@managemint-solutions/sdk 0.6.0 → 0.8.0

package/README.md

@@ -15,7 +15,9 @@ are peer dependencies — the request DTOs (`AddStatusDto`, `UpdateStatusDto`, `
 `AdditionalDetailsIdDto`, `GetAdditionalDetailsDto`, `AddNoteDto`, `NoteIdDto`,
 `GetNotesDto`, `SupportingFileIdDto`, `GetSupportingFilesDto`, `GetClientsDto`, `ClientIdDto`,
 `CreateClientDto`, `UpdateClientDto`, `GetProjectsDto`, `ProjectIdDto`, `CreateProjectDto`,
-`UpdateProjectDto`, `GetTasksDto`, `TaskIdDto`, `CreateTaskDto`, `UpdateTaskDto`) ship with their class-validator
+`UpdateProjectDto`, `GetTasksDto`, `TaskIdDto`, `CreateTaskDto`, `UpdateTaskDto`, `SignInDto`,
+`ExchangeRefreshTokenDto`, `SendPasswordResetEmailDto`, `ExchangeTokenHashDto`,
+`ResetPasswordDto`) ship with their class-validator
 decorators so consumers validate against
 the same rules the SDK's input types describe. `@nestjs/common` (^11) is an optional peer
 dependency, needed only for the `@managemint-solutions/sdk/nest` subpath.
@@ -196,13 +198,78 @@ The client decodes `{ mms_id, organization_id }` from the JWT itself and scopes
 by `organization_id`. `supabase.supabase` is the raw `@supabase/supabase-js` client
 (`TypedSupabaseClient`) — the escape hatch for queries not yet covered by a resource.
 
+## Auth
+
+`SupabaseClient` needs the caller's JWT, which the auth flows are there to produce — so sign-in,
+refresh and the password-reset exchanges live on a separate `SupabaseAuthClient`, built from the
+publishable key alone.
+
+```ts
+import { createSupabaseAuthClient } from '@managemint-solutions/sdk';
+
+const auth = createSupabaseAuthClient({
+  url: process.env.SUPABASE_URL!,
+  key: process.env.SUPABASE_PUBLISHABLE_KEY!, // no caller token — these callers are logged out
+});
+
+const { access_token, refresh_token } = await auth.signIn({ email, password });
+await auth.refreshSession({ refresh_token });
+await auth.signOut();
+
+// The redirect URL is passed in; the SDK reads no environment variables.
+await auth.sendPasswordResetEmail({ email }, `${process.env.FRONTEND_URL}/reset-password`);
+await auth.exchangeRecoveryToken({ token_hash }); // recovery link → tokens
+await auth.exchangeConfirmToken({ token_hash });  // signup confirmation link → tokens
+await auth.resetPassword({ password, access_token, refresh_token });
+```
+
+`signIn` also stamps `users.last_logged_in` for the user who just signed in, on a throwaway
+client carrying the fresh access token; a failed stamp never fails the login. `signOut` is a
+no-op server-side — the client holds no session — and is kept for parity with the api endpoint
+it replaces. `auth.supabase` is the raw `@supabase/supabase-js` client.
+
+```ts
+import { SupabasePublicClient } from '@managemint-solutions/sdk/nest';
+import { SignInDto, SupabaseAuthClient } from '@managemint-solutions/sdk';
+
+@Controller('auth')
+export class AuthController {
+  @Post('sign-in')
+  signIn(@SupabasePublicClient() auth: SupabaseAuthClient, @Body() body: SignInDto) {
+    return auth.signIn(body);
+  }
+}
+```
+
+## Pricebooks
+
+The price catalog (`pricebooks`, `pricebook_modules`, `billing_modules`) is readable by `anon`
+by design — an unauthenticated signup prices against it — so `pricebooks` hangs off the same
+bearer-less `SupabaseAuthClient` as the auth flows, takes no auth context and scopes by nothing.
+
+```ts
+import { monthlyTotalMinor } from '@managemint-solutions/sdk';
+import type { PricebookWithModules } from '@managemint-solutions/entities/modules';
+
+const pricebook: PricebookWithModules = await auth.pricebooks.getActive();
+await auth.pricebooks.getById(pricebookId); // e.g. the pricebook an organization is pinned to
+
+// What the selected modules cost per month, in minor units. A module the pricebook does not
+// price throws a 400 `Pricing Error`.
+const total = monthlyTotalMinor(pricebook, ['CRM'], seatCount);
+```
+
+Each pricebook comes back with its `modules` flattened to `PricedModule`s (the `pricebook_modules`
+row joined with its `billing_modules` catalog entry). Exactly one pricebook is active at a time.
+
 ## Errors
 
 Every error the SDK throws is a `SupabaseClientError` carrying the HTTP `status` to respond
 with and the client-facing body, `toResponse()` → `{ error, message }`. Postgrest/Postgres
 errors are translated by `mapPostgrestError` (Postgrest code → status, RLS permission and
 module denials → readable messages), Storage errors by `mapStorageError` (the storage error's
-own HTTP status, or 500 when it has none); JWT problems are `401 Authentication Error`. Consumers
+own HTTP status, or 500 when it has none), Supabase Auth errors by `mapAuthError` (same rule,
+`Authentication Error`); JWT problems are `401 Authentication Error`. Consumers
 return these as-is instead of mapping database errors themselves.
 
 ## NestJS

package/dist/auth-client/dto.d.ts

@@ -0,0 +1,19 @@
+import type { ExchangeRefreshTokenDto as ExchangeRefreshTokenDtoType, ExchangeTokenHashDto as ExchangeTokenHashDtoType, loginDto as LoginDtoType, ResetPasswordDto as ResetPasswordDtoType, SendPasswordResetEmailDto as SendPasswordResetEmailDtoType } from '@managemint-solutions/entities/auth/dto';
+export declare class SignInDto implements LoginDtoType {
+    readonly email: string;
+    readonly password: string;
+}
+export declare class ExchangeRefreshTokenDto implements ExchangeRefreshTokenDtoType {
+    readonly refresh_token: string;
+}
+export declare class SendPasswordResetEmailDto implements SendPasswordResetEmailDtoType {
+    readonly email: string;
+}
+export declare class ExchangeTokenHashDto implements ExchangeTokenHashDtoType {
+    readonly token_hash: string;
+}
+export declare class ResetPasswordDto implements ResetPasswordDtoType {
+    readonly password: string;
+    readonly access_token: string;
+    readonly refresh_token: string;
+}

package/dist/auth-client/dto.js

@@ -0,0 +1,72 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.SendPasswordResetEmailDto = exports.ExchangeRefreshTokenDto = exports.SignInDto = void 0;
+const class_validator_1 = require("class-validator");
+// class-validator versions of the shared DTO types from @managemint-solutions/entities.
+// Each class `implements` its entities type so the wire contract cannot drift.
+// The entities type is spelled `loginDto` (lowercase); the class keeps the `SignInDto` name.
+class SignInDto {
+    email;
+    password;
+}
+exports.SignInDto = SignInDto;
+__decorate([
+    (0, class_validator_1.IsEmail)({}, { message: 'Email is required' }),
+    __metadata("design:type", String)
+], SignInDto.prototype, "email", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Password is required' }),
+    __metadata("design:type", String)
+], SignInDto.prototype, "password", void 0);
+class ExchangeRefreshTokenDto {
+    refresh_token;
+}
+exports.ExchangeRefreshTokenDto = ExchangeRefreshTokenDto;
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Refresh token is required' }),
+    __metadata("design:type", String)
+], ExchangeRefreshTokenDto.prototype, "refresh_token", void 0);
+class SendPasswordResetEmailDto {
+    email;
+}
+exports.SendPasswordResetEmailDto = SendPasswordResetEmailDto;
+__decorate([
+    (0, class_validator_1.IsEmail)({}, { message: 'Email is required' }),
+    __metadata("design:type", String)
+], SendPasswordResetEmailDto.prototype, "email", void 0);
+class ExchangeTokenHashDto {
+    token_hash;
+}
+exports.ExchangeTokenHashDto = ExchangeTokenHashDto;
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Token hash is required' }),
+    __metadata("design:type", String)
+], ExchangeTokenHashDto.prototype, "token_hash", void 0);
+class ResetPasswordDto {
+    password;
+    access_token;
+    refresh_token;
+}
+exports.ResetPasswordDto = ResetPasswordDto;
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Password is required' }),
+    __metadata("design:type", String)
+], ResetPasswordDto.prototype, "password", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Access token is required' }),
+    __metadata("design:type", String)
+], ResetPasswordDto.prototype, "access_token", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Refresh token is required' }),
+    __metadata("design:type", String)
+], ResetPasswordDto.prototype, "refresh_token", void 0);
+//# sourceMappingURL=dto.js.map

package/dist/auth-client/dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dto.js","sourceRoot":"","sources":["../../src/auth-client/dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAoD;AASpD,wFAAwF;AACxF,+EAA+E;AAE/E,6FAA6F;AAC7F,MAAa,SAAS;IAEX,KAAK,CAAU;IAGf,QAAQ,CAAU;CAC5B;AAND,8BAMC;AAJU;IADR,IAAA,yBAAO,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;;wCACtB;AAGf;IADR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;;2CACnB;AAG7B,MAAa,uBAAuB;IAEzB,aAAa,CAAU;CACjC;AAHD,0DAGC;AADU;IADR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;;8DACnB;AAGlC,MAAa,yBAAyB;IAE3B,KAAK,CAAU;CACzB;AAHD,8DAGC;AADU;IADR,IAAA,yBAAO,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;;wDACtB;AAG1B,MAAa,oBAAoB;IAEtB,UAAU,CAAU;CAC9B;AAHD,oDAGC;AADU;IADR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;;wDACnB;AAG/B,MAAa,gBAAgB;IAElB,QAAQ,CAAU;IAGlB,YAAY,CAAU;IAGtB,aAAa,CAAU;CACjC;AATD,4CASC;AAPU;IADR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;;kDACnB;AAGlB;IADR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;;sDACnB;AAGtB;IADR,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;;uDACnB"}

package/dist/auth-client/index.d.ts

@@ -0,0 +1,41 @@
+import { type SupabaseClient as SupabaseJsClient } from '@supabase/supabase-js';
+import type { ExchangeTokenResponse, LoginResponse } from '@managemint-solutions/entities/auth';
+import type { ExchangeRefreshTokenDto, ExchangeTokenHashDto, loginDto, ResetPasswordDto, SendPasswordResetEmailDto } from '@managemint-solutions/entities/auth/dto';
+import { PricebooksResource } from '../pricebooks';
+export * from './dto';
+export type SupabaseAuthClientConfig = {
+    url: string;
+    key: string;
+};
+/**
+ * The client for callers that do not have a JWT yet: the auth flows, and the public catalog
+ * (`pricebooks`) an unauthenticated signup prices against. `SupabaseClient` needs the caller's
+ * token to build its RLS context, so sign-in, refresh and the password-reset exchanges live on
+ * this separate client, built from the publishable key alone.
+ */
+export declare class SupabaseAuthClient {
+    private readonly config;
+    readonly supabase: SupabaseJsClient;
+    readonly pricebooks: PricebooksResource;
+    constructor(config: SupabaseAuthClientConfig);
+    signIn(input: loginDto): Promise<LoginResponse>;
+    refreshSession(input: ExchangeRefreshTokenDto): Promise<ExchangeTokenResponse>;
+    /**
+     * Parity with the api: this client never holds a session (`persistSession` is off), so
+     * server-side there is nothing to revoke and the call is a no-op. Kept as the api had it.
+     */
+    signOut(): Promise<void>;
+    /** `redirectTo` is passed in — the SDK reads no environment variables. */
+    sendPasswordResetEmail(input: SendPasswordResetEmailDto, redirectTo: string): Promise<void>;
+    exchangeRecoveryToken(input: ExchangeTokenHashDto): Promise<ExchangeTokenResponse>;
+    exchangeConfirmToken(input: ExchangeTokenHashDto): Promise<ExchangeTokenResponse>;
+    resetPassword(input: ResetPasswordDto): Promise<void>;
+    /**
+     * Stamps `users.last_logged_in` as the user who just signed in — the users UPDATE policy
+     * allows `auth.uid() = mms_id`, so the write goes through a throwaway client carrying the
+     * fresh access token rather than this session-less one. Parity with the api: the result is
+     * ignored, a failed stamp must not fail the login.
+     */
+    private stampLastLoggedIn;
+}
+export declare const createSupabaseAuthClient: (config: SupabaseAuthClientConfig) => SupabaseAuthClient;

package/dist/auth-client/index.js

@@ -0,0 +1,139 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSupabaseAuthClient = exports.SupabaseAuthClient = void 0;
+const supabase_js_1 = require("@supabase/supabase-js");
+const errors_1 = require("../errors");
+const pricebooks_1 = require("../pricebooks");
+__exportStar(require("./dto"), exports);
+// The api's "no session/user returned" NotFoundException, as an SDK error.
+const noSession = (message) => new errors_1.SupabaseClientError({ status: 404, error: 'Authentication Error', message });
+const toTokens = (session) => ({
+    access_token: session.access_token,
+    refresh_token: session.refresh_token,
+});
+/**
+ * The client for callers that do not have a JWT yet: the auth flows, and the public catalog
+ * (`pricebooks`) an unauthenticated signup prices against. `SupabaseClient` needs the caller's
+ * token to build its RLS context, so sign-in, refresh and the password-reset exchanges live on
+ * this separate client, built from the publishable key alone.
+ */
+class SupabaseAuthClient {
+    config;
+    supabase; // escape hatch for flows not covered by a method
+    pricebooks;
+    constructor(config) {
+        this.config = config;
+        this.supabase = (0, supabase_js_1.createClient)(config.url, config.key, {
+            // Server-side and stateless: nothing is stored, refreshed or read out of a URL.
+            auth: { persistSession: false, autoRefreshToken: false, detectSessionInUrl: false },
+        });
+        this.pricebooks = new pricebooks_1.PricebooksResource(this.supabase);
+    }
+    async signIn(input) {
+        const { data, error } = await this.supabase.auth.signInWithPassword({
+            email: input.email,
+            password: input.password,
+        });
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
+        if (!data.session || !data.user) {
+            throw noSession('Authentication failed: No session or user data returned');
+        }
+        await this.stampLastLoggedIn(data.session.access_token, data.user.id);
+        return toTokens(data.session);
+    }
+    async refreshSession(input) {
+        const { data, error } = await this.supabase.auth.refreshSession({
+            refresh_token: input.refresh_token,
+        });
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
+        if (!data.session)
+            throw noSession('Token exchange failed: No session data returned');
+        return toTokens(data.session);
+    }
+    /**
+     * Parity with the api: this client never holds a session (`persistSession` is off), so
+     * server-side there is nothing to revoke and the call is a no-op. Kept as the api had it.
+     */
+    async signOut() {
+        const { error } = await this.supabase.auth.signOut();
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
+    }
+    /** `redirectTo` is passed in — the SDK reads no environment variables. */
+    async sendPasswordResetEmail(input, redirectTo) {
+        const { error } = await this.supabase.auth.resetPasswordForEmail(input.email, { redirectTo });
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
+    }
+    async exchangeRecoveryToken(input) {
+        const { data, error } = await this.supabase.auth.verifyOtp({
+            type: 'recovery',
+            token_hash: input.token_hash,
+        });
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
+        if (!data.session)
+            throw noSession('Token exchange failed: No session data returned');
+        return toTokens(data.session);
+    }
+    async exchangeConfirmToken(input) {
+        const { data, error } = await this.supabase.auth.verifyOtp({
+            type: 'signup',
+            token_hash: input.token_hash,
+        });
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
+        if (!data.session)
+            throw noSession('Token exchange failed: No session data returned');
+        return toTokens(data.session);
+    }
+    async resetPassword(input) {
+        const { error: sessionError } = await this.supabase.auth.setSession({
+            access_token: input.access_token,
+            refresh_token: input.refresh_token,
+        });
+        if (sessionError)
+            throw (0, errors_1.mapAuthError)(sessionError);
+        const { error: updateError } = await this.supabase.auth.updateUser({
+            password: input.password,
+        });
+        if (updateError)
+            throw (0, errors_1.mapAuthError)(updateError);
+    }
+    /**
+     * Stamps `users.last_logged_in` as the user who just signed in — the users UPDATE policy
+     * allows `auth.uid() = mms_id`, so the write goes through a throwaway client carrying the
+     * fresh access token rather than this session-less one. Parity with the api: the result is
+     * ignored, a failed stamp must not fail the login.
+     */
+    async stampLastLoggedIn(accessToken, userId) {
+        const asUser = (0, supabase_js_1.createClient)(this.config.url, this.config.key, {
+            global: { headers: { Authorization: `Bearer ${accessToken}` } },
+            auth: { persistSession: false, autoRefreshToken: false },
+        });
+        await asUser
+            .from('users')
+            .update({ last_logged_in: new Date().toISOString() })
+            .eq('mms_id', userId);
+    }
+}
+exports.SupabaseAuthClient = SupabaseAuthClient;
+const createSupabaseAuthClient = (config) => new SupabaseAuthClient(config);
+exports.createSupabaseAuthClient = createSupabaseAuthClient;
+//# sourceMappingURL=index.js.map

package/dist/auth-client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth-client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,uDAA8F;AAY9F,sCAA8D;AAC9D,8CAAmD;AAEnD,wCAAsB;AAOtB,2EAA2E;AAC3E,MAAM,SAAS,GAAG,CAAC,OAAe,EAAuB,EAAE,CACzD,IAAI,4BAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,CAAC,OAGjB,EAAyB,EAAE,CAAC,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;IAClC,aAAa,EAAE,OAAO,CAAC,aAAa;CACrC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAa,kBAAkB;IAIA;IAHpB,QAAQ,CAAmB,CAAC,iDAAiD;IAC7E,UAAU,CAAqB;IAExC,YAA6B,MAAgC;QAAhC,WAAM,GAAN,MAAM,CAA0B;QAC3D,IAAI,CAAC,QAAQ,GAAG,IAAA,0BAAY,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;YACnD,gFAAgF;YAChF,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE;SACpF,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,+BAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAe;QAC1B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAClE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,SAAS,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEtE,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAA8B;QACjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC;YAC9D,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAEtF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACrD,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,sBAAsB,CAC1B,KAAgC,EAChC,UAAkB;QAElB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9F,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAA2B;QACrD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YACzD,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAEtF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAA2B;QACpD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YACzD,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAEtF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAuB;QACzC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YAClE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;QACH,IAAI,YAAY;YAAE,MAAM,IAAA,qBAAY,EAAC,YAAY,CAAC,CAAC;QAEnD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YACjE,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,WAAW;YAAE,MAAM,IAAA,qBAAY,EAAC,WAAW,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,MAAc;QACjE,MAAM,MAAM,GAAG,IAAA,0BAAY,EAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YAC5D,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YAC/D,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACzD,CAAC,CAAC;QACH,MAAM,MAAM;aACT,IAAI,CAAC,OAAO,CAAC;aACb,MAAM,CAAC,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;aACpD,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;CACF;AA1GD,gDA0GC;AAEM,MAAM,wBAAwB,GAAG,CAAC,MAAgC,EAAsB,EAAE,CAC/F,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;AADpB,QAAA,wBAAwB,4BACJ"}

package/dist/errors.d.ts

@@ -1,5 +1,5 @@
 import type { StorageError } from '@supabase/storage-js';
-import type { PostgrestError } from '@supabase/supabase-js';
+import type { AuthError, PostgrestError } from '@supabase/supabase-js';
 export type SupabaseClientErrorInit = {
     /** HTTP status the consumer should respond with. */
     status: number;
@@ -34,3 +34,9 @@ export declare const mapPostgrestError: (error: PostgrestError) => SupabaseClien
  * network/unknown failures have none, hence the 500 fallback.
  */
 export declare const mapStorageError: (error: StorageError, message?: string) => SupabaseClientError;
+/**
+ * Converts a Supabase Auth (GoTrue) error into the SupabaseClientError the SDK throws — the
+ * SDK-side equivalent of the api's `throwAuthErrorResponse`. `AuthError.status` is the HTTP
+ * status GoTrue answered with; network/unknown failures carry none, hence the 500 fallback.
+ */
+export declare const mapAuthError: (error: AuthError) => SupabaseClientError;

package/dist/errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.mapStorageError = exports.mapPostgrestError = exports.SupabaseClientError = void 0;
+exports.mapAuthError = exports.mapStorageError = exports.mapPostgrestError = exports.SupabaseClientError = void 0;
 /**
  * Every error the SDK throws. It already carries the HTTP status and the body the
  * consumer sends back to the client (`toResponse()`), so the api needs no mapping.
@@ -140,4 +140,15 @@ const mapStorageError = (error, message = error.message) => new SupabaseClientEr
     message,
 }, { cause: error });
 exports.mapStorageError = mapStorageError;
+/**
+ * Converts a Supabase Auth (GoTrue) error into the SupabaseClientError the SDK throws — the
+ * SDK-side equivalent of the api's `throwAuthErrorResponse`. `AuthError.status` is the HTTP
+ * status GoTrue answered with; network/unknown failures carry none, hence the 500 fallback.
+ */
+const mapAuthError = (error) => new SupabaseClientError({
+    status: error.status ?? 500,
+    error: 'Authentication Error',
+    message: error.message,
+}, { cause: error });
+exports.mapAuthError = mapAuthError;
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAcA;;;GAGG;AACH,MAAa,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,KAAK,CAAS;IACd,IAAI,CAAU;IAEvB,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAA2B,EAAE,OAA6B;QAClG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,UAAU;QACR,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;CACF;AAhBD,kDAgBC;AAED,MAAM,6BAA6B,GAA2B;IAC5D,uBAAuB;IACvB,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IAEb,wBAAwB;IACxB,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IAEb,yBAAyB;IACzB,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IAEb,gBAAgB;IAChB,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IAEb,qBAAqB;IACrB,QAAQ,EAAE,GAAG;IAEb,oDAAoD;IACpD,KAAK,EAAE,GAAG;IACV,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;CACT,CAAC;AAEF,MAAM,gBAAgB,GAA2B;IAC/C,4BAA4B,EAAE,sCAAsC;CACrE,CAAC;AAEF,sFAAsF;AACtF,qFAAqF;AACrF,+DAA+D;AAC/D,MAAM,mBAAmB,GAA2B;IAClD,aAAa,EAAE,oBAAoB;IACnC,WAAW,EAAE,kBAAkB;IAC/B,aAAa,EAAE,oBAAoB;IACnC,aAAa,EAAE,oBAAoB;IAEnC,kBAAkB,EAAE,uBAAuB;IAE3C,YAAY,EAAE,kBAAkB;IAChC,UAAU,EAAE,gBAAgB;IAC5B,YAAY,EAAE,kBAAkB;IAChC,YAAY,EAAE,kBAAkB;IAEhC,qBAAqB,EAAE,2BAA2B;IAClD,uBAAuB,EAAE,6BAA6B;IAEtD,cAAc,EAAE,oBAAoB;IACpC,YAAY,EAAE,kBAAkB;IAChC,cAAc,EAAE,oBAAoB;IACpC,cAAc,EAAE,oBAAoB;IAEpC,eAAe,EAAE,qBAAqB;IACtC,aAAa,EAAE,mBAAmB;IAClC,eAAe,EAAE,qBAAqB;IACtC,eAAe,EAAE,qBAAqB;IAEtC,cAAc,EAAE,oBAAoB;IACpC,YAAY,EAAE,kBAAkB;IAChC,cAAc,EAAE,oBAAoB;IACpC,cAAc,EAAE,oBAAoB;IAEpC,YAAY,EAAE,kBAAkB;IAChC,UAAU,EAAE,gBAAgB;IAC5B,YAAY,EAAE,kBAAkB;IAChC,YAAY,EAAE,kBAAkB;IAEhC,kBAAkB,EAAE,wBAAwB;IAC5C,oBAAoB,EAAE,0BAA0B;IAChD,oBAAoB,EAAE,0BAA0B;IAChD,oBAAoB,EAAE,0BAA0B;IAEhD,eAAe,EAAE,qBAAqB;IACtC,oBAAoB,EAAE,0BAA0B;CACjD,CAAC;AAEF,MAAM,eAAe,GAA2B;IAC9C,MAAM,EAAE,OAAO;CAChB,CAAC;AAEF,MAAM,iBAAiB,GAAG,4CAA4C,CAAC;AACvE,MAAM,aAAa,GAAG,gCAAgC,CAAC;AAEvD,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,OAAe,EAAU,EAAE;IACnE,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxC,OAAO,iBAAiB,GAAG,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACpC,OAAO,aAAa,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,gBAAgB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;AAC9C,CAAC,CAAC;AAEF,kFAAkF;AAC3E,MAAM,iBAAiB,GAAG,CAAC,KAAqB,EAAuB,EAAE,CAC9E,IAAI,mBAAmB,CACrB;IACE,MAAM,EAAE,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG;IACxD,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;IACtD,IAAI,EAAE,KAAK,CAAC,IAAI;CACjB,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;AATS,QAAA,iBAAiB,qBAS1B;AAEJ;;;;GAIG;AACI,MAAM,eAAe,GAAG,CAC7B,KAAmB,EACnB,OAAO,GAAG,KAAK,CAAC,OAAO,EACF,EAAE,CACvB,IAAI,mBAAmB,CACrB;IACE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG;IAC3B,KAAK,EAAE,eAAe;IACtB,OAAO;CACR,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;AAXS,QAAA,eAAe,mBAWxB"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAcA;;;GAGG;AACH,MAAa,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,KAAK,CAAS;IACd,IAAI,CAAU;IAEvB,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAA2B,EAAE,OAA6B;QAClG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,UAAU;QACR,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;CACF;AAhBD,kDAgBC;AAED,MAAM,6BAA6B,GAA2B;IAC5D,uBAAuB;IACvB,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IAEb,wBAAwB;IACxB,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IAEb,yBAAyB;IACzB,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IAEb,gBAAgB;IAChB,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,GAAG;IAEb,qBAAqB;IACrB,QAAQ,EAAE,GAAG;IAEb,oDAAoD;IACpD,KAAK,EAAE,GAAG;IACV,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;CACT,CAAC;AAEF,MAAM,gBAAgB,GAA2B;IAC/C,4BAA4B,EAAE,sCAAsC;CACrE,CAAC;AAEF,sFAAsF;AACtF,qFAAqF;AACrF,+DAA+D;AAC/D,MAAM,mBAAmB,GAA2B;IAClD,aAAa,EAAE,oBAAoB;IACnC,WAAW,EAAE,kBAAkB;IAC/B,aAAa,EAAE,oBAAoB;IACnC,aAAa,EAAE,oBAAoB;IAEnC,kBAAkB,EAAE,uBAAuB;IAE3C,YAAY,EAAE,kBAAkB;IAChC,UAAU,EAAE,gBAAgB;IAC5B,YAAY,EAAE,kBAAkB;IAChC,YAAY,EAAE,kBAAkB;IAEhC,qBAAqB,EAAE,2BAA2B;IAClD,uBAAuB,EAAE,6BAA6B;IAEtD,cAAc,EAAE,oBAAoB;IACpC,YAAY,EAAE,kBAAkB;IAChC,cAAc,EAAE,oBAAoB;IACpC,cAAc,EAAE,oBAAoB;IAEpC,eAAe,EAAE,qBAAqB;IACtC,aAAa,EAAE,mBAAmB;IAClC,eAAe,EAAE,qBAAqB;IACtC,eAAe,EAAE,qBAAqB;IAEtC,cAAc,EAAE,oBAAoB;IACpC,YAAY,EAAE,kBAAkB;IAChC,cAAc,EAAE,oBAAoB;IACpC,cAAc,EAAE,oBAAoB;IAEpC,YAAY,EAAE,kBAAkB;IAChC,UAAU,EAAE,gBAAgB;IAC5B,YAAY,EAAE,kBAAkB;IAChC,YAAY,EAAE,kBAAkB;IAEhC,kBAAkB,EAAE,wBAAwB;IAC5C,oBAAoB,EAAE,0BAA0B;IAChD,oBAAoB,EAAE,0BAA0B;IAChD,oBAAoB,EAAE,0BAA0B;IAEhD,eAAe,EAAE,qBAAqB;IACtC,oBAAoB,EAAE,0BAA0B;CACjD,CAAC;AAEF,MAAM,eAAe,GAA2B;IAC9C,MAAM,EAAE,OAAO;CAChB,CAAC;AAEF,MAAM,iBAAiB,GAAG,4CAA4C,CAAC;AACvE,MAAM,aAAa,GAAG,gCAAgC,CAAC;AAEvD,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,OAAe,EAAU,EAAE;IACnE,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxC,OAAO,iBAAiB,GAAG,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACpC,OAAO,aAAa,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,gBAAgB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;AAC9C,CAAC,CAAC;AAEF,kFAAkF;AAC3E,MAAM,iBAAiB,GAAG,CAAC,KAAqB,EAAuB,EAAE,CAC9E,IAAI,mBAAmB,CACrB;IACE,MAAM,EAAE,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG;IACxD,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;IACtD,IAAI,EAAE,KAAK,CAAC,IAAI;CACjB,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;AATS,QAAA,iBAAiB,qBAS1B;AAEJ;;;;GAIG;AACI,MAAM,eAAe,GAAG,CAC7B,KAAmB,EACnB,OAAO,GAAG,KAAK,CAAC,OAAO,EACF,EAAE,CACvB,IAAI,mBAAmB,CACrB;IACE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG;IAC3B,KAAK,EAAE,eAAe;IACtB,OAAO;CACR,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;AAXS,QAAA,eAAe,mBAWxB;AAEJ;;;;GAIG;AACI,MAAM,YAAY,GAAG,CAAC,KAAgB,EAAuB,EAAE,CACpE,IAAI,mBAAmB,CACrB;IACE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG;IAC3B,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;CACvB,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;AARS,QAAA,YAAY,gBAQrB"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from './client';
 export * from './auth';
+export * from './auth-client';
 export * from './errors';
 export * from './validators';
 export * from './transforms';
@@ -10,3 +11,4 @@ export * from './supporting-files';
 export * from './clients';
 export * from './projects';
 export * from './tasks';
+export * from './pricebooks';

package/dist/index.js

@@ -16,6 +16,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./client"), exports);
 __exportStar(require("./auth"), exports);
+__exportStar(require("./auth-client"), exports);
 __exportStar(require("./errors"), exports);
 __exportStar(require("./validators"), exports);
 __exportStar(require("./transforms"), exports);
@@ -26,4 +27,5 @@ __exportStar(require("./supporting-files"), exports);
 __exportStar(require("./clients"), exports);
 __exportStar(require("./projects"), exports);
 __exportStar(require("./tasks"), exports);
+__exportStar(require("./pricebooks"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,yCAAuB;AACvB,2CAAyB;AACzB,+CAA6B;AAC7B,+CAA6B;AAC7B,6CAA2B;AAC3B,uDAAqC;AACrC,0CAAwB;AACxB,qDAAmC;AACnC,4CAA0B;AAC1B,6CAA2B;AAC3B,0CAAwB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,yCAAuB;AACvB,gDAA8B;AAC9B,2CAAyB;AACzB,+CAA6B;AAC7B,+CAA6B;AAC7B,6CAA2B;AAC3B,uDAAqC;AACrC,0CAAwB;AACxB,qDAAmC;AACnC,4CAA0B;AAC1B,6CAA2B;AAC3B,0CAAwB;AACxB,+CAA6B"}

package/dist/nest/index.d.ts

@@ -7,3 +7,8 @@ import { SupabaseClientError } from '../errors';
  */
 export declare const toHttpException: (error: SupabaseClientError) => HttpException;
 export declare const SupabaseUserClient: (...dataOrPipes: unknown[]) => ParameterDecorator;
+/**
+ * A `SupabaseAuthClient` for routes a logged-out caller hits (sign-in, refresh, password
+ * reset) — built from the publishable key alone, with no bearer token involved.
+ */
+export declare const SupabasePublicClient: (...dataOrPipes: any[]) => ParameterDecorator;

package/dist/nest/index.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SupabaseUserClient = exports.toHttpException = void 0;
+exports.SupabasePublicClient = exports.SupabaseUserClient = exports.toHttpException = void 0;
 const common_1 = require("@nestjs/common");
+const auth_client_1 = require("../auth-client");
 const client_1 = require("../client");
 const errors_1 = require("../errors");
 /**
@@ -44,4 +45,12 @@ exports.SupabaseUserClient = (0, common_1.createParamDecorator)((_, ctx) => {
         throw error;
     }
 });
+/**
+ * A `SupabaseAuthClient` for routes a logged-out caller hits (sign-in, refresh, password
+ * reset) — built from the publishable key alone, with no bearer token involved.
+ */
+exports.SupabasePublicClient = (0, common_1.createParamDecorator)(() => (0, auth_client_1.createSupabaseAuthClient)({
+    url: getEnvOrThrow('SUPABASE_URL'),
+    key: getEnvOrThrow('SUPABASE_PUBLISHABLE_KEY'),
+}));
 //# sourceMappingURL=index.js.map

package/dist/nest/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nest/index.ts"],"names":[],"mappings":";;;AAAA,2CAMwB;AAExB,sCAAsE;AACtE,sCAAgD;AAEhD;;;;GAIG;AACI,MAAM,eAAe,GAAG,CAAC,KAA0B,EAAiB,EAAE,CAC3E,IAAI,sBAAa,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAD3D,QAAA,eAAe,mBAC4C;AAExE,MAAM,aAAa,GAAG,CAAC,GAAgD,EAAU,EAAE;IACjF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,qCAA4B,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAU,EAAE;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;IACzE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACjD,MAAM,IAAI,8BAAqB,CAAC,4CAA4C,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEW,QAAA,kBAAkB,GAAG,IAAA,6BAAoB,EACpD,CAAC,CAAU,EAAE,GAAqB,EAAkB,EAAE;IACpD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,IAAA,6BAAoB,EAAC;YAC1B,GAAG,EAAE,aAAa,CAAC,cAAc,CAAC;YAClC,GAAG,EAAE,aAAa,CAAC,0BAA0B,CAAC;YAC9C,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+EAA+E;QAC/E,qCAAqC;QACrC,IAAI,KAAK,YAAY,4BAAmB;YAAE,MAAM,IAAA,uBAAe,EAAC,KAAK,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nest/index.ts"],"names":[],"mappings":";;;AAAA,2CAMwB;AAExB,gDAAmF;AACnF,sCAAsE;AACtE,sCAAgD;AAEhD;;;;GAIG;AACI,MAAM,eAAe,GAAG,CAAC,KAA0B,EAAiB,EAAE,CAC3E,IAAI,sBAAa,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAD3D,QAAA,eAAe,mBAC4C;AAExE,MAAM,aAAa,GAAG,CAAC,GAAgD,EAAU,EAAE;IACjF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,qCAA4B,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAU,EAAE;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;IACzE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACjD,MAAM,IAAI,8BAAqB,CAAC,4CAA4C,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEW,QAAA,kBAAkB,GAAG,IAAA,6BAAoB,EACpD,CAAC,CAAU,EAAE,GAAqB,EAAkB,EAAE;IACpD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,IAAA,6BAAoB,EAAC;YAC1B,GAAG,EAAE,aAAa,CAAC,cAAc,CAAC;YAClC,GAAG,EAAE,aAAa,CAAC,0BAA0B,CAAC;YAC9C,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+EAA+E;QAC/E,qCAAqC;QACrC,IAAI,KAAK,YAAY,4BAAmB;YAAE,MAAM,IAAA,uBAAe,EAAC,KAAK,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CACF,CAAC;AAEF;;;GAGG;AACU,QAAA,oBAAoB,GAAG,IAAA,6BAAoB,EACtD,GAAuB,EAAE,CACvB,IAAA,sCAAwB,EAAC;IACvB,GAAG,EAAE,aAAa,CAAC,cAAc,CAAC;IAClC,GAAG,EAAE,aAAa,CAAC,0BAA0B,CAAC;CAC/C,CAAC,CACL,CAAC"}

package/dist/pricebooks/index.d.ts

@@ -0,0 +1,19 @@
+import type { SupabaseClient as SupabaseJsClient } from '@supabase/supabase-js';
+import type { PricebookWithModules } from '@managemint-solutions/entities/modules';
+/**
+ * The public price catalog. `pricebooks`, `pricebook_modules` and `billing_modules` are readable
+ * by `anon` by design — unauthenticated signup prices against them — so this resource takes no
+ * auth context and scopes by nothing.
+ */
+export declare class PricebooksResource {
+    private readonly supabase;
+    constructor(supabase: SupabaseJsClient);
+    getActive(): Promise<PricebookWithModules>;
+    getById(pricebookId: string): Promise<PricebookWithModules>;
+}
+/**
+ * What the given modules cost per month, in minor units: every module's unit price summed and
+ * multiplied by the seat count. A module the pricebook does not price is a 400 — the caller
+ * asked for something that cannot be billed.
+ */
+export declare const monthlyTotalMinor: (pricebook: PricebookWithModules, moduleKeys: string[], seatCount: number) => number;

package/dist/pricebooks/index.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.monthlyTotalMinor = exports.PricebooksResource = void 0;
+const errors_1 = require("../errors");
+// The public contract is PricebookWithModules from @managemint-solutions/entities; the row
+// types below only declare the shape this select string produces (the columns are defined in
+// the api's supabase/migrations).
+const PRICEBOOK_SELECT = `
+  mms_id,
+  name,
+  description,
+  active,
+  pricebook_modules (
+    module_id,
+    unit_amount_minor,
+    currency,
+    billing_modules (
+      module_key
+    )
+  )
+`;
+// A pricebook_modules row whose catalog entry did not come back leaves `module_key` undefined —
+// the cast keeps the mapping honest about that rather than inventing a key.
+const toPricebookWithModules = (row) => ({
+    mms_id: row.mms_id,
+    name: row.name,
+    active: row.active,
+    description: row.description,
+    modules: (row.pricebook_modules || []).map((pricedModule) => ({
+        module_id: pricedModule.module_id,
+        module_key: pricedModule.billing_modules?.module_key,
+        unit_amount_minor: pricedModule.unit_amount_minor,
+        currency: pricedModule.currency,
+    })),
+});
+/**
+ * The public price catalog. `pricebooks`, `pricebook_modules` and `billing_modules` are readable
+ * by `anon` by design — unauthenticated signup prices against them — so this resource takes no
+ * auth context and scopes by nothing.
+ */
+class PricebooksResource {
+    supabase;
+    constructor(supabase) {
+        this.supabase = supabase;
+    }
+    async getActive() {
+        const { data, error } = await this.supabase
+            .from('pricebooks')
+            .select(PRICEBOOK_SELECT)
+            .eq('active', true)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return toPricebookWithModules(data);
+    }
+    async getById(pricebookId) {
+        const { data, error } = await this.supabase
+            .from('pricebooks')
+            .select(PRICEBOOK_SELECT)
+            .eq('mms_id', pricebookId)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return toPricebookWithModules(data);
+    }
+}
+exports.PricebooksResource = PricebooksResource;
+/**
+ * What the given modules cost per month, in minor units: every module's unit price summed and
+ * multiplied by the seat count. A module the pricebook does not price is a 400 — the caller
+ * asked for something that cannot be billed.
+ */
+const monthlyTotalMinor = (pricebook, moduleKeys, seatCount) => {
+    const total = moduleKeys.reduce((sum, moduleKey) => {
+        const pricedModule = pricebook.modules.find((module) => module.module_key === moduleKey);
+        if (!pricedModule) {
+            throw new errors_1.SupabaseClientError({
+                status: 400,
+                error: 'Pricing Error',
+                message: `Module ${moduleKey} is not priced by pricebook ${pricebook.name}`,
+            });
+        }
+        return sum + pricedModule.unit_amount_minor;
+    }, 0);
+    return total * seatCount;
+};
+exports.monthlyTotalMinor = monthlyTotalMinor;
+//# sourceMappingURL=index.js.map

package/dist/pricebooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pricebooks/index.ts"],"names":[],"mappings":";;;AAEA,sCAAmE;AAEnE,2FAA2F;AAC3F,6FAA6F;AAC7F,kCAAkC;AAClC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;CAaf,CAAC;AAoBX,gGAAgG;AAChG,4EAA4E;AAC5E,MAAM,sBAAsB,GAAG,CAAC,GAAiB,EAAwB,EAAE,CAAC,CAAC;IAC3E,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,WAAW,EAAE,GAAG,CAAC,WAAW;IAC5B,OAAO,EAAE,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC5D,SAAS,EAAE,YAAY,CAAC,SAAS;QACjC,UAAU,EAAE,YAAY,CAAC,eAAe,EAAE,UAAU;QACpD,iBAAiB,EAAE,YAAY,CAAC,iBAAiB;QACjD,QAAQ,EAAE,YAAY,CAAC,QAAQ;KAChC,CAAC,CAAmB;CACtB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAa,kBAAkB;IACA;IAA7B,YAA6B,QAA0B;QAA1B,aAAQ,GAAR,QAAQ,CAAkB;IAAG,CAAC;IAE3D,KAAK,CAAC,SAAS;QACb,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,YAAY,CAAC;aAClB,MAAM,CAAC,gBAAgB,CAAC;aACxB,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;aAClB,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,sBAAsB,CAAC,IAA+B,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,WAAmB;QAC/B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,YAAY,CAAC;aAClB,MAAM,CAAC,gBAAgB,CAAC;aACxB,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;aACzB,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,sBAAsB,CAAC,IAA+B,CAAC,CAAC;IACjE,CAAC;CACF;AAtBD,gDAsBC;AAED;;;;GAIG;AACI,MAAM,iBAAiB,GAAG,CAC/B,SAA+B,EAC/B,UAAoB,EACpB,SAAiB,EACT,EAAE;IACV,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;QACjD,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;QAEzF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,4BAAmB,CAAC;gBAC5B,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,UAAU,SAAS,+BAA+B,SAAS,CAAC,IAAI,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,OAAO,GAAG,GAAG,YAAY,CAAC,iBAAiB,CAAC;IAC9C,CAAC,EAAE,CAAC,CAAC,CAAC;IAEN,OAAO,KAAK,GAAG,SAAS,CAAC;AAC3B,CAAC,CAAC;AApBW,QAAA,iBAAiB,qBAoB5B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@managemint-solutions/sdk",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Typed Supabase data-access SDK for ManageMint Solutions",
   "license": "UNLICENSED",
   "author": "Scott Bebington <scottbebington@gmail.com>",