@xinosolutions/auth-sdk 0.1.1 → 0.3.1

package/dist/index.d.cts

@@ -1,3 +1,50 @@
+/** XS Auth browser session account (multi-account SSO on the Auth-Server domain). */
+interface XSBrowserAccount {
+    sessionId: string;
+    userId: string;
+    email: string;
+    name: string;
+    isPrimary: boolean;
+}
+interface OpenSessionBridgeOptions {
+    clientId: string;
+    parentOrigin?: string;
+    timeoutMs?: number;
+}
+interface SessionBridge {
+    listAccounts(): Promise<XSBrowserAccount[]>;
+    revokeAccount(sessionId: string): Promise<{
+        accounts: XSBrowserAccount[];
+        remainingCount: number;
+    }>;
+    revokeAll(): Promise<void>;
+    setPrimary(sessionId: string): Promise<XSBrowserAccount[]>;
+    close(): void;
+}
+declare class SessionBridgeError extends Error {
+    readonly name = "SessionBridgeError";
+    readonly errorCode: string;
+    constructor(errorCode: string, message: string);
+}
+/** True when the user must pick another primary account before signing out. */
+declare function isPrimaryAccountError(error: unknown): boolean;
+
+interface SignOutWithXSOptions {
+    clientId: string;
+    parentOrigin?: string;
+    /** XS Auth user id (`sub`) for the account active in the host app. */
+    activeUserId?: string;
+    timeoutMs?: number;
+    /** Override Auth-Server base URL (e.g. same-origin `/xs-auth` proxy in local dev). */
+    authBaseUrl?: string;
+}
+type SignOutAction = 'revoked_one' | 'revoked_all' | 'cancelled';
+interface SignOutWithXSResult {
+    action: SignOutAction;
+    revokedCurrent: boolean;
+    remainingCount: number;
+}
+
 /** Popup was blocked by the browser or environment. */
 declare class PopupBlockedError extends Error {
     readonly name = "PopupBlockedError";
@@ -17,6 +64,15 @@ declare class XSAuthDeniedError extends Error {
     readonly description: string;
     constructor(errorCode: string, description: string);
 }
+/** Session bridge did not respond within timeout. */
+declare class LoginBridgeTimeoutError extends Error {
+    readonly name = "LoginBridgeTimeoutError";
+}
+
+/** Opens the Auth-Server session bridge popup (multi-account sign-out). */
+declare function openSessionBridge(opts: OpenSessionBridgeOptions): Promise<SessionBridge>;
+/** Google-style sign-out popup on the Auth-Server domain. */
+declare function signOutWithXS(opts: SignOutWithXSOptions): Promise<SignOutWithXSResult>;
 /** Signed-in user profile from XS Auth. */
 interface XSAuthUser {
     email: string;
@@ -28,17 +84,35 @@ interface LoginWithXSOptions {
     clientId: string;
     /** Must be on your XS Auth client's allowed domains list (normally `window.location.origin`). */
     parentOrigin?: string;
+    /**
+     * Sign-in timeout in ms. Defaults to 180s to allow MFA verification in the Auth-Server popup.
+     */
     timeoutMs?: number;
     scope?: string;
     /**
      * Request a `nonce` inside `idToken` — your backend should verify it matches when validating the JWT.
      */
     useNonce?: boolean;
+    /**
+     * OAuth-style prompt for multi-account SSO on the Auth-Server domain.
+     * - `none`: silent sign-in with the primary browser session (fails with `login_required` if absent)
+     * - `select_account`: always show the account chooser when sessions exist
+     * - `login`: force email/password (add another account)
+     */
+    prompt?: 'none' | 'select_account' | 'login';
+    /** Prefer a specific XS Auth user id (`sub`) when continuing an existing browser session. */
+    accountId?: string;
+    /** When true and `prompt` is unset, defaults to `none` instead of account chooser. */
+    preferPrimary?: boolean;
+    /** Override Auth-Server base URL (e.g. same-origin `/xs-auth` proxy in local dev). */
+    authBaseUrl?: string;
 }
 interface LoginWithXSResult {
     user: XSAuthUser;
     /** Short-lived signed JWT — send to your backend to create a session. */
     idToken: string;
+    /** True when the user completed MFA during this sign-in (`amr` includes `mfa`). */
+    mfaVerified: boolean;
 }
 /** PKCE helpers for tests / custom callers. */
 declare function createPkcePair(): Promise<{
@@ -52,5 +126,11 @@ declare function createPkcePair(): Promise<{
  * opens the popup and exchanges postMessages with the PKCE verifier — no fetch to Auth-Server.
  */
 declare function loginWithXS(opts: LoginWithXSOptions): Promise<LoginWithXSResult>;
+/** True when an XS Auth idToken indicates MFA was completed at sign-in. */
+declare function idTokenIncludesMfa(idToken: string): boolean;
+/** Read the `amr` claim from an XS Auth idToken payload (no signature verification). */
+declare function parseIdTokenAmr(idToken: string): string[] | null;
+/** True when Auth-Server has no active browser session for silent sign-in. */
+declare function isLoginRequiredError(error: unknown): boolean;
 
-export { LoginTimeoutError, type LoginWithXSOptions, type LoginWithXSResult, PopupBlockedError, PopupClosedError, XSAuthDeniedError, type XSAuthUser, createPkcePair, loginWithXS };
+export { LoginBridgeTimeoutError, LoginTimeoutError, type LoginWithXSOptions, type LoginWithXSResult, type OpenSessionBridgeOptions, PopupBlockedError, PopupClosedError, type SessionBridge, SessionBridgeError, type SignOutAction, type SignOutWithXSOptions, type SignOutWithXSResult, XSAuthDeniedError, type XSAuthUser, type XSBrowserAccount, createPkcePair, idTokenIncludesMfa, isLoginRequiredError, isPrimaryAccountError, loginWithXS, openSessionBridge, parseIdTokenAmr, signOutWithXS };

package/dist/index.d.ts

@@ -1,3 +1,50 @@
+/** XS Auth browser session account (multi-account SSO on the Auth-Server domain). */
+interface XSBrowserAccount {
+    sessionId: string;
+    userId: string;
+    email: string;
+    name: string;
+    isPrimary: boolean;
+}
+interface OpenSessionBridgeOptions {
+    clientId: string;
+    parentOrigin?: string;
+    timeoutMs?: number;
+}
+interface SessionBridge {
+    listAccounts(): Promise<XSBrowserAccount[]>;
+    revokeAccount(sessionId: string): Promise<{
+        accounts: XSBrowserAccount[];
+        remainingCount: number;
+    }>;
+    revokeAll(): Promise<void>;
+    setPrimary(sessionId: string): Promise<XSBrowserAccount[]>;
+    close(): void;
+}
+declare class SessionBridgeError extends Error {
+    readonly name = "SessionBridgeError";
+    readonly errorCode: string;
+    constructor(errorCode: string, message: string);
+}
+/** True when the user must pick another primary account before signing out. */
+declare function isPrimaryAccountError(error: unknown): boolean;
+
+interface SignOutWithXSOptions {
+    clientId: string;
+    parentOrigin?: string;
+    /** XS Auth user id (`sub`) for the account active in the host app. */
+    activeUserId?: string;
+    timeoutMs?: number;
+    /** Override Auth-Server base URL (e.g. same-origin `/xs-auth` proxy in local dev). */
+    authBaseUrl?: string;
+}
+type SignOutAction = 'revoked_one' | 'revoked_all' | 'cancelled';
+interface SignOutWithXSResult {
+    action: SignOutAction;
+    revokedCurrent: boolean;
+    remainingCount: number;
+}
+
 /** Popup was blocked by the browser or environment. */
 declare class PopupBlockedError extends Error {
     readonly name = "PopupBlockedError";
@@ -17,6 +64,15 @@ declare class XSAuthDeniedError extends Error {
     readonly description: string;
     constructor(errorCode: string, description: string);
 }
+/** Session bridge did not respond within timeout. */
+declare class LoginBridgeTimeoutError extends Error {
+    readonly name = "LoginBridgeTimeoutError";
+}
+
+/** Opens the Auth-Server session bridge popup (multi-account sign-out). */
+declare function openSessionBridge(opts: OpenSessionBridgeOptions): Promise<SessionBridge>;
+/** Google-style sign-out popup on the Auth-Server domain. */
+declare function signOutWithXS(opts: SignOutWithXSOptions): Promise<SignOutWithXSResult>;
 /** Signed-in user profile from XS Auth. */
 interface XSAuthUser {
     email: string;
@@ -28,17 +84,35 @@ interface LoginWithXSOptions {
     clientId: string;
     /** Must be on your XS Auth client's allowed domains list (normally `window.location.origin`). */
     parentOrigin?: string;
+    /**
+     * Sign-in timeout in ms. Defaults to 180s to allow MFA verification in the Auth-Server popup.
+     */
     timeoutMs?: number;
     scope?: string;
     /**
      * Request a `nonce` inside `idToken` — your backend should verify it matches when validating the JWT.
      */
     useNonce?: boolean;
+    /**
+     * OAuth-style prompt for multi-account SSO on the Auth-Server domain.
+     * - `none`: silent sign-in with the primary browser session (fails with `login_required` if absent)
+     * - `select_account`: always show the account chooser when sessions exist
+     * - `login`: force email/password (add another account)
+     */
+    prompt?: 'none' | 'select_account' | 'login';
+    /** Prefer a specific XS Auth user id (`sub`) when continuing an existing browser session. */
+    accountId?: string;
+    /** When true and `prompt` is unset, defaults to `none` instead of account chooser. */
+    preferPrimary?: boolean;
+    /** Override Auth-Server base URL (e.g. same-origin `/xs-auth` proxy in local dev). */
+    authBaseUrl?: string;
 }
 interface LoginWithXSResult {
     user: XSAuthUser;
     /** Short-lived signed JWT — send to your backend to create a session. */
     idToken: string;
+    /** True when the user completed MFA during this sign-in (`amr` includes `mfa`). */
+    mfaVerified: boolean;
 }
 /** PKCE helpers for tests / custom callers. */
 declare function createPkcePair(): Promise<{
@@ -52,5 +126,11 @@ declare function createPkcePair(): Promise<{
  * opens the popup and exchanges postMessages with the PKCE verifier — no fetch to Auth-Server.
  */
 declare function loginWithXS(opts: LoginWithXSOptions): Promise<LoginWithXSResult>;
+/** True when an XS Auth idToken indicates MFA was completed at sign-in. */
+declare function idTokenIncludesMfa(idToken: string): boolean;
+/** Read the `amr` claim from an XS Auth idToken payload (no signature verification). */
+declare function parseIdTokenAmr(idToken: string): string[] | null;
+/** True when Auth-Server has no active browser session for silent sign-in. */
+declare function isLoginRequiredError(error: unknown): boolean;
 
-export { LoginTimeoutError, type LoginWithXSOptions, type LoginWithXSResult, PopupBlockedError, PopupClosedError, XSAuthDeniedError, type XSAuthUser, createPkcePair, loginWithXS };
+export { LoginBridgeTimeoutError, LoginTimeoutError, type LoginWithXSOptions, type LoginWithXSResult, type OpenSessionBridgeOptions, PopupBlockedError, PopupClosedError, type SessionBridge, SessionBridgeError, type SignOutAction, type SignOutWithXSOptions, type SignOutWithXSResult, XSAuthDeniedError, type XSAuthUser, type XSBrowserAccount, createPkcePair, idTokenIncludesMfa, isLoginRequiredError, isPrimaryAccountError, loginWithXS, openSessionBridge, parseIdTokenAmr, signOutWithXS };

package/dist/index.js

@@ -1,4 +1,4 @@
-// src/index.ts
+// src/errors.ts
 var PopupBlockedError = class extends Error {
   name = "PopupBlockedError";
 };
@@ -18,7 +18,327 @@ var XSAuthDeniedError = class extends Error {
     this.description = description;
   }
 };
+var LoginBridgeTimeoutError = class extends Error {
+  name = "LoginBridgeTimeoutError";
+};
+
+// src/session-bridge.ts
+var SessionBridgeError = class extends Error {
+  name = "SessionBridgeError";
+  errorCode;
+  constructor(errorCode, message) {
+    super(message || errorCode);
+    this.errorCode = errorCode;
+  }
+};
+var BRIDGE_STATE_KEY = "__xs_bridge_state";
+function parseAccounts(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.map((item) => {
+    if (!item || typeof item !== "object") return null;
+    const row = item;
+    const sessionId = typeof row.sessionId === "string" ? row.sessionId : typeof row.session_id === "string" ? row.session_id : "";
+    const userId = typeof row.userId === "string" ? row.userId : typeof row.user_id === "string" ? row.user_id : "";
+    const email = typeof row.email === "string" ? row.email : "";
+    const name = typeof row.name === "string" ? row.name : email;
+    if (!sessionId || !email) return null;
+    return {
+      sessionId,
+      userId,
+      email,
+      name,
+      isPrimary: row.isPrimary === true || row.is_primary === true
+    };
+  }).filter((x) => x !== null);
+}
+function hiddenBridgePopupFeatures() {
+  return "width=1,height=1,left=-10000,top=-10000,resizable=no,scrollbars=no";
+}
+function randomBridgeState() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/u, "");
+}
+async function openSessionBridge(opts, authBaseUrl) {
+  const parentOrigin = opts.parentOrigin ?? globalThis.location?.origin;
+  if (!parentOrigin || typeof window === "undefined") {
+    throw new Error(
+      "openSessionBridge requires a browser Window and explicit parentOrigin (or window.location)."
+    );
+  }
+  const normalizedBase = new URL(authBaseUrl);
+  const authOrigin = normalizedBase.origin;
+  const state = randomBridgeState();
+  sessionStorage.setItem(BRIDGE_STATE_KEY, state);
+  const params = new URLSearchParams({
+    client_id: opts.clientId,
+    parent_origin: parentOrigin,
+    state
+  });
+  const bridgeUrl = `${normalizedBase.href.replace(/\/?$/u, "")}/session/bridge?${params.toString()}`;
+  const popup = window.open(
+    bridgeUrl,
+    `xs-auth-bridge-${crypto.randomUUID()}`,
+    hiddenBridgePopupFeatures()
+  );
+  if (!popup) throw new PopupBlockedError();
+  const timeoutMs = opts.timeoutMs !== void 0 ? opts.timeoutMs : 12e4;
+  let cleaned = false;
+  let closePoll;
+  const teardown = () => {
+    if (cleaned) return;
+    cleaned = true;
+    window.removeEventListener("message", handleMessage);
+    if (closePoll !== void 0) clearInterval(closePoll);
+    sessionStorage.removeItem(BRIDGE_STATE_KEY);
+    try {
+      popup.close();
+    } catch {
+    }
+  };
+  const pending = /* @__PURE__ */ new Map();
+  let bridgeReady = false;
+  let readyResolve = null;
+  let readyReject = null;
+  const readyPromise = new Promise((resolve, reject) => {
+    readyResolve = resolve;
+    readyReject = reject;
+  });
+  const handleMessage = (event) => {
+    if (event.origin !== authOrigin) return;
+    const d = event.data;
+    if (d?.source !== "xs-auth") return;
+    const st = typeof d.state === "string" ? d.state : "";
+    if (!st || st !== sessionStorage.getItem(BRIDGE_STATE_KEY)) return;
+    if (d.type === "bridge_ready") {
+      bridgeReady = true;
+      readyResolve?.();
+      return;
+    }
+    const requestId = typeof d.requestId === "string" ? d.requestId : "";
+    if (!requestId) return;
+    const entry = pending.get(requestId);
+    if (!entry) return;
+    pending.delete(requestId);
+    if (typeof d.error === "string" && d.error.length > 0) {
+      entry.reject(
+        new SessionBridgeError(
+          String(d.error),
+          typeof d.error_description === "string" ? d.error_description : ""
+        )
+      );
+      return;
+    }
+    if (d.type === "result") {
+      entry.resolve(d);
+    }
+  };
+  window.addEventListener("message", handleMessage);
+  closePoll = window.setInterval(() => {
+    if (!popup.closed) return;
+    if (cleaned) return;
+    for (const [, entry] of pending) {
+      entry.reject(new PopupClosedError());
+    }
+    pending.clear();
+    readyReject?.(new PopupClosedError());
+    teardown();
+  }, 280);
+  const readyTimer = window.setTimeout(() => {
+    if (bridgeReady) return;
+    readyReject?.(new LoginBridgeTimeoutError());
+    teardown();
+  }, timeoutMs);
+  try {
+    await readyPromise;
+  } catch (error) {
+    clearTimeout(readyTimer);
+    throw error;
+  }
+  clearTimeout(readyTimer);
+  const sendRequest = (type, extra = {}) => {
+    if (popup.closed) {
+      return Promise.reject(new PopupClosedError());
+    }
+    const requestId = crypto.randomUUID();
+    return new Promise((resolve, reject) => {
+      const timer = window.setTimeout(() => {
+        pending.delete(requestId);
+        reject(new LoginBridgeTimeoutError());
+      }, timeoutMs);
+      pending.set(requestId, {
+        resolve: (value) => {
+          clearTimeout(timer);
+          resolve(value);
+        },
+        reject: (error) => {
+          clearTimeout(timer);
+          reject(error);
+        }
+      });
+      try {
+        popup.postMessage(
+          {
+            source: "xs-auth-opener",
+            state,
+            client_id: opts.clientId,
+            requestId,
+            type,
+            ...extra
+          },
+          authOrigin
+        );
+      } catch {
+        pending.delete(requestId);
+        clearTimeout(timer);
+        reject(new SessionBridgeError("post_message_failed", "Could not reach the session bridge."));
+      }
+    });
+  };
+  return {
+    async listAccounts() {
+      const result = await sendRequest("list_accounts");
+      return parseAccounts(result.accounts);
+    },
+    async revokeAccount(sessionId) {
+      const result = await sendRequest("revoke", { session_id: sessionId.trim() });
+      const accounts = parseAccounts(result.accounts);
+      const remainingCount = typeof result.remainingCount === "number" ? result.remainingCount : accounts.length;
+      return { accounts, remainingCount };
+    },
+    async revokeAll() {
+      await sendRequest("revoke_all");
+    },
+    async setPrimary(sessionId) {
+      const result = await sendRequest("set_primary", { session_id: sessionId.trim() });
+      return parseAccounts(result.accounts);
+    },
+    close() {
+      teardown();
+    }
+  };
+}
+function isPrimaryAccountError(error) {
+  return error instanceof SessionBridgeError && error.errorCode === "primary_account";
+}
+
+// src/sign-out.ts
+var SIGN_OUT_STATE_KEY = "__xs_sign_out_state";
+function popupWindowFeatures(width, height) {
+  const win = window;
+  const outerW = win.outerWidth > 0 ? win.outerWidth : win.innerWidth;
+  const outerH = win.outerHeight > 0 ? win.outerHeight : win.innerHeight;
+  const screenX = win.screenX ?? win.screenLeft ?? 0;
+  const screenY = win.screenY ?? win.screenTop ?? 0;
+  const left = Math.round(screenX + Math.max(0, (outerW - width) / 2));
+  const top = Math.round(screenY + Math.max(0, (outerH - height) / 2));
+  return `width=${width},height=${height},left=${left},top=${top},resizable=yes,scrollbars=yes`;
+}
+function randomState() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/u, "");
+}
+function parseSignOutResult(raw, data) {
+  return {
+    action: raw,
+    revokedCurrent: data.revokedCurrent === true,
+    remainingCount: typeof data.remainingCount === "number" && Number.isFinite(data.remainingCount) ? Math.max(0, data.remainingCount) : 0
+  };
+}
+async function signOutWithXS(opts, authBaseUrl) {
+  const parentOrigin = opts.parentOrigin ?? globalThis.location?.origin;
+  if (!parentOrigin || typeof window === "undefined") {
+    throw new Error(
+      "signOutWithXS requires a browser Window and explicit parentOrigin (or window.location)."
+    );
+  }
+  const normalizedBase = new URL(authBaseUrl);
+  const authOrigin = normalizedBase.origin;
+  const state = randomState();
+  sessionStorage.setItem(SIGN_OUT_STATE_KEY, state);
+  const params = new URLSearchParams({
+    client_id: opts.clientId,
+    parent_origin: parentOrigin,
+    state
+  });
+  if (opts.activeUserId?.trim()) {
+    params.set("active_user_id", opts.activeUserId.trim());
+  }
+  const url = `${normalizedBase.href.replace(/\/?$/u, "")}/session/sign-out?${params.toString()}`;
+  const popup = window.open(
+    url,
+    `xs-auth-signout-${crypto.randomUUID()}`,
+    popupWindowFeatures(480, 640)
+  );
+  if (!popup) throw new PopupBlockedError();
+  const timeoutMs = opts.timeoutMs !== void 0 ? opts.timeoutMs : 12e4;
+  return await new Promise((resolve, reject) => {
+    let cleaned = false;
+    const teardown = () => {
+      if (cleaned) return;
+      cleaned = true;
+      window.removeEventListener("message", handleMessage);
+      clearInterval(closePoll);
+      clearTimeout(timer);
+      sessionStorage.removeItem(SIGN_OUT_STATE_KEY);
+      try {
+        popup.close();
+      } catch {
+      }
+    };
+    const fail = (error) => {
+      teardown();
+      reject(error);
+    };
+    const timer = window.setTimeout(() => {
+      fail(new LoginBridgeTimeoutError());
+    }, timeoutMs);
+    const handleMessage = (event) => {
+      if (event.origin !== authOrigin) return;
+      const d = event.data;
+      if (d?.source !== "xs-auth") return;
+      const st = typeof d.state === "string" ? d.state : "";
+      if (!st || st !== sessionStorage.getItem(SIGN_OUT_STATE_KEY)) return;
+      if (d.type === "sign_out_cancelled") {
+        teardown();
+        resolve(parseSignOutResult("cancelled", d));
+        return;
+      }
+      if (d.type === "sign_out_complete") {
+        teardown();
+        const actionRaw = typeof d.action === "string" ? d.action : "revoked_one";
+        const action = actionRaw === "revoked_all" ? "revoked_all" : actionRaw === "cancelled" ? "cancelled" : "revoked_one";
+        resolve(parseSignOutResult(action, d));
+      }
+    };
+    window.addEventListener("message", handleMessage);
+    const closePoll = window.setInterval(() => {
+      if (!popup.closed) return;
+      if (cleaned) return;
+      if (!sessionStorage.getItem(SIGN_OUT_STATE_KEY)) return;
+      fail(new PopupClosedError());
+    }, 280);
+  });
+}
+
+// src/index.ts
 var XS_AUTH_BASE_URL = "https://auth.xinosolutions.com";
+function openSessionBridge2(opts) {
+  return openSessionBridge(opts, XS_AUTH_BASE_URL);
+}
+function signOutWithXS2(opts) {
+  const authBase = opts.authBaseUrl?.trim() || XS_AUTH_BASE_URL;
+  return signOutWithXS(opts, authBase);
+}
 function bytesBuffer(len) {
   const out = new Uint8Array(len);
   crypto.getRandomValues(out);
@@ -57,8 +377,26 @@ function parseSdkUser(raw) {
   if (lastName) user.lastName = lastName;
   return user;
 }
+function resolvePrompt(opts) {
+  if (opts.prompt) return opts.prompt;
+  if (opts.preferPrimary) return "none";
+  return void 0;
+}
+function authPublicPathFromBase(authBaseUrl) {
+  try {
+    const pathname = new URL(authBaseUrl).pathname.replace(/\/$/u, "");
+    return pathname === "/" ? "" : pathname;
+  } catch {
+    return "";
+  }
+}
+function maybeSetPublicPath(params, authBaseUrl) {
+  const publicPath = authPublicPathFromBase(authBaseUrl);
+  if (publicPath) params.set("public_path", publicPath);
+}
 async function loginWithXS(opts) {
-  const normalizedBase = normalizeBaseUrl(XS_AUTH_BASE_URL);
+  const authBase = opts.authBaseUrl?.trim() || XS_AUTH_BASE_URL;
+  const normalizedBase = normalizeBaseUrl(authBase);
   const authOrigin = normalizedBase.origin;
   const parentOrigin = opts.parentOrigin ?? globalThis.location?.origin;
   if (!parentOrigin || typeof window === "undefined") {
@@ -66,7 +404,7 @@ async function loginWithXS(opts) {
       "loginWithXS requires a browser Window and explicit parentOrigin (or window.location)."
     );
   }
-  const timeoutMs = opts.timeoutMs !== void 0 ? opts.timeoutMs : 12e4;
+  const timeoutMs = opts.timeoutMs !== void 0 ? opts.timeoutMs : 18e4;
   const state = randomBase64State();
   sessionStorage.setItem(STATE_KEY_STORAGE, state);
   const nonce = opts.useNonce ? randomBase64State() : void 0;
@@ -81,13 +419,17 @@ async function loginWithXS(opts) {
   });
   if (opts.scope?.trim()) params.set("scope", opts.scope.trim());
   if (nonce) params.set("nonce", nonce);
+  const prompt = resolvePrompt(opts);
+  if (prompt) params.set("prompt", prompt);
+  if (opts.accountId?.trim()) params.set("account_id", opts.accountId.trim());
+  maybeSetPublicPath(params, authBase);
   const authorizeUrl = `${normalizedBase.href.replace(/\/?$/u, "")}/authorize?${params.toString()}`;
-  const popupWidth = 480;
-  const popupHeight = 640;
+  const popupWidth = prompt === "none" ? 420 : 480;
+  const popupHeight = prompt === "none" ? 120 : 640;
   const popup = window.open(
     authorizeUrl,
     `xs-auth-${crypto.randomUUID()}`,
-    popupWindowFeatures(popupWidth, popupHeight)
+    popupWindowFeatures2(popupWidth, popupHeight)
   );
   if (!popup) throw new PopupBlockedError();
   return await new Promise((resolve, reject) => {
@@ -150,7 +492,7 @@ async function loginWithXS(opts) {
       window.removeEventListener("message", handleMessage);
       clearInterval(closePoll);
       cleaned = true;
-      resolve({ user, idToken });
+      resolve({ user, idToken, mfaVerified: idTokenIncludesMfa(idToken) });
       try {
         popup.close();
       } catch {
@@ -166,13 +508,38 @@ async function loginWithXS(opts) {
     }, 280);
   });
 }
+function idTokenIncludesMfa(idToken) {
+  const amr = parseIdTokenAmr(idToken);
+  return Array.isArray(amr) && amr.includes("mfa");
+}
+function parseIdTokenAmr(idToken) {
+  const payload = parseJwtPayload(idToken);
+  if (!payload || !("amr" in payload)) return null;
+  const amr = payload.amr;
+  if (Array.isArray(amr)) {
+    return amr.filter((v) => typeof v === "string");
+  }
+  if (typeof amr === "string" && amr.trim()) return [amr.trim()];
+  return null;
+}
+function parseJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    const json = atob(parts[1].replace(/-/g, "+").replace(/_/g, "/"));
+    const parsed = JSON.parse(json);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
 function randomBase64State() {
   return base64UrlEncode(bytesBuffer(32));
 }
 function normalizeBaseUrl(s) {
   return new URL(s);
 }
-function popupWindowFeatures(width, height) {
+function popupWindowFeatures2(width, height) {
   const win = window;
   const outerW = win.outerWidth > 0 ? win.outerWidth : win.innerWidth;
   const outerH = win.outerHeight > 0 ? win.outerHeight : win.innerHeight;
@@ -182,12 +549,23 @@ function popupWindowFeatures(width, height) {
   const top = Math.round(screenY + Math.max(0, (outerH - height) / 2));
   return `width=${width},height=${height},left=${left},top=${top},resizable=yes,scrollbars=yes`;
 }
+function isLoginRequiredError(error) {
+  return error instanceof XSAuthDeniedError && error.errorCode === "login_required";
+}
 export {
+  LoginBridgeTimeoutError,
   LoginTimeoutError,
   PopupBlockedError,
   PopupClosedError,
+  SessionBridgeError,
   XSAuthDeniedError,
   createPkcePair,
-  loginWithXS
+  idTokenIncludesMfa,
+  isLoginRequiredError,
+  isPrimaryAccountError,
+  loginWithXS,
+  openSessionBridge2 as openSessionBridge,
+  parseIdTokenAmr,
+  signOutWithXS2 as signOutWithXS
 };
 //# sourceMappingURL=index.js.map