@ankhorage/auth-supabase 0.0.0-stage → 2.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fabio Gartenmann
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,23 @@
-# Temporary Holding Version
+<!-- markdownlint-disable MD013 MD033 -->
+<!-- This file is generated by Paradox. Do not edit manually. -->
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# SUPABASE AUTH
+
+![license: MIT](./paradox/badges/license.svg) ![npm: v2.0.0](./paradox/badges/npm.svg) ![runtime: bun](./paradox/badges/runtime.svg) ![typescript: strict](./paradox/badges/typescript.svg) ![eslint: checked](./paradox/badges/eslint.svg) ![prettier: checked](./paradox/badges/prettier.svg) ![build: checked](./paradox/badges/build.svg) ![tests: checked](./paradox/badges/tests.svg) ![paradox: warnings](./paradox/badges/docs.svg)
+
+Supabase adapter implementing the provider-neutral Ankhorage auth port.
+
+## Generated documentation
+
+- [Interactive documentation app](./paradox/index.html)
+- [Public API reference](./paradox/exports.md)
+- [Component registry](./paradox/components.md)
+- [Architecture overview](./paradox/diagrams/architecture-overview.mmd)
+- [Module relationships](./paradox/diagrams/module-relationships.mmd)
+- [Export graph](./paradox/diagrams/export-graph.mmd)
+- [createSupabaseOAuthProfileVerifier sequence](./paradox/diagrams/sequences/create-supabase-oauth-profile-verifier.mmd)
+- [getSupabaseOAuthProviderDefinition sequence](./paradox/diagrams/sequences/get-supabase-oauth-provider-definition.mmd)
+- [materializeSupabaseOAuthEnvironment sequence](./paradox/diagrams/sequences/materialize-supabase-oauth-environment.mmd)
+- [normalizeSupabaseAuthProfileVerificationConfig sequence](./paradox/diagrams/sequences/normalize-supabase-auth-profile-verification-config.mmd)
+- [resolveSupabaseOAuthSetupPlan sequence](./paradox/diagrams/sequences/resolve-supabase-oauth-setup-plan.mmd)
+- [validateSupabaseOAuthSecretPayload sequence](./paradox/diagrams/sequences/validate-supabase-oauth-secret-payload.mmd)

package/dist/authConfiguration.d.ts

@@ -0,0 +1,15 @@
+import { type SupabaseOAuthProviderId } from './oauthProviderDefinitions.js';
+import type { SupabaseAuthConfig, SupabaseAuthFetch, SupabaseAuthProfileVerificationConfig, SupabaseAuthRandomBytes, SupabaseAuthStorage, SupabaseOAuthLifecycleObserver } from './types.js';
+export interface RequiredSupabaseAuthConfig {
+    readonly url: string;
+    readonly anonKey: string;
+    readonly fetch: SupabaseAuthFetch;
+    readonly storage?: SupabaseAuthStorage;
+    readonly storageKey: string;
+    readonly oauthProviders: SupabaseOAuthProviderId[];
+    readonly oauthRandomBytes?: SupabaseAuthRandomBytes;
+    readonly profileVerification?: SupabaseAuthProfileVerificationConfig;
+    readonly onOAuthLifecycleEvent?: SupabaseOAuthLifecycleObserver;
+}
+export declare function validateSupabaseAuthConfig(config: SupabaseAuthConfig): RequiredSupabaseAuthConfig;
+//# sourceMappingURL=authConfiguration.d.ts.map

package/dist/authConfiguration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authConfiguration.d.ts","sourceRoot":"","sources":["../src/authConfiguration.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EACjB,qCAAqC,EACrC,uBAAuB,EACvB,mBAAmB,EACnB,8BAA8B,EAC/B,MAAM,YAAY,CAAC;AAIpB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,uBAAuB,EAAE,CAAC;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IACpD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,qCAAqC,CAAC;IACrE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC;CACjE;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,0BAA0B,CAwBjG"}

package/dist/authConfiguration.js

@@ -0,0 +1,69 @@
+import { isSupabaseOAuthProviderId, } from './oauthProviderDefinitions.js';
+import { normalizeSupabaseAuthProfileVerificationConfig } from './profileVerification.js';
+const DEFAULT_STORAGE_KEY = 'ankhorage.supabase-auth.session';
+export function validateSupabaseAuthConfig(config) {
+    const url = normalizeUrl(config.url);
+    const anonKey = config.anonKey.trim();
+    if (anonKey.length === 0)
+        throw new TypeError('Supabase anon key is required.');
+    const oauthProviders = normalizeOAuthProviders(config);
+    validateOAuthConfiguration(config, oauthProviders);
+    const configuredStorageKey = config.storageKey?.trim();
+    return {
+        url,
+        anonKey,
+        fetch: requireFetch(config.fetch),
+        storage: config.storage,
+        storageKey: configuredStorageKey === undefined || configuredStorageKey.length === 0
+            ? DEFAULT_STORAGE_KEY
+            : configuredStorageKey,
+        oauthProviders,
+        oauthRandomBytes: config.oauthRandomBytes,
+        profileVerification: config.profileVerification === undefined
+            ? undefined
+            : normalizeSupabaseAuthProfileVerificationConfig(config.profileVerification),
+        onOAuthLifecycleEvent: config.onOAuthLifecycleEvent,
+    };
+}
+function normalizeUrl(rawUrl) {
+    const url = rawUrl.trim();
+    if (url.length === 0)
+        throw new TypeError('Supabase Auth URL is required.');
+    try {
+        new URL(url);
+    }
+    catch {
+        throw new TypeError('Supabase Auth URL must be a valid URL.');
+    }
+    return url.replace(/\/+$/u, '');
+}
+function normalizeOAuthProviders(config) {
+    const providers = [];
+    for (const rawProvider of config.oauthProviders ?? []) {
+        const provider = rawProvider.trim();
+        if (!isSupabaseOAuthProviderId(provider)) {
+            throw new TypeError(`Supabase OAuth provider "${provider}" is not supported.`);
+        }
+        if (!providers.includes(provider))
+            providers.push(provider);
+    }
+    return providers;
+}
+function validateOAuthConfiguration(config, providers) {
+    if (providers.length > 0 && config.storage === undefined) {
+        throw new TypeError('Supabase OAuth PKCE requires persistent auth storage.');
+    }
+    if (config.profileVerification !== undefined && providers.length === 0) {
+        throw new TypeError('Supabase OAuth profile verification requires an OAuth provider.');
+    }
+}
+function requireFetch(fetchImplementation = createDefaultFetch()) {
+    if (typeof fetchImplementation !== 'function') {
+        throw new TypeError('A fetch implementation is required to use Supabase Auth.');
+    }
+    return fetchImplementation;
+}
+function createDefaultFetch() {
+    return (input, init) => globalThis.fetch(input, init);
+}
+//# sourceMappingURL=authConfiguration.js.map

package/dist/authConfiguration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authConfiguration.js","sourceRoot":"","sources":["../src/authConfiguration.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,GAE1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,8CAA8C,EAAE,MAAM,0BAA0B,CAAC;AAU1F,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAc9D,MAAM,UAAU,0BAA0B,CAAC,MAA0B;IACnE,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACvD,0BAA0B,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,oBAAoB,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACvD,OAAO;QACL,GAAG;QACH,OAAO;QACP,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EACR,oBAAoB,KAAK,SAAS,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC;YACrE,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,oBAAoB;QAC1B,cAAc;QACd,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,mBAAmB,EACjB,MAAM,CAAC,mBAAmB,KAAK,SAAS;YACtC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,8CAA8C,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChF,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA0B;IACzD,MAAM,SAAS,GAA8B,EAAE,CAAC;IAChD,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAwB,WAAW,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,SAAS,CAAC,4BAA4B,QAAQ,qBAAqB,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CACjC,MAA0B,EAC1B,SAA6C;IAE7C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,mBAAmB,GAAG,kBAAkB,EAAE;IAC9D,IAAI,OAAO,mBAAmB,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,0DAA0D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC","sourcesContent":["import type { AuthOAuthProviderId } from '@ankhorage/contracts/auth';\n\nimport {\n  isSupabaseOAuthProviderId,\n  type SupabaseOAuthProviderId,\n} from './oauthProviderDefinitions.js';\nimport { normalizeSupabaseAuthProfileVerificationConfig } from './profileVerification.js';\nimport type {\n  SupabaseAuthConfig,\n  SupabaseAuthFetch,\n  SupabaseAuthProfileVerificationConfig,\n  SupabaseAuthRandomBytes,\n  SupabaseAuthStorage,\n  SupabaseOAuthLifecycleObserver,\n} from './types.js';\n\nconst DEFAULT_STORAGE_KEY = 'ankhorage.supabase-auth.session';\n\nexport interface RequiredSupabaseAuthConfig {\n  readonly url: string;\n  readonly anonKey: string;\n  readonly fetch: SupabaseAuthFetch;\n  readonly storage?: SupabaseAuthStorage;\n  readonly storageKey: string;\n  readonly oauthProviders: SupabaseOAuthProviderId[];\n  readonly oauthRandomBytes?: SupabaseAuthRandomBytes;\n  readonly profileVerification?: SupabaseAuthProfileVerificationConfig;\n  readonly onOAuthLifecycleEvent?: SupabaseOAuthLifecycleObserver;\n}\n\nexport function validateSupabaseAuthConfig(config: SupabaseAuthConfig): RequiredSupabaseAuthConfig {\n  const url = normalizeUrl(config.url);\n  const anonKey = config.anonKey.trim();\n  if (anonKey.length === 0) throw new TypeError('Supabase anon key is required.');\n  const oauthProviders = normalizeOAuthProviders(config);\n  validateOAuthConfiguration(config, oauthProviders);\n  const configuredStorageKey = config.storageKey?.trim();\n  return {\n    url,\n    anonKey,\n    fetch: requireFetch(config.fetch),\n    storage: config.storage,\n    storageKey:\n      configuredStorageKey === undefined || configuredStorageKey.length === 0\n        ? DEFAULT_STORAGE_KEY\n        : configuredStorageKey,\n    oauthProviders,\n    oauthRandomBytes: config.oauthRandomBytes,\n    profileVerification:\n      config.profileVerification === undefined\n        ? undefined\n        : normalizeSupabaseAuthProfileVerificationConfig(config.profileVerification),\n    onOAuthLifecycleEvent: config.onOAuthLifecycleEvent,\n  };\n}\n\nfunction normalizeUrl(rawUrl: string): string {\n  const url = rawUrl.trim();\n  if (url.length === 0) throw new TypeError('Supabase Auth URL is required.');\n  try {\n    new URL(url);\n  } catch {\n    throw new TypeError('Supabase Auth URL must be a valid URL.');\n  }\n  return url.replace(/\\/+$/u, '');\n}\n\nfunction normalizeOAuthProviders(config: SupabaseAuthConfig): SupabaseOAuthProviderId[] {\n  const providers: SupabaseOAuthProviderId[] = [];\n  for (const rawProvider of config.oauthProviders ?? []) {\n    const provider: AuthOAuthProviderId = rawProvider.trim();\n    if (!isSupabaseOAuthProviderId(provider)) {\n      throw new TypeError(`Supabase OAuth provider \"${provider}\" is not supported.`);\n    }\n    if (!providers.includes(provider)) providers.push(provider);\n  }\n  return providers;\n}\n\nfunction validateOAuthConfiguration(\n  config: SupabaseAuthConfig,\n  providers: readonly SupabaseOAuthProviderId[],\n): void {\n  if (providers.length > 0 && config.storage === undefined) {\n    throw new TypeError('Supabase OAuth PKCE requires persistent auth storage.');\n  }\n  if (config.profileVerification !== undefined && providers.length === 0) {\n    throw new TypeError('Supabase OAuth profile verification requires an OAuth provider.');\n  }\n}\n\nfunction requireFetch(fetchImplementation = createDefaultFetch()): SupabaseAuthFetch {\n  if (typeof fetchImplementation !== 'function') {\n    throw new TypeError('A fetch implementation is required to use Supabase Auth.');\n  }\n  return fetchImplementation;\n}\n\nfunction createDefaultFetch(): SupabaseAuthFetch {\n  return (input, init) => globalThis.fetch(input, init);\n}\n"]}

package/dist/authPasswordOperations.d.ts

@@ -0,0 +1,10 @@
+import type { AuthPort } from '@ankhorage/auth';
+import type { AuthOperationContext } from './authSessionContext.js';
+/*** Create the Supabase sign-in implementation for the neutral authentication port. */
+export declare function createSignInOperation(context: AuthOperationContext): AuthPort['signIn'];
+/*** Create the Supabase sign-up implementation for the neutral authentication port. */
+export declare function createSignUpOperation(context: AuthOperationContext): AuthPort['signUp'];
+export declare function createPasswordResetOperation(context: AuthOperationContext): AuthPort['requestPasswordReset'];
+/*** Create the Supabase OTP verification implementation for the neutral authentication port. */
+export declare function createVerifyOtpOperation(context: AuthOperationContext): AuthPort['verifyOtp'];
+//# sourceMappingURL=authPasswordOperations.d.ts.map

package/dist/authPasswordOperations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authPasswordOperations.d.ts","sourceRoot":"","sources":["../src/authPasswordOperations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAWhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAIpE,uFAAuF;AACvF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,oBAAoB,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAavF;AAED,uFAAuF;AACvF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,oBAAoB,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAcvF;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,oBAAoB,GAC5B,QAAQ,CAAC,sBAAsB,CAAC,CAelC;AAED,gGAAgG;AAChG,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,GAAG,QAAQ,CAAC,WAAW,CAAC,CAc7F"}

package/dist/authPasswordOperations.js

@@ -0,0 +1,163 @@
+import { createAuthError, mapNetworkError, mapSupabaseError, readResponseBody } from './errors.js';
+import { normalizeSupabaseSession, normalizeSupabaseUser } from './session.js';
+/*** Create the Supabase sign-in implementation for the neutral authentication port. */
+export function createSignInOperation(context) {
+    return async (input) => {
+        const credentials = passwordCredentials(input.identifier, input.password);
+        if (!credentials.ok)
+            return credentials;
+        try {
+            const response = await context.request('token?grant_type=password', {
+                body: credentials.data,
+            });
+            return await context.handleSessionResponse(response);
+        }
+        catch (error) {
+            return { ok: false, error: mapNetworkError(error) };
+        }
+    };
+}
+/*** Create the Supabase sign-up implementation for the neutral authentication port. */
+export function createSignUpOperation(context) {
+    return async (input) => {
+        const credentials = passwordCredentials(input.identifier, input.password);
+        if (!credentials.ok)
+            return credentials;
+        try {
+            const response = await context.request('signup', {
+                body: { ...credentials.data, ...metadataBody(input.profile, input.metadata) },
+                redirectTo: input.redirectTo,
+            });
+            return await handleSignUpResponse(context, response);
+        }
+        catch (error) {
+            return { ok: false, error: mapNetworkError(error) };
+        }
+    };
+}
+export function createPasswordResetOperation(context) {
+    return async (input) => {
+        const email = passwordResetEmail(input);
+        if (!email.ok)
+            return email;
+        try {
+            const response = await context.request('recover', {
+                body: { email: email.data },
+                redirectTo: input.redirectTo,
+            });
+            if (response.ok)
+                return { ok: true };
+            return { ok: false, error: mapSupabaseError(response, await readResponseBody(response)) };
+        }
+        catch (error) {
+            return { ok: false, error: mapNetworkError(error) };
+        }
+    };
+}
+/*** Create the Supabase OTP verification implementation for the neutral authentication port. */
+export function createVerifyOtpOperation(context) {
+    return async (input) => {
+        const body = otpBody(input);
+        if (!body.ok)
+            return body;
+        try {
+            const response = await context.request('verify', {
+                body: body.data,
+                redirectTo: input.redirectTo,
+            });
+            return await context.handleSessionResponse(response);
+        }
+        catch (error) {
+            return { ok: false, error: mapNetworkError(error) };
+        }
+    };
+}
+async function handleSignUpResponse(context, response) {
+    const body = await readResponseBody(response);
+    if (!response.ok)
+        return { ok: false, error: mapSupabaseError(response, body) };
+    const session = normalizeSupabaseSession(body);
+    if (session !== null) {
+        const error = await context.persistSessionSafely(session);
+        return error === null ? { ok: true, data: session } : { ok: false, error };
+    }
+    const user = normalizeSupabaseUser(isRecord(body) && 'user' in body ? body.user : body);
+    return user === null
+        ? {
+            ok: false,
+            error: createAuthError('provider_error', 'Supabase returned an invalid sign-up.', body),
+        }
+        : { ok: true, data: user };
+}
+function passwordCredentials(identifier, password) {
+    const passwordError = validatePassword(password);
+    if (passwordError !== null)
+        return { ok: false, error: passwordError };
+    const body = identifierBody(identifier);
+    return body.ok ? { ok: true, data: { ...body.data, password } } : body;
+}
+function passwordResetEmail(input) {
+    if (input.identifier.kind !== 'email') {
+        return {
+            ok: false,
+            error: createAuthError('unsupported_identifier', 'Password reset supports email only.'),
+        };
+    }
+    const value = input.identifier.value.trim();
+    return value.length === 0
+        ? {
+            ok: false,
+            error: createAuthError('missing_identifier', 'An auth identifier is required.'),
+        }
+        : { ok: true, data: value };
+}
+function otpBody(input) {
+    const token = input.token.trim();
+    if (token.length === 0) {
+        return {
+            ok: false,
+            error: createAuthError('validation_error', 'An OTP token is required.'),
+        };
+    }
+    const identifier = identifierBody(input.identifier);
+    return identifier.ok
+        ? {
+            ok: true,
+            data: {
+                ...identifier.data,
+                token,
+                type: input.identifier.kind === 'phone' ? 'sms' : 'email',
+            },
+        }
+        : identifier;
+}
+function validatePassword(password) {
+    return password === undefined || password.length === 0
+        ? createAuthError('missing_password', 'A password is required.')
+        : null;
+}
+function identifierBody(identifier) {
+    const value = identifier.value.trim();
+    if (value.length === 0) {
+        return {
+            ok: false,
+            error: createAuthError('missing_identifier', 'An auth identifier is required.'),
+        };
+    }
+    if (identifier.kind === 'email')
+        return { ok: true, data: { email: value } };
+    if (identifier.kind === 'phone')
+        return { ok: true, data: { phone: value } };
+    return {
+        ok: false,
+        error: createAuthError('unsupported_identifier', 'Supabase supports email and phone.'),
+    };
+}
+function metadataBody(profile, metadata) {
+    const data = { ...(profile ?? {}), ...(metadata ?? {}) };
+    return Object.keys(data).length > 0 ? { data } : {};
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=authPasswordOperations.js.map

package/dist/authPasswordOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authPasswordOperations.js","sourceRoot":"","sources":["../src/authPasswordOperations.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE/E,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,OAA6B;IACjE,OAAO,KAAK,EAAE,KAAkB,EAAoC,EAAE;QACpE,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW,CAAC,EAAE;YAAE,OAAO,WAAW,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE;gBAClE,IAAI,EAAE,WAAW,CAAC,IAAI;aACvB,CAAC,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,OAA6B;IACjE,OAAO,KAAK,EAAE,KAAkB,EAA+C,EAAE;QAC/E,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW,CAAC,EAAE;YAAE,OAAO,WAAW,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAC/C,IAAI,EAAE,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;gBAC7E,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;YACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAA6B;IAE7B,OAAO,KAAK,EAAE,KAAyB,EAAuB,EAAE;QAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE;gBAChD,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;gBAC3B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,wBAAwB,CAAC,OAA6B;IACpE,OAAO,KAAK,EAAE,KAAqB,EAAoC,EAAE;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAA6B,EAC7B,QAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;IAChF,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,IAAI,KAAK,IAAI;QAClB,CAAC,CAAC;YACE,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,eAAe,CAAC,gBAAgB,EAAE,uCAAuC,EAAE,IAAI,CAAC;SACxF;QACH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAqC,EAAE,QAA4B;IAC9F,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAChF,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClF,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAyB;IACnD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE,eAAe,CAAC,wBAAwB,EAAE,qCAAqC,CAAC;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC;YACE,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE,eAAe,CAAC,oBAAoB,EAAE,iCAAiC,CAAC;SAChF;QACH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,OAAO,CAAC,KAAqB;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE,eAAe,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,EAAE;QAClB,CAAC,CAAC;YACE,EAAE,EAAE,IAAa;YACjB,IAAI,EAAE;gBACJ,GAAG,UAAU,CAAC,IAAI;gBAClB,KAAK;gBACL,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;aAC1D;SACF;QACH,CAAC,CAAC,UAAU,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QACpD,CAAC,CAAC,eAAe,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;QAChE,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CAAC,UAAqC;IAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE,eAAe,CAAC,oBAAoB,EAAE,iCAAiC,CAAC;SAChF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;IACtF,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;IACtF,OAAO;QACL,EAAE,EAAE,KAAc;QAClB,KAAK,EAAE,eAAe,CAAC,wBAAwB,EAAE,oCAAoC,CAAC;KACvF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,OAA4C,EAC5C,QAA6C;IAE7C,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["import type { AuthPort } from '@ankhorage/auth';\nimport type {\n  AuthResult,\n  AuthSession,\n  AuthUser,\n  PasswordResetInput,\n  SignInInput,\n  SignUpInput,\n  VerifyOtpInput,\n} from '@ankhorage/contracts/auth';\n\nimport type { AuthOperationContext } from './authSessionContext.js';\nimport { createAuthError, mapNetworkError, mapSupabaseError, readResponseBody } from './errors.js';\nimport { normalizeSupabaseSession, normalizeSupabaseUser } from './session.js';\n\n/*** Create the Supabase sign-in implementation for the neutral authentication port. */\nexport function createSignInOperation(context: AuthOperationContext): AuthPort['signIn'] {\n  return async (input: SignInInput): Promise<AuthResult<AuthSession>> => {\n    const credentials = passwordCredentials(input.identifier, input.password);\n    if (!credentials.ok) return credentials;\n    try {\n      const response = await context.request('token?grant_type=password', {\n        body: credentials.data,\n      });\n      return await context.handleSessionResponse(response);\n    } catch (error) {\n      return { ok: false, error: mapNetworkError(error) };\n    }\n  };\n}\n\n/*** Create the Supabase sign-up implementation for the neutral authentication port. */\nexport function createSignUpOperation(context: AuthOperationContext): AuthPort['signUp'] {\n  return async (input: SignUpInput): Promise<AuthResult<AuthSession | AuthUser>> => {\n    const credentials = passwordCredentials(input.identifier, input.password);\n    if (!credentials.ok) return credentials;\n    try {\n      const response = await context.request('signup', {\n        body: { ...credentials.data, ...metadataBody(input.profile, input.metadata) },\n        redirectTo: input.redirectTo,\n      });\n      return await handleSignUpResponse(context, response);\n    } catch (error) {\n      return { ok: false, error: mapNetworkError(error) };\n    }\n  };\n}\n\nexport function createPasswordResetOperation(\n  context: AuthOperationContext,\n): AuthPort['requestPasswordReset'] {\n  return async (input: PasswordResetInput): Promise<AuthResult> => {\n    const email = passwordResetEmail(input);\n    if (!email.ok) return email;\n    try {\n      const response = await context.request('recover', {\n        body: { email: email.data },\n        redirectTo: input.redirectTo,\n      });\n      if (response.ok) return { ok: true };\n      return { ok: false, error: mapSupabaseError(response, await readResponseBody(response)) };\n    } catch (error) {\n      return { ok: false, error: mapNetworkError(error) };\n    }\n  };\n}\n\n/*** Create the Supabase OTP verification implementation for the neutral authentication port. */\nexport function createVerifyOtpOperation(context: AuthOperationContext): AuthPort['verifyOtp'] {\n  return async (input: VerifyOtpInput): Promise<AuthResult<AuthSession>> => {\n    const body = otpBody(input);\n    if (!body.ok) return body;\n    try {\n      const response = await context.request('verify', {\n        body: body.data,\n        redirectTo: input.redirectTo,\n      });\n      return await context.handleSessionResponse(response);\n    } catch (error) {\n      return { ok: false, error: mapNetworkError(error) };\n    }\n  };\n}\n\nasync function handleSignUpResponse(\n  context: AuthOperationContext,\n  response: Response,\n): Promise<AuthResult<AuthSession | AuthUser>> {\n  const body = await readResponseBody(response);\n  if (!response.ok) return { ok: false, error: mapSupabaseError(response, body) };\n  const session = normalizeSupabaseSession(body);\n  if (session !== null) {\n    const error = await context.persistSessionSafely(session);\n    return error === null ? { ok: true, data: session } : { ok: false, error };\n  }\n  const user = normalizeSupabaseUser(isRecord(body) && 'user' in body ? body.user : body);\n  return user === null\n    ? {\n        ok: false,\n        error: createAuthError('provider_error', 'Supabase returned an invalid sign-up.', body),\n      }\n    : { ok: true, data: user };\n}\n\nfunction passwordCredentials(identifier: SignInInput['identifier'], password: string | undefined) {\n  const passwordError = validatePassword(password);\n  if (passwordError !== null) return { ok: false as const, error: passwordError };\n  const body = identifierBody(identifier);\n  return body.ok ? { ok: true as const, data: { ...body.data, password } } : body;\n}\n\nfunction passwordResetEmail(input: PasswordResetInput) {\n  if (input.identifier.kind !== 'email') {\n    return {\n      ok: false as const,\n      error: createAuthError('unsupported_identifier', 'Password reset supports email only.'),\n    };\n  }\n  const value = input.identifier.value.trim();\n  return value.length === 0\n    ? {\n        ok: false as const,\n        error: createAuthError('missing_identifier', 'An auth identifier is required.'),\n      }\n    : { ok: true as const, data: value };\n}\n\nfunction otpBody(input: VerifyOtpInput) {\n  const token = input.token.trim();\n  if (token.length === 0) {\n    return {\n      ok: false as const,\n      error: createAuthError('validation_error', 'An OTP token is required.'),\n    };\n  }\n  const identifier = identifierBody(input.identifier);\n  return identifier.ok\n    ? {\n        ok: true as const,\n        data: {\n          ...identifier.data,\n          token,\n          type: input.identifier.kind === 'phone' ? 'sms' : 'email',\n        },\n      }\n    : identifier;\n}\n\nfunction validatePassword(password: string | undefined) {\n  return password === undefined || password.length === 0\n    ? createAuthError('missing_password', 'A password is required.')\n    : null;\n}\n\nfunction identifierBody(identifier: SignInInput['identifier']) {\n  const value = identifier.value.trim();\n  if (value.length === 0) {\n    return {\n      ok: false as const,\n      error: createAuthError('missing_identifier', 'An auth identifier is required.'),\n    };\n  }\n  if (identifier.kind === 'email') return { ok: true as const, data: { email: value } };\n  if (identifier.kind === 'phone') return { ok: true as const, data: { phone: value } };\n  return {\n    ok: false as const,\n    error: createAuthError('unsupported_identifier', 'Supabase supports email and phone.'),\n  };\n}\n\nfunction metadataBody(\n  profile: Record<string, unknown> | undefined,\n  metadata: Record<string, unknown> | undefined,\n): { readonly data?: Record<string, unknown> } {\n  const data = { ...(profile ?? {}), ...(metadata ?? {}) };\n  return Object.keys(data).length > 0 ? { data } : {};\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n"]}

package/dist/authSessionContext.d.ts

@@ -0,0 +1,19 @@
+import type { AuthAdapterError, AuthResult, AuthSession } from '@ankhorage/contracts/auth';
+import type { RequiredSupabaseAuthConfig } from './authConfiguration.js';
+export interface AuthOperationContext {
+    readonly config: RequiredSupabaseAuthConfig;
+    readonly handleSessionResponse: (response: Response, options?: {
+        readonly clearExpiredSession?: boolean;
+    }) => Promise<AuthResult<AuthSession>>;
+    readonly persistSessionSafely: (session: AuthSession | null) => Promise<AuthAdapterError | null>;
+    readonly readStoredSession: () => Promise<AuthSession | null>;
+    readonly request: (path: string, options?: AuthRequestOptions) => Promise<Response>;
+}
+interface AuthRequestOptions {
+    readonly body?: Record<string, unknown>;
+    readonly accessToken?: string;
+    readonly redirectTo?: string;
+}
+export declare function createAuthOperationContext(config: RequiredSupabaseAuthConfig): AuthOperationContext;
+export {};
+//# sourceMappingURL=authSessionContext.d.ts.map

package/dist/authSessionContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSessionContext.d.ts","sourceRoot":"","sources":["../src/authSessionContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE3F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAIzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,qBAAqB,EAAE,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,KACjD,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACtC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACjG,QAAQ,CAAC,iBAAiB,EAAE,MAAM,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrF;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,0BAA0B,GACjC,oBAAoB,CA8BtB"}

package/dist/authSessionContext.js

@@ -0,0 +1,96 @@
+import { createAuthError, mapSupabaseError, readResponseBody } from './errors.js';
+import { isAuthSessionExpired, normalizeSupabaseSession, parseStoredSession } from './session.js';
+export function createAuthOperationContext(config) {
+    let currentSession = null;
+    let sessionLoaded = false;
+    const persistSession = async (session) => {
+        if (config.storage !== undefined) {
+            if (session === null)
+                await config.storage.removeItem(config.storageKey);
+            else
+                await config.storage.setItem(config.storageKey, JSON.stringify(session));
+        }
+        currentSession = session;
+        sessionLoaded = true;
+    };
+    const persistSessionSafely = createSafeSessionPersistence(persistSession);
+    const readStoredSession = async () => {
+        if (sessionLoaded)
+            return currentSession;
+        sessionLoaded = true;
+        if (config.storage === undefined)
+            return null;
+        currentSession = parseStoredSession(await config.storage.getItem(config.storageKey));
+        if (!isAuthSessionExpired(currentSession))
+            return currentSession;
+        currentSession = null;
+        await config.storage.removeItem(config.storageKey);
+        return null;
+    };
+    const request = createAuthRequest(config);
+    return {
+        config,
+        request,
+        persistSessionSafely,
+        readStoredSession,
+        handleSessionResponse: createSessionResponseHandler(persistSessionSafely),
+    };
+}
+function createAuthRequest(config) {
+    return async (path, options = {}) => {
+        const url = new URL(`${config.url}/auth/v1/${path}`);
+        if (options.redirectTo !== undefined)
+            url.searchParams.set('redirect_to', options.redirectTo);
+        return config.fetch(url.toString(), {
+            method: 'POST',
+            headers: createHeaders(config.anonKey, options.accessToken),
+            body: options.body === undefined ? undefined : JSON.stringify(options.body),
+        });
+    };
+}
+function createSafeSessionPersistence(persistSession) {
+    return async (session) => {
+        try {
+            await persistSession(session);
+            return null;
+        }
+        catch {
+            return createAuthError('session_persistence_failed', session === null
+                ? 'The persisted auth session could not be cleared.'
+                : 'The auth session could not be persisted.');
+        }
+    };
+}
+function createSessionResponseHandler(persistSessionSafely) {
+    return async (response, options = {}) => {
+        const body = await readResponseBody(response);
+        if (!response.ok) {
+            const error = mapSupabaseError(response, body);
+            if (options.clearExpiredSession === true && error.code === 'session_expired') {
+                const persistenceError = await persistSessionSafely(null);
+                if (persistenceError !== null)
+                    return { ok: false, error: persistenceError };
+            }
+            return { ok: false, error };
+        }
+        const session = normalizeSupabaseSession(body);
+        if (session === null) {
+            return {
+                ok: false,
+                error: createAuthError('provider_error', 'Supabase returned an invalid session.', body),
+            };
+        }
+        const persistenceError = await persistSessionSafely(session);
+        return persistenceError === null
+            ? { ok: true, data: session }
+            : { ok: false, error: persistenceError };
+    };
+}
+function createHeaders(anonKey, accessToken) {
+    return {
+        apikey: anonKey,
+        'Content-Type': 'application/json',
+        ...(accessToken === undefined ? {} : { Authorization: `Bearer ${accessToken}` }),
+    };
+}
+//# sourceMappingURL=authSessionContext.js.map

package/dist/authSessionContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSessionContext.js","sourceRoot":"","sources":["../src/authSessionContext.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAmBlG,MAAM,UAAU,0BAA0B,CACxC,MAAkC;IAElC,IAAI,cAAc,GAAuB,IAAI,CAAC;IAC9C,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,MAAM,cAAc,GAAG,KAAK,EAAE,OAA2B,EAAiB,EAAE;QAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,OAAO,KAAK,IAAI;gBAAE,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;;gBACpE,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,cAAc,GAAG,OAAO,CAAC;QACzB,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC,CAAC;IACF,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,cAAc,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,KAAK,IAAiC,EAAE;QAChE,IAAI,aAAa;YAAE,OAAO,cAAc,CAAC;QACzC,aAAa,GAAG,IAAI,CAAC;QACrB,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC9C,cAAc,GAAG,kBAAkB,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC;YAAE,OAAO,cAAc,CAAC;QACjE,cAAc,GAAG,IAAI,CAAC;QACtB,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,MAAM;QACN,OAAO;QACP,oBAAoB;QACpB,iBAAiB;QACjB,qBAAqB,EAAE,4BAA4B,CAAC,oBAAoB,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAkC;IAC3D,OAAO,KAAK,EAAE,IAAY,EAAE,UAA8B,EAAE,EAAqB,EAAE;QACjF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,YAAY,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9F,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC;YAC3D,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,cAA8D;IAE9D,OAAO,KAAK,EAAE,OAA2B,EAAoC,EAAE;QAC7E,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,eAAe,CACpB,4BAA4B,EAC5B,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,kDAAkD;gBACpD,CAAC,CAAC,0CAA0C,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,oBAAkE;IAElE,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,mBAAmB,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAC7E,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,gBAAgB,KAAK,IAAI;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YAC/E,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,eAAe,CAAC,gBAAgB,EAAE,uCAAuC,EAAE,IAAI,CAAC;aACxF,CAAC;QACJ,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,gBAAgB,KAAK,IAAI;YAC9B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;YAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,WAAoB;IAC1D,OAAO;QACL,MAAM,EAAE,OAAO;QACf,cAAc,EAAE,kBAAkB;QAClC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC;KACjF,CAAC;AACJ,CAAC","sourcesContent":["import type { AuthAdapterError, AuthResult, AuthSession } from '@ankhorage/contracts/auth';\n\nimport type { RequiredSupabaseAuthConfig } from './authConfiguration.js';\nimport { createAuthError, mapSupabaseError, readResponseBody } from './errors.js';\nimport { isAuthSessionExpired, normalizeSupabaseSession, parseStoredSession } from './session.js';\n\nexport interface AuthOperationContext {\n  readonly config: RequiredSupabaseAuthConfig;\n  readonly handleSessionResponse: (\n    response: Response,\n    options?: { readonly clearExpiredSession?: boolean },\n  ) => Promise<AuthResult<AuthSession>>;\n  readonly persistSessionSafely: (session: AuthSession | null) => Promise<AuthAdapterError | null>;\n  readonly readStoredSession: () => Promise<AuthSession | null>;\n  readonly request: (path: string, options?: AuthRequestOptions) => Promise<Response>;\n}\n\ninterface AuthRequestOptions {\n  readonly body?: Record<string, unknown>;\n  readonly accessToken?: string;\n  readonly redirectTo?: string;\n}\n\nexport function createAuthOperationContext(\n  config: RequiredSupabaseAuthConfig,\n): AuthOperationContext {\n  let currentSession: AuthSession | null = null;\n  let sessionLoaded = false;\n  const persistSession = async (session: AuthSession | null): Promise<void> => {\n    if (config.storage !== undefined) {\n      if (session === null) await config.storage.removeItem(config.storageKey);\n      else await config.storage.setItem(config.storageKey, JSON.stringify(session));\n    }\n    currentSession = session;\n    sessionLoaded = true;\n  };\n  const persistSessionSafely = createSafeSessionPersistence(persistSession);\n  const readStoredSession = async (): Promise<AuthSession | null> => {\n    if (sessionLoaded) return currentSession;\n    sessionLoaded = true;\n    if (config.storage === undefined) return null;\n    currentSession = parseStoredSession(await config.storage.getItem(config.storageKey));\n    if (!isAuthSessionExpired(currentSession)) return currentSession;\n    currentSession = null;\n    await config.storage.removeItem(config.storageKey);\n    return null;\n  };\n  const request = createAuthRequest(config);\n  return {\n    config,\n    request,\n    persistSessionSafely,\n    readStoredSession,\n    handleSessionResponse: createSessionResponseHandler(persistSessionSafely),\n  };\n}\n\nfunction createAuthRequest(config: RequiredSupabaseAuthConfig) {\n  return async (path: string, options: AuthRequestOptions = {}): Promise<Response> => {\n    const url = new URL(`${config.url}/auth/v1/${path}`);\n    if (options.redirectTo !== undefined) url.searchParams.set('redirect_to', options.redirectTo);\n    return config.fetch(url.toString(), {\n      method: 'POST',\n      headers: createHeaders(config.anonKey, options.accessToken),\n      body: options.body === undefined ? undefined : JSON.stringify(options.body),\n    });\n  };\n}\n\nfunction createSafeSessionPersistence(\n  persistSession: (session: AuthSession | null) => Promise<void>,\n) {\n  return async (session: AuthSession | null): Promise<AuthAdapterError | null> => {\n    try {\n      await persistSession(session);\n      return null;\n    } catch {\n      return createAuthError(\n        'session_persistence_failed',\n        session === null\n          ? 'The persisted auth session could not be cleared.'\n          : 'The auth session could not be persisted.',\n      );\n    }\n  };\n}\n\nfunction createSessionResponseHandler(\n  persistSessionSafely: AuthOperationContext['persistSessionSafely'],\n): AuthOperationContext['handleSessionResponse'] {\n  return async (response, options = {}) => {\n    const body = await readResponseBody(response);\n    if (!response.ok) {\n      const error = mapSupabaseError(response, body);\n      if (options.clearExpiredSession === true && error.code === 'session_expired') {\n        const persistenceError = await persistSessionSafely(null);\n        if (persistenceError !== null) return { ok: false, error: persistenceError };\n      }\n      return { ok: false, error };\n    }\n    const session = normalizeSupabaseSession(body);\n    if (session === null) {\n      return {\n        ok: false,\n        error: createAuthError('provider_error', 'Supabase returned an invalid session.', body),\n      };\n    }\n    const persistenceError = await persistSessionSafely(session);\n    return persistenceError === null\n      ? { ok: true, data: session }\n      : { ok: false, error: persistenceError };\n  };\n}\n\nfunction createHeaders(anonKey: string, accessToken?: string): Record<string, string> {\n  return {\n    apikey: anonKey,\n    'Content-Type': 'application/json',\n    ...(accessToken === undefined ? {} : { Authorization: `Bearer ${accessToken}` }),\n  };\n}\n"]}

package/dist/authSessionOperations.d.ts

@@ -0,0 +1,7 @@
+import type { AuthPort } from '@ankhorage/auth';
+import type { AuthOperationContext } from './authSessionContext.js';
+/*** Create the Supabase sign-out implementation for the neutral authentication port. */
+export declare function createSignOutOperation(context: AuthOperationContext): AuthPort['signOut'];
+export declare function createGetSessionOperation(context: AuthOperationContext): AuthPort['getSession'];
+export declare function createRefreshSessionOperation(context: AuthOperationContext): AuthPort['refreshSession'];
+//# sourceMappingURL=authSessionOperations.d.ts.map

package/dist/authSessionOperations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSessionOperations.d.ts","sourceRoot":"","sources":["../src/authSessionOperations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAGpE,wFAAwF;AACxF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,GAAG,QAAQ,CAAC,SAAS,CAAC,CAOzF;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,oBAAoB,GAAG,QAAQ,CAAC,YAAY,CAAC,CAc/F;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,oBAAoB,GAC5B,QAAQ,CAAC,gBAAgB,CAAC,CAmB5B"}

package/dist/authSessionOperations.js

@@ -0,0 +1,79 @@
+import { createAuthError, mapNetworkError, mapSupabaseError, readResponseBody } from './errors.js';
+/*** Create the Supabase sign-out implementation for the neutral authentication port. */
+export function createSignOutOperation(context) {
+    return async (input) => {
+        const providerError = await signOutProvider(context, input?.allDevices === true);
+        const persistenceError = await context.persistSessionSafely(null);
+        if (persistenceError !== null)
+            return { ok: false, error: persistenceError };
+        return providerError === null ? { ok: true } : { ok: false, error: providerError };
+    };
+}
+export function createGetSessionOperation(context) {
+    return async () => {
+        try {
+            return { ok: true, data: await context.readStoredSession() };
+        }
+        catch {
+            return {
+                ok: false,
+                error: createAuthError('session_persistence_failed', 'The persisted auth session could not be read.'),
+            };
+        }
+    };
+}
+export function createRefreshSessionOperation(context) {
+    return async () => {
+        const session = await readRefreshSession(context);
+        if (!session.ok)
+            return session;
+        if (session.data?.refreshToken === undefined) {
+            return {
+                ok: false,
+                error: createAuthError('missing_refresh_token', 'No refresh token is available.'),
+            };
+        }
+        try {
+            const response = await context.request('token?grant_type=refresh_token', {
+                body: { refresh_token: session.data.refreshToken },
+            });
+            return await context.handleSessionResponse(response, { clearExpiredSession: true });
+        }
+        catch (error) {
+            return { ok: false, error: mapNetworkError(error) };
+        }
+    };
+}
+async function signOutProvider(context, allDevices) {
+    let session;
+    try {
+        session = await context.readStoredSession();
+    }
+    catch {
+        return createAuthError('session_persistence_failed', 'The persisted auth session could not be read before sign-out.');
+    }
+    if (session?.accessToken === undefined)
+        return null;
+    try {
+        const response = await context.request('logout', {
+            accessToken: session.accessToken,
+            body: allDevices ? { scope: 'global' } : undefined,
+        });
+        return response.ok ? null : mapSupabaseError(response, await readResponseBody(response));
+    }
+    catch (error) {
+        return mapNetworkError(error);
+    }
+}
+async function readRefreshSession(context) {
+    try {
+        return { ok: true, data: await context.readStoredSession() };
+    }
+    catch {
+        return {
+            ok: false,
+            error: createAuthError('session_persistence_failed', 'The persisted auth session could not be read for refresh.'),
+        };
+    }
+}
+//# sourceMappingURL=authSessionOperations.js.map

package/dist/authSessionOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSessionOperations.js","sourceRoot":"","sources":["../src/authSessionOperations.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEnG,wFAAwF;AACxF,MAAM,UAAU,sBAAsB,CAAC,OAA6B;IAClE,OAAO,KAAK,EAAE,KAAK,EAAuB,EAAE;QAC1C,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC;QACjF,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,gBAAgB,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QAC7E,OAAO,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IACrF,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAA6B;IACrE,OAAO,KAAK,IAA6C,EAAE;QACzD,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,eAAe,CACpB,4BAA4B,EAC5B,+CAA+C,CAChD;aACF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAA6B;IAE7B,OAAO,KAAK,IAA6C,EAAE;QACzD,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC;QAChC,IAAI,OAAO,CAAC,IAAI,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,eAAe,CAAC,uBAAuB,EAAE,gCAAgC,CAAC;aAClF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,gCAAgC,EAAE;gBACvE,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE;aACnD,CAAC,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,qBAAqB,CAAC,QAAQ,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAA6B,EAC7B,UAAmB;IAEnB,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CACpB,4BAA4B,EAC5B,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC/C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SACnD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAA6B;IAE7B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,eAAe,CACpB,4BAA4B,EAC5B,2DAA2D,CAC5D;SACF,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type { AuthPort } from '@ankhorage/auth';\nimport type { AuthAdapterError, AuthResult, AuthSession } from '@ankhorage/contracts/auth';\n\nimport type { AuthOperationContext } from './authSessionContext.js';\nimport { createAuthError, mapNetworkError, mapSupabaseError, readResponseBody } from './errors.js';\n\n/*** Create the Supabase sign-out implementation for the neutral authentication port. */\nexport function createSignOutOperation(context: AuthOperationContext): AuthPort['signOut'] {\n  return async (input): Promise<AuthResult> => {\n    const providerError = await signOutProvider(context, input?.allDevices === true);\n    const persistenceError = await context.persistSessionSafely(null);\n    if (persistenceError !== null) return { ok: false, error: persistenceError };\n    return providerError === null ? { ok: true } : { ok: false, error: providerError };\n  };\n}\n\nexport function createGetSessionOperation(context: AuthOperationContext): AuthPort['getSession'] {\n  return async (): Promise<AuthResult<AuthSession | null>> => {\n    try {\n      return { ok: true, data: await context.readStoredSession() };\n    } catch {\n      return {\n        ok: false,\n        error: createAuthError(\n          'session_persistence_failed',\n          'The persisted auth session could not be read.',\n        ),\n      };\n    }\n  };\n}\n\nexport function createRefreshSessionOperation(\n  context: AuthOperationContext,\n): AuthPort['refreshSession'] {\n  return async (): Promise<AuthResult<AuthSession | null>> => {\n    const session = await readRefreshSession(context);\n    if (!session.ok) return session;\n    if (session.data?.refreshToken === undefined) {\n      return {\n        ok: false,\n        error: createAuthError('missing_refresh_token', 'No refresh token is available.'),\n      };\n    }\n    try {\n      const response = await context.request('token?grant_type=refresh_token', {\n        body: { refresh_token: session.data.refreshToken },\n      });\n      return await context.handleSessionResponse(response, { clearExpiredSession: true });\n    } catch (error) {\n      return { ok: false, error: mapNetworkError(error) };\n    }\n  };\n}\n\nasync function signOutProvider(\n  context: AuthOperationContext,\n  allDevices: boolean,\n): Promise<AuthAdapterError | null> {\n  let session: AuthSession | null;\n  try {\n    session = await context.readStoredSession();\n  } catch {\n    return createAuthError(\n      'session_persistence_failed',\n      'The persisted auth session could not be read before sign-out.',\n    );\n  }\n  if (session?.accessToken === undefined) return null;\n  try {\n    const response = await context.request('logout', {\n      accessToken: session.accessToken,\n      body: allDevices ? { scope: 'global' } : undefined,\n    });\n    return response.ok ? null : mapSupabaseError(response, await readResponseBody(response));\n  } catch (error) {\n    return mapNetworkError(error);\n  }\n}\n\nasync function readRefreshSession(\n  context: AuthOperationContext,\n): Promise<AuthResult<AuthSession | null>> {\n  try {\n    return { ok: true, data: await context.readStoredSession() };\n  } catch {\n    return {\n      ok: false,\n      error: createAuthError(\n        'session_persistence_failed',\n        'The persisted auth session could not be read for refresh.',\n      ),\n    };\n  }\n}\n"]}

package/dist/createSupabaseAuthAdapter.d.ts

@@ -0,0 +1,5 @@
+import type { AuthPort } from '@ankhorage/auth';
+import type { SupabaseAuthConfig } from './types.js';
+/*** Create a Supabase implementation of the provider-neutral authentication port. */
+export declare function createSupabaseAuthAdapter(config: SupabaseAuthConfig): AuthPort;
+//# sourceMappingURL=createSupabaseAuthAdapter.d.ts.map

package/dist/createSupabaseAuthAdapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createSupabaseAuthAdapter.d.ts","sourceRoot":"","sources":["../src/createSupabaseAuthAdapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAsBhD,OAAO,KAAK,EAAE,kBAAkB,EAAgC,MAAM,YAAY,CAAC;AAEnF,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,kBAAkB,GAAG,QAAQ,CAe9E"}