, a country texts are not sent
+ * to, or no attempts left. One answer for every reason, like a wrong password.
+ */
+ | {
+    status: 'invalid';
+};
 /** What a browser needs to ask an authenticator for a passkey assertion. */
 interface PasskeyOptions {
     challenge: string;
@@ -196,7 +252,7 @@ declare class CboxIdFrontend {
      * fetches of the same immutable document is a waste the SDK should absorb rather than
      * ask every consumer to.
      */
-    private configPromise;
+    private readonly configPromises;
     constructor(options: FrontendClientOptions);
     /** Whether this key drives real sign-ins. Handy for a "test mode" badge in your own UI. */
     get isLive(): boolean;
@@ -206,8 +262,9 @@ declare class CboxIdFrontend {
      * Fetched once per client instance. The document is small and changes when somebody
      * edits it in the console, so a long-lived page picks changes up on its next full load
      * rather than mid-session — which is the right trade for something that decides layout.
+     * Each `organization` is fetched and cached on its own.
      */
-    config(): Promise<FrontendConfig>;
+    config(options?: FrontendConfigOptions): Promise<FrontendConfig>;
     /**
      * Who is signed in, given an access token your app already holds.
      *
@@ -255,8 +312,29 @@ declare class CboxIdFrontend {
      *
      * A wrong code costs an attempt, not the sign-in: five are allowed before the token
      * dies and the person starts from the password again.
+     *
+     * `method` says which challenge the code answers: `'mfa'` for an authenticator or
+     * recovery code, `'otp'` for an emailed code (`otp_required`), `'sms'` for a code sent
+     * with {@link sendSmsCode}. A texted code is six digits like an authenticator's, so the
+     * server cannot tell them apart by shape — answering one as the other is refused.
      */
-    submitSecondFactor(mfaToken: string, code: string, method?: 'mfa' | 'otp'): Promise<SignInResult>;
+    submitSecondFactor(mfaToken: string, code: string, method?: 'mfa' | 'otp' | 'sms'): Promise<SignInResult>;
+    /**
+     * Text the person a sign-in code, when `mfa_required` listed `'sms'` in `factors`.
+     * Then finish with `submitSecondFactor(mfaToken, code, 'sms')`.
+     *
+     * Only call it when the person asks ("Text me a code"), never on page load: each send
+     * spends one of the token's five attempts — that is what bounds how many texts one
+     * proved password can cause — and every text costs the customer money.
+     *
+     * ```ts
+     * if (result.status === 'mfa_required' && result.factors?.includes('sms')) {
+     *   const sent = await frontend.sendSmsCode(result.mfaToken)
+     *   if (sent.status === 'sent') showCodeField(`We texted ${sent.to}`)
+     * }
+     * ```
+     */
+    sendSmsCode(mfaToken: string): Promise<SmsCodeResult>;
     /**
      * The WebAuthn options for a passkey sign-in, and the handle that carries the challenge.
      *
@@ -282,92 +360,6 @@ declare class CboxIdFrontend {
     private attempt;
 }
 
-/**
- * Base class for every error this SDK throws, so callers can `catch (e) { if (e
- * instanceof CboxIdError) ... }` in one branch.
- */
-declare class CboxIdError extends Error {
-    constructor(message: string);
-}
-/** The client is misconfigured (a required option is missing or empty). */
-declare class ConfigurationError extends CboxIdError {
-}
-/**
- * The login `state` did not match what was stored — the callback is forged or
- * stale. Treat as a fresh start, not an error to surface to the user.
- */
-declare class InvalidStateError extends CboxIdError {
-}
-/**
- * Login could not be completed: the provider returned an error, the callback was
- * missing a code, or a token / id_token failed verification.
- *
- * `error` carries the RFC 6749 §5.2 code the authorization server sent, when it sent one.
- * It used to be discarded at every back-channel boundary, leaving a single message string
- * for outcomes that need opposite responses: `invalid_grant` on a refresh means the
- * session is over and the person has to sign in again, while `temporarily_unavailable`
- * means try the same token in a moment. A caller reduced to matching on prose either
- * retries what can never succeed, or signs out somebody who did not need to be.
- */
-declare class AuthenticationError extends CboxIdError {
-    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */
-    readonly error?: string | undefined;
-    /** The server's `error_description`, verbatim. Not end-user copy. */
-    readonly errorDescription?: string | undefined;
-    /** HTTP status, for the cases where the body says nothing useful. */
-    readonly status?: number | undefined;
-    /**
-     * Seconds to wait, off the `Retry-After` header — set only on a 429.
-     *
-     * The distinction it carries is the one a caller most needs and could least infer:
-     * a 429 is the ONLY back-channel failure where the same request will succeed
-     * unchanged if you simply wait. Every other one needs a different request, or a new
-     * sign-in. Without this the SDK reported "token refresh failed" and a caller with a
-     * retry loop hammered a limiter that was already telling it exactly how long to stop.
-     */
-    readonly retryAfter?: number | undefined;
-    constructor(message: string, 
-    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */
-    error?: string | undefined, 
-    /** The server's `error_description`, verbatim. Not end-user copy. */
-    errorDescription?: string | undefined, 
-    /** HTTP status, for the cases where the body says nothing useful. */
-    status?: number | undefined, 
-    /**
-     * Seconds to wait, off the `Retry-After` header — set only on a 429.
-     *
-     * The distinction it carries is the one a caller most needs and could least infer:
-     * a 429 is the ONLY back-channel failure where the same request will succeed
-     * unchanged if you simply wait. Every other one needs a different request, or a new
-     * sign-in. Without this the SDK reported "token refresh failed" and a caller with a
-     * retry loop hammered a limiter that was already telling it exactly how long to stop.
-     */
-    retryAfter?: number | undefined);
-    /** Whether waiting `retryAfter` seconds and repeating the same request is worth it. */
-    get isRateLimited(): boolean;
-}
-/**
- * The Frontend API refused, or could not be reached.
- *
- * Carries a `code` because the four ways this goes wrong need four different responses
- * from the caller, and telling them apart from a message string is the kind of thing
- * that works until somebody rewords the message:
- *
- *  - `origin_not_allowed` — the overwhelmingly likely cause of a refusal, and a
- *    configuration problem the developer fixes once in the console.
- *  - `rate_limited` — back off; `retryAfter` says for how long, when the server said.
- *  - `unavailable` — the network, or a 5xx. Transient by assumption; already retried.
- *  - `malformed` — a 200 whose body is not the document we expect, which means something
- *    between the page and us is rewriting responses (a proxy, an extension, a captive
- *    portal). Worth distinguishing, because retrying it never helps.
- */
-declare class FrontendApiError extends CboxIdError {
-    readonly code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed';
-    readonly status?: number | undefined;
-    readonly retryAfter?: number | undefined;
-    constructor(message: string, code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed', status?: number | undefined, retryAfter?: number | undefined);
-}
-
 /**
  * PKCE (RFC 7636) and the random values the login flow needs, built on Web Crypto
  * (`globalThis.crypto`) so the same code runs on Node, edge runtimes and browsers.
@@ -527,4 +519,4 @@ declare function buildManifest(declaration: AuthzDeclaration): Promise<AuthzMani
  */
 declare function publishManifest(config: ManifestPublisherConfig, declaration: AuthzDeclaration): Promise<ManifestSyncSummary>;
 
-export { type Appearance, AuthenticationError, type AuthzDeclaration, type AuthzManifest, CboxIdError, CboxIdFrontend, ConfigurationError, FrontendApiError, type FrontendClientOptions, type FrontendConfig, type FrontendSession, InvalidStateError, type LegacyUser, type LegacyVerifierOptions, type ManifestPermission, type ManifestPublisherConfig, type ManifestRole, type ManifestSyncSummary, type PasskeyOptions, type PermissionDefinition, type RoleDefinition, type SignInResult, type SocialProvider, buildManifest, challenge, createLegacyVerifier, createVerifier, defineAuthz, publishManifest, randomToken };
+export { type Appearance, type AuthzDeclaration, type AuthzManifest, CboxIdFrontend, type FrontendClientOptions, type FrontendConfig, type FrontendConfigOptions, type FrontendSession, type LegacyUser, type LegacyVerifierOptions, type ManifestPermission, type ManifestPublisherConfig, type ManifestRole, type ManifestSyncSummary, type PasskeyOptions, type PermissionDefinition, type RoleDefinition, type SecondFactorKind, type SignInResult, type SmsCodeResult, type SocialProvider, buildManifest, challenge, createLegacyVerifier, createVerifier, defineAuthz, publishManifest, randomToken };

package/dist/index.js

@@ -1,7 +1,8 @@
-import { Discovery } from './chunk-G3CD7X4U.js';
-export { CboxIdClient, VaultClient, actor, challenge, createVerifier, hasPermission, hasRole, isSupportSession, organization, permissions, randomToken, roles, sessionId, verifyWebhook } from './chunk-G3CD7X4U.js';
-import { ConfigurationError, assertSecureIssuer, FrontendApiError, AuthenticationError } from './chunk-ASOQN47M.js';
-export { AuthenticationError, CboxIdError, ConfigurationError, FrontendApiError, InvalidStateError } from './chunk-ASOQN47M.js';
+import { Discovery } from './chunk-YGLMLIKL.js';
+export { CboxIdClient, FEATURE_FLAGS_SCOPE, PipeLeaseDeniedError, PipeLeaseError, PipeNotConnectedError, PipeReauthorizationRequiredError, PipeTemporarilyUnavailableError, VaultClient, actor, challenge, createVerifier, featureFlags, hasFeature, hasPermission, hasRole, isSupportSession, organization, permissions, pipeConnectUrl, randomToken, roles, sessionId, verifyStandardWebhook, verifyWebhook, withConnectReturn } from './chunk-YGLMLIKL.js';
+import { assertSecureIssuer } from './chunk-QQW63PGU.js';
+import { ConfigurationError, FrontendApiError, AuthenticationError } from './chunk-SEUD4TE4.js';
+export { AuthenticationError, CboxIdError, ConfigurationError, FrontendApiError, InvalidStateError } from './chunk-SEUD4TE4.js';
 
 // src/legacy.ts
 function createLegacyVerifier(options) {
@@ -97,6 +98,7 @@ function json(body, status) {
 }
 
 // src/frontend.ts
+var SECOND_FACTOR_KINDS = /* @__PURE__ */ new Set(["totp", "sms", "recovery_code"]);
 var CboxIdFrontend = class {
   issuer;
   publishableKey;
@@ -111,7 +113,7 @@ var CboxIdFrontend = class {
    * fetches of the same immutable document is a waste the SDK should absorb rather than
    * ask every consumer to.
    */
-  configPromise = null;
+  configPromises = /* @__PURE__ */ new Map();
   constructor(options) {
     if (!options.issuer) {
       throw new ConfigurationError("issuer is required.");
@@ -138,13 +140,20 @@ var CboxIdFrontend = class {
    * Fetched once per client instance. The document is small and changes when somebody
    * edits it in the console, so a long-lived page picks changes up on its next full load
    * rather than mid-session — which is the right trade for something that decides layout.
+   * Each `organization` is fetched and cached on its own.
    */
-  async config() {
-    this.configPromise ??= this.get("/frontend/v1/config", {}, isFrontendConfig).catch((error) => {
-      this.configPromise = null;
-      throw error;
-    });
-    return this.configPromise;
+  async config(options = {}) {
+    const organization2 = options.organization ?? "";
+    let pending = this.configPromises.get(organization2);
+    if (pending === void 0) {
+      const path = organization2 === "" ? "/frontend/v1/config" : `/frontend/v1/config?${new URLSearchParams({ organization: organization2 }).toString()}`;
+      pending = this.get(path, {}, isFrontendConfig).catch((error) => {
+        this.configPromises.delete(organization2);
+        throw error;
+      });
+      this.configPromises.set(organization2, pending);
+    }
+    return pending;
   }
   /**
    * Who is signed in, given an access token your app already holds.
@@ -206,8 +215,12 @@ var CboxIdFrontend = class {
     if (body.status === "ok" && typeof body.login_ticket === "string") {
       return { status: "ok", loginTicket: body.login_ticket, expiresIn: body.expires_in ?? 60 };
     }
-    if ((body.status === "mfa_required" || body.status === "otp_required") && typeof body.mfa_token === "string") {
-      return { status: body.status, mfaToken: body.mfa_token };
+    if (body.status === "mfa_required" && typeof body.mfa_token === "string") {
+      const factors = Array.isArray(body.factors) ? body.factors.filter((f) => typeof f === "string" && SECOND_FACTOR_KINDS.has(f)) : void 0;
+      return { status: "mfa_required", mfaToken: body.mfa_token, ...factors ? { factors } : {} };
+    }
+    if (body.status === "otp_required" && typeof body.mfa_token === "string") {
+      return { status: "otp_required", mfaToken: body.mfa_token };
     }
     if (body.status === "sso_required") {
       return { status: "sso_required" };
@@ -224,6 +237,11 @@ var CboxIdFrontend = class {
    *
    * A wrong code costs an attempt, not the sign-in: five are allowed before the token
    * dies and the person starts from the password again.
+   *
+   * `method` says which challenge the code answers: `'mfa'` for an authenticator or
+   * recovery code, `'otp'` for an emailed code (`otp_required`), `'sms'` for a code sent
+   * with {@link sendSmsCode}. A texted code is six digits like an authenticator's, so the
+   * server cannot tell them apart by shape — answering one as the other is refused.
    */
   async submitSecondFactor(mfaToken, code, method = "mfa") {
     const response = await this.post("/frontend/v1/sign-in/factor", { mfa_token: mfaToken, code, method });
@@ -235,6 +253,41 @@ var CboxIdFrontend = class {
     }
     return body.status === "ok" && typeof body.login_ticket === "string" ? { status: "ok", loginTicket: body.login_ticket, expiresIn: body.expires_in ?? 60 } : { status: "invalid" };
   }
+  /**
+   * Text the person a sign-in code, when `mfa_required` listed `'sms'` in `factors`.
+   * Then finish with `submitSecondFactor(mfaToken, code, 'sms')`.
+   *
+   * Only call it when the person asks ("Text me a code"), never on page load: each send
+   * spends one of the token's five attempts — that is what bounds how many texts one
+   * proved password can cause — and every text costs the customer money.
+   *
+   * ```ts
+   * if (result.status === 'mfa_required' && result.factors?.includes('sms')) {
+   *   const sent = await frontend.sendSmsCode(result.mfaToken)
+   *   if (sent.status === 'sent') showCodeField(`We texted ${sent.to}`)
+   * }
+   * ```
+   */
+  async sendSmsCode(mfaToken) {
+    const response = await this.post("/frontend/v1/sign-in/factor/sms", { mfa_token: mfaToken });
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new FrontendApiError("Cbox ID returned a body that is not JSON.", "malformed", response.status);
+    }
+    if (body.status === "sent" && typeof body.to === "string") {
+      return { status: "sent", to: body.to, expiresIn: typeof body.expires_in === "number" ? body.expires_in : 300 };
+    }
+    if (body.status === "rate_limited" || response.status === 429) {
+      const retryAfter = typeof body.retry_after === "number" ? body.retry_after : Number(response.headers.get("Retry-After") ?? "");
+      return { status: "rate_limited", retryAfter: Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter : void 0 };
+    }
+    if (body.status === "unavailable") {
+      return { status: "unavailable" };
+    }
+    return { status: "invalid" };
+  }
   /**
    * The WebAuthn options for a passkey sign-in, and the handle that carries the challenge.
    *