@deepkey/sdk 1.0.0

package/README.md

@@ -0,0 +1,294 @@
+# @deepkey/sdk
+
+Authentication SDK for **DeepKey** — passwordless and social sign-in with a **supabase-js compatible surface**. If you have code written against `supabase.auth.*`, the call sites, response envelopes, and auth events port 1:1.
+
+The full reference lives at [deepkey.dev/sdk](https://deepkey.dev/sdk).
+
+Two entry points:
+
+| Import | Runs in | Key used | Purpose |
+|---|---|---|---|
+| `@deepkey/sdk` | Browser (SPA) | Publishable key (`bt_pub_…`) | Sign-in flows, session management, auto-refresh |
+| `@deepkey/sdk/server` | Server (Node ≥ 18, Bun, edge) | Secret key (`bt_secret_…`) | Validate access tokens, fetch the user |
+
+```bash
+npm install @deepkey/sdk
+```
+
+## Core concepts
+
+- **Hosted API** — every request goes to `https://deepkey.dev/api/auth/v1/*`. The URL is built in; you only pass a key.
+- **Project** — each consuming app is a project on DeepKey. The project is resolved from the API key sent with every request (`apikey` header).
+- **Publishable key** (`bt_pub_<project-slug>_<random>`) — safe to ship in browser bundles. Identifies the project; grants no privileged access.
+- **Secret key** (`bt_secret_…`) — server-side only. Never expose it in client code.
+- **Session** — `{ access_token, refresh_token, token_type: 'bearer', expires_in, expires_at, user }`. The access token is an ES256 JWT (short-lived); the refresh token is opaque and **rotates on every refresh**.
+- **Sign-in flows** — passwordless only: email OTP (6-digit code), magic link, and OAuth (Google, X). There is **no password sign-in**. Magic link and OAuth complete via the *implicit flow*: DeepKey redirects back to your app with tokens in the URL fragment (`#access_token=…`), which the client picks up automatically.
+- **Redirect allow-list** — every `redirectTo` / `emailRedirectTo` URL must be allow-listed in the project's settings on the DeepKey console (wildcards supported: `*` doesn't cross `/` or `.`, `**` crosses everything). ⚠️ A redirect that is *not* on the list is **not an error** — the service silently falls back to the project's Site URL (same semantics as Supabase). If your login "works but lands on the wrong page", this is why.
+
+## Response envelope (never throws)
+
+Every method resolves to `{ data, error }` — network and API failures are returned, not thrown:
+
+```ts
+const { data, error } = await deepkey.auth.getUser()
+if (error) {
+  // error is an AuthError: { message: string, status?: number, code?: string }
+  // error.code === 'network_error' → request never reached the service (status 0)
+}
+```
+
+Error messages use Supabase's English phrasing (e.g. `Token has expired or is invalid`, `Signups not allowed`), so regex-based error translation written for Supabase keeps working.
+
+## Browser client
+
+### Setup
+
+```ts
+import { createAuthClient } from '@deepkey/sdk'
+
+export const deepkey = createAuthClient(import.meta.env.VITE_DEEPKEY_PUB_KEY) // bt_pub_...
+// deepkey.auth is the supabase-js-shaped auth interface
+```
+
+Create **one client per app** (module singleton). On construction the client:
+
+1. Checks the URL fragment for implicit-flow tokens (`#access_token=…`) — if present, strips them from the address bar, validates them against the service, saves the session, and emits `SIGNED_IN`.
+2. Otherwise restores the persisted session from `localStorage` (refreshing it first if expired).
+3. Starts a background refresh timer (checks every 30s, refreshes when the access token is within 90s of expiry).
+
+An empty key does **not** throw at construction — failures surface on the first call.
+
+The constant `DEEPKEY_API_URL` exports the hosted origin for building your own URLs (for example the JWKS endpoint).
+
+### Options (all optional)
+
+```ts
+createAuthClient(publishableKey, {
+  persistSession: true,       // persist to storage (default true)
+  autoRefreshToken: true,     // background refresh + refresh-on-demand (default true)
+  detectSessionInUrl: true,   // pick up #access_token fragments (default true)
+  storageKey: 'custom-key',   // default: 'bt-<project-slug>-auth-token' (derived from the publishable key)
+  storage: customAdapter,     // { getItem, setItem, removeItem } — default: localStorage, in-memory fallback
+  fetch: customFetch,         // custom fetch implementation
+})
+```
+
+### Email OTP / magic link
+
+```ts
+// 1. Send the email (contains BOTH a 6-digit code and a magic link)
+const { error } = await deepkey.auth.signInWithOtp({
+  email: 'user@example.com',
+  options: {
+    emailRedirectTo: window.location.origin, // where the magic link lands (must be allow-listed)
+    shouldCreateUser: true,                  // set false to reject emails without an account
+  },
+})
+
+// 2a. User types the 6-digit code → verify it
+const { data, error } = await deepkey.auth.verifyOtp({
+  email: 'user@example.com',
+  token: '123456',
+  type: 'email',
+})
+// data.session / data.user are set on success; SIGNED_IN is emitted
+
+// 2b. OR the user clicks the magic link → redirected to emailRedirectTo with
+// #access_token=… in the URL; the client handles it automatically on load
+// (detectSessionInUrl) and emits SIGNED_IN. No code needed.
+```
+
+### OAuth (Google, X)
+
+```ts
+await deepkey.auth.signInWithOAuth({
+  provider: 'google', // or 'x'
+  options: {
+    redirectTo: window.location.origin,  // must be allow-listed
+    // scopes: 'extra scopes',
+    // queryParams: { prompt: 'select_account' },
+    // skipBrowserRedirect: true,        // don't navigate; just return data.url
+  },
+})
+// Performs a full-page redirect to the provider. After consent DeepKey
+// redirects back to redirectTo with #access_token=… — handled automatically
+// on load, SIGNED_IN is emitted.
+```
+
+### Auth state (drive your UI from this)
+
+```ts
+const { data: { subscription } } = deepkey.auth.onAuthStateChange((event, session) => {
+  // event: 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED'
+  // session: Session | null
+})
+subscription.unsubscribe()
+```
+
+- Every subscriber receives **`INITIAL_SESSION`** (asynchronously) once initialization settles — use it to resolve your app's loading state. `session` is `null` if the user is signed out.
+- `TOKEN_REFRESHED` fires on background refreshes and cross-tab session updates.
+- `SIGNED_OUT` fires on `signOut()`, when the refresh token is rejected, and when another tab signs out.
+- Sessions sync across tabs automatically (via `storage` events).
+
+### Session access
+
+```ts
+// Current session (refreshes first if expired) — local, fast, use for tokens:
+const { data: { session } } = await deepkey.auth.getSession()
+const accessToken = session?.access_token   // send as Authorization: Bearer <token> to YOUR api
+
+// Authoritative user check (validates against DeepKey):
+const { data: { user }, error } = await deepkey.auth.getUser()
+
+// Manual refresh (rarely needed — auto-refresh covers normal usage):
+await deepkey.auth.refreshSession()
+
+// Sign out (revokes server-side, clears storage, emits SIGNED_OUT):
+await deepkey.auth.signOut()
+```
+
+`getSession()` returns `{ session: null }` (with `error: null`) when signed out or when the stored session could not be refreshed. On *network* failures it keeps and returns the existing session so a flaky connection doesn't log the user out.
+
+### React integration pattern
+
+```tsx
+function AuthProvider({ children }: { children: React.ReactNode }) {
+  const [session, setSession] = useState<Session | null>(null)
+  const [loading, setLoading] = useState(true)
+
+  useEffect(() => {
+    const { data: { subscription } } = deepkey.auth.onAuthStateChange((_event, session) => {
+      setSession(session)
+      setLoading(false) // INITIAL_SESSION always arrives, even when signed out
+    })
+    return () => subscription.unsubscribe()
+  }, [])
+
+  if (loading) return <Spinner />
+  return <AuthContext.Provider value={{ session }}>{children}</AuthContext.Provider>
+}
+```
+
+### Calling your own backend
+
+DeepKey authenticates users; **your** API authorizes them. Attach the access token to your requests:
+
+```ts
+const { data: { session } } = await deepkey.auth.getSession()
+await fetch('/api/things', {
+  headers: { Authorization: `Bearer ${session?.access_token}` },
+})
+```
+
+## Server client (validating tokens in your backend)
+
+```ts
+import { createServerClient } from '@deepkey/sdk/server'
+
+const deepkey = createServerClient(process.env.DEEPKEY_SECRET_KEY) // bt_secret_...
+
+// In your request handler:
+const jwt = request.headers.get('authorization')?.replace(/^Bearer /, '')
+const { data: { user }, error } = await deepkey.auth.getUser(jwt)
+if (error || !user) return new Response('Unauthorized', { status: 401 })
+// user.id is the stable user UUID — key your own tables on it
+```
+
+Alternative — **local JWT verification without a network round-trip**: access tokens are ES256 JWTs; public keys are served at `https://deepkey.dev/api/auth/v1/.well-known/jwks.json`. Verify with `jose`:
+
+```ts
+import { DEEPKEY_API_URL } from '@deepkey/sdk/server'
+import { createRemoteJWKSet, jwtVerify } from 'jose'
+
+const jwks = createRemoteJWKSet(new URL(`${DEEPKEY_API_URL}/auth/v1/.well-known/jwks.json`))
+const { payload } = await jwtVerify(jwt, jwks) // payload.sub = user id
+```
+
+Use `getUser()` when you need revocation-awareness (a signed-out session fails immediately); use JWKS verification when latency matters (tokens remain valid until expiry).
+
+## Types (full public surface)
+
+```ts
+// '@deepkey/sdk'
+const DEEPKEY_API_URL: 'https://deepkey.dev/api'
+function createAuthClient(publishableKey: string, options?: AuthClientOptions): { auth: Auth }
+
+class Auth {
+  signInWithOtp(credentials: SignInWithOtpCredentials): Promise<AuthResponse<{ user: null; session: null }>>
+  verifyOtp(params: VerifyOtpParams): Promise<AuthResponse<{ user: User | null; session: Session | null }>>
+  signInWithOAuth(credentials: SignInWithOAuthCredentials): Promise<AuthResponse<{ provider: string; url: string }>>
+  onAuthStateChange(cb: (event: AuthChangeEvent, session: Session | null) => void): { data: { subscription: Subscription } }
+  getSession(): Promise<AuthResponse<{ session: Session | null }>>
+  getUser(jwt?: string): Promise<AuthResponse<{ user: User | null }>>
+  refreshSession(currentSession?: { refresh_token: string }): Promise<AuthResponse<{ session: Session | null; user: User | null }>>
+  signOut(): Promise<{ error: AuthError | null }>
+}
+
+interface AuthClientOptions {
+  persistSession?: boolean
+  autoRefreshToken?: boolean
+  detectSessionInUrl?: boolean
+  storageKey?: string
+  storage?: StorageAdapter
+  fetch?: typeof fetch
+}
+
+type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED'
+interface AuthResponse<T> { data: T; error: AuthError | null }
+class AuthError extends Error { status?: number; code?: string }
+
+interface Session {
+  access_token: string      // ES256 JWT
+  refresh_token: string     // opaque, single-use (rotates on refresh)
+  token_type: 'bearer'
+  expires_in: number        // seconds
+  expires_at: number        // unix epoch seconds
+  user: User
+}
+
+interface User {
+  id: string                // stable UUID — use as the foreign key in your app
+  aud: string
+  role: string
+  email: string | null
+  email_confirmed_at: string | null
+  app_metadata: { provider?: string | null; providers?: string[] }
+  user_metadata: { name?: string; full_name?: string; avatar_url?: string; picture?: string; email?: string }
+  identities?: UserIdentity[]   // one per linked provider (google, x, email, …)
+  created_at: string
+}
+
+// '@deepkey/sdk/server'
+const DEEPKEY_API_URL: 'https://deepkey.dev/api'
+function createServerClient(secretKey: string, options?: ServerClientOptions): {
+  auth: { getUser(jwt: string): Promise<{ data: { user: User | null }; error: AuthError | null }> }
+}
+interface ServerClientOptions { fetch?: typeof fetch }
+```
+
+## HTTP endpoints used (for debugging)
+
+All calls send the API key as the `apikey` header against `https://deepkey.dev/api/auth/v1`:
+
+| Method call | HTTP request |
+|---|---|
+| `signInWithOtp` | `POST /otp` |
+| `verifyOtp` | `POST /verify` |
+| `signInWithOAuth` | navigate to `GET /authorize?provider=…&apikey=…` |
+| (magic link click) | `GET /verify?token=…` → 302 to your app with `#access_token=…` |
+| token refresh | `POST /token?grant_type=refresh_token` |
+| `getUser` | `GET /user` (with `Authorization: Bearer`) |
+| `signOut` | `POST /logout` |
+
+## Gotchas & troubleshooting
+
+- **Login redirects to the wrong URL** → your `redirectTo`/`emailRedirectTo` is not on the project's redirect allow-list; the service silently fell back to the Site URL. Add the URL (with wildcards if needed) in the console.
+- **Session not restored after redirect** → the tokens arrive in the URL *fragment* (`#access_token=…`). Make sure the client is constructed on the page the user lands on, before anything rewrites `location`, and that `detectSessionInUrl` isn't disabled. The fragment is stripped from the address bar immediately after being read.
+- **Using the secret key in the browser (or the publishable key on the server)** → key types are not interchangeable: `bt_pub_…` for the browser client, `bt_secret_…` for `createServerClient`.
+- **`getUser()` returns `Auth session missing!`** (`code: 'session_missing'`) → no active session and no `jwt` argument was passed.
+- **SSR** → the default storage falls back to in-memory when `localStorage` is unavailable, so importing the client on the server is safe, but sessions only persist in the browser. Do sign-in flows client-side; validate tokens server-side with `@deepkey/sdk/server`.
+- **Multiple tabs** → handled: sessions sync via storage events, and refresh-token rotation has a grace window on the service to absorb concurrent refreshes.
+
+## Compatibility with supabase-js
+
+Supported and drop-in: `signInWithOtp`, `verifyOtp`, `signInWithOAuth`, `onAuthStateChange`, `getSession`, `getUser`, `refreshSession`, `signOut`, the `{ data, error }` envelopes, the event lifecycle, localStorage persistence, and implicit-flow fragment handling. Not implemented: password auth, phone auth, `updateUser`, admin APIs, and PKCE on the client (the service supports PKCE; the SDK uses the implicit flow).

package/dist/chunk-IFNRLMVX.js

@@ -0,0 +1,23 @@
+// src/constants.ts
+var DEEPKEY_API_URL = "https://deepkey.dev/api";
+var resolveBaseUrl = (url) => {
+  const candidate = typeof url === "string" ? url.trim() : "";
+  return (candidate || DEEPKEY_API_URL).replace(/\/+$/, "");
+};
+
+// src/types.ts
+var AuthError = class extends Error {
+  constructor(message, status, code) {
+    super(message);
+    this.name = "AuthError";
+    this.status = status;
+    this.code = code;
+  }
+};
+
+export {
+  DEEPKEY_API_URL,
+  resolveBaseUrl,
+  AuthError
+};
+//# sourceMappingURL=chunk-IFNRLMVX.js.map

package/dist/chunk-IFNRLMVX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/constants.ts","../src/types.ts"],"sourcesContent":["// The hosted DeepKey API. Every client talks to this origin; only DeepKey's own\n// console and test suites replace it through the internal override.\nexport const DEEPKEY_API_URL = 'https://deepkey.dev/api'\n\n// Resolves the base URL used for every request. An absent or blank internal\n// override keeps the hosted API; a provided value has any trailing slash removed\n// so path joins stay predictable.\nexport const resolveBaseUrl = (url?: string | null): string => {\n  const candidate = typeof url === 'string' ? url.trim() : ''\n  return (candidate || DEEPKEY_API_URL).replace(/\\/+$/, '')\n}\n","export interface UserIdentity {\n  identity_id: string\n  id: string\n  user_id: string\n  provider: string\n  identity_data: Record<string, unknown>\n  last_sign_in_at: string | null\n  created_at: string\n  updated_at: string\n}\n\nexport interface User {\n  id: string\n  aud: string\n  role: string\n  email: string | null\n  email_confirmed_at: string | null\n  app_metadata: { provider?: string | null; providers?: string[]; [key: string]: unknown }\n  user_metadata: {\n    name?: string\n    full_name?: string\n    avatar_url?: string\n    picture?: string\n    email?: string\n    [key: string]: unknown\n  }\n  identities?: UserIdentity[]\n  created_at: string\n  updated_at?: string\n  last_sign_in_at?: string | null\n}\n\nexport interface Session {\n  access_token: string\n  refresh_token: string\n  token_type: 'bearer'\n  expires_in: number\n  expires_at: number\n  user: User\n}\n\nexport class AuthError extends Error {\n  status?: number\n  code?: string\n\n  constructor(message: string, status?: number, code?: string) {\n    super(message)\n    this.name = 'AuthError'\n    this.status = status\n    this.code = code\n  }\n}\n\nexport type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED'\n\nexport interface Subscription {\n  id: string\n  unsubscribe: () => void\n}\n\nexport interface StorageAdapter {\n  getItem(key: string): string | null\n  setItem(key: string, value: string): void\n  removeItem(key: string): void\n}\n\nexport interface AuthClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  storageKey?: string\n  autoRefreshToken?: boolean\n  detectSessionInUrl?: boolean\n  persistSession?: boolean\n  storage?: StorageAdapter\n  fetch?: typeof fetch\n}\n\nexport interface ServerClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  fetch?: typeof fetch\n}\n\nexport interface SignInWithOtpCredentials {\n  email: string\n  options?: {\n    emailRedirectTo?: string\n    shouldCreateUser?: boolean\n    data?: Record<string, unknown>\n  }\n}\n\nexport interface VerifyOtpParams {\n  email: string\n  token: string\n  type: 'email' | 'magiclink'\n}\n\nexport interface SignInWithOAuthCredentials {\n  provider: string\n  options?: {\n    redirectTo?: string\n    scopes?: string\n    queryParams?: Record<string, string>\n    skipBrowserRedirect?: boolean\n  }\n}\n\nexport interface AuthResponse<T> {\n  data: T\n  error: AuthError | null\n}\n"],"mappings":";AAEO,IAAM,kBAAkB;AAKxB,IAAM,iBAAiB,CAAC,QAAgC;AAC7D,QAAM,YAAY,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;AACzD,UAAQ,aAAa,iBAAiB,QAAQ,QAAQ,EAAE;AAC1D;;;AC+BO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAInC,YAAY,SAAiB,QAAiB,MAAe;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;","names":[]}

package/dist/constants-BQhswdms.d.cts

@@ -0,0 +1,98 @@
+interface UserIdentity {
+    identity_id: string;
+    id: string;
+    user_id: string;
+    provider: string;
+    identity_data: Record<string, unknown>;
+    last_sign_in_at: string | null;
+    created_at: string;
+    updated_at: string;
+}
+interface User {
+    id: string;
+    aud: string;
+    role: string;
+    email: string | null;
+    email_confirmed_at: string | null;
+    app_metadata: {
+        provider?: string | null;
+        providers?: string[];
+        [key: string]: unknown;
+    };
+    user_metadata: {
+        name?: string;
+        full_name?: string;
+        avatar_url?: string;
+        picture?: string;
+        email?: string;
+        [key: string]: unknown;
+    };
+    identities?: UserIdentity[];
+    created_at: string;
+    updated_at?: string;
+    last_sign_in_at?: string | null;
+}
+interface Session {
+    access_token: string;
+    refresh_token: string;
+    token_type: 'bearer';
+    expires_in: number;
+    expires_at: number;
+    user: User;
+}
+declare class AuthError extends Error {
+    status?: number;
+    code?: string;
+    constructor(message: string, status?: number, code?: string);
+}
+type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED';
+interface Subscription {
+    id: string;
+    unsubscribe: () => void;
+}
+interface StorageAdapter {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+interface AuthClientOptions {
+    storageKey?: string;
+    autoRefreshToken?: boolean;
+    detectSessionInUrl?: boolean;
+    persistSession?: boolean;
+    storage?: StorageAdapter;
+    fetch?: typeof fetch;
+}
+interface ServerClientOptions {
+    fetch?: typeof fetch;
+}
+interface SignInWithOtpCredentials {
+    email: string;
+    options?: {
+        emailRedirectTo?: string;
+        shouldCreateUser?: boolean;
+        data?: Record<string, unknown>;
+    };
+}
+interface VerifyOtpParams {
+    email: string;
+    token: string;
+    type: 'email' | 'magiclink';
+}
+interface SignInWithOAuthCredentials {
+    provider: string;
+    options?: {
+        redirectTo?: string;
+        scopes?: string;
+        queryParams?: Record<string, string>;
+        skipBrowserRedirect?: boolean;
+    };
+}
+interface AuthResponse<T> {
+    data: T;
+    error: AuthError | null;
+}
+
+declare const DEEPKEY_API_URL = "https://deepkey.dev/api";
+
+export { type AuthClientOptions as A, DEEPKEY_API_URL as D, type SignInWithOtpCredentials as S, type User as U, type VerifyOtpParams as V, type AuthResponse as a, type Session as b, type SignInWithOAuthCredentials as c, type AuthChangeEvent as d, type Subscription as e, AuthError as f, type ServerClientOptions as g, type StorageAdapter as h, type UserIdentity as i };

package/dist/constants-BQhswdms.d.ts

@@ -0,0 +1,98 @@
+interface UserIdentity {
+    identity_id: string;
+    id: string;
+    user_id: string;
+    provider: string;
+    identity_data: Record<string, unknown>;
+    last_sign_in_at: string | null;
+    created_at: string;
+    updated_at: string;
+}
+interface User {
+    id: string;
+    aud: string;
+    role: string;
+    email: string | null;
+    email_confirmed_at: string | null;
+    app_metadata: {
+        provider?: string | null;
+        providers?: string[];
+        [key: string]: unknown;
+    };
+    user_metadata: {
+        name?: string;
+        full_name?: string;
+        avatar_url?: string;
+        picture?: string;
+        email?: string;
+        [key: string]: unknown;
+    };
+    identities?: UserIdentity[];
+    created_at: string;
+    updated_at?: string;
+    last_sign_in_at?: string | null;
+}
+interface Session {
+    access_token: string;
+    refresh_token: string;
+    token_type: 'bearer';
+    expires_in: number;
+    expires_at: number;
+    user: User;
+}
+declare class AuthError extends Error {
+    status?: number;
+    code?: string;
+    constructor(message: string, status?: number, code?: string);
+}
+type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED';
+interface Subscription {
+    id: string;
+    unsubscribe: () => void;
+}
+interface StorageAdapter {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+interface AuthClientOptions {
+    storageKey?: string;
+    autoRefreshToken?: boolean;
+    detectSessionInUrl?: boolean;
+    persistSession?: boolean;
+    storage?: StorageAdapter;
+    fetch?: typeof fetch;
+}
+interface ServerClientOptions {
+    fetch?: typeof fetch;
+}
+interface SignInWithOtpCredentials {
+    email: string;
+    options?: {
+        emailRedirectTo?: string;
+        shouldCreateUser?: boolean;
+        data?: Record<string, unknown>;
+    };
+}
+interface VerifyOtpParams {
+    email: string;
+    token: string;
+    type: 'email' | 'magiclink';
+}
+interface SignInWithOAuthCredentials {
+    provider: string;
+    options?: {
+        redirectTo?: string;
+        scopes?: string;
+        queryParams?: Record<string, string>;
+        skipBrowserRedirect?: boolean;
+    };
+}
+interface AuthResponse<T> {
+    data: T;
+    error: AuthError | null;
+}
+
+declare const DEEPKEY_API_URL = "https://deepkey.dev/api";
+
+export { type AuthClientOptions as A, DEEPKEY_API_URL as D, type SignInWithOtpCredentials as S, type User as U, type VerifyOtpParams as V, type AuthResponse as a, type Session as b, type SignInWithOAuthCredentials as c, type AuthChangeEvent as d, type Subscription as e, AuthError as f, type ServerClientOptions as g, type StorageAdapter as h, type UserIdentity as i };