@motherbase/client 2.2.1 → 2.2.3

package/dist/auth/session.js

@@ -0,0 +1,161 @@
+import { normalizeSession } from '../utils/compat.js';
+/**
+ * The key every built-in storage adapter defaults to, for both the cookie and
+ * localStorage. Defined once: it is a contract between the browser half of an
+ * app and the server half, and a second copy of the literal is how the two
+ * drift apart. Re-exported from `cookie.ts` and from the package root.
+ */
+export const SESSION_COOKIE_KEY = 'motherbase.session';
+/** In-memory adapter. Safe everywhere (SSR, tests); does not survive reloads. */
+export function memoryStorage() {
+    let current = null;
+    return {
+        get: () => current,
+        set: (s) => {
+            current = s;
+        },
+    };
+}
+/**
+ * Browser localStorage adapter. Falls back to memory when localStorage is
+ * unavailable (SSR, private mode), so it never throws on import or use.
+ */
+export function localStorageStorage(key = SESSION_COOKIE_KEY) {
+    const ls = browserLocalStorage();
+    if (!ls)
+        return memoryStorage();
+    // Reading the property, getItem and setItem can all throw (blocked site data,
+    // quota, Safari private mode). The session then lives in memory instead.
+    const fallback = memoryStorage();
+    return {
+        get: () => {
+            try {
+                const raw = ls.getItem(key);
+                return raw ? JSON.parse(raw) : fallback.get();
+            }
+            catch {
+                return fallback.get();
+            }
+        },
+        set: (s) => {
+            fallback.set(s);
+            try {
+                if (s)
+                    ls.setItem(key, JSON.stringify(s));
+                else
+                    ls.removeItem(key);
+            }
+            catch {
+                // kept in memory only
+            }
+        },
+    };
+}
+/** `globalThis.localStorage`, or undefined when absent or when merely touching it throws. */
+export function browserLocalStorage() {
+    try {
+        return globalThis.localStorage;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Wrap a supabase-js style key/value store (localStorage, React Native's
+ * AsyncStorage, a cookie shim) as a session adapter.
+ *
+ * This is what lets `createClient(url, key, { auth: { storage: AsyncStorage } })`
+ * work verbatim on a ported app. A value that will not parse is treated as no
+ * session rather than thrown: a corrupt entry must not brick every launch.
+ */
+export function keyValueStorage(store, key = SESSION_COOKIE_KEY) {
+    return {
+        get: async () => {
+            const raw = await store.getItem(key);
+            if (!raw)
+                return null;
+            try {
+                return JSON.parse(raw);
+            }
+            catch {
+                return null;
+            }
+        },
+        set: async (s) => {
+            if (s)
+                await store.setItem(key, JSON.stringify(s));
+            else
+                await store.removeItem(key);
+        },
+    };
+}
+/** Tell the two adapter shapes apart: supabase-js's is a key/value store. */
+export function isKeyValueStorage(value) {
+    return typeof value.getItem === 'function';
+}
+/**
+ * Holds the live session in memory, mirrors it to a storage adapter, and
+ * notifies listeners of auth changes. The in-memory copy is the source of truth
+ * for synchronous reads (e.g. attaching the bearer header).
+ */
+export class SessionStore {
+    constructor(storage) {
+        this.storage = storage;
+        this.current = null;
+        this.listeners = new Set();
+        this.hydrated = false;
+        this.revision = 0;
+    }
+    /** Load the persisted session once. Idempotent. */
+    async hydrate() {
+        if (this.hydrated)
+            return this.current;
+        // A session read back from storage was written by an older version (or by
+        // the server half of an SSR app), so it is normalised on the way in too:
+        // the aliases must not depend on which code path produced the session.
+        const loaded = await this.storage.get();
+        // Re-check AFTER the await. `hydrate()` is started but not awaited by
+        // `onAuthStateChange`, so a `set()` can land while this one is still
+        // reading storage, and `loaded` is then a snapshot from before that write.
+        // Assigning it anyway is a lost update, and it presents as the opposite of
+        // a storage bug: `setSession()` resolves with "Invalid session" because the
+        // token it just stored was wiped out from under the request that used it.
+        if (this.hydrated)
+            return this.current;
+        this.current = normalizeSession(loaded);
+        this.hydrated = true;
+        return this.current;
+    }
+    get() {
+        return this.current;
+    }
+    getRevision() {
+        return this.revision;
+    }
+    async set(session, event) {
+        const next = normalizeSession(session);
+        // Only identity changes invalidate in-flight auth requests. A metadata
+        // refresh must not discard a concurrent sign-in or sign-out response.
+        if (next?.accessToken !== this.current?.accessToken || event === 'signOut')
+            this.revision += 1;
+        this.current = next;
+        this.hydrated = true;
+        await this.storage.set(this.current);
+        this.emit(event);
+    }
+    /** Replace only the tokens, keeping the existing user (used after refresh). */
+    async setTokens(accessToken, refreshToken) {
+        if (!this.current)
+            return;
+        await this.set({ ...this.current, accessToken, refreshToken }, 'tokenRefreshed');
+    }
+    subscribe(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+    }
+    emit(event) {
+        for (const l of this.listeners)
+            l(event, this.current);
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAStD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD,iFAAiF;AACjF,MAAM,UAAU,aAAa;IAC3B,IAAI,OAAO,GAAmB,IAAI,CAAC;IACnC,OAAO;QACL,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO;QAClB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;YACT,OAAO,GAAG,CAAC,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAG,kBAAkB;IAC1D,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACjC,IAAI,CAAC,EAAE;QAAE,OAAO,aAAa,EAAE,CAAC;IAChC,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,OAAO;QACL,GAAG,EAAE,GAAG,EAAE;YACR,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC5B,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QACD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;YACT,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC;gBACH,IAAI,CAAC;oBAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;;oBACrC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,OAAQ,UAAyC,CAAC,YAAY,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAA6B,EAAE,GAAG,GAAG,kBAAkB;IACrF,OAAO;QACL,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACf,IAAI,CAAC;gBAAE,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;;gBAC9C,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAC/B,KAAqD;IAErD,OAAO,OAAQ,KAAgC,CAAC,OAAO,KAAK,UAAU,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAMvB,YAA6B,OAA8B;QAA9B,YAAO,GAAP,OAAO,CAAuB;QALnD,YAAO,GAAmB,IAAI,CAAC;QACtB,cAAS,GAAG,IAAI,GAAG,EAAgB,CAAC;QAC7C,aAAQ,GAAG,KAAK,CAAC;QACjB,aAAQ,GAAG,CAAC,CAAC;IAE0C,CAAC;IAEhE,mDAAmD;IACnD,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACvC,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAExC,sEAAsE;QACtE,qEAAqE;QACrE,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QAEvC,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAuB,EAAE,KAAgB;QACjD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACvC,uEAAuE;QACvE,sEAAsE;QACtE,IAAI,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC/F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,YAAoB;QACvD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACnF,CAAC;IAED,SAAS,CAAC,QAAsB;QAC9B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAEO,IAAI,CAAC,KAAgB;QAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS;YAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/auth/types.d.ts

@@ -0,0 +1,341 @@
+import type { BetterFetch, BetterFetchPlugin, BetterFetchResponse } from '@better-fetch/fetch';
+import type { AuthClient as BetterAuthClient } from 'better-auth/client';
+import type { passkeyClient } from '@better-auth/passkey/client';
+import type { ssoClient } from '@better-auth/sso/client';
+import type { apiKeyClient } from '@better-auth/api-key/client';
+import type { anonymousClient, emailOTPClient, jwtClient, magicLinkClient, organizationClient, phoneNumberClient, twoFactorClient } from 'better-auth/client/plugins';
+import type { AuthAdminClient } from '../admin/auth-admin-client.js';
+import type { AuthAdminMfaClient } from '../admin/auth-admin-mfa-client.js';
+import type { VerifierStore } from './pkce.js';
+/**
+ * A timestamp as it can reach the client: ISO string over HTTP, `Date` when a
+ * server-side caller passes a Better Auth row straight in.
+ */
+export type Timestamp = string | Date;
+/**
+ * The open bag of profile fields.
+ *
+ * `User` itself is closed: every field the platform sets is declared, and a
+ * typo like `user.emailVerifed` is a compile error. Project-specific columns
+ * (anything added to `user.additionalFields` on the server) cannot be known
+ * here, so they live in this bag, which is the one place with an index
+ * signature. `compat.ts` copies every non-platform field into it, so a custom
+ * `plan` column is readable as `user.user_metadata.plan`.
+ *
+ * Declare your own shape for it when you know the columns:
+ * `const meta = user.user_metadata as { plan?: string }`.
+ */
+export interface UserMetadata {
+    name?: string | null;
+    image?: string | null;
+    [key: string]: unknown;
+}
+/** Fields Better Auth itself owns on a user row. */
+export interface BetterAuthUserFields {
+    /** Display name. Better Auth's own column, mirrored into `user_metadata`. */
+    name?: string | null;
+    /** Avatar URL. Better Auth's own column, mirrored into `user_metadata`. */
+    image?: string | null;
+    /** Better Auth stores verification as a boolean, not a timestamp. */
+    emailVerified?: boolean;
+    createdAt?: Timestamp | null;
+    updatedAt?: Timestamp | null;
+    /** Set by the `phoneNumber` plugin; aliased to `phone`. */
+    phoneNumber?: string | null;
+    phoneNumberVerified?: boolean | null;
+    /** Set by the `admin` plugin. */
+    banned?: boolean | null;
+    banReason?: string | null;
+    banExpires?: Timestamp | null;
+    /** Set by the `twoFactor` plugin. */
+    twoFactorEnabled?: boolean | null;
+    /** Set by the `anonymous` plugin; aliased to `is_anonymous`. */
+    isAnonymous?: boolean | null;
+}
+/**
+ * The `additionalFields` Motherbase configures on every project's auth
+ * instance (see `apps/server/auth/instance.ts`). The first four are
+ * client-writable through `updateUser`; the rest are server-set.
+ */
+export interface MotherbaseUserFields {
+    username?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+    imageUrl?: string | null;
+    /** `'USER'` by default on the server, `'authenticated'` after `compat.ts`. */
+    role?: string;
+    status?: string | null;
+    classicEmail?: string | null;
+    appleId?: string | null;
+    appleEmail?: string | null;
+    googleId?: string | null;
+    googleEmail?: string | null;
+}
+/**
+ * The snake_case aliases `compat.ts` adds on the way out, so code ported from
+ * supabase-js reads `user.created_at` and `user.user_metadata.full_name` on a
+ * user that came out of Better Auth.
+ *
+ * They are optional because a `User` you construct yourself (a test fixture, a
+ * value on its way *in*) has not been through `compat.ts` yet. Everything the
+ * SDK hands back has them.
+ */
+export interface SupabaseUserAliases {
+    /** Always `'authenticated'`. Present for supabase-js parity. */
+    aud?: string;
+    created_at?: string | null;
+    updated_at?: string | null;
+    /** Non-null once the email is verified. Better Auth stores a boolean, so the
+     *  value is the last-update timestamp rather than the true verification time. */
+    email_confirmed_at?: string | null;
+    confirmed_at?: string | null;
+    /** Alias of `phoneNumber`, `''` when the user has no phone. */
+    phone?: string;
+    /**
+     * Always `{}`: the client is not told which provider issued the session, and
+     * a guessed `{ provider: 'email' }` is worse than a missing one.
+     */
+    app_metadata?: Record<string, unknown>;
+    /** Profile fields (`name`, `image`, any configured additional field). */
+    user_metadata?: UserMetadata;
+    identities?: UserIdentity[];
+    is_anonymous?: boolean;
+}
+/** A linked provider, in the supabase-js `UserIdentity` shape. */
+export interface UserIdentity {
+    id: string;
+    identity_id: string;
+    user_id: string;
+    provider: string;
+    identity_data: Record<string, unknown>;
+    created_at: string | null;
+    updated_at: string | null;
+    last_sign_in_at: string | null;
+}
+/**
+ * Authenticated user as returned by the API.
+ *
+ * Closed on purpose: every field the platform can set is declared above, so
+ * reading one that does not exist is a compile error instead of a silent
+ * `undefined` at runtime. Project-specific columns go through
+ * [`UserMetadata`](#UserMetadata) (`user.user_metadata.<field>`).
+ */
+export interface User extends BetterAuthUserFields, MotherbaseUserFields, SupabaseUserAliases {
+    id: string;
+    email: string;
+}
+/**
+ * The bearer token issued by sign-up / sign-in. With Better Auth this is the
+ * session token; there is no separate refresh token (a session is valid until
+ * it expires, after which the user re-authenticates). `refreshToken` is kept
+ * optional for backwards source-compat and is unused.
+ */
+export interface Tokens {
+    accessToken: string;
+    refreshToken?: string;
+}
+/**
+ * The locally-held session: the bearer token plus the user it belongs to.
+ *
+ * The snake_case fields are supabase-js aliases, added by the session store on
+ * the way out (see `compat.ts`). `access_token` always mirrors `accessToken`;
+ * `expires_at` / `expires_in` are present only when the server dated the
+ * session, because supabase-js callers schedule refreshes off them and a
+ * fabricated expiry schedules them wrong.
+ */
+export interface Session extends Tokens {
+    user: User;
+    /** supabase-js alias of `accessToken`. */
+    access_token?: string;
+    /** supabase-js alias of `refreshToken`. Always null on Better Auth sessions. */
+    refresh_token?: string | null;
+    token_type?: 'bearer';
+    /** Unix seconds. Absent when the backend did not date the session. */
+    expires_at?: number;
+    /** Seconds until `expires_at`. Absent for the same reason. */
+    expires_in?: number;
+}
+/** Session payload returned by Better Auth after sign-in or second-factor verification. */
+export interface AuthPayload {
+    token: string;
+    user: User;
+}
+/**
+ * Persists the session between runs. Implementations must be synchronous-or-async
+ * tolerant: every method may return a value or a promise of it.
+ */
+export interface SessionStorageAdapter {
+    get(): Session | null | Promise<Session | null>;
+    set(session: Session | null): void | Promise<void>;
+}
+/**
+ * A key/value store shaped like `window.localStorage` or React Native's
+ * `AsyncStorage`. supabase-js takes its session storage in this form, so an app
+ * being ported passes one of these; the client wraps it (see
+ * `keyValueStorage`) rather than failing at runtime on a missing `.get`.
+ */
+export interface KeyValueStorageAdapter {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
+}
+/**
+ * Supabase-compatible auth change events emitted by `onAuthStateChange`.
+ *
+ * `INITIAL_SESSION` is fired once per subscription, right after subscribing,
+ * with whatever session was already stored. supabase-js does the same, and an
+ * app that clears its loading flag on it hangs forever without it.
+ */
+export type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED' | 'USER_UPDATED' | 'PASSWORD_RECOVERY' | 'MFA_CHALLENGE_VERIFIED';
+export type AuthChangeListener = (event: AuthChangeEvent, session: Session | null) => void;
+/** Internal event names used by the session store. */
+export type AuthEvent = 'signIn' | 'signOut' | 'tokenRefreshed' | 'userUpdated' | 'mfaVerified';
+export type AuthListener = (event: AuthEvent, session: Session | null) => void;
+/**
+ * `implicit` returns the session in the redirect's URL fragment. `pkce`
+ * returns `?code=` instead, for `exchangeCodeForSession`.
+ */
+export type AuthFlowType = 'implicit' | 'pkce';
+export interface SocialSignInBody {
+    provider?: string;
+    callbackURL?: string;
+    errorCallbackURL?: string;
+    newUserCallbackURL?: string;
+    scopes?: string[];
+    disableRedirect?: boolean;
+    idToken?: unknown;
+}
+/** `auth.admin`: the public methods of `AuthAdminClient`, `mfa` included. */
+export type AuthAdminActions = Omit<AuthAdminClient, 'mfa'> & {
+    mfa: Omit<AuthAdminMfaClient, never>;
+};
+export interface AuthClientOptions {
+    /** The project URL. Better Auth is mounted under `/api/auth`. */
+    url: string;
+    fetch: typeof fetch;
+    /** Client-level headers (`apikey`, impersonation), sent on every auth call too. */
+    headers: Record<string, string>;
+    flowType: AuthFlowType;
+    /** Where the PKCE verifier waits out the redirect. */
+    verifiers: VerifierStore;
+}
+export interface Subscription {
+    unsubscribe(): void;
+}
+export interface SessionResult {
+    data: {
+        user: User;
+        session: Session;
+    } | null;
+    /** Better Auth's error shape. */
+    error: {
+        message?: string;
+        status?: number;
+        statusText?: string;
+    } | null;
+}
+/** What Motherbase adds to Better Auth's client. */
+export interface MotherbaseAuthActions {
+    /**
+     * Subscribe to session changes. The callback fires once with
+     * `INITIAL_SESSION` as soon as the stored session has been read, so an app
+     * can leave its loading state for a signed-out visitor too, then on every
+     * sign-in, sign-out and user update made through `client.auth`. Delivered
+     * asynchronously: unsubscribing synchronously suppresses it.
+     */
+    onAuthStateChange(callback: AuthChangeListener): {
+        data: {
+            subscription: Subscription;
+        };
+    };
+    /**
+     * Finish a social, SSO or magic-link sign-in on the page the server sent the
+     * browser back to: read the `#access_token=` it appended and adopt that
+     * session. `createClient` already does this on load unless
+     * `auth.detectSessionInUrl` is false. Resolves with `data: null` and no error
+     * when the URL carries no token, so it is safe on every page.
+     */
+    getSessionFromUrl(href?: string): Promise<SessionResult>;
+    /**
+     * Finish a PKCE sign-in: trade the `?code=` the redirect came back with for
+     * the session. Needs the verifier the sign-in stored, so it works once, in
+     * the browser that started the flow. `createClient` already does this on load.
+     */
+    exchangeCodeForSession(authCode: string): Promise<SessionResult>;
+    signIn: {
+        /**
+         * Sign in with a custom OIDC/OAuth2 provider configured on the server.
+         * Same as `signIn.social({ provider: providerId, ... })`, which is how
+         * Better Auth 1.7 serves these providers.
+         */
+        oauth2(params: {
+            providerId: string;
+            callbackURL?: string;
+            errorCallbackURL?: string;
+            newUserCallbackURL?: string;
+            disableRedirect?: boolean;
+            scopes?: string[];
+            requestSignUp?: boolean;
+        }): Promise<BetterFetchResponse<{
+            url: string;
+            redirect: boolean;
+        }>>;
+    };
+    /** Email the signed-in user a one-time code to pass as `nonce` to `updateUserCredentials`. */
+    reauthenticate(): Promise<BetterFetchResponse<{
+        success: boolean;
+    }>>;
+    /**
+     * Set the signed-in user's email or password where Better Auth's own
+     * `changeEmail` / `changePassword` cannot: an anonymous user's first address
+     * (which makes it permanent, keeping its id), a first password, or a password
+     * replaced with the `nonce` from `reauthenticate()`.
+     */
+    updateUserCredentials(params: {
+        email?: string;
+        password?: string;
+        nonce?: string;
+    }): Promise<BetterFetchResponse<{
+        user: User;
+    }>>;
+    /**
+     * User administration for server code holding a secret key. Present on every
+     * client because whether the key is secret is a server-side fact: with a
+     * publishable key, these answer 401.
+     */
+    admin: AuthAdminActions;
+}
+export interface MotherbaseClientPlugin {
+    id: 'motherbase';
+    fetchPlugins: BetterFetchPlugin[];
+    getActions: ($fetch: BetterFetch) => MotherbaseAuthActions;
+}
+/**
+ * The client plugins matching what auth/instance.ts mounts on the server, plus
+ * Motherbase's. Spelled out as a type so `client.auth` has a name in the
+ * declarations: inferred, it is too large for TypeScript to write down.
+ * `createAuthClient` builds the same list as values, and the compiler checks
+ * the two agree, element by element.
+ */
+export type AuthPlugins = [
+    ReturnType<typeof anonymousClient>,
+    ReturnType<typeof emailOTPClient>,
+    ReturnType<typeof magicLinkClient>,
+    ReturnType<typeof phoneNumberClient>,
+    ReturnType<typeof twoFactorClient>,
+    ReturnType<typeof organizationClient<{
+        teams: {
+            enabled: true;
+        };
+    }>>,
+    ReturnType<typeof jwtClient>,
+    ReturnType<typeof passkeyClient>,
+    ReturnType<typeof ssoClient<Record<never, never>>>,
+    ReturnType<typeof apiKeyClient>,
+    MotherbaseClientPlugin
+];
+/** `client.auth`: Better Auth's client, with Motherbase's session handling. */
+export type AuthClient = BetterAuthClient<{
+    plugins: AuthPlugins;
+}>;
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,KAAK,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,qEAAqE;IACrE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC7B,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACrC,iCAAiC;IACjC,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC9B,qCAAqC;IACrC,gBAAgB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,gEAAgE;IAChE,WAAW,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;qFACiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,yEAAyE;IACzE,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,IAAK,SAAQ,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB;IAC3F,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAQ,SAAQ,MAAM;IACrC,IAAI,EAAE,IAAI,CAAC;IACX,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,CAAC,EAAE,QAAQ,CAAC;IACtB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,2FAA2F;AAC3F,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,IAAI,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAChD,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,WAAW,GACX,YAAY,GACZ,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,wBAAwB,CAAC;AAC7B,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,KAAK,IAAI,CAAC;AAE3F,sDAAsD;AACtD,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,gBAAgB,GAAG,aAAa,GAAG,aAAa,CAAC;AAChG,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,KAAK,IAAI,CAAC;AAE/E;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,GAAG;IAAE,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;CAAE,CAAC;AAEvG,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,EAAE,YAAY,CAAC;IACvB,sDAAsD;IACtD,SAAS,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,IAAI,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9C,iCAAiC;IACjC,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1E;AAED,oDAAoD;AACpD,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG;QAAE,IAAI,EAAE;YAAE,YAAY,EAAE,YAAY,CAAA;SAAE,CAAA;KAAE,CAAC;IAC1F;;;;;;OAMG;IACH,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzD;;;;OAIG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,EAAE;QACN;;;;WAIG;QACH,MAAM,CAAC,MAAM,EAAE;YACb,UAAU,EAAE,MAAM,CAAC;YACnB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;YAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;YAC1B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;YAClB,aAAa,CAAC,EAAE,OAAO,CAAC;SACzB,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC,CAAC;KACtE,CAAC;IACF,8FAA8F;IAC9F,cAAc,IAAI,OAAO,CAAC,mBAAmB,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,CAAC;IACrE;;;;;OAKG;IACH,qBAAqB,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;QAAE,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IACnI;;;;OAIG;IACH,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,YAAY,CAAC;IACjB,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,qBAAqB,CAAC;CAC5D;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,CAAC,OAAO,eAAe,CAAC;IAClC,UAAU,CAAC,OAAO,cAAc,CAAC;IACjC,UAAU,CAAC,OAAO,eAAe,CAAC;IAClC,UAAU,CAAC,OAAO,iBAAiB,CAAC;IACpC,UAAU,CAAC,OAAO,eAAe,CAAC;IAClC,UAAU,CAAC,OAAO,kBAAkB,CAAC;QAAE,KAAK,EAAE;YAAE,OAAO,EAAE,IAAI,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IACnE,UAAU,CAAC,OAAO,SAAS,CAAC;IAC5B,UAAU,CAAC,OAAO,aAAa,CAAC;IAGhC,UAAU,CAAC,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAClD,UAAU,CAAC,OAAO,YAAY,CAAC;IAC/B,sBAAsB;CACvB,CAAC;AAEF,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG,gBAAgB,CAAC;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC"}

package/dist/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":""}

package/dist/auth/utils.d.ts

@@ -0,0 +1,28 @@
+import { AuthAdminActions, SocialSignInBody } from "./types.js";
+import { HttpClient } from "../http/index.js";
+/** The server's GET start route for a social sign-in (auth/social-start.ts). */
+export declare function socialStartUrl(projectUrl: string, body: SocialSignInBody): string;
+/** The `token` a `/revoke-session` request names. The body reaches the hook serialized. */
+export declare function revokedToken(body: unknown): string | undefined;
+/**
+ * Read the token an OAuth callback left in the URL fragment and return the URL
+ * with it removed, so a reload or a shared link cannot replay it.
+ *
+ * The provider callback cannot answer the SDK with a JSON body: it is a browser
+ * redirect. The server therefore appends `#access_token=…` to the redirect it
+ * issues (auth/oauth-redirect.ts). Exported for testing.
+ */
+export declare function readAccessTokenFromUrl(href: string): {
+    accessToken: string;
+    cleanedHref: string;
+} | null;
+/** The auth path of a request: `/api/auth/sign-in/email` → `/sign-in/email`. */
+export declare function authPath(url: string | URL): string;
+/**
+ * The proxy hands out the function it finds detached from its object, so a
+ * class instance exposed as an action would lose `this`. Copy its methods out
+ * bound.
+ */
+export declare function bindMethods<T extends object>(target: T): Omit<T, never>;
+export declare function adminActions(http: HttpClient): AuthAdminActions;
+//# sourceMappingURL=utils.d.ts.map

package/dist/auth/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/auth/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAI9C,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,MAAM,CASjF;AAED,2FAA2F;AAC3F,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAM9D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUxG;AAID,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAGlD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAOvE;AAOD,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,gBAAgB,CAG/D"}

package/dist/auth/utils.js

@@ -0,0 +1,70 @@
+import { HTTP_ROUTES } from "@motherbase/contracts";
+import { withoutTrailingSlash } from "../http/utils.js";
+import { AuthAdminClient } from "../admin/auth-admin-client.js";
+/** The server's GET start route for a social sign-in (auth/social-start.ts). */
+export function socialStartUrl(projectUrl, body) {
+    const params = new URLSearchParams();
+    for (const key of ['callbackURL', 'errorCallbackURL', 'newUserCallbackURL']) {
+        if (body[key])
+            params.set(key, body[key]);
+    }
+    if (body.scopes?.length)
+        params.set('scopes', body.scopes.join(' '));
+    const query = params.toString();
+    const provider = encodeURIComponent(body.provider ?? '');
+    return `${withoutTrailingSlash(projectUrl)}${HTTP_ROUTES.authSignInSocial}/${provider}${query ? `?${query}` : ''}`;
+}
+/** The `token` a `/revoke-session` request names. The body reaches the hook serialized. */
+export function revokedToken(body) {
+    try {
+        return (typeof body === 'string' ? JSON.parse(body) : body)?.token;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Read the token an OAuth callback left in the URL fragment and return the URL
+ * with it removed, so a reload or a shared link cannot replay it.
+ *
+ * The provider callback cannot answer the SDK with a JSON body: it is a browser
+ * redirect. The server therefore appends `#access_token=…` to the redirect it
+ * issues (auth/oauth-redirect.ts). Exported for testing.
+ */
+export function readAccessTokenFromUrl(href) {
+    const hash = href.indexOf('#');
+    if (hash === -1)
+        return null;
+    const params = new URLSearchParams(href.slice(hash + 1));
+    const accessToken = params.get('access_token');
+    if (!accessToken)
+        return null;
+    params.delete('access_token');
+    params.delete('token_type');
+    const rest = params.toString();
+    return { accessToken, cleanedHref: `${href.slice(0, hash)}${rest ? `#${rest}` : ''}` };
+}
+/** The auth path of a request: `/api/auth/sign-in/email` → `/sign-in/email`. */
+export function authPath(url) {
+    const pathname = typeof url === 'string' && !/^https?:/.test(url) ? url.split('?')[0] : new URL(url).pathname;
+    return pathname.startsWith(HTTP_ROUTES.auth) ? pathname.slice(HTTP_ROUTES.auth.length) : pathname;
+}
+/**
+ * The proxy hands out the function it finds detached from its object, so a
+ * class instance exposed as an action would lose `this`. Copy its methods out
+ * bound.
+ */
+export function bindMethods(target) {
+    const bound = {};
+    for (const key of Object.getOwnPropertyNames(Object.getPrototypeOf(target))) {
+        const value = target[key];
+        if (key !== 'constructor' && typeof value === 'function')
+            bound[key] = value.bind(target);
+    }
+    return bound;
+}
+export function adminActions(http) {
+    const admin = new AuthAdminClient(http);
+    return { ...bindMethods(admin), mfa: bindMethods(admin.mfa) };
+}
+//# sourceMappingURL=utils.js.map

package/dist/auth/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/auth/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,IAAsB;IACvE,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,CAAU,EAAE,CAAC;QACrF,IAAI,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC,gBAAgB,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACrH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC/B,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACzF,CAAC;AAID,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,GAAiB;IACxC,MAAM,QAAQ,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC9G,OAAO,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAmB,MAAS;IACrD,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,GAAG,KAAK,aAAa,IAAI,OAAO,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,KAAuB,CAAC;AACjC,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChE,CAAC"}

package/dist/auth.d.ts

@@ -4,11 +4,12 @@ import { passkeyClient } from '@better-auth/passkey/client';
 import { ssoClient } from '@better-auth/sso/client';
 import { apiKeyClient } from '@better-auth/api-key/client';
 import type { BetterFetch, BetterFetchPlugin, BetterFetchResponse } from '@better-fetch/fetch';
-import { AuthAdminClient, type AuthAdminMfaClient } from './admin.js';
 import { type VerifierStore } from './pkce.js';
-import type { HttpClient } from './http.js';
+import type { HttpClient } from './http/index.js';
 import type { SessionStore } from './session.js';
 import type { AuthChangeListener, Session, User } from './types.js';
+import { AuthAdminMfaClient } from './admin/auth-admin-mfa-client.js';
+import { AuthAdminClient } from './admin/auth-admin-client.js';
 /**
  * `client.auth` IS Better Auth's own client, typed with the plugins the server
  * mounts (auth/instance.ts). Every method in Better Auth's documentation is