@motherbase/client 1.4.0 → 1.5.1

package/dist/admin.d.ts

@@ -13,9 +13,9 @@ import type { MotherbaseResponse, User } from './types.js';
  *   * Scope. This is user administration only. Supabase's service key also opens
  *     SQL and DDL; here those stay behind operator authentication, so a leaked
  *     application key cannot drop a table.
- *   * `generateLink` has no equivalent. Better Auth issues one-time codes rather
- *     than pre-signed links, so use `auth.signInWithOtp` / `auth.verifyOtp`, or
- *     `invite()` below, which mails the credential itself.
+ *   * `generateLink` covers signup, invite, magiclink and recovery. Recovery is
+ *     code-based here, so it returns `email_otp` and no `action_link`, and the
+ *     `email_change_*` types are refused.
  */
 export interface AdminListUsersParams {
     page?: number;
@@ -51,9 +51,59 @@ export interface AdminUpdateUserParams {
     lastName?: string;
     status?: string;
 }
+export interface AdminGenerateLinkParams {
+    type: 'signup' | 'invite' | 'magiclink' | 'recovery' | 'email_change_current' | 'email_change_new';
+    email: string;
+    /** Required for `signup`. */
+    password?: string;
+    newEmail?: string;
+    options?: {
+        redirectTo?: string;
+        data?: Record<string, unknown>;
+    };
+}
+export interface AdminGeneratedLink {
+    properties: {
+        /** The link the email would carry. Null for `recovery`, which is code-based here. */
+        action_link: string | null;
+        email_otp: string | null;
+        hashed_token: string | null;
+        redirect_to: string | null;
+        verification_type: string;
+    };
+    user: User | null;
+}
+/** A supabase-js `Factor`: TOTP from two-factor, and each passkey as `webauthn`. */
+export interface AdminMfaFactor {
+    id: string;
+    factor_type: 'totp' | 'webauthn';
+    status: 'verified' | 'unverified';
+    friendly_name: string;
+    created_at: string | null;
+    updated_at: string | null;
+}
+/** `auth.admin.mfa`, shaped like supabase-js. */
+export declare class AuthAdminMfaClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    listFactors(params: {
+        userId: string;
+    }): Promise<MotherbaseResponse<{
+        factors: AdminMfaFactor[];
+    }>>;
+    deleteFactor(params: {
+        userId: string;
+        id: string;
+    }): Promise<MotherbaseResponse<{
+        id: string;
+    }>>;
+}
 export declare class AuthAdminClient {
     private readonly http;
+    readonly mfa: AuthAdminMfaClient;
     constructor(http: HttpClient);
+    /** The link (or code) an auth email would carry, returned instead of sent. */
+    generateLink(params: AdminGenerateLinkParams): Promise<MotherbaseResponse<AdminGeneratedLink>>;
     listUsers(params?: AdminListUsersParams): Promise<MotherbaseResponse<AdminUserList>>;
     getUserById(id: string): Promise<MotherbaseResponse<{
         user: User | null;

package/dist/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,gEAAgE;IAChE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,IAAI,CAAC;IACX,wEAAwE;IACxE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,SAAS,CAAC,MAAM,GAAE,oBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAaxF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAS3E,UAAU,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IASxF,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAY/C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IASzE,qDAAqD;IAC/C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAS1E,iEAAiE;IAC3D,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAO,GAC3D,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAWjE"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,gEAAgE;IAChE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,IAAI,CAAC;IACX,wEAAwE;IACxE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,sBAAsB,GAAG,kBAAkB,CAAC;IACnG,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CACnE;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE;QACV,qFAAqF;QACrF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;CACnB;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAID,iDAAiD;AACjD,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,cAAc,EAAE,CAAA;KAAE,CAAC,CAAC;IAWnG,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAWxG;AAED,qBAAa,eAAe;IAGd,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;gBAEJ,IAAI,EAAE,UAAU;IAI7C,8EAA8E;IACxE,YAAY,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;IAS9F,SAAS,CAAC,MAAM,GAAE,oBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAaxF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAS3E,UAAU,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IASxF,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAY/C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IASzE,qDAAqD;IAC/C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAS1E,iEAAiE;IAC3D,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAO,GAC3D,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAWjE"}

package/dist/admin.js

@@ -1,8 +1,44 @@
 import { toError } from './http.js';
-const BASE = '/api/auth/admin';
+import { HTTP_ROUTES } from '@motherbase/contracts';
+const BASE = HTTP_ROUTES.authAdmin;
+/** `auth.admin.mfa`, shaped like supabase-js. */
+export class AuthAdminMfaClient {
+    constructor(http) {
+        this.http = http;
+    }
+    async listFactors(params) {
+        try {
+            const data = await this.http.request(`${BASE}/users/${encodeURIComponent(params.userId)}/factors`);
+            return { data, error: null };
+        }
+        catch (err) {
+            return { data: null, error: toError(err) };
+        }
+    }
+    async deleteFactor(params) {
+        try {
+            const data = await this.http.request(`${BASE}/users/${encodeURIComponent(params.userId)}/factors/${encodeURIComponent(params.id)}`, { method: 'DELETE' });
+            return { data, error: null };
+        }
+        catch (err) {
+            return { data: null, error: toError(err) };
+        }
+    }
+}
 export class AuthAdminClient {
     constructor(http) {
         this.http = http;
+        this.mfa = new AuthAdminMfaClient(http);
+    }
+    /** The link (or code) an auth email would carry, returned instead of sent. */
+    async generateLink(params) {
+        try {
+            const data = await this.http.request(`${BASE}/generate-link`, { method: 'POST', body: params });
+            return { data, error: null };
+        }
+        catch (err) {
+            return { data: null, error: toError(err) };
+        }
     }
     async listUsers(params = {}) {
         const query = new URLSearchParams();

package/dist/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6DpC,MAAM,IAAI,GAAG,iBAAiB,CAAC;AAE/B,MAAM,OAAO,eAAe;IAC1B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,SAAS,CAAC,SAA+B,EAAE;QAC/C,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgB,GAAG,IAAI,SAAS,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAiB,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAChG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAA6B;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAmB,GAAG,IAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1G,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,EAAU,EACV,MAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAiB,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC9F,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACzF,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,UAA0D,EAAE;QAE5D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAmC,GAAG,IAAI,SAAS,EAAE;gBACvF,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AA4FpD,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC;AAEnC,iDAAiD;AACjD,MAAM,OAAO,kBAAkB;IAC7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,WAAW,CAAC,MAA0B;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAClC,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAC7D,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAsC;QACvD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAClC,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAC7F,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IAG1B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;QAC3C,IAAI,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,YAAY,CAAC,MAA+B;QAChD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAqB,GAAG,IAAI,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACpH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,SAA+B,EAAE;QAC/C,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgB,GAAG,IAAI,SAAS,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAiB,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAChG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAA6B;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAmB,GAAG,IAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1G,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,EAAU,EACV,MAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAiB,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC9F,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACzF,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,UAA0D,EAAE;QAE5D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAmC,GAAG,IAAI,SAAS,EAAE;gBACvF,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}

package/dist/auth.d.ts

@@ -1,22 +1,46 @@
 import { MfaClient } from './mfa.js';
 import { AuthAdminClient } from './admin.js';
+import { type VerifierStore } from './pkce.js';
+import { OrganizationClient } from './organization.js';
+import { PasskeyClient } from './passkey.js';
+import { SsoClient } from './sso.js';
 import type { HttpClient } from './http.js';
 import type { SessionStore } from './session.js';
 import type { AuthChangeListener, MotherbaseResponse, Session, User, UserIdentity } from './types.js';
+/**
+ * The CAPTCHA response token from the hCaptcha or Turnstile widget. Required
+ * by every guarded endpoint once the project turns CAPTCHA protection on
+ * (Studio → Authentication → Attack Protection), exactly as in supabase-js.
+ */
+export interface CaptchaOptions {
+    captchaToken?: string;
+}
 export interface SignUpCredentials {
     email: string;
     password: string;
     /** Optional extra profile field supported by the backend. */
     username?: string;
+    options?: CaptchaOptions & {
+        /** Where the email-verification link sends the user. Must be an allowed redirect URL. */
+        emailRedirectTo?: string;
+    };
 }
 export interface SignInWithPasswordCredentials {
     email: string;
     password: string;
+    options?: CaptchaOptions;
 }
 export interface SignInWithOtpCredentials {
     email?: string;
     /** E.164 phone number. Routes to the SMS one-time code flow instead. */
     phone?: string;
+    options?: CaptchaOptions;
+}
+export interface SignInAnonymouslyCredentials {
+    options?: CaptchaOptions & {
+        /** Profile fields for the guest, stored like `updateUser({ data })`. */
+        data?: Record<string, unknown>;
+    };
 }
 export interface VerifyOtpParams {
     email?: string;
@@ -52,10 +76,21 @@ export interface DeleteUserAttributes {
     callbackURL?: string;
 }
 export interface UpdateUserAttributes {
-    /** New password. Requires `currentPassword`. The backend does not allow a
-     *  blind password change from an authenticated session. */
+    /**
+     * Give an anonymous user an email address, which makes it permanent. The id
+     * does not change, so everything the guest owned stays owned. A permanent
+     * user cannot change its address through this call.
+     */
+    email?: string;
+    /**
+     * New password. Replacing an existing one takes either `currentPassword` or
+     * the `nonce` that `reauthenticate()` emailed. A user with no password yet
+     * (a converted guest, a social sign-in) needs neither.
+     */
     password?: string;
     currentPassword?: string;
+    /** The code from `reauthenticate()`. */
+    nonce?: string;
     /** Arbitrary profile fields (name, image, or any custom additional field). */
     data?: Record<string, unknown>;
 }
@@ -74,6 +109,12 @@ export declare function readAccessTokenFromUrl(href: string): {
 export interface Subscription {
     unsubscribe(): void;
 }
+export interface AuthClientOptions {
+    /** `pkce` makes OAuth and SSO redirects come back with `?code=` for `exchangeCodeForSession`. */
+    flowType?: 'implicit' | 'pkce';
+    /** Where the PKCE verifier waits out the redirect. Defaults to localStorage, else memory. */
+    verifiers?: VerifierStore;
+}
 /**
  * Supabase-compatible auth client. Maps supabase-js method names onto the
  * Motherbase auth endpoints and reuses the existing token/refresh/session-store
@@ -93,8 +134,19 @@ export declare class AuthClient {
      * these with a publishable key is a 401, not a missing method.
      */
     readonly admin: AuthAdminClient;
+    /**
+     * End-user organizations, members, invitations and teams. Not part of
+     * supabase-js; method names follow Better Auth's organization client.
+     */
+    readonly organization: OrganizationClient;
+    /** The signed-in user's passkeys. Signing in with one is `signInWithPasskey`. */
+    readonly passkey: PasskeyClient;
+    /** Identity providers registered at runtime. Signing in through one is `signInWithSSO`. */
+    readonly sso: SsoClient;
     private autoRefreshTimer;
-    constructor(http: HttpClient, store: SessionStore);
+    private readonly flowType;
+    private readonly verifiers;
+    constructor(http: HttpClient, store: SessionStore, options?: AuthClientOptions);
     signUp(credentials: SignUpCredentials): Promise<MotherbaseResponse<{
         user: User | null;
         session: Session | null;
@@ -103,12 +155,32 @@ export declare class AuthClient {
         user: User | null;
         session: Session | null;
     }>>;
+    /**
+     * Sign in as a new guest, supabase-js style. The project must allow
+     * anonymous sign-ins (Studio → Authentication → Sign In / Providers).
+     *
+     * The guest is a real user whose `is_anonymous` is true, and RLS sees the
+     * same flag as the `is_anonymous` claim. Make it permanent without changing
+     * its id with `updateUser({ email })` or `linkIdentity()`.
+     */
+    signInAnonymously(credentials?: SignInAnonymouslyCredentials): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
+    /**
+     * Email the signed-in user a one-time nonce, then pass it to
+     * `updateUser({ password, nonce })`. GoTrue's "secure password change".
+     */
+    reauthenticate(): Promise<MotherbaseResponse<{
+        user: null;
+        session: null;
+    }>>;
     /**
      * Request a password-reset OTP by email. Always resolves successfully
      * (whether or not the email is registered) to avoid leaking account
      * existence; check `error` only for transport/server failures.
      */
-    resetPasswordForEmail(email: string): Promise<{
+    resetPasswordForEmail(email: string, options?: CaptchaOptions): Promise<{
         error: MotherbaseResponse<null>['error'];
     }>;
     /** Complete a password reset using the OTP sent to the user's email. */
@@ -167,6 +239,15 @@ export declare class AuthClient {
         provider: string;
         url: string | null;
     }>>;
+    /**
+     * Sign in with a passkey saved on this device or a synced one. Opens the
+     * browser's passkey prompt; dismissing it resolves with an error, not a throw.
+     * Needs Auth · Passkey on and a browser (see `auth.passkey`).
+     */
+    signInWithPasskey(): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
     /**
      * Start an enterprise SSO sign-in. Identify the provider by the user's email
      * domain, by an explicit `domain`, or by `providerId` when you already know
@@ -240,6 +321,22 @@ export declare class AuthClient {
         user: User | null;
         session: Session | null;
     }>>;
+    /**
+     * Finish a PKCE sign-in: trade the `?code=` the provider redirect came back
+     * with for the session. Needs the verifier `signInWithOAuth` stored, so it
+     * works once, in the browser that started the flow.
+     */
+    exchangeCodeForSession(authCode: string): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
+    /**
+     * The redirect a flow should use. Implicit: as given. PKCE: with a fresh
+     * challenge on it, the verifier stored for `exchangeCodeForSession`; the
+     * challenge rides on the redirect URL, so PKCE needs one, and in a browser
+     * the current page stands in when none is given.
+     */
+    private redirectForFlow;
     /** Fetch the current user from Better Auth (requires a valid session). */
     getUser(): Promise<MotherbaseResponse<{
         user: User | null;

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAEV,kBAAkB,EAElB,kBAAkB,EAClB,OAAO,EACP,IAAI,EACJ,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,cAAc,GAAG,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC;CAClF;AAED,MAAM,WAAW,0BAA0B;IACzC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,kEAAkE;QAClE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oCAAoC;QACpC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6EAA6E;QAC7E,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uGAAuG;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC;+DAC2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AA4DD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUxG;AAUD,MAAM,WAAW,YAAY;IAC3B,WAAW,IAAI,IAAI,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,UAAU;IAgBT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAc,OAAO,CAAC,QAAQ,CAAC,KAAK;IAfrE;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAEhC,OAAO,CAAC,gBAAgB,CAA+C;gBAE1C,IAAI,EAAE,UAAU,EAAmB,KAAK,EAAE,YAAY;IAS7E,MAAM,CACV,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAexE,kBAAkB,CACtB,WAAW,EAAE,6BAA6B,GACzC,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAe9E;;;;OAIG;IACG,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAcjG,wEAAwE;IAClE,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAclI;;;;;;;OAOG;IACG,aAAa,CAAC,WAAW,EAAE,wBAAwB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IA0B9I;;;;;;;OAOG;IACG,MAAM,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,QAAQ,GAAG,cAAc,GAAG,UAAU,GAAG,KAAK,GAAG,cAAc,CAAC;QACtE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IA8BtF;;;;;;OAMG;IACG,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA2BrH;;;;OAIG;IACG,eAAe,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA4CrI;;;;;;;;;OASG;IACG,aAAa,CAAC,MAAM,EAAE;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAClE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA4BvD;;;;OAIG;IACG,UAAU,CAAC,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA6BtG;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,GAAE,oBAAyB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAc9G;;;;;OAKG;IACG,UAAU,CAAC,cAAc,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAiBzJ,OAAO,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAUtE;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA6B9E,0EAA0E;IACpE,OAAO,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IASnE;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAK5E;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAyBnG;;;;;;;;;;;;OAYG;IACH;;;;;OAKG;IACG,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,UAAU,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC,CAAC;IAoBtF;;;;OAIG;IACG,YAAY,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAsBlI,iDAAiD;IAC3C,cAAc,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAa3I;;;;OAIG;IACG,iBAAiB,CAAC,MAAM,EAAE;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAyB/E;;;;;;;;;OASG;IACG,SAAS,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAclG;;;;;OAKG;IACH,gBAAgB,CAAC,UAAU,SAAS,GAAG,IAAI;IAU3C,iFAAiF;IACjF,eAAe,IAAI,IAAI;IAOvB,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG;QAAE,IAAI,EAAE;YAAE,YAAY,EAAE,YAAY,CAAA;SAAE,CAAA;KAAE;IAsBzF;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;YAKpB,OAAO;CAKtB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAA4E,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,aAAa,EAA2B,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAEV,kBAAkB,EAElB,kBAAkB,EAClB,OAAO,EACP,IAAI,EACJ,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,yFAAyF;QACzF,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,wEAAwE;QACxE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,cAAc,GAAG,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC;CAClF;AAED,MAAM,WAAW,0BAA0B;IACzC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,kEAAkE;QAClE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oCAAoC;QACpC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6EAA6E;QAC7E,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uGAAuG;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAiED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUxG;AAUD,MAAM,WAAW,YAAY;IAC3B,WAAW,IAAI,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,iGAAiG;IACjG,QAAQ,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAC/B,6FAA6F;IAC7F,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED;;;;GAIG;AACH,qBAAa,UAAU;IA8BT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAc,OAAO,CAAC,QAAQ,CAAC,KAAK;IA7BrE;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAEhC;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAE1C,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAEhC,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB,OAAO,CAAC,gBAAgB,CAA+C;IACvE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;gBAEb,IAAI,EAAE,UAAU,EAAmB,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,iBAAsB;IAc9G,MAAM,CACV,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAqBxE,kBAAkB,CACtB,WAAW,EAAE,6BAA6B,GACzC,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAgB9E;;;;;;;OAOG;IACG,iBAAiB,CACrB,WAAW,GAAE,4BAAiC,GAC7C,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAwB9E;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IASlF;;;;OAIG;IACG,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAe3H,wEAAwE;IAClE,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAclI;;;;;;;OAOG;IACG,aAAa,CAAC,WAAW,EAAE,wBAAwB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IA4B9I;;;;;;;OAOG;IACG,MAAM,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,QAAQ,GAAG,cAAc,GAAG,UAAU,GAAG,KAAK,GAAG,cAAc,CAAC;QACtE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IA8BtF;;;;;;OAMG;IACG,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA2BrH;;;;OAIG;IACG,eAAe,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA+CrI;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAOtG;;;;;;;;;OASG;IACG,aAAa,CAAC,MAAM,EAAE;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAClE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA+BvD;;;;OAIG;IACG,UAAU,CAAC,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAsCtG;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,GAAE,oBAAyB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAc9G;;;;;OAKG;IACG,UAAU,CAAC,cAAc,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAiBzJ,OAAO,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAUtE;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA6B9E;;;;OAIG;IACG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAoB3H;;;;;OAKG;YACW,eAAe;IAS7B,0EAA0E;IACpE,OAAO,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IASnE;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAK5E;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAyBnG;;;;;;;;;;;;OAYG;IACH;;;;;OAKG;IACG,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,UAAU,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC,CAAC;IAoBtF;;;;OAIG;IACG,YAAY,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAsBlI,iDAAiD;IAC3C,cAAc,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAa3I;;;;OAIG;IACG,iBAAiB,CAAC,MAAM,EAAE;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAyB/E;;;;;;;;;OASG;IACG,SAAS,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAclG;;;;;OAKG;IACH,gBAAgB,CAAC,UAAU,SAAS,GAAG,IAAI;IAU3C,iFAAiF;IACjF,eAAe,IAAI,IAAI;IAOvB,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG;QAAE,IAAI,EAAE;YAAE,YAAY,EAAE,YAAY,CAAA;SAAE,CAAA;KAAE;IAsBzF;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;YAKpB,OAAO;CAKtB"}

package/dist/auth.js

@@ -2,6 +2,10 @@ import { BackendError, toError } from './http.js';
 import { normalizeUser } from './compat.js';
 import { MfaClient } from './mfa.js';
 import { AuthAdminClient } from './admin.js';
+import { codeChallengeFor, generateCodeVerifier, verifierStore, withCodeChallenge } from './pkce.js';
+import { OrganizationClient } from './organization.js';
+import { PasskeyClient, authenticateWithPasskey } from './passkey.js';
+import { SsoClient } from './sso.js';
 import { HTTP_ROUTES } from '@motherbase/contracts';
 function asIsoString(value) {
     if (typeof value === 'string')
@@ -33,6 +37,10 @@ function decodeJwtPayload(token) {
         return null;
     }
 }
+/** The header the server's captcha plugin reads the widget token from. */
+function captchaHeaders(options) {
+    return options?.captchaToken ? { 'x-captcha-response': options.captchaToken } : undefined;
+}
 /** Build a clean Session from the Better Auth auth payload. */
 function toSession(payload) {
     return { accessToken: payload.token, user: payload.user };
@@ -71,22 +79,33 @@ const EVENT_MAP = {
  * machinery. Returns `{ data, error }` and never throws for expected failures.
  */
 export class AuthClient {
-    constructor(http, store) {
+    constructor(http, store, options = {}) {
         this.http = http;
         this.store = store;
         this.autoRefreshTimer = null;
+        this.flowType = options.flowType ?? 'implicit';
+        this.verifiers = options.verifiers ?? verifierStore('motherbase.session');
         // A successful verify can return a stepped-up session, so mfa re-runs the
         // session read through the same path every other method uses.
         this.mfa = new MfaClient(http, async () => {
             await this.refreshSession();
         });
         this.admin = new AuthAdminClient(http);
+        this.organization = new OrganizationClient(http);
+        this.passkey = new PasskeyClient(http);
+        this.sso = new SsoClient(http);
     }
     async signUp(credentials) {
         try {
             const payload = await this.http.request(HTTP_ROUTES.authSignUp, {
                 method: 'POST',
-                body: { email: credentials.email, password: credentials.password, name: credentials.username ?? credentials.email },
+                body: {
+                    email: credentials.email,
+                    password: credentials.password,
+                    name: credentials.username ?? credentials.email,
+                    ...(credentials.options?.emailRedirectTo ? { callbackURL: credentials.options.emailRedirectTo } : {}),
+                },
+                headers: captchaHeaders(credentials.options),
                 anonymous: true,
                 raw: true,
             });
@@ -102,6 +121,7 @@ export class AuthClient {
             const payload = await this.http.request(HTTP_ROUTES.authSignIn, {
                 method: 'POST',
                 body: { email: credentials.email, password: credentials.password },
+                headers: captchaHeaders(credentials.options),
                 anonymous: true,
                 raw: true,
             });
@@ -112,16 +132,63 @@ export class AuthClient {
             return { data: { user: null, session: null }, error: toError(err) };
         }
     }
+    /**
+     * Sign in as a new guest, supabase-js style. The project must allow
+     * anonymous sign-ins (Studio → Authentication → Sign In / Providers).
+     *
+     * The guest is a real user whose `is_anonymous` is true, and RLS sees the
+     * same flag as the `is_anonymous` claim. Make it permanent without changing
+     * its id with `updateUser({ email })` or `linkIdentity()`.
+     */
+    async signInAnonymously(credentials = {}) {
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authSignInAnonymous, {
+                method: 'POST',
+                body: {},
+                headers: captchaHeaders(credentials.options),
+                anonymous: true,
+                raw: true,
+            });
+            await this.persist(payload);
+            const data = credentials.options?.data;
+            if (data && Object.keys(data).length > 0) {
+                // Better Auth creates the guest with no profile, so the metadata is
+                // written straight after, as the guest itself.
+                const updated = await this.updateUser({ data });
+                if (updated.error)
+                    return { data: { user: null, session: null }, error: updated.error };
+            }
+            const session = this.store.get();
+            return { data: { user: session?.user ?? null, session }, error: null };
+        }
+        catch (err) {
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
+    /**
+     * Email the signed-in user a one-time nonce, then pass it to
+     * `updateUser({ password, nonce })`. GoTrue's "secure password change".
+     */
+    async reauthenticate() {
+        try {
+            await this.http.request(HTTP_ROUTES.authReauthenticate, { method: 'POST', body: {}, raw: true });
+            return { data: { user: null, session: null }, error: null };
+        }
+        catch (err) {
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
     /**
      * Request a password-reset OTP by email. Always resolves successfully
      * (whether or not the email is registered) to avoid leaking account
      * existence; check `error` only for transport/server failures.
      */
-    async resetPasswordForEmail(email) {
+    async resetPasswordForEmail(email, options) {
         try {
             await this.http.request(HTTP_ROUTES.authRequestPasswordReset, {
                 method: 'POST',
                 body: { email },
+                headers: captchaHeaders(options),
                 anonymous: true,
                 raw: true,
             });
@@ -163,6 +230,7 @@ export class AuthClient {
                 await this.http.request(HTTP_ROUTES.authSendPhoneOtp, {
                     method: 'POST',
                     body: { phoneNumber: credentials.phone },
+                    headers: captchaHeaders(credentials.options),
                     anonymous: true,
                     raw: true,
                 });
@@ -171,6 +239,7 @@ export class AuthClient {
             await this.http.request(HTTP_ROUTES.authSendOtp, {
                 method: 'POST',
                 body: { email: credentials.email, type: 'sign-in' },
+                headers: captchaHeaders(credentials.options),
                 anonymous: true,
                 raw: true,
             });
@@ -256,6 +325,10 @@ export class AuthClient {
      * unless `options.skipBrowserRedirect` is set.
      */
     async signInWithOAuth(credentials) {
+        const redirectTo = await this.redirectForFlow(credentials.options?.redirectTo);
+        if (redirectTo instanceof Error)
+            return { data: { provider: credentials.provider, url: null }, error: { message: redirectTo.message } };
+        credentials = { ...credentials, options: { ...credentials.options, redirectTo } };
         // In a browser, hand the whole handshake to a top-level navigation. Starting
         // it with a fetch makes the OAuth state cookie a cross-site write, which
         // Safari and Firefox drop outright and Chrome drops in incognito, and the
@@ -297,6 +370,18 @@ export class AuthClient {
             return { data: { provider: credentials.provider, url: null }, error: toError(err) };
         }
     }
+    /**
+     * Sign in with a passkey saved on this device or a synced one. Opens the
+     * browser's passkey prompt; dismissing it resolves with an error, not a throw.
+     * Needs Auth · Passkey on and a browser (see `auth.passkey`).
+     */
+    async signInWithPasskey() {
+        const result = await authenticateWithPasskey(this.http);
+        if (result.error)
+            return { data: { user: null, session: null }, error: result.error };
+        const session = await this.persist(result.data);
+        return { data: { user: session.user, session }, error: null };
+    }
     /**
      * Start an enterprise SSO sign-in. Identify the provider by the user's email
      * domain, by an explicit `domain`, or by `providerId` when you already know
@@ -311,6 +396,10 @@ export class AuthClient {
         if (!params.domain && !params.email && !params.providerId && !params.organizationSlug) {
             return { data: { url: null }, error: { message: 'signInWithSSO needs a domain, email, providerId or organizationSlug' } };
         }
+        const redirectTo = await this.redirectForFlow(params.options?.redirectTo);
+        if (redirectTo instanceof Error)
+            return { data: { url: null }, error: { message: redirectTo.message } };
+        params = { ...params, options: { ...params.options, redirectTo } };
         try {
             const payload = await this.http.request('/api/auth/sign-in/sso', {
                 method: 'POST',
@@ -345,16 +434,26 @@ export class AuthClient {
             if (attributes.data && Object.keys(attributes.data).length > 0) {
                 await this.http.request(HTTP_ROUTES.authUpdateUser, { method: 'POST', body: attributes.data, raw: true });
             }
-            if (attributes.password) {
-                if (!attributes.currentPassword) {
-                    return { data: { user: null }, error: { message: '`currentPassword` is required to change the password.' } };
-                }
+            if (attributes.password && attributes.currentPassword) {
                 await this.http.request(HTTP_ROUTES.authChangePassword, {
                     method: 'POST',
                     body: { newPassword: attributes.password, currentPassword: attributes.currentPassword },
                     raw: true,
                 });
             }
+            else if (attributes.email || attributes.password) {
+                // Email (a guest's upgrade) and a password set by nonce, or a first
+                // password, go through GoTrue's `PUT /user` equivalent.
+                await this.http.request(HTTP_ROUTES.authUpdateUserCredentials, {
+                    method: 'POST',
+                    body: {
+                        ...(attributes.email ? { email: attributes.email } : {}),
+                        ...(attributes.password ? { password: attributes.password } : {}),
+                        ...(attributes.nonce ? { nonce: attributes.nonce } : {}),
+                    },
+                    raw: true,
+                });
+            }
             const result = await this.getUser();
             // supabase-js emits USER_UPDATED here, and apps re-read the profile off
             // that event rather than off the return value. Refresh the stored session
@@ -464,6 +563,47 @@ export class AuthClient {
             return { data: { user: null, session: null }, error: toError(err) };
         }
     }
+    /**
+     * Finish a PKCE sign-in: trade the `?code=` the provider redirect came back
+     * with for the session. Needs the verifier `signInWithOAuth` stored, so it
+     * works once, in the browser that started the flow.
+     */
+    async exchangeCodeForSession(authCode) {
+        const verifier = await this.verifiers.get();
+        if (!verifier) {
+            return { data: { user: null, session: null }, error: { message: 'No PKCE code verifier found: start the flow with flowType: "pkce" in this browser.' } };
+        }
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authExchangeCode, {
+                method: 'POST',
+                body: { auth_code: authCode, code_verifier: verifier },
+                anonymous: true,
+                raw: true,
+            });
+            await this.verifiers.clear();
+            const session = await this.persist(payload);
+            return { data: { user: session.user, session }, error: null };
+        }
+        catch (err) {
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
+    /**
+     * The redirect a flow should use. Implicit: as given. PKCE: with a fresh
+     * challenge on it, the verifier stored for `exchangeCodeForSession`; the
+     * challenge rides on the redirect URL, so PKCE needs one, and in a browser
+     * the current page stands in when none is given.
+     */
+    async redirectForFlow(redirectTo) {
+        if (this.flowType !== 'pkce')
+            return redirectTo;
+        const target = redirectTo ?? (typeof window !== 'undefined' ? window.location.href.split('#')[0] : undefined);
+        if (!target)
+            return new Error('flowType "pkce" needs options.redirectTo outside a browser.');
+        const verifier = generateCodeVerifier();
+        await this.verifiers.set(verifier);
+        return withCodeChallenge(target, await codeChallengeFor(verifier));
+    }
     /** Fetch the current user from Better Auth (requires a valid session). */
     async getUser() {
         try {