@nauth-toolkit/client 0.1.3

package/dist/index.cjs

@@ -0,0 +1,1473 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AuthAuditEventType: () => AuthAuditEventType,
+  AuthChallenge: () => AuthChallenge,
+  BrowserStorage: () => BrowserStorage,
+  EventEmitter: () => EventEmitter,
+  FetchAdapter: () => FetchAdapter,
+  InMemoryStorage: () => InMemoryStorage,
+  NAuthClient: () => NAuthClient,
+  NAuthClientError: () => NAuthClientError,
+  NAuthErrorCode: () => NAuthErrorCode,
+  defaultEndpoints: () => defaultEndpoints,
+  getChallengeInstructions: () => getChallengeInstructions,
+  getMFAMethod: () => getMFAMethod,
+  getMaskedDestination: () => getMaskedDestination,
+  isOTPChallenge: () => isOTPChallenge,
+  requiresPhoneCollection: () => requiresPhoneCollection,
+  resolveConfig: () => resolveConfig
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/types/auth.types.ts
+var AuthChallenge = /* @__PURE__ */ ((AuthChallenge2) => {
+  AuthChallenge2["VERIFY_EMAIL"] = "VERIFY_EMAIL";
+  AuthChallenge2["VERIFY_PHONE"] = "VERIFY_PHONE";
+  AuthChallenge2["MFA_REQUIRED"] = "MFA_REQUIRED";
+  AuthChallenge2["MFA_SETUP_REQUIRED"] = "MFA_SETUP_REQUIRED";
+  AuthChallenge2["FORCE_CHANGE_PASSWORD"] = "FORCE_CHANGE_PASSWORD";
+  return AuthChallenge2;
+})(AuthChallenge || {});
+
+// src/types/error.types.ts
+var NAuthErrorCode = /* @__PURE__ */ ((NAuthErrorCode2) => {
+  NAuthErrorCode2["AUTH_INVALID_CREDENTIALS"] = "AUTH_INVALID_CREDENTIALS";
+  NAuthErrorCode2["AUTH_ACCOUNT_LOCKED"] = "AUTH_ACCOUNT_LOCKED";
+  NAuthErrorCode2["AUTH_ACCOUNT_INACTIVE"] = "AUTH_ACCOUNT_INACTIVE";
+  NAuthErrorCode2["AUTH_TOKEN_EXPIRED"] = "AUTH_TOKEN_EXPIRED";
+  NAuthErrorCode2["AUTH_TOKEN_INVALID"] = "AUTH_TOKEN_INVALID";
+  NAuthErrorCode2["AUTH_BEARER_NOT_ALLOWED"] = "AUTH_BEARER_NOT_ALLOWED";
+  NAuthErrorCode2["AUTH_COOKIES_NOT_ALLOWED"] = "AUTH_COOKIES_NOT_ALLOWED";
+  NAuthErrorCode2["AUTH_CSRF_TOKEN_INVALID"] = "AUTH_CSRF_TOKEN_INVALID";
+  NAuthErrorCode2["AUTH_CSRF_TOKEN_MISSING"] = "AUTH_CSRF_TOKEN_MISSING";
+  NAuthErrorCode2["AUTH_TOKEN_REUSE_DETECTED"] = "AUTH_TOKEN_REUSE_DETECTED";
+  NAuthErrorCode2["AUTH_SESSION_NOT_FOUND"] = "AUTH_SESSION_NOT_FOUND";
+  NAuthErrorCode2["AUTH_SESSION_EXPIRED"] = "AUTH_SESSION_EXPIRED";
+  NAuthErrorCode2["SIGNUP_DISABLED"] = "SIGNUP_DISABLED";
+  NAuthErrorCode2["SIGNUP_EMAIL_EXISTS"] = "SIGNUP_EMAIL_EXISTS";
+  NAuthErrorCode2["SIGNUP_USERNAME_EXISTS"] = "SIGNUP_USERNAME_EXISTS";
+  NAuthErrorCode2["SIGNUP_PHONE_EXISTS"] = "SIGNUP_PHONE_EXISTS";
+  NAuthErrorCode2["SIGNUP_WEAK_PASSWORD"] = "SIGNUP_WEAK_PASSWORD";
+  NAuthErrorCode2["SIGNUP_PHONE_REQUIRED"] = "SIGNUP_PHONE_REQUIRED";
+  NAuthErrorCode2["SIGNUP_NOT_ALLOWED"] = "SIGNUP_NOT_ALLOWED";
+  NAuthErrorCode2["VERIFY_CODE_INVALID"] = "VERIFY_CODE_INVALID";
+  NAuthErrorCode2["VERIFY_CODE_EXPIRED"] = "VERIFY_CODE_EXPIRED";
+  NAuthErrorCode2["VERIFY_TOO_MANY_ATTEMPTS"] = "VERIFY_TOO_MANY_ATTEMPTS";
+  NAuthErrorCode2["VERIFY_ALREADY_VERIFIED"] = "VERIFY_ALREADY_VERIFIED";
+  NAuthErrorCode2["MFA_SETUP_REQUIRED"] = "MFA_SETUP_REQUIRED";
+  NAuthErrorCode2["RATE_LIMIT_SMS"] = "RATE_LIMIT_SMS";
+  NAuthErrorCode2["RATE_LIMIT_EMAIL"] = "RATE_LIMIT_EMAIL";
+  NAuthErrorCode2["RATE_LIMIT_LOGIN"] = "RATE_LIMIT_LOGIN";
+  NAuthErrorCode2["RATE_LIMIT_RESEND"] = "RATE_LIMIT_RESEND";
+  NAuthErrorCode2["SOCIAL_TOKEN_INVALID"] = "SOCIAL_TOKEN_INVALID";
+  NAuthErrorCode2["SOCIAL_ACCOUNT_LINKED"] = "SOCIAL_ACCOUNT_LINKED";
+  NAuthErrorCode2["SOCIAL_CONFIG_MISSING"] = "SOCIAL_CONFIG_MISSING";
+  NAuthErrorCode2["SOCIAL_EMAIL_REQUIRED"] = "SOCIAL_EMAIL_REQUIRED";
+  NAuthErrorCode2["SOCIAL_ACCOUNT_NOT_FOUND"] = "SOCIAL_ACCOUNT_NOT_FOUND";
+  NAuthErrorCode2["CHALLENGE_EXPIRED"] = "CHALLENGE_EXPIRED";
+  NAuthErrorCode2["CHALLENGE_INVALID"] = "CHALLENGE_INVALID";
+  NAuthErrorCode2["CHALLENGE_TYPE_MISMATCH"] = "CHALLENGE_TYPE_MISMATCH";
+  NAuthErrorCode2["CHALLENGE_MAX_ATTEMPTS"] = "CHALLENGE_MAX_ATTEMPTS";
+  NAuthErrorCode2["CHALLENGE_ALREADY_COMPLETED"] = "CHALLENGE_ALREADY_COMPLETED";
+  NAuthErrorCode2["VALIDATION_FAILED"] = "VALIDATION_FAILED";
+  NAuthErrorCode2["VALIDATION_INVALID_PHONE"] = "VALIDATION_INVALID_PHONE";
+  NAuthErrorCode2["VALIDATION_INVALID_EMAIL"] = "VALIDATION_INVALID_EMAIL";
+  NAuthErrorCode2["VALIDATION_INVALID_PASSWORD"] = "VALIDATION_INVALID_PASSWORD";
+  NAuthErrorCode2["PASSWORD_INCORRECT"] = "PASSWORD_INCORRECT";
+  NAuthErrorCode2["PASSWORD_REUSED"] = "PASSWORD_REUSED";
+  NAuthErrorCode2["PASSWORD_CHANGE_NOT_ALLOWED"] = "PASSWORD_CHANGE_NOT_ALLOWED";
+  NAuthErrorCode2["SIGNIN_BLOCKED_HIGH_RISK"] = "SIGNIN_BLOCKED_HIGH_RISK";
+  NAuthErrorCode2["RESOURCE_NOT_FOUND"] = "RESOURCE_NOT_FOUND";
+  NAuthErrorCode2["FORBIDDEN"] = "FORBIDDEN";
+  NAuthErrorCode2["INTERNAL_ERROR"] = "INTERNAL_ERROR";
+  NAuthErrorCode2["SERVICE_UNAVAILABLE"] = "SERVICE_UNAVAILABLE";
+  return NAuthErrorCode2;
+})(NAuthErrorCode || {});
+
+// src/types/audit.types.ts
+var AuthAuditEventType = /* @__PURE__ */ ((AuthAuditEventType2) => {
+  AuthAuditEventType2["LOGIN_SUCCESS"] = "LOGIN_SUCCESS";
+  AuthAuditEventType2["LOGIN_FAILED"] = "LOGIN_FAILED";
+  AuthAuditEventType2["LOGOUT"] = "LOGOUT";
+  AuthAuditEventType2["TOKEN_REFRESH"] = "TOKEN_REFRESH";
+  AuthAuditEventType2["TOKEN_REVOKED"] = "TOKEN_REVOKED";
+  AuthAuditEventType2["SIGNUP_SUCCESS"] = "SIGNUP_SUCCESS";
+  AuthAuditEventType2["SIGNUP_FAILED"] = "SIGNUP_FAILED";
+  AuthAuditEventType2["EMAIL_VERIFIED"] = "EMAIL_VERIFIED";
+  AuthAuditEventType2["PHONE_VERIFIED"] = "PHONE_VERIFIED";
+  AuthAuditEventType2["VERIFICATION_FAILED"] = "VERIFICATION_FAILED";
+  AuthAuditEventType2["MFA_ENABLED"] = "MFA_ENABLED";
+  AuthAuditEventType2["MFA_DISABLED"] = "MFA_DISABLED";
+  AuthAuditEventType2["MFA_VERIFIED"] = "MFA_VERIFIED";
+  AuthAuditEventType2["MFA_FAILED"] = "MFA_FAILED";
+  AuthAuditEventType2["MFA_BACKUP_CODE_USED"] = "MFA_BACKUP_CODE_USED";
+  AuthAuditEventType2["PASSWORD_CHANGED"] = "PASSWORD_CHANGED";
+  AuthAuditEventType2["PASSWORD_RESET_REQUESTED"] = "PASSWORD_RESET_REQUESTED";
+  AuthAuditEventType2["PASSWORD_RESET_COMPLETED"] = "PASSWORD_RESET_COMPLETED";
+  AuthAuditEventType2["ACCOUNT_LOCKED"] = "ACCOUNT_LOCKED";
+  AuthAuditEventType2["ACCOUNT_UNLOCKED"] = "ACCOUNT_UNLOCKED";
+  AuthAuditEventType2["SUSPICIOUS_ACTIVITY"] = "SUSPICIOUS_ACTIVITY";
+  AuthAuditEventType2["ADAPTIVE_MFA_TRIGGERED"] = "ADAPTIVE_MFA_TRIGGERED";
+  AuthAuditEventType2["SOCIAL_LINK_SUCCESS"] = "SOCIAL_LINK_SUCCESS";
+  AuthAuditEventType2["SOCIAL_LINK_FAILED"] = "SOCIAL_LINK_FAILED";
+  AuthAuditEventType2["SOCIAL_UNLINK"] = "SOCIAL_UNLINK";
+  return AuthAuditEventType2;
+})(AuthAuditEventType || {});
+
+// src/core/config.ts
+var defaultEndpoints = {
+  login: "/login",
+  signup: "/signup",
+  logout: "/logout",
+  logoutAll: "/logout/all",
+  refresh: "/refresh",
+  respondChallenge: "/respond-challenge",
+  resendCode: "/challenge/resend",
+  getSetupData: "/challenge/setup-data",
+  getChallengeData: "/challenge/challenge-data",
+  profile: "/profile",
+  changePassword: "/change-password",
+  requestPasswordChange: "/request-password-change",
+  mfaStatus: "/mfa/status",
+  mfaDevices: "/mfa/devices",
+  mfaSetupData: "/mfa/setup-data",
+  mfaVerifySetup: "/mfa/verify-setup",
+  mfaRemove: "/mfa/method",
+  mfaPreferred: "/mfa/preferred-method",
+  mfaBackupCodes: "/mfa/backup-codes/generate",
+  mfaExemption: "/mfa/exemption",
+  socialAuthUrl: "/social/auth-url",
+  socialCallback: "/social/callback",
+  socialLinked: "/social/linked",
+  socialLink: "/social/link",
+  socialUnlink: "/social/unlink",
+  socialVerify: "/social/:provider/verify",
+  trustDevice: "/trust-device",
+  isTrustedDevice: "/is-trusted-device",
+  auditHistory: "/audit/history",
+  updateProfile: "/profile"
+};
+var resolveConfig = (config, defaultAdapter) => {
+  const resolvedEndpoints = {
+    ...defaultEndpoints,
+    ...config.endpoints ?? {}
+  };
+  return {
+    ...config,
+    csrf: {
+      cookieName: config.csrf?.cookieName ?? "nauth_csrf_token",
+      headerName: config.csrf?.headerName ?? "x-csrf-token"
+    },
+    deviceTrust: {
+      headerName: config.deviceTrust?.headerName ?? "X-Device-Token",
+      storageKey: config.deviceTrust?.storageKey ?? "nauth_device_token"
+    },
+    headers: config.headers ?? {},
+    timeout: config.timeout ?? 3e4,
+    endpoints: resolvedEndpoints,
+    storage: config.storage,
+    httpAdapter: config.httpAdapter ?? defaultAdapter
+  };
+};
+
+// src/core/errors.ts
+var NAuthClientError = class _NAuthClientError extends Error {
+  /**
+   * Create a new client error.
+   *
+   * @param code - Error code from NAuthErrorCode enum
+   * @param message - Human-readable error message
+   * @param options - Optional metadata including details, statusCode, timestamp, and network error flag
+   */
+  constructor(code, message, options) {
+    super(message);
+    __publicField(this, "code");
+    __publicField(this, "details");
+    __publicField(this, "statusCode");
+    __publicField(this, "timestamp");
+    __publicField(this, "isNetworkError");
+    this.code = code;
+    this.details = options?.details;
+    this.statusCode = options?.statusCode;
+    this.timestamp = options?.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+    this.isNetworkError = options?.isNetworkError ?? false;
+    this.name = "NAuthClientError";
+    Object.setPrototypeOf(this, _NAuthClientError.prototype);
+  }
+  /**
+   * Check if error matches a specific error code.
+   *
+   * @param code - Error code to check against
+   * @returns True if the error code matches
+   *
+   * @example
+   * ```typescript
+   * if (error.isCode(NAuthErrorCode.RATE_LIMIT_SMS)) {
+   *   // Handle SMS rate limit
+   * }
+   * ```
+   */
+  isCode(code) {
+    return this.code === code;
+  }
+  /**
+   * Get error details/metadata.
+   *
+   * @returns Error details object or undefined
+   *
+   * @example
+   * ```typescript
+   * const details = error.getDetails();
+   * if (details?.retryAfter) {
+   *   console.log(`Retry after ${details.retryAfter} seconds`);
+   * }
+   * ```
+   */
+  getDetails() {
+    return this.details;
+  }
+  /**
+   * Get the error code.
+   *
+   * @returns The error code enum value
+   */
+  getCode() {
+    return this.code;
+  }
+  /**
+   * Serialize error to JSON object.
+   *
+   * @returns Plain object representation
+   *
+   * @example
+   * ```typescript
+   * const errorJson = error.toJSON();
+   * // { code: 'AUTH_INVALID_CREDENTIALS', message: '...', timestamp: '...', details: {...} }
+   * ```
+   */
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      timestamp: this.timestamp,
+      details: this.details,
+      statusCode: this.statusCode
+    };
+  }
+};
+
+// src/core/refresh.ts
+var ACCESS_TOKEN_KEY = "nauth_access_token";
+var REFRESH_TOKEN_KEY = "nauth_refresh_token";
+var ACCESS_EXPIRES_AT_KEY = "nauth_access_token_expires_at";
+var REFRESH_EXPIRES_AT_KEY = "nauth_refresh_token_expires_at";
+var USER_KEY = "nauth_user";
+var CHALLENGE_KEY = "nauth_challenge_session";
+var TokenManager = class {
+  /**
+   * @param storage - storage adapter
+   */
+  constructor(storage) {
+    __publicField(this, "storage");
+    __publicField(this, "refreshPromise", null);
+    __publicField(this, "isBrowser", typeof window !== "undefined");
+    this.storage = storage;
+  }
+  /**
+   * Load tokens from storage.
+   */
+  async getTokens() {
+    const [accessToken, refreshToken, accessExpRaw, refreshExpRaw] = await Promise.all([
+      this.storage.getItem(ACCESS_TOKEN_KEY),
+      this.storage.getItem(REFRESH_TOKEN_KEY),
+      this.storage.getItem(ACCESS_EXPIRES_AT_KEY),
+      this.storage.getItem(REFRESH_EXPIRES_AT_KEY)
+    ]);
+    return {
+      accessToken,
+      refreshToken,
+      accessTokenExpiresAt: accessExpRaw ? Number(accessExpRaw) : null,
+      refreshTokenExpiresAt: refreshExpRaw ? Number(refreshExpRaw) : null
+    };
+  }
+  /**
+   * Persist tokens.
+   *
+   * @param tokens - new token pair
+   */
+  async setTokens(tokens) {
+    await Promise.all([
+      this.storage.setItem(ACCESS_TOKEN_KEY, tokens.accessToken),
+      this.storage.setItem(REFRESH_TOKEN_KEY, tokens.refreshToken),
+      this.storage.setItem(ACCESS_EXPIRES_AT_KEY, tokens.accessTokenExpiresAt.toString()),
+      this.storage.setItem(REFRESH_EXPIRES_AT_KEY, tokens.refreshTokenExpiresAt.toString())
+    ]);
+    this.broadcastStorage();
+  }
+  /**
+   * Clear tokens and related auth state.
+   */
+  async clearTokens() {
+    await Promise.all([
+      this.storage.removeItem(ACCESS_TOKEN_KEY),
+      this.storage.removeItem(REFRESH_TOKEN_KEY),
+      this.storage.removeItem(ACCESS_EXPIRES_AT_KEY),
+      this.storage.removeItem(REFRESH_EXPIRES_AT_KEY),
+      this.storage.removeItem(USER_KEY),
+      this.storage.removeItem(CHALLENGE_KEY)
+    ]);
+    this.broadcastStorage();
+  }
+  /**
+   * Ensure only one refresh in flight.
+   *
+   * @param refreshFn - function performing refresh request
+   */
+  async refreshOnce(refreshFn) {
+    if (!this.refreshPromise) {
+      this.refreshPromise = refreshFn().then(async (tokens) => {
+        await this.setTokens(tokens);
+        return tokens;
+      }).catch((error) => {
+        throw error;
+      }).finally(() => {
+        this.refreshPromise = null;
+      });
+    }
+    return this.refreshPromise;
+  }
+  /**
+   * Validate that a refresh token exists before attempting refresh.
+   */
+  async assertHasRefreshToken() {
+    const state = await this.getTokens();
+    if (!state.refreshToken) {
+      throw new NAuthClientError("AUTH_SESSION_NOT_FOUND" /* AUTH_SESSION_NOT_FOUND */, "No refresh token available");
+    }
+  }
+  /**
+   * Broadcast a no-op write to trigger storage listeners in other tabs.
+   */
+  broadcastStorage() {
+    if (!this.isBrowser) return;
+    try {
+      window.localStorage.setItem("nauth_sync", Date.now().toString());
+    } catch {
+    }
+  }
+};
+
+// src/storage/browser.ts
+var BrowserStorage = class {
+  /**
+   * Create a browser storage adapter.
+   *
+   * @param storage - Storage implementation (localStorage by default)
+   */
+  constructor(storage = window.localStorage) {
+    __publicField(this, "storage");
+    this.storage = storage;
+  }
+  async getItem(key) {
+    return this.storage.getItem(key);
+  }
+  async setItem(key, value) {
+    this.storage.setItem(key, value);
+  }
+  async removeItem(key) {
+    this.storage.removeItem(key);
+  }
+};
+
+// src/storage/memory.ts
+var InMemoryStorage = class {
+  constructor() {
+    __publicField(this, "store", /* @__PURE__ */ new Map());
+  }
+  async getItem(key) {
+    return this.store.has(key) ? this.store.get(key) : null;
+  }
+  async setItem(key, value) {
+    this.store.set(key, value);
+  }
+  async removeItem(key) {
+    this.store.delete(key);
+  }
+};
+
+// src/core/events.ts
+var EventEmitter = class {
+  constructor() {
+    __publicField(this, "listeners", /* @__PURE__ */ new Map());
+  }
+  /**
+   * Subscribe to an authentication event
+   *
+   * @param event - Event type or '*' for all events
+   * @param listener - Callback function
+   * @returns Unsubscribe function
+   *
+   * @example
+   * ```typescript
+   * const unsubscribe = emitter.on('auth:success', (event) => {
+   *   console.log('User logged in:', event.data);
+   * });
+   *
+   * // Later
+   * unsubscribe();
+   * ```
+   */
+  on(event, listener) {
+    if (!this.listeners.has(event)) {
+      this.listeners.set(event, /* @__PURE__ */ new Set());
+    }
+    this.listeners.get(event).add(listener);
+    return () => this.off(event, listener);
+  }
+  /**
+   * Unsubscribe from an authentication event
+   *
+   * @param event - Event type or '*'
+   * @param listener - Callback function to remove
+   */
+  off(event, listener) {
+    this.listeners.get(event)?.delete(listener);
+  }
+  /**
+   * Emit an authentication event
+   *
+   * Notifies all listeners for the specific event type and wildcard listeners.
+   *
+   * @param event - Event to emit
+   * @internal
+   */
+  emit(event) {
+    const specificListeners = this.listeners.get(event.type);
+    const wildcardListeners = this.listeners.get("*");
+    specificListeners?.forEach((listener) => {
+      try {
+        listener(event);
+      } catch (error) {
+        console.error(`Error in ${event.type} event listener:`, error);
+      }
+    });
+    wildcardListeners?.forEach((listener) => {
+      try {
+        listener(event);
+      } catch (error) {
+        console.error(`Error in wildcard event listener:`, error);
+      }
+    });
+  }
+  /**
+   * Remove all listeners
+   *
+   * @internal
+   */
+  clear() {
+    this.listeners.clear();
+  }
+};
+
+// src/adapters/fetch-adapter.ts
+var FetchAdapter = class {
+  /**
+   * Execute HTTP request using native fetch.
+   *
+   * @param config - Request configuration
+   * @returns Response with parsed data
+   * @throws NAuthClientError if request fails
+   */
+  async request(config) {
+    const fetchOptions = {
+      method: config.method,
+      headers: config.headers,
+      signal: config.signal,
+      credentials: config.credentials
+    };
+    if (config.body !== void 0) {
+      fetchOptions.body = JSON.stringify(config.body);
+    }
+    let response;
+    try {
+      response = await fetch(config.url, fetchOptions);
+    } catch (error) {
+      throw new NAuthClientError("INTERNAL_ERROR" /* INTERNAL_ERROR */, "Network request failed", {
+        isNetworkError: true,
+        details: { url: config.url, message: error.message }
+      });
+    }
+    const status = response.status;
+    let data = null;
+    const text = await response.text();
+    if (text) {
+      try {
+        data = JSON.parse(text);
+      } catch {
+        data = text;
+      }
+    }
+    const headers = {};
+    response.headers.forEach((value, key) => {
+      headers[key] = value;
+    });
+    if (!response.ok) {
+      const errorData = typeof data === "object" && data !== null ? data : {};
+      const code = typeof errorData["code"] === "string" ? errorData.code : "INTERNAL_ERROR" /* INTERNAL_ERROR */;
+      const message = typeof errorData["message"] === "string" ? errorData.message : `Request failed with status ${status}`;
+      const timestamp = typeof errorData["timestamp"] === "string" ? errorData.timestamp : void 0;
+      const details = errorData["details"];
+      throw new NAuthClientError(code, message, {
+        statusCode: status,
+        timestamp,
+        details
+      });
+    }
+    return { data, status, headers };
+  }
+};
+
+// src/core/client.ts
+var USER_KEY2 = "nauth_user";
+var CHALLENGE_KEY2 = "nauth_challenge_session";
+var hasWindow = () => typeof globalThis !== "undefined" && typeof globalThis.window !== "undefined";
+var defaultStorage = () => {
+  if (hasWindow() && typeof window.localStorage !== "undefined") {
+    return new BrowserStorage();
+  }
+  return new InMemoryStorage();
+};
+var NAuthClient = class {
+  /**
+   * Create a new client instance.
+   *
+   * @param userConfig - Client configuration
+   */
+  constructor(userConfig) {
+    __publicField(this, "config");
+    __publicField(this, "tokenManager");
+    __publicField(this, "eventEmitter");
+    __publicField(this, "currentUser", null);
+    /**
+     * Handle cross-tab storage updates.
+     */
+    __publicField(this, "handleStorageEvent", (event) => {
+      if (event.key === "nauth_sync") {
+        this.config.storage.getItem(USER_KEY2).then((value) => value ? JSON.parse(value) : null).then((user) => {
+          this.currentUser = user;
+          this.config.onAuthStateChange?.(user);
+        }).catch(() => {
+        });
+      }
+    });
+    const storage = userConfig.storage ?? defaultStorage();
+    const defaultAdapter = userConfig.httpAdapter ?? new FetchAdapter();
+    this.config = resolveConfig({ ...userConfig, storage }, defaultAdapter);
+    this.tokenManager = new TokenManager(storage);
+    this.eventEmitter = new EventEmitter();
+    if (hasWindow()) {
+      window.addEventListener("storage", this.handleStorageEvent);
+    }
+  }
+  /**
+   * Clean up resources.
+   */
+  dispose() {
+    if (hasWindow()) {
+      window.removeEventListener("storage", this.handleStorageEvent);
+    }
+  }
+  /**
+   * Login with identifier and password.
+   */
+  async login(identifier, password) {
+    const loginEvent = { type: "auth:login", data: { identifier }, timestamp: Date.now() };
+    this.eventEmitter.emit(loginEvent);
+    try {
+      const body = { identifier, password };
+      const response = await this.post(this.config.endpoints.login, body);
+      await this.handleAuthResponse(response);
+      if (response.challengeName) {
+        const challengeEvent = { type: "auth:challenge", data: response, timestamp: Date.now() };
+        this.eventEmitter.emit(challengeEvent);
+      } else {
+        const successEvent = { type: "auth:success", data: response, timestamp: Date.now() };
+        this.eventEmitter.emit(successEvent);
+      }
+      return response;
+    } catch (error) {
+      const authError = error instanceof NAuthClientError ? error : new NAuthClientError("AUTH_INVALID_CREDENTIALS" /* AUTH_INVALID_CREDENTIALS */, error.message || "Login failed");
+      const errorEvent = { type: "auth:error", data: authError, timestamp: Date.now() };
+      this.eventEmitter.emit(errorEvent);
+      throw authError;
+    }
+  }
+  /**
+   * Signup with credentials.
+   */
+  async signup(payload) {
+    this.eventEmitter.emit({ type: "auth:signup", data: { email: payload.email }, timestamp: Date.now() });
+    try {
+      const response = await this.post(this.config.endpoints.signup, payload);
+      await this.handleAuthResponse(response);
+      if (response.challengeName) {
+        this.eventEmitter.emit({ type: "auth:challenge", data: response, timestamp: Date.now() });
+      } else {
+        this.eventEmitter.emit({ type: "auth:success", data: response, timestamp: Date.now() });
+      }
+      return response;
+    } catch (error) {
+      const authError = error instanceof NAuthClientError ? error : new NAuthClientError("AUTH_INVALID_CREDENTIALS" /* AUTH_INVALID_CREDENTIALS */, error.message || "Signup failed");
+      this.eventEmitter.emit({ type: "auth:error", data: authError, timestamp: Date.now() });
+      throw authError;
+    }
+  }
+  /**
+   * Refresh tokens manually.
+   */
+  async refreshTokens() {
+    const tokenDelivery = this.getTokenDeliveryMode();
+    if (tokenDelivery === "json") {
+      await this.tokenManager.assertHasRefreshToken();
+    }
+    const body = tokenDelivery === "json" ? { refreshToken: (await this.tokenManager.getTokens()).refreshToken } : { refreshToken: "" };
+    const refreshFn = async () => {
+      return this.post(this.config.endpoints.refresh, body, false);
+    };
+    const tokens = await this.tokenManager.refreshOnce(refreshFn);
+    this.config.onTokenRefresh?.();
+    this.eventEmitter.emit({ type: "auth:refresh", data: { success: true }, timestamp: Date.now() });
+    return tokens;
+  }
+  /**
+   * Logout current session.
+   *
+   * Uses GET request to avoid CSRF token issues.
+   *
+   * @param forgetDevice - If true, also untrust the device (require MFA on next login)
+   */
+  async logout(forgetDevice) {
+    const queryParams = forgetDevice ? "?forgetMe=true" : "";
+    try {
+      await this.get(this.config.endpoints.logout + queryParams, true);
+    } catch (error) {
+      console.warn("[nauth] Logout request failed (session may already be invalid):", error);
+    } finally {
+      await this.clearAuthState(forgetDevice);
+      this.eventEmitter.emit({
+        type: "auth:logout",
+        data: { forgetDevice: !!forgetDevice, global: false },
+        timestamp: Date.now()
+      });
+    }
+  }
+  /**
+   * Logout all sessions.
+   *
+   * Revokes all active sessions for the current user across all devices.
+   * Optionally revokes all trusted devices if forgetDevices is true.
+   *
+   * @param forgetDevices - If true, also revokes all trusted devices (default: false)
+   * @returns Number of sessions revoked
+   */
+  async logoutAll(forgetDevices) {
+    try {
+      const payload = {
+        forgetDevices: forgetDevices ?? false
+      };
+      const result = await this.post(
+        this.config.endpoints.logoutAll,
+        payload,
+        true
+      );
+      await this.clearAuthState(forgetDevices);
+      this.eventEmitter.emit({
+        type: "auth:logout",
+        data: { forgetDevice: !!forgetDevices, global: true },
+        timestamp: Date.now()
+      });
+      return { revokedCount: result.revokedCount };
+    } catch (error) {
+      await this.clearAuthState(forgetDevices);
+      this.eventEmitter.emit({
+        type: "auth:logout",
+        data: { forgetDevice: !!forgetDevices, global: true },
+        timestamp: Date.now()
+      });
+      throw error;
+    }
+  }
+  /**
+   * Respond to a challenge.
+   *
+   * Validates challenge response data before sending to backend.
+   * Provides helpful error messages for common validation issues.
+   *
+   * @param response - Challenge response data
+   * @returns Auth response from backend
+   * @throws {NAuthClientError} If validation fails
+   */
+  async respondToChallenge(response) {
+    if (response.type === "MFA_SETUP_REQUIRED" /* MFA_SETUP_REQUIRED */ && response.method === "totp") {
+      const setupData = response.setupData;
+      if (!setupData || typeof setupData !== "object") {
+        throw new NAuthClientError(
+          "VALIDATION_FAILED" /* VALIDATION_FAILED */,
+          "TOTP setup requires setupData with both secret and code",
+          { details: { field: "setupData" } }
+        );
+      }
+      const secret = setupData["secret"];
+      const code = setupData["code"];
+      if (!secret || typeof secret !== "string") {
+        throw new NAuthClientError(
+          "VALIDATION_FAILED" /* VALIDATION_FAILED */,
+          "TOTP setup requires secret in setupData. Make sure to include the secret from getSetupData() response.",
+          { details: { field: "secret" } }
+        );
+      }
+      if (!code || typeof code !== "string") {
+        throw new NAuthClientError(
+          "VALIDATION_FAILED" /* VALIDATION_FAILED */,
+          "TOTP setup requires code in setupData. Please enter the verification code from your authenticator app.",
+          { details: { field: "code" } }
+        );
+      }
+    }
+    try {
+      const result = await this.post(this.config.endpoints.respondChallenge, response);
+      await this.handleAuthResponse(result);
+      if (result.challengeName) {
+        const challengeEvent = { type: "auth:challenge", data: result, timestamp: Date.now() };
+        this.eventEmitter.emit(challengeEvent);
+      } else {
+        const successEvent = { type: "auth:success", data: result, timestamp: Date.now() };
+        this.eventEmitter.emit(successEvent);
+      }
+      return result;
+    } catch (error) {
+      const authError = error instanceof NAuthClientError ? error : new NAuthClientError(
+        "CHALLENGE_INVALID" /* CHALLENGE_INVALID */,
+        error.message || "Challenge response failed"
+      );
+      const errorEvent = { type: "auth:error", data: authError, timestamp: Date.now() };
+      this.eventEmitter.emit(errorEvent);
+      throw authError;
+    }
+  }
+  /**
+   * Resend a challenge code.
+   */
+  async resendCode(session) {
+    const payload = { session };
+    return this.post(this.config.endpoints.resendCode, payload);
+  }
+  /**
+   * Get setup data for MFA.
+   *
+   * Returns method-specific setup information:
+   * - TOTP: { secret, qrCode, manualEntryKey }
+   * - SMS: { maskedPhone }
+   * - Email: { maskedEmail }
+   * - Passkey: WebAuthn registration options
+   *
+   * @param session - Challenge session token
+   * @param method - MFA method to set up
+   * @returns Setup data wrapped in GetSetupDataResponse
+   */
+  async getSetupData(session, method) {
+    const payload = { session, method };
+    return this.post(this.config.endpoints.getSetupData, payload);
+  }
+  /**
+   * Get challenge data (e.g., WebAuthn options).
+   *
+   * Returns challenge-specific data for verification flows.
+   *
+   * @param session - Challenge session token
+   * @param method - Challenge method to get data for
+   * @returns Challenge data wrapped in GetChallengeDataResponse
+   */
+  async getChallengeData(session, method) {
+    const payload = { session, method };
+    return this.post(this.config.endpoints.getChallengeData, payload);
+  }
+  /**
+   * Get current user profile.
+   */
+  async getProfile() {
+    const profile = await this.get(this.config.endpoints.profile, true);
+    await this.setUser(profile);
+    return profile;
+  }
+  /**
+   * Update user profile.
+   */
+  async updateProfile(updates) {
+    const updated = await this.put(this.config.endpoints.updateProfile, updates, true);
+    await this.setUser(updated);
+    return updated;
+  }
+  /**
+   * Change user password.
+   */
+  async changePassword(oldPassword, newPassword) {
+    const payload = { currentPassword: oldPassword, newPassword };
+    await this.post(this.config.endpoints.changePassword, payload, true);
+  }
+  /**
+   * Request password change (must change on next login).
+   */
+  async requestPasswordChange() {
+    await this.post(this.config.endpoints.requestPasswordChange, {}, true);
+  }
+  /**
+   * Get MFA status.
+   */
+  async getMfaStatus() {
+    return this.get(this.config.endpoints.mfaStatus, true);
+  }
+  /**
+   * Get MFA devices.
+   */
+  async getMfaDevices() {
+    return this.get(this.config.endpoints.mfaDevices, true);
+  }
+  /**
+   * Setup MFA device (authenticated user).
+   */
+  async setupMfaDevice(method) {
+    return this.post(this.config.endpoints.mfaSetupData, { method }, true);
+  }
+  /**
+   * Verify MFA setup (authenticated user).
+   */
+  async verifyMfaSetup(method, setupData, deviceName) {
+    return this.post(
+      this.config.endpoints.mfaVerifySetup,
+      { method, setupData, deviceName },
+      true
+    );
+  }
+  /**
+   * Remove MFA method.
+   */
+  async removeMfaDevice(method) {
+    const path = `${this.config.endpoints.mfaRemove}/${method}`;
+    return this.delete(path, true);
+  }
+  /**
+   * Set preferred MFA method.
+   *
+   * @param method - Device method to set as preferred ('totp', 'sms', 'email', or 'passkey'). Cannot be 'backup'.
+   * @returns Success message
+   */
+  async setPreferredMfaMethod(method) {
+    return this.post(this.config.endpoints.mfaPreferred, { method }, true);
+  }
+  /**
+   * Generate backup codes.
+   */
+  async generateBackupCodes() {
+    const result = await this.post(this.config.endpoints.mfaBackupCodes, {}, true);
+    return result.codes;
+  }
+  /**
+   * Set MFA exemption (admin/test scenarios).
+   */
+  async setMfaExemption(exempt, reason) {
+    await this.post(this.config.endpoints.mfaExemption, { exempt, reason }, true);
+  }
+  // ============================================================================
+  // Event System
+  // ============================================================================
+  /**
+   * Subscribe to authentication events.
+   *
+   * Emits events throughout the auth lifecycle for custom logic, analytics, or UI updates.
+   *
+   * @param event - Event type to listen for, or '*' for all events
+   * @param listener - Callback function to handle the event
+   * @returns Unsubscribe function
+   *
+   * @example
+   * ```typescript
+   * // Listen to successful authentication
+   * const unsubscribe = client.on('auth:success', (event) => {
+   *   console.log('User logged in:', event.data.user);
+   *   analytics.track('login_success');
+   * });
+   *
+   * // Listen to all events
+   * client.on('*', (event) => {
+   *   console.log('Auth event:', event.type, event.data);
+   * });
+   *
+   * // Unsubscribe when done
+   * unsubscribe();
+   * ```
+   */
+  on(event, listener) {
+    return this.eventEmitter.on(event, listener);
+  }
+  /**
+   * Unsubscribe from authentication events.
+   *
+   * @param event - Event type
+   * @param listener - Callback function to remove
+   */
+  off(event, listener) {
+    this.eventEmitter.off(event, listener);
+  }
+  // ============================================================================
+  // Social Authentication
+  // ============================================================================
+  /**
+   * Start social OAuth flow with automatic state management.
+   *
+   * Generates a secure state token, stores OAuth context, and redirects to the OAuth provider.
+   * After OAuth callback, use `handleOAuthCallback()` to complete authentication.
+   *
+   * @param provider - OAuth provider ('google', 'apple', 'facebook')
+   * @param options - Optional configuration
+   *
+   * @example
+   * ```typescript
+   * // Simple usage
+   * await client.loginWithSocial('google');
+   *
+   * // With custom redirect URI
+   * await client.loginWithSocial('apple', {
+   *   redirectUri: 'https://example.com/auth/callback'
+   * });
+   * ```
+   */
+  async loginWithSocial(provider, _options) {
+    this.eventEmitter.emit({ type: "oauth:started", data: { provider }, timestamp: Date.now() });
+    const { url } = await this.getSocialAuthUrl({ provider });
+    if (hasWindow()) {
+      window.location.href = url;
+    }
+  }
+  /**
+   * Auto-detect and handle OAuth callback.
+   *
+   * Call this on app initialization or in callback route.
+   * Returns null if not an OAuth callback (no provider/code params).
+   *
+   * The SDK validates the state token, completes authentication via backend,
+   * and emits appropriate events.
+   *
+   * @param urlOrParams - Optional URL string or URLSearchParams (auto-detects from window.location if not provided)
+   * @returns AuthResponse if OAuth callback detected, null otherwise
+   *
+   * @example
+   * ```typescript
+   * // Auto-detect on app init
+   * const response = await client.handleOAuthCallback();
+   * if (response) {
+   *   if (response.challengeName) {
+   *     router.navigate(['/challenge', response.challengeName]);
+   *   } else {
+   *     router.navigate(['/']); // Navigate to your app's home route
+   *   }
+   * }
+   *
+   * // In callback route
+   * const response = await client.handleOAuthCallback(window.location.search);
+   * ```
+   */
+  async handleOAuthCallback(urlOrParams) {
+    let params;
+    if (urlOrParams instanceof URLSearchParams) {
+      params = urlOrParams;
+    } else if (typeof urlOrParams === "string") {
+      params = new URLSearchParams(urlOrParams);
+    } else if (hasWindow()) {
+      params = new URLSearchParams(window.location.search);
+    } else {
+      return null;
+    }
+    const provider = params.get("provider");
+    const code = params.get("code");
+    const state = params.get("state");
+    const error = params.get("error");
+    if (!provider || !code && !error) {
+      return null;
+    }
+    this.eventEmitter.emit({ type: "oauth:callback", data: { provider }, timestamp: Date.now() });
+    try {
+      if (error) {
+        const authError = new NAuthClientError(
+          "SOCIAL_TOKEN_INVALID" /* SOCIAL_TOKEN_INVALID */,
+          params.get("error_description") || error,
+          { details: { error, provider } }
+        );
+        this.eventEmitter.emit({ type: "oauth:error", data: authError, timestamp: Date.now() });
+        throw authError;
+      }
+      if (!state) {
+        throw new NAuthClientError("CHALLENGE_INVALID" /* CHALLENGE_INVALID */, "Missing OAuth state parameter");
+      }
+      const response = await this.handleSocialCallback({
+        provider,
+        code,
+        state
+      });
+      if (response.challengeName) {
+        this.eventEmitter.emit({ type: "auth:challenge", data: response, timestamp: Date.now() });
+      } else {
+        this.eventEmitter.emit({ type: "auth:success", data: response, timestamp: Date.now() });
+      }
+      this.eventEmitter.emit({ type: "oauth:completed", data: response, timestamp: Date.now() });
+      return response;
+    } catch (error2) {
+      const authError = error2 instanceof NAuthClientError ? error2 : new NAuthClientError(
+        "SOCIAL_TOKEN_INVALID" /* SOCIAL_TOKEN_INVALID */,
+        error2.message || "OAuth callback failed"
+      );
+      this.eventEmitter.emit({ type: "oauth:error", data: authError, timestamp: Date.now() });
+      throw authError;
+    }
+  }
+  /**
+   * Get social auth URL (low-level API).
+   *
+   * For most cases, use `loginWithSocial()` which handles state management automatically.
+   */
+  async getSocialAuthUrl(request) {
+    return this.post(this.config.endpoints.socialAuthUrl, request);
+  }
+  /**
+   * Handle social callback.
+   */
+  async handleSocialCallback(request) {
+    const result = await this.post(this.config.endpoints.socialCallback, request);
+    await this.handleAuthResponse(result);
+    return result;
+  }
+  /**
+   * Verify native social token (mobile).
+   */
+  async verifyNativeSocial(request) {
+    try {
+      const path = this.config.endpoints.socialVerify.replace(":provider", request.provider);
+      const result = await this.post(path, request);
+      await this.handleAuthResponse(result);
+      if (result.challengeName) {
+        const challengeEvent = { type: "auth:challenge", data: result, timestamp: Date.now() };
+        this.eventEmitter.emit(challengeEvent);
+      } else {
+        const successEvent = { type: "auth:success", data: result, timestamp: Date.now() };
+        this.eventEmitter.emit(successEvent);
+      }
+      return result;
+    } catch (error) {
+      const authError = error instanceof NAuthClientError ? error : new NAuthClientError(
+        "SOCIAL_TOKEN_INVALID" /* SOCIAL_TOKEN_INVALID */,
+        error.message || "Social verification failed"
+      );
+      const errorEvent = { type: "auth:error", data: authError, timestamp: Date.now() };
+      this.eventEmitter.emit(errorEvent);
+      throw authError;
+    }
+  }
+  /**
+   * Get linked accounts.
+   */
+  async getLinkedAccounts() {
+    return this.get(this.config.endpoints.socialLinked, true);
+  }
+  /**
+   * Link social account.
+   */
+  async linkSocialAccount(provider, code, state) {
+    return this.post(this.config.endpoints.socialLink, { provider, code, state }, true);
+  }
+  /**
+   * Unlink social account.
+   */
+  async unlinkSocialAccount(provider) {
+    return this.post(this.config.endpoints.socialUnlink, { provider }, true);
+  }
+  /**
+   * Trust current device.
+   */
+  async trustDevice() {
+    const result = await this.post(this.config.endpoints.trustDevice, {}, true);
+    await this.setDeviceToken(result.deviceToken);
+    return result;
+  }
+  /**
+   * Check if the current device is trusted.
+   *
+   * Returns whether the current device is trusted based on the device token
+   * (from cookie in cookies mode, or header in JSON mode).
+   *
+   * This performs a server-side validation of the device token and checks:
+   * - Device token exists and is valid
+   * - Device token matches a trusted device record in the database
+   * - Trust has not expired
+   *
+   * @returns Object with trusted status
+   *
+   * @example
+   * ```typescript
+   * const result = await client.isTrustedDevice();
+   * if (result.trusted) {
+   *   console.log('This device is trusted');
+   * }
+   * ```
+   */
+  async isTrustedDevice() {
+    return this.get(this.config.endpoints.isTrustedDevice, true);
+  }
+  /**
+   * Get paginated audit history for the current user.
+   *
+   * Returns authentication and security events with full audit details including:
+   * - Event type (login, logout, MFA, etc.)
+   * - Event status (success, failure, suspicious)
+   * - Device information, location, risk factors
+   *
+   * @param params - Query parameters for filtering and pagination
+   * @returns Paginated audit history response
+   *
+   * @example
+   * ```typescript
+   * const history = await client.getAuditHistory({
+   *   page: 1,
+   *   limit: 20,
+   *   eventType: 'LOGIN_SUCCESS'
+   * });
+   * ```
+   */
+  async getAuditHistory(params) {
+    const entries = Object.entries(params ?? {}).map(([k, v]) => [k, String(v)]);
+    const query = entries.length > 0 ? `?${new URLSearchParams(entries).toString()}` : "";
+    const path = `${this.config.endpoints.auditHistory}${query}`;
+    return this.get(path, true);
+  }
+  /**
+   * Initialize client by hydrating state from storage.
+   * Call this on app startup to restore auth state.
+   */
+  async initialize() {
+    const userJson = await this.config.storage.getItem(USER_KEY2);
+    if (userJson) {
+      try {
+        this.currentUser = JSON.parse(userJson);
+        this.config.onAuthStateChange?.(this.currentUser);
+      } catch {
+        await this.config.storage.removeItem(USER_KEY2);
+      }
+    }
+  }
+  /**
+   * Determine if user is authenticated (async - checks tokens).
+   */
+  async isAuthenticated() {
+    const tokens = await this.tokenManager.getTokens();
+    return Boolean(tokens.accessToken);
+  }
+  /**
+   * Determine if user is authenticated (sync - checks cached user).
+   * Use this for guards and sync checks. Use `isAuthenticated()` for definitive check.
+   */
+  isAuthenticatedSync() {
+    return this.currentUser !== null;
+  }
+  /**
+   * Get current access token (may be null).
+   */
+  async getAccessToken() {
+    const tokens = await this.tokenManager.getTokens();
+    return tokens.accessToken ?? null;
+  }
+  /**
+   * Get current user (cached, sync).
+   */
+  getCurrentUser() {
+    return this.currentUser;
+  }
+  /**
+   * Get stored challenge session (for resuming challenge flows).
+   */
+  async getStoredChallenge() {
+    const raw = await this.config.storage.getItem(CHALLENGE_KEY2);
+    if (!raw) return null;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Clear stored challenge session.
+   */
+  async clearStoredChallenge() {
+    await this.config.storage.removeItem(CHALLENGE_KEY2);
+  }
+  /**
+   * Internal: handle auth response (tokens or challenge).
+   *
+   * In cookies mode: Tokens are set as httpOnly cookies by backend, not stored in client storage.
+   * In JSON mode: Tokens are stored in tokenManager for Authorization header.
+   */
+  async handleAuthResponse(response) {
+    if (response.challengeName) {
+      await this.persistChallenge(response);
+      return;
+    }
+    if (this.config.tokenDelivery === "json" && response.accessToken && response.refreshToken) {
+      await this.tokenManager.setTokens({
+        accessToken: response.accessToken,
+        refreshToken: response.refreshToken,
+        accessTokenExpiresAt: response.accessTokenExpiresAt ?? 0,
+        refreshTokenExpiresAt: response.refreshTokenExpiresAt ?? 0
+      });
+    }
+    if (this.config.tokenDelivery === "json" && response.deviceToken) {
+      await this.setDeviceToken(response.deviceToken);
+    }
+    if (response.user) {
+      await this.setUser(response.user);
+    }
+    await this.clearChallenge();
+  }
+  /**
+   * Persist challenge state.
+   */
+  async persistChallenge(challenge) {
+    await this.config.storage.setItem(CHALLENGE_KEY2, JSON.stringify(challenge));
+  }
+  /**
+   * Clear challenge state.
+   */
+  async clearChallenge() {
+    await this.config.storage.removeItem(CHALLENGE_KEY2);
+  }
+  /**
+   * Persist user.
+   */
+  async setUser(user) {
+    this.currentUser = user;
+    await this.config.storage.setItem(USER_KEY2, JSON.stringify(user));
+    this.config.onAuthStateChange?.(user);
+  }
+  /**
+   * Clear all auth state.
+   *
+   * @param forgetDevice - If true, also clear device token (for JSON mode)
+   */
+  async clearAuthState(forgetDevice) {
+    this.currentUser = null;
+    await this.tokenManager.clearTokens();
+    await this.config.storage.removeItem(USER_KEY2);
+    if (forgetDevice && this.config.tokenDelivery === "json") {
+      await this.config.storage.removeItem(this.config.deviceTrust.storageKey);
+    }
+    this.config.onAuthStateChange?.(null);
+  }
+  /**
+   * Persist device token (json mode mobile).
+   */
+  async setDeviceToken(token) {
+    await this.config.storage.setItem(this.config.deviceTrust.storageKey, token);
+  }
+  /**
+   * Determine token delivery mode for this environment.
+   */
+  getTokenDeliveryMode() {
+    return this.config.tokenDelivery;
+  }
+  /**
+   * Build request URL by combining baseUrl with path.
+   * @private
+   */
+  buildUrl(path) {
+    return `${this.config.baseUrl}${path}`;
+  }
+  /**
+   * Build request headers for authentication.
+   * @private
+   */
+  async buildHeaders(auth) {
+    const headers = {
+      "Content-Type": "application/json",
+      ...this.config.headers
+    };
+    if (auth && this.config.tokenDelivery === "json") {
+      const accessToken = (await this.tokenManager.getTokens()).accessToken;
+      if (accessToken) {
+        headers["Authorization"] = `Bearer ${accessToken}`;
+      }
+    }
+    if (this.config.tokenDelivery === "cookies" && hasWindow()) {
+      const csrfToken = this.getCsrfToken();
+      if (csrfToken) {
+        headers[this.config.csrf.headerName] = csrfToken;
+      }
+    }
+    return headers;
+  }
+  /**
+   * Get CSRF token from cookie (browser only).
+   * @private
+   */
+  getCsrfToken() {
+    if (!hasWindow() || typeof document === "undefined") return null;
+    const match = document.cookie.match(new RegExp(`(^| )${this.config.csrf.cookieName}=([^;]+)`));
+    return match ? decodeURIComponent(match[2]) : null;
+  }
+  /**
+   * Execute GET request.
+   * Note: 401 refresh is handled by framework interceptors (Angular) or manually.
+   */
+  async get(path, auth = false) {
+    const url = this.buildUrl(path);
+    const headers = await this.buildHeaders(auth);
+    const credentials = this.config.tokenDelivery === "cookies" ? "include" : "omit";
+    const response = await this.config.httpAdapter.request({
+      method: "GET",
+      url,
+      headers,
+      credentials
+    });
+    return response.data;
+  }
+  /**
+   * Execute POST request.
+   * Note: 401 refresh is handled by framework interceptors (Angular) or manually.
+   */
+  async post(path, body, auth = false) {
+    const url = this.buildUrl(path);
+    const headers = await this.buildHeaders(auth);
+    const credentials = this.config.tokenDelivery === "cookies" ? "include" : "omit";
+    const response = await this.config.httpAdapter.request({
+      method: "POST",
+      url,
+      headers,
+      body,
+      credentials
+    });
+    return response.data;
+  }
+  /**
+   * Execute PUT request.
+   * Note: 401 refresh is handled by framework interceptors (Angular) or manually.
+   */
+  async put(path, body, auth = false) {
+    const url = this.buildUrl(path);
+    const headers = await this.buildHeaders(auth);
+    const credentials = this.config.tokenDelivery === "cookies" ? "include" : "omit";
+    const response = await this.config.httpAdapter.request({
+      method: "PUT",
+      url,
+      headers,
+      body,
+      credentials
+    });
+    return response.data;
+  }
+  /**
+   * Execute DELETE request.
+   * Note: 401 refresh is handled by framework interceptors (Angular) or manually.
+   */
+  async delete(path, auth = false) {
+    const url = this.buildUrl(path);
+    const headers = await this.buildHeaders(auth);
+    const credentials = this.config.tokenDelivery === "cookies" ? "include" : "omit";
+    const response = await this.config.httpAdapter.request({
+      method: "DELETE",
+      url,
+      headers,
+      credentials
+    });
+    return response.data;
+  }
+};
+
+// src/core/challenge-helpers.ts
+function requiresPhoneCollection(challenge) {
+  if (challenge.challengeName !== "VERIFY_PHONE" /* VERIFY_PHONE */) {
+    return false;
+  }
+  const params = challenge.challengeParameters;
+  return params?.["requiresPhoneCollection"] === "true";
+}
+function getMaskedDestination(challenge) {
+  const params = challenge.challengeParameters;
+  if (!params) {
+    return null;
+  }
+  const challengeName = challenge.challengeName;
+  if (challengeName === "MFA_REQUIRED" /* MFA_REQUIRED */) {
+    const method = params?.["preferredMethod"] || params?.["method"];
+    if (method === "sms") {
+      return params["maskedPhone"] || null;
+    }
+    if (method === "email") {
+      return params["maskedEmail"] || null;
+    }
+    return params["maskedPhone"] || params["maskedEmail"] || null;
+  }
+  return params["codeDeliveryDestination"] || null;
+}
+function getMFAMethod(challenge) {
+  if (challenge.challengeName !== "MFA_REQUIRED" /* MFA_REQUIRED */) {
+    return void 0;
+  }
+  const params = challenge.challengeParameters;
+  return params?.["preferredMethod"] || params?.["method"];
+}
+function getChallengeInstructions(challenge) {
+  const params = challenge.challengeParameters;
+  return params?.["instructions"];
+}
+function isOTPChallenge(challenge) {
+  const challengeName = challenge.challengeName;
+  return challengeName === "VERIFY_EMAIL" /* VERIFY_EMAIL */ || challengeName === "VERIFY_PHONE" /* VERIFY_PHONE */ || challengeName === "MFA_REQUIRED" /* MFA_REQUIRED */;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthAuditEventType,
+  AuthChallenge,
+  BrowserStorage,
+  EventEmitter,
+  FetchAdapter,
+  InMemoryStorage,
+  NAuthClient,
+  NAuthClientError,
+  NAuthErrorCode,
+  defaultEndpoints,
+  getChallengeInstructions,
+  getMFAMethod,
+  getMaskedDestination,
+  isOTPChallenge,
+  requiresPhoneCollection,
+  resolveConfig
+});
+//# sourceMappingURL=index.cjs.map