@robelest/convex-auth 0.0.4-preview.18 → 0.0.4-preview.19

package/dist/client/index.js

@@ -1,4 +1,11 @@
 import { AUTH_ERRORS, isAuthError, parseAuthError } from "../server/errors.js";
+import { browserMutex, getStorageListenerRegistry } from "../runtime/browser.js";
+import { createDeviceClient } from "../factors/device.js";
+import { createInviteManager } from "../runtime/invite.js";
+import { createPasskeyClient } from "../factors/passkey.js";
+import { createProxyHelpers, isRetriableProxyRefreshError, isTransientNetworkError } from "../runtime/proxy.js";
+import { createStorageHelpers } from "../runtime/storage.js";
+import { createTotpClient } from "../factors/totp.js";
 import { Fx } from "@robelest/fx";
 import { ConvexHttpClient } from "convex/browser";
 import { ConvexError } from "convex/values";
@@ -12,7 +19,6 @@ const INVITE_EMAIL_KEY = "__convexAuthPendingInviteEmail";
 const RETRY_BASE_MS = 500;
 const RETRY_MAX_RETRIES = 2;
 const AUTH_HANDSHAKE_TIMEOUT_MS = 5e3;
-const NETWORK_ERROR_PATTERN = /(network|fetch|load failed|failed to fetch)/i;
 /**
 * Resolve the Convex deployment URL from the client.
 *
@@ -26,17 +32,6 @@ function resolveUrl(convex, explicit) {
 	if (typeof url === "string") return url;
 	throw new Error("Could not determine Convex deployment URL. Pass `url` explicitly.");
 }
-function isTransientNetworkError(error) {
-	return error instanceof TypeError || error instanceof Error && NETWORK_ERROR_PATTERN.test(error.message || "");
-}
-function isRetriableProxyRefreshError(error) {
-	if (isTransientNetworkError(error)) return true;
-	if (!(error instanceof Error)) return false;
-	const statusMatch = error.message.match(/Proxy request failed:\s*(\d{3})/);
-	if (statusMatch === null) return false;
-	const statusCode = Number(statusMatch[1]);
-	return statusCode >= 500 && statusCode < 600;
-}
 /**
 * Create a framework-agnostic auth client.
 *
@@ -69,7 +64,10 @@ function isRetriableProxyRefreshError(error) {
 * holds the JWT in memory only.
 *
 * @param options - Client configuration. See {@link ClientOptions}.
+* @typeParam Api - An AuthApiRefs type determining which factor helpers are available.
 * @returns Auth client with conditional `passkey`, `totp`, and `device` helpers.
+* @throws {Error} When the Convex deployment URL cannot be determined and `url` is not passed explicitly.
+* @throws {Error} When `proxyPath` is not set and the `api` option is missing.
 */
 function client(options) {
 	const { convex, proxyPath, api: apiRefs } = options;
@@ -88,6 +86,21 @@ function client(options) {
 		if (typeof window !== "undefined") return new URL(window.location.href);
 		return null;
 	}
+	/**
+	* SSR-safe URL parameter reader.
+	*
+	* Uses the `location` option if provided, otherwise falls back to
+	* `window.location` (returns `null` during SSR where `window` is unavailable).
+	*
+	* @param name - The query parameter name.
+	* @returns The parameter value, or `null` if not present or in SSR.
+	*
+	* @example
+	* ```ts
+	* const workspaceId = auth.param("workspace");
+	* const tab = auth.param("tab") ?? "issues";
+	* ```
+	*/
 	function param(name) {
 		return getLocation()?.searchParams.get(name) ?? null;
 	}
@@ -105,6 +118,11 @@ function client(options) {
 	const url = proxy ? void 0 : resolveUrl(convex, options.url);
 	const escapedNamespace = proxy ? proxy.replace(/[^a-zA-Z0-9]/g, "") : url.replace(/[^a-zA-Z0-9]/g, "");
 	const key = (name) => `${name}_${escapedNamespace}`;
+	const { get: storageGet, set: storageSet, remove: storageRemove } = createStorageHelpers({
+		storage,
+		key
+	});
+	const { isAbsoluteUrl, proxyFetch, resolveProxyUrl } = createProxyHelpers({ proxy });
 	const subscribers = /* @__PURE__ */ new Set();
 	let disposeStorageListener = null;
 	const httpClient = proxy ? null : new ConvexHttpClient(url);
@@ -212,68 +230,18 @@ function client(options) {
 		isLoading = false;
 		if (updateSnapshot()) notify();
 	};
-	const storageGet = async (name) => {
-		if (!storage) return null;
-		return Fx.run(Fx.from({
-			ok: async () => await storage.getItem(key(name)) ?? null,
-			err: (e) => e
-		}).pipe(Fx.inspect((error) => Fx.sync(() => console.error(`[convex-auth] Failed to read ${name} from storage:`, error))), Fx.recover(() => Fx.succeed(null))));
-	};
-	const storageSet = async (name, value) => {
-		if (!storage) return;
-		await Fx.run(Fx.from({
-			ok: () => storage.setItem(key(name), value),
-			err: (e) => e
-		}).pipe(Fx.inspect((error) => Fx.sync(() => console.error(`[convex-auth] Failed to write ${name} to storage:`, error))), Fx.recover(() => Fx.succeed(void 0))));
-	};
-	const storageRemove = async (name) => {
-		if (!storage) return;
-		await Fx.run(Fx.from({
-			ok: () => storage.removeItem(key(name)),
-			err: (e) => e
-		}).pipe(Fx.inspect((error) => Fx.sync(() => console.error(`[convex-auth] Failed to remove ${name} from storage:`, error))), Fx.recover(() => Fx.succeed(void 0))));
-	};
-	let pendingInvite = null;
-	const urlInviteToken = param("invite");
-	if (urlInviteToken) pendingInvite = {
-		token: urlInviteToken,
-		email: param("email")
-	};
-	else (async () => {
-		const storedToken = await storageGet(INVITE_TOKEN_KEY);
-		if (storedToken && !pendingInvite) {
-			pendingInvite = {
-				token: storedToken,
-				email: await storageGet(INVITE_EMAIL_KEY) ?? null
-			};
-			storageRemove(INVITE_TOKEN_KEY);
-			storageRemove(INVITE_EMAIL_KEY);
-		}
-	})();
-	async function persistInvite() {
-		if (!pendingInvite) return;
-		await storageSet(INVITE_TOKEN_KEY, pendingInvite.token);
-		if (pendingInvite.email) await storageSet(INVITE_EMAIL_KEY, pendingInvite.email);
-	}
-	/**
-	* Consume the pending invite: clears storage/URL and returns the token.
-	* The app uses the returned token to call its own accept mutation.
-	*/
-	async function acceptInvite() {
-		if (!pendingInvite) return {
-			ok: false,
-			message: "No pending invite"
-		};
-		const { token: token$1 } = pendingInvite;
-		pendingInvite = null;
-		storageRemove(INVITE_TOKEN_KEY);
-		storageRemove(INVITE_EMAIL_KEY);
-		cleanUrlParams(["invite", "email"]);
-		return {
-			ok: true,
-			token: token$1
-		};
-	}
+	const inviteManager = createInviteManager({
+		param,
+		storageGet,
+		storageSet,
+		storageRemove,
+		cleanUrlParams,
+		tokenKey: INVITE_TOKEN_KEY,
+		emailKey: INVITE_EMAIL_KEY
+	});
+	const getPendingInvite = () => inviteManager.getPendingInvite();
+	const persistInvite = () => inviteManager.persistInvite();
+	const acceptInvite = () => inviteManager.acceptInvite();
 	const bindConvexAuth = () => {
 		convex.setAuth(fetchAccessToken, handleConvexAuthChange);
 	};
@@ -323,45 +291,6 @@ function client(options) {
 		if (waitForHandshake) await waitForAuthHandshake(context);
 		return true;
 	};
-	const resolveProxyUrl = () => {
-		const origin = typeof window !== "undefined" && typeof window.location?.origin === "string" ? window.location.origin : typeof location !== "undefined" && typeof location.origin === "string" ? location.origin : null;
-		if (origin !== null) return new URL(proxy, origin).toString();
-		return Fx.run(Fx.from({
-			ok: () => new URL(proxy).toString(),
-			err: () => proxy
-		}).pipe(Fx.recover((fallback) => Fx.succeed(fallback))));
-	};
-	const isAbsoluteUrl = (value) => {
-		return Fx.run(Fx.from({
-			ok: () => {
-				new URL(value);
-				return true;
-			},
-			err: () => false
-		}).pipe(Fx.recover((v) => Fx.succeed(v))));
-	};
-	const proxyFetch = async (body) => {
-		const proxyUrl = await resolveProxyUrl();
-		if (typeof window === "undefined" && !await isAbsoluteUrl(proxyUrl)) throw new Error(`Cannot call relative proxy URL \`${proxy}\` without a browser origin. Pass an absolute proxy URL for server runtimes.`);
-		const response = await fetch(proxyUrl, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			credentials: "include",
-			body: JSON.stringify(body)
-		});
-		if (!response.ok) {
-			const errorBody = await Fx.run(Fx.from({
-				ok: () => response.json(),
-				err: () => ({})
-			}).pipe(Fx.recover((fallback) => Fx.succeed(fallback))));
-			if (typeof errorBody === "object" && errorBody !== null && "authError" in errorBody && typeof errorBody.authError === "object") throw new ConvexError(errorBody.authError);
-			throw new Error(errorBody.error ?? `Proxy request failed: ${response.status}`);
-		}
-		return Fx.run(Fx.from({
-			ok: () => response.json(),
-			err: () => /* @__PURE__ */ new Error("Proxy response was not valid JSON")
-		}).pipe(Fx.recover((e) => Fx.fatal(e))));
-	};
 	const verifyCode = async (args) => {
 		const verifyCodeRetryPolicy = Fx.retry.while(Fx.retry.compose(Fx.retry.jittered(Fx.retry.exponential(RETRY_BASE_MS)), Fx.retry.recurs(RETRY_MAX_RETRIES)), (meta) => isTransientNetworkError(meta.input));
 		return Fx.run(Fx.from({
@@ -385,8 +314,8 @@ function client(options) {
 		return {
 			deviceCode: device_code.deviceCode,
 			userCode: device_code.userCode,
-			verification_uri: device_code.verification_uri ?? device_code.verificationUri,
-			verification_uri_complete: device_code.verification_uri_complete ?? device_code.verificationUriComplete,
+			verificationUri: device_code.verification_uri ?? device_code.verificationUri,
+			verificationUriComplete: device_code.verification_uri_complete ?? device_code.verificationUriComplete,
 			expiresIn: device_code.expiresIn,
 			interval: device_code.interval
 		};
@@ -399,6 +328,7 @@ function client(options) {
 	* @param args - Provider-specific arguments. Pass a `Record<string, Value>`
 	*   or `FormData`. Common fields: `email`, `password`, `code`, `redirectTo`.
 	* @returns A {@link SignInResult} indicating the outcome.
+	* @throws {ConvexError} When the server action rejects the sign-in attempt (e.g. invalid credentials, provider error, or rate limiting).
 	*
 	* @example Email magic link
 	* ```ts
@@ -668,29 +598,13 @@ function client(options) {
 			err: (e) => e
 		}).pipe(Fx.recover(() => Fx.succeed(void 0))))));
 	}, "[convex-auth] SPA initialization failed:");
-	/**
-	* Base64url encode/decode helpers for the WebAuthn credential API.
-	* These run client-side only (browser context).
-	*/
-	const base64urlEncode = (buffer) => {
-		const bytes = new Uint8Array(buffer);
-		let binary = "";
-		for (let i = 0; i < bytes.byteLength; i++) binary += String.fromCharCode(bytes[i]);
-		return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-	};
-	const base64urlDecode = (str) => {
-		const padded = str.replace(/-/g, "+").replace(/_/g, "/");
-		const binary = atob(padded);
-		const bytes = new Uint8Array(binary.length);
-		for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-		return bytes;
-	};
 	return {
 		get state() {
 			return snapshot;
 		},
 		param,
 		get invite() {
+			const pendingInvite = getPendingInvite();
 			if (!pendingInvite) return null;
 			return {
 				token: pendingInvite.token,
@@ -701,395 +615,27 @@ function client(options) {
 		signIn,
 		signOut,
 		onChange,
-		passkey: {
-			isSupported: () => {
-				return typeof window !== "undefined" && typeof window.PublicKeyCredential !== "undefined";
-			},
-			isAutofillSupported: async () => {
-				if (typeof window === "undefined") return false;
-				if (typeof window.PublicKeyCredential === "undefined") return false;
-				if (typeof window.PublicKeyCredential.isConditionalMediationAvailable !== "function") return false;
-				return window.PublicKeyCredential.isConditionalMediationAvailable();
-			},
-			register: async (opts) => {
-				const phase1Params = {
-					flow: "registerOptions",
-					email: opts?.email,
-					userName: opts?.userName,
-					userDisplayName: opts?.userDisplayName
-				};
-				let phase1Result;
-				if (proxy) phase1Result = await proxyFetch({
-					action: "auth:signIn",
-					args: {
-						provider: "passkey",
-						params: phase1Params
-					}
-				});
-				else phase1Result = await convex.action(requireApiRefs().signIn, {
-					provider: "passkey",
-					params: phase1Params
-				});
-				if (phase1Result.kind !== "passkeyOptions") throw new Error("Server did not return passkey registration options");
-				const options$1 = phase1Result.options;
-				const createOptions = { publicKey: {
-					rp: options$1.rp,
-					user: {
-						id: base64urlDecode(options$1.user.id).buffer,
-						name: options$1.user.name,
-						displayName: options$1.user.displayName
-					},
-					challenge: base64urlDecode(options$1.challenge).buffer,
-					pubKeyCredParams: options$1.pubKeyCredParams,
-					timeout: options$1.timeout,
-					attestation: options$1.attestation,
-					authenticatorSelection: options$1.authenticatorSelection,
-					excludeCredentials: (options$1.excludeCredentials ?? []).map((cred) => ({
-						type: cred.type ?? "public-key",
-						id: base64urlDecode(cred.id).buffer,
-						transports: cred.transports
-					}))
-				} };
-				const credential = await navigator.credentials.create(createOptions);
-				if (!credential) throw new Error("Passkey registration was cancelled");
-				const response = credential.response;
-				const transports = typeof response.getTransports === "function" ? response.getTransports() : void 0;
-				const phase2Params = {
-					flow: "registerVerify",
-					clientDataJSON: base64urlEncode(response.clientDataJSON),
-					attestationObject: base64urlEncode(response.attestationObject),
-					transports,
-					passkeyName: opts?.name,
-					email: opts?.email
-				};
-				let phase2Result;
-				if (proxy) phase2Result = await proxyFetch({
-					action: "auth:signIn",
-					args: {
-						provider: "passkey",
-						params: phase2Params,
-						verifier: phase1Result.verifier
-					}
-				});
-				else phase2Result = await convex.action(requireApiRefs().signIn, {
-					provider: "passkey",
-					params: phase2Params,
-					verifier: phase1Result.verifier
-				});
-				return Fx.run(Fx.match(phase2Result, phase2Result.kind, {
-					signedIn: (signedInResult) => Fx.from({
-						ok: async () => {
-							return await setTokenAndMaybeWait(proxy ? {
-								shouldStore: false,
-								tokens: signedInResult.tokens === null ? null : { token: signedInResult.tokens.token },
-								waitForHandshake: true,
-								context: {
-									provider: "passkey",
-									flow: "registerVerify"
-								}
-							} : {
-								shouldStore: true,
-								tokens: signedInResult.tokens,
-								waitForHandshake: true,
-								context: {
-									provider: "passkey",
-									flow: "registerVerify"
-								}
-							}) ? { kind: "signedIn" } : { kind: "started" };
-						},
-						err: (e) => e
-					}),
-					redirect: (_redirectResult) => Fx.succeed({ kind: "started" }),
-					started: (_startedResult) => Fx.succeed({ kind: "started" }),
-					passkeyOptions: (_passkeyOptionsResult) => Fx.succeed({ kind: "started" }),
-					totpRequired: (_totpRequiredResult) => Fx.succeed({ kind: "started" }),
-					totpSetup: (_totpSetupResult) => Fx.succeed({ kind: "started" }),
-					deviceCode: (_deviceCodeResult) => Fx.succeed({ kind: "started" })
-				}));
-			},
-			authenticate: async (opts) => {
-				const phase1Params = {
-					flow: "authOptions",
-					email: opts?.email
-				};
-				let phase1Result;
-				if (proxy) phase1Result = await proxyFetch({
-					action: "auth:signIn",
-					args: {
-						provider: "passkey",
-						params: phase1Params
-					}
-				});
-				else phase1Result = await convex.action(requireApiRefs().signIn, {
-					provider: "passkey",
-					params: phase1Params
-				});
-				if (phase1Result.kind !== "passkeyOptions") throw new Error("Server did not return passkey authentication options");
-				const options$1 = phase1Result.options;
-				const getOptions = {
-					publicKey: {
-						challenge: base64urlDecode(options$1.challenge).buffer,
-						timeout: options$1.timeout,
-						rpId: options$1.rpId,
-						userVerification: options$1.userVerification,
-						allowCredentials: (options$1.allowCredentials ?? []).map((cred) => ({
-							type: cred.type ?? "public-key",
-							id: base64urlDecode(cred.id).buffer,
-							transports: cred.transports
-						}))
-					},
-					...opts?.autofill ? { mediation: "conditional" } : {}
-				};
-				const credential = await navigator.credentials.get(getOptions);
-				if (!credential) throw new Error("Passkey authentication was cancelled");
-				const response = credential.response;
-				const phase2Params = {
-					flow: "authVerify",
-					credentialId: base64urlEncode(credential.rawId),
-					clientDataJSON: base64urlEncode(response.clientDataJSON),
-					authenticatorData: base64urlEncode(response.authenticatorData),
-					signature: base64urlEncode(response.signature)
-				};
-				let phase2Result;
-				if (proxy) phase2Result = await proxyFetch({
-					action: "auth:signIn",
-					args: {
-						provider: "passkey",
-						params: phase2Params,
-						verifier: phase1Result.verifier
-					}
-				});
-				else phase2Result = await convex.action(requireApiRefs().signIn, {
-					provider: "passkey",
-					params: phase2Params,
-					verifier: phase1Result.verifier
-				});
-				return Fx.run(Fx.match(phase2Result, phase2Result.kind, {
-					signedIn: (signedInResult) => Fx.from({
-						ok: async () => {
-							return await setTokenAndMaybeWait(proxy ? {
-								shouldStore: false,
-								tokens: signedInResult.tokens === null ? null : { token: signedInResult.tokens.token },
-								waitForHandshake: true,
-								context: {
-									provider: "passkey",
-									flow: "authVerify"
-								}
-							} : {
-								shouldStore: true,
-								tokens: signedInResult.tokens,
-								waitForHandshake: true,
-								context: {
-									provider: "passkey",
-									flow: "authVerify"
-								}
-							}) ? { kind: "signedIn" } : { kind: "started" };
-						},
-						err: (e) => e
-					}),
-					redirect: (_redirectResult) => Fx.succeed({ kind: "started" }),
-					started: (_startedResult) => Fx.succeed({ kind: "started" }),
-					passkeyOptions: (_passkeyOptionsResult) => Fx.succeed({ kind: "started" }),
-					totpRequired: (_totpRequiredResult) => Fx.succeed({ kind: "started" }),
-					totpSetup: (_totpSetupResult) => Fx.succeed({ kind: "started" }),
-					deviceCode: (_deviceCodeResult) => Fx.succeed({ kind: "started" })
-				}));
-			}
-		},
-		totp: {
-			setup: async (opts) => {
-				const params = { flow: "setup" };
-				if (opts?.name) params.name = opts.name;
-				if (opts?.accountName) params.accountName = opts.accountName;
-				if (proxy) {
-					const result$1 = await proxyFetch({
-						action: "auth:signIn",
-						args: {
-							provider: "totp",
-							params
-						}
-					});
-					return {
-						uri: result$1.totpSetup.uri,
-						secret: result$1.totpSetup.secret,
-						verifier: result$1.verifier,
-						totpId: result$1.totpSetup.totpId
-					};
-				}
-				const result = await convex.action(requireApiRefs().signIn, {
-					provider: "totp",
-					params
-				});
-				return {
-					uri: result.totpSetup.uri,
-					secret: result.totpSetup.secret,
-					verifier: result.verifier,
-					totpId: result.totpSetup.totpId
-				};
-			},
-			confirm: async (opts) => {
-				const params = {
-					flow: "confirm",
-					code: opts.code,
-					totpId: opts.totpId
-				};
-				if (proxy) {
-					const result$1 = await proxyFetch({
-						action: "auth:signIn",
-						args: {
-							provider: "totp",
-							params,
-							verifier: opts.verifier
-						}
-					});
-					if (result$1.tokens) await setTokenAndMaybeWait({
-						shouldStore: false,
-						tokens: result$1.tokens === null ? null : { token: result$1.tokens.token },
-						waitForHandshake: true,
-						context: {
-							provider: "totp",
-							flow: "confirm"
-						}
-					});
-					return;
-				}
-				const result = await convex.action(requireApiRefs().signIn, {
-					provider: "totp",
-					params,
-					verifier: opts.verifier
-				});
-				if (result.tokens) await setTokenAndMaybeWait({
-					shouldStore: true,
-					tokens: result.tokens ?? null,
-					waitForHandshake: true,
-					context: {
-						provider: "totp",
-						flow: "confirm"
-					}
-				});
-			},
-			verify: async (opts) => {
-				const params = {
-					flow: "verify",
-					code: opts.code
-				};
-				if (proxy) {
-					const result$1 = await proxyFetch({
-						action: "auth:signIn",
-						args: {
-							provider: "totp",
-							params,
-							verifier: opts.verifier
-						}
-					});
-					if (result$1.tokens) await setTokenAndMaybeWait({
-						shouldStore: false,
-						tokens: result$1.tokens === null ? null : { token: result$1.tokens.token },
-						waitForHandshake: true,
-						context: {
-							provider: "totp",
-							flow: "verify"
-						}
-					});
-					return;
-				}
-				const result = await convex.action(requireApiRefs().signIn, {
-					provider: "totp",
-					params,
-					verifier: opts.verifier
-				});
-				if (result.tokens) await setTokenAndMaybeWait({
-					shouldStore: true,
-					tokens: result.tokens ?? null,
-					waitForHandshake: true,
-					context: {
-						provider: "totp",
-						flow: "verify"
-					}
-				});
-			}
-		},
-		device: {
-			poll: async (code) => {
-				const intervalMs = code.interval * 1e3;
-				const expiresAt = Date.now() + code.expiresIn * 1e3;
-				while (Date.now() < expiresAt) {
-					await new Promise((resolve) => setTimeout(resolve, intervalMs));
-					const pollResult = await Fx.run(Fx.from({
-						ok: async () => {
-							let result;
-							const params = {
-								flow: "poll",
-								deviceCode: code.deviceCode
-							};
-							if (proxy) result = await proxyFetch({
-								action: "auth:signIn",
-								args: {
-									provider: "device",
-									params
-								}
-							});
-							else result = await convex.action(requireApiRefs().signIn, {
-								provider: "device",
-								params
-							});
-							return result;
-						},
-						err: (e) => e
-					}).pipe(Fx.recover((e) => {
-						const dispatch = e instanceof ConvexError ? { tag: e.data?.code === "DEVICE_AUTHORIZATION_PENDING" ? "continue" : e.data?.code === "DEVICE_SLOW_DOWN" ? "slowDown" : "fatal" } : { tag: "fatal" };
-						return Fx.match(dispatch, dispatch.tag, {
-							continue: () => Fx.succeed({ _poll: "continue" }),
-							slowDown: () => Fx.succeed({ _poll: "slow_down" }),
-							fatal: () => Fx.fatal(e)
-						});
-					})));
-					if ("_poll" in pollResult) {
-						if (pollResult._poll === "slow_down") await new Promise((resolve) => setTimeout(resolve, intervalMs));
-						continue;
-					}
-					if (pollResult.tokens) {
-						if (proxy) await setTokenAndMaybeWait({
-							shouldStore: false,
-							tokens: pollResult.tokens === null ? null : { token: pollResult.tokens.token },
-							waitForHandshake: true,
-							context: {
-								provider: "device",
-								flow: "poll"
-							}
-						});
-						else await setTokenAndMaybeWait({
-							shouldStore: true,
-							tokens: pollResult.tokens ?? null,
-							waitForHandshake: true,
-							context: {
-								provider: "device",
-								flow: "poll"
-							}
-						});
-						return;
-					}
-				}
-				throw new Error("Device authorization timed out.");
-			},
-			verify: async (userCode) => {
-				const params = {
-					flow: "verify",
-					userCode
-				};
-				if (proxy) await proxyFetch({
-					action: "auth:signIn",
-					args: {
-						provider: "device",
-						params
-					}
-				});
-				else await convex.action(requireApiRefs().signIn, {
-					provider: "device",
-					params
-				});
-			}
-		},
+		passkey: createPasskeyClient({
+			proxy,
+			convex,
+			requireApiRefs,
+			proxyFetch,
+			setTokenAndMaybeWait
+		}),
+		totp: createTotpClient({
+			proxy,
+			convex,
+			requireApiRefs,
+			proxyFetch,
+			setTokenAndMaybeWait
+		}),
+		device: createDeviceClient({
+			proxy,
+			convex,
+			requireApiRefs,
+			proxyFetch,
+			setTokenAndMaybeWait
+		}),
 		destroy: () => {
 			destroyed = true;
 			settleHandshakeWaiters(authEpoch, {
@@ -1101,50 +647,6 @@ function client(options) {
 		}
 	};
 }
-async function browserMutex(key, callback) {
-	const lockManager = globalThis?.navigator?.locks;
-	return lockManager !== void 0 ? await lockManager.request(key, callback) : await manualMutex(key, callback);
-}
-function getStorageListenerRegistry() {
-	const globalAny = globalThis;
-	if (globalAny.__convexAuthStorageListeners === void 0) globalAny.__convexAuthStorageListeners = {};
-	return globalAny.__convexAuthStorageListeners;
-}
-function getManualMutexTails() {
-	const globalAny = globalThis;
-	if (globalAny.__convexAuthMutexTails === void 0) globalAny.__convexAuthMutexTails = {};
-	return globalAny.__convexAuthMutexTails;
-}
-async function manualMutex(key, callback) {
-	const mutexTails = getManualMutexTails();
-	const previousTail = mutexTails[key] ?? Promise.resolve();
-	let releaseCurrent;
-	const currentTail = new Promise((resolve) => {
-		releaseCurrent = resolve;
-	});
-	mutexTails[key] = previousTail.then(() => currentTail, () => currentTail);
-	await Fx.run(Fx.from({
-		ok: () => previousTail,
-		err: () => void 0
-	}).pipe(Fx.recover(() => Fx.succeed(void 0))));
-	let result;
-	let threw = false;
-	let thrownError;
-	await Fx.run(Fx.from({
-		ok: async () => {
-			result = await callback();
-		},
-		err: (e) => e
-	}).pipe(Fx.recover((e) => {
-		threw = true;
-		thrownError = e;
-		return Fx.succeed(void 0);
-	})));
-	releaseCurrent?.();
-	if (mutexTails[key] === currentTail) delete mutexTails[key];
-	if (threw) throw thrownError;
-	return result;
-}
 
 //#endregion
 export { AUTH_ERRORS, client, isAuthError, parseAuthError };