@edgespark/web 0.0.0-beta.807cd96

package/dist/api/types.d.ts

@@ -0,0 +1,13 @@
+export type EdgeSparkRequestInit = Omit<RequestInit, "credentials">;
+/**
+ * Same-origin fetch wrapper for authenticated app requests.
+ */
+export interface EdgeSparkApi {
+    /**
+     * Same-origin `fetch` with cookie credentials always enabled.
+     *
+     * `credentials` is intentionally omitted from the accepted init shape because
+     * the SDK never allows callers to disable cookie auth.
+     */
+    fetch(input: RequestInfo | URL, init?: EdgeSparkRequestInit): Promise<Response>;
+}

package/dist/auth/create-auth.d.ts

@@ -0,0 +1,18 @@
+import { BetterAuthClientInstance, EdgeSparkAuth } from './types';
+export declare const AUTH_BASE_PATH: "/api/_es/auth";
+export declare function syncEdgeSparkAuthSession(authClient: BetterAuthClientInstance): Promise<void>;
+/**
+ * Creates the headless auth module.
+ *
+ * The exposed API intentionally keeps better-auth's shape so existing upstream
+ * knowledge transfers directly. EdgeSpark adds session helpers and sync
+ * semantics on top of that familiar surface.
+ */
+export declare function createEdgeSparkAuth(): EdgeSparkAuth;
+/**
+ * Creates the internal auth client used by the managed UI.
+ *
+ * Redirect handling is intentionally disabled here so `authUI` can own
+ * callback timing, loading state, and post-auth navigation semantics.
+ */
+export declare function createManagedAuthUIClient(): BetterAuthClientInstance;

package/dist/auth/local-dev.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Is the web app running in local-dev mode?
+ *
+ * Reads a `<meta name="edgespark-local-dev" content="true">` tag that
+ * the `edgespark dev` reverse proxy splices into every HTML response.
+ * The dev proxy only runs under `edgespark dev`; the meta tag is absent
+ * on deployed apps (served through the CF dispatcher, which doesn't
+ * inject).
+ *
+ * Uses a <meta> tag rather than an inline <script> so the signal works
+ * under strict CSP — `script-src 'self'` without `'unsafe-inline'`
+ * would silently drop a script-based marker. Meta tags carry no
+ * script-src constraint.
+ *
+ * No server round-trip, no build-time macro, no hostname heuristic, no
+ * framework assumptions. Survives SDK pre-bundling — the SDK reads the
+ * DOM at call time, not a value captured at build time.
+ */
+export declare function isLocalDev(): boolean;
+/**
+ * Auto-verify email in local dev. The server reads the pending verification
+ * token from D1, drives Better Auth's verify-email handler, and returns with
+ * the session cookie already set. Single round-trip — no token round-trip on
+ * the client.
+ */
+export declare function autoVerifyLocalDev(email: string): Promise<boolean>;
+/**
+ * Fetch the pending OTP for password reset in local dev.
+ * Returns the OTP string or null if not available.
+ */
+export declare function fetchOtpLocalDev(email: string): Promise<string | null>;
+/**
+ * Fetch the pending OTP for email sign-in in local dev.
+ * Returns the OTP string or null if not available.
+ */
+export declare function fetchSignInOtpLocalDev(email: string): Promise<string | null>;
+/**
+ * Fetch the pending SMS sign-in code in local dev.
+ * Returns the code string or null if not available.
+ */
+export declare function fetchPhoneOtpLocalDev(phoneNumber: string): Promise<string | null>;

package/dist/auth/placeholder-email.d.ts

@@ -0,0 +1,7 @@
+export declare const PLACEHOLDER_EMAIL_DOMAIN = "phone.invalid";
+/**
+ * Users who signed in without an email (e.g. SMS sign-in) get a generated
+ * `@phone.invalid` address. It cannot receive mail — don't display it or
+ * pass it to payment, analytics, or email providers.
+ */
+export declare function isPlaceholderEmail(email: string | null | undefined): boolean;

package/dist/auth/types.d.ts

@@ -0,0 +1,84 @@
+import { createAuthClient } from 'better-auth/client';
+/**
+ * Direct better-auth client instance returned by createAuthClient().
+ */
+export type BetterAuthClientInstance = ReturnType<typeof createAuthClient>;
+export type SessionResult = Awaited<ReturnType<BetterAuthClientInstance["getSession"]>>;
+export type AuthSession = NonNullable<SessionResult["data"]>;
+export type AuthUser = AuthSession["user"];
+export type SessionChangeCallback = (session: AuthSession | null) => void;
+export interface AuthEndpointError {
+    code?: string;
+    message?: string;
+    status?: number;
+}
+export interface AuthEndpointResult<TData = unknown> {
+    data?: TData | null;
+    error?: AuthEndpointError | null;
+}
+/**
+ * EdgeSpark keeps the auth API shape aligned with better-auth while adding a
+ * small set of session helpers on top.
+ *
+ * Most upstream auth methods remain available on the familiar better-auth
+ * shape. Some upstream methods may still be intentionally unsupported by the
+ * current EdgeSpark platform capability set even though they exist on the
+ * underlying better-auth client surface. In those cases, the facade throws an
+ * `EdgeSparkAuthError` with code `UNSUPPORTED_AUTH_METHOD` instead of deferring
+ * to a platform-specific 400/404 response.
+ */
+export type EdgeSparkAuth = BetterAuthClientInstance & {
+    /**
+     * Resolves with the current session, or throws when the browser is not authenticated.
+     *
+     * Use this for route guards and other flows where nullable session checks add noise.
+     *
+     * If the session lookup itself fails (offline, 5xx, etc.), this throws an
+     * `EdgeSparkAuthError` that preserves the upstream error code/status instead
+     * of collapsing the failure into `UNAUTHENTICATED`.
+     */
+    requireSession(): Promise<AuthSession>;
+    /**
+     * Subscribes to session changes for the current browser context.
+     *
+     * The first emission is hydration-safe: it waits for the initial server
+     * session lookup to complete before firing, so subscribers never receive a
+     * premature `null` while a cookie session is still settling.
+     *
+     * After hydration, successful session atom updates are forwarded immediately.
+     * Successful auth mutations that create or clear a session in the current
+     * tab also prompt other tabs to refetch their session state, so logout and
+     * same-tab sign-in/sign-up converge quickly across tabs.
+     *
+     * Transient lookup failures that temporarily clear the atom to `null` are
+     * ignored so subscribers do not mistake a backend error for a real sign-out.
+     *
+     * Returns an unsubscribe function.
+     */
+    onSessionChange(callback: SessionChangeCallback): () => void;
+    /**
+     * Signs out and then best-effort synchronizes session state for the current
+     * tab and other open tabs.
+     *
+     * The underlying better-auth result is returned unchanged.
+     */
+    signOut(...args: Parameters<BetterAuthClientInstance["signOut"]>): ReturnType<BetterAuthClientInstance["signOut"]>;
+    /**
+     * Currently unsupported by EdgeSpark platform auth.
+     *
+     * The method remains present to preserve the familiar better-auth API shape,
+     * but the facade throws `UNSUPPORTED_AUTH_METHOD` until the platform enables
+     * this capability. For browser auth, prefer supported `client.auth` methods
+     * or `authUI.mount()` instead of dropping to raw `/api/_es/auth/*` routes.
+     */
+    changeEmail(...args: Parameters<BetterAuthClientInstance["changeEmail"]>): ReturnType<BetterAuthClientInstance["changeEmail"]>;
+    /**
+     * Currently unsupported by EdgeSpark platform auth.
+     *
+     * The method remains present to preserve the familiar better-auth API shape,
+     * but the facade throws `UNSUPPORTED_AUTH_METHOD` until the platform enables
+     * this capability. Handle account removal through your own app flow until the
+     * platform adds first-class support.
+     */
+    deleteUser(...args: Parameters<BetterAuthClientInstance["deleteUser"]>): ReturnType<BetterAuthClientInstance["deleteUser"]>;
+};

package/dist/auth-ui/ManagedAuthUI.d.ts

@@ -0,0 +1,114 @@
+import { BetterAuthClientInstance } from '../auth/types';
+import { NormalizedAuthUIConfig } from './config';
+import { AuthUIModuleRuntimeOptions } from './mount';
+import { MountAuthUIOptions, MountedAuthUI } from './types';
+/**
+ * Internal managed auth UI implementation.
+ *
+ * The public API only exposes `authUI.mount(...)`; this class owns the DOM,
+ * form flows, and lifecycle.
+ *
+ * DOM ownership: the instance owns a single root element it appends to the
+ * mount container. It never writes to `container.innerHTML`. This keeps
+ * tear-down safe when the container is a DOM node a reconciling framework
+ * (React/Vue/Solid) reuses across conditional branches — wiping the
+ * container would erase sibling content the framework just rendered.
+ */
+export declare class ManagedAuthUI implements MountedAuthUI {
+    private readonly container;
+    private readonly auth;
+    private readonly options;
+    private readonly loadConfig;
+    private readonly runtimeOptions?;
+    private readonly fieldIdPrefix;
+    private readonly labels;
+    private readonly root;
+    private readonly state;
+    private destroyed;
+    private terminalActionInProgress;
+    private config;
+    private countdownUntil;
+    private countdownTimer;
+    private pendingFocusSnapshot;
+    private focusRestoreTimer;
+    private verificationCompletionAction;
+    constructor(container: HTMLElement, auth: BetterAuthClientInstance, options: MountAuthUIOptions, loadConfig: () => Promise<NormalizedAuthUIConfig>, runtimeOptions?: AuthUIModuleRuntimeOptions | undefined);
+    destroy(): void;
+    private initialize;
+    private redirectAfterManagedReturnLookupFailure;
+    private navigateToRedirect;
+    private readMountSession;
+    private render;
+    private renderLoading;
+    private renderDevModeBanner;
+    private renderStatus;
+    private renderCurrentView;
+    private renderSignInView;
+    private renderSignInMethodTab;
+    private renderPhoneInput;
+    private renderSignUpView;
+    private renderVerifyEmailView;
+    private renderForgotPasswordView;
+    private renderResetPasswordView;
+    private renderOAuthProviders;
+    private renderInput;
+    private bindDOM;
+    private switchView;
+    private handleSignIn;
+    private handleEmailOtpSignIn;
+    private sendSignInOtp;
+    private resendSignInCode;
+    private handlePhoneOtpSignIn;
+    private sendPhoneOtp;
+    private fullPhoneNumber;
+    private toPhoneAuthError;
+    private handleSignUp;
+    private handleOAuthSignIn;
+    private handleForgotPassword;
+    private resendResetCode;
+    private handleResetPassword;
+    private resendVerificationEmail;
+    /**
+     * Drive the local-dev auto-verify endpoint and, on success, complete the
+     * auth flow. Returns whether auto-verify completed — callers decide what
+     * to do on `false` (sign-up falls through to a retry UI; resend throws).
+     */
+    private tryDevAutoVerify;
+    private sendVerificationEmail;
+    private completeAuth;
+    private retryAuthCompletionDataIfNeeded;
+    private syncPublicSessionBestEffort;
+    private resolveAuthCompletionData;
+    private completePasswordReset;
+    private handleExistingSessionOnMount;
+    private runAction;
+    private maybeHandleVerificationRequired;
+    private handleVerificationEmailSent;
+    private invokeRedirectModeSuccessHook;
+    private handleError;
+    private failValidation;
+    private getManagedReturnURL;
+    private consumeManagedReturnContext;
+    private startCountdown;
+    private updateCountdownControls;
+    private clearCountdown;
+    private captureFocusSnapshot;
+    private scheduleFocusRestore;
+    private clearFocusRestoreTimer;
+    private passwordResetEndpoints;
+    private emailOtpSignInEndpoints;
+    private phoneOtpSignInEndpoints;
+    private availableSignInMethods;
+    private activeSignInMethod;
+    private resolveInitialSignInMethod;
+    private setSignInMethod;
+    private canUseEmailOtpSignIn;
+    private extractRedirectURL;
+    private extractUser;
+    private canUsePasswordResetEmailOtp;
+    private handleSessionlessManagedReturn;
+    private isCountdownActive;
+    private getCountdownSecondsRemaining;
+    private countdownText;
+    private escape;
+}

package/dist/auth-ui/appearance.d.ts

@@ -0,0 +1,64 @@
+export declare const AUTH_UI_THEME: {
+    readonly LIGHT: "light";
+    readonly DARK: "dark";
+};
+export declare const AUTH_UI_THEME_LIGHT: "light";
+export declare const AUTH_UI_THEME_DARK: "dark";
+export declare const AUTH_UI_THEMES: readonly ["light", "dark"];
+export declare const AUTH_UI_DEFAULT_THEME: "light";
+export type AuthUITheme = (typeof AUTH_UI_THEME)[keyof typeof AUTH_UI_THEME];
+export declare const AUTH_UI_APPEARANCE_VARIABLE: {
+    readonly BACKGROUND: "--edgespark-auth-bg";
+    readonly BACKGROUND_MUTED: "--edgespark-auth-bg-muted";
+    readonly CARD_BACKGROUND: "--edgespark-auth-card-bg";
+    readonly BORDER: "--edgespark-auth-border";
+    readonly TEXT: "--edgespark-auth-text";
+    readonly TEXT_MUTED: "--edgespark-auth-text-muted";
+    readonly DIVIDER_BACKGROUND: "--edgespark-auth-divider-bg";
+    readonly PRIMARY: "--edgespark-auth-primary";
+    readonly PRIMARY_HOVER: "--edgespark-auth-primary-hover";
+    readonly PRIMARY_CONTRAST: "--edgespark-auth-primary-contrast";
+    readonly ERROR: "--edgespark-auth-error";
+    readonly INFO: "--edgespark-auth-info";
+    readonly CARD_RADIUS: "--edgespark-auth-radius-card";
+    readonly CONTROL_RADIUS: "--edgespark-auth-radius-control";
+    readonly SHADOW: "--edgespark-auth-shadow";
+    readonly FONT: "--edgespark-auth-font";
+    readonly MODAL_BACKDROP: "--edgespark-auth-modal-backdrop";
+    readonly MODAL_CARD_BACKGROUND: "--edgespark-auth-modal-card-bg";
+    readonly MODAL_SHADOW: "--edgespark-auth-modal-shadow";
+};
+export type AuthUIAppearanceVariableName = (typeof AUTH_UI_APPEARANCE_VARIABLE)[keyof typeof AUTH_UI_APPEARANCE_VARIABLE];
+export declare const AUTH_UI_APPEARANCE_VARIABLE_NAMES: readonly AuthUIAppearanceVariableName[];
+export type AuthUIAppearanceVariables = Partial<Record<AuthUIAppearanceVariableName, string>>;
+export interface AuthUIAppearance {
+    /**
+     * Built-in visual preset for the managed auth UI root.
+     *
+     * Defaults to `"light"` when omitted. Variable overrides apply on top of the
+     * selected preset instead of replacing the entire theme contract.
+     */
+    theme?: AuthUITheme;
+    /**
+     * Optional class applied to the managed auth UI root container.
+     *
+     * Use this to scope additional app-level CSS around the stable root element.
+     */
+    className?: string;
+    /**
+     * Stable CSS custom properties supported by the managed auth UI.
+     *
+     * This is the supported appearance contract for light-touch theming. When a
+     * variable is omitted, the current theme preset keeps its default value.
+     */
+    variables?: AuthUIAppearanceVariables;
+}
+interface NormalizedAuthUIAppearance {
+    theme: AuthUITheme;
+    className: string;
+    variables: AuthUIAppearanceVariables;
+}
+export declare function isAuthUITheme(value: unknown): value is AuthUITheme;
+export declare function isAuthUIAppearanceVariableName(value: string): value is AuthUIAppearanceVariableName;
+export declare function normalizeAuthUIAppearance(appearance?: AuthUIAppearance): NormalizedAuthUIAppearance;
+export {};

package/dist/auth-ui/config.d.ts

@@ -0,0 +1,60 @@
+export type OAuthProviderId = "google" | "apple" | "microsoft" | "github" | "gitlab" | "discord";
+interface OAuthProviderConfig {
+    /**
+     * OAuth Client ID resolved server-side. Present only when both the Client
+     * ID var and the corresponding secret resolve, so a non-empty value is
+     * the "this provider is fully wired browser-side" signal.
+     */
+    clientId?: string;
+}
+interface OAuthProviderBlock {
+    enabled?: boolean;
+    config?: OAuthProviderConfig;
+}
+interface ProviderEmailPassword {
+    enabled?: boolean;
+    config?: {
+        minPasswordLength?: number;
+        requireEmailVerification?: boolean;
+        requirePasswordResetEmailVerification?: boolean;
+    };
+}
+interface ProviderEmailOtp {
+    enabled?: boolean;
+}
+interface ProviderPhoneOtp {
+    enabled?: boolean;
+}
+interface AuthConfigResponse {
+    disableSignUp?: boolean;
+    providerEmailPassword?: ProviderEmailPassword;
+    providerEmailOtp?: ProviderEmailOtp;
+    providerPhoneOtp?: ProviderPhoneOtp;
+    providerGoogle?: OAuthProviderBlock;
+    providerApple?: OAuthProviderBlock;
+    providerMicrosoft?: OAuthProviderBlock;
+    providerGithub?: OAuthProviderBlock;
+    providerGitlab?: OAuthProviderBlock;
+    providerDiscord?: OAuthProviderBlock;
+}
+export interface NormalizedAuthUIConfig {
+    disableSignUp: boolean;
+    emailPasswordEnabled: boolean;
+    emailOtpSignInEnabled: boolean;
+    /** SMS sign-in for +86 mobile numbers; only present for projects the platform enabled. */
+    phoneOtpSignInEnabled?: boolean;
+    minPasswordLength: number;
+    requireEmailVerification: boolean;
+    passwordResetEmailOtpEnabled: boolean;
+    oauthProviders: OAuthProviderId[];
+    /**
+     * Resolved Google OAuth Client ID when Google is enabled and both
+     * credentials resolved server-side; `null` otherwise. Signals that
+     * Google client-side wiring is ready.
+     */
+    googleClientId: string | null;
+    isLocalDev: boolean;
+}
+export declare function loadNormalizedAuthUIConfig(): Promise<NormalizedAuthUIConfig>;
+export declare function normalizeAuthUIConfig(config: AuthConfigResponse, isLocalDev?: boolean): NormalizedAuthUIConfig;
+export {};

package/dist/auth-ui/default-labels.d.ts

@@ -0,0 +1,2 @@
+import { AuthUILabelOverrides, AuthUILabels } from './types';
+export declare function mergeAuthUILabels(base: AuthUILabels, overrides?: AuthUILabelOverrides): AuthUILabels;

package/dist/auth-ui/google-one-tap.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Minimal helpers for driving Google Identity Services (One Tap) from the
+ * managed auth UI. Loads the GIS client script on demand and exposes a tiny
+ * typed surface around the global `google.accounts.id` namespace.
+ *
+ * GIS is treated as a UX enhancement: any load failure falls back silently
+ * to the regular "Continue with Google" OAuth button.
+ */
+interface GsiCredentialResponse {
+    credential: string;
+    select_by?: string;
+}
+interface GsiInitializeOptions {
+    client_id: string;
+    callback: (response: GsiCredentialResponse) => void;
+    auto_select?: boolean;
+    cancel_on_tap_outside?: boolean;
+    use_fedcm_for_prompt?: boolean;
+    context?: "signin" | "signup" | "use";
+}
+/**
+ * Subset of Google's `PromptMomentNotification`. Methods are optional because
+ * GIS's FedCM-era roadmap retires some of them, and EdgeSpark does not depend
+ * on `@types/google.accounts` for the full type surface.
+ */
+interface GsiPromptNotification {
+    isNotDisplayed?: () => boolean;
+    isSkippedMoment?: () => boolean;
+    isDismissedMoment?: () => boolean;
+    getDismissedReason?: () => string | undefined;
+}
+interface GsiIdAccounts {
+    initialize(options: GsiInitializeOptions): void;
+    prompt(notificationCallback?: (notification: GsiPromptNotification) => void): void;
+    cancel(): void;
+    disableAutoSelect(): void;
+}
+/**
+ * Loads `accounts.google.com/gsi/client` once per page and resolves with
+ * the `google.accounts.id` namespace. Subsequent calls return the same
+ * promise; load failures reject and reset so a caller can retry next mount.
+ */
+export declare function loadGoogleIdentityServices(): Promise<GsiIdAccounts>;
+export type GoogleIdentityServices = GsiIdAccounts;
+export type GoogleCredentialResponse = GsiCredentialResponse;
+export type GooglePromptNotification = GsiPromptNotification;
+export {};

package/dist/auth-ui/index.d.ts

@@ -0,0 +1,4 @@
+export { createAuthUIModule } from './mount';
+export { AUTH_UI_APPEARANCE_VARIABLE, AUTH_UI_APPEARANCE_VARIABLE_NAMES, AUTH_UI_THEME, AUTH_UI_DEFAULT_THEME, AUTH_UI_THEME_DARK, AUTH_UI_THEME_LIGHT, AUTH_UI_THEMES, } from './appearance';
+export type { AuthUIAppearance, AuthUIAppearanceVariableName, AuthUIAppearanceVariables, AuthUITheme, } from './appearance';
+export type { AuthenticatedAuthSuccessEvent, AuthSuccessEvent, AuthUILabelOverrides, AuthUILabels, ControlledAuthUIOptions, EdgeSparkAuthUI, MountAuthUIOptions, MountedAuthUI, OneTapPromptHandle, PromptGoogleOneTapOptions, RedirectAuthUIOptions, } from './types';

package/dist/auth-ui/mount.d.ts

@@ -0,0 +1,22 @@
+import { BetterAuthClientInstance } from '../auth/types';
+import { EdgeSparkAuthUI } from './types';
+/**
+ * Internal runtime config for the auth-UI module factory. Threads cross-cutting
+ * auth wiring into `ManagedAuthUI` (modal/redirect flows) and
+ * `promptGoogleOneTap` (page-load One Tap prompt).
+ */
+export interface AuthUIModuleRuntimeOptions {
+    /**
+     * Best-effort hook to nudge the public auth session after the managed UI
+     * completes a sign-in. Used by `ManagedAuthUI`'s email and OAuth flows.
+     */
+    syncPublicSession?: () => Promise<void> | void;
+    /**
+     * The public auth client used by `promptGoogleOneTap` for credential
+     * exchange. Routing One Tap through the same client as `signIn`/`signUp`
+     * keeps session updates and `onSessionChange` consistent across all
+     * sign-in methods.
+     */
+    publicAuthClient: BetterAuthClientInstance;
+}
+export declare function createAuthUIModule(auth: BetterAuthClientInstance, runtimeOptions: AuthUIModuleRuntimeOptions): EdgeSparkAuthUI;

package/dist/auth-ui/prompt-google-one-tap.d.ts

@@ -0,0 +1,43 @@
+import { BetterAuthClientInstance } from '../auth/types';
+import { EdgeSparkAuthError } from '../errors';
+import { NormalizedAuthUIConfig } from './config';
+import { AuthenticatedAuthSuccessEvent } from './types';
+export interface PromptGoogleOneTapOptions {
+    /**
+     * Fires when Google One Tap sign-in completes.
+     *
+     * **Most apps should prefer `client.auth.onSessionChange`** as the single
+     * source of truth — it fires for One Tap, modal sign-in, sign-out, and
+     * cross-tab session changes. Use `onSuccess` only for flow-local concerns
+     * scoped to this specific prompt (e.g., per-flow analytics).
+     */
+    onSuccess?: (event: AuthenticatedAuthSuccessEvent) => void;
+    /**
+     * Fires on credential-exchange or post-sign-in errors.
+     */
+    onError?: (error: EdgeSparkAuthError) => void;
+    /**
+     * Fires when Google declines to display the prompt — e.g., FedCM cooldown,
+     * no eligible accounts, or browser permission denied. Use this to render a
+     * fallback "Sign in with Google" button.
+     */
+    onUnavailable?: () => void;
+}
+export interface OneTapPromptHandle {
+    /**
+     * Dismiss the prompt and suppress any pending callbacks. Idempotent and
+     * safe to call after the prompt has already closed.
+     */
+    cancel(): void;
+}
+interface PromptRuntime {
+    /**
+     * The wrapped public auth client. Calls flow through its path-proxy so
+     * `oneTap.callback` triggers the same session-atom refresh and
+     * `onSessionChange` emit as `signIn`/`signUp`.
+     */
+    authClient: BetterAuthClientInstance;
+    loadConfig: () => Promise<NormalizedAuthUIConfig>;
+}
+export declare function createPromptGoogleOneTap(runtime: PromptRuntime): (options?: PromptGoogleOneTapOptions) => OneTapPromptHandle;
+export {};

package/dist/auth-ui/runtime.d.ts

@@ -0,0 +1,7 @@
+import { AuthSession, AuthUser, BetterAuthClientInstance } from '../auth/types';
+import { EdgeSparkAuthError } from '../errors';
+export declare function normalizeAuthError(error: unknown, fallbackMessage?: string): EdgeSparkAuthError;
+export declare function readCurrentSession(auth: BetterAuthClientInstance): Promise<{
+    user: AuthUser | null;
+    session: AuthSession | null;
+}>;