@fayz-ai/auth 0.9.0 → 0.10.0

package/README.md

@@ -44,7 +44,7 @@ function Dashboard() {
 ```
 
 ## Part of the Fayz SDK
-The auth seam between `@fayz-ai/core` and the multi-tenant `@fayz-ai/saas` layer.
+The auth seam between `@fayz-ai/core` and the multi-tenant `@fayz-ai/admin` layer.
 
 ## Roadmap & contributing
-Built and evolving in the open. See the [Fayz SDK roadmap](../../docs/ROADMAP.md#auth) for current gaps, missing features, and good first issues.
+Built and evolving in the open. See the [Fayz SDK roadmap](../../docs/platform/ROADMAP.md#auth) for current gaps, missing features, and good first issues.

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { createSupabaseAuthAdapter, MUST_SET_PASSWORD_FLAG } from './adapters/supabase';
 export type { SupabaseAuthConfig } from './adapters/supabase';
-export { readAuthUrlIntent, clearAuthUrlTokens, withAuthIntent, decidePasswordSetup, AUTH_INTENT_PARAM, } from './url-intent';
-export type { AuthUrlIntent, PasswordSetupDecision, PasswordSetupInput, PasswordSetupReason, } from './url-intent';
+export { readAuthUrlIntent, clearAuthUrlTokens, withAuthIntent, decidePasswordSetup, AUTH_INTENT_PARAM, } from './lib/url-intent';
+export type { AuthUrlIntent, PasswordSetupDecision, PasswordSetupInput, PasswordSetupReason, } from './lib/url-intent';
 export { createMockAuthAdapter } from './adapters/mock';
 export type { MockUser } from './adapters/mock';
 export { useAuthStore } from './store';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AACvF,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAG/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAGnD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AACvF,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAG/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAGnD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA"}

package/dist/index.js

@@ -5,7 +5,7 @@ import { jsx } from 'react/jsx-runtime';
 
 // src/adapters/supabase.ts
 
-// src/url-intent.ts
+// src/lib/url-intent.ts
 var AUTH_INTENT_PARAM = "fayz_auth";
 var RESET_PATH = "/auth/reset-password";
 function snapshot() {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/url-intent.ts","../src/adapters/supabase.ts","../src/adapters/mock.ts","../src/store.ts","../src/context.tsx"],"names":[],"mappings":";;;;;;;;AA2BO,IAAM,iBAAA,GAAoB;AAIjC,IAAM,UAAA,GAAa,sBAAA;AAQnB,SAAS,QAAA,GAA+B;AACtC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,OAAO,QAAA,CAAS,QAAA;AAAA,IAC1B,MAAA,EAAQ,OAAO,QAAA,CAAS,MAAA;AAAA,IACxB,IAAA,EAAM,OAAO,QAAA,CAAS;AAAA,GACxB;AACF;AAGA,IAAM,aAAiC,QAAA,EAAS;AAIhD,SAAS,WAAW,IAAA,EAA+B;AACjD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA;AACjC,EAAA,IAAI,CAAC,OAAO,CAAC,GAAA,CAAI,SAAS,GAAG,CAAA,EAAG,OAAO,IAAI,eAAA,EAAgB;AAC3D,EAAA,OAAO,IAAI,gBAAgB,GAAG,CAAA;AAChC;AAEO,SAAS,kBAAkB,GAAA,EAAgD;AAChF,EAAA,MAAM,MAAM,GAAA,IAAO,UAAA;AACnB,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AAEjB,EAAA,MAAM,KAAA,GAAQ,IAAI,eAAA,CAAgB,GAAA,CAAI,MAAM,CAAA;AAC5C,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AAChC,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAA,KAAgB,IAAA,CAAK,IAAI,GAAG,CAAA,IAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAE7D,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,YAAY,CAAA,IAAK,MAAM,OAAO,CAAA;AACtD,EAAA,MAAM,mBAAmB,KAAA,CAAM,mBAAmB,CAAA,EAAG,OAAA,CAAQ,OAAO,GAAG,CAAA;AAKvE,EAAA,IAAI,SAAA,IAAa,oBAAoB,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,gBAAA,IAAoB,EAAE,CAAA,CAAE,CAAA,EAAG;AACnF,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAS,oBAAoB,MAAA,EAAU;AAAA,EACnE;AAEA,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,iBAAiB,CAAA;AAC1C,EAAA,MAAM,IAAA,GAAO,MAAM,MAAM,CAAA;AACzB,EAAA,IAAI,SAAS,UAAA,IAAc,MAAA,KAAW,YAAY,OAAO,EAAE,MAAM,UAAA,EAAW;AAI5E,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAC5C,EAAA,IAAI,KAAK,QAAA,CAAS,UAAU,GAAG,OAAO,EAAE,MAAM,UAAA,EAAW;AAEzD,EAAA,OAAO,IAAA;AACT;AAKO,SAAS,kBAAA,GAA2B;AACzC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAA,CAAO,SAAS,IAAI,CAAA;AACxC,EAAA,GAAA,CAAI,YAAA,CAAa,OAAO,iBAAiB,CAAA;AACzC,EAAA,IAAI,IAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,MAAO,IAAA,GAAO,EAAA;AACvC,EAAA,MAAA,CAAO,OAAA,CAAQ,aAAa,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAA,EAAI,GAAA,CAAI,UAAU,CAAA;AACtE;AAIO,SAAS,cAAA,CAAe,KAAa,MAAA,EAA4B;AACtE,EAAA,MAAM,OAAO,OAAO,MAAA,KAAW,WAAA,GAAc,kBAAA,GAAqB,OAAO,QAAA,CAAS,MAAA;AAClF,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AAChC,EAAA,MAAA,CAAO,YAAA,CAAa,GAAA,CAAI,iBAAA,EAAmB,MAAM,CAAA;AACjD,EAAA,OAAO,eAAA,CAAgB,IAAA,CAAK,GAAG,CAAA,GAAI,OAAO,QAAA,EAAS,GAAI,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,EAAG,OAAO,IAAI,CAAA,CAAA;AACzG;AAyBA,IAAM,UAAiC,EAAE,MAAA,EAAQ,MAAM,OAAA,EAAS,KAAA,EAAO,UAAU,KAAA,EAAM;AAEhF,SAAS,oBAAoB,KAAA,EAAkD;AACpF,EAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,EAAW,eAAA,EAAiB,iBAAgB,GAAI,KAAA;AAEhE,EAAA,IAAI,MAAA,EAAQ,IAAA,KAAS,SAAA,EAAW,OAAO,EAAE,QAAQ,UAAA,EAAY,OAAA,EAAS,IAAA,EAAM,QAAA,EAAU,KAAA,EAAM;AAE5F,EAAA,IAAI,MAAA,EAAQ,SAAS,UAAA,EAAY;AAC/B,IAAA,IAAI,SAAA,SAAkB,EAAE,MAAA,EAAQ,YAAY,OAAA,EAAS,KAAA,EAAO,UAAU,IAAA,EAAK;AAE3E,IAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,SAAS,CAAC,eAAA,EAAiB,UAAU,KAAA,EAAM;AAAA,EAC1E;AAEA,EAAA,IAAI,CAAC,SAAA,IAAa,eAAA,IAAmB,eAAA,EAAiB;AACpD,IAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,OAAA,EAAS,KAAA,EAAO,UAAU,KAAA,EAAM;AAAA,EAC7D;AAEA,EAAA,OAAO,OAAA;AACT;;;AC9IO,IAAM,sBAAA,GAAyB;AAUtC,SAAS,gBAAgB,YAAA,EAQZ;AACX,EAAA,OAAO;AAAA,IACL,IAAI,YAAA,CAAa,EAAA;AAAA,IACjB,KAAA,EAAO,aAAa,KAAA,IAAS,EAAA;AAAA,IAC7B,QAAA,EACG,aAAa,aAAA,GAAgB,WAAW,KACxC,YAAA,CAAa,aAAA,GAAgB,MAAM,CAAA,IACpC,EAAA;AAAA,IACF,SAAA,EAAW,YAAA,CAAa,aAAA,GAAgB,YAAY,CAAA;AAAA,IACpD,eAAA,EAAiB,YAAA,CAAa,aAAA,GAAgB,sBAAsB,CAAA,KAAM;AAAA,GAC5E;AACF;AAEA,SAAS,mBAAmB,OAAA,EAMZ;AACd,EAAA,OAAO;AAAA,IACL,aAAa,OAAA,CAAQ,YAAA;AAAA,IACrB,cAAc,OAAA,CAAQ,aAAA;AAAA,IACtB,SAAA,EACE,OAAA,CAAQ,UAAA,IACR,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA,IAAK,OAAA,CAAQ,UAAA,IAAc,IAAA,CAAA;AAAA,IACzD,IAAA,EAAM,eAAA,CAAgB,OAAA,CAAQ,IAAI;AAAA,GACpC;AACF;AAEO,SAAS,0BAA0B,MAAA,EAAyC;AACjF,EAAA,MAAM,WAAW,MAAA,CAAO,cAAA,IAAkB,aAAa,MAAA,CAAO,WAAA,EAAa,OAAO,eAAe,CAAA;AAEjG,EAAA,OAAO;AAAA,IACL,MAAM,UAAA,GAAa;AACjB,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,EAAE,OAAA;AAAQ,OAClB,GAAI,MAAM,QAAA,CAAS,IAAA,CAAK,UAAA,EAAW;AACnC,MAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,MAAA,MAAM,MAAA,GAAS,mBAAmB,OAAO,CAAA;AACzC,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,SAAS,MAAA,EAAO;AAAA,IAC9C,CAAA;AAAA,IAEA,kBAAkB,EAAA,EAAI;AACpB,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,EAAE,YAAA;AAAa,UACnB,QAAA,CAAS,IAAA,CAAK,iBAAA,CAAkB,CAAC,QAAQ,OAAA,KAAY;AACvD,QAAA,EAAA,CAAG,OAAA,GAAU,eAAA,CAAgB,OAAA,CAAQ,IAAI,IAAI,IAAI,CAAA;AAAA,MACnD,CAAC,CAAA;AACD,MAAA,OAAO,MAAM,aAAa,WAAA,EAAY;AAAA,IACxC,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,KAAA,EAAO,QAAA,EAAU;AAC5B,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,IAAA,CAAK,kBAAA,CAAmB,EAAE,KAAA,EAAO,QAAA,EAAU,CAAA;AAClF,MAAA,IAAI,OAAO,MAAM,KAAA;AACjB,MAAA,OAAO,kBAAA,CAAmB,KAAK,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU;AACtC,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,KAAU,MAAM,QAAA,CAAS,KAAK,MAAA,CAAO;AAAA,QACjD,KAAA;AAAA,QACA,QAAA;AAAA,QACA,SAAS,EAAE,IAAA,EAAM,EAAE,SAAA,EAAW,UAAS;AAAE,OAC1C,CAAA;AACD,MAAA,IAAI,OAAO,MAAM,KAAA;AAGjB,MAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,QAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,iCAAiC,CAAA;AACjE,QAAA,OAAO;AAAA,UACL,WAAA,EAAa,EAAA;AAAA,UACb,YAAA,EAAc,EAAA;AAAA,UACd,SAAA,EAAW,CAAA;AAAA,UACX,IAAA,EAAM,eAAA,CAAgB,IAAA,CAAK,IAAI;AAAA,SACjC;AAAA,MACF;AAEA,MAAA,OAAO,kBAAA,CAAmB,KAAK,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,IAEA,MAAM,OAAA,GAAU;AACd,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,KAAK,OAAA,EAAQ;AAC9C,MAAA,IAAI,OAAO,MAAM,KAAA;AAAA,IACnB,CAAA;AAAA,IAEA,MAAM,gBAAgB,QAAA,EAAwB;AAC5C,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,KAAK,eAAA,CAAgB;AAAA,QACpD,QAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,UAAA,EACE,MAAA,CAAO,WAAA,KACN,OAAO,MAAA,KAAW,cAAc,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,cAAA,CAAA,GAAmB,MAAA;AAAA;AACjF,OACD,CAAA;AACD,MAAA,IAAI,OAAO,MAAM,KAAA;AAAA,IACnB,CAAA;AAAA,IAEA,MAAM,aAAA,CAAc,KAAA,EAAO,OAAA,EAAS;AAQlC,MAAA,MAAM,QAAA,GAAW,OAAA,EAAS,UAAA,IAAc,MAAA,CAAO,gBAAA;AAC/C,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,IAAA,CAAK,sBAAsB,KAAA,EAAO;AAAA,QACjE,UAAA,EAAY,QAAA,GACR,cAAA,CAAe,QAAA,EAAU,UAAU,CAAA,GACnC,OAAO,MAAA,KAAW,WAAA,GAChB,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,GACzB;AAAA,OACP,CAAA;AACD,MAAA,IAAI,OAAO,MAAM,KAAA;AAAA,IACnB,CAAA;AAAA,IAEA,MAAM,eAAe,QAAA,EAAU;AAG7B,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,KAAU,MAAM,QAAA,CAAS,KAAK,UAAA,CAAW;AAAA,QACrD,QAAA;AAAA,QACA,IAAA,EAAM,EAAE,CAAC,sBAAsB,GAAG,KAAA;AAAM,OACzC,CAAA;AACD,MAAA,IAAI,OAAO,MAAM,KAAA;AACjB,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,EAAE,OAAA;AAAQ,OAClB,GAAI,MAAM,QAAA,CAAS,IAAA,CAAK,UAAA,EAAW;AACnC,MAAA,IAAI,OAAA,EAAS,OAAO,kBAAA,CAAmB,OAAO,CAAA;AAC9C,MAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,OAAO,MAAA;AACvB,MAAA,OAAO;AAAA,QACL,WAAA,EAAa,EAAA;AAAA,QACb,YAAA,EAAc,EAAA;AAAA,QACd,SAAA,EAAW,CAAA;AAAA,QACX,IAAA,EAAM,eAAA,CAAgB,IAAA,CAAK,IAAI;AAAA,OACjC;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,eAAe,GAAA,EAAK;AACxB,MAAA,MAAM,SAAS,GAAA,KAAQ,OAAO,WAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,EAAA,CAAA;AAC9E,MAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,MAAM,CAAA;AAG7B,MAAA,MAAM,QAAA,GAAW,IAAI,eAAA,CAAgB,MAAA,CAAO,KAAK,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAC,CAAA;AAClE,MAAA,MAAM,KAAA,GAAQ,CAAC,GAAA,KAAgB,MAAA,CAAO,YAAA,CAAa,IAAI,GAAG,CAAA,IAAK,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAE/E,MAAA,MAAM,IAAA,GAAO,MAAM,MAAM,CAAA;AACzB,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,MAAM,EAAE,MAAM,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,IAAA,CAAK,uBAAuB,IAAI,CAAA;AACvE,QAAA,IAAI,OAAO,MAAM,KAAA;AACjB,QAAA,OAAO,IAAA,CAAK,OAAA,GAAU,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAA,GAAI,IAAA;AAAA,MAC3D;AAIA,MAAA,MAAM,SAAA,GAAY,KAAA,CAAM,YAAY,CAAA,IAAK,MAAM,OAAO,CAAA;AACtD,MAAA,MAAM,IAAA,GAAO,MAAM,MAAM,CAAA;AACzB,MAAA,IAAI,aAAa,IAAA,EAAM;AACrB,QAAA,MAAM,EAAE,IAAA,EAAM,KAAA,KAAU,MAAM,QAAA,CAAS,KAAK,SAAA,CAAU;AAAA,UACpD,UAAA,EAAY,SAAA;AAAA,UACZ;AAAA,SACD,CAAA;AACD,QAAA,IAAI,OAAO,MAAM,KAAA;AACjB,QAAA,OAAO,IAAA,CAAK,OAAA,GAAU,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAA,GAAI,IAAA;AAAA,MAC3D;AAEA,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,EAAE,OAAA;AAAQ,OAClB,GAAI,MAAM,QAAA,CAAS,IAAA,CAAK,UAAA,EAAW;AACnC,MAAA,OAAO,OAAA,GAAU,kBAAA,CAAmB,OAAO,CAAA,GAAI,IAAA;AAAA,IACjD,CAAA;AAAA,IAEA,MAAM,UAAA,CAAW,KAAA,EAAO,OAAA,EAAS;AAK/B,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,KAAK,aAAA,CAAc;AAAA,QAClD,KAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,gBAAA,EAAkB,IAAA;AAAA,UAClB,eAAA,EACE,OAAA,EAAS,UAAA,KACR,OAAO,MAAA,KAAW,cAAc,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,GAAM,MAAA,CAAA;AAAA;AAAA;AAAA;AAAA,UAIlE,IAAA,EAAM,EAAE,GAAG,OAAA,EAAS,MAAM,CAAC,sBAAsB,GAAG,IAAA;AAAK;AAC3D,OACD,CAAA;AACD,MAAA,IAAI,OAAO,MAAM,KAAA;AAAA,IACnB;AAAA,GACF;AACF;;;ACjNA,IAAM,iBAAA,GAA8B;AAAA,EAClC,EAAA,EAAI,cAAA;AAAA,EACJ,KAAA,EAAO,eAAA;AAAA,EACP,QAAA,EAAU,WAAA;AAAA,EACV,IAAA,EAAM;AACR,CAAA;AAEA,IAAM,WAAA,GAAc,gBAAA;AAEpB,SAAS,WAAW,QAAA,EAA8B;AAChD,EAAA,OAAO;AAAA,IACL,IAAI,QAAA,CAAS,EAAA;AAAA,IACb,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,UAAU,QAAA,CAAS;AAAA,GACrB;AACF;AAEA,SAAS,kBAAkB,IAAA,EAA6B;AACtD,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,CAAA,WAAA,EAAc,IAAA,CAAK,EAAE,CAAA,CAAA;AAAA,IAClC,YAAA,EAAc,CAAA,aAAA,EAAgB,IAAA,CAAK,EAAE,CAAA,CAAA;AAAA,IACrC,WAAW,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI,IAAA;AAAA,IAC3C;AAAA,GACF;AACF;AAEA,SAAS,SAAA,GAA6D;AACpE,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,YAAA,KAAiB,WAAA,EAAa,OAAO,IAAA;AAChD,IAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,CAAQ,WAAW,CAAA;AAC5C,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,UAAU,IAAA,EAA6D;AAC9E,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,iBAAiB,WAAA,EAAa;AACzC,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,YAAA,CAAa,OAAA,CAAQ,WAAA,EAAa,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,IACxD,CAAA,MAAO;AACL,MAAA,YAAA,CAAa,WAAW,WAAW,CAAA;AAAA,IACrC;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEO,SAAS,qBAAA,CAAsB,WAAqB,iBAAA,EAAgC;AACzF,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAqC;AAE3D,EAAA,SAAS,gBAAgB,IAAA,EAA6B;AACpD,IAAA,KAAA,MAAW,EAAA,IAAM,SAAA,EAAW,EAAA,CAAG,IAAI,CAAA;AAAA,EACrC;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,UAAA,GAAa;AACjB,MAAA,OAAO,SAAA,EAAU;AAAA,IACnB,CAAA;AAAA,IAEA,kBAAkB,EAAA,EAAI;AACpB,MAAA,SAAA,CAAU,IAAI,EAAE,CAAA;AAChB,MAAA,OAAO,MAAM;AACX,QAAA,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,MACrB,CAAA;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,KAAA,EAAO,SAAA,EAAW;AAI7B,MAAA,MAAM,SAAS,SAAA,EAAU;AACzB,MAAA,MAAM,OACJ,MAAA,IAAU,MAAA,CAAO,KAAK,KAAA,KAAU,KAAA,GAC5B,OAAO,IAAA,GACP;AAAA,QACE,IAAI,KAAA,KAAU,QAAA,CAAS,QAAQ,QAAA,CAAS,EAAA,GAAK,QAAQ,KAAK,CAAA,CAAA;AAAA,QAC1D,KAAA;AAAA,QACA,QAAA,EAAU,KAAA,KAAU,QAAA,CAAS,KAAA,GAAQ,QAAA,CAAS,QAAA,GAAY,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK;AAAA,OACnF;AACN,MAAA,MAAM,OAAA,GAAU,kBAAkB,IAAI,CAAA;AACtC,MAAA,SAAA,CAAU,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AAC3B,MAAA,eAAA,CAAgB,IAAI,CAAA;AACpB,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,KAAA,EAAO,SAAA,EAAW,QAAA,EAAU;AAEvC,MAAA,MAAM,IAAA,GAAiB;AAAA,QACrB,EAAA,EAAI,QAAQ,KAAK,CAAA,CAAA;AAAA,QACjB,KAAA;AAAA,QACA,UAAU,QAAA,KAAa,KAAA,CAAM,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,SAAA;AAAA,OAChD;AACA,MAAA,MAAM,OAAA,GAAU,kBAAkB,IAAI,CAAA;AACtC,MAAA,SAAA,CAAU,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AAC3B,MAAA,eAAA,CAAgB,IAAI,CAAA;AACpB,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,OAAA,GAAU;AACd,MAAA,SAAA,CAAU,IAAI,CAAA;AACd,MAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,IACtB,CAAA;AAAA,IAEA,MAAM,gBAAgB,SAAA,EAAW;AAE/B,MAAA,MAAM,IAAA,GAAO,WAAW,QAAQ,CAAA;AAChC,MAAA,MAAM,OAAA,GAAU,kBAAkB,IAAI,CAAA;AACtC,MAAA,SAAA,CAAU,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AAC3B,MAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,IACtB,CAAA;AAAA,IAEA,MAAM,cAAc,MAAA,EAAQ;AAAA,IAE5B,CAAA;AAAA,IAEA,MAAM,eAAe,SAAA,EAAW;AAC9B,MAAA,MAAM,SAAS,SAAA,EAAU;AACzB,MAAA,OAAO,MAAA,EAAQ,OAAA;AAAA,IACjB,CAAA;AAAA,IAEA,MAAM,cAAA,GAAiB;AACrB,MAAA,OAAO,SAAA,IAAa,OAAA,IAAW,IAAA;AAAA,IACjC,CAAA;AAAA,IAEA,MAAM,UAAA,CAAW,MAAA,EAAQ,QAAA,EAAU;AAAA,IAGnC;AAAA,GACF;AACF;AC1HA,IAAM,YAAA,GAA0B;AAAA,EAC9B,IAAA,EAAM,IAAA;AAAA,EACN,OAAA,EAAS,IAAA;AAAA,EACT,SAAA,EAAW,IAAA;AAAA,EACX,eAAA,EAAiB,KAAA;AAAA,EACjB,KAAA,EAAO;AACT,CAAA;AAEO,IAAM,YAAA,GAAe,MAAA,CAAkB,CAAC,GAAA,MAAS;AAAA,EACtD,GAAG,YAAA;AAAA,EAEH,OAAA,EAAS,CAAC,IAAA,KACR,GAAA,CAAI,EAAE,IAAA,EAAM,eAAA,EAAiB,IAAA,KAAS,IAAA,EAAM,CAAA;AAAA,EAE9C,UAAA,EAAY,CAAC,OAAA,KACX,GAAA,CAAI;AAAA,IACF,OAAA;AAAA,IACA,IAAA,EAAM,SAAS,IAAA,IAAQ,IAAA;AAAA,IACvB,iBAAiB,OAAA,KAAY;AAAA,GAC9B,CAAA;AAAA,EAEH,YAAY,CAAC,SAAA,KAAc,GAAA,CAAI,EAAE,WAAW,CAAA;AAAA,EAE5C,UAAU,CAAC,KAAA,KAAU,GAAA,CAAI,EAAE,OAAO,CAAA;AAAA,EAElC,KAAA,EAAO,MAAM,GAAA,CAAI,YAAY;AAC/B,CAAA,CAAE;AC1BF,IAAM,WAAA,GAAc,cAAuC,IAAI,CAAA;AAWxD,SAAS,YAAA,CAAa,EAAE,OAAA,EAAS,QAAA,EAAS,EAAsB;AACrE,EAAA,MAAM,EAAE,UAAA,EAAY,UAAA,EAAY,QAAA,EAAU,KAAA,KAAU,YAAA,EAAa;AAGjE,EAAA,MAAM,UAAA,GAAa,OAAO,OAAO,CAAA;AACjC,EAAA,UAAA,CAAW,OAAA,GAAU,OAAA;AAErB,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,WAAA;AAEJ,IAAA,eAAe,IAAA,GAAO;AACpB,MAAA,IAAI;AACF,QAAA,UAAA,CAAW,IAAI,CAAA;AACf,QAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,OAAA,CAAQ,UAAA,EAAW;AACnD,QAAA,UAAA,CAAW,MAAA,EAAQ,WAAW,IAAI,CAAA;AAAA,MACpC,SAAS,GAAA,EAAK;AACZ,QAAA,QAAA,CAAS,GAAA,YAAe,QAAQ,GAAA,GAAM,IAAI,MAAM,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA;AAAA,MAC9D,CAAA,SAAE;AACA,QAAA,UAAA,CAAW,KAAK,CAAA;AAAA,MAClB;AAGA,MAAA,WAAA,GAAc,UAAA,CAAW,OAAA,CAAQ,iBAAA,CAAkB,CAAC,IAAA,KAAS;AAC3D,QAAA,IAAI,CAAC,IAAA,EAAM;AACT,UAAA,KAAA,EAAM;AAEN,UAAA,UAAA,CAAW,KAAK,CAAA;AAChB,UAAA;AAAA,QACF;AAIA,QAAA,KAAK,UAAA,CAAW,OAAA,CAAQ,UAAA,EAAW,CAAE,KAAK,CAAC,MAAA,KAAW,UAAA,CAAW,MAAA,EAAQ,OAAA,IAAW,IAAI,CAAC,CAAA,CAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MAC3G,CAAC,CAAA;AAAA,IACH;AAEA,IAAA,KAAK,IAAA,EAAK;AAEV,IAAA,OAAO,MAAM;AACX,MAAA,WAAA,IAAc;AAAA,IAChB,CAAA;AAAA,EAEF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,KAAA,GAA0B;AAAA,IAC9B,MAAM,MAAA,CAAO,KAAA,EAAO,QAAA,EAAU;AAC5B,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAU,MAAM,UAAA,CAAW,OAAA,CAAQ,MAAA,CAAO,OAAO,QAAQ,CAAA;AAC/D,QAAA,UAAA,CAAW,OAAO,CAAA;AAClB,QAAA,OAAO,OAAA;AAAA,MACT,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU;AACtC,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAU,MAAM,UAAA,CAAW,QAAQ,MAAA,CAAO,KAAA,EAAO,UAAU,QAAQ,CAAA;AACzE,QAAA,UAAA,CAAW,OAAO,CAAA;AAClB,QAAA,OAAO,OAAA;AAAA,MACT,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,OAAA,GAAU;AACd,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,QAAQ,OAAA,EAAQ;AACjC,QAAA,KAAA,EAAM;AACN,QAAA,UAAA,CAAW,KAAK,CAAA;AAAA,MAClB,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,gBAAgB,QAAA,EAAU;AAC9B,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,CAAQ,eAAA,CAAgB,QAAQ,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,aAAA,CAAc,KAAA,EAAO,OAAA,EAAS;AAClC,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,CAAQ,aAAA,CAAc,KAAA,EAAO,OAAO,CAAA;AAAA,MACvD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,eAAe,QAAA,EAAU;AAC7B,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,OAAA,CAAQ,iBAAiB,QAAQ,CAAA;AAClE,QAAA,IAAI,OAAA,aAAoB,OAAO,CAAA;AAC/B,QAAA,OAAO,OAAA;AAAA,MACT,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,eAAe,GAAA,EAAK;AACxB,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAU,MAAM,UAAA,CAAW,OAAA,CAAQ,cAAA,GAAiB,GAAG,CAAA,IAAK,IAAA;AAClE,QAAA,IAAI,OAAA,aAAoB,OAAO,CAAA;AAC/B,QAAA,OAAO,OAAA;AAAA,MACT,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,UAAA,CAAW,KAAA,EAAO,OAAA,EAAS;AAC/B,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,CAAQ,UAAA,GAAa,KAAA,EAAO,OAAO,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF;AAAA,GACF;AAEA,EAAA,uBAAO,GAAA,CAAC,WAAA,CAAY,QAAA,EAAZ,EAAqB,OAAe,QAAA,EAAS,CAAA;AACvD;AAMO,SAAS,OAAA,GAAU;AACxB,EAAA,MAAM,GAAA,GAAM,WAAW,WAAW,CAAA;AAClC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,EAC9D;AAEA,EAAA,MAAM,EAAE,IAAA,EAAM,OAAA,EAAS,WAAW,eAAA,EAAiB,KAAA,KAAU,YAAA,EAAa;AAE1E,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA,eAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,SAAS,GAAA,CAAI,OAAA;AAAA,IACb,iBAAiB,GAAA,CAAI,eAAA;AAAA,IACrB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,gBAAgB,GAAA,CAAI,cAAA;AAAA,IACpB,gBAAgB,GAAA,CAAI,cAAA;AAAA,IACpB,YAAY,GAAA,CAAI;AAAA,GAClB;AACF","file":"index.js","sourcesContent":["// ---------------------------------------------------------------------------\n// Auth link intent — what the URL the user just arrived on is asking for.\n//\n// A Supabase recovery / magic link lands on the app with the tokens in the URL\n// FRAGMENT (implicit flow is the supabase-js default), e.g.\n//\n//   https://app.example.com/#access_token=…&refresh_token=…&type=recovery\n//\n// GoTrue then consumes that fragment and wipes it (`window.location.hash = ''`)\n// as soon as the client initialises — so by the time React renders, the reason\n// the user is here is gone. Hence the module-load snapshot: this file is\n// imported long before any createClient() call, so it always sees the original\n// URL.\n//\n// Errors arrive the same way, without a `type`:\n//\n//   https://app.example.com/#error=access_denied&error_code=otp_expired&…\n// ---------------------------------------------------------------------------\n\nexport type AuthUrlIntent =\n  /** A password-recovery link — the user must choose a new password now. */\n  | { kind: 'recovery' }\n  /** A one-time link that was already used or has expired. */\n  | { kind: 'expired'; message?: string }\n\n/** Query param apps can put on their own redirect URLs to force the\n *  set-password screen (e.g. when they override `resetPasswordUrl`). */\nexport const AUTH_INTENT_PARAM = 'fayz_auth'\n\n/** Path segment the SDK historically used as the reset-password redirect.\n *  Still honoured so apps that configured it keep working. */\nconst RESET_PATH = '/auth/reset-password'\n\ninterface UrlSnapshot {\n  pathname: string\n  search: string\n  hash: string\n}\n\nfunction snapshot(): UrlSnapshot | null {\n  if (typeof window === 'undefined') return null\n  return {\n    pathname: window.location.pathname,\n    search: window.location.search,\n    hash: window.location.hash,\n  }\n}\n\n/** Taken at import time — before any Supabase client can strip the fragment. */\nconst initialUrl: UrlSnapshot | null = snapshot()\n\n/** The fragment can be either auth params (`access_token=…&type=recovery`) or a\n *  hash-router path (`#/dashboard`). Only the former parses into pairs. */\nfunction hashParams(hash: string): URLSearchParams {\n  const raw = hash.replace(/^#/, '')\n  if (!raw || !raw.includes('=')) return new URLSearchParams()\n  return new URLSearchParams(raw)\n}\n\nexport function readAuthUrlIntent(url?: UrlSnapshot | null): AuthUrlIntent | null {\n  const loc = url ?? initialUrl\n  if (!loc) return null\n\n  const query = new URLSearchParams(loc.search)\n  const hash = hashParams(loc.hash)\n  const param = (key: string) => hash.get(key) ?? query.get(key)\n\n  const errorCode = param('error_code') ?? param('error')\n  const errorDescription = param('error_description')?.replace(/\\+/g, ' ')\n  // A dead one-time link (`error_code=otp_expired`). Deliberately narrow: an\n  // OAuth `access_denied` is a different failure and must not land here. GoTrue\n  // does not echo `type` on error redirects, so recovery and invite links are\n  // indistinguishable at this point — the screen offers a fresh link either way.\n  if (errorCode && /otp|expired|link/i.test(`${errorCode} ${errorDescription ?? ''}`)) {\n    return { kind: 'expired', message: errorDescription ?? undefined }\n  }\n\n  const marker = query.get(AUTH_INTENT_PARAM)\n  const type = param('type')\n  if (type === 'recovery' || marker === 'recovery') return { kind: 'recovery' }\n\n  // `/auth/reset-password` with no tokens at all: the user opened the reset URL\n  // directly, or the tokens were already consumed by a previous page load.\n  const path = loc.pathname.replace(/\\/+$/, '')\n  if (path.endsWith(RESET_PATH)) return { kind: 'recovery' }\n\n  return null\n}\n\n/** Strip auth leftovers from the address bar once the flow is finished, so a\n *  reload does not put the user back on the set-password screen (and so the\n *  hash router gets a clean slate). */\nexport function clearAuthUrlTokens(): void {\n  if (typeof window === 'undefined') return\n  const url = new URL(window.location.href)\n  url.searchParams.delete(AUTH_INTENT_PARAM)\n  if (url.hash.includes('=')) url.hash = ''\n  window.history.replaceState(window.history.state, '', url.toString())\n}\n\n/** Add the intent marker to a redirect URL. Absolute or relative; existing\n *  params are preserved. */\nexport function withAuthIntent(url: string, intent: 'recovery'): string {\n  const base = typeof window === 'undefined' ? 'http://localhost' : window.location.origin\n  const parsed = new URL(url, base)\n  parsed.searchParams.set(AUTH_INTENT_PARAM, intent)\n  return /^https?:\\/\\//i.test(url) ? parsed.toString() : `${parsed.pathname}${parsed.search}${parsed.hash}`\n}\n\n// ---------------------------------------------------------------------------\n// Whether the user owes us a password before they reach the app. Pure, so the\n// decision is testable without a browser; the React wrapper lives in\n// @fayz-ai/plugin-auth (usePasswordSetupGate).\n// ---------------------------------------------------------------------------\n\nexport type PasswordSetupReason = 'recovery' | 'invite'\n\nexport interface PasswordSetupInput {\n  intent: AuthUrlIntent | null\n  /** Session still resolving — the link's tokens are exchanged asynchronously. */\n  isLoading: boolean\n  isAuthenticated: boolean\n  /** AuthUser.mustSetPassword — an invitee who never chose one. */\n  mustSetPassword?: boolean\n}\n\nexport interface PasswordSetupDecision {\n  reason: PasswordSetupReason | null\n  expired: boolean\n  checking: boolean\n}\n\nconst NOTHING: PasswordSetupDecision = { reason: null, expired: false, checking: false }\n\nexport function decidePasswordSetup(input: PasswordSetupInput): PasswordSetupDecision {\n  const { intent, isLoading, isAuthenticated, mustSetPassword } = input\n\n  if (intent?.kind === 'expired') return { reason: 'recovery', expired: true, checking: false }\n\n  if (intent?.kind === 'recovery') {\n    if (isLoading) return { reason: 'recovery', expired: false, checking: true }\n    // A recovery link with no session behind it was already used or has expired.\n    return { reason: 'recovery', expired: !isAuthenticated, checking: false }\n  }\n\n  if (!isLoading && isAuthenticated && mustSetPassword) {\n    return { reason: 'invite', expired: false, checking: false }\n  }\n\n  return NOTHING\n}\n","import { createClient, type SupabaseClient } from '@supabase/supabase-js'\nimport type { AuthAdapter, AuthUser, AuthSession, AuthProvider } from '@fayz-ai/core'\nimport { withAuthIntent } from '../url-intent'\n\n/** Metadata flag stamped on invited users (created by a magic link, so they have\n *  no password yet) and cleared the moment they choose one. Metadata, not a URL\n *  param: it survives the link being opened later, in another browser, or twice —\n *  and it needs no new entry in Supabase's redirect allow-list. */\nexport const MUST_SET_PASSWORD_FLAG = 'fayz_must_set_password'\n\nexport interface SupabaseAuthConfig {\n  supabaseUrl: string\n  supabaseAnonKey: string\n  supabaseClient?: SupabaseClient\n  callbackUrl?: string\n  resetPasswordUrl?: string\n}\n\nfunction mapSupabaseUser(supabaseUser: {\n  id: string\n  email?: string | null\n  created_at?: string\n  updated_at?: string | null\n  email_confirmed_at?: string | null\n  user_metadata?: Record<string, unknown>\n  app_metadata?: { providers?: string[]; provider?: string }\n}): AuthUser {\n  return {\n    id: supabaseUser.id,\n    email: supabaseUser.email ?? '',\n    fullName:\n      (supabaseUser.user_metadata?.['full_name'] as string | undefined) ??\n      (supabaseUser.user_metadata?.['name'] as string | undefined) ??\n      '',\n    avatarUrl: supabaseUser.user_metadata?.['avatar_url'] as string | undefined,\n    mustSetPassword: supabaseUser.user_metadata?.[MUST_SET_PASSWORD_FLAG] === true,\n  }\n}\n\nfunction mapSupabaseSession(session: {\n  access_token: string\n  refresh_token?: string\n  expires_at?: number\n  expires_in?: number\n  user: Parameters<typeof mapSupabaseUser>[0]\n}): AuthSession {\n  return {\n    accessToken: session.access_token,\n    refreshToken: session.refresh_token,\n    expiresAt:\n      session.expires_at ??\n      Math.floor(Date.now() / 1000) + (session.expires_in ?? 3600),\n    user: mapSupabaseUser(session.user),\n  }\n}\n\nexport function createSupabaseAuthAdapter(config: SupabaseAuthConfig): AuthAdapter {\n  const supabase = config.supabaseClient ?? createClient(config.supabaseUrl, config.supabaseAnonKey)\n\n  return {\n    async getSession() {\n      const {\n        data: { session },\n      } = await supabase.auth.getSession()\n      if (!session) return null\n      const mapped = mapSupabaseSession(session)\n      return { user: mapped.user, session: mapped }\n    },\n\n    onAuthStateChange(cb) {\n      const {\n        data: { subscription },\n      } = supabase.auth.onAuthStateChange((_event, session) => {\n        cb(session ? mapSupabaseUser(session.user) : null)\n      })\n      return () => subscription.unsubscribe()\n    },\n\n    async signIn(email, password) {\n      const { data, error } = await supabase.auth.signInWithPassword({ email, password })\n      if (error) throw error\n      return mapSupabaseSession(data.session)\n    },\n\n    async signUp(email, password, fullName) {\n      const { data, error } = await supabase.auth.signUp({\n        email,\n        password,\n        options: { data: { full_name: fullName } },\n      })\n      if (error) throw error\n\n      // When email confirmation is required, session is null\n      if (!data.session) {\n        if (!data.user) throw new Error('Signup failed: no user returned')\n        return {\n          accessToken: '',\n          refreshToken: '',\n          expiresAt: 0,\n          user: mapSupabaseUser(data.user),\n        }\n      }\n\n      return mapSupabaseSession(data.session)\n    },\n\n    async signOut() {\n      const { error } = await supabase.auth.signOut()\n      if (error) throw error\n    },\n\n    async signInWithOAuth(provider: AuthProvider) {\n      const { error } = await supabase.auth.signInWithOAuth({\n        provider: provider as 'google' | 'github' | 'apple',\n        options: {\n          redirectTo:\n            config.callbackUrl ??\n            (typeof window !== 'undefined' ? `${window.location.origin}/auth/callback` : undefined),\n        },\n      })\n      if (error) throw error\n    },\n\n    async resetPassword(email, options) {\n      // Root, not `/auth/reset-password`: the shell recognises a recovery link by\n      // the link's own `type=recovery` param, so the flow needs no route of its\n      // own — and the app root is the one URL every deployment already serves and\n      // every Supabase project already allow-lists (a URL outside the allow-list\n      // is silently swapped for the project's Site URL, i.e. another app).\n      // A host that DOES point recovery somewhere else gets the explicit intent\n      // marker, since we cannot assume its landing page carries the params.\n      const explicit = options?.redirectTo ?? config.resetPasswordUrl\n      const { error } = await supabase.auth.resetPasswordForEmail(email, {\n        redirectTo: explicit\n          ? withAuthIntent(explicit, 'recovery')\n          : typeof window !== 'undefined'\n            ? `${window.location.origin}/`\n            : undefined,\n      })\n      if (error) throw error\n    },\n\n    async updatePassword(password) {\n      // Clearing the flag in the same call as the password: one round-trip, and\n      // no window where the password is set but the screen still demands one.\n      const { data, error } = await supabase.auth.updateUser({\n        password,\n        data: { [MUST_SET_PASSWORD_FLAG]: false },\n      })\n      if (error) throw error\n      const {\n        data: { session },\n      } = await supabase.auth.getSession()\n      if (session) return mapSupabaseSession(session)\n      if (!data.user) return undefined\n      return {\n        accessToken: '',\n        refreshToken: '',\n        expiresAt: 0,\n        user: mapSupabaseUser(data.user),\n      }\n    },\n\n    async handleCallback(url) {\n      const target = url ?? (typeof window !== 'undefined' ? window.location.href : '')\n      const parsed = new URL(target)\n      // The fragment carries the params on the implicit flow; the query on PKCE\n      // and on `{{ .TokenHash }}`-style e-mail templates.\n      const fragment = new URLSearchParams(parsed.hash.replace(/^#/, ''))\n      const param = (key: string) => parsed.searchParams.get(key) ?? fragment.get(key)\n\n      const code = param('code')\n      if (code) {\n        const { data, error } = await supabase.auth.exchangeCodeForSession(code)\n        if (error) throw error\n        return data.session ? mapSupabaseSession(data.session) : null\n      }\n\n      // Templates that link straight at the app with a token instead of routing\n      // through GoTrue's /verify never produce a session on their own.\n      const tokenHash = param('token_hash') ?? param('token')\n      const type = param('type')\n      if (tokenHash && type) {\n        const { data, error } = await supabase.auth.verifyOtp({\n          token_hash: tokenHash,\n          type: type as 'recovery' | 'invite' | 'magiclink' | 'signup' | 'email',\n        })\n        if (error) throw error\n        return data.session ? mapSupabaseSession(data.session) : null\n      }\n\n      const {\n        data: { session },\n      } = await supabase.auth.getSession()\n      return session ? mapSupabaseSession(session) : null\n    },\n\n    async inviteUser(email, options) {\n      // Native, edge-function-free invite: a passwordless magic link. Sends the\n      // e-mail + creates the auth user (anon-callable, no service-role/admin).\n      // Membership is NOT granted from `data` (a client could forge it) — the\n      // accept-time trigger trusts the RLS-protected public.invitations row.\n      const { error } = await supabase.auth.signInWithOtp({\n        email,\n        options: {\n          shouldCreateUser: true,\n          emailRedirectTo:\n            options?.redirectTo ??\n            (typeof window !== 'undefined' ? `${window.location.origin}/` : undefined),\n          // `data` only lands on users the OTP actually creates, which is exactly\n          // who needs a password: the shell holds them on the set-password screen\n          // until they choose one, so they can sign in normally from then on.\n          data: { ...options?.data, [MUST_SET_PASSWORD_FLAG]: true },\n        },\n      })\n      if (error) throw error\n    },\n  }\n}\n","import type { AuthAdapter, AuthUser, AuthSession } from '@fayz-ai/core'\n\nexport interface MockUser {\n  id: string\n  email: string\n  fullName: string\n  role?: string\n}\n\nconst DEFAULT_MOCK_USER: MockUser = {\n  id: 'mock-user-id',\n  email: 'demo@fayz.dev',\n  fullName: 'Demo User',\n  role: 'admin',\n}\n\nconst STORAGE_KEY = 'fayz:mock-auth'\n\nfunction toAuthUser(mockUser: MockUser): AuthUser {\n  return {\n    id: mockUser.id,\n    email: mockUser.email,\n    fullName: mockUser.fullName,\n  }\n}\n\nfunction createMockSession(user: AuthUser): AuthSession {\n  return {\n    accessToken: `mock-token-${user.id}`,\n    refreshToken: `mock-refresh-${user.id}`,\n    expiresAt: Math.floor(Date.now() / 1000) + 3600,\n    user,\n  }\n}\n\nfunction getStored(): { user: AuthUser; session: AuthSession } | null {\n  try {\n    if (typeof localStorage === 'undefined') return null\n    const raw = localStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    return JSON.parse(raw) as { user: AuthUser; session: AuthSession }\n  } catch {\n    return null\n  }\n}\n\nfunction setStored(data: { user: AuthUser; session: AuthSession } | null): void {\n  try {\n    if (typeof localStorage === 'undefined') return\n    if (data) {\n      localStorage.setItem(STORAGE_KEY, JSON.stringify(data))\n    } else {\n      localStorage.removeItem(STORAGE_KEY)\n    }\n  } catch {\n    // SSR or storage unavailable — silently skip\n  }\n}\n\nexport function createMockAuthAdapter(mockUser: MockUser = DEFAULT_MOCK_USER): AuthAdapter {\n  const listeners = new Set<(user: AuthUser | null) => void>()\n\n  function notifyListeners(user: AuthUser | null): void {\n    for (const cb of listeners) cb(user)\n  }\n\n  return {\n    async getSession() {\n      return getStored()\n    },\n\n    onAuthStateChange(cb) {\n      listeners.add(cb)\n      return () => {\n        listeners.delete(cb)\n      }\n    },\n\n    async signIn(email, _password) {\n      // Mock accepts any credentials, but the identity FOLLOWS the email —\n      // storefront customers and saas users keep their own purchase/session\n      // history instead of all becoming the configured demo user.\n      const stored = getStored()\n      const user: AuthUser =\n        stored && stored.user.email === email\n          ? stored.user\n          : {\n              id: email === mockUser.email ? mockUser.id : `mock-${email}`,\n              email,\n              fullName: email === mockUser.email ? mockUser.fullName : (email.split('@')[0] ?? 'Cliente'),\n            }\n      const session = createMockSession(user)\n      setStored({ user, session })\n      notifyListeners(user)\n      return session\n    },\n\n    async signUp(email, _password, fullName) {\n      // Mock signup creates a user from the provided details\n      const user: AuthUser = {\n        id: `mock-${email}`,\n        email,\n        fullName: fullName || (email.split('@')[0] ?? 'Cliente'),\n      }\n      const session = createMockSession(user)\n      setStored({ user, session })\n      notifyListeners(user)\n      return session\n    },\n\n    async signOut() {\n      setStored(null)\n      notifyListeners(null)\n    },\n\n    async signInWithOAuth(_provider) {\n      // Mock OAuth signs in as the configured user\n      const user = toAuthUser(mockUser)\n      const session = createMockSession(user)\n      setStored({ user, session })\n      notifyListeners(user)\n    },\n\n    async resetPassword(_email) {\n      // No-op in mock\n    },\n\n    async updatePassword(_password) {\n      const stored = getStored()\n      return stored?.session\n    },\n\n    async handleCallback() {\n      return getStored()?.session ?? null\n    },\n\n    async inviteUser(_email, _options) {\n      // No admin path in mock — the org mock adapter still records the pending\n      // invite so the Team UI shows it. Delivery is a no-op locally.\n    },\n  }\n}\n","import { create } from 'zustand'\nimport type { AuthUser, AuthSession } from '@fayz-ai/core'\n\nexport interface AuthState {\n  user: AuthUser | null\n  session: AuthSession | null\n  isLoading: boolean\n  isAuthenticated: boolean\n  error: Error | null\n}\n\nexport interface AuthStore extends AuthState {\n  setUser: (user: AuthUser | null) => void\n  setSession: (session: AuthSession | null) => void\n  setLoading: (isLoading: boolean) => void\n  setError: (error: Error | null) => void\n  reset: () => void\n}\n\nconst initialState: AuthState = {\n  user: null,\n  session: null,\n  isLoading: true,\n  isAuthenticated: false,\n  error: null,\n}\n\nexport const useAuthStore = create<AuthStore>((set) => ({\n  ...initialState,\n\n  setUser: (user) =>\n    set({ user, isAuthenticated: user !== null }),\n\n  setSession: (session) =>\n    set({\n      session,\n      user: session?.user ?? null,\n      isAuthenticated: session !== null,\n    }),\n\n  setLoading: (isLoading) => set({ isLoading }),\n\n  setError: (error) => set({ error }),\n\n  reset: () => set(initialState),\n}))\n","import React, { createContext, useContext, useEffect, useRef } from 'react'\nimport type { AuthAdapter, AuthProvider as OAuthProvider, AuthSession } from '@fayz-ai/core'\nimport { useAuthStore } from './store'\n\n// ---------------------------------------------------------------------------\n// Context\n// ---------------------------------------------------------------------------\n\ninterface AuthContextValue {\n  signIn: (email: string, password: string) => Promise<AuthSession>\n  signUp: (email: string, password: string, fullName: string) => Promise<AuthSession>\n  signOut: () => Promise<void>\n  signInWithOAuth: (provider: OAuthProvider) => Promise<void>\n  resetPassword: (email: string, options?: { redirectTo?: string }) => Promise<void>\n  updatePassword: (password: string) => Promise<AuthSession | void>\n  handleCallback: (url?: string) => Promise<AuthSession | null>\n  inviteUser: (email: string, options?: { redirectTo?: string; data?: Record<string, unknown> }) => Promise<void>\n}\n\nconst AuthContext = createContext<AuthContextValue | null>(null)\n\n// ---------------------------------------------------------------------------\n// Provider\n// ---------------------------------------------------------------------------\n\nexport interface AuthProviderProps {\n  adapter: AuthAdapter\n  children: React.ReactNode\n}\n\nexport function AuthProvider({ adapter, children }: AuthProviderProps) {\n  const { setSession, setLoading, setError, reset } = useAuthStore()\n\n  // Keep a stable ref to the adapter so the effect only runs once on mount\n  const adapterRef = useRef(adapter)\n  adapterRef.current = adapter\n\n  useEffect(() => {\n    let unsubscribe: (() => void) | undefined\n\n    async function init() {\n      try {\n        setLoading(true)\n        const result = await adapterRef.current.getSession()\n        setSession(result?.session ?? null)\n      } catch (err) {\n        setError(err instanceof Error ? err : new Error(String(err)))\n      } finally {\n        setLoading(false)\n      }\n\n      // Subscribe to future auth state changes\n      unsubscribe = adapterRef.current.onAuthStateChange((user) => {\n        if (!user) {\n          reset()\n          // Keep isLoading false after an explicit sign-out\n          setLoading(false)\n          return\n        }\n        // Positive change (adapter-driven sign-in — e.g. an external callback,\n        // another tab, or a direct adapter.signUp bridge) — sync the session so\n        // consumers reflect it even when the call didn't go through ctx.signIn.\n        void adapterRef.current.getSession().then((result) => setSession(result?.session ?? null)).catch(() => {})\n      })\n    }\n\n    void init()\n\n    return () => {\n      unsubscribe?.()\n    }\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [])\n\n  const value: AuthContextValue = {\n    async signIn(email, password) {\n      setError(null)\n      try {\n        const session = await adapterRef.current.signIn(email, password)\n        setSession(session)\n        return session\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async signUp(email, password, fullName) {\n      setError(null)\n      try {\n        const session = await adapterRef.current.signUp(email, password, fullName)\n        setSession(session)\n        return session\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async signOut() {\n      setError(null)\n      try {\n        await adapterRef.current.signOut()\n        reset()\n        setLoading(false)\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async signInWithOAuth(provider) {\n      setError(null)\n      try {\n        await adapterRef.current.signInWithOAuth(provider)\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async resetPassword(email, options) {\n      setError(null)\n      try {\n        await adapterRef.current.resetPassword(email, options)\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async updatePassword(password) {\n      setError(null)\n      try {\n        const session = await adapterRef.current.updatePassword?.(password)\n        if (session) setSession(session)\n        return session\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async handleCallback(url) {\n      setError(null)\n      try {\n        const session = await adapterRef.current.handleCallback?.(url) ?? null\n        if (session) setSession(session)\n        return session\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async inviteUser(email, options) {\n      setError(null)\n      try {\n        await adapterRef.current.inviteUser?.(email, options)\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n  }\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>\n}\n\n// ---------------------------------------------------------------------------\n// Hook\n// ---------------------------------------------------------------------------\n\nexport function useAuth() {\n  const ctx = useContext(AuthContext)\n  if (!ctx) {\n    throw new Error('useAuth must be used inside <AuthProvider>')\n  }\n\n  const { user, session, isLoading, isAuthenticated, error } = useAuthStore()\n\n  return {\n    user,\n    session,\n    isLoading,\n    isAuthenticated,\n    error,\n    signIn: ctx.signIn,\n    signUp: ctx.signUp,\n    signOut: ctx.signOut,\n    signInWithOAuth: ctx.signInWithOAuth,\n    resetPassword: ctx.resetPassword,\n    updatePassword: ctx.updatePassword,\n    handleCallback: ctx.handleCallback,\n    inviteUser: ctx.inviteUser,\n  }\n}\n"]}
+{"version":3,"sources":["../src/lib/url-intent.ts","../src/adapters/supabase.ts","../src/adapters/mock.ts","../src/store.ts","../src/context.tsx"],"names":[],"mappings":";;;;;;;;AA2BO,IAAM,iBAAA,GAAoB;AAIjC,IAAM,UAAA,GAAa,sBAAA;AAQnB,SAAS,QAAA,GAA+B;AACtC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,OAAO,QAAA,CAAS,QAAA;AAAA,IAC1B,MAAA,EAAQ,OAAO,QAAA,CAAS,MAAA;AAAA,IACxB,IAAA,EAAM,OAAO,QAAA,CAAS;AAAA,GACxB;AACF;AAGA,IAAM,aAAiC,QAAA,EAAS;AAIhD,SAAS,WAAW,IAAA,EAA+B;AACjD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA;AACjC,EAAA,IAAI,CAAC,OAAO,CAAC,GAAA,CAAI,SAAS,GAAG,CAAA,EAAG,OAAO,IAAI,eAAA,EAAgB;AAC3D,EAAA,OAAO,IAAI,gBAAgB,GAAG,CAAA;AAChC;AAEO,SAAS,kBAAkB,GAAA,EAAgD;AAChF,EAAA,MAAM,MAAM,GAAA,IAAO,UAAA;AACnB,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AAEjB,EAAA,MAAM,KAAA,GAAQ,IAAI,eAAA,CAAgB,GAAA,CAAI,MAAM,CAAA;AAC5C,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AAChC,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAA,KAAgB,IAAA,CAAK,IAAI,GAAG,CAAA,IAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAE7D,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,YAAY,CAAA,IAAK,MAAM,OAAO,CAAA;AACtD,EAAA,MAAM,mBAAmB,KAAA,CAAM,mBAAmB,CAAA,EAAG,OAAA,CAAQ,OAAO,GAAG,CAAA;AAKvE,EAAA,IAAI,SAAA,IAAa,oBAAoB,IAAA,CAAK,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,gBAAA,IAAoB,EAAE,CAAA,CAAE,CAAA,EAAG;AACnF,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAS,oBAAoB,MAAA,EAAU;AAAA,EACnE;AAEA,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,iBAAiB,CAAA;AAC1C,EAAA,MAAM,IAAA,GAAO,MAAM,MAAM,CAAA;AACzB,EAAA,IAAI,SAAS,UAAA,IAAc,MAAA,KAAW,YAAY,OAAO,EAAE,MAAM,UAAA,EAAW;AAI5E,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAC5C,EAAA,IAAI,KAAK,QAAA,CAAS,UAAU,GAAG,OAAO,EAAE,MAAM,UAAA,EAAW;AAEzD,EAAA,OAAO,IAAA;AACT;AAKO,SAAS,kBAAA,GAA2B;AACzC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAA,CAAO,SAAS,IAAI,CAAA;AACxC,EAAA,GAAA,CAAI,YAAA,CAAa,OAAO,iBAAiB,CAAA;AACzC,EAAA,IAAI,IAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,MAAO,IAAA,GAAO,EAAA;AACvC,EAAA,MAAA,CAAO,OAAA,CAAQ,aAAa,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAA,EAAI,GAAA,CAAI,UAAU,CAAA;AACtE;AAIO,SAAS,cAAA,CAAe,KAAa,MAAA,EAA4B;AACtE,EAAA,MAAM,OAAO,OAAO,MAAA,KAAW,WAAA,GAAc,kBAAA,GAAqB,OAAO,QAAA,CAAS,MAAA;AAClF,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AAChC,EAAA,MAAA,CAAO,YAAA,CAAa,GAAA,CAAI,iBAAA,EAAmB,MAAM,CAAA;AACjD,EAAA,OAAO,eAAA,CAAgB,IAAA,CAAK,GAAG,CAAA,GAAI,OAAO,QAAA,EAAS,GAAI,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,EAAG,OAAO,IAAI,CAAA,CAAA;AACzG;AAyBA,IAAM,UAAiC,EAAE,MAAA,EAAQ,MAAM,OAAA,EAAS,KAAA,EAAO,UAAU,KAAA,EAAM;AAEhF,SAAS,oBAAoB,KAAA,EAAkD;AACpF,EAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,EAAW,eAAA,EAAiB,iBAAgB,GAAI,KAAA;AAEhE,EAAA,IAAI,MAAA,EAAQ,IAAA,KAAS,SAAA,EAAW,OAAO,EAAE,QAAQ,UAAA,EAAY,OAAA,EAAS,IAAA,EAAM,QAAA,EAAU,KAAA,EAAM;AAE5F,EAAA,IAAI,MAAA,EAAQ,SAAS,UAAA,EAAY;AAC/B,IAAA,IAAI,SAAA,SAAkB,EAAE,MAAA,EAAQ,YAAY,OAAA,EAAS,KAAA,EAAO,UAAU,IAAA,EAAK;AAE3E,IAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,SAAS,CAAC,eAAA,EAAiB,UAAU,KAAA,EAAM;AAAA,EAC1E;AAEA,EAAA,IAAI,CAAC,SAAA,IAAa,eAAA,IAAmB,eAAA,EAAiB;AACpD,IAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,OAAA,EAAS,KAAA,EAAO,UAAU,KAAA,EAAM;AAAA,EAC7D;AAEA,EAAA,OAAO,OAAA;AACT;;;AC9IO,IAAM,sBAAA,GAAyB;AAUtC,SAAS,gBAAgB,YAAA,EAQZ;AACX,EAAA,OAAO;AAAA,IACL,IAAI,YAAA,CAAa,EAAA;AAAA,IACjB,KAAA,EAAO,aAAa,KAAA,IAAS,EAAA;AAAA,IAC7B,QAAA,EACG,aAAa,aAAA,GAAgB,WAAW,KACxC,YAAA,CAAa,aAAA,GAAgB,MAAM,CAAA,IACpC,EAAA;AAAA,IACF,SAAA,EAAW,YAAA,CAAa,aAAA,GAAgB,YAAY,CAAA;AAAA,IACpD,eAAA,EAAiB,YAAA,CAAa,aAAA,GAAgB,sBAAsB,CAAA,KAAM;AAAA,GAC5E;AACF;AAEA,SAAS,mBAAmB,OAAA,EAMZ;AACd,EAAA,OAAO;AAAA,IACL,aAAa,OAAA,CAAQ,YAAA;AAAA,IACrB,cAAc,OAAA,CAAQ,aAAA;AAAA,IACtB,SAAA,EACE,OAAA,CAAQ,UAAA,IACR,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA,IAAK,OAAA,CAAQ,UAAA,IAAc,IAAA,CAAA;AAAA,IACzD,IAAA,EAAM,eAAA,CAAgB,OAAA,CAAQ,IAAI;AAAA,GACpC;AACF;AAEO,SAAS,0BAA0B,MAAA,EAAyC;AACjF,EAAA,MAAM,WAAW,MAAA,CAAO,cAAA,IAAkB,aAAa,MAAA,CAAO,WAAA,EAAa,OAAO,eAAe,CAAA;AAEjG,EAAA,OAAO;AAAA,IACL,MAAM,UAAA,GAAa;AACjB,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,EAAE,OAAA;AAAQ,OAClB,GAAI,MAAM,QAAA,CAAS,IAAA,CAAK,UAAA,EAAW;AACnC,MAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,MAAA,MAAM,MAAA,GAAS,mBAAmB,OAAO,CAAA;AACzC,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,SAAS,MAAA,EAAO;AAAA,IAC9C,CAAA;AAAA,IAEA,kBAAkB,EAAA,EAAI;AACpB,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,EAAE,YAAA;AAAa,UACnB,QAAA,CAAS,IAAA,CAAK,iBAAA,CAAkB,CAAC,QAAQ,OAAA,KAAY;AACvD,QAAA,EAAA,CAAG,OAAA,GAAU,eAAA,CAAgB,OAAA,CAAQ,IAAI,IAAI,IAAI,CAAA;AAAA,MACnD,CAAC,CAAA;AACD,MAAA,OAAO,MAAM,aAAa,WAAA,EAAY;AAAA,IACxC,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,KAAA,EAAO,QAAA,EAAU;AAC5B,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,IAAA,CAAK,kBAAA,CAAmB,EAAE,KAAA,EAAO,QAAA,EAAU,CAAA;AAClF,MAAA,IAAI,OAAO,MAAM,KAAA;AACjB,MAAA,OAAO,kBAAA,CAAmB,KAAK,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU;AACtC,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,KAAU,MAAM,QAAA,CAAS,KAAK,MAAA,CAAO;AAAA,QACjD,KAAA;AAAA,QACA,QAAA;AAAA,QACA,SAAS,EAAE,IAAA,EAAM,EAAE,SAAA,EAAW,UAAS;AAAE,OAC1C,CAAA;AACD,MAAA,IAAI,OAAO,MAAM,KAAA;AAGjB,MAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,QAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,iCAAiC,CAAA;AACjE,QAAA,OAAO;AAAA,UACL,WAAA,EAAa,EAAA;AAAA,UACb,YAAA,EAAc,EAAA;AAAA,UACd,SAAA,EAAW,CAAA;AAAA,UACX,IAAA,EAAM,eAAA,CAAgB,IAAA,CAAK,IAAI;AAAA,SACjC;AAAA,MACF;AAEA,MAAA,OAAO,kBAAA,CAAmB,KAAK,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,IAEA,MAAM,OAAA,GAAU;AACd,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,KAAK,OAAA,EAAQ;AAC9C,MAAA,IAAI,OAAO,MAAM,KAAA;AAAA,IACnB,CAAA;AAAA,IAEA,MAAM,gBAAgB,QAAA,EAAwB;AAC5C,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,KAAK,eAAA,CAAgB;AAAA,QACpD,QAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,UAAA,EACE,MAAA,CAAO,WAAA,KACN,OAAO,MAAA,KAAW,cAAc,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,cAAA,CAAA,GAAmB,MAAA;AAAA;AACjF,OACD,CAAA;AACD,MAAA,IAAI,OAAO,MAAM,KAAA;AAAA,IACnB,CAAA;AAAA,IAEA,MAAM,aAAA,CAAc,KAAA,EAAO,OAAA,EAAS;AAQlC,MAAA,MAAM,QAAA,GAAW,OAAA,EAAS,UAAA,IAAc,MAAA,CAAO,gBAAA;AAC/C,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,IAAA,CAAK,sBAAsB,KAAA,EAAO;AAAA,QACjE,UAAA,EAAY,QAAA,GACR,cAAA,CAAe,QAAA,EAAU,UAAU,CAAA,GACnC,OAAO,MAAA,KAAW,WAAA,GAChB,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,GACzB;AAAA,OACP,CAAA;AACD,MAAA,IAAI,OAAO,MAAM,KAAA;AAAA,IACnB,CAAA;AAAA,IAEA,MAAM,eAAe,QAAA,EAAU;AAG7B,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,KAAU,MAAM,QAAA,CAAS,KAAK,UAAA,CAAW;AAAA,QACrD,QAAA;AAAA,QACA,IAAA,EAAM,EAAE,CAAC,sBAAsB,GAAG,KAAA;AAAM,OACzC,CAAA;AACD,MAAA,IAAI,OAAO,MAAM,KAAA;AACjB,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,EAAE,OAAA;AAAQ,OAClB,GAAI,MAAM,QAAA,CAAS,IAAA,CAAK,UAAA,EAAW;AACnC,MAAA,IAAI,OAAA,EAAS,OAAO,kBAAA,CAAmB,OAAO,CAAA;AAC9C,MAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,OAAO,MAAA;AACvB,MAAA,OAAO;AAAA,QACL,WAAA,EAAa,EAAA;AAAA,QACb,YAAA,EAAc,EAAA;AAAA,QACd,SAAA,EAAW,CAAA;AAAA,QACX,IAAA,EAAM,eAAA,CAAgB,IAAA,CAAK,IAAI;AAAA,OACjC;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,eAAe,GAAA,EAAK;AACxB,MAAA,MAAM,SAAS,GAAA,KAAQ,OAAO,WAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,EAAA,CAAA;AAC9E,MAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,MAAM,CAAA;AAG7B,MAAA,MAAM,QAAA,GAAW,IAAI,eAAA,CAAgB,MAAA,CAAO,KAAK,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAC,CAAA;AAClE,MAAA,MAAM,KAAA,GAAQ,CAAC,GAAA,KAAgB,MAAA,CAAO,YAAA,CAAa,IAAI,GAAG,CAAA,IAAK,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAE/E,MAAA,MAAM,IAAA,GAAO,MAAM,MAAM,CAAA;AACzB,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,MAAM,EAAE,MAAM,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,IAAA,CAAK,uBAAuB,IAAI,CAAA;AACvE,QAAA,IAAI,OAAO,MAAM,KAAA;AACjB,QAAA,OAAO,IAAA,CAAK,OAAA,GAAU,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAA,GAAI,IAAA;AAAA,MAC3D;AAIA,MAAA,MAAM,SAAA,GAAY,KAAA,CAAM,YAAY,CAAA,IAAK,MAAM,OAAO,CAAA;AACtD,MAAA,MAAM,IAAA,GAAO,MAAM,MAAM,CAAA;AACzB,MAAA,IAAI,aAAa,IAAA,EAAM;AACrB,QAAA,MAAM,EAAE,IAAA,EAAM,KAAA,KAAU,MAAM,QAAA,CAAS,KAAK,SAAA,CAAU;AAAA,UACpD,UAAA,EAAY,SAAA;AAAA,UACZ;AAAA,SACD,CAAA;AACD,QAAA,IAAI,OAAO,MAAM,KAAA;AACjB,QAAA,OAAO,IAAA,CAAK,OAAA,GAAU,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAA,GAAI,IAAA;AAAA,MAC3D;AAEA,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,EAAE,OAAA;AAAQ,OAClB,GAAI,MAAM,QAAA,CAAS,IAAA,CAAK,UAAA,EAAW;AACnC,MAAA,OAAO,OAAA,GAAU,kBAAA,CAAmB,OAAO,CAAA,GAAI,IAAA;AAAA,IACjD,CAAA;AAAA,IAEA,MAAM,UAAA,CAAW,KAAA,EAAO,OAAA,EAAS;AAK/B,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,QAAA,CAAS,KAAK,aAAA,CAAc;AAAA,QAClD,KAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,gBAAA,EAAkB,IAAA;AAAA,UAClB,eAAA,EACE,OAAA,EAAS,UAAA,KACR,OAAO,MAAA,KAAW,cAAc,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,GAAM,MAAA,CAAA;AAAA;AAAA;AAAA;AAAA,UAIlE,IAAA,EAAM,EAAE,GAAG,OAAA,EAAS,MAAM,CAAC,sBAAsB,GAAG,IAAA;AAAK;AAC3D,OACD,CAAA;AACD,MAAA,IAAI,OAAO,MAAM,KAAA;AAAA,IACnB;AAAA,GACF;AACF;;;ACjNA,IAAM,iBAAA,GAA8B;AAAA,EAClC,EAAA,EAAI,cAAA;AAAA,EACJ,KAAA,EAAO,eAAA;AAAA,EACP,QAAA,EAAU,WAAA;AAAA,EACV,IAAA,EAAM;AACR,CAAA;AAEA,IAAM,WAAA,GAAc,gBAAA;AAEpB,SAAS,WAAW,QAAA,EAA8B;AAChD,EAAA,OAAO;AAAA,IACL,IAAI,QAAA,CAAS,EAAA;AAAA,IACb,OAAO,QAAA,CAAS,KAAA;AAAA,IAChB,UAAU,QAAA,CAAS;AAAA,GACrB;AACF;AAEA,SAAS,kBAAkB,IAAA,EAA6B;AACtD,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,CAAA,WAAA,EAAc,IAAA,CAAK,EAAE,CAAA,CAAA;AAAA,IAClC,YAAA,EAAc,CAAA,aAAA,EAAgB,IAAA,CAAK,EAAE,CAAA,CAAA;AAAA,IACrC,WAAW,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI,IAAA;AAAA,IAC3C;AAAA,GACF;AACF;AAEA,SAAS,SAAA,GAA6D;AACpE,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,YAAA,KAAiB,WAAA,EAAa,OAAO,IAAA;AAChD,IAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,CAAQ,WAAW,CAAA;AAC5C,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,UAAU,IAAA,EAA6D;AAC9E,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,iBAAiB,WAAA,EAAa;AACzC,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,YAAA,CAAa,OAAA,CAAQ,WAAA,EAAa,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,IACxD,CAAA,MAAO;AACL,MAAA,YAAA,CAAa,WAAW,WAAW,CAAA;AAAA,IACrC;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEO,SAAS,qBAAA,CAAsB,WAAqB,iBAAA,EAAgC;AACzF,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAqC;AAE3D,EAAA,SAAS,gBAAgB,IAAA,EAA6B;AACpD,IAAA,KAAA,MAAW,EAAA,IAAM,SAAA,EAAW,EAAA,CAAG,IAAI,CAAA;AAAA,EACrC;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,UAAA,GAAa;AACjB,MAAA,OAAO,SAAA,EAAU;AAAA,IACnB,CAAA;AAAA,IAEA,kBAAkB,EAAA,EAAI;AACpB,MAAA,SAAA,CAAU,IAAI,EAAE,CAAA;AAChB,MAAA,OAAO,MAAM;AACX,QAAA,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,MACrB,CAAA;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,KAAA,EAAO,SAAA,EAAW;AAI7B,MAAA,MAAM,SAAS,SAAA,EAAU;AACzB,MAAA,MAAM,OACJ,MAAA,IAAU,MAAA,CAAO,KAAK,KAAA,KAAU,KAAA,GAC5B,OAAO,IAAA,GACP;AAAA,QACE,IAAI,KAAA,KAAU,QAAA,CAAS,QAAQ,QAAA,CAAS,EAAA,GAAK,QAAQ,KAAK,CAAA,CAAA;AAAA,QAC1D,KAAA;AAAA,QACA,QAAA,EAAU,KAAA,KAAU,QAAA,CAAS,KAAA,GAAQ,QAAA,CAAS,QAAA,GAAY,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK;AAAA,OACnF;AACN,MAAA,MAAM,OAAA,GAAU,kBAAkB,IAAI,CAAA;AACtC,MAAA,SAAA,CAAU,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AAC3B,MAAA,eAAA,CAAgB,IAAI,CAAA;AACpB,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,KAAA,EAAO,SAAA,EAAW,QAAA,EAAU;AAEvC,MAAA,MAAM,IAAA,GAAiB;AAAA,QACrB,EAAA,EAAI,QAAQ,KAAK,CAAA,CAAA;AAAA,QACjB,KAAA;AAAA,QACA,UAAU,QAAA,KAAa,KAAA,CAAM,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,SAAA;AAAA,OAChD;AACA,MAAA,MAAM,OAAA,GAAU,kBAAkB,IAAI,CAAA;AACtC,MAAA,SAAA,CAAU,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AAC3B,MAAA,eAAA,CAAgB,IAAI,CAAA;AACpB,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,OAAA,GAAU;AACd,MAAA,SAAA,CAAU,IAAI,CAAA;AACd,MAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,IACtB,CAAA;AAAA,IAEA,MAAM,gBAAgB,SAAA,EAAW;AAE/B,MAAA,MAAM,IAAA,GAAO,WAAW,QAAQ,CAAA;AAChC,MAAA,MAAM,OAAA,GAAU,kBAAkB,IAAI,CAAA;AACtC,MAAA,SAAA,CAAU,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AAC3B,MAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,IACtB,CAAA;AAAA,IAEA,MAAM,cAAc,MAAA,EAAQ;AAAA,IAE5B,CAAA;AAAA,IAEA,MAAM,eAAe,SAAA,EAAW;AAC9B,MAAA,MAAM,SAAS,SAAA,EAAU;AACzB,MAAA,OAAO,MAAA,EAAQ,OAAA;AAAA,IACjB,CAAA;AAAA,IAEA,MAAM,cAAA,GAAiB;AACrB,MAAA,OAAO,SAAA,IAAa,OAAA,IAAW,IAAA;AAAA,IACjC,CAAA;AAAA,IAEA,MAAM,UAAA,CAAW,MAAA,EAAQ,QAAA,EAAU;AAAA,IAGnC;AAAA,GACF;AACF;AC1HA,IAAM,YAAA,GAA0B;AAAA,EAC9B,IAAA,EAAM,IAAA;AAAA,EACN,OAAA,EAAS,IAAA;AAAA,EACT,SAAA,EAAW,IAAA;AAAA,EACX,eAAA,EAAiB,KAAA;AAAA,EACjB,KAAA,EAAO;AACT,CAAA;AAEO,IAAM,YAAA,GAAe,MAAA,CAAkB,CAAC,GAAA,MAAS;AAAA,EACtD,GAAG,YAAA;AAAA,EAEH,OAAA,EAAS,CAAC,IAAA,KACR,GAAA,CAAI,EAAE,IAAA,EAAM,eAAA,EAAiB,IAAA,KAAS,IAAA,EAAM,CAAA;AAAA,EAE9C,UAAA,EAAY,CAAC,OAAA,KACX,GAAA,CAAI;AAAA,IACF,OAAA;AAAA,IACA,IAAA,EAAM,SAAS,IAAA,IAAQ,IAAA;AAAA,IACvB,iBAAiB,OAAA,KAAY;AAAA,GAC9B,CAAA;AAAA,EAEH,YAAY,CAAC,SAAA,KAAc,GAAA,CAAI,EAAE,WAAW,CAAA;AAAA,EAE5C,UAAU,CAAC,KAAA,KAAU,GAAA,CAAI,EAAE,OAAO,CAAA;AAAA,EAElC,KAAA,EAAO,MAAM,GAAA,CAAI,YAAY;AAC/B,CAAA,CAAE;AC1BF,IAAM,WAAA,GAAc,cAAuC,IAAI,CAAA;AAWxD,SAAS,YAAA,CAAa,EAAE,OAAA,EAAS,QAAA,EAAS,EAAsB;AACrE,EAAA,MAAM,EAAE,UAAA,EAAY,UAAA,EAAY,QAAA,EAAU,KAAA,KAAU,YAAA,EAAa;AAGjE,EAAA,MAAM,UAAA,GAAa,OAAO,OAAO,CAAA;AACjC,EAAA,UAAA,CAAW,OAAA,GAAU,OAAA;AAErB,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,WAAA;AAEJ,IAAA,eAAe,IAAA,GAAO;AACpB,MAAA,IAAI;AACF,QAAA,UAAA,CAAW,IAAI,CAAA;AACf,QAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,OAAA,CAAQ,UAAA,EAAW;AACnD,QAAA,UAAA,CAAW,MAAA,EAAQ,WAAW,IAAI,CAAA;AAAA,MACpC,SAAS,GAAA,EAAK;AACZ,QAAA,QAAA,CAAS,GAAA,YAAe,QAAQ,GAAA,GAAM,IAAI,MAAM,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA;AAAA,MAC9D,CAAA,SAAE;AACA,QAAA,UAAA,CAAW,KAAK,CAAA;AAAA,MAClB;AAGA,MAAA,WAAA,GAAc,UAAA,CAAW,OAAA,CAAQ,iBAAA,CAAkB,CAAC,IAAA,KAAS;AAC3D,QAAA,IAAI,CAAC,IAAA,EAAM;AACT,UAAA,KAAA,EAAM;AAEN,UAAA,UAAA,CAAW,KAAK,CAAA;AAChB,UAAA;AAAA,QACF;AAIA,QAAA,KAAK,UAAA,CAAW,OAAA,CAAQ,UAAA,EAAW,CAAE,KAAK,CAAC,MAAA,KAAW,UAAA,CAAW,MAAA,EAAQ,OAAA,IAAW,IAAI,CAAC,CAAA,CAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MAC3G,CAAC,CAAA;AAAA,IACH;AAEA,IAAA,KAAK,IAAA,EAAK;AAEV,IAAA,OAAO,MAAM;AACX,MAAA,WAAA,IAAc;AAAA,IAChB,CAAA;AAAA,EAEF,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,KAAA,GAA0B;AAAA,IAC9B,MAAM,MAAA,CAAO,KAAA,EAAO,QAAA,EAAU;AAC5B,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAU,MAAM,UAAA,CAAW,OAAA,CAAQ,MAAA,CAAO,OAAO,QAAQ,CAAA;AAC/D,QAAA,UAAA,CAAW,OAAO,CAAA;AAClB,QAAA,OAAO,OAAA;AAAA,MACT,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU;AACtC,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAU,MAAM,UAAA,CAAW,QAAQ,MAAA,CAAO,KAAA,EAAO,UAAU,QAAQ,CAAA;AACzE,QAAA,UAAA,CAAW,OAAO,CAAA;AAClB,QAAA,OAAO,OAAA;AAAA,MACT,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,OAAA,GAAU;AACd,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,QAAQ,OAAA,EAAQ;AACjC,QAAA,KAAA,EAAM;AACN,QAAA,UAAA,CAAW,KAAK,CAAA;AAAA,MAClB,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,gBAAgB,QAAA,EAAU;AAC9B,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,CAAQ,eAAA,CAAgB,QAAQ,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,aAAA,CAAc,KAAA,EAAO,OAAA,EAAS;AAClC,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,CAAQ,aAAA,CAAc,KAAA,EAAO,OAAO,CAAA;AAAA,MACvD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,eAAe,QAAA,EAAU;AAC7B,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,OAAA,CAAQ,iBAAiB,QAAQ,CAAA;AAClE,QAAA,IAAI,OAAA,aAAoB,OAAO,CAAA;AAC/B,QAAA,OAAO,OAAA;AAAA,MACT,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,eAAe,GAAA,EAAK;AACxB,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAU,MAAM,UAAA,CAAW,OAAA,CAAQ,cAAA,GAAiB,GAAG,CAAA,IAAK,IAAA;AAClE,QAAA,IAAI,OAAA,aAAoB,OAAO,CAAA;AAC/B,QAAA,OAAO,OAAA;AAAA,MACT,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,UAAA,CAAW,KAAA,EAAO,OAAA,EAAS;AAC/B,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,CAAQ,UAAA,GAAa,KAAA,EAAO,OAAO,CAAA;AAAA,MACtD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAChE,QAAA,QAAA,CAAS,KAAK,CAAA;AACd,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF;AAAA,GACF;AAEA,EAAA,uBAAO,GAAA,CAAC,WAAA,CAAY,QAAA,EAAZ,EAAqB,OAAe,QAAA,EAAS,CAAA;AACvD;AAMO,SAAS,OAAA,GAAU;AACxB,EAAA,MAAM,GAAA,GAAM,WAAW,WAAW,CAAA;AAClC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,EAC9D;AAEA,EAAA,MAAM,EAAE,IAAA,EAAM,OAAA,EAAS,WAAW,eAAA,EAAiB,KAAA,KAAU,YAAA,EAAa;AAE1E,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA,eAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,SAAS,GAAA,CAAI,OAAA;AAAA,IACb,iBAAiB,GAAA,CAAI,eAAA;AAAA,IACrB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,gBAAgB,GAAA,CAAI,cAAA;AAAA,IACpB,gBAAgB,GAAA,CAAI,cAAA;AAAA,IACpB,YAAY,GAAA,CAAI;AAAA,GAClB;AACF","file":"index.js","sourcesContent":["// ---------------------------------------------------------------------------\n// Auth link intent — what the URL the user just arrived on is asking for.\n//\n// A Supabase recovery / magic link lands on the app with the tokens in the URL\n// FRAGMENT (implicit flow is the supabase-js default), e.g.\n//\n//   https://app.example.com/#access_token=…&refresh_token=…&type=recovery\n//\n// GoTrue then consumes that fragment and wipes it (`window.location.hash = ''`)\n// as soon as the client initialises — so by the time React renders, the reason\n// the user is here is gone. Hence the module-load snapshot: this file is\n// imported long before any createClient() call, so it always sees the original\n// URL.\n//\n// Errors arrive the same way, without a `type`:\n//\n//   https://app.example.com/#error=access_denied&error_code=otp_expired&…\n// ---------------------------------------------------------------------------\n\nexport type AuthUrlIntent =\n  /** A password-recovery link — the user must choose a new password now. */\n  | { kind: 'recovery' }\n  /** A one-time link that was already used or has expired. */\n  | { kind: 'expired'; message?: string }\n\n/** Query param apps can put on their own redirect URLs to force the\n *  set-password screen (e.g. when they override `resetPasswordUrl`). */\nexport const AUTH_INTENT_PARAM = 'fayz_auth'\n\n/** Path segment the SDK historically used as the reset-password redirect.\n *  Still honoured so apps that configured it keep working. */\nconst RESET_PATH = '/auth/reset-password'\n\ninterface UrlSnapshot {\n  pathname: string\n  search: string\n  hash: string\n}\n\nfunction snapshot(): UrlSnapshot | null {\n  if (typeof window === 'undefined') return null\n  return {\n    pathname: window.location.pathname,\n    search: window.location.search,\n    hash: window.location.hash,\n  }\n}\n\n/** Taken at import time — before any Supabase client can strip the fragment. */\nconst initialUrl: UrlSnapshot | null = snapshot()\n\n/** The fragment can be either auth params (`access_token=…&type=recovery`) or a\n *  hash-router path (`#/dashboard`). Only the former parses into pairs. */\nfunction hashParams(hash: string): URLSearchParams {\n  const raw = hash.replace(/^#/, '')\n  if (!raw || !raw.includes('=')) return new URLSearchParams()\n  return new URLSearchParams(raw)\n}\n\nexport function readAuthUrlIntent(url?: UrlSnapshot | null): AuthUrlIntent | null {\n  const loc = url ?? initialUrl\n  if (!loc) return null\n\n  const query = new URLSearchParams(loc.search)\n  const hash = hashParams(loc.hash)\n  const param = (key: string) => hash.get(key) ?? query.get(key)\n\n  const errorCode = param('error_code') ?? param('error')\n  const errorDescription = param('error_description')?.replace(/\\+/g, ' ')\n  // A dead one-time link (`error_code=otp_expired`). Deliberately narrow: an\n  // OAuth `access_denied` is a different failure and must not land here. GoTrue\n  // does not echo `type` on error redirects, so recovery and invite links are\n  // indistinguishable at this point — the screen offers a fresh link either way.\n  if (errorCode && /otp|expired|link/i.test(`${errorCode} ${errorDescription ?? ''}`)) {\n    return { kind: 'expired', message: errorDescription ?? undefined }\n  }\n\n  const marker = query.get(AUTH_INTENT_PARAM)\n  const type = param('type')\n  if (type === 'recovery' || marker === 'recovery') return { kind: 'recovery' }\n\n  // `/auth/reset-password` with no tokens at all: the user opened the reset URL\n  // directly, or the tokens were already consumed by a previous page load.\n  const path = loc.pathname.replace(/\\/+$/, '')\n  if (path.endsWith(RESET_PATH)) return { kind: 'recovery' }\n\n  return null\n}\n\n/** Strip auth leftovers from the address bar once the flow is finished, so a\n *  reload does not put the user back on the set-password screen (and so the\n *  hash router gets a clean slate). */\nexport function clearAuthUrlTokens(): void {\n  if (typeof window === 'undefined') return\n  const url = new URL(window.location.href)\n  url.searchParams.delete(AUTH_INTENT_PARAM)\n  if (url.hash.includes('=')) url.hash = ''\n  window.history.replaceState(window.history.state, '', url.toString())\n}\n\n/** Add the intent marker to a redirect URL. Absolute or relative; existing\n *  params are preserved. */\nexport function withAuthIntent(url: string, intent: 'recovery'): string {\n  const base = typeof window === 'undefined' ? 'http://localhost' : window.location.origin\n  const parsed = new URL(url, base)\n  parsed.searchParams.set(AUTH_INTENT_PARAM, intent)\n  return /^https?:\\/\\//i.test(url) ? parsed.toString() : `${parsed.pathname}${parsed.search}${parsed.hash}`\n}\n\n// ---------------------------------------------------------------------------\n// Whether the user owes us a password before they reach the app. Pure, so the\n// decision is testable without a browser; the React wrapper lives in\n// @fayz-ai/plugin-auth (usePasswordSetupGate).\n// ---------------------------------------------------------------------------\n\nexport type PasswordSetupReason = 'recovery' | 'invite'\n\nexport interface PasswordSetupInput {\n  intent: AuthUrlIntent | null\n  /** Session still resolving — the link's tokens are exchanged asynchronously. */\n  isLoading: boolean\n  isAuthenticated: boolean\n  /** AuthUser.mustSetPassword — an invitee who never chose one. */\n  mustSetPassword?: boolean\n}\n\nexport interface PasswordSetupDecision {\n  reason: PasswordSetupReason | null\n  expired: boolean\n  checking: boolean\n}\n\nconst NOTHING: PasswordSetupDecision = { reason: null, expired: false, checking: false }\n\nexport function decidePasswordSetup(input: PasswordSetupInput): PasswordSetupDecision {\n  const { intent, isLoading, isAuthenticated, mustSetPassword } = input\n\n  if (intent?.kind === 'expired') return { reason: 'recovery', expired: true, checking: false }\n\n  if (intent?.kind === 'recovery') {\n    if (isLoading) return { reason: 'recovery', expired: false, checking: true }\n    // A recovery link with no session behind it was already used or has expired.\n    return { reason: 'recovery', expired: !isAuthenticated, checking: false }\n  }\n\n  if (!isLoading && isAuthenticated && mustSetPassword) {\n    return { reason: 'invite', expired: false, checking: false }\n  }\n\n  return NOTHING\n}\n","import { createClient, type SupabaseClient } from '@supabase/supabase-js'\nimport type { AuthAdapter, AuthUser, AuthSession, AuthProvider } from '@fayz-ai/core'\nimport { withAuthIntent } from '../lib/url-intent'\n\n/** Metadata flag stamped on invited users (created by a magic link, so they have\n *  no password yet) and cleared the moment they choose one. Metadata, not a URL\n *  param: it survives the link being opened later, in another browser, or twice —\n *  and it needs no new entry in Supabase's redirect allow-list. */\nexport const MUST_SET_PASSWORD_FLAG = 'fayz_must_set_password'\n\nexport interface SupabaseAuthConfig {\n  supabaseUrl: string\n  supabaseAnonKey: string\n  supabaseClient?: SupabaseClient\n  callbackUrl?: string\n  resetPasswordUrl?: string\n}\n\nfunction mapSupabaseUser(supabaseUser: {\n  id: string\n  email?: string | null\n  created_at?: string\n  updated_at?: string | null\n  email_confirmed_at?: string | null\n  user_metadata?: Record<string, unknown>\n  app_metadata?: { providers?: string[]; provider?: string }\n}): AuthUser {\n  return {\n    id: supabaseUser.id,\n    email: supabaseUser.email ?? '',\n    fullName:\n      (supabaseUser.user_metadata?.['full_name'] as string | undefined) ??\n      (supabaseUser.user_metadata?.['name'] as string | undefined) ??\n      '',\n    avatarUrl: supabaseUser.user_metadata?.['avatar_url'] as string | undefined,\n    mustSetPassword: supabaseUser.user_metadata?.[MUST_SET_PASSWORD_FLAG] === true,\n  }\n}\n\nfunction mapSupabaseSession(session: {\n  access_token: string\n  refresh_token?: string\n  expires_at?: number\n  expires_in?: number\n  user: Parameters<typeof mapSupabaseUser>[0]\n}): AuthSession {\n  return {\n    accessToken: session.access_token,\n    refreshToken: session.refresh_token,\n    expiresAt:\n      session.expires_at ??\n      Math.floor(Date.now() / 1000) + (session.expires_in ?? 3600),\n    user: mapSupabaseUser(session.user),\n  }\n}\n\nexport function createSupabaseAuthAdapter(config: SupabaseAuthConfig): AuthAdapter {\n  const supabase = config.supabaseClient ?? createClient(config.supabaseUrl, config.supabaseAnonKey)\n\n  return {\n    async getSession() {\n      const {\n        data: { session },\n      } = await supabase.auth.getSession()\n      if (!session) return null\n      const mapped = mapSupabaseSession(session)\n      return { user: mapped.user, session: mapped }\n    },\n\n    onAuthStateChange(cb) {\n      const {\n        data: { subscription },\n      } = supabase.auth.onAuthStateChange((_event, session) => {\n        cb(session ? mapSupabaseUser(session.user) : null)\n      })\n      return () => subscription.unsubscribe()\n    },\n\n    async signIn(email, password) {\n      const { data, error } = await supabase.auth.signInWithPassword({ email, password })\n      if (error) throw error\n      return mapSupabaseSession(data.session)\n    },\n\n    async signUp(email, password, fullName) {\n      const { data, error } = await supabase.auth.signUp({\n        email,\n        password,\n        options: { data: { full_name: fullName } },\n      })\n      if (error) throw error\n\n      // When email confirmation is required, session is null\n      if (!data.session) {\n        if (!data.user) throw new Error('Signup failed: no user returned')\n        return {\n          accessToken: '',\n          refreshToken: '',\n          expiresAt: 0,\n          user: mapSupabaseUser(data.user),\n        }\n      }\n\n      return mapSupabaseSession(data.session)\n    },\n\n    async signOut() {\n      const { error } = await supabase.auth.signOut()\n      if (error) throw error\n    },\n\n    async signInWithOAuth(provider: AuthProvider) {\n      const { error } = await supabase.auth.signInWithOAuth({\n        provider: provider as 'google' | 'github' | 'apple',\n        options: {\n          redirectTo:\n            config.callbackUrl ??\n            (typeof window !== 'undefined' ? `${window.location.origin}/auth/callback` : undefined),\n        },\n      })\n      if (error) throw error\n    },\n\n    async resetPassword(email, options) {\n      // Root, not `/auth/reset-password`: the shell recognises a recovery link by\n      // the link's own `type=recovery` param, so the flow needs no route of its\n      // own — and the app root is the one URL every deployment already serves and\n      // every Supabase project already allow-lists (a URL outside the allow-list\n      // is silently swapped for the project's Site URL, i.e. another app).\n      // A host that DOES point recovery somewhere else gets the explicit intent\n      // marker, since we cannot assume its landing page carries the params.\n      const explicit = options?.redirectTo ?? config.resetPasswordUrl\n      const { error } = await supabase.auth.resetPasswordForEmail(email, {\n        redirectTo: explicit\n          ? withAuthIntent(explicit, 'recovery')\n          : typeof window !== 'undefined'\n            ? `${window.location.origin}/`\n            : undefined,\n      })\n      if (error) throw error\n    },\n\n    async updatePassword(password) {\n      // Clearing the flag in the same call as the password: one round-trip, and\n      // no window where the password is set but the screen still demands one.\n      const { data, error } = await supabase.auth.updateUser({\n        password,\n        data: { [MUST_SET_PASSWORD_FLAG]: false },\n      })\n      if (error) throw error\n      const {\n        data: { session },\n      } = await supabase.auth.getSession()\n      if (session) return mapSupabaseSession(session)\n      if (!data.user) return undefined\n      return {\n        accessToken: '',\n        refreshToken: '',\n        expiresAt: 0,\n        user: mapSupabaseUser(data.user),\n      }\n    },\n\n    async handleCallback(url) {\n      const target = url ?? (typeof window !== 'undefined' ? window.location.href : '')\n      const parsed = new URL(target)\n      // The fragment carries the params on the implicit flow; the query on PKCE\n      // and on `{{ .TokenHash }}`-style e-mail templates.\n      const fragment = new URLSearchParams(parsed.hash.replace(/^#/, ''))\n      const param = (key: string) => parsed.searchParams.get(key) ?? fragment.get(key)\n\n      const code = param('code')\n      if (code) {\n        const { data, error } = await supabase.auth.exchangeCodeForSession(code)\n        if (error) throw error\n        return data.session ? mapSupabaseSession(data.session) : null\n      }\n\n      // Templates that link straight at the app with a token instead of routing\n      // through GoTrue's /verify never produce a session on their own.\n      const tokenHash = param('token_hash') ?? param('token')\n      const type = param('type')\n      if (tokenHash && type) {\n        const { data, error } = await supabase.auth.verifyOtp({\n          token_hash: tokenHash,\n          type: type as 'recovery' | 'invite' | 'magiclink' | 'signup' | 'email',\n        })\n        if (error) throw error\n        return data.session ? mapSupabaseSession(data.session) : null\n      }\n\n      const {\n        data: { session },\n      } = await supabase.auth.getSession()\n      return session ? mapSupabaseSession(session) : null\n    },\n\n    async inviteUser(email, options) {\n      // Native, edge-function-free invite: a passwordless magic link. Sends the\n      // e-mail + creates the auth user (anon-callable, no service-role/admin).\n      // Membership is NOT granted from `data` (a client could forge it) — the\n      // accept-time trigger trusts the RLS-protected public.invitations row.\n      const { error } = await supabase.auth.signInWithOtp({\n        email,\n        options: {\n          shouldCreateUser: true,\n          emailRedirectTo:\n            options?.redirectTo ??\n            (typeof window !== 'undefined' ? `${window.location.origin}/` : undefined),\n          // `data` only lands on users the OTP actually creates, which is exactly\n          // who needs a password: the shell holds them on the set-password screen\n          // until they choose one, so they can sign in normally from then on.\n          data: { ...options?.data, [MUST_SET_PASSWORD_FLAG]: true },\n        },\n      })\n      if (error) throw error\n    },\n  }\n}\n","import type { AuthAdapter, AuthUser, AuthSession } from '@fayz-ai/core'\n\nexport interface MockUser {\n  id: string\n  email: string\n  fullName: string\n  role?: string\n}\n\nconst DEFAULT_MOCK_USER: MockUser = {\n  id: 'mock-user-id',\n  email: 'demo@fayz.dev',\n  fullName: 'Demo User',\n  role: 'admin',\n}\n\nconst STORAGE_KEY = 'fayz:mock-auth'\n\nfunction toAuthUser(mockUser: MockUser): AuthUser {\n  return {\n    id: mockUser.id,\n    email: mockUser.email,\n    fullName: mockUser.fullName,\n  }\n}\n\nfunction createMockSession(user: AuthUser): AuthSession {\n  return {\n    accessToken: `mock-token-${user.id}`,\n    refreshToken: `mock-refresh-${user.id}`,\n    expiresAt: Math.floor(Date.now() / 1000) + 3600,\n    user,\n  }\n}\n\nfunction getStored(): { user: AuthUser; session: AuthSession } | null {\n  try {\n    if (typeof localStorage === 'undefined') return null\n    const raw = localStorage.getItem(STORAGE_KEY)\n    if (!raw) return null\n    return JSON.parse(raw) as { user: AuthUser; session: AuthSession }\n  } catch {\n    return null\n  }\n}\n\nfunction setStored(data: { user: AuthUser; session: AuthSession } | null): void {\n  try {\n    if (typeof localStorage === 'undefined') return\n    if (data) {\n      localStorage.setItem(STORAGE_KEY, JSON.stringify(data))\n    } else {\n      localStorage.removeItem(STORAGE_KEY)\n    }\n  } catch {\n    // SSR or storage unavailable — silently skip\n  }\n}\n\nexport function createMockAuthAdapter(mockUser: MockUser = DEFAULT_MOCK_USER): AuthAdapter {\n  const listeners = new Set<(user: AuthUser | null) => void>()\n\n  function notifyListeners(user: AuthUser | null): void {\n    for (const cb of listeners) cb(user)\n  }\n\n  return {\n    async getSession() {\n      return getStored()\n    },\n\n    onAuthStateChange(cb) {\n      listeners.add(cb)\n      return () => {\n        listeners.delete(cb)\n      }\n    },\n\n    async signIn(email, _password) {\n      // Mock accepts any credentials, but the identity FOLLOWS the email —\n      // storefront customers and saas users keep their own purchase/session\n      // history instead of all becoming the configured demo user.\n      const stored = getStored()\n      const user: AuthUser =\n        stored && stored.user.email === email\n          ? stored.user\n          : {\n              id: email === mockUser.email ? mockUser.id : `mock-${email}`,\n              email,\n              fullName: email === mockUser.email ? mockUser.fullName : (email.split('@')[0] ?? 'Cliente'),\n            }\n      const session = createMockSession(user)\n      setStored({ user, session })\n      notifyListeners(user)\n      return session\n    },\n\n    async signUp(email, _password, fullName) {\n      // Mock signup creates a user from the provided details\n      const user: AuthUser = {\n        id: `mock-${email}`,\n        email,\n        fullName: fullName || (email.split('@')[0] ?? 'Cliente'),\n      }\n      const session = createMockSession(user)\n      setStored({ user, session })\n      notifyListeners(user)\n      return session\n    },\n\n    async signOut() {\n      setStored(null)\n      notifyListeners(null)\n    },\n\n    async signInWithOAuth(_provider) {\n      // Mock OAuth signs in as the configured user\n      const user = toAuthUser(mockUser)\n      const session = createMockSession(user)\n      setStored({ user, session })\n      notifyListeners(user)\n    },\n\n    async resetPassword(_email) {\n      // No-op in mock\n    },\n\n    async updatePassword(_password) {\n      const stored = getStored()\n      return stored?.session\n    },\n\n    async handleCallback() {\n      return getStored()?.session ?? null\n    },\n\n    async inviteUser(_email, _options) {\n      // No admin path in mock — the org mock adapter still records the pending\n      // invite so the Team UI shows it. Delivery is a no-op locally.\n    },\n  }\n}\n","import { create } from 'zustand'\nimport type { AuthUser, AuthSession } from '@fayz-ai/core'\n\nexport interface AuthState {\n  user: AuthUser | null\n  session: AuthSession | null\n  isLoading: boolean\n  isAuthenticated: boolean\n  error: Error | null\n}\n\nexport interface AuthStore extends AuthState {\n  setUser: (user: AuthUser | null) => void\n  setSession: (session: AuthSession | null) => void\n  setLoading: (isLoading: boolean) => void\n  setError: (error: Error | null) => void\n  reset: () => void\n}\n\nconst initialState: AuthState = {\n  user: null,\n  session: null,\n  isLoading: true,\n  isAuthenticated: false,\n  error: null,\n}\n\nexport const useAuthStore = create<AuthStore>((set) => ({\n  ...initialState,\n\n  setUser: (user) =>\n    set({ user, isAuthenticated: user !== null }),\n\n  setSession: (session) =>\n    set({\n      session,\n      user: session?.user ?? null,\n      isAuthenticated: session !== null,\n    }),\n\n  setLoading: (isLoading) => set({ isLoading }),\n\n  setError: (error) => set({ error }),\n\n  reset: () => set(initialState),\n}))\n","import React, { createContext, useContext, useEffect, useRef } from 'react'\nimport type { AuthAdapter, AuthProvider as OAuthProvider, AuthSession } from '@fayz-ai/core'\nimport { useAuthStore } from './store'\n\n// ---------------------------------------------------------------------------\n// Context\n// ---------------------------------------------------------------------------\n\ninterface AuthContextValue {\n  signIn: (email: string, password: string) => Promise<AuthSession>\n  signUp: (email: string, password: string, fullName: string) => Promise<AuthSession>\n  signOut: () => Promise<void>\n  signInWithOAuth: (provider: OAuthProvider) => Promise<void>\n  resetPassword: (email: string, options?: { redirectTo?: string }) => Promise<void>\n  updatePassword: (password: string) => Promise<AuthSession | void>\n  handleCallback: (url?: string) => Promise<AuthSession | null>\n  inviteUser: (email: string, options?: { redirectTo?: string; data?: Record<string, unknown> }) => Promise<void>\n}\n\nconst AuthContext = createContext<AuthContextValue | null>(null)\n\n// ---------------------------------------------------------------------------\n// Provider\n// ---------------------------------------------------------------------------\n\nexport interface AuthProviderProps {\n  adapter: AuthAdapter\n  children: React.ReactNode\n}\n\nexport function AuthProvider({ adapter, children }: AuthProviderProps) {\n  const { setSession, setLoading, setError, reset } = useAuthStore()\n\n  // Keep a stable ref to the adapter so the effect only runs once on mount\n  const adapterRef = useRef(adapter)\n  adapterRef.current = adapter\n\n  useEffect(() => {\n    let unsubscribe: (() => void) | undefined\n\n    async function init() {\n      try {\n        setLoading(true)\n        const result = await adapterRef.current.getSession()\n        setSession(result?.session ?? null)\n      } catch (err) {\n        setError(err instanceof Error ? err : new Error(String(err)))\n      } finally {\n        setLoading(false)\n      }\n\n      // Subscribe to future auth state changes\n      unsubscribe = adapterRef.current.onAuthStateChange((user) => {\n        if (!user) {\n          reset()\n          // Keep isLoading false after an explicit sign-out\n          setLoading(false)\n          return\n        }\n        // Positive change (adapter-driven sign-in — e.g. an external callback,\n        // another tab, or a direct adapter.signUp bridge) — sync the session so\n        // consumers reflect it even when the call didn't go through ctx.signIn.\n        void adapterRef.current.getSession().then((result) => setSession(result?.session ?? null)).catch(() => {})\n      })\n    }\n\n    void init()\n\n    return () => {\n      unsubscribe?.()\n    }\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [])\n\n  const value: AuthContextValue = {\n    async signIn(email, password) {\n      setError(null)\n      try {\n        const session = await adapterRef.current.signIn(email, password)\n        setSession(session)\n        return session\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async signUp(email, password, fullName) {\n      setError(null)\n      try {\n        const session = await adapterRef.current.signUp(email, password, fullName)\n        setSession(session)\n        return session\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async signOut() {\n      setError(null)\n      try {\n        await adapterRef.current.signOut()\n        reset()\n        setLoading(false)\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async signInWithOAuth(provider) {\n      setError(null)\n      try {\n        await adapterRef.current.signInWithOAuth(provider)\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async resetPassword(email, options) {\n      setError(null)\n      try {\n        await adapterRef.current.resetPassword(email, options)\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async updatePassword(password) {\n      setError(null)\n      try {\n        const session = await adapterRef.current.updatePassword?.(password)\n        if (session) setSession(session)\n        return session\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async handleCallback(url) {\n      setError(null)\n      try {\n        const session = await adapterRef.current.handleCallback?.(url) ?? null\n        if (session) setSession(session)\n        return session\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n\n    async inviteUser(email, options) {\n      setError(null)\n      try {\n        await adapterRef.current.inviteUser?.(email, options)\n      } catch (err) {\n        const error = err instanceof Error ? err : new Error(String(err))\n        setError(error)\n        throw error\n      }\n    },\n  }\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>\n}\n\n// ---------------------------------------------------------------------------\n// Hook\n// ---------------------------------------------------------------------------\n\nexport function useAuth() {\n  const ctx = useContext(AuthContext)\n  if (!ctx) {\n    throw new Error('useAuth must be used inside <AuthProvider>')\n  }\n\n  const { user, session, isLoading, isAuthenticated, error } = useAuthStore()\n\n  return {\n    user,\n    session,\n    isLoading,\n    isAuthenticated,\n    error,\n    signIn: ctx.signIn,\n    signUp: ctx.signUp,\n    signOut: ctx.signOut,\n    signInWithOAuth: ctx.signInWithOAuth,\n    resetPassword: ctx.resetPassword,\n    updatePassword: ctx.updatePassword,\n    handleCallback: ctx.handleCallback,\n    inviteUser: ctx.inviteUser,\n  }\n}\n"]}

package/dist/lib/url-intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-intent.d.ts","sourceRoot":"","sources":["../../src/lib/url-intent.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,aAAa;AACvB,0EAA0E;AACxE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE;AACtB,4DAA4D;GAC1D;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzC;wEACwE;AACxE,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAM5C,UAAU,WAAW;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb;AAsBD,wBAAgB,iBAAiB,CAAC,GAAG,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,aAAa,GAAG,IAAI,CA4BhF;AAED;;uCAEuC;AACvC,wBAAgB,kBAAkB,IAAI,IAAI,CAMzC;AAED;4BAC4B;AAC5B,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAKtE;AAQD,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEvD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,gFAAgF;IAChF,SAAS,EAAE,OAAO,CAAA;IAClB,eAAe,EAAE,OAAO,CAAA;IACxB,iEAAiE;IACjE,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;CAClB;AAID,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,qBAAqB,CAgBpF"}

package/package.json

@@ -3,7 +3,7 @@
   "fayz": {
     "status": "beta"
   },
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Fayz SDK auth — pluggable authentication adapters with React hooks",
   "type": "module",
   "sideEffects": false,
@@ -12,31 +12,29 @@
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "source": "./src/index.ts",
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     }
   },
   "files": [
-    "dist",
-    "src"
+    "dist"
   ],
   "peerDependencies": {
+    "@supabase/supabase-js": "^2.45.0",
     "react": "^18.0.0 || ^19.0.0",
-    "zustand": "^4.5.0 || ^5.0.0",
-    "@supabase/supabase-js": "^2.45.0"
+    "zustand": "^4.5.0 || ^5.0.0"
   },
   "dependencies": {
-    "@fayz-ai/core": "^0.9.0"
+    "@fayz-ai/core": "^0.10.0"
   },
   "devDependencies": {
+    "@supabase/supabase-js": "^2.45.0",
     "@types/react": "^18.3.0",
     "react": "^18.3.0",
     "tsup": "^8.2.0",
     "typescript": "^5.5.0",
-    "zustand": "^4.5.0",
-    "@supabase/supabase-js": "^2.45.0",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.5",
+    "zustand": "^4.5.0"
   },
   "license": "MIT",
   "publishConfig": {
@@ -45,7 +43,7 @@
   "scripts": {
     "build": "tsup && tsc --emitDeclarationOnly --declaration --declarationMap --noEmit false",
     "dev": "tsup --watch",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit -p tsconfig.test.json",
     "test": "vitest run",
     "clean": "rm -rf dist"
   }

package/dist/url-intent.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"url-intent.d.ts","sourceRoot":"","sources":["../src/url-intent.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,aAAa;AACvB,0EAA0E;AACxE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE;AACtB,4DAA4D;GAC1D;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzC;wEACwE;AACxE,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAM5C,UAAU,WAAW;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb;AAsBD,wBAAgB,iBAAiB,CAAC,GAAG,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,aAAa,GAAG,IAAI,CA4BhF;AAED;;uCAEuC;AACvC,wBAAgB,kBAAkB,IAAI,IAAI,CAMzC;AAED;4BAC4B;AAC5B,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAKtE;AAQD,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEvD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,gFAAgF;IAChF,SAAS,EAAE,OAAO,CAAA;IAClB,eAAe,EAAE,OAAO,CAAA;IACxB,iEAAiE;IACjE,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;CAClB;AAID,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,qBAAqB,CAgBpF"}

package/dist/url-intent.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=url-intent.test.d.ts.map

package/dist/url-intent.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"url-intent.test.d.ts","sourceRoot":"","sources":["../src/url-intent.test.ts"],"names":[],"mappings":""}

package/src/adapters/mock.ts

@@ -1,142 +0,0 @@
-import type { AuthAdapter, AuthUser, AuthSession } from '@fayz-ai/core'
-
-export interface MockUser {
-  id: string
-  email: string
-  fullName: string
-  role?: string
-}
-
-const DEFAULT_MOCK_USER: MockUser = {
-  id: 'mock-user-id',
-  email: 'demo@fayz.dev',
-  fullName: 'Demo User',
-  role: 'admin',
-}
-
-const STORAGE_KEY = 'fayz:mock-auth'
-
-function toAuthUser(mockUser: MockUser): AuthUser {
-  return {
-    id: mockUser.id,
-    email: mockUser.email,
-    fullName: mockUser.fullName,
-  }
-}
-
-function createMockSession(user: AuthUser): AuthSession {
-  return {
-    accessToken: `mock-token-${user.id}`,
-    refreshToken: `mock-refresh-${user.id}`,
-    expiresAt: Math.floor(Date.now() / 1000) + 3600,
-    user,
-  }
-}
-
-function getStored(): { user: AuthUser; session: AuthSession } | null {
-  try {
-    if (typeof localStorage === 'undefined') return null
-    const raw = localStorage.getItem(STORAGE_KEY)
-    if (!raw) return null
-    return JSON.parse(raw) as { user: AuthUser; session: AuthSession }
-  } catch {
-    return null
-  }
-}
-
-function setStored(data: { user: AuthUser; session: AuthSession } | null): void {
-  try {
-    if (typeof localStorage === 'undefined') return
-    if (data) {
-      localStorage.setItem(STORAGE_KEY, JSON.stringify(data))
-    } else {
-      localStorage.removeItem(STORAGE_KEY)
-    }
-  } catch {
-    // SSR or storage unavailable — silently skip
-  }
-}
-
-export function createMockAuthAdapter(mockUser: MockUser = DEFAULT_MOCK_USER): AuthAdapter {
-  const listeners = new Set<(user: AuthUser | null) => void>()
-
-  function notifyListeners(user: AuthUser | null): void {
-    for (const cb of listeners) cb(user)
-  }
-
-  return {
-    async getSession() {
-      return getStored()
-    },
-
-    onAuthStateChange(cb) {
-      listeners.add(cb)
-      return () => {
-        listeners.delete(cb)
-      }
-    },
-
-    async signIn(email, _password) {
-      // Mock accepts any credentials, but the identity FOLLOWS the email —
-      // storefront customers and saas users keep their own purchase/session
-      // history instead of all becoming the configured demo user.
-      const stored = getStored()
-      const user: AuthUser =
-        stored && stored.user.email === email
-          ? stored.user
-          : {
-              id: email === mockUser.email ? mockUser.id : `mock-${email}`,
-              email,
-              fullName: email === mockUser.email ? mockUser.fullName : (email.split('@')[0] ?? 'Cliente'),
-            }
-      const session = createMockSession(user)
-      setStored({ user, session })
-      notifyListeners(user)
-      return session
-    },
-
-    async signUp(email, _password, fullName) {
-      // Mock signup creates a user from the provided details
-      const user: AuthUser = {
-        id: `mock-${email}`,
-        email,
-        fullName: fullName || (email.split('@')[0] ?? 'Cliente'),
-      }
-      const session = createMockSession(user)
-      setStored({ user, session })
-      notifyListeners(user)
-      return session
-    },
-
-    async signOut() {
-      setStored(null)
-      notifyListeners(null)
-    },
-
-    async signInWithOAuth(_provider) {
-      // Mock OAuth signs in as the configured user
-      const user = toAuthUser(mockUser)
-      const session = createMockSession(user)
-      setStored({ user, session })
-      notifyListeners(user)
-    },
-
-    async resetPassword(_email) {
-      // No-op in mock
-    },
-
-    async updatePassword(_password) {
-      const stored = getStored()
-      return stored?.session
-    },
-
-    async handleCallback() {
-      return getStored()?.session ?? null
-    },
-
-    async inviteUser(_email, _options) {
-      // No admin path in mock — the org mock adapter still records the pending
-      // invite so the Team UI shows it. Delivery is a no-op locally.
-    },
-  }
-}

package/src/adapters/supabase.ts

@@ -1,219 +0,0 @@
-import { createClient, type SupabaseClient } from '@supabase/supabase-js'
-import type { AuthAdapter, AuthUser, AuthSession, AuthProvider } from '@fayz-ai/core'
-import { withAuthIntent } from '../url-intent'
-
-/** Metadata flag stamped on invited users (created by a magic link, so they have
- *  no password yet) and cleared the moment they choose one. Metadata, not a URL
- *  param: it survives the link being opened later, in another browser, or twice —
- *  and it needs no new entry in Supabase's redirect allow-list. */
-export const MUST_SET_PASSWORD_FLAG = 'fayz_must_set_password'
-
-export interface SupabaseAuthConfig {
-  supabaseUrl: string
-  supabaseAnonKey: string
-  supabaseClient?: SupabaseClient
-  callbackUrl?: string
-  resetPasswordUrl?: string
-}
-
-function mapSupabaseUser(supabaseUser: {
-  id: string
-  email?: string | null
-  created_at?: string
-  updated_at?: string | null
-  email_confirmed_at?: string | null
-  user_metadata?: Record<string, unknown>
-  app_metadata?: { providers?: string[]; provider?: string }
-}): AuthUser {
-  return {
-    id: supabaseUser.id,
-    email: supabaseUser.email ?? '',
-    fullName:
-      (supabaseUser.user_metadata?.['full_name'] as string | undefined) ??
-      (supabaseUser.user_metadata?.['name'] as string | undefined) ??
-      '',
-    avatarUrl: supabaseUser.user_metadata?.['avatar_url'] as string | undefined,
-    mustSetPassword: supabaseUser.user_metadata?.[MUST_SET_PASSWORD_FLAG] === true,
-  }
-}
-
-function mapSupabaseSession(session: {
-  access_token: string
-  refresh_token?: string
-  expires_at?: number
-  expires_in?: number
-  user: Parameters<typeof mapSupabaseUser>[0]
-}): AuthSession {
-  return {
-    accessToken: session.access_token,
-    refreshToken: session.refresh_token,
-    expiresAt:
-      session.expires_at ??
-      Math.floor(Date.now() / 1000) + (session.expires_in ?? 3600),
-    user: mapSupabaseUser(session.user),
-  }
-}
-
-export function createSupabaseAuthAdapter(config: SupabaseAuthConfig): AuthAdapter {
-  const supabase = config.supabaseClient ?? createClient(config.supabaseUrl, config.supabaseAnonKey)
-
-  return {
-    async getSession() {
-      const {
-        data: { session },
-      } = await supabase.auth.getSession()
-      if (!session) return null
-      const mapped = mapSupabaseSession(session)
-      return { user: mapped.user, session: mapped }
-    },
-
-    onAuthStateChange(cb) {
-      const {
-        data: { subscription },
-      } = supabase.auth.onAuthStateChange((_event, session) => {
-        cb(session ? mapSupabaseUser(session.user) : null)
-      })
-      return () => subscription.unsubscribe()
-    },
-
-    async signIn(email, password) {
-      const { data, error } = await supabase.auth.signInWithPassword({ email, password })
-      if (error) throw error
-      return mapSupabaseSession(data.session)
-    },
-
-    async signUp(email, password, fullName) {
-      const { data, error } = await supabase.auth.signUp({
-        email,
-        password,
-        options: { data: { full_name: fullName } },
-      })
-      if (error) throw error
-
-      // When email confirmation is required, session is null
-      if (!data.session) {
-        if (!data.user) throw new Error('Signup failed: no user returned')
-        return {
-          accessToken: '',
-          refreshToken: '',
-          expiresAt: 0,
-          user: mapSupabaseUser(data.user),
-        }
-      }
-
-      return mapSupabaseSession(data.session)
-    },
-
-    async signOut() {
-      const { error } = await supabase.auth.signOut()
-      if (error) throw error
-    },
-
-    async signInWithOAuth(provider: AuthProvider) {
-      const { error } = await supabase.auth.signInWithOAuth({
-        provider: provider as 'google' | 'github' | 'apple',
-        options: {
-          redirectTo:
-            config.callbackUrl ??
-            (typeof window !== 'undefined' ? `${window.location.origin}/auth/callback` : undefined),
-        },
-      })
-      if (error) throw error
-    },
-
-    async resetPassword(email, options) {
-      // Root, not `/auth/reset-password`: the shell recognises a recovery link by
-      // the link's own `type=recovery` param, so the flow needs no route of its
-      // own — and the app root is the one URL every deployment already serves and
-      // every Supabase project already allow-lists (a URL outside the allow-list
-      // is silently swapped for the project's Site URL, i.e. another app).
-      // A host that DOES point recovery somewhere else gets the explicit intent
-      // marker, since we cannot assume its landing page carries the params.
-      const explicit = options?.redirectTo ?? config.resetPasswordUrl
-      const { error } = await supabase.auth.resetPasswordForEmail(email, {
-        redirectTo: explicit
-          ? withAuthIntent(explicit, 'recovery')
-          : typeof window !== 'undefined'
-            ? `${window.location.origin}/`
-            : undefined,
-      })
-      if (error) throw error
-    },
-
-    async updatePassword(password) {
-      // Clearing the flag in the same call as the password: one round-trip, and
-      // no window where the password is set but the screen still demands one.
-      const { data, error } = await supabase.auth.updateUser({
-        password,
-        data: { [MUST_SET_PASSWORD_FLAG]: false },
-      })
-      if (error) throw error
-      const {
-        data: { session },
-      } = await supabase.auth.getSession()
-      if (session) return mapSupabaseSession(session)
-      if (!data.user) return undefined
-      return {
-        accessToken: '',
-        refreshToken: '',
-        expiresAt: 0,
-        user: mapSupabaseUser(data.user),
-      }
-    },
-
-    async handleCallback(url) {
-      const target = url ?? (typeof window !== 'undefined' ? window.location.href : '')
-      const parsed = new URL(target)
-      // The fragment carries the params on the implicit flow; the query on PKCE
-      // and on `{{ .TokenHash }}`-style e-mail templates.
-      const fragment = new URLSearchParams(parsed.hash.replace(/^#/, ''))
-      const param = (key: string) => parsed.searchParams.get(key) ?? fragment.get(key)
-
-      const code = param('code')
-      if (code) {
-        const { data, error } = await supabase.auth.exchangeCodeForSession(code)
-        if (error) throw error
-        return data.session ? mapSupabaseSession(data.session) : null
-      }
-
-      // Templates that link straight at the app with a token instead of routing
-      // through GoTrue's /verify never produce a session on their own.
-      const tokenHash = param('token_hash') ?? param('token')
-      const type = param('type')
-      if (tokenHash && type) {
-        const { data, error } = await supabase.auth.verifyOtp({
-          token_hash: tokenHash,
-          type: type as 'recovery' | 'invite' | 'magiclink' | 'signup' | 'email',
-        })
-        if (error) throw error
-        return data.session ? mapSupabaseSession(data.session) : null
-      }
-
-      const {
-        data: { session },
-      } = await supabase.auth.getSession()
-      return session ? mapSupabaseSession(session) : null
-    },
-
-    async inviteUser(email, options) {
-      // Native, edge-function-free invite: a passwordless magic link. Sends the
-      // e-mail + creates the auth user (anon-callable, no service-role/admin).
-      // Membership is NOT granted from `data` (a client could forge it) — the
-      // accept-time trigger trusts the RLS-protected public.invitations row.
-      const { error } = await supabase.auth.signInWithOtp({
-        email,
-        options: {
-          shouldCreateUser: true,
-          emailRedirectTo:
-            options?.redirectTo ??
-            (typeof window !== 'undefined' ? `${window.location.origin}/` : undefined),
-          // `data` only lands on users the OTP actually creates, which is exactly
-          // who needs a password: the shell holds them on the set-password screen
-          // until they choose one, so they can sign in normally from then on.
-          data: { ...options?.data, [MUST_SET_PASSWORD_FLAG]: true },
-        },
-      })
-      if (error) throw error
-    },
-  }
-}

package/src/context.tsx

@@ -1,205 +0,0 @@
-import React, { createContext, useContext, useEffect, useRef } from 'react'
-import type { AuthAdapter, AuthProvider as OAuthProvider, AuthSession } from '@fayz-ai/core'
-import { useAuthStore } from './store'
-
-// ---------------------------------------------------------------------------
-// Context
-// ---------------------------------------------------------------------------
-
-interface AuthContextValue {
-  signIn: (email: string, password: string) => Promise<AuthSession>
-  signUp: (email: string, password: string, fullName: string) => Promise<AuthSession>
-  signOut: () => Promise<void>
-  signInWithOAuth: (provider: OAuthProvider) => Promise<void>
-  resetPassword: (email: string, options?: { redirectTo?: string }) => Promise<void>
-  updatePassword: (password: string) => Promise<AuthSession | void>
-  handleCallback: (url?: string) => Promise<AuthSession | null>
-  inviteUser: (email: string, options?: { redirectTo?: string; data?: Record<string, unknown> }) => Promise<void>
-}
-
-const AuthContext = createContext<AuthContextValue | null>(null)
-
-// ---------------------------------------------------------------------------
-// Provider
-// ---------------------------------------------------------------------------
-
-export interface AuthProviderProps {
-  adapter: AuthAdapter
-  children: React.ReactNode
-}
-
-export function AuthProvider({ adapter, children }: AuthProviderProps) {
-  const { setSession, setLoading, setError, reset } = useAuthStore()
-
-  // Keep a stable ref to the adapter so the effect only runs once on mount
-  const adapterRef = useRef(adapter)
-  adapterRef.current = adapter
-
-  useEffect(() => {
-    let unsubscribe: (() => void) | undefined
-
-    async function init() {
-      try {
-        setLoading(true)
-        const result = await adapterRef.current.getSession()
-        setSession(result?.session ?? null)
-      } catch (err) {
-        setError(err instanceof Error ? err : new Error(String(err)))
-      } finally {
-        setLoading(false)
-      }
-
-      // Subscribe to future auth state changes
-      unsubscribe = adapterRef.current.onAuthStateChange((user) => {
-        if (!user) {
-          reset()
-          // Keep isLoading false after an explicit sign-out
-          setLoading(false)
-          return
-        }
-        // Positive change (adapter-driven sign-in — e.g. an external callback,
-        // another tab, or a direct adapter.signUp bridge) — sync the session so
-        // consumers reflect it even when the call didn't go through ctx.signIn.
-        void adapterRef.current.getSession().then((result) => setSession(result?.session ?? null)).catch(() => {})
-      })
-    }
-
-    void init()
-
-    return () => {
-      unsubscribe?.()
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [])
-
-  const value: AuthContextValue = {
-    async signIn(email, password) {
-      setError(null)
-      try {
-        const session = await adapterRef.current.signIn(email, password)
-        setSession(session)
-        return session
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err))
-        setError(error)
-        throw error
-      }
-    },
-
-    async signUp(email, password, fullName) {
-      setError(null)
-      try {
-        const session = await adapterRef.current.signUp(email, password, fullName)
-        setSession(session)
-        return session
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err))
-        setError(error)
-        throw error
-      }
-    },
-
-    async signOut() {
-      setError(null)
-      try {
-        await adapterRef.current.signOut()
-        reset()
-        setLoading(false)
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err))
-        setError(error)
-        throw error
-      }
-    },
-
-    async signInWithOAuth(provider) {
-      setError(null)
-      try {
-        await adapterRef.current.signInWithOAuth(provider)
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err))
-        setError(error)
-        throw error
-      }
-    },
-
-    async resetPassword(email, options) {
-      setError(null)
-      try {
-        await adapterRef.current.resetPassword(email, options)
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err))
-        setError(error)
-        throw error
-      }
-    },
-
-    async updatePassword(password) {
-      setError(null)
-      try {
-        const session = await adapterRef.current.updatePassword?.(password)
-        if (session) setSession(session)
-        return session
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err))
-        setError(error)
-        throw error
-      }
-    },
-
-    async handleCallback(url) {
-      setError(null)
-      try {
-        const session = await adapterRef.current.handleCallback?.(url) ?? null
-        if (session) setSession(session)
-        return session
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err))
-        setError(error)
-        throw error
-      }
-    },
-
-    async inviteUser(email, options) {
-      setError(null)
-      try {
-        await adapterRef.current.inviteUser?.(email, options)
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err))
-        setError(error)
-        throw error
-      }
-    },
-  }
-
-  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>
-}
-
-// ---------------------------------------------------------------------------
-// Hook
-// ---------------------------------------------------------------------------
-
-export function useAuth() {
-  const ctx = useContext(AuthContext)
-  if (!ctx) {
-    throw new Error('useAuth must be used inside <AuthProvider>')
-  }
-
-  const { user, session, isLoading, isAuthenticated, error } = useAuthStore()
-
-  return {
-    user,
-    session,
-    isLoading,
-    isAuthenticated,
-    error,
-    signIn: ctx.signIn,
-    signUp: ctx.signUp,
-    signOut: ctx.signOut,
-    signInWithOAuth: ctx.signInWithOAuth,
-    resetPassword: ctx.resetPassword,
-    updatePassword: ctx.updatePassword,
-    handleCallback: ctx.handleCallback,
-    inviteUser: ctx.inviteUser,
-  }
-}

package/src/index.ts

@@ -1,29 +0,0 @@
-// Adapters
-export { createSupabaseAuthAdapter, MUST_SET_PASSWORD_FLAG } from './adapters/supabase'
-export type { SupabaseAuthConfig } from './adapters/supabase'
-
-// Auth link intent (recovery / expired one-time link) + set-password decision
-export {
-  readAuthUrlIntent,
-  clearAuthUrlTokens,
-  withAuthIntent,
-  decidePasswordSetup,
-  AUTH_INTENT_PARAM,
-} from './url-intent'
-export type {
-  AuthUrlIntent,
-  PasswordSetupDecision,
-  PasswordSetupInput,
-  PasswordSetupReason,
-} from './url-intent'
-
-export { createMockAuthAdapter } from './adapters/mock'
-export type { MockUser } from './adapters/mock'
-
-// Store
-export { useAuthStore } from './store'
-export type { AuthState, AuthStore } from './store'
-
-// Context & hook
-export { AuthProvider, useAuth } from './context'
-export type { AuthProviderProps } from './context'

package/src/store.ts

@@ -1,46 +0,0 @@
-import { create } from 'zustand'
-import type { AuthUser, AuthSession } from '@fayz-ai/core'
-
-export interface AuthState {
-  user: AuthUser | null
-  session: AuthSession | null
-  isLoading: boolean
-  isAuthenticated: boolean
-  error: Error | null
-}
-
-export interface AuthStore extends AuthState {
-  setUser: (user: AuthUser | null) => void
-  setSession: (session: AuthSession | null) => void
-  setLoading: (isLoading: boolean) => void
-  setError: (error: Error | null) => void
-  reset: () => void
-}
-
-const initialState: AuthState = {
-  user: null,
-  session: null,
-  isLoading: true,
-  isAuthenticated: false,
-  error: null,
-}
-
-export const useAuthStore = create<AuthStore>((set) => ({
-  ...initialState,
-
-  setUser: (user) =>
-    set({ user, isAuthenticated: user !== null }),
-
-  setSession: (session) =>
-    set({
-      session,
-      user: session?.user ?? null,
-      isAuthenticated: session !== null,
-    }),
-
-  setLoading: (isLoading) => set({ isLoading }),
-
-  setError: (error) => set({ error }),
-
-  reset: () => set(initialState),
-}))

package/src/url-intent.test.ts

@@ -1,91 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { readAuthUrlIntent, withAuthIntent, decidePasswordSetup } from './url-intent'
-
-function url(pathname: string, search = '', hash = '') {
-  return { pathname, search, hash }
-}
-
-describe('readAuthUrlIntent', () => {
-  it('recognises a recovery link by its implicit-flow fragment', () => {
-    expect(
-      readAuthUrlIntent(url('/', '', '#access_token=abc&refresh_token=def&type=recovery')),
-    ).toEqual({ kind: 'recovery' })
-  })
-
-  it('recognises the explicit marker for hosts that override the redirect', () => {
-    expect(readAuthUrlIntent(url('/', '?fayz_auth=recovery'))).toEqual({ kind: 'recovery' })
-  })
-
-  it('still honours the legacy /auth/reset-password path', () => {
-    expect(readAuthUrlIntent(url('/auth/reset-password'))).toEqual({ kind: 'recovery' })
-  })
-
-  it('flags a used or expired one-time link', () => {
-    const intent = readAuthUrlIntent(
-      url('/', '', '#error=access_denied&error_code=otp_expired&error_description=Email+link+is+invalid+or+has+expired'),
-    )
-    expect(intent?.kind).toBe('expired')
-    expect(intent && 'message' in intent && intent.message).toBe('Email link is invalid or has expired')
-  })
-
-  it('leaves a plain sign-in, a magic link and an OAuth denial alone', () => {
-    expect(readAuthUrlIntent(url('/', '', '#/dashboard'))).toBeNull()
-    expect(readAuthUrlIntent(url('/', '', '#access_token=abc&type=magiclink'))).toBeNull()
-    expect(readAuthUrlIntent(url('/', '', '#error=access_denied&error_code=user_banned'))).toBeNull()
-  })
-})
-
-describe('decidePasswordSetup', () => {
-  const signedIn = { isLoading: false, isAuthenticated: true }
-  const signedOut = { isLoading: false, isAuthenticated: false }
-
-  it('asks for a new password on a recovery link', () => {
-    expect(decidePasswordSetup({ intent: { kind: 'recovery' }, ...signedIn })).toEqual({
-      reason: 'recovery',
-      expired: false,
-      checking: false,
-    })
-  })
-
-  it('waits for the link session instead of flashing the login form', () => {
-    expect(
-      decidePasswordSetup({ intent: { kind: 'recovery' }, isLoading: true, isAuthenticated: false }),
-    ).toEqual({ reason: 'recovery', expired: false, checking: true })
-  })
-
-  it('treats a recovery link that produced no session as expired', () => {
-    expect(decidePasswordSetup({ intent: { kind: 'recovery' }, ...signedOut })).toEqual({
-      reason: 'recovery',
-      expired: true,
-      checking: false,
-    })
-  })
-
-  it('holds an invitee on the screen until they choose a password', () => {
-    expect(decidePasswordSetup({ intent: null, ...signedIn, mustSetPassword: true })).toEqual({
-      reason: 'invite',
-      expired: false,
-      checking: false,
-    })
-  })
-
-  it('stays out of the way for everyone else', () => {
-    expect(decidePasswordSetup({ intent: null, ...signedIn }).reason).toBeNull()
-    expect(decidePasswordSetup({ intent: null, ...signedOut }).reason).toBeNull()
-    // Never gate the login form itself: no session, nothing to update.
-    expect(decidePasswordSetup({ intent: null, ...signedOut, mustSetPassword: true }).reason).toBeNull()
-  })
-})
-
-describe('withAuthIntent', () => {
-  it('keeps existing params and stays absolute', () => {
-    expect(withAuthIntent('https://app.example.com/?ref=x', 'recovery')).toBe(
-      'https://app.example.com/?ref=x&fayz_auth=recovery',
-    )
-  })
-
-  it('is idempotent', () => {
-    const once = withAuthIntent('https://app.example.com/', 'recovery')
-    expect(withAuthIntent(once, 'recovery')).toBe(once)
-  })
-})

package/src/url-intent.ts

@@ -1,151 +0,0 @@
-// ---------------------------------------------------------------------------
-// Auth link intent — what the URL the user just arrived on is asking for.
-//
-// A Supabase recovery / magic link lands on the app with the tokens in the URL
-// FRAGMENT (implicit flow is the supabase-js default), e.g.
-//
-//   https://app.example.com/#access_token=…&refresh_token=…&type=recovery
-//
-// GoTrue then consumes that fragment and wipes it (`window.location.hash = ''`)
-// as soon as the client initialises — so by the time React renders, the reason
-// the user is here is gone. Hence the module-load snapshot: this file is
-// imported long before any createClient() call, so it always sees the original
-// URL.
-//
-// Errors arrive the same way, without a `type`:
-//
-//   https://app.example.com/#error=access_denied&error_code=otp_expired&…
-// ---------------------------------------------------------------------------
-
-export type AuthUrlIntent =
-  /** A password-recovery link — the user must choose a new password now. */
-  | { kind: 'recovery' }
-  /** A one-time link that was already used or has expired. */
-  | { kind: 'expired'; message?: string }
-
-/** Query param apps can put on their own redirect URLs to force the
- *  set-password screen (e.g. when they override `resetPasswordUrl`). */
-export const AUTH_INTENT_PARAM = 'fayz_auth'
-
-/** Path segment the SDK historically used as the reset-password redirect.
- *  Still honoured so apps that configured it keep working. */
-const RESET_PATH = '/auth/reset-password'
-
-interface UrlSnapshot {
-  pathname: string
-  search: string
-  hash: string
-}
-
-function snapshot(): UrlSnapshot | null {
-  if (typeof window === 'undefined') return null
-  return {
-    pathname: window.location.pathname,
-    search: window.location.search,
-    hash: window.location.hash,
-  }
-}
-
-/** Taken at import time — before any Supabase client can strip the fragment. */
-const initialUrl: UrlSnapshot | null = snapshot()
-
-/** The fragment can be either auth params (`access_token=…&type=recovery`) or a
- *  hash-router path (`#/dashboard`). Only the former parses into pairs. */
-function hashParams(hash: string): URLSearchParams {
-  const raw = hash.replace(/^#/, '')
-  if (!raw || !raw.includes('=')) return new URLSearchParams()
-  return new URLSearchParams(raw)
-}
-
-export function readAuthUrlIntent(url?: UrlSnapshot | null): AuthUrlIntent | null {
-  const loc = url ?? initialUrl
-  if (!loc) return null
-
-  const query = new URLSearchParams(loc.search)
-  const hash = hashParams(loc.hash)
-  const param = (key: string) => hash.get(key) ?? query.get(key)
-
-  const errorCode = param('error_code') ?? param('error')
-  const errorDescription = param('error_description')?.replace(/\+/g, ' ')
-  // A dead one-time link (`error_code=otp_expired`). Deliberately narrow: an
-  // OAuth `access_denied` is a different failure and must not land here. GoTrue
-  // does not echo `type` on error redirects, so recovery and invite links are
-  // indistinguishable at this point — the screen offers a fresh link either way.
-  if (errorCode && /otp|expired|link/i.test(`${errorCode} ${errorDescription ?? ''}`)) {
-    return { kind: 'expired', message: errorDescription ?? undefined }
-  }
-
-  const marker = query.get(AUTH_INTENT_PARAM)
-  const type = param('type')
-  if (type === 'recovery' || marker === 'recovery') return { kind: 'recovery' }
-
-  // `/auth/reset-password` with no tokens at all: the user opened the reset URL
-  // directly, or the tokens were already consumed by a previous page load.
-  const path = loc.pathname.replace(/\/+$/, '')
-  if (path.endsWith(RESET_PATH)) return { kind: 'recovery' }
-
-  return null
-}
-
-/** Strip auth leftovers from the address bar once the flow is finished, so a
- *  reload does not put the user back on the set-password screen (and so the
- *  hash router gets a clean slate). */
-export function clearAuthUrlTokens(): void {
-  if (typeof window === 'undefined') return
-  const url = new URL(window.location.href)
-  url.searchParams.delete(AUTH_INTENT_PARAM)
-  if (url.hash.includes('=')) url.hash = ''
-  window.history.replaceState(window.history.state, '', url.toString())
-}
-
-/** Add the intent marker to a redirect URL. Absolute or relative; existing
- *  params are preserved. */
-export function withAuthIntent(url: string, intent: 'recovery'): string {
-  const base = typeof window === 'undefined' ? 'http://localhost' : window.location.origin
-  const parsed = new URL(url, base)
-  parsed.searchParams.set(AUTH_INTENT_PARAM, intent)
-  return /^https?:\/\//i.test(url) ? parsed.toString() : `${parsed.pathname}${parsed.search}${parsed.hash}`
-}
-
-// ---------------------------------------------------------------------------
-// Whether the user owes us a password before they reach the app. Pure, so the
-// decision is testable without a browser; the React wrapper lives in
-// @fayz-ai/plugin-auth (usePasswordSetupGate).
-// ---------------------------------------------------------------------------
-
-export type PasswordSetupReason = 'recovery' | 'invite'
-
-export interface PasswordSetupInput {
-  intent: AuthUrlIntent | null
-  /** Session still resolving — the link's tokens are exchanged asynchronously. */
-  isLoading: boolean
-  isAuthenticated: boolean
-  /** AuthUser.mustSetPassword — an invitee who never chose one. */
-  mustSetPassword?: boolean
-}
-
-export interface PasswordSetupDecision {
-  reason: PasswordSetupReason | null
-  expired: boolean
-  checking: boolean
-}
-
-const NOTHING: PasswordSetupDecision = { reason: null, expired: false, checking: false }
-
-export function decidePasswordSetup(input: PasswordSetupInput): PasswordSetupDecision {
-  const { intent, isLoading, isAuthenticated, mustSetPassword } = input
-
-  if (intent?.kind === 'expired') return { reason: 'recovery', expired: true, checking: false }
-
-  if (intent?.kind === 'recovery') {
-    if (isLoading) return { reason: 'recovery', expired: false, checking: true }
-    // A recovery link with no session behind it was already used or has expired.
-    return { reason: 'recovery', expired: !isAuthenticated, checking: false }
-  }
-
-  if (!isLoading && isAuthenticated && mustSetPassword) {
-    return { reason: 'invite', expired: false, checking: false }
-  }
-
-  return NOTHING
-}