@mosano-product-framework/sdk 0.2.0

package/dist/chunk-XAXFIIRT.js

@@ -0,0 +1,959 @@
+import { createTurnstileMiddleware, createAdminAuthMiddleware } from './chunk-K2ELAI2X.js';
+import { MPFClient, attachStandardMiddlewares } from './chunk-LRM6JJ63.js';
+import { __export, MPFValidationError } from './chunk-AJWM5MDZ.js';
+
+// src/identity/index.ts
+var identity_exports = {};
+__export(identity_exports, {
+  AuthClientV0: () => AuthClientV0,
+  createAdminClient: () => createAdminClient,
+  createAuthClient: () => createAuthClient,
+  isMFARequired: () => isMFARequired,
+  isMFASetupRequired: () => isMFASetupRequired
+});
+
+// src/identity/v0.ts
+var AuthClientV0 = class extends MPFClient {
+  /** Optional OAuth state store; see {@link AuthClientV0Config.oauthStateStore}. */
+  oauthStateStore;
+  constructor(config) {
+    const { oauthStateStore, ...clientConfig } = config;
+    super({
+      ...clientConfig,
+      baseUrl: `${clientConfig.baseUrl}/v0`
+    });
+    this.oauthStateStore = oauthStateStore;
+  }
+  /**
+   * Wraps request options with skipAuth: true for public endpoints
+   * that do not require authentication headers.
+   */
+  publicOptions(options) {
+    return { ...options, skipAuth: true };
+  }
+  // ============================================================================
+  // Public Endpoints - Authentication
+  // ============================================================================
+  /**
+   * Register a new user with email and password
+   *
+   * Creates a new user account and returns access and refresh tokens.
+   *
+   * @param data - User registration data
+   * @param options - Optional request options
+   * @returns Access and refresh tokens
+   */
+  async signUpEmailPassword(data, options) {
+    const cleanedData = {
+      email: data.email,
+      password: data.password,
+      ...data.first_name ? { first_name: data.first_name } : {},
+      ...data.last_name ? { last_name: data.last_name } : {},
+      ...data.display_name ? { display_name: data.display_name } : {}
+    };
+    return this.post(
+      "/sign-up-email-password",
+      cleanedData,
+      this.publicOptions(options)
+    );
+  }
+  /**
+   * Login with email and password
+   *
+   * Authenticates a user and returns access and refresh tokens.
+   *
+   * @param data - Login credentials
+   * @param options - Optional request options
+   * @returns Access and refresh tokens
+   */
+  async signInEmailPassword(data, options) {
+    return this.post(
+      "/sign-in-email-password",
+      data,
+      this.publicOptions(options)
+    );
+  }
+  /**
+   * Verify MFA code to complete login
+   *
+   * After a login attempt returns mfa_required, submit the TOTP code
+   * along with the MFA ticket to complete authentication.
+   *
+   * @param data - MFA ticket and TOTP code
+   * @param options - Optional request options
+   * @returns Access and refresh tokens
+   */
+  async verifyMFA(data, options) {
+    return this.post(
+      "/mfa/verify",
+      data,
+      this.publicOptions(options)
+    );
+  }
+  /**
+   * Verify MFA setup to complete first-time enrollment and login
+   *
+   * After a login attempt returns mfa_setup_required, verify the TOTP
+   * setup by submitting a code from the authenticator app.
+   *
+   * @param data - MFA ticket and verification code
+   * @param options - Optional request options
+   * @returns Access and refresh tokens
+   */
+  async verifyMFASetup(data, options) {
+    return this.post(
+      "/mfa/setup/verify",
+      data,
+      this.publicOptions(options)
+    );
+  }
+  // ============================================================================
+  // Public Endpoints - Password Recovery
+  // ============================================================================
+  /**
+   * Send password recovery code to email
+   *
+   * Initiates the password recovery process by sending a verification code.
+   *
+   * @param data - Email address for recovery
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async forgotPasswordWithEmail(data, options) {
+    return this.post(
+      "/forgot-password-with-email",
+      data,
+      this.publicOptions(options)
+    );
+  }
+  /**
+   * Verify password recovery code
+   *
+   * Verifies the recovery code and returns a recovery token for password reset.
+   *
+   * @param data - Email and verification code
+   * @param options - Optional request options
+   * @returns Recovery token for password reset
+   */
+  async verifyRecoveryCode(data, options) {
+    return this.post(
+      "/password/recovery/verify",
+      data,
+      this.publicOptions(options)
+    );
+  }
+  /**
+   * Reset password with recovery token
+   *
+   * Resets the user's password and returns new access and refresh tokens.
+   *
+   * @param data - Recovery token and new password
+   * @param options - Optional request options
+   * @returns Access and refresh tokens
+   */
+  async resetPassword(data, options) {
+    return this.post(
+      "/password/reset",
+      data,
+      this.publicOptions(options)
+    );
+  }
+  // ============================================================================
+  // Public Endpoints - Sessions
+  // ============================================================================
+  /**
+   * Renew session with refresh token
+   *
+   * Exchanges a valid refresh token for new access and refresh tokens.
+   *
+   * Tenant is selected per request via the `X-MPF-Tenant` header, so a renewal
+   * neither takes nor changes a tenant.
+   *
+   * @param data - Refresh token
+   * @param options - Optional request options
+   * @returns Access and refresh tokens
+   */
+  async renewSession(data, options) {
+    return this.post(
+      "/sessions/renew",
+      data,
+      this.publicOptions(options)
+    );
+  }
+  /**
+   * Revoke session (logout)
+   *
+   * Revokes the session associated with the provided refresh token.
+   * Requires authentication.
+   *
+   * @param data - Refresh token to revoke
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async revokeSession(data, options) {
+    return this.post(
+      "/sessions/revoke",
+      data,
+      options
+    );
+  }
+  // ============================================================================
+  // Public Endpoints - Invitations
+  // ============================================================================
+  /**
+   * List pending invitations for the authenticated user
+   *
+   * Returns all pending invitations for the currently authenticated user.
+   * Requires authentication.
+   *
+   * @param options - Optional request options
+   * @returns Array of pending invitations
+   */
+  async listMyInvitations(options) {
+    return this.get(
+      "/users/me/invitations",
+      options
+    );
+  }
+  /**
+   * Preview an invitation (public, pre-auth).
+   *
+   * Returns the tenant, role, and inviter display name for the
+   * invitation-acceptance page. Email is intentionally omitted. Use this
+   * to render the accept page before the user signs in.
+   *
+   * @param token - Invitation token
+   * @param options - Optional request options
+   * @returns Public-safe invitation preview
+   */
+  async previewInvitation(token, options) {
+    return this.get(
+      `/invitations/${encodeURIComponent(token)}`,
+      this.publicOptions(options)
+    );
+  }
+  /**
+   * Accept an invitation.
+   *
+   * Requires the user to be authenticated. The user's primary verified
+   * email must match the invitation. Creates the membership row.
+   *
+   * @param token - Invitation token
+   * @param options - Optional request options
+   * @returns Acceptance result (invitation + new membership)
+   */
+  async acceptInvitation(token, options) {
+    return this.post(
+      `/invitations/${encodeURIComponent(token)}/accept`,
+      void 0,
+      options
+    );
+  }
+  /**
+   * Revoke a pending invitation. Caller must be a manager of the tenant
+   * that issued the invitation.
+   *
+   * @param invitationId - Invitation ID (not the token)
+   * @param options - Optional request options
+   */
+  async revokeInvitation(invitationId, options) {
+    return this.delete(
+      `/invitations/${encodeURIComponent(invitationId)}`,
+      options
+    );
+  }
+  // ============================================================================
+  // Public Endpoints - Health
+  // ============================================================================
+  /**
+   * Health check endpoint
+   *
+   * Returns the health status of the service.
+   *
+   * @param options - Optional request options
+   * @returns Health status
+   */
+  async healthCheck(options) {
+    return this.get("/healthz", this.publicOptions(options));
+  }
+  // ============================================================================
+  // Protected Endpoints - User Profile
+  // ============================================================================
+  /**
+   * Get current user profile
+   *
+   * Returns the authenticated user's profile information.
+   * Requires authentication.
+   *
+   * @param options - Optional request options
+   * @returns User profile
+   */
+  async getMe(options) {
+    return this.get("/users/me", options);
+  }
+  /**
+   * Update current user profile
+   *
+   * Updates the authenticated user's profile information.
+   * Requires authentication.
+   *
+   * @param data - Profile update data
+   * @param options - Optional request options
+   * @returns Updated user profile
+   */
+  async updateMe(data, options) {
+    return this.patch("/users/me", data, options);
+  }
+  // ============================================================================
+  // Protected Endpoints - Emails
+  // ============================================================================
+  /**
+   * List user emails
+   *
+   * Returns all email addresses associated with the authenticated user.
+   * Requires authentication.
+   *
+   * @param options - Optional request options
+   * @returns Array of email addresses
+   */
+  async listEmails(options) {
+    const response = await this.get("/users/me/emails", options);
+    return response.emails;
+  }
+  /**
+   * Add a new email address
+   *
+   * Adds a new email address to the authenticated user's account.
+   * A verification code will be sent to the email.
+   * Requires authentication.
+   *
+   * @param data - Email address to add
+   * @param options - Optional request options
+   * @returns Added email information
+   */
+  async addEmail(data, options) {
+    return this.post("/users/me/emails", data, options);
+  }
+  /**
+   * Verify an email address
+   *
+   * Verifies an email address using a verification code.
+   * Requires authentication.
+   *
+   * @param emailId - Email ID to verify
+   * @param data - Verification code
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async verifyEmail(emailId, data, options) {
+    return this.post(
+      `/users/me/emails/${encodeURIComponent(emailId)}/verify`,
+      data,
+      options
+    );
+  }
+  /**
+   * Delete an email address
+   *
+   * Removes an email address from the authenticated user's account.
+   * Cannot delete the primary email.
+   * Requires authentication.
+   *
+   * @param emailId - Email ID to delete
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async deleteEmail(emailId, options) {
+    return this.delete(
+      `/users/me/emails/${encodeURIComponent(emailId)}`,
+      void 0,
+      options
+    );
+  }
+  /**
+   * Set email as primary
+   *
+   * Sets the specified email address as the primary email for the user.
+   * Email must be verified before it can be set as primary.
+   * Requires authentication.
+   *
+   * @param emailId - Email ID to set as primary
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async setPrimaryEmail(emailId, options) {
+    return this.post(
+      `/users/me/emails/${encodeURIComponent(emailId)}/set-primary`,
+      void 0,
+      options
+    );
+  }
+  /**
+   * Send email verification code
+   *
+   * Sends a verification code to the authenticated user's primary email address.
+   * Use verifyEmail() to complete the verification.
+   * Requires authentication.
+   *
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async sendEmailVerification(options) {
+    return this.post(
+      "/email/send-verification",
+      void 0,
+      options
+    );
+  }
+  // ============================================================================
+  // Protected Endpoints - Phones
+  // ============================================================================
+  /**
+   * List user phones
+   *
+   * Returns all phone numbers associated with the authenticated user.
+   * Requires authentication.
+   *
+   * @param options - Optional request options
+   * @returns Array of phone numbers
+   */
+  async listPhones(options) {
+    const response = await this.get("/users/me/phones", options);
+    return response.phones;
+  }
+  /**
+   * Add a new phone number
+   *
+   * Adds a new phone number to the authenticated user's account.
+   * A verification code will be sent to the phone.
+   * Requires authentication.
+   *
+   * @param data - Phone number to add (E.164 format)
+   * @param options - Optional request options
+   * @returns Added phone information
+   */
+  async addPhone(data, options) {
+    return this.post("/users/me/phones", data, options);
+  }
+  /**
+   * Verify a phone number
+   *
+   * Verifies a phone number using a verification code.
+   * Requires authentication.
+   *
+   * @param phoneId - Phone ID to verify
+   * @param data - Verification code
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async verifyPhone(phoneId, data, options) {
+    return this.post(
+      `/users/me/phones/${encodeURIComponent(phoneId)}/verify`,
+      data,
+      options
+    );
+  }
+  /**
+   * Delete a phone number
+   *
+   * Removes a phone number from the authenticated user's account.
+   * Cannot delete the primary phone.
+   * Requires authentication.
+   *
+   * @param phoneId - Phone ID to delete
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async deletePhone(phoneId, options) {
+    return this.delete(
+      `/users/me/phones/${encodeURIComponent(phoneId)}`,
+      void 0,
+      options
+    );
+  }
+  /**
+   * Set phone as primary
+   *
+   * Sets the specified phone number as the primary phone for the user.
+   * Phone must be verified before it can be set as primary.
+   * Requires authentication.
+   *
+   * @param phoneId - Phone ID to set as primary
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async setPrimaryPhone(phoneId, options) {
+    return this.post(
+      `/users/me/phones/${encodeURIComponent(phoneId)}/set-primary`,
+      void 0,
+      options
+    );
+  }
+  // ============================================================================
+  // Protected Endpoints - Sessions
+  // ============================================================================
+  /**
+   * List user sessions
+   *
+   * Returns all active sessions for the authenticated user.
+   * Requires authentication.
+   *
+   * @param options - Optional request options
+   * @returns Array of sessions
+   */
+  async listSessions(options) {
+    const response = await this.get("/users/me/sessions", options);
+    return response.sessions;
+  }
+  /**
+   * Delete a session
+   *
+   * Revokes a specific session for the authenticated user.
+   * Requires authentication.
+   *
+   * @param sessionId - Session ID to delete
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async deleteSession(sessionId, options) {
+    return this.delete(
+      `/users/me/sessions/${encodeURIComponent(sessionId)}`,
+      void 0,
+      options
+    );
+  }
+  // ============================================================================
+  // Protected Endpoints - Clients
+  // ============================================================================
+  /**
+   * List authorized OAuth clients
+   *
+   * Returns all OAuth clients authorized by the authenticated user.
+   * Requires authentication.
+   *
+   * @param options - Optional request options
+   * @returns Array of OAuth clients
+   */
+  async listClients(options) {
+    const response = await this.get("/users/me/clients", options);
+    return response.clients;
+  }
+  /**
+   * Revoke OAuth client authorization
+   *
+   * Revokes authorization for a specific OAuth client.
+   * Requires authentication.
+   *
+   * @param clientId - Client ID to revoke
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async deleteClient(clientId, options) {
+    return this.delete(
+      `/users/me/clients/${encodeURIComponent(clientId)}`,
+      void 0,
+      options
+    );
+  }
+  // ============================================================================
+  // Protected Endpoints - Password
+  // ============================================================================
+  /**
+   * Update password (authenticated)
+   *
+   * Updates the authenticated user's password.
+   * Requires authentication.
+   *
+   * @param data - Current and new password
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async updatePassword(data, options) {
+    return this.post(
+      "/password/update",
+      data,
+      options
+    );
+  }
+  // ============================================================================
+  // Protected Endpoints - Tenants
+  // ============================================================================
+  /**
+   * Create a new tenant
+   *
+   * Creates a new tenant organization. The authenticated user becomes the owner.
+   * Requires authentication.
+   *
+   * @param data - Tenant creation data
+   * @param options - Optional request options
+   * @returns Created tenant information
+   */
+  async createTenant(data, options) {
+    return this.post("/tenants", data, options);
+  }
+  /**
+   * List current user's tenants
+   *
+   * Returns all tenants the authenticated user is a member of.
+   * Requires authentication.
+   *
+   * @param options - Optional request options
+   * @returns Array of tenant information
+   */
+  async listMyTenants(options) {
+    return this.get("/users/me/tenants", options);
+  }
+  // ============================================================================
+  // Protected Endpoints - Tenant Members
+  // ============================================================================
+  /**
+   * List tenant members
+   *
+   * Returns all members of the specified tenant.
+   * Requires authentication and membership in the tenant.
+   *
+   * @param tenantId - Tenant ID
+   * @param options - Optional request options
+   * @returns Array of tenant members
+   */
+  async listTenantMembers(tenantId, options) {
+    const response = await this.get(
+      `/tenants/${encodeURIComponent(tenantId)}/members`,
+      options
+    );
+    return response.members;
+  }
+  /**
+   * Invite a member to tenant
+   *
+   * Sends an invitation to join the tenant. Requires authentication and
+   * owner/admin role on the tenant.
+   *
+   * @param tenantId - Target tenant ID
+   * @param data - Invitation data
+   * @param options - Optional request options
+   * @returns Invitation result, including a copyable accept_url
+   */
+  async inviteTenantMember(tenantId, data, options) {
+    return this.post(
+      `/tenants/${encodeURIComponent(tenantId)}/members/invite`,
+      data,
+      options
+    );
+  }
+  /**
+   * List pending invitations issued by the authenticated caller for a tenant.
+   *
+   * Returns only invitations whose `invited_by` matches the caller. Lets the
+   * caller copy the `accept_url` of an invite they previously sent (for
+   * example, to re-share if email delivery failed). Callers without a
+   * membership, and members who never issued an invite for this tenant,
+   * get an empty array.
+   *
+   * @param tenantId - Tenant ID
+   * @param options - Optional request options
+   * @returns Array of invitations issued by the caller
+   */
+  async listTenantInvitationsIssuedByMe(tenantId, options) {
+    const response = await this.get(
+      `/tenants/${encodeURIComponent(tenantId)}/invitations`,
+      options
+    );
+    return response.invitations;
+  }
+  /**
+   * Update member role
+   *
+   * Updates the role of a tenant member.
+   * Requires authentication and owner role in the tenant.
+   *
+   * @param tenantId - Tenant ID
+   * @param userId - User ID of the member
+   * @param data - New role
+   * @param options - Optional request options
+   * @returns Updated membership information
+   */
+  async updateTenantMemberRole(tenantId, userId, data, options) {
+    return this.patch(
+      `/tenants/${encodeURIComponent(tenantId)}/members/${encodeURIComponent(userId)}`,
+      data,
+      options
+    );
+  }
+  /**
+   * Remove member from tenant
+   *
+   * Removes a member from the tenant.
+   * Cannot remove the last owner.
+   * Requires authentication and admin/owner role in the tenant.
+   *
+   * @param tenantId - Tenant ID
+   * @param userId - User ID of the member to remove
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async removeTenantMember(tenantId, userId, options) {
+    return this.delete(
+      `/tenants/${encodeURIComponent(tenantId)}/members/${encodeURIComponent(userId)}`,
+      void 0,
+      options
+    );
+  }
+  // ============================================================================
+  // Protected Endpoints - TOTP (Two-Factor Authentication)
+  // ============================================================================
+  /**
+   * Setup TOTP two-factor authentication
+   *
+   * Initializes TOTP setup and returns the secret, QR code URL, and backup codes.
+   * The setup must be verified with verifyTOTP() before it becomes active.
+   * Requires authentication.
+   *
+   * @param options - Optional request options
+   * @returns TOTP setup data including secret and backup codes
+   */
+  async setupTOTP(options) {
+    return this.post(
+      "/totp/setup",
+      void 0,
+      options
+    );
+  }
+  /**
+   * Verify TOTP setup
+   *
+   * Verifies a TOTP code to complete the 2FA setup process.
+   * After verification, TOTP will be required on future logins.
+   * Requires authentication.
+   *
+   * @param data - TOTP verification code
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async verifyTOTP(data, options) {
+    return this.post("/totp/verify", data, options);
+  }
+  /**
+   * Disable TOTP two-factor authentication
+   *
+   * Disables TOTP 2FA. Requires a valid TOTP code to confirm.
+   * Requires authentication.
+   *
+   * @param data - TOTP code to confirm disable
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async disableTOTP(data, options) {
+    return this.post("/totp/disable", data, options);
+  }
+  // ============================================================================
+  // Passkey / WebAuthn - Public Endpoints
+  // ============================================================================
+  /**
+   * Begin passkey login
+   *
+   * Starts the WebAuthn authentication process.
+   * Returns options to pass to navigator.credentials.get().
+   *
+   * @param options - Optional request options
+   * @returns WebAuthn request options
+   */
+  async beginPasskeyLogin(options) {
+    const response = await this.post(
+      "/passkey/login/begin",
+      void 0,
+      this.publicOptions(options)
+    );
+    const raw = response.options;
+    const opts = "publicKey" in raw ? raw.publicKey : raw;
+    return { options: opts, session_key: response.session_key ?? "" };
+  }
+  /**
+   * Complete passkey login
+   *
+   * Completes the WebAuthn authentication and returns access tokens.
+   *
+   * @param data - WebAuthn assertion result from navigator.credentials.get()
+   * @param options - Optional request options
+   * @returns Access and refresh tokens
+   */
+  async finishPasskeyLogin(data, options) {
+    return this.post(
+      "/passkey/login/finish",
+      data,
+      this.publicOptions(options)
+    );
+  }
+  // ============================================================================
+  // Passkey / WebAuthn - Protected Endpoints
+  // ============================================================================
+  /**
+   * Begin passkey registration
+   *
+   * Starts the WebAuthn registration process for the authenticated user.
+   * Returns options to pass to navigator.credentials.create().
+   * Requires authentication.
+   *
+   * @param options - Optional request options
+   * @returns WebAuthn creation options
+   */
+  async beginPasskeyRegistration(options) {
+    const response = await this.post(
+      "/passkeys/register/begin",
+      void 0,
+      options
+    );
+    const raw = response.options;
+    const opts = "publicKey" in raw ? raw.publicKey : raw;
+    return { options: opts };
+  }
+  /**
+   * Complete passkey registration
+   *
+   * Completes the WebAuthn registration with the attestation result.
+   * Requires authentication.
+   *
+   * @param data - WebAuthn attestation result and optional passkey name
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async finishPasskeyRegistration(data, options) {
+    return this.post(
+      "/passkeys/register/finish",
+      data,
+      options
+    );
+  }
+  /**
+   * List registered passkeys
+   *
+   * Returns all passkeys registered by the authenticated user.
+   * Requires authentication.
+   *
+   * @param options - Optional request options
+   * @returns Array of passkey information
+   */
+  async listPasskeys(options) {
+    const response = await this.get("/passkeys", options);
+    return response.passkeys;
+  }
+  /**
+   * Delete a passkey
+   *
+   * Removes a registered passkey from the authenticated user's account.
+   * If the user has TOTP 2FA enabled, a valid TOTP code must be provided.
+   * Requires authentication.
+   *
+   * @param passkeyId - Passkey ID to delete
+   * @param data - Optional request body with TOTP code for 2FA verification
+   * @param options - Optional request options
+   * @returns Success response
+   */
+  async deletePasskey(passkeyId, data, options) {
+    return this.delete(
+      `/passkeys/${encodeURIComponent(passkeyId)}`,
+      data,
+      options
+    );
+  }
+  // ============================================================================
+  // Google OAuth - Public Endpoints
+  // ============================================================================
+  /**
+   * Get Google OAuth authorization URL and its CSRF state.
+   *
+   * Returns `{ url, state }`. Redirect the user to `url`, and keep `state` —
+   * `handleGoogleOAuthCallback` requires it. When the client was constructed
+   * with an `oauthStateStore`, the state is persisted here automatically.
+   *
+   * @param params - Query parameters including redirect_uri
+   * @param options - Optional request options
+   * @returns The authorization URL and the single-use state to round-trip
+   */
+  async getGoogleOAuthURL(params, options) {
+    const queryParams = new URLSearchParams({ redirect_uri: params.redirect_uri });
+    const response = await this.get(
+      `/oauth/google/url?${queryParams.toString()}`,
+      this.publicOptions(options)
+    );
+    if (this.oauthStateStore && response.state) {
+      this.oauthStateStore.save(response.state);
+    }
+    return response;
+  }
+  /**
+   * Handle Google OAuth callback
+   *
+   * Exchanges the Google OAuth authorization code for access tokens.
+   * Creates a new user if one doesn't exist with the Google email.
+   *
+   * The `state` from `getGoogleOAuthURL` is **required**: the server validates
+   * it before exchanging the code, and rejects a mismatch, absence, expiry or
+   * reuse. See {@link Types.GoogleOAuthCallbackRequest.state}.
+   *
+   * @param data - OAuth callback data: code, redirect_uri and state
+   * @param options - Optional request options
+   * @returns Access and refresh tokens
+   * @throws {MPFValidationError} If `state` is missing or empty (client-side).
+   */
+  async handleGoogleOAuthCallback(data, options) {
+    if (typeof data.state !== "string" || data.state === "") {
+      throw new MPFValidationError(
+        "OAuth callback requires the `state` returned by getGoogleOAuthURL. It is the CSRF defence for this flow: without it a callback carrying an attacker's authorization code would be accepted. Persist it across the redirect with createOAuthStateStore().",
+        { field: "state" },
+        { state: ["state is required"] }
+      );
+    }
+    return this.post(
+      "/oauth/google/callback",
+      data,
+      this.publicOptions(options)
+    );
+  }
+};
+
+// src/identity/types.ts
+function isMFARequired(response) {
+  return "mfa_required" in response && response.mfa_required === true;
+}
+function isMFASetupRequired(response) {
+  return "mfa_setup_required" in response && response.mfa_setup_required === true;
+}
+
+// src/identity/index.ts
+var TURNSTILE_PROTECTED_PATHS = [
+  "/sign-up-email-password",
+  "/sign-in-email-password",
+  "/forgot-password-with-email",
+  "/password/recovery/verify",
+  "/password/reset",
+  "/passkey/login/begin",
+  "/passkey/login/finish",
+  "/oauth/google/callback",
+  "/accept",
+  // matches /invitations/{token}/accept
+  "/invite"
+  // matches /tenants/{id}/members/invite
+];
+function createAuthClient(options) {
+  const { tokenProvider, turnstileProvider, tenantProvider, ...clientConfig } = options;
+  const client = new AuthClientV0(clientConfig);
+  attachStandardMiddlewares(client, { tokenProvider, tenantProvider });
+  if (turnstileProvider) {
+    client.use(createTurnstileMiddleware({
+      getToken: turnstileProvider.getToken,
+      protectedPaths: TURNSTILE_PROTECTED_PATHS
+    }));
+  }
+  return client;
+}
+function createAdminClient(options) {
+  const { admin, ...clientConfig } = options;
+  const client = new AuthClientV0(clientConfig);
+  client.use(createAdminAuthMiddleware(admin));
+  return client;
+}
+
+export { AuthClientV0, createAdminClient, createAuthClient, identity_exports, isMFARequired, isMFASetupRequired };
+//# sourceMappingURL=chunk-XAXFIIRT.js.map
+//# sourceMappingURL=chunk-XAXFIIRT.js.map