@finueva/auth 0.6.0 → 0.7.0

package/dist/device.js

@@ -439,6 +439,9 @@ function createFetch(globalOptions = {}) {
 //#region src/errors.ts
 const messages = {
 	invalid_credentials: "The credentials are invalid.",
+	invalid_auth_input: "The authentication input is invalid.",
+	account_conflict: "The account is not available.",
+	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",
 	invalid_invitation: "The invitation is invalid.",
@@ -448,6 +451,7 @@ const messages = {
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",
 	credential_rate_limited: "Credential requests are temporarily limited.",
+	auth_request_rate_limited: "Authentication requests are temporarily limited.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
 	identity_authority_unavailable: "Authentication is temporarily unavailable."
@@ -466,8 +470,56 @@ var AuthError = class extends Error {
 };
 //#endregion
 //#region src/shared.ts
+const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
 const email = /^[^\s@]+@[^\s@]+$/;
+const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
+function normalizeEmail(value) {
+	if (typeof value !== "string") throw new TypeError("email is invalid");
+	const normalized = value.trim().toLowerCase();
+	if (normalized.length === 0 || normalized.length > 320 || !email.test(normalized)) throw new TypeError("email is invalid");
+	return normalized;
+}
+function normalizePassword(value, name = "password", minLength = 8) {
+	if (typeof value !== "string" || value.length < minLength || value.length > 128) throw new TypeError(`${name} is invalid`);
+	return value;
+}
+function normalizeSocialIdTokenInput(value) {
+	if (!isObject(value)) throw new TypeError("social ID token input is invalid");
+	const keys = Object.keys(value);
+	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp") || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
+	return {
+		provider: value.provider,
+		idToken: value.idToken,
+		...value.nonce === void 0 ? {} : { nonce: value.nonce },
+		signUp: value.signUp
+	};
+}
+function socialIdTokenRequest(value) {
+	return {
+		provider: value.provider,
+		idToken: {
+			token: value.idToken,
+			...value.nonce === void 0 ? {} : { nonce: value.nonce }
+		},
+		requestSignUp: value.signUp
+	};
+}
+function normalizeName(value) {
+	if (typeof value !== "string") throw new TypeError("name is invalid");
+	const normalized = value.trim();
+	if (normalized.length === 0 || normalized.length > 256) throw new TypeError("name is invalid");
+	return normalized;
+}
+function normalizeProfileInput(value) {
+	if (!isObject(value)) throw new TypeError("profile input is invalid");
+	const keys = Object.keys(value);
+	if (keys.length === 0 || keys.length > 2 || keys.some((key) => key !== "name" && key !== "image") || value.name === void 0 && value.image === void 0) throw new TypeError("profile input is invalid");
+	const result = {};
+	if (value.name !== void 0) result.name = normalizeName(value.name);
+	if (value.image !== void 0) result.image = value.image === null ? null : normalizeProfileImage(value.image);
+	return result;
+}
 function normalizeOrigin(value, name) {
 	if (value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must be an ASCII HTTP origin`);
 	let url;
@@ -503,10 +555,48 @@ function normalizeSession(value) {
 		}
 	};
 }
+function normalizeDriveCredential(value, now) {
+	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16 * 1024) throw authorityUnavailable();
+	return {
+		tokenType: "Bearer",
+		token: value.token,
+		expiresAt: new Date(now + value.expiresIn * 1e3)
+	};
+}
+function normalizeWorkspaceSelection(value) {
+	if (!isObject(value)) throw new AuthError("invalid_workspace_selection", 422);
+	const keys = Object.keys(value);
+	if (value.type === "personal" && keys.length === 1 && keys[0] === "type") return { type: "personal" };
+	if (value.type === "organization" && keys.length === 2 && keys.includes("type") && keys.includes("organizationId") && typeof value.organizationId === "string" && id.test(value.organizationId)) return {
+		type: "organization",
+		organizationId: value.organizationId
+	};
+	throw new AuthError("invalid_workspace_selection", 422);
+}
 function fromAuthorityError(value, fallbackStatus, retryAfter) {
 	const mapped = mapError(isObject(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
 	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
 }
+function fromAccountAuthorityError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
+	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
+	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);
+	if (code === "INVALID_PASSWORD" || code === "INVALID_EMAIL_OR_PASSWORD") return new AuthError("invalid_credentials", 401);
+	if (code === "INVALID_EMAIL" || code === "PASSWORD_TOO_SHORT" || code === "PASSWORD_TOO_LONG" || code === "BODY_MUST_BE_AN_OBJECT" || code === "EMAIL_CAN_NOT_BE_UPDATED") return new AuthError("invalid_auth_input", 422);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("access_denied", 403);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	if (status === 400 || status === 422) return new AuthError("invalid_auth_input", 422);
+	return authorityUnavailable();
+}
+function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
+	if (code === "OAUTH_LINK_ERROR") return new AuthError("account_conflict", 409);
+	return fromAccountAuthorityError(value, status, retryAfter);
+}
 function authorityUnavailable() {
 	return new AuthError("identity_authority_unavailable", 503);
 }
@@ -569,6 +659,18 @@ function toDate(value) {
 	const result = value instanceof Date ? value : typeof value === "string" ? new Date(value) : void 0;
 	return result && Number.isFinite(result.getTime()) ? result : void 0;
 }
+function normalizeProfileImage(value) {
+	if (typeof value !== "string" || value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError("profile image is invalid");
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new TypeError("profile image is invalid");
+	}
+	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
+	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.toString() !== value) throw new TypeError("profile image is invalid");
+	return value;
+}
 function isId(value) {
 	return typeof value === "string" && id.test(value);
 }
@@ -585,7 +687,7 @@ async function requestJsonResponse(url, options) {
 			method: options.method,
 			headers: options.headers,
 			body: options.body,
-			credentials: "include",
+			credentials: options.credentials ?? "include",
 			retry: 0,
 			timeout: options.timeoutMs,
 			redirect: "manual",
@@ -647,8 +749,9 @@ async function readJson(response) {
 //#region src/device.ts
 const DEVICE_SCOPE = "openid";
 const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-const MAX_TOKEN_BYTES = 16 * 1024;
+const MAX_TOKEN_BYTES = 16 * 1024 - 7;
 const MAX_POLLING_MS = 900 * 1e3;
+const REFRESH_WINDOW_MS = 120 * 1e3;
 const errorMessages = {
 	device_access_denied: "Device authorization was denied.",
 	device_authorization_cancelled: "Device authorization was cancelled.",
@@ -678,7 +781,30 @@ function createDeviceAuth(options) {
 	let token = null;
 	let hydrated = false;
 	let hydration = null;
-	async function getToken() {
+	let credential;
+	let credentialRequest;
+	let selectedWorkspaceKey;
+	let credentialGeneration = 0;
+	let authorityGeneration = 0;
+	let authorityTail = Promise.resolve();
+	let persistenceTail = Promise.resolve();
+	let persistencePending = 0;
+	function clearCredential() {
+		credential = void 0;
+		selectedWorkspaceKey = void 0;
+		credentialGeneration += 1;
+	}
+	function serializeAuthority(operation, invalidateCredential = false) {
+		if (invalidateCredential) clearCredential();
+		const guardedOperation = () => {
+			if (persistencePending > 0) throw new AuthError("state_conflict", 409);
+			return operation();
+		};
+		const request = authorityTail.then(guardedOperation, guardedOperation);
+		authorityTail = request.then(() => void 0, () => void 0);
+		return request;
+	}
+	async function readToken() {
 		if (!hydrated) {
 			hydration ??= hydrate().finally(() => {
 				hydration = null;
@@ -687,17 +813,28 @@ function createDeviceAuth(options) {
 		}
 		if (token && token.expiresAt.getTime() <= now()) {
 			token = null;
+			authorityGeneration += 1;
+			clearCredential();
 			await removePersisted();
 		}
 		return token ? copyToken(token) : null;
 	}
 	async function hydrate() {
 		try {
-			const loaded = options.persistence ? normalizeToken(await persistenceCall((signal) => options.persistence.read(signal)), now()) : null;
-			if (options.persistence && !loaded) await persistenceCall((signal) => options.persistence.delete(signal));
+			const persisted = options.persistence ? await persistenceCall((signal) => options.persistence.read(signal)) : null;
+			let loaded;
+			try {
+				loaded = normalizeToken(persisted, now());
+			} catch {
+				token = null;
+				if (options.persistence && persisted !== null) await persistenceCall((signal) => options.persistence.delete(signal)).catch(() => void 0);
+				throw unavailable();
+			}
+			if (options.persistence && persisted !== null && !loaded) await persistenceCall((signal) => options.persistence.delete(signal));
 			token = loaded;
-		} catch {
+		} catch (error) {
 			token = null;
+			if (error instanceof DeviceAuthorizationError) throw error;
 			throw unavailable();
 		} finally {
 			hydrated = true;
@@ -710,6 +847,7 @@ function createDeviceAuth(options) {
 				fetch: requestFetch,
 				timeoutMs,
 				method: "POST",
+				credentials: "omit",
 				body: {
 					client_id: options.clientId,
 					scope: DEVICE_SCOPE
@@ -723,14 +861,14 @@ function createDeviceAuth(options) {
 			throw unavailable();
 		}
 	}
-	async function pollForToken(authorization, pollOptions = {}) {
-		if (pollOptions.signal?.aborted) throw cancelled();
-		const normalized = normalizeAuthorizationInput(authorization, now());
+	async function pollForToken(authorization, signal) {
+		if (signal?.aborted) throw cancelled();
+		const previous = await readToken();
 		const startedAt = now();
-		const deadline = Math.min(normalized.expiresAt.getTime(), startedAt + maxPollingMs);
-		let intervalMs = normalized.intervalSeconds * 1e3;
+		const deadline = Math.min(authorization.expiresAt.getTime(), startedAt + maxPollingMs);
+		let intervalMs = authorization.intervalSeconds * 1e3;
 		while (true) {
-			await wait(intervalMs, pollOptions.signal, deadline, now);
+			await wait(intervalMs, signal, deadline, now);
 			const requestBudget = deadline - now();
 			if (requestBudget <= 0) throw expired();
 			let response;
@@ -739,18 +877,19 @@ function createDeviceAuth(options) {
 					fetch: requestFetch,
 					timeoutMs: Math.min(timeoutMs, requestBudget),
 					method: "POST",
+					credentials: "omit",
 					body: {
 						grant_type: GRANT_TYPE,
-						device_code: normalized.deviceCode,
+						device_code: authorization.deviceCode,
 						client_id: options.clientId
 					},
-					signal: pollOptions.signal,
+					signal,
 					mapError(value) {
 						return new DeviceProtocolError(isObject(value) && typeof value.error === "string" ? value.error : void 0);
 					}
 				});
 			} catch (error) {
-				if (pollOptions.signal?.aborted) throw cancelled();
+				if (signal?.aborted) throw cancelled();
 				if (now() >= deadline) throw expired();
 				if (error instanceof DeviceProtocolError) {
 					if (error.protocolCode === "authorization_pending") continue;
@@ -765,43 +904,54 @@ function createDeviceAuth(options) {
 				throw unavailable();
 			}
 			if (now() >= deadline) throw expired();
-			const next = normalizeTokenResponse(response.value, now());
-			if (options.persistence) try {
-				await persistenceCall((signal) => options.persistence.replace(copyToken(next), signal));
+			const recoverableAccessToken = extractRedeemedToken(response.value);
+			let next;
+			try {
+				next = normalizeTokenResponse(response.value, now());
 			} catch {
-				token = null;
-				hydrated = true;
-				await persistenceCall((signal) => options.persistence.delete(signal)).catch(() => void 0);
+				if (recoverableAccessToken) await revokeToken(recoverableAccessToken);
+				await clearToken().catch(() => void 0);
+				throw unavailable();
+			}
+			try {
+				await publishReplacement(next, previous);
+			} catch {
+				await revokeToken(next.accessToken);
+				await retainPrevious(previous);
 				throw unavailable();
 			}
-			token = next;
-			hydrated = true;
 			return copyToken(next);
 		}
 	}
-	async function authenticated(path, body) {
-		const current = await getToken();
-		if (!current) return null;
-		try {
-			return await requestJsonResponse(joinURL(authOrigin, "api/v1/auth", path), {
-				fetch: requestFetch,
-				timeoutMs,
-				method: body ? "POST" : "GET",
-				headers: { authorization: `Bearer ${current.accessToken}` },
-				body
-			});
-		} catch {
-			throw unavailable();
-		}
+	async function fetchBearerSession(accessToken) {
+		return normalizeSession((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/get-session"), {
+			fetch: requestFetch,
+			timeoutMs,
+			method: "GET",
+			credentials: "omit",
+			headers: { authorization: `Bearer ${accessToken}` }
+		})).value);
+	}
+	async function authenticated(path, current, body) {
+		return requestJsonResponse(joinURL(authOrigin, "api/v1/auth", path), {
+			fetch: requestFetch,
+			timeoutMs,
+			method: body ? "POST" : "GET",
+			credentials: "omit",
+			headers: { authorization: `Bearer ${current.accessToken}` },
+			body,
+			mapError: fromAccountAuthorityError
+		});
 	}
 	async function revoke(path) {
-		const current = await getToken();
+		const current = await readToken();
 		if (!current) return;
 		try {
 			await requestJsonResponse(joinURL(authOrigin, "api/v1/auth", path), {
 				fetch: requestFetch,
 				timeoutMs,
 				method: "POST",
+				credentials: "omit",
 				headers: { authorization: `Bearer ${current.accessToken}` },
 				body: path === "revoke-session" ? { token: current.accessToken } : void 0
 			});
@@ -809,8 +959,139 @@ function createDeviceAuth(options) {
 			throw unavailable();
 		}
 		token = null;
+		hydrated = true;
+		authorityGeneration += 1;
+		clearCredential();
+		await removePersisted();
+	}
+	async function replaceToken(next) {
+		try {
+			if (options.persistence) await persistenceCall((signal) => options.persistence.replace(copyToken(next), signal));
+		} catch {
+			throw unavailable();
+		}
+		token = copyToken(next);
+		hydrated = true;
+		authorityGeneration += 1;
+		clearCredential();
+	}
+	async function publishReplacement(next, previous) {
+		await replaceToken(next);
+		if (previous && previous.accessToken !== next.accessToken) await revokeToken(previous.accessToken);
+	}
+	async function replaceIssuedToken(issued, previous) {
+		let session;
+		try {
+			const authoritative = await fetchBearerSession(issued.accessToken);
+			if (!authoritative || authoritative.user.id !== issued.userId || authoritative.expiresAt.getTime() <= now()) throw authorityUnavailable();
+			session = authoritative;
+			await publishReplacement({
+				accessToken: issued.accessToken,
+				tokenType: "Bearer",
+				expiresAt: authoritative.expiresAt,
+				scope: DEVICE_SCOPE
+			}, previous);
+		} catch (error) {
+			await revokeToken(issued.accessToken);
+			await retainPrevious(previous);
+			throw error instanceof AuthError ? error : authorityUnavailable();
+		}
+		return session;
+	}
+	async function replaceIssuedResponse(value, previous) {
+		const accessToken = extractIssuedToken(value);
+		let issued;
+		try {
+			issued = normalizeIssuedSession(value);
+		} catch (error) {
+			if (accessToken) await revokeToken(accessToken);
+			await retainPrevious(previous);
+			throw error instanceof AuthError ? error : authorityUnavailable();
+		}
+		return replaceIssuedToken(issued, previous);
+	}
+	async function revokeToken(accessToken) {
+		await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/revoke-session"), {
+			fetch: requestFetch,
+			timeoutMs,
+			method: "POST",
+			credentials: "omit",
+			headers: { authorization: `Bearer ${accessToken}` },
+			body: { token: accessToken }
+		}).catch(() => void 0);
+	}
+	async function clearToken() {
+		token = null;
+		hydrated = true;
+		authorityGeneration += 1;
+		clearCredential();
 		await removePersisted();
 	}
+	async function retainPrevious(previous) {
+		if (previous) {
+			try {
+				const session = await fetchBearerSession(previous.accessToken);
+				if (session && session.expiresAt.getTime() > now()) {
+					const restored = {
+						...previous,
+						expiresAt: session.expiresAt
+					};
+					if (options.persistence) await replaceToken(restored);
+					else {
+						token = copyToken(previous);
+						hydrated = true;
+					}
+					return;
+				}
+			} catch {}
+			await revokeToken(previous.accessToken);
+		}
+		token = null;
+		hydrated = true;
+		authorityGeneration += 1;
+		clearCredential();
+		await removePersisted().catch(() => void 0);
+	}
+	async function accountRequest(path, body, mapError = fromAccountAuthorityError) {
+		clearCredential();
+		return requestJsonResponse(joinURL(authOrigin, "api/v1/auth", path), {
+			fetch: requestFetch,
+			timeoutMs,
+			method: "POST",
+			credentials: "omit",
+			headers: { "content-type": "application/json; charset=utf-8" },
+			body,
+			mapError
+		});
+	}
+	async function getSession() {
+		const current = await readToken();
+		if (!current) return null;
+		let session;
+		try {
+			session = await fetchBearerSession(current.accessToken);
+		} catch (error) {
+			throw error instanceof AuthError ? error : unavailable();
+		}
+		if (!session || session.expiresAt.getTime() <= now()) {
+			await clearToken();
+			return null;
+		}
+		if (session.expiresAt.getTime() !== current.expiresAt.getTime()) try {
+			await replaceToken({
+				...current,
+				expiresAt: session.expiresAt
+			});
+		} catch {
+			token = null;
+			hydrated = true;
+			authorityGeneration += 1;
+			clearCredential();
+			await removePersisted().catch(() => void 0);
+			throw unavailable();
+		}
+		return session;
+	}
 	async function removePersisted() {
 		if (!options.persistence) return;
 		try {
@@ -821,30 +1102,236 @@ function createDeviceAuth(options) {
 	}
 	return {
 		requestAuthorization,
-		pollForToken,
-		getToken,
-		async getSession() {
-			const response = await authenticated("get-session");
-			return response ? normalizeSession(response.value) : null;
+		pollForToken(authorization, pollOptions) {
+			let signal;
+			let snapshot;
+			try {
+				signal = normalizePollSignal(pollOptions);
+				if (signal?.aborted) throw cancelled();
+				snapshot = normalizeAuthorizationInput(authorization, now());
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(() => pollForToken(snapshot, signal), true);
+		},
+		getToken: () => serializeAuthority(async () => copyTokenOrNull(await readToken())),
+		getSession: () => serializeAuthority(getSession, true),
+		signUpWithEmail(email, password, name) {
+			let body;
+			try {
+				body = {
+					email: normalizeEmail(email),
+					password: normalizePassword(password, "password", 10),
+					name: normalizeName(name)
+				};
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				const previous = await readToken();
+				return replaceIssuedResponse((await accountRequest("sign-up/email", body)).value, previous);
+			}, true);
+		},
+		signInWithEmail(email, password) {
+			let body;
+			try {
+				body = {
+					email: normalizeEmail(email),
+					password: normalizePassword(password)
+				};
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				const previous = await readToken();
+				return replaceIssuedResponse((await accountRequest("sign-in/email", body)).value, previous);
+			}, true);
+		},
+		signInWithSocialIdToken(input) {
+			let body;
+			try {
+				body = socialIdTokenRequest(normalizeSocialIdTokenInput(input));
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				const previous = await readToken();
+				return replaceIssuedResponse((await accountRequest("sign-in/social", body, fromSocialIdTokenAuthorityError)).value, previous);
+			}, true);
+		},
+		updateProfile(input) {
+			let body;
+			try {
+				body = normalizeProfileInput(input);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				const current = await readToken();
+				if (!current) throw new AuthError("authentication_required", 401);
+				const response = await authenticated("update-user", current, body);
+				if (!isObject(response.value) || response.value.status !== true) throw authorityUnavailable();
+				const session = await getSession();
+				if (!session) throw new AuthError("authentication_required", 401);
+				return session;
+			}, true);
+		},
+		changePassword(currentPassword, newPassword, revokeOtherSessions = true) {
+			let body;
+			try {
+				if (typeof revokeOtherSessions !== "boolean") throw new TypeError("revokeOtherSessions is invalid");
+				body = {
+					currentPassword: normalizePassword(currentPassword, "currentPassword"),
+					newPassword: normalizePassword(newPassword, "newPassword", 10),
+					revokeOtherSessions
+				};
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				const current = await readToken();
+				if (!current) throw new AuthError("authentication_required", 401);
+				let response;
+				try {
+					response = await authenticated("change-password", current, body);
+				} catch (error) {
+					await retainPrevious(current);
+					throw error instanceof AuthError ? error : authorityUnavailable();
+				}
+				let replacement;
+				try {
+					replacement = normalizePasswordChange(response.value);
+				} catch (error) {
+					const accessToken = extractIssuedToken(response.value);
+					if (accessToken) await revokeToken(accessToken);
+					await retainPrevious(current);
+					throw error;
+				}
+				if (replacement.accessToken !== null) return replaceIssuedToken({
+					accessToken: replacement.accessToken,
+					userId: replacement.userId
+				}, current);
+				let session;
+				try {
+					session = await fetchBearerSession(current.accessToken);
+				} catch (error) {
+					await retainPrevious(current);
+					throw error instanceof AuthError ? error : authorityUnavailable();
+				}
+				if (!session || session.user.id !== replacement.userId || session.expiresAt.getTime() <= now()) {
+					await clearToken();
+					throw new AuthError("authentication_required", 401);
+				}
+				await replaceToken({
+					...current,
+					expiresAt: session.expiresAt
+				});
+				return session;
+			}, true);
+		},
+		getDriveCredential(input) {
+			let workspace;
+			let forceRefresh;
+			try {
+				workspace = normalizeWorkspaceSelection(input?.workspace);
+				const submittedForceRefresh = input?.forceRefresh;
+				if (submittedForceRefresh !== void 0 && typeof submittedForceRefresh !== "boolean") throw new TypeError("forceRefresh is invalid");
+				forceRefresh = submittedForceRefresh ?? false;
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			const workspaceKey = workspace.type === "personal" ? "personal" : `organization:${workspace.organizationId}`;
+			if (credentialRequest) {
+				if (!forceRefresh && credentialRequest.key === workspaceKey && credentialRequest.generation === credentialGeneration && selectedWorkspaceKey === workspaceKey) return credentialRequest.value;
+				return Promise.reject(new AuthError("state_conflict", 409));
+			}
+			if (selectedWorkspaceKey !== workspaceKey) {
+				credential = void 0;
+				selectedWorkspaceKey = workspaceKey;
+				credentialGeneration += 1;
+			}
+			if (forceRefresh) {
+				credential = void 0;
+				credentialGeneration += 1;
+			}
+			const requestGeneration = credentialGeneration;
+			const request = (async () => {
+				const authority = await serializeAuthority(async () => {
+					const current = await readToken();
+					return {
+						authorityGeneration,
+						token: current
+					};
+				});
+				const current = authority.token;
+				if (!current) throw new AuthError("authentication_required", 401);
+				if (authority.authorityGeneration !== authorityGeneration || requestGeneration !== credentialGeneration || selectedWorkspaceKey !== workspaceKey) throw new AuthError("state_conflict", 409);
+				if (!forceRefresh && credential?.key === workspaceKey && credential.value.expiresAt.getTime() - now() > REFRESH_WINDOW_MS) return credential.value;
+				const next = normalizeDriveCredential((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/drive-credential"), {
+					fetch: requestFetch,
+					timeoutMs,
+					method: "POST",
+					credentials: "omit",
+					headers: {
+						authorization: `Bearer ${current.accessToken}`,
+						"content-type": "application/json; charset=utf-8"
+					},
+					body: { workspace }
+				})).value, now());
+				if (authority.authorityGeneration !== authorityGeneration || requestGeneration !== credentialGeneration || selectedWorkspaceKey !== workspaceKey) throw new AuthError("state_conflict", 409);
+				credential = {
+					key: workspaceKey,
+					value: next
+				};
+				return next;
+			})().finally(() => {
+				if (credentialRequest?.value === request) credentialRequest = void 0;
+			});
+			credentialRequest = {
+				generation: requestGeneration,
+				key: workspaceKey,
+				value: request
+			};
+			return request;
 		},
-		revokeCurrentDevice: () => revoke("revoke-session"),
-		revokeAllSessions: () => revoke("revoke-sessions")
+		revokeCurrentDevice: () => serializeAuthority(() => revoke("revoke-session"), true),
+		revokeAllSessions: () => serializeAuthority(() => revoke("revoke-sessions"), true)
 	};
 	async function persistenceCall(operation) {
-		const controller = new AbortController();
-		let timer;
+		const operationTimeoutMs = Math.min(timeoutMs, 1e3);
+		persistencePending += 1;
+		const settledRequest = persistenceTail.then(async () => {
+			const controller = new AbortController();
+			const timer = setTimeout(() => controller.abort(), operationTimeoutMs);
+			try {
+				return await operation(controller.signal);
+			} finally {
+				clearTimeout(timer);
+			}
+		}).finally(() => {
+			persistencePending -= 1;
+		});
+		persistenceTail = settledRequest.then(() => void 0, () => void 0);
+		let publicTimer;
 		try {
-			return await Promise.race([Promise.resolve().then(() => operation(controller.signal)), new Promise((_, reject) => {
-				timer = setTimeout(() => {
-					controller.abort();
-					reject(unavailable());
-				}, Math.min(timeoutMs, 1e3));
+			return await Promise.race([settledRequest.catch(() => {
+				throw unavailable();
+			}), new Promise((_, reject) => {
+				publicTimer = setTimeout(() => reject(unavailable()), operationTimeoutMs);
 			})]);
 		} finally {
-			if (timer) clearTimeout(timer);
+			if (publicTimer) clearTimeout(publicTimer);
 		}
 	}
 }
+function copyTokenOrNull(value) {
+	return value ? copyToken(value) : null;
+}
+function normalizePollSignal(value) {
+	if (value === void 0) return void 0;
+	if (!isObject(value) || Object.keys(value).some((key) => key !== "signal") || value.signal !== void 0 && !(value.signal instanceof AbortSignal)) throw new TypeError("poll options are invalid");
+	return value.signal;
+}
 var DeviceProtocolError = class extends Error {
 	protocolCode;
 	constructor(protocolCode) {
@@ -864,8 +1351,15 @@ function normalizeAuthorization(value, currentTime) {
 	};
 }
 function normalizeAuthorizationInput(value, currentTime) {
-	if (!value || !boundedSecret(value.deviceCode) || typeof value.userCode !== "string" || !exactHttpsOrLocalUri(value.verificationUri) || !exactHttpsOrLocalUri(value.verificationUriComplete) || !(value.expiresAt instanceof Date) || !Number.isFinite(value.expiresAt.getTime()) || value.expiresAt.getTime() <= currentTime || !Number.isSafeInteger(value.intervalSeconds) || value.intervalSeconds < 1 || value.intervalSeconds > 60) throw invalid();
-	return value;
+	if (!value || !boundedSecret(value.deviceCode) || typeof value.userCode !== "string" || !/^[A-Z0-9-]{1,32}$/.test(value.userCode) || !exactHttpsOrLocalUri(value.verificationUri) || !exactHttpsOrLocalUri(value.verificationUriComplete) || !(value.expiresAt instanceof Date) || !Number.isFinite(value.expiresAt.getTime()) || value.expiresAt.getTime() <= currentTime || !Number.isSafeInteger(value.intervalSeconds) || value.intervalSeconds < 1 || value.intervalSeconds > 60) throw invalid();
+	return {
+		deviceCode: value.deviceCode,
+		userCode: value.userCode,
+		verificationUri: value.verificationUri,
+		verificationUriComplete: value.verificationUriComplete,
+		expiresAt: new Date(value.expiresAt),
+		intervalSeconds: value.intervalSeconds
+	};
 }
 function normalizeTokenResponse(value, currentTime) {
 	if (!isObject(value) || !boundedSecret(value.access_token) || value.token_type !== "Bearer" || value.scope !== DEVICE_SCOPE || !Number.isSafeInteger(value.expires_in) || value.expires_in < 1 || value.expires_in > 744 * 60 * 60) throw unavailable();
@@ -876,6 +1370,26 @@ function normalizeTokenResponse(value, currentTime) {
 		scope: DEVICE_SCOPE
 	};
 }
+function normalizeIssuedSession(value) {
+	if (!isObject(value) || !boundedSecret(value.token) || !isObject(value.user) || typeof value.user.id !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(value.user.id)) throw authorityUnavailable();
+	return {
+		accessToken: value.token,
+		userId: value.user.id
+	};
+}
+function extractIssuedToken(value) {
+	return isObject(value) && boundedSecret(value.token) ? value.token : void 0;
+}
+function extractRedeemedToken(value) {
+	return isObject(value) && boundedSecret(value.access_token) ? value.access_token : void 0;
+}
+function normalizePasswordChange(value) {
+	if (!isObject(value) || value.token !== null && !boundedSecret(value.token) || !isObject(value.user) || typeof value.user.id !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(value.user.id)) throw authorityUnavailable();
+	return {
+		accessToken: value.token,
+		userId: value.user.id
+	};
+}
 function normalizeToken(value, currentTime) {
 	if (value === null) return null;
 	if (!value || !boundedSecret(value.accessToken) || value.tokenType !== "Bearer" || value.scope !== DEVICE_SCOPE || !(value.expiresAt instanceof Date) || !Number.isFinite(value.expiresAt.getTime())) throw unavailable();
@@ -934,4 +1448,4 @@ function unavailable() {
 	return new DeviceAuthorizationError("identity_authority_unavailable");
 }
 //#endregion
-export { DeviceAuthorizationError, createDeviceAuth };
+export { AuthError, DeviceAuthorizationError, createDeviceAuth };