@cboxdk/id-js 0.18.0 → 0.20.0

package/dist/index.d.cts

@@ -1,6 +1,7 @@
 export { A as AuthenticationError, C as CboxIdError, a as ConfigurationError, F as FrontendApiError, I as InvalidStateError } from './errors-D61xljZE.cjs';
-export { a as CallbackParams, C as CboxIdClient, S as StoreSecretInput, b as StoredAuthState, V as VaultClient, c as VaultLease, d as VaultSecretRef, e as VerifyStandardWebhookOptions, f as VerifyWebhookOptions, W as WebhookHeaders, v as verifyStandardWebhook, g as verifyWebhook } from './client-BxUHm5hX.cjs';
-export { c as AuthorizationPrompt, b as AuthorizationRequest, A as AuthorizationRequestOptions, d as CboxActiveOrganization, e as CboxActor, a as CboxIdConfig, f as CboxOrganization, C as CboxUser, g as ClaimSource, D as DeviceAuthorization, h as DiscoveryDocument, O as OrganizationRole, R as RefreshedTokens, i as TokenResponse, T as TokenTypeHint, j as actor, k as hasPermission, l as hasRole, m as isSupportSession, o as organization, p as permissions, r as roles, s as sessionId } from './types-BYZldock.cjs';
+export { a as CallbackParams, C as CboxIdClient, P as PipeConnectOptions, b as PipeLeaseDeniedError, c as PipeLeaseError, d as PipeNotConnectedError, e as PipeProvider, f as PipeReauthorizationRequiredError, g as PipeTemporarilyUnavailableError, h as PipeToken, S as StoreSecretInput, i as StoredAuthState, V as VaultClient, j as VaultLease, k as VaultSecretRef, l as VerifyStandardWebhookOptions, m as VerifyWebhookOptions, W as WebhookHeaders, p as pipeConnectUrl, v as verifyStandardWebhook, n as verifyWebhook, w as withConnectReturn } from './client-BT-jOm0p.cjs';
+export { c as AuthorizationPrompt, b as AuthorizationRequest, A as AuthorizationRequestOptions, d as CboxActiveOrganization, e as CboxActor, a as CboxIdConfig, f as CboxOrganization, C as CboxUser, g as ClaimSource, D as DeviceAuthorization, h as DiscoveryDocument, F as FEATURE_FLAGS_SCOPE, O as OrganizationRole, R as RefreshedTokens, i as TokenResponse, T as TokenTypeHint, j as actor, k as featureFlags, l as hasFeature, m as hasPermission, n as hasRole, o as isSupportSession, p as organization, q as permissions, r as roles, s as sessionId } from './types-CC1bz68x.cjs';
+export { P as PermissionDecision, a as PermissionDecisionConfig, c as checkPermissions } from './decisions-DNd9UXwi.cjs';
 
 /**
  * The handler on YOUR side of a legacy migration.
@@ -130,9 +131,35 @@ interface FrontendConfig {
         end_session: string;
         jwks: string;
     };
+    /**
+     * The social buttons to draw, exactly as the hosted sign-in page would: the environment's
+     * own providers, or — with `config({ organization })` — that organization's.
+     */
     social: SocialProvider[];
     appearance?: Appearance;
+    /**
+     * Which other sign-in methods are switched on, so a box does not draw a button whose
+     * endpoint answers 403. Absent from instances that predate it.
+     */
+    methods?: {
+        passkeys: boolean;
+        magic_link: boolean;
+    };
+}
+/** Options for {@link CboxIdFrontend.config}. */
+interface FrontendConfigOptions {
+    /**
+     * The organization the box is for, by id or slug — the way a hosted page is addressed.
+     * `social` is then exactly what that organization's sign-in page offers. An organization
+     * the environment does not have is answered as no hint at all.
+     */
+    organization?: string;
 }
+/**
+ * A second factor the person can answer an `mfa_required` with. Kinds only — the server
+ * never says which number a text would go to before one is sent.
+ */
+type SecondFactorKind = 'totp' | 'sms' | 'recovery_code';
 /** What a sign-in attempt produced. */
 type SignInResult = {
     status: 'ok';
@@ -141,6 +168,11 @@ type SignInResult = {
 } | {
     status: 'mfa_required';
     mfaToken: string;
+    /**
+     * The factors this person can answer with (laravel-id 1.24+). Absent when the
+     * instance predates the list — then only an authenticator or a recovery code works.
+     */
+    factors?: SecondFactorKind[];
 } | {
     status: 'otp_required';
     mfaToken: string;
@@ -152,6 +184,30 @@ type SignInResult = {
     status: 'rate_limited';
     retryAfter: number | undefined;
 };
+/** What asking for a texted sign-in code produced. */
+type SmsCodeResult = 
+/** Sent. `to` is the number masked (`+45 ******78`); the code lasts `expiresIn` seconds. */
+{
+    status: 'sent';
+    to: string;
+    expiresIn: number;
+}
+/** Too soon, or a sending limit was hit. Waiting `retryAfter` seconds may help. */
+ | {
+    status: 'rate_limited';
+    retryAfter: number | undefined;
+}
+/** The text provider failed. Try again shortly, or offer another factor. */
+ | {
+    status: 'unavailable';
+}
+/**
+ * Refused: an unknown or spent token, no number on file, a country texts are not sent
+ * to, or no attempts left. One answer for every reason, like a wrong password.
+ */
+ | {
+    status: 'invalid';
+};
 /** What a browser needs to ask an authenticator for a passkey assertion. */
 interface PasskeyOptions {
     challenge: string;
@@ -197,7 +253,7 @@ declare class CboxIdFrontend {
      * fetches of the same immutable document is a waste the SDK should absorb rather than
      * ask every consumer to.
      */
-    private configPromise;
+    private readonly configPromises;
     constructor(options: FrontendClientOptions);
     /** Whether this key drives real sign-ins. Handy for a "test mode" badge in your own UI. */
     get isLive(): boolean;
@@ -207,8 +263,9 @@ declare class CboxIdFrontend {
      * Fetched once per client instance. The document is small and changes when somebody
      * edits it in the console, so a long-lived page picks changes up on its next full load
      * rather than mid-session — which is the right trade for something that decides layout.
+     * Each `organization` is fetched and cached on its own.
      */
-    config(): Promise<FrontendConfig>;
+    config(options?: FrontendConfigOptions): Promise<FrontendConfig>;
     /**
      * Who is signed in, given an access token your app already holds.
      *
@@ -256,8 +313,29 @@ declare class CboxIdFrontend {
      *
      * A wrong code costs an attempt, not the sign-in: five are allowed before the token
      * dies and the person starts from the password again.
+     *
+     * `method` says which challenge the code answers: `'mfa'` for an authenticator or
+     * recovery code, `'otp'` for an emailed code (`otp_required`), `'sms'` for a code sent
+     * with {@link sendSmsCode}. A texted code is six digits like an authenticator's, so the
+     * server cannot tell them apart by shape — answering one as the other is refused.
+     */
+    submitSecondFactor(mfaToken: string, code: string, method?: 'mfa' | 'otp' | 'sms'): Promise<SignInResult>;
+    /**
+     * Text the person a sign-in code, when `mfa_required` listed `'sms'` in `factors`.
+     * Then finish with `submitSecondFactor(mfaToken, code, 'sms')`.
+     *
+     * Only call it when the person asks ("Text me a code"), never on page load: each send
+     * spends one of the token's five attempts — that is what bounds how many texts one
+     * proved password can cause — and every text costs the customer money.
+     *
+     * ```ts
+     * if (result.status === 'mfa_required' && result.factors?.includes('sms')) {
+     *   const sent = await frontend.sendSmsCode(result.mfaToken)
+     *   if (sent.status === 'sent') showCodeField(`We texted ${sent.to}`)
+     * }
+     * ```
      */
-    submitSecondFactor(mfaToken: string, code: string, method?: 'mfa' | 'otp'): Promise<SignInResult>;
+    sendSmsCode(mfaToken: string): Promise<SmsCodeResult>;
     /**
      * The WebAuthn options for a passkey sign-in, and the handle that carries the challenge.
      *
@@ -442,4 +520,4 @@ declare function buildManifest(declaration: AuthzDeclaration): Promise<AuthzMani
  */
 declare function publishManifest(config: ManifestPublisherConfig, declaration: AuthzDeclaration): Promise<ManifestSyncSummary>;
 
-export { type Appearance, type AuthzDeclaration, type AuthzManifest, CboxIdFrontend, type FrontendClientOptions, type FrontendConfig, type FrontendSession, type LegacyUser, type LegacyVerifierOptions, type ManifestPermission, type ManifestPublisherConfig, type ManifestRole, type ManifestSyncSummary, type PasskeyOptions, type PermissionDefinition, type RoleDefinition, type SignInResult, type SocialProvider, buildManifest, challenge, createLegacyVerifier, createVerifier, defineAuthz, publishManifest, randomToken };
+export { type Appearance, type AuthzDeclaration, type AuthzManifest, CboxIdFrontend, type FrontendClientOptions, type FrontendConfig, type FrontendConfigOptions, type FrontendSession, type LegacyUser, type LegacyVerifierOptions, type ManifestPermission, type ManifestPublisherConfig, type ManifestRole, type ManifestSyncSummary, type PasskeyOptions, type PermissionDefinition, type RoleDefinition, type SecondFactorKind, type SignInResult, type SmsCodeResult, type SocialProvider, buildManifest, challenge, createLegacyVerifier, createVerifier, defineAuthz, publishManifest, randomToken };

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { A as AuthenticationError, C as CboxIdError, a as ConfigurationError, F as FrontendApiError, I as InvalidStateError } from './errors-D61xljZE.js';
-export { a as CallbackParams, C as CboxIdClient, S as StoreSecretInput, b as StoredAuthState, V as VaultClient, c as VaultLease, d as VaultSecretRef, e as VerifyStandardWebhookOptions, f as VerifyWebhookOptions, W as WebhookHeaders, v as verifyStandardWebhook, g as verifyWebhook } from './client-BSZASrMo.js';
-export { c as AuthorizationPrompt, b as AuthorizationRequest, A as AuthorizationRequestOptions, d as CboxActiveOrganization, e as CboxActor, a as CboxIdConfig, f as CboxOrganization, C as CboxUser, g as ClaimSource, D as DeviceAuthorization, h as DiscoveryDocument, O as OrganizationRole, R as RefreshedTokens, i as TokenResponse, T as TokenTypeHint, j as actor, k as hasPermission, l as hasRole, m as isSupportSession, o as organization, p as permissions, r as roles, s as sessionId } from './types-BYZldock.js';
+export { a as CallbackParams, C as CboxIdClient, P as PipeConnectOptions, b as PipeLeaseDeniedError, c as PipeLeaseError, d as PipeNotConnectedError, e as PipeProvider, f as PipeReauthorizationRequiredError, g as PipeTemporarilyUnavailableError, h as PipeToken, S as StoreSecretInput, i as StoredAuthState, V as VaultClient, j as VaultLease, k as VaultSecretRef, l as VerifyStandardWebhookOptions, m as VerifyWebhookOptions, W as WebhookHeaders, p as pipeConnectUrl, v as verifyStandardWebhook, n as verifyWebhook, w as withConnectReturn } from './client-xlEJalu8.js';
+export { c as AuthorizationPrompt, b as AuthorizationRequest, A as AuthorizationRequestOptions, d as CboxActiveOrganization, e as CboxActor, a as CboxIdConfig, f as CboxOrganization, C as CboxUser, g as ClaimSource, D as DeviceAuthorization, h as DiscoveryDocument, F as FEATURE_FLAGS_SCOPE, O as OrganizationRole, R as RefreshedTokens, i as TokenResponse, T as TokenTypeHint, j as actor, k as featureFlags, l as hasFeature, m as hasPermission, n as hasRole, o as isSupportSession, p as organization, q as permissions, r as roles, s as sessionId } from './types-CC1bz68x.js';
+export { P as PermissionDecision, a as PermissionDecisionConfig, c as checkPermissions } from './decisions-C84Fzah4.js';
 
 /**
  * The handler on YOUR side of a legacy migration.
@@ -130,9 +131,35 @@ interface FrontendConfig {
         end_session: string;
         jwks: string;
     };
+    /**
+     * The social buttons to draw, exactly as the hosted sign-in page would: the environment's
+     * own providers, or — with `config({ organization })` — that organization's.
+     */
     social: SocialProvider[];
     appearance?: Appearance;
+    /**
+     * Which other sign-in methods are switched on, so a box does not draw a button whose
+     * endpoint answers 403. Absent from instances that predate it.
+     */
+    methods?: {
+        passkeys: boolean;
+        magic_link: boolean;
+    };
+}
+/** Options for {@link CboxIdFrontend.config}. */
+interface FrontendConfigOptions {
+    /**
+     * The organization the box is for, by id or slug — the way a hosted page is addressed.
+     * `social` is then exactly what that organization's sign-in page offers. An organization
+     * the environment does not have is answered as no hint at all.
+     */
+    organization?: string;
 }
+/**
+ * A second factor the person can answer an `mfa_required` with. Kinds only — the server
+ * never says which number a text would go to before one is sent.
+ */
+type SecondFactorKind = 'totp' | 'sms' | 'recovery_code';
 /** What a sign-in attempt produced. */
 type SignInResult = {
     status: 'ok';
@@ -141,6 +168,11 @@ type SignInResult = {
 } | {
     status: 'mfa_required';
     mfaToken: string;
+    /**
+     * The factors this person can answer with (laravel-id 1.24+). Absent when the
+     * instance predates the list — then only an authenticator or a recovery code works.
+     */
+    factors?: SecondFactorKind[];
 } | {
     status: 'otp_required';
     mfaToken: string;
@@ -152,6 +184,30 @@ type SignInResult = {
     status: 'rate_limited';
     retryAfter: number | undefined;
 };
+/** What asking for a texted sign-in code produced. */
+type SmsCodeResult = 
+/** Sent. `to` is the number masked (`+45 ******78`); the code lasts `expiresIn` seconds. */
+{
+    status: 'sent';
+    to: string;
+    expiresIn: number;
+}
+/** Too soon, or a sending limit was hit. Waiting `retryAfter` seconds may help. */
+ | {
+    status: 'rate_limited';
+    retryAfter: number | undefined;
+}
+/** The text provider failed. Try again shortly, or offer another factor. */
+ | {
+    status: 'unavailable';
+}
+/**
+ * Refused: an unknown or spent token, no number on file, a country texts are not sent
+ * to, or no attempts left. One answer for every reason, like a wrong password.
+ */
+ | {
+    status: 'invalid';
+};
 /** What a browser needs to ask an authenticator for a passkey assertion. */
 interface PasskeyOptions {
     challenge: string;
@@ -197,7 +253,7 @@ declare class CboxIdFrontend {
      * fetches of the same immutable document is a waste the SDK should absorb rather than
      * ask every consumer to.
      */
-    private configPromise;
+    private readonly configPromises;
     constructor(options: FrontendClientOptions);
     /** Whether this key drives real sign-ins. Handy for a "test mode" badge in your own UI. */
     get isLive(): boolean;
@@ -207,8 +263,9 @@ declare class CboxIdFrontend {
      * Fetched once per client instance. The document is small and changes when somebody
      * edits it in the console, so a long-lived page picks changes up on its next full load
      * rather than mid-session — which is the right trade for something that decides layout.
+     * Each `organization` is fetched and cached on its own.
      */
-    config(): Promise<FrontendConfig>;
+    config(options?: FrontendConfigOptions): Promise<FrontendConfig>;
     /**
      * Who is signed in, given an access token your app already holds.
      *
@@ -256,8 +313,29 @@ declare class CboxIdFrontend {
      *
      * A wrong code costs an attempt, not the sign-in: five are allowed before the token
      * dies and the person starts from the password again.
+     *
+     * `method` says which challenge the code answers: `'mfa'` for an authenticator or
+     * recovery code, `'otp'` for an emailed code (`otp_required`), `'sms'` for a code sent
+     * with {@link sendSmsCode}. A texted code is six digits like an authenticator's, so the
+     * server cannot tell them apart by shape — answering one as the other is refused.
+     */
+    submitSecondFactor(mfaToken: string, code: string, method?: 'mfa' | 'otp' | 'sms'): Promise<SignInResult>;
+    /**
+     * Text the person a sign-in code, when `mfa_required` listed `'sms'` in `factors`.
+     * Then finish with `submitSecondFactor(mfaToken, code, 'sms')`.
+     *
+     * Only call it when the person asks ("Text me a code"), never on page load: each send
+     * spends one of the token's five attempts — that is what bounds how many texts one
+     * proved password can cause — and every text costs the customer money.
+     *
+     * ```ts
+     * if (result.status === 'mfa_required' && result.factors?.includes('sms')) {
+     *   const sent = await frontend.sendSmsCode(result.mfaToken)
+     *   if (sent.status === 'sent') showCodeField(`We texted ${sent.to}`)
+     * }
+     * ```
      */
-    submitSecondFactor(mfaToken: string, code: string, method?: 'mfa' | 'otp'): Promise<SignInResult>;
+    sendSmsCode(mfaToken: string): Promise<SmsCodeResult>;
     /**
      * The WebAuthn options for a passkey sign-in, and the handle that carries the challenge.
      *
@@ -442,4 +520,4 @@ declare function buildManifest(declaration: AuthzDeclaration): Promise<AuthzMani
  */
 declare function publishManifest(config: ManifestPublisherConfig, declaration: AuthzDeclaration): Promise<ManifestSyncSummary>;
 
-export { type Appearance, type AuthzDeclaration, type AuthzManifest, CboxIdFrontend, type FrontendClientOptions, type FrontendConfig, type FrontendSession, type LegacyUser, type LegacyVerifierOptions, type ManifestPermission, type ManifestPublisherConfig, type ManifestRole, type ManifestSyncSummary, type PasskeyOptions, type PermissionDefinition, type RoleDefinition, type SignInResult, type SocialProvider, buildManifest, challenge, createLegacyVerifier, createVerifier, defineAuthz, publishManifest, randomToken };
+export { type Appearance, type AuthzDeclaration, type AuthzManifest, CboxIdFrontend, type FrontendClientOptions, type FrontendConfig, type FrontendConfigOptions, type FrontendSession, type LegacyUser, type LegacyVerifierOptions, type ManifestPermission, type ManifestPublisherConfig, type ManifestRole, type ManifestSyncSummary, type PasskeyOptions, type PermissionDefinition, type RoleDefinition, type SecondFactorKind, type SignInResult, type SmsCodeResult, type SocialProvider, buildManifest, challenge, createLegacyVerifier, createVerifier, defineAuthz, publishManifest, randomToken };

package/dist/index.js

@@ -1,5 +1,6 @@
-import { Discovery } from './chunk-CXGKOJRJ.js';
-export { CboxIdClient, VaultClient, actor, challenge, createVerifier, hasPermission, hasRole, isSupportSession, organization, permissions, randomToken, roles, sessionId, verifyStandardWebhook, verifyWebhook } from './chunk-CXGKOJRJ.js';
+import { Discovery } from './chunk-YGLMLIKL.js';
+export { CboxIdClient, FEATURE_FLAGS_SCOPE, PipeLeaseDeniedError, PipeLeaseError, PipeNotConnectedError, PipeReauthorizationRequiredError, PipeTemporarilyUnavailableError, VaultClient, actor, challenge, createVerifier, featureFlags, hasFeature, hasPermission, hasRole, isSupportSession, organization, permissions, pipeConnectUrl, randomToken, roles, sessionId, verifyStandardWebhook, verifyWebhook, withConnectReturn } from './chunk-YGLMLIKL.js';
+export { PermissionDecision, checkPermissions } from './chunk-EVZ6RB3K.js';
 import { assertSecureIssuer } from './chunk-QQW63PGU.js';
 import { ConfigurationError, FrontendApiError, AuthenticationError } from './chunk-SEUD4TE4.js';
 export { AuthenticationError, CboxIdError, ConfigurationError, FrontendApiError, InvalidStateError } from './chunk-SEUD4TE4.js';
@@ -98,6 +99,7 @@ function json(body, status) {
 }
 
 // src/frontend.ts
+var SECOND_FACTOR_KINDS = /* @__PURE__ */ new Set(["totp", "sms", "recovery_code"]);
 var CboxIdFrontend = class {
   issuer;
   publishableKey;
@@ -112,7 +114,7 @@ var CboxIdFrontend = class {
    * fetches of the same immutable document is a waste the SDK should absorb rather than
    * ask every consumer to.
    */
-  configPromise = null;
+  configPromises = /* @__PURE__ */ new Map();
   constructor(options) {
     if (!options.issuer) {
       throw new ConfigurationError("issuer is required.");
@@ -139,13 +141,20 @@ var CboxIdFrontend = class {
    * Fetched once per client instance. The document is small and changes when somebody
    * edits it in the console, so a long-lived page picks changes up on its next full load
    * rather than mid-session — which is the right trade for something that decides layout.
+   * Each `organization` is fetched and cached on its own.
    */
-  async config() {
-    this.configPromise ??= this.get("/frontend/v1/config", {}, isFrontendConfig).catch((error) => {
-      this.configPromise = null;
-      throw error;
-    });
-    return this.configPromise;
+  async config(options = {}) {
+    const organization2 = options.organization ?? "";
+    let pending = this.configPromises.get(organization2);
+    if (pending === void 0) {
+      const path = organization2 === "" ? "/frontend/v1/config" : `/frontend/v1/config?${new URLSearchParams({ organization: organization2 }).toString()}`;
+      pending = this.get(path, {}, isFrontendConfig).catch((error) => {
+        this.configPromises.delete(organization2);
+        throw error;
+      });
+      this.configPromises.set(organization2, pending);
+    }
+    return pending;
   }
   /**
    * Who is signed in, given an access token your app already holds.
@@ -207,8 +216,12 @@ var CboxIdFrontend = class {
     if (body.status === "ok" && typeof body.login_ticket === "string") {
       return { status: "ok", loginTicket: body.login_ticket, expiresIn: body.expires_in ?? 60 };
     }
-    if ((body.status === "mfa_required" || body.status === "otp_required") && typeof body.mfa_token === "string") {
-      return { status: body.status, mfaToken: body.mfa_token };
+    if (body.status === "mfa_required" && typeof body.mfa_token === "string") {
+      const factors = Array.isArray(body.factors) ? body.factors.filter((f) => typeof f === "string" && SECOND_FACTOR_KINDS.has(f)) : void 0;
+      return { status: "mfa_required", mfaToken: body.mfa_token, ...factors ? { factors } : {} };
+    }
+    if (body.status === "otp_required" && typeof body.mfa_token === "string") {
+      return { status: "otp_required", mfaToken: body.mfa_token };
     }
     if (body.status === "sso_required") {
       return { status: "sso_required" };
@@ -225,6 +238,11 @@ var CboxIdFrontend = class {
    *
    * A wrong code costs an attempt, not the sign-in: five are allowed before the token
    * dies and the person starts from the password again.
+   *
+   * `method` says which challenge the code answers: `'mfa'` for an authenticator or
+   * recovery code, `'otp'` for an emailed code (`otp_required`), `'sms'` for a code sent
+   * with {@link sendSmsCode}. A texted code is six digits like an authenticator's, so the
+   * server cannot tell them apart by shape — answering one as the other is refused.
    */
   async submitSecondFactor(mfaToken, code, method = "mfa") {
     const response = await this.post("/frontend/v1/sign-in/factor", { mfa_token: mfaToken, code, method });
@@ -236,6 +254,41 @@ var CboxIdFrontend = class {
     }
     return body.status === "ok" && typeof body.login_ticket === "string" ? { status: "ok", loginTicket: body.login_ticket, expiresIn: body.expires_in ?? 60 } : { status: "invalid" };
   }
+  /**
+   * Text the person a sign-in code, when `mfa_required` listed `'sms'` in `factors`.
+   * Then finish with `submitSecondFactor(mfaToken, code, 'sms')`.
+   *
+   * Only call it when the person asks ("Text me a code"), never on page load: each send
+   * spends one of the token's five attempts — that is what bounds how many texts one
+   * proved password can cause — and every text costs the customer money.
+   *
+   * ```ts
+   * if (result.status === 'mfa_required' && result.factors?.includes('sms')) {
+   *   const sent = await frontend.sendSmsCode(result.mfaToken)
+   *   if (sent.status === 'sent') showCodeField(`We texted ${sent.to}`)
+   * }
+   * ```
+   */
+  async sendSmsCode(mfaToken) {
+    const response = await this.post("/frontend/v1/sign-in/factor/sms", { mfa_token: mfaToken });
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new FrontendApiError("Cbox ID returned a body that is not JSON.", "malformed", response.status);
+    }
+    if (body.status === "sent" && typeof body.to === "string") {
+      return { status: "sent", to: body.to, expiresIn: typeof body.expires_in === "number" ? body.expires_in : 300 };
+    }
+    if (body.status === "rate_limited" || response.status === 429) {
+      const retryAfter = typeof body.retry_after === "number" ? body.retry_after : Number(response.headers.get("Retry-After") ?? "");
+      return { status: "rate_limited", retryAfter: Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter : void 0 };
+    }
+    if (body.status === "unavailable") {
+      return { status: "unavailable" };
+    }
+    return { status: "invalid" };
+  }
   /**
    * The WebAuthn options for a passkey sign-in, and the handle that carries the challenge.
    *
@@ -435,6 +488,11 @@ async function publishManifest(config, declaration) {
     throw new ConfigurationError("Publishing a manifest needs issuer, clientId and clientSecret.");
   }
   const timeoutMs = config.timeoutMs ?? 1e4;
+  assertSecureIssuer(config.issuer);
+  const issuer = new URL(config.issuer);
+  if (issuer.username || issuer.password || issuer.search || issuer.hash) {
+    throw new ConfigurationError("The manifest issuer must not contain credentials, a query or a fragment.");
+  }
   const manifest = await buildManifest(declaration);
   const discovery = new Discovery(config.issuer, timeoutMs, 36e5);
   const token = await mintToken(config, discovery, timeoutMs);
@@ -442,6 +500,7 @@ async function publishManifest(config, declaration) {
     `${config.issuer.replace(/\/$/, "")}/api/v1/apps/manifest`,
     {
       method: "POST",
+      redirect: "error",
       headers: {
         authorization: `Bearer ${token}`,
         accept: "application/json",
@@ -452,10 +511,20 @@ async function publishManifest(config, declaration) {
     timeoutMs
   );
   if (!response.ok) {
-    throw new AuthenticationError(`Manifest push failed: HTTP ${response.status} ${await response.text()}`);
+    throw new AuthenticationError(`Manifest push failed: HTTP ${response.status}`);
+  }
+  const json2 = await response.json().catch(() => {
+    throw new AuthenticationError("Cbox ID returned an invalid manifest acknowledgement.");
+  });
+  const checksum = await sha256Hex(canonicalManifestJson(declaration.permissions ?? [], declaration.roles ?? []));
+  if (json2 === null || typeof json2 !== "object" || Array.isArray(json2)) {
+    throw new AuthenticationError("Cbox ID did not acknowledge the authorization manifest.");
+  }
+  const summary = json2;
+  if (summary.client_id !== config.clientId || summary.version !== manifest.version || summary.checksum !== checksum || typeof summary.unchanged !== "boolean" || !Number.isInteger(summary.roles_declared) || !Number.isInteger(summary.permissions_declared) || (summary.roles_declared ?? -1) < 0 || (summary.permissions_declared ?? -1) < 0 || !summary.unchanged && (summary.roles_declared !== manifest.roles.length || summary.permissions_declared !== manifest.permissions.length)) {
+    throw new AuthenticationError("Cbox ID did not acknowledge this app and its complete authorization manifest.");
   }
-  const json2 = await response.json();
-  return json2 !== null && typeof json2 === "object" ? json2 : {};
+  return summary;
 }
 async function mintToken(config, discovery, timeoutMs) {
   const response = await fetchWithTimeout(
@@ -463,6 +532,7 @@ async function mintToken(config, discovery, timeoutMs) {
     {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
+      redirect: "error",
       body: new URLSearchParams({
         grant_type: "client_credentials",
         client_id: config.clientId,
@@ -473,7 +543,7 @@ async function mintToken(config, discovery, timeoutMs) {
     timeoutMs
   );
   const json2 = await response.json().catch(() => ({}));
-  if (typeof json2.access_token !== "string" || json2.access_token === "") {
+  if (!response.ok || typeof json2.access_token !== "string" || json2.access_token === "") {
     throw new AuthenticationError(
       "Could not obtain an apps.manifest access token \u2014 check the client credentials and that the client holds the apps.manifest scope."
     );
@@ -595,6 +665,8 @@ async function fetchWithTimeout(url, init, timeoutMs) {
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
     return await fetch(url, { ...init, signal: controller.signal });
+  } catch {
+    throw new AuthenticationError("Cbox ID manifest publication could not be verified.");
   } finally {
     clearTimeout(timer);
   }