@erpgulf/auth-sdk 0.1.0-beta.1

package/dist/index.js

@@ -0,0 +1,756 @@
+// src/errors/AuthError.ts
+var AuthError = class extends Error {
+  code;
+  httpStatus;
+  retryable;
+  constructor(code, message, options = {}) {
+    super(
+      message,
+      options.cause === void 0 ? void 0 : { cause: options.cause }
+    );
+    this.name = "AuthError";
+    this.code = code;
+    this.httpStatus = options.httpStatus;
+    this.retryable = options.retryable ?? false;
+  }
+};
+function isAuthError(error) {
+  return error instanceof AuthError;
+}
+
+// src/form/encodeForm.ts
+function encodeForm(values) {
+  const form = new URLSearchParams();
+  for (const [key, value] of Object.entries(values)) {
+    if (value !== void 0) {
+      form.append(key, String(value));
+    }
+  }
+  return form.toString();
+}
+
+// src/master-token/MasterTokenManager.ts
+var MASTER_TOKEN_EXPIRY_SKEW_MS = 3e4;
+var MasterTokenManager = class {
+  #credential;
+  #inFlight;
+  expirySkewMs;
+  fetchCredential;
+  now;
+  constructor(options) {
+    this.fetchCredential = options.fetchCredential;
+    this.now = options.now ?? Date.now;
+    this.expirySkewMs = options.expirySkewMs ?? MASTER_TOKEN_EXPIRY_SKEW_MS;
+  }
+  async getCredential() {
+    if (this.isUsable(this.#credential)) {
+      return this.#credential;
+    }
+    if (this.#inFlight !== void 0) {
+      return this.#inFlight;
+    }
+    const acquisition = this.acquire();
+    this.#inFlight = acquisition;
+    try {
+      return await acquisition;
+    } finally {
+      if (this.#inFlight === acquisition) {
+        this.#inFlight = void 0;
+      }
+    }
+  }
+  invalidate(expectedAccessToken) {
+    if (expectedAccessToken === void 0 || this.#credential?.accessToken === expectedAccessToken) {
+      this.#credential = void 0;
+    }
+  }
+  async acquire() {
+    const credential = await this.fetchCredential();
+    this.#credential = credential;
+    return credential;
+  }
+  isUsable(credential) {
+    return credential !== void 0 && this.now() < credential.expiresAt - this.expirySkewMs;
+  }
+};
+
+// src/url/baseUrl.ts
+function normalizeBaseUrl(input, options = {}) {
+  const trimmed = input.trim();
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    throw invalidBaseUrl("Base URL must be a valid absolute URL.");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw invalidBaseUrl("Base URL must use the HTTPS or HTTP protocol.");
+  }
+  if (url.protocol === "http:" && options.allowInsecureHttp !== true) {
+    throw invalidBaseUrl(
+      "HTTP base URLs require allowInsecureHttp: true and should only be used for development."
+    );
+  }
+  if (url.hostname.length === 0) {
+    throw invalidBaseUrl("Base URL must include a hostname.");
+  }
+  if (url.username.length > 0 || url.password.length > 0) {
+    throw invalidBaseUrl("Base URL must not contain embedded credentials.");
+  }
+  if (url.hash.length > 0) {
+    throw invalidBaseUrl("Base URL must not contain a fragment.");
+  }
+  if (url.search.length > 0) {
+    throw invalidBaseUrl("Base URL must not contain a query string.");
+  }
+  if (url.pathname !== "/") {
+    throw invalidBaseUrl("Base URL must not contain a path.");
+  }
+  return url.origin;
+}
+function joinUrl(baseUrl, endpoint) {
+  const normalizedEndpoint = endpoint.replace(/^\/+/, "");
+  if (normalizedEndpoint.length === 0) {
+    return baseUrl;
+  }
+  return `${baseUrl}/${normalizedEndpoint}`;
+}
+function invalidBaseUrl(message) {
+  return new AuthError("INVALID_BASE_URL", message);
+}
+
+// src/backend/frappe/endpoints.ts
+var AUTH_ENDPOINTS = {
+  masterToken: "/api/method/employee_app.authentication.master_token",
+  loginPolicy: "/api/method/employee_app.authentication.get_employee_login_policy",
+  sendOtp: "/api/method/employee_app.authentication.generate_and_send_otp",
+  signUp: "/api/method/employee_app.authentication.sign_up_api",
+  signIn: "/api/method/employee_app.sign_in.sign_in_api"
+};
+
+// src/backend/frappe/schemas.ts
+import { z } from "zod";
+var backendPolicyValueSchema = z.enum(["Mandatory", "Optional", "No"]);
+var tokenSchema = z.object({
+  access_token: z.string().min(1),
+  expires_in: z.number().int().positive(),
+  token_type: z.string().min(1),
+  scope: z.string(),
+  refresh_token: z.string().min(1)
+});
+var employeeSchema = z.object({
+  id: z.string().min(1),
+  employee_name: z.string().min(1),
+  phone: z.string().min(1),
+  email: z.string().nullable()
+});
+var masterTokenResponseSchema = z.object({
+  data: tokenSchema.extend({
+    // This value will enter an HTTP header. Reject whitespace, controls and
+    // non-ASCII values rather than letting fetch echo them in an exception.
+    access_token: z.string().regex(/^[\x21-\x7e]+$/u)
+  })
+});
+var loginPolicyResponseSchema = z.object({
+  status: z.literal("success"),
+  employee_id: z.string().min(1),
+  policy: z.object({
+    password_policy: backendPolicyValueSchema,
+    otp_policy: backendPolicyValueSchema
+  }),
+  employee_has_existing_password: z.boolean(),
+  employee_has_signed_up: z.boolean()
+});
+var sendOtpResponseSchema = z.object({
+  status: z.literal("success"),
+  message: z.string(),
+  otp_expires_in: z.number().int().positive()
+});
+var signUpResponseSchema = z.object({
+  status: z.literal("success"),
+  data: z.object({
+    token: tokenSchema,
+    employee: employeeSchema,
+    time: z.string().min(1)
+  })
+});
+var signInResponseSchema = z.object({
+  status: z.literal("success"),
+  data: z.object({
+    token: tokenSchema,
+    employee: employeeSchema,
+    password_policy: backendPolicyValueSchema,
+    otp_policy: backendPolicyValueSchema,
+    time: z.string().min(1)
+  })
+});
+var backendErrorResponseSchema = z.object({
+  status: z.literal("error"),
+  message: z.string()
+});
+var masterAuthenticationErrorSchema = z.object({
+  exc_type: z.literal("AuthenticationError")
+});
+var businessErrorMarkerSchema = z.object({
+  status: z.literal("error")
+});
+
+// src/backend/frappe/mappers.ts
+function mapMasterCredential(value, now) {
+  const response = parseConfirmedResponse(
+    masterTokenResponseSchema,
+    value,
+    "master-token"
+  );
+  return {
+    accessToken: response.data.access_token,
+    expiresIn: response.data.expires_in,
+    expiresAt: now + response.data.expires_in * 1e3,
+    tokenType: normalizeTokenType(response.data.token_type),
+    scope: response.data.scope
+  };
+}
+function mapLoginPolicy(value) {
+  const response = parseConfirmedResponse(
+    loginPolicyResponseSchema,
+    value,
+    "login-policy"
+  );
+  return {
+    employeeId: response.employee_id,
+    employeeHasExistingPassword: response.employee_has_existing_password,
+    employeeHasSignedUp: response.employee_has_signed_up,
+    passwordPolicy: mapPasswordPolicy(response.policy.password_policy),
+    otpPolicy: mapOtpPolicy(response.policy.otp_policy)
+  };
+}
+function mapSendOtpResult(value) {
+  const response = parseConfirmedResponse(
+    sendOtpResponseSchema,
+    value,
+    "send-OTP"
+  );
+  return { expiresIn: response.otp_expires_in };
+}
+function mapSignUpResult(value) {
+  const response = parseConfirmedResponse(
+    signUpResponseSchema,
+    value,
+    "sign-up"
+  );
+  return mapBaseAuthResult(response);
+}
+function mapSignInResult(value) {
+  const response = parseConfirmedResponse(
+    signInResponseSchema,
+    value,
+    "sign-in"
+  );
+  return {
+    ...mapBaseAuthResult(response),
+    passwordPolicy: mapPasswordPolicy(response.data.password_policy),
+    otpPolicy: mapOtpPolicy(response.data.otp_policy)
+  };
+}
+function mapBaseAuthResult(response) {
+  return {
+    token: mapToken(response.data.token),
+    employee: mapEmployee(response.data.employee),
+    authenticatedAt: response.data.time
+  };
+}
+function mapToken(token) {
+  return {
+    accessToken: token.access_token,
+    refreshToken: token.refresh_token,
+    expiresIn: token.expires_in,
+    tokenType: normalizeTokenType(token.token_type),
+    scope: token.scope
+  };
+}
+function mapEmployee(employee) {
+  return {
+    id: employee.id,
+    name: employee.employee_name,
+    phone: employee.phone,
+    email: employee.email
+  };
+}
+function normalizeTokenType(value) {
+  return value.toLowerCase() === "bearer" ? "Bearer" : value;
+}
+function mapPasswordPolicy(value) {
+  return mapPolicy(value);
+}
+function mapOtpPolicy(value) {
+  return mapPolicy(value);
+}
+function mapPolicy(value) {
+  switch (value) {
+    case "Mandatory":
+      return "required";
+    case "Optional":
+      return "optional";
+    case "No":
+      return "disabled";
+  }
+}
+function parseConfirmedResponse(schema, value, operation) {
+  const result = schema.safeParse(value);
+  if (result.success) {
+    return result.data;
+  }
+  const unsupportedPolicy2 = result.error.issues.some(
+    (issue) => issue.code === "invalid_value" && (issue.path.at(-1) === "password_policy" || issue.path.at(-1) === "otp_policy")
+  );
+  if (unsupportedPolicy2) {
+    throw new AuthError(
+      "UNSUPPORTED_POLICY",
+      "Backend returned an unsupported authentication policy."
+    );
+  }
+  throw new AuthError(
+    "INVALID_RESPONSE",
+    `Backend returned a malformed ${operation} response.`
+  );
+}
+
+// src/backend/frappe/FrappeAuthBackend.ts
+var FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+var FrappeAuthBackend = class {
+  baseUrl;
+  defaultHeaders;
+  #masterTokens;
+  now;
+  timeoutMs;
+  #transport;
+  constructor(options) {
+    this.baseUrl = options.baseUrl;
+    this.#transport = options.transport;
+    this.timeoutMs = options.timeoutMs;
+    this.now = options.now ?? Date.now;
+    this.defaultHeaders = createMetadataHeaders(options);
+    this.#masterTokens = new MasterTokenManager({
+      fetchCredential: () => this.fetchMasterCredential(),
+      now: this.now
+    });
+  }
+  async getLoginPolicy(input) {
+    const query = encodeForm({ mobile: input.mobileNumber });
+    const response = await this.requestWithMasterAuth(
+      (accessToken) => ({
+        method: "GET",
+        url: `${this.endpoint(AUTH_ENDPOINTS.loginPolicy)}?${query}`,
+        headers: this.formHeaders(accessToken),
+        timeoutMs: this.timeoutMs
+      }),
+      false
+    );
+    ensureSuccess(response, "login-policy", false);
+    return mapLoginPolicy(response.body);
+  }
+  async sendOtp(input) {
+    const response = await this.requestWithMasterAuth(
+      (accessToken) => ({
+        method: "POST",
+        url: this.endpoint(AUTH_ENDPOINTS.sendOtp),
+        headers: this.formHeaders(accessToken),
+        body: encodeForm({ mobile_no: input.mobileNumber }),
+        timeoutMs: this.timeoutMs
+      }),
+      true
+    );
+    ensureSuccess(response, "send-OTP", true);
+    return mapSendOtpResult(response.body);
+  }
+  async signUp(input) {
+    const response = await this.requestTransport(
+      {
+        method: "POST",
+        url: this.endpoint(AUTH_ENDPOINTS.signUp),
+        headers: this.formHeaders(),
+        body: encodeForm({
+          mobile_no: input.mobileNumber,
+          otp: input.otp,
+          password: input.password
+        }),
+        timeoutMs: this.timeoutMs
+      },
+      true
+    );
+    ensureSuccess(response, "sign-up", true);
+    return mapSignUpResult(response.body);
+  }
+  async signIn(input) {
+    const response = await this.requestWithMasterAuth(
+      (accessToken) => ({
+        method: "POST",
+        url: this.endpoint(AUTH_ENDPOINTS.signIn),
+        headers: this.formHeaders(accessToken),
+        body: encodeForm({
+          mobile_no: input.mobileNumber,
+          otp: input.otp,
+          password: input.password
+        }),
+        timeoutMs: this.timeoutMs
+      }),
+      true
+    );
+    if (response.status >= 500) {
+      ensureSuccess(response, "sign-in", true);
+    }
+    const backendError = backendErrorResponseSchema.safeParse(response.body);
+    if (backendError.success) {
+      throw mapSignInError(backendError.data.message, response.status);
+    }
+    ensureSuccess(response, "sign-in", true);
+    return mapSignInResult(response.body);
+  }
+  endpoint(path) {
+    return joinUrl(this.baseUrl, path);
+  }
+  async fetchMasterCredential() {
+    const response = await this.requestTransport(
+      {
+        method: "GET",
+        url: this.endpoint(AUTH_ENDPOINTS.masterToken),
+        headers: this.defaultHeaders,
+        timeoutMs: this.timeoutMs
+      },
+      false
+    );
+    if (response.status < 200 || response.status >= 300) {
+      throw new AuthError(
+        "MASTER_TOKEN_FAILED",
+        "Unable to acquire the master authentication token.",
+        {
+          httpStatus: response.status,
+          retryable: response.status >= 500
+        }
+      );
+    }
+    try {
+      return mapMasterCredential(response.body, this.now());
+    } catch (error) {
+      if (isAuthError(error) && error.code === "INVALID_RESPONSE") {
+        throw new AuthError(
+          "MASTER_TOKEN_FAILED",
+          "Backend returned a malformed master-token response."
+        );
+      }
+      throw error;
+    }
+  }
+  formHeaders(accessToken) {
+    return accessToken === void 0 ? { ...this.defaultHeaders, "Content-Type": FORM_CONTENT_TYPE } : {
+      ...this.defaultHeaders,
+      "Content-Type": FORM_CONTENT_TYPE,
+      Authorization: `Bearer ${accessToken}`
+    };
+  }
+  async requestWithMasterAuth(buildRequest, replayUnsafe) {
+    const firstCredential = await this.#masterTokens.getCredential();
+    const firstResponse = await this.requestTransport(
+      buildRequest(firstCredential.accessToken),
+      replayUnsafe
+    );
+    if (!isMasterRejection(firstResponse)) {
+      return firstResponse;
+    }
+    this.#masterTokens.invalidate(firstCredential.accessToken);
+    const replacement = await this.#masterTokens.getCredential();
+    const retryResponse = await this.requestTransport(
+      buildRequest(replacement.accessToken),
+      replayUnsafe
+    );
+    if (isMasterRejection(retryResponse)) {
+      this.#masterTokens.invalidate(replacement.accessToken);
+      throw new AuthError(
+        "MASTER_TOKEN_REJECTED",
+        "The server rejected master authentication.",
+        { httpStatus: retryResponse.status }
+      );
+    }
+    return retryResponse;
+  }
+  async requestTransport(request, replayUnsafe) {
+    try {
+      return await this.#transport.request(request);
+    } catch (error) {
+      const timedOut = isAuthError(error) && error.code === "TIMEOUT";
+      throw new AuthError(
+        timedOut ? "TIMEOUT" : "NETWORK_ERROR",
+        timedOut ? "Authentication request timed out." : "Authentication request could not reach the server.",
+        { retryable: !replayUnsafe }
+      );
+    }
+  }
+};
+function createMetadataHeaders(options) {
+  const headers = {};
+  if (options.appId !== void 0) {
+    headers["X-ERPGulf-App-Id"] = options.appId;
+  }
+  if (options.appVersion !== void 0) {
+    headers["X-ERPGulf-App-Version"] = options.appVersion;
+  }
+  return headers;
+}
+function isMasterRejection(response) {
+  return response.status === 401 && !businessErrorMarkerSchema.safeParse(response.body).success && masterAuthenticationErrorSchema.safeParse(response.body).success;
+}
+function ensureSuccess(response, operation, replayUnsafe) {
+  if (response.status >= 200 && response.status < 300) {
+    return;
+  }
+  throw new AuthError("SERVER_ERROR", `The ${operation} request failed.`, {
+    httpStatus: response.status,
+    retryable: !replayUnsafe && response.status >= 500
+  });
+}
+function mapSignInError(message, httpStatus) {
+  if (message === "Invalid or expired OTP") {
+    return new AuthError(
+      "INVALID_OR_EXPIRED_OTP",
+      "The OTP is invalid or expired.",
+      { httpStatus }
+    );
+  }
+  if (message === "Invalid password") {
+    return new AuthError("INVALID_PASSWORD", "The password is invalid.", {
+      httpStatus
+    });
+  }
+  return new AuthError(
+    "AUTHENTICATION_FAILED",
+    "Authentication was not successful.",
+    { httpStatus }
+  );
+}
+
+// src/http/FetchTransport.ts
+var DEFAULT_TIMEOUT_MS = 1e4;
+var FetchTransport = class {
+  async request(request) {
+    const timeoutMs = request.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const response = await fetch(request.url, {
+        method: request.method,
+        signal: controller.signal,
+        redirect: "error",
+        cache: "no-store",
+        credentials: "omit",
+        ...request.headers === void 0 ? {} : { headers: request.headers },
+        ...request.body === void 0 ? {} : { body: request.body }
+      });
+      return {
+        status: response.status,
+        body: await parseResponseBody(response)
+      };
+    } catch {
+      if (controller.signal.aborted) {
+        throw new AuthError("TIMEOUT", "Authentication request timed out.", {
+          retryable: true
+        });
+      }
+      throw new AuthError(
+        "NETWORK_ERROR",
+        "Authentication request could not reach the server.",
+        { retryable: true }
+      );
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+};
+async function parseResponseBody(response) {
+  const text = await response.text();
+  if (text.length === 0) {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
+// src/flow/resolveAuthFlow.ts
+function resolveAuthFlow(policy) {
+  if (!policy.employeeHasSignedUp && policy.employeeHasExistingPassword) {
+    throw unsupportedPolicy(
+      "An employee who has not signed up cannot have an existing password."
+    );
+  }
+  if (policy.passwordPolicy === "disabled" && policy.otpPolicy === "disabled") {
+    throw unsupportedPolicy(
+      "Authentication policy disables both password and OTP credentials."
+    );
+  }
+  const action = policy.employeeHasSignedUp ? "SIGN_IN" : "SIGN_UP";
+  const atLeastOneOf = resolveAtLeastOneOf(policy);
+  return {
+    action,
+    nextStep: resolveNextStep(policy),
+    credentials: {
+      password: policy.passwordPolicy,
+      otp: policy.otpPolicy,
+      atLeastOneOf
+    },
+    policy
+  };
+}
+function resolveAtLeastOneOf(policy) {
+  if (policy.passwordPolicy === "required" || policy.otpPolicy === "required") {
+    return [];
+  }
+  const credentials = [];
+  if (policy.passwordPolicy === "optional") {
+    credentials.push("password");
+  }
+  if (policy.otpPolicy === "optional") {
+    credentials.push("otp");
+  }
+  return credentials;
+}
+function resolveNextStep(policy) {
+  if (policy.passwordPolicy === "required" && policy.otpPolicy === "required") {
+    return "ENTER_PASSWORD_AND_OTP";
+  }
+  if (policy.passwordPolicy === "required") {
+    return policy.employeeHasExistingPassword ? "ENTER_PASSWORD" : "CREATE_PASSWORD";
+  }
+  if (policy.otpPolicy === "required") {
+    return "ENTER_OTP";
+  }
+  if (policy.passwordPolicy === "optional" && policy.otpPolicy === "optional") {
+    return "CHOOSE_PASSWORD_OR_OTP";
+  }
+  return policy.passwordPolicy === "optional" ? policy.employeeHasExistingPassword ? "ENTER_PASSWORD" : "CREATE_PASSWORD" : "ENTER_OTP";
+}
+function unsupportedPolicy(message) {
+  return new AuthError("UNSUPPORTED_POLICY", message);
+}
+
+// src/client/AuthClient.ts
+var DefaultAuthClient = class {
+  #backend;
+  constructor(backend) {
+    this.#backend = backend;
+  }
+  async begin(input) {
+    const policy = await this.getLoginPolicy(input);
+    return resolveAuthFlow(policy);
+  }
+  async getLoginPolicy(input) {
+    return await this.#backend.getLoginPolicy({
+      mobileNumber: validateMobile(input.mobileNumber)
+    });
+  }
+  async sendOtp(input) {
+    return await this.#backend.sendOtp({
+      mobileNumber: validateMobile(input.mobileNumber)
+    });
+  }
+  async signUp(input) {
+    const otp = validateOptionalCredential(input.otp, "otp", "sign-up");
+    const password = validateOptionalCredential(
+      input.password,
+      "password",
+      "sign-up"
+    );
+    if (otp === void 0 && password === void 0) {
+      throw new AuthError(
+        "INVALID_SIGN_UP_INPUT",
+        "Sign-up requires an OTP, a password, or both according to policy."
+      );
+    }
+    return await this.#backend.signUp({
+      mobileNumber: validateMobile(input.mobileNumber),
+      ...otp === void 0 ? {} : { otp },
+      ...password === void 0 ? {} : { password }
+    });
+  }
+  async signIn(input) {
+    const otp = validateOptionalCredential(input.otp, "otp", "sign-in");
+    const password = validateOptionalCredential(
+      input.password,
+      "password",
+      "sign-in"
+    );
+    if (otp === void 0 && password === void 0) {
+      throw new AuthError(
+        "INVALID_SIGN_IN_INPUT",
+        "Sign-in requires an OTP, a password, or both."
+      );
+    }
+    return await this.#backend.signIn({
+      mobileNumber: validateMobile(input.mobileNumber),
+      ...otp === void 0 ? {} : { otp },
+      ...password === void 0 ? {} : { password }
+    });
+  }
+};
+function validateMobile(mobileNumber) {
+  const normalized = mobileNumber.trim();
+  if (normalized.length === 0) {
+    throw new AuthError("INVALID_MOBILE", "Mobile number must not be empty.");
+  }
+  return normalized;
+}
+function validateOptionalCredential(value, name, operation) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (value.length === 0) {
+    throw new AuthError(
+      operation === "sign-in" ? "INVALID_SIGN_IN_INPUT" : "INVALID_SIGN_UP_INPUT",
+      `${name === "otp" ? "OTP" : "Password"} must not be empty when provided.`
+    );
+  }
+  return value;
+}
+
+// src/client/createAuthClient.ts
+var DEFAULT_TIMEOUT_MS2 = 1e4;
+function createAuthClient(config) {
+  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  validateTimeout(timeoutMs);
+  validateMetadata(config.metadata?.appId, "appId");
+  validateMetadata(config.metadata?.appVersion, "appVersion");
+  const backend = new FrappeAuthBackend({
+    baseUrl: normalizeBaseUrl(
+      config.baseUrl,
+      config.allowInsecureHttp === void 0 ? {} : { allowInsecureHttp: config.allowInsecureHttp }
+    ),
+    transport: config.transport ?? new FetchTransport(),
+    timeoutMs,
+    ...config.metadata?.appId === void 0 ? {} : { appId: config.metadata.appId },
+    ...config.metadata?.appVersion === void 0 ? {} : { appVersion: config.metadata.appVersion }
+  });
+  return new DefaultAuthClient(backend);
+}
+function validateTimeout(timeoutMs) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new AuthError(
+      "INVALID_CLIENT_CONFIG",
+      "timeoutMs must be a positive finite number."
+    );
+  }
+}
+function validateMetadata(value, name) {
+  if (value !== void 0 && (value.length === 0 || /[\r\n]/u.test(value))) {
+    throw new AuthError(
+      "INVALID_CLIENT_CONFIG",
+      `${name} must be non-empty and must not contain line breaks.`
+    );
+  }
+}
+export {
+  AuthError,
+  createAuthClient,
+  isAuthError
+};
+//# sourceMappingURL=index.js.map