@versini/auth0-auth-js-stub 1.0.0

package/LICENSE

@@ -0,0 +1,28 @@
+MIT License
+
+Copyright (c) 2026 Arno V
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+----------------------------------------------------------------------------
+
+The published @versini/auth0-react-thin and @versini/auth0-spa-js-no-authjs
+packages are builds of Auth0's @auth0/auth0-react and @auth0/auth0-spa-js
+(also MIT, Copyright (c) Auth0, Inc.), modified only by a one-line Rollup
+`external` change. Their published tarballs carry Auth0's original LICENSE.

package/README.md

@@ -0,0 +1,34 @@
+# @versini/auth0-auth-js-stub
+
+A featherweight, no-op stub of [`@auth0/auth0-auth-js`](https://www.npmjs.com/package/@auth0/auth0-auth-js).
+
+The real package pulls in `openid-client` + `oauth4webapi` + `jose` (~26 KB gzip of
+first-paint weight) and powers only the **MFA / Passkey / MyAccount / DPoP** APIs. If
+your app uses only basic Auth0 login (`loginWithRedirect`, `getAccessTokenSilently`,
+`logout`, `isAuthenticated`, `user`), that weight is dead code.
+
+This stub satisfies the symbols `@auth0/auth0-spa-js` imports at runtime. `AuthClient`
+constructs without throwing (it runs on every login), and any MFA/Passkey method call
+throws a clear, actionable error.
+
+## Usage
+
+Don't depend on this directly. It is installed in place of `@auth0/auth0-auth-js` via a
+pnpm `npm:` alias override, together with the slimmed `@auth0/auth0-react` and
+`@auth0/auth0-spa-js` forks. See **[@versini/auth0-thin](https://www.npmjs.com/package/@versini/auth0-thin)**
+for the full setup and the CI verifier.
+
+```yaml
+# pnpm-workspace.yaml
+overrides:
+  "@auth0/auth0-react":   "npm:@versini/auth0-react-thin@<version>"
+  "@auth0/auth0-spa-js":  "npm:@versini/auth0-spa-js-no-authjs@<version>"
+  "@auth0/auth0-auth-js": "npm:@versini/auth0-auth-js-stub@<version>"
+```
+
+> ⚠️ Only safe if your app never uses Auth0 MFA, Passkey, MyAccount, or DPoP. Run
+> `npx auth0-thin verify` in CI to enforce that the assumption still holds.
+
+## License
+
+MIT. This stub is original code; it contains no Auth0 source.

package/index.cjs

@@ -0,0 +1,78 @@
+// Featherweight stub of @auth0/auth0-auth-js (CommonJS). See index.js for rationale.
+
+const notSupported = feature => () => {
+  throw new Error(
+    `@auth0/auth0-auth-js is stubbed in this app; "${feature}" is unavailable. ` +
+      `Remove the pnpm override for @auth0/auth0-auth-js (and the spa-js fork) to restore it.`
+  );
+};
+
+const throwingClient = label =>
+  new Proxy(
+    {},
+    { get: (_t, prop) => notSupported(`${label}.${String(prop)}`) }
+  );
+
+class AuthClient {
+  constructor(_options) {
+    this.mfa = throwingClient('mfa');
+    this.passkey = throwingClient('passkey');
+  }
+}
+
+class MfaClient {}
+
+class StubError extends Error {
+  constructor(code, message) {
+    super(message ?? code);
+    this.code = code;
+  }
+}
+
+class MfaListAuthenticatorsError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'MfaListAuthenticatorsError';
+  }
+}
+class MfaEnrollmentError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'MfaEnrollmentError';
+  }
+}
+class MfaChallengeError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'MfaChallengeError';
+  }
+}
+class PasskeyRegisterError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'PasskeyRegisterError';
+  }
+}
+class PasskeyChallengeError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'PasskeyChallengeError';
+  }
+}
+class PasskeyGetTokenError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'PasskeyGetTokenError';
+  }
+}
+
+module.exports = {
+  AuthClient,
+  MfaClient,
+  MfaListAuthenticatorsError,
+  MfaEnrollmentError,
+  MfaChallengeError,
+  PasskeyRegisterError,
+  PasskeyChallengeError,
+  PasskeyGetTokenError
+};

package/index.d.ts

@@ -0,0 +1,39 @@
+// Type stub for @auth0/auth0-auth-js — permissive shapes for the symbols the
+// @auth0/auth0-spa-js typings reference. MFA/Passkey are not used in this app.
+
+export declare class AuthClient {
+  constructor(options?: unknown);
+  mfa: any;
+  passkey: any;
+}
+
+export declare class MfaClient {}
+export declare class PasskeyClient {}
+
+export declare class MfaListAuthenticatorsError extends Error {
+  code?: string;
+}
+export declare class MfaEnrollmentError extends Error {
+  code?: string;
+}
+export declare class MfaChallengeError extends Error {
+  code?: string;
+}
+export declare class PasskeyRegisterError extends Error {
+  code?: string;
+}
+export declare class PasskeyChallengeError extends Error {
+  code?: string;
+}
+export declare class PasskeyGetTokenError extends Error {
+  code?: string;
+}
+
+export type MfaApiErrorResponse = any;
+export type PasskeyCreationOptions = any;
+export type PasskeyCredentialResponse = any;
+export type PasskeyLoginChallengeOptions = any;
+export type PasskeyLoginChallengeResponse = any;
+export type PasskeyRequestOptions = any;
+export type PasskeySignupChallengeOptions = any;
+export type PasskeySignupChallengeResponse = any;

package/index.js

@@ -0,0 +1,76 @@
+// Featherweight stub of @auth0/auth0-auth-js (ESM).
+//
+// This app does not use Auth0 MFA or Passkey flows. The real package pulls in
+// openid-client + oauth4webapi + jose (~26KB gzip of first-paint weight). It is
+// swapped for this stub via pnpm overrides so that weight never ships.
+//
+// The forked @auth0/auth0-spa-js build (external: ['@auth0/auth0-auth-js'])
+// statically imports exactly these symbols; this stub satisfies them at runtime.
+// `new AuthClient()` runs on every Auth0Client construction, so it must not throw
+// — only the (unused) MFA/Passkey method calls do.
+
+const notSupported = feature => () => {
+  throw new Error(
+    `@auth0/auth0-auth-js is stubbed in this app; "${feature}" is unavailable. ` +
+      `Remove the pnpm override for @auth0/auth0-auth-js (and the spa-js fork) to restore it.`
+  );
+};
+
+const throwingClient = label =>
+  new Proxy(
+    {},
+    { get: (_t, prop) => notSupported(`${label}.${String(prop)}`) }
+  );
+
+export class AuthClient {
+  constructor(_options) {
+    this.mfa = throwingClient('mfa');
+    this.passkey = throwingClient('passkey');
+  }
+}
+
+export class MfaClient {}
+
+class StubError extends Error {
+  constructor(code, message) {
+    super(message ?? code);
+    this.code = code;
+  }
+}
+
+export class MfaListAuthenticatorsError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'MfaListAuthenticatorsError';
+  }
+}
+export class MfaEnrollmentError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'MfaEnrollmentError';
+  }
+}
+export class MfaChallengeError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'MfaChallengeError';
+  }
+}
+export class PasskeyRegisterError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'PasskeyRegisterError';
+  }
+}
+export class PasskeyChallengeError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'PasskeyChallengeError';
+  }
+}
+export class PasskeyGetTokenError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'PasskeyGetTokenError';
+  }
+}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@versini/auth0-auth-js-stub",
+  "version": "1.0.0",
+  "description": "Featherweight no-op stub of @auth0/auth0-auth-js for apps that use only basic Auth0 login (no MFA/Passkey/MyAccount/DPoP). Consumed via a pnpm `npm:` alias override to drop ~26KB gzip (openid-client + oauth4webapi + jose) from first paint. See @versini/auth0-thin.",
+  "type": "module",
+  "main": "./index.cjs",
+  "module": "./index.js",
+  "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "import": "./index.js",
+      "require": "./index.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js",
+    "index.cjs",
+    "index.d.ts"
+  ],
+  "sideEffects": false,
+  "keywords": [
+    "auth0",
+    "auth0-auth-js",
+    "stub",
+    "bundle-size",
+    "tree-shaking"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/versini-org/auth0-thin.git",
+    "directory": "packages/auth0-auth-js-stub"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  }
+}