@auth0/auth0-server-js 1.3.0 → 1.5.0

package/dist/index.cjs

@@ -25,13 +25,20 @@ __export(index_exports, {
   BackchannelLogoutError: () => BackchannelLogoutError,
   CookieTransactionStore: () => CookieTransactionStore,
   InvalidConfigurationError: () => InvalidConfigurationError,
+  IssuerValidationError: () => IssuerValidationError,
+  MfaChallengeError: () => import_auth0_auth_js2.MfaChallengeError,
+  MfaEnrollmentError: () => import_auth0_auth_js2.MfaEnrollmentError,
+  MfaListAuthenticatorsError: () => import_auth0_auth_js2.MfaListAuthenticatorsError,
+  MfaVerifyError: () => import_auth0_auth_js2.MfaVerifyError,
   MissingRequiredArgumentError: () => MissingRequiredArgumentError,
   MissingSessionError: () => MissingSessionError,
   MissingTransactionError: () => MissingTransactionError,
   ServerClient: () => ServerClient,
+  ServerMfaClient: () => ServerMfaClient,
   StartLinkUserError: () => StartLinkUserError,
   StatefulStateStore: () => StatefulStateStore,
-  StatelessStateStore: () => StatelessStateStore
+  StatelessStateStore: () => StatelessStateStore,
+  isMfaRequiredError: () => import_auth0_auth_js2.isMfaRequiredError
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -78,6 +85,13 @@ var InvalidConfigurationError = class extends Error {
     this.name = "InvalidConfigurationError";
   }
 };
+var IssuerValidationError = class extends Error {
+  code = "issuer_validation_error";
+  constructor(message) {
+    super(message);
+    this.name = "IssuerValidationError";
+  }
+};
 
 // src/state/utils.ts
 var createUpdatedTokenSet = (audience, response) => ({
@@ -86,7 +100,18 @@ var createUpdatedTokenSet = (audience, response) => ({
   scope: response.scope,
   expiresAt: response.expiresAt
 });
-function updateStateData(audience, stateData, tokenEndpointResponse) {
+function updateStateData(audience, stateData, tokenEndpointResponse, context) {
+  if (stateData && tokenEndpointResponse.claims) {
+    const newSub = tokenEndpointResponse.claims.sub;
+    const newIss = tokenEndpointResponse.claims.iss;
+    const existingSub = stateData.user?.sub;
+    const existingIss = stateData.user?.iss;
+    const subMismatch = newSub !== void 0 && existingSub !== void 0 && newSub !== existingSub;
+    const issMismatch = newIss !== void 0 && existingIss !== void 0 && newIss !== existingIss;
+    if (subMismatch || issMismatch) {
+      stateData = void 0;
+    }
+  }
   if (stateData) {
     const isNewTokenSet = !stateData.tokenSets.some(
       (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope
@@ -98,7 +123,8 @@ function updateStateData(audience, stateData, tokenEndpointResponse) {
       ...stateData,
       idToken: tokenEndpointResponse.idToken ?? stateData.idToken,
       refreshToken: tokenEndpointResponse.refreshToken ?? stateData.refreshToken,
-      tokenSets
+      tokenSets,
+      domain: context?.domain ?? stateData.domain
     };
   } else {
     const user = tokenEndpointResponse.claims;
@@ -106,9 +132,8 @@ function updateStateData(audience, stateData, tokenEndpointResponse) {
       user,
       idToken: tokenEndpointResponse.idToken,
       refreshToken: tokenEndpointResponse.refreshToken,
-      tokenSets: [
-        createUpdatedTokenSet(audience, tokenEndpointResponse)
-      ],
+      tokenSets: [createUpdatedTokenSet(audience, tokenEndpointResponse)],
+      domain: context?.domain,
       internal: {
         sid: user?.sid,
         createdAt: Math.floor(Date.now() / 1e3)
@@ -153,6 +178,9 @@ var compareScopes = (scopes, requiredScopes) => {
   return requiredScopesArray.every((scope) => scopesSet.has(scope));
 };
 
+// src/server-client.ts
+var import_jose = require("jose");
+
 // src/telemetry.ts
 function getTelemetryConfig(config) {
   if (config?.enabled === false) {
@@ -161,13 +189,106 @@ function getTelemetryConfig(config) {
   return {
     enabled: true,
     name: config?.name ?? "@auth0/auth0-server-js",
-    version: config?.version ?? "1.3.0"
+    version: config?.version ?? "1.5.0"
   };
 }
 
+// src/mfa/server-mfa-client.ts
+var ServerMfaClient = class {
+  #options;
+  /**
+   * @internal
+   */
+  constructor(options) {
+    this.#options = options;
+  }
+  /**
+   * Lists all MFA authenticators enrolled by the user.
+   *
+   * @param options - Options for listing authenticators
+   * @returns Promise resolving to an array of enrolled authenticators
+   * @throws {MfaListAuthenticatorsError} When the request fails
+   */
+  async listAuthenticators(options) {
+    return this.#options.authClient.mfa.listAuthenticators(options);
+  }
+  /**
+   * Enrolls a new MFA authenticator for the user.
+   *
+   * @param options - Enrollment options
+   * @returns Promise resolving to enrollment response with authenticator details
+   * @throws {MfaEnrollmentError} When enrollment fails
+   */
+  async enrollAuthenticator(options) {
+    return this.#options.authClient.mfa.enrollAuthenticator(options);
+  }
+  /**
+   * Initiates an MFA challenge for user verification.
+   *
+   * @param options - Challenge options
+   * @returns Promise resolving to challenge response with challenge details
+   * @throws {MfaChallengeError} When the challenge fails
+   */
+  async challengeAuthenticator(options) {
+    return this.#options.authClient.mfa.challengeAuthenticator(options);
+  }
+  /**
+   * Verifies an MFA challenge and completes the authentication flow.
+   *
+   * Exchanges the MFA token and verification code for access, ID, and refresh tokens,
+   * then saves them into the user's session automatically.
+   *
+   * @param options - The MFA token, factor type (otp / oob / recovery-code), and the code to verify
+   * @param storeOptions - Optional options forwarded to the session store. Can be omitted when
+   *   using the built-in stores; required if your custom store needs extra context (e.g. a request object).
+   * @returns The tokens returned by Auth0 after successful verification
+   * @throws {MfaVerifyError} When verification fails (e.g. invalid token, wrong code)
+   */
+  async verify(options, storeOptions) {
+    const tokenResponse = await this.#options.authClient.mfa.verify(options);
+    const audience = options.audience ?? this.#options.defaultAudience;
+    const existingStateData = await this.#options.stateStore.get(
+      this.#options.stateStoreIdentifier,
+      storeOptions
+    );
+    const updatedStateData = updateStateData(audience, existingStateData, tokenResponse, {
+      domain: this.#options.domain
+    });
+    await this.#options.stateStore.set(
+      this.#options.stateStoreIdentifier,
+      updatedStateData,
+      true,
+      storeOptions
+    );
+    const result = {
+      accessToken: tokenResponse.accessToken,
+      tokenType: tokenResponse.tokenType ?? "bearer",
+      expiresAt: tokenResponse.expiresAt,
+      scope: tokenResponse.scope
+    };
+    if (tokenResponse.idToken) result.idToken = tokenResponse.idToken;
+    if (tokenResponse.refreshToken) result.refreshToken = tokenResponse.refreshToken;
+    if (tokenResponse.recoveryCode) result.recoveryCode = tokenResponse.recoveryCode;
+    return result;
+  }
+};
+
 // src/server-client.ts
 var DEFAULT_SCOPES = "openid profile email offline_access";
-function ensureOpenIdScope(scope) {
+var normalizeDomain = (value) => {
+  const trimmed = value.trim();
+  const parsed = trimmed.startsWith("http") ? new URL(trimmed) : new URL(`https://${trimmed}`);
+  return parsed.host.toLowerCase();
+};
+var decodeIssuer = (token) => {
+  try {
+    const { iss } = (0, import_jose.decodeJwt)(token);
+    return typeof iss === "string" ? iss : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var ensureOpenIdScope = (scope) => {
   if (!scope) {
     return DEFAULT_SCOPES;
   }
@@ -176,20 +297,51 @@ function ensureOpenIdScope(scope) {
     scopes.unshift("openid");
   }
   return scopes.join(" ");
-}
+};
 var ServerClient = class {
   #options;
   #transactionStore;
   #transactionStoreIdentifier;
   #stateStore;
   #stateStoreIdentifier;
+  #authClientOptions;
+  #staticDomain;
+  #authClient;
+  #mfaClient;
   /**
    * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
    * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
-   * 
+   *
+   * This property can only be used when `domain` is configured as a static string.
+   * In resolver mode (`domain` as a function), the SDK resolves the domain per request,
+   * so use `ServerClient` methods instead.
+   *
    * Important: the methods exposed on the `authClient` instance do not handle any session or state management.
    */
-  authClient;
+  get authClient() {
+    if (!this.#authClient) {
+      throw new InvalidConfigurationError("authClient is only available when using a static domain configuration.");
+    }
+    return this.#authClient;
+  }
+  /**
+   * The MFA client for managing multi-factor authentication operations.
+   *
+   * Provides methods to list, enroll, and challenge MFA authenticators,
+   * as well as verify MFA challenges to complete authentication.
+   *
+   * The `verify` method integrates with the session state store, persisting tokens
+   * and user data after successful MFA verification.
+   *
+   * This property can only be used when `domain` is configured as a static string.
+   * In resolver mode (`domain` as a function), MFA is not supported.
+   */
+  get mfa() {
+    if (!this.#mfaClient) {
+      throw new InvalidConfigurationError("mfa is only available when using a static domain configuration.");
+    }
+    return this.#mfaClient;
+  }
   constructor(options) {
     this.#options = options;
     this.#stateStoreIdentifier = this.#options.stateIdentifier || "__a0_session";
@@ -202,18 +354,84 @@ var ServerClient = class {
     if (!this.#options.transactionStore) {
       throw new MissingRequiredArgumentError("transactionStore");
     }
-    this.authClient = new import_auth0_auth_js.AuthClient({
-      domain: this.#options.domain,
+    if (typeof this.#options.domain !== "string" && typeof this.#options.domain !== "function") {
+      throw new InvalidConfigurationError("domain must be a string or resolver function");
+    }
+    this.#authClientOptions = {
       clientId: this.#options.clientId,
       clientSecret: this.#options.clientSecret,
       clientAssertionSigningKey: this.#options.clientAssertionSigningKey,
       clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,
       authorizationParams: this.#options.authorizationParams,
+      discoveryCache: this.#options.discoveryCache,
       customFetch: this.#options.customFetch,
-      useMtls: this.#options.useMtls,
+      useMtls: this.#options.useMtls
+    };
+    if (typeof this.#options.domain === "string") {
+      const domain = normalizeDomain(this.#options.domain);
+      this.#staticDomain = domain;
+      this.#authClient = new import_auth0_auth_js.AuthClient({
+        domain,
+        ...this.#authClientOptions,
+        telemetry: getTelemetryConfig(this.#options.telemetry)
+      });
+      this.#mfaClient = new ServerMfaClient({
+        authClient: this.#authClient,
+        domain,
+        stateStore: this.#stateStore,
+        stateStoreIdentifier: this.#stateStoreIdentifier,
+        defaultAudience: this.#options.authorizationParams?.audience ?? "default"
+      });
+    }
+  }
+  async #resolveDomain(storeOptions) {
+    if (typeof this.#options.domain === "function") {
+      const resolved = await this.#options.domain(storeOptions);
+      if (typeof resolved !== "string" || resolved.trim().length === 0) {
+        throw new InvalidConfigurationError("domainResolver returned no domain");
+      }
+      return normalizeDomain(resolved);
+    }
+    return normalizeDomain(this.#options.domain);
+  }
+  #createAuthClient(domain) {
+    return new import_auth0_auth_js.AuthClient({
+      domain,
+      ...this.#authClientOptions,
       telemetry: getTelemetryConfig(this.#options.telemetry)
     });
   }
+  #getAuthClient(domain) {
+    const normalizedDomain = normalizeDomain(domain);
+    if (this.#authClient && this.#staticDomain === normalizedDomain) {
+      return this.#authClient;
+    }
+    return this.#createAuthClient(normalizedDomain);
+  }
+  #getSessionDomain(stateData) {
+    if (stateData.domain) {
+      return normalizeDomain(stateData.domain);
+    }
+    if (this.#staticDomain) {
+      return this.#staticDomain;
+    }
+    const issuerFromClaims = stateData.user?.iss;
+    if (typeof issuerFromClaims === "string" && issuerFromClaims.trim().length > 0) {
+      return normalizeDomain(issuerFromClaims);
+    }
+    return;
+  }
+  #isResolverMode() {
+    return typeof this.#options.domain === "function";
+  }
+  async #isSessionForCurrentDomain(stateData, storeOptions) {
+    const sessionDomain = this.#getSessionDomain(stateData);
+    if (!sessionDomain) {
+      return false;
+    }
+    const resolvedDomain = await this.#resolveDomain(storeOptions);
+    return sessionDomain === resolvedDomain;
+  }
   /**
    * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
    * @param options Optional options used to configure the interactive login process.
@@ -229,7 +447,9 @@ var ServerClient = class {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
     const scope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
-    const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({
+    const domain = await this.#resolveDomain(storeOptions);
+    const authClient = this.#getAuthClient(domain);
+    const { codeVerifier, authorizationUrl } = await authClient.buildAuthorizationUrl({
       pushedAuthorizationRequests: options?.pushedAuthorizationRequests,
       authorizationParams: {
         ...options?.authorizationParams,
@@ -239,7 +459,8 @@ var ServerClient = class {
     });
     const transactionState = {
       audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,
-      codeVerifier
+      codeVerifier,
+      domain
     };
     if (options?.appState) {
       transactionState.appState = options.appState;
@@ -263,11 +484,15 @@ var ServerClient = class {
     if (!transactionData) {
       throw new MissingTransactionError();
     }
-    const tokenEndpointResponse = await this.authClient.getTokenByCode(url, {
+    const domain = transactionData.domain ?? await this.#resolveDomain(storeOptions);
+    const authClient = this.#getAuthClient(domain);
+    const tokenEndpointResponse = await authClient.getTokenByCode(url, {
       codeVerifier: transactionData.codeVerifier
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    const stateData = updateStateData(transactionData.audience ?? "default", existingStateData, tokenEndpointResponse);
+    const stateData = updateStateData(transactionData.audience ?? "default", existingStateData, tokenEndpointResponse, {
+      domain
+    });
     await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);
     await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);
     return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails };
@@ -289,7 +514,15 @@ var ServerClient = class {
         "Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process."
       );
     }
-    const { linkUserUrl, codeVerifier } = await this.authClient.buildLinkUserUrl({
+    if (this.#isResolverMode()) {
+      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);
+      if (!isCurrentDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+    }
+    const domain = this.#getSessionDomain(stateData);
+    const authClient = this.#getAuthClient(domain);
+    const { linkUserUrl, codeVerifier } = await authClient.buildLinkUserUrl({
       connection: options.connection,
       connectionScope: options.connectionScope,
       idToken: stateData.idToken,
@@ -297,7 +530,8 @@ var ServerClient = class {
     });
     const transactionState = {
       audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,
-      codeVerifier
+      codeVerifier,
+      domain
     };
     if (options?.appState) {
       transactionState.appState = options.appState;
@@ -339,14 +573,23 @@ var ServerClient = class {
         "Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process."
       );
     }
-    const { unlinkUserUrl, codeVerifier } = await this.authClient.buildUnlinkUserUrl({
+    if (this.#isResolverMode()) {
+      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);
+      if (!isCurrentDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+    }
+    const domain = this.#getSessionDomain(stateData);
+    const authClient = this.#getAuthClient(domain);
+    const { unlinkUserUrl, codeVerifier } = await authClient.buildUnlinkUserUrl({
       connection: options.connection,
       idToken: stateData.idToken,
       authorizationParams: options.authorizationParams
     });
     const transactionState = {
       audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,
-      codeVerifier
+      codeVerifier,
+      domain
     };
     if (options?.appState) {
       transactionState.appState = options.appState;
@@ -385,7 +628,9 @@ var ServerClient = class {
    */
   async loginBackchannel(options, storeOptions) {
     const scope = ensureOpenIdScope(options.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
-    const tokenEndpointResponse = await this.authClient.backchannelAuthentication({
+    const domain = await this.#resolveDomain(storeOptions);
+    const authClient = this.#getAuthClient(domain);
+    const tokenEndpointResponse = await authClient.backchannelAuthentication({
       bindingMessage: options.bindingMessage,
       loginHint: options.loginHint,
       authorizationParams: {
@@ -397,7 +642,8 @@ var ServerClient = class {
     const stateData = updateStateData(
       this.#options.authorizationParams?.audience ?? "default",
       existingStateData,
-      tokenEndpointResponse
+      tokenEndpointResponse,
+      { domain }
     );
     await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);
     return {
@@ -411,16 +657,31 @@ var ServerClient = class {
    */
   async getUser(storeOptions) {
     const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    return stateData?.user;
+    if (!stateData) {
+      return;
+    }
+    if (this.#isResolverMode()) {
+      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);
+      if (!isCurrentDomain) {
+        return;
+      }
+    }
+    return stateData.user;
   }
   /**
    * Retrieve the user session from the store, or undefined if no session found.
    * @param storeOptions Optional options used to pass to the Transaction and State Store.
-   * @returns The sessionm or undefined if no session found in the store.
+   * @returns The session or undefined if no session found in the store.
    */
   async getSession(storeOptions) {
     const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
     if (stateData) {
+      if (this.#isResolverMode()) {
+        const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);
+        if (!isCurrentDomain) {
+          return;
+        }
+      }
       const { internal, ...sessionData } = stateData;
       return sessionData;
     }
@@ -428,24 +689,29 @@ var ServerClient = class {
   /**
    * Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.
    * Also updates the store when a new token was retrieved from Auth0.
-   *
-   * @param options Optional options for requesting specific audience/scope.
    * @param storeOptions Optional options used to pass to the Transaction and State Store.
    *
-   * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.
+   * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token. When the cause is `mfa_required`, use `isMfaRequiredError(error)` to narrow the error and read `cause.mfa_token`.
    *
    * @returns The Token Set, containing the access token, as well as additional information.
    */
-  async getAccessToken(tokenOptionsOrStoreOptions, storeOptions) {
-    const hasTokenOptions = (
-      // If second arg exists, first arg must be GetAccessTokenOptions
-      storeOptions !== void 0 || // OR if first arg has audience/scope properties
-      tokenOptionsOrStoreOptions && typeof tokenOptionsOrStoreOptions === "object" && ("audience" in tokenOptionsOrStoreOptions || "scope" in tokenOptionsOrStoreOptions)
-    );
-    const [resolvedOptions, resolvedStoreOptions] = hasTokenOptions ? [tokenOptionsOrStoreOptions, storeOptions] : [void 0, tokenOptionsOrStoreOptions];
-    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, resolvedStoreOptions);
-    const audience = resolvedOptions?.audience ?? this.#options.authorizationParams?.audience ?? "default";
-    const scope = resolvedOptions?.scope ?? this.#options.authorizationParams?.scope;
+  async getAccessToken(storeOptions) {
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const audience = this.#options.authorizationParams?.audience ?? "default";
+    const scope = this.#options.authorizationParams?.scope;
+    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : this.#staticDomain;
+    if (this.#isResolverMode()) {
+      if (!stateData) {
+        throw new MissingSessionError("Unable to retrieve access token without a logged in user.");
+      }
+      if (!sessionDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+      const resolvedDomain = await this.#resolveDomain(storeOptions);
+      if (sessionDomain !== resolvedDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+    }
     const tokenSet = stateData?.tokenSets.find(
       (tokenSet2) => tokenSet2.audience === audience && (!scope || compareScopes(tokenSet2.scope, scope))
     );
@@ -457,14 +723,15 @@ var ServerClient = class {
         "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."
       );
     }
-    const tokenByRefreshTokenOptions = {
-      refreshToken: stateData.refreshToken,
-      ...hasTokenOptions && { audience, scope }
-    };
-    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken(tokenByRefreshTokenOptions);
-    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, resolvedStoreOptions);
-    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);
-    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, resolvedStoreOptions);
+    const domainForSession = sessionDomain;
+    const tokenEndpointResponse = await this.#getAuthClient(domainForSession).getTokenByRefreshToken({
+      refreshToken: stateData.refreshToken
+    });
+    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse, {
+      domain: domainForSession
+    });
+    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);
     return {
       accessToken: tokenEndpointResponse.accessToken,
       scope: tokenEndpointResponse.scope,
@@ -489,6 +756,19 @@ var ServerClient = class {
    */
   async getAccessTokenForConnection(options, storeOptions) {
     const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : this.#staticDomain;
+    if (this.#isResolverMode()) {
+      if (!stateData) {
+        throw new MissingSessionError("Unable to retrieve an access token for a connection without a logged in user.");
+      }
+      if (!sessionDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+      const resolvedDomain = await this.#resolveDomain(storeOptions);
+      if (sessionDomain !== resolvedDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+    }
     const connectionTokenSet = stateData?.connectionTokenSets?.find(
       (tokenSet) => tokenSet.connection === options.connection
     );
@@ -500,12 +780,20 @@ var ServerClient = class {
         "A refresh token was not found but is required to be able to retrieve an access token for a connection."
       );
     }
-    const tokenEndpointResponse = await this.authClient.getTokenForConnection({
+    const domainForSession = sessionDomain;
+    const tokenEndpointResponse = await this.#getAuthClient(domainForSession).getTokenForConnection({
       connection: options.connection,
       loginHint: options.loginHint,
       refreshToken: stateData.refreshToken
     });
-    const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);
+    const updatedStateData = updateStateDataForConnectionTokenSet(
+      options,
+      {
+        ...stateData,
+        domain: stateData.domain ?? domainForSession
+      },
+      tokenEndpointResponse
+    );
     await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);
     return {
       accessToken: tokenEndpointResponse.accessToken,
@@ -522,8 +810,21 @@ var ServerClient = class {
    * @returns {URL}
    */
   async logout(options, storeOptions) {
-    await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
-    return this.authClient.buildLogoutUrl(options);
+    if (!this.#isResolverMode()) {
+      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
+      return this.authClient.buildLogoutUrl(options);
+    }
+    const resolvedDomain = await this.#resolveDomain(storeOptions);
+    const authClient = this.#getAuthClient(resolvedDomain);
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : void 0;
+    if (!stateData) {
+      return authClient.buildLogoutUrl(options);
+    }
+    if (sessionDomain && sessionDomain === resolvedDomain) {
+      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
+    }
+    return authClient.buildLogoutUrl(options);
   }
   /**
    * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.
@@ -537,13 +838,28 @@ var ServerClient = class {
     if (!logoutToken) {
       throw new BackchannelLogoutError("Missing Logout Token");
     }
-    const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });
-    await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);
+    if (!this.#isResolverMode()) {
+      const logoutTokenClaims2 = await this.authClient.verifyLogoutToken({ logoutToken });
+      await this.#stateStore.deleteByLogoutToken(logoutTokenClaims2, storeOptions);
+      return;
+    }
+    const issuer = decodeIssuer(logoutToken);
+    if (!issuer) {
+      throw new BackchannelLogoutError("Logout token is missing an issuer");
+    }
+    const resolvedDomain = await this.#resolveDomain(storeOptions);
+    const domain = normalizeDomain(issuer);
+    if (domain !== resolvedDomain) {
+      throw new BackchannelLogoutError("Logout token issuer does not match the resolved domain");
+    }
+    const authClient = this.#getAuthClient(domain);
+    const logoutTokenClaims = await authClient.verifyLogoutToken({ logoutToken });
+    await this.#stateStore.deleteByLogoutToken({ ...logoutTokenClaims, iss: issuer }, storeOptions);
   }
 };
 
 // src/encryption/index.ts
-var import_jose = require("jose");
+var import_jose2 = require("jose");
 var ENC = "A256CBC-HS512";
 var ALG = "dir";
 var DIGEST = "SHA-256";
@@ -551,7 +867,7 @@ var BIT_LENGTH = 512;
 var HKDF_INFO = "derived cookie encryption secret";
 var encoder;
 function isDecryptionError(e) {
-  return e instanceof import_jose.errors.JWEDecryptionFailed || e instanceof import_jose.errors.JWEInvalid;
+  return e instanceof import_jose2.errors.JWEDecryptionFailed || e instanceof import_jose2.errors.JWEInvalid;
 }
 async function deriveEncryptionSecret(secret, salt, kid) {
   encoder ||= new TextEncoder();
@@ -572,7 +888,7 @@ async function deriveEncryptionSecret(secret, salt, kid) {
 async function _encrypt(payload, secret, salt, expiration) {
   const kid = crypto.randomUUID();
   const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);
-  return await new import_jose.EncryptJWT(payload).setProtectedHeader({ enc: ENC, alg: ALG, kid }).setExpirationTime(expiration).encrypt(encryptionSecret);
+  return await new import_jose2.EncryptJWT(payload).setProtectedHeader({ enc: ENC, alg: ALG, kid }).setExpirationTime(expiration).encrypt(encryptionSecret);
 }
 async function encrypt(payload, secret, salt, expiration) {
   if (typeof secret === "string") {
@@ -586,7 +902,7 @@ async function encrypt(payload, secret, salt, expiration) {
   }
 }
 async function _decrypt(value, secret, salt) {
-  const res = await (0, import_jose.jwtDecrypt)(
+  const res = await (0, import_jose2.jwtDecrypt)(
     value,
     async (protectedHeader) => {
       if (!protectedHeader.kid) {
@@ -856,6 +1172,9 @@ var StatelessStateStore = class extends AbstractSessionStore {
     };
   }
 };
+
+// src/mfa/index.ts
+var import_auth0_auth_js2 = require("@auth0/auth0-auth-js");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AbstractStateStore,
@@ -863,12 +1182,19 @@ var StatelessStateStore = class extends AbstractSessionStore {
   BackchannelLogoutError,
   CookieTransactionStore,
   InvalidConfigurationError,
+  IssuerValidationError,
+  MfaChallengeError,
+  MfaEnrollmentError,
+  MfaListAuthenticatorsError,
+  MfaVerifyError,
   MissingRequiredArgumentError,
   MissingSessionError,
   MissingTransactionError,
   ServerClient,
+  ServerMfaClient,
   StartLinkUserError,
   StatefulStateStore,
-  StatelessStateStore
+  StatelessStateStore,
+  isMfaRequiredError
 });
 //# sourceMappingURL=index.cjs.map