@torrow/sdk-auth 0.0.0-stage → 0.7.0

package/dist/index.js

@@ -0,0 +1,1317 @@
+// ../../src/auth-session/app-credentials.ts
+var DEFAULT_APP_CREDENTIALS = {
+  clientId: "sdk.torrow.net",
+  clientSecret: "4YM1qYq87faSXaFqXTBcnJrn/jj0AOXl6tTsfubLyCE="
+};
+function resolveAppCredentials(input) {
+  return input ?? DEFAULT_APP_CREDENTIALS;
+}
+function appCredentialsToAuthIdentityBasic(appCredentials) {
+  const clientId = appCredentials?.clientId?.trim();
+  const clientSecret = appCredentials?.clientSecret?.trim();
+  if (!clientId || !clientSecret) return void 0;
+  return { username: clientId, password: clientSecret };
+}
+
+// ../../src/auth-session/otp-flow.ts
+import {
+  isAuthCaptchaType,
+  isDeviceType,
+  isSendCodeAccountType,
+  isVerificationMethod,
+  TokenStatusValues as TokenStatusValues2,
+  VerificationMethodValues
+} from "@torrow/sdk-client";
+
+// ../../src/auth-session/identity-client.ts
+import { TorrowClient } from "@torrow/sdk-client";
+function createIdentityClient(options) {
+  const authIdentityBasic = appCredentialsToAuthIdentityBasic(
+    resolveAppCredentials(options.appCredentials)
+  );
+  if (!authIdentityBasic) {
+    throw new Error(
+      "TokenSession: \u043D\u0435\u043F\u043E\u043B\u043D\u0430\u044F appCredentials (\u043D\u0443\u0436\u043D\u044B \u043D\u0435\u043F\u0443\u0441\u0442\u044B\u0435 clientId \u0438 clientSecret). \u0411\u0435\u0437 \u043E\u043F\u0446\u0438\u0438 \u0438\u0441\u043F\u043E\u043B\u044C\u0437\u0443\u0435\u0442\u0441\u044F DEFAULT_APP_CREDENTIALS."
+    );
+  }
+  return new TorrowClient({
+    baseUrl: options.baseUrl,
+    fetch: options.fetch,
+    defaultHeaders: options.defaultHeaders,
+    userAgent: options.userAgent,
+    authIdentityBasic
+  });
+}
+
+// ../../src/auth-session/auth-protocol.ts
+import {
+  DefaultAuthScopes,
+  isTokenStatus,
+  TokenStatusValues
+} from "@torrow/sdk-client";
+function buildOtpSendRequest(input) {
+  const accountName = input.accountName.trim();
+  if (!accountName) throw new Error("runOtpLogin: accountName is empty");
+  return {
+    accountName,
+    type: input.type,
+    language: input.language?.trim() || "ru",
+    regionStorageId: typeof input.regionStorageId === "number" && Number.isFinite(input.regionStorageId) ? input.regionStorageId : 70,
+    ...input.captcha?.trim() ? { captcha: input.captcha.trim() } : {},
+    ...input.captchaType ? { captchaType: input.captchaType } : {},
+    ...input.inviteSessionId?.trim() ? { inviteSessionId: input.inviteSessionId.trim() } : {},
+    ...input.preferredMethod ? { preferredMethod: input.preferredMethod } : {},
+    ...input.supportedMethods?.length ? { supportedMethods: input.supportedMethods } : {}
+  };
+}
+function sendOtpCode(client, input, signal) {
+  return client.auth.sendCode(buildOtpSendRequest(input), { signal });
+}
+function requestAuthToken(client, input, signal) {
+  return client.auth.requestToken(
+    {
+      sessionId: input.sessionId,
+      code: input.code,
+      deviceInfo: input.deviceInfo,
+      scopes: input.scopes?.length ? input.scopes : [...DefaultAuthScopes],
+      ...input.splitTokens !== void 0 ? { splitTokens: input.splitTokens } : {}
+    },
+    { signal }
+  );
+}
+function tokenTransition(status, legacy = false) {
+  if (legacy && status == null) return TokenStatusValues.TokenReady;
+  return typeof status === "string" && isTokenStatus(status) ? status : void 0;
+}
+function tokenResponseFields(o) {
+  return {
+    access: o.accessToken ?? o.AccessToken ?? o.access_token,
+    refresh: o.refreshToken ?? o.RefreshToken ?? o.refresh_token,
+    expiration: o.expiration ?? o.Expiration ?? o.expires_in,
+    status: o.status ?? o.Status
+  };
+}
+
+// ../../src/auth-session/otp-flow.ts
+var OtpPhaseValues = /* @__PURE__ */ ((OtpPhaseValues2) => {
+  OtpPhaseValues2["AwaitingCode"] = "AwaitingCode";
+  OtpPhaseValues2["Pending"] = "Pending";
+  return OtpPhaseValues2;
+})(OtpPhaseValues || {});
+var OtpFlowErrorCodeValues = /* @__PURE__ */ ((OtpFlowErrorCodeValues2) => {
+  OtpFlowErrorCodeValues2["InvalidArguments"] = "InvalidArguments";
+  OtpFlowErrorCodeValues2["InvalidChallenge"] = "InvalidChallenge";
+  OtpFlowErrorCodeValues2["InvalidResponse"] = "InvalidResponse";
+  OtpFlowErrorCodeValues2["UnsupportedMethod"] = "UnsupportedMethod";
+  return OtpFlowErrorCodeValues2;
+})(OtpFlowErrorCodeValues || {});
+var OtpFlowError = class extends Error {
+  constructor(code, cleanup) {
+    super(`OTP flow: ${code}`);
+    this.code = code;
+    this.#cleanup = cleanup ? Object.freeze({ ...cleanup }) : void 0;
+  }
+  code;
+  name = "OtpFlowError";
+  #cleanup;
+  /** Секрет доступен явно; не является перечисляемым полем исключения. */
+  get cleanup() {
+    return this.#cleanup;
+  }
+};
+function createOtpFlow(options) {
+  if (!isRecord(options) || !isRecord(options.deviceInfo) || typeof options.deviceInfo.deviceId !== "string" || !options.deviceInfo.deviceId.trim() || typeof options.deviceInfo.deviceType !== "string" || !isDeviceType(options.deviceInfo.deviceType) || options.scopes !== void 0 && (!Array.isArray(options.scopes) || !options.scopes.every(
+    (scope) => typeof scope === "string" && scope.trim()
+  )) || options.splitTokens !== void 0 && typeof options.splitTokens !== "boolean")
+    throw new OtpFlowError("InvalidArguments" /* InvalidArguments */);
+  const client = createIdentityClient(options);
+  const deviceInfo = { ...options.deviceInfo };
+  const scopes = options.scopes ? [...options.scopes] : void 0;
+  const splitTokens = options.splitTokens;
+  return {
+    async start(input, requestOptions) {
+      validateStartInput(input);
+      requestOptions?.signal?.throwIfAborted();
+      const startedAt = Date.now();
+      const response = await sendOtpCode(
+        client,
+        {
+          ...input,
+          accountName: input.account.accountName,
+          type: input.account.accountType
+        },
+        requestOptions?.signal
+      );
+      if (!isRecord(response) || typeof response.sessionId !== "string" || !response.sessionId.trim())
+        throw new OtpFlowError("InvalidResponse" /* InvalidResponse */);
+      if (!supportedMethod(response.usedMethod, input.account.accountType))
+        throw new OtpFlowError("UnsupportedMethod" /* UnsupportedMethod */);
+      const ttl = response.sessionLifeTimeInSeconds ?? 180;
+      if (!positive(ttl)) throw new OtpFlowError("InvalidResponse" /* InvalidResponse */);
+      const expiresAtMs = startedAt + ttl * 1e3;
+      if (!timestamp(expiresAtMs) || expiresAtMs <= Date.now())
+        throw new OtpFlowError("InvalidResponse" /* InvalidResponse */);
+      const mobile = response.usedMethod === VerificationMethodValues.MtsMobileId;
+      const nextSendAtMs = response.nextAvailableUsageTime instanceof Date ? response.nextAvailableUsageTime.getTime() : typeof response.nextAvailableUsageTime === "string" ? Date.parse(response.nextAvailableUsageTime) : void 0;
+      return {
+        sessionId: response.sessionId.trim(),
+        accountType: input.account.accountType,
+        usedMethod: response.usedMethod,
+        phase: mobile ? "Pending" /* Pending */ : "AwaitingCode" /* AwaitingCode */,
+        expiresAtMs,
+        codeLength: codeLength(response.codeLength) ? response.codeLength : input.account.accountType === "Email" && !mobile ? 6 : 4,
+        ...mobile ? {
+          pollIntervalSeconds: positive(response.pollIntervalSeconds) ? response.pollIntervalSeconds : 3
+        } : {},
+        ...attempts(response.attemptCountToUseSession) ? { attemptsRemaining: response.attemptCountToUseSession } : {},
+        ...timestamp(nextSendAtMs) ? { nextSendAtMs } : {},
+        ...methods(response.availableMethods) ? { availableMethods: [...response.availableMethods] } : {}
+      };
+    },
+    async complete(input, requestOptions) {
+      if (!isRecord(input)) throw new OtpFlowError("InvalidArguments" /* InvalidArguments */);
+      requestOptions?.signal?.throwIfAborted();
+      const continuation = validateChallenge(input.challenge);
+      if (continuation.phase === "Pending" /* Pending */ && input.code !== void 0 || continuation.phase === "AwaitingCode" /* AwaitingCode */ && (typeof input.code !== "string" || !input.code.trim()))
+        throw new OtpFlowError("InvalidArguments" /* InvalidArguments */);
+      const raw = await requestAuthToken(
+        client,
+        {
+          sessionId: continuation.sessionId,
+          code: input.code?.trim() ?? "",
+          deviceInfo,
+          scopes,
+          splitTokens
+        },
+        requestOptions?.signal
+      );
+      if (!isRecord(raw)) throw new OtpFlowError("InvalidResponse" /* InvalidResponse */);
+      const fields = tokenResponseFields(raw);
+      const refreshToken = typeof fields.refresh === "string" && fields.refresh.trim() ? fields.refresh.trim() : void 0;
+      const cleanup = refreshToken ? { refreshToken } : void 0;
+      const status = tokenTransition(
+        typeof fields.status === "string" ? fields.status.trim() : fields.status
+      );
+      if (!status || fields.access != null && typeof fields.access !== "string" || fields.refresh != null && typeof fields.refresh !== "string" || fields.expiration != null && (typeof fields.expiration !== "number" || !Number.isFinite(fields.expiration) || fields.expiration < 0))
+        throw new OtpFlowError("InvalidResponse" /* InvalidResponse */, cleanup);
+      if (status === TokenStatusValues2.Pending)
+        return {
+          status,
+          cleanup,
+          challenge: {
+            ...continuation,
+            phase: "Pending" /* Pending */,
+            usedMethod: VerificationMethodValues.MtsMobileId,
+            pollIntervalSeconds: continuation.pollIntervalSeconds ?? 3
+          }
+        };
+      if (status === TokenStatusValues2.AwaitingSmsCode) {
+        const { pollIntervalSeconds: _interval, ...challenge } = continuation;
+        return {
+          status,
+          cleanup,
+          challenge: {
+            ...challenge,
+            phase: "AwaitingCode" /* AwaitingCode */,
+            usedMethod: VerificationMethodValues.Sms,
+            codeLength: challenge.codeLength || 4
+          }
+        };
+      }
+      if (status === TokenStatusValues2.Failed) return { status, cleanup };
+      if (typeof fields.access !== "string" || !fields.access.trim())
+        throw new OtpFlowError("InvalidResponse" /* InvalidResponse */, cleanup);
+      return {
+        status,
+        tokens: {
+          status,
+          accessToken: fields.access.trim(),
+          ...refreshToken ? { refreshToken } : {},
+          ...typeof fields.expiration === "number" ? { expiration: fields.expiration } : {}
+        }
+      };
+    }
+  };
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function positive(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+function codeLength(value) {
+  return positive(value) && Number.isInteger(value) && value <= 32;
+}
+function attempts(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function timestamp(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= 864e13;
+}
+function methods(value) {
+  return Array.isArray(value) && value.every(
+    (method) => typeof method === "string" && isVerificationMethod(method)
+  );
+}
+function supportedMethod(value, accountType) {
+  return typeof value === "string" && isVerificationMethod(value) && (value !== VerificationMethodValues.UnknownMethod || accountType === "Email");
+}
+function validateStartInput(input) {
+  if (!isRecord(input) || !isRecord(input.account) || typeof input.account.accountType !== "string" || !isSendCodeAccountType(input.account.accountType) || typeof input.account.accountName !== "string" || !input.account.accountName.trim())
+    throw new OtpFlowError("InvalidArguments" /* InvalidArguments */);
+  for (const field of ["language", "captcha", "inviteSessionId"]) {
+    if (input[field] !== void 0 && typeof input[field] !== "string")
+      throw new OtpFlowError("InvalidArguments" /* InvalidArguments */);
+  }
+  if (input.regionStorageId !== void 0 && !attempts(input.regionStorageId) || input.captchaType !== void 0 && (typeof input.captchaType !== "string" || !isAuthCaptchaType(input.captchaType)) || input.preferredMethod !== void 0 && (typeof input.preferredMethod !== "string" || !isVerificationMethod(input.preferredMethod)) || input.supportedMethods !== void 0 && !methods(input.supportedMethods))
+    throw new OtpFlowError("InvalidArguments" /* InvalidArguments */);
+}
+function validateChallenge(value) {
+  if (!isRecord(value) || typeof value.sessionId !== "string" || !value.sessionId.trim() || typeof value.accountType !== "string" || !isSendCodeAccountType(value.accountType) || !supportedMethod(value.usedMethod, value.accountType) || value.phase !== "Pending" /* Pending */ && value.phase !== "AwaitingCode" /* AwaitingCode */ || !timestamp(value.expiresAtMs) || value.expiresAtMs <= Date.now() || value.phase === "Pending" /* Pending */ !== (value.usedMethod === VerificationMethodValues.MtsMobileId))
+    throw new OtpFlowError("InvalidChallenge" /* InvalidChallenge */);
+  if (value.codeLength !== void 0 && !codeLength(value.codeLength) || value.pollIntervalSeconds !== void 0 && !positive(value.pollIntervalSeconds) || value.attemptsRemaining !== void 0 && !attempts(value.attemptsRemaining) || value.nextSendAtMs !== void 0 && !timestamp(value.nextSendAtMs) || value.availableMethods !== void 0 && !methods(value.availableMethods))
+    throw new OtpFlowError("InvalidChallenge" /* InvalidChallenge */);
+  return {
+    sessionId: value.sessionId.trim(),
+    accountType: value.accountType,
+    usedMethod: value.usedMethod,
+    phase: value.phase,
+    expiresAtMs: value.expiresAtMs,
+    ...codeLength(value.codeLength) ? { codeLength: value.codeLength } : {},
+    ...positive(value.pollIntervalSeconds) ? { pollIntervalSeconds: value.pollIntervalSeconds } : {},
+    ...attempts(value.attemptsRemaining) ? { attemptsRemaining: value.attemptsRemaining } : {},
+    ...timestamp(value.nextSendAtMs) ? { nextSendAtMs: value.nextSendAtMs } : {},
+    ...methods(value.availableMethods) ? { availableMethods: [...value.availableMethods] } : {}
+  };
+}
+
+// ../../src/auth-session/token-storage.ts
+var MemoryTokenStorage = class {
+  snapshot;
+  constructor(initial) {
+    this.snapshot = { ...initial ?? {} };
+  }
+  async load() {
+    return { ...this.snapshot };
+  }
+  async save(snapshot) {
+    this.snapshot = {
+      accessToken: snapshot.accessToken?.trim() || void 0,
+      refreshToken: snapshot.refreshToken?.trim() || void 0,
+      accessExpiresAtMs: snapshot.accessExpiresAtMs || void 0,
+      deviceId: snapshot.deviceId?.trim() || void 0
+    };
+  }
+};
+
+// ../../src/auth-session/local-storage-token-storage.ts
+function resolveLocalStorage() {
+  const g = globalThis;
+  if (!g.localStorage || typeof g.localStorage.getItem !== "function") {
+    throw new Error(
+      "LocalStorageTokenStorage: globalThis.localStorage is not available in this environment"
+    );
+  }
+  return g.localStorage;
+}
+var LocalStorageTokenStorage = class {
+  constructor(key, store) {
+    this.key = key;
+    const trimmed = key.trim();
+    if (!trimmed) {
+      throw new Error("LocalStorageTokenStorage: empty key");
+    }
+    this.key = trimmed;
+    this.store = store ?? resolveLocalStorage();
+  }
+  key;
+  store;
+  async load() {
+    try {
+      const raw = this.store.getItem(this.key);
+      if (!raw?.trim()) return {};
+      const parsed = JSON.parse(raw);
+      if (parsed === null || typeof parsed !== "object") return {};
+      const o = parsed;
+      return {
+        accessToken: typeof o.accessToken === "string" ? o.accessToken : void 0,
+        refreshToken: typeof o.refreshToken === "string" ? o.refreshToken : void 0,
+        accessExpiresAtMs: typeof o.accessExpiresAtMs === "number" ? o.accessExpiresAtMs : void 0,
+        deviceId: typeof o.deviceId === "string" ? o.deviceId : void 0
+      };
+    } catch {
+      return {};
+    }
+  }
+  async save(snapshot) {
+    const toSave = {
+      accessToken: snapshot.accessToken?.trim() || void 0,
+      refreshToken: snapshot.refreshToken?.trim() || void 0,
+      accessExpiresAtMs: snapshot.accessExpiresAtMs || void 0,
+      deviceId: snapshot.deviceId?.trim() || void 0
+    };
+    this.store.setItem(this.key, JSON.stringify(toSave));
+  }
+};
+
+// ../../src/auth-session/auth-session-not-ready.ts
+import { TorrowHttpError } from "@torrow/sdk-client";
+var AuthSessionNotReadyError = class extends Error {
+  name = "AuthSessionNotReadyError";
+  cause;
+  constructor(message = "Auth session is not ready yet", cause) {
+    super(message);
+    this.cause = cause;
+  }
+};
+function isAuthSessionNotReadyYet(e) {
+  if (e instanceof AuthSessionNotReadyError) return true;
+  if (!(e instanceof TorrowHttpError)) return false;
+  const text = [
+    e.message,
+    e.apiErrorName,
+    typeof e.body === "string" ? e.body : JSON.stringify(e.body ?? "")
+  ].join(" ").toLowerCase();
+  return text.includes("session is not ready") || text.includes("unauthorized_client");
+}
+
+// ../../src/auth-session/TokenSession.ts
+import {
+  DefaultAuthScopes as DefaultAuthScopes2,
+  TorrowClient as TorrowClient2,
+  TorrowHttpError as TorrowHttpError2,
+  DeviceTypeValues,
+  TokenStatusValues as TokenStatusValues3
+} from "@torrow/sdk-client";
+
+// ../../src/auth-session/fetch-with-401-retry.ts
+function requestUrl(input) {
+  if (typeof input === "string") return input;
+  if (input instanceof URL) return input.href;
+  return input.url;
+}
+function isAuthIdentityUrl(url) {
+  return url.includes("/api/v1/auth/");
+}
+function createFetchWith401Retry(options) {
+  const baseFetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+  const wrapped = async (input, init) => {
+    const first = await baseFetch(input, init);
+    if (first.status !== 401) return first;
+    const url = requestUrl(input);
+    if (isAuthIdentityUrl(url)) return first;
+    await options.refresh();
+    const token = await options.getAccessToken();
+    const headers = new Headers(init?.headers);
+    if (token) {
+      headers.set("Authorization", `Bearer ${token}`);
+    } else {
+      headers.delete("Authorization");
+    }
+    return baseFetch(input, { ...init, headers });
+  };
+  return wrapped;
+}
+
+// ../../src/auth-session/merge-tokens.ts
+import { isTokenRespReadyStatus } from "@torrow/sdk-client";
+function normalizeTokenResp(raw) {
+  if (raw === null || raw === void 0) return {};
+  if (typeof raw === "string") {
+    const t = raw.trim();
+    return t ? { accessToken: t } : {};
+  }
+  if (typeof raw !== "object") return {};
+  const o = raw;
+  const { access, refresh, expiration: expRaw, status: statusRaw } = tokenResponseFields(o);
+  const out = {};
+  if (typeof access === "string" && access.trim()) out.accessToken = access.trim();
+  if (typeof refresh === "string" && refresh.trim()) out.refreshToken = refresh.trim();
+  if (typeof expRaw === "number" && Number.isFinite(expRaw)) out.expiration = expRaw;
+  if (typeof statusRaw === "string" && statusRaw.trim()) {
+    out.status = statusRaw.trim();
+  }
+  return out;
+}
+function decodeJwtJsonSegment(segment) {
+  try {
+    const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = b64.length % 4 === 0 ? "" : "=".repeat(4 - b64.length % 4);
+    const binary = atob(b64 + pad);
+    const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+    return JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    return void 0;
+  }
+}
+function accessExpiresAtMsFromJwt(accessToken) {
+  const parts = accessToken.split(".");
+  if (parts.length < 2) return void 0;
+  if (decodeJwtJsonSegment(parts[0]) === void 0) return void 0;
+  const payload = decodeJwtJsonSegment(parts[1]);
+  if (payload === null || typeof payload !== "object") return void 0;
+  const exp = payload.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return void 0;
+  return exp * 1e3;
+}
+function accessTokenLooksLikeJwt(accessToken) {
+  return accessToken.split(".").length >= 3;
+}
+function mergeAuthTokens(prev, tokens, opts) {
+  const replace = opts?.replace === true;
+  const nextAccess = (replace ? tokens.accessToken?.trim() || "" : tokens.accessToken?.trim() || prev.accessToken?.trim() || "").trim();
+  const refreshToken = replace ? tokens.refreshToken?.trim() || "" : tokens.refreshToken?.trim() || prev.refreshToken?.trim() || "";
+  const ttlSec = tokens.expiration ?? 0;
+  let accessExpiresAtMs;
+  if (ttlSec > 0) {
+    accessExpiresAtMs = Date.now() + ttlSec * 1e3;
+  } else {
+    const keepAfter = opts?.keepPrevTtlIfExpiresAfterMs ?? Date.now();
+    const jwtExp = nextAccess ? accessExpiresAtMsFromJwt(nextAccess) : void 0;
+    if (typeof jwtExp === "number") {
+      accessExpiresAtMs = jwtExp;
+    } else if (!replace && typeof prev.accessExpiresAtMs === "number" && prev.accessExpiresAtMs > keepAfter) {
+      accessExpiresAtMs = prev.accessExpiresAtMs;
+    } else {
+      accessExpiresAtMs = void 0;
+    }
+  }
+  return {
+    ...prev,
+    accessToken: nextAccess || void 0,
+    refreshToken: refreshToken || void 0,
+    accessExpiresAtMs
+  };
+}
+function assertTokenRespReadyForStorage(tokens, context) {
+  const status = tokens.status;
+  if (!isTokenRespReadyStatus(status)) {
+    throw new Error(
+      `${context}: TokenResp.status=${status} (\u043E\u0436\u0438\u0434\u0430\u043B\u0441\u044F TokenReady). \u0422\u043E\u043A\u0435\u043D\u044B \u043D\u0435 \u0441\u043E\u0445\u0440\u0430\u043D\u044F\u0435\u043C.`
+    );
+  }
+  if (!tokens.accessToken?.trim() && !tokens.refreshToken?.trim()) {
+    throw new Error(`${context}: TokenResp \u0431\u0435\u0437 accessToken \u0438 refreshToken.`);
+  }
+  return tokens;
+}
+
+// ../../src/auth-session/TokenSession.ts
+var DEFAULT_SKEW_MS = 3e4;
+var SESSION_CLOSED_MESSAGE = "TokenSession: session closed (logout)";
+function defaultOnRefreshFailure(err) {
+  if (!(err instanceof TorrowHttpError2)) return "keep";
+  const s = err.status;
+  if (s === 429 || s === 502 || s === 503 || s === 504) return "keep";
+  return "clear";
+}
+var TokenSession = class _TokenSession {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  opts;
+  tokenSnapshot = {};
+  ensureFreshMutex = Promise.resolve();
+  _client;
+  statusListeners = /* @__PURE__ */ new Set();
+  closed = false;
+  /** Set in refreshWithFailurePolicy catch; not cleared on success (see public refresh). */
+  lastRefreshError;
+  static async open(opts) {
+    const session = new _TokenSession(opts);
+    session.tokenSnapshot = await opts.tokenStorage.load();
+    if (!session.tokenSnapshot.deviceId?.trim()) {
+      const di = session.resolveDeviceInfo();
+      const id = di.deviceId?.trim();
+      if (id) {
+        session.tokenSnapshot = { ...session.tokenSnapshot, deviceId: id };
+        await session.persist(false);
+      }
+    }
+    session._client = session.buildClient();
+    if (!opts.skipEnsureFreshOnOpen) {
+      await session.ensureFresh();
+    }
+    return session;
+  }
+  /** Persist, переданный в `TokenSession.open` / `TorrowAuth.*`. */
+  get tokenStorage() {
+    return this.opts.tokenStorage;
+  }
+  get client() {
+    if (!this._client) {
+      throw new Error("TokenSession: client not initialized (call TokenSession.open)");
+    }
+    return this._client;
+  }
+  /** Текущий статус сессии. */
+  get status() {
+    return this.computeStatus();
+  }
+  /** Подписка на смену статуса; возвращает unsubscribe. Сразу вызывает listener с текущим статусом. */
+  onStatusChange(listener) {
+    this.statusListeners.add(listener);
+    try {
+      listener(this.computeStatus());
+    } catch {
+    }
+    return () => {
+      this.statusListeners.delete(listener);
+    };
+  }
+  /** Текущий снимок токенов сессии (копия {@link AuthTokenSnapshot}). */
+  getTokenSnapshot() {
+    return { ...this.tokenSnapshot };
+  }
+  /** `deviceInfo` из options open или fallback Desktop + deviceId из tokenSnapshot. */
+  getDeviceInfo() {
+    return this.resolveDeviceInfo();
+  }
+  async getAccessToken() {
+    if (this.closed) return void 0;
+    await this.ensureFresh();
+    return this.tokenSnapshot.accessToken?.trim() || void 0;
+  }
+  /**
+   * Сохранить ответ `requestToken` / `refresh` (только TokenReady).
+   * Сериализован с `ensureFresh` / `logout` через mutex. Дефолт merge намеренно
+   * (refresh-shaped); логин — `{ replace: true }`. После `logout` — новая сессия.
+   */
+  async applyTokenResp(tokens, opts) {
+    await this.runExclusive(() => this.applyTokenRespUnlocked(tokens, opts));
+  }
+  async clearTokens() {
+    await this.runExclusive(() => this.clearTokensUnlocked());
+  }
+  /**
+   * Revoke refresh (если есть) + очистка storage.
+   * Единственное публичное имя выхода из сессии.
+   */
+  async logout() {
+    await this.runExclusive(async () => {
+      this.closed = true;
+      const refresh = this.tokenSnapshot.refreshToken?.trim();
+      if (refresh) {
+        try {
+          await this.identityClient().auth.revoke({ token: refresh });
+        } catch {
+        }
+      }
+      await this.clearTokensUnlocked();
+    });
+  }
+  /**
+   * Получить токены по **id auth-сессии** (`sessionId` из `sendCode` / `createSession`)
+   * и **OTP-коду доступа**, затем сохранить их в storage сессии.
+   *
+   * Один вызов `POST /api/v1/auth/token` (`requestToken`) с `{ sessionId, code }`.
+   * При успехе (`TokenReady`) — persist; если сессия ещё не готова —
+   * {@link AuthSessionNotReadyError} (поллинг для deep-link — внутри `TorrowAuth.loginWithLink`).
+   *
+   * HTTP вне mutex; persist сериализован через {@link applyTokenResp} (не оборачивать
+   * весь метод в `runExclusive` — вложенный mutex с публичным `applyTokenResp`).
+   */
+  async requestTokenWithCode(args) {
+    this.assertNotClosedForWrite();
+    const sessionId = args.sessionId.trim();
+    const code = args.code.trim();
+    if (!sessionId || !code) {
+      throw new Error("TokenSession.requestTokenWithCode: sessionId and code are required");
+    }
+    const scopes = args.scopes && args.scopes.length > 0 ? args.scopes : [...DefaultAuthScopes2];
+    const deviceInfo = this.resolveDeviceInfo();
+    let resp;
+    try {
+      resp = normalizeTokenResp(
+        await requestAuthToken(
+          this.identityClient(),
+          { sessionId, code, scopes, deviceInfo },
+          args.signal
+        )
+      );
+    } catch (e) {
+      if (isAuthSessionNotReadyYet(e)) {
+        throw new AuthSessionNotReadyError("Auth session is not ready yet", e);
+      }
+      throw e;
+    }
+    if (tokenTransition(resp.status, true) !== TokenStatusValues3.TokenReady) {
+      throw new AuthSessionNotReadyError(
+        `TokenResp.status=${resp.status} (\u043E\u0436\u0438\u0434\u0430\u043B\u0441\u044F TokenReady)`
+      );
+    }
+    const ready = assertTokenRespReadyForStorage(resp, "TokenSession.requestTokenWithCode");
+    await this.applyTokenResp(ready, { replace: true });
+    return ready;
+  }
+  /**
+   * Явный refresh (single-flight через общий mutex сессии).
+   * Сериализован с `logout` / `ensureFresh` / `applyTokenResp`.
+   * При гонке с `logout()`: promise может resolve с `TokenResp`, но snapshot уже очищен —
+   * не используй return value; смотри `session.status` / `getTokenSnapshot()`.
+   */
+  async refresh() {
+    return this.runExclusive(async () => {
+      this.assertNotClosedForWrite();
+      if (!this.tokenSnapshot.refreshToken?.trim()) {
+        throw new Error("TokenSession.refresh: \u043D\u0435\u0442 refreshToken \u0432 storage");
+      }
+      const result = await this.refreshWithFailurePolicy();
+      if (result.outcome === "refreshed") {
+        return result.resp;
+      }
+      if (this.lastRefreshError !== void 0) {
+        throw this.lastRefreshError;
+      }
+      throw new Error("TokenSession.refresh: refresh failed");
+    });
+  }
+  async ensureFresh() {
+    await this.runExclusive(() => this.ensureFreshImpl());
+  }
+  assertNotClosedForWrite() {
+    if (this.closed) {
+      throw new Error(SESSION_CLOSED_MESSAGE);
+    }
+  }
+  /** Caller must hold `runExclusive`. Do not call public `applyTokenResp` from here. */
+  async applyTokenRespUnlocked(tokens, opts) {
+    this.assertNotClosedForWrite();
+    const normalized = normalizeTokenResp(tokens);
+    assertTokenRespReadyForStorage(normalized, "TokenSession.applyTokenResp");
+    this.tokenSnapshot = mergeAuthTokens(this.tokenSnapshot, normalized, {
+      ...opts,
+      // Host TTL survives refresh without expiration only while still fresh (incl. skew); else cleared → opaque until 401.
+      keepPrevTtlIfExpiresAfterMs: Date.now() + (this.opts.accessTokenSkewMs ?? DEFAULT_SKEW_MS)
+    });
+    await this.persist(true);
+  }
+  async clearTokensUnlocked() {
+    this.tokenSnapshot = {
+      ...this.tokenSnapshot,
+      accessToken: void 0,
+      refreshToken: void 0,
+      accessExpiresAtMs: void 0
+    };
+    await this.persist(true);
+  }
+  /** Caller must hold `runExclusive`. `refreshWithFailurePolicy` skips when no refreshToken; guard here is intentional defense-in-depth. */
+  async refreshUnlocked() {
+    const refresh = this.tokenSnapshot.refreshToken?.trim();
+    if (!refresh) {
+      throw new Error("TokenSession.refresh: \u043D\u0435\u0442 refreshToken \u0432 storage");
+    }
+    const deviceInfo = this.resolveDeviceInfo();
+    const resp = await this.identityClient().auth.refresh({
+      refreshToken: refresh,
+      deviceInfo
+    });
+    await this.applyTokenRespUnlocked(resp);
+    return resp;
+  }
+  /** Caller must hold `runExclusive`. */
+  async refreshWithFailurePolicy() {
+    if (this.closed) {
+      return { outcome: "unchanged" };
+    }
+    const refresh = this.tokenSnapshot.refreshToken?.trim();
+    if (!refresh) {
+      return { outcome: "unchanged" };
+    }
+    try {
+      const resp = await this.refreshUnlocked();
+      this.lastRefreshError = void 0;
+      return { outcome: "refreshed", resp };
+    } catch (e) {
+      this.lastRefreshError = e;
+      const action = await this.opts.onRefreshFailure?.(e) ?? defaultOnRefreshFailure(e);
+      if (action === "throw") throw e;
+      if (action === "keep") {
+        return { outcome: "unchanged" };
+      }
+      await this.clearTokensUnlocked();
+      return { outcome: "cleared" };
+    }
+  }
+  async runExclusive(fn) {
+    const prev = this.ensureFreshMutex;
+    let release;
+    this.ensureFreshMutex = new Promise((resolve) => {
+      release = resolve;
+    });
+    await prev;
+    try {
+      return await fn();
+    } finally {
+      release();
+    }
+  }
+  async ensureFreshImpl() {
+    if (this.closed) return;
+    const skew = this.opts.accessTokenSkewMs ?? DEFAULT_SKEW_MS;
+    const access = this.tokenSnapshot.accessToken?.trim() ?? "";
+    const expires = this.tokenSnapshot.accessExpiresAtMs ?? 0;
+    if (access && this.isAccessStillFresh(access, expires, skew)) {
+      return;
+    }
+    const refresh = this.tokenSnapshot.refreshToken?.trim() ?? "";
+    if (refresh) {
+      await this.refreshWithFailurePolicy();
+    }
+  }
+  isAccessStillFresh(access, expiresAtMs, accessTokenSkewMs) {
+    const now = Date.now();
+    const jwtExpMs = accessExpiresAtMsFromJwt(access);
+    if (jwtExpMs !== void 0) {
+      const jwtFresh = now < jwtExpMs - accessTokenSkewMs;
+      const snapFresh = !(expiresAtMs > 0) || now < expiresAtMs - accessTokenSkewMs;
+      return jwtFresh && snapFresh;
+    }
+    if (accessTokenLooksLikeJwt(access)) {
+      return false;
+    }
+    if (!(expiresAtMs > 0)) {
+      return true;
+    }
+    return now < expiresAtMs - accessTokenSkewMs;
+  }
+  computeStatus() {
+    const skew = this.opts.accessTokenSkewMs ?? DEFAULT_SKEW_MS;
+    const access = this.tokenSnapshot.accessToken?.trim() ?? "";
+    const expires = this.tokenSnapshot.accessExpiresAtMs ?? 0;
+    if (access && this.isAccessStillFresh(access, expires, skew)) {
+      return "authenticated";
+    }
+    const hasAny = Boolean(access) || Boolean(this.tokenSnapshot.refreshToken?.trim()) || typeof expires === "number" && expires > 0;
+    if (!hasAny) return "unauthenticated";
+    return "expired";
+  }
+  emitStatusChange() {
+    const status = this.computeStatus();
+    for (const listener of this.statusListeners) {
+      try {
+        listener(status);
+      } catch {
+      }
+    }
+  }
+  resolveDeviceInfo() {
+    if (this.opts.deviceInfo) {
+      return { ...this.opts.deviceInfo };
+    }
+    const deviceId = this.tokenSnapshot.deviceId?.trim();
+    return {
+      ...deviceId ? { deviceId } : {},
+      deviceType: DeviceTypeValues.Desktop
+    };
+  }
+  /** Identity-клиент с Basic приложения, без Bearer пользователя. */
+  identityClient() {
+    return createIdentityClient(this.opts);
+  }
+  buildClient() {
+    let fetchImpl = this.opts.fetch;
+    if (this.opts.refreshOnUnauthorized !== false) {
+      fetchImpl = createFetchWith401Retry({
+        fetch: this.opts.fetch,
+        getAccessToken: async () => {
+          if (this.closed) return void 0;
+          return this.tokenSnapshot.accessToken?.trim() || void 0;
+        },
+        refresh: async () => {
+          await this.runExclusive(async () => {
+            if (this.closed) {
+              throw new Error(SESSION_CLOSED_MESSAGE);
+            }
+            const result = await this.refreshWithFailurePolicy();
+            if (result.outcome !== "refreshed") {
+              throw this.lastRefreshError ?? new Error("TokenSession 401-retry: refresh failed");
+            }
+          });
+        }
+      });
+    }
+    return new TorrowClient2({
+      baseUrl: this.opts.baseUrl,
+      fetch: fetchImpl,
+      defaultHeaders: this.opts.defaultHeaders,
+      userAgent: this.opts.userAgent,
+      authIdentityBasic: appCredentialsToAuthIdentityBasic(
+        resolveAppCredentials(this.opts.appCredentials)
+      ),
+      getAccessToken: async () => this.getAccessToken()
+    });
+  }
+  async persist(emitStatus) {
+    await this.opts.tokenStorage.save(this.tokenSnapshot);
+    if (emitStatus) this.emitStatusChange();
+  }
+};
+
+// ../../src/auth-session/torrow-auth.ts
+import {
+  TorrowClient as TorrowClient3
+} from "@torrow/sdk-client";
+
+// ../../src/auth-session/link-login.ts
+import {
+  AccountTypeValues,
+  DefaultAuthScopes as DefaultAuthScopes3
+} from "@torrow/sdk-client";
+
+// ../../src/auth-session/sleep.ts
+function sleepMs(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(signal.reason ?? new Error("Aborted"));
+      return;
+    }
+    const onAbort = () => {
+      clearTimeout(t);
+      signal?.removeEventListener("abort", onAbort);
+      reject(signal?.reason ?? new Error("Aborted"));
+    };
+    const t = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+// ../../src/auth-session/link-login.ts
+var DEFAULT_POLL_INTERVAL_MS = 2e3;
+var DEFAULT_POLL_TIMEOUT_SEC = 180;
+var DEFAULT_LANGUAGE = "ru";
+var DEFAULT_REGION = 70;
+async function runLinkLogin(session, options) {
+  const client = session.identityClient();
+  const accountType = options.accountType ?? AccountTypeValues.Telegram;
+  const body = {
+    accountType,
+    language: options.language?.trim() || DEFAULT_LANGUAGE,
+    regionStorageId: typeof options.regionStorageId === "number" && Number.isFinite(options.regionStorageId) ? options.regionStorageId : DEFAULT_REGION,
+    ...options.inviteSessionId?.trim() ? { inviteSessionId: options.inviteSessionId.trim() } : {},
+    ...options.captcha?.trim() ? { captcha: options.captcha.trim() } : {},
+    ...options.deviceInfo.deviceId?.trim() ? { deviceId: options.deviceInfo.deviceId.trim() } : {}
+  };
+  const createResp = await client.auth.createSession(body, { signal: options.signal });
+  const sessionId = createResp.sessionId?.trim();
+  const code = createResp.code?.trim();
+  const authUrl = createResp.authUrl?.trim();
+  if (!sessionId || !code || !authUrl) {
+    throw new Error(
+      "runLinkLogin: createSession response incomplete (need sessionId, code, authUrl)"
+    );
+  }
+  await options.onLink(authUrl);
+  const scopes = options.scopes && options.scopes.length > 0 ? options.scopes : [...DefaultAuthScopes3];
+  const intervalMs = typeof options.pollIntervalMs === "number" && options.pollIntervalMs > 0 ? options.pollIntervalMs : DEFAULT_POLL_INTERVAL_MS;
+  const timeoutSec = typeof options.pollTimeoutSec === "number" && options.pollTimeoutSec > 0 ? options.pollTimeoutSec : typeof createResp.sessionLifeTimeInSeconds === "number" && createResp.sessionLifeTimeInSeconds > 0 ? createResp.sessionLifeTimeInSeconds : DEFAULT_POLL_TIMEOUT_SEC;
+  const deadline = Date.now() + timeoutSec * 1e3;
+  for (; ; ) {
+    options.signal?.throwIfAborted?.();
+    try {
+      return await session.requestTokenWithCode({
+        sessionId,
+        code,
+        scopes,
+        signal: options.signal
+      });
+    } catch (e) {
+      if (!isAuthSessionNotReadyYet(e)) throw e;
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `runLinkLogin: timeout ~${timeoutSec}s waiting for auth session to become ready`
+        );
+      }
+      await sleepMs(intervalMs, options.signal);
+    }
+  }
+}
+
+// ../../src/auth-session/otp-login.ts
+import {
+  DefaultAuthScopes as DefaultAuthScopes5,
+  SendCodeAccountTypeValues,
+  TorrowHttpError as TorrowHttpError3,
+  VerificationMethodValues as VerificationMethodValues2,
+  TokenStatusValues as TokenStatusValues5
+} from "@torrow/sdk-client";
+
+// ../../src/auth-session/mobile-id.ts
+import {
+  DefaultAuthScopes as DefaultAuthScopes4,
+  TokenStatusValues as TokenStatusValues4
+} from "@torrow/sdk-client";
+var DEFAULT_POLL_INTERVAL_SEC = 3;
+var DEFAULT_MAX_WAIT_SEC = 180;
+function scopesOrDefault(scopes) {
+  return scopes && scopes.length > 0 ? scopes : [...DefaultAuthScopes4];
+}
+async function pollMobileIdOnce(client, args) {
+  const sessionId = args.sessionId.trim();
+  if (!sessionId) {
+    throw new Error("pollMobileIdOnce: sessionId is empty");
+  }
+  const body = {
+    sessionId,
+    // Empty code = plain poll (server accepts it for Mobile ID); value = SMS-OTP fallback.
+    code: args.code ?? "",
+    scopes: scopesOrDefault(args.scopes),
+    deviceInfo: args.deviceInfo
+  };
+  return normalizeTokenResp(await requestAuthToken(client, body, args.signal));
+}
+async function pollMobileIdUntilReady(client, options) {
+  const sessionId = options.sessionId.trim();
+  if (!sessionId) {
+    throw new Error("pollMobileIdUntilReady: sessionId is empty");
+  }
+  const intervalSec = typeof options.pollIntervalSeconds === "number" && options.pollIntervalSeconds > 0 ? options.pollIntervalSeconds : DEFAULT_POLL_INTERVAL_SEC;
+  const maxWaitSec = typeof options.maxWaitSeconds === "number" && options.maxWaitSeconds > 0 ? options.maxWaitSeconds : DEFAULT_MAX_WAIT_SEC;
+  const deadline = Date.now() + maxWaitSec * 1e3;
+  const scopes = scopesOrDefault(options.scopes);
+  for (; ; ) {
+    if (options.signal?.aborted) {
+      throw options.signal.reason ?? new Error("Aborted");
+    }
+    const resp = await pollMobileIdOnce(client, {
+      sessionId,
+      deviceInfo: options.deviceInfo,
+      scopes,
+      signal: options.signal
+    });
+    const status = resp.status;
+    if (tokenTransition(status, true) === TokenStatusValues4.TokenReady) {
+      return assertTokenRespReadyForStorage(resp, "pollMobileIdUntilReady");
+    }
+    if (status === TokenStatusValues4.Failed) {
+      throw new Error(
+        "pollMobileIdUntilReady: TokenResp.status=Failed \u2014 \u043D\u0443\u0436\u0435\u043D \u043D\u043E\u0432\u044B\u0439 sendCode."
+      );
+    }
+    if (status === TokenStatusValues4.AwaitingSmsCode) {
+      const obtain = options.obtainSmsCode;
+      if (!obtain) {
+        throw new Error(
+          "pollMobileIdUntilReady: AwaitingSmsCode, \u043D\u043E obtainSmsCode \u043D\u0435 \u0437\u0430\u0434\u0430\u043D."
+        );
+      }
+      const code = (await obtain({
+        codeLength: options.smsCodeLength
+      })).trim();
+      if (!code) {
+        throw new Error("pollMobileIdUntilReady: \u043F\u0443\u0441\u0442\u043E\u0439 SMS-\u043A\u043E\u0434 \u043F\u043E\u0441\u043B\u0435 AwaitingSmsCode.");
+      }
+      const afterSms = await pollMobileIdOnce(client, {
+        sessionId,
+        deviceInfo: options.deviceInfo,
+        scopes,
+        code,
+        signal: options.signal
+      });
+      if (tokenTransition(afterSms.status, true) === TokenStatusValues4.TokenReady) {
+        return assertTokenRespReadyForStorage(afterSms, "pollMobileIdUntilReady (SMS)");
+      }
+      if (afterSms.status === TokenStatusValues4.Failed) {
+        throw new Error(
+          "pollMobileIdUntilReady: TokenResp.status=Failed \u043F\u043E\u0441\u043B\u0435 SMS \u2014 \u043D\u0443\u0436\u0435\u043D \u043D\u043E\u0432\u044B\u0439 sendCode."
+        );
+      }
+      if (afterSms.status === TokenStatusValues4.Pending) {
+        continue;
+      }
+      if (afterSms.status === TokenStatusValues4.AwaitingSmsCode) {
+        continue;
+      }
+      throw new Error(
+        `pollMobileIdUntilReady: \u043D\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043D\u044B\u0439 TokenResp.status=${String(afterSms.status)} \u043F\u043E\u0441\u043B\u0435 SMS.`
+      );
+    }
+    if (status !== TokenStatusValues4.Pending) {
+      throw new Error(
+        `pollMobileIdUntilReady: \u043D\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043D\u044B\u0439 TokenResp.status=${String(status)}.`
+      );
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(
+        `pollMobileIdUntilReady: timeout ~${maxWaitSec}\u0441 (poll \u043A\u0430\u0436\u0434\u044B\u0435 ${intervalSec}\u0441) \u2014 \u0441\u0442\u0430\u0442\u0443\u0441 Pending.`
+      );
+    }
+    await sleepMs(intervalSec * 1e3, options.signal);
+  }
+}
+
+// ../../src/auth-session/otp-login.ts
+var MOBILE_ID_SMS_CODE_LENGTH = 4;
+var OtpCodeRequestLimitExceededError = class extends Error {
+  name = "OtpCodeRequestLimitExceededError";
+  minutes;
+  seconds;
+  traceUrl;
+  apiMessage;
+  body;
+  constructor(body) {
+    const parsed = parseRateLimitBody(body);
+    const wait = parsed.min || parsed.sec ? `\u041F\u043E\u0432\u0442\u043E\u0440 \u043F\u0440\u0438\u043C\u0435\u0440\u043D\u043E \u0447\u0435\u0440\u0435\u0437 ${[parsed.min && `${parsed.min} \u043C\u0438\u043D.`, parsed.sec && `${parsed.sec} \u0441\u0435\u043A.`].filter(Boolean).join(" ")}.` : "\u0422\u043E\u0447\u043D\u043E\u0435 \u0432\u0440\u0435\u043C\u044F \u043E\u0436\u0438\u0434\u0430\u043D\u0438\u044F \u0441\u0435\u0440\u0432\u0435\u0440 \u043D\u0435 \u043F\u0435\u0440\u0435\u0434\u0430\u043B.";
+    super(`sendCode: CODE_REQUEST_LIMIT_EXCEEDED. ${wait}`);
+    this.minutes = parsed.min;
+    this.seconds = parsed.sec;
+    this.traceUrl = parsed.trace;
+    this.apiMessage = parsed.message;
+    this.body = body;
+  }
+};
+var OtpAuthHeaderMissingError = class extends Error {
+  name = "OtpAuthHeaderMissingError";
+  body;
+  systemMessage;
+  constructor(body) {
+    const sys = body !== null && typeof body === "object" && typeof body.systemMessage === "string" ? body.systemMessage.trim() : void 0;
+    super(
+      [
+        "requestToken: AUTH_HEADER_MISSING \u2014 \u0437\u0430\u0434\u0430\u0439 appCredentials: { clientId, clientSecret }.",
+        sys ? `\u0421\u043E\u043E\u0431\u0449\u0435\u043D\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430: ${sys}` : ""
+      ].filter(Boolean).join(" ")
+    );
+    this.body = body;
+    this.systemMessage = sys;
+  }
+};
+function parseRateLimitBody(body) {
+  if (body === null || typeof body !== "object") return {};
+  const o = body;
+  const p = o.parameters ?? {};
+  return {
+    min: p.minutes != null && String(p.minutes) !== "" ? String(p.minutes) : void 0,
+    sec: p.seconds != null && String(p.seconds) !== "" ? String(p.seconds) : void 0,
+    message: typeof o.message === "string" && o.message.trim() ? o.message.trim() : void 0,
+    trace: typeof o.traceUrl === "string" && o.traceUrl.trim() ? o.traceUrl.trim() : void 0
+  };
+}
+function isSendCodeRateLimitedBody(body) {
+  if (body === null || typeof body !== "object") return false;
+  return body.name === "CODE_REQUEST_LIMIT_EXCEEDED";
+}
+function isAuthHeaderMissingBody(body) {
+  if (body === null || typeof body !== "object") return false;
+  return body.name === "AUTH_HEADER_MISSING";
+}
+function httpErrorBody(e) {
+  if (e instanceof TorrowHttpError3) return e.body;
+  if (e !== null && typeof e === "object" && "body" in e) {
+    return e.body;
+  }
+  return void 0;
+}
+function scopesOrDefault2(scopes) {
+  return scopes && scopes.length > 0 ? scopes : [...DefaultAuthScopes5];
+}
+function effectiveCodeLength(raw, fallback) {
+  if (typeof raw === "number" && raw > 0) return raw;
+  return fallback > 0 ? fallback : void 0;
+}
+async function requestTokenOrThrow(client, body, signal) {
+  try {
+    return normalizeTokenResp(await requestAuthToken(client, body, signal));
+  } catch (e) {
+    const errBody = httpErrorBody(e);
+    if (errBody !== void 0 && isAuthHeaderMissingBody(errBody)) {
+      throw new OtpAuthHeaderMissingError(errBody);
+    }
+    throw e;
+  }
+}
+async function runOtpLogin(client, options) {
+  const accountName = options.accountName.trim();
+  const accountType = options.type;
+  const scopes = scopesOrDefault2(options.scopes);
+  const signal = options.signal;
+  let sendResp;
+  try {
+    sendResp = await sendOtpCode(client, options, signal);
+  } catch (e) {
+    const errBody = httpErrorBody(e);
+    if (errBody !== void 0 && isSendCodeRateLimitedBody(errBody)) {
+      throw new OtpCodeRequestLimitExceededError(errBody);
+    }
+    throw e;
+  }
+  const sessionId = sendResp.sessionId?.trim();
+  if (!sessionId) {
+    throw new Error("runOtpLogin: sendCode response had no sessionId");
+  }
+  const result = {
+    accountName,
+    accountType,
+    sessionId,
+    usedMethod: sendResp.usedMethod,
+    codeLength: sendResp.codeLength,
+    pollIntervalSeconds: sendResp.pollIntervalSeconds,
+    availableMethods: sendResp.availableMethods,
+    sessionLifeTimeInSeconds: sendResp.sessionLifeTimeInSeconds,
+    nextAvailableUsageTime: sendResp.nextAvailableUsageTime ?? null
+  };
+  await options.onSendCode(result);
+  if (sendResp.usedMethod === VerificationMethodValues2.MtsMobileId) {
+    try {
+      return await pollMobileIdUntilReady(client, {
+        sessionId,
+        deviceInfo: options.deviceInfo,
+        scopes,
+        pollIntervalSeconds: sendResp.pollIntervalSeconds,
+        maxWaitSeconds: sendResp.sessionLifeTimeInSeconds,
+        signal,
+        smsCodeLength: typeof sendResp.codeLength === "number" && sendResp.codeLength > 0 ? sendResp.codeLength : MOBILE_ID_SMS_CODE_LENGTH,
+        obtainSmsCode: async (ctx) => {
+          const codeLength2 = effectiveCodeLength(ctx.codeLength, MOBILE_ID_SMS_CODE_LENGTH);
+          return (await options.getCode({
+            sessionId,
+            codeLength: codeLength2,
+            usedMethod: sendResp.usedMethod
+          })).trim();
+        }
+      });
+    } catch (e) {
+      const errBody = httpErrorBody(e);
+      if (errBody !== void 0 && isAuthHeaderMissingBody(errBody)) {
+        throw new OtpAuthHeaderMissingError(errBody);
+      }
+      throw e;
+    }
+  }
+  const classicLength = effectiveCodeLength(
+    sendResp.codeLength,
+    accountType === SendCodeAccountTypeValues.Email ? 6 : 4
+  );
+  const code = (await options.getCode({
+    sessionId,
+    codeLength: classicLength,
+    usedMethod: sendResp.usedMethod
+  })).trim();
+  if (!code) {
+    throw new Error("runOtpLogin: empty OTP code");
+  }
+  const resp = await requestTokenOrThrow(
+    client,
+    {
+      sessionId,
+      code,
+      scopes,
+      deviceInfo: options.deviceInfo
+    },
+    signal
+  );
+  if (tokenTransition(resp.status, true) !== TokenStatusValues5.TokenReady) {
+    throw new Error(`runOtpLogin: TokenResp.status=${resp.status} (\u043E\u0436\u0438\u0434\u0430\u043B\u0441\u044F TokenReady)`);
+  }
+  return assertTokenRespReadyForStorage(resp, "runOtpLogin");
+}
+
+// ../../src/auth-session/torrow-auth.ts
+function sessionOpenOpts(base) {
+  return {
+    appCredentials: base.appCredentials,
+    tokenStorage: base.tokenStorage,
+    deviceInfo: base.deviceInfo,
+    baseUrl: base.baseUrl,
+    fetch: base.fetch,
+    defaultHeaders: base.defaultHeaders,
+    userAgent: base.userAgent,
+    accessTokenSkewMs: base.accessTokenSkewMs,
+    refreshOnUnauthorized: base.refreshOnUnauthorized,
+    onRefreshFailure: base.onRefreshFailure
+  };
+}
+function sessionOpenOptsForLogin(base) {
+  return { ...sessionOpenOpts(base), skipEnsureFreshOnOpen: true };
+}
+var TorrowAuth = {
+  /** Пошаговый OTP без storage, polling и refresh. */
+  createOtpFlow,
+  async connect(options) {
+    const session = await TokenSession.open(sessionOpenOpts(options));
+    return { client: session.client, session };
+  },
+  async loginWithOtp(options) {
+    const accountName = options.account.accountName.trim();
+    if (!accountName) {
+      throw new Error("TorrowAuth.loginWithOtp: account.accountName is empty");
+    }
+    const session = await TokenSession.open(sessionOpenOptsForLogin(options));
+    const deviceInfo = session.getDeviceInfo();
+    const ready = await runOtpLogin(session.identityClient(), {
+      accountName,
+      type: options.account.accountType,
+      deviceInfo,
+      onSendCode: options.onSendCode,
+      getCode: options.getCode,
+      scopes: options.scopes,
+      language: options.language,
+      regionStorageId: options.regionStorageId,
+      captcha: options.captcha,
+      captchaType: options.captchaType,
+      inviteSessionId: options.inviteSessionId,
+      preferredMethod: options.preferredMethod,
+      supportedMethods: options.supportedMethods,
+      signal: options.signal
+    });
+    await session.applyTokenResp(ready, { replace: true });
+    return { client: session.client, session };
+  },
+  async loginWithLink(options) {
+    const session = await TokenSession.open(sessionOpenOptsForLogin(options));
+    await runLinkLogin(session, {
+      deviceInfo: session.getDeviceInfo(),
+      onLink: options.onLink,
+      accountType: options.accountType,
+      language: options.language,
+      regionStorageId: options.regionStorageId,
+      captcha: options.captcha,
+      inviteSessionId: options.inviteSessionId,
+      scopes: options.scopes,
+      pollIntervalMs: options.pollIntervalMs,
+      pollTimeoutSec: options.pollTimeoutSec,
+      signal: options.signal
+    });
+    return { client: session.client, session };
+  },
+  async fromTokens(options) {
+    const accessToken = options.accessToken.trim();
+    if (!accessToken) {
+      throw new Error("TorrowAuth.fromTokens: accessToken is empty");
+    }
+    const refreshToken = options.refreshToken?.trim() || void 0;
+    const prev = await options.tokenStorage.load();
+    const explicitTtl = options.accessExpiresAtMs;
+    const accessExpiresAtMs = typeof explicitTtl === "number" && Number.isFinite(explicitTtl) && explicitTtl > 0 ? explicitTtl : accessExpiresAtMsFromJwt(accessToken);
+    await options.tokenStorage.save({
+      accessToken,
+      refreshToken,
+      ...typeof accessExpiresAtMs === "number" && accessExpiresAtMs > 0 ? { accessExpiresAtMs } : { accessExpiresAtMs: void 0 },
+      deviceId: options.deviceInfo.deviceId?.trim() || prev.deviceId?.trim() || void 0
+    });
+    return TorrowAuth.connect(options);
+  },
+  anonymous(config = {}) {
+    return new TorrowClient3({
+      ...config,
+      getAccessToken: void 0
+    });
+  }
+};
+export {
+  AuthSessionNotReadyError,
+  DEFAULT_APP_CREDENTIALS,
+  LocalStorageTokenStorage,
+  MemoryTokenStorage,
+  OtpAuthHeaderMissingError,
+  OtpCodeRequestLimitExceededError,
+  OtpFlowError,
+  OtpFlowErrorCodeValues,
+  OtpPhaseValues,
+  TokenSession,
+  TorrowAuth
+};
+//# sourceMappingURL=index.js.map