@kaiz11/stack-client 0.0.14

package/dist/auth/methods/oauth.js

@@ -0,0 +1,165 @@
+import { authPath } from "../../lib/paths.js";
+import { normalizeSession } from "../types.js";
+/**
+ * OAuth authentication methods
+ */
+export class OAuthMethods {
+    http;
+    tokenManager;
+    tenantId;
+    constructor(http, tokenManager, tenantId) {
+        this.http = http;
+        this.tokenManager = tokenManager;
+        this.tenantId = tenantId;
+    }
+    /**
+     * Get the base URL for OAuth redirects
+     */
+    getBaseUrl() {
+        return this.http.getBaseUrl();
+    }
+    /**
+     * Sign in with OAuth provider
+     *
+     * In browser: Redirects to provider's auth page
+     * With skipBrowserRedirect: Returns URL for manual redirect
+     *
+     * @example
+     * ```typescript
+     * // Browser redirect
+     * await client.auth.signInWithOAuth({
+     *   provider: "google",
+     *   redirectTo: "https://myapp.com/auth/callback",
+     * });
+     *
+     * // Get URL without redirect
+     * const { url } = await client.auth.signInWithOAuth({
+     *   provider: "github",
+     *   skipBrowserRedirect: true,
+     * });
+     * ```
+     */
+    async signInWithOAuth(options) {
+        const { provider, redirectTo, scopes, queryParams, skipBrowserRedirect } = options;
+        // Build authorization URL
+        const params = new URLSearchParams();
+        if (redirectTo)
+            params.set("redirect_to", redirectTo);
+        if (scopes)
+            params.set("scopes", scopes);
+        if (queryParams) {
+            for (const [key, value] of Object.entries(queryParams)) {
+                params.set(key, value);
+            }
+        }
+        const baseUrl = this.getBaseUrl();
+        const authorizePath = authPath(this.tenantId, `/authorize`);
+        const queryString = params.toString();
+        const url = `${baseUrl}${authorizePath}?provider=${provider}${queryString ? `&${queryString}` : ""}`;
+        // Redirect in browser unless skipped
+        if (!skipBrowserRedirect && typeof window !== "undefined") {
+            window.location.href = url;
+        }
+        return { url, provider };
+    }
+    /**
+     * Handle OAuth callback
+     *
+     * Call this on your callback page to exchange the authorization code for a session.
+     * Also handles email verification callbacks which use URL hash fragments.
+     *
+     * @example
+     * ```typescript
+     * // On /auth/callback page or in AuthProvider on mount
+     * const session = await client.auth.handleOAuthCallback();
+     * if (session) {
+     *   router.push("/dashboard");
+     * }
+     * ```
+     */
+    async handleOAuthCallback() {
+        // Parse URL parameters
+        if (typeof window === "undefined") {
+            throw new Error("handleOAuthCallback can only be called in browser");
+        }
+        let params = new URLSearchParams(window.location.search);
+        // Check for hash fragment (email verification and some OAuth flows use fragment)
+        if (window.location.hash) {
+            const hashParams = new URLSearchParams(window.location.hash.substring(1));
+            if (hashParams.get("access_token")) {
+                params = hashParams;
+            }
+        }
+        const accessToken = params.get("access_token");
+        const refreshToken = params.get("refresh_token");
+        const expiresIn = params.get("expires_in");
+        const expiresAt = params.get("expires_at");
+        // Check for authorization code flow
+        const code = params.get("code");
+        if (code) {
+            return this.exchangeCodeForSession(code);
+        }
+        // Check for implicit flow tokens
+        if (accessToken && refreshToken) {
+            // Fetch user info to complete session
+            const path = authPath(this.tenantId, "/user");
+            const response = await this.http.get(path, {
+                headers: { Authorization: `Bearer ${accessToken}` },
+            });
+            const session = {
+                accessToken,
+                refreshToken,
+                expiresIn: expiresIn ? parseInt(expiresIn, 10) : 3600,
+                expiresAt: expiresAt
+                    ? parseInt(expiresAt, 10)
+                    : Math.floor(Date.now() / 1000) + 3600,
+                tokenType: "bearer",
+                user: response.user
+                    ? {
+                        id: response.user.id,
+                        email: response.user.email ?? null,
+                        phone: response.user.phone ?? null,
+                        emailConfirmedAt: response.user.email_confirmed_at ?? null,
+                        phoneConfirmedAt: response.user.phone_confirmed_at ?? null,
+                        createdAt: response.user.created_at,
+                        updatedAt: response.user.updated_at,
+                        appMetadata: response.user.app_metadata,
+                        userMetadata: response.user.user_metadata,
+                    }
+                    : {
+                        id: "",
+                        email: null,
+                        phone: null,
+                        emailConfirmedAt: null,
+                        phoneConfirmedAt: null,
+                        createdAt: new Date().toISOString(),
+                        updatedAt: new Date().toISOString(),
+                        appMetadata: {},
+                        userMetadata: {},
+                    },
+            };
+            this.tokenManager.setSession(session);
+            return session;
+        }
+        // Check for error
+        const error = params.get("error");
+        const errorDescription = params.get("error_description");
+        if (error) {
+            throw new Error(errorDescription || error);
+        }
+        return null;
+    }
+    /**
+     * Exchange authorization code for session (PKCE flow)
+     */
+    async exchangeCodeForSession(code) {
+        const path = authPath(this.tenantId, "/token?grant_type=pkce");
+        const response = await this.http.post(path, {
+            auth_code: code,
+        }, { noAuth: true });
+        const session = normalizeSession(response);
+        this.tokenManager.setSession(session);
+        return session;
+    }
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/methods/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/auth/methods/oauth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAO9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C;;GAEG;AACH,MAAM,OAAO,YAAY;IAEJ;IACA;IACA;IAHnB,YACmB,IAAgB,EAChB,YAA0B,EAC1B,QAAgB;QAFhB,SAAI,GAAJ,IAAI,CAAY;QAChB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ;;OAEG;IACK,UAAU;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,eAAe,CACnB,OAA2B;QAE3B,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,GACtE,OAAO,CAAC;QAEV,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,aAAa,aAAa,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAErG,qCAAqC;QACrC,IAAI,CAAC,mBAAmB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC;QAC7B,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,mBAAmB;QACvB,uBAAuB;QACvB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEzD,iFAAiF;QACjF,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,IAAI,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,MAAM,GAAG,UAAU,CAAC;YACtB,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE3C,oCAAoC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,iCAAiC;QACjC,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;YAChC,sCAAsC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAsB,IAAI,EAAE;gBAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;aACpD,CAAC,CAAC;YAEH,MAAM,OAAO,GAAY;gBACvB,WAAW;gBACX,YAAY;gBACZ,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;gBACrD,SAAS,EAAE,SAAS;oBAClB,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;oBACzB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;gBACxC,SAAS,EAAE,QAAQ;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACjB,CAAC,CAAC;wBACE,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;wBACpB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;wBAClC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;wBAClC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI;wBAC1D,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI;wBAC1D,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;wBACnC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;wBACnC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY;wBACvC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa;qBAC1C;oBACH,CAAC,CAAC;wBACE,EAAE,EAAE,EAAE;wBACN,KAAK,EAAE,IAAI;wBACX,KAAK,EAAE,IAAI;wBACX,gBAAgB,EAAE,IAAI;wBACtB,gBAAgB,EAAE,IAAI;wBACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,WAAW,EAAE,EAAE;wBACf,YAAY,EAAE,EAAE;qBACjB;aACN,CAAC;YAEF,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,kBAAkB;QAClB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACzD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAAC,IAAY;QAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CACnC,IAAI,EACJ;YACE,SAAS,EAAE,IAAI;SAChB,EACD,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;QAEF,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/auth/methods/otp.d.ts

@@ -0,0 +1,43 @@
+import type { HttpClient } from "../../lib/http.js";
+import type { TokenManager } from "../token-manager.js";
+import type { OtpSignInOptions, OtpVerifyOptions, Session } from "../types.js";
+/**
+ * OTP (one-time password) authentication methods
+ */
+export declare class OtpMethods {
+    private readonly http;
+    private readonly tokenManager;
+    private readonly tenantId;
+    constructor(http: HttpClient, tokenManager: TokenManager, tenantId: string);
+    /**
+     * Send an OTP to the user's email or phone
+     *
+     * @example
+     * ```typescript
+     * // Email OTP
+     * await client.auth.signInWithOtp({
+     *   email: "user@example.com",
+     * });
+     *
+     * // Phone OTP
+     * await client.auth.signInWithOtp({
+     *   phone: "+1234567890",
+     * });
+     * ```
+     */
+    signInWithOtp(options: OtpSignInOptions): Promise<void>;
+    /**
+     * Verify an OTP code
+     *
+     * @example
+     * ```typescript
+     * const session = await client.auth.verifyOtp({
+     *   email: "user@example.com",
+     *   token: "123456",
+     *   type: "email",
+     * });
+     * ```
+     */
+    verifyOtp(options: OtpVerifyOptions): Promise<Session>;
+}
+//# sourceMappingURL=otp.d.ts.map

package/dist/auth/methods/otp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp.d.ts","sourceRoot":"","sources":["../../../src/auth/methods/otp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,OAAO,EAER,MAAM,aAAa,CAAC;AAUrB;;GAEG;AACH,qBAAa,UAAU;IAEnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,IAAI,EAAE,UAAU,EAChB,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,MAAM;IAGnC;;;;;;;;;;;;;;;OAeG;IACG,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB7D;;;;;;;;;;;OAWG;IACG,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAkB7D"}

package/dist/auth/methods/otp.js

@@ -0,0 +1,66 @@
+import { authPath } from "../../lib/paths.js";
+import { normalizeSession } from "../types.js";
+/**
+ * OTP (one-time password) authentication methods
+ */
+export class OtpMethods {
+    http;
+    tokenManager;
+    tenantId;
+    constructor(http, tokenManager, tenantId) {
+        this.http = http;
+        this.tokenManager = tokenManager;
+        this.tenantId = tenantId;
+    }
+    /**
+     * Send an OTP to the user's email or phone
+     *
+     * @example
+     * ```typescript
+     * // Email OTP
+     * await client.auth.signInWithOtp({
+     *   email: "user@example.com",
+     * });
+     *
+     * // Phone OTP
+     * await client.auth.signInWithOtp({
+     *   phone: "+1234567890",
+     * });
+     * ```
+     */
+    async signInWithOtp(options) {
+        const path = authPath(this.tenantId, "/otp");
+        await this.http.post(path, {
+            email: options.email,
+            phone: options.phone,
+            redirect_to: options.redirectTo,
+            create_user: options.shouldCreateUser ?? false,
+            data: options.data,
+        }, { noAuth: true });
+    }
+    /**
+     * Verify an OTP code
+     *
+     * @example
+     * ```typescript
+     * const session = await client.auth.verifyOtp({
+     *   email: "user@example.com",
+     *   token: "123456",
+     *   type: "email",
+     * });
+     * ```
+     */
+    async verifyOtp(options) {
+        const path = authPath(this.tenantId, "/verify");
+        const response = await this.http.post(path, {
+            email: options.email,
+            phone: options.phone,
+            token: options.token,
+            type: options.type,
+        }, { noAuth: true });
+        const session = normalizeSession(response);
+        this.tokenManager.setSession(session);
+        return session;
+    }
+}
+//# sourceMappingURL=otp.js.map

package/dist/auth/methods/otp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp.js","sourceRoot":"","sources":["../../../src/auth/methods/otp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAQ9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAS/C;;GAEG;AACH,MAAM,OAAO,UAAU;IAEF;IACA;IACA;IAHnB,YACmB,IAAgB,EAChB,YAA0B,EAC1B,QAAgB;QAFhB,SAAI,GAAJ,IAAI,CAAY;QAChB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,aAAa,CAAC,OAAyB;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE7C,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAClB,IAAI,EACJ;YACE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,UAAU;YAC/B,WAAW,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;YAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,EACD,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,SAAS,CAAC,OAAyB;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CACnC,IAAI,EACJ;YACE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,EACD,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;QAEF,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/auth/methods/password.d.ts

@@ -0,0 +1,64 @@
+import type { HttpClient } from "../../lib/http.js";
+import type { TokenManager } from "../token-manager.js";
+import type { EmailPasswordCredentials, SignUpOptions, Session, SignUpResult, LogoutScope } from "../types.js";
+/**
+ * Password authentication methods
+ */
+export declare class PasswordMethods {
+    private readonly http;
+    private readonly tokenManager;
+    private readonly tenantId;
+    constructor(http: HttpClient, tokenManager: TokenManager, tenantId: string);
+    /**
+     * Sign in with email and password
+     *
+     * @example
+     * ```typescript
+     * const session = await client.auth.signInWithPassword({
+     *   email: "user@example.com",
+     *   password: "password123",
+     * });
+     * ```
+     */
+    signInWithPassword(credentials: EmailPasswordCredentials): Promise<Session>;
+    /**
+     * Sign up with email and password
+     *
+     * Returns a SignUpResult with session (if auto-confirm enabled) or just user info
+     * (if email verification required).
+     *
+     * @example
+     * ```typescript
+     * const { session, user } = await client.auth.signUp({
+     *   email: "newuser@example.com",
+     *   password: "password123",
+     *   data: { name: "New User" },
+     * });
+     *
+     * if (session) {
+     *   // User is signed in (auto-confirm enabled)
+     *   console.log("Signed in as", session.user.email);
+     * } else {
+     *   // Email verification required
+     *   console.log("Check your email to verify", user.email);
+     * }
+     * ```
+     */
+    signUp(options: SignUpOptions): Promise<SignUpResult>;
+    /**
+     * Sign out current session
+     *
+     * @param scope - "local" to clear local session only, "global" to revoke all sessions
+     *
+     * @example
+     * ```typescript
+     * // Local sign out (fast, no network request)
+     * await client.auth.signOut();
+     *
+     * // Global sign out (revokes all sessions on server)
+     * await client.auth.signOut("global");
+     * ```
+     */
+    signOut(scope?: LogoutScope): Promise<void>;
+}
+//# sourceMappingURL=password.d.ts.map

package/dist/auth/methods/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/auth/methods/password.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,wBAAwB,EACxB,aAAa,EACb,OAAO,EAGP,YAAY,EACZ,WAAW,EACZ,MAAM,aAAa,CAAC;AAGrB;;GAEG;AACH,qBAAa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,IAAI,EAAE,UAAU,EAChB,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,MAAM;IAGnC;;;;;;;;;;OAUG;IACG,kBAAkB,CACtB,WAAW,EAAE,wBAAwB,GACpC,OAAO,CAAC,OAAO,CAAC;IAgBnB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAwC3D;;;;;;;;;;;;;OAaG;IACG,OAAO,CAAC,KAAK,GAAE,WAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;CAgB3D"}

package/dist/auth/methods/password.js

@@ -0,0 +1,116 @@
+import { authPath } from "../../lib/paths.js";
+import { normalizeSession, normalizeUser } from "../types.js";
+/**
+ * Password authentication methods
+ */
+export class PasswordMethods {
+    http;
+    tokenManager;
+    tenantId;
+    constructor(http, tokenManager, tenantId) {
+        this.http = http;
+        this.tokenManager = tokenManager;
+        this.tenantId = tenantId;
+    }
+    /**
+     * Sign in with email and password
+     *
+     * @example
+     * ```typescript
+     * const session = await client.auth.signInWithPassword({
+     *   email: "user@example.com",
+     *   password: "password123",
+     * });
+     * ```
+     */
+    async signInWithPassword(credentials) {
+        const path = authPath(this.tenantId, "/token?grant_type=password");
+        const response = await this.http.post(path, {
+            email: credentials.email,
+            password: credentials.password,
+        }, { noAuth: true });
+        const session = normalizeSession(response);
+        this.tokenManager.setSession(session);
+        return session;
+    }
+    /**
+     * Sign up with email and password
+     *
+     * Returns a SignUpResult with session (if auto-confirm enabled) or just user info
+     * (if email verification required).
+     *
+     * @example
+     * ```typescript
+     * const { session, user } = await client.auth.signUp({
+     *   email: "newuser@example.com",
+     *   password: "password123",
+     *   data: { name: "New User" },
+     * });
+     *
+     * if (session) {
+     *   // User is signed in (auto-confirm enabled)
+     *   console.log("Signed in as", session.user.email);
+     * } else {
+     *   // Email verification required
+     *   console.log("Check your email to verify", user.email);
+     * }
+     * ```
+     */
+    async signUp(options) {
+        const path = authPath(this.tenantId, "/signup");
+        const response = await this.http.post(path, {
+            email: options.email,
+            password: options.password,
+            data: options.data,
+        }, { noAuth: true });
+        // Check if we got a full token response (auto-confirm enabled)
+        if (response.access_token && response.refresh_token) {
+            const session = normalizeSession(response);
+            this.tokenManager.setSession(session);
+            return { session, user: session.user };
+        }
+        // Email verification required - no session, just user info
+        const user = normalizeUser({
+            id: response.id,
+            aud: "authenticated",
+            email: response.email,
+            phone: response.phone,
+            created_at: response.created_at,
+            updated_at: response.updated_at,
+            app_metadata: response.app_metadata,
+            user_metadata: response.user_metadata,
+            identities: response.identities,
+        });
+        return { session: null, user };
+    }
+    /**
+     * Sign out current session
+     *
+     * @param scope - "local" to clear local session only, "global" to revoke all sessions
+     *
+     * @example
+     * ```typescript
+     * // Local sign out (fast, no network request)
+     * await client.auth.signOut();
+     *
+     * // Global sign out (revokes all sessions on server)
+     * await client.auth.signOut("global");
+     * ```
+     */
+    async signOut(scope = "local") {
+        const accessToken = this.tokenManager.getAccessToken();
+        if (accessToken && scope === "global") {
+            try {
+                const path = authPath(this.tenantId, "/logout?scope=global");
+                await this.http.post(path, undefined, {
+                    headers: { Authorization: `Bearer ${accessToken}` },
+                });
+            }
+            catch {
+                // Ignore logout errors, clear local session anyway
+            }
+        }
+        this.tokenManager.clearSession();
+    }
+}
+//# sourceMappingURL=password.js.map

package/dist/auth/methods/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../src/auth/methods/password.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAW9C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE9D;;GAEG;AACH,MAAM,OAAO,eAAe;IAEP;IACA;IACA;IAHnB,YACmB,IAAgB,EAChB,YAA0B,EAC1B,QAAgB;QAFhB,SAAI,GAAJ,IAAI,CAAY;QAChB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,KAAK,CAAC,kBAAkB,CACtB,WAAqC;QAErC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CACnC,IAAI,EACJ;YACE,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,EACD,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;QAEF,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,MAAM,CAAC,OAAsB;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CACnC,IAAI,EACJ;YACE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,EACD,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;QAEF,+DAA+D;QAC/D,IAAI,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,gBAAgB,CAC9B,QAA0C,CAC3C,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACzC,CAAC;QAED,2DAA2D;QAC3D,MAAM,IAAI,GAAG,aAAa,CAAC;YACzB,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,GAAG,EAAE,eAAe;YACpB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,YAAY,EAAE,QAAQ,CAAC,YAGtB;YACD,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,OAAO,CAAC,QAAqB,OAAO;QACxC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QAEvD,IAAI,WAAW,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;gBAC7D,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE;oBACpC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;IACnC,CAAC;CACF"}

package/dist/auth/methods/recovery.d.ts

@@ -0,0 +1,62 @@
+import type { HttpClient } from "../../lib/http.js";
+import type { TokenManager } from "../token-manager.js";
+import type { PasswordResetOptions, UpdatePasswordOptions, ReauthenticateOptions, Session } from "../types.js";
+/**
+ * Password recovery and update methods
+ */
+export declare class RecoveryMethods {
+    private readonly http;
+    private readonly tokenManager;
+    private readonly tenantId;
+    constructor(http: HttpClient, tokenManager: TokenManager, tenantId: string);
+    /**
+     * Send a password reset email
+     *
+     * @example
+     * ```typescript
+     * await client.auth.resetPasswordForEmail({
+     *   email: "user@example.com",
+     *   redirectTo: "https://myapp.com/reset-password",
+     * });
+     * ```
+     */
+    resetPasswordForEmail(options: PasswordResetOptions): Promise<void>;
+    /**
+     * Update the user's password
+     *
+     * For sensitive operations, you may need to reauthenticate first.
+     *
+     * @example
+     * ```typescript
+     * // Simple password update (when user has recovery token)
+     * await client.auth.updatePassword({
+     *   password: "newSecurePassword123",
+     * });
+     *
+     * // With reauthentication nonce
+     * const { nonce } = await client.auth.reauthenticate();
+     * await client.auth.updatePassword({
+     *   password: "newSecurePassword123",
+     *   nonce,
+     * });
+     * ```
+     */
+    updatePassword(options: UpdatePasswordOptions): Promise<Session>;
+    /**
+     * Request reauthentication for sensitive operations
+     *
+     * Sends an OTP to the user's email or phone. The user must retrieve this OTP
+     * and provide it as the `nonce` parameter when performing sensitive operations
+     * like password changes.
+     *
+     * @example
+     * ```typescript
+     * await client.auth.reauthenticate();
+     * // User receives OTP via email
+     * // User provides OTP as nonce
+     * await client.auth.updatePassword({ password: "new", nonce: otpFromEmail });
+     * ```
+     */
+    reauthenticate(_options?: ReauthenticateOptions): Promise<void>;
+}
+//# sourceMappingURL=recovery.d.ts.map

package/dist/auth/methods/recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../src/auth/methods/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,OAAO,EAGR,MAAM,aAAa,CAAC;AAiBrB;;GAEG;AACH,qBAAa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,IAAI,EAAE,UAAU,EAChB,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,MAAM;IAGnC;;;;;;;;;;OAUG;IACG,qBAAqB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAazE;;;;;;;;;;;;;;;;;;;OAmBG;IACG,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC;IAmCtE;;;;;;;;;;;;;;OAcG;IACG,cAAc,CAAC,QAAQ,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;CAKtE"}

package/dist/auth/methods/recovery.js

@@ -0,0 +1,100 @@
+import { authPath } from "../../lib/paths.js";
+import { AuthError } from "../../lib/errors.js";
+import { normalizeSession, normalizeUser } from "../types.js";
+/**
+ * Password recovery and update methods
+ */
+export class RecoveryMethods {
+    http;
+    tokenManager;
+    tenantId;
+    constructor(http, tokenManager, tenantId) {
+        this.http = http;
+        this.tokenManager = tokenManager;
+        this.tenantId = tenantId;
+    }
+    /**
+     * Send a password reset email
+     *
+     * @example
+     * ```typescript
+     * await client.auth.resetPasswordForEmail({
+     *   email: "user@example.com",
+     *   redirectTo: "https://myapp.com/reset-password",
+     * });
+     * ```
+     */
+    async resetPasswordForEmail(options) {
+        const path = authPath(this.tenantId, "/recover");
+        await this.http.post(path, {
+            email: options.email,
+            redirect_to: options.redirectTo,
+        }, { noAuth: true });
+    }
+    /**
+     * Update the user's password
+     *
+     * For sensitive operations, you may need to reauthenticate first.
+     *
+     * @example
+     * ```typescript
+     * // Simple password update (when user has recovery token)
+     * await client.auth.updatePassword({
+     *   password: "newSecurePassword123",
+     * });
+     *
+     * // With reauthentication nonce
+     * const { nonce } = await client.auth.reauthenticate();
+     * await client.auth.updatePassword({
+     *   password: "newSecurePassword123",
+     *   nonce,
+     * });
+     * ```
+     */
+    async updatePassword(options) {
+        const path = authPath(this.tenantId, "/user");
+        const body = {
+            password: options.password,
+        };
+        if (options.nonce) {
+            body.nonce = options.nonce;
+        }
+        const response = await this.http.put(path, body);
+        let session;
+        if ("user" in response && response.user) {
+            session = normalizeSession(response);
+        }
+        else {
+            const currentSession = this.tokenManager.getSession();
+            if (!currentSession) {
+                throw AuthError.notAuthenticated();
+            }
+            session = {
+                ...currentSession,
+                user: normalizeUser(response),
+            };
+        }
+        this.tokenManager.setSession(session, "USER_UPDATED");
+        return session;
+    }
+    /**
+     * Request reauthentication for sensitive operations
+     *
+     * Sends an OTP to the user's email or phone. The user must retrieve this OTP
+     * and provide it as the `nonce` parameter when performing sensitive operations
+     * like password changes.
+     *
+     * @example
+     * ```typescript
+     * await client.auth.reauthenticate();
+     * // User receives OTP via email
+     * // User provides OTP as nonce
+     * await client.auth.updatePassword({ password: "new", nonce: otpFromEmail });
+     * ```
+     */
+    async reauthenticate(_options) {
+        const path = authPath(this.tenantId, "/reauthenticate");
+        await this.http.get(path);
+    }
+}
+//# sourceMappingURL=recovery.js.map

package/dist/auth/methods/recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.js","sourceRoot":"","sources":["../../../src/auth/methods/recovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAUhD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAgB9D;;GAEG;AACH,MAAM,OAAO,eAAe;IAEP;IACA;IACA;IAHnB,YACmB,IAAgB,EAChB,YAA0B,EAC1B,QAAgB;QAFhB,SAAI,GAAJ,IAAI,CAAY;QAChB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,KAAK,CAAC,qBAAqB,CAAC,OAA6B;QACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEjD,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAClB,IAAI,EACJ;YACE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,UAAU;SAChC,EACD,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,cAAc,CAAC,OAA8B;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAE9C,MAAM,IAAI,GAA4B;YACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;QAEF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAClC,IAAI,EACJ,IAAI,CACL,CAAC;QAEF,IAAI,OAAgB,CAAC;QACrB,IAAI,MAAM,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,OAAO,GAAG,gBAAgB,CAAC,QAA+B,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;YACtD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,SAAS,CAAC,gBAAgB,EAAE,CAAC;YACrC,CAAC;YAED,OAAO,GAAG;gBACR,GAAG,cAAc;gBACjB,IAAI,EAAE,aAAa,CAAC,QAAsB,CAAC;aAC5C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgC;QACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAExD,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAyB,IAAI,CAAC,CAAC;IACpD,CAAC;CACF"}