@motherbase/client 2.2.1 → 2.2.3

package/dist/auth/constants.js

@@ -0,0 +1,34 @@
+export const EVENT_MAP = {
+    signIn: 'SIGNED_IN',
+    signOut: 'SIGNED_OUT',
+    tokenRefreshed: 'TOKEN_REFRESHED',
+    userUpdated: 'USER_UPDATED',
+    mfaVerified: 'MFA_CHALLENGE_VERIFIED',
+};
+/**
+ * Endpoints whose next step needs a cookie set on the response: the OAuth
+ * state, the WebAuthn challenge, or the pending second factor a password
+ * sign-in leaves for `twoFactor.verify*`. Cross-origin, fetch only keeps and
+ * resends a cookie with `credentials: 'include'`. Everything else stays
+ * `same-origin`, so a backend that does not allow credentialed CORS still
+ * serves it.
+ */
+export const COOKIE_PATHS = [
+    '/sign-in/email',
+    '/sign-in/phone-number',
+    '/two-factor/',
+    '/sign-in/social',
+    '/sign-in/sso',
+    '/link-social',
+    '/passkey/',
+];
+/** Sign-ins that come back through the server's OAuth callback, where the PKCE challenge rides. */
+export const REDIRECT_SIGN_IN_PATHS = ['/sign-in/social', '/sign-in/sso'];
+/** Calls after which the session this client holds no longer exists. */
+export const SIGN_OUT_PATHS = new Set(['/sign-out', '/revoke-sessions']);
+/**
+ * Calls that change the user but answer without it (`{ status: true }`): the
+ * session is read again after them, so the stored user and USER_UPDATED follow.
+ */
+export const USER_CHANGE_PATHS = new Set(['/update-user', '/change-email', '/update-user-credentials', '/two-factor/disable']);
+//# sourceMappingURL=constants.js.map

package/dist/auth/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/auth/constants.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,SAAS,GAAuC;IAC3D,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,cAAc,EAAE,iBAAiB;IACjC,WAAW,EAAE,cAAc;IAC3B,WAAW,EAAE,wBAAwB;CACtC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,gBAAgB;IAChB,uBAAuB;IACvB,cAAc;IACd,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,WAAW;CACZ,CAAC;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;AAE1E,wEAAwE;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,eAAe,EAAE,0BAA0B,EAAE,qBAAqB,CAAC,CAAC,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,5 @@
+import { HttpClient } from '../http/index.js';
+import { SessionStore } from './session.js';
+import type { AuthClient, AuthClientOptions } from './types.js';
+export declare function createAuthClient(http: HttpClient, store: SessionStore, options: AuthClientOptions): AuthClient;
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAe,MAAM,YAAY,CAAC;AAE7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,GAAG,UAAU,CAwB9G"}

package/dist/auth/index.js

@@ -0,0 +1,34 @@
+import { createAuthClient as createBetterAuthClient } from 'better-auth/client';
+import { anonymousClient, emailOTPClient, jwtClient, magicLinkClient, organizationClient, phoneNumberClient, twoFactorClient } from 'better-auth/client/plugins';
+import { apiKeyClient } from '@better-auth/api-key/client';
+import { passkeyClient } from '@better-auth/passkey/client';
+import { ssoClient } from '@better-auth/sso/client';
+import { HTTP_ROUTES } from '@motherbase/contracts';
+import { withoutTrailingSlash } from '../http/utils.js';
+import { motherbaseClient } from './motherbase-plugin.js';
+export function createAuthClient(http, store, options) {
+    // Must stay in step with `AuthPlugins`; the annotation makes the compiler check it.
+    const plugins = [
+        anonymousClient(),
+        emailOTPClient(),
+        magicLinkClient(),
+        phoneNumberClient(),
+        twoFactorClient(),
+        organizationClient({ teams: { enabled: true } }),
+        jwtClient(),
+        passkeyClient(),
+        ssoClient(),
+        apiKeyClient(),
+        motherbaseClient(http, store, options),
+    ];
+    return createBetterAuthClient({
+        baseURL: `${withoutTrailingSlash(options.url)}${HTTP_ROUTES.auth}`,
+        fetchOptions: {
+            customFetchImpl: http.observedFetch(options.fetch),
+            headers: options.headers,
+            auth: { type: 'Bearer', token: async () => (await store.hydrate())?.accessToken },
+        },
+        plugins,
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,IAAI,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AACjK,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAI1D,MAAM,UAAU,gBAAgB,CAAC,IAAgB,EAAE,KAAmB,EAAE,OAA0B;IAChG,oFAAoF;IACpF,MAAM,OAAO,GAAgB;QAC3B,eAAe,EAAE;QACjB,cAAc,EAAE;QAChB,eAAe,EAAE;QACjB,iBAAiB,EAAE;QACnB,eAAe,EAAE;QACjB,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChD,SAAS,EAAE;QACX,aAAa,EAAE;QACf,SAAS,EAAE;QACX,YAAY,EAAE;QACd,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC;KACvC,CAAC;IACF,OAAO,sBAAsB,CAAC;QAC5B,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE;QAClE,YAAY,EAAE;YACZ,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC;YAClD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE;SAClF;QACD,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/motherbase-plugin.d.ts

@@ -0,0 +1,6 @@
+import { HttpClient } from "../http/index.js";
+import { SessionStore } from "./session.js";
+import { AuthClientOptions, MotherbaseClientPlugin } from "./types.js";
+/** Motherbase's additions, as a Better Auth client plugin. */
+export declare function motherbaseClient(http: HttpClient, store: SessionStore, options: AuthClientOptions): MotherbaseClientPlugin;
+//# sourceMappingURL=motherbase-plugin.d.ts.map

package/dist/auth/motherbase-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"motherbase-plugin.d.ts","sourceRoot":"","sources":["../../src/auth/motherbase-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,EAAG,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMxE,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,GAAG,sBAAsB,CAwE1H"}

package/dist/auth/motherbase-plugin.js

@@ -0,0 +1,80 @@
+import { isBrowser } from "../utils/runtime.js";
+import { EVENT_MAP } from "./constants.js";
+import { adminActions, readAccessTokenFromUrl } from "./utils.js";
+import { currentSession, sameSession, sessionFromResponse, sessionSync } from "./session-utils.js";
+/** Motherbase's additions, as a Better Auth client plugin. */
+export function motherbaseClient(http, store, options) {
+    // Bound when Better Auth hands over its fetch, which happens as the client
+    // is built, before any request can reach the session sync.
+    let revalidate = async () => undefined;
+    return {
+        id: 'motherbase',
+        fetchPlugins: [sessionSync(store, options, () => revalidate())],
+        getActions: $fetch => {
+            revalidate = () => $fetch('/get-session');
+            return {
+                onAuthStateChange(callback) {
+                    let active = true;
+                    const unsubscribe = store.subscribe((event, session) => {
+                        if (active)
+                            callback(EVENT_MAP[event], session);
+                    });
+                    void store.hydrate().then(session => {
+                        if (active)
+                            callback('INITIAL_SESSION', session);
+                    });
+                    return { data: { subscription: { unsubscribe: () => { active = false; unsubscribe(); } } } };
+                },
+                async getSessionFromUrl(href) {
+                    const url = href ?? (isBrowser() ? window.location.href : undefined);
+                    const found = url ? readAccessTokenFromUrl(url) : null;
+                    if (!found)
+                        return { data: null, error: null };
+                    // Strip the token before the network call: a failed lookup must not
+                    // leave a usable token in the address bar or the history.
+                    if (!href && isBrowser()) {
+                        window.history?.replaceState?.(window.history.state, '', found.cleanedHref);
+                    }
+                    // Checked before it is stored, so a rejected token never emits
+                    // SIGNED_IN. On success, sessionSync adopts it from the response.
+                    const { data, error } = await $fetch('/get-session', { auth: { type: 'Bearer', token: found.accessToken } });
+                    if (error)
+                        return { data: null, error };
+                    const verified = sessionFromResponse(data);
+                    if (!verified || !sameSession(verified.token, found.accessToken)
+                        || !sameSession(store.get()?.accessToken, verified.token)) {
+                        return { data: null, error: { message: 'The session in the URL is no longer valid.' } };
+                    }
+                    return currentSession(store) ?? { data: null, error: { message: 'The session in the URL is no longer valid.' } };
+                },
+                async exchangeCodeForSession(authCode) {
+                    const verifier = await options.verifiers.get();
+                    if (!verifier) {
+                        return { data: null, error: { message: 'No PKCE code verifier found: start the sign-in with flowType: "pkce" in this browser.' } };
+                    }
+                    const { data, error } = await $fetch('/exchange-code', {
+                        method: 'POST',
+                        body: { auth_code: authCode, code_verifier: verifier },
+                    });
+                    if (error)
+                        return { data: null, error };
+                    const verified = sessionFromResponse(data);
+                    if (!verified || !sameSession(store.get()?.accessToken, verified.token)) {
+                        return { data: null, error: { message: 'The code did not produce a session.' } };
+                    }
+                    await options.verifiers.clear();
+                    return currentSession(store) ?? { data: null, error: { message: 'The code did not produce a session.' } };
+                },
+                // Better Auth 1.7 serves custom OAuth providers through signIn.social;
+                // kept so apps calling the 1.6 genericOAuthClient spelling keep working.
+                signIn: {
+                    oauth2: ({ providerId, ...params }) => $fetch('/sign-in/social', { method: 'POST', body: { provider: providerId, ...params } }),
+                },
+                reauthenticate: () => $fetch('/reauthenticate', { method: 'POST' }),
+                updateUserCredentials: params => $fetch('/update-user-credentials', { method: 'POST', body: params }),
+                admin: adminActions(http),
+            };
+        },
+    };
+}
+//# sourceMappingURL=motherbase-plugin.js.map

package/dist/auth/motherbase-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"motherbase-plugin.js","sourceRoot":"","sources":["../../src/auth/motherbase-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAInG,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,IAAgB,EAAE,KAAmB,EAAE,OAA0B;IAChG,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,UAAU,GAA2B,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAC/D,OAAO;QACL,EAAE,EAAE,YAAY;QAChB,YAAY,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/D,UAAU,EAAE,MAAM,CAAC,EAAE;YACnB,UAAU,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC1C,OAAO;gBACL,iBAAiB,CAAC,QAAQ;oBACxB,IAAI,MAAM,GAAG,IAAI,CAAC;oBAClB,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;wBACrD,IAAI,MAAM;4BAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;oBAClD,CAAC,CAAC,CAAC;oBACH,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;wBAClC,IAAI,MAAM;4BAAE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;oBACnD,CAAC,CAAC,CAAC;oBACH,OAAO,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;gBAC/F,CAAC;gBAED,KAAK,CAAC,iBAAiB,CAAC,IAAI;oBAC1B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;oBACrE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACvD,IAAI,CAAC,KAAK;wBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;oBAC/C,oEAAoE;oBACpE,0DAA0D;oBAC1D,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,EAAE,CAAC;wBACzB,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;oBAC9E,CAAC;oBACD,+DAA+D;oBAC/D,kEAAkE;oBAClE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;oBAC7G,IAAI,KAAK;wBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;oBACxC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;oBAC3C,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC;2BAC3D,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC;oBAC1F,CAAC;oBACD,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC;gBACnH,CAAC;gBAED,KAAK,CAAC,sBAAsB,CAAC,QAAQ;oBACnC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;oBAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uFAAuF,EAAE,EAAE,CAAC;oBACrI,CAAC;oBACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE;wBACrD,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE;qBACvD,CAAC,CAAC;oBACH,IAAI,KAAK;wBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;oBACxC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;oBAC3C,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;wBACxE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,EAAE,CAAC;oBACnF,CAAC;oBACD,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;oBAChC,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,EAAE,CAAC;gBAC5G,CAAC;gBAED,uEAAuE;gBACvE,yEAAyE;gBACzE,MAAM,EAAE;oBACN,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,CACpC,MAAM,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;iBAC3F;gBACD,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnE,qBAAqB,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBACrG,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC;aAC1B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/pkce.d.ts

@@ -0,0 +1,19 @@
+import type { KeyValueStorageAdapter } from './types.js';
+/** 56 unreserved characters (RFC 7636 allows 43 to 128). */
+export declare function generateCodeVerifier(): string;
+export declare function codeChallengeFor(verifier: string): Promise<string>;
+/** Append the challenge to the redirect URL, which is where the server looks for it. */
+export declare function withCodeChallenge(redirectTo: string, challenge: string): string;
+export interface VerifierStore {
+    get(): Promise<string | null>;
+    set(verifier: string): Promise<void>;
+    clear(): Promise<void>;
+}
+/**
+ * The callback URL a PKCE sign-in should use: the given one, or this page, with
+ * a fresh challenge on it. The verifier waits in `verifiers` for
+ * `exchangeCodeForSession`.
+ */
+export declare function pkceCallback(callbackURL: string | undefined, verifiers: VerifierStore): Promise<string>;
+export declare function verifierStore(storageKey: string, storage?: KeyValueStorageAdapter): VerifierStore;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/auth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/auth/pkce.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAsBzD,4DAA4D;AAC5D,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxE;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAM/E;AAED,MAAM,WAAW,aAAa;IAC1B,GAAG,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9B,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAWD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAM7G;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,aAAa,CAuBjG"}

package/dist/auth/pkce.js

@@ -0,0 +1,89 @@
+import { browserLocalStorage } from './session.js';
+import { isBrowser } from '../utils/runtime.js';
+/**
+ * The client half of the PKCE flow (`flowType: 'pkce'`).
+ *
+ * `signIn.social` (and `signIn.sso`) makes a verifier, keeps it, and sends
+ * only its SHA-256 challenge on the redirect URL. The provider callback comes
+ * back with `?code=`, and `exchangeCodeForSession(code)` proves possession of
+ * the verifier to get the session. The verifier has to outlive a full-page
+ * navigation, so it lives in the key/value storage the app passed, or in
+ * localStorage, the way supabase-js keeps `<storageKey>-code-verifier`.
+ */
+const VERIFIER_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
+function base64Url(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** 56 unreserved characters (RFC 7636 allows 43 to 128). */
+export function generateCodeVerifier() {
+    const bytes = crypto.getRandomValues(new Uint8Array(56));
+    return Array.from(bytes, b => VERIFIER_ALPHABET[b % VERIFIER_ALPHABET.length]).join('');
+}
+export async function codeChallengeFor(verifier) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    return base64Url(new Uint8Array(digest));
+}
+/** Append the challenge to the redirect URL, which is where the server looks for it. */
+export function withCodeChallenge(redirectTo, challenge) {
+    const hash = redirectTo.indexOf('#');
+    const base = hash === -1 ? redirectTo : redirectTo.slice(0, hash);
+    const fragment = hash === -1 ? '' : redirectTo.slice(hash);
+    const separator = base.includes('?') ? '&' : '?';
+    return `${base}${separator}code_challenge=${encodeURIComponent(challenge)}&code_challenge_method=s256${fragment}`;
+}
+function inMemory() {
+    const values = new Map();
+    return {
+        getItem: key => values.get(key) ?? null,
+        setItem: (key, value) => void values.set(key, value),
+        removeItem: key => void values.delete(key),
+    };
+}
+/**
+ * The callback URL a PKCE sign-in should use: the given one, or this page, with
+ * a fresh challenge on it. The verifier waits in `verifiers` for
+ * `exchangeCodeForSession`.
+ */
+export async function pkceCallback(callbackURL, verifiers) {
+    const target = callbackURL ?? (isBrowser() ? window.location.href.split('#')[0] : undefined);
+    if (!target)
+        throw new Error('flowType "pkce" needs a callbackURL outside a browser.');
+    const verifier = generateCodeVerifier();
+    await verifiers.set(verifier);
+    return withCodeChallenge(target, await codeChallengeFor(verifier));
+}
+export function verifierStore(storageKey, storage) {
+    const backing = storage ?? browserLocalStorage() ?? inMemory();
+    // The default localStorage can throw (blocked site data, quota); the verifier
+    // then lives in memory, which still serves a same-page exchange.
+    const fallback = inMemory();
+    const key = `${storageKey}-code-verifier`;
+    return {
+        get: async () => {
+            try {
+                return (await backing.getItem(key)) ?? (await fallback.getItem(key)) ?? null;
+            }
+            catch {
+                return (await fallback.getItem(key)) ?? null;
+            }
+        },
+        set: async (verifier) => {
+            await fallback.setItem(key, verifier);
+            try {
+                await backing.setItem(key, verifier);
+            }
+            catch { /* memory only */ }
+        },
+        clear: async () => {
+            await fallback.removeItem(key);
+            try {
+                await backing.removeItem(key);
+            }
+            catch { /* nothing persisted */ }
+        },
+    };
+}
+//# sourceMappingURL=pkce.js.map

package/dist/auth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/auth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;;;;;;;GASG;AAEH,MAAM,iBAAiB,GAAG,oEAAoE,CAAC;AAE/F,SAAS,SAAS,CAAC,KAAiB;IAChC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,SAAiB;IACnE,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACjD,OAAO,GAAG,IAAI,GAAG,SAAS,kBAAkB,kBAAkB,CAAC,SAAS,CAAC,8BAA8B,QAAQ,EAAE,CAAC;AACtH,CAAC;AAQD,SAAS,QAAQ;IACb,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,OAAO;QACH,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACvC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,WAA+B,EAAE,SAAwB;IAC1F,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,iBAAiB,CAAC,MAAM,EAAE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,OAAgC;IAC9E,MAAM,OAAO,GAA2B,OAAO,IAAI,mBAAmB,EAAE,IAAI,QAAQ,EAAE,CAAC;IACvF,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,GAAG,UAAU,gBAAgB,CAAC;IAC1C,OAAO;QACH,GAAG,EAAE,KAAK,IAAI,EAAE;YACZ,IAAI,CAAC;gBACD,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;YACjF,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;YACjD,CAAC;QACL,CAAC;QACD,GAAG,EAAE,KAAK,EAAC,QAAQ,EAAC,EAAE;YAClB,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC;gBAAC,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC;gBAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAC5E,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/auth/session-utils.d.ts

@@ -0,0 +1,29 @@
+import { BetterFetchPlugin } from "@better-fetch/fetch";
+import { SessionStore } from "./session.js";
+import type { AuthClientOptions, AuthPayload, SessionResult } from "./types.js";
+/**
+ * The session a successful auth response carries, if any.
+ *
+ * Better Auth answers a sign-in with `{ token, user }` (password, OTP, anonymous,
+ * id token, second factor) or `{ session: { token }, user }` (passkey,
+ * get-session). A `user` is required alongside: the jwt plugin's `/token`
+ * answers `{ token }` with a JWT, which is not a session.
+ */
+export declare function sessionFromResponse(data: unknown): AuthPayload | null;
+/**
+ * Whether two tokens name the same session. The bearer the server hands out
+ * (`set-auth-token`, the OAuth fragment) is the signed cookie value,
+ * `<token>.<signature>`, while response bodies carry the bare `<token>`; the
+ * bearer plugin accepts either.
+ */
+export declare function sameSession(stored: string | undefined, token: string | undefined): boolean;
+export declare function currentSession(store: SessionStore): SessionResult | null;
+/**
+ * Keeps the SDK's session store and Better Auth's calls in step: the bearer
+ * goes out on every request, and every response that creates, replaces or ends
+ * the session is written back, which is what fires `onAuthStateChange`.
+ */
+export declare function sessionSync(store: SessionStore, options: AuthClientOptions, 
+/** Reads the session again; its response comes back through this plugin. */
+revalidate: () => Promise<unknown>): BetterFetchPlugin;
+//# sourceMappingURL=session-utils.d.ts.map

package/dist/auth/session-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-utils.d.ts","sourceRoot":"","sources":["../../src/auth/session-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAA0B,MAAM,YAAY,CAAC;AAMxG;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAMrE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAG1F;AAGD,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,aAAa,GAAG,IAAI,CAGxE;AAGD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,iBAAiB;AAC1B,4EAA4E;AAC5E,UAAU,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GACjC,iBAAiB,CA6EnB"}

package/dist/auth/session-utils.js

@@ -0,0 +1,123 @@
+import { COOKIE_PATHS, REDIRECT_SIGN_IN_PATHS, SIGN_OUT_PATHS, USER_CHANGE_PATHS } from "./constants.js";
+import { authPath, revokedToken, socialStartUrl } from "./utils.js";
+import { normalizeUser } from "../utils/compat.js";
+import { isBrowser } from "../utils/runtime.js";
+import { pkceCallback } from "./pkce.js";
+/**
+ * The session a successful auth response carries, if any.
+ *
+ * Better Auth answers a sign-in with `{ token, user }` (password, OTP, anonymous,
+ * id token, second factor) or `{ session: { token }, user }` (passkey,
+ * get-session). A `user` is required alongside: the jwt plugin's `/token`
+ * answers `{ token }` with a JWT, which is not a session.
+ */
+export function sessionFromResponse(data) {
+    if (!data || typeof data !== 'object')
+        return null;
+    const body = data;
+    if (!body.user)
+        return null;
+    const token = typeof body.token === 'string' ? body.token : body.session?.token;
+    return typeof token === 'string' ? { token, user: body.user } : null;
+}
+/**
+ * Whether two tokens name the same session. The bearer the server hands out
+ * (`set-auth-token`, the OAuth fragment) is the signed cookie value,
+ * `<token>.<signature>`, while response bodies carry the bare `<token>`; the
+ * bearer plugin accepts either.
+ */
+export function sameSession(stored, token) {
+    if (!stored || !token)
+        return false;
+    return stored === token || stored.startsWith(`${token}.`) || token.startsWith(`${stored}.`);
+}
+export function currentSession(store) {
+    const session = store.get();
+    return session ? { data: { user: session.user, session }, error: null } : null;
+}
+/**
+ * Keeps the SDK's session store and Better Auth's calls in step: the bearer
+ * goes out on every request, and every response that creates, replaces or ends
+ * the session is written back, which is what fires `onAuthStateChange`.
+ */
+export function sessionSync(store, options, 
+/** Reads the session again; its response comes back through this plugin. */
+revalidate) {
+    const { flowType, verifiers } = options;
+    const revisions = new WeakMap();
+    return {
+        id: 'motherbase-session',
+        name: 'Motherbase session',
+        // Edits the call's options in place rather than returning a copy: better-fetch
+        // runs its own schema plugin after this one, and it hands back the options
+        // object it was given. The object is built fresh for every call.
+        async init(url, fetchOptions = {}) {
+            const path = authPath(url);
+            fetchOptions.credentials = COOKIE_PATHS.some(prefix => path.startsWith(prefix)) ? 'include' : 'same-origin';
+            // Node does not send Origin, and Better Auth's CSRF check wants one on a
+            // mutation. Supply the project's own rather than turning the check off.
+            const headers = (fetchOptions.headers ?? {});
+            if (!isBrowser() && (fetchOptions.method ?? 'GET').toUpperCase() !== 'GET'
+                && !Object.keys(headers).some(name => name.toLowerCase() === 'origin')) {
+                fetchOptions.headers = { ...headers, origin: new URL(options.url).origin };
+            }
+            const body = (fetchOptions.body ?? {});
+            // An id-token sign-in answers with the session directly: no redirect.
+            if (!REDIRECT_SIGN_IN_PATHS.includes(path) || body.idToken)
+                return { url, options: fetchOptions };
+            if (flowType === 'pkce') {
+                fetchOptions.body = { ...body, callbackURL: await pkceCallback(body.callbackURL, verifiers) };
+            }
+            if (path === '/sign-in/social' && isBrowser() && !body.disableRedirect) {
+                // Started with a fetch, the OAuth state cookie is a cross-site write
+                // that Safari and Firefox drop (Chrome too, in incognito), and the
+                // callback fails with state_mismatch. Navigating to the server's GET
+                // start route makes it first-party. The request is answered locally
+                // with Better Auth's own shape, `redirect: false` so it does not
+                // navigate a second time.
+                const href = socialStartUrl(options.url, fetchOptions.body);
+                window.location.href = href;
+                fetchOptions.customFetchImpl = async () => Response.json({ url: href, redirect: false });
+            }
+            return { url, options: fetchOptions };
+        },
+        hooks: {
+            onRequest(request) {
+                revisions.set(request, store.getRevision());
+            },
+            async onSuccess({ data, request }) {
+                const path = authPath(request.url);
+                const current = store.get();
+                // Do not let an older response replace a newer account or sign-out.
+                if (revisions.get(request) !== store.getRevision())
+                    return;
+                const ended = SIGN_OUT_PATHS.has(path)
+                    || (path === '/revoke-session' && sameSession(current?.accessToken, revokedToken(request.body)))
+                    || (path === '/delete-user' && data?.message === 'User deleted')
+                    // The stored token was revoked or expired elsewhere: the server answers
+                    // null. Only for the stored token: getSessionFromUrl checks another one.
+                    || (path === '/get-session' && data === null
+                        && request.headers.get('authorization') === `Bearer ${current?.accessToken}`);
+                if (ended) {
+                    await store.set(null, 'signOut');
+                    return;
+                }
+                if (USER_CHANGE_PATHS.has(path) && current) {
+                    await revalidate();
+                    return;
+                }
+                const next = sessionFromResponse(data);
+                if (!next)
+                    return;
+                if (!current || !sameSession(current.accessToken, next.token)) {
+                    await store.set({ accessToken: next.token, user: next.user }, path.startsWith('/two-factor/') ? 'mfaVerified' : 'signIn');
+                }
+                else if (JSON.stringify(normalizeUser(next.user)) !== JSON.stringify(current.user)) {
+                    // Compared as the store holds it: normalised, aliases included.
+                    await store.set({ ...current, user: next.user }, 'userUpdated');
+                }
+            },
+        },
+    };
+}
+//# sourceMappingURL=session-utils.js.map

package/dist/auth/session-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-utils.js","sourceRoot":"","sources":["../../src/auth/session-utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGzG,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,IAAqF,CAAC;IACnG,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;IAChF,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAA0B,EAAE,KAAyB;IAC/E,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AAC9F,CAAC;AAGD,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAGD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,KAAmB,EACnB,OAA0B;AAC1B,4EAA4E;AAC5E,UAAkC;IAElC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,OAAO,EAAkB,CAAC;IAChD,OAAO;QACL,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,oBAAoB;QAC1B,+EAA+E;QAC/E,2EAA2E;QAC3E,iEAAiE;QACjE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,eAAkC,EAAE;YAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC3B,YAAY,CAAC,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;YAE5G,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,OAAO,GAAG,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAA2B,CAAC;YACvE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK;mBACrE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACzE,YAAY,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;YAC7E,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAAqB,CAAC;YAC3D,sEAAsE;YACtE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YAElG,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,YAAY,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;YAChG,CAAC;YACD,IAAI,IAAI,KAAK,iBAAiB,IAAI,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;gBACvE,qEAAqE;gBACrE,mEAAmE;gBACnE,qEAAqE;gBACrE,oEAAoE;gBACpE,iEAAiE;gBACjE,0BAA0B;gBAC1B,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,IAAwB,CAAC,CAAC;gBAChF,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;gBAC5B,YAAY,CAAC,eAAe,GAAG,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACxC,CAAC;QACD,KAAK,EAAE;YACL,SAAS,CAAC,OAAO;gBACf,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9C,CAAC;YACD,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;gBAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC5B,oEAAoE;gBACpE,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,WAAW,EAAE;oBAAE,OAAO;gBAC3D,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;uBACjC,CAAC,IAAI,KAAK,iBAAiB,IAAI,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;uBAC7F,CAAC,IAAI,KAAK,cAAc,IAAK,IAAoC,EAAE,OAAO,KAAK,cAAc,CAAC;oBACjG,wEAAwE;oBACxE,yEAAyE;uBACtE,CAAC,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,IAAI;2BACvC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,UAAU,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;gBAClF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACjC,OAAO;gBACT,CAAC;gBACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;oBAC3C,MAAM,UAAU,EAAE,CAAC;oBACnB,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9D,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAC5H,CAAC;qBAAM,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrF,gEAAgE;oBAChE,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/session.d.ts

@@ -0,0 +1,51 @@
+import type { AuthEvent, AuthListener, KeyValueStorageAdapter, Session, SessionStorageAdapter } from './types.js';
+/**
+ * The key every built-in storage adapter defaults to, for both the cookie and
+ * localStorage. Defined once: it is a contract between the browser half of an
+ * app and the server half, and a second copy of the literal is how the two
+ * drift apart. Re-exported from `cookie.ts` and from the package root.
+ */
+export declare const SESSION_COOKIE_KEY = "motherbase.session";
+/** In-memory adapter. Safe everywhere (SSR, tests); does not survive reloads. */
+export declare function memoryStorage(): SessionStorageAdapter;
+/**
+ * Browser localStorage adapter. Falls back to memory when localStorage is
+ * unavailable (SSR, private mode), so it never throws on import or use.
+ */
+export declare function localStorageStorage(key?: string): SessionStorageAdapter;
+/** `globalThis.localStorage`, or undefined when absent or when merely touching it throws. */
+export declare function browserLocalStorage(): Storage | undefined;
+/**
+ * Wrap a supabase-js style key/value store (localStorage, React Native's
+ * AsyncStorage, a cookie shim) as a session adapter.
+ *
+ * This is what lets `createClient(url, key, { auth: { storage: AsyncStorage } })`
+ * work verbatim on a ported app. A value that will not parse is treated as no
+ * session rather than thrown: a corrupt entry must not brick every launch.
+ */
+export declare function keyValueStorage(store: KeyValueStorageAdapter, key?: string): SessionStorageAdapter;
+/** Tell the two adapter shapes apart: supabase-js's is a key/value store. */
+export declare function isKeyValueStorage(value: KeyValueStorageAdapter | SessionStorageAdapter): value is KeyValueStorageAdapter;
+/**
+ * Holds the live session in memory, mirrors it to a storage adapter, and
+ * notifies listeners of auth changes. The in-memory copy is the source of truth
+ * for synchronous reads (e.g. attaching the bearer header).
+ */
+export declare class SessionStore {
+    private readonly storage;
+    private current;
+    private readonly listeners;
+    private hydrated;
+    private revision;
+    constructor(storage: SessionStorageAdapter);
+    /** Load the persisted session once. Idempotent. */
+    hydrate(): Promise<Session | null>;
+    get(): Session | null;
+    getRevision(): number;
+    set(session: Session | null, event: AuthEvent): Promise<void>;
+    /** Replace only the tokens, keeping the existing user (used after refresh). */
+    setTokens(accessToken: string, refreshToken: string): Promise<void>;
+    subscribe(listener: AuthListener): () => void;
+    private emit;
+}
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EACT,YAAY,EACZ,sBAAsB,EACtB,OAAO,EACP,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAEpB;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,iFAAiF;AACjF,wBAAgB,aAAa,IAAI,qBAAqB,CAQrD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,SAAqB,GAAG,qBAAqB,CAyBnF;AAED,6FAA6F;AAC7F,wBAAgB,mBAAmB,IAAI,OAAO,GAAG,SAAS,CAMzD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,sBAAsB,EAAE,GAAG,SAAqB,GAAG,qBAAqB,CAgB9G;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,GAAG,qBAAqB,GACpD,KAAK,IAAI,sBAAsB,CAEjC;AAED;;;;GAIG;AACH,qBAAa,YAAY;IAMX,OAAO,CAAC,QAAQ,CAAC,OAAO;IALpC,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IACrD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAK;gBAEQ,OAAO,EAAE,qBAAqB;IAE3D,mDAAmD;IAC7C,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAoBxC,GAAG,IAAI,OAAO,GAAG,IAAI;IAIrB,WAAW,IAAI,MAAM;IAIf,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAWnE,+EAA+E;IACzE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzE,SAAS,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,IAAI;IAK7C,OAAO,CAAC,IAAI;CAGb"}