@koolbase/react-native 9.2.0 → 10.0.0

package/dist/auth.js

@@ -1,810 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.KoolbaseAuth = void 0;
-const types_1 = require("./types");
-const auth_errors_1 = require("./auth-errors");
-const auth_storage_1 = require("./auth-storage");
-const device_metadata_1 = require("./device-metadata");
-class KoolbaseAuth {
-    constructor(config) {
-        this.session = null;
-        this.ongoingRefresh = null;
-        this.listeners = new Set();
-        this.config = config;
-        this.metadata = new device_metadata_1.DeviceMetadata(config.appVersion);
-        this.fetchFn = config.fetch ?? ((url, init) => fetch(url, init));
-        this.timeoutMs = config.authTimeout ?? 10000;
-        if (config.authStorage) {
-            this.storage = config.authStorage;
-        }
-        else if ((0, auth_storage_1.isKeychainAvailable)()) {
-            this.storage = new auth_storage_1.SecureAuthStorage();
-        }
-        else {
-            this.storage = null;
-            // eslint-disable-next-line no-console
-            console.warn('[Koolbase] No persistent auth storage available. Sessions will not ' +
-                'survive app restarts. Install react-native-keychain for the ' +
-                'default secure backend, or provide KoolbaseConfig.authStorage ' +
-                'with your own implementation.');
-        }
-    }
-    // ─── Auth state listener ────────────────────────────────────────────────
-    /**
-     * Subscribe to authentication state changes. The listener fires:
-     * - Immediately on subscribe, with the current user (or null).
-     * - On every successful login, register, refresh, session restoration.
-     * - On logout / explicit setSession(null).
-     * - On linkPhone success (user object updated with phone fields).
-     *
-     * Returns an unsubscribe function. Call it when the consumer no longer
-     * needs updates (e.g. in a React useEffect cleanup).
-     *
-     * Listener errors are swallowed so a buggy listener can't break auth
-     * state propagation to other listeners.
-     *
-     * @example
-     * const unsubscribe = auth.onAuthStateChange((user) => {
-     *   setCurrentUser(user);
-     * });
-     * // later:
-     * unsubscribe();
-     */
-    onAuthStateChange(listener) {
-        this.listeners.add(listener);
-        // Fire immediately with current state — matches RN ecosystem
-        // convention (Firebase Auth, Supabase Auth) so consumers don't
-        // need to separately read currentUser on mount.
-        try {
-            listener(this.session?.user ?? null);
-        }
-        catch {
-            // swallow
-        }
-        return () => {
-            this.listeners.delete(listener);
-        };
-    }
-    fireAuthStateChange() {
-        const user = this.session?.user ?? null;
-        for (const listener of this.listeners) {
-            try {
-                listener(user);
-            }
-            catch {
-                // swallow — one broken listener doesn't break others
-            }
-        }
-    }
-    // ─── Headers ────────────────────────────────────────────────────────────
-    /**
-     * Compose the full header set for an outbound request: base headers,
-     * device metadata, and optionally the Authorization bearer token.
-     * Async because device metadata's first build may read from keychain.
-     */
-    async prepareHeaders(includeAuth) {
-        const deviceHeaders = await this.metadata.build();
-        return {
-            'Content-Type': 'application/json',
-            'x-api-key': this.config.publicKey,
-            ...deviceHeaders,
-            ...(includeAuth && this.session
-                ? { Authorization: `Bearer ${this.session.accessToken}` }
-                : {}),
-        };
-    }
-    // ─── Request plumbing ───────────────────────────────────────────────────
-    /**
-     * Low-level request helper used by every endpoint. Wires together:
-     * - The injected fetch implementation (config.fetch or global fetch)
-     * - Device metadata + x-api-key + auth header in one place
-     * - AbortController-based timeout (config.authTimeout, default 10s)
-     *
-     * On timeout, fetch rejects with an AbortError; callers see this as a
-     * non-KoolbaseAuthError exception, which restoreSession() treats as
-     * Offline (preserving optimistic state).
-     */
-    async authRequest(path, options = {}) {
-        const headers = await this.prepareHeaders(options.includeAuth ?? false);
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-        try {
-            return await this.fetchFn(`${this.config.baseUrl}${path}`, {
-                method: options.method ?? 'GET',
-                headers,
-                body: options.body !== undefined ? JSON.stringify(options.body) : undefined,
-                signal: controller.signal,
-            });
-        }
-        finally {
-            clearTimeout(timer);
-        }
-    }
-    /**
-     * Authenticated request wrapper. Refreshes the access token if it's
-     * stale (within 1-min buffer of expiry) before issuing the call, then
-     * delegates to {@link authRequest} with includeAuth=true.
-     */
-    async authedRequest(path, options = {}) {
-        await this._ensureValidToken();
-        return this.authRequest(path, { ...options, includeAuth: true });
-    }
-    // ─── Internal session lifecycle ─────────────────────────────────────────
-    async setSessionInternal(session) {
-        this.session = session;
-        if (this.storage) {
-            try {
-                await this.storage.saveSession(session);
-            }
-            catch (err) {
-                // eslint-disable-next-line no-console
-                console.warn('[Koolbase] Failed to persist session; staying signed in for this ' +
-                    'session only:', err);
-            }
-        }
-        this.fireAuthStateChange();
-    }
-    /**
-     * Discards the stored session without contacting the server.
-     *
-     * For when the session is already known to be unusable — the server rejected
-     * the token, or a build was pointed at a different project and the persisted
-     * session belongs to the old one. Unlike `logout()` there is no server call:
-     * the token has already been refused, and asking for it to be revoked would
-     * only add a round trip that cannot succeed.
-     *
-     * Safe in any state, including with no session at all. The SDK calls this
-     * itself when a request is rejected as unauthenticated, so most apps will not
-     * need to.
-     */
-    async clearStoredSession() {
-        await this.clearSessionInternal();
-    }
-    async clearSessionInternal() {
-        this.session = null;
-        if (this.storage) {
-            try {
-                await this.storage.clear();
-            }
-            catch {
-                // best effort
-            }
-        }
-        this.fireAuthStateChange();
-    }
-    // ─── Session restoration ────────────────────────────────────────────────
-    async restoreSession() {
-        if (!this.storage)
-            return types_1.RestoreResult.NoSession;
-        const persisted = await this.storage.readSession();
-        if (!persisted)
-            return types_1.RestoreResult.NoSession;
-        // Optimistic restore — populate state and fire listener before any
-        // network call. App can render authenticated UI immediately.
-        this.session = persisted;
-        this.fireAuthStateChange();
-        const expiresAt = persisted.expiresAt
-            ? new Date(persisted.expiresAt).getTime()
-            : 0;
-        const oneMinuteMs = 60 * 1000;
-        if (expiresAt > Date.now() + oneMinuteMs) {
-            return types_1.RestoreResult.Restored;
-        }
-        try {
-            await this.refresh(persisted.refreshToken);
-            return types_1.RestoreResult.Restored;
-        }
-        catch (e) {
-            if (e instanceof auth_errors_1.SessionExpiredError ||
-                e instanceof auth_errors_1.TokenRevokedError ||
-                e instanceof auth_errors_1.InvalidCredentialsError) {
-                await this.clearSessionInternal();
-                return types_1.RestoreResult.Expired;
-            }
-            return types_1.RestoreResult.Offline;
-        }
-    }
-    // ─── Public auth API ────────────────────────────────────────────────────
-    async register(params) {
-        if (params.password.length < 8)
-            throw new auth_errors_1.WeakPasswordError();
-        const res = await this.authRequest('/v1/sdk/auth/register', {
-            method: 'POST',
-            body: params,
-        });
-        const session = await this.parseSessionResponse(res, false);
-        await this.setSessionInternal(session);
-        return session.user;
-    }
-    async login(params) {
-        const res = await this.authRequest('/v1/sdk/auth/login', {
-            method: 'POST',
-            body: params,
-        });
-        const session = await this.parseSessionResponse(res, false);
-        await this.setSessionInternal(session);
-        return session;
-    }
-    /**
-   * Sign in with Apple using a credential obtained from a native Apple
-   * Sign-In SDK.
-   *
-   * The SDK is library-agnostic — use any native Apple Sign-In package
-   * (`@invertase/react-native-apple-authentication`, etc.) and pass the
-   * resulting `identityToken`, optional `nonce`, and optional `fullName`.
-   *
-   * `fullName` is meaningful only on first sign-in — Apple omits name
-   * data on subsequent sign-ins. The server persists at link time and
-   * ignores on subsequent sign-ins.
-   *
-   * On success the session is persisted via the configured storage and
-   * `onAuthStateChange` fires with the resolved user.
-   *
-   * @throws AppleSignInNotConfiguredError when Apple is not enabled in
-   *   the dashboard OAuth config for this environment (400).
-   * @throws InvalidAppleTokenError when the token signature, audience,
-   *   expiry, replay, or nonce check failed server-side (401).
-   * @throws UserDisabledError when the account flag is set to disabled (403).
-   * @throws AppleEmailRequiredError when Apple did not return email for
-   *   a new-account sign-in (400).
-   * @throws OAuthEmailConflictError when email matches existing user
-   *   but auto-link rule blocked (409).
-   */
-    async signInWithApple(params) {
-        const body = {
-            identity_token: params.identityToken,
-        };
-        if (params.nonce && params.nonce.length > 0) {
-            body.nonce = params.nonce;
-        }
-        if (params.fullName) {
-            const nameJson = {};
-            if (params.fullName.givenName)
-                nameJson.given_name = params.fullName.givenName;
-            if (params.fullName.familyName)
-                nameJson.family_name = params.fullName.familyName;
-            if (Object.keys(nameJson).length > 0) {
-                body.full_name = nameJson;
-            }
-        }
-        const res = await this.authRequest('/v1/sdk/auth/oauth/apple', {
-            method: 'POST',
-            body,
-        });
-        const session = await this.parseAppleSessionResponse(res);
-        await this.setSessionInternal(session);
-        return session;
-    }
-    /**
-     * Sign in with Google using an idToken from a native Google Sign-In SDK.
-     *
-     * The SDK is library-agnostic — use any native Google Sign-In package
-     * (`@react-native-google-signin/google-signin`, etc.) and pass the
-     * resulting `idToken`. Google embeds the user's name and email in the
-     * idToken itself, so this method does not take a `fullName` parameter
-     * (unlike `signInWithApple`).
-     *
-     * On success the session is persisted via the configured storage and
-     * `onAuthStateChange` fires with the resolved user.
-     *
-     * @throws GoogleSignInNotConfiguredError when Google is not enabled
-     *   in the OAuth config for this environment (400).
-     * @throws InvalidGoogleTokenError when the token signature, audience,
-     *   expiry, replay, or nonce check failed server-side (401).
-     * @throws UserDisabledError when the account flag is set to disabled (403).
-     * @throws GoogleEmailRequiredError when Google did not return email
-     *   for a new-account sign-in (400).
-     * @throws OAuthEmailConflictError when email matches existing user
-     *   but auto-link rule blocked (409).
-     */
-    async signInWithGoogle(params) {
-        const body = {
-            identity_token: params.idToken,
-        };
-        if (params.nonce && params.nonce.length > 0) {
-            body.nonce = params.nonce;
-        }
-        const res = await this.authRequest('/v1/sdk/auth/oauth/google', {
-            method: 'POST',
-            body,
-        });
-        const session = await this.parseGoogleSessionResponse(res);
-        await this.setSessionInternal(session);
-        return session;
-    }
-    /**
-     * Parses a /v1/sdk/auth/oauth/google response. Code-first: the server
-     * emits unified OAuth codes (oauth_not_configured, invalid_oauth_token,
-     * oauth_email_required, oauth_email_conflict) for both providers; the
-     * provider distinction is made here so Google codes map to Google-specific
-     * errors. Status + message logic is retained as a fallback for older servers.
-     */
-    async parseGoogleSessionResponse(res) {
-        if (res.status === 200) {
-            const data = await res.json();
-            return {
-                accessToken: data.access_token,
-                refreshToken: data.refresh_token,
-                expiresAt: data.expires_at,
-                user: this.mapUser(data.user),
-            };
-        }
-        let body = {};
-        try {
-            body = await res.json();
-        }
-        catch {
-            // best-effort error message extraction
-        }
-        const code = body?.code ?? '';
-        const errorMessage = body?.error ?? '';
-        // ─── code-first ───
-        switch (code) {
-            case 'oauth_not_configured':
-                throw new auth_errors_1.GoogleSignInNotConfiguredError();
-            case 'invalid_oauth_token':
-                throw new auth_errors_1.InvalidGoogleTokenError();
-            case 'account_disabled':
-                throw new auth_errors_1.UserDisabledError();
-            case 'oauth_email_required':
-                throw new auth_errors_1.GoogleEmailRequiredError();
-            case 'oauth_email_conflict':
-                throw new auth_errors_1.OAuthEmailConflictError();
-            case 'rate_limit':
-                throw new auth_errors_1.RateLimitError(errorMessage || undefined);
-        }
-        // ─── status + message fallback (pre-code servers) ───
-        if (res.status === 400) {
-            if (errorMessage.includes('not configured')) {
-                throw new auth_errors_1.GoogleSignInNotConfiguredError();
-            }
-            if (errorMessage.includes('did not return email')) {
-                throw new auth_errors_1.GoogleEmailRequiredError();
-            }
-            throw new auth_errors_1.KoolbaseAuthError(`google sign-in failed: ${errorMessage}`, 'google_signin_failed');
-        }
-        if (res.status === 401)
-            throw new auth_errors_1.InvalidGoogleTokenError();
-        if (res.status === 403)
-            throw new auth_errors_1.UserDisabledError();
-        if (res.status === 409)
-            throw new auth_errors_1.OAuthEmailConflictError();
-        if (res.status === 429)
-            throw new auth_errors_1.RateLimitError(errorMessage);
-        throw new auth_errors_1.KoolbaseAuthError(`google sign-in failed: ${res.status} ${errorMessage}`, `google_signin_http_${res.status}`);
-    }
-    /**
-     * Parses a /v1/sdk/auth/oauth/apple response. Code-first; the provider
-     * distinction is made here so the server's unified OAuth codes map to
-     * Apple-specific errors. Status + message logic is retained as a fallback
-     * for older servers.
-     */
-    async parseAppleSessionResponse(res) {
-        if (res.status === 200) {
-            const data = await res.json();
-            return {
-                accessToken: data.access_token,
-                refreshToken: data.refresh_token,
-                expiresAt: data.expires_at,
-                user: this.mapUser(data.user),
-            };
-        }
-        let body = {};
-        try {
-            body = await res.json();
-        }
-        catch {
-            // best-effort error message extraction
-        }
-        const code = body?.code ?? '';
-        const errorMessage = body?.error ?? '';
-        // ─── code-first ───
-        switch (code) {
-            case 'oauth_not_configured':
-                throw new auth_errors_1.AppleSignInNotConfiguredError();
-            case 'invalid_oauth_token':
-                throw new auth_errors_1.InvalidAppleTokenError();
-            case 'account_disabled':
-                throw new auth_errors_1.UserDisabledError();
-            case 'oauth_email_required':
-                throw new auth_errors_1.AppleEmailRequiredError();
-            case 'oauth_email_conflict':
-                throw new auth_errors_1.OAuthEmailConflictError();
-            case 'rate_limit':
-                throw new auth_errors_1.RateLimitError(errorMessage || undefined);
-        }
-        // ─── status + message fallback (pre-code servers) ───
-        if (res.status === 400) {
-            if (errorMessage.includes('not configured')) {
-                throw new auth_errors_1.AppleSignInNotConfiguredError();
-            }
-            if (errorMessage.includes('did not return email')) {
-                throw new auth_errors_1.AppleEmailRequiredError();
-            }
-            throw new auth_errors_1.KoolbaseAuthError(`apple sign-in failed: ${errorMessage}`, 'apple_signin_failed');
-        }
-        if (res.status === 401)
-            throw new auth_errors_1.InvalidAppleTokenError();
-        if (res.status === 403)
-            throw new auth_errors_1.UserDisabledError();
-        if (res.status === 409)
-            throw new auth_errors_1.OAuthEmailConflictError();
-        if (res.status === 429)
-            throw new auth_errors_1.RateLimitError(errorMessage);
-        throw new auth_errors_1.KoolbaseAuthError(`apple sign-in failed: ${res.status} ${errorMessage}`, `apple_signin_http_${res.status}`);
-    }
-    async refresh(refreshToken) {
-        if (this.ongoingRefresh) {
-            return this.ongoingRefresh;
-        }
-        const promise = this._doRefresh(refreshToken);
-        this.ongoingRefresh = promise;
-        promise
-            .catch(() => {
-            // swallow; original promise still rejects to awaiters
-        })
-            .finally(() => {
-            if (this.ongoingRefresh === promise) {
-                this.ongoingRefresh = null;
-            }
-        });
-        return promise;
-    }
-    async _doRefresh(refreshToken) {
-        const token = refreshToken ?? this.session?.refreshToken;
-        if (!token) {
-            throw new auth_errors_1.SessionExpiredError();
-        }
-        const res = await this.authRequest('/v1/sdk/auth/refresh', {
-            method: 'POST',
-            body: { refresh_token: token },
-        });
-        const session = await this.parseSessionResponse(res, true);
-        await this.setSessionInternal(session);
-        return session;
-    }
-    async logout() {
-        let serverSucceeded = true;
-        try {
-            if (this.session) {
-                // Best-effort: don't auto-refresh during logout. If the token's
-                // already expired, we still want to clear local state — server
-                // will reap expired sessions itself.
-                const res = await this.authRequest('/v1/sdk/auth/logout', {
-                    method: 'POST',
-                    includeAuth: true,
-                });
-                if (!res.ok)
-                    serverSucceeded = false;
-            }
-        }
-        catch {
-            serverSucceeded = false;
-        }
-        finally {
-            await this.clearSessionInternal();
-        }
-        return serverSucceeded;
-    }
-    async forgotPassword(email) {
-        const res = await this.authRequest('/v1/sdk/auth/password-reset', {
-            method: 'POST',
-            body: { email },
-        });
-        await this.checkResponse(res);
-    }
-    async resetPassword(token, password) {
-        const res = await this.authRequest('/v1/sdk/auth/password-reset/confirm', {
-            method: 'POST',
-            body: { token, password },
-        });
-        await this.checkResponse(res);
-    }
-    async unlock(token) {
-        const res = await this.authRequest('/v1/sdk/auth/unlock', {
-            method: 'POST',
-            body: { token },
-        });
-        await this.checkResponse(res);
-    }
-    get currentUser() {
-        return this.session?.user ?? null;
-    }
-    get accessToken() {
-        return this.session?.accessToken ?? null;
-    }
-    /**
-     * Currently-valid access token for data-plane requests, refreshing
-     * (via refresh()) if the cached one is near expiry. Returns null when no
-     * session exists or refresh fails — callers then go api-key-only and the
-     * server treats it as having no end-user identity. The db/storage/functions
-     * clients pull from this per request so identity follows the live session.
-     */
-    async validAccessToken() {
-        if (!this.session)
-            return null;
-        try {
-            return await this._ensureValidToken();
-        }
-        catch {
-            return null;
-        }
-    }
-    async setSession(session) {
-        if (session) {
-            await this.setSessionInternal(session);
-        }
-        else {
-            await this.clearSessionInternal();
-        }
-    }
-    // ─── OAuth (DEPRECATED — see v1.10.0) ───────────────────────────────────
-    /**
-     * @deprecated v1.9.0: Server endpoint /v1/sdk/auth/oauth not yet
-     * shipped. This method previously routed to /v1/auth/oauth (dashboard
-     * developer OAuth) which never created project-scoped end-user
-     * sessions. Properly implemented in v1.10.0 with provider-specific
-     * server endpoints under /v1/sdk/auth/oauth/{apple,google,github}.
-     * Use email/password sign-in for now.
-     *
-     * @throws Always throws KoolbaseAuthError('not_implemented').
-     */
-    async oauthLogin(_params) {
-        throw new auth_errors_1.KoolbaseAuthError('OAuth sign-in is not yet implemented for the Koolbase SDK. ' +
-            'Planned for v1.10.0 (server-side endpoints under ' +
-            '/v1/sdk/auth/oauth/{provider}). Use email/password authentication ' +
-            'in the meantime.', 'not_implemented');
-    }
-    // ─── Phone OTP ──────────────────────────────────────────────────────────
-    async sendOtp(params) {
-        this.validatePhone(params.phoneNumber);
-        const res = await this.authRequest('/v1/sdk/auth/phone/send-otp', {
-            method: 'POST',
-            body: { phone_number: params.phoneNumber },
-        });
-        const data = await this.parsePhoneResponse(res);
-        return { expiresAt: data.expires_at };
-    }
-    async verifyOtp(params) {
-        this.validatePhone(params.phoneNumber);
-        const res = await this.authRequest('/v1/sdk/auth/phone/verify-otp', {
-            method: 'POST',
-            body: {
-                phone_number: params.phoneNumber,
-                code: params.code,
-            },
-        });
-        const data = await this.parsePhoneResponse(res);
-        const session = {
-            accessToken: data.access_token,
-            refreshToken: data.refresh_token,
-            expiresAt: data.expires_at,
-            user: this.mapUser(data.user),
-        };
-        await this.setSessionInternal(session);
-        return { session, isNewUser: data.is_new_user ?? false };
-    }
-    async linkPhone(params) {
-        if (!this.session) {
-            throw new auth_errors_1.KoolbaseAuthError('Must be signed in to link a phone number', 'unauthenticated');
-        }
-        this.validatePhone(params.phoneNumber);
-        const res = await this.authedRequest('/v1/sdk/auth/phone/link', {
-            method: 'POST',
-            body: {
-                phone_number: params.phoneNumber,
-                code: params.code,
-            },
-        });
-        const body = await this.parsePhoneResponse(res);
-        // Update local session: prefer the canonical user from the server
-        // response if present; otherwise merge the linked phone into the
-        // existing in-memory user. Either way, setSessionInternal fires the
-        // auth state listener so consumers can react to the phone link.
-        if (this.session) {
-            const updatedUser = body.user
-                ? this.mapUser(body.user)
-                : {
-                    ...this.session.user,
-                    phoneNumber: params.phoneNumber,
-                    phoneVerified: true,
-                };
-            await this.setSessionInternal({
-                ...this.session,
-                user: updatedUser,
-            });
-        }
-    }
-    // ─── Cleanup ────────────────────────────────────────────────────────────
-    /**
-     * Release resources held by this auth client. Clears the in-memory
-     * listener set. Does not invalidate sessions or clear storage — call
-     * {@link logout} for that.
-     */
-    dispose() {
-        this.listeners.clear();
-    }
-    // ─── Helpers ────────────────────────────────────────────────────────────
-    validatePhone(phoneNumber) {
-        if (!/^\+[1-9]\d{6,14}$/.test(phoneNumber)) {
-            throw new auth_errors_1.InvalidPhoneNumberError();
-        }
-    }
-    async _ensureValidToken() {
-        if (this.session && this.session.expiresAt) {
-            const expiresAt = new Date(this.session.expiresAt).getTime();
-            if (Date.now() < expiresAt - 60 * 1000) {
-                return this.session.accessToken;
-            }
-        }
-        if (!this.session) {
-            throw new auth_errors_1.SessionExpiredError();
-        }
-        try {
-            const session = await this.refresh();
-            return session.accessToken;
-        }
-        catch (e) {
-            if (e instanceof auth_errors_1.KoolbaseAuthError)
-                throw e;
-            throw new auth_errors_1.SessionExpiredError();
-        }
-    }
-    mapUser(raw) {
-        return {
-            id: raw.id,
-            email: raw.email ?? '',
-            phoneNumber: raw.phone_number,
-            phoneVerified: raw.phone_verified ?? false,
-            fullName: raw.full_name,
-            avatarUrl: raw.avatar_url,
-            verified: raw.verified ?? false,
-            createdAt: raw.created_at,
-        };
-    }
-    /**
-     * Parse a session-returning response (login, register, refresh).
-     * Non-2xx is delegated to throwTypedError, which is code-first
-     * (reads body.code) with a status/message fallback. isRefresh only
-     * affects how a bare 401 (no code, older server) is interpreted.
-     */
-    async parseSessionResponse(res, isRefresh) {
-        if (!res.ok)
-            await this.throwTypedError(res, isRefresh); // never returns
-        const data = await res.json();
-        return {
-            accessToken: data.access_token,
-            refreshToken: data.refresh_token,
-            expiresAt: data.expires_at,
-            user: this.mapUser(data.user),
-        };
-    }
-    async checkResponse(res) {
-        if (res.ok)
-            return;
-        await this.throwTypedError(res);
-    }
-    /**
-     * Map a non-2xx credential/session response to a typed error.
-     *
-     * Code-first: the server now emits a stable `code` on every error
-     * (contract conformance), so we switch on body.code. The status +
-     * message logic is retained as a fallback for older servers or any
-     * response that arrives without a code. isRefresh only changes how a
-     * bare 401 is interpreted in the fallback path.
-     */
-    async throwTypedError(res, isRefresh = false) {
-        let body = {};
-        try {
-            body = await res.json();
-        }
-        catch {
-            // ignore
-        }
-        const code = body.code ?? '';
-        const msg = body.error ?? '';
-        // ─── code-first ───
-        switch (code) {
-            case 'invalid_credentials':
-                throw new auth_errors_1.InvalidCredentialsError();
-            case 'email_in_use':
-                throw new auth_errors_1.EmailAlreadyInUseError();
-            case 'account_disabled':
-                throw new auth_errors_1.UserDisabledError();
-            case 'account_locked':
-                throw new auth_errors_1.AccountLockedError();
-            case 'invalid_refresh_token':
-                // Refresh token rejected — the session is unrecoverable; re-login.
-                throw new auth_errors_1.SessionExpiredError();
-            case 'token_revoked':
-                throw new auth_errors_1.TokenRevokedError();
-            case 'invalid_unlock_token':
-                throw new auth_errors_1.UnlockTokenInvalidError();
-            case 'rate_limit':
-                throw new auth_errors_1.RateLimitError(msg || undefined);
-        }
-        // ─── status fallback (pre-code servers) ───
-        if (res.status === 409)
-            throw new auth_errors_1.EmailAlreadyInUseError();
-        if (res.status === 401) {
-            throw isRefresh ? new auth_errors_1.SessionExpiredError() : new auth_errors_1.InvalidCredentialsError();
-        }
-        if (res.status === 403)
-            throw new auth_errors_1.UserDisabledError();
-        if (res.status === 429) {
-            if (msg.includes('account temporarily locked')) {
-                throw new auth_errors_1.AccountLockedError();
-            }
-            throw new auth_errors_1.RateLimitError(msg || undefined);
-        }
-        // ─── legacy message fallback ───
-        if (msg.includes('invalid or expired unlock token')) {
-            throw new auth_errors_1.UnlockTokenInvalidError();
-        }
-        if (msg.includes('session revoked') ||
-            msg.includes('token revoked') ||
-            msg.includes('session has been revoked')) {
-            throw new auth_errors_1.TokenRevokedError();
-        }
-        throw new auth_errors_1.KoolbaseAuthError(msg || `Request failed: ${res.status}`, code || `http_${res.status}`);
-    }
-    /**
-     * Parse a phone-auth response. Code-first, with a phone-specific twist:
-     * the server emits the generic `rate_limit` code for the phone endpoints
-     * (they share the default 429), but phone has a dedicated server-side
-     * rate-limiter, so we surface OtpRateLimitError rather than RateLimitError.
-     * Status + message logic is retained as a fallback for older servers.
-     */
-    async parsePhoneResponse(res) {
-        let body = {};
-        try {
-            body = await res.json();
-        }
-        catch {
-            // ignore
-        }
-        if (res.ok)
-            return body;
-        const code = body.code ?? '';
-        const msg = body.error ?? '';
-        // ─── code-first ───
-        switch (code) {
-            case 'invalid_phone':
-                throw new auth_errors_1.InvalidPhoneNumberError();
-            case 'otp_expired':
-                throw new auth_errors_1.OtpExpiredError();
-            case 'otp_invalid':
-                throw new auth_errors_1.OtpInvalidError();
-            case 'otp_max_attempts':
-                throw new auth_errors_1.OtpMaxAttemptsError();
-            case 'phone_in_use':
-                throw new auth_errors_1.PhoneAlreadyLinkedError();
-            case 'sms_not_configured':
-                throw new auth_errors_1.SmsConfigMissingError();
-            case 'rate_limit':
-                throw new auth_errors_1.OtpRateLimitError();
-        }
-        // ─── status fallback (pre-code servers) ───
-        if (res.status === 429)
-            throw new auth_errors_1.OtpRateLimitError();
-        if (res.status === 409)
-            throw new auth_errors_1.PhoneAlreadyLinkedError();
-        // ─── legacy message fallback ───
-        if (msg.includes('E.164'))
-            throw new auth_errors_1.InvalidPhoneNumberError();
-        if (msg.includes('OTP has expired'))
-            throw new auth_errors_1.OtpExpiredError();
-        if (msg.includes('too many incorrect attempts')) {
-            throw new auth_errors_1.OtpMaxAttemptsError();
-        }
-        if (msg.includes('invalid OTP') ||
-            msg.includes('invalid or expired OTP')) {
-            throw new auth_errors_1.OtpInvalidError();
-        }
-        if (msg.includes('SMS provider not configured')) {
-            throw new auth_errors_1.SmsConfigMissingError();
-        }
-        throw new auth_errors_1.KoolbaseAuthError(msg || 'An unexpected error occurred', code || undefined);
-    }
-}
-exports.KoolbaseAuth = KoolbaseAuth;