@resultdev/sdk 0.1.0 → 0.2.0

package/dist/ssr.js

@@ -1,20 +1,250 @@
-import {
-  ERROR_CODES,
-  oAuthProvidersSchema
-} from "./chunk-Y7VCTXPN.js";
+// src/lib/jwt.ts
+function decodeBase64Url(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(
+    normalized.length + (4 - normalized.length % 4) % 4,
+    "="
+  );
+  const binary = atob(padded);
+  const bytes2 = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+  return new TextDecoder().decode(bytes2);
+}
+function getJwtExpiration(token) {
+  if (!token) {
+    return null;
+  }
+  const [, payload] = token.split(".");
+  if (!payload) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(decodeBase64Url(payload));
+    if (typeof parsed.exp !== "number" || !Number.isFinite(parsed.exp)) {
+      return null;
+    }
+    return new Date(parsed.exp * 1e3);
+  } catch {
+    return null;
+  }
+}
+function isJwtExpiredOrExpiring(token, leewaySeconds = 60) {
+  if (!token) {
+    return false;
+  }
+  const expires = getJwtExpiration(token);
+  if (!expires) {
+    return true;
+  }
+  return expires.getTime() <= Date.now() + leewaySeconds * 1e3;
+}
 
-// ../../node_modules/.bun/@insforge+sdk@1.4.4/node_modules/@insforge/sdk/dist/ssr.mjs
-import { PostgrestClient } from "@supabase/postgrest-js";
-var InsForgeError = class _InsForgeError extends Error {
+// src/ssr/cookies.ts
+var DEFAULT_ACCESS_TOKEN_COOKIE = "result_access_token";
+var DEFAULT_REFRESH_TOKEN_COOKIE = "result_refresh_token";
+var EXPIRED_DATE = /* @__PURE__ */ new Date(0);
+function getAccessTokenCookieName(names) {
+  return names?.accessToken ?? DEFAULT_ACCESS_TOKEN_COOKIE;
+}
+function getRefreshTokenCookieName(names) {
+  return names?.refreshToken ?? DEFAULT_REFRESH_TOKEN_COOKIE;
+}
+function getCookieValue(cookies, name) {
+  if (!cookies) {
+    return null;
+  }
+  const value = cookies.get(name);
+  if (typeof value === "string") {
+    return value || null;
+  }
+  if (value && typeof value.value === "string") {
+    return value.value || null;
+  }
+  return null;
+}
+function getCookieValueFromHeader(cookieHeader, name) {
+  if (!cookieHeader) {
+    return null;
+  }
+  const parts = cookieHeader.split(";");
+  for (const part of parts) {
+    const [rawName, ...rawValue] = part.trim().split("=");
+    if (rawName !== name) {
+      continue;
+    }
+    try {
+      return decodeURIComponent(rawValue.join("="));
+    } catch {
+      return rawValue.join("=");
+    }
+  }
+  return null;
+}
+function getBrowserCookie(name) {
+  if (typeof document === "undefined") {
+    return null;
+  }
+  return getCookieValueFromHeader(document.cookie, name);
+}
+function defaultCookieOptions() {
+  const secure = typeof process !== "undefined" ? process.env.NODE_ENV === "production" : typeof location !== "undefined" && location.protocol === "https:";
+  return {
+    path: "/",
+    sameSite: "lax",
+    secure
+  };
+}
+function accessTokenCookieOptions(token, overrides) {
+  return {
+    ...defaultCookieOptions(),
+    httpOnly: false,
+    expires: getJwtExpiration(token) ?? void 0,
+    ...overrides
+  };
+}
+function refreshTokenCookieOptions(token, overrides) {
+  return {
+    ...defaultCookieOptions(),
+    httpOnly: true,
+    expires: getJwtExpiration(token) ?? void 0,
+    ...overrides
+  };
+}
+function expiredCookieOptions(overrides) {
+  const {
+    expires: _expires,
+    maxAge: _maxAge,
+    ...safeOverrides
+  } = overrides ?? {};
+  return {
+    ...defaultCookieOptions(),
+    ...safeOverrides,
+    expires: EXPIRED_DATE,
+    maxAge: 0
+  };
+}
+function setCookie(cookies, name, value, options) {
+  if (!cookies?.set) {
+    return;
+  }
+  cookies.set(name, value, options);
+}
+function deleteCookie(cookies, name, options) {
+  if (!cookies) {
+    return;
+  }
+  if (cookies.set) {
+    cookies.set(name, "", expiredCookieOptions(options));
+    return;
+  }
+  cookies.delete?.(name);
+}
+function serializeCookie(name, value, options = {}) {
+  const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
+  if (options.maxAge !== void 0) {
+    parts.push(`Max-Age=${options.maxAge}`);
+  }
+  if (options.domain) {
+    parts.push(`Domain=${options.domain}`);
+  }
+  if (options.path) {
+    parts.push(`Path=${options.path}`);
+  }
+  if (options.expires) {
+    parts.push(`Expires=${options.expires.toUTCString()}`);
+  }
+  if (options.httpOnly) {
+    parts.push("HttpOnly");
+  }
+  if (options.secure) {
+    parts.push("Secure");
+  }
+  if (options.sameSite) {
+    const sameSite = options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1);
+    parts.push(`SameSite=${sameSite}`);
+  }
+  return parts.join("; ");
+}
+function appendSetCookie(headers, name, value, options) {
+  headers.append("Set-Cookie", serializeCookie(name, value, options));
+}
+function setAuthCookies(cookies, tokens, settings = {}) {
+  const accessName = getAccessTokenCookieName(settings.names);
+  const refreshName = getRefreshTokenCookieName(settings.names);
+  const accessOptions = accessTokenCookieOptions(
+    tokens.accessToken,
+    settings.options?.accessToken
+  );
+  setCookie(cookies, accessName, tokens.accessToken, accessOptions);
+  if (tokens.refreshToken) {
+    setCookie(
+      cookies,
+      refreshName,
+      tokens.refreshToken,
+      refreshTokenCookieOptions(
+        tokens.refreshToken,
+        settings.options?.refreshToken
+      )
+    );
+  }
+}
+function clearAuthCookies(cookies, settings = {}) {
+  const accessName = getAccessTokenCookieName(settings.names);
+  const refreshName = getRefreshTokenCookieName(settings.names);
+  const accessOptions = expiredCookieOptions(settings.options?.accessToken);
+  const refreshOptions = expiredCookieOptions(settings.options?.refreshToken);
+  deleteCookie(cookies, accessName, accessOptions);
+  deleteCookie(cookies, refreshName, refreshOptions);
+}
+function setAuthCookieHeaders(headers, tokens, settings = {}) {
+  const accessName = getAccessTokenCookieName(settings.names);
+  const refreshName = getRefreshTokenCookieName(settings.names);
+  appendSetCookie(
+    headers,
+    accessName,
+    tokens.accessToken,
+    accessTokenCookieOptions(tokens.accessToken, settings.options?.accessToken)
+  );
+  if (tokens.refreshToken) {
+    appendSetCookie(
+      headers,
+      refreshName,
+      tokens.refreshToken,
+      refreshTokenCookieOptions(
+        tokens.refreshToken,
+        settings.options?.refreshToken
+      )
+    );
+  }
+}
+function clearAuthCookieHeaders(headers, settings = {}) {
+  appendSetCookie(
+    headers,
+    getAccessTokenCookieName(settings.names),
+    "",
+    expiredCookieOptions(settings.options?.accessToken)
+  );
+  appendSetCookie(
+    headers,
+    getRefreshTokenCookieName(settings.names),
+    "",
+    expiredCookieOptions(settings.options?.refreshToken)
+  );
+}
+
+// src/types.ts
+var ResultError = class _ResultError extends Error {
+  statusCode;
+  error;
+  nextActions;
   constructor(message, statusCode, error, nextActions) {
     super(message);
-    this.name = "InsForgeError";
+    this.name = "ResultError";
     this.statusCode = statusCode;
     this.error = error;
     this.nextActions = nextActions;
   }
   static fromApiError(apiError) {
-    return new _InsForgeError(
+    return new _ResultError(
       apiError.message,
       apiError.statusCode,
       apiError.error,
@@ -22,7 +252,14 @@ var InsForgeError = class _InsForgeError extends Error {
     );
   }
 };
-var SENSITIVE_HEADERS = ["authorization", "x-api-key", "cookie", "set-cookie"];
+
+// src/lib/logger.ts
+var SENSITIVE_HEADERS = [
+  "authorization",
+  "x-api-key",
+  "cookie",
+  "set-cookie"
+];
 var SENSITIVE_BODY_KEYS = [
   "password",
   "token",
@@ -97,6 +334,9 @@ function formatBody(body) {
   }
 }
 var Logger = class {
+  /** Whether debug logging is currently enabled */
+  enabled;
+  customLog;
   /**
    * Creates a new Logger instance.
    * @param debug - Set to true to enable console logging, or pass a custom log function
@@ -119,7 +359,7 @@ var Logger = class {
     if (!this.enabled) {
       return;
     }
-    const formatted = `[InsForge Debug] ${message}`;
+    const formatted = `[Result Debug] ${message}`;
     if (this.customLog) {
       this.customLog(formatted, ...args);
     } else {
@@ -135,7 +375,7 @@ var Logger = class {
     if (!this.enabled) {
       return;
     }
-    const formatted = `[InsForge Debug] ${message}`;
+    const formatted = `[Result Debug] ${message}`;
     if (this.customLog) {
       this.customLog(formatted, ...args);
     } else {
@@ -151,7 +391,7 @@ var Logger = class {
     if (!this.enabled) {
       return;
     }
-    const formatted = `[InsForge Debug] ${message}`;
+    const formatted = `[Result Debug] ${message}`;
     if (this.customLog) {
       this.customLog(formatted, ...args);
     } else {
@@ -176,7 +416,7 @@ var Logger = class {
     }
     const formattedBody = formatBody(sanitizeBody(body));
     if (formattedBody) {
-      const truncated = formattedBody.length > 1e3 ? formattedBody.slice(0, 1e3) + "... [truncated]" : formattedBody;
+      const truncated = formattedBody.length > 1e3 ? `${formattedBody.slice(0, 1e3)}... [truncated]` : formattedBody;
       parts.push(`  Body: ${truncated}`);
     }
     this.log(parts.join("\n"));
@@ -197,7 +437,7 @@ var Logger = class {
     const parts = [`\u2190 ${method} ${url} ${status} (${durationMs}ms)`];
     const formattedBody = formatBody(sanitizeBody(body));
     if (formattedBody) {
-      const truncated = formattedBody.length > 1e3 ? formattedBody.slice(0, 1e3) + "... [truncated]" : formattedBody;
+      const truncated = formattedBody.length > 1e3 ? `${formattedBody.slice(0, 1e3)}... [truncated]` : formattedBody;
       parts.push(`  Body: ${truncated}`);
     }
     if (status >= 400) {
@@ -207,12 +447,14 @@ var Logger = class {
     }
   }
 };
+
+// src/lib/token-manager.ts
 var AuthChangeEvent = {
   SIGNED_IN: "signedIn",
   SIGNED_OUT: "signedOut",
   TOKEN_REFRESHED: "tokenRefreshed"
 };
-var CSRF_TOKEN_COOKIE = "insforge_csrf_token";
+var CSRF_TOKEN_COOKIE = "result_csrf_token";
 function getCsrfToken() {
   if (typeof document === "undefined") {
     return null;
@@ -239,11 +481,10 @@ function clearCsrfToken() {
   document.cookie = `${CSRF_TOKEN_COOKIE}=; path=/; max-age=0; SameSite=Lax${secure}`;
 }
 var TokenManager = class {
-  constructor() {
-    this.accessToken = null;
-    this.user = null;
-    this.authStateChangeCallbacks = /* @__PURE__ */ new Map();
-  }
+  // In-memory storage
+  accessToken = null;
+  user = null;
+  authStateChangeCallbacks = /* @__PURE__ */ new Map();
   /**
    * Save session in memory
    */
@@ -321,41 +562,8 @@ var TokenManager = class {
     }
   }
 };
-function decodeBase64Url(input) {
-  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
-  const binary = atob(padded);
-  const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
-  return new TextDecoder().decode(bytes);
-}
-function getJwtExpiration(token) {
-  if (!token) {
-    return null;
-  }
-  const [, payload] = token.split(".");
-  if (!payload) {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(decodeBase64Url(payload));
-    if (typeof parsed.exp !== "number" || !Number.isFinite(parsed.exp)) {
-      return null;
-    }
-    return new Date(parsed.exp * 1e3);
-  } catch {
-    return null;
-  }
-}
-function isJwtExpiredOrExpiring(token, leewaySeconds = 60) {
-  if (!token) {
-    return false;
-  }
-  const expires = getJwtExpiration(token);
-  if (!expires) {
-    return true;
-  }
-  return expires.getTime() <= Date.now() + leewaySeconds * 1e3;
-}
+
+// src/lib/http-client.ts
 var RETRYABLE_STATUS_CODES = /* @__PURE__ */ new Set([500, 502, 503, 504]);
 var IDEMPOTENT_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
 var REFRESHABLE_AUTH_ERROR_CODES = /* @__PURE__ */ new Set(["AUTH_UNAUTHORIZED", "PGRST301"]);
@@ -385,7 +593,7 @@ async function parseResponse(response) {
       data = await response.text();
     }
   } catch (parseErr) {
-    throw new InsForgeError(
+    throw new ResultError(
       `Failed to parse response body: ${parseErr?.message || "Unknown error"}`,
       response.status,
       response.ok ? "PARSE_ERROR" : "REQUEST_FAILED"
@@ -393,8 +601,8 @@ async function parseResponse(response) {
   }
   if (!response.ok) {
     if (data && typeof data === "object" && "error" in data) {
-      data.statusCode ?? (data.statusCode = data.status ?? response.status);
-      const error = InsForgeError.fromApiError(data);
+      data.statusCode ??= data.status ?? response.status;
+      const error = ResultError.fromApiError(data);
       Object.keys(data).forEach((key) => {
         if (key !== "error" && key !== "message" && key !== "statusCode") {
           error[key] = data[key];
@@ -402,7 +610,7 @@ async function parseResponse(response) {
       });
       throw error;
     }
-    throw new InsForgeError(
+    throw new ResultError(
       `Request failed: ${response.statusText}`,
       response.status,
       "REQUEST_FAILED"
@@ -411,6 +619,20 @@ async function parseResponse(response) {
   return data;
 }
 var HttpClient = class {
+  baseUrl;
+  fetch;
+  config;
+  defaultHeaders;
+  anonKey;
+  userToken = null;
+  logger;
+  isRefreshing = false;
+  refreshPromise = null;
+  tokenManager;
+  refreshToken = null;
+  timeout;
+  retryCount;
+  retryDelay;
   /**
    * Creates a new HttpClient instance.
    * @param config - SDK configuration including baseUrl, timeout, retry settings, and fetch implementation.
@@ -418,10 +640,6 @@ var HttpClient = class {
    * @param logger - Optional logger instance for request/response debugging.
    */
   constructor(config, tokenManager, logger) {
-    this.userToken = null;
-    this.isRefreshing = false;
-    this.refreshPromise = null;
-    this.refreshToken = null;
     this.config = config;
     this.baseUrl = config.baseUrl || "http://localhost:7130";
     this.fetch = config.fetch || (globalThis.fetch ? globalThis.fetch.bind(globalThis) : void 0);
@@ -469,7 +687,7 @@ var HttpClient = class {
    * @returns Delay in milliseconds.
    */
   computeRetryDelay(attempt) {
-    const base = this.retryDelay * Math.pow(2, attempt - 1);
+    const base = this.retryDelay * 2 ** (attempt - 1);
     const jitter = base * (0.85 + Math.random() * 0.3);
     return Math.round(jitter);
   }
@@ -477,19 +695,29 @@ var HttpClient = class {
     return statusCode === 401 && REFRESHABLE_AUTH_ERROR_CODES.has(errorCode ?? "") && !this.config.isServerMode && !this.config.accessToken && !this.config.edgeFunctionToken && !options.skipAuthRefresh && authToken !== null;
   }
   async fetchWithRetry(args) {
-    const { method, url, headers, body, fetchOptions, callerSignal, maxAttempts } = args;
-    let lastError;
-    for (let attempt = 0; attempt <= maxAttempts; attempt++) {
-      if (attempt > 0) {
-        const delay = this.computeRetryDelay(attempt);
-        this.logger.warn(`Retry ${attempt}/${maxAttempts} for ${method} ${url} in ${delay}ms`);
+    const {
+      method,
+      url,
+      headers,
+      body,
+      fetchOptions,
+      callerSignal,
+      maxAttempts
+    } = args;
+    let lastError;
+    for (let attempt = 0; attempt <= maxAttempts; attempt++) {
+      if (attempt > 0) {
+        const delay = this.computeRetryDelay(attempt);
+        this.logger.warn(
+          `Retry ${attempt}/${maxAttempts} for ${method} ${url} in ${delay}ms`
+        );
         if (callerSignal?.aborted) {
           throw callerSignal.reason;
         }
         await new Promise((resolve, reject) => {
           const onAbort = () => {
             clearTimeout(timer2);
-            reject(callerSignal.reason);
+            reject(callerSignal?.reason);
           };
           const timer2 = setTimeout(() => {
             if (callerSignal) {
@@ -507,13 +735,13 @@ var HttpClient = class {
       if (this.timeout > 0 || callerSignal) {
         controller = new AbortController();
         if (this.timeout > 0) {
-          timer = setTimeout(() => controller.abort(), this.timeout);
+          timer = setTimeout(() => controller?.abort(), this.timeout);
         }
         if (callerSignal) {
           if (callerSignal.aborted) {
             controller.abort(callerSignal.reason);
           } else {
-            const onCallerAbort = () => controller.abort(callerSignal.reason);
+            const onCallerAbort = () => controller?.abort(callerSignal.reason);
             callerSignal.addEventListener("abort", onCallerAbort, {
               once: true
             });
@@ -540,7 +768,7 @@ var HttpClient = class {
             clearTimeout(timer);
           }
           await response.body?.cancel();
-          lastError = new InsForgeError(
+          lastError = new ResultError(
             `Server error: ${response.status} ${response.statusText}`,
             response.status,
             "SERVER_ERROR"
@@ -556,8 +784,8 @@ var HttpClient = class {
           clearTimeout(timer);
         }
         if (err?.name === "AbortError") {
-          if (controller && controller.signal.aborted && this.timeout > 0 && !callerSignal?.aborted) {
-            throw new InsForgeError(
+          if (controller?.signal.aborted && this.timeout > 0 && !callerSignal?.aborted) {
+            throw new ResultError(
               `Request timed out after ${this.timeout}ms`,
               408,
               "REQUEST_TIMEOUT"
@@ -569,14 +797,18 @@ var HttpClient = class {
           lastError = err;
           continue;
         }
-        throw new InsForgeError(
+        throw new ResultError(
           `Network request failed: ${err?.message || "Unknown error"}`,
           0,
           "NETWORK_ERROR"
         );
       }
     }
-    throw lastError || new InsForgeError("Request failed after all retry attempts", 0, "NETWORK_ERROR");
+    throw lastError || new ResultError(
+      "Request failed after all retry attempts",
+      0,
+      "NETWORK_ERROR"
+    );
   }
   /**
    * Performs an HTTP request with automatic retry and timeout handling.
@@ -586,7 +818,7 @@ var HttpClient = class {
    * @param path - API path relative to the base URL.
    * @param options - Optional request configuration including headers, body, and query params.
    * @returns Parsed response data.
-   * @throws {InsForgeError} On timeout, network failure, or HTTP error responses.
+   * @throws {ResultError} On timeout, network failure, or HTTP error responses.
    */
   async handleRequest(method, path, options = {}, tokenOverride) {
     const {
@@ -606,14 +838,14 @@ var HttpClient = class {
     };
     const authToken = tokenOverride ?? this.userToken ?? this.anonKey;
     if (authToken) {
-      requestHeaders["Authorization"] = `Bearer ${authToken}`;
+      requestHeaders.Authorization = `Bearer ${authToken}`;
     }
     const processedBody = serializeBody(method, body, requestHeaders);
     const setRequestHeader = (key, value) => {
       if (key.toLowerCase() === "authorization") {
-        delete requestHeaders["Authorization"];
-        delete requestHeaders["authorization"];
-        requestHeaders["Authorization"] = value;
+        delete requestHeaders.Authorization;
+        delete requestHeaders.authorization;
+        requestHeaders.Authorization = value;
         return;
       }
       requestHeaders[key] = value;
@@ -645,7 +877,7 @@ var HttpClient = class {
     try {
       data = await parseResponse(response);
     } catch (err) {
-      if (err instanceof InsForgeError) {
+      if (err instanceof ResultError) {
         this.logger.logResponse(
           method,
           url,
@@ -656,15 +888,31 @@ var HttpClient = class {
       }
       throw err;
     }
-    this.logger.logResponse(method, url, response.status, Date.now() - startTime, data);
+    this.logger.logResponse(
+      method,
+      url,
+      response.status,
+      Date.now() - startTime,
+      data
+    );
     return data;
   }
   async request(method, path, options = {}) {
     const tokenUsed = this.userToken;
     try {
-      return await this.handleRequest(method, path, { ...options }, tokenUsed);
+      return await this.handleRequest(
+        method,
+        path,
+        { ...options },
+        tokenUsed
+      );
     } catch (error) {
-      if (!(error instanceof InsForgeError) || !this.shouldRefreshAccessToken(error.statusCode, error.error, tokenUsed, options)) {
+      if (!(error instanceof ResultError) || !this.shouldRefreshAccessToken(
+        error.statusCode,
+        error.error,
+        tokenUsed,
+        options
+      )) {
         throw error;
       }
       if (tokenUsed !== this.userToken) {
@@ -684,7 +932,7 @@ var HttpClient = class {
       try {
         await this.refreshAndSaveSession();
       } catch (error2) {
-        if (error2 instanceof InsForgeError && (error2.statusCode === 401 || error2.statusCode === 403)) {
+        if (error2 instanceof ResultError && (error2.statusCode === 401 || error2.statusCode === 403)) {
           this.clearAuthSession();
         }
         throw error2;
@@ -749,7 +997,12 @@ var HttpClient = class {
       callerSignal,
       maxAttempts
     });
-    this.logger.logResponse(method, url, response.status, Date.now() - startTime);
+    this.logger.logResponse(
+      method,
+      url,
+      response.status,
+      Date.now() - startTime
+    );
     let errorCode = null;
     if (response.status === 401) {
       try {
@@ -763,7 +1016,12 @@ var HttpClient = class {
       } catch {
       }
     }
-    if (!this.shouldRefreshAccessToken(response.status, errorCode, tokenUsed, options)) {
+    if (!this.shouldRefreshAccessToken(
+      response.status,
+      errorCode,
+      tokenUsed,
+      options
+    )) {
       return response;
     }
     if (tokenUsed !== this.userToken) {
@@ -782,7 +1040,7 @@ var HttpClient = class {
     try {
       newTokenData = await this.refreshAndSaveSession();
     } catch (error) {
-      if (error instanceof InsForgeError && (error.statusCode === 401 || error.statusCode === 403)) {
+      if (error instanceof ResultError && (error.statusCode === 401 || error.statusCode === 403)) {
         this.clearAuthSession();
       }
       throw error;
@@ -827,7 +1085,7 @@ var HttpClient = class {
     const headers = { ...this.defaultHeaders };
     const authToken = this.userToken || this.anonKey;
     if (authToken) {
-      headers["Authorization"] = `Bearer ${authToken}`;
+      headers.Authorization = `Bearer ${authToken}`;
     }
     return headers;
   }
@@ -871,7 +1129,7 @@ var HttpClient = class {
       const refreshed = await this.refreshAndSaveSession();
       return refreshed.accessToken;
     } catch (error) {
-      if (error instanceof InsForgeError && (error.statusCode === 401 || error.statusCode === 403) && this.userToken === accessToken) {
+      if (error instanceof ResultError && (error.statusCode === 401 || error.statusCode === 403) && this.userToken === accessToken) {
         this.clearAuthSession();
       }
       throw error;
@@ -880,7 +1138,10 @@ var HttpClient = class {
   async refreshAndSaveSession() {
     const newTokenData = await this.refreshAccessToken();
     this.setAuthToken(newTokenData.accessToken);
-    this.tokenManager.saveSession(newTokenData, AuthChangeEvent.TOKEN_REFRESHED);
+    this.tokenManager.saveSession(
+      newTokenData,
+      AuthChangeEvent.TOKEN_REFRESHED
+    );
     if (newTokenData.csrfToken) {
       setCsrfToken(newTokenData.csrfToken);
     }
@@ -896,1328 +1157,1404 @@ var HttpClient = class {
     clearCsrfToken();
   }
 };
-var PKCE_VERIFIER_KEY = "insforge_pkce_verifier";
-async function getWebCrypto() {
-  const webCrypto = globalThis.crypto;
-  if (typeof webCrypto?.getRandomValues === "function" && webCrypto.subtle) {
-    return webCrypto;
-  }
-  if (typeof process !== "undefined" && process.versions?.node) {
-    const { webcrypto } = await import("crypto");
-    return webcrypto;
-  }
-  throw new Error("Web Crypto API is not available in this environment");
-}
-function base64UrlEncode(buffer) {
-  const base64 = btoa(String.fromCharCode(...buffer));
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-async function generateCodeVerifier() {
-  const webCrypto = await getWebCrypto();
-  const array = new Uint8Array(32);
-  webCrypto.getRandomValues(array);
-  return base64UrlEncode(array);
-}
-async function generateCodeChallenge(verifier) {
-  const webCrypto = await getWebCrypto();
-  const encoder = new TextEncoder();
-  const data = encoder.encode(verifier);
-  const hash = await webCrypto.subtle.digest("SHA-256", data);
-  return base64UrlEncode(new Uint8Array(hash));
-}
-function storePkceVerifier(verifier) {
-  if (typeof sessionStorage !== "undefined") {
-    sessionStorage.setItem(PKCE_VERIFIER_KEY, verifier);
-  }
-}
-function retrievePkceVerifier() {
-  if (typeof sessionStorage === "undefined") {
-    return null;
-  }
-  const verifier = sessionStorage.getItem(PKCE_VERIFIER_KEY);
-  if (verifier) {
-    sessionStorage.removeItem(PKCE_VERIFIER_KEY);
-  }
-  return verifier;
-}
-function wrapError(error, fallbackMessage) {
-  if (error instanceof InsForgeError) {
-    return { data: null, error };
+
+// src/modules/ai.ts
+var AI = class {
+  chat;
+  images;
+  embeddings;
+  constructor(http) {
+    this.chat = new Chat(http);
+    this.images = new Images(http);
+    this.embeddings = new Embeddings(http);
   }
-  return {
-    data: null,
-    error: new InsForgeError(
-      error instanceof Error ? error.message : fallbackMessage,
-      500,
-      "UNEXPECTED_ERROR"
-    )
-  };
-}
-function cleanUrlParams(...params) {
-  if (typeof window === "undefined") {
-    return;
+};
+var Chat = class {
+  completions;
+  constructor(http) {
+    this.completions = new ChatCompletions(http);
   }
-  const url = new URL(window.location.href);
-  params.forEach((p) => url.searchParams.delete(p));
-  window.history.replaceState({}, document.title, url.toString());
-}
-var Auth = class {
-  constructor(http, tokenManager, options = {}) {
+};
+var ChatCompletions = class {
+  constructor(http) {
     this.http = http;
-    this.tokenManager = tokenManager;
-    this.options = options;
-    this.authCallbackHandled = options.detectOAuthCallback === false ? Promise.resolve() : this.detectAuthCallback();
-  }
-  isServerMode() {
-    return !!this.options.isServerMode;
-  }
-  /** Subscribe to SDK authentication state changes. */
-  onAuthStateChange(callback) {
-    return this.tokenManager.onAuthStateChange(callback);
   }
-  /**
-   * Save session from API response
-   * Handles token storage, CSRF token, and HTTP auth header
-   */
-  saveSessionFromResponse(response, event = AuthChangeEvent.SIGNED_IN) {
-    if (!response.accessToken || !response.user) {
-      return false;
-    }
-    const session = {
-      accessToken: response.accessToken,
-      user: response.user
+  http;
+  async create(params) {
+    const backendParams = {
+      model: params.model,
+      messages: params.messages,
+      temperature: params.temperature,
+      maxTokens: params.maxTokens,
+      topP: params.topP,
+      stream: params.stream,
+      // New plugin options
+      webSearch: params.webSearch,
+      fileParser: params.fileParser,
+      thinking: params.thinking,
+      // Tool calling options
+      tools: params.tools,
+      toolChoice: params.toolChoice,
+      parallelToolCalls: params.parallelToolCalls
     };
-    if (!this.isServerMode() && response.csrfToken) {
-      setCsrfToken(response.csrfToken);
-    }
-    if (!this.isServerMode()) {
-      this.tokenManager.saveSession(session, event);
-    }
-    this.http.setAuthToken(response.accessToken);
-    this.http.setRefreshToken(response.refreshToken ?? null);
-    return true;
-  }
-  // ============================================================================
-  // OAuth Callback Detection (runs on initialization)
-  // ============================================================================
-  /**
-   * Detect and handle OAuth callback parameters in URL
-   * Supports PKCE flow (insforge_code)
-   */
-  async detectAuthCallback() {
-    if (this.isServerMode() || typeof window === "undefined") {
-      return;
-    }
-    try {
-      const params = new URLSearchParams(window.location.search);
-      const error = params.get("error");
-      if (error) {
-        cleanUrlParams("error");
-        console.debug("OAuth callback error:", error);
-        return;
-      }
-      const code = params.get("insforge_code");
-      if (code) {
-        cleanUrlParams("insforge_code");
-        const { error: exchangeError } = await this.exchangeOAuthCode(code);
-        if (exchangeError) {
-          console.debug("OAuth code exchange failed:", exchangeError.message);
+    if (params.stream) {
+      const headers = this.http.getHeaders();
+      headers["Content-Type"] = "application/json";
+      const response2 = await this.http.fetch(
+        `${this.http.baseUrl}/api/ai/chat/completion`,
+        {
+          method: "POST",
+          headers,
+          body: JSON.stringify(backendParams)
         }
-        return;
-      }
-    } catch (error) {
-      console.debug("OAuth callback detection skipped:", error);
-    }
-  }
-  // ============================================================================
-  // Sign Up / Sign In / Sign Out
-  // ============================================================================
-  async signUp(request) {
-    try {
-      const response = await this.http.post(
-        this.isServerMode() ? "/api/auth/users?client_type=mobile" : "/api/auth/users",
-        request,
-        { credentials: "include", skipAuthRefresh: true }
       );
-      if (response.accessToken && response.user) {
-        this.saveSessionFromResponse(response);
-      }
-      if (response.refreshToken) {
-        this.http.setRefreshToken(response.refreshToken);
+      if (!response2.ok) {
+        const error = await response2.json();
+        throw new Error(error.error || "Stream request failed");
       }
-      return { data: response, error: null };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred during sign up");
+      return this.parseSSEStream(response2, params.model);
     }
+    const response = await this.http.post(
+      "/api/ai/chat/completion",
+      backendParams
+    );
+    const content = response.text || "";
+    return {
+      id: `chatcmpl-${Date.now()}`,
+      object: "chat.completion",
+      created: Math.floor(Date.now() / 1e3),
+      model: response.metadata?.model,
+      choices: [
+        {
+          index: 0,
+          message: {
+            role: "assistant",
+            content,
+            // Include tool_calls if present (from tool calling)
+            ...response.tool_calls?.length && {
+              tool_calls: response.tool_calls
+            },
+            // Include annotations if present (from web search or file parsing)
+            ...response.annotations?.length && {
+              annotations: response.annotations
+            }
+          },
+          finish_reason: response.tool_calls?.length ? "tool_calls" : "stop"
+        }
+      ],
+      usage: {
+        prompt_tokens: response.metadata?.usage?.promptTokens || 0,
+        completion_tokens: response.metadata?.usage?.completionTokens || 0,
+        total_tokens: response.metadata?.usage?.totalTokens || 0
+      }
+    };
   }
-  async signInWithPassword(request) {
-    try {
-      const response = await this.http.post(
-        this.isServerMode() ? "/api/auth/sessions?client_type=mobile" : "/api/auth/sessions",
-        request,
-        { credentials: "include", skipAuthRefresh: true }
+  /**
+   * Parse SSE stream into async iterable of OpenAI-like chunks
+   */
+  async *parseSSEStream(response, model) {
+    const reader = response.body?.getReader();
+    if (!reader) {
+      throw new ResultError(
+        "Streaming response has no body",
+        500,
+        "AI_UPSTREAM_UNAVAILABLE"
       );
-      this.saveSessionFromResponse(response);
-      if (response.refreshToken) {
-        this.http.setRefreshToken(response.refreshToken);
-      }
-      return { data: response, error: null };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred during sign in");
     }
-  }
-  async signOut() {
+    const decoder = new TextDecoder();
+    let buffer = "";
     try {
-      try {
-        const serverMode = this.isServerMode();
-        const csrfToken = !serverMode ? getCsrfToken() : null;
-        await this.http.post(
-          serverMode ? "/api/auth/logout?client_type=mobile" : "/api/auth/logout",
-          void 0,
-          {
-            credentials: "include",
-            skipAuthRefresh: true,
-            ...csrfToken ? { headers: { "X-CSRF-Token": csrfToken } } : {}
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) {
+          break;
+        }
+        buffer += decoder.decode(value, { stream: true });
+        const lines = buffer.split("\n");
+        buffer = lines.pop() || "";
+        for (const line of lines) {
+          if (line.startsWith("data: ")) {
+            const dataStr = line.slice(6).trim();
+            if (dataStr) {
+              try {
+                const data = JSON.parse(dataStr);
+                if (data.chunk || data.content) {
+                  yield {
+                    id: `chatcmpl-${Date.now()}`,
+                    object: "chat.completion.chunk",
+                    created: Math.floor(Date.now() / 1e3),
+                    model,
+                    choices: [
+                      {
+                        index: 0,
+                        delta: {
+                          content: data.chunk || data.content
+                        },
+                        finish_reason: null
+                      }
+                    ]
+                  };
+                }
+                if (data.tool_calls?.length) {
+                  yield {
+                    id: `chatcmpl-${Date.now()}`,
+                    object: "chat.completion.chunk",
+                    created: Math.floor(Date.now() / 1e3),
+                    model,
+                    choices: [
+                      {
+                        index: 0,
+                        delta: {
+                          tool_calls: data.tool_calls
+                        },
+                        finish_reason: "tool_calls"
+                      }
+                    ]
+                  };
+                }
+                if (data.done) {
+                  reader.releaseLock();
+                  return;
+                }
+              } catch {
+                console.warn("Failed to parse SSE data:", dataStr);
+              }
+            }
           }
-        );
-      } catch {
-      }
-      this.tokenManager.clearSession();
-      this.http.setAuthToken(null);
-      this.http.setRefreshToken(null);
-      if (!this.isServerMode()) {
-        clearCsrfToken();
-      }
-      return { error: null };
-    } catch {
-      return {
-        error: new InsForgeError("Failed to sign out", 500, "SIGNOUT_ERROR")
-      };
-    }
-  }
-  async signInWithOAuth(providerOrOptions, options) {
-    try {
-      let signInOptions;
-      if (typeof providerOrOptions === "object") {
-        signInOptions = providerOrOptions;
-      } else if (options) {
-        signInOptions = { provider: providerOrOptions, ...options };
-      } else {
-        return {
-          data: {},
-          error: new InsForgeError(
-            "OAuth sign-in options are required",
-            400,
-            ERROR_CODES.INVALID_INPUT
-          )
-        };
-      }
-      if (!signInOptions || !signInOptions.redirectTo) {
-        return {
-          data: {},
-          error: new InsForgeError("Redirect URI is required", 400, ERROR_CODES.INVALID_INPUT)
-        };
-      }
-      const { provider } = signInOptions;
-      const providerKey = encodeURIComponent(provider.toLowerCase());
-      const codeVerifier = await generateCodeVerifier();
-      const codeChallenge = await generateCodeChallenge(codeVerifier);
-      storePkceVerifier(codeVerifier);
-      const params = {
-        ...signInOptions.additionalParams ?? {},
-        redirect_uri: signInOptions.redirectTo,
-        code_challenge: codeChallenge
-      };
-      const isBuiltInProvider = oAuthProvidersSchema.options.includes(
-        providerKey
-      );
-      const oauthPath = isBuiltInProvider ? `/api/auth/oauth/${providerKey}` : `/api/auth/oauth/custom/${providerKey}`;
-      const response = await this.http.get(oauthPath, {
-        params,
-        skipAuthRefresh: true
-      });
-      if (!this.isServerMode() && typeof window !== "undefined" && !signInOptions.skipBrowserRedirect) {
-        window.location.href = response.authUrl;
-        return { data: {}, error: null };
-      }
-      return {
-        data: { url: response.authUrl, provider: providerKey, codeVerifier },
-        error: null
-      };
-    } catch (error) {
-      if (error instanceof InsForgeError) {
-        return { data: {}, error };
+        }
       }
-      return {
-        data: {},
-        error: new InsForgeError(
-          "An unexpected error occurred during OAuth initialization",
-          500,
-          "UNEXPECTED_ERROR"
-        )
-      };
+    } finally {
+      reader.releaseLock();
     }
   }
-  /**
-   * Exchange OAuth authorization code for tokens (PKCE flow)
-   * Called automatically on initialization when insforge_code is in URL
-   */
-  async exchangeOAuthCode(code, codeVerifier) {
-    try {
-      const verifier = codeVerifier ?? retrievePkceVerifier();
-      if (!verifier) {
-        return {
-          data: null,
-          error: new InsForgeError(
-            "PKCE code verifier not found. Ensure signInWithOAuth was called in the same browser session.",
-            400,
-            "PKCE_VERIFIER_MISSING"
-          )
-        };
-      }
-      const request = {
-        code,
-        code_verifier: verifier
-      };
-      const response = await this.http.post(
-        this.isServerMode() ? "/api/auth/oauth/exchange?client_type=mobile" : "/api/auth/oauth/exchange",
-        request,
-        { credentials: "include", skipAuthRefresh: true }
-      );
-      this.saveSessionFromResponse(response);
-      return {
-        data: response,
-        error: null
-      };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred during OAuth code exchange");
-    }
+};
+var Embeddings = class {
+  constructor(http) {
+    this.http = http;
   }
+  http;
   /**
-   * Sign in with an ID token from a native SDK (Google One Tap, etc.)
-   * Use this for native mobile apps or Google One Tap on web.
+   * Create embeddings for text input - OpenAI-like response format
    *
-   * @param credentials.provider - The identity provider (currently only 'google' is supported)
-   * @param credentials.token - The ID token from the native SDK
-   */
-  async signInWithIdToken(credentials) {
-    try {
-      const { provider, token } = credentials;
-      const response = await this.http.post(
-        "/api/auth/id-token?client_type=mobile",
-        { provider, token },
-        { credentials: "include", skipAuthRefresh: true }
-      );
-      this.saveSessionFromResponse(response);
-      if (response.refreshToken) {
-        this.http.setRefreshToken(response.refreshToken);
-      }
-      return {
-        data: response,
-        error: null
-      };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred during ID token sign in");
-    }
-  }
-  // ============================================================================
-  // Session Management
-  // ============================================================================
-  /**
-   * Refresh the current auth session.
+   * @example
+   * ```typescript
+   * // Single text input
+   * const response = await client.ai.embeddings.create({
+   *   model: 'openai/text-embedding-3-small',
+   *   input: 'Hello world'
+   * });
+   * console.log(response.data[0].embedding); // number[]
    *
-   * Browser mode:
-   * - Uses httpOnly refresh cookie and optional CSRF header.
+   * // Multiple text inputs
+   * const response = await client.ai.embeddings.create({
+   *   model: 'openai/text-embedding-3-small',
+   *   input: ['Hello world', 'Goodbye world']
+   * });
+   * response.data.forEach((item, i) => {
+   *   console.log(`Embedding ${i}:`, item.embedding.slice(0, 5)); // First 5 dimensions
+   * });
    *
-   * Legacy server mode (`isServerMode: true`):
-   * - Uses mobile auth flow and requires `refreshToken` in request body.
+   * // With custom dimensions (if supported by model)
+   * const response = await client.ai.embeddings.create({
+   *   model: 'openai/text-embedding-3-small',
+   *   input: 'Hello world',
+   *   dimensions: 256
+   * });
    *
-   * SSR apps should prefer `createRefreshAuthRouter()` / `refreshAuth()` from
-   * `@insforge/sdk/ssr`.
+   * // With base64 encoding format
+   * const response = await client.ai.embeddings.create({
+   *   model: 'openai/text-embedding-3-small',
+   *   input: 'Hello world',
+   *   encoding_format: 'base64'
+   * });
+   * ```
    */
-  async refreshSession(options) {
-    try {
-      if (this.isServerMode() && !options?.refreshToken) {
-        return {
-          data: null,
-          error: new InsForgeError(
-            "refreshToken is required when refreshing session in server mode",
-            400,
-            ERROR_CODES.AUTH_UNAUTHORIZED
-          )
-        };
-      }
-      const csrfToken = !this.isServerMode() ? getCsrfToken() : null;
-      const response = await this.http.post(
-        this.isServerMode() ? "/api/auth/refresh?client_type=mobile" : "/api/auth/refresh",
-        this.isServerMode() ? { refresh_token: options?.refreshToken } : void 0,
-        {
-          headers: csrfToken ? { "X-CSRF-Token": csrfToken } : {},
-          credentials: "include",
-          skipAuthRefresh: true
-        }
-      );
-      if (response.accessToken) {
-        this.saveSessionFromResponse(response, AuthChangeEvent.TOKEN_REFRESHED);
+  async create(params) {
+    const response = await this.http.post(
+      "/api/ai/embeddings",
+      params
+    );
+    return {
+      object: response.object,
+      data: response.data,
+      model: response.metadata?.model,
+      usage: response.metadata?.usage ? {
+        prompt_tokens: response.metadata.usage.promptTokens || 0,
+        total_tokens: response.metadata.usage.totalTokens || 0
+      } : {
+        prompt_tokens: 0,
+        total_tokens: 0
       }
-      return { data: response, error: null };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred during session refresh");
-    }
+    };
+  }
+};
+var Images = class {
+  constructor(http) {
+    this.http = http;
   }
+  http;
   /**
-   * Get current user, automatically waits for pending OAuth callback
+   * Generate images - OpenAI-like response format
+   *
+   * @example
+   * ```typescript
+   * // Text-to-image
+   * const response = await client.ai.images.generate({
+   *   model: 'dall-e-3',
+   *   prompt: 'A sunset over mountains',
+   * });
+   * console.log(response.data[0].b64_json);
+   *
+   * // Image-to-image (with input images)
+   * const response = await client.ai.images.generate({
+   *   model: 'stable-diffusion-xl',
+   *   prompt: 'Transform this into a watercolor painting',
+   *   images: [
+   *     { url: 'https://example.com/input.jpg' },
+   *     // or base64-encoded Data URI:
+   *     { url: 'data:image/jpeg;base64,/9j/4AAQ...' }
+   *   ]
+   * });
+   * ```
    */
-  async getCurrentUser() {
-    await this.authCallbackHandled;
-    try {
-      if (this.isServerMode()) {
-        const accessToken = this.tokenManager.getAccessToken();
-        if (!accessToken) {
-          return { data: { user: null }, error: null };
-        }
-        this.http.setAuthToken(accessToken);
-        const response = await this.http.get("/api/auth/sessions/current");
-        const user = response.user ?? null;
-        return { data: { user }, error: null };
-      }
-      const session = this.tokenManager.getSession();
-      if (session) {
-        this.http.setAuthToken(session.accessToken);
-        return { data: { user: session.user }, error: null };
-      }
-      if (typeof window !== "undefined") {
-        const { data: refreshed, error: refreshError } = await this.refreshSession();
-        if (refreshError) {
-          return { data: { user: null }, error: refreshError };
-        }
-        if (refreshed?.accessToken) {
-          return { data: { user: refreshed.user ?? null }, error: null };
+  async generate(params) {
+    const response = await this.http.post(
+      "/api/ai/image/generation",
+      params
+    );
+    let data = [];
+    if (response.images && response.images.length > 0) {
+      data = response.images.map((img) => ({
+        b64_json: img.imageUrl.replace(/^data:image\/\w+;base64,/, ""),
+        content: response.text
+      }));
+    } else if (response.text) {
+      data = [{ content: response.text }];
+    }
+    return {
+      created: Math.floor(Date.now() / 1e3),
+      data,
+      ...response.metadata?.usage && {
+        usage: {
+          total_tokens: response.metadata.usage.totalTokens || 0,
+          input_tokens: response.metadata.usage.promptTokens || 0,
+          output_tokens: response.metadata.usage.completionTokens || 0
         }
       }
-      return { data: { user: null }, error: null };
-    } catch (error) {
-      if (error instanceof InsForgeError) {
-        return { data: { user: null }, error };
-      }
-      return {
-        data: { user: null },
-        error: new InsForgeError(
-          "An unexpected error occurred while getting user",
-          500,
-          "UNEXPECTED_ERROR"
-        )
-      };
+    };
+  }
+};
+
+// src/modules/analytics.ts
+var DEFAULT_ENDPOINT = "https://beta.result.dev/api/wa";
+var IDLE_MS = 30 * 60 * 1e3;
+var Analytics = class {
+  siteId;
+  endpoint;
+  options;
+  active = false;
+  lastUrl = null;
+  left = false;
+  referrer = "";
+  // localStorage with an in-memory fallback for private-mode browsers.
+  mem = {};
+  constructor(options) {
+    this.options = options ?? { siteId: "" };
+    this.siteId = this.options.siteId ?? "";
+    this.endpoint = this.options.endpoint || DEFAULT_ENDPOINT;
+    if (!this.siteId || typeof window === "undefined" || navigator.webdriver) {
+      return;
+    }
+    if (window.rwa) {
+      return;
+    }
+    if (this.read("rwa_disable") === "1") {
+      return;
+    }
+    const domains = (this.options.domains ?? []).map(
+      (domain) => domain.trim().toLowerCase().replace(/^www\./, "")
+    ).filter(Boolean);
+    const here = location.hostname.toLowerCase().replace(/^www\./, "");
+    if (domains.length && domains.indexOf(here) === -1) {
+      return;
+    }
+    this.active = true;
+    this.referrer = document.referrer || "";
+    window.rwa = {
+      track: (name, props) => this.track(name, props),
+      identify: (id) => this.identify(id)
+    };
+    const doc = document;
+    if (doc.prerendering) {
+      document.addEventListener("prerenderingchange", () => this.start(), {
+        once: true
+      });
+    } else {
+      this.start();
     }
   }
-  // ============================================================================
-  // Profile Management
-  // ============================================================================
-  async getProfile(userId) {
-    try {
-      const response = await this.http.get(`/api/auth/profiles/${userId}`);
-      return { data: response, error: null };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred while fetching user profile");
+  /** Send a custom event. No-op outside the browser or when inactive. */
+  track(name, props) {
+    if (!this.active || typeof name !== "string" || !name) {
+      return;
+    }
+    const event = {
+      e: "ev",
+      n: name.slice(0, 64),
+      dt: document.title
+    };
+    if (props && typeof props === "object") {
+      event.p = props;
     }
+    this.post(event);
   }
-  async setProfile(profile) {
-    try {
-      const response = await this.http.patch("/api/auth/profiles/current", {
-        profile
-      });
-      const currentUser = this.tokenManager.getUser();
-      if (!this.isServerMode() && currentUser && response.profile !== void 0) {
-        this.tokenManager.setUser({
-          ...currentUser,
-          profile: response.profile
-        });
-      }
-      return { data: response, error: null };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred while updating user profile");
+  /** Attach your own user id to subsequent events. */
+  identify(id) {
+    if (!this.active || typeof id !== "string" || !id) {
+      return;
     }
+    this.write("rwa_uid", id.slice(0, 64));
   }
-  // ============================================================================
-  // Email Verification
-  // ============================================================================
-  async resendVerificationEmail(request) {
+  // -- internals -------------------------------------------------------------
+  read(key) {
     try {
-      const response = await this.http.post("/api/auth/email/send-verification", request, {
-        skipAuthRefresh: true
-      });
-      return { data: response, error: null };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred while sending verification email");
+      return localStorage.getItem(key) || this.mem[key] || "";
+    } catch {
+      return this.mem[key] || "";
     }
   }
-  async verifyEmail(request) {
+  write(key, value) {
+    this.mem[key] = value;
     try {
-      const response = await this.http.post(
-        this.isServerMode() ? "/api/auth/email/verify?client_type=mobile" : "/api/auth/email/verify",
-        request,
-        { credentials: "include", skipAuthRefresh: true }
-      );
-      this.saveSessionFromResponse(response);
-      if (response.refreshToken) {
-        this.http.setRefreshToken(response.refreshToken);
-      }
-      return { data: response, error: null };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred while verifying email");
+      localStorage.setItem(key, value);
+    } catch {
     }
   }
-  // ============================================================================
-  // Password Reset
-  // ============================================================================
-  async sendResetPasswordEmail(request) {
-    try {
-      const response = await this.http.post("/api/auth/email/send-reset-password", request, {
-        skipAuthRefresh: true
+  visitor() {
+    let visitor = this.read("rwa_id");
+    if (!visitor) {
+      visitor = uuid4();
+      this.write("rwa_id", visitor);
+    }
+    return visitor;
+  }
+  session() {
+    const parts = this.read("rwa_s").split(".");
+    let id = parts[0];
+    const last = Number(parts[1]) || 0;
+    const now = Date.now();
+    if (!id || now - last > IDLE_MS) {
+      id = uuid7();
+    }
+    this.write("rwa_s", `${id}.${now}`);
+    return id;
+  }
+  pageUrl() {
+    let url = location.href;
+    if (this.options.excludeHash) {
+      url = url.split("#")[0];
+    }
+    if (this.options.excludeSearch) {
+      const hash = this.options.excludeHash ? "" : url.split("#")[1] || "";
+      url = url.split("#")[0].split("?")[0] + (hash ? `#${hash}` : "");
+    }
+    return url.slice(0, 4096);
+  }
+  post(event) {
+    event.u = event.u || this.pageUrl();
+    event.d = this.visitor();
+    event.s = this.session();
+    event.t = Date.now();
+    event.w = innerWidth;
+    event.h = innerHeight;
+    event.sw = screen.width;
+    event.sh = screen.height;
+    const uid = this.read("rwa_uid");
+    if (uid) {
+      event.uid = uid;
+    }
+    const body = JSON.stringify({ site: this.siteId, events: [event] });
+    if (!navigator.sendBeacon?.(this.endpoint, body)) {
+      fetch(this.endpoint, {
+        method: "POST",
+        body,
+        keepalive: true,
+        mode: "no-cors"
+      }).catch(() => {
       });
-      return { data: response, error: null };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred while sending password reset email");
     }
   }
-  async exchangeResetPasswordToken(request) {
-    try {
-      const response = await this.http.post(
-        "/api/auth/email/exchange-reset-password-token",
-        request,
-        { skipAuthRefresh: true }
-      );
-      return { data: response, error: null };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred while verifying reset code");
+  pageview() {
+    const url = this.pageUrl();
+    if (url === this.lastUrl) {
+      return;
     }
+    const from = this.lastUrl ? this.lastUrl : this.referrer;
+    this.lastUrl = url;
+    this.left = false;
+    this.post({ e: "pv", u: url, r: from, dt: document.title });
   }
-  async resetPassword(request) {
-    try {
-      const response = await this.http.post(
-        "/api/auth/email/reset-password",
-        request,
-        { skipAuthRefresh: true }
-      );
-      return { data: response, error: null };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred while resetting password");
+  pageleave() {
+    if (this.left || !this.lastUrl) {
+      return;
     }
+    this.left = true;
+    this.post({ e: "pl", u: this.lastUrl });
   }
-  // ============================================================================
-  // Configuration
-  // ============================================================================
-  async getPublicAuthConfig() {
-    try {
-      const response = await this.http.get("/api/auth/public-config", {
-        skipAuthRefresh: true
+  start() {
+    const onNav = () => {
+      setTimeout(() => this.pageview(), 0);
+    };
+    if (this.options.autoTrack !== false) {
+      const push = history.pushState;
+      const replace = history.replaceState;
+      history.pushState = function(...args) {
+        push.apply(this, args);
+        onNav();
+      };
+      history.replaceState = function(...args) {
+        replace.apply(this, args);
+        onNav();
+      };
+      addEventListener("popstate", onNav);
+      addEventListener("hashchange", onNav);
+      addEventListener("pageshow", (event) => {
+        if (event.persisted) {
+          this.lastUrl = null;
+          this.pageview();
+        }
       });
-      return { data: response, error: null };
-    } catch (error) {
-      return wrapError(error, "An unexpected error occurred while fetching auth configuration");
+      this.pageview();
     }
+    addEventListener("pagehide", () => this.pageleave());
+    document.addEventListener("visibilitychange", () => {
+      if (document.visibilityState === "hidden") {
+        this.pageleave();
+      } else {
+        this.left = false;
+      }
+    });
+    document.addEventListener(
+      "click",
+      (clickEvent) => {
+        const source = clickEvent.target;
+        const target = source?.closest ? source.closest("[data-wa-event]") : null;
+        if (!target) {
+          return;
+        }
+        const name = target.getAttribute("data-wa-event");
+        if (!name) {
+          return;
+        }
+        const props = {};
+        let any = false;
+        for (const attr of Array.from(target.attributes)) {
+          if (attr.name.indexOf("data-wa-event-") === 0) {
+            props[attr.name.slice(14)] = attr.value;
+            any = true;
+          }
+        }
+        this.track(name, any ? props : void 0);
+      },
+      true
+    );
   }
 };
-function createInsForgePostgrestFetch(httpClient) {
-  return async (input, init) => {
-    const url = typeof input === "string" ? input : input.toString();
-    const urlObj = new URL(url);
-    const pathname = urlObj.pathname.slice(1);
-    const rpcMatch = pathname.match(/^rpc\/(.+)$/);
-    const endpoint = rpcMatch ? `/api/database/rpc/${rpcMatch[1]}` : `/api/database/records/${pathname}`;
-    const insforgeUrl = `${httpClient.baseUrl}${endpoint}${urlObj.search}`;
-    const headers = new Headers(httpClient.getHeaders());
-    new Headers(init?.headers).forEach((value, key) => {
-      headers.set(key, value);
-    });
-    const response = await httpClient.rawFetch(insforgeUrl, {
-      ...init,
-      headers
-    });
-    return response;
-  };
+function bytes() {
+  const b = new Uint8Array(16);
+  crypto.getRandomValues(b);
+  return b;
 }
-var Database = class {
-  constructor(httpClient, defaultSchema) {
-    this.postgrest = new PostgrestClient("http://dummy", {
-      fetch: createInsForgePostgrestFetch(httpClient),
-      headers: {},
-      ...defaultSchema ? { schema: defaultSchema } : {}
-    });
+function format(b, version) {
+  b[6] = b[6] & 15 | version << 4;
+  b[8] = b[8] & 63 | 128;
+  let hex = "";
+  for (let i = 0; i < 16; i++) {
+    hex += (b[i] + 256).toString(16).slice(1);
+    if (i === 3 || i === 5 || i === 7 || i === 9) hex += "-";
+  }
+  return hex;
+}
+function uuid4() {
+  return format(bytes(), 4);
+}
+function uuid7() {
+  const b = bytes();
+  let t = Date.now();
+  for (let i = 5; i >= 0; i--) {
+    b[i] = t & 255;
+    t = Math.floor(t / 256);
+  }
+  return format(b, 7);
+}
+
+// src/types/api.ts
+var ERROR_CODE_VALUES = [
+  // Auth
+  "AUTH_INVALID_EMAIL",
+  "AUTH_WEAK_PASSWORD",
+  "AUTH_INVALID_CREDENTIALS",
+  "AUTH_INVALID_API_KEY",
+  "AUTH_EMAIL_EXISTS",
+  "AUTH_USER_NOT_FOUND",
+  "AUTH_OAUTH_CONFIG_ALREADY_EXISTS",
+  "AUTH_OAUTH_CONFIG_ERROR",
+  "AUTH_OAUTH_CONFIG_NOT_FOUND",
+  "AUTH_UNSUPPORTED_PROVIDER",
+  "AUTH_TOKEN_EXPIRED",
+  "AUTH_UNAUTHORIZED",
+  "AUTH_NEED_VERIFICATION",
+  "AUTH_SIGNUP_DISABLED",
+  "AUTH_VERIFICATION_EMAIL_DELIVERY_FAILED",
+  // Database
+  "DATABASE_INVALID_PARAMETER",
+  "DATABASE_VALIDATION_ERROR",
+  "DATABASE_CONSTRAINT_VIOLATION",
+  "DATABASE_NOT_FOUND",
+  "DATABASE_DUPLICATE",
+  "DATABASE_MIGRATION_ALREADY_EXISTS",
+  "DATABASE_PERMISSION_DENIED",
+  "DATABASE_INTERNAL_ERROR",
+  "DATABASE_FORBIDDEN",
+  // Storage
+  "STORAGE_ALREADY_EXISTS",
+  "STORAGE_INVALID_PARAMETER",
+  "STORAGE_INVALID_FILE_TYPE",
+  "STORAGE_INSUFFICIENT_QUOTA",
+  "STORAGE_NOT_FOUND",
+  "STORAGE_PERMISSION_DENIED",
+  "S3_ACCESS_KEY_LIMIT_EXCEEDED",
+  "S3_ACCESS_KEY_NOT_FOUND",
+  "S3_PROTOCOL_UNAVAILABLE",
+  // Realtime
+  "REALTIME_CHANNEL_NOT_FOUND",
+  "REALTIME_CONNECTION_FAILED",
+  "REALTIME_INVALID_CHANNEL_REQUEST",
+  "REALTIME_INVALID_CHANNEL_PATTERN",
+  "REALTIME_INVALID_EVENT",
+  "REALTIME_NOT_SUBSCRIBED",
+  "REALTIME_UNAUTHORIZED",
+  // AI
+  "AI_INVALID_API_KEY",
+  "AI_INVALID_MODEL",
+  "AI_UPSTREAM_UNAVAILABLE",
+  // Analytics
+  "ANALYTICS_NOT_CONNECTED",
+  "ANALYTICS_UNAVAILABLE",
+  // Logs
+  "LOGS_AWS_NOT_CONFIGURED",
+  "LOG_NOT_FOUND",
+  // Compute
+  "COMPUTE_CLOUD_UNAVAILABLE",
+  "COMPUTE_NOT_CONFIGURED",
+  "COMPUTE_PROVIDER_ERROR",
+  "COMPUTE_SERVICE_NOT_FOUND",
+  "COMPUTE_MACHINE_NOT_FOUND",
+  "COMPUTE_SERVICE_NOT_CONFIGURED",
+  "COMPUTE_SERVICE_DEPLOY_FAILED",
+  "COMPUTE_SERVICE_ALREADY_EXISTS",
+  "COMPUTE_SERVICE_START_FAILED",
+  "COMPUTE_SERVICE_STOP_FAILED",
+  "COMPUTE_SERVICE_DELETE_FAILED",
+  "COMPUTE_REGION_CHANGE_NOT_SUPPORTED",
+  "COMPUTE_QUOTA_EXCEEDED",
+  // Billing
+  "BILLING_INSUFFICIENT_BALANCE",
+  // Email
+  "EMAIL_PROVIDER_NOT_CONFIGURED",
+  "EMAIL_SMTP_CONNECTION_FAILED",
+  "EMAIL_SMTP_SEND_FAILED",
+  "EMAIL_TEMPLATE_NOT_FOUND",
+  // Deployments
+  "DEPLOYMENT_ALREADY_EXISTS",
+  "DEPLOYMENT_INVALID_FILE",
+  "DEPLOYMENT_NOT_FOUND",
+  "DEPLOYMENT_UPLOAD_CANCELED",
+  "DOMAIN_ALREADY_EXISTS",
+  "DOMAIN_INVALID",
+  "DOMAIN_NOT_FOUND",
+  "ENVIRONMENT_VARIABLE_NOT_FOUND",
+  // Docs
+  "DOCS_NOT_FOUND",
+  // Functions
+  "FUNCTION_ALREADY_EXISTS",
+  "FUNCTION_DEPLOYMENT_NOT_FOUND",
+  "FUNCTION_NOT_FOUND",
+  // Schedules
+  "SCHEDULE_INVALID_CRON",
+  "SCHEDULE_NOT_FOUND",
+  // Payments
+  "PAYMENT_CHECKOUT_ALREADY_EXISTS",
+  "PAYMENT_CONFIG_INVALID",
+  "PAYMENT_CONFIG_NOT_FOUND",
+  "PAYMENT_NOT_FOUND",
+  "PAYMENT_METHOD_DECLINED",
+  "PAYMENT_PRICE_NOT_FOUND",
+  "PAYMENT_PRODUCT_NOT_FOUND",
+  // Secrets
+  "SECRET_ALREADY_EXISTS",
+  "SECRET_NOT_FOUND",
+  // General
+  "MISSING_FIELD",
+  "ALREADY_EXISTS",
+  "INVALID_INPUT",
+  "NOT_FOUND",
+  "UNKNOWN_ERROR",
+  "INTERNAL_ERROR",
+  "TOO_MANY_REQUESTS",
+  "FORBIDDEN",
+  "RATE_LIMITED",
+  "NOT_IMPLEMENTED",
+  "UPSTREAM_FAILURE"
+];
+var ERROR_CODES = Object.fromEntries(
+  ERROR_CODE_VALUES.map((code) => [code, code])
+);
+var OAUTH_PROVIDERS = [
+  "google",
+  "github",
+  "discord",
+  "linkedin",
+  "facebook",
+  "instagram",
+  "tiktok",
+  "apple",
+  "x",
+  "spotify",
+  "microsoft"
+];
+
+// src/modules/auth/helpers.ts
+var PKCE_VERIFIER_KEY = "result_pkce_verifier";
+async function getWebCrypto() {
+  const webCrypto = globalThis.crypto;
+  if (typeof webCrypto?.getRandomValues === "function" && webCrypto.subtle) {
+    return webCrypto;
   }
-  /**
-   * Select a non-default Postgres schema for the chained query. Maps to
-   * PostgREST's `Accept-Profile` (reads) / `Content-Profile` (writes) header.
-   * The schema must be exposed by the backend.
-   *
-   * @example
-   * const { data } = await client.database
-   *   .schema('analytics')
-   *   .from('events')
-   *   .select('*');
-   *
-   * @example
-   * await client.database.schema('analytics').rpc('rollup', { day: '2026-01-01' });
-   */
-  schema(schemaName) {
-    return this.postgrest.schema(schemaName);
+  if (typeof process !== "undefined" && process.versions?.node) {
+    const { webcrypto } = await import("crypto");
+    return webcrypto;
   }
-  /**
-   * Create a query builder for a table
-   *
-   * @example
-   * // Basic query
-   * const { data, error } = await client.database
-   *   .from('posts')
-   *   .select('*')
-   *   .eq('user_id', userId);
-   *
-   * // With count (Supabase style!)
-   * const { data, error, count } = await client.database
-   *   .from('posts')
-   *   .select('*', { count: 'exact' })
-   *   .range(0, 9);
-   *
-   * // Just get count, no data
-   * const { count } = await client.database
-   *   .from('posts')
-   *   .select('*', { count: 'exact', head: true });
-   *
-   * // Complex queries with OR
-   * const { data } = await client.database
-   *   .from('posts')
-   *   .select('*, users!inner(*)')
-   *   .or('status.eq.active,status.eq.pending');
-   *
-   * // All features work:
-   * - Nested selects
-   * - Foreign key expansion
-   * - OR/AND/NOT conditions
-   * - Count with head
-   * - Range pagination
-   * - Upserts
-   */
-  from(table) {
-    return this.postgrest.from(table);
+  throw new Error("Web Crypto API is not available in this environment");
+}
+function base64UrlEncode(buffer) {
+  const base64 = btoa(String.fromCharCode(...buffer));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function generateCodeVerifier() {
+  const webCrypto = await getWebCrypto();
+  const array = new Uint8Array(32);
+  webCrypto.getRandomValues(array);
+  return base64UrlEncode(array);
+}
+async function generateCodeChallenge(verifier) {
+  const webCrypto = await getWebCrypto();
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const hash = await webCrypto.subtle.digest("SHA-256", data);
+  return base64UrlEncode(new Uint8Array(hash));
+}
+function storePkceVerifier(verifier) {
+  if (typeof sessionStorage !== "undefined") {
+    sessionStorage.setItem(PKCE_VERIFIER_KEY, verifier);
+  }
+}
+function retrievePkceVerifier() {
+  if (typeof sessionStorage === "undefined") {
+    return null;
+  }
+  const verifier = sessionStorage.getItem(PKCE_VERIFIER_KEY);
+  if (verifier) {
+    sessionStorage.removeItem(PKCE_VERIFIER_KEY);
+  }
+  return verifier;
+}
+function wrapError(error, fallbackMessage) {
+  if (error instanceof ResultError) {
+    return { data: null, error };
   }
-  /**
-   * Call a PostgreSQL function (RPC)
-   *
-   * @example
-   * // Call a function with parameters
-   * const { data, error } = await client.database
-   *   .rpc('get_user_stats', { user_id: 123 });
-   *
-   * // Call a function with no parameters
-   * const { data, error } = await client.database
-   *   .rpc('get_all_active_users');
-   *
-   * // With options (head, count, get)
-   * const { data, count } = await client.database
-   *   .rpc('search_posts', { query: 'hello' }, { count: 'exact' });
-   */
-  rpc(fn, args, options) {
-    return this.postgrest.rpc(fn, args, options);
+  return {
+    data: null,
+    error: new ResultError(
+      error instanceof Error ? error.message : fallbackMessage,
+      500,
+      "UNEXPECTED_ERROR"
+    )
+  };
+}
+function cleanUrlParams(...params) {
+  if (typeof window === "undefined") {
+    return;
   }
-};
-var StorageBucket = class {
-  constructor(bucketName, http) {
-    this.bucketName = bucketName;
+  const url = new URL(window.location.href);
+  for (const p of params) {
+    url.searchParams.delete(p);
+  }
+  window.history.replaceState({}, document.title, url.toString());
+}
+
+// src/modules/auth/auth.ts
+var Auth = class {
+  constructor(http, tokenManager, options = {}) {
     this.http = http;
+    this.tokenManager = tokenManager;
+    this.options = options;
+    this.authCallbackHandled = options.detectOAuthCallback === false ? Promise.resolve() : this.detectAuthCallback();
+  }
+  http;
+  tokenManager;
+  options;
+  authCallbackHandled;
+  isServerMode() {
+    return !!this.options.isServerMode;
+  }
+  /** Subscribe to SDK authentication state changes. */
+  onAuthStateChange(callback) {
+    return this.tokenManager.onAuthStateChange(callback);
   }
   /**
-   * Upload a file with a specific key
-   * Uses the upload strategy from backend (direct or presigned)
-   * @param path - The object key/path
-   * @param file - File or Blob to upload
+   * Save session from API response
+   * Handles token storage, CSRF token, and HTTP auth header
    */
-  async upload(path, file) {
+  saveSessionFromResponse(response, event = AuthChangeEvent.SIGNED_IN) {
+    if (!response.accessToken || !response.user) {
+      return false;
+    }
+    const session = {
+      accessToken: response.accessToken,
+      user: response.user
+    };
+    if (!this.isServerMode() && response.csrfToken) {
+      setCsrfToken(response.csrfToken);
+    }
+    if (!this.isServerMode()) {
+      this.tokenManager.saveSession(session, event);
+    }
+    this.http.setAuthToken(response.accessToken);
+    this.http.setRefreshToken(response.refreshToken ?? null);
+    return true;
+  }
+  // ============================================================================
+  // OAuth Callback Detection (runs on initialization)
+  // ============================================================================
+  /**
+   * Detect and handle OAuth callback parameters in URL
+   * Supports the PKCE flow (OAuth callback code in the URL)
+   */
+  async detectAuthCallback() {
+    if (this.isServerMode() || typeof window === "undefined") {
+      return;
+    }
     try {
-      const strategyResponse = await this.http.post(
-        `/api/storage/buckets/${this.bucketName}/upload-strategy`,
-        {
-          filename: path,
-          contentType: file.type || "application/octet-stream",
-          size: file.size
+      const params = new URLSearchParams(window.location.search);
+      const error = params.get("error");
+      if (error) {
+        cleanUrlParams("error");
+        console.debug("OAuth callback error:", error);
+        return;
+      }
+      const code = params.get("insforge_code");
+      if (code) {
+        cleanUrlParams("insforge_code");
+        const { error: exchangeError } = await this.exchangeOAuthCode(code);
+        if (exchangeError) {
+          console.debug("OAuth code exchange failed:", exchangeError.message);
         }
+        return;
+      }
+    } catch (error) {
+      console.debug("OAuth callback detection skipped:", error);
+    }
+  }
+  // ============================================================================
+  // Sign Up / Sign In / Sign Out
+  // ============================================================================
+  async signUp(request) {
+    try {
+      const response = await this.http.post(
+        this.isServerMode() ? "/api/auth/users?client_type=mobile" : "/api/auth/users",
+        request,
+        { credentials: "include", skipAuthRefresh: true }
       );
-      if (strategyResponse.method === "presigned") {
-        return await this.uploadWithPresignedUrl(strategyResponse, file);
+      if (response.accessToken && response.user) {
+        this.saveSessionFromResponse(response);
       }
-      if (strategyResponse.method === "direct") {
-        const formData = new FormData();
-        formData.append("file", file);
-        const response = await this.http.request(
-          "PUT",
-          `/api/storage/buckets/${this.bucketName}/objects/${encodeURIComponent(path)}`,
-          {
-            body: formData,
-            headers: {
-              // Don't set Content-Type, let browser set multipart boundary
-            }
-          }
-        );
-        return { data: response, error: null };
+      if (response.refreshToken) {
+        this.http.setRefreshToken(response.refreshToken);
       }
-      throw new InsForgeError(
-        `Unsupported upload method: ${strategyResponse.method}`,
-        500,
-        "STORAGE_ERROR"
-      );
+      return { data: response, error: null };
     } catch (error) {
-      return {
-        data: null,
-        error: error instanceof InsForgeError ? error : new InsForgeError("Upload failed", 500, "STORAGE_ERROR")
-      };
+      return wrapError(error, "An unexpected error occurred during sign up");
     }
   }
-  /**
-   * Upload a file with auto-generated key
-   * Uses the upload strategy from backend (direct or presigned)
-   * @param file - File or Blob to upload
-   */
-  async uploadAuto(file) {
+  async signInWithPassword(request) {
     try {
-      const filename = file instanceof File ? file.name : "file";
-      const strategyResponse = await this.http.post(
-        `/api/storage/buckets/${this.bucketName}/upload-strategy`,
-        {
-          filename,
-          contentType: file.type || "application/octet-stream",
-          size: file.size
-        }
+      const response = await this.http.post(
+        this.isServerMode() ? "/api/auth/sessions?client_type=mobile" : "/api/auth/sessions",
+        request,
+        { credentials: "include", skipAuthRefresh: true }
       );
-      if (strategyResponse.method === "presigned") {
-        return await this.uploadWithPresignedUrl(strategyResponse, file);
+      this.saveSessionFromResponse(response);
+      if (response.refreshToken) {
+        this.http.setRefreshToken(response.refreshToken);
       }
-      if (strategyResponse.method === "direct") {
-        const formData = new FormData();
-        formData.append("file", file);
-        const response = await this.http.request(
-          "POST",
-          `/api/storage/buckets/${this.bucketName}/objects`,
+      return { data: response, error: null };
+    } catch (error) {
+      return wrapError(error, "An unexpected error occurred during sign in");
+    }
+  }
+  async signOut() {
+    try {
+      try {
+        const serverMode = this.isServerMode();
+        const csrfToken = !serverMode ? getCsrfToken() : null;
+        await this.http.post(
+          serverMode ? "/api/auth/logout?client_type=mobile" : "/api/auth/logout",
+          void 0,
           {
-            body: formData,
-            headers: {
-              // Don't set Content-Type, let browser set multipart boundary
-            }
+            credentials: "include",
+            skipAuthRefresh: true,
+            ...csrfToken ? { headers: { "X-CSRF-Token": csrfToken } } : {}
           }
         );
-        return { data: response, error: null };
+      } catch {
       }
-      throw new InsForgeError(
-        `Unsupported upload method: ${strategyResponse.method}`,
-        500,
-        "STORAGE_ERROR"
-      );
-    } catch (error) {
+      this.tokenManager.clearSession();
+      this.http.setAuthToken(null);
+      this.http.setRefreshToken(null);
+      if (!this.isServerMode()) {
+        clearCsrfToken();
+      }
+      return { error: null };
+    } catch {
       return {
-        data: null,
-        error: error instanceof InsForgeError ? error : new InsForgeError("Upload failed", 500, "STORAGE_ERROR")
+        error: new ResultError("Failed to sign out", 500, "SIGNOUT_ERROR")
       };
     }
   }
-  /**
-   * Internal method to handle presigned URL uploads
-   */
-  async uploadWithPresignedUrl(strategy, file) {
+  async signInWithOAuth(providerOrOptions, options) {
     try {
-      const formData = new FormData();
-      if (strategy.fields) {
-        Object.entries(strategy.fields).forEach(([key, value]) => {
-          formData.append(key, value);
-        });
+      let signInOptions;
+      if (typeof providerOrOptions === "object") {
+        signInOptions = providerOrOptions;
+      } else if (options) {
+        signInOptions = { provider: providerOrOptions, ...options };
+      } else {
+        return {
+          data: {},
+          error: new ResultError(
+            "OAuth sign-in options are required",
+            400,
+            ERROR_CODES.INVALID_INPUT
+          )
+        };
       }
-      formData.append("file", file);
-      const uploadResponse = await fetch(strategy.uploadUrl, {
-        method: "POST",
-        body: formData
+      if (!signInOptions || !signInOptions.redirectTo) {
+        return {
+          data: {},
+          error: new ResultError(
+            "Redirect URI is required",
+            400,
+            ERROR_CODES.INVALID_INPUT
+          )
+        };
+      }
+      const { provider } = signInOptions;
+      const providerKey = encodeURIComponent(provider.toLowerCase());
+      const codeVerifier = await generateCodeVerifier();
+      const codeChallenge = await generateCodeChallenge(codeVerifier);
+      storePkceVerifier(codeVerifier);
+      const params = {
+        ...signInOptions.additionalParams ?? {},
+        redirect_uri: signInOptions.redirectTo,
+        code_challenge: codeChallenge
+      };
+      const isBuiltInProvider = OAUTH_PROVIDERS.includes(
+        providerKey
+      );
+      const oauthPath = isBuiltInProvider ? `/api/auth/oauth/${providerKey}` : `/api/auth/oauth/custom/${providerKey}`;
+      const response = await this.http.get(oauthPath, {
+        params,
+        skipAuthRefresh: true
       });
-      if (!uploadResponse.ok) {
-        throw new InsForgeError(
-          `Upload to storage failed: ${uploadResponse.statusText}`,
-          uploadResponse.status,
-          "STORAGE_ERROR"
-        );
-      }
-      if (strategy.confirmRequired && strategy.confirmUrl) {
-        const confirmResponse = await this.http.post(strategy.confirmUrl, {
-          size: file.size,
-          contentType: file.type || "application/octet-stream"
-        });
-        return { data: confirmResponse, error: null };
+      if (!this.isServerMode() && typeof window !== "undefined" && !signInOptions.skipBrowserRedirect) {
+        window.location.href = response.authUrl;
+        return { data: {}, error: null };
       }
       return {
-        data: {
-          key: strategy.key,
-          bucket: this.bucketName,
-          size: file.size,
-          mimeType: file.type || "application/octet-stream",
-          uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          url: this.getPublicUrl(strategy.key).data.publicUrl
-        },
+        data: { url: response.authUrl, provider: providerKey, codeVerifier },
         error: null
       };
     } catch (error) {
-      throw error instanceof InsForgeError ? error : new InsForgeError("Presigned upload failed", 500, "STORAGE_ERROR");
+      if (error instanceof ResultError) {
+        return { data: {}, error };
+      }
+      return {
+        data: {},
+        error: new ResultError(
+          "An unexpected error occurred during OAuth initialization",
+          500,
+          "UNEXPECTED_ERROR"
+        )
+      };
     }
   }
   /**
-   * Download a file
-   * Uses the download strategy from backend (direct or presigned)
-   * @param path - The object key/path
-   * Returns the file as a Blob
+   * Exchange OAuth authorization code for tokens (PKCE flow)
+   * Called automatically on initialization when the OAuth callback code is in the URL
    */
-  async download(path) {
+  async exchangeOAuthCode(code, codeVerifier) {
     try {
-      const encodedKey = encodeURIComponent(path);
-      let strategyResponse;
-      try {
-        strategyResponse = await this.http.get(
-          `/api/storage/buckets/${this.bucketName}/download-strategy/objects/${encodedKey}`
-        );
-      } catch (err) {
-        const status = err instanceof InsForgeError ? err.statusCode : void 0;
-        if (status === 404 || status === 405) {
-          strategyResponse = await this.http.post(
-            `/api/storage/buckets/${this.bucketName}/objects/${encodedKey}/download-strategy`,
-            {}
-          );
-        } else {
-          throw err;
-        }
-      }
-      const downloadUrl = strategyResponse.url;
-      const headers = {};
-      if (strategyResponse.method === "direct") {
-        Object.assign(headers, this.http.getHeaders());
-      }
-      const response = await fetch(downloadUrl, {
-        method: "GET",
-        headers
-      });
-      if (!response.ok) {
-        try {
-          const error = await response.json();
-          throw InsForgeError.fromApiError(error);
-        } catch {
-          throw new InsForgeError(
-            `Download failed: ${response.statusText}`,
-            response.status,
-            "STORAGE_ERROR"
-          );
-        }
+      const verifier = codeVerifier ?? retrievePkceVerifier();
+      if (!verifier) {
+        return {
+          data: null,
+          error: new ResultError(
+            "PKCE code verifier not found. Ensure signInWithOAuth was called in the same browser session.",
+            400,
+            "PKCE_VERIFIER_MISSING"
+          )
+        };
       }
-      const blob = await response.blob();
-      return { data: blob, error: null };
-    } catch (error) {
+      const request = {
+        code,
+        code_verifier: verifier
+      };
+      const response = await this.http.post(
+        this.isServerMode() ? "/api/auth/oauth/exchange?client_type=mobile" : "/api/auth/oauth/exchange",
+        request,
+        { credentials: "include", skipAuthRefresh: true }
+      );
+      this.saveSessionFromResponse(response);
       return {
-        data: null,
-        error: error instanceof InsForgeError ? error : new InsForgeError("Download failed", 500, "STORAGE_ERROR")
+        data: response,
+        error: null
       };
+    } catch (error) {
+      return wrapError(
+        error,
+        "An unexpected error occurred during OAuth code exchange"
+      );
     }
   }
   /**
-   * Get the public URL for an object in a public bucket.
-   *
-   * Pure string construction — no network call, no auth. The URL only resolves
-   * if the bucket is public; for private objects use {@link createSignedUrl}.
+   * Sign in with an ID token from a native SDK (Google One Tap, etc.)
+   * Use this for native mobile apps or Google One Tap on web.
    *
-   * @param path - The object key/path
-   * @returns `{ data: { publicUrl }, error }` — matches the external SDK pattern,
-   *   so `const { data } = getPublicUrl(path)` then `data.publicUrl`.
-   */
-  getPublicUrl(path) {
-    const publicUrl = `${this.http.baseUrl}/api/storage/buckets/${this.bucketName}/objects/${encodeURIComponent(path)}`;
-    return { data: { publicUrl }, error: null };
-  }
-  /**
-   * Resolve a download strategy (signed or direct URL) for an object with a
-   * caller-supplied TTL. Prefers the canonical GET route and falls back to the
-   * legacy POST alias so signed-URL creation still works against older backends
-   * that predate the GET route (they return 404/405 for it). A genuine
-   * "object not found" (STORAGE_NOT_FOUND) is not retried.
+   * @param credentials.provider - The identity provider (currently only 'google' is supported)
+   * @param credentials.token - The ID token from the native SDK
    */
-  async requestDownloadStrategy(path, expiresIn) {
-    const encoded = encodeURIComponent(path);
+  async signInWithIdToken(credentials) {
     try {
-      return await this.http.get(
-        `/api/storage/buckets/${this.bucketName}/download-strategy/objects/${encoded}`,
-        { params: { expiresIn: expiresIn.toString() } }
+      const { provider, token } = credentials;
+      const response = await this.http.post(
+        "/api/auth/id-token?client_type=mobile",
+        { provider, token },
+        { credentials: "include", skipAuthRefresh: true }
       );
-    } catch (error) {
-      const status = error instanceof InsForgeError ? error.statusCode : void 0;
-      const isMissingRoute = (status === 404 || status === 405) && !(error instanceof InsForgeError && error.error === "STORAGE_NOT_FOUND");
-      if (!isMissingRoute) {
-        throw error;
+      this.saveSessionFromResponse(response);
+      if (response.refreshToken) {
+        this.http.setRefreshToken(response.refreshToken);
       }
-      return await this.http.post(
-        `/api/storage/buckets/${this.bucketName}/objects/${encoded}/download-strategy`,
-        { expiresIn }
+      return {
+        data: response,
+        error: null
+      };
+    } catch (error) {
+      return wrapError(
+        error,
+        "An unexpected error occurred during ID token sign in"
       );
     }
   }
+  // ============================================================================
+  // Session Management
+  // ============================================================================
   /**
-   * Create a signed URL for an object.
+   * Refresh the current auth session.
    *
-   * Returns a time-limited, credential-free URL that can be handed directly to
-   * a browser (`<img src>`), an email, or a third party — no SDK or session is
-   * needed to fetch it. Authorization is enforced when the URL is minted (the
-   * caller must be allowed to read the object), so the resulting link is a
-   * pre-authorized capability scoped to this one object until it expires.
+   * Browser mode:
+   * - Uses httpOnly refresh cookie and optional CSRF header.
    *
-   * @param path - The object key/path
-   * @param expiresIn - Lifetime in seconds (default 3600 = 1h, max 604800 = 7d).
-   *   Honored for private buckets; public buckets return their long-lived URL.
+   * Legacy server mode (`isServerMode: true`):
+   * - Uses mobile auth flow and requires `refreshToken` in request body.
+   *
+   * SSR apps should prefer `createRefreshAuthRouter()` / `refreshAuth()` from
+   * `@resultdev/sdk/ssr`.
    */
-  async createSignedUrl(path, expiresIn = 3600) {
+  async refreshSession(options) {
     try {
-      const strategy = await this.requestDownloadStrategy(path, expiresIn);
-      return {
-        data: {
-          signedUrl: strategy.url,
-          expiresAt: strategy.expiresAt ? new Date(strategy.expiresAt).toISOString() : null
-        },
-        error: null
-      };
+      if (this.isServerMode() && !options?.refreshToken) {
+        return {
+          data: null,
+          error: new ResultError(
+            "refreshToken is required when refreshing session in server mode",
+            400,
+            ERROR_CODES.AUTH_UNAUTHORIZED
+          )
+        };
+      }
+      const csrfToken = !this.isServerMode() ? getCsrfToken() : null;
+      const response = await this.http.post(
+        this.isServerMode() ? "/api/auth/refresh?client_type=mobile" : "/api/auth/refresh",
+        this.isServerMode() ? { refresh_token: options?.refreshToken } : void 0,
+        {
+          headers: csrfToken ? { "X-CSRF-Token": csrfToken } : {},
+          credentials: "include",
+          skipAuthRefresh: true
+        }
+      );
+      if (response.accessToken) {
+        this.saveSessionFromResponse(response, AuthChangeEvent.TOKEN_REFRESHED);
+      }
+      return { data: response, error: null };
     } catch (error) {
-      return {
-        data: null,
-        error: error instanceof InsForgeError ? error : new InsForgeError("Failed to create signed URL", 500, "STORAGE_ERROR")
-      };
+      return wrapError(
+        error,
+        "An unexpected error occurred during session refresh"
+      );
     }
   }
   /**
-   * Create signed URLs for multiple objects in a single call.
-   *
-   * Each entry resolves independently: a failure on one key (not found / not
-   * permitted) is reported on that entry's `error` without failing the rest.
-   *
-   * @param paths - The object keys/paths
-   * @param expiresIn - Lifetime in seconds (default 3600 = 1h, max 604800 = 7d)
+   * Get current user, automatically waits for pending OAuth callback
    */
-  async createSignedUrls(paths, expiresIn = 3600) {
+  async getCurrentUser() {
+    await this.authCallbackHandled;
     try {
-      const data = await Promise.all(
-        paths.map(async (path) => {
-          const { data: signed, error } = await this.createSignedUrl(path, expiresIn);
-          return {
-            path,
-            signedUrl: signed?.signedUrl ?? null,
-            error: error ? error.message : null
-          };
-        })
-      );
-      return { data, error: null };
+      if (this.isServerMode()) {
+        const accessToken = this.tokenManager.getAccessToken();
+        if (!accessToken) {
+          return { data: { user: null }, error: null };
+        }
+        this.http.setAuthToken(accessToken);
+        const response = await this.http.get(
+          "/api/auth/sessions/current"
+        );
+        const user = response.user ?? null;
+        return { data: { user }, error: null };
+      }
+      const session = this.tokenManager.getSession();
+      if (session) {
+        this.http.setAuthToken(session.accessToken);
+        return { data: { user: session.user }, error: null };
+      }
+      if (typeof window !== "undefined") {
+        const { data: refreshed, error: refreshError } = await this.refreshSession();
+        if (refreshError) {
+          return { data: { user: null }, error: refreshError };
+        }
+        if (refreshed?.accessToken) {
+          return { data: { user: refreshed.user ?? null }, error: null };
+        }
+      }
+      return { data: { user: null }, error: null };
     } catch (error) {
+      if (error instanceof ResultError) {
+        return { data: { user: null }, error };
+      }
       return {
-        data: null,
-        error: error instanceof InsForgeError ? error : new InsForgeError("Failed to create signed URLs", 500, "STORAGE_ERROR")
+        data: { user: null },
+        error: new ResultError(
+          "An unexpected error occurred while getting user",
+          500,
+          "UNEXPECTED_ERROR"
+        )
       };
     }
   }
-  /**
-   * List objects in the bucket
-   * @param prefix - Filter by key prefix
-   * @param search - Search in file names
-   * @param limit - Maximum number of results (default: 100, max: 1000)
-   * @param offset - Number of results to skip
-   */
-  async list(options) {
+  // ============================================================================
+  // Profile Management
+  // ============================================================================
+  async getProfile(userId) {
     try {
-      const params = {};
-      if (options?.prefix) {
-        params.prefix = options.prefix;
-      }
-      if (options?.search) {
-        params.search = options.search;
-      }
-      if (options?.limit) {
-        params.limit = options.limit.toString();
-      }
-      if (options?.offset) {
-        params.offset = options.offset.toString();
-      }
       const response = await this.http.get(
-        `/api/storage/buckets/${this.bucketName}/objects`,
-        { params }
+        `/api/auth/profiles/${userId}`
       );
       return { data: response, error: null };
     } catch (error) {
-      return {
-        data: null,
-        error: error instanceof InsForgeError ? error : new InsForgeError("List failed", 500, "STORAGE_ERROR")
-      };
+      return wrapError(
+        error,
+        "An unexpected error occurred while fetching user profile"
+      );
     }
   }
-  /**
-   * Delete a file
-   * @param path - The object key/path
-   */
-  async remove(path) {
+  async setProfile(profile) {
     try {
-      const response = await this.http.delete(
-        `/api/storage/buckets/${this.bucketName}/objects/${encodeURIComponent(path)}`
+      const response = await this.http.patch(
+        "/api/auth/profiles/current",
+        {
+          profile
+        }
       );
+      const currentUser = this.tokenManager.getUser();
+      if (!this.isServerMode() && currentUser && response.profile !== void 0) {
+        this.tokenManager.setUser({
+          ...currentUser,
+          profile: response.profile
+        });
+      }
       return { data: response, error: null };
     } catch (error) {
-      return {
-        data: null,
-        error: error instanceof InsForgeError ? error : new InsForgeError("Delete failed", 500, "STORAGE_ERROR")
-      };
+      return wrapError(
+        error,
+        "An unexpected error occurred while updating user profile"
+      );
     }
   }
-};
-var Storage = class {
-  constructor(http) {
-    this.http = http;
-  }
-  /**
-   * Get a bucket instance for operations
-   * @param bucketName - Name of the bucket
-   */
-  from(bucketName) {
-    return new StorageBucket(bucketName, this.http);
-  }
-};
-var AI = class {
-  constructor(http) {
-    this.http = http;
-    this.chat = new Chat(http);
-    this.images = new Images(http);
-    this.embeddings = new Embeddings(http);
-  }
-};
-var Chat = class {
-  constructor(http) {
-    this.completions = new ChatCompletions(http);
-  }
-};
-var ChatCompletions = class {
-  constructor(http) {
-    this.http = http;
-  }
-  /**
-   * Create a chat completion - OpenAI-like response format
-   *
-   * @example
-   * ```typescript
-   * // Non-streaming
-   * const completion = await client.ai.chat.completions.create({
-   *   model: 'gpt-4',
-   *   messages: [{ role: 'user', content: 'Hello!' }]
-   * });
-   * console.log(completion.choices[0].message.content);
-   *
-   * // With images (OpenAI-compatible format)
-   * const response = await client.ai.chat.completions.create({
-   *   model: 'gpt-4-vision',
-   *   messages: [{
-   *     role: 'user',
-   *     content: [
-   *       { type: 'text', text: 'What is in this image?' },
-   *       { type: 'image_url', image_url: { url: 'https://example.com/image.jpg' } }
-   *     ]
-   *   }]
-   * });
-   *
-   * // With PDF files
-   * const pdfResponse = await client.ai.chat.completions.create({
-   *   model: 'anthropic/claude-3.5-sonnet',
-   *   messages: [{
-   *     role: 'user',
-   *     content: [
-   *       { type: 'text', text: 'Summarize this document' },
-   *       { type: 'file', file: { filename: 'doc.pdf', file_data: 'https://example.com/doc.pdf' } }
-   *     ]
-   *   }],
-   *   fileParser: { enabled: true, pdf: { engine: 'mistral-ocr' } }
-   * });
-   *
-   * // With web search
-   * const searchResponse = await client.ai.chat.completions.create({
-   *   model: 'openai/gpt-4',
-   *   messages: [{ role: 'user', content: 'What are the latest news about AI?' }],
-   *   webSearch: { enabled: true, maxResults: 5 }
-   * });
-   * // Access citations from response.choices[0].message.annotations
-   *
-   * // With thinking/reasoning mode (Anthropic models)
-   * const thinkingResponse = await client.ai.chat.completions.create({
-   *   model: 'anthropic/claude-3.5-sonnet',
-   *   messages: [{ role: 'user', content: 'Solve this complex math problem...' }],
-   *   thinking: true
-   * });
-   *
-   * // Streaming - returns async iterable
-   * const stream = await client.ai.chat.completions.create({
-   *   model: 'gpt-4',
-   *   messages: [{ role: 'user', content: 'Tell me a story' }],
-   *   stream: true
-   * });
-   *
-   * for await (const chunk of stream) {
-   *   if (chunk.choices[0]?.delta?.content) {
-   *     process.stdout.write(chunk.choices[0].delta.content);
-   *   }
-   * }
-   * ```
-   */
-  async create(params) {
-    const backendParams = {
-      model: params.model,
-      messages: params.messages,
-      temperature: params.temperature,
-      maxTokens: params.maxTokens,
-      topP: params.topP,
-      stream: params.stream,
-      // New plugin options
-      webSearch: params.webSearch,
-      fileParser: params.fileParser,
-      thinking: params.thinking,
-      // Tool calling options
-      tools: params.tools,
-      toolChoice: params.toolChoice,
-      parallelToolCalls: params.parallelToolCalls
-    };
-    if (params.stream) {
-      const headers = this.http.getHeaders();
-      headers["Content-Type"] = "application/json";
-      const response2 = await this.http.fetch(`${this.http.baseUrl}/api/ai/chat/completion`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(backendParams)
+  // ============================================================================
+  // Email Verification
+  // ============================================================================
+  async resendVerificationEmail(request) {
+    try {
+      const response = await this.http.post("/api/auth/email/send-verification", request, {
+        skipAuthRefresh: true
       });
-      if (!response2.ok) {
-        const error = await response2.json();
-        throw new Error(error.error || "Stream request failed");
-      }
-      return this.parseSSEStream(response2, params.model);
+      return { data: response, error: null };
+    } catch (error) {
+      return wrapError(
+        error,
+        "An unexpected error occurred while sending verification email"
+      );
     }
-    const response = await this.http.post(
-      "/api/ai/chat/completion",
-      backendParams
-    );
-    const content = response.text || "";
-    return {
-      id: `chatcmpl-${Date.now()}`,
-      object: "chat.completion",
-      created: Math.floor(Date.now() / 1e3),
-      model: response.metadata?.model,
-      choices: [
-        {
-          index: 0,
-          message: {
-            role: "assistant",
-            content,
-            // Include tool_calls if present (from tool calling)
-            ...response.tool_calls?.length && { tool_calls: response.tool_calls },
-            // Include annotations if present (from web search or file parsing)
-            ...response.annotations?.length && { annotations: response.annotations }
-          },
-          finish_reason: response.tool_calls?.length ? "tool_calls" : "stop"
-        }
-      ],
-      usage: response.metadata?.usage || {
-        prompt_tokens: 0,
-        completion_tokens: 0,
-        total_tokens: 0
-      }
-    };
   }
-  /**
-   * Parse SSE stream into async iterable of OpenAI-like chunks
-   */
-  async *parseSSEStream(response, model) {
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = "";
+  async verifyEmail(request) {
     try {
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) {
-          break;
-        }
-        buffer += decoder.decode(value, { stream: true });
-        const lines = buffer.split("\n");
-        buffer = lines.pop() || "";
-        for (const line of lines) {
-          if (line.startsWith("data: ")) {
-            const dataStr = line.slice(6).trim();
-            if (dataStr) {
-              try {
-                const data = JSON.parse(dataStr);
-                if (data.chunk || data.content) {
-                  yield {
-                    id: `chatcmpl-${Date.now()}`,
-                    object: "chat.completion.chunk",
-                    created: Math.floor(Date.now() / 1e3),
-                    model,
-                    choices: [
-                      {
-                        index: 0,
-                        delta: {
-                          content: data.chunk || data.content
-                        },
-                        finish_reason: null
-                      }
-                    ]
-                  };
-                }
-                if (data.tool_calls?.length) {
-                  yield {
-                    id: `chatcmpl-${Date.now()}`,
-                    object: "chat.completion.chunk",
-                    created: Math.floor(Date.now() / 1e3),
-                    model,
-                    choices: [
-                      {
-                        index: 0,
-                        delta: {
-                          tool_calls: data.tool_calls
-                        },
-                        finish_reason: "tool_calls"
-                      }
-                    ]
-                  };
-                }
-                if (data.done) {
-                  reader.releaseLock();
-                  return;
-                }
-              } catch {
-                console.warn("Failed to parse SSE data:", dataStr);
-              }
-            }
-          }
+      const response = await this.http.post(
+        this.isServerMode() ? "/api/auth/email/verify?client_type=mobile" : "/api/auth/email/verify",
+        request,
+        { credentials: "include", skipAuthRefresh: true }
+      );
+      this.saveSessionFromResponse(response);
+      if (response.refreshToken) {
+        this.http.setRefreshToken(response.refreshToken);
+      }
+      return { data: response, error: null };
+    } catch (error) {
+      return wrapError(
+        error,
+        "An unexpected error occurred while verifying email"
+      );
+    }
+  }
+  // ============================================================================
+  // Password Reset
+  // ============================================================================
+  async sendResetPasswordEmail(request) {
+    try {
+      const response = await this.http.post("/api/auth/email/send-reset-password", request, {
+        skipAuthRefresh: true
+      });
+      return { data: response, error: null };
+    } catch (error) {
+      return wrapError(
+        error,
+        "An unexpected error occurred while sending password reset email"
+      );
+    }
+  }
+  async exchangeResetPasswordToken(request) {
+    try {
+      const response = await this.http.post(
+        "/api/auth/email/exchange-reset-password-token",
+        request,
+        { skipAuthRefresh: true }
+      );
+      return { data: response, error: null };
+    } catch (error) {
+      return wrapError(
+        error,
+        "An unexpected error occurred while verifying reset code"
+      );
+    }
+  }
+  async resetPassword(request) {
+    try {
+      const response = await this.http.post(
+        "/api/auth/email/reset-password",
+        request,
+        { skipAuthRefresh: true }
+      );
+      return { data: response, error: null };
+    } catch (error) {
+      return wrapError(
+        error,
+        "An unexpected error occurred while resetting password"
+      );
+    }
+  }
+  // ============================================================================
+  // Configuration
+  // ============================================================================
+  async getPublicAuthConfig() {
+    try {
+      const response = await this.http.get(
+        "/api/auth/public-config",
+        {
+          skipAuthRefresh: true
         }
-      }
-    } finally {
-      reader.releaseLock();
+      );
+      return { data: response, error: null };
+    } catch (error) {
+      return wrapError(
+        error,
+        "An unexpected error occurred while fetching auth configuration"
+      );
     }
   }
 };
-var Embeddings = class {
-  constructor(http) {
-    this.http = http;
+
+// src/modules/database-postgrest.ts
+import { PostgrestClient } from "@supabase/postgrest-js";
+function createResultPostgrestFetch(httpClient) {
+  return async (input, init) => {
+    const url = typeof input === "string" ? input : input.toString();
+    const urlObj = new URL(url);
+    const pathname = urlObj.pathname.slice(1);
+    const rpcMatch = pathname.match(/^rpc\/(.+)$/);
+    const endpoint = rpcMatch ? `/api/database/rpc/${rpcMatch[1]}` : `/api/database/records/${pathname}`;
+    const backendUrl = `${httpClient.baseUrl}${endpoint}${urlObj.search}`;
+    const headers = new Headers(httpClient.getHeaders());
+    new Headers(init?.headers).forEach((value, key) => {
+      headers.set(key, value);
+    });
+    const response = await httpClient.rawFetch(backendUrl, {
+      ...init,
+      headers
+    });
+    return response;
+  };
+}
+var Database = class {
+  postgrest;
+  constructor(httpClient, defaultSchema) {
+    this.postgrest = new PostgrestClient("http://dummy", {
+      fetch: createResultPostgrestFetch(httpClient),
+      headers: {},
+      ...defaultSchema ? { schema: defaultSchema } : {}
+    });
   }
   /**
-   * Create embeddings for text input - OpenAI-like response format
+   * Select a non-default Postgres schema for the chained query. Maps to
+   * PostgREST's `Accept-Profile` (reads) / `Content-Profile` (writes) header.
+   * The schema must be exposed by the backend.
    *
    * @example
-   * ```typescript
-   * // Single text input
-   * const response = await client.ai.embeddings.create({
-   *   model: 'openai/text-embedding-3-small',
-   *   input: 'Hello world'
-   * });
-   * console.log(response.data[0].embedding); // number[]
+   * const { data } = await client.database
+   *   .schema('analytics')
+   *   .from('events')
+   *   .select('*');
    *
-   * // Multiple text inputs
-   * const response = await client.ai.embeddings.create({
-   *   model: 'openai/text-embedding-3-small',
-   *   input: ['Hello world', 'Goodbye world']
-   * });
-   * response.data.forEach((item, i) => {
-   *   console.log(`Embedding ${i}:`, item.embedding.slice(0, 5)); // First 5 dimensions
-   * });
+   * @example
+   * await client.database.schema('analytics').rpc('rollup', { day: '2026-01-01' });
+   */
+  schema(schemaName) {
+    return this.postgrest.schema(schemaName);
+  }
+  /**
+   * Create a query builder for a table
    *
-   * // With custom dimensions (if supported by model)
-   * const response = await client.ai.embeddings.create({
-   *   model: 'openai/text-embedding-3-small',
-   *   input: 'Hello world',
-   *   dimensions: 256
-   * });
+   * @example
+   * // Basic query
+   * const { data, error } = await client.database
+   *   .from('posts')
+   *   .select('*')
+   *   .eq('user_id', userId);
    *
-   * // With base64 encoding format
-   * const response = await client.ai.embeddings.create({
-   *   model: 'openai/text-embedding-3-small',
-   *   input: 'Hello world',
-   *   encoding_format: 'base64'
-   * });
-   * ```
+   * // With count (Supabase style!)
+   * const { data, error, count } = await client.database
+   *   .from('posts')
+   *   .select('*', { count: 'exact' })
+   *   .range(0, 9);
+   *
+   * // Just get count, no data
+   * const { count } = await client.database
+   *   .from('posts')
+   *   .select('*', { count: 'exact', head: true });
+   *
+   * // Complex queries with OR
+   * const { data } = await client.database
+   *   .from('posts')
+   *   .select('*, users!inner(*)')
+   *   .or('status.eq.active,status.eq.pending');
+   *
+   * // All features work:
+   * - Nested selects
+   * - Foreign key expansion
+   * - OR/AND/NOT conditions
+   * - Count with head
+   * - Range pagination
+   * - Upserts
    */
-  async create(params) {
-    const response = await this.http.post("/api/ai/embeddings", params);
-    return {
-      object: response.object,
-      data: response.data,
-      model: response.metadata?.model,
-      usage: response.metadata?.usage ? {
-        prompt_tokens: response.metadata.usage.promptTokens || 0,
-        total_tokens: response.metadata.usage.totalTokens || 0
-      } : {
-        prompt_tokens: 0,
-        total_tokens: 0
-      }
-    };
+  from(table) {
+    return this.postgrest.from(table);
+  }
+  /**
+   * Call a PostgreSQL function (RPC)
+   *
+   * @example
+   * // Call a function with parameters
+   * const { data, error } = await client.database
+   *   .rpc('get_user_stats', { user_id: 123 });
+   *
+   * // Call a function with no parameters
+   * const { data, error } = await client.database
+   *   .rpc('get_all_active_users');
+   *
+   * // With options (head, count, get)
+   * const { data, count } = await client.database
+   *   .rpc('search_posts', { query: 'hello' }, { count: 'exact' });
+   */
+  rpc(fn, args, options) {
+    return this.postgrest.rpc(fn, args, options);
   }
 };
-var Images = class {
+
+// src/modules/email.ts
+var Emails = class {
+  http;
   constructor(http) {
     this.http = http;
   }
   /**
-   * Generate images - OpenAI-like response format
-   *
-   * @example
-   * ```typescript
-   * // Text-to-image
-   * const response = await client.ai.images.generate({
-   *   model: 'dall-e-3',
-   *   prompt: 'A sunset over mountains',
-   * });
-   * console.log(response.data[0].b64_json);
-   *
-   * // Image-to-image (with input images)
-   * const response = await client.ai.images.generate({
-   *   model: 'stable-diffusion-xl',
-   *   prompt: 'Transform this into a watercolor painting',
-   *   images: [
-   *     { url: 'https://example.com/input.jpg' },
-   *     // or base64-encoded Data URI:
-   *     { url: 'data:image/jpeg;base64,/9j/4AAQ...' }
-   *   ]
-   * });
-   * ```
+   * Send a custom HTML email
+   * @param options Email options including recipients, subject, and HTML content
    */
-  async generate(params) {
-    const response = await this.http.post(
-      "/api/ai/image/generation",
-      params
-    );
-    let data = [];
-    if (response.images && response.images.length > 0) {
-      data = response.images.map((img) => ({
-        b64_json: img.imageUrl.replace(/^data:image\/\w+;base64,/, ""),
-        content: response.text
-      }));
-    } else if (response.text) {
-      data = [{ content: response.text }];
-    }
-    return {
-      created: Math.floor(Date.now() / 1e3),
-      data,
-      ...response.metadata?.usage && {
-        usage: {
-          total_tokens: response.metadata.usage.totalTokens || 0,
-          input_tokens: response.metadata.usage.promptTokens || 0,
-          output_tokens: response.metadata.usage.completionTokens || 0
-        }
+  async send(options) {
+    try {
+      const data = await this.http.post(
+        "/api/email/send-raw",
+        options
+      );
+      return { data, error: null };
+    } catch (error) {
+      if (error instanceof Error && error.name === "AbortError") {
+        throw error;
       }
-    };
+      return {
+        data: null,
+        error: error instanceof ResultError ? error : new ResultError(
+          error instanceof Error ? error.message : "Email send failed",
+          500,
+          "EMAIL_ERROR"
+        )
+      };
+    }
   }
 };
+
+// src/modules/functions.ts
 var Functions = class _Functions {
+  http;
+  functionsUrl;
   constructor(http, functionsUrl) {
     this.http = http;
     this.functionsUrl = functionsUrl || _Functions.deriveSubhostingUrl(http.baseUrl);
   }
   /**
    * Derive the subhosting URL from the base URL.
-   * Base URL pattern: https://{appKey}.{region}.insforge.app
-   * Functions URL:    https://{appKey}.functions.insforge.app
-   * Only applies to .insforge.app domains.
+   * Rewrites the backend base URL to its functions subhosting URL
+   * ({appKey}.{region}.<domain> -> {appKey}.functions.<domain>).
+   * Only applies to platform-hosted backends.
    */
   static deriveSubhostingUrl(baseUrl) {
     try {
@@ -2236,7 +2573,7 @@ var Functions = class _Functions {
    * placeholder; the router only reads pathname.
    */
   buildInProcessRequest(slug, method, body, callerHeaders) {
-    const url = new URL("/" + slug, "http://insforge.local").toString();
+    const url = new URL(`/${slug}`, "http://backend.local").toString();
     const headers = { ...this.http.getHeaders() };
     const reqBody = serializeBody(method, body, headers);
     Object.assign(headers, callerHeaders);
@@ -2250,7 +2587,7 @@ var Functions = class _Functions {
    * Invoke an Edge Function.
    *
    * Dispatch order:
-   * 1. If `globalThis.__insforge_dispatch__` is present, call it in-process.
+   * 1. If the platform's in-process dispatch hook is present, call it directly.
    *    This avoids Deno Subhosting's 508 Loop Detected when one bundled
    *    function invokes another inside the same deployment.
    * 2. Otherwise, try the configured subhosting URL.
@@ -2275,7 +2612,7 @@ var Functions = class _Functions {
         }
         return {
           data: null,
-          error: error instanceof InsForgeError ? error : new InsForgeError(
+          error: error instanceof ResultError ? error : new ResultError(
             error instanceof Error ? error.message : "Function invocation failed",
             500,
             "FUNCTION_ERROR"
@@ -2285,20 +2622,24 @@ var Functions = class _Functions {
     }
     if (this.functionsUrl) {
       try {
-        const data = await this.http.request(method, `${this.functionsUrl}/${slug}`, {
-          body,
-          headers
-        });
+        const data = await this.http.request(
+          method,
+          `${this.functionsUrl}/${slug}`,
+          {
+            body,
+            headers
+          }
+        );
         return { data, error: null };
       } catch (error) {
         if (error instanceof Error && error.name === "AbortError") {
           throw error;
         }
-        if (error instanceof InsForgeError && error.statusCode === 404) {
+        if (error instanceof ResultError && error.statusCode === 404) {
         } else {
           return {
             data: null,
-            error: error instanceof InsForgeError ? error : new InsForgeError(
+            error: error instanceof ResultError ? error : new ResultError(
               error instanceof Error ? error.message : "Function invocation failed",
               500,
               "FUNCTION_ERROR"
@@ -2317,7 +2658,7 @@ var Functions = class _Functions {
       }
       return {
         data: null,
-        error: error instanceof InsForgeError ? error : new InsForgeError(
+        error: error instanceof ResultError ? error : new ResultError(
           error instanceof Error ? error.message : "Function invocation failed",
           500,
           "FUNCTION_ERROR"
@@ -2326,6 +2667,8 @@ var Functions = class _Functions {
     }
   }
 };
+
+// src/modules/realtime.ts
 var CONNECT_TIMEOUT = 1e4;
 var SUBSCRIBE_TIMEOUT = 1e4;
 var Realtime = class {
@@ -2334,18 +2677,22 @@ var Realtime = class {
     this.tokenManager = tokenManager;
     this.anonKey = anonKey;
     this.getValidAccessToken = getValidAccessToken;
-    this.socket = null;
-    this.connectPromise = null;
-    this.connectionAttempt = null;
-    this.nextConnectionAttemptId = 0;
-    this.subscriptions = /* @__PURE__ */ new Map();
-    this.eventListeners = /* @__PURE__ */ new Map();
     this.tokenManager.onAuthStateChange((event) => {
       if (event !== AuthChangeEvent.TOKEN_REFRESHED) {
         this.reconnectForAuthChange();
       }
     });
   }
+  baseUrl;
+  tokenManager;
+  anonKey;
+  getValidAccessToken;
+  socket = null;
+  connectPromise = null;
+  connectionAttempt = null;
+  nextConnectionAttemptId = 0;
+  subscriptions = /* @__PURE__ */ new Map();
+  eventListeners = /* @__PURE__ */ new Map();
   notifyListeners(event, payload) {
     for (const callback of this.eventListeners.get(event) ?? []) {
       try {
@@ -2510,7 +2857,10 @@ var Realtime = class {
         {
           ok: false,
           channel: subscription.channel,
-          error: { code: "DISCONNECTED", message: "Connection lost before subscription completed" }
+          error: {
+            code: "DISCONNECTED",
+            message: "Connection lost before subscription completed"
+          }
         },
         true
       );
@@ -2533,7 +2883,10 @@ var Realtime = class {
       return Promise.resolve({
         ok: false,
         channel,
-        error: { code: "CONNECTION_FAILED", message: "Not connected to realtime server" }
+        error: {
+          code: "CONNECTION_FAILED",
+          message: "Not connected to realtime server"
+        }
       });
     }
     subscription.status = "pending";
@@ -2564,333 +2917,702 @@ var Realtime = class {
           );
         }
       }, SUBSCRIBE_TIMEOUT);
-      socket.emit("realtime:subscribe", { channel }, (response) => {
-        if (this.subscriptions.get(channel) !== subscription || subscription.epoch !== epoch) {
-          return;
+      socket.emit(
+        "realtime:subscribe",
+        { channel },
+        (response) => {
+          if (this.subscriptions.get(channel) !== subscription || subscription.epoch !== epoch) {
+            return;
+          }
+          if (response.ok) {
+            subscription.status = "subscribed";
+            subscription.members = new Map(
+              response.presence.members.map((member) => [
+                member.presenceId,
+                member
+              ])
+            );
+          } else {
+            subscription.status = "rejected";
+            subscription.members.clear();
+          }
+          this.settleSubscription(subscription, response, false);
+        }
+      );
+    });
+    return subscription.pending;
+  }
+  settleSubscription(subscription, response, incrementEpoch) {
+    if (incrementEpoch) {
+      subscription.epoch++;
+    }
+    subscription.settlePending?.(response);
+  }
+  applyPresenceEvent(event, message) {
+    if (event !== "presence:join" && event !== "presence:leave") {
+      return;
+    }
+    const presenceEvent = message;
+    const channel = presenceEvent.meta?.channel;
+    const member = presenceEvent.member;
+    if (!channel || !member) {
+      return;
+    }
+    const subscription = this.subscriptions.get(channel);
+    if (!subscription) {
+      return;
+    }
+    if (event === "presence:join") {
+      subscription.members.set(member.presenceId, member);
+    } else {
+      subscription.members.delete(member.presenceId);
+    }
+  }
+  get isConnected() {
+    return this.socket?.connected ?? false;
+  }
+  get connectionState() {
+    if (!this.socket) {
+      return "disconnected";
+    }
+    return this.socket.connected ? "connected" : "connecting";
+  }
+  get socketId() {
+    return this.socket?.id;
+  }
+  async subscribe(channel) {
+    let subscription = this.subscriptions.get(channel);
+    if (subscription) {
+      if (subscription.pending) {
+        return subscription.pending;
+      }
+      if (subscription.status === "subscribed") {
+        return {
+          ok: true,
+          channel,
+          presence: { members: [...subscription.members.values()] }
+        };
+      }
+    } else {
+      subscription = {
+        channel,
+        epoch: 0,
+        status: "pending",
+        members: /* @__PURE__ */ new Map()
+      };
+      this.subscriptions.set(channel, subscription);
+    }
+    if (!this.socket?.connected) {
+      try {
+        await this.connect();
+      } catch (error) {
+        if (this.subscriptions.get(channel) === subscription) {
+          this.subscriptions.delete(channel);
+        }
+        const message = error instanceof Error ? error.message : "Connection failed";
+        return {
+          ok: false,
+          channel,
+          error: { code: "CONNECTION_FAILED", message }
+        };
+      }
+    }
+    return subscription.pending ?? this.requestSubscription(channel, subscription);
+  }
+  unsubscribe(channel) {
+    const subscription = this.subscriptions.get(channel);
+    if (!subscription) {
+      return;
+    }
+    this.subscriptions.delete(channel);
+    this.settleSubscription(
+      subscription,
+      {
+        ok: false,
+        channel,
+        error: {
+          code: "SUBSCRIPTION_CANCELLED",
+          message: "Subscription cancelled"
+        }
+      },
+      true
+    );
+    if (this.socket?.connected) {
+      this.socket.emit("realtime:unsubscribe", { channel });
+    }
+  }
+  async publish(channel, event, payload) {
+    if (!this.socket?.connected) {
+      throw new Error(
+        "Not connected to realtime server. Call connect() first."
+      );
+    }
+    this.socket.emit("realtime:publish", { channel, event, payload });
+  }
+  on(event, callback) {
+    const listeners = this.eventListeners.get(event) ?? /* @__PURE__ */ new Set();
+    listeners.add(callback);
+    this.eventListeners.set(event, listeners);
+  }
+  off(event, callback) {
+    const listeners = this.eventListeners.get(event);
+    listeners?.delete(callback);
+    if (listeners?.size === 0) {
+      this.eventListeners.delete(event);
+    }
+  }
+  once(event, callback) {
+    const wrapper = (payload) => {
+      this.off(event, wrapper);
+      callback(payload);
+    };
+    this.on(event, wrapper);
+  }
+  getSubscribedChannels() {
+    return [...this.subscriptions.values()].filter((subscription) => subscription.status === "subscribed").map((subscription) => subscription.channel);
+  }
+  getPresenceState(channel) {
+    return [...this.subscriptions.get(channel)?.members.values() ?? []];
+  }
+};
+
+// src/modules/storage.ts
+function generateObjectKey(filename) {
+  const dotIndex = filename.lastIndexOf(".");
+  const hasExt = dotIndex > 0;
+  const ext = hasExt ? filename.slice(dotIndex) : "";
+  const base = hasExt ? filename.slice(0, dotIndex) : filename;
+  const sanitizedBase = base.replace(/[^a-zA-Z0-9-_]/g, "-").slice(0, 32) || "file";
+  const timestamp = Date.now();
+  const random = Math.random().toString(36).slice(2, 8);
+  return `${sanitizedBase}-${timestamp}-${random}${ext}`;
+}
+var StorageBucket = class {
+  constructor(bucketName, http) {
+    this.bucketName = bucketName;
+    this.http = http;
+  }
+  bucketName;
+  http;
+  /**
+   * Upload a file to a specific key.
+   * Uses the upload strategy from the backend (direct or presigned).
+   * Standard PUT semantics: uploading to an existing key replaces the
+   * current object in place.
+   * @param path - The object key/path
+   * @param file - File or Blob to upload
+   */
+  async upload(path, file) {
+    try {
+      const strategyResponse = await this.http.post(
+        `/api/storage/buckets/${this.bucketName}/upload-strategy`,
+        {
+          filename: path,
+          contentType: file.type || "application/octet-stream",
+          size: file.size
         }
-        if (response.ok) {
-          subscription.status = "subscribed";
-          subscription.members = new Map(
-            response.presence.members.map((member) => [member.presenceId, member])
+      );
+      if (strategyResponse.method === "presigned") {
+        return await this.uploadWithPresignedUrl(strategyResponse, file);
+      }
+      if (strategyResponse.method === "direct") {
+        const formData = new FormData();
+        formData.append("file", file);
+        const response = await this.http.request(
+          "PUT",
+          `/api/storage/buckets/${this.bucketName}/objects/${encodeURIComponent(path)}`,
+          {
+            body: formData,
+            headers: {
+              // Don't set Content-Type, let browser set multipart boundary
+            }
+          }
+        );
+        return { data: response, error: null };
+      }
+      throw new ResultError(
+        `Unsupported upload method: ${strategyResponse.method}`,
+        500,
+        "STORAGE_ERROR"
+      );
+    } catch (error) {
+      return {
+        data: null,
+        error: error instanceof ResultError ? error : new ResultError("Upload failed", 500, "STORAGE_ERROR")
+      };
+    }
+  }
+  /**
+   * Upload a file under an automatically generated, collision-free key.
+   * The key is derived client-side from the filename (sanitized base +
+   * timestamp + random suffix) and uploaded through the standard
+   * {@link upload} path, so repeated uploads of the same file never
+   * overwrite each other. Reads the filename structurally to avoid assuming
+   * a global `File` (which Node 18 does not expose).
+   * @param file - File or Blob to upload
+   */
+  async uploadAuto(file) {
+    const filename = "name" in file && typeof file.name === "string" ? file.name : "file";
+    return this.upload(generateObjectKey(filename), file);
+  }
+  /**
+   * Internal method to handle presigned URL uploads
+   */
+  async uploadWithPresignedUrl(strategy, file) {
+    try {
+      const formData = new FormData();
+      if (strategy.fields) {
+        Object.entries(strategy.fields).forEach(([key, value]) => {
+          formData.append(key, value);
+        });
+      }
+      formData.append("file", file);
+      const uploadResponse = await fetch(strategy.uploadUrl, {
+        method: "POST",
+        body: formData
+      });
+      if (!uploadResponse.ok) {
+        throw new ResultError(
+          `Upload to storage failed: ${uploadResponse.statusText}`,
+          uploadResponse.status,
+          "STORAGE_ERROR"
+        );
+      }
+      if (strategy.confirmRequired && strategy.confirmUrl) {
+        const confirmResponse = await this.http.post(
+          strategy.confirmUrl,
+          {
+            size: file.size,
+            contentType: file.type || "application/octet-stream"
+          }
+        );
+        return { data: confirmResponse, error: null };
+      }
+      return {
+        data: {
+          key: strategy.key,
+          bucket: this.bucketName,
+          size: file.size,
+          mimeType: file.type || "application/octet-stream",
+          uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          url: this.getPublicUrl(strategy.key).data?.publicUrl
+        },
+        error: null
+      };
+    } catch (error) {
+      throw error instanceof ResultError ? error : new ResultError("Presigned upload failed", 500, "STORAGE_ERROR");
+    }
+  }
+  /**
+   * Download a file
+   * Uses the download strategy from backend (direct or presigned)
+   * @param path - The object key/path
+   * Returns the file as a Blob
+   */
+  async download(path) {
+    try {
+      const encodedKey = encodeURIComponent(path);
+      let strategyResponse;
+      try {
+        strategyResponse = await this.http.get(
+          `/api/storage/buckets/${this.bucketName}/download-strategy/objects/${encodedKey}`
+        );
+      } catch (err) {
+        const status = err instanceof ResultError ? err.statusCode : void 0;
+        if (status === 404 || status === 405) {
+          strategyResponse = await this.http.post(
+            `/api/storage/buckets/${this.bucketName}/objects/${encodedKey}/download-strategy`,
+            {}
           );
         } else {
-          subscription.status = "rejected";
-          subscription.members.clear();
+          throw err;
         }
-        this.settleSubscription(subscription, response, false);
-      });
-    });
-    return subscription.pending;
-  }
-  settleSubscription(subscription, response, incrementEpoch) {
-    if (incrementEpoch) {
-      subscription.epoch++;
-    }
-    subscription.settlePending?.(response);
-  }
-  applyPresenceEvent(event, message) {
-    if (event !== "presence:join" && event !== "presence:leave") {
-      return;
-    }
-    const presenceEvent = message;
-    const channel = presenceEvent.meta?.channel;
-    const member = presenceEvent.member;
-    if (!channel || !member) {
-      return;
-    }
-    const subscription = this.subscriptions.get(channel);
-    if (!subscription) {
-      return;
-    }
-    if (event === "presence:join") {
-      subscription.members.set(member.presenceId, member);
-    } else {
-      subscription.members.delete(member.presenceId);
-    }
-  }
-  get isConnected() {
-    return this.socket?.connected ?? false;
-  }
-  get connectionState() {
-    if (!this.socket) {
-      return "disconnected";
-    }
-    return this.socket.connected ? "connected" : "connecting";
-  }
-  get socketId() {
-    return this.socket?.id;
-  }
-  async subscribe(channel) {
-    let subscription = this.subscriptions.get(channel);
-    if (subscription) {
-      if (subscription.pending) {
-        return subscription.pending;
       }
-      if (subscription.status === "subscribed") {
-        return { ok: true, channel, presence: { members: [...subscription.members.values()] } };
+      const downloadUrl = strategyResponse.url;
+      const headers = {};
+      if (strategyResponse.method === "direct") {
+        Object.assign(headers, this.http.getHeaders());
       }
-    } else {
-      subscription = { channel, epoch: 0, status: "pending", members: /* @__PURE__ */ new Map() };
-      this.subscriptions.set(channel, subscription);
-    }
-    if (!this.socket?.connected) {
-      try {
-        await this.connect();
-      } catch (error) {
-        if (this.subscriptions.get(channel) === subscription) {
-          this.subscriptions.delete(channel);
+      const response = await fetch(downloadUrl, {
+        method: "GET",
+        headers
+      });
+      if (!response.ok) {
+        try {
+          const error = await response.json();
+          throw ResultError.fromApiError(error);
+        } catch {
+          throw new ResultError(
+            `Download failed: ${response.statusText}`,
+            response.status,
+            "STORAGE_ERROR"
+          );
         }
-        const message = error instanceof Error ? error.message : "Connection failed";
-        return { ok: false, channel, error: { code: "CONNECTION_FAILED", message } };
       }
+      const blob = await response.blob();
+      return { data: blob, error: null };
+    } catch (error) {
+      return {
+        data: null,
+        error: error instanceof ResultError ? error : new ResultError("Download failed", 500, "STORAGE_ERROR")
+      };
     }
-    return subscription.pending ?? this.requestSubscription(channel, subscription);
   }
-  unsubscribe(channel) {
-    const subscription = this.subscriptions.get(channel);
-    if (!subscription) {
-      return;
-    }
-    this.subscriptions.delete(channel);
-    this.settleSubscription(
-      subscription,
-      {
-        ok: false,
-        channel,
-        error: { code: "SUBSCRIPTION_CANCELLED", message: "Subscription cancelled" }
-      },
-      true
-    );
-    if (this.socket?.connected) {
-      this.socket.emit("realtime:unsubscribe", { channel });
-    }
+  /**
+   * Get the public URL for an object in a public bucket.
+   *
+   * Pure string construction — no network call, no auth. The URL only resolves
+   * if the bucket is public; for private objects use {@link createSignedUrl}.
+   *
+   * @param path - The object key/path
+   * @returns `{ data: { publicUrl }, error }` — matches the external SDK pattern,
+   *   so `const { data } = getPublicUrl(path)` then `data.publicUrl`.
+   */
+  getPublicUrl(path) {
+    const publicUrl = `${this.http.baseUrl}/api/storage/buckets/${this.bucketName}/objects/${encodeURIComponent(path)}`;
+    return { data: { publicUrl }, error: null };
   }
-  async publish(channel, event, payload) {
-    if (!this.socket?.connected) {
-      throw new Error("Not connected to realtime server. Call connect() first.");
+  /**
+   * Resolve a download strategy (signed or direct URL) for an object with a
+   * caller-supplied TTL. Prefers the canonical GET route and falls back to the
+   * legacy POST alias so signed-URL creation still works against older backends
+   * that predate the GET route (they return 404/405 for it). A genuine
+   * "object not found" (STORAGE_NOT_FOUND) is not retried.
+   */
+  async requestDownloadStrategy(path, expiresIn) {
+    const encoded = encodeURIComponent(path);
+    try {
+      return await this.http.get(
+        `/api/storage/buckets/${this.bucketName}/download-strategy/objects/${encoded}`,
+        { params: { expiresIn: expiresIn.toString() } }
+      );
+    } catch (error) {
+      const status = error instanceof ResultError ? error.statusCode : void 0;
+      const isMissingRoute = (status === 404 || status === 405) && !(error instanceof ResultError && error.error === "STORAGE_NOT_FOUND");
+      if (!isMissingRoute) {
+        throw error;
+      }
+      return await this.http.post(
+        `/api/storage/buckets/${this.bucketName}/objects/${encoded}/download-strategy`,
+        { expiresIn }
+      );
     }
-    this.socket.emit("realtime:publish", { channel, event, payload });
-  }
-  on(event, callback) {
-    const listeners = this.eventListeners.get(event) ?? /* @__PURE__ */ new Set();
-    listeners.add(callback);
-    this.eventListeners.set(event, listeners);
   }
-  off(event, callback) {
-    const listeners = this.eventListeners.get(event);
-    listeners?.delete(callback);
-    if (listeners?.size === 0) {
-      this.eventListeners.delete(event);
+  /**
+   * Create a signed URL for an object.
+   *
+   * Returns a time-limited, credential-free URL that can be handed directly to
+   * a browser (`<img src>`), an email, or a third party — no SDK or session is
+   * needed to fetch it. Authorization is enforced when the URL is minted (the
+   * caller must be allowed to read the object), so the resulting link is a
+   * pre-authorized capability scoped to this one object until it expires.
+   *
+   * @param path - The object key/path
+   * @param expiresIn - Lifetime in seconds (default 3600 = 1h, max 604800 = 7d).
+   *   Honored for private buckets; public buckets return their long-lived URL.
+   */
+  async createSignedUrl(path, expiresIn = 3600) {
+    try {
+      const strategy = await this.requestDownloadStrategy(path, expiresIn);
+      return {
+        data: {
+          signedUrl: strategy.url,
+          expiresAt: strategy.expiresAt ? new Date(strategy.expiresAt).toISOString() : null
+        },
+        error: null
+      };
+    } catch (error) {
+      return {
+        data: null,
+        error: error instanceof ResultError ? error : new ResultError(
+          "Failed to create signed URL",
+          500,
+          "STORAGE_ERROR"
+        )
+      };
     }
   }
-  once(event, callback) {
-    const wrapper = (payload) => {
-      this.off(event, wrapper);
-      callback(payload);
-    };
-    this.on(event, wrapper);
-  }
-  getSubscribedChannels() {
-    return [...this.subscriptions.values()].filter((subscription) => subscription.status === "subscribed").map((subscription) => subscription.channel);
-  }
-  getPresenceState(channel) {
-    return [...this.subscriptions.get(channel)?.members.values() ?? []];
-  }
-};
-var Emails = class {
-  constructor(http) {
-    this.http = http;
-  }
   /**
-   * Send a custom HTML email
-   * @param options Email options including recipients, subject, and HTML content
+   * Create signed URLs for multiple objects in a single call.
+   *
+   * Each entry resolves independently: a failure on one key (not found / not
+   * permitted) is reported on that entry's `error` without failing the rest.
+   *
+   * @param paths - The object keys/paths
+   * @param expiresIn - Lifetime in seconds (default 3600 = 1h, max 604800 = 7d)
    */
-  async send(options) {
+  async createSignedUrls(paths, expiresIn = 3600) {
     try {
-      const data = await this.http.post("/api/email/send-raw", options);
+      const data = await Promise.all(
+        paths.map(async (path) => {
+          const { data: signed, error } = await this.createSignedUrl(
+            path,
+            expiresIn
+          );
+          return {
+            path,
+            signedUrl: signed?.signedUrl ?? null,
+            error: error ? error.message : null
+          };
+        })
+      );
       return { data, error: null };
     } catch (error) {
-      if (error instanceof Error && error.name === "AbortError") {
-        throw error;
-      }
       return {
         data: null,
-        error: error instanceof InsForgeError ? error : new InsForgeError(
-          error instanceof Error ? error.message : "Email send failed",
+        error: error instanceof ResultError ? error : new ResultError(
+          "Failed to create signed URLs",
           500,
-          "EMAIL_ERROR"
+          "STORAGE_ERROR"
         )
       };
     }
   }
-};
-function providerEnvironmentPath(provider, environment) {
-  return `/api/payments/${provider}/${encodeURIComponent(environment)}`;
-}
-var StripePayments = class {
-  constructor(http) {
-    this.http = http;
-  }
   /**
-   * Create a Stripe Checkout Session through the InsForge backend.
-   *
-   * @example
-   * ```typescript
-   * const { data, error } = await client.payments.stripe.createCheckoutSession('test', {
-   *   mode: 'payment',
-   *   lineItems: [{ priceId: 'price_123', quantity: 1 }],
-   *   successUrl: `${window.location.origin}/success`,
-   *   cancelUrl: `${window.location.origin}/pricing`
-   * });
-   *
-   * if (!error && data.checkoutSession.url) {
-   *   window.location.assign(data.checkoutSession.url);
-   * }
-   * ```
+   * List objects in the bucket
+   * @param prefix - Filter by key prefix
+   * @param search - Search in file names
+   * @param limit - Maximum number of results (default: 100, max: 1000)
+   * @param offset - Number of results to skip
    */
-  async createCheckoutSession(environment, request) {
+  async list(options) {
     try {
-      const data = await this.http.post(
-        `${providerEnvironmentPath("stripe", environment)}/checkout-sessions`,
-        request,
-        { idempotent: !!request.idempotencyKey }
+      const params = {};
+      if (options?.prefix) {
+        params.prefix = options.prefix;
+      }
+      if (options?.search) {
+        params.search = options.search;
+      }
+      if (options?.limit) {
+        params.limit = options.limit.toString();
+      }
+      if (options?.offset) {
+        params.offset = options.offset.toString();
+      }
+      const response = await this.http.get(
+        `/api/storage/buckets/${this.bucketName}/objects`,
+        { params }
       );
-      return { data, error: null };
+      return { data: response, error: null };
     } catch (error) {
-      return wrapError(
-        error,
-        "Stripe checkout session creation failed"
-      );
+      return {
+        data: null,
+        error: error instanceof ResultError ? error : new ResultError("List failed", 500, "STORAGE_ERROR")
+      };
     }
   }
   /**
-   * Create a Stripe Billing Portal Session for a mapped billing subject.
+   * Delete one or more files.
+   *
+   * A string uses the single-object endpoint. An array uses the batch endpoint,
+   * which accepts at most 1000 keys and returns one result per key.
+   *
+   * @param pathOrPaths - One object key/path or an array of object keys/paths
    */
-  async createCustomerPortalSession(environment, request) {
+  async remove(pathOrPaths) {
     try {
-      const data = await this.http.post(
-        `${providerEnvironmentPath("stripe", environment)}/customer-portal-sessions`,
-        request
+      const response = Array.isArray(pathOrPaths) ? await this.http.delete(
+        `/api/storage/buckets/${this.bucketName}/objects`,
+        { body: { keys: pathOrPaths } }
+      ) : await this.http.delete(
+        `/api/storage/buckets/${this.bucketName}/objects/${encodeURIComponent(pathOrPaths)}`
       );
-      return { data, error: null };
+      return { data: response, error: null };
     } catch (error) {
-      return wrapError(
-        error,
-        "Stripe customer portal session creation failed"
-      );
+      return {
+        data: null,
+        error: error instanceof ResultError ? error : new ResultError("Delete failed", 500, "STORAGE_ERROR")
+      };
     }
   }
 };
-var RazorpayPayments = class {
+var Storage = class {
   constructor(http) {
     this.http = http;
   }
-  async createOrder(environment, request) {
-    try {
-      const data = await this.http.post(
-        `${providerEnvironmentPath("razorpay", environment)}/orders`,
-        request
-      );
-      return { data, error: null };
-    } catch (error) {
-      return wrapError(error, "Razorpay order creation failed");
-    }
+  http;
+  /**
+   * Get a bucket instance for operations
+   * @param bucketName - Name of the bucket
+   */
+  from(bucketName) {
+    return new StorageBucket(bucketName, this.http);
   }
-  async verifyOrder(environment, request) {
-    try {
-      const data = await this.http.post(
-        `${providerEnvironmentPath("razorpay", environment)}/orders/verify`,
-        request
-      );
-      return { data, error: null };
-    } catch (error) {
-      return wrapError(error, "Razorpay order verification failed");
-    }
+};
+
+// src/modules/support.ts
+var DEFAULT_ENDPOINT2 = "https://beta.result.dev";
+var Support = class {
+  handle;
+  endpoint;
+  // Fallback for non-browser runtimes and private mode.
+  mem = { threads: [] };
+  constructor(options) {
+    this.handle = options?.handle ?? "";
+    this.endpoint = (options?.endpoint || DEFAULT_ENDPOINT2).replace(/\/$/, "");
   }
-  async createSubscription(environment, request) {
-    try {
-      const data = await this.http.post(
-        `${providerEnvironmentPath("razorpay", environment)}/subscriptions`,
-        request
-      );
-      return { data, error: null };
-    } catch (error) {
-      return wrapError(
-        error,
-        "Razorpay subscription creation failed"
-      );
-    }
+  /**
+   * Start a new support conversation. The returned access key is stored
+   * locally so `getThread`/`sendMessage` work without passing it around.
+   */
+  async startThread(options) {
+    const guard = this.requireHandle();
+    if (guard) return { data: null, error: guard };
+    const { data, error } = await this.request(
+      "POST",
+      "/api/support/threads",
+      {
+        username: this.handle,
+        email: options.email,
+        name: options.name,
+        message: options.message
+      }
+    );
+    if (data) {
+      this.remember(data.id, data.accessKey, options);
+    }
+    return { data, error };
+  }
+  /** Fetch a thread (status + full message history) with its stored access key. */
+  async getThread(threadId, accessKey) {
+    const guard = this.requireHandle();
+    if (guard) return { data: null, error: guard };
+    const key = accessKey ?? this.keyFor(threadId);
+    if (!key) {
+      return { data: null, error: this.missingKey(threadId) };
+    }
+    const { data, error } = await this.request(
+      "GET",
+      `/api/support/threads/${encodeURIComponent(threadId)}?key=${encodeURIComponent(key)}`
+    );
+    return { data: data?.thread ?? null, error };
+  }
+  /** Send a visitor reply on an existing thread (reopens it if closed). */
+  async sendMessage(threadId, message, accessKey) {
+    const guard = this.requireHandle();
+    if (guard) return { data: null, error: guard };
+    const key = accessKey ?? this.keyFor(threadId);
+    if (!key) {
+      return { data: null, error: this.missingKey(threadId) };
+    }
+    const { data, error } = await this.request(
+      "POST",
+      `/api/support/threads/${encodeURIComponent(threadId)}/messages`,
+      { message, key }
+    );
+    return { data, error };
+  }
+  /** Threads started from this browser (ids only; fetch each with getThread). */
+  listThreads() {
+    return this.load().threads.map(({ id }) => ({ id }));
+  }
+  /** The contact details used when this browser last started a thread. */
+  getContact() {
+    return this.load().contact;
+  }
+  // -- internals -------------------------------------------------------------
+  requireHandle() {
+    if (this.handle) return null;
+    return new ResultError(
+      "Missing support handle. Pass support: { handle } to createClient().",
+      400,
+      "MISSING_FIELD"
+    );
   }
-  async verifySubscription(environment, request) {
-    try {
-      const data = await this.http.post(
-        `${providerEnvironmentPath("razorpay", environment)}/subscriptions/verify`,
-        request
-      );
-      return { data, error: null };
-    } catch (error) {
-      return wrapError(
-        error,
-        "Razorpay subscription verification failed"
-      );
-    }
+  missingKey(threadId) {
+    return new ResultError(
+      `No access key stored for thread ${threadId}. Pass the accessKey returned by startThread().`,
+      401,
+      "AUTH_UNAUTHORIZED"
+    );
   }
-  async cancelSubscription(environment, subscriptionId, request = {}) {
+  async request(method, path, body) {
     try {
-      const data = await this.http.post(
-        `${providerEnvironmentPath("razorpay", environment)}/subscriptions/${encodeURIComponent(
-          subscriptionId
-        )}/cancel`,
-        request
-      );
-      return { data, error: null };
+      const response = await fetch(`${this.endpoint}${path}`, {
+        method,
+        headers: body ? { "Content-Type": "application/json" } : void 0,
+        body: body ? JSON.stringify(body) : void 0
+      });
+      const payload = await response.json().catch(() => null);
+      if (!response.ok) {
+        return {
+          data: null,
+          error: new ResultError(
+            payload?.error?.message ?? `Support request failed (${response.status})`,
+            response.status,
+            payload?.error?.code ?? "UNKNOWN_ERROR"
+          )
+        };
+      }
+      return { data: payload, error: null };
     } catch (error) {
-      return wrapError(
-        error,
-        "Razorpay subscription cancellation failed"
-      );
+      if (error instanceof Error && error.name === "AbortError") {
+        throw error;
+      }
+      return {
+        data: null,
+        error: new ResultError(
+          error instanceof Error ? error.message : "Support request failed",
+          500,
+          "UNKNOWN_ERROR"
+        )
+      };
     }
   }
-  async pauseSubscription(environment, subscriptionId) {
+  storageKey() {
+    return `rsup_${this.handle}`;
+  }
+  load() {
     try {
-      const data = await this.http.post(
-        `${providerEnvironmentPath("razorpay", environment)}/subscriptions/${encodeURIComponent(
-          subscriptionId
-        )}/pause`,
-        {}
-      );
-      return { data, error: null };
-    } catch (error) {
-      return wrapError(
-        error,
-        "Razorpay subscription pause failed"
-      );
+      const raw = localStorage.getItem(this.storageKey());
+      if (raw) {
+        const parsed = JSON.parse(raw);
+        if (parsed && Array.isArray(parsed.threads)) {
+          return parsed;
+        }
+      }
+    } catch {
     }
+    return this.mem;
   }
-  async resumeSubscription(environment, subscriptionId) {
+  save(state) {
+    this.mem = state;
     try {
-      const data = await this.http.post(
-        `${providerEnvironmentPath("razorpay", environment)}/subscriptions/${encodeURIComponent(
-          subscriptionId
-        )}/resume`,
-        {}
-      );
-      return { data, error: null };
-    } catch (error) {
-      return wrapError(
-        error,
-        "Razorpay subscription resume failed"
-      );
+      localStorage.setItem(this.storageKey(), JSON.stringify(state));
+    } catch {
     }
   }
-};
-var Payments = class {
-  constructor(http) {
-    this.stripe = new StripePayments(http);
-    this.razorpay = new RazorpayPayments(http);
+  keyFor(threadId) {
+    return this.load().threads.find((thread) => thread.id === threadId)?.key;
+  }
+  remember(id, key, options) {
+    const state = this.load();
+    const threads = state.threads.filter((thread) => thread.id !== id);
+    threads.unshift({ id, key });
+    this.save({
+      contact: {
+        email: options.email,
+        name: options.name ?? state.contact?.name
+      },
+      threads
+    });
   }
 };
-var InsForgeClient = class {
+
+// src/client.ts
+var ResultClient = class {
+  http;
+  tokenManager;
+  auth;
+  database;
+  storage;
+  ai;
+  functions;
+  realtime;
+  emails;
+  analytics;
+  support;
   constructor(config = {}) {
     const logger = new Logger(config.debug);
     this.tokenManager = new TokenManager();
@@ -2915,7 +3637,8 @@ var InsForgeClient = class {
       () => this.http.getValidAccessToken()
     );
     this.emails = new Emails(this.http);
-    this.payments = new Payments(this.http);
+    this.analytics = new Analytics(config.analytics);
+    this.support = new Support(config.support);
   }
   /**
    * Get the underlying HTTP client for custom requests
@@ -2939,16 +3662,16 @@ var InsForgeClient = class {
    *
    * Use this when an external auth provider (Better Auth, Clerk, Auth0,
    * WorkOS, Kinde, Stytch, …) issues the JWT and you need to keep the
-   * long-lived InsForge client in sync. Without this, you'd have to call
+   * long-lived Result client in sync. Without this, you'd have to call
    * `client.getHttpClient().setAuthToken(token)` AND reach into the private
    * realtime token manager separately.
    *
    * @example
    * ```typescript
-   * import { AuthChangeEvent } from '@insforge/sdk';
+   * import { AuthChangeEvent } from '@resultdev/sdk';
    *
    * // Refresh a third-party-issued JWT periodically
-   * const { token } = await fetch('/api/insforge-token').then((r) => r.json());
+   * const { token } = await fetch('/api/backend-token').then((r) => r.json());
    * client.setAccessToken(token, AuthChangeEvent.TOKEN_REFRESHED);
    *
    * // Sign-out
@@ -2963,193 +3686,142 @@ var InsForgeClient = class {
       this.tokenManager.setAccessToken(token, event);
     }
   }
-  /**
-   * Future modules will be added here:
-   * - database: Database operations
-   * - storage: File storage operations
-   * - functions: Serverless functions
-   * - tables: Table management
-   * - metadata: Backend metadata
-   */
 };
-var DEFAULT_ACCESS_TOKEN_COOKIE = "insforge_access_token";
-var DEFAULT_REFRESH_TOKEN_COOKIE = "insforge_refresh_token";
-var EXPIRED_DATE = /* @__PURE__ */ new Date(0);
-function getAccessTokenCookieName(names) {
-  return names?.accessToken ?? DEFAULT_ACCESS_TOKEN_COOKIE;
-}
-function getRefreshTokenCookieName(names) {
-  return names?.refreshToken ?? DEFAULT_REFRESH_TOKEN_COOKIE;
-}
-function getCookieValue(cookies, name) {
-  if (!cookies) {
-    return null;
-  }
-  const value = cookies.get(name);
-  if (typeof value === "string") {
-    return value || null;
-  }
-  if (value && typeof value.value === "string") {
-    return value.value || null;
-  }
-  return null;
-}
-function getCookieValueFromHeader(cookieHeader, name) {
-  if (!cookieHeader) {
-    return null;
-  }
-  const parts = cookieHeader.split(";");
-  for (const part of parts) {
-    const [rawName, ...rawValue] = part.trim().split("=");
-    if (rawName !== name) {
-      continue;
-    }
-    try {
-      return decodeURIComponent(rawValue.join("="));
-    } catch {
-      return rawValue.join("=");
-    }
-  }
-  return null;
-}
-function getBrowserCookie(name) {
-  if (typeof document === "undefined") {
-    return null;
-  }
-  return getCookieValueFromHeader(document.cookie, name);
-}
-function defaultCookieOptions() {
-  const secure = typeof process !== "undefined" ? process.env.NODE_ENV === "production" : typeof location !== "undefined" && location.protocol === "https:";
-  return {
-    path: "/",
-    sameSite: "lax",
-    secure
-  };
-}
-function accessTokenCookieOptions(token, overrides) {
-  return {
-    ...defaultCookieOptions(),
-    httpOnly: false,
-    expires: getJwtExpiration(token) ?? void 0,
-    ...overrides
-  };
-}
-function refreshTokenCookieOptions(token, overrides) {
-  return {
-    ...defaultCookieOptions(),
-    httpOnly: true,
-    expires: getJwtExpiration(token) ?? void 0,
-    ...overrides
-  };
-}
-function expiredCookieOptions(overrides) {
-  const { expires: _expires, maxAge: _maxAge, ...safeOverrides } = overrides ?? {};
-  return {
-    ...defaultCookieOptions(),
-    ...safeOverrides,
-    expires: EXPIRED_DATE,
-    maxAge: 0
-  };
-}
-function setCookie(cookies, name, value, options) {
-  if (!cookies?.set) {
-    return;
-  }
-  cookies.set(name, value, options);
-}
-function deleteCookie(cookies, name, options) {
-  if (!cookies) {
-    return;
+
+// src/ssr/server-client.ts
+function createServerClient(options = {}) {
+  let { baseUrl, anonKey } = options;
+  try {
+    baseUrl ||= process.env.NEXT_PUBLIC_BACKEND_URL;
+    anonKey ||= process.env.NEXT_PUBLIC_BACKEND_ANON_KEY;
+  } catch {
   }
-  if (cookies.set) {
-    cookies.set(name, "", expiredCookieOptions(options));
-    return;
+  if (!baseUrl || !anonKey) {
+    throw new Error(
+      "Missing Result baseUrl or anonKey. Pass baseUrl and anonKey to createServerClient() or set NEXT_PUBLIC_BACKEND_URL and NEXT_PUBLIC_BACKEND_ANON_KEY."
+    );
   }
-  cookies.delete?.(name);
+  const accessToken = options.accessToken ?? getCookieValue(options.cookies, getAccessTokenCookieName(options.names));
+  return new ResultClient({
+    ...options,
+    baseUrl,
+    anonKey,
+    isServerMode: true,
+    accessToken: accessToken ?? void 0,
+    // The cookie/option token is the only credential source here; shadow any
+    // untyped edgeFunctionToken smuggled through the options spread.
+    edgeFunctionToken: void 0
+  });
 }
-function serializeCookie(name, value, options = {}) {
-  const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
-  if (options.maxAge !== void 0) {
-    parts.push(`Max-Age=${options.maxAge}`);
-  }
-  if (options.domain) {
-    parts.push(`Domain=${options.domain}`);
-  }
-  if (options.path) {
-    parts.push(`Path=${options.path}`);
-  }
-  if (options.expires) {
-    parts.push(`Expires=${options.expires.toUTCString()}`);
-  }
-  if (options.httpOnly) {
-    parts.push("HttpOnly");
-  }
-  if (options.secure) {
-    parts.push("Secure");
-  }
-  if (options.sameSite) {
-    const sameSite = options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1);
-    parts.push(`SameSite=${sameSite}`);
+
+// src/ssr/auth-actions.ts
+function persistSessionCookies(cookies, data, settings) {
+  if (!data?.accessToken) {
+    return;
   }
-  return parts.join("; ");
-}
-function appendSetCookie(headers, name, value, options) {
-  headers.append("Set-Cookie", serializeCookie(name, value, options));
+  setAuthCookies(
+    cookies,
+    {
+      accessToken: data.accessToken,
+      refreshToken: data.refreshToken
+    },
+    settings
+  );
 }
-function setAuthCookies(cookies, tokens, settings = {}) {
-  const accessName = getAccessTokenCookieName(settings.names);
-  const refreshName = getRefreshTokenCookieName(settings.names);
-  const accessOptions = accessTokenCookieOptions(tokens.accessToken, settings.options?.accessToken);
-  setCookie(cookies, accessName, tokens.accessToken, accessOptions);
-  if (tokens.refreshToken) {
-    setCookie(
-      cookies,
-      refreshName,
-      tokens.refreshToken,
-      refreshTokenCookieOptions(tokens.refreshToken, settings.options?.refreshToken)
-    );
+function sanitizeAuthData(data) {
+  if (!data) {
+    return null;
   }
+  const {
+    accessToken: _accessToken,
+    refreshToken: _refreshToken,
+    csrfToken: _csrfToken,
+    ...safeData
+  } = data;
+  return safeData;
 }
-function clearAuthCookies(cookies, settings = {}) {
-  const accessName = getAccessTokenCookieName(settings.names);
-  const refreshName = getRefreshTokenCookieName(settings.names);
-  const accessOptions = expiredCookieOptions(settings.options?.accessToken);
-  const refreshOptions = expiredCookieOptions(settings.options?.refreshToken);
-  deleteCookie(cookies, accessName, accessOptions);
-  deleteCookie(cookies, refreshName, refreshOptions);
+function toSafeAuthResult(result) {
+  return {
+    data: sanitizeAuthData(result.data),
+    error: result.error
+  };
 }
-function setAuthCookieHeaders(headers, tokens, settings = {}) {
-  const accessName = getAccessTokenCookieName(settings.names);
-  const refreshName = getRefreshTokenCookieName(settings.names);
-  appendSetCookie(
-    headers,
-    accessName,
-    tokens.accessToken,
-    accessTokenCookieOptions(tokens.accessToken, settings.options?.accessToken)
-  );
-  if (tokens.refreshToken) {
-    appendSetCookie(
-      headers,
-      refreshName,
-      tokens.refreshToken,
-      refreshTokenCookieOptions(tokens.refreshToken, settings.options?.refreshToken)
+function createAuthActions(options = {}) {
+  const {
+    cookies,
+    requestCookies,
+    responseCookies,
+    names,
+    options: cookieOptions,
+    ...clientOptions
+  } = options;
+  const readCookies = requestCookies ?? cookies;
+  const writeCookies = responseCookies ?? cookies;
+  if (!writeCookies?.set) {
+    throw new Error(
+      "createAuthActions() requires a writable cookie store. Pass cookies in Server Actions or responseCookies in Route Handlers."
     );
   }
+  const cookieSettings = {
+    names,
+    options: cookieOptions
+  };
+  const createClient = () => createServerClient({
+    ...clientOptions,
+    names,
+    options: cookieOptions,
+    cookies: readCookies
+  });
+  return {
+    signUp: async (request) => {
+      const result = await createClient().auth.signUp(request);
+      persistSessionCookies(writeCookies, result.data, cookieSettings);
+      return toSafeAuthResult(result);
+    },
+    signInWithPassword: async (request) => {
+      const result = await createClient().auth.signInWithPassword(request);
+      persistSessionCookies(writeCookies, result.data, cookieSettings);
+      return toSafeAuthResult(
+        result
+      );
+    },
+    signInWithOAuth: async (providerOrOptions, signInOptions) => {
+      return createClient().auth.signInWithOAuth(
+        providerOrOptions,
+        signInOptions
+      );
+    },
+    signInWithIdToken: async (credentials) => {
+      const result = await createClient().auth.signInWithIdToken(credentials);
+      persistSessionCookies(writeCookies, result.data, cookieSettings);
+      return toSafeAuthResult(
+        result
+      );
+    },
+    exchangeOAuthCode: async (code, codeVerifier) => {
+      const result = await createClient().auth.exchangeOAuthCode(
+        code,
+        codeVerifier
+      );
+      persistSessionCookies(writeCookies, result.data, cookieSettings);
+      return toSafeAuthResult(
+        result
+      );
+    },
+    verifyEmail: async (request) => {
+      const result = await createClient().auth.verifyEmail(request);
+      persistSessionCookies(writeCookies, result.data, cookieSettings);
+      return toSafeAuthResult(result);
+    },
+    signOut: async () => {
+      const result = await createClient().auth.signOut();
+      clearAuthCookies(writeCookies, cookieSettings);
+      return result;
+    }
+  };
 }
-function clearAuthCookieHeaders(headers, settings = {}) {
-  appendSetCookie(
-    headers,
-    getAccessTokenCookieName(settings.names),
-    "",
-    expiredCookieOptions(settings.options?.accessToken)
-  );
-  appendSetCookie(
-    headers,
-    getRefreshTokenCookieName(settings.names),
-    "",
-    expiredCookieOptions(settings.options?.refreshToken)
-  );
-}
+
+// src/ssr/browser-client.ts
 async function parseRefreshResponse(response) {
   const contentType = response.headers.get("content-type");
   if (contentType?.includes("json")) {
@@ -3160,13 +3832,13 @@ async function parseRefreshResponse(response) {
 function toRefreshError(response, body) {
   if (body && typeof body === "object") {
     const errorBody = body;
-    return new InsForgeError(
+    return new ResultError(
       typeof errorBody.message === "string" ? errorBody.message : "Failed to refresh auth session",
       typeof errorBody.statusCode === "number" ? errorBody.statusCode : response.status,
       typeof errorBody.error === "string" ? errorBody.error : ERROR_CODES.UNKNOWN_ERROR
     );
   }
-  return new InsForgeError(
+  return new ResultError(
     typeof body === "string" && body ? body : "Failed to refresh auth session",
     response.status,
     ERROR_CODES.UNKNOWN_ERROR
@@ -3210,13 +3882,13 @@ function getRequestUrl(input) {
 function createBrowserClient(options = {}) {
   let { baseUrl, anonKey } = options;
   try {
-    baseUrl || (baseUrl = process.env.NEXT_PUBLIC_INSFORGE_URL);
-    anonKey || (anonKey = process.env.NEXT_PUBLIC_INSFORGE_ANON_KEY);
+    baseUrl ||= process.env.NEXT_PUBLIC_BACKEND_URL;
+    anonKey ||= process.env.NEXT_PUBLIC_BACKEND_ANON_KEY;
   } catch {
   }
   if (!baseUrl || !anonKey) {
     throw new Error(
-      "Missing InsForge baseUrl or anonKey. Pass baseUrl and anonKey to createBrowserClient() or set NEXT_PUBLIC_INSFORGE_URL and NEXT_PUBLIC_INSFORGE_ANON_KEY."
+      "Missing Result baseUrl or anonKey. Pass baseUrl and anonKey to createBrowserClient() or set NEXT_PUBLIC_BACKEND_URL and NEXT_PUBLIC_BACKEND_ANON_KEY."
     );
   }
   let accessToken = getBrowserCookie(getAccessTokenCookieName(options.names));
@@ -3231,7 +3903,9 @@ function createBrowserClient(options = {}) {
     }
     refreshPromise = (async () => {
       if (!fetchImpl) {
-        throw new Error("Fetch is not available. Please provide a fetch implementation.");
+        throw new Error(
+          "Fetch is not available. Please provide a fetch implementation."
+        );
       }
       const response = await fetchImpl(refreshUrl, {
         method: "POST",
@@ -3256,7 +3930,10 @@ function createBrowserClient(options = {}) {
         return null;
       }
       accessToken = refreshBody.accessToken;
-      client?.setAccessToken(refreshBody.accessToken, AuthChangeEvent.TOKEN_REFRESHED);
+      client?.setAccessToken(
+        refreshBody.accessToken,
+        AuthChangeEvent.TOKEN_REFRESHED
+      );
       return refreshBody;
     })().finally(() => {
       sessionChecked = true;
@@ -3270,7 +3947,9 @@ function createBrowserClient(options = {}) {
   };
   const ssrFetch = async (input, init) => {
     if (!fetchImpl) {
-      throw new Error("Fetch is not available. Please provide a fetch implementation.");
+      throw new Error(
+        "Fetch is not available. Please provide a fetch implementation."
+      );
     }
     if (shouldSkipRefresh(input)) {
       return fetchImpl(input, init);
@@ -3294,7 +3973,7 @@ function createBrowserClient(options = {}) {
     }
     return fetchImpl(input, withAuthHeader(init, refreshed.accessToken));
   };
-  client = new InsForgeClient({
+  client = new ResultClient({
     ...options,
     baseUrl,
     anonKey,
@@ -3319,30 +3998,8 @@ function createBrowserClient(options = {}) {
   }
   return client;
 }
-function createServerClient(options = {}) {
-  let { baseUrl, anonKey } = options;
-  try {
-    baseUrl || (baseUrl = process.env.NEXT_PUBLIC_INSFORGE_URL);
-    anonKey || (anonKey = process.env.NEXT_PUBLIC_INSFORGE_ANON_KEY);
-  } catch {
-  }
-  if (!baseUrl || !anonKey) {
-    throw new Error(
-      "Missing InsForge baseUrl or anonKey. Pass baseUrl and anonKey to createServerClient() or set NEXT_PUBLIC_INSFORGE_URL and NEXT_PUBLIC_INSFORGE_ANON_KEY."
-    );
-  }
-  const accessToken = options.accessToken ?? getCookieValue(options.cookies, getAccessTokenCookieName(options.names));
-  return new InsForgeClient({
-    ...options,
-    baseUrl,
-    anonKey,
-    isServerMode: true,
-    accessToken: accessToken ?? void 0,
-    // The cookie/option token is the only credential source here; shadow any
-    // untyped edgeFunctionToken smuggled through the options spread.
-    edgeFunctionToken: void 0
-  });
-}
+
+// src/ssr/refresh.ts
 function jsonResponse(body, init = {}, headers = new Headers(init.headers)) {
   headers.set("Content-Type", "application/json");
   return new Response(JSON.stringify(body), {
@@ -3351,18 +4008,18 @@ function jsonResponse(body, init = {}, headers = new Headers(init.headers)) {
   });
 }
 function normalizeError(error) {
-  if (error instanceof InsForgeError) {
+  if (error instanceof ResultError) {
     return error;
   }
   if (error && typeof error === "object") {
     const body = error;
-    return new InsForgeError(
+    return new ResultError(
       typeof body.message === "string" ? body.message : "Failed to refresh auth session",
       typeof body.statusCode === "number" ? body.statusCode : 500,
       typeof body.error === "string" ? body.error : ERROR_CODES.UNKNOWN_ERROR
     );
   }
-  return new InsForgeError(
+  return new ResultError(
     error instanceof Error ? error.message : "Failed to refresh auth session",
     500,
     ERROR_CODES.UNKNOWN_ERROR
@@ -3384,14 +4041,17 @@ function readRefreshToken(options) {
   if (cookieValue) {
     return cookieValue;
   }
-  return getCookieValueFromHeader(options.request?.headers.get("cookie"), refreshCookieName);
+  return getCookieValueFromHeader(
+    options.request?.headers.get("cookie"),
+    refreshCookieName
+  );
 }
 async function refreshAuth(options = {}) {
   const headers = new Headers();
   const refreshToken = readRefreshToken(options);
   if (!refreshToken) {
     clearAuthCookieHeaders(headers, options);
-    const error2 = new InsForgeError(
+    const error2 = new ResultError(
       "Refresh token cookie is missing",
       401,
       ERROR_CODES.AUTH_UNAUTHORIZED
@@ -3414,18 +4074,20 @@ async function refreshAuth(options = {}) {
   }
   let { baseUrl, anonKey } = options;
   try {
-    baseUrl || (baseUrl = process.env.NEXT_PUBLIC_INSFORGE_URL);
-    anonKey || (anonKey = process.env.NEXT_PUBLIC_INSFORGE_ANON_KEY);
+    baseUrl ||= process.env.NEXT_PUBLIC_BACKEND_URL;
+    anonKey ||= process.env.NEXT_PUBLIC_BACKEND_ANON_KEY;
   } catch {
   }
   if (!baseUrl || !anonKey) {
     throw new Error(
-      "Missing InsForge baseUrl or anonKey. Pass baseUrl and anonKey to refreshAuth() or set NEXT_PUBLIC_INSFORGE_URL and NEXT_PUBLIC_INSFORGE_ANON_KEY."
+      "Missing Result baseUrl or anonKey. Pass baseUrl and anonKey to refreshAuth() or set NEXT_PUBLIC_BACKEND_URL and NEXT_PUBLIC_BACKEND_ANON_KEY."
     );
   }
   const fetchImpl = options.fetch ?? (globalThis.fetch ? globalThis.fetch.bind(globalThis) : void 0);
   if (!fetchImpl) {
-    throw new Error("Fetch is not available. Please provide a fetch implementation.");
+    throw new Error(
+      "Fetch is not available. Please provide a fetch implementation."
+    );
   }
   const requestHeaders = new Headers(options.headers);
   requestHeaders.set("Authorization", `Bearer ${anonKey}`);
@@ -3503,99 +4165,8 @@ function createRefreshAuthRouter(options = {}) {
     POST: async (request) => (await refreshAuth({ ...options, request })).response
   };
 }
-function persistSessionCookies(cookies, data, settings) {
-  if (!data?.accessToken) {
-    return;
-  }
-  setAuthCookies(
-    cookies,
-    {
-      accessToken: data.accessToken,
-      refreshToken: data.refreshToken
-    },
-    settings
-  );
-}
-function sanitizeAuthData(data) {
-  if (!data) {
-    return null;
-  }
-  const {
-    accessToken: _accessToken,
-    refreshToken: _refreshToken,
-    csrfToken: _csrfToken,
-    ...safeData
-  } = data;
-  return safeData;
-}
-function toSafeAuthResult(result) {
-  return {
-    data: sanitizeAuthData(result.data),
-    error: result.error
-  };
-}
-function createAuthActions(options = {}) {
-  const {
-    cookies,
-    requestCookies,
-    responseCookies,
-    names,
-    options: cookieOptions,
-    ...clientOptions
-  } = options;
-  const readCookies = requestCookies ?? cookies;
-  const writeCookies = responseCookies ?? cookies;
-  if (!writeCookies?.set) {
-    throw new Error(
-      "createAuthActions() requires a writable cookie store. Pass cookies in Server Actions or responseCookies in Route Handlers."
-    );
-  }
-  const cookieSettings = {
-    names,
-    options: cookieOptions
-  };
-  const createClient = () => createServerClient({
-    ...clientOptions,
-    names,
-    options: cookieOptions,
-    cookies: readCookies
-  });
-  return {
-    signUp: async (request) => {
-      const result = await createClient().auth.signUp(request);
-      persistSessionCookies(writeCookies, result.data, cookieSettings);
-      return toSafeAuthResult(result);
-    },
-    signInWithPassword: async (request) => {
-      const result = await createClient().auth.signInWithPassword(request);
-      persistSessionCookies(writeCookies, result.data, cookieSettings);
-      return toSafeAuthResult(result);
-    },
-    signInWithOAuth: async (providerOrOptions, signInOptions) => {
-      return createClient().auth.signInWithOAuth(providerOrOptions, signInOptions);
-    },
-    signInWithIdToken: async (credentials) => {
-      const result = await createClient().auth.signInWithIdToken(credentials);
-      persistSessionCookies(writeCookies, result.data, cookieSettings);
-      return toSafeAuthResult(result);
-    },
-    exchangeOAuthCode: async (code, codeVerifier) => {
-      const result = await createClient().auth.exchangeOAuthCode(code, codeVerifier);
-      persistSessionCookies(writeCookies, result.data, cookieSettings);
-      return toSafeAuthResult(result);
-    },
-    verifyEmail: async (request) => {
-      const result = await createClient().auth.verifyEmail(request);
-      persistSessionCookies(writeCookies, result.data, cookieSettings);
-      return toSafeAuthResult(result);
-    },
-    signOut: async () => {
-      const result = await createClient().auth.signOut();
-      clearAuthCookies(writeCookies, cookieSettings);
-      return result;
-    }
-  };
-}
+
+// src/ssr/update-session.ts
 async function updateSession(options) {
   const accessCookieName = getAccessTokenCookieName(options.names);
   const refreshCookieName = getRefreshTokenCookieName(options.names);
@@ -3607,7 +4178,10 @@ async function updateSession(options) {
       error: null
     };
   }
-  const refreshToken = getCookieValue(options.requestCookies, refreshCookieName);
+  const refreshToken = getCookieValue(
+    options.requestCookies,
+    refreshCookieName
+  );
   if (!refreshToken) {
     if (accessToken) {
       clearAuthCookies(options.requestCookies, options);