@depup/supabase__auth-js 2.103.0-depup.0 → 2.110.8-depup.0

package/dist/main/lib/types.d.ts

@@ -2,7 +2,8 @@ import { AuthError } from './errors';
 import { Fetch } from './fetch';
 import { EIP1193Provider, EthereumSignInInput, Hex } from './web3/ethereum';
 import type { SolanaSignInInput, SolanaSignInOutput } from './web3/solana';
-import { ServerCredentialCreationOptions, ServerCredentialRequestOptions, WebAuthnApi } from './webauthn';
+import { ServerCredentialCreationOptions, ServerCredentialRequestOptions, WebAuthnApi, WebAuthnError } from './webauthn';
+import type { RegistrationResponseJSON, AuthenticationResponseJSON, ServerCredentialResponse } from './webauthn';
 import { AuthenticationCredential, PublicKeyCredentialCreationOptionsFuture, PublicKeyCredentialRequestOptionsFuture, RegistrationCredential } from './webauthn.dom';
 /** One of the providers supported by GoTrue. Use the `custom:` prefix for custom OIDC providers (e.g. `custom:my-oidc-provider`). */
 export type Provider = 'apple' | 'azure' | 'bitbucket' | 'discord' | 'facebook' | 'figma' | 'github' | 'gitlab' | 'google' | 'kakao' | 'keycloak' | 'linkedin' | 'linkedin_oidc' | 'notion' | 'slack' | 'slack_oidc' | 'spotify' | 'twitch'
@@ -72,12 +73,17 @@ export type GoTrueClientOptions = {
     flowType?: AuthFlowType;
     debug?: boolean | ((message: string, ...args: any[]) => void);
     /**
-     * Provide your own locking mechanism based on the environment. By default,
-     * `navigatorLock` (Web Locks API) is used in browser environments when
-     * `persistSession` is true. Falls back to an in-process lock for non-browser
-     * environments (e.g. React Native).
+     * Provide your own locking mechanism based on the environment. By default
+     * the client coordinates refreshes itself (single-flight via
+     * `refreshingDeferred` + commit guard) and relies on the GoTrue server to
+     * resolve cross-tab refresh races. Passing a custom lock opts into a
+     * legacy path that wraps every auth operation in your supplied lock — this
+     * path is preserved for backwards compatibility (typically React Native
+     * `processLock` or Node multi-process setups).
      *
-     * @experimental
+     * @deprecated Custom locks still work in v2.x for backwards compatibility.
+     * The legacy lock path will be removed in v3 — drop this option from your
+     * constructor options before upgrading.
      */
     lock?: LockFunc;
     /**
@@ -91,30 +97,14 @@ export type GoTrueClientOptions = {
      */
     throwOnError?: boolean;
     /**
-     * The maximum time in milliseconds to wait for acquiring a cross-tab synchronization lock.
-     *
-     * When multiple browser tabs or windows use the auth client simultaneously, they coordinate
-     * via the Web Locks API to prevent race conditions during session refresh and other operations.
-     * This timeout controls how long to wait before attempting lock recovery.
-     *
-     * - **Positive value**: Wait up to this many milliseconds. If the lock is still held, attempt
-     *   automatic recovery by stealing it (the previous holder is evicted, its callback continues
-     *   to completion without exclusive access). This recovers from orphaned locks caused by
-     *   React Strict Mode double-mount, storage API hangs, or aborted operations.
-     * - **Zero (0)**: Fail immediately if the lock is unavailable; throws `LockAcquireTimeoutError`
-     *   (check `error.isAcquireTimeout === true`).
-     * - **Negative value**: Wait indefinitely — can cause permanent deadlocks if the lock is orphaned.
+     * The maximum time in milliseconds to wait for acquiring the custom lock
+     * supplied via the `lock` option. Only consulted when a custom `lock` is
+     * passed — the default lockless path doesn't use this timeout.
      *
      * @default 5000
      *
-     * @example
-     * ```ts
-     * const client = createClient(url, key, {
-     *   auth: {
-     *     lockAcquireTimeout: 5000, // 5 seconds, then steal orphaned lock
-     *   },
-     * })
-     * ```
+     * @deprecated Only used by the legacy lock path. Will be removed in v3
+     * along with the `lock` option.
      */
     lockAcquireTimeout?: number;
     /**
@@ -125,6 +115,25 @@ export type GoTrueClientOptions = {
      * @default false
      */
     skipAutoInitialize?: boolean;
+    /**
+     * Opt-in flags for experimental features. These APIs may change without
+     * notice and are disabled by default.
+     *
+     * @experimental
+     */
+    experimental?: ExperimentalFeatureFlags;
+};
+export type ExperimentalFeatureFlags = {
+    /**
+     * Enables passkey support:
+     *   - `auth.signInWithPasskey()`, `auth.registerPasskey()`
+     *   - `auth.passkey.*`
+     *   - `auth.admin.passkey.*`
+     *
+     * Defaults to `false`. Calling any passkey method while this flag is
+     * disabled throws a descriptive error at call time.
+     */
+    passkey?: boolean;
 };
 declare const WeakPasswordReasons: readonly ["length", "characters", "pwned"];
 export type WeakPasswordReasons = (typeof WeakPasswordReasons)[number];
@@ -157,7 +166,7 @@ export type RequestResult<T, ErrorType extends Error = AuthError> = {
 };
 /**
  * similar to RequestResult except it allows you to destructure the possible shape of the success response
- *  {@see RequestResult}
+ *  {@link RequestResult}
  */
 export type RequestResultSafeDestructure<T> = {
     data: T;
@@ -180,7 +189,7 @@ export type AuthResponsePassword = RequestResultSafeDestructure<{
 /**
  * AuthOtpResponse is returned when OTP is used.
  *
- * {@see AuthResponse}
+ * {@link AuthResponse}
  */
 export type AuthOtpResponse = RequestResultSafeDestructure<{
     user: null;
@@ -304,7 +313,7 @@ type FactorVerificationStatus = (typeof FactorVerificationStatuses)[number];
  *
  * @see {@link GoTrueMFAApi#enroll}
  * @see {@link GoTrueMFAApi#listFactors}
- * @see {@link GoTrueMFAAdminApi#listFactors}
+ * @see {@link GoTrueAdminMFAApi#listFactors}
  */
 export type Factor<Type extends FactorType = FactorType, Status extends FactorVerificationStatus = (typeof FactorVerificationStatuses)[number]> = {
     /** ID of the factor. */
@@ -495,14 +504,14 @@ export type SignInAnonymouslyCredentials = {
         captchaToken?: string;
     };
 };
-export type SignUpWithPasswordCredentials = Prettify<PasswordCredentialsBase & {
+export type SignUpWithPasswordCredentials = PasswordCredentialsBase & {
     options?: {
         emailRedirectTo?: string;
         data?: object;
         captchaToken?: string;
         channel?: 'sms' | 'whatsapp';
     };
-}>;
+};
 type PasswordCredentialsBase = {
     email: string;
     password: string;
@@ -550,7 +559,7 @@ export type SignInWithPasswordlessCredentials = {
         channel?: 'sms' | 'whatsapp';
     };
 };
-export type AuthFlowType = 'implicit' | 'pkce';
+export type AuthFlowType = 'implicit' | 'pkce' | (string & {});
 export type SignInWithOAuthCredentials = {
     /** One of the providers supported by GoTrue. */
     provider: Provider;
@@ -680,8 +689,8 @@ export interface VerifyTokenHashParams {
     /** The user's verification type. */
     type: EmailOtpType;
 }
-export type MobileOtpType = 'sms' | 'phone_change';
-export type EmailOtpType = 'signup' | 'invite' | 'magiclink' | 'recovery' | 'email_change' | 'email';
+export type MobileOtpType = 'sms' | 'phone_change' | (string & {});
+export type EmailOtpType = 'signup' | 'invite' | 'magiclink' | 'recovery' | 'email_change' | 'email' | (string & {});
 export type ResendParams = {
     type: Extract<EmailOtpType, 'signup' | 'email_change'>;
     email: string;
@@ -810,9 +819,9 @@ type MFAVerifyTOTPParamFields = {
     /** Verification code provided by the user. */
     code: string;
 };
-export type MFAVerifyTOTPParams = Prettify<MFAVerifyParamsBase & MFAVerifyTOTPParamFields>;
+export type MFAVerifyTOTPParams = MFAVerifyParamsBase & MFAVerifyTOTPParamFields;
 type MFAVerifyPhoneParamFields = MFAVerifyTOTPParamFields;
-export type MFAVerifyPhoneParams = Prettify<MFAVerifyParamsBase & MFAVerifyPhoneParamFields>;
+export type MFAVerifyPhoneParams = MFAVerifyParamsBase & MFAVerifyPhoneParamFields;
 type MFAVerifyWebauthnParamFieldsBase = {
     /** Relying party ID */
     rpId: string;
@@ -839,7 +848,7 @@ export type MFAVerifyWebauthnParamFields<T extends 'create' | 'request' = 'creat
  * @template T - Type of WebAuthn operation: 'create' for registration, 'request' for authentication
  * @see {@link https://w3c.github.io/webauthn/#sctn-verifying-assertion W3C WebAuthn Spec - Verifying an Authentication Assertion}
  */
-export type MFAVerifyWebauthnParams<T extends 'create' | 'request' = 'create' | 'request'> = Prettify<MFAVerifyParamsBase & MFAVerifyWebauthnParamFields<T>>;
+export type MFAVerifyWebauthnParams<T extends 'create' | 'request' = 'create' | 'request'> = MFAVerifyParamsBase & MFAVerifyWebauthnParamFields<T>;
 export type MFAVerifyParams = MFAVerifyTOTPParams | MFAVerifyPhoneParams | MFAVerifyWebauthnParams;
 type MFAChallengeParamsBase = {
     /** ID of the factor to be challenged. Returned in enroll(). */
@@ -847,12 +856,12 @@ type MFAChallengeParamsBase = {
 };
 declare const MFATOTPChannels: readonly ["sms", "whatsapp"];
 export type MFATOTPChannel = (typeof MFATOTPChannels)[number];
-export type MFAChallengeTOTPParams = Prettify<MFAChallengeParamsBase>;
+export type MFAChallengeTOTPParams = MFAChallengeParamsBase;
 type MFAChallengePhoneParamFields<Channel extends MFATOTPChannel = MFATOTPChannel> = {
     /** Messaging channel to use (e.g. whatsapp or sms). Only relevant for phone factors */
     channel: Channel;
 };
-export type MFAChallengePhoneParams = Prettify<MFAChallengeParamsBase & MFAChallengePhoneParamFields>;
+export type MFAChallengePhoneParams = MFAChallengeParamsBase & MFAChallengePhoneParamFields;
 /** WebAuthn parameters for WebAuthn factor challenge */
 type MFAChallengeWebauthnParamFields = {
     webauthn: {
@@ -867,11 +876,11 @@ type MFAChallengeWebauthnParamFields = {
  * Includes Relying Party information needed for WebAuthn ceremonies.
  * @see {@link https://w3c.github.io/webauthn/#sctn-rp-operations W3C WebAuthn Spec - Relying Party Operations}
  */
-export type MFAChallengeWebauthnParams = Prettify<MFAChallengeParamsBase & MFAChallengeWebauthnParamFields>;
+export type MFAChallengeWebauthnParams = MFAChallengeParamsBase & MFAChallengeWebauthnParamFields;
 export type MFAChallengeParams = MFAChallengeTOTPParams | MFAChallengePhoneParams | MFAChallengeWebauthnParams;
 type MFAChallengeAndVerifyParamsBase = Omit<MFAVerifyParamsBase, 'challengeId'>;
 type MFAChallengeAndVerifyTOTPParamFields = MFAVerifyTOTPParamFields;
-type MFAChallengeAndVerifyTOTPParams = Prettify<MFAChallengeAndVerifyParamsBase & MFAChallengeAndVerifyTOTPParamFields>;
+type MFAChallengeAndVerifyTOTPParams = MFAChallengeAndVerifyParamsBase & MFAChallengeAndVerifyTOTPParamFields;
 export type MFAChallengeAndVerifyParams = MFAChallengeAndVerifyTOTPParams;
 /**
  * Data returned after successful MFA verification.
@@ -908,9 +917,9 @@ type AuthMFAChallengeResponseBase<T extends FactorType> = {
     expires_at: number;
 };
 type AuthMFAChallengeTOTPResponseFields = {};
-export type AuthMFAChallengeTOTPResponse = RequestResult<Prettify<AuthMFAChallengeResponseBase<'totp'> & AuthMFAChallengeTOTPResponseFields>>;
+export type AuthMFAChallengeTOTPResponse = RequestResult<AuthMFAChallengeResponseBase<'totp'> & AuthMFAChallengeTOTPResponseFields>;
 type AuthMFAChallengePhoneResponseFields = {};
-export type AuthMFAChallengePhoneResponse = RequestResult<Prettify<AuthMFAChallengeResponseBase<'phone'> & AuthMFAChallengePhoneResponseFields>>;
+export type AuthMFAChallengePhoneResponse = RequestResult<AuthMFAChallengeResponseBase<'phone'> & AuthMFAChallengePhoneResponseFields>;
 type AuthMFAChallengeWebauthnResponseFields = {
     webauthn: {
         type: 'create';
@@ -929,7 +938,7 @@ type AuthMFAChallengeWebauthnResponseFields = {
  * Contains credential creation or request options from the server.
  * @see {@link https://w3c.github.io/webauthn/#sctn-credential-creation W3C WebAuthn Spec - Credential Creation}
  */
-export type AuthMFAChallengeWebauthnResponse = RequestResult<Prettify<AuthMFAChallengeResponseBase<'webauthn'> & AuthMFAChallengeWebauthnResponseFields>>;
+export type AuthMFAChallengeWebauthnResponse = RequestResult<AuthMFAChallengeResponseBase<'webauthn'> & AuthMFAChallengeWebauthnResponseFields>;
 type AuthMFAChallengeWebauthnResponseFieldsJSON = {
     webauthn: {
         type: 'create';
@@ -947,7 +956,7 @@ type AuthMFAChallengeWebauthnResponseFieldsJSON = {
  * JSON-serializable version of WebAuthn challenge response.
  * Used for server communication with base64url-encoded binary fields.
  */
-export type AuthMFAChallengeWebauthnResponseDataJSON = Prettify<AuthMFAChallengeResponseBase<'webauthn'> & AuthMFAChallengeWebauthnResponseFieldsJSON>;
+export type AuthMFAChallengeWebauthnResponseDataJSON = AuthMFAChallengeResponseBase<'webauthn'> & AuthMFAChallengeWebauthnResponseFieldsJSON;
 /**
  * Server response type for WebAuthn MFA challenge.
  * Contains JSON-formatted WebAuthn options ready for browser API.
@@ -957,11 +966,11 @@ export type AuthMFAChallengeResponse = AuthMFAChallengeTOTPResponse | AuthMFACha
 /** response of ListFactors, which should contain all the types of factors that are available, this ensures we always include all */
 export type AuthMFAListFactorsResponse<T extends typeof FactorTypes = typeof FactorTypes> = RequestResult<{
     /** All available factors (verified and unverified). */
-    all: Prettify<Factor>[];
+    all: Factor[];
 } & {
-    [K in T[number]]: Prettify<Factor<K, 'verified'>>[];
+    [K in T[number]]: Factor<K, 'verified'>[];
 }>;
-export type AuthenticatorAssuranceLevels = 'aal1' | 'aal2';
+export type AuthenticatorAssuranceLevels = 'aal1' | 'aal2' | (string & {});
 export type AuthMFAGetAuthenticatorAssuranceLevelResponse = RequestResult<{
     /** Current AAL level of the session. */
     currentLevel: AuthenticatorAssuranceLevels | null;
@@ -998,6 +1007,7 @@ export interface GoTrueMFAApi {
      * Upon verifying a factor, all other sessions are logged out and the current session's authenticator level is promoted to `aal2`.
      *
      * @category Auth
+     * @subcategory Auth MFA
      *
      * @remarks
      * - Use `totp` or `phone` as the `factorType` and use the returned `id` to create a challenge.
@@ -1077,6 +1087,7 @@ export interface GoTrueMFAApi {
      * factor.
      *
      * @category Auth
+     * @subcategory Auth MFA
      *
      * @remarks
      * - An [enrolled factor](/docs/reference/javascript/auth-mfa-enroll) is required before creating a challenge.
@@ -1149,6 +1160,7 @@ export interface GoTrueMFAApi {
      * provided by the user by entering a code seen in their authenticator app.
      *
      * @category Auth
+     * @subcategory Auth MFA
      *
      * @remarks
      * - To verify a challenge, please [create a challenge](/docs/reference/javascript/auth-mfa-challenge) first.
@@ -1231,6 +1243,7 @@ export interface GoTrueMFAApi {
      * A user has to have an `aal2` authenticator level in order to unenroll a `verified` factor.
      *
      * @category Auth
+     * @subcategory Auth MFA
      *
      * @example Unenroll a factor
      * ```js
@@ -1255,6 +1268,7 @@ export interface GoTrueMFAApi {
      * provided by the user by entering a code seen in their authenticator app.
      *
      * @category Auth
+     * @subcategory Auth MFA
      *
      * @remarks
      * - Intended for use with only TOTP factors.
@@ -1339,6 +1353,7 @@ export interface GoTrueMFAApi {
      *
      *
      * @category Auth
+     * @subcategory Auth MFA
      */
     listFactors(): Promise<AuthMFAListFactorsResponse>;
     /**
@@ -1357,6 +1372,7 @@ export interface GoTrueMFAApi {
      * @param jwt Takes in an optional access token JWT. If no JWT is provided, the JWT from the current session is used.
      *
      * @category Auth
+     * @subcategory Auth MFA
      *
      * @remarks
      * - Authenticator Assurance Level (AAL) is the measure of the strength of an authentication mechanism.
@@ -1396,14 +1412,14 @@ export interface GoTrueMFAApi {
     webauthn: WebAuthnApi;
 }
 /**
- * @expermental
+ * @experimental
  */
 export type AuthMFAAdminDeleteFactorResponse = RequestResult<{
     /** ID of the factor that was successfully deleted. */
     id: string;
 }>;
 /**
- * @expermental
+ * @experimental
  */
 export type AuthMFAAdminDeleteFactorParams = {
     /** ID of the MFA factor to delete. */
@@ -1412,14 +1428,14 @@ export type AuthMFAAdminDeleteFactorParams = {
     userId: string;
 };
 /**
- * @expermental
+ * @experimental
  */
 export type AuthMFAAdminListFactorsResponse = RequestResult<{
     /** All factors attached to the user. */
     factors: Factor[];
 }>;
 /**
- * @expermental
+ * @experimental
  */
 export type AuthMFAAdminListFactorsParams = {
     /** ID of the user. */
@@ -1428,7 +1444,7 @@ export type AuthMFAAdminListFactorsParams = {
 /**
  * Contains the full multi-factor authentication administration API.
  *
- * @expermental
+ * @experimental
  */
 export interface GoTrueAdminMFAApi {
     /**
@@ -1436,6 +1452,7 @@ export interface GoTrueAdminMFAApi {
      *
      *
      * @category Auth
+     * @subcategory Auth Admin
      *
      * @example List all factors for a user
      * ```js
@@ -1468,9 +1485,10 @@ export interface GoTrueAdminMFAApi {
      *
      * @see {@link GoTrueMFAApi#unenroll}
      *
-     * @expermental
+     * @experimental
      *
      * @category Auth
+     * @subcategory Auth Admin
      *
      * @example Delete a factor for a user
      * ```js
@@ -1546,19 +1564,19 @@ type MFAEnrollTOTPParamFields = {
     /** Domain which the user is enrolled with. */
     issuer?: string;
 };
-export type MFAEnrollTOTPParams = Prettify<MFAEnrollParamsBase<'totp'> & MFAEnrollTOTPParamFields>;
+export type MFAEnrollTOTPParams = MFAEnrollParamsBase<'totp'> & MFAEnrollTOTPParamFields;
 type MFAEnrollPhoneParamFields = {
     /** Phone number associated with a factor. Number should conform to E.164 format */
     phone: string;
 };
-export type MFAEnrollPhoneParams = Prettify<MFAEnrollParamsBase<'phone'> & MFAEnrollPhoneParamFields>;
+export type MFAEnrollPhoneParams = MFAEnrollParamsBase<'phone'> & MFAEnrollPhoneParamFields;
 type MFAEnrollWebauthnFields = {};
 /**
  * Parameters for enrolling a WebAuthn factor.
  * Creates an unverified WebAuthn factor that must be verified with a credential.
  * @see {@link https://w3c.github.io/webauthn/#sctn-registering-a-new-credential W3C WebAuthn Spec - Registering a New Credential}
  */
-export type MFAEnrollWebauthnParams = Prettify<MFAEnrollParamsBase<'webauthn'> & MFAEnrollWebauthnFields>;
+export type MFAEnrollWebauthnParams = MFAEnrollParamsBase<'webauthn'> & MFAEnrollWebauthnFields;
 type AuthMFAEnrollResponseBase<T extends FactorType> = {
     /** ID of the factor that was just enrolled (in an unverified state). */
     id: string;
@@ -1583,21 +1601,21 @@ type AuthMFAEnrollTOTPResponseFields = {
         uri: string;
     };
 };
-export type AuthMFAEnrollTOTPResponse = RequestResult<Prettify<AuthMFAEnrollResponseBase<'totp'> & AuthMFAEnrollTOTPResponseFields>>;
+export type AuthMFAEnrollTOTPResponse = RequestResult<AuthMFAEnrollResponseBase<'totp'> & AuthMFAEnrollTOTPResponseFields>;
 type AuthMFAEnrollPhoneResponseFields = {
     /** Phone number of the MFA factor in E.164 format. Used to send messages  */
     phone: string;
 };
-export type AuthMFAEnrollPhoneResponse = RequestResult<Prettify<AuthMFAEnrollResponseBase<'phone'> & AuthMFAEnrollPhoneResponseFields>>;
+export type AuthMFAEnrollPhoneResponse = RequestResult<AuthMFAEnrollResponseBase<'phone'> & AuthMFAEnrollPhoneResponseFields>;
 type AuthMFAEnrollWebauthnFields = {};
 /**
  * Response type for WebAuthn factor enrollment.
  * Returns the enrolled factor ID and metadata.
  * @see {@link https://w3c.github.io/webauthn/#sctn-registering-a-new-credential W3C WebAuthn Spec - Registering a New Credential}
  */
-export type AuthMFAEnrollWebauthnResponse = RequestResult<Prettify<AuthMFAEnrollResponseBase<'webauthn'> & AuthMFAEnrollWebauthnFields>>;
+export type AuthMFAEnrollWebauthnResponse = RequestResult<AuthMFAEnrollResponseBase<'webauthn'> & AuthMFAEnrollWebauthnFields>;
 export type JwtHeader = {
-    alg: 'RS256' | 'ES256' | 'HS256';
+    alg: 'RS256' | 'ES256' | 'HS256' | (string & {});
     kid: string;
     typ: string;
 };
@@ -1638,7 +1656,7 @@ export interface JwtPayload extends RequiredClaims {
     [key: string]: any;
 }
 export interface JWK {
-    kty: 'RSA' | 'EC' | 'oct';
+    kty: 'RSA' | 'EC' | 'oct' | (string & {});
     key_ops: string[];
     alg?: string;
     kid?: string;
@@ -1650,7 +1668,7 @@ export type SignOutScope = (typeof SIGN_OUT_SCOPES)[number];
  * OAuth client grant types supported by the OAuth 2.1 server.
  * Only relevant when the OAuth 2.1 server is enabled in Supabase Auth.
  */
-export type OAuthClientGrantType = 'authorization_code' | 'refresh_token';
+export type OAuthClientGrantType = 'authorization_code' | 'refresh_token' | (string & {});
 /**
  * OAuth client response types supported by the OAuth 2.1 server.
  * Only relevant when the OAuth 2.1 server is enabled in Supabase Auth.
@@ -1777,6 +1795,7 @@ export interface GoTrueAdminOAuthApi {
      * This function should only be called on a server. Never expose your `service_role` key in the browser.
      *
      * @category Auth
+     * @subcategory OAuth Admin
      */
     listClients(params?: PageParams): Promise<OAuthClientListResponse>;
     /**
@@ -1786,6 +1805,7 @@ export interface GoTrueAdminOAuthApi {
      * This function should only be called on a server. Never expose your `service_role` key in the browser.
      *
      * @category Auth
+     * @subcategory OAuth Admin
      */
     createClient(params: CreateOAuthClientParams): Promise<OAuthClientResponse>;
     /**
@@ -1795,6 +1815,7 @@ export interface GoTrueAdminOAuthApi {
      * This function should only be called on a server. Never expose your `service_role` key in the browser.
      *
      * @category Auth
+     * @subcategory OAuth Admin
      */
     getClient(clientId: string): Promise<OAuthClientResponse>;
     /**
@@ -1804,6 +1825,7 @@ export interface GoTrueAdminOAuthApi {
      * This function should only be called on a server. Never expose your `service_role` key in the browser.
      *
      * @category Auth
+     * @subcategory OAuth Admin
      */
     updateClient(clientId: string, params: UpdateOAuthClientParams): Promise<OAuthClientResponse>;
     /**
@@ -1813,6 +1835,7 @@ export interface GoTrueAdminOAuthApi {
      * This function should only be called on a server. Never expose your `service_role` key in the browser.
      *
      * @category Auth
+     * @subcategory OAuth Admin
      */
     deleteClient(clientId: string): Promise<{
         data: null;
@@ -1825,6 +1848,7 @@ export interface GoTrueAdminOAuthApi {
      * This function should only be called on a server. Never expose your `service_role` key in the browser.
      *
      * @category Auth
+     * @subcategory OAuth Admin
      */
     regenerateClientSecret(clientId: string): Promise<OAuthClientResponse>;
 }
@@ -1877,6 +1901,14 @@ export type CustomOAuthProvider = {
     acceptable_client_ids?: string[];
     /** OAuth scopes requested during authorization */
     scopes?: string[];
+    /**
+     * Allowlist of raw identity provider claim keys to copy verbatim into the
+     * user's `custom_claims` field (within `identity_data` and
+     * `raw_user_meta_data`), e.g. `["groups", "org_id", "mail"]`. This is an
+     * opt-in allowlist that defaults to empty (no claims captured) and operates
+     * independently from `attribute_mapping`.
+     */
+    custom_claims_allowlist?: string[];
     /** Whether PKCE is enabled */
     pkce_enabled?: boolean;
     /** Mapping of provider attributes to Supabase user attributes */
@@ -1926,6 +1958,14 @@ export type CreateCustomProviderParams = {
     acceptable_client_ids?: string[];
     /** OAuth scopes requested during authorization */
     scopes?: string[];
+    /**
+     * Allowlist of raw identity provider claim keys to copy verbatim into the
+     * user's `custom_claims` field (within `identity_data` and
+     * `raw_user_meta_data`), e.g. `["groups", "org_id", "mail"]`. This is an
+     * opt-in allowlist that defaults to empty (no claims captured) and operates
+     * independently from `attribute_mapping`.
+     */
+    custom_claims_allowlist?: string[];
     /** Whether PKCE is enabled */
     pkce_enabled?: boolean;
     /** Mapping of provider attributes to Supabase user attributes */
@@ -1967,6 +2007,14 @@ export type UpdateCustomProviderParams = {
     acceptable_client_ids?: string[];
     /** OAuth scopes requested during authorization */
     scopes?: string[];
+    /**
+     * Allowlist of raw identity provider claim keys to copy verbatim into the
+     * user's `custom_claims` field (within `identity_data` and
+     * `raw_user_meta_data`), e.g. `["groups", "org_id", "mail"]`. This is an
+     * opt-in allowlist that defaults to empty (no claims captured) and operates
+     * independently from `attribute_mapping`.
+     */
+    custom_claims_allowlist?: string[];
     /** Whether PKCE is enabled */
     pkce_enabled?: boolean;
     /** Mapping of provider attributes to Supabase user attributes */
@@ -2025,6 +2073,9 @@ export interface GoTrueAdminCustomProvidersApi {
      * Lists all custom providers with optional type filter.
      *
      * This function should only be called on a server. Never expose your `service_role` key in the browser.
+     *
+     * @category Auth
+     * @subcategory Auth Admin
      */
     listProviders(params?: ListCustomProvidersParams): Promise<CustomProviderListResponse>;
     /**
@@ -2037,12 +2088,18 @@ export interface GoTrueAdminCustomProvidersApi {
      * in the document does not match the expected issuer.
      *
      * This function should only be called on a server. Never expose your `service_role` key in the browser.
+     *
+     * @category Auth
+     * @subcategory Auth Admin
      */
     createProvider(params: CreateCustomProviderParams): Promise<CustomProviderResponse>;
     /**
      * Gets details of a specific custom provider by identifier.
      *
      * This function should only be called on a server. Never expose your `service_role` key in the browser.
+     *
+     * @category Auth
+     * @subcategory Auth Admin
      */
     getProvider(identifier: string): Promise<CustomProviderResponse>;
     /**
@@ -2054,12 +2111,18 @@ export interface GoTrueAdminCustomProvidersApi {
      * the issuer does not match.
      *
      * This function should only be called on a server. Never expose your `service_role` key in the browser.
+     *
+     * @category Auth
+     * @subcategory Auth Admin
      */
     updateProvider(identifier: string, params: UpdateCustomProviderParams): Promise<CustomProviderResponse>;
     /**
      * Deletes a custom provider.
      *
      * This function should only be called on a server. Never expose your `service_role` key in the browser.
+     *
+     * @category Auth
+     * @subcategory Auth Admin
      */
     deleteProvider(identifier: string): Promise<{
         data: null;
@@ -2204,6 +2267,7 @@ export interface AuthOAuthServerApi {
      * @returns Authorization details or redirect URL depending on consent status
      *
      * @category Auth
+     * @subcategory OAuth Server
      */
     getAuthorizationDetails(authorizationId: string): Promise<AuthOAuthAuthorizationDetailsResponse>;
     /**
@@ -2219,6 +2283,7 @@ export interface AuthOAuthServerApi {
      * @returns Redirect URL to send the user back to the OAuth client with authorization code
      *
      * @category Auth
+     * @subcategory OAuth Server
      */
     approveAuthorization(authorizationId: string, options?: {
         skipBrowserRedirect?: boolean;
@@ -2236,6 +2301,7 @@ export interface AuthOAuthServerApi {
      * @returns Redirect URL to send the user back to the OAuth client with error information
      *
      * @category Auth
+     * @subcategory OAuth Server
      */
     denyAuthorization(authorizationId: string, options?: {
         skipBrowserRedirect?: boolean;
@@ -2247,6 +2313,7 @@ export interface AuthOAuthServerApi {
      * @returns Response with array of OAuth grants with client information and granted scopes
      *
      * @category Auth
+     * @subcategory OAuth Server
      */
     listGrants(): Promise<AuthOAuthGrantsResponse>;
     /**
@@ -2261,10 +2328,184 @@ export interface AuthOAuthServerApi {
      * @returns Empty response on successful revocation
      *
      * @category Auth
+     * @subcategory OAuth Server
      */
     revokeGrant(options: {
         clientId: string;
     }): Promise<AuthOAuthRevokeGrantResponse>;
 }
+/** Response from POST /passkeys/registration/options */
+export type PasskeyRegistrationOptionsResponse = {
+    challenge_id: string;
+    options: ServerCredentialCreationOptions;
+    expires_at: number;
+};
+/** Request body for POST /passkeys/registration/verify */
+export type PasskeyRegistrationVerifyParams = {
+    challenge_id: string;
+    credential: RegistrationResponseJSON;
+};
+/** Response from POST /passkeys/registration/verify */
+export type PasskeyMetadata = {
+    id: string;
+    friendly_name?: string;
+    created_at: string;
+};
+/** Response from POST /passkeys/authentication/options */
+export type PasskeyAuthenticationOptionsResponse = {
+    challenge_id: string;
+    options: ServerCredentialRequestOptions;
+    expires_at: number;
+};
+/** Request body for POST /passkeys/authentication/verify */
+export type PasskeyAuthenticationVerifyParams = {
+    challenge_id: string;
+    credential: AuthenticationResponseJSON;
+};
+/** Item in the passkeys list (GET /passkeys/ and admin list) */
+export type PasskeyListItem = {
+    id: string;
+    friendly_name?: string;
+    created_at: string;
+    last_used_at?: string;
+};
+export type SignInWithPasskeyCredentials = {
+    options?: {
+        captchaToken?: string;
+        signal?: AbortSignal;
+    };
+};
+export type RegisterPasskeyCredentials = {
+    options?: {
+        signal?: AbortSignal;
+    };
+};
+export type VerifyPasskeyRegistrationParams = {
+    /** Challenge ID from startRegistration */
+    challengeId: string;
+    /** Serialized credential from navigator.credentials.create() */
+    credential: ServerCredentialResponse;
+};
+export type StartPasskeyAuthenticationParams = {
+    options?: {
+        captchaToken?: string;
+    };
+};
+export type VerifyPasskeyAuthenticationParams = {
+    /** Challenge ID from startAuthentication */
+    challengeId: string;
+    /** Serialized credential from navigator.credentials.get() */
+    credential: ServerCredentialResponse;
+};
+export type PasskeyUpdateParams = {
+    /** UUID of the passkey to update */
+    passkeyId: string;
+    /** New friendly name (max 120 chars) */
+    friendlyName: string;
+};
+export type PasskeyDeleteParams = {
+    /** UUID of the passkey to delete */
+    passkeyId: string;
+};
+export type AuthPasskeyRegistrationOptionsResponse = RequestResult<PasskeyRegistrationOptionsResponse>;
+export type AuthPasskeyRegistrationVerifyResponse = RequestResult<PasskeyMetadata, WebAuthnError | AuthError>;
+export type AuthPasskeyAuthenticationOptionsResponse = RequestResult<PasskeyAuthenticationOptionsResponse>;
+export type AuthPasskeyAuthenticationVerifyResponse = RequestResult<{
+    session: Session | null;
+    user: User | null;
+}, WebAuthnError | AuthError>;
+export type AuthPasskeyListResponse = RequestResult<PasskeyListItem[]>;
+export type AuthPasskeyUpdateResponse = RequestResult<PasskeyListItem>;
+export type AuthPasskeyDeleteResponse = RequestResult<null>;
+export type AuthPasskeyAdminListParams = {
+    userId: string;
+};
+export type AuthPasskeyAdminDeleteParams = {
+    userId: string;
+    passkeyId: string;
+};
+/**
+ * Lower-level two-step API and management methods for passkeys.
+ * Access via `supabase.auth.passkey`.
+ */
+export interface AuthPasskeyApi {
+    /**
+     * Starts the passkey registration ceremony. Fetches a registration challenge
+     * and credential creation options from the server. Used as the first step of
+     * a two-step registration flow when the caller wants to handle
+     * `navigator.credentials.create()` themselves.
+     *
+     * @category Auth
+     * @subcategory Auth Passkey
+     */
+    startRegistration(): Promise<AuthPasskeyRegistrationOptionsResponse>;
+    /**
+     * Verifies a passkey registration credential against a previously issued
+     * challenge. Used as the second step of a two-step registration flow.
+     *
+     * @category Auth
+     * @subcategory Auth Passkey
+     */
+    verifyRegistration(params: VerifyPasskeyRegistrationParams): Promise<AuthPasskeyRegistrationVerifyResponse>;
+    /**
+     * Starts the passkey authentication ceremony. Fetches an authentication
+     * challenge and credential request options from the server. Used as the
+     * first step of a two-step sign-in flow when the caller wants to handle
+     * `navigator.credentials.get()` themselves.
+     *
+     * @category Auth
+     * @subcategory Auth Passkey
+     */
+    startAuthentication(params?: StartPasskeyAuthenticationParams): Promise<AuthPasskeyAuthenticationOptionsResponse>;
+    /**
+     * Verifies a passkey authentication credential against a previously issued
+     * challenge. Used as the second step of a two-step sign-in flow.
+     *
+     * @category Auth
+     * @subcategory Auth Passkey
+     */
+    verifyAuthentication(params: VerifyPasskeyAuthenticationParams): Promise<AuthPasskeyAuthenticationVerifyResponse>;
+    /**
+     * Lists all passkeys registered for the currently signed-in user.
+     *
+     * @category Auth
+     * @subcategory Auth Passkey
+     */
+    list(): Promise<AuthPasskeyListResponse>;
+    /**
+     * Updates a passkey's friendly name.
+     *
+     * @category Auth
+     * @subcategory Auth Passkey
+     */
+    update(params: PasskeyUpdateParams): Promise<AuthPasskeyUpdateResponse>;
+    /**
+     * Deletes a passkey for the currently signed-in user.
+     *
+     * @category Auth
+     * @subcategory Auth Passkey
+     */
+    delete(params: PasskeyDeleteParams): Promise<AuthPasskeyDeleteResponse>;
+}
+export interface GoTrueAdminPasskeyApi {
+    /**
+     * Lists all passkeys registered for a specific user.
+     *
+     * This function should only be called on a server. Never expose your `service_role` key in the browser.
+     *
+     * @category Auth
+     * @subcategory Passkey Admin
+     */
+    listPasskeys(params: AuthPasskeyAdminListParams): Promise<AuthPasskeyListResponse>;
+    /**
+     * Deletes a specific passkey for a specific user.
+     *
+     * This function should only be called on a server. Never expose your `service_role` key in the browser.
+     *
+     * @category Auth
+     * @subcategory Passkey Admin
+     */
+    deletePasskey(params: AuthPasskeyAdminDeleteParams): Promise<AuthPasskeyDeleteResponse>;
+}
 export {};
 //# sourceMappingURL=types.d.ts.map