@deepkey/sdk 1.0.0 → 1.1.0

package/README.md

@@ -180,6 +180,46 @@ await fetch('/api/things', {
 })
 ```
 
+## Provider connections (durable provider access)
+
+Login discards provider tokens. When your product needs to act on a provider on the user's behalf (for example manage several X accounts), the signed-in user **connects** accounts. DeepKey keeps the provider refresh token; browsers only see metadata and your server receives short-lived provider access tokens.
+
+```ts
+// Browser — the user is already signed in (any method: email, Google, X).
+await deepkey.connections.connect({
+  provider: 'x',
+  options: { redirectTo: `${window.location.origin}/settings` }, // must be allow-listed
+})
+// Full-page redirect to the provider. DeepKey returns to redirectTo with
+// ?connection_id=...&provider=x (or ?error=access_denied&error_code=...).
+
+const { data, error } = await deepkey.connections.list()
+// data.connections: [{ id, provider, provider_user_id, identity_data, scope, status, created_at, updated_at }]
+
+await deepkey.connections.revoke(connectionId) // revokes at the provider and deletes the connection
+```
+
+```ts
+// Server — secret key only.
+const { data: token, error } = await deepkey.connections.issueAccessToken(connectionId)
+// token: { access_token, token_type: 'bearer', expires_at, scope } — no refresh token, ever.
+// error?.code === 'connection_reauthorization_required' → the user must connect again.
+
+const { data } = await deepkey.connections.list({ userId })
+await deepkey.connections.revoke(connectionId)
+```
+
+**How a connection is tied to the user.** `connections.connect()` sends the current DeepKey session as the bearer, so DeepKey binds the new connection to the signed-in `user.id` (the id is signed into the OAuth state and re-checked on the callback; nothing from the browser chooses the user). On your server, correlate with the same id you get from `getUser(jwt)`:
+
+```ts
+const { data: { user } } = await deepkey.auth.getUser(jwt)          // your authenticated user
+const { data: { connections } } = await deepkey.connections.list({ userId: user!.id })
+// Only trust a connection_id from your frontend if it is in this list
+// (every item also carries user_id === user.id).
+```
+
+Scopes are a project policy: the adapter's minimum plus the `connectScopes` configured for the provider on the DeepKey console. They are requested only by `connections.connect()`, never during login. Each connection's `scope` reports what the provider actually granted.
+
 ## Server client (validating tokens in your backend)
 
 ```ts
@@ -211,7 +251,7 @@ Use `getUser()` when you need revocation-awareness (a signed-out session fails i
 ```ts
 // '@deepkey/sdk'
 const DEEPKEY_API_URL: 'https://deepkey.dev/api'
-function createAuthClient(publishableKey: string, options?: AuthClientOptions): { auth: Auth }
+function createAuthClient(publishableKey: string, options?: AuthClientOptions): { auth: Auth; connections: Connections }
 
 class Auth {
   signInWithOtp(credentials: SignInWithOtpCredentials): Promise<AuthResponse<{ user: null; session: null }>>
@@ -224,6 +264,26 @@ class Auth {
   signOut(): Promise<{ error: AuthError | null }>
 }
 
+class Connections {
+  connect(credentials: ConnectProviderCredentials): Promise<AuthResponse<{ provider: string; url: string | null }>>
+  list(): Promise<AuthResponse<{ connections: ProviderConnection[] }>>
+  revoke(connectionId: string): Promise<{ error: AuthError | null }>
+}
+
+interface ConnectProviderCredentials { provider: string; options?: { redirectTo?: string; skipBrowserRedirect?: boolean } }
+interface ProviderConnection {
+  id: string                    // stable reference for your own tables
+  user_id: string               // the DeepKey user that granted it (same id as getUser(jwt).user.id)
+  provider: string
+  provider_user_id: string      // immutable provider subject
+  identity_data: Record<string, unknown>
+  scope: string | null          // what the provider granted
+  status: 'active' | 'reauthorization_required'
+  created_at: string
+  updated_at: string
+}
+interface ProviderAccessToken { access_token: string; token_type: 'bearer'; expires_at: number | null; scope: string | null }
+
 interface AuthClientOptions {
   persistSession?: boolean
   autoRefreshToken?: boolean
@@ -261,7 +321,12 @@ interface User {
 // '@deepkey/sdk/server'
 const DEEPKEY_API_URL: 'https://deepkey.dev/api'
 function createServerClient(secretKey: string, options?: ServerClientOptions): {
-  auth: { getUser(jwt: string): Promise<{ data: { user: User | null }; error: AuthError | null }> }
+  auth: { getUser(jwt: string): Promise<AuthResponse<{ user: User | null }>> }
+  connections: {
+    list(params: { userId: string }): Promise<AuthResponse<{ connections: ProviderConnection[] }>>
+    issueAccessToken(connectionId: string): Promise<AuthResponse<ProviderAccessToken | null>>
+    revoke(connectionId: string): Promise<{ error: AuthError | null }>
+  }
 }
 interface ServerClientOptions { fetch?: typeof fetch }
 ```
@@ -279,6 +344,10 @@ All calls send the API key as the `apikey` header against `https://deepkey.dev/a
 | token refresh | `POST /token?grant_type=refresh_token` |
 | `getUser` | `GET /user` (with `Authorization: Bearer`) |
 | `signOut` | `POST /logout` |
+| `connections.connect` | `POST /connections/authorize` (bearer) → navigate to `data.url`; provider returns to `redirectTo?connection_id=…` |
+| `connections.list` | `GET /connections` (bearer) or `GET /connections?user_id=…` (secret key) |
+| server `connections.issueAccessToken` | `POST /connections/:id/token` (secret key) |
+| `connections.revoke` | `DELETE /connections/:id` |
 
 ## Gotchas & troubleshooting
 

package/dist/chunk-A2CRUXTA.js

@@ -0,0 +1,61 @@
+// src/types.ts
+var AuthError = class extends Error {
+  constructor(message, status, code) {
+    super(message);
+    this.name = "AuthError";
+    this.status = status;
+    this.code = code;
+  }
+};
+
+// src/fetch.ts
+var request = async (options) => {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  try {
+    const headers = { apikey: options.apikey };
+    if (options.body !== void 0) headers["Content-Type"] = "application/json";
+    if (options.accessToken) headers.Authorization = `Bearer ${options.accessToken}`;
+    const response = await fetchImpl(`${options.baseUrl}${options.path}`, {
+      method: options.method,
+      headers,
+      body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+    });
+    if (response.status === 204) return { data: {}, error: null };
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      payload = null;
+    }
+    if (!response.ok) {
+      const errorBody = payload?.error;
+      return {
+        data: null,
+        error: new AuthError(
+          errorBody?.message ?? `Request failed with status ${response.status}`,
+          response.status,
+          errorBody?.code
+        )
+      };
+    }
+    return { data: payload, error: null };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Network request failed";
+    return { data: null, error: new AuthError(message, 0, "network_error") };
+  }
+};
+
+// src/constants.ts
+var DEEPKEY_API_URL = "https://deepkey.dev/api";
+var resolveBaseUrl = (url) => {
+  const candidate = typeof url === "string" ? url.trim() : "";
+  return (candidate || DEEPKEY_API_URL).replace(/\/+$/, "");
+};
+
+export {
+  AuthError,
+  request,
+  DEEPKEY_API_URL,
+  resolveBaseUrl
+};
+//# sourceMappingURL=chunk-A2CRUXTA.js.map

package/dist/chunk-A2CRUXTA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts","../src/fetch.ts","../src/constants.ts"],"sourcesContent":["export interface UserIdentity {\n  identity_id: string\n  id: string\n  user_id: string\n  provider: string\n  identity_data: Record<string, unknown>\n  last_sign_in_at: string | null\n  created_at: string\n  updated_at: string\n}\n\nexport interface User {\n  id: string\n  aud: string\n  role: string\n  email: string | null\n  email_confirmed_at: string | null\n  app_metadata: { provider?: string | null; providers?: string[]; [key: string]: unknown }\n  user_metadata: {\n    name?: string\n    full_name?: string\n    avatar_url?: string\n    picture?: string\n    email?: string\n    [key: string]: unknown\n  }\n  identities?: UserIdentity[]\n  created_at: string\n  updated_at?: string\n  last_sign_in_at?: string | null\n}\n\nexport interface Session {\n  access_token: string\n  refresh_token: string\n  token_type: 'bearer'\n  expires_in: number\n  expires_at: number\n  user: User\n}\n\nexport class AuthError extends Error {\n  status?: number\n  code?: string\n\n  constructor(message: string, status?: number, code?: string) {\n    super(message)\n    this.name = 'AuthError'\n    this.status = status\n    this.code = code\n  }\n}\n\nexport type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED'\n\nexport interface Subscription {\n  id: string\n  unsubscribe: () => void\n}\n\nexport interface StorageAdapter {\n  getItem(key: string): string | null\n  setItem(key: string, value: string): void\n  removeItem(key: string): void\n}\n\nexport interface AuthClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  storageKey?: string\n  autoRefreshToken?: boolean\n  detectSessionInUrl?: boolean\n  persistSession?: boolean\n  storage?: StorageAdapter\n  fetch?: typeof fetch\n}\n\nexport interface ServerClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  fetch?: typeof fetch\n}\n\nexport interface SignInWithOtpCredentials {\n  email: string\n  options?: {\n    emailRedirectTo?: string\n    shouldCreateUser?: boolean\n    data?: Record<string, unknown>\n  }\n}\n\nexport interface VerifyOtpParams {\n  email: string\n  token: string\n  type: 'email' | 'magiclink'\n}\n\nexport interface ConnectProviderCredentials {\n  provider: string\n  options?: {\n    redirectTo?: string\n    skipBrowserRedirect?: boolean\n  }\n}\n\n// Metadata only: provider tokens never appear in browser responses.\nexport interface ProviderConnection {\n  id: string\n  // The DeepKey user that granted the connection: the same `user.id` your server gets from getUser(jwt).\n  user_id: string\n  provider: string\n  provider_user_id: string\n  identity_data: Record<string, unknown>\n  scope: string | null\n  status: 'active' | 'reauthorization_required'\n  created_at: string\n  updated_at: string\n}\n\n// Issued to consumer servers through the secret key; short-lived and refreshed by DeepKey.\nexport interface ProviderAccessToken {\n  access_token: string\n  token_type: 'bearer'\n  expires_at: number | null\n  scope: string | null\n}\n\nexport interface SignInWithOAuthCredentials {\n  provider: string\n  options?: {\n    redirectTo?: string\n    scopes?: string\n    queryParams?: Record<string, string>\n    skipBrowserRedirect?: boolean\n  }\n}\n\nexport interface AuthResponse<T> {\n  data: T\n  error: AuthError | null\n}\n","import { AuthError } from './types'\n\nexport interface RequestOptions {\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE'\n  path: string\n  apikey: string\n  baseUrl: string\n  accessToken?: string\n  body?: unknown\n  fetchImpl?: typeof fetch\n}\n\nexport interface RequestResult<T> {\n  data: T | null\n  error: AuthError | null\n}\n\n// All service errors are shaped { error: { code, message } }.\nexport const request = async <T>(options: RequestOptions): Promise<RequestResult<T>> => {\n  const fetchImpl = options.fetchImpl ?? fetch\n  try {\n    const headers: Record<string, string> = { apikey: options.apikey }\n    if (options.body !== undefined) headers['Content-Type'] = 'application/json'\n    if (options.accessToken) headers.Authorization = `Bearer ${options.accessToken}`\n\n    const response = await fetchImpl(`${options.baseUrl}${options.path}`, {\n      method: options.method,\n      headers,\n      body: options.body !== undefined ? JSON.stringify(options.body) : undefined,\n    })\n\n    if (response.status === 204) return { data: {} as T, error: null }\n\n    let payload: unknown\n    try {\n      payload = await response.json()\n    } catch {\n      payload = null\n    }\n\n    if (!response.ok) {\n      const errorBody = (payload as { error?: { code?: string; message?: string } } | null)?.error\n      return {\n        data: null,\n        error: new AuthError(\n          errorBody?.message ?? `Request failed with status ${response.status}`,\n          response.status,\n          errorBody?.code,\n        ),\n      }\n    }\n\n    return { data: payload as T, error: null }\n  } catch (err) {\n    const message = err instanceof Error ? err.message : 'Network request failed'\n    return { data: null, error: new AuthError(message, 0, 'network_error') }\n  }\n}\n","// The hosted DeepKey API. Every client talks to this origin; only DeepKey's own\n// console and test suites replace it through the internal override.\nexport const DEEPKEY_API_URL = 'https://deepkey.dev/api'\n\n// Resolves the base URL used for every request. An absent or blank internal\n// override keeps the hosted API; a provided value has any trailing slash removed\n// so path joins stay predictable.\nexport const resolveBaseUrl = (url?: string | null): string => {\n  const candidate = typeof url === 'string' ? url.trim() : ''\n  return (candidate || DEEPKEY_API_URL).replace(/\\/+$/, '')\n}\n"],"mappings":";AAyCO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAInC,YAAY,SAAiB,QAAiB,MAAe;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;;;ACjCO,IAAM,UAAU,OAAU,YAAuD;AACtF,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI;AACF,UAAM,UAAkC,EAAE,QAAQ,QAAQ,OAAO;AACjE,QAAI,QAAQ,SAAS,OAAW,SAAQ,cAAc,IAAI;AAC1D,QAAI,QAAQ,YAAa,SAAQ,gBAAgB,UAAU,QAAQ,WAAW;AAE9E,UAAM,WAAW,MAAM,UAAU,GAAG,QAAQ,OAAO,GAAG,QAAQ,IAAI,IAAI;AAAA,MACpE,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,MAAM,QAAQ,SAAS,SAAY,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,IACpE,CAAC;AAED,QAAI,SAAS,WAAW,IAAK,QAAO,EAAE,MAAM,CAAC,GAAQ,OAAO,KAAK;AAEjE,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,SAAS,KAAK;AAAA,IAChC,QAAQ;AACN,gBAAU;AAAA,IACZ;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,SAAoE;AACvF,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO,IAAI;AAAA,UACT,WAAW,WAAW,8BAA8B,SAAS,MAAM;AAAA,UACnE,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,SAAc,OAAO,KAAK;AAAA,EAC3C,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,EAAE,MAAM,MAAM,OAAO,IAAI,UAAU,SAAS,GAAG,eAAe,EAAE;AAAA,EACzE;AACF;;;ACvDO,IAAM,kBAAkB;AAKxB,IAAM,iBAAiB,CAAC,QAAgC;AAC7D,QAAM,YAAY,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;AACzD,UAAQ,aAAa,iBAAiB,QAAQ,QAAQ,EAAE;AAC1D;","names":[]}

package/dist/{constants-BQhswdms.d.cts → constants-DgChFH24.d.cts}

@@ -79,6 +79,30 @@ interface VerifyOtpParams {
     token: string;
     type: 'email' | 'magiclink';
 }
+interface ConnectProviderCredentials {
+    provider: string;
+    options?: {
+        redirectTo?: string;
+        skipBrowserRedirect?: boolean;
+    };
+}
+interface ProviderConnection {
+    id: string;
+    user_id: string;
+    provider: string;
+    provider_user_id: string;
+    identity_data: Record<string, unknown>;
+    scope: string | null;
+    status: 'active' | 'reauthorization_required';
+    created_at: string;
+    updated_at: string;
+}
+interface ProviderAccessToken {
+    access_token: string;
+    token_type: 'bearer';
+    expires_at: number | null;
+    scope: string | null;
+}
 interface SignInWithOAuthCredentials {
     provider: string;
     options?: {
@@ -95,4 +119,4 @@ interface AuthResponse<T> {
 
 declare const DEEPKEY_API_URL = "https://deepkey.dev/api";
 
-export { type AuthClientOptions as A, DEEPKEY_API_URL as D, type SignInWithOtpCredentials as S, type User as U, type VerifyOtpParams as V, type AuthResponse as a, type Session as b, type SignInWithOAuthCredentials as c, type AuthChangeEvent as d, type Subscription as e, AuthError as f, type ServerClientOptions as g, type StorageAdapter as h, type UserIdentity as i };
+export { type AuthResponse as A, type ConnectProviderCredentials as C, DEEPKEY_API_URL as D, type ProviderConnection as P, type SignInWithOtpCredentials as S, type User as U, type VerifyOtpParams as V, AuthError as a, type AuthClientOptions as b, type Session as c, type SignInWithOAuthCredentials as d, type AuthChangeEvent as e, type Subscription as f, type ProviderAccessToken as g, type ServerClientOptions as h, type StorageAdapter as i, type UserIdentity as j };

package/dist/{constants-BQhswdms.d.ts → constants-DgChFH24.d.ts}

@@ -79,6 +79,30 @@ interface VerifyOtpParams {
     token: string;
     type: 'email' | 'magiclink';
 }
+interface ConnectProviderCredentials {
+    provider: string;
+    options?: {
+        redirectTo?: string;
+        skipBrowserRedirect?: boolean;
+    };
+}
+interface ProviderConnection {
+    id: string;
+    user_id: string;
+    provider: string;
+    provider_user_id: string;
+    identity_data: Record<string, unknown>;
+    scope: string | null;
+    status: 'active' | 'reauthorization_required';
+    created_at: string;
+    updated_at: string;
+}
+interface ProviderAccessToken {
+    access_token: string;
+    token_type: 'bearer';
+    expires_at: number | null;
+    scope: string | null;
+}
 interface SignInWithOAuthCredentials {
     provider: string;
     options?: {
@@ -95,4 +119,4 @@ interface AuthResponse<T> {
 
 declare const DEEPKEY_API_URL = "https://deepkey.dev/api";
 
-export { type AuthClientOptions as A, DEEPKEY_API_URL as D, type SignInWithOtpCredentials as S, type User as U, type VerifyOtpParams as V, type AuthResponse as a, type Session as b, type SignInWithOAuthCredentials as c, type AuthChangeEvent as d, type Subscription as e, AuthError as f, type ServerClientOptions as g, type StorageAdapter as h, type UserIdentity as i };
+export { type AuthResponse as A, type ConnectProviderCredentials as C, DEEPKEY_API_URL as D, type ProviderConnection as P, type SignInWithOtpCredentials as S, type User as U, type VerifyOtpParams as V, AuthError as a, type AuthClientOptions as b, type Session as c, type SignInWithOAuthCredentials as d, type AuthChangeEvent as e, type Subscription as f, type ProviderAccessToken as g, type ServerClientOptions as h, type StorageAdapter as i, type UserIdentity as j };

package/dist/index.cjs

@@ -22,18 +22,12 @@ var index_exports = {};
 __export(index_exports, {
   Auth: () => Auth,
   AuthError: () => AuthError,
+  Connections: () => Connections,
   DEEPKEY_API_URL: () => DEEPKEY_API_URL,
   createAuthClient: () => createAuthClient
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/constants.ts
-var DEEPKEY_API_URL = "https://deepkey.dev/api";
-var resolveBaseUrl = (url) => {
-  const candidate = typeof url === "string" ? url.trim() : "";
-  return (candidate || DEEPKEY_API_URL).replace(/\/+$/, "");
-};
-
 // src/types.ts
 var AuthError = class extends Error {
   constructor(message, status, code) {
@@ -81,6 +75,50 @@ var request = async (options) => {
   }
 };
 
+// src/connections.ts
+var Connections = class {
+  constructor(auth, options) {
+    this.auth = auth;
+    this.options = options;
+  }
+  async connect(credentials) {
+    const { data, error } = await this.request(
+      "POST",
+      "/auth/v1/connections/authorize",
+      { provider: credentials.provider, redirect_to: credentials.options?.redirectTo }
+    );
+    if (error || !data) return { data: { provider: credentials.provider, url: null }, error };
+    if (!credentials.options?.skipBrowserRedirect && typeof window !== "undefined") {
+      window.location.assign(data.url);
+    }
+    return { data: { provider: credentials.provider, url: data.url }, error: null };
+  }
+  async list() {
+    const { data, error } = await this.request("GET", "/auth/v1/connections");
+    return { data: { connections: data?.connections ?? [] }, error };
+  }
+  async revoke(connectionId) {
+    const { error } = await this.request("DELETE", `/auth/v1/connections/${encodeURIComponent(connectionId)}`);
+    return { error };
+  }
+  async request(method, path, body) {
+    const {
+      data: { session }
+    } = await this.auth.getSession();
+    if (!session) {
+      return { data: null, error: new AuthError("Auth session missing!", 400, "session_missing") };
+    }
+    return request({ method, path, body, accessToken: session.access_token, ...this.options });
+  }
+};
+
+// src/constants.ts
+var DEEPKEY_API_URL = "https://deepkey.dev/api";
+var resolveBaseUrl = (url) => {
+  const candidate = typeof url === "string" ? url.trim() : "";
+  return (candidate || DEEPKEY_API_URL).replace(/\/+$/, "");
+};
+
 // src/storage.ts
 var MemoryStorage = class {
   constructor() {
@@ -425,6 +463,12 @@ var Auth = class {
   }
 };
 var createAuthClient = (publishableKey, options) => {
-  return { auth: new Auth(publishableKey, options) };
+  const auth = new Auth(publishableKey, options);
+  const connections = new Connections(auth, {
+    apikey: publishableKey ?? "",
+    baseUrl: resolveBaseUrl(options?.__internalBaseUrl),
+    fetchImpl: options?.fetch
+  });
+  return { auth, connections };
 };
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/constants.ts","../src/types.ts","../src/fetch.ts","../src/storage.ts","../src/url.ts","../src/client.ts"],"sourcesContent":["export { createAuthClient, Auth, type AuthClient } from './client'\nexport { DEEPKEY_API_URL } from './constants'\nexport {\n  AuthError,\n  type AuthChangeEvent,\n  type AuthClientOptions,\n  type AuthResponse,\n  type ServerClientOptions,\n  type Session,\n  type SignInWithOAuthCredentials,\n  type SignInWithOtpCredentials,\n  type StorageAdapter,\n  type Subscription,\n  type User,\n  type UserIdentity,\n  type VerifyOtpParams,\n} from './types'\n","// The hosted DeepKey API. Every client talks to this origin; only DeepKey's own\n// console and test suites replace it through the internal override.\nexport const DEEPKEY_API_URL = 'https://deepkey.dev/api'\n\n// Resolves the base URL used for every request. An absent or blank internal\n// override keeps the hosted API; a provided value has any trailing slash removed\n// so path joins stay predictable.\nexport const resolveBaseUrl = (url?: string | null): string => {\n  const candidate = typeof url === 'string' ? url.trim() : ''\n  return (candidate || DEEPKEY_API_URL).replace(/\\/+$/, '')\n}\n","export interface UserIdentity {\n  identity_id: string\n  id: string\n  user_id: string\n  provider: string\n  identity_data: Record<string, unknown>\n  last_sign_in_at: string | null\n  created_at: string\n  updated_at: string\n}\n\nexport interface User {\n  id: string\n  aud: string\n  role: string\n  email: string | null\n  email_confirmed_at: string | null\n  app_metadata: { provider?: string | null; providers?: string[]; [key: string]: unknown }\n  user_metadata: {\n    name?: string\n    full_name?: string\n    avatar_url?: string\n    picture?: string\n    email?: string\n    [key: string]: unknown\n  }\n  identities?: UserIdentity[]\n  created_at: string\n  updated_at?: string\n  last_sign_in_at?: string | null\n}\n\nexport interface Session {\n  access_token: string\n  refresh_token: string\n  token_type: 'bearer'\n  expires_in: number\n  expires_at: number\n  user: User\n}\n\nexport class AuthError extends Error {\n  status?: number\n  code?: string\n\n  constructor(message: string, status?: number, code?: string) {\n    super(message)\n    this.name = 'AuthError'\n    this.status = status\n    this.code = code\n  }\n}\n\nexport type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED'\n\nexport interface Subscription {\n  id: string\n  unsubscribe: () => void\n}\n\nexport interface StorageAdapter {\n  getItem(key: string): string | null\n  setItem(key: string, value: string): void\n  removeItem(key: string): void\n}\n\nexport interface AuthClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  storageKey?: string\n  autoRefreshToken?: boolean\n  detectSessionInUrl?: boolean\n  persistSession?: boolean\n  storage?: StorageAdapter\n  fetch?: typeof fetch\n}\n\nexport interface ServerClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  fetch?: typeof fetch\n}\n\nexport interface SignInWithOtpCredentials {\n  email: string\n  options?: {\n    emailRedirectTo?: string\n    shouldCreateUser?: boolean\n    data?: Record<string, unknown>\n  }\n}\n\nexport interface VerifyOtpParams {\n  email: string\n  token: string\n  type: 'email' | 'magiclink'\n}\n\nexport interface SignInWithOAuthCredentials {\n  provider: string\n  options?: {\n    redirectTo?: string\n    scopes?: string\n    queryParams?: Record<string, string>\n    skipBrowserRedirect?: boolean\n  }\n}\n\nexport interface AuthResponse<T> {\n  data: T\n  error: AuthError | null\n}\n","import { AuthError } from './types'\n\nexport interface RequestOptions {\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE'\n  path: string\n  apikey: string\n  baseUrl: string\n  accessToken?: string\n  body?: unknown\n  fetchImpl?: typeof fetch\n}\n\nexport interface RequestResult<T> {\n  data: T | null\n  error: AuthError | null\n}\n\n// All service errors are shaped { error: { code, message } }.\nexport const request = async <T>(options: RequestOptions): Promise<RequestResult<T>> => {\n  const fetchImpl = options.fetchImpl ?? fetch\n  try {\n    const headers: Record<string, string> = { apikey: options.apikey }\n    if (options.body !== undefined) headers['Content-Type'] = 'application/json'\n    if (options.accessToken) headers.Authorization = `Bearer ${options.accessToken}`\n\n    const response = await fetchImpl(`${options.baseUrl}${options.path}`, {\n      method: options.method,\n      headers,\n      body: options.body !== undefined ? JSON.stringify(options.body) : undefined,\n    })\n\n    if (response.status === 204) return { data: {} as T, error: null }\n\n    let payload: unknown\n    try {\n      payload = await response.json()\n    } catch {\n      payload = null\n    }\n\n    if (!response.ok) {\n      const errorBody = (payload as { error?: { code?: string; message?: string } } | null)?.error\n      return {\n        data: null,\n        error: new AuthError(\n          errorBody?.message ?? `Request failed with status ${response.status}`,\n          response.status,\n          errorBody?.code,\n        ),\n      }\n    }\n\n    return { data: payload as T, error: null }\n  } catch (err) {\n    const message = err instanceof Error ? err.message : 'Network request failed'\n    return { data: null, error: new AuthError(message, 0, 'network_error') }\n  }\n}\n","import type { StorageAdapter } from './types'\n\nclass MemoryStorage implements StorageAdapter {\n  private store = new Map<string, string>()\n  getItem(key: string) {\n    return this.store.get(key) ?? null\n  }\n  setItem(key: string, value: string) {\n    this.store.set(key, value)\n  }\n  removeItem(key: string) {\n    this.store.delete(key)\n  }\n}\n\n// localStorage when available, in-memory fallback (SSR, tests, restricted contexts).\nexport const defaultStorage = (): StorageAdapter => {\n  try {\n    if (typeof window !== 'undefined' && window.localStorage) {\n      const probe = '__bt_auth_probe__'\n      window.localStorage.setItem(probe, '1')\n      window.localStorage.removeItem(probe)\n      return window.localStorage\n    }\n  } catch {\n    // fall through to memory storage\n  }\n  return new MemoryStorage()\n}\n\n// Publishable keys look like `bt_pub_<project-slug>_<random>`; the slug namespaces the\n// persisted session per project (mirrors supabase's `sb-<ref>-auth-token`).\nexport const deriveStorageKey = (publishableKey: string | undefined): string => {\n  const match = publishableKey?.match(/^bt_pub_([a-z0-9-]+)_[A-Za-z0-9_-]+$/)\n  return match ? `bt-${match[1]}-auth-token` : 'bt-auth-token'\n}\n","export interface FragmentTokens {\n  access_token: string\n  refresh_token: string\n  expires_in: number\n  expires_at: number\n  token_type: 'bearer'\n  type?: string\n}\n\nexport interface FragmentError {\n  error: string\n  error_code?: string\n  error_description?: string\n}\n\nexport type ParsedFragment = { tokens: FragmentTokens } | { authError: FragmentError } | null\n\n// Parses the implicit-flow return fragment (`#access_token=...` or `#error=...`).\nexport const parseFragment = (hash: string): ParsedFragment => {\n  if (!hash || hash.length < 2) return null\n  const params = new URLSearchParams(hash.startsWith('#') ? hash.slice(1) : hash)\n\n  const error = params.get('error')\n  if (error) {\n    return {\n      authError: {\n        error,\n        error_code: params.get('error_code') ?? undefined,\n        error_description: params.get('error_description') ?? undefined,\n      },\n    }\n  }\n\n  const accessToken = params.get('access_token')\n  const refreshToken = params.get('refresh_token')\n  if (!accessToken || !refreshToken) return null\n\n  const expiresIn = Number(params.get('expires_in') ?? 3600)\n  const expiresAt = Number(params.get('expires_at') ?? Math.floor(Date.now() / 1000) + expiresIn)\n\n  return {\n    tokens: {\n      access_token: accessToken,\n      refresh_token: refreshToken,\n      expires_in: expiresIn,\n      expires_at: expiresAt,\n      token_type: 'bearer',\n      type: params.get('type') ?? undefined,\n    },\n  }\n}\n\n// Removes the auth fragment from the address bar (before any await, so tokens never\n// linger in history).\nexport const cleanFragmentFromUrl = () => {\n  if (typeof window === 'undefined' || typeof history === 'undefined') return\n  history.replaceState(null, '', window.location.pathname + window.location.search)\n}\n","import { resolveBaseUrl } from './constants'\nimport { request } from './fetch'\nimport { defaultStorage, deriveStorageKey } from './storage'\nimport {\n  AuthError,\n  type AuthChangeEvent,\n  type AuthClientOptions,\n  type AuthResponse,\n  type Session,\n  type SignInWithOAuthCredentials,\n  type SignInWithOtpCredentials,\n  type StorageAdapter,\n  type Subscription,\n  type User,\n  type VerifyOtpParams,\n} from './types'\nimport { cleanFragmentFromUrl, parseFragment } from './url'\n\nconst REFRESH_TICK_MS = 30_000\n// Refresh when the access token is within this margin of expiry.\nconst EXPIRY_MARGIN_SECONDS = 90\n\ntype Listener = (event: AuthChangeEvent, session: Session | null) => void\n\nexport class Auth {\n  private baseUrl: string\n  private apikey: string\n  private storage: StorageAdapter\n  private storageKey: string\n  private persistSession: boolean\n  private autoRefreshToken: boolean\n  private detectSessionInUrl: boolean\n  private fetchImpl?: typeof fetch\n\n  private session: Session | null = null\n  private listeners = new Map<string, Listener>()\n  private listenerSeq = 0\n  private initializePromise: Promise<void> | null = null\n  private refreshPromise: Promise<AuthResponse<{ session: Session | null; user: User | null }>> | null = null\n  private refreshTimer: ReturnType<typeof setInterval> | null = null\n\n  constructor(publishableKey: string, options: AuthClientOptions = {}) {\n    // Lazy by design: an empty key must not throw at construction time (CI builds\n    // with empty envs import this module transitively). Failures surface on first call.\n    // The hosted DeepKey API is the only supported origin. The internal override\n    // exists for DeepKey's console and tests and is not part of the public contract.\n    this.baseUrl = resolveBaseUrl(options.__internalBaseUrl)\n    this.apikey = publishableKey ?? ''\n    this.persistSession = options.persistSession ?? true\n    this.autoRefreshToken = options.autoRefreshToken ?? true\n    this.detectSessionInUrl = options.detectSessionInUrl ?? true\n    this.storage = options.storage ?? defaultStorage()\n    this.storageKey = options.storageKey ?? deriveStorageKey(publishableKey)\n    this.fetchImpl = options.fetch\n\n    this.setupCrossTabSync()\n  }\n\n  // ---- public API (supabase-js compatible) ----\n\n  async signInWithOtp(credentials: SignInWithOtpCredentials): Promise<AuthResponse<{ user: null; session: null }>> {\n    const { error } = await this.request<Record<string, never>>('POST', '/auth/v1/otp', {\n      email: credentials.email,\n      create_user: credentials.options?.shouldCreateUser,\n      redirect_to: credentials.options?.emailRedirectTo,\n    })\n    return { data: { user: null, session: null }, error }\n  }\n\n  async verifyOtp(params: VerifyOtpParams): Promise<AuthResponse<{ user: User | null; session: Session | null }>> {\n    const { data, error } = await this.request<Session>('POST', '/auth/v1/verify', {\n      type: 'email',\n      email: params.email,\n      token: params.token,\n    })\n    if (error || !data) return { data: { user: null, session: null }, error }\n\n    await this.saveSession(data)\n    this.emit('SIGNED_IN', data)\n    return { data: { user: data.user, session: data }, error: null }\n  }\n\n  async signInWithOAuth(\n    credentials: SignInWithOAuthCredentials,\n  ): Promise<AuthResponse<{ provider: string; url: string }>> {\n    const url = new URL(`${this.baseUrl}/auth/v1/authorize`)\n    url.searchParams.set('provider', credentials.provider)\n    url.searchParams.set('apikey', this.apikey)\n    if (credentials.options?.redirectTo) url.searchParams.set('redirect_to', credentials.options.redirectTo)\n    if (credentials.options?.scopes) url.searchParams.set('scopes', credentials.options.scopes)\n    for (const [key, value] of Object.entries(credentials.options?.queryParams ?? {})) {\n      url.searchParams.set(key, value)\n    }\n\n    if (!credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {\n      window.location.assign(url.toString())\n    }\n    return { data: { provider: credentials.provider, url: url.toString() }, error: null }\n  }\n\n  onAuthStateChange(callback: Listener): { data: { subscription: Subscription } } {\n    const id = `listener-${++this.listenerSeq}`\n    this.listeners.set(id, callback)\n\n    // Every subscriber receives INITIAL_SESSION asynchronously once initialization\n    // settles — the supabase-js contract that AuthProviders rely on to resolve loading.\n    this.initialize().then(() => {\n      if (this.listeners.has(id)) callback('INITIAL_SESSION', this.session)\n    })\n\n    return {\n      data: {\n        subscription: {\n          id,\n          unsubscribe: () => {\n            this.listeners.delete(id)\n          },\n        },\n      },\n    }\n  }\n\n  async signOut(): Promise<{ error: AuthError | null }> {\n    await this.initialize()\n    const session = this.session\n    if (session) {\n      // Best-effort server-side revocation; local sign-out always succeeds.\n      await this.request('POST', '/auth/v1/logout', {}, session.access_token)\n    }\n    this.clearSession()\n    this.emit('SIGNED_OUT', null)\n    return { error: null }\n  }\n\n  async getSession(): Promise<AuthResponse<{ session: Session | null }>> {\n    await this.initialize()\n\n    if (this.session && this.isExpired(this.session) && this.autoRefreshToken) {\n      const { error } = await this.refreshWithLock()\n      if (error && error.code !== 'network_error') {\n        return { data: { session: null }, error: null }\n      }\n    }\n\n    return { data: { session: this.session }, error: null }\n  }\n\n  async getUser(jwt?: string): Promise<AuthResponse<{ user: User | null }>> {\n    let token = jwt\n    if (!token) {\n      const {\n        data: { session },\n      } = await this.getSession()\n      token = session?.access_token\n    }\n    if (!token) {\n      return { data: { user: null }, error: new AuthError('Auth session missing!', 400, 'session_missing') }\n    }\n\n    const { data, error } = await this.request<User>('GET', '/auth/v1/user', undefined, token)\n    return { data: { user: data }, error }\n  }\n\n  async refreshSession(currentSession?: {\n    refresh_token: string\n  }): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    await this.initialize()\n    const refreshToken = currentSession?.refresh_token ?? this.session?.refresh_token\n    if (!refreshToken) {\n      return {\n        data: { session: null, user: null },\n        error: new AuthError('Auth session missing!', 400, 'session_missing'),\n      }\n    }\n    return this.refreshWithLock(refreshToken)\n  }\n\n  // ---- internals ----\n\n  private async request<T>(method: 'GET' | 'POST', path: string, body?: unknown, accessToken?: string) {\n    return request<T>({\n      method,\n      path,\n      body,\n      accessToken,\n      apikey: this.apikey,\n      baseUrl: this.baseUrl,\n      fetchImpl: this.fetchImpl,\n    })\n  }\n\n  private initialize(): Promise<void> {\n    this.initializePromise ??= this.doInitialize()\n    return this.initializePromise\n  }\n\n  private async doInitialize(): Promise<void> {\n    if (this.detectSessionInUrl && typeof window !== 'undefined') {\n      const parsed = parseFragment(window.location.hash)\n      if (parsed) {\n        // Strip tokens from the address bar synchronously, before any await.\n        cleanFragmentFromUrl()\n\n        if ('authError' in parsed) {\n          console.warn(\n            `[deepkey] Auth redirect returned an error: ${parsed.authError.error_code ?? parsed.authError.error}`,\n            parsed.authError.error_description ?? '',\n          )\n        } else {\n          const { data: user } = await this.request<User>('GET', '/auth/v1/user', undefined, parsed.tokens.access_token)\n          if (user) {\n            const session: Session = { ...parsed.tokens, token_type: 'bearer', user }\n            await this.saveSession(session)\n            this.emit('SIGNED_IN', session)\n            return\n          }\n        }\n      }\n    }\n\n    const stored = this.loadStoredSession()\n    if (!stored) return\n\n    if (this.isExpired(stored)) {\n      if (!this.autoRefreshToken) return\n      this.session = stored\n      const { error } = await this.refreshWithLock()\n      if (error && error.code !== 'network_error') this.clearSession()\n      return\n    }\n\n    this.session = stored\n    this.startRefreshTimer()\n  }\n\n  private isExpired(session: Session): boolean {\n    return session.expires_at <= Math.floor(Date.now() / 1000) + EXPIRY_MARGIN_SECONDS\n  }\n\n  private async refreshWithLock(\n    refreshToken?: string,\n  ): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    this.refreshPromise ??= this.doRefresh(refreshToken).finally(() => {\n      this.refreshPromise = null\n    })\n    return this.refreshPromise\n  }\n\n  private async doRefresh(\n    refreshToken?: string,\n  ): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    const token = refreshToken ?? this.session?.refresh_token\n    if (!token) {\n      return {\n        data: { session: null, user: null },\n        error: new AuthError('Auth session missing!', 400, 'session_missing'),\n      }\n    }\n\n    const { data, error } = await this.request<Session>('POST', '/auth/v1/token?grant_type=refresh_token', {\n      refresh_token: token,\n    })\n\n    if (error) {\n      // Network failures keep the session (retry next tick); auth failures clear it.\n      if (error.code !== 'network_error') {\n        this.clearSession()\n        this.emit('SIGNED_OUT', null)\n      }\n      return { data: { session: null, user: null }, error }\n    }\n\n    if (data) {\n      await this.saveSession(data)\n      this.emit('TOKEN_REFRESHED', data)\n      return { data: { session: data, user: data.user }, error: null }\n    }\n    return { data: { session: null, user: null }, error: new AuthError('Empty refresh response') }\n  }\n\n  private async saveSession(session: Session) {\n    this.session = session\n    if (this.persistSession) {\n      try {\n        this.storage.setItem(this.storageKey, JSON.stringify(session))\n      } catch {\n        // Persistence is best-effort (private mode, quota).\n      }\n    }\n    this.startRefreshTimer()\n  }\n\n  private clearSession() {\n    this.session = null\n    try {\n      this.storage.removeItem(this.storageKey)\n    } catch {\n      // ignore\n    }\n    this.stopRefreshTimer()\n  }\n\n  private loadStoredSession(): Session | null {\n    if (!this.persistSession) return null\n    try {\n      const raw = this.storage.getItem(this.storageKey)\n      if (!raw) return null\n      const parsed = JSON.parse(raw) as Session\n      if (!parsed.access_token || !parsed.refresh_token) return null\n      return parsed\n    } catch {\n      return null\n    }\n  }\n\n  private startRefreshTimer() {\n    if (!this.autoRefreshToken || this.refreshTimer || typeof setInterval === 'undefined') return\n    this.refreshTimer = setInterval(() => {\n      if (this.session && this.isExpired(this.session)) void this.refreshWithLock()\n    }, REFRESH_TICK_MS)\n    // Do not keep node processes alive because of the timer (no-op in browsers).\n    const timer = this.refreshTimer as unknown as { unref?: () => void }\n    if (typeof timer === 'object' && typeof timer.unref === 'function') timer.unref()\n  }\n\n  private stopRefreshTimer() {\n    if (this.refreshTimer) {\n      clearInterval(this.refreshTimer)\n      this.refreshTimer = null\n    }\n  }\n\n  private setupCrossTabSync() {\n    if (typeof window === 'undefined' || !this.persistSession) return\n    window.addEventListener('storage', event => {\n      if (event.key !== this.storageKey) return\n      if (!event.newValue) {\n        if (this.session) {\n          this.session = null\n          this.stopRefreshTimer()\n          this.emit('SIGNED_OUT', null)\n        }\n        return\n      }\n      try {\n        const next = JSON.parse(event.newValue) as Session\n        const changed = next.access_token !== this.session?.access_token\n        this.session = next\n        this.startRefreshTimer()\n        if (changed) this.emit('TOKEN_REFRESHED', next)\n      } catch {\n        // ignore malformed writes\n      }\n    })\n  }\n\n  private emit(event: AuthChangeEvent, session: Session | null) {\n    for (const listener of this.listeners.values()) {\n      try {\n        listener(event, session)\n      } catch (err) {\n        console.error('[deepkey] onAuthStateChange listener threw', err)\n      }\n    }\n  }\n}\n\nexport interface AuthClient {\n  auth: Auth\n}\n\nexport const createAuthClient = (publishableKey: string, options?: AuthClientOptions): AuthClient => {\n  return { auth: new Auth(publishableKey, options) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEO,IAAM,kBAAkB;AAKxB,IAAM,iBAAiB,CAAC,QAAgC;AAC7D,QAAM,YAAY,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;AACzD,UAAQ,aAAa,iBAAiB,QAAQ,QAAQ,EAAE;AAC1D;;;AC+BO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAInC,YAAY,SAAiB,QAAiB,MAAe;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;;;ACjCO,IAAM,UAAU,OAAU,YAAuD;AACtF,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI;AACF,UAAM,UAAkC,EAAE,QAAQ,QAAQ,OAAO;AACjE,QAAI,QAAQ,SAAS,OAAW,SAAQ,cAAc,IAAI;AAC1D,QAAI,QAAQ,YAAa,SAAQ,gBAAgB,UAAU,QAAQ,WAAW;AAE9E,UAAM,WAAW,MAAM,UAAU,GAAG,QAAQ,OAAO,GAAG,QAAQ,IAAI,IAAI;AAAA,MACpE,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,MAAM,QAAQ,SAAS,SAAY,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,IACpE,CAAC;AAED,QAAI,SAAS,WAAW,IAAK,QAAO,EAAE,MAAM,CAAC,GAAQ,OAAO,KAAK;AAEjE,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,SAAS,KAAK;AAAA,IAChC,QAAQ;AACN,gBAAU;AAAA,IACZ;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,SAAoE;AACvF,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO,IAAI;AAAA,UACT,WAAW,WAAW,8BAA8B,SAAS,MAAM;AAAA,UACnE,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,SAAc,OAAO,KAAK;AAAA,EAC3C,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,EAAE,MAAM,MAAM,OAAO,IAAI,UAAU,SAAS,GAAG,eAAe,EAAE;AAAA,EACzE;AACF;;;ACvDA,IAAM,gBAAN,MAA8C;AAAA,EAA9C;AACE,SAAQ,QAAQ,oBAAI,IAAoB;AAAA;AAAA,EACxC,QAAQ,KAAa;AACnB,WAAO,KAAK,MAAM,IAAI,GAAG,KAAK;AAAA,EAChC;AAAA,EACA,QAAQ,KAAa,OAAe;AAClC,SAAK,MAAM,IAAI,KAAK,KAAK;AAAA,EAC3B;AAAA,EACA,WAAW,KAAa;AACtB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AACF;AAGO,IAAM,iBAAiB,MAAsB;AAClD,MAAI;AACF,QAAI,OAAO,WAAW,eAAe,OAAO,cAAc;AACxD,YAAM,QAAQ;AACd,aAAO,aAAa,QAAQ,OAAO,GAAG;AACtC,aAAO,aAAa,WAAW,KAAK;AACpC,aAAO,OAAO;AAAA,IAChB;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,cAAc;AAC3B;AAIO,IAAM,mBAAmB,CAAC,mBAA+C;AAC9E,QAAM,QAAQ,gBAAgB,MAAM,sCAAsC;AAC1E,SAAO,QAAQ,MAAM,MAAM,CAAC,CAAC,gBAAgB;AAC/C;;;ACjBO,IAAM,gBAAgB,CAAC,SAAiC;AAC7D,MAAI,CAAC,QAAQ,KAAK,SAAS,EAAG,QAAO;AACrC,QAAM,SAAS,IAAI,gBAAgB,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI;AAE9E,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,MAAI,OAAO;AACT,WAAO;AAAA,MACL,WAAW;AAAA,QACT;AAAA,QACA,YAAY,OAAO,IAAI,YAAY,KAAK;AAAA,QACxC,mBAAmB,OAAO,IAAI,mBAAmB,KAAK;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,IAAI,cAAc;AAC7C,QAAM,eAAe,OAAO,IAAI,eAAe;AAC/C,MAAI,CAAC,eAAe,CAAC,aAAc,QAAO;AAE1C,QAAM,YAAY,OAAO,OAAO,IAAI,YAAY,KAAK,IAAI;AACzD,QAAM,YAAY,OAAO,OAAO,IAAI,YAAY,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,SAAS;AAE9F,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,cAAc;AAAA,MACd,eAAe;AAAA,MACf,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,MAAM,OAAO,IAAI,MAAM,KAAK;AAAA,IAC9B;AAAA,EACF;AACF;AAIO,IAAM,uBAAuB,MAAM;AACxC,MAAI,OAAO,WAAW,eAAe,OAAO,YAAY,YAAa;AACrE,UAAQ,aAAa,MAAM,IAAI,OAAO,SAAS,WAAW,OAAO,SAAS,MAAM;AAClF;;;ACvCA,IAAM,kBAAkB;AAExB,IAAM,wBAAwB;AAIvB,IAAM,OAAN,MAAW;AAAA,EAiBhB,YAAY,gBAAwB,UAA6B,CAAC,GAAG;AAPrE,SAAQ,UAA0B;AAClC,SAAQ,YAAY,oBAAI,IAAsB;AAC9C,SAAQ,cAAc;AACtB,SAAQ,oBAA0C;AAClD,SAAQ,iBAA+F;AACvG,SAAQ,eAAsD;AAO5D,SAAK,UAAU,eAAe,QAAQ,iBAAiB;AACvD,SAAK,SAAS,kBAAkB;AAChC,SAAK,iBAAiB,QAAQ,kBAAkB;AAChD,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,qBAAqB,QAAQ,sBAAsB;AACxD,SAAK,UAAU,QAAQ,WAAW,eAAe;AACjD,SAAK,aAAa,QAAQ,cAAc,iBAAiB,cAAc;AACvE,SAAK,YAAY,QAAQ;AAEzB,SAAK,kBAAkB;AAAA,EACzB;AAAA;AAAA,EAIA,MAAM,cAAc,aAA6F;AAC/G,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,QAA+B,QAAQ,gBAAgB;AAAA,MAClF,OAAO,YAAY;AAAA,MACnB,aAAa,YAAY,SAAS;AAAA,MAClC,aAAa,YAAY,SAAS;AAAA,IACpC,CAAC;AACD,WAAO,EAAE,MAAM,EAAE,MAAM,MAAM,SAAS,KAAK,GAAG,MAAM;AAAA,EACtD;AAAA,EAEA,MAAM,UAAU,QAAgG;AAC9G,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAiB,QAAQ,mBAAmB;AAAA,MAC7E,MAAM;AAAA,MACN,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AACD,QAAI,SAAS,CAAC,KAAM,QAAO,EAAE,MAAM,EAAE,MAAM,MAAM,SAAS,KAAK,GAAG,MAAM;AAExE,UAAM,KAAK,YAAY,IAAI;AAC3B,SAAK,KAAK,aAAa,IAAI;AAC3B,WAAO,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,GAAG,OAAO,KAAK;AAAA,EACjE;AAAA,EAEA,MAAM,gBACJ,aAC0D;AAC1D,UAAM,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,oBAAoB;AACvD,QAAI,aAAa,IAAI,YAAY,YAAY,QAAQ;AACrD,QAAI,aAAa,IAAI,UAAU,KAAK,MAAM;AAC1C,QAAI,YAAY,SAAS,WAAY,KAAI,aAAa,IAAI,eAAe,YAAY,QAAQ,UAAU;AACvG,QAAI,YAAY,SAAS,OAAQ,KAAI,aAAa,IAAI,UAAU,YAAY,QAAQ,MAAM;AAC1F,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,YAAY,SAAS,eAAe,CAAC,CAAC,GAAG;AACjF,UAAI,aAAa,IAAI,KAAK,KAAK;AAAA,IACjC;AAEA,QAAI,CAAC,YAAY,SAAS,uBAAuB,OAAO,WAAW,aAAa;AAC9E,aAAO,SAAS,OAAO,IAAI,SAAS,CAAC;AAAA,IACvC;AACA,WAAO,EAAE,MAAM,EAAE,UAAU,YAAY,UAAU,KAAK,IAAI,SAAS,EAAE,GAAG,OAAO,KAAK;AAAA,EACtF;AAAA,EAEA,kBAAkB,UAA8D;AAC9E,UAAM,KAAK,YAAY,EAAE,KAAK,WAAW;AACzC,SAAK,UAAU,IAAI,IAAI,QAAQ;AAI/B,SAAK,WAAW,EAAE,KAAK,MAAM;AAC3B,UAAI,KAAK,UAAU,IAAI,EAAE,EAAG,UAAS,mBAAmB,KAAK,OAAO;AAAA,IACtE,CAAC;AAED,WAAO;AAAA,MACL,MAAM;AAAA,QACJ,cAAc;AAAA,UACZ;AAAA,UACA,aAAa,MAAM;AACjB,iBAAK,UAAU,OAAO,EAAE;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,UAAgD;AACpD,UAAM,KAAK,WAAW;AACtB,UAAM,UAAU,KAAK;AACrB,QAAI,SAAS;AAEX,YAAM,KAAK,QAAQ,QAAQ,mBAAmB,CAAC,GAAG,QAAQ,YAAY;AAAA,IACxE;AACA,SAAK,aAAa;AAClB,SAAK,KAAK,cAAc,IAAI;AAC5B,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAAA,EAEA,MAAM,aAAiE;AACrE,UAAM,KAAK,WAAW;AAEtB,QAAI,KAAK,WAAW,KAAK,UAAU,KAAK,OAAO,KAAK,KAAK,kBAAkB;AACzE,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB;AAC7C,UAAI,SAAS,MAAM,SAAS,iBAAiB;AAC3C,eAAO,EAAE,MAAM,EAAE,SAAS,KAAK,GAAG,OAAO,KAAK;AAAA,MAChD;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,EAAE,SAAS,KAAK,QAAQ,GAAG,OAAO,KAAK;AAAA,EACxD;AAAA,EAEA,MAAM,QAAQ,KAA4D;AACxE,QAAI,QAAQ;AACZ,QAAI,CAAC,OAAO;AACV,YAAM;AAAA,QACJ,MAAM,EAAE,QAAQ;AAAA,MAClB,IAAI,MAAM,KAAK,WAAW;AAC1B,cAAQ,SAAS;AAAA,IACnB;AACA,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB,EAAE;AAAA,IACvG;AAEA,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAc,OAAO,iBAAiB,QAAW,KAAK;AACzF,WAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,eAAe,gBAEqD;AACxE,UAAM,KAAK,WAAW;AACtB,UAAM,eAAe,gBAAgB,iBAAiB,KAAK,SAAS;AACpE,QAAI,CAAC,cAAc;AACjB,aAAO;AAAA,QACL,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK;AAAA,QAClC,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB;AAAA,MACtE;AAAA,IACF;AACA,WAAO,KAAK,gBAAgB,YAAY;AAAA,EAC1C;AAAA;AAAA,EAIA,MAAc,QAAW,QAAwB,MAAc,MAAgB,aAAsB;AACnG,WAAO,QAAW;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,WAAW,KAAK;AAAA,IAClB,CAAC;AAAA,EACH;AAAA,EAEQ,aAA4B;AAClC,SAAK,sBAAL,KAAK,oBAAsB,KAAK,aAAa;AAC7C,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,eAA8B;AAC1C,QAAI,KAAK,sBAAsB,OAAO,WAAW,aAAa;AAC5D,YAAM,SAAS,cAAc,OAAO,SAAS,IAAI;AACjD,UAAI,QAAQ;AAEV,6BAAqB;AAErB,YAAI,eAAe,QAAQ;AACzB,kBAAQ;AAAA,YACN,8CAA8C,OAAO,UAAU,cAAc,OAAO,UAAU,KAAK;AAAA,YACnG,OAAO,UAAU,qBAAqB;AAAA,UACxC;AAAA,QACF,OAAO;AACL,gBAAM,EAAE,MAAM,KAAK,IAAI,MAAM,KAAK,QAAc,OAAO,iBAAiB,QAAW,OAAO,OAAO,YAAY;AAC7G,cAAI,MAAM;AACR,kBAAM,UAAmB,EAAE,GAAG,OAAO,QAAQ,YAAY,UAAU,KAAK;AACxE,kBAAM,KAAK,YAAY,OAAO;AAC9B,iBAAK,KAAK,aAAa,OAAO;AAC9B;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,kBAAkB;AACtC,QAAI,CAAC,OAAQ;AAEb,QAAI,KAAK,UAAU,MAAM,GAAG;AAC1B,UAAI,CAAC,KAAK,iBAAkB;AAC5B,WAAK,UAAU;AACf,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB;AAC7C,UAAI,SAAS,MAAM,SAAS,gBAAiB,MAAK,aAAa;AAC/D;AAAA,IACF;AAEA,SAAK,UAAU;AACf,SAAK,kBAAkB;AAAA,EACzB;AAAA,EAEQ,UAAU,SAA2B;AAC3C,WAAO,QAAQ,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAC/D;AAAA,EAEA,MAAc,gBACZ,cACuE;AACvE,SAAK,mBAAL,KAAK,iBAAmB,KAAK,UAAU,YAAY,EAAE,QAAQ,MAAM;AACjE,WAAK,iBAAiB;AAAA,IACxB,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,UACZ,cACuE;AACvE,UAAM,QAAQ,gBAAgB,KAAK,SAAS;AAC5C,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK;AAAA,QAClC,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB;AAAA,MACtE;AAAA,IACF;AAEA,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAiB,QAAQ,2CAA2C;AAAA,MACrG,eAAe;AAAA,IACjB,CAAC;AAED,QAAI,OAAO;AAET,UAAI,MAAM,SAAS,iBAAiB;AAClC,aAAK,aAAa;AAClB,aAAK,KAAK,cAAc,IAAI;AAAA,MAC9B;AACA,aAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,GAAG,MAAM;AAAA,IACtD;AAEA,QAAI,MAAM;AACR,YAAM,KAAK,YAAY,IAAI;AAC3B,WAAK,KAAK,mBAAmB,IAAI;AACjC,aAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,KAAK,GAAG,OAAO,KAAK;AAAA,IACjE;AACA,WAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,wBAAwB,EAAE;AAAA,EAC/F;AAAA,EAEA,MAAc,YAAY,SAAkB;AAC1C,SAAK,UAAU;AACf,QAAI,KAAK,gBAAgB;AACvB,UAAI;AACF,aAAK,QAAQ,QAAQ,KAAK,YAAY,KAAK,UAAU,OAAO,CAAC;AAAA,MAC/D,QAAQ;AAAA,MAER;AAAA,IACF;AACA,SAAK,kBAAkB;AAAA,EACzB;AAAA,EAEQ,eAAe;AACrB,SAAK,UAAU;AACf,QAAI;AACF,WAAK,QAAQ,WAAW,KAAK,UAAU;AAAA,IACzC,QAAQ;AAAA,IAER;AACA,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEQ,oBAAoC;AAC1C,QAAI,CAAC,KAAK,eAAgB,QAAO;AACjC,QAAI;AACF,YAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK,UAAU;AAChD,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,gBAAgB,CAAC,OAAO,cAAe,QAAO;AAC1D,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,oBAAoB;AAC1B,QAAI,CAAC,KAAK,oBAAoB,KAAK,gBAAgB,OAAO,gBAAgB,YAAa;AACvF,SAAK,eAAe,YAAY,MAAM;AACpC,UAAI,KAAK,WAAW,KAAK,UAAU,KAAK,OAAO,EAAG,MAAK,KAAK,gBAAgB;AAAA,IAC9E,GAAG,eAAe;AAElB,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,YAAY,OAAO,MAAM,UAAU,WAAY,OAAM,MAAM;AAAA,EAClF;AAAA,EAEQ,mBAAmB;AACzB,QAAI,KAAK,cAAc;AACrB,oBAAc,KAAK,YAAY;AAC/B,WAAK,eAAe;AAAA,IACtB;AAAA,EACF;AAAA,EAEQ,oBAAoB;AAC1B,QAAI,OAAO,WAAW,eAAe,CAAC,KAAK,eAAgB;AAC3D,WAAO,iBAAiB,WAAW,WAAS;AAC1C,UAAI,MAAM,QAAQ,KAAK,WAAY;AACnC,UAAI,CAAC,MAAM,UAAU;AACnB,YAAI,KAAK,SAAS;AAChB,eAAK,UAAU;AACf,eAAK,iBAAiB;AACtB,eAAK,KAAK,cAAc,IAAI;AAAA,QAC9B;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,OAAO,KAAK,MAAM,MAAM,QAAQ;AACtC,cAAM,UAAU,KAAK,iBAAiB,KAAK,SAAS;AACpD,aAAK,UAAU;AACf,aAAK,kBAAkB;AACvB,YAAI,QAAS,MAAK,KAAK,mBAAmB,IAAI;AAAA,MAChD,QAAQ;AAAA,MAER;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,KAAK,OAAwB,SAAyB;AAC5D,eAAW,YAAY,KAAK,UAAU,OAAO,GAAG;AAC9C,UAAI;AACF,iBAAS,OAAO,OAAO;AAAA,MACzB,SAAS,KAAK;AACZ,gBAAQ,MAAM,8CAA8C,GAAG;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;AAMO,IAAM,mBAAmB,CAAC,gBAAwB,YAA4C;AACnG,SAAO,EAAE,MAAM,IAAI,KAAK,gBAAgB,OAAO,EAAE;AACnD;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/fetch.ts","../src/connections.ts","../src/constants.ts","../src/storage.ts","../src/url.ts","../src/client.ts"],"sourcesContent":["export { createAuthClient, Auth, type AuthClient } from './client'\nexport { Connections } from './connections'\nexport { DEEPKEY_API_URL } from './constants'\nexport {\n  AuthError,\n  type AuthChangeEvent,\n  type AuthClientOptions,\n  type AuthResponse,\n  type ConnectProviderCredentials,\n  type ServerClientOptions,\n  type ProviderAccessToken,\n  type ProviderConnection,\n  type Session,\n  type SignInWithOAuthCredentials,\n  type SignInWithOtpCredentials,\n  type StorageAdapter,\n  type Subscription,\n  type User,\n  type UserIdentity,\n  type VerifyOtpParams,\n} from './types'\n","export interface UserIdentity {\n  identity_id: string\n  id: string\n  user_id: string\n  provider: string\n  identity_data: Record<string, unknown>\n  last_sign_in_at: string | null\n  created_at: string\n  updated_at: string\n}\n\nexport interface User {\n  id: string\n  aud: string\n  role: string\n  email: string | null\n  email_confirmed_at: string | null\n  app_metadata: { provider?: string | null; providers?: string[]; [key: string]: unknown }\n  user_metadata: {\n    name?: string\n    full_name?: string\n    avatar_url?: string\n    picture?: string\n    email?: string\n    [key: string]: unknown\n  }\n  identities?: UserIdentity[]\n  created_at: string\n  updated_at?: string\n  last_sign_in_at?: string | null\n}\n\nexport interface Session {\n  access_token: string\n  refresh_token: string\n  token_type: 'bearer'\n  expires_in: number\n  expires_at: number\n  user: User\n}\n\nexport class AuthError extends Error {\n  status?: number\n  code?: string\n\n  constructor(message: string, status?: number, code?: string) {\n    super(message)\n    this.name = 'AuthError'\n    this.status = status\n    this.code = code\n  }\n}\n\nexport type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED'\n\nexport interface Subscription {\n  id: string\n  unsubscribe: () => void\n}\n\nexport interface StorageAdapter {\n  getItem(key: string): string | null\n  setItem(key: string, value: string): void\n  removeItem(key: string): void\n}\n\nexport interface AuthClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  storageKey?: string\n  autoRefreshToken?: boolean\n  detectSessionInUrl?: boolean\n  persistSession?: boolean\n  storage?: StorageAdapter\n  fetch?: typeof fetch\n}\n\nexport interface ServerClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  fetch?: typeof fetch\n}\n\nexport interface SignInWithOtpCredentials {\n  email: string\n  options?: {\n    emailRedirectTo?: string\n    shouldCreateUser?: boolean\n    data?: Record<string, unknown>\n  }\n}\n\nexport interface VerifyOtpParams {\n  email: string\n  token: string\n  type: 'email' | 'magiclink'\n}\n\nexport interface ConnectProviderCredentials {\n  provider: string\n  options?: {\n    redirectTo?: string\n    skipBrowserRedirect?: boolean\n  }\n}\n\n// Metadata only: provider tokens never appear in browser responses.\nexport interface ProviderConnection {\n  id: string\n  // The DeepKey user that granted the connection: the same `user.id` your server gets from getUser(jwt).\n  user_id: string\n  provider: string\n  provider_user_id: string\n  identity_data: Record<string, unknown>\n  scope: string | null\n  status: 'active' | 'reauthorization_required'\n  created_at: string\n  updated_at: string\n}\n\n// Issued to consumer servers through the secret key; short-lived and refreshed by DeepKey.\nexport interface ProviderAccessToken {\n  access_token: string\n  token_type: 'bearer'\n  expires_at: number | null\n  scope: string | null\n}\n\nexport interface SignInWithOAuthCredentials {\n  provider: string\n  options?: {\n    redirectTo?: string\n    scopes?: string\n    queryParams?: Record<string, string>\n    skipBrowserRedirect?: boolean\n  }\n}\n\nexport interface AuthResponse<T> {\n  data: T\n  error: AuthError | null\n}\n","import { AuthError } from './types'\n\nexport interface RequestOptions {\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE'\n  path: string\n  apikey: string\n  baseUrl: string\n  accessToken?: string\n  body?: unknown\n  fetchImpl?: typeof fetch\n}\n\nexport interface RequestResult<T> {\n  data: T | null\n  error: AuthError | null\n}\n\n// All service errors are shaped { error: { code, message } }.\nexport const request = async <T>(options: RequestOptions): Promise<RequestResult<T>> => {\n  const fetchImpl = options.fetchImpl ?? fetch\n  try {\n    const headers: Record<string, string> = { apikey: options.apikey }\n    if (options.body !== undefined) headers['Content-Type'] = 'application/json'\n    if (options.accessToken) headers.Authorization = `Bearer ${options.accessToken}`\n\n    const response = await fetchImpl(`${options.baseUrl}${options.path}`, {\n      method: options.method,\n      headers,\n      body: options.body !== undefined ? JSON.stringify(options.body) : undefined,\n    })\n\n    if (response.status === 204) return { data: {} as T, error: null }\n\n    let payload: unknown\n    try {\n      payload = await response.json()\n    } catch {\n      payload = null\n    }\n\n    if (!response.ok) {\n      const errorBody = (payload as { error?: { code?: string; message?: string } } | null)?.error\n      return {\n        data: null,\n        error: new AuthError(\n          errorBody?.message ?? `Request failed with status ${response.status}`,\n          response.status,\n          errorBody?.code,\n        ),\n      }\n    }\n\n    return { data: payload as T, error: null }\n  } catch (err) {\n    const message = err instanceof Error ? err.message : 'Network request failed'\n    return { data: null, error: new AuthError(message, 0, 'network_error') }\n  }\n}\n","import type { Auth } from './client'\nimport { request } from './fetch'\nimport { AuthError, type AuthResponse, type ConnectProviderCredentials, type ProviderConnection } from './types'\n\nexport interface ConnectionsOptions {\n  apikey: string\n  baseUrl: string\n  fetchImpl?: typeof fetch\n}\n\n// Durable provider access for the signed-in user, kept apart from login identities:\n// a user who signed in with Google can connect several X accounts. Provider refresh\n// tokens stay on DeepKey; browsers only ever see connection metadata.\nexport class Connections {\n  constructor(\n    private auth: Auth,\n    private options: ConnectionsOptions,\n  ) {}\n\n  async connect(\n    credentials: ConnectProviderCredentials,\n  ): Promise<AuthResponse<{ provider: string; url: string | null }>> {\n    const { data, error } = await this.request<{ provider: string; url: string }>(\n      'POST',\n      '/auth/v1/connections/authorize',\n      { provider: credentials.provider, redirect_to: credentials.options?.redirectTo },\n    )\n    if (error || !data) return { data: { provider: credentials.provider, url: null }, error }\n\n    if (!credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {\n      window.location.assign(data.url)\n    }\n    return { data: { provider: credentials.provider, url: data.url }, error: null }\n  }\n\n  async list(): Promise<AuthResponse<{ connections: ProviderConnection[] }>> {\n    const { data, error } = await this.request<{ connections: ProviderConnection[] }>('GET', '/auth/v1/connections')\n    return { data: { connections: data?.connections ?? [] }, error }\n  }\n\n  async revoke(connectionId: string): Promise<{ error: AuthError | null }> {\n    const { error } = await this.request('DELETE', `/auth/v1/connections/${encodeURIComponent(connectionId)}`)\n    return { error }\n  }\n\n  private async request<T>(method: 'GET' | 'POST' | 'DELETE', path: string, body?: unknown) {\n    const {\n      data: { session },\n    } = await this.auth.getSession()\n    if (!session) {\n      return { data: null, error: new AuthError('Auth session missing!', 400, 'session_missing') }\n    }\n    return request<T>({ method, path, body, accessToken: session.access_token, ...this.options })\n  }\n}\n","// The hosted DeepKey API. Every client talks to this origin; only DeepKey's own\n// console and test suites replace it through the internal override.\nexport const DEEPKEY_API_URL = 'https://deepkey.dev/api'\n\n// Resolves the base URL used for every request. An absent or blank internal\n// override keeps the hosted API; a provided value has any trailing slash removed\n// so path joins stay predictable.\nexport const resolveBaseUrl = (url?: string | null): string => {\n  const candidate = typeof url === 'string' ? url.trim() : ''\n  return (candidate || DEEPKEY_API_URL).replace(/\\/+$/, '')\n}\n","import type { StorageAdapter } from './types'\n\nclass MemoryStorage implements StorageAdapter {\n  private store = new Map<string, string>()\n  getItem(key: string) {\n    return this.store.get(key) ?? null\n  }\n  setItem(key: string, value: string) {\n    this.store.set(key, value)\n  }\n  removeItem(key: string) {\n    this.store.delete(key)\n  }\n}\n\n// localStorage when available, in-memory fallback (SSR, tests, restricted contexts).\nexport const defaultStorage = (): StorageAdapter => {\n  try {\n    if (typeof window !== 'undefined' && window.localStorage) {\n      const probe = '__bt_auth_probe__'\n      window.localStorage.setItem(probe, '1')\n      window.localStorage.removeItem(probe)\n      return window.localStorage\n    }\n  } catch {\n    // fall through to memory storage\n  }\n  return new MemoryStorage()\n}\n\n// Publishable keys look like `bt_pub_<project-slug>_<random>`; the slug namespaces the\n// persisted session per project (mirrors supabase's `sb-<ref>-auth-token`).\nexport const deriveStorageKey = (publishableKey: string | undefined): string => {\n  const match = publishableKey?.match(/^bt_pub_([a-z0-9-]+)_[A-Za-z0-9_-]+$/)\n  return match ? `bt-${match[1]}-auth-token` : 'bt-auth-token'\n}\n","export interface FragmentTokens {\n  access_token: string\n  refresh_token: string\n  expires_in: number\n  expires_at: number\n  token_type: 'bearer'\n  type?: string\n}\n\nexport interface FragmentError {\n  error: string\n  error_code?: string\n  error_description?: string\n}\n\nexport type ParsedFragment = { tokens: FragmentTokens } | { authError: FragmentError } | null\n\n// Parses the implicit-flow return fragment (`#access_token=...` or `#error=...`).\nexport const parseFragment = (hash: string): ParsedFragment => {\n  if (!hash || hash.length < 2) return null\n  const params = new URLSearchParams(hash.startsWith('#') ? hash.slice(1) : hash)\n\n  const error = params.get('error')\n  if (error) {\n    return {\n      authError: {\n        error,\n        error_code: params.get('error_code') ?? undefined,\n        error_description: params.get('error_description') ?? undefined,\n      },\n    }\n  }\n\n  const accessToken = params.get('access_token')\n  const refreshToken = params.get('refresh_token')\n  if (!accessToken || !refreshToken) return null\n\n  const expiresIn = Number(params.get('expires_in') ?? 3600)\n  const expiresAt = Number(params.get('expires_at') ?? Math.floor(Date.now() / 1000) + expiresIn)\n\n  return {\n    tokens: {\n      access_token: accessToken,\n      refresh_token: refreshToken,\n      expires_in: expiresIn,\n      expires_at: expiresAt,\n      token_type: 'bearer',\n      type: params.get('type') ?? undefined,\n    },\n  }\n}\n\n// Removes the auth fragment from the address bar (before any await, so tokens never\n// linger in history).\nexport const cleanFragmentFromUrl = () => {\n  if (typeof window === 'undefined' || typeof history === 'undefined') return\n  history.replaceState(null, '', window.location.pathname + window.location.search)\n}\n","import { Connections } from './connections'\nimport { resolveBaseUrl } from './constants'\nimport { request } from './fetch'\nimport { defaultStorage, deriveStorageKey } from './storage'\nimport {\n  AuthError,\n  type AuthChangeEvent,\n  type AuthClientOptions,\n  type AuthResponse,\n  type Session,\n  type SignInWithOAuthCredentials,\n  type SignInWithOtpCredentials,\n  type StorageAdapter,\n  type Subscription,\n  type User,\n  type VerifyOtpParams,\n} from './types'\nimport { cleanFragmentFromUrl, parseFragment } from './url'\n\nconst REFRESH_TICK_MS = 30_000\n// Refresh when the access token is within this margin of expiry.\nconst EXPIRY_MARGIN_SECONDS = 90\n\ntype Listener = (event: AuthChangeEvent, session: Session | null) => void\n\nexport class Auth {\n  private baseUrl: string\n  private apikey: string\n  private storage: StorageAdapter\n  private storageKey: string\n  private persistSession: boolean\n  private autoRefreshToken: boolean\n  private detectSessionInUrl: boolean\n  private fetchImpl?: typeof fetch\n\n  private session: Session | null = null\n  private listeners = new Map<string, Listener>()\n  private listenerSeq = 0\n  private initializePromise: Promise<void> | null = null\n  private refreshPromise: Promise<AuthResponse<{ session: Session | null; user: User | null }>> | null = null\n  private refreshTimer: ReturnType<typeof setInterval> | null = null\n\n  constructor(publishableKey: string, options: AuthClientOptions = {}) {\n    // Lazy by design: an empty key must not throw at construction time (CI builds\n    // with empty envs import this module transitively). Failures surface on first call.\n    // The hosted DeepKey API is the only supported origin. The internal override\n    // exists for DeepKey's console and tests and is not part of the public contract.\n    this.baseUrl = resolveBaseUrl(options.__internalBaseUrl)\n    this.apikey = publishableKey ?? ''\n    this.persistSession = options.persistSession ?? true\n    this.autoRefreshToken = options.autoRefreshToken ?? true\n    this.detectSessionInUrl = options.detectSessionInUrl ?? true\n    this.storage = options.storage ?? defaultStorage()\n    this.storageKey = options.storageKey ?? deriveStorageKey(publishableKey)\n    this.fetchImpl = options.fetch\n\n    this.setupCrossTabSync()\n  }\n\n  // ---- public API (supabase-js compatible) ----\n\n  async signInWithOtp(credentials: SignInWithOtpCredentials): Promise<AuthResponse<{ user: null; session: null }>> {\n    const { error } = await this.request<Record<string, never>>('POST', '/auth/v1/otp', {\n      email: credentials.email,\n      create_user: credentials.options?.shouldCreateUser,\n      redirect_to: credentials.options?.emailRedirectTo,\n    })\n    return { data: { user: null, session: null }, error }\n  }\n\n  async verifyOtp(params: VerifyOtpParams): Promise<AuthResponse<{ user: User | null; session: Session | null }>> {\n    const { data, error } = await this.request<Session>('POST', '/auth/v1/verify', {\n      type: 'email',\n      email: params.email,\n      token: params.token,\n    })\n    if (error || !data) return { data: { user: null, session: null }, error }\n\n    await this.saveSession(data)\n    this.emit('SIGNED_IN', data)\n    return { data: { user: data.user, session: data }, error: null }\n  }\n\n  async signInWithOAuth(\n    credentials: SignInWithOAuthCredentials,\n  ): Promise<AuthResponse<{ provider: string; url: string }>> {\n    const url = new URL(`${this.baseUrl}/auth/v1/authorize`)\n    url.searchParams.set('provider', credentials.provider)\n    url.searchParams.set('apikey', this.apikey)\n    if (credentials.options?.redirectTo) url.searchParams.set('redirect_to', credentials.options.redirectTo)\n    if (credentials.options?.scopes) url.searchParams.set('scopes', credentials.options.scopes)\n    for (const [key, value] of Object.entries(credentials.options?.queryParams ?? {})) {\n      url.searchParams.set(key, value)\n    }\n\n    if (!credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {\n      window.location.assign(url.toString())\n    }\n    return { data: { provider: credentials.provider, url: url.toString() }, error: null }\n  }\n\n  onAuthStateChange(callback: Listener): { data: { subscription: Subscription } } {\n    const id = `listener-${++this.listenerSeq}`\n    this.listeners.set(id, callback)\n\n    // Every subscriber receives INITIAL_SESSION asynchronously once initialization\n    // settles — the supabase-js contract that AuthProviders rely on to resolve loading.\n    this.initialize().then(() => {\n      if (this.listeners.has(id)) callback('INITIAL_SESSION', this.session)\n    })\n\n    return {\n      data: {\n        subscription: {\n          id,\n          unsubscribe: () => {\n            this.listeners.delete(id)\n          },\n        },\n      },\n    }\n  }\n\n  async signOut(): Promise<{ error: AuthError | null }> {\n    await this.initialize()\n    const session = this.session\n    if (session) {\n      // Best-effort server-side revocation; local sign-out always succeeds.\n      await this.request('POST', '/auth/v1/logout', {}, session.access_token)\n    }\n    this.clearSession()\n    this.emit('SIGNED_OUT', null)\n    return { error: null }\n  }\n\n  async getSession(): Promise<AuthResponse<{ session: Session | null }>> {\n    await this.initialize()\n\n    if (this.session && this.isExpired(this.session) && this.autoRefreshToken) {\n      const { error } = await this.refreshWithLock()\n      if (error && error.code !== 'network_error') {\n        return { data: { session: null }, error: null }\n      }\n    }\n\n    return { data: { session: this.session }, error: null }\n  }\n\n  async getUser(jwt?: string): Promise<AuthResponse<{ user: User | null }>> {\n    let token = jwt\n    if (!token) {\n      const {\n        data: { session },\n      } = await this.getSession()\n      token = session?.access_token\n    }\n    if (!token) {\n      return { data: { user: null }, error: new AuthError('Auth session missing!', 400, 'session_missing') }\n    }\n\n    const { data, error } = await this.request<User>('GET', '/auth/v1/user', undefined, token)\n    return { data: { user: data }, error }\n  }\n\n  async refreshSession(currentSession?: {\n    refresh_token: string\n  }): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    await this.initialize()\n    const refreshToken = currentSession?.refresh_token ?? this.session?.refresh_token\n    if (!refreshToken) {\n      return {\n        data: { session: null, user: null },\n        error: new AuthError('Auth session missing!', 400, 'session_missing'),\n      }\n    }\n    return this.refreshWithLock(refreshToken)\n  }\n\n  // ---- internals ----\n\n  private async request<T>(method: 'GET' | 'POST', path: string, body?: unknown, accessToken?: string) {\n    return request<T>({\n      method,\n      path,\n      body,\n      accessToken,\n      apikey: this.apikey,\n      baseUrl: this.baseUrl,\n      fetchImpl: this.fetchImpl,\n    })\n  }\n\n  private initialize(): Promise<void> {\n    this.initializePromise ??= this.doInitialize()\n    return this.initializePromise\n  }\n\n  private async doInitialize(): Promise<void> {\n    if (this.detectSessionInUrl && typeof window !== 'undefined') {\n      const parsed = parseFragment(window.location.hash)\n      if (parsed) {\n        // Strip tokens from the address bar synchronously, before any await.\n        cleanFragmentFromUrl()\n\n        if ('authError' in parsed) {\n          console.warn(\n            `[deepkey] Auth redirect returned an error: ${parsed.authError.error_code ?? parsed.authError.error}`,\n            parsed.authError.error_description ?? '',\n          )\n        } else {\n          const { data: user } = await this.request<User>('GET', '/auth/v1/user', undefined, parsed.tokens.access_token)\n          if (user) {\n            const session: Session = { ...parsed.tokens, token_type: 'bearer', user }\n            await this.saveSession(session)\n            this.emit('SIGNED_IN', session)\n            return\n          }\n        }\n      }\n    }\n\n    const stored = this.loadStoredSession()\n    if (!stored) return\n\n    if (this.isExpired(stored)) {\n      if (!this.autoRefreshToken) return\n      this.session = stored\n      const { error } = await this.refreshWithLock()\n      if (error && error.code !== 'network_error') this.clearSession()\n      return\n    }\n\n    this.session = stored\n    this.startRefreshTimer()\n  }\n\n  private isExpired(session: Session): boolean {\n    return session.expires_at <= Math.floor(Date.now() / 1000) + EXPIRY_MARGIN_SECONDS\n  }\n\n  private async refreshWithLock(\n    refreshToken?: string,\n  ): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    this.refreshPromise ??= this.doRefresh(refreshToken).finally(() => {\n      this.refreshPromise = null\n    })\n    return this.refreshPromise\n  }\n\n  private async doRefresh(\n    refreshToken?: string,\n  ): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    const token = refreshToken ?? this.session?.refresh_token\n    if (!token) {\n      return {\n        data: { session: null, user: null },\n        error: new AuthError('Auth session missing!', 400, 'session_missing'),\n      }\n    }\n\n    const { data, error } = await this.request<Session>('POST', '/auth/v1/token?grant_type=refresh_token', {\n      refresh_token: token,\n    })\n\n    if (error) {\n      // Network failures keep the session (retry next tick); auth failures clear it.\n      if (error.code !== 'network_error') {\n        this.clearSession()\n        this.emit('SIGNED_OUT', null)\n      }\n      return { data: { session: null, user: null }, error }\n    }\n\n    if (data) {\n      await this.saveSession(data)\n      this.emit('TOKEN_REFRESHED', data)\n      return { data: { session: data, user: data.user }, error: null }\n    }\n    return { data: { session: null, user: null }, error: new AuthError('Empty refresh response') }\n  }\n\n  private async saveSession(session: Session) {\n    this.session = session\n    if (this.persistSession) {\n      try {\n        this.storage.setItem(this.storageKey, JSON.stringify(session))\n      } catch {\n        // Persistence is best-effort (private mode, quota).\n      }\n    }\n    this.startRefreshTimer()\n  }\n\n  private clearSession() {\n    this.session = null\n    try {\n      this.storage.removeItem(this.storageKey)\n    } catch {\n      // ignore\n    }\n    this.stopRefreshTimer()\n  }\n\n  private loadStoredSession(): Session | null {\n    if (!this.persistSession) return null\n    try {\n      const raw = this.storage.getItem(this.storageKey)\n      if (!raw) return null\n      const parsed = JSON.parse(raw) as Session\n      if (!parsed.access_token || !parsed.refresh_token) return null\n      return parsed\n    } catch {\n      return null\n    }\n  }\n\n  private startRefreshTimer() {\n    if (!this.autoRefreshToken || this.refreshTimer || typeof setInterval === 'undefined') return\n    this.refreshTimer = setInterval(() => {\n      if (this.session && this.isExpired(this.session)) void this.refreshWithLock()\n    }, REFRESH_TICK_MS)\n    // Do not keep node processes alive because of the timer (no-op in browsers).\n    const timer = this.refreshTimer as unknown as { unref?: () => void }\n    if (typeof timer === 'object' && typeof timer.unref === 'function') timer.unref()\n  }\n\n  private stopRefreshTimer() {\n    if (this.refreshTimer) {\n      clearInterval(this.refreshTimer)\n      this.refreshTimer = null\n    }\n  }\n\n  private setupCrossTabSync() {\n    if (typeof window === 'undefined' || !this.persistSession) return\n    window.addEventListener('storage', event => {\n      if (event.key !== this.storageKey) return\n      if (!event.newValue) {\n        if (this.session) {\n          this.session = null\n          this.stopRefreshTimer()\n          this.emit('SIGNED_OUT', null)\n        }\n        return\n      }\n      try {\n        const next = JSON.parse(event.newValue) as Session\n        const changed = next.access_token !== this.session?.access_token\n        this.session = next\n        this.startRefreshTimer()\n        if (changed) this.emit('TOKEN_REFRESHED', next)\n      } catch {\n        // ignore malformed writes\n      }\n    })\n  }\n\n  private emit(event: AuthChangeEvent, session: Session | null) {\n    for (const listener of this.listeners.values()) {\n      try {\n        listener(event, session)\n      } catch (err) {\n        console.error('[deepkey] onAuthStateChange listener threw', err)\n      }\n    }\n  }\n}\n\nexport interface AuthClient {\n  auth: Auth\n  connections: Connections\n}\n\nexport const createAuthClient = (publishableKey: string, options?: AuthClientOptions): AuthClient => {\n  const auth = new Auth(publishableKey, options)\n  const connections = new Connections(auth, {\n    apikey: publishableKey ?? '',\n    baseUrl: resolveBaseUrl(options?.__internalBaseUrl),\n    fetchImpl: options?.fetch,\n  })\n  return { auth, connections }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACyCO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAInC,YAAY,SAAiB,QAAiB,MAAe;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;;;ACjCO,IAAM,UAAU,OAAU,YAAuD;AACtF,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI;AACF,UAAM,UAAkC,EAAE,QAAQ,QAAQ,OAAO;AACjE,QAAI,QAAQ,SAAS,OAAW,SAAQ,cAAc,IAAI;AAC1D,QAAI,QAAQ,YAAa,SAAQ,gBAAgB,UAAU,QAAQ,WAAW;AAE9E,UAAM,WAAW,MAAM,UAAU,GAAG,QAAQ,OAAO,GAAG,QAAQ,IAAI,IAAI;AAAA,MACpE,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,MAAM,QAAQ,SAAS,SAAY,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,IACpE,CAAC;AAED,QAAI,SAAS,WAAW,IAAK,QAAO,EAAE,MAAM,CAAC,GAAQ,OAAO,KAAK;AAEjE,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,SAAS,KAAK;AAAA,IAChC,QAAQ;AACN,gBAAU;AAAA,IACZ;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,SAAoE;AACvF,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO,IAAI;AAAA,UACT,WAAW,WAAW,8BAA8B,SAAS,MAAM;AAAA,UACnE,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,SAAc,OAAO,KAAK;AAAA,EAC3C,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,EAAE,MAAM,MAAM,OAAO,IAAI,UAAU,SAAS,GAAG,eAAe,EAAE;AAAA,EACzE;AACF;;;AC5CO,IAAM,cAAN,MAAkB;AAAA,EACvB,YACU,MACA,SACR;AAFQ;AACA;AAAA,EACP;AAAA,EAEH,MAAM,QACJ,aACiE;AACjE,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK;AAAA,MACjC;AAAA,MACA;AAAA,MACA,EAAE,UAAU,YAAY,UAAU,aAAa,YAAY,SAAS,WAAW;AAAA,IACjF;AACA,QAAI,SAAS,CAAC,KAAM,QAAO,EAAE,MAAM,EAAE,UAAU,YAAY,UAAU,KAAK,KAAK,GAAG,MAAM;AAExF,QAAI,CAAC,YAAY,SAAS,uBAAuB,OAAO,WAAW,aAAa;AAC9E,aAAO,SAAS,OAAO,KAAK,GAAG;AAAA,IACjC;AACA,WAAO,EAAE,MAAM,EAAE,UAAU,YAAY,UAAU,KAAK,KAAK,IAAI,GAAG,OAAO,KAAK;AAAA,EAChF;AAAA,EAEA,MAAM,OAAqE;AACzE,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAA+C,OAAO,sBAAsB;AAC/G,WAAO,EAAE,MAAM,EAAE,aAAa,MAAM,eAAe,CAAC,EAAE,GAAG,MAAM;AAAA,EACjE;AAAA,EAEA,MAAM,OAAO,cAA4D;AACvE,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,QAAQ,UAAU,wBAAwB,mBAAmB,YAAY,CAAC,EAAE;AACzG,WAAO,EAAE,MAAM;AAAA,EACjB;AAAA,EAEA,MAAc,QAAW,QAAmC,MAAc,MAAgB;AACxF,UAAM;AAAA,MACJ,MAAM,EAAE,QAAQ;AAAA,IAClB,IAAI,MAAM,KAAK,KAAK,WAAW;AAC/B,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,MAAM,MAAM,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB,EAAE;AAAA,IAC7F;AACA,WAAO,QAAW,EAAE,QAAQ,MAAM,MAAM,aAAa,QAAQ,cAAc,GAAG,KAAK,QAAQ,CAAC;AAAA,EAC9F;AACF;;;ACpDO,IAAM,kBAAkB;AAKxB,IAAM,iBAAiB,CAAC,QAAgC;AAC7D,QAAM,YAAY,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;AACzD,UAAQ,aAAa,iBAAiB,QAAQ,QAAQ,EAAE;AAC1D;;;ACRA,IAAM,gBAAN,MAA8C;AAAA,EAA9C;AACE,SAAQ,QAAQ,oBAAI,IAAoB;AAAA;AAAA,EACxC,QAAQ,KAAa;AACnB,WAAO,KAAK,MAAM,IAAI,GAAG,KAAK;AAAA,EAChC;AAAA,EACA,QAAQ,KAAa,OAAe;AAClC,SAAK,MAAM,IAAI,KAAK,KAAK;AAAA,EAC3B;AAAA,EACA,WAAW,KAAa;AACtB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AACF;AAGO,IAAM,iBAAiB,MAAsB;AAClD,MAAI;AACF,QAAI,OAAO,WAAW,eAAe,OAAO,cAAc;AACxD,YAAM,QAAQ;AACd,aAAO,aAAa,QAAQ,OAAO,GAAG;AACtC,aAAO,aAAa,WAAW,KAAK;AACpC,aAAO,OAAO;AAAA,IAChB;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,cAAc;AAC3B;AAIO,IAAM,mBAAmB,CAAC,mBAA+C;AAC9E,QAAM,QAAQ,gBAAgB,MAAM,sCAAsC;AAC1E,SAAO,QAAQ,MAAM,MAAM,CAAC,CAAC,gBAAgB;AAC/C;;;ACjBO,IAAM,gBAAgB,CAAC,SAAiC;AAC7D,MAAI,CAAC,QAAQ,KAAK,SAAS,EAAG,QAAO;AACrC,QAAM,SAAS,IAAI,gBAAgB,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI;AAE9E,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,MAAI,OAAO;AACT,WAAO;AAAA,MACL,WAAW;AAAA,QACT;AAAA,QACA,YAAY,OAAO,IAAI,YAAY,KAAK;AAAA,QACxC,mBAAmB,OAAO,IAAI,mBAAmB,KAAK;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,IAAI,cAAc;AAC7C,QAAM,eAAe,OAAO,IAAI,eAAe;AAC/C,MAAI,CAAC,eAAe,CAAC,aAAc,QAAO;AAE1C,QAAM,YAAY,OAAO,OAAO,IAAI,YAAY,KAAK,IAAI;AACzD,QAAM,YAAY,OAAO,OAAO,IAAI,YAAY,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,SAAS;AAE9F,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,cAAc;AAAA,MACd,eAAe;AAAA,MACf,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,MAAM,OAAO,IAAI,MAAM,KAAK;AAAA,IAC9B;AAAA,EACF;AACF;AAIO,IAAM,uBAAuB,MAAM;AACxC,MAAI,OAAO,WAAW,eAAe,OAAO,YAAY,YAAa;AACrE,UAAQ,aAAa,MAAM,IAAI,OAAO,SAAS,WAAW,OAAO,SAAS,MAAM;AAClF;;;ACtCA,IAAM,kBAAkB;AAExB,IAAM,wBAAwB;AAIvB,IAAM,OAAN,MAAW;AAAA,EAiBhB,YAAY,gBAAwB,UAA6B,CAAC,GAAG;AAPrE,SAAQ,UAA0B;AAClC,SAAQ,YAAY,oBAAI,IAAsB;AAC9C,SAAQ,cAAc;AACtB,SAAQ,oBAA0C;AAClD,SAAQ,iBAA+F;AACvG,SAAQ,eAAsD;AAO5D,SAAK,UAAU,eAAe,QAAQ,iBAAiB;AACvD,SAAK,SAAS,kBAAkB;AAChC,SAAK,iBAAiB,QAAQ,kBAAkB;AAChD,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,qBAAqB,QAAQ,sBAAsB;AACxD,SAAK,UAAU,QAAQ,WAAW,eAAe;AACjD,SAAK,aAAa,QAAQ,cAAc,iBAAiB,cAAc;AACvE,SAAK,YAAY,QAAQ;AAEzB,SAAK,kBAAkB;AAAA,EACzB;AAAA;AAAA,EAIA,MAAM,cAAc,aAA6F;AAC/G,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,QAA+B,QAAQ,gBAAgB;AAAA,MAClF,OAAO,YAAY;AAAA,MACnB,aAAa,YAAY,SAAS;AAAA,MAClC,aAAa,YAAY,SAAS;AAAA,IACpC,CAAC;AACD,WAAO,EAAE,MAAM,EAAE,MAAM,MAAM,SAAS,KAAK,GAAG,MAAM;AAAA,EACtD;AAAA,EAEA,MAAM,UAAU,QAAgG;AAC9G,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAiB,QAAQ,mBAAmB;AAAA,MAC7E,MAAM;AAAA,MACN,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AACD,QAAI,SAAS,CAAC,KAAM,QAAO,EAAE,MAAM,EAAE,MAAM,MAAM,SAAS,KAAK,GAAG,MAAM;AAExE,UAAM,KAAK,YAAY,IAAI;AAC3B,SAAK,KAAK,aAAa,IAAI;AAC3B,WAAO,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,GAAG,OAAO,KAAK;AAAA,EACjE;AAAA,EAEA,MAAM,gBACJ,aAC0D;AAC1D,UAAM,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,oBAAoB;AACvD,QAAI,aAAa,IAAI,YAAY,YAAY,QAAQ;AACrD,QAAI,aAAa,IAAI,UAAU,KAAK,MAAM;AAC1C,QAAI,YAAY,SAAS,WAAY,KAAI,aAAa,IAAI,eAAe,YAAY,QAAQ,UAAU;AACvG,QAAI,YAAY,SAAS,OAAQ,KAAI,aAAa,IAAI,UAAU,YAAY,QAAQ,MAAM;AAC1F,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,YAAY,SAAS,eAAe,CAAC,CAAC,GAAG;AACjF,UAAI,aAAa,IAAI,KAAK,KAAK;AAAA,IACjC;AAEA,QAAI,CAAC,YAAY,SAAS,uBAAuB,OAAO,WAAW,aAAa;AAC9E,aAAO,SAAS,OAAO,IAAI,SAAS,CAAC;AAAA,IACvC;AACA,WAAO,EAAE,MAAM,EAAE,UAAU,YAAY,UAAU,KAAK,IAAI,SAAS,EAAE,GAAG,OAAO,KAAK;AAAA,EACtF;AAAA,EAEA,kBAAkB,UAA8D;AAC9E,UAAM,KAAK,YAAY,EAAE,KAAK,WAAW;AACzC,SAAK,UAAU,IAAI,IAAI,QAAQ;AAI/B,SAAK,WAAW,EAAE,KAAK,MAAM;AAC3B,UAAI,KAAK,UAAU,IAAI,EAAE,EAAG,UAAS,mBAAmB,KAAK,OAAO;AAAA,IACtE,CAAC;AAED,WAAO;AAAA,MACL,MAAM;AAAA,QACJ,cAAc;AAAA,UACZ;AAAA,UACA,aAAa,MAAM;AACjB,iBAAK,UAAU,OAAO,EAAE;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,UAAgD;AACpD,UAAM,KAAK,WAAW;AACtB,UAAM,UAAU,KAAK;AACrB,QAAI,SAAS;AAEX,YAAM,KAAK,QAAQ,QAAQ,mBAAmB,CAAC,GAAG,QAAQ,YAAY;AAAA,IACxE;AACA,SAAK,aAAa;AAClB,SAAK,KAAK,cAAc,IAAI;AAC5B,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAAA,EAEA,MAAM,aAAiE;AACrE,UAAM,KAAK,WAAW;AAEtB,QAAI,KAAK,WAAW,KAAK,UAAU,KAAK,OAAO,KAAK,KAAK,kBAAkB;AACzE,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB;AAC7C,UAAI,SAAS,MAAM,SAAS,iBAAiB;AAC3C,eAAO,EAAE,MAAM,EAAE,SAAS,KAAK,GAAG,OAAO,KAAK;AAAA,MAChD;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,EAAE,SAAS,KAAK,QAAQ,GAAG,OAAO,KAAK;AAAA,EACxD;AAAA,EAEA,MAAM,QAAQ,KAA4D;AACxE,QAAI,QAAQ;AACZ,QAAI,CAAC,OAAO;AACV,YAAM;AAAA,QACJ,MAAM,EAAE,QAAQ;AAAA,MAClB,IAAI,MAAM,KAAK,WAAW;AAC1B,cAAQ,SAAS;AAAA,IACnB;AACA,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB,EAAE;AAAA,IACvG;AAEA,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAc,OAAO,iBAAiB,QAAW,KAAK;AACzF,WAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,eAAe,gBAEqD;AACxE,UAAM,KAAK,WAAW;AACtB,UAAM,eAAe,gBAAgB,iBAAiB,KAAK,SAAS;AACpE,QAAI,CAAC,cAAc;AACjB,aAAO;AAAA,QACL,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK;AAAA,QAClC,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB;AAAA,MACtE;AAAA,IACF;AACA,WAAO,KAAK,gBAAgB,YAAY;AAAA,EAC1C;AAAA;AAAA,EAIA,MAAc,QAAW,QAAwB,MAAc,MAAgB,aAAsB;AACnG,WAAO,QAAW;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,WAAW,KAAK;AAAA,IAClB,CAAC;AAAA,EACH;AAAA,EAEQ,aAA4B;AAClC,SAAK,sBAAL,KAAK,oBAAsB,KAAK,aAAa;AAC7C,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,eAA8B;AAC1C,QAAI,KAAK,sBAAsB,OAAO,WAAW,aAAa;AAC5D,YAAM,SAAS,cAAc,OAAO,SAAS,IAAI;AACjD,UAAI,QAAQ;AAEV,6BAAqB;AAErB,YAAI,eAAe,QAAQ;AACzB,kBAAQ;AAAA,YACN,8CAA8C,OAAO,UAAU,cAAc,OAAO,UAAU,KAAK;AAAA,YACnG,OAAO,UAAU,qBAAqB;AAAA,UACxC;AAAA,QACF,OAAO;AACL,gBAAM,EAAE,MAAM,KAAK,IAAI,MAAM,KAAK,QAAc,OAAO,iBAAiB,QAAW,OAAO,OAAO,YAAY;AAC7G,cAAI,MAAM;AACR,kBAAM,UAAmB,EAAE,GAAG,OAAO,QAAQ,YAAY,UAAU,KAAK;AACxE,kBAAM,KAAK,YAAY,OAAO;AAC9B,iBAAK,KAAK,aAAa,OAAO;AAC9B;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,kBAAkB;AACtC,QAAI,CAAC,OAAQ;AAEb,QAAI,KAAK,UAAU,MAAM,GAAG;AAC1B,UAAI,CAAC,KAAK,iBAAkB;AAC5B,WAAK,UAAU;AACf,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB;AAC7C,UAAI,SAAS,MAAM,SAAS,gBAAiB,MAAK,aAAa;AAC/D;AAAA,IACF;AAEA,SAAK,UAAU;AACf,SAAK,kBAAkB;AAAA,EACzB;AAAA,EAEQ,UAAU,SAA2B;AAC3C,WAAO,QAAQ,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAC/D;AAAA,EAEA,MAAc,gBACZ,cACuE;AACvE,SAAK,mBAAL,KAAK,iBAAmB,KAAK,UAAU,YAAY,EAAE,QAAQ,MAAM;AACjE,WAAK,iBAAiB;AAAA,IACxB,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,UACZ,cACuE;AACvE,UAAM,QAAQ,gBAAgB,KAAK,SAAS;AAC5C,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK;AAAA,QAClC,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB;AAAA,MACtE;AAAA,IACF;AAEA,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAiB,QAAQ,2CAA2C;AAAA,MACrG,eAAe;AAAA,IACjB,CAAC;AAED,QAAI,OAAO;AAET,UAAI,MAAM,SAAS,iBAAiB;AAClC,aAAK,aAAa;AAClB,aAAK,KAAK,cAAc,IAAI;AAAA,MAC9B;AACA,aAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,GAAG,MAAM;AAAA,IACtD;AAEA,QAAI,MAAM;AACR,YAAM,KAAK,YAAY,IAAI;AAC3B,WAAK,KAAK,mBAAmB,IAAI;AACjC,aAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,KAAK,GAAG,OAAO,KAAK;AAAA,IACjE;AACA,WAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,wBAAwB,EAAE;AAAA,EAC/F;AAAA,EAEA,MAAc,YAAY,SAAkB;AAC1C,SAAK,UAAU;AACf,QAAI,KAAK,gBAAgB;AACvB,UAAI;AACF,aAAK,QAAQ,QAAQ,KAAK,YAAY,KAAK,UAAU,OAAO,CAAC;AAAA,MAC/D,QAAQ;AAAA,MAER;AAAA,IACF;AACA,SAAK,kBAAkB;AAAA,EACzB;AAAA,EAEQ,eAAe;AACrB,SAAK,UAAU;AACf,QAAI;AACF,WAAK,QAAQ,WAAW,KAAK,UAAU;AAAA,IACzC,QAAQ;AAAA,IAER;AACA,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEQ,oBAAoC;AAC1C,QAAI,CAAC,KAAK,eAAgB,QAAO;AACjC,QAAI;AACF,YAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK,UAAU;AAChD,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,gBAAgB,CAAC,OAAO,cAAe,QAAO;AAC1D,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,oBAAoB;AAC1B,QAAI,CAAC,KAAK,oBAAoB,KAAK,gBAAgB,OAAO,gBAAgB,YAAa;AACvF,SAAK,eAAe,YAAY,MAAM;AACpC,UAAI,KAAK,WAAW,KAAK,UAAU,KAAK,OAAO,EAAG,MAAK,KAAK,gBAAgB;AAAA,IAC9E,GAAG,eAAe;AAElB,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,YAAY,OAAO,MAAM,UAAU,WAAY,OAAM,MAAM;AAAA,EAClF;AAAA,EAEQ,mBAAmB;AACzB,QAAI,KAAK,cAAc;AACrB,oBAAc,KAAK,YAAY;AAC/B,WAAK,eAAe;AAAA,IACtB;AAAA,EACF;AAAA,EAEQ,oBAAoB;AAC1B,QAAI,OAAO,WAAW,eAAe,CAAC,KAAK,eAAgB;AAC3D,WAAO,iBAAiB,WAAW,WAAS;AAC1C,UAAI,MAAM,QAAQ,KAAK,WAAY;AACnC,UAAI,CAAC,MAAM,UAAU;AACnB,YAAI,KAAK,SAAS;AAChB,eAAK,UAAU;AACf,eAAK,iBAAiB;AACtB,eAAK,KAAK,cAAc,IAAI;AAAA,QAC9B;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,OAAO,KAAK,MAAM,MAAM,QAAQ;AACtC,cAAM,UAAU,KAAK,iBAAiB,KAAK,SAAS;AACpD,aAAK,UAAU;AACf,aAAK,kBAAkB;AACvB,YAAI,QAAS,MAAK,KAAK,mBAAmB,IAAI;AAAA,MAChD,QAAQ;AAAA,MAER;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,KAAK,OAAwB,SAAyB;AAC5D,eAAW,YAAY,KAAK,UAAU,OAAO,GAAG;AAC9C,UAAI;AACF,iBAAS,OAAO,OAAO;AAAA,MACzB,SAAS,KAAK;AACZ,gBAAQ,MAAM,8CAA8C,GAAG;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;AAOO,IAAM,mBAAmB,CAAC,gBAAwB,YAA4C;AACnG,QAAM,OAAO,IAAI,KAAK,gBAAgB,OAAO;AAC7C,QAAM,cAAc,IAAI,YAAY,MAAM;AAAA,IACxC,QAAQ,kBAAkB;AAAA,IAC1B,SAAS,eAAe,SAAS,iBAAiB;AAAA,IAClD,WAAW,SAAS;AAAA,EACtB,CAAC;AACD,SAAO,EAAE,MAAM,YAAY;AAC7B;","names":[]}

package/dist/index.d.cts

@@ -1,5 +1,27 @@
-import { A as AuthClientOptions, S as SignInWithOtpCredentials, a as AuthResponse, V as VerifyOtpParams, U as User, b as Session, c as SignInWithOAuthCredentials, d as AuthChangeEvent, e as Subscription, f as AuthError } from './constants-BQhswdms.cjs';
-export { D as DEEPKEY_API_URL, g as ServerClientOptions, h as StorageAdapter, i as UserIdentity } from './constants-BQhswdms.cjs';
+import { C as ConnectProviderCredentials, A as AuthResponse, P as ProviderConnection, a as AuthError, b as AuthClientOptions, S as SignInWithOtpCredentials, V as VerifyOtpParams, U as User, c as Session, d as SignInWithOAuthCredentials, e as AuthChangeEvent, f as Subscription } from './constants-DgChFH24.cjs';
+export { D as DEEPKEY_API_URL, g as ProviderAccessToken, h as ServerClientOptions, i as StorageAdapter, j as UserIdentity } from './constants-DgChFH24.cjs';
+
+interface ConnectionsOptions {
+    apikey: string;
+    baseUrl: string;
+    fetchImpl?: typeof fetch;
+}
+declare class Connections {
+    private auth;
+    private options;
+    constructor(auth: Auth, options: ConnectionsOptions);
+    connect(credentials: ConnectProviderCredentials): Promise<AuthResponse<{
+        provider: string;
+        url: string | null;
+    }>>;
+    list(): Promise<AuthResponse<{
+        connections: ProviderConnection[];
+    }>>;
+    revoke(connectionId: string): Promise<{
+        error: AuthError | null;
+    }>;
+    private request;
+}
 
 type Listener = (event: AuthChangeEvent, session: Session | null) => void;
 declare class Auth {
@@ -66,7 +88,8 @@ declare class Auth {
 }
 interface AuthClient {
     auth: Auth;
+    connections: Connections;
 }
 declare const createAuthClient: (publishableKey: string, options?: AuthClientOptions) => AuthClient;
 
-export { Auth, AuthChangeEvent, type AuthClient, AuthClientOptions, AuthError, AuthResponse, Session, SignInWithOAuthCredentials, SignInWithOtpCredentials, Subscription, User, VerifyOtpParams, createAuthClient };
+export { Auth, AuthChangeEvent, type AuthClient, AuthClientOptions, AuthError, AuthResponse, ConnectProviderCredentials, Connections, ProviderConnection, Session, SignInWithOAuthCredentials, SignInWithOtpCredentials, Subscription, User, VerifyOtpParams, createAuthClient };

package/dist/index.d.ts

@@ -1,5 +1,27 @@
-import { A as AuthClientOptions, S as SignInWithOtpCredentials, a as AuthResponse, V as VerifyOtpParams, U as User, b as Session, c as SignInWithOAuthCredentials, d as AuthChangeEvent, e as Subscription, f as AuthError } from './constants-BQhswdms.js';
-export { D as DEEPKEY_API_URL, g as ServerClientOptions, h as StorageAdapter, i as UserIdentity } from './constants-BQhswdms.js';
+import { C as ConnectProviderCredentials, A as AuthResponse, P as ProviderConnection, a as AuthError, b as AuthClientOptions, S as SignInWithOtpCredentials, V as VerifyOtpParams, U as User, c as Session, d as SignInWithOAuthCredentials, e as AuthChangeEvent, f as Subscription } from './constants-DgChFH24.js';
+export { D as DEEPKEY_API_URL, g as ProviderAccessToken, h as ServerClientOptions, i as StorageAdapter, j as UserIdentity } from './constants-DgChFH24.js';
+
+interface ConnectionsOptions {
+    apikey: string;
+    baseUrl: string;
+    fetchImpl?: typeof fetch;
+}
+declare class Connections {
+    private auth;
+    private options;
+    constructor(auth: Auth, options: ConnectionsOptions);
+    connect(credentials: ConnectProviderCredentials): Promise<AuthResponse<{
+        provider: string;
+        url: string | null;
+    }>>;
+    list(): Promise<AuthResponse<{
+        connections: ProviderConnection[];
+    }>>;
+    revoke(connectionId: string): Promise<{
+        error: AuthError | null;
+    }>;
+    private request;
+}
 
 type Listener = (event: AuthChangeEvent, session: Session | null) => void;
 declare class Auth {
@@ -66,7 +88,8 @@ declare class Auth {
 }
 interface AuthClient {
     auth: Auth;
+    connections: Connections;
 }
 declare const createAuthClient: (publishableKey: string, options?: AuthClientOptions) => AuthClient;
 
-export { Auth, AuthChangeEvent, type AuthClient, AuthClientOptions, AuthError, AuthResponse, Session, SignInWithOAuthCredentials, SignInWithOtpCredentials, Subscription, User, VerifyOtpParams, createAuthClient };
+export { Auth, AuthChangeEvent, type AuthClient, AuthClientOptions, AuthError, AuthResponse, ConnectProviderCredentials, Connections, ProviderConnection, Session, SignInWithOAuthCredentials, SignInWithOtpCredentials, Subscription, User, VerifyOtpParams, createAuthClient };

package/dist/index.js

@@ -1,43 +1,44 @@
 import {
   AuthError,
   DEEPKEY_API_URL,
+  request,
   resolveBaseUrl
-} from "./chunk-IFNRLMVX.js";
+} from "./chunk-A2CRUXTA.js";
 
-// src/fetch.ts
-var request = async (options) => {
-  const fetchImpl = options.fetchImpl ?? fetch;
-  try {
-    const headers = { apikey: options.apikey };
-    if (options.body !== void 0) headers["Content-Type"] = "application/json";
-    if (options.accessToken) headers.Authorization = `Bearer ${options.accessToken}`;
-    const response = await fetchImpl(`${options.baseUrl}${options.path}`, {
-      method: options.method,
-      headers,
-      body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
-    });
-    if (response.status === 204) return { data: {}, error: null };
-    let payload;
-    try {
-      payload = await response.json();
-    } catch {
-      payload = null;
+// src/connections.ts
+var Connections = class {
+  constructor(auth, options) {
+    this.auth = auth;
+    this.options = options;
+  }
+  async connect(credentials) {
+    const { data, error } = await this.request(
+      "POST",
+      "/auth/v1/connections/authorize",
+      { provider: credentials.provider, redirect_to: credentials.options?.redirectTo }
+    );
+    if (error || !data) return { data: { provider: credentials.provider, url: null }, error };
+    if (!credentials.options?.skipBrowserRedirect && typeof window !== "undefined") {
+      window.location.assign(data.url);
     }
-    if (!response.ok) {
-      const errorBody = payload?.error;
-      return {
-        data: null,
-        error: new AuthError(
-          errorBody?.message ?? `Request failed with status ${response.status}`,
-          response.status,
-          errorBody?.code
-        )
-      };
+    return { data: { provider: credentials.provider, url: data.url }, error: null };
+  }
+  async list() {
+    const { data, error } = await this.request("GET", "/auth/v1/connections");
+    return { data: { connections: data?.connections ?? [] }, error };
+  }
+  async revoke(connectionId) {
+    const { error } = await this.request("DELETE", `/auth/v1/connections/${encodeURIComponent(connectionId)}`);
+    return { error };
+  }
+  async request(method, path, body) {
+    const {
+      data: { session }
+    } = await this.auth.getSession();
+    if (!session) {
+      return { data: null, error: new AuthError("Auth session missing!", 400, "session_missing") };
     }
-    return { data: payload, error: null };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Network request failed";
-    return { data: null, error: new AuthError(message, 0, "network_error") };
+    return request({ method, path, body, accessToken: session.access_token, ...this.options });
   }
 };
 
@@ -385,11 +386,18 @@ var Auth = class {
   }
 };
 var createAuthClient = (publishableKey, options) => {
-  return { auth: new Auth(publishableKey, options) };
+  const auth = new Auth(publishableKey, options);
+  const connections = new Connections(auth, {
+    apikey: publishableKey ?? "",
+    baseUrl: resolveBaseUrl(options?.__internalBaseUrl),
+    fetchImpl: options?.fetch
+  });
+  return { auth, connections };
 };
 export {
   Auth,
   AuthError,
+  Connections,
   DEEPKEY_API_URL,
   createAuthClient
 };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/fetch.ts","../src/storage.ts","../src/url.ts","../src/client.ts"],"sourcesContent":["import { AuthError } from './types'\n\nexport interface RequestOptions {\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE'\n  path: string\n  apikey: string\n  baseUrl: string\n  accessToken?: string\n  body?: unknown\n  fetchImpl?: typeof fetch\n}\n\nexport interface RequestResult<T> {\n  data: T | null\n  error: AuthError | null\n}\n\n// All service errors are shaped { error: { code, message } }.\nexport const request = async <T>(options: RequestOptions): Promise<RequestResult<T>> => {\n  const fetchImpl = options.fetchImpl ?? fetch\n  try {\n    const headers: Record<string, string> = { apikey: options.apikey }\n    if (options.body !== undefined) headers['Content-Type'] = 'application/json'\n    if (options.accessToken) headers.Authorization = `Bearer ${options.accessToken}`\n\n    const response = await fetchImpl(`${options.baseUrl}${options.path}`, {\n      method: options.method,\n      headers,\n      body: options.body !== undefined ? JSON.stringify(options.body) : undefined,\n    })\n\n    if (response.status === 204) return { data: {} as T, error: null }\n\n    let payload: unknown\n    try {\n      payload = await response.json()\n    } catch {\n      payload = null\n    }\n\n    if (!response.ok) {\n      const errorBody = (payload as { error?: { code?: string; message?: string } } | null)?.error\n      return {\n        data: null,\n        error: new AuthError(\n          errorBody?.message ?? `Request failed with status ${response.status}`,\n          response.status,\n          errorBody?.code,\n        ),\n      }\n    }\n\n    return { data: payload as T, error: null }\n  } catch (err) {\n    const message = err instanceof Error ? err.message : 'Network request failed'\n    return { data: null, error: new AuthError(message, 0, 'network_error') }\n  }\n}\n","import type { StorageAdapter } from './types'\n\nclass MemoryStorage implements StorageAdapter {\n  private store = new Map<string, string>()\n  getItem(key: string) {\n    return this.store.get(key) ?? null\n  }\n  setItem(key: string, value: string) {\n    this.store.set(key, value)\n  }\n  removeItem(key: string) {\n    this.store.delete(key)\n  }\n}\n\n// localStorage when available, in-memory fallback (SSR, tests, restricted contexts).\nexport const defaultStorage = (): StorageAdapter => {\n  try {\n    if (typeof window !== 'undefined' && window.localStorage) {\n      const probe = '__bt_auth_probe__'\n      window.localStorage.setItem(probe, '1')\n      window.localStorage.removeItem(probe)\n      return window.localStorage\n    }\n  } catch {\n    // fall through to memory storage\n  }\n  return new MemoryStorage()\n}\n\n// Publishable keys look like `bt_pub_<project-slug>_<random>`; the slug namespaces the\n// persisted session per project (mirrors supabase's `sb-<ref>-auth-token`).\nexport const deriveStorageKey = (publishableKey: string | undefined): string => {\n  const match = publishableKey?.match(/^bt_pub_([a-z0-9-]+)_[A-Za-z0-9_-]+$/)\n  return match ? `bt-${match[1]}-auth-token` : 'bt-auth-token'\n}\n","export interface FragmentTokens {\n  access_token: string\n  refresh_token: string\n  expires_in: number\n  expires_at: number\n  token_type: 'bearer'\n  type?: string\n}\n\nexport interface FragmentError {\n  error: string\n  error_code?: string\n  error_description?: string\n}\n\nexport type ParsedFragment = { tokens: FragmentTokens } | { authError: FragmentError } | null\n\n// Parses the implicit-flow return fragment (`#access_token=...` or `#error=...`).\nexport const parseFragment = (hash: string): ParsedFragment => {\n  if (!hash || hash.length < 2) return null\n  const params = new URLSearchParams(hash.startsWith('#') ? hash.slice(1) : hash)\n\n  const error = params.get('error')\n  if (error) {\n    return {\n      authError: {\n        error,\n        error_code: params.get('error_code') ?? undefined,\n        error_description: params.get('error_description') ?? undefined,\n      },\n    }\n  }\n\n  const accessToken = params.get('access_token')\n  const refreshToken = params.get('refresh_token')\n  if (!accessToken || !refreshToken) return null\n\n  const expiresIn = Number(params.get('expires_in') ?? 3600)\n  const expiresAt = Number(params.get('expires_at') ?? Math.floor(Date.now() / 1000) + expiresIn)\n\n  return {\n    tokens: {\n      access_token: accessToken,\n      refresh_token: refreshToken,\n      expires_in: expiresIn,\n      expires_at: expiresAt,\n      token_type: 'bearer',\n      type: params.get('type') ?? undefined,\n    },\n  }\n}\n\n// Removes the auth fragment from the address bar (before any await, so tokens never\n// linger in history).\nexport const cleanFragmentFromUrl = () => {\n  if (typeof window === 'undefined' || typeof history === 'undefined') return\n  history.replaceState(null, '', window.location.pathname + window.location.search)\n}\n","import { resolveBaseUrl } from './constants'\nimport { request } from './fetch'\nimport { defaultStorage, deriveStorageKey } from './storage'\nimport {\n  AuthError,\n  type AuthChangeEvent,\n  type AuthClientOptions,\n  type AuthResponse,\n  type Session,\n  type SignInWithOAuthCredentials,\n  type SignInWithOtpCredentials,\n  type StorageAdapter,\n  type Subscription,\n  type User,\n  type VerifyOtpParams,\n} from './types'\nimport { cleanFragmentFromUrl, parseFragment } from './url'\n\nconst REFRESH_TICK_MS = 30_000\n// Refresh when the access token is within this margin of expiry.\nconst EXPIRY_MARGIN_SECONDS = 90\n\ntype Listener = (event: AuthChangeEvent, session: Session | null) => void\n\nexport class Auth {\n  private baseUrl: string\n  private apikey: string\n  private storage: StorageAdapter\n  private storageKey: string\n  private persistSession: boolean\n  private autoRefreshToken: boolean\n  private detectSessionInUrl: boolean\n  private fetchImpl?: typeof fetch\n\n  private session: Session | null = null\n  private listeners = new Map<string, Listener>()\n  private listenerSeq = 0\n  private initializePromise: Promise<void> | null = null\n  private refreshPromise: Promise<AuthResponse<{ session: Session | null; user: User | null }>> | null = null\n  private refreshTimer: ReturnType<typeof setInterval> | null = null\n\n  constructor(publishableKey: string, options: AuthClientOptions = {}) {\n    // Lazy by design: an empty key must not throw at construction time (CI builds\n    // with empty envs import this module transitively). Failures surface on first call.\n    // The hosted DeepKey API is the only supported origin. The internal override\n    // exists for DeepKey's console and tests and is not part of the public contract.\n    this.baseUrl = resolveBaseUrl(options.__internalBaseUrl)\n    this.apikey = publishableKey ?? ''\n    this.persistSession = options.persistSession ?? true\n    this.autoRefreshToken = options.autoRefreshToken ?? true\n    this.detectSessionInUrl = options.detectSessionInUrl ?? true\n    this.storage = options.storage ?? defaultStorage()\n    this.storageKey = options.storageKey ?? deriveStorageKey(publishableKey)\n    this.fetchImpl = options.fetch\n\n    this.setupCrossTabSync()\n  }\n\n  // ---- public API (supabase-js compatible) ----\n\n  async signInWithOtp(credentials: SignInWithOtpCredentials): Promise<AuthResponse<{ user: null; session: null }>> {\n    const { error } = await this.request<Record<string, never>>('POST', '/auth/v1/otp', {\n      email: credentials.email,\n      create_user: credentials.options?.shouldCreateUser,\n      redirect_to: credentials.options?.emailRedirectTo,\n    })\n    return { data: { user: null, session: null }, error }\n  }\n\n  async verifyOtp(params: VerifyOtpParams): Promise<AuthResponse<{ user: User | null; session: Session | null }>> {\n    const { data, error } = await this.request<Session>('POST', '/auth/v1/verify', {\n      type: 'email',\n      email: params.email,\n      token: params.token,\n    })\n    if (error || !data) return { data: { user: null, session: null }, error }\n\n    await this.saveSession(data)\n    this.emit('SIGNED_IN', data)\n    return { data: { user: data.user, session: data }, error: null }\n  }\n\n  async signInWithOAuth(\n    credentials: SignInWithOAuthCredentials,\n  ): Promise<AuthResponse<{ provider: string; url: string }>> {\n    const url = new URL(`${this.baseUrl}/auth/v1/authorize`)\n    url.searchParams.set('provider', credentials.provider)\n    url.searchParams.set('apikey', this.apikey)\n    if (credentials.options?.redirectTo) url.searchParams.set('redirect_to', credentials.options.redirectTo)\n    if (credentials.options?.scopes) url.searchParams.set('scopes', credentials.options.scopes)\n    for (const [key, value] of Object.entries(credentials.options?.queryParams ?? {})) {\n      url.searchParams.set(key, value)\n    }\n\n    if (!credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {\n      window.location.assign(url.toString())\n    }\n    return { data: { provider: credentials.provider, url: url.toString() }, error: null }\n  }\n\n  onAuthStateChange(callback: Listener): { data: { subscription: Subscription } } {\n    const id = `listener-${++this.listenerSeq}`\n    this.listeners.set(id, callback)\n\n    // Every subscriber receives INITIAL_SESSION asynchronously once initialization\n    // settles — the supabase-js contract that AuthProviders rely on to resolve loading.\n    this.initialize().then(() => {\n      if (this.listeners.has(id)) callback('INITIAL_SESSION', this.session)\n    })\n\n    return {\n      data: {\n        subscription: {\n          id,\n          unsubscribe: () => {\n            this.listeners.delete(id)\n          },\n        },\n      },\n    }\n  }\n\n  async signOut(): Promise<{ error: AuthError | null }> {\n    await this.initialize()\n    const session = this.session\n    if (session) {\n      // Best-effort server-side revocation; local sign-out always succeeds.\n      await this.request('POST', '/auth/v1/logout', {}, session.access_token)\n    }\n    this.clearSession()\n    this.emit('SIGNED_OUT', null)\n    return { error: null }\n  }\n\n  async getSession(): Promise<AuthResponse<{ session: Session | null }>> {\n    await this.initialize()\n\n    if (this.session && this.isExpired(this.session) && this.autoRefreshToken) {\n      const { error } = await this.refreshWithLock()\n      if (error && error.code !== 'network_error') {\n        return { data: { session: null }, error: null }\n      }\n    }\n\n    return { data: { session: this.session }, error: null }\n  }\n\n  async getUser(jwt?: string): Promise<AuthResponse<{ user: User | null }>> {\n    let token = jwt\n    if (!token) {\n      const {\n        data: { session },\n      } = await this.getSession()\n      token = session?.access_token\n    }\n    if (!token) {\n      return { data: { user: null }, error: new AuthError('Auth session missing!', 400, 'session_missing') }\n    }\n\n    const { data, error } = await this.request<User>('GET', '/auth/v1/user', undefined, token)\n    return { data: { user: data }, error }\n  }\n\n  async refreshSession(currentSession?: {\n    refresh_token: string\n  }): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    await this.initialize()\n    const refreshToken = currentSession?.refresh_token ?? this.session?.refresh_token\n    if (!refreshToken) {\n      return {\n        data: { session: null, user: null },\n        error: new AuthError('Auth session missing!', 400, 'session_missing'),\n      }\n    }\n    return this.refreshWithLock(refreshToken)\n  }\n\n  // ---- internals ----\n\n  private async request<T>(method: 'GET' | 'POST', path: string, body?: unknown, accessToken?: string) {\n    return request<T>({\n      method,\n      path,\n      body,\n      accessToken,\n      apikey: this.apikey,\n      baseUrl: this.baseUrl,\n      fetchImpl: this.fetchImpl,\n    })\n  }\n\n  private initialize(): Promise<void> {\n    this.initializePromise ??= this.doInitialize()\n    return this.initializePromise\n  }\n\n  private async doInitialize(): Promise<void> {\n    if (this.detectSessionInUrl && typeof window !== 'undefined') {\n      const parsed = parseFragment(window.location.hash)\n      if (parsed) {\n        // Strip tokens from the address bar synchronously, before any await.\n        cleanFragmentFromUrl()\n\n        if ('authError' in parsed) {\n          console.warn(\n            `[deepkey] Auth redirect returned an error: ${parsed.authError.error_code ?? parsed.authError.error}`,\n            parsed.authError.error_description ?? '',\n          )\n        } else {\n          const { data: user } = await this.request<User>('GET', '/auth/v1/user', undefined, parsed.tokens.access_token)\n          if (user) {\n            const session: Session = { ...parsed.tokens, token_type: 'bearer', user }\n            await this.saveSession(session)\n            this.emit('SIGNED_IN', session)\n            return\n          }\n        }\n      }\n    }\n\n    const stored = this.loadStoredSession()\n    if (!stored) return\n\n    if (this.isExpired(stored)) {\n      if (!this.autoRefreshToken) return\n      this.session = stored\n      const { error } = await this.refreshWithLock()\n      if (error && error.code !== 'network_error') this.clearSession()\n      return\n    }\n\n    this.session = stored\n    this.startRefreshTimer()\n  }\n\n  private isExpired(session: Session): boolean {\n    return session.expires_at <= Math.floor(Date.now() / 1000) + EXPIRY_MARGIN_SECONDS\n  }\n\n  private async refreshWithLock(\n    refreshToken?: string,\n  ): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    this.refreshPromise ??= this.doRefresh(refreshToken).finally(() => {\n      this.refreshPromise = null\n    })\n    return this.refreshPromise\n  }\n\n  private async doRefresh(\n    refreshToken?: string,\n  ): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    const token = refreshToken ?? this.session?.refresh_token\n    if (!token) {\n      return {\n        data: { session: null, user: null },\n        error: new AuthError('Auth session missing!', 400, 'session_missing'),\n      }\n    }\n\n    const { data, error } = await this.request<Session>('POST', '/auth/v1/token?grant_type=refresh_token', {\n      refresh_token: token,\n    })\n\n    if (error) {\n      // Network failures keep the session (retry next tick); auth failures clear it.\n      if (error.code !== 'network_error') {\n        this.clearSession()\n        this.emit('SIGNED_OUT', null)\n      }\n      return { data: { session: null, user: null }, error }\n    }\n\n    if (data) {\n      await this.saveSession(data)\n      this.emit('TOKEN_REFRESHED', data)\n      return { data: { session: data, user: data.user }, error: null }\n    }\n    return { data: { session: null, user: null }, error: new AuthError('Empty refresh response') }\n  }\n\n  private async saveSession(session: Session) {\n    this.session = session\n    if (this.persistSession) {\n      try {\n        this.storage.setItem(this.storageKey, JSON.stringify(session))\n      } catch {\n        // Persistence is best-effort (private mode, quota).\n      }\n    }\n    this.startRefreshTimer()\n  }\n\n  private clearSession() {\n    this.session = null\n    try {\n      this.storage.removeItem(this.storageKey)\n    } catch {\n      // ignore\n    }\n    this.stopRefreshTimer()\n  }\n\n  private loadStoredSession(): Session | null {\n    if (!this.persistSession) return null\n    try {\n      const raw = this.storage.getItem(this.storageKey)\n      if (!raw) return null\n      const parsed = JSON.parse(raw) as Session\n      if (!parsed.access_token || !parsed.refresh_token) return null\n      return parsed\n    } catch {\n      return null\n    }\n  }\n\n  private startRefreshTimer() {\n    if (!this.autoRefreshToken || this.refreshTimer || typeof setInterval === 'undefined') return\n    this.refreshTimer = setInterval(() => {\n      if (this.session && this.isExpired(this.session)) void this.refreshWithLock()\n    }, REFRESH_TICK_MS)\n    // Do not keep node processes alive because of the timer (no-op in browsers).\n    const timer = this.refreshTimer as unknown as { unref?: () => void }\n    if (typeof timer === 'object' && typeof timer.unref === 'function') timer.unref()\n  }\n\n  private stopRefreshTimer() {\n    if (this.refreshTimer) {\n      clearInterval(this.refreshTimer)\n      this.refreshTimer = null\n    }\n  }\n\n  private setupCrossTabSync() {\n    if (typeof window === 'undefined' || !this.persistSession) return\n    window.addEventListener('storage', event => {\n      if (event.key !== this.storageKey) return\n      if (!event.newValue) {\n        if (this.session) {\n          this.session = null\n          this.stopRefreshTimer()\n          this.emit('SIGNED_OUT', null)\n        }\n        return\n      }\n      try {\n        const next = JSON.parse(event.newValue) as Session\n        const changed = next.access_token !== this.session?.access_token\n        this.session = next\n        this.startRefreshTimer()\n        if (changed) this.emit('TOKEN_REFRESHED', next)\n      } catch {\n        // ignore malformed writes\n      }\n    })\n  }\n\n  private emit(event: AuthChangeEvent, session: Session | null) {\n    for (const listener of this.listeners.values()) {\n      try {\n        listener(event, session)\n      } catch (err) {\n        console.error('[deepkey] onAuthStateChange listener threw', err)\n      }\n    }\n  }\n}\n\nexport interface AuthClient {\n  auth: Auth\n}\n\nexport const createAuthClient = (publishableKey: string, options?: AuthClientOptions): AuthClient => {\n  return { auth: new Auth(publishableKey, options) }\n}\n"],"mappings":";;;;;;;AAkBO,IAAM,UAAU,OAAU,YAAuD;AACtF,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI;AACF,UAAM,UAAkC,EAAE,QAAQ,QAAQ,OAAO;AACjE,QAAI,QAAQ,SAAS,OAAW,SAAQ,cAAc,IAAI;AAC1D,QAAI,QAAQ,YAAa,SAAQ,gBAAgB,UAAU,QAAQ,WAAW;AAE9E,UAAM,WAAW,MAAM,UAAU,GAAG,QAAQ,OAAO,GAAG,QAAQ,IAAI,IAAI;AAAA,MACpE,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,MAAM,QAAQ,SAAS,SAAY,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,IACpE,CAAC;AAED,QAAI,SAAS,WAAW,IAAK,QAAO,EAAE,MAAM,CAAC,GAAQ,OAAO,KAAK;AAEjE,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,SAAS,KAAK;AAAA,IAChC,QAAQ;AACN,gBAAU;AAAA,IACZ;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,SAAoE;AACvF,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO,IAAI;AAAA,UACT,WAAW,WAAW,8BAA8B,SAAS,MAAM;AAAA,UACnE,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,SAAc,OAAO,KAAK;AAAA,EAC3C,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,EAAE,MAAM,MAAM,OAAO,IAAI,UAAU,SAAS,GAAG,eAAe,EAAE;AAAA,EACzE;AACF;;;ACvDA,IAAM,gBAAN,MAA8C;AAAA,EAA9C;AACE,SAAQ,QAAQ,oBAAI,IAAoB;AAAA;AAAA,EACxC,QAAQ,KAAa;AACnB,WAAO,KAAK,MAAM,IAAI,GAAG,KAAK;AAAA,EAChC;AAAA,EACA,QAAQ,KAAa,OAAe;AAClC,SAAK,MAAM,IAAI,KAAK,KAAK;AAAA,EAC3B;AAAA,EACA,WAAW,KAAa;AACtB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AACF;AAGO,IAAM,iBAAiB,MAAsB;AAClD,MAAI;AACF,QAAI,OAAO,WAAW,eAAe,OAAO,cAAc;AACxD,YAAM,QAAQ;AACd,aAAO,aAAa,QAAQ,OAAO,GAAG;AACtC,aAAO,aAAa,WAAW,KAAK;AACpC,aAAO,OAAO;AAAA,IAChB;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,cAAc;AAC3B;AAIO,IAAM,mBAAmB,CAAC,mBAA+C;AAC9E,QAAM,QAAQ,gBAAgB,MAAM,sCAAsC;AAC1E,SAAO,QAAQ,MAAM,MAAM,CAAC,CAAC,gBAAgB;AAC/C;;;ACjBO,IAAM,gBAAgB,CAAC,SAAiC;AAC7D,MAAI,CAAC,QAAQ,KAAK,SAAS,EAAG,QAAO;AACrC,QAAM,SAAS,IAAI,gBAAgB,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI;AAE9E,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,MAAI,OAAO;AACT,WAAO;AAAA,MACL,WAAW;AAAA,QACT;AAAA,QACA,YAAY,OAAO,IAAI,YAAY,KAAK;AAAA,QACxC,mBAAmB,OAAO,IAAI,mBAAmB,KAAK;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,IAAI,cAAc;AAC7C,QAAM,eAAe,OAAO,IAAI,eAAe;AAC/C,MAAI,CAAC,eAAe,CAAC,aAAc,QAAO;AAE1C,QAAM,YAAY,OAAO,OAAO,IAAI,YAAY,KAAK,IAAI;AACzD,QAAM,YAAY,OAAO,OAAO,IAAI,YAAY,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,SAAS;AAE9F,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,cAAc;AAAA,MACd,eAAe;AAAA,MACf,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,MAAM,OAAO,IAAI,MAAM,KAAK;AAAA,IAC9B;AAAA,EACF;AACF;AAIO,IAAM,uBAAuB,MAAM;AACxC,MAAI,OAAO,WAAW,eAAe,OAAO,YAAY,YAAa;AACrE,UAAQ,aAAa,MAAM,IAAI,OAAO,SAAS,WAAW,OAAO,SAAS,MAAM;AAClF;;;ACvCA,IAAM,kBAAkB;AAExB,IAAM,wBAAwB;AAIvB,IAAM,OAAN,MAAW;AAAA,EAiBhB,YAAY,gBAAwB,UAA6B,CAAC,GAAG;AAPrE,SAAQ,UAA0B;AAClC,SAAQ,YAAY,oBAAI,IAAsB;AAC9C,SAAQ,cAAc;AACtB,SAAQ,oBAA0C;AAClD,SAAQ,iBAA+F;AACvG,SAAQ,eAAsD;AAO5D,SAAK,UAAU,eAAe,QAAQ,iBAAiB;AACvD,SAAK,SAAS,kBAAkB;AAChC,SAAK,iBAAiB,QAAQ,kBAAkB;AAChD,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,qBAAqB,QAAQ,sBAAsB;AACxD,SAAK,UAAU,QAAQ,WAAW,eAAe;AACjD,SAAK,aAAa,QAAQ,cAAc,iBAAiB,cAAc;AACvE,SAAK,YAAY,QAAQ;AAEzB,SAAK,kBAAkB;AAAA,EACzB;AAAA;AAAA,EAIA,MAAM,cAAc,aAA6F;AAC/G,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,QAA+B,QAAQ,gBAAgB;AAAA,MAClF,OAAO,YAAY;AAAA,MACnB,aAAa,YAAY,SAAS;AAAA,MAClC,aAAa,YAAY,SAAS;AAAA,IACpC,CAAC;AACD,WAAO,EAAE,MAAM,EAAE,MAAM,MAAM,SAAS,KAAK,GAAG,MAAM;AAAA,EACtD;AAAA,EAEA,MAAM,UAAU,QAAgG;AAC9G,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAiB,QAAQ,mBAAmB;AAAA,MAC7E,MAAM;AAAA,MACN,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AACD,QAAI,SAAS,CAAC,KAAM,QAAO,EAAE,MAAM,EAAE,MAAM,MAAM,SAAS,KAAK,GAAG,MAAM;AAExE,UAAM,KAAK,YAAY,IAAI;AAC3B,SAAK,KAAK,aAAa,IAAI;AAC3B,WAAO,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,GAAG,OAAO,KAAK;AAAA,EACjE;AAAA,EAEA,MAAM,gBACJ,aAC0D;AAC1D,UAAM,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,oBAAoB;AACvD,QAAI,aAAa,IAAI,YAAY,YAAY,QAAQ;AACrD,QAAI,aAAa,IAAI,UAAU,KAAK,MAAM;AAC1C,QAAI,YAAY,SAAS,WAAY,KAAI,aAAa,IAAI,eAAe,YAAY,QAAQ,UAAU;AACvG,QAAI,YAAY,SAAS,OAAQ,KAAI,aAAa,IAAI,UAAU,YAAY,QAAQ,MAAM;AAC1F,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,YAAY,SAAS,eAAe,CAAC,CAAC,GAAG;AACjF,UAAI,aAAa,IAAI,KAAK,KAAK;AAAA,IACjC;AAEA,QAAI,CAAC,YAAY,SAAS,uBAAuB,OAAO,WAAW,aAAa;AAC9E,aAAO,SAAS,OAAO,IAAI,SAAS,CAAC;AAAA,IACvC;AACA,WAAO,EAAE,MAAM,EAAE,UAAU,YAAY,UAAU,KAAK,IAAI,SAAS,EAAE,GAAG,OAAO,KAAK;AAAA,EACtF;AAAA,EAEA,kBAAkB,UAA8D;AAC9E,UAAM,KAAK,YAAY,EAAE,KAAK,WAAW;AACzC,SAAK,UAAU,IAAI,IAAI,QAAQ;AAI/B,SAAK,WAAW,EAAE,KAAK,MAAM;AAC3B,UAAI,KAAK,UAAU,IAAI,EAAE,EAAG,UAAS,mBAAmB,KAAK,OAAO;AAAA,IACtE,CAAC;AAED,WAAO;AAAA,MACL,MAAM;AAAA,QACJ,cAAc;AAAA,UACZ;AAAA,UACA,aAAa,MAAM;AACjB,iBAAK,UAAU,OAAO,EAAE;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,UAAgD;AACpD,UAAM,KAAK,WAAW;AACtB,UAAM,UAAU,KAAK;AACrB,QAAI,SAAS;AAEX,YAAM,KAAK,QAAQ,QAAQ,mBAAmB,CAAC,GAAG,QAAQ,YAAY;AAAA,IACxE;AACA,SAAK,aAAa;AAClB,SAAK,KAAK,cAAc,IAAI;AAC5B,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAAA,EAEA,MAAM,aAAiE;AACrE,UAAM,KAAK,WAAW;AAEtB,QAAI,KAAK,WAAW,KAAK,UAAU,KAAK,OAAO,KAAK,KAAK,kBAAkB;AACzE,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB;AAC7C,UAAI,SAAS,MAAM,SAAS,iBAAiB;AAC3C,eAAO,EAAE,MAAM,EAAE,SAAS,KAAK,GAAG,OAAO,KAAK;AAAA,MAChD;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,EAAE,SAAS,KAAK,QAAQ,GAAG,OAAO,KAAK;AAAA,EACxD;AAAA,EAEA,MAAM,QAAQ,KAA4D;AACxE,QAAI,QAAQ;AACZ,QAAI,CAAC,OAAO;AACV,YAAM;AAAA,QACJ,MAAM,EAAE,QAAQ;AAAA,MAClB,IAAI,MAAM,KAAK,WAAW;AAC1B,cAAQ,SAAS;AAAA,IACnB;AACA,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB,EAAE;AAAA,IACvG;AAEA,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAc,OAAO,iBAAiB,QAAW,KAAK;AACzF,WAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,eAAe,gBAEqD;AACxE,UAAM,KAAK,WAAW;AACtB,UAAM,eAAe,gBAAgB,iBAAiB,KAAK,SAAS;AACpE,QAAI,CAAC,cAAc;AACjB,aAAO;AAAA,QACL,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK;AAAA,QAClC,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB;AAAA,MACtE;AAAA,IACF;AACA,WAAO,KAAK,gBAAgB,YAAY;AAAA,EAC1C;AAAA;AAAA,EAIA,MAAc,QAAW,QAAwB,MAAc,MAAgB,aAAsB;AACnG,WAAO,QAAW;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,WAAW,KAAK;AAAA,IAClB,CAAC;AAAA,EACH;AAAA,EAEQ,aAA4B;AAClC,SAAK,sBAAL,KAAK,oBAAsB,KAAK,aAAa;AAC7C,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,eAA8B;AAC1C,QAAI,KAAK,sBAAsB,OAAO,WAAW,aAAa;AAC5D,YAAM,SAAS,cAAc,OAAO,SAAS,IAAI;AACjD,UAAI,QAAQ;AAEV,6BAAqB;AAErB,YAAI,eAAe,QAAQ;AACzB,kBAAQ;AAAA,YACN,8CAA8C,OAAO,UAAU,cAAc,OAAO,UAAU,KAAK;AAAA,YACnG,OAAO,UAAU,qBAAqB;AAAA,UACxC;AAAA,QACF,OAAO;AACL,gBAAM,EAAE,MAAM,KAAK,IAAI,MAAM,KAAK,QAAc,OAAO,iBAAiB,QAAW,OAAO,OAAO,YAAY;AAC7G,cAAI,MAAM;AACR,kBAAM,UAAmB,EAAE,GAAG,OAAO,QAAQ,YAAY,UAAU,KAAK;AACxE,kBAAM,KAAK,YAAY,OAAO;AAC9B,iBAAK,KAAK,aAAa,OAAO;AAC9B;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,kBAAkB;AACtC,QAAI,CAAC,OAAQ;AAEb,QAAI,KAAK,UAAU,MAAM,GAAG;AAC1B,UAAI,CAAC,KAAK,iBAAkB;AAC5B,WAAK,UAAU;AACf,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB;AAC7C,UAAI,SAAS,MAAM,SAAS,gBAAiB,MAAK,aAAa;AAC/D;AAAA,IACF;AAEA,SAAK,UAAU;AACf,SAAK,kBAAkB;AAAA,EACzB;AAAA,EAEQ,UAAU,SAA2B;AAC3C,WAAO,QAAQ,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAC/D;AAAA,EAEA,MAAc,gBACZ,cACuE;AACvE,SAAK,mBAAL,KAAK,iBAAmB,KAAK,UAAU,YAAY,EAAE,QAAQ,MAAM;AACjE,WAAK,iBAAiB;AAAA,IACxB,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,UACZ,cACuE;AACvE,UAAM,QAAQ,gBAAgB,KAAK,SAAS;AAC5C,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK;AAAA,QAClC,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB;AAAA,MACtE;AAAA,IACF;AAEA,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAiB,QAAQ,2CAA2C;AAAA,MACrG,eAAe;AAAA,IACjB,CAAC;AAED,QAAI,OAAO;AAET,UAAI,MAAM,SAAS,iBAAiB;AAClC,aAAK,aAAa;AAClB,aAAK,KAAK,cAAc,IAAI;AAAA,MAC9B;AACA,aAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,GAAG,MAAM;AAAA,IACtD;AAEA,QAAI,MAAM;AACR,YAAM,KAAK,YAAY,IAAI;AAC3B,WAAK,KAAK,mBAAmB,IAAI;AACjC,aAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,KAAK,GAAG,OAAO,KAAK;AAAA,IACjE;AACA,WAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,wBAAwB,EAAE;AAAA,EAC/F;AAAA,EAEA,MAAc,YAAY,SAAkB;AAC1C,SAAK,UAAU;AACf,QAAI,KAAK,gBAAgB;AACvB,UAAI;AACF,aAAK,QAAQ,QAAQ,KAAK,YAAY,KAAK,UAAU,OAAO,CAAC;AAAA,MAC/D,QAAQ;AAAA,MAER;AAAA,IACF;AACA,SAAK,kBAAkB;AAAA,EACzB;AAAA,EAEQ,eAAe;AACrB,SAAK,UAAU;AACf,QAAI;AACF,WAAK,QAAQ,WAAW,KAAK,UAAU;AAAA,IACzC,QAAQ;AAAA,IAER;AACA,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEQ,oBAAoC;AAC1C,QAAI,CAAC,KAAK,eAAgB,QAAO;AACjC,QAAI;AACF,YAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK,UAAU;AAChD,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,gBAAgB,CAAC,OAAO,cAAe,QAAO;AAC1D,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,oBAAoB;AAC1B,QAAI,CAAC,KAAK,oBAAoB,KAAK,gBAAgB,OAAO,gBAAgB,YAAa;AACvF,SAAK,eAAe,YAAY,MAAM;AACpC,UAAI,KAAK,WAAW,KAAK,UAAU,KAAK,OAAO,EAAG,MAAK,KAAK,gBAAgB;AAAA,IAC9E,GAAG,eAAe;AAElB,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,YAAY,OAAO,MAAM,UAAU,WAAY,OAAM,MAAM;AAAA,EAClF;AAAA,EAEQ,mBAAmB;AACzB,QAAI,KAAK,cAAc;AACrB,oBAAc,KAAK,YAAY;AAC/B,WAAK,eAAe;AAAA,IACtB;AAAA,EACF;AAAA,EAEQ,oBAAoB;AAC1B,QAAI,OAAO,WAAW,eAAe,CAAC,KAAK,eAAgB;AAC3D,WAAO,iBAAiB,WAAW,WAAS;AAC1C,UAAI,MAAM,QAAQ,KAAK,WAAY;AACnC,UAAI,CAAC,MAAM,UAAU;AACnB,YAAI,KAAK,SAAS;AAChB,eAAK,UAAU;AACf,eAAK,iBAAiB;AACtB,eAAK,KAAK,cAAc,IAAI;AAAA,QAC9B;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,OAAO,KAAK,MAAM,MAAM,QAAQ;AACtC,cAAM,UAAU,KAAK,iBAAiB,KAAK,SAAS;AACpD,aAAK,UAAU;AACf,aAAK,kBAAkB;AACvB,YAAI,QAAS,MAAK,KAAK,mBAAmB,IAAI;AAAA,MAChD,QAAQ;AAAA,MAER;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,KAAK,OAAwB,SAAyB;AAC5D,eAAW,YAAY,KAAK,UAAU,OAAO,GAAG;AAC9C,UAAI;AACF,iBAAS,OAAO,OAAO;AAAA,MACzB,SAAS,KAAK;AACZ,gBAAQ,MAAM,8CAA8C,GAAG;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;AAMO,IAAM,mBAAmB,CAAC,gBAAwB,YAA4C;AACnG,SAAO,EAAE,MAAM,IAAI,KAAK,gBAAgB,OAAO,EAAE;AACnD;","names":[]}
+{"version":3,"sources":["../src/connections.ts","../src/storage.ts","../src/url.ts","../src/client.ts"],"sourcesContent":["import type { Auth } from './client'\nimport { request } from './fetch'\nimport { AuthError, type AuthResponse, type ConnectProviderCredentials, type ProviderConnection } from './types'\n\nexport interface ConnectionsOptions {\n  apikey: string\n  baseUrl: string\n  fetchImpl?: typeof fetch\n}\n\n// Durable provider access for the signed-in user, kept apart from login identities:\n// a user who signed in with Google can connect several X accounts. Provider refresh\n// tokens stay on DeepKey; browsers only ever see connection metadata.\nexport class Connections {\n  constructor(\n    private auth: Auth,\n    private options: ConnectionsOptions,\n  ) {}\n\n  async connect(\n    credentials: ConnectProviderCredentials,\n  ): Promise<AuthResponse<{ provider: string; url: string | null }>> {\n    const { data, error } = await this.request<{ provider: string; url: string }>(\n      'POST',\n      '/auth/v1/connections/authorize',\n      { provider: credentials.provider, redirect_to: credentials.options?.redirectTo },\n    )\n    if (error || !data) return { data: { provider: credentials.provider, url: null }, error }\n\n    if (!credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {\n      window.location.assign(data.url)\n    }\n    return { data: { provider: credentials.provider, url: data.url }, error: null }\n  }\n\n  async list(): Promise<AuthResponse<{ connections: ProviderConnection[] }>> {\n    const { data, error } = await this.request<{ connections: ProviderConnection[] }>('GET', '/auth/v1/connections')\n    return { data: { connections: data?.connections ?? [] }, error }\n  }\n\n  async revoke(connectionId: string): Promise<{ error: AuthError | null }> {\n    const { error } = await this.request('DELETE', `/auth/v1/connections/${encodeURIComponent(connectionId)}`)\n    return { error }\n  }\n\n  private async request<T>(method: 'GET' | 'POST' | 'DELETE', path: string, body?: unknown) {\n    const {\n      data: { session },\n    } = await this.auth.getSession()\n    if (!session) {\n      return { data: null, error: new AuthError('Auth session missing!', 400, 'session_missing') }\n    }\n    return request<T>({ method, path, body, accessToken: session.access_token, ...this.options })\n  }\n}\n","import type { StorageAdapter } from './types'\n\nclass MemoryStorage implements StorageAdapter {\n  private store = new Map<string, string>()\n  getItem(key: string) {\n    return this.store.get(key) ?? null\n  }\n  setItem(key: string, value: string) {\n    this.store.set(key, value)\n  }\n  removeItem(key: string) {\n    this.store.delete(key)\n  }\n}\n\n// localStorage when available, in-memory fallback (SSR, tests, restricted contexts).\nexport const defaultStorage = (): StorageAdapter => {\n  try {\n    if (typeof window !== 'undefined' && window.localStorage) {\n      const probe = '__bt_auth_probe__'\n      window.localStorage.setItem(probe, '1')\n      window.localStorage.removeItem(probe)\n      return window.localStorage\n    }\n  } catch {\n    // fall through to memory storage\n  }\n  return new MemoryStorage()\n}\n\n// Publishable keys look like `bt_pub_<project-slug>_<random>`; the slug namespaces the\n// persisted session per project (mirrors supabase's `sb-<ref>-auth-token`).\nexport const deriveStorageKey = (publishableKey: string | undefined): string => {\n  const match = publishableKey?.match(/^bt_pub_([a-z0-9-]+)_[A-Za-z0-9_-]+$/)\n  return match ? `bt-${match[1]}-auth-token` : 'bt-auth-token'\n}\n","export interface FragmentTokens {\n  access_token: string\n  refresh_token: string\n  expires_in: number\n  expires_at: number\n  token_type: 'bearer'\n  type?: string\n}\n\nexport interface FragmentError {\n  error: string\n  error_code?: string\n  error_description?: string\n}\n\nexport type ParsedFragment = { tokens: FragmentTokens } | { authError: FragmentError } | null\n\n// Parses the implicit-flow return fragment (`#access_token=...` or `#error=...`).\nexport const parseFragment = (hash: string): ParsedFragment => {\n  if (!hash || hash.length < 2) return null\n  const params = new URLSearchParams(hash.startsWith('#') ? hash.slice(1) : hash)\n\n  const error = params.get('error')\n  if (error) {\n    return {\n      authError: {\n        error,\n        error_code: params.get('error_code') ?? undefined,\n        error_description: params.get('error_description') ?? undefined,\n      },\n    }\n  }\n\n  const accessToken = params.get('access_token')\n  const refreshToken = params.get('refresh_token')\n  if (!accessToken || !refreshToken) return null\n\n  const expiresIn = Number(params.get('expires_in') ?? 3600)\n  const expiresAt = Number(params.get('expires_at') ?? Math.floor(Date.now() / 1000) + expiresIn)\n\n  return {\n    tokens: {\n      access_token: accessToken,\n      refresh_token: refreshToken,\n      expires_in: expiresIn,\n      expires_at: expiresAt,\n      token_type: 'bearer',\n      type: params.get('type') ?? undefined,\n    },\n  }\n}\n\n// Removes the auth fragment from the address bar (before any await, so tokens never\n// linger in history).\nexport const cleanFragmentFromUrl = () => {\n  if (typeof window === 'undefined' || typeof history === 'undefined') return\n  history.replaceState(null, '', window.location.pathname + window.location.search)\n}\n","import { Connections } from './connections'\nimport { resolveBaseUrl } from './constants'\nimport { request } from './fetch'\nimport { defaultStorage, deriveStorageKey } from './storage'\nimport {\n  AuthError,\n  type AuthChangeEvent,\n  type AuthClientOptions,\n  type AuthResponse,\n  type Session,\n  type SignInWithOAuthCredentials,\n  type SignInWithOtpCredentials,\n  type StorageAdapter,\n  type Subscription,\n  type User,\n  type VerifyOtpParams,\n} from './types'\nimport { cleanFragmentFromUrl, parseFragment } from './url'\n\nconst REFRESH_TICK_MS = 30_000\n// Refresh when the access token is within this margin of expiry.\nconst EXPIRY_MARGIN_SECONDS = 90\n\ntype Listener = (event: AuthChangeEvent, session: Session | null) => void\n\nexport class Auth {\n  private baseUrl: string\n  private apikey: string\n  private storage: StorageAdapter\n  private storageKey: string\n  private persistSession: boolean\n  private autoRefreshToken: boolean\n  private detectSessionInUrl: boolean\n  private fetchImpl?: typeof fetch\n\n  private session: Session | null = null\n  private listeners = new Map<string, Listener>()\n  private listenerSeq = 0\n  private initializePromise: Promise<void> | null = null\n  private refreshPromise: Promise<AuthResponse<{ session: Session | null; user: User | null }>> | null = null\n  private refreshTimer: ReturnType<typeof setInterval> | null = null\n\n  constructor(publishableKey: string, options: AuthClientOptions = {}) {\n    // Lazy by design: an empty key must not throw at construction time (CI builds\n    // with empty envs import this module transitively). Failures surface on first call.\n    // The hosted DeepKey API is the only supported origin. The internal override\n    // exists for DeepKey's console and tests and is not part of the public contract.\n    this.baseUrl = resolveBaseUrl(options.__internalBaseUrl)\n    this.apikey = publishableKey ?? ''\n    this.persistSession = options.persistSession ?? true\n    this.autoRefreshToken = options.autoRefreshToken ?? true\n    this.detectSessionInUrl = options.detectSessionInUrl ?? true\n    this.storage = options.storage ?? defaultStorage()\n    this.storageKey = options.storageKey ?? deriveStorageKey(publishableKey)\n    this.fetchImpl = options.fetch\n\n    this.setupCrossTabSync()\n  }\n\n  // ---- public API (supabase-js compatible) ----\n\n  async signInWithOtp(credentials: SignInWithOtpCredentials): Promise<AuthResponse<{ user: null; session: null }>> {\n    const { error } = await this.request<Record<string, never>>('POST', '/auth/v1/otp', {\n      email: credentials.email,\n      create_user: credentials.options?.shouldCreateUser,\n      redirect_to: credentials.options?.emailRedirectTo,\n    })\n    return { data: { user: null, session: null }, error }\n  }\n\n  async verifyOtp(params: VerifyOtpParams): Promise<AuthResponse<{ user: User | null; session: Session | null }>> {\n    const { data, error } = await this.request<Session>('POST', '/auth/v1/verify', {\n      type: 'email',\n      email: params.email,\n      token: params.token,\n    })\n    if (error || !data) return { data: { user: null, session: null }, error }\n\n    await this.saveSession(data)\n    this.emit('SIGNED_IN', data)\n    return { data: { user: data.user, session: data }, error: null }\n  }\n\n  async signInWithOAuth(\n    credentials: SignInWithOAuthCredentials,\n  ): Promise<AuthResponse<{ provider: string; url: string }>> {\n    const url = new URL(`${this.baseUrl}/auth/v1/authorize`)\n    url.searchParams.set('provider', credentials.provider)\n    url.searchParams.set('apikey', this.apikey)\n    if (credentials.options?.redirectTo) url.searchParams.set('redirect_to', credentials.options.redirectTo)\n    if (credentials.options?.scopes) url.searchParams.set('scopes', credentials.options.scopes)\n    for (const [key, value] of Object.entries(credentials.options?.queryParams ?? {})) {\n      url.searchParams.set(key, value)\n    }\n\n    if (!credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {\n      window.location.assign(url.toString())\n    }\n    return { data: { provider: credentials.provider, url: url.toString() }, error: null }\n  }\n\n  onAuthStateChange(callback: Listener): { data: { subscription: Subscription } } {\n    const id = `listener-${++this.listenerSeq}`\n    this.listeners.set(id, callback)\n\n    // Every subscriber receives INITIAL_SESSION asynchronously once initialization\n    // settles — the supabase-js contract that AuthProviders rely on to resolve loading.\n    this.initialize().then(() => {\n      if (this.listeners.has(id)) callback('INITIAL_SESSION', this.session)\n    })\n\n    return {\n      data: {\n        subscription: {\n          id,\n          unsubscribe: () => {\n            this.listeners.delete(id)\n          },\n        },\n      },\n    }\n  }\n\n  async signOut(): Promise<{ error: AuthError | null }> {\n    await this.initialize()\n    const session = this.session\n    if (session) {\n      // Best-effort server-side revocation; local sign-out always succeeds.\n      await this.request('POST', '/auth/v1/logout', {}, session.access_token)\n    }\n    this.clearSession()\n    this.emit('SIGNED_OUT', null)\n    return { error: null }\n  }\n\n  async getSession(): Promise<AuthResponse<{ session: Session | null }>> {\n    await this.initialize()\n\n    if (this.session && this.isExpired(this.session) && this.autoRefreshToken) {\n      const { error } = await this.refreshWithLock()\n      if (error && error.code !== 'network_error') {\n        return { data: { session: null }, error: null }\n      }\n    }\n\n    return { data: { session: this.session }, error: null }\n  }\n\n  async getUser(jwt?: string): Promise<AuthResponse<{ user: User | null }>> {\n    let token = jwt\n    if (!token) {\n      const {\n        data: { session },\n      } = await this.getSession()\n      token = session?.access_token\n    }\n    if (!token) {\n      return { data: { user: null }, error: new AuthError('Auth session missing!', 400, 'session_missing') }\n    }\n\n    const { data, error } = await this.request<User>('GET', '/auth/v1/user', undefined, token)\n    return { data: { user: data }, error }\n  }\n\n  async refreshSession(currentSession?: {\n    refresh_token: string\n  }): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    await this.initialize()\n    const refreshToken = currentSession?.refresh_token ?? this.session?.refresh_token\n    if (!refreshToken) {\n      return {\n        data: { session: null, user: null },\n        error: new AuthError('Auth session missing!', 400, 'session_missing'),\n      }\n    }\n    return this.refreshWithLock(refreshToken)\n  }\n\n  // ---- internals ----\n\n  private async request<T>(method: 'GET' | 'POST', path: string, body?: unknown, accessToken?: string) {\n    return request<T>({\n      method,\n      path,\n      body,\n      accessToken,\n      apikey: this.apikey,\n      baseUrl: this.baseUrl,\n      fetchImpl: this.fetchImpl,\n    })\n  }\n\n  private initialize(): Promise<void> {\n    this.initializePromise ??= this.doInitialize()\n    return this.initializePromise\n  }\n\n  private async doInitialize(): Promise<void> {\n    if (this.detectSessionInUrl && typeof window !== 'undefined') {\n      const parsed = parseFragment(window.location.hash)\n      if (parsed) {\n        // Strip tokens from the address bar synchronously, before any await.\n        cleanFragmentFromUrl()\n\n        if ('authError' in parsed) {\n          console.warn(\n            `[deepkey] Auth redirect returned an error: ${parsed.authError.error_code ?? parsed.authError.error}`,\n            parsed.authError.error_description ?? '',\n          )\n        } else {\n          const { data: user } = await this.request<User>('GET', '/auth/v1/user', undefined, parsed.tokens.access_token)\n          if (user) {\n            const session: Session = { ...parsed.tokens, token_type: 'bearer', user }\n            await this.saveSession(session)\n            this.emit('SIGNED_IN', session)\n            return\n          }\n        }\n      }\n    }\n\n    const stored = this.loadStoredSession()\n    if (!stored) return\n\n    if (this.isExpired(stored)) {\n      if (!this.autoRefreshToken) return\n      this.session = stored\n      const { error } = await this.refreshWithLock()\n      if (error && error.code !== 'network_error') this.clearSession()\n      return\n    }\n\n    this.session = stored\n    this.startRefreshTimer()\n  }\n\n  private isExpired(session: Session): boolean {\n    return session.expires_at <= Math.floor(Date.now() / 1000) + EXPIRY_MARGIN_SECONDS\n  }\n\n  private async refreshWithLock(\n    refreshToken?: string,\n  ): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    this.refreshPromise ??= this.doRefresh(refreshToken).finally(() => {\n      this.refreshPromise = null\n    })\n    return this.refreshPromise\n  }\n\n  private async doRefresh(\n    refreshToken?: string,\n  ): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    const token = refreshToken ?? this.session?.refresh_token\n    if (!token) {\n      return {\n        data: { session: null, user: null },\n        error: new AuthError('Auth session missing!', 400, 'session_missing'),\n      }\n    }\n\n    const { data, error } = await this.request<Session>('POST', '/auth/v1/token?grant_type=refresh_token', {\n      refresh_token: token,\n    })\n\n    if (error) {\n      // Network failures keep the session (retry next tick); auth failures clear it.\n      if (error.code !== 'network_error') {\n        this.clearSession()\n        this.emit('SIGNED_OUT', null)\n      }\n      return { data: { session: null, user: null }, error }\n    }\n\n    if (data) {\n      await this.saveSession(data)\n      this.emit('TOKEN_REFRESHED', data)\n      return { data: { session: data, user: data.user }, error: null }\n    }\n    return { data: { session: null, user: null }, error: new AuthError('Empty refresh response') }\n  }\n\n  private async saveSession(session: Session) {\n    this.session = session\n    if (this.persistSession) {\n      try {\n        this.storage.setItem(this.storageKey, JSON.stringify(session))\n      } catch {\n        // Persistence is best-effort (private mode, quota).\n      }\n    }\n    this.startRefreshTimer()\n  }\n\n  private clearSession() {\n    this.session = null\n    try {\n      this.storage.removeItem(this.storageKey)\n    } catch {\n      // ignore\n    }\n    this.stopRefreshTimer()\n  }\n\n  private loadStoredSession(): Session | null {\n    if (!this.persistSession) return null\n    try {\n      const raw = this.storage.getItem(this.storageKey)\n      if (!raw) return null\n      const parsed = JSON.parse(raw) as Session\n      if (!parsed.access_token || !parsed.refresh_token) return null\n      return parsed\n    } catch {\n      return null\n    }\n  }\n\n  private startRefreshTimer() {\n    if (!this.autoRefreshToken || this.refreshTimer || typeof setInterval === 'undefined') return\n    this.refreshTimer = setInterval(() => {\n      if (this.session && this.isExpired(this.session)) void this.refreshWithLock()\n    }, REFRESH_TICK_MS)\n    // Do not keep node processes alive because of the timer (no-op in browsers).\n    const timer = this.refreshTimer as unknown as { unref?: () => void }\n    if (typeof timer === 'object' && typeof timer.unref === 'function') timer.unref()\n  }\n\n  private stopRefreshTimer() {\n    if (this.refreshTimer) {\n      clearInterval(this.refreshTimer)\n      this.refreshTimer = null\n    }\n  }\n\n  private setupCrossTabSync() {\n    if (typeof window === 'undefined' || !this.persistSession) return\n    window.addEventListener('storage', event => {\n      if (event.key !== this.storageKey) return\n      if (!event.newValue) {\n        if (this.session) {\n          this.session = null\n          this.stopRefreshTimer()\n          this.emit('SIGNED_OUT', null)\n        }\n        return\n      }\n      try {\n        const next = JSON.parse(event.newValue) as Session\n        const changed = next.access_token !== this.session?.access_token\n        this.session = next\n        this.startRefreshTimer()\n        if (changed) this.emit('TOKEN_REFRESHED', next)\n      } catch {\n        // ignore malformed writes\n      }\n    })\n  }\n\n  private emit(event: AuthChangeEvent, session: Session | null) {\n    for (const listener of this.listeners.values()) {\n      try {\n        listener(event, session)\n      } catch (err) {\n        console.error('[deepkey] onAuthStateChange listener threw', err)\n      }\n    }\n  }\n}\n\nexport interface AuthClient {\n  auth: Auth\n  connections: Connections\n}\n\nexport const createAuthClient = (publishableKey: string, options?: AuthClientOptions): AuthClient => {\n  const auth = new Auth(publishableKey, options)\n  const connections = new Connections(auth, {\n    apikey: publishableKey ?? '',\n    baseUrl: resolveBaseUrl(options?.__internalBaseUrl),\n    fetchImpl: options?.fetch,\n  })\n  return { auth, connections }\n}\n"],"mappings":";;;;;;;;AAaO,IAAM,cAAN,MAAkB;AAAA,EACvB,YACU,MACA,SACR;AAFQ;AACA;AAAA,EACP;AAAA,EAEH,MAAM,QACJ,aACiE;AACjE,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK;AAAA,MACjC;AAAA,MACA;AAAA,MACA,EAAE,UAAU,YAAY,UAAU,aAAa,YAAY,SAAS,WAAW;AAAA,IACjF;AACA,QAAI,SAAS,CAAC,KAAM,QAAO,EAAE,MAAM,EAAE,UAAU,YAAY,UAAU,KAAK,KAAK,GAAG,MAAM;AAExF,QAAI,CAAC,YAAY,SAAS,uBAAuB,OAAO,WAAW,aAAa;AAC9E,aAAO,SAAS,OAAO,KAAK,GAAG;AAAA,IACjC;AACA,WAAO,EAAE,MAAM,EAAE,UAAU,YAAY,UAAU,KAAK,KAAK,IAAI,GAAG,OAAO,KAAK;AAAA,EAChF;AAAA,EAEA,MAAM,OAAqE;AACzE,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAA+C,OAAO,sBAAsB;AAC/G,WAAO,EAAE,MAAM,EAAE,aAAa,MAAM,eAAe,CAAC,EAAE,GAAG,MAAM;AAAA,EACjE;AAAA,EAEA,MAAM,OAAO,cAA4D;AACvE,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,QAAQ,UAAU,wBAAwB,mBAAmB,YAAY,CAAC,EAAE;AACzG,WAAO,EAAE,MAAM;AAAA,EACjB;AAAA,EAEA,MAAc,QAAW,QAAmC,MAAc,MAAgB;AACxF,UAAM;AAAA,MACJ,MAAM,EAAE,QAAQ;AAAA,IAClB,IAAI,MAAM,KAAK,KAAK,WAAW;AAC/B,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,MAAM,MAAM,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB,EAAE;AAAA,IAC7F;AACA,WAAO,QAAW,EAAE,QAAQ,MAAM,MAAM,aAAa,QAAQ,cAAc,GAAG,KAAK,QAAQ,CAAC;AAAA,EAC9F;AACF;;;ACpDA,IAAM,gBAAN,MAA8C;AAAA,EAA9C;AACE,SAAQ,QAAQ,oBAAI,IAAoB;AAAA;AAAA,EACxC,QAAQ,KAAa;AACnB,WAAO,KAAK,MAAM,IAAI,GAAG,KAAK;AAAA,EAChC;AAAA,EACA,QAAQ,KAAa,OAAe;AAClC,SAAK,MAAM,IAAI,KAAK,KAAK;AAAA,EAC3B;AAAA,EACA,WAAW,KAAa;AACtB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AACF;AAGO,IAAM,iBAAiB,MAAsB;AAClD,MAAI;AACF,QAAI,OAAO,WAAW,eAAe,OAAO,cAAc;AACxD,YAAM,QAAQ;AACd,aAAO,aAAa,QAAQ,OAAO,GAAG;AACtC,aAAO,aAAa,WAAW,KAAK;AACpC,aAAO,OAAO;AAAA,IAChB;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,cAAc;AAC3B;AAIO,IAAM,mBAAmB,CAAC,mBAA+C;AAC9E,QAAM,QAAQ,gBAAgB,MAAM,sCAAsC;AAC1E,SAAO,QAAQ,MAAM,MAAM,CAAC,CAAC,gBAAgB;AAC/C;;;ACjBO,IAAM,gBAAgB,CAAC,SAAiC;AAC7D,MAAI,CAAC,QAAQ,KAAK,SAAS,EAAG,QAAO;AACrC,QAAM,SAAS,IAAI,gBAAgB,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI;AAE9E,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,MAAI,OAAO;AACT,WAAO;AAAA,MACL,WAAW;AAAA,QACT;AAAA,QACA,YAAY,OAAO,IAAI,YAAY,KAAK;AAAA,QACxC,mBAAmB,OAAO,IAAI,mBAAmB,KAAK;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,IAAI,cAAc;AAC7C,QAAM,eAAe,OAAO,IAAI,eAAe;AAC/C,MAAI,CAAC,eAAe,CAAC,aAAc,QAAO;AAE1C,QAAM,YAAY,OAAO,OAAO,IAAI,YAAY,KAAK,IAAI;AACzD,QAAM,YAAY,OAAO,OAAO,IAAI,YAAY,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,SAAS;AAE9F,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,cAAc;AAAA,MACd,eAAe;AAAA,MACf,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,MAAM,OAAO,IAAI,MAAM,KAAK;AAAA,IAC9B;AAAA,EACF;AACF;AAIO,IAAM,uBAAuB,MAAM;AACxC,MAAI,OAAO,WAAW,eAAe,OAAO,YAAY,YAAa;AACrE,UAAQ,aAAa,MAAM,IAAI,OAAO,SAAS,WAAW,OAAO,SAAS,MAAM;AAClF;;;ACtCA,IAAM,kBAAkB;AAExB,IAAM,wBAAwB;AAIvB,IAAM,OAAN,MAAW;AAAA,EAiBhB,YAAY,gBAAwB,UAA6B,CAAC,GAAG;AAPrE,SAAQ,UAA0B;AAClC,SAAQ,YAAY,oBAAI,IAAsB;AAC9C,SAAQ,cAAc;AACtB,SAAQ,oBAA0C;AAClD,SAAQ,iBAA+F;AACvG,SAAQ,eAAsD;AAO5D,SAAK,UAAU,eAAe,QAAQ,iBAAiB;AACvD,SAAK,SAAS,kBAAkB;AAChC,SAAK,iBAAiB,QAAQ,kBAAkB;AAChD,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,qBAAqB,QAAQ,sBAAsB;AACxD,SAAK,UAAU,QAAQ,WAAW,eAAe;AACjD,SAAK,aAAa,QAAQ,cAAc,iBAAiB,cAAc;AACvE,SAAK,YAAY,QAAQ;AAEzB,SAAK,kBAAkB;AAAA,EACzB;AAAA;AAAA,EAIA,MAAM,cAAc,aAA6F;AAC/G,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,QAA+B,QAAQ,gBAAgB;AAAA,MAClF,OAAO,YAAY;AAAA,MACnB,aAAa,YAAY,SAAS;AAAA,MAClC,aAAa,YAAY,SAAS;AAAA,IACpC,CAAC;AACD,WAAO,EAAE,MAAM,EAAE,MAAM,MAAM,SAAS,KAAK,GAAG,MAAM;AAAA,EACtD;AAAA,EAEA,MAAM,UAAU,QAAgG;AAC9G,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAiB,QAAQ,mBAAmB;AAAA,MAC7E,MAAM;AAAA,MACN,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AACD,QAAI,SAAS,CAAC,KAAM,QAAO,EAAE,MAAM,EAAE,MAAM,MAAM,SAAS,KAAK,GAAG,MAAM;AAExE,UAAM,KAAK,YAAY,IAAI;AAC3B,SAAK,KAAK,aAAa,IAAI;AAC3B,WAAO,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,GAAG,OAAO,KAAK;AAAA,EACjE;AAAA,EAEA,MAAM,gBACJ,aAC0D;AAC1D,UAAM,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,oBAAoB;AACvD,QAAI,aAAa,IAAI,YAAY,YAAY,QAAQ;AACrD,QAAI,aAAa,IAAI,UAAU,KAAK,MAAM;AAC1C,QAAI,YAAY,SAAS,WAAY,KAAI,aAAa,IAAI,eAAe,YAAY,QAAQ,UAAU;AACvG,QAAI,YAAY,SAAS,OAAQ,KAAI,aAAa,IAAI,UAAU,YAAY,QAAQ,MAAM;AAC1F,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,YAAY,SAAS,eAAe,CAAC,CAAC,GAAG;AACjF,UAAI,aAAa,IAAI,KAAK,KAAK;AAAA,IACjC;AAEA,QAAI,CAAC,YAAY,SAAS,uBAAuB,OAAO,WAAW,aAAa;AAC9E,aAAO,SAAS,OAAO,IAAI,SAAS,CAAC;AAAA,IACvC;AACA,WAAO,EAAE,MAAM,EAAE,UAAU,YAAY,UAAU,KAAK,IAAI,SAAS,EAAE,GAAG,OAAO,KAAK;AAAA,EACtF;AAAA,EAEA,kBAAkB,UAA8D;AAC9E,UAAM,KAAK,YAAY,EAAE,KAAK,WAAW;AACzC,SAAK,UAAU,IAAI,IAAI,QAAQ;AAI/B,SAAK,WAAW,EAAE,KAAK,MAAM;AAC3B,UAAI,KAAK,UAAU,IAAI,EAAE,EAAG,UAAS,mBAAmB,KAAK,OAAO;AAAA,IACtE,CAAC;AAED,WAAO;AAAA,MACL,MAAM;AAAA,QACJ,cAAc;AAAA,UACZ;AAAA,UACA,aAAa,MAAM;AACjB,iBAAK,UAAU,OAAO,EAAE;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,UAAgD;AACpD,UAAM,KAAK,WAAW;AACtB,UAAM,UAAU,KAAK;AACrB,QAAI,SAAS;AAEX,YAAM,KAAK,QAAQ,QAAQ,mBAAmB,CAAC,GAAG,QAAQ,YAAY;AAAA,IACxE;AACA,SAAK,aAAa;AAClB,SAAK,KAAK,cAAc,IAAI;AAC5B,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAAA,EAEA,MAAM,aAAiE;AACrE,UAAM,KAAK,WAAW;AAEtB,QAAI,KAAK,WAAW,KAAK,UAAU,KAAK,OAAO,KAAK,KAAK,kBAAkB;AACzE,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB;AAC7C,UAAI,SAAS,MAAM,SAAS,iBAAiB;AAC3C,eAAO,EAAE,MAAM,EAAE,SAAS,KAAK,GAAG,OAAO,KAAK;AAAA,MAChD;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,EAAE,SAAS,KAAK,QAAQ,GAAG,OAAO,KAAK;AAAA,EACxD;AAAA,EAEA,MAAM,QAAQ,KAA4D;AACxE,QAAI,QAAQ;AACZ,QAAI,CAAC,OAAO;AACV,YAAM;AAAA,QACJ,MAAM,EAAE,QAAQ;AAAA,MAClB,IAAI,MAAM,KAAK,WAAW;AAC1B,cAAQ,SAAS;AAAA,IACnB;AACA,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB,EAAE;AAAA,IACvG;AAEA,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAc,OAAO,iBAAiB,QAAW,KAAK;AACzF,WAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,eAAe,gBAEqD;AACxE,UAAM,KAAK,WAAW;AACtB,UAAM,eAAe,gBAAgB,iBAAiB,KAAK,SAAS;AACpE,QAAI,CAAC,cAAc;AACjB,aAAO;AAAA,QACL,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK;AAAA,QAClC,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB;AAAA,MACtE;AAAA,IACF;AACA,WAAO,KAAK,gBAAgB,YAAY;AAAA,EAC1C;AAAA;AAAA,EAIA,MAAc,QAAW,QAAwB,MAAc,MAAgB,aAAsB;AACnG,WAAO,QAAW;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,WAAW,KAAK;AAAA,IAClB,CAAC;AAAA,EACH;AAAA,EAEQ,aAA4B;AAClC,SAAK,sBAAL,KAAK,oBAAsB,KAAK,aAAa;AAC7C,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,eAA8B;AAC1C,QAAI,KAAK,sBAAsB,OAAO,WAAW,aAAa;AAC5D,YAAM,SAAS,cAAc,OAAO,SAAS,IAAI;AACjD,UAAI,QAAQ;AAEV,6BAAqB;AAErB,YAAI,eAAe,QAAQ;AACzB,kBAAQ;AAAA,YACN,8CAA8C,OAAO,UAAU,cAAc,OAAO,UAAU,KAAK;AAAA,YACnG,OAAO,UAAU,qBAAqB;AAAA,UACxC;AAAA,QACF,OAAO;AACL,gBAAM,EAAE,MAAM,KAAK,IAAI,MAAM,KAAK,QAAc,OAAO,iBAAiB,QAAW,OAAO,OAAO,YAAY;AAC7G,cAAI,MAAM;AACR,kBAAM,UAAmB,EAAE,GAAG,OAAO,QAAQ,YAAY,UAAU,KAAK;AACxE,kBAAM,KAAK,YAAY,OAAO;AAC9B,iBAAK,KAAK,aAAa,OAAO;AAC9B;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,kBAAkB;AACtC,QAAI,CAAC,OAAQ;AAEb,QAAI,KAAK,UAAU,MAAM,GAAG;AAC1B,UAAI,CAAC,KAAK,iBAAkB;AAC5B,WAAK,UAAU;AACf,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB;AAC7C,UAAI,SAAS,MAAM,SAAS,gBAAiB,MAAK,aAAa;AAC/D;AAAA,IACF;AAEA,SAAK,UAAU;AACf,SAAK,kBAAkB;AAAA,EACzB;AAAA,EAEQ,UAAU,SAA2B;AAC3C,WAAO,QAAQ,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAC/D;AAAA,EAEA,MAAc,gBACZ,cACuE;AACvE,SAAK,mBAAL,KAAK,iBAAmB,KAAK,UAAU,YAAY,EAAE,QAAQ,MAAM;AACjE,WAAK,iBAAiB;AAAA,IACxB,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,UACZ,cACuE;AACvE,UAAM,QAAQ,gBAAgB,KAAK,SAAS;AAC5C,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK;AAAA,QAClC,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB;AAAA,MACtE;AAAA,IACF;AAEA,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAiB,QAAQ,2CAA2C;AAAA,MACrG,eAAe;AAAA,IACjB,CAAC;AAED,QAAI,OAAO;AAET,UAAI,MAAM,SAAS,iBAAiB;AAClC,aAAK,aAAa;AAClB,aAAK,KAAK,cAAc,IAAI;AAAA,MAC9B;AACA,aAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,GAAG,MAAM;AAAA,IACtD;AAEA,QAAI,MAAM;AACR,YAAM,KAAK,YAAY,IAAI;AAC3B,WAAK,KAAK,mBAAmB,IAAI;AACjC,aAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,KAAK,GAAG,OAAO,KAAK;AAAA,IACjE;AACA,WAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,wBAAwB,EAAE;AAAA,EAC/F;AAAA,EAEA,MAAc,YAAY,SAAkB;AAC1C,SAAK,UAAU;AACf,QAAI,KAAK,gBAAgB;AACvB,UAAI;AACF,aAAK,QAAQ,QAAQ,KAAK,YAAY,KAAK,UAAU,OAAO,CAAC;AAAA,MAC/D,QAAQ;AAAA,MAER;AAAA,IACF;AACA,SAAK,kBAAkB;AAAA,EACzB;AAAA,EAEQ,eAAe;AACrB,SAAK,UAAU;AACf,QAAI;AACF,WAAK,QAAQ,WAAW,KAAK,UAAU;AAAA,IACzC,QAAQ;AAAA,IAER;AACA,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEQ,oBAAoC;AAC1C,QAAI,CAAC,KAAK,eAAgB,QAAO;AACjC,QAAI;AACF,YAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK,UAAU;AAChD,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,gBAAgB,CAAC,OAAO,cAAe,QAAO;AAC1D,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,oBAAoB;AAC1B,QAAI,CAAC,KAAK,oBAAoB,KAAK,gBAAgB,OAAO,gBAAgB,YAAa;AACvF,SAAK,eAAe,YAAY,MAAM;AACpC,UAAI,KAAK,WAAW,KAAK,UAAU,KAAK,OAAO,EAAG,MAAK,KAAK,gBAAgB;AAAA,IAC9E,GAAG,eAAe;AAElB,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,YAAY,OAAO,MAAM,UAAU,WAAY,OAAM,MAAM;AAAA,EAClF;AAAA,EAEQ,mBAAmB;AACzB,QAAI,KAAK,cAAc;AACrB,oBAAc,KAAK,YAAY;AAC/B,WAAK,eAAe;AAAA,IACtB;AAAA,EACF;AAAA,EAEQ,oBAAoB;AAC1B,QAAI,OAAO,WAAW,eAAe,CAAC,KAAK,eAAgB;AAC3D,WAAO,iBAAiB,WAAW,WAAS;AAC1C,UAAI,MAAM,QAAQ,KAAK,WAAY;AACnC,UAAI,CAAC,MAAM,UAAU;AACnB,YAAI,KAAK,SAAS;AAChB,eAAK,UAAU;AACf,eAAK,iBAAiB;AACtB,eAAK,KAAK,cAAc,IAAI;AAAA,QAC9B;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,OAAO,KAAK,MAAM,MAAM,QAAQ;AACtC,cAAM,UAAU,KAAK,iBAAiB,KAAK,SAAS;AACpD,aAAK,UAAU;AACf,aAAK,kBAAkB;AACvB,YAAI,QAAS,MAAK,KAAK,mBAAmB,IAAI;AAAA,MAChD,QAAQ;AAAA,MAER;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,KAAK,OAAwB,SAAyB;AAC5D,eAAW,YAAY,KAAK,UAAU,OAAO,GAAG;AAC9C,UAAI;AACF,iBAAS,OAAO,OAAO;AAAA,MACzB,SAAS,KAAK;AACZ,gBAAQ,MAAM,8CAA8C,GAAG;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;AAOO,IAAM,mBAAmB,CAAC,gBAAwB,YAA4C;AACnG,QAAM,OAAO,IAAI,KAAK,gBAAgB,OAAO;AAC7C,QAAM,cAAc,IAAI,YAAY,MAAM;AAAA,IACxC,QAAQ,kBAAkB;AAAA,IAC1B,SAAS,eAAe,SAAS,iBAAiB;AAAA,IAClD,WAAW,SAAS;AAAA,EACtB,CAAC;AACD,SAAO,EAAE,MAAM,YAAY;AAC7B;","names":[]}

package/dist/server.cjs

@@ -43,39 +43,74 @@ var AuthError = class extends Error {
   }
 };
 
+// src/fetch.ts
+var request = async (options) => {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  try {
+    const headers = { apikey: options.apikey };
+    if (options.body !== void 0) headers["Content-Type"] = "application/json";
+    if (options.accessToken) headers.Authorization = `Bearer ${options.accessToken}`;
+    const response = await fetchImpl(`${options.baseUrl}${options.path}`, {
+      method: options.method,
+      headers,
+      body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+    });
+    if (response.status === 204) return { data: {}, error: null };
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      payload = null;
+    }
+    if (!response.ok) {
+      const errorBody = payload?.error;
+      return {
+        data: null,
+        error: new AuthError(
+          errorBody?.message ?? `Request failed with status ${response.status}`,
+          response.status,
+          errorBody?.code
+        )
+      };
+    }
+    return { data: payload, error: null };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Network request failed";
+    return { data: null, error: new AuthError(message, 0, "network_error") };
+  }
+};
+
 // src/server.ts
 var createServerClient = (secretKey, options = {}) => {
-  const baseUrl = resolveBaseUrl(options.__internalBaseUrl);
-  const fetchImpl = options.fetch ?? fetch;
+  const base = { apikey: secretKey, baseUrl: resolveBaseUrl(options.__internalBaseUrl), fetchImpl: options.fetch };
+  const connection = (id) => `/auth/v1/connections/${encodeURIComponent(id)}`;
   return {
     auth: {
       async getUser(jwt) {
-        try {
-          const response = await fetchImpl(`${baseUrl}/auth/v1/user`, {
-            headers: { Authorization: `Bearer ${jwt}`, apikey: secretKey }
-          });
-          let payload = null;
-          try {
-            payload = await response.json();
-          } catch {
-            payload = null;
-          }
-          if (!response.ok) {
-            const errorBody = payload?.error;
-            return {
-              data: { user: null },
-              error: new AuthError(
-                errorBody?.message ?? `Request failed with status ${response.status}`,
-                response.status,
-                errorBody?.code
-              )
-            };
-          }
-          return { data: { user: payload }, error: null };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : "Network request failed";
-          return { data: { user: null }, error: new AuthError(message, 0, "network_error") };
-        }
+        const { data, error } = await request({ ...base, method: "GET", path: "/auth/v1/user", accessToken: jwt });
+        return { data: { user: data }, error };
+      }
+    },
+    connections: {
+      async list({ userId }) {
+        const { data, error } = await request({
+          ...base,
+          method: "GET",
+          path: `/auth/v1/connections?user_id=${encodeURIComponent(userId)}`
+        });
+        return { data: { connections: data?.connections ?? [] }, error };
+      },
+      async issueAccessToken(connectionId) {
+        return request({
+          ...base,
+          method: "POST",
+          path: `${connection(connectionId)}/token`,
+          body: {}
+        });
+      },
+      async revoke(connectionId) {
+        const { error } = await request({ ...base, method: "DELETE", path: connection(connectionId) });
+        return { error };
       }
     }
   };

package/dist/server.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts","../src/constants.ts","../src/types.ts"],"sourcesContent":["import { resolveBaseUrl } from './constants'\nimport { AuthError, type ServerClientOptions, type User } from './types'\n\nexport interface ServerAuthClient {\n  auth: {\n    // Mirrors `supabase.auth.getUser(jwt)` server-side: validates the access token\n    // against the auth service and returns the user.\n    getUser(jwt: string): Promise<{ data: { user: User | null }; error: AuthError | null }>\n  }\n}\n\n// Runs anywhere with global fetch (Bun, Node >= 18). `secretKey` is the project's\n// bt_secret_... key. Requests target the hosted DeepKey API; the internal\n// override is reserved for DeepKey's console and tests.\nexport const createServerClient = (secretKey: string, options: ServerClientOptions = {}): ServerAuthClient => {\n  const baseUrl = resolveBaseUrl(options.__internalBaseUrl)\n  const fetchImpl = options.fetch ?? fetch\n\n  return {\n    auth: {\n      async getUser(jwt: string) {\n        try {\n          const response = await fetchImpl(`${baseUrl}/auth/v1/user`, {\n            headers: { Authorization: `Bearer ${jwt}`, apikey: secretKey },\n          })\n\n          let payload: unknown = null\n          try {\n            payload = await response.json()\n          } catch {\n            payload = null\n          }\n\n          if (!response.ok) {\n            const errorBody = (payload as { error?: { code?: string; message?: string } } | null)?.error\n            return {\n              data: { user: null },\n              error: new AuthError(\n                errorBody?.message ?? `Request failed with status ${response.status}`,\n                response.status,\n                errorBody?.code,\n              ),\n            }\n          }\n\n          return { data: { user: payload as User }, error: null }\n        } catch (err) {\n          const message = err instanceof Error ? err.message : 'Network request failed'\n          return { data: { user: null }, error: new AuthError(message, 0, 'network_error') }\n        }\n      },\n    },\n  }\n}\n\nexport { DEEPKEY_API_URL } from './constants'\nexport { AuthError, type ServerClientOptions, type User } from './types'\n","// The hosted DeepKey API. Every client talks to this origin; only DeepKey's own\n// console and test suites replace it through the internal override.\nexport const DEEPKEY_API_URL = 'https://deepkey.dev/api'\n\n// Resolves the base URL used for every request. An absent or blank internal\n// override keeps the hosted API; a provided value has any trailing slash removed\n// so path joins stay predictable.\nexport const resolveBaseUrl = (url?: string | null): string => {\n  const candidate = typeof url === 'string' ? url.trim() : ''\n  return (candidate || DEEPKEY_API_URL).replace(/\\/+$/, '')\n}\n","export interface UserIdentity {\n  identity_id: string\n  id: string\n  user_id: string\n  provider: string\n  identity_data: Record<string, unknown>\n  last_sign_in_at: string | null\n  created_at: string\n  updated_at: string\n}\n\nexport interface User {\n  id: string\n  aud: string\n  role: string\n  email: string | null\n  email_confirmed_at: string | null\n  app_metadata: { provider?: string | null; providers?: string[]; [key: string]: unknown }\n  user_metadata: {\n    name?: string\n    full_name?: string\n    avatar_url?: string\n    picture?: string\n    email?: string\n    [key: string]: unknown\n  }\n  identities?: UserIdentity[]\n  created_at: string\n  updated_at?: string\n  last_sign_in_at?: string | null\n}\n\nexport interface Session {\n  access_token: string\n  refresh_token: string\n  token_type: 'bearer'\n  expires_in: number\n  expires_at: number\n  user: User\n}\n\nexport class AuthError extends Error {\n  status?: number\n  code?: string\n\n  constructor(message: string, status?: number, code?: string) {\n    super(message)\n    this.name = 'AuthError'\n    this.status = status\n    this.code = code\n  }\n}\n\nexport type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED'\n\nexport interface Subscription {\n  id: string\n  unsubscribe: () => void\n}\n\nexport interface StorageAdapter {\n  getItem(key: string): string | null\n  setItem(key: string, value: string): void\n  removeItem(key: string): void\n}\n\nexport interface AuthClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  storageKey?: string\n  autoRefreshToken?: boolean\n  detectSessionInUrl?: boolean\n  persistSession?: boolean\n  storage?: StorageAdapter\n  fetch?: typeof fetch\n}\n\nexport interface ServerClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  fetch?: typeof fetch\n}\n\nexport interface SignInWithOtpCredentials {\n  email: string\n  options?: {\n    emailRedirectTo?: string\n    shouldCreateUser?: boolean\n    data?: Record<string, unknown>\n  }\n}\n\nexport interface VerifyOtpParams {\n  email: string\n  token: string\n  type: 'email' | 'magiclink'\n}\n\nexport interface SignInWithOAuthCredentials {\n  provider: string\n  options?: {\n    redirectTo?: string\n    scopes?: string\n    queryParams?: Record<string, string>\n    skipBrowserRedirect?: boolean\n  }\n}\n\nexport interface AuthResponse<T> {\n  data: T\n  error: AuthError | null\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEO,IAAM,kBAAkB;AAKxB,IAAM,iBAAiB,CAAC,QAAgC;AAC7D,QAAM,YAAY,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;AACzD,UAAQ,aAAa,iBAAiB,QAAQ,QAAQ,EAAE;AAC1D;;;AC+BO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAInC,YAAY,SAAiB,QAAiB,MAAe;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;;;AFrCO,IAAM,qBAAqB,CAAC,WAAmB,UAA+B,CAAC,MAAwB;AAC5G,QAAM,UAAU,eAAe,QAAQ,iBAAiB;AACxD,QAAM,YAAY,QAAQ,SAAS;AAEnC,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,MAAM,QAAQ,KAAa;AACzB,YAAI;AACF,gBAAM,WAAW,MAAM,UAAU,GAAG,OAAO,iBAAiB;AAAA,YAC1D,SAAS,EAAE,eAAe,UAAU,GAAG,IAAI,QAAQ,UAAU;AAAA,UAC/D,CAAC;AAED,cAAI,UAAmB;AACvB,cAAI;AACF,sBAAU,MAAM,SAAS,KAAK;AAAA,UAChC,QAAQ;AACN,sBAAU;AAAA,UACZ;AAEA,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,YAAa,SAAoE;AACvF,mBAAO;AAAA,cACL,MAAM,EAAE,MAAM,KAAK;AAAA,cACnB,OAAO,IAAI;AAAA,gBACT,WAAW,WAAW,8BAA8B,SAAS,MAAM;AAAA,gBACnE,SAAS;AAAA,gBACT,WAAW;AAAA,cACb;AAAA,YACF;AAAA,UACF;AAEA,iBAAO,EAAE,MAAM,EAAE,MAAM,QAAgB,GAAG,OAAO,KAAK;AAAA,QACxD,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,iBAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,SAAS,GAAG,eAAe,EAAE;AAAA,QACnF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/server.ts","../src/constants.ts","../src/types.ts","../src/fetch.ts"],"sourcesContent":["import { resolveBaseUrl } from './constants'\nimport { request } from './fetch'\nimport type {\n  AuthError,\n  AuthResponse,\n  ProviderAccessToken,\n  ProviderConnection,\n  ServerClientOptions,\n  User,\n} from './types'\n\nexport interface ServerAuthClient {\n  auth: {\n    // Mirrors `supabase.auth.getUser(jwt)` server-side: validates the access token\n    // against the auth service and returns the user.\n    getUser(jwt: string): Promise<AuthResponse<{ user: User | null }>>\n  }\n  // Provider connections a user granted through the browser SDK. The secret key acts\n  // for the whole project; provider access tokens are issued only here, never to browsers.\n  connections: {\n    list(params: { userId: string }): Promise<AuthResponse<{ connections: ProviderConnection[] }>>\n    issueAccessToken(connectionId: string): Promise<AuthResponse<ProviderAccessToken | null>>\n    revoke(connectionId: string): Promise<{ error: AuthError | null }>\n  }\n}\n\n// Runs anywhere with global fetch (Bun, Node >= 18). `secretKey` is the project's\n// bt_secret_... key. Requests target the hosted DeepKey API; the internal\n// override is reserved for DeepKey's console and tests.\nexport const createServerClient = (secretKey: string, options: ServerClientOptions = {}): ServerAuthClient => {\n  const base = { apikey: secretKey, baseUrl: resolveBaseUrl(options.__internalBaseUrl), fetchImpl: options.fetch }\n  const connection = (id: string) => `/auth/v1/connections/${encodeURIComponent(id)}`\n\n  return {\n    auth: {\n      async getUser(jwt: string) {\n        const { data, error } = await request<User>({ ...base, method: 'GET', path: '/auth/v1/user', accessToken: jwt })\n        return { data: { user: data }, error }\n      },\n    },\n    connections: {\n      async list({ userId }) {\n        const { data, error } = await request<{ connections: ProviderConnection[] }>({\n          ...base,\n          method: 'GET',\n          path: `/auth/v1/connections?user_id=${encodeURIComponent(userId)}`,\n        })\n        return { data: { connections: data?.connections ?? [] }, error }\n      },\n      async issueAccessToken(connectionId) {\n        return request<ProviderAccessToken>({\n          ...base,\n          method: 'POST',\n          path: `${connection(connectionId)}/token`,\n          body: {},\n        })\n      },\n      async revoke(connectionId) {\n        const { error } = await request({ ...base, method: 'DELETE', path: connection(connectionId) })\n        return { error }\n      },\n    },\n  }\n}\n\nexport { DEEPKEY_API_URL } from './constants'\nexport {\n  AuthError,\n  type AuthResponse,\n  type ProviderAccessToken,\n  type ProviderConnection,\n  type ServerClientOptions,\n  type User,\n} from './types'\n","// The hosted DeepKey API. Every client talks to this origin; only DeepKey's own\n// console and test suites replace it through the internal override.\nexport const DEEPKEY_API_URL = 'https://deepkey.dev/api'\n\n// Resolves the base URL used for every request. An absent or blank internal\n// override keeps the hosted API; a provided value has any trailing slash removed\n// so path joins stay predictable.\nexport const resolveBaseUrl = (url?: string | null): string => {\n  const candidate = typeof url === 'string' ? url.trim() : ''\n  return (candidate || DEEPKEY_API_URL).replace(/\\/+$/, '')\n}\n","export interface UserIdentity {\n  identity_id: string\n  id: string\n  user_id: string\n  provider: string\n  identity_data: Record<string, unknown>\n  last_sign_in_at: string | null\n  created_at: string\n  updated_at: string\n}\n\nexport interface User {\n  id: string\n  aud: string\n  role: string\n  email: string | null\n  email_confirmed_at: string | null\n  app_metadata: { provider?: string | null; providers?: string[]; [key: string]: unknown }\n  user_metadata: {\n    name?: string\n    full_name?: string\n    avatar_url?: string\n    picture?: string\n    email?: string\n    [key: string]: unknown\n  }\n  identities?: UserIdentity[]\n  created_at: string\n  updated_at?: string\n  last_sign_in_at?: string | null\n}\n\nexport interface Session {\n  access_token: string\n  refresh_token: string\n  token_type: 'bearer'\n  expires_in: number\n  expires_at: number\n  user: User\n}\n\nexport class AuthError extends Error {\n  status?: number\n  code?: string\n\n  constructor(message: string, status?: number, code?: string) {\n    super(message)\n    this.name = 'AuthError'\n    this.status = status\n    this.code = code\n  }\n}\n\nexport type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED'\n\nexport interface Subscription {\n  id: string\n  unsubscribe: () => void\n}\n\nexport interface StorageAdapter {\n  getItem(key: string): string | null\n  setItem(key: string, value: string): void\n  removeItem(key: string): void\n}\n\nexport interface AuthClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  storageKey?: string\n  autoRefreshToken?: boolean\n  detectSessionInUrl?: boolean\n  persistSession?: boolean\n  storage?: StorageAdapter\n  fetch?: typeof fetch\n}\n\nexport interface ServerClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  fetch?: typeof fetch\n}\n\nexport interface SignInWithOtpCredentials {\n  email: string\n  options?: {\n    emailRedirectTo?: string\n    shouldCreateUser?: boolean\n    data?: Record<string, unknown>\n  }\n}\n\nexport interface VerifyOtpParams {\n  email: string\n  token: string\n  type: 'email' | 'magiclink'\n}\n\nexport interface ConnectProviderCredentials {\n  provider: string\n  options?: {\n    redirectTo?: string\n    skipBrowserRedirect?: boolean\n  }\n}\n\n// Metadata only: provider tokens never appear in browser responses.\nexport interface ProviderConnection {\n  id: string\n  // The DeepKey user that granted the connection: the same `user.id` your server gets from getUser(jwt).\n  user_id: string\n  provider: string\n  provider_user_id: string\n  identity_data: Record<string, unknown>\n  scope: string | null\n  status: 'active' | 'reauthorization_required'\n  created_at: string\n  updated_at: string\n}\n\n// Issued to consumer servers through the secret key; short-lived and refreshed by DeepKey.\nexport interface ProviderAccessToken {\n  access_token: string\n  token_type: 'bearer'\n  expires_at: number | null\n  scope: string | null\n}\n\nexport interface SignInWithOAuthCredentials {\n  provider: string\n  options?: {\n    redirectTo?: string\n    scopes?: string\n    queryParams?: Record<string, string>\n    skipBrowserRedirect?: boolean\n  }\n}\n\nexport interface AuthResponse<T> {\n  data: T\n  error: AuthError | null\n}\n","import { AuthError } from './types'\n\nexport interface RequestOptions {\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE'\n  path: string\n  apikey: string\n  baseUrl: string\n  accessToken?: string\n  body?: unknown\n  fetchImpl?: typeof fetch\n}\n\nexport interface RequestResult<T> {\n  data: T | null\n  error: AuthError | null\n}\n\n// All service errors are shaped { error: { code, message } }.\nexport const request = async <T>(options: RequestOptions): Promise<RequestResult<T>> => {\n  const fetchImpl = options.fetchImpl ?? fetch\n  try {\n    const headers: Record<string, string> = { apikey: options.apikey }\n    if (options.body !== undefined) headers['Content-Type'] = 'application/json'\n    if (options.accessToken) headers.Authorization = `Bearer ${options.accessToken}`\n\n    const response = await fetchImpl(`${options.baseUrl}${options.path}`, {\n      method: options.method,\n      headers,\n      body: options.body !== undefined ? JSON.stringify(options.body) : undefined,\n    })\n\n    if (response.status === 204) return { data: {} as T, error: null }\n\n    let payload: unknown\n    try {\n      payload = await response.json()\n    } catch {\n      payload = null\n    }\n\n    if (!response.ok) {\n      const errorBody = (payload as { error?: { code?: string; message?: string } } | null)?.error\n      return {\n        data: null,\n        error: new AuthError(\n          errorBody?.message ?? `Request failed with status ${response.status}`,\n          response.status,\n          errorBody?.code,\n        ),\n      }\n    }\n\n    return { data: payload as T, error: null }\n  } catch (err) {\n    const message = err instanceof Error ? err.message : 'Network request failed'\n    return { data: null, error: new AuthError(message, 0, 'network_error') }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEO,IAAM,kBAAkB;AAKxB,IAAM,iBAAiB,CAAC,QAAgC;AAC7D,QAAM,YAAY,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;AACzD,UAAQ,aAAa,iBAAiB,QAAQ,QAAQ,EAAE;AAC1D;;;AC+BO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAInC,YAAY,SAAiB,QAAiB,MAAe;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;;;ACjCO,IAAM,UAAU,OAAU,YAAuD;AACtF,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI;AACF,UAAM,UAAkC,EAAE,QAAQ,QAAQ,OAAO;AACjE,QAAI,QAAQ,SAAS,OAAW,SAAQ,cAAc,IAAI;AAC1D,QAAI,QAAQ,YAAa,SAAQ,gBAAgB,UAAU,QAAQ,WAAW;AAE9E,UAAM,WAAW,MAAM,UAAU,GAAG,QAAQ,OAAO,GAAG,QAAQ,IAAI,IAAI;AAAA,MACpE,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,MAAM,QAAQ,SAAS,SAAY,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,IACpE,CAAC;AAED,QAAI,SAAS,WAAW,IAAK,QAAO,EAAE,MAAM,CAAC,GAAQ,OAAO,KAAK;AAEjE,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,SAAS,KAAK;AAAA,IAChC,QAAQ;AACN,gBAAU;AAAA,IACZ;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,SAAoE;AACvF,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO,IAAI;AAAA,UACT,WAAW,WAAW,8BAA8B,SAAS,MAAM;AAAA,UACnE,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,SAAc,OAAO,KAAK;AAAA,EAC3C,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,EAAE,MAAM,MAAM,OAAO,IAAI,UAAU,SAAS,GAAG,eAAe,EAAE;AAAA,EACzE;AACF;;;AH5BO,IAAM,qBAAqB,CAAC,WAAmB,UAA+B,CAAC,MAAwB;AAC5G,QAAM,OAAO,EAAE,QAAQ,WAAW,SAAS,eAAe,QAAQ,iBAAiB,GAAG,WAAW,QAAQ,MAAM;AAC/G,QAAM,aAAa,CAAC,OAAe,wBAAwB,mBAAmB,EAAE,CAAC;AAEjF,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,MAAM,QAAQ,KAAa;AACzB,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,QAAc,EAAE,GAAG,MAAM,QAAQ,OAAO,MAAM,iBAAiB,aAAa,IAAI,CAAC;AAC/G,eAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,MAAM;AAAA,MACvC;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,MAAM,KAAK,EAAE,OAAO,GAAG;AACrB,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,QAA+C;AAAA,UAC3E,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,MAAM,gCAAgC,mBAAmB,MAAM,CAAC;AAAA,QAClE,CAAC;AACD,eAAO,EAAE,MAAM,EAAE,aAAa,MAAM,eAAe,CAAC,EAAE,GAAG,MAAM;AAAA,MACjE;AAAA,MACA,MAAM,iBAAiB,cAAc;AACnC,eAAO,QAA6B;AAAA,UAClC,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,MAAM,GAAG,WAAW,YAAY,CAAC;AAAA,UACjC,MAAM,CAAC;AAAA,QACT,CAAC;AAAA,MACH;AAAA,MACA,MAAM,OAAO,cAAc;AACzB,cAAM,EAAE,MAAM,IAAI,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,UAAU,MAAM,WAAW,YAAY,EAAE,CAAC;AAC7F,eAAO,EAAE,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/server.d.cts

@@ -1,16 +1,24 @@
-import { U as User, f as AuthError, g as ServerClientOptions } from './constants-BQhswdms.cjs';
-export { D as DEEPKEY_API_URL } from './constants-BQhswdms.cjs';
+import { A as AuthResponse, U as User, P as ProviderConnection, g as ProviderAccessToken, a as AuthError, h as ServerClientOptions } from './constants-DgChFH24.cjs';
+export { D as DEEPKEY_API_URL } from './constants-DgChFH24.cjs';
 
 interface ServerAuthClient {
     auth: {
-        getUser(jwt: string): Promise<{
-            data: {
-                user: User | null;
-            };
+        getUser(jwt: string): Promise<AuthResponse<{
+            user: User | null;
+        }>>;
+    };
+    connections: {
+        list(params: {
+            userId: string;
+        }): Promise<AuthResponse<{
+            connections: ProviderConnection[];
+        }>>;
+        issueAccessToken(connectionId: string): Promise<AuthResponse<ProviderAccessToken | null>>;
+        revoke(connectionId: string): Promise<{
             error: AuthError | null;
         }>;
     };
 }
 declare const createServerClient: (secretKey: string, options?: ServerClientOptions) => ServerAuthClient;
 
-export { AuthError, type ServerAuthClient, ServerClientOptions, User, createServerClient };
+export { AuthError, AuthResponse, ProviderAccessToken, ProviderConnection, type ServerAuthClient, ServerClientOptions, User, createServerClient };

package/dist/server.d.ts

@@ -1,16 +1,24 @@
-import { U as User, f as AuthError, g as ServerClientOptions } from './constants-BQhswdms.js';
-export { D as DEEPKEY_API_URL } from './constants-BQhswdms.js';
+import { A as AuthResponse, U as User, P as ProviderConnection, g as ProviderAccessToken, a as AuthError, h as ServerClientOptions } from './constants-DgChFH24.js';
+export { D as DEEPKEY_API_URL } from './constants-DgChFH24.js';
 
 interface ServerAuthClient {
     auth: {
-        getUser(jwt: string): Promise<{
-            data: {
-                user: User | null;
-            };
+        getUser(jwt: string): Promise<AuthResponse<{
+            user: User | null;
+        }>>;
+    };
+    connections: {
+        list(params: {
+            userId: string;
+        }): Promise<AuthResponse<{
+            connections: ProviderConnection[];
+        }>>;
+        issueAccessToken(connectionId: string): Promise<AuthResponse<ProviderAccessToken | null>>;
+        revoke(connectionId: string): Promise<{
             error: AuthError | null;
         }>;
     };
 }
 declare const createServerClient: (secretKey: string, options?: ServerClientOptions) => ServerAuthClient;
 
-export { AuthError, type ServerAuthClient, ServerClientOptions, User, createServerClient };
+export { AuthError, AuthResponse, ProviderAccessToken, ProviderConnection, type ServerAuthClient, ServerClientOptions, User, createServerClient };

package/dist/server.js

@@ -1,42 +1,41 @@
 import {
   AuthError,
   DEEPKEY_API_URL,
+  request,
   resolveBaseUrl
-} from "./chunk-IFNRLMVX.js";
+} from "./chunk-A2CRUXTA.js";
 
 // src/server.ts
 var createServerClient = (secretKey, options = {}) => {
-  const baseUrl = resolveBaseUrl(options.__internalBaseUrl);
-  const fetchImpl = options.fetch ?? fetch;
+  const base = { apikey: secretKey, baseUrl: resolveBaseUrl(options.__internalBaseUrl), fetchImpl: options.fetch };
+  const connection = (id) => `/auth/v1/connections/${encodeURIComponent(id)}`;
   return {
     auth: {
       async getUser(jwt) {
-        try {
-          const response = await fetchImpl(`${baseUrl}/auth/v1/user`, {
-            headers: { Authorization: `Bearer ${jwt}`, apikey: secretKey }
-          });
-          let payload = null;
-          try {
-            payload = await response.json();
-          } catch {
-            payload = null;
-          }
-          if (!response.ok) {
-            const errorBody = payload?.error;
-            return {
-              data: { user: null },
-              error: new AuthError(
-                errorBody?.message ?? `Request failed with status ${response.status}`,
-                response.status,
-                errorBody?.code
-              )
-            };
-          }
-          return { data: { user: payload }, error: null };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : "Network request failed";
-          return { data: { user: null }, error: new AuthError(message, 0, "network_error") };
-        }
+        const { data, error } = await request({ ...base, method: "GET", path: "/auth/v1/user", accessToken: jwt });
+        return { data: { user: data }, error };
+      }
+    },
+    connections: {
+      async list({ userId }) {
+        const { data, error } = await request({
+          ...base,
+          method: "GET",
+          path: `/auth/v1/connections?user_id=${encodeURIComponent(userId)}`
+        });
+        return { data: { connections: data?.connections ?? [] }, error };
+      },
+      async issueAccessToken(connectionId) {
+        return request({
+          ...base,
+          method: "POST",
+          path: `${connection(connectionId)}/token`,
+          body: {}
+        });
+      },
+      async revoke(connectionId) {
+        const { error } = await request({ ...base, method: "DELETE", path: connection(connectionId) });
+        return { error };
       }
     }
   };

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import { resolveBaseUrl } from './constants'\nimport { AuthError, type ServerClientOptions, type User } from './types'\n\nexport interface ServerAuthClient {\n  auth: {\n    // Mirrors `supabase.auth.getUser(jwt)` server-side: validates the access token\n    // against the auth service and returns the user.\n    getUser(jwt: string): Promise<{ data: { user: User | null }; error: AuthError | null }>\n  }\n}\n\n// Runs anywhere with global fetch (Bun, Node >= 18). `secretKey` is the project's\n// bt_secret_... key. Requests target the hosted DeepKey API; the internal\n// override is reserved for DeepKey's console and tests.\nexport const createServerClient = (secretKey: string, options: ServerClientOptions = {}): ServerAuthClient => {\n  const baseUrl = resolveBaseUrl(options.__internalBaseUrl)\n  const fetchImpl = options.fetch ?? fetch\n\n  return {\n    auth: {\n      async getUser(jwt: string) {\n        try {\n          const response = await fetchImpl(`${baseUrl}/auth/v1/user`, {\n            headers: { Authorization: `Bearer ${jwt}`, apikey: secretKey },\n          })\n\n          let payload: unknown = null\n          try {\n            payload = await response.json()\n          } catch {\n            payload = null\n          }\n\n          if (!response.ok) {\n            const errorBody = (payload as { error?: { code?: string; message?: string } } | null)?.error\n            return {\n              data: { user: null },\n              error: new AuthError(\n                errorBody?.message ?? `Request failed with status ${response.status}`,\n                response.status,\n                errorBody?.code,\n              ),\n            }\n          }\n\n          return { data: { user: payload as User }, error: null }\n        } catch (err) {\n          const message = err instanceof Error ? err.message : 'Network request failed'\n          return { data: { user: null }, error: new AuthError(message, 0, 'network_error') }\n        }\n      },\n    },\n  }\n}\n\nexport { DEEPKEY_API_URL } from './constants'\nexport { AuthError, type ServerClientOptions, type User } from './types'\n"],"mappings":";;;;;;;AAcO,IAAM,qBAAqB,CAAC,WAAmB,UAA+B,CAAC,MAAwB;AAC5G,QAAM,UAAU,eAAe,QAAQ,iBAAiB;AACxD,QAAM,YAAY,QAAQ,SAAS;AAEnC,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,MAAM,QAAQ,KAAa;AACzB,YAAI;AACF,gBAAM,WAAW,MAAM,UAAU,GAAG,OAAO,iBAAiB;AAAA,YAC1D,SAAS,EAAE,eAAe,UAAU,GAAG,IAAI,QAAQ,UAAU;AAAA,UAC/D,CAAC;AAED,cAAI,UAAmB;AACvB,cAAI;AACF,sBAAU,MAAM,SAAS,KAAK;AAAA,UAChC,QAAQ;AACN,sBAAU;AAAA,UACZ;AAEA,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,YAAa,SAAoE;AACvF,mBAAO;AAAA,cACL,MAAM,EAAE,MAAM,KAAK;AAAA,cACnB,OAAO,IAAI;AAAA,gBACT,WAAW,WAAW,8BAA8B,SAAS,MAAM;AAAA,gBACnE,SAAS;AAAA,gBACT,WAAW;AAAA,cACb;AAAA,YACF;AAAA,UACF;AAEA,iBAAO,EAAE,MAAM,EAAE,MAAM,QAAgB,GAAG,OAAO,KAAK;AAAA,QACxD,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,iBAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,SAAS,GAAG,eAAe,EAAE;AAAA,QACnF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import { resolveBaseUrl } from './constants'\nimport { request } from './fetch'\nimport type {\n  AuthError,\n  AuthResponse,\n  ProviderAccessToken,\n  ProviderConnection,\n  ServerClientOptions,\n  User,\n} from './types'\n\nexport interface ServerAuthClient {\n  auth: {\n    // Mirrors `supabase.auth.getUser(jwt)` server-side: validates the access token\n    // against the auth service and returns the user.\n    getUser(jwt: string): Promise<AuthResponse<{ user: User | null }>>\n  }\n  // Provider connections a user granted through the browser SDK. The secret key acts\n  // for the whole project; provider access tokens are issued only here, never to browsers.\n  connections: {\n    list(params: { userId: string }): Promise<AuthResponse<{ connections: ProviderConnection[] }>>\n    issueAccessToken(connectionId: string): Promise<AuthResponse<ProviderAccessToken | null>>\n    revoke(connectionId: string): Promise<{ error: AuthError | null }>\n  }\n}\n\n// Runs anywhere with global fetch (Bun, Node >= 18). `secretKey` is the project's\n// bt_secret_... key. Requests target the hosted DeepKey API; the internal\n// override is reserved for DeepKey's console and tests.\nexport const createServerClient = (secretKey: string, options: ServerClientOptions = {}): ServerAuthClient => {\n  const base = { apikey: secretKey, baseUrl: resolveBaseUrl(options.__internalBaseUrl), fetchImpl: options.fetch }\n  const connection = (id: string) => `/auth/v1/connections/${encodeURIComponent(id)}`\n\n  return {\n    auth: {\n      async getUser(jwt: string) {\n        const { data, error } = await request<User>({ ...base, method: 'GET', path: '/auth/v1/user', accessToken: jwt })\n        return { data: { user: data }, error }\n      },\n    },\n    connections: {\n      async list({ userId }) {\n        const { data, error } = await request<{ connections: ProviderConnection[] }>({\n          ...base,\n          method: 'GET',\n          path: `/auth/v1/connections?user_id=${encodeURIComponent(userId)}`,\n        })\n        return { data: { connections: data?.connections ?? [] }, error }\n      },\n      async issueAccessToken(connectionId) {\n        return request<ProviderAccessToken>({\n          ...base,\n          method: 'POST',\n          path: `${connection(connectionId)}/token`,\n          body: {},\n        })\n      },\n      async revoke(connectionId) {\n        const { error } = await request({ ...base, method: 'DELETE', path: connection(connectionId) })\n        return { error }\n      },\n    },\n  }\n}\n\nexport { DEEPKEY_API_URL } from './constants'\nexport {\n  AuthError,\n  type AuthResponse,\n  type ProviderAccessToken,\n  type ProviderConnection,\n  type ServerClientOptions,\n  type User,\n} from './types'\n"],"mappings":";;;;;;;;AA6BO,IAAM,qBAAqB,CAAC,WAAmB,UAA+B,CAAC,MAAwB;AAC5G,QAAM,OAAO,EAAE,QAAQ,WAAW,SAAS,eAAe,QAAQ,iBAAiB,GAAG,WAAW,QAAQ,MAAM;AAC/G,QAAM,aAAa,CAAC,OAAe,wBAAwB,mBAAmB,EAAE,CAAC;AAEjF,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,MAAM,QAAQ,KAAa;AACzB,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,QAAc,EAAE,GAAG,MAAM,QAAQ,OAAO,MAAM,iBAAiB,aAAa,IAAI,CAAC;AAC/G,eAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,MAAM;AAAA,MACvC;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,MAAM,KAAK,EAAE,OAAO,GAAG;AACrB,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,QAA+C;AAAA,UAC3E,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,MAAM,gCAAgC,mBAAmB,MAAM,CAAC;AAAA,QAClE,CAAC;AACD,eAAO,EAAE,MAAM,EAAE,aAAa,MAAM,eAAe,CAAC,EAAE,GAAG,MAAM;AAAA,MACjE;AAAA,MACA,MAAM,iBAAiB,cAAc;AACnC,eAAO,QAA6B;AAAA,UAClC,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,MAAM,GAAG,WAAW,YAAY,CAAC;AAAA,UACjC,MAAM,CAAC;AAAA,QACT,CAAC;AAAA,MACH;AAAA,MACA,MAAM,OAAO,cAAc;AACzB,cAAM,EAAE,MAAM,IAAI,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,UAAU,MAAM,WAAW,YAAY,EAAE,CAAC;AAC7F,eAAO,EAAE,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepkey/sdk",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "DeepKey authentication SDK for the browser and server — a supabase-js compatible auth surface",
   "homepage": "https://deepkey.dev/sdk",
   "keywords": [

package/dist/chunk-IFNRLMVX.js

@@ -1,23 +0,0 @@
-// src/constants.ts
-var DEEPKEY_API_URL = "https://deepkey.dev/api";
-var resolveBaseUrl = (url) => {
-  const candidate = typeof url === "string" ? url.trim() : "";
-  return (candidate || DEEPKEY_API_URL).replace(/\/+$/, "");
-};
-
-// src/types.ts
-var AuthError = class extends Error {
-  constructor(message, status, code) {
-    super(message);
-    this.name = "AuthError";
-    this.status = status;
-    this.code = code;
-  }
-};
-
-export {
-  DEEPKEY_API_URL,
-  resolveBaseUrl,
-  AuthError
-};
-//# sourceMappingURL=chunk-IFNRLMVX.js.map

package/dist/chunk-IFNRLMVX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/constants.ts","../src/types.ts"],"sourcesContent":["// The hosted DeepKey API. Every client talks to this origin; only DeepKey's own\n// console and test suites replace it through the internal override.\nexport const DEEPKEY_API_URL = 'https://deepkey.dev/api'\n\n// Resolves the base URL used for every request. An absent or blank internal\n// override keeps the hosted API; a provided value has any trailing slash removed\n// so path joins stay predictable.\nexport const resolveBaseUrl = (url?: string | null): string => {\n  const candidate = typeof url === 'string' ? url.trim() : ''\n  return (candidate || DEEPKEY_API_URL).replace(/\\/+$/, '')\n}\n","export interface UserIdentity {\n  identity_id: string\n  id: string\n  user_id: string\n  provider: string\n  identity_data: Record<string, unknown>\n  last_sign_in_at: string | null\n  created_at: string\n  updated_at: string\n}\n\nexport interface User {\n  id: string\n  aud: string\n  role: string\n  email: string | null\n  email_confirmed_at: string | null\n  app_metadata: { provider?: string | null; providers?: string[]; [key: string]: unknown }\n  user_metadata: {\n    name?: string\n    full_name?: string\n    avatar_url?: string\n    picture?: string\n    email?: string\n    [key: string]: unknown\n  }\n  identities?: UserIdentity[]\n  created_at: string\n  updated_at?: string\n  last_sign_in_at?: string | null\n}\n\nexport interface Session {\n  access_token: string\n  refresh_token: string\n  token_type: 'bearer'\n  expires_in: number\n  expires_at: number\n  user: User\n}\n\nexport class AuthError extends Error {\n  status?: number\n  code?: string\n\n  constructor(message: string, status?: number, code?: string) {\n    super(message)\n    this.name = 'AuthError'\n    this.status = status\n    this.code = code\n  }\n}\n\nexport type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED'\n\nexport interface Subscription {\n  id: string\n  unsubscribe: () => void\n}\n\nexport interface StorageAdapter {\n  getItem(key: string): string | null\n  setItem(key: string, value: string): void\n  removeItem(key: string): void\n}\n\nexport interface AuthClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  storageKey?: string\n  autoRefreshToken?: boolean\n  detectSessionInUrl?: boolean\n  persistSession?: boolean\n  storage?: StorageAdapter\n  fetch?: typeof fetch\n}\n\nexport interface ServerClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  fetch?: typeof fetch\n}\n\nexport interface SignInWithOtpCredentials {\n  email: string\n  options?: {\n    emailRedirectTo?: string\n    shouldCreateUser?: boolean\n    data?: Record<string, unknown>\n  }\n}\n\nexport interface VerifyOtpParams {\n  email: string\n  token: string\n  type: 'email' | 'magiclink'\n}\n\nexport interface SignInWithOAuthCredentials {\n  provider: string\n  options?: {\n    redirectTo?: string\n    scopes?: string\n    queryParams?: Record<string, string>\n    skipBrowserRedirect?: boolean\n  }\n}\n\nexport interface AuthResponse<T> {\n  data: T\n  error: AuthError | null\n}\n"],"mappings":";AAEO,IAAM,kBAAkB;AAKxB,IAAM,iBAAiB,CAAC,QAAgC;AAC7D,QAAM,YAAY,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;AACzD,UAAQ,aAAa,iBAAiB,QAAQ,QAAQ,EAAE;AAC1D;;;AC+BO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAInC,YAAY,SAAiB,QAAiB,MAAe;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;","names":[]}