@motherbase/client 1.4.0 → 1.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@motherbase/client",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Typed client SDK for Motherbase, the open source self-hosted backend platform.",
   "type": "module",
   "main": "./dist/index.js",

package/dist/admin.d.ts

@@ -1,81 +0,0 @@
-import type { HttpClient } from './http.js';
-import type { MotherbaseResponse, User } from './types.js';
-/**
- * `client.auth.admin`, shaped like `supabase.auth.admin`.
- *
- * Every method here needs a **secret** project API key, so the client it hangs
- * off must have been built with one. A publishable key gets a 401 from the
- * server, which is the correct outcome: these calls create and delete users
- * without being any user.
- *
- * Two differences from supabase-js worth knowing before you port code:
- *
- *   * Scope. This is user administration only. Supabase's service key also opens
- *     SQL and DDL; here those stay behind operator authentication, so a leaked
- *     application key cannot drop a table.
- *   * `generateLink` has no equivalent. Better Auth issues one-time codes rather
- *     than pre-signed links, so use `auth.signInWithOtp` / `auth.verifyOtp`, or
- *     `invite()` below, which mails the credential itself.
- */
-export interface AdminListUsersParams {
-    page?: number;
-    perPage?: number;
-}
-export interface AdminUserList {
-    users: User[];
-    page: number;
-    perPage: number;
-    total: number;
-}
-export interface AdminCreateUserParams {
-    email: string;
-    password?: string;
-    username?: string;
-    role?: 'ADMIN' | 'USER';
-    /** Mark the address verified without sending a confirmation. */
-    email_confirm?: boolean;
-    /** Also email the temporary password. `invite()` is the same thing, named. */
-    sendInvite?: boolean;
-}
-export interface AdminCreatedUser {
-    user: User;
-    /** Generated when no password was supplied. Never logged by the SDK. */
-    temporaryPassword: string;
-    invited: boolean;
-}
-export interface AdminUpdateUserParams {
-    password?: string;
-    role?: 'ADMIN' | 'USER';
-    username?: string;
-    firstName?: string;
-    lastName?: string;
-    status?: string;
-}
-export declare class AuthAdminClient {
-    private readonly http;
-    constructor(http: HttpClient);
-    listUsers(params?: AdminListUsersParams): Promise<MotherbaseResponse<AdminUserList>>;
-    getUserById(id: string): Promise<MotherbaseResponse<{
-        user: User | null;
-    }>>;
-    createUser(params: AdminCreateUserParams): Promise<MotherbaseResponse<AdminCreatedUser>>;
-    updateUserById(id: string, params: AdminUpdateUserParams): Promise<MotherbaseResponse<{
-        user: User | null;
-    }>>;
-    deleteUser(id: string): Promise<MotherbaseResponse<{
-        id: string;
-    }>>;
-    /** End every session this user holds, everywhere. */
-    signOut(userId: string): Promise<MotherbaseResponse<{
-        id: string;
-    }>>;
-    /** Create the account and email the temporary password to it. */
-    inviteUserByEmail(email: string, options?: {
-        username?: string;
-        role?: 'ADMIN' | 'USER';
-    }): Promise<MotherbaseResponse<{
-        user: User;
-        invited: boolean;
-    }>>;
-}
-//# sourceMappingURL=admin.d.ts.map

package/dist/admin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,gEAAgE;IAChE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,IAAI,CAAC;IACX,wEAAwE;IACxE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,SAAS,CAAC,MAAM,GAAE,oBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAaxF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAS3E,UAAU,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IASxF,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAY/C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IASzE,qDAAqD;IAC/C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAS1E,iEAAiE;IAC3D,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAO,GAC3D,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAWjE"}

package/dist/admin.js

@@ -1,85 +0,0 @@
-import { toError } from './http.js';
-const BASE = '/api/auth/admin';
-export class AuthAdminClient {
-    constructor(http) {
-        this.http = http;
-    }
-    async listUsers(params = {}) {
-        const query = new URLSearchParams();
-        if (params.page !== undefined)
-            query.set('page', String(params.page));
-        if (params.perPage !== undefined)
-            query.set('per_page', String(params.perPage));
-        const suffix = query.toString();
-        try {
-            const data = await this.http.request(`${BASE}/users${suffix ? `?${suffix}` : ''}`);
-            return { data, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    async getUserById(id) {
-        try {
-            const data = await this.http.request(`${BASE}/users/${encodeURIComponent(id)}`);
-            return { data, error: null };
-        }
-        catch (err) {
-            return { data: { user: null }, error: toError(err) };
-        }
-    }
-    async createUser(params) {
-        try {
-            const data = await this.http.request(`${BASE}/users`, { method: 'POST', body: params });
-            return { data, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    async updateUserById(id, params) {
-        try {
-            const data = await this.http.request(`${BASE}/users/${encodeURIComponent(id)}`, {
-                method: 'PATCH',
-                body: params,
-            });
-            return { data, error: null };
-        }
-        catch (err) {
-            return { data: { user: null }, error: toError(err) };
-        }
-    }
-    async deleteUser(id) {
-        try {
-            await this.http.request(`${BASE}/users/${encodeURIComponent(id)}`, { method: 'DELETE' });
-            return { data: { id }, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /** End every session this user holds, everywhere. */
-    async signOut(userId) {
-        try {
-            await this.http.request(`${BASE}/users/${encodeURIComponent(userId)}/sign-out`, { method: 'POST' });
-            return { data: { id: userId }, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /** Create the account and email the temporary password to it. */
-    async inviteUserByEmail(email, options = {}) {
-        try {
-            const data = await this.http.request(`${BASE}/invite`, {
-                method: 'POST',
-                body: { email, ...options },
-            });
-            return { data, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-}
-//# sourceMappingURL=admin.js.map

package/dist/admin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6DpC,MAAM,IAAI,GAAG,iBAAiB,CAAC;AAE/B,MAAM,OAAO,eAAe;IAC1B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,SAAS,CAAC,SAA+B,EAAE;QAC/C,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgB,GAAG,IAAI,SAAS,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAiB,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAChG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAA6B;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAmB,GAAG,IAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1G,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,EAAU,EACV,MAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAiB,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC9F,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACzF,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,UAA0D,EAAE;QAE5D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAmC,GAAG,IAAI,SAAS,EAAE;gBACvF,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}

package/dist/auth.d.ts

@@ -1,362 +0,0 @@
-import { MfaClient } from './mfa.js';
-import { AuthAdminClient } from './admin.js';
-import type { HttpClient } from './http.js';
-import type { SessionStore } from './session.js';
-import type { AuthChangeListener, MotherbaseResponse, Session, User, UserIdentity } from './types.js';
-export interface SignUpCredentials {
-    email: string;
-    password: string;
-    /** Optional extra profile field supported by the backend. */
-    username?: string;
-}
-export interface SignInWithPasswordCredentials {
-    email: string;
-    password: string;
-}
-export interface SignInWithOtpCredentials {
-    email?: string;
-    /** E.164 phone number. Routes to the SMS one-time code flow instead. */
-    phone?: string;
-}
-export interface VerifyOtpParams {
-    email?: string;
-    /** E.164 phone number, when the code was sent by SMS. */
-    phone?: string;
-    /** The code that was sent. Named `token` for supabase-js parity. */
-    token: string;
-    /**
-     * supabase-js verification type. The channel actually follows the identifier
-     * you pass; this only disambiguates if both are present. `recovery` and
-     * `email_change` are not routed: use `resetPassword` for the first, and
-     * email changes are not supported.
-     */
-    type?: 'email' | 'sms' | 'phone_change' | 'recovery' | 'email_change' | 'signup';
-}
-export interface SignInWithOAuthCredentials {
-    /** Social provider id, e.g. 'google' or 'apple'. Must be enabled on the backend. */
-    provider: string;
-    options?: {
-        /** Where the provider should send the user back to after auth. */
-        redirectTo?: string;
-        /** Space-separated OAuth scopes. */
-        scopes?: string;
-        /** Skip the automatic `window.location` redirect and just return the URL. */
-        skipBrowserRedirect?: boolean;
-    };
-}
-export interface DeleteUserAttributes {
-    /** Required unless the session is already "fresh" (i.e. just re-authenticated). */
-    password?: string;
-    /** Deletion-confirmation token, when the backend's delete flow requires an email confirmation step. */
-    token?: string;
-    callbackURL?: string;
-}
-export interface UpdateUserAttributes {
-    /** New password. Requires `currentPassword`. The backend does not allow a
-     *  blind password change from an authenticated session. */
-    password?: string;
-    currentPassword?: string;
-    /** Arbitrary profile fields (name, image, or any custom additional field). */
-    data?: Record<string, unknown>;
-}
-/**
- * Read the token an OAuth callback left in the URL fragment and return the URL
- * with it removed, so a reload or a shared link cannot replay it.
- *
- * The provider callback cannot answer the SDK with a JSON body: it is a browser
- * redirect. The backend therefore appends `#access_token=…` to the redirect it
- * issues, the same implicit flow supabase-js reads. Exported for testing.
- */
-export declare function readAccessTokenFromUrl(href: string): {
-    accessToken: string;
-    cleanedHref: string;
-} | null;
-export interface Subscription {
-    unsubscribe(): void;
-}
-/**
- * Supabase-compatible auth client. Maps supabase-js method names onto the
- * Motherbase auth endpoints and reuses the existing token/refresh/session-store
- * machinery. Returns `{ data, error }` and never throws for expected failures.
- */
-export declare class AuthClient {
-    private readonly http;
-    private readonly store;
-    /**
-     * Two-factor, shaped like `supabase.auth.mfa`. The server has shipped TOTP
-     * from the start; this is the namespace that makes it reachable.
-     */
-    readonly mfa: MfaClient;
-    /**
-     * User administration for server code holding a secret key. Present on every
-     * client, because whether the key is secret is a server-side fact: calling
-     * these with a publishable key is a 401, not a missing method.
-     */
-    readonly admin: AuthAdminClient;
-    private autoRefreshTimer;
-    constructor(http: HttpClient, store: SessionStore);
-    signUp(credentials: SignUpCredentials): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    signInWithPassword(credentials: SignInWithPasswordCredentials): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    /**
-     * Request a password-reset OTP by email. Always resolves successfully
-     * (whether or not the email is registered) to avoid leaking account
-     * existence; check `error` only for transport/server failures.
-     */
-    resetPasswordForEmail(email: string): Promise<{
-        error: MotherbaseResponse<null>['error'];
-    }>;
-    /** Complete a password reset using the OTP sent to the user's email. */
-    resetPassword(args: {
-        email: string;
-        otp: string;
-        password: string;
-    }): Promise<{
-        error: MotherbaseResponse<null>['error'];
-    }>;
-    /**
-     * Send a one-time sign-in code, by email or by SMS. Pair with `verifyOtp` to
-     * complete the sign-in.
-     *
-     * `{ phone }` routes to the phone-number plugin, which the project has to
-     * have enabled with an SMS sender configured; without one the call resolves
-     * with the backend's error rather than pretending a code was sent.
-     */
-    signInWithOtp(credentials: SignInWithOtpCredentials): Promise<{
-        data: Record<string, never>;
-        error: MotherbaseResponse<null>['error'];
-    }>;
-    /**
-     * Send the one-time code again, supabase-js style.
-     *
-     * supabase-js names the flows `signup` (confirm a new address), `email_change`
-     * and `recovery`; Better Auth names them `email-verification` and
-     * `forget-password`. The mapping lives here so ported code keeps working.
-     * `sms` and `phone_change` re-send an SMS code through the phone-number flow.
-     */
-    resend(params: {
-        type: 'signup' | 'email_change' | 'recovery' | 'sms' | 'phone_change';
-        email?: string;
-        phone?: string;
-    }): Promise<{
-        data: Record<string, never>;
-        error: MotherbaseResponse<null>['error'];
-    }>;
-    /**
-     * Complete a `signInWithOtp` sign-in with the code that was sent.
-     *
-     * The channel follows the identifier, as in supabase-js: `{ phone }` verifies
-     * an SMS code, `{ email }` an email one. `type` is accepted for signature
-     * parity and only disambiguates when both are somehow present.
-     */
-    verifyOtp(params: VerifyOtpParams): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    /**
-     * Start an OAuth sign-in with a configured social provider. Resolves with the
-     * provider's authorize URL and, in a browser, redirects to it immediately
-     * unless `options.skipBrowserRedirect` is set.
-     */
-    signInWithOAuth(credentials: SignInWithOAuthCredentials): Promise<MotherbaseResponse<{
-        provider: string;
-        url: string | null;
-    }>>;
-    /**
-     * Start an enterprise SSO sign-in. Identify the provider by the user's email
-     * domain, by an explicit `domain`, or by `providerId` when you already know
-     * which one to use.
-     *
-     * Resolves with the identity provider's URL and, in a browser, redirects to it
-     * unless `options.skipBrowserRedirect` is set. The project must have the SSO
-     * plugin enabled and at least one provider registered (Studio →
-     * Authentication → Organizations & SSO).
-     */
-    signInWithSSO(params: {
-        domain?: string;
-        email?: string;
-        providerId?: string;
-        organizationSlug?: string;
-        options?: {
-            redirectTo?: string;
-            skipBrowserRedirect?: boolean;
-        };
-    }): Promise<MotherbaseResponse<{
-        url: string | null;
-    }>>;
-    /**
-     * Update the signed-in user's profile fields and/or password. Password
-     * changes require `currentPassword` (a Better Auth requirement. There is no
-     * blind password overwrite from an authenticated session).
-     */
-    updateUser(attributes: UpdateUserAttributes): Promise<MotherbaseResponse<{
-        user: User | null;
-    }>>;
-    /**
-     * Permanently delete the signed-in user's account. Not part of the
-     * supabase-js client surface (there it's admin-only). Kept here because
-     * self-service account deletion is a real product need. Requires the
-     * backend's `delete-user` flow to be enabled; clears the local session on
-     * success.
-     */
-    deleteUser(attributes?: DeleteUserAttributes): Promise<{
-        error: MotherbaseResponse<null>['error'];
-    }>;
-    /**
-     * Adopt an externally-obtained access token as the current session (e.g. one
-     * captured from an OAuth redirect). Validates it against the server before
-     * persisting. `refresh_token` is accepted for supabase-js signature parity
-     * and unused: Better Auth bearer sessions have none.
-     */
-    setSession(currentSession: {
-        access_token: string;
-        refresh_token?: string;
-    }): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    signOut(): Promise<{
-        error: MotherbaseResponse<null>['error'];
-    }>;
-    /**
-     * Finish an OAuth / SSO sign-in after the provider redirected back.
-     *
-     * `signInWithOAuth` only starts the flow; the session is created during the
-     * redirect the browser makes to the backend callback, so the SDK has to pick
-     * it up from the URL the browser landed on. Call this once on the page you
-     * pointed `redirectTo` at (or on app start, which is where supabase-js does
-     * the equivalent). Without it the user is signed in on the backend and signed
-     * out in your app.
-     *
-     * Resolves with a null session and no error when there is nothing to read, so
-     * it is safe to call on every page load.
-     */
-    getSessionFromUrl(href?: string): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    /** Fetch the current user from Better Auth (requires a valid session). */
-    getUser(): Promise<MotherbaseResponse<{
-        user: User | null;
-    }>>;
-    /**
-     * NEVER USE FOR AN AUTHORIZATION DECISION. Use {@link getUser} instead.
-     *
-     * The locally-held session, if any (no network call). It is whatever the
-     * caller's cookie or storage said, parsed: unsigned JSON the browser sent,
-     * which anyone can set by hand. `session.user.id`, `.email` and `.role` are
-     * therefore attacker-controlled, and an admin allowlist checked against
-     * them is checked against nothing.
-     *
-     * Reads and writes through `from()` are unaffected: they carry the access
-     * token to the backend, which verifies it under RLS. It is the decisions
-     * your own app takes from `session.user` that are forgeable.
-     *
-     * `getUser()` costs one round trip and returns the user the backend
-     * confirms, in the same `{ data, error }` shape. Prefer it everywhere but a
-     * cosmetic "am I probably signed in" check.
-     */
-    getSession(): Promise<MotherbaseResponse<{
-        session: Session | null;
-    }>>;
-    /**
-     * Revalidate the current session against the server. Better Auth bearer
-     * sessions have no refresh token: if the session is still valid the user is
-     * refreshed; otherwise the local session is cleared.
-     */
-    refreshSession(): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    /**
-     * Subscribe to auth changes, supabase-js style.
-     *
-     * The callback fires once with `INITIAL_SESSION` as soon as the stored
-     * session has been read, before any later event. That first call is not a
-     * nicety: the standard Supabase bootstrap is
-     * `if (event === 'INITIAL_SESSION') setLoading(false)`, and without it the
-     * app renders its loading state forever for a signed-out visitor, who never
-     * produces any other event.
-     *
-     * It is delivered asynchronously (after hydration), so unsubscribing
-     * synchronously suppresses it, exactly as in supabase-js.
-     */
-    /**
-     * The providers linked to the signed-in user, in the supabase-js identity
-     * shape. Backed by Better Auth's `list-accounts`, which is why `email` shows
-     * up as an identity for a password account: it is a real linked credential,
-     * exactly as in Supabase.
-     */
-    getUserIdentities(): Promise<MotherbaseResponse<{
-        identities: UserIdentity[];
-    }>>;
-    /**
-     * Link another provider to the signed-in user. Like `signInWithOAuth`, this
-     * only starts the flow: the browser is sent to the provider and comes back
-     * through the callback.
-     */
-    linkIdentity(credentials: SignInWithOAuthCredentials): Promise<MotherbaseResponse<{
-        provider: string;
-        url: string | null;
-    }>>;
-    /** Unlink a provider from the signed-in user. */
-    unlinkIdentity(identity: {
-        provider: string;
-        id?: string;
-        identity_id?: string;
-    }): Promise<MotherbaseResponse<Record<string, never>>>;
-    /**
-     * Native mobile sign-in with a provider id token (Sign in with Apple, Google
-     * One Tap), routed to Better Auth's social sign-in with an `idToken`.
-     * The provider must be configured on the backend.
-     */
-    signInWithIdToken(params: {
-        provider: string;
-        token: string;
-        access_token?: string;
-        nonce?: string;
-    }): Promise<MotherbaseResponse<{
-        user: User | null;
-        session: Session | null;
-    }>>;
-    /**
-     * Claims for the current session, as a JWT payload.
-     *
-     * supabase-js reads them out of the access token, which is itself a JWT.
-     * A Better Auth session token is an opaque bearer, so this asks the server's
-     * jwt plugin to mint one and decodes it. The decode is NOT a verification:
-     * the token came from the authenticated endpoint over TLS, and a client
-     * verifying a token it just asked for proves nothing. Verify server side,
-     * against `/api/auth/jwks`.
-     */
-    getClaims(): Promise<MotherbaseResponse<{
-        claims: Record<string, unknown>;
-        token: string;
-    }>>;
-    /**
-     * Revalidate the session on a timer, the way supabase-js does while the tab
-     * is focused. Motherbase refreshes on a 401 already, so this is opt-in: it
-     * exists so a ported app that calls it keeps working, and so a long-lived
-     * screen notices a revoked session without waiting for its next request.
-     */
-    startAutoRefresh(intervalMs?: number): void;
-    /** Stop the timer started by `startAutoRefresh`. Safe to call when none runs. */
-    stopAutoRefresh(): void;
-    onAuthStateChange(callback: AuthChangeListener): {
-        data: {
-            subscription: Subscription;
-        };
-    };
-    /**
-     * Internal: refresh used by the HttpClient's 401 path. Returns true on success.
-     * Not part of the public Supabase surface.
-     */
-    _refresh(): Promise<boolean>;
-    private persist;
-}
-//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAEV,kBAAkB,EAElB,kBAAkB,EAClB,OAAO,EACP,IAAI,EACJ,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,cAAc,GAAG,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC;CAClF;AAED,MAAM,WAAW,0BAA0B;IACzC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,kEAAkE;QAClE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oCAAoC;QACpC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6EAA6E;QAC7E,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uGAAuG;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC;+DAC2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AA4DD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUxG;AAUD,MAAM,WAAW,YAAY;IAC3B,WAAW,IAAI,IAAI,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,UAAU;IAgBT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAc,OAAO,CAAC,QAAQ,CAAC,KAAK;IAfrE;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAEhC,OAAO,CAAC,gBAAgB,CAA+C;gBAE1C,IAAI,EAAE,UAAU,EAAmB,KAAK,EAAE,YAAY;IAS7E,MAAM,CACV,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAexE,kBAAkB,CACtB,WAAW,EAAE,6BAA6B,GACzC,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAe9E;;;;OAIG;IACG,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAcjG,wEAAwE;IAClE,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAclI;;;;;;;OAOG;IACG,aAAa,CAAC,WAAW,EAAE,wBAAwB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IA0B9I;;;;;;;OAOG;IACG,MAAM,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,QAAQ,GAAG,cAAc,GAAG,UAAU,GAAG,KAAK,GAAG,cAAc,CAAC;QACtE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IA8BtF;;;;;;OAMG;IACG,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA2BrH;;;;OAIG;IACG,eAAe,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA4CrI;;;;;;;;;OASG;IACG,aAAa,CAAC,MAAM,EAAE;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAClE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA4BvD;;;;OAIG;IACG,UAAU,CAAC,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA6BtG;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,GAAE,oBAAyB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAc9G;;;;;OAKG;IACG,UAAU,CAAC,cAAc,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAiBzJ,OAAO,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAUtE;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA6B9E,0EAA0E;IACpE,OAAO,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IASnE;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAK5E;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAyBnG;;;;;;;;;;;;OAYG;IACH;;;;;OAKG;IACG,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,UAAU,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC,CAAC;IAoBtF;;;;OAIG;IACG,YAAY,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAsBlI,iDAAiD;IAC3C,cAAc,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAa3I;;;;OAIG;IACG,iBAAiB,CAAC,MAAM,EAAE;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAyB/E;;;;;;;;;OASG;IACG,SAAS,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAclG;;;;;OAKG;IACH,gBAAgB,CAAC,UAAU,SAAS,GAAG,IAAI;IAU3C,iFAAiF;IACjF,eAAe,IAAI,IAAI;IAOvB,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG;QAAE,IAAI,EAAE;YAAE,YAAY,EAAE,YAAY,CAAA;SAAE,CAAA;KAAE;IAsBzF;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;YAKpB,OAAO;CAKtB"}