@saeris/hanko 0.0.0 → 0.2.0

package/dist/linking-nKoayyHf.d.mts

@@ -0,0 +1,133 @@
+//#region src/linking.d.ts
+/**
+ * App-opening for scanned QR codes.
+ *
+ * The goal: one QR payload that opens a native app when it is installed, and a
+ * web page when it is not — without the device ever showing an error.
+ *
+ * That rules out custom schemes as the primary target. A `myapp://` QR read by
+ * the OS camera on a phone without the app fails silently and
+ * unrecoverably — the user sees "cannot open" and has nowhere to go. Universal
+ * Links (iOS) and App Links (Android) solve this by making the payload an
+ * ordinary `https://` URL that the OS *routes* to the app when the domain and
+ * app are associated, and to the browser when they are not.
+ *
+ * So the QR keeps encoding `verification_uri_complete` exactly as before. The
+ * routing lives in association files served from the same origin, not in a
+ * different payload. What this module provides is the association files, the
+ * URL parsing on the receiving end, and a custom-scheme fallback for the cases
+ * that genuinely need one.
+ */
+/** Where an inbound approval link came from. */
+type LinkSource =
+/** A Universal Link / App Link that opened the native app. */
+`app-link` |
+/** A custom scheme (`myapp://`). Only reached when explicitly used. */
+`custom-scheme` |
+/** An ordinary web navigation — the app was not installed, or this is a PWA. */
+`web`;
+interface ParsedApprovalLink {
+  userCode: string;
+  source: LinkSource;
+  /** The full URL, for logging or to hand to a router. */
+  href: string;
+}
+interface LinkConfig {
+  /**
+   * Origin serving the approval page, e.g. `https://example.com`.
+   * Must be HTTPS: both Apple and Google refuse to associate a plain-HTTP domain.
+   */
+  origin: string;
+  /** Path of the approval page. Also the path the association files claim. */
+  path?: string;
+  /** Query parameter carrying the code. */
+  codeParam?: string;
+  /**
+   * Custom scheme, e.g. `beerjournal`. Optional and NOT the primary path.
+   *
+   * Worth registering anyway: it is the only way to reach the app from
+   * contexts that refuse to follow universal links — some in-app browsers, and
+   * a few QR readers that strip them.
+   */
+  scheme?: string;
+}
+/**
+ * Build the URL a QR should encode.
+ *
+ * Deliberately an `https://` URL rather than a scheme: this is the same string
+ * `verification_uri_complete` already carries, which is what lets one QR serve
+ * a phone with the app, a phone without it, and a laptop.
+ */
+declare const buildApprovalUrl: (userCode: string, { origin, path, codeParam }: LinkConfig) => string;
+/**
+ * Build the custom-scheme equivalent.
+ *
+ * For a "Open in app" button on the web fallback page — a deliberate tap, where
+ * a failure is recoverable because the user is already looking at a working web
+ * page. Never for the QR itself.
+ */
+declare const buildAppSchemeUrl: (userCode: string, { scheme, path, codeParam }: LinkConfig) => string;
+declare const parseApprovalLink: (href: string, { codeParam, scheme }?: Partial<LinkConfig>) => ParsedApprovalLink | null;
+/**
+ * Apple App Site Association, for `/.well-known/apple-app-site-association`.
+ *
+ * Serve as `application/json` over HTTPS with **no redirects** — Apple fetches
+ * it directly and a redirect makes the association fail silently, which is the
+ * single most common reason universal links "just don't work".
+ *
+ * @param appIds `<TEAM_ID>.<BUNDLE_ID>`, e.g. `QQ57RJ5UTD.gg.saeris.beerjournal`
+ */
+declare const appleAppSiteAssociation: (appIds: string[], { paths }?: {
+  paths?: string[];
+}) => object;
+/**
+ * Digital Asset Links, for `/.well-known/assetlinks.json`.
+ *
+ * @param fingerprints SHA-256 of the app's SIGNING certificate. Note that Play
+ *   App Signing re-signs the upload, so the fingerprint that works in
+ *   production is the one from the Play Console — not your local keystore. A
+ *   local-only fingerprint is why app links commonly work in debug and break
+ *   after release.
+ */
+declare const digitalAssetLinks: (packageName: string, fingerprints: string[]) => object[];
+/**
+ * Expo app config fragment for universal/app links.
+ *
+ * Merge into `app.json`. Requires a development or production build — the
+ * entitlement is registered at build time, so **universal links do not work in
+ * Expo Go**, and a project pinned to Expo Go must use the web fallback until it
+ * moves to dev builds.
+ */
+declare const expoLinkingConfig: ({ origin, path, scheme }: LinkConfig) => object;
+/**
+ * `launch_handler` fragment for a PWA manifest.
+ *
+ * `navigate-existing` so a scanned link reuses the already-open window rather
+ * than stacking a second one. An approval screen that opened behind the window
+ * the user was already looking at would appear not to have worked at all.
+ *
+ * Pair with `window.launchQueue.setConsumer()` to read the target URL — see
+ * {@link consumeLaunchTarget}.
+ */
+declare const pwaLaunchHandler: () => object;
+/**
+ * Read the URL an installed PWA was launched with.
+ *
+ * With `navigate-existing`, the window is reused and `location.href` may
+ * already be correct — but when the app was cold-started or the consumer runs
+ * before navigation settles, `launchQueue` is the only reliable source.
+ *
+ * Where `launchQueue` is unsupported — Safari and Firefox, as of 2026 — this
+ * calls back with the current location ONLY when `fallbackToLocation` is set.
+ * It defaults to false because the fallback cannot tell a launch from an
+ * ordinary page load: it fires on every visit, and a caller that treats the
+ * result as "the user just arrived from a link" will act on a URL nobody
+ * followed. Opt in when the page is only ever reached by launch.
+ */
+declare const consumeLaunchTarget: (onTarget: (href: string) => void, { currentHref, fallbackToLocation }?: {
+  currentHref?: string;
+  fallbackToLocation?: boolean;
+}) => void;
+//#endregion
+export { buildAppSchemeUrl as a, digitalAssetLinks as c, pwaLaunchHandler as d, appleAppSiteAssociation as i, expoLinkingConfig as l, LinkSource as n, buildApprovalUrl as o, ParsedApprovalLink as r, consumeLaunchTarget as s, LinkConfig as t, parseApprovalLink as u };
+//# sourceMappingURL=linking-nKoayyHf.d.mts.map

package/dist/linking-nKoayyHf.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linking-nKoayyHf.d.mts","names":[],"sources":["../src/linking.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;KAqBY;;;;;;;UAQK;EACf;EACA,QAAQ;;EAER;;UAGe;;;;;EAKf;;EAEA;;EAEA;;;;;;;;EAQA;;;;;;;;;cAUW,mBACX,oBACA,QAAA,MAAA,aAAqD;;;;;;;;cAc1C,oBACX,oBACA,QAAA,MAAA,aAAqD;cAuC1C,oBACX,gBACA,WAAA,WAAqC,QAAQ,gBAC5C;;;;;;;;;;cAsCU,0BACX,oBACA;EAAoC;;;;;;;;;;;cAkBzB,oBACX,qBACA;;;;;;;;;cAoBW,sBAAqB,QAAA,MAAA,UAI/B;;;;;;;;;;;cAoCU;;;;;;;;;;;;;;;cAkBA,sBACX,WAAW,yBACX,aAAA;EAGK;EAAsB"}

package/dist/machine-CRHKjtoP.d.mts

@@ -0,0 +1,223 @@
+//#region src/machine.d.ts
+/**
+ * The device-authorization flow as two explicit state machines.
+ *
+ * Modeled the way xstate would model it — states, events, and a declarative
+ * transition table — but hand-rolled on WinterTC primitives so the library
+ * stays dependency-free. What we keep from that shape is the part that pays:
+ * transitions are DATA, readable in one place and checkable against RFC 8628
+ * side by side, rather than control flow scattered across functions.
+ *
+ * What we deliberately omit is the actor/service layer. Nothing here needs to
+ * observe transitions from outside, and an interpreter abstraction for a
+ * single consumer would be weight without benefit.
+ *
+ * Side effects live outside: these reducers are pure, and the classes in
+ * `server.ts` / `client/index.ts` own the I/O and the state itself.
+ */
+/**
+ * Server-side lifecycle of one authorization attempt.
+ *
+ * `pending` is the only non-terminal state. `consumed` is distinct from
+ * `approved` because approval is not what ends the flow — redemption is. A
+ * device_code that stayed redeemable after approval would be a replayable
+ * bearer credential.
+ */
+type GrantState = `pending` | `approved` | `denied` | `expired` | `consumed`;
+/** Events that can move a grant. */
+type GrantEvent =
+/** The user authorized on their phone. Carries who they are. */
+{
+  type: `APPROVE`;
+  subject: string;
+} |
+/** The user refused. */
+{
+  type: `DENY`;
+} |
+/** The deadline passed. Raised on read, not by a timer — see `server.ts`. */
+{
+  type: `EXPIRE`;
+} |
+/** The device redeemed its approval. Terminal. */
+{
+  type: `REDEEM`;
+};
+/** Whether `event` is legal in `state`. */
+declare const canTransitionGrant: (state: GrantState, event: GrantEvent[`type`]) => boolean;
+/**
+ * Pure grant reducer. Returns the same state when the event is illegal, so
+ * callers can compare identity to detect a rejected transition.
+ */
+declare const grantTransition: (state: GrantState, event: GrantEvent) => GrantState;
+/** Terminal states accept no further events. */
+declare const isGrantSettled: (state: GrantState) => boolean;
+/**
+ * Device-side polling lifecycle.
+ *
+ * States mirror what the screen is doing, so a UI can render directly from
+ * them: `waiting` is the gap between polls, `polling` is a request in flight.
+ * The three terminal states are the outcomes the screen must show.
+ */
+type PollState = `idle` | `waiting` | `polling` | `authorized` | `denied` | `expired` | `aborted`;
+/**
+ * Events driving the poll loop.
+ *
+ * The four RFC error codes appear verbatim as event types so the mapping from
+ * a token-endpoint response to a transition needs no translation layer.
+ */
+type PollEvent = {
+  type: `START`;
+} | {
+  type: `TICK`;
+} | {
+  type: `AUTHORIZATION_PENDING`;
+} | {
+  type: `SLOW_DOWN`;
+} | {
+  type: `ACCESS_DENIED`;
+} | {
+  type: `EXPIRED_TOKEN`;
+} |
+/** A response with no `error` — the grant was redeemed. */
+{
+  type: `SUCCESS`;
+} |
+/** Network failure. Distinct from SLOW_DOWN: congestion, not policy. */
+{
+  type: `NETWORK_ERROR`;
+} |
+/** The client's own deadline elapsed. */
+{
+  type: `DEADLINE`;
+} |
+/** The screen was dismissed. */
+{
+  type: `ABORT`;
+};
+/**
+ * Context carried alongside the poll state.
+ *
+ * Separate from the state itself, exactly as xstate separates finite state
+ * from extended state: the interval changes constantly but is not a state —
+ * `waiting` at 5s and `waiting` at 20s are the same state, different context.
+ */
+interface PollContext {
+  /** Current wait between polls, in seconds. */
+  intervalSeconds: number;
+  /** Epoch ms after which the flow is over regardless of the server. */
+  deadline: number;
+  /** Polls attempted. Useful for UI ("still waiting…") and diagnostics. */
+  attempts: number;
+}
+declare const canTransitionPoll: (state: PollState, event: PollEvent[`type`]) => boolean;
+declare const pollTransition: (state: PollState, event: PollEvent) => PollState;
+declare const isPollSettled: (state: PollState) => boolean;
+/**
+ * Context reducer, pure and separate from the state reducer.
+ *
+ * The two interval rules live here together, which is the point: `SLOW_DOWN`
+ * is a fixed +5s per RFC 8628 §3.5 ("increased by 5 seconds for this and all
+ * subsequent requests"), while `NETWORK_ERROR` doubles. Conflating them is the
+ * easy mistake, and side-by-side they cannot be confused.
+ */
+declare const pollContextTransition: (context: PollContext, event: PollEvent) => PollContext;
+/** RFC 8628 §3.5: `slow_down` adds exactly this many seconds, permanently. */
+declare const SLOW_DOWN_INCREMENT_SECONDS = 5;
+/** Ceiling for network backoff, so a long outage cannot stall the flow. */
+declare const MAX_BACKOFF_SECONDS = 60;
+/**
+ * Map a token-endpoint response's `error` field to a poll event.
+ *
+ * `undefined` means success. An unrecognized code maps to
+ * `AUTHORIZATION_PENDING` rather than success or failure: an unknown code is
+ * not evidence the user decided anything, and the deadline still bounds the
+ * loop. Treating it as success would sign the device in on a garbage payload.
+ */
+declare const eventForTokenError: (error: string | undefined) => PollEvent;
+/**
+ * The approving device's lifecycle — the third participant in the flow.
+ *
+ * Runs on the phone that is ALREADY authenticated. Two ways in, as the
+ * ecosystem shows: Plex hands the OS camera a URL and the user lands in a
+ * browser (`scanning` is skipped, the code arrives from the query string),
+ * while Discord and Steam scan inside their own app and never leave it.
+ *
+ * `confirming` exists because approving must not be one tap on an unverified
+ * code. RFC 8628 §5.4 asks the user to check that the code matches the screen
+ * in front of them; that check is the only defense against a phished QR
+ * pointing at an attacker's device.
+ */
+type ApprovalState = `idle` |
+/** Camera open, looking for a code. Skipped when arriving by URL. */
+`scanning` |
+/** A code was read or typed; asking the server what it belongs to. */
+`resolving` |
+/** Server knows the grant. Running the challenge before approve/deny. */
+`confirming` |
+/** Sending the decision. */
+`submitting` | `approved` | `denied` |
+/** The grant was already expired, consumed, or unknown. */
+`invalid` |
+/** Camera or network failure. Recoverable — the user can retry. */
+`failed`;
+type ApprovalEvent =
+/** Open the scanner (in-app path). */
+{
+  type: `SCAN`;
+} |
+/** A code arrived — scanned, typed, or read from the URL. */
+{
+  type: `CODE`;
+  userCode: string;
+} |
+/** The server resolved the code to a live grant. */
+{
+  type: `RESOLVED`;
+} |
+/** The server did not recognize the code, or it is no longer live. */
+{
+  type: `REJECTED`;
+} |
+/** The challenge passed — the user proved they are looking at the screen. */
+{
+  type: `CONFIRMED`;
+} |
+/** The challenge failed. Back to confirming so the user can retry. */
+{
+  type: `CHALLENGE_FAILED`;
+} |
+/** The user chose to approve. */
+{
+  type: `APPROVE`;
+} |
+/** The user chose to refuse. */
+{
+  type: `DENY`;
+} |
+/** The server accepted the decision. */
+{
+  type: `SUBMITTED`;
+  approved: boolean;
+} |
+/** Camera or network failure. */
+{
+  type: `ERROR`;
+} |
+/** Start over after a failure or an invalid code. */
+{
+  type: `RESET`;
+};
+declare const canTransitionApproval: (state: ApprovalState, event: ApprovalEvent[`type`]) => boolean;
+/**
+ * Pure approval reducer.
+ *
+ * `SUBMITTED` is the one event whose target depends on its payload — the same
+ * transition lands on `approved` or `denied` according to what the user chose,
+ * so the table's entry is overridden here.
+ */
+declare const approvalTransition: (state: ApprovalState, event: ApprovalEvent) => ApprovalState;
+declare const isApprovalSettled: (state: ApprovalState) => boolean;
+//#endregion
+export { isGrantSettled as _, MAX_BACKOFF_SECONDS as a, pollTransition as b, PollState as c, canTransitionApproval as d, canTransitionGrant as f, isApprovalSettled as g, grantTransition as h, GrantState as i, SLOW_DOWN_INCREMENT_SECONDS as l, eventForTokenError as m, ApprovalState as n, PollContext as o, canTransitionPoll as p, GrantEvent as r, PollEvent as s, ApprovalEvent as t, approvalTransition as u, isPollSettled as v, pollContextTransition as y };
+//# sourceMappingURL=machine-CRHKjtoP.d.mts.map

package/dist/machine-CRHKjtoP.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-CRHKjtoP.d.mts","names":[],"sources":["../src/machine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KA2BY;;KAQA;;;EAEN;EAAiB;;;;EAEjB;;;;EAEA;;;;EAEA;;;cA+BO,qBACX,OAAO,YACP,OAAO;;;;;cAOI,kBACX,OAAO,YACP,OAAO,eACN;;cAGU,iBAAkB,OAAO;;;;;;;;KAY1B;;;;;;;KAeA;EACN;;EACA;;EACA;;EACA;;EACA;;EACA;;;;EAEA;;;;EAEA;;;;EAEA;;;;EAEA;;;;;;;;;UAoCW;;EAEf;;EAEA;;EAEA;;cAGW,oBACX,OAAO,WACP,OAAO;cAGI,iBAAkB,OAAO,WAAW,OAAO,cAAY;cAGvD,gBAAiB,OAAO;;;;;;;;;cAWxB,wBACX,SAAS,aACT,OAAO,cACN;;cAoCU;;cAGA;;;;;;;;;cAUA,qBAAsB,8BAA4B;;;;;;;;;;;;;;KAgCnD;;;;;;;;;;;;;KAiBA;;;EAEN;;;;EAEA;EAAc;;;;EAEd;;;;EAEA;;;;EAEA;;;;EAEA;;;;EAEA;;;;EAEA;;;;EAEA;EAAmB;;;;EAEnB;;;;EAEA;;cA6CO,wBACX,OAAO,eACP,OAAO;;;;;;;;cAUI,qBACX,OAAO,eACP,OAAO,kBACN;cAOU,oBAAqB,OAAO"}

package/dist/machine-D_5DAFxi.mjs

@@ -0,0 +1,155 @@
+//#region src/machine.ts
+/**
+* Transitions, as a table.
+*
+* Read this against RFC 8628 §3.3–3.5: every legal move is one entry, and
+* anything absent is illegal by construction. An event with no entry for the
+* current state is a no-op — which is what makes double-approval, approving an
+* expired grant, and re-redeeming a consumed one all impossible without a
+* scattering of guard clauses.
+*/
+const GRANT_TRANSITIONS = {
+	pending: {
+		APPROVE: `approved`,
+		DENY: `denied`,
+		EXPIRE: `expired`
+	},
+	approved: {
+		REDEEM: `consumed`,
+		EXPIRE: `expired`
+	}
+};
+/** Whether `event` is legal in `state`. */
+const canTransitionGrant = (state, event) => GRANT_TRANSITIONS[state]?.[event] !== void 0;
+/**
+* Pure grant reducer. Returns the same state when the event is illegal, so
+* callers can compare identity to detect a rejected transition.
+*/
+const grantTransition = (state, event) => GRANT_TRANSITIONS[state]?.[event.type] ?? state;
+/** Terminal states accept no further events. */
+const isGrantSettled = (state) => GRANT_TRANSITIONS[state] === void 0;
+const POLL_TRANSITIONS = {
+	idle: {
+		START: `waiting`,
+		ABORT: `aborted`
+	},
+	waiting: {
+		TICK: `polling`,
+		DEADLINE: `expired`,
+		ABORT: `aborted`
+	},
+	polling: {
+		AUTHORIZATION_PENDING: `waiting`,
+		SLOW_DOWN: `waiting`,
+		NETWORK_ERROR: `waiting`,
+		SUCCESS: `authorized`,
+		ACCESS_DENIED: `denied`,
+		EXPIRED_TOKEN: `expired`,
+		DEADLINE: `expired`,
+		ABORT: `aborted`
+	}
+};
+const canTransitionPoll = (state, event) => POLL_TRANSITIONS[state]?.[event] !== void 0;
+const pollTransition = (state, event) => POLL_TRANSITIONS[state]?.[event.type] ?? state;
+const isPollSettled = (state) => POLL_TRANSITIONS[state] === void 0;
+/**
+* Context reducer, pure and separate from the state reducer.
+*
+* The two interval rules live here together, which is the point: `SLOW_DOWN`
+* is a fixed +5s per RFC 8628 §3.5 ("increased by 5 seconds for this and all
+* subsequent requests"), while `NETWORK_ERROR` doubles. Conflating them is the
+* easy mistake, and side-by-side they cannot be confused.
+*/
+const pollContextTransition = (context, event) => {
+	switch (event.type) {
+		case `SLOW_DOWN`: return {
+			...context,
+			intervalSeconds: context.intervalSeconds + 5,
+			attempts: context.attempts + 1
+		};
+		case `NETWORK_ERROR`: return {
+			...context,
+			intervalSeconds: Math.min(context.intervalSeconds * 2, 60),
+			attempts: context.attempts + 1
+		};
+		case `AUTHORIZATION_PENDING`: return {
+			...context,
+			attempts: context.attempts + 1
+		};
+		case `START`:
+		case `TICK`:
+		case `SUCCESS`:
+		case `ACCESS_DENIED`:
+		case `EXPIRED_TOKEN`:
+		case `DEADLINE`:
+		case `ABORT`: return context;
+	}
+};
+/** RFC 8628 §3.5: `slow_down` adds exactly this many seconds, permanently. */
+const SLOW_DOWN_INCREMENT_SECONDS = 5;
+/** Ceiling for network backoff, so a long outage cannot stall the flow. */
+const MAX_BACKOFF_SECONDS = 60;
+/**
+* Map a token-endpoint response's `error` field to a poll event.
+*
+* `undefined` means success. An unrecognized code maps to
+* `AUTHORIZATION_PENDING` rather than success or failure: an unknown code is
+* not evidence the user decided anything, and the deadline still bounds the
+* loop. Treating it as success would sign the device in on a garbage payload.
+*/
+const eventForTokenError = (error) => {
+	switch (error) {
+		case void 0: return { type: `SUCCESS` };
+		case `authorization_pending`: return { type: `AUTHORIZATION_PENDING` };
+		case `slow_down`: return { type: `SLOW_DOWN` };
+		case `access_denied`: return { type: `ACCESS_DENIED` };
+		case `expired_token`: return { type: `EXPIRED_TOKEN` };
+		default: return { type: `AUTHORIZATION_PENDING` };
+	}
+};
+const APPROVAL_TRANSITIONS = {
+	idle: {
+		SCAN: `scanning`,
+		CODE: `resolving`
+	},
+	scanning: {
+		CODE: `resolving`,
+		ERROR: `failed`,
+		RESET: `idle`
+	},
+	resolving: {
+		RESOLVED: `confirming`,
+		REJECTED: `invalid`,
+		ERROR: `failed`
+	},
+	confirming: {
+		CONFIRMED: `confirming`,
+		CHALLENGE_FAILED: `confirming`,
+		APPROVE: `submitting`,
+		DENY: `submitting`,
+		RESET: `idle`
+	},
+	submitting: {
+		SUBMITTED: `approved`,
+		ERROR: `failed`
+	},
+	failed: { RESET: `idle` },
+	invalid: { RESET: `idle` }
+};
+const canTransitionApproval = (state, event) => APPROVAL_TRANSITIONS[state]?.[event] !== void 0;
+/**
+* Pure approval reducer.
+*
+* `SUBMITTED` is the one event whose target depends on its payload — the same
+* transition lands on `approved` or `denied` according to what the user chose,
+* so the table's entry is overridden here.
+*/
+const approvalTransition = (state, event) => {
+	if (event.type === `SUBMITTED` && state === `submitting`) return event.approved ? `approved` : `denied`;
+	return APPROVAL_TRANSITIONS[state]?.[event.type] ?? state;
+};
+const isApprovalSettled = (state) => APPROVAL_TRANSITIONS[state] === void 0;
+//#endregion
+export { canTransitionGrant as a, grantTransition as c, isPollSettled as d, pollContextTransition as f, canTransitionApproval as i, isApprovalSettled as l, SLOW_DOWN_INCREMENT_SECONDS as n, canTransitionPoll as o, pollTransition as p, approvalTransition as r, eventForTokenError as s, MAX_BACKOFF_SECONDS as t, isGrantSettled as u };
+
+//# sourceMappingURL=machine-D_5DAFxi.mjs.map

package/dist/machine-D_5DAFxi.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-D_5DAFxi.mjs","names":[],"sources":["../src/machine.ts"],"sourcesContent":["/**\n * The device-authorization flow as two explicit state machines.\n *\n * Modeled the way xstate would model it — states, events, and a declarative\n * transition table — but hand-rolled on WinterTC primitives so the library\n * stays dependency-free. What we keep from that shape is the part that pays:\n * transitions are DATA, readable in one place and checkable against RFC 8628\n * side by side, rather than control flow scattered across functions.\n *\n * What we deliberately omit is the actor/service layer. Nothing here needs to\n * observe transitions from outside, and an interpreter abstraction for a\n * single consumer would be weight without benefit.\n *\n * Side effects live outside: these reducers are pure, and the classes in\n * `server.ts` / `client/index.ts` own the I/O and the state itself.\n */\n\n/* ────────────────────────────  Grant machine  ──────────────────────────── */\n\n/**\n * Server-side lifecycle of one authorization attempt.\n *\n * `pending` is the only non-terminal state. `consumed` is distinct from\n * `approved` because approval is not what ends the flow — redemption is. A\n * device_code that stayed redeemable after approval would be a replayable\n * bearer credential.\n */\nexport type GrantState =\n  | `pending`\n  | `approved`\n  | `denied`\n  | `expired`\n  | `consumed`;\n\n/** Events that can move a grant. */\nexport type GrantEvent =\n  /** The user authorized on their phone. Carries who they are. */\n  | { type: `APPROVE`; subject: string }\n  /** The user refused. */\n  | { type: `DENY` }\n  /** The deadline passed. Raised on read, not by a timer — see `server.ts`. */\n  | { type: `EXPIRE` }\n  /** The device redeemed its approval. Terminal. */\n  | { type: `REDEEM` };\n\n/**\n * Transitions, as a table.\n *\n * Read this against RFC 8628 §3.3–3.5: every legal move is one entry, and\n * anything absent is illegal by construction. An event with no entry for the\n * current state is a no-op — which is what makes double-approval, approving an\n * expired grant, and re-redeeming a consumed one all impossible without a\n * scattering of guard clauses.\n */\nconst GRANT_TRANSITIONS: {\n  readonly [S in GrantState]?: {\n    readonly [E in GrantEvent[`type`]]?: GrantState;\n  };\n} = {\n  pending: {\n    APPROVE: `approved`,\n    DENY: `denied`,\n    EXPIRE: `expired`\n  },\n  // Approved grants still expire: an approval nobody collected before the\n  // deadline must not stay redeemable indefinitely.\n  approved: {\n    REDEEM: `consumed`,\n    EXPIRE: `expired`\n  }\n  // denied, expired, consumed: terminal. No entry, so no event moves them.\n};\n\n/** Whether `event` is legal in `state`. */\nexport const canTransitionGrant = (\n  state: GrantState,\n  event: GrantEvent[`type`]\n): boolean => GRANT_TRANSITIONS[state]?.[event] !== undefined;\n\n/**\n * Pure grant reducer. Returns the same state when the event is illegal, so\n * callers can compare identity to detect a rejected transition.\n */\nexport const grantTransition = (\n  state: GrantState,\n  event: GrantEvent\n): GrantState => GRANT_TRANSITIONS[state]?.[event.type] ?? state;\n\n/** Terminal states accept no further events. */\nexport const isGrantSettled = (state: GrantState): boolean =>\n  GRANT_TRANSITIONS[state] === undefined;\n\n/* ────────────────────────────  Poll machine  ───────────────────────────── */\n\n/**\n * Device-side polling lifecycle.\n *\n * States mirror what the screen is doing, so a UI can render directly from\n * them: `waiting` is the gap between polls, `polling` is a request in flight.\n * The three terminal states are the outcomes the screen must show.\n */\nexport type PollState =\n  | `idle`\n  | `waiting`\n  | `polling`\n  | `authorized`\n  | `denied`\n  | `expired`\n  | `aborted`;\n\n/**\n * Events driving the poll loop.\n *\n * The four RFC error codes appear verbatim as event types so the mapping from\n * a token-endpoint response to a transition needs no translation layer.\n */\nexport type PollEvent =\n  | { type: `START` }\n  | { type: `TICK` }\n  | { type: `AUTHORIZATION_PENDING` }\n  | { type: `SLOW_DOWN` }\n  | { type: `ACCESS_DENIED` }\n  | { type: `EXPIRED_TOKEN` }\n  /** A response with no `error` — the grant was redeemed. */\n  | { type: `SUCCESS` }\n  /** Network failure. Distinct from SLOW_DOWN: congestion, not policy. */\n  | { type: `NETWORK_ERROR` }\n  /** The client's own deadline elapsed. */\n  | { type: `DEADLINE` }\n  /** The screen was dismissed. */\n  | { type: `ABORT` };\n\nconst POLL_TRANSITIONS: {\n  readonly [S in PollState]?: { readonly [E in PollEvent[`type`]]?: PollState };\n} = {\n  idle: {\n    START: `waiting`,\n    ABORT: `aborted`\n  },\n  waiting: {\n    TICK: `polling`,\n    DEADLINE: `expired`,\n    ABORT: `aborted`\n  },\n  polling: {\n    // Back to waiting: these three mean \"keep going\", differing only in how\n    // long the next wait is — which is context, not state.\n    AUTHORIZATION_PENDING: `waiting`,\n    SLOW_DOWN: `waiting`,\n    NETWORK_ERROR: `waiting`,\n    SUCCESS: `authorized`,\n    ACCESS_DENIED: `denied`,\n    EXPIRED_TOKEN: `expired`,\n    DEADLINE: `expired`,\n    ABORT: `aborted`\n  }\n  // authorized, denied, expired, aborted: terminal.\n};\n\n/**\n * Context carried alongside the poll state.\n *\n * Separate from the state itself, exactly as xstate separates finite state\n * from extended state: the interval changes constantly but is not a state —\n * `waiting` at 5s and `waiting` at 20s are the same state, different context.\n */\nexport interface PollContext {\n  /** Current wait between polls, in seconds. */\n  intervalSeconds: number;\n  /** Epoch ms after which the flow is over regardless of the server. */\n  deadline: number;\n  /** Polls attempted. Useful for UI (\"still waiting…\") and diagnostics. */\n  attempts: number;\n}\n\nexport const canTransitionPoll = (\n  state: PollState,\n  event: PollEvent[`type`]\n): boolean => POLL_TRANSITIONS[state]?.[event] !== undefined;\n\nexport const pollTransition = (state: PollState, event: PollEvent): PollState =>\n  POLL_TRANSITIONS[state]?.[event.type] ?? state;\n\nexport const isPollSettled = (state: PollState): boolean =>\n  POLL_TRANSITIONS[state] === undefined;\n\n/**\n * Context reducer, pure and separate from the state reducer.\n *\n * The two interval rules live here together, which is the point: `SLOW_DOWN`\n * is a fixed +5s per RFC 8628 §3.5 (\"increased by 5 seconds for this and all\n * subsequent requests\"), while `NETWORK_ERROR` doubles. Conflating them is the\n * easy mistake, and side-by-side they cannot be confused.\n */\nexport const pollContextTransition = (\n  context: PollContext,\n  event: PollEvent\n): PollContext => {\n  switch (event.type) {\n    case `SLOW_DOWN`:\n      // Additive and sticky. Never reset on a later success.\n      return {\n        ...context,\n        intervalSeconds: context.intervalSeconds + SLOW_DOWN_INCREMENT_SECONDS,\n        attempts: context.attempts + 1\n      };\n    case `NETWORK_ERROR`:\n      // Exponential, capped. The spec recommends backoff for connection\n      // failures specifically, as distinct from the server's pacing signal.\n      return {\n        ...context,\n        intervalSeconds: Math.min(\n          context.intervalSeconds * 2,\n          MAX_BACKOFF_SECONDS\n        ),\n        attempts: context.attempts + 1\n      };\n    case `AUTHORIZATION_PENDING`:\n      return { ...context, attempts: context.attempts + 1 };\n    // Lifecycle and terminal events carry no cadence change: the interval a\n    // flow ended on is not information anyone needs afterwards.\n    case `START`:\n    case `TICK`:\n    case `SUCCESS`:\n    case `ACCESS_DENIED`:\n    case `EXPIRED_TOKEN`:\n    case `DEADLINE`:\n    case `ABORT`:\n      return context;\n  }\n};\n\n/** RFC 8628 §3.5: `slow_down` adds exactly this many seconds, permanently. */\nexport const SLOW_DOWN_INCREMENT_SECONDS = 5;\n\n/** Ceiling for network backoff, so a long outage cannot stall the flow. */\nexport const MAX_BACKOFF_SECONDS = 60;\n\n/**\n * Map a token-endpoint response's `error` field to a poll event.\n *\n * `undefined` means success. An unrecognized code maps to\n * `AUTHORIZATION_PENDING` rather than success or failure: an unknown code is\n * not evidence the user decided anything, and the deadline still bounds the\n * loop. Treating it as success would sign the device in on a garbage payload.\n */\nexport const eventForTokenError = (error: string | undefined): PollEvent => {\n  switch (error) {\n    case undefined:\n      return { type: `SUCCESS` };\n    case `authorization_pending`:\n      return { type: `AUTHORIZATION_PENDING` };\n    case `slow_down`:\n      return { type: `SLOW_DOWN` };\n    case `access_denied`:\n      return { type: `ACCESS_DENIED` };\n    case `expired_token`:\n      return { type: `EXPIRED_TOKEN` };\n    default:\n      return { type: `AUTHORIZATION_PENDING` };\n  }\n};\n\n/* ──────────────────────────  Approval machine  ─────────────────────────── */\n\n/**\n * The approving device's lifecycle — the third participant in the flow.\n *\n * Runs on the phone that is ALREADY authenticated. Two ways in, as the\n * ecosystem shows: Plex hands the OS camera a URL and the user lands in a\n * browser (`scanning` is skipped, the code arrives from the query string),\n * while Discord and Steam scan inside their own app and never leave it.\n *\n * `confirming` exists because approving must not be one tap on an unverified\n * code. RFC 8628 §5.4 asks the user to check that the code matches the screen\n * in front of them; that check is the only defense against a phished QR\n * pointing at an attacker's device.\n */\nexport type ApprovalState =\n  | `idle`\n  /** Camera open, looking for a code. Skipped when arriving by URL. */\n  | `scanning`\n  /** A code was read or typed; asking the server what it belongs to. */\n  | `resolving`\n  /** Server knows the grant. Running the challenge before approve/deny. */\n  | `confirming`\n  /** Sending the decision. */\n  | `submitting`\n  | `approved`\n  | `denied`\n  /** The grant was already expired, consumed, or unknown. */\n  | `invalid`\n  /** Camera or network failure. Recoverable — the user can retry. */\n  | `failed`;\n\nexport type ApprovalEvent =\n  /** Open the scanner (in-app path). */\n  | { type: `SCAN` }\n  /** A code arrived — scanned, typed, or read from the URL. */\n  | { type: `CODE`; userCode: string }\n  /** The server resolved the code to a live grant. */\n  | { type: `RESOLVED` }\n  /** The server did not recognize the code, or it is no longer live. */\n  | { type: `REJECTED` }\n  /** The challenge passed — the user proved they are looking at the screen. */\n  | { type: `CONFIRMED` }\n  /** The challenge failed. Back to confirming so the user can retry. */\n  | { type: `CHALLENGE_FAILED` }\n  /** The user chose to approve. */\n  | { type: `APPROVE` }\n  /** The user chose to refuse. */\n  | { type: `DENY` }\n  /** The server accepted the decision. */\n  | { type: `SUBMITTED`; approved: boolean }\n  /** Camera or network failure. */\n  | { type: `ERROR` }\n  /** Start over after a failure or an invalid code. */\n  | { type: `RESET` };\n\nconst APPROVAL_TRANSITIONS: {\n  readonly [S in ApprovalState]?: {\n    readonly [E in ApprovalEvent[`type`]]?: ApprovalState;\n  };\n} = {\n  idle: {\n    SCAN: `scanning`,\n    // No SCAN first: this is the Plex path, where the code came from the URL\n    // and there is no camera step at all.\n    CODE: `resolving`\n  },\n  scanning: {\n    CODE: `resolving`,\n    ERROR: `failed`,\n    RESET: `idle`\n  },\n  resolving: {\n    RESOLVED: `confirming`,\n    REJECTED: `invalid`,\n    ERROR: `failed`\n  },\n  confirming: {\n    CONFIRMED: `confirming`,\n    // Stays put: a wrong code or a failed biometric is a retry, not a dead\n    // end. The host decides how many attempts to allow.\n    CHALLENGE_FAILED: `confirming`,\n    APPROVE: `submitting`,\n    DENY: `submitting`,\n    RESET: `idle`\n  },\n  submitting: {\n    SUBMITTED: `approved`,\n    ERROR: `failed`\n  },\n  failed: {\n    RESET: `idle`\n  },\n  invalid: {\n    RESET: `idle`\n  }\n  // approved, denied: terminal.\n};\n\nexport const canTransitionApproval = (\n  state: ApprovalState,\n  event: ApprovalEvent[`type`]\n): boolean => APPROVAL_TRANSITIONS[state]?.[event] !== undefined;\n\n/**\n * Pure approval reducer.\n *\n * `SUBMITTED` is the one event whose target depends on its payload — the same\n * transition lands on `approved` or `denied` according to what the user chose,\n * so the table's entry is overridden here.\n */\nexport const approvalTransition = (\n  state: ApprovalState,\n  event: ApprovalEvent\n): ApprovalState => {\n  if (event.type === `SUBMITTED` && state === `submitting`) {\n    return event.approved ? `approved` : `denied`;\n  }\n  return APPROVAL_TRANSITIONS[state]?.[event.type] ?? state;\n};\n\nexport const isApprovalSettled = (state: ApprovalState): boolean =>\n  APPROVAL_TRANSITIONS[state] === undefined;\n"],"mappings":";;;;;;;;;;AAsDA,MAAM,oBAIF;CACF,SAAS;EACP,SAAS;EACT,MAAM;EACN,QAAQ;CACV;CAGA,UAAU;EACR,QAAQ;EACR,QAAQ;CACV;AAEF;;AAGA,MAAa,sBACX,OACA,UACY,kBAAkB,MAAM,GAAG,WAAW,KAAA;;;;;AAMpD,MAAa,mBACX,OACA,UACe,kBAAkB,MAAM,GAAG,MAAM,SAAS;;AAG3D,MAAa,kBAAkB,UAC7B,kBAAkB,WAAW,KAAA;AA0C/B,MAAM,mBAEF;CACF,MAAM;EACJ,OAAO;EACP,OAAO;CACT;CACA,SAAS;EACP,MAAM;EACN,UAAU;EACV,OAAO;CACT;CACA,SAAS;EAGP,uBAAuB;EACvB,WAAW;EACX,eAAe;EACf,SAAS;EACT,eAAe;EACf,eAAe;EACf,UAAU;EACV,OAAO;CACT;AAEF;AAkBA,MAAa,qBACX,OACA,UACY,iBAAiB,MAAM,GAAG,WAAW,KAAA;AAEnD,MAAa,kBAAkB,OAAkB,UAC/C,iBAAiB,MAAM,GAAG,MAAM,SAAS;AAE3C,MAAa,iBAAiB,UAC5B,iBAAiB,WAAW,KAAA;;;;;;;;;AAU9B,MAAa,yBACX,SACA,UACgB;CAChB,QAAQ,MAAM,MAAd;EACE,KAAK,aAEH,OAAO;GACL,GAAG;GACH,iBAAiB,QAAQ,kBAAA;GACzB,UAAU,QAAQ,WAAW;EAC/B;EACF,KAAK,iBAGH,OAAO;GACL,GAAG;GACH,iBAAiB,KAAK,IACpB,QAAQ,kBAAkB,GAAA,EAE5B;GACA,UAAU,QAAQ,WAAW;EAC/B;EACF,KAAK,yBACH,OAAO;GAAE,GAAG;GAAS,UAAU,QAAQ,WAAW;EAAE;EAGtD,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,SACH,OAAO;CACX;AACF;;AAGA,MAAa,8BAA8B;;AAG3C,MAAa,sBAAsB;;;;;;;;;AAUnC,MAAa,sBAAsB,UAAyC;CAC1E,QAAQ,OAAR;EACE,KAAK,KAAA,GACH,OAAO,EAAE,MAAM,UAAU;EAC3B,KAAK,yBACH,OAAO,EAAE,MAAM,wBAAwB;EACzC,KAAK,aACH,OAAO,EAAE,MAAM,YAAY;EAC7B,KAAK,iBACH,OAAO,EAAE,MAAM,gBAAgB;EACjC,KAAK,iBACH,OAAO,EAAE,MAAM,gBAAgB;EACjC,SACE,OAAO,EAAE,MAAM,wBAAwB;CAC3C;AACF;AA0DA,MAAM,uBAIF;CACF,MAAM;EACJ,MAAM;EAGN,MAAM;CACR;CACA,UAAU;EACR,MAAM;EACN,OAAO;EACP,OAAO;CACT;CACA,WAAW;EACT,UAAU;EACV,UAAU;EACV,OAAO;CACT;CACA,YAAY;EACV,WAAW;EAGX,kBAAkB;EAClB,SAAS;EACT,MAAM;EACN,OAAO;CACT;CACA,YAAY;EACV,WAAW;EACX,OAAO;CACT;CACA,QAAQ,EACN,OAAO,OACT;CACA,SAAS,EACP,OAAO,OACT;AAEF;AAEA,MAAa,yBACX,OACA,UACY,qBAAqB,MAAM,GAAG,WAAW,KAAA;;;;;;;;AASvD,MAAa,sBACX,OACA,UACkB;CAClB,IAAI,MAAM,SAAS,eAAe,UAAU,cAC1C,OAAO,MAAM,WAAW,aAAa;CAEvC,OAAO,qBAAqB,MAAM,GAAG,MAAM,SAAS;AACtD;AAEA,MAAa,qBAAqB,UAChC,qBAAqB,WAAW,KAAA"}

package/dist/qr.d.mts

@@ -0,0 +1,58 @@
+//#region src/qr.d.ts
+/**
+ * QR rendering for the device screen.
+ *
+ * A thin, opinionated wrapper over `etiket` — the defaults here exist because
+ * this QR is scanned off a TV from across a room, which is a harsher case than
+ * the usual on-screen QR.
+ */
+interface DeviceQrOptions {
+  /** Rendered edge length in px. Large by default: TVs are viewed from far away. */
+  size?: number;
+  /**
+   * Error-correction level. Defaults to `M`.
+   *
+   * NOT `H`, despite the instinct to max it out. Higher correction adds modules
+   * to encode the same URL, so at a fixed pixel size each module gets smaller —
+   * on a 1080p panel viewed from 3m, denser modules hurt scan rate more than
+   * damage-tolerance helps. A TV screen is clean and unscuffed; `M` is the
+   * right trade. Raise it only if you overlay a logo.
+   */
+  ecLevel?: `L` | `M` | `Q` | `H`;
+  /** Foreground. Must stay dark-on-light for reliable scanning. */
+  color?: string;
+  /**
+   * Background. Keep it opaque and light.
+   *
+   * Do not make this transparent to sit the QR on a dark or photographic
+   * backdrop — scanners need the quiet zone to contrast with the modules.
+   *
+   * Inverting (light modules on a dark ground, as Plex does) is a constraint
+   * on READERS, and is not a contrast question — an inverted symbol can sit
+   * at 10:1 and still be unreadable. Many decoders binarize assuming dark
+   * modules on a light ground and never try the opposite: jsQR, the engine
+   * behind qr-scanner, defaults its live camera path to `dontInvert`, so an
+   * inverted symbol decodes as nothing at all while the camera looks
+   * perfectly healthy. Apple's detector tries both, so the iOS camera reads
+   * what your own scanner cannot — which makes this look like a broken
+   * scanner rather than a polarity mismatch.
+   *
+   * So invert deliberately, not by accident: it is fine when you control the
+   * readers and have configured them for it (see `setInversionMode`), and a
+   * silent failure when you have not.
+   */
+  background?: string;
+  /** Quiet-zone width in modules. The spec minimum is 4; do not go below it. */
+  margin?: number;
+}
+/**
+ * Render `verification_uri_complete` as an SVG string.
+ *
+ * SVG rather than PNG so it scales to any panel without resampling, and so it
+ * can be inlined into the page with no extra request — which matters on a Fire
+ * TV / Pi-class device where every fetch is expensive.
+ */
+declare const renderDeviceQr: (verificationUriComplete: string, { size, ecLevel, color, background, margin }?: DeviceQrOptions) => string;
+//#endregion
+export { DeviceQrOptions, renderDeviceQr };
+//# sourceMappingURL=qr.d.mts.map

package/dist/qr.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr.d.mts","names":[],"sources":["../src/qr.ts"],"mappings":";;;;;;;;UAaiB;;EAEf;;;;;;;;;;EAUA;;EAEA;;;;;;;;;;;;;;;;;;;;;EAqBA;;EAEA;;;;;;;;;cAUW,iBACX,mCACA,MAAA,SAAA,OAAA,YAAA,WAMG"}

package/dist/qr.mjs

@@ -0,0 +1,27 @@
+import { qrcode } from "etiket/qr";
+//#region src/qr.ts
+/**
+* QR rendering for the device screen.
+*
+* A thin, opinionated wrapper over `etiket` — the defaults here exist because
+* this QR is scanned off a TV from across a room, which is a harsher case than
+* the usual on-screen QR.
+*/
+/**
+* Render `verification_uri_complete` as an SVG string.
+*
+* SVG rather than PNG so it scales to any panel without resampling, and so it
+* can be inlined into the page with no extra request — which matters on a Fire
+* TV / Pi-class device where every fetch is expensive.
+*/
+const renderDeviceQr = (verificationUriComplete, { size = 512, ecLevel = `M`, color = `#000000`, background = `#ffffff`, margin = 4 } = {}) => qrcode(verificationUriComplete, {
+	size,
+	ecLevel,
+	color,
+	background,
+	margin
+});
+//#endregion
+export { renderDeviceQr };
+
+//# sourceMappingURL=qr.mjs.map

package/dist/qr.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr.mjs","names":[],"sources":["../src/qr.ts"],"sourcesContent":["/**\n * QR rendering for the device screen.\n *\n * A thin, opinionated wrapper over `etiket` — the defaults here exist because\n * this QR is scanned off a TV from across a room, which is a harsher case than\n * the usual on-screen QR.\n */\n\n// etiket's QR subpath, not its barrel: the barrel re-exports every symbology\n// it supports (Aztec, PDF417, DataMatrix, postal), and pulling those into a\n// consumer's graph to draw one QR relies on their bundler shaking perfectly.\nimport { qrcode } from \"etiket/qr\";\n\nexport interface DeviceQrOptions {\n  /** Rendered edge length in px. Large by default: TVs are viewed from far away. */\n  size?: number;\n  /**\n   * Error-correction level. Defaults to `M`.\n   *\n   * NOT `H`, despite the instinct to max it out. Higher correction adds modules\n   * to encode the same URL, so at a fixed pixel size each module gets smaller —\n   * on a 1080p panel viewed from 3m, denser modules hurt scan rate more than\n   * damage-tolerance helps. A TV screen is clean and unscuffed; `M` is the\n   * right trade. Raise it only if you overlay a logo.\n   */\n  ecLevel?: `L` | `M` | `Q` | `H`;\n  /** Foreground. Must stay dark-on-light for reliable scanning. */\n  color?: string;\n  /**\n   * Background. Keep it opaque and light.\n   *\n   * Do not make this transparent to sit the QR on a dark or photographic\n   * backdrop — scanners need the quiet zone to contrast with the modules.\n   *\n   * Inverting (light modules on a dark ground, as Plex does) is a constraint\n   * on READERS, and is not a contrast question — an inverted symbol can sit\n   * at 10:1 and still be unreadable. Many decoders binarize assuming dark\n   * modules on a light ground and never try the opposite: jsQR, the engine\n   * behind qr-scanner, defaults its live camera path to `dontInvert`, so an\n   * inverted symbol decodes as nothing at all while the camera looks\n   * perfectly healthy. Apple's detector tries both, so the iOS camera reads\n   * what your own scanner cannot — which makes this look like a broken\n   * scanner rather than a polarity mismatch.\n   *\n   * So invert deliberately, not by accident: it is fine when you control the\n   * readers and have configured them for it (see `setInversionMode`), and a\n   * silent failure when you have not.\n   */\n  background?: string;\n  /** Quiet-zone width in modules. The spec minimum is 4; do not go below it. */\n  margin?: number;\n}\n\n/**\n * Render `verification_uri_complete` as an SVG string.\n *\n * SVG rather than PNG so it scales to any panel without resampling, and so it\n * can be inlined into the page with no extra request — which matters on a Fire\n * TV / Pi-class device where every fetch is expensive.\n */\nexport const renderDeviceQr = (\n  verificationUriComplete: string,\n  {\n    size = 512,\n    ecLevel = `M`,\n    color = `#000000`,\n    background = `#ffffff`,\n    margin = 4\n  }: DeviceQrOptions = {}\n): string =>\n  qrcode(verificationUriComplete, {\n    size,\n    ecLevel,\n    color,\n    background,\n    margin\n  });\n"],"mappings":";;;;;;;;;;;;;;;;AA4DA,MAAa,kBACX,yBACA,EACE,OAAO,KACP,UAAU,KACV,QAAQ,WACR,aAAa,WACb,SAAS,MACU,CAAC,MAEtB,OAAO,yBAAyB;CAC9B;CACA;CACA;CACA;CACA;AACF,CAAC"}