@multiplatform.one/auth 7.7.2

package/dist/jsx/index.native.js

@@ -0,0 +1,411 @@
+"use strict";
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all) __defProp(target, name, {
+    get: all[name],
+    enumerable: true
+  });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from)) if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    });
+  }
+  return to;
+};
+var __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
+  value: true
+}), mod);
+var index_exports = {};
+__export(index_exports, {
+  ACCESS_TOKEN_RETRY_DELAYS_MS: () => import_accessTokenRefresh2.ACCESS_TOKEN_RETRY_DELAYS_MS,
+  FAILED_TO_GET_ACCESS_TOKEN: () => import_accessTokenRefresh2.FAILED_TO_GET_ACCESS_TOKEN,
+  TOKEN_REFRESH_UNAVAILABLE: () => import_accessTokenRefresh2.TOKEN_REFRESH_UNAVAILABLE,
+  classifyAccessTokenResponse: () => import_accessTokenRefresh2.classifyAccessTokenResponse,
+  createAuth: () => createAuth,
+  createAuthRouteHandler: () => createAuthRouteHandler,
+  createSessionHelpers: () => createSessionHelpers,
+  retryWhileTransient: () => import_accessTokenRefresh2.retryWhileTransient,
+  watchDocumentVisible: () => import_accessTokenRefresh2.watchDocumentVisible
+});
+module.exports = __toCommonJS(index_exports);
+var import_async_hooks = require("async_hooks");
+var import_better_auth = require("better-auth");
+var import_api = require("better-auth/api");
+var import_cookies = require("better-auth/cookies");
+var import_plugins = require("better-auth/plugins");
+var import_expo = require("@better-auth/expo");
+var import_accessTokenRefresh = require("./accessTokenRefresh.native.js");
+var import_accessTokenRefresh2 = require("./accessTokenRefresh.native.js");
+var requestOriginStorage = new import_async_hooks.AsyncLocalStorage();
+function deriveRequestOrigin(req) {
+  var isDevHost = function isDevHost2(host) {
+    return DEV_LAN_HOST_PATTERNS.some(function (pattern) {
+      return (0, import_better_auth.matchesHostPattern)(host, pattern);
+    });
+  };
+  var forwardedHost = req.headers.get("x-forwarded-host");
+  if (forwardedHost && isDevHost(forwardedHost)) {
+    var proto = req.headers.get("x-forwarded-proto") === "https" ? "https" : "http";
+    return `${proto}://${forwardedHost}`;
+  }
+  var originHeader = req.headers.get("origin");
+  if (originHeader) {
+    try {
+      var url = new URL(originHeader);
+      if (isDevHost(url.host)) return url.origin;
+    } catch (unused) {}
+  }
+  try {
+    return new URL(req.url).origin;
+  } catch (unused) {
+    return void 0;
+  }
+}
+var DEV_LAN_HOST_PATTERNS = ["localhost", "localhost:*", "127.0.0.1", "127.0.0.1:*", "10.*", "192.168.*", "172.*", "*.local", "*.local:*"];
+function createKeycloakSsoPlugin(options) {
+  var {
+    realm,
+    clientId,
+    clientSecret,
+    issuer,
+    baseUrl,
+    publicKeycloakBaseFor
+  } = options;
+  var tokenEndpoint = `${issuer}/protocol/openid-connect/token`;
+  var resolveVisitorOrigin = function resolveVisitorOrigin2(request) {
+    var _requestOriginStorage_getStore;
+    return (_requestOriginStorage_getStore = requestOriginStorage.getStore()) !== null && _requestOriginStorage_getStore !== void 0 ? _requestOriginStorage_getStore : request ? deriveRequestOrigin(request) : void 0;
+  };
+  var isRefreshDefinitivelyDead = async function isRefreshDefinitivelyDead2(refreshToken) {
+    try {
+      var res = await fetch(tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+          client_id: clientId,
+          client_secret: clientSecret
+        }),
+        signal: AbortSignal.timeout(5e3)
+      });
+      if (res.ok) return false;
+      if (res.status !== 400 && res.status !== 401) return false;
+      var body = await res.json().catch(function () {
+        return null;
+      });
+      return (body === null || body === void 0 ? void 0 : body.error) === "invalid_grant" || (body === null || body === void 0 ? void 0 : body.error) === "invalid_token";
+    } catch (unused) {
+      return false;
+    }
+  };
+  var signOutSso = (0, import_api.createAuthEndpoint)("/sign-out/sso", {
+    method: "GET"
+  }, async function (ctx) {
+    var _resolveVisitorOrigin, _ref;
+    var visitorOrigin = (_resolveVisitorOrigin = resolveVisitorOrigin(ctx.request)) !== null && _resolveVisitorOrigin !== void 0 ? _resolveVisitorOrigin : baseUrl;
+    var searchParams = ctx.request ? new URL(ctx.request.url).searchParams : void 0;
+    var rawCallback = (_ref = searchParams === null || searchParams === void 0 ? void 0 : searchParams.get("callbackURL")) !== null && _ref !== void 0 ? _ref : null;
+    var jsonMode = (searchParams === null || searchParams === void 0 ? void 0 : searchParams.get("mode")) === "json";
+    var answer = function answer2(url, redirect) {
+      if (jsonMode) return ctx.json({
+        redirect,
+        url
+      });
+      throw ctx.redirect(url);
+    };
+    var callbackURL = rawCallback || "/";
+    var postLogoutRedirect = callbackURL.startsWith("/") ? `${visitorOrigin}${callbackURL}` : callbackURL;
+    var idTokenHint;
+    var sessionToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+    var session = await (0, import_api.getSessionFromCtx)(ctx).catch(function () {
+      return null;
+    });
+    if (session) {
+      var _ref1;
+      var _accounts_find;
+      var accounts = await ctx.context.internalAdapter.findAccounts(session.user.id).catch(function () {
+        return [];
+      });
+      idTokenHint = (_ref1 = (_accounts_find = accounts.find(function (account) {
+        return account.providerId === "keycloak";
+      })) === null || _accounts_find === void 0 ? void 0 : _accounts_find.idToken) !== null && _ref1 !== void 0 ? _ref1 : void 0;
+    }
+    if (!idTokenHint) {
+      var accountCookie = await (0, import_cookies.getAccountCookie)(ctx).catch(function () {
+        return null;
+      });
+      if ((accountCookie === null || accountCookie === void 0 ? void 0 : accountCookie.providerId) === "keycloak" && accountCookie.idToken) {
+        idTokenHint = accountCookie.idToken;
+      }
+    }
+    if (sessionToken) {
+      await ctx.context.internalAdapter.deleteSession(sessionToken).catch(function (error) {
+        ctx.context.logger.error("Failed to delete session during SSO sign-out", error);
+      });
+    }
+    (0, import_cookies.deleteSessionCookie)(ctx);
+    var keycloakBase = publicKeycloakBaseFor(visitorOrigin);
+    if (!keycloakBase || !session && !idTokenHint && !sessionToken) {
+      return answer(postLogoutRedirect, false);
+    }
+    var endSession = new URL(`${keycloakBase}/realms/${realm}/protocol/openid-connect/logout`);
+    endSession.searchParams.set("post_logout_redirect_uri", postLogoutRedirect);
+    endSession.searchParams.set("client_id", clientId);
+    if (idTokenHint) endSession.searchParams.set("id_token_hint", idTokenHint);
+    return answer(endSession.toString(), true);
+  });
+  return {
+    id: "keycloak-sso",
+    endpoints: {
+      signOutSso
+    },
+    hooks: {
+      after: [{
+        matcher: function matcher(ctx) {
+          return ctx.path === "/get-access-token";
+        },
+        handler: (0, import_api.createAuthMiddleware)(async function (ctx) {
+          var _ctx_body, _accounts_find;
+          var returned = ctx.context.returned;
+          if (!(0, import_api.isAPIError)(returned)) return;
+          var body = returned.body;
+          if ((body === null || body === void 0 ? void 0 : body.code) !== import_accessTokenRefresh.FAILED_TO_GET_ACCESS_TOKEN) return;
+          var providerId = (_ctx_body = ctx.body) === null || _ctx_body === void 0 ? void 0 : _ctx_body.providerId;
+          if (providerId && providerId !== "keycloak") return;
+          var session = await (0, import_api.getSessionFromCtx)(ctx).catch(function () {
+            return null;
+          });
+          if (!session) return;
+          var accounts = await ctx.context.internalAdapter.findAccounts(session.user.id).catch(function () {
+            return [];
+          });
+          var refreshToken = (_accounts_find = accounts.find(function (account) {
+            return account.providerId === "keycloak";
+          })) === null || _accounts_find === void 0 ? void 0 : _accounts_find.refreshToken;
+          if (!refreshToken) {
+            var accountCookie = await (0, import_cookies.getAccountCookie)(ctx).catch(function () {
+              return null;
+            });
+            if ((accountCookie === null || accountCookie === void 0 ? void 0 : accountCookie.providerId) === "keycloak") {
+              refreshToken = accountCookie.refreshToken;
+            }
+          }
+          var definitive = refreshToken ? await isRefreshDefinitivelyDead(refreshToken) : true;
+          if (!definitive) {
+            return new import_api.APIError("INTERNAL_SERVER_ERROR", {
+              message: "Keycloak token refresh temporarily unavailable",
+              code: import_accessTokenRefresh.TOKEN_REFRESH_UNAVAILABLE
+            });
+          }
+          ctx.context.logger.warn("Keycloak refresh token is dead (invalid_grant); revoking the stale Better Auth session");
+          var sessionToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+          if (sessionToken) {
+            await ctx.context.internalAdapter.deleteSession(sessionToken).catch(function (error) {
+              ctx.context.logger.error("Failed to delete stale session", error);
+            });
+          }
+          (0, import_cookies.deleteSessionCookie)(ctx);
+          var headers = new Headers();
+          var accumulated = ctx.responseHeaders;
+          accumulated === null || accumulated === void 0 ? void 0 : accumulated.getSetCookie().forEach(function (cookie) {
+            headers.append("set-cookie", cookie);
+          });
+          return new import_api.APIError("BAD_REQUEST", {
+            message: (body === null || body === void 0 ? void 0 : body.message) || "Failed to get a valid access token",
+            code: import_accessTokenRefresh.FAILED_TO_GET_ACCESS_TOKEN
+          }, headers);
+        })
+      }]
+    }
+  };
+}
+function createAuth() {
+  var options = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
+  var _options_plugins, _options_database, _options_sessionMaxAge;
+  var _options_keycloak, _options_keycloak1, _options_keycloak2, _options_keycloak3;
+  var baseUrl = options.baseUrl || process.env.BASE_URL || `http://localhost:${process.env.ONE_PORT || "3000"}`;
+  var isProduction = process.env.NODE_ENV === "production";
+  var keycloakBaseUrl = ((_options_keycloak = options.keycloak) === null || _options_keycloak === void 0 ? void 0 : _options_keycloak.baseUrl) || process.env.KEYCLOAK_BACKCHANNEL_URL || `${baseUrl}/auth`;
+  var keycloakRealm = ((_options_keycloak1 = options.keycloak) === null || _options_keycloak1 === void 0 ? void 0 : _options_keycloak1.realm) || process.env.KEYCLOAK_REALM || "master";
+  var issuer = `${keycloakBaseUrl}/realms/${keycloakRealm}`;
+  var keycloakClientId = ((_options_keycloak2 = options.keycloak) === null || _options_keycloak2 === void 0 ? void 0 : _options_keycloak2.clientId) || process.env.KEYCLOAK_CLIENT_ID || "";
+  var keycloakClientSecret = ((_options_keycloak3 = options.keycloak) === null || _options_keycloak3 === void 0 ? void 0 : _options_keycloak3.clientSecret) || process.env.KEYCLOAK_CLIENT_SECRET || "";
+  var expoPlugin = options.enableExpo !== false ? (0, import_expo.expo)() : void 0;
+  var basePath = options.basePath || "/api/auth";
+  var keycloakProviderConfig = {
+    ...(0, import_plugins.keycloak)({
+      clientId: keycloakClientId,
+      clientSecret: keycloakClientSecret,
+      issuer
+    }),
+    // Backchannel token/userinfo: `/get-access-token` refresh keeps these
+    // when discovery fails (Keycloak restart), so we don't depend on the
+    // well-known document coming up in the same instant as the token
+    // endpoint. Browser-facing authorize/issuer stay on the public /auth
+    // proxy (getters below).
+    tokenUrl: `${issuer}/protocol/openid-connect/token`,
+    userInfoUrl: `${issuer}/protocol/openid-connect/userinfo`,
+    // Wallet (SIWE-style) users authenticate by signature and have NO email —
+    // Keycloak issues them a username = wallet address and no email claim.
+    // better-auth's genericOAuth callback hard-rejects a user with no email
+    // ("email_is_missing"), so synthesize a stable, unique placeholder from the
+    // wallet address / subject. `.wallet` is a non-routable placeholder domain;
+    // the address stays the stable identity.
+    mapProfileToUser: function mapProfileToUser(profile) {
+      var _profile_email_verified;
+      var handle = profile.preferred_username || profile.sub || profile.id || profile.name;
+      var email = profile.email || (handle ? `${handle}@wallet` : void 0);
+      return {
+        ...profile,
+        email,
+        emailVerified: (_profile_email_verified = profile.email_verified) !== null && _profile_email_verified !== void 0 ? _profile_email_verified : true,
+        name: profile.name || handle
+      };
+    }
+  };
+  var keycloakPublicPath = function () {
+    try {
+      var path = new URL(keycloakBaseUrl).pathname.replace(/\/+$/, "");
+      return path && path !== "/" ? path : void 0;
+    } catch (unused) {
+      return void 0;
+    }
+  }();
+  var publicKeycloakBaseFor = function publicKeycloakBaseFor2(requestOrigin) {
+    if (!keycloakPublicPath) return keycloakBaseUrl;
+    try {
+      var url = new URL(baseUrl);
+      if (!isProduction && requestOrigin) {
+        url.hostname = new URL(requestOrigin).hostname;
+      }
+      return `${url.origin}${keycloakPublicPath}`;
+    } catch (unused) {
+      return void 0;
+    }
+  };
+  if (!isProduction) {
+    Object.defineProperty(keycloakProviderConfig, "redirectURI", {
+      enumerable: true,
+      get() {
+        var origin = requestOriginStorage.getStore();
+        return origin ? `${origin}${basePath}/oauth2/callback/keycloak` : void 0;
+      }
+    });
+    var keycloakPublicBase = function keycloakPublicBase2() {
+      var origin = requestOriginStorage.getStore();
+      if (!origin || !keycloakPublicPath) return void 0;
+      return publicKeycloakBaseFor(origin);
+    };
+    if (keycloakPublicPath) {
+      Object.defineProperty(keycloakProviderConfig, "authorizationUrl", {
+        enumerable: true,
+        get() {
+          var base = keycloakPublicBase();
+          return base ? `${base}/realms/${keycloakRealm}/protocol/openid-connect/auth` : void 0;
+        }
+      });
+      Object.defineProperty(keycloakProviderConfig, "issuer", {
+        enumerable: true,
+        get() {
+          var base = keycloakPublicBase();
+          return base ? `${base}/realms/${keycloakRealm}` : void 0;
+        }
+      });
+    }
+  }
+  var oauthPlugin = (0, import_plugins.genericOAuth)({
+    config: [keycloakProviderConfig]
+  });
+  var keycloakSsoPlugin = createKeycloakSsoPlugin({
+    realm: keycloakRealm,
+    clientId: keycloakClientId,
+    clientSecret: keycloakClientSecret,
+    issuer,
+    baseUrl,
+    publicKeycloakBaseFor
+  });
+  var plugins = [...(expoPlugin ? [expoPlugin] : []), oauthPlugin, keycloakSsoPlugin, ...((_options_plugins = options.plugins) !== null && _options_plugins !== void 0 ? _options_plugins : [])];
+  var database = (_options_database = options.database) !== null && _options_database !== void 0 ? _options_database : process.env.DATABASE_URL || void 0;
+  return (0, import_better_auth.betterAuth)({
+    basePath,
+    // Static on purpose: better-auth's dynamic `baseURL` config (allowedHosts)
+    // is not honored by the genericOAuth plugin — it pins redirect URIs at
+    // init time, which turned them relative and bounced callbacks to the
+    // Keycloak host. Dev multi-host support comes from the per-request
+    // redirectURI getter above + the LAN trustedOrigins below instead.
+    baseURL: baseUrl,
+    ...(database ? {
+      database
+    } : {}),
+    secret: options.secret || process.env.SECRET || "",
+    trustedOrigins: options.trustedOrigins || [baseUrl, keycloakBaseUrl,
+    // In dev, ONE_PORT may differ from BASE_URL; ensure the dev server origin is trusted.
+    ...(process.env.ONE_PORT && !baseUrl.includes(`:${process.env.ONE_PORT}`) ? [`http://localhost:${process.env.ONE_PORT}`] : []), "multiplatform-one://",
+    // Expo Go (dev) receives OAuth returns on the exp:// scheme — the app
+    // derives its callbackURL via Linking.createURL, which yields
+    // exp://<host>:<port>/--/ there. Never trusted in production builds.
+    // Dev also trusts private-network origins (see DEV_LAN_HOST_PATTERNS)
+    // so sign-in from a phone / the machine's LAN IP is not rejected.
+    ...(isProduction ? [] : ["exp://", ...DEV_LAN_HOST_PATTERNS.map(function (host) {
+      return `http://${host}`;
+    })])],
+    session: {
+      cookieCache: {
+        enabled: true,
+        maxAge: (_options_sessionMaxAge = options.sessionMaxAge) !== null && _options_sessionMaxAge !== void 0 ? _options_sessionMaxAge : 7 * 24 * 60 * 60,
+        strategy: "jwe",
+        refreshCache: true
+      }
+    },
+    account: {
+      storeStateStrategy: "cookie",
+      storeAccountCookie: true
+    },
+    plugins
+  });
+}
+function createAuthRouteHandler(auth) {
+  var handler = function handler2(req) {
+    var origin = deriveRequestOrigin(req);
+    return origin ? requestOriginStorage.run(origin, function () {
+      return auth.handler(req);
+    }) : auth.handler(req);
+  };
+  return {
+    GET: handler,
+    POST: handler
+  };
+}
+function createSessionHelpers(auth) {
+  async function getSession(req) {
+    return auth.api.getSession({
+      headers: req.headers
+    });
+  }
+  async function verifyAuth(req) {
+    var session = await auth.api.getSession({
+      headers: req.headers
+    });
+    if (!session) {
+      throw new Response("Unauthorized", {
+        status: 401
+      });
+    }
+    return session;
+  }
+  return {
+    verifyAuth,
+    getSession
+  };
+}
+//# sourceMappingURL=index.native.js.map

package/dist/jsx/index.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["__defProp","Object","defineProperty","__getOwnPropDesc","getOwnPropertyDescriptor","__getOwnPropNames","getOwnPropertyNames","__hasOwnProp","prototype","hasOwnProperty","__export","target","all","name","get","enumerable","__copyProps","to","from","except","desc","key","call","__toCommonJS","mod","value","index_exports","ACCESS_TOKEN_RETRY_DELAYS_MS","import_accessTokenRefresh2","FAILED_TO_GET_ACCESS_TOKEN","TOKEN_REFRESH_UNAVAILABLE","classifyAccessTokenResponse","createAuth","createAuthRouteHandler","createSessionHelpers","retryWhileTransient","watchDocumentVisible","module","exports","import_async_hooks","require","import_better_auth","import_api","import_cookies","import_plugins","import_expo","import_accessTokenRefresh","requestOriginStorage","AsyncLocalStorage","deriveRequestOrigin","req","isDevHost","isDevHost2","host","DEV_LAN_HOST_PATTERNS","some","pattern","matchesHostPattern","forwardedHost","headers","proto","originHeader","url","URL","origin","unused","createKeycloakSsoPlugin","options","realm","clientId","clientSecret","issuer","baseUrl","publicKeycloakBaseFor","tokenEndpoint","resolveVisitorOrigin","resolveVisitorOrigin2","request","_requestOriginStorage_getStore","getStore","isRefreshDefinitivelyDead","isRefreshDefinitivelyDead2","refreshToken","res","fetch","method","body","URLSearchParams","grant_type","refresh_token","client_id","client_secret","signal","AbortSignal","timeout","ok","status","json","catch","error","signOutSso","createAuthEndpoint","ctx","_resolveVisitorOrigin","_ref","visitorOrigin","searchParams","rawCallback","jsonMode","answer","answer2","redirect","callbackURL","postLogoutRedirect","startsWith","idTokenHint","sessionToken","getSignedCookie","context","authCookies","secret","session","getSessionFromCtx","_ref1","_accounts_find","accounts","internalAdapter","findAccounts","user","id","find","account","providerId","idToken","accountCookie","getAccountCookie","deleteSession","logger","deleteSessionCookie","keycloakBase","endSession","set","toString","endpoints","hooks","after","matcher","path","handler","createAuthMiddleware","_ctx_body","returned","isAPIError","code","definitive","APIError","message","warn","Headers","accumulated","responseHeaders","getSetCookie","forEach","cookie","append","arguments","length","_options_plugins","_options_database","_options_sessionMaxAge","_options_keycloak","_options_keycloak1","_options_keycloak2","_options_keycloak3","process","env","BASE_URL","ONE_PORT","isProduction","NODE_ENV","keycloakBaseUrl","keycloak","KEYCLOAK_BACKCHANNEL_URL","keycloakRealm","KEYCLOAK_REALM","keycloakClientId","KEYCLOAK_CLIENT_ID","keycloakClientSecret","KEYCLOAK_CLIENT_SECRET","expoPlugin","enableExpo","expo","basePath","keycloakProviderConfig","tokenUrl","userInfoUrl","mapProfileToUser","profile","_profile_email_verified","handle","preferred_username","sub","email","emailVerified","email_verified","keycloakPublicPath","pathname","replace","publicKeycloakBaseFor2","requestOrigin","hostname","keycloakPublicBase","keycloakPublicBase2","base","oauthPlugin","genericOAuth","config","keycloakSsoPlugin","plugins","database","DATABASE_URL","betterAuth","baseURL","SECRET"],"sources":["../../src/index.ts"],"sourcesContent":[null],"mappings":"AAgBA,YAAS;;AACT,IAAAA,SAAS,GAAAC,MAAY,CAAAC,cAAA;AAErB,IAAAC,gBAAA,GAAAF,MAAA,CAAAG,wBAAA;AAAA,IACEC,iBAAA,GAAAJ,MAAA,CAAAK,mBAAA;AAAA,IACAC,YAAA,GAAAN,MAAA,CAAAO,SAAA,CAAAC,cAAA;AAAA,IACAC,QAAA,GAAAA,CAAAC,MAAA,EAAAC,GAAA;EACA,SAAAC,IAAA,IAAAD,GAAA,EACAZ,SAAA,CAAAW,MAAA,EAAAE,IAAA;IAAAC,GAAA,EAAAF,GAAA,CAAAC,IAAA;IAAAE,UAAA;EAAA;AAAA;AAEF,IAAAC,WAAS,GAAAA,CAAAC,EAAA,EAAAC,IAAA,EAAAC,MAAqB,EAAAC,IAAA;EAC9B,IAAAF,IAAS,WAAAA,IAAc,iBAAgB,OAAAA,IAAA;IACvC,KAAS,IAAAG,GAAA,IAAAhB,iBAAY,CAAAa,IAAA,GACrB,IAAS,CAAAX,YAAA,CAAAe,IAAA,CAAAL,EAAA,EAAAI,GAAA,CAA4B,IAAAA,GAAA,KAAAF,MAAA,EAErCnB,SAAA,CAAAiB,EAAA,EAAAI,GAAA;MAAAP,GAAA,EAAAA,CAAA,KAAAI,IAAA,CAAAG,GAAA;MAAAN,UAAA,IAAAK,IAAA,GAAAjB,gBAAA,CAAAe,IAAA,EAAAG,GAAA,MAAAD,IAAA,CAAAL;IAAA;EACE;EACA,OAAAE,EAAA;AAAA;AACA,IACAM,YAAA,GAAAC,GAAA,IAAAR,WAAA,CAAAhB,SAAA;EAAAyB,KAAA;AAAA,IAAAD,GAAA;AAAA,IACAE,aAAA;AAAAhB,QACA,CAAAgB,aAAA;EAAAC,4BACK,EAAAA,CAAA,KAAAC,0BAAA,CAAAD,4BAAA;EAYPE,0BAAM,EAAuBA,CAAA,KAAID,0BAA0B,CAAAC,0BAAA;EAW3DC,yBAAS,EAAoBA,CAAA,KAAkCF,0BAAA,CAAAE,yBAAA;EAC7DC,2BAAmB,EACjBA,CAAA,KAAAH,0BAA4B,CAAAG,2BAA+B;EAE7DC,UAAM,EAAAA,CAAA,KAAAA,UAAoB;EAC1BC,sBAAqB,EAAAA,CAAA,KAAAA,sBAA0B;EAC7CC,oBAAkB,EAAAA,CAAA,KAAQA,oBAAI;EAC9BC,mBAAe,EAAAA,CAAA,KAAMP,0BAAa,CAAAO,mBAAA;EACpCC,oBAAA,EAAAA,CAAA,KAAAR,0BAAA,CAAAQ;AAEA;AACAC,MAAI,CAAAC,OAAA,GAAAf,YAAc,CAAAG,aAAA;AAChB,IAAAa,kBAAI,GAAAC,OAAA;AACF,IAAAC,kBAAgB,GAAAD,OAAI,cAAY;AAChC,IAAAE,UAAI,GAAAF,OAAc,kBAAkB;AAAA,IACtCG,cAAQ,GAAAH,OAAA;AAAA,IAERI,cAAA,GAAAJ,OAAA;AAAA,IACFK,WAAA,GAAAL,OAAA;AAEA,IAAAM,yBAAI,GAAAN,OAAA;AACF,IAAAZ,0BAAwB,GAAAY,OAAA;AAAA,IAC1BO,oBAAQ,OAAAR,kBAAA,CAAAS,iBAAA;AACN,SAAAC,mBAAOA,CAAAC,GAAA;EACT,IAAAC,SAAA,YAAAC,WAAAC,IAAA;IACF,OAAAC,qBAAA,CAAAC,IAAA,WAAAC,OAAA;MAqDM,WAAAf,kBAAwB,CAAAgB,kBAAA,EAAAJ,IAAA,EAAAG,OAAA;IAC5B;EACA;EACA,IAAAE,aAAA,GAAAR,GAAA,CAAAS,OAAA,CAAA7C,GAAA;EACA,IAAA4C,aAAA,IAAAP,SAAA,CAAAO,aAAA;IACA,IAAAE,KAAA,GAAAV,GAAA,CAAAS,OAAA,CAAA7C,GAAA;IACA,UAAA8C,KAAA,MAAAF,aAAA;EACA;EACA,IAAAG,YAAA,GAAAX,GAAA,CAAAS,OAAA,CAAA7C,GAAA;EACA,IAAA+C,YAAA;IACF;MAsDA,IAASC,GAAA,OAAAC,GAAA,CAAAF,YAAwB;MAC/B,IAAQV,SAAO,CAAAW,GAAA,CAAAT,IAAU,UAAAS,GAAc,CAAAE,MAAA;IACvC,SAAMC,MAAA,GAGN;EASA;EACE;IACE,WAAMF,GAAM,CAAAb,GAAA,CAAAY,GAAM,EAAAE,MAAM;EAAe,SACrCC,MAAQ;IAAA,OACR,MAAS;EAAsD;AACrC;AACZ,IAAAX,qBACG,eACf,EAAW,aACX,EAAe,WAChB,eACD,EAAgC,MACjC,EACD,WAAI,EACJ,SACA,WACA,WAAO,CAAmD;AAE1D,SAAAY,uBAAOA,CAAAC,OAAA;EAAA,IACT;IAAAC,KAAA;IAAAC,QAAA;IAAAC,YAAA;IAAAC,MAAA;IAAAC,OAAA;IAAAC;EAAA,IAAAN,OAAA;EACF,IAAAO,aAAA,MAAAH,MAAA;EAEA,IAAAI,oBAAmB,YAAAC,qBAAsCA,CAAAC,OAAQ;IAC/D,IAAAC,8BAAsB;IACtB,OAAM,CAAAA,8BAA6B,GAAI/B,oBAAqB,CAAAgC,QAAA,QAAe,QAAAD,8BAAA,cAAAA,8BAAA,GAAAD,OAAA,GAAA5B,mBAAA,CAAA4B,OAAA;EAC3E;EAEA,IAAAG,yBAAiB,kBAAwBC,0BAAMA,CAAAC,YAAA;IAC/C;MACE,IAAIC,GAAA,SAAUC,KAAO,CAAAV,aAAW;QAChCW,MAAM,EAAI;QACZ1B,OAAA;UACM,cAAc;QAGpB;QASI2B,IAAA,MAAAC,eAAA;UACEC,UAAA,iBAAyB;UACzBC,aAAQ,EAAAP,YAAY;UACpBQ,SAAQ,EAAArB,QAAA;UACdsB,aAAA,EAAArB;QACA,EAAM;QACFsB,MAAA,EAAAC,WAAS,CAAAC,OAAA;MACX;MAGA,IAAAX,GAAA,CAAAY,EAAA,SACE,KAAS;MACb,IAAAZ,GAAA,CAAAa,MAAA,YAAAb,GAAA,CAAAa,MAAA;MACA,IAAKV,IAAA,SAAaH,GAAA,CAAAc,IAAA,GAAAC,KAAA;QAChB,OAAM;MAA6C,EACjD;MACF,QAAAZ,IAAA,aAAAA,IAAA,uBAAAA,IAAA,CAAAa,KAAA,0BAAAb,IAAA,aAAAA,IAAA,uBAAAA,IAAA,CAAAa,KAAA;IACA,SAAIlC,MAAA;MACF;IAA4B;EAC9B;EAGF,IAAAmC,UAAI,OAAc1D,UAAA,CAAA2D,kBAAA;IAChBhB,MAAA,EAAM;EACJ,mBAAYiB,GAAA;IAAkE,IAC/EC,qBAAA,EAAAC,IAAA;IACH,IAAAC,aAAA,IAAAF,qBAAA,GAAA5B,oBAAA,CAAA2B,GAAA,CAAAzB,OAAA,eAAA0B,qBAAA,cAAAA,qBAAA,GAAA/B,OAAA;IACA,IAAAkC,YAAA,GAAAJ,GAAoB,CAAGzB,OAAA,OAAAd,GAAA,CAAAuC,GAAA,CAAAzB,OAAA,CAAAf,GAAA,EAAA4C,YAAA;IAOvB,IAAAC,WAAM,IAAAH,IAAe,GAAAE,YAAA,KAAsB,QAAAA,YAAa,uBAAAA,YAAA,CAAA5F,GAAA,6BAAA0F,IAAA,cAAAA,IAAA;IACxD,IAAII,QAAC,IAAAF,YAAkB,KAAW,IAAC,IAAAA,YAAgB,WAAe,YAAAA,YAAA,CAAA5F,GAAA;IAChE,IAAA+F,MAAO,YAAOC,QAAAhD,GAAA,EAAAiD,QAAyB;MACzC,IAAAH,QAAA,SAAAN,GAAA,CAAAL,IAAA;QAEAc,QAAM;QACNjD;MACA;MACA,MAAIwC,GAAA,CAAAS,QAAa,CAAAjD,GAAA;IACjB;IACD,IAAAkD,WAAA,GAAAL,WAAA;IAED,IAAAM,kBAAO,GAAAD,WAAA,CAAAE,UAAA,WAAAT,aAAA,GAAAO,WAAA,KAAAA,WAAA;IACL,IAAIG,WAAA;IACJ,IAAAC,YAAW,SAAAd,GAAA,CAAAe,eAAA,CAAAf,GAAA,CAAAgB,OAAA,CAAAC,WAAA,CAAAH,YAAA,CAAAvG,IAAA,EAAAyF,GAAA,CAAAgB,OAAA,CAAAE,MAAA;IAAA,IACTC,OAAA,aAAA/E,UAAA,CAAAgF,iBAAA,EAAApB,GAAA,EAAAJ,KAAA;MACF;IACA;IAAO,IACLuB,OAAO;MAAA,IACLE,KAAA;MAAA,IACEC,cAAU;MAAqB,IAC/BC,QAAA,GAAS,MAAAvB,GAAA,CAAAgB,OAAA,CAAAQ,eAA4B,CAAQC,YAAA,CAAAN,OAAA,CAAAO,IAAA,CAAAC,EAAA,EAAA/B,KAAA;QAC3C;MACA;MACAiB,WAAA,GAAM,CAAAQ,KAAO,IAAAC,cAAS,GAAAC,QAAA,CAAAK,IAAA,WAAAC,OAAA;QACtB,OAAAA,OAAU,CAAAC,UAAS;MACnB,YAAM,IAAAR,cAAkB,KAA8C,kBAAAA,cAAA,CAAAS,OAAA,cAAAV,KAAA,cAAAA,KAAA;IACtE;IAEA,KAAAR,WAAM;MACN,IAAAmB,aAAK,GAAS,UAAA3F,cAAA,CAAA4F,gBAAA,EAAAjC,GAAA,EAAAJ,KAAA;QAKd,WAAM;MAGN;MAA4B,KAAAoC,aACzB,KAAY,QAAQA,aAAe,uBAAAA,aAAA,CAAAF,UAAA,oBAAAE,aAAA,CAAAD,OAAA;QAAAlB,WACnC,GAAAmB,aAAA,CAAAD,OAAA;MACH;IACE;IAAmD,IAAAjB,YACjD,EAAM;MAAA,MAAAd,GACR,CAAAgB,OAAA,CAAAQ,eAAA,CAAAU,aAAA,CAAApB,YAAA,EAAAlB,KAAA,WAAAC,KAAA;QACAG,GAAA,CAAAgB,OAAI,CAAAmB,MAAA,CAAAtC,KAAA,CAAe,8CAA2B,EAAAA,KAAA;MAC5C;IAA6B;IAC/B,IAAAxD,cACF,CAAA+F,mBAAA,EAAApC,GAAA;IACA,IAAAqC,YAAM,GAAAlE,qBAAa,CAAAgC,aAAqB;IACxC,KAAAkC,YAAK,KAAAlB,OAAY,KAAAN,WAAA,KAAAC,YAAA;MAIf,OAAAP,MAAA,CAAAI,kBAAoB;IAAyB;IAClC,IAAA2B,UACT,OAAM7E,GAAA,IAAA4E,YAAA,WAAAvE,KAAA;IAAAwE,UACR,CAAClC,YAAA,CAAAmC,GAAA,6BAAA5B,kBAAA;IAAA2B,UACH,CAAAlC,YAAA,CAAAmC,GAAA,cAAAxE,QAAA;IAEA,IAAA8C,WAAI,EAAAyB,UAAe,CAAAlC,YAAA,CAAAmC,GAAA,kBAAA1B,WAAA;IAAA,OAAAN,MACjB,CAAA+B,UAAA,CAAAE,QAAA;EAAA;EAEF;IAA+Bb,EAAA,gBACzB;IAAiCc,SAAA,EACrC;MAAY3C;IAEd;IACE4C,KAAA;MAGIC,KAAA,GAAgE;QACjEC,OACL,WAAAA,QAAA5C,GAAA;UACA,OAAAA,GAAA,CAAA6C,IAAA,KAAoB,mBAAG;QAKvB;QACAC,OAAA,EAAM,IAAA1G,UAAe,CAAA2G,oBAAiD,kBAAA/C,GAAA;UACtE,IAAAgD,SAAa,EAAA1B,cAAe;UAC1B,IAAA2B,QAAQ,GAAAjD,GAAO,CAAAgB,OAAA,CAAAiC,QAAc;UAC/B,IAAC,KAAA7G,UAAA,CAAA8G,UAAA,EAAAD,QAAA;UACD,IAAAjE,IAAO,GAAIiE,QAAA,CAAAjE,IAAA;UAAA,IACT,CAAAA,IAAA,aAAAA,IAAA,uBAAAA,IAAA,CAAAmE,IAAA,MAAA3G,yBAAA,CAAAjB,0BAAA;UAAA,IACAuG,UAAA,IAAAkB,SAAA,GAAAhD,GAAA,CAAAhB,IAAA,cAAAgE,SAAA,uBAAAA,SAAA,CAAAlB,UAAA;UAAA,IACEA,UAAS,IAAAA,UAAM,KAAW;UAAA,IAC1BX,OAAM,aAAA/E,UAAA,CAAAgF,iBAAA,EAAApB,GAAA,EAAAJ,KAAA;YACR;UAAA,EACA;UACF,KAAAuB,OAAA;UACD,IAAAI,QAAA,SAAAvB,GAAA,CAAAgB,OAAA,CAAAQ,eAAA,CAAAC,YAAA,CAAAN,OAAA,CAAAO,IAAA,CAAAC,EAAA,EAAA/B,KAAA;YACH;UACF;UACF,IAAAhB,YAAA,IAAA0C,cAAA,GAAAC,QAAA,CAAAK,IAAA,WAAAC,OAAA;YACF,OAAAA,OAAA,CAAAC,UAAA;UACF,gBAAAR,cAAA,uBAAAA,cAAA,CAAA1C,YAAA;UAMgB,KAAAA,YAAW,EAA8B;YACjD,IACJoD,aAAQ,SAAW,IAAA3F,cAAY,CAAA4F,gBAAY,EAAAjC,GAAA,CAAoB,CAAAJ,KAAA,aAAY;cACvE,OAAe;YAIf;YAEA,KAAAoC,aAAwB,aAAUA,aAAS,KAAY,kBAAkBA,aAAA,CAAAF,UAAA;cACzElD,YAAY,GAAAoD,aAAe,CAAApD,YAAW;YAEtC;UACA;UAGA,IAAAwE,UAAa,GAAQxE,YAAA,GAAe,MAAAF,yBAAiB,CAAAE,YAAA;UAErD,KAAAwE,UAAmB;YAEnB,WAAAhH,UAAyB,CAAAiH,QAAA;cACjBC,OAAA;cACAH,IAAA,EAAA3G,yBAAA,CAAAhB;YACV;UACA;UACDwE,GAAA,CAAAgB,OAAA,CAAAmB,MAAA,CAAAoB,IAAA;UAAA,IAAAzC,YAAA,SAAAd,GAAA,CAAAe,eAAA,CAAAf,GAAA,CAAAgB,OAAA,CAAAC,WAAA,CAAAH,YAAA,CAAAvG,IAAA,EAAAyF,GAAA,CAAAgB,OAAA,CAAAE,MAAA;UAAA,IAAAJ,YAAA;YAAA,MAAAd,GAAA,CAAAgB,OAAA,CAAAQ,eAAA,CAAAU,aAAA,CAAApB,YAAA,EAAAlB,KAAA,WAAAC,KAAA;cAAAG,GAAA,CAAAgB,OAAA,CAAAmB,MAAA,CAAAtC,KAAA,mCAAAA,KAAA;YAAA;UAMD;UACA,IAAAxD,cAAsB,CAAA+F,mBAAA,EAAApC,GAAA;UAAA,IAAA3C,OAAA,OAAAmG,OAAA;UAAA,IAAAC,WAAA,GAAAzD,GAAA,CAAA0D,eAAA;UAAAD,WAAA,aAAAA,WAAA,uBAAAA,WAAA,CAAAE,YAAA,GAAAC,OAAA,WAAAC,MAAA;YAAAxG,OAAA,CAAAyG,MAAA,eAAAD,MAAA;UAAA;UAAA,WAAAzH,UAAA,CAAAiH,QAAA;YAOtBC,OAAA,EAAmB,CAAAtE,IAAA,SAAiC,IAAAA,IAAA,uBAAAA,IAAA,CAAAsE,OAAA;YAC5CH,IAAA,EAAA3G,yBAAiB,CAAAjB;UACjB,GAAA8B,OAAQ;QACd;MACE;IACA;EACyC;AACnB;AACxB,SACF3B,WAAA;EACF,IAAAmC,OAAA,GAAAkG,SAAA,CAAAC,MAAA,QAAAD,SAAA,iBAAAA,SAAA;EAGA,IAAAE,gBAAM,EAAAC,iBAA4B,EAAAC,sBAAA;EAChC,IAAAC,iBAAI,EAAAC,kBAAA,EAAAC,kBAAA,EAAAC,kBAAA;EACF,IAAArG,OAAM,GAAAL,OAAW,CAAAK,OAAI,IAAAsG,OAAe,CAAAC,GAAE,CAAAC,QAAS,wBAAkBF,OAAA,CAAAC,GAAA,CAAAE,QAAA;EACjE,IAAAC,YAAO,GAAQJ,OAAA,CAAAC,GAAS,CAAAI,QAAM,KAAO;EAAA,IACvCC,eAAQ,KAAAV,iBAAA,GAAAvG,OAAA,CAAAkH,QAAA,cAAAX,iBAAA,uBAAAA,iBAAA,CAAAlG,OAAA,KAAAsG,OAAA,CAAAC,GAAA,CAAAO,wBAAA,OAAA9G,OAAA;EACN,IAAA+G,aAAO,KAAAZ,kBAAA,GAAAxG,OAAA,CAAAkH,QAAA,cAAAV,kBAAA,uBAAAA,kBAAA,CAAAvG,KAAA,KAAA0G,OAAA,CAAAC,GAAA,CAAAS,cAAA;EAAA,IACTjH,MAAA,MAAA6G,eAAA,WAAAG,aAAA;EACF,IAAGE,gBAAA,KAAAb,kBAAA,GAAAzG,OAAA,CAAAkH,QAAA,cAAAT,kBAAA,uBAAAA,kBAAA,CAAAvG,QAAA,KAAAyG,OAAA,CAAAC,GAAA,CAAAW,kBAAA;EASH,IAAAC,oBAAM,KAAAd,kBAAyB,GAA+C1G,OAAA,CAAAkH,QAAA,cAAAR,kBAAA,uBAAAA,kBAAA,CAAAvG,YAAA,KAAAwG,OAAA,CAAAC,GAAA,CAAAa,sBAAA;EAC5E,IAAAC,UAAK,GAAA1H,OAAA,CAAA2H,UAA2B,iBAAAjJ,WAAA,CAAAkJ,IAAA;EAChC,IAAAC,QAAI,GAAA7H,OAAA,CAAA6H,QAAA;EACF,IAAAC,sBAAoB;IACpB,OAAKrJ,cAAA,CAAAyI,QAAgB;MACnBhH,QAAI,EAAAoH,gBAAmB;MACzBnH,YAAA,EAAAqH,oBAAA;MACApH;IACF;IACE;IACF;IACF;IAEA;IAQE;IAA6D2H,QAC3D,KAAA3H,MAAY;IAAA4H,WACN,KAAA5H,MAAA;IACJ;IACA;IAAkE;IAEtE;IAsBA;IACE;IACA6H,gBAAK,EAAW,SAAAA,gBAAoBA,CAAAC,OAAO;MAC3C,IAAAC,uBAAO;MACT,IAAAC,MAAA,GAAAF,OAAA,CAAAG,kBAAA,IAAAH,OAAA,CAAAI,GAAA,IAAAJ,OAAA,CAAApE,EAAA,IAAAoE,OAAA,CAAAxL,IAAA;MACA,IAAI6L,KAAA,GAAAL,OAAA,CAAAK,KAAoB,KAAAH,MAAA,MAAAA,MAAA;MACtB,OAAO;QACL,GAAAF,OAAA;QACAK,KAAA;QACEC,aAAM,EAAO,CAAAL,uBAAmB,GAAAD,OAAA,CAAAO,cAAA,cAAAN,uBAAA,cAAAA,uBAAA;QAChCzL,IAAA,EAAAwL,OAAO,CAAAxL,IAAO,IAAG0L;MAA8D;IACjF;EASF;EAAwD,IAAAM,kBAC1C;IAAA,IACZ;MACE,IAAA1D,IAAA,GAAM,IAAApF,GAAO,CAAAqH,eAAA,EAAmB0B,QAAA,CAAAC,OAAA;MAChC,OAAA5D,IAAO,IAAAA,IAAO,KAAG,GAAI,GAAAA,IAAA,GAAW;IAAkB,SACpDlF,MAAA;MACF,OAAC;IACH;EACF;EAIA,IAAAQ,qBAAoB,YAAauI,uBAAAC,aAAA;IAC/B,KAAAJ,kBAAS,SAA8EzB,eAAA;IACxF;MAED,IAAMtH,GAAA,OAAAC,GAAA,CAAAS,OAAoB;MACxB,KAAO0G,YAAA,IAAA+B,aAAA;QACPnJ,GAAA,CAAAoJ,QAAU,OAAAnJ,GAAA,CAAAkJ,aAAA,EAAAC,QAAA;MACV;MACA,UAAApJ,GAAA,CAAAE,MAAA,GAAA6I,kBAAA;IACA,SAAA5I,MAAA;MACA;IACD;EAED;EAAuB,IACrB,CAAIiH,YAAA,EAAc;IAClBjL,MAAA,CAAAC,cAAA,CAAA+L,sBAAA;MACAlL,UAAA;MACAD,GAAIA,CAAA;QACN,IAAAkD,MAAA,GAAAjB,oBAAA,CAAAgC,QAAA;QAIM,OAAAf,MAAW,MAAQA,MAAA,GAAAgI,QAAa,2BAA4B;MAElE;IACE;IAAA,IAAAmB,kBAAA,YAAAC,oBAAA;MAAA,IAAApJ,MAAA,GAAAjB,oBAAA,CAAAgC,QAAA;MAAA,KAAAf,MAAA,KAAA6I,kBAAA;MAAA,OAAApI,qBAAA,CAAAT,MAAA;IAAA;IAMA,IAAA6I,kBAAS;MACT5M,MAAI,CAAAC,cAAa,CAAA+L,sBAAc;QAC/BlL,UAAQ,EAAQ;QAChBD,IAAA;UACE,IAAAuM,IAAA,GAAAF,kBAAA;UACA,OAAAE,IAAA,MAAAA,IAAA,WAAA9B,aAAA;QAAA;MAEA;MAGAtL,MAAA,CAAAC,cAAA,CAAA+L,sBAAA;QAAAlL,UAAA;QAAAD,IAAA;UAAA,IAAAuM,IAAA,GAAAF,kBAAA;UAAA,OAAAE,IAAA,MAAAA,IAAA,WAAA9B,aAAA;QAAA;MAMA;IACF;EAAA;EACS,IACP+B,WAAA,GAAa,IAAA1K,cAAA,CAAA2K,YAAA;IAAAC,MACX,GAASvB,sBACO;EACN;EACI,IAChBwB,iBAAA,GAAAvJ,uBAAA;IACFE,KAAA,EAAAmH,aAAA;IACAlH,QAAA,EAASoH,gBAAA;IAAAnH,YACP,EAAAqH,oBAAoB;IAAApH,MACpB;IACFC,OAAA;IACAC;EACF,CAAC;EACH,IAAAiJ,OAAA,IAmBO,IAAA7B,UAAS,IAKdA,UAAM,CACJ,KAAM,GACNyB,WAAO,EACTG,iBAAA,EACA,KAAAlD,gBAAc,GAASpG,OAAM,CAAAuJ,OAAQ,cAAAnD,gBAAA,cAAAA,gBAAA,OACvC;EASO,IAAAoD,QAAS,IAAAnD,iBAAqB,GAAgBrG,OAAA,CAAAwJ,QAAA,cAAAnD,iBAAA,cAAAA,iBAAA,GAAAM,OAAA,CAAAC,GAAA,CAAA6C,YAAA;EAEnD,WAAAnL,kBAA0B,CAAAoL,UAAc;IACtC7B,QAAO;IACT;IAGA;IACE;IACA;IACE;IACF8B,OAAA,EAAAtJ,OAAA;IACA,IAAAmJ,QAAO;MACTA;IAEA,KAAO;IACTnG,MAAA,EAAArD,OAAA,CAAAqD,MAAA,IAAAsD,OAAA,CAAAC,GAAA,CAAAgD,MAAA","ignoreList":[]}

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@multiplatform.one/auth",
+  "version": "7.7.2",
+  "description": "Better Auth helpers for multiplatform.one apps with Keycloak",
+  "keywords": [
+    "auth",
+    "better-auth",
+    "keycloak",
+    "onestack"
+  ],
+  "homepage": "https://multiplatform.one",
+  "license": "Apache-2.0",
+  "author": "BitSpur",
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/bitspur/frappe/multiplatform.one.git",
+    "directory": "public/auth"
+  },
+  "source": "src/index.ts",
+  "files": [
+    "dist",
+    "src",
+    "types"
+  ],
+  "sideEffects": false,
+  "main": "src/index.ts",
+  "module": "src/index.ts",
+  "types": "src/index.ts",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "source": "./src/index.ts",
+      "types": "./src/index.ts",
+      "import": "./dist/esm/index.mjs",
+      "require": "./dist/cjs/index.cjs",
+      "default": "./src/index.ts"
+    },
+    "./access-token": {
+      "source": "./src/accessTokenRefresh.ts",
+      "types": "./src/accessTokenRefresh.ts",
+      "import": "./src/accessTokenRefresh.ts",
+      "require": "./src/accessTokenRefresh.ts",
+      "default": "./src/accessTokenRefresh.ts"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "rm -rf dist types 2>/dev/null && tamagui-build --ts-project ./tsconfig.build.json",
+    "test": "vitest run --coverage --coverage.provider=v8 --coverage.reporter=text --coverage.reporter=lcov --coverage.reporter=html",
+    "typecheck": "tsgo --noEmit"
+  },
+  "devDependencies": {
+    "@better-auth/expo": "^1.6.9",
+    "@multiplatform.one/config": "7.7.2",
+    "@multiplatform.one/test-utils": "7.7.2",
+    "@tamagui/build": "2.7.6",
+    "@vitest/coverage-v8": "^4.1.5",
+    "better-auth": "^1.6.9",
+    "typescript": "~5.9.3",
+    "vitest": "^4.1.5"
+  },
+  "peerDependencies": {
+    "@better-auth/expo": "^1.4.0",
+    "@multiplatform.one/wallet": "7.7.2",
+    "better-auth": "^1.4.0"
+  },
+  "peerDependenciesMeta": {
+    "@multiplatform.one/wallet": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "module:jsx": "dist/jsx"
+}

package/src/accessTokenRefresh.ts

@@ -0,0 +1,80 @@
+/**
+ * Isomorphic helpers for Keycloak access-token refresh.
+ *
+ * better-auth's `/get-access-token` collapses every refresh failure into
+ * `FAILED_TO_GET_ACCESS_TOKEN` (400). The Keycloak SSO plugin in `createAuth`
+ * reclassifies: a dead refresh token (`invalid_grant`) stays 400 and revokes
+ * the session; a Keycloak blip (restart, 5xx, network) is rewritten to
+ * `TOKEN_REFRESH_UNAVAILABLE` so clients can retry instead of signing the
+ * user out.
+ *
+ * Web and native token getters share this classifier so a restart never
+ * looks like a logout. Stream 9 (native) can import
+ * `@multiplatform.one/auth/access-token` without pulling Node `async_hooks`.
+ */
+
+export const FAILED_TO_GET_ACCESS_TOKEN = "FAILED_TO_GET_ACCESS_TOKEN";
+export const TOKEN_REFRESH_UNAVAILABLE = "TOKEN_REFRESH_UNAVAILABLE";
+
+export type AccessTokenFailureKind = "signed-out" | "transient";
+
+/** First attempt is immediate; later attempts wait out a Keycloak bounce. */
+export const ACCESS_TOKEN_RETRY_DELAYS_MS = [0, 400, 1000] as const;
+
+export function classifyAccessTokenResponse(
+  status: number,
+  body?: { code?: string } | null,
+): AccessTokenFailureKind {
+  if (status === 401 || status === 403) return "signed-out";
+  if (status === 400 && body?.code === FAILED_TO_GET_ACCESS_TOKEN) return "signed-out";
+  return "transient";
+}
+
+export type RetryAttemptResult<T> =
+  | { ok: true; value: T }
+  | { ok: false; kind: AccessTokenFailureKind };
+
+/**
+ * Retry an access-token fetch while the failure is transient (Keycloak
+ * restart, 5xx, network). A definitive signed-out answer stops immediately
+ * so we never hammer a revoked session.
+ */
+export async function retryWhileTransient<T>(
+  attempt: () => Promise<RetryAttemptResult<T>>,
+  opts?: {
+    delaysMs?: readonly number[];
+    sleep?: (ms: number) => Promise<void>;
+  },
+): Promise<RetryAttemptResult<T>> {
+  const delays = opts?.delaysMs ?? ACCESS_TOKEN_RETRY_DELAYS_MS;
+  const sleep = opts?.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let last: RetryAttemptResult<T> = { ok: false, kind: "transient" };
+  for (let i = 0; i < delays.length; i++) {
+    const wait = delays[i];
+    if (wait) await sleep(wait);
+    last = await attempt();
+    if (last.ok) return last;
+    if (last.kind === "signed-out") return last;
+  }
+  return last;
+}
+
+/**
+ * Revalidate when the tab becomes visible again (GitHub / Linear / Figma
+ * style: a backgrounded tab notices IdP logout or a recovered Keycloak
+ * without a full reload). Returns an unsubscribe. No-op on the server.
+ */
+export function watchDocumentVisible(revalidate: () => void): () => void {
+  if (typeof document === "undefined" || typeof window === "undefined") {
+    return () => {};
+  }
+  const onVisible = () => {
+    if (document.visibilityState === "visible") revalidate();
+  };
+  document.addEventListener("visibilitychange", onVisible);
+  window.addEventListener("focus", onVisible);
+  return () => {
+    document.removeEventListener("visibilitychange", onVisible);
+    window.removeEventListener("focus", onVisible);
+  };
+}