@omni2fa/core 0.6.1

package/dist/index.js

@@ -0,0 +1,915 @@
+import N from "openapi-fetch";
+import { setup as h, fromPromise as l, createActor as u } from "xstate";
+class k {
+  map = /* @__PURE__ */ new Map();
+  get(e) {
+    return this.map.get(e) ?? null;
+  }
+  set(e, r) {
+    this.map.set(e, r);
+  }
+  remove(e) {
+    this.map.delete(e);
+  }
+}
+const s = {
+  InvalidCode: "INVALID_CODE",
+  PreAuthExpired: "PREAUTH_EXPIRED",
+  PreAuthInvalid: "PREAUTH_INVALID",
+  ChallengeNotFound: "CHALLENGE_NOT_FOUND",
+  ChallengeConsumed: "CHALLENGE_CONSUMED",
+  TooManyAttempts: "TOO_MANY_ATTEMPTS",
+  MethodNotFound: "METHOD_NOT_FOUND",
+  TypeAlreadyEnrolled: "TYPE_ALREADY_ENROLLED",
+  MaxMethodsReached: "MAX_METHODS_REACHED",
+  LastMethodProtected: "LAST_METHOD_PROTECTED",
+  RecoveryCodeInvalid: "RECOVERY_CODE_INVALID",
+  RecoveryCodeUsed: "RECOVERY_CODE_USED",
+  WebAuthnVerificationFailed: "WEBAUTHN_VERIFICATION_FAILED",
+  ValidationFailed: "VALIDATION_FAILED",
+  NetworkError: "NETWORK_ERROR",
+  Unknown: "UNKNOWN"
+}, w = {
+  [s.InvalidCode]: "The code you entered is invalid.",
+  [s.PreAuthExpired]: "Your session has expired. Please sign in again.",
+  [s.PreAuthInvalid]: "Your session is invalid. Please sign in again.",
+  [s.ChallengeNotFound]: "No active verification step. Please restart.",
+  [s.ChallengeConsumed]: "This verification step was already used. Please sign in again.",
+  [s.TooManyAttempts]: "Too many attempts. Please wait before trying again.",
+  [s.MethodNotFound]: "The selected 2FA method was not found.",
+  [s.TypeAlreadyEnrolled]: "You already have this type of 2FA enabled.",
+  [s.MaxMethodsReached]: "You have reached the maximum number of 2FA methods.",
+  [s.LastMethodProtected]: "You cannot remove your last 2FA method.",
+  [s.RecoveryCodeInvalid]: "The recovery code is invalid.",
+  [s.RecoveryCodeUsed]: "This recovery code has already been used.",
+  [s.WebAuthnVerificationFailed]: "Security key verification failed.",
+  [s.ValidationFailed]: "The request was malformed.",
+  [s.NetworkError]: "Network error. Please check your connection.",
+  [s.Unknown]: "An unexpected error occurred."
+};
+function v(t) {
+  return w[t] ?? w[s.Unknown];
+}
+const R = "omni2fa:preauth", D = "omni2fa:session", I = "http://omni2fa.local";
+class P {
+  storage;
+  preAuthKey;
+  sessionKey;
+  basePath;
+  inner;
+  constructor(e) {
+    this.storage = e.storage ?? new k(), this.preAuthKey = e.preAuthStorageKey ?? R, this.sessionKey = e.sessionStorageKey ?? D, this.basePath = new URL(e.baseUrl, I).pathname.replace(/\/$/, ""), this.inner = N({
+      baseUrl: e.baseUrl,
+      fetch: e.fetch ?? globalThis.fetch.bind(globalThis),
+      ...e.credentials ? { credentials: e.credentials } : {}
+    }), this.inner.use({
+      onRequest: ({ request: r }) => {
+        if (r.headers.has("Authorization"))
+          return r;
+        const n = this.isPreAuthEndpoint(r.url) ? this.getPreAuthToken() : this.getSessionToken();
+        return n && r.headers.set("Authorization", `Bearer ${n}`), r;
+      }
+    });
+  }
+  /** Pre-auth endpoints are exactly the ones mounted under <c>{basePath}/challenge/</c>. */
+  isPreAuthEndpoint(e) {
+    const r = new URL(e, I).pathname;
+    return (r.startsWith(this.basePath) ? r.slice(this.basePath.length) : r).startsWith("/challenge/");
+  }
+  setPreAuthToken(e) {
+    this.setToken(this.preAuthKey, e);
+  }
+  getPreAuthToken() {
+    return this.storage.get(this.preAuthKey);
+  }
+  setSessionToken(e) {
+    this.setToken(this.sessionKey, e);
+  }
+  getSessionToken() {
+    return this.storage.get(this.sessionKey);
+  }
+  setToken(e, r) {
+    r === null || r.length === 0 ? this.storage.remove(e) : this.storage.set(e, r);
+  }
+  async listMethods() {
+    const { data: e, error: r, response: n } = await this.inner.GET("/methods");
+    return this.toCall(e, r, n);
+  }
+  async removeMethod(e) {
+    const { error: r, response: n } = await this.inner.DELETE("/methods/{methodId}", { params: { path: { methodId: e } } });
+    return r ? this.errorCall(r, n) : { ok: !0, value: void 0 };
+  }
+  async startTotpEnrollment() {
+    const { data: e, error: r, response: n } = await this.inner.POST("/enroll/totp/start");
+    return this.toCall(e, r, n);
+  }
+  async confirmTotpEnrollment(e) {
+    const { data: r, error: n, response: o } = await this.inner.POST("/enroll/totp/confirm", { body: e });
+    return this.toCall(r, n, o);
+  }
+  async startEmailEnrollment(e) {
+    const { data: r, error: n, response: o } = await this.inner.POST("/enroll/email/start", { body: e });
+    return this.toCall(r, n, o);
+  }
+  async confirmEmailEnrollment(e) {
+    const { data: r, error: n, response: o } = await this.inner.POST("/enroll/email/confirm", { body: e });
+    return this.toCall(r, n, o);
+  }
+  async resendEmailEnrollment(e) {
+    const { data: r, error: n, response: o } = await this.inner.POST("/enroll/email/resend", { body: e });
+    return this.toCall(r, n, o);
+  }
+  async startWebAuthnEnrollment() {
+    const { data: e, error: r, response: n } = await this.inner.POST("/enroll/webauthn/start");
+    return this.toCall(e, r, n);
+  }
+  async confirmWebAuthnEnrollment(e) {
+    const { data: r, error: n, response: o } = await this.inner.POST("/enroll/webauthn/confirm", { body: e });
+    return this.toCall(r, n, o);
+  }
+  async startChallenge(e) {
+    const { data: r, error: n, response: o } = await this.inner.POST("/challenge/start", { body: e });
+    return this.toCall(r, n, o);
+  }
+  async resendChallenge(e) {
+    const { data: r, error: n, response: o } = await this.inner.POST("/challenge/resend", { body: e });
+    return this.toCall(r, n, o);
+  }
+  async verifyChallenge(e) {
+    const { data: r, error: n, response: o } = await this.inner.POST("/challenge/verify", { body: e });
+    return this.toCall(r, n, o);
+  }
+  async verifyRecoveryCode(e) {
+    const { data: r, error: n, response: o } = await this.inner.POST("/challenge/recovery-code", { body: e });
+    return this.toCall(r, n, o);
+  }
+  async regenerateRecoveryCodes() {
+    const { data: e, error: r, response: n } = await this.inner.POST("/recovery-codes/regenerate");
+    return this.toCall(e, r, n);
+  }
+  toCall(e, r, n) {
+    return r !== void 0 ? this.errorCall(r, n) : e === void 0 ? {
+      ok: !1,
+      code: s.NetworkError,
+      message: v(s.NetworkError),
+      httpStatus: n.status
+    } : { ok: !0, value: e };
+  }
+  errorCall(e, r) {
+    const n = e.code || s.Unknown;
+    return {
+      ok: !1,
+      code: n,
+      message: e.message || v(n),
+      httpStatus: r.status,
+      details: e.details ?? null
+    };
+  }
+}
+class z {
+  get(e) {
+    return globalThis.sessionStorage?.getItem(e) ?? null;
+  }
+  set(e, r) {
+    globalThis.sessionStorage?.setItem(e, r);
+  }
+  remove(e) {
+    globalThis.sessionStorage?.removeItem(e);
+  }
+}
+class X {
+  get(e) {
+    return globalThis.localStorage?.getItem(e) ?? null;
+  }
+  set(e, r) {
+    globalThis.localStorage?.setItem(e, r);
+  }
+  remove(e) {
+    globalThis.localStorage?.removeItem(e);
+  }
+}
+class a extends Error {
+  code;
+  httpStatus;
+  details;
+  constructor(e, r, n, o = null) {
+    super(r), this.name = "Omni2FaApiError", this.code = e, this.httpStatus = n, this.details = o;
+  }
+}
+const U = {
+  enrollmentId: null,
+  otpAuthUri: null,
+  secret: null,
+  methodId: null,
+  recoveryCodes: null,
+  errorCode: null,
+  errorMessage: null
+};
+function _(t) {
+  return h({
+    types: {
+      context: {},
+      events: {}
+    },
+    actors: {
+      startEnrollment: l(async () => {
+        const e = await t.startTotpEnrollment();
+        if (!e.ok)
+          throw new a(e.code, e.message, e.httpStatus, e.details ?? null);
+        return e.value;
+      }),
+      confirmEnrollment: l(async ({ input: e }) => {
+        const r = await t.confirmTotpEnrollment({
+          enrollmentId: e.enrollmentId,
+          code: e.code,
+          name: e.name
+        });
+        if (!r.ok)
+          throw new a(r.code, r.message, r.httpStatus, r.details ?? null);
+        return r.value;
+      })
+    }
+  }).createMachine({
+    id: "totpEnrollment",
+    initial: "idle",
+    context: U,
+    states: {
+      idle: {
+        on: {
+          start: { target: "starting" }
+        }
+      },
+      starting: {
+        invoke: {
+          src: "startEnrollment",
+          onDone: {
+            target: "awaitingCode",
+            actions: ({ context: e, event: r }) => {
+              e.enrollmentId = r.output.enrollmentId, e.otpAuthUri = r.output.otpAuthUri, e.secret = r.output.secret, e.errorCode = null, e.errorMessage = null;
+            }
+          },
+          onError: {
+            target: "failed",
+            actions: ({ context: e, event: r }) => A(e, r.error)
+          }
+        }
+      },
+      awaitingCode: {
+        on: {
+          submit: { target: "confirming" },
+          reset: { target: "idle", actions: p }
+        }
+      },
+      confirming: {
+        invoke: {
+          src: "confirmEnrollment",
+          input: ({ context: e, event: r }) => {
+            if (r.type !== "submit") throw new Error("confirming requires submit event");
+            if (!e.enrollmentId) throw new Error("no enrollmentId");
+            return { enrollmentId: e.enrollmentId, code: r.code, name: r.name ?? null };
+          },
+          onDone: {
+            target: "enrolled",
+            actions: ({ context: e, event: r }) => {
+              e.methodId = r.output.methodId, e.recoveryCodes = r.output.recoveryCodes ?? null, e.errorCode = null, e.errorMessage = null;
+            }
+          },
+          onError: {
+            target: "awaitingCode",
+            actions: ({ context: e, event: r }) => A(e, r.error)
+          }
+        }
+      },
+      enrolled: {
+        on: {
+          reset: { target: "idle", actions: p }
+        }
+      },
+      failed: {
+        on: {
+          start: { target: "starting" },
+          reset: { target: "idle", actions: p }
+        }
+      }
+    }
+  });
+}
+function p({ context: t }) {
+  t.enrollmentId = null, t.otpAuthUri = null, t.secret = null, t.methodId = null, t.recoveryCodes = null, t.errorCode = null, t.errorMessage = null;
+}
+function A(t, e) {
+  e instanceof a ? (t.errorCode = e.code, t.errorMessage = e.message) : (t.errorCode = "UNKNOWN", t.errorMessage = e instanceof Error ? e.message : null);
+}
+const J = {
+  enrollmentId: null,
+  email: null,
+  expiresAt: null,
+  resendAvailableAt: null,
+  methodId: null,
+  recoveryCodes: null,
+  errorCode: null,
+  errorMessage: null
+};
+function F(t) {
+  return h({
+    types: {
+      context: {},
+      events: {}
+    },
+    actors: {
+      startEnrollment: l(async ({ input: e }) => {
+        const r = await t.startEmailEnrollment({ email: e.email });
+        if (!r.ok)
+          throw new a(r.code, r.message, r.httpStatus, r.details ?? null);
+        return r.value;
+      }),
+      resendEnrollment: l(async ({ input: e }) => {
+        const r = await t.resendEmailEnrollment({ enrollmentId: e.enrollmentId });
+        if (!r.ok)
+          throw new a(r.code, r.message, r.httpStatus, r.details ?? null);
+        return r.value;
+      }),
+      confirmEnrollment: l(async ({ input: e }) => {
+        const r = await t.confirmEmailEnrollment({
+          enrollmentId: e.enrollmentId,
+          code: e.code,
+          name: e.name
+        });
+        if (!r.ok)
+          throw new a(r.code, r.message, r.httpStatus, r.details ?? null);
+        return r.value;
+      })
+    }
+  }).createMachine({
+    id: "emailEnrollment",
+    initial: "idle",
+    context: J,
+    states: {
+      idle: {
+        on: {
+          start: { target: "starting" }
+        }
+      },
+      starting: {
+        entry: ({ context: e, event: r }) => {
+          r.type === "start" && (e.email = r.email);
+        },
+        invoke: {
+          src: "startEnrollment",
+          input: ({ context: e }) => {
+            if (!e.email) throw new Error("no email");
+            return { email: e.email };
+          },
+          onDone: {
+            target: "awaitingCode",
+            actions: ({ context: e, event: r }) => b(e, r.output)
+          },
+          onError: {
+            target: "failed",
+            actions: ({ context: e, event: r }) => y(e, r.error)
+          }
+        }
+      },
+      awaitingCode: {
+        on: {
+          submit: { target: "confirming" },
+          resend: { target: "resending" },
+          reset: { target: "idle", actions: f }
+        }
+      },
+      resending: {
+        invoke: {
+          src: "resendEnrollment",
+          input: ({ context: e }) => {
+            if (!e.enrollmentId) throw new Error("no enrollmentId");
+            return { enrollmentId: e.enrollmentId };
+          },
+          onDone: {
+            target: "awaitingCode",
+            actions: ({ context: e, event: r }) => b(e, r.output)
+          },
+          onError: {
+            target: "awaitingCode",
+            actions: ({ context: e, event: r }) => y(e, r.error)
+          }
+        }
+      },
+      confirming: {
+        invoke: {
+          src: "confirmEnrollment",
+          input: ({ context: e, event: r }) => {
+            if (r.type !== "submit") throw new Error("confirming requires submit event");
+            if (!e.enrollmentId) throw new Error("no enrollmentId");
+            return { enrollmentId: e.enrollmentId, code: r.code, name: r.name ?? null };
+          },
+          onDone: {
+            target: "enrolled",
+            actions: ({ context: e, event: r }) => {
+              e.methodId = r.output.methodId, e.recoveryCodes = r.output.recoveryCodes ?? null, e.errorCode = null, e.errorMessage = null;
+            }
+          },
+          onError: {
+            target: "awaitingCode",
+            actions: ({ context: e, event: r }) => y(e, r.error)
+          }
+        }
+      },
+      enrolled: {
+        on: {
+          reset: { target: "idle", actions: f }
+        }
+      },
+      failed: {
+        on: {
+          start: { target: "starting" },
+          reset: { target: "idle", actions: f }
+        }
+      }
+    }
+  });
+}
+function b(t, e) {
+  t.enrollmentId = e.enrollmentId, t.expiresAt = e.expiresAt, t.resendAvailableAt = e.resendAvailableAt, t.errorCode = null, t.errorMessage = null;
+}
+function f({ context: t }) {
+  t.enrollmentId = null, t.email = null, t.expiresAt = null, t.resendAvailableAt = null, t.methodId = null, t.recoveryCodes = null, t.errorCode = null, t.errorMessage = null;
+}
+function y(t, e) {
+  e instanceof a ? (t.errorCode = e.code, t.errorMessage = e.message) : (t.errorCode = "UNKNOWN", t.errorMessage = e instanceof Error ? e.message : null);
+}
+function g(t) {
+  const e = t.replace(/-/g, "+").replace(/_/g, "/"), r = e.padEnd(Math.ceil(e.length / 4) * 4, "="), n = atob(r), o = new Uint8Array(n.length);
+  for (let i = 0; i < n.length; i++)
+    o[i] = n.charCodeAt(i);
+  return o.buffer;
+}
+function d(t) {
+  const e = new Uint8Array(t);
+  let r = "";
+  for (const n of e)
+    r += String.fromCharCode(n);
+  return btoa(r).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function O(t) {
+  return (t ?? []).map((e) => ({ ...e, id: g(e.id) }));
+}
+async function L(t) {
+  const e = JSON.parse(t), r = {
+    ...e,
+    challenge: g(e.challenge),
+    user: { ...e.user, id: g(e.user.id) },
+    excludeCredentials: O(e.excludeCredentials)
+    // Cast through unknown: the spread carries Fido2's index-signature fields the DOM type omits.
+  }, n = await navigator.credentials.create({ publicKey: r });
+  if (n === null)
+    throw new Error("WebAuthn registration produced no credential.");
+  const o = n.response;
+  return JSON.stringify({
+    id: n.id,
+    rawId: d(n.rawId),
+    type: n.type,
+    extensions: n.getClientExtensionResults(),
+    response: {
+      attestationObject: d(o.attestationObject),
+      clientDataJSON: d(o.clientDataJSON)
+    }
+  });
+}
+async function K(t) {
+  const e = JSON.parse(t), r = {
+    ...e,
+    challenge: g(e.challenge),
+    allowCredentials: O(e.allowCredentials)
+  }, n = await navigator.credentials.get({ publicKey: r });
+  if (n === null)
+    throw new Error("WebAuthn authentication produced no credential.");
+  const o = n.response;
+  return JSON.stringify({
+    id: n.id,
+    rawId: d(n.rawId),
+    type: n.type,
+    extensions: n.getClientExtensionResults(),
+    response: {
+      authenticatorData: d(o.authenticatorData),
+      clientDataJSON: d(o.clientDataJSON),
+      signature: d(o.signature),
+      userHandle: o.userHandle ? d(o.userHandle) : null
+    }
+  });
+}
+const W = {
+  enrollmentId: null,
+  optionsJson: null,
+  name: null,
+  methodId: null,
+  recoveryCodes: null,
+  errorCode: null,
+  errorMessage: null
+};
+function $(t) {
+  return h({
+    types: {
+      context: {},
+      events: {}
+    },
+    actors: {
+      startEnrollment: l(async () => {
+        const e = await t.startWebAuthnEnrollment();
+        if (!e.ok)
+          throw new a(e.code, e.message, e.httpStatus, e.details ?? null);
+        return e.value;
+      }),
+      registerAndConfirm: l(async ({ input: e }) => {
+        const r = await L(e.optionsJson), n = await t.confirmWebAuthnEnrollment({
+          enrollmentId: e.enrollmentId,
+          attestationResponseJson: r,
+          name: e.name
+        });
+        if (!n.ok)
+          throw new a(n.code, n.message, n.httpStatus, n.details ?? null);
+        return n.value;
+      })
+    }
+  }).createMachine({
+    id: "webauthnEnrollment",
+    initial: "idle",
+    context: W,
+    states: {
+      idle: {
+        on: {
+          start: { target: "starting" }
+        }
+      },
+      starting: {
+        entry: ({ context: e, event: r }) => {
+          r.type === "start" && (e.name = r.name ?? null);
+        },
+        invoke: {
+          src: "startEnrollment",
+          onDone: {
+            target: "registering",
+            actions: ({ context: e, event: r }) => {
+              e.enrollmentId = r.output.enrollmentId, e.optionsJson = r.output.optionsJson, e.errorCode = null, e.errorMessage = null;
+            }
+          },
+          onError: {
+            target: "failed",
+            actions: ({ context: e, event: r }) => M(e, r.error)
+          }
+        }
+      },
+      registering: {
+        invoke: {
+          src: "registerAndConfirm",
+          input: ({ context: e }) => {
+            if (!e.enrollmentId || !e.optionsJson) throw new Error("no pending enrollment");
+            return { enrollmentId: e.enrollmentId, optionsJson: e.optionsJson, name: e.name };
+          },
+          onDone: {
+            target: "enrolled",
+            actions: ({ context: e, event: r }) => {
+              e.methodId = r.output.methodId, e.recoveryCodes = r.output.recoveryCodes ?? null, e.errorCode = null, e.errorMessage = null;
+            }
+          },
+          onError: {
+            target: "failed",
+            actions: ({ context: e, event: r }) => M(e, r.error)
+          }
+        }
+      },
+      enrolled: {
+        on: {
+          reset: { target: "idle", actions: T }
+        }
+      },
+      failed: {
+        on: {
+          retry: { target: "starting" },
+          reset: { target: "idle", actions: T }
+        }
+      }
+    }
+  });
+}
+function T({ context: t }) {
+  t.enrollmentId = null, t.optionsJson = null, t.name = null, t.methodId = null, t.recoveryCodes = null, t.errorCode = null, t.errorMessage = null;
+}
+function M(t, e) {
+  e instanceof a ? (t.errorCode = e.code, t.errorMessage = e.message) : (t.errorCode = "UNKNOWN", t.errorMessage = e instanceof Error ? e.message : null);
+}
+const H = {
+  methodId: null,
+  methodType: null,
+  userId: null,
+  expiresAt: null,
+  resendAvailableAt: null,
+  optionsJson: null,
+  errorCode: null,
+  errorMessage: null
+};
+function Y(t) {
+  return h({
+    types: {
+      context: {},
+      events: {}
+    },
+    actors: {
+      startChallenge: l(async ({ input: e }) => {
+        const r = await t.startChallenge({ methodId: e.methodId });
+        if (!r.ok)
+          throw new a(r.code, r.message, r.httpStatus, r.details ?? null);
+        return r.value;
+      }),
+      resendChallenge: l(async ({ input: e }) => {
+        const r = await t.resendChallenge({ methodId: e.methodId });
+        if (!r.ok)
+          throw new a(r.code, r.message, r.httpStatus, r.details ?? null);
+        return r.value;
+      }),
+      verifyChallenge: l(async ({ input: e }) => {
+        const r = await t.verifyChallenge({ methodId: e.methodId, code: e.code });
+        if (!r.ok)
+          throw new a(r.code, r.message, r.httpStatus, r.details ?? null);
+        return r.value;
+      }),
+      assertChallenge: l(async ({ input: e }) => {
+        const r = await K(e.optionsJson), n = await t.verifyChallenge({ methodId: e.methodId, assertionResponseJson: r });
+        if (!n.ok)
+          throw new a(n.code, n.message, n.httpStatus, n.details ?? null);
+        return n.value;
+      }),
+      verifyRecoveryCode: l(async ({ input: e }) => {
+        const r = await t.verifyRecoveryCode({ recoveryCode: e.code });
+        if (!r.ok)
+          throw new a(r.code, r.message, r.httpStatus, r.details ?? null);
+        return r.value;
+      })
+    }
+  }).createMachine({
+    id: "challenge",
+    initial: "idle",
+    context: H,
+    states: {
+      idle: {
+        on: {
+          pick: { target: "starting" },
+          useRecoveryCode: { target: "verifyingRecovery" }
+        }
+      },
+      starting: {
+        entry: ({ context: e, event: r }) => {
+          r.type === "pick" && (e.methodId = r.methodId);
+        },
+        invoke: {
+          src: "startChallenge",
+          input: ({ context: e }) => {
+            if (!e.methodId) throw new Error("no methodId");
+            return { methodId: e.methodId };
+          },
+          onDone: [
+            {
+              guard: ({ event: e }) => e.output.type === "WebAuthn",
+              target: "asserting",
+              actions: ({ context: e, event: r }) => C(e, r.output)
+            },
+            {
+              target: "awaitingCode",
+              actions: ({ context: e, event: r }) => C(e, r.output)
+            }
+          ],
+          onError: {
+            target: "failed",
+            actions: ({ context: e, event: r }) => c(e, r.error)
+          }
+        }
+      },
+      asserting: {
+        invoke: {
+          src: "assertChallenge",
+          input: ({ context: e }) => {
+            if (!e.methodId || !e.optionsJson) throw new Error("no assertion options");
+            return { methodId: e.methodId, optionsJson: e.optionsJson };
+          },
+          onDone: {
+            target: "verified",
+            actions: ({ context: e, event: r }) => {
+              e.userId = r.output.userId, e.errorCode = null, e.errorMessage = null;
+            }
+          },
+          onError: {
+            target: "failed",
+            actions: ({ context: e, event: r }) => c(e, r.error)
+          }
+        }
+      },
+      awaitingCode: {
+        on: {
+          submit: { target: "verifying" },
+          resend: { target: "resending" },
+          useRecoveryCode: { target: "verifyingRecovery" },
+          reset: { target: "idle", actions: E }
+        }
+      },
+      verifyingRecovery: {
+        invoke: {
+          src: "verifyRecoveryCode",
+          input: ({ event: e }) => {
+            if (e.type !== "useRecoveryCode") throw new Error("verifyingRecovery requires useRecoveryCode event");
+            return { code: e.code };
+          },
+          onDone: {
+            target: "verified",
+            actions: ({ context: e, event: r }) => {
+              e.userId = r.output.userId, e.errorCode = null, e.errorMessage = null;
+            }
+          },
+          onError: {
+            target: "failed",
+            actions: ({ context: e, event: r }) => c(e, r.error)
+          }
+        }
+      },
+      resending: {
+        invoke: {
+          src: "resendChallenge",
+          input: ({ context: e }) => {
+            if (!e.methodId) throw new Error("no methodId");
+            return { methodId: e.methodId };
+          },
+          onDone: {
+            target: "awaitingCode",
+            actions: ({ context: e, event: r }) => C(e, r.output)
+          },
+          onError: {
+            target: "awaitingCode",
+            actions: ({ context: e, event: r }) => c(e, r.error)
+          }
+        }
+      },
+      verifying: {
+        invoke: {
+          src: "verifyChallenge",
+          input: ({ context: e, event: r }) => {
+            if (r.type !== "submit") throw new Error("verifying requires submit event");
+            if (!e.methodId) throw new Error("no methodId");
+            return { methodId: e.methodId, code: r.code };
+          },
+          onDone: {
+            target: "verified",
+            actions: ({ context: e, event: r }) => {
+              e.userId = r.output.userId, e.errorCode = null, e.errorMessage = null;
+            }
+          },
+          onError: {
+            target: "awaitingCode",
+            actions: ({ context: e, event: r }) => c(e, r.error)
+          }
+        }
+      },
+      verified: {
+        on: {
+          reset: { target: "idle", actions: E }
+        }
+      },
+      failed: {
+        on: {
+          pick: { target: "starting" },
+          useRecoveryCode: { target: "verifyingRecovery" },
+          reset: { target: "idle", actions: E }
+        }
+      }
+    }
+  });
+}
+function C(t, e) {
+  t.methodType = e.type, t.expiresAt = e.expiresAt ?? null, t.resendAvailableAt = e.resendAvailableAt ?? null, t.optionsJson = e.optionsJson ?? null, t.errorCode = null, t.errorMessage = null;
+}
+function E({ context: t }) {
+  t.methodId = null, t.methodType = null, t.userId = null, t.expiresAt = null, t.resendAvailableAt = null, t.optionsJson = null, t.errorCode = null, t.errorMessage = null;
+}
+function c(t, e) {
+  e instanceof a ? (t.errorCode = e.code, t.errorMessage = e.message) : (t.errorCode = "UNKNOWN", t.errorMessage = e instanceof Error ? e.message : null);
+}
+const V = {
+  items: [],
+  errorCode: null,
+  errorMessage: null
+};
+function B(t) {
+  return h({
+    types: {
+      context: {},
+      events: {}
+    },
+    actors: {
+      load: l(async () => {
+        const e = await t.listMethods();
+        if (!e.ok)
+          throw new a(e.code, e.message, e.httpStatus, e.details ?? null);
+        return e.value;
+      }),
+      remove: l(async ({ input: e }) => {
+        const r = await t.removeMethod(e.methodId);
+        if (!r.ok)
+          throw new a(r.code, r.message, r.httpStatus, r.details ?? null);
+        return e.methodId;
+      })
+    }
+  }).createMachine({
+    id: "methods",
+    initial: "idle",
+    context: V,
+    states: {
+      idle: {
+        on: {
+          load: { target: "loading" }
+        }
+      },
+      loading: {
+        invoke: {
+          src: "load",
+          onDone: {
+            target: "ready",
+            actions: ({ context: e, event: r }) => {
+              e.items = r.output, e.errorCode = null, e.errorMessage = null;
+            }
+          },
+          onError: {
+            target: "failed",
+            actions: ({ context: e, event: r }) => S(e, r.error)
+          }
+        }
+      },
+      ready: {
+        on: {
+          load: { target: "loading" },
+          remove: { target: "removing" }
+        }
+      },
+      removing: {
+        invoke: {
+          src: "remove",
+          input: ({ event: e }) => {
+            if (e.type !== "remove") throw new Error("removing requires remove event");
+            return { methodId: e.methodId };
+          },
+          onDone: {
+            target: "ready",
+            actions: ({ context: e, event: r }) => {
+              const n = r.output;
+              e.items = e.items.filter((o) => o.id !== n), e.errorCode = null, e.errorMessage = null;
+            }
+          },
+          onError: {
+            target: "ready",
+            actions: ({ context: e, event: r }) => S(e, r.error)
+          }
+        }
+      },
+      failed: {
+        on: {
+          load: { target: "loading" },
+          reset: { target: "idle", actions: G }
+        }
+      }
+    }
+  });
+}
+function G({ context: t }) {
+  t.items = [], t.errorCode = null, t.errorMessage = null;
+}
+function S(t, e) {
+  e instanceof a ? (t.errorCode = e.code, t.errorMessage = e.message) : (t.errorCode = "UNKNOWN", t.errorMessage = e instanceof Error ? e.message : null);
+}
+function Q(t) {
+  const e = new P(t), r = u(_(e)), n = u(F(e)), o = u($(e)), i = u(Y(e)), m = u(B(e));
+  return r.start(), n.start(), o.start(), i.start(), m.start(), {
+    client: e,
+    totpEnrollment: r,
+    emailEnrollment: n,
+    webauthnEnrollment: o,
+    challenge: i,
+    methods: m,
+    dispose() {
+      r.stop(), n.stop(), o.stop(), i.stop(), m.stop();
+    }
+  };
+}
+export {
+  X as LocalStorageStorage,
+  k as MemoryStorage,
+  a as Omni2FaApiError,
+  P as Omni2FaClient,
+  s as Omni2FaErrorCodes,
+  z as SessionStorageStorage,
+  Y as createChallengeMachine,
+  F as createEmailEnrollmentMachine,
+  B as createMethodsMachine,
+  Q as createOmni2Fa,
+  _ as createTotpEnrollmentMachine,
+  $ as createWebAuthnEnrollmentMachine,
+  v as getDefaultMessage,
+  K as startAuthentication,
+  L as startRegistration
+};
+//# sourceMappingURL=index.js.map