@finueva/auth 0.3.0 → 0.4.0

package/README.md

@@ -64,14 +64,37 @@ const acceptance = await auth.acceptInvitation({ invitationId });
 const credential = await auth.getDriveCredential({
   workspace: { type: "organization", organizationId: organizations[0].id },
 });
+const signOut = await auth.signOut();
+const responseHeaders = new Headers();
+signOut.applyCookies(responseHeaders);
 ```
 
-The server client is request-scoped and does not cache credentials. It forwards the incoming Auth cookie only to Auth and never sends it to Drive. Apply cookies returned by server invitation acceptance to the outgoing response with `acceptance.applyCookies(headers)`.
+The server client is request-scoped and does not cache credentials. It forwards only reserved Better Auth cookies to Auth and never sends them to Drive. Apply cookies returned by server invitation acceptance or sign-out to the outgoing response with `acceptance.applyCookies(headers)` or `signOut.applyCookies(headers)`.
+
+## Device
+
+```ts
+import { createDeviceAuth } from "@finueva/auth/device";
+
+const auth = createDeviceAuth({
+  authOrigin: "https://auth.finueva.com",
+  clientId: "finueva-cli",
+});
+const authorization = await auth.requestAuthorization();
+showCode(authorization.userCode, authorization.verificationUri);
+const token = await auth.pollForToken(authorization, { signal });
+const session = await auth.getSession();
+await auth.revokeCurrentDevice(); // or revokeAllSessions()
+```
+
+Polling starts at the server-provided interval, adds five seconds after each RFC 8628 `slow_down`, has no transport retry, and stops on denial, expiry, cancellation, the configured `maxPollingMs`, malformed/bounded responses, or transport timeout. The only requested scope is `openid`.
+
+The token is memory-only by default. Secure persistence is opt-in through a structural adapter implementing `read`, atomic `replace`, and `delete`; every operation receives an `AbortSignal` and must stop without committing when aborted. The caller owns encryption and platform credential storage. Adapter and authority failures are value-free and never include device codes or tokens. This export uses standard expiring/revocable Better Auth sessions and does not implement refresh tokens.
 
 ## Current Limits
 
 - Organization mutation and active-organization state are not exposed; callers select an organization returned by `listOrganizations()` explicitly.
-- Cross-root SSO is not part of `0.1.0`.
+- Cross-root SSO is not implemented.
 - The package does not persist Drive credentials or expose Better Auth or Unstorage internals.
 - Public errors are `AuthError` instances with stable, value-free codes.
 - Organization contexts with more than 50 current teams fail with `organization_context_too_large` and status `422`.

package/dist/device.d.ts

@@ -0,0 +1,51 @@
+import { o as AuthSession } from "./types-zEqO1_r2.js";
+//#region src/device.d.ts
+type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
+declare class DeviceAuthorizationError extends Error {
+  readonly code: DeviceAuthorizationErrorCode;
+  constructor(code: DeviceAuthorizationErrorCode);
+}
+interface DeviceToken {
+  accessToken: string;
+  tokenType: "Bearer";
+  expiresAt: Date;
+  scope: "openid";
+}
+interface DeviceTokenPersistence {
+  read(signal: AbortSignal): DeviceToken | null | Promise<DeviceToken | null>;
+  replace(token: DeviceToken, signal: AbortSignal): void | Promise<void>;
+  delete(signal: AbortSignal): void | Promise<void>;
+}
+interface DeviceAuthorization {
+  deviceCode: string;
+  userCode: string;
+  verificationUri: string;
+  verificationUriComplete: string;
+  expiresAt: Date;
+  intervalSeconds: number;
+}
+interface DeviceAuthOptions {
+  authOrigin: string;
+  clientId: string;
+  fetch?: typeof globalThis.fetch;
+  now?: () => number;
+  persistence?: DeviceTokenPersistence;
+  timeoutMs?: number;
+  maxPollingMs?: number;
+}
+interface PollDeviceOptions {
+  signal?: AbortSignal;
+}
+interface DeviceAuthClient {
+  requestAuthorization(options?: {
+    signal?: AbortSignal;
+  }): Promise<DeviceAuthorization>;
+  pollForToken(authorization: DeviceAuthorization, options?: PollDeviceOptions): Promise<DeviceToken>;
+  getSession(): Promise<AuthSession | null>;
+  getToken(): Promise<DeviceToken | null>;
+  revokeCurrentDevice(): Promise<void>;
+  revokeAllSessions(): Promise<void>;
+}
+declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
+//#endregion
+export { DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, PollDeviceOptions, createDeviceAuth };

package/dist/device.js

@@ -0,0 +1,936 @@
+//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
+const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
+const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
+const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+function jsonParseTransform(key, value) {
+	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+		warnKeyDropped(key);
+		return;
+	}
+	return value;
+}
+function warnKeyDropped(key) {
+	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
+}
+function destr(value, options = {}) {
+	if (typeof value !== "string") return value;
+	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
+	const _value = value.trim();
+	if (_value.length <= 9) switch (_value.toLowerCase()) {
+		case "true": return true;
+		case "false": return false;
+		case "undefined": return;
+		case "null": return null;
+		case "nan": return NaN;
+		case "infinity": return Number.POSITIVE_INFINITY;
+		case "-infinity": return Number.NEGATIVE_INFINITY;
+	}
+	if (!JsonSigRx.test(value)) {
+		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
+		return value;
+	}
+	try {
+		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
+			if (options.strict) throw new Error("[destr] Possible prototype pollution");
+			return JSON.parse(value, jsonParseTransform);
+		}
+		return JSON.parse(value);
+	} catch (error) {
+		if (options.strict) throw error;
+		return value;
+	}
+}
+String.fromCharCode;
+const HASH_RE = /#/g;
+const AMPERSAND_RE = /&/g;
+const SLASH_RE = /\//g;
+const EQUAL_RE = /=/g;
+const PLUS_RE = /\+/g;
+const ENC_CARET_RE = /%5e/gi;
+const ENC_BACKTICK_RE = /%60/gi;
+const ENC_PIPE_RE = /%7c/gi;
+const ENC_SPACE_RE = /%20/gi;
+function encode(text) {
+	return encodeURI("" + text).replace(ENC_PIPE_RE, "|");
+}
+function encodeQueryValue(input) {
+	return encode(typeof input === "string" ? input : JSON.stringify(input)).replace(PLUS_RE, "%2B").replace(ENC_SPACE_RE, "+").replace(HASH_RE, "%23").replace(AMPERSAND_RE, "%26").replace(ENC_BACKTICK_RE, "`").replace(ENC_CARET_RE, "^").replace(SLASH_RE, "%2F");
+}
+function encodeQueryKey(text) {
+	return encodeQueryValue(text).replace(EQUAL_RE, "%3D");
+}
+function decode(text = "") {
+	try {
+		return decodeURIComponent("" + text);
+	} catch {
+		return "" + text;
+	}
+}
+function decodeQueryKey(text) {
+	return decode(text.replace(PLUS_RE, " "));
+}
+function decodeQueryValue(text) {
+	return decode(text.replace(PLUS_RE, " "));
+}
+function parseQuery(parametersString = "") {
+	const object = Object.create(null);
+	if (parametersString[0] === "?") parametersString = parametersString.slice(1);
+	for (const parameter of parametersString.split("&")) {
+		const s = parameter.match(/([^=]+)=?(.*)/) || [];
+		if (s.length < 2) continue;
+		const key = decodeQueryKey(s[1]);
+		if (key === "__proto__" || key === "constructor") continue;
+		const value = decodeQueryValue(s[2] || "");
+		if (object[key] === void 0) object[key] = value;
+		else if (Array.isArray(object[key])) object[key].push(value);
+		else object[key] = [object[key], value];
+	}
+	return object;
+}
+function encodeQueryItem(key, value) {
+	if (typeof value === "number" || typeof value === "boolean") value = String(value);
+	if (!value) return encodeQueryKey(key);
+	if (Array.isArray(value)) return value.map((_value) => `${encodeQueryKey(key)}=${encodeQueryValue(_value)}`).join("&");
+	return `${encodeQueryKey(key)}=${encodeQueryValue(value)}`;
+}
+function stringifyQuery(query) {
+	return Object.keys(query).filter((k) => query[k] !== void 0).map((k) => encodeQueryItem(k, query[k])).filter(Boolean).join("&");
+}
+const PROTOCOL_STRICT_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{1,2})/;
+const PROTOCOL_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{2})?/;
+const PROTOCOL_RELATIVE_REGEX = /^([/\\]\s*){2,}[^/\\]/;
+const TRAILING_SLASH_RE = /\/$|\/\?|\/#/;
+const JOIN_LEADING_SLASH_RE = /^\.?\//;
+function hasProtocol(inputString, opts = {}) {
+	if (typeof opts === "boolean") opts = { acceptRelative: opts };
+	if (opts.strict) return PROTOCOL_STRICT_REGEX.test(inputString);
+	return PROTOCOL_REGEX.test(inputString) || (opts.acceptRelative ? PROTOCOL_RELATIVE_REGEX.test(inputString) : false);
+}
+function hasTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return input.endsWith("/");
+	return TRAILING_SLASH_RE.test(input);
+}
+function withoutTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return (hasTrailingSlash(input) ? input.slice(0, -1) : input) || "/";
+	if (!hasTrailingSlash(input, true)) return input || "/";
+	let path = input;
+	let fragment = "";
+	const fragmentIndex = input.indexOf("#");
+	if (fragmentIndex !== -1) {
+		path = input.slice(0, fragmentIndex);
+		fragment = input.slice(fragmentIndex);
+	}
+	const [s0, ...s] = path.split("?");
+	return ((s0.endsWith("/") ? s0.slice(0, -1) : s0) || "/") + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
+}
+function withTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return input.endsWith("/") ? input : input + "/";
+	if (hasTrailingSlash(input, true)) return input || "/";
+	let path = input;
+	let fragment = "";
+	const fragmentIndex = input.indexOf("#");
+	if (fragmentIndex !== -1) {
+		path = input.slice(0, fragmentIndex);
+		fragment = input.slice(fragmentIndex);
+		if (!path) return fragment;
+	}
+	const [s0, ...s] = path.split("?");
+	return s0 + "/" + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
+}
+function withBase(input, base) {
+	if (isEmptyURL(base) || hasProtocol(input)) return input;
+	const _base = withoutTrailingSlash(base);
+	if (input.startsWith(_base)) {
+		const nextChar = input[_base.length];
+		if (!nextChar || nextChar === "/" || nextChar === "?") return input;
+	}
+	return joinURL(_base, input);
+}
+function withQuery(input, query) {
+	const parsed = parseURL(input);
+	parsed.search = stringifyQuery({
+		...parseQuery(parsed.search),
+		...query
+	});
+	return stringifyParsedURL(parsed);
+}
+function isEmptyURL(url) {
+	return !url || url === "/";
+}
+function isNonEmptyURL(url) {
+	return url && url !== "/";
+}
+function joinURL(base, ...input) {
+	let url = base || "";
+	for (const segment of input.filter((url2) => isNonEmptyURL(url2))) if (url) {
+		const _segment = segment.replace(JOIN_LEADING_SLASH_RE, "");
+		url = withTrailingSlash(url) + _segment;
+	} else url = segment;
+	return url;
+}
+const protocolRelative = Symbol.for("ufo:protocolRelative");
+function parseURL(input = "", defaultProto) {
+	const _specialProtoMatch = input.match(/^[\s\0]*(blob:|data:|javascript:|vbscript:)(.*)/i);
+	if (_specialProtoMatch) {
+		const [, _proto, _pathname = ""] = _specialProtoMatch;
+		return {
+			protocol: _proto.toLowerCase(),
+			pathname: _pathname,
+			href: _proto + _pathname,
+			auth: "",
+			host: "",
+			search: "",
+			hash: ""
+		};
+	}
+	if (!hasProtocol(input, { acceptRelative: true })) return defaultProto ? parseURL(defaultProto + input) : parsePath(input);
+	const [, protocol = "", auth, hostAndPath = ""] = input.replace(/\\/g, "/").match(/^[\s\0]*([\w+.-]{2,}:)?\/\/([^/@]+@)?(.*)/) || [];
+	let [, host = "", path = ""] = hostAndPath.match(/([^#/?]*)(.*)?/) || [];
+	if (protocol === "file:") path = path.replace(/\/(?=[A-Za-z]:)/, "");
+	const { pathname, search, hash } = parsePath(path);
+	return {
+		protocol: protocol.toLowerCase(),
+		auth: auth ? auth.slice(0, Math.max(0, auth.length - 1)) : "",
+		host,
+		pathname,
+		search,
+		hash,
+		[protocolRelative]: !protocol
+	};
+}
+function parsePath(input = "") {
+	const [pathname = "", search = "", hash = ""] = (input.match(/([^#?]*)(\?[^#]*)?(#.*)?/) || []).splice(1);
+	return {
+		pathname,
+		search,
+		hash
+	};
+}
+function stringifyParsedURL(parsed) {
+	const pathname = parsed.pathname || "";
+	const search = parsed.search ? (parsed.search.startsWith("?") ? "" : "?") + parsed.search : "";
+	const hash = parsed.hash || "";
+	const auth = parsed.auth ? parsed.auth + "@" : "";
+	const host = parsed.host || "";
+	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
+var FetchError = class extends Error {
+	constructor(message, opts) {
+		super(message, opts);
+		this.name = "FetchError";
+		if (opts?.cause && !this.cause) this.cause = opts.cause;
+	}
+};
+function createFetchError(ctx) {
+	const errorMessage = ctx.error?.message || ctx.error?.toString() || "";
+	const method = ctx.request?.method || ctx.options?.method || "GET";
+	const url = ctx.request?.url || String(ctx.request) || "/";
+	const fetchError = new FetchError(`${`[${method}] ${JSON.stringify(url)}`}: ${ctx.response ? `${ctx.response.status} ${ctx.response.statusText}` : "<no response>"}${errorMessage ? ` ${errorMessage}` : ""}`, ctx.error ? { cause: ctx.error } : void 0);
+	for (const key of [
+		"request",
+		"options",
+		"response"
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx[key];
+	} });
+	for (const [key, refKey] of [
+		["data", "_data"],
+		["status", "status"],
+		["statusCode", "status"],
+		["statusText", "statusText"],
+		["statusMessage", "statusText"]
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx.response && ctx.response[refKey];
+	} });
+	return fetchError;
+}
+const payloadMethods = new Set(Object.freeze([
+	"PATCH",
+	"POST",
+	"PUT",
+	"DELETE"
+]));
+function isPayloadMethod(method = "GET") {
+	return payloadMethods.has(method.toUpperCase());
+}
+function isJSONSerializable(value) {
+	if (value === void 0) return false;
+	const t = typeof value;
+	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
+	if (t !== "object") return false;
+	if (Array.isArray(value)) return true;
+	if (value.buffer) return false;
+	if (value instanceof FormData || value instanceof URLSearchParams) return false;
+	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
+}
+const textTypes = new Set([
+	"image/svg",
+	"application/xml",
+	"application/xhtml",
+	"application/html"
+]);
+const JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
+function detectResponseType(_contentType = "") {
+	if (!_contentType) return "json";
+	const contentType = _contentType.split(";").shift() || "";
+	if (JSON_RE.test(contentType)) return "json";
+	if (contentType === "text/event-stream") return "stream";
+	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
+	return "blob";
+}
+function resolveFetchOptions(request, input, defaults, Headers) {
+	const headers = mergeHeaders(input?.headers ?? request?.headers, defaults?.headers, Headers);
+	let query;
+	if (defaults?.query || defaults?.params || input?.params || input?.query) query = {
+		...defaults?.params,
+		...defaults?.query,
+		...input?.params,
+		...input?.query
+	};
+	return {
+		...defaults,
+		...input,
+		query,
+		params: query,
+		headers
+	};
+}
+function mergeHeaders(input, defaults, Headers) {
+	if (!defaults) return new Headers(input);
+	const headers = new Headers(defaults);
+	if (input) for (const [key, value] of Symbol.iterator in input || Array.isArray(input) ? input : new Headers(input)) headers.set(key, value);
+	return headers;
+}
+async function callHooks(context, hooks) {
+	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
+	else await hooks(context);
+}
+const retryStatusCodes = new Set([
+	408,
+	409,
+	425,
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+const nullBodyResponses = new Set([
+	101,
+	204,
+	205,
+	304
+]);
+function createFetch(globalOptions = {}) {
+	const { fetch = globalThis.fetch, Headers = globalThis.Headers, AbortController = globalThis.AbortController } = globalOptions;
+	async function onError(context) {
+		const isAbort = context.error && context.error.name === "AbortError" && !context.options.timeout || false;
+		if (context.options.retry !== false && !isAbort) {
+			let retries;
+			if (typeof context.options.retry === "number") retries = context.options.retry;
+			else retries = isPayloadMethod(context.options.method) ? 0 : 1;
+			const responseCode = context.response && context.response.status || 500;
+			if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
+				const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
+				if (retryDelay > 0) await new Promise((resolve) => setTimeout(resolve, retryDelay));
+				return $fetchRaw(context.request, {
+					...context.options,
+					retry: retries - 1
+				});
+			}
+		}
+		const error = createFetchError(context);
+		if (Error.captureStackTrace) Error.captureStackTrace(error, $fetchRaw);
+		throw error;
+	}
+	const $fetchRaw = async function $fetchRaw2(_request, _options = {}) {
+		const context = {
+			request: _request,
+			options: resolveFetchOptions(_request, _options, globalOptions.defaults, Headers),
+			response: void 0,
+			error: void 0
+		};
+		if (context.options.method) context.options.method = context.options.method.toUpperCase();
+		if (context.options.onRequest) {
+			await callHooks(context, context.options.onRequest);
+			if (!(context.options.headers instanceof Headers)) context.options.headers = new Headers(context.options.headers || {});
+		}
+		if (typeof context.request === "string") {
+			if (context.options.baseURL) context.request = withBase(context.request, context.options.baseURL);
+			if (context.options.query) {
+				context.request = withQuery(context.request, context.options.query);
+				delete context.options.query;
+			}
+			if ("query" in context.options) delete context.options.query;
+			if ("params" in context.options) delete context.options.params;
+		}
+		if (context.options.body && isPayloadMethod(context.options.method)) {
+			if (isJSONSerializable(context.options.body)) {
+				const contentType = context.options.headers.get("content-type");
+				if (typeof context.options.body !== "string") context.options.body = contentType === "application/x-www-form-urlencoded" ? new URLSearchParams(context.options.body).toString() : JSON.stringify(context.options.body);
+				if (!contentType) context.options.headers.set("content-type", "application/json");
+				if (!context.options.headers.has("accept")) context.options.headers.set("accept", "application/json");
+			} else if ("pipeTo" in context.options.body && typeof context.options.body.pipeTo === "function" || typeof context.options.body.pipe === "function") {
+				if (!("duplex" in context.options)) context.options.duplex = "half";
+			}
+		}
+		let abortTimeout;
+		if (!context.options.signal && context.options.timeout) {
+			const controller = new AbortController();
+			abortTimeout = setTimeout(() => {
+				const error = new Error("[TimeoutError]: The operation was aborted due to timeout");
+				error.name = "TimeoutError";
+				error.code = 23;
+				controller.abort(error);
+			}, context.options.timeout);
+			context.options.signal = controller.signal;
+		}
+		try {
+			context.response = await fetch(context.request, context.options);
+		} catch (error) {
+			context.error = error;
+			if (context.options.onRequestError) await callHooks(context, context.options.onRequestError);
+			return await onError(context);
+		} finally {
+			if (abortTimeout) clearTimeout(abortTimeout);
+		}
+		if ((context.response.body || context.response._bodyInit) && !nullBodyResponses.has(context.response.status) && context.options.method !== "HEAD") {
+			const responseType = (context.options.parseResponse ? "json" : context.options.responseType) || detectResponseType(context.response.headers.get("content-type") || "");
+			switch (responseType) {
+				case "json": {
+					const data = await context.response.text();
+					const parseFunction = context.options.parseResponse || destr;
+					context.response._data = parseFunction(data);
+					break;
+				}
+				case "stream":
+					context.response._data = context.response.body || context.response._bodyInit;
+					break;
+				default: context.response._data = await context.response[responseType]();
+			}
+		}
+		if (context.options.onResponse) await callHooks(context, context.options.onResponse);
+		if (!context.options.ignoreResponseError && context.response.status >= 400 && context.response.status < 600) {
+			if (context.options.onResponseError) await callHooks(context, context.options.onResponseError);
+			return await onError(context);
+		}
+		return context.response;
+	};
+	const $fetch = async function $fetch2(request, options) {
+		return (await $fetchRaw(request, options))._data;
+	};
+	$fetch.raw = $fetchRaw;
+	$fetch.native = (...args) => fetch(...args);
+	$fetch.create = (defaultOptions = {}, customGlobalOptions = {}) => createFetch({
+		...globalOptions,
+		...customGlobalOptions,
+		defaults: {
+			...globalOptions.defaults,
+			...customGlobalOptions.defaults,
+			...defaultOptions
+		}
+	});
+	return $fetch;
+}
+//#endregion
+//#region src/errors.ts
+const messages = {
+	invalid_credentials: "The credentials are invalid.",
+	authentication_required: "Authentication is required.",
+	request_origin_denied: "The request origin is not allowed.",
+	invalid_invitation: "The invitation is invalid.",
+	invitation_unavailable: "The invitation is not available.",
+	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	email_verification_required: "Email verification is required.",
+	invalid_workspace_selection: "The workspace selection is invalid.",
+	organization_context_too_large: "The organization context is too large.",
+	credential_rate_limited: "Credential requests are temporarily limited.",
+	state_conflict: "The authentication state conflicts with the request.",
+	access_denied: "Access is denied.",
+	identity_authority_unavailable: "Authentication is temporarily unavailable."
+};
+var AuthError = class extends Error {
+	code;
+	status;
+	retryAfterSeconds;
+	constructor(code, status, retryAfterSeconds) {
+		super(messages[code]);
+		this.name = "AuthError";
+		this.code = code;
+		this.status = status;
+		this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
+//#endregion
+//#region src/shared.ts
+const id = /^[A-Za-z0-9_-]{1,128}$/;
+const email = /^[^\s@]+@[^\s@]+$/;
+function normalizeOrigin(value, name) {
+	if (value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	}
+	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
+	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== value) throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	return url.origin;
+}
+function normalizeTimeout(value) {
+	const timeout = value ?? 1e4;
+	if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 6e4) throw new TypeError("timeoutMs must be an integer from 1 to 60000");
+	return timeout;
+}
+function normalizeSession(value) {
+	if (value === null) return null;
+	if (!isObject(value) || !isObject(value.session) || !isObject(value.user)) throw authorityUnavailable();
+	const expiresAt = toDate(value.session.expiresAt);
+	const image = value.user.image;
+	if (!isId(value.session.id) || !expiresAt || !isId(value.user.id) || typeof value.user.name !== "string" || value.user.name.length > 256 || typeof value.user.email !== "string" || value.user.email.length > 320 || !email.test(value.user.email) || typeof value.user.emailVerified !== "boolean" || image !== null && image !== void 0 && (typeof image !== "string" || image.length > 2048)) throw authorityUnavailable();
+	return {
+		id: value.session.id,
+		expiresAt,
+		user: {
+			id: value.user.id,
+			name: value.user.name,
+			email: value.user.email,
+			emailVerified: value.user.emailVerified,
+			image: image ?? null
+		}
+	};
+}
+function fromAuthorityError(value, fallbackStatus, retryAfter) {
+	const mapped = mapError(isObject(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
+	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
+}
+function authorityUnavailable() {
+	return new AuthError("identity_authority_unavailable", 503);
+}
+function mapError(code, status) {
+	if (code === "authentication_required") return {
+		code,
+		status: 401
+	};
+	if (code === "request_origin_denied") return {
+		code,
+		status: 403
+	};
+	if (code === "invalid_workspace_selection") return {
+		code,
+		status: 422
+	};
+	if (code === "organization_context_too_large") return {
+		code,
+		status: 422
+	};
+	if (code === "credential_rate_limited") return {
+		code,
+		status: 429
+	};
+	if (code === "identity_authority_unavailable") return {
+		code,
+		status: 503
+	};
+	if (status === 401 || status === 400) return {
+		code: "invalid_credentials",
+		status: 401
+	};
+	if (status === 403) return {
+		code: "access_denied",
+		status: 403
+	};
+	if (status === 409) return {
+		code: "state_conflict",
+		status: 409
+	};
+	if (status === 422) return {
+		code: "invalid_workspace_selection",
+		status: 422
+	};
+	if (status === 429) return {
+		code: "credential_rate_limited",
+		status: 429
+	};
+	return {
+		code: "identity_authority_unavailable",
+		status: 503
+	};
+}
+function parseRetryAfter(value) {
+	if (!value || !/^\d+$/.test(value)) return void 0;
+	const seconds = Number(value);
+	return Number.isSafeInteger(seconds) && seconds >= 1 && seconds <= 3600 ? seconds : void 0;
+}
+function toDate(value) {
+	const result = value instanceof Date ? value : typeof value === "string" ? new Date(value) : void 0;
+	return result && Number.isFinite(result.getTime()) ? result : void 0;
+}
+function isId(value) {
+	return typeof value === "string" && id.test(value);
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/http.ts
+const MAX_RESPONSE_BYTES = 64 * 1024;
+async function requestJsonResponse(url, options) {
+	let response;
+	try {
+		response = await createFetch({ fetch: options.fetch }).raw(url, {
+			method: options.method,
+			headers: options.headers,
+			body: options.body,
+			credentials: "include",
+			retry: 0,
+			timeout: options.timeoutMs,
+			redirect: "manual",
+			signal: options.signal,
+			responseType: "stream",
+			ignoreResponseError: true
+		});
+	} catch {
+		throw authorityUnavailable();
+	}
+	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
+		const body = contentType === "application/json" ? await readJson(response) : void 0;
+		await response.body?.cancel();
+		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
+	}
+	return {
+		value: await readJson(response),
+		headers: response.headers
+	};
+}
+async function readJson(response) {
+	const length = response.headers.get("content-length");
+	if (length && (!/^\d+$/.test(length) || Number(length) > MAX_RESPONSE_BYTES)) {
+		await response.body?.cancel();
+		throw authorityUnavailable();
+	}
+	if (!response.body) throw authorityUnavailable();
+	const reader = response.body.getReader();
+	const chunks = [];
+	let size = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > MAX_RESPONSE_BYTES) throw authorityUnavailable();
+			chunks.push(value);
+		}
+	} catch (error) {
+		await reader.cancel();
+		throw error;
+	} finally {
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	try {
+		return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+	} catch {
+		throw authorityUnavailable();
+	}
+}
+//#endregion
+//#region src/device.ts
+const DEVICE_SCOPE = "openid";
+const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const MAX_TOKEN_BYTES = 16 * 1024;
+const MAX_POLLING_MS = 900 * 1e3;
+const errorMessages = {
+	device_access_denied: "Device authorization was denied.",
+	device_authorization_cancelled: "Device authorization was cancelled.",
+	device_code_expired: "Device authorization expired.",
+	invalid_device_authorization: "Device authorization is invalid.",
+	identity_authority_unavailable: "Authentication is temporarily unavailable."
+};
+var DeviceAuthorizationError = class extends Error {
+	code;
+	constructor(code) {
+		super(errorMessages[code]);
+		this.name = "DeviceAuthorizationError";
+		this.code = code;
+	}
+};
+function createDeviceAuth(options) {
+	if (!options || typeof options !== "object") throw new TypeError("device options are required");
+	const authOrigin = normalizeOrigin(options.authOrigin, "authOrigin");
+	if (!/^[A-Za-z0-9._~-]{1,64}$/.test(options.clientId)) throw new TypeError("clientId is invalid");
+	if (options.persistence && !validPersistence(options.persistence)) throw new TypeError("persistence must implement read, replace, and delete");
+	const requestFetch = options.fetch ?? globalThis.fetch;
+	if (typeof requestFetch !== "function") throw new TypeError("fetch is required");
+	const now = options.now ?? Date.now;
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	const maxPollingMs = options.maxPollingMs ?? 600 * 1e3;
+	if (!Number.isSafeInteger(maxPollingMs) || maxPollingMs < 1 || maxPollingMs > MAX_POLLING_MS) throw new TypeError("maxPollingMs must be an integer from 1 to 900000");
+	let token = null;
+	let hydrated = false;
+	let hydration = null;
+	async function getToken() {
+		if (!hydrated) {
+			hydration ??= hydrate().finally(() => {
+				hydration = null;
+			});
+			await hydration;
+		}
+		if (token && token.expiresAt.getTime() <= now()) {
+			token = null;
+			await removePersisted();
+		}
+		return token ? copyToken(token) : null;
+	}
+	async function hydrate() {
+		try {
+			const loaded = options.persistence ? normalizeToken(await persistenceCall((signal) => options.persistence.read(signal)), now()) : null;
+			if (options.persistence && !loaded) await persistenceCall((signal) => options.persistence.delete(signal));
+			token = loaded;
+		} catch {
+			token = null;
+			throw unavailable();
+		} finally {
+			hydrated = true;
+		}
+	}
+	async function requestAuthorization(requestOptions = {}) {
+		if (requestOptions.signal?.aborted) throw cancelled();
+		try {
+			return normalizeAuthorization((await requestJsonResponse(`${authOrigin}/api/v1/auth/device/code`, {
+				fetch: requestFetch,
+				timeoutMs,
+				method: "POST",
+				body: {
+					client_id: options.clientId,
+					scope: DEVICE_SCOPE
+				},
+				signal: requestOptions.signal,
+				mapError: () => invalid()
+			})).value, now());
+		} catch (error) {
+			if (requestOptions.signal?.aborted) throw cancelled();
+			if (error instanceof DeviceAuthorizationError) throw error;
+			throw unavailable();
+		}
+	}
+	async function pollForToken(authorization, pollOptions = {}) {
+		if (pollOptions.signal?.aborted) throw cancelled();
+		const normalized = normalizeAuthorizationInput(authorization, now());
+		const startedAt = now();
+		const deadline = Math.min(normalized.expiresAt.getTime(), startedAt + maxPollingMs);
+		let intervalMs = normalized.intervalSeconds * 1e3;
+		while (true) {
+			await wait(intervalMs, pollOptions.signal, deadline, now);
+			const requestBudget = deadline - now();
+			if (requestBudget <= 0) throw expired();
+			let response;
+			try {
+				response = await requestJsonResponse(`${authOrigin}/api/v1/auth/device/token`, {
+					fetch: requestFetch,
+					timeoutMs: Math.min(timeoutMs, requestBudget),
+					method: "POST",
+					body: {
+						grant_type: GRANT_TYPE,
+						device_code: normalized.deviceCode,
+						client_id: options.clientId
+					},
+					signal: pollOptions.signal,
+					mapError(value) {
+						return new DeviceProtocolError(isObject(value) && typeof value.error === "string" ? value.error : void 0);
+					}
+				});
+			} catch (error) {
+				if (pollOptions.signal?.aborted) throw cancelled();
+				if (now() >= deadline) throw expired();
+				if (error instanceof DeviceProtocolError) {
+					if (error.protocolCode === "authorization_pending") continue;
+					if (error.protocolCode === "slow_down") {
+						intervalMs += 5e3;
+						continue;
+					}
+					if (error.protocolCode === "access_denied") throw new DeviceAuthorizationError("device_access_denied");
+					if (error.protocolCode === "expired_token") throw expired();
+					if (error.protocolCode === "invalid_grant" || error.protocolCode === "invalid_request") throw invalid();
+				}
+				throw unavailable();
+			}
+			if (now() >= deadline) throw expired();
+			const next = normalizeTokenResponse(response.value, now());
+			if (options.persistence) try {
+				await persistenceCall((signal) => options.persistence.replace(copyToken(next), signal));
+			} catch {
+				token = null;
+				hydrated = true;
+				await persistenceCall((signal) => options.persistence.delete(signal)).catch(() => void 0);
+				throw unavailable();
+			}
+			token = next;
+			hydrated = true;
+			return copyToken(next);
+		}
+	}
+	async function authenticated(path, body) {
+		const current = await getToken();
+		if (!current) return null;
+		try {
+			return await requestJsonResponse(`${authOrigin}/api/v1/auth/${path}`, {
+				fetch: requestFetch,
+				timeoutMs,
+				method: body ? "POST" : "GET",
+				headers: { authorization: `Bearer ${current.accessToken}` },
+				body
+			});
+		} catch {
+			throw unavailable();
+		}
+	}
+	async function revoke(path) {
+		const current = await getToken();
+		if (!current) return;
+		try {
+			await requestJsonResponse(`${authOrigin}/api/v1/auth/${path}`, {
+				fetch: requestFetch,
+				timeoutMs,
+				method: "POST",
+				headers: { authorization: `Bearer ${current.accessToken}` },
+				body: path === "revoke-session" ? { token: current.accessToken } : void 0
+			});
+		} catch {
+			throw unavailable();
+		}
+		token = null;
+		await removePersisted();
+	}
+	async function removePersisted() {
+		if (!options.persistence) return;
+		try {
+			await persistenceCall((signal) => options.persistence.delete(signal));
+		} catch {
+			throw unavailable();
+		}
+	}
+	return {
+		requestAuthorization,
+		pollForToken,
+		getToken,
+		async getSession() {
+			const response = await authenticated("get-session");
+			return response ? normalizeSession(response.value) : null;
+		},
+		revokeCurrentDevice: () => revoke("revoke-session"),
+		revokeAllSessions: () => revoke("revoke-sessions")
+	};
+	async function persistenceCall(operation) {
+		const controller = new AbortController();
+		let timer;
+		try {
+			return await Promise.race([Promise.resolve().then(() => operation(controller.signal)), new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					controller.abort();
+					reject(unavailable());
+				}, Math.min(timeoutMs, 1e3));
+			})]);
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+	}
+}
+var DeviceProtocolError = class extends Error {
+	protocolCode;
+	constructor(protocolCode) {
+		super("Device authorization request failed");
+		this.protocolCode = protocolCode;
+	}
+};
+function normalizeAuthorization(value, currentTime) {
+	if (!isObject(value) || !boundedSecret(value.device_code) || typeof value.user_code !== "string" || !/^[A-Z0-9-]{1,32}$/.test(value.user_code) || !exactHttpsOrLocalUri(value.verification_uri) || !exactHttpsOrLocalUri(value.verification_uri_complete) || !Number.isSafeInteger(value.expires_in) || value.expires_in < 1 || value.expires_in > 900 || !Number.isSafeInteger(value.interval) || value.interval < 1 || value.interval > 60) throw unavailable();
+	return {
+		deviceCode: value.device_code,
+		userCode: value.user_code,
+		verificationUri: value.verification_uri,
+		verificationUriComplete: value.verification_uri_complete,
+		expiresAt: new Date(currentTime + value.expires_in * 1e3),
+		intervalSeconds: value.interval
+	};
+}
+function normalizeAuthorizationInput(value, currentTime) {
+	if (!value || !boundedSecret(value.deviceCode) || typeof value.userCode !== "string" || !exactHttpsOrLocalUri(value.verificationUri) || !exactHttpsOrLocalUri(value.verificationUriComplete) || !(value.expiresAt instanceof Date) || !Number.isFinite(value.expiresAt.getTime()) || value.expiresAt.getTime() <= currentTime || !Number.isSafeInteger(value.intervalSeconds) || value.intervalSeconds < 1 || value.intervalSeconds > 60) throw invalid();
+	return value;
+}
+function normalizeTokenResponse(value, currentTime) {
+	if (!isObject(value) || !boundedSecret(value.access_token) || value.token_type !== "Bearer" || value.scope !== DEVICE_SCOPE || !Number.isSafeInteger(value.expires_in) || value.expires_in < 1 || value.expires_in > 744 * 60 * 60) throw unavailable();
+	return {
+		accessToken: value.access_token,
+		tokenType: "Bearer",
+		expiresAt: new Date(currentTime + value.expires_in * 1e3),
+		scope: DEVICE_SCOPE
+	};
+}
+function normalizeToken(value, currentTime) {
+	if (value === null) return null;
+	if (!value || !boundedSecret(value.accessToken) || value.tokenType !== "Bearer" || value.scope !== DEVICE_SCOPE || !(value.expiresAt instanceof Date) || !Number.isFinite(value.expiresAt.getTime())) throw unavailable();
+	return value.expiresAt.getTime() > currentTime ? copyToken(value) : null;
+}
+function copyToken(value) {
+	return {
+		...value,
+		expiresAt: new Date(value.expiresAt)
+	};
+}
+function boundedSecret(value) {
+	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= MAX_TOKEN_BYTES;
+}
+function exactHttpsOrLocalUri(value) {
+	if (typeof value !== "string" || value.length > 2048 || /[^\x20-\x7e]/.test(value)) return false;
+	try {
+		const url = new URL(value);
+		const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
+		return !url.username && !url.password && (url.protocol === "https:" || local && url.protocol === "http:");
+	} catch {
+		return false;
+	}
+}
+function validPersistence(value) {
+	return typeof value.read === "function" && typeof value.replace === "function" && typeof value.delete === "function";
+}
+async function wait(milliseconds, signal, deadline, now) {
+	if (signal?.aborted) throw cancelled();
+	const remaining = deadline - now();
+	if (remaining <= 0 || milliseconds > remaining) throw expired();
+	await new Promise((resolve, reject) => {
+		const timeout = setTimeout(done, milliseconds);
+		function done() {
+			signal?.removeEventListener("abort", abort);
+			resolve();
+		}
+		function abort() {
+			clearTimeout(timeout);
+			signal?.removeEventListener("abort", abort);
+			reject(cancelled());
+		}
+		signal?.addEventListener("abort", abort, { once: true });
+	});
+}
+function invalid() {
+	return new DeviceAuthorizationError("invalid_device_authorization");
+}
+function expired() {
+	return new DeviceAuthorizationError("device_code_expired");
+}
+function cancelled() {
+	return new DeviceAuthorizationError("device_authorization_cancelled");
+}
+function unavailable() {
+	return new DeviceAuthorizationError("identity_authority_unavailable");
+}
+//#endregion
+export { DeviceAuthorizationError, createDeviceAuth };

package/dist/errors-Crd93Rah.d.ts

@@ -0,0 +1,11 @@
+//#region src/errors.d.ts
+type AuthErrorCode = "invalid_credentials" | "authentication_required" | "request_origin_denied" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "state_conflict" | "access_denied" | "identity_authority_unavailable";
+type AuthErrorStatus = 401 | 403 | 409 | 422 | 429 | 503;
+declare class AuthError extends Error {
+  readonly code: AuthErrorCode;
+  readonly status: AuthErrorStatus;
+  readonly retryAfterSeconds?: number;
+  constructor(code: AuthErrorCode, status: AuthErrorStatus, retryAfterSeconds?: number);
+}
+//#endregion
+export { AuthErrorCode as n, AuthErrorStatus as r, AuthError as t };

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-import { _ as PersonalWorkspaceSelection, a as AuthClientOptions, c as AuthPersistenceDriver, d as AuthUser, f as DriveCredential, g as OrganizationWorkspaceSelection, h as InvitationAcceptance, i as AcceptInvitationInput, l as AuthSession, m as FinuevaAuthClient, n as AuthErrorCode, o as AuthOrganization, p as DriveCredentialInput, r as AuthErrorStatus, s as AuthPersistence, t as AuthError, u as AuthState, v as SignInInput, y as WorkspaceSelection } from "./errors-B0S9-QGH.js";
+import { a as AuthPersistenceDriver, c as AuthUser, d as FinuevaAuthClient, f as InvitationAcceptance, g as WorkspaceSelection, h as SignInInput, i as AuthPersistence, l as DriveCredential, m as PersonalWorkspaceSelection, n as AuthClientOptions, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as DriveCredentialInput } from "./types-zEqO1_r2.js";
+import { n as AuthErrorCode, r as AuthErrorStatus, t as AuthError } from "./errors-Crd93Rah.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion

package/dist/server.d.ts

@@ -1,4 +1,5 @@
-import { _ as PersonalWorkspaceSelection, d as AuthUser, f as DriveCredential, g as OrganizationWorkspaceSelection, h as InvitationAcceptance, i as AcceptInvitationInput, l as AuthSession, n as AuthErrorCode, o as AuthOrganization, p as DriveCredentialInput, r as AuthErrorStatus, t as AuthError, y as WorkspaceSelection } from "./errors-B0S9-QGH.js";
+import { c as AuthUser, f as InvitationAcceptance, g as WorkspaceSelection, l as DriveCredential, m as PersonalWorkspaceSelection, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, t as AcceptInvitationInput, u as DriveCredentialInput } from "./types-zEqO1_r2.js";
+import { n as AuthErrorCode, r as AuthErrorStatus, t as AuthError } from "./errors-Crd93Rah.js";
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;

package/dist/{errors-B0S9-QGH.d.ts → types-zEqO1_r2.d.ts}

@@ -87,14 +87,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-//#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "authentication_required" | "request_origin_denied" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "state_conflict" | "access_denied" | "identity_authority_unavailable";
-type AuthErrorStatus = 401 | 403 | 409 | 422 | 429 | 503;
-declare class AuthError extends Error {
-  readonly code: AuthErrorCode;
-  readonly status: AuthErrorStatus;
-  readonly retryAfterSeconds?: number;
-  constructor(code: AuthErrorCode, status: AuthErrorStatus, retryAfterSeconds?: number);
-}
-//#endregion
-export { PersonalWorkspaceSelection as _, AuthClientOptions as a, AuthPersistenceDriver as c, AuthUser as d, DriveCredential as f, OrganizationWorkspaceSelection as g, InvitationAcceptance as h, AcceptInvitationInput as i, AuthSession as l, FinuevaAuthClient as m, AuthErrorCode as n, AuthOrganization as o, DriveCredentialInput as p, AuthErrorStatus as r, AuthPersistence as s, AuthError as t, AuthState as u, SignInInput as v, WorkspaceSelection as y };
+export { AuthPersistenceDriver as a, AuthUser as c, FinuevaAuthClient as d, InvitationAcceptance as f, WorkspaceSelection as g, SignInInput as h, AuthPersistence as i, DriveCredential as l, PersonalWorkspaceSelection as m, AuthClientOptions as n, AuthSession as o, OrganizationWorkspaceSelection as p, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, DriveCredentialInput as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,
@@ -18,6 +18,10 @@
     "./server": {
       "types": "./dist/server.d.ts",
       "import": "./dist/server.js"
+    },
+    "./device": {
+      "types": "./dist/device.d.ts",
+      "import": "./dist/device.js"
     }
   },
   "files": [
@@ -38,6 +42,7 @@
     "coverage": "vitest run --coverage",
     "lint": "eslint .",
     "test": "pnpm test:unit && pnpm build && pnpm test:package",
+    "test:composition": "node scripts/test-composition.mjs",
     "test:package": "node scripts/test-package.mjs",
     "test:unit": "vitest run",
     "typecheck": "tsc --noEmit"