@torrow/sdk-auth 0.6.0 → 0.7.0

package/dist/index.js

@@ -1,4 +1,4 @@
-// ../../src/auth-session/types.ts
+// ../../src/auth-session/app-credentials.ts
 var DEFAULT_APP_CREDENTIALS = {
   clientId: "sdk.torrow.net",
   clientSecret: "4YM1qYq87faSXaFqXTBcnJrn/jj0AOXl6tTsfubLyCE="
@@ -13,6 +13,278 @@ function appCredentialsToAuthIdentityBasic(appCredentials) {
   return { username: clientId, password: clientSecret };
 }
 
+// ../../src/auth-session/otp-flow.ts
+import {
+  isAuthCaptchaType,
+  isDeviceType,
+  isSendCodeAccountType,
+  isVerificationMethod,
+  TokenStatusValues as TokenStatusValues2,
+  VerificationMethodValues
+} from "@torrow/sdk-client";
+
+// ../../src/auth-session/identity-client.ts
+import { TorrowClient } from "@torrow/sdk-client";
+function createIdentityClient(options) {
+  const authIdentityBasic = appCredentialsToAuthIdentityBasic(
+    resolveAppCredentials(options.appCredentials)
+  );
+  if (!authIdentityBasic) {
+    throw new Error(
+      "TokenSession: \u043D\u0435\u043F\u043E\u043B\u043D\u0430\u044F appCredentials (\u043D\u0443\u0436\u043D\u044B \u043D\u0435\u043F\u0443\u0441\u0442\u044B\u0435 clientId \u0438 clientSecret). \u0411\u0435\u0437 \u043E\u043F\u0446\u0438\u0438 \u0438\u0441\u043F\u043E\u043B\u044C\u0437\u0443\u0435\u0442\u0441\u044F DEFAULT_APP_CREDENTIALS."
+    );
+  }
+  return new TorrowClient({
+    baseUrl: options.baseUrl,
+    fetch: options.fetch,
+    defaultHeaders: options.defaultHeaders,
+    userAgent: options.userAgent,
+    authIdentityBasic
+  });
+}
+
+// ../../src/auth-session/auth-protocol.ts
+import {
+  DefaultAuthScopes,
+  isTokenStatus,
+  TokenStatusValues
+} from "@torrow/sdk-client";
+function buildOtpSendRequest(input) {
+  const accountName = input.accountName.trim();
+  if (!accountName) throw new Error("runOtpLogin: accountName is empty");
+  return {
+    accountName,
+    type: input.type,
+    language: input.language?.trim() || "ru",
+    regionStorageId: typeof input.regionStorageId === "number" && Number.isFinite(input.regionStorageId) ? input.regionStorageId : 70,
+    ...input.captcha?.trim() ? { captcha: input.captcha.trim() } : {},
+    ...input.captchaType ? { captchaType: input.captchaType } : {},
+    ...input.inviteSessionId?.trim() ? { inviteSessionId: input.inviteSessionId.trim() } : {},
+    ...input.preferredMethod ? { preferredMethod: input.preferredMethod } : {},
+    ...input.supportedMethods?.length ? { supportedMethods: input.supportedMethods } : {}
+  };
+}
+function sendOtpCode(client, input, signal) {
+  return client.auth.sendCode(buildOtpSendRequest(input), { signal });
+}
+function requestAuthToken(client, input, signal) {
+  return client.auth.requestToken(
+    {
+      sessionId: input.sessionId,
+      code: input.code,
+      deviceInfo: input.deviceInfo,
+      scopes: input.scopes?.length ? input.scopes : [...DefaultAuthScopes],
+      ...input.splitTokens !== void 0 ? { splitTokens: input.splitTokens } : {}
+    },
+    { signal }
+  );
+}
+function tokenTransition(status, legacy = false) {
+  if (legacy && status == null) return TokenStatusValues.TokenReady;
+  return typeof status === "string" && isTokenStatus(status) ? status : void 0;
+}
+function tokenResponseFields(o) {
+  return {
+    access: o.accessToken ?? o.AccessToken ?? o.access_token,
+    refresh: o.refreshToken ?? o.RefreshToken ?? o.refresh_token,
+    expiration: o.expiration ?? o.Expiration ?? o.expires_in,
+    status: o.status ?? o.Status
+  };
+}
+
+// ../../src/auth-session/otp-flow.ts
+var OtpPhaseValues = /* @__PURE__ */ ((OtpPhaseValues2) => {
+  OtpPhaseValues2["AwaitingCode"] = "AwaitingCode";
+  OtpPhaseValues2["Pending"] = "Pending";
+  return OtpPhaseValues2;
+})(OtpPhaseValues || {});
+var OtpFlowErrorCodeValues = /* @__PURE__ */ ((OtpFlowErrorCodeValues2) => {
+  OtpFlowErrorCodeValues2["InvalidArguments"] = "InvalidArguments";
+  OtpFlowErrorCodeValues2["InvalidChallenge"] = "InvalidChallenge";
+  OtpFlowErrorCodeValues2["InvalidResponse"] = "InvalidResponse";
+  OtpFlowErrorCodeValues2["UnsupportedMethod"] = "UnsupportedMethod";
+  return OtpFlowErrorCodeValues2;
+})(OtpFlowErrorCodeValues || {});
+var OtpFlowError = class extends Error {
+  constructor(code, cleanup) {
+    super(`OTP flow: ${code}`);
+    this.code = code;
+    this.#cleanup = cleanup ? Object.freeze({ ...cleanup }) : void 0;
+  }
+  code;
+  name = "OtpFlowError";
+  #cleanup;
+  /** Секрет доступен явно; не является перечисляемым полем исключения. */
+  get cleanup() {
+    return this.#cleanup;
+  }
+};
+function createOtpFlow(options) {
+  if (!isRecord(options) || !isRecord(options.deviceInfo) || typeof options.deviceInfo.deviceId !== "string" || !options.deviceInfo.deviceId.trim() || typeof options.deviceInfo.deviceType !== "string" || !isDeviceType(options.deviceInfo.deviceType) || options.scopes !== void 0 && (!Array.isArray(options.scopes) || !options.scopes.every(
+    (scope) => typeof scope === "string" && scope.trim()
+  )) || options.splitTokens !== void 0 && typeof options.splitTokens !== "boolean")
+    throw new OtpFlowError("InvalidArguments" /* InvalidArguments */);
+  const client = createIdentityClient(options);
+  const deviceInfo = { ...options.deviceInfo };
+  const scopes = options.scopes ? [...options.scopes] : void 0;
+  const splitTokens = options.splitTokens;
+  return {
+    async start(input, requestOptions) {
+      validateStartInput(input);
+      requestOptions?.signal?.throwIfAborted();
+      const startedAt = Date.now();
+      const response = await sendOtpCode(
+        client,
+        {
+          ...input,
+          accountName: input.account.accountName,
+          type: input.account.accountType
+        },
+        requestOptions?.signal
+      );
+      if (!isRecord(response) || typeof response.sessionId !== "string" || !response.sessionId.trim())
+        throw new OtpFlowError("InvalidResponse" /* InvalidResponse */);
+      if (!supportedMethod(response.usedMethod, input.account.accountType))
+        throw new OtpFlowError("UnsupportedMethod" /* UnsupportedMethod */);
+      const ttl = response.sessionLifeTimeInSeconds ?? 180;
+      if (!positive(ttl)) throw new OtpFlowError("InvalidResponse" /* InvalidResponse */);
+      const expiresAtMs = startedAt + ttl * 1e3;
+      if (!timestamp(expiresAtMs) || expiresAtMs <= Date.now())
+        throw new OtpFlowError("InvalidResponse" /* InvalidResponse */);
+      const mobile = response.usedMethod === VerificationMethodValues.MtsMobileId;
+      const nextSendAtMs = response.nextAvailableUsageTime instanceof Date ? response.nextAvailableUsageTime.getTime() : typeof response.nextAvailableUsageTime === "string" ? Date.parse(response.nextAvailableUsageTime) : void 0;
+      return {
+        sessionId: response.sessionId.trim(),
+        accountType: input.account.accountType,
+        usedMethod: response.usedMethod,
+        phase: mobile ? "Pending" /* Pending */ : "AwaitingCode" /* AwaitingCode */,
+        expiresAtMs,
+        codeLength: codeLength(response.codeLength) ? response.codeLength : input.account.accountType === "Email" && !mobile ? 6 : 4,
+        ...mobile ? {
+          pollIntervalSeconds: positive(response.pollIntervalSeconds) ? response.pollIntervalSeconds : 3
+        } : {},
+        ...attempts(response.attemptCountToUseSession) ? { attemptsRemaining: response.attemptCountToUseSession } : {},
+        ...timestamp(nextSendAtMs) ? { nextSendAtMs } : {},
+        ...methods(response.availableMethods) ? { availableMethods: [...response.availableMethods] } : {}
+      };
+    },
+    async complete(input, requestOptions) {
+      if (!isRecord(input)) throw new OtpFlowError("InvalidArguments" /* InvalidArguments */);
+      requestOptions?.signal?.throwIfAborted();
+      const continuation = validateChallenge(input.challenge);
+      if (continuation.phase === "Pending" /* Pending */ && input.code !== void 0 || continuation.phase === "AwaitingCode" /* AwaitingCode */ && (typeof input.code !== "string" || !input.code.trim()))
+        throw new OtpFlowError("InvalidArguments" /* InvalidArguments */);
+      const raw = await requestAuthToken(
+        client,
+        {
+          sessionId: continuation.sessionId,
+          code: input.code?.trim() ?? "",
+          deviceInfo,
+          scopes,
+          splitTokens
+        },
+        requestOptions?.signal
+      );
+      if (!isRecord(raw)) throw new OtpFlowError("InvalidResponse" /* InvalidResponse */);
+      const fields = tokenResponseFields(raw);
+      const refreshToken = typeof fields.refresh === "string" && fields.refresh.trim() ? fields.refresh.trim() : void 0;
+      const cleanup = refreshToken ? { refreshToken } : void 0;
+      const status = tokenTransition(
+        typeof fields.status === "string" ? fields.status.trim() : fields.status
+      );
+      if (!status || fields.access != null && typeof fields.access !== "string" || fields.refresh != null && typeof fields.refresh !== "string" || fields.expiration != null && (typeof fields.expiration !== "number" || !Number.isFinite(fields.expiration) || fields.expiration < 0))
+        throw new OtpFlowError("InvalidResponse" /* InvalidResponse */, cleanup);
+      if (status === TokenStatusValues2.Pending)
+        return {
+          status,
+          cleanup,
+          challenge: {
+            ...continuation,
+            phase: "Pending" /* Pending */,
+            usedMethod: VerificationMethodValues.MtsMobileId,
+            pollIntervalSeconds: continuation.pollIntervalSeconds ?? 3
+          }
+        };
+      if (status === TokenStatusValues2.AwaitingSmsCode) {
+        const { pollIntervalSeconds: _interval, ...challenge } = continuation;
+        return {
+          status,
+          cleanup,
+          challenge: {
+            ...challenge,
+            phase: "AwaitingCode" /* AwaitingCode */,
+            usedMethod: VerificationMethodValues.Sms,
+            codeLength: challenge.codeLength || 4
+          }
+        };
+      }
+      if (status === TokenStatusValues2.Failed) return { status, cleanup };
+      if (typeof fields.access !== "string" || !fields.access.trim())
+        throw new OtpFlowError("InvalidResponse" /* InvalidResponse */, cleanup);
+      return {
+        status,
+        tokens: {
+          status,
+          accessToken: fields.access.trim(),
+          ...refreshToken ? { refreshToken } : {},
+          ...typeof fields.expiration === "number" ? { expiration: fields.expiration } : {}
+        }
+      };
+    }
+  };
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function positive(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+function codeLength(value) {
+  return positive(value) && Number.isInteger(value) && value <= 32;
+}
+function attempts(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function timestamp(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= 864e13;
+}
+function methods(value) {
+  return Array.isArray(value) && value.every(
+    (method) => typeof method === "string" && isVerificationMethod(method)
+  );
+}
+function supportedMethod(value, accountType) {
+  return typeof value === "string" && isVerificationMethod(value) && (value !== VerificationMethodValues.UnknownMethod || accountType === "Email");
+}
+function validateStartInput(input) {
+  if (!isRecord(input) || !isRecord(input.account) || typeof input.account.accountType !== "string" || !isSendCodeAccountType(input.account.accountType) || typeof input.account.accountName !== "string" || !input.account.accountName.trim())
+    throw new OtpFlowError("InvalidArguments" /* InvalidArguments */);
+  for (const field of ["language", "captcha", "inviteSessionId"]) {
+    if (input[field] !== void 0 && typeof input[field] !== "string")
+      throw new OtpFlowError("InvalidArguments" /* InvalidArguments */);
+  }
+  if (input.regionStorageId !== void 0 && !attempts(input.regionStorageId) || input.captchaType !== void 0 && (typeof input.captchaType !== "string" || !isAuthCaptchaType(input.captchaType)) || input.preferredMethod !== void 0 && (typeof input.preferredMethod !== "string" || !isVerificationMethod(input.preferredMethod)) || input.supportedMethods !== void 0 && !methods(input.supportedMethods))
+    throw new OtpFlowError("InvalidArguments" /* InvalidArguments */);
+}
+function validateChallenge(value) {
+  if (!isRecord(value) || typeof value.sessionId !== "string" || !value.sessionId.trim() || typeof value.accountType !== "string" || !isSendCodeAccountType(value.accountType) || !supportedMethod(value.usedMethod, value.accountType) || value.phase !== "Pending" /* Pending */ && value.phase !== "AwaitingCode" /* AwaitingCode */ || !timestamp(value.expiresAtMs) || value.expiresAtMs <= Date.now() || value.phase === "Pending" /* Pending */ !== (value.usedMethod === VerificationMethodValues.MtsMobileId))
+    throw new OtpFlowError("InvalidChallenge" /* InvalidChallenge */);
+  if (value.codeLength !== void 0 && !codeLength(value.codeLength) || value.pollIntervalSeconds !== void 0 && !positive(value.pollIntervalSeconds) || value.attemptsRemaining !== void 0 && !attempts(value.attemptsRemaining) || value.nextSendAtMs !== void 0 && !timestamp(value.nextSendAtMs) || value.availableMethods !== void 0 && !methods(value.availableMethods))
+    throw new OtpFlowError("InvalidChallenge" /* InvalidChallenge */);
+  return {
+    sessionId: value.sessionId.trim(),
+    accountType: value.accountType,
+    usedMethod: value.usedMethod,
+    phase: value.phase,
+    expiresAtMs: value.expiresAtMs,
+    ...codeLength(value.codeLength) ? { codeLength: value.codeLength } : {},
+    ...positive(value.pollIntervalSeconds) ? { pollIntervalSeconds: value.pollIntervalSeconds } : {},
+    ...attempts(value.attemptsRemaining) ? { attemptsRemaining: value.attemptsRemaining } : {},
+    ...timestamp(value.nextSendAtMs) ? { nextSendAtMs: value.nextSendAtMs } : {},
+    ...methods(value.availableMethods) ? { availableMethods: [...value.availableMethods] } : {}
+  };
+}
+
 // ../../src/auth-session/token-storage.ts
 var MemoryTokenStorage = class {
   snapshot;
@@ -105,11 +377,11 @@ function isAuthSessionNotReadyYet(e) {
 
 // ../../src/auth-session/TokenSession.ts
 import {
-  DefaultAuthScopes,
-  TorrowClient,
+  DefaultAuthScopes as DefaultAuthScopes2,
+  TorrowClient as TorrowClient2,
   TorrowHttpError as TorrowHttpError2,
   DeviceTypeValues,
-  isTokenRespReadyStatus as isTokenRespReadyStatus2
+  TokenStatusValues as TokenStatusValues3
 } from "@torrow/sdk-client";
 
 // ../../src/auth-session/fetch-with-401-retry.ts
@@ -151,10 +423,7 @@ function normalizeTokenResp(raw) {
   }
   if (typeof raw !== "object") return {};
   const o = raw;
-  const access = o.accessToken ?? o.AccessToken ?? o.access_token;
-  const refresh = o.refreshToken ?? o.RefreshToken ?? o.refresh_token;
-  const expRaw = o.expiration ?? o.Expiration ?? o.expires_in;
-  const statusRaw = o.status ?? o.Status;
+  const { access, refresh, expiration: expRaw, status: statusRaw } = tokenResponseFields(o);
   const out = {};
   if (typeof access === "string" && access.trim()) out.accessToken = access.trim();
   if (typeof refresh === "string" && refresh.trim()) out.refreshToken = refresh.trim();
@@ -349,14 +618,15 @@ var TokenSession = class _TokenSession {
     if (!sessionId || !code) {
       throw new Error("TokenSession.requestTokenWithCode: sessionId and code are required");
     }
-    const scopes = args.scopes && args.scopes.length > 0 ? args.scopes : [...DefaultAuthScopes];
+    const scopes = args.scopes && args.scopes.length > 0 ? args.scopes : [...DefaultAuthScopes2];
     const deviceInfo = this.resolveDeviceInfo();
     let resp;
     try {
       resp = normalizeTokenResp(
-        await this.identityClient().auth.requestToken(
+        await requestAuthToken(
+          this.identityClient(),
           { sessionId, code, scopes, deviceInfo },
-          { signal: args.signal }
+          args.signal
         )
       );
     } catch (e) {
@@ -365,7 +635,7 @@ var TokenSession = class _TokenSession {
       }
       throw e;
     }
-    if (!isTokenRespReadyStatus2(resp.status)) {
+    if (tokenTransition(resp.status, true) !== TokenStatusValues3.TokenReady) {
       throw new AuthSessionNotReadyError(
         `TokenResp.status=${resp.status} (\u043E\u0436\u0438\u0434\u0430\u043B\u0441\u044F TokenReady)`
       );
@@ -537,21 +807,7 @@ var TokenSession = class _TokenSession {
   }
   /** Identity-клиент с Basic приложения, без Bearer пользователя. */
   identityClient() {
-    const authIdentityBasic = appCredentialsToAuthIdentityBasic(
-      resolveAppCredentials(this.opts.appCredentials)
-    );
-    if (!authIdentityBasic) {
-      throw new Error(
-        "TokenSession: \u043D\u0435\u043F\u043E\u043B\u043D\u0430\u044F appCredentials (\u043D\u0443\u0436\u043D\u044B \u043D\u0435\u043F\u0443\u0441\u0442\u044B\u0435 clientId \u0438 clientSecret). \u0411\u0435\u0437 \u043E\u043F\u0446\u0438\u0438 \u0438\u0441\u043F\u043E\u043B\u044C\u0437\u0443\u0435\u0442\u0441\u044F DEFAULT_APP_CREDENTIALS."
-      );
-    }
-    return new TorrowClient({
-      baseUrl: this.opts.baseUrl,
-      fetch: this.opts.fetch,
-      defaultHeaders: this.opts.defaultHeaders,
-      userAgent: this.opts.userAgent,
-      authIdentityBasic
-    });
+    return createIdentityClient(this.opts);
   }
   buildClient() {
     let fetchImpl = this.opts.fetch;
@@ -575,7 +831,7 @@ var TokenSession = class _TokenSession {
         }
       });
     }
-    return new TorrowClient({
+    return new TorrowClient2({
       baseUrl: this.opts.baseUrl,
       fetch: fetchImpl,
       defaultHeaders: this.opts.defaultHeaders,
@@ -594,13 +850,13 @@ var TokenSession = class _TokenSession {
 
 // ../../src/auth-session/torrow-auth.ts
 import {
-  TorrowClient as TorrowClient2
+  TorrowClient as TorrowClient3
 } from "@torrow/sdk-client";
 
 // ../../src/auth-session/link-login.ts
 import {
   AccountTypeValues,
-  DefaultAuthScopes as DefaultAuthScopes2
+  DefaultAuthScopes as DefaultAuthScopes3
 } from "@torrow/sdk-client";
 
 // ../../src/auth-session/sleep.ts
@@ -649,7 +905,7 @@ async function runLinkLogin(session, options) {
     );
   }
   await options.onLink(authUrl);
-  const scopes = options.scopes && options.scopes.length > 0 ? options.scopes : [...DefaultAuthScopes2];
+  const scopes = options.scopes && options.scopes.length > 0 ? options.scopes : [...DefaultAuthScopes3];
   const intervalMs = typeof options.pollIntervalMs === "number" && options.pollIntervalMs > 0 ? options.pollIntervalMs : DEFAULT_POLL_INTERVAL_MS;
   const timeoutSec = typeof options.pollTimeoutSec === "number" && options.pollTimeoutSec > 0 ? options.pollTimeoutSec : typeof createResp.sessionLifeTimeInSeconds === "number" && createResp.sessionLifeTimeInSeconds > 0 ? createResp.sessionLifeTimeInSeconds : DEFAULT_POLL_TIMEOUT_SEC;
   const deadline = Date.now() + timeoutSec * 1e3;
@@ -676,23 +932,22 @@ async function runLinkLogin(session, options) {
 
 // ../../src/auth-session/otp-login.ts
 import {
-  DefaultAuthScopes as DefaultAuthScopes4,
-  isTokenRespReadyStatus as isTokenRespReadyStatus4,
+  DefaultAuthScopes as DefaultAuthScopes5,
   SendCodeAccountTypeValues,
   TorrowHttpError as TorrowHttpError3,
-  VerificationMethodValues
+  VerificationMethodValues as VerificationMethodValues2,
+  TokenStatusValues as TokenStatusValues5
 } from "@torrow/sdk-client";
 
 // ../../src/auth-session/mobile-id.ts
 import {
-  DefaultAuthScopes as DefaultAuthScopes3,
-  isTokenRespReadyStatus as isTokenRespReadyStatus3,
-  TokenStatusValues
+  DefaultAuthScopes as DefaultAuthScopes4,
+  TokenStatusValues as TokenStatusValues4
 } from "@torrow/sdk-client";
 var DEFAULT_POLL_INTERVAL_SEC = 3;
 var DEFAULT_MAX_WAIT_SEC = 180;
 function scopesOrDefault(scopes) {
-  return scopes && scopes.length > 0 ? scopes : [...DefaultAuthScopes3];
+  return scopes && scopes.length > 0 ? scopes : [...DefaultAuthScopes4];
 }
 async function pollMobileIdOnce(client, args) {
   const sessionId = args.sessionId.trim();
@@ -706,7 +961,7 @@ async function pollMobileIdOnce(client, args) {
     scopes: scopesOrDefault(args.scopes),
     deviceInfo: args.deviceInfo
   };
-  return normalizeTokenResp(await client.auth.requestToken(body, { signal: args.signal }));
+  return normalizeTokenResp(await requestAuthToken(client, body, args.signal));
 }
 async function pollMobileIdUntilReady(client, options) {
   const sessionId = options.sessionId.trim();
@@ -728,15 +983,15 @@ async function pollMobileIdUntilReady(client, options) {
       signal: options.signal
     });
     const status = resp.status;
-    if (isTokenRespReadyStatus3(status)) {
+    if (tokenTransition(status, true) === TokenStatusValues4.TokenReady) {
       return assertTokenRespReadyForStorage(resp, "pollMobileIdUntilReady");
     }
-    if (status === TokenStatusValues.Failed) {
+    if (status === TokenStatusValues4.Failed) {
       throw new Error(
         "pollMobileIdUntilReady: TokenResp.status=Failed \u2014 \u043D\u0443\u0436\u0435\u043D \u043D\u043E\u0432\u044B\u0439 sendCode."
       );
     }
-    if (status === TokenStatusValues.AwaitingSmsCode) {
+    if (status === TokenStatusValues4.AwaitingSmsCode) {
       const obtain = options.obtainSmsCode;
       if (!obtain) {
         throw new Error(
@@ -756,25 +1011,25 @@ async function pollMobileIdUntilReady(client, options) {
         code,
         signal: options.signal
       });
-      if (isTokenRespReadyStatus3(afterSms.status)) {
+      if (tokenTransition(afterSms.status, true) === TokenStatusValues4.TokenReady) {
         return assertTokenRespReadyForStorage(afterSms, "pollMobileIdUntilReady (SMS)");
       }
-      if (afterSms.status === TokenStatusValues.Failed) {
+      if (afterSms.status === TokenStatusValues4.Failed) {
         throw new Error(
           "pollMobileIdUntilReady: TokenResp.status=Failed \u043F\u043E\u0441\u043B\u0435 SMS \u2014 \u043D\u0443\u0436\u0435\u043D \u043D\u043E\u0432\u044B\u0439 sendCode."
         );
       }
-      if (afterSms.status === TokenStatusValues.Pending) {
+      if (afterSms.status === TokenStatusValues4.Pending) {
         continue;
       }
-      if (afterSms.status === TokenStatusValues.AwaitingSmsCode) {
+      if (afterSms.status === TokenStatusValues4.AwaitingSmsCode) {
         continue;
       }
       throw new Error(
         `pollMobileIdUntilReady: \u043D\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043D\u044B\u0439 TokenResp.status=${String(afterSms.status)} \u043F\u043E\u0441\u043B\u0435 SMS.`
       );
     }
-    if (status !== TokenStatusValues.Pending) {
+    if (status !== TokenStatusValues4.Pending) {
       throw new Error(
         `pollMobileIdUntilReady: \u043D\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043D\u044B\u0439 TokenResp.status=${String(status)}.`
       );
@@ -789,8 +1044,6 @@ async function pollMobileIdUntilReady(client, options) {
 }
 
 // ../../src/auth-session/otp-login.ts
-var DEFAULT_LANGUAGE2 = "ru";
-var DEFAULT_REGION2 = 70;
 var MOBILE_ID_SMS_CODE_LENGTH = 4;
 var OtpCodeRequestLimitExceededError = class extends Error {
   name = "OtpCodeRequestLimitExceededError";
@@ -853,24 +1106,7 @@ function httpErrorBody(e) {
   return void 0;
 }
 function scopesOrDefault2(scopes) {
-  return scopes && scopes.length > 0 ? scopes : [...DefaultAuthScopes4];
-}
-function buildSendCodeReq(options) {
-  const accountName = options.accountName.trim();
-  if (!accountName) {
-    throw new Error("runOtpLogin: accountName is empty");
-  }
-  return {
-    accountName,
-    type: options.type,
-    language: options.language?.trim() || DEFAULT_LANGUAGE2,
-    regionStorageId: typeof options.regionStorageId === "number" && Number.isFinite(options.regionStorageId) ? options.regionStorageId : DEFAULT_REGION2,
-    ...options.captcha?.trim() ? { captcha: options.captcha.trim() } : {},
-    ...options.captchaType ? { captchaType: options.captchaType } : {},
-    ...options.inviteSessionId?.trim() ? { inviteSessionId: options.inviteSessionId.trim() } : {},
-    ...options.preferredMethod ? { preferredMethod: options.preferredMethod } : {},
-    ...options.supportedMethods && options.supportedMethods.length > 0 ? { supportedMethods: options.supportedMethods } : {}
-  };
+  return scopes && scopes.length > 0 ? scopes : [...DefaultAuthScopes5];
 }
 function effectiveCodeLength(raw, fallback) {
   if (typeof raw === "number" && raw > 0) return raw;
@@ -878,7 +1114,7 @@ function effectiveCodeLength(raw, fallback) {
 }
 async function requestTokenOrThrow(client, body, signal) {
   try {
-    return normalizeTokenResp(await client.auth.requestToken(body, { signal }));
+    return normalizeTokenResp(await requestAuthToken(client, body, signal));
   } catch (e) {
     const errBody = httpErrorBody(e);
     if (errBody !== void 0 && isAuthHeaderMissingBody(errBody)) {
@@ -888,14 +1124,13 @@ async function requestTokenOrThrow(client, body, signal) {
   }
 }
 async function runOtpLogin(client, options) {
-  const sendBody = buildSendCodeReq(options);
   const accountName = options.accountName.trim();
   const accountType = options.type;
   const scopes = scopesOrDefault2(options.scopes);
   const signal = options.signal;
   let sendResp;
   try {
-    sendResp = await client.auth.sendCode(sendBody, { signal });
+    sendResp = await sendOtpCode(client, options, signal);
   } catch (e) {
     const errBody = httpErrorBody(e);
     if (errBody !== void 0 && isSendCodeRateLimitedBody(errBody)) {
@@ -919,7 +1154,7 @@ async function runOtpLogin(client, options) {
     nextAvailableUsageTime: sendResp.nextAvailableUsageTime ?? null
   };
   await options.onSendCode(result);
-  if (sendResp.usedMethod === VerificationMethodValues.MtsMobileId) {
+  if (sendResp.usedMethod === VerificationMethodValues2.MtsMobileId) {
     try {
       return await pollMobileIdUntilReady(client, {
         sessionId,
@@ -930,10 +1165,10 @@ async function runOtpLogin(client, options) {
         signal,
         smsCodeLength: typeof sendResp.codeLength === "number" && sendResp.codeLength > 0 ? sendResp.codeLength : MOBILE_ID_SMS_CODE_LENGTH,
         obtainSmsCode: async (ctx) => {
-          const codeLength = effectiveCodeLength(ctx.codeLength, MOBILE_ID_SMS_CODE_LENGTH);
+          const codeLength2 = effectiveCodeLength(ctx.codeLength, MOBILE_ID_SMS_CODE_LENGTH);
           return (await options.getCode({
             sessionId,
-            codeLength,
+            codeLength: codeLength2,
             usedMethod: sendResp.usedMethod
           })).trim();
         }
@@ -968,7 +1203,7 @@ async function runOtpLogin(client, options) {
     },
     signal
   );
-  if (!isTokenRespReadyStatus4(resp.status)) {
+  if (tokenTransition(resp.status, true) !== TokenStatusValues5.TokenReady) {
     throw new Error(`runOtpLogin: TokenResp.status=${resp.status} (\u043E\u0436\u0438\u0434\u0430\u043B\u0441\u044F TokenReady)`);
   }
   return assertTokenRespReadyForStorage(resp, "runOtpLogin");
@@ -993,6 +1228,8 @@ function sessionOpenOptsForLogin(base) {
   return { ...sessionOpenOpts(base), skipEnsureFreshOnOpen: true };
 }
 var TorrowAuth = {
+  /** Пошаговый OTP без storage, polling и refresh. */
+  createOtpFlow,
   async connect(options) {
     const session = await TokenSession.open(sessionOpenOpts(options));
     return { client: session.client, session };
@@ -1058,7 +1295,7 @@ var TorrowAuth = {
     return TorrowAuth.connect(options);
   },
   anonymous(config = {}) {
-    return new TorrowClient2({
+    return new TorrowClient3({
       ...config,
       getAccessToken: void 0
     });
@@ -1071,6 +1308,9 @@ export {
   MemoryTokenStorage,
   OtpAuthHeaderMissingError,
   OtpCodeRequestLimitExceededError,
+  OtpFlowError,
+  OtpFlowErrorCodeValues,
+  OtpPhaseValues,
   TokenSession,
   TorrowAuth
 };