@motherbase/client 1.4.0 → 1.5.0

package/dist/auth.js

@@ -1,721 +0,0 @@
-import { BackendError, toError } from './http.js';
-import { normalizeUser } from './compat.js';
-import { MfaClient } from './mfa.js';
-import { AuthAdminClient } from './admin.js';
-import { HTTP_ROUTES } from '@motherbase/contracts';
-function asIsoString(value) {
-    if (typeof value === 'string')
-        return value;
-    if (value instanceof Date)
-        return value.toISOString();
-    return null;
-}
-/**
- * Read a JWT's payload without verifying it. Base64url, so `-`/`_` are mapped
- * back and the padding is restored before decoding. Returns null for anything
- * that is not a three-part token with a JSON object payload.
- */
-function decodeJwtPayload(token) {
-    const parts = token.split('.');
-    if (parts.length !== 3)
-        return null;
-    try {
-        const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
-        const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
-        // `atob` is global in every runtime this SDK supports (browsers, Node 16+,
-        // Deno, workers). Its output is latin1, so the percent-escape round trip is
-        // what turns a multi-byte claim value back into correct UTF-8.
-        const json = decodeURIComponent(Array.from(atob(padded), c => `%${c.charCodeAt(0).toString(16).padStart(2, '0')}`).join(''));
-        const parsed = JSON.parse(json);
-        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
-    }
-    catch {
-        return null;
-    }
-}
-/** Build a clean Session from the Better Auth auth payload. */
-function toSession(payload) {
-    return { accessToken: payload.token, user: payload.user };
-}
-/**
- * Read the token an OAuth callback left in the URL fragment and return the URL
- * with it removed, so a reload or a shared link cannot replay it.
- *
- * The provider callback cannot answer the SDK with a JSON body: it is a browser
- * redirect. The backend therefore appends `#access_token=…` to the redirect it
- * issues, the same implicit flow supabase-js reads. Exported for testing.
- */
-export function readAccessTokenFromUrl(href) {
-    const hash = href.indexOf('#');
-    if (hash === -1)
-        return null;
-    const params = new URLSearchParams(href.slice(hash + 1));
-    const accessToken = params.get('access_token');
-    if (!accessToken)
-        return null;
-    params.delete('access_token');
-    params.delete('token_type');
-    const rest = params.toString();
-    return { accessToken, cleanedHref: `${href.slice(0, hash)}${rest ? `#${rest}` : ''}` };
-}
-const EVENT_MAP = {
-    signIn: 'SIGNED_IN',
-    signOut: 'SIGNED_OUT',
-    tokenRefreshed: 'TOKEN_REFRESHED',
-    userUpdated: 'USER_UPDATED',
-    mfaVerified: 'MFA_CHALLENGE_VERIFIED',
-};
-/**
- * Supabase-compatible auth client. Maps supabase-js method names onto the
- * Motherbase auth endpoints and reuses the existing token/refresh/session-store
- * machinery. Returns `{ data, error }` and never throws for expected failures.
- */
-export class AuthClient {
-    constructor(http, store) {
-        this.http = http;
-        this.store = store;
-        this.autoRefreshTimer = null;
-        // A successful verify can return a stepped-up session, so mfa re-runs the
-        // session read through the same path every other method uses.
-        this.mfa = new MfaClient(http, async () => {
-            await this.refreshSession();
-        });
-        this.admin = new AuthAdminClient(http);
-    }
-    async signUp(credentials) {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSignUp, {
-                method: 'POST',
-                body: { email: credentials.email, password: credentials.password, name: credentials.username ?? credentials.email },
-                anonymous: true,
-                raw: true,
-            });
-            const session = await this.persist(payload);
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    async signInWithPassword(credentials) {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSignIn, {
-                method: 'POST',
-                body: { email: credentials.email, password: credentials.password },
-                anonymous: true,
-                raw: true,
-            });
-            const session = await this.persist(payload);
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Request a password-reset OTP by email. Always resolves successfully
-     * (whether or not the email is registered) to avoid leaking account
-     * existence; check `error` only for transport/server failures.
-     */
-    async resetPasswordForEmail(email) {
-        try {
-            await this.http.request(HTTP_ROUTES.authRequestPasswordReset, {
-                method: 'POST',
-                body: { email },
-                anonymous: true,
-                raw: true,
-            });
-            return { error: null };
-        }
-        catch (err) {
-            return { error: toError(err) };
-        }
-    }
-    /** Complete a password reset using the OTP sent to the user's email. */
-    async resetPassword(args) {
-        try {
-            await this.http.request(HTTP_ROUTES.authResetPassword, {
-                method: 'POST',
-                body: { email: args.email, otp: args.otp, password: args.password },
-                anonymous: true,
-                raw: true,
-            });
-            return { error: null };
-        }
-        catch (err) {
-            return { error: toError(err) };
-        }
-    }
-    /**
-     * Send a one-time sign-in code, by email or by SMS. Pair with `verifyOtp` to
-     * complete the sign-in.
-     *
-     * `{ phone }` routes to the phone-number plugin, which the project has to
-     * have enabled with an SMS sender configured; without one the call resolves
-     * with the backend's error rather than pretending a code was sent.
-     */
-    async signInWithOtp(credentials) {
-        if (!credentials.email && !credentials.phone) {
-            return { data: {}, error: { message: 'signInWithOtp needs either `email` or `phone`.' } };
-        }
-        try {
-            if (credentials.phone) {
-                await this.http.request(HTTP_ROUTES.authSendPhoneOtp, {
-                    method: 'POST',
-                    body: { phoneNumber: credentials.phone },
-                    anonymous: true,
-                    raw: true,
-                });
-                return { data: {}, error: null };
-            }
-            await this.http.request(HTTP_ROUTES.authSendOtp, {
-                method: 'POST',
-                body: { email: credentials.email, type: 'sign-in' },
-                anonymous: true,
-                raw: true,
-            });
-            return { data: {}, error: null };
-        }
-        catch (err) {
-            return { data: {}, error: toError(err) };
-        }
-    }
-    /**
-     * Send the one-time code again, supabase-js style.
-     *
-     * supabase-js names the flows `signup` (confirm a new address), `email_change`
-     * and `recovery`; Better Auth names them `email-verification` and
-     * `forget-password`. The mapping lives here so ported code keeps working.
-     * `sms` and `phone_change` re-send an SMS code through the phone-number flow.
-     */
-    async resend(params) {
-        if (params.type === 'sms' || params.type === 'phone_change') {
-            if (!params.phone)
-                return { data: {}, error: { message: '`phone` is required.' } };
-            return this.signInWithOtp({ phone: params.phone });
-        }
-        const OTP_TYPE = {
-            signup: 'email-verification',
-            email_change: 'email-verification',
-            recovery: 'forget-password',
-        };
-        const type = OTP_TYPE[params.type];
-        if (!type) {
-            return { data: {}, error: { message: `resend({ type: '${params.type}' }) is not supported.` } };
-        }
-        if (!params.email) {
-            return { data: {}, error: { message: '`email` is required.' } };
-        }
-        try {
-            await this.http.request(HTTP_ROUTES.authSendOtp, {
-                method: 'POST',
-                body: { email: params.email, type },
-                anonymous: true,
-                raw: true,
-            });
-            return { data: {}, error: null };
-        }
-        catch (err) {
-            return { data: {}, error: toError(err) };
-        }
-    }
-    /**
-     * Complete a `signInWithOtp` sign-in with the code that was sent.
-     *
-     * The channel follows the identifier, as in supabase-js: `{ phone }` verifies
-     * an SMS code, `{ email }` an email one. `type` is accepted for signature
-     * parity and only disambiguates when both are somehow present.
-     */
-    async verifyOtp(params) {
-        if (!params.email && !params.phone) {
-            return { data: { user: null, session: null }, error: { message: 'verifyOtp needs either `email` or `phone`.' } };
-        }
-        try {
-            const bySms = Boolean(params.phone) && params.type !== 'email';
-            const payload = await this.http.request(bySms ? HTTP_ROUTES.authVerifyPhoneOtp : HTTP_ROUTES.authSignInEmailOtp, {
-                method: 'POST',
-                body: bySms
-                    ? { phoneNumber: params.phone, code: params.token }
-                    : { email: params.email, otp: params.token },
-                anonymous: true,
-                raw: true,
-            });
-            if (!payload?.token) {
-                return { data: { user: null, session: null }, error: { message: 'The code did not produce a session.' } };
-            }
-            const session = await this.persist(payload);
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Start an OAuth sign-in with a configured social provider. Resolves with the
-     * provider's authorize URL and, in a browser, redirects to it immediately
-     * unless `options.skipBrowserRedirect` is set.
-     */
-    async signInWithOAuth(credentials) {
-        // In a browser, hand the whole handshake to a top-level navigation. Starting
-        // it with a fetch makes the OAuth state cookie a cross-site write, which
-        // Safari and Firefox drop outright and Chrome drops in incognito, and the
-        // callback then fails with state_mismatch. Navigating to the backend's own
-        // origin makes that cookie first-party, so a plain SameSite=Lax cookie
-        // survives everywhere. The backend redirects on from there.
-        if (typeof window !== 'undefined' && !credentials.options?.skipBrowserRedirect) {
-            const params = new URLSearchParams();
-            if (credentials.options?.redirectTo)
-                params.set('callbackURL', credentials.options.redirectTo);
-            const query = params.toString();
-            const url = this.http.url(`${HTTP_ROUTES.authSignInSocial}/${encodeURIComponent(credentials.provider)}${query ? `?${query}` : ''}`);
-            window.location.href = url;
-            return { data: { provider: credentials.provider, url }, error: null };
-        }
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSignInSocial, {
-                method: 'POST',
-                body: {
-                    provider: credentials.provider,
-                    callbackURL: credentials.options?.redirectTo,
-                    scopes: credentials.options?.scopes ? credentials.options.scopes.split(' ') : undefined,
-                    disableRedirect: true,
-                },
-                anonymous: true,
-                raw: true,
-                // The server answers with a signed OAuth state cookie it checks again on
-                // the provider callback. Without 'include' the browser drops that cookie
-                // on a cross-origin call and every callback fails with state_mismatch.
-                credentials: 'include',
-            });
-            const url = payload?.url ?? null;
-            if (url && !credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {
-                window.location.href = url;
-            }
-            return { data: { provider: credentials.provider, url }, error: null };
-        }
-        catch (err) {
-            return { data: { provider: credentials.provider, url: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Start an enterprise SSO sign-in. Identify the provider by the user's email
-     * domain, by an explicit `domain`, or by `providerId` when you already know
-     * which one to use.
-     *
-     * Resolves with the identity provider's URL and, in a browser, redirects to it
-     * unless `options.skipBrowserRedirect` is set. The project must have the SSO
-     * plugin enabled and at least one provider registered (Studio →
-     * Authentication → Organizations & SSO).
-     */
-    async signInWithSSO(params) {
-        if (!params.domain && !params.email && !params.providerId && !params.organizationSlug) {
-            return { data: { url: null }, error: { message: 'signInWithSSO needs a domain, email, providerId or organizationSlug' } };
-        }
-        try {
-            const payload = await this.http.request('/api/auth/sign-in/sso', {
-                method: 'POST',
-                body: {
-                    ...(params.domain ? { domain: params.domain } : {}),
-                    ...(params.email ? { email: params.email } : {}),
-                    ...(params.providerId ? { providerId: params.providerId } : {}),
-                    ...(params.organizationSlug ? { organizationSlug: params.organizationSlug } : {}),
-                    callbackURL: params.options?.redirectTo,
-                },
-                anonymous: true,
-                raw: true,
-                credentials: 'include', // Same OAuth state cookie as signInWithOAuth.
-            });
-            const url = payload?.url ?? null;
-            if (url && !params.options?.skipBrowserRedirect && typeof window !== 'undefined') {
-                window.location.href = url;
-            }
-            return { data: { url }, error: null };
-        }
-        catch (err) {
-            return { data: { url: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Update the signed-in user's profile fields and/or password. Password
-     * changes require `currentPassword` (a Better Auth requirement. There is no
-     * blind password overwrite from an authenticated session).
-     */
-    async updateUser(attributes) {
-        try {
-            if (attributes.data && Object.keys(attributes.data).length > 0) {
-                await this.http.request(HTTP_ROUTES.authUpdateUser, { method: 'POST', body: attributes.data, raw: true });
-            }
-            if (attributes.password) {
-                if (!attributes.currentPassword) {
-                    return { data: { user: null }, error: { message: '`currentPassword` is required to change the password.' } };
-                }
-                await this.http.request(HTTP_ROUTES.authChangePassword, {
-                    method: 'POST',
-                    body: { newPassword: attributes.password, currentPassword: attributes.currentPassword },
-                    raw: true,
-                });
-            }
-            const result = await this.getUser();
-            // supabase-js emits USER_UPDATED here, and apps re-read the profile off
-            // that event rather than off the return value. Refresh the stored session
-            // so the user the listener receives is the updated one.
-            const current = this.store.get();
-            if (result.data?.user && current) {
-                await this.store.set({ ...current, user: result.data.user }, 'userUpdated');
-            }
-            return result;
-        }
-        catch (err) {
-            return { data: { user: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Permanently delete the signed-in user's account. Not part of the
-     * supabase-js client surface (there it's admin-only). Kept here because
-     * self-service account deletion is a real product need. Requires the
-     * backend's `delete-user` flow to be enabled; clears the local session on
-     * success.
-     */
-    async deleteUser(attributes = {}) {
-        try {
-            await this.http.request(HTTP_ROUTES.authDeleteUser, {
-                method: 'POST',
-                body: attributes,
-                raw: true,
-            });
-            await this.store.set(null, 'signOut');
-            return { error: null };
-        }
-        catch (err) {
-            return { error: toError(err) };
-        }
-    }
-    /**
-     * Adopt an externally-obtained access token as the current session (e.g. one
-     * captured from an OAuth redirect). Validates it against the server before
-     * persisting. `refresh_token` is accepted for supabase-js signature parity
-     * and unused: Better Auth bearer sessions have none.
-     */
-    async setSession(currentSession) {
-        await this.store.set({ accessToken: currentSession.access_token, user: { id: '', email: '' } }, 'signIn');
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSession, { raw: true });
-            if (!payload?.user) {
-                await this.store.set(null, 'signOut');
-                return { data: { user: null, session: null }, error: { message: 'Invalid session' } };
-            }
-            const session = { accessToken: currentSession.access_token, user: payload.user };
-            await this.store.set(session, 'signIn');
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            await this.store.set(null, 'signOut');
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    async signOut() {
-        try {
-            await this.http.request(HTTP_ROUTES.authSignOut, { method: 'POST', raw: true });
-        }
-        catch {
-            // best-effort; clear locally regardless
-        }
-        await this.store.set(null, 'signOut');
-        return { error: null };
-    }
-    /**
-     * Finish an OAuth / SSO sign-in after the provider redirected back.
-     *
-     * `signInWithOAuth` only starts the flow; the session is created during the
-     * redirect the browser makes to the backend callback, so the SDK has to pick
-     * it up from the URL the browser landed on. Call this once on the page you
-     * pointed `redirectTo` at (or on app start, which is where supabase-js does
-     * the equivalent). Without it the user is signed in on the backend and signed
-     * out in your app.
-     *
-     * Resolves with a null session and no error when there is nothing to read, so
-     * it is safe to call on every page load.
-     */
-    async getSessionFromUrl(href) {
-        const url = href ?? (typeof window !== 'undefined' ? window.location.href : undefined);
-        const found = url ? readAccessTokenFromUrl(url) : null;
-        if (!found)
-            return { data: { user: null, session: null }, error: null };
-        // Strip the token before the network call: a failed lookup must not leave a
-        // usable token sitting in the address bar or in the back/forward history.
-        if (!href && typeof window !== 'undefined') {
-            window.history?.replaceState?.(window.history.state, '', found.cleanedHref);
-        }
-        try {
-            // Resolve the user with the token explicitly rather than storing it first:
-            // a rejected token must not emit a SIGNED_IN event carrying a null user.
-            const payload = await this.http.request(HTTP_ROUTES.authSession, {
-                raw: true,
-                anonymous: true,
-                headers: { Authorization: `Bearer ${found.accessToken}` },
-            });
-            if (!payload?.user) {
-                return { data: { user: null, session: null }, error: { message: 'OAuth session is no longer valid' } };
-            }
-            const session = await this.persist({ token: found.accessToken, user: payload.user });
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    /** Fetch the current user from Better Auth (requires a valid session). */
-    async getUser() {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSession, { raw: true });
-            return { data: { user: normalizeUser(payload?.user) }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null }, error: toError(err) };
-        }
-    }
-    /**
-     * NEVER USE FOR AN AUTHORIZATION DECISION. Use {@link getUser} instead.
-     *
-     * The locally-held session, if any (no network call). It is whatever the
-     * caller's cookie or storage said, parsed: unsigned JSON the browser sent,
-     * which anyone can set by hand. `session.user.id`, `.email` and `.role` are
-     * therefore attacker-controlled, and an admin allowlist checked against
-     * them is checked against nothing.
-     *
-     * Reads and writes through `from()` are unaffected: they carry the access
-     * token to the backend, which verifies it under RLS. It is the decisions
-     * your own app takes from `session.user` that are forgeable.
-     *
-     * `getUser()` costs one round trip and returns the user the backend
-     * confirms, in the same `{ data, error }` shape. Prefer it everywhere but a
-     * cosmetic "am I probably signed in" check.
-     */
-    async getSession() {
-        await this.store.hydrate();
-        return { data: { session: this.store.get() }, error: null };
-    }
-    /**
-     * Revalidate the current session against the server. Better Auth bearer
-     * sessions have no refresh token: if the session is still valid the user is
-     * refreshed; otherwise the local session is cleared.
-     */
-    async refreshSession() {
-        await this.store.hydrate();
-        const current = this.store.get();
-        if (!current?.accessToken) {
-            return { data: { user: null, session: null }, error: { message: 'Auth session missing!' } };
-        }
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSession, { raw: true, _retry: true });
-            if (!payload?.user) {
-                await this.store.set(null, 'signOut');
-                return { data: { user: null, session: null }, error: { message: 'Session expired' } };
-            }
-            const session = { accessToken: current.accessToken, user: payload.user };
-            await this.store.set(session, 'tokenRefreshed');
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            // Only a rejected token clears the session. A network failure or a 5xx
-            // must leave it intact: middleware runs this on every navigation, so
-            // one backend hiccup would otherwise sign the user out.
-            const status = err instanceof BackendError ? err.httpStatus : 0;
-            if (status === 401 || status === 403)
-                await this.store.set(null, 'signOut');
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Subscribe to auth changes, supabase-js style.
-     *
-     * The callback fires once with `INITIAL_SESSION` as soon as the stored
-     * session has been read, before any later event. That first call is not a
-     * nicety: the standard Supabase bootstrap is
-     * `if (event === 'INITIAL_SESSION') setLoading(false)`, and without it the
-     * app renders its loading state forever for a signed-out visitor, who never
-     * produces any other event.
-     *
-     * It is delivered asynchronously (after hydration), so unsubscribing
-     * synchronously suppresses it, exactly as in supabase-js.
-     */
-    /**
-     * The providers linked to the signed-in user, in the supabase-js identity
-     * shape. Backed by Better Auth's `list-accounts`, which is why `email` shows
-     * up as an identity for a password account: it is a real linked credential,
-     * exactly as in Supabase.
-     */
-    async getUserIdentities() {
-        try {
-            const accounts = await this.http.request(HTTP_ROUTES.authListAccounts, { raw: true });
-            const userId = this.store.get()?.user?.id ?? '';
-            const identities = (accounts ?? []).map(account => ({
-                id: account.accountId ?? account.id,
-                identity_id: account.id,
-                user_id: userId,
-                provider: account.providerId,
-                identity_data: { sub: account.accountId, ...(account.scopes ? { scopes: account.scopes } : {}) },
-                created_at: asIsoString(account.createdAt),
-                updated_at: asIsoString(account.updatedAt),
-                last_sign_in_at: asIsoString(account.updatedAt),
-            }));
-            return { data: { identities }, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /**
-     * Link another provider to the signed-in user. Like `signInWithOAuth`, this
-     * only starts the flow: the browser is sent to the provider and comes back
-     * through the callback.
-     */
-    async linkIdentity(credentials) {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authLinkSocial, {
-                method: 'POST',
-                body: {
-                    provider: credentials.provider,
-                    callbackURL: credentials.options?.redirectTo,
-                    scopes: credentials.options?.scopes?.split(/\s+/).filter(Boolean),
-                },
-                credentials: 'include',
-                raw: true,
-            });
-            const url = payload?.url ?? null;
-            if (url && !credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {
-                window.location.assign(url);
-            }
-            return { data: { provider: credentials.provider, url }, error: null };
-        }
-        catch (err) {
-            return { data: { provider: credentials.provider, url: null }, error: toError(err) };
-        }
-    }
-    /** Unlink a provider from the signed-in user. */
-    async unlinkIdentity(identity) {
-        try {
-            await this.http.request(HTTP_ROUTES.authUnlinkAccount, {
-                method: 'POST',
-                body: { providerId: identity.provider, accountId: identity.id },
-                raw: true,
-            });
-            return { data: {}, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /**
-     * Native mobile sign-in with a provider id token (Sign in with Apple, Google
-     * One Tap), routed to Better Auth's social sign-in with an `idToken`.
-     * The provider must be configured on the backend.
-     */
-    async signInWithIdToken(params) {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSignInSocial, {
-                method: 'POST',
-                body: {
-                    provider: params.provider,
-                    idToken: {
-                        token: params.token,
-                        ...(params.access_token ? { accessToken: params.access_token } : {}),
-                        ...(params.nonce ? { nonce: params.nonce } : {}),
-                    },
-                },
-                anonymous: true,
-                raw: true,
-            });
-            if (!payload?.token) {
-                return { data: { user: null, session: null }, error: { message: 'The provider did not return a session.' } };
-            }
-            const session = await this.persist(payload);
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Claims for the current session, as a JWT payload.
-     *
-     * supabase-js reads them out of the access token, which is itself a JWT.
-     * A Better Auth session token is an opaque bearer, so this asks the server's
-     * jwt plugin to mint one and decodes it. The decode is NOT a verification:
-     * the token came from the authenticated endpoint over TLS, and a client
-     * verifying a token it just asked for proves nothing. Verify server side,
-     * against `/api/auth/jwks`.
-     */
-    async getClaims() {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authToken, { raw: true });
-            const token = payload?.token;
-            const claims = token ? decodeJwtPayload(token) : null;
-            if (!token || !claims) {
-                return { data: null, error: { message: 'No JWT is available for this session.' } };
-            }
-            return { data: { claims, token }, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /**
-     * Revalidate the session on a timer, the way supabase-js does while the tab
-     * is focused. Motherbase refreshes on a 401 already, so this is opt-in: it
-     * exists so a ported app that calls it keeps working, and so a long-lived
-     * screen notices a revoked session without waiting for its next request.
-     */
-    startAutoRefresh(intervalMs = 60000) {
-        this.stopAutoRefresh();
-        this.autoRefreshTimer = setInterval(() => {
-            if (this.store.get())
-                void this.refreshSession();
-        }, intervalMs);
-        // Node keeps the process alive for a pending timer; a background refresh
-        // must never be the reason a script does not exit.
-        this.autoRefreshTimer.unref?.();
-    }
-    /** Stop the timer started by `startAutoRefresh`. Safe to call when none runs. */
-    stopAutoRefresh() {
-        if (this.autoRefreshTimer !== null) {
-            clearInterval(this.autoRefreshTimer);
-            this.autoRefreshTimer = null;
-        }
-    }
-    onAuthStateChange(callback) {
-        let active = true;
-        const unsubscribeStore = this.store.subscribe((event, session) => {
-            if (active)
-                callback(EVENT_MAP[event], session);
-        });
-        void this.store.hydrate().then(session => {
-            if (active)
-                callback('INITIAL_SESSION', session);
-        });
-        return {
-            data: {
-                subscription: {
-                    unsubscribe: () => {
-                        active = false;
-                        unsubscribeStore();
-                    },
-                },
-            },
-        };
-    }
-    /**
-     * Internal: refresh used by the HttpClient's 401 path. Returns true on success.
-     * Not part of the public Supabase surface.
-     */
-    async _refresh() {
-        const result = await this.refreshSession();
-        return result.error === null;
-    }
-    async persist(payload) {
-        const session = toSession(payload);
-        await this.store.set(session, 'signIn');
-        return session;
-    }
-}
-//# sourceMappingURL=auth.js.map