@authsome/ui-core 1.7.1 → 1.8.1

package/dist/index.js

@@ -805,7 +805,7 @@ var AuthClient = class {
    * List SSO connections for an app (admin)
    * GET /v1/admin/sso/connections
    */
-  async ssoAdminListConnections(app_id, token) {
+  async ssoAdminListConnections(token, app_id) {
     const params = new URLSearchParams();
     if (app_id !== void 0) params.set("app_id", String(app_id));
     const qs = params.toString();
@@ -995,6 +995,19 @@ var AuthClient = class {
       token
     );
   }
+  /**
+   * Unlock user (admin)
+   * POST /v1/admin/users/{userId}/unlock
+   */
+  async adminUnlockUser(userId, token) {
+    const path = `/v1/admin/users/${userId}/unlock`;
+    return this.request(
+      "POST",
+      path,
+      void 0,
+      token
+    );
+  }
   /**
    * List coupons
    * GET /v1/billing/coupons
@@ -1717,6 +1730,32 @@ var AuthClient = class {
       token
     );
   }
+  /**
+   * List my OAuth2 grants
+   * GET /v1/me/oauth/grants
+   */
+  async oauth2ListMyGrants(token) {
+    const path = "/v1/me/oauth/grants";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * Revoke an OAuth2 grant
+   * DELETE /v1/me/oauth/grants/{clientId}
+   */
+  async oauth2RevokeMyGrant(clientId, token) {
+    const path = `/v1/me/oauth/grants/${clientId}`;
+    return this.request(
+      "DELETE",
+      path,
+      void 0,
+      token
+    );
+  }
   /**
    * Switch active organization
    * POST /v1/me/switch-org
@@ -1835,7 +1874,7 @@ var AuthClient = class {
    * OAuth2 Authorization
    * GET /v1/oauth/authorize
    */
-  async oauth2Authorize(response_type, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, resource) {
+  async oauth2Authorize(response_type, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, resource, prompt) {
     const params = new URLSearchParams();
     if (response_type !== void 0) params.set("response_type", String(response_type));
     if (client_id !== void 0) params.set("client_id", String(client_id));
@@ -1845,6 +1884,7 @@ var AuthClient = class {
     if (code_challenge !== void 0) params.set("code_challenge", String(code_challenge));
     if (code_challenge_method !== void 0) params.set("code_challenge_method", String(code_challenge_method));
     if (resource !== void 0) for (const element of resource) params.append("resource", String(element));
+    if (prompt !== void 0) params.set("prompt", String(prompt));
     const qs = params.toString();
     const path = "/v1/oauth/authorize" + (qs ? `?${qs}` : "");
     return this.request(
@@ -1853,6 +1893,32 @@ var AuthClient = class {
       void 0
     );
   }
+  /**
+   * OAuth2 consent
+   * GET /v1/oauth/consent
+   */
+  async oauth2ConsentPage(token) {
+    const path = "/v1/oauth/consent";
+    return this.request(
+      "GET",
+      path,
+      void 0,
+      token
+    );
+  }
+  /**
+   * OAuth2 consent decision
+   * POST /v1/oauth/consent
+   */
+  async oauth2ConsentDecision(token) {
+    const path = "/v1/oauth/consent";
+    return this.request(
+      "POST",
+      path,
+      void 0,
+      token
+    );
+  }
   /**
    * Device Authorization
    * POST /v1/oauth/device/authorize
@@ -1978,8 +2044,12 @@ var AuthClient = class {
    * List organizations
    * GET /v1/orgs
    */
-  async listOrganizations(token) {
-    const path = "/v1/orgs";
+  async listOrganizations(token, limit, cursor) {
+    const params = new URLSearchParams();
+    if (limit !== void 0) params.set("limit", String(limit));
+    if (cursor !== void 0) params.set("cursor", String(cursor));
+    const qs = params.toString();
+    const path = "/v1/orgs" + (qs ? `?${qs}` : "");
     return this.request(
       "GET",
       path,
@@ -2086,8 +2156,12 @@ var AuthClient = class {
    * List invitations
    * GET /v1/orgs/{orgId}/invitations
    */
-  async listInvitations(orgId, token) {
-    const path = `/v1/orgs/${orgId}/invitations`;
+  async listInvitations(orgId, token, limit, cursor) {
+    const params = new URLSearchParams();
+    if (limit !== void 0) params.set("limit", String(limit));
+    if (cursor !== void 0) params.set("cursor", String(cursor));
+    const qs = params.toString();
+    const path = `/v1/orgs/${orgId}/invitations` + (qs ? `?${qs}` : "");
     return this.request(
       "GET",
       path,
@@ -2112,8 +2186,12 @@ var AuthClient = class {
    * List members
    * GET /v1/orgs/{orgId}/members
    */
-  async listMembers(orgId, token) {
-    const path = `/v1/orgs/${orgId}/members`;
+  async listMembers(orgId, token, limit, cursor) {
+    const params = new URLSearchParams();
+    if (limit !== void 0) params.set("limit", String(limit));
+    if (cursor !== void 0) params.set("cursor", String(cursor));
+    const qs = params.toString();
+    const path = `/v1/orgs/${orgId}/members` + (qs ? `?${qs}` : "");
     return this.request(
       "GET",
       path,
@@ -2164,8 +2242,12 @@ var AuthClient = class {
    * List teams
    * GET /v1/orgs/{orgId}/teams
    */
-  async listTeams(orgId, token) {
-    const path = `/v1/orgs/${orgId}/teams`;
+  async listTeams(orgId, token, limit, cursor) {
+    const params = new URLSearchParams();
+    if (limit !== void 0) params.set("limit", String(limit));
+    if (cursor !== void 0) params.set("cursor", String(cursor));
+    const qs = params.toString();
+    const path = `/v1/orgs/${orgId}/teams` + (qs ? `?${qs}` : "");
     return this.request(
       "GET",
       path,
@@ -2512,8 +2594,12 @@ var AuthClient = class {
    * List sessions
    * GET /v1/sessions
    */
-  async listSessions(token) {
-    const path = "/v1/sessions";
+  async listSessions(token, limit, cursor) {
+    const params = new URLSearchParams();
+    if (limit !== void 0) params.set("limit", String(limit));
+    if (cursor !== void 0) params.set("cursor", String(cursor));
+    const qs = params.toString();
+    const path = "/v1/sessions" + (qs ? `?${qs}` : "");
     return this.request(
       "GET",
       path,
@@ -2521,6 +2607,19 @@ var AuthClient = class {
       token
     );
   }
+  /**
+   * Revoke other sessions
+   * DELETE /v1/sessions
+   */
+  async revokeOtherSessions(token) {
+    const path = "/v1/sessions";
+    return this.request(
+      "DELETE",
+      path,
+      void 0,
+      token
+    );
+  }
   /**
    * Revoke session
    * DELETE /v1/sessions/{sessionId}
@@ -2821,6 +2920,19 @@ var AuthClient = class {
       token
     );
   }
+  /**
+   * Rotate webhook secret
+   * POST /v1/webhooks/{webhookId}/rotate-secret
+   */
+  async rotateWebhookSecret(webhookId, token) {
+    const path = `/v1/webhooks/${webhookId}/rotate-secret`;
+    return this.request(
+      "POST",
+      path,
+      void 0,
+      token
+    );
+  }
   // ──────────────────────────────────────────────────
   // Internal request helper
   // ──────────────────────────────────────────────────
@@ -2883,7 +2995,65 @@ var AuthClientError = class extends Error {
 };
 
 // src/client.ts
+function readOrganizationList(res) {
+  const body = res ?? {};
+  const organizations = body.organizations ?? body.items ?? [];
+  return {
+    organizations,
+    nextCursor: body.next_cursor || void 0,
+    total: typeof body.total === "number" ? body.total : organizations.length
+  };
+}
 var AuthClient2 = class extends AuthClient {
+  waitlistURL;
+  waitlistFetch;
+  constructor(config) {
+    const fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
+    let baseURL = config.baseURL;
+    while (baseURL.endsWith("/")) baseURL = baseURL.slice(0, -1);
+    const deviceCompletionURL = `${baseURL}/v1/oauth/device/complete`;
+    super({
+      ...config,
+      fetch: (input, init) => {
+        const isDeviceCompletion = input === deviceCompletionURL && init?.method === "POST";
+        return fetchFn(
+          input,
+          isDeviceCompletion ? { ...init, credentials: "include" } : init
+        );
+      }
+    });
+    this.waitlistURL = `${baseURL}/v1/waitlist/join`;
+    this.waitlistFetch = fetchFn;
+  }
+  /** Join the waitlist, or return the existing entry and its approval status. */
+  async joinWaitlist(body) {
+    const headers = {
+      "Content-Type": "application/json",
+      Accept: "application/json"
+    };
+    const key = this.getPublishableKey();
+    if (key) headers["X-Publishable-Key"] = key;
+    const response = await this.waitlistFetch(this.waitlistURL, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ ...body, email: body.email.trim().toLowerCase() })
+    });
+    const data = await response.json().catch(() => null);
+    if (!response.ok) {
+      throw new AuthClientError(
+        data?.error ?? `Request failed with status ${response.status}`,
+        response.status,
+        data?.type,
+        data ?? void 0
+      );
+    }
+    if (typeof data?.email !== "string" || !["pending", "approved", "rejected"].includes(data?.status)) {
+      throw new AuthClientError(
+        "Unable to check waitlist status. Please try again."
+      );
+    }
+    return data;
+  }
   /**
    * Refresh session tokens.
    *
@@ -2908,97 +3078,44 @@ var AuthClient2 = class extends AuthClient {
     }
     return super.signOut(token);
   }
-  /**
-   * MFA challenge — bridge for auth.ts.
-   *
-   * auth.ts calls `mfaChallenge({ enrollment_id, code })` and expects
-   * an AuthResponse back.  The generated client uses `challengeMFA`.
-   */
+  /** @deprecated Use challengeMFA with the ticket from sign-in. */
   async mfaChallenge(body) {
+    if (!("mfa_ticket" in body) || !body.mfa_ticket) {
+      throw new Error(
+        "MFA challenge requires an authentication ticket, not an enrollment ID"
+      );
+    }
     return super.challengeMFA(body);
   }
-  /**
-   * Verify an MFA recovery code.
-   *
-   * Accepts a raw code string (used by auth.ts) or the full request body.
-   */
+  /** Verify a recovery code in an existing cookie-authenticated session. */
   async verifyRecoveryCode(body) {
-    const req = typeof body === "string" ? { code: body } : body;
-    return super.verifyRecoveryCode(req);
+    return super.verifyRecoveryCode(
+      typeof body === "string" ? { code: body } : body
+    );
   }
-  /**
-   * Send an SMS code for MFA — bridge for auth.ts.
-   *
-   * Simplifies the call-site by accepting just the session token.
-   */
+  /** Send an SMS code for the authenticated session. */
   async sendSMSCodeForMFA(token) {
     return super.sendSMSCode({}, token);
   }
-  /**
-   * Verify an SMS code for MFA — bridge for auth.ts.
-   *
-   * Simplifies the call-site by accepting code + token directly.
-   */
+  /** Verify an SMS code without issuing a session. */
   async verifySMSCodeForMFA(code, token) {
     return super.verifySMSCode({ code }, token);
   }
-  /**
-   * Complete a device authorization (RFC 8628).
-   *
-   * Approves or denies a device code. Requires an authenticated session —
-   * pass the session token so the backend can identify the user.
-   */
+  /** Approve or deny a device using a bearer token or the existing session cookie. */
   async completeDeviceAuthorization(userCode, action, token) {
-    const base = this.baseURL;
-    const fetchFn = this.fetchFn;
-    const headers = {
-      "Content-Type": "application/json"
-    };
-    if (token) {
-      headers.Authorization = `Bearer ${token}`;
-    }
-    const res = await fetchFn(`${base}/v1/oauth/device/complete`, {
-      method: "POST",
-      headers,
-      credentials: "include",
-      body: JSON.stringify({ user_code: userCode, action })
-    });
-    if (!res.ok) {
-      const body = await res.json().catch(() => ({}));
-      throw new AuthClientError(
-        body.error || "Failed to authorize device",
-        res.status
-      );
-    }
-    return res.json();
+    return super.oauth2DeviceComplete(
+      { user_code: userCode, action },
+      token ?? ""
+    );
   }
   /**
    * Fetch the client configuration from the backend.
    *
    * The config describes which auth methods are enabled so SDK
    * components can auto-configure without manual props.
-   *
-   * Reads `baseURL` and `fetchFn` directly off the generated parent
-   * class — earlier generator templates kept a `this.config` ref but
-   * the current embedded template stores fields individually, so the
-   * old `(this as any).config.baseURL` shape produced `undefined` and
-   * the URL constructor threw.
    */
   async fetchClientConfig(publishableKey) {
-    const baseURL = this.baseURL;
-    const fetchFn = this.fetchFn ?? globalThis.fetch;
-    const url = new URL("/v1/client-config", baseURL);
-    if (publishableKey) {
-      url.searchParams.set("key", publishableKey);
-    }
-    const res = await fetchFn(url.toString(), {
-      method: "GET",
-      headers: { "Content-Type": "application/json" }
-    });
-    if (!res.ok) {
-      throw new AuthClientError("Failed to fetch client config", res.status);
-    }
-    return res.json();
+    return super.getClientConfig("", publishableKey);
   }
 };
 
@@ -3007,6 +3124,7 @@ var SESSION_STORAGE_KEY = "authsome:session";
 var SESSION_KEY = SESSION_STORAGE_KEY;
 var CONFIG_KEY = "authsome:client_config";
 var REFRESH_BEFORE_MS = 6e4;
+var MAX_TIMEOUT_MS = 2147483647;
 var CONFIG_TTL_MS = 5 * 6e4;
 var DEFAULT_SESSION_TTL_MS = 36e5;
 var MAX_REFRESH_ATTEMPTS = 5;
@@ -3045,19 +3163,45 @@ function isAuthRejection(err) {
   }
   return false;
 }
+var refreshQueues = /* @__PURE__ */ new Map();
+async function withRefreshLock(key, operation) {
+  if (typeof navigator !== "undefined" && navigator.locks) {
+    await navigator.locks.request(key, operation);
+    return;
+  }
+  const previous = refreshQueues.get(key) ?? Promise.resolve();
+  const next = previous.catch(() => {
+  }).then(operation);
+  refreshQueues.set(key, next);
+  try {
+    await next;
+  } finally {
+    if (refreshQueues.get(key) === next) refreshQueues.delete(key);
+  }
+}
 var AuthManager = class {
   client;
   storage;
   state = { status: "idle" };
   listeners = /* @__PURE__ */ new Set();
+  initializePromise = null;
+  refreshPromise = null;
+  refreshLockKey;
+  active = true;
+  smsCeremonyVersion = 0;
   refreshTimer = null;
   onError;
   publishableKey;
+  configCacheKey;
   clientConfig = null;
   configListeners = /* @__PURE__ */ new Set();
   configFetchPromise = null;
   constructor(config) {
     this.client = new AuthClient2(config);
+    let baseEnd = config.baseURL.length;
+    while (baseEnd > 0 && config.baseURL[baseEnd - 1] === "/") baseEnd--;
+    this.configCacheKey = `${CONFIG_KEY}:${JSON.stringify([config.baseURL.slice(0, baseEnd), config.publishableKey ?? ""])}`;
+    this.refreshLockKey = `authsome:refresh:${config.baseURL}:${config.publishableKey ?? ""}`;
     this.storage = config.storage ?? createMemoryStorage();
     this.onError = config.onError;
     this.publishableKey = config.publishableKey;
@@ -3089,9 +3233,20 @@ var AuthManager = class {
    * When a publishableKey is set, also fetches client config in parallel.
    * Call this once on app start.
    */
-  async initialize() {
+  initialize() {
+    this.active = true;
+    if (!this.initializePromise) {
+      this.initializePromise = this.restoreSession().finally(() => {
+        this.initializePromise = null;
+      });
+    }
+    return this.initializePromise;
+  }
+  async restoreSession() {
+    let session;
     if (this.publishableKey && !this.clientConfig) {
-      void this.fetchClientConfig();
+      void this.fetchClientConfig().catch(() => {
+      });
     }
     try {
       const raw = await this.storage.getItem(SESSION_KEY);
@@ -3099,7 +3254,7 @@ var AuthManager = class {
         this.setState({ status: "unauthenticated" });
         return;
       }
-      const session = JSON.parse(raw);
+      session = JSON.parse(raw);
       const expiresAt = new Date(session.expires_at).getTime();
       if (Date.now() >= expiresAt) {
         await this.refreshSession(session.refresh_token);
@@ -3110,7 +3265,11 @@ var AuthManager = class {
       this.setState({ status: "authenticated", user, session });
       this.scheduleRefresh(session);
     } catch (err) {
-      await this.handleInitFailure(err);
+      if (session?.refresh_token && isAuthRejection(err)) {
+        await this.refreshSession(session.refresh_token);
+      } else {
+        await this.handleInitFailure(err);
+      }
     }
   }
   /**
@@ -3146,7 +3305,12 @@ var AuthManager = class {
       return;
     }
     this.setState({ status: "unknown", session });
-    this.scheduleRefresh(session);
+    this.clearRefreshTimer();
+    if (this.active) {
+      this.refreshTimer = setTimeout(() => {
+        void this.initialize();
+      }, REFRESH_RETRY_BASE_MS);
+    }
   }
   /** Sign in with email & password. */
   async signIn(credentials) {
@@ -3179,10 +3343,51 @@ var AuthManager = class {
       throw err;
     }
   }
+  /**
+   * Begin an SSO login against one of the app's configured connections.
+   *
+   * Resolves to the IdP `login_url`; the caller navigates the browser there.
+   * `returnUrl` is where the backend lands the browser after the IdP round
+   * trip, with `?code=` on success or `?sso_error=` on failure. It must be an
+   * allowlisted https origin (or localhost). Omit it to use the server's
+   * default `/sso/callback` landing.
+   */
+  async startSSOLogin(connectionId, returnUrl) {
+    const res = await this.client.startSSOLogin(connectionId, returnUrl);
+    return res.login_url;
+  }
+  /**
+   * Finish an SSO login by exchanging the one-time `code` from the callback
+   * URL for a session. The exchange is publishable-key authed, so no bearer
+   * token is sent.
+   */
+  async completeSSOLogin(code) {
+    try {
+      const res = await this.client.ssoExchange({ code }, "");
+      const session = toSession(res);
+      await this.handleAuthResponse(res.user, session);
+    } catch (err) {
+      this.handleError(err);
+      throw err;
+    }
+  }
   /** Sign up with email & password. */
   async signUp(data) {
     try {
-      await this.client.signUp(data);
+      const config = this.clientConfig ?? (this.publishableKey ? await this.fetchClientConfig() : null);
+      if (config?.signup_enabled === false)
+        throw new Error("Signup isn't available for this app.");
+      const res = await this.client.signUp(data);
+      const verification = config?.email_verification;
+      if (verification && (!verification.enabled || !verification.required)) {
+        try {
+          const user = await this.client.getMe(res.session_token);
+          await this.handleAuthResponse(user, toSession(res));
+          return;
+        } catch (err) {
+          if (!isAuthRejection(err)) throw err;
+        }
+      }
       this.setState({
         status: "verification_pending",
         email: data.email
@@ -3213,6 +3418,8 @@ var AuthManager = class {
   }
   /** Sign out and clear the session. */
   async signOut() {
+    this.smsCeremonyVersion++;
+    this.clearRefreshTimer();
     const token = this.getSessionToken();
     if (token) {
       try {
@@ -3237,7 +3444,9 @@ var AuthManager = class {
   async submitMFAChallenge(code) {
     const state = this.state;
     if (state.status !== "mfa_required") {
-      throw new Error("auth: submitMFAChallenge called outside the mfa_required state");
+      throw new Error(
+        "auth: submitMFAChallenge called outside the mfa_required state"
+      );
     }
     try {
       const res = await this.client.challengeMFA({
@@ -3262,41 +3471,51 @@ var AuthManager = class {
   async submitMFACode(_enrollmentId, code) {
     return this.submitMFAChallenge(code);
   }
-  /** Submit an MFA recovery code. */
+  /** Submit a recovery code against the active login ticket. */
   async submitRecoveryCode(code) {
-    this.setState({ status: "loading" });
-    try {
-      const res = await this.client.verifyRecoveryCode(code);
-      const session = toSession(res);
-      await this.handleAuthResponse(res.user, session);
-    } catch (err) {
-      this.handleError(err);
-    }
+    return this.submitMFAChallenge(code);
   }
-  /** Send an SMS code for MFA verification. Returns masked phone + expiry info. */
+  /** Send an SMS code for an already authenticated session. */
   async sendSMSCode() {
-    const token = this.getSessionToken();
-    if (!token) throw new Error("No session token available");
-    return this.client.sendSMSCodeForMFA(token);
+    const state = this.requireSMSAuthState();
+    const version = this.smsCeremonyVersion;
+    const result = await this.client.sendSMSCodeForMFA(
+      state.session.session_token
+    );
+    this.checkSMSAuthState(state, version);
+    if (!result.sent) throw new Error("SMS code was not sent");
+    return result;
   }
-  /** Submit an SMS verification code during MFA challenge. */
+  /** Verify an SMS ceremony without replacing the authenticated session. */
   async submitSMSCode(code) {
-    this.setState({ status: "loading" });
-    try {
-      const token = this.getSessionToken();
-      if (!token) throw new Error("No session token available");
-      const res = await this.client.verifySMSCodeForMFA(code, token);
-      const session = toSession(res);
-      await this.handleAuthResponse(res.user, session);
-    } catch (err) {
-      this.handleError(err);
+    const state = this.requireSMSAuthState();
+    const version = this.smsCeremonyVersion;
+    const result = await this.client.verifySMSCodeForMFA(
+      code,
+      state.session.session_token
+    );
+    this.checkSMSAuthState(state, version);
+    if (!result.verified || result.method !== "sms") {
+      throw new Error("SMS verification failed");
+    }
+  }
+  requireSMSAuthState() {
+    if (!this.active || this.state.status !== "authenticated" || !this.state.session.session_token) {
+      throw new Error("SMS verification requires an authenticated session");
+    }
+    return this.state;
+  }
+  checkSMSAuthState(state, version) {
+    if (!this.active || this.state !== state || this.smsCeremonyVersion !== version) {
+      throw new Error("Session changed during SMS verification");
     }
   }
   /** Refresh the current session manually. */
   async refreshNow() {
-    const state = this.state;
-    if (state.status !== "authenticated") return;
-    await this.refreshSession(state.session.refresh_token);
+    const raw = await this.storage.getItem(SESSION_KEY);
+    if (!raw) return;
+    const session = JSON.parse(raw);
+    if (session.refresh_token) await this.refreshSession(session.refresh_token);
   }
   /**
    * Get the current session token (if authenticated). Returns null
@@ -3346,7 +3565,7 @@ var AuthManager = class {
       return this.configFetchPromise;
     }
     try {
-      const cached = await this.storage.getItem(CONFIG_KEY);
+      const cached = await this.storage.getItem(this.configCacheKey);
       if (cached) {
         const { config, fetchedAt } = JSON.parse(cached);
         if (Date.now() - fetchedAt < CONFIG_TTL_MS) {
@@ -3360,7 +3579,7 @@ var AuthManager = class {
       this.setClientConfig(config);
       try {
         await this.storage.setItem(
-          CONFIG_KEY,
+          this.configCacheKey,
           JSON.stringify({ config, fetchedAt: Date.now() })
         );
       } catch {
@@ -3373,6 +3592,7 @@ var AuthManager = class {
   }
   /** Tear down: clear timers and listeners. */
   destroy() {
+    this.active = false;
     this.clearRefreshTimer();
     this.listeners.clear();
     this.configListeners.clear();
@@ -3383,43 +3603,46 @@ var AuthManager = class {
     this.setState({ status: "authenticated", user, session });
     this.scheduleRefresh(session);
   }
-  /**
-   * Exchanges the refresh token for a new session.
-   *
-   * On failure the two cases are separated, as they are in initialize: a
-   * rejected token means signed out, anything else means no verdict and is
-   * worth retrying.
-   *
-   * `attempt` was previously accepted and never read, and the retry path
-   * called back in without it — so a permanently-invalid token retried every
-   * 30s for as long as the tab stayed open, and the user was never signed out.
-   * It now bounds the retries and backs off between them.
-   */
-  async refreshSession(refreshToken, attempt = 0) {
+  // Keep rotation and persistence in the same lock. Once the server rotates a
+  // token, every later operation must read its replacement from storage.
+  refreshSession(refreshToken, attempt = 0) {
+    if (!this.refreshPromise) {
+      this.refreshPromise = withRefreshLock(
+        this.refreshLockKey,
+        () => this.exchangeSession(refreshToken, attempt)
+      ).finally(() => {
+        this.refreshPromise = null;
+      });
+    }
+    return this.refreshPromise;
+  }
+  async exchangeSession(refreshToken, attempt) {
+    let current;
+    let exchanged = false;
     try {
-      const newSession = await this.client.refresh(refreshToken);
-      const user = await this.client.getMe(newSession.session_token);
-      await this.persistSession(newSession);
-      this.setState({ status: "authenticated", user, session: newSession });
-      this.scheduleRefresh(newSession);
-    } catch (err) {
-      if (isAuthRejection(err)) {
+      const raw = await this.storage.getItem(SESSION_KEY);
+      if (!raw) {
         this.setState({ status: "unauthenticated" });
         return;
       }
-      if (attempt >= MAX_REFRESH_ATTEMPTS) {
-        const stored = await this.storage.getItem(SESSION_KEY);
-        if (stored) {
-          try {
-            this.setState({ status: "unknown", session: JSON.parse(stored) });
-            return;
-          } catch {
-          }
-        }
+      current = JSON.parse(raw);
+      if (current.refresh_token === refreshToken || Date.now() >= Date.parse(current.expires_at)) {
+        current = await this.client.refresh(current.refresh_token);
+        exchanged = true;
+        await this.persistSession(current);
+      }
+      const user = await this.client.getMe(current.session_token);
+      this.setState({ status: "authenticated", user, session: current });
+      this.scheduleRefresh(current);
+    } catch (err) {
+      this.clearRefreshTimer();
+      if (!exchanged && isAuthRejection(err) && current?.refresh_token === refreshToken) {
+        await this.clearSession();
         this.setState({ status: "unauthenticated" });
         return;
       }
-      this.clearRefreshTimer();
+      if (current) this.setState({ status: "unknown", session: current });
+      if (attempt >= MAX_REFRESH_ATTEMPTS || !this.active) return;
       this.refreshTimer = setTimeout(
         () => {
           void this.refreshSession(refreshToken, attempt + 1);
@@ -3430,15 +3653,19 @@ var AuthManager = class {
   }
   scheduleRefresh(session) {
     this.clearRefreshTimer();
+    if (!this.active) return;
     const expiresAt = new Date(session.expires_at).getTime();
     const delay = expiresAt - Date.now() - REFRESH_BEFORE_MS;
-    if (delay <= 0) {
+    if (!Number.isFinite(expiresAt) || delay <= 0) {
       void this.refreshSession(session.refresh_token);
       return;
     }
-    this.refreshTimer = setTimeout(() => {
-      void this.refreshSession(session.refresh_token);
-    }, delay);
+    this.refreshTimer = setTimeout(
+      () => {
+        this.scheduleRefresh(session);
+      },
+      Math.min(delay, MAX_TIMEOUT_MS)
+    );
   }
   clearRefreshTimer() {
     if (this.refreshTimer !== null) {
@@ -3616,6 +3843,7 @@ export {
   isSafeRedirect,
   prepareCreationOptions,
   prepareRequestOptions,
+  readOrganizationList,
   safeRedirectTarget,
   serializeCredential
 };