@authsome/ui-core 0.1.7 → 0.1.9

package/dist/adapters/index.d.mts

@@ -1,4 +1,4 @@
-import { c as AuthProvider, G as ProviderConfig, S as SignInRequest, E as AuthResponse, d as SignUpRequest, t as User, u as Session, w as SessionData, U as UpdateUserRequest, P as PasswordChangeRequest, e as PasswordResetRequest, f as PasswordResetConfirmRequest, O as OAuthSignInRequest, g as OAuthCallbackRequest, h as OAuthProvider, M as MagicLinkRequest, i as MagicLinkVerifyRequest, j as PhoneAuthRequest, k as PhoneVerifyRequest, T as TwoFactorSetupRequest, l as TwoFactorSetupResponse, m as TwoFactorVerifyRequest, n as TwoFactorMethod, o as PasskeyRegisterRequest, p as PasskeyCredential, q as PasskeyAuthRequest, R as RequestContext, C as CookieData, a as AuthError } from '../provider-Du6Oe4tD.mjs';
+import { c as AuthProvider, R as ProviderConfig, S as SignInRequest, Q as AuthResponse, d as SignUpRequest, t as User, u as Session, w as SessionData, U as UpdateUserRequest, P as PasswordChangeRequest, e as PasswordResetRequest, f as PasswordResetConfirmRequest, O as OAuthSignInRequest, g as OAuthCallbackRequest, h as OAuthProvider, M as MagicLinkRequest, i as MagicLinkVerifyRequest, j as PhoneAuthRequest, k as PhoneVerifyRequest, T as TwoFactorSetupRequest, l as TwoFactorSetupResponse, m as TwoFactorVerifyRequest, n as TwoFactorMethod, o as PasskeyRegisterRequest, p as PasskeyCredential, q as PasskeyAuthRequest, D as DeviceFlowInitiateRequest, z as DeviceFlowInitiateResponse, B as DeviceCodeVerifyRequest, E as DeviceCodeVerifyResponse, F as DeviceAuthorizeRequest, G as DeviceTokenPollRequest, I as DeviceTokenPollResponse, W as RequestContext, C as CookieData, a as AuthError } from '../provider-DWklI8Wr.mjs';
 
 /**
  * Base auth provider implementation
@@ -49,6 +49,26 @@ declare abstract class BaseAuthProvider implements AuthProvider {
     abstract authenticatePasskey(request: PasskeyAuthRequest): Promise<AuthResponse>;
     abstract listPasskeys(): Promise<PasskeyCredential[]>;
     abstract deletePasskey(credentialId: string): Promise<void>;
+    /**
+     * Initiate device authorization flow
+     * Returns device code, user code, and verification URI
+     */
+    abstract initiateDeviceFlow(request: DeviceFlowInitiateRequest): Promise<DeviceFlowInitiateResponse>;
+    /**
+     * Verify a user-entered device code
+     * Called by web UI when user enters the code shown on their device
+     */
+    abstract verifyDeviceCode(request: DeviceCodeVerifyRequest): Promise<DeviceCodeVerifyResponse>;
+    /**
+     * Authorize or deny the device request
+     * Called when user approves or denies the authorization
+     */
+    abstract authorizeDevice(request: DeviceAuthorizeRequest): Promise<void>;
+    /**
+     * Poll for device token (used by CLI/device)
+     * Returns auth response when authorized, or status when still pending
+     */
+    abstract pollDeviceToken(request: DeviceTokenPollRequest): Promise<AuthResponse | DeviceTokenPollResponse>;
     /**
      * Optional edge runtime context methods
      * Default implementations do nothing - subclasses can override

package/dist/adapters/index.d.ts

@@ -1,4 +1,4 @@
-import { c as AuthProvider, G as ProviderConfig, S as SignInRequest, E as AuthResponse, d as SignUpRequest, t as User, u as Session, w as SessionData, U as UpdateUserRequest, P as PasswordChangeRequest, e as PasswordResetRequest, f as PasswordResetConfirmRequest, O as OAuthSignInRequest, g as OAuthCallbackRequest, h as OAuthProvider, M as MagicLinkRequest, i as MagicLinkVerifyRequest, j as PhoneAuthRequest, k as PhoneVerifyRequest, T as TwoFactorSetupRequest, l as TwoFactorSetupResponse, m as TwoFactorVerifyRequest, n as TwoFactorMethod, o as PasskeyRegisterRequest, p as PasskeyCredential, q as PasskeyAuthRequest, R as RequestContext, C as CookieData, a as AuthError } from '../provider-Du6Oe4tD.js';
+import { c as AuthProvider, R as ProviderConfig, S as SignInRequest, Q as AuthResponse, d as SignUpRequest, t as User, u as Session, w as SessionData, U as UpdateUserRequest, P as PasswordChangeRequest, e as PasswordResetRequest, f as PasswordResetConfirmRequest, O as OAuthSignInRequest, g as OAuthCallbackRequest, h as OAuthProvider, M as MagicLinkRequest, i as MagicLinkVerifyRequest, j as PhoneAuthRequest, k as PhoneVerifyRequest, T as TwoFactorSetupRequest, l as TwoFactorSetupResponse, m as TwoFactorVerifyRequest, n as TwoFactorMethod, o as PasskeyRegisterRequest, p as PasskeyCredential, q as PasskeyAuthRequest, D as DeviceFlowInitiateRequest, z as DeviceFlowInitiateResponse, B as DeviceCodeVerifyRequest, E as DeviceCodeVerifyResponse, F as DeviceAuthorizeRequest, G as DeviceTokenPollRequest, I as DeviceTokenPollResponse, W as RequestContext, C as CookieData, a as AuthError } from '../provider-DWklI8Wr.js';
 
 /**
  * Base auth provider implementation
@@ -49,6 +49,26 @@ declare abstract class BaseAuthProvider implements AuthProvider {
     abstract authenticatePasskey(request: PasskeyAuthRequest): Promise<AuthResponse>;
     abstract listPasskeys(): Promise<PasskeyCredential[]>;
     abstract deletePasskey(credentialId: string): Promise<void>;
+    /**
+     * Initiate device authorization flow
+     * Returns device code, user code, and verification URI
+     */
+    abstract initiateDeviceFlow(request: DeviceFlowInitiateRequest): Promise<DeviceFlowInitiateResponse>;
+    /**
+     * Verify a user-entered device code
+     * Called by web UI when user enters the code shown on their device
+     */
+    abstract verifyDeviceCode(request: DeviceCodeVerifyRequest): Promise<DeviceCodeVerifyResponse>;
+    /**
+     * Authorize or deny the device request
+     * Called when user approves or denies the authorization
+     */
+    abstract authorizeDevice(request: DeviceAuthorizeRequest): Promise<void>;
+    /**
+     * Poll for device token (used by CLI/device)
+     * Returns auth response when authorized, or status when still pending
+     */
+    abstract pollDeviceToken(request: DeviceTokenPollRequest): Promise<AuthResponse | DeviceTokenPollResponse>;
     /**
      * Optional edge runtime context methods
      * Default implementations do nothing - subclasses can override

package/dist/adapters/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/types/auth.ts","../../src/utils/errors.ts","../../src/adapters/base-provider.ts"],"names":[],"mappings":";;;AAmFO,IAAM,SAAA,GAAN,MAAM,UAAA,SAAkB,KAAA,CAAM;AAAA,EAMnC,WAAA,CACE,OAAA,EACA,IAAA,GAAsB,eAAA,sBACtB,OAAA,EAKA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAU,OAAA,EAAS,OAAA;AACxB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AACrB,IAAA,IAAA,CAAK,gBAAgB,OAAA,EAAS,aAAA;AAG9B,IAAA,IAAI,MAAM,iBAAA,EAAmB;AAC3B,MAAA,KAAA,CAAM,iBAAA,CAAkB,MAAM,UAAS,CAAA;AAAA,IACzC;AAAA,EACF;AACF,CAAA;;;ACvFO,SAAS,YAAY,KAAA,EAAoC;AAC9D,EAAA,OAAO,KAAA,YAAiB,SAAA;AAC1B;AAKO,SAAS,YAAY,KAAA,EAA2B;AACrD,EAAA,IAAI,WAAA,CAAY,KAAK,CAAA,EAAG;AACtB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,IAAA,OAAO,IAAI,SAAA,CAAU,KAAA,CAAM,OAAA,EAAA,eAAA,sBAAsC;AAAA,MAC/D,OAAA,EAAS;AAAA,QACP,eAAe,KAAA,CAAM,IAAA;AAAA,QACrB,OAAO,KAAA,CAAM;AAAA;AACf,KACD,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,UAAU,KAAA,EAAA,eAAA,qBAAkC;AAAA,EACzD;AAEA,EAAA,OAAO,IAAI,SAAA;AAAA,IACT,2BAAA;AAAA,IAAA,eAAA;AAAA,IAEA,EAAE,OAAA,EAAS,EAAE,KAAA,EAAM;AAAE,GACvB;AACF;;;ACbO,IAAe,mBAAf,MAAwD;AAAA,EAAxD,WAAA,GAAA;AAEL,IAAA,IAAA,CAAU,SAAyB,EAAC;AACpC,IAAA,IAAA,CAAU,WAAA,GAAc,KAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA,EAKxB,MAAM,WAAW,MAAA,EAAuC;AACtD,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKU,iBAAA,GAA0B;AAClC,IAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,IAAA,CAAK,IAAI,CAAA,mBAAA,CAAqB,CAAA;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAgB,OAAA,CACd,GAAA,EACA,OAAA,GAAuB,EAAC,EACZ;AACZ,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAChC,GAAG,OAAA;AAAA,MACH,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,GAAG,OAAA,CAAQ;AAAA;AACb,KACD,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,QAAQ,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,MAAM,OAAO;AAAA,QAC/C,SAAS,QAAA,CAAS;AAAA,OACpB,CAAE,CAAA;AACF,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,OAAO,SAAS,IAAA,EAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAyCA,eAAe,KAAA,EAA2B;AACxC,IAAA,OAAO,YAAY,KAAK,CAAA;AAAA,EAC1B;AACF","file":"index.js","sourcesContent":["/**\n * Core authentication types and interfaces\n */\n\n/**\n * Authentication state enum\n */\nexport enum AuthState {\n  AUTHENTICATED = 'authenticated',\n  UNAUTHENTICATED = 'unauthenticated',\n  LOADING = 'loading',\n  ERROR = 'error',\n}\n\n/**\n * User profile interface\n */\nexport interface User {\n  id: string;\n  email?: string;\n  username?: string;\n  phone?: string;\n  emailVerified?: boolean;\n  phoneVerified?: boolean;\n  name?: string;\n  firstName?: string;\n  lastName?: string;\n  avatar?: string;\n  metadata?: Record<string, unknown>;\n  createdAt?: Date;\n  updatedAt?: Date;\n  \n  // Organization fields\n  organizationId?: string;\n  organizationRole?: string;\n  organizationMemberships?: OrganizationMembership[];\n}\n\n/**\n * Session interface\n */\nexport interface Session {\n  id: string;\n  userId: string;\n  token: string;\n  expiresAt?: Date;\n  createdAt?: Date;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Session data with user and session combined\n * Used for efficient retrieval of both user and session in one call\n */\nexport interface SessionData {\n  user: User;\n  session: Session;\n  expiresAt: number;\n}\n\n/**\n * Auth error types\n */\nexport enum AuthErrorType {\n  INVALID_CREDENTIALS = 'invalid_credentials',\n  USER_NOT_FOUND = 'user_not_found',\n  USER_ALREADY_EXISTS = 'user_already_exists',\n  INVALID_TOKEN = 'invalid_token',\n  TOKEN_EXPIRED = 'token_expired',\n  NETWORK_ERROR = 'network_error',\n  VALIDATION_ERROR = 'validation_error',\n  MFA_REQUIRED = 'mfa_required',\n  EMAIL_NOT_VERIFIED = 'email_not_verified',\n  PHONE_NOT_VERIFIED = 'phone_not_verified',\n  RATE_LIMIT_EXCEEDED = 'rate_limit_exceeded',\n  UNKNOWN_ERROR = 'unknown_error',\n}\n\n/**\n * Auth error class\n * \n * Extends Error to provide proper error handling with auth-specific context\n */\nexport class AuthError extends Error {\n  public readonly type: AuthErrorType;\n  public readonly details?: Record<string, unknown>;\n  public readonly code?: string | number;\n  public readonly originalError?: unknown;\n\n  constructor(\n    message: string,\n    type: AuthErrorType = AuthErrorType.UNKNOWN_ERROR,\n    options?: {\n      details?: Record<string, unknown>;\n      code?: string | number;\n      originalError?: unknown;\n    }\n  ) {\n    super(message);\n    this.name = 'AuthError';\n    this.type = type;\n    this.details = options?.details;\n    this.code = options?.code;\n    this.originalError = options?.originalError;\n\n    // Maintains proper stack trace for where our error was thrown (only available on V8)\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, AuthError);\n    }\n  }\n}\n\n/**\n * Auth context state\n */\nexport interface AuthContext {\n  state: AuthState;\n  user: User | null;\n  session: Session | null;\n  error: AuthError | null;\n  isAuthenticated: boolean;\n  isLoading: boolean;\n}\n\n/**\n * OAuth provider types\n */\nexport enum OAuthProvider {\n  GOOGLE = 'google',\n  GITHUB = 'github',\n  FACEBOOK = 'facebook',\n  TWITTER = 'twitter',\n  MICROSOFT = 'microsoft',\n  APPLE = 'apple',\n  LINKEDIN = 'linkedin',\n  DISCORD = 'discord',\n}\n\n/**\n * OAuth configuration\n */\nexport interface OAuthConfig {\n  provider: OAuthProvider;\n  clientId: string;\n  redirectUri: string;\n  scope?: string[];\n  state?: string;\n}\n\n/**\n * 2FA method types\n */\nexport enum TwoFactorMethod {\n  TOTP = 'totp',\n  SMS = 'sms',\n  EMAIL = 'email',\n  BACKUP_CODE = 'backup_code',\n}\n\n/**\n * 2FA configuration\n */\nexport interface TwoFactorConfig {\n  method: TwoFactorMethod;\n  enabled: boolean;\n  verified?: boolean;\n}\n\n/**\n * Passkey/WebAuthn types\n */\nexport interface PasskeyCredential {\n  id: string;\n  name?: string;\n  createdAt?: Date;\n  lastUsedAt?: Date;\n}\n\n/**\n * Validation error\n */\nexport interface ValidationError {\n  field: string;\n  message: string;\n  code?: string;\n}\n\n/**\n * Organization interface\n */\nexport interface Organization {\n  id: string;\n  name: string;\n  slug: string;\n  logoUrl?: string;\n  createdAt?: Date;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Organization membership interface\n */\nexport interface OrganizationMembership {\n  organization: Organization;\n  role: 'owner' | 'admin' | 'member';\n  permissions?: string[];\n}\n\n","/**\n * Error handling utilities\n */\n\nimport { AuthError, AuthErrorType } from '../types';\n\n/**\n * Create an auth error\n * \n * @deprecated Use `new AuthError()` directly instead\n */\nexport function createAuthError(\n  type: AuthErrorType,\n  message: string,\n  details?: Record<string, unknown>,\n  code?: string | number\n): AuthError {\n  return new AuthError(message, type, { details, code });\n}\n\n/**\n * Check if an error is an auth error\n */\nexport function isAuthError(error: unknown): error is AuthError {\n  return error instanceof AuthError;\n}\n\n/**\n * Convert unknown error to auth error\n */\nexport function toAuthError(error: unknown): AuthError {\n  if (isAuthError(error)) {\n    return error;\n  }\n\n  if (error instanceof Error) {\n    return new AuthError(error.message, AuthErrorType.UNKNOWN_ERROR, {\n      details: {\n        originalError: error.name,\n        stack: error.stack,\n      },\n    });\n  }\n\n  if (typeof error === 'string') {\n    return new AuthError(error, AuthErrorType.UNKNOWN_ERROR);\n  }\n\n  return new AuthError(\n    'An unknown error occurred',\n    AuthErrorType.UNKNOWN_ERROR,\n    { details: { error } }\n  );\n}\n\n/**\n * Check if error is a network error\n */\nexport function isNetworkError(error: unknown): boolean {\n  if (error instanceof Error) {\n    return (\n      error.name === 'NetworkError' ||\n      error.message.includes('network') ||\n      error.message.includes('fetch')\n    );\n  }\n  return false;\n}\n\n/**\n * Check if error indicates authentication is required\n */\nexport function isUnauthenticatedError(error: unknown): boolean {\n  if (isAuthError(error)) {\n    return (\n      error.type === AuthErrorType.INVALID_TOKEN ||\n      error.type === AuthErrorType.TOKEN_EXPIRED\n    );\n  }\n  return false;\n}\n\n/**\n * Check if error requires MFA\n */\nexport function isMFARequiredError(error: unknown): boolean {\n  if (isAuthError(error)) {\n    return error.type === AuthErrorType.MFA_REQUIRED;\n  }\n  return false;\n}\n","/**\n * Base auth provider implementation\n */\n\nimport type {\n  AuthProvider,\n  AuthResponse,\n  SignInRequest,\n  SignUpRequest,\n  UpdateUserRequest,\n  PasswordChangeRequest,\n  PasswordResetRequest,\n  PasswordResetConfirmRequest,\n  OAuthSignInRequest,\n  OAuthCallbackRequest,\n  MagicLinkRequest,\n  MagicLinkVerifyRequest,\n  PhoneAuthRequest,\n  PhoneVerifyRequest,\n  TwoFactorSetupRequest,\n  TwoFactorSetupResponse,\n  TwoFactorVerifyRequest,\n  PasskeyRegisterRequest,\n  PasskeyAuthRequest,\n  User,\n  Session,\n  SessionData,\n  OAuthProvider,\n  TwoFactorMethod,\n  PasskeyCredential,\n  AuthError,\n  ProviderConfig,\n  RequestContext,\n  CookieData,\n} from '../types';\nimport { toAuthError } from '../utils';\n\n/**\n * Base provider class with common functionality\n */\nexport abstract class BaseAuthProvider implements AuthProvider {\n  abstract readonly name: string;\n  protected config: ProviderConfig = {};\n  protected initialized = false;\n\n  /**\n   * Initialize the provider\n   */\n  async initialize(config: ProviderConfig): Promise<void> {\n    this.config = config;\n    this.initialized = true;\n  }\n\n  /**\n   * Ensure provider is initialized\n   */\n  protected ensureInitialized(): void {\n    if (!this.initialized) {\n      throw new Error(`Provider ${this.name} is not initialized`);\n    }\n  }\n\n  /**\n   * Make HTTP request\n   */\n  protected async request<T>(\n    url: string,\n    options: RequestInit = {}\n  ): Promise<T> {\n    const response = await fetch(url, {\n      ...options,\n      headers: {\n        'Content-Type': 'application/json',\n        ...options.headers,\n      },\n    });\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({\n        message: response.statusText,\n      }));\n      throw error;\n    }\n\n    return response.json();\n  }\n\n  // Abstract methods that must be implemented by subclasses\n  abstract signIn(request: SignInRequest): Promise<AuthResponse>;\n  abstract signUp(request: SignUpRequest): Promise<AuthResponse>;\n  abstract signOut(): Promise<void>;\n  abstract getCurrentUser(): Promise<User | null>;\n  abstract getCurrentSession(): Promise<Session | null>;\n  abstract getCurrentSessionData(): Promise<SessionData | null>;\n  abstract refreshSession(): Promise<Session>;\n  abstract updateUser(request: UpdateUserRequest): Promise<User>;\n  abstract changePassword(request: PasswordChangeRequest): Promise<void>;\n  abstract requestPasswordReset(request: PasswordResetRequest): Promise<void>;\n  abstract confirmPasswordReset(request: PasswordResetConfirmRequest): Promise<void>;\n  abstract oauthSignIn(request: OAuthSignInRequest): Promise<string>;\n  abstract oauthCallback(request: OAuthCallbackRequest): Promise<AuthResponse>;\n  abstract getOAuthProviders(): Promise<OAuthProvider[]>;\n  abstract sendMagicLink(request: MagicLinkRequest): Promise<void>;\n  abstract verifyMagicLink(request: MagicLinkVerifyRequest): Promise<AuthResponse>;\n  abstract sendPhoneCode(request: PhoneAuthRequest): Promise<void>;\n  abstract verifyPhoneCode(request: PhoneVerifyRequest): Promise<AuthResponse>;\n  abstract setupTwoFactor(request: TwoFactorSetupRequest): Promise<TwoFactorSetupResponse>;\n  abstract verifyTwoFactor(request: TwoFactorVerifyRequest): Promise<AuthResponse>;\n  abstract disableTwoFactor(): Promise<void>;\n  abstract getTwoFactorStatus(): Promise<TwoFactorMethod[]>;\n  abstract registerPasskey(request: PasskeyRegisterRequest): Promise<PasskeyCredential>;\n  abstract authenticatePasskey(request: PasskeyAuthRequest): Promise<AuthResponse>;\n  abstract listPasskeys(): Promise<PasskeyCredential[]>;\n  abstract deletePasskey(credentialId: string): Promise<void>;\n\n  /**\n   * Optional edge runtime context methods\n   * Default implementations do nothing - subclasses can override\n   */\n  setContext?(context: RequestContext): void;\n  getCookies?(): CookieData[];\n  clearContext?(): void;\n\n  /**\n   * Normalize error to AuthError\n   */\n  normalizeError(error: unknown): AuthError {\n    return toAuthError(error);\n  }\n}\n\n"]}
+{"version":3,"sources":["../../src/types/auth.ts","../../src/utils/errors.ts","../../src/adapters/base-provider.ts"],"names":[],"mappings":";;;AAmFO,IAAM,SAAA,GAAN,MAAM,UAAA,SAAkB,KAAA,CAAM;AAAA,EAMnC,WAAA,CACE,OAAA,EACA,IAAA,GAAsB,eAAA,sBACtB,OAAA,EAKA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAU,OAAA,EAAS,OAAA;AACxB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AACrB,IAAA,IAAA,CAAK,gBAAgB,OAAA,EAAS,aAAA;AAG9B,IAAA,IAAI,MAAM,iBAAA,EAAmB;AAC3B,MAAA,KAAA,CAAM,iBAAA,CAAkB,MAAM,UAAS,CAAA;AAAA,IACzC;AAAA,EACF;AACF,CAAA;;;ACvFO,SAAS,YAAY,KAAA,EAAoC;AAC9D,EAAA,OAAO,KAAA,YAAiB,SAAA;AAC1B;AAKO,SAAS,YAAY,KAAA,EAA2B;AACrD,EAAA,IAAI,WAAA,CAAY,KAAK,CAAA,EAAG;AACtB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,IAAA,OAAO,IAAI,SAAA,CAAU,KAAA,CAAM,OAAA,EAAA,eAAA,sBAAsC;AAAA,MAC/D,OAAA,EAAS;AAAA,QACP,eAAe,KAAA,CAAM,IAAA;AAAA,QACrB,OAAO,KAAA,CAAM;AAAA;AACf,KACD,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,UAAU,KAAA,EAAA,eAAA,qBAAkC;AAAA,EACzD;AAEA,EAAA,OAAO,IAAI,SAAA;AAAA,IACT,2BAAA;AAAA,IAAA,eAAA;AAAA,IAEA,EAAE,OAAA,EAAS,EAAE,KAAA,EAAM;AAAE,GACvB;AACF;;;ACNO,IAAe,mBAAf,MAAwD;AAAA,EAAxD,WAAA,GAAA;AAEL,IAAA,IAAA,CAAU,SAAyB,EAAC;AACpC,IAAA,IAAA,CAAU,WAAA,GAAc,KAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA,EAKxB,MAAM,WAAW,MAAA,EAAuC;AACtD,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKU,iBAAA,GAA0B;AAClC,IAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,IAAA,CAAK,IAAI,CAAA,mBAAA,CAAqB,CAAA;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAgB,OAAA,CACd,GAAA,EACA,OAAA,GAAuB,EAAC,EACZ;AACZ,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAChC,GAAG,OAAA;AAAA,MACH,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,GAAG,OAAA,CAAQ;AAAA;AACb,KACD,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,QAAQ,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,MAAM,OAAO;AAAA,QAC/C,SAAS,QAAA,CAAS;AAAA,OACpB,CAAE,CAAA;AACF,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,OAAO,SAAS,IAAA,EAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAkEA,eAAe,KAAA,EAA2B;AACxC,IAAA,OAAO,YAAY,KAAK,CAAA;AAAA,EAC1B;AACF","file":"index.js","sourcesContent":["/**\n * Core authentication types and interfaces\n */\n\n/**\n * Authentication state enum\n */\nexport enum AuthState {\n  AUTHENTICATED = 'authenticated',\n  UNAUTHENTICATED = 'unauthenticated',\n  LOADING = 'loading',\n  ERROR = 'error',\n}\n\n/**\n * User profile interface\n */\nexport interface User {\n  id: string;\n  email?: string;\n  username?: string;\n  phone?: string;\n  emailVerified?: boolean;\n  phoneVerified?: boolean;\n  name?: string;\n  firstName?: string;\n  lastName?: string;\n  avatar?: string;\n  metadata?: Record<string, unknown>;\n  createdAt?: Date;\n  updatedAt?: Date;\n  \n  // Organization fields\n  organizationId?: string;\n  organizationRole?: string;\n  organizationMemberships?: OrganizationMembership[];\n}\n\n/**\n * Session interface\n */\nexport interface Session {\n  id: string;\n  userId: string;\n  token: string;\n  expiresAt?: Date;\n  createdAt?: Date;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Session data with user and session combined\n * Used for efficient retrieval of both user and session in one call\n */\nexport interface SessionData {\n  user: User;\n  session: Session;\n  expiresAt: number;\n}\n\n/**\n * Auth error types\n */\nexport enum AuthErrorType {\n  INVALID_CREDENTIALS = 'invalid_credentials',\n  USER_NOT_FOUND = 'user_not_found',\n  USER_ALREADY_EXISTS = 'user_already_exists',\n  INVALID_TOKEN = 'invalid_token',\n  TOKEN_EXPIRED = 'token_expired',\n  NETWORK_ERROR = 'network_error',\n  VALIDATION_ERROR = 'validation_error',\n  MFA_REQUIRED = 'mfa_required',\n  EMAIL_NOT_VERIFIED = 'email_not_verified',\n  PHONE_NOT_VERIFIED = 'phone_not_verified',\n  RATE_LIMIT_EXCEEDED = 'rate_limit_exceeded',\n  UNKNOWN_ERROR = 'unknown_error',\n}\n\n/**\n * Auth error class\n * \n * Extends Error to provide proper error handling with auth-specific context\n */\nexport class AuthError extends Error {\n  public readonly type: AuthErrorType;\n  public readonly details?: Record<string, unknown>;\n  public readonly code?: string | number;\n  public readonly originalError?: unknown;\n\n  constructor(\n    message: string,\n    type: AuthErrorType = AuthErrorType.UNKNOWN_ERROR,\n    options?: {\n      details?: Record<string, unknown>;\n      code?: string | number;\n      originalError?: unknown;\n    }\n  ) {\n    super(message);\n    this.name = 'AuthError';\n    this.type = type;\n    this.details = options?.details;\n    this.code = options?.code;\n    this.originalError = options?.originalError;\n\n    // Maintains proper stack trace for where our error was thrown (only available on V8)\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, AuthError);\n    }\n  }\n}\n\n/**\n * Auth context state\n */\nexport interface AuthContext {\n  state: AuthState;\n  user: User | null;\n  session: Session | null;\n  error: AuthError | null;\n  isAuthenticated: boolean;\n  isLoading: boolean;\n}\n\n/**\n * OAuth provider types\n */\nexport enum OAuthProvider {\n  GOOGLE = 'google',\n  GITHUB = 'github',\n  FACEBOOK = 'facebook',\n  TWITTER = 'twitter',\n  MICROSOFT = 'microsoft',\n  APPLE = 'apple',\n  LINKEDIN = 'linkedin',\n  DISCORD = 'discord',\n}\n\n/**\n * OAuth configuration\n */\nexport interface OAuthConfig {\n  provider: OAuthProvider;\n  clientId: string;\n  redirectUri: string;\n  scope?: string[];\n  state?: string;\n}\n\n/**\n * 2FA method types\n */\nexport enum TwoFactorMethod {\n  TOTP = 'totp',\n  SMS = 'sms',\n  EMAIL = 'email',\n  BACKUP_CODE = 'backup_code',\n}\n\n/**\n * 2FA configuration\n */\nexport interface TwoFactorConfig {\n  method: TwoFactorMethod;\n  enabled: boolean;\n  verified?: boolean;\n}\n\n/**\n * Passkey/WebAuthn types\n */\nexport interface PasskeyCredential {\n  id: string;\n  name?: string;\n  createdAt?: Date;\n  lastUsedAt?: Date;\n}\n\n/**\n * Validation error\n */\nexport interface ValidationError {\n  field: string;\n  message: string;\n  code?: string;\n}\n\n/**\n * Organization interface\n */\nexport interface Organization {\n  id: string;\n  name: string;\n  slug: string;\n  logoUrl?: string;\n  createdAt?: Date;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Organization membership interface\n */\nexport interface OrganizationMembership {\n  organization: Organization;\n  role: 'owner' | 'admin' | 'member';\n  permissions?: string[];\n}\n\n/**\n * Device Flow types (RFC 8628 - OAuth 2.0 Device Authorization Grant)\n */\n\n/**\n * Request to initiate device flow\n * Used by CLI/device applications to start the authorization process\n */\nexport interface DeviceFlowInitiateRequest {\n  clientId: string;\n  scope?: string;\n}\n\n/**\n * Response from device flow initiation\n * Contains codes and URIs needed for user authorization\n */\nexport interface DeviceFlowInitiateResponse {\n  /** The device verification code (long, secret code for polling) */\n  deviceCode: string;\n  /** The user-facing code to enter in browser (short, easy-to-type) */\n  userCode: string;\n  /** The URL to visit for verification */\n  verificationUri: string;\n  /** Optional complete URL with user_code pre-filled */\n  verificationUriComplete?: string;\n  /** Lifetime of device_code and user_code in seconds */\n  expiresIn: number;\n  /** Minimum polling interval in seconds */\n  interval: number;\n}\n\n/**\n * Request to verify a user-entered device code\n * Used by the web UI when user enters their code\n */\nexport interface DeviceCodeVerifyRequest {\n  userCode: string;\n}\n\n/**\n * Response from device code verification\n * Contains information about the pending authorization\n */\nexport interface DeviceCodeVerifyResponse {\n  /** Whether the code is valid */\n  valid: boolean;\n  /** Client application name requesting access */\n  clientName?: string;\n  /** Scopes being requested */\n  scopes?: string[];\n  /** Time remaining before code expires */\n  expiresIn?: number;\n}\n\n/**\n * Request to authorize/deny a device\n * Used when user approves or denies the authorization request\n */\nexport interface DeviceAuthorizeRequest {\n  userCode: string;\n  action: 'approve' | 'deny';\n}\n\n/**\n * Request to poll for device token\n * Used by CLI/device to check if user has authorized\n */\nexport interface DeviceTokenPollRequest {\n  deviceCode: string;\n  clientId: string;\n}\n\n/**\n * Status returned when polling is not yet complete\n */\nexport type DeviceTokenPollStatus = \n  | 'authorization_pending'  // User hasn't authorized yet\n  | 'slow_down'              // Polling too frequently\n  | 'expired_token'          // Device code expired\n  | 'access_denied';         // User denied authorization\n\n/**\n * Response from device token polling\n * Either contains the auth response or a status indicator\n */\nexport interface DeviceTokenPollResponse {\n  status: DeviceTokenPollStatus;\n}\n","/**\n * Error handling utilities\n */\n\nimport { AuthError, AuthErrorType } from '../types';\n\n/**\n * Create an auth error\n * \n * @deprecated Use `new AuthError()` directly instead\n */\nexport function createAuthError(\n  type: AuthErrorType,\n  message: string,\n  details?: Record<string, unknown>,\n  code?: string | number\n): AuthError {\n  return new AuthError(message, type, { details, code });\n}\n\n/**\n * Check if an error is an auth error\n */\nexport function isAuthError(error: unknown): error is AuthError {\n  return error instanceof AuthError;\n}\n\n/**\n * Convert unknown error to auth error\n */\nexport function toAuthError(error: unknown): AuthError {\n  if (isAuthError(error)) {\n    return error;\n  }\n\n  if (error instanceof Error) {\n    return new AuthError(error.message, AuthErrorType.UNKNOWN_ERROR, {\n      details: {\n        originalError: error.name,\n        stack: error.stack,\n      },\n    });\n  }\n\n  if (typeof error === 'string') {\n    return new AuthError(error, AuthErrorType.UNKNOWN_ERROR);\n  }\n\n  return new AuthError(\n    'An unknown error occurred',\n    AuthErrorType.UNKNOWN_ERROR,\n    { details: { error } }\n  );\n}\n\n/**\n * Check if error is a network error\n */\nexport function isNetworkError(error: unknown): boolean {\n  if (error instanceof Error) {\n    return (\n      error.name === 'NetworkError' ||\n      error.message.includes('network') ||\n      error.message.includes('fetch')\n    );\n  }\n  return false;\n}\n\n/**\n * Check if error indicates authentication is required\n */\nexport function isUnauthenticatedError(error: unknown): boolean {\n  if (isAuthError(error)) {\n    return (\n      error.type === AuthErrorType.INVALID_TOKEN ||\n      error.type === AuthErrorType.TOKEN_EXPIRED\n    );\n  }\n  return false;\n}\n\n/**\n * Check if error requires MFA\n */\nexport function isMFARequiredError(error: unknown): boolean {\n  if (isAuthError(error)) {\n    return error.type === AuthErrorType.MFA_REQUIRED;\n  }\n  return false;\n}\n","/**\n * Base auth provider implementation\n */\n\nimport type {\n  AuthProvider,\n  AuthResponse,\n  SignInRequest,\n  SignUpRequest,\n  UpdateUserRequest,\n  PasswordChangeRequest,\n  PasswordResetRequest,\n  PasswordResetConfirmRequest,\n  OAuthSignInRequest,\n  OAuthCallbackRequest,\n  MagicLinkRequest,\n  MagicLinkVerifyRequest,\n  PhoneAuthRequest,\n  PhoneVerifyRequest,\n  TwoFactorSetupRequest,\n  TwoFactorSetupResponse,\n  TwoFactorVerifyRequest,\n  PasskeyRegisterRequest,\n  PasskeyAuthRequest,\n  User,\n  Session,\n  SessionData,\n  OAuthProvider,\n  TwoFactorMethod,\n  PasskeyCredential,\n  AuthError,\n  ProviderConfig,\n  RequestContext,\n  CookieData,\n  DeviceFlowInitiateRequest,\n  DeviceFlowInitiateResponse,\n  DeviceCodeVerifyRequest,\n  DeviceCodeVerifyResponse,\n  DeviceAuthorizeRequest,\n  DeviceTokenPollRequest,\n  DeviceTokenPollResponse,\n} from '../types';\nimport { toAuthError } from '../utils';\n\n/**\n * Base provider class with common functionality\n */\nexport abstract class BaseAuthProvider implements AuthProvider {\n  abstract readonly name: string;\n  protected config: ProviderConfig = {};\n  protected initialized = false;\n\n  /**\n   * Initialize the provider\n   */\n  async initialize(config: ProviderConfig): Promise<void> {\n    this.config = config;\n    this.initialized = true;\n  }\n\n  /**\n   * Ensure provider is initialized\n   */\n  protected ensureInitialized(): void {\n    if (!this.initialized) {\n      throw new Error(`Provider ${this.name} is not initialized`);\n    }\n  }\n\n  /**\n   * Make HTTP request\n   */\n  protected async request<T>(\n    url: string,\n    options: RequestInit = {}\n  ): Promise<T> {\n    const response = await fetch(url, {\n      ...options,\n      headers: {\n        'Content-Type': 'application/json',\n        ...options.headers,\n      },\n    });\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({\n        message: response.statusText,\n      }));\n      throw error;\n    }\n\n    return response.json();\n  }\n\n  // Abstract methods that must be implemented by subclasses\n  abstract signIn(request: SignInRequest): Promise<AuthResponse>;\n  abstract signUp(request: SignUpRequest): Promise<AuthResponse>;\n  abstract signOut(): Promise<void>;\n  abstract getCurrentUser(): Promise<User | null>;\n  abstract getCurrentSession(): Promise<Session | null>;\n  abstract getCurrentSessionData(): Promise<SessionData | null>;\n  abstract refreshSession(): Promise<Session>;\n  abstract updateUser(request: UpdateUserRequest): Promise<User>;\n  abstract changePassword(request: PasswordChangeRequest): Promise<void>;\n  abstract requestPasswordReset(request: PasswordResetRequest): Promise<void>;\n  abstract confirmPasswordReset(request: PasswordResetConfirmRequest): Promise<void>;\n  abstract oauthSignIn(request: OAuthSignInRequest): Promise<string>;\n  abstract oauthCallback(request: OAuthCallbackRequest): Promise<AuthResponse>;\n  abstract getOAuthProviders(): Promise<OAuthProvider[]>;\n  abstract sendMagicLink(request: MagicLinkRequest): Promise<void>;\n  abstract verifyMagicLink(request: MagicLinkVerifyRequest): Promise<AuthResponse>;\n  abstract sendPhoneCode(request: PhoneAuthRequest): Promise<void>;\n  abstract verifyPhoneCode(request: PhoneVerifyRequest): Promise<AuthResponse>;\n  abstract setupTwoFactor(request: TwoFactorSetupRequest): Promise<TwoFactorSetupResponse>;\n  abstract verifyTwoFactor(request: TwoFactorVerifyRequest): Promise<AuthResponse>;\n  abstract disableTwoFactor(): Promise<void>;\n  abstract getTwoFactorStatus(): Promise<TwoFactorMethod[]>;\n  abstract registerPasskey(request: PasskeyRegisterRequest): Promise<PasskeyCredential>;\n  abstract authenticatePasskey(request: PasskeyAuthRequest): Promise<AuthResponse>;\n  abstract listPasskeys(): Promise<PasskeyCredential[]>;\n  abstract deletePasskey(credentialId: string): Promise<void>;\n\n  // Device Flow methods (RFC 8628 - OAuth 2.0 Device Authorization Grant)\n  /**\n   * Initiate device authorization flow\n   * Returns device code, user code, and verification URI\n   */\n  abstract initiateDeviceFlow(request: DeviceFlowInitiateRequest): Promise<DeviceFlowInitiateResponse>;\n  \n  /**\n   * Verify a user-entered device code\n   * Called by web UI when user enters the code shown on their device\n   */\n  abstract verifyDeviceCode(request: DeviceCodeVerifyRequest): Promise<DeviceCodeVerifyResponse>;\n  \n  /**\n   * Authorize or deny the device request\n   * Called when user approves or denies the authorization\n   */\n  abstract authorizeDevice(request: DeviceAuthorizeRequest): Promise<void>;\n  \n  /**\n   * Poll for device token (used by CLI/device)\n   * Returns auth response when authorized, or status when still pending\n   */\n  abstract pollDeviceToken(request: DeviceTokenPollRequest): Promise<AuthResponse | DeviceTokenPollResponse>;\n\n  /**\n   * Optional edge runtime context methods\n   * Default implementations do nothing - subclasses can override\n   */\n  setContext?(context: RequestContext): void;\n  getCookies?(): CookieData[];\n  clearContext?(): void;\n\n  /**\n   * Normalize error to AuthError\n   */\n  normalizeError(error: unknown): AuthError {\n    return toAuthError(error);\n  }\n}\n\n"]}

package/dist/adapters/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/types/auth.ts","../../src/utils/errors.ts","../../src/adapters/base-provider.ts"],"names":[],"mappings":";AAmFO,IAAM,SAAA,GAAN,MAAM,UAAA,SAAkB,KAAA,CAAM;AAAA,EAMnC,WAAA,CACE,OAAA,EACA,IAAA,GAAsB,eAAA,sBACtB,OAAA,EAKA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAU,OAAA,EAAS,OAAA;AACxB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AACrB,IAAA,IAAA,CAAK,gBAAgB,OAAA,EAAS,aAAA;AAG9B,IAAA,IAAI,MAAM,iBAAA,EAAmB;AAC3B,MAAA,KAAA,CAAM,iBAAA,CAAkB,MAAM,UAAS,CAAA;AAAA,IACzC;AAAA,EACF;AACF,CAAA;;;ACvFO,SAAS,YAAY,KAAA,EAAoC;AAC9D,EAAA,OAAO,KAAA,YAAiB,SAAA;AAC1B;AAKO,SAAS,YAAY,KAAA,EAA2B;AACrD,EAAA,IAAI,WAAA,CAAY,KAAK,CAAA,EAAG;AACtB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,IAAA,OAAO,IAAI,SAAA,CAAU,KAAA,CAAM,OAAA,EAAA,eAAA,sBAAsC;AAAA,MAC/D,OAAA,EAAS;AAAA,QACP,eAAe,KAAA,CAAM,IAAA;AAAA,QACrB,OAAO,KAAA,CAAM;AAAA;AACf,KACD,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,UAAU,KAAA,EAAA,eAAA,qBAAkC;AAAA,EACzD;AAEA,EAAA,OAAO,IAAI,SAAA;AAAA,IACT,2BAAA;AAAA,IAAA,eAAA;AAAA,IAEA,EAAE,OAAA,EAAS,EAAE,KAAA,EAAM;AAAE,GACvB;AACF;;;ACbO,IAAe,mBAAf,MAAwD;AAAA,EAAxD,WAAA,GAAA;AAEL,IAAA,IAAA,CAAU,SAAyB,EAAC;AACpC,IAAA,IAAA,CAAU,WAAA,GAAc,KAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA,EAKxB,MAAM,WAAW,MAAA,EAAuC;AACtD,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKU,iBAAA,GAA0B;AAClC,IAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,IAAA,CAAK,IAAI,CAAA,mBAAA,CAAqB,CAAA;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAgB,OAAA,CACd,GAAA,EACA,OAAA,GAAuB,EAAC,EACZ;AACZ,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAChC,GAAG,OAAA;AAAA,MACH,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,GAAG,OAAA,CAAQ;AAAA;AACb,KACD,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,QAAQ,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,MAAM,OAAO;AAAA,QAC/C,SAAS,QAAA,CAAS;AAAA,OACpB,CAAE,CAAA;AACF,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,OAAO,SAAS,IAAA,EAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAyCA,eAAe,KAAA,EAA2B;AACxC,IAAA,OAAO,YAAY,KAAK,CAAA;AAAA,EAC1B;AACF","file":"index.mjs","sourcesContent":["/**\n * Core authentication types and interfaces\n */\n\n/**\n * Authentication state enum\n */\nexport enum AuthState {\n  AUTHENTICATED = 'authenticated',\n  UNAUTHENTICATED = 'unauthenticated',\n  LOADING = 'loading',\n  ERROR = 'error',\n}\n\n/**\n * User profile interface\n */\nexport interface User {\n  id: string;\n  email?: string;\n  username?: string;\n  phone?: string;\n  emailVerified?: boolean;\n  phoneVerified?: boolean;\n  name?: string;\n  firstName?: string;\n  lastName?: string;\n  avatar?: string;\n  metadata?: Record<string, unknown>;\n  createdAt?: Date;\n  updatedAt?: Date;\n  \n  // Organization fields\n  organizationId?: string;\n  organizationRole?: string;\n  organizationMemberships?: OrganizationMembership[];\n}\n\n/**\n * Session interface\n */\nexport interface Session {\n  id: string;\n  userId: string;\n  token: string;\n  expiresAt?: Date;\n  createdAt?: Date;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Session data with user and session combined\n * Used for efficient retrieval of both user and session in one call\n */\nexport interface SessionData {\n  user: User;\n  session: Session;\n  expiresAt: number;\n}\n\n/**\n * Auth error types\n */\nexport enum AuthErrorType {\n  INVALID_CREDENTIALS = 'invalid_credentials',\n  USER_NOT_FOUND = 'user_not_found',\n  USER_ALREADY_EXISTS = 'user_already_exists',\n  INVALID_TOKEN = 'invalid_token',\n  TOKEN_EXPIRED = 'token_expired',\n  NETWORK_ERROR = 'network_error',\n  VALIDATION_ERROR = 'validation_error',\n  MFA_REQUIRED = 'mfa_required',\n  EMAIL_NOT_VERIFIED = 'email_not_verified',\n  PHONE_NOT_VERIFIED = 'phone_not_verified',\n  RATE_LIMIT_EXCEEDED = 'rate_limit_exceeded',\n  UNKNOWN_ERROR = 'unknown_error',\n}\n\n/**\n * Auth error class\n * \n * Extends Error to provide proper error handling with auth-specific context\n */\nexport class AuthError extends Error {\n  public readonly type: AuthErrorType;\n  public readonly details?: Record<string, unknown>;\n  public readonly code?: string | number;\n  public readonly originalError?: unknown;\n\n  constructor(\n    message: string,\n    type: AuthErrorType = AuthErrorType.UNKNOWN_ERROR,\n    options?: {\n      details?: Record<string, unknown>;\n      code?: string | number;\n      originalError?: unknown;\n    }\n  ) {\n    super(message);\n    this.name = 'AuthError';\n    this.type = type;\n    this.details = options?.details;\n    this.code = options?.code;\n    this.originalError = options?.originalError;\n\n    // Maintains proper stack trace for where our error was thrown (only available on V8)\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, AuthError);\n    }\n  }\n}\n\n/**\n * Auth context state\n */\nexport interface AuthContext {\n  state: AuthState;\n  user: User | null;\n  session: Session | null;\n  error: AuthError | null;\n  isAuthenticated: boolean;\n  isLoading: boolean;\n}\n\n/**\n * OAuth provider types\n */\nexport enum OAuthProvider {\n  GOOGLE = 'google',\n  GITHUB = 'github',\n  FACEBOOK = 'facebook',\n  TWITTER = 'twitter',\n  MICROSOFT = 'microsoft',\n  APPLE = 'apple',\n  LINKEDIN = 'linkedin',\n  DISCORD = 'discord',\n}\n\n/**\n * OAuth configuration\n */\nexport interface OAuthConfig {\n  provider: OAuthProvider;\n  clientId: string;\n  redirectUri: string;\n  scope?: string[];\n  state?: string;\n}\n\n/**\n * 2FA method types\n */\nexport enum TwoFactorMethod {\n  TOTP = 'totp',\n  SMS = 'sms',\n  EMAIL = 'email',\n  BACKUP_CODE = 'backup_code',\n}\n\n/**\n * 2FA configuration\n */\nexport interface TwoFactorConfig {\n  method: TwoFactorMethod;\n  enabled: boolean;\n  verified?: boolean;\n}\n\n/**\n * Passkey/WebAuthn types\n */\nexport interface PasskeyCredential {\n  id: string;\n  name?: string;\n  createdAt?: Date;\n  lastUsedAt?: Date;\n}\n\n/**\n * Validation error\n */\nexport interface ValidationError {\n  field: string;\n  message: string;\n  code?: string;\n}\n\n/**\n * Organization interface\n */\nexport interface Organization {\n  id: string;\n  name: string;\n  slug: string;\n  logoUrl?: string;\n  createdAt?: Date;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Organization membership interface\n */\nexport interface OrganizationMembership {\n  organization: Organization;\n  role: 'owner' | 'admin' | 'member';\n  permissions?: string[];\n}\n\n","/**\n * Error handling utilities\n */\n\nimport { AuthError, AuthErrorType } from '../types';\n\n/**\n * Create an auth error\n * \n * @deprecated Use `new AuthError()` directly instead\n */\nexport function createAuthError(\n  type: AuthErrorType,\n  message: string,\n  details?: Record<string, unknown>,\n  code?: string | number\n): AuthError {\n  return new AuthError(message, type, { details, code });\n}\n\n/**\n * Check if an error is an auth error\n */\nexport function isAuthError(error: unknown): error is AuthError {\n  return error instanceof AuthError;\n}\n\n/**\n * Convert unknown error to auth error\n */\nexport function toAuthError(error: unknown): AuthError {\n  if (isAuthError(error)) {\n    return error;\n  }\n\n  if (error instanceof Error) {\n    return new AuthError(error.message, AuthErrorType.UNKNOWN_ERROR, {\n      details: {\n        originalError: error.name,\n        stack: error.stack,\n      },\n    });\n  }\n\n  if (typeof error === 'string') {\n    return new AuthError(error, AuthErrorType.UNKNOWN_ERROR);\n  }\n\n  return new AuthError(\n    'An unknown error occurred',\n    AuthErrorType.UNKNOWN_ERROR,\n    { details: { error } }\n  );\n}\n\n/**\n * Check if error is a network error\n */\nexport function isNetworkError(error: unknown): boolean {\n  if (error instanceof Error) {\n    return (\n      error.name === 'NetworkError' ||\n      error.message.includes('network') ||\n      error.message.includes('fetch')\n    );\n  }\n  return false;\n}\n\n/**\n * Check if error indicates authentication is required\n */\nexport function isUnauthenticatedError(error: unknown): boolean {\n  if (isAuthError(error)) {\n    return (\n      error.type === AuthErrorType.INVALID_TOKEN ||\n      error.type === AuthErrorType.TOKEN_EXPIRED\n    );\n  }\n  return false;\n}\n\n/**\n * Check if error requires MFA\n */\nexport function isMFARequiredError(error: unknown): boolean {\n  if (isAuthError(error)) {\n    return error.type === AuthErrorType.MFA_REQUIRED;\n  }\n  return false;\n}\n","/**\n * Base auth provider implementation\n */\n\nimport type {\n  AuthProvider,\n  AuthResponse,\n  SignInRequest,\n  SignUpRequest,\n  UpdateUserRequest,\n  PasswordChangeRequest,\n  PasswordResetRequest,\n  PasswordResetConfirmRequest,\n  OAuthSignInRequest,\n  OAuthCallbackRequest,\n  MagicLinkRequest,\n  MagicLinkVerifyRequest,\n  PhoneAuthRequest,\n  PhoneVerifyRequest,\n  TwoFactorSetupRequest,\n  TwoFactorSetupResponse,\n  TwoFactorVerifyRequest,\n  PasskeyRegisterRequest,\n  PasskeyAuthRequest,\n  User,\n  Session,\n  SessionData,\n  OAuthProvider,\n  TwoFactorMethod,\n  PasskeyCredential,\n  AuthError,\n  ProviderConfig,\n  RequestContext,\n  CookieData,\n} from '../types';\nimport { toAuthError } from '../utils';\n\n/**\n * Base provider class with common functionality\n */\nexport abstract class BaseAuthProvider implements AuthProvider {\n  abstract readonly name: string;\n  protected config: ProviderConfig = {};\n  protected initialized = false;\n\n  /**\n   * Initialize the provider\n   */\n  async initialize(config: ProviderConfig): Promise<void> {\n    this.config = config;\n    this.initialized = true;\n  }\n\n  /**\n   * Ensure provider is initialized\n   */\n  protected ensureInitialized(): void {\n    if (!this.initialized) {\n      throw new Error(`Provider ${this.name} is not initialized`);\n    }\n  }\n\n  /**\n   * Make HTTP request\n   */\n  protected async request<T>(\n    url: string,\n    options: RequestInit = {}\n  ): Promise<T> {\n    const response = await fetch(url, {\n      ...options,\n      headers: {\n        'Content-Type': 'application/json',\n        ...options.headers,\n      },\n    });\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({\n        message: response.statusText,\n      }));\n      throw error;\n    }\n\n    return response.json();\n  }\n\n  // Abstract methods that must be implemented by subclasses\n  abstract signIn(request: SignInRequest): Promise<AuthResponse>;\n  abstract signUp(request: SignUpRequest): Promise<AuthResponse>;\n  abstract signOut(): Promise<void>;\n  abstract getCurrentUser(): Promise<User | null>;\n  abstract getCurrentSession(): Promise<Session | null>;\n  abstract getCurrentSessionData(): Promise<SessionData | null>;\n  abstract refreshSession(): Promise<Session>;\n  abstract updateUser(request: UpdateUserRequest): Promise<User>;\n  abstract changePassword(request: PasswordChangeRequest): Promise<void>;\n  abstract requestPasswordReset(request: PasswordResetRequest): Promise<void>;\n  abstract confirmPasswordReset(request: PasswordResetConfirmRequest): Promise<void>;\n  abstract oauthSignIn(request: OAuthSignInRequest): Promise<string>;\n  abstract oauthCallback(request: OAuthCallbackRequest): Promise<AuthResponse>;\n  abstract getOAuthProviders(): Promise<OAuthProvider[]>;\n  abstract sendMagicLink(request: MagicLinkRequest): Promise<void>;\n  abstract verifyMagicLink(request: MagicLinkVerifyRequest): Promise<AuthResponse>;\n  abstract sendPhoneCode(request: PhoneAuthRequest): Promise<void>;\n  abstract verifyPhoneCode(request: PhoneVerifyRequest): Promise<AuthResponse>;\n  abstract setupTwoFactor(request: TwoFactorSetupRequest): Promise<TwoFactorSetupResponse>;\n  abstract verifyTwoFactor(request: TwoFactorVerifyRequest): Promise<AuthResponse>;\n  abstract disableTwoFactor(): Promise<void>;\n  abstract getTwoFactorStatus(): Promise<TwoFactorMethod[]>;\n  abstract registerPasskey(request: PasskeyRegisterRequest): Promise<PasskeyCredential>;\n  abstract authenticatePasskey(request: PasskeyAuthRequest): Promise<AuthResponse>;\n  abstract listPasskeys(): Promise<PasskeyCredential[]>;\n  abstract deletePasskey(credentialId: string): Promise<void>;\n\n  /**\n   * Optional edge runtime context methods\n   * Default implementations do nothing - subclasses can override\n   */\n  setContext?(context: RequestContext): void;\n  getCookies?(): CookieData[];\n  clearContext?(): void;\n\n  /**\n   * Normalize error to AuthError\n   */\n  normalizeError(error: unknown): AuthError {\n    return toAuthError(error);\n  }\n}\n\n"]}
+{"version":3,"sources":["../../src/types/auth.ts","../../src/utils/errors.ts","../../src/adapters/base-provider.ts"],"names":[],"mappings":";AAmFO,IAAM,SAAA,GAAN,MAAM,UAAA,SAAkB,KAAA,CAAM;AAAA,EAMnC,WAAA,CACE,OAAA,EACA,IAAA,GAAsB,eAAA,sBACtB,OAAA,EAKA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAU,OAAA,EAAS,OAAA;AACxB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AACrB,IAAA,IAAA,CAAK,gBAAgB,OAAA,EAAS,aAAA;AAG9B,IAAA,IAAI,MAAM,iBAAA,EAAmB;AAC3B,MAAA,KAAA,CAAM,iBAAA,CAAkB,MAAM,UAAS,CAAA;AAAA,IACzC;AAAA,EACF;AACF,CAAA;;;ACvFO,SAAS,YAAY,KAAA,EAAoC;AAC9D,EAAA,OAAO,KAAA,YAAiB,SAAA;AAC1B;AAKO,SAAS,YAAY,KAAA,EAA2B;AACrD,EAAA,IAAI,WAAA,CAAY,KAAK,CAAA,EAAG;AACtB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,IAAA,OAAO,IAAI,SAAA,CAAU,KAAA,CAAM,OAAA,EAAA,eAAA,sBAAsC;AAAA,MAC/D,OAAA,EAAS;AAAA,QACP,eAAe,KAAA,CAAM,IAAA;AAAA,QACrB,OAAO,KAAA,CAAM;AAAA;AACf,KACD,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,UAAU,KAAA,EAAA,eAAA,qBAAkC;AAAA,EACzD;AAEA,EAAA,OAAO,IAAI,SAAA;AAAA,IACT,2BAAA;AAAA,IAAA,eAAA;AAAA,IAEA,EAAE,OAAA,EAAS,EAAE,KAAA,EAAM;AAAE,GACvB;AACF;;;ACNO,IAAe,mBAAf,MAAwD;AAAA,EAAxD,WAAA,GAAA;AAEL,IAAA,IAAA,CAAU,SAAyB,EAAC;AACpC,IAAA,IAAA,CAAU,WAAA,GAAc,KAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA,EAKxB,MAAM,WAAW,MAAA,EAAuC;AACtD,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKU,iBAAA,GAA0B;AAClC,IAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,IAAA,CAAK,IAAI,CAAA,mBAAA,CAAqB,CAAA;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAgB,OAAA,CACd,GAAA,EACA,OAAA,GAAuB,EAAC,EACZ;AACZ,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,MAChC,GAAG,OAAA;AAAA,MACH,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,GAAG,OAAA,CAAQ;AAAA;AACb,KACD,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,QAAQ,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,MAAM,OAAO;AAAA,QAC/C,SAAS,QAAA,CAAS;AAAA,OACpB,CAAE,CAAA;AACF,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,OAAO,SAAS,IAAA,EAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAkEA,eAAe,KAAA,EAA2B;AACxC,IAAA,OAAO,YAAY,KAAK,CAAA;AAAA,EAC1B;AACF","file":"index.mjs","sourcesContent":["/**\n * Core authentication types and interfaces\n */\n\n/**\n * Authentication state enum\n */\nexport enum AuthState {\n  AUTHENTICATED = 'authenticated',\n  UNAUTHENTICATED = 'unauthenticated',\n  LOADING = 'loading',\n  ERROR = 'error',\n}\n\n/**\n * User profile interface\n */\nexport interface User {\n  id: string;\n  email?: string;\n  username?: string;\n  phone?: string;\n  emailVerified?: boolean;\n  phoneVerified?: boolean;\n  name?: string;\n  firstName?: string;\n  lastName?: string;\n  avatar?: string;\n  metadata?: Record<string, unknown>;\n  createdAt?: Date;\n  updatedAt?: Date;\n  \n  // Organization fields\n  organizationId?: string;\n  organizationRole?: string;\n  organizationMemberships?: OrganizationMembership[];\n}\n\n/**\n * Session interface\n */\nexport interface Session {\n  id: string;\n  userId: string;\n  token: string;\n  expiresAt?: Date;\n  createdAt?: Date;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Session data with user and session combined\n * Used for efficient retrieval of both user and session in one call\n */\nexport interface SessionData {\n  user: User;\n  session: Session;\n  expiresAt: number;\n}\n\n/**\n * Auth error types\n */\nexport enum AuthErrorType {\n  INVALID_CREDENTIALS = 'invalid_credentials',\n  USER_NOT_FOUND = 'user_not_found',\n  USER_ALREADY_EXISTS = 'user_already_exists',\n  INVALID_TOKEN = 'invalid_token',\n  TOKEN_EXPIRED = 'token_expired',\n  NETWORK_ERROR = 'network_error',\n  VALIDATION_ERROR = 'validation_error',\n  MFA_REQUIRED = 'mfa_required',\n  EMAIL_NOT_VERIFIED = 'email_not_verified',\n  PHONE_NOT_VERIFIED = 'phone_not_verified',\n  RATE_LIMIT_EXCEEDED = 'rate_limit_exceeded',\n  UNKNOWN_ERROR = 'unknown_error',\n}\n\n/**\n * Auth error class\n * \n * Extends Error to provide proper error handling with auth-specific context\n */\nexport class AuthError extends Error {\n  public readonly type: AuthErrorType;\n  public readonly details?: Record<string, unknown>;\n  public readonly code?: string | number;\n  public readonly originalError?: unknown;\n\n  constructor(\n    message: string,\n    type: AuthErrorType = AuthErrorType.UNKNOWN_ERROR,\n    options?: {\n      details?: Record<string, unknown>;\n      code?: string | number;\n      originalError?: unknown;\n    }\n  ) {\n    super(message);\n    this.name = 'AuthError';\n    this.type = type;\n    this.details = options?.details;\n    this.code = options?.code;\n    this.originalError = options?.originalError;\n\n    // Maintains proper stack trace for where our error was thrown (only available on V8)\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, AuthError);\n    }\n  }\n}\n\n/**\n * Auth context state\n */\nexport interface AuthContext {\n  state: AuthState;\n  user: User | null;\n  session: Session | null;\n  error: AuthError | null;\n  isAuthenticated: boolean;\n  isLoading: boolean;\n}\n\n/**\n * OAuth provider types\n */\nexport enum OAuthProvider {\n  GOOGLE = 'google',\n  GITHUB = 'github',\n  FACEBOOK = 'facebook',\n  TWITTER = 'twitter',\n  MICROSOFT = 'microsoft',\n  APPLE = 'apple',\n  LINKEDIN = 'linkedin',\n  DISCORD = 'discord',\n}\n\n/**\n * OAuth configuration\n */\nexport interface OAuthConfig {\n  provider: OAuthProvider;\n  clientId: string;\n  redirectUri: string;\n  scope?: string[];\n  state?: string;\n}\n\n/**\n * 2FA method types\n */\nexport enum TwoFactorMethod {\n  TOTP = 'totp',\n  SMS = 'sms',\n  EMAIL = 'email',\n  BACKUP_CODE = 'backup_code',\n}\n\n/**\n * 2FA configuration\n */\nexport interface TwoFactorConfig {\n  method: TwoFactorMethod;\n  enabled: boolean;\n  verified?: boolean;\n}\n\n/**\n * Passkey/WebAuthn types\n */\nexport interface PasskeyCredential {\n  id: string;\n  name?: string;\n  createdAt?: Date;\n  lastUsedAt?: Date;\n}\n\n/**\n * Validation error\n */\nexport interface ValidationError {\n  field: string;\n  message: string;\n  code?: string;\n}\n\n/**\n * Organization interface\n */\nexport interface Organization {\n  id: string;\n  name: string;\n  slug: string;\n  logoUrl?: string;\n  createdAt?: Date;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Organization membership interface\n */\nexport interface OrganizationMembership {\n  organization: Organization;\n  role: 'owner' | 'admin' | 'member';\n  permissions?: string[];\n}\n\n/**\n * Device Flow types (RFC 8628 - OAuth 2.0 Device Authorization Grant)\n */\n\n/**\n * Request to initiate device flow\n * Used by CLI/device applications to start the authorization process\n */\nexport interface DeviceFlowInitiateRequest {\n  clientId: string;\n  scope?: string;\n}\n\n/**\n * Response from device flow initiation\n * Contains codes and URIs needed for user authorization\n */\nexport interface DeviceFlowInitiateResponse {\n  /** The device verification code (long, secret code for polling) */\n  deviceCode: string;\n  /** The user-facing code to enter in browser (short, easy-to-type) */\n  userCode: string;\n  /** The URL to visit for verification */\n  verificationUri: string;\n  /** Optional complete URL with user_code pre-filled */\n  verificationUriComplete?: string;\n  /** Lifetime of device_code and user_code in seconds */\n  expiresIn: number;\n  /** Minimum polling interval in seconds */\n  interval: number;\n}\n\n/**\n * Request to verify a user-entered device code\n * Used by the web UI when user enters their code\n */\nexport interface DeviceCodeVerifyRequest {\n  userCode: string;\n}\n\n/**\n * Response from device code verification\n * Contains information about the pending authorization\n */\nexport interface DeviceCodeVerifyResponse {\n  /** Whether the code is valid */\n  valid: boolean;\n  /** Client application name requesting access */\n  clientName?: string;\n  /** Scopes being requested */\n  scopes?: string[];\n  /** Time remaining before code expires */\n  expiresIn?: number;\n}\n\n/**\n * Request to authorize/deny a device\n * Used when user approves or denies the authorization request\n */\nexport interface DeviceAuthorizeRequest {\n  userCode: string;\n  action: 'approve' | 'deny';\n}\n\n/**\n * Request to poll for device token\n * Used by CLI/device to check if user has authorized\n */\nexport interface DeviceTokenPollRequest {\n  deviceCode: string;\n  clientId: string;\n}\n\n/**\n * Status returned when polling is not yet complete\n */\nexport type DeviceTokenPollStatus = \n  | 'authorization_pending'  // User hasn't authorized yet\n  | 'slow_down'              // Polling too frequently\n  | 'expired_token'          // Device code expired\n  | 'access_denied';         // User denied authorization\n\n/**\n * Response from device token polling\n * Either contains the auth response or a status indicator\n */\nexport interface DeviceTokenPollResponse {\n  status: DeviceTokenPollStatus;\n}\n","/**\n * Error handling utilities\n */\n\nimport { AuthError, AuthErrorType } from '../types';\n\n/**\n * Create an auth error\n * \n * @deprecated Use `new AuthError()` directly instead\n */\nexport function createAuthError(\n  type: AuthErrorType,\n  message: string,\n  details?: Record<string, unknown>,\n  code?: string | number\n): AuthError {\n  return new AuthError(message, type, { details, code });\n}\n\n/**\n * Check if an error is an auth error\n */\nexport function isAuthError(error: unknown): error is AuthError {\n  return error instanceof AuthError;\n}\n\n/**\n * Convert unknown error to auth error\n */\nexport function toAuthError(error: unknown): AuthError {\n  if (isAuthError(error)) {\n    return error;\n  }\n\n  if (error instanceof Error) {\n    return new AuthError(error.message, AuthErrorType.UNKNOWN_ERROR, {\n      details: {\n        originalError: error.name,\n        stack: error.stack,\n      },\n    });\n  }\n\n  if (typeof error === 'string') {\n    return new AuthError(error, AuthErrorType.UNKNOWN_ERROR);\n  }\n\n  return new AuthError(\n    'An unknown error occurred',\n    AuthErrorType.UNKNOWN_ERROR,\n    { details: { error } }\n  );\n}\n\n/**\n * Check if error is a network error\n */\nexport function isNetworkError(error: unknown): boolean {\n  if (error instanceof Error) {\n    return (\n      error.name === 'NetworkError' ||\n      error.message.includes('network') ||\n      error.message.includes('fetch')\n    );\n  }\n  return false;\n}\n\n/**\n * Check if error indicates authentication is required\n */\nexport function isUnauthenticatedError(error: unknown): boolean {\n  if (isAuthError(error)) {\n    return (\n      error.type === AuthErrorType.INVALID_TOKEN ||\n      error.type === AuthErrorType.TOKEN_EXPIRED\n    );\n  }\n  return false;\n}\n\n/**\n * Check if error requires MFA\n */\nexport function isMFARequiredError(error: unknown): boolean {\n  if (isAuthError(error)) {\n    return error.type === AuthErrorType.MFA_REQUIRED;\n  }\n  return false;\n}\n","/**\n * Base auth provider implementation\n */\n\nimport type {\n  AuthProvider,\n  AuthResponse,\n  SignInRequest,\n  SignUpRequest,\n  UpdateUserRequest,\n  PasswordChangeRequest,\n  PasswordResetRequest,\n  PasswordResetConfirmRequest,\n  OAuthSignInRequest,\n  OAuthCallbackRequest,\n  MagicLinkRequest,\n  MagicLinkVerifyRequest,\n  PhoneAuthRequest,\n  PhoneVerifyRequest,\n  TwoFactorSetupRequest,\n  TwoFactorSetupResponse,\n  TwoFactorVerifyRequest,\n  PasskeyRegisterRequest,\n  PasskeyAuthRequest,\n  User,\n  Session,\n  SessionData,\n  OAuthProvider,\n  TwoFactorMethod,\n  PasskeyCredential,\n  AuthError,\n  ProviderConfig,\n  RequestContext,\n  CookieData,\n  DeviceFlowInitiateRequest,\n  DeviceFlowInitiateResponse,\n  DeviceCodeVerifyRequest,\n  DeviceCodeVerifyResponse,\n  DeviceAuthorizeRequest,\n  DeviceTokenPollRequest,\n  DeviceTokenPollResponse,\n} from '../types';\nimport { toAuthError } from '../utils';\n\n/**\n * Base provider class with common functionality\n */\nexport abstract class BaseAuthProvider implements AuthProvider {\n  abstract readonly name: string;\n  protected config: ProviderConfig = {};\n  protected initialized = false;\n\n  /**\n   * Initialize the provider\n   */\n  async initialize(config: ProviderConfig): Promise<void> {\n    this.config = config;\n    this.initialized = true;\n  }\n\n  /**\n   * Ensure provider is initialized\n   */\n  protected ensureInitialized(): void {\n    if (!this.initialized) {\n      throw new Error(`Provider ${this.name} is not initialized`);\n    }\n  }\n\n  /**\n   * Make HTTP request\n   */\n  protected async request<T>(\n    url: string,\n    options: RequestInit = {}\n  ): Promise<T> {\n    const response = await fetch(url, {\n      ...options,\n      headers: {\n        'Content-Type': 'application/json',\n        ...options.headers,\n      },\n    });\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({\n        message: response.statusText,\n      }));\n      throw error;\n    }\n\n    return response.json();\n  }\n\n  // Abstract methods that must be implemented by subclasses\n  abstract signIn(request: SignInRequest): Promise<AuthResponse>;\n  abstract signUp(request: SignUpRequest): Promise<AuthResponse>;\n  abstract signOut(): Promise<void>;\n  abstract getCurrentUser(): Promise<User | null>;\n  abstract getCurrentSession(): Promise<Session | null>;\n  abstract getCurrentSessionData(): Promise<SessionData | null>;\n  abstract refreshSession(): Promise<Session>;\n  abstract updateUser(request: UpdateUserRequest): Promise<User>;\n  abstract changePassword(request: PasswordChangeRequest): Promise<void>;\n  abstract requestPasswordReset(request: PasswordResetRequest): Promise<void>;\n  abstract confirmPasswordReset(request: PasswordResetConfirmRequest): Promise<void>;\n  abstract oauthSignIn(request: OAuthSignInRequest): Promise<string>;\n  abstract oauthCallback(request: OAuthCallbackRequest): Promise<AuthResponse>;\n  abstract getOAuthProviders(): Promise<OAuthProvider[]>;\n  abstract sendMagicLink(request: MagicLinkRequest): Promise<void>;\n  abstract verifyMagicLink(request: MagicLinkVerifyRequest): Promise<AuthResponse>;\n  abstract sendPhoneCode(request: PhoneAuthRequest): Promise<void>;\n  abstract verifyPhoneCode(request: PhoneVerifyRequest): Promise<AuthResponse>;\n  abstract setupTwoFactor(request: TwoFactorSetupRequest): Promise<TwoFactorSetupResponse>;\n  abstract verifyTwoFactor(request: TwoFactorVerifyRequest): Promise<AuthResponse>;\n  abstract disableTwoFactor(): Promise<void>;\n  abstract getTwoFactorStatus(): Promise<TwoFactorMethod[]>;\n  abstract registerPasskey(request: PasskeyRegisterRequest): Promise<PasskeyCredential>;\n  abstract authenticatePasskey(request: PasskeyAuthRequest): Promise<AuthResponse>;\n  abstract listPasskeys(): Promise<PasskeyCredential[]>;\n  abstract deletePasskey(credentialId: string): Promise<void>;\n\n  // Device Flow methods (RFC 8628 - OAuth 2.0 Device Authorization Grant)\n  /**\n   * Initiate device authorization flow\n   * Returns device code, user code, and verification URI\n   */\n  abstract initiateDeviceFlow(request: DeviceFlowInitiateRequest): Promise<DeviceFlowInitiateResponse>;\n  \n  /**\n   * Verify a user-entered device code\n   * Called by web UI when user enters the code shown on their device\n   */\n  abstract verifyDeviceCode(request: DeviceCodeVerifyRequest): Promise<DeviceCodeVerifyResponse>;\n  \n  /**\n   * Authorize or deny the device request\n   * Called when user approves or denies the authorization\n   */\n  abstract authorizeDevice(request: DeviceAuthorizeRequest): Promise<void>;\n  \n  /**\n   * Poll for device token (used by CLI/device)\n   * Returns auth response when authorized, or status when still pending\n   */\n  abstract pollDeviceToken(request: DeviceTokenPollRequest): Promise<AuthResponse | DeviceTokenPollResponse>;\n\n  /**\n   * Optional edge runtime context methods\n   * Default implementations do nothing - subclasses can override\n   */\n  setContext?(context: RequestContext): void;\n  getCookies?(): CookieData[];\n  clearContext?(): void;\n\n  /**\n   * Normalize error to AuthError\n   */\n  normalizeError(error: unknown): AuthError {\n    return toAuthError(error);\n  }\n}\n\n"]}

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { A as AuthErrorType, a as AuthError, V as ValidationError, C as CookieData, b as AuthContext, c as AuthProvider, S as SignInRequest, d as SignUpRequest, U as UpdateUserRequest, P as PasswordChangeRequest, e as PasswordResetRequest, f as PasswordResetConfirmRequest, O as OAuthSignInRequest, g as OAuthCallbackRequest, h as OAuthProvider, M as MagicLinkRequest, i as MagicLinkVerifyRequest, j as PhoneAuthRequest, k as PhoneVerifyRequest, T as TwoFactorSetupRequest, l as TwoFactorSetupResponse, m as TwoFactorVerifyRequest, n as TwoFactorMethod, o as PasskeyRegisterRequest, p as PasskeyCredential, q as PasskeyAuthRequest, r as Organization, s as OrganizationMembership, t as User, u as Session } from './provider-Du6Oe4tD.mjs';
-export { E as AuthResponse, v as AuthState, B as FieldDefinition, z as FieldType, F as FieldValidation, x as OAuthConfig, G as ProviderConfig, R as RequestContext, w as SessionData, D as SignupFieldsResponse, y as TwoFactorConfig } from './provider-Du6Oe4tD.mjs';
+import { A as AuthErrorType, a as AuthError, V as ValidationError, C as CookieData, b as AuthContext, c as AuthProvider, S as SignInRequest, d as SignUpRequest, U as UpdateUserRequest, P as PasswordChangeRequest, e as PasswordResetRequest, f as PasswordResetConfirmRequest, O as OAuthSignInRequest, g as OAuthCallbackRequest, h as OAuthProvider, M as MagicLinkRequest, i as MagicLinkVerifyRequest, j as PhoneAuthRequest, k as PhoneVerifyRequest, T as TwoFactorSetupRequest, l as TwoFactorSetupResponse, m as TwoFactorVerifyRequest, n as TwoFactorMethod, o as PasskeyRegisterRequest, p as PasskeyCredential, q as PasskeyAuthRequest, r as Organization, s as OrganizationMembership, t as User, u as Session } from './provider-DWklI8Wr.mjs';
+export { Q as AuthResponse, v as AuthState, a3 as Device, F as DeviceAuthorizeRequest, B as DeviceCodeVerifyRequest, E as DeviceCodeVerifyResponse, D as DeviceFlowInitiateRequest, z as DeviceFlowInitiateResponse, G as DeviceTokenPollRequest, I as DeviceTokenPollResponse, H as DeviceTokenPollStatus, $ as EnrollMFAFactorRequest, L as FieldDefinition, K as FieldType, J as FieldValidation, a5 as ListSessionsOptions, a6 as ListSessionsResponse, a1 as MFAChallengeRequest, a2 as MFAChallengeResponse, _ as MFAFactor, x as OAuthConfig, R as ProviderConfig, W as RequestContext, Z as ResendVerificationRequest, X as SendVerificationEmailRequest, w as SessionData, a4 as SessionInfo, N as SignupFieldsResponse, y as TwoFactorConfig, Y as VerifyEmailRequest, a0 as VerifyMFAFactorRequest } from './provider-DWklI8Wr.mjs';
 import { Storage, Observable, Unsubscribe } from './types/index.mjs';
 export { Listener, LocalStorageAdapter, MemoryStorageAdapter, SessionStorageAdapter } from './types/index.mjs';
 export { BaseAuthProvider } from './adapters/index.mjs';
@@ -104,6 +104,40 @@ interface AuthLocale {
         register: string;
         usePasskey: string;
     };
+    deviceFlow: {
+        title: string;
+        subtitle: string;
+        enterCode: string;
+        enterCodeDescription: string;
+        codeLabel: string;
+        codePlaceholder: string;
+        codeHint: string;
+        verify: string;
+        verifyCode: string;
+        invalidCode: string;
+        noCode: string;
+        getCodeHelp: string;
+        authorizationTitle: string;
+        authorizationSubtitle: string;
+        authorizeTitle: string;
+        authorizeDescription: string;
+        requestingAccess: string;
+        codeConfirm: string;
+        requestedPermissions: string;
+        securityWarning: string;
+        scopes: string;
+        approve: string;
+        deny: string;
+        authorizedTitle: string;
+        authorizedMessage: string;
+        authorizedDescription: string;
+        authorizedHint: string;
+        returnToCli: string;
+        deniedTitle: string;
+        deniedMessage: string;
+        deniedDescription: string;
+        deniedHint: string;
+    };
     signUp: {
         title: string;
         subtitle: string;
@@ -554,6 +588,13 @@ declare enum FlowStep {
     PASSWORD_CHANGE = "password_change",
     PROFILE_UPDATE = "profile_update",
     PROFILE_COMPLETE = "profile_complete",
+    DEVICE_FLOW_INITIATE = "device_flow_initiate",
+    DEVICE_CODE_ENTRY = "device_code_entry",
+    DEVICE_CODE_VERIFY = "device_code_verify",
+    DEVICE_AUTHORIZE = "device_authorize",
+    DEVICE_POLLING = "device_polling",
+    DEVICE_AUTHORIZED = "device_authorized",
+    DEVICE_DENIED = "device_denied",
     SUCCESS = "success",
     ERROR = "error",
     CANCELLED = "cancelled"
@@ -569,6 +610,7 @@ interface FlowState {
     email?: string;
     phone?: string;
     username?: string;
+    token?: string;
     mfaRequired?: boolean;
     mfaMethods?: TwoFactorMethod[];
     mfaToken?: string;
@@ -577,6 +619,15 @@ interface FlowState {
     verificationRequired?: boolean;
     verificationToken?: string;
     verificationSent?: boolean;
+    deviceCode?: string;
+    userCode?: string;
+    verificationUri?: string;
+    verificationUriComplete?: string;
+    deviceCodeExpiresIn?: number;
+    devicePollingInterval?: number;
+    deviceClientId?: string;
+    deviceScopes?: string[];
+    deviceAuthorized?: boolean;
     error?: AuthError;
     metadata?: Record<string, unknown>;
 }
@@ -627,6 +678,7 @@ declare enum FlowConfigType {
     SECURE_SIGN_IN_FLOW = "secure_sign_in_flow",// signin → MFA → success
     PASSWORD_RESET_FLOW = "password_reset_flow",
     EMAIL_VERIFICATION_FLOW = "email_verification_flow",
+    DEVICE_FLOW = "device_flow",
     CUSTOM = "custom"
 }
 /**
@@ -767,6 +819,7 @@ declare const predefinedFlows: {
     oauth_sign_in: FlowConfig;
     password_reset_flow: FlowConfig;
     email_verification_flow: FlowConfig;
+    device_flow: FlowConfig;
 };
 
 export { AuthClient, type AuthClientConfig, AuthContext, AuthError, AuthErrorType, type AuthLocale, AuthProvider, CookieData, type DeepPartial, FlowAction, type FlowConfig, FlowConfigType, FlowEngine, type FlowEvent, type FlowState, FlowStep, type FlowTransition, MagicLinkRequest, MagicLinkVerifyRequest, OAuthCallbackRequest, OAuthProvider, OAuthSignInRequest, Observable, Organization, OrganizationMembership, PasskeyAuthRequest, PasskeyCredential, PasskeyRegisterRequest, PasswordChangeRequest, PasswordResetConfirmRequest, PasswordResetRequest, PhoneAuthRequest, PhoneVerifyRequest, Session, SignInRequest, SignUpRequest, Storage, TokenManager, TwoFactorMethod, TwoFactorSetupRequest, TwoFactorSetupResponse, TwoFactorVerifyRequest, Unsubscribe, UpdateUserRequest, User, ValidationError, completeSignUpFlow, createAuthError, createLocale, defaultLocale, emailVerificationFlow, extractCookiesFromHeaders, getFlowConfig, interpolate, isAuthError, isMFARequiredError, isNetworkError, isUnauthenticatedError, magicLinkFlow, oauthSignInFlow, parseCookie, parseCookieOptions, passwordResetFlow, phoneAuthFlow, predefinedFlows, serializeCookie, serializeCookies, signInWithMFAFlow, simpleSignInFlow, toAuthError, validate2FACode, validateEmail, validatePassword, validatePhone, validateRequired, validateUsername };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { A as AuthErrorType, a as AuthError, V as ValidationError, C as CookieData, b as AuthContext, c as AuthProvider, S as SignInRequest, d as SignUpRequest, U as UpdateUserRequest, P as PasswordChangeRequest, e as PasswordResetRequest, f as PasswordResetConfirmRequest, O as OAuthSignInRequest, g as OAuthCallbackRequest, h as OAuthProvider, M as MagicLinkRequest, i as MagicLinkVerifyRequest, j as PhoneAuthRequest, k as PhoneVerifyRequest, T as TwoFactorSetupRequest, l as TwoFactorSetupResponse, m as TwoFactorVerifyRequest, n as TwoFactorMethod, o as PasskeyRegisterRequest, p as PasskeyCredential, q as PasskeyAuthRequest, r as Organization, s as OrganizationMembership, t as User, u as Session } from './provider-Du6Oe4tD.js';
-export { E as AuthResponse, v as AuthState, B as FieldDefinition, z as FieldType, F as FieldValidation, x as OAuthConfig, G as ProviderConfig, R as RequestContext, w as SessionData, D as SignupFieldsResponse, y as TwoFactorConfig } from './provider-Du6Oe4tD.js';
+import { A as AuthErrorType, a as AuthError, V as ValidationError, C as CookieData, b as AuthContext, c as AuthProvider, S as SignInRequest, d as SignUpRequest, U as UpdateUserRequest, P as PasswordChangeRequest, e as PasswordResetRequest, f as PasswordResetConfirmRequest, O as OAuthSignInRequest, g as OAuthCallbackRequest, h as OAuthProvider, M as MagicLinkRequest, i as MagicLinkVerifyRequest, j as PhoneAuthRequest, k as PhoneVerifyRequest, T as TwoFactorSetupRequest, l as TwoFactorSetupResponse, m as TwoFactorVerifyRequest, n as TwoFactorMethod, o as PasskeyRegisterRequest, p as PasskeyCredential, q as PasskeyAuthRequest, r as Organization, s as OrganizationMembership, t as User, u as Session } from './provider-DWklI8Wr.js';
+export { Q as AuthResponse, v as AuthState, a3 as Device, F as DeviceAuthorizeRequest, B as DeviceCodeVerifyRequest, E as DeviceCodeVerifyResponse, D as DeviceFlowInitiateRequest, z as DeviceFlowInitiateResponse, G as DeviceTokenPollRequest, I as DeviceTokenPollResponse, H as DeviceTokenPollStatus, $ as EnrollMFAFactorRequest, L as FieldDefinition, K as FieldType, J as FieldValidation, a5 as ListSessionsOptions, a6 as ListSessionsResponse, a1 as MFAChallengeRequest, a2 as MFAChallengeResponse, _ as MFAFactor, x as OAuthConfig, R as ProviderConfig, W as RequestContext, Z as ResendVerificationRequest, X as SendVerificationEmailRequest, w as SessionData, a4 as SessionInfo, N as SignupFieldsResponse, y as TwoFactorConfig, Y as VerifyEmailRequest, a0 as VerifyMFAFactorRequest } from './provider-DWklI8Wr.js';
 import { Storage, Observable, Unsubscribe } from './types/index.js';
 export { Listener, LocalStorageAdapter, MemoryStorageAdapter, SessionStorageAdapter } from './types/index.js';
 export { BaseAuthProvider } from './adapters/index.js';
@@ -104,6 +104,40 @@ interface AuthLocale {
         register: string;
         usePasskey: string;
     };
+    deviceFlow: {
+        title: string;
+        subtitle: string;
+        enterCode: string;
+        enterCodeDescription: string;
+        codeLabel: string;
+        codePlaceholder: string;
+        codeHint: string;
+        verify: string;
+        verifyCode: string;
+        invalidCode: string;
+        noCode: string;
+        getCodeHelp: string;
+        authorizationTitle: string;
+        authorizationSubtitle: string;
+        authorizeTitle: string;
+        authorizeDescription: string;
+        requestingAccess: string;
+        codeConfirm: string;
+        requestedPermissions: string;
+        securityWarning: string;
+        scopes: string;
+        approve: string;
+        deny: string;
+        authorizedTitle: string;
+        authorizedMessage: string;
+        authorizedDescription: string;
+        authorizedHint: string;
+        returnToCli: string;
+        deniedTitle: string;
+        deniedMessage: string;
+        deniedDescription: string;
+        deniedHint: string;
+    };
     signUp: {
         title: string;
         subtitle: string;
@@ -554,6 +588,13 @@ declare enum FlowStep {
     PASSWORD_CHANGE = "password_change",
     PROFILE_UPDATE = "profile_update",
     PROFILE_COMPLETE = "profile_complete",
+    DEVICE_FLOW_INITIATE = "device_flow_initiate",
+    DEVICE_CODE_ENTRY = "device_code_entry",
+    DEVICE_CODE_VERIFY = "device_code_verify",
+    DEVICE_AUTHORIZE = "device_authorize",
+    DEVICE_POLLING = "device_polling",
+    DEVICE_AUTHORIZED = "device_authorized",
+    DEVICE_DENIED = "device_denied",
     SUCCESS = "success",
     ERROR = "error",
     CANCELLED = "cancelled"
@@ -569,6 +610,7 @@ interface FlowState {
     email?: string;
     phone?: string;
     username?: string;
+    token?: string;
     mfaRequired?: boolean;
     mfaMethods?: TwoFactorMethod[];
     mfaToken?: string;
@@ -577,6 +619,15 @@ interface FlowState {
     verificationRequired?: boolean;
     verificationToken?: string;
     verificationSent?: boolean;
+    deviceCode?: string;
+    userCode?: string;
+    verificationUri?: string;
+    verificationUriComplete?: string;
+    deviceCodeExpiresIn?: number;
+    devicePollingInterval?: number;
+    deviceClientId?: string;
+    deviceScopes?: string[];
+    deviceAuthorized?: boolean;
     error?: AuthError;
     metadata?: Record<string, unknown>;
 }
@@ -627,6 +678,7 @@ declare enum FlowConfigType {
     SECURE_SIGN_IN_FLOW = "secure_sign_in_flow",// signin → MFA → success
     PASSWORD_RESET_FLOW = "password_reset_flow",
     EMAIL_VERIFICATION_FLOW = "email_verification_flow",
+    DEVICE_FLOW = "device_flow",
     CUSTOM = "custom"
 }
 /**
@@ -767,6 +819,7 @@ declare const predefinedFlows: {
     oauth_sign_in: FlowConfig;
     password_reset_flow: FlowConfig;
     email_verification_flow: FlowConfig;
+    device_flow: FlowConfig;
 };
 
 export { AuthClient, type AuthClientConfig, AuthContext, AuthError, AuthErrorType, type AuthLocale, AuthProvider, CookieData, type DeepPartial, FlowAction, type FlowConfig, FlowConfigType, FlowEngine, type FlowEvent, type FlowState, FlowStep, type FlowTransition, MagicLinkRequest, MagicLinkVerifyRequest, OAuthCallbackRequest, OAuthProvider, OAuthSignInRequest, Observable, Organization, OrganizationMembership, PasskeyAuthRequest, PasskeyCredential, PasskeyRegisterRequest, PasswordChangeRequest, PasswordResetConfirmRequest, PasswordResetRequest, PhoneAuthRequest, PhoneVerifyRequest, Session, SignInRequest, SignUpRequest, Storage, TokenManager, TwoFactorMethod, TwoFactorSetupRequest, TwoFactorSetupResponse, TwoFactorVerifyRequest, Unsubscribe, UpdateUserRequest, User, ValidationError, completeSignUpFlow, createAuthError, createLocale, defaultLocale, emailVerificationFlow, extractCookiesFromHeaders, getFlowConfig, interpolate, isAuthError, isMFARequiredError, isNetworkError, isUnauthenticatedError, magicLinkFlow, oauthSignInFlow, parseCookie, parseCookieOptions, passwordResetFlow, phoneAuthFlow, predefinedFlows, serializeCookie, serializeCookies, signInWithMFAFlow, simpleSignInFlow, toAuthError, validate2FACode, validateEmail, validatePassword, validatePhone, validateRequired, validateUsername };

package/dist/index.js

@@ -278,6 +278,40 @@ var enLocale = {
     register: "Register passkey",
     usePasskey: "Use passkey"
   },
+  deviceFlow: {
+    title: "Authorize Device",
+    subtitle: "Enter the code displayed on your device",
+    enterCode: "Authorize Device",
+    enterCodeDescription: "Enter the code displayed on your device or CLI",
+    codeLabel: "Device Code",
+    codePlaceholder: "XXXX-XXXX",
+    codeHint: "Enter the 8-character code shown on your device",
+    verify: "Verify Code",
+    verifyCode: "Verify Code",
+    invalidCode: "Invalid code. Please check and try again.",
+    noCode: "Don't have a code?",
+    getCodeHelp: "Get help",
+    authorizationTitle: "Authorize Application",
+    authorizationSubtitle: "An application is requesting access to your account",
+    authorizeTitle: "Authorize Device",
+    authorizeDescription: "An application is requesting access to your account",
+    requestingAccess: "is requesting access to:",
+    codeConfirm: "Confirm this is your code:",
+    requestedPermissions: "Requested permissions:",
+    securityWarning: "Only approve this request if you initiated it",
+    scopes: "Requested permissions",
+    approve: "Approve",
+    deny: "Deny",
+    authorizedTitle: "Device Authorized",
+    authorizedMessage: "You can now return to your device to continue",
+    authorizedDescription: "Your device has been successfully authorized",
+    authorizedHint: "You can close this window and return to your CLI or device",
+    returnToCli: "Return to CLI",
+    deniedTitle: "Access Denied",
+    deniedMessage: "You have denied access to this device",
+    deniedDescription: "The device authorization request has been denied",
+    deniedHint: "You can close this window"
+  },
   signUp: {
     title: "Create Account",
     subtitle: "Get started with your account",
@@ -1235,6 +1269,13 @@ var FlowStep = /* @__PURE__ */ ((FlowStep2) => {
   FlowStep2["PASSWORD_CHANGE"] = "password_change";
   FlowStep2["PROFILE_UPDATE"] = "profile_update";
   FlowStep2["PROFILE_COMPLETE"] = "profile_complete";
+  FlowStep2["DEVICE_FLOW_INITIATE"] = "device_flow_initiate";
+  FlowStep2["DEVICE_CODE_ENTRY"] = "device_code_entry";
+  FlowStep2["DEVICE_CODE_VERIFY"] = "device_code_verify";
+  FlowStep2["DEVICE_AUTHORIZE"] = "device_authorize";
+  FlowStep2["DEVICE_POLLING"] = "device_polling";
+  FlowStep2["DEVICE_AUTHORIZED"] = "device_authorized";
+  FlowStep2["DEVICE_DENIED"] = "device_denied";
   FlowStep2["SUCCESS"] = "success";
   FlowStep2["ERROR"] = "error";
   FlowStep2["CANCELLED"] = "cancelled";
@@ -1252,6 +1293,7 @@ var FlowConfigType = /* @__PURE__ */ ((FlowConfigType2) => {
   FlowConfigType2["SECURE_SIGN_IN_FLOW"] = "secure_sign_in_flow";
   FlowConfigType2["PASSWORD_RESET_FLOW"] = "password_reset_flow";
   FlowConfigType2["EMAIL_VERIFICATION_FLOW"] = "email_verification_flow";
+  FlowConfigType2["DEVICE_FLOW"] = "device_flow";
   FlowConfigType2["CUSTOM"] = "custom";
   return FlowConfigType2;
 })(FlowConfigType || {});
@@ -1461,6 +1503,8 @@ var simpleSignInFlow = {
   initialStep: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
   allowedSteps: [
     "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
+    "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */,
+    "email_verification_sent" /* EMAIL_VERIFICATION_SENT */,
     "password_reset_request" /* PASSWORD_RESET_REQUEST */,
     "password_reset_sent" /* PASSWORD_RESET_SENT */,
     "success" /* SUCCESS */,
@@ -1471,6 +1515,14 @@ var simpleSignInFlow = {
       onSuccess: "success" /* SUCCESS */,
       onError: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */
     },
+    ["email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */]: {
+      onSuccess: "email_verification_sent" /* EMAIL_VERIFICATION_SENT */,
+      onError: "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */
+    },
+    ["email_verification_sent" /* EMAIL_VERIFICATION_SENT */]: {
+      onSuccess: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
+      onError: "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */
+    },
     ["password_reset_request" /* PASSWORD_RESET_REQUEST */]: {
       onSuccess: "password_reset_sent" /* PASSWORD_RESET_SENT */,
       onBack: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */
@@ -1486,6 +1538,8 @@ var signInWithMFAFlow = {
   initialStep: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
   allowedSteps: [
     "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
+    "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */,
+    "email_verification_sent" /* EMAIL_VERIFICATION_SENT */,
     "mfa_required" /* MFA_REQUIRED */,
     "mfa_select_method" /* MFA_SELECT_METHOD */,
     "mfa_verify" /* MFA_VERIFY */,
@@ -1505,6 +1559,14 @@ var signInWithMFAFlow = {
         }
       ]
     },
+    ["email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */]: {
+      onSuccess: "email_verification_sent" /* EMAIL_VERIFICATION_SENT */,
+      onError: "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */
+    },
+    ["email_verification_sent" /* EMAIL_VERIFICATION_SENT */]: {
+      onSuccess: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
+      onError: "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */
+    },
     ["mfa_required" /* MFA_REQUIRED */]: {
       onSuccess: "mfa_verify" /* MFA_VERIFY */,
       conditions: [
@@ -1678,6 +1740,43 @@ var emailVerificationFlow = {
     }
   }
 };
+var deviceFlow = {
+  name: "Device Flow",
+  description: "OAuth 2.0 Device Authorization Grant for CLI/device login",
+  initialStep: "device_code_entry" /* DEVICE_CODE_ENTRY */,
+  allowedSteps: [
+    "device_code_entry" /* DEVICE_CODE_ENTRY */,
+    "device_code_verify" /* DEVICE_CODE_VERIFY */,
+    "device_authorize" /* DEVICE_AUTHORIZE */,
+    "device_authorized" /* DEVICE_AUTHORIZED */,
+    "device_denied" /* DEVICE_DENIED */,
+    "success" /* SUCCESS */,
+    "error" /* ERROR */
+  ],
+  transitions: {
+    ["device_code_entry" /* DEVICE_CODE_ENTRY */]: {
+      onSuccess: "device_code_verify" /* DEVICE_CODE_VERIFY */,
+      onError: "device_code_entry" /* DEVICE_CODE_ENTRY */,
+      onCancel: "cancelled" /* CANCELLED */
+    },
+    ["device_code_verify" /* DEVICE_CODE_VERIFY */]: {
+      onSuccess: "device_authorize" /* DEVICE_AUTHORIZE */,
+      onError: "device_code_entry" /* DEVICE_CODE_ENTRY */,
+      onBack: "device_code_entry" /* DEVICE_CODE_ENTRY */
+    },
+    ["device_authorize" /* DEVICE_AUTHORIZE */]: {
+      onSuccess: "device_authorized" /* DEVICE_AUTHORIZED */,
+      onError: "device_denied" /* DEVICE_DENIED */,
+      onCancel: "device_denied" /* DEVICE_DENIED */
+    },
+    ["device_authorized" /* DEVICE_AUTHORIZED */]: {
+      onSuccess: "success" /* SUCCESS */
+    },
+    ["device_denied" /* DEVICE_DENIED */]: {
+      onSuccess: "error" /* ERROR */
+    }
+  }
+};
 function getFlowConfig(type) {
   switch (type) {
     case "simple_sign_in" /* SIMPLE_SIGN_IN */:
@@ -1696,6 +1795,8 @@ function getFlowConfig(type) {
       return passwordResetFlow;
     case "email_verification_flow" /* EMAIL_VERIFICATION_FLOW */:
       return emailVerificationFlow;
+    case "device_flow" /* DEVICE_FLOW */:
+      return deviceFlow;
     default:
       throw new Error(`Unknown flow type: ${type}`);
   }
@@ -1708,7 +1809,8 @@ var predefinedFlows = {
   ["phone_auth_flow" /* PHONE_AUTH_FLOW */]: phoneAuthFlow,
   ["oauth_sign_in" /* OAUTH_SIGN_IN */]: oauthSignInFlow,
   ["password_reset_flow" /* PASSWORD_RESET_FLOW */]: passwordResetFlow,
-  ["email_verification_flow" /* EMAIL_VERIFICATION_FLOW */]: emailVerificationFlow
+  ["email_verification_flow" /* EMAIL_VERIFICATION_FLOW */]: emailVerificationFlow,
+  ["device_flow" /* DEVICE_FLOW */]: deviceFlow
 };
 
 exports.AuthClient = AuthClient;