@finueva/auth 0.6.0 → 0.7.0

package/dist/index.d.ts

@@ -1,6 +1,5 @@
-import { _ as WorkspaceSelection, a as AuthPersistenceDriver, c as AuthUser, d as FinuevaAuthClient, f as InvitationAcceptance, g as SignInInput, h as SendVerificationEmailInput, i as AuthPersistence, l as DriveCredential, m as PersonalWorkspaceSelection, n as AuthClientOptions, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as DriveCredentialInput } from "./types-HSdjQWMZ.js";
-import { n as AuthErrorCode, r as AuthErrorStatus, t as AuthError } from "./errors-Crd93Rah.js";
+import { C as AuthErrorStatus, S as AuthErrorCode, _ as SocialIdTokenInput, a as AuthPersistenceDriver, b as WorkspaceSelection, c as AuthUser, d as FinuevaAuthClient, f as InvitationAcceptance, g as SignInInput, h as SendVerificationEmailInput, i as AuthPersistence, l as DriveCredential, m as PersonalWorkspaceSelection, n as AuthClientOptions, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as DriveCredentialInput, v as SocialIdTokenProvider, x as AuthError, y as UpdateProfileInput } from "./types-B1SZbs6Z.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type SendVerificationEmailInput, type SignInInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -1879,6 +1879,9 @@ function stringifyParsedURL(parsed) {
 //#region src/errors.ts
 const messages = {
 	invalid_credentials: "The credentials are invalid.",
+	invalid_auth_input: "The authentication input is invalid.",
+	account_conflict: "The account is not available.",
+	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",
 	invalid_invitation: "The invitation is invalid.",
@@ -1888,6 +1891,7 @@ const messages = {
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",
 	credential_rate_limited: "Credential requests are temporarily limited.",
+	auth_request_rate_limited: "Authentication requests are temporarily limited.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
 	identity_authority_unavailable: "Authentication is temporarily unavailable."
@@ -2172,6 +2176,69 @@ function createFetch(globalOptions = {}) {
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
 const email = /^[^\s@]+@[^\s@]+$/;
+const passwordResetToken = /^[A-Za-z0-9_-]{1,512}$/;
+const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
+function normalizeEmail(value) {
+	if (typeof value !== "string") throw new TypeError("email is invalid");
+	const normalized = value.trim().toLowerCase();
+	if (normalized.length === 0 || normalized.length > 320 || !email.test(normalized)) throw new TypeError("email is invalid");
+	return normalized;
+}
+function normalizePassword(value, name = "password", minLength = 8) {
+	if (typeof value !== "string" || value.length < minLength || value.length > 128) throw new TypeError(`${name} is invalid`);
+	return value;
+}
+function normalizeSocialIdTokenInput(value) {
+	if (!isObject(value)) throw new TypeError("social ID token input is invalid");
+	const keys = Object.keys(value);
+	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp") || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
+	return {
+		provider: value.provider,
+		idToken: value.idToken,
+		...value.nonce === void 0 ? {} : { nonce: value.nonce },
+		signUp: value.signUp
+	};
+}
+function socialIdTokenRequest(value) {
+	return {
+		provider: value.provider,
+		idToken: {
+			token: value.idToken,
+			...value.nonce === void 0 ? {} : { nonce: value.nonce }
+		},
+		requestSignUp: value.signUp
+	};
+}
+function normalizeName(value) {
+	if (typeof value !== "string") throw new TypeError("name is invalid");
+	const normalized = value.trim();
+	if (normalized.length === 0 || normalized.length > 256) throw new TypeError("name is invalid");
+	return normalized;
+}
+function normalizeProfileInput(value) {
+	if (!isObject(value)) throw new TypeError("profile input is invalid");
+	const keys = Object.keys(value);
+	if (keys.length === 0 || keys.length > 2 || keys.some((key) => key !== "name" && key !== "image") || value.name === void 0 && value.image === void 0) throw new TypeError("profile input is invalid");
+	const result = {};
+	if (value.name !== void 0) result.name = normalizeName(value.name);
+	if (value.image !== void 0) result.image = value.image === null ? null : normalizeProfileImage(value.image);
+	return result;
+}
+function normalizePasswordResetToken(value) {
+	if (typeof value !== "string" || !passwordResetToken.test(value)) throw new TypeError("password reset token is invalid");
+	return value;
+}
+function normalizeSameAppURL(value, appOrigin, name) {
+	if (typeof value !== "string" || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must belong to appOrigin`);
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new TypeError(`${name} must belong to appOrigin`);
+	}
+	if (url.origin !== appOrigin || url.username || url.password || url.toString() !== value) throw new TypeError(`${name} must belong to appOrigin`);
+	return value;
+}
 function normalizeOrigin(value, name) {
 	if (value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must be an ASCII HTTP origin`);
 	let url;
@@ -2208,7 +2275,7 @@ function normalizeSession(value) {
 	};
 }
 function normalizeDriveCredential(value, now) {
-	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || value.token.length + 7 > 16 * 1024) throw authorityUnavailable();
+	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16 * 1024) throw authorityUnavailable();
 	return {
 		tokenType: "Bearer",
 		token: value.token,
@@ -2235,19 +2302,12 @@ function normalizeInvitationInput(value) {
 function normalizeVerificationEmailInput(value, appOrigin) {
 	if (!isObject(value)) throw new TypeError("verification email input is invalid");
 	const keys = Object.keys(value);
-	if (keys.length !== 1 && keys.length !== 2 || !keys.includes("email") || keys.length === 2 && !keys.includes("callbackURL") || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email)) throw new TypeError("verification email input is invalid");
-	if (value.callbackURL === void 0) return { email: value.email };
-	if (typeof value.callbackURL !== "string" || value.callbackURL.length > 2048 || /[^\x20-\x7e]/.test(value.callbackURL)) throw new TypeError("callbackURL must belong to appOrigin");
-	let callback;
-	try {
-		callback = new URL(value.callbackURL);
-	} catch {
-		throw new TypeError("callbackURL must belong to appOrigin");
-	}
-	if (callback.origin !== appOrigin || callback.username || callback.password || callback.toString() !== value.callbackURL) throw new TypeError("callbackURL must belong to appOrigin");
+	if (keys.length !== 1 && keys.length !== 2 || !keys.includes("email") || keys.length === 2 && !keys.includes("callbackURL") || typeof value.email !== "string") throw new TypeError("verification email input is invalid");
+	const normalizedEmail = normalizeEmail(value.email);
+	if (value.callbackURL === void 0) return { email: normalizedEmail };
 	return {
-		email: value.email,
-		callbackURL: value.callbackURL
+		email: normalizedEmail,
+		callbackURL: normalizeSameAppURL(value.callbackURL, appOrigin, "callbackURL")
 	};
 }
 function normalizeVerificationEmailResponse(value) {
@@ -2271,6 +2331,26 @@ function fromAuthorityError(value, fallbackStatus, retryAfter) {
 	const mapped = mapError(isObject(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
 	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
 }
+function fromAccountAuthorityError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
+	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
+	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);
+	if (code === "INVALID_PASSWORD" || code === "INVALID_EMAIL_OR_PASSWORD") return new AuthError("invalid_credentials", 401);
+	if (code === "INVALID_EMAIL" || code === "PASSWORD_TOO_SHORT" || code === "PASSWORD_TOO_LONG" || code === "BODY_MUST_BE_AN_OBJECT" || code === "EMAIL_CAN_NOT_BE_UPDATED") return new AuthError("invalid_auth_input", 422);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("access_denied", 403);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	if (status === 400 || status === 422) return new AuthError("invalid_auth_input", 422);
+	return authorityUnavailable();
+}
+function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
+	if (code === "OAUTH_LINK_ERROR") return new AuthError("account_conflict", 409);
+	return fromAccountAuthorityError(value, status, retryAfter);
+}
 function authorityUnavailable() {
 	return new AuthError("identity_authority_unavailable", 503);
 }
@@ -2350,6 +2430,18 @@ function toDate(value) {
 	const result = value instanceof Date ? value : typeof value === "string" ? new Date(value) : void 0;
 	return result && Number.isFinite(result.getTime()) ? result : void 0;
 }
+function normalizeProfileImage(value) {
+	if (typeof value !== "string" || value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError("profile image is invalid");
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new TypeError("profile image is invalid");
+	}
+	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
+	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.toString() !== value) throw new TypeError("profile image is invalid");
+	return value;
+}
 function isId(value) {
 	return typeof value === "string" && id.test(value);
 }
@@ -2369,7 +2461,7 @@ async function requestJsonResponse(url, options) {
 			method: options.method,
 			headers: options.headers,
 			body: options.body,
-			credentials: "include",
+			credentials: options.credentials ?? "include",
 			retry: 0,
 			timeout: options.timeoutMs,
 			redirect: "manual",
@@ -3181,12 +3273,14 @@ function createAuthClient(options) {
 		basePath: "/api/v1/auth",
 		fetchOptions: {
 			customFetchImpl: fetchImpl,
+			credentials: "include",
 			retry: 0,
 			timeout: timeoutMs
 		}
 	});
 	const persistence = createSessionPersistence(options.persistence, authOrigin, now, timeoutMs);
 	const authStateListeners = new Set();
+	const sessionListeners = new Set();
 	let authState = { status: "loading" };
 	let authStateStarted = false;
 	let credential;
@@ -3194,15 +3288,29 @@ function createAuthClient(options) {
 	let selectedWorkspaceKey;
 	let credentialGeneration = 0;
 	let authorityGeneration = 0;
-	let locallySignedOut = false;
-	let activeSignInGeneration;
+	let sessionReadEpoch = 0;
+	let activeAccountMutationGeneration;
 	let invitationAbort;
 	let invitationRequest;
 	let signOutRequest;
 	let sessionId;
+	let sessionUserId;
+	let sessionSignalSubscribed = false;
+	let betterAuthRefetching = false;
+	let suppressBetterAuthSettlement = false;
+	let signalRefreshPending = false;
+	let signalRefreshScheduled = false;
+	let signalRefreshRequest;
 	function setAuthState(state) {
 		authState = state;
-		for (const listener of authStateListeners) listener(state);
+		for (const listener of authStateListeners) try {
+			listener(state);
+		} catch {}
+	}
+	function emitSession(session) {
+		for (const listener of sessionListeners) try {
+			listener(session);
+		} catch {}
 	}
 	function unavailable() {
 		setAuthState({
@@ -3229,26 +3337,16 @@ function createAuthClient(options) {
 			});
 			persistence.remove();
 		}
+		emitSession(normalized);
 		return normalized;
 	}
 	function startAuthState() {
 		if (authStateStarted) return;
 		authStateStarted = true;
-		betterAuth.useSession.subscribe((state) => {
-			if (state.isPending) return;
-			if (state.error) {
-				unavailable();
-				return;
-			}
-			try {
-				const session = normalizeSession(state.data);
-				if (session && (locallySignedOut || signOutRequest)) return;
-				acceptAuthoritySession(session);
-			} catch {
-				unavailable();
-			}
-		});
+		subscribeToSessionSignals();
+		const hydrationGeneration = authorityGeneration;
 		persistence.hydrate((session) => {
+			if (hydrationGeneration !== authorityGeneration || activeAccountMutationGeneration !== void 0) return;
 			if (authState.status === "loading") setAuthState({
 				status: "cached",
 				session,
@@ -3260,7 +3358,45 @@ function createAuthClient(options) {
 				authoritative: false
 			});
 		});
-		if (typeof window === "undefined" || typeof document === "undefined") getSession().catch(() => void 0);
+		getSession().catch(() => void 0);
+	}
+	function subscribeToSessionSignals() {
+		if (sessionSignalSubscribed) return;
+		sessionSignalSubscribed = true;
+		let initialized = false;
+		betterAuth.useSession.subscribe((state) => {
+			const refetching = state.isRefetching === true;
+			if (!initialized) {
+				initialized = true;
+				betterAuthRefetching = refetching;
+				return;
+			}
+			const settled = betterAuthRefetching && !refetching;
+			betterAuthRefetching = refetching;
+			if (refetching && signOutRequest) suppressBetterAuthSettlement = true;
+			if (!settled) return;
+			if (suppressBetterAuthSettlement) {
+				suppressBetterAuthSettlement = false;
+				return;
+			}
+			queueSignalRefresh();
+		});
+	}
+	function queueSignalRefresh() {
+		signalRefreshPending = true;
+		if (signalRefreshScheduled || signalRefreshRequest || signOutRequest || activeAccountMutationGeneration !== void 0) return;
+		signalRefreshScheduled = true;
+		queueMicrotask(runSignalRefresh);
+	}
+	function runSignalRefresh() {
+		signalRefreshScheduled = false;
+		if (!signalRefreshPending || signalRefreshRequest || signOutRequest || activeAccountMutationGeneration !== void 0) return;
+		signalRefreshPending = false;
+		const request = refreshAuthoritySession(authorityGeneration).then(() => void 0, () => void 0).finally(() => {
+			if (signalRefreshRequest === request) signalRefreshRequest = void 0;
+			if (signalRefreshPending) queueSignalRefresh();
+		});
+		signalRefreshRequest = request;
 	}
 	function clearCredential() {
 		credential = void 0;
@@ -3270,44 +3406,52 @@ function createAuthClient(options) {
 	}
 	function updateSession(session) {
 		const unboundCredential = !sessionId && (credential || credentialRequests.size > 0);
-		if (!session || unboundCredential || sessionId && session.id !== sessionId) clearCredential();
+		if (!session || unboundCredential || sessionId && (session.id !== sessionId || session.user.id !== sessionUserId)) clearCredential();
 		sessionId = session?.id;
+		sessionUserId = session?.user.id;
 		return session;
 	}
-	async function getSession() {
-		if (signOutRequest) throw new AuthError("state_conflict", 409);
-		locallySignedOut = false;
-		const generation = authorityGeneration;
-		let result;
-		try {
-			result = await betterAuth.getSession();
-		} catch {
-			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
-			unavailable();
-			throw authorityUnavailable();
-		}
-		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
-		if (result.error) {
-			unavailable();
-			throw fromAuthorityError(result.error, result.error.status);
-		}
+	async function refreshAuthoritySession(generation) {
+		const readEpoch = ++sessionReadEpoch;
 		try {
-			return acceptAuthoritySession(normalizeSession(result.data), generation);
+			const response = await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/get-session"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "GET"
+			});
+			if (generation !== authorityGeneration || readEpoch !== sessionReadEpoch) throw new AuthError("state_conflict", 409);
+			return acceptAuthoritySession(normalizeSession(response.value), generation);
 		} catch (error) {
-			if (error instanceof AuthError) throw error;
+			if (generation !== authorityGeneration || readEpoch !== sessionReadEpoch) throw new AuthError("state_conflict", 409);
+			if (error instanceof AuthError && error.code === "state_conflict") throw error;
 			unavailable();
+			if (error instanceof AuthError) throw error;
 			throw authorityUnavailable();
 		}
 	}
+	function getSession() {
+		if (signOutRequest || activeAccountMutationGeneration !== void 0) return Promise.reject(new AuthError("state_conflict", 409));
+		return refreshAuthoritySession(authorityGeneration);
+	}
 	function signOut() {
 		if (signOutRequest) return signOutRequest;
+		if (activeAccountMutationGeneration !== void 0) return Promise.reject(new AuthError("state_conflict", 409));
 		const pendingInvitation = invitationRequest;
 		invitationAbort?.abort();
 		const generation = ++authorityGeneration;
-		locallySignedOut = true;
+		sessionReadEpoch += 1;
 		clearCredential();
 		sessionId = void 0;
+		sessionUserId = void 0;
+		if (betterAuthRefetching) suppressBetterAuthSettlement = true;
+		signalRefreshPending = false;
 		persistence.remove();
+		setAuthState({
+			status: "unavailable",
+			session: null,
+			authoritative: false
+		});
+		emitSession(null);
 		const request = (async () => {
 			await pendingInvitation?.catch(() => void 0);
 			let result;
@@ -3315,13 +3459,11 @@ function createAuthClient(options) {
 				result = await betterAuth.signOut();
 			} catch {
 				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
-				locallySignedOut = false;
 				unavailable();
 				throw authorityUnavailable();
 			}
 			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 			if (result.error) {
-				locallySignedOut = false;
 				unavailable();
 				throw fromAuthorityError(result.error, result.error.status);
 			}
@@ -3330,12 +3472,68 @@ function createAuthClient(options) {
 				session: null,
 				authoritative: true
 			});
+			emitSession(null);
 		})().finally(() => {
-			if (signOutRequest === request) signOutRequest = void 0;
+			if (signOutRequest === request) {
+				signOutRequest = void 0;
+				signalRefreshPending = false;
+			}
 		});
 		signOutRequest = request;
 		return request;
 	}
+	async function runAccountMutation(operation) {
+		if (signOutRequest || activeAccountMutationGeneration !== void 0) throw new AuthError("state_conflict", 409);
+		const pendingInvitation = invitationRequest;
+		invitationAbort?.abort();
+		const generation = ++authorityGeneration;
+		sessionReadEpoch += 1;
+		activeAccountMutationGeneration = generation;
+		clearCredential();
+		sessionId = void 0;
+		sessionUserId = void 0;
+		persistence.remove();
+		setAuthState({
+			status: "unavailable",
+			session: null,
+			authoritative: false
+		});
+		emitSession(null);
+		try {
+			await pendingInvitation?.catch(() => void 0);
+			try {
+				const data = await operation();
+				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+				return {
+					data,
+					session: await refreshAuthoritySession(generation)
+				};
+			} catch (error) {
+				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+				if (error instanceof AuthError) {
+					unavailable();
+					throw error;
+				}
+				unavailable();
+				throw authorityUnavailable();
+			}
+		} finally {
+			if (activeAccountMutationGeneration === generation) {
+				activeAccountMutationGeneration = void 0;
+				if (signalRefreshPending) queueSignalRefresh();
+			}
+		}
+	}
+	async function accountRequest(path, body, mapError = fromAccountAuthorityError) {
+		return (await requestJsonResponse(joinURL(authOrigin, "api/v1/auth", path), {
+			fetch: fetchImpl,
+			timeoutMs,
+			method: "POST",
+			headers: { "content-type": "application/json; charset=utf-8" },
+			body,
+			mapError
+		})).value;
+	}
 	return {
 		acceptInvitation(input) {
 			let invitation;
@@ -3344,7 +3542,7 @@ function createAuthClient(options) {
 			} catch (error) {
 				return Promise.reject(error);
 			}
-			if (signOutRequest || activeSignInGeneration !== void 0 || invitationRequest) return Promise.reject(new AuthError("state_conflict", 409));
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) return Promise.reject(new AuthError("state_conflict", 409));
 			const generation = authorityGeneration;
 			const controller = new AbortController();
 			clearCredential();
@@ -3377,7 +3575,7 @@ function createAuthClient(options) {
 		},
 		getSession,
 		async listOrganizations() {
-			if (signOutRequest || activeSignInGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
 			const generation = authorityGeneration;
 			try {
 				const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organization/list"), {
@@ -3393,37 +3591,60 @@ function createAuthClient(options) {
 			}
 		},
 		async signIn(input) {
-			if (signOutRequest) throw new AuthError("state_conflict", 409);
-			const pendingInvitation = invitationRequest;
-			invitationAbort?.abort();
-			const generation = ++authorityGeneration;
-			activeSignInGeneration = generation;
-			try {
-				await pendingInvitation?.catch(() => void 0);
-				locallySignedOut = false;
-				clearCredential();
-				let result;
-				try {
-					result = await betterAuth.signIn.email({
-						email: input.email,
-						password: input.password
-					});
-				} catch {
-					if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
-					unavailable();
-					throw authorityUnavailable();
-				}
-				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
-				if (result.error) {
-					unavailable();
-					throw fromAuthorityError(result.error, result.error.status);
-				}
-				const session = await getSession();
-				if (!session) throw new AuthError("authentication_required", 401);
-				return session;
-			} finally {
-				if (activeSignInGeneration === generation) activeSignInGeneration = void 0;
-			}
+			const body = {
+				email: normalizeEmail(input?.email),
+				password: normalizePassword(input?.password)
+			};
+			const result = await runAccountMutation(() => accountRequest("sign-in/email", body));
+			if (!result.session) throw new AuthError("authentication_required", 401);
+			return result.session;
+		},
+		async signInWithSocialIdToken(input) {
+			const body = socialIdTokenRequest(normalizeSocialIdTokenInput(input));
+			const result = await runAccountMutation(() => accountRequest("sign-in/social", body, fromSocialIdTokenAuthorityError));
+			if (!result.session) throw new AuthError("authentication_required", 401);
+			return result.session;
+		},
+		async signUp(email, password, name) {
+			const body = {
+				email: normalizeEmail(email),
+				password: normalizePassword(password, "password", 10),
+				name: normalizeName(name)
+			};
+			const result = await runAccountMutation(() => accountRequest("sign-up/email", body));
+			if (!result.session) throw new AuthError("authentication_required", 401);
+			return result.session;
+		},
+		async updateProfile(input) {
+			const body = normalizeProfileInput(input);
+			const result = await runAccountMutation(() => accountRequest("update-user", body));
+			if (!result.session) throw new AuthError("authentication_required", 401);
+			return result.session;
+		},
+		async changePassword(currentPassword, newPassword, revokeOtherSessions = true) {
+			const current = normalizePassword(currentPassword, "currentPassword");
+			const next = normalizePassword(newPassword, "newPassword", 10);
+			if (typeof revokeOtherSessions !== "boolean") throw new TypeError("revokeOtherSessions is invalid");
+			const result = await runAccountMutation(() => accountRequest("change-password", {
+				currentPassword: current,
+				newPassword: next,
+				revokeOtherSessions
+			}));
+			if (!result.session) throw new AuthError("authentication_required", 401);
+			return result.session;
+		},
+		async requestPasswordReset(email, redirectTo) {
+			normalizeVerificationEmailResponse(await accountRequest("request-password-reset", {
+				email: normalizeEmail(email),
+				redirectTo: normalizeSameAppURL(redirectTo, appOrigin, "redirectTo")
+			}));
+		},
+		async resetPassword(token, newPassword) {
+			const body = {
+				token: normalizePasswordResetToken(token),
+				newPassword: normalizePassword(newPassword, "newPassword", 10)
+			};
+			normalizeVerificationEmailResponse((await runAccountMutation(() => accountRequest("reset-password", body))).data);
 		},
 		async sendVerificationEmail(input) {
 			const body = normalizeVerificationEmailInput(input, appOrigin);
@@ -3443,7 +3664,7 @@ function createAuthClient(options) {
 			} catch (error) {
 				return Promise.reject(error);
 			}
-			if (invitationRequest) return Promise.reject(new AuthError("state_conflict", 409));
+			if (invitationRequest || signOutRequest || activeAccountMutationGeneration !== void 0) return Promise.reject(new AuthError("state_conflict", 409));
 			const workspaceKey = workspace.type === "personal" ? "personal" : `organization:${workspace.organizationId}`;
 			if (selectedWorkspaceKey !== workspaceKey) {
 				credential = void 0;
@@ -3480,21 +3701,20 @@ function createAuthClient(options) {
 		},
 		onAuthStateChange(listener) {
 			authStateListeners.add(listener);
-			listener(authState);
+			try {
+				listener(authState);
+			} catch {}
 			startAuthState();
 			return () => authStateListeners.delete(listener);
 		},
 		onSessionChange(listener) {
-			return betterAuth.useSession.subscribe((state) => {
-				let session;
-				try {
-					session = updateSession(normalizeSession(state.data));
-				} catch {
-					clearCredential();
-					session = null;
-				}
-				listener(session);
-			});
+			sessionListeners.add(listener);
+			try {
+				if (authState.status === "authenticated") listener(authState.session);
+				else if (authState.status === "unauthenticated") listener(null);
+			} catch {}
+			startAuthState();
+			return () => sessionListeners.delete(listener);
 		}
 	};
 }

package/dist/server.d.ts

@@ -1,5 +1,4 @@
-import { _ as WorkspaceSelection, c as AuthUser, f as InvitationAcceptance, l as DriveCredential, m as PersonalWorkspaceSelection, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, t as AcceptInvitationInput, u as DriveCredentialInput } from "./types-HSdjQWMZ.js";
-import { n as AuthErrorCode, r as AuthErrorStatus, t as AuthError } from "./errors-Crd93Rah.js";
+import { C as AuthErrorStatus, S as AuthErrorCode, _ as SocialIdTokenInput, b as WorkspaceSelection, c as AuthUser, f as InvitationAcceptance, l as DriveCredential, m as PersonalWorkspaceSelection, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, t as AcceptInvitationInput, u as DriveCredentialInput, v as SocialIdTokenProvider, x as AuthError } from "./types-B1SZbs6Z.js";
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;
@@ -15,13 +14,17 @@ interface ServerSignOutResult {
 interface ServerInvitationAcceptance extends InvitationAcceptance {
   applyCookies(headers: Headers): void;
 }
+interface ServerSocialIdTokenSession extends AuthSession {
+  applyCookies(headers: Headers): void;
+}
 interface FinuevaServerAuth {
   acceptInvitation(input: AcceptInvitationInput): Promise<ServerInvitationAcceptance>;
   getSession(): Promise<AuthSession | null>;
   listOrganizations(): Promise<AuthOrganization[]>;
+  signInWithSocialIdToken(input: SocialIdTokenInput): Promise<ServerSocialIdTokenSession>;
   getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
   signOut(): Promise<ServerSignOutResult>;
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, type WorkspaceSelection, createServerAuth };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type WorkspaceSelection, createServerAuth };