@baliola/auth-sdk 0.2.0

package/dist/client-BcyoQ5Cj.js

@@ -0,0 +1,504 @@
+import { _ as authErrorFromResponse, g as authErrorFromFetchFailure, n as AuthError } from "./authError-DbEZJnC4.js";
+import { n as memoryStore } from "./sessionStore-DD6lON9W.js";
+//#region src/client/methods.ts
+function toAuthSession(data) {
+	const issuedAt = Date.now();
+	return {
+		accessToken: data.accessToken,
+		refreshToken: data.refreshToken,
+		expiresIn: data.expiresIn,
+		issuedAt,
+		expiresAt: issuedAt + data.expiresIn * 1e3,
+		account: data.account,
+		...data.project !== void 0 && { project: data.project },
+		roles: data.roles,
+		permissions: data.permissions
+	};
+}
+function createMethods(ctx) {
+	const withClientId = (body) => {
+		if (ctx.clientId === void 0) return body;
+		return {
+			...body,
+			clientId: ctx.clientId
+		};
+	};
+	const stripUndefined = (body) => {
+		const out = {};
+		for (const [k, v] of Object.entries(body)) if (v !== void 0) out[k] = v;
+		return out;
+	};
+	return {
+		async sendLoginCode(input) {
+			return ctx.transport.request({
+				path: "/auth/email-otp/send-login-code",
+				method: "POST",
+				authMode: "none",
+				body: stripUndefined(withClientId({
+					email: input.email,
+					captchaToken: input.captchaToken
+				}))
+			});
+		},
+		async verifyLoginCode(input) {
+			return toAuthSession(await ctx.transport.request({
+				path: "/auth/email-otp/verify-login-code",
+				method: "POST",
+				authMode: "none",
+				body: withClientId({
+					email: input.email,
+					otp: input.code
+				})
+			}));
+		},
+		async resendLoginCode(input) {
+			return ctx.transport.request({
+				path: "/auth/email-otp/resend-login-code",
+				method: "POST",
+				authMode: "none",
+				body: stripUndefined(withClientId({
+					email: input.email,
+					captchaToken: input.captchaToken
+				}))
+			});
+		},
+		async register(input) {
+			return ctx.transport.request({
+				path: "/auth/email-password/register",
+				method: "POST",
+				authMode: "none",
+				body: stripUndefined(withClientId({
+					email: input.email,
+					password: input.password,
+					captchaToken: input.captchaToken
+				}))
+			});
+		},
+		async verifyRegistrationCode(input) {
+			return toAuthSession(await ctx.transport.request({
+				path: "/auth/email-password/verify-registration-code",
+				method: "POST",
+				authMode: "none",
+				body: withClientId({
+					email: input.email,
+					otp: input.code
+				})
+			}));
+		},
+		async resendRegistrationCode(input) {
+			return ctx.transport.request({
+				path: "/auth/email-password/resend-registration-code",
+				method: "POST",
+				authMode: "none",
+				body: stripUndefined(withClientId({
+					email: input.email,
+					captchaToken: input.captchaToken
+				}))
+			});
+		},
+		async loginWithPassword(input) {
+			return toAuthSession(await ctx.transport.request({
+				path: "/auth/email-password/login",
+				method: "POST",
+				authMode: "none",
+				body: stripUndefined(withClientId({
+					email: input.email,
+					password: input.password,
+					captchaToken: input.captchaToken
+				}))
+			}));
+		},
+		async setPassword(input) {
+			await ctx.transport.request({
+				path: "/auth/email-password/set-password",
+				method: "POST",
+				authMode: "bearer+session",
+				body: { password: input.password }
+			});
+		},
+		async changePassword(input) {
+			await ctx.transport.request({
+				path: "/auth/email-password/change-password",
+				method: "POST",
+				authMode: "bearer+session",
+				body: {
+					currentPassword: input.currentPassword,
+					newPassword: input.newPassword
+				}
+			});
+		},
+		async loginWithGoogle(input) {
+			return toAuthSession(await ctx.transport.request({
+				path: "/auth/google/login",
+				method: "POST",
+				authMode: "none",
+				body: withClientId({ idToken: input.idToken })
+			}));
+		},
+		async logoutRequest() {
+			await ctx.transport.request({
+				path: "/auth/logout",
+				method: "POST",
+				authMode: "bearer+session"
+			});
+		},
+		/**
+		* Type-only helper: declares the refresh response shape so consumers
+		* pulling the inferred Methods type don't break. Refresh itself is
+		* handled by transport.refreshSession() to keep stampede protection.
+		*/
+		refreshResponseShape() {
+			throw new Error("refreshResponseShape is a type-only helper");
+		}
+	};
+}
+//#endregion
+//#region src/client/transport.ts
+/**
+* Minimal fetch wrapper for Baliola Auth: header injection, timeout via
+* AbortController, error mapping to AuthError, and the 401 → /auth/refresh
+* → retry-once stampede-safe flow.
+*
+* Public surface: `request<T>()` for SDK-internal endpoints (returns parsed
+* data of type T or throws AuthError) and `passthroughFetch()` for the
+* consumer escape hatch (returns Response, never throws on consumer-URL
+* non-2xx, throws only when the SDK's own refresh sub-call fails).
+*/
+function createTransport(options) {
+	const { baseUrl, fetch: fetchImpl, timeoutMs, onRefreshed, onSessionLost, getCurrentSession, shouldProactivelyRefresh } = options;
+	let refreshPromise = null;
+	function buildAuthHeaders(mode, session) {
+		const headers = new Headers();
+		headers.set("Content-Type", "application/json");
+		headers.set("Accept", "application/json");
+		if (!session) return headers;
+		switch (mode) {
+			case "bearer+session":
+				headers.set("Authorization", `Bearer ${session.accessToken}`);
+				headers.set("X-Session-ID", session.refreshToken);
+				break;
+			case "session-only":
+				headers.set("X-Session-ID", session.refreshToken);
+				break;
+			case "bearer-only-passthrough":
+				headers.set("Authorization", `Bearer ${session.accessToken}`);
+				break;
+			case "none": break;
+		}
+		return headers;
+	}
+	/**
+	* Compose two AbortSignals into one. Uses native AbortSignal.any when
+	* available (Node 20.3+, modern browsers, Bun); falls back to a small
+	* polyfill otherwise.
+	*/
+	function composeSignals(signals) {
+		const real = signals.filter((s) => s !== void 0);
+		if (real.length === 0) return new AbortController().signal;
+		if (real.length === 1) return real[0];
+		if (typeof AbortSignal.any === "function") return AbortSignal.any(real);
+		const ctrl = new AbortController();
+		for (const s of real) {
+			if (s.aborted) {
+				ctrl.abort(s.reason);
+				return ctrl.signal;
+			}
+			s.addEventListener("abort", () => ctrl.abort(s.reason), { once: true });
+		}
+		return ctrl.signal;
+	}
+	/**
+	* Run a single fetch with timeout + consumer signal composition.
+	* Returns the raw Response. Network/abort failures become AuthError.
+	*/
+	async function rawFetch(url, init) {
+		const timeoutCtrl = new AbortController();
+		const timer = setTimeout(() => timeoutCtrl.abort(/* @__PURE__ */ new Error("timeout")), timeoutMs);
+		let didTimeout = false;
+		timeoutCtrl.signal.addEventListener("abort", () => {
+			didTimeout = true;
+		}, { once: true });
+		try {
+			const signal = composeSignals([timeoutCtrl.signal, init.signal]);
+			return await fetchImpl(url, {
+				...init,
+				signal
+			});
+		} catch (err) {
+			throw authErrorFromFetchFailure(err, didTimeout);
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+	/**
+	* Call POST /auth/refresh. Used by both proactive and reactive paths.
+	* Stampede-protected via shared `refreshPromise`.
+	*/
+	function refreshSession() {
+		if (refreshPromise) return refreshPromise;
+		const current = getCurrentSession();
+		if (!current) {
+			const err = new AuthError({
+				status: 401,
+				serverMessage: "No session to refresh"
+			});
+			onSessionLost();
+			return Promise.reject(err);
+		}
+		refreshPromise = (async () => {
+			try {
+				const headers = buildAuthHeaders("session-only", current);
+				const response = await rawFetch(`${baseUrl}/auth/refresh`, {
+					method: "POST",
+					headers
+				});
+				if (!response.ok) {
+					const err = await authErrorFromResponse(response);
+					await onSessionLost();
+					throw err;
+				}
+				const body = await response.json();
+				const issuedAt = Date.now();
+				const merged = {
+					...current,
+					accessToken: body.data.accessToken,
+					refreshToken: body.data.refreshToken,
+					issuedAt,
+					expiresAt: issuedAt + current.expiresIn * 1e3
+				};
+				await onRefreshed(merged);
+				return merged;
+			} catch (err) {
+				if (err instanceof AuthError) {
+					if (err.status === 0) await onSessionLost();
+					throw err;
+				}
+				await onSessionLost();
+				throw authErrorFromFetchFailure(err);
+			} finally {
+				refreshPromise = null;
+			}
+		})();
+		return refreshPromise;
+	}
+	/**
+	* Internal SDK request helper. Returns parsed `data` of type T from
+	* the standard `{ message, data }` envelope. Throws AuthError on any
+	* non-2xx after the refresh-retry flow.
+	*/
+	async function request(opts) {
+		if (opts.authMode === "bearer+session" && shouldProactivelyRefresh() && !opts.skipAutoRefresh) await refreshSession();
+		const url = `${baseUrl}${opts.path}`;
+		let response = await rawFetch(url, {
+			method: opts.method,
+			headers: buildAuthHeaders(opts.authMode, getCurrentSession()),
+			...opts.body !== void 0 && { body: JSON.stringify(opts.body) },
+			...opts.signal !== void 0 && { signal: opts.signal }
+		});
+		if (response.status === 401 && !opts.skipAutoRefresh && (opts.authMode === "bearer+session" || opts.authMode === "session-only") && getCurrentSession()) {
+			await refreshSession();
+			response = await rawFetch(url, {
+				method: opts.method,
+				headers: buildAuthHeaders(opts.authMode, getCurrentSession()),
+				...opts.body !== void 0 && { body: JSON.stringify(opts.body) },
+				...opts.signal !== void 0 && { signal: opts.signal }
+			});
+		}
+		if (!response.ok) throw await authErrorFromResponse(response);
+		const text = await response.text();
+		if (text.length === 0) return;
+		return JSON.parse(text).data;
+	}
+	/**
+	* Consumer-URL escape hatch. Returns the raw Response. Auto-refresh on
+	* 401 the same way as internal calls, but:
+	*   - Does NOT throw on consumer-URL non-2xx; consumer handles via res.ok.
+	*   - DOES throw AuthError when the SDK's own /auth/refresh sub-call fails.
+	*   - Adds Authorization header ONLY if a session is loaded; otherwise
+	*     passes through unauthenticated.
+	*   - NEVER sends X-Session-ID to the consumer URL.
+	*/
+	async function passthroughFetch(input, init = {}) {
+		const { requireAuth, disableRefresh, ...fetchInit } = init;
+		if (requireAuth && !getCurrentSession()) throw new AuthError({
+			status: 401,
+			serverMessage: "No session loaded"
+		});
+		const session = getCurrentSession();
+		if (!disableRefresh && session && shouldProactivelyRefresh()) await refreshSession();
+		const composedInit = composeAuthInit(fetchInit, getCurrentSession());
+		let response = await rawFetch(toUrlString(input), composedInit);
+		if (!disableRefresh && response.status === 401 && getCurrentSession()) {
+			await refreshSession();
+			const retryInit = composeAuthInit(fetchInit, getCurrentSession());
+			response = await rawFetch(toUrlString(input), retryInit);
+		}
+		return response;
+	}
+	function composeAuthInit(init, session) {
+		const headers = new Headers(init.headers);
+		if (session) headers.set("Authorization", `Bearer ${session.accessToken}`);
+		const { signal: _signal, ...rest } = init;
+		const out = {
+			...rest,
+			headers
+		};
+		if (init.signal) out.signal = init.signal;
+		return out;
+	}
+	function toUrlString(input) {
+		if (typeof input === "string") return input;
+		if (input instanceof URL) return input.toString();
+		return input.url;
+	}
+	return {
+		request,
+		passthroughFetch,
+		refreshSession
+	};
+}
+//#endregion
+//#region src/client/index.ts
+const DEFAULT_TIMEOUT_MS = 15e3;
+const DEFAULT_PROACTIVE_LEAD_TIME_MS = 6e4;
+/**
+* Channel name used to propagate session changes between same-origin tabs
+* via `BroadcastChannel`. The `v1` suffix lets us evolve the wire format
+* without colliding with old tabs running an older SDK.
+*/
+const BROADCAST_CHANNEL_NAME = "baliola.auth.session.v1";
+function createAuthClient(options) {
+	if (!options.baseUrl) throw new Error("createAuthClient: baseUrl is required");
+	const baseUrl = options.baseUrl.replace(/\/+$/, "");
+	const store = options.store ?? memoryStore();
+	const fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const proactiveLeadTimeMs = options.proactiveRefresh === false ? null : options.proactiveRefresh?.leadTimeMs ?? DEFAULT_PROACTIVE_LEAD_TIME_MS;
+	const onError = options.onError ?? ((e, source) => console.error("[auth-sdk]", source, e));
+	let currentSession = null;
+	const subscribers = /* @__PURE__ */ new Set();
+	function notifySubscribers(session) {
+		for (const handler of subscribers) callHandler(handler, session, "session-change-handler");
+	}
+	function callHandler(handler, session, source) {
+		try {
+			handler(session);
+		} catch (e) {
+			try {
+				onError(e instanceof Error ? e : new Error(String(e)), source);
+			} catch {}
+		}
+	}
+	const channel = typeof globalThis.BroadcastChannel !== "undefined" ? new globalThis.BroadcastChannel(BROADCAST_CHANNEL_NAME) : null;
+	async function applyRemoteSession(session) {
+		currentSession = session;
+		await store.set(session);
+		notifySubscribers(session);
+	}
+	async function setSession(session) {
+		await applyRemoteSession(session);
+		channel?.postMessage({ session });
+	}
+	channel?.addEventListener("message", (event) => {
+		applyRemoteSession(event.data.session).catch((err) => {
+			onError(err instanceof Error ? err : new Error(String(err)), "broadcast-channel-message");
+		});
+	});
+	const transport = createTransport({
+		baseUrl,
+		fetch: fetchImpl,
+		timeoutMs,
+		getCurrentSession: () => currentSession,
+		shouldProactivelyRefresh: () => {
+			if (proactiveLeadTimeMs === null) return false;
+			if (!currentSession) return false;
+			return currentSession.expiresAt - Date.now() < proactiveLeadTimeMs;
+		},
+		onRefreshed: async (session) => {
+			currentSession = session;
+			await store.set(session);
+			notifySubscribers(session);
+		},
+		onSessionLost: async () => {
+			currentSession = null;
+			await store.set(null);
+			notifySubscribers(null);
+		}
+	});
+	const methods = createMethods({
+		transport,
+		...options.clientId !== void 0 && { clientId: options.clientId }
+	});
+	return {
+		emailOtp: {
+			sendLoginCode: (input) => methods.sendLoginCode(input),
+			async verifyLoginCode(input) {
+				const session = await methods.verifyLoginCode(input);
+				await setSession(session);
+				return session;
+			},
+			resendLoginCode: (input) => methods.resendLoginCode(input)
+		},
+		emailPassword: {
+			register: (input) => methods.register(input),
+			async verifyRegistrationCode(input) {
+				const session = await methods.verifyRegistrationCode(input);
+				await setSession(session);
+				return session;
+			},
+			resendRegistrationCode: (input) => methods.resendRegistrationCode(input),
+			async login(input) {
+				const session = await methods.loginWithPassword(input);
+				await setSession(session);
+				return session;
+			},
+			setPassword: (input) => methods.setPassword(input),
+			changePassword: (input) => methods.changePassword(input)
+		},
+		google: { async login(input) {
+			const session = await methods.loginWithGoogle(input);
+			await setSession(session);
+			return session;
+		} },
+		async refresh() {
+			return transport.refreshSession();
+		},
+		async logout() {
+			let serverError;
+			try {
+				await methods.logoutRequest();
+			} catch (e) {
+				serverError = e;
+			}
+			await setSession(null);
+			if (serverError !== void 0) throw serverError;
+		},
+		getSession() {
+			return currentSession;
+		},
+		isAuthenticated() {
+			return currentSession !== null;
+		},
+		async loadSession() {
+			const persisted = await store.get();
+			currentSession = persisted;
+			return persisted;
+		},
+		onSessionChange(handler, opts) {
+			const immediate = opts?.immediate ?? true;
+			subscribers.add(handler);
+			if (immediate) callHandler(handler, currentSession, "session-change-handler");
+			return () => {
+				subscribers.delete(handler);
+			};
+		},
+		fetch(input, init) {
+			return transport.passthroughFetch(input, init);
+		},
+		close() {
+			channel?.close();
+		}
+	};
+}
+//#endregion
+export { createAuthClient as t };

package/dist/errors/index.d.ts

@@ -0,0 +1,2 @@
+import { _ as authErrorFromFetchFailure, a as EmailAlreadyHasPasswordError, c as InvalidPasswordError, d as NoPasswordSetError, f as NoPendingOtpError, g as ResendCooldownError, h as RateLimitedError, i as CaptchaFailedError, l as MaxAttemptsError, m as OtpInvalidError, n as AuthError, o as InvalidCredentialsError, p as OtpExpiredError, r as AuthErrorInit, s as InvalidEmailError, t as AccountSuspendedError, u as MaxResendsError, v as authErrorFromResponse } from "../authError-C5g5jP5l.js";
+export { AccountSuspendedError, AuthError, type AuthErrorInit, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse };

package/dist/errors/index.js

@@ -0,0 +1,2 @@
+import { _ as authErrorFromResponse, a as InvalidCredentialsError, c as MaxAttemptsError, d as NoPendingOtpError, f as OtpExpiredError, g as authErrorFromFetchFailure, h as ResendCooldownError, i as EmailAlreadyHasPasswordError, l as MaxResendsError, m as RateLimitedError, n as AuthError, o as InvalidEmailError, p as OtpInvalidError, r as CaptchaFailedError, s as InvalidPasswordError, t as AccountSuspendedError, u as NoPasswordSetError } from "../authError-DbEZJnC4.js";
+export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse };

package/dist/index-G-gqveGn.d.ts

@@ -0,0 +1,142 @@
+import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
+import { n as SessionStore } from "./sessionStore-BDdEpbL8.js";
+import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, u as VerifyLoginCodeInput } from "./requests-eTORIjY5.js";
+
+//#region src/client/transport.d.ts
+type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+/**
+ * Init shape accepted by `auth.fetch()`. Extends `RequestInit` with two
+ * SDK-specific opt-in flags: `requireAuth` and `disableRefresh`. Both are
+ * stripped before the underlying fetch is called.
+ */
+type AuthFetchInit = RequestInit & {
+  /**
+   * If `true`, throw `AuthError({ status: 401 })` before sending when no
+   * session is loaded. Saves a wasted round-trip when the consumer URL
+   * would have 401-ed anyway.
+   */
+  requireAuth?: boolean;
+  /**
+   * If `true`, skip the SDK's automatic session-refresh machinery for
+   * this single call — both proactive (pre-flight) and reactive (post-401
+   * retry) paths are bypassed. The raw 401 `Response` is returned to the
+   * caller. Use for fire-and-forget telemetry or beacons where a stale
+   * token shouldn't trigger a refresh round-trip.
+   */
+  disableRefresh?: boolean;
+};
+//#endregion
+//#region src/client/index.d.ts
+type ProactiveRefreshConfig = false | {
+  /** Refresh proactively if `expiresAt - now < leadTimeMs`. Defaults to 60_000 (60s). */leadTimeMs?: number;
+};
+type CreateAuthClientOptions = {
+  /** Base URL of the Baliola Auth server (no trailing slash). */baseUrl: string; /** Optional clientId, applied to every auth request that accepts one. */
+  clientId?: string;
+  /**
+   * Pluggable session store. Defaults to `memoryStore()`. Use
+   * `localStorageStore()` in browsers for persistence across reloads.
+   */
+  store?: SessionStore; /** Override the fetch implementation (e.g. for tests). Defaults to globalThis.fetch. */
+  fetch?: FetchLike; /** Per-request timeout in ms. Defaults to 15_000. */
+  timeoutMs?: number;
+  /**
+   * Proactively refresh the access token before it expires. Pass `false`
+   * to disable; defaults to `{ leadTimeMs: 60_000 }`.
+   */
+  proactiveRefresh?: ProactiveRefreshConfig;
+  /**
+   * Receives errors thrown by user code (e.g. session-change handlers).
+   * Defaults to `console.error`. Pass a no-op to silence.
+   */
+  onError?: ErrorHandler;
+};
+type SubscribeOptions = {
+  /**
+   * If `true` (default), the handler is called synchronously during
+   * subscribe with the current session value. Set to `false` for strict
+   * future-changes-only semantics.
+   */
+  immediate?: boolean;
+};
+/** Passwordless flow ("email_otp" provider). */
+type EmailOtpNamespace = {
+  /**
+   * Send a 6-digit one-time code to the email. Used for passwordless
+   * login (existing accounts) or signup (creates a new account on verify).
+   *
+   * @example
+   * const r = await auth.emailOtp.sendLoginCode({ email, captchaToken })
+   * // r = { flow: 'login'|'signup', methods: ['password','passwordless'],
+   * //       otp: { expiresInSeconds, expiresAt, canResendInSeconds, resendsRemaining } }
+   *
+   * @throws CaptchaFailedError, RateLimitedError, InvalidEmailError, AuthError.
+   */
+  sendLoginCode(input: SendLoginCodeInput): Promise<SendLoginCodeResult>;
+  /**
+   * Verify a passwordless login code and return an authenticated session.
+   *
+   * @throws OtpInvalidError ({ attemptsRemaining, canResendInSeconds }),
+   *         OtpExpiredError, MaxAttemptsError ({ retryAfterSeconds }),
+   *         NoPendingOtpError, RateLimitedError, AuthError.
+   */
+  verifyLoginCode(input: VerifyLoginCodeInput): Promise<AuthSession>;
+  /**
+   * Resend the verification code for a pending passwordless OTP.
+   * Subject to RESEND_COOLDOWN_SECONDS and MAX_RESENDS_PER_OTP.
+   *
+   * @throws ResendCooldownError, MaxResendsError, NoPendingOtpError,
+   *         CaptchaFailedError, RateLimitedError, AuthError.
+   */
+  resendLoginCode(input: ResendLoginCodeInput): Promise<ResendCodeResult>;
+};
+/** Password flow ("email_password" provider). */
+type EmailPasswordNamespace = {
+  /**
+   * Begin email+password registration. The bcrypt hash is held server-side
+   * with the OTP record until the user verifies.
+   *
+   * @throws EmailAlreadyHasPasswordError, InvalidPasswordError,
+   *         CaptchaFailedError, RateLimitedError, AuthError.
+   */
+  register(input: RegisterInput): Promise<RegisterResult>;
+  /**
+   * Verify the password-registration code, finalize signup, and return a session.
+   */
+  verifyRegistrationCode(input: VerifyRegistrationCodeInput): Promise<AuthSession>; /** Resend the verification code for a pending password registration. */
+  resendRegistrationCode(input: ResendRegistrationCodeInput): Promise<ResendCodeResult>;
+  /**
+   * Authenticate with email + password.
+   *
+   * @throws InvalidCredentialsError, NoPasswordSetError,
+   *         AccountSuspendedError, CaptchaFailedError, AuthError.
+   */
+  login(input: LoginWithPasswordInput): Promise<AuthSession>; /** Set a password on an existing account (auth required). */
+  setPassword(input: SetPasswordInput): Promise<void>; /** Rotate password (auth required); revokes other sessions on success. */
+  changePassword(input: ChangePasswordInput): Promise<void>;
+};
+/** Google flow. */
+type GoogleNamespace = {
+  login(input: LoginWithGoogleInput): Promise<AuthSession>;
+};
+type AuthClient = {
+  emailOtp: EmailOtpNamespace;
+  emailPassword: EmailPasswordNamespace;
+  google: GoogleNamespace;
+  refresh(): Promise<AuthSession>;
+  logout(): Promise<void>;
+  getSession(): AuthSession | null;
+  isAuthenticated(): boolean;
+  loadSession(): Promise<AuthSession | null>;
+  onSessionChange(handler: SessionChangeHandler, opts?: SubscribeOptions): () => void;
+  /**
+   * Fetch a consumer URL with `Authorization: Bearer <accessToken>`
+   * automatically attached. See AuthFetchInit for `requireAuth` and
+   * `disableRefresh` semantics.
+   */
+  fetch(input: RequestInfo | URL, init?: AuthFetchInit): Promise<Response>; /** Close cross-tab BroadcastChannel listener. Optional. */
+  close(): void;
+};
+declare function createAuthClient(options: CreateAuthClientOptions): AuthClient;
+//#endregion
+export { GoogleNamespace as a, createAuthClient as c, EmailPasswordNamespace as i, AuthFetchInit as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, SubscribeOptions as s, AuthClient as t };

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
+import { a as GoogleNamespace, c as createAuthClient, i as EmailPasswordNamespace, l as AuthFetchInit, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient } from "./index-G-gqveGn.js";
+import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "./sessionStore-BDdEpbL8.js";
+import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, t as CaptchaArgs, u as VerifyLoginCodeInput } from "./requests-eTORIjY5.js";
+import { _ as authErrorFromFetchFailure, a as EmailAlreadyHasPasswordError, c as InvalidPasswordError, d as NoPasswordSetError, f as NoPendingOtpError, g as ResendCooldownError, h as RateLimitedError, i as CaptchaFailedError, l as MaxAttemptsError, m as OtpInvalidError, n as AuthError, o as InvalidCredentialsError, p as OtpExpiredError, r as AuthErrorInit, s as InvalidEmailError, t as AccountSuspendedError, u as MaxResendsError, v as authErrorFromResponse } from "./authError-C5g5jP5l.js";
+import { n as AccessTokenPayloadProject, t as AccessTokenPayload } from "./tokens-BXrPLi5B.js";
+export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleNamespace, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SubscribeOptions, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/index.js

@@ -0,0 +1,4 @@
+import { t as createAuthClient } from "./client-BcyoQ5Cj.js";
+import { _ as authErrorFromResponse, a as InvalidCredentialsError, c as MaxAttemptsError, d as NoPendingOtpError, f as OtpExpiredError, g as authErrorFromFetchFailure, h as ResendCooldownError, i as EmailAlreadyHasPasswordError, l as MaxResendsError, m as RateLimitedError, n as AuthError, o as InvalidEmailError, p as OtpInvalidError, r as CaptchaFailedError, s as InvalidPasswordError, t as AccountSuspendedError, u as NoPasswordSetError } from "./authError-DbEZJnC4.js";
+import { n as memoryStore, t as localStorageStore } from "./sessionStore-DD6lON9W.js";
+export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };