@motherbase/client 1.5.1 → 2.0.2

package/dist/auth.js

@@ -1,57 +1,54 @@
-import { BackendError, toError } from './http.js';
-import { normalizeUser } from './compat.js';
-import { MfaClient } from './mfa.js';
-import { AuthAdminClient } from './admin.js';
-import { codeChallengeFor, generateCodeVerifier, verifierStore, withCodeChallenge } from './pkce.js';
-import { OrganizationClient } from './organization.js';
-import { PasskeyClient, authenticateWithPasskey } from './passkey.js';
-import { SsoClient } from './sso.js';
+import { createAuthClient as createBetterAuthClient } from 'better-auth/client';
+import { anonymousClient, emailOTPClient, genericOAuthClient, jwtClient, magicLinkClient, organizationClient, phoneNumberClient, twoFactorClient, } from 'better-auth/client/plugins';
+import { passkeyClient } from '@better-auth/passkey/client';
+import { ssoClient } from '@better-auth/sso/client';
+import { apiKeyClient } from '@better-auth/api-key/client';
 import { HTTP_ROUTES } from '@motherbase/contracts';
-function asIsoString(value) {
-    if (typeof value === 'string')
-        return value;
-    if (value instanceof Date)
-        return value.toISOString();
-    return null;
-}
+import { AuthAdminClient } from './admin.js';
+import { normalizeUser } from './compat.js';
+import { codeChallengeFor, generateCodeVerifier, withCodeChallenge } from './pkce.js';
+const EVENT_MAP = {
+    signIn: 'SIGNED_IN',
+    signOut: 'SIGNED_OUT',
+    tokenRefreshed: 'TOKEN_REFRESHED',
+    userUpdated: 'USER_UPDATED',
+    mfaVerified: 'MFA_CHALLENGE_VERIFIED',
+};
 /**
- * Read a JWT's payload without verifying it. Base64url, so `-`/`_` are mapped
- * back and the padding is restored before decoding. Returns null for anything
- * that is not a three-part token with a JSON object payload.
+ * Endpoints whose next step needs a cookie set on the response: the OAuth
+ * state, the WebAuthn challenge, or the pending second factor a password
+ * sign-in leaves for `twoFactor.verify*`. Cross-origin, fetch only keeps and
+ * resends a cookie with `credentials: 'include'`. Everything else stays
+ * `same-origin`, so a backend that does not allow credentialed CORS still
+ * serves it.
  */
-function decodeJwtPayload(token) {
-    const parts = token.split('.');
-    if (parts.length !== 3)
-        return null;
-    try {
-        const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
-        const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
-        // `atob` is global in every runtime this SDK supports (browsers, Node 16+,
-        // Deno, workers). Its output is latin1, so the percent-escape round trip is
-        // what turns a multi-byte claim value back into correct UTF-8.
-        const json = decodeURIComponent(Array.from(atob(padded), c => `%${c.charCodeAt(0).toString(16).padStart(2, '0')}`).join(''));
-        const parsed = JSON.parse(json);
-        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
-    }
-    catch {
-        return null;
-    }
-}
-/** The header the server's captcha plugin reads the widget token from. */
-function captchaHeaders(options) {
-    return options?.captchaToken ? { 'x-captcha-response': options.captchaToken } : undefined;
-}
-/** Build a clean Session from the Better Auth auth payload. */
-function toSession(payload) {
-    return { accessToken: payload.token, user: payload.user };
-}
+const COOKIE_PATHS = [
+    '/sign-in/email',
+    '/sign-in/phone-number',
+    '/two-factor/',
+    '/sign-in/social',
+    '/sign-in/sso',
+    '/sign-in/oauth2',
+    '/link-social',
+    '/oauth2/link',
+    '/passkey/',
+];
+/** Sign-ins that come back through the server's OAuth callback, where the PKCE challenge rides. */
+const REDIRECT_SIGN_IN_PATHS = ['/sign-in/social', '/sign-in/sso', '/sign-in/oauth2'];
+/** Calls after which the session this client holds no longer exists. */
+const SIGN_OUT_PATHS = new Set(['/sign-out', '/revoke-sessions']);
+/**
+ * Calls that change the user but answer without it (`{ status: true }`): the
+ * session is read again after them, so the stored user and USER_UPDATED follow.
+ */
+const USER_CHANGE_PATHS = new Set(['/update-user', '/change-email', '/update-user-credentials', '/two-factor/disable']);
 /**
  * Read the token an OAuth callback left in the URL fragment and return the URL
  * with it removed, so a reload or a shared link cannot replay it.
  *
  * The provider callback cannot answer the SDK with a JSON body: it is a browser
- * redirect. The backend therefore appends `#access_token=…` to the redirect it
- * issues, the same implicit flow supabase-js reads. Exported for testing.
+ * redirect. The server therefore appends `#access_token=…` to the redirect it
+ * issues (auth/oauth-redirect.ts). Exported for testing.
  */
 export function readAccessTokenFromUrl(href) {
     const hash = href.indexOf('#');
@@ -66,796 +63,259 @@ export function readAccessTokenFromUrl(href) {
     const rest = params.toString();
     return { accessToken, cleanedHref: `${href.slice(0, hash)}${rest ? `#${rest}` : ''}` };
 }
-const EVENT_MAP = {
-    signIn: 'SIGNED_IN',
-    signOut: 'SIGNED_OUT',
-    tokenRefreshed: 'TOKEN_REFRESHED',
-    userUpdated: 'USER_UPDATED',
-    mfaVerified: 'MFA_CHALLENGE_VERIFIED',
-};
 /**
- * Supabase-compatible auth client. Maps supabase-js method names onto the
- * Motherbase auth endpoints and reuses the existing token/refresh/session-store
- * machinery. Returns `{ data, error }` and never throws for expected failures.
+ * The session a successful auth response carries, if any.
+ *
+ * Better Auth answers a sign-in with `{ token, user }` (password, OTP, anonymous,
+ * id token, second factor) or `{ session: { token }, user }` (passkey,
+ * get-session). A `user` is required alongside: the jwt plugin's `/token`
+ * answers `{ token }` with a JWT, which is not a session.
  */
-export class AuthClient {
-    constructor(http, store, options = {}) {
-        this.http = http;
-        this.store = store;
-        this.autoRefreshTimer = null;
-        this.flowType = options.flowType ?? 'implicit';
-        this.verifiers = options.verifiers ?? verifierStore('motherbase.session');
-        // A successful verify can return a stepped-up session, so mfa re-runs the
-        // session read through the same path every other method uses.
-        this.mfa = new MfaClient(http, async () => {
-            await this.refreshSession();
-        });
-        this.admin = new AuthAdminClient(http);
-        this.organization = new OrganizationClient(http);
-        this.passkey = new PasskeyClient(http);
-        this.sso = new SsoClient(http);
-    }
-    async signUp(credentials) {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSignUp, {
-                method: 'POST',
-                body: {
-                    email: credentials.email,
-                    password: credentials.password,
-                    name: credentials.username ?? credentials.email,
-                    ...(credentials.options?.emailRedirectTo ? { callbackURL: credentials.options.emailRedirectTo } : {}),
-                },
-                headers: captchaHeaders(credentials.options),
-                anonymous: true,
-                raw: true,
-            });
-            const session = await this.persist(payload);
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    async signInWithPassword(credentials) {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSignIn, {
-                method: 'POST',
-                body: { email: credentials.email, password: credentials.password },
-                headers: captchaHeaders(credentials.options),
-                anonymous: true,
-                raw: true,
-            });
-            const session = await this.persist(payload);
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Sign in as a new guest, supabase-js style. The project must allow
-     * anonymous sign-ins (Studio → Authentication → Sign In / Providers).
-     *
-     * The guest is a real user whose `is_anonymous` is true, and RLS sees the
-     * same flag as the `is_anonymous` claim. Make it permanent without changing
-     * its id with `updateUser({ email })` or `linkIdentity()`.
-     */
-    async signInAnonymously(credentials = {}) {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSignInAnonymous, {
-                method: 'POST',
-                body: {},
-                headers: captchaHeaders(credentials.options),
-                anonymous: true,
-                raw: true,
-            });
-            await this.persist(payload);
-            const data = credentials.options?.data;
-            if (data && Object.keys(data).length > 0) {
-                // Better Auth creates the guest with no profile, so the metadata is
-                // written straight after, as the guest itself.
-                const updated = await this.updateUser({ data });
-                if (updated.error)
-                    return { data: { user: null, session: null }, error: updated.error };
-            }
-            const session = this.store.get();
-            return { data: { user: session?.user ?? null, session }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Email the signed-in user a one-time nonce, then pass it to
-     * `updateUser({ password, nonce })`. GoTrue's "secure password change".
-     */
-    async reauthenticate() {
-        try {
-            await this.http.request(HTTP_ROUTES.authReauthenticate, { method: 'POST', body: {}, raw: true });
-            return { data: { user: null, session: null }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Request a password-reset OTP by email. Always resolves successfully
-     * (whether or not the email is registered) to avoid leaking account
-     * existence; check `error` only for transport/server failures.
-     */
-    async resetPasswordForEmail(email, options) {
-        try {
-            await this.http.request(HTTP_ROUTES.authRequestPasswordReset, {
-                method: 'POST',
-                body: { email },
-                headers: captchaHeaders(options),
-                anonymous: true,
-                raw: true,
-            });
-            return { error: null };
-        }
-        catch (err) {
-            return { error: toError(err) };
-        }
-    }
-    /** Complete a password reset using the OTP sent to the user's email. */
-    async resetPassword(args) {
-        try {
-            await this.http.request(HTTP_ROUTES.authResetPassword, {
-                method: 'POST',
-                body: { email: args.email, otp: args.otp, password: args.password },
-                anonymous: true,
-                raw: true,
-            });
-            return { error: null };
-        }
-        catch (err) {
-            return { error: toError(err) };
-        }
-    }
-    /**
-     * Send a one-time sign-in code, by email or by SMS. Pair with `verifyOtp` to
-     * complete the sign-in.
-     *
-     * `{ phone }` routes to the phone-number plugin, which the project has to
-     * have enabled with an SMS sender configured; without one the call resolves
-     * with the backend's error rather than pretending a code was sent.
-     */
-    async signInWithOtp(credentials) {
-        if (!credentials.email && !credentials.phone) {
-            return { data: {}, error: { message: 'signInWithOtp needs either `email` or `phone`.' } };
-        }
-        try {
-            if (credentials.phone) {
-                await this.http.request(HTTP_ROUTES.authSendPhoneOtp, {
-                    method: 'POST',
-                    body: { phoneNumber: credentials.phone },
-                    headers: captchaHeaders(credentials.options),
-                    anonymous: true,
-                    raw: true,
-                });
-                return { data: {}, error: null };
-            }
-            await this.http.request(HTTP_ROUTES.authSendOtp, {
-                method: 'POST',
-                body: { email: credentials.email, type: 'sign-in' },
-                headers: captchaHeaders(credentials.options),
-                anonymous: true,
-                raw: true,
-            });
-            return { data: {}, error: null };
-        }
-        catch (err) {
-            return { data: {}, error: toError(err) };
-        }
-    }
-    /**
-     * Send the one-time code again, supabase-js style.
-     *
-     * supabase-js names the flows `signup` (confirm a new address), `email_change`
-     * and `recovery`; Better Auth names them `email-verification` and
-     * `forget-password`. The mapping lives here so ported code keeps working.
-     * `sms` and `phone_change` re-send an SMS code through the phone-number flow.
-     */
-    async resend(params) {
-        if (params.type === 'sms' || params.type === 'phone_change') {
-            if (!params.phone)
-                return { data: {}, error: { message: '`phone` is required.' } };
-            return this.signInWithOtp({ phone: params.phone });
-        }
-        const OTP_TYPE = {
-            signup: 'email-verification',
-            email_change: 'email-verification',
-            recovery: 'forget-password',
-        };
-        const type = OTP_TYPE[params.type];
-        if (!type) {
-            return { data: {}, error: { message: `resend({ type: '${params.type}' }) is not supported.` } };
-        }
-        if (!params.email) {
-            return { data: {}, error: { message: '`email` is required.' } };
-        }
-        try {
-            await this.http.request(HTTP_ROUTES.authSendOtp, {
-                method: 'POST',
-                body: { email: params.email, type },
-                anonymous: true,
-                raw: true,
-            });
-            return { data: {}, error: null };
-        }
-        catch (err) {
-            return { data: {}, error: toError(err) };
-        }
-    }
-    /**
-     * Complete a `signInWithOtp` sign-in with the code that was sent.
-     *
-     * The channel follows the identifier, as in supabase-js: `{ phone }` verifies
-     * an SMS code, `{ email }` an email one. `type` is accepted for signature
-     * parity and only disambiguates when both are somehow present.
-     */
-    async verifyOtp(params) {
-        if (!params.email && !params.phone) {
-            return { data: { user: null, session: null }, error: { message: 'verifyOtp needs either `email` or `phone`.' } };
-        }
-        try {
-            const bySms = Boolean(params.phone) && params.type !== 'email';
-            const payload = await this.http.request(bySms ? HTTP_ROUTES.authVerifyPhoneOtp : HTTP_ROUTES.authSignInEmailOtp, {
-                method: 'POST',
-                body: bySms
-                    ? { phoneNumber: params.phone, code: params.token }
-                    : { email: params.email, otp: params.token },
-                anonymous: true,
-                raw: true,
-            });
-            if (!payload?.token) {
-                return { data: { user: null, session: null }, error: { message: 'The code did not produce a session.' } };
-            }
-            const session = await this.persist(payload);
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Start an OAuth sign-in with a configured social provider. Resolves with the
-     * provider's authorize URL and, in a browser, redirects to it immediately
-     * unless `options.skipBrowserRedirect` is set.
-     */
-    async signInWithOAuth(credentials) {
-        const redirectTo = await this.redirectForFlow(credentials.options?.redirectTo);
-        if (redirectTo instanceof Error)
-            return { data: { provider: credentials.provider, url: null }, error: { message: redirectTo.message } };
-        credentials = { ...credentials, options: { ...credentials.options, redirectTo } };
-        // In a browser, hand the whole handshake to a top-level navigation. Starting
-        // it with a fetch makes the OAuth state cookie a cross-site write, which
-        // Safari and Firefox drop outright and Chrome drops in incognito, and the
-        // callback then fails with state_mismatch. Navigating to the backend's own
-        // origin makes that cookie first-party, so a plain SameSite=Lax cookie
-        // survives everywhere. The backend redirects on from there.
-        if (typeof window !== 'undefined' && !credentials.options?.skipBrowserRedirect) {
-            const params = new URLSearchParams();
-            if (credentials.options?.redirectTo)
-                params.set('callbackURL', credentials.options.redirectTo);
-            const query = params.toString();
-            const url = this.http.url(`${HTTP_ROUTES.authSignInSocial}/${encodeURIComponent(credentials.provider)}${query ? `?${query}` : ''}`);
-            window.location.href = url;
-            return { data: { provider: credentials.provider, url }, error: null };
-        }
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSignInSocial, {
-                method: 'POST',
-                body: {
-                    provider: credentials.provider,
-                    callbackURL: credentials.options?.redirectTo,
-                    scopes: credentials.options?.scopes ? credentials.options.scopes.split(' ') : undefined,
-                    disableRedirect: true,
-                },
-                anonymous: true,
-                raw: true,
-                // The server answers with a signed OAuth state cookie it checks again on
-                // the provider callback. Without 'include' the browser drops that cookie
-                // on a cross-origin call and every callback fails with state_mismatch.
-                credentials: 'include',
-            });
-            const url = payload?.url ?? null;
-            if (url && !credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {
-                window.location.href = url;
-            }
-            return { data: { provider: credentials.provider, url }, error: null };
-        }
-        catch (err) {
-            return { data: { provider: credentials.provider, url: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Sign in with a passkey saved on this device or a synced one. Opens the
-     * browser's passkey prompt; dismissing it resolves with an error, not a throw.
-     * Needs Auth · Passkey on and a browser (see `auth.passkey`).
-     */
-    async signInWithPasskey() {
-        const result = await authenticateWithPasskey(this.http);
-        if (result.error)
-            return { data: { user: null, session: null }, error: result.error };
-        const session = await this.persist(result.data);
-        return { data: { user: session.user, session }, error: null };
-    }
-    /**
-     * Start an enterprise SSO sign-in. Identify the provider by the user's email
-     * domain, by an explicit `domain`, or by `providerId` when you already know
-     * which one to use.
-     *
-     * Resolves with the identity provider's URL and, in a browser, redirects to it
-     * unless `options.skipBrowserRedirect` is set. The project must have the SSO
-     * plugin enabled and at least one provider registered (Studio →
-     * Authentication → Organizations & SSO).
-     */
-    async signInWithSSO(params) {
-        if (!params.domain && !params.email && !params.providerId && !params.organizationSlug) {
-            return { data: { url: null }, error: { message: 'signInWithSSO needs a domain, email, providerId or organizationSlug' } };
-        }
-        const redirectTo = await this.redirectForFlow(params.options?.redirectTo);
-        if (redirectTo instanceof Error)
-            return { data: { url: null }, error: { message: redirectTo.message } };
-        params = { ...params, options: { ...params.options, redirectTo } };
-        try {
-            const payload = await this.http.request('/api/auth/sign-in/sso', {
-                method: 'POST',
-                body: {
-                    ...(params.domain ? { domain: params.domain } : {}),
-                    ...(params.email ? { email: params.email } : {}),
-                    ...(params.providerId ? { providerId: params.providerId } : {}),
-                    ...(params.organizationSlug ? { organizationSlug: params.organizationSlug } : {}),
-                    callbackURL: params.options?.redirectTo,
-                },
-                anonymous: true,
-                raw: true,
-                credentials: 'include', // Same OAuth state cookie as signInWithOAuth.
-            });
-            const url = payload?.url ?? null;
-            if (url && !params.options?.skipBrowserRedirect && typeof window !== 'undefined') {
-                window.location.href = url;
-            }
-            return { data: { url }, error: null };
-        }
-        catch (err) {
-            return { data: { url: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Update the signed-in user's profile fields and/or password. Password
-     * changes require `currentPassword` (a Better Auth requirement. There is no
-     * blind password overwrite from an authenticated session).
-     */
-    async updateUser(attributes) {
-        try {
-            if (attributes.data && Object.keys(attributes.data).length > 0) {
-                await this.http.request(HTTP_ROUTES.authUpdateUser, { method: 'POST', body: attributes.data, raw: true });
-            }
-            if (attributes.password && attributes.currentPassword) {
-                await this.http.request(HTTP_ROUTES.authChangePassword, {
-                    method: 'POST',
-                    body: { newPassword: attributes.password, currentPassword: attributes.currentPassword },
-                    raw: true,
-                });
-            }
-            else if (attributes.email || attributes.password) {
-                // Email (a guest's upgrade) and a password set by nonce, or a first
-                // password, go through GoTrue's `PUT /user` equivalent.
-                await this.http.request(HTTP_ROUTES.authUpdateUserCredentials, {
-                    method: 'POST',
-                    body: {
-                        ...(attributes.email ? { email: attributes.email } : {}),
-                        ...(attributes.password ? { password: attributes.password } : {}),
-                        ...(attributes.nonce ? { nonce: attributes.nonce } : {}),
-                    },
-                    raw: true,
-                });
-            }
-            const result = await this.getUser();
-            // supabase-js emits USER_UPDATED here, and apps re-read the profile off
-            // that event rather than off the return value. Refresh the stored session
-            // so the user the listener receives is the updated one.
-            const current = this.store.get();
-            if (result.data?.user && current) {
-                await this.store.set({ ...current, user: result.data.user }, 'userUpdated');
+export function sessionFromResponse(data) {
+    if (!data || typeof data !== 'object')
+        return null;
+    const body = data;
+    if (!body.user)
+        return null;
+    const token = typeof body.token === 'string' ? body.token : body.session?.token;
+    return typeof token === 'string' ? { token, user: body.user } : null;
+}
+/**
+ * Whether two tokens name the same session. The bearer the server hands out
+ * (`set-auth-token`, the OAuth fragment) is the signed cookie value,
+ * `<token>.<signature>`, while response bodies carry the bare `<token>`; the
+ * bearer plugin accepts either.
+ */
+export function sameSession(stored, token) {
+    if (!stored || !token)
+        return false;
+    return stored === token || stored.startsWith(`${token}.`) || token.startsWith(`${stored}.`);
+}
+/** The auth path of a request: `/api/auth/sign-in/email` → `/sign-in/email`. */
+function authPath(url) {
+    const pathname = typeof url === 'string' && !/^https?:/.test(url) ? url.split('?')[0] : new URL(url).pathname;
+    return pathname.startsWith(HTTP_ROUTES.auth) ? pathname.slice(HTTP_ROUTES.auth.length) : pathname;
+}
+/**
+ * The proxy hands out the function it finds detached from its object, so a
+ * class instance exposed as an action would lose `this`. Copy its methods out
+ * bound.
+ */
+function bindMethods(target) {
+    const bound = {};
+    for (const key of Object.getOwnPropertyNames(Object.getPrototypeOf(target))) {
+        const value = target[key];
+        if (key !== 'constructor' && typeof value === 'function')
+            bound[key] = value.bind(target);
+    }
+    return bound;
+}
+function adminActions(http) {
+    const admin = new AuthAdminClient(http);
+    return { ...bindMethods(admin), mfa: bindMethods(admin.mfa) };
+}
+/**
+ * Keeps the SDK's session store and Better Auth's calls in step: the bearer
+ * goes out on every request, and every response that creates, replaces or ends
+ * the session is written back, which is what fires `onAuthStateChange`.
+ */
+function sessionSync(store, options, 
+/** Reads the session again; its response comes back through this plugin. */
+revalidate) {
+    const { flowType, verifiers } = options;
+    return {
+        id: 'motherbase-session',
+        name: 'Motherbase session',
+        // Edits the call's options in place rather than returning a copy: better-fetch
+        // runs its own schema plugin after this one, and it hands back the options
+        // object it was given. The object is built fresh for every call.
+        async init(url, fetchOptions = {}) {
+            const path = authPath(url);
+            fetchOptions.credentials = COOKIE_PATHS.some(prefix => path.startsWith(prefix)) ? 'include' : 'same-origin';
+            // Node does not send Origin, and Better Auth's CSRF check wants one on a
+            // mutation. Supply the project's own rather than turning the check off.
+            const headers = (fetchOptions.headers ?? {});
+            if (typeof window === 'undefined' && (fetchOptions.method ?? 'GET').toUpperCase() !== 'GET'
+                && !Object.keys(headers).some(name => name.toLowerCase() === 'origin')) {
+                fetchOptions.headers = { ...headers, origin: new URL(options.url).origin };
             }
-            return result;
-        }
-        catch (err) {
-            return { data: { user: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Permanently delete the signed-in user's account. Not part of the
-     * supabase-js client surface (there it's admin-only). Kept here because
-     * self-service account deletion is a real product need. Requires the
-     * backend's `delete-user` flow to be enabled; clears the local session on
-     * success.
-     */
-    async deleteUser(attributes = {}) {
-        try {
-            await this.http.request(HTTP_ROUTES.authDeleteUser, {
-                method: 'POST',
-                body: attributes,
-                raw: true,
-            });
-            await this.store.set(null, 'signOut');
-            return { error: null };
-        }
-        catch (err) {
-            return { error: toError(err) };
-        }
-    }
-    /**
-     * Adopt an externally-obtained access token as the current session (e.g. one
-     * captured from an OAuth redirect). Validates it against the server before
-     * persisting. `refresh_token` is accepted for supabase-js signature parity
-     * and unused: Better Auth bearer sessions have none.
-     */
-    async setSession(currentSession) {
-        await this.store.set({ accessToken: currentSession.access_token, user: { id: '', email: '' } }, 'signIn');
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSession, { raw: true });
-            if (!payload?.user) {
-                await this.store.set(null, 'signOut');
-                return { data: { user: null, session: null }, error: { message: 'Invalid session' } };
+            const body = (fetchOptions.body ?? {});
+            // An id-token sign-in answers with the session directly: no redirect.
+            if (!REDIRECT_SIGN_IN_PATHS.includes(path) || body.idToken)
+                return { url, options: fetchOptions };
+            if (flowType === 'pkce') {
+                fetchOptions.body = { ...body, callbackURL: await pkceCallback(body.callbackURL, verifiers) };
             }
-            const session = { accessToken: currentSession.access_token, user: payload.user };
-            await this.store.set(session, 'signIn');
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            await this.store.set(null, 'signOut');
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    async signOut() {
-        try {
-            await this.http.request(HTTP_ROUTES.authSignOut, { method: 'POST', raw: true });
-        }
-        catch {
-            // best-effort; clear locally regardless
-        }
-        await this.store.set(null, 'signOut');
-        return { error: null };
-    }
-    /**
-     * Finish an OAuth / SSO sign-in after the provider redirected back.
-     *
-     * `signInWithOAuth` only starts the flow; the session is created during the
-     * redirect the browser makes to the backend callback, so the SDK has to pick
-     * it up from the URL the browser landed on. Call this once on the page you
-     * pointed `redirectTo` at (or on app start, which is where supabase-js does
-     * the equivalent). Without it the user is signed in on the backend and signed
-     * out in your app.
-     *
-     * Resolves with a null session and no error when there is nothing to read, so
-     * it is safe to call on every page load.
-     */
-    async getSessionFromUrl(href) {
-        const url = href ?? (typeof window !== 'undefined' ? window.location.href : undefined);
-        const found = url ? readAccessTokenFromUrl(url) : null;
-        if (!found)
-            return { data: { user: null, session: null }, error: null };
-        // Strip the token before the network call: a failed lookup must not leave a
-        // usable token sitting in the address bar or in the back/forward history.
-        if (!href && typeof window !== 'undefined') {
-            window.history?.replaceState?.(window.history.state, '', found.cleanedHref);
-        }
-        try {
-            // Resolve the user with the token explicitly rather than storing it first:
-            // a rejected token must not emit a SIGNED_IN event carrying a null user.
-            const payload = await this.http.request(HTTP_ROUTES.authSession, {
-                raw: true,
-                anonymous: true,
-                headers: { Authorization: `Bearer ${found.accessToken}` },
-            });
-            if (!payload?.user) {
-                return { data: { user: null, session: null }, error: { message: 'OAuth session is no longer valid' } };
+            if (path === '/sign-in/social' && typeof window !== 'undefined' && !body.disableRedirect) {
+                // Started with a fetch, the OAuth state cookie is a cross-site write
+                // that Safari and Firefox drop (Chrome too, in incognito), and the
+                // callback fails with state_mismatch. Navigating to the server's GET
+                // start route makes it first-party. The request is answered locally
+                // with Better Auth's own shape, `redirect: false` so it does not
+                // navigate a second time.
+                const href = socialStartUrl(options.url, fetchOptions.body);
+                window.location.href = href;
+                fetchOptions.customFetchImpl = async () => Response.json({ url: href, redirect: false });
             }
-            const session = await this.persist({ token: found.accessToken, user: payload.user });
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Finish a PKCE sign-in: trade the `?code=` the provider redirect came back
-     * with for the session. Needs the verifier `signInWithOAuth` stored, so it
-     * works once, in the browser that started the flow.
-     */
-    async exchangeCodeForSession(authCode) {
-        const verifier = await this.verifiers.get();
-        if (!verifier) {
-            return { data: { user: null, session: null }, error: { message: 'No PKCE code verifier found: start the flow with flowType: "pkce" in this browser.' } };
-        }
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authExchangeCode, {
-                method: 'POST',
-                body: { auth_code: authCode, code_verifier: verifier },
-                anonymous: true,
-                raw: true,
-            });
-            await this.verifiers.clear();
-            const session = await this.persist(payload);
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    /**
-     * The redirect a flow should use. Implicit: as given. PKCE: with a fresh
-     * challenge on it, the verifier stored for `exchangeCodeForSession`; the
-     * challenge rides on the redirect URL, so PKCE needs one, and in a browser
-     * the current page stands in when none is given.
-     */
-    async redirectForFlow(redirectTo) {
-        if (this.flowType !== 'pkce')
-            return redirectTo;
-        const target = redirectTo ?? (typeof window !== 'undefined' ? window.location.href.split('#')[0] : undefined);
-        if (!target)
-            return new Error('flowType "pkce" needs options.redirectTo outside a browser.');
-        const verifier = generateCodeVerifier();
-        await this.verifiers.set(verifier);
-        return withCodeChallenge(target, await codeChallengeFor(verifier));
-    }
-    /** Fetch the current user from Better Auth (requires a valid session). */
-    async getUser() {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSession, { raw: true });
-            return { data: { user: normalizeUser(payload?.user) }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null }, error: toError(err) };
-        }
-    }
-    /**
-     * NEVER USE FOR AN AUTHORIZATION DECISION. Use {@link getUser} instead.
-     *
-     * The locally-held session, if any (no network call). It is whatever the
-     * caller's cookie or storage said, parsed: unsigned JSON the browser sent,
-     * which anyone can set by hand. `session.user.id`, `.email` and `.role` are
-     * therefore attacker-controlled, and an admin allowlist checked against
-     * them is checked against nothing.
-     *
-     * Reads and writes through `from()` are unaffected: they carry the access
-     * token to the backend, which verifies it under RLS. It is the decisions
-     * your own app takes from `session.user` that are forgeable.
-     *
-     * `getUser()` costs one round trip and returns the user the backend
-     * confirms, in the same `{ data, error }` shape. Prefer it everywhere but a
-     * cosmetic "am I probably signed in" check.
-     */
-    async getSession() {
-        await this.store.hydrate();
-        return { data: { session: this.store.get() }, error: null };
-    }
-    /**
-     * Revalidate the current session against the server. Better Auth bearer
-     * sessions have no refresh token: if the session is still valid the user is
-     * refreshed; otherwise the local session is cleared.
-     */
-    async refreshSession() {
-        await this.store.hydrate();
-        const current = this.store.get();
-        if (!current?.accessToken) {
-            return { data: { user: null, session: null }, error: { message: 'Auth session missing!' } };
-        }
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSession, { raw: true, _retry: true });
-            if (!payload?.user) {
-                await this.store.set(null, 'signOut');
-                return { data: { user: null, session: null }, error: { message: 'Session expired' } };
-            }
-            const session = { accessToken: current.accessToken, user: payload.user };
-            await this.store.set(session, 'tokenRefreshed');
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            // Only a rejected token clears the session. A network failure or a 5xx
-            // must leave it intact: middleware runs this on every navigation, so
-            // one backend hiccup would otherwise sign the user out.
-            const status = err instanceof BackendError ? err.httpStatus : 0;
-            if (status === 401 || status === 403)
-                await this.store.set(null, 'signOut');
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
+            return { url, options: fetchOptions };
+        },
+        hooks: {
+            async onSuccess({ data, request }) {
+                const path = authPath(request.url);
+                const current = store.get();
+                const ended = SIGN_OUT_PATHS.has(path)
+                    || (path === '/revoke-session' && sameSession(current?.accessToken, revokedToken(request.body)))
+                    || (path === '/delete-user' && data?.message === 'User deleted')
+                    // The stored token was revoked or expired elsewhere: the server answers
+                    // null. Only for the stored token: getSessionFromUrl checks another one.
+                    || (path === '/get-session' && data === null
+                        && request.headers.get('authorization') === `Bearer ${current?.accessToken}`);
+                if (ended) {
+                    if (current)
+                        await store.set(null, 'signOut');
+                    return;
+                }
+                if (USER_CHANGE_PATHS.has(path) && current) {
+                    await revalidate();
+                    return;
+                }
+                const next = sessionFromResponse(data);
+                if (!next)
+                    return;
+                if (!current || !sameSession(current.accessToken, next.token)) {
+                    await store.set({ accessToken: next.token, user: next.user }, path.startsWith('/two-factor/') ? 'mfaVerified' : 'signIn');
+                }
+                else if (JSON.stringify(normalizeUser(next.user)) !== JSON.stringify(current.user)) {
+                    // Compared as the store holds it: normalised, aliases included.
+                    await store.set({ ...current, user: next.user }, 'userUpdated');
+                }
+            },
+        },
+    };
+}
+/** The server's GET start route for a social sign-in (auth/social-start.ts). */
+function socialStartUrl(projectUrl, body) {
+    const params = new URLSearchParams();
+    for (const key of ['callbackURL', 'errorCallbackURL', 'newUserCallbackURL']) {
+        if (body[key])
+            params.set(key, body[key]);
+    }
+    if (body.scopes?.length)
+        params.set('scopes', body.scopes.join(' '));
+    const query = params.toString();
+    const provider = encodeURIComponent(body.provider ?? '');
+    return `${projectUrl.replace(/\/$/, '')}${HTTP_ROUTES.authSignInSocial}/${provider}${query ? `?${query}` : ''}`;
+}
+/** The `token` a `/revoke-session` request names. The body reaches the hook serialized. */
+function revokedToken(body) {
+    try {
+        return (typeof body === 'string' ? JSON.parse(body) : body)?.token;
     }
-    /**
-     * Subscribe to auth changes, supabase-js style.
-     *
-     * The callback fires once with `INITIAL_SESSION` as soon as the stored
-     * session has been read, before any later event. That first call is not a
-     * nicety: the standard Supabase bootstrap is
-     * `if (event === 'INITIAL_SESSION') setLoading(false)`, and without it the
-     * app renders its loading state forever for a signed-out visitor, who never
-     * produces any other event.
-     *
-     * It is delivered asynchronously (after hydration), so unsubscribing
-     * synchronously suppresses it, exactly as in supabase-js.
-     */
-    /**
-     * The providers linked to the signed-in user, in the supabase-js identity
-     * shape. Backed by Better Auth's `list-accounts`, which is why `email` shows
-     * up as an identity for a password account: it is a real linked credential,
-     * exactly as in Supabase.
-     */
-    async getUserIdentities() {
-        try {
-            const accounts = await this.http.request(HTTP_ROUTES.authListAccounts, { raw: true });
-            const userId = this.store.get()?.user?.id ?? '';
-            const identities = (accounts ?? []).map(account => ({
-                id: account.accountId ?? account.id,
-                identity_id: account.id,
-                user_id: userId,
-                provider: account.providerId,
-                identity_data: { sub: account.accountId, ...(account.scopes ? { scopes: account.scopes } : {}) },
-                created_at: asIsoString(account.createdAt),
-                updated_at: asIsoString(account.updatedAt),
-                last_sign_in_at: asIsoString(account.updatedAt),
-            }));
-            return { data: { identities }, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
+    catch {
+        return undefined;
     }
-    /**
-     * Link another provider to the signed-in user. Like `signInWithOAuth`, this
-     * only starts the flow: the browser is sent to the provider and comes back
-     * through the callback.
-     */
-    async linkIdentity(credentials) {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authLinkSocial, {
-                method: 'POST',
-                body: {
-                    provider: credentials.provider,
-                    callbackURL: credentials.options?.redirectTo,
-                    scopes: credentials.options?.scopes?.split(/\s+/).filter(Boolean),
+}
+/**
+ * The callback URL a PKCE sign-in should use: the given one, or this page, with
+ * a fresh challenge on it. The verifier waits in `verifiers` for
+ * `exchangeCodeForSession`.
+ */
+async function pkceCallback(callbackURL, verifiers) {
+    const target = callbackURL ?? (typeof window !== 'undefined' ? window.location.href.split('#')[0] : undefined);
+    if (!target)
+        throw new Error('flowType "pkce" needs a callbackURL outside a browser.');
+    const verifier = generateCodeVerifier();
+    await verifiers.set(verifier);
+    return withCodeChallenge(target, await codeChallengeFor(verifier));
+}
+/** Motherbase's additions, as a Better Auth client plugin. */
+function motherbaseClient(http, store, options) {
+    // Bound when Better Auth hands over its fetch, which happens as the client
+    // is built, before any request can reach the session sync.
+    let revalidate = async () => undefined;
+    return {
+        id: 'motherbase',
+        fetchPlugins: [sessionSync(store, options, () => revalidate())],
+        getActions: $fetch => {
+            revalidate = () => $fetch('/get-session');
+            return {
+                onAuthStateChange(callback) {
+                    let active = true;
+                    const unsubscribe = store.subscribe((event, session) => {
+                        if (active)
+                            callback(EVENT_MAP[event], session);
+                    });
+                    void store.hydrate().then(session => {
+                        if (active)
+                            callback('INITIAL_SESSION', session);
+                    });
+                    return { data: { subscription: { unsubscribe: () => { active = false; unsubscribe(); } } } };
                 },
-                credentials: 'include',
-                raw: true,
-            });
-            const url = payload?.url ?? null;
-            if (url && !credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {
-                window.location.assign(url);
-            }
-            return { data: { provider: credentials.provider, url }, error: null };
-        }
-        catch (err) {
-            return { data: { provider: credentials.provider, url: null }, error: toError(err) };
-        }
-    }
-    /** Unlink a provider from the signed-in user. */
-    async unlinkIdentity(identity) {
-        try {
-            await this.http.request(HTTP_ROUTES.authUnlinkAccount, {
-                method: 'POST',
-                body: { providerId: identity.provider, accountId: identity.id },
-                raw: true,
-            });
-            return { data: {}, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /**
-     * Native mobile sign-in with a provider id token (Sign in with Apple, Google
-     * One Tap), routed to Better Auth's social sign-in with an `idToken`.
-     * The provider must be configured on the backend.
-     */
-    async signInWithIdToken(params) {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authSignInSocial, {
-                method: 'POST',
-                body: {
-                    provider: params.provider,
-                    idToken: {
-                        token: params.token,
-                        ...(params.access_token ? { accessToken: params.access_token } : {}),
-                        ...(params.nonce ? { nonce: params.nonce } : {}),
-                    },
+                async getSessionFromUrl(href) {
+                    const url = href ?? (typeof window !== 'undefined' ? window.location.href : undefined);
+                    const found = url ? readAccessTokenFromUrl(url) : null;
+                    if (!found)
+                        return { data: null, error: null };
+                    // Strip the token before the network call: a failed lookup must not
+                    // leave a usable token in the address bar or the history.
+                    if (!href && typeof window !== 'undefined') {
+                        window.history?.replaceState?.(window.history.state, '', found.cleanedHref);
+                    }
+                    // Checked before it is stored, so a rejected token never emits
+                    // SIGNED_IN. On success, sessionSync adopts it from the response.
+                    const { error } = await $fetch('/get-session', { auth: { type: 'Bearer', token: found.accessToken } });
+                    if (error)
+                        return { data: null, error };
+                    return currentSession(store) ?? { data: null, error: { message: 'The session in the URL is no longer valid.' } };
                 },
-                anonymous: true,
-                raw: true,
-            });
-            if (!payload?.token) {
-                return { data: { user: null, session: null }, error: { message: 'The provider did not return a session.' } };
-            }
-            const session = await this.persist(payload);
-            return { data: { user: session.user, session }, error: null };
-        }
-        catch (err) {
-            return { data: { user: null, session: null }, error: toError(err) };
-        }
-    }
-    /**
-     * Claims for the current session, as a JWT payload.
-     *
-     * supabase-js reads them out of the access token, which is itself a JWT.
-     * A Better Auth session token is an opaque bearer, so this asks the server's
-     * jwt plugin to mint one and decodes it. The decode is NOT a verification:
-     * the token came from the authenticated endpoint over TLS, and a client
-     * verifying a token it just asked for proves nothing. Verify server side,
-     * against `/api/auth/jwks`.
-     */
-    async getClaims() {
-        try {
-            const payload = await this.http.request(HTTP_ROUTES.authToken, { raw: true });
-            const token = payload?.token;
-            const claims = token ? decodeJwtPayload(token) : null;
-            if (!token || !claims) {
-                return { data: null, error: { message: 'No JWT is available for this session.' } };
-            }
-            return { data: { claims, token }, error: null };
-        }
-        catch (err) {
-            return { data: null, error: toError(err) };
-        }
-    }
-    /**
-     * Revalidate the session on a timer, the way supabase-js does while the tab
-     * is focused. Motherbase refreshes on a 401 already, so this is opt-in: it
-     * exists so a ported app that calls it keeps working, and so a long-lived
-     * screen notices a revoked session without waiting for its next request.
-     */
-    startAutoRefresh(intervalMs = 60000) {
-        this.stopAutoRefresh();
-        this.autoRefreshTimer = setInterval(() => {
-            if (this.store.get())
-                void this.refreshSession();
-        }, intervalMs);
-        // Node keeps the process alive for a pending timer; a background refresh
-        // must never be the reason a script does not exit.
-        this.autoRefreshTimer.unref?.();
-    }
-    /** Stop the timer started by `startAutoRefresh`. Safe to call when none runs. */
-    stopAutoRefresh() {
-        if (this.autoRefreshTimer !== null) {
-            clearInterval(this.autoRefreshTimer);
-            this.autoRefreshTimer = null;
-        }
-    }
-    onAuthStateChange(callback) {
-        let active = true;
-        const unsubscribeStore = this.store.subscribe((event, session) => {
-            if (active)
-                callback(EVENT_MAP[event], session);
-        });
-        void this.store.hydrate().then(session => {
-            if (active)
-                callback('INITIAL_SESSION', session);
-        });
-        return {
-            data: {
-                subscription: {
-                    unsubscribe: () => {
-                        active = false;
-                        unsubscribeStore();
-                    },
+                async exchangeCodeForSession(authCode) {
+                    const verifier = await options.verifiers.get();
+                    if (!verifier) {
+                        return { data: null, error: { message: 'No PKCE code verifier found: start the sign-in with flowType: "pkce" in this browser.' } };
+                    }
+                    const { error } = await $fetch('/exchange-code', {
+                        method: 'POST',
+                        body: { auth_code: authCode, code_verifier: verifier },
+                    });
+                    if (error)
+                        return { data: null, error };
+                    await options.verifiers.clear();
+                    return currentSession(store) ?? { data: null, error: { message: 'The code did not produce a session.' } };
                 },
-            },
-        };
-    }
-    /**
-     * Internal: refresh used by the HttpClient's 401 path. Returns true on success.
-     * Not part of the public Supabase surface.
-     */
-    async _refresh() {
-        const result = await this.refreshSession();
-        return result.error === null;
-    }
-    async persist(payload) {
-        const session = toSession(payload);
-        await this.store.set(session, 'signIn');
-        return session;
-    }
+                reauthenticate: () => $fetch('/reauthenticate', { method: 'POST' }),
+                updateUserCredentials: params => $fetch('/update-user-credentials', { method: 'POST', body: params }),
+                admin: adminActions(http),
+            };
+        },
+    };
+}
+function currentSession(store) {
+    const session = store.get();
+    return session ? { data: { user: session.user, session }, error: null } : null;
+}
+export function createAuthClient(http, store, options) {
+    const plugins = [
+        anonymousClient(),
+        emailOTPClient(),
+        magicLinkClient(),
+        phoneNumberClient(),
+        twoFactorClient(),
+        organizationClient({ teams: { enabled: true } }),
+        genericOAuthClient(),
+        jwtClient(),
+        passkeyClient(),
+        ssoClient(),
+        apiKeyClient(),
+        motherbaseClient(http, store, options),
+    ];
+    return createBetterAuthClient({
+        baseURL: `${options.url.replace(/\/$/, '')}${HTTP_ROUTES.auth}`,
+        fetchOptions: {
+            customFetchImpl: http.observedFetch(options.fetch),
+            headers: options.headers,
+            auth: { type: 'Bearer', token: async () => (await store.hydrate())?.accessToken },
+        },
+        plugins,
+    });
 }
 //# sourceMappingURL=auth.js.map