@baasix/sdk 0.1.18 → 0.1.20

package/dist/modules/auth.d.ts

@@ -1,15 +1,34 @@
 import { H as HttpClient } from '../client-D67LK80v.js';
 import { S as StorageAdapter } from '../types-BdjsGANq.js';
-import { AuthMode, AuthStateEvent, User, RegisterData, AuthResponse, LoginCredentials, AuthTokens, MagicLinkOptions, PasswordResetOptions, Tenant, AuthState } from '@baasix/types';
+import { AuthMode, AuthResponse, AuthStateEvent, User, RegisterData, LoginCredentials, AuthTokens, MagicLinkOptions, PasswordResetOptions, Tenant, AuthState } from '@baasix/types';
 export { AuthResponse, AuthState, AuthStateEvent, AuthTokens, LoginCredentials, MagicLinkOptions, PasswordResetOptions, RegisterData, Tenant, User } from '@baasix/types';
 
-type OAuthProvider = "google" | "facebook" | "apple" | "github";
+declare const SOCIAL_PROVIDERS: readonly ["apple", "atlassian", "cognito", "discord", "dropbox", "facebook", "figma", "github", "gitlab", "google", "huggingface", "kakao", "kick", "line", "linear", "linkedin", "microsoft", "naver", "notion", "paybin", "paypal", "polar", "railway", "reddit", "roblox", "salesforce", "slack", "spotify", "tiktok", "twitch", "twitter", "vercel", "vk", "wechat", "zoom"];
+type OAuthProvider = (typeof SOCIAL_PROVIDERS)[number];
 interface OAuthOptions {
     provider: OAuthProvider;
     redirectUrl: string;
     scopes?: string[];
     state?: string;
 }
+interface AuthMethods {
+    registration: boolean;
+    emailPassword: boolean;
+    magicLink: boolean;
+    passkey: boolean;
+    twoFactor: boolean;
+    socialProviders: OAuthProvider[];
+}
+interface TwoFactorChallengeResponse {
+    twoFactorRequired: true;
+    twoFactorToken: string;
+}
+type LoginResult = AuthResponse | TwoFactorChallengeResponse;
+interface TwoFactorEnableResult {
+    secret: string;
+    otpauthUrl: string;
+    backupCodes: string[];
+}
 interface InviteOptions {
     email: string;
     roleId: string;
@@ -22,6 +41,14 @@ interface VerifyInviteResult {
     tenantId?: string;
     roleId?: string;
 }
+interface Passkey {
+    id: string;
+    name: string | null;
+    deviceType: string;
+    backedUp: boolean;
+    createdAt: string;
+    lastUsedAt: string | null;
+}
 interface AuthModuleConfig {
     client: HttpClient;
     storage: StorageAdapter;
@@ -52,7 +79,65 @@ declare class AuthModule {
     private authMode;
     private onAuthStateChange?;
     private currentUser;
+    private authMethodsCache;
+    /**
+     * Two-factor authentication (TOTP) helpers.
+     *
+     * @example
+     * ```typescript
+     * const result = await baasix.auth.login({ email, password });
+     * if ("twoFactorRequired" in result && result.twoFactorRequired) {
+     *   const { user, token } = await baasix.auth.twoFactor.verify(result.twoFactorToken, code);
+     * }
+     * ```
+     */
+    readonly twoFactor: {
+        verify(twoFactorToken: string, code: string, opts?: {
+            authMode?: AuthMode;
+            authType?: string;
+        }): Promise<AuthResponse>;
+        enable(): Promise<TwoFactorEnableResult>;
+        verifySetup(code: string): Promise<{
+            enabled: boolean;
+        }>;
+        disable(password: string): Promise<{
+            disabled: boolean;
+        }>;
+    };
+    /**
+     * Passkey (WebAuthn) registration and authentication helpers.
+     * Browser-only: throws a `BaasixError` when called outside a browser
+     * environment (no `window`/`PublicKeyCredential`).
+     *
+     * @example
+     * ```typescript
+     * // Register a passkey for the currently logged-in user
+     * await baasix.auth.passkey.register("My Laptop");
+     *
+     * // Authenticate with a passkey (no prior login required)
+     * const { user, token } = await baasix.auth.passkey.authenticate();
+     *
+     * // List and remove registered passkeys
+     * const passkeys = await baasix.auth.passkey.list();
+     * await baasix.auth.passkey.remove(passkeys[0].id);
+     * ```
+     */
+    passkey: {
+        register: (name?: string) => Promise<{
+            verified: boolean;
+        }>;
+        authenticate: (opts?: {
+            authMode?: AuthMode;
+        }) => Promise<AuthResponse>;
+        list: () => Promise<Passkey[]>;
+        remove: (id: string) => Promise<void>;
+    };
     constructor(config: AuthModuleConfig);
+    /**
+     * Assert that we're running in a browser environment with WebAuthn support.
+     * Throws a `BaasixError` otherwise.
+     */
+    private assertBrowser;
     /**
      * Emit an authentication state change event
      */
@@ -105,7 +190,22 @@ declare class AuthModule {
      * });
      * ```
      */
-    login(credentials: LoginCredentials): Promise<AuthResponse>;
+    login(credentials: LoginCredentials): Promise<LoginResult>;
+    /**
+     * Discover which authentication methods are enabled for this project
+     * (registration, email/password, magic link, passkey, 2FA, and the list
+     * of configured social/OAuth providers). Result is cached per instance;
+     * pass `force: true` to bypass the cache and refetch.
+     *
+     * @example
+     * ```typescript
+     * const methods = await baasix.auth.getAuthMethods();
+     * if (methods.socialProviders.includes("google")) {
+     *   // show "Sign in with Google"
+     * }
+     * ```
+     */
+    getAuthMethods(force?: boolean): Promise<AuthMethods>;
     /**
      * Logout the current user
      *
@@ -390,4 +490,4 @@ declare class AuthModule {
     }): Promise<AuthResponse>;
 }
 
-export { AuthModule, type AuthModuleConfig, type InviteOptions, type OAuthOptions, type OAuthProvider, type VerifyInviteResult };
+export { type AuthMethods, AuthModule, type AuthModuleConfig, type InviteOptions, type LoginResult, type OAuthOptions, type OAuthProvider, type Passkey, SOCIAL_PROVIDERS, type TwoFactorChallengeResponse, type TwoFactorEnableResult, type VerifyInviteResult };

package/dist/modules/auth.js

@@ -36,17 +36,123 @@ var BaasixError = class _BaasixError extends Error {
 };
 
 // src/modules/auth.ts
+var SOCIAL_PROVIDERS = ["apple", "atlassian", "cognito", "discord", "dropbox", "facebook", "figma", "github", "gitlab", "google", "huggingface", "kakao", "kick", "line", "linear", "linkedin", "microsoft", "naver", "notion", "paybin", "paypal", "polar", "railway", "reddit", "roblox", "salesforce", "slack", "spotify", "tiktok", "twitch", "twitter", "vercel", "vk", "wechat", "zoom"];
 var AuthModule = class {
   client;
   storage;
   authMode;
   onAuthStateChange;
   currentUser = null;
+  authMethodsCache = null;
+  /**
+   * Two-factor authentication (TOTP) helpers.
+   *
+   * @example
+   * ```typescript
+   * const result = await baasix.auth.login({ email, password });
+   * if ("twoFactorRequired" in result && result.twoFactorRequired) {
+   *   const { user, token } = await baasix.auth.twoFactor.verify(result.twoFactorToken, code);
+   * }
+   * ```
+   */
+  twoFactor;
+  /**
+   * Passkey (WebAuthn) registration and authentication helpers.
+   * Browser-only: throws a `BaasixError` when called outside a browser
+   * environment (no `window`/`PublicKeyCredential`).
+   *
+   * @example
+   * ```typescript
+   * // Register a passkey for the currently logged-in user
+   * await baasix.auth.passkey.register("My Laptop");
+   *
+   * // Authenticate with a passkey (no prior login required)
+   * const { user, token } = await baasix.auth.passkey.authenticate();
+   *
+   * // List and remove registered passkeys
+   * const passkeys = await baasix.auth.passkey.list();
+   * await baasix.auth.passkey.remove(passkeys[0].id);
+   * ```
+   */
+  passkey = {
+    register: async (name) => {
+      this.assertBrowser();
+      const { startRegistration } = await import('@simplewebauthn/browser');
+      const options = await this.client.post("/auth/passkey/register/options", {});
+      const attestation = await startRegistration({ optionsJSON: options });
+      await this.client.post("/auth/passkey/register/verify", {
+        response: attestation,
+        name: name || null
+      });
+      return { verified: true };
+    },
+    authenticate: async (opts) => {
+      this.assertBrowser();
+      const { startAuthentication } = await import('@simplewebauthn/browser');
+      const { options, challengeId } = await this.client.post(
+        "/auth/passkey/authenticate/options",
+        {},
+        { skipAuth: true }
+      );
+      const assertion = await startAuthentication({ optionsJSON: options });
+      const response = await this.client.post(
+        "/auth/passkey/authenticate/verify",
+        { challengeId, response: assertion, authMode: opts?.authMode },
+        { skipAuth: true }
+      );
+      await this.storeTokens(response);
+      this.emitAuthStateChange("SIGNED_IN", response.user);
+      return response;
+    },
+    list: async () => (await this.client.get("/auth/passkey")).passkeys,
+    remove: async (id) => {
+      await this.client.delete(`/auth/passkey/${encodeURIComponent(id)}`);
+    }
+  };
   constructor(config) {
     this.client = config.client;
     this.storage = config.storage;
     this.authMode = config.authMode;
     this.onAuthStateChange = config.onAuthStateChange;
+    this.twoFactor = {
+      verify: async (twoFactorToken, code, opts) => {
+        const response = await this.client.post(
+          "/auth/2fa/verify",
+          {
+            twoFactorToken,
+            code,
+            authMode: opts?.authMode,
+            authType: opts?.authType
+          },
+          { skipAuth: true }
+        );
+        await this.storeTokens(response);
+        this.emitAuthStateChange("SIGNED_IN", response.user);
+        return response;
+      },
+      enable: () => {
+        return this.client.post("/auth/2fa/enable");
+      },
+      verifySetup: (code) => {
+        return this.client.post("/auth/2fa/verify-setup", {
+          code
+        });
+      },
+      disable: (password) => {
+        return this.client.post("/auth/2fa/disable", {
+          password
+        });
+      }
+    };
+  }
+  /**
+   * Assert that we're running in a browser environment with WebAuthn support.
+   * Throws a `BaasixError` otherwise.
+   */
+  assertBrowser() {
+    if (typeof window === "undefined" || !window.PublicKeyCredential) {
+      throw new BaasixError("Passkeys are only available in a browser", 400);
+    }
   }
   /**
    * Emit an authentication state change event
@@ -143,9 +249,39 @@ var AuthModule = class {
       },
       { skipAuth: true }
     );
-    await this.storeTokens(response);
-    this.emitAuthStateChange("SIGNED_IN", response.user);
-    return response;
+    if ("twoFactorRequired" in response && response.twoFactorRequired) {
+      return response;
+    }
+    const authResponse = response;
+    await this.storeTokens(authResponse);
+    this.emitAuthStateChange("SIGNED_IN", authResponse.user);
+    return authResponse;
+  }
+  /**
+   * Discover which authentication methods are enabled for this project
+   * (registration, email/password, magic link, passkey, 2FA, and the list
+   * of configured social/OAuth providers). Result is cached per instance;
+   * pass `force: true` to bypass the cache and refetch.
+   *
+   * @example
+   * ```typescript
+   * const methods = await baasix.auth.getAuthMethods();
+   * if (methods.socialProviders.includes("google")) {
+   *   // show "Sign in with Google"
+   * }
+   * ```
+   */
+  async getAuthMethods(force = false) {
+    if (this.authMethodsCache && !force) {
+      return this.authMethodsCache;
+    }
+    const response = await this.client.get(
+      "/",
+      { skipAuth: true }
+    );
+    const authMethods = response?.project?.auth;
+    this.authMethodsCache = authMethods;
+    return authMethods;
   }
   /**
    * Logout the current user
@@ -647,6 +783,6 @@ var AuthModule = class {
   }
 };
 
-export { AuthModule };
+export { AuthModule, SOCIAL_PROVIDERS };
 //# sourceMappingURL=auth.js.map
 //# sourceMappingURL=auth.js.map

package/dist/modules/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/storage/types.ts","../../src/types.ts","../../src/modules/auth.ts"],"names":[],"mappings":";AAkCO,IAAM,YAAA,GAAe;AAAA,EAC1B,YAAA,EAAc,qBAAA;AAAA,EACd,aAAA,EAAe,sBAAA;AAAA,EACf,YAAA,EAAc,qBAAA;AAAA,EACd,IAAA,EAAM,aAAA;AAAA,EACN,MAAA,EAAQ;AACV,CAAA;;;ACqPO,IAAM,WAAA,GAAN,MAAM,YAAA,SAAoB,KAAA,CAAM;AAAA,EACrB,MAAA;AAAA,EACA,IAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EAEhB,WAAA,CACE,OAAA,EACA,MAAA,GAAS,GAAA,EACT,MACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,WAAA,GAAc,MAAA,IAAU,GAAA,IAAO,MAAA,KAAW,GAAA;AAG/C,IAAA,IAAI,MAAM,iBAAA,EAAmB;AAC3B,MAAA,KAAA,CAAM,iBAAA,CAAkB,MAAM,YAAW,CAAA;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAA,GAAS;AACP,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,SAAS,IAAA,CAAK;AAAA,KAChB;AAAA,EACF;AACF,CAAA;;;AC7PO,IAAM,aAAN,MAAiB;AAAA,EACd,MAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,WAAA,GAA2B,IAAA;AAAA,EAEnC,YAAY,MAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AACrB,IAAA,IAAA,CAAK,UAAU,MAAA,CAAO,OAAA;AACtB,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,QAAA;AACvB,IAAA,IAAA,CAAK,oBAAoB,MAAA,CAAO,iBAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA,EAKQ,mBAAA,CAAoB,OAAuB,IAAA,EAAyB;AAC1E,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,iBAAA,GAAoB,OAAO,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YAAY,QAAA,EAAuC;AAC/D,IAAA,IAAI,IAAA,CAAK,aAAa,KAAA,EAAO;AAC3B,MAAA,MAAM,KAAK,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,YAAA,EAAc,SAAS,KAAK,CAAA;AAEhE,MAAA,IAAI,SAAS,YAAA,EAAc;AACzB,QAAA,MAAM,KAAK,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,aAAA,EAAe,SAAS,YAAY,CAAA;AAAA,MAC1E;AAEA,MAAA,IAAI,SAAS,SAAA,EAAW;AACtB,QAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAS,SAAA,GAAY,GAAA;AACpD,QAAA,MAAM,KAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,EAAc,SAAA,CAAU,UAAU,CAAA;AAAA,MACxE;AAAA,IACF;AAGA,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,MAAM,IAAA,CAAK,QAAQ,GAAA,CAAI,YAAA,CAAa,MAAM,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AAAA,IACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,SAAA,GAA2B;AACvC,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,YAAA,CAAa,YAAY,CAAA;AACnD,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,YAAA,CAAa,aAAa,CAAA;AACpD,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,YAAA,CAAa,YAAY,CAAA;AACnD,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,YAAA,CAAa,IAAI,CAAA;AAC3C,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,YAAA,CAAa,MAAM,CAAA;AAC7C,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,SAAS,IAAA,EAA2C;AACxD,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAmB,kBAAkB,IAAA,EAAM;AAAA,MAC5E,QAAA,EAAU;AAAA,KACX,CAAA;AAED,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,IAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,QAAA,CAAS,IAAI,CAAA;AAEnD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BA,MAAM,MAAM,WAAA,EAAsD;AAChE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MACjC,aAAA;AAAA,MACA;AAAA,QACE,OAAO,WAAA,CAAY,KAAA;AAAA,QACnB,UAAU,WAAA,CAAY,QAAA;AAAA,QACtB,WAAW,WAAA,CAAY,QAAA;AAAA,QACvB,UAAU,WAAA,CAAY,QAAA;AAAA,QACtB,UAAU,WAAA,CAAY;AAAA,OACxB;AAAA,MACA,EAAE,UAAU,IAAA;AAAK,KACnB;AAEA,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,IAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,QAAA,CAAS,IAAI,CAAA;AAEnD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,MAAA,GAAwB;AAC5B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA;AAAA,IACtC,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,IAAA,CAAK,mBAAA,CAAoB,cAAc,IAAI,CAAA;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAAA,GAAgC;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAoB,UAAU,CAAA;AACjE,MAAA,IAAA,CAAK,cAAc,QAAA,CAAS,IAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,QAAQ,GAAA,CAAI,YAAA,CAAa,MAAM,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AACvE,MAAA,OAAO,QAAA,CAAS,IAAA;AAAA,IAClB,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,KAAA,YAAiB,WAAA,IAAe,KAAA,CAAM,MAAA,KAAW,GAAA,EAAK;AACxD,QAAA,MAAM,KAAK,SAAA,EAAU;AACrB,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,EAAA,GAA2B;AAC/B,IAAA,OAAO,KAAK,OAAA,EAAQ;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAA,GAAsC;AAC1C,IAAA,IAAI,KAAK,WAAA,EAAa;AACpB,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACd;AAEA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,IAAI,CAAA;AACzD,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AACtC,QAAA,OAAO,IAAA,CAAK,WAAA;AAAA,MACd,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,eAAA,GAAoC;AACxC,IAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAE9B,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,aAAA,EAAc;AACtC,MAAA,OAAO,IAAA,KAAS,IAAA;AAAA,IAClB;AAEA,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAY,CAAA;AAC9D,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AAGnB,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAY,CAAA;AAC/D,IAAA,IAAI,UAAU,IAAA,CAAK,GAAA,MAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,EAAG;AAEhD,MAAA,MAAM,eAAe,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,aAAa,CAAA;AACtE,MAAA,OAAO,CAAC,CAAC,YAAA;AAAA,IACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAA,GAAmC;AACvC,IAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAY,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,SAAS,KAAA,EAA8B;AAC3C,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,cAAc,KAAK,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YAAA,GAAoC;AACxC,IAAA,MAAM,eAAe,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,aAAa,CAAA;AAEtE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MACjC,eAAA;AAAA,MACA,IAAA,CAAK,QAAA,KAAa,KAAA,GACd,EAAE,YAAA,EAAc,UAAU,KAAA,EAAM,GAChC,EAAE,QAAA,EAAU,QAAA;AAAS,KAC3B;AAEA,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAE/B,IAAA,MAAM,MAAA,GAAqB;AAAA,MACzB,aAAa,QAAA,CAAS,KAAA;AAAA,MACtB,cAAc,QAAA,CAAS,YAAA;AAAA,MACvB,WAAW,QAAA,CAAS,SAAA;AAAA,MACpB,SAAA,EAAW,SAAS,SAAA,GAChB,IAAA,CAAK,KAAI,GAAI,QAAA,CAAS,YAAY,GAAA,GAClC;AAAA,KACN;AAEA,IAAA,IAAA,CAAK,mBAAA,CAAoB,iBAAA,EAAmB,QAAA,CAAS,IAAI,CAAA;AAEzD,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,cAAc,OAAA,EAA0C;AAC5D,IAAA,MAAM,KAAK,MAAA,CAAO,IAAA;AAAA,MAChB,iBAAA;AAAA,MACA;AAAA,QACE,OAAO,OAAA,CAAQ,KAAA;AAAA,QACf,MAAM,OAAA,CAAQ,WAAA;AAAA,QACd,IAAA,EAAM,QAAQ,IAAA,IAAQ;AAAA,OACxB;AAAA,MACA,EAAE,UAAU,IAAA;AAAK,KACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,gBAAgB,KAAA,EAAsC;AAC1D,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA;AAAA,MACjC,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA,MAC5C,EAAE,UAAU,IAAA;AAAK,KACnB;AAEA,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,IAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,QAAA,CAAS,IAAI,CAAA;AAEnD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,eAAe,OAAA,EAA8C;AACjE,IAAA,MAAM,KAAK,MAAA,CAAO,IAAA;AAAA,MAChB,sBAAA;AAAA,MACA;AAAA,QACE,OAAO,OAAA,CAAQ,KAAA;AAAA,QACf,MAAM,OAAA,CAAQ;AAAA,OAChB;AAAA,MACA,EAAE,UAAU,IAAA;AAAK,KACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAA,CAAc,KAAA,EAAe,WAAA,EAAoC;AACrE,IAAA,MAAM,KAAK,MAAA,CAAO,IAAA;AAAA,MAChB,CAAA,qBAAA,EAAwB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA,MACjD,EAAE,UAAU,WAAA,EAAY;AAAA,MACxB,EAAE,UAAU,IAAA;AAAK,KACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAA,CACJ,eAAA,EACA,WAAA,EACe;AACf,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,uBAAA,EAAyB;AAAA,MAC9C,eAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,UAAA,GAAgC;AACpC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAA2B,eAAe,CAAA;AAC7E,IAAA,OAAO,QAAA,CAAS,OAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAa,QAAA,EAAyC;AAC1D,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,KAAmB,qBAAA,EAAuB;AAAA,MAC3E,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,QAAQ,QAAQ,CAAA;AACpD,IAAA,IAAA,CAAK,mBAAA,CAAoB,iBAAA,EAAmB,QAAA,CAAS,IAAI,CAAA;AAEzD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,QAAA,GAA+B;AACnC,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,eAAA,EAAgB;AACnD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,aAAA,EAAc;AAEtC,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA,EAAW,KAAA;AAAA,MACX,KAAA,EAAO;AAAA,KACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,UAAA,GAAiC;AACrC,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,EAAS;AAElC,IAAA,IAAI,KAAA,CAAM,eAAA,IAAmB,KAAA,CAAM,IAAA,EAAM;AACvC,MAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,KAAA,CAAM,IAAI,CAAA;AAAA,IAClD;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,YAAY,OAAA,EAA+B;AACzC,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,MAAA,CAAO,UAAA,EAAW;AACvC,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MACjC,cAAc,OAAA,CAAQ;AAAA,KACvB,CAAA;AAED,IAAA,IAAI,OAAA,CAAQ,QAAQ,MAAA,EAAQ;AAC1B,MAAA,MAAA,CAAO,IAAI,QAAA,EAAU,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IAC/C;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,OAAA,CAAQ,KAAK,CAAA;AAAA,IACnC;AAEA,IAAA,OAAO,CAAA,EAAG,OAAO,CAAA,aAAA,EAAgB,OAAA,CAAQ,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,UAAU,CAAA,CAAA;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,oBAAoB,KAAA,EAAsC;AAE9D,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,cAAc,KAAK,CAAA;AAGvD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,EAAQ;AAEhC,IAAA,MAAM,QAAA,GAAyB;AAAA,MAC7B,KAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,IAAA,CAAK,mBAAA,CAAoB,aAAa,IAAI,CAAA;AAC1C,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,yBAAyB,WAAA,EAAoC;AACjE,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,oBAAA,EAAsB;AAAA,MAC3C,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,YAAY,KAAA,EAA8B;AAC9C,IAAA,MAAM,KAAK,MAAA,CAAO,GAAA,CAAI,sBAAsB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA,EAAI;AAAA,MACvE,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YAAA,GAAiC;AACrC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAwB,aAAa,CAAA;AACxE,MAAA,OAAO,QAAA,CAAS,KAAA;AAAA,IAClB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,WAAW,OAAA,EAAuC;AACtD,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,cAAA,EAAgB;AAAA,MACrC,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,SAAS,OAAA,CAAQ,MAAA;AAAA,MACjB,WAAW,OAAA,CAAQ,QAAA;AAAA,MACnB,MAAM,OAAA,CAAQ;AAAA,KACf,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,YAAA,CAAa,KAAA,EAAe,WAAA,EAAmD;AACnF,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA;AAAA,MACjC,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA,MAChD;AAAA,QACE,MAAA,EAAQ;AAAA,UACN,IAAA,EAAM;AAAA,SACR;AAAA,QACA,QAAA,EAAU;AAAA;AACZ,KACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAa,KAAA,EAAsC;AACvD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MACjC,qBAAA;AAAA,MACA,EAAE,aAAa,KAAA;AAAM,KACvB;AAEA,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,IAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,QAAA,CAAS,IAAI,CAAA;AAEnD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,mBAAmB,IAAA,EAAqE;AAC5F,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MACjC,gBAAA;AAAA,MACA;AAAA,QACE,GAAG,IAAA;AAAA,QACH,aAAa,IAAA,CAAK;AAAA,OACpB;AAAA,MACA,EAAE,UAAU,IAAA;AAAK,KACnB;AAEA,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,IAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,QAAA,CAAS,IAAI,CAAA;AAEnD,IAAA,OAAO,QAAA;AAAA,EACT;AACF","file":"auth.js","sourcesContent":["/**\n * Storage adapter interface for persisting authentication state.\n * Implement this interface to create custom storage solutions (e.g., AsyncStorage for React Native).\n */\nexport interface StorageAdapter {\n  /**\n   * Get a value from storage\n   * @param key - The storage key\n   * @returns The stored value or null if not found\n   */\n  get(key: string): Promise<string | null> | string | null;\n\n  /**\n   * Set a value in storage\n   * @param key - The storage key\n   * @param value - The value to store\n   */\n  set(key: string, value: string): Promise<void> | void;\n\n  /**\n   * Remove a value from storage\n   * @param key - The storage key\n   */\n  remove(key: string): Promise<void> | void;\n\n  /**\n   * Clear all SDK-related values from storage\n   */\n  clear?(): Promise<void> | void;\n}\n\n/**\n * Storage keys used by the SDK\n */\nexport const STORAGE_KEYS = {\n  ACCESS_TOKEN: \"baasix_access_token\",\n  REFRESH_TOKEN: \"baasix_refresh_token\",\n  TOKEN_EXPIRY: \"baasix_token_expiry\",\n  USER: \"baasix_user\",\n  TENANT: \"baasix_tenant\",\n} as const;\n\nexport type StorageKey = (typeof STORAGE_KEYS)[keyof typeof STORAGE_KEYS];\n","/**\n * Baasix SDK Types\n *\n * This file re-exports shared types from @baasix/types and defines\n * SDK-specific types that are not shared with other packages.\n */\n\nimport type { StorageAdapter } from \"./storage/types\";\n\n// ============================================================================\n// Re-export shared types from @baasix/types\n// ============================================================================\n\n// Auth types\nexport type {\n  User,\n  UserWithPassword,\n  UserWithRolesAndPermissions,\n  Role,\n  PermissionAction,\n  Permission,\n  PermissionData,\n  CreatePermissionData,\n  Tenant,\n  Session,\n  AuthTokens,\n  JWTPayload,\n  Accountability,\n  LoginCredentials,\n  RegisterData,\n  AuthResponse,\n  AuthStateEvent,\n  AuthState,\n  MagicLinkOptions,\n  PasswordResetOptions,\n  OAuth2Tokens,\n  OAuth2UserInfo,\n} from \"@baasix/types\";\n\n// Schema types\nexport type {\n  FieldType,\n  DefaultValueType,\n  FieldValidationRules,\n  FieldValues,\n  FieldDefinition,\n  FlattenedField,\n  FieldInfo,\n  IndexDefinition,\n  SchemaDefinition,\n  SchemaInfo,\n  SchemaValidation,\n  FieldValidation,\n  ValidationResult,\n  RelationshipType,\n  AssociationType,\n  RelationshipDefinition,\n  AssociationDefinition,\n  IncludeConfig,\n  ProcessedInclude,\n} from \"@baasix/types\";\n\n// Query types\nexport type {\n  FilterOperator,\n  FilterValue,\n  FilterCondition,\n  LogicalFilter,\n  Filter,\n  FilterObject,\n  SortDirection,\n  Sort,\n  SortItem,\n  SortObject,\n  PaginationOptions,\n  PaginationMetadata,\n  AggregateFunction,\n  AggregateConfig,\n  Aggregate,\n  DatePart,\n  DateTruncPrecision,\n  QueryParams,\n  QueryOptions,\n  QueryContext,\n} from \"@baasix/types\";\n\n// Response types\nexport type {\n  PaginatedResponse,\n  SingleResponse,\n  MutationResponse,\n  DeleteResponse,\n  BulkResponse,\n  ReadResult,\n  ErrorResponse,\n} from \"@baasix/types\";\n\n// File types\nexport type {\n  FileMetadata,\n  FileData,\n  UploadOptions,\n  InternalUploadedFile,\n  AssetTransformOptions,\n  AssetQuery,\n  ProcessedImage,\n  StorageProvider,\n} from \"@baasix/types\";\n\n// Workflow types\nexport type {\n  WorkflowTriggerType,\n  WorkflowStatus,\n  Workflow,\n  WorkflowFlowData,\n  WorkflowTrigger,\n  WorkflowNode,\n  WorkflowNodeData,\n  WorkflowEdge,\n  WorkflowExecutionStatus,\n  WorkflowExecution,\n  WorkflowExecutionLog,\n} from \"@baasix/types\";\n\n// Notification types\nexport type {\n  NotificationType,\n  Notification,\n  NotificationOptions,\n  SendNotificationData,\n} from \"@baasix/types\";\n\n// Common types\nexport type {\n  BaseItem,\n  TimestampedItem,\n  SoftDeletableItem,\n  DeepPartial,\n  CollectionItem,\n  WithRequired,\n  WithOptional,\n  KeysOfType,\n  AnyRecord,\n  Settings,\n  TenantSettings,\n  // Import/Export types\n  UploadedFile,\n  ImportOptions,\n  ExportOptions,\n  ImportResult,\n  ExportResult,\n  // Stats types\n  StatsQuery,\n  StatsResult,\n  // Task types\n  BackgroundTask,\n  // Report types\n  ReportConfig,\n  ReportResult,\n  // Spatial types\n  GeoJSONPoint,\n  GeoJSONLineString,\n  GeoJSONPolygon,\n  GeoJSONGeometry,\n  // Hook types\n  HookEvent,\n  HookContext,\n  HookHandler,\n  Hook,\n  // HTTP types\n  HttpMethod,\n  // Mail types\n  MailOptions,\n  SenderConfig,\n  // Seed types\n  SeedData,\n  SeedResult,\n  // Cache types\n  CacheConfig,\n  CacheStrategy,\n} from \"@baasix/types\";\n\n// Import types needed for SDK-specific interfaces\nimport type { User, AuthStateEvent } from \"@baasix/types\";\n\n// Auth mode (re-exported from @baasix/types)\nexport type { AuthMode } from \"@baasix/types\";\n\n// Import for internal use\nimport type { AuthMode } from \"@baasix/types\";\n\n// ============================================================================\n// SDK-Specific Types (not shared)\n// ============================================================================\n\n/**\n * SDK Configuration options\n */\nexport interface BaasixConfig {\n  /**\n   * The base URL of your Baasix instance\n   * @example 'https://api.example.com' or 'http://localhost:8056'\n   */\n  url: string;\n\n  /**\n   * Authentication mode\n   * @default 'jwt'\n   */\n  authMode?: AuthMode;\n\n  /**\n   * Storage adapter for persisting tokens and user data\n   * @default LocalStorageAdapter (web) or MemoryStorageAdapter (SSR)\n   */\n  storage?: StorageAdapter;\n\n  /**\n   * Static access token (useful for server-side or service accounts)\n   * When provided, this token is used instead of stored tokens\n   */\n  token?: string;\n\n  /**\n   * Custom headers to include in all requests\n   */\n  headers?: Record<string, string>;\n\n  /**\n   * Request timeout in milliseconds\n   * @default 30000 (30 seconds)\n   */\n  timeout?: number;\n\n  /**\n   * Whether to automatically refresh tokens before expiry\n   * @default true\n   */\n  autoRefresh?: boolean;\n\n  /**\n   * Credentials mode for fetch requests (important for cookies)\n   * @default 'include' for cookie mode, 'same-origin' for jwt mode\n   */\n  credentials?: RequestCredentials;\n\n  /**\n   * Tenant ID for multi-tenant mode\n   */\n  tenantId?: string;\n\n  /**\n   * Global error handler\n   */\n  onError?: (error: BaasixError) => void;\n\n  /**\n   * Called when authentication state changes\n   */\n  onAuthStateChange?: (event: AuthStateEvent, user: User | null) => void;\n\n  /**\n   * WebSocket server URL for realtime features\n   * @default Same as url\n   */\n  socketUrl?: string;\n\n  /**\n   * WebSocket path\n   * @default '/socket'\n   */\n  socketPath?: string;\n}\n\n// ============================================================================\n// Error Types (SDK-specific implementation)\n// ============================================================================\n\nexport interface BaasixErrorDetails {\n  code?: string;\n  field?: string;\n  message?: string;\n  [key: string]: unknown;\n}\n\nexport class BaasixError extends Error {\n  public readonly status: number;\n  public readonly code?: string;\n  public readonly details?: BaasixErrorDetails[];\n  public readonly isRetryable: boolean;\n\n  constructor(\n    message: string,\n    status = 500,\n    code?: string,\n    details?: BaasixErrorDetails[]\n  ) {\n    super(message);\n    this.name = \"BaasixError\";\n    this.status = status;\n    this.code = code;\n    this.details = details;\n    this.isRetryable = status >= 500 || status === 429;\n\n    // Maintains proper stack trace for where error was thrown\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, BaasixError);\n    }\n  }\n\n  toJSON() {\n    return {\n      name: this.name,\n      message: this.message,\n      status: this.status,\n      code: this.code,\n      details: this.details,\n    };\n  }\n}\n","import type { HttpClient } from \"../client\";\nimport type { StorageAdapter } from \"../storage/types\";\nimport { STORAGE_KEYS } from \"../storage/types\";\nimport type {\n  AuthMode,\n  AuthResponse,\n  AuthState,\n  AuthStateEvent,\n  AuthTokens,\n  LoginCredentials,\n  MagicLinkOptions,\n  PasswordResetOptions,\n  RegisterData,\n  Tenant,\n  User,\n} from \"../types\";\nimport { BaasixError } from \"../types\";\n\nexport type OAuthProvider = \"google\" | \"facebook\" | \"apple\" | \"github\";\n\nexport interface OAuthOptions {\n  provider: OAuthProvider;\n  redirectUrl: string;\n  scopes?: string[];\n  state?: string;\n}\n\nexport interface InviteOptions {\n  email: string;\n  roleId: string;\n  tenantId?: string;\n  redirectUrl: string;\n}\n\nexport interface VerifyInviteResult {\n  valid: boolean;\n  email?: string;\n  tenantId?: string;\n  roleId?: string;\n}\n\nexport interface AuthModuleConfig {\n  client: HttpClient;\n  storage: StorageAdapter;\n  authMode: AuthMode;\n  onAuthStateChange?: (event: AuthStateEvent, user: User | null) => void;\n}\n\n/**\n * Authentication module for handling user authentication, sessions, and token management.\n *\n * @example\n * ```typescript\n * // Login\n * const { user, token } = await baasix.auth.login({\n *   email: 'user@example.com',\n *   password: 'password123'\n * });\n *\n * // Get current user\n * const user = await baasix.auth.getUser();\n *\n * // Logout\n * await baasix.auth.logout();\n * ```\n */\nexport class AuthModule {\n  private client: HttpClient;\n  private storage: StorageAdapter;\n  private authMode: AuthMode;\n  private onAuthStateChange?: (event: AuthStateEvent, user: User | null) => void;\n  private currentUser: User | null = null;\n\n  constructor(config: AuthModuleConfig) {\n    this.client = config.client;\n    this.storage = config.storage;\n    this.authMode = config.authMode;\n    this.onAuthStateChange = config.onAuthStateChange;\n  }\n\n  /**\n   * Emit an authentication state change event\n   */\n  private emitAuthStateChange(event: AuthStateEvent, user: User | null): void {\n    this.currentUser = user;\n    this.onAuthStateChange?.(event, user);\n  }\n\n  /**\n   * Store authentication tokens\n   */\n  private async storeTokens(response: AuthResponse): Promise<void> {\n    if (this.authMode === \"jwt\") {\n      await this.storage.set(STORAGE_KEYS.ACCESS_TOKEN, response.token);\n\n      if (response.refreshToken) {\n        await this.storage.set(STORAGE_KEYS.REFRESH_TOKEN, response.refreshToken);\n      }\n\n      if (response.expiresIn) {\n        const expiresAt = Date.now() + response.expiresIn * 1000;\n        await this.storage.set(STORAGE_KEYS.TOKEN_EXPIRY, expiresAt.toString());\n      }\n    }\n\n    // Store user info\n    if (response.user) {\n      await this.storage.set(STORAGE_KEYS.USER, JSON.stringify(response.user));\n    }\n  }\n\n  /**\n   * Clear stored authentication data\n   */\n  private async clearAuth(): Promise<void> {\n    await this.storage.remove(STORAGE_KEYS.ACCESS_TOKEN);\n    await this.storage.remove(STORAGE_KEYS.REFRESH_TOKEN);\n    await this.storage.remove(STORAGE_KEYS.TOKEN_EXPIRY);\n    await this.storage.remove(STORAGE_KEYS.USER);\n    await this.storage.remove(STORAGE_KEYS.TENANT);\n    this.currentUser = null;\n  }\n\n  /**\n   * Register a new user\n   *\n   * @example\n   * ```typescript\n   * const { user, token } = await baasix.auth.register({\n   *   email: 'newuser@example.com',\n   *   password: 'securepassword',\n   *   firstName: 'John',\n   *   lastName: 'Doe'\n   * });\n   * ```\n   */\n  async register(data: RegisterData): Promise<AuthResponse> {\n    const response = await this.client.post<AuthResponse>(\"/auth/register\", data, {\n      skipAuth: true,\n    });\n\n    await this.storeTokens(response);\n    this.emitAuthStateChange(\"SIGNED_IN\", response.user);\n\n    return response;\n  }\n\n  /**\n   * Login with email and password\n   *\n   * @example\n   * ```typescript\n   * const { user, token } = await baasix.auth.login({\n   *   email: 'user@example.com',\n   *   password: 'password123'\n   * });\n   *\n   * // Login with tenant (multi-tenant mode)\n   * const result = await baasix.auth.login({\n   *   email: 'user@example.com',\n   *   password: 'password123',\n   *   tenantId: 'tenant-uuid'\n   * });\n   *\n   * // Login with authMode and authType\n   * const result = await baasix.auth.login({\n   *   email: 'user@example.com',\n   *   password: 'password123',\n   *   authMode: 'cookie', // or 'jwt' (default)\n   *   authType: 'mobile'  // for session management\n   * });\n   * ```\n   */\n  async login(credentials: LoginCredentials): Promise<AuthResponse> {\n    const response = await this.client.post<AuthResponse>(\n      \"/auth/login\",\n      {\n        email: credentials.email,\n        password: credentials.password,\n        tenant_Id: credentials.tenantId,\n        authMode: credentials.authMode,\n        authType: credentials.authType,\n      },\n      { skipAuth: true }\n    );\n\n    await this.storeTokens(response);\n    this.emitAuthStateChange(\"SIGNED_IN\", response.user);\n\n    return response;\n  }\n\n  /**\n   * Logout the current user\n   *\n   * @example\n   * ```typescript\n   * await baasix.auth.logout();\n   * ```\n   */\n  async logout(): Promise<void> {\n    try {\n      await this.client.get(\"/auth/logout\");\n    } catch {\n      // Ignore logout errors - we still want to clear local state\n    }\n\n    await this.clearAuth();\n    this.emitAuthStateChange(\"SIGNED_OUT\", null);\n  }\n\n  /**\n   * Get the current authenticated user from the server\n   *\n   * @example\n   * ```typescript\n   * const user = await baasix.auth.getUser();\n   * console.log(user?.email);\n   * ```\n   */\n  async getUser(): Promise<User | null> {\n    try {\n      const response = await this.client.get<{ user: User }>(\"/auth/me\");\n      this.currentUser = response.user;\n      await this.storage.set(STORAGE_KEYS.USER, JSON.stringify(response.user));\n      return response.user;\n    } catch (error) {\n      if (error instanceof BaasixError && error.status === 401) {\n        await this.clearAuth();\n        return null;\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Alias for getUser() - Get the current authenticated user from the server\n   * Calls the /auth/me endpoint\n   *\n   * @example\n   * ```typescript\n   * const user = await baasix.auth.me();\n   * console.log(user?.email);\n   * ```\n   */\n  async me(): Promise<User | null> {\n    return this.getUser();\n  }\n\n  /**\n   * Get the cached current user (does not make an API call)\n   *\n   * @example\n   * ```typescript\n   * const user = await baasix.auth.getCachedUser();\n   * ```\n   */\n  async getCachedUser(): Promise<User | null> {\n    if (this.currentUser) {\n      return this.currentUser;\n    }\n\n    const userJson = await this.storage.get(STORAGE_KEYS.USER);\n    if (userJson) {\n      try {\n        this.currentUser = JSON.parse(userJson);\n        return this.currentUser;\n      } catch {\n        return null;\n      }\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if user is authenticated (has valid token)\n   *\n   * @example\n   * ```typescript\n   * if (await baasix.auth.isAuthenticated()) {\n   *   // User is logged in\n   * }\n   * ```\n   */\n  async isAuthenticated(): Promise<boolean> {\n    if (this.authMode === \"cookie\") {\n      // For cookie mode, try to get user\n      const user = await this.getCachedUser();\n      return user !== null;\n    }\n\n    const token = await this.storage.get(STORAGE_KEYS.ACCESS_TOKEN);\n    if (!token) return false;\n\n    // Check expiry\n    const expiry = await this.storage.get(STORAGE_KEYS.TOKEN_EXPIRY);\n    if (expiry && Date.now() >= parseInt(expiry, 10)) {\n      // Token expired, check if we have refresh token\n      const refreshToken = await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);\n      return !!refreshToken;\n    }\n\n    return true;\n  }\n\n  /**\n   * Get the current access token\n   *\n   * @example\n   * ```typescript\n   * const token = await baasix.auth.getToken();\n   * ```\n   */\n  async getToken(): Promise<string | null> {\n    if (this.authMode === \"cookie\") {\n      return null;\n    }\n    return await this.storage.get(STORAGE_KEYS.ACCESS_TOKEN);\n  }\n\n  /**\n   * Set a static token (useful for server-side or service accounts)\n   *\n   * @example\n   * ```typescript\n   * baasix.auth.setToken('your-api-token');\n   * ```\n   */\n  async setToken(token: string): Promise<void> {\n    await this.storage.set(STORAGE_KEYS.ACCESS_TOKEN, token);\n  }\n\n  /**\n   * Refresh the current token\n   *\n   * @example\n   * ```typescript\n   * const tokens = await baasix.auth.refreshToken();\n   * ```\n   */\n  async refreshToken(): Promise<AuthTokens> {\n    const refreshToken = await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);\n\n    const response = await this.client.post<AuthResponse>(\n      \"/auth/refresh\",\n      this.authMode === \"jwt\"\n        ? { refreshToken, authMode: \"jwt\" }\n        : { authMode: \"cookie\" }\n    );\n\n    await this.storeTokens(response);\n\n    const tokens: AuthTokens = {\n      accessToken: response.token,\n      refreshToken: response.refreshToken,\n      expiresIn: response.expiresIn,\n      expiresAt: response.expiresIn\n        ? Date.now() + response.expiresIn * 1000\n        : undefined,\n    };\n\n    this.emitAuthStateChange(\"TOKEN_REFRESHED\", response.user);\n\n    return tokens;\n  }\n\n  /**\n   * Request a magic link for passwordless login\n   *\n   * @example\n   * ```typescript\n   * await baasix.auth.sendMagicLink({\n   *   email: 'user@example.com',\n   *   redirectUrl: 'https://myapp.com/auth/callback'\n   * });\n   * ```\n   */\n  async sendMagicLink(options: MagicLinkOptions): Promise<void> {\n    await this.client.post(\n      \"/auth/magiclink\",\n      {\n        email: options.email,\n        link: options.redirectUrl,\n        mode: options.mode || \"link\",\n      },\n      { skipAuth: true }\n    );\n  }\n\n  /**\n   * Verify magic link/code and complete login\n   *\n   * @example\n   * ```typescript\n   * const { user, token } = await baasix.auth.verifyMagicLink('verification-token');\n   * ```\n   */\n  async verifyMagicLink(token: string): Promise<AuthResponse> {\n    const response = await this.client.get<AuthResponse>(\n      `/auth/magiclink/${encodeURIComponent(token)}`,\n      { skipAuth: true }\n    );\n\n    await this.storeTokens(response);\n    this.emitAuthStateChange(\"SIGNED_IN\", response.user);\n\n    return response;\n  }\n\n  /**\n   * Request a password reset\n   *\n   * @example\n   * ```typescript\n   * await baasix.auth.forgotPassword({\n   *   email: 'user@example.com',\n   *   redirectUrl: 'https://myapp.com/reset-password'\n   * });\n   * ```\n   */\n  async forgotPassword(options: PasswordResetOptions): Promise<void> {\n    await this.client.post(\n      \"/auth/password/reset\",\n      {\n        email: options.email,\n        link: options.redirectUrl,\n      },\n      { skipAuth: true }\n    );\n  }\n\n  /**\n   * Reset password using a reset token\n   *\n   * @example\n   * ```typescript\n   * await baasix.auth.resetPassword('reset-token', 'newpassword123');\n   * ```\n   */\n  async resetPassword(token: string, newPassword: string): Promise<void> {\n    await this.client.post(\n      `/auth/password/reset/${encodeURIComponent(token)}`,\n      { password: newPassword },\n      { skipAuth: true }\n    );\n  }\n\n  /**\n   * Change the current user's password\n   *\n   * @example\n   * ```typescript\n   * await baasix.auth.changePassword('currentPassword', 'newPassword');\n   * ```\n   */\n  async changePassword(\n    currentPassword: string,\n    newPassword: string\n  ): Promise<void> {\n    await this.client.post(\"/auth/password/change\", {\n      currentPassword,\n      newPassword,\n    });\n  }\n\n  /**\n   * Get available tenants for the current user (multi-tenant mode)\n   *\n   * @example\n   * ```typescript\n   * const tenants = await baasix.auth.getTenants();\n   * ```\n   */\n  async getTenants(): Promise<Tenant[]> {\n    const response = await this.client.get<{ tenants: Tenant[] }>(\"/auth/tenants\");\n    return response.tenants;\n  }\n\n  /**\n   * Switch to a different tenant (multi-tenant mode)\n   *\n   * @example\n   * ```typescript\n   * const { user, token } = await baasix.auth.switchTenant('tenant-uuid');\n   * ```\n   */\n  async switchTenant(tenantId: string): Promise<AuthResponse> {\n    const response = await this.client.post<AuthResponse>(\"/auth/switch-tenant\", {\n      tenant_Id: tenantId,\n    });\n\n    await this.storeTokens(response);\n    await this.storage.set(STORAGE_KEYS.TENANT, tenantId);\n    this.emitAuthStateChange(\"TENANT_SWITCHED\", response.user);\n\n    return response;\n  }\n\n  /**\n   * Get the current authentication state\n   *\n   * @example\n   * ```typescript\n   * const state = await baasix.auth.getState();\n   * console.log(state.isAuthenticated, state.user);\n   * ```\n   */\n  async getState(): Promise<AuthState> {\n    const isAuthenticated = await this.isAuthenticated();\n    const user = await this.getCachedUser();\n\n    return {\n      user,\n      isAuthenticated,\n      isLoading: false,\n      error: null,\n    };\n  }\n\n  /**\n   * Initialize authentication state from storage\n   * Call this on app startup to restore previous session\n   *\n   * @example\n   * ```typescript\n   * await baasix.auth.initialize();\n   * ```\n   */\n  async initialize(): Promise<AuthState> {\n    const state = await this.getState();\n\n    if (state.isAuthenticated && state.user) {\n      this.emitAuthStateChange(\"SIGNED_IN\", state.user);\n    }\n\n    return state;\n  }\n\n  // ===================\n  // OAuth / Social Login\n  // ===================\n\n  /**\n   * Get the OAuth authorization URL for a provider\n   * Redirect the user to this URL to start the OAuth flow\n   * \n   * @example\n   * ```typescript\n   * const url = baasix.auth.getOAuthUrl({\n   *   provider: 'google',\n   *   redirectUrl: 'https://myapp.com/auth/callback'\n   * });\n   * window.location.href = url;\n   * ```\n   */\n  getOAuthUrl(options: OAuthOptions): string {\n    const baseUrl = this.client.getBaseUrl();\n    const params = new URLSearchParams({\n      redirect_url: options.redirectUrl,\n    });\n    \n    if (options.scopes?.length) {\n      params.set(\"scopes\", options.scopes.join(\",\"));\n    }\n    if (options.state) {\n      params.set(\"state\", options.state);\n    }\n\n    return `${baseUrl}/auth/signin/${options.provider}?${params.toString()}`;\n  }\n\n  /**\n   * Handle OAuth callback and complete login\n   * Call this from your callback page with the token from URL\n   * \n   * @example\n   * ```typescript\n   * // In your callback page\n   * const params = new URLSearchParams(window.location.search);\n   * const token = params.get('token');\n   * \n   * if (token) {\n   *   await baasix.auth.handleOAuthCallback(token);\n   * }\n   * ```\n   */\n  async handleOAuthCallback(token: string): Promise<AuthResponse> {\n    // Store the token\n    await this.storage.set(STORAGE_KEYS.ACCESS_TOKEN, token);\n    \n    // Get user info\n    const user = await this.getUser();\n    \n    const response: AuthResponse = {\n      token,\n      user: user!,\n    };\n    \n    this.emitAuthStateChange(\"SIGNED_IN\", user);\n    return response;\n  }\n\n  // ===================\n  // Email Verification\n  // ===================\n\n  /**\n   * Request email verification\n   * Sends a verification email to the current user\n   * \n   * @example\n   * ```typescript\n   * await baasix.auth.requestEmailVerification('https://myapp.com/verify-email');\n   * ```\n   */\n  async requestEmailVerification(redirectUrl: string): Promise<void> {\n    await this.client.post(\"/auth/email/verify\", {\n      link: redirectUrl,\n    });\n  }\n\n  /**\n   * Verify email with token\n   * \n   * @example\n   * ```typescript\n   * const params = new URLSearchParams(window.location.search);\n   * const token = params.get('token');\n   * \n   * await baasix.auth.verifyEmail(token);\n   * ```\n   */\n  async verifyEmail(token: string): Promise<void> {\n    await this.client.get(`/auth/email/verify/${encodeURIComponent(token)}`, {\n      skipAuth: true,\n    });\n  }\n\n  /**\n   * Check if current session/token is valid\n   * \n   * @example\n   * ```typescript\n   * const isValid = await baasix.auth.checkSession();\n   * ```\n   */\n  async checkSession(): Promise<boolean> {\n    try {\n      const response = await this.client.get<{ valid: boolean }>(\"/auth/check\");\n      return response.valid;\n    } catch {\n      return false;\n    }\n  }\n\n  // ===================\n  // Invitation System\n  // ===================\n\n  /**\n   * Send an invitation to a user (multi-tenant mode)\n   * \n   * @example\n   * ```typescript\n   * await baasix.auth.sendInvite({\n   *   email: 'newuser@example.com',\n   *   roleId: 'role-uuid',\n   *   tenantId: 'tenant-uuid',\n   *   redirectUrl: 'https://myapp.com/accept-invite'\n   * });\n   * ```\n   */\n  async sendInvite(options: InviteOptions): Promise<void> {\n    await this.client.post(\"/auth/invite\", {\n      email: options.email,\n      role_Id: options.roleId,\n      tenant_Id: options.tenantId,\n      link: options.redirectUrl,\n    });\n  }\n\n  /**\n   * Verify an invitation token\n   * \n   * @example\n   * ```typescript\n   * const params = new URLSearchParams(window.location.search);\n   * const token = params.get('token');\n   * \n   * const result = await baasix.auth.verifyInvite(token);\n   * if (result.valid) {\n   *   // Show registration form with pre-filled email\n   * }\n   * ```\n   */\n  async verifyInvite(token: string, redirectUrl?: string): Promise<VerifyInviteResult> {\n    const response = await this.client.get<VerifyInviteResult>(\n      `/auth/verify-invite/${encodeURIComponent(token)}`,\n      {\n        params: {\n          link: redirectUrl,\n        },\n        skipAuth: true,\n      }\n    );\n    return response;\n  }\n\n  /**\n   * Accept an invitation (for existing users)\n   * \n   * @example\n   * ```typescript\n   * await baasix.auth.acceptInvite(token);\n   * ```\n   */\n  async acceptInvite(token: string): Promise<AuthResponse> {\n    const response = await this.client.post<AuthResponse>(\n      \"/auth/accept-invite\",\n      { inviteToken: token }\n    );\n\n    await this.storeTokens(response);\n    this.emitAuthStateChange(\"SIGNED_IN\", response.user);\n\n    return response;\n  }\n\n  /**\n   * Register with an invitation token\n   * \n   * @example\n   * ```typescript\n   * const { user, token } = await baasix.auth.registerWithInvite({\n   *   email: 'user@example.com',\n   *   password: 'password',\n   *   firstName: 'John',\n   *   lastName: 'Doe',\n   *   inviteToken: 'invite-token'\n   * });\n   * ```\n   */\n  async registerWithInvite(data: RegisterData & { inviteToken: string }): Promise<AuthResponse> {\n    const response = await this.client.post<AuthResponse>(\n      \"/auth/register\",\n      {\n        ...data,\n        inviteToken: data.inviteToken,\n      },\n      { skipAuth: true }\n    );\n\n    await this.storeTokens(response);\n    this.emitAuthStateChange(\"SIGNED_IN\", response.user);\n\n    return response;\n  }\n}\n\n// Re-export types from types.ts\nexport type {\n  AuthResponse,\n  AuthState,\n  AuthStateEvent,\n  AuthTokens,\n  LoginCredentials,\n  MagicLinkOptions,\n  PasswordResetOptions,\n  RegisterData,\n  Tenant,\n  User,\n};\n"]}
+{"version":3,"sources":["../../src/storage/types.ts","../../src/types.ts","../../src/modules/auth.ts"],"names":[],"mappings":";AAkCO,IAAM,YAAA,GAAe;AAAA,EAC1B,YAAA,EAAc,qBAAA;AAAA,EACd,aAAA,EAAe,sBAAA;AAAA,EACf,YAAA,EAAc,qBAAA;AAAA,EACd,IAAA,EAAM,aAAA;AAAA,EACN,MAAA,EAAQ;AACV,CAAA;;;ACqPO,IAAM,WAAA,GAAN,MAAM,YAAA,SAAoB,KAAA,CAAM;AAAA,EACrB,MAAA;AAAA,EACA,IAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EAEhB,WAAA,CACE,OAAA,EACA,MAAA,GAAS,GAAA,EACT,MACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,WAAA,GAAc,MAAA,IAAU,GAAA,IAAO,MAAA,KAAW,GAAA;AAG/C,IAAA,IAAI,MAAM,iBAAA,EAAmB;AAC3B,MAAA,KAAA,CAAM,iBAAA,CAAkB,MAAM,YAAW,CAAA;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAA,GAAS;AACP,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,SAAS,IAAA,CAAK;AAAA,KAChB;AAAA,EACF;AACF,CAAA;;;AC7SO,IAAM,mBAAmB,CAAC,OAAA,EAAQ,WAAA,EAAY,SAAA,EAAU,WAAU,SAAA,EAAU,UAAA,EAAW,OAAA,EAAQ,QAAA,EAAS,UAAS,QAAA,EAAS,aAAA,EAAc,OAAA,EAAQ,MAAA,EAAO,QAAO,QAAA,EAAS,UAAA,EAAW,WAAA,EAAY,OAAA,EAAQ,UAAS,QAAA,EAAS,QAAA,EAAS,OAAA,EAAQ,SAAA,EAAU,UAAS,QAAA,EAAS,YAAA,EAAa,OAAA,EAAQ,SAAA,EAAU,UAAS,QAAA,EAAS,SAAA,EAAU,QAAA,EAAS,IAAA,EAAK,UAAS,MAAM;AAgF7V,IAAM,aAAN,MAAiB;AAAA,EACd,MAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,WAAA,GAA2B,IAAA;AAAA,EAC3B,gBAAA,GAAuC,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAatC,SAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6BF,OAAA,GAAU;AAAA,IACf,QAAA,EAAU,OAAO,IAAA,KAAkD;AACjE,MAAA,IAAA,CAAK,aAAA,EAAc;AACnB,MAAA,MAAM,EAAE,iBAAA,EAAkB,GAAI,MAAM,OAAO,yBAAyB,CAAA;AACpE,MAAA,MAAM,UAAU,MAAM,IAAA,CAAK,OAAO,IAAA,CAAU,gCAAA,EAAkC,EAAE,CAAA;AAChF,MAAA,MAAM,cAAc,MAAM,iBAAA,CAAkB,EAAE,WAAA,EAAa,SAAS,CAAA;AACpE,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,+BAAA,EAAiC;AAAA,QACtD,QAAA,EAAU,WAAA;AAAA,QACV,MAAM,IAAA,IAAQ;AAAA,OACf,CAAA;AACD,MAAA,OAAO,EAAE,UAAU,IAAA,EAAK;AAAA,IAC1B,CAAA;AAAA,IAEA,YAAA,EAAc,OAAO,IAAA,KAA0D;AAC7E,MAAA,IAAA,CAAK,aAAA,EAAc;AACnB,MAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,MAAM,OAAO,yBAAyB,CAAA;AACtE,MAAA,MAAM,EAAE,OAAA,EAAS,WAAA,EAAY,GAAI,MAAM,KAAK,MAAA,CAAO,IAAA;AAAA,QACjD,oCAAA;AAAA,QACA,EAAC;AAAA,QACD,EAAE,UAAU,IAAA;AAAK,OACnB;AACA,MAAA,MAAM,YAAY,MAAM,mBAAA,CAAoB,EAAE,WAAA,EAAa,SAAS,CAAA;AACpE,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,QACjC,mCAAA;AAAA,QACA,EAAE,WAAA,EAAa,QAAA,EAAU,SAAA,EAAW,QAAA,EAAU,MAAM,QAAA,EAAS;AAAA,QAC7D,EAAE,UAAU,IAAA;AAAK,OACnB;AAEA,MAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,MAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,QAAA,CAAS,IAAI,CAAA;AAEnD,MAAA,OAAO,QAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,YAAA,CACH,MAAM,KAAK,MAAA,CAAO,GAAA,CAA6B,eAAe,CAAA,EAAG,QAAA;AAAA,IAEpE,MAAA,EAAQ,OAAO,EAAA,KAA8B;AAC3C,MAAA,MAAM,KAAK,MAAA,CAAO,MAAA,CAAO,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,IACpE;AAAA,GACF;AAAA,EAEA,YAAY,MAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AACrB,IAAA,IAAA,CAAK,UAAU,MAAA,CAAO,OAAA;AACtB,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,QAAA;AACvB,IAAA,IAAA,CAAK,oBAAoB,MAAA,CAAO,iBAAA;AAEhC,IAAA,IAAA,CAAK,SAAA,GAAY;AAAA,MACf,MAAA,EAAQ,OACN,cAAA,EACA,IAAA,EACA,IAAA,KAC0B;AAC1B,QAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,UACjC,kBAAA;AAAA,UACA;AAAA,YACE,cAAA;AAAA,YACA,IAAA;AAAA,YACA,UAAU,IAAA,EAAM,QAAA;AAAA,YAChB,UAAU,IAAA,EAAM;AAAA,WAClB;AAAA,UACA,EAAE,UAAU,IAAA;AAAK,SACnB;AAEA,QAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,QAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,QAAA,CAAS,IAAI,CAAA;AAEnD,QAAA,OAAO,QAAA;AAAA,MACT,CAAA;AAAA,MAEA,QAAQ,MAAsC;AAC5C,QAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAA4B,kBAAkB,CAAA;AAAA,MACnE,CAAA;AAAA,MAEA,WAAA,EAAa,CAAC,IAAA,KAAgD;AAC5D,QAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAA2B,wBAAA,EAA0B;AAAA,UACtE;AAAA,SACD,CAAA;AAAA,MACH,CAAA;AAAA,MAEA,OAAA,EAAS,CAAC,QAAA,KAAqD;AAC7D,QAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAA4B,mBAAA,EAAqB;AAAA,UAClE;AAAA,SACD,CAAA;AAAA,MACH;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAA,GAAsB;AAC5B,IAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,CAAE,OAAe,mBAAA,EAAqB;AACzE,MAAA,MAAM,IAAI,WAAA,CAAY,0CAAA,EAA4C,GAAG,CAAA;AAAA,IACvE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,mBAAA,CAAoB,OAAuB,IAAA,EAAyB;AAC1E,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,iBAAA,GAAoB,OAAO,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YAAY,QAAA,EAAuC;AAC/D,IAAA,IAAI,IAAA,CAAK,aAAa,KAAA,EAAO;AAC3B,MAAA,MAAM,KAAK,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,YAAA,EAAc,SAAS,KAAK,CAAA;AAEhE,MAAA,IAAI,SAAS,YAAA,EAAc;AACzB,QAAA,MAAM,KAAK,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,aAAA,EAAe,SAAS,YAAY,CAAA;AAAA,MAC1E;AAEA,MAAA,IAAI,SAAS,SAAA,EAAW;AACtB,QAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAS,SAAA,GAAY,GAAA;AACpD,QAAA,MAAM,KAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,EAAc,SAAA,CAAU,UAAU,CAAA;AAAA,MACxE;AAAA,IACF;AAGA,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,MAAM,IAAA,CAAK,QAAQ,GAAA,CAAI,YAAA,CAAa,MAAM,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AAAA,IACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,SAAA,GAA2B;AACvC,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,YAAA,CAAa,YAAY,CAAA;AACnD,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,YAAA,CAAa,aAAa,CAAA;AACpD,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,YAAA,CAAa,YAAY,CAAA;AACnD,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,YAAA,CAAa,IAAI,CAAA;AAC3C,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,YAAA,CAAa,MAAM,CAAA;AAC7C,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,SAAS,IAAA,EAA2C;AACxD,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAmB,kBAAkB,IAAA,EAAM;AAAA,MAC5E,QAAA,EAAU;AAAA,KACX,CAAA;AAED,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,IAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,QAAA,CAAS,IAAI,CAAA;AAEnD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BA,MAAM,MAAM,WAAA,EAAqD;AAC/D,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MACjC,aAAA;AAAA,MACA;AAAA,QACE,OAAO,WAAA,CAAY,KAAA;AAAA,QACnB,UAAU,WAAA,CAAY,QAAA;AAAA,QACtB,WAAW,WAAA,CAAY,QAAA;AAAA,QACvB,UAAU,WAAA,CAAY,QAAA;AAAA,QACtB,UAAU,WAAA,CAAY;AAAA,OACxB;AAAA,MACA,EAAE,UAAU,IAAA;AAAK,KACnB;AAEA,IAAA,IAAI,mBAAA,IAAuB,QAAA,IAAY,QAAA,CAAS,iBAAA,EAAmB;AACjE,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,YAAA,GAAe,QAAA;AACrB,IAAA,MAAM,IAAA,CAAK,YAAY,YAAY,CAAA;AACnC,IAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,YAAA,CAAa,IAAI,CAAA;AAEvD,IAAA,OAAO,YAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,cAAA,CAAe,KAAA,GAAQ,KAAA,EAA6B;AACxD,IAAA,IAAI,IAAA,CAAK,gBAAA,IAAoB,CAAC,KAAA,EAAO;AACnC,MAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,IACd;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA;AAAA,MACjC,GAAA;AAAA,MACA,EAAE,UAAU,IAAA;AAAK,KACnB;AAEA,IAAA,MAAM,WAAA,GAAc,UAAU,OAAA,EAAS,IAAA;AACvC,IAAA,IAAA,CAAK,gBAAA,GAAmB,WAAA;AAExB,IAAA,OAAO,WAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,MAAA,GAAwB;AAC5B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA;AAAA,IACtC,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,IAAA,CAAK,mBAAA,CAAoB,cAAc,IAAI,CAAA;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAAA,GAAgC;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAoB,UAAU,CAAA;AACjE,MAAA,IAAA,CAAK,cAAc,QAAA,CAAS,IAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,QAAQ,GAAA,CAAI,YAAA,CAAa,MAAM,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AACvE,MAAA,OAAO,QAAA,CAAS,IAAA;AAAA,IAClB,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,KAAA,YAAiB,WAAA,IAAe,KAAA,CAAM,MAAA,KAAW,GAAA,EAAK;AACxD,QAAA,MAAM,KAAK,SAAA,EAAU;AACrB,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,EAAA,GAA2B;AAC/B,IAAA,OAAO,KAAK,OAAA,EAAQ;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAA,GAAsC;AAC1C,IAAA,IAAI,KAAK,WAAA,EAAa;AACpB,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACd;AAEA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,IAAI,CAAA;AACzD,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AACtC,QAAA,OAAO,IAAA,CAAK,WAAA;AAAA,MACd,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,eAAA,GAAoC;AACxC,IAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAE9B,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,aAAA,EAAc;AACtC,MAAA,OAAO,IAAA,KAAS,IAAA;AAAA,IAClB;AAEA,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAY,CAAA;AAC9D,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AAGnB,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAY,CAAA;AAC/D,IAAA,IAAI,UAAU,IAAA,CAAK,GAAA,MAAS,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA,EAAG;AAEhD,MAAA,MAAM,eAAe,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,aAAa,CAAA;AACtE,MAAA,OAAO,CAAC,CAAC,YAAA;AAAA,IACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAA,GAAmC;AACvC,IAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAY,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,SAAS,KAAA,EAA8B;AAC3C,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,cAAc,KAAK,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YAAA,GAAoC;AACxC,IAAA,MAAM,eAAe,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,aAAa,CAAA;AAEtE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MACjC,eAAA;AAAA,MACA,IAAA,CAAK,QAAA,KAAa,KAAA,GACd,EAAE,YAAA,EAAc,UAAU,KAAA,EAAM,GAChC,EAAE,QAAA,EAAU,QAAA;AAAS,KAC3B;AAEA,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAE/B,IAAA,MAAM,MAAA,GAAqB;AAAA,MACzB,aAAa,QAAA,CAAS,KAAA;AAAA,MACtB,cAAc,QAAA,CAAS,YAAA;AAAA,MACvB,WAAW,QAAA,CAAS,SAAA;AAAA,MACpB,SAAA,EAAW,SAAS,SAAA,GAChB,IAAA,CAAK,KAAI,GAAI,QAAA,CAAS,YAAY,GAAA,GAClC;AAAA,KACN;AAEA,IAAA,IAAA,CAAK,mBAAA,CAAoB,iBAAA,EAAmB,QAAA,CAAS,IAAI,CAAA;AAEzD,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,cAAc,OAAA,EAA0C;AAC5D,IAAA,MAAM,KAAK,MAAA,CAAO,IAAA;AAAA,MAChB,iBAAA;AAAA,MACA;AAAA,QACE,OAAO,OAAA,CAAQ,KAAA;AAAA,QACf,MAAM,OAAA,CAAQ,WAAA;AAAA,QACd,IAAA,EAAM,QAAQ,IAAA,IAAQ;AAAA,OACxB;AAAA,MACA,EAAE,UAAU,IAAA;AAAK,KACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,gBAAgB,KAAA,EAAsC;AAC1D,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA;AAAA,MACjC,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA,MAC5C,EAAE,UAAU,IAAA;AAAK,KACnB;AAEA,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,IAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,QAAA,CAAS,IAAI,CAAA;AAEnD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,eAAe,OAAA,EAA8C;AACjE,IAAA,MAAM,KAAK,MAAA,CAAO,IAAA;AAAA,MAChB,sBAAA;AAAA,MACA;AAAA,QACE,OAAO,OAAA,CAAQ,KAAA;AAAA,QACf,MAAM,OAAA,CAAQ;AAAA,OAChB;AAAA,MACA,EAAE,UAAU,IAAA;AAAK,KACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAA,CAAc,KAAA,EAAe,WAAA,EAAoC;AACrE,IAAA,MAAM,KAAK,MAAA,CAAO,IAAA;AAAA,MAChB,CAAA,qBAAA,EAAwB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA,MACjD,EAAE,UAAU,WAAA,EAAY;AAAA,MACxB,EAAE,UAAU,IAAA;AAAK,KACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAA,CACJ,eAAA,EACA,WAAA,EACe;AACf,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,uBAAA,EAAyB;AAAA,MAC9C,eAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,UAAA,GAAgC;AACpC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAA2B,eAAe,CAAA;AAC7E,IAAA,OAAO,QAAA,CAAS,OAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAa,QAAA,EAAyC;AAC1D,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,KAAmB,qBAAA,EAAuB;AAAA,MAC3E,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,QAAQ,QAAQ,CAAA;AACpD,IAAA,IAAA,CAAK,mBAAA,CAAoB,iBAAA,EAAmB,QAAA,CAAS,IAAI,CAAA;AAEzD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,QAAA,GAA+B;AACnC,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,eAAA,EAAgB;AACnD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,aAAA,EAAc;AAEtC,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA,EAAW,KAAA;AAAA,MACX,KAAA,EAAO;AAAA,KACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,UAAA,GAAiC;AACrC,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,EAAS;AAElC,IAAA,IAAI,KAAA,CAAM,eAAA,IAAmB,KAAA,CAAM,IAAA,EAAM;AACvC,MAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,KAAA,CAAM,IAAI,CAAA;AAAA,IAClD;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,YAAY,OAAA,EAA+B;AACzC,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,MAAA,CAAO,UAAA,EAAW;AACvC,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MACjC,cAAc,OAAA,CAAQ;AAAA,KACvB,CAAA;AAED,IAAA,IAAI,OAAA,CAAQ,QAAQ,MAAA,EAAQ;AAC1B,MAAA,MAAA,CAAO,IAAI,QAAA,EAAU,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IAC/C;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,OAAA,CAAQ,KAAK,CAAA;AAAA,IACnC;AAEA,IAAA,OAAO,CAAA,EAAG,OAAO,CAAA,aAAA,EAAgB,OAAA,CAAQ,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,UAAU,CAAA,CAAA;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,oBAAoB,KAAA,EAAsC;AAE9D,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,cAAc,KAAK,CAAA;AAGvD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,EAAQ;AAEhC,IAAA,MAAM,QAAA,GAAyB;AAAA,MAC7B,KAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,IAAA,CAAK,mBAAA,CAAoB,aAAa,IAAI,CAAA;AAC1C,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,yBAAyB,WAAA,EAAoC;AACjE,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,oBAAA,EAAsB;AAAA,MAC3C,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,YAAY,KAAA,EAA8B;AAC9C,IAAA,MAAM,KAAK,MAAA,CAAO,GAAA,CAAI,sBAAsB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA,EAAI;AAAA,MACvE,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YAAA,GAAiC;AACrC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAwB,aAAa,CAAA;AACxE,MAAA,OAAO,QAAA,CAAS,KAAA;AAAA,IAClB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,WAAW,OAAA,EAAuC;AACtD,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,cAAA,EAAgB;AAAA,MACrC,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,SAAS,OAAA,CAAQ,MAAA;AAAA,MACjB,WAAW,OAAA,CAAQ,QAAA;AAAA,MACnB,MAAM,OAAA,CAAQ;AAAA,KACf,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,YAAA,CAAa,KAAA,EAAe,WAAA,EAAmD;AACnF,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA;AAAA,MACjC,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA,MAChD;AAAA,QACE,MAAA,EAAQ;AAAA,UACN,IAAA,EAAM;AAAA,SACR;AAAA,QACA,QAAA,EAAU;AAAA;AACZ,KACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAa,KAAA,EAAsC;AACvD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MACjC,qBAAA;AAAA,MACA,EAAE,aAAa,KAAA;AAAM,KACvB;AAEA,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,IAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,QAAA,CAAS,IAAI,CAAA;AAEnD,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,mBAAmB,IAAA,EAAqE;AAC5F,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,MACjC,gBAAA;AAAA,MACA;AAAA,QACE,GAAG,IAAA;AAAA,QACH,aAAa,IAAA,CAAK;AAAA,OACpB;AAAA,MACA,EAAE,UAAU,IAAA;AAAK,KACnB;AAEA,IAAA,MAAM,IAAA,CAAK,YAAY,QAAQ,CAAA;AAC/B,IAAA,IAAA,CAAK,mBAAA,CAAoB,WAAA,EAAa,QAAA,CAAS,IAAI,CAAA;AAEnD,IAAA,OAAO,QAAA;AAAA,EACT;AACF","file":"auth.js","sourcesContent":["/**\n * Storage adapter interface for persisting authentication state.\n * Implement this interface to create custom storage solutions (e.g., AsyncStorage for React Native).\n */\nexport interface StorageAdapter {\n  /**\n   * Get a value from storage\n   * @param key - The storage key\n   * @returns The stored value or null if not found\n   */\n  get(key: string): Promise<string | null> | string | null;\n\n  /**\n   * Set a value in storage\n   * @param key - The storage key\n   * @param value - The value to store\n   */\n  set(key: string, value: string): Promise<void> | void;\n\n  /**\n   * Remove a value from storage\n   * @param key - The storage key\n   */\n  remove(key: string): Promise<void> | void;\n\n  /**\n   * Clear all SDK-related values from storage\n   */\n  clear?(): Promise<void> | void;\n}\n\n/**\n * Storage keys used by the SDK\n */\nexport const STORAGE_KEYS = {\n  ACCESS_TOKEN: \"baasix_access_token\",\n  REFRESH_TOKEN: \"baasix_refresh_token\",\n  TOKEN_EXPIRY: \"baasix_token_expiry\",\n  USER: \"baasix_user\",\n  TENANT: \"baasix_tenant\",\n} as const;\n\nexport type StorageKey = (typeof STORAGE_KEYS)[keyof typeof STORAGE_KEYS];\n","/**\n * Baasix SDK Types\n *\n * This file re-exports shared types from @baasix/types and defines\n * SDK-specific types that are not shared with other packages.\n */\n\nimport type { StorageAdapter } from \"./storage/types\";\n\n// ============================================================================\n// Re-export shared types from @baasix/types\n// ============================================================================\n\n// Auth types\nexport type {\n  User,\n  UserWithPassword,\n  UserWithRolesAndPermissions,\n  Role,\n  PermissionAction,\n  Permission,\n  PermissionData,\n  CreatePermissionData,\n  Tenant,\n  Session,\n  AuthTokens,\n  JWTPayload,\n  Accountability,\n  LoginCredentials,\n  RegisterData,\n  AuthResponse,\n  AuthStateEvent,\n  AuthState,\n  MagicLinkOptions,\n  PasswordResetOptions,\n  OAuth2Tokens,\n  OAuth2UserInfo,\n} from \"@baasix/types\";\n\n// Schema types\nexport type {\n  FieldType,\n  DefaultValueType,\n  FieldValidationRules,\n  FieldValues,\n  FieldDefinition,\n  FlattenedField,\n  FieldInfo,\n  IndexDefinition,\n  SchemaDefinition,\n  SchemaInfo,\n  SchemaValidation,\n  FieldValidation,\n  ValidationResult,\n  RelationshipType,\n  AssociationType,\n  RelationshipDefinition,\n  AssociationDefinition,\n  IncludeConfig,\n  ProcessedInclude,\n} from \"@baasix/types\";\n\n// Query types\nexport type {\n  FilterOperator,\n  FilterValue,\n  FilterCondition,\n  LogicalFilter,\n  Filter,\n  FilterObject,\n  SortDirection,\n  Sort,\n  SortItem,\n  SortObject,\n  PaginationOptions,\n  PaginationMetadata,\n  AggregateFunction,\n  AggregateConfig,\n  Aggregate,\n  DatePart,\n  DateTruncPrecision,\n  QueryParams,\n  QueryOptions,\n  QueryContext,\n} from \"@baasix/types\";\n\n// Response types\nexport type {\n  PaginatedResponse,\n  SingleResponse,\n  MutationResponse,\n  DeleteResponse,\n  BulkResponse,\n  ReadResult,\n  ErrorResponse,\n} from \"@baasix/types\";\n\n// File types\nexport type {\n  FileMetadata,\n  FileData,\n  UploadOptions,\n  InternalUploadedFile,\n  AssetTransformOptions,\n  AssetQuery,\n  ProcessedImage,\n  StorageProvider,\n} from \"@baasix/types\";\n\n// Workflow types\nexport type {\n  WorkflowTriggerType,\n  WorkflowStatus,\n  Workflow,\n  WorkflowFlowData,\n  WorkflowTrigger,\n  WorkflowNode,\n  WorkflowNodeData,\n  WorkflowEdge,\n  WorkflowExecutionStatus,\n  WorkflowExecution,\n  WorkflowExecutionLog,\n} from \"@baasix/types\";\n\n// Notification types\nexport type {\n  NotificationType,\n  Notification,\n  NotificationOptions,\n  SendNotificationData,\n} from \"@baasix/types\";\n\n// Common types\nexport type {\n  BaseItem,\n  TimestampedItem,\n  SoftDeletableItem,\n  DeepPartial,\n  CollectionItem,\n  WithRequired,\n  WithOptional,\n  KeysOfType,\n  AnyRecord,\n  Settings,\n  TenantSettings,\n  // Import/Export types\n  UploadedFile,\n  ImportOptions,\n  ExportOptions,\n  ImportResult,\n  ExportResult,\n  // Stats types\n  StatsQuery,\n  StatsResult,\n  // Task types\n  BackgroundTask,\n  // Report types\n  ReportConfig,\n  ReportResult,\n  // Spatial types\n  GeoJSONPoint,\n  GeoJSONLineString,\n  GeoJSONPolygon,\n  GeoJSONGeometry,\n  // Hook types\n  HookEvent,\n  HookContext,\n  HookHandler,\n  Hook,\n  // HTTP types\n  HttpMethod,\n  // Mail types\n  MailOptions,\n  SenderConfig,\n  // Seed types\n  SeedData,\n  SeedResult,\n  // Cache types\n  CacheConfig,\n  CacheStrategy,\n} from \"@baasix/types\";\n\n// Import types needed for SDK-specific interfaces\nimport type { User, AuthStateEvent } from \"@baasix/types\";\n\n// Auth mode (re-exported from @baasix/types)\nexport type { AuthMode } from \"@baasix/types\";\n\n// Import for internal use\nimport type { AuthMode } from \"@baasix/types\";\n\n// ============================================================================\n// SDK-Specific Types (not shared)\n// ============================================================================\n\n/**\n * SDK Configuration options\n */\nexport interface BaasixConfig {\n  /**\n   * The base URL of your Baasix instance\n   * @example 'https://api.example.com' or 'http://localhost:8056'\n   */\n  url: string;\n\n  /**\n   * Authentication mode\n   * @default 'jwt'\n   */\n  authMode?: AuthMode;\n\n  /**\n   * Storage adapter for persisting tokens and user data\n   * @default LocalStorageAdapter (web) or MemoryStorageAdapter (SSR)\n   */\n  storage?: StorageAdapter;\n\n  /**\n   * Static access token (useful for server-side or service accounts)\n   * When provided, this token is used instead of stored tokens\n   */\n  token?: string;\n\n  /**\n   * Custom headers to include in all requests\n   */\n  headers?: Record<string, string>;\n\n  /**\n   * Request timeout in milliseconds\n   * @default 30000 (30 seconds)\n   */\n  timeout?: number;\n\n  /**\n   * Whether to automatically refresh tokens before expiry\n   * @default true\n   */\n  autoRefresh?: boolean;\n\n  /**\n   * Credentials mode for fetch requests (important for cookies)\n   * @default 'include' for cookie mode, 'same-origin' for jwt mode\n   */\n  credentials?: RequestCredentials;\n\n  /**\n   * Tenant ID for multi-tenant mode\n   */\n  tenantId?: string;\n\n  /**\n   * Global error handler\n   */\n  onError?: (error: BaasixError) => void;\n\n  /**\n   * Called when authentication state changes\n   */\n  onAuthStateChange?: (event: AuthStateEvent, user: User | null) => void;\n\n  /**\n   * WebSocket server URL for realtime features\n   * @default Same as url\n   */\n  socketUrl?: string;\n\n  /**\n   * WebSocket path\n   * @default '/socket'\n   */\n  socketPath?: string;\n}\n\n// ============================================================================\n// Error Types (SDK-specific implementation)\n// ============================================================================\n\nexport interface BaasixErrorDetails {\n  code?: string;\n  field?: string;\n  message?: string;\n  [key: string]: unknown;\n}\n\nexport class BaasixError extends Error {\n  public readonly status: number;\n  public readonly code?: string;\n  public readonly details?: BaasixErrorDetails[];\n  public readonly isRetryable: boolean;\n\n  constructor(\n    message: string,\n    status = 500,\n    code?: string,\n    details?: BaasixErrorDetails[]\n  ) {\n    super(message);\n    this.name = \"BaasixError\";\n    this.status = status;\n    this.code = code;\n    this.details = details;\n    this.isRetryable = status >= 500 || status === 429;\n\n    // Maintains proper stack trace for where error was thrown\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, BaasixError);\n    }\n  }\n\n  toJSON() {\n    return {\n      name: this.name,\n      message: this.message,\n      status: this.status,\n      code: this.code,\n      details: this.details,\n    };\n  }\n}\n","import type { HttpClient } from \"../client\";\r\nimport type { StorageAdapter } from \"../storage/types\";\r\nimport { STORAGE_KEYS } from \"../storage/types\";\r\nimport type {\r\n  AuthMode,\r\n  AuthResponse,\r\n  AuthState,\r\n  AuthStateEvent,\r\n  AuthTokens,\r\n  LoginCredentials,\r\n  MagicLinkOptions,\r\n  PasswordResetOptions,\r\n  RegisterData,\r\n  Tenant,\r\n  User,\r\n} from \"../types\";\r\nimport { BaasixError } from \"../types\";\r\n\r\nexport const SOCIAL_PROVIDERS = [\"apple\",\"atlassian\",\"cognito\",\"discord\",\"dropbox\",\"facebook\",\"figma\",\"github\",\"gitlab\",\"google\",\"huggingface\",\"kakao\",\"kick\",\"line\",\"linear\",\"linkedin\",\"microsoft\",\"naver\",\"notion\",\"paybin\",\"paypal\",\"polar\",\"railway\",\"reddit\",\"roblox\",\"salesforce\",\"slack\",\"spotify\",\"tiktok\",\"twitch\",\"twitter\",\"vercel\",\"vk\",\"wechat\",\"zoom\"] as const;\r\nexport type OAuthProvider = (typeof SOCIAL_PROVIDERS)[number];\r\n\r\nexport interface OAuthOptions {\r\n  provider: OAuthProvider;\r\n  redirectUrl: string;\r\n  scopes?: string[];\r\n  state?: string;\r\n}\r\n\r\nexport interface AuthMethods {\r\n  registration: boolean;\r\n  emailPassword: boolean;\r\n  magicLink: boolean;\r\n  passkey: boolean;\r\n  twoFactor: boolean;\r\n  socialProviders: OAuthProvider[];\r\n}\r\n\r\nexport interface TwoFactorChallengeResponse {\r\n  twoFactorRequired: true;\r\n  twoFactorToken: string;\r\n}\r\n\r\nexport type LoginResult = AuthResponse | TwoFactorChallengeResponse;\r\n\r\nexport interface TwoFactorEnableResult {\r\n  secret: string;\r\n  otpauthUrl: string;\r\n  backupCodes: string[];\r\n}\r\n\r\nexport interface InviteOptions {\r\n  email: string;\r\n  roleId: string;\r\n  tenantId?: string;\r\n  redirectUrl: string;\r\n}\r\n\r\nexport interface VerifyInviteResult {\r\n  valid: boolean;\r\n  email?: string;\r\n  tenantId?: string;\r\n  roleId?: string;\r\n}\r\n\r\nexport interface Passkey {\r\n  id: string;\r\n  name: string | null;\r\n  deviceType: string;\r\n  backedUp: boolean;\r\n  createdAt: string;\r\n  lastUsedAt: string | null;\r\n}\r\n\r\nexport interface AuthModuleConfig {\r\n  client: HttpClient;\r\n  storage: StorageAdapter;\r\n  authMode: AuthMode;\r\n  onAuthStateChange?: (event: AuthStateEvent, user: User | null) => void;\r\n}\r\n\r\n/**\r\n * Authentication module for handling user authentication, sessions, and token management.\r\n *\r\n * @example\r\n * ```typescript\r\n * // Login\r\n * const { user, token } = await baasix.auth.login({\r\n *   email: 'user@example.com',\r\n *   password: 'password123'\r\n * });\r\n *\r\n * // Get current user\r\n * const user = await baasix.auth.getUser();\r\n *\r\n * // Logout\r\n * await baasix.auth.logout();\r\n * ```\r\n */\r\nexport class AuthModule {\r\n  private client: HttpClient;\r\n  private storage: StorageAdapter;\r\n  private authMode: AuthMode;\r\n  private onAuthStateChange?: (event: AuthStateEvent, user: User | null) => void;\r\n  private currentUser: User | null = null;\r\n  private authMethodsCache: AuthMethods | null = null;\r\n\r\n  /**\r\n   * Two-factor authentication (TOTP) helpers.\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const result = await baasix.auth.login({ email, password });\r\n   * if (\"twoFactorRequired\" in result && result.twoFactorRequired) {\r\n   *   const { user, token } = await baasix.auth.twoFactor.verify(result.twoFactorToken, code);\r\n   * }\r\n   * ```\r\n   */\r\n  readonly twoFactor: {\r\n    verify(\r\n      twoFactorToken: string,\r\n      code: string,\r\n      opts?: { authMode?: AuthMode; authType?: string }\r\n    ): Promise<AuthResponse>;\r\n    enable(): Promise<TwoFactorEnableResult>;\r\n    verifySetup(code: string): Promise<{ enabled: boolean }>;\r\n    disable(password: string): Promise<{ disabled: boolean }>;\r\n  };\r\n\r\n  /**\r\n   * Passkey (WebAuthn) registration and authentication helpers.\r\n   * Browser-only: throws a `BaasixError` when called outside a browser\r\n   * environment (no `window`/`PublicKeyCredential`).\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * // Register a passkey for the currently logged-in user\r\n   * await baasix.auth.passkey.register(\"My Laptop\");\r\n   *\r\n   * // Authenticate with a passkey (no prior login required)\r\n   * const { user, token } = await baasix.auth.passkey.authenticate();\r\n   *\r\n   * // List and remove registered passkeys\r\n   * const passkeys = await baasix.auth.passkey.list();\r\n   * await baasix.auth.passkey.remove(passkeys[0].id);\r\n   * ```\r\n   */\r\n  public passkey = {\r\n    register: async (name?: string): Promise<{ verified: boolean }> => {\r\n      this.assertBrowser();\r\n      const { startRegistration } = await import(\"@simplewebauthn/browser\");\r\n      const options = await this.client.post<any>(\"/auth/passkey/register/options\", {});\r\n      const attestation = await startRegistration({ optionsJSON: options });\r\n      await this.client.post(\"/auth/passkey/register/verify\", {\r\n        response: attestation,\r\n        name: name || null,\r\n      });\r\n      return { verified: true };\r\n    },\r\n\r\n    authenticate: async (opts?: { authMode?: AuthMode }): Promise<AuthResponse> => {\r\n      this.assertBrowser();\r\n      const { startAuthentication } = await import(\"@simplewebauthn/browser\");\r\n      const { options, challengeId } = await this.client.post<any>(\r\n        \"/auth/passkey/authenticate/options\",\r\n        {},\r\n        { skipAuth: true }\r\n      );\r\n      const assertion = await startAuthentication({ optionsJSON: options });\r\n      const response = await this.client.post<AuthResponse>(\r\n        \"/auth/passkey/authenticate/verify\",\r\n        { challengeId, response: assertion, authMode: opts?.authMode },\r\n        { skipAuth: true }\r\n      );\r\n\r\n      await this.storeTokens(response);\r\n      this.emitAuthStateChange(\"SIGNED_IN\", response.user);\r\n\r\n      return response;\r\n    },\r\n\r\n    list: async (): Promise<Passkey[]> =>\r\n      (await this.client.get<{ passkeys: Passkey[] }>(\"/auth/passkey\")).passkeys,\r\n\r\n    remove: async (id: string): Promise<void> => {\r\n      await this.client.delete(`/auth/passkey/${encodeURIComponent(id)}`);\r\n    },\r\n  };\r\n\r\n  constructor(config: AuthModuleConfig) {\r\n    this.client = config.client;\r\n    this.storage = config.storage;\r\n    this.authMode = config.authMode;\r\n    this.onAuthStateChange = config.onAuthStateChange;\r\n\r\n    this.twoFactor = {\r\n      verify: async (\r\n        twoFactorToken: string,\r\n        code: string,\r\n        opts?: { authMode?: AuthMode; authType?: string }\r\n      ): Promise<AuthResponse> => {\r\n        const response = await this.client.post<AuthResponse>(\r\n          \"/auth/2fa/verify\",\r\n          {\r\n            twoFactorToken,\r\n            code,\r\n            authMode: opts?.authMode,\r\n            authType: opts?.authType,\r\n          },\r\n          { skipAuth: true }\r\n        );\r\n\r\n        await this.storeTokens(response);\r\n        this.emitAuthStateChange(\"SIGNED_IN\", response.user);\r\n\r\n        return response;\r\n      },\r\n\r\n      enable: (): Promise<TwoFactorEnableResult> => {\r\n        return this.client.post<TwoFactorEnableResult>(\"/auth/2fa/enable\");\r\n      },\r\n\r\n      verifySetup: (code: string): Promise<{ enabled: boolean }> => {\r\n        return this.client.post<{ enabled: boolean }>(\"/auth/2fa/verify-setup\", {\r\n          code,\r\n        });\r\n      },\r\n\r\n      disable: (password: string): Promise<{ disabled: boolean }> => {\r\n        return this.client.post<{ disabled: boolean }>(\"/auth/2fa/disable\", {\r\n          password,\r\n        });\r\n      },\r\n    };\r\n  }\r\n\r\n  /**\r\n   * Assert that we're running in a browser environment with WebAuthn support.\r\n   * Throws a `BaasixError` otherwise.\r\n   */\r\n  private assertBrowser(): void {\r\n    if (typeof window === \"undefined\" || !(window as any).PublicKeyCredential) {\r\n      throw new BaasixError(\"Passkeys are only available in a browser\", 400);\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Emit an authentication state change event\r\n   */\r\n  private emitAuthStateChange(event: AuthStateEvent, user: User | null): void {\r\n    this.currentUser = user;\r\n    this.onAuthStateChange?.(event, user);\r\n  }\r\n\r\n  /**\r\n   * Store authentication tokens\r\n   */\r\n  private async storeTokens(response: AuthResponse): Promise<void> {\r\n    if (this.authMode === \"jwt\") {\r\n      await this.storage.set(STORAGE_KEYS.ACCESS_TOKEN, response.token);\r\n\r\n      if (response.refreshToken) {\r\n        await this.storage.set(STORAGE_KEYS.REFRESH_TOKEN, response.refreshToken);\r\n      }\r\n\r\n      if (response.expiresIn) {\r\n        const expiresAt = Date.now() + response.expiresIn * 1000;\r\n        await this.storage.set(STORAGE_KEYS.TOKEN_EXPIRY, expiresAt.toString());\r\n      }\r\n    }\r\n\r\n    // Store user info\r\n    if (response.user) {\r\n      await this.storage.set(STORAGE_KEYS.USER, JSON.stringify(response.user));\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Clear stored authentication data\r\n   */\r\n  private async clearAuth(): Promise<void> {\r\n    await this.storage.remove(STORAGE_KEYS.ACCESS_TOKEN);\r\n    await this.storage.remove(STORAGE_KEYS.REFRESH_TOKEN);\r\n    await this.storage.remove(STORAGE_KEYS.TOKEN_EXPIRY);\r\n    await this.storage.remove(STORAGE_KEYS.USER);\r\n    await this.storage.remove(STORAGE_KEYS.TENANT);\r\n    this.currentUser = null;\r\n  }\r\n\r\n  /**\r\n   * Register a new user\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const { user, token } = await baasix.auth.register({\r\n   *   email: 'newuser@example.com',\r\n   *   password: 'securepassword',\r\n   *   firstName: 'John',\r\n   *   lastName: 'Doe'\r\n   * });\r\n   * ```\r\n   */\r\n  async register(data: RegisterData): Promise<AuthResponse> {\r\n    const response = await this.client.post<AuthResponse>(\"/auth/register\", data, {\r\n      skipAuth: true,\r\n    });\r\n\r\n    await this.storeTokens(response);\r\n    this.emitAuthStateChange(\"SIGNED_IN\", response.user);\r\n\r\n    return response;\r\n  }\r\n\r\n  /**\r\n   * Login with email and password\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const { user, token } = await baasix.auth.login({\r\n   *   email: 'user@example.com',\r\n   *   password: 'password123'\r\n   * });\r\n   *\r\n   * // Login with tenant (multi-tenant mode)\r\n   * const result = await baasix.auth.login({\r\n   *   email: 'user@example.com',\r\n   *   password: 'password123',\r\n   *   tenantId: 'tenant-uuid'\r\n   * });\r\n   *\r\n   * // Login with authMode and authType\r\n   * const result = await baasix.auth.login({\r\n   *   email: 'user@example.com',\r\n   *   password: 'password123',\r\n   *   authMode: 'cookie', // or 'jwt' (default)\r\n   *   authType: 'mobile'  // for session management\r\n   * });\r\n   * ```\r\n   */\r\n  async login(credentials: LoginCredentials): Promise<LoginResult> {\r\n    const response = await this.client.post<LoginResult>(\r\n      \"/auth/login\",\r\n      {\r\n        email: credentials.email,\r\n        password: credentials.password,\r\n        tenant_Id: credentials.tenantId,\r\n        authMode: credentials.authMode,\r\n        authType: credentials.authType,\r\n      },\r\n      { skipAuth: true }\r\n    );\r\n\r\n    if (\"twoFactorRequired\" in response && response.twoFactorRequired) {\r\n      return response;\r\n    }\r\n\r\n    const authResponse = response as AuthResponse;\r\n    await this.storeTokens(authResponse);\r\n    this.emitAuthStateChange(\"SIGNED_IN\", authResponse.user);\r\n\r\n    return authResponse;\r\n  }\r\n\r\n  /**\r\n   * Discover which authentication methods are enabled for this project\r\n   * (registration, email/password, magic link, passkey, 2FA, and the list\r\n   * of configured social/OAuth providers). Result is cached per instance;\r\n   * pass `force: true` to bypass the cache and refetch.\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const methods = await baasix.auth.getAuthMethods();\r\n   * if (methods.socialProviders.includes(\"google\")) {\r\n   *   // show \"Sign in with Google\"\r\n   * }\r\n   * ```\r\n   */\r\n  async getAuthMethods(force = false): Promise<AuthMethods> {\r\n    if (this.authMethodsCache && !force) {\r\n      return this.authMethodsCache;\r\n    }\r\n\r\n    const response = await this.client.get<{ project?: { auth?: AuthMethods } }>(\r\n      \"/\",\r\n      { skipAuth: true }\r\n    );\r\n\r\n    const authMethods = response?.project?.auth as AuthMethods;\r\n    this.authMethodsCache = authMethods;\r\n\r\n    return authMethods;\r\n  }\r\n\r\n  /**\r\n   * Logout the current user\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * await baasix.auth.logout();\r\n   * ```\r\n   */\r\n  async logout(): Promise<void> {\r\n    try {\r\n      await this.client.get(\"/auth/logout\");\r\n    } catch {\r\n      // Ignore logout errors - we still want to clear local state\r\n    }\r\n\r\n    await this.clearAuth();\r\n    this.emitAuthStateChange(\"SIGNED_OUT\", null);\r\n  }\r\n\r\n  /**\r\n   * Get the current authenticated user from the server\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const user = await baasix.auth.getUser();\r\n   * console.log(user?.email);\r\n   * ```\r\n   */\r\n  async getUser(): Promise<User | null> {\r\n    try {\r\n      const response = await this.client.get<{ user: User }>(\"/auth/me\");\r\n      this.currentUser = response.user;\r\n      await this.storage.set(STORAGE_KEYS.USER, JSON.stringify(response.user));\r\n      return response.user;\r\n    } catch (error) {\r\n      if (error instanceof BaasixError && error.status === 401) {\r\n        await this.clearAuth();\r\n        return null;\r\n      }\r\n      throw error;\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Alias for getUser() - Get the current authenticated user from the server\r\n   * Calls the /auth/me endpoint\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const user = await baasix.auth.me();\r\n   * console.log(user?.email);\r\n   * ```\r\n   */\r\n  async me(): Promise<User | null> {\r\n    return this.getUser();\r\n  }\r\n\r\n  /**\r\n   * Get the cached current user (does not make an API call)\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const user = await baasix.auth.getCachedUser();\r\n   * ```\r\n   */\r\n  async getCachedUser(): Promise<User | null> {\r\n    if (this.currentUser) {\r\n      return this.currentUser;\r\n    }\r\n\r\n    const userJson = await this.storage.get(STORAGE_KEYS.USER);\r\n    if (userJson) {\r\n      try {\r\n        this.currentUser = JSON.parse(userJson);\r\n        return this.currentUser;\r\n      } catch {\r\n        return null;\r\n      }\r\n    }\r\n\r\n    return null;\r\n  }\r\n\r\n  /**\r\n   * Check if user is authenticated (has valid token)\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * if (await baasix.auth.isAuthenticated()) {\r\n   *   // User is logged in\r\n   * }\r\n   * ```\r\n   */\r\n  async isAuthenticated(): Promise<boolean> {\r\n    if (this.authMode === \"cookie\") {\r\n      // For cookie mode, try to get user\r\n      const user = await this.getCachedUser();\r\n      return user !== null;\r\n    }\r\n\r\n    const token = await this.storage.get(STORAGE_KEYS.ACCESS_TOKEN);\r\n    if (!token) return false;\r\n\r\n    // Check expiry\r\n    const expiry = await this.storage.get(STORAGE_KEYS.TOKEN_EXPIRY);\r\n    if (expiry && Date.now() >= parseInt(expiry, 10)) {\r\n      // Token expired, check if we have refresh token\r\n      const refreshToken = await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);\r\n      return !!refreshToken;\r\n    }\r\n\r\n    return true;\r\n  }\r\n\r\n  /**\r\n   * Get the current access token\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const token = await baasix.auth.getToken();\r\n   * ```\r\n   */\r\n  async getToken(): Promise<string | null> {\r\n    if (this.authMode === \"cookie\") {\r\n      return null;\r\n    }\r\n    return await this.storage.get(STORAGE_KEYS.ACCESS_TOKEN);\r\n  }\r\n\r\n  /**\r\n   * Set a static token (useful for server-side or service accounts)\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * baasix.auth.setToken('your-api-token');\r\n   * ```\r\n   */\r\n  async setToken(token: string): Promise<void> {\r\n    await this.storage.set(STORAGE_KEYS.ACCESS_TOKEN, token);\r\n  }\r\n\r\n  /**\r\n   * Refresh the current token\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const tokens = await baasix.auth.refreshToken();\r\n   * ```\r\n   */\r\n  async refreshToken(): Promise<AuthTokens> {\r\n    const refreshToken = await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);\r\n\r\n    const response = await this.client.post<AuthResponse>(\r\n      \"/auth/refresh\",\r\n      this.authMode === \"jwt\"\r\n        ? { refreshToken, authMode: \"jwt\" }\r\n        : { authMode: \"cookie\" }\r\n    );\r\n\r\n    await this.storeTokens(response);\r\n\r\n    const tokens: AuthTokens = {\r\n      accessToken: response.token,\r\n      refreshToken: response.refreshToken,\r\n      expiresIn: response.expiresIn,\r\n      expiresAt: response.expiresIn\r\n        ? Date.now() + response.expiresIn * 1000\r\n        : undefined,\r\n    };\r\n\r\n    this.emitAuthStateChange(\"TOKEN_REFRESHED\", response.user);\r\n\r\n    return tokens;\r\n  }\r\n\r\n  /**\r\n   * Request a magic link for passwordless login\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * await baasix.auth.sendMagicLink({\r\n   *   email: 'user@example.com',\r\n   *   redirectUrl: 'https://myapp.com/auth/callback'\r\n   * });\r\n   * ```\r\n   */\r\n  async sendMagicLink(options: MagicLinkOptions): Promise<void> {\r\n    await this.client.post(\r\n      \"/auth/magiclink\",\r\n      {\r\n        email: options.email,\r\n        link: options.redirectUrl,\r\n        mode: options.mode || \"link\",\r\n      },\r\n      { skipAuth: true }\r\n    );\r\n  }\r\n\r\n  /**\r\n   * Verify magic link/code and complete login\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const { user, token } = await baasix.auth.verifyMagicLink('verification-token');\r\n   * ```\r\n   */\r\n  async verifyMagicLink(token: string): Promise<AuthResponse> {\r\n    const response = await this.client.get<AuthResponse>(\r\n      `/auth/magiclink/${encodeURIComponent(token)}`,\r\n      { skipAuth: true }\r\n    );\r\n\r\n    await this.storeTokens(response);\r\n    this.emitAuthStateChange(\"SIGNED_IN\", response.user);\r\n\r\n    return response;\r\n  }\r\n\r\n  /**\r\n   * Request a password reset\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * await baasix.auth.forgotPassword({\r\n   *   email: 'user@example.com',\r\n   *   redirectUrl: 'https://myapp.com/reset-password'\r\n   * });\r\n   * ```\r\n   */\r\n  async forgotPassword(options: PasswordResetOptions): Promise<void> {\r\n    await this.client.post(\r\n      \"/auth/password/reset\",\r\n      {\r\n        email: options.email,\r\n        link: options.redirectUrl,\r\n      },\r\n      { skipAuth: true }\r\n    );\r\n  }\r\n\r\n  /**\r\n   * Reset password using a reset token\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * await baasix.auth.resetPassword('reset-token', 'newpassword123');\r\n   * ```\r\n   */\r\n  async resetPassword(token: string, newPassword: string): Promise<void> {\r\n    await this.client.post(\r\n      `/auth/password/reset/${encodeURIComponent(token)}`,\r\n      { password: newPassword },\r\n      { skipAuth: true }\r\n    );\r\n  }\r\n\r\n  /**\r\n   * Change the current user's password\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * await baasix.auth.changePassword('currentPassword', 'newPassword');\r\n   * ```\r\n   */\r\n  async changePassword(\r\n    currentPassword: string,\r\n    newPassword: string\r\n  ): Promise<void> {\r\n    await this.client.post(\"/auth/password/change\", {\r\n      currentPassword,\r\n      newPassword,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Get available tenants for the current user (multi-tenant mode)\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const tenants = await baasix.auth.getTenants();\r\n   * ```\r\n   */\r\n  async getTenants(): Promise<Tenant[]> {\r\n    const response = await this.client.get<{ tenants: Tenant[] }>(\"/auth/tenants\");\r\n    return response.tenants;\r\n  }\r\n\r\n  /**\r\n   * Switch to a different tenant (multi-tenant mode)\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const { user, token } = await baasix.auth.switchTenant('tenant-uuid');\r\n   * ```\r\n   */\r\n  async switchTenant(tenantId: string): Promise<AuthResponse> {\r\n    const response = await this.client.post<AuthResponse>(\"/auth/switch-tenant\", {\r\n      tenant_Id: tenantId,\r\n    });\r\n\r\n    await this.storeTokens(response);\r\n    await this.storage.set(STORAGE_KEYS.TENANT, tenantId);\r\n    this.emitAuthStateChange(\"TENANT_SWITCHED\", response.user);\r\n\r\n    return response;\r\n  }\r\n\r\n  /**\r\n   * Get the current authentication state\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * const state = await baasix.auth.getState();\r\n   * console.log(state.isAuthenticated, state.user);\r\n   * ```\r\n   */\r\n  async getState(): Promise<AuthState> {\r\n    const isAuthenticated = await this.isAuthenticated();\r\n    const user = await this.getCachedUser();\r\n\r\n    return {\r\n      user,\r\n      isAuthenticated,\r\n      isLoading: false,\r\n      error: null,\r\n    };\r\n  }\r\n\r\n  /**\r\n   * Initialize authentication state from storage\r\n   * Call this on app startup to restore previous session\r\n   *\r\n   * @example\r\n   * ```typescript\r\n   * await baasix.auth.initialize();\r\n   * ```\r\n   */\r\n  async initialize(): Promise<AuthState> {\r\n    const state = await this.getState();\r\n\r\n    if (state.isAuthenticated && state.user) {\r\n      this.emitAuthStateChange(\"SIGNED_IN\", state.user);\r\n    }\r\n\r\n    return state;\r\n  }\r\n\r\n  // ===================\r\n  // OAuth / Social Login\r\n  // ===================\r\n\r\n  /**\r\n   * Get the OAuth authorization URL for a provider\r\n   * Redirect the user to this URL to start the OAuth flow\r\n   * \r\n   * @example\r\n   * ```typescript\r\n   * const url = baasix.auth.getOAuthUrl({\r\n   *   provider: 'google',\r\n   *   redirectUrl: 'https://myapp.com/auth/callback'\r\n   * });\r\n   * window.location.href = url;\r\n   * ```\r\n   */\r\n  getOAuthUrl(options: OAuthOptions): string {\r\n    const baseUrl = this.client.getBaseUrl();\r\n    const params = new URLSearchParams({\r\n      redirect_url: options.redirectUrl,\r\n    });\r\n    \r\n    if (options.scopes?.length) {\r\n      params.set(\"scopes\", options.scopes.join(\",\"));\r\n    }\r\n    if (options.state) {\r\n      params.set(\"state\", options.state);\r\n    }\r\n\r\n    return `${baseUrl}/auth/signin/${options.provider}?${params.toString()}`;\r\n  }\r\n\r\n  /**\r\n   * Handle OAuth callback and complete login\r\n   * Call this from your callback page with the token from URL\r\n   * \r\n   * @example\r\n   * ```typescript\r\n   * // In your callback page\r\n   * const params = new URLSearchParams(window.location.search);\r\n   * const token = params.get('token');\r\n   * \r\n   * if (token) {\r\n   *   await baasix.auth.handleOAuthCallback(token);\r\n   * }\r\n   * ```\r\n   */\r\n  async handleOAuthCallback(token: string): Promise<AuthResponse> {\r\n    // Store the token\r\n    await this.storage.set(STORAGE_KEYS.ACCESS_TOKEN, token);\r\n    \r\n    // Get user info\r\n    const user = await this.getUser();\r\n    \r\n    const response: AuthResponse = {\r\n      token,\r\n      user: user!,\r\n    };\r\n    \r\n    this.emitAuthStateChange(\"SIGNED_IN\", user);\r\n    return response;\r\n  }\r\n\r\n  // ===================\r\n  // Email Verification\r\n  // ===================\r\n\r\n  /**\r\n   * Request email verification\r\n   * Sends a verification email to the current user\r\n   * \r\n   * @example\r\n   * ```typescript\r\n   * await baasix.auth.requestEmailVerification('https://myapp.com/verify-email');\r\n   * ```\r\n   */\r\n  async requestEmailVerification(redirectUrl: string): Promise<void> {\r\n    await this.client.post(\"/auth/email/verify\", {\r\n      link: redirectUrl,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Verify email with token\r\n   * \r\n   * @example\r\n   * ```typescript\r\n   * const params = new URLSearchParams(window.location.search);\r\n   * const token = params.get('token');\r\n   * \r\n   * await baasix.auth.verifyEmail(token);\r\n   * ```\r\n   */\r\n  async verifyEmail(token: string): Promise<void> {\r\n    await this.client.get(`/auth/email/verify/${encodeURIComponent(token)}`, {\r\n      skipAuth: true,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Check if current session/token is valid\r\n   * \r\n   * @example\r\n   * ```typescript\r\n   * const isValid = await baasix.auth.checkSession();\r\n   * ```\r\n   */\r\n  async checkSession(): Promise<boolean> {\r\n    try {\r\n      const response = await this.client.get<{ valid: boolean }>(\"/auth/check\");\r\n      return response.valid;\r\n    } catch {\r\n      return false;\r\n    }\r\n  }\r\n\r\n  // ===================\r\n  // Invitation System\r\n  // ===================\r\n\r\n  /**\r\n   * Send an invitation to a user (multi-tenant mode)\r\n   * \r\n   * @example\r\n   * ```typescript\r\n   * await baasix.auth.sendInvite({\r\n   *   email: 'newuser@example.com',\r\n   *   roleId: 'role-uuid',\r\n   *   tenantId: 'tenant-uuid',\r\n   *   redirectUrl: 'https://myapp.com/accept-invite'\r\n   * });\r\n   * ```\r\n   */\r\n  async sendInvite(options: InviteOptions): Promise<void> {\r\n    await this.client.post(\"/auth/invite\", {\r\n      email: options.email,\r\n      role_Id: options.roleId,\r\n      tenant_Id: options.tenantId,\r\n      link: options.redirectUrl,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Verify an invitation token\r\n   * \r\n   * @example\r\n   * ```typescript\r\n   * const params = new URLSearchParams(window.location.search);\r\n   * const token = params.get('token');\r\n   * \r\n   * const result = await baasix.auth.verifyInvite(token);\r\n   * if (result.valid) {\r\n   *   // Show registration form with pre-filled email\r\n   * }\r\n   * ```\r\n   */\r\n  async verifyInvite(token: string, redirectUrl?: string): Promise<VerifyInviteResult> {\r\n    const response = await this.client.get<VerifyInviteResult>(\r\n      `/auth/verify-invite/${encodeURIComponent(token)}`,\r\n      {\r\n        params: {\r\n          link: redirectUrl,\r\n        },\r\n        skipAuth: true,\r\n      }\r\n    );\r\n    return response;\r\n  }\r\n\r\n  /**\r\n   * Accept an invitation (for existing users)\r\n   * \r\n   * @example\r\n   * ```typescript\r\n   * await baasix.auth.acceptInvite(token);\r\n   * ```\r\n   */\r\n  async acceptInvite(token: string): Promise<AuthResponse> {\r\n    const response = await this.client.post<AuthResponse>(\r\n      \"/auth/accept-invite\",\r\n      { inviteToken: token }\r\n    );\r\n\r\n    await this.storeTokens(response);\r\n    this.emitAuthStateChange(\"SIGNED_IN\", response.user);\r\n\r\n    return response;\r\n  }\r\n\r\n  /**\r\n   * Register with an invitation token\r\n   * \r\n   * @example\r\n   * ```typescript\r\n   * const { user, token } = await baasix.auth.registerWithInvite({\r\n   *   email: 'user@example.com',\r\n   *   password: 'password',\r\n   *   firstName: 'John',\r\n   *   lastName: 'Doe',\r\n   *   inviteToken: 'invite-token'\r\n   * });\r\n   * ```\r\n   */\r\n  async registerWithInvite(data: RegisterData & { inviteToken: string }): Promise<AuthResponse> {\r\n    const response = await this.client.post<AuthResponse>(\r\n      \"/auth/register\",\r\n      {\r\n        ...data,\r\n        inviteToken: data.inviteToken,\r\n      },\r\n      { skipAuth: true }\r\n    );\r\n\r\n    await this.storeTokens(response);\r\n    this.emitAuthStateChange(\"SIGNED_IN\", response.user);\r\n\r\n    return response;\r\n  }\r\n}\r\n\r\n// Re-export types from types.ts\r\nexport type {\r\n  AuthResponse,\r\n  AuthState,\r\n  AuthStateEvent,\r\n  AuthTokens,\r\n  LoginCredentials,\r\n  MagicLinkOptions,\r\n  PasswordResetOptions,\r\n  RegisterData,\r\n  Tenant,\r\n  User,\r\n};\r\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baasix/sdk",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "Official JavaScript/TypeScript SDK for Baasix Backend-as-a-Service",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -106,6 +106,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@baasix/types": "^1.0.8"
+    "@baasix/types": "^1.0.10",
+    "@simplewebauthn/browser": "^13.3.0"
   }
 }