@wtfalch/auth 0.16.0 → 0.20.0

package/dist/broker.d.ts

@@ -15,6 +15,18 @@ export interface NewUser {
      * and words it will not have. Without it the email is the login name.
      */
     username?: string;
+    /**
+     * Creates the account with `password` as a one-time password: the person
+     * is signed in on nothing until they choose their own (`signUp` answers
+     * `password_change_required`, then `setNewPassword`).
+     */
+    changeRequired?: boolean;
+    /**
+     * Where this person's reset links go instead of their own login address --
+     * for somebody who cannot yet open the mailbox that address names. See
+     * `Auth['adminResetPassword']` for the person this does not cover.
+     */
+    personalEmail?: string;
 }
 /** One of the organisation's people, as the sign-in service reports them. */
 export interface Person {
@@ -35,7 +47,11 @@ export declare class BrokerError extends Error {
     readonly status: number;
     readonly error: string;
     readonly detail?: string | undefined;
-    constructor(status: number, error: string, detail?: string | undefined);
+    /** Only `password_change_required` carries one: see `setNewPassword`. */
+    readonly changeToken?: string | undefined;
+    constructor(status: number, error: string, detail?: string | undefined, 
+    /** Only `password_change_required` carries one: see `setNewPassword`. */
+    changeToken?: string | undefined);
 }
 /**
  * The privileged half, over HTTP. The app holds a key that reaches its own
@@ -54,12 +70,23 @@ export declare class Broker {
         userId: string;
         state: string;
     }>;
+    /** An admin's reset for somebody requestPasswordReset cannot get back in: see `Auth['adminResetPassword']`. */
+    adminResetPassword(userId: string): Promise<{
+        userId: string;
+        password: string;
+    }>;
     authRequest(id: string): Promise<AuthRequest>;
     signIn(input: {
         authRequestId: string;
         email: string;
         password: string;
     }): Promise<string>;
+    /** The call after `password_change_required`: no old password, only the token that sign-in answered with. */
+    setNewPassword(input: {
+        authRequestId: string;
+        changeToken: string;
+        newPassword: string;
+    }): Promise<string>;
     signUp(input: {
         authRequestId: string;
     } & NewUser): Promise<string>;
@@ -103,9 +130,11 @@ export declare class Broker {
         givenName: string;
         familyName: string;
         next: string;
+        personalEmail?: string;
     }): Promise<{
         userId: string;
         invited: boolean;
+        personalEmailStored: boolean;
     }>;
     sendLink(email: string, next: string): Promise<unknown>;
     sendReset(email: string, next: string): Promise<unknown>;

package/dist/broker.js

@@ -2,11 +2,15 @@ export class BrokerError extends Error {
     status;
     error;
     detail;
-    constructor(status, error, detail) {
+    changeToken;
+    constructor(status, error, detail, 
+    /** Only `password_change_required` carries one: see `setNewPassword`. */
+    changeToken) {
         super(detail ?? error);
         this.status = status;
         this.error = error;
         this.detail = detail;
+        this.changeToken = changeToken;
         this.name = 'BrokerError';
     }
 }
@@ -48,7 +52,7 @@ export class Broker {
             throw new BrokerError(response.status, 'unavailable', `non-JSON response from ${path}`);
         }
         if (!response.ok) {
-            throw new BrokerError(response.status, String(data.error ?? 'unavailable'), data.message);
+            throw new BrokerError(response.status, String(data.error ?? 'unavailable'), data.message, typeof data.changeToken === 'string' ? data.changeToken : undefined);
         }
         return data;
     }
@@ -63,6 +67,10 @@ export class Broker {
     setPersonActive(userId, active) {
         return this.call('POST', active ? '/people/reactivate' : '/people/deactivate', { userId });
     }
+    /** An admin's reset for somebody requestPasswordReset cannot get back in: see `Auth['adminResetPassword']`. */
+    adminResetPassword(userId) {
+        return this.call('POST', '/people/reset-password', { userId });
+    }
     authRequest(id) {
         return this.call('GET', '/auth-request', { id });
     }
@@ -70,6 +78,11 @@ export class Broker {
         const { callbackUrl } = await this.call('POST', '/sign-in', input);
         return callbackUrl;
     }
+    /** The call after `password_change_required`: no old password, only the token that sign-in answered with. */
+    async setNewPassword(input) {
+        const { callbackUrl } = await this.call('POST', '/password/set', input);
+        return callbackUrl;
+    }
     async signUp(input) {
         const { callbackUrl } = await this.call('POST', '/sign-up', {
             ...input,

package/dist/browser.d.ts

@@ -57,7 +57,7 @@ export interface BrowserAuthStore {
 export interface BrowserAuthOptions {
     /** Public namespace registry projection; never include broker or cookie secrets. */
     namespace?: NamespaceSelection;
-    /** The issuer, e.g. `https://auth.wtfalch.dev`. */
+    /** The issuer, e.g. `https://auth.example.com`. */
     issuer: string;
     /** This app's client id at the issuer. */
     clientId: string;
@@ -84,8 +84,10 @@ export interface BrowserAuthOptions {
     open?: BrowserOpener;
     /**
      * Holds the token, verifier, return path and silent-tried mark. Default
-     * wraps `sessionStorage` and never throws. Two instances given different
-     * stores never see each other's values — inject one per app.
+     * wraps `sessionStorage` with keys bound to issuer, client, origin, callback
+     * and scopes, and never throws. Custom stores retain fixed keys: supply
+     * separate backing storage per context, and reuse the same store object
+     * for instances that should coordinate writes and refreshes.
      */
     store?: BrowserAuthStore;
 }
@@ -123,10 +125,9 @@ export type RefreshOutcome = {
     kind: 'no-refresh-token';
 }
 /**
- * The issuer would not rotate the refresh token. ZITADEL spends a refresh
- * token on every use whether it accepts or refuses it, so either way the
- * old one cannot be tried again — the held session is dropped before this
- * returns.
+ * The issuer refused rotation, or this operation was cancelled. An issuer
+ * refusal drops the held session because the old refresh token was spent.
+ * Cancellation discards the old response and preserves any newer session.
  */
  | {
     kind: 'refused';
@@ -167,13 +168,14 @@ export interface BrowserAuth {
      * `currentSession()` never carries the refresh token itself — a value
      * passed around the app should not be able to mint new access tokens — so
      * this is the only way to use it. A refusal drops the held session.
-     * Concurrent calls share one in-flight exchange, so two callers racing
+     * Concurrent calls in the same store/context share one in-flight exchange, so callers racing
      * near expiry both get the freshly rotated session rather than one losing
      * to the other's now-spent refresh token.
      */
     refresh(): Promise<RefreshOutcome>;
     /** Drop the session, and do not silently take another in this tab. Awaits
-     *  the store's writes, so a caller that awaits this knows they landed. */
+     *  the store's writes and invalidates pending sign-in/refresh completions.
+     * After it resolves, an older write cannot restore the forgotten session. */
     forget(): Promise<void>;
 }
 export declare function createBrowserAuth(options: BrowserAuthOptions): BrowserAuth;

package/dist/browser.js

@@ -51,6 +51,9 @@ function publicSession(session) {
     const { refreshToken, ...rest } = session;
     return rest;
 }
+// Instances using the same store and context share cancellation and refreshes.
+// The network is outside this queue: forget must not wait for a token response.
+const coordinators = new WeakMap();
 export function createBrowserAuth(options) {
     if (options.namespace) {
         // The namespace path coordinates a shared session across tabs and
@@ -69,11 +72,67 @@ export function createBrowserAuth(options) {
     const scope = Array.from(new Set([...baseScope.split(/\s+/).filter(Boolean), ...extraScopes])).join(' ');
     const redirectUri = `${origin}${callbackPath}`;
     const store = options.store ?? defaultStore;
+    // Custom stores retain their established keys. Their owner supplies a separate
+    // store per context; default storage is bound to the complete client context.
+    const context = options.store
+        ? ''
+        : JSON.stringify([
+            options.issuer.replace(/\/$/, ''),
+            options.clientId,
+            new URL(origin).origin,
+            redirectUri,
+            scope.split(' ').sort(),
+        ]);
+    const key = (name) => (context ? `wtfalch.auth.browser.v1:${context}:${name}` : name);
+    const tokenKey = key(TOKEN);
+    const verifierKey = key(VERIFIER);
+    const returnKey = key(RETURN);
+    const triedKey = key(TRIED);
+    let contexts = coordinators.get(store);
+    if (!contexts) {
+        contexts = new Map();
+        coordinators.set(store, contexts);
+    }
+    let shared = contexts.get(context);
+    if (!shared) {
+        shared = { generation: 0, writes: Promise.resolve() };
+        contexts.set(context, shared);
+    }
+    const coordinator = shared;
+    const mutate = (operation) => {
+        const result = coordinator.writes.then(operation);
+        coordinator.writes = result.then(() => { }, () => { });
+        return result;
+    };
+    const current = (generation) => coordinator.generation === generation;
+    const cancelled = () => ({
+        kind: 'error',
+        error: 'This sign-in was cancelled; start again',
+    });
+    const cancelledRefresh = () => ({
+        kind: 'refused',
+        error: 'This refresh was cancelled',
+    });
     const open = options.open ?? ((url) => window.location.assign(url));
     const authorize = async (prompt, returnTo) => {
+        const generation = ++coordinator.generation;
         const proof = verifier();
-        await store.set(VERIFIER, proof);
-        await store.set(RETURN, returnTo);
+        await mutate(async () => {
+            if (!current(generation))
+                return;
+            if (prompt)
+                await store.set(triedKey, '1');
+            else
+                await store.drop(triedKey);
+            if (!current(generation))
+                return;
+            await store.set(verifierKey, proof);
+            if (!current(generation))
+                return;
+            await store.set(returnKey, returnTo);
+        });
+        if (!current(generation))
+            return false;
         const url = new URL(`${options.issuer}/oauth/v2/authorize`);
         url.searchParams.set('client_id', options.clientId);
         url.searchParams.set('redirect_uri', redirectUri);
@@ -83,10 +142,13 @@ export function createBrowserAuth(options) {
         url.searchParams.set('code_challenge_method', 'S256');
         if (prompt)
             url.searchParams.set('prompt', prompt);
+        if (!current(generation))
+            return false;
         await open(url.toString());
+        return true;
     };
     const readStored = () => {
-        const raw = store.get(TOKEN);
+        const raw = store.get(tokenKey);
         if (!raw)
             return null;
         try {
@@ -102,13 +164,12 @@ export function createBrowserAuth(options) {
             return null;
         return session.expiresAt - 60_000 > Date.now() ? publicSession(session) : null;
     };
-    const silentSignInAvailable = () => !currentSession() && !store.get(TRIED);
-    // Shared by every `refresh()` call on this instance, so two callers racing
-    // near expiry share one exchange rather than each spending the same
-    // refresh token — ZITADEL rotates it on first use, so the second would be
-    // refused and drop the session the first just set.
-    let refreshing;
-    const performRefresh = async () => {
+    const silentSignInAvailable = () => !currentSession() && !store.get(triedKey);
+    const performRefresh = async (generation) => {
+        // Wait for earlier store operations, without occupying the write queue while fetching.
+        await coordinator.writes;
+        if (!current(generation))
+            return cancelledRefresh();
         const session = readStored();
         if (!session?.refreshToken)
             return { kind: 'no-refresh-token' };
@@ -121,29 +182,42 @@ export function createBrowserAuth(options) {
                 refresh_token: session.refreshToken,
             }),
         });
+        if (!current(generation))
+            return cancelledRefresh();
         if (!response.ok) {
-            // ZITADEL spends the refresh token on every use, whether it accepts
-            // or refuses it: either way the old one cannot be tried again, so
-            // the held session goes with it.
-            await store.drop(TOKEN);
             const body = await response.text();
-            return {
-                kind: 'refused',
-                error: `the issuer refused the refresh (${response.status}): ${body.slice(0, 200)}`,
-            };
+            return mutate(async () => {
+                if (!current(generation))
+                    return cancelledRefresh();
+                await store.drop(tokenKey);
+                if (!current(generation))
+                    return cancelledRefresh();
+                return {
+                    kind: 'refused',
+                    error: `the issuer refused the refresh (${response.status}): ${body.slice(0, 200)}`,
+                };
+            });
         }
         const token = (await response.json());
-        if (!token.access_token || !token.refresh_token) {
-            await store.drop(TOKEN);
-            return { kind: 'refused', error: 'the issuer returned an incomplete refresh response' };
-        }
-        const next = {
-            accessToken: token.access_token,
-            expiresAt: Date.now() + (token.expires_in ?? 3600) * 1000,
-            refreshToken: token.refresh_token,
-        };
-        await store.set(TOKEN, JSON.stringify(next));
-        return { kind: 'refreshed', session: publicSession(next) };
+        return mutate(async () => {
+            if (!current(generation))
+                return cancelledRefresh();
+            if (!token.access_token || !token.refresh_token) {
+                await store.drop(tokenKey);
+                if (!current(generation))
+                    return cancelledRefresh();
+                return { kind: 'refused', error: 'the issuer returned an incomplete refresh response' };
+            }
+            const next = {
+                accessToken: token.access_token,
+                expiresAt: Date.now() + (token.expires_in ?? 3600) * 1000,
+                refreshToken: token.refresh_token,
+            };
+            await store.set(tokenKey, JSON.stringify(next));
+            if (!current(generation))
+                return cancelledRefresh();
+            return { kind: 'refreshed', session: publicSession(next) };
+        });
     };
     return {
         accountChanged: () => false,
@@ -152,30 +226,32 @@ export function createBrowserAuth(options) {
         async trySilentSignIn(returnTo = window.location.pathname) {
             if (!silentSignInAvailable())
                 return false;
-            await store.set(TRIED, '1');
-            await authorize('none', returnTo);
-            return true;
+            return authorize('none', returnTo);
         },
         async signIn(returnTo = window.location.pathname) {
-            // A deliberate sign-in clears the mark: whatever the issuer said before,
-            // the person is asking now.
-            await store.drop(TRIED);
             await authorize(undefined, returnTo);
         },
         async completeSignIn(search = window.location.search) {
+            const generation = coordinator.generation;
             const params = new URLSearchParams(search);
-            const proof = store.get(VERIFIER);
-            const returnTo = store.get(RETURN) ?? '/';
-            // Removed whatever happens: a code that failed to exchange must not be
-            // retried against the same proof, and a stale verifier is what makes the
-            // *next* sign-in fail confusingly.
-            await store.drop(VERIFIER);
-            await store.drop(RETURN);
+            // Reading and consuming the proof is one queued operation, so recreated
+            // instances cannot consume the same transaction while its drop is pending.
+            const transaction = await mutate(async () => {
+                if (!current(generation))
+                    return null;
+                const proof = store.get(verifierKey);
+                const returnTo = store.get(returnKey) ?? '/';
+                await store.drop(verifierKey);
+                if (!current(generation))
+                    return null;
+                await store.drop(returnKey);
+                return { proof, returnTo };
+            });
+            if (!transaction || !current(generation))
+                return cancelled();
+            const { proof, returnTo } = transaction;
             const issuerError = params.get('error');
             if (issuerError) {
-                // The three the spec gives for "I would have had to ask them
-                // something". Any of them answers a silent attempt rather than
-                // failing it.
                 if (['login_required', 'interaction_required', 'consent_required'].includes(issuerError)) {
                     return { kind: 'silent-refused' };
                 }
@@ -184,12 +260,11 @@ export function createBrowserAuth(options) {
             const code = params.get('code');
             if (!code)
                 return { kind: 'error', error: 'the issuer sent no code' };
-            if (!proof) {
+            if (!proof)
                 return {
                     kind: 'error',
                     error: 'this tab has no record of starting a sign-in — start again from the app',
                 };
-            }
             const response = await fetch(`${options.issuer}/oauth/v2/token`, {
                 method: 'POST',
                 headers: { 'content-type': 'application/x-www-form-urlencoded' },
@@ -201,42 +276,59 @@ export function createBrowserAuth(options) {
                     code_verifier: proof,
                 }),
             });
+            if (!current(generation))
+                return cancelled();
             if (!response.ok) {
                 const body = await response.text();
+                if (!current(generation))
+                    return cancelled();
                 return {
                     kind: 'error',
                     error: `the issuer refused the code (${response.status}): ${body.slice(0, 200)}`,
                 };
             }
             const token = (await response.json());
-            if (!token.access_token)
-                return { kind: 'error', error: 'the issuer returned no access token' };
-            const session = {
-                accessToken: token.access_token,
-                expiresAt: Date.now() + (token.expires_in ?? 3600) * 1000,
-                refreshToken: token.refresh_token,
-            };
-            await store.set(TOKEN, JSON.stringify(session));
-            // Signed in: a later silent attempt in this tab is allowed again, which
-            // matters when the token expires and the page reloads.
-            await store.drop(TRIED);
-            return { kind: 'signed-in', session: publicSession(session), returnTo };
+            return mutate(async () => {
+                if (!current(generation))
+                    return cancelled();
+                if (!token.access_token)
+                    return { kind: 'error', error: 'the issuer returned no access token' };
+                const session = {
+                    accessToken: token.access_token,
+                    expiresAt: Date.now() + (token.expires_in ?? 3600) * 1000,
+                    refreshToken: token.refresh_token,
+                };
+                await store.set(tokenKey, JSON.stringify(session));
+                if (!current(generation))
+                    return cancelled();
+                await store.drop(triedKey);
+                if (!current(generation))
+                    return cancelled();
+                return { kind: 'signed-in', session: publicSession(session), returnTo };
+            });
         },
         async refresh() {
-            // One in-flight exchange per instance: two callers racing near expiry
-            // must not both spend the same refresh token — ZITADEL rotates it on
-            // first use, so the second would be refused and drop the session the
-            // first just set.
-            refreshing ??= performRefresh().finally(() => {
-                refreshing = undefined;
-            });
-            return refreshing;
+            const generation = coordinator.generation;
+            if (coordinator.refreshing?.generation !== generation) {
+                const promise = performRefresh(generation).finally(() => {
+                    if (coordinator.refreshing?.promise === promise)
+                        coordinator.refreshing = undefined;
+                });
+                coordinator.refreshing = { generation, promise };
+            }
+            return coordinator.refreshing.promise;
         },
         async forget() {
-            await store.drop(TOKEN);
-            // The mark stays set: a sign-out that silently signs you back in is not
-            // a sign-out.
-            await store.set(TRIED, '1');
+            // Invalidate synchronously, before the first async store call. A write
+            // already underway finishes before this queued cleanup, so after forget
+            // resolves it cannot resurrect the old session or clear the tried mark.
+            ++coordinator.generation;
+            await mutate(async () => {
+                await store.drop(tokenKey);
+                await store.drop(verifierKey);
+                await store.drop(returnKey);
+                await store.set(triedKey, '1');
+            });
         },
     };
 }

package/dist/config.d.ts

@@ -19,6 +19,11 @@ export type AuthEvent = {
     email: string;
     userId: string;
     invited: boolean;
+}
+/** Never the password: an audit record of who was reset, not a copy of the credential. */
+ | {
+    type: 'adminResetPassword';
+    userId: string;
 };
 /**
  * Why `accessToken` refused: no session (no cookie in cookie mode, no live
@@ -82,8 +87,8 @@ export interface AuthOptions {
      * the key.
      */
     cookieSecret?: string | undefined;
-    /** Default https://auth.wtfalch.dev. */
-    issuer?: string;
+    /** e.g. https://auth.example.com. Required -- there is no estate-wide default. */
+    issuer: string | undefined;
     /** Where the routes are mounted. Default /auth. */
     basePath?: string;
     /** Default /. */
@@ -152,5 +157,4 @@ export interface ResolvedOptions {
     fetch: typeof fetch;
     onAuthEvent: ((event: AuthEvent) => void) | null;
 }
-export declare const ISSUER = "https://auth.wtfalch.dev";
 export declare function resolveOptions(options: AuthOptions): ResolvedOptions;

package/dist/config.js

@@ -1,9 +1,9 @@
 import { resolveNamespaceContext } from './namespaces.js';
-export const ISSUER = 'https://auth.wtfalch.dev';
 export function resolveOptions(options) {
     const appUrl = parseAppUrl(options.appUrl);
     required(options.clientId, 'clientId');
     required(options.organizationId, 'organizationId');
+    required(options.issuer, 'issuer');
     const basePath = options.basePath ?? '/auth';
     if (!basePath.startsWith('/') || basePath.endsWith('/')) {
         throw new Error(`@wtfalch/auth: basePath must start with "/" and not end with one, got "${basePath}"`);
@@ -20,7 +20,7 @@ export function resolveOptions(options) {
     */
     if (options.cookieSecret !== undefined)
         decodeKey(options.cookieSecret);
-    const issuer = (options.issuer ?? ISSUER).replace(/\/$/, '');
+    const issuer = options.issuer.replace(/\/$/, '');
     const namespace = options.namespace
         ? resolveNamespaceContext(options.namespace, {
             issuer,
@@ -46,14 +46,14 @@ export function resolveOptions(options) {
             cookieKey ??= decodeKey(options.cookieSecret);
             return cookieKey;
         },
-        issuer: (options.issuer ?? ISSUER).replace(/\/$/, ''),
+        issuer,
         basePath,
         afterLogin: options.afterLogin ?? '/',
         afterLogout: options.afterLogout ?? '/',
         onError: options.onError ?? '/',
         afterVerify: options.afterVerify ?? '/',
         appKey: options.appKey || null,
-        brokerUrl: (options.brokerUrl ?? `${(options.issuer ?? ISSUER).replace(/\/$/, '')}/api`).replace(/\/$/, ''),
+        brokerUrl: (options.brokerUrl ?? `${issuer}/api`).replace(/\/$/, ''),
         sessionMaxAge: seconds(options.sessionMaxAge, 'sessionMaxAge', 30 * 24 * 60 * 60),
         refreshWindow: seconds(options.refreshWindow, 'refreshWindow', 5 * 60),
         freshness: seconds(options.freshness, 'freshness', 5 * 60),

package/dist/cookies.d.ts

@@ -15,6 +15,8 @@ export interface TransactionPayload extends JWTPayload {
     nc: string;
     cv: string;
     nx: string;
+    /** The leg was a silent pass (`prompt=none`): an error coming back falls back to interactive sign-in. */
+    sl?: true;
 }
 export interface CookieAttributes {
     path: '/';
@@ -57,6 +59,11 @@ export declare function digest(value: string): Promise<string>;
 export declare function sealTransaction(options: ResolvedOptions, payload: Omit<TransactionPayload, keyof JWTPayload>): Promise<SetCookie>;
 export declare function openTransaction(options: ResolvedOptions, value: string | undefined): Promise<TransactionPayload | null>;
 export declare function clearTransaction(options: ResolvedOptions): SetCookie;
+export declare function silentCookieName(options: ResolvedOptions): string;
+/** `try`: the gate asked for one silent pass. `done`: it ran, so every later sign-in is interactive. */
+export type SilentState = 'try' | 'done';
+export declare function sealSilent(options: ResolvedOptions, state: SilentState): Promise<SetCookie>;
+export declare function openSilent(options: ResolvedOptions, value: string | undefined): Promise<SilentState | null>;
 export declare function qrTransactionCookieName(options: ResolvedOptions): string;
 /**
  * `ttl` is the issuer's own `expires_in` for the device code, not a fixed

package/dist/cookies.js

@@ -4,6 +4,9 @@ const SESSION = 'wtfalch_auth';
 const TRANSACTION = 'wtfalch_auth_tx';
 const LINK = 'wtfalch_auth_link';
 const QR = 'wtfalch_auth_qr';
+const SILENT = 'wtfalch_auth_silent';
+/** How long the gate remembers it has tried (or finished) a silent pass, so a failed one is never retried in a loop. */
+const SILENT_TTL = 5 * 60;
 const TRANSACTION_TTL = 10 * 60;
 /**
  * A namespace session handle lives as long as a browser will keep a cookie.
@@ -81,6 +84,17 @@ export async function openTransaction(options, value) {
 export function clearTransaction(options) {
     return setCookie(transactionCookieName(options), '', 0, options.secure);
 }
+export function silentCookieName(options) {
+    return options.secure ? `__Host-${SILENT}` : SILENT;
+}
+export async function sealSilent(options, state) {
+    const value = await seal(options, 'silent', { s: state }, SILENT_TTL);
+    return setCookie(silentCookieName(options), value, SILENT_TTL, options.secure);
+}
+export async function openSilent(options, value) {
+    const payload = await open(options, 'silent', value);
+    return payload?.s === 'try' || payload?.s === 'done' ? payload.s : null;
+}
 export function qrTransactionCookieName(options) {
     return options.secure ? `__Host-${QR}` : QR;
 }

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { type Auth, type AuthRequest, type Gate, type GateRules, type Intent, type MaxAge, type NewUser, type PasskeyRegistrationResult, type PasskeyRegistrationStart, type PasskeySignInStart, type Prompt, type QrPollResult, type QrPollStatus, type QrSignInStart, type ReadResult, type ResetError, type SignInError, type SignInResult, type SignUpError, type SignUpResult, type SignedIn, type User, createAuth, } from './auth.js';
-export { type AccessTokenReason, type AccessTokenResult, type AuthEvent, type AuthOptions, ISSUER, } from './config.js';
+export { type Auth, type AuthRequest, type Gate, type GateRules, type Intent, type MaxAge, type NewUser, type PasskeyRegistrationResult, type PasswordChangeRequired, type PasskeyRegistrationStart, type PasskeySignInStart, type Prompt, type QrPollResult, type QrPollStatus, type QrSignInStart, type ReadResult, type ResetError, type SetNewPasswordError, type SetNewPasswordResult, type SignInError, type SignInResult, type SignUpError, type SignUpResult, type SignedIn, type User, STEP_UP_MAX_AGE, createAuth, } from './auth.js';
+export type { AccessTokenReason, AccessTokenResult, AuthEvent, AuthOptions } from './config.js';
 export type { SetCookie } from './cookies.js';
 export type { SessionRecord, SessionStore, SessionUpdate } from './sessions.js';
 export { BrokerError } from './broker.js';

package/dist/index.js

@@ -1,5 +1,4 @@
-export { createAuth, } from './auth.js';
-export { ISSUER, } from './config.js';
+export { STEP_UP_MAX_AGE, createAuth, } from './auth.js';
 export { BrokerError } from './broker.js';
 export { AuthError, ORG_CLAIM } from './oidc.js';
 export { safeNextPath } from './redirect.js';

package/dist/names.d.ts

@@ -20,8 +20,9 @@
  * read as an `i` and as an `l`, so `wa1id` is `walid` too.
  *
  * The letter rules -- what characters, how long -- are the caller's: this is a
- * login name in ZITADEL and one part of `name@tf.auth.wtfalch.dev`, so the
- * default is ASCII letters, digits, `_`, `.` and `-`, three to thirty of them.
+ * login name in ZITADEL and one part of an email-shaped login handle at the
+ * issuer (`name@tf.<issuer-host>`), so the default is ASCII letters, digits,
+ * `_`, `.` and `-`, three to thirty of them.
  */
 export type Refusal = 'too_short' | 'too_long' | 'characters' | 'reserved' | 'disallowed';
 export type Verdict = {

package/dist/names.reserved.js

@@ -181,7 +181,9 @@ export const SYSTEM = [
     'webmaster',
     'listmaster',
     'abuse',
+    'dmarc',
     'noc',
+    'ops',
     'security',
     'usenet',
     'news',