@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/client/index.js

@@ -1,12 +1,16 @@
-import { createDeviceClient } from "../factors/device.js";
-import { browserMutex, getStorageListenerRegistry } from "../runtime/browser.js";
-import { createPasskeyClient } from "../factors/passkey.js";
-import { createTotpClient } from "../factors/totp.js";
-import { createInviteManager } from "../runtime/invite.js";
-import { createProxyHelpers, isRetriableProxyRefreshError, isTransientNetworkError } from "../runtime/proxy.js";
-import { createStorageHelpers } from "../runtime/storage.js";
-import { Fx } from "@robelest/fx";
-import { ConvexHttpClient } from "convex/browser";
+import { LOG_LEVELS, logMessage } from "../shared/log.js";
+import { createDeferred } from "./core/types.js";
+import { createHandshakeError } from "./errors.js";
+import { createDeviceClient } from "./factors/device.js";
+import { createTotpClient } from "./factors/totp.js";
+import { createInviteManager } from "./runtime/invite.js";
+import { localMutex } from "./runtime/mutex.js";
+import { isRetriableProxyRefreshError, isTransientNetworkError, parseProxyErrorBody } from "./runtime/proxy.js";
+import { createStorageHelpers } from "./runtime/storage.js";
+import { ClientAdapterFactoriesLive, ClientAdaptersLive } from "./services/adapters.js";
+import { ClientHttpLive } from "./services/http.js";
+import { resolveClientServices } from "./services/resolve.js";
+import { ClientRuntimeLive } from "./services/runtime.js";
 import { ConvexError } from "convex/values";
 
 //#region src/client/index.ts
@@ -18,6 +22,17 @@ const INVITE_EMAIL_KEY = "__convexAuthPendingInviteEmail";
 const RETRY_BASE_MS = 500;
 const RETRY_MAX_RETRIES = 2;
 const AUTH_HANDSHAKE_TIMEOUT_MS = 5e3;
+async function retryWithJitteredBackoff(fn, shouldRetry) {
+	let attempt = 0;
+	while (true) try {
+		return await fn();
+	} catch (error) {
+		if (attempt >= RETRY_MAX_RETRIES || !shouldRetry(error)) throw error;
+		const jitter = RETRY_BASE_MS * Math.pow(2, attempt) * (.5 + Math.random());
+		await new Promise((resolve) => setTimeout(resolve, jitter));
+		attempt++;
+	}
+}
 /**
 * Resolve the Convex deployment URL from the client.
 *
@@ -26,16 +41,30 @@ const AUTH_HANDSHAKE_TIMEOUT_MS = 5e3;
 */
 function resolveUrl(convex, explicit) {
 	if (explicit) return explicit;
-	const c = convex;
-	const url = c.url ?? c.client?.url;
+	const candidate = convex;
+	const client = typeof candidate.client === "object" && candidate.client !== null ? candidate.client : void 0;
+	const url = candidate.url ?? client?.url;
 	if (typeof url === "string") return url;
 	throw new Error("Could not determine Convex deployment URL. Pass `url` explicitly.");
 }
+function stableStringify(value) {
+	if (value === void 0) return "null";
+	if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+	if (value !== null && typeof value === "object") return `{${Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableStringify(entryValue)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+function buildSignInRequestKey(provider, params) {
+	return stableStringify({
+		provider: provider ?? null,
+		params
+	});
+}
 /**
 * Create a framework-agnostic auth client.
 *
-* Returns an object with `signIn`, `signOut`, `onChange`, `state`,
-* `passkey`, and `totp` — everything needed for client-side auth.
+* Returns an object with `signIn`, `signOut`, `onChange`, `state`, and any
+* factor helpers enabled by your configured providers. Browser-specific
+* passkey support is added by the `@robelest/convex-auth/browser` entrypoint.
 *
 * ### SPA mode (default)
 *
@@ -48,48 +77,64 @@ function resolveUrl(convex, explicit) {
 * const auth = client({ convex, api: api.auth });
 * ```
 *
-* ### SSR / proxy mode
+* ### Proxy mode
 *
 * ```ts
 * const auth = client({
 *   convex,
 *   proxyPath: '/api/auth',
 *   tokenSeed: tokenFromServer, // JWT read from httpOnly cookie during SSR
+*   runtime: myRuntime,
 * });
 * ```
 *
-* In proxy mode all auth operations go through the proxy URL.
+* In proxy mode all auth operations go through the injected proxy runtime.
 * Tokens are stored in httpOnly cookies server-side — the client
 * holds the JWT in memory only.
 *
 * @param options - Client configuration. See {@link ClientOptions}.
 * @typeParam Api - An AuthApiRefs type determining which factor helpers are available.
-* @returns Auth client with conditional `passkey`, `totp`, and `device` helpers.
+* @returns Auth client with conditional `totp` and `device` helpers.
 * @throws {Error} When the Convex deployment URL cannot be determined and `url` is not passed explicitly.
 * @throws {Error} When `proxyPath` is not set and the `api` option is missing.
+* @throws {Error} When `proxyPath` is set and `runtime.proxy` is missing.
 */
 function client(options) {
 	const { convex, proxyPath, api: apiRefs } = options;
 	const proxy = proxyPath;
+	const services = resolveClientServices({
+		runtime: ClientRuntimeLive(options.runtime ?? {}),
+		adapters: ClientAdaptersLive(options.adapters ?? {}),
+		adapterFactories: ClientAdapterFactoriesLive(options.adapterFactories ?? {}),
+		http: ClientHttpLive(proxy ? null : options.httpClient ?? null)
+	});
+	const runtime = services.runtime;
+	const adapters = services.adapters;
+	function requireProxyRuntime() {
+		if (!runtime.proxy) throw new Error("The `runtime.proxy` option is required when `proxyPath` is set. Use `@robelest/convex-auth/browser` for browser defaults or inject a proxy runtime explicitly.");
+		return runtime.proxy;
+	}
 	function requireApiRefs() {
 		if (!apiRefs) throw new Error("The `api` option is required when `proxyPath` is not set. Pass { api: api.auth }.");
 		return apiRefs;
 	}
-	const storage = options.storage !== void 0 ? options.storage : proxy ? null : typeof window === "undefined" ? null : window.localStorage;
-	const replaceUrl = options.replaceUrl ?? ((url$1) => {
-		if (typeof window !== "undefined") window.history.replaceState({}, "", url$1);
-	});
+	function requireHttpClient() {
+		if (!httpClient) throw new Error("The `httpClient` option is required when `proxyPath` is not set in a non-browser runtime. Use `@robelest/convex-auth/browser` for browser defaults or pass an action-only transport explicitly.");
+		return httpClient;
+	}
+	const storage = options.storage !== void 0 ? options.storage : runtime.storage !== void 0 ? runtime.storage : null;
+	const proxyRuntime = proxy ? requireProxyRuntime() : null;
+	const replaceUrl = options.replaceUrl ?? (runtime.location ? (url$1) => runtime.location.replace(url$1) : (_url) => {});
 	function getLocation() {
 		if (typeof options.location === "function") return options.location();
 		if (options.location instanceof URL) return options.location;
-		if (typeof window !== "undefined") return new URL(window.location.href);
+		if (runtime.location) return runtime.location.get();
 		return null;
 	}
 	/**
 	* SSR-safe URL parameter reader.
 	*
-	* Uses the `location` option if provided, otherwise falls back to
-	* `window.location` (returns `null` during SSR where `window` is unavailable).
+	* Uses the injected location source when provided.
 	*
 	* @param name - The query parameter name.
 	* @returns The parameter value, or `null` if not present or in SSR.
@@ -121,10 +166,28 @@ function client(options) {
 		storage,
 		key
 	});
-	const { isAbsoluteUrl, proxyFetch, resolveProxyUrl } = createProxyHelpers({ proxy });
+	const proxyFetch = async (body) => {
+		if (!proxy) throw new Error("Proxy fetch requested without proxyPath.");
+		const response = await proxyRuntime.fetch(body, proxy);
+		if (!response.ok) {
+			let errorBody = {};
+			try {
+				errorBody = parseProxyErrorBody(await response.json());
+			} catch {
+				errorBody = {};
+			}
+			if (typeof errorBody === "object" && errorBody !== null && "authError" in errorBody && typeof errorBody.authError === "object") throw new ConvexError(errorBody.authError);
+			throw new Error(errorBody.error ?? `Proxy request failed: ${response.status}`);
+		}
+		try {
+			return await response.json();
+		} catch {
+			throw new Error("Proxy response was not valid JSON");
+		}
+	};
 	const subscribers = /* @__PURE__ */ new Set();
 	let disposeStorageListener = null;
-	const httpClient = proxy ? null : new ConvexHttpClient(url);
+	const httpClient = services.httpClient;
 	const serverToken = typeof options.tokenSeed === "string" && options.tokenSeed.trim().length > 0 ? options.tokenSeed : null;
 	const hasServerToken = serverToken !== null;
 	let token = serverToken;
@@ -133,6 +196,7 @@ function client(options) {
 	let handshakePending = false;
 	let authEpoch = 0;
 	let destroyed = false;
+	let activeSignIn = null;
 	const handshakeWaiters = /* @__PURE__ */ new Set();
 	let snapshot = {
 		phase: hasServerToken ? "authenticated" : isLoading ? "loading" : "unauthenticated",
@@ -141,24 +205,13 @@ function client(options) {
 		token
 	};
 	let handlingCodeFlow = false;
-	const HANDSHAKE_ERROR_MESSAGES = {
-		AUTH_HANDSHAKE_TIMEOUT: "Sign-in succeeded but authentication confirmation timed out.",
-		AUTH_HANDSHAKE_REJECTED: "Authentication was rejected while confirming the session."
-	};
-	const createHandshakeError = (code, context) => {
-		return new ConvexError({
-			code,
-			message: HANDSHAKE_ERROR_MESSAGES[code],
-			...context
-		});
-	};
 	const settleHandshakeWaiters = (epoch, outcome) => {
 		for (const waiter of Array.from(handshakeWaiters)) {
 			if (waiter.epoch !== epoch) continue;
 			clearTimeout(waiter.timeoutId);
 			handshakeWaiters.delete(waiter);
-			if (outcome.type === "resolve") waiter.resolve();
-			else waiter.reject(outcome.error);
+			if (outcome.type === "resolve") waiter.deferred.resolve(void 0);
+			else waiter.deferred.reject(outcome.error);
 		}
 	};
 	const rejectObsoleteHandshakeWaiters = (activeEpoch) => {
@@ -166,7 +219,7 @@ function client(options) {
 			if (waiter.epoch >= activeEpoch) continue;
 			clearTimeout(waiter.timeoutId);
 			handshakeWaiters.delete(waiter);
-			waiter.reject(createHandshakeError("AUTH_HANDSHAKE_REJECTED", {
+			waiter.deferred.reject(createHandshakeError("AUTH_HANDSHAKE_REJECTED", {
 				...waiter.context,
 				reason: "token_changed"
 			}));
@@ -180,24 +233,26 @@ function client(options) {
 			reason: "auth_rejected"
 		});
 		const epoch = authEpoch;
-		await new Promise((resolve, reject) => {
-			const waiterRef = { current: null };
-			const waiter = {
-				epoch,
-				context,
-				resolve,
-				reject,
-				timeoutId: setTimeout(() => {
-					if (waiterRef.current !== null) handshakeWaiters.delete(waiterRef.current);
-					reject(createHandshakeError("AUTH_HANDSHAKE_TIMEOUT", {
-						...context,
-						timeoutMs: AUTH_HANDSHAKE_TIMEOUT_MS
-					}));
-				}, AUTH_HANDSHAKE_TIMEOUT_MS)
-			};
-			waiterRef.current = waiter;
-			handshakeWaiters.add(waiter);
-		});
+		const deferred = createDeferred();
+		const waiter = {
+			epoch,
+			context,
+			deferred,
+			timeoutId: setTimeout(() => {
+				handshakeWaiters.delete(waiter);
+				deferred.reject(createHandshakeError("AUTH_HANDSHAKE_TIMEOUT", {
+					...context,
+					timeoutMs: AUTH_HANDSHAKE_TIMEOUT_MS
+				}));
+			}, AUTH_HANDSHAKE_TIMEOUT_MS)
+		};
+		handshakeWaiters.add(waiter);
+		try {
+			await deferred.promise;
+		} finally {
+			clearTimeout(waiter.timeoutId);
+			handshakeWaiters.delete(waiter);
+		}
 	};
 	const handleConvexAuthChange = (isAuthenticated) => {
 		if (destroyed) return;
@@ -212,12 +267,7 @@ function client(options) {
 		for (const cb of subscribers) cb();
 	};
 	const updateSnapshot = () => {
-		const phase = {
-			handshake: "handshake",
-			loading: "loading",
-			authenticated: "authenticated",
-			unauthenticated: "unauthenticated"
-		}[{ tag: token !== null && handshakePending ? "handshake" : isLoading ? "loading" : token !== null && authConfirmed ? "authenticated" : "unauthenticated" }.tag];
+		const phase = token !== null && handshakePending ? "handshake" : isLoading ? "loading" : token !== null && authConfirmed ? "authenticated" : "unauthenticated";
 		const next = {
 			phase,
 			isLoading: phase === "loading" || phase === "handshake",
@@ -294,18 +344,24 @@ function client(options) {
 		if (waitForHandshake) await waitForAuthHandshake(context);
 		return true;
 	};
+	const adapterDeps = {
+		proxy,
+		convex,
+		requireApiRefs,
+		proxyFetch,
+		setTokenAndMaybeWait
+	};
+	const passkeyAdapter = adapters.passkey ?? services.adapterFactories.passkey?.(adapterDeps);
 	const verifyCode = async (args) => {
-		const verifyCodeRetryPolicy = Fx.retry.while(Fx.retry.compose(Fx.retry.jittered(Fx.retry.exponential(RETRY_BASE_MS)), Fx.retry.recurs(RETRY_MAX_RETRIES)), (meta) => isTransientNetworkError(meta.input));
-		return Fx.run(Fx.from({
-			ok: () => httpClient.action(requireApiRefs().signIn, "code" in args ? {
-				params: { code: args.code },
-				verifier: args.verifier
-			} : args),
-			err: (e) => e
-		}).pipe(Fx.retry(verifyCodeRetryPolicy), Fx.recover((e) => Fx.fatal(e))));
+		return retryWithJitteredBackoff(() => requireHttpClient().action(requireApiRefs().signIn, "code" in args ? {
+			params: { code: args.code },
+			verifier: args.verifier
+		} : args), isTransientNetworkError);
 	};
 	const verifyCodeAndSetToken = async (args, opts) => {
-		const { tokens } = await verifyCode(args);
+		const result = await verifyCode(args);
+		if (result.kind !== "signedIn") throw new Error("Code exchange did not return tokens.");
+		const { tokens } = result;
 		await setToken({
 			shouldStore: true,
 			tokens: tokens ?? null,
@@ -314,15 +370,17 @@ function client(options) {
 		return tokens !== null;
 	};
 	const normalizeDeviceCodeResult = (device_code) => {
+		const input = device_code;
 		return {
-			deviceCode: device_code.deviceCode,
-			userCode: device_code.userCode,
-			verificationUri: device_code.verification_uri ?? device_code.verificationUri,
-			verificationUriComplete: device_code.verification_uri_complete ?? device_code.verificationUriComplete,
-			expiresIn: device_code.expiresIn,
-			interval: device_code.interval
+			deviceCode: input.deviceCode,
+			userCode: input.userCode,
+			verificationUri: input.verification_uri ?? input.verificationUri ?? "",
+			verificationUriComplete: input.verification_uri_complete ?? input.verificationUriComplete ?? "",
+			expiresIn: input.expiresIn,
+			interval: input.interval
 		};
 	};
+	const isSignedInResult = (result) => result.kind === "signedIn";
 	/**
 	* Sign in with a provider.
 	*
@@ -361,68 +419,80 @@ function client(options) {
 			return formParams;
 		})() : args ?? {};
 		const flow = typeof params.flow === "string" && params.flow.length > 0 ? params.flow : "signIn";
-		const handleSignInActionResult = async (result, options$1) => Fx.run(Fx.match(result, result.kind, {
-			redirect: (redirectResult) => Fx.promise(async () => {
-				const redirectUrl = new URL(redirectResult.redirect);
-				if (options$1.persistVerifier) await storageSet(VERIFIER_STORAGE_KEY, redirectResult.verifier);
-				if (typeof window !== "undefined") window.location.href = redirectUrl.toString();
+		const signInKey = buildSignInRequestKey(provider, params);
+		const handleSignInActionResult = async (result, resultOptions) => {
+			if (result.kind === "redirect") {
+				const redirectUrl = new URL(result.redirect);
+				if (resultOptions.persistVerifier) await storageSet(VERIFIER_STORAGE_KEY, result.verifier);
+				if (runtime.location) await runtime.location.redirect(redirectUrl);
 				return {
 					kind: "redirect",
 					redirect: redirectUrl,
-					verifier: redirectResult.verifier
+					verifier: result.verifier
 				};
-			}),
-			totpRequired: (totpRequiredResult) => Fx.succeed({
+			}
+			if (result.kind === "totpRequired") return {
 				kind: "totpRequired",
-				verifier: totpRequiredResult.verifier
-			}),
-			deviceCode: (deviceCodeResult) => Fx.succeed({
+				verifier: result.verifier
+			};
+			if (result.kind === "deviceCode") return {
 				kind: "deviceCode",
-				deviceCode: normalizeDeviceCodeResult(deviceCodeResult.deviceCode)
-			}),
-			signedIn: (signedInResult) => Fx.promise(async () => {
-				return await setTokenAndMaybeWait(options$1.shouldStore ? {
-					shouldStore: true,
-					tokens: signedInResult.tokens,
-					waitForHandshake: true,
-					context: {
-						provider,
-						flow
-					}
-				} : {
-					shouldStore: false,
-					tokens: signedInResult.tokens === null ? null : { token: signedInResult.tokens.token },
-					waitForHandshake: true,
-					context: {
-						provider,
-						flow
-					}
-				}) ? { kind: "signedIn" } : { kind: "started" };
-			}),
-			started: (_startedResult) => Fx.succeed({ kind: "started" }),
-			passkeyOptions: (_passkeyOptionsResult) => Fx.succeed({ kind: "started" }),
-			totpSetup: (_totpSetupResult) => Fx.succeed({ kind: "started" })
-		}));
-		if (proxy) return handleSignInActionResult(await proxyFetch({
-			action: "auth:signIn",
-			args: {
+				deviceCode: normalizeDeviceCodeResult(result.deviceCode)
+			};
+			if (result.kind === "signedIn") return await setTokenAndMaybeWait(resultOptions.shouldStore ? {
+				shouldStore: true,
+				tokens: result.tokens,
+				waitForHandshake: true,
+				context: {
+					provider,
+					flow
+				}
+			} : {
+				shouldStore: false,
+				tokens: result.tokens === null ? null : { token: result.tokens.token },
+				waitForHandshake: true,
+				context: {
+					provider,
+					flow
+				}
+			}) ? { kind: "signedIn" } : { kind: "started" };
+			return { kind: "started" };
+		};
+		if (activeSignIn !== null) {
+			if (activeSignIn.key === signInKey) return await activeSignIn.promise;
+			throw new Error("Another sign-in flow is already in progress.");
+		}
+		const signInPromise = (async () => {
+			if (proxy) return await handleSignInActionResult(await proxyFetch({
+				action: "auth:signIn",
+				args: {
+					provider,
+					params
+				}
+			}), {
+				shouldStore: false,
+				persistVerifier: false
+			});
+			const verifier = await storageGet(VERIFIER_STORAGE_KEY) ?? void 0;
+			await storageRemove(VERIFIER_STORAGE_KEY);
+			return await handleSignInActionResult(await convex.action(requireApiRefs().signIn, {
 				provider,
-				params
-			}
-		}), {
-			shouldStore: false,
-			persistVerifier: false
-		});
-		const verifier = await storageGet(VERIFIER_STORAGE_KEY) ?? void 0;
-		await storageRemove(VERIFIER_STORAGE_KEY);
-		return handleSignInActionResult(await convex.action(requireApiRefs().signIn, {
-			provider,
-			params,
-			verifier
-		}), {
-			shouldStore: true,
-			persistVerifier: true
-		});
+				params,
+				verifier
+			}), {
+				shouldStore: true,
+				persistVerifier: true
+			});
+		})();
+		activeSignIn = {
+			key: signInKey,
+			promise: signInPromise
+		};
+		try {
+			return await signInPromise;
+		} finally {
+			if (activeSignIn?.promise === signInPromise) activeSignIn = null;
+		}
 	};
 	/**
 	* Sign out the current user.
@@ -433,13 +503,12 @@ function client(options) {
 	*/
 	const signOut = async () => {
 		if (proxy) {
-			await Fx.run(Fx.from({
-				ok: () => proxyFetch({
+			try {
+				await proxyFetch({
 					action: "auth:signOut",
 					args: {}
-				}),
-				err: () => void 0
-			}).pipe(Fx.recover(() => Fx.succeed(void 0))));
+				});
+			} catch {}
 			await setToken({
 				shouldStore: false,
 				tokens: null
@@ -447,10 +516,9 @@ function client(options) {
 			if (convex.clearAuth) convex.clearAuth();
 			return;
 		}
-		await Fx.run(Fx.from({
-			ok: () => convex.action(requireApiRefs().signOut, {}),
-			err: () => void 0
-		}).pipe(Fx.recover(() => Fx.succeed(void 0))));
+		try {
+			await convex.action(requireApiRefs().signOut, {});
+		} catch {}
 		await setToken({
 			shouldStore: true,
 			tokens: null
@@ -459,45 +527,36 @@ function client(options) {
 	};
 	const fetchAccessToken = async ({ forceRefreshToken }) => {
 		if (!forceRefreshToken) return token;
+		const mutex = runtime.mutex;
+		const withMutex = mutex ? (key$1, callback) => mutex.withKey(key$1, callback) : localMutex;
 		if (proxy) {
-			const resolvedProxyUrl = await resolveProxyUrl();
-			if (typeof window === "undefined" && !await isAbsoluteUrl(resolvedProxyUrl)) {
-				finalizeLoadingState();
-				return token;
-			}
 			const tokenBeforeRefresh = token;
-			return await browserMutex("__convexAuthProxyRefresh", async () => {
+			return await withMutex("__convexAuthProxyRefresh", async () => {
 				if (token !== tokenBeforeRefresh) return token;
-				const proxyRefreshRetryPolicy = Fx.retry.while(Fx.retry.compose(Fx.retry.jittered(Fx.retry.exponential(RETRY_BASE_MS)), Fx.retry.recurs(RETRY_MAX_RETRIES)), (meta) => isRetriableProxyRefreshError(meta.input));
-				await Fx.run(Fx.from({
-					ok: () => proxyFetch({
+				try {
+					const result = await retryWithJitteredBackoff(() => proxyFetch({
 						action: "auth:signIn",
 						args: { refreshToken: true }
-					}),
-					err: (e) => e
-				}).pipe(Fx.retry(proxyRefreshRetryPolicy), Fx.chain((result) => Fx.from({
-					ok: async () => {
-						if (result.tokens) await setToken({
-							shouldStore: false,
-							tokens: { token: result.tokens.token },
-							resyncConvexAuth: false
-						});
-						else await setToken({
-							shouldStore: false,
-							tokens: null,
-							resyncConvexAuth: false
-						});
-					},
-					err: (e) => e
-				})), Fx.inspect((error) => Fx.sync(() => console.error("[convex-auth] Proxy refresh failed:", error))), Fx.recover(() => {
+					}), isRetriableProxyRefreshError);
+					if (isSignedInResult(result) && result.tokens) await setToken({
+						shouldStore: false,
+						tokens: { token: result.tokens.token },
+						resyncConvexAuth: false
+					});
+					else await setToken({
+						shouldStore: false,
+						tokens: null,
+						resyncConvexAuth: false
+					});
+				} catch (error) {
+					logMessage("convex-auth/client", LOG_LEVELS.ERROR, ["[convex-auth] Proxy refresh failed:", error]);
 					if (token === null) finalizeLoadingState();
-					return Fx.succeed(void 0);
-				})));
+				}
 				return token;
 			});
 		}
 		const tokenBeforeLockAcquisition = token;
-		return await browserMutex(REFRESH_TOKEN_STORAGE_KEY, async () => {
+		return await withMutex(REFRESH_TOKEN_STORAGE_KEY, async () => {
 			const tokenAfterLockAcquisition = token;
 			if (tokenAfterLockAcquisition !== tokenBeforeLockAcquisition) return tokenAfterLockAcquisition;
 			const refreshToken = await storageGet(REFRESH_TOKEN_STORAGE_KEY) ?? null;
@@ -510,25 +569,20 @@ function client(options) {
 		});
 	};
 	const handleCodeFlow = async () => {
-		if (typeof window === "undefined") return;
 		if (handlingCodeFlow) return;
-		const code = new URLSearchParams(window.location.search).get("code");
+		const location = getLocation();
+		if (!location) return;
+		const code = location.searchParams.get("code");
 		if (!code) return;
 		handlingCodeFlow = true;
-		await Fx.run(Fx.from({
-			ok: async () => {
-				await signIn(void 0, { code });
-				const codeUrl = new URL(window.location.href);
-				codeUrl.searchParams.delete("code");
-				await replaceUrl(codeUrl.pathname + codeUrl.search + codeUrl.hash);
-			},
-			err: (e) => e
-		}).pipe(Fx.recover(() => Fx.succeed(void 0)), Fx.tap(() => Fx.sync(() => {
+		try {
+			await signIn(void 0, { code });
+			const codeUrl = new URL(location.toString());
+			codeUrl.searchParams.delete("code");
+			await replaceUrl(codeUrl.pathname + codeUrl.search + codeUrl.hash);
+		} catch {} finally {
 			handlingCodeFlow = false;
-		})), Fx.inspect(() => Fx.sync(() => {
-			handlingCodeFlow = false;
-		}))));
-		handlingCodeFlow = false;
+		}
 	};
 	const hydrateFromStorage = async () => {
 		const storedToken = await storageGet(JWT_STORAGE_KEY) ?? null;
@@ -556,45 +610,34 @@ function client(options) {
 			subscribers.delete(wrapped);
 		};
 	};
-	if (!proxy && typeof window !== "undefined") {
-		const registryKey = key(JWT_STORAGE_KEY);
-		const registry = getStorageListenerRegistry();
-		const existingListener = registry[registryKey];
-		if (existingListener !== void 0) window.removeEventListener("storage", existingListener);
-		const onStorage = (event) => {
-			Fx.detach(async () => {
-				if (event.key !== key(JWT_STORAGE_KEY)) return;
+	if (!proxy && runtime.sync) disposeStorageListener = runtime.sync.subscribe(key(JWT_STORAGE_KEY), (value) => {
+		setToken({
+			shouldStore: false,
+			tokens: value === null ? null : { token: value }
+		}).catch((error) => {
+			logMessage("convex-auth/client", LOG_LEVELS.ERROR, ["[convex-auth] Storage event handler failed:", error]);
+		});
+	}) ?? null;
+	bindConvexAuth();
+	if (proxy) {
+		if (!hasServerToken && runtime.environment !== "server") fetchAccessToken({ forceRefreshToken: true }).catch((error) => {
+			logMessage("convex-auth/client", LOG_LEVELS.ERROR, ["[convex-auth] Proxy token refresh failed:", error]);
+		});
+	} else (async () => {
+		try {
+			await hydrateFromStorage();
+			await handleCodeFlow();
+		} catch {
+			try {
 				await setToken({
 					shouldStore: false,
-					tokens: event.newValue === null ? null : { token: event.newValue }
+					tokens: null
 				});
-			}, "[convex-auth] Storage event handler failed:");
-		};
-		window.addEventListener("storage", onStorage);
-		registry[registryKey] = onStorage;
-		disposeStorageListener = () => {
-			if (registry[registryKey] === onStorage) delete registry[registryKey];
-			window.removeEventListener("storage", onStorage);
-		};
-	}
-	bindConvexAuth();
-	if (typeof window !== "undefined") if (proxy) {
-		if (!hasServerToken) Fx.detach(() => fetchAccessToken({ forceRefreshToken: true }), "[convex-auth] Proxy token refresh failed:");
-	} else Fx.detach(async () => {
-		await Fx.run(Fx.from({
-			ok: async () => {
-				await hydrateFromStorage();
-				await handleCodeFlow();
-			},
-			err: (e) => e
-		}).pipe(Fx.inspect((error) => Fx.sync(() => console.error("[convex-auth] Client initialization failed:", error))), Fx.recover((_error) => Fx.from({
-			ok: () => setToken({
-				shouldStore: false,
-				tokens: null
-			}),
-			err: (e) => e
-		}).pipe(Fx.recover(() => Fx.succeed(void 0))))));
-	}, "[convex-auth] SPA initialization failed:");
+			} catch {}
+		}
+	})().catch((error) => {
+		logMessage("convex-auth/client", LOG_LEVELS.ERROR, ["[convex-auth] SPA initialization failed:", error]);
+	});
 	return {
 		get state() {
 			return snapshot;
@@ -612,21 +655,14 @@ function client(options) {
 		signIn,
 		signOut,
 		onChange,
-		passkey: createPasskeyClient({
+		totp: adapters.totp ?? createTotpClient({
 			proxy,
 			convex,
 			requireApiRefs,
 			proxyFetch,
 			setTokenAndMaybeWait
 		}),
-		totp: createTotpClient({
-			proxy,
-			convex,
-			requireApiRefs,
-			proxyFetch,
-			setTokenAndMaybeWait
-		}),
-		device: createDeviceClient({
+		device: adapters.device ?? createDeviceClient({
 			proxy,
 			convex,
 			requireApiRefs,
@@ -641,7 +677,8 @@ function client(options) {
 			});
 			disposeStorageListener?.();
 			subscribers.clear();
-		}
+		},
+		...passkeyAdapter ? { passkey: passkeyAdapter } : {}
 	};
 }