@stapel/auth-react 1.0.0

package/dist/flows/passkeyFlow.js

@@ -0,0 +1,100 @@
+import { createFlowMachine } from "./createFlowMachine.js";
+import { toFlowError } from "./errors.js";
+export function createPasskeyRegistrationFlow(deps) {
+    const machine = createFlowMachine({
+        id: "auth.passkey_register",
+        initial: { step: "idle" },
+        analytics: deps.analytics ?? null,
+    });
+    let pendingDeviceName;
+    async function submitCredential(credential) {
+        const s = machine.getState();
+        if (s.step !== "awaitingCredential")
+            return;
+        await machine.run({ step: "completing" }, () => deps.api.passkeyRegisterComplete(credential, pendingDeviceName), {
+            resolve: (passkey) => ({ step: "registered", passkey }),
+            reject: (error) => ({
+                step: "error",
+                error: toFlowError(error),
+            }),
+        });
+    }
+    async function begin(deviceName) {
+        pendingDeviceName = deviceName;
+        await machine.run({ step: "beginning" }, () => deps.api.passkeyRegisterBegin(), {
+            resolve: (r) => ({
+                step: "awaitingCredential",
+                options: r.options,
+            }),
+            reject: (error) => ({
+                step: "error",
+                error: toFlowError(error),
+            }),
+        });
+        const after = machine.getState();
+        if (after.step === "awaitingCredential" && deps.webauthnCreate) {
+            try {
+                const credential = await deps.webauthnCreate(after.options);
+                await submitCredential(credential);
+            }
+            catch (error) {
+                machine.to({ step: "error", error: toFlowError(error) });
+            }
+        }
+    }
+    function reset() {
+        machine.to({ step: "idle" });
+    }
+    return { machine, begin, submitCredential, reset };
+}
+export function createPasskeyLoginFlow(deps) {
+    const machine = createFlowMachine({
+        id: "auth.passkey_login",
+        initial: { step: "idle" },
+        analytics: deps.analytics ?? null,
+    });
+    async function submitAssertion(credential) {
+        const s = machine.getState();
+        if (s.step !== "awaitingAssertion")
+            return;
+        const { sessionKey } = s;
+        await machine.run({ step: "completing", sessionKey }, () => deps.api.passkeyAuthenticateComplete(sessionKey, credential), {
+            resolve: (result) => {
+                deps.onAuthenticated?.(result);
+                return { step: "authenticated", result };
+            },
+            reject: (error) => ({
+                step: "error",
+                error: toFlowError(error),
+            }),
+        });
+    }
+    async function begin(email) {
+        await machine.run({ step: "beginning" }, () => deps.api.passkeyAuthenticateBegin(email), {
+            resolve: (r) => ({
+                step: "awaitingAssertion",
+                sessionKey: r.session_key,
+                options: r.options,
+            }),
+            reject: (error) => ({
+                step: "error",
+                error: toFlowError(error),
+            }),
+        });
+        const after = machine.getState();
+        if (after.step === "awaitingAssertion" && deps.webauthnGet) {
+            try {
+                const credential = await deps.webauthnGet(after.options);
+                await submitAssertion(credential);
+            }
+            catch (error) {
+                machine.to({ step: "error", error: toFlowError(error) });
+            }
+        }
+    }
+    function reset() {
+        machine.to({ step: "idle" });
+    }
+    return { machine, begin, submitAssertion, reset };
+}
+//# sourceMappingURL=passkeyFlow.js.map

package/dist/flows/passkeyFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeyFlow.js","sourceRoot":"","sources":["../../src/flows/passkeyFlow.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAsC1C,MAAM,UAAU,6BAA6B,CAC3C,IAAiC;IAEjC,MAAM,OAAO,GAAG,iBAAiB,CAAuB;QACtD,EAAE,EAAE,uBAAuB;QAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;IAEH,IAAI,iBAAqC,CAAC;IAE1C,KAAK,UAAU,gBAAgB,CAAC,UAAmB;QACjD,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;YAAE,OAAO;QAC5C,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,YAAY,EAAE,EACtB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,UAAU,EAAE,iBAAiB,CAAC,EACrE;YACE,OAAO,EAAE,CAAC,OAAO,EAAwB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;YAC7E,MAAM,EAAE,CAAC,KAAK,EAAwB,EAAE,CAAC,CAAC;gBACxC,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,UAAmB;QACtC,iBAAiB,GAAG,UAAU,CAAC;QAC/B,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE;YAC9E,OAAO,EAAE,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC;gBACrC,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC;YACF,MAAM,EAAE,CAAC,KAAK,EAAwB,EAAE,CAAC,CAAC;gBACxC,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/D,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5D,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,KAAK;QACZ,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC;AA+BD,MAAM,UAAU,sBAAsB,CACpC,IAA0B;IAE1B,MAAM,OAAO,GAAG,iBAAiB,CAAoB;QACnD,EAAE,EAAE,oBAAoB;QACxB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;IAEH,KAAK,UAAU,eAAe,CAAC,UAAmB;QAChD,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;YAAE,OAAO;QAC3C,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QACzB,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAClC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,UAAU,EAAE,UAAU,CAAC,EAClE;YACE,OAAO,EAAE,CAAC,MAAM,EAAqB,EAAE;gBACrC,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC/B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;YAC3C,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;gBACrC,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,KAAc;QACjC,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,WAAW,EAAE,EACrB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAC9C;YACE,OAAO,EAAE,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC;gBAClC,IAAI,EAAE,mBAAmB;gBACzB,UAAU,EAAE,CAAC,CAAC,WAAW;gBACzB,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC;YACF,MAAM,EAAE,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;gBACrC,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC3D,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACzD,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,KAAK;QACZ,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC"}

package/dist/flows/passwordChangeFlow.d.ts

@@ -0,0 +1,53 @@
+import type { Analytics } from "@stapel/core";
+import type { AuthApi } from "../api/authApi.js";
+import type { OtpChannel } from "../api/types.js";
+import type { FlowMachine } from "./createFlowMachine.js";
+import type { FlowError } from "./errors.js";
+/**
+ * Authenticated password change (auth-sa.md §4). Two host-selected paths that
+ * converge on `changed`:
+ *  - **old password** — `changeWithPassword(old, new)`.
+ *  - **email / SMS code** — `requestOtp(method)` → `submitOtp(code, new)`.
+ *
+ * Which tabs to show is a host decision driven by `GET /password/methods/`
+ * (see `usePasswordMethods`); the machine serves whichever path is invoked.
+ */
+export type PasswordChangeState = {
+    readonly step: "idle";
+} | {
+    readonly step: "changing";
+} | {
+    readonly step: "requestingOtp";
+    readonly method: OtpChannel;
+} | {
+    readonly step: "otpSent";
+    readonly method: OtpChannel;
+    readonly target: string;
+} | {
+    readonly step: "verifyingOtp";
+    readonly method: OtpChannel;
+    readonly target: string;
+} | {
+    readonly step: "changed";
+} | {
+    readonly step: "error";
+    readonly error: FlowError;
+} | {
+    readonly step: "otpError";
+    readonly method: OtpChannel;
+    readonly target: string;
+    readonly error: FlowError;
+};
+export interface PasswordChangeFlow {
+    readonly machine: FlowMachine<PasswordChangeState>;
+    changeWithPassword(oldPassword: string, newPassword: string): Promise<void>;
+    requestOtp(method: OtpChannel): Promise<void>;
+    submitOtp(code: string, newPassword: string): Promise<void>;
+    reset(): void;
+}
+export interface PasswordChangeFlowDeps {
+    readonly api: AuthApi;
+    readonly analytics?: Analytics | null;
+}
+export declare function createPasswordChangeFlow(deps: PasswordChangeFlowDeps): PasswordChangeFlow;
+//# sourceMappingURL=passwordChangeFlow.d.ts.map

package/dist/flows/passwordChangeFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordChangeFlow.d.ts","sourceRoot":"","sources":["../../src/flows/passwordChangeFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClF;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvF;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GACrD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B,CAAC;AAEN,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnD,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;CACvC;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,sBAAsB,GAC3B,kBAAkB,CAkEpB"}

package/dist/flows/passwordChangeFlow.js

@@ -0,0 +1,51 @@
+import { createFlowMachine } from "./createFlowMachine.js";
+import { toFlowError } from "./errors.js";
+export function createPasswordChangeFlow(deps) {
+    const machine = createFlowMachine({
+        id: "auth.password_change",
+        initial: { step: "idle" },
+        analytics: deps.analytics ?? null,
+    });
+    async function changeWithPassword(oldPassword, newPassword) {
+        await machine.run({ step: "changing" }, () => deps.api.passwordChange(oldPassword, newPassword), {
+            resolve: () => ({ step: "changed" }),
+            reject: (error) => ({
+                step: "error",
+                error: toFlowError(error),
+            }),
+        });
+    }
+    async function requestOtp(method) {
+        await machine.run({ step: "requestingOtp", method }, () => deps.api.passwordChangeOtpRequest(method), {
+            resolve: (r) => ({
+                step: "otpSent",
+                method,
+                target: r.target,
+            }),
+            reject: (error) => ({
+                step: "error",
+                error: toFlowError(error),
+            }),
+        });
+    }
+    async function submitOtp(code, newPassword) {
+        const s = machine.getState();
+        if (s.step !== "otpSent" && s.step !== "otpError")
+            return;
+        const { method, target } = s;
+        await machine.run({ step: "verifyingOtp", method, target }, () => deps.api.passwordChangeOtpVerify(method, code, newPassword), {
+            resolve: () => ({ step: "changed" }),
+            reject: (error) => ({
+                step: "otpError",
+                method,
+                target,
+                error: toFlowError(error),
+            }),
+        });
+    }
+    function reset() {
+        machine.to({ step: "idle" });
+    }
+    return { machine, changeWithPassword, requestOtp, submitOtp, reset };
+}
+//# sourceMappingURL=passwordChangeFlow.js.map

package/dist/flows/passwordChangeFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordChangeFlow.js","sourceRoot":"","sources":["../../src/flows/passwordChangeFlow.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAwC1C,MAAM,UAAU,wBAAwB,CACtC,IAA4B;IAE5B,MAAM,OAAO,GAAG,iBAAiB,CAAsB;QACrD,EAAE,EAAE,sBAAsB;QAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;IAEH,KAAK,UAAU,kBAAkB,CAC/B,WAAmB,EACnB,WAAmB;QAEnB,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,UAAU,EAAE,EACpB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EACvD;YACE,OAAO,EAAE,GAAwB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACzD,MAAM,EAAE,CAAC,KAAK,EAAuB,EAAE,CAAC,CAAC;gBACvC,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,MAAkB;QAC1C,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,EACjC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAC/C;YACE,OAAO,EAAE,CAAC,CAAC,EAAuB,EAAE,CAAC,CAAC;gBACpC,IAAI,EAAE,SAAS;gBACf,MAAM;gBACN,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC;YACF,MAAM,EAAE,CAAC,KAAK,EAAuB,EAAE,CAAC,CAAC;gBACvC,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,WAAmB;QACxD,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO;QAC1D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,EACxC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,EACjE;YACE,OAAO,EAAE,GAAwB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACzD,MAAM,EAAE,CAAC,KAAK,EAAuB,EAAE,CAAC,CAAC;gBACvC,IAAI,EAAE,UAAU;gBAChB,MAAM;gBACN,MAAM;gBACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,SAAS,KAAK;QACZ,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC"}

package/dist/flows/passwordLoginFlow.d.ts

@@ -0,0 +1,62 @@
+import type { Analytics } from "@stapel/core";
+import type { AuthApi } from "../api/authApi.js";
+import type { AuthResponse } from "../api/types.js";
+import type { FlowMachine } from "./createFlowMachine.js";
+import type { FlowError } from "./errors.js";
+/**
+ * Password login with the TOTP step-up branch (auth-sa.md §3 + §11). A login
+ * response is a `oneOf` union — when the account has TOTP enabled the server
+ * answers `TOTP_REQUIRED` with a `challenge_token` instead of a session, and
+ * the flow parks in `totpRequired` until the user enters their 6-digit code
+ * (or a backup code).
+ *
+ * A 423 during TOTP verify **invalidates the challenge** (auth-sa.md §11): the
+ * machine goes to `totpLocked` and the user must log in again for a fresh
+ * token — modelled as a terminal step (call `reset()` to return to `idle`).
+ */
+export type PasswordLoginState = {
+    readonly step: "idle";
+} | {
+    readonly step: "authenticating";
+    readonly login: string;
+} | {
+    readonly step: "totpRequired";
+    readonly challengeToken: string;
+    readonly expiresIn: number;
+} | {
+    readonly step: "verifyingTotp";
+    readonly challengeToken: string;
+    readonly expiresIn: number;
+} | {
+    readonly step: "authenticated";
+    readonly result: AuthResponse;
+} | {
+    readonly step: "error";
+    readonly login: string;
+    readonly error: FlowError;
+} | {
+    readonly step: "totpError";
+    readonly challengeToken: string;
+    readonly expiresIn: number;
+    readonly error: FlowError;
+} | {
+    readonly step: "totpLocked";
+    readonly error: FlowError;
+};
+export interface TotpProof {
+    readonly code?: string;
+    readonly backup_code?: string;
+}
+export interface PasswordLoginFlow {
+    readonly machine: FlowMachine<PasswordLoginState>;
+    login(loginId: string, password: string): Promise<void>;
+    submitTotp(proof: TotpProof): Promise<void>;
+    reset(): void;
+}
+export interface PasswordLoginFlowDeps {
+    readonly api: AuthApi;
+    readonly analytics?: Analytics | null;
+    readonly onAuthenticated?: (result: AuthResponse) => void;
+}
+export declare function createPasswordLoginFlow(deps: PasswordLoginFlowDeps): PasswordLoginFlow;
+//# sourceMappingURL=passwordLoginFlow.d.ts.map

package/dist/flows/passwordLoginFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordLoginFlow.d.ts","sourceRoot":"","sources":["../../src/flows/passwordLoginFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3D;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/F;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAC7E;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAE/D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAClD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;CAC3D;AAID,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,iBAAiB,CA4DnB"}

package/dist/flows/passwordLoginFlow.js

@@ -0,0 +1,55 @@
+import { isTotpChallenge } from "../api/types.js";
+import { createFlowMachine } from "./createFlowMachine.js";
+import { toFlowError } from "./errors.js";
+const LOCKED_STATUS = 423;
+export function createPasswordLoginFlow(deps) {
+    const machine = createFlowMachine({
+        id: "auth.password_login",
+        initial: { step: "idle" },
+        analytics: deps.analytics ?? null,
+    });
+    async function login(loginId, password) {
+        await machine.run({ step: "authenticating", login: loginId }, () => deps.api.passwordLogin(loginId, password), {
+            resolve: (r) => {
+                if (isTotpChallenge(r)) {
+                    return {
+                        step: "totpRequired",
+                        challengeToken: r.challenge_token,
+                        expiresIn: r.expires_in,
+                    };
+                }
+                deps.onAuthenticated?.(r);
+                return { step: "authenticated", result: r };
+            },
+            reject: (error) => ({
+                step: "error",
+                login: loginId,
+                error: toFlowError(error),
+            }),
+        });
+    }
+    async function submitTotp(proof) {
+        const s = machine.getState();
+        if (s.step !== "totpRequired" && s.step !== "totpError")
+            return;
+        const { challengeToken, expiresIn } = s;
+        await machine.run({ step: "verifyingTotp", challengeToken, expiresIn }, () => deps.api.totpChallengeVerify(challengeToken, proof), {
+            resolve: (result) => {
+                deps.onAuthenticated?.(result);
+                return { step: "authenticated", result };
+            },
+            reject: (error) => {
+                const flowError = toFlowError(error);
+                if (flowError.status === LOCKED_STATUS) {
+                    return { step: "totpLocked", error: flowError };
+                }
+                return { step: "totpError", challengeToken, expiresIn, error: flowError };
+            },
+        });
+    }
+    function reset() {
+        machine.to({ step: "idle" });
+    }
+    return { machine, login, submitTotp, reset };
+}
+//# sourceMappingURL=passwordLoginFlow.js.map

package/dist/flows/passwordLoginFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordLoginFlow.js","sourceRoot":"","sources":["../../src/flows/passwordLoginFlow.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAmD1C,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,UAAU,uBAAuB,CACrC,IAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAAqB;QACpD,EAAE,EAAE,qBAAqB;QACzB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;IAEH,KAAK,UAAU,KAAK,CAAC,OAAe,EAAE,QAAgB;QACpD,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAC1C,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC/C;YACE,OAAO,EAAE,CAAC,CAAC,EAAsB,EAAE;gBACjC,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvB,OAAO;wBACL,IAAI,EAAE,cAAc;wBACpB,cAAc,EAAE,CAAC,CAAC,eAAe;wBACjC,SAAS,EAAE,CAAC,CAAC,UAAU;qBACxB,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC9C,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAsB,EAAE,CAAC,CAAC;gBACtC,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,KAAgB;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO;QAChE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,EACpD,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,cAAc,EAAE,KAAK,CAAC,EACzD;YACE,OAAO,EAAE,CAAC,MAAM,EAAsB,EAAE;gBACtC,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC/B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;YAC3C,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAsB,EAAE;gBACpC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;gBACrC,IAAI,SAAS,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;oBACvC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;gBAClD,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC5E,CAAC;SACF,CACF,CAAC;IACJ,CAAC;IAED,SAAS,KAAK;QACZ,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC"}

package/dist/flows/passwordResetFlow.d.ts

@@ -0,0 +1,56 @@
+import type { Analytics } from "@stapel/core";
+import type { AuthApi } from "../api/authApi.js";
+import type { AuthResponse, OtpChannel } from "../api/types.js";
+import type { FlowMachine } from "./createFlowMachine.js";
+import type { FlowError } from "./errors.js";
+/**
+ * Unauthenticated password reset (auth-sa.md §5). User proves ownership of an
+ * email/phone via OTP and receives a fresh session with the new password. The
+ * verify step carries the new password, so this is a two-input human-wait
+ * (`codeSent`): code + new password together.
+ */
+export type PasswordResetState = {
+    readonly step: "idle";
+} | {
+    readonly step: "requesting";
+    readonly channel: OtpChannel;
+    readonly value: string;
+} | {
+    readonly step: "codeSent";
+    readonly channel: OtpChannel;
+    readonly value: string;
+    readonly target: string;
+} | {
+    readonly step: "verifying";
+    readonly channel: OtpChannel;
+    readonly value: string;
+    readonly target: string;
+} | {
+    readonly step: "authenticated";
+    readonly result: AuthResponse;
+} | {
+    readonly step: "requestError";
+    readonly channel: OtpChannel;
+    readonly value: string;
+    readonly error: FlowError;
+} | {
+    readonly step: "codeError";
+    readonly channel: OtpChannel;
+    readonly value: string;
+    readonly target: string;
+    readonly error: FlowError;
+};
+export interface PasswordResetFlow {
+    readonly machine: FlowMachine<PasswordResetState>;
+    request(channel: OtpChannel, value: string): Promise<void>;
+    resend(): Promise<void>;
+    submit(code: string, newPassword: string): Promise<void>;
+    reset(): void;
+}
+export interface PasswordResetFlowDeps {
+    readonly api: AuthApi;
+    readonly analytics?: Analytics | null;
+    readonly onAuthenticated?: (result: AuthResponse) => void;
+}
+export declare function createPasswordResetFlow(deps: PasswordResetFlowDeps): PasswordResetFlow;
+//# sourceMappingURL=passwordResetFlow.d.ts.map

package/dist/flows/passwordResetFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordResetFlow.d.ts","sourceRoot":"","sources":["../../src/flows/passwordResetFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrF;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7G;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACjE;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B,CAAC;AAEN,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;CAC3D;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,iBAAiB,CAmEnB"}

package/dist/flows/passwordResetFlow.js

@@ -0,0 +1,57 @@
+import { createFlowMachine } from "./createFlowMachine.js";
+import { toFlowError } from "./errors.js";
+export function createPasswordResetFlow(deps) {
+    const machine = createFlowMachine({
+        id: "auth.password_reset",
+        initial: { step: "idle" },
+        analytics: deps.analytics ?? null,
+    });
+    async function request(channel, value) {
+        await machine.run({ step: "requesting", channel, value }, () => deps.api.passwordResetRequest(channel, value), {
+            resolve: (r) => ({
+                step: "codeSent",
+                channel,
+                value,
+                target: r.target,
+            }),
+            reject: (error) => ({
+                step: "requestError",
+                channel,
+                value,
+                error: toFlowError(error),
+            }),
+        });
+    }
+    async function resend() {
+        const s = machine.getState();
+        if (s.step === "codeSent" ||
+            s.step === "codeError" ||
+            s.step === "requestError") {
+            await request(s.channel, s.value);
+        }
+    }
+    async function submit(code, newPassword) {
+        const s = machine.getState();
+        if (s.step !== "codeSent" && s.step !== "codeError")
+            return;
+        const { channel, value, target } = s;
+        await machine.run({ step: "verifying", channel, value, target }, () => deps.api.passwordResetVerify(channel, value, code, newPassword), {
+            resolve: (result) => {
+                deps.onAuthenticated?.(result);
+                return { step: "authenticated", result };
+            },
+            reject: (error) => ({
+                step: "codeError",
+                channel,
+                value,
+                target,
+                error: toFlowError(error),
+            }),
+        });
+    }
+    function reset() {
+        machine.to({ step: "idle" });
+    }
+    return { machine, request, resend, submit, reset };
+}
+//# sourceMappingURL=passwordResetFlow.js.map

package/dist/flows/passwordResetFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordResetFlow.js","sourceRoot":"","sources":["../../src/flows/passwordResetFlow.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgD1C,MAAM,UAAU,uBAAuB,CACrC,IAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAAqB;QACpD,EAAE,EAAE,qBAAqB;QACzB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;IAEH,KAAK,UAAU,OAAO,CAAC,OAAmB,EAAE,KAAa;QACvD,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,EACtC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,EACnD;YACE,OAAO,EAAE,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC;gBACnC,IAAI,EAAE,UAAU;gBAChB,OAAO;gBACP,KAAK;gBACL,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC;YACF,MAAM,EAAE,CAAC,KAAK,EAAsB,EAAE,CAAC,CAAC;gBACtC,IAAI,EAAE,cAAc;gBACpB,OAAO;gBACP,KAAK;gBACL,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IACE,CAAC,CAAC,IAAI,KAAK,UAAU;YACrB,CAAC,CAAC,IAAI,KAAK,WAAW;YACtB,CAAC,CAAC,IAAI,KAAK,cAAc,EACzB,CAAC;YACD,MAAM,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,WAAmB;QACrD,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO;QAC5D,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAC7C,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,EACrE;YACE,OAAO,EAAE,CAAC,MAAM,EAAsB,EAAE;gBACtC,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC/B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;YAC3C,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAsB,EAAE,CAAC,CAAC;gBACtC,IAAI,EAAE,WAAW;gBACjB,OAAO;gBACP,KAAK;gBACL,MAAM;gBACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,SAAS,KAAK;QACZ,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC"}

package/dist/flows/qrLoginFlow.d.ts

@@ -0,0 +1,55 @@
+import type { Analytics } from "@stapel/core";
+import type { AuthApi } from "../api/authApi.js";
+import type { AuthTokens, QrType } from "../api/types.js";
+import type { FlowMachine } from "./createFlowMachine.js";
+import type { FlowError } from "./errors.js";
+/**
+ * QR authentication with background polling (auth-sa.md §8). Serves both the
+ * `login_request` sign-in tab (polling device receives `access_token` /
+ * `refresh_token` on fulfilment) and the `session_share` profile modal (the
+ * *scanning* device gets the session; the generator just watches for
+ * `fulfilled`).
+ *
+ * Device binding matters: generate and poll from the same browser context so
+ * the httponly `stapel_qr_<key>` cookie is present (the client must send
+ * credentials). On `expired` the flow auto-regenerates and resets the poll
+ * loop, per spec.
+ */
+export type QrLoginState = {
+    readonly step: "idle";
+} | {
+    readonly step: "generating";
+    readonly type: QrType;
+} | {
+    readonly step: "awaitingScan";
+    readonly type: QrType;
+    readonly key: string;
+    readonly scanUrl: string;
+    readonly expiresIn: number;
+} | {
+    readonly step: "fulfilled";
+    readonly tokens: AuthTokens | null;
+} | {
+    readonly step: "rejected";
+    readonly key: string;
+} | {
+    readonly step: "error";
+    readonly error: FlowError;
+};
+export interface QrLoginFlow {
+    readonly machine: FlowMachine<QrLoginState>;
+    /** Generate a QR and begin the poll loop. */
+    start(type: QrType, redirectUrl: string, allowUnauthenticatedScanner?: boolean): Promise<void>;
+    /** Stop polling and reset to idle (call on modal close / unmount). */
+    dispose(): void;
+}
+export interface QrLoginFlowDeps {
+    readonly api: AuthApi;
+    readonly analytics?: Analytics | null;
+    /** For `login_request` fulfilment — receives the delivered tokens. */
+    readonly onAuthenticated?: (tokens: AuthTokens) => void;
+    /** Poll cadence; default 5000 ms (auth-sa.md §8). */
+    readonly pollIntervalMs?: number;
+}
+export declare function createQrLoginFlow(deps: QrLoginFlowDeps): QrLoginFlow;
+//# sourceMappingURL=qrLoginFlow.d.ts.map

package/dist/flows/qrLoginFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qrLoginFlow.d.ts","sourceRoot":"","sources":["../../src/flows/qrLoginFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtD;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,GAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;IAC5C,6CAA6C;IAC7C,KAAK,CACH,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,2BAA2B,CAAC,EAAE,OAAO,GACpC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,sEAAsE;IACtE,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC,sEAAsE;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxD,qDAAqD;IACrD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CAsGpE"}

package/dist/flows/qrLoginFlow.js

@@ -0,0 +1,91 @@
+import { createFlowMachine } from "./createFlowMachine.js";
+import { toFlowError } from "./errors.js";
+export function createQrLoginFlow(deps) {
+    const machine = createFlowMachine({
+        id: "auth.qr_login",
+        initial: { step: "idle" },
+        analytics: deps.analytics ?? null,
+    });
+    const interval = deps.pollIntervalMs ?? 5000;
+    let timer = null;
+    let params = null;
+    function clearTimer() {
+        if (timer !== null) {
+            clearTimeout(timer);
+            timer = null;
+        }
+    }
+    function schedulePoll(key) {
+        clearTimer();
+        timer = setTimeout(() => {
+            void poll(key);
+        }, interval);
+    }
+    async function poll(key) {
+        // Bail if the machine moved on (disposed / regenerated).
+        const s = machine.getState();
+        if (s.step !== "awaitingScan" || s.key !== key)
+            return;
+        try {
+            const status = await deps.api.qrStatus(key);
+            if (machine.getState().step !== "awaitingScan")
+                return;
+            switch (status.status) {
+                case "pending":
+                    schedulePoll(key);
+                    break;
+                case "fulfilled": {
+                    clearTimer();
+                    const tokens = status.access_token !== undefined && status.refresh_token !== undefined
+                        ? { access: status.access_token, refresh: status.refresh_token }
+                        : null;
+                    if (tokens)
+                        deps.onAuthenticated?.(tokens);
+                    machine.to({ step: "fulfilled", tokens });
+                    break;
+                }
+                case "expired":
+                    clearTimer();
+                    if (params) {
+                        void start(params.type, params.redirectUrl, params.allowUnauth);
+                    }
+                    break;
+                case "rejected":
+                    clearTimer();
+                    machine.to({ step: "rejected", key });
+                    break;
+            }
+        }
+        catch (error) {
+            clearTimer();
+            machine.to({ step: "error", error: toFlowError(error) });
+        }
+    }
+    async function start(type, redirectUrl, allowUnauthenticatedScanner) {
+        clearTimer();
+        params = { type, redirectUrl, allowUnauth: allowUnauthenticatedScanner };
+        await machine.run({ step: "generating", type }, () => deps.api.qrGenerate(type, redirectUrl, allowUnauthenticatedScanner), {
+            resolve: (r) => ({
+                step: "awaitingScan",
+                type,
+                key: r.key,
+                scanUrl: r.scan_url,
+                expiresIn: r.expires_in,
+            }),
+            reject: (error) => ({
+                step: "error",
+                error: toFlowError(error),
+            }),
+        });
+        const after = machine.getState();
+        if (after.step === "awaitingScan")
+            schedulePoll(after.key);
+    }
+    function dispose() {
+        clearTimer();
+        params = null;
+        machine.to({ step: "idle" });
+    }
+    return { machine, start, dispose };
+}
+//# sourceMappingURL=qrLoginFlow.js.map

package/dist/flows/qrLoginFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qrLoginFlow.js","sourceRoot":"","sources":["../../src/flows/qrLoginFlow.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkD1C,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,OAAO,GAAG,iBAAiB,CAAe;QAC9C,EAAE,EAAE,eAAe;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;IAE7C,IAAI,KAAK,GAAyC,IAAI,CAAC;IACvD,IAAI,MAAM,GAIC,IAAI,CAAC;IAEhB,SAAS,UAAU;QACjB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IAED,SAAS,YAAY,CAAC,GAAW;QAC/B,UAAU,EAAE,CAAC;QACb,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC,EAAE,QAAQ,CAAC,CAAC;IACf,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,GAAW;QAC7B,yDAAyD;QACzD,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,KAAK,cAAc;gBAAE,OAAO;YACvD,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,KAAK,SAAS;oBACZ,YAAY,CAAC,GAAG,CAAC,CAAC;oBAClB,MAAM;gBACR,KAAK,WAAW,CAAC,CAAC,CAAC;oBACjB,UAAU,EAAE,CAAC;oBACb,MAAM,MAAM,GACV,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;wBACrE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE;wBAChE,CAAC,CAAC,IAAI,CAAC;oBACX,IAAI,MAAM;wBAAE,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;oBAC3C,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC1C,MAAM;gBACR,CAAC;gBACD,KAAK,SAAS;oBACZ,UAAU,EAAE,CAAC;oBACb,IAAI,MAAM,EAAE,CAAC;wBACX,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;oBAClE,CAAC;oBACD,MAAM;gBACR,KAAK,UAAU;oBACb,UAAU,EAAE,CAAC;oBACb,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;oBACtC,MAAM;YACV,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,IAAY,EACZ,WAAmB,EACnB,2BAAqC;QAErC,UAAU,EAAE,CAAC;QACb,MAAM,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;QACzE,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAC5B,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,2BAA2B,CAAC,EACzE;YACE,OAAO,EAAE,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC;gBAC7B,IAAI,EAAE,cAAc;gBACpB,IAAI;gBACJ,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,OAAO,EAAE,CAAC,CAAC,QAAQ;gBACnB,SAAS,EAAE,CAAC,CAAC,UAAU;aACxB,CAAC;YACF,MAAM,EAAE,CAAC,KAAK,EAAgB,EAAE,CAAC,CAAC;gBAChC,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;YAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,SAAS,OAAO;QACd,UAAU,EAAE,CAAC;QACb,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC"}