@deepkey/sdk 1.0.0

package/dist/index.js

@@ -0,0 +1,396 @@
+import {
+  AuthError,
+  DEEPKEY_API_URL,
+  resolveBaseUrl
+} from "./chunk-IFNRLMVX.js";
+
+// src/fetch.ts
+var request = async (options) => {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  try {
+    const headers = { apikey: options.apikey };
+    if (options.body !== void 0) headers["Content-Type"] = "application/json";
+    if (options.accessToken) headers.Authorization = `Bearer ${options.accessToken}`;
+    const response = await fetchImpl(`${options.baseUrl}${options.path}`, {
+      method: options.method,
+      headers,
+      body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+    });
+    if (response.status === 204) return { data: {}, error: null };
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      payload = null;
+    }
+    if (!response.ok) {
+      const errorBody = payload?.error;
+      return {
+        data: null,
+        error: new AuthError(
+          errorBody?.message ?? `Request failed with status ${response.status}`,
+          response.status,
+          errorBody?.code
+        )
+      };
+    }
+    return { data: payload, error: null };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Network request failed";
+    return { data: null, error: new AuthError(message, 0, "network_error") };
+  }
+};
+
+// src/storage.ts
+var MemoryStorage = class {
+  constructor() {
+    this.store = /* @__PURE__ */ new Map();
+  }
+  getItem(key) {
+    return this.store.get(key) ?? null;
+  }
+  setItem(key, value) {
+    this.store.set(key, value);
+  }
+  removeItem(key) {
+    this.store.delete(key);
+  }
+};
+var defaultStorage = () => {
+  try {
+    if (typeof window !== "undefined" && window.localStorage) {
+      const probe = "__bt_auth_probe__";
+      window.localStorage.setItem(probe, "1");
+      window.localStorage.removeItem(probe);
+      return window.localStorage;
+    }
+  } catch {
+  }
+  return new MemoryStorage();
+};
+var deriveStorageKey = (publishableKey) => {
+  const match = publishableKey?.match(/^bt_pub_([a-z0-9-]+)_[A-Za-z0-9_-]+$/);
+  return match ? `bt-${match[1]}-auth-token` : "bt-auth-token";
+};
+
+// src/url.ts
+var parseFragment = (hash) => {
+  if (!hash || hash.length < 2) return null;
+  const params = new URLSearchParams(hash.startsWith("#") ? hash.slice(1) : hash);
+  const error = params.get("error");
+  if (error) {
+    return {
+      authError: {
+        error,
+        error_code: params.get("error_code") ?? void 0,
+        error_description: params.get("error_description") ?? void 0
+      }
+    };
+  }
+  const accessToken = params.get("access_token");
+  const refreshToken = params.get("refresh_token");
+  if (!accessToken || !refreshToken) return null;
+  const expiresIn = Number(params.get("expires_in") ?? 3600);
+  const expiresAt = Number(params.get("expires_at") ?? Math.floor(Date.now() / 1e3) + expiresIn);
+  return {
+    tokens: {
+      access_token: accessToken,
+      refresh_token: refreshToken,
+      expires_in: expiresIn,
+      expires_at: expiresAt,
+      token_type: "bearer",
+      type: params.get("type") ?? void 0
+    }
+  };
+};
+var cleanFragmentFromUrl = () => {
+  if (typeof window === "undefined" || typeof history === "undefined") return;
+  history.replaceState(null, "", window.location.pathname + window.location.search);
+};
+
+// src/client.ts
+var REFRESH_TICK_MS = 3e4;
+var EXPIRY_MARGIN_SECONDS = 90;
+var Auth = class {
+  constructor(publishableKey, options = {}) {
+    this.session = null;
+    this.listeners = /* @__PURE__ */ new Map();
+    this.listenerSeq = 0;
+    this.initializePromise = null;
+    this.refreshPromise = null;
+    this.refreshTimer = null;
+    this.baseUrl = resolveBaseUrl(options.__internalBaseUrl);
+    this.apikey = publishableKey ?? "";
+    this.persistSession = options.persistSession ?? true;
+    this.autoRefreshToken = options.autoRefreshToken ?? true;
+    this.detectSessionInUrl = options.detectSessionInUrl ?? true;
+    this.storage = options.storage ?? defaultStorage();
+    this.storageKey = options.storageKey ?? deriveStorageKey(publishableKey);
+    this.fetchImpl = options.fetch;
+    this.setupCrossTabSync();
+  }
+  // ---- public API (supabase-js compatible) ----
+  async signInWithOtp(credentials) {
+    const { error } = await this.request("POST", "/auth/v1/otp", {
+      email: credentials.email,
+      create_user: credentials.options?.shouldCreateUser,
+      redirect_to: credentials.options?.emailRedirectTo
+    });
+    return { data: { user: null, session: null }, error };
+  }
+  async verifyOtp(params) {
+    const { data, error } = await this.request("POST", "/auth/v1/verify", {
+      type: "email",
+      email: params.email,
+      token: params.token
+    });
+    if (error || !data) return { data: { user: null, session: null }, error };
+    await this.saveSession(data);
+    this.emit("SIGNED_IN", data);
+    return { data: { user: data.user, session: data }, error: null };
+  }
+  async signInWithOAuth(credentials) {
+    const url = new URL(`${this.baseUrl}/auth/v1/authorize`);
+    url.searchParams.set("provider", credentials.provider);
+    url.searchParams.set("apikey", this.apikey);
+    if (credentials.options?.redirectTo) url.searchParams.set("redirect_to", credentials.options.redirectTo);
+    if (credentials.options?.scopes) url.searchParams.set("scopes", credentials.options.scopes);
+    for (const [key, value] of Object.entries(credentials.options?.queryParams ?? {})) {
+      url.searchParams.set(key, value);
+    }
+    if (!credentials.options?.skipBrowserRedirect && typeof window !== "undefined") {
+      window.location.assign(url.toString());
+    }
+    return { data: { provider: credentials.provider, url: url.toString() }, error: null };
+  }
+  onAuthStateChange(callback) {
+    const id = `listener-${++this.listenerSeq}`;
+    this.listeners.set(id, callback);
+    this.initialize().then(() => {
+      if (this.listeners.has(id)) callback("INITIAL_SESSION", this.session);
+    });
+    return {
+      data: {
+        subscription: {
+          id,
+          unsubscribe: () => {
+            this.listeners.delete(id);
+          }
+        }
+      }
+    };
+  }
+  async signOut() {
+    await this.initialize();
+    const session = this.session;
+    if (session) {
+      await this.request("POST", "/auth/v1/logout", {}, session.access_token);
+    }
+    this.clearSession();
+    this.emit("SIGNED_OUT", null);
+    return { error: null };
+  }
+  async getSession() {
+    await this.initialize();
+    if (this.session && this.isExpired(this.session) && this.autoRefreshToken) {
+      const { error } = await this.refreshWithLock();
+      if (error && error.code !== "network_error") {
+        return { data: { session: null }, error: null };
+      }
+    }
+    return { data: { session: this.session }, error: null };
+  }
+  async getUser(jwt) {
+    let token = jwt;
+    if (!token) {
+      const {
+        data: { session }
+      } = await this.getSession();
+      token = session?.access_token;
+    }
+    if (!token) {
+      return { data: { user: null }, error: new AuthError("Auth session missing!", 400, "session_missing") };
+    }
+    const { data, error } = await this.request("GET", "/auth/v1/user", void 0, token);
+    return { data: { user: data }, error };
+  }
+  async refreshSession(currentSession) {
+    await this.initialize();
+    const refreshToken = currentSession?.refresh_token ?? this.session?.refresh_token;
+    if (!refreshToken) {
+      return {
+        data: { session: null, user: null },
+        error: new AuthError("Auth session missing!", 400, "session_missing")
+      };
+    }
+    return this.refreshWithLock(refreshToken);
+  }
+  // ---- internals ----
+  async request(method, path, body, accessToken) {
+    return request({
+      method,
+      path,
+      body,
+      accessToken,
+      apikey: this.apikey,
+      baseUrl: this.baseUrl,
+      fetchImpl: this.fetchImpl
+    });
+  }
+  initialize() {
+    this.initializePromise ?? (this.initializePromise = this.doInitialize());
+    return this.initializePromise;
+  }
+  async doInitialize() {
+    if (this.detectSessionInUrl && typeof window !== "undefined") {
+      const parsed = parseFragment(window.location.hash);
+      if (parsed) {
+        cleanFragmentFromUrl();
+        if ("authError" in parsed) {
+          console.warn(
+            `[deepkey] Auth redirect returned an error: ${parsed.authError.error_code ?? parsed.authError.error}`,
+            parsed.authError.error_description ?? ""
+          );
+        } else {
+          const { data: user } = await this.request("GET", "/auth/v1/user", void 0, parsed.tokens.access_token);
+          if (user) {
+            const session = { ...parsed.tokens, token_type: "bearer", user };
+            await this.saveSession(session);
+            this.emit("SIGNED_IN", session);
+            return;
+          }
+        }
+      }
+    }
+    const stored = this.loadStoredSession();
+    if (!stored) return;
+    if (this.isExpired(stored)) {
+      if (!this.autoRefreshToken) return;
+      this.session = stored;
+      const { error } = await this.refreshWithLock();
+      if (error && error.code !== "network_error") this.clearSession();
+      return;
+    }
+    this.session = stored;
+    this.startRefreshTimer();
+  }
+  isExpired(session) {
+    return session.expires_at <= Math.floor(Date.now() / 1e3) + EXPIRY_MARGIN_SECONDS;
+  }
+  async refreshWithLock(refreshToken) {
+    this.refreshPromise ?? (this.refreshPromise = this.doRefresh(refreshToken).finally(() => {
+      this.refreshPromise = null;
+    }));
+    return this.refreshPromise;
+  }
+  async doRefresh(refreshToken) {
+    const token = refreshToken ?? this.session?.refresh_token;
+    if (!token) {
+      return {
+        data: { session: null, user: null },
+        error: new AuthError("Auth session missing!", 400, "session_missing")
+      };
+    }
+    const { data, error } = await this.request("POST", "/auth/v1/token?grant_type=refresh_token", {
+      refresh_token: token
+    });
+    if (error) {
+      if (error.code !== "network_error") {
+        this.clearSession();
+        this.emit("SIGNED_OUT", null);
+      }
+      return { data: { session: null, user: null }, error };
+    }
+    if (data) {
+      await this.saveSession(data);
+      this.emit("TOKEN_REFRESHED", data);
+      return { data: { session: data, user: data.user }, error: null };
+    }
+    return { data: { session: null, user: null }, error: new AuthError("Empty refresh response") };
+  }
+  async saveSession(session) {
+    this.session = session;
+    if (this.persistSession) {
+      try {
+        this.storage.setItem(this.storageKey, JSON.stringify(session));
+      } catch {
+      }
+    }
+    this.startRefreshTimer();
+  }
+  clearSession() {
+    this.session = null;
+    try {
+      this.storage.removeItem(this.storageKey);
+    } catch {
+    }
+    this.stopRefreshTimer();
+  }
+  loadStoredSession() {
+    if (!this.persistSession) return null;
+    try {
+      const raw = this.storage.getItem(this.storageKey);
+      if (!raw) return null;
+      const parsed = JSON.parse(raw);
+      if (!parsed.access_token || !parsed.refresh_token) return null;
+      return parsed;
+    } catch {
+      return null;
+    }
+  }
+  startRefreshTimer() {
+    if (!this.autoRefreshToken || this.refreshTimer || typeof setInterval === "undefined") return;
+    this.refreshTimer = setInterval(() => {
+      if (this.session && this.isExpired(this.session)) void this.refreshWithLock();
+    }, REFRESH_TICK_MS);
+    const timer = this.refreshTimer;
+    if (typeof timer === "object" && typeof timer.unref === "function") timer.unref();
+  }
+  stopRefreshTimer() {
+    if (this.refreshTimer) {
+      clearInterval(this.refreshTimer);
+      this.refreshTimer = null;
+    }
+  }
+  setupCrossTabSync() {
+    if (typeof window === "undefined" || !this.persistSession) return;
+    window.addEventListener("storage", (event) => {
+      if (event.key !== this.storageKey) return;
+      if (!event.newValue) {
+        if (this.session) {
+          this.session = null;
+          this.stopRefreshTimer();
+          this.emit("SIGNED_OUT", null);
+        }
+        return;
+      }
+      try {
+        const next = JSON.parse(event.newValue);
+        const changed = next.access_token !== this.session?.access_token;
+        this.session = next;
+        this.startRefreshTimer();
+        if (changed) this.emit("TOKEN_REFRESHED", next);
+      } catch {
+      }
+    });
+  }
+  emit(event, session) {
+    for (const listener of this.listeners.values()) {
+      try {
+        listener(event, session);
+      } catch (err) {
+        console.error("[deepkey] onAuthStateChange listener threw", err);
+      }
+    }
+  }
+};
+var createAuthClient = (publishableKey, options) => {
+  return { auth: new Auth(publishableKey, options) };
+};
+export {
+  Auth,
+  AuthError,
+  DEEPKEY_API_URL,
+  createAuthClient
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fetch.ts","../src/storage.ts","../src/url.ts","../src/client.ts"],"sourcesContent":["import { AuthError } from './types'\n\nexport interface RequestOptions {\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE'\n  path: string\n  apikey: string\n  baseUrl: string\n  accessToken?: string\n  body?: unknown\n  fetchImpl?: typeof fetch\n}\n\nexport interface RequestResult<T> {\n  data: T | null\n  error: AuthError | null\n}\n\n// All service errors are shaped { error: { code, message } }.\nexport const request = async <T>(options: RequestOptions): Promise<RequestResult<T>> => {\n  const fetchImpl = options.fetchImpl ?? fetch\n  try {\n    const headers: Record<string, string> = { apikey: options.apikey }\n    if (options.body !== undefined) headers['Content-Type'] = 'application/json'\n    if (options.accessToken) headers.Authorization = `Bearer ${options.accessToken}`\n\n    const response = await fetchImpl(`${options.baseUrl}${options.path}`, {\n      method: options.method,\n      headers,\n      body: options.body !== undefined ? JSON.stringify(options.body) : undefined,\n    })\n\n    if (response.status === 204) return { data: {} as T, error: null }\n\n    let payload: unknown\n    try {\n      payload = await response.json()\n    } catch {\n      payload = null\n    }\n\n    if (!response.ok) {\n      const errorBody = (payload as { error?: { code?: string; message?: string } } | null)?.error\n      return {\n        data: null,\n        error: new AuthError(\n          errorBody?.message ?? `Request failed with status ${response.status}`,\n          response.status,\n          errorBody?.code,\n        ),\n      }\n    }\n\n    return { data: payload as T, error: null }\n  } catch (err) {\n    const message = err instanceof Error ? err.message : 'Network request failed'\n    return { data: null, error: new AuthError(message, 0, 'network_error') }\n  }\n}\n","import type { StorageAdapter } from './types'\n\nclass MemoryStorage implements StorageAdapter {\n  private store = new Map<string, string>()\n  getItem(key: string) {\n    return this.store.get(key) ?? null\n  }\n  setItem(key: string, value: string) {\n    this.store.set(key, value)\n  }\n  removeItem(key: string) {\n    this.store.delete(key)\n  }\n}\n\n// localStorage when available, in-memory fallback (SSR, tests, restricted contexts).\nexport const defaultStorage = (): StorageAdapter => {\n  try {\n    if (typeof window !== 'undefined' && window.localStorage) {\n      const probe = '__bt_auth_probe__'\n      window.localStorage.setItem(probe, '1')\n      window.localStorage.removeItem(probe)\n      return window.localStorage\n    }\n  } catch {\n    // fall through to memory storage\n  }\n  return new MemoryStorage()\n}\n\n// Publishable keys look like `bt_pub_<project-slug>_<random>`; the slug namespaces the\n// persisted session per project (mirrors supabase's `sb-<ref>-auth-token`).\nexport const deriveStorageKey = (publishableKey: string | undefined): string => {\n  const match = publishableKey?.match(/^bt_pub_([a-z0-9-]+)_[A-Za-z0-9_-]+$/)\n  return match ? `bt-${match[1]}-auth-token` : 'bt-auth-token'\n}\n","export interface FragmentTokens {\n  access_token: string\n  refresh_token: string\n  expires_in: number\n  expires_at: number\n  token_type: 'bearer'\n  type?: string\n}\n\nexport interface FragmentError {\n  error: string\n  error_code?: string\n  error_description?: string\n}\n\nexport type ParsedFragment = { tokens: FragmentTokens } | { authError: FragmentError } | null\n\n// Parses the implicit-flow return fragment (`#access_token=...` or `#error=...`).\nexport const parseFragment = (hash: string): ParsedFragment => {\n  if (!hash || hash.length < 2) return null\n  const params = new URLSearchParams(hash.startsWith('#') ? hash.slice(1) : hash)\n\n  const error = params.get('error')\n  if (error) {\n    return {\n      authError: {\n        error,\n        error_code: params.get('error_code') ?? undefined,\n        error_description: params.get('error_description') ?? undefined,\n      },\n    }\n  }\n\n  const accessToken = params.get('access_token')\n  const refreshToken = params.get('refresh_token')\n  if (!accessToken || !refreshToken) return null\n\n  const expiresIn = Number(params.get('expires_in') ?? 3600)\n  const expiresAt = Number(params.get('expires_at') ?? Math.floor(Date.now() / 1000) + expiresIn)\n\n  return {\n    tokens: {\n      access_token: accessToken,\n      refresh_token: refreshToken,\n      expires_in: expiresIn,\n      expires_at: expiresAt,\n      token_type: 'bearer',\n      type: params.get('type') ?? undefined,\n    },\n  }\n}\n\n// Removes the auth fragment from the address bar (before any await, so tokens never\n// linger in history).\nexport const cleanFragmentFromUrl = () => {\n  if (typeof window === 'undefined' || typeof history === 'undefined') return\n  history.replaceState(null, '', window.location.pathname + window.location.search)\n}\n","import { resolveBaseUrl } from './constants'\nimport { request } from './fetch'\nimport { defaultStorage, deriveStorageKey } from './storage'\nimport {\n  AuthError,\n  type AuthChangeEvent,\n  type AuthClientOptions,\n  type AuthResponse,\n  type Session,\n  type SignInWithOAuthCredentials,\n  type SignInWithOtpCredentials,\n  type StorageAdapter,\n  type Subscription,\n  type User,\n  type VerifyOtpParams,\n} from './types'\nimport { cleanFragmentFromUrl, parseFragment } from './url'\n\nconst REFRESH_TICK_MS = 30_000\n// Refresh when the access token is within this margin of expiry.\nconst EXPIRY_MARGIN_SECONDS = 90\n\ntype Listener = (event: AuthChangeEvent, session: Session | null) => void\n\nexport class Auth {\n  private baseUrl: string\n  private apikey: string\n  private storage: StorageAdapter\n  private storageKey: string\n  private persistSession: boolean\n  private autoRefreshToken: boolean\n  private detectSessionInUrl: boolean\n  private fetchImpl?: typeof fetch\n\n  private session: Session | null = null\n  private listeners = new Map<string, Listener>()\n  private listenerSeq = 0\n  private initializePromise: Promise<void> | null = null\n  private refreshPromise: Promise<AuthResponse<{ session: Session | null; user: User | null }>> | null = null\n  private refreshTimer: ReturnType<typeof setInterval> | null = null\n\n  constructor(publishableKey: string, options: AuthClientOptions = {}) {\n    // Lazy by design: an empty key must not throw at construction time (CI builds\n    // with empty envs import this module transitively). Failures surface on first call.\n    // The hosted DeepKey API is the only supported origin. The internal override\n    // exists for DeepKey's console and tests and is not part of the public contract.\n    this.baseUrl = resolveBaseUrl(options.__internalBaseUrl)\n    this.apikey = publishableKey ?? ''\n    this.persistSession = options.persistSession ?? true\n    this.autoRefreshToken = options.autoRefreshToken ?? true\n    this.detectSessionInUrl = options.detectSessionInUrl ?? true\n    this.storage = options.storage ?? defaultStorage()\n    this.storageKey = options.storageKey ?? deriveStorageKey(publishableKey)\n    this.fetchImpl = options.fetch\n\n    this.setupCrossTabSync()\n  }\n\n  // ---- public API (supabase-js compatible) ----\n\n  async signInWithOtp(credentials: SignInWithOtpCredentials): Promise<AuthResponse<{ user: null; session: null }>> {\n    const { error } = await this.request<Record<string, never>>('POST', '/auth/v1/otp', {\n      email: credentials.email,\n      create_user: credentials.options?.shouldCreateUser,\n      redirect_to: credentials.options?.emailRedirectTo,\n    })\n    return { data: { user: null, session: null }, error }\n  }\n\n  async verifyOtp(params: VerifyOtpParams): Promise<AuthResponse<{ user: User | null; session: Session | null }>> {\n    const { data, error } = await this.request<Session>('POST', '/auth/v1/verify', {\n      type: 'email',\n      email: params.email,\n      token: params.token,\n    })\n    if (error || !data) return { data: { user: null, session: null }, error }\n\n    await this.saveSession(data)\n    this.emit('SIGNED_IN', data)\n    return { data: { user: data.user, session: data }, error: null }\n  }\n\n  async signInWithOAuth(\n    credentials: SignInWithOAuthCredentials,\n  ): Promise<AuthResponse<{ provider: string; url: string }>> {\n    const url = new URL(`${this.baseUrl}/auth/v1/authorize`)\n    url.searchParams.set('provider', credentials.provider)\n    url.searchParams.set('apikey', this.apikey)\n    if (credentials.options?.redirectTo) url.searchParams.set('redirect_to', credentials.options.redirectTo)\n    if (credentials.options?.scopes) url.searchParams.set('scopes', credentials.options.scopes)\n    for (const [key, value] of Object.entries(credentials.options?.queryParams ?? {})) {\n      url.searchParams.set(key, value)\n    }\n\n    if (!credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {\n      window.location.assign(url.toString())\n    }\n    return { data: { provider: credentials.provider, url: url.toString() }, error: null }\n  }\n\n  onAuthStateChange(callback: Listener): { data: { subscription: Subscription } } {\n    const id = `listener-${++this.listenerSeq}`\n    this.listeners.set(id, callback)\n\n    // Every subscriber receives INITIAL_SESSION asynchronously once initialization\n    // settles — the supabase-js contract that AuthProviders rely on to resolve loading.\n    this.initialize().then(() => {\n      if (this.listeners.has(id)) callback('INITIAL_SESSION', this.session)\n    })\n\n    return {\n      data: {\n        subscription: {\n          id,\n          unsubscribe: () => {\n            this.listeners.delete(id)\n          },\n        },\n      },\n    }\n  }\n\n  async signOut(): Promise<{ error: AuthError | null }> {\n    await this.initialize()\n    const session = this.session\n    if (session) {\n      // Best-effort server-side revocation; local sign-out always succeeds.\n      await this.request('POST', '/auth/v1/logout', {}, session.access_token)\n    }\n    this.clearSession()\n    this.emit('SIGNED_OUT', null)\n    return { error: null }\n  }\n\n  async getSession(): Promise<AuthResponse<{ session: Session | null }>> {\n    await this.initialize()\n\n    if (this.session && this.isExpired(this.session) && this.autoRefreshToken) {\n      const { error } = await this.refreshWithLock()\n      if (error && error.code !== 'network_error') {\n        return { data: { session: null }, error: null }\n      }\n    }\n\n    return { data: { session: this.session }, error: null }\n  }\n\n  async getUser(jwt?: string): Promise<AuthResponse<{ user: User | null }>> {\n    let token = jwt\n    if (!token) {\n      const {\n        data: { session },\n      } = await this.getSession()\n      token = session?.access_token\n    }\n    if (!token) {\n      return { data: { user: null }, error: new AuthError('Auth session missing!', 400, 'session_missing') }\n    }\n\n    const { data, error } = await this.request<User>('GET', '/auth/v1/user', undefined, token)\n    return { data: { user: data }, error }\n  }\n\n  async refreshSession(currentSession?: {\n    refresh_token: string\n  }): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    await this.initialize()\n    const refreshToken = currentSession?.refresh_token ?? this.session?.refresh_token\n    if (!refreshToken) {\n      return {\n        data: { session: null, user: null },\n        error: new AuthError('Auth session missing!', 400, 'session_missing'),\n      }\n    }\n    return this.refreshWithLock(refreshToken)\n  }\n\n  // ---- internals ----\n\n  private async request<T>(method: 'GET' | 'POST', path: string, body?: unknown, accessToken?: string) {\n    return request<T>({\n      method,\n      path,\n      body,\n      accessToken,\n      apikey: this.apikey,\n      baseUrl: this.baseUrl,\n      fetchImpl: this.fetchImpl,\n    })\n  }\n\n  private initialize(): Promise<void> {\n    this.initializePromise ??= this.doInitialize()\n    return this.initializePromise\n  }\n\n  private async doInitialize(): Promise<void> {\n    if (this.detectSessionInUrl && typeof window !== 'undefined') {\n      const parsed = parseFragment(window.location.hash)\n      if (parsed) {\n        // Strip tokens from the address bar synchronously, before any await.\n        cleanFragmentFromUrl()\n\n        if ('authError' in parsed) {\n          console.warn(\n            `[deepkey] Auth redirect returned an error: ${parsed.authError.error_code ?? parsed.authError.error}`,\n            parsed.authError.error_description ?? '',\n          )\n        } else {\n          const { data: user } = await this.request<User>('GET', '/auth/v1/user', undefined, parsed.tokens.access_token)\n          if (user) {\n            const session: Session = { ...parsed.tokens, token_type: 'bearer', user }\n            await this.saveSession(session)\n            this.emit('SIGNED_IN', session)\n            return\n          }\n        }\n      }\n    }\n\n    const stored = this.loadStoredSession()\n    if (!stored) return\n\n    if (this.isExpired(stored)) {\n      if (!this.autoRefreshToken) return\n      this.session = stored\n      const { error } = await this.refreshWithLock()\n      if (error && error.code !== 'network_error') this.clearSession()\n      return\n    }\n\n    this.session = stored\n    this.startRefreshTimer()\n  }\n\n  private isExpired(session: Session): boolean {\n    return session.expires_at <= Math.floor(Date.now() / 1000) + EXPIRY_MARGIN_SECONDS\n  }\n\n  private async refreshWithLock(\n    refreshToken?: string,\n  ): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    this.refreshPromise ??= this.doRefresh(refreshToken).finally(() => {\n      this.refreshPromise = null\n    })\n    return this.refreshPromise\n  }\n\n  private async doRefresh(\n    refreshToken?: string,\n  ): Promise<AuthResponse<{ session: Session | null; user: User | null }>> {\n    const token = refreshToken ?? this.session?.refresh_token\n    if (!token) {\n      return {\n        data: { session: null, user: null },\n        error: new AuthError('Auth session missing!', 400, 'session_missing'),\n      }\n    }\n\n    const { data, error } = await this.request<Session>('POST', '/auth/v1/token?grant_type=refresh_token', {\n      refresh_token: token,\n    })\n\n    if (error) {\n      // Network failures keep the session (retry next tick); auth failures clear it.\n      if (error.code !== 'network_error') {\n        this.clearSession()\n        this.emit('SIGNED_OUT', null)\n      }\n      return { data: { session: null, user: null }, error }\n    }\n\n    if (data) {\n      await this.saveSession(data)\n      this.emit('TOKEN_REFRESHED', data)\n      return { data: { session: data, user: data.user }, error: null }\n    }\n    return { data: { session: null, user: null }, error: new AuthError('Empty refresh response') }\n  }\n\n  private async saveSession(session: Session) {\n    this.session = session\n    if (this.persistSession) {\n      try {\n        this.storage.setItem(this.storageKey, JSON.stringify(session))\n      } catch {\n        // Persistence is best-effort (private mode, quota).\n      }\n    }\n    this.startRefreshTimer()\n  }\n\n  private clearSession() {\n    this.session = null\n    try {\n      this.storage.removeItem(this.storageKey)\n    } catch {\n      // ignore\n    }\n    this.stopRefreshTimer()\n  }\n\n  private loadStoredSession(): Session | null {\n    if (!this.persistSession) return null\n    try {\n      const raw = this.storage.getItem(this.storageKey)\n      if (!raw) return null\n      const parsed = JSON.parse(raw) as Session\n      if (!parsed.access_token || !parsed.refresh_token) return null\n      return parsed\n    } catch {\n      return null\n    }\n  }\n\n  private startRefreshTimer() {\n    if (!this.autoRefreshToken || this.refreshTimer || typeof setInterval === 'undefined') return\n    this.refreshTimer = setInterval(() => {\n      if (this.session && this.isExpired(this.session)) void this.refreshWithLock()\n    }, REFRESH_TICK_MS)\n    // Do not keep node processes alive because of the timer (no-op in browsers).\n    const timer = this.refreshTimer as unknown as { unref?: () => void }\n    if (typeof timer === 'object' && typeof timer.unref === 'function') timer.unref()\n  }\n\n  private stopRefreshTimer() {\n    if (this.refreshTimer) {\n      clearInterval(this.refreshTimer)\n      this.refreshTimer = null\n    }\n  }\n\n  private setupCrossTabSync() {\n    if (typeof window === 'undefined' || !this.persistSession) return\n    window.addEventListener('storage', event => {\n      if (event.key !== this.storageKey) return\n      if (!event.newValue) {\n        if (this.session) {\n          this.session = null\n          this.stopRefreshTimer()\n          this.emit('SIGNED_OUT', null)\n        }\n        return\n      }\n      try {\n        const next = JSON.parse(event.newValue) as Session\n        const changed = next.access_token !== this.session?.access_token\n        this.session = next\n        this.startRefreshTimer()\n        if (changed) this.emit('TOKEN_REFRESHED', next)\n      } catch {\n        // ignore malformed writes\n      }\n    })\n  }\n\n  private emit(event: AuthChangeEvent, session: Session | null) {\n    for (const listener of this.listeners.values()) {\n      try {\n        listener(event, session)\n      } catch (err) {\n        console.error('[deepkey] onAuthStateChange listener threw', err)\n      }\n    }\n  }\n}\n\nexport interface AuthClient {\n  auth: Auth\n}\n\nexport const createAuthClient = (publishableKey: string, options?: AuthClientOptions): AuthClient => {\n  return { auth: new Auth(publishableKey, options) }\n}\n"],"mappings":";;;;;;;AAkBO,IAAM,UAAU,OAAU,YAAuD;AACtF,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI;AACF,UAAM,UAAkC,EAAE,QAAQ,QAAQ,OAAO;AACjE,QAAI,QAAQ,SAAS,OAAW,SAAQ,cAAc,IAAI;AAC1D,QAAI,QAAQ,YAAa,SAAQ,gBAAgB,UAAU,QAAQ,WAAW;AAE9E,UAAM,WAAW,MAAM,UAAU,GAAG,QAAQ,OAAO,GAAG,QAAQ,IAAI,IAAI;AAAA,MACpE,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,MAAM,QAAQ,SAAS,SAAY,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,IACpE,CAAC;AAED,QAAI,SAAS,WAAW,IAAK,QAAO,EAAE,MAAM,CAAC,GAAQ,OAAO,KAAK;AAEjE,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,SAAS,KAAK;AAAA,IAChC,QAAQ;AACN,gBAAU;AAAA,IACZ;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAa,SAAoE;AACvF,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO,IAAI;AAAA,UACT,WAAW,WAAW,8BAA8B,SAAS,MAAM;AAAA,UACnE,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,SAAc,OAAO,KAAK;AAAA,EAC3C,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,EAAE,MAAM,MAAM,OAAO,IAAI,UAAU,SAAS,GAAG,eAAe,EAAE;AAAA,EACzE;AACF;;;ACvDA,IAAM,gBAAN,MAA8C;AAAA,EAA9C;AACE,SAAQ,QAAQ,oBAAI,IAAoB;AAAA;AAAA,EACxC,QAAQ,KAAa;AACnB,WAAO,KAAK,MAAM,IAAI,GAAG,KAAK;AAAA,EAChC;AAAA,EACA,QAAQ,KAAa,OAAe;AAClC,SAAK,MAAM,IAAI,KAAK,KAAK;AAAA,EAC3B;AAAA,EACA,WAAW,KAAa;AACtB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AACF;AAGO,IAAM,iBAAiB,MAAsB;AAClD,MAAI;AACF,QAAI,OAAO,WAAW,eAAe,OAAO,cAAc;AACxD,YAAM,QAAQ;AACd,aAAO,aAAa,QAAQ,OAAO,GAAG;AACtC,aAAO,aAAa,WAAW,KAAK;AACpC,aAAO,OAAO;AAAA,IAChB;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,cAAc;AAC3B;AAIO,IAAM,mBAAmB,CAAC,mBAA+C;AAC9E,QAAM,QAAQ,gBAAgB,MAAM,sCAAsC;AAC1E,SAAO,QAAQ,MAAM,MAAM,CAAC,CAAC,gBAAgB;AAC/C;;;ACjBO,IAAM,gBAAgB,CAAC,SAAiC;AAC7D,MAAI,CAAC,QAAQ,KAAK,SAAS,EAAG,QAAO;AACrC,QAAM,SAAS,IAAI,gBAAgB,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI;AAE9E,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,MAAI,OAAO;AACT,WAAO;AAAA,MACL,WAAW;AAAA,QACT;AAAA,QACA,YAAY,OAAO,IAAI,YAAY,KAAK;AAAA,QACxC,mBAAmB,OAAO,IAAI,mBAAmB,KAAK;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,IAAI,cAAc;AAC7C,QAAM,eAAe,OAAO,IAAI,eAAe;AAC/C,MAAI,CAAC,eAAe,CAAC,aAAc,QAAO;AAE1C,QAAM,YAAY,OAAO,OAAO,IAAI,YAAY,KAAK,IAAI;AACzD,QAAM,YAAY,OAAO,OAAO,IAAI,YAAY,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,SAAS;AAE9F,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,cAAc;AAAA,MACd,eAAe;AAAA,MACf,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,MAAM,OAAO,IAAI,MAAM,KAAK;AAAA,IAC9B;AAAA,EACF;AACF;AAIO,IAAM,uBAAuB,MAAM;AACxC,MAAI,OAAO,WAAW,eAAe,OAAO,YAAY,YAAa;AACrE,UAAQ,aAAa,MAAM,IAAI,OAAO,SAAS,WAAW,OAAO,SAAS,MAAM;AAClF;;;ACvCA,IAAM,kBAAkB;AAExB,IAAM,wBAAwB;AAIvB,IAAM,OAAN,MAAW;AAAA,EAiBhB,YAAY,gBAAwB,UAA6B,CAAC,GAAG;AAPrE,SAAQ,UAA0B;AAClC,SAAQ,YAAY,oBAAI,IAAsB;AAC9C,SAAQ,cAAc;AACtB,SAAQ,oBAA0C;AAClD,SAAQ,iBAA+F;AACvG,SAAQ,eAAsD;AAO5D,SAAK,UAAU,eAAe,QAAQ,iBAAiB;AACvD,SAAK,SAAS,kBAAkB;AAChC,SAAK,iBAAiB,QAAQ,kBAAkB;AAChD,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,qBAAqB,QAAQ,sBAAsB;AACxD,SAAK,UAAU,QAAQ,WAAW,eAAe;AACjD,SAAK,aAAa,QAAQ,cAAc,iBAAiB,cAAc;AACvE,SAAK,YAAY,QAAQ;AAEzB,SAAK,kBAAkB;AAAA,EACzB;AAAA;AAAA,EAIA,MAAM,cAAc,aAA6F;AAC/G,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,QAA+B,QAAQ,gBAAgB;AAAA,MAClF,OAAO,YAAY;AAAA,MACnB,aAAa,YAAY,SAAS;AAAA,MAClC,aAAa,YAAY,SAAS;AAAA,IACpC,CAAC;AACD,WAAO,EAAE,MAAM,EAAE,MAAM,MAAM,SAAS,KAAK,GAAG,MAAM;AAAA,EACtD;AAAA,EAEA,MAAM,UAAU,QAAgG;AAC9G,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAiB,QAAQ,mBAAmB;AAAA,MAC7E,MAAM;AAAA,MACN,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AACD,QAAI,SAAS,CAAC,KAAM,QAAO,EAAE,MAAM,EAAE,MAAM,MAAM,SAAS,KAAK,GAAG,MAAM;AAExE,UAAM,KAAK,YAAY,IAAI;AAC3B,SAAK,KAAK,aAAa,IAAI;AAC3B,WAAO,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,GAAG,OAAO,KAAK;AAAA,EACjE;AAAA,EAEA,MAAM,gBACJ,aAC0D;AAC1D,UAAM,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,oBAAoB;AACvD,QAAI,aAAa,IAAI,YAAY,YAAY,QAAQ;AACrD,QAAI,aAAa,IAAI,UAAU,KAAK,MAAM;AAC1C,QAAI,YAAY,SAAS,WAAY,KAAI,aAAa,IAAI,eAAe,YAAY,QAAQ,UAAU;AACvG,QAAI,YAAY,SAAS,OAAQ,KAAI,aAAa,IAAI,UAAU,YAAY,QAAQ,MAAM;AAC1F,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,YAAY,SAAS,eAAe,CAAC,CAAC,GAAG;AACjF,UAAI,aAAa,IAAI,KAAK,KAAK;AAAA,IACjC;AAEA,QAAI,CAAC,YAAY,SAAS,uBAAuB,OAAO,WAAW,aAAa;AAC9E,aAAO,SAAS,OAAO,IAAI,SAAS,CAAC;AAAA,IACvC;AACA,WAAO,EAAE,MAAM,EAAE,UAAU,YAAY,UAAU,KAAK,IAAI,SAAS,EAAE,GAAG,OAAO,KAAK;AAAA,EACtF;AAAA,EAEA,kBAAkB,UAA8D;AAC9E,UAAM,KAAK,YAAY,EAAE,KAAK,WAAW;AACzC,SAAK,UAAU,IAAI,IAAI,QAAQ;AAI/B,SAAK,WAAW,EAAE,KAAK,MAAM;AAC3B,UAAI,KAAK,UAAU,IAAI,EAAE,EAAG,UAAS,mBAAmB,KAAK,OAAO;AAAA,IACtE,CAAC;AAED,WAAO;AAAA,MACL,MAAM;AAAA,QACJ,cAAc;AAAA,UACZ;AAAA,UACA,aAAa,MAAM;AACjB,iBAAK,UAAU,OAAO,EAAE;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,UAAgD;AACpD,UAAM,KAAK,WAAW;AACtB,UAAM,UAAU,KAAK;AACrB,QAAI,SAAS;AAEX,YAAM,KAAK,QAAQ,QAAQ,mBAAmB,CAAC,GAAG,QAAQ,YAAY;AAAA,IACxE;AACA,SAAK,aAAa;AAClB,SAAK,KAAK,cAAc,IAAI;AAC5B,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAAA,EAEA,MAAM,aAAiE;AACrE,UAAM,KAAK,WAAW;AAEtB,QAAI,KAAK,WAAW,KAAK,UAAU,KAAK,OAAO,KAAK,KAAK,kBAAkB;AACzE,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB;AAC7C,UAAI,SAAS,MAAM,SAAS,iBAAiB;AAC3C,eAAO,EAAE,MAAM,EAAE,SAAS,KAAK,GAAG,OAAO,KAAK;AAAA,MAChD;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,EAAE,SAAS,KAAK,QAAQ,GAAG,OAAO,KAAK;AAAA,EACxD;AAAA,EAEA,MAAM,QAAQ,KAA4D;AACxE,QAAI,QAAQ;AACZ,QAAI,CAAC,OAAO;AACV,YAAM;AAAA,QACJ,MAAM,EAAE,QAAQ;AAAA,MAClB,IAAI,MAAM,KAAK,WAAW;AAC1B,cAAQ,SAAS;AAAA,IACnB;AACA,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB,EAAE;AAAA,IACvG;AAEA,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAc,OAAO,iBAAiB,QAAW,KAAK;AACzF,WAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,eAAe,gBAEqD;AACxE,UAAM,KAAK,WAAW;AACtB,UAAM,eAAe,gBAAgB,iBAAiB,KAAK,SAAS;AACpE,QAAI,CAAC,cAAc;AACjB,aAAO;AAAA,QACL,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK;AAAA,QAClC,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB;AAAA,MACtE;AAAA,IACF;AACA,WAAO,KAAK,gBAAgB,YAAY;AAAA,EAC1C;AAAA;AAAA,EAIA,MAAc,QAAW,QAAwB,MAAc,MAAgB,aAAsB;AACnG,WAAO,QAAW;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,WAAW,KAAK;AAAA,IAClB,CAAC;AAAA,EACH;AAAA,EAEQ,aAA4B;AAClC,SAAK,sBAAL,KAAK,oBAAsB,KAAK,aAAa;AAC7C,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,eAA8B;AAC1C,QAAI,KAAK,sBAAsB,OAAO,WAAW,aAAa;AAC5D,YAAM,SAAS,cAAc,OAAO,SAAS,IAAI;AACjD,UAAI,QAAQ;AAEV,6BAAqB;AAErB,YAAI,eAAe,QAAQ;AACzB,kBAAQ;AAAA,YACN,8CAA8C,OAAO,UAAU,cAAc,OAAO,UAAU,KAAK;AAAA,YACnG,OAAO,UAAU,qBAAqB;AAAA,UACxC;AAAA,QACF,OAAO;AACL,gBAAM,EAAE,MAAM,KAAK,IAAI,MAAM,KAAK,QAAc,OAAO,iBAAiB,QAAW,OAAO,OAAO,YAAY;AAC7G,cAAI,MAAM;AACR,kBAAM,UAAmB,EAAE,GAAG,OAAO,QAAQ,YAAY,UAAU,KAAK;AACxE,kBAAM,KAAK,YAAY,OAAO;AAC9B,iBAAK,KAAK,aAAa,OAAO;AAC9B;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,kBAAkB;AACtC,QAAI,CAAC,OAAQ;AAEb,QAAI,KAAK,UAAU,MAAM,GAAG;AAC1B,UAAI,CAAC,KAAK,iBAAkB;AAC5B,WAAK,UAAU;AACf,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB;AAC7C,UAAI,SAAS,MAAM,SAAS,gBAAiB,MAAK,aAAa;AAC/D;AAAA,IACF;AAEA,SAAK,UAAU;AACf,SAAK,kBAAkB;AAAA,EACzB;AAAA,EAEQ,UAAU,SAA2B;AAC3C,WAAO,QAAQ,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EAC/D;AAAA,EAEA,MAAc,gBACZ,cACuE;AACvE,SAAK,mBAAL,KAAK,iBAAmB,KAAK,UAAU,YAAY,EAAE,QAAQ,MAAM;AACjE,WAAK,iBAAiB;AAAA,IACxB,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,UACZ,cACuE;AACvE,UAAM,QAAQ,gBAAgB,KAAK,SAAS;AAC5C,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK;AAAA,QAClC,OAAO,IAAI,UAAU,yBAAyB,KAAK,iBAAiB;AAAA,MACtE;AAAA,IACF;AAEA,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,QAAiB,QAAQ,2CAA2C;AAAA,MACrG,eAAe;AAAA,IACjB,CAAC;AAED,QAAI,OAAO;AAET,UAAI,MAAM,SAAS,iBAAiB;AAClC,aAAK,aAAa;AAClB,aAAK,KAAK,cAAc,IAAI;AAAA,MAC9B;AACA,aAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,GAAG,MAAM;AAAA,IACtD;AAEA,QAAI,MAAM;AACR,YAAM,KAAK,YAAY,IAAI;AAC3B,WAAK,KAAK,mBAAmB,IAAI;AACjC,aAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,KAAK,GAAG,OAAO,KAAK;AAAA,IACjE;AACA,WAAO,EAAE,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,wBAAwB,EAAE;AAAA,EAC/F;AAAA,EAEA,MAAc,YAAY,SAAkB;AAC1C,SAAK,UAAU;AACf,QAAI,KAAK,gBAAgB;AACvB,UAAI;AACF,aAAK,QAAQ,QAAQ,KAAK,YAAY,KAAK,UAAU,OAAO,CAAC;AAAA,MAC/D,QAAQ;AAAA,MAER;AAAA,IACF;AACA,SAAK,kBAAkB;AAAA,EACzB;AAAA,EAEQ,eAAe;AACrB,SAAK,UAAU;AACf,QAAI;AACF,WAAK,QAAQ,WAAW,KAAK,UAAU;AAAA,IACzC,QAAQ;AAAA,IAER;AACA,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEQ,oBAAoC;AAC1C,QAAI,CAAC,KAAK,eAAgB,QAAO;AACjC,QAAI;AACF,YAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK,UAAU;AAChD,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,gBAAgB,CAAC,OAAO,cAAe,QAAO;AAC1D,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,oBAAoB;AAC1B,QAAI,CAAC,KAAK,oBAAoB,KAAK,gBAAgB,OAAO,gBAAgB,YAAa;AACvF,SAAK,eAAe,YAAY,MAAM;AACpC,UAAI,KAAK,WAAW,KAAK,UAAU,KAAK,OAAO,EAAG,MAAK,KAAK,gBAAgB;AAAA,IAC9E,GAAG,eAAe;AAElB,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,YAAY,OAAO,MAAM,UAAU,WAAY,OAAM,MAAM;AAAA,EAClF;AAAA,EAEQ,mBAAmB;AACzB,QAAI,KAAK,cAAc;AACrB,oBAAc,KAAK,YAAY;AAC/B,WAAK,eAAe;AAAA,IACtB;AAAA,EACF;AAAA,EAEQ,oBAAoB;AAC1B,QAAI,OAAO,WAAW,eAAe,CAAC,KAAK,eAAgB;AAC3D,WAAO,iBAAiB,WAAW,WAAS;AAC1C,UAAI,MAAM,QAAQ,KAAK,WAAY;AACnC,UAAI,CAAC,MAAM,UAAU;AACnB,YAAI,KAAK,SAAS;AAChB,eAAK,UAAU;AACf,eAAK,iBAAiB;AACtB,eAAK,KAAK,cAAc,IAAI;AAAA,QAC9B;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,OAAO,KAAK,MAAM,MAAM,QAAQ;AACtC,cAAM,UAAU,KAAK,iBAAiB,KAAK,SAAS;AACpD,aAAK,UAAU;AACf,aAAK,kBAAkB;AACvB,YAAI,QAAS,MAAK,KAAK,mBAAmB,IAAI;AAAA,MAChD,QAAQ;AAAA,MAER;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,KAAK,OAAwB,SAAyB;AAC5D,eAAW,YAAY,KAAK,UAAU,OAAO,GAAG;AAC9C,UAAI;AACF,iBAAS,OAAO,OAAO;AAAA,MACzB,SAAS,KAAK;AACZ,gBAAQ,MAAM,8CAA8C,GAAG;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;AAMO,IAAM,mBAAmB,CAAC,gBAAwB,YAA4C;AACnG,SAAO,EAAE,MAAM,IAAI,KAAK,gBAAgB,OAAO,EAAE;AACnD;","names":[]}

package/dist/server.cjs

@@ -0,0 +1,83 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  AuthError: () => AuthError,
+  DEEPKEY_API_URL: () => DEEPKEY_API_URL,
+  createServerClient: () => createServerClient
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/constants.ts
+var DEEPKEY_API_URL = "https://deepkey.dev/api";
+var resolveBaseUrl = (url) => {
+  const candidate = typeof url === "string" ? url.trim() : "";
+  return (candidate || DEEPKEY_API_URL).replace(/\/+$/, "");
+};
+
+// src/types.ts
+var AuthError = class extends Error {
+  constructor(message, status, code) {
+    super(message);
+    this.name = "AuthError";
+    this.status = status;
+    this.code = code;
+  }
+};
+
+// src/server.ts
+var createServerClient = (secretKey, options = {}) => {
+  const baseUrl = resolveBaseUrl(options.__internalBaseUrl);
+  const fetchImpl = options.fetch ?? fetch;
+  return {
+    auth: {
+      async getUser(jwt) {
+        try {
+          const response = await fetchImpl(`${baseUrl}/auth/v1/user`, {
+            headers: { Authorization: `Bearer ${jwt}`, apikey: secretKey }
+          });
+          let payload = null;
+          try {
+            payload = await response.json();
+          } catch {
+            payload = null;
+          }
+          if (!response.ok) {
+            const errorBody = payload?.error;
+            return {
+              data: { user: null },
+              error: new AuthError(
+                errorBody?.message ?? `Request failed with status ${response.status}`,
+                response.status,
+                errorBody?.code
+              )
+            };
+          }
+          return { data: { user: payload }, error: null };
+        } catch (err) {
+          const message = err instanceof Error ? err.message : "Network request failed";
+          return { data: { user: null }, error: new AuthError(message, 0, "network_error") };
+        }
+      }
+    }
+  };
+};
+//# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/constants.ts","../src/types.ts"],"sourcesContent":["import { resolveBaseUrl } from './constants'\nimport { AuthError, type ServerClientOptions, type User } from './types'\n\nexport interface ServerAuthClient {\n  auth: {\n    // Mirrors `supabase.auth.getUser(jwt)` server-side: validates the access token\n    // against the auth service and returns the user.\n    getUser(jwt: string): Promise<{ data: { user: User | null }; error: AuthError | null }>\n  }\n}\n\n// Runs anywhere with global fetch (Bun, Node >= 18). `secretKey` is the project's\n// bt_secret_... key. Requests target the hosted DeepKey API; the internal\n// override is reserved for DeepKey's console and tests.\nexport const createServerClient = (secretKey: string, options: ServerClientOptions = {}): ServerAuthClient => {\n  const baseUrl = resolveBaseUrl(options.__internalBaseUrl)\n  const fetchImpl = options.fetch ?? fetch\n\n  return {\n    auth: {\n      async getUser(jwt: string) {\n        try {\n          const response = await fetchImpl(`${baseUrl}/auth/v1/user`, {\n            headers: { Authorization: `Bearer ${jwt}`, apikey: secretKey },\n          })\n\n          let payload: unknown = null\n          try {\n            payload = await response.json()\n          } catch {\n            payload = null\n          }\n\n          if (!response.ok) {\n            const errorBody = (payload as { error?: { code?: string; message?: string } } | null)?.error\n            return {\n              data: { user: null },\n              error: new AuthError(\n                errorBody?.message ?? `Request failed with status ${response.status}`,\n                response.status,\n                errorBody?.code,\n              ),\n            }\n          }\n\n          return { data: { user: payload as User }, error: null }\n        } catch (err) {\n          const message = err instanceof Error ? err.message : 'Network request failed'\n          return { data: { user: null }, error: new AuthError(message, 0, 'network_error') }\n        }\n      },\n    },\n  }\n}\n\nexport { DEEPKEY_API_URL } from './constants'\nexport { AuthError, type ServerClientOptions, type User } from './types'\n","// The hosted DeepKey API. Every client talks to this origin; only DeepKey's own\n// console and test suites replace it through the internal override.\nexport const DEEPKEY_API_URL = 'https://deepkey.dev/api'\n\n// Resolves the base URL used for every request. An absent or blank internal\n// override keeps the hosted API; a provided value has any trailing slash removed\n// so path joins stay predictable.\nexport const resolveBaseUrl = (url?: string | null): string => {\n  const candidate = typeof url === 'string' ? url.trim() : ''\n  return (candidate || DEEPKEY_API_URL).replace(/\\/+$/, '')\n}\n","export interface UserIdentity {\n  identity_id: string\n  id: string\n  user_id: string\n  provider: string\n  identity_data: Record<string, unknown>\n  last_sign_in_at: string | null\n  created_at: string\n  updated_at: string\n}\n\nexport interface User {\n  id: string\n  aud: string\n  role: string\n  email: string | null\n  email_confirmed_at: string | null\n  app_metadata: { provider?: string | null; providers?: string[]; [key: string]: unknown }\n  user_metadata: {\n    name?: string\n    full_name?: string\n    avatar_url?: string\n    picture?: string\n    email?: string\n    [key: string]: unknown\n  }\n  identities?: UserIdentity[]\n  created_at: string\n  updated_at?: string\n  last_sign_in_at?: string | null\n}\n\nexport interface Session {\n  access_token: string\n  refresh_token: string\n  token_type: 'bearer'\n  expires_in: number\n  expires_at: number\n  user: User\n}\n\nexport class AuthError extends Error {\n  status?: number\n  code?: string\n\n  constructor(message: string, status?: number, code?: string) {\n    super(message)\n    this.name = 'AuthError'\n    this.status = status\n    this.code = code\n  }\n}\n\nexport type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED'\n\nexport interface Subscription {\n  id: string\n  unsubscribe: () => void\n}\n\nexport interface StorageAdapter {\n  getItem(key: string): string | null\n  setItem(key: string, value: string): void\n  removeItem(key: string): void\n}\n\nexport interface AuthClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  storageKey?: string\n  autoRefreshToken?: boolean\n  detectSessionInUrl?: boolean\n  persistSession?: boolean\n  storage?: StorageAdapter\n  fetch?: typeof fetch\n}\n\nexport interface ServerClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  fetch?: typeof fetch\n}\n\nexport interface SignInWithOtpCredentials {\n  email: string\n  options?: {\n    emailRedirectTo?: string\n    shouldCreateUser?: boolean\n    data?: Record<string, unknown>\n  }\n}\n\nexport interface VerifyOtpParams {\n  email: string\n  token: string\n  type: 'email' | 'magiclink'\n}\n\nexport interface SignInWithOAuthCredentials {\n  provider: string\n  options?: {\n    redirectTo?: string\n    scopes?: string\n    queryParams?: Record<string, string>\n    skipBrowserRedirect?: boolean\n  }\n}\n\nexport interface AuthResponse<T> {\n  data: T\n  error: AuthError | null\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEO,IAAM,kBAAkB;AAKxB,IAAM,iBAAiB,CAAC,QAAgC;AAC7D,QAAM,YAAY,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;AACzD,UAAQ,aAAa,iBAAiB,QAAQ,QAAQ,EAAE;AAC1D;;;AC+BO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAInC,YAAY,SAAiB,QAAiB,MAAe;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;;;AFrCO,IAAM,qBAAqB,CAAC,WAAmB,UAA+B,CAAC,MAAwB;AAC5G,QAAM,UAAU,eAAe,QAAQ,iBAAiB;AACxD,QAAM,YAAY,QAAQ,SAAS;AAEnC,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,MAAM,QAAQ,KAAa;AACzB,YAAI;AACF,gBAAM,WAAW,MAAM,UAAU,GAAG,OAAO,iBAAiB;AAAA,YAC1D,SAAS,EAAE,eAAe,UAAU,GAAG,IAAI,QAAQ,UAAU;AAAA,UAC/D,CAAC;AAED,cAAI,UAAmB;AACvB,cAAI;AACF,sBAAU,MAAM,SAAS,KAAK;AAAA,UAChC,QAAQ;AACN,sBAAU;AAAA,UACZ;AAEA,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,YAAa,SAAoE;AACvF,mBAAO;AAAA,cACL,MAAM,EAAE,MAAM,KAAK;AAAA,cACnB,OAAO,IAAI;AAAA,gBACT,WAAW,WAAW,8BAA8B,SAAS,MAAM;AAAA,gBACnE,SAAS;AAAA,gBACT,WAAW;AAAA,cACb;AAAA,YACF;AAAA,UACF;AAEA,iBAAO,EAAE,MAAM,EAAE,MAAM,QAAgB,GAAG,OAAO,KAAK;AAAA,QACxD,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,iBAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,SAAS,GAAG,eAAe,EAAE;AAAA,QACnF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/server.d.cts

@@ -0,0 +1,16 @@
+import { U as User, f as AuthError, g as ServerClientOptions } from './constants-BQhswdms.cjs';
+export { D as DEEPKEY_API_URL } from './constants-BQhswdms.cjs';
+
+interface ServerAuthClient {
+    auth: {
+        getUser(jwt: string): Promise<{
+            data: {
+                user: User | null;
+            };
+            error: AuthError | null;
+        }>;
+    };
+}
+declare const createServerClient: (secretKey: string, options?: ServerClientOptions) => ServerAuthClient;
+
+export { AuthError, type ServerAuthClient, ServerClientOptions, User, createServerClient };

package/dist/server.d.ts

@@ -0,0 +1,16 @@
+import { U as User, f as AuthError, g as ServerClientOptions } from './constants-BQhswdms.js';
+export { D as DEEPKEY_API_URL } from './constants-BQhswdms.js';
+
+interface ServerAuthClient {
+    auth: {
+        getUser(jwt: string): Promise<{
+            data: {
+                user: User | null;
+            };
+            error: AuthError | null;
+        }>;
+    };
+}
+declare const createServerClient: (secretKey: string, options?: ServerClientOptions) => ServerAuthClient;
+
+export { AuthError, type ServerAuthClient, ServerClientOptions, User, createServerClient };

package/dist/server.js

@@ -0,0 +1,49 @@
+import {
+  AuthError,
+  DEEPKEY_API_URL,
+  resolveBaseUrl
+} from "./chunk-IFNRLMVX.js";
+
+// src/server.ts
+var createServerClient = (secretKey, options = {}) => {
+  const baseUrl = resolveBaseUrl(options.__internalBaseUrl);
+  const fetchImpl = options.fetch ?? fetch;
+  return {
+    auth: {
+      async getUser(jwt) {
+        try {
+          const response = await fetchImpl(`${baseUrl}/auth/v1/user`, {
+            headers: { Authorization: `Bearer ${jwt}`, apikey: secretKey }
+          });
+          let payload = null;
+          try {
+            payload = await response.json();
+          } catch {
+            payload = null;
+          }
+          if (!response.ok) {
+            const errorBody = payload?.error;
+            return {
+              data: { user: null },
+              error: new AuthError(
+                errorBody?.message ?? `Request failed with status ${response.status}`,
+                response.status,
+                errorBody?.code
+              )
+            };
+          }
+          return { data: { user: payload }, error: null };
+        } catch (err) {
+          const message = err instanceof Error ? err.message : "Network request failed";
+          return { data: { user: null }, error: new AuthError(message, 0, "network_error") };
+        }
+      }
+    }
+  };
+};
+export {
+  AuthError,
+  DEEPKEY_API_URL,
+  createServerClient
+};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import { resolveBaseUrl } from './constants'\nimport { AuthError, type ServerClientOptions, type User } from './types'\n\nexport interface ServerAuthClient {\n  auth: {\n    // Mirrors `supabase.auth.getUser(jwt)` server-side: validates the access token\n    // against the auth service and returns the user.\n    getUser(jwt: string): Promise<{ data: { user: User | null }; error: AuthError | null }>\n  }\n}\n\n// Runs anywhere with global fetch (Bun, Node >= 18). `secretKey` is the project's\n// bt_secret_... key. Requests target the hosted DeepKey API; the internal\n// override is reserved for DeepKey's console and tests.\nexport const createServerClient = (secretKey: string, options: ServerClientOptions = {}): ServerAuthClient => {\n  const baseUrl = resolveBaseUrl(options.__internalBaseUrl)\n  const fetchImpl = options.fetch ?? fetch\n\n  return {\n    auth: {\n      async getUser(jwt: string) {\n        try {\n          const response = await fetchImpl(`${baseUrl}/auth/v1/user`, {\n            headers: { Authorization: `Bearer ${jwt}`, apikey: secretKey },\n          })\n\n          let payload: unknown = null\n          try {\n            payload = await response.json()\n          } catch {\n            payload = null\n          }\n\n          if (!response.ok) {\n            const errorBody = (payload as { error?: { code?: string; message?: string } } | null)?.error\n            return {\n              data: { user: null },\n              error: new AuthError(\n                errorBody?.message ?? `Request failed with status ${response.status}`,\n                response.status,\n                errorBody?.code,\n              ),\n            }\n          }\n\n          return { data: { user: payload as User }, error: null }\n        } catch (err) {\n          const message = err instanceof Error ? err.message : 'Network request failed'\n          return { data: { user: null }, error: new AuthError(message, 0, 'network_error') }\n        }\n      },\n    },\n  }\n}\n\nexport { DEEPKEY_API_URL } from './constants'\nexport { AuthError, type ServerClientOptions, type User } from './types'\n"],"mappings":";;;;;;;AAcO,IAAM,qBAAqB,CAAC,WAAmB,UAA+B,CAAC,MAAwB;AAC5G,QAAM,UAAU,eAAe,QAAQ,iBAAiB;AACxD,QAAM,YAAY,QAAQ,SAAS;AAEnC,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,MAAM,QAAQ,KAAa;AACzB,YAAI;AACF,gBAAM,WAAW,MAAM,UAAU,GAAG,OAAO,iBAAiB;AAAA,YAC1D,SAAS,EAAE,eAAe,UAAU,GAAG,IAAI,QAAQ,UAAU;AAAA,UAC/D,CAAC;AAED,cAAI,UAAmB;AACvB,cAAI;AACF,sBAAU,MAAM,SAAS,KAAK;AAAA,UAChC,QAAQ;AACN,sBAAU;AAAA,UACZ;AAEA,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,YAAa,SAAoE;AACvF,mBAAO;AAAA,cACL,MAAM,EAAE,MAAM,KAAK;AAAA,cACnB,OAAO,IAAI;AAAA,gBACT,WAAW,WAAW,8BAA8B,SAAS,MAAM;AAAA,gBACnE,SAAS;AAAA,gBACT,WAAW;AAAA,cACb;AAAA,YACF;AAAA,UACF;AAEA,iBAAO,EAAE,MAAM,EAAE,MAAM,QAAgB,GAAG,OAAO,KAAK;AAAA,QACxD,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,iBAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,SAAS,GAAG,eAAe,EAAE;AAAA,QACnF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}