@depup/supabase__auth-js 2.110.8-depup.0 → 2.111.0-depup.0

package/dist/module/GoTrueClient.d.ts

@@ -609,7 +609,8 @@ export default class GoTrueClient {
      * {
      *   data: {
      *     provider: 'github',
-     *     url: <PROVIDER_URL_TO_REDIRECT_TO>
+     *     url: <PROVIDER_URL_TO_REDIRECT_TO>,
+     *     flowId: <PKCE_FLOW_ID_OR_NULL>
      *   },
      *   error: null
      * }
@@ -674,12 +675,29 @@ export default class GoTrueClient {
      *
      * @remarks
      * - Used when `flowType` is set to `pkce` in client options.
+     * - When several PKCE flows are in flight at once, pass `options.flowId` so
+     *   the code is exchanged with the verifier created by that specific flow.
+     *   The flow id is returned by `signInWithOAuth`, and with
+     *   `experimental.appendPkceFlowIdToRedirects` enabled it also arrives on
+     *   your callback URL as the reserved `sb_flow_id` query parameter (read
+     *   automatically in a browser).
+     * - When a flow id is present but its stored verifier is gone (evicted,
+     *   already used, or from another device), the call fails with a verifier
+     *   missing error instead of trying another flow's verifier — a mismatched
+     *   verifier would consume the single-use code. Without any flow id the
+     *   most recently stored verifier is used, as before.
      *
      * @example Exchange Auth Code
      * ```js
      * supabase.auth.exchangeCodeForSession('34e770dd-9ff9-416c-87fa-43b31d7ef225')
      * ```
      *
+     * @example Exchange Auth Code for a specific flow (e.g. in a server-side callback handler)
+     * ```js
+     * const flowId = requestUrl.searchParams.get('sb_flow_id')
+     * supabase.auth.exchangeCodeForSession(code, flowId ? { flowId } : undefined)
+     * ```
+     *
      * @exampleResponse Exchange Auth Code
      * ```json
      * {
@@ -837,7 +855,9 @@ export default class GoTrueClient {
      * }
      * ```
      */
-    exchangeCodeForSession(authCode: string): Promise<AuthTokenResponse>;
+    exchangeCodeForSession(authCode: string, options?: {
+        flowId?: string;
+    }): Promise<AuthTokenResponse>;
     /**
      * Signs in a user by verifying a message signed by the user's private key.
      * Supports Ethereum (via Sign-In-With-Ethereum) & Solana (Sign-In-With-Solana) standards,
@@ -2382,6 +2402,19 @@ export default class GoTrueClient {
      * @param options.queryParams An object of key-value pairs containing query parameters granted to the OAuth application.
      */
     private _getUrlForProvider;
+    /**
+     * Appends the reserved flow id parameter to a redirect URL so the callback
+     * can be matched to the verifier stored for its flow. Opt-in via
+     * `experimental.appendPkceFlowIdToRedirects`: redirect URLs are validated
+     * against the project's allow list including the query string, so an extra
+     * parameter can stop exact (non-wildcard) entries from matching.
+     */
+    private _maybeAppendFlowIdToRedirect;
+    /**
+     * Generates and stores a PKCE challenge/verifier pair for a new flow,
+     * logging any pending verifier the bounded slot ring evicts.
+     */
+    private _getCodeChallengeAndMethod;
     private _unenroll;
     /**
      * {@link GoTrueMFAApi#enroll}

package/dist/module/GoTrueClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GoTrueClient.d.ts","sourceRoot":"","sources":["../../src/GoTrueClient.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,kBAAkB,CAAA;AAW7C,OAAO,EACL,SAAS,EAgBV,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,KAAK,EAMN,MAAM,aAAa,CAAA;AACpB,OAAO,EAIL,QAAQ,EAgBT,MAAM,eAAe,CAAA;AAOtB,OAAO,KAAK,EACV,eAAe,EAEf,YAAY,EAcZ,eAAe,EACf,YAAY,EAEZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EAItB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,GAAG,EACH,SAAS,EACT,UAAU,EACV,QAAQ,EAgBR,aAAa,EACb,kBAAkB,EAOlB,YAAY,EACZ,OAAO,EACP,4BAA4B,EAC5B,4BAA4B,EAC5B,0BAA0B,EAC1B,6BAA6B,EAC7B,iCAAiC,EACjC,aAAa,EACb,OAAO,EACP,6BAA6B,EAG7B,WAAW,EAEX,YAAY,EACZ,gBAAgB,EAChB,IAAI,EACJ,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAO1B,qCAAqC,EAErC,uCAAuC,EAIxC,MAAM,aAAa,CAAA;AAmEpB,MAAM,CAAC,OAAO,OAAO,YAAY;IAC/B,OAAO,CAAC,MAAM,CAAC,cAAc,CAA6B;IAE1D,OAAO,CAAC,UAAU,CAAQ;IAE1B;;;OAGG;IACH,KAAK,EAAE,cAAc,CAAA;IACrB;;OAEG;IACH,GAAG,EAAE,YAAY,CAAA;IACjB;;;;OAIG;IACH,KAAK,EAAE,kBAAkB,CAAA;IACzB;;;;;OAKG;IACH,OAAO,EAAE,cAAc,CAAA;IACvB;;OAEG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,CAAA;IAE5B,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAA;IAEhC;;OAEG;IACH,SAAS,KAAK,IAAI,IAIQ;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAFxC;IAED,SAAS,KAAK,IAAI,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,EAExC;IAED,SAAS,KAAK,cAAc,IAIQ,MAAM,CAFzC;IAED,SAAS,KAAK,cAAc,CAAC,KAAK,EAAE,MAAM,EAEzC;IAED,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAA;IACnC,SAAS,CAAC,cAAc,EAAE,OAAO,CAAA;IACjC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAA;IACnC;;OAEG;IACH,SAAS,CAAC,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAO;IACrD,SAAS,CAAC,aAAa,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAO;IAChE,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,YAAY,CAAC,CAAY;IAC7E,SAAS,CAAC,iBAAiB,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,GAAG,IAAI,CAAO;IACzE,SAAS,CAAC,sBAAsB,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,GAAG,IAAI,CAAO;IAC7E,SAAS,CAAC,yBAAyB,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAO;IACvE,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAO;IAC5E;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,kBAAkB,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAA;QACpB,MAAM,EAAE,sBAAsB,CAAA;QAC9B,SAAS,EAAE,MAAM,CAAA;KAClB,GAAG,IAAI,CAAO;IACf;;;;;;OAMG;IACH,SAAS,CAAC,oBAAoB,SAAI;IAClC;;;;;OAKG;IACH,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAO;IACpE;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,yBAAyB,CAIjB;IAChB,SAAS,CAAC,kBAAkB,EACxB,OAAO,GACP,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE;QAAE,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,CAAO;IAC3E,SAAS,CAAC,GAAG,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,OAAO,EAAE;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KACtB,CAAA;IACD,SAAS,CAAC,4BAA4B,UAAQ;IAC9C,SAAS,CAAC,yBAAyB,UAAQ;IAC3C,SAAS,CAAC,KAAK,EAAE,KAAK,CAAA;IACtB;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAO;IACtC,SAAS,CAAC,YAAY,UAAQ;IAC9B,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAK;IAC5C,SAAS,CAAC,YAAY,EAAE,OAAO,CAAA;IAC/B;;OAEG;IACH,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACpC;;;OAGG;IACH,SAAS,CAAC,YAAY,EAAE,wBAAwB,CAAA;IAEhD;;OAEG;IACH,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAO;IAE1D,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAA;IACnC,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,CAAc;IAEzE;;;;;;;;;;;;;;;;;;;;;OAqBG;gBACS,OAAO,EAAE,mBAAmB;IAgJxC;;OAEG;IACI,qBAAqB,IAAI,OAAO;IAIvC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,MAAM;IAQd;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAsC7C;;;;;OAKG;YACW,WAAW;IAiFzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwEG;IACG,iBAAiB,CAAC,WAAW,CAAC,EAAE,4BAA4B,GAAG,OAAO,CAAC,YAAY,CAAC;IAiC1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgLG;IACG,MAAM,CAAC,WAAW,EAAE,6BAA6B,GAAG,OAAO,CAAC,YAAY,CAAC;IAuE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmIG;IACG,kBAAkB,CACtB,WAAW,EAAE,6BAA6B,GACzC,OAAO,CAAC,yBAAyB,CAAC;IA0DrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8EG;IACG,eAAe,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC;IAStF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyKG;IACG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAa1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuFG;IACG,cAAc,CAAC,WAAW,EAAE,eAAe,GAAG,OAAO,CACvD;QACE,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,IAAI,CAAA;SAAE,CAAA;QACtC,KAAK,EAAE,IAAI,CAAA;KACZ,GACD;QAAE,IAAI,EAAE;YAAE,OAAO,EAAE,IAAI,CAAC;YAAC,IAAI,EAAE,IAAI,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CAC5D;YAaa,kBAAkB;YAyIlB,gBAAgB;YA0LhB,uBAAuB;IA2DrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0EG;IACG,iBAAiB,CAAC,WAAW,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAoC9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4EG;IACG,aAAa,CAAC,WAAW,EAAE,iCAAiC,GAAG,OAAO,CAAC,eAAe,CAAC;IAsD7F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwIG;IACG,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;IA+C/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoDG;IACG,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IA0ChE;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;YAa/B,eAAe;IAwB7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0DG;IACG,MAAM,CAAC,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC;IAuDjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoFG;IACG,UAAU;cAqGA;YACJ,OAAO,EAAE,OAAO,CAAA;SACjB;eACM,IAAI;;cAGL;YACJ,OAAO,EAAE,IAAI,CAAA;SACd;eACM,SAAS;;cAGV;YACJ,OAAO,EAAE,IAAI,CAAA;SACd;eACM,IAAI;;IAnGrB;;;;;;OAMG;YACW,YAAY;IAoE1B;;;;OAIG;YACW,WAAW;IAsCzB;;;;OAIG;YACW,aAAa;IAgI3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2EG;IACG,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAwBpC,QAAQ;IA4CtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiHG;IACG,UAAU,CACd,UAAU,EAAE,cAAc,EAC1B,OAAO,GAAE;QACP,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAChC,GACL,OAAO,CAAC,YAAY,CAAC;cAaR,WAAW,CACzB,UAAU,EAAE,cAAc,EAC1B,OAAO,GAAE;QACP,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAChC,GACL,OAAO,CAAC,YAAY,CAAC;IAiDxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2HG;IACG,UAAU,CAAC,cAAc,EAAE;QAC/B,YAAY,EAAE,MAAM,CAAA;QACpB,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,YAAY,CAAC;cAaT,WAAW,CAAC,cAAc,EAAE;QAC1C,YAAY,EAAE,MAAM,CAAA;QACpB,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,YAAY,CAAC;IAuDzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4HG;IACG,cAAc,CAAC,cAAc,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;cAavE,eAAe,CAAC,cAAc,CAAC,EAAE;QAC/C,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,YAAY,CAAC;IAoCzB;;OAEG;YACW,kBAAkB;IAsIhC;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IAShC;;OAEG;YACW,eAAe;IAS7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACG,OAAO,CAAC,OAAO,GAAE,OAA6B,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;cAa3E,QAAQ,CACtB,EAAE,KAAK,EAAE,GAAE,OAA6B,GACvC,OAAO,CAAC;QAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;IAqCvC;;;;;OAKG;IACH,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG;QACtF,IAAI,EAAE;YAAE,YAAY,EAAE,YAAY,CAAA;SAAE,CAAA;KACrC;IAED;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG;QAC/F,IAAI,EAAE;YAAE,YAAY,EAAE,YAAY,CAAA;SAAE,CAAA;KACrC;YAsNa,mBAAmB;IA0BjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkEG;IACG,qBAAqB,CACzB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,YAAY,CAAC,EAAE,MAAM,CAAA;KACjB,GACL,OAAO,CACN;QACE,IAAI,EAAE,EAAE,CAAA;QACR,KAAK,EAAE,IAAI,CAAA;KACZ,GACD;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CACnC;IAgCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACG,iBAAiB,IAAI,OAAO,CAC9B;QACE,IAAI,EAAE;YACJ,UAAU,EAAE,YAAY,EAAE,CAAA;SAC3B,CAAA;QACD,KAAK,EAAE,IAAI,CAAA;KACZ,GACD;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CACnC;IAaD;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC;IAEnF;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;YAqC3E,iBAAiB;YAoCjB,mBAAmB;IAmDjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,cAAc,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CACjD;QACE,IAAI,EAAE,EAAE,CAAA;QACR,KAAK,EAAE,IAAI,CAAA;KACZ,GACD;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CACnC;IAyBD;;;OAGG;YACW,mBAAmB;IA+CjC,OAAO,CAAC,eAAe;YAWT,qBAAqB;IAyBnC;;;OAGG;YACW,kBAAkB;YAkIlB,iBAAiB;YAgLjB,qBAAqB;IAkDnC;;;OAGG;YACW,YAAY;YAuCZ,cAAc;IAyB5B;;;;;OAKG;IACH,OAAO,CAAC,gCAAgC;IAexC;;;OAGG;YACW,iBAAiB;IA0C/B;;;OAGG;YACW,gBAAgB;IAkB9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACG,gBAAgB;IAKtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACG,eAAe;IAKrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B;;OAEG;YACW,qBAAqB;IAoGnC;;;;OAIG;YACW,uBAAuB;IA+BrC;;OAEG;YACW,oBAAoB;IA6ClC;;;;;OAKG;YACW,kBAAkB;YAwClB,SAAS;IAqBvB;;OAEG;YACW,OAAO;IA4CrB;;OAEG;YACW,OAAO;IAsFrB;;OAEG;YACW,UAAU;IA4FxB;;OAEG;YACW,mBAAmB;IAiBjC;;OAEG;YACW,YAAY;IA8B1B;;OAEG;YACW,+BAA+B;IA8E7C;;;;;;;OAOG;YACW,wBAAwB;IAsCtC;;;OAGG;YACW,qBAAqB;IAiDnC;;;OAGG;YACW,kBAAkB;IAiDhC;;;OAGG;YACW,gBAAgB;IA+B9B;;;OAGG;YACW,iBAAiB;YAmCjB,QAAQ;IAsCtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgEG;IACG,SAAS,CACb,GAAG,CAAC,EAAE,MAAM,EACZ,OAAO,GAAE;QACP;;WAEG;QACH,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;QAEZ,uFAAuF;QACvF,YAAY,CAAC,EAAE,OAAO,CAAA;QAEtB,+GAA+G;QAC/G,IAAI,CAAC,EAAE;YAAE,IAAI,EAAE,GAAG,EAAE,CAAA;SAAE,CAAA;KAClB,GACL,OAAO,CACN;QACE,IAAI,EAAE;YAAE,MAAM,EAAE,UAAU,CAAC;YAAC,MAAM,EAAE,SAAS,CAAC;YAAC,SAAS,EAAE,UAAU,CAAA;SAAE,CAAA;QACtE,KAAK,EAAE,IAAI,CAAA;KACZ,GACD;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,GAChC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,CAC9B;IA2FD;;;;;;;;;OASG;IACG,iBAAiB,CACrB,WAAW,CAAC,EAAE,4BAA4B,GACzC,OAAO,CAAC,uCAAuC,CAAC;IA8CnD;;;;;;;;;OASG;IACG,eAAe,CACnB,WAAW,CAAC,EAAE,0BAA0B,GACvC,OAAO,CAAC,qCAAqC,CAAC;IA4CjD;;;OAGG;YACW,yBAAyB;IAqCvC;;;OAGG;YACW,0BAA0B;IA0CxC;;;OAGG;YACW,2BAA2B;IA4BzC;;;OAGG;YACW,4BAA4B;IAkC1C;;OAEG;YACW,aAAa;IAgC3B;;OAEG;YACW,cAAc;IAqC5B;;OAEG;YACW,cAAc;CAoC7B"}
+{"version":3,"file":"GoTrueClient.d.ts","sourceRoot":"","sources":["../../src/GoTrueClient.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,kBAAkB,CAAA;AAY7C,OAAO,EACL,SAAS,EAgBV,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,KAAK,EAMN,MAAM,aAAa,CAAA;AACpB,OAAO,EAKL,QAAQ,EAqBT,MAAM,eAAe,CAAA;AAOtB,OAAO,KAAK,EACV,eAAe,EAEf,YAAY,EAcZ,eAAe,EACf,YAAY,EAEZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EAItB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,GAAG,EACH,SAAS,EACT,UAAU,EACV,QAAQ,EAgBR,aAAa,EACb,kBAAkB,EAOlB,YAAY,EACZ,OAAO,EACP,4BAA4B,EAC5B,4BAA4B,EAC5B,0BAA0B,EAC1B,6BAA6B,EAC7B,iCAAiC,EACjC,aAAa,EACb,OAAO,EACP,6BAA6B,EAG7B,WAAW,EAEX,YAAY,EACZ,gBAAgB,EAChB,IAAI,EACJ,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAO1B,qCAAqC,EAErC,uCAAuC,EAIxC,MAAM,aAAa,CAAA;AAmEpB,MAAM,CAAC,OAAO,OAAO,YAAY;IAC/B,OAAO,CAAC,MAAM,CAAC,cAAc,CAA6B;IAE1D,OAAO,CAAC,UAAU,CAAQ;IAE1B;;;OAGG;IACH,KAAK,EAAE,cAAc,CAAA;IACrB;;OAEG;IACH,GAAG,EAAE,YAAY,CAAA;IACjB;;;;OAIG;IACH,KAAK,EAAE,kBAAkB,CAAA;IACzB;;;;;OAKG;IACH,OAAO,EAAE,cAAc,CAAA;IACvB;;OAEG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,CAAA;IAE5B,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAA;IAEhC;;OAEG;IACH,SAAS,KAAK,IAAI,IAIQ;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAFxC;IAED,SAAS,KAAK,IAAI,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,EAExC;IAED,SAAS,KAAK,cAAc,IAIQ,MAAM,CAFzC;IAED,SAAS,KAAK,cAAc,CAAC,KAAK,EAAE,MAAM,EAEzC;IAED,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAA;IACnC,SAAS,CAAC,cAAc,EAAE,OAAO,CAAA;IACjC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAA;IACnC;;OAEG;IACH,SAAS,CAAC,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAO;IACrD,SAAS,CAAC,aAAa,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAO;IAChE,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,YAAY,CAAC,CAAY;IAC7E,SAAS,CAAC,iBAAiB,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,GAAG,IAAI,CAAO;IACzE,SAAS,CAAC,sBAAsB,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,GAAG,IAAI,CAAO;IAC7E,SAAS,CAAC,yBAAyB,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAO;IACvE,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAO;IAC5E;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,kBAAkB,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAA;QACpB,MAAM,EAAE,sBAAsB,CAAA;QAC9B,SAAS,EAAE,MAAM,CAAA;KAClB,GAAG,IAAI,CAAO;IACf;;;;;;OAMG;IACH,SAAS,CAAC,oBAAoB,SAAI;IAClC;;;;;OAKG;IACH,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAO;IACpE;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,yBAAyB,CAIjB;IAChB,SAAS,CAAC,kBAAkB,EACxB,OAAO,GACP,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE;QAAE,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,CAAO;IAC3E,SAAS,CAAC,GAAG,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,OAAO,EAAE;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KACtB,CAAA;IACD,SAAS,CAAC,4BAA4B,UAAQ;IAC9C,SAAS,CAAC,yBAAyB,UAAQ;IAC3C,SAAS,CAAC,KAAK,EAAE,KAAK,CAAA;IACtB;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAO;IACtC,SAAS,CAAC,YAAY,UAAQ;IAC9B,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAK;IAC5C,SAAS,CAAC,YAAY,EAAE,OAAO,CAAA;IAC/B;;OAEG;IACH,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACpC;;;OAGG;IACH,SAAS,CAAC,YAAY,EAAE,wBAAwB,CAAA;IAEhD;;OAEG;IACH,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAO;IAE1D,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAA;IACnC,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,CAAc;IAEzE;;;;;;;;;;;;;;;;;;;;;OAqBG;gBACS,OAAO,EAAE,mBAAmB;IAgJxC;;OAEG;IACI,qBAAqB,IAAI,OAAO;IAIvC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,MAAM;IAQd;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAsC7C;;;;;OAKG;YACW,WAAW;IAiFzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwEG;IACG,iBAAiB,CAAC,WAAW,CAAC,EAAE,4BAA4B,GAAG,OAAO,CAAC,YAAY,CAAC;IAiC1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgLG;IACG,MAAM,CAAC,WAAW,EAAE,6BAA6B,GAAG,OAAO,CAAC,YAAY,CAAC;IAqE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmIG;IACG,kBAAkB,CACtB,WAAW,EAAE,6BAA6B,GACzC,OAAO,CAAC,yBAAyB,CAAC;IA0DrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+EG;IACG,eAAe,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC;IAStF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0LG;IACG,sBAAsB,CAC1B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,iBAAiB,CAAC;IAa7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuFG;IACG,cAAc,CAAC,WAAW,EAAE,eAAe,GAAG,OAAO,CACvD;QACE,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,IAAI,CAAA;SAAE,CAAA;QACtC,KAAK,EAAE,IAAI,CAAA;KACZ,GACD;QAAE,IAAI,EAAE;YAAE,OAAO,EAAE,IAAI,CAAC;YAAC,IAAI,EAAE,IAAI,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CAC5D;YAaa,kBAAkB;YAyIlB,gBAAgB;YA0LhB,uBAAuB;IAoFrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0EG;IACG,iBAAiB,CAAC,WAAW,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAoC9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4EG;IACG,aAAa,CAAC,WAAW,EAAE,iCAAiC,GAAG,OAAO,CAAC,eAAe,CAAC;IAoD7F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwIG;IACG,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;IA+C/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoDG;IACG,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAwChE;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;YAa/B,eAAe;IAwB7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0DG;IACG,MAAM,CAAC,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC;IAqDjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoFG;IACG,UAAU;cAqGA;YACJ,OAAO,EAAE,OAAO,CAAA;SACjB;eACM,IAAI;;cAGL;YACJ,OAAO,EAAE,IAAI,CAAA;SACd;eACM,SAAS;;cAGV;YACJ,OAAO,EAAE,IAAI,CAAA;SACd;eACM,IAAI;;IAnGrB;;;;;;OAMG;YACW,YAAY;IAoE1B;;;;OAIG;YACW,WAAW;IAsCzB;;;;OAIG;YACW,aAAa;IAgI3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2EG;IACG,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAwBpC,QAAQ;IA2CtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiHG;IACG,UAAU,CACd,UAAU,EAAE,cAAc,EAC1B,OAAO,GAAE;QACP,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAChC,GACL,OAAO,CAAC,YAAY,CAAC;cAaR,WAAW,CACzB,UAAU,EAAE,cAAc,EAC1B,OAAO,GAAE;QACP,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAChC,GACL,OAAO,CAAC,YAAY,CAAC;IA+CxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2HG;IACG,UAAU,CAAC,cAAc,EAAE;QAC/B,YAAY,EAAE,MAAM,CAAA;QACpB,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,YAAY,CAAC;cAaT,WAAW,CAAC,cAAc,EAAE;QAC1C,YAAY,EAAE,MAAM,CAAA;QACpB,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,YAAY,CAAC;IAuDzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4HG;IACG,cAAc,CAAC,cAAc,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;cAavE,eAAe,CAAC,cAAc,CAAC,EAAE;QAC/C,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,YAAY,CAAC;IAoCzB;;OAEG;YACW,kBAAkB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IAShC;;OAEG;YACW,eAAe;IAqB7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACG,OAAO,CAAC,OAAO,GAAE,OAA6B,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;cAa3E,QAAQ,CACtB,EAAE,KAAK,EAAE,GAAE,OAA6B,GACvC,OAAO,CAAC;QAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;IAoCvC;;;;;OAKG;IACH,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG;QACtF,IAAI,EAAE;YAAE,YAAY,EAAE,YAAY,CAAA;SAAE,CAAA;KACrC;IAED;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG;QAC/F,IAAI,EAAE;YAAE,YAAY,EAAE,YAAY,CAAA;SAAE,CAAA;KACrC;YAsNa,mBAAmB;IAkCjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkEG;IACG,qBAAqB,CACzB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,YAAY,CAAC,EAAE,MAAM,CAAA;KACjB,GACL,OAAO,CACN;QACE,IAAI,EAAE,EAAE,CAAA;QACR,KAAK,EAAE,IAAI,CAAA;KACZ,GACD;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CACnC;IA+BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACG,iBAAiB,IAAI,OAAO,CAC9B;QACE,IAAI,EAAE;YACJ,UAAU,EAAE,YAAY,EAAE,CAAA;SAC3B,CAAA;QACD,KAAK,EAAE,IAAI,CAAA;KACZ,GACD;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CACnC;IAaD;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC;IAEnF;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;YAsC3E,iBAAiB;YAyCjB,mBAAmB;IAmDjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,cAAc,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CACjD;QACE,IAAI,EAAE,EAAE,CAAA;QACR,KAAK,EAAE,IAAI,CAAA;KACZ,GACD;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CACnC;IAyBD;;;OAGG;YACW,mBAAmB;IA+CjC,OAAO,CAAC,eAAe;YAWT,qBAAqB;IAyBnC;;;OAGG;YACW,kBAAkB;YAkIlB,iBAAiB;YAgLjB,qBAAqB;IAkDnC;;;OAGG;YACW,YAAY;YAuCZ,cAAc;IAyB5B;;;;;OAKG;IACH,OAAO,CAAC,gCAAgC;IAexC;;;OAGG;YACW,iBAAiB;IA0C/B;;;OAGG;YACW,gBAAgB;IAkB9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACG,gBAAgB;IAKtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACG,eAAe;IAKrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B;;OAEG;YACW,qBAAqB;IAoGnC;;;;OAIG;YACW,uBAAuB;IA+BrC;;OAEG;YACW,oBAAoB;IA6ClC;;;;;OAKG;YACW,kBAAkB;IA4ChC;;;;;;OAMG;IACH,OAAO,CAAC,4BAA4B;IAUpC;;;OAGG;YACW,0BAA0B;YAgB1B,SAAS;IAqBvB;;OAEG;YACW,OAAO;IA4CrB;;OAEG;YACW,OAAO;IAsFrB;;OAEG;YACW,UAAU;IA4FxB;;OAEG;YACW,mBAAmB;IAiBjC;;OAEG;YACW,YAAY;IA8B1B;;OAEG;YACW,+BAA+B;IA8E7C;;;;;;;OAOG;YACW,wBAAwB;IAsCtC;;;OAGG;YACW,qBAAqB;IAiDnC;;;OAGG;YACW,kBAAkB;IAiDhC;;;OAGG;YACW,gBAAgB;IA+B9B;;;OAGG;YACW,iBAAiB;YAmCjB,QAAQ;IAsCtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgEG;IACG,SAAS,CACb,GAAG,CAAC,EAAE,MAAM,EACZ,OAAO,GAAE;QACP;;WAEG;QACH,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;QAEZ,uFAAuF;QACvF,YAAY,CAAC,EAAE,OAAO,CAAA;QAEtB,+GAA+G;QAC/G,IAAI,CAAC,EAAE;YAAE,IAAI,EAAE,GAAG,EAAE,CAAA;SAAE,CAAA;KAClB,GACL,OAAO,CACN;QACE,IAAI,EAAE;YAAE,MAAM,EAAE,UAAU,CAAC;YAAC,MAAM,EAAE,SAAS,CAAC;YAAC,SAAS,EAAE,UAAU,CAAA;SAAE,CAAA;QACtE,KAAK,EAAE,IAAI,CAAA;KACZ,GACD;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,GAChC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,CAC9B;IA2FD;;;;;;;;;OASG;IACG,iBAAiB,CACrB,WAAW,CAAC,EAAE,4BAA4B,GACzC,OAAO,CAAC,uCAAuC,CAAC;IA8CnD;;;;;;;;;OASG;IACG,eAAe,CACnB,WAAW,CAAC,EAAE,0BAA0B,GACvC,OAAO,CAAC,qCAAqC,CAAC;IA4CjD;;;OAGG;YACW,yBAAyB;IAqCvC;;;OAGG;YACW,0BAA0B;IA0CxC;;;OAGG;YACW,2BAA2B;IA4BzC;;;OAGG;YACW,4BAA4B;IAkC1C;;OAEG;YACW,aAAa;IAgC3B;;OAEG;YACW,cAAc;IAqC5B;;OAEG;YACW,cAAc;CAoC7B"}

package/dist/module/GoTrueClient.js

@@ -1,8 +1,8 @@
 import GoTrueAdminApi from './GoTrueAdminApi';
-import { AUTO_REFRESH_TICK_DURATION_MS, AUTO_REFRESH_TICK_THRESHOLD, DEFAULT_HEADERS, EXPIRY_MARGIN_MS, GOTRUE_URL, JWKS_TTL, REFRESH_FAILURE_COOLDOWN_MS, STORAGE_KEY, } from './lib/constants';
+import { AUTO_REFRESH_TICK_DURATION_MS, AUTO_REFRESH_TICK_THRESHOLD, DEFAULT_HEADERS, EXPIRY_MARGIN_MS, GOTRUE_URL, JWKS_TTL, PKCE_FLOW_ID_PARAM, REFRESH_FAILURE_COOLDOWN_MS, STORAGE_KEY, } from './lib/constants';
 import { AuthImplicitGrantRedirectError, AuthInvalidCredentialsError, AuthInvalidJwtError, AuthInvalidTokenResponseError, AuthPKCECodeVerifierMissingError, AuthPKCEGrantCodeExchangeError, AuthRefreshDiscardedError, AuthSessionMissingError, AuthUnknownError, isAuthApiError, isAuthError, isAuthImplicitGrantRedirectError, isAuthRefreshDiscardedError, isAuthRetryableFetchError, isAuthSessionMissingError, } from './lib/errors';
 import { _request, _sessionResponse, _sessionResponsePassword, _ssoResponse, _userResponse, } from './lib/fetch';
-import { assertPasskeyExperimentalEnabled, decodeJWT, deepClone, Deferred, generateCallbackId, getAlgorithm, getCodeChallengeAndMethod, getItemAsync, insecureUserWarningProxy, isBrowser, parseParametersFromURL, removeItemAsync, resolveFetch, retryable, setItemAsync, sleep, supportsLocalStorage, userNotAvailableProxy, validateExp, } from './lib/helpers';
+import { appendFlowIdToRedirectTo, assertPasskeyExperimentalEnabled, decodeJWT, deepClone, Deferred, generateCallbackId, getAlgorithm, getCodeChallengeAndMethod, getItemAsync, insecureUserWarningProxy, isBrowser, parseParametersFromURL, pkceVerifierSlotKey, removeAllPKCEVerifiers, removeItemAsync, removePKCEVerifier, resolveFetch, retrievePKCEVerifier, retryable, setItemAsync, sleep, supportsLocalStorage, userNotAvailableProxy, validateExp, validatePKCEFlowId, } from './lib/helpers';
 import { memoryLocalStorageAdapter } from './lib/local-storage';
 import { LockAcquireTimeoutError } from './lib/locks';
 import { polyfillGlobalThis } from './lib/polyfills';
@@ -714,6 +714,7 @@ class GoTrueClient {
      */
     async signUp(credentials) {
         var _a, _b, _c;
+        let flowId = null;
         try {
             let res;
             if ('email' in credentials) {
@@ -722,11 +723,11 @@ class GoTrueClient {
                 let codeChallengeMethod = null;
                 if (this.flowType === 'pkce') {
                     ;
-                    [codeChallenge, codeChallengeMethod] = await getCodeChallengeAndMethod(this.storage, this.storageKey);
+                    [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod();
                 }
                 res = await _request(this.fetch, 'POST', `${this.url}/signup`, {
                     headers: this.headers,
-                    redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
+                    redirectTo: this._maybeAppendFlowIdToRedirect(options === null || options === void 0 ? void 0 : options.emailRedirectTo, flowId),
                     body: {
                         email,
                         password,
@@ -757,7 +758,7 @@ class GoTrueClient {
             }
             const { data, error } = res;
             if (error || !data) {
-                await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+                await removePKCEVerifier(this.storage, this.storageKey, flowId);
                 return this._returnResult({ data: { user: null, session: null }, error: error });
             }
             const session = data.session;
@@ -769,7 +770,7 @@ class GoTrueClient {
             return this._returnResult({ data: { user, session }, error: null });
         }
         catch (error) {
-            await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+            await removePKCEVerifier(this.storage, this.storageKey, flowId);
             if (isAuthError(error)) {
                 return this._returnResult({ data: { user: null, session: null }, error });
             }
@@ -984,7 +985,8 @@ class GoTrueClient {
      * {
      *   data: {
      *     provider: 'github',
-     *     url: <PROVIDER_URL_TO_REDIRECT_TO>
+     *     url: <PROVIDER_URL_TO_REDIRECT_TO>,
+     *     flowId: <PKCE_FLOW_ID_OR_NULL>
      *   },
      *   error: null
      * }
@@ -1057,12 +1059,29 @@ class GoTrueClient {
      *
      * @remarks
      * - Used when `flowType` is set to `pkce` in client options.
+     * - When several PKCE flows are in flight at once, pass `options.flowId` so
+     *   the code is exchanged with the verifier created by that specific flow.
+     *   The flow id is returned by `signInWithOAuth`, and with
+     *   `experimental.appendPkceFlowIdToRedirects` enabled it also arrives on
+     *   your callback URL as the reserved `sb_flow_id` query parameter (read
+     *   automatically in a browser).
+     * - When a flow id is present but its stored verifier is gone (evicted,
+     *   already used, or from another device), the call fails with a verifier
+     *   missing error instead of trying another flow's verifier — a mismatched
+     *   verifier would consume the single-use code. Without any flow id the
+     *   most recently stored verifier is used, as before.
      *
      * @example Exchange Auth Code
      * ```js
      * supabase.auth.exchangeCodeForSession('34e770dd-9ff9-416c-87fa-43b31d7ef225')
      * ```
      *
+     * @example Exchange Auth Code for a specific flow (e.g. in a server-side callback handler)
+     * ```js
+     * const flowId = requestUrl.searchParams.get('sb_flow_id')
+     * supabase.auth.exchangeCodeForSession(code, flowId ? { flowId } : undefined)
+     * ```
+     *
      * @exampleResponse Exchange Auth Code
      * ```json
      * {
@@ -1220,15 +1239,15 @@ class GoTrueClient {
      * }
      * ```
      */
-    async exchangeCodeForSession(authCode) {
+    async exchangeCodeForSession(authCode, options) {
         await this.initializePromise;
         if (this.lock != null) {
             // TODO(v3): remove legacy lock path
             return this._acquireLock(this.lockAcquireTimeout, async () => {
-                return this._exchangeCodeForSession(authCode);
+                return this._exchangeCodeForSession(authCode, options);
             });
         }
-        return this._exchangeCodeForSession(authCode);
+        return this._exchangeCodeForSession(authCode, options);
     }
     /**
      * Signs in a user by verifying a message signed by the user's private key.
@@ -1570,8 +1589,23 @@ class GoTrueClient {
             throw error;
         }
     }
-    async _exchangeCodeForSession(authCode) {
-        const storageItem = await getItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+    async _exchangeCodeForSession(authCode, options) {
+        const hasExplicitFlowId = (options === null || options === void 0 ? void 0 : options.flowId) != null;
+        const requestedFlowId = hasExplicitFlowId
+            ? validatePKCEFlowId(options === null || options === void 0 ? void 0 : options.flowId)
+            : isBrowser()
+                ? validatePKCEFlowId(parseParametersFromURL(window.location.href)[PKCE_FLOW_ID_PARAM])
+                : null;
+        if (hasExplicitFlowId && !requestedFlowId) {
+            this._debug('#_exchangeCodeForSession()', 'provided flowId is not a valid flow id', options === null || options === void 0 ? void 0 : options.flowId);
+        }
+        // With a flow id (explicit or from the callback URL) the lookup is
+        // slot-only and a miss fails fast — see retrievePKCEVerifier. An invalid
+        // explicit flow id also fails fast rather than borrowing another flow's
+        // verifier.
+        const { verifier: storageItem, flowId } = hasExplicitFlowId && !requestedFlowId
+            ? { verifier: null, flowId: null }
+            : await retrievePKCEVerifier(this.storage, this.storageKey, requestedFlowId);
         const [codeVerifier, redirectType] = (storageItem !== null && storageItem !== void 0 ? storageItem : '').split('/');
         try {
             if (!codeVerifier && this.flowType === 'pkce') {
@@ -1585,7 +1619,7 @@ class GoTrueClient {
                 },
                 xform: _sessionResponse,
             });
-            await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+            await removePKCEVerifier(this.storage, this.storageKey, flowId);
             if (error) {
                 throw error;
             }
@@ -1603,7 +1637,7 @@ class GoTrueClient {
             return this._returnResult({ data: Object.assign(Object.assign({}, data), { redirectType: redirectType !== null && redirectType !== void 0 ? redirectType : null }), error });
         }
         catch (error) {
-            await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+            await removePKCEVerifier(this.storage, this.storageKey, flowId);
             if (isAuthError(error)) {
                 return this._returnResult({
                     data: { user: null, session: null, redirectType: null },
@@ -1802,6 +1836,7 @@ class GoTrueClient {
      */
     async signInWithOtp(credentials) {
         var _a, _b, _c, _d, _f;
+        let flowId = null;
         try {
             if ('email' in credentials) {
                 const { email, options } = credentials;
@@ -1809,7 +1844,7 @@ class GoTrueClient {
                 let codeChallengeMethod = null;
                 if (this.flowType === 'pkce') {
                     ;
-                    [codeChallenge, codeChallengeMethod] = await getCodeChallengeAndMethod(this.storage, this.storageKey);
+                    [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod();
                 }
                 const { error } = await _request(this.fetch, 'POST', `${this.url}/otp`, {
                     headers: this.headers,
@@ -1821,7 +1856,7 @@ class GoTrueClient {
                         code_challenge: codeChallenge,
                         code_challenge_method: codeChallengeMethod,
                     },
-                    redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
+                    redirectTo: this._maybeAppendFlowIdToRedirect(options === null || options === void 0 ? void 0 : options.emailRedirectTo, flowId),
                 });
                 return this._returnResult({ data: { user: null, session: null }, error });
             }
@@ -1845,7 +1880,7 @@ class GoTrueClient {
             throw new AuthInvalidCredentialsError('You must provide either an email or phone number.');
         }
         catch (error) {
-            await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+            await removePKCEVerifier(this.storage, this.storageKey, flowId);
             if (isAuthError(error)) {
                 return this._returnResult({ data: { user: null, session: null }, error });
             }
@@ -2080,29 +2115,30 @@ class GoTrueClient {
      * ```
      */
     async signInWithSSO(params) {
-        var _a, _b, _c, _d, _f;
+        var _a, _b, _c, _d;
+        let flowId = null;
         try {
             let codeChallenge = null;
             let codeChallengeMethod = null;
             if (this.flowType === 'pkce') {
                 ;
-                [codeChallenge, codeChallengeMethod] = await getCodeChallengeAndMethod(this.storage, this.storageKey);
+                [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod();
             }
             const result = await _request(this.fetch, 'POST', `${this.url}/sso`, {
-                body: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, ('providerId' in params ? { provider_id: params.providerId } : null)), ('domain' in params ? { domain: params.domain } : null)), { redirect_to: (_b = (_a = params.options) === null || _a === void 0 ? void 0 : _a.redirectTo) !== null && _b !== void 0 ? _b : undefined }), (((_c = params === null || params === void 0 ? void 0 : params.options) === null || _c === void 0 ? void 0 : _c.captchaToken)
+                body: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, ('providerId' in params ? { provider_id: params.providerId } : null)), ('domain' in params ? { domain: params.domain } : null)), { redirect_to: this._maybeAppendFlowIdToRedirect((_a = params.options) === null || _a === void 0 ? void 0 : _a.redirectTo, flowId) }), (((_b = params === null || params === void 0 ? void 0 : params.options) === null || _b === void 0 ? void 0 : _b.captchaToken)
                     ? { gotrue_meta_security: { captcha_token: params.options.captchaToken } }
                     : null)), { skip_http_redirect: true, code_challenge: codeChallenge, code_challenge_method: codeChallengeMethod }),
                 headers: this.headers,
                 xform: _ssoResponse,
             });
             // Automatically redirect in browser unless skipBrowserRedirect is true
-            if (((_d = result.data) === null || _d === void 0 ? void 0 : _d.url) && isBrowser() && !((_f = params.options) === null || _f === void 0 ? void 0 : _f.skipBrowserRedirect)) {
+            if (((_c = result.data) === null || _c === void 0 ? void 0 : _c.url) && isBrowser() && !((_d = params.options) === null || _d === void 0 ? void 0 : _d.skipBrowserRedirect)) {
                 window.location.assign(result.data.url);
             }
             return this._returnResult(result);
         }
         catch (error) {
-            await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+            await removePKCEVerifier(this.storage, this.storageKey, flowId);
             if (isAuthError(error)) {
                 return this._returnResult({ data: null, error });
             }
@@ -2222,6 +2258,7 @@ class GoTrueClient {
      * ```
      */
     async resend(credentials) {
+        let flowId = null;
         try {
             const endpoint = `${this.url}/resend`;
             if ('email' in credentials) {
@@ -2230,7 +2267,7 @@ class GoTrueClient {
                 let codeChallengeMethod = null;
                 if (this.flowType === 'pkce') {
                     ;
-                    [codeChallenge, codeChallengeMethod] = await getCodeChallengeAndMethod(this.storage, this.storageKey);
+                    [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod();
                 }
                 const { error } = await _request(this.fetch, 'POST', endpoint, {
                     headers: this.headers,
@@ -2241,10 +2278,10 @@ class GoTrueClient {
                         code_challenge: codeChallenge,
                         code_challenge_method: codeChallengeMethod,
                     },
-                    redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
+                    redirectTo: this._maybeAppendFlowIdToRedirect(options === null || options === void 0 ? void 0 : options.emailRedirectTo, flowId),
                 });
                 if (error) {
-                    await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+                    await removePKCEVerifier(this.storage, this.storageKey, flowId);
                 }
                 return this._returnResult({ data: { user: null, session: null }, error });
             }
@@ -2266,7 +2303,7 @@ class GoTrueClient {
             throw new AuthInvalidCredentialsError('You must provide either an email or phone number and a type');
         }
         catch (error) {
-            await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+            await removePKCEVerifier(this.storage, this.storageKey, flowId);
             if (isAuthError(error)) {
                 return this._returnResult({ data: { user: null, session: null }, error });
             }
@@ -2668,7 +2705,6 @@ class GoTrueClient {
                     // JWT contains a `session_id` which does not correspond to an active
                     // session in the database, indicating the user is signed out.
                     await this._removeSession();
-                    await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
                 }
                 return this._returnResult({ data: { user: null }, error });
             }
@@ -2800,6 +2836,7 @@ class GoTrueClient {
         return await this._updateUser(attributes, options);
     }
     async _updateUser(attributes, options = {}) {
+        let flowId = null;
         try {
             return await this._useSession(async (result) => {
                 const { data: sessionData, error: sessionError } = result;
@@ -2814,11 +2851,11 @@ class GoTrueClient {
                 let codeChallengeMethod = null;
                 if (this.flowType === 'pkce' && attributes.email != null) {
                     ;
-                    [codeChallenge, codeChallengeMethod] = await getCodeChallengeAndMethod(this.storage, this.storageKey);
+                    [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod();
                 }
                 const { data, error: userError } = await _request(this.fetch, 'PUT', `${this.url}/user`, {
                     headers: this.headers,
-                    redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
+                    redirectTo: this._maybeAppendFlowIdToRedirect(options === null || options === void 0 ? void 0 : options.emailRedirectTo, flowId),
                     body: Object.assign(Object.assign({}, attributes), { code_challenge: codeChallenge, code_challenge_method: codeChallengeMethod }),
                     jwt: session.access_token,
                     xform: _userResponse,
@@ -2833,7 +2870,7 @@ class GoTrueClient {
             });
         }
         catch (error) {
-            await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+            await removePKCEVerifier(this.storage, this.storageKey, flowId);
             if (isAuthError(error)) {
                 return this._returnResult({ data: { user: null }, error });
             }
@@ -3226,11 +3263,14 @@ class GoTrueClient {
                 this._debug('#_initialize()', 'begin', 'is PKCE flow', true);
                 if (!params.code)
                     throw new AuthPKCEGrantCodeExchangeError('No code detected.');
-                const { data, error } = await this._exchangeCodeForSession(params.code);
+                const { data, error } = await this._exchangeCodeForSession(params.code, {
+                    flowId: params[PKCE_FLOW_ID_PARAM],
+                });
                 if (error)
                     throw error;
                 const url = new URL(window.location.href);
                 url.searchParams.delete('code');
+                url.searchParams.delete(PKCE_FLOW_ID_PARAM);
                 window.history.replaceState(window.history.state, '', url.toString());
                 return {
                     data: { session: data.session, redirectType: (_a = data.redirectType) !== null && _a !== void 0 ? _a : null },
@@ -3300,8 +3340,16 @@ class GoTrueClient {
      * Checks if the current URL and backing storage contain parameters given by a PKCE flow
      */
     async _isPKCECallback(params) {
+        if (!params.code) {
+            return false;
+        }
+        const flowId = validatePKCEFlowId(params[PKCE_FLOW_ID_PARAM]);
+        if (flowId &&
+            (await getItemAsync(this.storage, pkceVerifierSlotKey(this.storageKey, flowId)))) {
+            return true;
+        }
         const currentStorageContent = await getItemAsync(this.storage, `${this.storageKey}-code-verifier`);
-        return !!(params.code && currentStorageContent);
+        return !!currentStorageContent;
     }
     /**
      * Inside a browser context, `signOut()` will remove the logged in user from the browser session and log them out - removing all items from localstorage and then trigger a `"SIGNED_OUT"` event.
@@ -3359,7 +3407,6 @@ class GoTrueClient {
             var _a;
             const removeCurrentSession = async () => {
                 await this._removeSession();
-                await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
             };
             const { data, error: sessionError } = result;
             if (sessionError && !isAuthSessionMissingError(sessionError)) {
@@ -3603,10 +3650,16 @@ class GoTrueClient {
             catch (err) {
                 await ((_b = this.stateChangeEmitters.get(id)) === null || _b === void 0 ? void 0 : _b.callback('INITIAL_SESSION', null));
                 this._debug('INITIAL_SESSION', 'callback id', id, 'error', err);
-                if (isAuthSessionMissingError(err) || isAuthRetryableFetchError(err)) {
-                    // A missing session or a transient/aborted network failure (e.g. a
-                    // superseded page navigation cancelling the in-flight request) is
-                    // not an application error — warn rather than surface it raw.
+                if (isAuthSessionMissingError(err) ||
+                    isAuthRetryableFetchError(err) ||
+                    (isAuthApiError(err) &&
+                        (err.code === 'refresh_token_not_found' ||
+                            err.code === 'refresh_token_already_used' ||
+                            err.code === 'session_expired'))) {
+                    // A missing session, a transient/aborted network failure (e.g. a
+                    // superseded page navigation cancelling the in-flight request), or
+                    // a dead refresh token (e.g. stale SSR cookies) is not an
+                    // application error — warn rather than surface it raw.
                     console.warn(err);
                 }
                 else {
@@ -3685,9 +3738,10 @@ class GoTrueClient {
     async resetPasswordForEmail(email, options = {}) {
         let codeChallenge = null;
         let codeChallengeMethod = null;
+        let flowId = null;
         if (this.flowType === 'pkce') {
             ;
-            [codeChallenge, codeChallengeMethod] = await getCodeChallengeAndMethod(this.storage, this.storageKey, true // isPasswordRecovery
+            [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod(true // isPasswordRecovery
             );
         }
         try {
@@ -3699,11 +3753,11 @@ class GoTrueClient {
                     gotrue_meta_security: { captcha_token: options.captchaToken },
                 },
                 headers: this.headers,
-                redirectTo: options.redirectTo,
+                redirectTo: this._maybeAppendFlowIdToRedirect(options.redirectTo, flowId),
             });
         }
         catch (error) {
-            await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+            await removePKCEVerifier(this.storage, this.storageKey, flowId);
             if (isAuthError(error)) {
                 return this._returnResult({ data: null, error });
             }
@@ -3786,7 +3840,8 @@ class GoTrueClient {
      * {
      *   data: {
      *     provider: 'github',
-     *     url: <PROVIDER_URL_TO_REDIRECT_TO>
+     *     url: <PROVIDER_URL_TO_REDIRECT_TO>,
+     *     flowId: <PKCE_FLOW_ID_OR_NULL>
      *   },
      *   error: null
      * }
@@ -3800,18 +3855,20 @@ class GoTrueClient {
     }
     async linkIdentityOAuth(credentials) {
         var _a;
+        let flowId = null;
         try {
             const { data, error } = await this._useSession(async (result) => {
                 var _a, _b, _c, _d, _f;
                 const { data, error } = result;
                 if (error)
                     throw error;
-                const url = await this._getUrlForProvider(`${this.url}/user/identities/authorize`, credentials.provider, {
+                const { url, flowId: urlFlowId } = await this._getUrlForProvider(`${this.url}/user/identities/authorize`, credentials.provider, {
                     redirectTo: (_a = credentials.options) === null || _a === void 0 ? void 0 : _a.redirectTo,
                     scopes: (_b = credentials.options) === null || _b === void 0 ? void 0 : _b.scopes,
                     queryParams: (_c = credentials.options) === null || _c === void 0 ? void 0 : _c.queryParams,
                     skipBrowserRedirect: true,
                 });
+                flowId = urlFlowId;
                 return await _request(this.fetch, 'GET', url, {
                     headers: this.headers,
                     jwt: (_f = (_d = data.session) === null || _d === void 0 ? void 0 : _d.access_token) !== null && _f !== void 0 ? _f : undefined,
@@ -3823,13 +3880,16 @@ class GoTrueClient {
                 window.location.assign(data === null || data === void 0 ? void 0 : data.url);
             }
             return this._returnResult({
-                data: { provider: credentials.provider, url: data === null || data === void 0 ? void 0 : data.url },
+                data: { provider: credentials.provider, url: data === null || data === void 0 ? void 0 : data.url, flowId },
                 error: null,
             });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return this._returnResult({ data: { provider: credentials.provider, url: null }, error });
+                return this._returnResult({
+                    data: { provider: credentials.provider, url: null, flowId },
+                    error,
+                });
             }
             throw error;
         }
@@ -3872,7 +3932,7 @@ class GoTrueClient {
                 return this._returnResult({ data, error });
             }
             catch (error) {
-                await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+                await removePKCEVerifier(this.storage, this.storageKey, null);
                 if (isAuthError(error)) {
                     return this._returnResult({ data: { user: null, session: null }, error });
                 }
@@ -3977,7 +4037,7 @@ class GoTrueClient {
         return isValidSession;
     }
     async _handleProviderSignIn(provider, options) {
-        const url = await this._getUrlForProvider(`${this.url}/authorize`, provider, {
+        const { url, flowId } = await this._getUrlForProvider(`${this.url}/authorize`, provider, {
             redirectTo: options.redirectTo,
             scopes: options.scopes,
             queryParams: options.queryParams,
@@ -3987,7 +4047,7 @@ class GoTrueClient {
         if (isBrowser() && !options.skipBrowserRedirect) {
             window.location.assign(url);
         }
-        return { data: { provider, url }, error: null };
+        return { data: { provider, url, flowId }, error: null };
     }
     /**
      * Recovers the session from LocalStorage and refreshes the token
@@ -4335,7 +4395,7 @@ class GoTrueClient {
         this.lastRefreshFailure = null;
         this.suppressGetSessionWarning = false;
         await removeItemAsync(this.storage, this.storageKey);
-        await removeItemAsync(this.storage, this.storageKey + '-code-verifier');
+        await removeAllPKCEVerifiers(this.storage, this.storageKey);
         await removeItemAsync(this.storage, this.storageKey + '-user');
         if (this.userStorage) {
             await removeItemAsync(this.userStorage, this.storageKey + '-user');
@@ -4701,15 +4761,23 @@ class GoTrueClient {
      * @param options.queryParams An object of key-value pairs containing query parameters granted to the OAuth application.
      */
     async _getUrlForProvider(url, provider, options) {
+        let redirectTo = options === null || options === void 0 ? void 0 : options.redirectTo;
+        let codeChallenge = null;
+        let codeChallengeMethod = null;
+        let flowId = null;
+        if (this.flowType === 'pkce') {
+            ;
+            [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod();
+            redirectTo = this._maybeAppendFlowIdToRedirect(redirectTo, flowId);
+        }
         const urlParams = [`provider=${encodeURIComponent(provider)}`];
-        if (options === null || options === void 0 ? void 0 : options.redirectTo) {
-            urlParams.push(`redirect_to=${encodeURIComponent(options.redirectTo)}`);
+        if (redirectTo) {
+            urlParams.push(`redirect_to=${encodeURIComponent(redirectTo)}`);
         }
         if (options === null || options === void 0 ? void 0 : options.scopes) {
             urlParams.push(`scopes=${encodeURIComponent(options.scopes)}`);
         }
-        if (this.flowType === 'pkce') {
-            const [codeChallenge, codeChallengeMethod] = await getCodeChallengeAndMethod(this.storage, this.storageKey);
+        if (codeChallenge != null && codeChallengeMethod != null) {
             const flowParams = new URLSearchParams({
                 code_challenge: `${encodeURIComponent(codeChallenge)}`,
                 code_challenge_method: `${encodeURIComponent(codeChallengeMethod)}`,
@@ -4723,7 +4791,27 @@ class GoTrueClient {
         if (options === null || options === void 0 ? void 0 : options.skipBrowserRedirect) {
             urlParams.push(`skip_http_redirect=${options.skipBrowserRedirect}`);
         }
-        return `${url}?${urlParams.join('&')}`;
+        return { url: `${url}?${urlParams.join('&')}`, flowId };
+    }
+    /**
+     * Appends the reserved flow id parameter to a redirect URL so the callback
+     * can be matched to the verifier stored for its flow. Opt-in via
+     * `experimental.appendPkceFlowIdToRedirects`: redirect URLs are validated
+     * against the project's allow list including the query string, so an extra
+     * parameter can stop exact (non-wildcard) entries from matching.
+     */
+    _maybeAppendFlowIdToRedirect(redirectTo, flowId) {
+        if (!redirectTo || !flowId || !this.experimental.appendPkceFlowIdToRedirects) {
+            return redirectTo !== null && redirectTo !== void 0 ? redirectTo : undefined;
+        }
+        return appendFlowIdToRedirectTo(redirectTo, flowId);
+    }
+    /**
+     * Generates and stores a PKCE challenge/verifier pair for a new flow,
+     * logging any pending verifier the bounded slot ring evicts.
+     */
+    async _getCodeChallengeAndMethod(isPasswordRecovery = false) {
+        return getCodeChallengeAndMethod(this.storage, this.storageKey, isPasswordRecovery, (evictedFlowId) => this._debug('#_getCodeChallengeAndMethod()', 'evicted oldest pending PKCE verifier slot', evictedFlowId));
     }
     async _unenroll(params) {
         try {