@sentroy-co/client-sdk 2.13.6 → 2.13.8

package/dist/auth/admin/index.d.ts

@@ -0,0 +1,52 @@
+import type { SentroyAuthUser } from "../types";
+/**
+ * Server-side Sentroy Auth admin SDK. **Node only — apiKey browser'a
+ * koymayın**; bu sınıf Project'in master `aps_` token'ını taşır ve
+ * Sentroy üzerindeki user pool'a yetki vermez.
+ *
+ * Tipik kullanım: backend, kendi `/api/auth/...` proxy'sinde RP-spesifik
+ * authorization yapar, sonra `admin.users.get(...)` ile Sentroy'dan
+ * end-user'ı çeker. JWT verify de bu SDK üzerinden — tüm akış stateless.
+ */
+export interface SentroyAuthAdminOptions {
+    authBaseUrl?: string;
+    projectSlug: string;
+    apiKey: string;
+}
+export declare class SentroyAuthAdmin {
+    private readonly http;
+    private cachedJwks;
+    constructor(opts: SentroyAuthAdminOptions);
+    users: {
+        list: (opts?: {
+            limit?: number;
+            skip?: number;
+            emailVerified?: boolean;
+        }) => Promise<{
+            items: SentroyAuthUser[];
+            pagination: {
+                total: number;
+                limit: number;
+                skip: number;
+            };
+        }>;
+    };
+    /**
+     * Local verify — JWKS cache'lenir (5dk TTL), JWT signature kontrolü
+     * RS256 ile RP backend'inde stateless yapılır. `iss`/`aud` claim
+     * eşleşmesi de kontrol edilir.
+     */
+    verifyIdToken(token: string): Promise<{
+        sub: string;
+        email?: string;
+        email_verified?: boolean;
+        name?: string;
+        picture?: string;
+        iss: string;
+        aud: string;
+        iat: number;
+        exp: number;
+    }>;
+    private fetchJwks;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/admin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/admin/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE/C;;;;;;;;GAQG;AAEH,MAAM,WAAW,uBAAuB;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAU;IAC/B,OAAO,CAAC,UAAU,CAAmD;gBAEzD,IAAI,EAAE,uBAAuB;IAMzC,KAAK;sBACU;YACX,KAAK,CAAC,EAAE,MAAM,CAAA;YACd,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,aAAa,CAAC,EAAE,OAAO,CAAA;SACxB,KAAQ,OAAO,CAAC;YACf,KAAK,EAAE,eAAe,EAAE,CAAA;YACxB,UAAU,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAA;SAC3D,CAAC;MAQH;IAID;;;;OAIG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAC1C,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,cAAc,CAAC,EAAE,OAAO,CAAA;QACxB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,CAAC;YAiDY,SAAS;CAaxB"}

package/dist/auth/admin/index.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SentroyAuthAdmin = void 0;
+const http_1 = require("../http");
+class SentroyAuthAdmin {
+    http;
+    cachedJwks = null;
+    constructor(opts) {
+        this.http = new http_1.AuthHttp(opts);
+    }
+    // ─── User pool admin ──────────────────────────────────────────────────
+    users = {
+        list: (opts = {}) => {
+            throw new Error("admin.users.list requires session-authenticated admin API; use dashboard /api/companies/[slug]/auth-projects/[id]/users instead. (v2 admin SDK will proxy this with stk_ tokens.)");
+            // NOTE Phase 5+: SDK admin endpoint'leri public path'lere taşınmadı;
+            // şu an `/api/companies/...` cookie-auth ile. v2'de `/api/v1/admin/...`
+            // RP token'ı ile authenticate eden ayrı public admin layer eklenir.
+        },
+    };
+    // ─── ID token verification ─────────────────────────────────────────────
+    /**
+     * Local verify — JWKS cache'lenir (5dk TTL), JWT signature kontrolü
+     * RS256 ile RP backend'inde stateless yapılır. `iss`/`aud` claim
+     * eşleşmesi de kontrol edilir.
+     */
+    async verifyIdToken(token) {
+        const parts = token.split(".");
+        if (parts.length !== 3) {
+            throw new Error("Malformed JWT — expected three segments.");
+        }
+        const [headerB64, payloadB64, sigB64] = parts;
+        const header = JSON.parse(decodeBase64Url(headerB64));
+        if (header.alg !== "RS256") {
+            throw new Error("Only RS256 supported.");
+        }
+        const claims = JSON.parse(decodeBase64Url(payloadB64));
+        if (typeof claims.exp !== "number" || claims.exp * 1000 < Date.now()) {
+            throw new Error("Token expired.");
+        }
+        // iss + aud check
+        const expectedIssSuffix = `/p/${this.http.projectSlug}`;
+        if (typeof claims.iss !== "string" || !claims.iss.endsWith(expectedIssSuffix)) {
+            throw new Error("Issuer mismatch.");
+        }
+        // aud == project apiKeyPrefix (12 chars). API key first 12 = aud check.
+        if (typeof claims.aud !== "string" ||
+            !this.http.apiKey?.startsWith(claims.aud)) {
+            throw new Error("Audience mismatch.");
+        }
+        const jwks = await this.fetchJwks();
+        const key = jwks.keys.find((k) => k.kid === header.kid) ?? jwks.keys[0];
+        if (!key)
+            throw new Error("No public key in JWKS.");
+        await verifyRsaSignature({
+            data: `${headerB64}.${payloadB64}`,
+            sigB64,
+            jwk: key,
+        });
+        return claims;
+    }
+    async fetchJwks() {
+        if (this.cachedJwks)
+            return this.cachedJwks;
+        const jwks = await this.http.request("/jwks.json", { method: "GET" });
+        this.cachedJwks = jwks;
+        // 5dk cache — basit setTimeout invalidation
+        setTimeout(() => {
+            this.cachedJwks = null;
+        }, 5 * 60 * 1000);
+        return jwks;
+    }
+}
+exports.SentroyAuthAdmin = SentroyAuthAdmin;
+// ─── Helpers ─────────────────────────────────────────────────────────────
+function decodeBase64Url(s) {
+    const padded = s.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - (padded.length % 4));
+    if (typeof atob === "function") {
+        const binary = atob(padded + pad);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++)
+            bytes[i] = binary.charCodeAt(i);
+        return new TextDecoder().decode(bytes);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const B = globalThis.Buffer;
+    if (B)
+        return B.from(padded + pad, "base64").toString("utf8");
+    throw new Error("No base64 decoder available");
+}
+function base64UrlToBytes(s) {
+    const padded = s.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - (padded.length % 4));
+    if (typeof atob === "function") {
+        const binary = atob(padded + pad);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++)
+            bytes[i] = binary.charCodeAt(i);
+        return bytes;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const B = globalThis.Buffer;
+    if (B)
+        return new Uint8Array(B.from(padded + pad, "base64"));
+    throw new Error("No base64 decoder available");
+}
+async function verifyRsaSignature(input) {
+    // Browser + modern Node (>=18) have crypto.subtle. Tek kod yolu.
+    const subtle = typeof crypto !== "undefined" && crypto.subtle ? crypto.subtle : null;
+    if (!subtle) {
+        throw new Error("Web Crypto unavailable — upgrade Node >= 18 or run in a browser.");
+    }
+    const key = await subtle.importKey("jwk", input.jwk, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+    // Web Crypto types want ArrayBuffer-backed BufferSource. TypeScript
+    // can't prove Uint8Array isn't SharedArrayBuffer-backed (DOM lib edge);
+    // bytes are created fresh from base64 decode so ArrayBuffer-safe — cast.
+    const sigBytes = base64UrlToBytes(input.sigB64);
+    const dataBytes = new TextEncoder().encode(input.data);
+    const ok = await subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, sigBytes, dataBytes);
+    if (!ok)
+        throw new Error("Signature mismatch.");
+}
+//# sourceMappingURL=index.js.map

package/dist/auth/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/admin/index.ts"],"names":[],"mappings":";;;AAAA,kCAAkC;AAmBlC,MAAa,gBAAgB;IACV,IAAI,CAAU;IACvB,UAAU,GAA+C,IAAI,CAAA;IAErE,YAAY,IAA6B;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,eAAQ,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC;IAED,yEAAyE;IAEzE,KAAK,GAAG;QACN,IAAI,EAAE,CAAC,OAIH,EAAE,EAGH,EAAE;YACH,MAAM,IAAI,KAAK,CACb,mLAAmL,CACpL,CAAA;YACD,qEAAqE;YACrE,wEAAwE;YACxE,oEAAoE;QACtE,CAAC;KACF,CAAA;IAED,0EAA0E;IAE1E;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAW/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAGnD,CAAA;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,CAIpD,CAAA;QACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;QACnC,CAAC;QACD,kBAAkB;QAClB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;QACvD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;QACrC,CAAC;QACD,wEAAwE;QACxE,IACE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAE,CAAsB,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAClD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAEnD,MAAM,kBAAkB,CAAC;YACvB,IAAI,EAAE,GAAG,SAAS,IAAI,UAAU,EAAE;YAClC,MAAM;YACN,GAAG,EAAE,GAAiB;SACvB,CAAC,CAAA;QAEF,OAAO,MAAe,CAAA;IACxB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAA;QAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAClC,YAAY,EACZ,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAA;QACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;QACtB,4CAA4C;QAC5C,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;QACxB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AA3GD,4CA2GC;AAED,4EAA4E;AAE5E,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9E,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACvE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IACD,8DAA8D;IAC9D,MAAM,CAAC,GAAI,UAAkB,CAAC,MAAM,CAAA;IACpC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7D,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9E,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACvE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,8DAA8D;IAC9D,MAAM,CAAC,GAAI,UAAkB,CAAC,MAAM,CAAA;IACpC,IAAI,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC5D,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;AAChD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAIjC;IACC,iEAAiE;IACjE,MAAM,MAAM,GACV,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACvE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAChC,KAAK,EACL,KAAK,CAAC,GAAG,EACT,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAA;IACD,oEAAoE;IACpE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAe,CAAA;IAC7D,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAe,CAAA;IACpE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAC5B,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,QAAkC,EAClC,SAAmC,CACpC,CAAA;IACD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;AACjD,CAAC"}

package/dist/auth/client.d.ts

@@ -0,0 +1,86 @@
+import { type SentroyAuthUser, type SignupResponse, type LoginResponse } from "./types";
+import { type AuthHttpOptions } from "./http";
+/**
+ * Browser-facing Sentroy Auth SDK — Firebase Auth tarzı session API.
+ *
+ * `apiKey` BROWSER'DA OLMAMALI; bu sınıf `apiKey`'i header'a koyacaktır.
+ * RP backend gerçek api-key tutar; browser'da end-user kendi access/refresh
+ * token'larıyla yaşar. Yine de DX için sınıf hem apiKey-less browser
+ * akışına (signup/login backend proxy üzerinden) hem apiKey'li server
+ * akışına (admin) tek tip API sunar — caller hangi mod'da olduğunu
+ * `SentroyAuthAdmin` (admin SDK, sunucu) vs `SentroyAuth` (browser SDK,
+ * apiKey-less) seçimiyle netleştirir.
+ *
+ * Storage: browser'da access + refresh `storage` adapter'a yazılır
+ * (default `localStorage`). Refresh expire'a 5dk kala arka planda
+ * yenilenir; fail olursa `onAuthStateChanged(null)` ve storage silinir.
+ *
+ * **Server-side rendering**: `typeof window === "undefined"` korumalı —
+ * Node ortamında `localStorage` yok, default `memory` storage'a düşer.
+ */
+export type AuthStateChangeListener = (user: SentroyAuthUser | null) => void;
+export interface AuthStorageAdapter {
+    read(): {
+        accessToken: string;
+        refreshToken: string;
+        user: SentroyAuthUser;
+    } | null;
+    write(value: {
+        accessToken: string;
+        refreshToken: string;
+        user: SentroyAuthUser;
+    }): void;
+    clear(): void;
+}
+export interface SentroyAuthOptions extends AuthHttpOptions {
+    /** Token persistence stratejisi. Default `"localStorage"` browser'da,
+     *  Node'da otomatik `"memory"`. Custom için adapter geçilebilir. */
+    storage?: "localStorage" | "memory" | AuthStorageAdapter;
+    /** Background refresh tetikleme süresi (saniye, expiresIn altında).
+     *  Default 300 (5dk). */
+    refreshSkew?: number;
+}
+export declare class SentroyAuth {
+    private readonly http;
+    private readonly storage;
+    private readonly listeners;
+    private readonly refreshSkew;
+    private refreshTimer;
+    private currentUser;
+    constructor(opts: SentroyAuthOptions);
+    get user(): SentroyAuthUser | null;
+    get accessToken(): string | null;
+    signUp(input: {
+        email: string;
+        password: string;
+        displayName?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<SignupResponse>;
+    signIn(input: {
+        email: string;
+        password: string;
+    }): Promise<LoginResponse>;
+    signOut(): Promise<void>;
+    sendPasswordReset(email: string): Promise<void>;
+    verifyEmail(token: string): Promise<SentroyAuthUser>;
+    /**
+     * Subscription pattern — Firebase Auth uyumlu. Caller'ın hemen mevcut
+     * state'i alabilmesi için constructor'da restore edilen user
+     * subscribe sırasında bir kez dispatch edilir.
+     */
+    onAuthStateChanged(listener: AuthStateChangeListener): () => void;
+    private persist;
+    private clearSession;
+    private notify;
+    /**
+     * JWT'nin `exp` claim'inden expiry'i tahmin et. Parsing fail ise
+     * 1 saat varsay (default access TTL). Refresh window: exp - skew.
+     *
+     * **Browser-safe**: `Buffer` Node'a özel, tarayıcıda yok. `atob`
+     * + URL-safe charset normalization ile decode ediyoruz.
+     */
+    private estimateExpiry;
+    private scheduleRefresh;
+    private refresh;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/auth/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/auth/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,SAAS,CAAA;AAChB,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,QAAQ,CAAA;AAEvD;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,KAAK,IAAI,CAAA;AAE5E,MAAM,WAAW,kBAAkB;IACjC,IAAI,IAAI;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,eAAe,CAAA;KAAE,GAAG,IAAI,CAAA;IACnF,KAAK,CAAC,KAAK,EAAE;QACX,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,eAAe,CAAA;KACtB,GAAG,IAAI,CAAA;IACR,KAAK,IAAI,IAAI,CAAA;CACd;AA+ED,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD;wEACoE;IACpE,OAAO,CAAC,EAAE,cAAc,GAAG,QAAQ,GAAG,kBAAkB,CAAA;IACxD;6BACyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,YAAY,CAA6C;IACjE,OAAO,CAAC,WAAW,CAA+B;gBAEtC,IAAI,EAAE,kBAAkB;IA2BpC,IAAI,IAAI,IAAI,eAAe,GAAG,IAAI,CAEjC;IAED,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAEK,MAAM,CAAC,KAAK,EAAE;QAClB,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACnC,GAAG,OAAO,CAAC,cAAc,CAAC;IAerB,MAAM,CAAC,KAAK,EAAE;QAClB,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,aAAa,CAAC;IAapB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAexB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAiB1D;;;;OAIG;IACH,kBAAkB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,IAAI;IAYjE,OAAO,CAAC,OAAO;IAWf,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,MAAM;IAUd;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,eAAe;YAaT,OAAO;CAiBtB"}

package/dist/auth/client.js

@@ -0,0 +1,265 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SentroyAuth = void 0;
+const http_1 = require("./http");
+const STORAGE_KEY_PREFIX = "sentroy.auth";
+/**
+ * Base64URL → UTF-8 decode. Browser'da `atob` + manuel UTF-8 reconstruction;
+ * Node'da `Buffer.from(..., "base64url")`. Tek kod yolu, runtime detect.
+ */
+function decodeBase64Url(s) {
+    // Pad + standard base64
+    const padded = s.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - (padded.length % 4));
+    if (typeof atob === "function") {
+        const binary = atob(padded + pad);
+        // UTF-8 reconstruction (JWT claims yabancı karakter içerebilir)
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++)
+            bytes[i] = binary.charCodeAt(i);
+        return new TextDecoder().decode(bytes);
+    }
+    // Node fallback
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const B = globalThis.Buffer;
+    if (B)
+        return B.from(padded + pad, "base64").toString("utf8");
+    throw new Error("No base64 decoder available");
+}
+function localStorageAdapter(projectSlug) {
+    if (typeof window === "undefined" || !window.localStorage) {
+        return memoryStorageAdapter();
+    }
+    const key = `${STORAGE_KEY_PREFIX}.${projectSlug}`;
+    return {
+        read() {
+            try {
+                const raw = window.localStorage.getItem(key);
+                if (!raw)
+                    return null;
+                return JSON.parse(raw);
+            }
+            catch {
+                return null;
+            }
+        },
+        write(value) {
+            try {
+                window.localStorage.setItem(key, JSON.stringify(value));
+            }
+            catch {
+                // QuotaExceeded, etc — degrade to memory silently.
+            }
+        },
+        clear() {
+            try {
+                window.localStorage.removeItem(key);
+            }
+            catch {
+                // ignore
+            }
+        },
+    };
+}
+function memoryStorageAdapter() {
+    let store = null;
+    return {
+        read: () => store,
+        write: (value) => {
+            store = value;
+        },
+        clear: () => {
+            store = null;
+        },
+    };
+}
+class SentroyAuth {
+    http;
+    storage;
+    listeners = new Set();
+    refreshSkew;
+    refreshTimer = null;
+    currentUser = null;
+    constructor(opts) {
+        this.http = new http_1.AuthHttp(opts);
+        this.refreshSkew = opts.refreshSkew ?? 300;
+        if (opts.storage === "memory") {
+            this.storage = memoryStorageAdapter();
+        }
+        else if (opts.storage &&
+            typeof opts.storage === "object" &&
+            "read" in opts.storage) {
+            this.storage = opts.storage;
+        }
+        else {
+            this.storage = localStorageAdapter(opts.projectSlug);
+        }
+        // Restore from storage on construct — `onAuthStateChanged` listener'ları
+        // henüz yok; ilk subscribe sırasında dispatch edilir.
+        const restored = this.storage.read();
+        if (restored) {
+            this.currentUser = restored.user;
+            this.scheduleRefresh(this.estimateExpiry(restored.accessToken));
+        }
+    }
+    // ─── Public API ──────────────────────────────────────────────────────────
+    get user() {
+        return this.currentUser;
+    }
+    get accessToken() {
+        return this.storage.read()?.accessToken ?? null;
+    }
+    async signUp(input) {
+        const res = await this.http.request("/signup", {
+            method: "POST",
+            json: input,
+        });
+        if (res.accessToken && res.refreshToken) {
+            this.persist({
+                accessToken: res.accessToken,
+                refreshToken: res.refreshToken,
+                user: res.user,
+            });
+        }
+        return res;
+    }
+    async signIn(input) {
+        const res = await this.http.request("/login", {
+            method: "POST",
+            json: input,
+        });
+        this.persist({
+            accessToken: res.accessToken,
+            refreshToken: res.refreshToken,
+            user: res.user,
+        });
+        return res;
+    }
+    async signOut() {
+        const restored = this.storage.read();
+        if (restored?.refreshToken) {
+            // Best-effort revoke — fail'ı sessizce yut (network problem
+            // sign-out'u bloklamasın).
+            await this.http
+                .request("/logout", {
+                method: "POST",
+                json: { refreshToken: restored.refreshToken },
+            })
+                .catch(() => { });
+        }
+        this.clearSession();
+    }
+    async sendPasswordReset(email) {
+        await this.http.request("/password-reset/request", {
+            method: "POST",
+            json: { email },
+        });
+    }
+    async verifyEmail(token) {
+        const res = await this.http.request("/verify-email", { method: "POST", json: { token } });
+        if (this.currentUser && this.currentUser.id === res.user.id) {
+            const restored = this.storage.read();
+            if (restored) {
+                this.persist({ ...restored, user: res.user });
+            }
+            else {
+                this.currentUser = res.user;
+                this.notify();
+            }
+        }
+        return res.user;
+    }
+    /**
+     * Subscription pattern — Firebase Auth uyumlu. Caller'ın hemen mevcut
+     * state'i alabilmesi için constructor'da restore edilen user
+     * subscribe sırasında bir kez dispatch edilir.
+     */
+    onAuthStateChanged(listener) {
+        this.listeners.add(listener);
+        // Microtask gibi async dispatch — caller's `useEffect` cleanup race
+        // problemlerini önler.
+        Promise.resolve().then(() => listener(this.currentUser));
+        return () => {
+            this.listeners.delete(listener);
+        };
+    }
+    // ─── Internals ───────────────────────────────────────────────────────────
+    persist(value) {
+        this.storage.write(value);
+        this.currentUser = value.user;
+        this.notify();
+        this.scheduleRefresh(this.estimateExpiry(value.accessToken));
+    }
+    clearSession() {
+        this.storage.clear();
+        this.currentUser = null;
+        if (this.refreshTimer) {
+            clearTimeout(this.refreshTimer);
+            this.refreshTimer = null;
+        }
+        this.notify();
+    }
+    notify() {
+        for (const l of this.listeners) {
+            try {
+                l(this.currentUser);
+            }
+            catch {
+                // Listener hatası diğer subscriber'ları engellemesin.
+            }
+        }
+    }
+    /**
+     * JWT'nin `exp` claim'inden expiry'i tahmin et. Parsing fail ise
+     * 1 saat varsay (default access TTL). Refresh window: exp - skew.
+     *
+     * **Browser-safe**: `Buffer` Node'a özel, tarayıcıda yok. `atob`
+     * + URL-safe charset normalization ile decode ediyoruz.
+     */
+    estimateExpiry(accessToken) {
+        try {
+            const [, payloadB64] = accessToken.split(".");
+            const payload = JSON.parse(decodeBase64Url(payloadB64));
+            if (typeof payload.exp === "number") {
+                return payload.exp * 1000;
+            }
+        }
+        catch {
+            // ignore — fall through to default
+        }
+        return Date.now() + 60 * 60 * 1000;
+    }
+    scheduleRefresh(expiryMs) {
+        if (typeof window === "undefined")
+            return; // SSR'da auto-refresh yok
+        if (this.refreshTimer)
+            clearTimeout(this.refreshTimer);
+        const fireAt = expiryMs - this.refreshSkew * 1000;
+        const delay = Math.max(fireAt - Date.now(), 5_000);
+        this.refreshTimer = setTimeout(() => {
+            this.refresh().catch(() => {
+                // Refresh fail → session cleared, listener'lar null user görür
+                this.clearSession();
+            });
+        }, delay);
+    }
+    async refresh() {
+        const restored = this.storage.read();
+        if (!restored?.refreshToken) {
+            this.clearSession();
+            return;
+        }
+        const res = await this.http.request("/refresh", {
+            method: "POST",
+            json: { refreshToken: restored.refreshToken },
+        });
+        this.storage.write({
+            ...restored,
+            accessToken: res.accessToken,
+            refreshToken: res.refreshToken,
+        });
+        this.scheduleRefresh(this.estimateExpiry(res.accessToken));
+    }
+}
+exports.SentroyAuth = SentroyAuth;
+//# sourceMappingURL=client.js.map

package/dist/auth/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/auth/client.ts"],"names":[],"mappings":";;;AAMA,iCAAuD;AAiCvD,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAEzC;;;GAGG;AACH,SAAS,eAAe,CAAC,CAAS;IAChC,wBAAwB;IACxB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9E,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QACjC,gEAAgE;QAChE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACvE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IACD,gBAAgB;IAChB,8DAA8D;IAC9D,MAAM,CAAC,GAAI,UAAkB,CAAC,MAAM,CAAA;IACpC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7D,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC1D,OAAO,oBAAoB,EAAE,CAAA;IAC/B,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,kBAAkB,IAAI,WAAW,EAAE,CAAA;IAClD,OAAO;QACL,IAAI;YACF,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAC5C,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAA;gBACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAIpB,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK;YACT,IAAI,CAAC;gBACH,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;QACH,CAAC;QACD,KAAK;YACH,IAAI,CAAC;gBACH,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB;IAC3B,IAAI,KAAK,GAIE,IAAI,CAAA;IACf,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK;QACjB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,KAAK,GAAG,KAAK,CAAA;QACf,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;KACF,CAAA;AACH,CAAC;AAWD,MAAa,WAAW;IACL,IAAI,CAAU;IACd,OAAO,CAAoB;IAC3B,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAA;IAC9C,WAAW,CAAQ;IAC5B,YAAY,GAAyC,IAAI,CAAA;IACzD,WAAW,GAA2B,IAAI,CAAA;IAElD,YAAY,IAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,eAAQ,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,CAAA;QAE1C,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,GAAG,oBAAoB,EAAE,CAAA;QACvC,CAAC;aAAM,IACL,IAAI,CAAC,OAAO;YACZ,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAChC,MAAM,IAAI,IAAI,CAAC,OAAO,EACtB,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACtD,CAAC;QAED,yEAAyE;QACzE,sDAAsD;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QACpC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAA;YAChC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,IAAI,IAAI,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAKZ;QACC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAiB,SAAS,EAAE;YAC7D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,KAAK;SACZ,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC;gBACX,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAGZ;QACC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgB,QAAQ,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,KAAK;SACZ,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,CAAC;YACX,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAA;QACF,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QACpC,IAAI,QAAQ,EAAE,YAAY,EAAE,CAAC;YAC3B,4DAA4D;YAC5D,2BAA2B;YAC3B,MAAM,IAAI,CAAC,IAAI;iBACZ,OAAO,CAAC,SAAS,EAAE;gBAClB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE;aAC9C,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACpB,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CACjC,eAAe,EACf,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CACpC,CAAA;QACD,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YACpC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;YAC/C,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAA;gBAC3B,IAAI,CAAC,MAAM,EAAE,CAAA;YACf,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,QAAiC;QAClD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5B,oEAAoE;QACpE,uBAAuB;QACvB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;QACxD,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACjC,CAAC,CAAA;IACH,CAAC;IAED,4EAA4E;IAEpE,OAAO,CAAC,KAIf;QACC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,CAAA;QAC7B,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IAC9D,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACpB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACvB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QAC1B,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAA;IACf,CAAC;IAEO,MAAM;QACZ,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,WAAmB;QACxC,IAAI,CAAC;YACH,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,CAErD,CAAA;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;YAC3B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IACpC,CAAC;IAEO,eAAe,CAAC,QAAgB;QACtC,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAM,CAAC,0BAA0B;QACpE,IAAI,IAAI,CAAC,YAAY;YAAE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;QAClD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBACxB,+DAA+D;gBAC/D,IAAI,CAAC,YAAY,EAAE,CAAA;YACrB,CAAC,CAAC,CAAA;QACJ,CAAC,EAAE,KAAK,CAAC,CAAA;IACX,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QACpC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,EAAE,CAAA;YACnB,OAAM;QACR,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAqB,UAAU,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE;SAC9C,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACjB,GAAG,QAAQ;YACX,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,YAAY,EAAE,GAAG,CAAC,YAAY;SAC/B,CAAC,CAAA;QACF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;IAC5D,CAAC;CACF;AA1ND,kCA0NC"}

package/dist/auth/http.d.ts

@@ -0,0 +1,19 @@
+export interface AuthHttpOptions {
+    authBaseUrl?: string;
+    projectSlug: string;
+    apiKey?: string;
+    /** Hata-fırlatma yerine raw response döndür — caller fine-grained handling. */
+    rawErrors?: boolean;
+}
+export declare class AuthHttp {
+    readonly baseUrl: string;
+    readonly projectSlug: string;
+    readonly apiKey?: string;
+    constructor(opts: AuthHttpOptions);
+    url(path: string): string;
+    request<T>(path: string, init?: RequestInit & {
+        json?: unknown;
+        bearer?: string;
+    }): Promise<T>;
+}
+//# sourceMappingURL=http.d.ts.map

package/dist/auth/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/auth/http.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+EAA+E;IAC/E,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,qBAAa,QAAQ;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;gBAEZ,IAAI,EAAE,eAAe;IASjC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAKnB,OAAO,CAAC,CAAC,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,WAAW,GAAG;QAClB,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;KACX,GACL,OAAO,CAAC,CAAC,CAAC;CAsDd"}

package/dist/auth/http.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthHttp = void 0;
+const types_1 = require("./types");
+/**
+ * Auth-as-a-Service shared HTTP layer. Project's signup/login/refresh
+ * endpoints'iyle aynı format (JSON request + JSON response, 401/403/4xx
+ * tek-tip `{error, error_description}` shape).
+ *
+ * `apiKey` opsiyonel — browser SDK end-user akışında apiKey-less
+ * (server-only güvenlik), admin SDK her zaman set'li.
+ */
+const DEFAULT_AUTH_BASE_URL = "https://auth.sentroy.com";
+class AuthHttp {
+    baseUrl;
+    projectSlug;
+    apiKey;
+    constructor(opts) {
+        this.baseUrl = (opts.authBaseUrl || DEFAULT_AUTH_BASE_URL).replace(/\/+$/, "");
+        this.projectSlug = opts.projectSlug;
+        this.apiKey = opts.apiKey;
+    }
+    url(path) {
+        const p = path.startsWith("/") ? path : `/${path}`;
+        return `${this.baseUrl}/api/v1/auth/${this.projectSlug}${p}`;
+    }
+    async request(path, init = {}) {
+        const headers = new Headers(init.headers);
+        headers.set("Accept", "application/json");
+        if (init.json !== undefined) {
+            headers.set("Content-Type", "application/json");
+        }
+        // Auth precedence: explicit `bearer` (user access token) > project `apiKey`.
+        // Caller chooses the one that fits the endpoint.
+        if (init.bearer) {
+            headers.set("Authorization", `Bearer ${init.bearer}`);
+        }
+        else if (this.apiKey) {
+            headers.set("Authorization", `Bearer ${this.apiKey}`);
+        }
+        const res = await fetch(this.url(path), {
+            ...init,
+            headers,
+            body: init.json !== undefined ? JSON.stringify(init.json) : init.body,
+        });
+        let payload = null;
+        const ct = res.headers.get("content-type") ?? "";
+        if (ct.includes("application/json")) {
+            try {
+                payload = await res.json();
+            }
+            catch {
+                payload = null;
+            }
+        }
+        if (!res.ok) {
+            const err = payload && typeof payload === "object"
+                ? payload
+                : {};
+            throw new types_1.SentroyAuthError(err.error ?? "http_error", err.error_description ?? `HTTP ${res.status}`, res.status);
+        }
+        // Sentroy admin endpoints wrap in `{data}`; public endpoints sometimes
+        // too. SDK auto-unwraps when present so callers don't keep .data on
+        // every call.
+        if (payload &&
+            typeof payload === "object" &&
+            "data" in payload) {
+            return payload.data;
+        }
+        return payload;
+    }
+}
+exports.AuthHttp = AuthHttp;
+//# sourceMappingURL=http.js.map

package/dist/auth/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/auth/http.ts"],"names":[],"mappings":";;;AAAA,mCAA0C;AAE1C;;;;;;;GAOG;AAEH,MAAM,qBAAqB,GAAG,0BAA0B,CAAA;AAUxD,MAAa,QAAQ;IACV,OAAO,CAAQ;IACf,WAAW,CAAQ;IACnB,MAAM,CAAS;IAExB,YAAY,IAAqB;QAC/B,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC,CAAC,OAAO,CAChE,MAAM,EACN,EAAE,CACH,CAAA;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACnC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC3B,CAAC;IAED,GAAG,CAAC,IAAY;QACd,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;QAClD,OAAO,GAAG,IAAI,CAAC,OAAO,gBAAgB,IAAI,CAAC,WAAW,GAAG,CAAC,EAAE,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,OAGI,EAAE;QAEN,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAA;QACzC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;QACjD,CAAC;QACD,6EAA6E;QAC7E,iDAAiD;QACjD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACvD,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACtC,GAAG,IAAI;YACP,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;SACtE,CAAC,CAAA;QAEF,IAAI,OAAO,GAAY,IAAI,CAAA;QAC3B,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;QAChD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GACP,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;gBACpC,CAAC,CAAE,OAA0D;gBAC7D,CAAC,CAAC,EAAE,CAAA;YACR,MAAM,IAAI,wBAAgB,CACxB,GAAG,CAAC,KAAK,IAAI,YAAY,EACzB,GAAG,CAAC,iBAAiB,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAC7C,GAAG,CAAC,MAAM,CACX,CAAA;QACH,CAAC;QAED,uEAAuE;QACvE,oEAAoE;QACpE,cAAc;QACd,IACE,OAAO;YACP,OAAO,OAAO,KAAK,QAAQ;YAC3B,MAAM,IAAK,OAAmC,EAC9C,CAAC;YACD,OAAQ,OAAuB,CAAC,IAAI,CAAA;QACtC,CAAC;QACD,OAAO,OAAY,CAAA;IACrB,CAAC;CACF;AA/ED,4BA+EC"}