@spfn/auth 0.3.0-beta.26 → 0.3.0-beta.28

package/dist/index.js

@@ -191,6 +191,57 @@ var DeviceAuthDeniedError = class extends ForbiddenError {
     this.name = "DeviceAuthDeniedError";
   }
 };
+var DeviceLinkNotFoundError = class extends NotFoundError {
+  constructor(data = {}) {
+    super({ message: data.message || "Device link not found", details: data.details });
+    this.name = "DeviceLinkNotFoundError";
+  }
+};
+var DeviceLinkExpiredError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This link code has expired. Show a new code on the signed-in device.",
+      details: data.details
+    });
+    this.name = "DeviceLinkExpiredError";
+  }
+};
+var DeviceLinkNotRedeemedError = class extends ConflictError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "No device has used this link code yet",
+      details: data.details
+    });
+    this.name = "DeviceLinkNotRedeemedError";
+  }
+};
+var DeviceLinkAlreadyHandledError = class extends ConflictError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This device link has already been answered",
+      details: data.details
+    });
+    this.name = "DeviceLinkAlreadyHandledError";
+  }
+};
+var DeviceLinkWrongMatchError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "That is not the number on the new device. The link was refused; show a new code to try again.",
+      details: data.details
+    });
+    this.name = "DeviceLinkWrongMatchError";
+  }
+};
+var DeviceLinkDeniedError = class extends ForbiddenError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This device link was denied",
+      details: data.details
+    });
+    this.name = "DeviceLinkDeniedError";
+  }
+};
 var NonceKeyBindingError = class extends ValidationError {
   constructor(data = {}) {
     super({
@@ -569,6 +620,12 @@ authErrorRegistry.append([
   DeviceAuthExpiredError,
   DeviceAuthAlreadyHandledError,
   DeviceAuthDeniedError,
+  DeviceLinkNotFoundError,
+  DeviceLinkExpiredError,
+  DeviceLinkNotRedeemedError,
+  DeviceLinkAlreadyHandledError,
+  DeviceLinkWrongMatchError,
+  DeviceLinkDeniedError,
   VerificationTokenPurposeMismatchError,
   VerificationTokenTargetMismatchError,
   InsufficientPermissionsError,
@@ -606,59 +663,56 @@ var routeMap = {
   requestSignupLink: { method: "POST", path: "/_auth/signup/email" },
   confirmSignupLink: { method: "POST", path: "/_auth/signup/email/confirm" },
   completeSignup: { method: "POST", path: "/_auth/signup/password" },
+  requestPasswordReset: { method: "POST", path: "/_auth/password/reset" },
+  confirmPasswordReset: { method: "POST", path: "/_auth/password/reset/confirm" },
+  completePasswordReset: { method: "POST", path: "/_auth/password/reset/complete" },
   login: { method: "POST", path: "/_auth/login" },
   startDeviceAuth: { method: "POST", path: "/_auth/device/start" },
   pollDeviceAuth: { method: "POST", path: "/_auth/device/poll" },
   getDeviceAuthInfo: { method: "POST", path: "/_auth/device/info" },
   approveDeviceAuth: { method: "POST", path: "/_auth/device/approve" },
   denyDeviceAuth: { method: "POST", path: "/_auth/device/deny" },
-  logout: { method: "POST", path: "/_auth/logout" },
-  rotateKey: { method: "POST", path: "/_auth/keys/rotate" },
-  listKeys: { method: "POST", path: "/_auth/keys/list" },
-  revokeKey: { method: "POST", path: "/_auth/keys/revoke" },
-  revokeAllKeys: { method: "POST", path: "/_auth/keys/revoke-all" },
-  changePassword: { method: "PUT", path: "/_auth/password" },
-  getAuthSession: { method: "GET", path: "/_auth/session" },
-  issueOneTimeToken: { method: "POST", path: "/_auth/tokens" },
-  requestPasswordReset: { method: "POST", path: "/_auth/password/reset" },
-  confirmPasswordReset: { method: "POST", path: "/_auth/password/reset/confirm" },
-  completePasswordReset: { method: "POST", path: "/_auth/password/reset/complete" },
-  confirmRevokeAllLink: { method: "POST", path: "/_auth/keys/revoke-all/confirm" },
-  consumeRevokeAllLink: { method: "POST", path: "/_auth/keys/revoke-all/consume" },
+  issueDeviceLink: { method: "POST", path: "/_auth/device/link/issue" },
+  redeemDeviceLink: { method: "POST", path: "/_auth/device/link/redeem" },
+  getDeviceLinkStatus: { method: "POST", path: "/_auth/device/link/status" },
+  confirmDeviceLink: { method: "POST", path: "/_auth/device/link/confirm" },
+  denyDeviceLink: { method: "POST", path: "/_auth/device/link/deny" },
+  cancelDeviceLink: { method: "POST", path: "/_auth/device/link/cancel" },
+  pollDeviceLink: { method: "POST", path: "/_auth/device/link/poll" },
+  passkeyRegisterOptions: { method: "POST", path: "/_auth/passkeys/register/options" },
+  passkeyRegisterVerify: { method: "POST", path: "/_auth/passkeys/register/verify" },
+  passkeyLoginOptions: { method: "POST", path: "/_auth/passkeys/login/options" },
+  passkeyLoginVerify: { method: "POST", path: "/_auth/passkeys/login/verify" },
+  listPasskeys: { method: "POST", path: "/_auth/passkeys/list" },
+  renamePasskey: { method: "POST", path: "/_auth/passkeys/rename" },
+  revokePasskey: { method: "POST", path: "/_auth/passkeys/revoke" },
   mfaTotpEnroll: { method: "POST", path: "/_auth/mfa/totp/enroll" },
   mfaTotpConfirm: { method: "POST", path: "/_auth/mfa/totp/confirm" },
   mfaDisable: { method: "POST", path: "/_auth/mfa/disable" },
   mfaMarkPasskey: { method: "POST", path: "/_auth/mfa/passkey/mark" },
   mfaRegenerateRecoveryCodes: { method: "POST", path: "/_auth/mfa/recovery/regenerate" },
   mfaStatus: { method: "GET", path: "/_auth/mfa/status" },
-  mfaVerify: { method: "POST", path: "/_auth/mfa/verify" },
-  mfaVerifyOptions: { method: "POST", path: "/_auth/mfa/verify/options" },
   mfaStepUp: { method: "POST", path: "/_auth/mfa/step-up" },
   mfaStepUpOptions: { method: "POST", path: "/_auth/mfa/step-up/options" },
+  mfaVerify: { method: "POST", path: "/_auth/mfa/verify" },
+  mfaVerifyOptions: { method: "POST", path: "/_auth/mfa/verify/options" },
+  logout: { method: "POST", path: "/_auth/logout" },
+  rotateKey: { method: "POST", path: "/_auth/keys/rotate" },
+  listKeys: { method: "POST", path: "/_auth/keys/list" },
+  revokeKey: { method: "POST", path: "/_auth/keys/revoke" },
+  revokeAllKeys: { method: "POST", path: "/_auth/keys/revoke-all" },
+  confirmRevokeAllLink: { method: "POST", path: "/_auth/keys/revoke-all/confirm" },
+  consumeRevokeAllLink: { method: "POST", path: "/_auth/keys/revoke-all/consume" },
+  changePassword: { method: "PUT", path: "/_auth/password" },
+  getAuthSession: { method: "GET", path: "/_auth/session" },
   setSessionBinding: { method: "POST", path: "/_auth/session/binding" },
   getSessionBinding: { method: "GET", path: "/_auth/session/binding" },
   sessionBindingDisableOptions: { method: "POST", path: "/_auth/session/binding/disable/options" },
   sessionRenewOptions: { method: "POST", path: "/_auth/session/renew/options" },
   sessionRenewVerify: { method: "POST", path: "/_auth/session/renew/verify" },
-  passkeyRegisterOptions: { method: "POST", path: "/_auth/passkeys/register/options" },
-  passkeyRegisterVerify: { method: "POST", path: "/_auth/passkeys/register/verify" },
-  passkeyLoginOptions: { method: "POST", path: "/_auth/passkeys/login/options" },
-  passkeyLoginVerify: { method: "POST", path: "/_auth/passkeys/login/verify" },
-  listPasskeys: { method: "POST", path: "/_auth/passkeys/list" },
-  renamePasskey: { method: "POST", path: "/_auth/passkeys/rename" },
-  revokePasskey: { method: "POST", path: "/_auth/passkeys/revoke" },
-  getInvitation: { method: "GET", path: "/_auth/invitations/:token" },
-  acceptInvitation: { method: "POST", path: "/_auth/invitations/accept" },
-  createInvitation: { method: "POST", path: "/_auth/invitations" },
-  listInvitations: { method: "GET", path: "/_auth/invitations" },
-  cancelInvitation: { method: "POST", path: "/_auth/invitations/cancel" },
-  resendInvitation: { method: "POST", path: "/_auth/invitations/resend" },
-  deleteInvitation: { method: "POST", path: "/_auth/invitations/delete" },
-  getUserProfile: { method: "GET", path: "/_auth/users/profile" },
-  updateUserProfile: { method: "PATCH", path: "/_auth/users/profile" },
-  checkUsername: { method: "GET", path: "/_auth/users/username/check" },
-  updateUsername: { method: "PATCH", path: "/_auth/users/username" },
-  updateLocale: { method: "PATCH", path: "/_auth/users/locale" },
+  issueOneTimeToken: { method: "POST", path: "/_auth/tokens" },
+  requestAccountDeletion: { method: "POST", path: "/_auth/deletion/request" },
+  cancelAccountDeletion: { method: "POST", path: "/_auth/deletion/cancel" },
   oauthGoogleStart: { method: "GET", path: "/_auth/oauth/google" },
   oauthGoogleCallback: { method: "GET", path: "/_auth/oauth/google/callback" },
   oauthStart: { method: "POST", path: "/_auth/oauth/start" },
@@ -671,24 +725,34 @@ var routeMap = {
   oauthNative: { method: "POST", path: "/_auth/oauth/:provider/native" },
   oauthUnlinkNotify: { method: "POST", path: "/_auth/oauth/:provider/unlink-notify" },
   oauthUnlinkNotifyGet: { method: "GET", path: "/_auth/oauth/:provider/unlink-notify" },
+  getInvitation: { method: "GET", path: "/_auth/invitations/:token" },
+  acceptInvitation: { method: "POST", path: "/_auth/invitations/accept" },
+  createInvitation: { method: "POST", path: "/_auth/invitations" },
+  listInvitations: { method: "GET", path: "/_auth/invitations" },
+  cancelInvitation: { method: "POST", path: "/_auth/invitations/cancel" },
+  resendInvitation: { method: "POST", path: "/_auth/invitations/resend" },
+  deleteInvitation: { method: "POST", path: "/_auth/invitations/delete" },
+  getUserProfile: { method: "GET", path: "/_auth/users/profile" },
+  updateUserProfile: { method: "PATCH", path: "/_auth/users/profile" },
+  checkUsername: { method: "GET", path: "/_auth/users/username/check" },
+  updateUsername: { method: "PATCH", path: "/_auth/users/username" },
+  updateLocale: { method: "PATCH", path: "/_auth/users/locale" },
   listRoles: { method: "GET", path: "/_auth/admin/roles" },
   createAdminRole: { method: "POST", path: "/_auth/admin/roles" },
   updateAdminRole: { method: "PATCH", path: "/_auth/admin/roles/:id" },
   deleteAdminRole: { method: "DELETE", path: "/_auth/admin/roles/:id" },
   updateUserRole: { method: "PATCH", path: "/_auth/admin/users/:userId/role" },
-  requestAccountDeletion: { method: "POST", path: "/_auth/deletion/request" },
-  cancelAccountDeletion: { method: "POST", path: "/_auth/deletion/cancel" },
   issueOpsToken: { method: "POST", path: "/_auth/ops-tokens" },
   listOpsTokens: { method: "GET", path: "/_auth/ops-tokens" },
   revokeOpsToken: { method: "DELETE", path: "/_auth/ops-tokens/:id" },
   registerOAuth2Client: { method: "POST", path: "/_auth/oauth2/register" },
-  listOAuth2Grants: { method: "GET", path: "/_auth/oauth2/grants" },
-  revokeOAuth2Grant: { method: "DELETE", path: "/_auth/oauth2/grants/:id" },
-  oauth2AuthorizationServerMetadata: { method: "GET", path: "/.well-known/oauth-authorization-server" },
   getOAuth2Authorize: { method: "GET", path: "/_auth/oauth2/authorize" },
   createOAuth2AuthorizationCode: { method: "POST", path: "/_auth/oauth2/authorize" },
   oauth2Token: { method: "POST", path: "/_auth/oauth2/token" },
-  oauth2Revoke: { method: "POST", path: "/_auth/oauth2/revoke" }
+  oauth2Revoke: { method: "POST", path: "/_auth/oauth2/revoke" },
+  listOAuth2Grants: { method: "GET", path: "/_auth/oauth2/grants" },
+  revokeOAuth2Grant: { method: "DELETE", path: "/_auth/oauth2/grants/:id" },
+  oauth2AuthorizationServerMetadata: { method: "GET", path: "/.well-known/oauth-authorization-server" }
 };
 
 // src/lib/types.ts
@@ -3480,6 +3544,16 @@ var UserCodeSchema = Type.String({
   maxLength: 16,
   description: "Device user code as displayed, e.g. WXYZ-2345. Dashes, spaces and case are ignored."
 });
+var LinkIdSchema = Type.String({
+  minLength: 1,
+  maxLength: 64,
+  description: "Device link handle returned by /_auth/device/link/issue"
+});
+var MatchChoiceSchema = Type.Integer({
+  minimum: 10,
+  maximum: 99,
+  description: "The number the issuer picked \u2014 the one the new device shows"
+});
 var DeviceAuthPollResponseSchema = Type.Union([
   Type.Object({
     status: Type.Literal("pending"),