@rixl/sdk 0.32.0 → 0.33.0

package/dist/index.js

@@ -2576,6 +2576,7 @@ const videosV1VideoServiceGetVideo = (options) => (options.client ?? client).get
 const GLOBAL_PREFIX = "__rixl_auth";
 /** OAuth state storage key prefix */
 const STATE_STORAGE_KEY_PREFIX = "__rixl_auth_state_";
+const PKCE_STORAGE_KEY_PREFIX = "__rixl_auth_pkce_";
 /** Social connect storage key prefix */
 const SOCIAL_CONNECT_KEY_PREFIX = "__rixl_auth_social_connect_";
 /** HTTP Status codes - only codes actually used in the library */
@@ -2592,7 +2593,7 @@ const HTTP_STATUS = {
 
 //#endregion
 //#region src/auth/state.ts
-const storagePath = (provider) => STATE_STORAGE_KEY_PREFIX + provider;
+const storagePath$1 = (provider) => STATE_STORAGE_KEY_PREFIX + provider;
 /**
 * Retrieves and validates the OAuth state from session storage
 * @param provider The provider identifier
@@ -2600,7 +2601,7 @@ const storagePath = (provider) => STATE_STORAGE_KEY_PREFIX + provider;
 * @returns True if the state is valid, false otherwise
 */
 function validateOAuthState(provider, state) {
-	return sessionStorage.getItem(storagePath(provider)) === state;
+	return sessionStorage.getItem(storagePath$1(provider)) === state;
 }
 /**
 * Discards the stored state for a provider so the next login round-trip mints a
@@ -2609,7 +2610,7 @@ function validateOAuthState(provider, state) {
 * @param provider The provider identifier
 */
 function clearOauthState(provider) {
-	sessionStorage.removeItem(storagePath(provider));
+	sessionStorage.removeItem(storagePath$1(provider));
 }
 /**
 * Gets or Generates a complete state parameter for OAuth requests
@@ -2617,11 +2618,11 @@ function clearOauthState(provider) {
 * @returns A state string containing the provider identifier and random data
 */
 function getOauthState(provider) {
-	return sessionStorage.getItem(storagePath(provider)) ?? generateOauthState(provider);
+	return sessionStorage.getItem(storagePath$1(provider)) ?? generateOauthState(provider);
 }
 function generateOauthState(provider) {
 	const state = `${provider}_${crypto.randomUUID()}`;
-	sessionStorage.setItem(storagePath(provider), state);
+	sessionStorage.setItem(storagePath$1(provider), state);
 	return state;
 }
 
@@ -2736,10 +2737,49 @@ const appleConfig = appleProvider.config;
 const appleAuthUrl = appleProvider.authUrl;
 const updateAppleAuthUrl = appleProvider.updateAuthUrl;
 
+//#endregion
+//#region src/auth/pkce.ts
+const storagePath = (provider) => PKCE_STORAGE_KEY_PREFIX + provider;
+const base64Url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+/**
+* Gets or generates the PKCE code verifier for a provider. It lives in session
+* storage so the callback page can send it with the authorization code.
+*/
+function getPkceVerifier(provider) {
+	const stored = sessionStorage.getItem(storagePath(provider));
+	if (stored) return stored;
+	const verifier = base64Url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
+	sessionStorage.setItem(storagePath(provider), verifier);
+	return verifier;
+}
+function clearPkceVerifier(provider) {
+	sessionStorage.removeItem(storagePath(provider));
+}
+/** The S256 code challenge for a verifier. */
+async function pkceChallenge(verifier) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return base64Url(new Uint8Array(digest));
+}
+
 //#endregion
 //#region src/auth/providers/telegram.ts
+const TELEGRAM_AUTH_URL = "https://oauth.telegram.org/auth";
 const telegramConfig = shared("provider.telegram.config", () => atom(null));
 const telegramAuthUrl = shared("provider.telegram.authUrl", () => atom(null));
+const telegramRedirectUri = (config) => config.redirectUri ?? window.location.origin;
+const legacyAuthUrl = (config) => `${TELEGRAM_AUTH_URL}?bot_id=${encodeURIComponent(config.botId)}&origin=${encodeURIComponent(window.location.origin)}&return_to=${encodeURIComponent(window.location.origin + location.pathname)}`;
+const oidcAuthUrl = async (config) => {
+	const params = new URLSearchParams({
+		client_id: config.botId,
+		redirect_uri: telegramRedirectUri(config),
+		response_type: "code",
+		scope: "openid profile",
+		state: getOauthState("telegram"),
+		code_challenge: await pkceChallenge(getPkceVerifier("telegram")),
+		code_challenge_method: "S256"
+	});
+	return `${TELEGRAM_AUTH_URL}?${params.toString()}`;
+};
 /**
 * Updates the Telegram authentication URL using the configured settings
 */
@@ -2750,9 +2790,22 @@ function updateTelegramAuthUrl() {
 		telegramAuthUrl.set(null);
 		return;
 	}
-	const url = `https://oauth.telegram.org/auth?bot_id=${encodeURIComponent(config.botId)}&origin=${encodeURIComponent(window.location.origin)}&return_to=${encodeURIComponent(window.location.origin + location.pathname)}`;
-	telegramAuthUrl.set(url);
+	if (!config.oidc) {
+		telegramAuthUrl.set(legacyAuthUrl(config));
+		return;
+	}
+	telegramAuthUrl.set(null);
+	oidcAuthUrl(config).then((url) => telegramAuthUrl.set(url));
 }
+/** The PKCE verifier and redirect URI the backend needs to redeem a Telegram authorization code. */
+const telegramCodeExchange = () => {
+	const config = telegramConfig.get();
+	if (!config) return void 0;
+	return {
+		codeVerifier: getPkceVerifier("telegram"),
+		redirectUri: telegramRedirectUri(config)
+	};
+};
 
 //#endregion
 //#region src/auth/url.ts
@@ -2783,10 +2836,10 @@ const OAUTH_PROVIDERS$1 = [
 */
 function detectProvider() {
 	if (urlParams.has("tgWebAppData")) return "tgWebAppData";
-	if (urlParams.has("tgAuthResult")) return "tgAuthResult";
-	const id_token = urlParams.get("id_token");
 	const state = urlParams.get("state");
-	if (id_token && state) {
+	if (urlParams.has("code") && state && validateOAuthState("telegram", state)) return "telegram";
+	if (urlParams.has("tgAuthResult")) return "tgAuthResult";
+	if (urlParams.get("id_token") && state) {
 		const providerFromState = extractProviderFromState(state);
 		return OAUTH_PROVIDERS$1.find((p) => providerFromState === p && validateOAuthState(p, state));
 	}
@@ -2798,6 +2851,7 @@ function detectProvider() {
 */
 function getProviderToken(provider) {
 	if (provider === "tgWebAppData" || provider === "tgAuthResult") return urlParams.get(provider) || void 0;
+	if (provider === "telegram") return urlParams.get("code") || void 0;
 	if (provider === "google" || provider === "apple" || provider === "microsoft") return urlParams.get("id_token") || void 0;
 }
 
@@ -2833,7 +2887,8 @@ const hasProviderResponse = () => CREDENTIAL_PARAMS.some((key) => urlParams.has(
 const AUTH_URL_UPDATERS = {
 	["google"]: updateGoogleAuthUrl,
 	["apple"]: updateAppleAuthUrl,
-	["microsoft"]: updateMicrosoftAuthUrl
+	["microsoft"]: updateMicrosoftAuthUrl,
+	["telegram"]: updateTelegramAuthUrl
 };
 /** Returns undefined when the half holds no credential, meaning it is the app's own and must not be touched. */
 const stripped = (query) => {
@@ -2869,6 +2924,7 @@ const completeOAuthCallback = () => {
 	const provider = detectProvider();
 	if (!provider) return;
 	clearOauthState(provider);
+	clearPkceVerifier(provider);
 	AUTH_URL_UPDATERS[provider]?.();
 	window.history.replaceState(window.history.state, "", withoutOAuthResponse(window.location.href));
 };
@@ -2981,30 +3037,31 @@ const logProviderExchangeFailure = (provider, credential, error) => {
 };
 
 //#endregion
-//#region src/auth/social/socialState.ts
-const socialStoragePath = (provider) => SOCIAL_CONNECT_KEY_PREFIX + provider;
-/**
-* Sets a flag indicating that a social provider connection is being attempted
-* @param provider The provider identifier
-*/
-function setSocialConnectAttempt(provider) {
-	sessionStorage.setItem(socialStoragePath(provider), "true");
-}
-/**
-* Checks if there's a pending social provider connection attempt
-* @param provider The provider identifier
-* @returns True if there's a pending connection attempt, false otherwise
-*/
-function hasSocialConnectAttempt(provider) {
-	return sessionStorage.getItem(socialStoragePath(provider)) === "true";
-}
+//#region src/auth/api/refresh-tokens.ts
 /**
-* Clears the social provider connection attempt flag
-* @param provider The provider identifier
+* Exchange a provider credential for a Rixl session, or refresh an existing
+* Rixl session with a Bearer refresh token.
+*
+* Both go to `/auth/v1/token`, which needs no session: `token_type` is the
+* `AuthProvider` value and `refresh_token` carries the stored refresh token or
+* the provider's `id_token` / Telegram payload. `/auth/v1/providers/connect`
+* links a provider to an already signed-in user, so it cannot sign anyone in.
 */
-function clearSocialConnectAttempt(provider) {
-	sessionStorage.removeItem(socialStoragePath(provider));
-}
+const refreshTokens = async (provider, token, options) => {
+	const body = {
+		token_type: provider,
+		refresh_token: token,
+		country_code: options?.countryCode,
+		origin: options?.origin,
+		code_verifier: options?.codeVerifier,
+		redirect_uri: options?.redirectUri
+	};
+	const { data } = await authV1TokenServiceRefreshToken({
+		body,
+		throwOnError: true
+	});
+	return data;
+};
 
 //#endregion
 //#region src/auth/initialization.ts
@@ -3035,254 +3092,6 @@ function createDeferred() {
 */
 const initDeferred = shared("initDeferred", createDeferred);
 
-//#endregion
-//#region src/auth/api/error-handlers.ts
-/**
-* Helper to create error functions - reduces bundle size by reusing error creation logic
-*/
-const err = (message) => () => new Error(message);
-/** Reusable error handlers for common cases - reduces repetitive error messages */
-const commonErrors = {
-	unauthorized: err("User is not authorized"),
-	badRequest: err("Bad request"),
-	notFound: err("Not found"),
-	conflict: err("Resource already exists"),
-	forbidden: err("Forbidden"),
-	tooManyRequests: err("Too many requests")
-};
-/**
-* Standard error handler for API errors with custom status code handling
-*/
-const handleApiError = (error, statusHandlers) => {
-	if (error instanceof ApiError) {
-		const handler = statusHandlers[error.status];
-		if (handler) throw new ApiError(handler().message, error.status, error.endpoint, error.data);
-		throw error;
-	}
-	throw error;
-};
-
-//#endregion
-//#region src/auth/api/utils.ts
-/**
-* Generic helper for API calls to handle initialization and error handling
-* @param fn The async function to execute
-* @param errorMap A map of status codes to error functions
-* @returns The result of the function execution
-*/
-const apiCall = async (fn, errorMap = {}) => {
-	await initDeferred.promise;
-	try {
-		return await fn();
-	} catch (error) {
-		return handleApiError(error, errorMap);
-	}
-};
-
-//#endregion
-//#region src/auth/api/tokens.ts
-function persistTokens(data) {
-	const tokens = data ?? {};
-	if (tokens.access_token && tokens.refresh_token && tokens.expires_in) {
-		setTokens(tokens.access_token, tokens.refresh_token, Number(tokens.expires_in));
-		return true;
-	}
-	return false;
-}
-
-//#endregion
-//#region src/auth/validation/base.ts
-/**
-* 🛡️ INPUT VALIDATION UTILITY
-* Validates data before API calls and throws user-friendly errors
-*/
-const validateInput = (schema, data) => {
-	try {
-		return v.parse(schema, data);
-	} catch (error) {
-		if (error instanceof v.ValiError) {
-			const firstError = error.issues[0];
-			throw new Error(firstError.message);
-		}
-		throw error;
-	}
-};
-const EmailSchema = v.pipe(v.string("Email must be text"), v.email("Please enter a valid email address"), v.minLength(1, "Email is required"));
-const PasswordSchema = v.pipe(v.string("Password must be text"), v.minLength(8, "Password must be at least 8 characters long"), v.regex(/[A-Z]/, "Password must contain at least one uppercase letter"), v.regex(/[a-z]/, "Password must contain at least one lowercase letter"), v.regex(/[0-9]/, "Password must contain at least one number"));
-/**
-* Username validation schema
-* - Must be 4-24 characters
-* - Only letters, numbers, underscores, and periods
-*/
-const UsernameSchema = v.pipe(v.string("Username must be text"), v.minLength(4, "Username must be 4-24 characters long"), v.maxLength(24, "Username must be 4-24 characters long"), v.regex(/^[a-z0-9_.]+$/, "Username can only contain lowercase letters, numbers, dots and underscores"));
-/**
-* Name validation schema
-* - Must be 1-30 characters
-*/
-const NameSchema = v.pipe(v.string("Name must be text"), v.minLength(1, "Name must be 1-30 characters long"), v.maxLength(30, "Name must be 1-30 characters long"));
-/**
-* Domain validation schema
-* - Must be lowercase
-* - Must contain at least one dot
-* - Only alphanumeric characters, hyphens, and dots
-* - Cannot start or end with hyphen in any part
-*/
-const DomainSchema = v.pipe(v.string("Domain must be text"), v.trim(), v.toLowerCase(), v.minLength(1, "Domain is required"), v.regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/, "Invalid domain format. Please enter a valid domain like company.com"));
-
-//#endregion
-//#region src/auth/validation/auth.ts
-const EmailAuthRequestSchema = v.object({
-	email: EmailSchema,
-	password: PasswordSchema
-});
-const RegisterRequestSchema = v.object({
-	email: EmailSchema,
-	password: PasswordSchema,
-	country_code: v.optional(v.string()),
-	subscribe_to_blog: v.optional(v.boolean())
-});
-const ResetPasswordRequestSchema = v.object({
-	token: v.string(),
-	new_password: PasswordSchema
-});
-const LoginOTPVerifyRequestSchema = v.object({
-	code: v.pipe(v.string("TOTP or backup code must be text"), v.minLength(1, "TOTP or backup code is required")),
-	session_id: v.pipe(v.string("Session ID must be text"), v.minLength(1, "Session ID is required"))
-});
-const ResendEmailRequestSchema = v.object({ email: EmailSchema });
-const ChangeEmailRequestSchema = v.object({ new_email: EmailSchema });
-const verifyEmailChangeRequestSchema = v.object({
-	code: v.pipe(v.string("OTP code must be text"), v.minLength(6, "OTP code must be at least 6 characters"), v.maxLength(8, "OTP code must be at most 8 characters"), v.regex(/^\d+$/, "OTP code must contain only numbers")),
-	new_email: v.optional(EmailSchema),
-	type: v.union([v.literal("verification"), v.literal("email_change")]),
-	verification_id: v.string("Verification ID is required")
-});
-/**
-* Social provider schemas
-*/
-const ConnectProviderSchema = v.object({
-	provider: v.pipe(v.string("Provider must be text"), v.minLength(1, "Provider is required")),
-	token: v.pipe(v.string("Token must be text"), v.minLength(1, "Token is required"))
-});
-/**
-* OTP verification schema (for user OTP operations)
-*/
-const VerifyOTPCodeSchema = v.object({ code: v.pipe(v.string("OTP code must be text"), v.minLength(6, "OTP code must be at least 6 characters"), v.regex(/^\d+$/, "OTP code must contain only numbers")) });
-
-//#endregion
-//#region src/auth/social/socialConnections.ts
-const PROVIDER_TO_PROTO = {
-	google: "EXTERNAL_ACCOUNT_PROVIDER_GOOGLE",
-	apple: "EXTERNAL_ACCOUNT_PROVIDER_APPLE",
-	microsoft: "EXTERNAL_ACCOUNT_PROVIDER_MICROSOFT",
-	facebook: "EXTERNAL_ACCOUNT_PROVIDER_FACEBOOK",
-	telegram: "EXTERNAL_ACCOUNT_PROVIDER_TELEGRAM"
-};
-const PROVIDER_FROM_PROTO = {
-	EXTERNAL_ACCOUNT_PROVIDER_GOOGLE: "google",
-	EXTERNAL_ACCOUNT_PROVIDER_APPLE: "apple",
-	EXTERNAL_ACCOUNT_PROVIDER_MICROSOFT: "microsoft",
-	EXTERNAL_ACCOUNT_PROVIDER_FACEBOOK: "facebook",
-	EXTERNAL_ACCOUNT_PROVIDER_TELEGRAM: "telegram"
-};
-const normalizeProviderType = (provider) => provider === "tgAuthResult" || provider === "tgWebAppData" ? "telegram" : provider;
-const toProtoProvider = (provider) => {
-	const proto = PROVIDER_TO_PROTO[provider];
-	if (!proto) throw new Error(`Unknown provider: ${provider}`);
-	return proto;
-};
-const listSocials = async () => {
-	return apiCall(async () => {
-		const { data } = await authV1ProvidersServiceListProviders({ throwOnError: true });
-		return (data.providers ?? []).flatMap((p) => {
-			const provider = p.provider ? PROVIDER_FROM_PROTO[p.provider] : void 0;
-			if (!provider) return [];
-			return [{
-				provider,
-				username: p.username,
-				first_name: p.first_name,
-				last_name: p.last_name,
-				email_address: p.email_address,
-				image_url: p.image_url
-			}];
-		});
-	}, { [HTTP_STATUS.UNAUTHORIZED]: () => /* @__PURE__ */ new Error("User is not authorized to list providers!") });
-};
-const connectSocialInternal = async (provider, token) => {
-	return apiCall(async () => {
-		const requestBody = validateInput(ConnectProviderSchema, {
-			provider,
-			token
-		});
-		const sessionToken = await getToken();
-		const headers = sessionToken ? { Authorization: `Bearer ${sessionToken}` } : {};
-		const { data } = await authV1ProvidersServiceConnectProvider({
-			body: {
-				provider: toProtoProvider(normalizeProviderType(requestBody.provider)),
-				token: requestBody.token
-			},
-			headers,
-			throwOnError: true
-		});
-		persistTokens(data);
-	}, { [HTTP_STATUS.UNAUTHORIZED]: () => /* @__PURE__ */ new Error("User is not authorized to connect provider!") });
-};
-const disconnectSocial = async (provider) => {
-	return apiCall(async () => {
-		await authV1ProvidersServiceDisconnectProvider({
-			path: { provider: toProtoProvider(provider) },
-			throwOnError: true
-		});
-	}, {
-		[HTTP_STATUS.UNAUTHORIZED]: () => /* @__PURE__ */ new Error("User is not authorized to disconnect provider!"),
-		[HTTP_STATUS.NOT_FOUND]: () => /* @__PURE__ */ new Error("Provider not found!"),
-		[HTTP_STATUS.BAD_REQUEST]: () => /* @__PURE__ */ new Error("Cannot disconnect the last social provider!")
-	});
-};
-const connectSocial = (provider) => {
-	setSocialConnectAttempt(provider);
-	login(provider);
-};
-
-//#endregion
-//#region src/auth/api/refresh-tokens.ts
-/**
-* Exchange a provider credential for a Rixl session, or refresh an existing
-* Rixl session with a Bearer refresh token.
-*
-* - For `AuthProvider.BEARER`, the call hits `/auth/v1/token` with the stored
-*   Rixl refresh token.
-* - For OAuth/Telegram providers, the call hits `/auth/v1/providers/connect`
-*   with the provider's `id_token` or Telegram payload. The wire `provider`
-*   value is the `auth.v1.ExternalAccountProvider` enum (e.g.
-*   `EXTERNAL_ACCOUNT_PROVIDER_GOOGLE`), not the short SDK name.
-*/
-const refreshTokens = async (provider, token, options) => {
-	if (provider === "Bearer") {
-		const { data } = await authV1TokenServiceRefreshToken({
-			body: {
-				token_type: "Bearer",
-				refresh_token: token,
-				country_code: options?.countryCode,
-				origin: options?.origin
-			},
-			throwOnError: true
-		});
-		return data;
-	}
-	const requestProvider = normalizeProviderType(provider);
-	const { data } = await authV1ProvidersServiceConnectProvider({
-		body: {
-			provider: toProtoProvider(requestProvider),
-			token,
-			country_code: options?.countryCode,
-			origin: options?.origin
-		},
-		throwOnError: true
-	});
-	return data;
-};
-
 //#endregion
 //#region src/auth/cookie/util.ts
 const splitOnFirstEquals = (pair) => {
@@ -3797,6 +3606,245 @@ function configureSdkClient() {
 	});
 }
 
+//#endregion
+//#region src/auth/social/socialState.ts
+const socialStoragePath = (provider) => SOCIAL_CONNECT_KEY_PREFIX + provider;
+/**
+* Sets a flag indicating that a social provider connection is being attempted
+* @param provider The provider identifier
+*/
+function setSocialConnectAttempt(provider) {
+	sessionStorage.setItem(socialStoragePath(provider), "true");
+}
+/**
+* Checks if there's a pending social provider connection attempt
+* @param provider The provider identifier
+* @returns True if there's a pending connection attempt, false otherwise
+*/
+function hasSocialConnectAttempt(provider) {
+	return sessionStorage.getItem(socialStoragePath(provider)) === "true";
+}
+/**
+* Clears the social provider connection attempt flag
+* @param provider The provider identifier
+*/
+function clearSocialConnectAttempt(provider) {
+	sessionStorage.removeItem(socialStoragePath(provider));
+}
+
+//#endregion
+//#region src/auth/api/error-handlers.ts
+/**
+* Helper to create error functions - reduces bundle size by reusing error creation logic
+*/
+const err = (message) => () => new Error(message);
+/** Reusable error handlers for common cases - reduces repetitive error messages */
+const commonErrors = {
+	unauthorized: err("User is not authorized"),
+	badRequest: err("Bad request"),
+	notFound: err("Not found"),
+	conflict: err("Resource already exists"),
+	forbidden: err("Forbidden"),
+	tooManyRequests: err("Too many requests")
+};
+/**
+* Standard error handler for API errors with custom status code handling
+*/
+const handleApiError = (error, statusHandlers) => {
+	if (error instanceof ApiError) {
+		const handler = statusHandlers[error.status];
+		if (handler) throw new ApiError(handler().message, error.status, error.endpoint, error.data);
+		throw error;
+	}
+	throw error;
+};
+
+//#endregion
+//#region src/auth/api/utils.ts
+/**
+* Generic helper for API calls to handle initialization and error handling
+* @param fn The async function to execute
+* @param errorMap A map of status codes to error functions
+* @returns The result of the function execution
+*/
+const apiCall = async (fn, errorMap = {}) => {
+	await initDeferred.promise;
+	try {
+		return await fn();
+	} catch (error) {
+		return handleApiError(error, errorMap);
+	}
+};
+
+//#endregion
+//#region src/auth/api/tokens.ts
+function persistTokens(data) {
+	const tokens = data ?? {};
+	if (tokens.access_token && tokens.refresh_token && tokens.expires_in) {
+		setTokens(tokens.access_token, tokens.refresh_token, Number(tokens.expires_in));
+		return true;
+	}
+	return false;
+}
+
+//#endregion
+//#region src/auth/validation/base.ts
+/**
+* 🛡️ INPUT VALIDATION UTILITY
+* Validates data before API calls and throws user-friendly errors
+*/
+const validateInput = (schema, data) => {
+	try {
+		return v.parse(schema, data);
+	} catch (error) {
+		if (error instanceof v.ValiError) {
+			const firstError = error.issues[0];
+			throw new Error(firstError.message);
+		}
+		throw error;
+	}
+};
+const EmailSchema = v.pipe(v.string("Email must be text"), v.email("Please enter a valid email address"), v.minLength(1, "Email is required"));
+const PasswordSchema = v.pipe(v.string("Password must be text"), v.minLength(8, "Password must be at least 8 characters long"), v.regex(/[A-Z]/, "Password must contain at least one uppercase letter"), v.regex(/[a-z]/, "Password must contain at least one lowercase letter"), v.regex(/[0-9]/, "Password must contain at least one number"));
+/**
+* Username validation schema
+* - Must be 4-24 characters
+* - Only letters, numbers, underscores, and periods
+*/
+const UsernameSchema = v.pipe(v.string("Username must be text"), v.minLength(4, "Username must be 4-24 characters long"), v.maxLength(24, "Username must be 4-24 characters long"), v.regex(/^[a-z0-9_.]+$/, "Username can only contain lowercase letters, numbers, dots and underscores"));
+/**
+* Name validation schema
+* - Must be 1-30 characters
+*/
+const NameSchema = v.pipe(v.string("Name must be text"), v.minLength(1, "Name must be 1-30 characters long"), v.maxLength(30, "Name must be 1-30 characters long"));
+/**
+* Domain validation schema
+* - Must be lowercase
+* - Must contain at least one dot
+* - Only alphanumeric characters, hyphens, and dots
+* - Cannot start or end with hyphen in any part
+*/
+const DomainSchema = v.pipe(v.string("Domain must be text"), v.trim(), v.toLowerCase(), v.minLength(1, "Domain is required"), v.regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/, "Invalid domain format. Please enter a valid domain like company.com"));
+
+//#endregion
+//#region src/auth/validation/auth.ts
+const EmailAuthRequestSchema = v.object({
+	email: EmailSchema,
+	password: PasswordSchema
+});
+const RegisterRequestSchema = v.object({
+	email: EmailSchema,
+	password: PasswordSchema,
+	country_code: v.optional(v.string()),
+	subscribe_to_blog: v.optional(v.boolean())
+});
+const ResetPasswordRequestSchema = v.object({
+	token: v.string(),
+	new_password: PasswordSchema
+});
+const LoginOTPVerifyRequestSchema = v.object({
+	code: v.pipe(v.string("TOTP or backup code must be text"), v.minLength(1, "TOTP or backup code is required")),
+	session_id: v.pipe(v.string("Session ID must be text"), v.minLength(1, "Session ID is required"))
+});
+const ResendEmailRequestSchema = v.object({ email: EmailSchema });
+const ChangeEmailRequestSchema = v.object({ new_email: EmailSchema });
+const verifyEmailChangeRequestSchema = v.object({
+	code: v.pipe(v.string("OTP code must be text"), v.minLength(6, "OTP code must be at least 6 characters"), v.maxLength(8, "OTP code must be at most 8 characters"), v.regex(/^\d+$/, "OTP code must contain only numbers")),
+	new_email: v.optional(EmailSchema),
+	type: v.union([v.literal("verification"), v.literal("email_change")]),
+	verification_id: v.string("Verification ID is required")
+});
+/**
+* Social provider schemas
+*/
+const ConnectProviderSchema = v.object({
+	provider: v.pipe(v.string("Provider must be text"), v.minLength(1, "Provider is required")),
+	token: v.pipe(v.string("Token must be text"), v.minLength(1, "Token is required"))
+});
+/**
+* OTP verification schema (for user OTP operations)
+*/
+const VerifyOTPCodeSchema = v.object({ code: v.pipe(v.string("OTP code must be text"), v.minLength(6, "OTP code must be at least 6 characters"), v.regex(/^\d+$/, "OTP code must contain only numbers")) });
+
+//#endregion
+//#region src/auth/social/socialConnections.ts
+const PROVIDER_TO_PROTO = {
+	google: "EXTERNAL_ACCOUNT_PROVIDER_GOOGLE",
+	apple: "EXTERNAL_ACCOUNT_PROVIDER_APPLE",
+	microsoft: "EXTERNAL_ACCOUNT_PROVIDER_MICROSOFT",
+	facebook: "EXTERNAL_ACCOUNT_PROVIDER_FACEBOOK",
+	telegram: "EXTERNAL_ACCOUNT_PROVIDER_TELEGRAM"
+};
+const PROVIDER_FROM_PROTO = {
+	EXTERNAL_ACCOUNT_PROVIDER_GOOGLE: "google",
+	EXTERNAL_ACCOUNT_PROVIDER_APPLE: "apple",
+	EXTERNAL_ACCOUNT_PROVIDER_MICROSOFT: "microsoft",
+	EXTERNAL_ACCOUNT_PROVIDER_FACEBOOK: "facebook",
+	EXTERNAL_ACCOUNT_PROVIDER_TELEGRAM: "telegram"
+};
+const normalizeProviderType = (provider) => provider === "tgAuthResult" || provider === "tgWebAppData" ? "telegram" : provider;
+const toProtoProvider = (provider) => {
+	const proto = PROVIDER_TO_PROTO[provider];
+	if (!proto) throw new Error(`Unknown provider: ${provider}`);
+	return proto;
+};
+const listSocials = async () => {
+	return apiCall(async () => {
+		const { data } = await authV1ProvidersServiceListProviders({ throwOnError: true });
+		return (data.providers ?? []).flatMap((p) => {
+			const provider = p.provider ? PROVIDER_FROM_PROTO[p.provider] : void 0;
+			if (!provider) return [];
+			return [{
+				provider,
+				username: p.username,
+				first_name: p.first_name,
+				last_name: p.last_name,
+				email_address: p.email_address,
+				image_url: p.image_url
+			}];
+		});
+	}, { [HTTP_STATUS.UNAUTHORIZED]: () => /* @__PURE__ */ new Error("User is not authorized to list providers!") });
+};
+const connectSocialInternal = async (provider, token) => {
+	return apiCall(async () => {
+		const requestBody = validateInput(ConnectProviderSchema, {
+			provider,
+			token
+		});
+		const sessionToken = await getToken();
+		const headers = sessionToken ? { Authorization: `Bearer ${sessionToken}` } : {};
+		const exchange = provider === "telegram" ? telegramCodeExchange() : void 0;
+		const body = {
+			provider: toProtoProvider(normalizeProviderType(requestBody.provider)),
+			token: requestBody.token,
+			code_verifier: exchange?.codeVerifier,
+			redirect_uri: exchange?.redirectUri
+		};
+		const { data } = await authV1ProvidersServiceConnectProvider({
+			body,
+			headers,
+			throwOnError: true
+		});
+		persistTokens(data);
+	}, { [HTTP_STATUS.UNAUTHORIZED]: () => /* @__PURE__ */ new Error("User is not authorized to connect provider!") });
+};
+const disconnectSocial = async (provider) => {
+	return apiCall(async () => {
+		await authV1ProvidersServiceDisconnectProvider({
+			path: { provider: toProtoProvider(provider) },
+			throwOnError: true
+		});
+	}, {
+		[HTTP_STATUS.UNAUTHORIZED]: () => /* @__PURE__ */ new Error("User is not authorized to disconnect provider!"),
+		[HTTP_STATUS.NOT_FOUND]: () => /* @__PURE__ */ new Error("Provider not found!"),
+		[HTTP_STATUS.BAD_REQUEST]: () => /* @__PURE__ */ new Error("Cannot disconnect the last social provider!")
+	});
+};
+const connectSocial = (provider) => {
+	setSocialConnectAttempt(provider);
+	login(provider);
+};
+
 //#endregion
 //#region src/auth/authConfig.ts
 const config = shared("authConfig", () => ({ loginRedirectUrl: void 0 }));
@@ -3887,7 +3935,8 @@ const handleInitPageApiError = (error) => {
 	setAuthErrorAndClear("provider_exchange_failed", info.error || info.description, info.email);
 };
 const exchangeProviderToken = async (provider, token) => {
-	const result = await refreshTokens(provider, token);
+	const options = provider === "telegram" ? telegramCodeExchange() : void 0;
+	const result = await refreshTokens(provider, token, options);
 	applyTokenExchangeResult(result);
 };
 const initPage = async () => {
@@ -3896,8 +3945,12 @@ const initPage = async () => {
 		if (hasProviderResponse()) logUnusableProviderResponse();
 		return;
 	}
+	if (provider === "telegram" && hasSocialConnectAttempt(provider)) return void 0;
 	const token = getProviderToken(provider);
 	if (!token) return void 0;
+	await loginWithProviderToken(provider, token);
+};
+const loginWithProviderToken = async (provider, token) => {
 	try {
 		await exchangeProviderToken(provider, token);
 	} catch (error) {
@@ -4619,8 +4672,10 @@ const initiateEmailChange = async (email) => {
 const addEmail = async (email) => {
 	return apiCall(async () => {
 		const validatedInput = validateInput(ResendEmailRequestSchema, { email });
+		const limitedToken = limitedAccessToken.get();
 		const { data } = await authV1EmailServiceAddEmail({
 			body: validatedInput,
+			...limitedToken && { headers: { Authorization: `Bearer ${limitedToken}` } },
 			throwOnError: true
 		});
 		if (data.verification_id) return {