@aurabase/aurabase-js 0.3.0 → 0.4.0

package/packages/auth/dist/index.cjs

@@ -1,1175 +0,0 @@
-'use strict';
-
-var core = require('@aurabase/core');
-
-// src/AuthService.ts
-
-// src/SessionManager.ts
-var SessionManager = class {
-  opts;
-  _interval = null;
-  _channel = null;
-  _active = false;
-  _visHandler = null;
-  constructor(opts) {
-    this.opts = { tickMs: 3e4, ...opts };
-  }
-  get isActive() {
-    return this._active;
-  }
-  start() {
-    if (!this.opts.enabled) return;
-    if (typeof BroadcastChannel !== "undefined" && !this._channel) {
-      this._channel = new BroadcastChannel(this.opts.channelName);
-      this._channel.onmessage = (e) => this.opts.onRemoteMessage(e.data);
-    }
-    if (typeof document !== "undefined" && !this._visHandler) {
-      this._visHandler = () => {
-        if (document.hidden) {
-          this._stopInterval();
-        } else if (this._active) {
-          this._startInterval();
-          if (this.opts.isRefreshDue()) this.opts.onTick();
-        }
-      };
-      document.addEventListener("visibilitychange", this._visHandler);
-    }
-  }
-  setActive(active) {
-    this._active = active;
-    if (!this.opts.enabled) return;
-    const hidden = typeof document !== "undefined" && document.hidden;
-    if (active && !hidden) this._startInterval();
-    else this._stopInterval();
-  }
-  broadcast(data) {
-    this._channel?.postMessage(data);
-  }
-  stop() {
-    this._stopInterval();
-    this._active = false;
-    if (this._channel) {
-      try {
-        this._channel.close();
-      } catch {
-      }
-      this._channel = null;
-    }
-    if (this._visHandler && typeof document !== "undefined") {
-      document.removeEventListener("visibilitychange", this._visHandler);
-      this._visHandler = null;
-    }
-  }
-  _startInterval() {
-    if (this._interval) return;
-    this._interval = setInterval(() => {
-      if (this.opts.isRefreshDue()) this.opts.onTick();
-    }, this.opts.tickMs);
-    this._interval.unref?.();
-  }
-  _stopInterval() {
-    if (this._interval) {
-      clearInterval(this._interval);
-      this._interval = null;
-    }
-  }
-};
-
-// src/jwks.ts
-var MAX_AGE_CAP_MS = 864e5;
-var FORCED_REFETCH_COOLDOWN_MS = 3e4;
-var NEGATIVE_CACHE_TTL_MS = 1e4;
-var DEFAULT_MAX_AGE_MS = 6e5;
-var clientStates = /* @__PURE__ */ new WeakMap();
-function stateFor(scope) {
-  let s = clientStates.get(scope);
-  if (!s) {
-    s = {
-      cache: /* @__PURE__ */ new Map(),
-      inflight: /* @__PURE__ */ new Map(),
-      lastFailedAt: /* @__PURE__ */ new Map(),
-      lastForcedFetchAt: /* @__PURE__ */ new Map()
-    };
-    clientStates.set(scope, s);
-  }
-  return s;
-}
-function b64urlToBytes(s) {
-  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - s.length % 4) % 4);
-  const bin = atob(b64);
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
-  return out;
-}
-function decodeJwt(jwt) {
-  const [h, p, s] = jwt.split(".");
-  if (!h || !p || !s) throw new Error("malformed jwt");
-  const dec = new TextDecoder();
-  return {
-    header: JSON.parse(dec.decode(b64urlToBytes(h))),
-    payload: JSON.parse(dec.decode(b64urlToBytes(p))),
-    signingInput: `${h}.${p}`,
-    signature: b64urlToBytes(s)
-  };
-}
-function parseMaxAge(cc) {
-  const m = cc?.match(/max-age=(\d+)/);
-  return m ? Number(m[1]) * 1e3 : null;
-}
-function fetchJwksDeduped(state, fetchFn, baseUrl) {
-  const existing = state.inflight.get(baseUrl);
-  if (existing) return existing;
-  const p = (async () => {
-    try {
-      const res = await fetchFn(`${baseUrl}/.well-known/jwks.json`);
-      if (!res.ok) throw new Error("jwks_fetch_failed");
-      const body = await res.json();
-      const parsed = parseMaxAge(res.headers.get("Cache-Control")) ?? DEFAULT_MAX_AGE_MS;
-      const maxAge = Math.min(parsed, MAX_AGE_CAP_MS);
-      const keys = body.keys ?? [];
-      state.cache.set(baseUrl, { keys, fetchedAt: Date.now(), maxAgeMs: maxAge });
-      state.lastFailedAt.delete(baseUrl);
-      return keys;
-    } catch {
-      state.lastFailedAt.set(baseUrl, Date.now());
-      throw new Error("jwks_fetch_failed");
-    }
-  })().finally(() => state.inflight.delete(baseUrl));
-  state.inflight.set(baseUrl, p);
-  return p;
-}
-async function loadJwks(state, fetchFn, baseUrl) {
-  const now = Date.now();
-  const c = state.cache.get(baseUrl);
-  if (c && now - c.fetchedAt < c.maxAgeMs) return c.keys;
-  const failedAt = state.lastFailedAt.get(baseUrl);
-  if (failedAt !== void 0 && now - failedAt < NEGATIVE_CACHE_TTL_MS) {
-    throw new Error("jwks_fetch_failed");
-  }
-  return fetchJwksDeduped(state, fetchFn, baseUrl);
-}
-async function forcedRefetchJwks(state, fetchFn, baseUrl) {
-  const now = Date.now();
-  const last = state.lastForcedFetchAt.get(baseUrl);
-  if (last !== void 0 && now - last < FORCED_REFETCH_COOLDOWN_MS) return null;
-  state.lastForcedFetchAt.set(baseUrl, now);
-  const failedAt = state.lastFailedAt.get(baseUrl);
-  if (failedAt !== void 0 && now - failedAt < NEGATIVE_CACHE_TTL_MS) {
-    throw new Error("jwks_fetch_failed");
-  }
-  return fetchJwksDeduped(state, fetchFn, baseUrl);
-}
-function algParams(alg) {
-  if (alg === "RS256") {
-    return {
-      importAlg: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
-      verifyAlg: { name: "RSASSA-PKCS1-v1_5" }
-    };
-  }
-  if (alg === "ES256") {
-    return {
-      importAlg: { name: "ECDSA", namedCurve: "P-256" },
-      verifyAlg: { name: "ECDSA", hash: "SHA-256" }
-    };
-  }
-  return null;
-}
-async function verifyJwtLocal(scope, fetchFn, baseUrl, jwt, opts = {}) {
-  let d;
-  try {
-    d = decodeJwt(jwt);
-  } catch {
-    return { ok: false, code: "invalid_jwt" };
-  }
-  const params = algParams(d.header.alg);
-  if (!params) return { ok: false, code: "unsupported_alg" };
-  const state = stateFor(scope);
-  const matchesAlg = (k) => d.header.alg === "RS256" ? k.kty === "RSA" : k.kty === "EC";
-  const candidateKeys = (keys2) => d.header.kid ? keys2.filter((k) => k.kid === d.header.kid && matchesAlg(k)) : keys2.filter((k) => matchesAlg(k));
-  let keys;
-  try {
-    keys = await loadJwks(state, fetchFn, baseUrl);
-  } catch {
-    try {
-      opts.onEvent?.(baseUrl);
-    } catch {
-    }
-    return { ok: false, code: "jwks_fetch_failed" };
-  }
-  let candidates = candidateKeys(keys);
-  if (candidates.length === 0 && d.header.kid) {
-    let refetched;
-    try {
-      refetched = await forcedRefetchJwks(state, fetchFn, baseUrl);
-    } catch {
-      try {
-        opts.onEvent?.(baseUrl);
-      } catch {
-      }
-      return { ok: false, code: "jwks_fetch_failed" };
-    }
-    if (refetched) {
-      keys = refetched;
-      candidates = candidateKeys(keys);
-    }
-  }
-  if (candidates.length === 0) return { ok: false, code: "no_matching_key" };
-  const signingBytes = new TextEncoder().encode(d.signingInput);
-  let valid = false;
-  for (const jwk of candidates) {
-    try {
-      const key = await crypto.subtle.importKey("jwk", jwk, params.importAlg, false, ["verify"]);
-      if (await crypto.subtle.verify(
-        params.verifyAlg,
-        key,
-        d.signature,
-        signingBytes
-      )) {
-        valid = true;
-        break;
-      }
-    } catch {
-    }
-  }
-  if (!valid) return { ok: false, code: "signature_invalid" };
-  const now = Math.floor(Date.now() / 1e3);
-  if (!opts.allowExpired && typeof d.payload.exp === "number" && d.payload.exp < now) {
-    return { ok: false, code: "token_expired" };
-  }
-  if (typeof d.payload.nbf === "number" && d.payload.nbf > now + 60) {
-    return { ok: false, code: "token_not_yet_valid" };
-  }
-  return {
-    ok: true,
-    claims: d.payload,
-    header: {
-      alg: d.header.alg,
-      kid: d.header.kid,
-      typ: d.header.typ
-    }
-  };
-}
-
-// src/pkce.ts
-function b64url(bytes) {
-  let s = "";
-  for (const b of bytes) s += String.fromCharCode(b);
-  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function generateCodeVerifier() {
-  const bytes = new Uint8Array(64);
-  crypto.getRandomValues(bytes);
-  return b64url(bytes);
-}
-async function codeChallengeS256(verifier) {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  return b64url(new Uint8Array(digest));
-}
-
-// src/AuthService.ts
-function isMfaChallenge(v) {
-  return typeof v === "object" && v !== null && v.mfa_required === true;
-}
-var AuthService = class extends core.BaseService {
-  _stateListeners = /* @__PURE__ */ new Set();
-  _sessionManager;
-  _applyingRemote = false;
-  _unsubStore = null;
-  _disposed = false;
-  constructor(client, options) {
-    super(client);
-    const browser = typeof window !== "undefined";
-    const enabled = !!options?.forceEnabled || (options?.autoRefresh ?? true) && browser && (options?.persistSession ?? true);
-    this._sessionManager = new SessionManager({
-      channelName: `aura-${client.projectId}-auth`,
-      enabled,
-      onTick: () => {
-        void this.refreshSession();
-      },
-      isRefreshDue: () => {
-        const t = this.client.authStore.token;
-        return !!t && !!this.client.authStore.refreshToken && core.isTokenExpired(t, 60);
-      },
-      onRemoteMessage: (data) => this._applyRemoteState(data)
-    });
-    this._sessionManager.start();
-    this._unsubStore = this.client.authStore.onChange((token) => {
-      this._sessionManager.setActive(!!token);
-      if (!this._applyingRemote) {
-        const state = this._broadcastState();
-        if (!token || state !== null) {
-          this._sessionManager.broadcast(state);
-        }
-      }
-    });
-    if (this.client.authStore.token) this._sessionManager.setActive(true);
-    const detect = options?.detectSessionInUrl ?? browser;
-    if (detect && browser) {
-      void this._detectSessionInUrl();
-    }
-  }
-  /**
-   * Détecte et consomme une session présente dans l'URL courante au boot (callback
-   * OAuth), à l'image de `detectSessionInUrl` de supabase-js :
-   *  - fragment `#access_token=…&refresh_token=…` (flux implicit) → `setSession`.
-   *  - query `?token=…&type=recovery` (lien de récupération de mot de passe) → émet
-   *    `PASSWORD_RECOVERY` avec `recoveryToken` (AUCUNE session posée, PAS de `SIGNED_IN`).
-   *  - query `?code=…` (flux PKCE) → `exchangeCodeForSession` (relit le verifier).
-   * Puis nettoie l'URL via `history.replaceState` (retire tokens/code de la barre
-   * d'adresse et de l'historique). Idempotent, no-op si aucun token/code n'est
-   * présent, no-op hors navigateur. NE THROW JAMAIS (best-effort au boot).
-   */
-  async _detectSessionInUrl() {
-    if (typeof window === "undefined") return;
-    try {
-      const loc = window.location;
-      if (!loc) return;
-      const hash = typeof loc.hash === "string" ? loc.hash : "";
-      const search = typeof loc.search === "string" ? loc.search : "";
-      if (hash.includes("access_token")) {
-        const initiatedKey = this._oauthInitiatedKey;
-        const initiated = this.client.authStore.getItem(initiatedKey);
-        if (!initiated) return;
-        this.client.authStore.removeItem(initiatedKey);
-        const frag = new URLSearchParams(hash.replace(/^#/, ""));
-        const accessToken = frag.get("access_token");
-        const refreshToken = frag.get("refresh_token");
-        if (accessToken && refreshToken) {
-          await this.setSession(accessToken, refreshToken);
-          this._cleanAuthParamsFromUrl();
-        }
-        return;
-      }
-      {
-        const qs = new URLSearchParams(search.replace(/^\?/, ""));
-        const recoveryToken = qs.get("token");
-        if (qs.get("type") === "recovery" && recoveryToken) {
-          this._emitEvent("PASSWORD_RECOVERY", null, null, { recoveryToken });
-          this._cleanAuthParamsFromUrl();
-          return;
-        }
-      }
-      if (/[?&]code=/.test(search)) {
-        const qs = new URLSearchParams(search.replace(/^\?/, ""));
-        const code = qs.get("code");
-        if (code) {
-          await this.exchangeCodeForSession(code);
-          this._cleanAuthParamsFromUrl();
-        }
-        return;
-      }
-    } catch {
-    }
-  }
-  /**
-   * Retire de l'URL courante les paramètres d'auth du callback OAuth : le fragment
-   * entier (flux implicit) et les query params `code`/`state` (flux PKCE), tout en
-   * préservant les autres query params. Via `history.replaceState` (pas de nouvelle
-   * entrée d'historique). Best-effort, ne throw jamais.
-   */
-  _cleanAuthParamsFromUrl() {
-    try {
-      if (typeof window === "undefined") return;
-      const h = window.history;
-      const loc = window.location;
-      if (!h || typeof h.replaceState !== "function" || !loc) return;
-      const qs = new URLSearchParams(
-        typeof loc.search === "string" ? loc.search.replace(/^\?/, "") : ""
-      );
-      qs.delete("code");
-      qs.delete("state");
-      qs.delete("token");
-      qs.delete("project_id");
-      qs.delete("type");
-      const remaining = qs.toString();
-      const path = loc.pathname ?? "/";
-      const clean = path + (remaining ? `?${remaining}` : "");
-      h.replaceState(null, "", clean || "/");
-    } catch {
-    }
-  }
-  _broadcastState() {
-    const s = this.client.authStore;
-    if (!s.token || !s.refreshToken || !s.user || typeof s.user !== "object" || !("id" in s.user) || !s.user.id) {
-      return null;
-    }
-    return { token: s.token, refreshToken: s.refreshToken, user: s.user };
-  }
-  _applyRemoteState(data) {
-    if (data !== null) {
-      const d = data;
-      if (typeof d.token !== "string" || typeof d.refreshToken !== "string" || !d.user || typeof d.user !== "object") {
-        return;
-      }
-    }
-    this._applyingRemote = true;
-    try {
-      const store = this.client.authStore;
-      const prevToken = store.token;
-      if (!data) {
-        store.clear();
-        this._emitEvent("SIGNED_OUT", null, null);
-      } else {
-        const s = data;
-        store.save(s.token, s.refreshToken, s.user);
-        const event = !prevToken ? "SIGNED_IN" : s.token !== prevToken ? "TOKEN_REFRESHED" : "USER_UPDATED";
-        this._emitEvent(event, s.user, s.token);
-      }
-    } finally {
-      this._applyingRemote = false;
-    }
-  }
-  /** Démonte le cycle de vie proactif : ticker, visibilité, BroadcastChannel, listeners. */
-  dispose() {
-    if (this._disposed) return;
-    this._disposed = true;
-    this._sessionManager.stop();
-    this._unsubStore?.();
-    this._unsubStore = null;
-    this._stateListeners.clear();
-  }
-  get prefix() {
-    return `/v1/auth/${this.client.projectId}`;
-  }
-  /** Clé project-scoped du `code_verifier` PKCE (anti-collision multi-projets). */
-  get _pkceVerifierKey() {
-    return `aura-${this.client.projectId}-pkce-code-verifier`;
-  }
-  /**
-   * Clé project-scoped du MARQUEUR d'initiation du flux OAuth implicit (SEC-F3).
-   * Posé par `signInWithOAuth` (flux implicit) avant le redirect ; vérifié + purgé
-   * par `_detectSessionInUrl` au retour. Un fragment `#access_token` forgé/injecté
-   * par un attaquant (login-CSRF / session fixation) n'aura PAS ce marqueur → il ne
-   * sera jamais adopté.
-   */
-  get _oauthInitiatedKey() {
-    return `aura-${this.client.projectId}-oauth-implicit-initiated`;
-  }
-  // -- Auth state change ------------------------------------------------------
-  onAuthStateChange(callback) {
-    if (this._disposed) return { unsubscribe: () => {
-    } };
-    this._stateListeners.add(callback);
-    const store = this.client.authStore;
-    queueMicrotask(() => {
-      if (this._stateListeners.has(callback)) {
-        callback({ event: "INITIAL_SESSION", user: store.user, accessToken: store.token });
-      }
-    });
-    return {
-      unsubscribe: () => {
-        this._stateListeners.delete(callback);
-      }
-    };
-  }
-  _emitEvent(event, user, accessToken, extra) {
-    for (const cb of this._stateListeners) {
-      try {
-        cb({ event, user, accessToken, ...extra });
-      } catch {
-      }
-    }
-  }
-  // -- Sign up / sign in / sign out -------------------------------------------
-  async signUp(req) {
-    const res = await this.request("POST", `${this.prefix}/register`, req);
-    if (res.data && !isMfaChallenge(res.data)) {
-      const tp = res.data;
-      this.client.authStore.save(tp.access_token, tp.refresh_token, tp.user);
-      this._emitEvent("SIGNED_IN", tp.user, tp.access_token);
-    }
-    if (res.data && isMfaChallenge(res.data)) {
-      const mfa = res.data;
-      this._emitEvent("MFA_CHALLENGE", null, null, {
-        mfaToken: mfa.mfa_token,
-        mfaSetupRequired: mfa.mfa_setup_required
-      });
-    }
-    return res;
-  }
-  async signInWithPassword(req) {
-    const res = await this.request("POST", `${this.prefix}/login`, req);
-    if (res.data && !isMfaChallenge(res.data)) {
-      const tp = res.data;
-      this.client.authStore.save(tp.access_token, tp.refresh_token, tp.user);
-      this._emitEvent("SIGNED_IN", tp.user, tp.access_token);
-    }
-    if (res.data && isMfaChallenge(res.data)) {
-      const mfa = res.data;
-      this._emitEvent("MFA_CHALLENGE", null, null, {
-        mfaToken: mfa.mfa_token,
-        mfaSetupRequired: mfa.mfa_setup_required
-      });
-    }
-    return res;
-  }
-  async signInWithOAuth(provider, options) {
-    const params = new URLSearchParams();
-    params.set("project_id", this.client.projectId);
-    if (options?.redirectTo) params.set("redirect_uri", options.redirectTo);
-    if (options?.scopes) params.set("scopes", options.scopes);
-    if (options?.queryParams) {
-      for (const [k, v] of Object.entries(options.queryParams)) {
-        params.set(k, v);
-      }
-    }
-    if (options?.flowType === "pkce") {
-      if (typeof window !== "undefined" && !this.client.authStore.persistent) {
-        console.warn(
-          `[aurabase] PKCE (flowType:"pkce") requiert un store persistant (LocalAuthStore) pour que le code_verifier survive au redirect OAuth ; le store courant est en m\xE9moire \u2014 l'\xE9change \xE9chouera au retour.`
-        );
-      }
-      try {
-        const verifier = generateCodeVerifier();
-        const challenge = await codeChallengeS256(verifier);
-        this.client.authStore.setItem(this._pkceVerifierKey, verifier);
-        params.set("code_challenge", challenge);
-        params.set("code_challenge_method", "S256");
-      } catch {
-        return {
-          data: null,
-          error: new core.AuraError(0, {
-            error: {
-              code: "pkce_generation_failed",
-              message: "PKCE: g\xE9n\xE9ration du code_verifier/challenge impossible (WebCrypto indisponible)"
-            }
-          })
-        };
-      }
-    } else {
-      if (typeof window !== "undefined" && !this.client.authStore.persistent) {
-        console.warn(
-          '[aurabase] S\xC9CURIT\xC9 : signInWithOAuth en flux implicit avec un store NON persistant (m\xE9moire) \u2014 le marqueur anti session-fixation ne survivra pas au redirect OAuth et la session ne sera pas adopt\xE9e au retour. Utilisez un LocalAuthStore, et pr\xE9f\xE9rez flowType:"pkce" (recommand\xE9, immunis\xE9 contre la session fixation).'
-        );
-      }
-      try {
-        this.client.authStore.setItem(this._oauthInitiatedKey, "1");
-      } catch {
-      }
-    }
-    const url = `${this.client.baseUrl}/v1/auth/oauth/${encodeURIComponent(provider)}/start?${params.toString()}`;
-    if (typeof window !== "undefined") {
-      window.location.href = url;
-    }
-    return { data: { url }, error: null };
-  }
-  async signInWithMagicLink(req) {
-    return this.request("POST", `${this.prefix}/magic-link`, req);
-  }
-  async signInAnonymously() {
-    const res = await this.request("POST", `${this.prefix}/anonymous`);
-    if (res.data) {
-      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
-      this._emitEvent("SIGNED_IN", res.data.user, res.data.access_token);
-    }
-    return res;
-  }
-  async signOut() {
-    const refreshToken = this.client.authStore.refreshToken;
-    if (!refreshToken) {
-      this.client.authStore.clear();
-      this._emitEvent("SIGNED_OUT", null, null);
-      return { data: null, error: null };
-    }
-    const res = await this.request("POST", `${this.prefix}/logout`, {
-      refresh_token: refreshToken
-    }, { skipAuthRefresh: true });
-    this.client.authStore.clear();
-    this._emitEvent("SIGNED_OUT", null, null);
-    return res;
-  }
-  // -- Session management -----------------------------------------------------
-  async refreshSession() {
-    const res = await core.refreshOnce(this.client);
-    if (res.data) {
-      this._emitEvent("TOKEN_REFRESHED", res.data.user, res.data.access_token);
-    }
-    return res;
-  }
-  /**
-   * Session courante lue depuis le store (synchrone en pratique, pas d'appel réseau).
-   *
-   * ÉCART DE FORME AVEC SUPABASE (LOT 3, 3.5, documenté — pas de breaking change) :
-   * `supabase-js` renvoie `AuraResponse`-like `{data:{session: Session|null}, error}`
-   * où `Session` regroupe `access_token`/`refresh_token`/`expires_at`/`user`. Ici,
-   * `getSession()` renvoie directement `{accessToken, user}` (pas d'enveloppe
-   * `{data, error}`, pas de `refreshToken`/`expiresAt`). Ce choix est délibéré :
-   * cette méthode ne fait aucune requête réseau et ne peut donc jamais échouer
-   * (`error` serait toujours `null`) — l'envelopper aurait été un contrat menteur.
-   * Le `refreshToken` n'est pas exposé pour éviter qu'un consommateur le manipule
-   * hors du store (contrairement à `accessToken`, souvent nécessaire pour des appels
-   * `fetch` manuels côté app). Pour la session complète, lire `client.authStore`
-   * directement (`.token`, `.refreshToken`, `.user`, `.isValid`).
-   */
-  async getSession() {
-    return {
-      accessToken: this.client.authStore.token,
-      user: this.client.authStore.user
-    };
-  }
-  async setSession(accessToken, refreshToken) {
-    const store = this.client.authStore;
-    const prev = { token: store.token, refreshToken: store.refreshToken, user: store.user };
-    const hadValidPrev = !!(prev.token && prev.refreshToken && prev.user && prev.user.id);
-    const restore = () => {
-      if (hadValidPrev) {
-        store.save(prev.token, prev.refreshToken, prev.user);
-      } else {
-        store.clear();
-      }
-    };
-    if (core.isTokenExpired(accessToken, 0)) {
-      store.save(accessToken, refreshToken, {});
-      const refreshed = await core.refreshOnce(this.client);
-      if (refreshed.data) {
-        this._emitEvent("SIGNED_IN", refreshed.data.user, refreshed.data.access_token);
-        return { data: refreshed.data.user, error: null };
-      }
-      restore();
-      return { data: null, error: refreshed.error };
-    }
-    store.save(accessToken, refreshToken, {});
-    const res = await this.request("GET", `${this.prefix}/user`);
-    if (res.data) {
-      store.save(accessToken, refreshToken, res.data);
-      this._emitEvent("SIGNED_IN", res.data, accessToken);
-      return res;
-    }
-    restore();
-    return res;
-  }
-  async exchangeCodeForSession(authCode, codeVerifier) {
-    return this._exchangeCode(authCode, codeVerifier, "SIGNED_IN");
-  }
-  /**
-   * Cœur de l'échange PKCE. `successEvent` détermine l'événement émis en cas de
-   * succès : `SIGNED_IN` (connexion normale) ou `PASSWORD_RECOVERY` (callback de
-   * récupération de mot de passe, `?code=…&type=recovery` — voir `_detectSessionInUrl`).
-   */
-  async _exchangeCode(authCode, codeVerifier, successEvent) {
-    const verifierKey = this._pkceVerifierKey;
-    const verifier = codeVerifier ?? this.client.authStore.getItem(verifierKey);
-    if (!verifier) {
-      return {
-        data: null,
-        error: new core.AuraError(0, {
-          error: { code: "no_code_verifier", message: "No PKCE code_verifier available (not provided and none stored)" }
-        })
-      };
-    }
-    try {
-      const res = await this.request("POST", `${this.prefix}/oauth/pkce`, {
-        auth_code: authCode,
-        code_verifier: verifier
-      });
-      if (res.data) {
-        this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
-        this._emitEvent(successEvent, res.data.user, res.data.access_token);
-      }
-      return res;
-    } finally {
-      this.client.authStore.removeItem(verifierKey);
-    }
-  }
-  async listSessions() {
-    const store = this.client.authStore;
-    if (store.token && store.refreshToken && !store.isValid) {
-      const refreshed = await this.refreshSession();
-      if (refreshed.error) {
-        return { data: null, error: refreshed.error };
-      }
-    }
-    const refreshToken = store.refreshToken;
-    return this.request("GET", `${this.prefix}/sessions`, void 0, {
-      headers: refreshToken ? { "x-refresh-token": refreshToken } : void 0
-    });
-  }
-  async revokeSession(sessionId) {
-    return this.request("DELETE", `${this.prefix}/sessions/${sessionId}`);
-  }
-  async revokeAllSessions() {
-    const rt = this.client.authStore.refreshToken;
-    if (!rt) {
-      return {
-        data: null,
-        error: new core.AuraError(0, { error: { code: "no_session", message: "No refresh token available" } })
-      };
-    }
-    const res = await this.request(
-      "POST",
-      `${this.prefix}/logout`,
-      { refresh_token: rt, scope: "global" },
-      { skipAuthRefresh: true }
-    );
-    if (!res.error) {
-      this.client.authStore.clear();
-      this._emitEvent("SIGNED_OUT", null, null);
-    }
-    return res;
-  }
-  // -- User management --------------------------------------------------------
-  /**
-   * Récupère l'utilisateur validé côté serveur.
-   *
-   * Sans argument : valide le token de la SESSION courante (`store.token`),
-   * avec refresh proactif — comportement historique.
-   *
-   * Avec `jwt` (LOT D) : valide le token ARBITRAIRE passé, via l'override
-   * `authToken` (`Authorization: Bearer <jwt>`), SANS toucher la session
-   * (`skipAuthRefresh`, aucun refresh ni retry-401 sur le store). Le backend
-   * applique l'isolation projet native : un token d'un AUTRE projet → 403.
-   */
-  async getUser(jwt) {
-    if (jwt !== void 0) {
-      return this.request("GET", `${this.prefix}/user`, void 0, {
-        authToken: jwt,
-        skipAuthRefresh: true
-      });
-    }
-    return this.request("GET", `${this.prefix}/user`);
-  }
-  /**
-   * Vérifie et décode les claims d'un JWT.
-   *
-   * Chemin nominal : vérification LOCALE via JWKS + WebCrypto, uniquement pour
-   * `alg ∈ {RS256, ES256}` (anti-alg-confusion : jamais de vérif locale HS256).
-   * Chemin fallback : `getUser()` (validation serveur) quand la vérif locale
-   * n'est pas applicable — `alg` non supporté (HS256), JWKS vide, aucune clé
-   * correspondante, ou fetch JWKS en échec. C'est le chemin nominal sur les
-   * déploiements HS256 (JWKS `{"keys":[]}`).
-   *
-   * FOREIGN-TOKEN (LOT D) : le fallback getUser valide le token RÉELLEMENT visé.
-   * Pour le token de session (no-arg, ou `jwt === authStore.token`), c'est
-   * `getUser()` (validation du token du store). Pour un `jwt` ÉTRANGER, c'est
-   * `getUser(jwt)` qui présente CE token en `Authorization` (override `authToken`,
-   * jamais celui du store) : le backend le valide et renvoie SON identité. Aucune
-   * misattribution possible — on présente exactement le token à vérifier — et
-   * l'isolation projet est native côté gateway (token d'un autre projet → 403,
-   * remonté en AuraError, jamais fabriqué).
-   *
-   * NOTE (fallback) : les claims renvoyées par le chemin fallback sont dérivées
-   * de `getUser()` (identité validée serveur) et NE contiennent PAS `exp`/`iat`
-   * (ni les autres champs temporels du JWT) — un consommateur ne doit pas se
-   * fier à `claims.exp` / `claims.iat` après un fallback. Seul le chemin de
-   * vérification locale RS256/ES256 renvoie les claims JWT complètes.
-   */
-  async getClaims(jwt, options) {
-    const token = jwt ?? this.client.authStore.token;
-    const usingStoreToken = jwt === void 0 || jwt === this.client.authStore.token;
-    if (!token) {
-      return {
-        data: null,
-        error: new core.AuraError(0, { error: { code: "no_session", message: "No JWT available" } })
-      };
-    }
-    const r = await verifyJwtLocal(this.client, this.client.fetchFn, this.client.baseUrl, token, {
-      allowExpired: options?.allowExpired,
-      // LOT 3 (I8) : relie le callback générique de jwks.ts au hook d'observabilité
-      // du client (onEvent/debug). jwks.ts reste sans dépendance vers @aurabase/core.
-      onEvent: (baseUrl) => core.emitAuraEvent(this.client.onEvent, this.client.debug, { kind: "jwks-fetch-failed", baseUrl })
-    });
-    const checkIssAud = (c) => {
-      if (options?.issuer !== void 0 && c.iss !== options.issuer) {
-        return new core.AuraError(0, {
-          error: { code: "invalid_issuer", message: `getClaims: issuer mismatch` }
-        });
-      }
-      if (options?.audience !== void 0) {
-        const aud = c.aud;
-        const audList = Array.isArray(aud) ? aud : aud !== void 0 ? [aud] : [];
-        if (!audList.includes(options.audience)) {
-          return new core.AuraError(0, {
-            error: { code: "invalid_audience", message: `getClaims: audience mismatch` }
-          });
-        }
-      }
-      return null;
-    };
-    if (r.ok) {
-      const claims = r.claims;
-      const issAudErr = checkIssAud(claims);
-      if (issAudErr) return { data: null, error: issAudErr };
-      const claimProject = claims.project_id;
-      if (typeof claimProject === "string" && claimProject !== this.client.projectId) {
-        return {
-          data: null,
-          error: new core.AuraError(0, {
-            error: {
-              code: "project_isolation_violation",
-              message: `getClaims: token project mismatch (isolation)`
-            }
-          })
-        };
-      }
-      return { data: { claims, header: r.header }, error: null };
-    }
-    if (r.code === "unsupported_alg" || r.code === "no_matching_key" || r.code === "jwks_fetch_failed") {
-      let localPayload = {};
-      try {
-        localPayload = decodeJwt(token).payload;
-      } catch {
-      }
-      const issAudErr = checkIssAud(localPayload);
-      if (issAudErr) return { data: null, error: issAudErr };
-      if (options?.allowExpired && typeof localPayload.exp === "number" && localPayload.exp < Math.floor(Date.now() / 1e3)) {
-        return {
-          data: null,
-          error: new core.AuraError(0, {
-            error: {
-              code: "allow_expired_unsupported_on_fallback",
-              message: "getClaims: allowExpired ne peut pas \xEAtre honor\xE9 sur le chemin de validation serveur (fallback HS256/JWKS)"
-            }
-          })
-        };
-      }
-      const u = usingStoreToken ? await this.getUser() : await this.getUser(token);
-      if (u.data) {
-        let realAlg = "unknown";
-        try {
-          realAlg = decodeJwt(token).header.alg ?? "unknown";
-        } catch {
-        }
-        return {
-          data: {
-            // Claims dérivées de getUser : PAS de `exp`/`iat` (voir JwtClaims/JSDoc).
-            // `exp`/`iat` étant optionnels, plus de `as unknown as` masquant l'absence.
-            claims: { ...u.data, sub: u.data.id },
-            header: { alg: realAlg }
-          },
-          error: null
-        };
-      }
-      return { data: null, error: u.error };
-    }
-    return {
-      data: null,
-      error: new core.AuraError(0, { error: { code: r.code, message: `getClaims: ${r.code}` } })
-    };
-  }
-  async deleteUser(password) {
-    const res = await this.request("DELETE", `${this.prefix}/user`, { password });
-    if (!res.error) {
-      this.client.authStore.clear();
-      this._emitEvent("SIGNED_OUT", null, null);
-    }
-    return res;
-  }
-  async updateUser(req) {
-    const res = await this.request("PUT", `${this.prefix}/user`, req);
-    if (res.data) {
-      const store = this.client.authStore;
-      if (store.token && store.refreshToken) {
-        store.save(store.token, store.refreshToken, res.data);
-      }
-      this._emitEvent("USER_UPDATED", res.data, this.client.authStore.token);
-    }
-    return res;
-  }
-  // -- Password recovery ------------------------------------------------------
-  async resetPasswordForEmail(req) {
-    return this.request("POST", `${this.prefix}/forgot-password`, req);
-  }
-  async updatePassword(newPassword, currentPassword) {
-    const res = await this.request("PUT", `${this.prefix}/user`, {
-      password: newPassword,
-      current_password: currentPassword
-    });
-    if (!res.error) {
-      this.client.authStore.clear();
-      this._emitEvent("SIGNED_OUT", null, null);
-    }
-    return res;
-  }
-  // -- MFA --------------------------------------------------------------------
-  async mfaEnroll() {
-    return this.request("POST", `${this.prefix}/mfa/setup`);
-  }
-  async mfaVerifySetup(code) {
-    return this.request("POST", `${this.prefix}/mfa/setup/verify`, { code });
-  }
-  async mfaVerify(req) {
-    const res = await this.request("POST", `${this.prefix}/mfa/verify-login`, req);
-    if (res.data) {
-      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
-      this._emitEvent("SIGNED_IN", res.data.user, res.data.access_token);
-    }
-    return res;
-  }
-  async mfaUnenroll(password) {
-    return this.request("POST", `${this.prefix}/mfa/disable`, { password });
-  }
-  async verifyOtp(params) {
-    switch (params.type) {
-      case "signup":
-        return this._verifyToTokenPair(`${this.prefix}/verify-email`, { token: params.token });
-      case "magiclink":
-        return this._verifyToTokenPair(`${this.prefix}/magic-link/verify`, { token: params.token });
-      case "email":
-        return this._verifyToTokenPair(`${this.prefix}/email-otp/verify`, {
-          email: params.email,
-          code: params.token
-        });
-      case "sms":
-        return this._verifyToTokenPair(`${this.prefix}/sms/verify`, {
-          phone: params.phone,
-          code: params.token
-        });
-      case "recovery": {
-        if (!params.password) {
-          return {
-            data: null,
-            error: new core.AuraError(0, {
-              error: {
-                code: "missing_password",
-                message: "verifyOtp({ type: 'recovery' }) exige `password` : le backend fusionne consommation du token et changement de mot de passe."
-              }
-            })
-          };
-        }
-        return this._verifyToTokenPair(`${this.prefix}/reset-password`, {
-          token: params.token,
-          password: params.password
-        });
-      }
-      case "email_change": {
-        const res = await this.request("POST", `${this.prefix}/user/confirm-email-change`, {
-          token: params.token
-        });
-        if (res.data) {
-          const store = this.client.authStore;
-          if (store.token && store.refreshToken) {
-            store.save(store.token, store.refreshToken, res.data);
-          }
-          this._emitEvent("USER_UPDATED", res.data, this.client.authStore.token);
-        }
-        return res;
-      }
-      case "invite":
-      case "phone_change":
-        return {
-          data: null,
-          error: new core.AuraError(0, {
-            error: {
-              code: "otp_type_unsupported",
-              message: `verifyOtp: le type '${params.type}' n'est pas support\xE9 (aucun endpoint backend).`
-            }
-          })
-        };
-      default:
-        return {
-          data: null,
-          error: new core.AuraError(0, {
-            error: { code: "otp_type_unsupported", message: "verifyOtp: type OTP inconnu." }
-          })
-        };
-    }
-  }
-  /**
-   * Helper commun aux vérifications OTP renvoyant une `TokenPair` : appelle
-   * l'endpoint, puis (succès) sauvegarde la session et émet `SIGNED_IN`.
-   */
-  async _verifyToTokenPair(path, body) {
-    const res = await this.request("POST", path, body);
-    if (res.data) {
-      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
-      this._emitEvent("SIGNED_IN", res.data.user, res.data.access_token);
-    }
-    return res;
-  }
-  // -- Email verification -----------------------------------------------------
-  /** Rétrocompat : délègue à `verifyOtp({ type: 'signup' })` (POST /verify-email). */
-  async verifyEmail(token) {
-    return this.verifyOtp({ type: "signup", token });
-  }
-  async resendVerificationEmail(email) {
-    const e = email ?? this.client.authStore.user?.email;
-    if (!e) {
-      return {
-        data: null,
-        error: new core.AuraError(0, { error: { code: "missing_email", message: "Email is required" } })
-      };
-    }
-    return this.request("POST", `${this.prefix}/resend-verification`, { email: e });
-  }
-  // -- Email OTP (Phase 2) --------------------------------------------------
-  async signInWithEmailOtp(email) {
-    return this.request("POST", `${this.prefix}/email-otp/send`, { email });
-  }
-  /** Rétrocompat : délègue à `verifyOtp({ type: 'email' })` (POST /email-otp/verify). */
-  async verifyEmailOtp(email, code) {
-    return this.verifyOtp({ type: "email", email, token: code });
-  }
-  // -- SMS OTP (Phase 2) ----------------------------------------------------
-  async signInWithSmsOtp(phone) {
-    return this.request("POST", `${this.prefix}/sms/send`, { phone });
-  }
-  /** Rétrocompat : délègue à `verifyOtp({ type: 'sms' })` (POST /sms/verify). */
-  async verifySmsOtp(phone, code) {
-    return this.verifyOtp({ type: "sms", phone, token: code });
-  }
-  // -- Identity linking (Phase 2) -------------------------------------------
-  async listIdentities() {
-    return this.request("GET", `${this.prefix}/user/identities`);
-  }
-  async linkIdentity(provider) {
-    return this.request("POST", `${this.prefix}/user/identities/link/${provider}`);
-  }
-  async unlinkIdentity(identityId) {
-    return this.request("DELETE", `${this.prefix}/user/identities/${identityId}`);
-  }
-  // -- Email change (Phase 2) -----------------------------------------------
-  /**
-   * Rétrocompat : délègue à `verifyOtp({ type: 'email_change' })`.
-   * CHANGEMENT ASSUMÉ (parité) : émet désormais `USER_UPDATED` (auparavant aucun
-   * événement) — voir CHANGELOG.
-   */
-  async confirmEmailChange(token) {
-    return this.verifyOtp({ type: "email_change", token });
-  }
-  // -- MFA recovery codes (Phase 2) -----------------------------------------
-  async regenerateRecoveryCodes(code) {
-    return this.request("POST", `${this.prefix}/mfa/recovery-codes/regenerate`, { code });
-  }
-  // -- Native mobile OAuth (Phase 2) ----------------------------------------
-  async signInWithIdToken(provider, idToken, accessToken) {
-    const res = await this.request("POST", `${this.prefix}/token`, {
-      provider,
-      id_token: idToken,
-      access_token: accessToken
-    });
-    if (res.data) {
-      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
-      this._emitEvent("SIGNED_IN", res.data.user, res.data.access_token);
-    }
-    return res;
-  }
-  // -- Project settings / public config --------------------------------------
-  /** GoTrue parity : GET /settings — config publique du projet (pas d'auth requise). */
-  async getSettings() {
-    return this.request("GET", `${this.prefix}/settings`);
-  }
-  /** Clé publiable (anon key) du projet — GET /anon-key (public, à l'image du modèle Supabase). */
-  async getAnonKey() {
-    return this.request("GET", `${this.prefix}/anon-key`);
-  }
-  // -- Password recovery (token consumption) ----------------------------------
-  /**
-   * Consomme le token de récupération de mot de passe et applique le nouveau mot de passe.
-   * Body confirmé au handler (`ResetPasswordRequest` — services/aura-auth/src/handlers/auth.rs) :
-   * `{ token, password }`. Révoque les anciennes sessions et renvoie une nouvelle TokenPair.
-   */
-  async resetPassword(token, newPassword) {
-    return this.verifyOtp({ type: "recovery", token, password: newPassword });
-  }
-  // -- Anonymous promotion -----------------------------------------------------
-  /**
-   * Convertit l'utilisateur anonyme courant (JWT requis) en compte régulier email+password.
-   * Body confirmé au handler (`PromoteAnonymousRequest`) : `{ email, password }`.
-   */
-  async promoteAnonymous(credentials) {
-    const res = await this.request("POST", `${this.prefix}/anonymous/promote`, credentials);
-    if (res.data) {
-      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
-      this._emitEvent("USER_UPDATED", res.data.user, res.data.access_token);
-    }
-    return res;
-  }
-  // -- Magic link verification -------------------------------------------------
-  /**
-   * Consomme le token de magic link et renvoie une TokenPair.
-   * Body confirmé au handler (`VerifyMagicLinkRequest`) : `{ token }`.
-   */
-  async verifyMagicLink(token) {
-    return this.verifyOtp({ type: "magiclink", token });
-  }
-};
-var AuthAdminService = class extends core.BaseService {
-  get prefix() {
-    return `/v1/auth/${this.client.projectId}/admin`;
-  }
-  // -- Users ----------------------------------------------------------------
-  async listUsers(params) {
-    const query = new URLSearchParams();
-    if (params?.limit !== void 0) query.set("limit", String(params.limit));
-    if (params?.offset !== void 0) query.set("offset", String(params.offset));
-    if (params?.search) query.set("search", params.search);
-    const qs = query.toString();
-    return this.request("GET", `${this.prefix}/users${qs ? "?" + qs : ""}`);
-  }
-  async getUser(userId) {
-    return this.request("GET", `${this.prefix}/users/${userId}`);
-  }
-  async createUser(data) {
-    return this.request("POST", `${this.prefix}/users`, data);
-  }
-  async updateUser(userId, data) {
-    return this.request("PUT", `${this.prefix}/users/${userId}`, data);
-  }
-  async deleteUser(userId) {
-    return this.request("DELETE", `${this.prefix}/users/${userId}`);
-  }
-  async banUser(userId) {
-    return this.request("POST", `${this.prefix}/users/${userId}/ban`, {});
-  }
-  async unbanUser(userId) {
-    return this.request("POST", `${this.prefix}/users/${userId}/unban`, {});
-  }
-  async generateLink(userId, type) {
-    return this.request("POST", `${this.prefix}/users/${userId}/generate-link`, { type });
-  }
-  async getUserStats() {
-    return this.request("GET", `${this.prefix}/users/stats`);
-  }
-  async listUserIdentities(userId) {
-    return this.request("GET", `${this.prefix}/users/${userId}/identities`);
-  }
-  // -- Sessions ---------------------------------------------------------------
-  async listSessions(params) {
-    const query = new URLSearchParams();
-    if (params?.userId !== void 0) query.set("user_id", params.userId);
-    if (params?.limit !== void 0) query.set("limit", String(params.limit));
-    if (params?.offset !== void 0) query.set("offset", String(params.offset));
-    const qs = query.toString();
-    return this.request("GET", `${this.prefix}/sessions${qs ? "?" + qs : ""}`);
-  }
-  async revokeSession(sessionId) {
-    return this.request("DELETE", `${this.prefix}/sessions/${sessionId}`);
-  }
-  // -- Audit log ------------------------------------------------------------
-  async getAuditLog(params) {
-    const query = new URLSearchParams();
-    if (params?.userId !== void 0) query.set("user_id", params.userId);
-    if (params?.limit !== void 0) query.set("limit", String(params.limit));
-    if (params?.offset !== void 0) query.set("offset", String(params.offset));
-    const qs = query.toString();
-    return this.request("GET", `${this.prefix}/audit-log${qs ? "?" + qs : ""}`);
-  }
-  // -- Settings -------------------------------------------------------------
-  async getSettings() {
-    return this.request("GET", `${this.prefix}/settings`);
-  }
-  async updateSettings(data) {
-    return this.request("PUT", `${this.prefix}/settings`, data);
-  }
-  // -- Email templates ------------------------------------------------------
-  async listEmailTemplates() {
-    return this.request("GET", `${this.prefix}/email-templates`);
-  }
-  async getEmailTemplate(type) {
-    return this.request("GET", `${this.prefix}/email-templates/${type}`);
-  }
-  async updateEmailTemplate(type, data) {
-    return this.request("PUT", `${this.prefix}/email-templates/${type}`, data);
-  }
-  async deleteEmailTemplate(type) {
-    return this.request("DELETE", `${this.prefix}/email-templates/${type}`);
-  }
-  async testEmailTemplate(type, body) {
-    return this.request("POST", `${this.prefix}/email-templates/${type}/test`, body);
-  }
-};
-
-exports.AuthAdminService = AuthAdminService;
-exports.AuthService = AuthService;
-exports.SessionManager = SessionManager;
-exports.isMfaChallenge = isMfaChallenge;