@multiplatform.one/auth 7.7.2

package/dist/cjs/index.native.js

@@ -0,0 +1,411 @@
+"use strict";
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all) __defProp(target, name, {
+    get: all[name],
+    enumerable: true
+  });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from)) if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    });
+  }
+  return to;
+};
+var __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
+  value: true
+}), mod);
+var index_exports = {};
+__export(index_exports, {
+  ACCESS_TOKEN_RETRY_DELAYS_MS: () => import_accessTokenRefresh2.ACCESS_TOKEN_RETRY_DELAYS_MS,
+  FAILED_TO_GET_ACCESS_TOKEN: () => import_accessTokenRefresh2.FAILED_TO_GET_ACCESS_TOKEN,
+  TOKEN_REFRESH_UNAVAILABLE: () => import_accessTokenRefresh2.TOKEN_REFRESH_UNAVAILABLE,
+  classifyAccessTokenResponse: () => import_accessTokenRefresh2.classifyAccessTokenResponse,
+  createAuth: () => createAuth,
+  createAuthRouteHandler: () => createAuthRouteHandler,
+  createSessionHelpers: () => createSessionHelpers,
+  retryWhileTransient: () => import_accessTokenRefresh2.retryWhileTransient,
+  watchDocumentVisible: () => import_accessTokenRefresh2.watchDocumentVisible
+});
+module.exports = __toCommonJS(index_exports);
+var import_async_hooks = require("async_hooks");
+var import_better_auth = require("better-auth");
+var import_api = require("better-auth/api");
+var import_cookies = require("better-auth/cookies");
+var import_plugins = require("better-auth/plugins");
+var import_expo = require("@better-auth/expo");
+var import_accessTokenRefresh = require("./accessTokenRefresh.native.js");
+var import_accessTokenRefresh2 = require("./accessTokenRefresh.native.js");
+var requestOriginStorage = new import_async_hooks.AsyncLocalStorage();
+function deriveRequestOrigin(req) {
+  var isDevHost = function isDevHost2(host) {
+    return DEV_LAN_HOST_PATTERNS.some(function (pattern) {
+      return (0, import_better_auth.matchesHostPattern)(host, pattern);
+    });
+  };
+  var forwardedHost = req.headers.get("x-forwarded-host");
+  if (forwardedHost && isDevHost(forwardedHost)) {
+    var proto = req.headers.get("x-forwarded-proto") === "https" ? "https" : "http";
+    return `${proto}://${forwardedHost}`;
+  }
+  var originHeader = req.headers.get("origin");
+  if (originHeader) {
+    try {
+      var url = new URL(originHeader);
+      if (isDevHost(url.host)) return url.origin;
+    } catch (unused) {}
+  }
+  try {
+    return new URL(req.url).origin;
+  } catch (unused) {
+    return void 0;
+  }
+}
+var DEV_LAN_HOST_PATTERNS = ["localhost", "localhost:*", "127.0.0.1", "127.0.0.1:*", "10.*", "192.168.*", "172.*", "*.local", "*.local:*"];
+function createKeycloakSsoPlugin(options) {
+  var {
+    realm,
+    clientId,
+    clientSecret,
+    issuer,
+    baseUrl,
+    publicKeycloakBaseFor
+  } = options;
+  var tokenEndpoint = `${issuer}/protocol/openid-connect/token`;
+  var resolveVisitorOrigin = function resolveVisitorOrigin2(request) {
+    var _requestOriginStorage_getStore;
+    return (_requestOriginStorage_getStore = requestOriginStorage.getStore()) !== null && _requestOriginStorage_getStore !== void 0 ? _requestOriginStorage_getStore : request ? deriveRequestOrigin(request) : void 0;
+  };
+  var isRefreshDefinitivelyDead = async function isRefreshDefinitivelyDead2(refreshToken) {
+    try {
+      var res = await fetch(tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+          client_id: clientId,
+          client_secret: clientSecret
+        }),
+        signal: AbortSignal.timeout(5e3)
+      });
+      if (res.ok) return false;
+      if (res.status !== 400 && res.status !== 401) return false;
+      var body = await res.json().catch(function () {
+        return null;
+      });
+      return (body === null || body === void 0 ? void 0 : body.error) === "invalid_grant" || (body === null || body === void 0 ? void 0 : body.error) === "invalid_token";
+    } catch (unused) {
+      return false;
+    }
+  };
+  var signOutSso = (0, import_api.createAuthEndpoint)("/sign-out/sso", {
+    method: "GET"
+  }, async function (ctx) {
+    var _resolveVisitorOrigin, _ref;
+    var visitorOrigin = (_resolveVisitorOrigin = resolveVisitorOrigin(ctx.request)) !== null && _resolveVisitorOrigin !== void 0 ? _resolveVisitorOrigin : baseUrl;
+    var searchParams = ctx.request ? new URL(ctx.request.url).searchParams : void 0;
+    var rawCallback = (_ref = searchParams === null || searchParams === void 0 ? void 0 : searchParams.get("callbackURL")) !== null && _ref !== void 0 ? _ref : null;
+    var jsonMode = (searchParams === null || searchParams === void 0 ? void 0 : searchParams.get("mode")) === "json";
+    var answer = function answer2(url, redirect) {
+      if (jsonMode) return ctx.json({
+        redirect,
+        url
+      });
+      throw ctx.redirect(url);
+    };
+    var callbackURL = rawCallback || "/";
+    var postLogoutRedirect = callbackURL.startsWith("/") ? `${visitorOrigin}${callbackURL}` : callbackURL;
+    var idTokenHint;
+    var sessionToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+    var session = await (0, import_api.getSessionFromCtx)(ctx).catch(function () {
+      return null;
+    });
+    if (session) {
+      var _ref1;
+      var _accounts_find;
+      var accounts = await ctx.context.internalAdapter.findAccounts(session.user.id).catch(function () {
+        return [];
+      });
+      idTokenHint = (_ref1 = (_accounts_find = accounts.find(function (account) {
+        return account.providerId === "keycloak";
+      })) === null || _accounts_find === void 0 ? void 0 : _accounts_find.idToken) !== null && _ref1 !== void 0 ? _ref1 : void 0;
+    }
+    if (!idTokenHint) {
+      var accountCookie = await (0, import_cookies.getAccountCookie)(ctx).catch(function () {
+        return null;
+      });
+      if ((accountCookie === null || accountCookie === void 0 ? void 0 : accountCookie.providerId) === "keycloak" && accountCookie.idToken) {
+        idTokenHint = accountCookie.idToken;
+      }
+    }
+    if (sessionToken) {
+      await ctx.context.internalAdapter.deleteSession(sessionToken).catch(function (error) {
+        ctx.context.logger.error("Failed to delete session during SSO sign-out", error);
+      });
+    }
+    (0, import_cookies.deleteSessionCookie)(ctx);
+    var keycloakBase = publicKeycloakBaseFor(visitorOrigin);
+    if (!keycloakBase || !session && !idTokenHint && !sessionToken) {
+      return answer(postLogoutRedirect, false);
+    }
+    var endSession = new URL(`${keycloakBase}/realms/${realm}/protocol/openid-connect/logout`);
+    endSession.searchParams.set("post_logout_redirect_uri", postLogoutRedirect);
+    endSession.searchParams.set("client_id", clientId);
+    if (idTokenHint) endSession.searchParams.set("id_token_hint", idTokenHint);
+    return answer(endSession.toString(), true);
+  });
+  return {
+    id: "keycloak-sso",
+    endpoints: {
+      signOutSso
+    },
+    hooks: {
+      after: [{
+        matcher: function matcher(ctx) {
+          return ctx.path === "/get-access-token";
+        },
+        handler: (0, import_api.createAuthMiddleware)(async function (ctx) {
+          var _ctx_body, _accounts_find;
+          var returned = ctx.context.returned;
+          if (!(0, import_api.isAPIError)(returned)) return;
+          var body = returned.body;
+          if ((body === null || body === void 0 ? void 0 : body.code) !== import_accessTokenRefresh.FAILED_TO_GET_ACCESS_TOKEN) return;
+          var providerId = (_ctx_body = ctx.body) === null || _ctx_body === void 0 ? void 0 : _ctx_body.providerId;
+          if (providerId && providerId !== "keycloak") return;
+          var session = await (0, import_api.getSessionFromCtx)(ctx).catch(function () {
+            return null;
+          });
+          if (!session) return;
+          var accounts = await ctx.context.internalAdapter.findAccounts(session.user.id).catch(function () {
+            return [];
+          });
+          var refreshToken = (_accounts_find = accounts.find(function (account) {
+            return account.providerId === "keycloak";
+          })) === null || _accounts_find === void 0 ? void 0 : _accounts_find.refreshToken;
+          if (!refreshToken) {
+            var accountCookie = await (0, import_cookies.getAccountCookie)(ctx).catch(function () {
+              return null;
+            });
+            if ((accountCookie === null || accountCookie === void 0 ? void 0 : accountCookie.providerId) === "keycloak") {
+              refreshToken = accountCookie.refreshToken;
+            }
+          }
+          var definitive = refreshToken ? await isRefreshDefinitivelyDead(refreshToken) : true;
+          if (!definitive) {
+            return new import_api.APIError("INTERNAL_SERVER_ERROR", {
+              message: "Keycloak token refresh temporarily unavailable",
+              code: import_accessTokenRefresh.TOKEN_REFRESH_UNAVAILABLE
+            });
+          }
+          ctx.context.logger.warn("Keycloak refresh token is dead (invalid_grant); revoking the stale Better Auth session");
+          var sessionToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+          if (sessionToken) {
+            await ctx.context.internalAdapter.deleteSession(sessionToken).catch(function (error) {
+              ctx.context.logger.error("Failed to delete stale session", error);
+            });
+          }
+          (0, import_cookies.deleteSessionCookie)(ctx);
+          var headers = new Headers();
+          var accumulated = ctx.responseHeaders;
+          accumulated === null || accumulated === void 0 ? void 0 : accumulated.getSetCookie().forEach(function (cookie) {
+            headers.append("set-cookie", cookie);
+          });
+          return new import_api.APIError("BAD_REQUEST", {
+            message: (body === null || body === void 0 ? void 0 : body.message) || "Failed to get a valid access token",
+            code: import_accessTokenRefresh.FAILED_TO_GET_ACCESS_TOKEN
+          }, headers);
+        })
+      }]
+    }
+  };
+}
+function createAuth() {
+  var options = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
+  var _options_plugins, _options_database, _options_sessionMaxAge;
+  var _options_keycloak, _options_keycloak1, _options_keycloak2, _options_keycloak3;
+  var baseUrl = options.baseUrl || process.env.BASE_URL || `http://localhost:${process.env.ONE_PORT || "3000"}`;
+  var isProduction = process.env.NODE_ENV === "production";
+  var keycloakBaseUrl = ((_options_keycloak = options.keycloak) === null || _options_keycloak === void 0 ? void 0 : _options_keycloak.baseUrl) || process.env.KEYCLOAK_BACKCHANNEL_URL || `${baseUrl}/auth`;
+  var keycloakRealm = ((_options_keycloak1 = options.keycloak) === null || _options_keycloak1 === void 0 ? void 0 : _options_keycloak1.realm) || process.env.KEYCLOAK_REALM || "master";
+  var issuer = `${keycloakBaseUrl}/realms/${keycloakRealm}`;
+  var keycloakClientId = ((_options_keycloak2 = options.keycloak) === null || _options_keycloak2 === void 0 ? void 0 : _options_keycloak2.clientId) || process.env.KEYCLOAK_CLIENT_ID || "";
+  var keycloakClientSecret = ((_options_keycloak3 = options.keycloak) === null || _options_keycloak3 === void 0 ? void 0 : _options_keycloak3.clientSecret) || process.env.KEYCLOAK_CLIENT_SECRET || "";
+  var expoPlugin = options.enableExpo !== false ? (0, import_expo.expo)() : void 0;
+  var basePath = options.basePath || "/api/auth";
+  var keycloakProviderConfig = {
+    ...(0, import_plugins.keycloak)({
+      clientId: keycloakClientId,
+      clientSecret: keycloakClientSecret,
+      issuer
+    }),
+    // Backchannel token/userinfo: `/get-access-token` refresh keeps these
+    // when discovery fails (Keycloak restart), so we don't depend on the
+    // well-known document coming up in the same instant as the token
+    // endpoint. Browser-facing authorize/issuer stay on the public /auth
+    // proxy (getters below).
+    tokenUrl: `${issuer}/protocol/openid-connect/token`,
+    userInfoUrl: `${issuer}/protocol/openid-connect/userinfo`,
+    // Wallet (SIWE-style) users authenticate by signature and have NO email —
+    // Keycloak issues them a username = wallet address and no email claim.
+    // better-auth's genericOAuth callback hard-rejects a user with no email
+    // ("email_is_missing"), so synthesize a stable, unique placeholder from the
+    // wallet address / subject. `.wallet` is a non-routable placeholder domain;
+    // the address stays the stable identity.
+    mapProfileToUser: function mapProfileToUser(profile) {
+      var _profile_email_verified;
+      var handle = profile.preferred_username || profile.sub || profile.id || profile.name;
+      var email = profile.email || (handle ? `${handle}@wallet` : void 0);
+      return {
+        ...profile,
+        email,
+        emailVerified: (_profile_email_verified = profile.email_verified) !== null && _profile_email_verified !== void 0 ? _profile_email_verified : true,
+        name: profile.name || handle
+      };
+    }
+  };
+  var keycloakPublicPath = function () {
+    try {
+      var path = new URL(keycloakBaseUrl).pathname.replace(/\/+$/, "");
+      return path && path !== "/" ? path : void 0;
+    } catch (unused) {
+      return void 0;
+    }
+  }();
+  var publicKeycloakBaseFor = function publicKeycloakBaseFor2(requestOrigin) {
+    if (!keycloakPublicPath) return keycloakBaseUrl;
+    try {
+      var url = new URL(baseUrl);
+      if (!isProduction && requestOrigin) {
+        url.hostname = new URL(requestOrigin).hostname;
+      }
+      return `${url.origin}${keycloakPublicPath}`;
+    } catch (unused) {
+      return void 0;
+    }
+  };
+  if (!isProduction) {
+    Object.defineProperty(keycloakProviderConfig, "redirectURI", {
+      enumerable: true,
+      get() {
+        var origin = requestOriginStorage.getStore();
+        return origin ? `${origin}${basePath}/oauth2/callback/keycloak` : void 0;
+      }
+    });
+    var keycloakPublicBase = function keycloakPublicBase2() {
+      var origin = requestOriginStorage.getStore();
+      if (!origin || !keycloakPublicPath) return void 0;
+      return publicKeycloakBaseFor(origin);
+    };
+    if (keycloakPublicPath) {
+      Object.defineProperty(keycloakProviderConfig, "authorizationUrl", {
+        enumerable: true,
+        get() {
+          var base = keycloakPublicBase();
+          return base ? `${base}/realms/${keycloakRealm}/protocol/openid-connect/auth` : void 0;
+        }
+      });
+      Object.defineProperty(keycloakProviderConfig, "issuer", {
+        enumerable: true,
+        get() {
+          var base = keycloakPublicBase();
+          return base ? `${base}/realms/${keycloakRealm}` : void 0;
+        }
+      });
+    }
+  }
+  var oauthPlugin = (0, import_plugins.genericOAuth)({
+    config: [keycloakProviderConfig]
+  });
+  var keycloakSsoPlugin = createKeycloakSsoPlugin({
+    realm: keycloakRealm,
+    clientId: keycloakClientId,
+    clientSecret: keycloakClientSecret,
+    issuer,
+    baseUrl,
+    publicKeycloakBaseFor
+  });
+  var plugins = [...(expoPlugin ? [expoPlugin] : []), oauthPlugin, keycloakSsoPlugin, ...((_options_plugins = options.plugins) !== null && _options_plugins !== void 0 ? _options_plugins : [])];
+  var database = (_options_database = options.database) !== null && _options_database !== void 0 ? _options_database : process.env.DATABASE_URL || void 0;
+  return (0, import_better_auth.betterAuth)({
+    basePath,
+    // Static on purpose: better-auth's dynamic `baseURL` config (allowedHosts)
+    // is not honored by the genericOAuth plugin — it pins redirect URIs at
+    // init time, which turned them relative and bounced callbacks to the
+    // Keycloak host. Dev multi-host support comes from the per-request
+    // redirectURI getter above + the LAN trustedOrigins below instead.
+    baseURL: baseUrl,
+    ...(database ? {
+      database
+    } : {}),
+    secret: options.secret || process.env.SECRET || "",
+    trustedOrigins: options.trustedOrigins || [baseUrl, keycloakBaseUrl,
+    // In dev, ONE_PORT may differ from BASE_URL; ensure the dev server origin is trusted.
+    ...(process.env.ONE_PORT && !baseUrl.includes(`:${process.env.ONE_PORT}`) ? [`http://localhost:${process.env.ONE_PORT}`] : []), "multiplatform-one://",
+    // Expo Go (dev) receives OAuth returns on the exp:// scheme — the app
+    // derives its callbackURL via Linking.createURL, which yields
+    // exp://<host>:<port>/--/ there. Never trusted in production builds.
+    // Dev also trusts private-network origins (see DEV_LAN_HOST_PATTERNS)
+    // so sign-in from a phone / the machine's LAN IP is not rejected.
+    ...(isProduction ? [] : ["exp://", ...DEV_LAN_HOST_PATTERNS.map(function (host) {
+      return `http://${host}`;
+    })])],
+    session: {
+      cookieCache: {
+        enabled: true,
+        maxAge: (_options_sessionMaxAge = options.sessionMaxAge) !== null && _options_sessionMaxAge !== void 0 ? _options_sessionMaxAge : 7 * 24 * 60 * 60,
+        strategy: "jwe",
+        refreshCache: true
+      }
+    },
+    account: {
+      storeStateStrategy: "cookie",
+      storeAccountCookie: true
+    },
+    plugins
+  });
+}
+function createAuthRouteHandler(auth) {
+  var handler = function handler2(req) {
+    var origin = deriveRequestOrigin(req);
+    return origin ? requestOriginStorage.run(origin, function () {
+      return auth.handler(req);
+    }) : auth.handler(req);
+  };
+  return {
+    GET: handler,
+    POST: handler
+  };
+}
+function createSessionHelpers(auth) {
+  async function getSession(req) {
+    return auth.api.getSession({
+      headers: req.headers
+    });
+  }
+  async function verifyAuth(req) {
+    var session = await auth.api.getSession({
+      headers: req.headers
+    });
+    if (!session) {
+      throw new Response("Unauthorized", {
+        status: 401
+      });
+    }
+    return session;
+  }
+  return {
+    verifyAuth,
+    getSession
+  };
+}
+//# sourceMappingURL=index.native.js.map

package/dist/cjs/index.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","index_exports","__export","ACCESS_TOKEN_RETRY_DELAYS_MS","import_accessTokenRefresh2","FAILED_TO_GET_ACCESS_TOKEN","TOKEN_REFRESH_UNAVAILABLE","classifyAccessTokenResponse","createAuth","createAuthRouteHandler","createSessionHelpers","retryWhileTransient","watchDocumentVisible","module","exports","import_async_hooks","require","import_better_auth","import_api","import_cookies","import_plugins","import_expo","import_accessTokenRefresh","requestOriginStorage","AsyncLocalStorage","deriveRequestOrigin","req","isDevHost","isDevHost2","host","DEV_LAN_HOST_PATTERNS","some","pattern","matchesHostPattern","forwardedHost","headers","get","proto","originHeader","url","URL","origin","unused","createKeycloakSsoPlugin","options","realm","clientId","clientSecret","issuer","baseUrl","publicKeycloakBaseFor","tokenEndpoint","resolveVisitorOrigin","resolveVisitorOrigin2","request","_requestOriginStorage_getStore","getStore","isRefreshDefinitivelyDead","isRefreshDefinitivelyDead2","refreshToken","res","fetch","method","body","URLSearchParams","grant_type","refresh_token","client_id","client_secret","signal","AbortSignal","timeout","ok","status","json","catch","error","signOutSso","createAuthEndpoint","ctx","_resolveVisitorOrigin","_ref","visitorOrigin","searchParams","rawCallback","jsonMode","answer","answer2","redirect","callbackURL","postLogoutRedirect","startsWith","idTokenHint","sessionToken","getSignedCookie","context","authCookies","name","secret","session","getSessionFromCtx","_ref1","_accounts_find","accounts","internalAdapter","findAccounts","user","id","find","account","providerId","idToken","accountCookie","getAccountCookie","deleteSession","logger","deleteSessionCookie","keycloakBase","endSession","set","toString","endpoints","hooks","after","matcher","path","handler","createAuthMiddleware","_ctx_body","returned","isAPIError","code","definitive","APIError","message","warn","Headers","accumulated","responseHeaders","getSetCookie","forEach","cookie","append","arguments","length","_options_plugins","_options_database","_options_sessionMaxAge","_options_keycloak","_options_keycloak1","_options_keycloak2","_options_keycloak3","process","env","BASE_URL","ONE_PORT","isProduction","NODE_ENV","keycloakBaseUrl","keycloak","KEYCLOAK_BACKCHANNEL_URL","keycloakRealm","KEYCLOAK_REALM","keycloakClientId","KEYCLOAK_CLIENT_ID","keycloakClientSecret","KEYCLOAK_CLIENT_SECRET","expoPlugin","enableExpo","expo","basePath","keycloakProviderConfig","tokenUrl","userInfoUrl","mapProfileToUser","profile","_profile_email_verified","handle","preferred_username","sub","email","emailVerified","email_verified","keycloakPublicPath","pathname","replace","publicKeycloakBaseFor2","requestOrigin","hostname","Object","defineProperty","enumerable","keycloakPublicBase","keycloakPublicBase2","base","oauthPlugin","genericOAuth","config","keycloakSsoPlugin","plugins","database","DATABASE_URL","betterAuth","baseURL","SECRET","trustedOrigins","includes","map"],"sources":["../../src/index.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,aAAA;AAAAC,QAAA,CAAAD,aAAA;EAAAE,4BAAA,EAAAA,CAAA,KAAAC,0BAAA,CAAAD,4BAAA;EAAAE,0BAAA,EAAAA,CAAA,KAAAD,0BAAA,CAAAC,0BAAA;EAAAC,yBAAA,EAAAA,CAAA,KAAAF,0BAAA,CAAAE,yBAAA;EAAAC,2BAAA,EAAAA,CAAA,KAAAH,0BAAA,CAAAG,2BAAA;EAAAC,UAAA,EAAAA,CAAA,KAAAA,UAAA;EAAAC,sBAAA,EAAAA,CAAA,KAAAA,sBAAA;EAAAC,oBAAA,EAAAA,CAAA,KAAAA,oBAAA;EAAAC,mBAAA,EAAAA,CAAA,KAAAP,0BAAA,CAAAO,mBAAA;EAAAC,oBAAA,EAAAA,CAAA,KAAAR,0BAAA,CAAAQ;AAAA;AAgBAC,MAAA,CAAAC,OAAA,GAAAlB,YAAA,CAAkCK,aAAA;AAClC,IAAAc,kBAAA,GAA+CC,OAAA;AAE/C,IAAAC,kBAMO,GAAAD,OAAA;AACP,IAAAE,UAAA,GAAAF,OAAsD;AACtD,IAAAG,cAAA,GAAuCH,OAAA;AACvC,IAAAI,cAAqB,GAAAJ,OAAA;AACrB,IAAAK,WAAA,GAAAL,OAAA,oBAAsE;AAEtE,IAAAM,yBAAA,GAAAN,OAOO;AAYP,IAAAZ,0BAA6B,GAAIY,OAAA;AAWjC,IAAAO,oBAAS,OAAoBR,kBAAkC,CAAAS,iBAAA;AAC7D,SAAMC,mBAAaA,CAAAC,GACjB;EAEF,IAAAC,SAAM,YAAgBC,UAAYA,CAAAC,IAAI;IACtC,OAAIC,qBAAiB,CAAUC,IAAA,WAAaC,OAAG;MAC7C,OAAM,IAAAf,kBAAwB,CAAAgB,kBAAmB,EAAAJ,IAAM,EAAAG,OAAU;IACjE;EACF;EAEA,IAAAE,aAAM,GAAAR,GAAe,CAAAS,OAAI,CAAAC,GAAQ,mBAAY;EAC7C,IAAIF,aAAA,IAAcP,SAAA,CAAAO,aAAA;IAChB,IAAIG,KAAA,GAAAX,GAAA,CAAAS,OAAA,CAAAC,GAAA;IACF,UAAMC,KAAM,MAAIH,aAAgB;EAChC;EAAoC,IACtCI,YAAQ,GAAAZ,GAAA,CAAAS,OAAA,CAAAC,GAAA;EAAA,IAERE,YAAA;IACF;MAEI,IAAAC,GAAA,OAAAC,GAAA,CAAAF,YAAA;MACF,IAAAX,SAAe,CAAAY,GAAI,CAAAV,IAAK,UAAAU,GAAA,CAAAE,MAAA;IAC1B,SAAQC,MAAA,GACN;EACF;EACF;IAqDA,OAAM,IAAAF,GAAA,CAAAd,GAAA,CAAAa,GAAA,EAAAE,MAAwB;EAC5B,SAAAC,MAAA;IACA;EACA;AAAA;AACA,IACAZ,qBAAA,IACA,aACA,eACA,aACA,eACF,QAsDA,WAAS,EACP,OAAM,EACN,SAAM,EAGN,WAAM,CASN;AACE,SAAIa,wBAAAC,OAAA;EACF;IAAAC,KAAM;IAAAC,QAAM;IAAMC,YAAM;IAAAC,MAAe;IAAAC,OAAA;IAAAC;EAAA,IAAAN,OAAA;EAAA,IAAAO,aAC7B,MAAAH,MAAA;EAAA,IAAAI,oBACG,YAAgBC,sBAAAC,OAAA;IAAoC,IAC/DC,8BAA0B;IAAA,OACxB,CAAAA,8BAAY,GAAAhC,oBAAA,CAAAiC,QAAA,gBAAAD,8BAAA,cAAAA,8BAAA,GAAAD,OAAA,GAAA7B,mBAAA,CAAA6B,OAAA;EAAA;EACG,IAAAG,yBACJ,kBAAAC,2BAAAC,YAAA;IAAA;MACI,IAChBC,GAAA,SAAAC,KAAA,CAAAV,aAAA;QACDW,MAAA,EAAQ;QACT3B,OAAA;UACG,cAAQ,EAAO;QACnB;QACA4B,IAAM,MAAAC,eAAkB,CAAK;UAC7BC,UAAa,iBAAU;UACzBC,aAAQ,EAAAP,YAAA;UACNQ,SAAO,EAAArB,QAAA;UACTsB,aAAA,EAAArB;QACF;QAEMsB,MAAA,EAAAC,WAAa,CAAAC,OAAA;MACjB;MACA,IAAMX,GAAA,CAAAY,EAAA,SAAe,KAAI;MACzB,IAAMZ,GAAA,CAAAa,MAAA,KAAc,OAAAb,GAAA,CAAAa,MAAkB,iBAAa,KAAK;MAExD,IAAMV,IAAA,SAAWH,GAAA,CAAAc,IAAA,GAAAC,KAAkB,aAAY;QAC/C,OAAM,IAAS;MACb;MACA,OAAM,CAAAZ,IAAI,SAAS,IAAGA,IAAA,uBAAAA,IAAA,CAAAa,KAAA,0BAAAb,IAAA,aAAAA,IAAA,uBAAAA,IAAA,CAAAa,KAAA;IACxB,SAAAlC,MAAA;MACA,OAAM;IAGN;EASA;EACA,IAAAmC,UAAM,OAAA3D,UAAqB,CAAA4D,kBAAI;IAAAhB,MACzB;EAAiC,mBACzBiB,GAAA;IACd,IAAAC,qBAAA,EAAAC,IAAA;IACA,IAAAC,aAAgB,IAAAF,qBAAM,GAAA5B,oBAAuB,CAAA2B,GAAM,CAAAzB,OAAU,eAAA0B,qBAAA,cAAAA,qBAAA,GAAA/B,OAAA;IAC7D,IAAIkC,YAAS,GAAAJ,GAAA,CAAAzB,OAAA,OAAAd,GAAA,CAAAuC,GAAA,CAAAzB,OAAA,CAAAf,GAAA,EAAA4C,YAAA;IACX,IAAAC,WAAM,IAAYH,IAAA,GAAME,YAAY,aAAAA,YACjC,KAAa,MAAQ,QAAO,CAC5B,GAAAA,YAAc,CAAA/C,GAAA,6BAAA6C,IAAA,cAAAA,IAAA;IACjB,IAAAI,QAAA,IACEF,YAAS,KAAM,QAAAA,YAAoB,cAAe,SAAUA,YAAG,CAAA/C,GAAW;IAC9E,IAAAkD,MAAA,YAAAC,QAAAhD,GAAA,EAAAiD,QAAA;MACA,IAAKH,QAAA,SAAaN,GAAA,CAAAL,IAAA;QAChBc,QAAM;QACJjD;MACF;MACA,MAAIwC,GAAA,CAAAS,QAAA,CAAejD,GAAA;IACjB;IAA4B,IAC9BkD,WAAA,GAAAL,WAAA;IACF,IAAAM,kBAAA,GAAAD,WAAA,CAAAE,UAAA,WAAAT,aAAA,GAAAO,WAAA,KAAAA,WAAA;IAEA,IAAIG,WAAA;IACF,IAAAC,YAAU,SAAQd,GAAA,CAAAe,eAAgB,CAAAf,GAAA,CAAAgB,OAAc,CAAAC,WAAc,CAAAH,YAA0B,CAAAI,IAAA,EAAAlB,GAAA,CAAAgB,OAAA,CAAAG,MAAA;IACtF,IAAAC,OAAI,SAAQ,IAAOjF,UAAM,CAAAkF,iBAAA,EAAArB,GAAA,EAAAJ,KAAA;MAC3B,OAAC;IACH;IACA,IAAAwB,OAAA;MAOA,IAAME,KAAA;MACN,IAAKC,cAAA;MACH,IAAAC,QAAO,GAAO,MAAAxB,GAAA,CAAAgB,OAAA,CAAAS,eAAyB,CAAAC,YAAA,CAAAN,OAAA,CAAAO,IAAA,CAAAC,EAAA,EAAAhC,KAAA;QACzC;MAEA;MACAiB,WAAW,IAAAS,KAAA,GAAa,CAAAC,cAAI,GAAAC,QAAA,CAAAK,IAA4B,WAAAC,OAAA,EAAkB;QAC1E,OAAWA,OAAA,CAAAC,UAAiB,eAAa;MACzC,EAAI,cAAaR,cAAW,UAAa,IAAI,SAAAA,cAAiB,CAAAS,OAAW,cAAAV,KAAA,cAAAA,KAAA;IACzE;IACD,KAAAT,WAAA;MAED,IAAOoB,aAAA,aAAA7F,cAAA,CAAA8F,gBAAA,EAAAlC,GAAA,EAAAJ,KAAA;QACD;MACJ;MACE,KAAAqC,aAAA,aAAAA,aAAA,uBAAAA,aAAA,CAAAF,UAAA,oBAAAE,aAAA,CAAAD,OAAA;QACFnB,WAAA,GAAAoB,aAAA,CAAAD,OAAA;MACA;IAAO;IACE,IACLlB,YAAA;MAAA,MACEd,GAAA,CAAAgB,OAAU,CAAAS,eAAY,CAAAU,aAAS,CAAArB,YAAA,EAAAlB,KAAA,WAAAC,KAAA;QAAAG,GAC/B,CAAAgB,OAAA,CAAAoB,MAAS,CAAAvC,KAAA,+CAAoC,EAAAA,KAAA;MAC3C;IACA;IACA,IAAAzD,cAAM,CAAAiG,mBAAgB,EAAArC,GAAA;IACtB,IAAAsC,YAAI,GAAMnE,qBAAS,CAAAgC,aAAA;IACnB,KAAAmC,YAAM,KAAAlB,OAAc,IAAI,CAAAP,WAA8C,KAAAC,YAAA;MACtE,OAAAP,MAAI,CAAAI,kBAAc,OAAe;IAEjC;IACA,IAAA4B,UAAK,OAAS9E,GAAA,IAAA6E,YAAA,WAAAxE,KAAA;IAKdyE,UAAA,CAAAnC,YAAM,CAAAoC,GAAY,2BAAkB,EAAA7B,kBACpB;IAEhB4B,UAAA,CAAAnC,YAAI,CAAAoC,GAAe,YAAS,EAAAzE,QAAA;IAAA,IAAA8C,WACzB,EAAA0B,UAAY,CAAAnC,YAAQ,CAAAoC,GAAA,gBAAe,EAAA3B,WAAA;IAAA,OAAAN,MACnC,CAAAgC,UAAA,CAAAE,QAAA;EACH;EACE;IAAmDb,EAAA,gBAC3C;IAAAc,SAAA,EACR;MACA5C;IACE;IAA6B6C,KAAA;MAC/BC,KAAA,EACF,CACA;QACAC,OAAK,WAAAA,OAAYA,CAAA7C,GAAA;UAIf,OAAAA,GAAO,CAAA8C,IAAI,wBAAS;QAAyB;QAClCC,OACT,MAAM5G,UAAA,CAAA6G,oBAAA,kBAAAhD,GAAA;UAAA,IACPiD,SAAA,EAAA1B,cAAA;UACH,IAAA2B,QAAA,GAAAlD,GAAA,CAAAgB,OAAA,CAAAkC,QAAA;UAEA,IAAI,KAAA/G,UAAe,CAAAgH,UAAA,EAAAD,QAAA;UAAA,IACjBlE,IAAA,GAAAkE,QAAA,CAAAlE,IAAA;UACF,KAAAA,IAAA,aAAAA,IAAA,uBAAAA,IAAA,CAAAoE,IAAA,MAAA7G,yBAAA,CAAAjB,0BAAA;UACA,IAAAyG,UAAM,IAAAkB,SAAqB,GAAAjD,GAAI,CAAAhB,IAAA,cAAAiE,SAAA,uBAAAA,SAAA,CAAAlB,UAAA;UAAA,IAC7BA,UAAY,IAAAA,UAAY,eAAa;UAAA,IACrCX,OAAI,GAAQ,UAAAjF,UAAA,CAAAkF,iBAAA,EAAArB,GAAA,EAAAJ,KAAA;YACd;UACA;UACE,KAAAwB,OAAU;UAGN,IAAAI,QAAI,SAAQxB,GAAO,CAAAgB,OAAM,CAAAS,eAAA,CAAAC,YAAA,CAAAN,OAAuC,CAAAO,IAAA,CAAAC,EAAA,EAAAhC,KAAA;YAClE,OAAC;UACL;UACA,IAAAhB,YAAA,IAAA2C,cAAA,GAAAC,QAAuB,CAAAK,IAAA,WAAAC,OAAA;YAKvB,OAAMA,OAAU,CAAAC,UAAI,KAAQ;UAC5B,QAAM,QAAAR,cAAgE,uBAAAA,cAAA,CAAA3C,YAAA;UACtE,KAAAA,YAAa;YACX,IAAAqD,aAAe,aAAc7F,cAAM,CAAA8F,gBAAA,EAAAlC,GAAA,EAAAJ,KAAA;cACpC;YACD;YACE,KAAAqC,aAAA,aAAAA,aAAA,uBAAAA,aAAA,CAAAF,UAAA;cACAnD,YAAA,GAAAqD,aAAA,CAAArD,YAAA;YAAA;UAC4B;UACpB,IACRyE,UAAA,GAAAzE,YAAA,SAAAF,yBAAA,CAAAE,YAAA;UAAA,IACA,CAAAyE,UAAA;YACF,WAAAlH,UAAA,CAAAmH,QAAA;cACDC,OAAA;cACHH,IAAA,EAAA7G,yBAAA,CAAAhB;YACF;UACF;UACFyE,GAAA,CAAAgB,OAAA,CAAAoB,MAAA,CAAAoB,IAAA;UACF,IAAA1C,YAAA,SAAAd,GAAA,CAAAe,eAAA,CAAAf,GAAA,CAAAgB,OAAA,CAAAC,WAAA,CAAAH,YAAA,CAAAI,IAAA,EAAAlB,GAAA,CAAAgB,OAAA,CAAAG,MAAA;UAMgB,IAAAL,YAAW,EAA6B;YAChD,MACJd,GAAA,CAAAgB,OAAQ,CAAAS,eAAmB,CAAAU,aAAgB,CAAArB,YAAA,EAAAlB,KAAoB,WAAQC,KAAI;cACvEG,GAAA,CAAAgB,OAAe,CAAAoB,MAAQ,CAAIvC,KAAA,iCAAa,EAAAA,KAAA;YAIxC;UAEA;UACA,IAAAzD,cAAY,CAAAiG,mBAA0B,EAAArC,GAAA;UAEtC,IAAA5C,OAAA,OAAmBqG,OAAQ;UAC3B,IAAAC,WAAA,GAAA1D,GACJ,CAAA2D,eAAkB;UAEdD,WAAa,SAAQ,IAAAA,WAAe,UAAQ,aAAAA,WAAS,CAAAE,YAAA,GAAAC,OAAA,WAAAC,MAAA;YAErD1G,OAAW,CAAA2G,MAAQ,aAAY,EAAAD,MAAA;UAE/B;UACD,WAAA3H,UAAA,CAAAmH,QAAS;YACVC,OAAU,GAAAvE,IAAA,aAAAA,IAAA,uBAAAA,IAAA,CAAAuE,OAAA;YACVH,IAAA,EAAc7G,yBAAA,CAAAjB;UACd,GAAA8B,OAAA;QACD;MAAA;IAAA;EAAA;AAAA;AAAA,SAMD3B,UAAaA,CAAA;EAAM,IACnBoC,OAAA,GAAAmG,SAAgB,CAAMC,MAAA,QAAAD,SAAA,iBAAAA,SAAA;EAAA,IAAAE,gBAAA,EAAAC,iBAAA,EAAAC,sBAAA;EAAA,IAAAC,iBAAA,EAAAC,kBAAA,EAAAC,kBAAA,EAAAC,kBAAA;EAAA,IAAAtG,OAAA,GAAAL,OAAA,CAAAK,OAAA,IAAAuG,OAAA,CAAAC,GAAA,CAAAC,QAAA,wBAAAF,OAAA,CAAAC,GAAA,CAAAE,QAAA;EAAA,IAAAC,YAAA,GAAAJ,OAAA,CAAAC,GAAA,CAAAI,QAAA;EAAA,IAAAC,eAAA,KAAAV,iBAAA,GAAAxG,OAAA,CAAAmH,QAAA,cAAAX,iBAAA,uBAAAA,iBAAA,CAAAnG,OAAA,KAAAuG,OAAA,CAAAC,GAAA,CAAAO,wBAAA,OAAA/G,OAAA;EAAA,IAAAgH,aAAA,KAAAZ,kBAAA,GAAAzG,OAAA,CAAAmH,QAAA,cAAAV,kBAAA,uBAAAA,kBAAA,CAAAxG,KAAA,KAAA2G,OAAA,CAAAC,GAAA,CAAAS,cAAA;EAAA,IAOtBlH,MAAA,MAAA8G,eAAmB,WAAiCG,aAAA;EAClD,IAAAE,gBAAe,KAAAb,kBAAQ,GAAA1G,OAAsB,CAAAmH,QAAQ,MAAO,IAAQ,IAAAT,kBAAc,uBAAAA,kBAAA,CAAAxG,QAAA,KAAA0G,OAAA,CAAAC,GAAA,CAAAW,kBAAA;EAClF,IAAAC,oBAAc,GAAQ,EAAAd,kBAAmB,GAAG3G,OAAM,CAAAmH,QAAY,cAAAR,kBAAA,uBAAAA,kBAAA,CAAAxG,YAAA,KAAAyG,OAAA,CAAAC,GAAA,CAAAa,sBAAA;EAC9D,IAAAC,UAAO,GAAA3H,OAAA,CAAA4H,UAAA,iBAAAnJ,WAAA,CAAAoJ,IAAA;EAAA,IAAAC,QACF,GAAA9H,OAAA,CAAA8H,QAAA;EAAA,IAAAC,sBACH;IAAA,IACA,GAAAvJ,cAAe,CAAA2I,QAAQ;MAAkBjH,QACnC,EAAAqH,gBAAgB;MACxBpH,YAAA,EAAAsH,oBAAA;MACFrH;IACF;IAGA;IACE;IACE;IACA;IACF;IACE4H,QAAA,EAAO,GAAA5H,MAAA;IACT6H,WAAA,KAAA7H,MAAA;IACF;IASA;IACE;IACA;IACE;IACA;IACE8H,gBAAI,WAAmBA,gBAAeA,CAAAC,OAAA;MACxC,IAAAC,uBAAA;MACA,IAAAC,MAAU,GAAAF,OAAU,CAAAG,kBAAG,IAAkBH,OAAA,CAAAI,GAAA,IAAAJ,OAAA,CAAApE,EAAA,IAAAoE,OAAA,CAAA9E,IAAA;MAC3C,IAAAmF,KAAQ,GAAAL,OAAA,CAAAK,KAAA,KAAAH,MAAA,MAAAA,MAAA;MACN,OAAO;QACT,GAAAF,OAAA;QACFK,KAAA;QAEKC,aAAc,GAAAL,uBAAA,GAAAD,OAAA,CAAAO,cAAA,cAAAN,uBAAA,cAAAA,uBAAA;QAQjB/E,IAAO,EAAA8E,OAAA,CAAA9E,IAAe,IAAAgF;MACpB;IAAY;EAEV;EACA,IAAAM,kBAAgB,GAAG,YAAS;IAAsC,IACpE;MACD,IAAA1D,IAAA,OAAArF,GAAA,CAAAsH,eAAA,EAAA0B,QAAA,CAAAC,OAAA;MAsBD,OAAM5D,IAAA,IAAAA,IAAA,QAAqB,GAAAA,IAA0B;IACnD,SAAMnF,MAAA,EAAS;MACf,OAAK;IACL;EAAmC,EACrC;EACA,IAAAQ,qBAAI,GAAoB,SAAAwI,uBAAAC,aAAA;IACtB,KAAAJ,kBAAO,EAAe,OAAAzB,eAAA;IAA4C,IAChE;MAAY,IACZvH,GAAA,GAAM,IAAAC,GAAA,CAAAS,OAAA;MACJ,KAAA2G,YAAa,IAAA+B,aAAA,EAAmB;QAChCpJ,GAAA,CAAAqJ,QAAO,OAAUpJ,GAAA,CAAImJ,aAAW,EAAAC,QAAA;MAA+C;MAEnF,OAAC,GAAArJ,GAAA,CAAAE,MAAA,GAAA8I,kBAAA;IAQD,SAAO7I,MAAA;MAAiD,OACtD;IAAY;EAEV;EACA,KAAAkH,YAAO;IAA2CiC,MACpD,CAAAC,cAAA,CAAAnB,sBAAA;MACFoB,UAAC;MACH3J,IAAA;QACF,IAAAK,MAAA,GAAAlB,oBAAA,CAAAiC,QAAA;QAIM,OAAAf,MAAA,MAAcA,MAAA,GAAAiI,QAAA,2BAAa;MAC/B;IACD;IAED,IAAMsB,kBAAA,GAAoB,SAAAC,mBAAwBA,CAAA;MAChD,IAAAxJ,MAAO,GAAAlB,oBAAA,CAAAiC,QAAA;MACP,KAAAf,MAAU,KAAA8I,kBAAA;MACV,OAAArI,qBAAc,CAAAT,MAAA;IACd;IACA,IAAA8I,kBAAA;MACAM,MAAA,CAAAC,cAAA,CAAAnB,sBAAA;QACDoB,UAAA;QAEK3J,IAAA;UACA,IAAA8J,IAAA,GAAcF,kBAAe;UACjC,OAAAE,IAAA,MAAAA,IAAA,WAAAjC,aAAA;QACA;MACA,CAAI;MACN4B,MAAA,CAAAC,cAAA,CAAAnB,sBAAA;QAIMoB,UAAA,EAAW;QAEjB3J,IAAA,EAAO;UACL,IAAA8J,IAAA,GAAAF,kBAAA;UAAA,OAAAE,IAAA,MAAAA,IAAA,WAAAjC,aAAA;QAAA;MAAA;IAAA;EAAA;EAAA,IAMAkC,WAAS,OAAA/K,cAAA,CAAAgL,YAAA;IACTC,MAAI,GACJ1B,sBAAgB;EAC0B;EACxC,IACA2B,iBAAA,GAAA3J,uBAAA;IAAAE,KAAA,EAAAoH,aAAA;IAAAnH,QAEI,EAAAqH,gBAAY;IAEXpH,YACL,EAAAsH,oBAAA;IAAArH,MAAA;IAAAC,OAAA;IAAAC;EAAA;EAAA,IAAAqJ,OAAA,QAMAhC,UAAI,IACNA,UAAA,CACA,QAAS4B,WACP,EAAaG,iBACF,OACTrD,gBAAgB,GAAArG,OAAA,CAAA2J,OAAiB,MAAI,IAAK,IAAKtD,gBAAA,cAAAA,gBAAA;EACrC,IAAAuD,QACV,IAAAtD,iBAAc,GAAAtG,OAAA,CAAA4J,QAAA,cAAAtD,iBAAA,cAAAA,iBAAA,GAAAM,OAAA,CAAAC,GAAA,CAAAgD,YAAA;EAAA,OAChB,IAAAxL,kBAAA,CAAAyL,UAAA;IACFhC,QAAA;IACA;IAAS;IACa;IAEtB;IACA;IACDiC,OAAA,EAAA1J,OAAA;IACH,IAAAuJ,QAAA;MAmBOA;IAKL,IAAM;IACJtG,MAAM,EAAAtD,OAAS,CAAAsD,MAAA,IAAAsD,OAAA,CAAAC,GAAoB,CAAGmD,MAAA;IACtCC,cAAO,EAASjK,OAAA,CAAAiK,cAAqB,IAAI,CAC3C5J,OAAA,EACA6G,eAAc;IAChB;IASO,IAASN,OAAA,CAAAC,GAAA,CAAAE,QAAA,IAAqB,CAAA1G,OAAgB,CAAA6J,QAAA,KAAAtD,OAAA,CAAAC,GAAA,CAAAE,QAAA,OAEnD,oBAA0BH,OAAc,CAAAC,GAAA,CAAAE,QAAA,GACtC,KAAO,GACT;IAGA;IACE;IACA;IACE;IACF;IACA,IAAAC,YAAO,SACT,UAEA,GAAS9H,qBAAY,CAAAiL,GAAW,WAAAlL,IAAA;MAClC,iBAAAA,IAAA","ignoreList":[]}

package/dist/esm/accessTokenRefresh.mjs

@@ -0,0 +1,40 @@
+const FAILED_TO_GET_ACCESS_TOKEN = "FAILED_TO_GET_ACCESS_TOKEN";
+const TOKEN_REFRESH_UNAVAILABLE = "TOKEN_REFRESH_UNAVAILABLE";
+const ACCESS_TOKEN_RETRY_DELAYS_MS = [0, 400, 1e3];
+function classifyAccessTokenResponse(status, body) {
+  if (status === 401 || status === 403) return "signed-out";
+  if (status === 400 && body?.code === FAILED_TO_GET_ACCESS_TOKEN) return "signed-out";
+  return "transient";
+}
+async function retryWhileTransient(attempt, opts) {
+  const delays = opts?.delaysMs ?? ACCESS_TOKEN_RETRY_DELAYS_MS;
+  const sleep = opts?.sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
+  let last = {
+    ok: false,
+    kind: "transient"
+  };
+  for (let i = 0; i < delays.length; i++) {
+    const wait = delays[i];
+    if (wait) await sleep(wait);
+    last = await attempt();
+    if (last.ok) return last;
+    if (last.kind === "signed-out") return last;
+  }
+  return last;
+}
+function watchDocumentVisible(revalidate) {
+  if (typeof document === "undefined" || typeof window === "undefined") {
+    return () => {};
+  }
+  const onVisible = () => {
+    if (document.visibilityState === "visible") revalidate();
+  };
+  document.addEventListener("visibilitychange", onVisible);
+  window.addEventListener("focus", onVisible);
+  return () => {
+    document.removeEventListener("visibilitychange", onVisible);
+    window.removeEventListener("focus", onVisible);
+  };
+}
+export { ACCESS_TOKEN_RETRY_DELAYS_MS, FAILED_TO_GET_ACCESS_TOKEN, TOKEN_REFRESH_UNAVAILABLE, classifyAccessTokenResponse, retryWhileTransient, watchDocumentVisible };
+//# sourceMappingURL=accessTokenRefresh.mjs.map

package/dist/esm/accessTokenRefresh.mjs.map

@@ -0,0 +1 @@
+{"version":3,"names":["FAILED_TO_GET_ACCESS_TOKEN","TOKEN_REFRESH_UNAVAILABLE","ACCESS_TOKEN_RETRY_DELAYS_MS","classifyAccessTokenResponse","status","body","code","retryWhileTransient","attempt","opts","delays","delaysMs","sleep","ms","Promise","resolve","setTimeout","last","ok","kind","i","length","wait","watchDocumentVisible","revalidate","document","window","onVisible","visibilityState","addEventListener","removeEventListener"],"sources":["../../src/accessTokenRefresh.ts"],"sourcesContent":[null],"mappings":"AAeO,MAAMA,0BAAA,GAA6B;AACnC,MAAMC,yBAAA,GAA4B;AAKlC,MAAMC,4BAAA,GAA+B,CAAC,GAAG,KAAK,GAAI;AAElD,SAASC,4BACdC,MAAA,EACAC,IAAA,EACwB;EACxB,IAAID,MAAA,KAAW,OAAOA,MAAA,KAAW,KAAK,OAAO;EAC7C,IAAIA,MAAA,KAAW,OAAOC,IAAA,EAAMC,IAAA,KAASN,0BAAA,EAA4B,OAAO;EACxE,OAAO;AACT;AAWA,eAAsBO,oBACpBC,OAAA,EACAC,IAAA,EAIgC;EAChC,MAAMC,MAAA,GAASD,IAAA,EAAME,QAAA,IAAYT,4BAAA;EACjC,MAAMU,KAAA,GAAQH,IAAA,EAAMG,KAAA,KAAWC,EAAA,IAAe,IAAIC,OAAA,CAASC,OAAA,IAAYC,UAAA,CAAWD,OAAA,EAASF,EAAE,CAAC;EAC9F,IAAII,IAAA,GAA8B;IAAEC,EAAA,EAAI;IAAOC,IAAA,EAAM;EAAY;EACjE,SAASC,CAAA,GAAI,GAAGA,CAAA,GAAIV,MAAA,CAAOW,MAAA,EAAQD,CAAA,IAAK;IACtC,MAAME,IAAA,GAAOZ,MAAA,CAAOU,CAAC;IACrB,IAAIE,IAAA,EAAM,MAAMV,KAAA,CAAMU,IAAI;IAC1BL,IAAA,GAAO,MAAMT,OAAA,CAAQ;IACrB,IAAIS,IAAA,CAAKC,EAAA,EAAI,OAAOD,IAAA;IACpB,IAAIA,IAAA,CAAKE,IAAA,KAAS,cAAc,OAAOF,IAAA;EACzC;EACA,OAAOA,IAAA;AACT;AAOO,SAASM,qBAAqBC,UAAA,EAAoC;EACvE,IAAI,OAAOC,QAAA,KAAa,eAAe,OAAOC,MAAA,KAAW,aAAa;IACpE,OAAO,MAAM,CAAC;EAChB;EACA,MAAMC,SAAA,GAAYA,CAAA,KAAM;IACtB,IAAIF,QAAA,CAASG,eAAA,KAAoB,WAAWJ,UAAA,CAAW;EACzD;EACAC,QAAA,CAASI,gBAAA,CAAiB,oBAAoBF,SAAS;EACvDD,MAAA,CAAOG,gBAAA,CAAiB,SAASF,SAAS;EAC1C,OAAO,MAAM;IACXF,QAAA,CAASK,mBAAA,CAAoB,oBAAoBH,SAAS;IAC1DD,MAAA,CAAOI,mBAAA,CAAoB,SAASH,SAAS;EAC/C;AACF","ignoreList":[]}

package/dist/esm/accessTokenRefresh.native.js

@@ -0,0 +1,45 @@
+var FAILED_TO_GET_ACCESS_TOKEN = "FAILED_TO_GET_ACCESS_TOKEN";
+var TOKEN_REFRESH_UNAVAILABLE = "TOKEN_REFRESH_UNAVAILABLE";
+var ACCESS_TOKEN_RETRY_DELAYS_MS = [0, 400, 1e3];
+function classifyAccessTokenResponse(status, body) {
+  if (status === 401 || status === 403) return "signed-out";
+  if (status === 400 && (body === null || body === void 0 ? void 0 : body.code) === FAILED_TO_GET_ACCESS_TOKEN) return "signed-out";
+  return "transient";
+}
+async function retryWhileTransient(attempt, opts) {
+  var _ref, _ref1;
+  var delays = (_ref = opts === null || opts === void 0 ? void 0 : opts.delaysMs) !== null && _ref !== void 0 ? _ref : ACCESS_TOKEN_RETRY_DELAYS_MS;
+  var sleep = (_ref1 = opts === null || opts === void 0 ? void 0 : opts.sleep) !== null && _ref1 !== void 0 ? _ref1 : function (ms) {
+    return new Promise(function (resolve) {
+      return setTimeout(resolve, ms);
+    });
+  };
+  var last = {
+    ok: false,
+    kind: "transient"
+  };
+  for (var i = 0; i < delays.length; i++) {
+    var wait = delays[i];
+    if (wait) await sleep(wait);
+    last = await attempt();
+    if (last.ok) return last;
+    if (last.kind === "signed-out") return last;
+  }
+  return last;
+}
+function watchDocumentVisible(revalidate) {
+  if (typeof document === "undefined" || typeof window === "undefined") {
+    return function () {};
+  }
+  var onVisible = function onVisible2() {
+    if (document.visibilityState === "visible") revalidate();
+  };
+  document.addEventListener("visibilitychange", onVisible);
+  window.addEventListener("focus", onVisible);
+  return function () {
+    document.removeEventListener("visibilitychange", onVisible);
+    window.removeEventListener("focus", onVisible);
+  };
+}
+export { ACCESS_TOKEN_RETRY_DELAYS_MS, FAILED_TO_GET_ACCESS_TOKEN, TOKEN_REFRESH_UNAVAILABLE, classifyAccessTokenResponse, retryWhileTransient, watchDocumentVisible };
+//# sourceMappingURL=accessTokenRefresh.native.js.map

package/dist/esm/accessTokenRefresh.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["FAILED_TO_GET_ACCESS_TOKEN","TOKEN_REFRESH_UNAVAILABLE","ACCESS_TOKEN_RETRY_DELAYS_MS","classifyAccessTokenResponse","status","body","code","retryWhileTransient","attempt","opts","_ref","_ref1","delays","delaysMs","sleep","ms","Promise","resolve","setTimeout","last","ok","kind","i","length","wait","watchDocumentVisible","revalidate","document","window"],"sources":["../../src/accessTokenRefresh.ts"],"sourcesContent":[null],"mappings":"AAeO,IAAAA,0BAAM,+BAA6B;AACnC,IAAAC,yBAAM,8BAA4B;AAKlC,IAAAC,4BAAM,IAEN,GAIL,KACA,IACA;AACF,SAAAC,4BAAAC,MAAA,EAAAC,IAAA;EAWA,IAAAD,MAAA,KAAsB,OAAAA,MAAA,KACpB,YACA,YAIgC;EAChC,IAAAA,MAAM,KAAS,OAAM,CAAAC,IAAA,SAAY,IAAAA,IAAA,uBAAAA,IAAA,CAAAC,IAAA,MAAAN,0BAAA;EACjC,OAAM,WAAQ;AACd;AACA,eAAaO,mBAAcA,CAAAC,OAAa,EAAAC,IAAA;EACtC,IAAAC,IAAM,EAAAC,KAAO;EACb,IAAAC,MAAI,GAAM,CAAAF,IAAM,GAAAD,IAAM,KAAI,QAAAA,IAAA,uBAAAA,IAAA,CAAAI,QAAA,cAAAH,IAAA,cAAAA,IAAA,GAAAR,4BAAA;EAC1B,IAAAY,KAAO,IAAAH,KAAM,GAAAF,IAAQ,aAAAA,IAAA,uBAAAA,IAAA,CAAAK,KAAA,cAAAH,KAAA,cAAAA,KAAA,aAAAI,EAAA;IACrB,OAAI,IAAKC,OAAI,WAAOC,OAAA;MACpB,OAASC,UAAS,CAAAD,OAAA,EAAAF,EAAc;IAClC;EACA;EACF,IAAAI,IAAA;IAOOC,EAAA,OAAS;IACdC,IAAI;EACF;EAAa,KAAC,IAAAC,CAAA,MAAAA,CAAA,GAAAV,MAAA,CAAAW,MAAA,EAAAD,CAAA;IAChB,IAAAE,IAAA,GAAAZ,MAAA,CAAAU,CAAA;IACA,IAAME,IAAA,QAAYV,KAAA,CAAMU,IAAA;IACtBL,IAAI,SAASX,OAAA;IACf,IAAAW,IAAA,CAAAC,EAAA,SAAAD,IAAA;IACA,IAAAA,IAAS,CAAAE,IAAA,iBAAiB,SAAAF,IAAA;EAC1B;EACA,OAAOA,IAAA;AACL;AACA,SAAAM,oBAAOA,CAAAC,UAA6B;EACtC,WAAAC,QAAA,2BAAAC,MAAA;IACF,oB","ignoreList":[]}