@missionmind/auth-front 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MissionMind
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,73 @@
-# Temporary Holding Version
+# @missionmind/auth-front
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Better Auth in an Expo app whose users start anonymous on a device and sign in
+later. The server side is [`@missionmind/auth-api`](https://www.npmjs.com/package/@missionmind/auth-api).
+
+```sh
+npx expo install @missionmind/auth-front expo-secure-store expo-crypto \
+  expo-constants expo-web-browser expo-apple-authentication \
+  @react-native-google-signin/google-signin @legendapp/state
+```
+
+The native modules, `@legendapp/state` and `react` are peer dependencies the
+app installs itself.
+
+## What it does
+
+- **One account per device, created once.** `ensureAccount()` signs the
+  device in anonymously (at the end of onboarding, say); `ensureSession()` and
+  `recoverSession()` only ever bring back the account it holds, never create
+  one. Concurrent callers share one run, with retries and backoff.
+- **A device token in the keychain** (`<prefix>.device-token`, issued per
+  device id) gets a new session whenever the last one died. If the account is
+  gone: an anonymous one starts over (`onStartOver`), a registered one sets
+  `isSignInRequired$` for the app to ask the user to sign in.
+- **Sign-in** with email, Apple (native sheet on iOS, the API's web flow on
+  Android) or Google replaces an anonymous account; **linking** Apple or Google
+  keeps it. The device token is reissued for the new account.
+- The session itself is better-auth's: the Expo plugin keeps the cookie in the
+  keychain and caches `/get-session`, so the user is known offline.
+  `holdsNoAccount()` and `readStoredCookie()` answer synchronously, before the
+  first render.
+
+## Usage
+
+```ts
+import { createAuthSession, createExpoAuthClient } from "@missionmind/auth-front";
+
+export const expoAuthClient = createExpoAuthClient({
+  baseURL: API_URL,
+  scheme: "myapp",
+  storagePrefix: "myapp", // keychain: myapp_cookie, myapp.device-token…
+});
+export const { authClient } = expoAuthClient;
+
+export const {
+  ensureAccount, ensureSession, recoverSession, initializeAuth, holdsNoAccount,
+  isSignInRequired$, useAuthSession, signInWithEmail, signInWithApple,
+  signInWithGoogle, linkWithApple, linkWithGoogle, requestPasswordReset,
+  resetPassword, signOut, rememberAccountKind, rememberAccountUser,
+} = createAuthSession(expoAuthClient, {
+  signInOrigin: "myapp://", // sent as expo-origin: one of the API's trusted origins
+  passwordResetUrl: `${API_URL}/reset-password`,
+  apple: { webSignInUrl: `${API_URL}/auth/apple/start` },
+  google: { webClientId: GOOGLE_WEB_CLIENT_ID, iosClientId: GOOGLE_IOS_CLIENT_ID },
+  // All optional:
+  onStartOver: () => clearLocalData(),
+  onAccountSignedIn: ({ isSameAccount }) => (isSameAccount ? syncLocalData() : clearLocalData()),
+  onAnonymousAccountReplaced: (userId) => transferPurchases(userId),
+  trackAction: (action, props, run) => run(),
+  onPasswordReset: () => {},
+  onSignOut: () => {},
+  reportError: (error) => {},
+  legacyStorageKeys: [],
+});
+```
+
+- Call `initializeAuth()` once at launch, and `recoverSession()` when the API
+  answers 401.
+- Sign-ins throw `AuthenticationError` (`code` is Better Auth's error code) and
+  resolve false when the user backs out of the Apple or Google sheet.
+- Android's Apple sign-in answers on `<scheme>://apple-auth`
+  (`APPLE_WEB_SIGN_IN_APP_PATH`): let `+native-intent` consume it rather than
+  navigate.

package/dist/apple-id-token.android.d.ts

@@ -0,0 +1,7 @@
+export declare function getAppleIdToken({ webSignInUrl, }: {
+    webSignInUrl: string;
+}): Promise<{
+    token: string;
+    nonce: string;
+} | null>;
+//# sourceMappingURL=apple-id-token.android.d.ts.map

package/dist/apple-id-token.android.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-id-token.android.d.ts","sourceRoot":"","sources":["../src/apple-id-token.android.ts"],"names":[],"mappings":"AAWA,wBAAsB,eAAe,CAAC,EACpC,YAAY,GACb,EAAE;IACD,YAAY,EAAE,MAAM,CAAC;CACtB;;;UA0CA"}

package/dist/apple-id-token.android.js

@@ -0,0 +1,39 @@
+import Constants from "expo-constants";
+import { CryptoDigestAlgorithm, digestStringAsync, randomUUID, } from "expo-crypto";
+import { openAuthSessionAsync } from "expo-web-browser";
+import { APPLE_WEB_SIGN_IN_APP_PATH } from "./apple-web-sign-in";
+const USER_CANCELLED = "user_cancelled_authorize";
+export async function getAppleIdToken({ webSignInUrl, }) {
+    const scheme = Constants.expoConfig?.scheme;
+    if (typeof scheme !== "string") {
+        throw new Error("No app scheme");
+    }
+    const state = randomUUID();
+    const nonce = randomUUID();
+    // Apple embeds the hash; the server checks it against the raw nonce, so a
+    // token caught on its way through the deep link cannot be replayed.
+    const hashedNonce = await digestStringAsync(CryptoDigestAlgorithm.SHA256, nonce);
+    const startUrl = `${webSignInUrl}?${new URLSearchParams({
+        scheme,
+        state,
+        nonce: hashedNonce,
+    }).toString()}`;
+    const result = await openAuthSessionAsync(startUrl, `${scheme}://${APPLE_WEB_SIGN_IN_APP_PATH}`);
+    if (result.type !== "success") {
+        return null;
+    }
+    const params = new URL(result.url).searchParams;
+    if (params.get("state") !== state) {
+        throw new Error("Apple sign-in state mismatch");
+    }
+    const error = params.get("error");
+    if (error === USER_CANCELLED) {
+        return null;
+    }
+    const token = params.get("id_token");
+    if (!token) {
+        throw new Error(`Apple sign-in failed: ${error ?? "no identity token"}`);
+    }
+    return { token, nonce };
+}
+//# sourceMappingURL=apple-id-token.android.js.map

package/dist/apple-id-token.android.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-id-token.android.js","sourceRoot":"","sources":["../src/apple-id-token.android.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,gBAAgB,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,YAAY,GAGb;IACC,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,WAAW,GAAG,MAAM,iBAAiB,CACzC,qBAAqB,CAAC,MAAM,EAC5B,KAAK,CACN,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,YAAY,IAAI,IAAI,eAAe,CAAC;QACtD,MAAM;QACN,KAAK;QACL,KAAK,EAAE,WAAW;KACnB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAEhB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,QAAQ,EACR,GAAG,MAAM,MAAM,0BAA0B,EAAE,CAC5C,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChD,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,IAAI,mBAAmB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC"}

package/dist/apple-id-token.d.ts

@@ -0,0 +1,12 @@
+/**
+ * An Apple identity token for `authClient.signIn.social` / `linkSocial`:
+ * from the native sheet on iOS (`.ios.ts`), from Apple's web sign-in in a
+ * browser tab on Android (`.android.ts`, opening `webSignInUrl`: the API's
+ * `createAppleWebSignInRouter` `/start`). Resolves null when the user backs out.
+ */
+export declare function getAppleIdToken(options: {
+  webSignInUrl: string;
+}): Promise<{
+  nonce?: string;
+  token: string;
+} | null>;

package/dist/apple-id-token.ios.d.ts

@@ -0,0 +1,7 @@
+/** The native sheet: no web sign-in on iOS. */
+export declare function getAppleIdToken(_options: {
+    webSignInUrl: string;
+}): Promise<{
+    token: string;
+} | null>;
+//# sourceMappingURL=apple-id-token.ios.d.ts.map

package/dist/apple-id-token.ios.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-id-token.ios.d.ts","sourceRoot":"","sources":["../src/apple-id-token.ios.ts"],"names":[],"mappings":"AAGA,+CAA+C;AAC/C,wBAAsB,eAAe,CAAC,QAAQ,EAAE;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE;;UAsBvE"}

package/dist/apple-id-token.ios.js

@@ -0,0 +1,25 @@
+// biome-ignore lint/performance/noNamespaceImport: needed for expo-apple-authentication
+import * as AppleAuthentication from "expo-apple-authentication";
+/** The native sheet: no web sign-in on iOS. */
+export async function getAppleIdToken(_options) {
+    try {
+        const credential = await AppleAuthentication.signInAsync({
+            requestedScopes: [
+                AppleAuthentication.AppleAuthenticationScope.FULL_NAME,
+                AppleAuthentication.AppleAuthenticationScope.EMAIL,
+            ],
+        });
+        if (!credential.identityToken) {
+            throw new Error("No identity token");
+        }
+        return { token: credential.identityToken };
+        // biome-ignore lint/suspicious/noExplicitAny: tmp fix
+    }
+    catch (err) {
+        if (err.code === "ERR_REQUEST_CANCELED") {
+            return null;
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=apple-id-token.ios.js.map

package/dist/apple-id-token.ios.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-id-token.ios.js","sourceRoot":"","sources":["../src/apple-id-token.ios.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,OAAO,KAAK,mBAAmB,MAAM,2BAA2B,CAAC;AAEjE,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAkC;IACtE,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC;YACvD,eAAe,EAAE;gBACf,mBAAmB,CAAC,wBAAwB,CAAC,SAAS;gBACtD,mBAAmB,CAAC,wBAAwB,CAAC,KAAK;aACnD;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC;QAC3C,sDAAsD;IACxD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/apple-web-sign-in.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The deep link path Apple's web sign-in (Android) answers on:
+ * `<scheme>://apple-auth`, as the API's `createAppleWebSignInRouter` sends it.
+ * The app should consume it rather than navigate to it (Expo Router's
+ * `+native-intent`).
+ */
+export declare const APPLE_WEB_SIGN_IN_APP_PATH = "apple-auth";
+//# sourceMappingURL=apple-web-sign-in.d.ts.map

package/dist/apple-web-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-web-sign-in.d.ts","sourceRoot":"","sources":["../src/apple-web-sign-in.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,eAAe,CAAC"}

package/dist/apple-web-sign-in.js

@@ -0,0 +1,8 @@
+/**
+ * The deep link path Apple's web sign-in (Android) answers on:
+ * `<scheme>://apple-auth`, as the API's `createAppleWebSignInRouter` sends it.
+ * The app should consume it rather than navigate to it (Expo Router's
+ * `+native-intent`).
+ */
+export const APPLE_WEB_SIGN_IN_APP_PATH = "apple-auth";
+//# sourceMappingURL=apple-web-sign-in.js.map

package/dist/apple-web-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-web-sign-in.js","sourceRoot":"","sources":["../src/apple-web-sign-in.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,130 @@
+export interface ExpoAuthClientOptions {
+    /** The API's URL, where Better Auth is served (`/api/auth`). */
+    baseURL: string;
+    /** This build's deep link scheme, for the Expo plugin's browser flows. */
+    scheme: string;
+    /**
+     * Prefix of what is kept in the keychain: the session cookie
+     * (`<prefix>_cookie`) and, with `createAuthSession`, the device token and
+     * the account records (`<prefix>.device-token`…).
+     */
+    storagePrefix: string;
+}
+/**
+ * The Better Auth client of an Expo app: the anonymous plugin, and the Expo
+ * plugin keeping the session cookie in the keychain, which also caches each
+ * `/get-session` reply there so the user is known before the first one comes
+ * back, and while offline.
+ */
+export declare function createExpoAuthClient(options: ExpoAuthClientOptions): {
+    authClient: import("better-auth/react").ReactAuthClient<{
+        baseURL: string;
+        sessionOptions: {
+            refetchInterval: number;
+            refetchOnWindowFocus: false;
+            refetchWhenOffline: false;
+        };
+        plugins: ({
+            id: "anonymous";
+            version: string;
+            $InferServerPlugin: ReturnType<typeof import("better-auth/plugins").anonymous>;
+            pathMethods: {
+                "/sign-in/anonymous": "POST";
+                "/delete-anonymous-user": "POST";
+            };
+            atomListeners: {
+                matcher: (path: string) => path is "/sign-in/anonymous";
+                signal: "$sessionSignal";
+            }[];
+            $ERROR_CODES: {
+                FAILED_TO_CREATE_USER: import("better-auth").RawError<"FAILED_TO_CREATE_USER">;
+                INVALID_EMAIL_FORMAT: import("better-auth").RawError<"INVALID_EMAIL_FORMAT">;
+                COULD_NOT_CREATE_SESSION: import("better-auth").RawError<"COULD_NOT_CREATE_SESSION">;
+                ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY: import("better-auth").RawError<"ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY">;
+                FAILED_TO_DELETE_ANONYMOUS_USER: import("better-auth").RawError<"FAILED_TO_DELETE_ANONYMOUS_USER">;
+                FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS: import("better-auth").RawError<"FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS">;
+                USER_IS_NOT_ANONYMOUS: import("better-auth").RawError<"USER_IS_NOT_ANONYMOUS">;
+                DELETE_ANONYMOUS_USER_DISABLED: import("better-auth").RawError<"DELETE_ANONYMOUS_USER_DISABLED">;
+            };
+        } | {
+            id: "expo";
+            version: string;
+            getActions(_fetch: unknown, $store: import("better-auth").ClientStore): {
+                getCookie: () => Promise<string>;
+            };
+            fetchPlugins: {
+                id: string;
+                name: string;
+                hooks: {
+                    onSuccess(context: import("@better-fetch/fetch").SuccessContext<any>): Promise<void>;
+                };
+                init(url: string, options: ({
+                    method?: string | undefined;
+                    window?: null | undefined;
+                    redirect?: RequestRedirect | undefined;
+                    cache?: RequestCache | undefined;
+                    credentials?: RequestCredentials | undefined;
+                    integrity?: string | undefined;
+                    keepalive?: boolean | undefined;
+                    mode?: RequestMode | undefined;
+                    priority?: RequestPriority | undefined;
+                    referrer?: string | undefined;
+                    referrerPolicy?: ReferrerPolicy | undefined;
+                    signal?: (AbortSignal | null) | undefined;
+                } & {
+                    onRequest?: (<T extends Record<string, any>>(context: import("@better-fetch/fetch").RequestContext<T>) => Promise<import("@better-fetch/fetch").RequestContext | void> | import("@better-fetch/fetch").RequestContext | void) | undefined;
+                    onResponse?: ((context: import("@better-fetch/fetch").ResponseContext) => Promise<Response | void | import("@better-fetch/fetch").ResponseContext> | Response | import("@better-fetch/fetch").ResponseContext | void) | undefined;
+                    onSuccess?: ((context: import("@better-fetch/fetch").SuccessContext<any>) => Promise<void> | void) | undefined;
+                    onError?: ((context: import("@better-fetch/fetch").ErrorContext) => Promise<void> | void) | undefined;
+                    onRetry?: ((response: import("@better-fetch/fetch").ResponseContext) => Promise<void> | void) | undefined;
+                    hookOptions?: {
+                        cloneResponse?: boolean;
+                    } | undefined;
+                    timeout?: number | undefined;
+                    customFetchImpl?: import("@better-fetch/fetch").FetchEsque | undefined;
+                    plugins?: import("@better-fetch/fetch").BetterFetchPlugin[] | undefined;
+                    baseURL?: string | undefined;
+                    throw?: boolean | undefined;
+                    auth?: ({
+                        type: "Bearer";
+                        token: string | Promise<string | undefined> | (() => string | Promise<string | undefined> | undefined) | undefined;
+                    } | {
+                        type: "Basic";
+                        username: string | (() => string | undefined) | undefined;
+                        password: string | (() => string | undefined) | undefined;
+                    } | {
+                        type: "Custom";
+                        prefix: string | (() => string | undefined) | undefined;
+                        value: string | (() => string | undefined) | undefined;
+                    }) | undefined;
+                    headers?: {} | {
+                        [x: string]: string | undefined;
+                        accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
+                        "content-type"?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream" | "application/x-www-form-urlencoded" | "multipart/form-data") | undefined;
+                        authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
+                    } | undefined;
+                    body?: any;
+                    query?: any;
+                    params?: any;
+                    duplex?: "full" | "half" | undefined;
+                    jsonParser?: ((text: string) => Promise<any> | any) | undefined;
+                    retry?: import("@better-fetch/fetch").RetryOptions | undefined;
+                    retryAttempt?: number | undefined;
+                    method?: ("POST" | "PUT" | "DELETE" | "PATCH" | "GET" | "HEAD" | "OPTIONS" | (string & {})) | undefined;
+                    output?: (import("@better-fetch/fetch").StandardSchemaV1 | typeof Blob | typeof File) | undefined;
+                    errorSchema?: import("@better-fetch/fetch").StandardSchemaV1 | undefined;
+                    disableValidation?: boolean | undefined;
+                    signal?: (AbortSignal | null) | undefined;
+                } & Record<string, any>) | undefined): Promise<{
+                    url: string;
+                    options: import("better-auth").ClientFetchOption;
+                }>;
+            }[];
+        })[];
+    }>;
+    readStoredCookie: () => string;
+    storagePrefix: string;
+};
+export type ExpoAuthClient = ReturnType<typeof createExpoAuthClient>;
+export type AuthClient = ExpoAuthClient["authClient"];
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BA0Cy6E,CAAC;0BAAkC,CAAC;4BAAkC,CAAC;yBAA0C,CAAC;+BAA6C,CAAC;6BAAiD,CAAC;6BAAqC,CAAC;wBAAiC,CAAC;4BAAyC,CAAC;4BAA6C,CAAC;kCAA0C,CAAC;0BAA0C,CAAC;;6BAA6D,CAAC;8BAAiP,CAAC;6BAAuO,CAAC;2BAAmH,CAAC;2BAA4G,CAAC;+BAAoH,CAAC;qCAAyB,CAAC;;2BAA6C,CAAC;mCAA2C,CAAC;2BAAqE,CAAC;2BAA8E,CAAC;yBAAiC,CAAC;wBAAiC,CAAC;;;;;;;;;;;;2BAA0gB,CAAC;;8BAAgE,CAAC;sCAAsH,CAAC;qCAAmL,CAAC;;wBAAuG,CAAC;yBAAkB,CAAC;0BAAmB,CAAC;0BAAmB,CAAC;8BAA+C,CAAC;yBAAiE,CAAC;gCAA4E,CAAC;0BAAkC,CAAC;0BAA8G,CAAC;+BAA6G,CAAC;qCAAqF,CAAC;0BAAmC,CAAC;;;;;;;;4BAbnqL,MAAM;;EASpC;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACrE,MAAM,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC"}

package/dist/client.js

@@ -0,0 +1,48 @@
+import { expoClient, getCookie, storageAdapter, } from "@better-auth/expo/client";
+import { anonymousClient } from "better-auth/client/plugins";
+import { createAuthClient } from "better-auth/react";
+// biome-ignore lint/performance/noNamespaceImport: needed for better-auth/expo
+import * as SecureStore from "expo-secure-store";
+/**
+ * The Better Auth client of an Expo app: the anonymous plugin, and the Expo
+ * plugin keeping the session cookie in the keychain, which also caches each
+ * `/get-session` reply there so the user is known before the first one comes
+ * back, and while offline.
+ */
+export function createExpoAuthClient(options) {
+    const { storagePrefix } = options;
+    const authClient = createAuthClient({
+        baseURL: options.baseURL,
+        sessionOptions: {
+            refetchInterval: 60 * 60 * 24, // 24 hours
+            refetchOnWindowFocus: false,
+            refetchWhenOffline: false,
+        },
+        plugins: [
+            anonymousClient(),
+            expoClient({
+                scheme: options.scheme,
+                storagePrefix,
+                storage: SecureStore,
+            }),
+        ],
+    });
+    const cookieStorage = storageAdapter(SecureStore);
+    /**
+     * The session cookie the Expo plugin keeps in the keychain, read
+     * synchronously — for the root layout, which decides before the first
+     * render. Everything else reads it with `authClient.getCookie()`, which is
+     * asynchronous since better-auth 1.7. A keychain that cannot be read counts
+     * as empty.
+     */
+    function readStoredCookie() {
+        try {
+            return getCookie(cookieStorage.getItem(`${storagePrefix}_cookie`));
+        }
+        catch {
+            return "";
+        }
+    }
+    return { authClient, readStoredCookie, storagePrefix };
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,SAAS,EACT,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,+EAA+E;AAC/E,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AAejD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAElC,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE;YACd,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW;YAC1C,oBAAoB,EAAE,KAAK;YAC3B,kBAAkB,EAAE,KAAK;SAC1B;QACD,OAAO,EAAE;YACP,eAAe,EAAE;YACjB,UAAU,CAAC;gBACT,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,aAAa;gBACb,OAAO,EAAE,WAAW;aACrB,CAAC;SACH;KACF,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAElD;;;;;;OAMG;IACH,SAAS,gBAAgB;QACvB,IAAI,CAAC;YACH,OAAO,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,aAAa,SAAS,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;AACzD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+/** biome-ignore-all lint/performance/noBarrelFile: the package's entry point */
+export { APPLE_WEB_SIGN_IN_APP_PATH } from "./apple-web-sign-in";
+export { type AuthClient, createExpoAuthClient, type ExpoAuthClient, type ExpoAuthClientOptions, } from "./client";
+export { type AuthAction, type AuthActionProps, AuthenticationError, type AuthProvider, type AuthSession, type AuthSessionOptions, createAuthSession, } from "./session";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EACL,KAAK,UAAU,EACf,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,iBAAiB,GAClB,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+/** biome-ignore-all lint/performance/noBarrelFile: the package's entry point */
+export { APPLE_WEB_SIGN_IN_APP_PATH } from "./apple-web-sign-in";
+export { createExpoAuthClient, } from "./client";
+export { AuthenticationError, createAuthSession, } from "./session";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAEL,oBAAoB,GAGrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAGL,mBAAmB,EAInB,iBAAiB,GAClB,MAAM,WAAW,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,132 @@
+import type { ExpoAuthClient } from "./client";
+export type AuthProvider = "email" | "apple" | "google";
+export type AuthAction = "sign_in" | "link_account";
+/** Where a sign-in started (`sign_in` by default), or `settings` for a link. */
+export interface AuthActionProps<EntryPoint extends string = string> {
+    entry_point: EntryPoint | "sign_in" | "settings";
+    provider: AuthProvider;
+}
+export interface AuthSessionOptions<EntryPoint extends string = string> {
+    apple: {
+        /**
+         * Apple's web sign-in on Android: the API's `createAppleWebSignInRouter`
+         * `/start` (`<api>/auth/apple/start`).
+         */
+        webSignInUrl: string;
+    };
+    google: {
+        /** The iOS OAuth client. */
+        iosClientId?: string;
+        /** The web OAuth client, whose id tokens the API verifies. */
+        webClientId?: string;
+    };
+    /**
+     * Keychain items an earlier version of the app wrote and nothing reads any
+     * more, deleted at launch.
+     */
+    legacyStorageKeys?: readonly string[];
+    /**
+     * The user's data on this device belongs to another account, or to none:
+     * a sign-in into another account (`isSameAccount` false) or back into the
+     * same one, or a device left without an account (`onStartOver`).
+     */
+    onAccountSignedIn?: (change: {
+        isSameAccount: boolean;
+        userId: string | undefined;
+    }) => Promise<void> | void;
+    /**
+     * An anonymous account was replaced by the account the user signed into,
+     * which the server deletes: hand over what is kept outside the API
+     * (purchases). Must not throw.
+     */
+    onAnonymousAccountReplaced?: (userId: string) => Promise<void> | void;
+    /** A password reset was requested or submitted (analytics). */
+    onPasswordReset?: () => void;
+    /** The user signs out (analytics). Called first. */
+    onSignOut?: () => void;
+    /**
+     * The device has no account any more (signed out, or its anonymous account
+     * is gone): empty what it kept of the old one.
+     */
+    onStartOver?: () => Promise<void> | void;
+    /**
+     * Where the password reset email's link leads: the API's
+     * `createResetPasswordRouter`.
+     */
+    passwordResetUrl: string;
+    /** Errors worth hearing about, beside the console (Sentry). */
+    reportError?: (error: unknown) => void;
+    /**
+     * The origin id-token sign-ins (Apple, Google) send as `expo-origin`: one of
+     * the API's trusted origins, such as `myapp://`.
+     */
+    signInOrigin: string;
+    /**
+     * Wraps each sign-in and link (analytics). `run` resolves false when the user
+     * backed out. Must return what `run` returned, and rethrow what it threw.
+     */
+    trackAction?: (action: AuthAction, props: AuthActionProps<EntryPoint>, run: () => Promise<boolean>) => Promise<boolean>;
+}
+export declare class AuthenticationError extends Error {
+    code: string;
+    constructor(status: number, code: string);
+}
+/**
+ * The account a device holds, and everything that signs it in and out.
+ *
+ * A device gets an anonymous account once (`ensureAccount`), and a long-lived
+ * device token in the keychain that brings that account back whenever its
+ * session dies (`ensureSession`, `recoverSession`). Signing in with an email,
+ * Apple or Google replaces an anonymous account (the server hands its data
+ * over), linking Apple or Google keeps it. A registered account that cannot be
+ * recovered asks the user to sign in (`isSignInRequired$`); an anonymous one
+ * starts over.
+ */
+export declare function createAuthSession<EntryPoint extends string = string>(client: ExpoAuthClient, options: AuthSessionOptions<EntryPoint>): {
+    ensureAccount: () => Promise<boolean>;
+    ensureSession: () => Promise<boolean>;
+    hasSessionCookie: () => Promise<boolean>;
+    holdsNoAccount: () => boolean;
+    initializeAuth: () => Promise<void>;
+    isSignInRequired$: import("@legendapp/state").ObservableBoolean<boolean>;
+    linkWithApple: () => Promise<boolean>;
+    linkWithGoogle: () => Promise<boolean>;
+    recoverSession: () => Promise<boolean>;
+    rememberAccountKind: (isAnonymous: boolean) => Promise<void>;
+    rememberAccountUser: (userId: string) => Promise<void>;
+    requestPasswordReset: (email: string) => Promise<void>;
+    resetPassword: (newPassword: string, token: string) => Promise<void>;
+    signInWithApple: (entryPoint?: EntryPoint | "sign_in") => Promise<boolean>;
+    signInWithEmail: (email: string, password: string, entryPoint?: EntryPoint | "sign_in") => Promise<boolean>;
+    signInWithGoogle: (entryPoint?: EntryPoint | "sign_in") => Promise<boolean>;
+    signOut: () => Promise<void>;
+    useAuthSession: () => {
+        isAnonymous: boolean;
+        isPending: boolean;
+        session: {
+            user: import("better-auth").StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            } & {
+                isAnonymous: boolean | null | undefined;
+            } & {}>;
+            session: import("better-auth").StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+            }>;
+        } | null;
+    };
+};
+export type AuthSession = ReturnType<typeof createAuthSession>;
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAU/C,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,cAAc,CAAC;AACpD,gFAAgF;AAChF,MAAM,WAAW,eAAe,CAAC,UAAU,SAAS,MAAM,GAAG,MAAM;IACjE,WAAW,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,CAAC;IACjD,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB,CAAC,UAAU,SAAS,MAAM,GAAG,MAAM;IACpE,KAAK,EAAE;QACL;;;WAGG;QACH,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,MAAM,EAAE;QACN,4BAA4B;QAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,8DAA8D;QAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;OAGG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE;QAC3B,aAAa,EAAE,OAAO,CAAC;QACvB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3B;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtE,+DAA+D;IAC/D,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzC;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,CACZ,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,eAAe,CAAC,UAAU,CAAC,EAClC,GAAG,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KACxB,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,IAAI,EAAE,MAAM,CAAC;gBAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAKzC;AA6CD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,SAAS,MAAM,GAAG,MAAM,EAClE,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,kBAAkB,CAAC,UAAU,CAAC;yBAkcb,OAAO,CAAC,OAAO,CAAC;yBAThB,OAAO,CAAC,OAAO,CAAC;4BA5XP,OAAO,CAAC,OAAO,CAAC;;;;;;0BAqZxB,OAAO,CAAC,OAAO,CAAC;uCAxTK,OAAO;kCAeZ,MAAM;kCA2mBN,MAAM;iCAWP,MAAM,SAAS,MAAM;mCA3IjD,UAAU,GAAG,SAAS;6BAvB3B,MAAM,YACH,MAAM,eACJ,UAAU,GAAG,SAAS;oCAsDtB,UAAU,GAAG,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0JrC;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC"}