najm-auth 3.0.0 → 3.1.0

package/dist/NajmAuthClient-D2fSvQ_H.d.ts

@@ -1,283 +0,0 @@
-/**
- * User data from the auth server
- */
-interface AuthUser {
-    id: string;
-    email: string;
-    name?: string;
-    role?: string | null;
-    permissions?: string[];
-    [key: string]: unknown;
-}
-/**
- * Full auth state snapshot
- */
-interface AuthState {
-    user: AuthUser | null;
-    accessToken: string | null;
-    isAuthenticated: boolean;
-    isLoading: boolean;
-    roles: string[];
-    permissions: string[];
-}
-/**
- * Decoded JWT payload (client-side, no verification)
- */
-interface DecodedToken {
-    userId: string;
-    jti?: string;
-    sessionVersion?: number;
-    roles?: string[];
-    permissions?: string[];
-    exp?: number;
-    iat?: number;
-    [key: string]: unknown;
-}
-/**
- * Server response envelope
- */
-interface ServerResponse<T = unknown> {
-    data: T;
-    message?: string;
-    status?: string;
-}
-/**
- * Token pair from login/refresh (internal — refresh token is httpOnly cookie)
- */
-interface TokenPair {
-    accessToken: string;
-    refreshToken?: string;
-    accessTokenExpiresAt?: number;
-    refreshTokenExpiresAt?: number;
-}
-/**
- * Login credentials. `identifier` accepts an email address or a phone number;
- * `email` stays supported for existing callers.
- */
-interface LoginCredentials {
-    identifier?: string;
-    email?: string;
-    password: string;
-    /** Persist the auth cookies past the browser closing. */
-    rememberMe?: boolean;
-    [key: string]: unknown;
-}
-/** The account must replace its credential before it gets a session. */
-interface CredentialSetupPending {
-    nextStep: 'credential_setup';
-    setupRequired: true;
-    purpose: string;
-    expiresAt: string;
-}
-interface AuthenticatedLogin {
-    nextStep: 'authenticated';
-    user: AuthUser;
-}
-/**
- * Login answer. Branch on `nextStep`: `credential_setup` carries no tokens and
- * leaves the client unauthenticated.
- */
-type LoginResult = AuthenticatedLogin | CredentialSetupPending;
-/**
- * Retry configuration
- */
-interface RetryConfig {
-    maxRetries?: number;
-    backoff?: 'exponential' | 'linear';
-    baseDelay?: number;
-}
-/**
- * Auth client configuration
- */
-interface AuthClientConfig {
-    /** API base URL (e.g., '/api' or 'https://api.example.com') */
-    baseURL: string;
-    /** Auth endpoints prefix (default: '/auth') */
-    authPrefix?: string;
-    /** Proactive refresh at this fraction of token lifetime (default: 0.8) */
-    refreshThreshold?: number;
-    /** Enable multi-tab sync via BroadcastChannel (default: true) */
-    tabSync?: boolean;
-    /** BroadcastChannel name (default: 'najm-auth') */
-    channelName?: string;
-    /** Network retry configuration */
-    retry?: RetryConfig;
-    /** Request timeout in milliseconds (default: 30000) */
-    timeout?: number;
-}
-type OAuthProvider = 'google';
-interface OAuthLoginOptions {
-    /** Same-origin frontend path after OAuth completes. */
-    returnTo?: string;
-}
-/**
- * Auth event types
- */
-interface AuthEventMap {
-    login: AuthUser;
-    logout: null;
-    /** Emitted when server-side logout invalidation fails (state was already cleared) */
-    logoutError: unknown;
-    tokenRefresh: null;
-    sessionExpired: null;
-    stateChange: AuthState;
-    userUpdated: AuthUser;
-}
-type AuthEvent = keyof AuthEventMap;
-type AuthEventHandler<K extends AuthEvent = AuthEvent> = (data: AuthEventMap[K]) => void;
-/**
- * Tab sync message types
- */
-type TabSyncMessage = {
-    type: 'logout';
-} | {
-    type: 'sync';
-    state: SyncPayload;
-};
-interface SyncPayload {
-    accessToken: string | null;
-    user: AuthUser | null;
-    roles: string[];
-    permissions: string[];
-    isAuthenticated: boolean;
-}
-/**
- * FetchClient request options
- */
-interface RequestOptions {
-    body?: unknown;
-    headers?: Record<string, string>;
-    signal?: AbortSignal;
-    timeout?: number;
-    /** Skip auth header attachment (for public endpoints like /login, /register) */
-    skipAuth?: boolean;
-    /** @internal Prevents 401-refresh loop after a single retry */
-    _retried?: boolean;
-}
-/**
- * Auth error thrown by the client
- */
-declare class AuthError extends Error {
-    status: number;
-    body?: unknown;
-    constructor(status: number, message: string, body?: unknown);
-}
-
-interface FetchClientConfig {
-    baseURL: string;
-    credentials?: RequestCredentials;
-    timeout?: number;
-    getToken?: () => string | null;
-    onUnauthorized?: () => Promise<string | null>;
-    retry?: RetryConfig;
-    defaultHeaders?: Record<string, string>;
-}
-declare class FetchClient {
-    private config;
-    constructor(config: FetchClientConfig);
-    get<T>(path: string, opts?: RequestOptions): Promise<T>;
-    post<T>(path: string, opts?: RequestOptions): Promise<T>;
-    put<T>(path: string, opts?: RequestOptions): Promise<T>;
-    patch<T>(path: string, opts?: RequestOptions): Promise<T>;
-    delete<T>(path: string, opts?: RequestOptions): Promise<T>;
-    private request;
-    private execute;
-    private doFetch;
-    private parseBody;
-}
-
-interface HydrateSession {
-    user: AuthUser | null;
-    accessToken?: string | null;
-    roles?: string[];
-    permissions?: string[];
-}
-declare class NajmAuthClient {
-    private config;
-    private static readonly MAX_REFRESH_FAILURES;
-    private static readonly CIRCUIT_RESET_MS;
-    private state;
-    private refreshTimer;
-    private refreshCircuitTimer;
-    private refreshPromise;
-    private fetchUserPromise;
-    private refreshFailures;
-    private _hydrated;
-    private listeners;
-    private eventListeners;
-    private tabSync;
-    api: FetchClient;
-    private readonly prefix;
-    private readonly threshold;
-    constructor(config: AuthClientConfig);
-    login(credentials: LoginCredentials): Promise<LoginResult>;
-    register(data: Record<string, unknown>): Promise<AuthUser>;
-    getOAuthLoginUrl(provider: OAuthProvider, options?: OAuthLoginOptions): string;
-    loginWithOAuth(provider: OAuthProvider, options?: OAuthLoginOptions): void;
-    loginWithGoogle(options?: OAuthLoginOptions): void;
-    linkOAuthAccount(provider: OAuthProvider, options?: OAuthLoginOptions): Promise<void>;
-    completeOAuthLogin(): Promise<AuthUser>;
-    logout(): Promise<void>;
-    refresh(): Promise<void>;
-    fetchUser(): Promise<AuthUser | null>;
-    private _doFetchUser;
-    forgotPassword(data: {
-        email: string;
-    }): Promise<void>;
-    changePassword(data: {
-        currentPassword: string;
-        newPassword: string;
-    }): Promise<void>;
-    resetPassword(data: {
-        token: string;
-        newPassword: string;
-    }): Promise<void>;
-    can(permission: string): boolean;
-    hasRole(role: string): boolean;
-    hasAnyRole(roles: string[]): boolean;
-    hasPermission(permission: string): boolean;
-    getUser(): AuthUser | null;
-    getAccessToken(): string | null;
-    isAuthenticated(): boolean;
-    getState(): AuthState;
-    /**
-     * Hydrate the client with a session resolved server-side.
-     * Use to skip the initial loading flicker on SSR-rendered pages.
-     * Safe to call multiple times — subsequent calls are no-ops.
-     */
-    hydrate(session: HydrateSession | null): void;
-    isHydrated(): boolean;
-    /**
-     * A fresh client with the same config — unhydrated, and without tab sync.
-     *
-     * Server rendering needs one client per request. A single process serves
-     * every user, so the hydration latch on a shared client would otherwise pin
-     * every later render to the first request's session.
-     */
-    fork(): NajmAuthClient;
-    on<K extends AuthEvent>(event: K, handler: AuthEventHandler<K>): void;
-    off<K extends AuthEvent>(event: K, handler: AuthEventHandler<K>): void;
-    subscribe(listener: (state: AuthState) => void): () => void;
-    destroy(): void;
-    private _refreshWithCircuit;
-    private _doRefresh;
-    private handleUnauthorized;
-    private applyTokens;
-    private scheduleRefresh;
-    private clearRefreshTimer;
-    private clearRefreshCircuitTimer;
-    private resetRefreshFailures;
-    private registerRefreshFailure;
-    private resetState;
-    private getSyncPayload;
-    private handleTabMessage;
-    private notify;
-    private emit;
-    private validateReturnTo;
-}
-/**
- * Factory function to create an auth client.
- */
-declare function createAuthClient(config: AuthClientConfig): NajmAuthClient;
-
-export { type AuthClientConfig as A, type CredentialSetupPending as C, type DecodedToken as D, FetchClient as F, type HydrateSession as H, type LoginCredentials as L, NajmAuthClient as N, type OAuthLoginOptions as O, type RequestOptions as R, type SyncPayload as S, type TabSyncMessage as T, AuthError as a, type AuthEvent as b, type AuthEventHandler as c, type AuthEventMap as d, type AuthState as e, type AuthUser as f, type AuthenticatedLogin as g, type LoginResult as h, type OAuthProvider as i, type RetryConfig as j, type ServerResponse as k, type TokenPair as l, createAuthClient as m };