@baliola/auth-sdk 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,76 @@
+# Changelog
+
+All notable changes to `@baliola/auth-sdk` are documented here.
+
+## 0.2.0
+
+Distribution change and clean-ups; no method-level API changes.
+
+- chore(release): publish to **public npm** (`https://registry.npmjs.org`) instead of GitHub Packages. Installing no longer requires a Personal Access Token, an `.npmrc` registry override, or SSO authorization — plain `bun add @baliola/auth-sdk` works in every environment.
+- docs: rewrite `README.md`, `docs/install.md`, `docs/ciSetup.md`, and `docs/troubleshooting.md` to reflect public-npm install. CI snippets no longer need build secrets.
+- Consumers previously installing from GitHub Packages should remove any `@baliola:registry=https://npm.pkg.github.com` entries from `~/.npmrc` and project-local `.npmrc` files before upgrading.
+- fix(types): realign `AccessTokenPayload` with the server's current JWT shape. The flat `projectId?: string | null` / `projectName?: string | null` pair is replaced by `projects: AccessTokenPayloadProject[]` (each entry carries `{ id, name, clientId }`). Type-only change — affects consumers that decode the JWT manually and reference this type. A scoped login (`clientId` supplied) yields a single-entry array; a central login yields every project the account has active roles in.
+- chore!: remove the `./internal` subpath export and the `internal/` source folder (`createValidateCache`, `newIdempotencyKey`, `consumeHeaders`). Those helpers targeted the retired `/internal/api-keys/*` endpoints and the static "internal token" concept. Service-to-service callers now authenticate with an admin-tier API key (`baliola_admin_…`) against `/admin/api-keys/*`; cache + idempotency helpers for that surface will ship in a dedicated admin SDK.
+
+## 0.1.0
+
+Breaking redesign of the auth API and SDK surface to eliminate dev confusion between the two email flows. Old method names and endpoint paths are removed; no aliases.
+
+### Breaking changes
+
+- feat(sdk)!: replace the flat method surface with namespaced flows — `auth.emailOtp.*`, `auth.emailPassword.*`, `auth.google.*`. The namespaces match the DB provider names (`email_otp`, `email_password`).
+- feat(sdk)!: rename verb-overloaded methods so each one's purpose is unambiguous at the call site:
+  - `auth.requestEmailOtp` → `auth.emailOtp.sendLoginCode`
+  - `auth.verifyEmailOtp` → `auth.emailOtp.verifyLoginCode`
+  - `auth.register` → `auth.emailPassword.register`
+  - `auth.verifyRegistration` → `auth.emailPassword.verifyRegistrationCode`
+  - `auth.loginWithPassword` → `auth.emailPassword.login`
+  - `auth.setPassword` → `auth.emailPassword.setPassword`
+  - `auth.changePassword` → `auth.emailPassword.changePassword`
+  - `auth.loginWithGoogle` → `auth.google.login`
+- feat(sdk)!: verify-code methods take `{ email, code }` instead of `{ email, otp }`.
+- feat(sdk)!: `auth.emailPassword.register` no longer branches on `'otp_sent' | 'linked'` — it always sends a verification OTP and returns `{ otp: OtpInfo }`. The single-step "linked" path is removed.
+- feat(sdk)!: send/resend/register success responses replace `expiresInMinutes` with a structured `OtpInfo` payload — `expiresInSeconds`, `expiresAt`, `canResendInSeconds`, `resendsRemaining`.
+- feat(sdk)!: backend endpoint paths renamed to match the namespaces: `POST /auth/email-otp/send-login-code`, `/auth/email-otp/verify-login-code`, `/auth/email-otp/resend-login-code`, `/auth/email-password/register`, `/auth/email-password/verify-registration-code`, `/auth/email-password/resend-registration-code`, etc.
+
+### New features
+
+- feat(sdk): add typed error subclasses under `AuthError` — `OtpInvalidError` (with `attemptsRemaining`, `canResendInSeconds`), `OtpExpiredError`, `MaxAttemptsError` (with `retryAfterSeconds`), `NoPendingOtpError`, `ResendCooldownError` (with `canResendInSeconds`), `MaxResendsError`, `InvalidCredentialsError`, `NoPasswordSetError`, `AccountSuspendedError`, `EmailAlreadyHasPasswordError`, `CaptchaFailedError`, `RateLimitedError` (with `retryAfterSeconds`, `retryAfterHuman`), `InvalidPasswordError` (with `reason`), `InvalidEmailError`. Branch on `instanceof` for TS narrowing, or `err.code` for stable string matching. Backend responses now carry the structured context fields via `error.details` so the SDK lifts them into the typed properties.
+- feat(sdk): add dedicated resend methods — `auth.emailOtp.resendLoginCode` and `auth.emailPassword.resendRegistrationCode`. Each enforces its own resend cooldown (`OTP_RESEND_COOLDOWN_SECONDS`, default 60s) and per-OTP cap (`OTP_MAX_RESENDS`, default 3) on top of the per-OTP attempts limit.
+- feat(sdk): add `captchaToken` option on every public unauthenticated entrypoint (`sendLoginCode`, `resendLoginCode`, `register`, `resendRegistrationCode`, `login`). Backend verifies via Cloudflare Turnstile when `TURNSTILE_SECRET_KEY` is set; dev bypass when unset; server-to-server clients can be allowlisted via `CAPTCHA_BYPASS_CLIENT_IDS`.
+- feat(sdk): `auth.emailOtp.sendLoginCode` response includes `flow: 'login' | 'signup'` and `methods: ('password' | 'passwordless')[]` so the UI can adapt to the account state without an extra round-trip.
+
+### Internal
+
+- refactor(sdk): backend collapses the two OTP namespaces (`otp:*` and `email_verify:*`) into a single Redis record per email, stamped with `purpose: 'passwordless' | 'register_password'`. Latest-wins on conflicts; the pending bcrypt hash for password registration is held inside the record until verify, so no account/provider rows are written before email ownership is proven.
+- docs(sdk): rewrite README around namespaced flows + typed error taxonomy; rewrite `docs/concepts.md` with sequence diagrams for each flow and the shared OTP-store model.
+
+## 0.0.5
+
+- feat(sdk): add cross-tab session sync via `BroadcastChannel` — when one tab logs in, logs out, or refreshes the access token, every other tab on the same origin updates its in-memory mirror in real time.
+- feat(sdk): add `auth.fetch({ requireAuth: true })` per-call option that throws `AuthError(401)` before sending when no session is loaded.
+- feat(sdk): add `auth.fetch({ disableRefresh: true })` per-call option that skips both proactive and reactive refresh, letting a 401 propagate to the caller.
+
+## 0.0.4
+
+- feat(sdk): add `changePassword({ currentPassword, newPassword })` paired with `POST /auth/email-password/change-password` server route — verifies the current password, rotates the bcrypt hash, revokes every other session for the account (caller stays signed in), and sends a confirmation email out-of-band.
+- chore(auth): relax password policy to require only 8+ characters and at least one uppercase letter (number and special-character requirements dropped).
+
+## 0.0.3
+
+- chore(sdk): bump version to 0.0.3
+- feat(sdk): expose `Project.allowedOrigins` on `AuthSession`
+
+## 0.0.2
+
+- chore(sdk): bump version to 0.0.2
+- refactor(sdk): drop pre-release version labels from public JSDoc
+- docs(sdk): inline install in README and move roadmap to ROADMAP.md
+- docs(sdk): add user install, troubleshooting, and CI setup guides
+- docs(sdk): add README with usage and configuration reference
+- test(sdk): add unit tests for client, transport, and store
+- feat(sdk): implement auth client with auto-refresh, session mirror, and consumer fetch helper
+
+## 0.0.1
+
+- feat(sdk): scaffold `@baliola/auth-sdk` package config

package/LICENSE

@@ -0,0 +1,37 @@
+Copyright (c) 2026 Baliola. All rights reserved.
+
+PROPRIETARY AND CONFIDENTIAL
+
+This software, including its source code, compiled output, type definitions,
+documentation, and any associated materials (collectively, the "Software"), is
+the proprietary property of Baliola. All rights, title, and interest in and to
+the Software are and shall remain the exclusive property of Baliola.
+
+Access to the Software is granted only to parties expressly authorized by
+Baliola, and solely under the terms of a separate written agreement with
+Baliola. No rights or licenses are granted by implication, estoppel, or
+otherwise.
+
+Without Baliola's prior written consent, the following are prohibited:
+
+1. Redistribution of the Software, in whole or in part, in source or
+   compiled form, to any third party.
+2. Modification, adaptation, translation, or creation of derivative works
+   based on the Software.
+3. Reverse engineering, decompilation, or disassembly of the Software,
+   except to the extent such restriction is expressly prohibited by
+   applicable law.
+4. Sublicensing, leasing, renting, selling, or otherwise transferring any
+   rights in the Software.
+5. Removing, altering, or obscuring any copyright, trademark, or other
+   proprietary notices appearing in the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NONINFRINGEMENT. IN NO EVENT
+SHALL BALIOLA, ITS AFFILIATES, OR CONTRIBUTORS BE LIABLE FOR ANY CLAIM,
+DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR
+OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+For licensing inquiries, contact: <info@baliola.io>

package/README.md

@@ -0,0 +1,305 @@
+# @baliola/auth-sdk
+
+Client SDK for the Baliola Auth service. Two clearly separated email flows (passwordless OTP, password + verification OTP) plus Google login, with typed methods, typed errors, auto-refresh, and cross-tab sync.
+
+For deeper detail see [docs/concepts.md](./docs/concepts.md).
+
+## Install
+
+```sh
+bun add @baliola/auth-sdk
+# or: npm install @baliola/auth-sdk
+# or: pnpm add @baliola/auth-sdk
+```
+
+Published to public npm under the `@baliola` scope — no registry config or auth token required.
+
+**Runtime**: Bun (any recent), Node 20.3+, Chrome 116+, Safari 17+, Firefox 124+. Zero runtime deps. ESM only.
+
+## Quick start
+
+```ts
+import { createAuthClient, localStorageStore, OtpInvalidError } from '@baliola/auth-sdk';
+
+const auth = createAuthClient({
+  baseUrl: 'https://baliola-auth.baliola.dev',
+  clientId: 'your-project-client-id', // omit for a central multi-project login
+  store: localStorageStore(), // omit for in-memory (server-side / tests)
+});
+await auth.loadSession(); // rehydrate from store at app boot
+
+// Passwordless login
+const { otp } = await auth.emailOtp.sendLoginCode({
+  email: 'user@example.com',
+  captchaToken: turnstileToken,
+});
+showOtpForm({ resendIn: otp.canResendInSeconds });
+
+try {
+  const session = await auth.emailOtp.verifyLoginCode({
+    email: 'user@example.com',
+    code: '123456',
+  });
+} catch (e) {
+  if (e instanceof OtpInvalidError) {
+    showError(`Wrong code. ${e.attemptsRemaining} tries left.`);
+  } else throw e;
+}
+
+auth.isAuthenticated(); // true
+await auth.logout();
+```
+
+## API
+
+The SDK is namespaced by flow so that each method's purpose is unambiguous at the call site.
+
+### `auth.emailOtp` — passwordless flow
+
+```ts
+auth.emailOtp.sendLoginCode({ email, captchaToken });
+//   → { flow: 'login'|'signup', methods: ('password'|'passwordless')[], otp: OtpInfo }
+
+auth.emailOtp.verifyLoginCode({ email, code });
+//   → AuthSession  (also populates the session mirror)
+
+auth.emailOtp.resendLoginCode({ email, captchaToken });
+//   → { otp: OtpInfo }
+```
+
+### `auth.emailPassword` — password flow
+
+```ts
+auth.emailPassword.register({ email, password, captchaToken });
+//   → { otp: OtpInfo }   (sends a verification OTP; bcrypt hash held server-side)
+
+auth.emailPassword.verifyRegistrationCode({ email, code });
+//   → AuthSession   (finalizes the account; populates the session mirror)
+
+auth.emailPassword.resendRegistrationCode({ email, captchaToken });
+//   → { otp: OtpInfo }
+
+auth.emailPassword.login({ email, password, captchaToken });
+//   → AuthSession
+
+// Authenticated:
+auth.emailPassword.setPassword({ password });
+auth.emailPassword.changePassword({ currentPassword, newPassword });
+//   ↑ revokes every other session for the account on success
+```
+
+### `auth.google`
+
+```ts
+// idToken is obtained from Google Sign-In on the frontend.
+auth.google.login({ idToken }); // → AuthSession
+```
+
+### Session lifecycle
+
+```ts
+await auth.refresh(); // → AuthSession  (manual; SDK also refreshes proactively/reactively)
+await auth.logout(); // → void
+
+auth.getSession(); // AuthSession | null  (sync)
+auth.isAuthenticated(); // boolean              (sync)
+await auth.loadSession(); // rehydrate from store at app boot
+
+const unsub = auth.onSessionChange((session) => {
+  /* AuthSession | null */
+});
+auth.onSessionChange(handler, { immediate: false }); // future-only
+unsub();
+```
+
+### `auth.fetch` — call your own backend
+
+`Authorization: Bearer …` is attached automatically; `X-Session-ID` is **never** sent to consumer URLs. 401 → `/auth/refresh` → retry-once happens transparently.
+
+```ts
+const res = await auth.fetch('https://api.example/things', {
+  method: 'POST',
+  body: JSON.stringify({ ping: 1 }),
+  signal: ctrl.signal,
+  requireAuth: true, // throw AuthError(401) before sending if no session
+  disableRefresh: true, // skip both proactive + reactive refresh for this call
+});
+if (!res.ok) {
+  /* res.status, res.json(), etc. */
+}
+```
+
+`auth.fetch` returns the `Response` for any consumer-URL non-2xx. It only throws `AuthError` when the SDK's own `/auth/refresh` sub-call fails.
+
+### Lifecycle
+
+```ts
+auth.close(); // release cross-tab BroadcastChannel; optional
+```
+
+## Errors
+
+Every error subclass extends `AuthError`. Branch on `instanceof` (preferred for TS narrowing) or `err.code`.
+
+```ts
+import {
+  AuthError,
+  OtpInvalidError,
+  OtpExpiredError,
+  MaxAttemptsError,
+  ResendCooldownError,
+  MaxResendsError,
+  NoPendingOtpError,
+  InvalidCredentialsError,
+  NoPasswordSetError,
+  AccountSuspendedError,
+  EmailAlreadyHasPasswordError,
+  CaptchaFailedError,
+  RateLimitedError,
+  InvalidPasswordError,
+  InvalidEmailError,
+} from '@baliola/auth-sdk';
+
+try {
+  await auth.emailOtp.verifyLoginCode({ email, code });
+} catch (e) {
+  if (e instanceof OtpInvalidError)
+    return show(`${e.attemptsRemaining} tries left, resend in ${e.canResendInSeconds}s`);
+  if (e instanceof OtpExpiredError) return showResendPrompt();
+  if (e instanceof MaxAttemptsError) return show(`Too many tries. Wait ${e.retryAfterSeconds}s`);
+  if (e instanceof RateLimitedError) return show(`Rate limited. ${e.retryAfterHuman}`);
+  throw e;
+}
+```
+
+| Error class                    | `code`                       | Status | Carries                                    |
+| ------------------------------ | ---------------------------- | ------ | ------------------------------------------ |
+| `OtpInvalidError`              | `otp_invalid`                | 400    | `attemptsRemaining`, `canResendInSeconds`  |
+| `OtpExpiredError`              | `otp_expired`                | 400    | —                                          |
+| `MaxAttemptsError`             | `max_attempts_exceeded`      | 429    | `retryAfterSeconds`                        |
+| `NoPendingOtpError`            | `no_pending_otp`             | 400    | —                                          |
+| `ResendCooldownError`          | `resend_cooldown`            | 429    | `canResendInSeconds`                       |
+| `MaxResendsError`              | `max_resends_exceeded`       | 429    | —                                          |
+| `InvalidCredentialsError`      | `invalid_credentials`        | 401    | —                                          |
+| `NoPasswordSetError`           | `no_password_set`            | 400    | —                                          |
+| `AccountSuspendedError`        | `account_suspended`          | 403    | —                                          |
+| `EmailAlreadyHasPasswordError` | `email_already_has_password` | 409    | —                                          |
+| `CaptchaFailedError`           | `captcha_failed`             | 400    | —                                          |
+| `InvalidPasswordError`         | `invalid_password`           | 400    | `reason: 'too_short'\|'no_uppercase'\|...` |
+| `InvalidEmailError`            | `invalid_email`              | 400    | —                                          |
+| `RateLimitedError`             | (legacy 429)                 | 429    | `retryAfterSeconds`, `retryAfterHuman`     |
+| `AuthError` (base)             | varies                       | varies | `status: 0` for network/timeout            |
+
+## Stores
+
+```ts
+import { memoryStore, localStorageStore, type SessionStore } from '@baliola/auth-sdk';
+
+memoryStore();                          // default — per-process, no persistence
+localStorageStore({ key? });            // browser only, persists across reloads
+
+const cookieStore: SessionStore = {
+  get() { /* AuthSession | null */ },
+  set(s) { /* persist or clear when s === null */ },
+};
+```
+
+Cross-tab sync (login / logout / refresh) is automatic via `BroadcastChannel`, regardless of store choice.
+
+## Configuration
+
+```ts
+createAuthClient({
+  baseUrl: 'https://baliola-auth.baliola.dev', // required, no trailing slash
+  clientId: 'your-project-client-id', // optional; scopes the session to one project. Omit for a central login that carries every project the account has active roles in.
+  store: memoryStore(), // default; or localStorageStore() / custom
+  fetch: globalThis.fetch, // override for tests / interceptors
+  timeoutMs: 15_000, // per-request, default 15s
+  proactiveRefresh: { leadTimeMs: 60_000 }, // or `false` to disable; default 60s lead
+  onError: (e, source) => console.error('[auth-sdk]', source, e),
+});
+```
+
+`clientId` is constructor-only — there is no per-call override. To switch projects, create a new client.
+
+## Decoding the JWT
+
+The SDK does not parse the access token; consumers that need claims (e.g. server-side authorization in a Node service) decode it with their own library. The exported `AccessTokenPayload` type matches the server's current claim shape.
+
+```ts
+import { decodeJwt } from 'jose';
+import type { AccessTokenPayload } from '@baliola/auth-sdk';
+
+const session = auth.getSession();
+if (session) {
+  const claims = decodeJwt<AccessTokenPayload>(session.accessToken);
+  // claims.accountId, claims.email
+  // claims.projects: { id, name, clientId }[]   // single entry for a scoped login; many for a central login
+  // claims.roles?: string[]; claims.permissions?: string[]
+}
+```
+
+## Sample response shapes
+
+**`auth.emailOtp.sendLoginCode` success:**
+
+```json
+{
+  "flow": "signup",
+  "methods": ["passwordless"],
+  "otp": {
+    "expiresInSeconds": 300,
+    "expiresAt": "2026-05-04T12:05:00.000Z",
+    "canResendInSeconds": 60,
+    "resendsRemaining": 3
+  }
+}
+```
+
+**`auth.emailPassword.register` / resend success:**
+
+```json
+{
+  "otp": {
+    "expiresInSeconds": 300,
+    "expiresAt": "...",
+    "canResendInSeconds": 60,
+    "resendsRemaining": 3
+  }
+}
+```
+
+**`auth.emailOtp.verifyLoginCode` / `auth.emailPassword.verifyRegistrationCode` / `auth.emailPassword.login` / `auth.google.login` success (`AuthSession`):**
+
+```json
+{
+  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
+  "refreshToken": "session-uuid",
+  "expiresIn": 3600,
+  "account": { "id": "...", "email": "user@example.com", "status": "active" },
+  "project": { "id": "...", "name": "...", "displayName": null, "allowedOrigins": [...] },
+  "roles": ["user"],
+  "permissions": []
+}
+```
+
+**Verify-code failure (e.g. `OtpInvalidError`):**
+
+```json
+{
+  "message": "Invalid verification code. 2 attempt(s) remaining.",
+  "data": null,
+  "error": {
+    "code": "otp_invalid",
+    "details": {
+      "name": "OtpInvalidError",
+      "attemptsRemaining": 2,
+      "canResendInSeconds": 30
+    }
+  }
+}
+```
+
+## License
+
+Proprietary — see [LICENSE](./LICENSE).

package/dist/authError-C5g5jP5l.d.ts

@@ -0,0 +1,102 @@
+//#region src/errors/authError.d.ts
+type AuthErrorInit = {
+  status: number; /** Stable machine-readable code (e.g. 'otp_invalid'). May be empty for network failures. */
+  code?: string;
+  serverMessage: string;
+  serverName?: string;
+  details?: unknown;
+  cause?: unknown;
+};
+/**
+ * Base class for every error thrown by the SDK. Concrete error subclasses
+ * (`OtpInvalidError`, `RateLimitedError`, etc.) extend this. Consumers can
+ * branch on either `instanceof` (preferred for TS narrowing) or `err.code`
+ * (when narrowing by string).
+ *
+ * - `status`: HTTP status from the server, or `0` for network/timeout failures.
+ * - `code`: stable machine-readable code (see error subclasses for values).
+ * - `serverMessage`: server's `message` field (for display or logs).
+ * - `serverName`: server's error class name from `error.details.name`.
+ * - `details`: server's `error.details` as-is (carries context fields like
+ *   `attemptsRemaining`, `canResendInSeconds`, `retryAfterSeconds`).
+ * - `cause`: original underlying error (e.g. the `TypeError` from a network failure).
+ */
+declare class AuthError extends Error {
+  readonly status: number;
+  readonly code: string;
+  readonly serverMessage: string;
+  readonly serverName?: string;
+  readonly details?: unknown;
+  readonly cause?: unknown;
+  constructor(init: AuthErrorInit);
+}
+declare class OtpInvalidError extends AuthError {
+  readonly attemptsRemaining: number;
+  readonly canResendInSeconds: number;
+  constructor(init: AuthErrorInit & {
+    attemptsRemaining: number;
+    canResendInSeconds: number;
+  });
+}
+declare class OtpExpiredError extends AuthError {
+  constructor(init: AuthErrorInit);
+}
+declare class MaxAttemptsError extends AuthError {
+  readonly retryAfterSeconds: number;
+  constructor(init: AuthErrorInit & {
+    retryAfterSeconds: number;
+  });
+}
+declare class NoPendingOtpError extends AuthError {
+  constructor(init: AuthErrorInit);
+}
+declare class ResendCooldownError extends AuthError {
+  readonly canResendInSeconds: number;
+  constructor(init: AuthErrorInit & {
+    canResendInSeconds: number;
+  });
+}
+declare class MaxResendsError extends AuthError {
+  constructor(init: AuthErrorInit);
+}
+declare class InvalidCredentialsError extends AuthError {
+  constructor(init: AuthErrorInit);
+}
+declare class NoPasswordSetError extends AuthError {
+  constructor(init: AuthErrorInit);
+}
+declare class AccountSuspendedError extends AuthError {
+  constructor(init: AuthErrorInit);
+}
+declare class EmailAlreadyHasPasswordError extends AuthError {
+  constructor(init: AuthErrorInit);
+}
+declare class CaptchaFailedError extends AuthError {
+  constructor(init: AuthErrorInit);
+}
+declare class RateLimitedError extends AuthError {
+  readonly retryAfterSeconds: number;
+  readonly retryAfterHuman: string;
+  constructor(init: AuthErrorInit & {
+    retryAfterSeconds: number;
+    retryAfterHuman: string;
+  });
+}
+declare class InvalidPasswordError extends AuthError {
+  readonly reason: 'too_short' | 'no_uppercase' | 'too_weak' | 'unknown';
+  constructor(init: AuthErrorInit & {
+    reason: 'too_short' | 'no_uppercase' | 'too_weak' | 'unknown';
+  });
+}
+declare class InvalidEmailError extends AuthError {
+  constructor(init: AuthErrorInit);
+}
+/**
+ * Map a backend error response onto the right AuthError subclass.
+ * Falls back to `AuthError` (with status + code preserved) for unknown codes.
+ */
+declare function authErrorFromResponse(response: Response): Promise<AuthError>;
+/** Network/timeout failures land here. */
+declare function authErrorFromFetchFailure(cause: unknown, isTimeout?: boolean): AuthError;
+//#endregion
+export { authErrorFromFetchFailure as _, EmailAlreadyHasPasswordError as a, InvalidPasswordError as c, NoPasswordSetError as d, NoPendingOtpError as f, ResendCooldownError as g, RateLimitedError as h, CaptchaFailedError as i, MaxAttemptsError as l, OtpInvalidError as m, AuthError as n, InvalidCredentialsError as o, OtpExpiredError as p, AuthErrorInit as r, InvalidEmailError as s, AccountSuspendedError as t, MaxResendsError as u, authErrorFromResponse as v };