@motherbase/client 1.2.4 → 1.2.7

package/dist/index.d.ts

@@ -4,15 +4,30 @@ import { StorageClient } from './storage.js';
 import { FunctionsClient } from './functions.js';
 import { RealtimeModule } from './realtime.js';
 import { RealtimeChannel, type RealtimeChannelOptions } from './channel.js';
-import { PostgrestQueryBuilder } from './postgrest.js';
+import type { PostgrestCount, PostgrestResponse } from './postgrest.js';
 import type { ClientOptions } from './types.js';
+/** Options for `client.rpc(fn, args, options)`, mirroring supabase-js. */
+export interface RpcOptions {
+    /** Send the request as HEAD: no rows, only the count. */
+    head?: boolean;
+    /** Use the read-only GET form, with the arguments as query parameters. */
+    get?: boolean;
+    count?: PostgrestCount;
+}
+import type { DefaultSchemaName, FunctionArgs, FunctionName, FunctionReturns, GenericDatabase, GenericSchema, InsertOf, RelationName, RowOf, SchemaOf, TypedQuery, UpdateOf } from './database.js';
 /**
  * Supabase-js-compatible client for a Motherbase backend.
  *
  * Drop-in shaped: `client.from(table).select()…`, `client.auth.signInWithPassword()`,
  * `client.storage.from(bucket)`, `client.channel(name)`, `client.functions.invoke()`.
+ *
+ * Pass the type generated by `motherbase gen types typescript` to get real
+ * inference: `createClient<Database>(url, key)` then types every row, rejects
+ * unknown columns in `.select()`, checks `.insert()` payloads against the
+ * Insert shape and types `.rpc()` from `Functions`. Without it the client
+ * behaves exactly as it did before generics existed.
  */
-export declare class MotherbaseClient {
+export declare class MotherbaseClient<Database = GenericDatabase, SchemaName = DefaultSchemaName<Database>, Schema extends GenericSchema = SchemaOf<Database, SchemaName>> {
     private readonly url;
     /** Accepted for supabase-js signature parity; sent as an `apikey` header when set. */
     readonly key?: string | undefined;
@@ -27,8 +42,29 @@ export declare class MotherbaseClient {
     constructor(url: string, 
     /** Accepted for supabase-js signature parity; sent as an `apikey` header when set. */
     key?: string | undefined, options?: ClientOptions);
-    /** Start a PostgREST-style query against a table. */
-    from<Row extends object = Record<string, unknown>>(table: string): PostgrestQueryBuilder<Row>;
+    /**
+     * Start a PostgREST-style query against a table or view.
+     *
+     * The first overload is the typed path: with a generated `Database` the
+     * relation name is checked and the row/insert/update types come from it.
+     * The second keeps the pre-generics form (`from<MyRow>('t')`) working; its
+     * `never` default makes the parameter unusable unless `Row` is passed
+     * explicitly, so a bare `from('typo')` still has to satisfy the first
+     * overload rather than silently falling through to an unchecked one.
+     */
+    from<Name extends RelationName<Schema>>(table: Name): TypedQuery<RowOf<Schema, Name>, InsertOf<Schema, Name>, UpdateOf<Schema, Name>>;
+    from<Row extends object = never>(table: [Row] extends [never] ? never : string): TypedQuery<Row, Partial<Row>, Partial<Row>>;
+    /**
+     * Call a database function, typed from the generated `Functions` map.
+     *
+     * The transport is `POST /rest/v1/rpc/<fn>`, which the REST layer gains in
+     * Phase 2.8. The typing is independent of that work: it reads only the
+     * generated `Database`, so it is correct the moment the route exists.
+     *
+     * `get` and `head` switch to the read-only forms, which carry their arguments
+     * as query parameters rather than as a body, exactly as supabase-js does.
+     */
+    rpc<Name extends FunctionName<Schema>>(fn: Name, args?: FunctionArgs<Schema, Name>, options?: RpcOptions): Promise<PostgrestResponse<FunctionReturns<Schema, Name>>>;
     /** Create (or reuse) a realtime channel. */
     channel(name: string, opts?: RealtimeChannelOptions): RealtimeChannel;
     /** Unsubscribe and drop a channel. */
@@ -44,14 +80,25 @@ export declare class MotherbaseClient {
  * @param url  Backend API base URL.
  * @param key  Anon/publishable key (optional). Sent as an `apikey` header.
  * @param options  Session storage, fetch override, extra headers.
+ *
+ * @example
+ * ```ts
+ * import type { Database } from './database.types'
+ * const client = createClient<Database>(url, anonKey)
+ * ```
  */
-export declare function createClient(url: string, key?: string, options?: ClientOptions): MotherbaseClient;
+export declare function createClient<Database = GenericDatabase, SchemaName = DefaultSchemaName<Database>, Schema extends GenericSchema = SchemaOf<Database, SchemaName>>(url: string, key?: string, options?: ClientOptions): MotherbaseClient<Database, SchemaName, Schema>;
 export { BackendError } from './http.js';
 export { memoryStorage, localStorageStorage };
 export { cookieStorage, serverCookieStorage } from './cookie.js';
 export { PostgrestQueryBuilder } from './postgrest.js';
-export type { PostgrestSingleBuilder } from './postgrest.js';
+export type { PostgrestSingleBuilder, PostgrestTextBuilder, PostgrestExplainBuilder, PostgrestResponse, PostgrestPrimitive, PostgrestArrayOperand, PostgrestFilterOperator, PostgrestIsValue, PostgrestCount, TextSearchType, ReferencedTableOption, OrderOptions, SelectOptions, InsertOptions, UpsertOptions, MutateOptions, ExplainOptions, } from './postgrest.js';
+export type { GenericDatabase, GenericSchema, GenericTable, GenericView, GenericFunction, DefaultSchemaName, SchemaOf, Relations, RelationName, RowOf, InsertOf, UpdateOf, FunctionName, FunctionArgs, FunctionReturns, TypedQuery, TypedSingleQuery, SelectResult, ValidateSelect, UnknownSelectColumns, EmbeddedSelectSeam, ColumnName, FilterValue, } from './database.js';
 export { AuthClient } from './auth.js';
+export { MfaClient } from './mfa.js';
+export { AuthAdminClient } from './admin.js';
+export type { AdminListUsersParams, AdminUserList, AdminCreateUserParams, AdminCreatedUser, AdminUpdateUserParams, } from './admin.js';
+export type { MfaFactor, MfaEnrollResponse, MfaChallengeResponse } from './mfa.js';
 export type { SignUpCredentials, SignInWithPasswordCredentials, SignInWithOtpCredentials, VerifyOtpParams, SignInWithOAuthCredentials, UpdateUserAttributes, DeleteUserAttributes, Subscription, } from './auth.js';
 export { StorageClient, StorageBucket } from './storage.js';
 export type { UploadOptions, UploadResult } from './storage.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;GAKG;AACH,qBAAa,gBAAgB;IAYzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,sFAAsF;IACtF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAbvB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAElC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;gBAG5C,GAAG,EAAE,MAAM;IAC5B,sFAAsF;IAC7E,GAAG,CAAC,EAAE,MAAM,YAAA,EACrB,OAAO,GAAE,aAAkB;IA4B7B,qDAAqD;IACrD,IAAI,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC;IAI7F,4CAA4C;IAC5C,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,sBAA2B,GAAG,eAAe;IAQzE,sCAAsC;IAChC,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5D,0CAA0C;IACpC,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAMxC,6EAA6E;IAC7E,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;CAG5B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,gBAAgB,CAErG;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,YAAY,EACV,iBAAiB,EACjB,6BAA6B,EAC7B,wBAAwB,EACxB,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7E,YAAY,EACV,WAAW,EACX,IAAI,EACJ,MAAM,EACN,OAAO,EACP,UAAU,EACV,cAAc,EACd,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,EACX,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,UAAU,GACX,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE5E,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,0EAA0E;IAC1E,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AACD,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,eAAe,EACf,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,KAAK,EACL,QAAQ,EACR,UAAU,EACV,QAAQ,EACT,MAAM,eAAe,CAAC;AAEvB;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB,CAC3B,QAAQ,GAAG,eAAe,EAC1B,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,EACxC,MAAM,SAAS,aAAa,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAa3D,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,sFAAsF;IACtF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAbvB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAElC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;gBAG5C,GAAG,EAAE,MAAM;IAC5B,sFAAsF;IAC7E,GAAG,CAAC,EAAE,MAAM,YAAA,EACrB,OAAO,GAAE,aAAkB;IA6C7B;;;;;;;;;OASG;IACH,IAAI,CAAC,IAAI,SAAS,YAAY,CAAC,MAAM,CAAC,EACpC,KAAK,EAAE,IAAI,GACV,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC,GAAG,SAAS,MAAM,GAAG,KAAK,EAC7B,KAAK,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,MAAM,GAC5C,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAK9C;;;;;;;;;OASG;IACG,GAAG,CAAC,IAAI,SAAS,YAAY,CAAC,MAAM,CAAC,EACzC,EAAE,EAAE,IAAI,EACR,IAAI,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,EACjC,OAAO,GAAE,UAAe,GACvB,OAAO,CAAC,iBAAiB,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IA4B5D,4CAA4C;IAC5C,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,sBAA2B,GAAG,eAAe;IAQzE,sCAAsC;IAChC,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5D,0CAA0C;IACpC,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAMxC,6EAA6E;IAC7E,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;CAG5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,GAAG,eAAe,EAC1B,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,EACxC,MAAM,SAAS,aAAa,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,EAC7D,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAExG;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EACV,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,eAAe,EACf,aAAa,EACb,YAAY,EACZ,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACnF,YAAY,EACV,iBAAiB,EACjB,6BAA6B,EAC7B,wBAAwB,EACxB,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7E,YAAY,EACV,WAAW,EACX,IAAI,EACJ,MAAM,EACN,OAAO,EACP,UAAU,EACV,cAAc,EACd,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,EACX,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,UAAU,GACX,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,4 +1,5 @@
-import { HttpClient } from './http.js';
+import { HttpClient, toError } from './http.js';
+import { contractPath } from '@motherbase/contracts';
 import { SessionStore, memoryStorage, localStorageStorage } from './session.js';
 import { AuthClient } from './auth.js';
 import { StorageClient } from './storage.js';
@@ -11,6 +12,12 @@ import { PostgrestQueryBuilder } from './postgrest.js';
  *
  * Drop-in shaped: `client.from(table).select()…`, `client.auth.signInWithPassword()`,
  * `client.storage.from(bucket)`, `client.channel(name)`, `client.functions.invoke()`.
+ *
+ * Pass the type generated by `motherbase gen types typescript` to get real
+ * inference: `createClient<Database>(url, key)` then types every row, rejects
+ * unknown columns in `.select()`, checks `.insert()` payloads against the
+ * Insert shape and types `.rpc()` from `Functions`. Without it the client
+ * behaves exactly as it did before generics existed.
  */
 export class MotherbaseClient {
     constructor(url, 
@@ -31,9 +38,23 @@ export class MotherbaseClient {
         const headers = { ...options.headers };
         if (key)
             headers['apikey'] = key;
+        // A secret key runs every request as service_role, which bypasses row level
+        // security. In a browser it is readable by anyone who opens devtools, so it
+        // is not "a key that leaked", it is the whole database published. Warn
+        // rather than throw: a legitimate caller may run in a runtime that defines
+        // `window` (a test harness, an Electron main process), and refusing to
+        // construct would break them for a heuristic.
+        if (key?.startsWith('mb_secret_') && typeof window !== 'undefined') {
+            console.warn('[motherbase] A secret API key was passed to createClient in a browser context. '
+                + 'Secret keys bypass row level security and must stay server side. '
+                + 'Use the publishable key here.');
+        }
         this.store = new SessionStore(options.storage ?? memoryStorage());
         // auth needs the http client, and http needs auth._refresh for the 401 path,
         // so wire them in two steps with a late-bound refresh callback.
+        // prefer-const cannot see the closure above: `auth` is read by the refresh
+        // callback before this line's assignment happens, so it has to be a `let`.
+        // eslint-disable-next-line prefer-const
         let auth;
         this.http = new HttpClient(url, this.store, { autoRefresh, fetch: fetchImpl, headers }, () => auth._refresh());
         auth = new AuthClient(this.http, this.store);
@@ -42,10 +63,47 @@ export class MotherbaseClient {
         this.functions = new FunctionsClient(this.http);
         this.realtime = new RealtimeModule(url, this.store, fetchImpl, options.realtimeIoFactory);
     }
-    /** Start a PostgREST-style query against a table. */
     from(table) {
         return new PostgrestQueryBuilder(this.http, table);
     }
+    /**
+     * Call a database function, typed from the generated `Functions` map.
+     *
+     * The transport is `POST /rest/v1/rpc/<fn>`, which the REST layer gains in
+     * Phase 2.8. The typing is independent of that work: it reads only the
+     * generated `Database`, so it is correct the moment the route exists.
+     *
+     * `get` and `head` switch to the read-only forms, which carry their arguments
+     * as query parameters rather than as a body, exactly as supabase-js does.
+     */
+    async rpc(fn, args, options = {}) {
+        try {
+            const method = options.head ? 'HEAD' : options.get ? 'GET' : 'POST';
+            const params = new URLSearchParams();
+            if (method !== 'POST') {
+                for (const [name, value] of Object.entries((args ?? {}))) {
+                    if (value === undefined)
+                        continue;
+                    params.append(name, Array.isArray(value) ? `{${value.join(',')}}` : String(value));
+                }
+            }
+            const query = params.toString();
+            const path = `${contractPath.rest('rpc')}/${encodeURIComponent(fn)}${query ? `?${query}` : ''}`;
+            const headers = options.count ? { Prefer: `count=${options.count}` } : undefined;
+            const result = await this.http.requestWithHeaders(path, {
+                method,
+                body: method === 'POST' ? (args ?? {}) : undefined,
+                headers,
+            });
+            const range = result.headers.get('content-range');
+            const total = range?.split('/')[1];
+            const count = total && total !== '*' && Number.isFinite(Number(total)) ? Number(total) : null;
+            return { data: options.head ? null : result.data, error: null, count };
+        }
+        catch (err) {
+            return { data: null, error: toError(err), count: null };
+        }
+    }
     /** Create (or reuse) a realtime channel. */
     channel(name, opts = {}) {
         const existing = this.channels.get(name);
@@ -78,6 +136,12 @@ export class MotherbaseClient {
  * @param url  Backend API base URL.
  * @param key  Anon/publishable key (optional). Sent as an `apikey` header.
  * @param options  Session storage, fetch override, extra headers.
+ *
+ * @example
+ * ```ts
+ * import type { Database } from './database.types'
+ * const client = createClient<Database>(url, anonKey)
+ * ```
  */
 export function createClient(url, key, options = {}) {
     return new MotherbaseClient(url, key, options);
@@ -87,6 +151,8 @@ export { memoryStorage, localStorageStorage };
 export { cookieStorage, serverCookieStorage } from './cookie.js';
 export { PostgrestQueryBuilder } from './postgrest.js';
 export { AuthClient } from './auth.js';
+export { MfaClient } from './mfa.js';
+export { AuthAdminClient } from './admin.js';
 export { StorageClient, StorageBucket } from './storage.js';
 export { FunctionsClient } from './functions.js';
 export { RealtimeChannel } from './channel.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAA+B,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IAW3B,YACmB,GAAW;IAC5B,sFAAsF;IAC7E,GAAY,EACrB,UAAyB,EAAE;QAHV,QAAG,GAAH,GAAG,CAAQ;QAEnB,QAAG,GAAH,GAAG,CAAS;QALN,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;QAQ7D,0EAA0E;QAC1E,yEAAyE;QACzE,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;QAChD,MAAM,OAAO,GAA2B,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/D,IAAI,GAAG;YAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;QAEjC,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC,CAAC;QAElE,6EAA6E;QAC7E,gEAAgE;QAChE,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/G,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAE7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5F,CAAC;IAED,qDAAqD;IACrD,IAAI,CAA+C,KAAa;QAC9D,OAAO,IAAI,qBAAqB,CAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,4CAA4C;IAC5C,OAAO,CAAC,IAAY,EAAE,OAA+B,EAAE;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,aAAa,CAAC,OAAwB;QAC1C,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,iBAAiB;QACrB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAY,EAAE,UAAyB,EAAE;IACjF,OAAO,IAAI,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAWvC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAA+B,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AA2BvD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAe3B,YACmB,GAAW;IAC5B,sFAAsF;IAC7E,GAAY,EACrB,UAAyB,EAAE;QAHV,QAAG,GAAH,GAAG,CAAQ;QAEnB,QAAG,GAAH,GAAG,CAAS;QALN,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;QAQ7D,0EAA0E;QAC1E,yEAAyE;QACzE,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;QAChD,MAAM,OAAO,GAA2B,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/D,IAAI,GAAG;YAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;QAEjC,4EAA4E;QAC5E,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,GAAG,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YACnE,OAAO,CAAC,IAAI,CACV,iFAAiF;kBAC7E,mEAAmE;kBACnE,+BAA+B,CACpC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC,CAAC;QAElE,6EAA6E;QAC7E,gEAAgE;QAChE,2EAA2E;QAC3E,2EAA2E;QAC3E,wCAAwC;QACxC,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/G,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAE7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5F,CAAC;IAkBD,IAAI,CAAC,KAAa;QAChB,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,CACP,EAAQ,EACR,IAAiC,EACjC,UAAsB,EAAE;QAExB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,EAAE,CAAC;oBACpF,IAAI,KAAK,KAAK,SAAS;wBAAE,SAAS;oBAClC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAChG,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAEjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAgC,IAAI,EAAE;gBACrF,MAAM;gBACN,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClD,OAAO;aACR,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9F,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,OAAO,CAAC,IAAY,EAAE,OAA+B,EAAE;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,aAAa,CAAC,OAAwB;QAC1C,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,iBAAiB;QACrB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAI1B,GAAW,EAAE,GAAY,EAAE,UAAyB,EAAE;IACtD,OAAO,IAAI,gBAAgB,CAA+B,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AA6CvD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAmB7C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/dist/mfa.d.ts

@@ -0,0 +1,109 @@
+import type { HttpClient } from './http.js';
+import type { MotherbaseResponse } from './types.js';
+/**
+ * Two-factor authentication, shaped like `supabase.auth.mfa`.
+ *
+ * The server has shipped TOTP with backup codes and trusted devices since the
+ * beginning; only the client namespace was missing, which meant the product's
+ * strongest auth feature could not be reached from the SDK that sells it.
+ *
+ * The mapping onto Better Auth is not one-to-one, and the differences are stated
+ * per method rather than papered over:
+ *
+ *   * A factor here is TOTP or nothing. Better Auth models two-factor as a
+ *     property of the user, not as a list of enrolled factors, so `listFactors`
+ *     reports the single TOTP factor rather than an arbitrary set, and there is
+ *     no phone factor to enrol.
+ *   * Enrolment needs the user's password. supabase-js does not ask for one;
+ *     Better Auth does, because enabling two-factor is a credential change.
+ *   * `challenge()` is a local no-op for TOTP: there is nothing to send, the
+ *     code is already on the user's device. It exists so the supabase-js
+ *     challenge/verify sequence compiles unchanged. For the email or SMS second
+ *     factor, `challenge()` does send a code.
+ */
+export interface MfaFactor {
+    id: string;
+    /** Always `totp` today. */
+    factor_type: 'totp';
+    status: 'verified' | 'unverified';
+    friendly_name?: string;
+}
+export interface MfaEnrollResponse {
+    id: string;
+    type: 'totp';
+    totp: {
+        /** otpauth:// URI to render as a QR code. */
+        uri: string;
+        /** The shared secret, for users who type it in by hand. */
+        secret: string;
+    };
+    /** One-time codes to store somewhere safe. Shown only at enrolment. */
+    backupCodes: string[];
+}
+export interface MfaChallengeResponse {
+    id: string;
+    expires_at: number | null;
+}
+export declare class MfaClient {
+    private readonly http;
+    /** Re-reads the session after a verify, so a stepped-up token is persisted. */
+    private readonly onVerified;
+    constructor(http: HttpClient, 
+    /** Re-reads the session after a verify, so a stepped-up token is persisted. */
+    onVerified: () => Promise<void>);
+    /**
+     * Start TOTP enrolment. Returns the otpauth URI, the secret and the backup
+     * codes. The factor is not usable until `verify()` accepts a code from it.
+     */
+    enroll(params: {
+        password: string;
+        issuer?: string;
+    }): Promise<MotherbaseResponse<MfaEnrollResponse>>;
+    /**
+     * For TOTP this resolves immediately and sends nothing: the code already lives
+     * on the user's device. Pass `channel` to send a second-factor code by email
+     * or SMS instead, when the project has that enabled.
+     */
+    challenge(params?: {
+        factorId?: string;
+        channel?: 'email' | 'sms';
+    }): Promise<MotherbaseResponse<MfaChallengeResponse>>;
+    /**
+     * Verify a code. `code` is a TOTP code by default; set `type` to `otp` for an
+     * emailed or texted second factor, or `backup` to spend a recovery code.
+     */
+    verify(params: {
+        code: string;
+        factorId?: string;
+        challengeId?: string;
+        type?: 'totp' | 'otp' | 'backup';
+        /** Remember this device for the project's configured trust window. */
+        trustDevice?: boolean;
+    }): Promise<MotherbaseResponse<{
+        verified: true;
+    }>>;
+    /** Turn two-factor off. Requires the password, as enabling did. */
+    unenroll(params: {
+        password: string;
+        factorId?: string;
+    }): Promise<MotherbaseResponse<{
+        id: string;
+    }>>;
+    /** Issue a fresh set of backup codes, invalidating the previous set. */
+    regenerateBackupCodes(params: {
+        password: string;
+    }): Promise<MotherbaseResponse<{
+        backupCodes: string[];
+    }>>;
+    /**
+     * The user's factors. Reads the TOTP URI: getting one back means TOTP is
+     * enrolled, a failure means it is not. There is no list endpoint to call
+     * because there is no list, and inventing one client-side would be a lie about
+     * what the server models.
+     */
+    listFactors(): Promise<MotherbaseResponse<{
+        totp: MfaFactor[];
+        all: MfaFactor[];
+    }>>;
+}
+//# sourceMappingURL=mfa.d.ts.map

package/dist/mfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE;QACJ,6CAA6C;QAC7C,GAAG,EAAE,MAAM,CAAC;QACZ,2DAA2D;QAC3D,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,uEAAuE;IACvE,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAaD,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFV,IAAI,EAAE,UAAU;IACjC,+EAA+E;IAC9D,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAGlD;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IA6B3G;;;;OAIG;IACG,SAAS,CAAC,MAAM,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,GAAG,KAAK,CAAA;KAAO,GAAG,OAAO,CACrF,kBAAkB,CAAC,oBAAoB,CAAC,CACzC;IAYD;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;QACjC,sEAAsE;QACtE,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAmBnD,mEAAmE;IAC7D,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAS5G,wEAAwE;IAClE,qBAAqB,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAajH;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAAC,GAAG,EAAE,SAAS,EAAE,CAAA;KAAE,CAAC,CAAC;CAU1F"}

package/dist/mfa.js

@@ -0,0 +1,134 @@
+import { toError } from './http.js';
+const R = {
+    enable: '/api/auth/two-factor/enable',
+    disable: '/api/auth/two-factor/disable',
+    totpUri: '/api/auth/two-factor/get-totp-uri',
+    verifyTotp: '/api/auth/two-factor/verify-totp',
+    sendOtp: '/api/auth/two-factor/send-otp',
+    verifyOtp: '/api/auth/two-factor/verify-otp',
+    verifyBackupCode: '/api/auth/two-factor/verify-backup-code',
+    generateBackupCodes: '/api/auth/two-factor/generate-backup-codes',
+};
+export class MfaClient {
+    constructor(http, 
+    /** Re-reads the session after a verify, so a stepped-up token is persisted. */
+    onVerified) {
+        this.http = http;
+        this.onVerified = onVerified;
+    }
+    /**
+     * Start TOTP enrolment. Returns the otpauth URI, the secret and the backup
+     * codes. The factor is not usable until `verify()` accepts a code from it.
+     */
+    async enroll(params) {
+        try {
+            const payload = await this.http.request(R.enable, {
+                method: 'POST',
+                body: { password: params.password, ...(params.issuer ? { issuer: params.issuer } : {}) },
+                raw: true,
+            });
+            const uri = payload.totpURI ?? payload.totpUri ?? '';
+            return {
+                data: {
+                    // Better Auth has no per-factor id: the user is the factor. `totp` is
+                    // used as a stable handle so unenroll/challenge/verify have something
+                    // to take, matching the supabase-js shape.
+                    id: 'totp',
+                    type: 'totp',
+                    totp: { uri, secret: secretFromUri(uri) },
+                    backupCodes: payload.backupCodes ?? [],
+                },
+                error: null,
+            };
+        }
+        catch (err) {
+            return { data: null, error: toError(err) };
+        }
+    }
+    /**
+     * For TOTP this resolves immediately and sends nothing: the code already lives
+     * on the user's device. Pass `channel` to send a second-factor code by email
+     * or SMS instead, when the project has that enabled.
+     */
+    async challenge(params = {}) {
+        if (!params.channel) {
+            return { data: { id: params.factorId ?? 'totp', expires_at: null }, error: null };
+        }
+        try {
+            await this.http.request(R.sendOtp, { method: 'POST', body: {}, raw: true });
+            return { data: { id: params.factorId ?? 'otp', expires_at: null }, error: null };
+        }
+        catch (err) {
+            return { data: null, error: toError(err) };
+        }
+    }
+    /**
+     * Verify a code. `code` is a TOTP code by default; set `type` to `otp` for an
+     * emailed or texted second factor, or `backup` to spend a recovery code.
+     */
+    async verify(params) {
+        // All three routes take the code under the same key.
+        const route = params.type === 'backup' ? R.verifyBackupCode : params.type === 'otp' ? R.verifyOtp : R.verifyTotp;
+        try {
+            await this.http.request(route, {
+                method: 'POST',
+                body: { code: params.code, ...(params.trustDevice ? { trustDevice: true } : {}) },
+                raw: true,
+            });
+            // Verification can hand back a stepped-up session; adopt it before the
+            // caller makes its next request with the old one.
+            await this.onVerified();
+            return { data: { verified: true }, error: null };
+        }
+        catch (err) {
+            return { data: null, error: toError(err) };
+        }
+    }
+    /** Turn two-factor off. Requires the password, as enabling did. */
+    async unenroll(params) {
+        try {
+            await this.http.request(R.disable, { method: 'POST', body: { password: params.password }, raw: true });
+            return { data: { id: params.factorId ?? 'totp' }, error: null };
+        }
+        catch (err) {
+            return { data: null, error: toError(err) };
+        }
+    }
+    /** Issue a fresh set of backup codes, invalidating the previous set. */
+    async regenerateBackupCodes(params) {
+        try {
+            const payload = await this.http.request(R.generateBackupCodes, {
+                method: 'POST',
+                body: { password: params.password },
+                raw: true,
+            });
+            return { data: { backupCodes: payload.backupCodes ?? [] }, error: null };
+        }
+        catch (err) {
+            return { data: null, error: toError(err) };
+        }
+    }
+    /**
+     * The user's factors. Reads the TOTP URI: getting one back means TOTP is
+     * enrolled, a failure means it is not. There is no list endpoint to call
+     * because there is no list, and inventing one client-side would be a lie about
+     * what the server models.
+     */
+    async listFactors() {
+        try {
+            await this.http.request(R.totpUri, { method: 'POST', body: {}, raw: true });
+            const factor = { id: 'totp', factor_type: 'totp', status: 'verified', friendly_name: 'TOTP' };
+            return { data: { totp: [factor], all: [factor] }, error: null };
+        }
+        catch {
+            // Not enrolled is a normal state, not an error the caller should branch on.
+            return { data: { totp: [], all: [] }, error: null };
+        }
+    }
+}
+/** Pull the `secret` query parameter out of an otpauth:// URI. */
+function secretFromUri(uri) {
+    const match = /[?&]secret=([^&]+)/i.exec(uri);
+    return match ? decodeURIComponent(match[1]) : '';
+}
+//# sourceMappingURL=mfa.js.map

package/dist/mfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.js","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoDpC,MAAM,CAAC,GAAG;IACR,MAAM,EAAE,6BAA6B;IACrC,OAAO,EAAE,8BAA8B;IACvC,OAAO,EAAE,mCAAmC;IAC5C,UAAU,EAAE,kCAAkC;IAC9C,OAAO,EAAE,+BAA+B;IACxC,SAAS,EAAE,iCAAiC;IAC5C,gBAAgB,EAAE,yCAAyC;IAC3D,mBAAmB,EAAE,4CAA4C;CACzD,CAAC;AAEX,MAAM,OAAO,SAAS;IACpB,YACmB,IAAgB;IACjC,+EAA+E;IAC9D,UAA+B;QAF/B,SAAI,GAAJ,IAAI,CAAY;QAEhB,eAAU,GAAV,UAAU,CAAqB;IAC/C,CAAC;IAEJ;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAA6C;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAIpC,CAAC,CAAC,MAAM,EAAE;gBACX,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBACxF,GAAG,EAAE,IAAI;aACV,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YACrD,OAAO;gBACL,IAAI,EAAE;oBACJ,sEAAsE;oBACtE,sEAAsE;oBACtE,2CAA2C;oBAC3C,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE;oBACzC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;iBACvC;gBACD,KAAK,EAAE,IAAI;aACZ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,SAA2D,EAAE;QAG3E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAOZ;QACC,qDAAqD;QACrD,MAAM,KAAK,GACT,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACrG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBACjF,GAAG,EAAE,IAAI;aACV,CAAC,CAAC;YACH,uEAAuE;YACvE,kDAAkD;YAClD,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,QAAQ,CAAC,MAA+C;QAC5D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACvG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,qBAAqB,CAAC,MAA4B;QACtD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAA6B,CAAC,CAAC,mBAAmB,EAAE;gBACzF,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACnC,GAAG,EAAE,IAAI;aACV,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAc,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;YACzG,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;CACF;AAED,kEAAkE;AAClE,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC"}