@absolutejs/auth 0.69.0 → 0.69.1

package/dist/client/index.js

@@ -46,396 +46,102 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// src/client/createAuthClient.ts
-var DEFAULT_ROUTES = {
-  emailVerify: "/auth/verify-email",
-  emailVerifyRequest: "/auth/verify-email/request",
-  login: "/auth/login",
-  magicLinkRequest: "/auth/passwordless/magic-link",
-  magicLinkVerify: "/auth/passwordless/magic-link/verify",
-  mfaChallenge: "/auth/mfa/totp/challenge",
-  mfaManagement: "/auth/mfa",
-  mfaSetup: "/auth/mfa/totp/setup",
-  mfaVerifySetup: "/auth/mfa/totp/verify",
-  passkeyAuthenticateOptions: "/auth/webauthn/authenticate/options",
-  passkeyAuthenticateVerify: "/auth/webauthn/authenticate/verify",
-  passkeyList: "/auth/webauthn/credentials",
-  passkeyRegisterOptions: "/auth/webauthn/register/options",
-  passkeyRegisterVerify: "/auth/webauthn/register/verify",
-  passkeyRemove: "/auth/webauthn/credentials",
-  passwordReset: "/auth/reset-password",
-  passwordResetRequest: "/auth/reset-password/request",
-  register: "/auth/register",
-  sessions: "/auth/sessions",
-  signout: "/oauth2/signout",
-  status: "/oauth2/status"
+// src/client/mobile.ts
+class MobileAuthError extends Error {
+  code;
+  cause;
+  constructor(code, message, options) {
+    super(message);
+    this.name = "MobileAuthError";
+    this.code = code;
+    this.cause = options?.cause;
+  }
+}
+var PENDING_KEY = "oidc.pending";
+var REFRESH_KEY = "oidc.refresh";
+var DEFAULT_CLOCK_SKEW_MS = 30000;
+var PENDING_TTL_MS = 10 * 60000;
+var RANDOM_BYTES = 32;
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var base64Url = (value) => {
+  let binary = "";
+  for (const byte of value)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
 };
-var succeed = (data) => ({
-  data,
-  error: null
-});
-var fail = (error) => ({
-  data: null,
-  error
-});
-var errorFor = (response, body) => ({
-  body,
-  message: typeof body === "string" ? body : readMessage(body) ?? response.statusText,
-  status: response.status
-});
-var createAuthClient = ({
-  baseUrl = "",
-  credentials = "same-origin",
-  fetch: fetchImpl = fetch,
-  routes,
-  transport
-} = {}) => {
-  const resolvedFetch = transport?.fetch ?? fetchImpl;
-  const signInEmail = transport?.signInEmail;
-  const signOut = transport?.signOut;
-  const signUpEmail = transport?.signUpEmail;
-  const transportStatus = transport?.status;
-  const resolvedRoutes = {
-    ...DEFAULT_ROUTES,
-    ...routes
-  };
-  const request = async (path, init) => {
-    try {
-      const response = await resolvedFetch(`${baseUrl}${path}`, {
-        credentials,
-        ...init
-      });
-      const text = await response.text();
-      if (!response.ok)
-        return fail(errorFor(response, safeJson(text)));
-      const data = JSON.parse(text === "" ? "null" : text);
-      return succeed(data);
-    } catch (caught) {
-      const message = caught instanceof Error ? caught.message : "network";
-      return fail({ body: null, message, status: 0 });
-    }
-  };
-  const runTransport = async (operation) => {
-    try {
-      return succeed(await operation());
-    } catch (caught) {
-      const message = caught instanceof Error ? caught.message : "authentication";
-      return fail({ body: null, message, status: 0 });
-    }
-  };
-  const post = (path, body, method = "POST") => request(path, {
-    body: body === undefined ? undefined : JSON.stringify(body),
-    headers: body === undefined ? undefined : { "content-type": "application/json" },
-    method
-  });
-  const get = (path) => request(path, { method: "GET" });
-  const del = (path) => request(path, { method: "DELETE" });
-  return {
-    emailVerification: {
-      request: (body) => post(resolvedRoutes.emailVerifyRequest, body),
-      verify: (body) => post(resolvedRoutes.emailVerify, body)
-    },
-    mfa: {
-      challenge: (body) => post(resolvedRoutes.mfaChallenge, body),
-      disable: () => del(resolvedRoutes.mfaManagement),
-      setup: () => post(resolvedRoutes.mfaSetup),
-      status: () => get(resolvedRoutes.mfaManagement),
-      verifySetup: (body) => post(resolvedRoutes.mfaVerifySetup, body)
-    },
-    passkeys: {
-      authenticateOptions: () => post(resolvedRoutes.passkeyAuthenticateOptions),
-      authenticateVerify: (response) => post(resolvedRoutes.passkeyAuthenticateVerify, response),
-      list: () => get(resolvedRoutes.passkeyList),
-      registerOptions: () => post(resolvedRoutes.passkeyRegisterOptions),
-      registerVerify: (response) => post(resolvedRoutes.passkeyRegisterVerify, response),
-      remove: (credentialId) => del(`${resolvedRoutes.passkeyRemove}/${encodeURIComponent(credentialId)}`)
-    },
-    passwordless: {
-      requestMagicLink: (body) => post(resolvedRoutes.magicLinkRequest, body),
-      verifyMagicLink: (body) => post(resolvedRoutes.magicLinkVerify, body)
-    },
-    passwordReset: {
-      confirm: (body) => post(resolvedRoutes.passwordReset, body),
-      request: (body) => post(resolvedRoutes.passwordResetRequest, body)
-    },
-    sessions: {
-      list: () => get(resolvedRoutes.sessions),
-      revoke: (sessionId) => del(`${resolvedRoutes.sessions}/${encodeURIComponent(sessionId)}`)
-    },
-    signIn: {
-      email: (body) => signInEmail ? runTransport(() => signInEmail(body)) : post(resolvedRoutes.login, body)
-    },
-    signUp: {
-      email: (body) => signUpEmail ? runTransport(() => signUpEmail(body)) : post(resolvedRoutes.register, body)
-    },
-    signOut: () => signOut ? runTransport(() => signOut()) : del(resolvedRoutes.signout),
-    status: () => transportStatus ? runTransport(() => transportStatus()) : get(resolvedRoutes.status)
-  };
+var decodeBase64Url = (value) => {
+  const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
 };
-var safeJson = (text) => {
+var randomValue = () => {
+  const value = new Uint8Array(RANDOM_BYTES);
+  crypto.getRandomValues(value);
+  return base64Url(value);
+};
+var pkceChallenge = async (verifier) => base64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+var normalizeIssuer = (value) => {
+  const issuer = new URL(value);
+  const loopback = issuer.protocol === "http:" && ["127.0.0.1", "[::1]", "localhost"].includes(issuer.hostname);
+  if (issuer.protocol !== "https:" && !loopback)
+    throw new TypeError("Mobile auth issuer must use HTTPS.");
+  if (issuer.username || issuer.password || issuer.search || issuer.hash)
+    throw new TypeError("Mobile auth issuer cannot contain credentials, query, or fragment.");
+  issuer.pathname = issuer.pathname.replace(/\/$/u, "");
+  return issuer.href.replace(/\/$/u, "");
+};
+var exactRedirect = (actualValue, expectedValue) => {
+  const actual = new URL(actualValue);
+  const expected = new URL(expectedValue);
+  return actual.protocol === expected.protocol && actual.host === expected.host && actual.pathname === expected.pathname && actual.username === "" && actual.password === "";
+};
+var parsePending = (value) => {
+  if (value === null)
+    return;
   try {
-    return JSON.parse(text);
+    const parsed = JSON.parse(value);
+    if (!isRecord(parsed) || typeof parsed.createdAt !== "number" || typeof parsed.nonce !== "string" || typeof parsed.state !== "string" || typeof parsed.verifier !== "string")
+      return;
+    return {
+      createdAt: parsed.createdAt,
+      nonce: parsed.nonce,
+      state: parsed.state,
+      verifier: parsed.verifier
+    };
   } catch {
-    return text;
+    return;
   }
 };
-var readMessage = (body) => {
-  if (typeof body !== "object" || body === null)
-    return;
-  const message = Reflect.get(body, "message");
-  return typeof message === "string" ? message : undefined;
+var parseTokenResponse = (value) => {
+  if (!isRecord(value) || typeof value.access_token !== "string" || typeof value.expires_in !== "number" || !Number.isFinite(value.expires_in) || value.expires_in <= 0 || typeof value.id_token !== "string" || typeof value.refresh_token !== "string" || typeof value.token_type !== "string")
+    throw new MobileAuthError("token", "The token response is malformed.");
+  if (value.token_type.toLowerCase() !== "bearer")
+    throw new MobileAuthError("token", `Unsupported mobile token type ${value.token_type}; DPoP is not enabled for this client.`);
+  return {
+    access_token: value.access_token,
+    expires_in: value.expires_in,
+    id_token: value.id_token,
+    refresh_token: value.refresh_token,
+    scope: typeof value.scope === "string" ? value.scope : undefined,
+    token_type: value.token_type
+  };
 };
-// src/client/sessionExpiry.ts
-var DEFAULT_CHECK_INTERVAL_MS = 30000;
-var DEFAULT_REASON = "session_expired";
-var DEFAULT_REASON_PARAM = "reason";
-var DEFAULT_RETURN_URL_PARAM = "returnUrl";
-var DEFAULT_SIGN_IN_PATH = "/signin";
-var DEFAULT_STATUS_PATH = "/oauth2/status";
-var HTTP_UNAUTHORIZED = 401;
-var activeGuard = null;
-var requestUrl = (input, origin) => {
-  const raw = input instanceof Request ? input.url : String(input);
+var responseBody = async (response) => {
+  const text = await response.text();
   try {
-    return new URL(raw, origin);
+    return JSON.parse(text);
   } catch {
-    return null;
+    return text;
   }
 };
-var buildSessionExpiredSignInUrl = ({
-  currentHref,
-  reason = DEFAULT_REASON,
-  reasonParam = DEFAULT_REASON_PARAM,
-  returnUrlParam = DEFAULT_RETURN_URL_PARAM,
-  signInPath = DEFAULT_SIGN_IN_PATH
-}) => {
-  const current = new URL(currentHref);
-  const returnTo = `${current.pathname}${current.search}${current.hash}`;
-  const destination = new URL(signInPath, current.origin);
-  destination.searchParams.set(reasonParam, reason);
-  destination.searchParams.set(returnUrlParam, returnTo);
-  return destination.origin === current.origin ? `${destination.pathname}${destination.search}${destination.hash}` : destination.toString();
-};
-var installSessionExpiryGuard = (config = {}) => {
-  if (typeof window === "undefined" || typeof document === "undefined") {
-    return { check: async () => false, dispose: () => {
-      return;
-    } };
-  }
-  if (activeGuard)
-    return activeGuard;
-  const {
-    checkIntervalMs = DEFAULT_CHECK_INTERVAL_MS,
-    isProtectedRequest,
-    onExpired,
-    protectedPaths = [],
-    reason = DEFAULT_REASON,
-    reasonParam = DEFAULT_REASON_PARAM,
-    returnUrlParam = DEFAULT_RETURN_URL_PARAM,
-    signInPath = DEFAULT_SIGN_IN_PATH,
-    statusPath = DEFAULT_STATUS_PATH
-  } = config;
-  const nativeFetch = window.fetch.bind(window);
-  const originalFetch = window.fetch;
-  let checking = false;
-  let disposed = false;
-  let expired = false;
-  let lastCheckedAt = Date.now();
-  const expire = () => {
-    if (expired || disposed)
-      return;
-    expired = true;
-    const currentHref = window.location.href;
-    const signInUrl = buildSessionExpiredSignInUrl({
-      currentHref,
-      reason,
-      reasonParam,
-      returnUrlParam,
-      signInPath
-    });
-    const current = new URL(currentHref);
-    const returnTo = `${current.pathname}${current.search}${current.hash}`;
-    if (onExpired) {
-      onExpired({ returnTo, signInUrl });
-      return;
-    }
-    window.location.assign(signInUrl);
-  };
-  const protectedRequest = (input) => {
-    const url = requestUrl(input, window.location.origin);
-    if (!url || url.origin !== window.location.origin)
-      return false;
-    if (new URL(statusPath, window.location.origin).pathname === url.pathname)
-      return false;
-    return isProtectedRequest?.(url) === true || protectedPaths.some((path) => url.pathname.startsWith(path));
-  };
-  const guardedFetch = new Proxy(originalFetch, {
-    apply: async (target, thisArg, args) => {
-      const [input] = args;
-      const response = await Reflect.apply(target, thisArg, args);
-      if (response.status === HTTP_UNAUTHORIZED && protectedRequest(input)) {
-        expire();
-      }
-      return response;
-    }
-  });
-  window.fetch = guardedFetch;
-  const check = async () => {
-    if (checking || expired || disposed)
-      return false;
-    checking = true;
-    lastCheckedAt = Date.now();
-    try {
-      const response = await nativeFetch(statusPath, {
-        cache: "no-store",
-        credentials: "include",
-        headers: { accept: "application/json" }
-      });
-      if (!response.ok)
-        return false;
-      const payload = await response.json();
-      const sessionExpired = typeof payload === "object" && payload !== null && Reflect.get(payload, "user") === null;
-      if (!sessionExpired)
-        return false;
-      expire();
-      return true;
-    } catch {
-      return false;
-    } finally {
-      checking = false;
-    }
-  };
-  const checkIfDue = () => {
-    if (document.visibilityState !== "visible" || Date.now() - lastCheckedAt < checkIntervalMs)
-      return;
-    check();
-  };
-  const checkPersistedSession = (event) => {
-    if (!event.persisted)
-      return;
-    check();
-  };
-  const dispose = () => {
-    if (disposed)
-      return;
-    disposed = true;
-    document.removeEventListener("visibilitychange", checkIfDue);
-    window.removeEventListener("focus", checkIfDue);
-    window.removeEventListener("pageshow", checkPersistedSession);
-    if (window.fetch === guardedFetch)
-      window.fetch = originalFetch;
-    activeGuard = null;
-  };
-  document.addEventListener("visibilitychange", checkIfDue);
-  window.addEventListener("focus", checkIfDue);
-  window.addEventListener("pageshow", checkPersistedSession);
-  activeGuard = { check, dispose };
-  return activeGuard;
-};
-var isProtectedSessionRequest = ({
-  input,
-  origin,
-  protectedPaths
-}) => {
-  const url = requestUrl(input, origin);
-  return url?.origin === origin && protectedPaths.some((path) => url.pathname.startsWith(path));
-};
-// src/client/mobile.ts
-class MobileAuthError extends Error {
-  code;
-  cause;
-  constructor(code, message, options) {
-    super(message);
-    this.name = "MobileAuthError";
-    this.code = code;
-    this.cause = options?.cause;
-  }
-}
-var PENDING_KEY = "oidc.pending";
-var REFRESH_KEY = "oidc.refresh";
-var DEFAULT_CLOCK_SKEW_MS = 30000;
-var PENDING_TTL_MS = 10 * 60000;
-var RANDOM_BYTES = 32;
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var base64Url = (value) => {
-  let binary = "";
-  for (const byte of value)
-    binary += String.fromCharCode(byte);
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
-};
-var decodeBase64Url = (value) => {
-  const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
-  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
-  const binary = atob(padded);
-  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
-};
-var randomValue = () => {
-  const value = new Uint8Array(RANDOM_BYTES);
-  crypto.getRandomValues(value);
-  return base64Url(value);
-};
-var pkceChallenge = async (verifier) => base64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
-var normalizeIssuer = (value) => {
-  const issuer = new URL(value);
-  const loopback = issuer.protocol === "http:" && ["127.0.0.1", "[::1]", "localhost"].includes(issuer.hostname);
-  if (issuer.protocol !== "https:" && !loopback)
-    throw new TypeError("Mobile auth issuer must use HTTPS.");
-  if (issuer.username || issuer.password || issuer.search || issuer.hash)
-    throw new TypeError("Mobile auth issuer cannot contain credentials, query, or fragment.");
-  issuer.pathname = issuer.pathname.replace(/\/$/u, "");
-  return issuer.href.replace(/\/$/u, "");
-};
-var exactRedirect = (actualValue, expectedValue) => {
-  const actual = new URL(actualValue);
-  const expected = new URL(expectedValue);
-  return actual.protocol === expected.protocol && actual.host === expected.host && actual.pathname === expected.pathname && actual.username === "" && actual.password === "";
-};
-var parsePending = (value) => {
-  if (value === null)
-    return;
-  try {
-    const parsed = JSON.parse(value);
-    if (!isRecord(parsed) || typeof parsed.createdAt !== "number" || typeof parsed.nonce !== "string" || typeof parsed.state !== "string" || typeof parsed.verifier !== "string")
-      return;
-    return {
-      createdAt: parsed.createdAt,
-      nonce: parsed.nonce,
-      state: parsed.state,
-      verifier: parsed.verifier
-    };
-  } catch {
-    return;
-  }
-};
-var parseTokenResponse = (value) => {
-  if (!isRecord(value) || typeof value.access_token !== "string" || typeof value.expires_in !== "number" || !Number.isFinite(value.expires_in) || value.expires_in <= 0 || typeof value.id_token !== "string" || typeof value.refresh_token !== "string" || typeof value.token_type !== "string")
-    throw new MobileAuthError("token", "The token response is malformed.");
-  if (value.token_type.toLowerCase() !== "bearer")
-    throw new MobileAuthError("token", `Unsupported mobile token type ${value.token_type}; DPoP is not enabled for this client.`);
-  return {
-    access_token: value.access_token,
-    expires_in: value.expires_in,
-    id_token: value.id_token,
-    refresh_token: value.refresh_token,
-    scope: typeof value.scope === "string" ? value.scope : undefined,
-    token_type: value.token_type
-  };
-};
-var responseBody = async (response) => {
-  const text = await response.text();
-  try {
-    return JSON.parse(text);
-  } catch {
-    return text;
-  }
-};
-var requireEndpoint = (value, name, issuer) => {
-  if (typeof value !== "string")
-    throw new MobileAuthError("discovery", `OIDC discovery is missing ${name}.`);
-  const endpoint = new URL(value);
-  if (endpoint.protocol !== "https:" && new URL(issuer).protocol === "https:")
-    throw new MobileAuthError("discovery", `OIDC discovery ${name} must use HTTPS.`);
-  return endpoint.href;
+var requireEndpoint = (value, name, issuer) => {
+  if (typeof value !== "string")
+    throw new MobileAuthError("discovery", `OIDC discovery is missing ${name}.`);
+  const endpoint = new URL(value);
+  if (endpoint.protocol !== "https:" && new URL(issuer).protocol === "https:")
+    throw new MobileAuthError("discovery", `OIDC discovery ${name} must use HTTPS.`);
+  return endpoint.href;
 };
 var parseDiscovery = (value, issuer) => {
   if (!isRecord(value) || value.issuer !== issuer)
@@ -716,146 +422,441 @@ var createMobileAuthClient = (config) => {
         reject(new MobileAuthError("aborted", "Authorization was cancelled."));
       }, { once: true });
     });
-    try {
-      await config.links.openExternal(url.href);
-    } catch (error) {
-      pendingSignIns.delete(pending.state);
-      await config.storage.remove(PENDING_KEY);
-      throw error;
+    try {
+      await config.links.openExternal(url.href);
+    } catch (error) {
+      pendingSignIns.delete(pending.state);
+      await config.storage.remove(PENDING_KEY);
+      throw error;
+    }
+    return result;
+  };
+  const authenticatedFetch = async (input, init) => {
+    const original = new Request(input, init);
+    if (!allowedOrigins.has(new URL(original.url).origin))
+      throw new MobileAuthError("origin", "Mobile auth refused to send a credential to an unregistered origin.");
+    const send = async (forceRefresh) => {
+      if (forceRefresh)
+        access = undefined;
+      const token = await refreshAccessToken();
+      const request = original.clone();
+      const headers = new Headers(request.headers);
+      headers.set("authorization", `Bearer ${token}`);
+      return fetchImpl(new Request(request, { credentials: "omit", headers }));
+    };
+    const response = await send(false);
+    return response.status === 401 ? send(true) : response;
+  };
+  const optionalAuthenticatedFetch = async (input, init) => {
+    const request = new Request(input, init);
+    if (!allowedOrigins.has(new URL(request.url).origin))
+      throw new MobileAuthError("origin", "Mobile auth refused to send a request outside an allowed origin.");
+    const refreshToken = await config.storage.get(REFRESH_KEY);
+    if (access || refreshToken)
+      return authenticatedFetch(request);
+    return fetchImpl(new Request(request, { credentials: "omit" }));
+  };
+  const status = async () => {
+    try {
+      const metadata = await discovery();
+      const response = await authenticatedFetch(metadata.userinfo_endpoint);
+      if (response.status === 401)
+        return null;
+      if (!response.ok)
+        throw new MobileAuthError("network", `User info failed with HTTP ${response.status}.`);
+      const user = await response.json();
+      if (!isRecord(user) || typeof user.sub !== "string")
+        throw new MobileAuthError("token", "The user-info response is malformed.");
+      return { ...user, sub: user.sub };
+    } catch (error) {
+      if (error instanceof MobileAuthError && (error.code === "oauth" || error.code === "token"))
+        return null;
+      throw error;
+    }
+  };
+  const socketTicket = async (audience = resource) => {
+    const metadata = await discovery();
+    if (!metadata.socket_ticket_endpoint)
+      throw new MobileAuthError("discovery", "The authorization server does not advertise WebSocket tickets.");
+    const response = await authenticatedFetch(metadata.socket_ticket_endpoint, {
+      body: JSON.stringify({ audience }),
+      headers: { "content-type": "application/json" },
+      method: "POST"
+    });
+    const body = await responseBody(response);
+    if (!response.ok || !isRecord(body) || typeof body.ticket !== "string")
+      throw new MobileAuthError(response.ok ? "token" : "oauth", `WebSocket ticket request failed with HTTP ${response.status}.`);
+    return body.ticket;
+  };
+  const revokeRefreshToken = async (refreshToken) => {
+    const metadata = await discovery();
+    if (metadata.revocation_endpoint)
+      await fetchImpl(metadata.revocation_endpoint, {
+        body: new URLSearchParams({
+          client_id: config.clientId,
+          token: refreshToken,
+          token_type_hint: "refresh_token"
+        }),
+        credentials: "omit",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        method: "POST"
+      });
+  };
+  const signOut = async () => {
+    const refreshToken = await config.storage.get(REFRESH_KEY);
+    try {
+      if (refreshToken)
+        await revokeRefreshToken(refreshToken);
+    } finally {
+      access = undefined;
+      await Promise.all([
+        config.storage.remove(PENDING_KEY),
+        config.storage.remove(REFRESH_KEY)
+      ]);
+    }
+  };
+  const stop = async () => {
+    await Promise.all([stopLinks?.(), stopResume?.()]);
+    stopLinks = undefined;
+    stopResume = undefined;
+    startPromise = undefined;
+  };
+  return {
+    fetch: authenticatedFetch,
+    fetchOptional: optionalAuthenticatedFetch,
+    handleCallback,
+    refresh: refreshAccessToken,
+    signIn,
+    signOut,
+    socketTicket,
+    start,
+    status,
+    stop
+  };
+};
+var createMobileAuthTransport = (client) => ({
+  fetch: client.fetch,
+  signInEmail: async ({ email }) => {
+    await client.signIn({
+      authorizationParameters: { login_hint: email }
+    });
+    return { status: "authenticated" };
+  },
+  signOut: async () => {
+    await client.signOut();
+    return null;
+  },
+  signUpEmail: async ({ email }) => {
+    await client.signIn({
+      authorizationParameters: {
+        login_hint: email,
+        screen_hint: "signup"
+      }
+    });
+    return { status: "authenticated" };
+  },
+  status: async () => {
+    const user = await client.status();
+    return { user };
+  }
+});
+
+// src/client/createAuthClient.ts
+var DEFAULT_ROUTES = {
+  emailVerify: "/auth/verify-email",
+  emailVerifyRequest: "/auth/verify-email/request",
+  login: "/auth/login",
+  magicLinkRequest: "/auth/passwordless/magic-link",
+  magicLinkVerify: "/auth/passwordless/magic-link/verify",
+  mfaChallenge: "/auth/mfa/totp/challenge",
+  mfaManagement: "/auth/mfa",
+  mfaSetup: "/auth/mfa/totp/setup",
+  mfaVerifySetup: "/auth/mfa/totp/verify",
+  passkeyAuthenticateOptions: "/auth/webauthn/authenticate/options",
+  passkeyAuthenticateVerify: "/auth/webauthn/authenticate/verify",
+  passkeyList: "/auth/webauthn/credentials",
+  passkeyRegisterOptions: "/auth/webauthn/register/options",
+  passkeyRegisterVerify: "/auth/webauthn/register/verify",
+  passkeyRemove: "/auth/webauthn/credentials",
+  passwordReset: "/auth/reset-password",
+  passwordResetRequest: "/auth/reset-password/request",
+  register: "/auth/register",
+  sessions: "/auth/sessions",
+  signout: "/oauth2/signout",
+  status: "/oauth2/status"
+};
+var succeed = (data) => ({
+  data,
+  error: null
+});
+var fail = (error) => ({
+  data: null,
+  error
+});
+var errorFor = (response, body) => ({
+  body,
+  message: typeof body === "string" ? body : readMessage(body) ?? response.statusText,
+  status: response.status
+});
+var createAuthClient = ({
+  baseUrl = "",
+  credentials = "same-origin",
+  fetch: fetchImpl = fetch,
+  routes,
+  transport
+} = {}) => {
+  const resolvedFetch = transport?.fetch ?? fetchImpl;
+  const signInEmail = transport?.signInEmail;
+  const signOut = transport?.signOut;
+  const signUpEmail = transport?.signUpEmail;
+  const transportStatus = transport?.status;
+  const resolvedRoutes = {
+    ...DEFAULT_ROUTES,
+    ...routes
+  };
+  const request = async (path, init) => {
+    try {
+      const response = await resolvedFetch(`${baseUrl}${path}`, {
+        credentials,
+        ...init
+      });
+      const text = await response.text();
+      if (!response.ok)
+        return fail(errorFor(response, safeJson(text)));
+      const data = JSON.parse(text === "" ? "null" : text);
+      return succeed(data);
+    } catch (caught) {
+      const message = caught instanceof Error ? caught.message : "network";
+      return fail({ body: null, message, status: 0 });
+    }
+  };
+  const runTransport = async (operation) => {
+    try {
+      return succeed(await operation());
+    } catch (caught) {
+      const message = caught instanceof Error ? caught.message : "authentication";
+      return fail({ body: null, message, status: 0 });
+    }
+  };
+  const post = (path, body, method = "POST") => request(path, {
+    body: body === undefined ? undefined : JSON.stringify(body),
+    headers: body === undefined ? undefined : { "content-type": "application/json" },
+    method
+  });
+  const get = (path) => request(path, { method: "GET" });
+  const del = (path) => request(path, { method: "DELETE" });
+  return {
+    emailVerification: {
+      request: (body) => post(resolvedRoutes.emailVerifyRequest, body),
+      verify: (body) => post(resolvedRoutes.emailVerify, body)
+    },
+    mfa: {
+      challenge: (body) => post(resolvedRoutes.mfaChallenge, body),
+      disable: () => del(resolvedRoutes.mfaManagement),
+      setup: () => post(resolvedRoutes.mfaSetup),
+      status: () => get(resolvedRoutes.mfaManagement),
+      verifySetup: (body) => post(resolvedRoutes.mfaVerifySetup, body)
+    },
+    passkeys: {
+      authenticateOptions: () => post(resolvedRoutes.passkeyAuthenticateOptions),
+      authenticateVerify: (response) => post(resolvedRoutes.passkeyAuthenticateVerify, response),
+      list: () => get(resolvedRoutes.passkeyList),
+      registerOptions: () => post(resolvedRoutes.passkeyRegisterOptions),
+      registerVerify: (response) => post(resolvedRoutes.passkeyRegisterVerify, response),
+      remove: (credentialId) => del(`${resolvedRoutes.passkeyRemove}/${encodeURIComponent(credentialId)}`)
+    },
+    passwordless: {
+      requestMagicLink: (body) => post(resolvedRoutes.magicLinkRequest, body),
+      verifyMagicLink: (body) => post(resolvedRoutes.magicLinkVerify, body)
+    },
+    passwordReset: {
+      confirm: (body) => post(resolvedRoutes.passwordReset, body),
+      request: (body) => post(resolvedRoutes.passwordResetRequest, body)
+    },
+    sessions: {
+      list: () => get(resolvedRoutes.sessions),
+      revoke: (sessionId) => del(`${resolvedRoutes.sessions}/${encodeURIComponent(sessionId)}`)
+    },
+    signIn: {
+      email: (body) => signInEmail ? runTransport(() => signInEmail(body)) : post(resolvedRoutes.login, body)
+    },
+    signUp: {
+      email: (body) => signUpEmail ? runTransport(() => signUpEmail(body)) : post(resolvedRoutes.register, body)
+    },
+    signOut: () => signOut ? runTransport(() => signOut()) : del(resolvedRoutes.signout),
+    status: () => transportStatus ? runTransport(() => transportStatus()) : get(resolvedRoutes.status)
+  };
+};
+var safeJson = (text) => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+};
+var readMessage = (body) => {
+  if (typeof body !== "object" || body === null)
+    return;
+  const message = Reflect.get(body, "message");
+  return typeof message === "string" ? message : undefined;
+};
+// src/client/sessionExpiry.ts
+var DEFAULT_CHECK_INTERVAL_MS = 30000;
+var DEFAULT_REASON = "session_expired";
+var DEFAULT_REASON_PARAM = "reason";
+var DEFAULT_RETURN_URL_PARAM = "returnUrl";
+var DEFAULT_SIGN_IN_PATH = "/signin";
+var DEFAULT_STATUS_PATH = "/oauth2/status";
+var HTTP_UNAUTHORIZED = 401;
+var activeGuard = null;
+var requestUrl = (input, origin) => {
+  const raw = input instanceof Request ? input.url : String(input);
+  try {
+    return new URL(raw, origin);
+  } catch {
+    return null;
+  }
+};
+var buildSessionExpiredSignInUrl = ({
+  currentHref,
+  reason = DEFAULT_REASON,
+  reasonParam = DEFAULT_REASON_PARAM,
+  returnUrlParam = DEFAULT_RETURN_URL_PARAM,
+  signInPath = DEFAULT_SIGN_IN_PATH
+}) => {
+  const current = new URL(currentHref);
+  const returnTo = `${current.pathname}${current.search}${current.hash}`;
+  const destination = new URL(signInPath, current.origin);
+  destination.searchParams.set(reasonParam, reason);
+  destination.searchParams.set(returnUrlParam, returnTo);
+  return destination.origin === current.origin ? `${destination.pathname}${destination.search}${destination.hash}` : destination.toString();
+};
+var installSessionExpiryGuard = (config = {}) => {
+  if (typeof window === "undefined" || typeof document === "undefined") {
+    return { check: async () => false, dispose: () => {
+      return;
+    } };
+  }
+  if (activeGuard)
+    return activeGuard;
+  const {
+    checkIntervalMs = DEFAULT_CHECK_INTERVAL_MS,
+    isProtectedRequest,
+    onExpired,
+    protectedPaths = [],
+    reason = DEFAULT_REASON,
+    reasonParam = DEFAULT_REASON_PARAM,
+    returnUrlParam = DEFAULT_RETURN_URL_PARAM,
+    signInPath = DEFAULT_SIGN_IN_PATH,
+    statusPath = DEFAULT_STATUS_PATH
+  } = config;
+  const nativeFetch = window.fetch.bind(window);
+  const originalFetch = window.fetch;
+  let checking = false;
+  let disposed = false;
+  let expired = false;
+  let lastCheckedAt = Date.now();
+  const expire = () => {
+    if (expired || disposed)
+      return;
+    expired = true;
+    const currentHref = window.location.href;
+    const signInUrl = buildSessionExpiredSignInUrl({
+      currentHref,
+      reason,
+      reasonParam,
+      returnUrlParam,
+      signInPath
+    });
+    const current = new URL(currentHref);
+    const returnTo = `${current.pathname}${current.search}${current.hash}`;
+    if (onExpired) {
+      onExpired({ returnTo, signInUrl });
+      return;
     }
-    return result;
-  };
-  const authenticatedFetch = async (input, init) => {
-    const original = new Request(input, init);
-    if (!allowedOrigins.has(new URL(original.url).origin))
-      throw new MobileAuthError("origin", "Mobile auth refused to send a credential to an unregistered origin.");
-    const send = async (forceRefresh) => {
-      if (forceRefresh)
-        access = undefined;
-      const token = await refreshAccessToken();
-      const request = original.clone();
-      const headers = new Headers(request.headers);
-      headers.set("authorization", `Bearer ${token}`);
-      return fetchImpl(new Request(request, { credentials: "omit", headers }));
-    };
-    const response = await send(false);
-    return response.status === 401 ? send(true) : response;
+    window.location.assign(signInUrl);
   };
-  const optionalAuthenticatedFetch = async (input, init) => {
-    const request = new Request(input, init);
-    if (!allowedOrigins.has(new URL(request.url).origin))
-      throw new MobileAuthError("origin", "Mobile auth refused to send a request outside an allowed origin.");
-    const refreshToken = await config.storage.get(REFRESH_KEY);
-    if (access || refreshToken)
-      return authenticatedFetch(request);
-    return fetchImpl(new Request(request, { credentials: "omit" }));
+  const protectedRequest = (input) => {
+    const url = requestUrl(input, window.location.origin);
+    if (!url || url.origin !== window.location.origin)
+      return false;
+    if (new URL(statusPath, window.location.origin).pathname === url.pathname)
+      return false;
+    return isProtectedRequest?.(url) === true || protectedPaths.some((path) => url.pathname.startsWith(path));
   };
-  const status = async () => {
-    try {
-      const metadata = await discovery();
-      const response = await authenticatedFetch(metadata.userinfo_endpoint);
-      if (response.status === 401)
-        return null;
-      if (!response.ok)
-        throw new MobileAuthError("network", `User info failed with HTTP ${response.status}.`);
-      const user = await response.json();
-      if (!isRecord(user) || typeof user.sub !== "string")
-        throw new MobileAuthError("token", "The user-info response is malformed.");
-      return { ...user, sub: user.sub };
-    } catch (error) {
-      if (error instanceof MobileAuthError && (error.code === "oauth" || error.code === "token"))
-        return null;
-      throw error;
+  const guardedFetch = new Proxy(originalFetch, {
+    apply: async (target, thisArg, args) => {
+      const [input] = args;
+      const response = await Reflect.apply(target, thisArg, args);
+      if (response.status === HTTP_UNAUTHORIZED && protectedRequest(input)) {
+        expire();
+      }
+      return response;
     }
-  };
-  const socketTicket = async (audience = resource) => {
-    const metadata = await discovery();
-    if (!metadata.socket_ticket_endpoint)
-      throw new MobileAuthError("discovery", "The authorization server does not advertise WebSocket tickets.");
-    const response = await authenticatedFetch(metadata.socket_ticket_endpoint, {
-      body: JSON.stringify({ audience }),
-      headers: { "content-type": "application/json" },
-      method: "POST"
-    });
-    const body = await responseBody(response);
-    if (!response.ok || !isRecord(body) || typeof body.ticket !== "string")
-      throw new MobileAuthError(response.ok ? "token" : "oauth", `WebSocket ticket request failed with HTTP ${response.status}.`);
-    return body.ticket;
-  };
-  const revokeRefreshToken = async (refreshToken) => {
-    const metadata = await discovery();
-    if (metadata.revocation_endpoint)
-      await fetchImpl(metadata.revocation_endpoint, {
-        body: new URLSearchParams({
-          client_id: config.clientId,
-          token: refreshToken,
-          token_type_hint: "refresh_token"
-        }),
-        credentials: "omit",
-        headers: {
-          "content-type": "application/x-www-form-urlencoded"
-        },
-        method: "POST"
-      });
-  };
-  const signOut = async () => {
-    const refreshToken = await config.storage.get(REFRESH_KEY);
+  });
+  window.fetch = guardedFetch;
+  const check = async () => {
+    if (checking || expired || disposed)
+      return false;
+    checking = true;
+    lastCheckedAt = Date.now();
     try {
-      if (refreshToken)
-        await revokeRefreshToken(refreshToken);
+      const response = await nativeFetch(statusPath, {
+        cache: "no-store",
+        credentials: "include",
+        headers: { accept: "application/json" }
+      });
+      if (!response.ok)
+        return false;
+      const payload = await response.json();
+      const sessionExpired = typeof payload === "object" && payload !== null && Reflect.get(payload, "user") === null;
+      if (!sessionExpired)
+        return false;
+      expire();
+      return true;
+    } catch {
+      return false;
     } finally {
-      access = undefined;
-      await Promise.all([
-        config.storage.remove(PENDING_KEY),
-        config.storage.remove(REFRESH_KEY)
-      ]);
+      checking = false;
     }
   };
-  const stop = async () => {
-    await Promise.all([stopLinks?.(), stopResume?.()]);
-    stopLinks = undefined;
-    stopResume = undefined;
-    startPromise = undefined;
+  const checkIfDue = () => {
+    if (document.visibilityState !== "visible" || Date.now() - lastCheckedAt < checkIntervalMs)
+      return;
+    check();
   };
-  return {
-    fetch: authenticatedFetch,
-    fetchOptional: optionalAuthenticatedFetch,
-    handleCallback,
-    refresh: refreshAccessToken,
-    signIn,
-    signOut,
-    socketTicket,
-    start,
-    status,
-    stop
+  const checkPersistedSession = (event) => {
+    if (!event.persisted)
+      return;
+    check();
+  };
+  const dispose = () => {
+    if (disposed)
+      return;
+    disposed = true;
+    document.removeEventListener("visibilitychange", checkIfDue);
+    window.removeEventListener("focus", checkIfDue);
+    window.removeEventListener("pageshow", checkPersistedSession);
+    if (window.fetch === guardedFetch)
+      window.fetch = originalFetch;
+    activeGuard = null;
   };
+  document.addEventListener("visibilitychange", checkIfDue);
+  window.addEventListener("focus", checkIfDue);
+  window.addEventListener("pageshow", checkPersistedSession);
+  activeGuard = { check, dispose };
+  return activeGuard;
+};
+var isProtectedSessionRequest = ({
+  input,
+  origin,
+  protectedPaths
+}) => {
+  const url = requestUrl(input, origin);
+  return url?.origin === origin && protectedPaths.some((path) => url.pathname.startsWith(path));
 };
-var createMobileAuthTransport = (client) => ({
-  fetch: client.fetch,
-  signInEmail: async ({ email }) => {
-    await client.signIn({
-      authorizationParameters: { login_hint: email }
-    });
-    return { status: "authenticated" };
-  },
-  signOut: async () => {
-    await client.signOut();
-    return null;
-  },
-  signUpEmail: async ({ email }) => {
-    await client.signIn({
-      authorizationParameters: {
-        login_hint: email,
-        screen_hint: "signup"
-      }
-    });
-    return { status: "authenticated" };
-  },
-  status: async () => {
-    const user = await client.status();
-    return { user };
-  }
-});
 // src/redirect.ts
 var isSafeLocalPath = (value) => /^\/(?![/\\])/.test(value);
 var toSafeLocalPath = (value, fallback = "/") => value !== undefined && isSafeLocalPath(value) ? value : fallback;
@@ -921,5 +922,5 @@ export {
   MobileAuthError
 };
 
-//# debugId=1DC9AFB1303049A564756E2164756E21
+//# debugId=E661DCC8D887DF4364756E2164756E21
 //# sourceMappingURL=index.js.map