@authsome/ui-core 0.1.9 → 1.1.0

package/dist/index.js

@@ -1,1863 +1,2088 @@
-'use strict';
-
-// src/types/auth.ts
-var AuthState = /* @__PURE__ */ ((AuthState2) => {
-  AuthState2["AUTHENTICATED"] = "authenticated";
-  AuthState2["UNAUTHENTICATED"] = "unauthenticated";
-  AuthState2["LOADING"] = "loading";
-  AuthState2["ERROR"] = "error";
-  return AuthState2;
-})(AuthState || {});
-var AuthErrorType = /* @__PURE__ */ ((AuthErrorType2) => {
-  AuthErrorType2["INVALID_CREDENTIALS"] = "invalid_credentials";
-  AuthErrorType2["USER_NOT_FOUND"] = "user_not_found";
-  AuthErrorType2["USER_ALREADY_EXISTS"] = "user_already_exists";
-  AuthErrorType2["INVALID_TOKEN"] = "invalid_token";
-  AuthErrorType2["TOKEN_EXPIRED"] = "token_expired";
-  AuthErrorType2["NETWORK_ERROR"] = "network_error";
-  AuthErrorType2["VALIDATION_ERROR"] = "validation_error";
-  AuthErrorType2["MFA_REQUIRED"] = "mfa_required";
-  AuthErrorType2["EMAIL_NOT_VERIFIED"] = "email_not_verified";
-  AuthErrorType2["PHONE_NOT_VERIFIED"] = "phone_not_verified";
-  AuthErrorType2["RATE_LIMIT_EXCEEDED"] = "rate_limit_exceeded";
-  AuthErrorType2["UNKNOWN_ERROR"] = "unknown_error";
-  return AuthErrorType2;
-})(AuthErrorType || {});
-var AuthError = class _AuthError extends Error {
-  constructor(message, type = "unknown_error" /* UNKNOWN_ERROR */, options) {
-    super(message);
-    this.name = "AuthError";
-    this.type = type;
-    this.details = options?.details;
-    this.code = options?.code;
-    this.originalError = options?.originalError;
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, _AuthError);
-    }
+// src/generated/api-client.ts
+var AuthClient = class {
+  baseURL;
+  fetchFn;
+  constructor(config) {
+    this.baseURL = config.baseURL.replace(/\/+$/, "");
+    this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
+  }
+  // ──────────────────────────────────────────────────
+  // Generated methods
+  // ──────────────────────────────────────────────────
+  /**
+   * Get AuthSome manifest
+   * GET /.well-known/authsome/manifest
+   */
+  async getManifest() {
+    const path = "/.well-known/authsome/manifest";
+    return this.request(
+      "GET",
+      path,
+      void 0
+    );
   }
-};
-var OAuthProvider = /* @__PURE__ */ ((OAuthProvider2) => {
-  OAuthProvider2["GOOGLE"] = "google";
-  OAuthProvider2["GITHUB"] = "github";
-  OAuthProvider2["FACEBOOK"] = "facebook";
-  OAuthProvider2["TWITTER"] = "twitter";
-  OAuthProvider2["MICROSOFT"] = "microsoft";
-  OAuthProvider2["APPLE"] = "apple";
-  OAuthProvider2["LINKEDIN"] = "linkedin";
-  OAuthProvider2["DISCORD"] = "discord";
-  return OAuthProvider2;
-})(OAuthProvider || {});
-var TwoFactorMethod = /* @__PURE__ */ ((TwoFactorMethod2) => {
-  TwoFactorMethod2["TOTP"] = "totp";
-  TwoFactorMethod2["SMS"] = "sms";
-  TwoFactorMethod2["EMAIL"] = "email";
-  TwoFactorMethod2["BACKUP_CODE"] = "backup_code";
-  return TwoFactorMethod2;
-})(TwoFactorMethod || {});
-
-// src/types/storage.ts
-var LocalStorageAdapter = class {
-  getItem(key) {
-    if (typeof window === "undefined") return null;
-    return window.localStorage.getItem(key);
+  /**
+   * Get OpenAPI specification
+   * GET /.well-known/authsome/openapi
+   */
+  async getOpenAPI() {
+    const path = "/.well-known/authsome/openapi";
+    return this.request(
+      "GET",
+      path,
+      void 0
+    );
   }
-  setItem(key, value) {
-    if (typeof window === "undefined") return;
-    window.localStorage.setItem(key, value);
+  /**
+   * Get per-app client config overrides
+   * GET /v1/admin/apps/{appId}/client-config
+   */
+  async getAppClientConfig(appId, token) {
+    const path = `/v1/admin/apps/${appId}/client-config`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-  removeItem(key) {
-    if (typeof window === "undefined") return;
-    window.localStorage.removeItem(key);
+  /**
+   * Set per-app client config overrides
+   * PUT /v1/admin/apps/{appId}/client-config
+   */
+  async setAppClientConfig(appId, body, token) {
+    const path = `/v1/admin/apps/${appId}/client-config`;
+    return this.request(
+      "PUT",
+      path,
+      body,
+      token
+    );
   }
-  clear() {
-    if (typeof window === "undefined") return;
-    window.localStorage.clear();
+  /**
+   * Delete per-app client config overrides
+   * DELETE /v1/admin/apps/{appId}/client-config
+   */
+  async deleteAppClientConfig(appId, body, token) {
+    const path = `/v1/admin/apps/${appId}/client-config`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
-};
-var SessionStorageAdapter = class {
-  getItem(key) {
-    if (typeof window === "undefined") return null;
-    return window.sessionStorage.getItem(key);
+  /**
+   * Get per-app session config
+   * GET /v1/admin/apps/{appId}/session-config
+   */
+  async getAppSessionConfig(appId, token) {
+    const path = `/v1/admin/apps/${appId}/session-config`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-  setItem(key, value) {
-    if (typeof window === "undefined") return;
-    window.sessionStorage.setItem(key, value);
+  /**
+   * Set per-app session config
+   * PUT /v1/admin/apps/{appId}/session-config
+   */
+  async setAppSessionConfig(appId, body, token) {
+    const path = `/v1/admin/apps/${appId}/session-config`;
+    return this.request(
+      "PUT",
+      path,
+      body,
+      token
+    );
   }
-  removeItem(key) {
-    if (typeof window === "undefined") return;
-    window.sessionStorage.removeItem(key);
+  /**
+   * Delete per-app session config
+   * DELETE /v1/admin/apps/{appId}/session-config
+   */
+  async deleteAppSessionConfig(appId, body, token) {
+    const path = `/v1/admin/apps/${appId}/session-config`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
-  clear() {
-    if (typeof window === "undefined") return;
-    window.sessionStorage.clear();
+  /**
+   * Bulk revoke sessions (admin)
+   * DELETE /v1/admin/bulk/sessions
+   */
+  async adminBulkRevokeSessions(body, token) {
+    const path = "/v1/admin/bulk/sessions";
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
-};
-var MemoryStorageAdapter = class {
-  constructor() {
-    this.store = /* @__PURE__ */ new Map();
+  /**
+   * Bulk import users (admin)
+   * POST /v1/admin/bulk/users/import
+   */
+  async adminBulkImportUsers(body, token) {
+    const path = "/v1/admin/bulk/users/import";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
-  getItem(key) {
-    return this.store.get(key) ?? null;
+  /**
+   * Stop impersonation (admin)
+   * POST /v1/admin/impersonate/stop
+   */
+  async adminStopImpersonation(body, token) {
+    const path = "/v1/admin/impersonate/stop";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
-  setItem(key, value) {
-    this.store.set(key, value);
+  /**
+   * Impersonate user (admin)
+   * POST /v1/admin/impersonate/{userId}
+   */
+  async adminImpersonate(userId, body, token) {
+    const path = `/v1/admin/impersonate/${userId}`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
-  removeItem(key) {
-    this.store.delete(key);
+  /**
+   * List organizations (admin)
+   * GET /v1/admin/orgs
+   */
+  async adminListOrgs(token) {
+    const path = "/v1/admin/orgs";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-  clear() {
-    this.store.clear();
+  /**
+   * List all setting definitions
+   * GET /v1/admin/settings/definitions
+   */
+  async listSettingsDefinitions(token) {
+    const path = "/v1/admin/settings/definitions";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-};
-
-// src/types/observable.ts
-var Observable = class {
-  constructor(initialValue) {
-    this.listeners = /* @__PURE__ */ new Set();
-    this.value = initialValue;
+  /**
+   * List definitions for a namespace
+   * GET /v1/admin/settings/definitions/{namespace}
+   */
+  async listNamespaceSettingsDefinitions(namespace, token) {
+    const path = `/v1/admin/settings/definitions/${namespace}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Get current value
+   * Enforce a setting value at a scope
+   * PUT /v1/admin/settings/enforce/{key}
    */
-  getValue() {
-    return this.value;
+  async enforceSetting(key, body, token) {
+    const path = `/v1/admin/settings/enforce/${key}`;
+    return this.request(
+      "PUT",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Set new value and notify listeners
+   * Remove enforcement from a setting
+   * DELETE /v1/admin/settings/enforce/{key}
    */
-  setValue(newValue) {
-    if (this.value !== newValue) {
-      this.value = newValue;
-      this.notify();
-    }
+  async unenforceSetting(key, body, token) {
+    const path = `/v1/admin/settings/enforce/${key}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Update value with a function
+   * Resolve all settings at a scope
+   * GET /v1/admin/settings/resolve
    */
-  update(updater) {
-    this.setValue(updater(this.value));
+  async resolveSettings(token) {
+    const path = "/v1/admin/settings/resolve";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Subscribe to value changes
+   * Resolve one setting with cascade details
+   * GET /v1/admin/settings/resolve/{key}
    */
-  subscribe(listener) {
-    this.listeners.add(listener);
-    listener(this.value);
-    return () => {
-      this.listeners.delete(listener);
-    };
+  async resolveSetting(key, token) {
+    const path = `/v1/admin/settings/resolve/${key}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Notify all listeners
+   * Set a setting value at a scope
+   * PUT /v1/admin/settings/values/{key}
    */
-  notify() {
-    this.listeners.forEach((listener) => listener(this.value));
+  async setSetting(key, body, token) {
+    const path = `/v1/admin/settings/values/${key}`;
+    return this.request(
+      "PUT",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Clear all listeners
+   * Delete a setting override at a scope
+   * DELETE /v1/admin/settings/values/{key}
    */
-  clearListeners() {
-    this.listeners.clear();
+  async deleteSetting(key, body, token) {
+    const path = `/v1/admin/settings/values/${key}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Get number of listeners
+   * Get stats (admin)
+   * GET /v1/admin/stats
    */
-  getListenerCount() {
-    return this.listeners.size;
+  async adminGetStats(token) {
+    const path = "/v1/admin/stats";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-};
-
-// src/utils/errors.ts
-function createAuthError(type, message, details, code) {
-  return new AuthError(message, type, { details, code });
-}
-function isAuthError(error) {
-  return error instanceof AuthError;
-}
-function toAuthError(error) {
-  if (isAuthError(error)) {
-    return error;
-  }
-  if (error instanceof Error) {
-    return new AuthError(error.message, "unknown_error" /* UNKNOWN_ERROR */, {
-      details: {
-        originalError: error.name,
-        stack: error.stack
-      }
-    });
+  /**
+   * List users (admin)
+   * GET /v1/admin/users
+   */
+  async adminListUsers(token) {
+    const path = "/v1/admin/users";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-  if (typeof error === "string") {
-    return new AuthError(error, "unknown_error" /* UNKNOWN_ERROR */);
+  /**
+   * Get user (admin)
+   * GET /v1/admin/users/{userId}
+   */
+  async adminGetUser(userId, token) {
+    const path = `/v1/admin/users/${userId}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-  return new AuthError(
-    "An unknown error occurred",
-    "unknown_error" /* UNKNOWN_ERROR */,
-    { details: { error } }
-  );
-}
-function isNetworkError(error) {
-  if (error instanceof Error) {
-    return error.name === "NetworkError" || error.message.includes("network") || error.message.includes("fetch");
+  /**
+   * Delete user (admin)
+   * DELETE /v1/admin/users/{userId}
+   */
+  async adminDeleteUser(userId, body, token) {
+    const path = `/v1/admin/users/${userId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
-  return false;
-}
-function isUnauthenticatedError(error) {
-  if (isAuthError(error)) {
-    return error.type === "invalid_token" /* INVALID_TOKEN */ || error.type === "token_expired" /* TOKEN_EXPIRED */;
+  /**
+   * Ban user (admin)
+   * POST /v1/admin/users/{userId}/ban
+   */
+  async adminBanUser(userId, body, token) {
+    const path = `/v1/admin/users/${userId}/ban`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
-  return false;
-}
-function isMFARequiredError(error) {
-  if (isAuthError(error)) {
-    return error.type === "mfa_required" /* MFA_REQUIRED */;
+  /**
+   * Unban user (admin)
+   * POST /v1/admin/users/{userId}/unban
+   */
+  async adminUnbanUser(userId, body, token) {
+    const path = `/v1/admin/users/${userId}/unban`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
-  return false;
-}
-
-// src/locale/en.ts
-var enLocale = {
-  common: {
-    loading: "Loading...",
-    submit: "Submit",
-    cancel: "Cancel",
-    continue: "Continue",
-    back: "Back",
-    or: "or",
-    optional: "optional"
-  },
-  auth: {
-    signIn: "Sign In",
-    signUp: "Sign Up",
-    signOut: "Sign Out",
-    email: "Email",
-    password: "Password",
-    confirmPassword: "Confirm Password",
-    username: "Username",
-    phone: "Phone",
-    rememberMe: "Remember me",
-    forgotPassword: "Forgot password?",
-    continueWith: "Continue with {provider}",
-    orContinueWith: "Or continue with"
-  },
-  oauth: {
-    google: "Google",
-    github: "GitHub",
-    microsoft: "Microsoft",
-    facebook: "Facebook",
-    apple: "Apple",
-    discord: "Discord",
-    twitter: "Twitter",
-    linkedin: "LinkedIn",
-    chooseProvider: "Choose Your Provider",
-    signInPreferred: "Sign in with your preferred account"
-  },
-  magicLink: {
-    sendLink: "Send magic link",
-    checkEmail: "Check your email",
-    linkSent: "Magic link sent! Check your email to continue.",
-    enterEmail: "Enter your email to receive a magic link"
-  },
-  phone: {
-    enterPhone: "Enter your phone number",
-    sendCode: "Send code",
-    enterCode: "Enter verification code",
-    verifyPhone: "Verify phone number",
-    codeLabel: "Verification code"
-  },
-  mfa: {
-    required: "Two-factor authentication required",
-    selectMethod: "Select verification method",
-    verify: "Verify",
-    enterCode: "Enter verification code",
-    sms: "SMS",
-    authenticator: "Authenticator app",
-    email: "Email"
-  },
-  passkey: {
-    signInWith: "Sign in with passkey",
-    register: "Register passkey",
-    usePasskey: "Use passkey"
-  },
-  deviceFlow: {
-    title: "Authorize Device",
-    subtitle: "Enter the code displayed on your device",
-    enterCode: "Authorize Device",
-    enterCodeDescription: "Enter the code displayed on your device or CLI",
-    codeLabel: "Device Code",
-    codePlaceholder: "XXXX-XXXX",
-    codeHint: "Enter the 8-character code shown on your device",
-    verify: "Verify Code",
-    verifyCode: "Verify Code",
-    invalidCode: "Invalid code. Please check and try again.",
-    noCode: "Don't have a code?",
-    getCodeHelp: "Get help",
-    authorizationTitle: "Authorize Application",
-    authorizationSubtitle: "An application is requesting access to your account",
-    authorizeTitle: "Authorize Device",
-    authorizeDescription: "An application is requesting access to your account",
-    requestingAccess: "is requesting access to:",
-    codeConfirm: "Confirm this is your code:",
-    requestedPermissions: "Requested permissions:",
-    securityWarning: "Only approve this request if you initiated it",
-    scopes: "Requested permissions",
-    approve: "Approve",
-    deny: "Deny",
-    authorizedTitle: "Device Authorized",
-    authorizedMessage: "You can now return to your device to continue",
-    authorizedDescription: "Your device has been successfully authorized",
-    authorizedHint: "You can close this window and return to your CLI or device",
-    returnToCli: "Return to CLI",
-    deniedTitle: "Access Denied",
-    deniedMessage: "You have denied access to this device",
-    deniedDescription: "The device authorization request has been denied",
-    deniedHint: "You can close this window"
-  },
-  signUp: {
-    title: "Create Account",
-    subtitle: "Get started with your account",
-    haveAccount: "Already have an account?",
-    signInLink: "Sign in",
-    agreeToTerms: "I agree to the {terms}",
-    terms: "terms and conditions"
-  },
-  signIn: {
-    title: "Sign In",
-    subtitle: "Enter your email to continue",
-    noAccount: "Don't have an account?",
-    signUpLink: "Sign up",
-    enterEmail: "Enter your email to continue"
-  },
-  validation: {
-    emailRequired: "Email is required",
-    emailInvalid: "Invalid email address",
-    passwordRequired: "Password is required",
-    passwordTooShort: "Password must be at least {min} characters",
-    passwordRequireUppercase: "Password must contain an uppercase letter",
-    passwordRequireLowercase: "Password must contain a lowercase letter",
-    passwordRequireNumber: "Password must contain a number",
-    passwordRequireSpecial: "Password must contain a special character",
-    passwordMismatch: "Passwords do not match",
-    usernameRequired: "Username is required",
-    usernameInvalid: "Username must be 3-30 characters and contain only letters, numbers, underscores, and hyphens",
-    phoneRequired: "Phone number is required",
-    phoneInvalid: "Invalid phone number",
-    codeRequired: "Verification code is required",
-    codeInvalid: "Invalid verification code",
-    fieldRequired: "{field} is required",
-    termsRequired: "You must agree to the terms and conditions"
-  },
-  errors: {
-    invalidCredentials: "Invalid email or password",
-    userNotFound: "User not found",
-    userExists: "User already exists",
-    invalidToken: "Invalid or expired token",
-    tokenExpired: "Token has expired",
-    networkError: "Network error. Please try again.",
-    mfaRequired: "Two-factor authentication required",
-    emailNotVerified: "Email not verified",
-    phoneNotVerified: "Phone number not verified",
-    rateLimitExceeded: "Too many attempts. Please try again later.",
-    unknownError: "An unknown error occurred",
-    generic: "Something went wrong. Please try again."
-  },
-  success: {
-    signedIn: "Successfully signed in",
-    signedUp: "Account created successfully",
-    signedOut: "Successfully signed out",
-    linkSent: "Link sent successfully",
-    codeSent: "Verification code sent",
-    verified: "Successfully verified",
-    welcome: "Welcome, {name}!"
-  },
-  placeholders: {
-    email: "john@example.com",
-    password: "Enter your password",
-    confirmPassword: "Confirm your password",
-    username: "johndoe",
-    phone: "+1234567890",
-    code: "123456",
-    fullName: "John Doe"
+  /**
+   * Change password
+   * POST /v1/change-password
+   */
+  async changePassword(body, token) {
+    const path = "/v1/change-password";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
-};
-
-// src/locale/utils.ts
-var defaultLocale = enLocale;
-function deepMerge(target, source) {
-  const result = { ...target };
-  for (const key in source) {
-    if (source[key] !== void 0) {
-      if (typeof source[key] === "object" && source[key] !== null && !Array.isArray(source[key]) && typeof result[key] === "object" && result[key] !== null) {
-        result[key] = deepMerge(result[key], source[key]);
-      } else {
-        result[key] = source[key];
-      }
-    }
+  /**
+   * Get client configuration
+   * GET /v1/client-config
+   */
+  async getClientConfig(token) {
+    const path = "/v1/client-config";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-  return result;
-}
-function createLocale(overrides) {
-  if (!overrides) {
-    return defaultLocale;
+  /**
+   * List devices
+   * GET /v1/devices
+   */
+  async listDevices(token) {
+    const path = "/v1/devices";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-  return deepMerge(defaultLocale, overrides);
-}
-function interpolate(template, values) {
-  return template.replace(/\{(\w+)\}/g, (match, key) => {
-    return values[key] !== void 0 ? String(values[key]) : match;
-  });
-}
-
-// src/utils/validation.ts
-var EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var PHONE_REGEX = /^\+?[1-9]\d{1,14}$/;
-var USERNAME_REGEX = /^[a-zA-Z0-9_-]{3,30}$/;
-function validateEmail(email, locale) {
-  const messages = locale?.validation || defaultLocale.validation;
-  if (!email) {
-    return { field: "email", message: messages.emailRequired };
-  }
-  if (!EMAIL_REGEX.test(email)) {
-    return { field: "email", message: messages.emailInvalid };
-  }
-  return null;
-}
-function validatePassword(password, options = {}) {
-  const {
-    minLength = 8,
-    requireUppercase = true,
-    requireLowercase = true,
-    requireNumber = true,
-    requireSpecial = false,
-    locale
-  } = options;
-  const messages = locale?.validation || defaultLocale.validation;
-  if (!password) {
-    return { field: "password", message: messages.passwordRequired };
-  }
-  if (password.length < minLength) {
-    return {
-      field: "password",
-      message: interpolate(messages.passwordTooShort, { min: minLength.toString() })
-    };
+  /**
+   * Get device
+   * GET /v1/devices/{deviceId}
+   */
+  async getDevice(deviceId, token) {
+    const path = `/v1/devices/${deviceId}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-  if (requireUppercase && !/[A-Z]/.test(password)) {
-    return {
-      field: "password",
-      message: messages.passwordRequireUppercase
-    };
+  /**
+   * Delete device
+   * DELETE /v1/devices/{deviceId}
+   */
+  async deleteDevice(deviceId, body, token) {
+    const path = `/v1/devices/${deviceId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
-  if (requireLowercase && !/[a-z]/.test(password)) {
-    return {
-      field: "password",
-      message: messages.passwordRequireLowercase
-    };
+  /**
+   * Trust device
+   * PATCH /v1/devices/{deviceId}/trust
+   */
+  async trustDevice(deviceId, body, token) {
+    const path = `/v1/devices/${deviceId}/trust`;
+    return this.request(
+      "PATCH",
+      path,
+      body,
+      token
+    );
   }
-  if (requireNumber && !/\d/.test(password)) {
-    return { field: "password", message: messages.passwordRequireNumber };
+  /**
+   * List environments
+   * GET /v1/environments
+   */
+  async listEnvironments(token) {
+    const path = "/v1/environments";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-  if (requireSpecial && !/[!@#$%^&*(),.?":{}|<>]/.test(password)) {
-    return {
-      field: "password",
-      message: messages.passwordRequireSpecial
-    };
+  /**
+   * Create environment
+   * POST /v1/environments
+   */
+  async createEnvironment(body, token) {
+    const path = "/v1/environments";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
-  return null;
-}
-function validatePhone(phone, locale) {
-  const messages = locale?.validation || defaultLocale.validation;
-  if (!phone) {
-    return { field: "phone", message: messages.phoneRequired };
-  }
-  if (!PHONE_REGEX.test(phone)) {
-    return {
-      field: "phone",
-      message: messages.phoneInvalid
-    };
+  /**
+   * Get environment
+   * GET /v1/environments/{envId}
+   */
+  async getEnvironment(envId, token) {
+    const path = `/v1/environments/${envId}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-  return null;
-}
-function validateUsername(username, locale) {
-  const messages = locale?.validation || defaultLocale.validation;
-  if (!username) {
-    return { field: "username", message: messages.usernameRequired };
-  }
-  if (!USERNAME_REGEX.test(username)) {
-    return {
-      field: "username",
-      message: messages.usernameInvalid
-    };
+  /**
+   * Update environment
+   * PATCH /v1/environments/{envId}
+   */
+  async updateEnvironment(envId, body, token) {
+    const path = `/v1/environments/${envId}`;
+    return this.request(
+      "PATCH",
+      path,
+      body,
+      token
+    );
   }
-  return null;
-}
-function validate2FACode(code, locale) {
-  const messages = locale?.validation || defaultLocale.validation;
-  if (!code) {
-    return { field: "code", message: messages.codeRequired };
+  /**
+   * Delete environment
+   * DELETE /v1/environments/{envId}
+   */
+  async deleteEnvironment(envId, token) {
+    const path = `/v1/environments/${envId}`;
+    return this.request(
+      "DELETE",
+      path,
+      void 0,
+      token
+    );
   }
-  if (!/^\d{6}$/.test(code)) {
-    return { field: "code", message: messages.codeInvalid };
+  /**
+   * Clone environment
+   * POST /v1/environments/{envId}/clone
+   */
+  async cloneEnvironment(envId, body, token) {
+    const path = `/v1/environments/${envId}/clone`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
-  return null;
-}
-function validateRequired(value, fieldName, locale) {
-  const messages = locale?.validation || defaultLocale.validation;
-  if (!value || typeof value === "string" && !value.trim()) {
-    return {
-      field: fieldName,
-      message: interpolate(messages.fieldRequired, { field: fieldName })
-    };
+  /**
+   * Set default environment
+   * POST /v1/environments/{envId}/set-default
+   */
+  async setDefaultEnvironment(envId, token) {
+    const path = `/v1/environments/${envId}/set-default`;
+    return this.request(
+      "POST",
+      path,
+      void 0,
+      token
+    );
   }
-  return null;
-}
-
-// src/utils/tokens.ts
-var TOKEN_KEY = "authsome_token";
-var REFRESH_TOKEN_KEY = "authsome_refresh_token";
-var TokenManager = class {
-  constructor(storage = new LocalStorageAdapter()) {
-    this.storage = storage;
+  /**
+   * Get environment settings
+   * GET /v1/environments/{envId}/settings
+   */
+  async getEnvironmentSettings(envId, token) {
+    const path = `/v1/environments/${envId}/settings`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Get access token
+   * Update environment settings
+   * PATCH /v1/environments/{envId}/settings
    */
-  async getToken() {
-    return await Promise.resolve(this.storage.getItem(TOKEN_KEY));
+  async updateEnvironmentSettings(envId, body, token) {
+    const path = `/v1/environments/${envId}/settings`;
+    return this.request(
+      "PATCH",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Set access token
+   * Forgot password
+   * POST /v1/forgot-password
    */
-  async setToken(token) {
-    await Promise.resolve(this.storage.setItem(TOKEN_KEY, token));
+  async forgotPassword(body) {
+    const path = "/v1/forgot-password";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Remove access token
+   * Health check
+   * GET /v1/health
    */
-  async removeToken() {
-    await Promise.resolve(this.storage.removeItem(TOKEN_KEY));
+  async getHealth() {
+    const path = "/v1/health";
+    return this.request(
+      "GET",
+      path,
+      void 0
+    );
   }
   /**
-   * Get refresh token
+   * List API keys
+   * GET /v1/keys
    */
-  async getRefreshToken() {
-    return await Promise.resolve(this.storage.getItem(REFRESH_TOKEN_KEY));
+  async listAPIKeys(token) {
+    const path = "/v1/keys";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Set refresh token
+   * Create API key
+   * POST /v1/keys
    */
-  async setRefreshToken(token) {
-    await Promise.resolve(this.storage.setItem(REFRESH_TOKEN_KEY, token));
+  async createAPIKey(body, token) {
+    const path = "/v1/keys";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Remove refresh token
+   * Revoke API key
+   * DELETE /v1/keys/{keyId}
    */
-  async removeRefreshToken() {
-    await Promise.resolve(this.storage.removeItem(REFRESH_TOKEN_KEY));
+  async revokeAPIKey(keyId, body, token) {
+    const path = `/v1/keys/${keyId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Send magic link
+   * POST /v1/magic-link/send
+   */
+  async sendMagicLink(body) {
+    const path = "/v1/magic-link/send";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
+  }
+  /**
+   * Verify magic link
+   * POST /v1/magic-link/verify
+   */
+  async verifyMagicLink(body) {
+    const path = "/v1/magic-link/verify";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Clear all tokens
+   * Get current user
+   * GET /v1/me
+   */
+  async getMe(token) {
+    const path = "/v1/me";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Update current user
+   * PATCH /v1/me
    */
-  async clearTokens() {
-    await this.removeToken();
-    await this.removeRefreshToken();
+  async updateMe(body, token) {
+    const path = "/v1/me";
+    return this.request(
+      "PATCH",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Check if token is expired
+   * Delete account
+   * DELETE /v1/me
    */
-  isTokenExpired(token) {
-    try {
-      const payload = this.decodeToken(token);
-      if (!payload.exp) return false;
-      const expiresAt = payload.exp * 1e3;
-      const now = Date.now();
-      return expiresAt - now < 6e4;
-    } catch {
-      return true;
-    }
+  async deleteMe(body, token) {
+    const path = "/v1/me";
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Decode JWT token (without verification)
+   * List linked auth methods
+   * GET /v1/me/auth-methods
    */
-  decodeToken(token) {
-    const parts = token.split(".");
-    if (parts.length !== 3) {
-      throw new Error("Invalid token format");
-    }
-    const payload = parts[1];
-    const decoded = atob(payload);
-    return JSON.parse(decoded);
+  async listAuthMethods(token) {
+    const path = "/v1/me/auth-methods";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-};
-
-// src/utils/cookies.ts
-function parseCookie(setCookieHeader) {
-  if (!setCookieHeader) return null;
-  const parts = setCookieHeader.split(";").map((p) => p.trim());
-  if (parts.length === 0) return null;
-  const [nameValue] = parts;
-  const [name, value] = nameValue.split("=");
-  if (!name || value === void 0) return null;
-  const cookieData = { name, value };
-  const options = {};
-  for (let i = 1; i < parts.length; i++) {
-    const part = parts[i];
-    const lowerPart = part.toLowerCase();
-    if (lowerPart === "httponly") {
-      options.httpOnly = true;
-    } else if (lowerPart === "secure") {
-      options.secure = true;
-    } else if (lowerPart.startsWith("path=")) {
-      options.path = part.substring(5);
-    } else if (lowerPart.startsWith("domain=")) {
-      options.domain = part.substring(7);
-    } else if (lowerPart.startsWith("max-age=")) {
-      const maxAge = parseInt(part.substring(8), 10);
-      if (!isNaN(maxAge)) {
-        options.maxAge = maxAge;
-      }
-    } else if (lowerPart.startsWith("expires=")) {
-      const expiresStr = part.substring(8);
-      const expiresDate = new Date(expiresStr);
-      if (!isNaN(expiresDate.getTime())) {
-        options.expires = expiresDate;
-      }
-    } else if (lowerPart.startsWith("samesite=")) {
-      const sameSiteValue = lowerPart.substring(9);
-      if (sameSiteValue === "strict" || sameSiteValue === "lax" || sameSiteValue === "none") {
-        options.sameSite = sameSiteValue;
-      }
-    }
+  /**
+   * Unlink an auth method
+   * DELETE /v1/me/auth-methods/{provider}
+   */
+  async unlinkAuthMethod(provider, body, token) {
+    const path = `/v1/me/auth-methods/${provider}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
-  if (Object.keys(options).length > 0) {
-    cookieData.options = options;
+  /**
+   * Export user data
+   * GET /v1/me/export
+   */
+  async exportMyData(token) {
+    const path = "/v1/me/export";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-  return cookieData;
-}
-function extractCookiesFromHeaders(setCookieHeaders) {
-  const headers = Array.isArray(setCookieHeaders) ? setCookieHeaders : [setCookieHeaders];
-  const cookies = [];
-  for (const header of headers) {
-    const cookie = parseCookie(header);
-    if (cookie) {
-      cookies.push(cookie);
-    }
+  /**
+   * MFA challenge
+   * POST /v1/mfa/challenge
+   */
+  async challengeMFA(body) {
+    const path = "/v1/mfa/challenge";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
-  return cookies;
-}
-function serializeCookie(cookie) {
-  const parts = [`${cookie.name}=${cookie.value}`];
-  if (cookie.options) {
-    const opts = cookie.options;
-    if (opts.path) {
-      parts.push(`Path=${opts.path}`);
-    }
-    if (opts.domain) {
-      parts.push(`Domain=${opts.domain}`);
-    }
-    if (opts.expires) {
-      parts.push(`Expires=${opts.expires.toUTCString()}`);
-    }
-    if (opts.maxAge !== void 0) {
-      parts.push(`Max-Age=${opts.maxAge}`);
-    }
-    if (opts.httpOnly) {
-      parts.push("HttpOnly");
-    }
-    if (opts.secure) {
-      parts.push("Secure");
-    }
-    if (opts.sameSite) {
-      const sameSite = opts.sameSite.charAt(0).toUpperCase() + opts.sameSite.slice(1);
-      parts.push(`SameSite=${sameSite}`);
-    }
+  /**
+   * Enroll in MFA
+   * POST /v1/mfa/enroll
+   */
+  async enrollMFA(body, token) {
+    const path = "/v1/mfa/enroll";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
-  return parts.join("; ");
-}
-function parseCookieOptions(cookieHeader) {
-  const cookies = {};
-  if (!cookieHeader) return cookies;
-  const pairs = cookieHeader.split(";").map((p) => p.trim());
-  for (const pair of pairs) {
-    const [name, value] = pair.split("=");
-    if (name && value !== void 0) {
-      cookies[name.trim()] = value.trim();
-    }
+  /**
+   * Disable MFA
+   * DELETE /v1/mfa/enrollment
+   */
+  async disableMFA(body, token) {
+    const path = "/v1/mfa/enrollment";
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
-  return cookies;
-}
-function serializeCookies(cookies) {
-  return Object.entries(cookies).map(([key, value]) => `${key}=${value}`).join("; ");
-}
-
-// src/adapters/base-provider.ts
-var BaseAuthProvider = class {
-  constructor() {
-    this.config = {};
-    this.initialized = false;
+  /**
+   * Regenerate MFA recovery codes
+   * POST /v1/mfa/recovery/regenerate
+   */
+  async regenerateMFARecoveryCodes(body, token) {
+    const path = "/v1/mfa/recovery/regenerate";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Initialize the provider
+   * Verify MFA recovery code
+   * POST /v1/mfa/recovery/verify
    */
-  async initialize(config) {
-    this.config = config;
-    this.initialized = true;
+  async verifyRecoveryCode(body) {
+    const path = "/v1/mfa/recovery/verify";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Ensure provider is initialized
+   * Send SMS verification code
+   * POST /v1/mfa/sms/send
    */
-  ensureInitialized() {
-    if (!this.initialized) {
-      throw new Error(`Provider ${this.name} is not initialized`);
-    }
+  async sendSMSCode(body, token) {
+    const path = "/v1/mfa/sms/send";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Make HTTP request
+   * Verify SMS code
+   * POST /v1/mfa/sms/verify
    */
-  async request(url, options = {}) {
-    const response = await fetch(url, {
-      ...options,
-      headers: {
-        "Content-Type": "application/json",
-        ...options.headers
-      }
-    });
-    if (!response.ok) {
-      const error = await response.json().catch(() => ({
-        message: response.statusText
-      }));
-      throw error;
-    }
-    return response.json();
+  async verifySMSCode(body, token) {
+    const path = "/v1/mfa/sms/verify";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Normalize error to AuthError
+   * Verify MFA code
+   * POST /v1/mfa/verify
    */
-  normalizeError(error) {
-    return toAuthError(error);
+  async verifyMFA(body) {
+    const path = "/v1/mfa/verify";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
-};
-
-// src/client.ts
-var AuthClient = class {
-  // Expose adapter for accessing provider-specific methods
-  get adapter() {
-    return this.provider;
+  /**
+   * List organizations
+   * GET /v1/orgs
+   */
+  async listOrganizations(token) {
+    const path = "/v1/orgs";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
-  constructor(config) {
-    this.provider = config.provider;
-    this.autoRefresh = config.autoRefresh ?? true;
-    this.refreshInterval = config.refreshInterval ?? 5 * 60 * 1e3;
-    this.state = new Observable({
-      state: "loading" /* LOADING */,
-      user: null,
-      session: null,
-      error: null,
-      isAuthenticated: false,
-      isLoading: true
-    });
+  /**
+   * Create organization
+   * POST /v1/orgs
+   */
+  async createOrganization(body, token) {
+    const path = "/v1/orgs";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Initialize the auth client
+   * Check slug availability
+   * GET /v1/orgs/check-slug
    */
-  async initialize() {
-    try {
-      const user = await this.provider.getCurrentUser();
-      const session = await this.provider.getCurrentSession();
-      if (user && session) {
-        this.updateState({
-          state: "authenticated" /* AUTHENTICATED */,
-          user,
-          session,
-          error: null,
-          isAuthenticated: true,
-          isLoading: false
-        });
-        if (this.autoRefresh) {
-          this.startAutoRefresh();
-        }
-      } else {
-        this.updateState({
-          state: "unauthenticated" /* UNAUTHENTICATED */,
-          user: null,
-          session: null,
-          error: null,
-          isAuthenticated: false,
-          isLoading: false
-        });
-      }
-    } catch (error) {
-      this.handleError(error);
-    }
+  async checkOrgSlug(token) {
+    const path = "/v1/orgs/check-slug";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Sign in with credentials
+   * Accept invitation
+   * POST /v1/orgs/invitations/accept
    */
-  async signIn(request) {
-    try {
-      this.setLoading();
-      const response = await this.provider.signIn(request);
-      if (response.requiresTwoFactor) {
-        this.updateState({
-          state: "unauthenticated" /* UNAUTHENTICATED */,
-          user: response.user,
-          session: null,
-          error: null,
-          isAuthenticated: false,
-          isLoading: false
-        });
-        return;
-      }
-      this.updateState({
-        state: "authenticated" /* AUTHENTICATED */,
-        user: response.user,
-        session: response.session,
-        error: null,
-        isAuthenticated: true,
-        isLoading: false
-      });
-      if (this.autoRefresh) {
-        this.startAutoRefresh();
-      }
-    } catch (error) {
-      this.handleError(error);
-    }
+  async acceptInvitation(body, token) {
+    const path = "/v1/orgs/invitations/accept";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Decline invitation
+   * POST /v1/orgs/invitations/decline
+   */
+  async declineInvitation(body, token) {
+    const path = "/v1/orgs/invitations/decline";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Get organization
+   * GET /v1/orgs/{orgId}
+   */
+  async getOrganization(orgId, token) {
+    const path = `/v1/orgs/${orgId}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Update organization
+   * PATCH /v1/orgs/{orgId}
+   */
+  async updateOrganization(orgId, body, token) {
+    const path = `/v1/orgs/${orgId}`;
+    return this.request(
+      "PATCH",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Delete organization
+   * DELETE /v1/orgs/{orgId}
+   */
+  async deleteOrganization(orgId, body, token) {
+    const path = `/v1/orgs/${orgId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * List invitations
+   * GET /v1/orgs/{orgId}/invitations
+   */
+  async listInvitations(orgId, token) {
+    const path = `/v1/orgs/${orgId}/invitations`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Create invitation
+   * POST /v1/orgs/{orgId}/invitations
+   */
+  async createInvitation(orgId, body, token) {
+    const path = `/v1/orgs/${orgId}/invitations`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * List members
+   * GET /v1/orgs/{orgId}/members
+   */
+  async listMembers(orgId, token) {
+    const path = `/v1/orgs/${orgId}/members`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Add member
+   * POST /v1/orgs/{orgId}/members
+   */
+  async addMember(orgId, body, token) {
+    const path = `/v1/orgs/${orgId}/members`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Update member role
+   * PATCH /v1/orgs/{orgId}/members/{memberId}
+   */
+  async updateMember(orgId, memberId, body, token) {
+    const path = `/v1/orgs/${orgId}/members/${memberId}`;
+    return this.request(
+      "PATCH",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Remove member
+   * DELETE /v1/orgs/{orgId}/members/{memberId}
+   */
+  async removeMember(orgId, memberId, body, token) {
+    const path = `/v1/orgs/${orgId}/members/${memberId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * List teams
+   * GET /v1/orgs/{orgId}/teams
+   */
+  async listTeams(orgId, token) {
+    const path = `/v1/orgs/${orgId}/teams`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Create team
+   * POST /v1/orgs/{orgId}/teams
+   */
+  async createTeam(orgId, body, token) {
+    const path = `/v1/orgs/${orgId}/teams`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Get team
+   * GET /v1/orgs/{orgId}/teams/{teamId}
+   */
+  async getTeam(orgId, teamId, token) {
+    const path = `/v1/orgs/${orgId}/teams/${teamId}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Update team
+   * PATCH /v1/orgs/{orgId}/teams/{teamId}
+   */
+  async updateTeam(orgId, teamId, body, token) {
+    const path = `/v1/orgs/${orgId}/teams/${teamId}`;
+    return this.request(
+      "PATCH",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Sign up with credentials
+   * Delete team
+   * DELETE /v1/orgs/{orgId}/teams/{teamId}
    */
-  async signUp(request) {
-    try {
-      this.setLoading();
-      const response = await this.provider.signUp(request);
-      this.updateState({
-        state: "authenticated" /* AUTHENTICATED */,
-        user: response.user,
-        session: response.session,
-        error: null,
-        isAuthenticated: true,
-        isLoading: false
-      });
-      if (this.autoRefresh) {
-        this.startAutoRefresh();
-      }
-    } catch (error) {
-      this.handleError(error);
-    }
+  async deleteTeam(orgId, teamId, body, token) {
+    const path = `/v1/orgs/${orgId}/teams/${teamId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Sign out
-   */
-  async signOut() {
-    try {
-      this.stopAutoRefresh();
-      await this.provider.signOut();
-      this.updateState({
-        state: "unauthenticated" /* UNAUTHENTICATED */,
-        user: null,
-        session: null,
-        error: null,
-        isAuthenticated: false,
-        isLoading: false
-      });
-    } catch (error) {
-      this.handleError(error);
-    }
+   * List passkeys
+   * GET /v1/passkeys/
+   */
+  async listPasskeys(token) {
+    const path = "/v1/passkeys/";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Update user profile
+   * Begin passkey login
+   * POST /v1/passkeys/login/begin
    */
-  async updateUser(request) {
-    try {
-      const user = await this.provider.updateUser(request);
-      const currentState = this.state.getValue();
-      this.updateState({
-        ...currentState,
-        user
-      });
-    } catch (error) {
-      this.handleError(error);
-    }
+  async passkeyLoginBegin(body) {
+    const path = "/v1/passkeys/login/begin";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Change password
+   * Complete passkey login
+   * POST /v1/passkeys/login/finish
    */
-  async changePassword(request) {
-    try {
-      await this.provider.changePassword(request);
-    } catch (error) {
-      throw this.provider.normalizeError(error);
-    }
+  async passkeyLoginFinish(body) {
+    const path = "/v1/passkeys/login/finish";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Request password reset
+   * Begin passkey registration
+   * POST /v1/passkeys/register/begin
    */
-  async requestPasswordReset(request) {
-    try {
-      await this.provider.requestPasswordReset(request);
-    } catch (error) {
-      throw this.provider.normalizeError(error);
-    }
+  async passkeyRegisterBegin(body, token) {
+    const path = "/v1/passkeys/register/begin";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Confirm password reset
+   * Complete passkey registration
+   * POST /v1/passkeys/register/finish
    */
-  async confirmPasswordReset(request) {
-    try {
-      await this.provider.confirmPasswordReset(request);
-    } catch (error) {
-      throw this.provider.normalizeError(error);
-    }
+  async passkeyRegisterFinish(body, token) {
+    const path = "/v1/passkeys/register/finish";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
+  }
+  /**
+   * Delete passkey
+   * DELETE /v1/passkeys/{credentialId}
+   */
+  async deletePasskey(credentialId, body, token) {
+    const path = `/v1/passkeys/${credentialId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Get OAuth sign in URL
+   * Refresh tokens
+   * POST /v1/refresh
    */
-  async getOAuthUrl(request) {
-    return this.provider.oauthSignIn(request);
+  async refresh(body) {
+    const path = "/v1/refresh";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Handle OAuth callback
+   * Reset password
+   * POST /v1/reset-password
    */
-  async handleOAuthCallback(request) {
-    try {
-      this.setLoading();
-      const response = await this.provider.oauthCallback(request);
-      this.updateState({
-        state: "authenticated" /* AUTHENTICATED */,
-        user: response.user,
-        session: response.session,
-        error: null,
-        isAuthenticated: true,
-        isLoading: false
-      });
-      if (this.autoRefresh) {
-        this.startAutoRefresh();
-      }
-    } catch (error) {
-      this.handleError(error);
-    }
+  async resetPassword(body) {
+    const path = "/v1/reset-password";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Get available OAuth providers
+   * List roles
+   * GET /v1/roles
    */
-  async getOAuthProviders() {
-    return this.provider.getOAuthProviders();
+  async authsomeListRoles(token) {
+    const path = "/v1/roles";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Send magic link
+   * Create role
+   * POST /v1/roles
    */
-  async sendMagicLink(request) {
-    try {
-      await this.provider.sendMagicLink(request);
-    } catch (error) {
-      throw this.provider.normalizeError(error);
-    }
+  async authsomeCreateRole(body, token) {
+    const path = "/v1/roles";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Verify magic link
+   * Get role
+   * GET /v1/roles/{roleId}
    */
-  async verifyMagicLink(request) {
-    try {
-      this.setLoading();
-      const response = await this.provider.verifyMagicLink(request);
-      this.updateState({
-        state: "authenticated" /* AUTHENTICATED */,
-        user: response.user,
-        session: response.session,
-        error: null,
-        isAuthenticated: true,
-        isLoading: false
-      });
-      if (this.autoRefresh) {
-        this.startAutoRefresh();
-      }
-    } catch (error) {
-      this.handleError(error);
-    }
+  async authsomeGetRole(roleId, token) {
+    const path = `/v1/roles/${roleId}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Send phone verification code
+   * Update role
+   * PATCH /v1/roles/{roleId}
    */
-  async sendPhoneCode(request) {
-    try {
-      await this.provider.sendPhoneCode(request);
-    } catch (error) {
-      throw this.provider.normalizeError(error);
-    }
+  async authsomeUpdateRole(roleId, body, token) {
+    const path = `/v1/roles/${roleId}`;
+    return this.request(
+      "PATCH",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Verify phone code
+   * Delete role
+   * DELETE /v1/roles/{roleId}
    */
-  async verifyPhoneCode(request) {
-    try {
-      this.setLoading();
-      const response = await this.provider.verifyPhoneCode(request);
-      this.updateState({
-        state: "authenticated" /* AUTHENTICATED */,
-        user: response.user,
-        session: response.session,
-        error: null,
-        isAuthenticated: true,
-        isLoading: false
-      });
-      if (this.autoRefresh) {
-        this.startAutoRefresh();
-      }
-    } catch (error) {
-      this.handleError(error);
-    }
+  async authsomeDeleteRole(roleId, token) {
+    const path = `/v1/roles/${roleId}`;
+    return this.request(
+      "DELETE",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Setup 2FA
+   * Assign role to user
+   * POST /v1/roles/{roleId}/assign
    */
-  async setupTwoFactor(request) {
-    return this.provider.setupTwoFactor(request);
+  async authsomeAssignRole(roleId, body, token) {
+    const path = `/v1/roles/${roleId}/assign`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Verify 2FA code
+   * List role permissions
+   * GET /v1/roles/{roleId}/permissions
    */
-  async verifyTwoFactor(request) {
-    try {
-      this.setLoading();
-      const response = await this.provider.verifyTwoFactor(request);
-      this.updateState({
-        state: "authenticated" /* AUTHENTICATED */,
-        user: response.user,
-        session: response.session,
-        error: null,
-        isAuthenticated: true,
-        isLoading: false
-      });
-      if (this.autoRefresh) {
-        this.startAutoRefresh();
-      }
-    } catch (error) {
-      this.handleError(error);
-    }
+  async authsomeListRolePermissions(roleId, token) {
+    const path = `/v1/roles/${roleId}/permissions`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Disable 2FA
+   * Add permission to role
+   * POST /v1/roles/{roleId}/permissions
    */
-  async disableTwoFactor() {
-    return this.provider.disableTwoFactor();
+  async authsomeAddPermission(roleId, body, token) {
+    const path = `/v1/roles/${roleId}/permissions`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Get 2FA status
+   * Remove permission from role
+   * DELETE /v1/roles/{roleId}/permissions/{permissionId}
    */
-  async getTwoFactorStatus() {
-    return this.provider.getTwoFactorStatus();
+  async authsomeRemovePermission(roleId, permissionId, token) {
+    const path = `/v1/roles/${roleId}/permissions/${permissionId}`;
+    return this.request(
+      "DELETE",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Register passkey
+   * Unassign role from user
+   * POST /v1/roles/{roleId}/unassign
    */
-  async registerPasskey(request) {
-    return this.provider.registerPasskey(request);
+  async authsomeUnassignRole(roleId, body, token) {
+    const path = `/v1/roles/${roleId}/unassign`;
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Authenticate with passkey
+   * List sessions
+   * GET /v1/sessions
    */
-  async authenticatePasskey(request) {
-    try {
-      this.setLoading();
-      const response = await this.provider.authenticatePasskey(request);
-      this.updateState({
-        state: "authenticated" /* AUTHENTICATED */,
-        user: response.user,
-        session: response.session,
-        error: null,
-        isAuthenticated: true,
-        isLoading: false
-      });
-      if (this.autoRefresh) {
-        this.startAutoRefresh();
-      }
-    } catch (error) {
-      this.handleError(error);
-    }
+  async listSessions(token) {
+    const path = "/v1/sessions";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * List passkeys
+   * Revoke session
+   * DELETE /v1/sessions/{sessionId}
    */
-  async listPasskeys() {
-    return this.provider.listPasskeys();
+  async revokeSession(sessionId, body, token) {
+    const path = `/v1/sessions/${sessionId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Delete passkey
+   * Sign in
+   * POST /v1/signin
    */
-  async deletePasskey(credentialId) {
-    return this.provider.deletePasskey(credentialId);
+  async signIn(body) {
+    const path = "/v1/signin";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
+  }
+  /**
+   * Sign out
+   * POST /v1/signout
+   */
+  async signOut(body, token) {
+    const path = "/v1/signout";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Get all organizations the user belongs to
-   * Only available if the provider supports organizations
+   * Sign up
+   * POST /v1/signup
    */
-  async getOrganizations() {
-    if (!this.provider.getOrganizations) {
-      throw this.createUnsupportedError("Organization support");
-    }
-    return this.provider.getOrganizations();
+  async signUp(body) {
+    const path = "/v1/signup";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Get the currently active organization
-   * Only available if the provider supports organizations
+   * Start OAuth flow
+   * POST /v1/social/{provider}
    */
-  async getActiveOrganization() {
-    if (!this.provider.getActiveOrganization) {
-      throw this.createUnsupportedError("Organization support");
-    }
-    return this.provider.getActiveOrganization();
+  async startOAuth(provider, body) {
+    const path = `/v1/social/${provider}`;
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Set the active organization and refresh user state
-   * Only available if the provider supports organizations
+   * OAuth callback
+   * GET /v1/social/{provider}/callback
    */
-  async setActiveOrganization(organizationId) {
-    if (!this.provider.setActiveOrganization) {
-      throw this.createUnsupportedError("Organization support");
-    }
-    await this.provider.setActiveOrganization(organizationId);
-    await this.refreshSession();
+  async oauthCallback(provider) {
+    const path = `/v1/social/${provider}/callback`;
+    return this.request(
+      "GET",
+      path,
+      void 0
+    );
   }
   /**
-   * Get organization memberships with roles and permissions
-   * Only available if the provider supports organizations
+   * SSO SAML ACS endpoint
+   * POST /v1/sso/{provider}/acs
    */
-  async getOrganizationMemberships() {
-    if (!this.provider.getOrganizationMemberships) {
-      throw this.createUnsupportedError("Organization memberships");
-    }
-    return this.provider.getOrganizationMemberships();
+  async ssoACS(provider, body) {
+    const path = `/v1/sso/${provider}/acs`;
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Check if the provider supports organizations
+   * SSO callback (OIDC)
+   * POST /v1/sso/{provider}/callback
    */
-  supportsOrganizations() {
-    return !!(this.provider.getOrganizations && this.provider.getActiveOrganization && this.provider.setActiveOrganization);
+  async ssoCallback(provider, body) {
+    const path = `/v1/sso/${provider}/callback`;
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Refresh session
+   * Start SSO login flow
+   * POST /v1/sso/{provider}/login
    */
-  async refreshSession() {
-    try {
-      const session = await this.provider.refreshSession();
-      const currentState = this.state.getValue();
-      this.updateState({
-        ...currentState,
-        session
-      });
-    } catch (error) {
-      console.warn("[AuthClient] Session refresh failed:", error);
-    }
+  async startSSOLogin(provider, body) {
+    const path = `/v1/sso/${provider}/login`;
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Get current user
+   * List user roles
+   * GET /v1/users/{userId}/roles
    */
-  getUser() {
-    return this.state.getValue().user;
+  async authsomeListUserRoles(userId, token) {
+    const path = `/v1/users/${userId}/roles`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Get current session
+   * Verify email
+   * POST /v1/verify-email
    */
-  getSession() {
-    return this.state.getValue().session;
+  async verifyEmail(body) {
+    const path = "/v1/verify-email";
+    return this.request(
+      "POST",
+      path,
+      body
+    );
   }
   /**
-   * Check if authenticated
+   * List webhooks
+   * GET /v1/webhooks
    */
-  isAuthenticated() {
-    return this.state.getValue().isAuthenticated;
+  async listWebhooks(token) {
+    const path = "/v1/webhooks";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Get current error
+   * Create webhook
+   * POST /v1/webhooks
    */
-  getError() {
-    return this.state.getValue().error;
+  async createWebhook(body, token) {
+    const path = "/v1/webhooks";
+    return this.request(
+      "POST",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Clear error
+   * Get webhook
+   * GET /v1/webhooks/{webhookId}
    */
-  clearError() {
-    const currentState = this.state.getValue();
-    this.updateState({
-      ...currentState,
-      error: null
-    });
+  async getWebhook(webhookId, token) {
+    const path = `/v1/webhooks/${webhookId}`;
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
   }
   /**
-   * Subscribe to auth state changes
+   * Update webhook
+   * PATCH /v1/webhooks/{webhookId}
    */
-  subscribe(listener) {
-    return this.state.subscribe(listener);
+  async updateWebhook(webhookId, body, token) {
+    const path = `/v1/webhooks/${webhookId}`;
+    return this.request(
+      "PATCH",
+      path,
+      body,
+      token
+    );
   }
   /**
-   * Cleanup resources
+   * Delete webhook
+   * DELETE /v1/webhooks/{webhookId}
    */
-  destroy() {
-    this.stopAutoRefresh();
-    this.state.clearListeners();
-  }
-  // Private methods
-  updateState(newState) {
-    this.state.setValue(newState);
-  }
-  setLoading() {
-    const currentState = this.state.getValue();
-    this.updateState({
-      ...currentState,
-      state: "loading" /* LOADING */,
-      isLoading: true,
-      error: null
-    });
+  async deleteWebhook(webhookId, body, token) {
+    const path = `/v1/webhooks/${webhookId}`;
+    return this.request(
+      "DELETE",
+      path,
+      body,
+      token
+    );
   }
-  handleError(error) {
-    const authError = this.provider.normalizeError(error);
-    const currentState = this.state.getValue();
-    this.updateState({
-      ...currentState,
-      state: "error" /* ERROR */,
-      error: authError,
-      isLoading: false
+  // ──────────────────────────────────────────────────
+  // Internal request helper
+  // ──────────────────────────────────────────────────
+  async request(method, path, body, token) {
+    const headers = {
+      "Content-Type": "application/json",
+      "Accept": "application/json"
+    };
+    if (token) {
+      headers["Authorization"] = `Bearer ${token}`;
+    }
+    const response = await this.fetchFn(`${this.baseURL}${path}`, {
+      method,
+      headers,
+      body: body !== void 0 ? JSON.stringify(body) : void 0
     });
-    throw authError;
-  }
-  startAutoRefresh() {
-    this.stopAutoRefresh();
-    this.refreshTimer = setInterval(() => {
-      this.refreshSession();
-    }, this.refreshInterval);
-  }
-  stopAutoRefresh() {
-    if (this.refreshTimer) {
-      clearInterval(this.refreshTimer);
-      this.refreshTimer = void 0;
+    if (!response.ok) {
+      let apiError;
+      try {
+        apiError = await response.json();
+      } catch {
+      }
+      throw new AuthClientError(
+        apiError?.error ?? `Request failed with status ${response.status}`,
+        apiError?.code ?? response.status
+      );
+    }
+    if (response.status === 204) {
+      return void 0;
     }
+    return response.json();
   }
-  createUnsupportedError(feature) {
-    return {
-      name: "AuthError",
-      message: `${feature} is not available with this auth provider`,
-      type: "unknown_error" /* UNKNOWN_ERROR */
-    };
+};
+var AuthClientError = class extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.name = "AuthClientError";
+    this.code = code;
   }
 };
 
-// src/flows/types.ts
-var FlowStep = /* @__PURE__ */ ((FlowStep2) => {
-  FlowStep2["SIGN_IN"] = "sign_in";
-  FlowStep2["SIGN_UP"] = "sign_up";
-  FlowStep2["EMAIL_PASSWORD_SIGN_IN"] = "email_password_sign_in";
-  FlowStep2["EMAIL_PASSWORD_SIGN_UP"] = "email_password_sign_up";
-  FlowStep2["OAUTH_SELECT"] = "oauth_select";
-  FlowStep2["OAUTH_CALLBACK"] = "oauth_callback";
-  FlowStep2["MAGIC_LINK_REQUEST"] = "magic_link_request";
-  FlowStep2["MAGIC_LINK_VERIFY"] = "magic_link_verify";
-  FlowStep2["MAGIC_LINK_SENT"] = "magic_link_sent";
-  FlowStep2["PHONE_REQUEST"] = "phone_request";
-  FlowStep2["PHONE_VERIFY"] = "phone_verify";
-  FlowStep2["USERNAME_SIGN_IN"] = "username_sign_in";
-  FlowStep2["USERNAME_SIGN_UP"] = "username_sign_up";
-  FlowStep2["PASSKEY_REGISTER"] = "passkey_register";
-  FlowStep2["PASSKEY_AUTHENTICATE"] = "passkey_authenticate";
-  FlowStep2["MFA_REQUIRED"] = "mfa_required";
-  FlowStep2["MFA_SETUP"] = "mfa_setup";
-  FlowStep2["MFA_VERIFY"] = "mfa_verify";
-  FlowStep2["MFA_SELECT_METHOD"] = "mfa_select_method";
-  FlowStep2["EMAIL_VERIFICATION_REQUIRED"] = "email_verification_required";
-  FlowStep2["EMAIL_VERIFICATION_SENT"] = "email_verification_sent";
-  FlowStep2["PHONE_VERIFICATION_REQUIRED"] = "phone_verification_required";
-  FlowStep2["PASSWORD_RESET_REQUEST"] = "password_reset_request";
-  FlowStep2["PASSWORD_RESET_SENT"] = "password_reset_sent";
-  FlowStep2["PASSWORD_RESET_CONFIRM"] = "password_reset_confirm";
-  FlowStep2["PASSWORD_CHANGE"] = "password_change";
-  FlowStep2["PROFILE_UPDATE"] = "profile_update";
-  FlowStep2["PROFILE_COMPLETE"] = "profile_complete";
-  FlowStep2["DEVICE_FLOW_INITIATE"] = "device_flow_initiate";
-  FlowStep2["DEVICE_CODE_ENTRY"] = "device_code_entry";
-  FlowStep2["DEVICE_CODE_VERIFY"] = "device_code_verify";
-  FlowStep2["DEVICE_AUTHORIZE"] = "device_authorize";
-  FlowStep2["DEVICE_POLLING"] = "device_polling";
-  FlowStep2["DEVICE_AUTHORIZED"] = "device_authorized";
-  FlowStep2["DEVICE_DENIED"] = "device_denied";
-  FlowStep2["SUCCESS"] = "success";
-  FlowStep2["ERROR"] = "error";
-  FlowStep2["CANCELLED"] = "cancelled";
-  return FlowStep2;
-})(FlowStep || {});
-var FlowConfigType = /* @__PURE__ */ ((FlowConfigType2) => {
-  FlowConfigType2["SIMPLE_SIGN_IN"] = "simple_sign_in";
-  FlowConfigType2["SIMPLE_SIGN_UP"] = "simple_sign_up";
-  FlowConfigType2["SIGN_UP_WITH_EMAIL_VERIFICATION"] = "sign_up_with_email_verification";
-  FlowConfigType2["SIGN_IN_WITH_MFA"] = "sign_in_with_mfa";
-  FlowConfigType2["OAUTH_SIGN_IN"] = "oauth_sign_in";
-  FlowConfigType2["MAGIC_LINK_FLOW"] = "magic_link_flow";
-  FlowConfigType2["PHONE_AUTH_FLOW"] = "phone_auth_flow";
-  FlowConfigType2["COMPLETE_SIGN_UP_FLOW"] = "complete_sign_up_flow";
-  FlowConfigType2["SECURE_SIGN_IN_FLOW"] = "secure_sign_in_flow";
-  FlowConfigType2["PASSWORD_RESET_FLOW"] = "password_reset_flow";
-  FlowConfigType2["EMAIL_VERIFICATION_FLOW"] = "email_verification_flow";
-  FlowConfigType2["DEVICE_FLOW"] = "device_flow";
-  FlowConfigType2["CUSTOM"] = "custom";
-  return FlowConfigType2;
-})(FlowConfigType || {});
-var FlowAction = /* @__PURE__ */ ((FlowAction2) => {
-  FlowAction2["START"] = "start";
-  FlowAction2["NEXT"] = "next";
-  FlowAction2["BACK"] = "back";
-  FlowAction2["CANCEL"] = "cancel";
-  FlowAction2["ERROR"] = "error";
-  FlowAction2["RESET"] = "reset";
-  return FlowAction2;
-})(FlowAction || {});
-
-// src/flows/engine.ts
-var FlowEngine = class {
-  constructor(config, initialState) {
-    this.history = [];
-    this.config = config;
-    this.state = {
-      currentStep: config.initialStep,
-      ...initialState
-    };
-    this.history.push(this.state.currentStep);
+// src/client.ts
+var AuthClient2 = class extends AuthClient {
+  /**
+   * Refresh session tokens.
+   *
+   * Accepts a raw refresh-token string (used by auth.ts) or the full
+   * RefreshRequest body.
+   */
+  async refresh(body) {
+    const req = typeof body === "string" ? { refresh_token: body } : body;
+    return super.refresh(req);
   }
   /**
-   * Get current flow state
+   * Sign out.
+   *
+   * Accepts a raw token string (used by auth.ts) or the full
+   * (body, token) pair from the generated client.
    */
-  getState() {
-    return { ...this.state };
+  async signOut(bodyOrToken, token) {
+    if (typeof bodyOrToken === "string") {
+      return super.signOut({}, bodyOrToken);
+    }
+    return super.signOut(bodyOrToken, token);
   }
   /**
-   * Get current step
+   * MFA challenge — bridge for auth.ts.
+   *
+   * auth.ts calls `mfaChallenge({ enrollment_id, code })` and expects
+   * an AuthResponse back.  The generated client uses `challengeMFA`.
    */
-  getCurrentStep() {
-    return this.state.currentStep;
+  async mfaChallenge(body) {
+    return super.challengeMFA(body);
   }
   /**
-   * Check if step is allowed in this flow
+   * Verify an MFA recovery code.
+   *
+   * Accepts a raw code string (used by auth.ts) or the full request body.
    */
-  isStepAllowed(step) {
-    return this.config.allowedSteps.includes(step);
+  async verifyRecoveryCode(body) {
+    const req = typeof body === "string" ? { code: body } : body;
+    return super.verifyRecoveryCode(req);
   }
   /**
-   * Transition to next step based on action
+   * Send an SMS code for MFA — bridge for auth.ts.
+   *
+   * Simplifies the call-site by accepting just the session token.
    */
-  async transition(event) {
-    const { action, data, error } = event;
-    switch (action) {
-      case "start":
-        return this.handleStart(data);
-      case "next":
-        return this.handleNext(data);
-      case "back":
-        return this.handleBack();
-      case "cancel":
-        return this.handleCancel();
-      case "error":
-        return this.handleError(error);
-      case "reset":
-        return this.handleReset();
-      default:
-        throw new AuthError(
-          `Unknown flow action: ${action}`,
-          "validation_error" /* VALIDATION_ERROR */
-        );
-    }
+  async sendSMSCodeForMFA(token) {
+    return super.sendSMSCode({}, token);
   }
   /**
-   * Start or restart the flow
+   * Verify an SMS code for MFA — bridge for auth.ts.
+   *
+   * Simplifies the call-site by accepting code + token directly.
    */
-  handleStart(data) {
-    this.state = {
-      currentStep: this.config.initialStep,
-      ...data
-    };
-    this.history = [this.state.currentStep];
-    if (this.config.onStepChange) {
-      this.config.onStepChange(this.state.currentStep, this.state);
-    }
-    return this.getState();
+  async verifySMSCodeForMFA(code, token) {
+    return super.verifySMSCode({ code }, token);
   }
   /**
-   * Move to next step
+   * Fetch the client configuration from the backend.
+   *
+   * The config describes which auth methods are enabled so SDK
+   * components can auto-configure without manual props.
    */
-  handleNext(data) {
-    this.state = {
-      ...this.state,
-      ...data,
-      previousStep: this.state.currentStep
-    };
-    const transitionConfig = this.config.transitions[this.state.currentStep];
-    if (!transitionConfig) {
-      throw new AuthError(
-        `No transition configured for step: ${this.state.currentStep}`,
-        "validation_error" /* VALIDATION_ERROR */
-      );
+  async fetchClientConfig(publishableKey) {
+    const url = new URL("/v1/client-config", this.config.baseURL);
+    if (publishableKey) {
+      url.searchParams.set("key", publishableKey);
     }
-    if (transitionConfig.conditions) {
-      for (const condition of transitionConfig.conditions) {
-        if (condition.when(this.state)) {
-          return this.moveToStep(condition.then);
-        }
-      }
+    const fetchFn = this.config.fetch ?? globalThis.fetch;
+    const res = await fetchFn(url.toString(), {
+      method: "GET",
+      headers: { "Content-Type": "application/json" }
+    });
+    if (!res.ok) {
+      throw new AuthClientError("Failed to fetch client config", res.status);
+    }
+    return res.json();
+  }
+};
+
+// src/auth.ts
+var SESSION_KEY = "authsome:session";
+var CONFIG_KEY = "authsome:client_config";
+var REFRESH_BEFORE_MS = 6e4;
+var CONFIG_TTL_MS = 5 * 6e4;
+var memoryStorage = /* @__PURE__ */ (() => {
+  const store = /* @__PURE__ */ new Map();
+  return {
+    getItem: (key) => store.get(key) ?? null,
+    setItem: (key, value) => {
+      store.set(key, value);
+    },
+    removeItem: (key) => {
+      store.delete(key);
     }
-    if (transitionConfig.onSuccess) {
-      return this.moveToStep(transitionConfig.onSuccess);
+  };
+})();
+function defaultStorage() {
+  try {
+    if (typeof window !== "undefined" && window.localStorage) {
+      return window.localStorage;
     }
-    throw new AuthError(
-      `No valid transition found for step: ${this.state.currentStep}`,
-      "validation_error" /* VALIDATION_ERROR */
-    );
+  } catch {
   }
-  /**
-   * Go back to previous step
-   */
-  handleBack() {
-    if (this.history.length < 2) {
-      throw new AuthError(
-        "Cannot go back - already at first step",
-        "validation_error" /* VALIDATION_ERROR */
-      );
+  return memoryStorage;
+}
+var AuthManager = class {
+  client;
+  storage;
+  state = { status: "idle" };
+  listeners = /* @__PURE__ */ new Set();
+  refreshTimer = null;
+  onError;
+  publishableKey;
+  clientConfig = null;
+  configListeners = /* @__PURE__ */ new Set();
+  configFetchPromise = null;
+  constructor(config) {
+    this.client = new AuthClient2(config);
+    this.storage = config.storage ?? defaultStorage();
+    this.onError = config.onError;
+    this.publishableKey = config.publishableKey;
+    if (config.initialClientConfig) {
+      this.clientConfig = config.initialClientConfig;
+    }
+    if (config.onStateChange) {
+      this.listeners.add(config.onStateChange);
     }
-    this.history.pop();
-    const previousStep = this.history[this.history.length - 1];
-    const transitionConfig = this.config.transitions[this.state.currentStep];
-    const targetStep = transitionConfig?.onBack || previousStep;
-    return this.moveToStep(targetStep, false);
+  }
+  // ── Public API ────────────────────────────────────
+  /** Current auth state (snapshot). */
+  getState() {
+    return this.state;
+  }
+  /** Subscribe to state changes. Returns an unsubscribe function. */
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  /** Access the underlying HTTP client. */
+  getClient() {
+    return this.client;
   }
   /**
-   * Cancel the flow
+   * Initialize by hydrating the session from storage.
+   * When a publishableKey is set, also fetches client config in parallel.
+   * Call this once on app start.
    */
-  handleCancel() {
-    const transitionConfig = this.config.transitions[this.state.currentStep];
-    const targetStep = transitionConfig?.onCancel;
-    if (this.config.onCancel) {
-      this.config.onCancel(this.state);
+  async initialize() {
+    if (this.publishableKey && !this.clientConfig) {
+      void this.fetchClientConfig();
     }
-    if (targetStep) {
-      return this.moveToStep(targetStep);
+    try {
+      const raw = await this.storage.getItem(SESSION_KEY);
+      if (!raw) {
+        this.setState({ status: "unauthenticated" });
+        return;
+      }
+      const session = JSON.parse(raw);
+      const expiresAt = new Date(session.expires_at).getTime();
+      if (Date.now() >= expiresAt) {
+        await this.refreshSession(session.refresh_token);
+        return;
+      }
+      this.setState({ status: "loading" });
+      const user = await this.client.getMe(session.session_token);
+      this.setState({ status: "authenticated", user, session });
+      this.scheduleRefresh(session);
+    } catch {
+      await this.clearSession();
+      this.setState({ status: "unauthenticated" });
     }
-    this.state.currentStep = "cancelled";
-    return this.getState();
   }
-  /**
-   * Handle error in flow
-   */
-  handleError(error) {
-    this.state.error = error;
-    const transitionConfig = this.config.transitions[this.state.currentStep];
-    const targetStep = transitionConfig?.onError;
-    if (this.config.onError) {
-      this.config.onError(error, this.state);
+  /** Sign in with email & password. */
+  async signIn(credentials) {
+    this.setState({ status: "loading" });
+    try {
+      const res = await this.client.signIn(credentials);
+      const session = {
+        session_token: res.session_token,
+        refresh_token: res.refresh_token,
+        expires_at: new Date(Date.now() + 36e5).toISOString()
+        // fallback
+      };
+      await this.handleAuthResponse(res.user, session);
+    } catch (err) {
+      this.handleError(err);
+      throw err;
     }
-    if (targetStep) {
-      return this.moveToStep(targetStep);
+  }
+  /** Sign up with email & password. */
+  async signUp(data) {
+    this.setState({ status: "loading" });
+    try {
+      const res = await this.client.signUp(data);
+      const session = {
+        session_token: res.session_token,
+        refresh_token: res.refresh_token,
+        expires_at: new Date(Date.now() + 36e5).toISOString()
+      };
+      await this.handleAuthResponse(res.user, session);
+    } catch (err) {
+      this.handleError(err);
+      throw err;
     }
-    return this.getState();
   }
-  /**
-   * Reset flow to initial state
-   */
-  handleReset() {
-    return this.handleStart();
+  /** Sign out and clear the session. */
+  async signOut() {
+    const token = this.getSessionToken();
+    if (token) {
+      try {
+        await this.client.signOut(token);
+      } catch {
+      }
+    }
+    this.clearRefreshTimer();
+    await this.clearSession();
+    this.setState({ status: "unauthenticated" });
   }
-  /**
-   * Move to a specific step
-   */
-  moveToStep(step, addToHistory = true) {
-    if (!this.isStepAllowed(step)) {
-      throw new AuthError(
-        `Step ${step} is not allowed in this flow`,
-        "validation_error" /* VALIDATION_ERROR */
-      );
+  /** Submit an MFA challenge code. */
+  async submitMFACode(enrollmentId, code) {
+    this.setState({ status: "loading" });
+    try {
+      const res = await this.client.mfaChallenge({ enrollment_id: enrollmentId, code });
+      const session = {
+        session_token: res.session_token,
+        refresh_token: res.refresh_token,
+        expires_at: new Date(Date.now() + 36e5).toISOString()
+      };
+      await this.handleAuthResponse(res.user, session);
+    } catch (err) {
+      this.handleError(err);
     }
-    this.state.currentStep = step;
-    if (addToHistory) {
-      this.history.push(step);
+  }
+  /** Submit an MFA recovery code. */
+  async submitRecoveryCode(code) {
+    this.setState({ status: "loading" });
+    try {
+      const res = await this.client.verifyRecoveryCode(code);
+      const session = {
+        session_token: res.session_token,
+        refresh_token: res.refresh_token,
+        expires_at: new Date(Date.now() + 36e5).toISOString()
+      };
+      await this.handleAuthResponse(res.user, session);
+    } catch (err) {
+      this.handleError(err);
+    }
+  }
+  /** Send an SMS code for MFA verification. Returns masked phone + expiry info. */
+  async sendSMSCode() {
+    const token = this.getSessionToken();
+    if (!token) throw new Error("No session token available");
+    return this.client.sendSMSCodeForMFA(token);
+  }
+  /** Submit an SMS verification code during MFA challenge. */
+  async submitSMSCode(code) {
+    this.setState({ status: "loading" });
+    try {
+      const token = this.getSessionToken();
+      if (!token) throw new Error("No session token available");
+      const res = await this.client.verifySMSCodeForMFA(code, token);
+      const session = {
+        session_token: res.session_token,
+        refresh_token: res.refresh_token,
+        expires_at: new Date(Date.now() + 36e5).toISOString()
+      };
+      await this.handleAuthResponse(res.user, session);
+    } catch (err) {
+      this.handleError(err);
     }
-    if (this.config.onStepChange) {
-      this.config.onStepChange(step, this.state);
+  }
+  /** Refresh the current session manually. */
+  async refreshNow() {
+    const state = this.state;
+    if (state.status !== "authenticated") return;
+    await this.refreshSession(state.session.refresh_token);
+  }
+  /** Get the current session token (if authenticated). */
+  getSessionToken() {
+    if (this.state.status === "authenticated") {
+      return this.state.session.session_token;
     }
-    if (step === "success" && this.state.user && this.state.session) {
-      if (this.config.onComplete) {
-        this.config.onComplete(this.state.user, this.state.session);
-      }
+    if (this.state.status === "mfa_required") {
+      return this.state.session.session_token;
     }
-    return this.getState();
+    return null;
   }
-  /**
-   * Get flow history
-   */
-  getHistory() {
-    return [...this.history];
+  /** Get the current user (if authenticated). */
+  getUser() {
+    if (this.state.status === "authenticated") {
+      return this.state.user;
+    }
+    return null;
+  }
+  // ── Client Config API ────────────────────────────
+  /** Get the cached client config (or null if not yet fetched). */
+  getClientConfig() {
+    return this.clientConfig;
+  }
+  /** Subscribe to client config changes. Returns an unsubscribe function. */
+  subscribeConfig(listener) {
+    this.configListeners.add(listener);
+    return () => {
+      this.configListeners.delete(listener);
+    };
   }
   /**
-   * Check if can go back
+   * Fetch client config from the backend.
+   * Deduplicates concurrent calls and caches the result with a TTL.
    */
-  canGoBack() {
-    return this.history.length > 1;
-  }
-};
-
-// src/flows/configs.ts
-var simpleSignInFlow = {
-  name: "Simple Sign In",
-  description: "Basic email/password sign-in",
-  initialStep: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
-  allowedSteps: [
-    "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
-    "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */,
-    "email_verification_sent" /* EMAIL_VERIFICATION_SENT */,
-    "password_reset_request" /* PASSWORD_RESET_REQUEST */,
-    "password_reset_sent" /* PASSWORD_RESET_SENT */,
-    "success" /* SUCCESS */,
-    "error" /* ERROR */
-  ],
-  transitions: {
-    ["email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */]: {
-      onSuccess: "success" /* SUCCESS */,
-      onError: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */
-    },
-    ["email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */]: {
-      onSuccess: "email_verification_sent" /* EMAIL_VERIFICATION_SENT */,
-      onError: "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */
-    },
-    ["email_verification_sent" /* EMAIL_VERIFICATION_SENT */]: {
-      onSuccess: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
-      onError: "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */
-    },
-    ["password_reset_request" /* PASSWORD_RESET_REQUEST */]: {
-      onSuccess: "password_reset_sent" /* PASSWORD_RESET_SENT */,
-      onBack: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */
-    },
-    ["password_reset_sent" /* PASSWORD_RESET_SENT */]: {
-      onSuccess: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */
+  async fetchClientConfig() {
+    if (this.configFetchPromise) {
+      return this.configFetchPromise;
     }
-  }
-};
-var signInWithMFAFlow = {
-  name: "Sign In with MFA",
-  description: "Sign-in that handles MFA if enabled",
-  initialStep: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
-  allowedSteps: [
-    "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
-    "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */,
-    "email_verification_sent" /* EMAIL_VERIFICATION_SENT */,
-    "mfa_required" /* MFA_REQUIRED */,
-    "mfa_select_method" /* MFA_SELECT_METHOD */,
-    "mfa_verify" /* MFA_VERIFY */,
-    "password_reset_request" /* PASSWORD_RESET_REQUEST */,
-    "password_reset_sent" /* PASSWORD_RESET_SENT */,
-    "success" /* SUCCESS */,
-    "error" /* ERROR */
-  ],
-  transitions: {
-    ["email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */]: {
-      onSuccess: "success" /* SUCCESS */,
-      onError: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
-      conditions: [
-        {
-          when: (state) => state.mfaRequired === true,
-          then: "mfa_required" /* MFA_REQUIRED */
-        }
-      ]
-    },
-    ["email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */]: {
-      onSuccess: "email_verification_sent" /* EMAIL_VERIFICATION_SENT */,
-      onError: "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */
-    },
-    ["email_verification_sent" /* EMAIL_VERIFICATION_SENT */]: {
-      onSuccess: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */,
-      onError: "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */
-    },
-    ["mfa_required" /* MFA_REQUIRED */]: {
-      onSuccess: "mfa_verify" /* MFA_VERIFY */,
-      conditions: [
-        {
-          when: (state) => (state.mfaMethods?.length || 0) > 1,
-          then: "mfa_select_method" /* MFA_SELECT_METHOD */
+    try {
+      const cached = await this.storage.getItem(CONFIG_KEY);
+      if (cached) {
+        const { config, fetchedAt } = JSON.parse(cached);
+        if (Date.now() - fetchedAt < CONFIG_TTL_MS) {
+          this.setClientConfig(config);
+          return config;
         }
-      ]
-    },
-    ["mfa_select_method" /* MFA_SELECT_METHOD */]: {
-      onSuccess: "mfa_verify" /* MFA_VERIFY */,
-      onBack: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */
-    },
-    ["mfa_verify" /* MFA_VERIFY */]: {
-      onSuccess: "success" /* SUCCESS */,
-      onError: "mfa_verify" /* MFA_VERIFY */,
-      onBack: "mfa_select_method" /* MFA_SELECT_METHOD */
-    },
-    ["password_reset_request" /* PASSWORD_RESET_REQUEST */]: {
-      onSuccess: "password_reset_sent" /* PASSWORD_RESET_SENT */,
-      onBack: "email_password_sign_in" /* EMAIL_PASSWORD_SIGN_IN */
+      }
+    } catch {
     }
+    this.configFetchPromise = this.client.fetchClientConfig(this.publishableKey).then(async (config) => {
+      this.setClientConfig(config);
+      try {
+        await this.storage.setItem(
+          CONFIG_KEY,
+          JSON.stringify({ config, fetchedAt: Date.now() })
+        );
+      } catch {
+      }
+      return config;
+    }).finally(() => {
+      this.configFetchPromise = null;
+    });
+    return this.configFetchPromise;
   }
-};
-var completeSignUpFlow = {
-  name: "Complete Sign Up",
-  description: "Sign-up with email verification and profile completion",
-  initialStep: "email_password_sign_up" /* EMAIL_PASSWORD_SIGN_UP */,
-  allowedSteps: [
-    "email_password_sign_up" /* EMAIL_PASSWORD_SIGN_UP */,
-    "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */,
-    "email_verification_sent" /* EMAIL_VERIFICATION_SENT */,
-    "profile_complete" /* PROFILE_COMPLETE */,
-    "success" /* SUCCESS */,
-    "error" /* ERROR */
-  ],
-  transitions: {
-    ["email_password_sign_up" /* EMAIL_PASSWORD_SIGN_UP */]: {
-      onSuccess: "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */,
-      onError: "email_password_sign_up" /* EMAIL_PASSWORD_SIGN_UP */,
-      conditions: [
-        {
-          when: (state) => state.verificationRequired === false,
-          then: "profile_complete" /* PROFILE_COMPLETE */
-        }
-      ]
-    },
-    ["email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */]: {
-      onSuccess: "email_verification_sent" /* EMAIL_VERIFICATION_SENT */
-    },
-    ["email_verification_sent" /* EMAIL_VERIFICATION_SENT */]: {
-      onSuccess: "profile_complete" /* PROFILE_COMPLETE */
-    },
-    ["profile_complete" /* PROFILE_COMPLETE */]: {
-      onSuccess: "success" /* SUCCESS */,
-      onError: "profile_complete" /* PROFILE_COMPLETE */
+  /** Tear down: clear timers and listeners. */
+  destroy() {
+    this.clearRefreshTimer();
+    this.listeners.clear();
+    this.configListeners.clear();
+  }
+  // ── Internals ─────────────────────────────────────
+  async handleAuthResponse(user, session) {
+    await this.persistSession(session);
+    this.setState({ status: "authenticated", user, session });
+    this.scheduleRefresh(session);
+  }
+  async refreshSession(refreshToken) {
+    try {
+      const newSession = await this.client.refresh(refreshToken);
+      const user = await this.client.getMe(newSession.session_token);
+      await this.persistSession(newSession);
+      this.setState({ status: "authenticated", user, session: newSession });
+      this.scheduleRefresh(newSession);
+    } catch {
+      await this.clearSession();
+      this.setState({ status: "unauthenticated" });
     }
   }
-};
-var magicLinkFlow = {
-  name: "Magic Link",
-  description: "Passwordless authentication via email",
-  initialStep: "magic_link_request" /* MAGIC_LINK_REQUEST */,
-  allowedSteps: [
-    "magic_link_request" /* MAGIC_LINK_REQUEST */,
-    "magic_link_sent" /* MAGIC_LINK_SENT */,
-    "magic_link_verify" /* MAGIC_LINK_VERIFY */,
-    "success" /* SUCCESS */,
-    "error" /* ERROR */
-  ],
-  transitions: {
-    ["magic_link_request" /* MAGIC_LINK_REQUEST */]: {
-      onSuccess: "magic_link_sent" /* MAGIC_LINK_SENT */,
-      onError: "magic_link_request" /* MAGIC_LINK_REQUEST */
-    },
-    ["magic_link_sent" /* MAGIC_LINK_SENT */]: {
-      onSuccess: "magic_link_verify" /* MAGIC_LINK_VERIFY */
-    },
-    ["magic_link_verify" /* MAGIC_LINK_VERIFY */]: {
-      onSuccess: "success" /* SUCCESS */,
-      onError: "magic_link_request" /* MAGIC_LINK_REQUEST */
+  scheduleRefresh(session) {
+    this.clearRefreshTimer();
+    const expiresAt = new Date(session.expires_at).getTime();
+    const delay = expiresAt - Date.now() - REFRESH_BEFORE_MS;
+    if (delay <= 0) {
+      void this.refreshSession(session.refresh_token);
+      return;
+    }
+    this.refreshTimer = setTimeout(() => {
+      void this.refreshSession(session.refresh_token);
+    }, delay);
+  }
+  clearRefreshTimer() {
+    if (this.refreshTimer !== null) {
+      clearTimeout(this.refreshTimer);
+      this.refreshTimer = null;
     }
   }
-};
-var phoneAuthFlow = {
-  name: "Phone Authentication",
-  description: "SMS-based authentication",
-  initialStep: "phone_request" /* PHONE_REQUEST */,
-  allowedSteps: [
-    "phone_request" /* PHONE_REQUEST */,
-    "phone_verify" /* PHONE_VERIFY */,
-    "success" /* SUCCESS */,
-    "error" /* ERROR */
-  ],
-  transitions: {
-    ["phone_request" /* PHONE_REQUEST */]: {
-      onSuccess: "phone_verify" /* PHONE_VERIFY */,
-      onError: "phone_request" /* PHONE_REQUEST */
-    },
-    ["phone_verify" /* PHONE_VERIFY */]: {
-      onSuccess: "success" /* SUCCESS */,
-      onError: "phone_verify" /* PHONE_VERIFY */,
-      onBack: "phone_request" /* PHONE_REQUEST */
+  async persistSession(session) {
+    await this.storage.setItem(SESSION_KEY, JSON.stringify(session));
+  }
+  async clearSession() {
+    await this.storage.removeItem(SESSION_KEY);
+  }
+  setClientConfig(config) {
+    this.clientConfig = config;
+    for (const listener of this.configListeners) {
+      try {
+        listener(config);
+      } catch {
+      }
     }
   }
-};
-var oauthSignInFlow = {
-  name: "OAuth Sign In",
-  description: "Third-party OAuth authentication",
-  initialStep: "oauth_select" /* OAUTH_SELECT */,
-  allowedSteps: [
-    "oauth_select" /* OAUTH_SELECT */,
-    "oauth_callback" /* OAUTH_CALLBACK */,
-    "success" /* SUCCESS */,
-    "error" /* ERROR */
-  ],
-  transitions: {
-    ["oauth_select" /* OAUTH_SELECT */]: {
-      onSuccess: "oauth_callback" /* OAUTH_CALLBACK */,
-      onError: "oauth_select" /* OAUTH_SELECT */
-    },
-    ["oauth_callback" /* OAUTH_CALLBACK */]: {
-      onSuccess: "success" /* SUCCESS */,
-      onError: "oauth_select" /* OAUTH_SELECT */
+  setState(newState) {
+    this.state = newState;
+    for (const listener of this.listeners) {
+      try {
+        listener(newState);
+      } catch {
+      }
     }
   }
-};
-var passwordResetFlow = {
-  name: "Password Reset",
-  description: "Reset forgotten password",
-  initialStep: "password_reset_request" /* PASSWORD_RESET_REQUEST */,
-  allowedSteps: [
-    "password_reset_request" /* PASSWORD_RESET_REQUEST */,
-    "password_reset_sent" /* PASSWORD_RESET_SENT */,
-    "password_reset_confirm" /* PASSWORD_RESET_CONFIRM */,
-    "success" /* SUCCESS */,
-    "error" /* ERROR */
-  ],
-  transitions: {
-    ["password_reset_request" /* PASSWORD_RESET_REQUEST */]: {
-      onSuccess: "password_reset_sent" /* PASSWORD_RESET_SENT */,
-      onError: "password_reset_request" /* PASSWORD_RESET_REQUEST */
-    },
-    ["password_reset_sent" /* PASSWORD_RESET_SENT */]: {
-      onSuccess: "password_reset_confirm" /* PASSWORD_RESET_CONFIRM */
-    },
-    ["password_reset_confirm" /* PASSWORD_RESET_CONFIRM */]: {
-      onSuccess: "success" /* SUCCESS */,
-      onError: "password_reset_confirm" /* PASSWORD_RESET_CONFIRM */
+  handleError(err) {
+    const message = err instanceof AuthClientError ? err.message : "An unexpected error occurred";
+    const code = err instanceof AuthClientError ? err.code : void 0;
+    if (code === 403 && message.toLowerCase().includes("mfa")) {
+      const token = this.getSessionToken();
+      if (token) {
+        this.setState({
+          status: "mfa_required",
+          session: {
+            session_token: token,
+            refresh_token: "",
+            expires_at: new Date(Date.now() + 3e5).toISOString()
+          }
+        });
+        return;
+      }
     }
+    this.setState({ status: "error", error: message });
+    this.onError?.({ error: message, code });
   }
 };
-var emailVerificationFlow = {
-  name: "Email Verification",
-  description: "Verify email address with code or link",
-  initialStep: "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */,
-  allowedSteps: [
-    "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */,
-    "email_verification_sent" /* EMAIL_VERIFICATION_SENT */,
-    "success" /* SUCCESS */,
-    "error" /* ERROR */
-  ],
-  transitions: {
-    ["email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */]: {
-      onSuccess: "email_verification_sent" /* EMAIL_VERIFICATION_SENT */,
-      onError: "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */
-    },
-    ["email_verification_sent" /* EMAIL_VERIFICATION_SENT */]: {
-      onSuccess: "success" /* SUCCESS */,
-      onError: "email_verification_required" /* EMAIL_VERIFICATION_REQUIRED */
+
+// src/webauthn.ts
+function base64urlToBuffer(base64url) {
+  const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+function bufferToBase64url(buffer) {
+  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.byteLength; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function prepareCreationOptions(options) {
+  const publicKey = options.publicKey ?? options;
+  const out = { ...publicKey };
+  if (typeof out.challenge === "string") {
+    out.challenge = base64urlToBuffer(out.challenge);
+  }
+  if (out.user && typeof out.user === "object") {
+    const user = { ...out.user };
+    if (typeof user.id === "string") {
+      user.id = base64urlToBuffer(user.id);
     }
+    out.user = user;
   }
-};
-var deviceFlow = {
-  name: "Device Flow",
-  description: "OAuth 2.0 Device Authorization Grant for CLI/device login",
-  initialStep: "device_code_entry" /* DEVICE_CODE_ENTRY */,
-  allowedSteps: [
-    "device_code_entry" /* DEVICE_CODE_ENTRY */,
-    "device_code_verify" /* DEVICE_CODE_VERIFY */,
-    "device_authorize" /* DEVICE_AUTHORIZE */,
-    "device_authorized" /* DEVICE_AUTHORIZED */,
-    "device_denied" /* DEVICE_DENIED */,
-    "success" /* SUCCESS */,
-    "error" /* ERROR */
-  ],
-  transitions: {
-    ["device_code_entry" /* DEVICE_CODE_ENTRY */]: {
-      onSuccess: "device_code_verify" /* DEVICE_CODE_VERIFY */,
-      onError: "device_code_entry" /* DEVICE_CODE_ENTRY */,
-      onCancel: "cancelled" /* CANCELLED */
-    },
-    ["device_code_verify" /* DEVICE_CODE_VERIFY */]: {
-      onSuccess: "device_authorize" /* DEVICE_AUTHORIZE */,
-      onError: "device_code_entry" /* DEVICE_CODE_ENTRY */,
-      onBack: "device_code_entry" /* DEVICE_CODE_ENTRY */
-    },
-    ["device_authorize" /* DEVICE_AUTHORIZE */]: {
-      onSuccess: "device_authorized" /* DEVICE_AUTHORIZED */,
-      onError: "device_denied" /* DEVICE_DENIED */,
-      onCancel: "device_denied" /* DEVICE_DENIED */
-    },
-    ["device_authorized" /* DEVICE_AUTHORIZED */]: {
-      onSuccess: "success" /* SUCCESS */
-    },
-    ["device_denied" /* DEVICE_DENIED */]: {
-      onSuccess: "error" /* ERROR */
+  if (Array.isArray(out.excludeCredentials)) {
+    out.excludeCredentials = out.excludeCredentials.map((c) => {
+      if (typeof c.id === "string") {
+        return { ...c, id: base64urlToBuffer(c.id) };
+      }
+      return c;
+    });
+  }
+  return out;
+}
+function prepareRequestOptions(options) {
+  const publicKey = options.publicKey ?? options;
+  const out = { ...publicKey };
+  if (typeof out.challenge === "string") {
+    out.challenge = base64urlToBuffer(out.challenge);
+  }
+  if (Array.isArray(out.allowCredentials)) {
+    out.allowCredentials = out.allowCredentials.map((c) => {
+      if (typeof c.id === "string") {
+        return { ...c, id: base64urlToBuffer(c.id) };
+      }
+      return c;
+    });
+  }
+  return out;
+}
+function serializeCredential(credential) {
+  const cred = credential;
+  const response = cred.response;
+  const result = {
+    id: cred.id,
+    rawId: bufferToBase64url(cred.rawId),
+    type: cred.type,
+    response: {}
+  };
+  const serializedResponse = {
+    clientDataJSON: bufferToBase64url(response.clientDataJSON)
+  };
+  if ("attestationObject" in response) {
+    const attestation = response;
+    serializedResponse.attestationObject = bufferToBase64url(
+      attestation.attestationObject
+    );
+  }
+  if ("authenticatorData" in response) {
+    const assertion = response;
+    serializedResponse.authenticatorData = bufferToBase64url(
+      assertion.authenticatorData
+    );
+    serializedResponse.signature = bufferToBase64url(assertion.signature);
+    if (assertion.userHandle) {
+      serializedResponse.userHandle = bufferToBase64url(assertion.userHandle);
     }
   }
-};
-function getFlowConfig(type) {
-  switch (type) {
-    case "simple_sign_in" /* SIMPLE_SIGN_IN */:
-      return simpleSignInFlow;
-    case "sign_in_with_mfa" /* SIGN_IN_WITH_MFA */:
-      return signInWithMFAFlow;
-    case "complete_sign_up_flow" /* COMPLETE_SIGN_UP_FLOW */:
-      return completeSignUpFlow;
-    case "magic_link_flow" /* MAGIC_LINK_FLOW */:
-      return magicLinkFlow;
-    case "phone_auth_flow" /* PHONE_AUTH_FLOW */:
-      return phoneAuthFlow;
-    case "oauth_sign_in" /* OAUTH_SIGN_IN */:
-      return oauthSignInFlow;
-    case "password_reset_flow" /* PASSWORD_RESET_FLOW */:
-      return passwordResetFlow;
-    case "email_verification_flow" /* EMAIL_VERIFICATION_FLOW */:
-      return emailVerificationFlow;
-    case "device_flow" /* DEVICE_FLOW */:
-      return deviceFlow;
-    default:
-      throw new Error(`Unknown flow type: ${type}`);
+  result.response = serializedResponse;
+  if (cred.authenticatorAttachment) {
+    result.authenticatorAttachment = cred.authenticatorAttachment;
   }
+  return result;
 }
-var predefinedFlows = {
-  ["simple_sign_in" /* SIMPLE_SIGN_IN */]: simpleSignInFlow,
-  ["sign_in_with_mfa" /* SIGN_IN_WITH_MFA */]: signInWithMFAFlow,
-  ["complete_sign_up_flow" /* COMPLETE_SIGN_UP_FLOW */]: completeSignUpFlow,
-  ["magic_link_flow" /* MAGIC_LINK_FLOW */]: magicLinkFlow,
-  ["phone_auth_flow" /* PHONE_AUTH_FLOW */]: phoneAuthFlow,
-  ["oauth_sign_in" /* OAUTH_SIGN_IN */]: oauthSignInFlow,
-  ["password_reset_flow" /* PASSWORD_RESET_FLOW */]: passwordResetFlow,
-  ["email_verification_flow" /* EMAIL_VERIFICATION_FLOW */]: emailVerificationFlow,
-  ["device_flow" /* DEVICE_FLOW */]: deviceFlow
+export {
+  AuthClient2 as AuthClient,
+  AuthClientError,
+  AuthManager,
+  base64urlToBuffer,
+  bufferToBase64url,
+  prepareCreationOptions,
+  prepareRequestOptions,
+  serializeCredential
 };
-
-exports.AuthClient = AuthClient;
-exports.AuthError = AuthError;
-exports.AuthErrorType = AuthErrorType;
-exports.AuthState = AuthState;
-exports.BaseAuthProvider = BaseAuthProvider;
-exports.FlowAction = FlowAction;
-exports.FlowConfigType = FlowConfigType;
-exports.FlowEngine = FlowEngine;
-exports.FlowStep = FlowStep;
-exports.LocalStorageAdapter = LocalStorageAdapter;
-exports.MemoryStorageAdapter = MemoryStorageAdapter;
-exports.OAuthProvider = OAuthProvider;
-exports.Observable = Observable;
-exports.SessionStorageAdapter = SessionStorageAdapter;
-exports.TokenManager = TokenManager;
-exports.TwoFactorMethod = TwoFactorMethod;
-exports.completeSignUpFlow = completeSignUpFlow;
-exports.createAuthError = createAuthError;
-exports.createLocale = createLocale;
-exports.defaultLocale = defaultLocale;
-exports.emailVerificationFlow = emailVerificationFlow;
-exports.extractCookiesFromHeaders = extractCookiesFromHeaders;
-exports.getFlowConfig = getFlowConfig;
-exports.interpolate = interpolate;
-exports.isAuthError = isAuthError;
-exports.isMFARequiredError = isMFARequiredError;
-exports.isNetworkError = isNetworkError;
-exports.isUnauthenticatedError = isUnauthenticatedError;
-exports.magicLinkFlow = magicLinkFlow;
-exports.oauthSignInFlow = oauthSignInFlow;
-exports.parseCookie = parseCookie;
-exports.parseCookieOptions = parseCookieOptions;
-exports.passwordResetFlow = passwordResetFlow;
-exports.phoneAuthFlow = phoneAuthFlow;
-exports.predefinedFlows = predefinedFlows;
-exports.serializeCookie = serializeCookie;
-exports.serializeCookies = serializeCookies;
-exports.signInWithMFAFlow = signInWithMFAFlow;
-exports.simpleSignInFlow = simpleSignInFlow;
-exports.toAuthError = toAuthError;
-exports.validate2FACode = validate2FACode;
-exports.validateEmail = validateEmail;
-exports.validatePassword = validatePassword;
-exports.validatePhone = validatePhone;
-exports.validateRequired = validateRequired;
-exports.validateUsername = validateUsername;
-//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map