@gorth-io/structure 0.0.0-alpha.10

package/dist/interface-ii8DV63k.d.cts

@@ -0,0 +1,283 @@
+import { CookieMethodsServer } from "@supabase/ssr";
+import { REALTIME_SUBSCRIBE_STATES, RealtimeChannel, RealtimeChannelOptions, SupabaseClient } from "@supabase/supabase-js";
+import { AxiosInstance, AxiosRequestConfig, AxiosResponse, Method } from "axios";
+import { ZodType } from "zod";
+import { JWTPayload, JWTVerifyGetKey } from "jose";
+import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
+import { BetterAuthOptions } from "better-auth";
+declare class CallerError extends Error {
+  readonly status?: number;
+  readonly code?: string;
+  readonly details?: unknown;
+  constructor(message: string, options?: CallerErrorOptions);
+}
+/** Do not propagate raw Axios errors (which contain credentials and request bodies). */
+declare function normalizeCallerError(error: unknown): CallerError;
+interface AuthCookieInput {
+  secure: boolean;
+  maxAgeSeconds: number;
+  path?: string;
+}
+interface OAuthIdentityClaims {
+  sub: string;
+  name?: string;
+  email?: string;
+  email_verified?: boolean;
+  preferred_username?: string | null;
+  picture?: string | null;
+}
+type DatabaseSchema<T> = string & keyof Omit<T, "__InternalSupabase">;
+type DefaultSchema<T> = "public" extends DatabaseSchema<T> ? "public" : DatabaseSchema<T>;
+interface AuthRetryOptions {
+  /** App session read/refresh or trusted IPC; never return OAuth tokens. */
+  refresh(signal: AbortSignal): Promise<boolean>;
+  getStatus(error: unknown): number | undefined;
+}
+interface AuthRetryInput {
+  enabled?: boolean;
+  signal?: AbortSignal;
+}
+/** Public identity projection; provider roles never overwrite local roles. */
+interface AuthIdentity {
+  subject: string;
+  name?: string;
+  email?: string;
+  emailVerified?: boolean;
+  username?: string | null;
+  image?: string | null;
+}
+interface AuthPolicy {
+  sessionMaxAgeMs: number;
+  transactionMaxAgeMs: number;
+  identityMaxAgeMs: number;
+  refreshLeewayMs: number;
+  clockToleranceSeconds: number;
+  logoutMaxAgeSeconds: number;
+  /** Cover the longest accepted access/app-session lifetime, not logout JWT expiry. */
+  revocationRetentionMs: number;
+}
+type AuthErrorCode = "invalid_configuration" | "rejected" | "forbidden" | "unavailable" | "cancelled";
+interface AuthFreshnessInput {
+  verifiedAt: number;
+  accessExpiresAt: number;
+  fresh?: boolean;
+}
+interface AuthFreshness {
+  expired: boolean;
+  refresh: boolean;
+  verifyIdentity: boolean;
+}
+interface VerifiedLogout {
+  jti: string;
+  subject?: string;
+  sid?: string;
+  issuedAt: number;
+  receiptExpiresAt: number;
+  revokeUntil: number;
+}
+interface LogoutStorage {
+  /** One transaction: deduplicate jti, persist revocation, invalidate matching sessions.
+   * When both sid/sub exist, match BOTH. Subject-only markers apply to sessions
+   * created at/before the end of issuedAt's second (JWT iat has second precision).
+   * Fence insert/replace to prevent refresh resurrection.
+   */
+  apply(logout: VerifiedLogout): Promise<boolean>;
+  isRevoked(input: {
+    subject: string;
+    sid?: string;
+    issuedAt: number;
+    now: number;
+  }): Promise<boolean>;
+}
+interface ProofStorage {
+  /** Atomic insert-if-absent; a live replay key must never be overwritten. */
+  consume(key: string, expiresAt: number): Promise<boolean>;
+}
+interface LogoutVerifierOptions {
+  issuer: string;
+  clientId: string;
+  getVerificationKey(): Promise<JWTVerifyGetKey>;
+  storage: LogoutStorage;
+  algorithms?: readonly ("RS256" | "ES256" | "EdDSA")[];
+  requireSid?: boolean;
+  policy?: Partial<AuthPolicy>;
+  now?: () => number;
+}
+interface ResourceAuthOptions {
+  /** Explicit issuer/audience, trusted JWKS URL or confidential introspection configuration. */
+  verification: Omit<VerifyAccessTokenRequestOptions, "dpop">;
+  proof: ProofStorage;
+  revocation: LogoutStorage;
+  /** UserInfo/introspection supplied by the app. Reject inactive identity, throw unavailable on outages. */
+  verifyActive(claims: JWTPayload, request: ResourceRequestInput): Promise<void>;
+  onlineVerification: "always" | "sensitive";
+  /** Defaults true. A provider without sid must use onlineVerification: always. */
+  requireSid?: boolean;
+  allowLoopbackHttp?: boolean;
+  policy?: Partial<AuthPolicy>;
+  now?: () => number;
+}
+type CommonCookieMethods = Pick<CookieMethodsServer, "getAll" | "setAll">;
+type SupabaseAnyClient = SupabaseClient<any, any, any>;
+type RealtimeUtils = {
+  createChannel: (topic: string, options?: RealtimeChannelOptions) => RealtimeChannel;
+  subscribe: (channel: RealtimeChannel, callback?: (status: REALTIME_SUBSCRIBE_STATES, error?: Error) => void) => Promise<REALTIME_SUBSCRIBE_STATES>;
+  removeChannel: (channel: RealtimeChannel) => Promise<"ok" | "timed out" | "error">;
+  removeAllChannels: () => Promise<("ok" | "timed out" | "error")[]>;
+};
+type UploadInput = {
+  bucket: string;
+  path: string;
+  fileBody: File | Blob | ArrayBuffer | ArrayBufferView | string;
+  options?: Record<string, unknown>;
+};
+type UploadUtils = {
+  upload: (input: UploadInput) => Promise<any>;
+  upsert: (input: UploadInput) => Promise<any>;
+  remove: (bucket: string, paths: string[]) => Promise<any>;
+  getPublicUrl: (bucket: string, path: string) => {
+    data: {
+      publicUrl: string;
+    };
+  };
+  createSignedUrl: (bucket: string, path: string, expiresIn: number) => Promise<any>;
+};
+interface DesktopRpcRequest {
+  url: string;
+  method: "GET" | "POST";
+  body?: string;
+}
+interface DesktopRpcResponse {
+  status: number;
+  body: string;
+}
+interface DesktopRpcPolicy {
+  origin?: string;
+  endpoint?: string;
+  maxUrlLength?: number;
+  maxBodyBytes?: number;
+  maxResponseBytes?: number;
+}
+interface DesktopRpcHandlerOptions extends DesktopRpcPolicy {
+  handle(request: Request): Promise<Response>;
+}
+interface DesktopRpcTransportOptions extends DesktopRpcPolicy {
+  request(input: DesktopRpcRequest, signal?: AbortSignal): Promise<DesktopRpcResponse>;
+}
+interface ShortcutDefinition {
+  id: string;
+  label: string;
+  defaultAccelerator: string;
+}
+interface Shortcut extends ShortcutDefinition {
+  accelerator: string;
+}
+interface ShortcutPolicy {
+  isMac: boolean;
+  /** Reserved bindings/actions belong to each app, not this package. */
+  reserved: readonly string[];
+}
+type CallerResponseHandler<Data> = "json" | "text" | "blob" | "arrayBuffer" | "stream" | "content-type" | ((response: AxiosResponse<unknown>) => Data | Promise<Data>);
+interface CallerToastOptions<Data> {
+  success?: string | ((data: Data) => string);
+  error?: string | ((error: CallerError) => string);
+}
+interface CallerRequestOptions<Data = unknown, Body = unknown, Params = Record<string, unknown>> extends Omit<AxiosRequestConfig<Body>, "url" | "method" | "data" | "params" | "auth" | "baseURL" | "signal"> {
+  url: string;
+  method?: Method;
+  body?: Body;
+  params?: Params;
+  query?: Params;
+  baseURL?: string | null;
+  signal?: AbortSignal;
+  auth?: boolean;
+  unwrapData?: boolean;
+  schema?: ZodType<Data>;
+  responseHandler?: CallerResponseHandler<Data>;
+  cache?: RequestCache;
+  credentials?: RequestCredentials;
+  redirect?: RequestRedirect;
+  /** Mutations must explicitly opt into replay after a 401 (idempotent/auth-before-write). */
+  retryUnsafe?: boolean;
+  toast?: boolean | CallerToastOptions<Data>;
+  onSuccess?(data: Data): void | Promise<void>;
+  onError?(error: CallerError): void | Promise<void>;
+}
+interface CallerOptions {
+  client: AxiosInstance;
+  refresh?(signal: AbortSignal): Promise<boolean>;
+  /** App supplies UI notification implementation. No UI dependency in this module. */
+  notify?(kind: "success" | "error", message: string): void;
+  /** Explicit sanitizer for trusted endpoint errors; never receive Axios config. */
+  mapError?(error: CallerError, responseData: unknown): CallerError;
+  canRetry?(url: string): boolean;
+}
+type CallerMethodOptions<Data, Body, Params> = Omit<CallerRequestOptions<Data, Body, Params>, "url" | "method" | "body">;
+interface CallerErrorOptions {
+  status?: number;
+  code?: string;
+  /** Opt-in safe endpoint metadata only; never include Axios config/request/cause. */
+  details?: unknown;
+}
+interface FetcherOptions<Body = unknown, Params = Record<string, unknown>> extends Omit<AxiosRequestConfig<Body>, "url" | "method" | "data" | "params" | "withCredentials"> {
+  url: string | URL;
+  method: Method;
+  body?: Body;
+  params?: Params;
+  cache?: RequestCache;
+  credentials?: RequestCredentials;
+  redirect?: RequestRedirect;
+}
+interface WebResponseOptions {
+  /** Explicitly empty a successful body, as distinct from JSON null. */
+  emptyBody?: boolean;
+  /** Node streams need an app/runtime-specific conversion. */
+  mapBody?(data: unknown): BodyInit | null;
+}
+/** Validated identity only, never an authorization/session/token cache. */
+interface IdentityCacheOptions<Value> {
+  load(credential: string): Promise<Value>;
+  /** Inject key derivation for non-token credentials; default is SHA-256. */
+  key?(credential: string): Promise<string>;
+  maxAgeMs?: number;
+  capacity?: number;
+  maxPending?: number;
+  now?: () => number;
+}
+interface IdentityCacheInput {
+  fresh?: boolean;
+  signal?: AbortSignal;
+}
+interface OAuthIdentityValidatorOptions {
+  providerId: string;
+  /** App-owned additional-field projection. Never match identities by email. */
+  subject(user: Parameters<NonNullable<NonNullable<BetterAuthOptions["user"]>["validateUserInfo"]>>[0]["user"]): unknown;
+  allowed?(profile: Record<string, unknown>): boolean | Promise<boolean>;
+}
+interface AuthSessionBinding {
+  id: string;
+  userId: string;
+  subject: string;
+  sid?: string;
+  expiresAt: number;
+}
+interface SessionGrantGuardOptions {
+  /** Authoritative native session read, not a cookie-cache-only result. */
+  read(): Promise<AuthSessionBinding | null>;
+  /** App verifies persistent revocation and current local permissions. */
+  assertAllowed(binding: Readonly<AuthSessionBinding>): Promise<void>;
+  now?: () => number;
+}
+interface AuthRevocation {
+  subject?: string;
+  sid?: string;
+  issuedAt: number;
+  expiresAt: number;
+}
+interface AuthRevocationIdentity {
+  subject: string;
+  sid?: string;
+  issuedAt: number;
+}
+export { LogoutVerifierOptions as A, SupabaseAnyClient as B, DesktopRpcRequest as C, IdentityCacheInput as D, FetcherOptions as E, ResourceAuthOptions as F, CallerError as G, UploadUtils as H, SessionGrantGuardOptions as I, normalizeCallerError as K, Shortcut as L, OAuthIdentityValidatorOptions as M, ProofStorage as N, IdentityCacheOptions as O, RealtimeUtils as P, ShortcutDefinition as R, DesktopRpcPolicy as S, DesktopRpcTransportOptions as T, VerifiedLogout as U, UploadInput as V, WebResponseOptions as W, CallerToastOptions as _, AuthIdentity as a, DefaultSchema as b, AuthRetryOptions as c, AuthSessionBinding as d, CallerErrorOptions as f, CallerResponseHandler as g, CallerRequestOptions as h, AuthFreshnessInput as i, OAuthIdentityClaims as j, LogoutStorage as k, AuthRevocation as l, CallerOptions as m, AuthErrorCode as n, AuthPolicy as o, CallerMethodOptions as p, AuthFreshness as r, AuthRetryInput as s, AuthCookieInput as t, AuthRevocationIdentity as u, CommonCookieMethods as v, DesktopRpcResponse as w, DesktopRpcHandlerOptions as x, DatabaseSchema as y, ShortcutPolicy as z };
+//# sourceMappingURL=interface-ii8DV63k.d.cts.map

package/dist/interface-ii8DV63k.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-ii8DV63k.d.cts","names":[],"sources":["../src/modules/http/error.ts","../src/utils/interface.ts"],"mappings":";;;;;;;cAGa,oBAAoB;WACtB;WACA;WACA;EACG,YAAA,iBAAiB,UAAS;;;iBAUxB,qBAAqB,iBAAiB;UCKrC;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;EACA;;KAGU,eAAe,oBAAoB,KAAK;KACxC,cAAc,sBACP,eAAe,gBAAgB,eAAe;UAEhD;;EAEf,QAAQ,QAAQ,cAAc;EAC9B,UAAU;;UAGK;EACf;EACA,SAAS;;;UAIM;EACf;EACA;EACA;EACA;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;EACA;;EAEA;;KAGU;UAOK;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;EACA;;UAGe;;;;;;EAMf,MAAM,QAAQ,iBAAiB;EAC/B,UAAU;IACR;IACA;IACA;IACA;MACE;;UAGW;;EAEf,QAAQ,aAAa,oBAAoB;;UAG1B;EACf;EACA;EACA,sBAAsB,QAAQ;EAC9B,SAAS;EACT;EACA;EACA,SAAS,QAAQ;EACjB;;UAGe;;EAEf,cAAc,KAAK;EACnB,OAAO;EACP,YAAY;;EAEZ,aACE,QAAQ,YACR,SAAS,uBACR;EACH;;EAEA;EACA;EACA,SAAS,QAAQ;EACjB;;KAGU,sBAAsB,KAChC;KAIU,oBAAoB;KAEpB;EACV,gBACE,eACA,UAAU,2BACP;EACL,YACE,SAAS,iBACT,YAAY,QAAQ,2BAA2B,QAAQ,mBACpD,QAAQ;EACb,gBACE,SAAS,oBACN;EACL,yBAAyB;;KAGf;EACV;EACA;EACA,UAAU,OAAO,OAAO,cAAc;EACtC,UAAU;;KAGA;EACV,SAAS,OAAO,gBAAgB;EAChC,SAAS,OAAO,gBAAgB;EAChC,SAAS,gBAAgB,oBAAoB;EAC7C,eACE,gBACA;IACK;MAAQ;;;EACf,kBACE,gBACA,cACA,sBACG;;UAGU;EACf;EACA;EACA;;UAGe;EACf;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;;UAGe,iCAAiC;EAChD,OAAO,SAAS,UAAU,QAAQ;;UAGnB,mCAAmC;EAClD,QACE,OAAO,mBACP,SAAS,cACR,QAAQ;;UAGI;EACf;EACA;EACA;;UAGe,iBAAiB;EAChC;;UAGe;EACf;;EAEA;;KAGU,sBAAsB,iFAO5B,UAAU,2BAA2B,OAAO,QAAQ;UAEzC,mBAAmB;EAClC,qBAAqB,MAAM;EAC3B,mBAAmB,OAAO;;UAGX,qBACf,gBACA,gBACA,SAAS,iCACD,KACR,mBAAmB;EAGnB;EACA,SAAS;EACT,OAAO;EACP,SAAS;EACT,QAAQ;EACR;EACA,SAAS;EACT;EACA;EACA,SAAS,QAAQ;EACjB,kBAAkB,sBAAsB;EACxC,QAAQ;EACR,cAAc;EACd,WAAW;;EAEX;EACA,kBAAkB,mBAAmB;EACrC,WAAW,MAAM,cAAc;EAC/B,SAAS,OAAO,qBAAqB;;UAGtB;EACf,QAAQ;EACR,SAAS,QAAQ,cAAc;;EAE/B,QAAQ,2BAA2B;;EAEnC,UAAU,OAAO,aAAa,wBAAwB;EACtD,UAAU;;KAGA,oBAAoB,MAAM,MAAM,UAAU,KACpD,qBAAqB,MAAM,MAAM;UAIlB;EACf;EACA;;EAEA;;UAGe,eACf,gBACA,SAAS,iCACD,KACR,mBAAmB;EAGnB,cAAc;EACd,QAAQ;EACR,OAAO;EACP,SAAS;EACT,QAAQ;EACR,cAAc;EACd,WAAW;;UAGI;;EAEf;;EAEA,SAAS,gBAAgB;;;UAIV,qBAAqB;EACpC,KAAK,qBAAqB,QAAQ;;EAElC,KAAK,qBAAqB;EAC1B;EACA;EACA;EACA;;UAEe;EACf;EACA,SAAS;;UAEM;EACf;;EAEA,QACE,MAAM,WACJ,YAAY,YAAY;EAG5B,SAAS,SAAS,oCAAoC;;UAEvC;EACf;EACA;EACA;EACA;EACA;;UAEe;;EAEf,QAAQ,QAAQ;;EAEhB,cAAc,SAAS,SAAS,sBAAsB;EACtD;;UAEe;EACf;EACA;EACA;EACA;;UAEe;EACf;EACA;EACA"}

package/dist/interface-ii8DV63k.d.ts

@@ -0,0 +1,283 @@
+import { CookieMethodsServer } from "@supabase/ssr";
+import { REALTIME_SUBSCRIBE_STATES, RealtimeChannel, RealtimeChannelOptions, SupabaseClient } from "@supabase/supabase-js";
+import { AxiosInstance, AxiosRequestConfig, AxiosResponse, Method } from "axios";
+import { ZodType } from "zod";
+import { JWTPayload, JWTVerifyGetKey } from "jose";
+import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
+import { BetterAuthOptions } from "better-auth";
+declare class CallerError extends Error {
+  readonly status?: number;
+  readonly code?: string;
+  readonly details?: unknown;
+  constructor(message: string, options?: CallerErrorOptions);
+}
+/** Do not propagate raw Axios errors (which contain credentials and request bodies). */
+declare function normalizeCallerError(error: unknown): CallerError;
+interface AuthCookieInput {
+  secure: boolean;
+  maxAgeSeconds: number;
+  path?: string;
+}
+interface OAuthIdentityClaims {
+  sub: string;
+  name?: string;
+  email?: string;
+  email_verified?: boolean;
+  preferred_username?: string | null;
+  picture?: string | null;
+}
+type DatabaseSchema<T> = string & keyof Omit<T, "__InternalSupabase">;
+type DefaultSchema<T> = "public" extends DatabaseSchema<T> ? "public" : DatabaseSchema<T>;
+interface AuthRetryOptions {
+  /** App session read/refresh or trusted IPC; never return OAuth tokens. */
+  refresh(signal: AbortSignal): Promise<boolean>;
+  getStatus(error: unknown): number | undefined;
+}
+interface AuthRetryInput {
+  enabled?: boolean;
+  signal?: AbortSignal;
+}
+/** Public identity projection; provider roles never overwrite local roles. */
+interface AuthIdentity {
+  subject: string;
+  name?: string;
+  email?: string;
+  emailVerified?: boolean;
+  username?: string | null;
+  image?: string | null;
+}
+interface AuthPolicy {
+  sessionMaxAgeMs: number;
+  transactionMaxAgeMs: number;
+  identityMaxAgeMs: number;
+  refreshLeewayMs: number;
+  clockToleranceSeconds: number;
+  logoutMaxAgeSeconds: number;
+  /** Cover the longest accepted access/app-session lifetime, not logout JWT expiry. */
+  revocationRetentionMs: number;
+}
+type AuthErrorCode = "invalid_configuration" | "rejected" | "forbidden" | "unavailable" | "cancelled";
+interface AuthFreshnessInput {
+  verifiedAt: number;
+  accessExpiresAt: number;
+  fresh?: boolean;
+}
+interface AuthFreshness {
+  expired: boolean;
+  refresh: boolean;
+  verifyIdentity: boolean;
+}
+interface VerifiedLogout {
+  jti: string;
+  subject?: string;
+  sid?: string;
+  issuedAt: number;
+  receiptExpiresAt: number;
+  revokeUntil: number;
+}
+interface LogoutStorage {
+  /** One transaction: deduplicate jti, persist revocation, invalidate matching sessions.
+   * When both sid/sub exist, match BOTH. Subject-only markers apply to sessions
+   * created at/before the end of issuedAt's second (JWT iat has second precision).
+   * Fence insert/replace to prevent refresh resurrection.
+   */
+  apply(logout: VerifiedLogout): Promise<boolean>;
+  isRevoked(input: {
+    subject: string;
+    sid?: string;
+    issuedAt: number;
+    now: number;
+  }): Promise<boolean>;
+}
+interface ProofStorage {
+  /** Atomic insert-if-absent; a live replay key must never be overwritten. */
+  consume(key: string, expiresAt: number): Promise<boolean>;
+}
+interface LogoutVerifierOptions {
+  issuer: string;
+  clientId: string;
+  getVerificationKey(): Promise<JWTVerifyGetKey>;
+  storage: LogoutStorage;
+  algorithms?: readonly ("RS256" | "ES256" | "EdDSA")[];
+  requireSid?: boolean;
+  policy?: Partial<AuthPolicy>;
+  now?: () => number;
+}
+interface ResourceAuthOptions {
+  /** Explicit issuer/audience, trusted JWKS URL or confidential introspection configuration. */
+  verification: Omit<VerifyAccessTokenRequestOptions, "dpop">;
+  proof: ProofStorage;
+  revocation: LogoutStorage;
+  /** UserInfo/introspection supplied by the app. Reject inactive identity, throw unavailable on outages. */
+  verifyActive(claims: JWTPayload, request: ResourceRequestInput): Promise<void>;
+  onlineVerification: "always" | "sensitive";
+  /** Defaults true. A provider without sid must use onlineVerification: always. */
+  requireSid?: boolean;
+  allowLoopbackHttp?: boolean;
+  policy?: Partial<AuthPolicy>;
+  now?: () => number;
+}
+type CommonCookieMethods = Pick<CookieMethodsServer, "getAll" | "setAll">;
+type SupabaseAnyClient = SupabaseClient<any, any, any>;
+type RealtimeUtils = {
+  createChannel: (topic: string, options?: RealtimeChannelOptions) => RealtimeChannel;
+  subscribe: (channel: RealtimeChannel, callback?: (status: REALTIME_SUBSCRIBE_STATES, error?: Error) => void) => Promise<REALTIME_SUBSCRIBE_STATES>;
+  removeChannel: (channel: RealtimeChannel) => Promise<"ok" | "timed out" | "error">;
+  removeAllChannels: () => Promise<("ok" | "timed out" | "error")[]>;
+};
+type UploadInput = {
+  bucket: string;
+  path: string;
+  fileBody: File | Blob | ArrayBuffer | ArrayBufferView | string;
+  options?: Record<string, unknown>;
+};
+type UploadUtils = {
+  upload: (input: UploadInput) => Promise<any>;
+  upsert: (input: UploadInput) => Promise<any>;
+  remove: (bucket: string, paths: string[]) => Promise<any>;
+  getPublicUrl: (bucket: string, path: string) => {
+    data: {
+      publicUrl: string;
+    };
+  };
+  createSignedUrl: (bucket: string, path: string, expiresIn: number) => Promise<any>;
+};
+interface DesktopRpcRequest {
+  url: string;
+  method: "GET" | "POST";
+  body?: string;
+}
+interface DesktopRpcResponse {
+  status: number;
+  body: string;
+}
+interface DesktopRpcPolicy {
+  origin?: string;
+  endpoint?: string;
+  maxUrlLength?: number;
+  maxBodyBytes?: number;
+  maxResponseBytes?: number;
+}
+interface DesktopRpcHandlerOptions extends DesktopRpcPolicy {
+  handle(request: Request): Promise<Response>;
+}
+interface DesktopRpcTransportOptions extends DesktopRpcPolicy {
+  request(input: DesktopRpcRequest, signal?: AbortSignal): Promise<DesktopRpcResponse>;
+}
+interface ShortcutDefinition {
+  id: string;
+  label: string;
+  defaultAccelerator: string;
+}
+interface Shortcut extends ShortcutDefinition {
+  accelerator: string;
+}
+interface ShortcutPolicy {
+  isMac: boolean;
+  /** Reserved bindings/actions belong to each app, not this package. */
+  reserved: readonly string[];
+}
+type CallerResponseHandler<Data> = "json" | "text" | "blob" | "arrayBuffer" | "stream" | "content-type" | ((response: AxiosResponse<unknown>) => Data | Promise<Data>);
+interface CallerToastOptions<Data> {
+  success?: string | ((data: Data) => string);
+  error?: string | ((error: CallerError) => string);
+}
+interface CallerRequestOptions<Data = unknown, Body = unknown, Params = Record<string, unknown>> extends Omit<AxiosRequestConfig<Body>, "url" | "method" | "data" | "params" | "auth" | "baseURL" | "signal"> {
+  url: string;
+  method?: Method;
+  body?: Body;
+  params?: Params;
+  query?: Params;
+  baseURL?: string | null;
+  signal?: AbortSignal;
+  auth?: boolean;
+  unwrapData?: boolean;
+  schema?: ZodType<Data>;
+  responseHandler?: CallerResponseHandler<Data>;
+  cache?: RequestCache;
+  credentials?: RequestCredentials;
+  redirect?: RequestRedirect;
+  /** Mutations must explicitly opt into replay after a 401 (idempotent/auth-before-write). */
+  retryUnsafe?: boolean;
+  toast?: boolean | CallerToastOptions<Data>;
+  onSuccess?(data: Data): void | Promise<void>;
+  onError?(error: CallerError): void | Promise<void>;
+}
+interface CallerOptions {
+  client: AxiosInstance;
+  refresh?(signal: AbortSignal): Promise<boolean>;
+  /** App supplies UI notification implementation. No UI dependency in this module. */
+  notify?(kind: "success" | "error", message: string): void;
+  /** Explicit sanitizer for trusted endpoint errors; never receive Axios config. */
+  mapError?(error: CallerError, responseData: unknown): CallerError;
+  canRetry?(url: string): boolean;
+}
+type CallerMethodOptions<Data, Body, Params> = Omit<CallerRequestOptions<Data, Body, Params>, "url" | "method" | "body">;
+interface CallerErrorOptions {
+  status?: number;
+  code?: string;
+  /** Opt-in safe endpoint metadata only; never include Axios config/request/cause. */
+  details?: unknown;
+}
+interface FetcherOptions<Body = unknown, Params = Record<string, unknown>> extends Omit<AxiosRequestConfig<Body>, "url" | "method" | "data" | "params" | "withCredentials"> {
+  url: string | URL;
+  method: Method;
+  body?: Body;
+  params?: Params;
+  cache?: RequestCache;
+  credentials?: RequestCredentials;
+  redirect?: RequestRedirect;
+}
+interface WebResponseOptions {
+  /** Explicitly empty a successful body, as distinct from JSON null. */
+  emptyBody?: boolean;
+  /** Node streams need an app/runtime-specific conversion. */
+  mapBody?(data: unknown): BodyInit | null;
+}
+/** Validated identity only, never an authorization/session/token cache. */
+interface IdentityCacheOptions<Value> {
+  load(credential: string): Promise<Value>;
+  /** Inject key derivation for non-token credentials; default is SHA-256. */
+  key?(credential: string): Promise<string>;
+  maxAgeMs?: number;
+  capacity?: number;
+  maxPending?: number;
+  now?: () => number;
+}
+interface IdentityCacheInput {
+  fresh?: boolean;
+  signal?: AbortSignal;
+}
+interface OAuthIdentityValidatorOptions {
+  providerId: string;
+  /** App-owned additional-field projection. Never match identities by email. */
+  subject(user: Parameters<NonNullable<NonNullable<BetterAuthOptions["user"]>["validateUserInfo"]>>[0]["user"]): unknown;
+  allowed?(profile: Record<string, unknown>): boolean | Promise<boolean>;
+}
+interface AuthSessionBinding {
+  id: string;
+  userId: string;
+  subject: string;
+  sid?: string;
+  expiresAt: number;
+}
+interface SessionGrantGuardOptions {
+  /** Authoritative native session read, not a cookie-cache-only result. */
+  read(): Promise<AuthSessionBinding | null>;
+  /** App verifies persistent revocation and current local permissions. */
+  assertAllowed(binding: Readonly<AuthSessionBinding>): Promise<void>;
+  now?: () => number;
+}
+interface AuthRevocation {
+  subject?: string;
+  sid?: string;
+  issuedAt: number;
+  expiresAt: number;
+}
+interface AuthRevocationIdentity {
+  subject: string;
+  sid?: string;
+  issuedAt: number;
+}
+export { LogoutVerifierOptions as A, SupabaseAnyClient as B, DesktopRpcRequest as C, IdentityCacheInput as D, FetcherOptions as E, ResourceAuthOptions as F, CallerError as G, UploadUtils as H, SessionGrantGuardOptions as I, normalizeCallerError as K, Shortcut as L, OAuthIdentityValidatorOptions as M, ProofStorage as N, IdentityCacheOptions as O, RealtimeUtils as P, ShortcutDefinition as R, DesktopRpcPolicy as S, DesktopRpcTransportOptions as T, VerifiedLogout as U, UploadInput as V, WebResponseOptions as W, CallerToastOptions as _, AuthIdentity as a, DefaultSchema as b, AuthRetryOptions as c, AuthSessionBinding as d, CallerErrorOptions as f, CallerResponseHandler as g, CallerRequestOptions as h, AuthFreshnessInput as i, OAuthIdentityClaims as j, LogoutStorage as k, AuthRevocation as l, CallerOptions as m, AuthErrorCode as n, AuthPolicy as o, CallerMethodOptions as p, AuthFreshness as r, AuthRetryInput as s, AuthCookieInput as t, AuthRevocationIdentity as u, CommonCookieMethods as v, DesktopRpcResponse as w, DesktopRpcHandlerOptions as x, DatabaseSchema as y, ShortcutPolicy as z };
+//# sourceMappingURL=interface-ii8DV63k.d.ts.map

package/dist/interface-ii8DV63k.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-ii8DV63k.d.ts","names":[],"sources":["../src/modules/http/error.ts","../src/utils/interface.ts"],"mappings":";;;;;;;cAGa,oBAAoB;WACtB;WACA;WACA;EACG,YAAA,iBAAiB,UAAS;;;iBAUxB,qBAAqB,iBAAiB;UCKrC;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;EACA;;KAGU,eAAe,oBAAoB,KAAK;KACxC,cAAc,sBACP,eAAe,gBAAgB,eAAe;UAEhD;;EAEf,QAAQ,QAAQ,cAAc;EAC9B,UAAU;;UAGK;EACf;EACA,SAAS;;;UAIM;EACf;EACA;EACA;EACA;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;EACA;;EAEA;;KAGU;UAOK;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;EACA;;UAGe;;;;;;EAMf,MAAM,QAAQ,iBAAiB;EAC/B,UAAU;IACR;IACA;IACA;IACA;MACE;;UAGW;;EAEf,QAAQ,aAAa,oBAAoB;;UAG1B;EACf;EACA;EACA,sBAAsB,QAAQ;EAC9B,SAAS;EACT;EACA;EACA,SAAS,QAAQ;EACjB;;UAGe;;EAEf,cAAc,KAAK;EACnB,OAAO;EACP,YAAY;;EAEZ,aACE,QAAQ,YACR,SAAS,uBACR;EACH;;EAEA;EACA;EACA,SAAS,QAAQ;EACjB;;KAGU,sBAAsB,KAChC;KAIU,oBAAoB;KAEpB;EACV,gBACE,eACA,UAAU,2BACP;EACL,YACE,SAAS,iBACT,YAAY,QAAQ,2BAA2B,QAAQ,mBACpD,QAAQ;EACb,gBACE,SAAS,oBACN;EACL,yBAAyB;;KAGf;EACV;EACA;EACA,UAAU,OAAO,OAAO,cAAc;EACtC,UAAU;;KAGA;EACV,SAAS,OAAO,gBAAgB;EAChC,SAAS,OAAO,gBAAgB;EAChC,SAAS,gBAAgB,oBAAoB;EAC7C,eACE,gBACA;IACK;MAAQ;;;EACf,kBACE,gBACA,cACA,sBACG;;UAGU;EACf;EACA;EACA;;UAGe;EACf;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;;UAGe,iCAAiC;EAChD,OAAO,SAAS,UAAU,QAAQ;;UAGnB,mCAAmC;EAClD,QACE,OAAO,mBACP,SAAS,cACR,QAAQ;;UAGI;EACf;EACA;EACA;;UAGe,iBAAiB;EAChC;;UAGe;EACf;;EAEA;;KAGU,sBAAsB,iFAO5B,UAAU,2BAA2B,OAAO,QAAQ;UAEzC,mBAAmB;EAClC,qBAAqB,MAAM;EAC3B,mBAAmB,OAAO;;UAGX,qBACf,gBACA,gBACA,SAAS,iCACD,KACR,mBAAmB;EAGnB;EACA,SAAS;EACT,OAAO;EACP,SAAS;EACT,QAAQ;EACR;EACA,SAAS;EACT;EACA;EACA,SAAS,QAAQ;EACjB,kBAAkB,sBAAsB;EACxC,QAAQ;EACR,cAAc;EACd,WAAW;;EAEX;EACA,kBAAkB,mBAAmB;EACrC,WAAW,MAAM,cAAc;EAC/B,SAAS,OAAO,qBAAqB;;UAGtB;EACf,QAAQ;EACR,SAAS,QAAQ,cAAc;;EAE/B,QAAQ,2BAA2B;;EAEnC,UAAU,OAAO,aAAa,wBAAwB;EACtD,UAAU;;KAGA,oBAAoB,MAAM,MAAM,UAAU,KACpD,qBAAqB,MAAM,MAAM;UAIlB;EACf;EACA;;EAEA;;UAGe,eACf,gBACA,SAAS,iCACD,KACR,mBAAmB;EAGnB,cAAc;EACd,QAAQ;EACR,OAAO;EACP,SAAS;EACT,QAAQ;EACR,cAAc;EACd,WAAW;;UAGI;;EAEf;;EAEA,SAAS,gBAAgB;;;UAIV,qBAAqB;EACpC,KAAK,qBAAqB,QAAQ;;EAElC,KAAK,qBAAqB;EAC1B;EACA;EACA;EACA;;UAEe;EACf;EACA,SAAS;;UAEM;EACf;;EAEA,QACE,MAAM,WACJ,YAAY,YAAY;EAG5B,SAAS,SAAS,oCAAoC;;UAEvC;EACf;EACA;EACA;EACA;EACA;;UAEe;;EAEf,QAAQ,QAAQ;;EAEhB,cAAc,SAAS,SAAS,sBAAsB;EACtD;;UAEe;EACf;EACA;EACA;EACA;;UAEe;EACf;EACA;EACA"}

package/dist/lib/permission.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/lib/permission.d.ts

@@ -0,0 +1 @@
+export {}

package/dist/lib/permission.js

@@ -0,0 +1 @@
+export{};

package/dist/modules/auth/client/index.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./retry.cjs"),t=require("../interface.cjs"),n=require("../policy.cjs");exports.AuthError=t.AuthError,exports.createAuthFreshnessPolicy=n.createAuthFreshnessPolicy,exports.createAuthPolicy=n.createAuthPolicy,exports.createAuthRetry=e.createAuthRetry,exports.waitForAuthOperation=e.waitForAuthOperation;

package/dist/modules/auth/client/index.d.cts

@@ -0,0 +1,6 @@
+/** SDK owns login/useSession/signOut. This entry only coordinates request retries. */
+import { createAuthRetry, waitForAuthOperation } from "./retry.cjs";
+import { c as AuthRetryOptions, i as AuthFreshnessInput, n as AuthErrorCode, o as AuthPolicy, r as AuthFreshness, s as AuthRetryInput } from "../../../interface-ii8DV63k.cjs";
+import { AuthError } from "../interface.cjs";
+import { createAuthFreshnessPolicy, createAuthPolicy } from "../policy.cjs";
+export { AuthError, type AuthErrorCode, type AuthFreshness, type AuthFreshnessInput, type AuthPolicy, type AuthRetryInput, type AuthRetryOptions, createAuthFreshnessPolicy, createAuthPolicy, createAuthRetry, waitForAuthOperation };

package/dist/modules/auth/client/index.d.ts

@@ -0,0 +1,6 @@
+/** SDK owns login/useSession/signOut. This entry only coordinates request retries. */
+import { createAuthRetry, waitForAuthOperation } from "./retry.js";
+import { c as AuthRetryOptions, i as AuthFreshnessInput, n as AuthErrorCode, o as AuthPolicy, r as AuthFreshness, s as AuthRetryInput } from "../../../interface-ii8DV63k.js";
+import { AuthError } from "../interface.js";
+import { createAuthFreshnessPolicy, createAuthPolicy } from "../policy.js";
+export { AuthError, type AuthErrorCode, type AuthFreshness, type AuthFreshnessInput, type AuthPolicy, type AuthRetryInput, type AuthRetryOptions, createAuthFreshnessPolicy, createAuthPolicy, createAuthRetry, waitForAuthOperation };

package/dist/modules/auth/client/index.js

@@ -0,0 +1 @@
+import{createAuthRetry as e,waitForAuthOperation as t}from"./retry.js";import{AuthError as n}from"../interface.js";import{createAuthFreshnessPolicy as r,createAuthPolicy as i}from"../policy.js";export{n as AuthError,r as createAuthFreshnessPolicy,i as createAuthPolicy,e as createAuthRetry,t as waitForAuthOperation};

package/dist/modules/auth/client/retry.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});async function e(e,t){return t?await new Promise((n,r)=>{let i=()=>{t.removeEventListener(`abort`,i),r(t.reason)};t.addEventListener(`abort`,i,{once:!0}),t.aborted&&i(),(async()=>{try{n(await e)}catch(e){r(e)}finally{t.removeEventListener(`abort`,i)}})()}):await e}function t(t){let n,r,i=0,a=!1;function o(){i++,r?.abort(),n=void 0}function s(){if(n)return n;r=new AbortController;let e=r.signal,o=i,s;return s=(async()=>{await Promise.resolve();try{return e.aborted||a||o!==i?!1:await t.refresh(e)&&o===i&&!a&&!e.aborted}catch{return!1}finally{n===s&&(n=void 0)}})(),n=s,s}return{async withAuthRetry(n,r={}){r.signal?.throwIfAborted();let o=i;try{return await n()}catch(c){if(r.signal?.throwIfAborted(),a||o!==i||r.enabled===!1||t.getStatus(c)!==401||!await e(s(),r.signal)||o!==i||a)throw c;return r.signal?.throwIfAborted(),await n()}},reset:o,dispose(){a=!0,o()}}}exports.createAuthRetry=t,exports.waitForAuthOperation=e;

package/dist/modules/auth/client/retry.d.cts

@@ -0,0 +1,11 @@
+import { c as AuthRetryOptions, s as AuthRetryInput } from "../../../interface-ii8DV63k.cjs";
+/** Waiter cancellation must not abort a refresh needed by other requests. */
+export declare function waitForAuthOperation<Value>(operation: Promise<Value>, signal?: AbortSignal): Promise<Value>;
+/** One refresh flight per factory, one retry per request. Reset on logout/account change. */
+export declare function createAuthRetry(options: AuthRetryOptions): {
+  withAuthRetry<Value>(request: () => Promise<Value>, input?: AuthRetryInput): Promise<Value>;
+  reset: () => void;
+  dispose(): void;
+};
+export type { AuthRetryInput, AuthRetryOptions };
+//# sourceMappingURL=retry.d.cts.map

package/dist/modules/auth/client/retry.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.cts","names":[],"sources":["../../../../src/modules/auth/client/retry.ts"],"mappings":";;wBAGsB,qBAAqB,OACzC,WAAW,QAAQ,QACnB,SAAS,cACR,QAAQ;;wBAuBK,gBAAgB,SAAS;EAoCjB,cAAA,OAAK,eACR,QAAQ,QAAM,QACtB,iBACN,QAAQ"}

package/dist/modules/auth/client/retry.d.ts

@@ -0,0 +1,11 @@
+import { c as AuthRetryOptions, s as AuthRetryInput } from "../../../interface-ii8DV63k.js";
+/** Waiter cancellation must not abort a refresh needed by other requests. */
+export declare function waitForAuthOperation<Value>(operation: Promise<Value>, signal?: AbortSignal): Promise<Value>;
+/** One refresh flight per factory, one retry per request. Reset on logout/account change. */
+export declare function createAuthRetry(options: AuthRetryOptions): {
+  withAuthRetry<Value>(request: () => Promise<Value>, input?: AuthRetryInput): Promise<Value>;
+  reset: () => void;
+  dispose(): void;
+};
+export type { AuthRetryInput, AuthRetryOptions };
+//# sourceMappingURL=retry.d.ts.map

package/dist/modules/auth/client/retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.ts","names":[],"sources":["../../../../src/modules/auth/client/retry.ts"],"mappings":";;wBAGsB,qBAAqB,OACzC,WAAW,QAAQ,QACnB,SAAS,cACR,QAAQ;;wBAuBK,gBAAgB,SAAS;EAoCjB,cAAA,OAAK,eACR,QAAQ,QAAM,QACtB,iBACN,QAAQ"}

package/dist/modules/auth/client/retry.js

@@ -0,0 +1,2 @@
+async function e(e,t){return t?await new Promise((n,r)=>{let i=()=>{t.removeEventListener(`abort`,i),r(t.reason)};t.addEventListener(`abort`,i,{once:!0}),t.aborted&&i(),(async()=>{try{n(await e)}catch(e){r(e)}finally{t.removeEventListener(`abort`,i)}})()}):await e}function t(t){let n,r,i=0,a=!1;function o(){i++,r?.abort(),n=void 0}function s(){if(n)return n;r=new AbortController;let e=r.signal,o=i,s;return s=(async()=>{await Promise.resolve();try{return e.aborted||a||o!==i?!1:await t.refresh(e)&&o===i&&!a&&!e.aborted}catch{return!1}finally{n===s&&(n=void 0)}})(),n=s,s}return{async withAuthRetry(n,r={}){r.signal?.throwIfAborted();let o=i;try{return await n()}catch(c){if(r.signal?.throwIfAborted(),a||o!==i||r.enabled===!1||t.getStatus(c)!==401||!await e(s(),r.signal)||o!==i||a)throw c;return r.signal?.throwIfAborted(),await n()}},reset:o,dispose(){a=!0,o()}}}export{t as createAuthRetry,e as waitForAuthOperation};
+//# sourceMappingURL=retry.js.map