@superbuilders/primer-tives 4.0.3 → 4.0.4

package/dist/client/auth/hosted-popup.d.ts

@@ -1,11 +1,9 @@
 import type { PrimerLogger } from "../../logger";
-import { type HostedAuthOptions } from "./browser";
 type HostedPopupConfig = {
     readonly origin: string;
     readonly publishableKey: string;
     readonly currentUrl: URL;
     readonly clientState: string;
-    readonly options?: HostedAuthOptions;
     readonly logger: PrimerLogger;
 };
 declare function beginHostedPopup(config: HostedPopupConfig): Promise<string>;

package/dist/client/auth/hosted-popup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-popup.d.ts","sourceRoot":"","sources":["../../../src/client/auth/hosted-popup.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AACtE,OAAO,EAGN,KAAK,iBAAiB,EACtB,MAAM,iDAAiD,CAAA;AAOxD,KAAK,iBAAiB,GAAG;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAC7B,CAAA;AAwJD,iBAAe,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAU1E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,YAAY,EAAE,iBAAiB,EAAE,CAAA"}
+{"version":3,"file":"hosted-popup.d.ts","sourceRoot":"","sources":["../../../src/client/auth/hosted-popup.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAOtE,KAAK,iBAAiB,GAAG;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAC7B,CAAA;AAgJD,iBAAe,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAU1E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,YAAY,EAAE,iBAAiB,EAAE,CAAA"}

package/dist/client/auth/provider.d.ts

@@ -1,28 +1,33 @@
 import type { PrimerLogger } from "../../logger";
-import { type HostedAuthOptions } from "./browser";
 import { type ResolvedAccessToken } from "./access-token";
 type AccessTokenResolverOptions = {
     readonly origin: string;
     readonly publishableKey: string;
     readonly accessToken?: string;
-    readonly hostedAuth?: HostedAuthOptions;
     readonly logger: PrimerLogger;
 };
 type ResolvedAccessTokenResult = {
     readonly kind: "resolved";
     readonly accessToken: ResolvedAccessToken;
-    readonly invalidate?: () => void;
 };
-type UnauthenticatedAccessTokenResult = {
-    readonly kind: "unauthenticated";
-    readonly error: Error | null;
+type MissingAccessTokenResult = {
+    readonly kind: "missing";
 };
 type FatalAccessTokenResult = {
     readonly kind: "fatal";
     readonly error: Error;
 };
-type ExistingAccessTokenResult = ResolvedAccessTokenResult | UnauthenticatedAccessTokenResult | FatalAccessTokenResult;
-type HostedLoginResult = ResolvedAccessTokenResult | UnauthenticatedAccessTokenResult;
+type ExistingAccessTokenResult = ResolvedAccessTokenResult | MissingAccessTokenResult | FatalAccessTokenResult;
+type HostedLoginResult = ResolvedAccessTokenResult | {
+    readonly kind: "sign-in-failed";
+    readonly error: Error;
+} | {
+    readonly kind: "auth-unavailable";
+    readonly error: Error;
+} | {
+    readonly kind: "auth-config-invalid";
+    readonly error: Error;
+};
 declare function resolveExistingAccessToken(options: AccessTokenResolverOptions): ExistingAccessTokenResult;
 declare function beginHostedLogin(options: AccessTokenResolverOptions): Promise<HostedLoginResult>;
 export { beginHostedLogin, resolveExistingAccessToken };

package/dist/client/auth/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/client/auth/provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AACtE,OAAO,EAIN,KAAK,iBAAiB,EACtB,MAAM,iDAAiD,CAAA;AAExD,OAAO,EAEN,KAAK,mBAAmB,EACxB,MAAM,sDAAsD,CAAA;AAS7D,KAAK,0BAA0B,GAAG;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAC7B,CAAA;AAED,KAAK,yBAAyB,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAA;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,IAAI,CAAA;CAChC,CAAA;AAED,KAAK,gCAAgC,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAA;CAC5B,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CACrB,CAAA;AAED,KAAK,yBAAyB,GAC3B,yBAAyB,GACzB,gCAAgC,GAChC,sBAAsB,CAAA;AAEzB,KAAK,iBAAiB,GAAG,yBAAyB,GAAG,gCAAgC,CAAA;AAuErF,iBAAS,0BAA0B,CAClC,OAAO,EAAE,0BAA0B,GACjC,yBAAyB,CAe3B;AAED,iBAAe,gBAAgB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwC/F;AAED,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,CAAA;AACvD,YAAY,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,CAAA"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/client/auth/provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAGtE,OAAO,EAEN,KAAK,mBAAmB,EACxB,MAAM,sDAAsD,CAAA;AAG7D,KAAK,0BAA0B,GAAG;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAC7B,CAAA;AAED,KAAK,yBAAyB,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAA;CACzC,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CACxB,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CACrB,CAAA;AAED,KAAK,yBAAyB,GAC3B,yBAAyB,GACzB,wBAAwB,GACxB,sBAAsB,CAAA;AAEzB,KAAK,iBAAiB,GACnB,yBAAyB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAA;AAyBlE,iBAAS,0BAA0B,CAClC,OAAO,EAAE,0BAA0B,GACjC,yBAAyB,CAK3B;AAYD,iBAAe,gBAAgB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwB/F;AAED,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,CAAA;AACvD,YAAY,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,CAAA"}

package/dist/client/auth-state.d.ts

@@ -0,0 +1,14 @@
+import type { PciId } from "../contracts/pci";
+import type { AuthUnavailableState, AuthConfigInvalidState, ManagedStartState, SignInFailedState, SignInRequiredState } from "./types";
+type SignInStateConfig<Pcis extends PciId = PciId> = {
+    login(): Promise<ManagedStartState<Pcis>>;
+};
+declare function signInRequiredState<Pcis extends PciId>(config: SignInStateConfig<Pcis>): SignInRequiredState<Pcis>;
+declare function signInFailedState<Pcis extends PciId>(config: SignInStateConfig<Pcis> & {
+    readonly error: Error;
+}): SignInFailedState<Pcis>;
+declare function authUnavailableState(error: Error): AuthUnavailableState;
+declare function authConfigInvalidState(error: Error): AuthConfigInvalidState;
+export { authConfigInvalidState, authUnavailableState, signInFailedState, signInRequiredState };
+export type { SignInStateConfig };
+//# sourceMappingURL=auth-state.d.ts.map

package/dist/client/auth-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-state.d.ts","sourceRoot":"","sources":["../../src/client/auth-state.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2CAA2C,CAAA;AACtE,OAAO,KAAK,EACX,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,MAAM,0CAA0C,CAAA;AAEjD,KAAK,iBAAiB,CAAC,IAAI,SAAS,KAAK,GAAG,KAAK,IAAI;IACpD,KAAK,IAAI,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAA;CACzC,CAAA;AAkBD,iBAAS,mBAAmB,CAAC,IAAI,SAAS,KAAK,EAC9C,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAC7B,mBAAmB,CAAC,IAAI,CAAC,CAM3B;AAED,iBAAS,iBAAiB,CAAC,IAAI,SAAS,KAAK,EAC5C,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACzD,iBAAiB,CAAC,IAAI,CAAC,CAOzB;AAED,iBAAS,oBAAoB,CAAC,KAAK,EAAE,KAAK,GAAG,oBAAoB,CAMhE;AAED,iBAAS,sBAAsB,CAAC,KAAK,EAAE,KAAK,GAAG,sBAAsB,CAMpE;AAED,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;AAC/F,YAAY,EAAE,iBAAiB,EAAE,CAAA"}

package/dist/client/index.d.ts

@@ -1,4 +1,4 @@
 export { start } from "./start";
-export type { PrimerOptions } from "./start";
-export type { ChoiceState, CompletedState, ErroredState, ExtendedTextMultipleState, ExtendedTextSingleState, ExtendedTextState, FatalState, FeedbackState, InteractionState, MatchState, NonSerializable, ObservationState, OrderState, PciInteractionState, PciPendingRenderProps, PciRenderProps, PciSubmittedRenderProps, PrimerState, TextEntryState, UnauthenticatedState } from "./types";
+export type { PrimerOptions, PrimerOptionsWithAccessToken, PrimerOptionsWithManagedAuth } from "./start";
+export type { ChoiceState, CompletedState, ErroredState, ExtendedTextMultipleState, ExtendedTextSingleState, ExtendedTextState, FatalState, FeedbackState, InteractionState, MatchState, ManagedStartState, NonSerializable, NonRetriableErroredState, ObservationState, OrderState, PciInteractionState, PciPendingRenderProps, PciRenderProps, PciSubmittedRenderProps, PrimerState, RetriableErroredState, RuntimeState, SignInFailedState, SignInRequiredState, TextEntryState, AccessTokenStartState, AuthConfigInvalidState, AuthUnavailableState } from "./types";
 //# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,0CAA0C,CAAA;AAChE,YAAY,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAA;AAE7E,YAAY,EACX,WAAW,EACX,cAAc,EACd,YAAY,EACZ,yBAAyB,EACzB,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,cAAc,EACd,oBAAoB,EACpB,MAAM,0CAA0C,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,0CAA0C,CAAA;AAChE,YAAY,EACX,aAAa,EACb,4BAA4B,EAC5B,4BAA4B,EAC5B,MAAM,0CAA0C,CAAA;AAEjD,YAAY,EACX,WAAW,EACX,cAAc,EACd,YAAY,EACZ,yBAAyB,EACzB,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,wBAAwB,EACxB,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,0CAA0C,CAAA"}

package/dist/client/index.js

@@ -6783,7 +6783,7 @@ function submissionValidationMessage(result) {
 import * as errors3 from "@superbuilders/errors";
 
 // src/version.ts
-var SDK_VERSION = "4.0.3";
+var SDK_VERSION = "4.0.4";
 var NPM_PACKAGE_URL = "https://www.npmjs.com/package/@superbuilders/primer-tives";
 
 // src/client/transport.ts
@@ -7471,15 +7471,19 @@ function makeSession(sc) {
   function errored(error, failedPhase, intent) {
     let pending;
     const retriable = isRetriableError(error);
+    if (!retriable) {
+      return {
+        phase: "errored",
+        error,
+        retriable: false,
+        toJSON: poisonToJSON
+      };
+    }
     const state = {
       phase: "errored",
       error,
-      retriable,
+      retriable: true,
       retry: function retry() {
-        if (!retriable) {
-          logger.debug({ failedPhase }, "retry ignored for non-retriable error");
-          return Promise.resolve(state);
-        }
         if (pending) {
           return pending;
         }
@@ -7585,38 +7589,16 @@ function makeSession(sc) {
 import * as errors12 from "@superbuilders/errors";
 
 // src/client/auth/browser.ts
-function browserStorage(options, logger) {
-  if (options !== undefined && options.storage !== undefined) {
-    return options.storage;
-  }
-  if (typeof globalThis.sessionStorage === "undefined") {
-    logger.error("auth storage unavailable");
-    throw ErrAuthUnavailable;
-  }
-  return globalThis.sessionStorage;
-}
-function currentUrl(options, logger) {
-  if (options !== undefined && options.currentUrl !== undefined) {
-    if (!URL.canParse(options.currentUrl)) {
-      logger.error({ currentUrl: options.currentUrl }, "auth current url invalid");
-      throw ErrAuthConfigInvalid;
-    }
-    return new URL(options.currentUrl);
-  }
+var POPUP_TARGET = "primer-auth";
+var POPUP_FEATURES = "popup,width=480,height=720";
+function currentUrl(logger) {
   if (typeof globalThis.location === "undefined") {
     logger.error("auth location unavailable");
     throw ErrAuthUnavailable;
   }
   return new URL(globalThis.location.href);
 }
-function redirectUri(options, url, logger) {
-  if (options !== undefined && options.redirectUri !== undefined) {
-    if (!URL.canParse(options.redirectUri)) {
-      logger.error({ redirectUri: options.redirectUri }, "auth redirect uri invalid");
-      throw ErrAuthConfigInvalid;
-    }
-    return options.redirectUri;
-  }
+function redirectUri(url) {
   return `${url.origin}${url.pathname}${url.search}`;
 }
 function randomClientState(logger) {
@@ -7632,20 +7614,12 @@ function randomClientState(logger) {
   }
   return result;
 }
-function openAuthPopup(url, options, logger) {
+function openAuthPopup(url, logger) {
   if (typeof globalThis.open === "undefined") {
     logger.error("auth popup api unavailable");
     throw ErrAuthUnavailable;
   }
-  let target = "primer-auth";
-  if (options !== undefined && options.popupTarget !== undefined) {
-    target = options.popupTarget;
-  }
-  let features = "popup,width=480,height=720";
-  if (options !== undefined && options.popupFeatures !== undefined) {
-    features = options.popupFeatures;
-  }
-  const popup = globalThis.open(url, target, features);
+  const popup = globalThis.open(url, POPUP_TARGET, POPUP_FEATURES);
   if (popup === null) {
     logger.error("auth popup blocked");
     throw ErrAuthPopupBlocked;
@@ -7657,26 +7631,18 @@ function openAuthPopup(url, options, logger) {
 var DEFAULT_POPUP_TIMEOUT_MS = 10 * 60 * 1000;
 var POPUP_POLL_MS = 250;
 var AUTH_MESSAGE_TYPE = "primer-tives.auth.result.v1";
-var AUTH_RESPONSE_MODE = "web_message";
 function hostedAuthUrl(config) {
   const logger = config.logger;
   if (!URL.canParse(config.origin)) {
     logger.error({ origin: config.origin }, "hosted auth origin invalid");
-    throw ErrAuthCallbackInvalid;
+    throw ErrAuthConfigInvalid;
   }
-  const authUrl = new URL("/auth/timeback", config.origin);
+  const authUrl = new URL("/api/auth/timeback/start", config.origin);
   authUrl.searchParams.set("publishableKey", config.publishableKey);
-  authUrl.searchParams.set("redirectUri", redirectUri(config.options, config.currentUrl, logger));
+  authUrl.searchParams.set("redirectUri", redirectUri(config.currentUrl));
   authUrl.searchParams.set("state", config.clientState);
-  authUrl.searchParams.set("responseMode", AUTH_RESPONSE_MODE);
   return authUrl.toString();
 }
-function popupTimeoutMs(options) {
-  if (options !== undefined && options.popupTimeoutMs !== undefined) {
-    return options.popupTimeoutMs;
-  }
-  return DEFAULT_POPUP_TIMEOUT_MS;
-}
 function isRecord(value) {
   return typeof value === "object" && value !== null;
 }
@@ -7750,7 +7716,7 @@ async function waitForPopupMessage(popup, config, expectedOrigin) {
       const timeoutId = globalThis.setTimeout(function timeout() {
         logger.error("hosted auth popup timed out");
         finishWithError(ErrAuthCancelled);
-      }, popupTimeoutMs(config.options));
+      }, DEFAULT_POPUP_TIMEOUT_MS);
       stack.defer(function clearPopupTimeout() {
         globalThis.clearTimeout(timeoutId);
       });
@@ -7794,10 +7760,10 @@ async function beginHostedPopup(config) {
   const url = hostedAuthUrl(config);
   if (!URL.canParse(config.origin)) {
     logger.error({ origin: config.origin }, "hosted auth origin invalid");
-    throw ErrAuthCallbackInvalid;
+    throw ErrAuthConfigInvalid;
   }
   const expectedOrigin = new URL(config.origin).origin;
-  const popup = openAuthPopup(url, config.options, logger);
+  const popup = openAuthPopup(url, logger);
   return waitForPopupMessage(popup, config, expectedOrigin);
 }
 
@@ -7875,35 +7841,6 @@ function resolveAccessToken(token, logger) {
   return { value: token, [resolvedAccessTokenBrand]: true };
 }
 
-// src/client/auth/storage.ts
-var ACCESS_TOKEN_KEY_PREFIX = "primer:access-token";
-var AUTH_STATE_KEY_PREFIX = "primer:auth-state";
-function accessTokenStorageKey(publishableKey) {
-  return `${ACCESS_TOKEN_KEY_PREFIX}:${publishableKey}`;
-}
-function authStateStorageKey(publishableKey) {
-  return `${AUTH_STATE_KEY_PREFIX}:${publishableKey}`;
-}
-function loadStoredAccessToken(storage, publishableKey) {
-  const token = storage.getItem(accessTokenStorageKey(publishableKey));
-  if (token === null || token.length === 0) {
-    return null;
-  }
-  return token;
-}
-function storeAccessToken(storage, publishableKey, accessToken) {
-  storage.setItem(accessTokenStorageKey(publishableKey), accessToken);
-}
-function clearStoredAccessToken(storage, publishableKey) {
-  storage.removeItem(accessTokenStorageKey(publishableKey));
-}
-function storeAuthState(storage, publishableKey, state) {
-  storage.setItem(authStateStorageKey(publishableKey), state);
-}
-function clearAuthState(storage, publishableKey) {
-  storage.removeItem(authStateStorageKey(publishableKey));
-}
-
 // src/client/auth/provider.ts
 function resolveProvidedAccessToken(token, logger) {
   const result = errors12.trySync(function resolveProvidedToken() {
@@ -7914,103 +7851,59 @@ function resolveProvidedAccessToken(token, logger) {
   }
   return { kind: "resolved", accessToken: result.data };
 }
-function resolveManagedAccessToken(token, logger, invalidate) {
-  const result = errors12.trySync(function resolveManagedToken() {
+function resolveHostedAccessToken(token, logger) {
+  const result = errors12.trySync(function resolveHostedToken() {
     return resolveAccessToken(token, logger);
   });
   if (result.error) {
-    return { kind: "unauthenticated", error: result.error };
-  }
-  return { kind: "resolved", accessToken: result.data, invalidate };
-}
-function createStoredTokenInvalidator(storage, publishableKey) {
-  return function invalidateStoredAccessToken() {
-    clearStoredAccessToken(storage, publishableKey);
-  };
-}
-function readBrowserAuthContext(options) {
-  const logger = options.logger;
-  const contextResult = errors12.trySync(function readContext() {
-    const storage = browserStorage(options.hostedAuth, logger);
-    const url = currentUrl(options.hostedAuth, logger);
-    return { storage, url };
-  });
-  if (contextResult.error) {
-    return { kind: "unauthenticated", error: contextResult.error };
+    return { kind: "sign-in-failed", error: result.error };
   }
-  return contextResult.data;
-}
-function resolveStoredAccessToken(context, options) {
-  const stored = loadStoredAccessToken(context.storage, options.publishableKey);
-  if (stored === null) {
-    return null;
-  }
-  const invalidate = createStoredTokenInvalidator(context.storage, options.publishableKey);
-  const resolved = resolveManagedAccessToken(stored, options.logger, invalidate);
-  if (resolved.kind === "unauthenticated") {
-    invalidate();
-  }
-  return resolved;
+  return { kind: "resolved", accessToken: result.data };
 }
 function resolveExistingAccessToken(options) {
   if (options.accessToken !== undefined) {
     return resolveProvidedAccessToken(options.accessToken, options.logger);
   }
-  const context = readBrowserAuthContext(options);
-  if ("kind" in context) {
-    return context;
+  return { kind: "missing" };
+}
+function authFailureResult(error) {
+  if (errors12.is(error, ErrAuthConfigInvalid)) {
+    return { kind: "auth-config-invalid", error };
   }
-  const stored = resolveStoredAccessToken(context, options);
-  if (stored !== null) {
-    return stored;
+  if (errors12.is(error, ErrAuthUnavailable)) {
+    return { kind: "auth-unavailable", error };
   }
-  return { kind: "unauthenticated", error: null };
+  return { kind: "sign-in-failed", error };
 }
 async function beginHostedLogin(options) {
   const logger = options.logger;
-  const context = readBrowserAuthContext(options);
-  if ("kind" in context) {
-    return context;
-  }
-  const storage = context.storage;
-  const url = context.url;
-  const clientStateResult = errors12.trySync(function prepareHostedLogin() {
-    const clientState2 = randomClientState(logger);
-    storeAuthState(storage, options.publishableKey, clientState2);
-    return clientState2;
+  const contextResult = errors12.trySync(function readContext() {
+    const url = currentUrl(logger);
+    const clientState = randomClientState(logger);
+    return { url, clientState };
   });
-  if (clientStateResult.error) {
-    return { kind: "unauthenticated", error: clientStateResult.error };
+  if (contextResult.error) {
+    return authFailureResult(contextResult.error);
   }
-  const clientState = clientStateResult.data;
+  const context = contextResult.data;
   const accessTokenResult = await errors12.try(beginHostedPopup({
     origin: options.origin,
     publishableKey: options.publishableKey,
-    currentUrl: url,
-    clientState,
-    options: options.hostedAuth,
+    currentUrl: context.url,
+    clientState: context.clientState,
     logger
   }));
   if (accessTokenResult.error) {
-    clearAuthState(storage, options.publishableKey);
-    return { kind: "unauthenticated", error: accessTokenResult.error };
-  }
-  const invalidate = createStoredTokenInvalidator(storage, options.publishableKey);
-  const resolved = resolveManagedAccessToken(accessTokenResult.data, logger, invalidate);
-  if (resolved.kind === "unauthenticated") {
-    clearAuthState(storage, options.publishableKey);
-    return resolved;
-  }
-  storeAccessToken(storage, options.publishableKey, accessTokenResult.data);
-  clearAuthState(storage, options.publishableKey);
-  return resolved;
+    return authFailureResult(accessTokenResult.error);
+  }
+  return resolveHostedAccessToken(accessTokenResult.data, logger);
 }
 
-// src/client/unauthenticated-state.ts
-function unauthenticatedState(config) {
+// src/client/auth-state.ts
+function pendingLogin(config) {
   let pending;
   function login() {
-    if (pending) {
+    if (pending !== undefined) {
       return pending;
     }
     pending = config.login().finally(function clearPending() {
@@ -8018,10 +7911,34 @@ function unauthenticatedState(config) {
     });
     return pending;
   }
+  return login;
+}
+function signInRequiredState(config) {
+  return {
+    phase: "sign-in-required",
+    login: pendingLogin(config),
+    toJSON: poisonToJSON
+  };
+}
+function signInFailedState(config) {
   return {
-    phase: "unauthenticated",
+    phase: "sign-in-failed",
     error: config.error,
-    login,
+    login: pendingLogin(config),
+    toJSON: poisonToJSON
+  };
+}
+function authUnavailableState(error) {
+  return {
+    phase: "auth-unavailable",
+    error,
+    toJSON: poisonToJSON
+  };
+}
+function authConfigInvalidState(error) {
+  return {
+    phase: "auth-config-invalid",
+    error,
     toJSON: poisonToJSON
   };
 }
@@ -8048,12 +7965,8 @@ function primerOrigin(origin) {
 }
 async function startRuntime(config, resolved) {
   let reauthenticate = null;
-  const invalidate = resolved.invalidate;
-  if (invalidate !== undefined) {
-    reauthenticate = function reauthenticate2() {
-      invalidate();
-      return Promise.resolve(makeUnauthenticatedState(config, ErrTokenExpired));
-    };
+  if (resolved.reauthenticate !== undefined) {
+    reauthenticate = resolved.reauthenticate;
   }
   const transport = createTransport({
     accessToken: resolved.accessToken,
@@ -8073,8 +7986,15 @@ async function startRuntime(config, resolved) {
   });
   return session.execute({ kind: "observation" }, "start");
 }
-function makeUnauthenticatedState(config, error) {
-  return unauthenticatedState({
+function makeSignInRequiredState(config) {
+  return signInRequiredState({
+    login: function login() {
+      return loginAndStart(config);
+    }
+  });
+}
+function makeSignInFailedState(config, error) {
+  return signInFailedState({
     error,
     login: function login() {
       return loginAndStart(config);
@@ -8087,10 +8007,21 @@ async function loginAndStart(config) {
     publishableKey: config.publishableKey,
     logger: config.logger
   });
-  if (result.kind === "unauthenticated") {
-    return makeUnauthenticatedState(config, result.error);
+  if (result.kind === "auth-unavailable") {
+    return authUnavailableState(result.error);
   }
-  return startRuntime(config, result);
+  if (result.kind === "auth-config-invalid") {
+    return authConfigInvalidState(result.error);
+  }
+  if (result.kind === "sign-in-failed") {
+    return makeSignInFailedState(config, result.error);
+  }
+  return startRuntime(config, {
+    accessToken: result.accessToken,
+    reauthenticate: function reauthenticate() {
+      return Promise.resolve(makeSignInFailedState(config, ErrTokenExpired));
+    }
+  });
 }
 async function start(options) {
   const logger = options.logger;
@@ -8119,8 +8050,8 @@ async function start(options) {
       toJSON: poisonToJSON
     };
   }
-  if (accessToken.kind === "unauthenticated") {
-    return makeUnauthenticatedState(config, accessToken.error);
+  if (accessToken.kind === "missing") {
+    return makeSignInRequiredState(config);
   }
   return startRuntime(config, accessToken);
 }
@@ -8128,4 +8059,4 @@ export {
   start
 };
 
-//# debugId=EA711F8FB6F7394764756E2164756E21
+//# debugId=1270BDB9A874B19364756E2164756E21