@nauth-toolkit/client 0.1.3

package/dist/angular/index.mjs

@@ -0,0 +1,1926 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+  if (kind && result) __defProp(target, key, result);
+  return result;
+};
+var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// src/angular/tokens.ts
+import { InjectionToken } from "@angular/core";
+var NAUTH_CLIENT_CONFIG = new InjectionToken("NAUTH_CLIENT_CONFIG");
+
+// src/angular/auth.service.ts
+import { Inject, Injectable as Injectable2, Optional, inject as inject2 } from "@angular/core";
+import { BehaviorSubject, from, Subject } from "rxjs";
+import { filter } from "rxjs/operators";
+
+// src/angular/http-adapter.ts
+import { Injectable, inject } from "@angular/core";
+import { HttpClient, HttpErrorResponse } from "@angular/common/http";
+import { firstValueFrom } from "rxjs";
+
+// src/core/errors.ts
+var _NAuthClientError = class _NAuthClientError extends Error {
+  /**
+   * Create a new client error.
+   *
+   * @param code - Error code from NAuthErrorCode enum
+   * @param message - Human-readable error message
+   * @param options - Optional metadata including details, statusCode, timestamp, and network error flag
+   */
+  constructor(code, message, options) {
+    super(message);
+    __publicField(this, "code");
+    __publicField(this, "details");
+    __publicField(this, "statusCode");
+    __publicField(this, "timestamp");
+    __publicField(this, "isNetworkError");
+    this.code = code;
+    this.details = options?.details;
+    this.statusCode = options?.statusCode;
+    this.timestamp = options?.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+    this.isNetworkError = options?.isNetworkError ?? false;
+    this.name = "NAuthClientError";
+    Object.setPrototypeOf(this, _NAuthClientError.prototype);
+  }
+  /**
+   * Check if error matches a specific error code.
+   *
+   * @param code - Error code to check against
+   * @returns True if the error code matches
+   *
+   * @example
+   * ```typescript
+   * if (error.isCode(NAuthErrorCode.RATE_LIMIT_SMS)) {
+   *   // Handle SMS rate limit
+   * }
+   * ```
+   */
+  isCode(code) {
+    return this.code === code;
+  }
+  /**
+   * Get error details/metadata.
+   *
+   * @returns Error details object or undefined
+   *
+   * @example
+   * ```typescript
+   * const details = error.getDetails();
+   * if (details?.retryAfter) {
+   *   console.log(`Retry after ${details.retryAfter} seconds`);
+   * }
+   * ```
+   */
+  getDetails() {
+    return this.details;
+  }
+  /**
+   * Get the error code.
+   *
+   * @returns The error code enum value
+   */
+  getCode() {
+    return this.code;
+  }
+  /**
+   * Serialize error to JSON object.
+   *
+   * @returns Plain object representation
+   *
+   * @example
+   * ```typescript
+   * const errorJson = error.toJSON();
+   * // { code: 'AUTH_INVALID_CREDENTIALS', message: '...', timestamp: '...', details: {...} }
+   * ```
+   */
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      timestamp: this.timestamp,
+      details: this.details,
+      statusCode: this.statusCode
+    };
+  }
+};
+__name(_NAuthClientError, "NAuthClientError");
+var NAuthClientError = _NAuthClientError;
+
+// src/angular/http-adapter.ts
+var AngularHttpAdapter = class {
+  constructor() {
+    __publicField(this, "http", inject(HttpClient));
+  }
+  /**
+   * Execute HTTP request using Angular's HttpClient.
+   *
+   * @param config - Request configuration
+   * @returns Response with parsed data
+   * @throws NAuthClientError if request fails
+   */
+  async request(config) {
+    try {
+      const data = await firstValueFrom(
+        this.http.request(config.method, config.url, {
+          body: config.body,
+          headers: config.headers,
+          withCredentials: config.credentials === "include",
+          observe: "body"
+          // Only return body data
+        })
+      );
+      return {
+        data,
+        status: 200,
+        // HttpClient only returns data on success
+        headers: {}
+        // Can extract from observe: 'response' if needed
+      };
+    } catch (error) {
+      if (error instanceof HttpErrorResponse) {
+        const errorData = error.error || {};
+        const code = typeof errorData["code"] === "string" ? errorData.code : "INTERNAL_ERROR" /* INTERNAL_ERROR */;
+        const message = typeof errorData["message"] === "string" ? errorData.message : error.message || `Request failed with status ${error.status}`;
+        const timestamp = typeof errorData["timestamp"] === "string" ? errorData.timestamp : void 0;
+        const details = errorData["details"];
+        throw new NAuthClientError(code, message, {
+          statusCode: error.status,
+          timestamp,
+          details,
+          isNetworkError: error.status === 0
+          // Network error (no response from server)
+        });
+      }
+      throw error;
+    }
+  }
+};
+__name(AngularHttpAdapter, "AngularHttpAdapter");
+AngularHttpAdapter = __decorateClass([
+  Injectable({ providedIn: "root" })
+], AngularHttpAdapter);
+
+// src/core/config.ts
+var defaultEndpoints = {
+  login: "/login",
+  signup: "/signup",
+  logout: "/logout",
+  logoutAll: "/logout/all",
+  refresh: "/refresh",
+  respondChallenge: "/respond-challenge",
+  resendCode: "/challenge/resend",
+  getSetupData: "/challenge/setup-data",
+  getChallengeData: "/challenge/challenge-data",
+  profile: "/profile",
+  changePassword: "/change-password",
+  requestPasswordChange: "/request-password-change",
+  mfaStatus: "/mfa/status",
+  mfaDevices: "/mfa/devices",
+  mfaSetupData: "/mfa/setup-data",
+  mfaVerifySetup: "/mfa/verify-setup",
+  mfaRemove: "/mfa/method",
+  mfaPreferred: "/mfa/preferred-method",
+  mfaBackupCodes: "/mfa/backup-codes/generate",
+  mfaExemption: "/mfa/exemption",
+  socialAuthUrl: "/social/auth-url",
+  socialCallback: "/social/callback",
+  socialLinked: "/social/linked",
+  socialLink: "/social/link",
+  socialUnlink: "/social/unlink",
+  socialVerify: "/social/:provider/verify",
+  trustDevice: "/trust-device",
+  isTrustedDevice: "/is-trusted-device",
+  auditHistory: "/audit/history",
+  updateProfile: "/profile"
+};
+var resolveConfig = /* @__PURE__ */ __name((config, defaultAdapter) => {
+  const resolvedEndpoints = {
+    ...defaultEndpoints,
+    ...config.endpoints ?? {}
+  };
+  return {
+    ...config,
+    csrf: {
+      cookieName: config.csrf?.cookieName ?? "nauth_csrf_token",
+      headerName: config.csrf?.headerName ?? "x-csrf-token"
+    },
+    deviceTrust: {
+      headerName: config.deviceTrust?.headerName ?? "X-Device-Token",
+      storageKey: config.deviceTrust?.storageKey ?? "nauth_device_token"
+    },
+    headers: config.headers ?? {},
+    timeout: config.timeout ?? 3e4,
+    endpoints: resolvedEndpoints,
+    storage: config.storage,
+    httpAdapter: config.httpAdapter ?? defaultAdapter
+  };
+}, "resolveConfig");
+
+// src/core/refresh.ts
+var ACCESS_TOKEN_KEY = "nauth_access_token";
+var REFRESH_TOKEN_KEY = "nauth_refresh_token";
+var ACCESS_EXPIRES_AT_KEY = "nauth_access_token_expires_at";
+var REFRESH_EXPIRES_AT_KEY = "nauth_refresh_token_expires_at";
+var USER_KEY = "nauth_user";
+var CHALLENGE_KEY = "nauth_challenge_session";
+var _TokenManager = class _TokenManager {
+  /**
+   * @param storage - storage adapter
+   */
+  constructor(storage) {
+    __publicField(this, "storage");
+    __publicField(this, "refreshPromise", null);
+    __publicField(this, "isBrowser", typeof window !== "undefined");
+    this.storage = storage;
+  }
+  /**
+   * Load tokens from storage.
+   */
+  async getTokens() {
+    const [accessToken, refreshToken, accessExpRaw, refreshExpRaw] = await Promise.all([
+      this.storage.getItem(ACCESS_TOKEN_KEY),
+      this.storage.getItem(REFRESH_TOKEN_KEY),
+      this.storage.getItem(ACCESS_EXPIRES_AT_KEY),
+      this.storage.getItem(REFRESH_EXPIRES_AT_KEY)
+    ]);
+    return {
+      accessToken,
+      refreshToken,
+      accessTokenExpiresAt: accessExpRaw ? Number(accessExpRaw) : null,
+      refreshTokenExpiresAt: refreshExpRaw ? Number(refreshExpRaw) : null
+    };
+  }
+  /**
+   * Persist tokens.
+   *
+   * @param tokens - new token pair
+   */
+  async setTokens(tokens) {
+    await Promise.all([
+      this.storage.setItem(ACCESS_TOKEN_KEY, tokens.accessToken),
+      this.storage.setItem(REFRESH_TOKEN_KEY, tokens.refreshToken),
+      this.storage.setItem(ACCESS_EXPIRES_AT_KEY, tokens.accessTokenExpiresAt.toString()),
+      this.storage.setItem(REFRESH_EXPIRES_AT_KEY, tokens.refreshTokenExpiresAt.toString())
+    ]);
+    this.broadcastStorage();
+  }
+  /**
+   * Clear tokens and related auth state.
+   */
+  async clearTokens() {
+    await Promise.all([
+      this.storage.removeItem(ACCESS_TOKEN_KEY),
+      this.storage.removeItem(REFRESH_TOKEN_KEY),
+      this.storage.removeItem(ACCESS_EXPIRES_AT_KEY),
+      this.storage.removeItem(REFRESH_EXPIRES_AT_KEY),
+      this.storage.removeItem(USER_KEY),
+      this.storage.removeItem(CHALLENGE_KEY)
+    ]);
+    this.broadcastStorage();
+  }
+  /**
+   * Ensure only one refresh in flight.
+   *
+   * @param refreshFn - function performing refresh request
+   */
+  async refreshOnce(refreshFn) {
+    if (!this.refreshPromise) {
+      this.refreshPromise = refreshFn().then(async (tokens) => {
+        await this.setTokens(tokens);
+        return tokens;
+      }).catch((error) => {
+        throw error;
+      }).finally(() => {
+        this.refreshPromise = null;
+      });
+    }
+    return this.refreshPromise;
+  }
+  /**
+   * Validate that a refresh token exists before attempting refresh.
+   */
+  async assertHasRefreshToken() {
+    const state = await this.getTokens();
+    if (!state.refreshToken) {
+      throw new NAuthClientError("AUTH_SESSION_NOT_FOUND" /* AUTH_SESSION_NOT_FOUND */, "No refresh token available");
+    }
+  }
+  /**
+   * Broadcast a no-op write to trigger storage listeners in other tabs.
+   */
+  broadcastStorage() {
+    if (!this.isBrowser) return;
+    try {
+      window.localStorage.setItem("nauth_sync", Date.now().toString());
+    } catch {
+    }
+  }
+};
+__name(_TokenManager, "TokenManager");
+var TokenManager = _TokenManager;
+
+// src/storage/browser.ts
+var _BrowserStorage = class _BrowserStorage {
+  /**
+   * Create a browser storage adapter.
+   *
+   * @param storage - Storage implementation (localStorage by default)
+   */
+  constructor(storage = window.localStorage) {
+    __publicField(this, "storage");
+    this.storage = storage;
+  }
+  async getItem(key) {
+    return this.storage.getItem(key);
+  }
+  async setItem(key, value) {
+    this.storage.setItem(key, value);
+  }
+  async removeItem(key) {
+    this.storage.removeItem(key);
+  }
+};
+__name(_BrowserStorage, "BrowserStorage");
+var BrowserStorage = _BrowserStorage;
+
+// src/storage/memory.ts
+var _InMemoryStorage = class _InMemoryStorage {
+  constructor() {
+    __publicField(this, "store", /* @__PURE__ */ new Map());
+  }
+  async getItem(key) {
+    return this.store.has(key) ? this.store.get(key) : null;
+  }
+  async setItem(key, value) {
+    this.store.set(key, value);
+  }
+  async removeItem(key) {
+    this.store.delete(key);
+  }
+};
+__name(_InMemoryStorage, "InMemoryStorage");
+var InMemoryStorage = _InMemoryStorage;
+
+// src/core/events.ts
+var _EventEmitter = class _EventEmitter {
+  constructor() {
+    __publicField(this, "listeners", /* @__PURE__ */ new Map());
+  }
+  /**
+   * Subscribe to an authentication event
+   *
+   * @param event - Event type or '*' for all events
+   * @param listener - Callback function
+   * @returns Unsubscribe function
+   *
+   * @example
+   * ```typescript
+   * const unsubscribe = emitter.on('auth:success', (event) => {
+   *   console.log('User logged in:', event.data);
+   * });
+   *
+   * // Later
+   * unsubscribe();
+   * ```
+   */
+  on(event, listener) {
+    if (!this.listeners.has(event)) {
+      this.listeners.set(event, /* @__PURE__ */ new Set());
+    }
+    this.listeners.get(event).add(listener);
+    return () => this.off(event, listener);
+  }
+  /**
+   * Unsubscribe from an authentication event
+   *
+   * @param event - Event type or '*'
+   * @param listener - Callback function to remove
+   */
+  off(event, listener) {
+    this.listeners.get(event)?.delete(listener);
+  }
+  /**
+   * Emit an authentication event
+   *
+   * Notifies all listeners for the specific event type and wildcard listeners.
+   *
+   * @param event - Event to emit
+   * @internal
+   */
+  emit(event) {
+    const specificListeners = this.listeners.get(event.type);
+    const wildcardListeners = this.listeners.get("*");
+    specificListeners?.forEach((listener) => {
+      try {
+        listener(event);
+      } catch (error) {
+        console.error(`Error in ${event.type} event listener:`, error);
+      }
+    });
+    wildcardListeners?.forEach((listener) => {
+      try {
+        listener(event);
+      } catch (error) {
+        console.error(`Error in wildcard event listener:`, error);
+      }
+    });
+  }
+  /**
+   * Remove all listeners
+   *
+   * @internal
+   */
+  clear() {
+    this.listeners.clear();
+  }
+};
+__name(_EventEmitter, "EventEmitter");
+var EventEmitter = _EventEmitter;
+
+// src/adapters/fetch-adapter.ts
+var _FetchAdapter = class _FetchAdapter {
+  /**
+   * Execute HTTP request using native fetch.
+   *
+   * @param config - Request configuration
+   * @returns Response with parsed data
+   * @throws NAuthClientError if request fails
+   */
+  async request(config) {
+    const fetchOptions = {
+      method: config.method,
+      headers: config.headers,
+      signal: config.signal,
+      credentials: config.credentials
+    };
+    if (config.body !== void 0) {
+      fetchOptions.body = JSON.stringify(config.body);
+    }
+    let response;
+    try {
+      response = await fetch(config.url, fetchOptions);
+    } catch (error) {
+      throw new NAuthClientError("INTERNAL_ERROR" /* INTERNAL_ERROR */, "Network request failed", {
+        isNetworkError: true,
+        details: { url: config.url, message: error.message }
+      });
+    }
+    const status = response.status;
+    let data = null;
+    const text = await response.text();
+    if (text) {
+      try {
+        data = JSON.parse(text);
+      } catch {
+        data = text;
+      }
+    }
+    const headers = {};
+    response.headers.forEach((value, key) => {
+      headers[key] = value;
+    });
+    if (!response.ok) {
+      const errorData = typeof data === "object" && data !== null ? data : {};
+      const code = typeof errorData["code"] === "string" ? errorData.code : "INTERNAL_ERROR" /* INTERNAL_ERROR */;
+      const message = typeof errorData["message"] === "string" ? errorData.message : `Request failed with status ${status}`;
+      const timestamp = typeof errorData["timestamp"] === "string" ? errorData.timestamp : void 0;
+      const details = errorData["details"];
+      throw new NAuthClientError(code, message, {
+        statusCode: status,
+        timestamp,
+        details
+      });
+    }
+    return { data, status, headers };
+  }
+};
+__name(_FetchAdapter, "FetchAdapter");
+var FetchAdapter = _FetchAdapter;
+
+// src/core/client.ts
+var USER_KEY2 = "nauth_user";
+var CHALLENGE_KEY2 = "nauth_challenge_session";
+var hasWindow = /* @__PURE__ */ __name(() => typeof globalThis !== "undefined" && typeof globalThis.window !== "undefined", "hasWindow");
+var defaultStorage = /* @__PURE__ */ __name(() => {
+  if (hasWindow() && typeof window.localStorage !== "undefined") {
+    return new BrowserStorage();
+  }
+  return new InMemoryStorage();
+}, "defaultStorage");
+var _NAuthClient = class _NAuthClient {
+  /**
+   * Create a new client instance.
+   *
+   * @param userConfig - Client configuration
+   */
+  constructor(userConfig) {
+    __publicField(this, "config");
+    __publicField(this, "tokenManager");
+    __publicField(this, "eventEmitter");
+    __publicField(this, "currentUser", null);
+    /**
+     * Handle cross-tab storage updates.
+     */
+    __publicField(this, "handleStorageEvent", /* @__PURE__ */ __name((event) => {
+      if (event.key === "nauth_sync") {
+        this.config.storage.getItem(USER_KEY2).then((value) => value ? JSON.parse(value) : null).then((user) => {
+          this.currentUser = user;
+          this.config.onAuthStateChange?.(user);
+        }).catch(() => {
+        });
+      }
+    }, "handleStorageEvent"));
+    const storage = userConfig.storage ?? defaultStorage();
+    const defaultAdapter = userConfig.httpAdapter ?? new FetchAdapter();
+    this.config = resolveConfig({ ...userConfig, storage }, defaultAdapter);
+    this.tokenManager = new TokenManager(storage);
+    this.eventEmitter = new EventEmitter();
+    if (hasWindow()) {
+      window.addEventListener("storage", this.handleStorageEvent);
+    }
+  }
+  /**
+   * Clean up resources.
+   */
+  dispose() {
+    if (hasWindow()) {
+      window.removeEventListener("storage", this.handleStorageEvent);
+    }
+  }
+  /**
+   * Login with identifier and password.
+   */
+  async login(identifier, password) {
+    const loginEvent = { type: "auth:login", data: { identifier }, timestamp: Date.now() };
+    this.eventEmitter.emit(loginEvent);
+    try {
+      const body = { identifier, password };
+      const response = await this.post(this.config.endpoints.login, body);
+      await this.handleAuthResponse(response);
+      if (response.challengeName) {
+        const challengeEvent = { type: "auth:challenge", data: response, timestamp: Date.now() };
+        this.eventEmitter.emit(challengeEvent);
+      } else {
+        const successEvent = { type: "auth:success", data: response, timestamp: Date.now() };
+        this.eventEmitter.emit(successEvent);
+      }
+      return response;
+    } catch (error) {
+      const authError = error instanceof NAuthClientError ? error : new NAuthClientError("AUTH_INVALID_CREDENTIALS" /* AUTH_INVALID_CREDENTIALS */, error.message || "Login failed");
+      const errorEvent = { type: "auth:error", data: authError, timestamp: Date.now() };
+      this.eventEmitter.emit(errorEvent);
+      throw authError;
+    }
+  }
+  /**
+   * Signup with credentials.
+   */
+  async signup(payload) {
+    this.eventEmitter.emit({ type: "auth:signup", data: { email: payload.email }, timestamp: Date.now() });
+    try {
+      const response = await this.post(this.config.endpoints.signup, payload);
+      await this.handleAuthResponse(response);
+      if (response.challengeName) {
+        this.eventEmitter.emit({ type: "auth:challenge", data: response, timestamp: Date.now() });
+      } else {
+        this.eventEmitter.emit({ type: "auth:success", data: response, timestamp: Date.now() });
+      }
+      return response;
+    } catch (error) {
+      const authError = error instanceof NAuthClientError ? error : new NAuthClientError("AUTH_INVALID_CREDENTIALS" /* AUTH_INVALID_CREDENTIALS */, error.message || "Signup failed");
+      this.eventEmitter.emit({ type: "auth:error", data: authError, timestamp: Date.now() });
+      throw authError;
+    }
+  }
+  /**
+   * Refresh tokens manually.
+   */
+  async refreshTokens() {
+    const tokenDelivery = this.getTokenDeliveryMode();
+    if (tokenDelivery === "json") {
+      await this.tokenManager.assertHasRefreshToken();
+    }
+    const body = tokenDelivery === "json" ? { refreshToken: (await this.tokenManager.getTokens()).refreshToken } : { refreshToken: "" };
+    const refreshFn = /* @__PURE__ */ __name(async () => {
+      return this.post(this.config.endpoints.refresh, body, false);
+    }, "refreshFn");
+    const tokens = await this.tokenManager.refreshOnce(refreshFn);
+    this.config.onTokenRefresh?.();
+    this.eventEmitter.emit({ type: "auth:refresh", data: { success: true }, timestamp: Date.now() });
+    return tokens;
+  }
+  /**
+   * Logout current session.
+   *
+   * Uses GET request to avoid CSRF token issues.
+   *
+   * @param forgetDevice - If true, also untrust the device (require MFA on next login)
+   */
+  async logout(forgetDevice) {
+    const queryParams = forgetDevice ? "?forgetMe=true" : "";
+    try {
+      await this.get(this.config.endpoints.logout + queryParams, true);
+    } catch (error) {
+      console.warn("[nauth] Logout request failed (session may already be invalid):", error);
+    } finally {
+      await this.clearAuthState(forgetDevice);
+      this.eventEmitter.emit({
+        type: "auth:logout",
+        data: { forgetDevice: !!forgetDevice, global: false },
+        timestamp: Date.now()
+      });
+    }
+  }
+  /**
+   * Logout all sessions.
+   *
+   * Revokes all active sessions for the current user across all devices.
+   * Optionally revokes all trusted devices if forgetDevices is true.
+   *
+   * @param forgetDevices - If true, also revokes all trusted devices (default: false)
+   * @returns Number of sessions revoked
+   */
+  async logoutAll(forgetDevices) {
+    try {
+      const payload = {
+        forgetDevices: forgetDevices ?? false
+      };
+      const result = await this.post(
+        this.config.endpoints.logoutAll,
+        payload,
+        true
+      );
+      await this.clearAuthState(forgetDevices);
+      this.eventEmitter.emit({
+        type: "auth:logout",
+        data: { forgetDevice: !!forgetDevices, global: true },
+        timestamp: Date.now()
+      });
+      return { revokedCount: result.revokedCount };
+    } catch (error) {
+      await this.clearAuthState(forgetDevices);
+      this.eventEmitter.emit({
+        type: "auth:logout",
+        data: { forgetDevice: !!forgetDevices, global: true },
+        timestamp: Date.now()
+      });
+      throw error;
+    }
+  }
+  /**
+   * Respond to a challenge.
+   *
+   * Validates challenge response data before sending to backend.
+   * Provides helpful error messages for common validation issues.
+   *
+   * @param response - Challenge response data
+   * @returns Auth response from backend
+   * @throws {NAuthClientError} If validation fails
+   */
+  async respondToChallenge(response) {
+    if (response.type === "MFA_SETUP_REQUIRED" /* MFA_SETUP_REQUIRED */ && response.method === "totp") {
+      const setupData = response.setupData;
+      if (!setupData || typeof setupData !== "object") {
+        throw new NAuthClientError(
+          "VALIDATION_FAILED" /* VALIDATION_FAILED */,
+          "TOTP setup requires setupData with both secret and code",
+          { details: { field: "setupData" } }
+        );
+      }
+      const secret = setupData["secret"];
+      const code = setupData["code"];
+      if (!secret || typeof secret !== "string") {
+        throw new NAuthClientError(
+          "VALIDATION_FAILED" /* VALIDATION_FAILED */,
+          "TOTP setup requires secret in setupData. Make sure to include the secret from getSetupData() response.",
+          { details: { field: "secret" } }
+        );
+      }
+      if (!code || typeof code !== "string") {
+        throw new NAuthClientError(
+          "VALIDATION_FAILED" /* VALIDATION_FAILED */,
+          "TOTP setup requires code in setupData. Please enter the verification code from your authenticator app.",
+          { details: { field: "code" } }
+        );
+      }
+    }
+    try {
+      const result = await this.post(this.config.endpoints.respondChallenge, response);
+      await this.handleAuthResponse(result);
+      if (result.challengeName) {
+        const challengeEvent = { type: "auth:challenge", data: result, timestamp: Date.now() };
+        this.eventEmitter.emit(challengeEvent);
+      } else {
+        const successEvent = { type: "auth:success", data: result, timestamp: Date.now() };
+        this.eventEmitter.emit(successEvent);
+      }
+      return result;
+    } catch (error) {
+      const authError = error instanceof NAuthClientError ? error : new NAuthClientError(
+        "CHALLENGE_INVALID" /* CHALLENGE_INVALID */,
+        error.message || "Challenge response failed"
+      );
+      const errorEvent = { type: "auth:error", data: authError, timestamp: Date.now() };
+      this.eventEmitter.emit(errorEvent);
+      throw authError;
+    }
+  }
+  /**
+   * Resend a challenge code.
+   */
+  async resendCode(session) {
+    const payload = { session };
+    return this.post(this.config.endpoints.resendCode, payload);
+  }
+  /**
+   * Get setup data for MFA.
+   *
+   * Returns method-specific setup information:
+   * - TOTP: { secret, qrCode, manualEntryKey }
+   * - SMS: { maskedPhone }
+   * - Email: { maskedEmail }
+   * - Passkey: WebAuthn registration options
+   *
+   * @param session - Challenge session token
+   * @param method - MFA method to set up
+   * @returns Setup data wrapped in GetSetupDataResponse
+   */
+  async getSetupData(session, method) {
+    const payload = { session, method };
+    return this.post(this.config.endpoints.getSetupData, payload);
+  }
+  /**
+   * Get challenge data (e.g., WebAuthn options).
+   *
+   * Returns challenge-specific data for verification flows.
+   *
+   * @param session - Challenge session token
+   * @param method - Challenge method to get data for
+   * @returns Challenge data wrapped in GetChallengeDataResponse
+   */
+  async getChallengeData(session, method) {
+    const payload = { session, method };
+    return this.post(this.config.endpoints.getChallengeData, payload);
+  }
+  /**
+   * Get current user profile.
+   */
+  async getProfile() {
+    const profile = await this.get(this.config.endpoints.profile, true);
+    await this.setUser(profile);
+    return profile;
+  }
+  /**
+   * Update user profile.
+   */
+  async updateProfile(updates) {
+    const updated = await this.put(this.config.endpoints.updateProfile, updates, true);
+    await this.setUser(updated);
+    return updated;
+  }
+  /**
+   * Change user password.
+   */
+  async changePassword(oldPassword, newPassword) {
+    const payload = { currentPassword: oldPassword, newPassword };
+    await this.post(this.config.endpoints.changePassword, payload, true);
+  }
+  /**
+   * Request password change (must change on next login).
+   */
+  async requestPasswordChange() {
+    await this.post(this.config.endpoints.requestPasswordChange, {}, true);
+  }
+  /**
+   * Get MFA status.
+   */
+  async getMfaStatus() {
+    return this.get(this.config.endpoints.mfaStatus, true);
+  }
+  /**
+   * Get MFA devices.
+   */
+  async getMfaDevices() {
+    return this.get(this.config.endpoints.mfaDevices, true);
+  }
+  /**
+   * Setup MFA device (authenticated user).
+   */
+  async setupMfaDevice(method) {
+    return this.post(this.config.endpoints.mfaSetupData, { method }, true);
+  }
+  /**
+   * Verify MFA setup (authenticated user).
+   */
+  async verifyMfaSetup(method, setupData, deviceName) {
+    return this.post(
+      this.config.endpoints.mfaVerifySetup,
+      { method, setupData, deviceName },
+      true
+    );
+  }
+  /**
+   * Remove MFA method.
+   */
+  async removeMfaDevice(method) {
+    const path = `${this.config.endpoints.mfaRemove}/${method}`;
+    return this.delete(path, true);
+  }
+  /**
+   * Set preferred MFA method.
+   *
+   * @param method - Device method to set as preferred ('totp', 'sms', 'email', or 'passkey'). Cannot be 'backup'.
+   * @returns Success message
+   */
+  async setPreferredMfaMethod(method) {
+    return this.post(this.config.endpoints.mfaPreferred, { method }, true);
+  }
+  /**
+   * Generate backup codes.
+   */
+  async generateBackupCodes() {
+    const result = await this.post(this.config.endpoints.mfaBackupCodes, {}, true);
+    return result.codes;
+  }
+  /**
+   * Set MFA exemption (admin/test scenarios).
+   */
+  async setMfaExemption(exempt, reason) {
+    await this.post(this.config.endpoints.mfaExemption, { exempt, reason }, true);
+  }
+  // ============================================================================
+  // Event System
+  // ============================================================================
+  /**
+   * Subscribe to authentication events.
+   *
+   * Emits events throughout the auth lifecycle for custom logic, analytics, or UI updates.
+   *
+   * @param event - Event type to listen for, or '*' for all events
+   * @param listener - Callback function to handle the event
+   * @returns Unsubscribe function
+   *
+   * @example
+   * ```typescript
+   * // Listen to successful authentication
+   * const unsubscribe = client.on('auth:success', (event) => {
+   *   console.log('User logged in:', event.data.user);
+   *   analytics.track('login_success');
+   * });
+   *
+   * // Listen to all events
+   * client.on('*', (event) => {
+   *   console.log('Auth event:', event.type, event.data);
+   * });
+   *
+   * // Unsubscribe when done
+   * unsubscribe();
+   * ```
+   */
+  on(event, listener) {
+    return this.eventEmitter.on(event, listener);
+  }
+  /**
+   * Unsubscribe from authentication events.
+   *
+   * @param event - Event type
+   * @param listener - Callback function to remove
+   */
+  off(event, listener) {
+    this.eventEmitter.off(event, listener);
+  }
+  // ============================================================================
+  // Social Authentication
+  // ============================================================================
+  /**
+   * Start social OAuth flow with automatic state management.
+   *
+   * Generates a secure state token, stores OAuth context, and redirects to the OAuth provider.
+   * After OAuth callback, use `handleOAuthCallback()` to complete authentication.
+   *
+   * @param provider - OAuth provider ('google', 'apple', 'facebook')
+   * @param options - Optional configuration
+   *
+   * @example
+   * ```typescript
+   * // Simple usage
+   * await client.loginWithSocial('google');
+   *
+   * // With custom redirect URI
+   * await client.loginWithSocial('apple', {
+   *   redirectUri: 'https://example.com/auth/callback'
+   * });
+   * ```
+   */
+  async loginWithSocial(provider, _options) {
+    this.eventEmitter.emit({ type: "oauth:started", data: { provider }, timestamp: Date.now() });
+    const { url } = await this.getSocialAuthUrl({ provider });
+    if (hasWindow()) {
+      window.location.href = url;
+    }
+  }
+  /**
+   * Auto-detect and handle OAuth callback.
+   *
+   * Call this on app initialization or in callback route.
+   * Returns null if not an OAuth callback (no provider/code params).
+   *
+   * The SDK validates the state token, completes authentication via backend,
+   * and emits appropriate events.
+   *
+   * @param urlOrParams - Optional URL string or URLSearchParams (auto-detects from window.location if not provided)
+   * @returns AuthResponse if OAuth callback detected, null otherwise
+   *
+   * @example
+   * ```typescript
+   * // Auto-detect on app init
+   * const response = await client.handleOAuthCallback();
+   * if (response) {
+   *   if (response.challengeName) {
+   *     router.navigate(['/challenge', response.challengeName]);
+   *   } else {
+   *     router.navigate(['/']); // Navigate to your app's home route
+   *   }
+   * }
+   *
+   * // In callback route
+   * const response = await client.handleOAuthCallback(window.location.search);
+   * ```
+   */
+  async handleOAuthCallback(urlOrParams) {
+    let params;
+    if (urlOrParams instanceof URLSearchParams) {
+      params = urlOrParams;
+    } else if (typeof urlOrParams === "string") {
+      params = new URLSearchParams(urlOrParams);
+    } else if (hasWindow()) {
+      params = new URLSearchParams(window.location.search);
+    } else {
+      return null;
+    }
+    const provider = params.get("provider");
+    const code = params.get("code");
+    const state = params.get("state");
+    const error = params.get("error");
+    if (!provider || !code && !error) {
+      return null;
+    }
+    this.eventEmitter.emit({ type: "oauth:callback", data: { provider }, timestamp: Date.now() });
+    try {
+      if (error) {
+        const authError = new NAuthClientError(
+          "SOCIAL_TOKEN_INVALID" /* SOCIAL_TOKEN_INVALID */,
+          params.get("error_description") || error,
+          { details: { error, provider } }
+        );
+        this.eventEmitter.emit({ type: "oauth:error", data: authError, timestamp: Date.now() });
+        throw authError;
+      }
+      if (!state) {
+        throw new NAuthClientError("CHALLENGE_INVALID" /* CHALLENGE_INVALID */, "Missing OAuth state parameter");
+      }
+      const response = await this.handleSocialCallback({
+        provider,
+        code,
+        state
+      });
+      if (response.challengeName) {
+        this.eventEmitter.emit({ type: "auth:challenge", data: response, timestamp: Date.now() });
+      } else {
+        this.eventEmitter.emit({ type: "auth:success", data: response, timestamp: Date.now() });
+      }
+      this.eventEmitter.emit({ type: "oauth:completed", data: response, timestamp: Date.now() });
+      return response;
+    } catch (error2) {
+      const authError = error2 instanceof NAuthClientError ? error2 : new NAuthClientError(
+        "SOCIAL_TOKEN_INVALID" /* SOCIAL_TOKEN_INVALID */,
+        error2.message || "OAuth callback failed"
+      );
+      this.eventEmitter.emit({ type: "oauth:error", data: authError, timestamp: Date.now() });
+      throw authError;
+    }
+  }
+  /**
+   * Get social auth URL (low-level API).
+   *
+   * For most cases, use `loginWithSocial()` which handles state management automatically.
+   */
+  async getSocialAuthUrl(request) {
+    return this.post(this.config.endpoints.socialAuthUrl, request);
+  }
+  /**
+   * Handle social callback.
+   */
+  async handleSocialCallback(request) {
+    const result = await this.post(this.config.endpoints.socialCallback, request);
+    await this.handleAuthResponse(result);
+    return result;
+  }
+  /**
+   * Verify native social token (mobile).
+   */
+  async verifyNativeSocial(request) {
+    try {
+      const path = this.config.endpoints.socialVerify.replace(":provider", request.provider);
+      const result = await this.post(path, request);
+      await this.handleAuthResponse(result);
+      if (result.challengeName) {
+        const challengeEvent = { type: "auth:challenge", data: result, timestamp: Date.now() };
+        this.eventEmitter.emit(challengeEvent);
+      } else {
+        const successEvent = { type: "auth:success", data: result, timestamp: Date.now() };
+        this.eventEmitter.emit(successEvent);
+      }
+      return result;
+    } catch (error) {
+      const authError = error instanceof NAuthClientError ? error : new NAuthClientError(
+        "SOCIAL_TOKEN_INVALID" /* SOCIAL_TOKEN_INVALID */,
+        error.message || "Social verification failed"
+      );
+      const errorEvent = { type: "auth:error", data: authError, timestamp: Date.now() };
+      this.eventEmitter.emit(errorEvent);
+      throw authError;
+    }
+  }
+  /**
+   * Get linked accounts.
+   */
+  async getLinkedAccounts() {
+    return this.get(this.config.endpoints.socialLinked, true);
+  }
+  /**
+   * Link social account.
+   */
+  async linkSocialAccount(provider, code, state) {
+    return this.post(this.config.endpoints.socialLink, { provider, code, state }, true);
+  }
+  /**
+   * Unlink social account.
+   */
+  async unlinkSocialAccount(provider) {
+    return this.post(this.config.endpoints.socialUnlink, { provider }, true);
+  }
+  /**
+   * Trust current device.
+   */
+  async trustDevice() {
+    const result = await this.post(this.config.endpoints.trustDevice, {}, true);
+    await this.setDeviceToken(result.deviceToken);
+    return result;
+  }
+  /**
+   * Check if the current device is trusted.
+   *
+   * Returns whether the current device is trusted based on the device token
+   * (from cookie in cookies mode, or header in JSON mode).
+   *
+   * This performs a server-side validation of the device token and checks:
+   * - Device token exists and is valid
+   * - Device token matches a trusted device record in the database
+   * - Trust has not expired
+   *
+   * @returns Object with trusted status
+   *
+   * @example
+   * ```typescript
+   * const result = await client.isTrustedDevice();
+   * if (result.trusted) {
+   *   console.log('This device is trusted');
+   * }
+   * ```
+   */
+  async isTrustedDevice() {
+    return this.get(this.config.endpoints.isTrustedDevice, true);
+  }
+  /**
+   * Get paginated audit history for the current user.
+   *
+   * Returns authentication and security events with full audit details including:
+   * - Event type (login, logout, MFA, etc.)
+   * - Event status (success, failure, suspicious)
+   * - Device information, location, risk factors
+   *
+   * @param params - Query parameters for filtering and pagination
+   * @returns Paginated audit history response
+   *
+   * @example
+   * ```typescript
+   * const history = await client.getAuditHistory({
+   *   page: 1,
+   *   limit: 20,
+   *   eventType: 'LOGIN_SUCCESS'
+   * });
+   * ```
+   */
+  async getAuditHistory(params) {
+    const entries = Object.entries(params ?? {}).map(([k, v]) => [k, String(v)]);
+    const query = entries.length > 0 ? `?${new URLSearchParams(entries).toString()}` : "";
+    const path = `${this.config.endpoints.auditHistory}${query}`;
+    return this.get(path, true);
+  }
+  /**
+   * Initialize client by hydrating state from storage.
+   * Call this on app startup to restore auth state.
+   */
+  async initialize() {
+    const userJson = await this.config.storage.getItem(USER_KEY2);
+    if (userJson) {
+      try {
+        this.currentUser = JSON.parse(userJson);
+        this.config.onAuthStateChange?.(this.currentUser);
+      } catch {
+        await this.config.storage.removeItem(USER_KEY2);
+      }
+    }
+  }
+  /**
+   * Determine if user is authenticated (async - checks tokens).
+   */
+  async isAuthenticated() {
+    const tokens = await this.tokenManager.getTokens();
+    return Boolean(tokens.accessToken);
+  }
+  /**
+   * Determine if user is authenticated (sync - checks cached user).
+   * Use this for guards and sync checks. Use `isAuthenticated()` for definitive check.
+   */
+  isAuthenticatedSync() {
+    return this.currentUser !== null;
+  }
+  /**
+   * Get current access token (may be null).
+   */
+  async getAccessToken() {
+    const tokens = await this.tokenManager.getTokens();
+    return tokens.accessToken ?? null;
+  }
+  /**
+   * Get current user (cached, sync).
+   */
+  getCurrentUser() {
+    return this.currentUser;
+  }
+  /**
+   * Get stored challenge session (for resuming challenge flows).
+   */
+  async getStoredChallenge() {
+    const raw = await this.config.storage.getItem(CHALLENGE_KEY2);
+    if (!raw) return null;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Clear stored challenge session.
+   */
+  async clearStoredChallenge() {
+    await this.config.storage.removeItem(CHALLENGE_KEY2);
+  }
+  /**
+   * Internal: handle auth response (tokens or challenge).
+   *
+   * In cookies mode: Tokens are set as httpOnly cookies by backend, not stored in client storage.
+   * In JSON mode: Tokens are stored in tokenManager for Authorization header.
+   */
+  async handleAuthResponse(response) {
+    if (response.challengeName) {
+      await this.persistChallenge(response);
+      return;
+    }
+    if (this.config.tokenDelivery === "json" && response.accessToken && response.refreshToken) {
+      await this.tokenManager.setTokens({
+        accessToken: response.accessToken,
+        refreshToken: response.refreshToken,
+        accessTokenExpiresAt: response.accessTokenExpiresAt ?? 0,
+        refreshTokenExpiresAt: response.refreshTokenExpiresAt ?? 0
+      });
+    }
+    if (this.config.tokenDelivery === "json" && response.deviceToken) {
+      await this.setDeviceToken(response.deviceToken);
+    }
+    if (response.user) {
+      await this.setUser(response.user);
+    }
+    await this.clearChallenge();
+  }
+  /**
+   * Persist challenge state.
+   */
+  async persistChallenge(challenge) {
+    await this.config.storage.setItem(CHALLENGE_KEY2, JSON.stringify(challenge));
+  }
+  /**
+   * Clear challenge state.
+   */
+  async clearChallenge() {
+    await this.config.storage.removeItem(CHALLENGE_KEY2);
+  }
+  /**
+   * Persist user.
+   */
+  async setUser(user) {
+    this.currentUser = user;
+    await this.config.storage.setItem(USER_KEY2, JSON.stringify(user));
+    this.config.onAuthStateChange?.(user);
+  }
+  /**
+   * Clear all auth state.
+   *
+   * @param forgetDevice - If true, also clear device token (for JSON mode)
+   */
+  async clearAuthState(forgetDevice) {
+    this.currentUser = null;
+    await this.tokenManager.clearTokens();
+    await this.config.storage.removeItem(USER_KEY2);
+    if (forgetDevice && this.config.tokenDelivery === "json") {
+      await this.config.storage.removeItem(this.config.deviceTrust.storageKey);
+    }
+    this.config.onAuthStateChange?.(null);
+  }
+  /**
+   * Persist device token (json mode mobile).
+   */
+  async setDeviceToken(token) {
+    await this.config.storage.setItem(this.config.deviceTrust.storageKey, token);
+  }
+  /**
+   * Determine token delivery mode for this environment.
+   */
+  getTokenDeliveryMode() {
+    return this.config.tokenDelivery;
+  }
+  /**
+   * Build request URL by combining baseUrl with path.
+   * @private
+   */
+  buildUrl(path) {
+    return `${this.config.baseUrl}${path}`;
+  }
+  /**
+   * Build request headers for authentication.
+   * @private
+   */
+  async buildHeaders(auth) {
+    const headers = {
+      "Content-Type": "application/json",
+      ...this.config.headers
+    };
+    if (auth && this.config.tokenDelivery === "json") {
+      const accessToken = (await this.tokenManager.getTokens()).accessToken;
+      if (accessToken) {
+        headers["Authorization"] = `Bearer ${accessToken}`;
+      }
+    }
+    if (this.config.tokenDelivery === "cookies" && hasWindow()) {
+      const csrfToken = this.getCsrfToken();
+      if (csrfToken) {
+        headers[this.config.csrf.headerName] = csrfToken;
+      }
+    }
+    return headers;
+  }
+  /**
+   * Get CSRF token from cookie (browser only).
+   * @private
+   */
+  getCsrfToken() {
+    if (!hasWindow() || typeof document === "undefined") return null;
+    const match = document.cookie.match(new RegExp(`(^| )${this.config.csrf.cookieName}=([^;]+)`));
+    return match ? decodeURIComponent(match[2]) : null;
+  }
+  /**
+   * Execute GET request.
+   * Note: 401 refresh is handled by framework interceptors (Angular) or manually.
+   */
+  async get(path, auth = false) {
+    const url = this.buildUrl(path);
+    const headers = await this.buildHeaders(auth);
+    const credentials = this.config.tokenDelivery === "cookies" ? "include" : "omit";
+    const response = await this.config.httpAdapter.request({
+      method: "GET",
+      url,
+      headers,
+      credentials
+    });
+    return response.data;
+  }
+  /**
+   * Execute POST request.
+   * Note: 401 refresh is handled by framework interceptors (Angular) or manually.
+   */
+  async post(path, body, auth = false) {
+    const url = this.buildUrl(path);
+    const headers = await this.buildHeaders(auth);
+    const credentials = this.config.tokenDelivery === "cookies" ? "include" : "omit";
+    const response = await this.config.httpAdapter.request({
+      method: "POST",
+      url,
+      headers,
+      body,
+      credentials
+    });
+    return response.data;
+  }
+  /**
+   * Execute PUT request.
+   * Note: 401 refresh is handled by framework interceptors (Angular) or manually.
+   */
+  async put(path, body, auth = false) {
+    const url = this.buildUrl(path);
+    const headers = await this.buildHeaders(auth);
+    const credentials = this.config.tokenDelivery === "cookies" ? "include" : "omit";
+    const response = await this.config.httpAdapter.request({
+      method: "PUT",
+      url,
+      headers,
+      body,
+      credentials
+    });
+    return response.data;
+  }
+  /**
+   * Execute DELETE request.
+   * Note: 401 refresh is handled by framework interceptors (Angular) or manually.
+   */
+  async delete(path, auth = false) {
+    const url = this.buildUrl(path);
+    const headers = await this.buildHeaders(auth);
+    const credentials = this.config.tokenDelivery === "cookies" ? "include" : "omit";
+    const response = await this.config.httpAdapter.request({
+      method: "DELETE",
+      url,
+      headers,
+      credentials
+    });
+    return response.data;
+  }
+};
+__name(_NAuthClient, "NAuthClient");
+var NAuthClient = _NAuthClient;
+
+// src/angular/auth.service.ts
+var AuthService = class {
+  /**
+   * @param config - Injected client configuration
+   *
+   * Note: AngularHttpAdapter is automatically injected via Angular DI.
+   * This ensures all requests go through Angular's HttpClient and interceptors.
+   */
+  constructor(config) {
+    __publicField(this, "client");
+    __publicField(this, "config");
+    __publicField(this, "currentUserSubject", new BehaviorSubject(null));
+    __publicField(this, "isAuthenticatedSubject", new BehaviorSubject(false));
+    __publicField(this, "challengeSubject", new BehaviorSubject(null));
+    __publicField(this, "authEventsSubject", new Subject());
+    __publicField(this, "initialized", false);
+    if (!config) {
+      throw new Error("NAUTH_CLIENT_CONFIG is required to initialize AuthService");
+    }
+    this.config = config;
+    const httpAdapter = config.httpAdapter ?? inject2(AngularHttpAdapter);
+    this.client = new NAuthClient({
+      ...config,
+      httpAdapter,
+      // Automatically use Angular's HttpClient
+      onAuthStateChange: /* @__PURE__ */ __name((user) => {
+        this.currentUserSubject.next(user);
+        this.isAuthenticatedSubject.next(Boolean(user));
+        config.onAuthStateChange?.(user);
+      }, "onAuthStateChange")
+    });
+    this.client.on("*", (event) => {
+      this.authEventsSubject.next(event);
+    });
+    this.initialize();
+  }
+  // ============================================================================
+  // Reactive State Observables
+  // ============================================================================
+  /**
+   * Current user observable.
+   */
+  get currentUser$() {
+    return this.currentUserSubject.asObservable();
+  }
+  /**
+   * Authenticated state observable.
+   */
+  get isAuthenticated$() {
+    return this.isAuthenticatedSubject.asObservable();
+  }
+  /**
+   * Current challenge observable (for reactive challenge navigation).
+   */
+  get challenge$() {
+    return this.challengeSubject.asObservable();
+  }
+  /**
+   * Authentication events stream.
+   * Emits all auth lifecycle events for custom logic, analytics, or UI updates.
+   */
+  get authEvents$() {
+    return this.authEventsSubject.asObservable();
+  }
+  /**
+   * Successful authentication events stream.
+   * Emits when user successfully authenticates (login, signup, social auth).
+   */
+  get authSuccess$() {
+    return this.authEventsSubject.pipe(filter((e) => e.type === "auth:success"));
+  }
+  /**
+   * Authentication error events stream.
+   * Emits when authentication fails (login error, OAuth error, etc.).
+   */
+  get authError$() {
+    return this.authEventsSubject.pipe(filter((e) => e.type === "auth:error" || e.type === "oauth:error"));
+  }
+  // ============================================================================
+  // Sync State Accessors (for guards, templates)
+  // ============================================================================
+  /**
+   * Check if authenticated (sync, uses cached state).
+   */
+  isAuthenticated() {
+    return this.client.isAuthenticatedSync();
+  }
+  /**
+   * Get current user (sync, uses cached state).
+   */
+  getCurrentUser() {
+    return this.client.getCurrentUser();
+  }
+  /**
+   * Get current challenge (sync).
+   */
+  getCurrentChallenge() {
+    return this.challengeSubject.value;
+  }
+  // ============================================================================
+  // Core Auth Methods (Observable wrappers)
+  // ============================================================================
+  /**
+   * Login with identifier and password.
+   */
+  login(identifier, password) {
+    return from(this.client.login(identifier, password).then((res) => this.updateChallengeState(res)));
+  }
+  /**
+   * Signup with credentials.
+   */
+  signup(payload) {
+    return from(this.client.signup(payload).then((res) => this.updateChallengeState(res)));
+  }
+  /**
+   * Logout current session.
+   */
+  logout(forgetDevice) {
+    return from(
+      this.client.logout(forgetDevice).then(() => {
+        this.challengeSubject.next(null);
+        this.currentUserSubject.next(null);
+        this.isAuthenticatedSubject.next(false);
+        if (this.config.tokenDelivery === "cookies" && typeof document !== "undefined") {
+          const csrfCookieName = this.config.csrf?.cookieName ?? "nauth_csrf_token";
+          try {
+            const url = new URL(this.config.baseUrl);
+            document.cookie = `${csrfCookieName}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; domain=${url.hostname}`;
+            document.cookie = `${csrfCookieName}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;
+          } catch {
+            document.cookie = `${csrfCookieName}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;
+          }
+        }
+      })
+    );
+  }
+  /**
+   * Logout all sessions.
+   *
+   * Revokes all active sessions for the current user across all devices.
+   * Optionally revokes all trusted devices if forgetDevices is true.
+   *
+   * @param forgetDevices - If true, also revokes all trusted devices (default: false)
+   * @returns Observable with number of sessions revoked
+   */
+  logoutAll(forgetDevices) {
+    return from(
+      this.client.logoutAll(forgetDevices).then((res) => {
+        this.challengeSubject.next(null);
+        this.currentUserSubject.next(null);
+        this.isAuthenticatedSubject.next(false);
+        return res;
+      })
+    );
+  }
+  /**
+   * Refresh tokens.
+   */
+  refresh() {
+    return from(this.client.refreshTokens());
+  }
+  // ============================================================================
+  // Challenge Flow Methods (Essential for any auth flow)
+  // ============================================================================
+  /**
+   * Respond to a challenge (VERIFY_EMAIL, VERIFY_PHONE, MFA_REQUIRED, etc.).
+   */
+  respondToChallenge(response) {
+    return from(this.client.respondToChallenge(response).then((res) => this.updateChallengeState(res)));
+  }
+  /**
+   * Resend challenge code.
+   */
+  resendCode(session) {
+    return from(this.client.resendCode(session));
+  }
+  /**
+   * Get MFA setup data (for MFA_SETUP_REQUIRED challenge).
+   *
+   * Returns method-specific setup information:
+   * - TOTP: { secret, qrCode, manualEntryKey }
+   * - SMS: { maskedPhone }
+   * - Email: { maskedEmail }
+   * - Passkey: WebAuthn registration options
+   *
+   * @param session - Challenge session token
+   * @param method - MFA method to set up
+   * @returns Observable of setup data response
+   */
+  getSetupData(session, method) {
+    return from(this.client.getSetupData(session, method));
+  }
+  /**
+   * Get MFA challenge data (for MFA_REQUIRED challenge - e.g., passkey options).
+   *
+   * @param session - Challenge session token
+   * @param method - Challenge method
+   * @returns Observable of challenge data response
+   */
+  getChallengeData(session, method) {
+    return from(this.client.getChallengeData(session, method));
+  }
+  /**
+   * Clear stored challenge (when navigating away from challenge flow).
+   */
+  clearChallenge() {
+    return from(
+      this.client.clearStoredChallenge().then(() => {
+        this.challengeSubject.next(null);
+      })
+    );
+  }
+  // ============================================================================
+  // Social Authentication
+  // ============================================================================
+  /**
+   * Initiate social OAuth login flow.
+   * Redirects to OAuth provider with automatic state management.
+   */
+  loginWithSocial(provider, options) {
+    return this.client.loginWithSocial(provider, options);
+  }
+  /**
+   * Get social auth URL to redirect user for OAuth (low-level API).
+   */
+  getSocialAuthUrl(provider, redirectUri) {
+    return from(
+      this.client.getSocialAuthUrl({ provider, redirectUri })
+    );
+  }
+  /**
+   * Handle social auth callback (low-level API).
+   */
+  handleSocialCallback(provider, code, state) {
+    return from(
+      this.client.handleSocialCallback({ provider, code, state }).then((res) => this.updateChallengeState(res))
+    );
+  }
+  // ============================================================================
+  // Escape Hatch
+  // ============================================================================
+  /**
+   * Expose underlying NAuthClient for advanced scenarios.
+   *
+   * Use this for operations not directly exposed by this service:
+   * - Profile management (getProfile, updateProfile)
+   * - MFA management (getMfaStatus, setupMfaDevice, etc.)
+   * - Social account linking (linkSocialAccount, unlinkSocialAccount)
+   * - Audit history (getAuditHistory)
+   * - Device trust (trustDevice)
+   *
+   * @example
+   * ```typescript
+   * // Get MFA status
+   * const status = await this.auth.getClient().getMfaStatus();
+   *
+   * // Update profile
+   * const user = await this.auth.getClient().updateProfile({ firstName: 'John' });
+   * ```
+   */
+  getClient() {
+    return this.client;
+  }
+  // ============================================================================
+  // Internal Methods
+  // ============================================================================
+  /**
+   * Initialize by hydrating state from storage.
+   * Called automatically on construction.
+   */
+  async initialize() {
+    if (this.initialized) return;
+    this.initialized = true;
+    await this.client.initialize();
+    const storedChallenge = await this.client.getStoredChallenge();
+    if (storedChallenge) {
+      this.challengeSubject.next(storedChallenge);
+    }
+    const user = this.client.getCurrentUser();
+    if (user) {
+      this.currentUserSubject.next(user);
+      this.isAuthenticatedSubject.next(true);
+    }
+  }
+  /**
+   * Update challenge state after auth response.
+   */
+  updateChallengeState(response) {
+    if (response.challengeName) {
+      this.challengeSubject.next(response);
+    } else {
+      this.challengeSubject.next(null);
+    }
+    return response;
+  }
+};
+__name(AuthService, "AuthService");
+AuthService = __decorateClass([
+  Injectable2({
+    providedIn: "root"
+  }),
+  __decorateParam(0, Optional()),
+  __decorateParam(0, Inject(NAUTH_CLIENT_CONFIG))
+], AuthService);
+
+// src/angular/auth.interceptor.ts
+import { inject as inject3, PLATFORM_ID } from "@angular/core";
+import { isPlatformBrowser } from "@angular/common";
+import { HttpClient as HttpClient2, HttpErrorResponse as HttpErrorResponse2 } from "@angular/common/http";
+import { Router } from "@angular/router";
+import { catchError, switchMap, throwError, filter as filter2, take, BehaviorSubject as BehaviorSubject2, from as from2 } from "rxjs";
+var isRefreshing = false;
+var refreshTokenSubject = new BehaviorSubject2(null);
+var retriedRequests = /* @__PURE__ */ new WeakSet();
+function getCsrfToken(cookieName) {
+  if (typeof document === "undefined") return null;
+  const match = document.cookie.match(new RegExp(`(^| )${cookieName}=([^;]+)`));
+  return match ? decodeURIComponent(match[2]) : null;
+}
+__name(getCsrfToken, "getCsrfToken");
+var authInterceptor = /* @__PURE__ */ __name((req, next) => {
+  const config = inject3(NAUTH_CLIENT_CONFIG);
+  const http = inject3(HttpClient2);
+  const authService = inject3(AuthService);
+  const platformId = inject3(PLATFORM_ID);
+  const router = inject3(Router);
+  const isBrowser = isPlatformBrowser(platformId);
+  if (!isBrowser) {
+    return next(req);
+  }
+  const tokenDelivery = config.tokenDelivery;
+  const baseUrl = config.baseUrl;
+  const endpoints = config.endpoints ?? {};
+  const refreshPath = endpoints.refresh ?? "/refresh";
+  const loginPath = endpoints.login ?? "/login";
+  const signupPath = endpoints.signup ?? "/signup";
+  const socialAuthUrlPath = endpoints.socialAuthUrl ?? "/social/auth-url";
+  const socialCallbackPath = endpoints.socialCallback ?? "/social/callback";
+  const refreshUrl = `${baseUrl}${refreshPath}`;
+  const isAuthApiRequest = req.url.includes(baseUrl);
+  const isRefreshEndpoint = req.url.includes(refreshPath);
+  const isPublicEndpoint = req.url.includes(loginPath) || req.url.includes(signupPath) || req.url.includes(socialAuthUrlPath) || req.url.includes(socialCallbackPath);
+  let authReq = req;
+  if (tokenDelivery === "cookies") {
+    authReq = authReq.clone({ withCredentials: true });
+    if (["POST", "PUT", "PATCH", "DELETE"].includes(req.method)) {
+      const csrfCookieName = config.csrf?.cookieName ?? "nauth_csrf_token";
+      const csrfHeaderName = config.csrf?.headerName ?? "x-csrf-token";
+      const csrfToken = getCsrfToken(csrfCookieName);
+      if (csrfToken) {
+        authReq = authReq.clone({ setHeaders: { [csrfHeaderName]: csrfToken } });
+      }
+    }
+  }
+  return next(authReq).pipe(
+    catchError((error) => {
+      const shouldHandle = error instanceof HttpErrorResponse2 && error.status === 401 && isAuthApiRequest && !isRefreshEndpoint && !isPublicEndpoint && !retriedRequests.has(req);
+      if (!shouldHandle) {
+        return throwError(() => error);
+      }
+      if (config.debug) {
+        console.warn("[nauth-interceptor] 401 detected:", req.url);
+      }
+      if (!isRefreshing) {
+        isRefreshing = true;
+        refreshTokenSubject.next(null);
+        if (config.debug) {
+          console.warn("[nauth-interceptor] Starting refresh...");
+        }
+        const refresh$ = tokenDelivery === "cookies" ? http.post(refreshUrl, {}, { withCredentials: true }) : from2(authService.getClient().refreshTokens());
+        return refresh$.pipe(
+          switchMap((response) => {
+            if (config.debug) {
+              console.warn("[nauth-interceptor] Refresh successful");
+            }
+            isRefreshing = false;
+            const newToken = "accessToken" in response ? response.accessToken : "success";
+            refreshTokenSubject.next(newToken ?? "success");
+            const retryReq = buildRetryRequest(authReq, tokenDelivery, newToken);
+            retriedRequests.add(retryReq);
+            if (config.debug) {
+              console.warn("[nauth-interceptor] Retrying:", req.url);
+            }
+            return next(retryReq);
+          }),
+          catchError((err) => {
+            if (config.debug) {
+              console.error("[nauth-interceptor] Refresh failed:", err);
+            }
+            isRefreshing = false;
+            refreshTokenSubject.next(null);
+            if (config.redirects?.sessionExpired) {
+              router.navigateByUrl(config.redirects.sessionExpired).catch((navError) => {
+                if (config.debug) {
+                  console.error("[nauth-interceptor] Navigation failed:", navError);
+                }
+              });
+            }
+            return throwError(() => err);
+          })
+        );
+      } else {
+        if (config.debug) {
+          console.warn("[nauth-interceptor] Waiting for refresh...");
+        }
+        return refreshTokenSubject.pipe(
+          filter2((token) => token !== null),
+          take(1),
+          switchMap((token) => {
+            if (config.debug) {
+              console.warn("[nauth-interceptor] Refresh done, retrying:", req.url);
+            }
+            const retryReq = buildRetryRequest(authReq, tokenDelivery, token);
+            retriedRequests.add(retryReq);
+            return next(retryReq);
+          })
+        );
+      }
+    })
+  );
+}, "authInterceptor");
+function buildRetryRequest(originalReq, tokenDelivery, newToken) {
+  if (tokenDelivery === "json" && newToken && newToken !== "success") {
+    return originalReq.clone({
+      setHeaders: { Authorization: `Bearer ${newToken}` }
+    });
+  }
+  return originalReq.clone();
+}
+__name(buildRetryRequest, "buildRetryRequest");
+var _AuthInterceptor = class _AuthInterceptor {
+  intercept(req, next) {
+    return authInterceptor(req, next);
+  }
+};
+__name(_AuthInterceptor, "AuthInterceptor");
+var AuthInterceptor = _AuthInterceptor;
+
+// src/angular/auth.guard.ts
+import { inject as inject4 } from "@angular/core";
+import { Router as Router2 } from "@angular/router";
+function authGuard(redirectTo = "/login") {
+  return () => {
+    const auth = inject4(AuthService);
+    const router = inject4(Router2);
+    if (auth.isAuthenticated()) {
+      return true;
+    }
+    return router.createUrlTree([redirectTo]);
+  };
+}
+__name(authGuard, "authGuard");
+var _AuthGuard = class _AuthGuard {
+  /**
+   * @param auth - Authentication service
+   * @param router - Angular router
+   */
+  constructor(auth, router) {
+    this.auth = auth;
+    this.router = router;
+  }
+  /**
+   * Check if route can be activated.
+   *
+   * @returns True if authenticated, otherwise redirects to login
+   */
+  canActivate() {
+    if (this.auth.isAuthenticated()) {
+      return true;
+    }
+    return this.router.createUrlTree(["/login"]);
+  }
+};
+__name(_AuthGuard, "AuthGuard");
+var AuthGuard = _AuthGuard;
+
+// src/angular/oauth-callback.guard.ts
+import { inject as inject5, PLATFORM_ID as PLATFORM_ID2 } from "@angular/core";
+import { isPlatformBrowser as isPlatformBrowser2 } from "@angular/common";
+var oauthCallbackGuard = /* @__PURE__ */ __name(async () => {
+  const auth = inject5(AuthService);
+  const config = inject5(NAUTH_CLIENT_CONFIG);
+  const platformId = inject5(PLATFORM_ID2);
+  const isBrowser = isPlatformBrowser2(platformId);
+  if (!isBrowser) {
+    return false;
+  }
+  try {
+    const response = await auth.getClient().handleOAuthCallback();
+    if (!response) {
+      const homeUrl = config.redirects?.success || "/";
+      window.location.replace(homeUrl);
+      return false;
+    }
+    if (response.challengeName) {
+      const challengeBase = config.redirects?.challengeBase || "/auth/challenge";
+      const challengeRoute = response.challengeName.toLowerCase().replace(/_/g, "-");
+      const challengePath = `${challengeBase}/${challengeRoute}`;
+      if (config.debug) {
+        console.warn("[oauth-callback-guard] Redirecting to challenge:", challengePath);
+      }
+      window.location.replace(challengePath);
+    } else {
+      const successUrl = config.redirects?.success || "/";
+      if (config.debug) {
+        console.warn("[oauth-callback-guard] Redirecting to success URL:", successUrl);
+      }
+      window.location.replace(successUrl);
+    }
+  } catch (error) {
+    console.error("[oauth-callback-guard] OAuth callback failed:", error);
+    const errorUrl = config.redirects?.oauthError || "/login";
+    if (config.debug) {
+      console.warn("[oauth-callback-guard] Redirecting to error URL:", errorUrl);
+    }
+    window.location.replace(errorUrl);
+  }
+  return false;
+}, "oauthCallbackGuard");
+
+// src/angular/auth.module.ts
+import { NgModule } from "@angular/core";
+import { HTTP_INTERCEPTORS } from "@angular/common/http";
+var NAuthModule = class {
+  /**
+   * Configure the module with client settings.
+   *
+   * @param config - Client configuration
+   */
+  static forRoot(config) {
+    return {
+      ngModule: NAuthModule,
+      providers: [
+        { provide: NAUTH_CLIENT_CONFIG, useValue: config },
+        { provide: HTTP_INTERCEPTORS, useClass: AuthInterceptor, multi: true }
+      ]
+    };
+  }
+};
+__name(NAuthModule, "NAuthModule");
+NAuthModule = __decorateClass([
+  NgModule({})
+], NAuthModule);
+export {
+  AngularHttpAdapter,
+  AuthGuard,
+  AuthInterceptor,
+  AuthService,
+  NAUTH_CLIENT_CONFIG,
+  NAuthModule,
+  authGuard,
+  authInterceptor,
+  oauthCallbackGuard
+};
+//# sourceMappingURL=index.mjs.map