@motherbase/client 1.2.8 → 1.4.0

package/README.md

@@ -10,14 +10,17 @@ import and the client factory, keep your queries. Every `supabase-js` data call
 in the contract suite is either supported or supported with a stated difference,
 including relational embedding (`select('*, author(*)')`), `.rpc()`, native
 `upsert`, `count`, `csv()`, the full filter set and PostgREST error codes.
-Auth and realtime are close, with named gaps (no PKCE code exchange, no `mfa`
-namespace on the client, no private channels).
+Auth and realtime are close, with named gaps (no PKCE code exchange, no
+`generateLink`, no private channels). Two-factor (`client.auth.mfa.*`), SSO,
+linked identities and secret-key user administration (`client.auth.admin.*`) are
+all here.
 
 **Storage is path-addressed too**: `upload('avatars/123/pic.png')` then
 `download('avatars/123/pic.png')` round trips, `list(prefix)` works, and keys are
-traversal-checked. Still missing there: `move`, `copy`, batch signed URLs and
-image transforms, and authorization is ownership plus bucket tokens rather than
-RLS policies on the objects table. See
+traversal-checked. `copy`, `move`, `info`, `exists`, batch signed URLs and
+direct-to-storage signed uploads are supported; image transforms are not.
+Authorization is ownership plus bucket tokens by default, and real RLS policies on
+`storage.files` when the `storage.policies` setting is on. See
 [`docs/migrating-from-supabase.md`](../../docs/migrating-from-supabase.md).
 
 Do not plan a migration from the paragraph above. Plan it from
@@ -107,7 +110,8 @@ client.from(table).select(cols).limit(n, { referencedTable }).range(from, to).ab
 client.from(table).select(cols).or('a.eq.1,and(b.gt.2,c.is.null)')   // nests, as PostgREST does
 client.from(table).select(cols).not(col, 'eq', v).filter(col, 'isdistinct', v)
 client.from(table).select(cols).textSearch(col, q, { type: 'websearch', config: 'english' })
-client.from(table).select(cols).single() | .maybeSingle() | .returns<T>() | .csv() | .explain()
+client.from(table).select(cols).single() | .maybeSingle() | .returns<T>() | .csv() | .geojson() | .explain()
+client.from(table).update(v).eq(..).throwOnError() | .maxAffected(1) | .rollback()
 client.from(table).insert(row) | .insert([rowA, rowB], { defaultToNull: false })
 client.from(table).upsert(rows, { onConflict, ignoreDuplicates })
 client.from(table).update(values).eq(..)         // a filter is required
@@ -136,6 +140,7 @@ client.auth.signInWithPassword({ email, password })
 client.auth.signInWithOtp({ email })            // emails a code
 client.auth.verifyOtp({ email, token })         // completes the OTP sign-in
 client.auth.signInWithOAuth({ provider, options: { redirectTo, scopes, skipBrowserRedirect } })
+client.auth.getSessionFromUrl()                 // finishes the OAuth redirect, see below
 client.auth.resetPasswordForEmail(email)
 client.auth.resetPassword({ email, otp, password })
 client.auth.updateUser({ data, password, currentPassword })
@@ -146,6 +151,14 @@ client.auth.getSession()       // { data: { session } }, local only
 client.auth.refreshSession()
 client.auth.onAuthStateChange((event, session) => {})  // SIGNED_IN | SIGNED_OUT | TOKEN_REFRESHED
 client.auth.deleteUser({ password })            // self-service, needs the backend flow enabled
+client.auth.signInWithSSO({ domain | providerId | email })
+client.auth.signInWithIdToken({ provider, token, nonce })   // Apple / Google One Tap
+client.auth.getUserIdentities() | .linkIdentity({ provider }) | .unlinkIdentity({ provider, id })
+client.auth.getClaims()                         // { claims, token }, decoded from a minted JWT
+client.auth.startAutoRefresh(ms) | .stopAutoRefresh()
+client.auth.mfa.enroll({ password }) | .challenge({ channel }) | .verify({ code, type? })
+client.auth.mfa.listFactors() | .regenerateBackupCodes({ password }) | .unenroll({ password })
+client.auth.admin.*                             // secret key only: list/get/create/update/delete/signOut/invite
 
 // Storage → { data, error }. `path` is the object key inside the bucket, and it
 // round trips. The file id returned by upload still works anywhere a path does.
@@ -153,8 +166,14 @@ client.storage.from(bucket).upload(path, file, { visibility, upsert })
 client.storage.from(bucket).download(path)
 client.storage.from(bucket).remove([path])
 client.storage.from(bucket).list(prefix, { limit, offset, search, sortBy })
-client.storage.from(bucket).createSignedUrl(path, expiresIn)     // expiresIn is ignored
+client.storage.from(bucket).createSignedUrl(path, expiresIn)     // seconds, 1..604800
+client.storage.from(bucket).createSignedUrls([path], expiresIn)  // per-entry results
 client.storage.from(bucket).getPublicUrl(path)                   // sync
+client.storage.from(bucket).update(path, file)                   // upload with upsert on
+client.storage.from(bucket).copy(from, to, { upsert }) | .move(from, to, { upsert })
+client.storage.from(bucket).info(path) | .exists(path)           // 404 reads as false
+client.storage.from(bucket).createSignedUploadUrl(path, { size, contentType })  // S3 driver
+client.storage.from(bucket).uploadToSignedUrl(path, token, file)
 
 // Realtime
 client.channel(name, { config: { broadcast: { self, ack }, presence: { key } } })
@@ -166,10 +185,55 @@ channel.send({ type: 'broadcast', event, payload })
 channel.track(state); channel.untrack(); channel.presenceState()
 client.removeChannel(channel)
 
-// Edge functions → { data, error }
-client.functions.invoke(name, { body })
+// Edge functions → { data, error }. `error` is a FunctionsHttpError /
+// FunctionsFetchError instance, but invoke still resolves rather than throws.
+client.functions.invoke(name, { body, method, headers, auth })
 ```
 
+## Social sign-in (OAuth)
+
+A provider callback is a browser redirect, so it cannot answer the SDK with a
+session the way a password sign-in does. Two calls, not one:
+
+```ts
+// 1. Wherever the button lives. Navigates the browser to the backend, which
+//    redirects on to the provider.
+await client.auth.signInWithOAuth({
+  provider: 'google',
+  options: { redirectTo: 'https://app.example.com/auth/callback' },
+});
+
+// 2. On that page (or on app start). Reads the token the backend appended to
+//    the redirect, stores the session, and strips it from the address bar.
+const { data, error } = await client.auth.getSessionFromUrl();
+```
+
+`getSessionFromUrl()` resolves with a null session and no error when there is
+nothing to read, so calling it on every page load is safe.
+
+Step 1 is a full-page navigation, not a fetch. That is deliberate: the backend
+sets an OAuth state cookie there and re-checks it on the provider callback, and
+a cookie set on a cross-site fetch response is refused by Safari and Firefox and
+by Chrome in incognito. Navigating makes it a first-party cookie, so the flow
+works in every browser even when your app and your API are on different domains.
+If you are not using the SDK, point the button at the same URL:
+
+```
+https://<your-api>/api/auth/sign-in/social/google?callbackURL=https://app.example.com/auth/callback
+```
+
+`callbackURL` is validated against the trusted origins, so it has to be an
+origin you allowlisted.
+
+Two backend settings decide whether this works at all:
+
+- **Callback URL.** Studio, Authentication, Sign In / Providers shows the exact
+  URL to register in the provider's console.
+- **CORS allowed origins.** Studio, Authentication settings, Security · CORS.
+  If your app is served from a different origin than the API, that origin must
+  be listed. Otherwise the browser refuses the cookie the sign-in start sets,
+  and the provider callback comes back as `?error=state_mismatch`.
+
 ## Storage adapters
 
 | Runtime  | Adapter                                                       |

package/dist/auth.d.ts

@@ -2,7 +2,7 @@ import { MfaClient } from './mfa.js';
 import { AuthAdminClient } from './admin.js';
 import type { HttpClient } from './http.js';
 import type { SessionStore } from './session.js';
-import type { AuthChangeListener, MotherbaseResponse, Session, User } from './types.js';
+import type { AuthChangeListener, MotherbaseResponse, Session, User, UserIdentity } from './types.js';
 export interface SignUpCredentials {
     email: string;
     password: string;
@@ -14,14 +14,23 @@ export interface SignInWithPasswordCredentials {
     password: string;
 }
 export interface SignInWithOtpCredentials {
-    email: string;
+    email?: string;
+    /** E.164 phone number. Routes to the SMS one-time code flow instead. */
+    phone?: string;
 }
 export interface VerifyOtpParams {
-    email: string;
-    /** The OTP code sent to the email. Named `token` for supabase-js parity. */
+    email?: string;
+    /** E.164 phone number, when the code was sent by SMS. */
+    phone?: string;
+    /** The code that was sent. Named `token` for supabase-js parity. */
     token: string;
-    /** Accepted for supabase-js signature parity; only the email sign-in OTP flow is supported. */
-    type?: 'email';
+    /**
+     * supabase-js verification type. The channel actually follows the identifier
+     * you pass; this only disambiguates if both are present. `recovery` and
+     * `email_change` are not routed: use `resetPassword` for the first, and
+     * email changes are not supported.
+     */
+    type?: 'email' | 'sms' | 'phone_change' | 'recovery' | 'email_change' | 'signup';
 }
 export interface SignInWithOAuthCredentials {
     /** Social provider id, e.g. 'google' or 'apple'. Must be enabled on the backend. */
@@ -43,13 +52,25 @@ export interface DeleteUserAttributes {
     callbackURL?: string;
 }
 export interface UpdateUserAttributes {
-    /** New password. Requires `currentPassword` — the backend does not allow a
+    /** New password. Requires `currentPassword`. The backend does not allow a
      *  blind password change from an authenticated session. */
     password?: string;
     currentPassword?: string;
     /** Arbitrary profile fields (name, image, or any custom additional field). */
     data?: Record<string, unknown>;
 }
+/**
+ * Read the token an OAuth callback left in the URL fragment and return the URL
+ * with it removed, so a reload or a shared link cannot replay it.
+ *
+ * The provider callback cannot answer the SDK with a JSON body: it is a browser
+ * redirect. The backend therefore appends `#access_token=…` to the redirect it
+ * issues, the same implicit flow supabase-js reads. Exported for testing.
+ */
+export declare function readAccessTokenFromUrl(href: string): {
+    accessToken: string;
+    cleanedHref: string;
+} | null;
 export interface Subscription {
     unsubscribe(): void;
 }
@@ -72,6 +93,7 @@ export declare class AuthClient {
      * these with a publishable key is a 401, not a missing method.
      */
     readonly admin: AuthAdminClient;
+    private autoRefreshTimer;
     constructor(http: HttpClient, store: SessionStore);
     signUp(credentials: SignUpCredentials): Promise<MotherbaseResponse<{
         user: User | null;
@@ -97,12 +119,41 @@ export declare class AuthClient {
     }): Promise<{
         error: MotherbaseResponse<null>['error'];
     }>;
-    /** Send a one-time sign-in code by email. Pair with `verifyOtp` to complete sign-in. */
+    /**
+     * Send a one-time sign-in code, by email or by SMS. Pair with `verifyOtp` to
+     * complete the sign-in.
+     *
+     * `{ phone }` routes to the phone-number plugin, which the project has to
+     * have enabled with an SMS sender configured; without one the call resolves
+     * with the backend's error rather than pretending a code was sent.
+     */
     signInWithOtp(credentials: SignInWithOtpCredentials): Promise<{
         data: Record<string, never>;
         error: MotherbaseResponse<null>['error'];
     }>;
-    /** Complete a `signInWithOtp` sign-in using the code sent to the user's email. */
+    /**
+     * Send the one-time code again, supabase-js style.
+     *
+     * supabase-js names the flows `signup` (confirm a new address), `email_change`
+     * and `recovery`; Better Auth names them `email-verification` and
+     * `forget-password`. The mapping lives here so ported code keeps working.
+     * `sms` and `phone_change` re-send an SMS code through the phone-number flow.
+     */
+    resend(params: {
+        type: 'signup' | 'email_change' | 'recovery' | 'sms' | 'phone_change';
+        email?: string;
+        phone?: string;
+    }): Promise<{
+        data: Record<string, never>;
+        error: MotherbaseResponse<null>['error'];
+    }>;
+    /**
+     * Complete a `signInWithOtp` sign-in with the code that was sent.
+     *
+     * The channel follows the identifier, as in supabase-js: `{ phone }` verifies
+     * an SMS code, `{ email }` an email one. `type` is accepted for signature
+     * parity and only disambiguates when both are somehow present.
+     */
     verifyOtp(params: VerifyOtpParams): Promise<MotherbaseResponse<{
         user: User | null;
         session: Session | null;
@@ -140,7 +191,7 @@ export declare class AuthClient {
     }>>;
     /**
      * Update the signed-in user's profile fields and/or password. Password
-     * changes require `currentPassword` (a Better Auth requirement — there is no
+     * changes require `currentPassword` (a Better Auth requirement. There is no
      * blind password overwrite from an authenticated session).
      */
     updateUser(attributes: UpdateUserAttributes): Promise<MotherbaseResponse<{
@@ -148,7 +199,7 @@ export declare class AuthClient {
     }>>;
     /**
      * Permanently delete the signed-in user's account. Not part of the
-     * supabase-js client surface (there it's admin-only) — kept here because
+     * supabase-js client surface (there it's admin-only). Kept here because
      * self-service account deletion is a real product need. Requires the
      * backend's `delete-user` flow to be enabled; clears the local session on
      * success.
@@ -160,7 +211,7 @@ export declare class AuthClient {
      * Adopt an externally-obtained access token as the current session (e.g. one
      * captured from an OAuth redirect). Validates it against the server before
      * persisting. `refresh_token` is accepted for supabase-js signature parity
-     * and unused — Better Auth bearer sessions have none.
+     * and unused: Better Auth bearer sessions have none.
      */
     setSession(currentSession: {
         access_token: string;
@@ -172,23 +223,130 @@ export declare class AuthClient {
     signOut(): Promise<{
         error: MotherbaseResponse<null>['error'];
     }>;
+    /**
+     * Finish an OAuth / SSO sign-in after the provider redirected back.
+     *
+     * `signInWithOAuth` only starts the flow; the session is created during the
+     * redirect the browser makes to the backend callback, so the SDK has to pick
+     * it up from the URL the browser landed on. Call this once on the page you
+     * pointed `redirectTo` at (or on app start, which is where supabase-js does
+     * the equivalent). Without it the user is signed in on the backend and signed
+     * out in your app.
+     *
+     * Resolves with a null session and no error when there is nothing to read, so
+     * it is safe to call on every page load.
+     */
+    getSessionFromUrl(href?: string): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
     /** Fetch the current user from Better Auth (requires a valid session). */
     getUser(): Promise<MotherbaseResponse<{
         user: User | null;
     }>>;
-    /** The locally-held session, if any (no network call). */
+    /**
+     * NEVER USE FOR AN AUTHORIZATION DECISION. Use {@link getUser} instead.
+     *
+     * The locally-held session, if any (no network call). It is whatever the
+     * caller's cookie or storage said, parsed: unsigned JSON the browser sent,
+     * which anyone can set by hand. `session.user.id`, `.email` and `.role` are
+     * therefore attacker-controlled, and an admin allowlist checked against
+     * them is checked against nothing.
+     *
+     * Reads and writes through `from()` are unaffected: they carry the access
+     * token to the backend, which verifies it under RLS. It is the decisions
+     * your own app takes from `session.user` that are forgeable.
+     *
+     * `getUser()` costs one round trip and returns the user the backend
+     * confirms, in the same `{ data, error }` shape. Prefer it everywhere but a
+     * cosmetic "am I probably signed in" check.
+     */
     getSession(): Promise<MotherbaseResponse<{
         session: Session | null;
     }>>;
     /**
      * Revalidate the current session against the server. Better Auth bearer
-     * sessions have no refresh token — if the session is still valid the user is
+     * sessions have no refresh token: if the session is still valid the user is
      * refreshed; otherwise the local session is cleared.
      */
     refreshSession(): Promise<MotherbaseResponse<{
         user: User | null;
         session: Session | null;
     }>>;
+    /**
+     * Subscribe to auth changes, supabase-js style.
+     *
+     * The callback fires once with `INITIAL_SESSION` as soon as the stored
+     * session has been read, before any later event. That first call is not a
+     * nicety: the standard Supabase bootstrap is
+     * `if (event === 'INITIAL_SESSION') setLoading(false)`, and without it the
+     * app renders its loading state forever for a signed-out visitor, who never
+     * produces any other event.
+     *
+     * It is delivered asynchronously (after hydration), so unsubscribing
+     * synchronously suppresses it, exactly as in supabase-js.
+     */
+    /**
+     * The providers linked to the signed-in user, in the supabase-js identity
+     * shape. Backed by Better Auth's `list-accounts`, which is why `email` shows
+     * up as an identity for a password account: it is a real linked credential,
+     * exactly as in Supabase.
+     */
+    getUserIdentities(): Promise<MotherbaseResponse<{
+        identities: UserIdentity[];
+    }>>;
+    /**
+     * Link another provider to the signed-in user. Like `signInWithOAuth`, this
+     * only starts the flow: the browser is sent to the provider and comes back
+     * through the callback.
+     */
+    linkIdentity(credentials: SignInWithOAuthCredentials): Promise<MotherbaseResponse<{
+        provider: string;
+        url: string | null;
+    }>>;
+    /** Unlink a provider from the signed-in user. */
+    unlinkIdentity(identity: {
+        provider: string;
+        id?: string;
+        identity_id?: string;
+    }): Promise<MotherbaseResponse<Record<string, never>>>;
+    /**
+     * Native mobile sign-in with a provider id token (Sign in with Apple, Google
+     * One Tap), routed to Better Auth's social sign-in with an `idToken`.
+     * The provider must be configured on the backend.
+     */
+    signInWithIdToken(params: {
+        provider: string;
+        token: string;
+        access_token?: string;
+        nonce?: string;
+    }): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
+    /**
+     * Claims for the current session, as a JWT payload.
+     *
+     * supabase-js reads them out of the access token, which is itself a JWT.
+     * A Better Auth session token is an opaque bearer, so this asks the server's
+     * jwt plugin to mint one and decodes it. The decode is NOT a verification:
+     * the token came from the authenticated endpoint over TLS, and a client
+     * verifying a token it just asked for proves nothing. Verify server side,
+     * against `/api/auth/jwks`.
+     */
+    getClaims(): Promise<MotherbaseResponse<{
+        claims: Record<string, unknown>;
+        token: string;
+    }>>;
+    /**
+     * Revalidate the session on a timer, the way supabase-js does while the tab
+     * is focused. Motherbase refreshes on a 401 already, so this is opt-in: it
+     * exists so a ported app that calls it keeps working, and so a long-lived
+     * screen notices a revoked session without waiting for its next request.
+     */
+    startAutoRefresh(intervalMs?: number): void;
+    /** Stop the timer started by `startAutoRefresh`. Safe to call when none runs. */
+    stopAutoRefresh(): void;
     onAuthStateChange(callback: AuthChangeListener): {
         data: {
             subscription: Subscription;

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAEV,kBAAkB,EAElB,kBAAkB,EAClB,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,kEAAkE;QAClE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oCAAoC;QACpC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6EAA6E;QAC7E,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uGAAuG;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC;+DAC2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAyBD,MAAM,WAAW,YAAY;IAC3B,WAAW,IAAI,IAAI,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,UAAU;IAcT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAc,OAAO,CAAC,QAAQ,CAAC,KAAK;IAbrE;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;gBAEH,IAAI,EAAE,UAAU,EAAmB,KAAK,EAAE,YAAY;IAS7E,MAAM,CACV,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAexE,kBAAkB,CACtB,WAAW,EAAE,6BAA6B,GACzC,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAe9E;;;;OAIG;IACG,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAcjG,wEAAwE;IAClE,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAclI,wFAAwF;IAClF,aAAa,CAAC,WAAW,EAAE,wBAAwB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAc9I,kFAAkF;IAC5E,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAerH;;;;OAIG;IACG,eAAe,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAuBrI;;;;;;;;;OASG;IACG,aAAa,CAAC,MAAM,EAAE;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAClE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA2BvD;;;;OAIG;IACG,UAAU,CAAC,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAqBtG;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,GAAE,oBAAyB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAc9G;;;;;OAKG;IACG,UAAU,CAAC,cAAc,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAiBzJ,OAAO,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAUtE,0EAA0E;IACpE,OAAO,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IASnE,0DAA0D;IACpD,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAK5E;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAyBnG,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG;QAAE,IAAI,EAAE;YAAE,YAAY,EAAE,YAAY,CAAA;SAAE,CAAA;KAAE;IAOzF;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;YAKpB,OAAO;CAKtB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAEV,kBAAkB,EAElB,kBAAkB,EAClB,OAAO,EACP,IAAI,EACJ,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,cAAc,GAAG,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC;CAClF;AAED,MAAM,WAAW,0BAA0B;IACzC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,kEAAkE;QAClE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oCAAoC;QACpC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6EAA6E;QAC7E,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uGAAuG;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC;+DAC2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AA4DD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUxG;AAUD,MAAM,WAAW,YAAY;IAC3B,WAAW,IAAI,IAAI,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,UAAU;IAgBT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAc,OAAO,CAAC,QAAQ,CAAC,KAAK;IAfrE;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAEhC,OAAO,CAAC,gBAAgB,CAA+C;gBAE1C,IAAI,EAAE,UAAU,EAAmB,KAAK,EAAE,YAAY;IAS7E,MAAM,CACV,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAexE,kBAAkB,CACtB,WAAW,EAAE,6BAA6B,GACzC,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAe9E;;;;OAIG;IACG,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAcjG,wEAAwE;IAClE,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAclI;;;;;;;OAOG;IACG,aAAa,CAAC,WAAW,EAAE,wBAAwB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IA0B9I;;;;;;;OAOG;IACG,MAAM,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,QAAQ,GAAG,cAAc,GAAG,UAAU,GAAG,KAAK,GAAG,cAAc,CAAC;QACtE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IA8BtF;;;;;;OAMG;IACG,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA2BrH;;;;OAIG;IACG,eAAe,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA4CrI;;;;;;;;;OASG;IACG,aAAa,CAAC,MAAM,EAAE;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAClE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA4BvD;;;;OAIG;IACG,UAAU,CAAC,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA6BtG;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,GAAE,oBAAyB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAc9G;;;;;OAKG;IACG,UAAU,CAAC,cAAc,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAiBzJ,OAAO,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAUtE;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA6B9E,0EAA0E;IACpE,OAAO,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IASnE;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAK5E;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAyBnG;;;;;;;;;;;;OAYG;IACH;;;;;OAKG;IACG,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,UAAU,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC,CAAC;IAoBtF;;;;OAIG;IACG,YAAY,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAsBlI,iDAAiD;IAC3C,cAAc,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAa3I;;;;OAIG;IACG,iBAAiB,CAAC,MAAM,EAAE;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAyB/E;;;;;;;;;OASG;IACG,SAAS,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAclG;;;;;OAKG;IACH,gBAAgB,CAAC,UAAU,SAAS,GAAG,IAAI;IAU3C,iFAAiF;IACjF,eAAe,IAAI,IAAI;IAOvB,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG;QAAE,IAAI,EAAE;YAAE,YAAY,EAAE,YAAY,CAAA;SAAE,CAAA;KAAE;IAsBzF;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;YAKpB,OAAO;CAKtB"}