@absolutejs/auth 0.68.2 → 0.69.0

package/dist/client/createAuthClient.d.ts

@@ -37,10 +37,36 @@ export type AuthClientRoutes = {
 export type AuthClientConfig = {
     baseUrl?: string;
     credentials?: RequestCredentials;
-    fetch?: typeof fetch;
+    fetch?: AuthClientFetch;
     routes?: AuthClientRoutes;
+    transport?: AuthClientTransport;
 };
-export declare const createAuthClient: ({ baseUrl, credentials, fetch: fetchImpl, routes }?: AuthClientConfig) => {
+export type AuthClientFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+export type AuthClientTransport = {
+    fetch?: AuthClientFetch;
+    signInEmail?: (body: {
+        email: string;
+        password: string;
+    }) => Promise<{
+        passwordCompromised?: boolean;
+        status: 'authenticated' | 'mfa_required';
+    }>;
+    signOut?: () => Promise<null>;
+    signUpEmail?: (body: {
+        email: string;
+        password: string;
+        [extra: string]: unknown;
+    }) => Promise<{
+        status: 'authenticated';
+    } | {
+        status: 'verification_required';
+    }>;
+    status?: () => Promise<{
+        impersonator?: unknown;
+        user: unknown | null;
+    }>;
+};
+export declare const createAuthClient: ({ baseUrl, credentials, fetch: fetchImpl, routes, transport }?: AuthClientConfig) => {
     emailVerification: {
         request: (body: {
             email: string;

package/dist/client/index.d.ts

@@ -1,4 +1,5 @@
 export * from './createAuthClient';
 export * from './sessionExpiry';
+export * from './mobile';
 export * from '../redirect';
 export { runConditionalAuthentication, runPasskeyRegistration } from './passkeyHelpers';

package/dist/client/index.js

@@ -87,15 +87,21 @@ var createAuthClient = ({
   baseUrl = "",
   credentials = "same-origin",
   fetch: fetchImpl = fetch,
-  routes
+  routes,
+  transport
 } = {}) => {
+  const resolvedFetch = transport?.fetch ?? fetchImpl;
+  const signInEmail = transport?.signInEmail;
+  const signOut = transport?.signOut;
+  const signUpEmail = transport?.signUpEmail;
+  const transportStatus = transport?.status;
   const resolvedRoutes = {
     ...DEFAULT_ROUTES,
     ...routes
   };
   const request = async (path, init) => {
     try {
-      const response = await fetchImpl(`${baseUrl}${path}`, {
+      const response = await resolvedFetch(`${baseUrl}${path}`, {
         credentials,
         ...init
       });
@@ -109,6 +115,14 @@ var createAuthClient = ({
       return fail({ body: null, message, status: 0 });
     }
   };
+  const runTransport = async (operation) => {
+    try {
+      return succeed(await operation());
+    } catch (caught) {
+      const message = caught instanceof Error ? caught.message : "authentication";
+      return fail({ body: null, message, status: 0 });
+    }
+  };
   const post = (path, body, method = "POST") => request(path, {
     body: body === undefined ? undefined : JSON.stringify(body),
     headers: body === undefined ? undefined : { "content-type": "application/json" },
@@ -149,13 +163,13 @@ var createAuthClient = ({
       revoke: (sessionId) => del(`${resolvedRoutes.sessions}/${encodeURIComponent(sessionId)}`)
     },
     signIn: {
-      email: (body) => post(resolvedRoutes.login, body)
+      email: (body) => signInEmail ? runTransport(() => signInEmail(body)) : post(resolvedRoutes.login, body)
     },
     signUp: {
-      email: (body) => post(resolvedRoutes.register, body)
+      email: (body) => signUpEmail ? runTransport(() => signUpEmail(body)) : post(resolvedRoutes.register, body)
     },
-    signOut: () => del(resolvedRoutes.signout),
-    status: () => get(resolvedRoutes.status)
+    signOut: () => signOut ? runTransport(() => signOut()) : del(resolvedRoutes.signout),
+    status: () => transportStatus ? runTransport(() => transportStatus()) : get(resolvedRoutes.status)
   };
 };
 var safeJson = (text) => {
@@ -326,6 +340,522 @@ var isProtectedSessionRequest = ({
   const url = requestUrl(input, origin);
   return url?.origin === origin && protectedPaths.some((path) => url.pathname.startsWith(path));
 };
+// src/client/mobile.ts
+class MobileAuthError extends Error {
+  code;
+  cause;
+  constructor(code, message, options) {
+    super(message);
+    this.name = "MobileAuthError";
+    this.code = code;
+    this.cause = options?.cause;
+  }
+}
+var PENDING_KEY = "oidc.pending";
+var REFRESH_KEY = "oidc.refresh";
+var DEFAULT_CLOCK_SKEW_MS = 30000;
+var PENDING_TTL_MS = 10 * 60000;
+var RANDOM_BYTES = 32;
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var base64Url = (value) => {
+  let binary = "";
+  for (const byte of value)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+};
+var decodeBase64Url = (value) => {
+  const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+};
+var randomValue = () => {
+  const value = new Uint8Array(RANDOM_BYTES);
+  crypto.getRandomValues(value);
+  return base64Url(value);
+};
+var pkceChallenge = async (verifier) => base64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+var normalizeIssuer = (value) => {
+  const issuer = new URL(value);
+  const loopback = issuer.protocol === "http:" && ["127.0.0.1", "[::1]", "localhost"].includes(issuer.hostname);
+  if (issuer.protocol !== "https:" && !loopback)
+    throw new TypeError("Mobile auth issuer must use HTTPS.");
+  if (issuer.username || issuer.password || issuer.search || issuer.hash)
+    throw new TypeError("Mobile auth issuer cannot contain credentials, query, or fragment.");
+  issuer.pathname = issuer.pathname.replace(/\/$/u, "");
+  return issuer.href.replace(/\/$/u, "");
+};
+var exactRedirect = (actualValue, expectedValue) => {
+  const actual = new URL(actualValue);
+  const expected = new URL(expectedValue);
+  return actual.protocol === expected.protocol && actual.host === expected.host && actual.pathname === expected.pathname && actual.username === "" && actual.password === "";
+};
+var parsePending = (value) => {
+  if (value === null)
+    return;
+  try {
+    const parsed = JSON.parse(value);
+    if (!isRecord(parsed) || typeof parsed.createdAt !== "number" || typeof parsed.nonce !== "string" || typeof parsed.state !== "string" || typeof parsed.verifier !== "string")
+      return;
+    return {
+      createdAt: parsed.createdAt,
+      nonce: parsed.nonce,
+      state: parsed.state,
+      verifier: parsed.verifier
+    };
+  } catch {
+    return;
+  }
+};
+var parseTokenResponse = (value) => {
+  if (!isRecord(value) || typeof value.access_token !== "string" || typeof value.expires_in !== "number" || !Number.isFinite(value.expires_in) || value.expires_in <= 0 || typeof value.id_token !== "string" || typeof value.refresh_token !== "string" || typeof value.token_type !== "string")
+    throw new MobileAuthError("token", "The token response is malformed.");
+  if (value.token_type.toLowerCase() !== "bearer")
+    throw new MobileAuthError("token", `Unsupported mobile token type ${value.token_type}; DPoP is not enabled for this client.`);
+  return {
+    access_token: value.access_token,
+    expires_in: value.expires_in,
+    id_token: value.id_token,
+    refresh_token: value.refresh_token,
+    scope: typeof value.scope === "string" ? value.scope : undefined,
+    token_type: value.token_type
+  };
+};
+var responseBody = async (response) => {
+  const text = await response.text();
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+};
+var requireEndpoint = (value, name, issuer) => {
+  if (typeof value !== "string")
+    throw new MobileAuthError("discovery", `OIDC discovery is missing ${name}.`);
+  const endpoint = new URL(value);
+  if (endpoint.protocol !== "https:" && new URL(issuer).protocol === "https:")
+    throw new MobileAuthError("discovery", `OIDC discovery ${name} must use HTTPS.`);
+  return endpoint.href;
+};
+var parseDiscovery = (value, issuer) => {
+  if (!isRecord(value) || value.issuer !== issuer)
+    throw new MobileAuthError("discovery", "OIDC discovery issuer does not match the configured issuer.");
+  const methods = Array.isArray(value.code_challenge_methods_supported) ? value.code_challenge_methods_supported.filter((method) => typeof method === "string") : undefined;
+  if (!methods?.includes("S256"))
+    throw new MobileAuthError("discovery", "OIDC provider does not advertise S256 PKCE.");
+  const authMethods = Array.isArray(value.token_endpoint_auth_methods_supported) ? value.token_endpoint_auth_methods_supported.filter((method) => typeof method === "string") : undefined;
+  if (!authMethods?.includes("none"))
+    throw new MobileAuthError("discovery", "OIDC provider does not accept public clients at the token endpoint.");
+  return {
+    authorization_endpoint: requireEndpoint(value.authorization_endpoint, "authorization_endpoint", issuer),
+    code_challenge_methods_supported: methods,
+    issuer,
+    jwks_uri: requireEndpoint(value.jwks_uri, "jwks_uri", issuer),
+    revocation_endpoint: typeof value.revocation_endpoint === "string" ? requireEndpoint(value.revocation_endpoint, "revocation_endpoint", issuer) : undefined,
+    socket_ticket_endpoint: typeof value.socket_ticket_endpoint === "string" ? requireEndpoint(value.socket_ticket_endpoint, "socket_ticket_endpoint", issuer) : undefined,
+    token_endpoint: requireEndpoint(value.token_endpoint, "token_endpoint", issuer),
+    token_endpoint_auth_methods_supported: authMethods,
+    userinfo_endpoint: requireEndpoint(value.userinfo_endpoint, "userinfo_endpoint", issuer)
+  };
+};
+var verifyIdToken = async ({
+  clientId,
+  fetchImpl,
+  idToken,
+  issuer,
+  jwksUri,
+  nonce,
+  now
+}) => {
+  const [encodedHeader, encodedPayload, encodedSignature, ...extra] = idToken.split(".");
+  if (!encodedHeader || !encodedPayload || !encodedSignature || extra.length)
+    throw new MobileAuthError("id-token", "The ID token is malformed.");
+  let header;
+  let payload;
+  try {
+    header = JSON.parse(new TextDecoder().decode(decodeBase64Url(encodedHeader)));
+    payload = JSON.parse(new TextDecoder().decode(decodeBase64Url(encodedPayload)));
+  } catch (cause) {
+    throw new MobileAuthError("id-token", "The ID token is malformed.", {
+      cause
+    });
+  }
+  if (!isRecord(header) || header.alg !== "ES256" || typeof header.kid !== "string" || !isRecord(payload))
+    throw new MobileAuthError("id-token", "The ID token header or claims are invalid.");
+  const response = await fetchImpl(jwksUri, { cache: "no-store" });
+  if (!response.ok)
+    throw new MobileAuthError("network", "Unable to fetch OIDC signing keys.");
+  const body = await response.json();
+  const keys = isRecord(body) && Array.isArray(body.keys) ? body.keys : [];
+  const jwk = keys.find((candidate) => isRecord(candidate) && candidate.kid === header.kid);
+  if (!jwk)
+    throw new MobileAuthError("id-token", "The ID token signing key is unknown.");
+  const key = await crypto.subtle.importKey("jwk", jwk, { hash: "SHA-256", name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+  const valid = await crypto.subtle.verify({ hash: "SHA-256", name: "ECDSA" }, key, decodeBase64Url(encodedSignature), new TextEncoder().encode(`${encodedHeader}.${encodedPayload}`));
+  const audience = payload.aud;
+  if (!valid || payload.iss !== issuer || !(audience === clientId || Array.isArray(audience) && audience.includes(clientId)) || payload.nonce !== nonce || typeof payload.exp !== "number" || payload.exp * 1000 <= now)
+    throw new MobileAuthError("id-token", "The ID token signature or claims are invalid.");
+};
+var createMobileAuthClient = (config) => {
+  const issuer = normalizeIssuer(config.issuer);
+  const redirectUri = new URL(config.redirectUri).href;
+  const fetchImpl = config.fetch ?? globalThis.fetch;
+  const now = config.now ?? Date.now;
+  const clockSkewMs = config.clockSkewMs ?? DEFAULT_CLOCK_SKEW_MS;
+  const scopes = [...new Set(config.scopes ?? ["openid", "profile"])];
+  const resource = config.resource ?? issuer;
+  if (!scopes.includes("openid"))
+    scopes.unshift("openid");
+  const allowedOrigins = new Set((config.allowedOrigins ?? [new URL(issuer).origin]).map((value) => new URL(value).origin));
+  let discoveryPromise;
+  let access;
+  let refreshPromise;
+  let stopLinks;
+  let stopResume;
+  let startPromise;
+  const pendingSignIns = new Map;
+  const fetchDiscovery = async () => {
+    const url = new URL("/.well-known/openid-configuration", `${issuer}/`);
+    const response = await fetchImpl(url, {
+      cache: "no-store",
+      headers: { accept: "application/json" }
+    });
+    if (!response.ok)
+      throw new MobileAuthError("discovery", `OIDC discovery failed with HTTP ${response.status}.`);
+    return parseDiscovery(await response.json(), issuer);
+  };
+  const discovery = () => {
+    discoveryPromise ??= fetchDiscovery();
+    return discoveryPromise;
+  };
+  const assertSecureStorage = async () => {
+    const capability = await config.storage.capability?.();
+    if (capability && !capability.available)
+      throw new MobileAuthError("secure-storage", capability.message ?? "Native secure credential storage is unavailable.");
+  };
+  const tokenRequest = async (metadata, body, nonce) => {
+    let response;
+    try {
+      response = await fetchImpl(metadata.token_endpoint, {
+        body,
+        credentials: "omit",
+        headers: {
+          accept: "application/json",
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        method: "POST"
+      });
+    } catch (cause) {
+      throw new MobileAuthError("network", "The token request failed.", {
+        cause
+      });
+    }
+    const value = await responseBody(response);
+    if (!response.ok) {
+      const oauthCode = isRecord(value) && typeof value.error === "string" ? value.error : `HTTP ${response.status}`;
+      throw new MobileAuthError("oauth", `The authorization server rejected the token request (${oauthCode}).`);
+    }
+    const tokens = parseTokenResponse(value);
+    if (nonce)
+      await verifyIdToken({
+        clientId: config.clientId,
+        fetchImpl,
+        idToken: tokens.id_token,
+        issuer,
+        jwksUri: metadata.jwks_uri,
+        nonce,
+        now: now()
+      });
+    return tokens;
+  };
+  const acceptTokens = async (tokens) => {
+    try {
+      await config.storage.set(REFRESH_KEY, tokens.refresh_token);
+    } catch (cause) {
+      access = undefined;
+      await config.storage.remove(REFRESH_KEY).catch(() => {
+        return;
+      });
+      throw new MobileAuthError("secure-storage", "The rotated refresh credential could not be saved securely.", { cause });
+    }
+    access = {
+      accessToken: tokens.access_token,
+      expiresAt: now() + tokens.expires_in * 1000,
+      idToken: tokens.id_token,
+      scope: tokens.scope?.split(" ").filter(Boolean) ?? scopes,
+      tokenType: "Bearer"
+    };
+    return { ...access, refreshToken: tokens.refresh_token };
+  };
+  const rotateAccessToken = async () => {
+    await assertSecureStorage();
+    const refreshToken = await config.storage.get(REFRESH_KEY);
+    if (!refreshToken)
+      throw new MobileAuthError("token", "This app has no renewable mobile session.");
+    const metadata = await discovery();
+    const body = new URLSearchParams({
+      client_id: config.clientId,
+      grant_type: "refresh_token",
+      refresh_token: refreshToken
+    });
+    body.set("resource", resource);
+    const tokens = await tokenRequest(metadata, body);
+    return (await acceptTokens(tokens)).accessToken;
+  };
+  const refreshAccessToken = async () => {
+    if (access && access.expiresAt - clockSkewMs > now())
+      return access.accessToken;
+    if (refreshPromise)
+      return refreshPromise;
+    refreshPromise = rotateAccessToken().finally(() => {
+      refreshPromise = undefined;
+    });
+    return refreshPromise;
+  };
+  const handleCallback = async (value) => {
+    if (!exactRedirect(value, redirectUri))
+      throw new MobileAuthError("callback", "The authorization callback does not match this app registration.");
+    const url = new URL(value);
+    const pending = parsePending(await config.storage.get(PENDING_KEY));
+    if (!pending || now() - pending.createdAt > PENDING_TTL_MS) {
+      await config.storage.remove(PENDING_KEY).catch(() => {
+        return;
+      });
+      throw new MobileAuthError("callback", "The authorization transaction is missing or expired.");
+    }
+    const deferred = pendingSignIns.get(pending.state);
+    const reject = (error) => {
+      pendingSignIns.delete(pending.state);
+      config.storage.remove(PENDING_KEY);
+      deferred?.reject(error);
+      throw error;
+    };
+    if (url.searchParams.get("state") !== pending.state)
+      return reject(new MobileAuthError("callback", "The authorization callback state does not match."));
+    if (url.searchParams.get("iss") !== issuer)
+      return reject(new MobileAuthError("callback", "The authorization callback issuer does not match."));
+    const oauthError = url.searchParams.get("error");
+    if (oauthError) {
+      await config.storage.remove(PENDING_KEY);
+      return reject(new MobileAuthError("oauth", `Authorization failed (${oauthError}).`));
+    }
+    const code = url.searchParams.get("code");
+    if (!code)
+      return reject(new MobileAuthError("callback", "The authorization callback contains no code."));
+    await config.storage.remove(PENDING_KEY);
+    try {
+      const metadata = await discovery();
+      const body = new URLSearchParams({
+        client_id: config.clientId,
+        code,
+        code_verifier: pending.verifier,
+        grant_type: "authorization_code",
+        redirect_uri: redirectUri
+      });
+      body.set("resource", resource);
+      const tokens = await acceptTokens(await tokenRequest(metadata, body, pending.nonce));
+      pendingSignIns.delete(pending.state);
+      deferred?.resolve(tokens);
+      return tokens;
+    } catch (error) {
+      return reject(error);
+    }
+  };
+  const initialize = async () => {
+    await assertSecureStorage();
+    stopLinks = await config.links.onOpen((url) => {
+      if (exactRedirect(url, redirectUri))
+        handleCallback(url).catch(() => {
+          return;
+        });
+    });
+    if (config.lifecycle?.onResume)
+      stopResume = await config.lifecycle.onResume(() => {
+        refreshAccessToken().catch(() => {
+          return;
+        });
+      });
+    const launchUrl = await config.links.getLaunchUrl();
+    if (launchUrl && exactRedirect(launchUrl, redirectUri))
+      await handleCallback(launchUrl);
+  };
+  const start = () => {
+    startPromise ??= initialize();
+    return startPromise;
+  };
+  const signIn = async (options = {}) => {
+    await start();
+    if (options.signal?.aborted)
+      throw new MobileAuthError("aborted", "Authorization was cancelled.");
+    const metadata = await discovery();
+    const pending = {
+      createdAt: now(),
+      nonce: randomValue(),
+      state: randomValue(),
+      verifier: randomValue()
+    };
+    await config.storage.set(PENDING_KEY, JSON.stringify(pending));
+    const url = new URL(metadata.authorization_endpoint);
+    url.search = new URLSearchParams({
+      client_id: config.clientId,
+      code_challenge: await pkceChallenge(pending.verifier),
+      code_challenge_method: "S256",
+      nonce: pending.nonce,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      scope: scopes.join(" "),
+      state: pending.state,
+      ...options.authorizationParameters
+    }).toString();
+    url.searchParams.set("resource", resource);
+    const result = new Promise((resolve, reject) => {
+      pendingSignIns.set(pending.state, { reject, resolve });
+      options.signal?.addEventListener("abort", () => {
+        pendingSignIns.delete(pending.state);
+        config.storage.remove(PENDING_KEY);
+        reject(new MobileAuthError("aborted", "Authorization was cancelled."));
+      }, { once: true });
+    });
+    try {
+      await config.links.openExternal(url.href);
+    } catch (error) {
+      pendingSignIns.delete(pending.state);
+      await config.storage.remove(PENDING_KEY);
+      throw error;
+    }
+    return result;
+  };
+  const authenticatedFetch = async (input, init) => {
+    const original = new Request(input, init);
+    if (!allowedOrigins.has(new URL(original.url).origin))
+      throw new MobileAuthError("origin", "Mobile auth refused to send a credential to an unregistered origin.");
+    const send = async (forceRefresh) => {
+      if (forceRefresh)
+        access = undefined;
+      const token = await refreshAccessToken();
+      const request = original.clone();
+      const headers = new Headers(request.headers);
+      headers.set("authorization", `Bearer ${token}`);
+      return fetchImpl(new Request(request, { credentials: "omit", headers }));
+    };
+    const response = await send(false);
+    return response.status === 401 ? send(true) : response;
+  };
+  const optionalAuthenticatedFetch = async (input, init) => {
+    const request = new Request(input, init);
+    if (!allowedOrigins.has(new URL(request.url).origin))
+      throw new MobileAuthError("origin", "Mobile auth refused to send a request outside an allowed origin.");
+    const refreshToken = await config.storage.get(REFRESH_KEY);
+    if (access || refreshToken)
+      return authenticatedFetch(request);
+    return fetchImpl(new Request(request, { credentials: "omit" }));
+  };
+  const status = async () => {
+    try {
+      const metadata = await discovery();
+      const response = await authenticatedFetch(metadata.userinfo_endpoint);
+      if (response.status === 401)
+        return null;
+      if (!response.ok)
+        throw new MobileAuthError("network", `User info failed with HTTP ${response.status}.`);
+      const user = await response.json();
+      if (!isRecord(user) || typeof user.sub !== "string")
+        throw new MobileAuthError("token", "The user-info response is malformed.");
+      return { ...user, sub: user.sub };
+    } catch (error) {
+      if (error instanceof MobileAuthError && (error.code === "oauth" || error.code === "token"))
+        return null;
+      throw error;
+    }
+  };
+  const socketTicket = async (audience = resource) => {
+    const metadata = await discovery();
+    if (!metadata.socket_ticket_endpoint)
+      throw new MobileAuthError("discovery", "The authorization server does not advertise WebSocket tickets.");
+    const response = await authenticatedFetch(metadata.socket_ticket_endpoint, {
+      body: JSON.stringify({ audience }),
+      headers: { "content-type": "application/json" },
+      method: "POST"
+    });
+    const body = await responseBody(response);
+    if (!response.ok || !isRecord(body) || typeof body.ticket !== "string")
+      throw new MobileAuthError(response.ok ? "token" : "oauth", `WebSocket ticket request failed with HTTP ${response.status}.`);
+    return body.ticket;
+  };
+  const revokeRefreshToken = async (refreshToken) => {
+    const metadata = await discovery();
+    if (metadata.revocation_endpoint)
+      await fetchImpl(metadata.revocation_endpoint, {
+        body: new URLSearchParams({
+          client_id: config.clientId,
+          token: refreshToken,
+          token_type_hint: "refresh_token"
+        }),
+        credentials: "omit",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        method: "POST"
+      });
+  };
+  const signOut = async () => {
+    const refreshToken = await config.storage.get(REFRESH_KEY);
+    try {
+      if (refreshToken)
+        await revokeRefreshToken(refreshToken);
+    } finally {
+      access = undefined;
+      await Promise.all([
+        config.storage.remove(PENDING_KEY),
+        config.storage.remove(REFRESH_KEY)
+      ]);
+    }
+  };
+  const stop = async () => {
+    await Promise.all([stopLinks?.(), stopResume?.()]);
+    stopLinks = undefined;
+    stopResume = undefined;
+    startPromise = undefined;
+  };
+  return {
+    fetch: authenticatedFetch,
+    fetchOptional: optionalAuthenticatedFetch,
+    handleCallback,
+    refresh: refreshAccessToken,
+    signIn,
+    signOut,
+    socketTicket,
+    start,
+    status,
+    stop
+  };
+};
+var createMobileAuthTransport = (client) => ({
+  fetch: client.fetch,
+  signInEmail: async ({ email }) => {
+    await client.signIn({
+      authorizationParameters: { login_hint: email }
+    });
+    return { status: "authenticated" };
+  },
+  signOut: async () => {
+    await client.signOut();
+    return null;
+  },
+  signUpEmail: async ({ email }) => {
+    await client.signIn({
+      authorizationParameters: {
+        login_hint: email,
+        screen_hint: "signup"
+      }
+    });
+    return { status: "authenticated" };
+  },
+  status: async () => {
+    const user = await client.status();
+    return { user };
+  }
+});
 // src/redirect.ts
 var isSafeLocalPath = (value) => /^\/(?![/\\])/.test(value);
 var toSafeLocalPath = (value, fallback = "/") => value !== undefined && isSafeLocalPath(value) ? value : fallback;
@@ -384,9 +914,12 @@ export {
   isSafeLocalPath,
   isProtectedSessionRequest,
   installSessionExpiryGuard,
+  createMobileAuthTransport,
+  createMobileAuthClient,
   createAuthClient,
-  buildSessionExpiredSignInUrl
+  buildSessionExpiredSignInUrl,
+  MobileAuthError
 };
 
-//# debugId=E8018F05FE86589464756E2164756E21
+//# debugId=1DC9AFB1303049A564756E2164756E21
 //# sourceMappingURL=index.js.map