@tern-secure/types 1.1.0-canary.v20251020032343 → 1.1.0-canary.v20251023005301

package/dist/esm/index.js

@@ -27,6 +27,7 @@ var ERRORS = {
   WRONG_PASSWORD: "auth/wrong-password",
   EMAIL_ALREADY_IN_USE: "auth/email-already-in-use",
   REQUIRES_RECENT_LOGIN: "auth/requires-recent-login",
+  INCORRECT_ARGUMENT: "auth/argument-error",
   NO_SESSION_COOKIE: "No session cookie found.",
   INVALID_SESSION_COOKIE: "Invalid session cookie.",
   NO_ID_TOKEN: "No ID token found.",

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/errors.ts","../../src/auth.ts","../../src/signIn.ts"],"sourcesContent":["\r\nexport type AuthErrorCode = keyof typeof ERRORS\r\n\r\nexport type ErrorCode = keyof typeof ERRORS\r\n\r\n\r\nexport const ERRORS = {\r\n  SERVER_SIDE_INITIALIZATION: \"TernSecure must be initialized on the client side\",\r\n  REQUIRES_VERIFICATION: \"AUTH_REQUIRES_VERIFICATION\",\r\n  AUTHENTICATED: \"AUTHENTICATED\",\r\n  UNAUTHENTICATED: \"UNAUTHENTICATED\",\r\n  UNVERIFIED: \"UNVERIFIED\",\r\n  NOT_INITIALIZED: \"TernSecure services are not initialized. Call initializeTernSecure() first\",\r\n  HOOK_CONTEXT: \"Hook must be used within TernSecureProvider\",\r\n  EMAIL_NOT_VERIFIED: \"EMAIL_NOT_VERIFIED\",\r\n  INVALID_CREDENTIALS: \"INVALID_CREDENTIALS\",\r\n  USER_DISABLED: \"USER_DISABLED\",\r\n  TOO_MANY_ATTEMPTS: \"TOO_MANY_ATTEMPTS\",\r\n  NETWORK_ERROR: \"NETWORK_ERROR\",\r\n  INVALID_EMAIL: \"INVALID_EMAIL\",\r\n  WEAK_PASSWORD: \"WEAK_PASSWORD\",\r\n  EMAIL_EXISTS: \"EMAIL_EXISTS\",\r\n  POPUP_BLOCKED: \"POPUP_BLOCKED\",\r\n  OPERATION_NOT_ALLOWED: \"OPERATION_NOT_ALLOWED\",\r\n  EXPIRED_TOKEN: \"EXPIRED_TOKEN\",\r\n  INVALID_TOKEN: \"INVALID_TOKEN\",\r\n  SESSION_EXPIRED: \"SESSION_EXPIRED\",\r\n  INTERNAL_ERROR: \"INTERNAL_ERROR\",\r\n  UNKNOWN_ERROR: \"An unknown error occurred.\",\r\n  INVALID_ARGUMENT: \"Invalid argument provided.\",\r\n  USER_NOT_FOUND: \"auth/user-not-found\",\r\n  WRONG_PASSWORD: \"auth/wrong-password\",\r\n  EMAIL_ALREADY_IN_USE: \"auth/email-already-in-use\",\r\n  REQUIRES_RECENT_LOGIN: \"auth/requires-recent-login\",\r\n  NO_SESSION_COOKIE: \"No session cookie found.\",\r\n  INVALID_SESSION_COOKIE: \"Invalid session cookie.\",\r\n  NO_ID_TOKEN: \"No ID token found.\",\r\n  INVALID_ID_TOKEN: \"Invalid ID token.\",\r\n  REDIRECT_LOOP: \"Redirect loop detected.\",\r\n} as const\r\n\r\n","import type { SignedInSession } from 'session';\nimport type { SignUpResource } from 'signUp';\n\nimport type { InstanceType, TernSecureConfig, TernSecureUser } from './all';\nimport type { DecodedIdToken } from './jwt';\nimport type {\n  AfterSignOutUrl,\n  RedirectOptions,\n  SignInRedirectUrl,\n  SignUpRedirectUrl,\n} from './redirect';\nimport type { AuthErrorResponse, SignInInitialValue, SignInResource } from './signIn';\n\nexport interface InitialState {\n  userId: string | null;\n  token: any | null;\n  email: string | null;\n  user?: TernSecureUser | null;\n}\n\nexport interface TernSecureState {\n  userId: string | null;\n  isLoaded: boolean;\n  error: Error | null;\n  isValid: boolean;\n  isVerified: boolean;\n  isAuthenticated: boolean;\n  token: any | null;\n  email: string | null;\n  status: 'loading' | 'authenticated' | 'unauthenticated' | 'unverified';\n  user?: TernSecureUser | null;\n}\n\nexport type TernSecureStateExtended = {\n  sessionClaims: DecodedIdToken | null;\n  userId: string | null;\n  token: string | null;\n  user?: TernSecureUser | null;\n}\n\nexport type AuthProviderStatus = 'idle' | 'pending' | 'error' | 'success';\n\nexport const DEFAULT_TERN_SECURE_STATE: TernSecureState = {\n  userId: null,\n  isLoaded: false,\n  error: null,\n  isValid: false,\n  isVerified: false,\n  isAuthenticated: false,\n  token: null,\n  email: null,\n  status: 'loading',\n  user: null,\n};\n\nexport interface TernSecureAuthProvider {\n  /** Current auth state */\n  internalAuthState: TernSecureState;\n\n  /** Current user*/\n  ternSecureUser(): TernSecureUser | null;\n\n  /** AuthCookie Manager */\n  authCookieManager(): void;\n\n  /** Current session */\n  currentSession: SignedInSession | null;\n\n  /** Sign in resource for authentication operations */\n  signIn: SignInResource | undefined;\n\n  /** SignUp resource for authentication operations */\n  signUp: SignUpResource | undefined;\n\n  /** The Firebase configuration used by this TernAuth instance. */\n  ternSecureConfig?: TernSecureConfig;\n\n  /** Sign out the current user */\n  signOut(): Promise<void>;\n}\n\nexport type Persistence = 'local' | 'session' | 'browserCookie' | 'none';\n\ntype Mode = 'browser' | 'server';\n\nexport type TernAuthSDK = {\n  /** SDK package name (e.g., @tern-secure/auth) */\n  name: string;\n  /** SDK version (e.g., 1.2.3) */\n  version: string;\n  /** Build environment (development, production, test) */\n  environment?: string;\n  /** Build date as ISO string */\n  buildDate?: string;\n  /** Additional build metadata */\n  buildInfo?: {\n    name: string;\n    version: string;\n    buildDate: string;\n    buildEnv: string;\n  };\n};\n\nexport interface TernSecureResources {\n  user?: TernSecureUser | null;\n  session?: SignedInSession | null;\n}\n\nexport type CreateActiveSessionParams = {\n  session?: TernSecureUser | null;\n  redirectUrl?: string;\n}\n\nexport type CreateActiveSession = (params: CreateActiveSessionParams) => Promise<void>;\n\nexport type TernSecureAuthOptions = {\n  apiUrl?: string;\n  sdkMetadata?: TernAuthSDK;\n  signInUrl?: string;\n  signUpUrl?: string;\n  mode?: Mode;\n  requiresVerification?: boolean;\n  isTernSecureDev?: boolean;\n  ternSecureConfig?: TernSecureConfig;\n  persistence?: Persistence;\n  enableServiceWorker?: boolean;\n  experimental?: {\n    /** rethrow network errors that occur while the offline */\n    rethrowOfflineNetworkErrors?: boolean;\n  };\n} & SignInRedirectUrl &\n  SignUpRedirectUrl &\n  AfterSignOutUrl;\n\nexport type TernAuthListenerEventPayload = {\n  authStateChanged: TernSecureState;\n  userChanged: TernSecureUser;\n  sessionChanged: SignedInSession | null;\n  tokenRefreshed: string | null;\n};\n\nexport type TernAuthListenerEvent = keyof TernAuthListenerEventPayload;\n\nexport type ListenerCallback = (emission: TernSecureResources) => void;\nexport type UnsubscribeCallback = () => void;\ntype TernSecureEvent = keyof TernAuthEventPayload;\ntype EventHandler<Events extends TernSecureEvent> = (payload: TernAuthEventPayload[Events]) => void;\nexport type TernAuthEventPayload = {\n  status: TernSecureAuthStatus;\n};\n\nexport type TernSecureAuthStatus = 'error' | 'loading' | 'ready';\n\ntype onEventListener = <E extends TernSecureEvent>(\n  event: E,\n  handler: EventHandler<E>,\n  opt?: { notify?: boolean },\n) => void;\ntype OffEventListener = <E extends TernSecureEvent>(event: E, handler: EventHandler<E>) => void;\n\nexport type SignOutOptions = {\n  /** URL to redirect to after sign out */\n  redirectUrl?: string;\n  /** Callback to perform consumer-specific cleanup (e.g., delete session cookies) */\n  onBeforeSignOut?: () => Promise<void> | void;\n  /** Callback executed after successful sign out */\n  onAfterSignOut?: () => Promise<void> | void;\n};\n\nexport interface SignOut {\n  (options?: SignOutOptions): Promise<void>;\n}\n\nexport interface TernSecureAuth {\n  /** TernSecureAuth SDK version number */\n  version: string | undefined;\n\n  /** Metadata about the SDK instance */\n  sdkMetadata: TernAuthSDK | undefined;\n\n  /** Indicates if the TernSecureAuth instance is currently loading */\n  isLoading: boolean;\n\n  /** The current status of the TernSecureAuth instance */\n  status: TernSecureAuthStatus;\n\n  /** TernSecure API URL */\n  apiUrl: string;\n\n  /** TernSecure domain for API string */\n  domain: string;\n\n  /** TernSecure Proxy url */\n  proxyUrl?: string;\n\n  /** TernSecure Instance type */\n  instanceType: InstanceType | undefined;\n\n  /** Indicates if the TernSecureAuth instance is ready for use */\n  isReady: boolean;\n\n  /** Requires Verification */\n  requiresVerification: boolean;\n\n  /** Initialize TernSecureAuth */\n  initialize(options?: TernSecureAuthOptions): Promise<void>;\n\n  /**\n   * @internal\n   */\n  _internal_getOption<K extends keyof TernSecureAuthOptions>(key: K): TernSecureAuthOptions[K];\n\n  /**\n   * @internal\n   */\n  _internal_getAllOptions(): Readonly<TernSecureAuthOptions>;\n\n  /** Current user*/\n  user: TernSecureUser | null | undefined;\n\n  /** Current session */\n  currentSession: SignedInSession | null;\n\n  /** Sign in resource for authentication operations */\n  signIn: SignInResource | undefined | null;\n\n  /** SignUp resource for authentication operations */\n  signUp: SignUpResource | undefined | null;\n\n  /** The Firebase configuration used by this TernAuth instance. */\n  ternSecureConfig?: TernSecureConfig;\n\n  /** Subscribe to auth state changes */\n  onAuthStateChanged(callback: (cb: any) => void): () => void;\n\n  /** Sign out the current user */\n  signOut: SignOut;\n\n  /** Subscribe to a single event */\n  on: onEventListener;\n\n  /** Remove event listener */\n  off: OffEventListener;\n\n  /** Subscribe to all auth state changes */\n  addListener: (callback: ListenerCallback) => UnsubscribeCallback;\n\n  /** Get redirect result from OAuth flows */\n  getRedirectResult: () => Promise<any>;\n\n  /** Create an active session */\n  createActiveSession: CreateActiveSession;\n\n  /** Navigate to SignIn page */\n  redirectToSignIn(options?: SignInRedirectOptions): Promise<unknown>;\n  /** Navigate to SignUp page */\n  redirectToSignUp(options?: SignUpRedirectOptions): Promise<unknown>;\n\n  redirectAfterSignIn: () => void;\n\n  redirectAfterSignUp: () => void;\n}\n\nexport type SignUpFormValues = {\n  email: string;\n  password: string;\n  confirmPassword?: string;\n  displayName?: string;\n};\n\nexport type SignUpInitialValue = Partial<SignUpFormValues>;\n\nexport interface TernSecureAuthFactory {\n  create(options?: TernSecureAuthOptions): TernSecureAuth;\n}\n\nexport type SharedSignInAuthObjectProperties = {\n  session: DecodedIdToken;\n  userId: string;\n};\n\nexport type CheckCustomClaims = {\n  role?: string | string[];\n  permissions?: string | string[];\n  [key: string]: any;\n};\n\nexport type CheckAuthorizationFromSessionClaims = (\n  isAuthorizedParams: CheckCustomClaims,\n) => boolean;\n\nexport type TernVerificationResult =\n  | (DecodedIdToken & {\n      valid: true;\n      token?: string;\n      error?: never;\n    })\n  | {\n      valid: false;\n      error: AuthErrorResponse;\n    };\n\n/**\n * Props for SignIn component focusing on UI concerns\n */\nexport type SignInProps = {\n  /** Routing Path */\n  path?: string;\n  /** URL to navigate to after successfully sign-in */\n  forceRedirectUrl?: string | null;\n  /** Initial form values */\n  initialValue?: SignInInitialValue;\n  /** Callbacks */\n  onSuccess?: (user: TernSecureUser | null) => void;\n} & SignUpRedirectUrl;\n\n/**\n * Props for SignUp component focusing on UI concerns\n */\nexport type SignUpProps = {\n  /** URL to navigate to after successfully sign-up */\n  forceRedirectUrl?: string | null;\n  /** Initial form values */\n  initialValue?: SignUpInitialValue;\n  /** Callbacks */\n  onSubmit?: (values: SignUpFormValues) => Promise<void>;\n  onSuccess?: (user: TernSecureUser | null) => void;\n} & SignInRedirectUrl;\n\nexport type SignInRedirectOptions = RedirectOptions;\nexport type SignUpRedirectOptions = RedirectOptions;\n\n","import type { UserCredential } from \"./all\";\nimport type { ErrorCode} from \"./errors\";\n\nexport type SignInStatus =\n  | 'idle'\n  | 'pending_email_password'\n  | 'pending_social'\n  | 'pending_mfa'\n  | 'redirecting'\n  | 'success'\n  | 'error';\n\n\nexport type SignInFormValues = {\n  email: string;\n  password: string;\n  phoneNumber?: string;\n};\n\nexport interface AuthErrorResponse {\n  success: false\n  message: string\n  code: ErrorCode\n}\n\nexport interface AuthErrorTree extends Error {\n  code?: any | string;\n  message: string;\n  response?: any | string;\n}\n\ninterface BaseSignInResponse {\n  status?: SignInStatus;\n  message?: string;\n  error?: any | undefined;\n}\n\n\nexport interface SignInSuccessResponse extends BaseSignInResponse, UserCredential {\n  status: 'success';\n}\n\nexport interface SignInErrorResponse extends BaseSignInResponse {\n  status: 'error';\n}\n\nexport interface SignInPendingResponse extends BaseSignInResponse {\n  status: 'redirecting' | 'pending_social' | 'pending_email_password';\n}\n\nexport type SignInResponse = \n  | SignInSuccessResponse \n  | SignInErrorResponse \n  | SignInPendingResponse;\n\n\nexport type SignInInitialValue = Partial<SignInFormValues>;\n\n\nexport interface ResendEmailVerification {\n  isVerified?: boolean;\n}\n\nexport function isSignInResponseTree(value: any): value is SignInResponse {\n  return (\n    typeof value === 'object' &&\n    'success' in value &&\n    typeof value.success === 'boolean'\n  );\n}\n\n\nexport interface SignInResource {\n  /**\n   * The current status of the sign-in process.\n   */\n  status?: SignInStatus;\n  /**\n   * Signs in a user with their email and password.\n   * @param params - The sign-in form values.\n   * @returns A promise that resolves with the sign-in response.\n   */\n  withEmailAndPassword: (params: SignInFormValues) => Promise<SignInResponse>;\n  /**\n   * @param provider - The identifier of the social provider (e.g., 'google', 'microsoft', 'github').\n   * @param options - Optional configuration for the social sign-in flow.\n   * @returns A promise that resolves with the sign-in response or void if redirecting.\n   */\n  withSocialProvider: (provider: string, options?: { mode?: 'popup' | 'redirect' }) => Promise<SignInResponse | void>;\n  /**\n   * Completes an MFA (Multi-Factor Authentication) step after a primary authentication attempt.\n   * @param mfaToken - The MFA token or code submitted by the user.\n   * @param mfaContext - Optional context or session data from the MFA initiation step.\n   * @returns A promise that resolves with the sign-in response upon successful MFA verification.\n   */\n  completeMfaSignIn: (mfaToken: string, mfaContext?: any) => Promise<SignInResponse>;\n  /**\n   * Sends a password reset email to the given email address.\n   * @param email - The user's email address.\n   * @returns A promise that resolves when the email is sent.\n   */\n  sendPasswordResetEmail: (email: string) => Promise<void>;\n  /**\n   * Resends the email verification link to the user's email address.\n   * @returns A promise that resolves with the sign-in response.\n   */\n  resendEmailVerification: () => Promise<ResendEmailVerification>;\n  /**\n   * Checks the result of a redirect-based sign-in flow, typically used in OAuth or SSO scenarios.\n   * @returns A promise that resolves with the sign-in response or null if no result is available.\n   */\n  checkRedirectResult: () => Promise<SignInResponse| null>;\n}"],"mappings":";AAMO,IAAM,SAAS;AAAA,EACpB,4BAA4B;AAAA,EAC5B,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,eAAe;AAAA,EACf,cAAc;AAAA,EACd,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,mBAAmB;AAAA,EACnB,wBAAwB;AAAA,EACxB,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,eAAe;AACjB;;;ACGO,IAAM,4BAA6C;AAAA,EACxD,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,OAAO;AAAA,EACP,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,OAAO;AAAA,EACP,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,MAAM;AACR;;;ACUO,SAAS,qBAAqB,OAAqC;AACxE,SACE,OAAO,UAAU,YACjB,aAAa,SACb,OAAO,MAAM,YAAY;AAE7B;","names":[]}
+{"version":3,"sources":["../../src/errors.ts","../../src/auth.ts","../../src/signIn.ts"],"sourcesContent":["\r\nexport type AuthErrorCode = keyof typeof ERRORS\r\n\r\nexport type ErrorCode = keyof typeof ERRORS\r\n\r\n\r\nexport const ERRORS = {\r\n  SERVER_SIDE_INITIALIZATION: \"TernSecure must be initialized on the client side\",\r\n  REQUIRES_VERIFICATION: \"AUTH_REQUIRES_VERIFICATION\",\r\n  AUTHENTICATED: \"AUTHENTICATED\",\r\n  UNAUTHENTICATED: \"UNAUTHENTICATED\",\r\n  UNVERIFIED: \"UNVERIFIED\",\r\n  NOT_INITIALIZED: \"TernSecure services are not initialized. Call initializeTernSecure() first\",\r\n  HOOK_CONTEXT: \"Hook must be used within TernSecureProvider\",\r\n  EMAIL_NOT_VERIFIED: \"EMAIL_NOT_VERIFIED\",\r\n  INVALID_CREDENTIALS: \"INVALID_CREDENTIALS\",\r\n  USER_DISABLED: \"USER_DISABLED\",\r\n  TOO_MANY_ATTEMPTS: \"TOO_MANY_ATTEMPTS\",\r\n  NETWORK_ERROR: \"NETWORK_ERROR\",\r\n  INVALID_EMAIL: \"INVALID_EMAIL\",\r\n  WEAK_PASSWORD: \"WEAK_PASSWORD\",\r\n  EMAIL_EXISTS: \"EMAIL_EXISTS\",\r\n  POPUP_BLOCKED: \"POPUP_BLOCKED\",\r\n  OPERATION_NOT_ALLOWED: \"OPERATION_NOT_ALLOWED\",\r\n  EXPIRED_TOKEN: \"EXPIRED_TOKEN\",\r\n  INVALID_TOKEN: \"INVALID_TOKEN\",\r\n  SESSION_EXPIRED: \"SESSION_EXPIRED\",\r\n  INTERNAL_ERROR: \"INTERNAL_ERROR\",\r\n  UNKNOWN_ERROR: \"An unknown error occurred.\",\r\n  INVALID_ARGUMENT: \"Invalid argument provided.\",\r\n  USER_NOT_FOUND: \"auth/user-not-found\",\r\n  WRONG_PASSWORD: \"auth/wrong-password\",\r\n  EMAIL_ALREADY_IN_USE: \"auth/email-already-in-use\",\r\n  REQUIRES_RECENT_LOGIN: \"auth/requires-recent-login\",\r\n  INCORRECT_ARGUMENT: \"auth/argument-error\",\r\n  NO_SESSION_COOKIE: \"No session cookie found.\",\r\n  INVALID_SESSION_COOKIE: \"Invalid session cookie.\",\r\n  NO_ID_TOKEN: \"No ID token found.\",\r\n  INVALID_ID_TOKEN: \"Invalid ID token.\",\r\n  REDIRECT_LOOP: \"Redirect loop detected.\",\r\n} as const\r\n\r\n","import type { SignedInSession } from 'session';\nimport type { SignUpResource } from 'signUp';\n\nimport type { InstanceType, TernSecureConfig, TernSecureUser } from './all';\nimport type { DecodedIdToken } from './jwt';\nimport type {\n  AfterSignOutUrl,\n  RedirectOptions,\n  SignInFallbackRedirectUrl,\n  SignInForceRedirectUrl,\n  SignUpFallbackRedirectUrl,\n  SignUpForceRedirectUrl,\n} from './redirect';\nimport type { AuthErrorResponse, SignInInitialValue, SignInResource } from './signIn';\n\nexport interface InitialState {\n  userId: string | null;\n  token: any | null;\n  email: string | null;\n  user?: TernSecureUser | null;\n}\n\nexport interface TernSecureState {\n  userId: string | null;\n  isLoaded: boolean;\n  error: Error | null;\n  isValid: boolean;\n  isVerified: boolean;\n  isAuthenticated: boolean;\n  token: any | null;\n  email: string | null;\n  status: 'loading' | 'authenticated' | 'unauthenticated' | 'unverified';\n  user?: TernSecureUser | null;\n}\n\nexport type TernSecureStateExtended = {\n  sessionClaims: DecodedIdToken | null;\n  userId: string | null;\n  token: string | null;\n  user?: TernSecureUser | null;\n};\n\nexport type AuthProviderStatus = 'idle' | 'pending' | 'error' | 'success';\n\nexport const DEFAULT_TERN_SECURE_STATE: TernSecureState = {\n  userId: null,\n  isLoaded: false,\n  error: null,\n  isValid: false,\n  isVerified: false,\n  isAuthenticated: false,\n  token: null,\n  email: null,\n  status: 'loading',\n  user: null,\n};\n\nexport interface TernSecureAuthProvider {\n  /** Current auth state */\n  internalAuthState: TernSecureState;\n\n  /** Current user*/\n  ternSecureUser(): TernSecureUser | null;\n\n  /** AuthCookie Manager */\n  authCookieManager(): void;\n\n  /** Current session */\n  currentSession: SignedInSession | null;\n\n  /** Sign in resource for authentication operations */\n  signIn: SignInResource | undefined;\n\n  /** SignUp resource for authentication operations */\n  signUp: SignUpResource | undefined;\n\n  /** The Firebase configuration used by this TernAuth instance. */\n  ternSecureConfig?: TernSecureConfig;\n\n  /** Sign out the current user */\n  signOut(): Promise<void>;\n}\n\nexport type Persistence = 'local' | 'session' | 'browserCookie' | 'none';\n\ntype Mode = 'browser' | 'server';\n\nexport type TernAuthSDK = {\n  /** SDK package name (e.g., @tern-secure/auth) */\n  name: string;\n  /** SDK version (e.g., 1.2.3) */\n  version: string;\n  /** Build environment (development, production, test) */\n  environment?: string;\n  /** Build date as ISO string */\n  buildDate?: string;\n  /** Additional build metadata */\n  buildInfo?: {\n    name: string;\n    version: string;\n    buildDate: string;\n    buildEnv: string;\n  };\n};\n\nexport interface TernSecureResources {\n  user?: TernSecureUser | null;\n  session?: SignedInSession | null;\n}\n\nexport type CreateActiveSessionParams = {\n  session?: TernSecureUser | null;\n  redirectUrl?: string;\n};\n\nexport type CreateActiveSession = (params: CreateActiveSessionParams) => Promise<void>;\n\n/**\n * Navigation options used to replace or push history changes.\n * Both `routerPush` & `routerReplace` OR none options should be passed.\n */\ntype TernSecureOptionsNavigation =\n  | {\n      /**\n       * A function which takes the destination path as an argument and performs a \"push\" navigation.\n       */\n      routerPush?: never;\n      /**\n       * A function which takes the destination path as an argument and performs a \"replace\" navigation.\n       */\n      routerReplace?: never;\n      routerDebug?: boolean;\n    }\n  | {\n      routerPush: RouterFn;\n      routerReplace: RouterFn;\n      routerDebug?: boolean;\n    };\n\nexport type TernSecureAuthOptions = TernSecureOptionsNavigation &\n  SignInForceRedirectUrl &\n  SignInFallbackRedirectUrl &\n  SignUpForceRedirectUrl &\n  SignUpFallbackRedirectUrl &\n  AfterSignOutUrl & {\n    apiUrl?: string;\n    sdkMetadata?: TernAuthSDK;\n    signInUrl?: string;\n    signUpUrl?: string;\n    mode?: Mode;\n    requiresVerification?: boolean;\n    isTernSecureDev?: boolean;\n    ternSecureConfig?: TernSecureConfig;\n    persistence?: Persistence;\n    enableServiceWorker?: boolean;\n    /**\n     * An optional array of domains to validate user-provided redirect URLs against. If no match is made, the redirect is considered unsafe and the default redirect will be used with a warning logged in the console.\n     */\n    allowedRedirectOrigins?: Array<string | RegExp>;\n    /**\n     * An optional array of protocols to validate user-provided redirect URLs against. If no match is made, the redirect is considered unsafe and the default redirect will be used with a warning logged in the console.\n     */\n    allowedRedirectProtocols?: Array<string>;\n    experimental?: {\n      /** rethrow network errors that occur while the offline */\n      rethrowOfflineNetworkErrors?: boolean;\n    };\n  };\n\nexport type TernAuthListenerEventPayload = {\n  authStateChanged: TernSecureState;\n  userChanged: TernSecureUser;\n  sessionChanged: SignedInSession | null;\n  tokenRefreshed: string | null;\n};\n\nexport interface NavigateOptions {\n  replace?: boolean;\n  metadata?: RouterMetadata;\n}\n\nexport type TernAuthListenerEvent = keyof TernAuthListenerEventPayload;\n\nexport type ListenerCallback = (emission: TernSecureResources) => void;\nexport type UnsubscribeCallback = () => void;\ntype TernSecureEvent = keyof TernAuthEventPayload;\ntype EventHandler<Events extends TernSecureEvent> = (payload: TernAuthEventPayload[Events]) => void;\nexport type TernAuthEventPayload = {\n  status: TernSecureAuthStatus;\n};\n\nexport type TernSecureAuthStatus = 'error' | 'loading' | 'ready';\n\ntype onEventListener = <E extends TernSecureEvent>(\n  event: E,\n  handler: EventHandler<E>,\n  opt?: { notify?: boolean },\n) => void;\ntype OffEventListener = <E extends TernSecureEvent>(event: E, handler: EventHandler<E>) => void;\n\nexport type SignOutOptions = {\n  /** URL to redirect to after sign out */\n  redirectUrl?: string;\n  /** Callback to perform consumer-specific cleanup (e.g., delete session cookies) */\n  onBeforeSignOut?: () => Promise<void> | void;\n  /** Callback executed after successful sign out */\n  onAfterSignOut?: () => Promise<void> | void;\n};\n\nexport interface SignOut {\n  (options?: SignOutOptions): Promise<void>;\n}\n\nexport interface TernSecureAuth {\n  /** TernSecureAuth SDK version number */\n  version: string | undefined;\n\n  /** Metadata about the SDK instance */\n  sdkMetadata: TernAuthSDK | undefined;\n\n  /** Indicates if the TernSecureAuth instance is currently loading */\n  isLoading: boolean;\n\n  /** The current status of the TernSecureAuth instance */\n  status: TernSecureAuthStatus;\n\n  /** TernSecure API URL */\n  apiUrl: string;\n\n  /** TernSecure domain for API string */\n  domain: string;\n\n  /** TernSecure Proxy url */\n  proxyUrl?: string;\n\n  /** TernSecure Instance type */\n  instanceType: InstanceType | undefined;\n\n  /** Indicates if the TernSecureAuth instance is ready for use */\n  isReady: boolean;\n\n  /** Requires Verification */\n  requiresVerification: boolean;\n\n  /** Initialize TernSecureAuth */\n  initialize: (options?: TernSecureAuthOptions) => Promise<void>;\n\n  /**\n   * @internal\n   */\n  _internal_getOption<K extends keyof TernSecureAuthOptions>(key: K): TernSecureAuthOptions[K];\n\n  /**\n   * @internal\n   */\n  _internal_getAllOptions(): Readonly<TernSecureAuthOptions>;\n\n  /** Current user*/\n  user: TernSecureUser | null | undefined;\n\n  /** Current session */\n  currentSession: SignedInSession | null;\n\n  /** Sign in resource for authentication operations */\n  signIn: SignInResource | undefined | null;\n\n  /** SignUp resource for authentication operations */\n  signUp: SignUpResource | undefined | null;\n\n  /** The Firebase configuration used by this TernAuth instance. */\n  ternSecureConfig?: TernSecureConfig;\n\n  /** Subscribe to auth state changes */\n  onAuthStateChanged(callback: (cb: any) => void): () => void;\n\n  /** Sign out the current user */\n  signOut: SignOut;\n\n  /** Subscribe to a single event */\n  on: onEventListener;\n\n  /** Remove event listener */\n  off: OffEventListener;\n\n  /** Subscribe to all auth state changes */\n  addListener: (callback: ListenerCallback) => UnsubscribeCallback;\n\n  /** Get redirect result from OAuth flows */\n  getRedirectResult: () => Promise<any>;\n\n  /** Create an active session */\n  createActiveSession: CreateActiveSession;\n\n  /**\n   * @param {string} to\n   */\n  constructUrlWithAuthRedirect(to: string): string;\n\n  /** Navigate to SignIn page */\n  redirectToSignIn(options?: SignInRedirectOptions): Promise<unknown>;\n  /** Navigate to SignUp page */\n  redirectToSignUp(options?: SignUpRedirectOptions): Promise<unknown>;\n\n  redirectAfterSignIn: () => void;\n\n  redirectAfterSignUp: () => void;\n}\n\nexport type SignUpFormValues = {\n  email: string;\n  password: string;\n  confirmPassword?: string;\n  displayName?: string;\n};\n\nexport type SignUpInitialValue = Partial<SignUpFormValues>;\n\nexport interface TernSecureAuthFactory {\n  create(options?: TernSecureAuthOptions): TernSecureAuth;\n}\n\nexport type SharedSignInAuthObjectProperties = {\n  session: DecodedIdToken;\n  userId: string;\n};\n\nexport type CheckCustomClaims = {\n  role?: string | string[];\n  permissions?: string | string[];\n  [key: string]: any;\n};\n\nexport type CheckAuthorizationFromSessionClaims = (\n  isAuthorizedParams: CheckCustomClaims,\n) => boolean;\n\nexport type TernVerificationResult =\n  | (DecodedIdToken & {\n      valid: true;\n      token?: string;\n      error?: never;\n    })\n  | {\n      valid: false;\n      error: AuthErrorResponse;\n    };\n\n/**\n * Props for SignIn component focusing on UI concerns\n */\nexport type SignInProps = {\n  /** Routing Path */\n  path?: string;\n  /** URL to navigate to after successfully sign-in */\n  forceRedirectUrl?: string | null;\n  /** Initial form values */\n  initialValue?: SignInInitialValue;\n  /** Callbacks */\n  onSuccess?: (user: TernSecureUser | null) => void;\n} & SignUpForceRedirectUrl;\n\n/**\n * Props for SignUp component focusing on UI concerns\n */\nexport type SignUpProps = {\n  /** URL to navigate to after successfully sign-up */\n  forceRedirectUrl?: string | null;\n  /** Initial form values */\n  initialValue?: SignUpInitialValue;\n  /** Callbacks */\n  onSubmit?: (values: SignUpFormValues) => Promise<void>;\n  onSuccess?: (user: TernSecureUser | null) => void;\n} & SignInForceRedirectUrl;\n\nexport type SignInRedirectOptions = RedirectOptions;\nexport type SignUpRedirectOptions = RedirectOptions;\n\nexport type RoutingStrategy = 'path' | 'hash' | 'virtual';\n\n/**\n * Internal is a navigation type that affects the component\n *\n */\ntype NavigationType =\n  /**\n   * Internal navigations affect the components and alter the\n   * part of the URL that comes after the `path` passed to the component.\n   * eg  <SignIn path='sign-in'>\n   * going from /sign-in to /sign-in/factor-one is an internal navigation\n   */\n  | 'internal'\n  /**\n   * Internal navigations affect the components and alter the\n   * part of the URL that comes before the `path` passed to the component.\n   * eg  <SignIn path='sign-in'>\n   * going from /sign-in to / is an external navigation\n   */\n  | 'external'\n  /**\n   * Window navigations are navigations towards a different origin\n   * and are not handled by the TernSecure component or the host app router.\n   */\n  | 'window';\n\ntype RouterMetadata = { routing?: RoutingStrategy; navigationType?: NavigationType };\n\n/**\n * @inline\n */\ntype RouterFn = (\n  /**\n   * The destination path\n   */\n  to: string,\n  /**\n   * Optional metadata\n   */\n  metadata?: {\n    /**\n     * @internal\n     */\n    __internal_metadata?: RouterMetadata;\n    /**\n     * Provide a function to be used for navigation.\n     */\n    windowNavigate: (to: URL | string) => void;\n  },\n) => Promise<unknown> | unknown;\n","import type { UserCredential } from \"./all\";\nimport type { ErrorCode} from \"./errors\";\n\nexport type SignInStatus =\n  | 'idle'\n  | 'pending_email_password'\n  | 'pending_social'\n  | 'pending_mfa'\n  | 'redirecting'\n  | 'success'\n  | 'error';\n\n\nexport type SignInFormValues = {\n  email: string;\n  password: string;\n  phoneNumber?: string;\n};\n\nexport interface AuthErrorResponse {\n  success: false\n  message: string\n  code: ErrorCode\n}\n\nexport interface AuthErrorTree extends Error {\n  code?: any | string;\n  message: string;\n  response?: any | string;\n}\n\ninterface BaseSignInResponse {\n  status?: SignInStatus;\n  message?: string;\n  error?: any | undefined;\n}\n\n\nexport interface SignInSuccessResponse extends BaseSignInResponse, UserCredential {\n  status: 'success';\n}\n\nexport interface SignInErrorResponse extends BaseSignInResponse {\n  status: 'error';\n}\n\nexport interface SignInPendingResponse extends BaseSignInResponse {\n  status: 'redirecting' | 'pending_social' | 'pending_email_password';\n}\n\nexport type SignInResponse = \n  | SignInSuccessResponse \n  | SignInErrorResponse \n  | SignInPendingResponse;\n\n\nexport type SignInInitialValue = Partial<SignInFormValues>;\n\n\nexport interface ResendEmailVerification {\n  isVerified?: boolean;\n}\n\nexport function isSignInResponseTree(value: any): value is SignInResponse {\n  return (\n    typeof value === 'object' &&\n    'success' in value &&\n    typeof value.success === 'boolean'\n  );\n}\n\n/**\n * social provider options that allow to specify custom parameters\n */\nexport interface SocialProviderOptions {\n  /** Authentication mode - popup or redirect */\n  mode?: 'popup' | 'redirect';\n  /** Custom parameters specific to the provider (e.g., prompt, access_type, locale) */\n  customParameters?: Record<string, string>;\n  /** OAuth scopes to request from the provider */\n  scopes?: string[];\n}\n\n\nexport interface SignInResource {\n  /**\n   * The current status of the sign-in process.\n   */\n  status?: SignInStatus;\n  /**\n   * Signs in a user with their email and password.\n   * @param params - The sign-in form values.\n   * @returns A promise that resolves with the sign-in response.\n   */\n  withEmailAndPassword: (params: SignInFormValues) => Promise<SignInResponse>;\n  /**\n   * @param provider - The identifier of the social provider (e.g., 'google', 'microsoft', 'github').\n   * @param options - Optional configuration for the social sign-in flow.\n   * @returns A promise that resolves with the sign-in response or void if redirecting.\n   */\n  withSocialProvider: (provider: string, options: SocialProviderOptions) => Promise<SignInResponse | void>;\n  /**\n   * Completes an MFA (Multi-Factor Authentication) step after a primary authentication attempt.\n   * @param mfaToken - The MFA token or code submitted by the user.\n   * @param mfaContext - Optional context or session data from the MFA initiation step.\n   * @returns A promise that resolves with the sign-in response upon successful MFA verification.\n   */\n  completeMfaSignIn: (mfaToken: string, mfaContext?: any) => Promise<SignInResponse>;\n  /**\n   * Sends a password reset email to the given email address.\n   * @param email - The user's email address.\n   * @returns A promise that resolves when the email is sent.\n   */\n  sendPasswordResetEmail: (email: string) => Promise<void>;\n  /**\n   * Resends the email verification link to the user's email address.\n   * @returns A promise that resolves with the sign-in response.\n   */\n  resendEmailVerification: () => Promise<ResendEmailVerification>;\n  /**\n   * Checks the result of a redirect-based sign-in flow, typically used in OAuth or SSO scenarios.\n   * @returns A promise that resolves with the sign-in response or null if no result is available.\n   */\n  checkRedirectResult: () => Promise<SignInResponse| null>;\n}"],"mappings":";AAMO,IAAM,SAAS;AAAA,EACpB,4BAA4B;AAAA,EAC5B,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,eAAe;AAAA,EACf,cAAc;AAAA,EACd,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,oBAAoB;AAAA,EACpB,mBAAmB;AAAA,EACnB,wBAAwB;AAAA,EACxB,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,eAAe;AACjB;;;ACIO,IAAM,4BAA6C;AAAA,EACxD,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,OAAO;AAAA,EACP,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,OAAO;AAAA,EACP,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,MAAM;AACR;;;ACQO,SAAS,qBAAqB,OAAqC;AACxE,SACE,OAAO,UAAU,YACjB,aAAa,SACb,OAAO,MAAM,YAAY;AAE7B;","names":[]}

package/dist/index.d.mts

@@ -252,6 +252,7 @@ declare const ERRORS: {
     readonly WRONG_PASSWORD: "auth/wrong-password";
     readonly EMAIL_ALREADY_IN_USE: "auth/email-already-in-use";
     readonly REQUIRES_RECENT_LOGIN: "auth/requires-recent-login";
+    readonly INCORRECT_ARGUMENT: "auth/argument-error";
     readonly NO_SESSION_COOKIE: "No session cookie found.";
     readonly INVALID_SESSION_COOKIE: "Invalid session cookie.";
     readonly NO_ID_TOKEN: "No ID token found.";
@@ -336,6 +337,7 @@ interface TernSecureHandlerOptions {
         sessions?: SessionEndpointConfig;
     };
     tenantId?: string | null;
+    revokeRefreshTokensOnSignOut?: boolean;
     enableCustomToken?: boolean;
     debug?: boolean;
     environment?: 'development' | 'production' | 'test';
@@ -426,6 +428,17 @@ interface ResendEmailVerification {
     isVerified?: boolean;
 }
 declare function isSignInResponseTree(value: any): value is SignInResponse;
+/**
+ * social provider options that allow to specify custom parameters
+ */
+interface SocialProviderOptions {
+    /** Authentication mode - popup or redirect */
+    mode?: 'popup' | 'redirect';
+    /** Custom parameters specific to the provider (e.g., prompt, access_type, locale) */
+    customParameters?: Record<string, string>;
+    /** OAuth scopes to request from the provider */
+    scopes?: string[];
+}
 interface SignInResource {
     /**
      * The current status of the sign-in process.
@@ -442,9 +455,7 @@ interface SignInResource {
      * @param options - Optional configuration for the social sign-in flow.
      * @returns A promise that resolves with the sign-in response or void if redirecting.
      */
-    withSocialProvider: (provider: string, options?: {
-        mode?: 'popup' | 'redirect';
-    }) => Promise<SignInResponse | void>;
+    withSocialProvider: (provider: string, options: SocialProviderOptions) => Promise<SignInResponse | void>;
     /**
      * Completes an MFA (Multi-Factor Authentication) step after a primary authentication attempt.
      * @param mfaToken - The MFA token or code submitted by the user.
@@ -554,16 +565,56 @@ type Jwt = {
     };
 };
 
-type SignInRedirectUrl = {
+/**
+ * @deprecated This will be removed in a future release.
+ */
+type LegacyRedirectProps = {
+    /**
+     * @deprecated Use `fallbackRedirectUrl` or `forceRedirectUrl` instead.
+     */
+    afterSignInUrl?: string | null;
+    /**
+     * @deprecated Use `fallbackRedirectUrl` or `forceRedirectUrl` instead.
+     */
+    afterSignUpUrl?: string | null;
+    /**
+     * @deprecated Use `fallbackRedirectUrl` or `forceRedirectUrl` instead.
+     */
+    redirectUrl?: string | null;
+};
+type RedirectOptions = SignInForceRedirectUrl & SignInFallbackRedirectUrl & SignUpForceRedirectUrl & SignUpFallbackRedirectUrl & LegacyRedirectProps;
+type RedirectUrlProp = {
+    /**
+     * Full URL or path to navigate to after a successful action.
+     */
+    redirectUrl?: string | null;
+};
+type SignInForceRedirectUrl = {
     signInForceRedirectUrl?: string | null;
 };
-type SignUpRedirectUrl = {
+type SignInFallbackRedirectUrl = {
+    /**
+     * The fallback URL to redirect to after the user signs in, if there's no `redirect_url` in the path already.
+     * @default '/'
+     */
+    signInFallbackRedirectUrl?: string | null;
+};
+type SignUpForceRedirectUrl = {
     signUpForceRedirectUrl?: string | null;
 };
+type SignUpFallbackRedirectUrl = {
+    /**
+     * The fallback URL to redirect to after the user signs up, if there's no `redirect_url` in the path already.
+     * @default '/'
+     */
+    signUpFallbackRedirectUrl?: string | null;
+};
 type AfterSignOutUrl = {
+    /**
+     * Full URL or path to navigate to after successful sign out.
+     */
     afterSignOutUrl?: string | null;
 };
-type RedirectOptions = SignInRedirectUrl | SignUpRedirectUrl;
 
 interface InitialState {
     userId: string | null;
@@ -637,7 +688,26 @@ type CreateActiveSessionParams = {
     redirectUrl?: string;
 };
 type CreateActiveSession = (params: CreateActiveSessionParams) => Promise<void>;
-type TernSecureAuthOptions = {
+/**
+ * Navigation options used to replace or push history changes.
+ * Both `routerPush` & `routerReplace` OR none options should be passed.
+ */
+type TernSecureOptionsNavigation = {
+    /**
+     * A function which takes the destination path as an argument and performs a "push" navigation.
+     */
+    routerPush?: never;
+    /**
+     * A function which takes the destination path as an argument and performs a "replace" navigation.
+     */
+    routerReplace?: never;
+    routerDebug?: boolean;
+} | {
+    routerPush: RouterFn;
+    routerReplace: RouterFn;
+    routerDebug?: boolean;
+};
+type TernSecureAuthOptions = TernSecureOptionsNavigation & SignInForceRedirectUrl & SignInFallbackRedirectUrl & SignUpForceRedirectUrl & SignUpFallbackRedirectUrl & AfterSignOutUrl & {
     apiUrl?: string;
     sdkMetadata?: TernAuthSDK;
     signInUrl?: string;
@@ -648,17 +718,29 @@ type TernSecureAuthOptions = {
     ternSecureConfig?: TernSecureConfig;
     persistence?: Persistence;
     enableServiceWorker?: boolean;
+    /**
+     * An optional array of domains to validate user-provided redirect URLs against. If no match is made, the redirect is considered unsafe and the default redirect will be used with a warning logged in the console.
+     */
+    allowedRedirectOrigins?: Array<string | RegExp>;
+    /**
+     * An optional array of protocols to validate user-provided redirect URLs against. If no match is made, the redirect is considered unsafe and the default redirect will be used with a warning logged in the console.
+     */
+    allowedRedirectProtocols?: Array<string>;
     experimental?: {
         /** rethrow network errors that occur while the offline */
         rethrowOfflineNetworkErrors?: boolean;
     };
-} & SignInRedirectUrl & SignUpRedirectUrl & AfterSignOutUrl;
+};
 type TernAuthListenerEventPayload = {
     authStateChanged: TernSecureState;
     userChanged: TernSecureUser;
     sessionChanged: SignedInSession | null;
     tokenRefreshed: string | null;
 };
+interface NavigateOptions {
+    replace?: boolean;
+    metadata?: RouterMetadata;
+}
 type TernAuthListenerEvent = keyof TernAuthListenerEventPayload;
 type ListenerCallback = (emission: TernSecureResources) => void;
 type UnsubscribeCallback = () => void;
@@ -705,7 +787,7 @@ interface TernSecureAuth {
     /** Requires Verification */
     requiresVerification: boolean;
     /** Initialize TernSecureAuth */
-    initialize(options?: TernSecureAuthOptions): Promise<void>;
+    initialize: (options?: TernSecureAuthOptions) => Promise<void>;
     /**
      * @internal
      */
@@ -738,6 +820,10 @@ interface TernSecureAuth {
     getRedirectResult: () => Promise<any>;
     /** Create an active session */
     createActiveSession: CreateActiveSession;
+    /**
+     * @param {string} to
+     */
+    constructUrlWithAuthRedirect(to: string): string;
     /** Navigate to SignIn page */
     redirectToSignIn(options?: SignInRedirectOptions): Promise<unknown>;
     /** Navigate to SignUp page */
@@ -785,7 +871,7 @@ type SignInProps = {
     initialValue?: SignInInitialValue;
     /** Callbacks */
     onSuccess?: (user: TernSecureUser | null) => void;
-} & SignUpRedirectUrl;
+} & SignUpForceRedirectUrl;
 /**
  * Props for SignUp component focusing on UI concerns
  */
@@ -797,9 +883,59 @@ type SignUpProps = {
     /** Callbacks */
     onSubmit?: (values: SignUpFormValues) => Promise<void>;
     onSuccess?: (user: TernSecureUser | null) => void;
-} & SignInRedirectUrl;
+} & SignInForceRedirectUrl;
 type SignInRedirectOptions = RedirectOptions;
 type SignUpRedirectOptions = RedirectOptions;
+type RoutingStrategy = 'path' | 'hash' | 'virtual';
+/**
+ * Internal is a navigation type that affects the component
+ *
+ */
+type NavigationType = 
+/**
+ * Internal navigations affect the components and alter the
+ * part of the URL that comes after the `path` passed to the component.
+ * eg  <SignIn path='sign-in'>
+ * going from /sign-in to /sign-in/factor-one is an internal navigation
+ */
+'internal'
+/**
+ * Internal navigations affect the components and alter the
+ * part of the URL that comes before the `path` passed to the component.
+ * eg  <SignIn path='sign-in'>
+ * going from /sign-in to / is an external navigation
+ */
+ | 'external'
+/**
+ * Window navigations are navigations towards a different origin
+ * and are not handled by the TernSecure component or the host app router.
+ */
+ | 'window';
+type RouterMetadata = {
+    routing?: RoutingStrategy;
+    navigationType?: NavigationType;
+};
+/**
+ * @inline
+ */
+type RouterFn = (
+/**
+ * The destination path
+ */
+to: string, 
+/**
+ * Optional metadata
+ */
+metadata?: {
+    /**
+     * @internal
+     */
+    __internal_metadata?: RouterMetadata;
+    /**
+     * Provide a function to be used for navigation.
+     */
+    windowNavigate: (to: URL | string) => void;
+}) => Promise<unknown> | unknown;
 
 /**
  * Defines the basic structure for color theming.
@@ -973,7 +1109,7 @@ type TernSecureInstanceTreeOptions = {
     isTernSecureDev?: boolean;
     ternSecureConfig?: TernSecureConfig;
     enableServiceWorker?: boolean;
-} & SignInRedirectUrl & SignUpRedirectUrl & AfterSignOutUrl;
+} & SignInForceRedirectUrl & SignUpForceRedirectUrl & AfterSignOutUrl;
 type TernSecureInstanceTreeStatus = 'error' | 'loading' | 'ready';
 /**
  * Instance interface for managing auth UI state
@@ -1074,7 +1210,7 @@ type SignInPropsTree = {
     /** Callbacks */
     onError?: (error: AuthErrorTree) => void;
     onSuccess?: (user: TernSecureUser | null) => void;
-} & SignUpRedirectUrl;
+} & SignUpForceRedirectUrl;
 /**
  * Props for SignUp component focusing on UI concerns
  */
@@ -1089,7 +1225,7 @@ type SignUpPropsTree = {
     onSubmit?: (values: SignUpFormValuesTree) => Promise<void>;
     onError?: (error: AuthErrorTree) => void;
     onSuccess?: (user: TernSecureUser | null) => void;
-} & SignInRedirectUrl;
+} & SignInForceRedirectUrl;
 type SignInRedirectOptionss = RedirectOptions;
 type SignUpRedirectOptionss = RedirectOptions;
 
@@ -1140,4 +1276,4 @@ type DomainOrProxyUrl = {
  */
 type Autocomplete<U extends T, T = string> = U | (T & Record<never, never>);
 
-export { type ActiveSession, type AdminConfigValidationResult, type AfterSignOutUrl, type Appearance, type AuthEndpoint, type AuthErrorCode, type AuthErrorResponse, type AuthErrorTree, type AuthProviderStatus, type Autocomplete, type BaseAuthUIConfig, type CheckAuthorizationFromSessionClaims, type CheckCustomClaims, type ConfigValidationResult, type CookieEndpointConfig, type CookieOptions, type CookieOpts, type CookieResource, type CookieStore, type CookieSubEndpoint, type CorsOptions, type CreateActiveSession, type CreateActiveSessionParams, DEFAULT_TERN_SECURE_STATE, type DecodedIdToken, type DomainOrProxyUrl, ERRORS, type EndpointConfig, type ErrorCode, type ExpiredSession, type FirebaseClaims, type FirebaseState, type IdTokenResult, type IdTokenResult_DEPRECATED, type InitialState, type InstanceType, type JWTPayload, type JWTProtectedHeader, type Jwt, type ListenerCallback, type ParsedToken, type PendingSession, type Persistence, type ProviderUserInfo, type RateLimitOptions, type RedirectOptions, type ResendEmailVerification, type SecurityOptions, type ServerConfigValidationResult, type SessionCookieConfig, type SessionEndpointConfig, type SessionJson, type SessionParams, type SessionResource, type SessionResult, type SessionStatus, type SessionSubEndpoint, type SharedSignInAuthObjectProperties, type SignInErrorResponse, type SignInFormValues, type SignInInitialValue, type SignInPendingResponse, type SignInProps, type SignInPropsTree, type SignInRedirectOptions, type SignInRedirectOptionss, type SignInRedirectUrl, type SignInResource, type SignInResponse, type SignInStatus, type SignInSuccessResponse, type SignInUIConfig, type SignOut, type SignOutOptions, type SignOutOptionsTree, type SignUpFormValues, type SignUpFormValuesTree, type SignUpInitialValue, type SignUpInitialValueTree, type SignUpProps, type SignUpPropsTree, type SignUpRedirectOptions, type SignUpRedirectOptionss, type SignUpRedirectUrl, type SignUpResource, type SignUpStatus, type SignUpUIConfig, type SignedInSession, type TernAuthEventPayload, type TernAuthListenerEvent, type TernAuthListenerEventPayload, type TernAuthSDK, type TernSecureAPIError, type TernSecureAdminConfig, type TernSecureApiErrorJSON, type TernSecureAuth, type TernSecureAuthFactory, type TernSecureAuthOptions, type TernSecureAuthProvider, type TernSecureAuthStatus, type TernSecureConfig, type TernSecureFireRestError, type TernSecureFireRestErrorJSON, type TernSecureHandlerOptions, type TernSecureInstance, type TernSecureInstanceTree, type TernSecureInstanceTreeOptions, type TernSecureInstanceTreeStatus, type TernSecureOptions, type TernSecureResources, type TernSecureSDK, type TernSecureServerConfig, type TernSecureSessionTree, type TernSecureState, type TernSecureStateExtended, type TernSecureUser, type TernSecureUserData, type TernVerificationResult, type ThemeBorderRadius, type ThemeColors, type ThemeComponentStyles, type ThemeFonts, type ThemeSpacing, type TokenCookieConfig, type UnsubscribeCallback, type UseAuthReturn, type UseSignInReturn, type UserCredential, type UserInfo, type VerifiedTokens, isSignInResponseTree };
+export { type ActiveSession, type AdminConfigValidationResult, type AfterSignOutUrl, type Appearance, type AuthEndpoint, type AuthErrorCode, type AuthErrorResponse, type AuthErrorTree, type AuthProviderStatus, type Autocomplete, type BaseAuthUIConfig, type CheckAuthorizationFromSessionClaims, type CheckCustomClaims, type ConfigValidationResult, type CookieEndpointConfig, type CookieOptions, type CookieOpts, type CookieResource, type CookieStore, type CookieSubEndpoint, type CorsOptions, type CreateActiveSession, type CreateActiveSessionParams, DEFAULT_TERN_SECURE_STATE, type DecodedIdToken, type DomainOrProxyUrl, ERRORS, type EndpointConfig, type ErrorCode, type ExpiredSession, type FirebaseClaims, type FirebaseState, type IdTokenResult, type IdTokenResult_DEPRECATED, type InitialState, type InstanceType, type JWTPayload, type JWTProtectedHeader, type Jwt, type LegacyRedirectProps, type ListenerCallback, type NavigateOptions, type ParsedToken, type PendingSession, type Persistence, type ProviderUserInfo, type RateLimitOptions, type RedirectOptions, type RedirectUrlProp, type ResendEmailVerification, type RoutingStrategy, type SecurityOptions, type ServerConfigValidationResult, type SessionCookieConfig, type SessionEndpointConfig, type SessionJson, type SessionParams, type SessionResource, type SessionResult, type SessionStatus, type SessionSubEndpoint, type SharedSignInAuthObjectProperties, type SignInErrorResponse, type SignInFallbackRedirectUrl, type SignInForceRedirectUrl, type SignInFormValues, type SignInInitialValue, type SignInPendingResponse, type SignInProps, type SignInPropsTree, type SignInRedirectOptions, type SignInRedirectOptionss, type SignInResource, type SignInResponse, type SignInStatus, type SignInSuccessResponse, type SignInUIConfig, type SignOut, type SignOutOptions, type SignOutOptionsTree, type SignUpFallbackRedirectUrl, type SignUpForceRedirectUrl, type SignUpFormValues, type SignUpFormValuesTree, type SignUpInitialValue, type SignUpInitialValueTree, type SignUpProps, type SignUpPropsTree, type SignUpRedirectOptions, type SignUpRedirectOptionss, type SignUpResource, type SignUpStatus, type SignUpUIConfig, type SignedInSession, type SocialProviderOptions, type TernAuthEventPayload, type TernAuthListenerEvent, type TernAuthListenerEventPayload, type TernAuthSDK, type TernSecureAPIError, type TernSecureAdminConfig, type TernSecureApiErrorJSON, type TernSecureAuth, type TernSecureAuthFactory, type TernSecureAuthOptions, type TernSecureAuthProvider, type TernSecureAuthStatus, type TernSecureConfig, type TernSecureFireRestError, type TernSecureFireRestErrorJSON, type TernSecureHandlerOptions, type TernSecureInstance, type TernSecureInstanceTree, type TernSecureInstanceTreeOptions, type TernSecureInstanceTreeStatus, type TernSecureOptions, type TernSecureResources, type TernSecureSDK, type TernSecureServerConfig, type TernSecureSessionTree, type TernSecureState, type TernSecureStateExtended, type TernSecureUser, type TernSecureUserData, type TernVerificationResult, type ThemeBorderRadius, type ThemeColors, type ThemeComponentStyles, type ThemeFonts, type ThemeSpacing, type TokenCookieConfig, type UnsubscribeCallback, type UseAuthReturn, type UseSignInReturn, type UserCredential, type UserInfo, type VerifiedTokens, isSignInResponseTree };

package/dist/index.d.ts

@@ -252,6 +252,7 @@ declare const ERRORS: {
     readonly WRONG_PASSWORD: "auth/wrong-password";
     readonly EMAIL_ALREADY_IN_USE: "auth/email-already-in-use";
     readonly REQUIRES_RECENT_LOGIN: "auth/requires-recent-login";
+    readonly INCORRECT_ARGUMENT: "auth/argument-error";
     readonly NO_SESSION_COOKIE: "No session cookie found.";
     readonly INVALID_SESSION_COOKIE: "Invalid session cookie.";
     readonly NO_ID_TOKEN: "No ID token found.";
@@ -336,6 +337,7 @@ interface TernSecureHandlerOptions {
         sessions?: SessionEndpointConfig;
     };
     tenantId?: string | null;
+    revokeRefreshTokensOnSignOut?: boolean;
     enableCustomToken?: boolean;
     debug?: boolean;
     environment?: 'development' | 'production' | 'test';
@@ -426,6 +428,17 @@ interface ResendEmailVerification {
     isVerified?: boolean;
 }
 declare function isSignInResponseTree(value: any): value is SignInResponse;
+/**
+ * social provider options that allow to specify custom parameters
+ */
+interface SocialProviderOptions {
+    /** Authentication mode - popup or redirect */
+    mode?: 'popup' | 'redirect';
+    /** Custom parameters specific to the provider (e.g., prompt, access_type, locale) */
+    customParameters?: Record<string, string>;
+    /** OAuth scopes to request from the provider */
+    scopes?: string[];
+}
 interface SignInResource {
     /**
      * The current status of the sign-in process.
@@ -442,9 +455,7 @@ interface SignInResource {
      * @param options - Optional configuration for the social sign-in flow.
      * @returns A promise that resolves with the sign-in response or void if redirecting.
      */
-    withSocialProvider: (provider: string, options?: {
-        mode?: 'popup' | 'redirect';
-    }) => Promise<SignInResponse | void>;
+    withSocialProvider: (provider: string, options: SocialProviderOptions) => Promise<SignInResponse | void>;
     /**
      * Completes an MFA (Multi-Factor Authentication) step after a primary authentication attempt.
      * @param mfaToken - The MFA token or code submitted by the user.
@@ -554,16 +565,56 @@ type Jwt = {
     };
 };
 
-type SignInRedirectUrl = {
+/**
+ * @deprecated This will be removed in a future release.
+ */
+type LegacyRedirectProps = {
+    /**
+     * @deprecated Use `fallbackRedirectUrl` or `forceRedirectUrl` instead.
+     */
+    afterSignInUrl?: string | null;
+    /**
+     * @deprecated Use `fallbackRedirectUrl` or `forceRedirectUrl` instead.
+     */
+    afterSignUpUrl?: string | null;
+    /**
+     * @deprecated Use `fallbackRedirectUrl` or `forceRedirectUrl` instead.
+     */
+    redirectUrl?: string | null;
+};
+type RedirectOptions = SignInForceRedirectUrl & SignInFallbackRedirectUrl & SignUpForceRedirectUrl & SignUpFallbackRedirectUrl & LegacyRedirectProps;
+type RedirectUrlProp = {
+    /**
+     * Full URL or path to navigate to after a successful action.
+     */
+    redirectUrl?: string | null;
+};
+type SignInForceRedirectUrl = {
     signInForceRedirectUrl?: string | null;
 };
-type SignUpRedirectUrl = {
+type SignInFallbackRedirectUrl = {
+    /**
+     * The fallback URL to redirect to after the user signs in, if there's no `redirect_url` in the path already.
+     * @default '/'
+     */
+    signInFallbackRedirectUrl?: string | null;
+};
+type SignUpForceRedirectUrl = {
     signUpForceRedirectUrl?: string | null;
 };
+type SignUpFallbackRedirectUrl = {
+    /**
+     * The fallback URL to redirect to after the user signs up, if there's no `redirect_url` in the path already.
+     * @default '/'
+     */
+    signUpFallbackRedirectUrl?: string | null;
+};
 type AfterSignOutUrl = {
+    /**
+     * Full URL or path to navigate to after successful sign out.
+     */
     afterSignOutUrl?: string | null;
 };
-type RedirectOptions = SignInRedirectUrl | SignUpRedirectUrl;
 
 interface InitialState {
     userId: string | null;
@@ -637,7 +688,26 @@ type CreateActiveSessionParams = {
     redirectUrl?: string;
 };
 type CreateActiveSession = (params: CreateActiveSessionParams) => Promise<void>;
-type TernSecureAuthOptions = {
+/**
+ * Navigation options used to replace or push history changes.
+ * Both `routerPush` & `routerReplace` OR none options should be passed.
+ */
+type TernSecureOptionsNavigation = {
+    /**
+     * A function which takes the destination path as an argument and performs a "push" navigation.
+     */
+    routerPush?: never;
+    /**
+     * A function which takes the destination path as an argument and performs a "replace" navigation.
+     */
+    routerReplace?: never;
+    routerDebug?: boolean;
+} | {
+    routerPush: RouterFn;
+    routerReplace: RouterFn;
+    routerDebug?: boolean;
+};
+type TernSecureAuthOptions = TernSecureOptionsNavigation & SignInForceRedirectUrl & SignInFallbackRedirectUrl & SignUpForceRedirectUrl & SignUpFallbackRedirectUrl & AfterSignOutUrl & {
     apiUrl?: string;
     sdkMetadata?: TernAuthSDK;
     signInUrl?: string;
@@ -648,17 +718,29 @@ type TernSecureAuthOptions = {
     ternSecureConfig?: TernSecureConfig;
     persistence?: Persistence;
     enableServiceWorker?: boolean;
+    /**
+     * An optional array of domains to validate user-provided redirect URLs against. If no match is made, the redirect is considered unsafe and the default redirect will be used with a warning logged in the console.
+     */
+    allowedRedirectOrigins?: Array<string | RegExp>;
+    /**
+     * An optional array of protocols to validate user-provided redirect URLs against. If no match is made, the redirect is considered unsafe and the default redirect will be used with a warning logged in the console.
+     */
+    allowedRedirectProtocols?: Array<string>;
     experimental?: {
         /** rethrow network errors that occur while the offline */
         rethrowOfflineNetworkErrors?: boolean;
     };
-} & SignInRedirectUrl & SignUpRedirectUrl & AfterSignOutUrl;
+};
 type TernAuthListenerEventPayload = {
     authStateChanged: TernSecureState;
     userChanged: TernSecureUser;
     sessionChanged: SignedInSession | null;
     tokenRefreshed: string | null;
 };
+interface NavigateOptions {
+    replace?: boolean;
+    metadata?: RouterMetadata;
+}
 type TernAuthListenerEvent = keyof TernAuthListenerEventPayload;
 type ListenerCallback = (emission: TernSecureResources) => void;
 type UnsubscribeCallback = () => void;
@@ -705,7 +787,7 @@ interface TernSecureAuth {
     /** Requires Verification */
     requiresVerification: boolean;
     /** Initialize TernSecureAuth */
-    initialize(options?: TernSecureAuthOptions): Promise<void>;
+    initialize: (options?: TernSecureAuthOptions) => Promise<void>;
     /**
      * @internal
      */
@@ -738,6 +820,10 @@ interface TernSecureAuth {
     getRedirectResult: () => Promise<any>;
     /** Create an active session */
     createActiveSession: CreateActiveSession;
+    /**
+     * @param {string} to
+     */
+    constructUrlWithAuthRedirect(to: string): string;
     /** Navigate to SignIn page */
     redirectToSignIn(options?: SignInRedirectOptions): Promise<unknown>;
     /** Navigate to SignUp page */
@@ -785,7 +871,7 @@ type SignInProps = {
     initialValue?: SignInInitialValue;
     /** Callbacks */
     onSuccess?: (user: TernSecureUser | null) => void;
-} & SignUpRedirectUrl;
+} & SignUpForceRedirectUrl;
 /**
  * Props for SignUp component focusing on UI concerns
  */
@@ -797,9 +883,59 @@ type SignUpProps = {
     /** Callbacks */
     onSubmit?: (values: SignUpFormValues) => Promise<void>;
     onSuccess?: (user: TernSecureUser | null) => void;
-} & SignInRedirectUrl;
+} & SignInForceRedirectUrl;
 type SignInRedirectOptions = RedirectOptions;
 type SignUpRedirectOptions = RedirectOptions;
+type RoutingStrategy = 'path' | 'hash' | 'virtual';
+/**
+ * Internal is a navigation type that affects the component
+ *
+ */
+type NavigationType = 
+/**
+ * Internal navigations affect the components and alter the
+ * part of the URL that comes after the `path` passed to the component.
+ * eg  <SignIn path='sign-in'>
+ * going from /sign-in to /sign-in/factor-one is an internal navigation
+ */
+'internal'
+/**
+ * Internal navigations affect the components and alter the
+ * part of the URL that comes before the `path` passed to the component.
+ * eg  <SignIn path='sign-in'>
+ * going from /sign-in to / is an external navigation
+ */
+ | 'external'
+/**
+ * Window navigations are navigations towards a different origin
+ * and are not handled by the TernSecure component or the host app router.
+ */
+ | 'window';
+type RouterMetadata = {
+    routing?: RoutingStrategy;
+    navigationType?: NavigationType;
+};
+/**
+ * @inline
+ */
+type RouterFn = (
+/**
+ * The destination path
+ */
+to: string, 
+/**
+ * Optional metadata
+ */
+metadata?: {
+    /**
+     * @internal
+     */
+    __internal_metadata?: RouterMetadata;
+    /**
+     * Provide a function to be used for navigation.
+     */
+    windowNavigate: (to: URL | string) => void;
+}) => Promise<unknown> | unknown;
 
 /**
  * Defines the basic structure for color theming.
@@ -973,7 +1109,7 @@ type TernSecureInstanceTreeOptions = {
     isTernSecureDev?: boolean;
     ternSecureConfig?: TernSecureConfig;
     enableServiceWorker?: boolean;
-} & SignInRedirectUrl & SignUpRedirectUrl & AfterSignOutUrl;
+} & SignInForceRedirectUrl & SignUpForceRedirectUrl & AfterSignOutUrl;
 type TernSecureInstanceTreeStatus = 'error' | 'loading' | 'ready';
 /**
  * Instance interface for managing auth UI state
@@ -1074,7 +1210,7 @@ type SignInPropsTree = {
     /** Callbacks */
     onError?: (error: AuthErrorTree) => void;
     onSuccess?: (user: TernSecureUser | null) => void;
-} & SignUpRedirectUrl;
+} & SignUpForceRedirectUrl;
 /**
  * Props for SignUp component focusing on UI concerns
  */
@@ -1089,7 +1225,7 @@ type SignUpPropsTree = {
     onSubmit?: (values: SignUpFormValuesTree) => Promise<void>;
     onError?: (error: AuthErrorTree) => void;
     onSuccess?: (user: TernSecureUser | null) => void;
-} & SignInRedirectUrl;
+} & SignInForceRedirectUrl;
 type SignInRedirectOptionss = RedirectOptions;
 type SignUpRedirectOptionss = RedirectOptions;
 
@@ -1140,4 +1276,4 @@ type DomainOrProxyUrl = {
  */
 type Autocomplete<U extends T, T = string> = U | (T & Record<never, never>);
 
-export { type ActiveSession, type AdminConfigValidationResult, type AfterSignOutUrl, type Appearance, type AuthEndpoint, type AuthErrorCode, type AuthErrorResponse, type AuthErrorTree, type AuthProviderStatus, type Autocomplete, type BaseAuthUIConfig, type CheckAuthorizationFromSessionClaims, type CheckCustomClaims, type ConfigValidationResult, type CookieEndpointConfig, type CookieOptions, type CookieOpts, type CookieResource, type CookieStore, type CookieSubEndpoint, type CorsOptions, type CreateActiveSession, type CreateActiveSessionParams, DEFAULT_TERN_SECURE_STATE, type DecodedIdToken, type DomainOrProxyUrl, ERRORS, type EndpointConfig, type ErrorCode, type ExpiredSession, type FirebaseClaims, type FirebaseState, type IdTokenResult, type IdTokenResult_DEPRECATED, type InitialState, type InstanceType, type JWTPayload, type JWTProtectedHeader, type Jwt, type ListenerCallback, type ParsedToken, type PendingSession, type Persistence, type ProviderUserInfo, type RateLimitOptions, type RedirectOptions, type ResendEmailVerification, type SecurityOptions, type ServerConfigValidationResult, type SessionCookieConfig, type SessionEndpointConfig, type SessionJson, type SessionParams, type SessionResource, type SessionResult, type SessionStatus, type SessionSubEndpoint, type SharedSignInAuthObjectProperties, type SignInErrorResponse, type SignInFormValues, type SignInInitialValue, type SignInPendingResponse, type SignInProps, type SignInPropsTree, type SignInRedirectOptions, type SignInRedirectOptionss, type SignInRedirectUrl, type SignInResource, type SignInResponse, type SignInStatus, type SignInSuccessResponse, type SignInUIConfig, type SignOut, type SignOutOptions, type SignOutOptionsTree, type SignUpFormValues, type SignUpFormValuesTree, type SignUpInitialValue, type SignUpInitialValueTree, type SignUpProps, type SignUpPropsTree, type SignUpRedirectOptions, type SignUpRedirectOptionss, type SignUpRedirectUrl, type SignUpResource, type SignUpStatus, type SignUpUIConfig, type SignedInSession, type TernAuthEventPayload, type TernAuthListenerEvent, type TernAuthListenerEventPayload, type TernAuthSDK, type TernSecureAPIError, type TernSecureAdminConfig, type TernSecureApiErrorJSON, type TernSecureAuth, type TernSecureAuthFactory, type TernSecureAuthOptions, type TernSecureAuthProvider, type TernSecureAuthStatus, type TernSecureConfig, type TernSecureFireRestError, type TernSecureFireRestErrorJSON, type TernSecureHandlerOptions, type TernSecureInstance, type TernSecureInstanceTree, type TernSecureInstanceTreeOptions, type TernSecureInstanceTreeStatus, type TernSecureOptions, type TernSecureResources, type TernSecureSDK, type TernSecureServerConfig, type TernSecureSessionTree, type TernSecureState, type TernSecureStateExtended, type TernSecureUser, type TernSecureUserData, type TernVerificationResult, type ThemeBorderRadius, type ThemeColors, type ThemeComponentStyles, type ThemeFonts, type ThemeSpacing, type TokenCookieConfig, type UnsubscribeCallback, type UseAuthReturn, type UseSignInReturn, type UserCredential, type UserInfo, type VerifiedTokens, isSignInResponseTree };
+export { type ActiveSession, type AdminConfigValidationResult, type AfterSignOutUrl, type Appearance, type AuthEndpoint, type AuthErrorCode, type AuthErrorResponse, type AuthErrorTree, type AuthProviderStatus, type Autocomplete, type BaseAuthUIConfig, type CheckAuthorizationFromSessionClaims, type CheckCustomClaims, type ConfigValidationResult, type CookieEndpointConfig, type CookieOptions, type CookieOpts, type CookieResource, type CookieStore, type CookieSubEndpoint, type CorsOptions, type CreateActiveSession, type CreateActiveSessionParams, DEFAULT_TERN_SECURE_STATE, type DecodedIdToken, type DomainOrProxyUrl, ERRORS, type EndpointConfig, type ErrorCode, type ExpiredSession, type FirebaseClaims, type FirebaseState, type IdTokenResult, type IdTokenResult_DEPRECATED, type InitialState, type InstanceType, type JWTPayload, type JWTProtectedHeader, type Jwt, type LegacyRedirectProps, type ListenerCallback, type NavigateOptions, type ParsedToken, type PendingSession, type Persistence, type ProviderUserInfo, type RateLimitOptions, type RedirectOptions, type RedirectUrlProp, type ResendEmailVerification, type RoutingStrategy, type SecurityOptions, type ServerConfigValidationResult, type SessionCookieConfig, type SessionEndpointConfig, type SessionJson, type SessionParams, type SessionResource, type SessionResult, type SessionStatus, type SessionSubEndpoint, type SharedSignInAuthObjectProperties, type SignInErrorResponse, type SignInFallbackRedirectUrl, type SignInForceRedirectUrl, type SignInFormValues, type SignInInitialValue, type SignInPendingResponse, type SignInProps, type SignInPropsTree, type SignInRedirectOptions, type SignInRedirectOptionss, type SignInResource, type SignInResponse, type SignInStatus, type SignInSuccessResponse, type SignInUIConfig, type SignOut, type SignOutOptions, type SignOutOptionsTree, type SignUpFallbackRedirectUrl, type SignUpForceRedirectUrl, type SignUpFormValues, type SignUpFormValuesTree, type SignUpInitialValue, type SignUpInitialValueTree, type SignUpProps, type SignUpPropsTree, type SignUpRedirectOptions, type SignUpRedirectOptionss, type SignUpResource, type SignUpStatus, type SignUpUIConfig, type SignedInSession, type SocialProviderOptions, type TernAuthEventPayload, type TernAuthListenerEvent, type TernAuthListenerEventPayload, type TernAuthSDK, type TernSecureAPIError, type TernSecureAdminConfig, type TernSecureApiErrorJSON, type TernSecureAuth, type TernSecureAuthFactory, type TernSecureAuthOptions, type TernSecureAuthProvider, type TernSecureAuthStatus, type TernSecureConfig, type TernSecureFireRestError, type TernSecureFireRestErrorJSON, type TernSecureHandlerOptions, type TernSecureInstance, type TernSecureInstanceTree, type TernSecureInstanceTreeOptions, type TernSecureInstanceTreeStatus, type TernSecureOptions, type TernSecureResources, type TernSecureSDK, type TernSecureServerConfig, type TernSecureSessionTree, type TernSecureState, type TernSecureStateExtended, type TernSecureUser, type TernSecureUserData, type TernVerificationResult, type ThemeBorderRadius, type ThemeColors, type ThemeComponentStyles, type ThemeFonts, type ThemeSpacing, type TokenCookieConfig, type UnsubscribeCallback, type UseAuthReturn, type UseSignInReturn, type UserCredential, type UserInfo, type VerifiedTokens, isSignInResponseTree };

package/dist/index.js

@@ -55,6 +55,7 @@ var ERRORS = {
   WRONG_PASSWORD: "auth/wrong-password",
   EMAIL_ALREADY_IN_USE: "auth/email-already-in-use",
   REQUIRES_RECENT_LOGIN: "auth/requires-recent-login",
+  INCORRECT_ARGUMENT: "auth/argument-error",
   NO_SESSION_COOKIE: "No session cookie found.",
   INVALID_SESSION_COOKIE: "Invalid session cookie.",
   NO_ID_TOKEN: "No ID token found.",

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/auth.ts","../src/signIn.ts"],"sourcesContent":["export * from './all'\nexport * from './api'\nexport * from './cookie'\nexport * from './errors'\nexport * from './handler'\nexport * from './instanceTree'\nexport * from './theme'\nexport * from './json'\nexport * from './jwt'\nexport * from './auth'\nexport * from './signIn'\nexport * from './signUp'\nexport * from './session'\nexport * from './redirect'\nexport * from './hooks'\nexport * from './multiDomain'\nexport * from './utils'","\r\nexport type AuthErrorCode = keyof typeof ERRORS\r\n\r\nexport type ErrorCode = keyof typeof ERRORS\r\n\r\n\r\nexport const ERRORS = {\r\n  SERVER_SIDE_INITIALIZATION: \"TernSecure must be initialized on the client side\",\r\n  REQUIRES_VERIFICATION: \"AUTH_REQUIRES_VERIFICATION\",\r\n  AUTHENTICATED: \"AUTHENTICATED\",\r\n  UNAUTHENTICATED: \"UNAUTHENTICATED\",\r\n  UNVERIFIED: \"UNVERIFIED\",\r\n  NOT_INITIALIZED: \"TernSecure services are not initialized. Call initializeTernSecure() first\",\r\n  HOOK_CONTEXT: \"Hook must be used within TernSecureProvider\",\r\n  EMAIL_NOT_VERIFIED: \"EMAIL_NOT_VERIFIED\",\r\n  INVALID_CREDENTIALS: \"INVALID_CREDENTIALS\",\r\n  USER_DISABLED: \"USER_DISABLED\",\r\n  TOO_MANY_ATTEMPTS: \"TOO_MANY_ATTEMPTS\",\r\n  NETWORK_ERROR: \"NETWORK_ERROR\",\r\n  INVALID_EMAIL: \"INVALID_EMAIL\",\r\n  WEAK_PASSWORD: \"WEAK_PASSWORD\",\r\n  EMAIL_EXISTS: \"EMAIL_EXISTS\",\r\n  POPUP_BLOCKED: \"POPUP_BLOCKED\",\r\n  OPERATION_NOT_ALLOWED: \"OPERATION_NOT_ALLOWED\",\r\n  EXPIRED_TOKEN: \"EXPIRED_TOKEN\",\r\n  INVALID_TOKEN: \"INVALID_TOKEN\",\r\n  SESSION_EXPIRED: \"SESSION_EXPIRED\",\r\n  INTERNAL_ERROR: \"INTERNAL_ERROR\",\r\n  UNKNOWN_ERROR: \"An unknown error occurred.\",\r\n  INVALID_ARGUMENT: \"Invalid argument provided.\",\r\n  USER_NOT_FOUND: \"auth/user-not-found\",\r\n  WRONG_PASSWORD: \"auth/wrong-password\",\r\n  EMAIL_ALREADY_IN_USE: \"auth/email-already-in-use\",\r\n  REQUIRES_RECENT_LOGIN: \"auth/requires-recent-login\",\r\n  NO_SESSION_COOKIE: \"No session cookie found.\",\r\n  INVALID_SESSION_COOKIE: \"Invalid session cookie.\",\r\n  NO_ID_TOKEN: \"No ID token found.\",\r\n  INVALID_ID_TOKEN: \"Invalid ID token.\",\r\n  REDIRECT_LOOP: \"Redirect loop detected.\",\r\n} as const\r\n\r\n","import type { SignedInSession } from 'session';\nimport type { SignUpResource } from 'signUp';\n\nimport type { InstanceType, TernSecureConfig, TernSecureUser } from './all';\nimport type { DecodedIdToken } from './jwt';\nimport type {\n  AfterSignOutUrl,\n  RedirectOptions,\n  SignInRedirectUrl,\n  SignUpRedirectUrl,\n} from './redirect';\nimport type { AuthErrorResponse, SignInInitialValue, SignInResource } from './signIn';\n\nexport interface InitialState {\n  userId: string | null;\n  token: any | null;\n  email: string | null;\n  user?: TernSecureUser | null;\n}\n\nexport interface TernSecureState {\n  userId: string | null;\n  isLoaded: boolean;\n  error: Error | null;\n  isValid: boolean;\n  isVerified: boolean;\n  isAuthenticated: boolean;\n  token: any | null;\n  email: string | null;\n  status: 'loading' | 'authenticated' | 'unauthenticated' | 'unverified';\n  user?: TernSecureUser | null;\n}\n\nexport type TernSecureStateExtended = {\n  sessionClaims: DecodedIdToken | null;\n  userId: string | null;\n  token: string | null;\n  user?: TernSecureUser | null;\n}\n\nexport type AuthProviderStatus = 'idle' | 'pending' | 'error' | 'success';\n\nexport const DEFAULT_TERN_SECURE_STATE: TernSecureState = {\n  userId: null,\n  isLoaded: false,\n  error: null,\n  isValid: false,\n  isVerified: false,\n  isAuthenticated: false,\n  token: null,\n  email: null,\n  status: 'loading',\n  user: null,\n};\n\nexport interface TernSecureAuthProvider {\n  /** Current auth state */\n  internalAuthState: TernSecureState;\n\n  /** Current user*/\n  ternSecureUser(): TernSecureUser | null;\n\n  /** AuthCookie Manager */\n  authCookieManager(): void;\n\n  /** Current session */\n  currentSession: SignedInSession | null;\n\n  /** Sign in resource for authentication operations */\n  signIn: SignInResource | undefined;\n\n  /** SignUp resource for authentication operations */\n  signUp: SignUpResource | undefined;\n\n  /** The Firebase configuration used by this TernAuth instance. */\n  ternSecureConfig?: TernSecureConfig;\n\n  /** Sign out the current user */\n  signOut(): Promise<void>;\n}\n\nexport type Persistence = 'local' | 'session' | 'browserCookie' | 'none';\n\ntype Mode = 'browser' | 'server';\n\nexport type TernAuthSDK = {\n  /** SDK package name (e.g., @tern-secure/auth) */\n  name: string;\n  /** SDK version (e.g., 1.2.3) */\n  version: string;\n  /** Build environment (development, production, test) */\n  environment?: string;\n  /** Build date as ISO string */\n  buildDate?: string;\n  /** Additional build metadata */\n  buildInfo?: {\n    name: string;\n    version: string;\n    buildDate: string;\n    buildEnv: string;\n  };\n};\n\nexport interface TernSecureResources {\n  user?: TernSecureUser | null;\n  session?: SignedInSession | null;\n}\n\nexport type CreateActiveSessionParams = {\n  session?: TernSecureUser | null;\n  redirectUrl?: string;\n}\n\nexport type CreateActiveSession = (params: CreateActiveSessionParams) => Promise<void>;\n\nexport type TernSecureAuthOptions = {\n  apiUrl?: string;\n  sdkMetadata?: TernAuthSDK;\n  signInUrl?: string;\n  signUpUrl?: string;\n  mode?: Mode;\n  requiresVerification?: boolean;\n  isTernSecureDev?: boolean;\n  ternSecureConfig?: TernSecureConfig;\n  persistence?: Persistence;\n  enableServiceWorker?: boolean;\n  experimental?: {\n    /** rethrow network errors that occur while the offline */\n    rethrowOfflineNetworkErrors?: boolean;\n  };\n} & SignInRedirectUrl &\n  SignUpRedirectUrl &\n  AfterSignOutUrl;\n\nexport type TernAuthListenerEventPayload = {\n  authStateChanged: TernSecureState;\n  userChanged: TernSecureUser;\n  sessionChanged: SignedInSession | null;\n  tokenRefreshed: string | null;\n};\n\nexport type TernAuthListenerEvent = keyof TernAuthListenerEventPayload;\n\nexport type ListenerCallback = (emission: TernSecureResources) => void;\nexport type UnsubscribeCallback = () => void;\ntype TernSecureEvent = keyof TernAuthEventPayload;\ntype EventHandler<Events extends TernSecureEvent> = (payload: TernAuthEventPayload[Events]) => void;\nexport type TernAuthEventPayload = {\n  status: TernSecureAuthStatus;\n};\n\nexport type TernSecureAuthStatus = 'error' | 'loading' | 'ready';\n\ntype onEventListener = <E extends TernSecureEvent>(\n  event: E,\n  handler: EventHandler<E>,\n  opt?: { notify?: boolean },\n) => void;\ntype OffEventListener = <E extends TernSecureEvent>(event: E, handler: EventHandler<E>) => void;\n\nexport type SignOutOptions = {\n  /** URL to redirect to after sign out */\n  redirectUrl?: string;\n  /** Callback to perform consumer-specific cleanup (e.g., delete session cookies) */\n  onBeforeSignOut?: () => Promise<void> | void;\n  /** Callback executed after successful sign out */\n  onAfterSignOut?: () => Promise<void> | void;\n};\n\nexport interface SignOut {\n  (options?: SignOutOptions): Promise<void>;\n}\n\nexport interface TernSecureAuth {\n  /** TernSecureAuth SDK version number */\n  version: string | undefined;\n\n  /** Metadata about the SDK instance */\n  sdkMetadata: TernAuthSDK | undefined;\n\n  /** Indicates if the TernSecureAuth instance is currently loading */\n  isLoading: boolean;\n\n  /** The current status of the TernSecureAuth instance */\n  status: TernSecureAuthStatus;\n\n  /** TernSecure API URL */\n  apiUrl: string;\n\n  /** TernSecure domain for API string */\n  domain: string;\n\n  /** TernSecure Proxy url */\n  proxyUrl?: string;\n\n  /** TernSecure Instance type */\n  instanceType: InstanceType | undefined;\n\n  /** Indicates if the TernSecureAuth instance is ready for use */\n  isReady: boolean;\n\n  /** Requires Verification */\n  requiresVerification: boolean;\n\n  /** Initialize TernSecureAuth */\n  initialize(options?: TernSecureAuthOptions): Promise<void>;\n\n  /**\n   * @internal\n   */\n  _internal_getOption<K extends keyof TernSecureAuthOptions>(key: K): TernSecureAuthOptions[K];\n\n  /**\n   * @internal\n   */\n  _internal_getAllOptions(): Readonly<TernSecureAuthOptions>;\n\n  /** Current user*/\n  user: TernSecureUser | null | undefined;\n\n  /** Current session */\n  currentSession: SignedInSession | null;\n\n  /** Sign in resource for authentication operations */\n  signIn: SignInResource | undefined | null;\n\n  /** SignUp resource for authentication operations */\n  signUp: SignUpResource | undefined | null;\n\n  /** The Firebase configuration used by this TernAuth instance. */\n  ternSecureConfig?: TernSecureConfig;\n\n  /** Subscribe to auth state changes */\n  onAuthStateChanged(callback: (cb: any) => void): () => void;\n\n  /** Sign out the current user */\n  signOut: SignOut;\n\n  /** Subscribe to a single event */\n  on: onEventListener;\n\n  /** Remove event listener */\n  off: OffEventListener;\n\n  /** Subscribe to all auth state changes */\n  addListener: (callback: ListenerCallback) => UnsubscribeCallback;\n\n  /** Get redirect result from OAuth flows */\n  getRedirectResult: () => Promise<any>;\n\n  /** Create an active session */\n  createActiveSession: CreateActiveSession;\n\n  /** Navigate to SignIn page */\n  redirectToSignIn(options?: SignInRedirectOptions): Promise<unknown>;\n  /** Navigate to SignUp page */\n  redirectToSignUp(options?: SignUpRedirectOptions): Promise<unknown>;\n\n  redirectAfterSignIn: () => void;\n\n  redirectAfterSignUp: () => void;\n}\n\nexport type SignUpFormValues = {\n  email: string;\n  password: string;\n  confirmPassword?: string;\n  displayName?: string;\n};\n\nexport type SignUpInitialValue = Partial<SignUpFormValues>;\n\nexport interface TernSecureAuthFactory {\n  create(options?: TernSecureAuthOptions): TernSecureAuth;\n}\n\nexport type SharedSignInAuthObjectProperties = {\n  session: DecodedIdToken;\n  userId: string;\n};\n\nexport type CheckCustomClaims = {\n  role?: string | string[];\n  permissions?: string | string[];\n  [key: string]: any;\n};\n\nexport type CheckAuthorizationFromSessionClaims = (\n  isAuthorizedParams: CheckCustomClaims,\n) => boolean;\n\nexport type TernVerificationResult =\n  | (DecodedIdToken & {\n      valid: true;\n      token?: string;\n      error?: never;\n    })\n  | {\n      valid: false;\n      error: AuthErrorResponse;\n    };\n\n/**\n * Props for SignIn component focusing on UI concerns\n */\nexport type SignInProps = {\n  /** Routing Path */\n  path?: string;\n  /** URL to navigate to after successfully sign-in */\n  forceRedirectUrl?: string | null;\n  /** Initial form values */\n  initialValue?: SignInInitialValue;\n  /** Callbacks */\n  onSuccess?: (user: TernSecureUser | null) => void;\n} & SignUpRedirectUrl;\n\n/**\n * Props for SignUp component focusing on UI concerns\n */\nexport type SignUpProps = {\n  /** URL to navigate to after successfully sign-up */\n  forceRedirectUrl?: string | null;\n  /** Initial form values */\n  initialValue?: SignUpInitialValue;\n  /** Callbacks */\n  onSubmit?: (values: SignUpFormValues) => Promise<void>;\n  onSuccess?: (user: TernSecureUser | null) => void;\n} & SignInRedirectUrl;\n\nexport type SignInRedirectOptions = RedirectOptions;\nexport type SignUpRedirectOptions = RedirectOptions;\n\n","import type { UserCredential } from \"./all\";\nimport type { ErrorCode} from \"./errors\";\n\nexport type SignInStatus =\n  | 'idle'\n  | 'pending_email_password'\n  | 'pending_social'\n  | 'pending_mfa'\n  | 'redirecting'\n  | 'success'\n  | 'error';\n\n\nexport type SignInFormValues = {\n  email: string;\n  password: string;\n  phoneNumber?: string;\n};\n\nexport interface AuthErrorResponse {\n  success: false\n  message: string\n  code: ErrorCode\n}\n\nexport interface AuthErrorTree extends Error {\n  code?: any | string;\n  message: string;\n  response?: any | string;\n}\n\ninterface BaseSignInResponse {\n  status?: SignInStatus;\n  message?: string;\n  error?: any | undefined;\n}\n\n\nexport interface SignInSuccessResponse extends BaseSignInResponse, UserCredential {\n  status: 'success';\n}\n\nexport interface SignInErrorResponse extends BaseSignInResponse {\n  status: 'error';\n}\n\nexport interface SignInPendingResponse extends BaseSignInResponse {\n  status: 'redirecting' | 'pending_social' | 'pending_email_password';\n}\n\nexport type SignInResponse = \n  | SignInSuccessResponse \n  | SignInErrorResponse \n  | SignInPendingResponse;\n\n\nexport type SignInInitialValue = Partial<SignInFormValues>;\n\n\nexport interface ResendEmailVerification {\n  isVerified?: boolean;\n}\n\nexport function isSignInResponseTree(value: any): value is SignInResponse {\n  return (\n    typeof value === 'object' &&\n    'success' in value &&\n    typeof value.success === 'boolean'\n  );\n}\n\n\nexport interface SignInResource {\n  /**\n   * The current status of the sign-in process.\n   */\n  status?: SignInStatus;\n  /**\n   * Signs in a user with their email and password.\n   * @param params - The sign-in form values.\n   * @returns A promise that resolves with the sign-in response.\n   */\n  withEmailAndPassword: (params: SignInFormValues) => Promise<SignInResponse>;\n  /**\n   * @param provider - The identifier of the social provider (e.g., 'google', 'microsoft', 'github').\n   * @param options - Optional configuration for the social sign-in flow.\n   * @returns A promise that resolves with the sign-in response or void if redirecting.\n   */\n  withSocialProvider: (provider: string, options?: { mode?: 'popup' | 'redirect' }) => Promise<SignInResponse | void>;\n  /**\n   * Completes an MFA (Multi-Factor Authentication) step after a primary authentication attempt.\n   * @param mfaToken - The MFA token or code submitted by the user.\n   * @param mfaContext - Optional context or session data from the MFA initiation step.\n   * @returns A promise that resolves with the sign-in response upon successful MFA verification.\n   */\n  completeMfaSignIn: (mfaToken: string, mfaContext?: any) => Promise<SignInResponse>;\n  /**\n   * Sends a password reset email to the given email address.\n   * @param email - The user's email address.\n   * @returns A promise that resolves when the email is sent.\n   */\n  sendPasswordResetEmail: (email: string) => Promise<void>;\n  /**\n   * Resends the email verification link to the user's email address.\n   * @returns A promise that resolves with the sign-in response.\n   */\n  resendEmailVerification: () => Promise<ResendEmailVerification>;\n  /**\n   * Checks the result of a redirect-based sign-in flow, typically used in OAuth or SSO scenarios.\n   * @returns A promise that resolves with the sign-in response or null if no result is available.\n   */\n  checkRedirectResult: () => Promise<SignInResponse| null>;\n}"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACMO,IAAM,SAAS;AAAA,EACpB,4BAA4B;AAAA,EAC5B,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,eAAe;AAAA,EACf,cAAc;AAAA,EACd,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,mBAAmB;AAAA,EACnB,wBAAwB;AAAA,EACxB,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,eAAe;AACjB;;;ACGO,IAAM,4BAA6C;AAAA,EACxD,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,OAAO;AAAA,EACP,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,OAAO;AAAA,EACP,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,MAAM;AACR;;;ACUO,SAAS,qBAAqB,OAAqC;AACxE,SACE,OAAO,UAAU,YACjB,aAAa,SACb,OAAO,MAAM,YAAY;AAE7B;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/auth.ts","../src/signIn.ts"],"sourcesContent":["export * from './all'\nexport * from './api'\nexport * from './cookie'\nexport * from './errors'\nexport * from './handler'\nexport * from './instanceTree'\nexport * from './theme'\nexport * from './json'\nexport * from './jwt'\nexport * from './auth'\nexport * from './signIn'\nexport * from './signUp'\nexport * from './session'\nexport * from './redirect'\nexport * from './hooks'\nexport * from './multiDomain'\nexport * from './utils'","\r\nexport type AuthErrorCode = keyof typeof ERRORS\r\n\r\nexport type ErrorCode = keyof typeof ERRORS\r\n\r\n\r\nexport const ERRORS = {\r\n  SERVER_SIDE_INITIALIZATION: \"TernSecure must be initialized on the client side\",\r\n  REQUIRES_VERIFICATION: \"AUTH_REQUIRES_VERIFICATION\",\r\n  AUTHENTICATED: \"AUTHENTICATED\",\r\n  UNAUTHENTICATED: \"UNAUTHENTICATED\",\r\n  UNVERIFIED: \"UNVERIFIED\",\r\n  NOT_INITIALIZED: \"TernSecure services are not initialized. Call initializeTernSecure() first\",\r\n  HOOK_CONTEXT: \"Hook must be used within TernSecureProvider\",\r\n  EMAIL_NOT_VERIFIED: \"EMAIL_NOT_VERIFIED\",\r\n  INVALID_CREDENTIALS: \"INVALID_CREDENTIALS\",\r\n  USER_DISABLED: \"USER_DISABLED\",\r\n  TOO_MANY_ATTEMPTS: \"TOO_MANY_ATTEMPTS\",\r\n  NETWORK_ERROR: \"NETWORK_ERROR\",\r\n  INVALID_EMAIL: \"INVALID_EMAIL\",\r\n  WEAK_PASSWORD: \"WEAK_PASSWORD\",\r\n  EMAIL_EXISTS: \"EMAIL_EXISTS\",\r\n  POPUP_BLOCKED: \"POPUP_BLOCKED\",\r\n  OPERATION_NOT_ALLOWED: \"OPERATION_NOT_ALLOWED\",\r\n  EXPIRED_TOKEN: \"EXPIRED_TOKEN\",\r\n  INVALID_TOKEN: \"INVALID_TOKEN\",\r\n  SESSION_EXPIRED: \"SESSION_EXPIRED\",\r\n  INTERNAL_ERROR: \"INTERNAL_ERROR\",\r\n  UNKNOWN_ERROR: \"An unknown error occurred.\",\r\n  INVALID_ARGUMENT: \"Invalid argument provided.\",\r\n  USER_NOT_FOUND: \"auth/user-not-found\",\r\n  WRONG_PASSWORD: \"auth/wrong-password\",\r\n  EMAIL_ALREADY_IN_USE: \"auth/email-already-in-use\",\r\n  REQUIRES_RECENT_LOGIN: \"auth/requires-recent-login\",\r\n  INCORRECT_ARGUMENT: \"auth/argument-error\",\r\n  NO_SESSION_COOKIE: \"No session cookie found.\",\r\n  INVALID_SESSION_COOKIE: \"Invalid session cookie.\",\r\n  NO_ID_TOKEN: \"No ID token found.\",\r\n  INVALID_ID_TOKEN: \"Invalid ID token.\",\r\n  REDIRECT_LOOP: \"Redirect loop detected.\",\r\n} as const\r\n\r\n","import type { SignedInSession } from 'session';\nimport type { SignUpResource } from 'signUp';\n\nimport type { InstanceType, TernSecureConfig, TernSecureUser } from './all';\nimport type { DecodedIdToken } from './jwt';\nimport type {\n  AfterSignOutUrl,\n  RedirectOptions,\n  SignInFallbackRedirectUrl,\n  SignInForceRedirectUrl,\n  SignUpFallbackRedirectUrl,\n  SignUpForceRedirectUrl,\n} from './redirect';\nimport type { AuthErrorResponse, SignInInitialValue, SignInResource } from './signIn';\n\nexport interface InitialState {\n  userId: string | null;\n  token: any | null;\n  email: string | null;\n  user?: TernSecureUser | null;\n}\n\nexport interface TernSecureState {\n  userId: string | null;\n  isLoaded: boolean;\n  error: Error | null;\n  isValid: boolean;\n  isVerified: boolean;\n  isAuthenticated: boolean;\n  token: any | null;\n  email: string | null;\n  status: 'loading' | 'authenticated' | 'unauthenticated' | 'unverified';\n  user?: TernSecureUser | null;\n}\n\nexport type TernSecureStateExtended = {\n  sessionClaims: DecodedIdToken | null;\n  userId: string | null;\n  token: string | null;\n  user?: TernSecureUser | null;\n};\n\nexport type AuthProviderStatus = 'idle' | 'pending' | 'error' | 'success';\n\nexport const DEFAULT_TERN_SECURE_STATE: TernSecureState = {\n  userId: null,\n  isLoaded: false,\n  error: null,\n  isValid: false,\n  isVerified: false,\n  isAuthenticated: false,\n  token: null,\n  email: null,\n  status: 'loading',\n  user: null,\n};\n\nexport interface TernSecureAuthProvider {\n  /** Current auth state */\n  internalAuthState: TernSecureState;\n\n  /** Current user*/\n  ternSecureUser(): TernSecureUser | null;\n\n  /** AuthCookie Manager */\n  authCookieManager(): void;\n\n  /** Current session */\n  currentSession: SignedInSession | null;\n\n  /** Sign in resource for authentication operations */\n  signIn: SignInResource | undefined;\n\n  /** SignUp resource for authentication operations */\n  signUp: SignUpResource | undefined;\n\n  /** The Firebase configuration used by this TernAuth instance. */\n  ternSecureConfig?: TernSecureConfig;\n\n  /** Sign out the current user */\n  signOut(): Promise<void>;\n}\n\nexport type Persistence = 'local' | 'session' | 'browserCookie' | 'none';\n\ntype Mode = 'browser' | 'server';\n\nexport type TernAuthSDK = {\n  /** SDK package name (e.g., @tern-secure/auth) */\n  name: string;\n  /** SDK version (e.g., 1.2.3) */\n  version: string;\n  /** Build environment (development, production, test) */\n  environment?: string;\n  /** Build date as ISO string */\n  buildDate?: string;\n  /** Additional build metadata */\n  buildInfo?: {\n    name: string;\n    version: string;\n    buildDate: string;\n    buildEnv: string;\n  };\n};\n\nexport interface TernSecureResources {\n  user?: TernSecureUser | null;\n  session?: SignedInSession | null;\n}\n\nexport type CreateActiveSessionParams = {\n  session?: TernSecureUser | null;\n  redirectUrl?: string;\n};\n\nexport type CreateActiveSession = (params: CreateActiveSessionParams) => Promise<void>;\n\n/**\n * Navigation options used to replace or push history changes.\n * Both `routerPush` & `routerReplace` OR none options should be passed.\n */\ntype TernSecureOptionsNavigation =\n  | {\n      /**\n       * A function which takes the destination path as an argument and performs a \"push\" navigation.\n       */\n      routerPush?: never;\n      /**\n       * A function which takes the destination path as an argument and performs a \"replace\" navigation.\n       */\n      routerReplace?: never;\n      routerDebug?: boolean;\n    }\n  | {\n      routerPush: RouterFn;\n      routerReplace: RouterFn;\n      routerDebug?: boolean;\n    };\n\nexport type TernSecureAuthOptions = TernSecureOptionsNavigation &\n  SignInForceRedirectUrl &\n  SignInFallbackRedirectUrl &\n  SignUpForceRedirectUrl &\n  SignUpFallbackRedirectUrl &\n  AfterSignOutUrl & {\n    apiUrl?: string;\n    sdkMetadata?: TernAuthSDK;\n    signInUrl?: string;\n    signUpUrl?: string;\n    mode?: Mode;\n    requiresVerification?: boolean;\n    isTernSecureDev?: boolean;\n    ternSecureConfig?: TernSecureConfig;\n    persistence?: Persistence;\n    enableServiceWorker?: boolean;\n    /**\n     * An optional array of domains to validate user-provided redirect URLs against. If no match is made, the redirect is considered unsafe and the default redirect will be used with a warning logged in the console.\n     */\n    allowedRedirectOrigins?: Array<string | RegExp>;\n    /**\n     * An optional array of protocols to validate user-provided redirect URLs against. If no match is made, the redirect is considered unsafe and the default redirect will be used with a warning logged in the console.\n     */\n    allowedRedirectProtocols?: Array<string>;\n    experimental?: {\n      /** rethrow network errors that occur while the offline */\n      rethrowOfflineNetworkErrors?: boolean;\n    };\n  };\n\nexport type TernAuthListenerEventPayload = {\n  authStateChanged: TernSecureState;\n  userChanged: TernSecureUser;\n  sessionChanged: SignedInSession | null;\n  tokenRefreshed: string | null;\n};\n\nexport interface NavigateOptions {\n  replace?: boolean;\n  metadata?: RouterMetadata;\n}\n\nexport type TernAuthListenerEvent = keyof TernAuthListenerEventPayload;\n\nexport type ListenerCallback = (emission: TernSecureResources) => void;\nexport type UnsubscribeCallback = () => void;\ntype TernSecureEvent = keyof TernAuthEventPayload;\ntype EventHandler<Events extends TernSecureEvent> = (payload: TernAuthEventPayload[Events]) => void;\nexport type TernAuthEventPayload = {\n  status: TernSecureAuthStatus;\n};\n\nexport type TernSecureAuthStatus = 'error' | 'loading' | 'ready';\n\ntype onEventListener = <E extends TernSecureEvent>(\n  event: E,\n  handler: EventHandler<E>,\n  opt?: { notify?: boolean },\n) => void;\ntype OffEventListener = <E extends TernSecureEvent>(event: E, handler: EventHandler<E>) => void;\n\nexport type SignOutOptions = {\n  /** URL to redirect to after sign out */\n  redirectUrl?: string;\n  /** Callback to perform consumer-specific cleanup (e.g., delete session cookies) */\n  onBeforeSignOut?: () => Promise<void> | void;\n  /** Callback executed after successful sign out */\n  onAfterSignOut?: () => Promise<void> | void;\n};\n\nexport interface SignOut {\n  (options?: SignOutOptions): Promise<void>;\n}\n\nexport interface TernSecureAuth {\n  /** TernSecureAuth SDK version number */\n  version: string | undefined;\n\n  /** Metadata about the SDK instance */\n  sdkMetadata: TernAuthSDK | undefined;\n\n  /** Indicates if the TernSecureAuth instance is currently loading */\n  isLoading: boolean;\n\n  /** The current status of the TernSecureAuth instance */\n  status: TernSecureAuthStatus;\n\n  /** TernSecure API URL */\n  apiUrl: string;\n\n  /** TernSecure domain for API string */\n  domain: string;\n\n  /** TernSecure Proxy url */\n  proxyUrl?: string;\n\n  /** TernSecure Instance type */\n  instanceType: InstanceType | undefined;\n\n  /** Indicates if the TernSecureAuth instance is ready for use */\n  isReady: boolean;\n\n  /** Requires Verification */\n  requiresVerification: boolean;\n\n  /** Initialize TernSecureAuth */\n  initialize: (options?: TernSecureAuthOptions) => Promise<void>;\n\n  /**\n   * @internal\n   */\n  _internal_getOption<K extends keyof TernSecureAuthOptions>(key: K): TernSecureAuthOptions[K];\n\n  /**\n   * @internal\n   */\n  _internal_getAllOptions(): Readonly<TernSecureAuthOptions>;\n\n  /** Current user*/\n  user: TernSecureUser | null | undefined;\n\n  /** Current session */\n  currentSession: SignedInSession | null;\n\n  /** Sign in resource for authentication operations */\n  signIn: SignInResource | undefined | null;\n\n  /** SignUp resource for authentication operations */\n  signUp: SignUpResource | undefined | null;\n\n  /** The Firebase configuration used by this TernAuth instance. */\n  ternSecureConfig?: TernSecureConfig;\n\n  /** Subscribe to auth state changes */\n  onAuthStateChanged(callback: (cb: any) => void): () => void;\n\n  /** Sign out the current user */\n  signOut: SignOut;\n\n  /** Subscribe to a single event */\n  on: onEventListener;\n\n  /** Remove event listener */\n  off: OffEventListener;\n\n  /** Subscribe to all auth state changes */\n  addListener: (callback: ListenerCallback) => UnsubscribeCallback;\n\n  /** Get redirect result from OAuth flows */\n  getRedirectResult: () => Promise<any>;\n\n  /** Create an active session */\n  createActiveSession: CreateActiveSession;\n\n  /**\n   * @param {string} to\n   */\n  constructUrlWithAuthRedirect(to: string): string;\n\n  /** Navigate to SignIn page */\n  redirectToSignIn(options?: SignInRedirectOptions): Promise<unknown>;\n  /** Navigate to SignUp page */\n  redirectToSignUp(options?: SignUpRedirectOptions): Promise<unknown>;\n\n  redirectAfterSignIn: () => void;\n\n  redirectAfterSignUp: () => void;\n}\n\nexport type SignUpFormValues = {\n  email: string;\n  password: string;\n  confirmPassword?: string;\n  displayName?: string;\n};\n\nexport type SignUpInitialValue = Partial<SignUpFormValues>;\n\nexport interface TernSecureAuthFactory {\n  create(options?: TernSecureAuthOptions): TernSecureAuth;\n}\n\nexport type SharedSignInAuthObjectProperties = {\n  session: DecodedIdToken;\n  userId: string;\n};\n\nexport type CheckCustomClaims = {\n  role?: string | string[];\n  permissions?: string | string[];\n  [key: string]: any;\n};\n\nexport type CheckAuthorizationFromSessionClaims = (\n  isAuthorizedParams: CheckCustomClaims,\n) => boolean;\n\nexport type TernVerificationResult =\n  | (DecodedIdToken & {\n      valid: true;\n      token?: string;\n      error?: never;\n    })\n  | {\n      valid: false;\n      error: AuthErrorResponse;\n    };\n\n/**\n * Props for SignIn component focusing on UI concerns\n */\nexport type SignInProps = {\n  /** Routing Path */\n  path?: string;\n  /** URL to navigate to after successfully sign-in */\n  forceRedirectUrl?: string | null;\n  /** Initial form values */\n  initialValue?: SignInInitialValue;\n  /** Callbacks */\n  onSuccess?: (user: TernSecureUser | null) => void;\n} & SignUpForceRedirectUrl;\n\n/**\n * Props for SignUp component focusing on UI concerns\n */\nexport type SignUpProps = {\n  /** URL to navigate to after successfully sign-up */\n  forceRedirectUrl?: string | null;\n  /** Initial form values */\n  initialValue?: SignUpInitialValue;\n  /** Callbacks */\n  onSubmit?: (values: SignUpFormValues) => Promise<void>;\n  onSuccess?: (user: TernSecureUser | null) => void;\n} & SignInForceRedirectUrl;\n\nexport type SignInRedirectOptions = RedirectOptions;\nexport type SignUpRedirectOptions = RedirectOptions;\n\nexport type RoutingStrategy = 'path' | 'hash' | 'virtual';\n\n/**\n * Internal is a navigation type that affects the component\n *\n */\ntype NavigationType =\n  /**\n   * Internal navigations affect the components and alter the\n   * part of the URL that comes after the `path` passed to the component.\n   * eg  <SignIn path='sign-in'>\n   * going from /sign-in to /sign-in/factor-one is an internal navigation\n   */\n  | 'internal'\n  /**\n   * Internal navigations affect the components and alter the\n   * part of the URL that comes before the `path` passed to the component.\n   * eg  <SignIn path='sign-in'>\n   * going from /sign-in to / is an external navigation\n   */\n  | 'external'\n  /**\n   * Window navigations are navigations towards a different origin\n   * and are not handled by the TernSecure component or the host app router.\n   */\n  | 'window';\n\ntype RouterMetadata = { routing?: RoutingStrategy; navigationType?: NavigationType };\n\n/**\n * @inline\n */\ntype RouterFn = (\n  /**\n   * The destination path\n   */\n  to: string,\n  /**\n   * Optional metadata\n   */\n  metadata?: {\n    /**\n     * @internal\n     */\n    __internal_metadata?: RouterMetadata;\n    /**\n     * Provide a function to be used for navigation.\n     */\n    windowNavigate: (to: URL | string) => void;\n  },\n) => Promise<unknown> | unknown;\n","import type { UserCredential } from \"./all\";\nimport type { ErrorCode} from \"./errors\";\n\nexport type SignInStatus =\n  | 'idle'\n  | 'pending_email_password'\n  | 'pending_social'\n  | 'pending_mfa'\n  | 'redirecting'\n  | 'success'\n  | 'error';\n\n\nexport type SignInFormValues = {\n  email: string;\n  password: string;\n  phoneNumber?: string;\n};\n\nexport interface AuthErrorResponse {\n  success: false\n  message: string\n  code: ErrorCode\n}\n\nexport interface AuthErrorTree extends Error {\n  code?: any | string;\n  message: string;\n  response?: any | string;\n}\n\ninterface BaseSignInResponse {\n  status?: SignInStatus;\n  message?: string;\n  error?: any | undefined;\n}\n\n\nexport interface SignInSuccessResponse extends BaseSignInResponse, UserCredential {\n  status: 'success';\n}\n\nexport interface SignInErrorResponse extends BaseSignInResponse {\n  status: 'error';\n}\n\nexport interface SignInPendingResponse extends BaseSignInResponse {\n  status: 'redirecting' | 'pending_social' | 'pending_email_password';\n}\n\nexport type SignInResponse = \n  | SignInSuccessResponse \n  | SignInErrorResponse \n  | SignInPendingResponse;\n\n\nexport type SignInInitialValue = Partial<SignInFormValues>;\n\n\nexport interface ResendEmailVerification {\n  isVerified?: boolean;\n}\n\nexport function isSignInResponseTree(value: any): value is SignInResponse {\n  return (\n    typeof value === 'object' &&\n    'success' in value &&\n    typeof value.success === 'boolean'\n  );\n}\n\n/**\n * social provider options that allow to specify custom parameters\n */\nexport interface SocialProviderOptions {\n  /** Authentication mode - popup or redirect */\n  mode?: 'popup' | 'redirect';\n  /** Custom parameters specific to the provider (e.g., prompt, access_type, locale) */\n  customParameters?: Record<string, string>;\n  /** OAuth scopes to request from the provider */\n  scopes?: string[];\n}\n\n\nexport interface SignInResource {\n  /**\n   * The current status of the sign-in process.\n   */\n  status?: SignInStatus;\n  /**\n   * Signs in a user with their email and password.\n   * @param params - The sign-in form values.\n   * @returns A promise that resolves with the sign-in response.\n   */\n  withEmailAndPassword: (params: SignInFormValues) => Promise<SignInResponse>;\n  /**\n   * @param provider - The identifier of the social provider (e.g., 'google', 'microsoft', 'github').\n   * @param options - Optional configuration for the social sign-in flow.\n   * @returns A promise that resolves with the sign-in response or void if redirecting.\n   */\n  withSocialProvider: (provider: string, options: SocialProviderOptions) => Promise<SignInResponse | void>;\n  /**\n   * Completes an MFA (Multi-Factor Authentication) step after a primary authentication attempt.\n   * @param mfaToken - The MFA token or code submitted by the user.\n   * @param mfaContext - Optional context or session data from the MFA initiation step.\n   * @returns A promise that resolves with the sign-in response upon successful MFA verification.\n   */\n  completeMfaSignIn: (mfaToken: string, mfaContext?: any) => Promise<SignInResponse>;\n  /**\n   * Sends a password reset email to the given email address.\n   * @param email - The user's email address.\n   * @returns A promise that resolves when the email is sent.\n   */\n  sendPasswordResetEmail: (email: string) => Promise<void>;\n  /**\n   * Resends the email verification link to the user's email address.\n   * @returns A promise that resolves with the sign-in response.\n   */\n  resendEmailVerification: () => Promise<ResendEmailVerification>;\n  /**\n   * Checks the result of a redirect-based sign-in flow, typically used in OAuth or SSO scenarios.\n   * @returns A promise that resolves with the sign-in response or null if no result is available.\n   */\n  checkRedirectResult: () => Promise<SignInResponse| null>;\n}"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACMO,IAAM,SAAS;AAAA,EACpB,4BAA4B;AAAA,EAC5B,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,eAAe;AAAA,EACf,cAAc;AAAA,EACd,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,oBAAoB;AAAA,EACpB,mBAAmB;AAAA,EACnB,wBAAwB;AAAA,EACxB,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,eAAe;AACjB;;;ACIO,IAAM,4BAA6C;AAAA,EACxD,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,OAAO;AAAA,EACP,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,OAAO;AAAA,EACP,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,MAAM;AACR;;;ACQO,SAAS,qBAAqB,OAAqC;AACxE,SACE,OAAO,UAAU,YACjB,aAAa,SACb,OAAO,MAAM,YAAY;AAE7B;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tern-secure/types",
-  "version": "1.1.0-canary.v20251020032343",
+  "version": "1.1.0-canary.v20251023005301",
   "description": "Type definitions for TernSecure packages",
   "repository": {
     "type": "git",