@stapel/auth-react 1.0.0

package/dist/api/types.d.ts

@@ -0,0 +1,238 @@
+/**
+ * Wire types for the stapel-auth HTTP contract (auth-sa.md §1–18).
+ *
+ * These are hand-authored here because the auth backend does not yet publish
+ * an `openapi.json` artifact to this monorepo. When it does, this file is the
+ * codegen target (frontend-standard §2/§3): the shapes below are transcribed
+ * verbatim from auth-sa.md's documented request/response bodies so a future
+ * `regen` produces a compatible surface.
+ */
+/** Result status of any flow that ends in a session (auth-sa.md §"AuthResponse"). */
+export type AuthStatus = "LOGGED_IN" | "REGISTERED" | "MERGED" | "MODIFIED";
+/** The authenticated principal. Backend adds fields freely; kept open. */
+export interface StapelUser {
+    readonly id: string;
+    readonly username?: string;
+    readonly email?: string | null;
+    readonly phone?: string | null;
+    readonly is_anonymous?: boolean;
+    readonly [extra: string]: unknown;
+}
+/** Access/refresh JWT pair returned in the body (also set as cookies). */
+export interface AuthTokens {
+    readonly access: string;
+    readonly refresh: string;
+}
+/** Returned by every flow that results in a session. */
+export interface AuthResponse {
+    readonly status: AuthStatus;
+    readonly user: StapelUser;
+    readonly tokens: AuthTokens;
+}
+/** Returned instead of `AuthResponse` when the account has TOTP enabled. */
+export interface TOTPChallengeResponse {
+    readonly status: "TOTP_REQUIRED";
+    readonly challenge_token: string;
+    readonly expires_in: number;
+}
+/**
+ * The `oneOf` login union (discriminator: `status`). Narrow with
+ * `if (r.status === "TOTP_REQUIRED")`.
+ */
+export type LoginResponse = AuthResponse | TOTPChallengeResponse;
+/** Narrowing helper for the login union. */
+export declare function isTotpChallenge(r: LoginResponse): r is TOTPChallengeResponse;
+/** `{ message, target }` — target is the masked destination to display. */
+export interface OtpRequestResponse {
+    readonly message: string;
+    readonly target: string;
+}
+/** Simple status envelopes returned by several mutations. */
+export interface StatusResponse {
+    readonly status: string;
+}
+export interface OAuthProviderInfo {
+    readonly id: string;
+    readonly name: string;
+}
+export interface RegistrationCapabilities {
+    readonly phone: boolean;
+    readonly email: boolean;
+    readonly password: boolean;
+    readonly oauth: readonly OAuthProviderInfo[];
+    readonly sso: boolean;
+    readonly anonymous: boolean;
+}
+export interface LoginCapabilities {
+    readonly phone: boolean;
+    readonly email: boolean;
+    readonly password: boolean;
+    readonly oauth: readonly OAuthProviderInfo[];
+    readonly sso: boolean;
+    readonly qr: boolean;
+    readonly passkey: boolean;
+    readonly magic_link: boolean;
+}
+export interface Capabilities {
+    readonly registration: RegistrationCapabilities;
+    readonly login: LoginCapabilities;
+}
+export type PasswordChangeMethod = "password" | "email" | "phone";
+export interface PasswordMethodEntry {
+    readonly method: PasswordChangeMethod;
+    readonly target?: string;
+}
+export interface PasswordMethods {
+    readonly has_password: boolean;
+    readonly methods: readonly PasswordMethodEntry[];
+}
+export interface SecurityStatus {
+    readonly password: {
+        readonly is_set: boolean;
+    };
+    readonly totp: {
+        readonly is_enabled: boolean;
+        readonly backup_codes_remaining: number;
+    };
+    readonly email: {
+        readonly value: string | null;
+        readonly is_verified: boolean;
+    };
+    readonly phone: {
+        readonly value: string | null;
+        readonly is_verified: boolean;
+    };
+    readonly oauth: {
+        readonly connected_providers: readonly string[];
+    };
+    readonly sessions: {
+        readonly active_count: number;
+    };
+    readonly passkeys: {
+        readonly count: number;
+    };
+}
+export type SessionDeviceType = "phone" | "tablet" | "desktop" | "api" | "unknown";
+export interface AuthSession {
+    readonly id: string;
+    readonly device_type: SessionDeviceType;
+    readonly device_name: string;
+    readonly device_details: string;
+    readonly ip_address: string;
+    readonly created_at: string;
+    readonly last_used_at: string;
+    readonly is_current: boolean;
+    readonly is_suspicious: boolean;
+}
+export interface TotpSetupResponse {
+    readonly secret: string;
+    readonly qr_uri: string;
+    readonly expires_in: number;
+}
+export interface TotpSetupConfirmResponse {
+    readonly backup_codes: readonly string[];
+}
+/** `oneOf` discriminated by `method` (auth-sa.md §"Disable TOTP"). */
+export type TotpDisableRequest = {
+    readonly method: "totp";
+    readonly code: string;
+} | {
+    readonly method: "backup";
+    readonly backup_code: string;
+} | {
+    readonly method: "otp";
+    readonly otp_code: string;
+};
+export type VerificationFactorId = "otp_email" | "otp_phone" | "totp" | "passkey";
+/** The `verification` object inside the 403 envelope. */
+export interface VerificationEnvelope {
+    readonly challenge_id: string;
+    readonly scope: string;
+    readonly factors: readonly VerificationFactorId[];
+    readonly expires_at: number;
+}
+export interface VerificationInitiateResponse {
+    readonly factor: VerificationFactorId;
+    /** For otp_* — `{ target }`; for passkey — `{ session_key, options }`. */
+    readonly data: Record<string, unknown>;
+}
+export interface VerificationCompleteResponse {
+    readonly verified: boolean;
+    readonly verification_token: string;
+}
+export type QrType = "session_share" | "login_request";
+export interface QrGenerateResponse {
+    readonly key: string;
+    readonly type: QrType;
+    readonly expires_in: number;
+    readonly scan_url: string;
+}
+export type QrStatusValue = "pending" | "fulfilled" | "expired" | "rejected";
+export interface QrStatusResponse {
+    readonly status: QrStatusValue;
+    /** Present only on `login_request` fulfilment. */
+    readonly access_token?: string;
+    readonly refresh_token?: string;
+}
+export interface Passkey {
+    readonly id: string;
+    readonly device_name: string;
+    readonly aaguid: string;
+    readonly transports: readonly string[];
+    readonly created_at: string;
+    readonly last_used_at: string | null;
+}
+export interface PasskeyRegisterBeginResponse {
+    /** PublicKeyCredentialCreationOptions (JSON form). */
+    readonly options: Record<string, unknown>;
+}
+export interface PasskeyAuthenticateBeginResponse {
+    readonly session_key: string;
+    /** PublicKeyCredentialRequestOptions (JSON form). */
+    readonly options: Record<string, unknown>;
+}
+export interface ChangeOldVerifiedResponse {
+    readonly status: "OLD_VERIFIED";
+    readonly change_token: string;
+    readonly expires_at: string;
+}
+export interface DelayedChangeInitiatedResponse {
+    readonly status: "PENDING";
+    readonly change_request_id: string;
+    readonly scheduled_at: string;
+    readonly can_cancel_until: string;
+}
+export type DelayedChangeStatus = {
+    readonly has_pending_change: false;
+} | {
+    readonly has_pending_change?: true;
+    readonly change_request_id: string;
+    readonly scheduled_at: string;
+    readonly can_cancel_until: string;
+};
+export interface SsoLookupResponse {
+    readonly sso_required: boolean;
+    readonly org_slug: string | null;
+    readonly protocol?: "saml" | "oidc";
+}
+export interface AuditEvent {
+    readonly id: string;
+    readonly event_type: string;
+    readonly ip_address: string;
+    readonly user_agent: string;
+    readonly metadata: Record<string, unknown>;
+    readonly created_at: string;
+}
+export interface AuditPage {
+    readonly results: readonly AuditEvent[];
+    readonly count: number;
+    readonly next: number | null;
+}
+/** `{ access, refresh }` from POST/GET /token/refresh/. */
+export interface RefreshResponse {
+    readonly access: string;
+    readonly refresh: string;
+}
+/** Which identifier channel an OTP flow uses. */
+export type OtpChannel = "email" | "phone";
+//# sourceMappingURL=types.d.ts.map

package/dist/api/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/api/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qFAAqF;AACrF,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE5E,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAED,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,qBAAqB,CAAC;AAEjE,4CAA4C;AAC5C,wBAAgB,eAAe,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,IAAI,qBAAqB,CAE5E;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,YAAY,EAAE,wBAAwB,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC;AAID,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC;AAElE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAClD;AAID,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;QAC7B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;KACzC,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;IACjF,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;IACjF,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAID,MAAM,MAAM,iBAAiB,GACzB,OAAO,GACP,QAAQ,GACR,SAAS,GACT,KAAK,GACL,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAI1D,MAAM,MAAM,oBAAoB,GAC5B,WAAW,GACX,WAAW,GACX,MAAM,GACN,SAAS,CAAC;AAEd,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAID,MAAM,MAAM,MAAM,GAAG,eAAe,GAAG,eAAe,CAAC;AAEvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC;AAE7E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAID,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,4BAA4B;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAID,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAA;CAAE,GACtC;IACE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,CAAC;AAIN,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC;AAID,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC"}

package/dist/api/types.js

@@ -0,0 +1,14 @@
+/**
+ * Wire types for the stapel-auth HTTP contract (auth-sa.md §1–18).
+ *
+ * These are hand-authored here because the auth backend does not yet publish
+ * an `openapi.json` artifact to this monorepo. When it does, this file is the
+ * codegen target (frontend-standard §2/§3): the shapes below are transcribed
+ * verbatim from auth-sa.md's documented request/response bodies so a future
+ * `regen` produces a compatible surface.
+ */
+/** Narrowing helper for the login union. */
+export function isTotpChallenge(r) {
+    return r.status === "TOTP_REQUIRED";
+}
+//# sourceMappingURL=types.js.map

package/dist/api/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/api/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAyCH,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,CAAgB;IAC9C,OAAO,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC;AACtC,CAAC"}

package/dist/api/urls.d.ts

@@ -0,0 +1,41 @@
+/**
+ * URL builders for the **browser-redirect** auth endpoints (auth-sa.md §7/§8/
+ * §15/§18). These must never be called with `fetch` — they are full-page
+ * navigations. Callers do `window.location.assign(authUrls(...).xyz)`.
+ *
+ * Plus the two open-redirect defence helpers of auth-sa.md §19.2. Every new
+ * `?somewhere=` parameter that ends up in `location.href`/`navigate()` must
+ * pass through one of these rather than trust raw input.
+ */
+export interface AuthUrls {
+    /** Server-side OAuth redirect (auth-sa.md §7 option A). */
+    oauthAuthorize(provider: string, redirectUri: string): string;
+    /** Enterprise SSO login redirect (auth-sa.md §18.1 step 2). */
+    ssoLogin(orgSlug: string): string;
+    /** The URL embedded in a QR image — opened by the scanner's browser only. */
+    qrScan(key: string): string;
+    /** SP metadata URL surfaced to a customer's IT admin (auth-sa.md §18.4). */
+    ssoSamlMetadata(orgSlug: string): string;
+}
+/** Build the browser-redirect URLs against a client base URL (e.g. `/auth/api`). */
+export declare function authUrls(baseUrl: string): AuthUrls;
+/**
+ * `redirect_url` for magic-link / QR generation must be a **relative** path
+ * starting with a single `/` (auth-sa.md §8/§15 — open-redirect defence).
+ * Returns the path unchanged when valid, else `null`.
+ */
+export declare function validRedirectUrl(raw: string): string | null;
+/**
+ * auth-sa.md §19.2 `safeNextPath`: accept a relative path (single leading `/`,
+ * not `//`) or a same-origin absolute URL reduced to `pathname+search+hash`.
+ * Anything cross-origin / unrecognised returns `null`; callers fall back to a
+ * safe default (e.g. `/app`).
+ */
+export declare function safeNextPath(raw: string | null | undefined, origin?: string): string | null;
+/**
+ * auth-sa.md §19.2 `safeScanRedirect`: accept only same-origin URLs whose path
+ * starts with `/auth/api/qr/` (the QR scan-flow continuation). Used for
+ * `?redirect=` on `/sign-in`.
+ */
+export declare function safeScanRedirect(raw: string | null | undefined, origin?: string): string | null;
+//# sourceMappingURL=urls.d.ts.map

package/dist/api/urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"urls.d.ts","sourceRoot":"","sources":["../../src/api/urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,MAAM,WAAW,QAAQ;IACvB,2DAA2D;IAC3D,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9D,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,6EAA6E;IAC7E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1C;AAED,oFAAoF;AACpF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAWlD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK3D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAcf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAcf"}

package/dist/api/urls.js

@@ -0,0 +1,86 @@
+/**
+ * URL builders for the **browser-redirect** auth endpoints (auth-sa.md §7/§8/
+ * §15/§18). These must never be called with `fetch` — they are full-page
+ * navigations. Callers do `window.location.assign(authUrls(...).xyz)`.
+ *
+ * Plus the two open-redirect defence helpers of auth-sa.md §19.2. Every new
+ * `?somewhere=` parameter that ends up in `location.href`/`navigate()` must
+ * pass through one of these rather than trust raw input.
+ */
+function trimBase(baseUrl) {
+    return baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
+}
+/** Build the browser-redirect URLs against a client base URL (e.g. `/auth/api`). */
+export function authUrls(baseUrl) {
+    const base = trimBase(baseUrl);
+    return {
+        oauthAuthorize: (provider, redirectUri) => `${base}/oauth/${provider}/authorize/?redirect_uri=${encodeURIComponent(redirectUri)}`,
+        ssoLogin: (orgSlug) => `${base}/sso/${orgSlug}/login/`,
+        qrScan: (key) => `${base}/qr/${key}/scan/`,
+        ssoSamlMetadata: (orgSlug) => `${base}/sso/${orgSlug}/saml/metadata/`,
+    };
+}
+/**
+ * `redirect_url` for magic-link / QR generation must be a **relative** path
+ * starting with a single `/` (auth-sa.md §8/§15 — open-redirect defence).
+ * Returns the path unchanged when valid, else `null`.
+ */
+export function validRedirectUrl(raw) {
+    if (raw.length === 0)
+        return null;
+    if (!raw.startsWith("/"))
+        return null;
+    if (raw.startsWith("//"))
+        return null;
+    return raw;
+}
+/**
+ * auth-sa.md §19.2 `safeNextPath`: accept a relative path (single leading `/`,
+ * not `//`) or a same-origin absolute URL reduced to `pathname+search+hash`.
+ * Anything cross-origin / unrecognised returns `null`; callers fall back to a
+ * safe default (e.g. `/app`).
+ */
+export function safeNextPath(raw, origin) {
+    if (raw == null || raw.length === 0)
+        return null;
+    if (raw.startsWith("/") && !raw.startsWith("//"))
+        return raw;
+    const selfOrigin = origin ??
+        (typeof window !== "undefined" ? window.location.origin : undefined);
+    if (selfOrigin === undefined)
+        return null;
+    try {
+        const url = new URL(raw, selfOrigin);
+        if (url.origin !== selfOrigin)
+            return null;
+        return `${url.pathname}${url.search}${url.hash}`;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * auth-sa.md §19.2 `safeScanRedirect`: accept only same-origin URLs whose path
+ * starts with `/auth/api/qr/` (the QR scan-flow continuation). Used for
+ * `?redirect=` on `/sign-in`.
+ */
+export function safeScanRedirect(raw, origin) {
+    if (raw == null || raw.length === 0)
+        return null;
+    const selfOrigin = origin ??
+        (typeof window !== "undefined" ? window.location.origin : undefined);
+    if (selfOrigin === undefined)
+        return null;
+    try {
+        const url = new URL(raw, selfOrigin);
+        if (url.origin !== selfOrigin)
+            return null;
+        if (!url.pathname.startsWith("/auth/api/qr/"))
+            return null;
+        return url.toString();
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=urls.js.map

package/dist/api/urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"urls.js","sourceRoot":"","sources":["../../src/api/urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAaD,oFAAoF;AACpF,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO;QACL,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,CACxC,GAAG,IAAI,UAAU,QAAQ,4BAA4B,kBAAkB,CACrE,WAAW,CACZ,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,OAAO,SAAS;QACtD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,OAAO,GAAG,QAAQ;QAC1C,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,OAAO,iBAAiB;KACtE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,GAA8B,EAC9B,MAAe;IAEf,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7D,MAAM,UAAU,GACd,MAAM;QACN,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAA8B,EAC9B,MAAe;IAEf,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,UAAU,GACd,MAAM;QACN,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/flows/anonymousFlow.d.ts

@@ -0,0 +1,33 @@
+import type { Analytics } from "@stapel/core";
+import type { AuthApi } from "../api/authApi.js";
+import type { AuthResponse } from "../api/types.js";
+import type { FlowMachine } from "./createFlowMachine.js";
+import type { FlowError } from "./errors.js";
+/**
+ * Anonymous session for onboarding-before-signup (auth-sa.md §6). A single
+ * call; passing the same `device_id` within 60 s dedups to the same anonymous
+ * user. A later email/phone verify upgrades or merges this session.
+ */
+export type AnonymousState = {
+    readonly step: "idle";
+} | {
+    readonly step: "creating";
+} | {
+    readonly step: "authenticated";
+    readonly result: AuthResponse;
+} | {
+    readonly step: "error";
+    readonly error: FlowError;
+};
+export interface AnonymousFlow {
+    readonly machine: FlowMachine<AnonymousState>;
+    create(deviceId?: string): Promise<void>;
+    reset(): void;
+}
+export interface AnonymousFlowDeps {
+    readonly api: AuthApi;
+    readonly analytics?: Analytics | null;
+    readonly onAuthenticated?: (result: AuthResponse) => void;
+}
+export declare function createAnonymousFlow(deps: AnonymousFlowDeps): AnonymousFlow;
+//# sourceMappingURL=anonymousFlow.d.ts.map

package/dist/flows/anonymousFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anonymousFlow.d.ts","sourceRoot":"","sources":["../../src/flows/anonymousFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;CAC3D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAyB1E"}

package/dist/flows/anonymousFlow.js

@@ -0,0 +1,26 @@
+import { createFlowMachine } from "./createFlowMachine.js";
+import { toFlowError } from "./errors.js";
+export function createAnonymousFlow(deps) {
+    const machine = createFlowMachine({
+        id: "auth.anonymous",
+        initial: { step: "idle" },
+        analytics: deps.analytics ?? null,
+    });
+    async function create(deviceId) {
+        await machine.run({ step: "creating" }, () => deps.api.anonymous(deviceId), {
+            resolve: (result) => {
+                deps.onAuthenticated?.(result);
+                return { step: "authenticated", result };
+            },
+            reject: (error) => ({
+                step: "error",
+                error: toFlowError(error),
+            }),
+        });
+    }
+    function reset() {
+        machine.to({ step: "idle" });
+    }
+    return { machine, create, reset };
+}
+//# sourceMappingURL=anonymousFlow.js.map

package/dist/flows/anonymousFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anonymousFlow.js","sourceRoot":"","sources":["../../src/flows/anonymousFlow.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA0B1C,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,OAAO,GAAG,iBAAiB,CAAiB;QAChD,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;IAEH,KAAK,UAAU,MAAM,CAAC,QAAiB;QACrC,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;YAC1E,OAAO,EAAE,CAAC,MAAM,EAAkB,EAAE;gBAClC,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC/B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;YAC3C,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAkB,EAAE,CAAC,CAAC;gBAClC,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,SAAS,KAAK;QACZ,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC"}

package/dist/flows/authenticatorChangeFlow.d.ts

@@ -0,0 +1,67 @@
+import type { Analytics } from "@stapel/core";
+import type { AuthApi } from "../api/authApi.js";
+import type { AuthResponse, OtpChannel } from "../api/types.js";
+import type { FlowMachine } from "./createFlowMachine.js";
+import type { FlowError } from "./errors.js";
+/**
+ * Authenticator (email/phone) change — INSTANT strategy (auth-sa.md §9). A
+ * four-hop human-wait chain proving the *old* value, then setting the *new*:
+ * request-old → verify-old (mints a `change_token`) → request-new → verify-new
+ * (→ `MODIFIED` session). The DELAYED strategy (14-day wait, no old access) is
+ * plain CRUD — use `api.changeDelayedInitiate/Status/Cancel` or the
+ * `useDelayedChangeStatus` model hook directly.
+ */
+export type AuthenticatorChangeState = {
+    readonly step: "idle";
+} | {
+    readonly step: "requestingOld";
+    readonly channel: OtpChannel;
+} | {
+    readonly step: "oldCodeSent";
+    readonly channel: OtpChannel;
+    readonly target: string;
+} | {
+    readonly step: "verifyingOld";
+    readonly channel: OtpChannel;
+} | {
+    readonly step: "oldVerified";
+    readonly channel: OtpChannel;
+    readonly changeToken: string;
+} | {
+    readonly step: "requestingNew";
+    readonly channel: OtpChannel;
+    readonly changeToken: string;
+    readonly newValue: string;
+} | {
+    readonly step: "newCodeSent";
+    readonly channel: OtpChannel;
+    readonly changeToken: string;
+    readonly newValue: string;
+    readonly target: string;
+} | {
+    readonly step: "verifyingNew";
+    readonly channel: OtpChannel;
+    readonly changeToken: string;
+    readonly newValue: string;
+} | {
+    readonly step: "changed";
+    readonly result: AuthResponse;
+} | {
+    readonly step: "error";
+    readonly error: FlowError;
+};
+export interface AuthenticatorChangeFlow {
+    readonly machine: FlowMachine<AuthenticatorChangeState>;
+    startInstant(channel: OtpChannel): Promise<void>;
+    submitOldCode(code: string): Promise<void>;
+    requestNew(newValue: string): Promise<void>;
+    submitNewCode(code: string): Promise<void>;
+    reset(): void;
+}
+export interface AuthenticatorChangeFlowDeps {
+    readonly api: AuthApi;
+    readonly analytics?: Analytics | null;
+    readonly onAuthenticated?: (result: AuthResponse) => void;
+}
+export declare function createAuthenticatorChangeFlow(deps: AuthenticatorChangeFlowDeps): AuthenticatorChangeFlow;
+//# sourceMappingURL=authenticatorChangeFlow.d.ts.map

package/dist/flows/authenticatorChangeFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticatorChangeFlow.d.ts","sourceRoot":"","sources":["../../src/flows/authenticatorChangeFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GAChE;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvF;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GAC/D;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,wBAAwB,CAAC,CAAC;IACxD,YAAY,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;CAC3D;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,2BAA2B,GAChC,uBAAuB,CA8FzB"}

package/dist/flows/authenticatorChangeFlow.js

@@ -0,0 +1,79 @@
+import { createFlowMachine } from "./createFlowMachine.js";
+import { toFlowError } from "./errors.js";
+export function createAuthenticatorChangeFlow(deps) {
+    const machine = createFlowMachine({
+        id: "auth.authenticator_change",
+        initial: { step: "idle" },
+        analytics: deps.analytics ?? null,
+    });
+    async function startInstant(channel) {
+        await machine.run({ step: "requestingOld", channel }, () => deps.api.changeInstantRequestOld(channel), {
+            resolve: (r) => ({
+                step: "oldCodeSent",
+                channel,
+                target: r.target,
+            }),
+            reject: (error) => ({
+                step: "error",
+                error: toFlowError(error),
+            }),
+        });
+    }
+    async function submitOldCode(code) {
+        const s = machine.getState();
+        if (s.step !== "oldCodeSent")
+            return;
+        const { channel } = s;
+        await machine.run({ step: "verifyingOld", channel }, () => deps.api.changeInstantVerifyOld(channel, code), {
+            resolve: (r) => ({
+                step: "oldVerified",
+                channel,
+                changeToken: r.change_token,
+            }),
+            reject: (error) => ({
+                step: "error",
+                error: toFlowError(error),
+            }),
+        });
+    }
+    async function requestNew(newValue) {
+        const s = machine.getState();
+        if (s.step !== "oldVerified")
+            return;
+        const { channel, changeToken } = s;
+        await machine.run({ step: "requestingNew", channel, changeToken, newValue }, () => deps.api.changeInstantRequestNew(channel, newValue, changeToken), {
+            resolve: (r) => ({
+                step: "newCodeSent",
+                channel,
+                changeToken,
+                newValue,
+                target: r.target,
+            }),
+            reject: (error) => ({
+                step: "error",
+                error: toFlowError(error),
+            }),
+        });
+    }
+    async function submitNewCode(code) {
+        const s = machine.getState();
+        if (s.step !== "newCodeSent")
+            return;
+        const { channel, changeToken, newValue } = s;
+        await machine.run({ step: "verifyingNew", channel, changeToken, newValue }, () => deps.api.changeInstantVerifyNew(channel, newValue, code, changeToken), {
+            resolve: (result) => {
+                deps.onAuthenticated?.(result);
+                return { step: "changed", result };
+            },
+            reject: (error) => ({
+                step: "error",
+                error: toFlowError(error),
+            }),
+        });
+    }
+    function reset() {
+        machine.to({ step: "idle" });
+    }
+    return { machine, startInstant, submitOldCode, requestNew, submitNewCode, reset };
+}
+//# sourceMappingURL=authenticatorChangeFlow.js.map

package/dist/flows/authenticatorChangeFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticatorChangeFlow.js","sourceRoot":"","sources":["../../src/flows/authenticatorChangeFlow.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA0D1C,MAAM,UAAU,6BAA6B,CAC3C,IAAiC;IAEjC,MAAM,OAAO,GAAG,iBAAiB,CAA2B;QAC1D,EAAE,EAAE,2BAA2B;QAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CAAC,OAAmB;QAC7C,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAClC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAC/C;YACE,OAAO,EAAE,CAAC,CAAC,EAA4B,EAAE,CAAC,CAAC;gBACzC,IAAI,EAAE,aAAa;gBACnB,OAAO;gBACP,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC;YACF,MAAM,EAAE,CAAC,KAAK,EAA4B,EAAE,CAAC,CAAC;gBAC5C,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,IAAY;QACvC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO;QACrC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACtB,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,EACjC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,EACpD;YACE,OAAO,EAAE,CAAC,CAAC,EAA4B,EAAE,CAAC,CAAC;gBACzC,IAAI,EAAE,aAAa;gBACnB,OAAO;gBACP,WAAW,EAAE,CAAC,CAAC,YAAY;aAC5B,CAAC;YACF,MAAM,EAAE,CAAC,KAAK,EAA4B,EAAE,CAAC,CAAC;gBAC5C,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,QAAgB;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO;QACrC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,EACzD,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,EACtE;YACE,OAAO,EAAE,CAAC,CAAC,EAA4B,EAAE,CAAC,CAAC;gBACzC,IAAI,EAAE,aAAa;gBACnB,OAAO;gBACP,WAAW;gBACX,QAAQ;gBACR,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC;YACF,MAAM,EAAE,CAAC,KAAK,EAA4B,EAAE,CAAC,CAAC;gBAC5C,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,IAAY;QACvC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO;QACrC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,EACxD,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,EAC3E;YACE,OAAO,EAAE,CAAC,MAAM,EAA4B,EAAE;gBAC5C,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACrC,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAA4B,EAAE,CAAC,CAAC;gBAC5C,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,SAAS,KAAK;QACZ,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AACpF,CAAC"}