@motherbase/client 2.2.1 → 2.2.3

package/COMPATIBILITY.md

@@ -0,0 +1,157 @@
+<!--
+  GENERATED FILE. Do not edit by hand.
+  Written by apps/server/tests/sdk-contract.integration.test.ts.
+  Regenerate with: npm run test -w apps/server -- sdk-contract
+-->
+
+# @motherbase/client vs supabase-js
+
+Every row is produced by a contract test that runs the real `@motherbase/client` against a real Motherbase server backed by a real Postgres. Rows marked `Not supported` assert the current failure behaviour, so implementing the feature breaks the test and forces this table to be regenerated. The table cannot claim more or less than the code does.
+
+Legend:
+
+- `Supported`: behaves as supabase-js does.
+- `Partial`: works, with the difference stated in the note.
+- `Not supported`: not implemented today. The note says what happens if you call it.
+
+Totals: 67 supported, 14 partial, 14 not supported (95 rows).
+
+## Client
+
+| Test id | Surface | Status | Notes |
+| --- | --- | --- | --- |
+| `client.createClient` | `createClient(url, key, options)` | Supported | The key is sent as an apikey header. Options cover session storage, a fetch override and extra headers. |
+| `client.getChannels` | `client.getChannels()` | Supported | Returns the channels this client has created, as supabase-js does. |
+| `client.options-shape` | `createClient(url, key, { auth, db, global })` | Supported | supabase-js nests its options under auth, db, global and realtime, and ported code passes them that way. Both spellings are read, the flat one winning where they collide, so { auth: { persistSession } } and { global: { headers, fetch } } take effect instead of being silently dropped. auth.storage accepts either adapter shape, including a React Native AsyncStorage. |
+| `client.rpc` | `client.rpc(fn, args)` | Supported | POST and GET /rest/v1/rpc/:fn resolve a public function from the catalog and call it with named arguments inside the caller RLS transaction. SECURITY DEFINER functions are refused unless an operator allowlists them, and an unknown function is a 404. |
+| `client.schema` | `client.schema('other') / createClient(url, key, { db: { schema } })` | Partial | schema('public') is the client. schema(name).rpc() calls functions in another schema through the Content-Profile/Accept-Profile headers, for the schemas a feature exposes (Queues' pgmq_public); any other is refused with PGRST106. Tables are served from public only, so schema(name).from() and the db.schema constructor option throw with the reason rather than reading public under another name. |
+| `client.typed-database` | `createClient<Database>(url, key)` | Supported | motherbase gen types typescript emits the supabase-js Database shape (Row, Insert, Update, Relationships, Enums, Functions) from the Postgres catalog, and createClient<Database> types from() and rpc() from it. Unknown columns are still rejected at runtime as well. |
+
+## Data · verbs
+
+| Test id | Surface | Status | Notes |
+| --- | --- | --- | --- |
+| `data.verb.delete` | `from(t).delete().eq(col, v)` | Supported | Deleted rows are returned when .select() is requested. The delete is bound to the row versions whose realtime audience was captured. |
+| `data.verb.delete.unfiltered` | `from(t).delete()` | Partial | An unfiltered delete is refused with 400 for non-admin callers, on purpose. supabase-js would delete every visible row. |
+| `data.verb.insert.bulk` | `from(t).insert([rowA, rowB])` | Supported | An array body is compiled into one multi-row INSERT. Rows may declare different key subsets; a key a row omits is written as DEFAULT so the column default applies. |
+| `data.verb.insert.single` | `from(t).insert(row)` | Supported | One row per call; .select() returns it with server defaults applied. Without .select(), data is null. |
+| `data.verb.select` | `from(t).select('*')` | Supported | Awaitable, resolves to { data, error } and never throws for an API error. |
+| `data.verb.update` | `from(t).update(values).eq(col, v)` | Supported | Returns the updated rows when .select() is requested. A filter that matches nothing is a 404 rather than an empty array. |
+| `data.verb.upsert` | `from(t).upsert(rows, { onConflict })` | Supported | A real INSERT ... ON CONFLICT DO UPDATE. The conflict target is ?on_conflict= or the catalog primary key, and a row that actually conflicted emits an updated realtime event rather than a created one. |
+| `data.verb.write-returning` | `from(t).insert(row).select()` | Supported | Writes return no rows by default. Add .select() to opt into a representation, subject to the caller’s SELECT policy. |
+
+## Data · filters
+
+| Test id | Surface | Status | Notes |
+| --- | --- | --- | --- |
+| `data.filter.containedBy-overlaps` | `from(t).containedBy(col, v) / .overlaps(col, v)` | Supported | Compiled to the contained-by and overlap operators, on array and range columns. |
+| `data.filter.contains` | `from(t).contains(col, value)` | Supported | Compiled to the containment operator. It applies to array, range and jsonb columns; used on a scalar column it is a 400 rather than a silently empty result. |
+| `data.filter.eq` | `from(t).eq(col, v)` | Supported | Compiled to a parameterised equality. |
+| `data.filter.filter` | `from(t).filter(col, op, value)` | Supported | The escape hatch reaches any operator in the dialect, including ones with no dedicated builder method. |
+| `data.filter.gt-gte-lt-lte` | `from(t).gt/gte/lt/lte(col, v)` | Supported | All four compile to the matching SQL comparison. |
+| `data.filter.ilike` | `from(t).ilike(col, pattern)` | Supported | Case-insensitive ILIKE with PostgREST anchoring, so %ETA means "ends with eta" rather than a substring match. |
+| `data.filter.in` | `from(t).in(col, [..])` | Supported | Compiled to an IN list. The client quotes any value that needs it, so a value containing a comma stays one value instead of splitting into two. |
+| `data.filter.is` | `from(t).is(col, null \| true \| false)` | Supported | is null becomes IS NULL. Boolean forms become an equality. |
+| `data.filter.json-path` | `from(t).eq('col->>key', v)` | Supported | A jsonb path operand is parsed and compiled. The text arrow compares as text, the object arrow compares as jsonb, and every path segment is bound as a parameter rather than interpolated. |
+| `data.filter.like` | `from(t).like(col, pattern)` | Supported | Case-sensitive LIKE with PostgREST anchoring. * is translated to %, and an unanchored pattern is an exact match. |
+| `data.filter.match` | `from(t).match({ col: v })` | Supported | Expanded into one equality filter per key, all ANDed together. |
+| `data.filter.neq` | `from(t).neq(col, v)` | Supported | Compiled to !=, so NULL values are excluded exactly as in PostgREST. |
+| `data.filter.not` | `from(t).not(col, op, value)` | Supported | Emitted as a not. prefix and honoured on every operator, including not.is.null. |
+| `data.filter.or` | `from(t).or('a.eq.1,b.eq.2')` | Supported | Emitted as an or group and compiled recursively, so a nested and() inside it works too. |
+| `data.filter.range-operators` | `from(t).rangeGt/rangeGte/rangeLt/rangeLte/rangeAdjacent` | Supported | Emitted as the strictly-left, strictly-right, not-extending and adjacent operators. The compat fixture has no range column, so this pins the emitted encoding rather than a result set. |
+| `data.filter.textSearch` | `from(t).textSearch(col, query)` | Supported | Maps to the four text-search operators, with an optional configuration rendered in parentheses. |
+
+## Data · modifiers
+
+| Test id | Surface | Status | Notes |
+| --- | --- | --- | --- |
+| `data.modifier.abortSignal` | `from(t).select().abortSignal(signal)` | Supported | The signal is handed to fetch, so an aborted query settles as an error instead of resolving rows. |
+| `data.modifier.csv-explain` | `from(t).select().csv() / .explain()` | Partial | csv() returns RFC 4180 text. explain() is admin-only: the server answers 403 for a normal caller, so an application cannot rely on it. |
+| `data.modifier.limit` | `from(t).limit(n)` | Supported | Sent as ?limit=n. The server caps it at the console-tunable api.rest.maxRows (1000 by default). |
+| `data.modifier.limit.foreignTable` | `from(t).limit(n, { foreignTable })` | Supported | Emitted as <relation>.limit and applied to the embedded subquery, so a parent keeps all its rows while its children are capped. |
+| `data.modifier.maxAffected-rollback` | `from(t).update(v).maxAffected(n) / .rollback()` | Supported | maxAffected rejects and rolls back writes above the limit; rollback performs a dry run. Both preserve transaction atomicity even when no rows are requested. |
+| `data.modifier.maybeSingle` | `from(t).select().maybeSingle()` | Supported | Resolves the first row or null. Applied client side. |
+| `data.modifier.order` | `from(t).order(col, { ascending })` | Supported | Multiple order() calls are concatenated into one ?order= list, as PostgREST does. |
+| `data.modifier.order.options` | `from(t).order(col, { nullsFirst, referencedTable })` | Supported | nullsFirst emits the nullsfirst and nullslast qualifiers, and referencedTable scopes the ordering to an embedded relation. |
+| `data.modifier.range` | `from(t).range(from, to)` | Supported | Translated to limit and offset. The server also reads a Range request header and always answers with Content-Range and Range-Unit. |
+| `data.modifier.returns` | `from(t).select().returns<T>()` | Supported | A compile-time cast helper. It changes no request, matching supabase-js. |
+| `data.modifier.setHeader` | `from(t).select().setHeader(name, value)` | Supported | Sends the header with that request only. It is how a CAPTCHA token reaches a table guarded under Attack Protection. |
+| `data.modifier.single` | `from(t).select().single()` | Supported | Resolves one row, or a PGRST116 error when the result is not exactly one row. Applied client side. |
+| `data.modifier.throwOnError` | `from(t).select().throwOnError()` | Supported | Rejects instead of resolving { data: null, error }, so ported code using try/catch works. Without it the envelope is still the default, in both SDKs. |
+
+## Data · response
+
+| Test id | Surface | Status | Notes |
+| --- | --- | --- | --- |
+| `data.response.count` | `from(t).select('*', { count: 'exact' })` | Supported | Prefer count=exact, planned or estimated is honoured, and the total comes back with a Content-Range header computed in the same transaction as the rows. |
+| `data.response.default-limit` | `from(t).select() with no limit` | Supported | An unbounded select returns up to api.rest.maxRows (1000 by default), which is what PostgREST does with db-max-rows and what a Supabase app was built against. One number governs both the default and the ceiling, so lowering it is how you cap an unbounded read. |
+| `data.response.embedding` | `from(t).select('*, author(*)')` | Supported | Embedded resources compile to correlated LATERAL subqueries inside the same RLS transaction, so embedded rows are policy-filtered too. Aliases, !inner, FK hints, nested filter/order/limit and the count aggregate all work. |
+| `data.response.error-shape` | `{ data, error } result envelope` | Supported | Expected API failures resolve rather than throw. error is { message, status, code }. |
+| `data.response.select-alias-cast` | `from(t).select('alias:col, col::text')` | Supported | Renamed columns and casts both compile. A cast target must be a bare lowercase type name with an optional array marker, so it cannot smuggle SQL. |
+| `data.response.select-projection` | `from(t).select('id,label')` | Supported | Column lists are validated against the table and compiled into the SELECT list. |
+
+## Auth
+
+| Test id | Surface | Status | Notes |
+| --- | --- | --- | --- |
+| `auth.admin` | `auth.admin.*` | Partial | User administration, MFA factor administration (admin.mfa.listFactors / deleteFactor) and generateLink, only with a secret project API key. This is Motherbase's API, shaped like supabase-js, not Better Auth's admin plugin. Narrower than the supabase service role, which also opens SQL and DDL. generateLink covers signup, invite, magiclink and recovery; recovery is code-based here, so it returns email_otp and no action_link, and email_change_* is refused. |
+| `auth.better-auth` | `auth.<any Better Auth client method>` | Supported | client.auth is Better Auth's client, typed with every plugin the server mounts (anonymous, email OTP, magic link, phone number, two-factor, organization, generic OAuth, JWT, passkey, SSO, API keys). Method names, parameters and the { data, error } results are Better Auth's, so its documentation applies as written; the SDK stores the session it returns, which is what from(), storage and realtime then send. |
+| `auth.deleteUser` | `auth.deleteUser()` | Partial | Better Auth's deleteUser: self-service, which supabase-js only offers to an admin. It takes the password (or a fresh session), and clears the local session once the account is gone. |
+| `auth.exchangeCodeForSession` | `auth.exchangeCodeForSession(code) / getSessionFromUrl(href?)` | Supported | With flowType 'pkce' the S256 challenge rides on the callback URL and the redirect returns ?code=, exchanged once against the verifier this browser kept (automatically on load, as detectSessionInUrl does). The implicit flow remains the default: the token comes back in the fragment and getSessionFromUrl reads it and strips it from the URL. |
+| `auth.getClaims` | `auth.getClaims()` | Not supported | Use auth.token(): a Better Auth session token is an opaque bearer, so the jwt plugin mints a JWT for the session. Verify it server side against /api/auth/jwks. |
+| `auth.getSession` | `auth.getSession()` | Partial | Better Auth's getSession: it asks the server, so it is the verified read, and returns { session, user } with Better Auth's session row rather than a token pair. A session the server no longer knows is cleared locally. The stored session without a network call is client.hydrate(). |
+| `auth.getUser` | `auth.getUser()` | Not supported | Use auth.getSession(), which asks the server and returns the user with the session. |
+| `auth.identities` | `auth.getUserIdentities() / linkIdentity() / unlinkIdentity()` | Not supported | Use auth.listAccounts(), auth.linkSocial({ provider, callbackURL }) and auth.unlinkAccount({ providerId }). A password account lists its credential account. |
+| `auth.mfa` | `auth.mfa.*` | Not supported | Use auth.twoFactor: enable({ password }) returns the TOTP URI and backup codes, verifyTotp / verifyOtp / verifyBackupCode finish a sign-in that answered twoFactorRedirect, disable({ password }) turns it off. The aal the server stamps on a session is on auth.getSession(). |
+| `auth.onAuthStateChange` | `auth.onAuthStateChange(cb)` | Supported | Fires INITIAL_SESSION once on subscribe, as supabase-js does, so an app that clears its loading flag on that event also clears it for a signed-out visitor. Then SIGNED_IN, USER_UPDATED, MFA_CHALLENGE_VERIFIED and SIGNED_OUT as the Better Auth calls change the session. There is no TOKEN_REFRESHED: Better Auth sessions are not rotated. Returns { data: { subscription } }. |
+| `auth.refreshSession` | `auth.refreshSession() / startAutoRefresh()` | Not supported | Better Auth sessions have no refresh token to rotate. auth.getSession() revalidates, and the client already does so on a 401. |
+| `auth.resetPassword` | `auth.resetPasswordForEmail(email)` | Not supported | Use auth.emailOtp.requestPasswordReset({ email }), then auth.emailOtp.resetPassword({ email, otp, password }): the reset is completed with a one time code rather than a redirect link. |
+| `auth.session-shape` | `session.access_token / user.user_metadata` | Partial | The session the SDK stores (client.hydrate(), onAuthStateChange) carries the supabase-js spellings alongside the native ones: access_token, refresh_token (always null), token_type, and on the user aud, role, created_at, email_confirmed_at, phone, identities and user_metadata holding the profile fields. app_metadata is {} rather than a guessed provider, and expires_at is absent. Better Auth's own responses keep its native shape. |
+| `auth.setSession` | `auth.setSession({ access_token, refresh_token })` | Not supported | A session token from elsewhere is adopted through the storage adapter the client is created with, or through auth.getSessionFromUrl() on an OAuth return. |
+| `auth.signInWithIdToken` | `auth.signInWithIdToken({ provider, token })` | Not supported | Use auth.signIn.social({ provider, idToken: { token } }), for Sign in with Apple and Google One Tap from a native app. The provider must be configured on the backend. |
+| `auth.signInWithOAuth` | `auth.signInWithOAuth({ provider, options })` | Not supported | Use auth.signIn.social({ provider, callbackURL }). In a browser it navigates to the server's start route, which keeps the OAuth state cookie first-party; disableRedirect: true returns the URL instead. The redirect back is completed by getSessionFromUrl(), on load by default. |
+| `auth.signInWithOtp` | `auth.signInWithOtp({ email \| phone }) then auth.verifyOtp({ token })` | Not supported | Use auth.emailOtp.sendVerificationOtp({ email, type: 'sign-in' }) then auth.signIn.emailOtp({ email, otp }); by SMS, auth.phoneNumber.sendOtp and auth.phoneNumber.verify, when the phone-number plugin is on with a sender configured. Magic links are auth.signIn.magicLink. |
+| `auth.signInWithPassword` | `auth.signInWithPassword({ email, password })` | Not supported | Use auth.signIn.email({ email, password }). The session is stored through the configured storage adapter and SIGNED_IN fires; with two-factor on, the answer is { twoFactorRedirect: true } and no session until auth.twoFactor verifies a code. |
+| `auth.signInWithSSO` | `auth.signInWithSSO({ domain })` | Not supported | Use auth.signIn.sso({ email, callbackURL }), or name the provider by domain, providerId or organizationSlug instead of email. The project needs the SSO plugin on and a provider registered; providers are managed with auth.sso.*. |
+| `auth.signOut` | `auth.signOut()` | Supported | Better Auth's signOut: revokes the server session and clears the local one. Other devices are auth.revokeOtherSessions(), every device auth.revokeSessions(). |
+| `auth.signUp` | `auth.signUp({ email, password })` | Not supported | Use auth.signUp.email({ email, password, name }). It answers { token, user }, with a null token while the project requires email verification first. |
+| `auth.updateUser` | `auth.updateUser({ data, email, password })` | Partial | Better Auth's updateUser takes the profile fields flat ({ name, image, ...additional fields }), not under data. A password is auth.changePassword({ currentPassword, newPassword }); an anonymous user's first email, a first password, or a password replaced with the nonce from auth.reauthenticate() is auth.updateUserCredentials(). |
+
+## Storage
+
+| Test id | Surface | Status | Notes |
+| --- | --- | --- | --- |
+| `storage.bucket-admin` | `storage.createBucket/getBucket/listBuckets/updateBucket/emptyBucket/deleteBucket` | Partial | All six are on the client and every one needs a secret project API key, which is the same rule Supabase applies to bucket administration. With a publishable key they resolve with a 401 rather than a partial answer. deleteBucket refuses a bucket that still holds objects unless force is passed, so one unqualified call cannot destroy the files in it. |
+| `storage.createSignedUrl` | `storage.from(b).createSignedUrl(path, expiresIn)` | Partial | expiresIn is read, in seconds, and validated from 1 second to 7 days (the AWS SigV4 ceiling); a longer lifetime is refused rather than quietly clamped. It resolves to { signedUrl, expiresAt }, and expiresAt is null when nothing actually expires: a public object URL is permanent, and a private object on the local driver resolves to the authenticated streaming endpoint, which is bound to the session rather than to a clock. |
+| `storage.createSignedUrls` | `storage.from(b).createSignedUrls(paths, expiresIn)` | Supported | Signs each key and reports per entry, so a missing object yields one entry carrying an error instead of failing the batch. There is no batch endpoint behind it: it is one request per key. |
+| `storage.download` | `storage.from(b).download(path)` | Supported | Resolves a Blob, addressed by the key the object was uploaded under. A file id is still accepted. |
+| `storage.getPublicUrl` | `storage.from(b).getPublicUrl(path)` | Supported | Synchronous, returns { data: { publicUrl } } built from the client base URL. |
+| `storage.info-exists` | `storage.from(b).info(path) / .exists(path)` | Supported | info returns the object's metadata without its body, in the supabase-js shape. exists reports false only for a 404: an authorization failure is reported as an error, because treating one as absence is how a UI offers to create something that is already there. |
+| `storage.list` | `storage.from(b).list(prefix, options)` | Supported | Lists objects under a prefix in the Supabase response shape (name, id, created_at, updated_at, metadata), with limit, offset, search and sortBy. Keys come back relative to the bucket. |
+| `storage.move-copy` | `storage.from(b).move(from, to) / .copy(from, to)` | Supported | Both work within one bucket. The bytes stream through the upload path, so bucket quota, the size guard and the mime allowlist apply to a copy exactly as to a fresh upload. move deletes the source only once the copy has landed. |
+| `storage.remove` | `storage.from(b).remove([path])` | Supported | Addressed by the key the object was uploaded under, as in supabase-js, and reported per entry. A bare file id still resolves, exactly as it does for download. |
+| `storage.signed-upload` | `storage.from(b).createSignedUploadUrl(path) / .uploadToSignedUrl(path, token, file)` | Partial | Both exist and land the object at the key you asked for, but createSignedUploadUrl needs the byte size and content type up front: the upload is reserved against the bucket quota and the signature is bound to that exact length, which is what stops a signed URL becoming an unbounded write. Requires the S3 driver; the local driver has no presigned uploads. |
+| `storage.transform` | `storage.from(b).download(path, { transform })` | Supported | Also getPublicUrl and createSignedUrl with { transform }, served by /storage/v1/render/image with Supabase limits. Without format, WebP is negotiated from Accept. |
+| `storage.update` | `storage.from(b).update(path, file)` | Supported | upload with upsert forced on, exactly as in supabase-js. |
+| `storage.upload` | `storage.from(b).upload(path, file, options)` | Supported | The key is the one you passed. avatars/{uid}/pic.png style paths round trip through upload, download, remove and the signed URL. The file id keeps working everywhere a path does. |
+| `storage.upload.options` | `storage.from(b).upload(path, file, { upsert, contentType })` | Partial | upsert works: without it a second write to the same key is a 409, with it the object is replaced. contentType overrides what the file itself declares. supabase-js' cacheControl is not part of UploadOptions, so a ported call naming it is a type error rather than a silently dropped option: cache headers are decided by the driver and, for a transform, by the render endpoint. |
+
+## Realtime
+
+| Test id | Surface | Status | Notes |
+| --- | --- | --- | --- |
+| `realtime.broadcast` | `channel(n).on('broadcast', { event }, cb) and channel.send(...)` | Supported | Routed by topic. config.broadcast.self and config.broadcast.ack are both honoured. |
+| `realtime.channel.private` | `channel(n, { config: { private: true } })` | Supported | The flag is sent in the join payload; the server then checks the RLS policies on realtime.messages (SELECT to receive, INSERT to send or track). |
+| `realtime.channel.unknown-event` | `channel(n).on('system', ...)` | Not supported | Only broadcast, presence and postgres_changes are accepted. Anything else throws immediately. |
+| `realtime.postgres_changes` | `channel(n).on('postgres_changes', { event, schema, table, filter }, cb).subscribe()` | Supported | INSERT, UPDATE, DELETE and * are delivered with the supabase payload shape. Server side the stream is RLS filtered. |
+| `realtime.presence` | `channel(n).on('presence', ...) with track/untrack/presenceState` | Supported | The server sends full state and the client diffs it into sync, join and leave, keyed by config.presence.key. |
+| `realtime.removeChannel` | `client.removeChannel(channel) / client.removeAllChannels()` | Supported | Unsubscribes and drops the channel, resolving to "ok". |
+| `realtime.subscribe.status` | `channel.subscribe(status => {})` | Supported | Reports SUBSCRIBED, TIMED_OUT, CLOSED and CHANNEL_ERROR, as supabase-js does. |
+
+## Edge functions
+
+| Test id | Surface | Status | Notes |
+| --- | --- | --- | --- |
+| `functions.invoke` | `functions.invoke(name, { body })` | Supported | POSTs the JSON body to /api/edge/:name with the current session bearer attached. |
+| `functions.invoke.error` | `functions.invoke error handling` | Partial | invoke resolves { data: null, error } rather than throwing, but error is a real FunctionsHttpError (or FunctionsFetchError when the request never reached the server), so an instanceof check ported from supabase-js still works. |
+| `functions.invoke.options` | `functions.invoke(name, { headers, method, region })` | Partial | method and headers are honoured: the invoke route answers every verb and forwards the request headers to the function, so a function reading req.method sees the one you asked for. region is accepted and ignored, because a self-hosted Motherbase runs its functions in one place. |

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Motherbase contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Motherbase contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -31,7 +31,7 @@ traversal-checked. `copy`, `move`, `info`, `exists`, batch signed URLs and
 direct-to-storage signed uploads are supported; image transforms are not.
 Authorization is ownership plus bucket tokens by default, and real RLS policies on
 `storage.files` when the `storage.policies` setting is on. See
-[`docs/migrating-from-supabase.md`](../../docs/migrating-from-supabase.md).
+[`docs/migrating-from-supabase.md`](https://github.com/JulienGuinot/Boilerplate-backend/blob/master/docs/migrating-from-supabase.md).
 
 On the server, `createClient(url, secretKey)` also authorizes storage objects as
 `service_role`, including objects uploaded by another user. Secret-key
@@ -75,6 +75,18 @@ requiring client read access. It does not enable event delivery for arbitrary
 SQL-editor or RPC writes. Motherbase's `transaction()` extension retains its
 existing batch response contract.
 
+Transaction callbacks describe writes without awaiting the individual builders.
+Awaiting a transaction builder is rejected before any request is sent. The batch
+endpoint does not support per-operation preferences or headers: `rollback()`,
+`maxAffected()`, upsert conflict preferences, count options and custom headers
+are rejected locally instead of being silently ignored. Use a standalone query
+for those options.
+
+Multiple `postgres_changes` bindings on one realtime channel require a server
+that advertises binding-id support in its join acknowledgement. Older servers
+remain usable with one binding per channel; a multi-binding subscription reports
+`CHANNEL_ERROR` with upgrade instructions.
+
 **Invalid keys are refused.** A project key that is unknown or revoked now
 answers `401 UNAUTHORIZED` even when the project does not require an API key.
 Before, it was ignored and the request ran as anonymous. Remove stale keys from
@@ -85,6 +97,30 @@ on global `fetch`. Its runtime dependencies are Better Auth's client and its
 plugins; `socket.io-client` is an optional peer dependency, used only for
 realtime.
 
+## Upgrading from 1.x
+
+Only the auth renames fail to compile. Go through the rest by hand:
+
+1. **Upgrade the server first**, with its migrations applied
+   (`20260924120000_rest_write_capture` among them). A 2.x client does not check
+   the server version.
+2. **Auth calls are Better Auth's.** `signInWithPassword` is `signIn.email`,
+   `signUp` is `signUp.email` (which requires `name`), `getUser` is gone.
+   [`COMPATIBILITY.md`](./COMPATIBILITY.md) has every rename;
+   `motherbase migrate codemod` lists the ones in your code.
+3. **Authorize on `auth.getSession()`**: it asks the server. `client.hydrate()`
+   returns what storage holds, unverified.
+4. **Writes resolve `data: null` without `.select()`**, now in the types too: a
+   1.x call that read `data` from a bare `insert()` stops compiling.
+5. **A stale project key is a 401** (see *Invalid keys are refused* above).
+
+Signed-in users stay signed in: 1.x already stored the server's Better Auth
+session token, in the same shape.
+
+On npm 10, `npm install` crashes resolving Better Auth 1.6's optional peers
+(`Cannot read properties of null (reading 'edgesOut')`), with or without this
+package. Use npm 11+, or `legacy-peer-deps=true` in `.npmrc`.
+
 ## Install
 
 ```bash
@@ -192,6 +228,17 @@ client.from('posts').select('id, comments(count)')                // aggregate
 // unless an operator allowlists them.
 client.rpc(fn, args, { get, head, count })
 
+// The same tables, Prisma-style. Sends the same requests as from(), but throws
+// on failure instead of resolving { data, error }. Operators: equals not in gt
+// gte lt lte contains startsWith endsWith. Embedded relations and or() stay on from().
+client.db.posts.findMany({ where: { published: true, views: { gt: 100 } }, select: { id: true, title: true },
+  orderBy: { created_at: 'desc' }, take: 20, skip: 40 })
+client.db.posts.findFirst({ where: { id } })               // row | null
+client.db.posts.create({ data: { title } })                // the inserted row
+client.db.posts.updateMany({ where: { id }, data: { title } }) | .deleteMany({ where: { id } })
+// Both resolve the affected rows, and refuse a where that matches no column:
+// { id: undefined } would otherwise write every row.
+
 // Auth → Better Auth's client: https://www.better-auth.com/docs. A sample of
 // what is there; each plugin needs to be on in the project's Auth settings.
 client.auth.signUp.email({ email, password, name })
@@ -394,6 +441,7 @@ Regenerate it locally with:
 npm run test -w apps/server -- sdk-contract
 ```
 
-More examples live in [`docs/sdk.md`](../../docs/sdk.md). Project Studio also
-exposes a project-specific Connect page with the exact API URL, WebSocket URL and
-project ID to paste into `.env`.
+More examples live in
+[`docs/sdk.md`](https://github.com/JulienGuinot/Boilerplate-backend/blob/master/docs/sdk.md).
+Project Studio also exposes a project-specific Connect page with the exact API
+URL, WebSocket URL and project ID to paste into `.env`.

package/dist/admin/auth-admin-client.d.ts

@@ -0,0 +1,43 @@
+import { HttpClient } from "../http/index.js";
+import { MotherbaseResponse } from "../types.js";
+import { User } from "../auth/types.js";
+import { AuthAdminMfaClient } from "./auth-admin-mfa-client.js";
+import { AdminCreatedUser, AdminCreateUserParams, AdminGeneratedLink, AdminGenerateLinkParams, AdminListUsersParams, AdminUpdateUserParams, AdminUserList } from "./types.js";
+/** User administration, `client.auth.admin`. Secret key only: never ship it to a browser. */
+export declare class AuthAdminClient {
+    private readonly http;
+    /** Users' second factors. */
+    readonly mfa: AuthAdminMfaClient;
+    constructor(http: HttpClient);
+    /** The link (or code) an auth email would carry, returned instead of sent. */
+    generateLink(params: AdminGenerateLinkParams): Promise<MotherbaseResponse<AdminGeneratedLink>>;
+    /** Every user, a page at a time (`page`, `perPage`). */
+    listUsers(params?: AdminListUsersParams): Promise<MotherbaseResponse<AdminUserList>>;
+    /** One user, or `{ user: null }` when the id matches none. */
+    getUserById(id: string): Promise<MotherbaseResponse<{
+        user: User | null;
+    }>>;
+    /** Create a user directly, without the sign-up flow or its emails. */
+    createUser(params: AdminCreateUserParams): Promise<MotherbaseResponse<AdminCreatedUser>>;
+    /** Change a user's email, password, role or profile. */
+    updateUserById(id: string, params: AdminUpdateUserParams): Promise<MotherbaseResponse<{
+        user: User | null;
+    }>>;
+    /** Delete a user. */
+    deleteUser(id: string): Promise<MotherbaseResponse<{
+        id: string;
+    }>>;
+    /** End every session this user holds, everywhere. */
+    signOut(userId: string): Promise<MotherbaseResponse<{
+        id: string;
+    }>>;
+    /** Create the account and email the temporary password to it. */
+    inviteUserByEmail(email: string, options?: {
+        username?: string;
+        role?: 'ADMIN' | 'USER';
+    }): Promise<MotherbaseResponse<{
+        user: User;
+        invited: boolean;
+    }>>;
+}
+//# sourceMappingURL=auth-admin-client.d.ts.map

package/dist/admin/auth-admin-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-admin-client.d.ts","sourceRoot":"","sources":["../../src/admin/auth-admin-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,aAAa,EAAQ,MAAM,YAAY,CAAC;AAIpL,6FAA6F;AAC7F,qBAAa,eAAe;IAIZ,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,6BAA6B;IAC7B,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;gBAEJ,IAAI,EAAE,UAAU;IAI7C,8EAA8E;IAC9E,YAAY,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;IAI9F,wDAAwD;IACxD,SAAS,CAAC,MAAM,GAAE,oBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAQxF,8DAA8D;IACxD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAMjF,sEAAsE;IACtE,UAAU,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAIxF,wDAAwD;IAClD,cAAc,CAChB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,qBAAqB,GAC9B,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAKrD,qBAAqB;IACrB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAOnE,qDAAqD;IACrD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAOpE,iEAAiE;IACjE,iBAAiB,CACb,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAO,GAC7D,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAMnE"}

package/dist/admin/auth-admin-client.js

@@ -0,0 +1,62 @@
+import { settle } from "../http/utils.js";
+import { AuthAdminMfaClient } from "./auth-admin-mfa-client.js";
+import { BASE } from "./types.js";
+const userPath = (id) => `${BASE}/users/${encodeURIComponent(id)}`;
+/** User administration, `client.auth.admin`. Secret key only: never ship it to a browser. */
+export class AuthAdminClient {
+    constructor(http) {
+        this.http = http;
+        this.mfa = new AuthAdminMfaClient(http);
+    }
+    /** The link (or code) an auth email would carry, returned instead of sent. */
+    generateLink(params) {
+        return settle(() => this.http.request(`${BASE}/generate-link`, { method: 'POST', body: params }));
+    }
+    /** Every user, a page at a time (`page`, `perPage`). */
+    listUsers(params = {}) {
+        const query = new URLSearchParams();
+        if (params.page !== undefined)
+            query.set('page', String(params.page));
+        if (params.perPage !== undefined)
+            query.set('per_page', String(params.perPage));
+        const suffix = query.toString();
+        return settle(() => this.http.request(`${BASE}/users${suffix ? `?${suffix}` : ''}`));
+    }
+    /** One user, or `{ user: null }` when the id matches none. */
+    async getUserById(id) {
+        const { data, error } = await settle(() => this.http.request(userPath(id)));
+        // supabase-js answers a failed lookup with `{ user: null }`, not `null`.
+        return { data: data ?? { user: null }, error };
+    }
+    /** Create a user directly, without the sign-up flow or its emails. */
+    createUser(params) {
+        return settle(() => this.http.request(`${BASE}/users`, { method: 'POST', body: params }));
+    }
+    /** Change a user's email, password, role or profile. */
+    async updateUserById(id, params) {
+        const { data, error } = await settle(() => this.http.request(userPath(id), { method: 'PATCH', body: params }));
+        return { data: data ?? { user: null }, error };
+    }
+    /** Delete a user. */
+    deleteUser(id) {
+        return settle(async () => {
+            await this.http.request(userPath(id), { method: 'DELETE' });
+            return { id };
+        });
+    }
+    /** End every session this user holds, everywhere. */
+    signOut(userId) {
+        return settle(async () => {
+            await this.http.request(`${userPath(userId)}/sign-out`, { method: 'POST' });
+            return { id: userId };
+        });
+    }
+    /** Create the account and email the temporary password to it. */
+    inviteUserByEmail(email, options = {}) {
+        return settle(() => this.http.request(`${BASE}/invite`, {
+            method: 'POST',
+            body: { email, ...options },
+        }));
+    }
+}
+//# sourceMappingURL=auth-admin-client.js.map

package/dist/admin/auth-admin-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-admin-client.js","sourceRoot":"","sources":["../../src/admin/auth-admin-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAoJ,IAAI,EAAE,MAAM,YAAY,CAAC;AAEpL,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,GAAG,IAAI,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;AAE3E,6FAA6F;AAC7F,MAAM,OAAO,eAAe;IAIxB,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,8EAA8E;IAC9E,YAAY,CAAC,MAA+B;QACxC,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAqB,GAAG,IAAI,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1H,CAAC;IAED,wDAAwD;IACxD,SAAS,CAAC,SAA+B,EAAE;QACvC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgB,GAAG,IAAI,SAAS,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,WAAW,CAAC,EAAU;QACxB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAiB,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,yEAAyE;QACzE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,sEAAsE;IACtE,UAAU,CAAC,MAA6B;QACpC,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAmB,GAAG,IAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAChH,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,cAAc,CAChB,EAAU,EACV,MAA6B;QAE7B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAiB,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/H,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,qBAAqB;IACrB,UAAU,CAAC,EAAU;QACjB,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,EAAE,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,qDAAqD;IACrD,OAAO,CAAC,MAAc;QAClB,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;IACP,CAAC;IAED,iEAAiE;IACjE,iBAAiB,CACb,KAAa,EACb,UAA0D,EAAE;QAE5D,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAmC,GAAG,IAAI,SAAS,EAAE;YACtF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE;SAC9B,CAAC,CAAC,CAAC;IACR,CAAC;CACJ"}

package/dist/admin/auth-admin-mfa-client.d.ts

@@ -0,0 +1,22 @@
+import { HttpClient } from "../http/index.js";
+import { MotherbaseResponse } from "../types.js";
+import { AdminMfaFactor } from "./types.js";
+/** A user's second factors (TOTP, passkeys), `client.auth.admin.mfa`. Secret key only. */
+export declare class AuthAdminMfaClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** The second factors a user has enrolled. */
+    listFactors(params: {
+        userId: string;
+    }): Promise<MotherbaseResponse<{
+        factors: AdminMfaFactor[];
+    }>>;
+    /** Remove one of a user's second factors, e.g. to recover a lost device. */
+    deleteFactor(params: {
+        userId: string;
+        id: string;
+    }): Promise<MotherbaseResponse<{
+        id: string;
+    }>>;
+}
+//# sourceMappingURL=auth-admin-mfa-client.d.ts.map

package/dist/admin/auth-admin-mfa-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-admin-mfa-client.d.ts","sourceRoot":"","sources":["../../src/admin/auth-admin-mfa-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAQ,MAAM,YAAY,CAAC;AAElD,0FAA0F;AAC1F,qBAAa,kBAAkB;IACf,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,8CAA8C;IAC9C,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,cAAc,EAAE,CAAA;KAAE,CAAC,CAAC;IAMnG,4EAA4E;IAC5E,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAMpG"}

package/dist/admin/auth-admin-mfa-client.js

@@ -0,0 +1,17 @@
+import { settle } from "../http/utils.js";
+import { BASE } from "./types.js";
+/** A user's second factors (TOTP, passkeys), `client.auth.admin.mfa`. Secret key only. */
+export class AuthAdminMfaClient {
+    constructor(http) {
+        this.http = http;
+    }
+    /** The second factors a user has enrolled. */
+    listFactors(params) {
+        return settle(() => this.http.request(`${BASE}/users/${encodeURIComponent(params.userId)}/factors`));
+    }
+    /** Remove one of a user's second factors, e.g. to recover a lost device. */
+    deleteFactor(params) {
+        return settle(() => this.http.request(`${BASE}/users/${encodeURIComponent(params.userId)}/factors/${encodeURIComponent(params.id)}`, { method: 'DELETE' }));
+    }
+}
+//# sourceMappingURL=auth-admin-mfa-client.js.map

package/dist/admin/auth-admin-mfa-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-admin-mfa-client.js","sourceRoot":"","sources":["../../src/admin/auth-admin-mfa-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAkB,IAAI,EAAE,MAAM,YAAY,CAAC;AAElD,0FAA0F;AAC1F,MAAM,OAAO,kBAAkB;IAC3B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAI,CAAC;IAElD,8CAA8C;IAC9C,WAAW,CAAC,MAA0B;QAClC,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CACjC,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAC/D,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAC5E,YAAY,CAAC,MAAsC;QAC/C,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CACjC,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAC7F,EAAE,MAAM,EAAE,QAAQ,EAAE,CACvB,CAAC,CAAC;IACP,CAAC;CACJ"}

package/dist/admin/types.d.ts

@@ -0,0 +1,85 @@
+import { User } from '../auth/types.js';
+/**
+ * `client.auth.admin`, shaped like `supabase.auth.admin`.
+ *
+ * Every method here needs a **secret** project API key, so the client it hangs
+ * off must have been built with one. A publishable key gets a 401 from the
+ * server, which is the correct outcome: these calls create and delete users
+ * without being any user.
+ *
+ * Two differences from supabase-js worth knowing before you port code:
+ *
+ *   * Scope. This is user administration only. Supabase's service key also opens
+ *     SQL and DDL; here those stay behind operator authentication, so a leaked
+ *     application key cannot drop a table.
+ *   * `generateLink` covers signup, invite, magiclink and recovery. Recovery is
+ *     code-based here, so it returns `email_otp` and no `action_link`, and the
+ *     `email_change_*` types are refused.
+ */
+export interface AdminListUsersParams {
+    page?: number;
+    perPage?: number;
+}
+export interface AdminUserList {
+    users: User[];
+    page: number;
+    perPage: number;
+    total: number;
+}
+export interface AdminCreateUserParams {
+    email: string;
+    password?: string;
+    username?: string;
+    role?: 'ADMIN' | 'USER';
+    /** Mark the address verified without sending a confirmation. */
+    email_confirm?: boolean;
+    /** Also email the temporary password. `invite()` is the same thing, named. */
+    sendInvite?: boolean;
+}
+export interface AdminCreatedUser {
+    user: User;
+    /** Generated when no password was supplied. Never logged by the SDK. */
+    temporaryPassword: string;
+    invited: boolean;
+}
+export interface AdminUpdateUserParams {
+    password?: string;
+    role?: 'ADMIN' | 'USER';
+    username?: string;
+    firstName?: string;
+    lastName?: string;
+    status?: string;
+}
+export interface AdminGenerateLinkParams {
+    type: 'signup' | 'invite' | 'magiclink' | 'recovery' | 'email_change_current' | 'email_change_new';
+    email: string;
+    /** Required for `signup`. */
+    password?: string;
+    newEmail?: string;
+    options?: {
+        redirectTo?: string;
+        data?: Record<string, unknown>;
+    };
+}
+export interface AdminGeneratedLink {
+    properties: {
+        /** The link the email would carry. Null for `recovery`, which is code-based here. */
+        action_link: string | null;
+        email_otp: string | null;
+        hashed_token: string | null;
+        redirect_to: string | null;
+        verification_type: string;
+    };
+    user: User | null;
+}
+/** A supabase-js `Factor`: TOTP from two-factor, and each passkey as `webauthn`. */
+export interface AdminMfaFactor {
+    id: string;
+    factor_type: 'totp' | 'webauthn';
+    status: 'verified' | 'unverified';
+    friendly_name: string;
+    created_at: string | null;
+    updated_at: string | null;
+}
+export declare const BASE: "/api/auth/admin";
+//# sourceMappingURL=types.d.ts.map

package/dist/admin/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/admin/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,oBAAoB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC1B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,gEAAgE;IAChE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,wEAAwE;IACxE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACpC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,sBAAsB,GAAG,kBAAkB,CAAC;IACnG,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CACrE;AAED,MAAM,WAAW,kBAAkB;IAC/B,UAAU,EAAE;QACR,qFAAqF;QACrF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,iBAAiB,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;CACrB;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,IAAI,mBAAwB,CAAC"}

package/dist/admin/types.js

@@ -0,0 +1,3 @@
+import { HTTP_ROUTES } from '@motherbase/contracts';
+export const BASE = HTTP_ROUTES.authAdmin;
+//# sourceMappingURL=types.js.map

package/dist/admin/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/admin/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AA2FpD,MAAM,CAAC,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC"}

package/dist/auth/constants.d.ts

@@ -0,0 +1,21 @@
+import { AuthChangeEvent, AuthEvent } from "./types.js";
+export declare const EVENT_MAP: Record<AuthEvent, AuthChangeEvent>;
+/**
+ * Endpoints whose next step needs a cookie set on the response: the OAuth
+ * state, the WebAuthn challenge, or the pending second factor a password
+ * sign-in leaves for `twoFactor.verify*`. Cross-origin, fetch only keeps and
+ * resends a cookie with `credentials: 'include'`. Everything else stays
+ * `same-origin`, so a backend that does not allow credentialed CORS still
+ * serves it.
+ */
+export declare const COOKIE_PATHS: string[];
+/** Sign-ins that come back through the server's OAuth callback, where the PKCE challenge rides. */
+export declare const REDIRECT_SIGN_IN_PATHS: string[];
+/** Calls after which the session this client holds no longer exists. */
+export declare const SIGN_OUT_PATHS: Set<string>;
+/**
+ * Calls that change the user but answer without it (`{ status: true }`): the
+ * session is read again after them, so the stored user and USER_UPDATED follow.
+ */
+export declare const USER_CHANGE_PATHS: Set<string>;
+//# sourceMappingURL=constants.d.ts.map

package/dist/auth/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/auth/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,eAAe,CAMxD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,UAQxB,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,UAAsC,CAAC;AAE1E,wEAAwE;AACxE,eAAO,MAAM,cAAc,aAA6C,CAAC;AAEzE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,aAAgG,CAAC"}