@prabhask5/stellar-engine 1.1.7 → 1.1.9

package/dist/supabase/auth.js

@@ -1,15 +1,60 @@
+/**
+ * @fileoverview Supabase Authentication Module
+ *
+ * Provides core authentication utilities on top of Supabase Auth for the
+ * single-user PIN/password gate system:
+ *
+ * - **Sign-out & teardown**: Full 10-step teardown sequence to ensure no stale
+ *   data leaks across sessions.
+ *
+ * - **Session management**: `getSession()` falls back to localStorage when the
+ *   device is offline, ensuring the app can still render authenticated views
+ *   with stale-but-usable session data.
+ *
+ * - **Profile CRUD**: Read and update user profile metadata on Supabase and
+ *   in the offline credential cache.
+ *
+ * - **Email confirmation & OTP**: Resend confirmation emails and verify OTP
+ *   token hashes from confirmation links.
+ *
+ * Security considerations:
+ *   - Corrupted sessions are detected and automatically cleared to prevent
+ *     infinite error loops.
+ *   - Sign-out follows a strict 10-step teardown sequence to ensure no stale
+ *     data leaks across user boundaries.
+ *
+ * Integration patterns:
+ *   - Used internally by single-user auth (`../auth/singleUser.ts`) and the
+ *     scaffolded confirm page (`../kit/confirm.ts`).
+ *   - Works in tandem with `./client.ts` (lazy Supabase singleton) and
+ *     `../engine.ts` (sync engine lifecycle).
+ *   - Offline credential helpers live in `../auth/offlineCredentials.ts`.
+ *
+ * @module supabase/auth
+ */
 import { supabase } from './client';
-import { cacheOfflineCredentials, clearOfflineCredentials, getOfflineCredentials, updateOfflineCredentialsPassword, updateOfflineCredentialsProfile } from '../auth/offlineCredentials';
+import { clearOfflineCredentials, updateOfflineCredentialsProfile } from '../auth/offlineCredentials';
 import { clearOfflineSession } from '../auth/offlineSession';
-import { preCheckLogin, onLoginSuccess, onLoginFailure, resetLoginGuard } from '../auth/loginGuard';
-import { hashValue, isAlreadyHashed } from '../auth/crypto';
+import { resetLoginGuard } from '../auth/loginGuard';
 import { debugWarn, debugError } from '../debug';
 import { getEngineConfig } from '../config';
 import { syncStatusStore } from '../stores/sync';
 import { authState } from '../stores/authState';
+// =============================================================================
+// SECTION: Helpers
+// =============================================================================
 /**
- * Get the email confirmation redirect URL
- * Points to /confirm page which handles the token verification
+ * Get the email confirmation redirect URL.
+ *
+ * Points to the `/confirm` page (or the path configured via
+ * `auth.confirmRedirectPath`) which handles the token verification flow
+ * after a user clicks the link in their confirmation email.
+ *
+ * @returns The fully-qualified redirect URL, e.g. `https://app.example.com/confirm`.
+ *          Falls back to a relative `/confirm` path in SSR environments where
+ *          `window` is unavailable.
+ *
+ * @see {@link resendConfirmationEmail} — uses this URL
  */
 function getConfirmRedirectUrl() {
     if (typeof window !== 'undefined') {
@@ -19,81 +64,42 @@ function getConfirmRedirectUrl() {
     // Fallback for SSR (shouldn't be called, but just in case)
     return '/confirm';
 }
-export async function signIn(email, password) {
-    // Pre-check credentials locally before calling Supabase
-    const preCheck = await preCheckLogin(password, 'multi-user', email);
-    if (!preCheck.proceed) {
-        return {
-            user: null,
-            session: null,
-            error: preCheck.error,
-            retryAfterMs: preCheck.retryAfterMs
-        };
-    }
-    const strategy = preCheck.strategy;
-    const { data, error } = await supabase.auth.signInWithPassword({
-        email,
-        password
-    });
-    if (error) {
-        await onLoginFailure(strategy, 'multi-user');
-        return { user: data.user, session: data.session, error: error.message };
-    }
-    // Successful Supabase login
-    onLoginSuccess();
-    // Cache credentials for offline use on successful login
-    if (data.session && data.user) {
-        try {
-            await cacheOfflineCredentials(email, password, data.user, data.session);
-        }
-        catch (e) {
-            debugError('[Auth] Failed to cache offline credentials:', e);
-        }
-        // Check device verification for multi-user mode
-        const config = getEngineConfig();
-        if (config.auth?.deviceVerification?.enabled) {
-            const { isDeviceTrusted, touchTrustedDevice, sendDeviceVerification, maskEmail } = await import('../auth/deviceVerification');
-            const trusted = await isDeviceTrusted(data.user.id);
-            if (!trusted) {
-                // Untrusted device — sign out, send OTP
-                const maskedEmail = maskEmail(email);
-                await sendDeviceVerification(email);
-                return {
-                    user: data.user,
-                    session: null,
-                    error: null,
-                    deviceVerificationRequired: true,
-                    maskedEmail
-                };
-            }
-            await touchTrustedDevice(data.user.id);
-        }
-    }
-    return {
-        user: data.user,
-        session: data.session,
-        error: null
-    };
-}
-export async function signUp(email, password, profileData) {
-    const config = getEngineConfig();
-    const metadata = config.auth?.profileToMetadata
-        ? config.auth.profileToMetadata(profileData)
-        : profileData;
-    const { data, error } = await supabase.auth.signUp({
-        email,
-        password,
-        options: {
-            emailRedirectTo: getConfirmRedirectUrl(),
-            data: metadata
-        }
-    });
-    return {
-        user: data.user,
-        session: data.session,
-        error: error?.message || null
-    };
-}
+// =============================================================================
+// SECTION: Sign Out
+// =============================================================================
+/**
+ * Sign the current user out and perform a full teardown of local state.
+ *
+ * The teardown follows a strict **10-step sequence** to ensure no stale data
+ * leaks between user sessions:
+ *
+ *   1. Stop the sync engine (dynamic import avoids circular deps).
+ *   2. Clear the pending sync queue (unless `preserveLocalData` is set).
+ *   3. Clear the local cache (unless `preserveLocalData` is set).
+ *   4. Clear the offline session token.
+ *   5. Clear offline credentials (only when online, to preserve offline re-login).
+ *   6. Call `supabase.auth.signOut()`.
+ *   7. Remove all `sb-*` keys from localStorage (Supabase internal storage).
+ *   8. Reset the login guard (brute-force counters).
+ *   9. Reset the sync status store.
+ *  10. Reset the auth state store.
+ *
+ * Each step is wrapped in its own try/catch so that a failure in one step
+ * does not prevent subsequent cleanup from running.
+ *
+ * @param options - Optional flags to control teardown behavior.
+ * @param options.preserveOfflineCredentials - When `true`, offline credentials
+ *        are kept so the user can re-authenticate without network access.
+ * @param options.preserveLocalData - When `true`, pending sync queue and local
+ *        cache are retained.
+ * @returns An object with an `error` field (`null` on success).
+ *
+ * @example
+ * ```ts
+ * await signOut(); // full teardown
+ * await signOut({ preserveLocalData: true }); // keep cached data
+ * ```
+ */
 export async function signOut(options) {
     // 1. Stop sync engine (import dynamically to avoid circular deps)
     try {
@@ -119,6 +125,10 @@ export async function signOut(options) {
     // 5. Clear offline credentials (only if online, for offline re-login preservation)
     try {
         if (!options?.preserveOfflineCredentials) {
+            /* Only clear when online — if the user is offline, we want to keep
+               the cached credentials so they can still sign back in without
+               network access. This is a deliberate security trade-off favouring
+               availability over strict credential erasure. */
             const isOnline = typeof navigator !== 'undefined' && navigator.onLine;
             if (isOnline) {
                 await clearOfflineCredentials();
@@ -148,10 +158,35 @@ export async function signOut(options) {
     authState.reset();
     return { error: error?.message || null };
 }
+// =============================================================================
+// SECTION: Session Management
+// =============================================================================
 /**
- * Get current Supabase session
- * When offline, returns the cached session from localStorage even if expired
- * (the caller should handle offline mode appropriately)
+ * Get the current Supabase session.
+ *
+ * When the device is **online**, this delegates to `supabase.auth.getSession()`
+ * which may trigger a token refresh if the access token is close to expiry.
+ *
+ * When the device is **offline**, or if the Supabase call fails with a
+ * corrupted-session error, this falls back to reading the session directly
+ * from localStorage via {@link getSessionFromStorage}. The returned session
+ * may be expired, but callers can use {@link isSessionExpired} to check and
+ * should handle offline mode appropriately (e.g. show cached data, queue
+ * mutations for later sync).
+ *
+ * @returns The current `Session` object, or `null` if no valid session exists.
+ *
+ * @example
+ * ```ts
+ * const session = await getSession();
+ * if (session && !isSessionExpired(session)) {
+ *   // Fully authenticated
+ * }
+ * ```
+ *
+ * @see {@link getSessionFromStorage} — direct localStorage fallback
+ * @see {@link isSessionExpired} — expiry check helper
+ * @see {@link getValidSession} — combined convenience wrapper
  */
 export async function getSession() {
     const isOffline = typeof navigator !== 'undefined' && !navigator.onLine;
@@ -165,7 +200,9 @@ export async function getSession() {
                 // Try to get session from localStorage directly
                 return getSessionFromStorage();
             }
-            // If session retrieval fails online, it might be corrupted - try to sign out to clear it
+            /* Detect corrupted session data (e.g. "can't access property 'hash'
+               of undefined") which can occur when localStorage is partially written.
+               Signing out clears the corrupt state so subsequent calls succeed. */
             if (error.message?.includes('hash') || error.message?.includes('undefined')) {
                 debugWarn('[Auth] Detected corrupted session, attempting to clear');
                 await supabase.auth.signOut();
@@ -192,8 +229,20 @@ export async function getSession() {
     }
 }
 /**
- * Get session directly from localStorage (for offline scenarios)
- * This bypasses Supabase's token refresh logic
+ * Read the session directly from localStorage, bypassing Supabase's
+ * built-in token refresh logic.
+ *
+ * This is used as a **fallback** when the device is offline and the normal
+ * `supabase.auth.getSession()` call fails. The returned session may be
+ * expired, but it still contains the user identity, which is sufficient for
+ * rendering cached offline views.
+ *
+ * Supabase stores its auth token in localStorage under a key matching the
+ * pattern `sb-{project-ref}-auth-token`. The internal structure has changed
+ * between Supabase versions, so we check for both `currentSession` (older)
+ * and `session` (newer) shapes.
+ *
+ * @returns The cached `Session`, or `null` if nothing usable is found.
  */
 function getSessionFromStorage() {
     try {
@@ -221,7 +270,22 @@ function getSessionFromStorage() {
     }
 }
 /**
- * Check if a session's access token is expired
+ * Check whether a session's access token has expired.
+ *
+ * The `expires_at` field on a Supabase session is a **Unix timestamp in
+ * seconds**. We compare it against `Date.now() / 1000` (which is in
+ * milliseconds, hence the division).
+ *
+ * @param session - The session to check, or `null`.
+ * @returns `true` if the session is `null`, missing `expires_at`, or past
+ *          its expiry time; `false` otherwise.
+ *
+ * @example
+ * ```ts
+ * if (isSessionExpired(session)) {
+ *   // Prompt re-authentication or attempt token refresh
+ * }
+ * ```
  */
 export function isSessionExpired(session) {
     if (!session)
@@ -232,6 +296,25 @@ export function isSessionExpired(session) {
         return true;
     return Date.now() / 1000 > expiresAt;
 }
+// =============================================================================
+// SECTION: User Profile
+// =============================================================================
+/**
+ * Extract the user's profile from their Supabase `user_metadata`.
+ *
+ * If the engine config provides a custom `auth.profileExtractor`, it is
+ * invoked to transform the raw metadata into the app's profile shape.
+ * Otherwise the raw `user_metadata` object is returned as-is.
+ *
+ * @param user - The Supabase `User` object (may be `null`).
+ * @returns A key-value record representing the user's profile fields.
+ *
+ * @example
+ * ```ts
+ * const profile = getUserProfile(session.user);
+ * console.log(profile.display_name);
+ * ```
+ */
 export function getUserProfile(user) {
     const config = getEngineConfig();
     if (config.auth?.profileExtractor && user) {
@@ -240,8 +323,22 @@ export function getUserProfile(user) {
     return user?.user_metadata || {};
 }
 /**
- * Update user profile
- * Also updates cached offline credentials
+ * Update the current user's profile metadata on Supabase.
+ *
+ * The profile data is transformed through `auth.profileToMetadata` (if
+ * configured) before being sent. On success the offline credential cache
+ * is also updated so that the profile stays consistent across online and
+ * offline modes.
+ *
+ * @param profile - The updated profile fields to persist.
+ * @returns An object with an `error` field (`null` on success).
+ *
+ * @example
+ * ```ts
+ * const { error } = await updateProfile({ display_name: 'New Name' });
+ * ```
+ *
+ * @see {@link updateOfflineCredentialsProfile} — keeps the offline cache in sync
  */
 export async function updateProfile(profile) {
     const config = getEngineConfig();
@@ -262,104 +359,23 @@ export async function updateProfile(profile) {
     }
     return { error: error?.message || null };
 }
+// =============================================================================
+// SECTION: Email Confirmation & OTP
+// =============================================================================
 /**
- * Change user password
- * Verifies current password first, then updates
- * Also updates cached offline credentials
- */
-export async function changePassword(currentPassword, newPassword) {
-    // Get current user email from session
-    const { data: { session } } = await supabase.auth.getSession();
-    const user = session?.user;
-    if (!user?.email) {
-        return { error: 'No authenticated user found' };
-    }
-    // Verify current password: prefer local hash check, fall back to Supabase
-    const creds = await getOfflineCredentials();
-    if (creds && creds.password && creds.email === user.email) {
-        // Local verification against cached hash
-        let passwordMatch;
-        if (isAlreadyHashed(creds.password)) {
-            const hashedInput = await hashValue(currentPassword);
-            passwordMatch = creds.password === hashedInput;
-        }
-        else {
-            passwordMatch = creds.password === currentPassword;
-        }
-        if (!passwordMatch) {
-            return { error: 'Current password is incorrect' };
-        }
-    }
-    else {
-        // No cached credentials — fall back to Supabase verification
-        const { error: verifyError } = await supabase.auth.signInWithPassword({
-            email: user.email,
-            password: currentPassword
-        });
-        if (verifyError) {
-            return { error: 'Current password is incorrect' };
-        }
-    }
-    // Update password
-    const { error } = await supabase.auth.updateUser({
-        password: newPassword
-    });
-    if (!error) {
-        // Update offline cache with new password
-        try {
-            await updateOfflineCredentialsPassword(newPassword);
-        }
-        catch (e) {
-            debugError('[Auth] Failed to update offline password:', e);
-        }
-    }
-    return { error: error?.message || null };
-}
-/**
- * Initiate an email change for the current user.
- * Supabase sends a confirmation email to the new address.
- */
-export async function changeEmail(newEmail) {
-    const { error } = await supabase.auth.updateUser({ email: newEmail });
-    if (error) {
-        return { error: error.message, confirmationRequired: false };
-    }
-    return { error: null, confirmationRequired: true };
-}
-/**
- * Complete email change after the user confirms via the email link.
- * Refreshes session to pick up the new email and updates offline credentials.
- */
-export async function completeEmailChange() {
-    const { data, error: refreshError } = await supabase.auth.refreshSession();
-    if (refreshError || !data.session) {
-        return { error: refreshError?.message || 'Failed to refresh session', newEmail: null };
-    }
-    const newEmail = data.session.user.email;
-    if (!newEmail) {
-        return { error: 'No email found in updated session', newEmail: null };
-    }
-    // Update offline credentials cache
-    try {
-        const db = getEngineConfig().db;
-        if (db) {
-            const existing = await db.table('offlineCredentials').get('current_user');
-            if (existing) {
-                await db.table('offlineCredentials').update('current_user', {
-                    email: newEmail,
-                    cachedAt: new Date().toISOString()
-                });
-            }
-        }
-    }
-    catch (e) {
-        debugError('[Auth] Failed to update offline credentials after email change:', e);
-    }
-    return { error: null, newEmail };
-}
-/**
- * Resend confirmation email for signup
- * Should be rate-limited on the client side (30 second cooldown)
+ * Resend the signup confirmation email for a given address.
+ *
+ * The caller should enforce a client-side cooldown (recommended: 30 seconds)
+ * to prevent abuse, since Supabase may not always rate-limit resends on its
+ * own.
+ *
+ * @param email - The email address that needs a new confirmation link.
+ * @returns An object with an `error` field (`null` on success).
+ *
+ * @example
+ * ```ts
+ * const { error } = await resendConfirmationEmail('user@example.com');
+ * ```
  */
 export async function resendConfirmationEmail(email) {
     const { error } = await supabase.auth.resend({
@@ -372,8 +388,21 @@ export async function resendConfirmationEmail(email) {
     return { error: error?.message || null };
 }
 /**
- * Verify OTP token (for email confirmation).
- * Absorbs confirm page's direct Supabase call.
+ * Verify an OTP token hash received from a confirmation email link.
+ *
+ * This absorbs the direct Supabase call that would otherwise live in the
+ * confirm page component, keeping all auth logic centralised in this module.
+ *
+ * @param tokenHash - The `token_hash` query parameter from the confirmation URL.
+ * @param type      - The type of OTP: `'signup'`, `'email'`, or `'email_change'`.
+ * @returns An object with an `error` field (`null` on success).
+ *
+ * @example
+ * ```ts
+ * // On the /confirm page:
+ * const hash = new URL(location.href).searchParams.get('token_hash');
+ * const { error } = await verifyOtp(hash, 'signup');
+ * ```
  */
 export async function verifyOtp(tokenHash, type) {
     const { error } = await supabase.auth.verifyOtp({
@@ -382,9 +411,28 @@ export async function verifyOtp(tokenHash, type) {
     });
     return { error: error?.message || null };
 }
+// =============================================================================
+// SECTION: Convenience Wrappers
+// =============================================================================
 /**
- * Get a valid (non-expired) session, or null.
- * Merges getSession() + isSessionExpired() into a single call.
+ * Get a valid (non-expired) session, or `null`.
+ *
+ * This is a convenience wrapper that combines {@link getSession} and
+ * {@link isSessionExpired} into a single call, useful when the caller only
+ * cares about sessions that can still be used for API requests.
+ *
+ * @returns A non-expired `Session`, or `null`.
+ *
+ * @example
+ * ```ts
+ * const session = await getValidSession();
+ * if (!session) {
+ *   redirectToLogin();
+ * }
+ * ```
+ *
+ * @see {@link getSession}
+ * @see {@link isSessionExpired}
  */
 export async function getValidSession() {
     const session = await getSession();

package/dist/supabase/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/supabase/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,gCAAgC,EAChC,+BAA+B,EAChC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEpG,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;GAGG;AACH,SAAS,qBAAqB;IAC5B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC,IAAI,EAAE,mBAAmB,IAAI,UAAU,CAAC;QACvE,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,2DAA2D;IAC3D,OAAO,UAAU,CAAC;AACpB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,QAAgB;IAC1D,wDAAwD;IACxD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAqB,QAAQ,CAAC,QAAQ,CAAC;IAErD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAC7D,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,cAAc,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1E,CAAC;IAED,4BAA4B;IAC5B,cAAc,EAAE,CAAC;IAEjB,wDAAwD;IACxD,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,UAAU,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,gDAAgD;QAChD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;YAC7C,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,SAAS,EAAE,GAC9E,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,wCAAwC;gBACxC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBACpC,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,IAAI;oBACX,0BAA0B,EAAE,IAAI;oBAChC,WAAW;iBACZ,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,KAAa,EACb,QAAgB,EAChB,WAAoC;IAEpC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,iBAAiB;QAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC;QAC5C,CAAC,CAAC,WAAW,CAAC;IAEhB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QACjD,KAAK;QACL,QAAQ;QACR,OAAO,EAAE;YACP,eAAe,EAAE,qBAAqB,EAAE;YACxC,IAAI,EAAE,QAAQ;SACf;KACF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAG7B;IACC,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAE7F,MAAM,cAAc,EAAE,CAAC;QAEvB,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;YAChC,8BAA8B;YAC9B,MAAM,qBAAqB,EAAE,CAAC;YAE9B,uBAAuB;YACvB,MAAM,eAAe,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,UAAU,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC;QACH,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,UAAU,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,mFAAmF;IACnF,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,0BAA0B,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,OAAO,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,MAAM,CAAC;YACtE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,uBAAuB,EAAE,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,UAAU,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,2BAA2B;IAC3B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAEhD,kCAAkC;IAClC,IAAI,CAAC;QACH,IAAI,OAAO,YAAY,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IAED,6BAA6B;IAC7B,eAAe,EAAE,CAAC;IAElB,6BAA6B;IAC7B,eAAe,CAAC,KAAK,EAAE,CAAC;IAExB,6BAA6B;IAC7B,SAAS,CAAC,KAAK,EAAE,CAAC;IAElB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,SAAS,GAAG,OAAO,SAAS,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;IAExE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAEzD,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAEtD,yFAAyF;YACzF,IAAI,SAAS,EAAE,CAAC;gBACd,SAAS,CAAC,gDAAgD,CAAC,CAAC;gBAC5D,gDAAgD;gBAChD,OAAO,qBAAqB,EAAE,CAAC;YACjC,CAAC;YAED,yFAAyF;YACzF,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC5E,SAAS,CAAC,wDAAwD,CAAC,CAAC;gBACpE,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,UAAU,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;QAE1D,6DAA6D;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,CAAC,yDAAyD,CAAC,CAAC;YACrE,OAAO,qBAAqB,EAAE,CAAC;QACjC,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB;IAC5B,IAAI,CAAC;QACH,wFAAwF;QACxF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAE7B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,EAAE,cAAc,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,cAAyB,CAAC;QAC1C,CAAC;QACD,kDAAkD;QAClD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,OAAkB,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,UAAU,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAuB;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,2BAA2B;IAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAiB;IAC9C,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,EAAE,gBAAgB,IAAI,IAAI,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,EAAE,aAAa,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgC;IAEhC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,iBAAiB;QAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,OAAO,CAAC;IAEZ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/C,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,UAAU,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,eAAuB,EACvB,WAAmB;IAEnB,sCAAsC;IACtC,MAAM,EACJ,IAAI,EAAE,EAAE,OAAO,EAAE,EAClB,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;IAED,0EAA0E;IAC1E,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC5C,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,yCAAyC;QACzC,IAAI,aAAsB,CAAC;QAC3B,IAAI,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,CAAC;YACrD,aAAa,GAAG,KAAK,CAAC,QAAQ,KAAK,WAAW,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,KAAK,CAAC,QAAQ,KAAK,eAAe,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,6DAA6D;QAC7D,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC;YACpE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,eAAe;SAC1B,CAAC,CAAC;QAEH,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/C,QAAQ,EAAE,WAAW;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,yCAAyC;QACzC,IAAI,CAAC;YACH,MAAM,gCAAgC,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,UAAU,CAAC,2CAA2C,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB;IAEhB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEtE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAIvC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;IAC3E,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,IAAI,2BAA2B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;IACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC,EAAE,CAAC;QAChC,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC1E,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE;oBAC1D,KAAK,EAAE,QAAQ;oBACf,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,UAAU,CAAC,iEAAiE,EAAE,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAa;IACzD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3C,IAAI,EAAE,QAAQ;QACd,KAAK;QACL,OAAO,EAAE;YACP,eAAe,EAAE,qBAAqB,EAAE;SACzC;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,IAAyC;IAEzC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAC9C,UAAU,EAAE,SAAS;QACrB,IAAI;KACL,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/supabase/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAChC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,SAAS,qBAAqB;IAC5B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC,IAAI,EAAE,mBAAmB,IAAI,UAAU,CAAC;QACvE,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,2DAA2D;IAC3D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAG7B;IACC,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAE7F,MAAM,cAAc,EAAE,CAAC;QAEvB,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;YAChC,8BAA8B;YAC9B,MAAM,qBAAqB,EAAE,CAAC;YAE9B,uBAAuB;YACvB,MAAM,eAAe,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,UAAU,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC;QACH,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,UAAU,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,mFAAmF;IACnF,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,0BAA0B,EAAE,CAAC;YACzC;;;8DAGkD;YAClD,MAAM,QAAQ,GAAG,OAAO,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,MAAM,CAAC;YACtE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,uBAAuB,EAAE,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,UAAU,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,2BAA2B;IAC3B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAEhD,kCAAkC;IAClC,IAAI,CAAC;QACH,IAAI,OAAO,YAAY,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IAED,6BAA6B;IAC7B,eAAe,EAAE,CAAC;IAElB,6BAA6B;IAC7B,eAAe,CAAC,KAAK,EAAE,CAAC;IAExB,6BAA6B;IAC7B,SAAS,CAAC,KAAK,EAAE,CAAC;IAElB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,SAAS,GAAG,OAAO,SAAS,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;IAExE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAEzD,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAEtD,yFAAyF;YACzF,IAAI,SAAS,EAAE,CAAC;gBACd,SAAS,CAAC,gDAAgD,CAAC,CAAC;gBAC5D,gDAAgD;gBAChD,OAAO,qBAAqB,EAAE,CAAC;YACjC,CAAC;YAED;;mFAEuE;YACvE,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC5E,SAAS,CAAC,wDAAwD,CAAC,CAAC;gBACpE,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,UAAU,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;QAE1D,6DAA6D;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,CAAC,yDAAyD,CAAC,CAAC;YACrE,OAAO,qBAAqB,EAAE,CAAC;QACjC,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,qBAAqB;IAC5B,IAAI,CAAC;QACH,wFAAwF;QACxF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAE7B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,EAAE,cAAc,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,cAAyB,CAAC;QAC1C,CAAC;QACD,kDAAkD;QAClD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,OAAkB,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,UAAU,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAuB;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,2BAA2B;IAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;AACvC,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,IAAiB;IAC9C,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,EAAE,gBAAgB,IAAI,IAAI,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,EAAE,aAAa,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgC;IAEhC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,iBAAiB;QAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,OAAO,CAAC;IAEZ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/C,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,UAAU,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,oCAAoC;AACpC,gFAAgF;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAa;IACzD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3C,IAAI,EAAE,QAAQ;QACd,KAAK;QACL,OAAO,EAAE;YACP,eAAe,EAAE,qBAAqB,EAAE;SACzC;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,IAAyC;IAEzC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAC9C,UAAU,EAAE,SAAS;QACrB,IAAI;KACL,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,gCAAgC;AAChC,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/supabase/client.d.ts

@@ -1,15 +1,88 @@
 /**
- * Supabase Client - Lazy Initialization via Proxy
+ * @fileoverview Supabase Client — Lazy Initialization via ES Proxy
  *
- * Uses runtime config instead of build-time $env/static/public.
- * The Proxy pattern preserves the exact same API surface.
+ * This module exports a single `supabase` constant that looks and behaves
+ * exactly like a `SupabaseClient` instance, but is actually an ES `Proxy`
+ * that defers client creation until the **first property access**. This
+ * "lazy singleton" pattern solves a critical bootstrapping problem:
+ *
+ *   The Supabase URL and anon key are loaded at **runtime** (via
+ *   `getConfig()` from `../runtime/runtimeConfig`), not at build time.
+ *   Modules that `import { supabase }` at the top level would otherwise
+ *   crash because the config has not been initialized yet when the import
+ *   executes.
+ *
+ * How the Proxy pattern works:
+ *   1. `supabase` is exported as `new Proxy({} as SupabaseClient, handler)`.
+ *   2. The handler's `get` trap intercepts every property access (e.g.
+ *      `supabase.auth`, `supabase.from(...)`).
+ *   3. On first access, `getOrCreateClient()` reads the runtime config and
+ *      calls `createClient(url, key, options)` to build the real client.
+ *   4. The real client is cached in a module-level `realClient` variable;
+ *      subsequent accesses reuse it (standard singleton).
+ *   5. Function values are `.bind(client)` to preserve `this` context.
+ *
+ * Additional responsibilities:
+ *   - **Corrupted session cleanup**: Before the client is created, any
+ *     malformed `sb-*` entries in localStorage are detected and removed to
+ *     prevent "can't access property 'hash'" runtime errors.
+ *   - **Unhandled rejection handler**: A global listener catches Supabase
+ *     auth errors that escape normal error handling, clears storage, and
+ *     performs a single guarded page reload to recover.
+ *   - **iOS PWA detection**: The client sends a custom `x-client-info`
+ *     header indicating whether it is running as a standalone PWA on iOS,
+ *     which helps with server-side debugging of session eviction issues.
+ *
+ * Security considerations:
+ *   - The anon key is a **public** key (safe to include in client bundles).
+ *   - PKCE flow is used instead of the implicit flow for stronger OAuth
+ *     security and better compatibility with PWA environments.
+ *   - Session persistence uses localStorage; the module proactively scrubs
+ *     corrupted entries to prevent denial-of-service via bad local state.
+ *
+ * @module supabase/client
  */
 import { type SupabaseClient } from '@supabase/supabase-js';
+/**
+ * Override the storage key prefix used by the Supabase client.
+ *
+ * Must be called **before** the first access to the `supabase` export,
+ * since the prefix is baked into the client options at creation time.
+ *
+ * @param prefix - The new prefix string (e.g. the app's name).
+ *
+ * @example
+ * ```ts
+ * _setClientPrefix('myapp');
+ * // Later accesses will use storageKey 'myapp-auth'
+ * ```
+ */
 export declare function _setClientPrefix(prefix: string): void;
 /**
- * Proxy-based lazy singleton.
- * Delegates all property access to the real SupabaseClient,
- * which is created on first access using getConfig().
+ * The public Supabase client — a Proxy-based lazy singleton.
+ *
+ * **Why a Proxy?**
+ * The Supabase URL and anon key are not available at import time (they come
+ * from a runtime config that is loaded asynchronously). A Proxy lets every
+ * module `import { supabase }` at the top level without worrying about
+ * initialization order. The real client is created transparently on first
+ * property access.
+ *
+ * **How it works:**
+ * - The `get` trap intercepts every property read (e.g. `supabase.auth`,
+ *   `supabase.from`).
+ * - It calls `getOrCreateClient()` to ensure the real client exists.
+ * - It forwards the property access via `Reflect.get`.
+ * - Function values are `.bind(client)` to keep `this` correct when the
+ *   caller destructures methods (e.g. `const { from } = supabase`).
+ *
+ * @example
+ * ```ts
+ * import { supabase } from './client';
+ *
+ * // Works immediately — the Proxy defers creation until this line runs:
+ * const { data } = await supabase.from('users').select('*');
+ * ```
  */
 export declare const supabase: SupabaseClient;
 //# sourceMappingURL=client.d.ts.map

package/dist/supabase/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/supabase/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAM1E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,QAE9C;AAqJD;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,cASrB,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/supabase/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAe1E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,QAE9C;AAwND;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,QAAQ,EAAE,cASrB,CAAC"}