@motherbase/client 1.3.1 → 1.5.0

package/dist/index.js

@@ -1,180 +0,0 @@
-import { HttpClient, toError } from './http.js';
-import { contractPath } from '@motherbase/contracts';
-import { SessionStore, memoryStorage, localStorageStorage } from './session.js';
-import { AuthClient } from './auth.js';
-import { StorageClient } from './storage.js';
-import { FunctionsClient } from './functions.js';
-import { RealtimeModule } from './realtime.js';
-import { RealtimeChannel } from './channel.js';
-import { PostgrestQueryBuilder } from './postgrest.js';
-import { isProduction } from './cookie.js';
-/**
- * Supabase-js-compatible client for a Motherbase backend.
- *
- * Drop-in shaped: `client.from(table).select()…`, `client.auth.signInWithPassword()`,
- * `client.storage.from(bucket)`, `client.channel(name)`, `client.functions.invoke()`.
- *
- * Pass the type generated by `motherbase gen types typescript` to get real
- * inference: `createClient<Database>(url, key)` then types every row, rejects
- * unknown columns in `.select()`, checks `.insert()` payloads against the
- * Insert shape and types `.rpc()` from `Functions`. Without it the client
- * behaves exactly as it did before generics existed.
- */
-export class MotherbaseClient {
-    constructor(url, 
-    /** Accepted for supabase-js signature parity; sent as an `apikey` header when set. */
-    key, options = {}) {
-        this.url = url;
-        this.key = key;
-        this.channels = new Map();
-        // `globalThis.fetch` is a native function that requires `this === window`
-        // (or an equivalent global) when invoked — copying the reference without
-        // binding it throws "Illegal invocation" the moment it's called as
-        // `this.opts.fetch(...)` inside HttpClient. Bind it once here.
-        const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
-        if (!fetchImpl) {
-            throw new Error('No fetch implementation found. Pass `fetch` in options for this runtime.');
-        }
-        const autoRefresh = options.autoRefresh ?? true;
-        const headers = { ...options.headers };
-        if (key)
-            headers['apikey'] = key;
-        // A secret key runs every request as service_role, which bypasses row level
-        // security. In a browser it is readable by anyone who opens devtools, so it
-        // is not "a key that leaked", it is the whole database published. Warn
-        // rather than throw: a legitimate caller may run in a runtime that defines
-        // `window` (a test harness, an Electron main process), and refusing to
-        // construct would break them for a heuristic.
-        if (key?.startsWith('mb_secret_') && typeof window !== 'undefined') {
-            console.warn('[motherbase] A secret API key was passed to createClient in a browser context. '
-                + 'Secret keys bypass row level security and must stay server side. '
-                + 'Use the publishable key here.');
-        }
-        // The default adapter keeps the session in memory only: it does not survive
-        // a reload, and the server never sees it. That is the right default for a
-        // script or a test, and a bug in a browser app — and it presents as
-        // "getUser() returns null everywhere", which reads like an auth problem
-        // rather than a storage one. Point at the fix once, in development.
-        if (!options.storage && typeof window !== 'undefined' && !MotherbaseClient.warnedAboutStorage) {
-            MotherbaseClient.warnedAboutStorage = true;
-            if (!isProduction()) {
-                console.warn('[motherbase] createClient() was called in a browser without a `storage` adapter, so the '
-                    + 'session lives in memory and is lost on reload. Pass `storage: cookieStorage()` (or '
-                    + '`localStorageStorage()`), or use `createBrowserClient` from `@motherbase/ssr`, which '
-                    + 'writes the cookie the server needs to read.');
-            }
-        }
-        this.store = new SessionStore(options.storage ?? memoryStorage());
-        // auth needs the http client, and http needs auth._refresh for the 401 path,
-        // so wire them in two steps with a late-bound refresh callback.
-        // prefer-const cannot see the closure above: `auth` is read by the refresh
-        // callback before this line's assignment happens, so it has to be a `let`.
-        // eslint-disable-next-line prefer-const
-        let auth;
-        this.http = new HttpClient(url, this.store, { autoRefresh, fetch: fetchImpl, headers }, () => auth._refresh());
-        auth = new AuthClient(this.http, this.store);
-        this.auth = auth;
-        this.storage = new StorageClient(this.http, url);
-        this.functions = new FunctionsClient(this.http);
-        this.realtime = new RealtimeModule(url, this.store, fetchImpl, options.realtimeIoFactory);
-    }
-    from(table) {
-        return new PostgrestQueryBuilder(this.http, table);
-    }
-    /**
-     * Call a database function, typed from the generated `Functions` map.
-     *
-     * The transport is `POST /rest/v1/rpc/<fn>`, which the REST layer gains in
-     * Phase 2.8. The typing is independent of that work: it reads only the
-     * generated `Database`, so it is correct the moment the route exists.
-     *
-     * `get` and `head` switch to the read-only forms, which carry their arguments
-     * as query parameters rather than as a body, exactly as supabase-js does.
-     */
-    async rpc(fn, args, options = {}) {
-        try {
-            const method = options.head ? 'HEAD' : options.get ? 'GET' : 'POST';
-            const params = new URLSearchParams();
-            if (method !== 'POST') {
-                for (const [name, value] of Object.entries((args ?? {}))) {
-                    if (value === undefined)
-                        continue;
-                    params.append(name, Array.isArray(value) ? `{${value.join(',')}}` : String(value));
-                }
-            }
-            const query = params.toString();
-            const path = `${contractPath.rest('rpc')}/${encodeURIComponent(fn)}${query ? `?${query}` : ''}`;
-            const headers = options.count ? { Prefer: `count=${options.count}` } : undefined;
-            const result = await this.http.requestWithHeaders(path, {
-                method,
-                body: method === 'POST' ? (args ?? {}) : undefined,
-                headers,
-            });
-            const range = result.headers.get('content-range');
-            const total = range?.split('/')[1];
-            const count = total && total !== '*' && Number.isFinite(Number(total)) ? Number(total) : null;
-            return { data: options.head ? null : result.data, error: null, count };
-        }
-        catch (err) {
-            return { data: null, error: toError(err), count: null };
-        }
-    }
-    /** Create (or reuse) a realtime channel. */
-    channel(name, opts = {}) {
-        const existing = this.channels.get(name);
-        if (existing)
-            return existing;
-        const channel = new RealtimeChannel(name, this.realtime, opts);
-        this.channels.set(name, channel);
-        return channel;
-    }
-    /** Unsubscribe and drop a channel. */
-    async removeChannel(channel) {
-        await channel.unsubscribe();
-        this.channels.delete(channel.topic);
-        return 'ok';
-    }
-    /** Unsubscribe and drop every channel. */
-    async removeAllChannels() {
-        await Promise.all(Array.from(this.channels.values()).map(c => c.unsubscribe()));
-        this.channels.clear();
-        return 'ok';
-    }
-    /** Load any persisted session before first use. Optional but recommended. */
-    hydrate() {
-        return this.store.hydrate();
-    }
-}
-MotherbaseClient.warnedAboutStorage = false;
-/**
- * Create a Supabase-compatible Motherbase client.
- *
- * In a Next.js app, prefer `createBrowserClient` / `createServerClient` from
- * `@motherbase/ssr`: they persist the session to a cookie both halves can read.
- * `createClient()` on its own keeps the session in memory, which the server
- * cannot see, so every server-rendered `getUser()` returns null.
- *
- * @param url  Backend API base URL.
- * @param key  Anon/publishable key (optional). Sent as an `apikey` header.
- * @param options  Session storage, fetch override, extra headers.
- *
- * @example
- * ```ts
- * import type { Database } from './database.types'
- * const client = createClient<Database>(url, anonKey)
- * ```
- */
-export function createClient(url, key, options = {}) {
-    return new MotherbaseClient(url, key, options);
-}
-export { BackendError } from './http.js';
-export { memoryStorage, localStorageStorage };
-export { cookieStorage, serverCookieStorage, SESSION_COOKIE_KEY } from './cookie.js';
-export { PostgrestQueryBuilder } from './postgrest.js';
-export { AuthClient } from './auth.js';
-export { MfaClient } from './mfa.js';
-export { AuthAdminClient } from './admin.js';
-export { StorageClient, StorageBucket } from './storage.js';
-export { FunctionsClient } from './functions.js';
-export { RealtimeChannel } from './channel.js';
-//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAA+B,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAyB3C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAgB3B,YACmB,GAAW;IAC5B,sFAAsF;IAC7E,GAAY,EACrB,UAAyB,EAAE;QAHV,QAAG,GAAH,GAAG,CAAQ;QAEnB,QAAG,GAAH,GAAG,CAAS;QANN,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;QAS7D,0EAA0E;QAC1E,yEAAyE;QACzE,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;QAChD,MAAM,OAAO,GAA2B,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/D,IAAI,GAAG;YAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;QAEjC,4EAA4E;QAC5E,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,GAAG,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YACnE,OAAO,CAAC,IAAI,CACV,iFAAiF;kBAC7E,mEAAmE;kBACnE,+BAA+B,CACpC,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,oEAAoE;QACpE,wEAAwE;QACxE,oEAAoE;QACpE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;YAC9F,gBAAgB,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC3C,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CACV,0FAA0F;sBACtF,qFAAqF;sBACrF,uFAAuF;sBACvF,6CAA6C,CAClD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC,CAAC;QAElE,6EAA6E;QAC7E,gEAAgE;QAChE,2EAA2E;QAC3E,2EAA2E;QAC3E,wCAAwC;QACxC,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/G,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAE7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5F,CAAC;IAkBD,IAAI,CAAC,KAAa;QAChB,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,CACP,EAAQ,EACR,IAAiC,EACjC,UAAsB,EAAE;QAExB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,EAAE,CAAC;oBACpF,IAAI,KAAK,KAAK,SAAS;wBAAE,SAAS;oBAClC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAChG,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAEjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAgC,IAAI,EAAE;gBACrF,MAAM;gBACN,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClD,OAAO;aACR,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9F,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,OAAO,CAAC,IAAY,EAAE,OAA+B,EAAE;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,aAAa,CAAC,OAAwB;QAC1C,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,iBAAiB;QACrB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;;AA5Jc,mCAAkB,GAAG,KAAK,AAAR,CAAS;AA+J5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAI1B,GAAW,EAAE,GAAY,EAAE,UAAyB,EAAE;IACtD,OAAO,IAAI,gBAAgB,CAA+B,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AA6CvD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAmB7C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/dist/mfa.d.ts

@@ -1,109 +0,0 @@
-import type { HttpClient } from './http.js';
-import type { MotherbaseResponse } from './types.js';
-/**
- * Two-factor authentication, shaped like `supabase.auth.mfa`.
- *
- * The server has shipped TOTP with backup codes and trusted devices since the
- * beginning; only the client namespace was missing, which meant the product's
- * strongest auth feature could not be reached from the SDK that sells it.
- *
- * The mapping onto Better Auth is not one-to-one, and the differences are stated
- * per method rather than papered over:
- *
- *   * A factor here is TOTP or nothing. Better Auth models two-factor as a
- *     property of the user, not as a list of enrolled factors, so `listFactors`
- *     reports the single TOTP factor rather than an arbitrary set, and there is
- *     no phone factor to enrol.
- *   * Enrolment needs the user's password. supabase-js does not ask for one;
- *     Better Auth does, because enabling two-factor is a credential change.
- *   * `challenge()` is a local no-op for TOTP: there is nothing to send, the
- *     code is already on the user's device. It exists so the supabase-js
- *     challenge/verify sequence compiles unchanged. For the email or SMS second
- *     factor, `challenge()` does send a code.
- */
-export interface MfaFactor {
-    id: string;
-    /** Always `totp` today. */
-    factor_type: 'totp';
-    status: 'verified' | 'unverified';
-    friendly_name?: string;
-}
-export interface MfaEnrollResponse {
-    id: string;
-    type: 'totp';
-    totp: {
-        /** otpauth:// URI to render as a QR code. */
-        uri: string;
-        /** The shared secret, for users who type it in by hand. */
-        secret: string;
-    };
-    /** One-time codes to store somewhere safe. Shown only at enrolment. */
-    backupCodes: string[];
-}
-export interface MfaChallengeResponse {
-    id: string;
-    expires_at: number | null;
-}
-export declare class MfaClient {
-    private readonly http;
-    /** Re-reads the session after a verify, so a stepped-up token is persisted. */
-    private readonly onVerified;
-    constructor(http: HttpClient, 
-    /** Re-reads the session after a verify, so a stepped-up token is persisted. */
-    onVerified: () => Promise<void>);
-    /**
-     * Start TOTP enrolment. Returns the otpauth URI, the secret and the backup
-     * codes. The factor is not usable until `verify()` accepts a code from it.
-     */
-    enroll(params: {
-        password: string;
-        issuer?: string;
-    }): Promise<MotherbaseResponse<MfaEnrollResponse>>;
-    /**
-     * For TOTP this resolves immediately and sends nothing: the code already lives
-     * on the user's device. Pass `channel` to send a second-factor code by email
-     * or SMS instead, when the project has that enabled.
-     */
-    challenge(params?: {
-        factorId?: string;
-        channel?: 'email' | 'sms';
-    }): Promise<MotherbaseResponse<MfaChallengeResponse>>;
-    /**
-     * Verify a code. `code` is a TOTP code by default; set `type` to `otp` for an
-     * emailed or texted second factor, or `backup` to spend a recovery code.
-     */
-    verify(params: {
-        code: string;
-        factorId?: string;
-        challengeId?: string;
-        type?: 'totp' | 'otp' | 'backup';
-        /** Remember this device for the project's configured trust window. */
-        trustDevice?: boolean;
-    }): Promise<MotherbaseResponse<{
-        verified: true;
-    }>>;
-    /** Turn two-factor off. Requires the password, as enabling did. */
-    unenroll(params: {
-        password: string;
-        factorId?: string;
-    }): Promise<MotherbaseResponse<{
-        id: string;
-    }>>;
-    /** Issue a fresh set of backup codes, invalidating the previous set. */
-    regenerateBackupCodes(params: {
-        password: string;
-    }): Promise<MotherbaseResponse<{
-        backupCodes: string[];
-    }>>;
-    /**
-     * The user's factors. Reads the TOTP URI: getting one back means TOTP is
-     * enrolled, a failure means it is not. There is no list endpoint to call
-     * because there is no list, and inventing one client-side would be a lie about
-     * what the server models.
-     */
-    listFactors(): Promise<MotherbaseResponse<{
-        totp: MfaFactor[];
-        all: MfaFactor[];
-    }>>;
-}
-//# sourceMappingURL=mfa.d.ts.map

package/dist/mfa.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE;QACJ,6CAA6C;QAC7C,GAAG,EAAE,MAAM,CAAC;QACZ,2DAA2D;QAC3D,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,uEAAuE;IACvE,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAaD,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFV,IAAI,EAAE,UAAU;IACjC,+EAA+E;IAC9D,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAGlD;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IA6B3G;;;;OAIG;IACG,SAAS,CAAC,MAAM,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,GAAG,KAAK,CAAA;KAAO,GAAG,OAAO,CACrF,kBAAkB,CAAC,oBAAoB,CAAC,CACzC;IAYD;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;QACjC,sEAAsE;QACtE,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAmBnD,mEAAmE;IAC7D,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAS5G,wEAAwE;IAClE,qBAAqB,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAajH;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAAC,GAAG,EAAE,SAAS,EAAE,CAAA;KAAE,CAAC,CAAC;CAU1F"}

package/dist/mfa.js

@@ -1,134 +0,0 @@
-import { toError } from './http.js';
-const R = {
-    enable: '/api/auth/two-factor/enable',
-    disable: '/api/auth/two-factor/disable',
-    totpUri: '/api/auth/two-factor/get-totp-uri',
-    verifyTotp: '/api/auth/two-factor/verify-totp',
-    sendOtp: '/api/auth/two-factor/send-otp',
-    verifyOtp: '/api/auth/two-factor/verify-otp',
-    verifyBackupCode: '/api/auth/two-factor/verify-backup-code',
-    generateBackupCodes: '/api/auth/two-factor/generate-backup-codes',
-};
-export class MfaClient {
-    constructor(http, 
-    /** Re-reads the session after a verify, so a stepped-up token is persisted. */
-    onVerified) {
-        this.http = http;
-        this.onVerified = onVerified;
-    }
-    /**
-     * Start TOTP enrolment. Returns the otpauth URI, the secret and the backup
-     * codes. The factor is not usable until `verify()` accepts a code from it.
-     */
-    async enroll(params) {
-        try {
-            const payload = await this.http.request(R.enable, {
-                method: 'POST',
-                body: { password: params.password, ...(params.issuer ? { issuer: params.issuer } : {}) },
-                raw: true,
-            });
-            const uri = payload.totpURI ?? payload.totpUri ?? '';
-            return {
-                data: {
-                    // Better Auth has no per-factor id: the user is the factor. `totp` is
-                    // used as a stable handle so unenroll/challenge/verify have something
-                    // to take, matching the supabase-js shape.
-                    id: 'totp',
-                    type: 'totp',
-                    totp: { uri, secret: secretFromUri(uri) },
-                    backupCodes: payload.backupCodes ?? [],
-                },
-                error: null,
-            };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /**
-     * For TOTP this resolves immediately and sends nothing: the code already lives
-     * on the user's device. Pass `channel` to send a second-factor code by email
-     * or SMS instead, when the project has that enabled.
-     */
-    async challenge(params = {}) {
-        if (!params.channel) {
-            return { data: { id: params.factorId ?? 'totp', expires_at: null }, error: null };
-        }
-        try {
-            await this.http.request(R.sendOtp, { method: 'POST', body: {}, raw: true });
-            return { data: { id: params.factorId ?? 'otp', expires_at: null }, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /**
-     * Verify a code. `code` is a TOTP code by default; set `type` to `otp` for an
-     * emailed or texted second factor, or `backup` to spend a recovery code.
-     */
-    async verify(params) {
-        // All three routes take the code under the same key.
-        const route = params.type === 'backup' ? R.verifyBackupCode : params.type === 'otp' ? R.verifyOtp : R.verifyTotp;
-        try {
-            await this.http.request(route, {
-                method: 'POST',
-                body: { code: params.code, ...(params.trustDevice ? { trustDevice: true } : {}) },
-                raw: true,
-            });
-            // Verification can hand back a stepped-up session; adopt it before the
-            // caller makes its next request with the old one.
-            await this.onVerified();
-            return { data: { verified: true }, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /** Turn two-factor off. Requires the password, as enabling did. */
-    async unenroll(params) {
-        try {
-            await this.http.request(R.disable, { method: 'POST', body: { password: params.password }, raw: true });
-            return { data: { id: params.factorId ?? 'totp' }, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /** Issue a fresh set of backup codes, invalidating the previous set. */
-    async regenerateBackupCodes(params) {
-        try {
-            const payload = await this.http.request(R.generateBackupCodes, {
-                method: 'POST',
-                body: { password: params.password },
-                raw: true,
-            });
-            return { data: { backupCodes: payload.backupCodes ?? [] }, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /**
-     * The user's factors. Reads the TOTP URI: getting one back means TOTP is
-     * enrolled, a failure means it is not. There is no list endpoint to call
-     * because there is no list, and inventing one client-side would be a lie about
-     * what the server models.
-     */
-    async listFactors() {
-        try {
-            await this.http.request(R.totpUri, { method: 'POST', body: {}, raw: true });
-            const factor = { id: 'totp', factor_type: 'totp', status: 'verified', friendly_name: 'TOTP' };
-            return { data: { totp: [factor], all: [factor] }, error: null };
-        }
-        catch {
-            // Not enrolled is a normal state, not an error the caller should branch on.
-            return { data: { totp: [], all: [] }, error: null };
-        }
-    }
-}
-/** Pull the `secret` query parameter out of an otpauth:// URI. */
-function secretFromUri(uri) {
-    const match = /[?&]secret=([^&]+)/i.exec(uri);
-    return match ? decodeURIComponent(match[1]) : '';
-}
-//# sourceMappingURL=mfa.js.map

package/dist/mfa.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mfa.js","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoDpC,MAAM,CAAC,GAAG;IACR,MAAM,EAAE,6BAA6B;IACrC,OAAO,EAAE,8BAA8B;IACvC,OAAO,EAAE,mCAAmC;IAC5C,UAAU,EAAE,kCAAkC;IAC9C,OAAO,EAAE,+BAA+B;IACxC,SAAS,EAAE,iCAAiC;IAC5C,gBAAgB,EAAE,yCAAyC;IAC3D,mBAAmB,EAAE,4CAA4C;CACzD,CAAC;AAEX,MAAM,OAAO,SAAS;IACpB,YACmB,IAAgB;IACjC,+EAA+E;IAC9D,UAA+B;QAF/B,SAAI,GAAJ,IAAI,CAAY;QAEhB,eAAU,GAAV,UAAU,CAAqB;IAC/C,CAAC;IAEJ;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAA6C;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAIpC,CAAC,CAAC,MAAM,EAAE;gBACX,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBACxF,GAAG,EAAE,IAAI;aACV,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YACrD,OAAO;gBACL,IAAI,EAAE;oBACJ,sEAAsE;oBACtE,sEAAsE;oBACtE,2CAA2C;oBAC3C,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE;oBACzC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;iBACvC;gBACD,KAAK,EAAE,IAAI;aACZ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,SAA2D,EAAE;QAG3E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAOZ;QACC,qDAAqD;QACrD,MAAM,KAAK,GACT,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACrG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBACjF,GAAG,EAAE,IAAI;aACV,CAAC,CAAC;YACH,uEAAuE;YACvE,kDAAkD;YAClD,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,QAAQ,CAAC,MAA+C;QAC5D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACvG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,qBAAqB,CAAC,MAA4B;QACtD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAA6B,CAAC,CAAC,mBAAmB,EAAE;gBACzF,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACnC,GAAG,EAAE,IAAI;aACV,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAc,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;YACzG,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;CACF;AAED,kEAAkE;AAClE,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC"}