@cplieger/access 0.0.0-stage → 1.0.0-dev.10

package/src/client.ts

@@ -0,0 +1,351 @@
+import type {
+  ApiResult,
+  FetchInstance,
+  HttpMethod,
+  RequestOptions,
+} from "@cplieger/reactive/fetch";
+import {
+  list,
+  parseCeremonyResponse,
+  parseKeyCreatedResponse,
+  parseKeyView,
+  parseMeResponse,
+  parseOIDCStartResponse,
+  parsePasskeyView,
+  parsePendingLinkResponse,
+  parseRecoveryResponse,
+  parseSecurityLogView,
+  parseSessionView,
+  parseSignedInResponse,
+  parseStateResponse,
+  parseTokenResponse,
+  parseTokenView,
+  parseUserView,
+  parseWebAuthnSignals,
+} from "./wire.js";
+import type {
+  CeremonyResponse,
+  InviteAcceptRequest,
+  InviteRequest,
+  KeyCreatedResponse,
+  KeyView,
+  LoginRequest,
+  MeResponse,
+  NameRequest,
+  NewKeyRequest,
+  NewUserRequest,
+  OIDCStartResponse,
+  PasskeyView,
+  PasswordChangeRequest,
+  PasswordRemoveRequest,
+  PasswordRequest,
+  PendingLinkResponse,
+  ProfileRequest,
+  RecoverPasswordRequest,
+  RecoveryResponse,
+  RedirectRequest,
+  SecurityLogView,
+  SessionView,
+  SetupPasskeyBeginRequest,
+  SetupPasswordRequest,
+  SignedInResponse,
+  StateResponse,
+  TTLRequest,
+  TokenRequest,
+  TokenResponse,
+  TokenView,
+  UserUpdateRequest,
+  UserView,
+  Validator,
+  WebAuthnSignals,
+} from "./wire.js";
+
+export interface AuthClientOptions {
+  /** The app's instance: its credentials mode, base URL and error hook apply to every call. */
+  readonly fetch: FetchInstance;
+  /** accesshttp.Config.Prefix. */
+  readonly prefix: string;
+  /** accesshttp.Config.OIDCPrefix. */
+  readonly oidcPrefix: string;
+}
+
+/**
+ * A finish route's body as the ceremonies build it: clientExtensionResults carries only an output
+ * the begin options requested (credProps on the create leg), because go-webauthn refuses any other.
+ */
+export type PublicKeyCredentialJSON =
+  | {
+      readonly id: string;
+      readonly rawId: string;
+      readonly type: string;
+      readonly authenticatorAttachment?: string;
+      readonly response: {
+        readonly attestationObject: string;
+        readonly clientDataJSON: string;
+        readonly transports?: readonly string[];
+      };
+      readonly clientExtensionResults: { readonly credProps?: { readonly rk?: boolean } };
+    }
+  | {
+      readonly id: string;
+      readonly rawId: string;
+      readonly type: string;
+      readonly authenticatorAttachment?: string;
+      readonly response: {
+        readonly authenticatorData: string;
+        readonly clientDataJSON: string;
+        readonly signature: string;
+        readonly userHandle?: string;
+      };
+      readonly clientExtensionResults: { readonly credProps?: { readonly rk?: boolean } };
+    };
+
+export interface RecoverFlags {
+  readonly keepSessions: boolean;
+  readonly keepKeys: boolean;
+}
+
+/**
+ * One method per JSON route of accesshttp, each decoded through wire.ts: a 2xx body that is not
+ * the route's type is the fetch instance's "decode" failure. The two redirect routes are
+ * navigations, built by oidcSignInURL.
+ */
+export interface AuthClient {
+  readonly prefix: string;
+  readonly oidcPrefix: string;
+  state(): Promise<ApiResult<StateResponse>>;
+  setupPassword(r: SetupPasswordRequest): Promise<ApiResult<SignedInResponse>>;
+  setupPasskeyBegin(r: SetupPasskeyBeginRequest): Promise<ApiResult<CeremonyResponse>>;
+  setupPasskeyFinish(
+    ceremony: string,
+    credential: PublicKeyCredentialJSON,
+  ): Promise<ApiResult<SignedInResponse>>;
+  loginPassword(r: LoginRequest): Promise<ApiResult<SignedInResponse>>;
+  loginPasskeyBegin(o?: {
+    readonly mediation?: "conditional";
+  }): Promise<ApiResult<CeremonyResponse>>;
+  loginPasskeyFinish(
+    ceremony: string,
+    credential: PublicKeyCredentialJSON,
+  ): Promise<ApiResult<SignedInResponse>>;
+  logout(): Promise<ApiResult<void>>;
+  oidcStartLink(r: RedirectRequest): Promise<ApiResult<OIDCStartResponse>>;
+  oidcStartStepUp(r: RedirectRequest): Promise<ApiResult<OIDCStartResponse>>;
+  oidcPending(): Promise<ApiResult<PendingLinkResponse>>;
+  oidcLinkPending(): Promise<ApiResult<MeResponse>>;
+  oidcUnlink(): Promise<ApiResult<void>>;
+  recoveryStart(r: TokenRequest): Promise<ApiResult<RecoveryResponse>>;
+  recoveryPassword(r: RecoverPasswordRequest): Promise<ApiResult<void>>;
+  recoveryPasskeyBegin(): Promise<ApiResult<CeremonyResponse>>;
+  recoveryPasskeyFinish(
+    ceremony: string,
+    credential: PublicKeyCredentialJSON,
+    o: RecoverFlags,
+  ): Promise<ApiResult<void>>;
+  inviteAcceptPassword(r: InviteAcceptRequest): Promise<ApiResult<SignedInResponse>>;
+  me(): Promise<ApiResult<MeResponse>>;
+  updateProfile(r: ProfileRequest): Promise<ApiResult<MeResponse>>;
+  reenableMethod(method: string): Promise<ApiResult<void>>;
+  stepUpPassword(r: PasswordRequest): Promise<ApiResult<void>>;
+  stepUpPasskeyBegin(): Promise<ApiResult<CeremonyResponse>>;
+  stepUpPasskeyFinish(
+    ceremony: string,
+    credential: PublicKeyCredentialJSON,
+  ): Promise<ApiResult<void>>;
+  setPassword(r: PasswordChangeRequest): Promise<ApiResult<void>>;
+  removePassword(r: PasswordRemoveRequest): Promise<ApiResult<void>>;
+  passkeys(): Promise<ApiResult<readonly PasskeyView[]>>;
+  passkeyRegisterBegin(): Promise<ApiResult<CeremonyResponse>>;
+  passkeyRegisterFinish(
+    ceremony: string,
+    credential: PublicKeyCredentialJSON,
+  ): Promise<ApiResult<PasskeyView>>;
+  renamePasskey(id: number, r: NameRequest): Promise<ApiResult<void>>;
+  removePasskey(id: number): Promise<ApiResult<void>>;
+  webauthnSignals(): Promise<ApiResult<WebAuthnSignals>>;
+  sessions(): Promise<ApiResult<readonly SessionView[]>>;
+  renameSession(id: string, r: NameRequest): Promise<ApiResult<void>>;
+  revokeSession(id: string): Promise<ApiResult<void>>;
+  revokeOtherSessions(): Promise<ApiResult<void>>;
+  keys(): Promise<ApiResult<readonly KeyView[]>>;
+  createKey(r: NewKeyRequest): Promise<ApiResult<KeyCreatedResponse>>;
+  revokeKey(id: number): Promise<ApiResult<void>>;
+  /** key lists the users any key in that key's lineage acted on (GET /users?key=). */
+  adminUsers(o?: { readonly key?: number }): Promise<ApiResult<readonly UserView[]>>;
+  adminCreateUser(r: NewUserRequest): Promise<ApiResult<UserView>>;
+  adminUpdateUser(id: number, r: UserUpdateRequest): Promise<ApiResult<UserView>>;
+  adminDeleteUser(id: number): Promise<ApiResult<void>>;
+  adminIssueRecovery(id: number, r: TTLRequest): Promise<ApiResult<TokenResponse>>;
+  adminInvite(r: InviteRequest): Promise<ApiResult<TokenResponse>>;
+  adminTokens(): Promise<ApiResult<readonly TokenView[]>>;
+  adminKeys(): Promise<ApiResult<readonly KeyView[]>>;
+  adminRevokeKey(id: number): Promise<ApiResult<void>>;
+  /**
+   * Newest first, or oldest first when oldestFirst is true; after and before are bounds only.
+   * kinds empty or absent is every kind.
+   */
+  adminSecurityLog(q?: {
+    readonly user?: number;
+    readonly actor?: number;
+    readonly actorKey?: number;
+    readonly after?: number;
+    readonly before?: number;
+    readonly kinds?: readonly string[];
+    readonly limit?: number;
+    readonly oldestFirst?: boolean;
+  }): Promise<ApiResult<SecurityLogView>>;
+}
+
+// The fetch instance's decoder contract is to throw on a mismatch, which it turns into a
+// "decode" failure; a wire.ts validator answers undefined instead.
+function decoder<T>(validate: Validator<T>): (v: unknown) => T {
+  return (v) => {
+    const out = validate(v);
+    if (out === undefined) {
+      throw new TypeError("response body is not the route's wire type");
+    }
+    return out;
+  };
+}
+
+function query(params: Readonly<Record<string, string | undefined>>): string {
+  const q = new URLSearchParams();
+  for (const [k, v] of Object.entries(params)) {
+    if (v !== undefined) {
+      q.set(k, v);
+    }
+  }
+  const s = q.toString();
+  return s === "" ? "" : `?${s}`;
+}
+
+const seg = encodeURIComponent;
+const num = (n: number | undefined): string | undefined =>
+  n === undefined ? undefined : String(n);
+
+export function createAuthClient(opts: AuthClientOptions): AuthClient {
+  const { fetch: f, prefix, oidcPrefix } = opts;
+
+  function json<T>(
+    method: HttpMethod,
+    path: string,
+    validate: Validator<T>,
+    o: RequestOptions<T> = {},
+  ): Promise<ApiResult<T>> {
+    return f.requestRaw<T>(method, path, { ...o, decoder: decoder(validate) });
+  }
+  function empty(method: HttpMethod, path: string, body?: unknown): Promise<ApiResult<void>> {
+    return f.requestRaw<undefined>(method, path, {
+      ignoreBody: true,
+      ...(body === undefined ? {} : { body }),
+    });
+  }
+  function finish(
+    ceremony: string,
+    credential: PublicKeyCredentialJSON,
+  ): { readonly body: unknown; readonly headers: Readonly<Record<string, string>> } {
+    return { body: credential, headers: { "X-Auth-Ceremony": ceremony } };
+  }
+  const p = (path: string): string => prefix + path;
+  const o = (path: string): string => oidcPrefix + path;
+  const passkeyList = list(parsePasskeyView);
+  const sessionList = list(parseSessionView);
+  const keyList = list(parseKeyView);
+  const userList = list(parseUserView);
+  const tokenList = list(parseTokenView);
+
+  return {
+    prefix,
+    oidcPrefix,
+    state: () => json("GET", p("/state"), parseStateResponse),
+    setupPassword: (r) => json("POST", p("/setup/password"), parseSignedInResponse, { body: r }),
+    setupPasskeyBegin: (r) =>
+      json("POST", p("/setup/passkey/begin"), parseCeremonyResponse, { body: r }),
+    setupPasskeyFinish: (c, cred) =>
+      json("POST", p("/setup/passkey/finish"), parseSignedInResponse, finish(c, cred)),
+    loginPassword: (r) => json("POST", p("/login/password"), parseSignedInResponse, { body: r }),
+    loginPasskeyBegin: (q) =>
+      json(
+        "POST",
+        p(`/login/passkey/begin${query({ mediation: q?.mediation })}`),
+        parseCeremonyResponse,
+      ),
+    loginPasskeyFinish: (c, cred) =>
+      json("POST", p("/login/passkey/finish"), parseSignedInResponse, finish(c, cred)),
+    logout: () => empty("POST", p("/logout")),
+    oidcStartLink: (r) => json("POST", o("/start/link"), parseOIDCStartResponse, { body: r }),
+    oidcStartStepUp: (r) => json("POST", o("/start/stepup"), parseOIDCStartResponse, { body: r }),
+    oidcPending: () => json("GET", p("/oidc/pending"), parsePendingLinkResponse),
+    oidcLinkPending: () => json("POST", p("/oidc/link"), parseMeResponse),
+    oidcUnlink: () => empty("DELETE", p("/oidc/link")),
+    recoveryStart: (r) => json("POST", p("/recovery"), parseRecoveryResponse, { body: r }),
+    recoveryPassword: (r) => empty("POST", p("/recovery/password"), r),
+    recoveryPasskeyBegin: () => json("POST", p("/recovery/passkey/begin"), parseCeremonyResponse),
+    recoveryPasskeyFinish: (c, cred, flags) =>
+      f.requestRaw<undefined>(
+        "POST",
+        p(
+          `/recovery/passkey/finish${query({
+            keep_sessions: flags.keepSessions ? "true" : undefined,
+            keep_keys: flags.keepKeys ? "true" : undefined,
+          })}`,
+        ),
+        { ...finish(c, cred), ignoreBody: true },
+      ),
+    inviteAcceptPassword: (r) =>
+      json("POST", p("/invite/password"), parseSignedInResponse, { body: r }),
+    me: () => json("GET", p("/me"), parseMeResponse),
+    updateProfile: (r) => json("PUT", p("/profile"), parseMeResponse, { body: r }),
+    reenableMethod: (m) => empty("POST", p(`/methods/${seg(m)}/reenable`)),
+    stepUpPassword: (r) => empty("POST", p("/stepup/password"), r),
+    stepUpPasskeyBegin: () => json("POST", p("/stepup/passkey/begin"), parseCeremonyResponse),
+    stepUpPasskeyFinish: (c, cred) =>
+      f.requestRaw<undefined>("POST", p("/stepup/passkey/finish"), {
+        ...finish(c, cred),
+        ignoreBody: true,
+      }),
+    setPassword: (r) => empty("PUT", p("/password"), r),
+    removePassword: (r) => empty("DELETE", p("/password"), r),
+    passkeys: () => json("GET", p("/passkeys"), passkeyList),
+    passkeyRegisterBegin: () => json("POST", p("/passkeys/begin"), parseCeremonyResponse),
+    passkeyRegisterFinish: (c, cred) =>
+      json("POST", p("/passkeys/finish"), parsePasskeyView, finish(c, cred)),
+    renamePasskey: (id, r) => empty("PUT", p(`/passkeys/${String(id)}`), r),
+    removePasskey: (id) => empty("DELETE", p(`/passkeys/${String(id)}`)),
+    webauthnSignals: () => json("GET", p("/webauthn/signals"), parseWebAuthnSignals),
+    sessions: () => json("GET", p("/sessions"), sessionList),
+    renameSession: (id, r) => empty("PUT", p(`/sessions/${seg(id)}`), r),
+    revokeSession: (id) => empty("DELETE", p(`/sessions/${seg(id)}`)),
+    revokeOtherSessions: () => empty("POST", p("/sessions/revoke-others")),
+    keys: () => json("GET", p("/apikeys"), keyList),
+    createKey: (r) => json("POST", p("/apikeys"), parseKeyCreatedResponse, { body: r }),
+    revokeKey: (id) => empty("DELETE", p(`/apikeys/${String(id)}`)),
+    adminUsers: (q) => json("GET", p(`/users${query({ key: num(q?.key) })}`), userList),
+    adminCreateUser: (r) => json("POST", p("/users"), parseUserView, { body: r }),
+    adminUpdateUser: (id, r) => json("PUT", p(`/users/${String(id)}`), parseUserView, { body: r }),
+    adminDeleteUser: (id) => empty("DELETE", p(`/users/${String(id)}`)),
+    adminIssueRecovery: (id, r) =>
+      json("POST", p(`/users/${String(id)}/recovery`), parseTokenResponse, { body: r }),
+    adminInvite: (r) => json("POST", p("/invites"), parseTokenResponse, { body: r }),
+    adminTokens: () => json("GET", p("/tokens"), tokenList),
+    adminKeys: () => json("GET", p("/admin/apikeys"), keyList),
+    adminRevokeKey: (id) => empty("DELETE", p(`/admin/apikeys/${String(id)}`)),
+    adminSecurityLog: (q) =>
+      json(
+        "GET",
+        p(
+          `/security-log${query({
+            user: num(q?.user),
+            actor: num(q?.actor),
+            actor_key: num(q?.actorKey),
+            after: num(q?.after),
+            before: num(q?.before),
+            kinds: q?.kinds === undefined || q.kinds.length === 0 ? undefined : q.kinds.join(","),
+            limit: num(q?.limit),
+            oldest_first: q?.oldestFirst === true ? "true" : undefined,
+          })}`,
+        ),
+        parseSecurityLogView,
+      ),
+  };
+}

package/src/continuation.ts

@@ -0,0 +1,174 @@
+import { readOIDCReturn } from "./oidc.js";
+
+const PREFIX = "@cplieger/access:continue:";
+const NONCE = /^[A-Za-z0-9_-]{22}$/;
+
+function storage(): Storage | undefined {
+  try {
+    return (globalThis as { readonly sessionStorage?: Storage }).sessionStorage;
+  } catch {
+    // The getter itself throws SecurityError where storage is blocked
+    // (https://html.spec.whatwg.org/multipage/webstorage.html#dom-sessionstorage).
+    return undefined;
+  }
+}
+
+function nonce(): string {
+  const b = crypto.getRandomValues(new Uint8Array(16));
+  return btoa(String.fromCharCode(...b))
+    .replaceAll("+", "-")
+    .replaceAll("/", "_")
+    .replace(/=+$/, "");
+}
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+// Undefined for an entry this module did not write.
+function entry(raw: string | null): { readonly exp: number; readonly v: unknown } | undefined {
+  if (raw === null) {
+    return undefined;
+  }
+  let e: unknown;
+  try {
+    e = JSON.parse(raw);
+  } catch {
+    return undefined;
+  }
+  if (!isRecord(e) || typeof e["exp"] !== "number" || !Object.hasOwn(e, "v")) {
+    return undefined;
+  }
+  return { exp: e["exp"], v: e["v"] };
+}
+
+function dropExpired(s: Storage, now: number): void {
+  const keys: string[] = [];
+  for (let i = 0; i < s.length; i++) {
+    const k = s.key(i);
+    if (k?.startsWith(PREFIX) === true) {
+      keys.push(k);
+    }
+  }
+  for (const k of keys) {
+    const e = entry(s.getItem(k));
+    if (e === undefined || now > e.exp) {
+      s.removeItem(k);
+    }
+  }
+}
+
+/** The same-origin half of an OIDC step-up's continuation, kept per tab in sessionStorage. */
+export const continuation: {
+  /**
+   * Stores value (JSON-serialisable) under a fresh 128-bit base64url nonce for at most
+   * maxAgeMs, and returns the nonce, which the app puts in its startOIDC redirect as
+   * continue=<nonce>. Throws, storing nothing, unless maxAgeMs is a finite number greater than
+   * 0 and JSON.stringify can serialise value.
+   */
+  put(value: unknown, maxAgeMs: number): string;
+  /**
+   * Reads search (location.search). Returns the stored value once, only when the oidc marker
+   * is stepped_up and continue names a known, unspent, unexpired nonce; otherwise undefined.
+   * Every call that names a nonce spends it, whatever it returns, and drops every expired
+   * entry.
+   */
+  take(search: string): unknown;
+} = {
+  put(value, maxAgeMs) {
+    if (!(Number.isFinite(maxAgeMs) && maxAgeMs > 0)) {
+      throw new RangeError("continuation.put: maxAgeMs must be a finite number above 0");
+    }
+    if ((JSON.stringify(value) as string | undefined) === undefined) {
+      throw new TypeError("continuation.put: value has no JSON form");
+    }
+    const record = JSON.stringify({ v: value, exp: Date.now() + maxAgeMs });
+    const s = storage();
+    if (s === undefined) {
+      throw new Error("continuation.put: sessionStorage is unavailable");
+    }
+    const n = nonce();
+    s.setItem(PREFIX + n, record);
+    return n;
+  },
+
+  take(search) {
+    const s = storage();
+    if (s === undefined) {
+      return undefined;
+    }
+    const now = Date.now();
+    const named = new URLSearchParams(search).getAll("continue");
+    const found = named.map((n) => {
+      const k = PREFIX + n;
+      const e = entry(s.getItem(k));
+      s.removeItem(k);
+      return e;
+    });
+    dropExpired(s, now);
+    const [only] = named;
+    const [e] = found;
+    if (
+      named.length !== 1 ||
+      only === undefined ||
+      !NONCE.test(only) ||
+      e === undefined ||
+      now > e.exp ||
+      readOIDCReturn(search).kind !== "stepped_up"
+    ) {
+      return undefined;
+    }
+    return e.v;
+  },
+};
+
+function utf8Length(s: string): number {
+  return new TextEncoder().encode(s).length;
+}
+
+function decode(s: string): string | undefined {
+  try {
+    return decodeURIComponent(s);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Reads name from location.hash's key=value pairs, removes every pair named name with
+ * history.replaceState (and the "#" when none is left), and returns the value when name
+ * appears exactly once and its value is non-empty and at most maxBytes UTF-8 bytes; otherwise
+ * undefined. The pairs are removed in every case, so no token stays in the URL or in this
+ * history entry; an entry the browser recorded elsewhere before the call is out of its reach.
+ */
+export function takeFragmentToken(name: string, maxBytes = 512): string | undefined {
+  const hash = globalThis.location.hash;
+  if (hash.length <= 1) {
+    return undefined;
+  }
+  const pairs = hash.slice(1).split("&");
+  const values: (string | undefined)[] = [];
+  const kept: string[] = [];
+  for (const p of pairs) {
+    const eq = p.indexOf("=");
+    const key = eq === -1 ? p : p.slice(0, eq);
+    if (decode(key) === name) {
+      values.push(eq === -1 ? "" : decode(p.slice(eq + 1)));
+    } else {
+      kept.push(p);
+    }
+  }
+  if (values.length === 0) {
+    return undefined;
+  }
+  const { pathname, search } = globalThis.location;
+  history.replaceState(
+    history.state,
+    "",
+    pathname + search + (kept.length === 0 ? "" : `#${kept.join("&")}`),
+  );
+  const [v] = values;
+  return values.length === 1 && v !== undefined && v !== "" && utf8Length(v) <= maxBytes
+    ? v
+    : undefined;
+}

package/src/index.ts

@@ -0,0 +1,125 @@
+export { createAuthClient } from "./client.js";
+export type {
+  AuthClient,
+  AuthClientOptions,
+  PublicKeyCredentialJSON,
+  RecoverFlags,
+} from "./client.js";
+export { continuation, takeFragmentToken } from "./continuation.js";
+export {
+  completePendingLink,
+  oidcSignInURL,
+  pendingLink,
+  readOIDCReturn,
+  startOIDC,
+} from "./oidc.js";
+export type { OIDCReturn } from "./oidc.js";
+export { storePasswordCredential } from "./password-credential.js";
+export { shownOnce } from "./secret.js";
+export type { ShownOnce } from "./secret.js";
+export { createSessionsModel } from "./sessions.js";
+export type { SessionsModel } from "./sessions.js";
+export { withStepUp } from "./stepup.js";
+export type { StepUpOptions, StepUpPrompt, StepUpResult } from "./stepup.js";
+export {
+  passkeySupport,
+  recoverWithPasskey,
+  registerPasskey,
+  sendSignals,
+  setupWithPasskey,
+  signInWithPasskey,
+  stepUpWithPasskey,
+} from "./webauthn.js";
+export type {
+  DOMExceptionName,
+  RecoverOutcome,
+  RegisterOutcome,
+  SignInOutcome,
+  StepUpOutcome,
+} from "./webauthn.js";
+export {
+  authCode,
+  authReason,
+  parseCeremonyResponse,
+  parseCurrentSessionView,
+  parseInviteAcceptRequest,
+  parseInviteRequest,
+  parseKeyCreatedResponse,
+  parseKeyView,
+  parseLoginRequest,
+  parseMeResponse,
+  parseMethodLockView,
+  parseMethodsView,
+  parseNameRequest,
+  parseNewKeyRequest,
+  parseNewUserRequest,
+  parseOIDCStartResponse,
+  parsePasskeyView,
+  parsePasswordChangeRequest,
+  parsePasswordRemoveRequest,
+  parsePasswordRequest,
+  parsePendingLinkResponse,
+  parseProfileRequest,
+  parseRecoverPasswordRequest,
+  parseRecoveryResponse,
+  parseRedirectRequest,
+  parseSessionView,
+  parseSetupPasskeyBeginRequest,
+  parseSetupPasswordRequest,
+  parseSignedInResponse,
+  parseStateResponse,
+  parseTokenRequest,
+  parseTokenResponse,
+  parseTokenView,
+  parseTTLRequest,
+  parseUserMethodsView,
+  parseUserUpdateRequest,
+  parseUserView,
+  parseWebAuthnSignals,
+} from "./wire.js";
+export type {
+  AuthCode,
+  AuthReason,
+  CeremonyOptions,
+  CeremonyResponse,
+  CurrentSessionView,
+  InviteAcceptRequest,
+  InviteRequest,
+  KeyCreatedResponse,
+  KeyView,
+  LogActorView,
+  LogClassView,
+  LogEntryView,
+  LoginRequest,
+  MeResponse,
+  MethodLockView,
+  MethodsView,
+  NameRequest,
+  NewKeyRequest,
+  NewUserRequest,
+  OIDCStartResponse,
+  PasskeyView,
+  PasswordChangeRequest,
+  PasswordRemoveRequest,
+  PasswordRequest,
+  PendingLinkResponse,
+  ProfileRequest,
+  RecoverPasswordRequest,
+  RecoveryResponse,
+  RedirectRequest,
+  SecurityLogView,
+  SessionView,
+  SetupPasskeyBeginRequest,
+  SetupPasswordRequest,
+  SignedInResponse,
+  StateResponse,
+  TokenRequest,
+  TokenResponse,
+  TokenView,
+  TTLRequest,
+  UserMethodsView,
+  UserUpdateRequest,
+  UserView,
+  Validator,
+  WebAuthnSignals,
+} from "./wire.js";

package/src/navigate.ts

@@ -0,0 +1,5 @@
+// Its own module because location is non-configurable: a test replaces this import instead.
+/** @internal */
+export function assign(url: string): void {
+  globalThis.location.assign(url);
+}