@baliola/auth-sdk 0.4.1 → 0.6.0

package/CHANGELOG.md

@@ -2,6 +2,64 @@
 
 All notable changes to `@baliola/auth-sdk` are documented here.
 
+## 0.6.0
+
+Hosted Google login. baliola-auth now runs the Google OAuth round trip itself
+(`GET /auth/google/start`, `GET /auth/google/callback`, `POST /auth/google/exchange`),
+so an app can offer "Sign in with Google" without loading Google Identity Services. The
+browser only ever sees a one-time code, never a token.
+
+- feat(client): `auth.google.signInWithPopup(opts?)` opens the hosted login in a popup,
+  waits for the exit message, exchanges the one-time code, and stores the session.
+  `opts.returnTo` (default: current href without hash) and `opts.popup.width` /
+  `opts.popup.height` (default 500 x 640). Browser only.
+- feat(client): `auth.google.completeRedirect(opts?)` finishes a hosted login started in
+  `redirect` mode on the `returnTo` page: resolves `null` when the URL carries no `code`
+  or `error`, verifies the nonce saved by `startUrl`, strips `code`, `error`, and `nonce`
+  from the URL before exchanging. Browser only.
+- feat(client): `auth.google.startUrl({ mode, returnTo?, nonce })` builds the
+  `/auth/google/start` URL from the client's `clientId`, and `auth.google.exchange({ code })`
+  posts the one-time code and stores the session like every other login method. Both are
+  the manual path underneath the two methods above.
+- feat(errors): `GoogleSignInCancelledError` (`code: 'oauth_cancelled'`,
+  `reason: 'popup_blocked' | 'popup_closed' | 'access_denied'`) and `GoogleSignInError`
+  (`code` is the exit or exchange failure: `invalid_google_code`, `email_unverified`,
+  `invalid_oauth_state`, `oauth_unexpected`, or the SDK-side `oauth_nonce_mismatch`).
+  `authErrorFromResponse` now maps server `invalid_google_code` and `email_unverified` to
+  `GoogleSignInError`; `status` and `code` are unchanged, so `instanceof AuthError` and
+  `err.code` branches keep working.
+- feat(types): `GoogleExchangeInput`, `GoogleStartMode`, `GoogleStartOptions`,
+  `GoogleSignInWithPopupOptions`, `GoogleCompleteRedirectOptions`, and
+  `GoogleSignInCancelledReason` are exported from the root and the `./types` (or
+  `./errors`) subpath.
+- feat(client)!: **Breaking.** `auth.google.login` accepts `{ idToken }` only.
+  `LoginWithGoogleInput` is narrowed from `{ idToken: string } | { code: string }` to
+  `{ idToken: string }`. The server no longer accepts `{ code }` on `/auth/google/login`
+  (it is a 400 now); apps that used the Google Identity Services code client should move
+  to `auth.google.signInWithPopup()`. `RELEASING.md` would call this removal a major
+  bump; the user chose 0.6.0 under the pre-1.0 rule that breaks ship as minors with an
+  explicit CHANGELOG callout, which this bullet is.
+
+## 0.5.0
+
+- feat(types): `auth.getProfile()` now returns `account.hasPassword`, a boolean
+  that is `true` when the account can sign in with a password and `false` for
+  Google-only or code-only accounts. Use it to decide between
+  `emailPassword.setPassword` and `emailPassword.changePassword`. `ProfileResult.account`
+  is typed as the new exported `ProfileAccount` (`Account & { hasPassword }`);
+  `Account` itself is unchanged. Requires baliola-auth with `hasPassword` on
+  `GET /profile`.
+- feat(client): `auth.google.login` accepts `{ code }` in addition to
+  `{ idToken }`. `code` is the authorization code from Google's OAuth popup
+  code flow (`google.accounts.oauth2.initCodeClient`, `ux_mode: 'popup'`), which
+  the server exchanges for the ID token with its client secret.
+  `LoginWithGoogleInput` is now `{ idToken: string } | { code: string }`. The
+  server answers `invalid_google_code` (401) when the exchange fails and
+  `google_code_unsupported` (400) when it has no client secret configured; both
+  surface as `AuthError` with `code` preserved.
+- types: `Profile`, `ProfileAccount`, and `ProfileResult` are now also exported
+  from the `./types` subpath, matching the root entry.
+
 ## 0.4.1
 
 - chore(sdk): internal cleanup, no public API change. Removed dead code (the

package/README.md

@@ -1,6 +1,6 @@
 # @baliola/auth-sdk
 
-Client SDK for the Baliola Auth service. Two clearly separated email flows (passwordless OTP, password + verification OTP) plus Google login, with typed methods, typed errors, auto-refresh, and cross-tab sync.
+Client SDK for the Baliola Auth service. Two clearly separated email flows (passwordless OTP, password + verification OTP) plus Google login (hosted popup, hosted redirect, or Google Identity Services), with typed methods, typed errors, auto-refresh, and cross-tab sync.
 
 Guides:
 
@@ -98,11 +98,44 @@ auth.emailPassword.changePassword({ currentPassword, newPassword });
 
 ### `auth.google`
 
+Three ways in. The hosted flow needs a `clientId` on the client and a `returnTo` whose origin is
+one of the project's `allowedOrigins`. Google Identity Services is not loaded in your page.
+
 ```ts
-// idToken is obtained from Google Sign-In on the frontend.
+import { GoogleSignInCancelledError, GoogleSignInError } from '@baliola/auth-sdk';
+
+// 1. Hosted popup (recommended). Opens the auth server's Google login in a popup,
+//    exchanges the one-time code it posts back, and stores the session.
+try {
+  const session = await auth.google.signInWithPopup();
+  // optional: { returnTo: '/auth/callback', popup: { width: 500, height: 640 } }
+} catch (e) {
+  if (e instanceof GoogleSignInCancelledError) return; // e.reason: 'popup_blocked' | 'popup_closed' | 'access_denied'
+  if (e instanceof GoogleSignInError) return showError(e.code); // 'email_unverified', 'invalid_google_code', ...
+  throw e;
+}
+
+// 2. Hosted redirect. Send the tab to Google, then finish on the returnTo page.
+location.assign(auth.google.startUrl({ mode: 'redirect', nonce: crypto.randomUUID() }));
+// ...on the returnTo page, at boot:
+const session = await auth.google.completeRedirect(); // null when the URL has no code or error
+
+// 3. Google Identity Services. idToken comes from the GIS button or One Tap.
 auth.google.login({ idToken }); // → AuthSession
 ```
 
+Manual control: `startUrl({ mode: 'popup' | 'redirect', returnTo?, nonce })` builds
+`GET {baseUrl}/auth/google/start`, and `exchange({ code })` turns the one-time code from the exit into
+a stored session. Both are what `signInWithPopup` and `completeRedirect` use internally.
+
+How the popup exit reaches you: the auth server's callback page runs
+`window.opener.postMessage({ type: 'baliola-auth:google', nonce, code }, returnToOrigin)` on success,
+or `{ type: 'baliola-auth:google', nonce, error }` on failure, then closes. `signInWithPopup` accepts
+a message only when `event.origin` is the auth server origin, `type` matches, and `nonce` is the one
+it generated. In `redirect` mode the exit is a 302 to `returnTo` with `code` and `nonce` (or `error`
+and `nonce`) query params; `completeRedirect` checks `nonce` against the value `startUrl` saved in
+`sessionStorage` and strips all three params from the URL before exchanging.
+
 ### Custodial wallet (smart-account signer)
 
 ```ts
@@ -123,8 +156,10 @@ The private key never leaves baliola-auth; `owner.signMessage({ raw })` calls `P
 
 ```ts
 const { account, profile } = await auth.getProfile(); // GET /profile (authenticated)
-// account = { id, email, status }   — status is live, not a token-time snapshot
+// account = { id, email, status, hasPassword }   (status is live, not a token-time snapshot)
 // profile = { displayName, avatarUrl, primaryEmail, primaryPhone } | null
+
+// hasPassword is false for Google-only or code-only accounts: offer setPassword, not changePassword.
 ```
 
 ### Session lifecycle
@@ -190,6 +225,8 @@ import {
   RateLimitedError,
   InvalidPasswordError,
   InvalidEmailError,
+  GoogleSignInCancelledError,
+  GoogleSignInError,
 } from '@baliola/auth-sdk';
 
 try {
@@ -207,19 +244,21 @@ try {
 | Error class                    | `code`                       | Status | Carries                                    |
 | ------------------------------ | ---------------------------- | ------ | ------------------------------------------ |
 | `OtpInvalidError`              | `otp_invalid`                | 400    | `attemptsRemaining`, `canResendInSeconds`  |
-| `OtpExpiredError`              | `otp_expired`                | 400    | —                                          |
+| `OtpExpiredError`              | `otp_expired`                | 400    | none                                       |
 | `MaxAttemptsError`             | `max_attempts_exceeded`      | 429    | `retryAfterSeconds`                        |
-| `NoPendingOtpError`            | `no_pending_otp`             | 400    | —                                          |
+| `NoPendingOtpError`            | `no_pending_otp`             | 400    | none                                       |
 | `ResendCooldownError`          | `resend_cooldown`            | 429    | `canResendInSeconds`                       |
-| `MaxResendsError`              | `max_resends_exceeded`       | 429    | —                                          |
-| `InvalidCredentialsError`      | `invalid_credentials`        | 401    | —                                          |
-| `NoPasswordSetError`           | `no_password_set`            | 400    | —                                          |
-| `AccountSuspendedError`        | `account_suspended`          | 403    | —                                          |
-| `EmailAlreadyHasPasswordError` | `email_already_has_password` | 409    | —                                          |
-| `CaptchaFailedError`           | `captcha_failed`             | 400    | —                                          |
+| `MaxResendsError`              | `max_resends_exceeded`       | 429    | none                                       |
+| `InvalidCredentialsError`      | `invalid_credentials`        | 401    | none                                       |
+| `NoPasswordSetError`           | `no_password_set`            | 400    | none                                       |
+| `AccountSuspendedError`        | `account_suspended`          | 403    | none                                       |
+| `EmailAlreadyHasPasswordError` | `email_already_has_password` | 409    | none                                       |
+| `CaptchaFailedError`           | `captcha_failed`             | 400    | none                                       |
 | `InvalidPasswordError`         | `invalid_password`           | 400    | `reason: 'too_short'\|'no_uppercase'\|...` |
-| `InvalidEmailError`            | `invalid_email`              | 400    | —                                          |
+| `InvalidEmailError`            | `invalid_email`              | 400    | none                                       |
 | `RateLimitedError`             | (legacy 429)                 | 429    | `retryAfterSeconds`, `retryAfterHuman`     |
+| `GoogleSignInCancelledError`   | `oauth_cancelled`            | 0      | `reason: 'popup_blocked'\|'popup_closed'\|'access_denied'` |
+| `GoogleSignInError`            | `invalid_google_code`, `email_unverified`, `invalid_oauth_state`, `oauth_unexpected`, `oauth_nonce_mismatch` | 401 / 400 / 0 | none |
 | `AuthError` (base)             | varies                       | varies | `status: 0` for network/timeout            |
 
 ## Stores
@@ -303,7 +342,7 @@ if (session) {
 }
 ```
 
-**`auth.emailOtp.verifyLoginCode` / `auth.emailPassword.verifyRegistrationCode` / `auth.emailPassword.login` / `auth.google.login` success (`AuthSession`):**
+**`auth.emailOtp.verifyLoginCode` / `auth.emailPassword.verifyRegistrationCode` / `auth.emailPassword.login` / `auth.google.login` / `auth.google.exchange` success (`AuthSession`):**
 
 ```json
 {
@@ -317,6 +356,15 @@ if (session) {
 }
 ```
 
+**`auth.getProfile` success (`ProfileResult`):**
+
+```json
+{
+  "account": { "id": "...", "email": "user@example.com", "status": "active", "hasPassword": true },
+  "profile": { "displayName": "Ada", "avatarUrl": null, "primaryEmail": "user@example.com", "primaryPhone": null }
+}
+```
+
 **Verify-code failure (e.g. `OtpInvalidError`):**
 
 ```json
@@ -334,6 +382,19 @@ if (session) {
 }
 ```
 
+**`auth.google.exchange` failure (`GoogleSignInError`, 401):**
+
+```json
+{
+  "message": "Invalid or expired login code",
+  "data": null,
+  "error": {
+    "code": "invalid_google_code",
+    "details": { "name": "UnauthorizedError", "requestId": "..." }
+  }
+}
+```
+
 ## License
 
 Proprietary — see [LICENSE](./LICENSE).

package/dist/{authError-DgPEjTfW.d.ts → authError-CDoEEOP_.d.ts}

@@ -92,6 +92,32 @@ declare class InvalidPasswordError extends AuthError {
 declare class InvalidEmailError extends AuthError {
   constructor(init: AuthErrorInit);
 }
+type GoogleSignInCancelledReason = 'popup_blocked' | 'popup_closed' | 'access_denied';
+/**
+ * The hosted Google sign-in ended without a session because of the user or
+ * the browser: the popup was blocked, the popup was closed early, or the
+ * user cancelled on Google's account chooser. `code` is always
+ * `oauth_cancelled`; branch on `reason` for the specific cause.
+ */
+declare class GoogleSignInCancelledError extends AuthError {
+  readonly reason: GoogleSignInCancelledReason;
+  constructor(init: {
+    reason: GoogleSignInCancelledReason;
+    cause?: unknown;
+  });
+}
+/**
+ * The hosted Google sign-in failed. `code` is the failure code the exit or
+ * the exchange returned: `invalid_oauth_state`, `invalid_google_code`,
+ * `email_unverified`, `oauth_unexpected`, or the SDK-side
+ * `oauth_nonce_mismatch`. `status` is the HTTP status when the exchange
+ * request failed, otherwise `0`.
+ */
+declare class GoogleSignInError extends AuthError {
+  constructor(init: {
+    code: string;
+  } & Partial<AuthErrorInit>);
+}
 /**
  * Map a backend error response onto the right AuthError subclass.
  * Falls back to `AuthError` (with status + code preserved) for unknown codes.
@@ -100,4 +126,4 @@ declare function authErrorFromResponse(response: Response): Promise<AuthError>;
 /** Network/timeout failures land here. */
 declare function authErrorFromFetchFailure(cause: unknown, isTimeout?: boolean): AuthError;
 //#endregion
-export { authErrorFromFetchFailure as _, EmailAlreadyHasPasswordError as a, InvalidPasswordError as c, NoPasswordSetError as d, NoPendingOtpError as f, ResendCooldownError as g, RateLimitedError as h, CaptchaFailedError as i, MaxAttemptsError as l, OtpInvalidError as m, AuthError as n, InvalidCredentialsError as o, OtpExpiredError as p, AuthErrorInit as r, InvalidEmailError as s, AccountSuspendedError as t, MaxResendsError as u, authErrorFromResponse as v };
+export { OtpInvalidError as _, EmailAlreadyHasPasswordError as a, authErrorFromFetchFailure as b, GoogleSignInError as c, InvalidPasswordError as d, MaxAttemptsError as f, OtpExpiredError as g, NoPendingOtpError as h, CaptchaFailedError as i, InvalidCredentialsError as l, NoPasswordSetError as m, AuthError as n, GoogleSignInCancelledError as o, MaxResendsError as p, AuthErrorInit as r, GoogleSignInCancelledReason as s, AccountSuspendedError as t, InvalidEmailError as u, RateLimitedError as v, authErrorFromResponse as x, ResendCooldownError as y };

package/dist/{authError-CYUAl2Jt.js → authError-CUQ1rFAr.js}

@@ -131,6 +131,42 @@ var InvalidEmailError = class extends AuthError {
 		this.name = "InvalidEmailError";
 	}
 };
+/**
+* The hosted Google sign-in ended without a session because of the user or
+* the browser: the popup was blocked, the popup was closed early, or the
+* user cancelled on Google's account chooser. `code` is always
+* `oauth_cancelled`; branch on `reason` for the specific cause.
+*/
+var GoogleSignInCancelledError = class extends AuthError {
+	reason;
+	constructor(init) {
+		super({
+			status: 0,
+			code: "oauth_cancelled",
+			serverMessage: `Google sign-in cancelled: ${init.reason}`,
+			...init.cause !== void 0 && { cause: init.cause }
+		});
+		this.name = "GoogleSignInCancelledError";
+		this.reason = init.reason;
+	}
+};
+/**
+* The hosted Google sign-in failed. `code` is the failure code the exit or
+* the exchange returned: `invalid_oauth_state`, `invalid_google_code`,
+* `email_unverified`, `oauth_unexpected`, or the SDK-side
+* `oauth_nonce_mismatch`. `status` is the HTTP status when the exchange
+* request failed, otherwise `0`.
+*/
+var GoogleSignInError = class extends AuthError {
+	constructor(init) {
+		super({
+			...init,
+			status: init.status ?? 0,
+			serverMessage: init.serverMessage ?? `Google sign-in failed: ${init.code}`
+		});
+		this.name = "GoogleSignInError";
+	}
+};
 function num(d, key, fallback = 0) {
 	const v = d?.[key];
 	return typeof v === "number" ? v : fallback;
@@ -189,6 +225,11 @@ async function authErrorFromResponse(response) {
 			});
 		}
 		case "invalid_email": return new InvalidEmailError(init);
+		case "invalid_google_code":
+		case "email_unverified": return new GoogleSignInError({
+			...init,
+			code
+		});
 		default:
 			if (response.status === 429) {
 				const retryAfterSeconds = num(details, "retryAfter") || num(details, "retryAfterSeconds") || Number(response.headers.get("Retry-After") ?? 0);
@@ -212,4 +253,4 @@ function authErrorFromFetchFailure(cause, isTimeout = false) {
 	});
 }
 //#endregion
-export { authErrorFromResponse as _, InvalidCredentialsError as a, MaxAttemptsError as c, NoPendingOtpError as d, OtpExpiredError as f, authErrorFromFetchFailure as g, ResendCooldownError as h, EmailAlreadyHasPasswordError as i, MaxResendsError as l, RateLimitedError as m, AuthError as n, InvalidEmailError as o, OtpInvalidError as p, CaptchaFailedError as r, InvalidPasswordError as s, AccountSuspendedError as t, NoPasswordSetError as u };
+export { ResendCooldownError as _, GoogleSignInCancelledError as a, InvalidEmailError as c, MaxResendsError as d, NoPasswordSetError as f, RateLimitedError as g, OtpInvalidError as h, EmailAlreadyHasPasswordError as i, InvalidPasswordError as l, OtpExpiredError as m, AuthError as n, GoogleSignInError as o, NoPendingOtpError as p, CaptchaFailedError as r, InvalidCredentialsError as s, AccountSuspendedError as t, MaxAttemptsError as u, authErrorFromFetchFailure as v, authErrorFromResponse as y };

package/dist/client/index.d.ts

@@ -1,2 +1,2 @@
-import { a as GoogleNamespace, c as WalletNamespace, f as AuthFetchInit, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient } from "../index-B2RuGLX_.js";
+import { a as GoogleNamespace, c as WalletNamespace, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient, u as AuthFetchInit } from "../index-CFXMA6WD.js";
 export { AuthClient, AuthFetchInit, CreateAuthClientOptions, EmailOtpNamespace, EmailPasswordNamespace, GoogleNamespace, ProactiveRefreshConfig, SubscribeOptions, WalletNamespace, createAuthClient };

package/dist/client/index.js

@@ -1,2 +1,2 @@
-import { t as createAuthClient } from "../client-DU_DerYi.js";
+import { t as createAuthClient } from "../client-Bk9WIMVc.js";
 export { createAuthClient };

package/dist/{client-DU_DerYi.js → client-Bk9WIMVc.js}

@@ -1,5 +1,143 @@
-import { _ as authErrorFromResponse, g as authErrorFromFetchFailure, n as AuthError } from "./authError-CYUAl2Jt.js";
+import { a as GoogleSignInCancelledError, n as AuthError, o as GoogleSignInError, v as authErrorFromFetchFailure, y as authErrorFromResponse } from "./authError-CUQ1rFAr.js";
 import { n as memoryStore } from "./sessionStore-DD6lON9W.js";
+//#region src/client/googleHosted.ts
+const NONCE_STORAGE_KEY = "baliola-auth:google:nonce";
+const MESSAGE_TYPE = "baliola-auth:google";
+const POPUP_WINDOW_NAME = "baliola-auth-google";
+const DEFAULT_POPUP_WIDTH = 500;
+const DEFAULT_POPUP_HEIGHT = 640;
+const POPUP_POLL_INTERVAL_MS = 500;
+function browserWindow() {
+	return typeof globalThis.window === "undefined" ? null : globalThis.window;
+}
+function requireBrowserWindow(method) {
+	const win = browserWindow();
+	if (!win) throw new Error(`google.${method}: only available in a browser (window is undefined)`);
+	return win;
+}
+function parseExitMessage(data) {
+	if (typeof data !== "object" || data === null) return null;
+	const record = data;
+	if (record["type"] !== MESSAGE_TYPE) return null;
+	const nonce = record["nonce"];
+	return {
+		nonce: typeof nonce === "string" ? nonce : null,
+		...typeof record["code"] === "string" && { code: record["code"] },
+		...typeof record["error"] === "string" && { error: record["error"] }
+	};
+}
+function exitError(code) {
+	if (code === "access_denied") return new GoogleSignInCancelledError({ reason: "access_denied" });
+	return new GoogleSignInError({ code });
+}
+function createGoogleHosted(ctx) {
+	const authOrigin = new URL(ctx.baseUrl).origin;
+	function resolveReturnTo(returnTo) {
+		if (returnTo !== void 0 && /^https?:\/\//i.test(returnTo)) return returnTo;
+		const win = browserWindow();
+		if (!win) throw new Error("google.startUrl: returnTo must be an absolute URL outside a browser (window is undefined)");
+		if (returnTo === void 0) {
+			const current = new URL(win.location.href);
+			current.hash = "";
+			return current.toString();
+		}
+		return new URL(returnTo, win.location.href).toString();
+	}
+	function saveRedirectNonce(nonce) {
+		if (typeof globalThis.sessionStorage === "undefined") throw new Error("google.startUrl: sessionStorage is required for redirect mode");
+		globalThis.sessionStorage.setItem(NONCE_STORAGE_KEY, nonce);
+	}
+	function startUrl(opts) {
+		if (ctx.clientId === void 0) throw new Error("google.startUrl: clientId is required");
+		const url = new URL(`${ctx.baseUrl}/auth/google/start`);
+		url.searchParams.set("clientId", ctx.clientId);
+		url.searchParams.set("returnTo", resolveReturnTo(opts.returnTo));
+		url.searchParams.set("mode", opts.mode);
+		url.searchParams.set("nonce", opts.nonce);
+		if (opts.mode === "redirect") saveRedirectNonce(opts.nonce);
+		return url.toString();
+	}
+	function signInWithPopup(opts = {}) {
+		return new Promise((resolve, reject) => {
+			const win = requireBrowserWindow("signInWithPopup");
+			const nonce = crypto.randomUUID();
+			const url = startUrl({
+				mode: "popup",
+				nonce,
+				...opts.returnTo !== void 0 && { returnTo: opts.returnTo }
+			});
+			const width = opts.popup?.width ?? DEFAULT_POPUP_WIDTH;
+			const height = opts.popup?.height ?? DEFAULT_POPUP_HEIGHT;
+			const popup = win.open(url, POPUP_WINDOW_NAME, `popup,width=${width},height=${height}`);
+			if (!popup) {
+				reject(new GoogleSignInCancelledError({ reason: "popup_blocked" }));
+				return;
+			}
+			let settled = false;
+			let closeTimer = null;
+			const cleanup = () => {
+				settled = true;
+				win.removeEventListener("message", onMessage);
+				clearInterval(pollTimer);
+				if (closeTimer !== null) clearTimeout(closeTimer);
+			};
+			const onMessage = (event) => {
+				if (settled || event.origin !== authOrigin) return;
+				const message = parseExitMessage(event.data);
+				if (!message || message.nonce !== nonce) return;
+				cleanup();
+				if (message.code !== void 0) {
+					ctx.exchange({ code: message.code }).then(resolve, reject);
+					return;
+				}
+				reject(exitError(message.error ?? "oauth_unexpected"));
+			};
+			const pollTimer = setInterval(() => {
+				if (settled || !popup.closed || closeTimer !== null) return;
+				closeTimer = setTimeout(() => {
+					if (settled) return;
+					cleanup();
+					reject(new GoogleSignInCancelledError({ reason: "popup_closed" }));
+				}, POPUP_POLL_INTERVAL_MS);
+			}, POPUP_POLL_INTERVAL_MS);
+			win.addEventListener("message", onMessage);
+		});
+	}
+	function takeRedirectNonce() {
+		if (typeof globalThis.sessionStorage === "undefined") return null;
+		const saved = globalThis.sessionStorage.getItem(NONCE_STORAGE_KEY);
+		globalThis.sessionStorage.removeItem(NONCE_STORAGE_KEY);
+		return saved;
+	}
+	function stripExitParams(url) {
+		for (const key of [
+			"code",
+			"error",
+			"nonce"
+		]) url.searchParams.delete(key);
+		if (typeof globalThis.history === "undefined") return;
+		globalThis.history.replaceState(globalThis.history.state, "", url.toString());
+	}
+	async function completeRedirect(opts = {}) {
+		const win = requireBrowserWindow("completeRedirect");
+		const url = new URL(opts.url ?? win.location.href);
+		const code = url.searchParams.get("code");
+		const error = url.searchParams.get("error");
+		if (code === null && error === null) return null;
+		const nonce = url.searchParams.get("nonce");
+		const saved = takeRedirectNonce();
+		stripExitParams(url);
+		if (saved === null || nonce !== saved) throw new GoogleSignInError({ code: "oauth_nonce_mismatch" });
+		if (code === null) throw exitError(error ?? "oauth_unexpected");
+		return ctx.exchange({ code });
+	}
+	return {
+		startUrl,
+		signInWithPopup,
+		completeRedirect
+	};
+}
+//#endregion
 //#region src/client/methods.ts
 function toAuthSession(data) {
 	const issuedAt = Date.now();
@@ -133,6 +271,14 @@ function createMethods(ctx) {
 				body: withClientId({ idToken: input.idToken })
 			}));
 		},
+		async googleExchange(input) {
+			return toAuthSession(await ctx.transport.request({
+				path: "/auth/google/exchange",
+				method: "POST",
+				authMode: "none",
+				body: { code: input.code }
+			}));
+		},
 		/** wallet.* */
 		async getWalletAddress() {
 			return ctx.transport.request({
@@ -441,37 +587,55 @@ function createAuthClient(options) {
 		transport,
 		...options.clientId !== void 0 && { clientId: options.clientId }
 	});
-	return {
-		emailOtp: {
-			sendLoginCode: (input) => methods.sendLoginCode(input),
-			async verifyLoginCode(input) {
-				const session = await methods.verifyLoginCode(input);
-				await setSession(session);
-				return session;
-			},
-			resendLoginCode: (input) => methods.resendLoginCode(input)
+	const emailOtp = {
+		sendLoginCode: (input) => methods.sendLoginCode(input),
+		async verifyLoginCode(input) {
+			const session = await methods.verifyLoginCode(input);
+			await setSession(session);
+			return session;
 		},
-		emailPassword: {
-			register: (input) => methods.register(input),
-			async verifyRegistrationCode(input) {
-				const session = await methods.verifyRegistrationCode(input);
-				await setSession(session);
-				return session;
-			},
-			resendRegistrationCode: (input) => methods.resendRegistrationCode(input),
+		resendLoginCode: (input) => methods.resendLoginCode(input)
+	};
+	const emailPassword = {
+		register: (input) => methods.register(input),
+		async verifyRegistrationCode(input) {
+			const session = await methods.verifyRegistrationCode(input);
+			await setSession(session);
+			return session;
+		},
+		resendRegistrationCode: (input) => methods.resendRegistrationCode(input),
+		async login(input) {
+			const session = await methods.loginWithPassword(input);
+			await setSession(session);
+			return session;
+		},
+		setPassword: (input) => methods.setPassword(input),
+		changePassword: (input) => methods.changePassword(input)
+	};
+	async function googleExchange(input) {
+		const session = await methods.googleExchange(input);
+		await setSession(session);
+		return session;
+	}
+	const googleHosted = createGoogleHosted({
+		baseUrl,
+		...options.clientId !== void 0 && { clientId: options.clientId },
+		exchange: googleExchange
+	});
+	return {
+		emailOtp,
+		emailPassword,
+		google: {
 			async login(input) {
-				const session = await methods.loginWithPassword(input);
+				const session = await methods.loginWithGoogle(input);
 				await setSession(session);
 				return session;
 			},
-			setPassword: (input) => methods.setPassword(input),
-			changePassword: (input) => methods.changePassword(input)
+			startUrl: (opts) => googleHosted.startUrl(opts),
+			exchange: googleExchange,
+			signInWithPopup: (opts) => googleHosted.signInWithPopup(opts),
+			completeRedirect: (opts) => googleHosted.completeRedirect(opts)
 		},
-		google: { async login(input) {
-			const session = await methods.loginWithGoogle(input);
-			await setSession(session);
-			return session;
-		} },
 		wallet: {
 			getAddress: async () => (await methods.getWalletAddress()).address,
 			signHash: async (hash) => (await methods.signWalletHash(hash)).signature

package/dist/errors/index.d.ts

@@ -1,2 +1,2 @@
-import { _ as authErrorFromFetchFailure, a as EmailAlreadyHasPasswordError, c as InvalidPasswordError, d as NoPasswordSetError, f as NoPendingOtpError, g as ResendCooldownError, h as RateLimitedError, i as CaptchaFailedError, l as MaxAttemptsError, m as OtpInvalidError, n as AuthError, o as InvalidCredentialsError, p as OtpExpiredError, r as AuthErrorInit, s as InvalidEmailError, t as AccountSuspendedError, u as MaxResendsError, v as authErrorFromResponse } from "../authError-DgPEjTfW.js";
-export { AccountSuspendedError, AuthError, type AuthErrorInit, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse };
+import { _ as OtpInvalidError, a as EmailAlreadyHasPasswordError, b as authErrorFromFetchFailure, c as GoogleSignInError, d as InvalidPasswordError, f as MaxAttemptsError, g as OtpExpiredError, h as NoPendingOtpError, i as CaptchaFailedError, l as InvalidCredentialsError, m as NoPasswordSetError, n as AuthError, o as GoogleSignInCancelledError, p as MaxResendsError, r as AuthErrorInit, s as GoogleSignInCancelledReason, t as AccountSuspendedError, u as InvalidEmailError, v as RateLimitedError, x as authErrorFromResponse, y as ResendCooldownError } from "../authError-CDoEEOP_.js";
+export { AccountSuspendedError, AuthError, type AuthErrorInit, CaptchaFailedError, EmailAlreadyHasPasswordError, GoogleSignInCancelledError, type GoogleSignInCancelledReason, GoogleSignInError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse };

package/dist/errors/index.js

@@ -1,2 +1,2 @@
-import { _ as authErrorFromResponse, a as InvalidCredentialsError, c as MaxAttemptsError, d as NoPendingOtpError, f as OtpExpiredError, g as authErrorFromFetchFailure, h as ResendCooldownError, i as EmailAlreadyHasPasswordError, l as MaxResendsError, m as RateLimitedError, n as AuthError, o as InvalidEmailError, p as OtpInvalidError, r as CaptchaFailedError, s as InvalidPasswordError, t as AccountSuspendedError, u as NoPasswordSetError } from "../authError-CYUAl2Jt.js";
-export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse };
+import { _ as ResendCooldownError, a as GoogleSignInCancelledError, c as InvalidEmailError, d as MaxResendsError, f as NoPasswordSetError, g as RateLimitedError, h as OtpInvalidError, i as EmailAlreadyHasPasswordError, l as InvalidPasswordError, m as OtpExpiredError, n as AuthError, o as GoogleSignInError, p as NoPendingOtpError, r as CaptchaFailedError, s as InvalidCredentialsError, t as AccountSuspendedError, u as MaxAttemptsError, v as authErrorFromFetchFailure, y as authErrorFromResponse } from "../authError-CUQ1rFAr.js";
+export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, GoogleSignInCancelledError, GoogleSignInError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse };

package/dist/{index-B2RuGLX_.d.ts → index-CFXMA6WD.d.ts}

@@ -1,6 +1,6 @@
-import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
+import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
 import { n as SessionStore } from "./sessionStore-BDdEpbL8.js";
-import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, u as VerifyLoginCodeInput } from "./requests-eTORIjY5.js";
+import { a as GoogleSignInWithPopupOptions, c as LoginWithGoogleInput, d as ResendLoginCodeInput, f as ResendRegistrationCodeInput, g as VerifyRegistrationCodeInput, h as VerifyLoginCodeInput, i as GoogleExchangeInput, l as LoginWithPasswordInput, m as SetPasswordInput, n as ChangePasswordInput, p as SendLoginCodeInput, r as GoogleCompleteRedirectOptions, s as GoogleStartOptions, u as RegisterInput, y as ProfileResult } from "./requests-C0WoK341.js";
 
 //#region src/client/transport.d.ts
 type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
@@ -26,20 +26,6 @@ type AuthFetchInit = RequestInit & {
   disableRefresh?: boolean;
 };
 //#endregion
-//#region src/types/profile.d.ts
-/** The account's profile record; every field is user-editable and nullable. */
-type Profile = {
-  displayName: string | null;
-  avatarUrl: string | null;
-  primaryEmail: string | null;
-  primaryPhone: string | null;
-};
-/** Result of `auth.getProfile` — identity read for the token holder. */
-type ProfileResult = {
-  /** `status` is the live account status, not a token-time snapshot. */account: Account; /** `null` when the account has no profile row yet. */
-  profile: Profile | null;
-};
-//#endregion
 //#region src/client/index.d.ts
 type ProactiveRefreshConfig = false | {
   /** Refresh proactively if `expiresAt - now < leadTimeMs`. Defaults to 60_000 (60s). */leadTimeMs?: number;
@@ -131,7 +117,71 @@ type EmailPasswordNamespace = {
 };
 /** Google flow. */
 type GoogleNamespace = {
+  /**
+   * Sign in with a Google ID token from the Google Identity Services button
+   * or One Tap. Apps that do not load Google Identity Services should use
+   * `signInWithPopup` instead.
+   *
+   * @throws AuthError (401) when the ID token fails verification,
+   *         GoogleSignInError with code `email_unverified`,
+   *         AccountSuspendedError, AuthError.
+   */
   login(input: LoginWithGoogleInput): Promise<AuthSession>;
+  /**
+   * Build the `GET /auth/google/start` URL for the hosted login. Use it to
+   * drive the redirect flow yourself (`location.assign(url)`), or a custom
+   * popup. In `redirect` mode the nonce is saved in `sessionStorage` for
+   * `completeRedirect` to verify.
+   *
+   * @throws Error when the client has no `clientId`, when `returnTo` is
+   *         relative outside a browser, or when `sessionStorage` is missing
+   *         in `redirect` mode.
+   */
+  startUrl(opts: GoogleStartOptions & {
+    nonce: string;
+  }): string;
+  /**
+   * Exchange the one-time `code` from a hosted login exit for a session.
+   * `signInWithPopup` and `completeRedirect` call this for you; call it
+   * yourself only when driving `startUrl` manually.
+   *
+   * @throws GoogleSignInError with code `invalid_google_code` (401) when the
+   *         code is unknown, expired (60 s), or already used;
+   *         AccountSuspendedError, AuthError.
+   */
+  exchange(input: GoogleExchangeInput): Promise<AuthSession>;
+  /**
+   * Sign in with Google through the auth-hosted flow in a popup. Opens
+   * `startUrl` in a popup window, waits for the exit message, exchanges the
+   * one-time code, and stores the session. Browser only.
+   *
+   * @throws GoogleSignInCancelledError (`reason`: `popup_blocked`,
+   *         `popup_closed`, or `access_denied`), GoogleSignInError with the
+   *         exit or exchange code, Error outside a browser.
+   * @example
+   * try {
+   *   const session = await auth.google.signInWithPopup();
+   * } catch (e) {
+   *   if (e instanceof GoogleSignInCancelledError) return; // user backed out
+   *   throw e;
+   * }
+   */
+  signInWithPopup(opts?: GoogleSignInWithPopupOptions): Promise<AuthSession>;
+  /**
+   * Finish a hosted Google login started in `redirect` mode. Call it on the
+   * `returnTo` page. Resolves `null` when the URL carries no `code` or
+   * `error`, otherwise verifies the nonce saved by `startUrl`, strips
+   * `code`, `error`, and `nonce` from the URL, and exchanges the code.
+   * Browser only.
+   *
+   * @throws GoogleSignInError (`oauth_nonce_mismatch`, or the exit or
+   *         exchange code), GoogleSignInCancelledError (`access_denied`),
+   *         Error outside a browser.
+   * @example
+   * const session = await auth.google.completeRedirect();
+   * if (session) router.replace('/dashboard');
+   */
+  completeRedirect(opts?: GoogleCompleteRedirectOptions): Promise<AuthSession | null>;
 };
 /** Custodial wallet (Console tier). */
 type WalletNamespace = {
@@ -144,8 +194,10 @@ type AuthClient = {
   google: GoogleNamespace;
   wallet: WalletNamespace;
   /**
-   * Fetch the token holder's identity: account (id, email, live status) plus
-   * its profile record (`profile: null` when none exists yet).
+   * Fetch the token holder's identity: account (id, email, live status,
+   * `hasPassword`) plus its profile record (`profile: null` when none exists
+   * yet). Use `account.hasPassword` to choose between
+   * `emailPassword.setPassword` and `emailPassword.changePassword`.
    *
    * @throws AuthError on 401 (missing/expired session) and other API errors.
    */
@@ -166,4 +218,4 @@ type AuthClient = {
 };
 declare function createAuthClient(options: CreateAuthClientOptions): AuthClient;
 //#endregion
-export { GoogleNamespace as a, WalletNamespace as c, ProfileResult as d, AuthFetchInit as f, EmailPasswordNamespace as i, createAuthClient as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, SubscribeOptions as s, AuthClient as t, Profile as u };
+export { GoogleNamespace as a, WalletNamespace as c, EmailPasswordNamespace as i, createAuthClient as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, SubscribeOptions as s, AuthClient as t, AuthFetchInit as u };

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
-import { a as GoogleNamespace, c as WalletNamespace, d as ProfileResult, f as AuthFetchInit, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient, u as Profile } from "./index-B2RuGLX_.js";
+import { a as GoogleNamespace, c as WalletNamespace, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient, u as AuthFetchInit } from "./index-CFXMA6WD.js";
 import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "./sessionStore-BDdEpbL8.js";
-import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, t as CaptchaArgs, u as VerifyLoginCodeInput } from "./requests-eTORIjY5.js";
-import { _ as authErrorFromFetchFailure, a as EmailAlreadyHasPasswordError, c as InvalidPasswordError, d as NoPasswordSetError, f as NoPendingOtpError, g as ResendCooldownError, h as RateLimitedError, i as CaptchaFailedError, l as MaxAttemptsError, m as OtpInvalidError, n as AuthError, o as InvalidCredentialsError, p as OtpExpiredError, r as AuthErrorInit, s as InvalidEmailError, t as AccountSuspendedError, u as MaxResendsError, v as authErrorFromResponse } from "./authError-DgPEjTfW.js";
+import { _ as Profile, a as GoogleSignInWithPopupOptions, c as LoginWithGoogleInput, d as ResendLoginCodeInput, f as ResendRegistrationCodeInput, g as VerifyRegistrationCodeInput, h as VerifyLoginCodeInput, i as GoogleExchangeInput, l as LoginWithPasswordInput, m as SetPasswordInput, n as ChangePasswordInput, o as GoogleStartMode, p as SendLoginCodeInput, r as GoogleCompleteRedirectOptions, s as GoogleStartOptions, t as CaptchaArgs, u as RegisterInput, v as ProfileAccount, y as ProfileResult } from "./requests-C0WoK341.js";
+import { _ as OtpInvalidError, a as EmailAlreadyHasPasswordError, b as authErrorFromFetchFailure, c as GoogleSignInError, d as InvalidPasswordError, f as MaxAttemptsError, g as OtpExpiredError, h as NoPendingOtpError, i as CaptchaFailedError, l as InvalidCredentialsError, m as NoPasswordSetError, n as AuthError, o as GoogleSignInCancelledError, p as MaxResendsError, r as AuthErrorInit, s as GoogleSignInCancelledReason, t as AccountSuspendedError, u as InvalidEmailError, v as RateLimitedError, x as authErrorFromResponse, y as ResendCooldownError } from "./authError-CDoEEOP_.js";
 import { n as AccessTokenPayloadProject, t as AccessTokenPayload } from "./tokens-BXrPLi5B.js";
 
 //#region src/types/wallet.d.ts
@@ -16,4 +16,4 @@ type SignHashResult = {
   address: string;
 };
 //#endregion
-export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleNamespace, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Profile, type ProfileResult, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SignHashResult, type SubscribeOptions, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, type WalletAddressResult, type WalletNamespace, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };
+export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleCompleteRedirectOptions, type GoogleExchangeInput, type GoogleNamespace, GoogleSignInCancelledError, type GoogleSignInCancelledReason, GoogleSignInError, type GoogleSignInWithPopupOptions, type GoogleStartMode, type GoogleStartOptions, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Profile, type ProfileAccount, type ProfileResult, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SignHashResult, type SubscribeOptions, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, type WalletAddressResult, type WalletNamespace, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { t as createAuthClient } from "./client-DU_DerYi.js";
-import { _ as authErrorFromResponse, a as InvalidCredentialsError, c as MaxAttemptsError, d as NoPendingOtpError, f as OtpExpiredError, g as authErrorFromFetchFailure, h as ResendCooldownError, i as EmailAlreadyHasPasswordError, l as MaxResendsError, m as RateLimitedError, n as AuthError, o as InvalidEmailError, p as OtpInvalidError, r as CaptchaFailedError, s as InvalidPasswordError, t as AccountSuspendedError, u as NoPasswordSetError } from "./authError-CYUAl2Jt.js";
+import { _ as ResendCooldownError, a as GoogleSignInCancelledError, c as InvalidEmailError, d as MaxResendsError, f as NoPasswordSetError, g as RateLimitedError, h as OtpInvalidError, i as EmailAlreadyHasPasswordError, l as InvalidPasswordError, m as OtpExpiredError, n as AuthError, o as GoogleSignInError, p as NoPendingOtpError, r as CaptchaFailedError, s as InvalidCredentialsError, t as AccountSuspendedError, u as MaxAttemptsError, v as authErrorFromFetchFailure, y as authErrorFromResponse } from "./authError-CUQ1rFAr.js";
+import { t as createAuthClient } from "./client-Bk9WIMVc.js";
 import { n as memoryStore, t as localStorageStore } from "./sessionStore-DD6lON9W.js";
-export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };
+export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, GoogleSignInCancelledError, GoogleSignInError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/requests-C0WoK341.d.ts

@@ -0,0 +1,93 @@
+import { t as Account } from "./session-Cs_P7ojF.js";
+
+//#region src/types/profile.d.ts
+/** The account's profile record; every field is user-editable and nullable. */
+type Profile = {
+  displayName: string | null;
+  avatarUrl: string | null;
+  primaryEmail: string | null;
+  primaryPhone: string | null;
+};
+/** The account as returned by `auth.getProfile`, with sign-in capability flags. */
+type ProfileAccount = Account & {
+  /**
+   * `true` when the account can sign in with a password; `false` for
+   * Google-only or code-only accounts, which should call
+   * `auth.emailPassword.setPassword` rather than `changePassword`.
+   */
+  hasPassword: boolean;
+};
+/** Result of `auth.getProfile`, the identity read for the token holder. */
+type ProfileResult = {
+  /** `status` is the live account status, not a token-time snapshot. */account: ProfileAccount; /** `null` when the account has no profile row yet. */
+  profile: Profile | null;
+};
+//#endregion
+//#region src/types/requests.d.ts
+/** Optional captcha argument shared by every public unauthenticated entrypoint. */
+type CaptchaArgs = {
+  /** Cloudflare Turnstile token. Required when captcha is enabled on the server. */captchaToken?: string;
+};
+type SendLoginCodeInput = {
+  email: string;
+} & CaptchaArgs;
+type VerifyLoginCodeInput = {
+  email: string;
+  code: string;
+};
+type ResendLoginCodeInput = {
+  email: string;
+} & CaptchaArgs;
+type RegisterInput = {
+  email: string;
+  password: string;
+} & CaptchaArgs;
+type VerifyRegistrationCodeInput = {
+  email: string;
+  code: string;
+};
+type ResendRegistrationCodeInput = {
+  email: string;
+} & CaptchaArgs;
+type LoginWithPasswordInput = {
+  email: string;
+  password: string;
+} & CaptchaArgs;
+type SetPasswordInput = {
+  password: string;
+};
+type ChangePasswordInput = {
+  currentPassword: string;
+  newPassword: string;
+};
+/** `idToken` comes from Google Identity Services (`renderButton` / One Tap). */
+type LoginWithGoogleInput = {
+  idToken: string;
+};
+/** The one-time code handed to the app by the hosted Google login exit. */
+type GoogleExchangeInput = {
+  code: string;
+};
+type GoogleStartMode = 'popup' | 'redirect';
+type GoogleStartOptions = {
+  /**
+   * Where the browser lands after Google. Absolute URL or a path resolved
+   * against `window.location`. Its origin must be one of the project's
+   * `allowedOrigins`. Default: the current href without its hash.
+   */
+  returnTo?: string; /** `popup` posts the result to `window.opener`; `redirect` 302s back to `returnTo`. */
+  mode: GoogleStartMode; /** Opaque value echoed back on the exit. Supplied by `signInWithPopup`; callers normally omit it. */
+  nonce?: string;
+};
+type GoogleSignInWithPopupOptions = {
+  /** See `GoogleStartOptions.returnTo`. Default: the current href without its hash. */returnTo?: string;
+  popup?: {
+    /** Popup width in CSS pixels. Default: 500. */width?: number; /** Popup height in CSS pixels. Default: 640. */
+    height?: number;
+  };
+};
+type GoogleCompleteRedirectOptions = {
+  /** URL to read `code`, `error`, and `nonce` from. Default: `window.location.href`. */url?: string;
+};
+//#endregion
+export { Profile as _, GoogleSignInWithPopupOptions as a, LoginWithGoogleInput as c, ResendLoginCodeInput as d, ResendRegistrationCodeInput as f, VerifyRegistrationCodeInput as g, VerifyLoginCodeInput as h, GoogleExchangeInput as i, LoginWithPasswordInput as l, SetPasswordInput as m, ChangePasswordInput as n, GoogleStartMode as o, SendLoginCodeInput as p, GoogleCompleteRedirectOptions as r, GoogleStartOptions as s, CaptchaArgs as t, RegisterInput as u, ProfileAccount as v, ProfileResult as y };

package/dist/types/index.d.ts

@@ -1,4 +1,4 @@
 import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "../session-Cs_P7ojF.js";
-import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, t as CaptchaArgs, u as VerifyLoginCodeInput } from "../requests-eTORIjY5.js";
+import { _ as Profile, a as GoogleSignInWithPopupOptions, c as LoginWithGoogleInput, d as ResendLoginCodeInput, f as ResendRegistrationCodeInput, g as VerifyRegistrationCodeInput, h as VerifyLoginCodeInput, i as GoogleExchangeInput, l as LoginWithPasswordInput, m as SetPasswordInput, n as ChangePasswordInput, o as GoogleStartMode, p as SendLoginCodeInput, r as GoogleCompleteRedirectOptions, s as GoogleStartOptions, t as CaptchaArgs, u as RegisterInput, v as ProfileAccount, y as ProfileResult } from "../requests-C0WoK341.js";
 import { n as AccessTokenPayloadProject, t as AccessTokenPayload } from "../tokens-BXrPLi5B.js";
-export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, type AuthSession, type CaptchaArgs, type ChangePasswordInput, type ErrorHandler, type ErrorSource, type LoginWithGoogleInput, type LoginWithPasswordInput, type OtpInfo, type Project, type RegisterInput, type RegisterResult, type ResendCodeResult, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SetPasswordInput, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput };
+export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, type AuthSession, type CaptchaArgs, type ChangePasswordInput, type ErrorHandler, type ErrorSource, type GoogleCompleteRedirectOptions, type GoogleExchangeInput, type GoogleSignInWithPopupOptions, type GoogleStartMode, type GoogleStartOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, type OtpInfo, type Profile, type ProfileAccount, type ProfileResult, type Project, type RegisterInput, type RegisterResult, type ResendCodeResult, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SetPasswordInput, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput };

package/dist/wallet/index.d.ts

@@ -1,4 +1,4 @@
-import { t as AuthClient } from "../index-B2RuGLX_.js";
+import { t as AuthClient } from "../index-CFXMA6WD.js";
 import { LocalAccount } from "viem";
 
 //#region src/wallet/index.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baliola/auth-sdk",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Client SDK for Baliola Auth",
   "keywords": [
     "auth",

package/dist/requests-eTORIjY5.d.ts

@@ -1,42 +0,0 @@
-//#region src/types/requests.d.ts
-/** Optional captcha argument shared by every public unauthenticated entrypoint. */
-type CaptchaArgs = {
-  /** Cloudflare Turnstile token. Required when captcha is enabled on the server. */captchaToken?: string;
-};
-type SendLoginCodeInput = {
-  email: string;
-} & CaptchaArgs;
-type VerifyLoginCodeInput = {
-  email: string;
-  code: string;
-};
-type ResendLoginCodeInput = {
-  email: string;
-} & CaptchaArgs;
-type RegisterInput = {
-  email: string;
-  password: string;
-} & CaptchaArgs;
-type VerifyRegistrationCodeInput = {
-  email: string;
-  code: string;
-};
-type ResendRegistrationCodeInput = {
-  email: string;
-} & CaptchaArgs;
-type LoginWithPasswordInput = {
-  email: string;
-  password: string;
-} & CaptchaArgs;
-type SetPasswordInput = {
-  password: string;
-};
-type ChangePasswordInput = {
-  currentPassword: string;
-  newPassword: string;
-};
-type LoginWithGoogleInput = {
-  idToken: string;
-};
-//#endregion
-export { RegisterInput as a, SendLoginCodeInput as c, VerifyRegistrationCodeInput as d, LoginWithPasswordInput as i, SetPasswordInput as l, ChangePasswordInput as n, ResendLoginCodeInput as o, LoginWithGoogleInput as r, ResendRegistrationCodeInput as s, CaptchaArgs as t, VerifyLoginCodeInput as u };