@nauth-toolkit/client 0.1.100 → 0.1.102

package/dist/index.cjs

@@ -1667,6 +1667,9 @@ var NAuthClient = class {
    * - In cookie delivery modes, httpOnly cookies can only be cleared by the backend; this method
    *   only clears client-side state (e.g., cached user + persisted tokens in JSON mode).
    *
+   * IMPORTANT: Also clears any pending challenge sessions to prevent ghost states where the UI
+   * shows a challenge screen but the backend session is invalid.
+   *
    * @param options - Optional behavior flags
    * @returns Promise that resolves when local state is cleared
    *
@@ -1678,6 +1681,7 @@ var NAuthClient = class {
    */
   async clearLocalAuthState(options) {
     await this.clearAuthState(options?.forgetDevice ?? false);
+    await this.clearChallenge();
   }
   /**
    * Logout current session.
@@ -1694,6 +1698,7 @@ var NAuthClient = class {
       console.warn("[nauth] Logout request failed (session may already be invalid):", error);
     } finally {
       await this.clearAuthState(forgetDevice);
+      await this.clearChallenge();
       this.eventEmitter.emit({
         type: "auth:logout",
         data: { forgetDevice: !!forgetDevice, global: false },
@@ -1721,6 +1726,7 @@ var NAuthClient = class {
         true
       );
       await this.clearAuthState(forgetDevices);
+      await this.clearChallenge();
       this.eventEmitter.emit({
         type: "auth:logout",
         data: { forgetDevice: !!forgetDevices, global: true },
@@ -1729,6 +1735,7 @@ var NAuthClient = class {
       return { revokedCount: result.revokedCount };
     } catch (error) {
       await this.clearAuthState(forgetDevices);
+      await this.clearChallenge();
       this.eventEmitter.emit({
         type: "auth:logout",
         data: { forgetDevice: !!forgetDevices, global: true },
@@ -2305,6 +2312,10 @@ var NAuthClient = class {
     if (forgetDevice && this.config.tokenDelivery === "json") {
       await this.config.storage.removeItem(this.config.deviceTrust.storageKey);
     }
+    try {
+      await this.oauthStorage.removeItem(OAUTH_STATE_KEY2);
+    } catch {
+    }
     this.config.onAuthStateChange?.(null);
   }
   /**