@rixl/sdk 0.9.0 → 0.9.1

package/dist/index.js

@@ -1,7 +1,6 @@
 import { atom } from "nanostores";
 import { decodeJwt } from "jose";
 import * as v from "valibot";
-import "ky";
 
 //#region src/generated/core/bodySerializer.gen.ts
 const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
@@ -352,9 +351,7 @@ const setAuthParams = async ({ security, ...options }) => {
 			case "cookie":
 				options.headers.append("Cookie", `${name}=${token}`);
 				break;
-			default:
-				options.headers.set(name, token);
-				break;
+			default: options.headers.set(name, token);
 		}
 	}
 };
@@ -515,9 +512,7 @@ const createClient = (config = {}) => {
 						case "stream":
 							emptyData = response.body;
 							break;
-						default:
-							emptyData = {};
-							break;
+						default: emptyData = {};
 					}
 					return opts.responseStyle === "data" ? emptyData : {
 						data: emptyData,
@@ -2324,6 +2319,15 @@ function validateOAuthState(provider, state) {
 	return sessionStorage.getItem(storagePath(provider)) === state;
 }
 /**
+* Discards the stored state for a provider so the next login round-trip mints a
+* fresh one. The state doubles as the OAuth `nonce`, so reusing it across logins
+* would replay a nonce the provider has already issued a token for.
+* @param provider The provider identifier
+*/
+function clearOauthState(provider) {
+	sessionStorage.removeItem(storagePath(provider));
+}
+/**
 * Gets or Generates a complete state parameter for OAuth requests
 * @param provider The identifier for the provider (e.g., 'google', 'apple')
 * @returns A state string containing the provider identifier and random data
@@ -2347,9 +2351,10 @@ function generateOauthState(provider) {
 * Builds an OAuth URL from configuration and metadata
 */
 const buildOAuthUrl = (config, metadata, state) => {
+	const redirectUri = config.redirectUri ?? window.location.origin;
 	const params = new URLSearchParams({
 		client_id: config.clientId,
-		redirect_uri: window.location.origin,
+		redirect_uri: redirectUri,
 		response_type: metadata.responseType,
 		scope: [...metadata.defaultScopes, ...config.scope ? [config.scope] : []].join(" "),
 		state
@@ -2372,8 +2377,8 @@ const warnProviderNotConfigured = (providerName) => {
 * This factory reduces code duplication across OAuth providers
 */
 const createOAuthProvider = ({ provider, metadata }) => {
-	const config = atom(null);
-	const authUrl = atom(null);
+	const config = shared(`provider.${provider}.config`, () => atom(null));
+	const authUrl = shared(`provider.${provider}.authUrl`, () => atom(null));
 	const updateAuthUrl = () => {
 		const currentConfig = config.get();
 		if (!currentConfig) {
@@ -2449,8 +2454,8 @@ const updateAppleAuthUrl = appleProvider.updateAuthUrl;
 
 //#endregion
 //#region src/auth/providers/telegram.ts
-const telegramConfig = atom(null);
-const telegramAuthUrl = atom(null);
+const telegramConfig = shared("provider.telegram.config", () => atom(null));
+const telegramAuthUrl = shared("provider.telegram.authUrl", () => atom(null));
 /**
 * Updates the Telegram authentication URL using the configured settings
 */
@@ -2483,7 +2488,7 @@ function extractProviderFromState(state) {
 	const parts = state.split("_");
 	if (parts.length >= 1) return parts[0];
 }
-const OAUTH_PROVIDERS = [
+const OAUTH_PROVIDERS$1 = [
 	"google",
 	"apple",
 	"microsoft"
@@ -2499,7 +2504,7 @@ function detectProvider() {
 	const state = urlParams.get("state");
 	if (id_token && state) {
 		const providerFromState = extractProviderFromState(state);
-		return OAUTH_PROVIDERS.find((p) => providerFromState === p && validateOAuthState(p, state));
+		return OAUTH_PROVIDERS$1.find((p) => providerFromState === p && validateOAuthState(p, state));
 	}
 }
 /**
@@ -2513,20 +2518,210 @@ function getProviderToken(provider) {
 }
 
 //#endregion
-//#region src/auth/api/refresh-tokens.ts
-const refreshTokens = async (provider, token, options) => {
-	const { data } = await authV1TokenServiceRefreshToken({
-		body: {
+//#region src/auth/providers/callback.ts
+/** Params that carry the credential itself — their presence marks a callback response. */
+const CREDENTIAL_PARAMS = [
+	"id_token",
+	"code",
+	"access_token",
+	"tgAuthResult",
+	"tgWebAppData"
+];
+/** Everything the providers append to the redirect URL, credential and bookkeeping alike. */
+const OAUTH_RESPONSE_PARAMS = [
+	...CREDENTIAL_PARAMS,
+	"state",
+	"token_type",
+	"expires_in",
+	"scope",
+	"session_state",
+	"authuser",
+	"prompt",
+	"hd"
+];
+/**
+* Whether the URL this page loaded with carries a provider response at all —
+* unlike `detectProvider()`, this does not require the state to validate. The
+* gap between the two is the case where a login round-trip came back but cannot
+* be used, which otherwise ends the flow in silence.
+*/
+const hasProviderResponse = () => CREDENTIAL_PARAMS.some((key) => urlParams.has(key));
+const AUTH_URL_UPDATERS = {
+	["google"]: updateGoogleAuthUrl,
+	["apple"]: updateAppleAuthUrl,
+	["microsoft"]: updateMicrosoftAuthUrl
+};
+/** Returns undefined when the half holds no credential, meaning it is the app's own and must not be touched. */
+const stripped = (query) => {
+	const params = new URLSearchParams(query);
+	if (!CREDENTIAL_PARAMS.some((key) => params.has(key))) return void 0;
+	OAUTH_RESPONSE_PARAMS.forEach((key) => params.delete(key));
+	return params.toString();
+};
+/**
+* Providers put their response in the query string or the fragment depending on
+* `response_mode`, and either half may also hold params the app itself put
+* there. Only the half actually carrying the credential is rewritten.
+*/
+const withoutOAuthResponse = (href) => {
+	const url = new URL(href);
+	url.search = stripped(url.search) ?? url.search;
+	url.hash = stripped(url.hash.slice(1)) ?? url.hash;
+	return url.toString();
+};
+/**
+* Retires the provider response after `initClient` is done with it.
+*
+* Left in place, the credential stays in the address bar and every reload — or
+* Vite's HMR full reload — replays an already-consumed `id_token`, which the
+* gateway rejects. Clearing the stored state on the way out also stops the next
+* login from reusing this round-trip's `nonce`.
+*
+* The `urlParams` snapshot is taken at import time and is intentionally left
+* untouched, so callers that already read the credential out of it keep working
+* for the rest of this page load.
+*/
+const completeOAuthCallback = () => {
+	const provider = detectProvider();
+	if (!provider) return;
+	clearOauthState(provider);
+	AUTH_URL_UPDATERS[provider]?.();
+	window.history.replaceState(window.history.state, "", withoutOAuthResponse(window.location.href));
+};
+
+//#endregion
+//#region src/auth/api/types.ts
+/**
+* Generic API error class - wraps ky's HTTPError for consistency
+*/
+var ApiError = class extends Error {
+	status;
+	endpoint;
+	data;
+	constructor(message, ...rest) {
+		super(message);
+		this.name = "ApiError";
+		const firstArg = rest[0];
+		if (typeof firstArg === "number") {
+			this.status = firstArg;
+			this.endpoint = rest[1] ?? "";
+			this.data = rest[2];
+			return;
+		}
+		this.status = firstArg.status;
+		this.endpoint = firstArg.endpoint;
+		this.data = firstArg.data;
+	}
+};
+
+//#endregion
+//#region src/auth/providers/diagnostics.ts
+const claimsOf = (token) => {
+	try {
+		const { iss, aud, exp, nonce, email } = decodeJwt(token);
+		return {
+			iss: String(iss ?? ""),
+			aud: String(aud ?? ""),
+			exp: exp ? (/* @__PURE__ */ new Date(Number(exp) * 1e3)).toISOString() : void 0,
+			expired: typeof exp === "number" && Date.now() >= exp * 1e3,
+			nonce: String(nonce ?? ""),
+			email: String(email ?? "")
+		};
+	} catch {
+		return { note: "not a JWT — expected for Telegram, unexpected for Google/Apple/Microsoft" };
+	}
+};
+const verdictFor = (error) => {
+	if ((typeof error.data === "object" && error.data !== null ? error.data : void 0)?.error === "invalid token type") return "CLIENT: the gateway does not accept this token_type. Expected one of Bearer, google, apple, microsoft, tgAuthResult, tgWebAppData.";
+	if (error.status === HTTP_STATUS.UNAUTHORIZED) return "BACKEND or CONFIG: the gateway could not verify the credential. Compare `aud` above with the client ID the gateway is configured with, and check `expired`.";
+	if (error.status === HTTP_STATUS.CONFLICT) return "EXPECTED: this email already belongs to an account created with a different provider.";
+	if (error.status === HTTP_STATUS.BAD_REQUEST) return "BACKEND: the gateway rejected the request body. Read `response.body` for its reason.";
+	return "UNKNOWN: see `response` below.";
+};
+const describe = (error) => {
+	if (!(error instanceof ApiError)) return {
+		response: {
+			status: "none — the request never completed",
+			detail: String(error)
+		},
+		verdict: "NETWORK or CORS: the browser never got a response. Check the gateway is reachable and its CORS headers allow this origin."
+	};
+	return {
+		response: {
+			status: error.status,
+			body: error.data,
+			message: error.message
+		},
+		verdict: verdictFor(error)
+	};
+};
+const OAUTH_PROVIDERS = [
+	"google",
+	"apple",
+	"microsoft"
+];
+const storedStates = () => Object.fromEntries(OAUTH_PROVIDERS.map((p) => [p, sessionStorage.getItem("__rixl_auth_state_" + p) ?? "(none)"]));
+/**
+* Reports a provider response that arrived but could not be used, which ends the
+* login without a request ever being sent — the case that otherwise looks like
+* "it just went back to the login page".
+*
+* `detectProvider()` requires the `state` in the URL to equal the one stored when
+* the login started, so the two states below are the thing to compare.
+*/
+const logUnusableProviderResponse = () => {
+	const state = urlParams.get("state") ?? "(none)";
+	console.error("[@rixl/sdk] a provider response is in the URL but no login was attempted", {
+		urlState: state,
+		storedStates: storedStates(),
+		credentialParams: [
+			"id_token",
+			"code",
+			"access_token"
+		].filter((key) => urlParams.has(key)),
+		verdict: state === "(none)" ? "CLIENT: the provider returned no `state`, so the response cannot be matched to a login attempt." : "CLIENT: `urlState` does not match the stored state for its provider. sessionStorage was cleared, the login started in a different tab, or the response was replayed after the state had already been retired."
+	});
+};
+/**
+* Reports a failed provider token exchange. `provider` doubles as the `token_type`
+* sent on the wire, so it is printed as-is.
+*/
+const logProviderExchangeFailure = (provider, credential, error) => {
+	console.error("[@rixl/sdk] provider login failed at POST /auth/v1/token", {
+		request: {
 			token_type: provider,
-			refresh_token: token,
-			country_code: options?.countryCode,
-			origin: options?.origin
+			credential: claimsOf(credential)
 		},
-		throwOnError: true
+		...describe(error)
 	});
-	return data;
 };
 
+//#endregion
+//#region src/auth/social/socialState.ts
+const socialStoragePath = (provider) => SOCIAL_CONNECT_KEY_PREFIX + provider;
+/**
+* Sets a flag indicating that a social provider connection is being attempted
+* @param provider The provider identifier
+*/
+function setSocialConnectAttempt(provider) {
+	sessionStorage.setItem(socialStoragePath(provider), "true");
+}
+/**
+* Checks if there's a pending social provider connection attempt
+* @param provider The provider identifier
+* @returns True if there's a pending connection attempt, false otherwise
+*/
+function hasSocialConnectAttempt(provider) {
+	return sessionStorage.getItem(socialStoragePath(provider)) === "true";
+}
+/**
+* Clears the social provider connection attempt flag
+* @param provider The provider identifier
+*/
+function clearSocialConnectAttempt(provider) {
+	sessionStorage.removeItem(socialStoragePath(provider));
+}
+
 //#endregion
 //#region src/auth/initialization.ts
 /**
@@ -2546,534 +2741,94 @@ function createDeferred() {
 	};
 }
 /**
-* Global deferred promise that tracks the initialization status of the auth library
-* This is resolved when initClient is called
+* Global deferred promise that tracks the initialization status of the auth library.
+* This is resolved when initClient is called.
+*
+* Shared across copies of this package. `connect()` runs in exactly one copy, so
+* a per-copy deferred leaves every other copy awaiting a promise nothing will
+* ever resolve — and because getToken() and the request interceptor both await
+* it, that is not a slow path but a permanent hang.
 */
-const initDeferred = createDeferred();
+const initDeferred = shared("initDeferred", createDeferred);
 
 //#endregion
-//#region src/auth/cookie/util.ts
-const getAllCookiesStartWith = (startWithKey) => {
-	if (typeof document === "undefined") return {};
-	return document.cookie.split(";").map((cv) => cv.split("=").map((v) => v.trim())).filter(([key]) => key && key !== startWithKey && key.startsWith(startWithKey)).reduce((ac, [key, value]) => Object.assign(ac, { [key.slice(startWithKey.length + 1)]: value }), {});
+//#region src/auth/api/error-handlers.ts
+/**
+* Helper to create error functions - reduces bundle size by reusing error creation logic
+*/
+const err = (message) => () => new Error(message);
+/** Reusable error handlers for common cases - reduces repetitive error messages */
+const commonErrors = {
+	unauthorized: err("User is not authorized"),
+	badRequest: err("Bad request"),
+	notFound: err("Not found"),
+	conflict: err("Resource already exists"),
+	forbidden: err("Forbidden"),
+	tooManyRequests: err("Too many requests")
 };
-function setCookie(name, value, options) {
-	if (typeof document === "undefined") return;
-	let cookieString = `${encodeName(name)}=${encodeValue(value)}`;
-	if (options) {
-		if (options.expires) if (typeof options.expires === "number") {
-			const date = /* @__PURE__ */ new Date();
-			date.setTime(date.getTime() + options.expires * 24 * 60 * 60 * 1e3);
-			cookieString += `; expires=${date.toUTCString()}`;
-		} else cookieString += `; expires=${options.expires.toUTCString()}`;
-		if (options.path) cookieString += `; path=${options.path}`;
-		if (options.domain) cookieString += `; domain=${options.domain}`;
-		if (options.secure) cookieString += `; secure`;
-		if (options.sameSite) cookieString += `; samesite=${options.sameSite}`;
+/**
+* Standard error handler for API errors with custom status code handling
+*/
+const handleApiError = (error, statusHandlers) => {
+	if (error instanceof ApiError) {
+		const handler = statusHandlers[error.status];
+		if (handler) throw new ApiError(handler().message, error.status, error.endpoint, error.data);
+		throw error;
 	}
-	document.cookie = cookieString;
-}
-function deleteCookie(name) {
-	if (typeof document === "undefined") return;
-	document.cookie = name + "=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;";
-}
-const encodeName = (name) => encodeURIComponent(name).replace(/%(2[346B]|5E|60|7C)/g, decodeURIComponent);
-const encodeValue = (value) => encodeURIComponent(value).replace(/%(2[346BF]|3[AC-F]|40|5[BDE]|60|7[BCD])/g, decodeURIComponent);
+	throw error;
+};
 
 //#endregion
-//#region src/auth/cookie/index.ts
-const initVals = getAllCookiesStartWith(GLOBAL_PREFIX);
-const setStoreCookie = (key, value) => {
-	const expires = /* @__PURE__ */ new Date();
-	expires.setTime(expires.getTime() + 30 * 24 * 60 * 60 * 1e3);
-	const cookieKey = `${GLOBAL_PREFIX}_${key}`;
-	if (!value || value === "") {
-		deleteCookie(cookieKey);
-		return;
+//#region src/auth/api/utils.ts
+/**
+* Generic helper for API calls to handle initialization and error handling
+* @param fn The async function to execute
+* @param errorMap A map of status codes to error functions
+* @returns The result of the function execution
+*/
+const apiCall = async (fn, errorMap = {}) => {
+	await initDeferred.promise;
+	try {
+		return await fn();
+	} catch (error) {
+		return handleApiError(error, errorMap);
 	}
-	const stringValue = typeof value === "string" ? value : JSON.stringify(value);
-	setCookie(`${GLOBAL_PREFIX}_${key}`, stringValue, {
-		expires,
-		path: "/",
-		sameSite: "Lax"
-	});
 };
 
 //#endregion
-//#region src/auth/userStore.ts
-const userPath = GLOBAL_PREFIX + "_user";
-const parseUser = () => {
-	if (typeof localStorage === "undefined" || !localStorage || typeof localStorage.getItem !== "function") return;
-	const value = localStorage.getItem(userPath);
-	if (value && value != "undefined") try {
-		return JSON.parse(value);
-	} catch (err) {
-		console.warn("Can't parse user data, error: ", err);
-		return;
+//#region src/auth/api/tokens.ts
+function persistTokens(data) {
+	const tokens = data ?? {};
+	if (tokens.access_token && tokens.refresh_token && tokens.expires_in) {
+		setTokens(tokens.access_token, tokens.refresh_token, Number(tokens.expires_in));
+		return true;
 	}
-};
-const user = shared("user", () => {
-	const store = atom(parseUser());
-	store.subscribe((value) => {
-		if (typeof localStorage === "undefined" || !localStorage || typeof localStorage.setItem !== "function") return;
-		if (value) localStorage.setItem(userPath, JSON.stringify(value));
-		else localStorage.removeItem(userPath);
-	});
-	return store;
-});
+	return false;
+}
 
 //#endregion
-//#region src/auth/utils/jwt.ts
+//#region src/auth/validation/base.ts
 /**
-* Decodes a JWT token and extracts user information
-* Uses jose library for modern, secure JWT handling
-* @param token The JWT token to decode
-* @returns The decoded user data or undefined if decoding fails
+* 🛡️ INPUT VALIDATION UTILITY
+* Validates data before API calls and throws user-friendly errors
 */
-const decodeToken = (token) => {
+const validateInput = (schema, data) => {
 	try {
-		const decodedUser = decodeJwt(token);
-		return {
-			id: decodedUser.id,
-			email: decodedUser.email,
-			first_name: decodedUser.first_name,
-			last_name: decodedUser.last_name,
-			username: decodedUser.username,
-			image_url: decodedUser.image_url,
-			language_code: decodedUser.language_code,
-			org_id: decodedUser.org_id
-		};
+		return v.parse(schema, data);
 	} catch (error) {
-		console.warn("Failed to decode JWT token. Error: ", error);
-		return;
+		if (error instanceof v.ValiError) {
+			const firstError = error.issues[0];
+			throw new Error(firstError.message);
+		}
+		throw error;
 	}
 };
+const EmailSchema = v.pipe(v.string("Email must be text"), v.email("Please enter a valid email address"), v.minLength(1, "Email is required"));
+const PasswordSchema = v.pipe(v.string("Password must be text"), v.minLength(8, "Password must be at least 8 characters long"), v.regex(/[A-Z]/, "Password must contain at least one uppercase letter"), v.regex(/[a-z]/, "Password must contain at least one lowercase letter"), v.regex(/[0-9]/, "Password must contain at least one number"));
 /**
-* Decodes a JWT token and sets the user in the store
-* @param token The JWT token to decode
-* @returns True if user was successfully decoded and set, false otherwise
-*/
-const decodeAndSetUser = (token) => {
-	const userData = decodeToken(token);
-	if (userData) {
-		user.set(userData);
-		return true;
-	}
-	return false;
-};
-/**
-* Checks if a token is expired based on the expiration timestamp
-* @param expireAt The expiration timestamp in milliseconds
-* @returns True if the token is expired, false otherwise
-*/
-const isTokenExpired = (expireAt) => {
-	if (!expireAt) return true;
-	return Date.now() >= expireAt;
-};
-
-//#endregion
-//#region src/auth/authStore.ts
-const isLogged = shared("isLogged", () => atom(initVals["isLogged"] === "true" || detectProvider() !== void 0));
-const accessToken = shared("accessToken", () => atom(initVals["accessToken"]));
-const refreshToken = shared("refreshToken", () => atom(initVals["refreshToken"]));
-const expireAt = shared("expireAt", () => atom(Number(initVals["expireAt"])));
-const authError = shared("authError", () => atom(null));
-const requiresAction = shared("requiresAction", () => atom(initVals["requiresAction"] || null));
-const limitedAccessToken = shared("limitedAccessToken", () => atom(initVals["limitedAccessToken"] || null));
-let currentTokenPromise = null;
-const PROVIDER_URL_MAP = {
-	google: googleAuthUrl,
-	apple: appleAuthUrl,
-	microsoft: microsoftAuthUrl,
-	telegram: telegramAuthUrl
-};
-const login = async (provider) => {
-	await initDeferred.promise;
-	const authUrlAtom = PROVIDER_URL_MAP[provider];
-	if (!authUrlAtom) throw new Error(`Unsupported provider: ${provider}`);
-	const authUrl = authUrlAtom.get();
-	if (authUrl) window.location.href = authUrl;
-	else throw new Error(`${provider} provider is not configured. Please check your initClient configuration.`);
-};
-const refreshAccessToken = async (refresh) => {
-	const result = await refreshTokens("Bearer", refresh);
-	if (!("requires_action" in result)) setTokens(result.access_token, result.refresh_token, result.expires_in);
-};
-const ensureValidAccessToken = async (refresh) => {
-	if (accessToken.get() && !isTokenExpired(expireAt.get())) return;
-	try {
-		await refreshAccessToken(refresh);
-	} catch (refreshError) {
-		console.error("Token refresh failed in getToken:", refreshError);
-		removeTokens();
-		throw refreshError;
-	}
-};
-const getToken = async () => {
-	if (currentTokenPromise) return currentTokenPromise;
-	currentTokenPromise = (async () => {
-		try {
-			await initDeferred.promise;
-			if (requiresAction.get()) return void 0;
-			const currentRefreshToken = refreshToken.get();
-			if (!currentRefreshToken) return void 0;
-			await ensureValidAccessToken(currentRefreshToken);
-			const token = accessToken.get();
-			if (token) decodeAndSetUser(token);
-			return token;
-		} catch (error) {
-			console.warn("Failed to getToken(). Error: ", error);
-			throw error;
-		} finally {
-			currentTokenPromise = null;
-		}
-	})();
-	return currentTokenPromise;
-};
-/**
-* Sets authentication tokens in the store
-* @param access The access token
-* @param refresh The refresh token
-* @param expiresIn The token expiration time in seconds
-*/
-const setTokens = (access, refresh, expiresIn) => {
-	accessToken.set(access);
-	refreshToken.set(refresh);
-	expireAt.set(Date.now() + expiresIn * 1e3);
-	isLogged.set(true);
-	limitedAccessToken.set(null);
-	requiresAction.set(null);
-	authError.set(null);
-	decodeAndSetUser(access);
-};
-/**
-* Removes authentication tokens from the store
-*/
-const removeTokens = () => {
-	accessToken.set("");
-	refreshToken.set("");
-	expireAt.set(0);
-	isLogged.set(false);
-	user.set(void 0);
-	limitedAccessToken.set(null);
-	requiresAction.set(null);
-	authError.set(null);
-};
-/**
-* Clears the auth error from the store
-*/
-const clearAuthError = () => {
-	authError.set(null);
-};
-/**
-* Sets limited access state for users requiring additional action (e.g., Telegram users without email)
-* @param token The limited scope access token
-* @param action The required action (e.g., "add_email")
-*/
-const setLimitedAccessState = (token, action) => {
-	limitedAccessToken.set(token);
-	requiresAction.set(action);
-	authError.set(null);
-	isLogged.set(true);
-};
-/**
-* Clears the limited access state (after email verification completes or user logs out)
-*/
-const clearLimitedAccessState = () => {
-	limitedAccessToken.set(null);
-	requiresAction.set(null);
-	if (!(!!accessToken.get() && !!refreshToken.get())) isLogged.set(false);
-};
-isLogged.subscribe((value) => setStoreCookie("isLogged", value));
-accessToken.subscribe((value) => setStoreCookie("accessToken", value));
-refreshToken.subscribe((value) => setStoreCookie("refreshToken", value));
-expireAt.subscribe((value) => setStoreCookie("expireAt", value));
-requiresAction.subscribe((value) => setStoreCookie("requiresAction", value));
-limitedAccessToken.subscribe((value) => setStoreCookie("limitedAccessToken", value));
-
-//#endregion
-//#region src/auth/api/types.ts
-/**
-* Generic API error class - wraps ky's HTTPError for consistency
-*/
-var ApiError = class extends Error {
-	status;
-	endpoint;
-	data;
-	constructor(message, ...rest) {
-		super(message);
-		this.name = "ApiError";
-		const firstArg = rest[0];
-		if (typeof firstArg === "number") {
-			this.status = firstArg;
-			this.endpoint = rest[1] ?? "";
-			this.data = rest[2];
-			return;
-		}
-		this.status = firstArg.status;
-		this.endpoint = firstArg.endpoint;
-		this.data = firstArg.data;
-	}
-};
-
-//#endregion
-//#region src/auth/api-url.ts
-/**
-* Global API base URL store
-*/
-const apiURL = shared("apiURL", () => atom(""));
-
-//#endregion
-//#region src/auth/api/sdk-client.ts
-function isWireErrorBody(error) {
-	return typeof error === "object" && error !== null;
-}
-const state = shared("sdkClientState", () => ({
-	configured: false,
-	tokenResolver: getToken
-}));
-function setTokenResolver(resolver) {
-	state.tokenResolver = resolver;
-}
-/**
-* Routes that do not require a Bearer token at the gateway edge. These
-* authenticate via credentials in the request body (or are webhooks verified by
-* signature), so attaching an Authorization header here would make the gateway
-* attempt to validate a stale/absent token and reject the request with 401.
-* Mirrors `publicRoutes` in backend/gateway/internal/routes/routes.go.
-*/
-const publicRoutes = [
-	{
-		method: "POST",
-		path: "/auth/v1/token"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/register"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/login"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/email/verify"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/email/verify/resend"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/password/reset"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/password/reset/confirm"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/verify-totp"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/verify-passkey"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/invitations/",
-		prefix: true
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/passkey/login/begin"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/passkey/login/finish"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/logout"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/blog/unsubscribe/email"
-	},
-	{
-		method: "POST",
-		path: "/auth/v1/blog/broadcast"
-	},
-	{
-		method: "GET",
-		path: "/media/v1/videos/",
-		prefix: true
-	},
-	{
-		method: "GET",
-		path: "/media/v1/images/",
-		prefix: true
-	},
-	{
-		method: "GET",
-		path: "/media/v1/languages"
-	},
-	{
-		method: "GET",
-		path: "/posts/v1/feeds/",
-		prefix: true
-	},
-	{
-		method: "POST",
-		path: "/billing/webhooks/stripe"
-	},
-	{
-		method: "POST",
-		path: "/webhooks/storage"
-	},
-	{
-		method: "POST",
-		path: "/platform/auth/v1/token"
-	},
-	{
-		method: "POST",
-		path: "/platform/auth/v1/refresh"
-	}
-];
-function isPublicRoute(method, pathname) {
-	const match = method.toUpperCase();
-	return publicRoutes.some(({ method: m, path, prefix }) => match === m && (prefix ? pathname.startsWith(path) : pathname === path));
-}
-function configureSdkClient() {
-	if (state.configured) return;
-	state.configured = true;
-	configureAllClients(apiURL.get());
-	apiURL.subscribe((url) => {
-		configureAllClients(url);
-	});
-	addClientInitializer((client) => {
-		client.interceptors.request.use(async (request) => {
-			if (request.headers.has("Authorization")) return request;
-			const { pathname } = new URL(request.url);
-			if (isPublicRoute(request.method, pathname)) return request;
-			const token = await state.tokenResolver();
-			if (!token) throw new ApiError("No access token available for an authenticated request", HTTP_STATUS.UNAUTHORIZED, pathname);
-			request.headers.set("Authorization", `Bearer ${token}`);
-			return request;
-		});
-		client.interceptors.error.use((error, response, request) => {
-			if (error instanceof Error) return error;
-			const body = isWireErrorBody(error) ? error : void 0;
-			const status = response?.status ?? body?.code ?? 0;
-			return new ApiError(body?.error || body?.details || (typeof error === "string" ? error : "Request failed"), status, request ? new URL(request.url).pathname : "", error);
-		});
-	});
-}
-
-//#endregion
-//#region src/auth/social/socialState.ts
-const socialStoragePath = (provider) => SOCIAL_CONNECT_KEY_PREFIX + provider;
-/**
-* Sets a flag indicating that a social provider connection is being attempted
-* @param provider The provider identifier
-*/
-function setSocialConnectAttempt(provider) {
-	sessionStorage.setItem(socialStoragePath(provider), "true");
-}
-/**
-* Checks if there's a pending social provider connection attempt
-* @param provider The provider identifier
-* @returns True if there's a pending connection attempt, false otherwise
-*/
-function hasSocialConnectAttempt(provider) {
-	return sessionStorage.getItem(socialStoragePath(provider)) === "true";
-}
-/**
-* Clears the social provider connection attempt flag
-* @param provider The provider identifier
-*/
-function clearSocialConnectAttempt(provider) {
-	sessionStorage.removeItem(socialStoragePath(provider));
-}
-
-//#endregion
-//#region src/auth/api/error-handlers.ts
-/**
-* Helper to create error functions - reduces bundle size by reusing error creation logic
-*/
-const err = (message) => () => new Error(message);
-/** Reusable error handlers for common cases - reduces repetitive error messages */
-const commonErrors = {
-	unauthorized: err("User is not authorized"),
-	badRequest: err("Bad request"),
-	notFound: err("Not found"),
-	conflict: err("Resource already exists"),
-	forbidden: err("Forbidden"),
-	tooManyRequests: err("Too many requests")
-};
-/**
-* Standard error handler for API errors with custom status code handling
-*/
-const handleApiError = (error, statusHandlers) => {
-	if (error instanceof ApiError) {
-		const handler = statusHandlers[error.status];
-		if (handler) throw new ApiError(handler().message, error.status, error.endpoint, error.data);
-		throw error;
-	}
-	throw error;
-};
-
-//#endregion
-//#region src/auth/api/utils.ts
-/**
-* Generic helper for API calls to handle initialization and error handling
-* @param fn The async function to execute
-* @param errorMap A map of status codes to error functions
-* @returns The result of the function execution
-*/
-const apiCall = async (fn, errorMap = {}) => {
-	await initDeferred.promise;
-	try {
-		return await fn();
-	} catch (error) {
-		return handleApiError(error, errorMap);
-	}
-};
-
-//#endregion
-//#region src/auth/api/tokens.ts
-function persistTokens(data) {
-	const tokens = data ?? {};
-	if (tokens.access_token && tokens.refresh_token && tokens.expires_in) {
-		setTokens(tokens.access_token, tokens.refresh_token, Number(tokens.expires_in));
-		return true;
-	}
-	return false;
-}
-
-//#endregion
-//#region src/auth/validation/base.ts
-/**
-* 🛡️ INPUT VALIDATION UTILITY
-* Validates data before API calls and throws user-friendly errors
-*/
-const validateInput = (schema, data) => {
-	try {
-		return v.parse(schema, data);
-	} catch (error) {
-		if (error instanceof v.ValiError) {
-			const firstError = error.issues[0];
-			throw new Error(firstError.message);
-		}
-		throw error;
-	}
-};
-const EmailSchema = v.pipe(v.string("Email must be text"), v.email("Please enter a valid email address"), v.minLength(1, "Email is required"));
-const PasswordSchema = v.pipe(v.string("Password must be text"), v.minLength(8, "Password must be at least 8 characters long"), v.regex(/[A-Z]/, "Password must contain at least one uppercase letter"), v.regex(/[a-z]/, "Password must contain at least one lowercase letter"), v.regex(/[0-9]/, "Password must contain at least one number"));
-/**
-* Username validation schema
-* - Must be 4-24 characters
-* - Only letters, numbers, underscores, and periods
+* Username validation schema
+* - Must be 4-24 characters
+* - Only letters, numbers, underscores, and periods
 */
 const UsernameSchema = v.pipe(v.string("Username must be text"), v.minLength(4, "Username must be 4-24 characters long"), v.maxLength(24, "Username must be 4-24 characters long"), v.regex(/^[a-z0-9_.]+$/, "Username can only contain lowercase letters, numbers, dots and underscores"));
 /**
@@ -3169,55 +2924,491 @@ const listSocials = async () => {
 		});
 	}, { [HTTP_STATUS.UNAUTHORIZED]: () => /* @__PURE__ */ new Error("User is not authorized to list providers!") });
 };
-const connectSocialInternal = async (provider, token) => {
-	return apiCall(async () => {
-		const requestBody = validateInput(ConnectProviderSchema, {
-			provider,
-			token
-		});
-		const { data } = await authV1ProvidersServiceConnectProvider({
-			body: {
-				provider: toProtoProvider(normalizeProviderType(requestBody.provider)),
-				token: requestBody.token
-			},
-			throwOnError: true
-		});
-		persistTokens(data);
-	}, { [HTTP_STATUS.UNAUTHORIZED]: () => /* @__PURE__ */ new Error("User is not authorized to connect provider!") });
+const connectSocialInternal = async (provider, token) => {
+	return apiCall(async () => {
+		const requestBody = validateInput(ConnectProviderSchema, {
+			provider,
+			token
+		});
+		const sessionToken = await getToken();
+		const headers = sessionToken ? { Authorization: `Bearer ${sessionToken}` } : {};
+		const { data } = await authV1ProvidersServiceConnectProvider({
+			body: {
+				provider: toProtoProvider(normalizeProviderType(requestBody.provider)),
+				token: requestBody.token
+			},
+			headers,
+			throwOnError: true
+		});
+		persistTokens(data);
+	}, { [HTTP_STATUS.UNAUTHORIZED]: () => /* @__PURE__ */ new Error("User is not authorized to connect provider!") });
+};
+const disconnectSocial = async (provider) => {
+	return apiCall(async () => {
+		await authV1ProvidersServiceDisconnectProvider({
+			path: { provider: toProtoProvider(provider) },
+			throwOnError: true
+		});
+	}, {
+		[HTTP_STATUS.UNAUTHORIZED]: () => /* @__PURE__ */ new Error("User is not authorized to disconnect provider!"),
+		[HTTP_STATUS.NOT_FOUND]: () => /* @__PURE__ */ new Error("Provider not found!"),
+		[HTTP_STATUS.BAD_REQUEST]: () => /* @__PURE__ */ new Error("Cannot disconnect the last social provider!")
+	});
+};
+const connectSocial = (provider) => {
+	setSocialConnectAttempt(provider);
+	login(provider);
+};
+
+//#endregion
+//#region src/auth/api/refresh-tokens.ts
+/**
+* Exchange a provider credential for a Rixl session, or refresh an existing
+* Rixl session with a Bearer refresh token.
+*
+* - For `AuthProvider.BEARER`, the call hits `/auth/v1/token` with the stored
+*   Rixl refresh token.
+* - For OAuth/Telegram providers, the call hits `/auth/v1/providers/connect`
+*   with the provider's `id_token` or Telegram payload. The wire `provider`
+*   value is the `auth.v1.ExternalAccountProvider` enum (e.g.
+*   `EXTERNAL_ACCOUNT_PROVIDER_GOOGLE`), not the short SDK name.
+*/
+const refreshTokens = async (provider, token, options) => {
+	if (provider === "Bearer") {
+		const { data } = await authV1TokenServiceRefreshToken({
+			body: {
+				token_type: "Bearer",
+				refresh_token: token,
+				country_code: options?.countryCode,
+				origin: options?.origin
+			},
+			throwOnError: true
+		});
+		return data;
+	}
+	const requestProvider = normalizeProviderType(provider);
+	const { data } = await authV1ProvidersServiceConnectProvider({
+		body: {
+			provider: toProtoProvider(requestProvider),
+			token,
+			country_code: options?.countryCode,
+			origin: options?.origin
+		},
+		throwOnError: true
+	});
+	return data;
+};
+
+//#endregion
+//#region src/auth/cookie/util.ts
+const splitOnFirstEquals = (pair) => {
+	const trimmed = pair.trim();
+	const separator = trimmed.indexOf("=");
+	return separator === -1 ? [trimmed, ""] : [trimmed.slice(0, separator), trimmed.slice(separator + 1).trim()];
+};
+const getAllCookiesStartWith = (startWithKey) => {
+	if (typeof document === "undefined") return {};
+	return document.cookie.split(";").map(splitOnFirstEquals).filter(([key]) => key && key !== startWithKey && key.startsWith(startWithKey)).reduce((ac, [key, value]) => Object.assign(ac, { [key.slice(startWithKey.length + 1)]: value }), {});
+};
+function setCookie(name, value, options) {
+	if (typeof document === "undefined") return;
+	let cookieString = `${encodeName(name)}=${encodeValue(value)}`;
+	if (options) {
+		if (options.expires) if (typeof options.expires === "number") {
+			const date = /* @__PURE__ */ new Date();
+			date.setTime(date.getTime() + options.expires * 24 * 60 * 60 * 1e3);
+			cookieString += `; expires=${date.toUTCString()}`;
+		} else cookieString += `; expires=${options.expires.toUTCString()}`;
+		if (options.path) cookieString += `; path=${options.path}`;
+		if (options.domain) cookieString += `; domain=${options.domain}`;
+		if (options.secure) cookieString += `; secure`;
+		if (options.sameSite) cookieString += `; samesite=${options.sameSite}`;
+	}
+	document.cookie = cookieString;
+}
+function deleteCookie(name) {
+	if (typeof document === "undefined") return;
+	document.cookie = name + "=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;";
+}
+const encodeName = (name) => encodeURIComponent(name).replace(/%(2[346B]|5E|60|7C)/g, decodeURIComponent);
+const encodeValue = (value) => encodeURIComponent(value).replace(/%(2[346BF]|3[AC-F]|40|5[BDE]|60|7[BCD])/g, decodeURIComponent);
+
+//#endregion
+//#region src/auth/cookie/index.ts
+const initVals = getAllCookiesStartWith(GLOBAL_PREFIX);
+const setStoreCookie = (key, value) => {
+	const expires = /* @__PURE__ */ new Date();
+	expires.setTime(expires.getTime() + 30 * 24 * 60 * 60 * 1e3);
+	const cookieKey = `${GLOBAL_PREFIX}_${key}`;
+	if (!value || value === "") {
+		deleteCookie(cookieKey);
+		return;
+	}
+	const stringValue = typeof value === "string" ? value : JSON.stringify(value);
+	setCookie(`${GLOBAL_PREFIX}_${key}`, stringValue, {
+		expires,
+		path: "/",
+		sameSite: "Lax"
+	});
+};
+
+//#endregion
+//#region src/auth/userStore.ts
+const userPath = GLOBAL_PREFIX + "_user";
+const parseUser = () => {
+	if (typeof localStorage === "undefined" || !localStorage || typeof localStorage.getItem !== "function") return;
+	const value = localStorage.getItem(userPath);
+	if (value && value != "undefined") try {
+		return JSON.parse(value);
+	} catch (err) {
+		console.warn("Can't parse user data, error: ", err);
+		return;
+	}
+};
+const user = shared("user", () => {
+	const store = atom(parseUser());
+	store.subscribe((value) => {
+		if (typeof localStorage === "undefined" || !localStorage || typeof localStorage.setItem !== "function") return;
+		if (value) localStorage.setItem(userPath, JSON.stringify(value));
+		else localStorage.removeItem(userPath);
+	});
+	return store;
+});
+
+//#endregion
+//#region src/auth/utils/jwt.ts
+/**
+* Decodes a JWT token and extracts user information
+* Uses jose library for modern, secure JWT handling
+* @param token The JWT token to decode
+* @returns The decoded user data or undefined if decoding fails
+*/
+const decodeToken = (token) => {
+	try {
+		const decodedUser = decodeJwt(token);
+		return {
+			id: decodedUser.id,
+			email: decodedUser.email,
+			first_name: decodedUser.first_name,
+			last_name: decodedUser.last_name,
+			username: decodedUser.username,
+			image_url: decodedUser.image_url,
+			language_code: decodedUser.language_code,
+			org_id: decodedUser.org_id
+		};
+	} catch (error) {
+		console.warn("Failed to decode JWT token. Error: ", error);
+		return;
+	}
+};
+/**
+* Decodes a JWT token and sets the user in the store
+* @param token The JWT token to decode
+* @returns True if user was successfully decoded and set, false otherwise
+*/
+const decodeAndSetUser = (token) => {
+	const userData = decodeToken(token);
+	if (userData) {
+		user.set(userData);
+		return true;
+	}
+	return false;
+};
+/**
+* Checks if a token is expired based on the expiration timestamp
+* @param expireAt The expiration timestamp in milliseconds
+* @returns True if the token is expired, false otherwise
+*/
+const isTokenExpired = (expireAt) => {
+	if (!expireAt) return true;
+	return Date.now() >= expireAt;
+};
+
+//#endregion
+//#region src/auth/authStore.ts
+const isLogged = shared("isLogged", () => atom(initVals["isLogged"] === "true"));
+const accessToken = shared("accessToken", () => atom(initVals["accessToken"]));
+const refreshToken = shared("refreshToken", () => atom(initVals["refreshToken"]));
+const expireAt = shared("expireAt", () => atom(Number(initVals["expireAt"])));
+const authError = shared("authError", () => atom(null));
+const requiresAction = shared("requiresAction", () => atom(initVals["requiresAction"] || null));
+const limitedAccessToken = shared("limitedAccessToken", () => atom(initVals["limitedAccessToken"] || null));
+const inFlight = shared("getTokenPromise", () => ({ promise: null }));
+const PROVIDER_URL_MAP = {
+	google: googleAuthUrl,
+	apple: appleAuthUrl,
+	microsoft: microsoftAuthUrl,
+	telegram: telegramAuthUrl
+};
+const login = async (provider) => {
+	await initDeferred.promise;
+	const authUrlAtom = PROVIDER_URL_MAP[provider];
+	if (!authUrlAtom) throw new Error(`Unsupported provider: ${provider}`);
+	const authUrl = authUrlAtom.get();
+	if (authUrl) window.location.href = authUrl;
+	else throw new Error(`${provider} provider is not configured. Please check your initClient configuration.`);
+};
+const refreshAccessToken = async (refresh) => {
+	const result = await refreshTokens("Bearer", refresh);
+	if (!("requires_action" in result)) setTokens(result.access_token, result.refresh_token, result.expires_in);
+};
+const ensureValidAccessToken = async (refresh) => {
+	if (accessToken.get() && !isTokenExpired(expireAt.get())) return;
+	try {
+		await refreshAccessToken(refresh);
+	} catch (refreshError) {
+		console.error("Token refresh failed in getToken:", refreshError);
+		removeTokens();
+		throw refreshError;
+	}
+};
+const getToken = async () => {
+	if (inFlight.promise) return inFlight.promise;
+	inFlight.promise = (async () => {
+		try {
+			await initDeferred.promise;
+			if (requiresAction.get()) return void 0;
+			const currentRefreshToken = refreshToken.get();
+			if (!currentRefreshToken) return void 0;
+			await ensureValidAccessToken(currentRefreshToken);
+			const token = accessToken.get();
+			if (token) decodeAndSetUser(token);
+			return token;
+		} catch (error) {
+			console.warn("Failed to getToken(). Error: ", error);
+			throw error;
+		} finally {
+			inFlight.promise = null;
+		}
+	})();
+	return inFlight.promise;
+};
+/**
+* Sets authentication tokens in the store
+* @param access The access token
+* @param refresh The refresh token
+* @param expiresIn The token expiration time in seconds
+*/
+const setTokens = (access, refresh, expiresIn) => {
+	accessToken.set(access);
+	refreshToken.set(refresh);
+	expireAt.set(Date.now() + expiresIn * 1e3);
+	isLogged.set(true);
+	limitedAccessToken.set(null);
+	requiresAction.set(null);
+	authError.set(null);
+	decodeAndSetUser(access);
+};
+/**
+* Removes authentication tokens from the store
+*/
+const removeTokens = () => {
+	accessToken.set("");
+	refreshToken.set("");
+	expireAt.set(0);
+	isLogged.set(false);
+	user.set(void 0);
+	limitedAccessToken.set(null);
+	requiresAction.set(null);
+	authError.set(null);
 };
-const disconnectSocial = async (provider) => {
-	return apiCall(async () => {
-		await authV1ProvidersServiceDisconnectProvider({
-			path: { provider: toProtoProvider(provider) },
-			throwOnError: true
-		});
-	}, {
-		[HTTP_STATUS.UNAUTHORIZED]: () => /* @__PURE__ */ new Error("User is not authorized to disconnect provider!"),
-		[HTTP_STATUS.NOT_FOUND]: () => /* @__PURE__ */ new Error("Provider not found!"),
-		[HTTP_STATUS.BAD_REQUEST]: () => /* @__PURE__ */ new Error("Cannot disconnect the last social provider!")
-	});
+/**
+* Clears the auth error from the store
+*/
+const clearAuthError = () => {
+	authError.set(null);
 };
-const connectSocial = (provider) => {
-	setSocialConnectAttempt(provider);
-	login(provider);
+/**
+* Sets limited access state for users requiring additional action (e.g., Telegram users without email)
+* @param token The limited scope access token
+* @param action The required action (e.g., "add_email")
+*/
+const setLimitedAccessState = (token, action) => {
+	limitedAccessToken.set(token);
+	requiresAction.set(action);
+	authError.set(null);
+	isLogged.set(true);
 };
+/**
+* Clears the limited access state (after email verification completes or user logs out)
+*/
+const clearLimitedAccessState = () => {
+	limitedAccessToken.set(null);
+	requiresAction.set(null);
+	if (!(!!accessToken.get() && !!refreshToken.get())) isLogged.set(false);
+};
+isLogged.subscribe((value) => setStoreCookie("isLogged", value));
+accessToken.subscribe((value) => setStoreCookie("accessToken", value));
+refreshToken.subscribe((value) => setStoreCookie("refreshToken", value));
+expireAt.subscribe((value) => setStoreCookie("expireAt", value));
+requiresAction.subscribe((value) => setStoreCookie("requiresAction", value));
+limitedAccessToken.subscribe((value) => setStoreCookie("limitedAccessToken", value));
 
 //#endregion
-//#region src/auth/api/client-core.ts
-let tokenRefreshFunction = null;
+//#region src/auth/api-url.ts
 /**
-* Sets the token refresh function used by the API client
-* This should be called during initialization
+* Global API base URL store
 */
-const setTokenRefreshFunction = (fn) => {
-	tokenRefreshFunction = fn ?? null;
-};
+const apiURL = shared("apiURL", () => atom(""));
+
+//#endregion
+//#region src/auth/api/sdk-client.ts
+function isWireErrorBody(error) {
+	return typeof error === "object" && error !== null;
+}
+const state = shared("sdkClientState", () => ({
+	configured: false,
+	tokenResolver: getToken
+}));
+function setTokenResolver(resolver) {
+	state.tokenResolver = resolver;
+}
+/**
+* Routes that do not require a Bearer token at the gateway edge. These
+* authenticate via credentials in the request body (or are webhooks verified by
+* signature), so attaching an Authorization header here would make the gateway
+* attempt to validate a stale/absent token and reject the request with 401.
+* Mirrors `publicRoutes` in backend/gateway/internal/routes/routes.go.
+*/
+const publicRoutes = [
+	{
+		method: "POST",
+		path: "/auth/v1/token"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/register"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/login"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/email/verify"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/email/verify/resend"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/password/reset"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/password/reset/confirm"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/verify-totp"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/verify-passkey"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/invitations/",
+		prefix: true
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/passkey/login/begin"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/passkey/login/finish"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/logout"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/providers/connect"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/blog/unsubscribe/email"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/blog/broadcast"
+	},
+	{
+		method: "GET",
+		path: "/media/v1/videos/",
+		prefix: true
+	},
+	{
+		method: "GET",
+		path: "/media/v1/images/",
+		prefix: true
+	},
+	{
+		method: "GET",
+		path: "/media/v1/languages"
+	},
+	{
+		method: "GET",
+		path: "/posts/v1/feeds/",
+		prefix: true
+	},
+	{
+		method: "POST",
+		path: "/billing/webhooks/stripe"
+	},
+	{
+		method: "POST",
+		path: "/webhooks/storage"
+	},
+	{
+		method: "POST",
+		path: "/platform/auth/v1/token"
+	},
+	{
+		method: "POST",
+		path: "/platform/auth/v1/refresh"
+	}
+];
+function isPublicRoute(method, pathname) {
+	const match = method.toUpperCase();
+	return publicRoutes.some(({ method: m, path, prefix }) => match === m && (prefix ? pathname.startsWith(path) : pathname === path));
+}
+function configureSdkClient() {
+	if (state.configured) return;
+	state.configured = true;
+	configureAllClients(apiURL.get());
+	apiURL.subscribe((url) => {
+		configureAllClients(url);
+	});
+	addClientInitializer((client) => {
+		client.interceptors.request.use(async (request) => {
+			if (request.headers.has("Authorization")) return request;
+			const { pathname } = new URL(request.url);
+			if (isPublicRoute(request.method, pathname)) return request;
+			const token = await state.tokenResolver();
+			if (!token) throw new ApiError("No access token available for an authenticated request", HTTP_STATUS.UNAUTHORIZED, pathname);
+			request.headers.set("Authorization", `Bearer ${token}`);
+			return request;
+		});
+		client.interceptors.error.use((error, response, request) => {
+			if (error instanceof Error) return error;
+			const body = isWireErrorBody(error) ? error : void 0;
+			const status = response?.status ?? body?.code ?? 0;
+			const message = body?.error || body?.details || (typeof error === "string" ? error : "Request failed");
+			const endpoint = request ? new URL(request.url).pathname : "";
+			return new ApiError(message, status, endpoint, error);
+		});
+	});
+}
 
 //#endregion
 //#region src/auth/authConfig.ts
-let loginRedirectUrl;
+const config = shared("authConfig", () => ({ loginRedirectUrl: void 0 }));
 const setLoginRedirectUrl = (url) => {
-	loginRedirectUrl = url;
+	config.loginRedirectUrl = url;
 };
 
 //#endregion
@@ -3228,24 +3419,26 @@ const setLoginRedirectUrl = (url) => {
 * @returns A promise that resolves to the current access token (if available)
 */
 const initClient = async (config) => {
-	await initConfig(config);
-	await initPage();
-	initDeferred.resolve();
-	await initSocials();
+	try {
+		await runInitSequence(config);
+	} finally {
+		completeOAuthCallback();
+	}
 	return getToken();
 };
+const runInitSequence = async (config) => {
+	try {
+		await initConfig(config);
+		await initPage();
+	} finally {
+		initDeferred.resolve();
+	}
+	await initSocials();
+};
 const initConfig = async (config) => {
 	apiURL.set(config.apiUrl);
 	configureSdkClient();
 	setLoginRedirectUrl(config.loginRedirectUrl);
-	setTokenRefreshFunction(async () => {
-		const currentRefreshToken = refreshToken.get();
-		if (currentRefreshToken) {
-			const result = await refreshTokens("Bearer", currentRefreshToken);
-			if (result && !("requires_action" in result)) setTokens(result.access_token, result.refresh_token, result.expires_in);
-			return getToken();
-		}
-	});
 	if (config.googleProvider) {
 		googleConfig.set(config.googleProvider);
 		updateGoogleAuthUrl();
@@ -3293,9 +3486,15 @@ const extractAuthErrorInfo = (error) => {
 };
 const handleInitPageApiError = (error) => {
 	const info = extractAuthErrorInfo(error);
-	if (error.status === HTTP_STATUS.BAD_REQUEST && info.error === "invalid_grant") return setAuthErrorAndClear("email_not_verified", info.description, info.email);
-	if (error.status === HTTP_STATUS.CONFLICT) return setAuthErrorAndClear("provider_conflict", info.description, info.email);
-	return false;
+	if (error.status === HTTP_STATUS.BAD_REQUEST && info.error === "invalid_grant") {
+		setAuthErrorAndClear("email_not_verified", info.description, info.email);
+		return;
+	}
+	if (error.status === HTTP_STATUS.CONFLICT) {
+		setAuthErrorAndClear("provider_conflict", info.description, info.email);
+		return;
+	}
+	setAuthErrorAndClear("provider_exchange_failed", info.error || info.description, info.email);
 };
 const exchangeProviderToken = async (provider, token) => {
 	const result = await refreshTokens(provider, token);
@@ -3303,14 +3502,18 @@ const exchangeProviderToken = async (provider, token) => {
 };
 const initPage = async () => {
 	const provider = detectProvider();
-	if (!provider) return void 0;
+	if (!provider) {
+		if (hasProviderResponse()) logUnusableProviderResponse();
+		return;
+	}
 	const token = getProviderToken(provider);
 	if (!token) return void 0;
 	try {
 		await exchangeProviderToken(provider, token);
 	} catch (error) {
-		if (error instanceof ApiError && handleInitPageApiError(error)) return;
-		throw error;
+		logProviderExchangeFailure(provider, token, error);
+		if (!(error instanceof ApiError)) throw error;
+		handleInitPageApiError(error);
 	}
 };
 const initSocials = async () => {
@@ -3734,8 +3937,9 @@ const getUserInfo = async (userId) => {
 };
 const updateFullName = async (fullName) => {
 	return apiCall(async () => {
+		const validatedInput = validateInput(UpdateNameSchema, { full_name: fullName });
 		await authV1UserServiceUpdateName({
-			body: validateInput(UpdateNameSchema, { full_name: fullName }),
+			body: validatedInput,
 			throwOnError: true
 		});
 	}, {
@@ -3746,8 +3950,9 @@ const updateFullName = async (fullName) => {
 };
 const updateUsername = async (username) => {
 	return apiCall(async () => {
+		const validatedInput = validateInput(UpdateUsernameSchema, { username });
 		await authV1UserServiceUpdateUsername({
-			body: validateInput(UpdateUsernameSchema, { username }),
+			body: validatedInput,
 			throwOnError: true
 		});
 	}, {
@@ -3777,8 +3982,9 @@ const setupUserOTP = async () => {
 };
 const verifyUserOTP = async (code) => {
 	return apiCall(async () => {
+		const validatedBody = validateInput(VerifyOTPCodeSchema, { code });
 		const { data } = await authV1OtpServiceVerifyOtp({
-			body: validateInput(VerifyOTPCodeSchema, { code }),
+			body: validatedBody,
 			throwOnError: true
 		});
 		persistTokens(data);
@@ -3861,11 +4067,12 @@ const loginWithEmail = async (email, password) => {
 };
 const verifyTOTPForLogin = async (code, session_id) => {
 	return apiCall(async () => {
+		const validatedInput = validateInput(LoginOTPVerifyRequestSchema, {
+			code,
+			session_id
+		});
 		const { data } = await authV1OtpServiceVerifyTotpForLogin({
-			body: validateInput(LoginOTPVerifyRequestSchema, {
-				code,
-				session_id
-			}),
+			body: validatedInput,
 			throwOnError: true
 		});
 		persistTokens(data);
@@ -3916,13 +4123,14 @@ function isApiErrorBody(error) {
 //#region src/auth/auth/register.ts
 const registerWithEmail = async (email, password, subscribeToBlog, countryCode) => {
 	return apiCall(async () => {
+		const validatedInput = validateInput(RegisterRequestSchema, {
+			email,
+			password,
+			country_code: countryCode,
+			subscribe_to_blog: subscribeToBlog
+		});
 		const { data } = await authV1EmailServiceRegister({
-			body: validateInput(RegisterRequestSchema, {
-				email,
-				password,
-				country_code: countryCode,
-				subscribe_to_blog: subscribeToBlog
-			}),
+			body: validatedInput,
 			throwOnError: true
 		});
 		if (data.verification_id) return {
@@ -3935,8 +4143,9 @@ const registerWithEmail = async (email, password, subscribeToBlog, countryCode)
 };
 const resendEmailVerificationCode = async (email) => {
 	return apiCall(async () => {
+		const validatedInput = validateInput(ResendEmailRequestSchema, { email });
 		const { data } = await authV1EmailServiceResendVerification({
-			body: validateInput(ResendEmailRequestSchema, { email }),
+			body: validatedInput,
 			throwOnError: true
 		});
 		if (data.verification_id) return {
@@ -3954,19 +4163,21 @@ const resendEmailVerificationCode = async (email) => {
 //#region src/auth/auth/password.ts
 const sendPasswordResetEmail = async (email) => {
 	return apiCall(async () => {
+		const validatedInput = validateInput(ResendEmailRequestSchema, { email });
 		await authV1EmailServiceSendPasswordReset({
-			body: validateInput(ResendEmailRequestSchema, { email }),
+			body: validatedInput,
 			throwOnError: true
 		});
 	}, { [HTTP_STATUS.BAD_REQUEST]: () => /* @__PURE__ */ new Error("Bad request - invalid email or validation error") });
 };
 const confirmPasswordReset = async (token, password) => {
 	return apiCall(async () => {
+		const validatedInput = validateInput(ResetPasswordRequestSchema, {
+			token,
+			new_password: password
+		});
 		await authV1EmailServiceResetPassword({
-			body: validateInput(ResetPasswordRequestSchema, {
-				token,
-				new_password: password
-			}),
+			body: validatedInput,
 			throwOnError: true
 		});
 	}, { [HTTP_STATUS.BAD_REQUEST]: () => /* @__PURE__ */ new Error("Bad request - invalid token or password") });
@@ -3976,8 +4187,9 @@ const confirmPasswordReset = async (token, password) => {
 //#region src/auth/auth/email.ts
 const initiateEmailChange = async (email) => {
 	return apiCall(async () => {
+		const validatedInput = validateInput(ChangeEmailRequestSchema, { new_email: email });
 		const { data } = await authV1EmailServiceInitiateEmailChange({
-			body: validateInput(ChangeEmailRequestSchema, { new_email: email }),
+			body: validatedInput,
 			throwOnError: true
 		});
 		if (data.verification_id) return {
@@ -3994,8 +4206,9 @@ const initiateEmailChange = async (email) => {
 };
 const addEmail = async (email) => {
 	return apiCall(async () => {
+		const validatedInput = validateInput(ResendEmailRequestSchema, { email });
 		const { data } = await authV1EmailServiceAddEmail({
-			body: validateInput(ResendEmailRequestSchema, { email }),
+			body: validatedInput,
 			throwOnError: true
 		});
 		if (data.verification_id) return {
@@ -4289,10 +4502,11 @@ function serializeRegistrationCredential(cred) {
 }
 const finishPasskeyLogin = async (session_id, credential) => {
 	return apiCall(async () => {
+		const serialized = serializeLoginCredential(credential);
 		const { data } = await authV1PasskeyServicePasskeyLoginFinish({
 			body: {
 				session_id,
-				credential: serializeLoginCredential(credential)
+				credential: serialized
 			},
 			throwOnError: true
 		});
@@ -4332,11 +4546,12 @@ const beginPasskeyRegistration = async () => {
 };
 const finishPasskeyRegistration = async (session_id, name, credential) => {
 	return apiCall(async () => {
+		const serialized = serializeRegistrationCredential(credential);
 		const { data } = await authV1PasskeyServicePasskeyRegisterFinish({
 			body: {
 				session_id,
 				name,
-				credential: serializeRegistrationCredential(credential)
+				credential: serialized
 			},
 			throwOnError: true
 		});
@@ -4383,10 +4598,11 @@ const listPasskeys = async () => {
 };
 const verifyPasskeyForLogin = async (session_id, credential) => {
 	return apiCall(async () => {
+		const serialized = serializeLoginCredential(credential);
 		const { data } = await authV1PasskeyServiceVerifyPasskeyForLogin({
 			body: {
 				session_id,
-				credential: serializeLoginCredential(credential)
+				credential: serialized
 			},
 			throwOnError: true
 		});