@stapel/auth-react 1.0.0

package/dist/flows/ssoFlow.d.ts

@@ -0,0 +1,46 @@
+import type { Analytics } from "@stapel/core";
+import type { AuthApi } from "../api/authApi.js";
+import type { SsoLookupResponse } from "../api/types.js";
+import type { FlowMachine } from "./createFlowMachine.js";
+import type { FlowError } from "./errors.js";
+/**
+ * Enterprise SSO discovery (auth-sa.md §18). The flow covers the *frontend*
+ * part: look up a domain after the user types their email, then decide what to
+ * render. Actual login is a full-page browser navigation to
+ * `authUrls(base).ssoLogin(orgSlug)` — the backend handles SAML/OIDC opaquely
+ * and drops the user back on `FRONTEND_URL/` with cookies set. `beginLogin`
+ * performs that navigation when a redirector is available.
+ */
+export type SsoState = {
+    readonly step: "idle";
+} | {
+    readonly step: "looking";
+    readonly domain: string;
+} | {
+    readonly step: "resolved";
+    readonly domain: string;
+    readonly result: SsoLookupResponse;
+} | {
+    readonly step: "error";
+    readonly domain: string;
+    readonly error: FlowError;
+};
+export interface SsoFlow {
+    readonly machine: FlowMachine<SsoState>;
+    /** Look up SSO for an email domain (`sso_required` / optional / none). */
+    lookup(domain: string): Promise<void>;
+    /** Navigate the browser to the SSO login endpoint for an org slug. */
+    beginLogin(orgSlug: string): void;
+    reset(): void;
+}
+export interface SsoFlowDeps {
+    readonly api: AuthApi;
+    readonly analytics?: Analytics | null;
+    /**
+     * Full-page redirect seam (default `window.location.assign`). Injectable for
+     * tests / custom routers.
+     */
+    readonly redirect?: (url: string) => void;
+}
+export declare function createSsoFlow(deps: SsoFlowDeps): SsoFlow;
+//# sourceMappingURL=ssoFlow.d.ts.map

package/dist/flows/ssoFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssoFlow.d.ts","sourceRoot":"","sources":["../../src/flows/ssoFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;CACpC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAEnF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,0EAA0E;IAC1E,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,sEAAsE;IACtE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAqCxD"}

package/dist/flows/ssoFlow.js

@@ -0,0 +1,34 @@
+import { authUrls } from "../api/urls.js";
+import { createFlowMachine } from "./createFlowMachine.js";
+import { toFlowError } from "./errors.js";
+export function createSsoFlow(deps) {
+    const machine = createFlowMachine({
+        id: "auth.sso",
+        initial: { step: "idle" },
+        analytics: deps.analytics ?? null,
+    });
+    async function lookup(domain) {
+        await machine.run({ step: "looking", domain }, () => deps.api.ssoLookup(domain), {
+            resolve: (result) => ({ step: "resolved", domain, result }),
+            reject: (error) => ({
+                step: "error",
+                domain,
+                error: toFlowError(error),
+            }),
+        });
+    }
+    function beginLogin(orgSlug) {
+        const url = authUrls(deps.api.client.baseUrl).ssoLogin(orgSlug);
+        const go = deps.redirect ??
+            ((target) => {
+                if (typeof window !== "undefined")
+                    window.location.assign(target);
+            });
+        go(url);
+    }
+    function reset() {
+        machine.to({ step: "idle" });
+    }
+    return { machine, lookup, beginLogin, reset };
+}
+//# sourceMappingURL=ssoFlow.js.map

package/dist/flows/ssoFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssoFlow.js","sourceRoot":"","sources":["../../src/flows/ssoFlow.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAwC1C,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,MAAM,OAAO,GAAG,iBAAiB,CAAW;QAC1C,EAAE,EAAE,UAAU;QACd,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;IAEH,KAAK,UAAU,MAAM,CAAC,MAAc;QAClC,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAC3B,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAChC;YACE,OAAO,EAAE,CAAC,MAAM,EAAY,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACrE,MAAM,EAAE,CAAC,KAAK,EAAY,EAAE,CAAC,CAAC;gBAC5B,IAAI,EAAE,OAAO;gBACb,MAAM;gBACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,SAAS,UAAU,CAAC,OAAe;QACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,EAAE,GACN,IAAI,CAAC,QAAQ;YACb,CAAC,CAAC,MAAc,EAAE,EAAE;gBAClB,IAAI,OAAO,MAAM,KAAK,WAAW;oBAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;QACL,EAAE,CAAC,GAAG,CAAC,CAAC;IACV,CAAC;IAED,SAAS,KAAK;QACZ,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAChD,CAAC"}

package/dist/flows/totpSetupFlow.d.ts

@@ -0,0 +1,49 @@
+import type { Analytics } from "@stapel/core";
+import type { AuthApi } from "../api/authApi.js";
+import type { FlowMachine } from "./createFlowMachine.js";
+import type { FlowError } from "./errors.js";
+/**
+ * TOTP enrollment on the security-settings screen (auth-sa.md §11 "TOTP
+ * setup"). `start()` mints a pending secret + `otpauth://` URI (render as a
+ * QR); `confirm(code)` proves the authenticator and returns the one-time
+ * backup codes (shown ONCE — host must surface a copy/warn affordance).
+ */
+export type TotpSetupState = {
+    readonly step: "idle";
+} | {
+    readonly step: "starting";
+} | {
+    readonly step: "enrolling";
+    readonly secret: string;
+    readonly qrUri: string;
+    readonly expiresIn: number;
+} | {
+    readonly step: "confirming";
+    readonly secret: string;
+    readonly qrUri: string;
+    readonly expiresIn: number;
+} | {
+    readonly step: "done";
+    readonly backupCodes: readonly string[];
+} | {
+    readonly step: "startError";
+    readonly error: FlowError;
+} | {
+    readonly step: "confirmError";
+    readonly secret: string;
+    readonly qrUri: string;
+    readonly expiresIn: number;
+    readonly error: FlowError;
+};
+export interface TotpSetupFlow {
+    readonly machine: FlowMachine<TotpSetupState>;
+    start(): Promise<void>;
+    confirm(code: string): Promise<void>;
+    reset(): void;
+}
+export interface TotpSetupFlowDeps {
+    readonly api: AuthApi;
+    readonly analytics?: Analytics | null;
+}
+export declare function createTotpSetupFlow(deps: TotpSetupFlowDeps): TotpSetupFlow;
+//# sourceMappingURL=totpSetupFlow.d.ts.map

package/dist/flows/totpSetupFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totpSetupFlow.d.ts","sourceRoot":"","sources":["../../src/flows/totpSetupFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC5G;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAC1D;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B,CAAC;AAEN,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;IAC9C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;CACvC;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAkD1E"}

package/dist/flows/totpSetupFlow.js

@@ -0,0 +1,47 @@
+import { createFlowMachine } from "./createFlowMachine.js";
+import { toFlowError } from "./errors.js";
+export function createTotpSetupFlow(deps) {
+    const machine = createFlowMachine({
+        id: "auth.totp_setup",
+        initial: { step: "idle" },
+        analytics: deps.analytics ?? null,
+    });
+    async function start() {
+        await machine.run({ step: "starting" }, () => deps.api.totpSetup(), {
+            resolve: (r) => ({
+                step: "enrolling",
+                secret: r.secret,
+                qrUri: r.qr_uri,
+                expiresIn: r.expires_in,
+            }),
+            reject: (error) => ({
+                step: "startError",
+                error: toFlowError(error),
+            }),
+        });
+    }
+    async function confirm(code) {
+        const s = machine.getState();
+        if (s.step !== "enrolling" && s.step !== "confirmError")
+            return;
+        const { secret, qrUri, expiresIn } = s;
+        await machine.run({ step: "confirming", secret, qrUri, expiresIn }, () => deps.api.totpSetupConfirm(code), {
+            resolve: (r) => ({
+                step: "done",
+                backupCodes: r.backup_codes,
+            }),
+            reject: (error) => ({
+                step: "confirmError",
+                secret,
+                qrUri,
+                expiresIn,
+                error: toFlowError(error),
+            }),
+        });
+    }
+    function reset() {
+        machine.to({ step: "idle" });
+    }
+    return { machine, start, confirm, reset };
+}
+//# sourceMappingURL=totpSetupFlow.js.map

package/dist/flows/totpSetupFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totpSetupFlow.js","sourceRoot":"","sources":["../../src/flows/totpSetupFlow.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAyC1C,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,OAAO,GAAG,iBAAiB,CAAiB;QAChD,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;IAEH,KAAK,UAAU,KAAK;QAClB,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE;YAClE,OAAO,EAAE,CAAC,CAAC,EAAkB,EAAE,CAAC,CAAC;gBAC/B,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,KAAK,EAAE,CAAC,CAAC,MAAM;gBACf,SAAS,EAAE,CAAC,CAAC,UAAU;aACxB,CAAC;YACF,MAAM,EAAE,CAAC,KAAK,EAAkB,EAAE,CAAC,CAAC;gBAClC,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,IAAY;QACjC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO;QAChE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAChD,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,EACrC;YACE,OAAO,EAAE,CAAC,CAAC,EAAkB,EAAE,CAAC,CAAC;gBAC/B,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,CAAC,CAAC,YAAY;aAC5B,CAAC;YACF,MAAM,EAAE,CAAC,KAAK,EAAkB,EAAE,CAAC,CAAC;gBAClC,IAAI,EAAE,cAAc;gBACpB,MAAM;gBACN,KAAK;gBACL,SAAS;gBACT,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,SAAS,KAAK;QACZ,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC"}

package/dist/flows/useFlow.d.ts

@@ -0,0 +1,9 @@
+import type { FlowMachine, FlowStateBase } from "./createFlowMachine.js";
+/**
+ * React binding for a {@link FlowMachine}: subscribes to transitions and
+ * returns the current state. Because the machine stores immutable state
+ * snapshots, `getState` is a stable reference read — no tearing under
+ * concurrent React.
+ */
+export declare function useFlow<S extends FlowStateBase>(machine: FlowMachine<S>): S;
+//# sourceMappingURL=useFlow.d.ts.map

package/dist/flows/useFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useFlow.d.ts","sourceRoot":"","sources":["../../src/flows/useFlow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEzE;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,aAAa,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAM3E"}

package/dist/flows/useFlow.js

@@ -0,0 +1,11 @@
+import { useSyncExternalStore } from "react";
+/**
+ * React binding for a {@link FlowMachine}: subscribes to transitions and
+ * returns the current state. Because the machine stores immutable state
+ * snapshots, `getState` is a stable reference read — no tearing under
+ * concurrent React.
+ */
+export function useFlow(machine) {
+    return useSyncExternalStore(machine.subscribe, machine.getState, machine.getState);
+}
+//# sourceMappingURL=useFlow.js.map

package/dist/flows/useFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useFlow.js","sourceRoot":"","sources":["../../src/flows/useFlow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAG7C;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAA0B,OAAuB;IACtE,OAAO,oBAAoB,CACzB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,QAAQ,CACjB,CAAC;AACJ,CAAC"}

package/dist/flows/verificationFlow.d.ts

@@ -0,0 +1,108 @@
+import type { Analytics, VerificationChallengeHandler } from "@stapel/core";
+import type { AuthApi } from "../api/authApi.js";
+import type { VerificationEnvelope, VerificationFactorId } from "../api/types.js";
+import type { FlowMachine } from "./createFlowMachine.js";
+import type { FlowError } from "./errors.js";
+/**
+ * THE FLAGSHIP CROSS-MODULE FLOW (frontend-standard §2).
+ *
+ * `@stapel/core`'s client intercepts a `403` whose body carries a
+ * `verification` envelope and calls `onVerificationChallenge(challenge)`,
+ * awaiting a {@link VerificationOutcome}. This controller *is* that handler: it
+ * parks a React flow-machine on the challenge, drives the user through one
+ * interchangeable factor (`otp_email` / `otp_phone` / `totp` / `passkey`), and
+ * resolves the awaited promise with `{ retry: true, token }` so core replays
+ * the original request with `X-Verification-Token`. Cancelling resolves
+ * `{ retry: false }` and the original 403 propagates.
+ *
+ * Wire it once:
+ * ```ts
+ * const verification = createVerificationController({ api });
+ * const client = createStapelClient({
+ *   baseUrl,
+ *   onVerificationChallenge: verification.handler,
+ * });
+ * // render <VerificationChallenge controller={verification}> at the app root
+ * ```
+ *
+ * Lifecycle safety: exactly one challenge is live at a time. It self-releases
+ * on `expires_at` (an abandoned modal resolves `retry:false` instead of hanging
+ * the core request forever and wedging future challenges), and a factor whose
+ * `initiate` fails recoverably returns to the picker so a different factor is
+ * still choosable — only a 404 (challenge gone) ends the whole challenge.
+ *
+ * WebAuthn note: the `passkey` factor is **flow-complete but its browser
+ * binding is a thin TODO** — the machine surfaces `session_key` + `options`
+ * and accepts a finished credential via `submitPasskey`; calling
+ * `navigator.credentials.get()` is the host's (or an injected `webauthnGet`)
+ * responsibility. See MODULE.md.
+ */
+export type VerificationState = {
+    readonly step: "idle";
+} | {
+    readonly step: "picking";
+    readonly challenge: VerificationEnvelope;
+    /** Set when a prior factor's initiate failed recoverably — pick another. */
+    readonly error?: FlowError;
+} | {
+    readonly step: "initiating";
+    readonly challenge: VerificationEnvelope;
+    readonly factor: VerificationFactorId;
+} | {
+    readonly step: "awaitingCode";
+    readonly challenge: VerificationEnvelope;
+    readonly factor: "otp_email" | "otp_phone" | "totp";
+    readonly target: string | null;
+} | {
+    readonly step: "awaitingPasskey";
+    readonly challenge: VerificationEnvelope;
+    readonly sessionKey: string;
+    readonly options: Record<string, unknown>;
+} | {
+    readonly step: "verifying";
+    readonly challenge: VerificationEnvelope;
+    readonly factor: VerificationFactorId;
+} | {
+    readonly step: "verified";
+    readonly token: string;
+} | {
+    readonly step: "factorError";
+    readonly challenge: VerificationEnvelope;
+    readonly factor: VerificationFactorId;
+    readonly target: string | null;
+    readonly error: FlowError;
+} | {
+    readonly step: "unavailable";
+    readonly error: FlowError;
+} | {
+    readonly step: "expired";
+};
+export interface VerificationController {
+    readonly machine: FlowMachine<VerificationState>;
+    /** The handler wired into `createStapelClient({ onVerificationChallenge })`. */
+    readonly handler: VerificationChallengeHandler;
+    /** Choose one of the challenge's factors and initiate it. */
+    chooseFactor(factor: VerificationFactorId): Promise<void>;
+    /** Submit an OTP/TOTP code (or a TOTP backup code). */
+    submitCode(proof: {
+        code?: string;
+        backup_code?: string;
+    }): Promise<void>;
+    /** Submit a finished WebAuthn assertion for the `passkey` factor. */
+    submitPasskey(credential: unknown): Promise<void>;
+    /** Abandon the challenge — resolves the awaited outcome with `retry:false`. */
+    cancel(): void;
+}
+export interface VerificationControllerDeps {
+    /** Lazy-friendly: a thunk breaks the client↔controller wiring cycle. */
+    readonly api: AuthApi | (() => AuthApi);
+    readonly analytics?: Analytics | null;
+    /**
+     * Optional WebAuthn binding. When provided, choosing the `passkey` factor
+     * auto-calls it with the server `options` and submits the result — the host
+     * needs no passkey code. Thin by design; omit to drive it manually.
+     */
+    readonly webauthnGet?: (options: Record<string, unknown>) => Promise<unknown>;
+}
+export declare function createVerificationController(deps: VerificationControllerDeps): VerificationController;
+//# sourceMappingURL=verificationFlow.d.ts.map

package/dist/flows/verificationFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationFlow.d.ts","sourceRoot":"","sources":["../../src/flows/verificationFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,SAAS,EAET,4BAA4B,EAE7B,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;CAC5B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrD;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,4BAA4B,CAAC;IAC/C,6DAA6D;IAC7D,YAAY,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,uDAAuD;IACvD,UAAU,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,qEAAqE;IACrE,aAAa,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,+EAA+E;IAC/E,MAAM,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAiBD,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,0BAA0B,GAC/B,sBAAsB,CA4MxB"}

package/dist/flows/verificationFlow.js

@@ -0,0 +1,195 @@
+import { createFlowMachine } from "./createFlowMachine.js";
+import { toFlowError } from "./errors.js";
+const NOT_FOUND_STATUS = 404;
+const LOCKED_STATUS = 423;
+function asEnvelope(challenge) {
+    return {
+        challenge_id: challenge.challenge_id,
+        scope: typeof challenge.scope === "string" ? challenge.scope : "",
+        factors: (challenge.factors ?? []),
+        expires_at: typeof challenge["expires_at"] === "number"
+            ? challenge["expires_at"]
+            : 0,
+    };
+}
+export function createVerificationController(deps) {
+    const machine = createFlowMachine({
+        id: "auth.verification",
+        initial: { step: "idle" },
+        analytics: deps.analytics ?? null,
+    });
+    const api = () => typeof deps.api === "function" ? deps.api() : deps.api;
+    // The awaited outcome for the in-flight core request. Exactly one challenge
+    // is handled at a time; a second arriving while one is active is declined.
+    let resolveOutcome = null;
+    // Self-release timer: without it, a user who abandons the modal (never
+    // cancels) leaves the core `await onVerificationChallenge(...)` hanging
+    // forever AND — because `resolveOutcome` stays set — wedges every FUTURE
+    // challenge into `retry:false`. The envelope's `expires_at` bounds this.
+    let expiryTimer = null;
+    function clearExpiry() {
+        if (expiryTimer !== null) {
+            clearTimeout(expiryTimer);
+            expiryTimer = null;
+        }
+    }
+    function settle(outcome) {
+        clearExpiry();
+        const resolve = resolveOutcome;
+        resolveOutcome = null;
+        resolve?.(outcome);
+    }
+    function scheduleExpiry(envelope) {
+        clearExpiry();
+        if (!envelope.expires_at)
+            return; // no bound advertised
+        const fire = () => {
+            if (resolveOutcome === null)
+                return; // already settled
+            machine.to({ step: "expired" });
+            settle({ retry: false });
+        };
+        const delayMs = envelope.expires_at * 1000 - Date.now();
+        if (delayMs <= 0) {
+            fire();
+            return;
+        }
+        expiryTimer = setTimeout(fire, delayMs);
+    }
+    const handler = (challenge) => {
+        if (resolveOutcome !== null) {
+            // Already busy with another challenge — decline the new one.
+            return Promise.resolve({ retry: false });
+        }
+        const envelope = asEnvelope(challenge);
+        return new Promise((resolve) => {
+            resolveOutcome = resolve;
+            machine.to({ step: "picking", challenge: envelope });
+            scheduleExpiry(envelope);
+        });
+    };
+    function currentChallenge() {
+        const s = machine.getState();
+        if ("challenge" in s)
+            return s.challenge;
+        return null;
+    }
+    function foldUnavailable(error) {
+        if (error.status === NOT_FOUND_STATUS || error.status === LOCKED_STATUS) {
+            return { step: "unavailable", error };
+        }
+        return null;
+    }
+    async function chooseFactor(factor) {
+        const challenge = currentChallenge();
+        if (challenge === null)
+            return;
+        await machine.run({ step: "initiating", challenge, factor }, () => api().verificationInitiate(challenge.challenge_id, factor), {
+            resolve: (r) => {
+                if (factor === "passkey") {
+                    const sessionKey = String(r.data["session_key"] ?? "");
+                    const options = (r.data["options"] ?? {});
+                    return {
+                        step: "awaitingPasskey",
+                        challenge,
+                        sessionKey,
+                        options,
+                    };
+                }
+                const target = typeof r.data["target"] === "string"
+                    ? r.data["target"]
+                    : null;
+                return { step: "awaitingCode", challenge, factor, target };
+            },
+            reject: (error) => {
+                const flowError = toFlowError(error);
+                // A 404 means the whole challenge is gone — restart the original
+                // action; release the core request.
+                if (flowError.status === NOT_FOUND_STATUS) {
+                    settle({ retry: false });
+                    return { step: "unavailable", error: flowError };
+                }
+                // Any other initiate failure (a locked/invalid factor, network) is
+                // factor-scoped: keep the challenge alive and return to the picker so
+                // the user can choose a DIFFERENT factor. A 423-locked email factor
+                // must not kill an available TOTP factor. Do NOT settle — the expiry
+                // timer still bounds abandonment.
+                return { step: "picking", challenge, error: flowError };
+            },
+        });
+        // Auto-drive the passkey factor when a binding is injected (thin seam).
+        const after = machine.getState();
+        if (after.step === "awaitingPasskey" && deps.webauthnGet) {
+            try {
+                const credential = await deps.webauthnGet(after.options);
+                await submitPasskey(credential);
+            }
+            catch (error) {
+                machine.to({
+                    step: "factorError",
+                    challenge,
+                    factor: "passkey",
+                    target: null,
+                    error: toFlowError(error),
+                });
+            }
+        }
+    }
+    async function complete(challenge, factor, target, body) {
+        await machine.run({ step: "verifying", challenge, factor }, () => api().verificationComplete(challenge.challenge_id, body), {
+            resolve: (r) => {
+                settle({ retry: true, token: r.verification_token });
+                return { step: "verified", token: r.verification_token };
+            },
+            reject: (error) => {
+                const flowError = toFlowError(error);
+                const unavailable = foldUnavailable(flowError);
+                if (unavailable) {
+                    settle({ retry: false });
+                    return unavailable;
+                }
+                // Recoverable (wrong code) — stay in the flow for a retry.
+                return { step: "factorError", challenge, factor, target, error: flowError };
+            },
+        });
+    }
+    async function submitCode(proof) {
+        const s = machine.getState();
+        let challenge;
+        let factor;
+        let target;
+        if (s.step === "awaitingCode") {
+            ({ challenge, factor, target } = s);
+        }
+        else if (s.step === "factorError" && s.factor !== "passkey") {
+            ({ challenge, factor, target } = s);
+        }
+        else {
+            return;
+        }
+        await complete(challenge, factor, target, { factor, ...proof });
+    }
+    async function submitPasskey(credential) {
+        const s = machine.getState();
+        if (s.step !== "awaitingPasskey")
+            return;
+        await complete(s.challenge, "passkey", null, {
+            factor: "passkey",
+            session_key: s.sessionKey,
+            credential,
+        });
+    }
+    function cancel() {
+        settle({ retry: false });
+        machine.to({ step: "idle" });
+    }
+    return {
+        machine,
+        handler,
+        chooseFactor,
+        submitCode,
+        submitPasskey,
+        cancel,
+    };
+}
+//# sourceMappingURL=verificationFlow.js.map

package/dist/flows/verificationFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationFlow.js","sourceRoot":"","sources":["../../src/flows/verificationFlow.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA0G1C,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,SAAS,UAAU,CAAC,SAAgC;IAClD,OAAO;QACL,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,KAAK,EAAE,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACjE,OAAO,EAAE,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAoC;QACrE,UAAU,EACR,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,QAAQ;YACzC,CAAC,CAAE,SAAS,CAAC,YAAY,CAAY;YACrC,CAAC,CAAC,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,IAAgC;IAEhC,MAAM,OAAO,GAAG,iBAAiB,CAAoB;QACnD,EAAE,EAAE,mBAAmB;QACvB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,GAAY,EAAE,CACxB,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IAEzD,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,cAAc,GAAoD,IAAI,CAAC;IAC3E,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,WAAW,GAAyC,IAAI,CAAC;IAE7D,SAAS,WAAW;QAClB,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,YAAY,CAAC,WAAW,CAAC,CAAC;YAC1B,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAED,SAAS,MAAM,CAAC,OAA4B;QAC1C,WAAW,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,cAAc,CAAC;QAC/B,cAAc,GAAG,IAAI,CAAC;QACtB,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,SAAS,cAAc,CAAC,QAA8B;QACpD,WAAW,EAAE,CAAC;QACd,IAAI,CAAC,QAAQ,CAAC,UAAU;YAAE,OAAO,CAAC,sBAAsB;QACxD,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,IAAI,cAAc,KAAK,IAAI;gBAAE,OAAO,CAAC,kBAAkB;YACvD,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAChC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,OAAO,GAAiC,CAAC,SAAS,EAAE,EAAE;QAC1D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,6DAA6D;YAC7D,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,EAAE;YAClD,cAAc,GAAG,OAAO,CAAC;YACzB,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrD,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,SAAS,gBAAgB;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,WAAW,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,SAAS,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,eAAe,CAAC,KAAgB;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACxE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAA4B;QACtD,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;QACrC,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO;QAE/B,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,EACzC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,EAChE;YACE,OAAO,EAAE,CAAC,CAAC,EAAqB,EAAE;gBAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;oBACvD,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAA4B,CAAC;oBACrE,OAAO;wBACL,IAAI,EAAE,iBAAiB;wBACvB,SAAS;wBACT,UAAU;wBACV,OAAO;qBACR,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GACV,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ;oBAClC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAY;oBAC9B,CAAC,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC7D,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAqB,EAAE;gBACnC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;gBACrC,iEAAiE;gBACjE,oCAAoC;gBACpC,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;oBAC1C,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBACzB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;gBACnD,CAAC;gBACD,mEAAmE;gBACnE,sEAAsE;gBACtE,oEAAoE;gBACpE,qEAAqE;gBACrE,kCAAkC;gBAClC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC1D,CAAC;SACF,CACF,CAAC;QAEF,wEAAwE;QACxE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACzD,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,EAAE,CAAC;oBACT,IAAI,EAAE,aAAa;oBACnB,SAAS;oBACT,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,IAAI;oBACZ,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,QAAQ,CACrB,SAA+B,EAC/B,MAA4B,EAC5B,MAAqB,EACrB,IAA6B;QAE7B,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,EACxC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,EAC9D;YACE,OAAO,EAAE,CAAC,CAAC,EAAqB,EAAE;gBAChC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;gBACrD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC;YAC3D,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAqB,EAAE;gBACnC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;gBAC/C,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBACzB,OAAO,WAAW,CAAC;gBACrB,CAAC;gBACD,2DAA2D;gBAC3D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC9E,CAAC;SACF,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,KAGzB;QACC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,SAA+B,CAAC;QACpC,IAAI,MAA4B,CAAC;QACjC,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC9B,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9D,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,UAAmB;QAC9C,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO;QACzC,MAAM,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;YAC3C,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,CAAC,CAAC,UAAU;YACzB,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED,SAAS,MAAM;QACb,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACzB,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,OAAO;QACP,OAAO;QACP,YAAY;QACZ,UAAU;QACV,aAAa;QACb,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/headless/AuthProvider.d.ts

@@ -0,0 +1,18 @@
+import type { ReactElement, ReactNode } from "react";
+import type { AuthRuntime } from "../model/runtime.js";
+/**
+ * Provides the wired {@link AuthRuntime} to every auth hook and headless
+ * component below it, and restores any persisted session once on mount. Bring
+ * your own visual shell — this component renders nothing of its own.
+ *
+ * ```tsx
+ * const runtime = createAuthRuntime({ baseUrl: "/auth/api", storage });
+ * // give runtime.client to core's <StapelConfigProvider config={{ client }}>
+ * <AuthProvider runtime={runtime}>{app}</AuthProvider>
+ * ```
+ */
+export declare function AuthProvider(props: {
+    runtime: AuthRuntime;
+    children: ReactNode;
+}): ReactElement;
+//# sourceMappingURL=AuthProvider.d.ts.map

package/dist/headless/AuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/headless/AuthProvider.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,SAAS,CAAC;CACrB,GAAG,YAAY,CAUf"}

package/dist/headless/AuthProvider.js

@@ -0,0 +1,22 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useEffect } from "react";
+import { AuthRuntimeContext } from "../model/context.js";
+/**
+ * Provides the wired {@link AuthRuntime} to every auth hook and headless
+ * component below it, and restores any persisted session once on mount. Bring
+ * your own visual shell — this component renders nothing of its own.
+ *
+ * ```tsx
+ * const runtime = createAuthRuntime({ baseUrl: "/auth/api", storage });
+ * // give runtime.client to core's <StapelConfigProvider config={{ client }}>
+ * <AuthProvider runtime={runtime}>{app}</AuthProvider>
+ * ```
+ */
+export function AuthProvider(props) {
+    const { runtime } = props;
+    useEffect(() => {
+        void runtime.session.restore();
+    }, [runtime]);
+    return (_jsx(AuthRuntimeContext.Provider, { value: runtime, children: props.children }));
+}
+//# sourceMappingURL=AuthProvider.js.map

package/dist/headless/AuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../../src/headless/AuthProvider.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAG5B;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACjC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACd,OAAO,CACL,KAAC,kBAAkB,CAAC,QAAQ,IAAC,KAAK,EAAE,OAAO,YACxC,KAAK,CAAC,QAAQ,GACa,CAC/B,CAAC;AACJ,CAAC"}

package/dist/headless/Passkey.d.ts

@@ -0,0 +1,31 @@
+import type { ReactNode } from "react";
+import type { PasskeyLoginState, PasskeyRegisterState } from "../flows/passkeyFlow.js";
+/**
+ * Optional WebAuthn binding injected into the passkey headless components.
+ * THIN by design (auth-sa.md §17): when omitted, the host performs the
+ * `navigator.credentials.*` ceremony and calls `submit*` with the result.
+ */
+export type WebauthnBinding = (options: Record<string, unknown>) => Promise<unknown>;
+export interface PasskeyRegistrationBag {
+    readonly state: PasskeyRegisterState;
+    begin(deviceName?: string): void;
+    submitCredential(credential: unknown): void;
+    reset(): void;
+}
+/** Headless passkey registration (auth-sa.md §17, requires auth). */
+export declare function PasskeyRegistration(props: {
+    children: (bag: PasskeyRegistrationBag) => ReactNode;
+    webauthnCreate?: WebauthnBinding;
+}): ReactNode;
+export interface PasskeyLoginBag {
+    readonly state: PasskeyLoginState;
+    begin(email?: string): void;
+    submitAssertion(credential: unknown): void;
+    reset(): void;
+}
+/** Headless passkey login (auth-sa.md §17, no auth required). */
+export declare function PasskeyLogin(props: {
+    children: (bag: PasskeyLoginBag) => ReactNode;
+    webauthnGet?: WebauthnBinding;
+}): ReactNode;
+//# sourceMappingURL=Passkey.d.ts.map

package/dist/headless/Passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Passkey.d.ts","sourceRoot":"","sources":["../../src/headless/Passkey.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAKvC,OAAO,KAAK,EACV,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,yBAAyB,CAAC;AAIjC;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,QAAQ,EAAE,CAAC,GAAG,EAAE,sBAAsB,KAAK,SAAS,CAAC;IACrD,cAAc,CAAC,EAAE,eAAe,CAAC;CAClC,GAAG,SAAS,CAwBZ;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,QAAQ,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,SAAS,CAAC;IAC9C,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,GAAG,SAAS,CA0BZ"}