@motherbase/client 1.3.1 → 1.5.0

package/README.md

@@ -10,20 +10,69 @@ import and the client factory, keep your queries. Every `supabase-js` data call
 in the contract suite is either supported or supported with a stated difference,
 including relational embedding (`select('*, author(*)')`), `.rpc()`, native
 `upsert`, `count`, `csv()`, the full filter set and PostgREST error codes.
-Auth and realtime are close, with named gaps (no PKCE code exchange, no `mfa`
-namespace on the client, no private channels).
+Auth and realtime are close, with named gaps (no private channels). Two-factor
+(`client.auth.mfa.*`), SSO, anonymous sign-ins, CAPTCHA tokens, the PKCE flow
+(`flowType: 'pkce'` + `exchangeCodeForSession`), linked identities and
+secret-key user administration (`client.auth.admin.*`, including `generateLink`
+and `admin.mfa`) are all here, and so are what supabase-js lacks: organizations
+and teams (`client.auth.organization.*`), passkeys and runtime SSO providers. You
+never import Better Auth on the client.
 
 **Storage is path-addressed too**: `upload('avatars/123/pic.png')` then
 `download('avatars/123/pic.png')` round trips, `list(prefix)` works, and keys are
-traversal-checked. Still missing there: `move`, `copy`, batch signed URLs and
-image transforms, and authorization is ownership plus bucket tokens rather than
-RLS policies on the objects table. See
+traversal-checked. `copy`, `move`, `info`, `exists`, batch signed URLs and
+direct-to-storage signed uploads are supported; image transforms are not.
+Authorization is ownership plus bucket tokens by default, and real RLS policies on
+`storage.files` when the `storage.policies` setting is on. See
 [`docs/migrating-from-supabase.md`](../../docs/migrating-from-supabase.md).
 
+On the server, `createClient(url, secretKey)` also authorizes storage objects as
+`service_role`, including objects uploaded by another user. Secret-key
+impersonation keeps the permissions of the impersonated caller. Anonymous uploads
+require storage policies granting INSERT; they do not require SELECT. An upload
+response's `url` can be `null` when the caller cannot read the object.
+
+Uploads accept `Blob`, `ArrayBuffer`, and typed arrays, including Node `Buffer`.
+Signed uploads carry a scoped finalization token; keep the entire returned token
+when calling `uploadToSignedUrl`. This capability grants finalization, not private
+read access. Public URLs use the shared contracts route.
+
+For auth mutations in Node, the SDK supplies the API URL's origin when no
+`Origin` header was provided. An explicit `headers: { Origin: 'https://app.example' }`
+is preserved and must be trusted by the server. Browser requests retain the
+browser's Origin and the server's CSRF checks remain enabled.
+
 Do not plan a migration from the paragraph above. Plan it from
 [`COMPATIBILITY.md`](./COMPATIBILITY.md), which is generated from contract tests
 and is exhaustive, per method, with the exact difference for every partial row.
 
+**Write responses (Supabase semantics).** Native and compatibility clients,
+including SSR clients, return `data: null` after a successful write unless you
+chain `.select()`. For a public contact form, grant INSERT and create an INSERT
+policy; no SELECT policy is needed. Requesting rows also requires SELECT access.
+
+```ts
+// Write only: no SELECT access required.
+const { error } = await client.from('contacts').insert({ email, message });
+
+// Read back the stored row, including generated defaults, if RLS permits it.
+const { data } = await client.from('contacts').insert({ email, message }).select().single();
+```
+
+Existing Motherbase code that consumed implicit write responses must add
+`.select()` to those calls. Raw REST writes default to `Prefer: return=minimal`;
+use `Prefer: return=representation` to receive rows. Apply the
+`20260924120000_rest_write_capture` server migration before starting the updated
+server: internal trigger capture keeps realtime/webhooks transactional without
+requiring client read access. It does not enable event delivery for arbitrary
+SQL-editor or RPC writes. Motherbase's `transaction()` extension retains its
+existing batch response contract.
+
+**Invalid keys are refused.** A project key that is unknown or revoked now
+answers `401 UNAUTHORIZED` even when the project does not require an API key.
+Before, it was ignored and the request ran as anonymous. Remove stale keys from
+client configuration rather than relying on that fallback.
+
 Typed, isomorphic (browser, Next.js server & client, Expo / React Native), built
 on global `fetch` with zero runtime dependencies (`socket.io-client` is an
 optional peer dependency, used only for realtime).
@@ -107,7 +156,8 @@ client.from(table).select(cols).limit(n, { referencedTable }).range(from, to).ab
 client.from(table).select(cols).or('a.eq.1,and(b.gt.2,c.is.null)')   // nests, as PostgREST does
 client.from(table).select(cols).not(col, 'eq', v).filter(col, 'isdistinct', v)
 client.from(table).select(cols).textSearch(col, q, { type: 'websearch', config: 'english' })
-client.from(table).select(cols).single() | .maybeSingle() | .returns<T>() | .csv() | .explain()
+client.from(table).select(cols).single() | .maybeSingle() | .returns<T>() | .csv() | .geojson() | .explain()
+client.from(table).update(v).eq(..).throwOnError() | .maxAffected(1) | .rollback()
 client.from(table).insert(row) | .insert([rowA, rowB], { defaultToNull: false })
 client.from(table).upsert(rows, { onConflict, ignoreDuplicates })
 client.from(table).update(values).eq(..)         // a filter is required
@@ -115,8 +165,10 @@ client.from(table).delete().eq(..)               // a filter is required
 // Every call resolves { data, error, count }. `count` is null unless you ask:
 // .select('*', { count: 'exact', head: true }).
 // Values are quoted for you: .in('name', ['a,b']) is one value, not two.
-// Writes always return their rows: no .select() needed, and no way to opt out.
-// An unbounded select is capped at 100 rows server side: paginate with .range().
+// Writes return { data: null, error: null } by default, like supabase-js.
+// Add .select() to insert/upsert/update/delete to request the written rows.
+// Returning rows requires a SELECT policy as well as the write policy.
+// An unbounded select is capped by api.rest.maxRows (1000 by default): paginate with .range().
 // explain() needs an admin caller; a normal caller gets 403.
 
 // Relational embedding. Compiles to a correlated LATERAL subquery inside the
@@ -147,15 +199,44 @@ client.auth.getSession()       // { data: { session } }, local only
 client.auth.refreshSession()
 client.auth.onAuthStateChange((event, session) => {})  // SIGNED_IN | SIGNED_OUT | TOKEN_REFRESHED
 client.auth.deleteUser({ password })            // self-service, needs the backend flow enabled
+client.auth.signInWithSSO({ domain | providerId | email })
+client.auth.signInWithIdToken({ provider, token, nonce })   // Apple / Google One Tap
+client.auth.getUserIdentities() | .linkIdentity({ provider }) | .unlinkIdentity({ provider, id })
+client.auth.getClaims()                         // { claims, token }, decoded from a minted JWT
+client.auth.startAutoRefresh(ms) | .stopAutoRefresh()
+client.auth.mfa.enroll({ password }) | .challenge({ channel }) | .verify({ code, type? })
+client.auth.mfa.listFactors() | .regenerateBackupCodes({ password }) | .unenroll({ password })
+client.auth.admin.*                             // secret key only: list/get/create/update/delete/signOut/invite
+
+// Beyond supabase-js. Method names and parameters are Better Auth's own, so its
+// plugin docs apply; each needs its plugin on in the project's Auth settings.
+client.auth.signInWithPasskey()                 // browser passkey prompt, then a session like any sign-in
+client.auth.passkey.register({ name }) | .list() | .update({ id, name }) | .delete({ id })
+client.auth.organization.create({ name, slug }) | .list() | .setActive({ organizationId })
+client.auth.organization.getFullOrganization() | .update({ data }) | .delete({ organizationId }) | .leave(...)
+client.auth.organization.inviteMember({ email, role }) | .acceptInvitation({ invitationId }) | .listUserInvitations()
+client.auth.organization.listMembers() | .updateMemberRole({ memberId, role }) | .removeMember({ memberIdOrEmail })
+client.auth.organization.hasPermission({ permissions: { member: ['create'] } })
+client.auth.organization.createTeam({ name }) | .listTeams() | .addTeamMember({ teamId, userId })   // teams on
+client.auth.sso.register({ providerId, issuer, domain, organizationId, oidcConfig | samlConfig })
+client.auth.sso.listProviders() | .getProvider({ providerId }) | .updateProvider(...) | .deleteProvider(...)
 
 // Storage → { data, error }. `path` is the object key inside the bucket, and it
 // round trips. The file id returned by upload still works anywhere a path does.
 client.storage.from(bucket).upload(path, file, { visibility, upsert })
-client.storage.from(bucket).download(path)
+client.storage.from(bucket).download(path, { transform })        // transform: see below
 client.storage.from(bucket).remove([path])
 client.storage.from(bucket).list(prefix, { limit, offset, search, sortBy })
-client.storage.from(bucket).createSignedUrl(path, expiresIn)     // expiresIn is ignored
-client.storage.from(bucket).getPublicUrl(path)                   // sync
+client.storage.from(bucket).createSignedUrl(path, expiresIn, { transform })  // seconds, 1..604800
+client.storage.from(bucket).createSignedUrls([path], expiresIn)  // per-entry results
+client.storage.from(bucket).getPublicUrl(path, { transform })    // sync
+client.storage.from(bucket).update(path, file)                   // upload with upsert on
+client.storage.from(bucket).copy(from, to, { upsert }) | .move(from, to, { upsert })
+client.storage.from(bucket).info(path) | .exists(path)           // 404 reads as false
+client.storage.from(bucket).createSignedUploadUrl(path, { size, contentType })  // S3 driver
+client.storage.from(bucket).uploadToSignedUrl(path, token, file)
+client.storage.createBucket(id, { public, fileSizeLimit, allowedMimeTypes })  // secret key
+// transform: { width, height, resize: 'cover'|'contain'|'fill', quality, format: 'origin'|'webp'|'avif' }
 
 // Realtime
 client.channel(name, { config: { broadcast: { self, ack }, presence: { key } } })
@@ -167,8 +248,41 @@ channel.send({ type: 'broadcast', event, payload })
 channel.track(state); channel.untrack(); channel.presenceState()
 client.removeChannel(channel)
 
-// Edge functions → { data, error }
-client.functions.invoke(name, { body })
+// Edge functions → { data, error }. `error` is a FunctionsHttpError /
+// FunctionsFetchError instance, but invoke still resolves rather than throws.
+client.functions.invoke(name, { body, method, headers, auth })
+```
+
+## Resumable uploads
+
+Large files go over TUS, exactly as on Supabase: the SDK does not bundle a TUS
+client (supabase-js does not either), so use
+[`tus-js-client`](https://github.com/tus/tus-js-client) against
+`/storage/v1/upload/resumable`. Chunks must be 6 MB. Bucket limits, the key
+collision check and storage policies are enforced when the upload is created,
+and an unfinished upload can be resumed for 24 hours.
+
+```ts
+import { Upload } from 'tus-js-client';
+
+const { data: { session } } = await client.auth.getSession();
+const upload = new Upload(file, {
+  endpoint: `${MOTHERBASE_URL}/storage/v1/upload/resumable`,
+  chunkSize: 6 * 1024 * 1024,
+  retryDelays: [0, 3000, 5000, 10000, 20000],
+  headers: {
+    authorization: `Bearer ${session?.access_token}`,
+    apikey: MOTHERBASE_PUBLISHABLE_KEY,
+    'x-upsert': 'true', // optional: replace an existing object
+  },
+  metadata: { bucketName: 'videos', objectName: 'u1/clip.mp4', contentType: 'video/mp4' },
+  onProgress: (sent, total) => console.log(Math.round((sent / total) * 100), '%'),
+  onSuccess: () => console.log('uploaded'),
+});
+upload.findPreviousUploads().then(previous => {
+  if (previous[0]) upload.resumeFromPreviousUpload(previous[0]);
+  upload.start();
+});
 ```
 
 ## Social sign-in (OAuth)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@motherbase/client",
-  "version": "1.3.1",
+  "version": "1.5.0",
   "description": "Typed client SDK for Motherbase, the open source self-hosted backend platform.",
   "type": "module",
   "main": "./dist/index.js",
@@ -13,6 +13,14 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./query": {
+      "types": "./dist/query.d.ts",
+      "import": "./dist/query.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "import": "./dist/testing.js"
     }
   },
   "files": [
@@ -47,6 +55,6 @@
   },
   "devDependencies": {
     "typescript": "^5.4.2",
-    "vitest": "^2.0.5"
+    "vitest": "^5.0.0"
   }
 }

package/dist/admin.d.ts

@@ -1,81 +0,0 @@
-import type { HttpClient } from './http.js';
-import type { MotherbaseResponse, User } from './types.js';
-/**
- * `client.auth.admin`, shaped like `supabase.auth.admin`.
- *
- * Every method here needs a **secret** project API key, so the client it hangs
- * off must have been built with one. A publishable key gets a 401 from the
- * server, which is the correct outcome: these calls create and delete users
- * without being any user.
- *
- * Two differences from supabase-js worth knowing before you port code:
- *
- *   * Scope. This is user administration only. Supabase's service key also opens
- *     SQL and DDL; here those stay behind operator authentication, so a leaked
- *     application key cannot drop a table.
- *   * `generateLink` has no equivalent. Better Auth issues one-time codes rather
- *     than pre-signed links, so use `auth.signInWithOtp` / `auth.verifyOtp`, or
- *     `invite()` below, which mails the credential itself.
- */
-export interface AdminListUsersParams {
-    page?: number;
-    perPage?: number;
-}
-export interface AdminUserList {
-    users: User[];
-    page: number;
-    perPage: number;
-    total: number;
-}
-export interface AdminCreateUserParams {
-    email: string;
-    password?: string;
-    username?: string;
-    role?: 'ADMIN' | 'USER';
-    /** Mark the address verified without sending a confirmation. */
-    email_confirm?: boolean;
-    /** Also email the temporary password. `invite()` is the same thing, named. */
-    sendInvite?: boolean;
-}
-export interface AdminCreatedUser {
-    user: User;
-    /** Generated when no password was supplied. Never logged by the SDK. */
-    temporaryPassword: string;
-    invited: boolean;
-}
-export interface AdminUpdateUserParams {
-    password?: string;
-    role?: 'ADMIN' | 'USER';
-    username?: string;
-    firstName?: string;
-    lastName?: string;
-    status?: string;
-}
-export declare class AuthAdminClient {
-    private readonly http;
-    constructor(http: HttpClient);
-    listUsers(params?: AdminListUsersParams): Promise<MotherbaseResponse<AdminUserList>>;
-    getUserById(id: string): Promise<MotherbaseResponse<{
-        user: User | null;
-    }>>;
-    createUser(params: AdminCreateUserParams): Promise<MotherbaseResponse<AdminCreatedUser>>;
-    updateUserById(id: string, params: AdminUpdateUserParams): Promise<MotherbaseResponse<{
-        user: User | null;
-    }>>;
-    deleteUser(id: string): Promise<MotherbaseResponse<{
-        id: string;
-    }>>;
-    /** End every session this user holds, everywhere. */
-    signOut(userId: string): Promise<MotherbaseResponse<{
-        id: string;
-    }>>;
-    /** Create the account and email the temporary password to it. */
-    inviteUserByEmail(email: string, options?: {
-        username?: string;
-        role?: 'ADMIN' | 'USER';
-    }): Promise<MotherbaseResponse<{
-        user: User;
-        invited: boolean;
-    }>>;
-}
-//# sourceMappingURL=admin.d.ts.map

package/dist/admin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,gEAAgE;IAChE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,IAAI,CAAC;IACX,wEAAwE;IACxE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,SAAS,CAAC,MAAM,GAAE,oBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAaxF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAS3E,UAAU,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IASxF,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAY/C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IASzE,qDAAqD;IAC/C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAS1E,iEAAiE;IAC3D,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAO,GAC3D,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAWjE"}

package/dist/admin.js

@@ -1,85 +0,0 @@
-import { toError } from './http.js';
-const BASE = '/api/auth/admin';
-export class AuthAdminClient {
-    constructor(http) {
-        this.http = http;
-    }
-    async listUsers(params = {}) {
-        const query = new URLSearchParams();
-        if (params.page !== undefined)
-            query.set('page', String(params.page));
-        if (params.perPage !== undefined)
-            query.set('per_page', String(params.perPage));
-        const suffix = query.toString();
-        try {
-            const data = await this.http.request(`${BASE}/users${suffix ? `?${suffix}` : ''}`);
-            return { data, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    async getUserById(id) {
-        try {
-            const data = await this.http.request(`${BASE}/users/${encodeURIComponent(id)}`);
-            return { data, error: null };
-        }
-        catch (err) {
-            return { data: { user: null }, error: toError(err) };
-        }
-    }
-    async createUser(params) {
-        try {
-            const data = await this.http.request(`${BASE}/users`, { method: 'POST', body: params });
-            return { data, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    async updateUserById(id, params) {
-        try {
-            const data = await this.http.request(`${BASE}/users/${encodeURIComponent(id)}`, {
-                method: 'PATCH',
-                body: params,
-            });
-            return { data, error: null };
-        }
-        catch (err) {
-            return { data: { user: null }, error: toError(err) };
-        }
-    }
-    async deleteUser(id) {
-        try {
-            await this.http.request(`${BASE}/users/${encodeURIComponent(id)}`, { method: 'DELETE' });
-            return { data: { id }, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /** End every session this user holds, everywhere. */
-    async signOut(userId) {
-        try {
-            await this.http.request(`${BASE}/users/${encodeURIComponent(userId)}/sign-out`, { method: 'POST' });
-            return { data: { id: userId }, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /** Create the account and email the temporary password to it. */
-    async inviteUserByEmail(email, options = {}) {
-        try {
-            const data = await this.http.request(`${BASE}/invite`, {
-                method: 'POST',
-                body: { email, ...options },
-            });
-            return { data, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-}
-//# sourceMappingURL=admin.js.map

package/dist/admin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6DpC,MAAM,IAAI,GAAG,iBAAiB,CAAC;AAE/B,MAAM,OAAO,eAAe;IAC1B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,SAAS,CAAC,SAA+B,EAAE;QAC/C,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgB,GAAG,IAAI,SAAS,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAiB,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAChG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAA6B;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAmB,GAAG,IAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1G,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,EAAU,EACV,MAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAiB,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC9F,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACzF,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,UAA0D,EAAE;QAE5D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAmC,GAAG,IAAI,SAAS,EAAE;gBACvF,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}

package/dist/auth.d.ts

@@ -1,233 +0,0 @@
-import { MfaClient } from './mfa.js';
-import { AuthAdminClient } from './admin.js';
-import type { HttpClient } from './http.js';
-import type { SessionStore } from './session.js';
-import type { AuthChangeListener, MotherbaseResponse, Session, User } from './types.js';
-export interface SignUpCredentials {
-    email: string;
-    password: string;
-    /** Optional extra profile field supported by the backend. */
-    username?: string;
-}
-export interface SignInWithPasswordCredentials {
-    email: string;
-    password: string;
-}
-export interface SignInWithOtpCredentials {
-    email: string;
-}
-export interface VerifyOtpParams {
-    email: string;
-    /** The OTP code sent to the email. Named `token` for supabase-js parity. */
-    token: string;
-    /** Accepted for supabase-js signature parity; only the email sign-in OTP flow is supported. */
-    type?: 'email';
-}
-export interface SignInWithOAuthCredentials {
-    /** Social provider id, e.g. 'google' or 'apple'. Must be enabled on the backend. */
-    provider: string;
-    options?: {
-        /** Where the provider should send the user back to after auth. */
-        redirectTo?: string;
-        /** Space-separated OAuth scopes. */
-        scopes?: string;
-        /** Skip the automatic `window.location` redirect and just return the URL. */
-        skipBrowserRedirect?: boolean;
-    };
-}
-export interface DeleteUserAttributes {
-    /** Required unless the session is already "fresh" (i.e. just re-authenticated). */
-    password?: string;
-    /** Deletion-confirmation token, when the backend's delete flow requires an email confirmation step. */
-    token?: string;
-    callbackURL?: string;
-}
-export interface UpdateUserAttributes {
-    /** New password. Requires `currentPassword` — the backend does not allow a
-     *  blind password change from an authenticated session. */
-    password?: string;
-    currentPassword?: string;
-    /** Arbitrary profile fields (name, image, or any custom additional field). */
-    data?: Record<string, unknown>;
-}
-/**
- * Read the token an OAuth callback left in the URL fragment and return the URL
- * with it removed, so a reload or a shared link cannot replay it.
- *
- * The provider callback cannot answer the SDK with a JSON body: it is a browser
- * redirect. The backend therefore appends `#access_token=…` to the redirect it
- * issues, the same implicit flow supabase-js reads. Exported for testing.
- */
-export declare function readAccessTokenFromUrl(href: string): {
-    accessToken: string;
-    cleanedHref: string;
-} | null;
-export interface Subscription {
-    unsubscribe(): void;
-}
-/**
- * Supabase-compatible auth client. Maps supabase-js method names onto the
- * Motherbase auth endpoints and reuses the existing token/refresh/session-store
- * machinery. Returns `{ data, error }` and never throws for expected failures.
- */
-export declare class AuthClient {
-    private readonly http;
-    private readonly store;
-    /**
-     * Two-factor, shaped like `supabase.auth.mfa`. The server has shipped TOTP
-     * from the start; this is the namespace that makes it reachable.
-     */
-    readonly mfa: MfaClient;
-    /**
-     * User administration for server code holding a secret key. Present on every
-     * client, because whether the key is secret is a server-side fact: calling
-     * these with a publishable key is a 401, not a missing method.
-     */
-    readonly admin: AuthAdminClient;
-    constructor(http: HttpClient, store: SessionStore);
-    signUp(credentials: SignUpCredentials): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    signInWithPassword(credentials: SignInWithPasswordCredentials): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    /**
-     * Request a password-reset OTP by email. Always resolves successfully
-     * (whether or not the email is registered) to avoid leaking account
-     * existence; check `error` only for transport/server failures.
-     */
-    resetPasswordForEmail(email: string): Promise<{
-        error: MotherbaseResponse<null>['error'];
-    }>;
-    /** Complete a password reset using the OTP sent to the user's email. */
-    resetPassword(args: {
-        email: string;
-        otp: string;
-        password: string;
-    }): Promise<{
-        error: MotherbaseResponse<null>['error'];
-    }>;
-    /** Send a one-time sign-in code by email. Pair with `verifyOtp` to complete sign-in. */
-    signInWithOtp(credentials: SignInWithOtpCredentials): Promise<{
-        data: Record<string, never>;
-        error: MotherbaseResponse<null>['error'];
-    }>;
-    /** Complete a `signInWithOtp` sign-in using the code sent to the user's email. */
-    verifyOtp(params: VerifyOtpParams): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    /**
-     * Start an OAuth sign-in with a configured social provider. Resolves with the
-     * provider's authorize URL and, in a browser, redirects to it immediately
-     * unless `options.skipBrowserRedirect` is set.
-     */
-    signInWithOAuth(credentials: SignInWithOAuthCredentials): Promise<MotherbaseResponse<{
-        provider: string;
-        url: string | null;
-    }>>;
-    /**
-     * Start an enterprise SSO sign-in. Identify the provider by the user's email
-     * domain, by an explicit `domain`, or by `providerId` when you already know
-     * which one to use.
-     *
-     * Resolves with the identity provider's URL and, in a browser, redirects to it
-     * unless `options.skipBrowserRedirect` is set. The project must have the SSO
-     * plugin enabled and at least one provider registered (Studio →
-     * Authentication → Organizations & SSO).
-     */
-    signInWithSSO(params: {
-        domain?: string;
-        email?: string;
-        providerId?: string;
-        organizationSlug?: string;
-        options?: {
-            redirectTo?: string;
-            skipBrowserRedirect?: boolean;
-        };
-    }): Promise<MotherbaseResponse<{
-        url: string | null;
-    }>>;
-    /**
-     * Update the signed-in user's profile fields and/or password. Password
-     * changes require `currentPassword` (a Better Auth requirement — there is no
-     * blind password overwrite from an authenticated session).
-     */
-    updateUser(attributes: UpdateUserAttributes): Promise<MotherbaseResponse<{
-        user: User | null;
-    }>>;
-    /**
-     * Permanently delete the signed-in user's account. Not part of the
-     * supabase-js client surface (there it's admin-only) — kept here because
-     * self-service account deletion is a real product need. Requires the
-     * backend's `delete-user` flow to be enabled; clears the local session on
-     * success.
-     */
-    deleteUser(attributes?: DeleteUserAttributes): Promise<{
-        error: MotherbaseResponse<null>['error'];
-    }>;
-    /**
-     * Adopt an externally-obtained access token as the current session (e.g. one
-     * captured from an OAuth redirect). Validates it against the server before
-     * persisting. `refresh_token` is accepted for supabase-js signature parity
-     * and unused — Better Auth bearer sessions have none.
-     */
-    setSession(currentSession: {
-        access_token: string;
-        refresh_token?: string;
-    }): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    signOut(): Promise<{
-        error: MotherbaseResponse<null>['error'];
-    }>;
-    /**
-     * Finish an OAuth / SSO sign-in after the provider redirected back.
-     *
-     * `signInWithOAuth` only starts the flow; the session is created during the
-     * redirect the browser makes to the backend callback, so the SDK has to pick
-     * it up from the URL the browser landed on. Call this once on the page you
-     * pointed `redirectTo` at (or on app start, which is where supabase-js does
-     * the equivalent). Without it the user is signed in on the backend and signed
-     * out in your app.
-     *
-     * Resolves with a null session and no error when there is nothing to read, so
-     * it is safe to call on every page load.
-     */
-    getSessionFromUrl(href?: string): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    /** Fetch the current user from Better Auth (requires a valid session). */
-    getUser(): Promise<MotherbaseResponse<{
-        user: User | null;
-    }>>;
-    /** The locally-held session, if any (no network call). */
-    getSession(): Promise<MotherbaseResponse<{
-        session: Session | null;
-    }>>;
-    /**
-     * Revalidate the current session against the server. Better Auth bearer
-     * sessions have no refresh token — if the session is still valid the user is
-     * refreshed; otherwise the local session is cleared.
-     */
-    refreshSession(): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    onAuthStateChange(callback: AuthChangeListener): {
-        data: {
-            subscription: Subscription;
-        };
-    };
-    /**
-     * Internal: refresh used by the HttpClient's 401 path. Returns true on success.
-     * Not part of the public Supabase surface.
-     */
-    _refresh(): Promise<boolean>;
-    private persist;
-}
-//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAEV,kBAAkB,EAElB,kBAAkB,EAClB,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,kEAAkE;QAClE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oCAAoC;QACpC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6EAA6E;QAC7E,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uGAAuG;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC;+DAC2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAmBD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUxG;AAQD,MAAM,WAAW,YAAY;IAC3B,WAAW,IAAI,IAAI,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,UAAU;IAcT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAc,OAAO,CAAC,QAAQ,CAAC,KAAK;IAbrE;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;gBAEH,IAAI,EAAE,UAAU,EAAmB,KAAK,EAAE,YAAY;IAS7E,MAAM,CACV,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAexE,kBAAkB,CACtB,WAAW,EAAE,6BAA6B,GACzC,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAe9E;;;;OAIG;IACG,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAcjG,wEAAwE;IAClE,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAclI,wFAAwF;IAClF,aAAa,CAAC,WAAW,EAAE,wBAAwB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAc9I,kFAAkF;IAC5E,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAerH;;;;OAIG;IACG,eAAe,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA4CrI;;;;;;;;;OASG;IACG,aAAa,CAAC,MAAM,EAAE;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAClE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA4BvD;;;;OAIG;IACG,UAAU,CAAC,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAqBtG;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,GAAE,oBAAyB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAc9G;;;;;OAKG;IACG,UAAU,CAAC,cAAc,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAiBzJ,OAAO,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAUtE;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA6B9E,0EAA0E;IACpE,OAAO,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IASnE,0DAA0D;IACpD,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAK5E;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAyBnG,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG;QAAE,IAAI,EAAE;YAAE,YAAY,EAAE,YAAY,CAAA;SAAE,CAAA;KAAE;IAOzF;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;YAKpB,OAAO;CAKtB"}