@oauth42/next 0.4.7 → 0.5.0

package/README.md

@@ -42,6 +42,8 @@ export const { handlers, auth } = createAuth({
   // Optional: Override defaults
   scopes: ['openid', 'profile', 'email'],
   pkceEnabled: true,
+  // Recommended: keep refresh tokens in the OAuth42 backend, not in cookies.
+  sessionStore: 'backend',
 });
 
 // App Router
@@ -230,9 +232,10 @@ export function MyClientComponent() {
 
 ```typescript
 // middleware.ts
-import { withOAuth42Auth } from '@oauth42/next/server';
+import { withOAuth42Auth } from '@oauth42/next/middleware';
 
 export default withOAuth42Auth({
+  sessionStore: 'backend',
   pages: {
     signIn: '/login',
   },
@@ -272,6 +275,48 @@ export const config = {
 
 **Note:** When using middleware, you don't need client-side auth checks in page components - the middleware handles authentication before the page renders.
 
+### Backend-Owned Opaque Sessions
+
+Use `sessionStore: 'backend'` for Gmail-style persistent sessions with immediate server-side revocation:
+
+```typescript
+// lib/auth.ts
+import { createAuth } from '@oauth42/next/server';
+
+const { auth, handlers } = createAuth({
+  clientId: process.env.OAUTH42_CLIENT_ID,
+  clientSecret: process.env.OAUTH42_CLIENT_SECRET,
+  issuer: process.env.OAUTH42_ISSUER,
+  cookiePrefix: 'oauth42-app',
+  sessionStore: 'backend',
+  session: {
+    maxAge: 365 * 24 * 60 * 60,
+  },
+});
+
+export const authOptions = auth;
+export { handlers };
+```
+
+```typescript
+// middleware.ts
+import { withOAuth42Auth } from '@oauth42/next/middleware';
+
+export default withOAuth42Auth({
+  cookiePrefix: 'oauth42-app',
+  sessionStore: 'backend',
+  clientId: process.env.OAUTH42_CLIENT_ID,
+  clientSecret: process.env.OAUTH42_CLIENT_SECRET,
+  issuer: process.env.OAUTH42_ISSUER,
+  session: {
+    maxAge: 365 * 24 * 60 * 60,
+  },
+  publicPaths: ['/api/auth', '/auth'],
+});
+```
+
+In this mode, the browser cookie contains an opaque backend session id inside the NextAuth session wrapper. OAuth access and refresh tokens are stored and rotated by the Rust OAuth42 backend. The Next.js SDK calls backend session endpoints; it does not connect to Redis.
+
 ### Server-Side Session
 
 ```typescript
@@ -367,4 +412,4 @@ Wrapper for protected content.
 Copyright (c) 2024 OAuth42, Inc. All rights reserved.
 
 This SDK is proprietary software provided by OAuth42, Inc. for use with OAuth42 services.
-See LICENSE file for terms and conditions.
+See LICENSE file for terms and conditions.

package/dist/{auth-BThRQMzh.d.mts → auth-CYMPe3k0.d.ts}

@@ -2,6 +2,7 @@ import { OAuthUserConfig, OAuthConfig } from 'next-auth/providers/oauth';
 import * as next_auth from 'next-auth';
 import { NextAuthOptions } from 'next-auth';
 import { GetServerSidePropsContext, NextApiRequest, NextApiResponse } from 'next';
+import { S as SessionStoreMode } from './index-Cfqxl9r2.js';
 
 interface OAuth42Profile {
     sub: string;
@@ -66,8 +67,17 @@ interface CreateAuthOptions {
     pkceEnabled?: boolean;
     debug?: boolean;
     callbacks?: NextAuthOptions['callbacks'];
+    events?: NextAuthOptions['events'];
     pages?: NextAuthOptions['pages'];
     session?: NextAuthOptions['session'];
+    /**
+     * Session storage mode.
+     *
+     * - "jwt" keeps OAuth token material in the encrypted NextAuth JWT cookie.
+     * - "backend" stores token material behind a Rust-backend-owned opaque
+     *   session id. Next.js never talks to Redis directly.
+     */
+    sessionStore?: SessionStoreMode;
     /**
      * Unique prefix for cookie names to allow multiple apps on the same domain.
      * Each app should use a different prefix (e.g., 'portal', 'admin', 'bond').

package/dist/{auth-BThRQMzh.d.ts → auth-D3tAruwx.d.mts}

@@ -2,6 +2,7 @@ import { OAuthUserConfig, OAuthConfig } from 'next-auth/providers/oauth';
 import * as next_auth from 'next-auth';
 import { NextAuthOptions } from 'next-auth';
 import { GetServerSidePropsContext, NextApiRequest, NextApiResponse } from 'next';
+import { S as SessionStoreMode } from './index-Cfqxl9r2.mjs';
 
 interface OAuth42Profile {
     sub: string;
@@ -66,8 +67,17 @@ interface CreateAuthOptions {
     pkceEnabled?: boolean;
     debug?: boolean;
     callbacks?: NextAuthOptions['callbacks'];
+    events?: NextAuthOptions['events'];
     pages?: NextAuthOptions['pages'];
     session?: NextAuthOptions['session'];
+    /**
+     * Session storage mode.
+     *
+     * - "jwt" keeps OAuth token material in the encrypted NextAuth JWT cookie.
+     * - "backend" stores token material behind a Rust-backend-owned opaque
+     *   session id. Next.js never talks to Redis directly.
+     */
+    sessionStore?: SessionStoreMode;
     /**
      * Unique prefix for cookie names to allow multiple apps on the same domain.
      * Each app should use a different prefix (e.g., 'portal', 'admin', 'bond').

package/dist/client/index.d.mts

@@ -1,9 +1,8 @@
 export { SessionProvider, signIn, signOut, useSession } from 'next-auth/react';
 export { Session } from 'next-auth';
-import * as react_jsx_runtime from 'react/jsx-runtime';
 import React from 'react';
 
-type OAuth42Session<E = {}> = ({
+type OAuth42Session<E extends object = Record<string, unknown>> = ({
     user?: {
         email?: string | null;
         name?: string | null;
@@ -15,7 +14,7 @@ type OAuth42Session<E = {}> = ({
     idToken?: string;
     expires?: string;
 }) & E;
-interface UseOAuth42SessionReturn<E = {}> {
+interface UseOAuth42SessionReturn<E extends object = Record<string, unknown>> {
     session: OAuth42Session<E> | null;
     loading: boolean;
     error: Error | null;
@@ -26,11 +25,11 @@ interface UseOAuth42SessionReturn<E = {}> {
 /**
  * Hook to manage OAuth42 session with optional extra fields
  */
-declare function useOAuth42Session<E = {}>(): UseOAuth42SessionReturn<E>;
+declare function useOAuth42Session<E extends object = Record<string, unknown>>(): UseOAuth42SessionReturn<E>;
 /**
  * Hook to get the current OAuth42 user
  */
-declare function useOAuth42User<E = {}>(): {
+declare function useOAuth42User<E extends object = Record<string, unknown>>(): {
     user: {
         email?: string | null;
         name?: string | null;
@@ -43,7 +42,7 @@ declare function useOAuth42User<E = {}>(): {
 /**
  * Hook to manage OAuth42 tokens
  */
-declare function useOAuth42Tokens<E = {}>(): {
+declare function useOAuth42Tokens<E extends object = Record<string, unknown>>(): {
     accessToken: string | undefined;
     idToken: string | undefined;
     isExpired: boolean;
@@ -66,7 +65,7 @@ interface SignInButtonProps {
 /**
  * Sign in button component
  */
-declare function SignInButton({ children, className, callbackUrl, onClick }: SignInButtonProps): react_jsx_runtime.JSX.Element;
+declare function SignInButton({ children, className, callbackUrl, onClick }: SignInButtonProps): React.JSX.Element;
 interface SignOutButtonProps {
     children?: React.ReactNode;
     className?: string;
@@ -76,7 +75,7 @@ interface SignOutButtonProps {
 /**
  * Sign out button component
  */
-declare function SignOutButton({ children, className, callbackUrl, onClick }: SignOutButtonProps): react_jsx_runtime.JSX.Element;
+declare function SignOutButton({ children, className, callbackUrl, onClick }: SignOutButtonProps): React.JSX.Element;
 interface UserProfileProps {
     className?: string;
     showEmail?: boolean;
@@ -88,7 +87,7 @@ interface UserProfileProps {
 /**
  * User profile display component
  */
-declare function UserProfile({ className, showEmail, showName, showImage, loadingComponent, notAuthenticatedComponent, }: UserProfileProps): react_jsx_runtime.JSX.Element;
+declare function UserProfile({ className, showEmail, showName, showImage, loadingComponent, notAuthenticatedComponent, }: UserProfileProps): React.JSX.Element;
 interface AuthStatusProps {
     authenticatedComponent?: React.ReactNode;
     unauthenticatedComponent?: React.ReactNode;
@@ -97,7 +96,7 @@ interface AuthStatusProps {
 /**
  * Conditional rendering based on auth status
  */
-declare function AuthStatus({ authenticatedComponent, unauthenticatedComponent, loadingComponent, }: AuthStatusProps): react_jsx_runtime.JSX.Element;
+declare function AuthStatus({ authenticatedComponent, unauthenticatedComponent, loadingComponent, }: AuthStatusProps): React.JSX.Element;
 interface ProtectedComponentProps {
     children: React.ReactNode;
     fallback?: React.ReactNode;
@@ -106,7 +105,7 @@ interface ProtectedComponentProps {
 /**
  * Wrapper component for protected content
  */
-declare function ProtectedComponent({ children, fallback, loadingComponent, }: ProtectedComponentProps): react_jsx_runtime.JSX.Element;
+declare function ProtectedComponent({ children, fallback, loadingComponent, }: ProtectedComponentProps): React.JSX.Element;
 
 /**
  * Utilities for OAuth42 Hosted Authentication
@@ -218,6 +217,15 @@ interface AuthError {
     requires_enrollment?: boolean;
     enrollment_token?: string;
     requires_mfa?: boolean;
+    mfa_methods?: string[];
+    email_otp_sent?: boolean;
+    email_otp_email?: string;
+    email_otp_rate_limited?: boolean;
+    phone_mfa_sent?: boolean;
+    phone_mfa_number?: string;
+    phone_mfa_method?: 'sms' | 'voice';
+    phone_mfa_rate_limited?: boolean;
+    phone_mfa_unavailable?: boolean;
 }
 /**
  * Authenticate with email/password and complete OAuth PKCE flow

package/dist/client/index.d.ts

@@ -1,9 +1,8 @@
 export { SessionProvider, signIn, signOut, useSession } from 'next-auth/react';
 export { Session } from 'next-auth';
-import * as react_jsx_runtime from 'react/jsx-runtime';
 import React from 'react';
 
-type OAuth42Session<E = {}> = ({
+type OAuth42Session<E extends object = Record<string, unknown>> = ({
     user?: {
         email?: string | null;
         name?: string | null;
@@ -15,7 +14,7 @@ type OAuth42Session<E = {}> = ({
     idToken?: string;
     expires?: string;
 }) & E;
-interface UseOAuth42SessionReturn<E = {}> {
+interface UseOAuth42SessionReturn<E extends object = Record<string, unknown>> {
     session: OAuth42Session<E> | null;
     loading: boolean;
     error: Error | null;
@@ -26,11 +25,11 @@ interface UseOAuth42SessionReturn<E = {}> {
 /**
  * Hook to manage OAuth42 session with optional extra fields
  */
-declare function useOAuth42Session<E = {}>(): UseOAuth42SessionReturn<E>;
+declare function useOAuth42Session<E extends object = Record<string, unknown>>(): UseOAuth42SessionReturn<E>;
 /**
  * Hook to get the current OAuth42 user
  */
-declare function useOAuth42User<E = {}>(): {
+declare function useOAuth42User<E extends object = Record<string, unknown>>(): {
     user: {
         email?: string | null;
         name?: string | null;
@@ -43,7 +42,7 @@ declare function useOAuth42User<E = {}>(): {
 /**
  * Hook to manage OAuth42 tokens
  */
-declare function useOAuth42Tokens<E = {}>(): {
+declare function useOAuth42Tokens<E extends object = Record<string, unknown>>(): {
     accessToken: string | undefined;
     idToken: string | undefined;
     isExpired: boolean;
@@ -66,7 +65,7 @@ interface SignInButtonProps {
 /**
  * Sign in button component
  */
-declare function SignInButton({ children, className, callbackUrl, onClick }: SignInButtonProps): react_jsx_runtime.JSX.Element;
+declare function SignInButton({ children, className, callbackUrl, onClick }: SignInButtonProps): React.JSX.Element;
 interface SignOutButtonProps {
     children?: React.ReactNode;
     className?: string;
@@ -76,7 +75,7 @@ interface SignOutButtonProps {
 /**
  * Sign out button component
  */
-declare function SignOutButton({ children, className, callbackUrl, onClick }: SignOutButtonProps): react_jsx_runtime.JSX.Element;
+declare function SignOutButton({ children, className, callbackUrl, onClick }: SignOutButtonProps): React.JSX.Element;
 interface UserProfileProps {
     className?: string;
     showEmail?: boolean;
@@ -88,7 +87,7 @@ interface UserProfileProps {
 /**
  * User profile display component
  */
-declare function UserProfile({ className, showEmail, showName, showImage, loadingComponent, notAuthenticatedComponent, }: UserProfileProps): react_jsx_runtime.JSX.Element;
+declare function UserProfile({ className, showEmail, showName, showImage, loadingComponent, notAuthenticatedComponent, }: UserProfileProps): React.JSX.Element;
 interface AuthStatusProps {
     authenticatedComponent?: React.ReactNode;
     unauthenticatedComponent?: React.ReactNode;
@@ -97,7 +96,7 @@ interface AuthStatusProps {
 /**
  * Conditional rendering based on auth status
  */
-declare function AuthStatus({ authenticatedComponent, unauthenticatedComponent, loadingComponent, }: AuthStatusProps): react_jsx_runtime.JSX.Element;
+declare function AuthStatus({ authenticatedComponent, unauthenticatedComponent, loadingComponent, }: AuthStatusProps): React.JSX.Element;
 interface ProtectedComponentProps {
     children: React.ReactNode;
     fallback?: React.ReactNode;
@@ -106,7 +105,7 @@ interface ProtectedComponentProps {
 /**
  * Wrapper component for protected content
  */
-declare function ProtectedComponent({ children, fallback, loadingComponent, }: ProtectedComponentProps): react_jsx_runtime.JSX.Element;
+declare function ProtectedComponent({ children, fallback, loadingComponent, }: ProtectedComponentProps): React.JSX.Element;
 
 /**
  * Utilities for OAuth42 Hosted Authentication
@@ -218,6 +217,15 @@ interface AuthError {
     requires_enrollment?: boolean;
     enrollment_token?: string;
     requires_mfa?: boolean;
+    mfa_methods?: string[];
+    email_otp_sent?: boolean;
+    email_otp_email?: string;
+    email_otp_rate_limited?: boolean;
+    phone_mfa_sent?: boolean;
+    phone_mfa_number?: string;
+    phone_mfa_method?: 'sms' | 'voice';
+    phone_mfa_rate_limited?: boolean;
+    phone_mfa_unavailable?: boolean;
 }
 /**
  * Authenticate with email/password and complete OAuth PKCE flow

package/dist/client/index.js

@@ -308,7 +308,16 @@ async function loginWithPassword(options) {
           success: false,
           error: "mfa_required",
           error_description: "MFA code required",
-          requires_mfa: true
+          requires_mfa: true,
+          mfa_methods: errorData?.mfa_methods,
+          email_otp_sent: errorData?.email_otp_sent,
+          email_otp_email: errorData?.email_otp_email,
+          email_otp_rate_limited: errorData?.email_otp_rate_limited,
+          phone_mfa_sent: errorData?.phone_mfa_sent,
+          phone_mfa_number: errorData?.phone_mfa_number,
+          phone_mfa_method: errorData?.phone_mfa_method,
+          phone_mfa_rate_limited: errorData?.phone_mfa_rate_limited,
+          phone_mfa_unavailable: errorData?.phone_mfa_unavailable
         };
       }
       if (loginResponse.status === 401 && /invalid mfa code/i.test(desc)) {

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/index.ts","../../src/client/hooks.ts","../../src/client/components.tsx","../../src/utils/hosted-auth.ts","../../src/client/auth.ts"],"sourcesContent":["// Client-side exports\n\n// Re-export commonly used next-auth/react functions\nexport { signIn, signOut, useSession, SessionProvider } from 'next-auth/react';\nexport type { Session } from 'next-auth';\nexport {\n  useOAuth42Session,\n  useOAuth42User,\n  useOAuth42Tokens,\n  useRequireAuth,\n} from './hooks';\n\nexport type {\n  OAuth42Session,\n  UseOAuth42SessionReturn,\n} from './hooks';\n\nexport {\n  SignInButton,\n  SignOutButton,\n  UserProfile,\n  AuthStatus,\n  ProtectedComponent,\n} from './components';\n\nexport type {\n  SignInButtonProps,\n  SignOutButtonProps,\n  UserProfileProps,\n  AuthStatusProps,\n  ProtectedComponentProps,\n} from './components';\n\n// Hosted auth utilities\nexport {\n  redirectToHostedAuth,\n  verifyState,\n  DEFAULT_HOSTED_AUTH_CONFIG,\n} from '../utils/hosted-auth';\n\nexport type {\n  HostedAuthOptions,\n  HostedAuthConfig,\n} from '../utils/hosted-auth';\n\n// Custom authentication utilities\nexport {\n  loginWithPassword,\n  initiateAuthenticatorLogin,\n  completeAuthenticatorLogin,\n  simulateApproval,\n  logout,\n  logoutEverywhere,\n} from './auth';\n\nexport type {\n  LoginWithPasswordOptions,\n  LoginWithAuthenticatorOptions,\n  AuthError,\n} from './auth';","import { useSession, signIn, signOut } from 'next-auth/react';\nimport { useCallback, useEffect, useState } from 'react';\n\nexport type OAuth42Session<E = {}> = ({\n  user?: {\n    email?: string | null;\n    name?: string | null;\n    image?: string | null;\n    username?: string;\n    emailVerified?: boolean;\n  };\n  accessToken?: string;\n  idToken?: string;\n  expires?: string;\n}) & E;\n\nexport interface UseOAuth42SessionReturn<E = {}> {\n  session: OAuth42Session<E> | null;\n  loading: boolean;\n  error: Error | null;\n  isAuthenticated: boolean;\n  signIn: () => Promise<void>;\n  signOut: () => Promise<void>;\n}\n\n/**\n * Hook to manage OAuth42 session with optional extra fields\n */\nexport function useOAuth42Session<E = {}>(): UseOAuth42SessionReturn<E> {\n  const { data: session, status } = useSession();\n  const [error, setError] = useState<Error | null>(null);\n  \n  const handleSignIn = useCallback(async () => {\n    try {\n      setError(null);\n      await signIn('oauth42');\n    } catch (err) {\n      setError(err as Error);\n    }\n  }, []);\n  \n  const handleSignOut = useCallback(async () => {\n    try {\n      setError(null);\n      await signOut();\n    } catch (err) {\n      setError(err as Error);\n    }\n  }, []);\n  \n  return {\n    session: session as unknown as OAuth42Session<E> | null,\n    loading: status === 'loading',\n    error,\n    isAuthenticated: status === 'authenticated',\n    signIn: handleSignIn,\n    signOut: handleSignOut,\n  };\n}\n\n/**\n * Hook to get the current OAuth42 user\n */\nexport function useOAuth42User<E = {}>() {\n  const { session, isAuthenticated } = useOAuth42Session<E>();\n  \n  return {\n    user: isAuthenticated ? session?.user : null,\n    isAuthenticated,\n  };\n}\n\n/**\n * Hook to manage OAuth42 tokens\n */\nexport function useOAuth42Tokens<E = {}>() {\n  const { session } = useOAuth42Session<E>();\n  const [isExpired, setIsExpired] = useState(false);\n  \n  useEffect(() => {\n    if (session?.expires) {\n      const expiryTime = new Date(session.expires).getTime();\n      const now = Date.now();\n      setIsExpired(now >= expiryTime);\n      \n      // Set a timer to update expiry status\n      const timeUntilExpiry = expiryTime - now;\n      if (timeUntilExpiry > 0) {\n        const timer = setTimeout(() => {\n          setIsExpired(true);\n        }, timeUntilExpiry);\n        \n        return () => clearTimeout(timer);\n      }\n    }\n  }, [session?.expires]);\n  \n  return {\n    accessToken: session?.accessToken,\n    idToken: session?.idToken,\n    isExpired,\n    refreshToken: async () => {\n      // Trigger a session refresh\n      await signIn('oauth42');\n    },\n  };\n}\n\n/**\n * Hook for protected routes\n */\nexport function useRequireAuth(redirectTo: string = '/auth/signin') {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  const [isRedirecting, setIsRedirecting] = useState(false);\n  \n  useEffect(() => {\n    if (!loading && !isAuthenticated && !isRedirecting) {\n      setIsRedirecting(true);\n      if (typeof window !== 'undefined') {\n        window.location.href = redirectTo;\n      }\n    }\n  }, [isAuthenticated, loading, redirectTo, isRedirecting]);\n  \n  return {\n    isAuthenticated,\n    loading: loading || isRedirecting,\n  };\n}\n","import React from 'react';\nimport { signIn, signOut } from 'next-auth/react';\nimport { useOAuth42Session, useOAuth42User } from './hooks';\n\nexport interface SignInButtonProps {\n  children?: React.ReactNode;\n  className?: string;\n  callbackUrl?: string;\n  onClick?: () => void;\n}\n\n/**\n * Sign in button component\n */\nexport function SignInButton({ \n  children = 'Sign in with OAuth42', \n  className = '',\n  callbackUrl = '/',\n  onClick\n}: SignInButtonProps) {\n  const handleClick = async () => {\n    if (onClick) onClick();\n    await signIn('oauth42', { callbackUrl });\n  };\n  \n  return (\n    <button\n      onClick={handleClick}\n      className={className}\n      type=\"button\"\n    >\n      {children}\n    </button>\n  );\n}\n\nexport interface SignOutButtonProps {\n  children?: React.ReactNode;\n  className?: string;\n  callbackUrl?: string;\n  onClick?: () => void;\n}\n\n/**\n * Sign out button component\n */\nexport function SignOutButton({ \n  children = 'Sign out', \n  className = '',\n  callbackUrl = '/',\n  onClick\n}: SignOutButtonProps) {\n  const handleClick = async () => {\n    if (onClick) onClick();\n    await signOut({ callbackUrl });\n  };\n  \n  return (\n    <button\n      onClick={handleClick}\n      className={className}\n      type=\"button\"\n    >\n      {children}\n    </button>\n  );\n}\n\nexport interface UserProfileProps {\n  className?: string;\n  showEmail?: boolean;\n  showName?: boolean;\n  showImage?: boolean;\n  loadingComponent?: React.ReactNode;\n  notAuthenticatedComponent?: React.ReactNode;\n}\n\n/**\n * User profile display component\n */\nexport function UserProfile({\n  className = '',\n  showEmail = true,\n  showName = true,\n  showImage = true,\n  loadingComponent = <div>Loading...</div>,\n  notAuthenticatedComponent = <div>Not authenticated</div>,\n}: UserProfileProps) {\n  const { session, loading, isAuthenticated } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  if (!isAuthenticated || !session?.user) {\n    return <>{notAuthenticatedComponent}</>;\n  }\n  \n  const { user } = session;\n  \n  return (\n    <div className={className}>\n      {showImage && user.image && (\n        <img \n          src={user.image} \n          alt={user.name || 'User'} \n          style={{ width: 50, height: 50, borderRadius: '50%' }}\n        />\n      )}\n      {showName && user.name && <div>{user.name}</div>}\n      {showEmail && user.email && <div>{user.email}</div>}\n    </div>\n  );\n}\n\nexport interface AuthStatusProps {\n  authenticatedComponent?: React.ReactNode;\n  unauthenticatedComponent?: React.ReactNode;\n  loadingComponent?: React.ReactNode;\n}\n\n/**\n * Conditional rendering based on auth status\n */\nexport function AuthStatus({\n  authenticatedComponent,\n  unauthenticatedComponent,\n  loadingComponent = <div>Loading...</div>,\n}: AuthStatusProps) {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  return <>{isAuthenticated ? authenticatedComponent : unauthenticatedComponent}</>;\n}\n\nexport interface ProtectedComponentProps {\n  children: React.ReactNode;\n  fallback?: React.ReactNode;\n  loadingComponent?: React.ReactNode;\n}\n\n/**\n * Wrapper component for protected content\n */\nexport function ProtectedComponent({\n  children,\n  fallback = <SignInButton />,\n  loadingComponent = <div>Loading...</div>,\n}: ProtectedComponentProps) {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  if (!isAuthenticated) {\n    return <>{fallback}</>;\n  }\n  \n  return <>{children}</>;\n}","/**\n * Utilities for OAuth42 Hosted Authentication\n */\n\nexport interface HostedAuthOptions {\n  /** OAuth2 client ID */\n  clientId: string;\n  /** Redirect URI after authentication */\n  redirectUri: string;\n  /** OAuth2 scopes (space-separated) */\n  scope?: string;\n  /** OAuth2 state parameter for CSRF protection */\n  state?: string;\n  /** Base URL for OAuth42 issuer/API (defaults to production) */\n  issuer?: string;\n}\n\n/**\n * Generate a random state parameter for CSRF protection\n */\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Redirect to OAuth42 hosted authentication pages\n *\n * @example\n * ```ts\n * import { redirectToHostedAuth } from '@oauth42/next/client';\n *\n * function LoginButton() {\n *   return (\n *     <button onClick={() => redirectToHostedAuth({\n *       clientId: process.env.NEXT_PUBLIC_OAUTH42_CLIENT_ID!,\n *       redirectUri: `${window.location.origin}/api/auth/callback`,\n *     })}>\n *       Sign in with OAuth42\n *     </button>\n *   );\n * }\n * ```\n */\nexport function redirectToHostedAuth(options: HostedAuthOptions): void {\n  const {\n    clientId,\n    redirectUri,\n    scope = 'openid profile email',\n    state = generateState(),\n    issuer = 'https://api.oauth42.com',\n  } = options;\n\n  const params = new URLSearchParams({\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    response_type: 'code',\n    scope,\n    state,\n  });\n\n  // Redirect to the backend's authorize endpoint, which handles the OAuth flow\n  // and redirects to hosted auth login if user is not authenticated\n  const authUrl = `${issuer}/oauth2/authorize?${params.toString()}`;\n\n  // Store state in sessionStorage for verification on callback\n  if (typeof window !== 'undefined') {\n    sessionStorage.setItem('oauth42_state', state);\n    window.location.href = authUrl;\n  }\n}\n\n/**\n * Verify state parameter on OAuth2 callback\n * Call this in your callback page to verify the state matches\n *\n * @example\n * ```ts\n * import { verifyState } from '@oauth42/next/client';\n *\n * export default function CallbackPage() {\n *   const searchParams = useSearchParams();\n *   const state = searchParams.get('state');\n *\n *   if (!verifyState(state)) {\n *     return <div>Invalid state parameter</div>;\n *   }\n *\n *   // Continue with token exchange...\n * }\n * ```\n */\nexport function verifyState(state: string | null): boolean {\n  if (typeof window === 'undefined') return false;\n  if (!state) return false;\n\n  const storedState = sessionStorage.getItem('oauth42_state');\n  sessionStorage.removeItem('oauth42_state');\n\n  return storedState === state;\n}\n\n/**\n * Configuration for hosted authentication\n */\nexport interface HostedAuthConfig {\n  /** Enable hosted authentication */\n  enabled: boolean;\n  /** Base URL for hosted auth pages (optional, defaults to production) */\n  baseUrl?: string;\n  /** Feature flags for hosted auth */\n  features?: {\n    /** Allow user signup */\n    signup?: boolean;\n    /** Allow social login */\n    socialLogin?: boolean;\n    /** Allow password reset */\n    passwordReset?: boolean;\n  };\n}\n\n/**\n * Default hosted auth configuration\n */\nexport const DEFAULT_HOSTED_AUTH_CONFIG: HostedAuthConfig = {\n  enabled: true,\n  baseUrl: 'https://auth.oauth42.com',\n  features: {\n    signup: true,\n    socialLogin: false,\n    passwordReset: true,\n  },\n};\n","/**\n * OAuth42 Custom Authentication Utilities\n *\n * Provides functions for implementing custom login UIs in customer apps\n * while properly handling OAuth2 PKCE flows and next-auth integration.\n */\n\nimport { signIn } from 'next-auth/react';\n\n// PKCE utilities\nfunction base64URLEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.byteLength; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '');\n}\n\nasync function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64URLEncode(array.buffer);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const hash = await crypto.subtle.digest('SHA-256', data);\n  return base64URLEncode(hash);\n}\n\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64URLEncode(array.buffer);\n}\n\nexport interface LoginWithPasswordOptions {\n  email: string;\n  password: string;\n  mfaCode?: string;\n  /**\n   * URL to redirect to after successful authentication.\n   * If not provided, will redirect to '/'\n   */\n  callbackUrl?: string;\n}\n\nexport interface LoginWithAuthenticatorOptions {\n  email: string;\n  sessionId: string;\n  /**\n   * URL to redirect to after successful authentication.\n   * If not provided, will redirect to '/'\n   */\n  callbackUrl?: string;\n}\n\nexport interface AuthError {\n  error: string;\n  error_description?: string;\n  requires_enrollment?: boolean;\n  enrollment_token?: string;\n  requires_mfa?: boolean;\n}\n\n/**\n * Authenticate with email/password and complete OAuth PKCE flow\n *\n * This function handles the full authentication flow:\n * 1. Authenticates with the backend using credentials\n * 2. Uses the access token to authorize the OAuth client\n * 3. Exchanges authorization code for tokens via next-auth\n *\n * @example\n * ```tsx\n * const result = await loginWithPassword({\n *   email: 'user@example.com',\n *   password: 'password123',\n *   callbackUrl: '/dashboard'\n * });\n *\n * if (result.success) {\n *   // User is authenticated, next-auth session is set\n * } else if (result.requires_mfa) {\n *   // Prompt for MFA code and call again with mfaCode\n * }\n * ```\n */\nexport async function loginWithPassword(\n  options: LoginWithPasswordOptions\n): Promise<{ success: boolean; access_token?: string } & Partial<AuthError>> {\n  try {\n    // Step 1: Authenticate with backend to get access token\n    const loginResponse = await fetch('/api/auth/login', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        email: options.email,\n        password: options.password,\n        ...(options.mfaCode ? { mfa_code: options.mfaCode } : {}),\n      }),\n    });\n\n    if (!loginResponse.ok) {\n      const errorData = await loginResponse.json().catch(() => ({}));\n      const desc: string = errorData?.error_description || errorData?.message || '';\n\n      // Handle special cases\n      if (loginResponse.status === 403 && errorData?.requires_enrollment) {\n        return {\n          success: false,\n          error: 'enrollment_required',\n          error_description: 'MFA enrollment required',\n          requires_enrollment: true,\n          enrollment_token: errorData.enrollment_token,\n        };\n      }\n\n      if (loginResponse.status === 403 && /mfa required/i.test(desc)) {\n        return {\n          success: false,\n          error: 'mfa_required',\n          error_description: 'MFA code required',\n          requires_mfa: true,\n        };\n      }\n\n      if (loginResponse.status === 401 && /invalid mfa code/i.test(desc)) {\n        return {\n          success: false,\n          error: 'invalid_mfa_code',\n          error_description: 'Invalid MFA code',\n          requires_mfa: true,\n        };\n      }\n\n      return {\n        success: false,\n        error: 'authentication_failed',\n        error_description: desc || 'Invalid credentials',\n      };\n    }\n\n    const { access_token } = await loginResponse.json();\n\n    // Return access token for the application to use in OAuth authorize flow\n    return { success: true, access_token };\n  } catch (error) {\n    console.error('Login error:', error);\n    return {\n      success: false,\n      error: 'network_error',\n      error_description: 'Failed to connect to authentication server',\n    };\n  }\n}\n\n/**\n * Initiate authenticator (passwordless) login and return challenge code\n *\n * @example\n * ```tsx\n * const result = await initiateAuthenticatorLogin({\n *   email: 'user@example.com',\n *   sessionId: crypto.randomUUID()\n * });\n *\n * if (result.success) {\n *   // Display result.challengeCode to user\n *   // Wait for WebSocket approval or poll for completion\n * }\n * ```\n */\nexport async function initiateAuthenticatorLogin(\n  options: LoginWithAuthenticatorOptions\n): Promise<{\n  success: boolean;\n  challengeCode?: string;\n  challengeId?: string;\n} & Partial<AuthError>> {\n  try {\n    const response = await fetch('/api/auth/passwordless/initiate', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        email: options.email,\n        session_id: options.sessionId,\n      }),\n    });\n\n    if (!response.ok) {\n      const errorData = await response.json().catch(() => ({}));\n      return {\n        success: false,\n        error: 'initiation_failed',\n        error_description: errorData.error_description || 'Failed to create challenge',\n      };\n    }\n\n    const data = await response.json();\n\n    return {\n      success: true,\n      challengeCode: data.challenge_code,\n      challengeId: data.challenge_id,\n    };\n  } catch (error) {\n    console.error('Authenticator login error:', error);\n    return {\n      success: false,\n      error: 'network_error',\n      error_description: 'Failed to connect to authentication server',\n    };\n  }\n}\n\n/**\n * Complete authenticator login after approval\n *\n * Call this after receiving approval notification via WebSocket\n * or after the user has approved on their mobile device.\n * Returns the access token for the application to use in OAuth authorize flow.\n *\n * @param accessToken - Access token received from approval payload\n */\nexport async function completeAuthenticatorLogin(\n  accessToken: string\n): Promise<{ success: boolean; access_token: string }> {\n  return { success: true, access_token: accessToken };\n}\n\n/**\n * Simulate approval for testing (development only)\n *\n * @param challengeId - The challenge ID to approve\n * @param selectedCode - The code that was displayed to the user\n */\nexport async function simulateApproval(\n  challengeId: string,\n  selectedCode: string\n): Promise<{ success: boolean }> {\n  try {\n    await fetch('/api/auth/challenge/approve', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        challenge_id: challengeId,\n        selected_code: selectedCode,\n      }),\n    });\n\n    return { success: true };\n  } catch (error) {\n    console.error('Simulated approval failed:', error);\n    return { success: false };\n  }\n}\n\n/**\n * Logout the current user from the app only (app-level logout)\n *\n * This clears the next-auth session for this app AND removes the app-user\n * mapping from the session registry. On next login, the user will see\n * the account picker to choose which account to use.\n *\n * For provider-level logout (sign out of all apps), use logoutEverywhere().\n *\n * @param options.callbackUrl - URL to redirect to after logout (default: '/')\n * @param options.clientId - OAuth client ID to clear from registry\n * @param options.issuer - OAuth42 issuer URL for the logout endpoint\n *\n * @example\n * ```tsx\n * import { logout } from '@oauth42/next/client';\n *\n * const handleLogout = async () => {\n *   await logout({\n *     callbackUrl: '/login',\n *     clientId: process.env.NEXT_PUBLIC_OAUTH42_CLIENT_ID,\n *     issuer: process.env.NEXT_PUBLIC_OAUTH_ISSUER || 'https://localhost:8443'\n *   });\n * };\n * ```\n */\nexport async function logout(options?: {\n  callbackUrl?: string;\n  clientId?: string;\n  issuer?: string;\n}): Promise<void> {\n  // If clientId and issuer provided, call backend to clear app_user from registry\n  if (options?.clientId && options?.issuer) {\n    try {\n      await fetch(`${options.issuer}/oauth2/logout?client_id=${encodeURIComponent(options.clientId)}`, {\n        method: 'POST',\n        credentials: 'include', // Include cookies (registry cookie)\n      });\n    } catch (err) {\n      console.warn('[OAuth42] Failed to clear app user from registry:', err);\n      // Continue with NextAuth signOut even if this fails\n    }\n  }\n\n  // Import signOut from next-auth/react\n  const { signOut } = await import('next-auth/react');\n\n  // Clear next-auth session (app-level only)\n  await signOut({\n    callbackUrl: options?.callbackUrl || '/',\n    redirect: true\n  });\n}\n\n/**\n * Logout the current user from ALL apps using OAuth42 (provider-level logout)\n *\n * This redirects to the OAuth42 provider's logout endpoint to clear the\n * oauth42_session cookie, effectively logging the user out of all apps.\n *\n * Use this when testing fresh login flows or when the user explicitly\n * wants to sign out of everything.\n *\n * @param issuer - The OAuth42 issuer URL (e.g., 'https://localhost:8443')\n * @param callbackUrl - URL to redirect to after logout (default: current origin)\n *\n * @example\n * ```tsx\n * import { logoutEverywhere } from '@oauth42/next/client';\n *\n * const handleLogoutEverywhere = () => {\n *   const issuer = process.env.NEXT_PUBLIC_OAUTH42_ISSUER || 'https://localhost:8443';\n *   logoutEverywhere(issuer, '/auth/signin');\n * };\n * ```\n */\nexport async function logoutEverywhere(issuer: string, callbackUrl?: string): Promise<void> {\n  const redirectUri = callbackUrl || window.location.origin;\n\n  // Build the final redirect URL - backend will clear oauth42_session, then redirect\n  // to NextAuth signout which will clear the app session cookie\n  const backendLogoutUrl = `${issuer}/auth/logout?redirect_uri=${encodeURIComponent(redirectUri)}`;\n\n  // First call NextAuth signout to clear the app session cookie\n  // Then redirect to backend to clear the oauth42_session cookie\n  try {\n    // Get CSRF token from NextAuth\n    const csrfResponse = await fetch('/api/auth/csrf');\n    const { csrfToken } = await csrfResponse.json();\n\n    // Call NextAuth signOut endpoint to clear session - wait for it to complete\n    const signoutResponse = await fetch('/api/auth/signout', {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        csrfToken,\n        json: 'true',\n      }),\n      credentials: 'include',\n    });\n\n    // Log response for debugging\n    console.log('[OAuth42] NextAuth signout response:', signoutResponse.status);\n  } catch (err) {\n    console.warn('[OAuth42] Failed to call NextAuth signout:', err);\n  }\n\n  // Now redirect to OAuth42 provider logout endpoint\n  // This clears the oauth42_session cookie and redirects back to the app\n  console.log('[OAuth42] Redirecting to backend logout:', backendLogoutUrl);\n  window.location.href = backendLogoutUrl;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,IAAAA,gBAA6D;;;ACH7D,mBAA4C;AAC5C,IAAAC,gBAAiD;AA2B1C,SAAS,oBAAwD;AACtE,QAAM,EAAE,MAAM,SAAS,OAAO,QAAI,yBAAW;AAC7C,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAuB,IAAI;AAErD,QAAM,mBAAe,2BAAY,YAAY;AAC3C,QAAI;AACF,eAAS,IAAI;AACb,gBAAM,qBAAO,SAAS;AAAA,IACxB,SAAS,KAAK;AACZ,eAAS,GAAY;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,oBAAgB,2BAAY,YAAY;AAC5C,QAAI;AACF,eAAS,IAAI;AACb,gBAAM,sBAAQ;AAAA,IAChB,SAAS,KAAK;AACZ,eAAS,GAAY;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,iBAAiB,WAAW;AAAA,IAC5B,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACF;AAKO,SAAS,iBAAyB;AACvC,QAAM,EAAE,SAAS,gBAAgB,IAAI,kBAAqB;AAE1D,SAAO;AAAA,IACL,MAAM,kBAAkB,SAAS,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAKO,SAAS,mBAA2B;AACzC,QAAM,EAAE,QAAQ,IAAI,kBAAqB;AACzC,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,KAAK;AAEhD,+BAAU,MAAM;AACd,QAAI,SAAS,SAAS;AACpB,YAAM,aAAa,IAAI,KAAK,QAAQ,OAAO,EAAE,QAAQ;AACrD,YAAM,MAAM,KAAK,IAAI;AACrB,mBAAa,OAAO,UAAU;AAG9B,YAAM,kBAAkB,aAAa;AACrC,UAAI,kBAAkB,GAAG;AACvB,cAAM,QAAQ,WAAW,MAAM;AAC7B,uBAAa,IAAI;AAAA,QACnB,GAAG,eAAe;AAElB,eAAO,MAAM,aAAa,KAAK;AAAA,MACjC;AAAA,IACF;AAAA,EACF,GAAG,CAAC,SAAS,OAAO,CAAC;AAErB,SAAO;AAAA,IACL,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,cAAc,YAAY;AAExB,gBAAM,qBAAO,SAAS;AAAA,IACxB;AAAA,EACF;AACF;AAKO,SAAS,eAAe,aAAqB,gBAAgB;AAClE,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AACvD,QAAM,CAAC,eAAe,gBAAgB,QAAI,wBAAS,KAAK;AAExD,+BAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,eAAe;AAClD,uBAAiB,IAAI;AACrB,UAAI,OAAO,WAAW,aAAa;AACjC,eAAO,SAAS,OAAO;AAAA,MACzB;AAAA,IACF;AAAA,EACF,GAAG,CAAC,iBAAiB,SAAS,YAAY,aAAa,CAAC;AAExD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,EACtB;AACF;;;AC/HA,IAAAC,gBAAgC;AAyB5B;AAZG,SAAS,aAAa;AAAA,EAC3B,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,cAAc;AAAA,EACd;AACF,GAAsB;AACpB,QAAM,cAAc,YAAY;AAC9B,QAAI,QAAS,SAAQ;AACrB,cAAM,sBAAO,WAAW,EAAE,YAAY,CAAC;AAAA,EACzC;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS;AAAA,MACT;AAAA,MACA,MAAK;AAAA,MAEJ;AAAA;AAAA,EACH;AAEJ;AAYO,SAAS,cAAc;AAAA,EAC5B,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,cAAc;AAAA,EACd;AACF,GAAuB;AACrB,QAAM,cAAc,YAAY;AAC9B,QAAI,QAAS,SAAQ;AACrB,cAAM,uBAAQ,EAAE,YAAY,CAAC;AAAA,EAC/B;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS;AAAA,MACT;AAAA,MACA,MAAK;AAAA,MAEJ;AAAA;AAAA,EACH;AAEJ;AAcO,SAAS,YAAY;AAAA,EAC1B,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,mBAAmB,4CAAC,SAAI,wBAAU;AAAA,EAClC,4BAA4B,4CAAC,SAAI,+BAAiB;AACpD,GAAqB;AACnB,QAAM,EAAE,SAAS,SAAS,gBAAgB,IAAI,kBAAkB;AAEhE,MAAI,SAAS;AACX,WAAO,2EAAG,4BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,mBAAmB,CAAC,SAAS,MAAM;AACtC,WAAO,2EAAG,qCAA0B;AAAA,EACtC;AAEA,QAAM,EAAE,KAAK,IAAI;AAEjB,SACE,6CAAC,SAAI,WACF;AAAA,iBAAa,KAAK,SACjB;AAAA,MAAC;AAAA;AAAA,QACC,KAAK,KAAK;AAAA,QACV,KAAK,KAAK,QAAQ;AAAA,QAClB,OAAO,EAAE,OAAO,IAAI,QAAQ,IAAI,cAAc,MAAM;AAAA;AAAA,IACtD;AAAA,IAED,YAAY,KAAK,QAAQ,4CAAC,SAAK,eAAK,MAAK;AAAA,IACzC,aAAa,KAAK,SAAS,4CAAC,SAAK,eAAK,OAAM;AAAA,KAC/C;AAEJ;AAWO,SAAS,WAAW;AAAA,EACzB;AAAA,EACA;AAAA,EACA,mBAAmB,4CAAC,SAAI,wBAAU;AACpC,GAAoB;AAClB,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AAEvD,MAAI,SAAS;AACX,WAAO,2EAAG,4BAAiB;AAAA,EAC7B;AAEA,SAAO,2EAAG,4BAAkB,yBAAyB,0BAAyB;AAChF;AAWO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,WAAW,4CAAC,gBAAa;AAAA,EACzB,mBAAmB,4CAAC,SAAI,wBAAU;AACpC,GAA4B;AAC1B,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AAEvD,MAAI,SAAS;AACX,WAAO,2EAAG,4BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,iBAAiB;AACpB,WAAO,2EAAG,oBAAS;AAAA,EACrB;AAEA,SAAO,2EAAG,UAAS;AACrB;;;AC/IA,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,UAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC9E;AAqBO,SAAS,qBAAqB,SAAkC;AACrE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ,cAAc;AAAA,IACtB,SAAS;AAAA,EACX,IAAI;AAEJ,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe;AAAA,IACf;AAAA,IACA;AAAA,EACF,CAAC;AAID,QAAM,UAAU,GAAG,MAAM,qBAAqB,OAAO,SAAS,CAAC;AAG/D,MAAI,OAAO,WAAW,aAAa;AACjC,mBAAe,QAAQ,iBAAiB,KAAK;AAC7C,WAAO,SAAS,OAAO;AAAA,EACzB;AACF;AAsBO,SAAS,YAAY,OAA+B;AACzD,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,cAAc,eAAe,QAAQ,eAAe;AAC1D,iBAAe,WAAW,eAAe;AAEzC,SAAO,gBAAgB;AACzB;AAwBO,IAAM,6BAA+C;AAAA,EAC1D,SAAS;AAAA,EACT,SAAS;AAAA,EACT,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AACF;;;ACxCA,eAAsB,kBACpB,SAC2E;AAC3E,MAAI;AAEF,UAAM,gBAAgB,MAAM,MAAM,mBAAmB;AAAA,MACnD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,QACf,UAAU,QAAQ;AAAA,QAClB,GAAI,QAAQ,UAAU,EAAE,UAAU,QAAQ,QAAQ,IAAI,CAAC;AAAA,MACzD,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,YAAY,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC7D,YAAM,OAAe,WAAW,qBAAqB,WAAW,WAAW;AAG3E,UAAI,cAAc,WAAW,OAAO,WAAW,qBAAqB;AAClE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,qBAAqB;AAAA,UACrB,kBAAkB,UAAU;AAAA,QAC9B;AAAA,MACF;AAEA,UAAI,cAAc,WAAW,OAAO,gBAAgB,KAAK,IAAI,GAAG;AAC9D,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,cAAc;AAAA,QAChB;AAAA,MACF;AAEA,UAAI,cAAc,WAAW,OAAO,oBAAoB,KAAK,IAAI,GAAG;AAClE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,cAAc;AAAA,QAChB;AAAA,MACF;AAEA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,QACP,mBAAmB,QAAQ;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,MAAM,cAAc,KAAK;AAGlD,WAAO,EAAE,SAAS,MAAM,aAAa;AAAA,EACvC,SAAS,OAAO;AACd,YAAQ,MAAM,gBAAgB,KAAK;AACnC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAkBA,eAAsB,2BACpB,SAKsB;AACtB,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,mCAAmC;AAAA,MAC9D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,QACf,YAAY,QAAQ;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACxD,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,QACP,mBAAmB,UAAU,qBAAqB;AAAA,MACpD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,aAAa,KAAK;AAAA,IACpB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAWA,eAAsB,2BACpB,aACqD;AACrD,SAAO,EAAE,SAAS,MAAM,cAAc,YAAY;AACpD;AAQA,eAAsB,iBACpB,aACA,cAC+B;AAC/B,MAAI;AACF,UAAM,MAAM,+BAA+B;AAAA,MACzC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,cAAc;AAAA,QACd,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACF;AA4BA,eAAsB,OAAO,SAIX;AAEhB,MAAI,SAAS,YAAY,SAAS,QAAQ;AACxC,QAAI;AACF,YAAM,MAAM,GAAG,QAAQ,MAAM,4BAA4B,mBAAmB,QAAQ,QAAQ,CAAC,IAAI;AAAA,QAC/F,QAAQ;AAAA,QACR,aAAa;AAAA;AAAA,MACf,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,cAAQ,KAAK,qDAAqD,GAAG;AAAA,IAEvE;AAAA,EACF;AAGA,QAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,iBAAiB;AAGlD,QAAMA,SAAQ;AAAA,IACZ,aAAa,SAAS,eAAe;AAAA,IACrC,UAAU;AAAA,EACZ,CAAC;AACH;AAwBA,eAAsB,iBAAiB,QAAgB,aAAqC;AAC1F,QAAM,cAAc,eAAe,OAAO,SAAS;AAInD,QAAM,mBAAmB,GAAG,MAAM,6BAA6B,mBAAmB,WAAW,CAAC;AAI9F,MAAI;AAEF,UAAM,eAAe,MAAM,MAAM,gBAAgB;AACjD,UAAM,EAAE,UAAU,IAAI,MAAM,aAAa,KAAK;AAG9C,UAAM,kBAAkB,MAAM,MAAM,qBAAqB;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB;AAAA,QACA,MAAM;AAAA,MACR,CAAC;AAAA,MACD,aAAa;AAAA,IACf,CAAC;AAGD,YAAQ,IAAI,wCAAwC,gBAAgB,MAAM;AAAA,EAC5E,SAAS,KAAK;AACZ,YAAQ,KAAK,8CAA8C,GAAG;AAAA,EAChE;AAIA,UAAQ,IAAI,4CAA4C,gBAAgB;AACxE,SAAO,SAAS,OAAO;AACzB;","names":["import_react","import_react","import_react","signOut"]}
+{"version":3,"sources":["../../src/client/index.ts","../../src/client/hooks.ts","../../src/client/components.tsx","../../src/utils/hosted-auth.ts","../../src/client/auth.ts"],"sourcesContent":["// Client-side exports\n\n// Re-export commonly used next-auth/react functions\nexport { signIn, signOut, useSession, SessionProvider } from 'next-auth/react';\nexport type { Session } from 'next-auth';\nexport {\n  useOAuth42Session,\n  useOAuth42User,\n  useOAuth42Tokens,\n  useRequireAuth,\n} from './hooks';\n\nexport type {\n  OAuth42Session,\n  UseOAuth42SessionReturn,\n} from './hooks';\n\nexport {\n  SignInButton,\n  SignOutButton,\n  UserProfile,\n  AuthStatus,\n  ProtectedComponent,\n} from './components';\n\nexport type {\n  SignInButtonProps,\n  SignOutButtonProps,\n  UserProfileProps,\n  AuthStatusProps,\n  ProtectedComponentProps,\n} from './components';\n\n// Hosted auth utilities\nexport {\n  redirectToHostedAuth,\n  verifyState,\n  DEFAULT_HOSTED_AUTH_CONFIG,\n} from '../utils/hosted-auth';\n\nexport type {\n  HostedAuthOptions,\n  HostedAuthConfig,\n} from '../utils/hosted-auth';\n\n// Custom authentication utilities\nexport {\n  loginWithPassword,\n  initiateAuthenticatorLogin,\n  completeAuthenticatorLogin,\n  simulateApproval,\n  logout,\n  logoutEverywhere,\n} from './auth';\n\nexport type {\n  LoginWithPasswordOptions,\n  LoginWithAuthenticatorOptions,\n  AuthError,\n} from './auth';","import { useSession, signIn, signOut } from 'next-auth/react';\nimport { useCallback, useEffect, useState } from 'react';\n\nexport type OAuth42Session<E extends object = Record<string, unknown>> = ({\n  user?: {\n    email?: string | null;\n    name?: string | null;\n    image?: string | null;\n    username?: string;\n    emailVerified?: boolean;\n  };\n  accessToken?: string;\n  idToken?: string;\n  expires?: string;\n}) & E;\n\nexport interface UseOAuth42SessionReturn<E extends object = Record<string, unknown>> {\n  session: OAuth42Session<E> | null;\n  loading: boolean;\n  error: Error | null;\n  isAuthenticated: boolean;\n  signIn: () => Promise<void>;\n  signOut: () => Promise<void>;\n}\n\n/**\n * Hook to manage OAuth42 session with optional extra fields\n */\nexport function useOAuth42Session<E extends object = Record<string, unknown>>(): UseOAuth42SessionReturn<E> {\n  const { data: session, status } = useSession();\n  const [error, setError] = useState<Error | null>(null);\n  \n  const handleSignIn = useCallback(async () => {\n    try {\n      setError(null);\n      await signIn('oauth42');\n    } catch (err) {\n      setError(err as Error);\n    }\n  }, []);\n  \n  const handleSignOut = useCallback(async () => {\n    try {\n      setError(null);\n      await signOut();\n    } catch (err) {\n      setError(err as Error);\n    }\n  }, []);\n  \n  return {\n    session: session as unknown as OAuth42Session<E> | null,\n    loading: status === 'loading',\n    error,\n    isAuthenticated: status === 'authenticated',\n    signIn: handleSignIn,\n    signOut: handleSignOut,\n  };\n}\n\n/**\n * Hook to get the current OAuth42 user\n */\nexport function useOAuth42User<E extends object = Record<string, unknown>>() {\n  const { session, isAuthenticated } = useOAuth42Session<E>();\n  \n  return {\n    user: isAuthenticated ? session?.user : null,\n    isAuthenticated,\n  };\n}\n\n/**\n * Hook to manage OAuth42 tokens\n */\nexport function useOAuth42Tokens<E extends object = Record<string, unknown>>() {\n  const { session } = useOAuth42Session<E>();\n  const [isExpired, setIsExpired] = useState(false);\n  \n  useEffect(() => {\n    if (session?.expires) {\n      const expiryTime = new Date(session.expires).getTime();\n      const now = Date.now();\n      setIsExpired(now >= expiryTime);\n      \n      // Set a timer to update expiry status\n      const timeUntilExpiry = expiryTime - now;\n      if (timeUntilExpiry > 0) {\n        const timer = setTimeout(() => {\n          setIsExpired(true);\n        }, timeUntilExpiry);\n        \n        return () => clearTimeout(timer);\n      }\n    }\n  }, [session?.expires]);\n  \n  return {\n    accessToken: session?.accessToken,\n    idToken: session?.idToken,\n    isExpired,\n    refreshToken: async () => {\n      // Trigger a session refresh\n      await signIn('oauth42');\n    },\n  };\n}\n\n/**\n * Hook for protected routes\n */\nexport function useRequireAuth(redirectTo: string = '/auth/signin') {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  const [isRedirecting, setIsRedirecting] = useState(false);\n  \n  useEffect(() => {\n    if (!loading && !isAuthenticated && !isRedirecting) {\n      setIsRedirecting(true);\n      if (typeof window !== 'undefined') {\n        window.location.href = redirectTo;\n      }\n    }\n  }, [isAuthenticated, loading, redirectTo, isRedirecting]);\n  \n  return {\n    isAuthenticated,\n    loading: loading || isRedirecting,\n  };\n}\n","import React from 'react';\nimport { signIn, signOut } from 'next-auth/react';\nimport { useOAuth42Session, useOAuth42User } from './hooks';\n\nexport interface SignInButtonProps {\n  children?: React.ReactNode;\n  className?: string;\n  callbackUrl?: string;\n  onClick?: () => void;\n}\n\n/**\n * Sign in button component\n */\nexport function SignInButton({ \n  children = 'Sign in with OAuth42', \n  className = '',\n  callbackUrl = '/',\n  onClick\n}: SignInButtonProps) {\n  const handleClick = async () => {\n    if (onClick) onClick();\n    await signIn('oauth42', { callbackUrl });\n  };\n  \n  return (\n    <button\n      onClick={handleClick}\n      className={className}\n      type=\"button\"\n    >\n      {children}\n    </button>\n  );\n}\n\nexport interface SignOutButtonProps {\n  children?: React.ReactNode;\n  className?: string;\n  callbackUrl?: string;\n  onClick?: () => void;\n}\n\n/**\n * Sign out button component\n */\nexport function SignOutButton({ \n  children = 'Sign out', \n  className = '',\n  callbackUrl = '/',\n  onClick\n}: SignOutButtonProps) {\n  const handleClick = async () => {\n    if (onClick) onClick();\n    await signOut({ callbackUrl });\n  };\n  \n  return (\n    <button\n      onClick={handleClick}\n      className={className}\n      type=\"button\"\n    >\n      {children}\n    </button>\n  );\n}\n\nexport interface UserProfileProps {\n  className?: string;\n  showEmail?: boolean;\n  showName?: boolean;\n  showImage?: boolean;\n  loadingComponent?: React.ReactNode;\n  notAuthenticatedComponent?: React.ReactNode;\n}\n\n/**\n * User profile display component\n */\nexport function UserProfile({\n  className = '',\n  showEmail = true,\n  showName = true,\n  showImage = true,\n  loadingComponent = <div>Loading...</div>,\n  notAuthenticatedComponent = <div>Not authenticated</div>,\n}: UserProfileProps) {\n  const { session, loading, isAuthenticated } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  if (!isAuthenticated || !session?.user) {\n    return <>{notAuthenticatedComponent}</>;\n  }\n  \n  const { user } = session;\n  \n  return (\n    <div className={className}>\n      {showImage && user.image && (\n        <img \n          src={user.image} \n          alt={user.name || 'User'} \n          style={{ width: 50, height: 50, borderRadius: '50%' }}\n        />\n      )}\n      {showName && user.name && <div>{user.name}</div>}\n      {showEmail && user.email && <div>{user.email}</div>}\n    </div>\n  );\n}\n\nexport interface AuthStatusProps {\n  authenticatedComponent?: React.ReactNode;\n  unauthenticatedComponent?: React.ReactNode;\n  loadingComponent?: React.ReactNode;\n}\n\n/**\n * Conditional rendering based on auth status\n */\nexport function AuthStatus({\n  authenticatedComponent,\n  unauthenticatedComponent,\n  loadingComponent = <div>Loading...</div>,\n}: AuthStatusProps) {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  return <>{isAuthenticated ? authenticatedComponent : unauthenticatedComponent}</>;\n}\n\nexport interface ProtectedComponentProps {\n  children: React.ReactNode;\n  fallback?: React.ReactNode;\n  loadingComponent?: React.ReactNode;\n}\n\n/**\n * Wrapper component for protected content\n */\nexport function ProtectedComponent({\n  children,\n  fallback = <SignInButton />,\n  loadingComponent = <div>Loading...</div>,\n}: ProtectedComponentProps) {\n  const { isAuthenticated, loading } = useOAuth42Session();\n  \n  if (loading) {\n    return <>{loadingComponent}</>;\n  }\n  \n  if (!isAuthenticated) {\n    return <>{fallback}</>;\n  }\n  \n  return <>{children}</>;\n}","/**\n * Utilities for OAuth42 Hosted Authentication\n */\n\nexport interface HostedAuthOptions {\n  /** OAuth2 client ID */\n  clientId: string;\n  /** Redirect URI after authentication */\n  redirectUri: string;\n  /** OAuth2 scopes (space-separated) */\n  scope?: string;\n  /** OAuth2 state parameter for CSRF protection */\n  state?: string;\n  /** Base URL for OAuth42 issuer/API (defaults to production) */\n  issuer?: string;\n}\n\n/**\n * Generate a random state parameter for CSRF protection\n */\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Redirect to OAuth42 hosted authentication pages\n *\n * @example\n * ```ts\n * import { redirectToHostedAuth } from '@oauth42/next/client';\n *\n * function LoginButton() {\n *   return (\n *     <button onClick={() => redirectToHostedAuth({\n *       clientId: process.env.NEXT_PUBLIC_OAUTH42_CLIENT_ID!,\n *       redirectUri: `${window.location.origin}/api/auth/callback`,\n *     })}>\n *       Sign in with OAuth42\n *     </button>\n *   );\n * }\n * ```\n */\nexport function redirectToHostedAuth(options: HostedAuthOptions): void {\n  const {\n    clientId,\n    redirectUri,\n    scope = 'openid profile email',\n    state = generateState(),\n    issuer = 'https://api.oauth42.com',\n  } = options;\n\n  const params = new URLSearchParams({\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    response_type: 'code',\n    scope,\n    state,\n  });\n\n  // Redirect to the backend's authorize endpoint, which handles the OAuth flow\n  // and redirects to hosted auth login if user is not authenticated\n  const authUrl = `${issuer}/oauth2/authorize?${params.toString()}`;\n\n  // Store state in sessionStorage for verification on callback\n  if (typeof window !== 'undefined') {\n    sessionStorage.setItem('oauth42_state', state);\n    window.location.href = authUrl;\n  }\n}\n\n/**\n * Verify state parameter on OAuth2 callback\n * Call this in your callback page to verify the state matches\n *\n * @example\n * ```ts\n * import { verifyState } from '@oauth42/next/client';\n *\n * export default function CallbackPage() {\n *   const searchParams = useSearchParams();\n *   const state = searchParams.get('state');\n *\n *   if (!verifyState(state)) {\n *     return <div>Invalid state parameter</div>;\n *   }\n *\n *   // Continue with token exchange...\n * }\n * ```\n */\nexport function verifyState(state: string | null): boolean {\n  if (typeof window === 'undefined') return false;\n  if (!state) return false;\n\n  const storedState = sessionStorage.getItem('oauth42_state');\n  sessionStorage.removeItem('oauth42_state');\n\n  return storedState === state;\n}\n\n/**\n * Configuration for hosted authentication\n */\nexport interface HostedAuthConfig {\n  /** Enable hosted authentication */\n  enabled: boolean;\n  /** Base URL for hosted auth pages (optional, defaults to production) */\n  baseUrl?: string;\n  /** Feature flags for hosted auth */\n  features?: {\n    /** Allow user signup */\n    signup?: boolean;\n    /** Allow social login */\n    socialLogin?: boolean;\n    /** Allow password reset */\n    passwordReset?: boolean;\n  };\n}\n\n/**\n * Default hosted auth configuration\n */\nexport const DEFAULT_HOSTED_AUTH_CONFIG: HostedAuthConfig = {\n  enabled: true,\n  baseUrl: 'https://auth.oauth42.com',\n  features: {\n    signup: true,\n    socialLogin: false,\n    passwordReset: true,\n  },\n};\n","/**\n * OAuth42 Custom Authentication Utilities\n *\n * Provides functions for implementing custom login UIs in customer apps\n * while properly handling OAuth2 PKCE flows and next-auth integration.\n */\n\nimport { signIn } from 'next-auth/react';\n\n// PKCE utilities\nfunction base64URLEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.byteLength; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '');\n}\n\nasync function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64URLEncode(array.buffer);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const hash = await crypto.subtle.digest('SHA-256', data);\n  return base64URLEncode(hash);\n}\n\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64URLEncode(array.buffer);\n}\n\nexport interface LoginWithPasswordOptions {\n  email: string;\n  password: string;\n  mfaCode?: string;\n  /**\n   * URL to redirect to after successful authentication.\n   * If not provided, will redirect to '/'\n   */\n  callbackUrl?: string;\n}\n\nexport interface LoginWithAuthenticatorOptions {\n  email: string;\n  sessionId: string;\n  /**\n   * URL to redirect to after successful authentication.\n   * If not provided, will redirect to '/'\n   */\n  callbackUrl?: string;\n}\n\nexport interface AuthError {\n  error: string;\n  error_description?: string;\n  requires_enrollment?: boolean;\n  enrollment_token?: string;\n  requires_mfa?: boolean;\n  mfa_methods?: string[];\n  email_otp_sent?: boolean;\n  email_otp_email?: string;\n  email_otp_rate_limited?: boolean;\n  phone_mfa_sent?: boolean;\n  phone_mfa_number?: string;\n  phone_mfa_method?: 'sms' | 'voice';\n  phone_mfa_rate_limited?: boolean;\n  phone_mfa_unavailable?: boolean;\n}\n\n/**\n * Authenticate with email/password and complete OAuth PKCE flow\n *\n * This function handles the full authentication flow:\n * 1. Authenticates with the backend using credentials\n * 2. Uses the access token to authorize the OAuth client\n * 3. Exchanges authorization code for tokens via next-auth\n *\n * @example\n * ```tsx\n * const result = await loginWithPassword({\n *   email: 'user@example.com',\n *   password: 'password123',\n *   callbackUrl: '/dashboard'\n * });\n *\n * if (result.success) {\n *   // User is authenticated, next-auth session is set\n * } else if (result.requires_mfa) {\n *   // Prompt for MFA code and call again with mfaCode\n * }\n * ```\n */\nexport async function loginWithPassword(\n  options: LoginWithPasswordOptions\n): Promise<{ success: boolean; access_token?: string } & Partial<AuthError>> {\n  try {\n    // Step 1: Authenticate with backend to get access token\n    const loginResponse = await fetch('/api/auth/login', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        email: options.email,\n        password: options.password,\n        ...(options.mfaCode ? { mfa_code: options.mfaCode } : {}),\n      }),\n    });\n\n    if (!loginResponse.ok) {\n      const errorData = await loginResponse.json().catch(() => ({}));\n      const desc: string = errorData?.error_description || errorData?.message || '';\n\n      // Handle special cases\n      if (loginResponse.status === 403 && errorData?.requires_enrollment) {\n        return {\n          success: false,\n          error: 'enrollment_required',\n          error_description: 'MFA enrollment required',\n          requires_enrollment: true,\n          enrollment_token: errorData.enrollment_token,\n        };\n      }\n\n      if (loginResponse.status === 403 && /mfa required/i.test(desc)) {\n        return {\n          success: false,\n          error: 'mfa_required',\n          error_description: 'MFA code required',\n          requires_mfa: true,\n          mfa_methods: errorData?.mfa_methods,\n          email_otp_sent: errorData?.email_otp_sent,\n          email_otp_email: errorData?.email_otp_email,\n          email_otp_rate_limited: errorData?.email_otp_rate_limited,\n          phone_mfa_sent: errorData?.phone_mfa_sent,\n          phone_mfa_number: errorData?.phone_mfa_number,\n          phone_mfa_method: errorData?.phone_mfa_method,\n          phone_mfa_rate_limited: errorData?.phone_mfa_rate_limited,\n          phone_mfa_unavailable: errorData?.phone_mfa_unavailable,\n        };\n      }\n\n      if (loginResponse.status === 401 && /invalid mfa code/i.test(desc)) {\n        return {\n          success: false,\n          error: 'invalid_mfa_code',\n          error_description: 'Invalid MFA code',\n          requires_mfa: true,\n        };\n      }\n\n      return {\n        success: false,\n        error: 'authentication_failed',\n        error_description: desc || 'Invalid credentials',\n      };\n    }\n\n    const { access_token } = await loginResponse.json();\n\n    // Return access token for the application to use in OAuth authorize flow\n    return { success: true, access_token };\n  } catch (error) {\n    console.error('Login error:', error);\n    return {\n      success: false,\n      error: 'network_error',\n      error_description: 'Failed to connect to authentication server',\n    };\n  }\n}\n\n/**\n * Initiate authenticator (passwordless) login and return challenge code\n *\n * @example\n * ```tsx\n * const result = await initiateAuthenticatorLogin({\n *   email: 'user@example.com',\n *   sessionId: crypto.randomUUID()\n * });\n *\n * if (result.success) {\n *   // Display result.challengeCode to user\n *   // Wait for WebSocket approval or poll for completion\n * }\n * ```\n */\nexport async function initiateAuthenticatorLogin(\n  options: LoginWithAuthenticatorOptions\n): Promise<{\n  success: boolean;\n  challengeCode?: string;\n  challengeId?: string;\n} & Partial<AuthError>> {\n  try {\n    const response = await fetch('/api/auth/passwordless/initiate', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        email: options.email,\n        session_id: options.sessionId,\n      }),\n    });\n\n    if (!response.ok) {\n      const errorData = await response.json().catch(() => ({}));\n      return {\n        success: false,\n        error: 'initiation_failed',\n        error_description: errorData.error_description || 'Failed to create challenge',\n      };\n    }\n\n    const data = await response.json();\n\n    return {\n      success: true,\n      challengeCode: data.challenge_code,\n      challengeId: data.challenge_id,\n    };\n  } catch (error) {\n    console.error('Authenticator login error:', error);\n    return {\n      success: false,\n      error: 'network_error',\n      error_description: 'Failed to connect to authentication server',\n    };\n  }\n}\n\n/**\n * Complete authenticator login after approval\n *\n * Call this after receiving approval notification via WebSocket\n * or after the user has approved on their mobile device.\n * Returns the access token for the application to use in OAuth authorize flow.\n *\n * @param accessToken - Access token received from approval payload\n */\nexport async function completeAuthenticatorLogin(\n  accessToken: string\n): Promise<{ success: boolean; access_token: string }> {\n  return { success: true, access_token: accessToken };\n}\n\n/**\n * Simulate approval for testing (development only)\n *\n * @param challengeId - The challenge ID to approve\n * @param selectedCode - The code that was displayed to the user\n */\nexport async function simulateApproval(\n  challengeId: string,\n  selectedCode: string\n): Promise<{ success: boolean }> {\n  try {\n    await fetch('/api/auth/challenge/approve', {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        challenge_id: challengeId,\n        selected_code: selectedCode,\n      }),\n    });\n\n    return { success: true };\n  } catch (error) {\n    console.error('Simulated approval failed:', error);\n    return { success: false };\n  }\n}\n\n/**\n * Logout the current user from the app only (app-level logout)\n *\n * This clears the next-auth session for this app AND removes the app-user\n * mapping from the session registry. On next login, the user will see\n * the account picker to choose which account to use.\n *\n * For provider-level logout (sign out of all apps), use logoutEverywhere().\n *\n * @param options.callbackUrl - URL to redirect to after logout (default: '/')\n * @param options.clientId - OAuth client ID to clear from registry\n * @param options.issuer - OAuth42 issuer URL for the logout endpoint\n *\n * @example\n * ```tsx\n * import { logout } from '@oauth42/next/client';\n *\n * const handleLogout = async () => {\n *   await logout({\n *     callbackUrl: '/login',\n *     clientId: process.env.NEXT_PUBLIC_OAUTH42_CLIENT_ID,\n *     issuer: process.env.NEXT_PUBLIC_OAUTH_ISSUER || 'https://localhost:8443'\n *   });\n * };\n * ```\n */\nexport async function logout(options?: {\n  callbackUrl?: string;\n  clientId?: string;\n  issuer?: string;\n}): Promise<void> {\n  // If clientId and issuer provided, call backend to clear app_user from registry\n  if (options?.clientId && options?.issuer) {\n    try {\n      await fetch(`${options.issuer}/oauth2/logout?client_id=${encodeURIComponent(options.clientId)}`, {\n        method: 'POST',\n        credentials: 'include', // Include cookies (registry cookie)\n      });\n    } catch (err) {\n      console.warn('[OAuth42] Failed to clear app user from registry:', err);\n      // Continue with NextAuth signOut even if this fails\n    }\n  }\n\n  // Import signOut from next-auth/react\n  const { signOut } = await import('next-auth/react');\n\n  // Clear next-auth session (app-level only)\n  await signOut({\n    callbackUrl: options?.callbackUrl || '/',\n    redirect: true\n  });\n}\n\n/**\n * Logout the current user from ALL apps using OAuth42 (provider-level logout)\n *\n * This redirects to the OAuth42 provider's logout endpoint to clear the\n * oauth42_session cookie, effectively logging the user out of all apps.\n *\n * Use this when testing fresh login flows or when the user explicitly\n * wants to sign out of everything.\n *\n * @param issuer - The OAuth42 issuer URL (e.g., 'https://localhost:8443')\n * @param callbackUrl - URL to redirect to after logout (default: current origin)\n *\n * @example\n * ```tsx\n * import { logoutEverywhere } from '@oauth42/next/client';\n *\n * const handleLogoutEverywhere = () => {\n *   const issuer = process.env.NEXT_PUBLIC_OAUTH42_ISSUER || 'https://localhost:8443';\n *   logoutEverywhere(issuer, '/auth/signin');\n * };\n * ```\n */\nexport async function logoutEverywhere(issuer: string, callbackUrl?: string): Promise<void> {\n  const redirectUri = callbackUrl || window.location.origin;\n\n  // Build the final redirect URL - backend will clear oauth42_session, then redirect\n  // to NextAuth signout which will clear the app session cookie\n  const backendLogoutUrl = `${issuer}/auth/logout?redirect_uri=${encodeURIComponent(redirectUri)}`;\n\n  // First call NextAuth signout to clear the app session cookie\n  // Then redirect to backend to clear the oauth42_session cookie\n  try {\n    // Get CSRF token from NextAuth\n    const csrfResponse = await fetch('/api/auth/csrf');\n    const { csrfToken } = await csrfResponse.json();\n\n    // Call NextAuth signOut endpoint to clear session - wait for it to complete\n    const signoutResponse = await fetch('/api/auth/signout', {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        csrfToken,\n        json: 'true',\n      }),\n      credentials: 'include',\n    });\n\n    // Log response for debugging\n    console.log('[OAuth42] NextAuth signout response:', signoutResponse.status);\n  } catch (err) {\n    console.warn('[OAuth42] Failed to call NextAuth signout:', err);\n  }\n\n  // Now redirect to OAuth42 provider logout endpoint\n  // This clears the oauth42_session cookie and redirects back to the app\n  console.log('[OAuth42] Redirecting to backend logout:', backendLogoutUrl);\n  window.location.href = backendLogoutUrl;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,IAAAA,gBAA6D;;;ACH7D,mBAA4C;AAC5C,IAAAC,gBAAiD;AA2B1C,SAAS,oBAA4F;AAC1G,QAAM,EAAE,MAAM,SAAS,OAAO,QAAI,yBAAW;AAC7C,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAuB,IAAI;AAErD,QAAM,mBAAe,2BAAY,YAAY;AAC3C,QAAI;AACF,eAAS,IAAI;AACb,gBAAM,qBAAO,SAAS;AAAA,IACxB,SAAS,KAAK;AACZ,eAAS,GAAY;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,oBAAgB,2BAAY,YAAY;AAC5C,QAAI;AACF,eAAS,IAAI;AACb,gBAAM,sBAAQ;AAAA,IAChB,SAAS,KAAK;AACZ,eAAS,GAAY;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,iBAAiB,WAAW;AAAA,IAC5B,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACF;AAKO,SAAS,iBAA6D;AAC3E,QAAM,EAAE,SAAS,gBAAgB,IAAI,kBAAqB;AAE1D,SAAO;AAAA,IACL,MAAM,kBAAkB,SAAS,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAKO,SAAS,mBAA+D;AAC7E,QAAM,EAAE,QAAQ,IAAI,kBAAqB;AACzC,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,KAAK;AAEhD,+BAAU,MAAM;AACd,QAAI,SAAS,SAAS;AACpB,YAAM,aAAa,IAAI,KAAK,QAAQ,OAAO,EAAE,QAAQ;AACrD,YAAM,MAAM,KAAK,IAAI;AACrB,mBAAa,OAAO,UAAU;AAG9B,YAAM,kBAAkB,aAAa;AACrC,UAAI,kBAAkB,GAAG;AACvB,cAAM,QAAQ,WAAW,MAAM;AAC7B,uBAAa,IAAI;AAAA,QACnB,GAAG,eAAe;AAElB,eAAO,MAAM,aAAa,KAAK;AAAA,MACjC;AAAA,IACF;AAAA,EACF,GAAG,CAAC,SAAS,OAAO,CAAC;AAErB,SAAO;AAAA,IACL,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,cAAc,YAAY;AAExB,gBAAM,qBAAO,SAAS;AAAA,IACxB;AAAA,EACF;AACF;AAKO,SAAS,eAAe,aAAqB,gBAAgB;AAClE,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AACvD,QAAM,CAAC,eAAe,gBAAgB,QAAI,wBAAS,KAAK;AAExD,+BAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,eAAe;AAClD,uBAAiB,IAAI;AACrB,UAAI,OAAO,WAAW,aAAa;AACjC,eAAO,SAAS,OAAO;AAAA,MACzB;AAAA,IACF;AAAA,EACF,GAAG,CAAC,iBAAiB,SAAS,YAAY,aAAa,CAAC;AAExD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,EACtB;AACF;;;AC/HA,IAAAC,gBAAgC;AAyB5B;AAZG,SAAS,aAAa;AAAA,EAC3B,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,cAAc;AAAA,EACd;AACF,GAAsB;AACpB,QAAM,cAAc,YAAY;AAC9B,QAAI,QAAS,SAAQ;AACrB,cAAM,sBAAO,WAAW,EAAE,YAAY,CAAC;AAAA,EACzC;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS;AAAA,MACT;AAAA,MACA,MAAK;AAAA,MAEJ;AAAA;AAAA,EACH;AAEJ;AAYO,SAAS,cAAc;AAAA,EAC5B,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,cAAc;AAAA,EACd;AACF,GAAuB;AACrB,QAAM,cAAc,YAAY;AAC9B,QAAI,QAAS,SAAQ;AACrB,cAAM,uBAAQ,EAAE,YAAY,CAAC;AAAA,EAC/B;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAS;AAAA,MACT;AAAA,MACA,MAAK;AAAA,MAEJ;AAAA;AAAA,EACH;AAEJ;AAcO,SAAS,YAAY;AAAA,EAC1B,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,mBAAmB,4CAAC,SAAI,wBAAU;AAAA,EAClC,4BAA4B,4CAAC,SAAI,+BAAiB;AACpD,GAAqB;AACnB,QAAM,EAAE,SAAS,SAAS,gBAAgB,IAAI,kBAAkB;AAEhE,MAAI,SAAS;AACX,WAAO,2EAAG,4BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,mBAAmB,CAAC,SAAS,MAAM;AACtC,WAAO,2EAAG,qCAA0B;AAAA,EACtC;AAEA,QAAM,EAAE,KAAK,IAAI;AAEjB,SACE,6CAAC,SAAI,WACF;AAAA,iBAAa,KAAK,SACjB;AAAA,MAAC;AAAA;AAAA,QACC,KAAK,KAAK;AAAA,QACV,KAAK,KAAK,QAAQ;AAAA,QAClB,OAAO,EAAE,OAAO,IAAI,QAAQ,IAAI,cAAc,MAAM;AAAA;AAAA,IACtD;AAAA,IAED,YAAY,KAAK,QAAQ,4CAAC,SAAK,eAAK,MAAK;AAAA,IACzC,aAAa,KAAK,SAAS,4CAAC,SAAK,eAAK,OAAM;AAAA,KAC/C;AAEJ;AAWO,SAAS,WAAW;AAAA,EACzB;AAAA,EACA;AAAA,EACA,mBAAmB,4CAAC,SAAI,wBAAU;AACpC,GAAoB;AAClB,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AAEvD,MAAI,SAAS;AACX,WAAO,2EAAG,4BAAiB;AAAA,EAC7B;AAEA,SAAO,2EAAG,4BAAkB,yBAAyB,0BAAyB;AAChF;AAWO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,WAAW,4CAAC,gBAAa;AAAA,EACzB,mBAAmB,4CAAC,SAAI,wBAAU;AACpC,GAA4B;AAC1B,QAAM,EAAE,iBAAiB,QAAQ,IAAI,kBAAkB;AAEvD,MAAI,SAAS;AACX,WAAO,2EAAG,4BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,iBAAiB;AACpB,WAAO,2EAAG,oBAAS;AAAA,EACrB;AAEA,SAAO,2EAAG,UAAS;AACrB;;;AC/IA,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,UAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC9E;AAqBO,SAAS,qBAAqB,SAAkC;AACrE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ,cAAc;AAAA,IACtB,SAAS;AAAA,EACX,IAAI;AAEJ,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe;AAAA,IACf;AAAA,IACA;AAAA,EACF,CAAC;AAID,QAAM,UAAU,GAAG,MAAM,qBAAqB,OAAO,SAAS,CAAC;AAG/D,MAAI,OAAO,WAAW,aAAa;AACjC,mBAAe,QAAQ,iBAAiB,KAAK;AAC7C,WAAO,SAAS,OAAO;AAAA,EACzB;AACF;AAsBO,SAAS,YAAY,OAA+B;AACzD,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,cAAc,eAAe,QAAQ,eAAe;AAC1D,iBAAe,WAAW,eAAe;AAEzC,SAAO,gBAAgB;AACzB;AAwBO,IAAM,6BAA+C;AAAA,EAC1D,SAAS;AAAA,EACT,SAAS;AAAA,EACT,UAAU;AAAA,IACR,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AACF;;;AC/BA,eAAsB,kBACpB,SAC2E;AAC3E,MAAI;AAEF,UAAM,gBAAgB,MAAM,MAAM,mBAAmB;AAAA,MACnD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,QACf,UAAU,QAAQ;AAAA,QAClB,GAAI,QAAQ,UAAU,EAAE,UAAU,QAAQ,QAAQ,IAAI,CAAC;AAAA,MACzD,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,YAAY,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC7D,YAAM,OAAe,WAAW,qBAAqB,WAAW,WAAW;AAG3E,UAAI,cAAc,WAAW,OAAO,WAAW,qBAAqB;AAClE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,qBAAqB;AAAA,UACrB,kBAAkB,UAAU;AAAA,QAC9B;AAAA,MACF;AAEA,UAAI,cAAc,WAAW,OAAO,gBAAgB,KAAK,IAAI,GAAG;AAC9D,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,cAAc;AAAA,UACd,aAAa,WAAW;AAAA,UACxB,gBAAgB,WAAW;AAAA,UAC3B,iBAAiB,WAAW;AAAA,UAC5B,wBAAwB,WAAW;AAAA,UACnC,gBAAgB,WAAW;AAAA,UAC3B,kBAAkB,WAAW;AAAA,UAC7B,kBAAkB,WAAW;AAAA,UAC7B,wBAAwB,WAAW;AAAA,UACnC,uBAAuB,WAAW;AAAA,QACpC;AAAA,MACF;AAEA,UAAI,cAAc,WAAW,OAAO,oBAAoB,KAAK,IAAI,GAAG;AAClE,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,mBAAmB;AAAA,UACnB,cAAc;AAAA,QAChB;AAAA,MACF;AAEA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,QACP,mBAAmB,QAAQ;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,MAAM,cAAc,KAAK;AAGlD,WAAO,EAAE,SAAS,MAAM,aAAa;AAAA,EACvC,SAAS,OAAO;AACd,YAAQ,MAAM,gBAAgB,KAAK;AACnC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAkBA,eAAsB,2BACpB,SAKsB;AACtB,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,mCAAmC;AAAA,MAC9D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,QACf,YAAY,QAAQ;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACxD,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,QACP,mBAAmB,UAAU,qBAAqB;AAAA,MACpD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,aAAa,KAAK;AAAA,IACpB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP,mBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAWA,eAAsB,2BACpB,aACqD;AACrD,SAAO,EAAE,SAAS,MAAM,cAAc,YAAY;AACpD;AAQA,eAAsB,iBACpB,aACA,cAC+B;AAC/B,MAAI;AACF,UAAM,MAAM,+BAA+B;AAAA,MACzC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,cAAc;AAAA,QACd,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,OAAO;AACd,YAAQ,MAAM,8BAA8B,KAAK;AACjD,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACF;AA4BA,eAAsB,OAAO,SAIX;AAEhB,MAAI,SAAS,YAAY,SAAS,QAAQ;AACxC,QAAI;AACF,YAAM,MAAM,GAAG,QAAQ,MAAM,4BAA4B,mBAAmB,QAAQ,QAAQ,CAAC,IAAI;AAAA,QAC/F,QAAQ;AAAA,QACR,aAAa;AAAA;AAAA,MACf,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,cAAQ,KAAK,qDAAqD,GAAG;AAAA,IAEvE;AAAA,EACF;AAGA,QAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,iBAAiB;AAGlD,QAAMA,SAAQ;AAAA,IACZ,aAAa,SAAS,eAAe;AAAA,IACrC,UAAU;AAAA,EACZ,CAAC;AACH;AAwBA,eAAsB,iBAAiB,QAAgB,aAAqC;AAC1F,QAAM,cAAc,eAAe,OAAO,SAAS;AAInD,QAAM,mBAAmB,GAAG,MAAM,6BAA6B,mBAAmB,WAAW,CAAC;AAI9F,MAAI;AAEF,UAAM,eAAe,MAAM,MAAM,gBAAgB;AACjD,UAAM,EAAE,UAAU,IAAI,MAAM,aAAa,KAAK;AAG9C,UAAM,kBAAkB,MAAM,MAAM,qBAAqB;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB;AAAA,QACA,MAAM;AAAA,MACR,CAAC;AAAA,MACD,aAAa;AAAA,IACf,CAAC;AAGD,YAAQ,IAAI,wCAAwC,gBAAgB,MAAM;AAAA,EAC5E,SAAS,KAAK;AACZ,YAAQ,KAAK,8CAA8C,GAAG;AAAA,EAChE;AAIA,UAAQ,IAAI,4CAA4C,gBAAgB;AACxE,SAAO,SAAS,OAAO;AACzB;","names":["import_react","import_react","import_react","signOut"]}

package/dist/client/index.mjs

@@ -253,7 +253,16 @@ async function loginWithPassword(options) {
           success: false,
           error: "mfa_required",
           error_description: "MFA code required",
-          requires_mfa: true
+          requires_mfa: true,
+          mfa_methods: errorData?.mfa_methods,
+          email_otp_sent: errorData?.email_otp_sent,
+          email_otp_email: errorData?.email_otp_email,
+          email_otp_rate_limited: errorData?.email_otp_rate_limited,
+          phone_mfa_sent: errorData?.phone_mfa_sent,
+          phone_mfa_number: errorData?.phone_mfa_number,
+          phone_mfa_method: errorData?.phone_mfa_method,
+          phone_mfa_rate_limited: errorData?.phone_mfa_rate_limited,
+          phone_mfa_unavailable: errorData?.phone_mfa_unavailable
         };
       }
       if (loginResponse.status === 401 && /invalid mfa code/i.test(desc)) {