# @versini/auth0-auth-js-stub

> Featherweight no-op stub of @auth0/auth0-auth-js for apps that use only basic Auth0 login (no MFA/Passkey/anonymous sessions/MyAccount/DPoP). Consumed via a pnpm `npm:` alias override to drop ~26KB gzip (openid-client + oauth4webapi + jose) from first pai

Latest version **1.1.0** (published 2026-09-24) · MIT license · 0 weekly downloads

## Install

```sh
npm install @versini/auth0-auth-js-stub
pnpm add @versini/auth0-auth-js-stub
yarn add @versini/auth0-auth-js-stub
bun add @versini/auth0-auth-js-stub
```

## Health

**Score 65/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; recently updated; high maintenance score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 1.1.0 |
| Published | 2026-09-24 |
| First published | 2026-06-25 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 0 |
| Unpacked size | 10.8 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Maintainers | aversini |
| Keywords | auth0, auth0-auth-js, stub, bundle-size, tree-shaking |

## Links

- npm: https://www.npmjs.com/package/@versini/auth0-auth-js-stub
- Repository: https://github.com/versini-org/auth0-thin
- Homepage: https://github.com/versini-org/auth0-thin#readme
- Issues: https://github.com/versini-org/auth0-thin/issues
- npm.io page: https://npm.io/package/@versini/auth0-auth-js-stub

## Alternatives

- [pagerjs](https://npm.io/package/pagerjs.md) — 60 weekly downloads
- [whistle.savefor-mock](https://npm.io/package/whistle.savefor-mock.md) — 4 weekly downloads
- [@loutre-run/core](https://npm.io/package/@loutre-run/core.md) — 0 weekly downloads
- [@crvouga/mockingbird-service-prism](https://npm.io/package/@crvouga/mockingbird-service-prism.md) — 0 weekly downloads
- [@crvouga/mockingbird-service-otel](https://npm.io/package/@crvouga/mockingbird-service-otel.md) — 0 weekly downloads

## Recent versions

- 1.1.0 (latest) — 2026-09-24
- 1.0.0 — 2026-06-25

## README

# @versini/auth0-auth-js-stub

A featherweight, no-op stub of [`@auth0/auth0-auth-js`](https://www.npmjs.com/package/@auth0/auth0-auth-js).

The real package pulls in `openid-client` + `oauth4webapi` + `jose` (~26 KB gzip of
first-paint weight) and powers only the **MFA / Passkey / MyAccount / DPoP** APIs. If
your app uses only basic Auth0 login (`loginWithRedirect`, `getAccessTokenSilently`,
`logout`, `isAuthenticated`, `user`), that weight is dead code.

This stub satisfies the symbols `@auth0/auth0-spa-js` imports or re-exports at runtime.
`AuthClient` constructs without throwing (it runs on every login). Any MFA, Passkey, or
anonymous-session method call throws a clear, actionable error, and `isFederatedDomain`
returns a promise that rejects with one.

> ⚠️ Do not set `createAnonymousSessionOnFailedSilentAuth` with this stub. spa-js 2.27
> calls the anonymous client from `checkSession` when that option is on and swallows the
> stub's error in a `try/catch`, so the fallback silently does nothing.

## Usage

Don't depend on this directly. It is installed in place of `@auth0/auth0-auth-js` via a
pnpm `npm:` alias override, together with the slimmed `@auth0/auth0-react` and
`@auth0/auth0-spa-js` forks. See **[@versini/auth0-thin](https://www.npmjs.com/package/@versini/auth0-thin)**
for the full setup and the CI verifier.

```yaml
# pnpm-workspace.yaml
overrides:
  "@auth0/auth0-react":   "npm:@versini/auth0-react-thin@<version>"
  "@auth0/auth0-spa-js":  "npm:@versini/auth0-spa-js-no-authjs@<version>"
  "@auth0/auth0-auth-js": "npm:@versini/auth0-auth-js-stub@<version>"
```

> ⚠️ Only safe if your app never uses Auth0 MFA, Passkey, MyAccount, or DPoP. Run
> `npx auth0-thin verify` in CI to enforce that the assumption still holds.

## License

MIT. This stub is original code; it contains no Auth0 source.

---
_Source: https://npm.io/package/@versini/auth0-auth-js-stub · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._