@absolutejs/auth 0.69.0 → 0.69.2

package/dist/client/index.js

@@ -46,396 +46,130 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// src/client/createAuthClient.ts
-var DEFAULT_ROUTES = {
-  emailVerify: "/auth/verify-email",
-  emailVerifyRequest: "/auth/verify-email/request",
-  login: "/auth/login",
-  magicLinkRequest: "/auth/passwordless/magic-link",
-  magicLinkVerify: "/auth/passwordless/magic-link/verify",
-  mfaChallenge: "/auth/mfa/totp/challenge",
-  mfaManagement: "/auth/mfa",
-  mfaSetup: "/auth/mfa/totp/setup",
-  mfaVerifySetup: "/auth/mfa/totp/verify",
-  passkeyAuthenticateOptions: "/auth/webauthn/authenticate/options",
-  passkeyAuthenticateVerify: "/auth/webauthn/authenticate/verify",
-  passkeyList: "/auth/webauthn/credentials",
-  passkeyRegisterOptions: "/auth/webauthn/register/options",
-  passkeyRegisterVerify: "/auth/webauthn/register/verify",
-  passkeyRemove: "/auth/webauthn/credentials",
-  passwordReset: "/auth/reset-password",
-  passwordResetRequest: "/auth/reset-password/request",
-  register: "/auth/register",
-  sessions: "/auth/sessions",
-  signout: "/oauth2/signout",
-  status: "/oauth2/status"
-};
-var succeed = (data) => ({
-  data,
-  error: null
-});
-var fail = (error) => ({
-  data: null,
-  error
-});
-var errorFor = (response, body) => ({
-  body,
-  message: typeof body === "string" ? body : readMessage(body) ?? response.statusText,
-  status: response.status
-});
-var createAuthClient = ({
-  baseUrl = "",
-  credentials = "same-origin",
-  fetch: fetchImpl = fetch,
-  routes,
-  transport
-} = {}) => {
-  const resolvedFetch = transport?.fetch ?? fetchImpl;
-  const signInEmail = transport?.signInEmail;
-  const signOut = transport?.signOut;
-  const signUpEmail = transport?.signUpEmail;
-  const transportStatus = transport?.status;
-  const resolvedRoutes = {
-    ...DEFAULT_ROUTES,
-    ...routes
-  };
-  const request = async (path, init) => {
-    try {
-      const response = await resolvedFetch(`${baseUrl}${path}`, {
-        credentials,
-        ...init
-      });
-      const text = await response.text();
-      if (!response.ok)
-        return fail(errorFor(response, safeJson(text)));
-      const data = JSON.parse(text === "" ? "null" : text);
-      return succeed(data);
-    } catch (caught) {
-      const message = caught instanceof Error ? caught.message : "network";
-      return fail({ body: null, message, status: 0 });
-    }
-  };
-  const runTransport = async (operation) => {
-    try {
-      return succeed(await operation());
-    } catch (caught) {
-      const message = caught instanceof Error ? caught.message : "authentication";
-      return fail({ body: null, message, status: 0 });
-    }
-  };
-  const post = (path, body, method = "POST") => request(path, {
-    body: body === undefined ? undefined : JSON.stringify(body),
-    headers: body === undefined ? undefined : { "content-type": "application/json" },
-    method
+// src/client/runtimeTransport.ts
+var AUTH_TRANSPORT_REGISTRY = Symbol.for("@absolutejs/auth/client-runtime-transport");
+var host = globalThis;
+var isRegistry = (value) => typeof value === "object" && value !== null && Array.isArray(Reflect.get(value, "installations"));
+var registry = (() => {
+  const existing = host[AUTH_TRANSPORT_REGISTRY];
+  if (isRegistry(existing))
+    return existing;
+  const created = { installations: [] };
+  Object.defineProperty(host, AUTH_TRANSPORT_REGISTRY, {
+    configurable: false,
+    enumerable: false,
+    value: created,
+    writable: false
   });
-  const get = (path) => request(path, { method: "GET" });
-  const del = (path) => request(path, { method: "DELETE" });
-  return {
-    emailVerification: {
-      request: (body) => post(resolvedRoutes.emailVerifyRequest, body),
-      verify: (body) => post(resolvedRoutes.emailVerify, body)
-    },
-    mfa: {
-      challenge: (body) => post(resolvedRoutes.mfaChallenge, body),
-      disable: () => del(resolvedRoutes.mfaManagement),
-      setup: () => post(resolvedRoutes.mfaSetup),
-      status: () => get(resolvedRoutes.mfaManagement),
-      verifySetup: (body) => post(resolvedRoutes.mfaVerifySetup, body)
-    },
-    passkeys: {
-      authenticateOptions: () => post(resolvedRoutes.passkeyAuthenticateOptions),
-      authenticateVerify: (response) => post(resolvedRoutes.passkeyAuthenticateVerify, response),
-      list: () => get(resolvedRoutes.passkeyList),
-      registerOptions: () => post(resolvedRoutes.passkeyRegisterOptions),
-      registerVerify: (response) => post(resolvedRoutes.passkeyRegisterVerify, response),
-      remove: (credentialId) => del(`${resolvedRoutes.passkeyRemove}/${encodeURIComponent(credentialId)}`)
-    },
-    passwordless: {
-      requestMagicLink: (body) => post(resolvedRoutes.magicLinkRequest, body),
-      verifyMagicLink: (body) => post(resolvedRoutes.magicLinkVerify, body)
-    },
-    passwordReset: {
-      confirm: (body) => post(resolvedRoutes.passwordReset, body),
-      request: (body) => post(resolvedRoutes.passwordResetRequest, body)
-    },
-    sessions: {
-      list: () => get(resolvedRoutes.sessions),
-      revoke: (sessionId) => del(`${resolvedRoutes.sessions}/${encodeURIComponent(sessionId)}`)
-    },
-    signIn: {
-      email: (body) => signInEmail ? runTransport(() => signInEmail(body)) : post(resolvedRoutes.login, body)
-    },
-    signUp: {
-      email: (body) => signUpEmail ? runTransport(() => signUpEmail(body)) : post(resolvedRoutes.register, body)
-    },
-    signOut: () => signOut ? runTransport(() => signOut()) : del(resolvedRoutes.signout),
-    status: () => transportStatus ? runTransport(() => transportStatus()) : get(resolvedRoutes.status)
+  return created;
+})();
+var getAuthClientRuntimeTransport = () => registry.installations.at(-1)?.transport;
+var installAuthClientRuntimeTransport = (transport) => {
+  const installation = { transport };
+  registry.installations.push(installation);
+  return () => {
+    const index = registry.installations.indexOf(installation);
+    if (index >= 0)
+      registry.installations.splice(index, 1);
   };
 };
-var safeJson = (text) => {
+
+// src/client/mobile.ts
+class MobileAuthError extends Error {
+  code;
+  cause;
+  constructor(code, message, options) {
+    super(message);
+    this.name = "MobileAuthError";
+    this.code = code;
+    this.cause = options?.cause;
+  }
+}
+var PENDING_KEY = "oidc.pending";
+var REFRESH_KEY = "oidc.refresh";
+var DEFAULT_CLOCK_SKEW_MS = 30000;
+var PENDING_TTL_MS = 10 * 60000;
+var RANDOM_BYTES = 32;
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var base64Url = (value) => {
+  let binary = "";
+  for (const byte of value)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+};
+var decodeBase64Url = (value) => {
+  const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+};
+var randomValue = () => {
+  const value = new Uint8Array(RANDOM_BYTES);
+  crypto.getRandomValues(value);
+  return base64Url(value);
+};
+var pkceChallenge = async (verifier) => base64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+var normalizeIssuer = (value) => {
+  const issuer = new URL(value);
+  const loopback = issuer.protocol === "http:" && ["127.0.0.1", "[::1]", "localhost"].includes(issuer.hostname);
+  if (issuer.protocol !== "https:" && !loopback)
+    throw new TypeError("Mobile auth issuer must use HTTPS.");
+  if (issuer.username || issuer.password || issuer.search || issuer.hash)
+    throw new TypeError("Mobile auth issuer cannot contain credentials, query, or fragment.");
+  issuer.pathname = issuer.pathname.replace(/\/$/u, "");
+  return issuer.href.replace(/\/$/u, "");
+};
+var exactRedirect = (actualValue, expectedValue) => {
+  const actual = new URL(actualValue);
+  const expected = new URL(expectedValue);
+  return actual.protocol === expected.protocol && actual.host === expected.host && actual.pathname === expected.pathname && actual.username === "" && actual.password === "";
+};
+var parsePending = (value) => {
+  if (value === null)
+    return;
   try {
-    return JSON.parse(text);
+    const parsed = JSON.parse(value);
+    if (!isRecord(parsed) || typeof parsed.createdAt !== "number" || typeof parsed.nonce !== "string" || typeof parsed.state !== "string" || typeof parsed.verifier !== "string")
+      return;
+    return {
+      createdAt: parsed.createdAt,
+      nonce: parsed.nonce,
+      state: parsed.state,
+      verifier: parsed.verifier
+    };
   } catch {
-    return text;
+    return;
   }
 };
-var readMessage = (body) => {
-  if (typeof body !== "object" || body === null)
-    return;
-  const message = Reflect.get(body, "message");
-  return typeof message === "string" ? message : undefined;
+var parseTokenResponse = (value) => {
+  if (!isRecord(value) || typeof value.access_token !== "string" || typeof value.expires_in !== "number" || !Number.isFinite(value.expires_in) || value.expires_in <= 0 || typeof value.id_token !== "string" || typeof value.refresh_token !== "string" || typeof value.token_type !== "string")
+    throw new MobileAuthError("token", "The token response is malformed.");
+  if (value.token_type.toLowerCase() !== "bearer")
+    throw new MobileAuthError("token", `Unsupported mobile token type ${value.token_type}; DPoP is not enabled for this client.`);
+  return {
+    access_token: value.access_token,
+    expires_in: value.expires_in,
+    id_token: value.id_token,
+    refresh_token: value.refresh_token,
+    scope: typeof value.scope === "string" ? value.scope : undefined,
+    token_type: value.token_type
+  };
 };
-// src/client/sessionExpiry.ts
-var DEFAULT_CHECK_INTERVAL_MS = 30000;
-var DEFAULT_REASON = "session_expired";
-var DEFAULT_REASON_PARAM = "reason";
-var DEFAULT_RETURN_URL_PARAM = "returnUrl";
-var DEFAULT_SIGN_IN_PATH = "/signin";
-var DEFAULT_STATUS_PATH = "/oauth2/status";
-var HTTP_UNAUTHORIZED = 401;
-var activeGuard = null;
-var requestUrl = (input, origin) => {
-  const raw = input instanceof Request ? input.url : String(input);
+var responseBody = async (response) => {
+  const text = await response.text();
   try {
-    return new URL(raw, origin);
+    return JSON.parse(text);
   } catch {
-    return null;
+    return text;
   }
 };
-var buildSessionExpiredSignInUrl = ({
-  currentHref,
-  reason = DEFAULT_REASON,
-  reasonParam = DEFAULT_REASON_PARAM,
-  returnUrlParam = DEFAULT_RETURN_URL_PARAM,
-  signInPath = DEFAULT_SIGN_IN_PATH
-}) => {
-  const current = new URL(currentHref);
-  const returnTo = `${current.pathname}${current.search}${current.hash}`;
-  const destination = new URL(signInPath, current.origin);
-  destination.searchParams.set(reasonParam, reason);
-  destination.searchParams.set(returnUrlParam, returnTo);
-  return destination.origin === current.origin ? `${destination.pathname}${destination.search}${destination.hash}` : destination.toString();
-};
-var installSessionExpiryGuard = (config = {}) => {
-  if (typeof window === "undefined" || typeof document === "undefined") {
-    return { check: async () => false, dispose: () => {
-      return;
-    } };
-  }
-  if (activeGuard)
-    return activeGuard;
-  const {
-    checkIntervalMs = DEFAULT_CHECK_INTERVAL_MS,
-    isProtectedRequest,
-    onExpired,
-    protectedPaths = [],
-    reason = DEFAULT_REASON,
-    reasonParam = DEFAULT_REASON_PARAM,
-    returnUrlParam = DEFAULT_RETURN_URL_PARAM,
-    signInPath = DEFAULT_SIGN_IN_PATH,
-    statusPath = DEFAULT_STATUS_PATH
-  } = config;
-  const nativeFetch = window.fetch.bind(window);
-  const originalFetch = window.fetch;
-  let checking = false;
-  let disposed = false;
-  let expired = false;
-  let lastCheckedAt = Date.now();
-  const expire = () => {
-    if (expired || disposed)
-      return;
-    expired = true;
-    const currentHref = window.location.href;
-    const signInUrl = buildSessionExpiredSignInUrl({
-      currentHref,
-      reason,
-      reasonParam,
-      returnUrlParam,
-      signInPath
-    });
-    const current = new URL(currentHref);
-    const returnTo = `${current.pathname}${current.search}${current.hash}`;
-    if (onExpired) {
-      onExpired({ returnTo, signInUrl });
-      return;
-    }
-    window.location.assign(signInUrl);
-  };
-  const protectedRequest = (input) => {
-    const url = requestUrl(input, window.location.origin);
-    if (!url || url.origin !== window.location.origin)
-      return false;
-    if (new URL(statusPath, window.location.origin).pathname === url.pathname)
-      return false;
-    return isProtectedRequest?.(url) === true || protectedPaths.some((path) => url.pathname.startsWith(path));
-  };
-  const guardedFetch = new Proxy(originalFetch, {
-    apply: async (target, thisArg, args) => {
-      const [input] = args;
-      const response = await Reflect.apply(target, thisArg, args);
-      if (response.status === HTTP_UNAUTHORIZED && protectedRequest(input)) {
-        expire();
-      }
-      return response;
-    }
-  });
-  window.fetch = guardedFetch;
-  const check = async () => {
-    if (checking || expired || disposed)
-      return false;
-    checking = true;
-    lastCheckedAt = Date.now();
-    try {
-      const response = await nativeFetch(statusPath, {
-        cache: "no-store",
-        credentials: "include",
-        headers: { accept: "application/json" }
-      });
-      if (!response.ok)
-        return false;
-      const payload = await response.json();
-      const sessionExpired = typeof payload === "object" && payload !== null && Reflect.get(payload, "user") === null;
-      if (!sessionExpired)
-        return false;
-      expire();
-      return true;
-    } catch {
-      return false;
-    } finally {
-      checking = false;
-    }
-  };
-  const checkIfDue = () => {
-    if (document.visibilityState !== "visible" || Date.now() - lastCheckedAt < checkIntervalMs)
-      return;
-    check();
-  };
-  const checkPersistedSession = (event) => {
-    if (!event.persisted)
-      return;
-    check();
-  };
-  const dispose = () => {
-    if (disposed)
-      return;
-    disposed = true;
-    document.removeEventListener("visibilitychange", checkIfDue);
-    window.removeEventListener("focus", checkIfDue);
-    window.removeEventListener("pageshow", checkPersistedSession);
-    if (window.fetch === guardedFetch)
-      window.fetch = originalFetch;
-    activeGuard = null;
-  };
-  document.addEventListener("visibilitychange", checkIfDue);
-  window.addEventListener("focus", checkIfDue);
-  window.addEventListener("pageshow", checkPersistedSession);
-  activeGuard = { check, dispose };
-  return activeGuard;
-};
-var isProtectedSessionRequest = ({
-  input,
-  origin,
-  protectedPaths
-}) => {
-  const url = requestUrl(input, origin);
-  return url?.origin === origin && protectedPaths.some((path) => url.pathname.startsWith(path));
-};
-// src/client/mobile.ts
-class MobileAuthError extends Error {
-  code;
-  cause;
-  constructor(code, message, options) {
-    super(message);
-    this.name = "MobileAuthError";
-    this.code = code;
-    this.cause = options?.cause;
-  }
-}
-var PENDING_KEY = "oidc.pending";
-var REFRESH_KEY = "oidc.refresh";
-var DEFAULT_CLOCK_SKEW_MS = 30000;
-var PENDING_TTL_MS = 10 * 60000;
-var RANDOM_BYTES = 32;
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var base64Url = (value) => {
-  let binary = "";
-  for (const byte of value)
-    binary += String.fromCharCode(byte);
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
-};
-var decodeBase64Url = (value) => {
-  const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
-  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
-  const binary = atob(padded);
-  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
-};
-var randomValue = () => {
-  const value = new Uint8Array(RANDOM_BYTES);
-  crypto.getRandomValues(value);
-  return base64Url(value);
-};
-var pkceChallenge = async (verifier) => base64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
-var normalizeIssuer = (value) => {
-  const issuer = new URL(value);
-  const loopback = issuer.protocol === "http:" && ["127.0.0.1", "[::1]", "localhost"].includes(issuer.hostname);
-  if (issuer.protocol !== "https:" && !loopback)
-    throw new TypeError("Mobile auth issuer must use HTTPS.");
-  if (issuer.username || issuer.password || issuer.search || issuer.hash)
-    throw new TypeError("Mobile auth issuer cannot contain credentials, query, or fragment.");
-  issuer.pathname = issuer.pathname.replace(/\/$/u, "");
-  return issuer.href.replace(/\/$/u, "");
-};
-var exactRedirect = (actualValue, expectedValue) => {
-  const actual = new URL(actualValue);
-  const expected = new URL(expectedValue);
-  return actual.protocol === expected.protocol && actual.host === expected.host && actual.pathname === expected.pathname && actual.username === "" && actual.password === "";
-};
-var parsePending = (value) => {
-  if (value === null)
-    return;
-  try {
-    const parsed = JSON.parse(value);
-    if (!isRecord(parsed) || typeof parsed.createdAt !== "number" || typeof parsed.nonce !== "string" || typeof parsed.state !== "string" || typeof parsed.verifier !== "string")
-      return;
-    return {
-      createdAt: parsed.createdAt,
-      nonce: parsed.nonce,
-      state: parsed.state,
-      verifier: parsed.verifier
-    };
-  } catch {
-    return;
-  }
-};
-var parseTokenResponse = (value) => {
-  if (!isRecord(value) || typeof value.access_token !== "string" || typeof value.expires_in !== "number" || !Number.isFinite(value.expires_in) || value.expires_in <= 0 || typeof value.id_token !== "string" || typeof value.refresh_token !== "string" || typeof value.token_type !== "string")
-    throw new MobileAuthError("token", "The token response is malformed.");
-  if (value.token_type.toLowerCase() !== "bearer")
-    throw new MobileAuthError("token", `Unsupported mobile token type ${value.token_type}; DPoP is not enabled for this client.`);
-  return {
-    access_token: value.access_token,
-    expires_in: value.expires_in,
-    id_token: value.id_token,
-    refresh_token: value.refresh_token,
-    scope: typeof value.scope === "string" ? value.scope : undefined,
-    token_type: value.token_type
-  };
-};
-var responseBody = async (response) => {
-  const text = await response.text();
-  try {
-    return JSON.parse(text);
-  } catch {
-    return text;
-  }
-};
-var requireEndpoint = (value, name, issuer) => {
-  if (typeof value !== "string")
-    throw new MobileAuthError("discovery", `OIDC discovery is missing ${name}.`);
-  const endpoint = new URL(value);
-  if (endpoint.protocol !== "https:" && new URL(issuer).protocol === "https:")
-    throw new MobileAuthError("discovery", `OIDC discovery ${name} must use HTTPS.`);
-  return endpoint.href;
+var requireEndpoint = (value, name, issuer) => {
+  if (typeof value !== "string")
+    throw new MobileAuthError("discovery", `OIDC discovery is missing ${name}.`);
+  const endpoint = new URL(value);
+  if (endpoint.protocol !== "https:" && new URL(issuer).protocol === "https:")
+    throw new MobileAuthError("discovery", `OIDC discovery ${name} must use HTTPS.`);
+  return endpoint.href;
 };
 var parseDiscovery = (value, issuer) => {
   if (!isRecord(value) || value.issuer !== issuer)
@@ -831,7 +565,7 @@ var createMobileAuthClient = (config) => {
   };
 };
 var createMobileAuthTransport = (client) => ({
-  fetch: client.fetch,
+  fetch: client.fetchOptional,
   signInEmail: async ({ email }) => {
     await client.signIn({
       authorizationParameters: { login_hint: email }
@@ -856,6 +590,302 @@ var createMobileAuthTransport = (client) => ({
     return { user };
   }
 });
+
+// src/client/createAuthClient.ts
+var DEFAULT_ROUTES = {
+  emailVerify: "/auth/verify-email",
+  emailVerifyRequest: "/auth/verify-email/request",
+  login: "/auth/login",
+  magicLinkRequest: "/auth/passwordless/magic-link",
+  magicLinkVerify: "/auth/passwordless/magic-link/verify",
+  mfaChallenge: "/auth/mfa/totp/challenge",
+  mfaManagement: "/auth/mfa",
+  mfaSetup: "/auth/mfa/totp/setup",
+  mfaVerifySetup: "/auth/mfa/totp/verify",
+  passkeyAuthenticateOptions: "/auth/webauthn/authenticate/options",
+  passkeyAuthenticateVerify: "/auth/webauthn/authenticate/verify",
+  passkeyList: "/auth/webauthn/credentials",
+  passkeyRegisterOptions: "/auth/webauthn/register/options",
+  passkeyRegisterVerify: "/auth/webauthn/register/verify",
+  passkeyRemove: "/auth/webauthn/credentials",
+  passwordReset: "/auth/reset-password",
+  passwordResetRequest: "/auth/reset-password/request",
+  register: "/auth/register",
+  sessions: "/auth/sessions",
+  signout: "/oauth2/signout",
+  status: "/oauth2/status"
+};
+var succeed = (data) => ({
+  data,
+  error: null
+});
+var fail = (error) => ({
+  data: null,
+  error
+});
+var errorFor = (response, body) => ({
+  body,
+  message: typeof body === "string" ? body : readMessage(body) ?? response.statusText,
+  status: response.status
+});
+var createAuthClient = ({
+  baseUrl = "",
+  credentials = "same-origin",
+  fetch: fetchImpl = fetch,
+  routes,
+  transport: configuredTransport
+} = {}) => {
+  const transport = configuredTransport ?? getAuthClientRuntimeTransport();
+  const resolvedFetch = transport?.fetch ?? fetchImpl;
+  const signInEmail = transport?.signInEmail;
+  const signOut = transport?.signOut;
+  const signUpEmail = transport?.signUpEmail;
+  const transportStatus = transport?.status;
+  const resolvedRoutes = {
+    ...DEFAULT_ROUTES,
+    ...routes
+  };
+  const request = async (path, init) => {
+    try {
+      const response = await resolvedFetch(`${baseUrl}${path}`, {
+        credentials,
+        ...init
+      });
+      const text = await response.text();
+      if (!response.ok)
+        return fail(errorFor(response, safeJson(text)));
+      const data = JSON.parse(text === "" ? "null" : text);
+      return succeed(data);
+    } catch (caught) {
+      const message = caught instanceof Error ? caught.message : "network";
+      return fail({ body: null, message, status: 0 });
+    }
+  };
+  const runTransport = async (operation) => {
+    try {
+      return succeed(await operation());
+    } catch (caught) {
+      const message = caught instanceof Error ? caught.message : "authentication";
+      return fail({ body: null, message, status: 0 });
+    }
+  };
+  const post = (path, body, method = "POST") => request(path, {
+    body: body === undefined ? undefined : JSON.stringify(body),
+    headers: body === undefined ? undefined : { "content-type": "application/json" },
+    method
+  });
+  const get = (path) => request(path, { method: "GET" });
+  const del = (path) => request(path, { method: "DELETE" });
+  return {
+    emailVerification: {
+      request: (body) => post(resolvedRoutes.emailVerifyRequest, body),
+      verify: (body) => post(resolvedRoutes.emailVerify, body)
+    },
+    mfa: {
+      challenge: (body) => post(resolvedRoutes.mfaChallenge, body),
+      disable: () => del(resolvedRoutes.mfaManagement),
+      setup: () => post(resolvedRoutes.mfaSetup),
+      status: () => get(resolvedRoutes.mfaManagement),
+      verifySetup: (body) => post(resolvedRoutes.mfaVerifySetup, body)
+    },
+    passkeys: {
+      authenticateOptions: () => post(resolvedRoutes.passkeyAuthenticateOptions),
+      authenticateVerify: (response) => post(resolvedRoutes.passkeyAuthenticateVerify, response),
+      list: () => get(resolvedRoutes.passkeyList),
+      registerOptions: () => post(resolvedRoutes.passkeyRegisterOptions),
+      registerVerify: (response) => post(resolvedRoutes.passkeyRegisterVerify, response),
+      remove: (credentialId) => del(`${resolvedRoutes.passkeyRemove}/${encodeURIComponent(credentialId)}`)
+    },
+    passwordless: {
+      requestMagicLink: (body) => post(resolvedRoutes.magicLinkRequest, body),
+      verifyMagicLink: (body) => post(resolvedRoutes.magicLinkVerify, body)
+    },
+    passwordReset: {
+      confirm: (body) => post(resolvedRoutes.passwordReset, body),
+      request: (body) => post(resolvedRoutes.passwordResetRequest, body)
+    },
+    sessions: {
+      list: () => get(resolvedRoutes.sessions),
+      revoke: (sessionId) => del(`${resolvedRoutes.sessions}/${encodeURIComponent(sessionId)}`)
+    },
+    signIn: {
+      email: (body) => signInEmail ? runTransport(() => signInEmail(body)) : post(resolvedRoutes.login, body)
+    },
+    signUp: {
+      email: (body) => signUpEmail ? runTransport(() => signUpEmail(body)) : post(resolvedRoutes.register, body)
+    },
+    signOut: () => signOut ? runTransport(() => signOut()) : del(resolvedRoutes.signout),
+    status: () => transportStatus ? runTransport(() => transportStatus()) : get(resolvedRoutes.status)
+  };
+};
+var safeJson = (text) => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+};
+var readMessage = (body) => {
+  if (typeof body !== "object" || body === null)
+    return;
+  const message = Reflect.get(body, "message");
+  return typeof message === "string" ? message : undefined;
+};
+// src/client/sessionExpiry.ts
+var DEFAULT_CHECK_INTERVAL_MS = 30000;
+var DEFAULT_REASON = "session_expired";
+var DEFAULT_REASON_PARAM = "reason";
+var DEFAULT_RETURN_URL_PARAM = "returnUrl";
+var DEFAULT_SIGN_IN_PATH = "/signin";
+var DEFAULT_STATUS_PATH = "/oauth2/status";
+var HTTP_UNAUTHORIZED = 401;
+var activeGuard = null;
+var requestUrl = (input, origin) => {
+  const raw = input instanceof Request ? input.url : String(input);
+  try {
+    return new URL(raw, origin);
+  } catch {
+    return null;
+  }
+};
+var buildSessionExpiredSignInUrl = ({
+  currentHref,
+  reason = DEFAULT_REASON,
+  reasonParam = DEFAULT_REASON_PARAM,
+  returnUrlParam = DEFAULT_RETURN_URL_PARAM,
+  signInPath = DEFAULT_SIGN_IN_PATH
+}) => {
+  const current = new URL(currentHref);
+  const returnTo = `${current.pathname}${current.search}${current.hash}`;
+  const destination = new URL(signInPath, current.origin);
+  destination.searchParams.set(reasonParam, reason);
+  destination.searchParams.set(returnUrlParam, returnTo);
+  return destination.origin === current.origin ? `${destination.pathname}${destination.search}${destination.hash}` : destination.toString();
+};
+var installSessionExpiryGuard = (config = {}) => {
+  if (typeof window === "undefined" || typeof document === "undefined") {
+    return { check: async () => false, dispose: () => {
+      return;
+    } };
+  }
+  if (activeGuard)
+    return activeGuard;
+  const {
+    checkIntervalMs = DEFAULT_CHECK_INTERVAL_MS,
+    isProtectedRequest,
+    onExpired,
+    protectedPaths = [],
+    reason = DEFAULT_REASON,
+    reasonParam = DEFAULT_REASON_PARAM,
+    returnUrlParam = DEFAULT_RETURN_URL_PARAM,
+    signInPath = DEFAULT_SIGN_IN_PATH,
+    statusPath = DEFAULT_STATUS_PATH
+  } = config;
+  const nativeFetch = window.fetch.bind(window);
+  const originalFetch = window.fetch;
+  let checking = false;
+  let disposed = false;
+  let expired = false;
+  let lastCheckedAt = Date.now();
+  const expire = () => {
+    if (expired || disposed)
+      return;
+    expired = true;
+    const currentHref = window.location.href;
+    const signInUrl = buildSessionExpiredSignInUrl({
+      currentHref,
+      reason,
+      reasonParam,
+      returnUrlParam,
+      signInPath
+    });
+    const current = new URL(currentHref);
+    const returnTo = `${current.pathname}${current.search}${current.hash}`;
+    if (onExpired) {
+      onExpired({ returnTo, signInUrl });
+      return;
+    }
+    window.location.assign(signInUrl);
+  };
+  const protectedRequest = (input) => {
+    const url = requestUrl(input, window.location.origin);
+    if (!url || url.origin !== window.location.origin)
+      return false;
+    if (new URL(statusPath, window.location.origin).pathname === url.pathname)
+      return false;
+    return isProtectedRequest?.(url) === true || protectedPaths.some((path) => url.pathname.startsWith(path));
+  };
+  const guardedFetch = new Proxy(originalFetch, {
+    apply: async (target, thisArg, args) => {
+      const [input] = args;
+      const response = await Reflect.apply(target, thisArg, args);
+      if (response.status === HTTP_UNAUTHORIZED && protectedRequest(input)) {
+        expire();
+      }
+      return response;
+    }
+  });
+  window.fetch = guardedFetch;
+  const check = async () => {
+    if (checking || expired || disposed)
+      return false;
+    checking = true;
+    lastCheckedAt = Date.now();
+    try {
+      const response = await nativeFetch(statusPath, {
+        cache: "no-store",
+        credentials: "include",
+        headers: { accept: "application/json" }
+      });
+      if (!response.ok)
+        return false;
+      const payload = await response.json();
+      const sessionExpired = typeof payload === "object" && payload !== null && Reflect.get(payload, "user") === null;
+      if (!sessionExpired)
+        return false;
+      expire();
+      return true;
+    } catch {
+      return false;
+    } finally {
+      checking = false;
+    }
+  };
+  const checkIfDue = () => {
+    if (document.visibilityState !== "visible" || Date.now() - lastCheckedAt < checkIntervalMs)
+      return;
+    check();
+  };
+  const checkPersistedSession = (event) => {
+    if (!event.persisted)
+      return;
+    check();
+  };
+  const dispose = () => {
+    if (disposed)
+      return;
+    disposed = true;
+    document.removeEventListener("visibilitychange", checkIfDue);
+    window.removeEventListener("focus", checkIfDue);
+    window.removeEventListener("pageshow", checkPersistedSession);
+    if (window.fetch === guardedFetch)
+      window.fetch = originalFetch;
+    activeGuard = null;
+  };
+  document.addEventListener("visibilitychange", checkIfDue);
+  window.addEventListener("focus", checkIfDue);
+  window.addEventListener("pageshow", checkPersistedSession);
+  activeGuard = { check, dispose };
+  return activeGuard;
+};
+var isProtectedSessionRequest = ({
+  input,
+  origin,
+  protectedPaths
+}) => {
+  const url = requestUrl(input, origin);
+  return url?.origin === origin && protectedPaths.some((path) => url.pathname.startsWith(path));
+};
 // src/redirect.ts
 var isSafeLocalPath = (value) => /^\/(?![/\\])/.test(value);
 var toSafeLocalPath = (value, fallback = "/") => value !== undefined && isSafeLocalPath(value) ? value : fallback;
@@ -914,6 +944,8 @@ export {
   isSafeLocalPath,
   isProtectedSessionRequest,
   installSessionExpiryGuard,
+  installAuthClientRuntimeTransport,
+  getAuthClientRuntimeTransport,
   createMobileAuthTransport,
   createMobileAuthClient,
   createAuthClient,
@@ -921,5 +953,5 @@ export {
   MobileAuthError
 };
 
-//# debugId=1DC9AFB1303049A564756E2164756E21
+//# debugId=45D0F7CD268E6FD764756E2164756E21
 //# sourceMappingURL=index.js.map