@sentroy-co/client-sdk 2.13.8 → 2.13.9

package/dist/auth/react/index.js

@@ -4,11 +4,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SentroyAuthProvider = SentroyAuthProvider;
 exports.useAuth = useAuth;
 exports.useUser = useUser;
+exports.useSessions = useSessions;
+exports.useActivity = useActivity;
+exports.useMfa = useMfa;
+exports.usePasskeys = usePasskeys;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const client_1 = require("../client");
 const AuthContext = (0, react_1.createContext)(null);
-function SentroyAuthProvider({ children, ...opts }) {
+function SentroyAuthProvider({ children, autoConsumeFragment = true, ...opts }) {
     // Single instance — opts deep-compare'a girersek dependency drift'i
     // restart'a yol açar. Caller `projectSlug` değiştirmemeli runtime'da.
     const auth = (0, react_1.useMemo)(() => new client_1.SentroyAuth(opts), 
@@ -23,6 +27,19 @@ function SentroyAuthProvider({ children, ...opts }) {
         });
         return unsubscribe;
     }, [auth]);
+    // Social login redirect handler — fragment varsa otomatik consume
+    (0, react_1.useEffect)(() => {
+        if (!autoConsumeFragment)
+            return;
+        if (typeof window === "undefined")
+            return;
+        if (!window.location.hash.includes("access_token="))
+            return;
+        auth.consumeRedirectFragment().catch(() => {
+            // Fragment varsa ama consume fail ise sessizce yut — caller
+            // gerekirse manuel tekrar dener.
+        });
+    }, [auth, autoConsumeFragment]);
     const value = (0, react_1.useMemo)(() => ({
         auth,
         user,
@@ -32,6 +49,12 @@ function SentroyAuthProvider({ children, ...opts }) {
         signOut: () => auth.signOut(),
         sendPasswordReset: (e) => auth.sendPasswordReset(e),
         verifyEmail: (t) => auth.verifyEmail(t),
+        verifyMfa: (i) => auth.verifyMfa(i),
+        sendMagicLink: (i) => auth.sendMagicLink(i),
+        consumeMagicLink: (t) => auth.consumeMagicLink(t),
+        acceptInvitation: (i) => auth.acceptInvitation(i),
+        socialAuthorizeUrl: (p, o) => auth.socialAuthorizeUrl(p, o),
+        consumeRedirectFragment: () => auth.consumeRedirectFragment(),
     }), [auth, user, loading]);
     return (0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: value, children: children });
 }
@@ -49,4 +72,160 @@ function useAuth() {
 function useUser() {
     return useAuth().user;
 }
+/**
+ * Reactive sessions hook — `/me/sessions` çağırır, refresh trigger eden
+ * `refresh()` döner. Manual revoke sonrası caller `refresh()` çağırır.
+ */
+function useSessions() {
+    const { auth, user } = useAuth();
+    const [sessions, setSessions] = (0, react_1.useState)(null);
+    const [loading, setLoading] = (0, react_1.useState)(false);
+    const [error, setError] = (0, react_1.useState)(null);
+    const refresh = (0, react_1.useCallback)(async () => {
+        if (!user) {
+            setSessions(null);
+            return;
+        }
+        setLoading(true);
+        setError(null);
+        try {
+            const data = await auth.listSessions();
+            setSessions(data);
+        }
+        catch (e) {
+            setError(e instanceof Error ? e : new Error(String(e)));
+        }
+        finally {
+            setLoading(false);
+        }
+    }, [auth, user]);
+    (0, react_1.useEffect)(() => {
+        refresh();
+    }, [refresh]);
+    const revoke = (0, react_1.useCallback)(async (id) => {
+        await auth.revokeSession(id);
+        await refresh();
+    }, [auth, refresh]);
+    return { sessions, loading, error, refresh, revoke };
+}
+/**
+ * Reactive activity log hook — `/me/activity`. RP'nin "recent activity"
+ * tab'ı için.
+ */
+function useActivity() {
+    const { auth, user } = useAuth();
+    const [activity, setActivity] = (0, react_1.useState)(null);
+    const [loading, setLoading] = (0, react_1.useState)(false);
+    const [error, setError] = (0, react_1.useState)(null);
+    const refresh = (0, react_1.useCallback)(async () => {
+        if (!user) {
+            setActivity(null);
+            return;
+        }
+        setLoading(true);
+        setError(null);
+        try {
+            const data = await auth.getActivity();
+            setActivity(data);
+        }
+        catch (e) {
+            setError(e instanceof Error ? e : new Error(String(e)));
+        }
+        finally {
+            setLoading(false);
+        }
+    }, [auth, user]);
+    (0, react_1.useEffect)(() => {
+        refresh();
+    }, [refresh]);
+    return { activity, loading, error, refresh };
+}
+/**
+ * Reactive MFA status. enroll / verify / disable wrapper'ları, status
+ * otomatik yeniden çekilir.
+ */
+function useMfa() {
+    const { auth, user } = useAuth();
+    const [status, setStatus] = (0, react_1.useState)(null);
+    const [loading, setLoading] = (0, react_1.useState)(false);
+    const [error, setError] = (0, react_1.useState)(null);
+    const refresh = (0, react_1.useCallback)(async () => {
+        if (!user) {
+            setStatus(null);
+            return;
+        }
+        setLoading(true);
+        setError(null);
+        try {
+            const data = await auth.mfa.getStatus();
+            setStatus(data);
+        }
+        catch (e) {
+            setError(e instanceof Error ? e : new Error(String(e)));
+        }
+        finally {
+            setLoading(false);
+        }
+    }, [auth, user]);
+    (0, react_1.useEffect)(() => {
+        refresh();
+    }, [refresh]);
+    const verifyTotpEnrollment = (0, react_1.useCallback)(async (code) => {
+        await auth.mfa.verifyTotpEnrollment(code);
+        await refresh();
+    }, [auth, refresh]);
+    const disableTotp = (0, react_1.useCallback)(async (currentPassword) => {
+        await auth.mfa.disableTotp(currentPassword);
+        await refresh();
+    }, [auth, refresh]);
+    return {
+        status,
+        loading,
+        error,
+        refresh,
+        enrollTotp: () => auth.mfa.enrollTotp(),
+        verifyTotpEnrollment,
+        disableTotp,
+    };
+}
+/**
+ * Reactive passkey list — list/delete/register, mutation sonrası
+ * otomatik refresh.
+ */
+function usePasskeys() {
+    const { auth, user } = useAuth();
+    const [passkeys, setPasskeys] = (0, react_1.useState)(null);
+    const [loading, setLoading] = (0, react_1.useState)(false);
+    const [error, setError] = (0, react_1.useState)(null);
+    const refresh = (0, react_1.useCallback)(async () => {
+        if (!user) {
+            setPasskeys(null);
+            return;
+        }
+        setLoading(true);
+        setError(null);
+        try {
+            const data = await auth.passkey.list();
+            setPasskeys(data);
+        }
+        catch (e) {
+            setError(e instanceof Error ? e : new Error(String(e)));
+        }
+        finally {
+            setLoading(false);
+        }
+    }, [auth, user]);
+    (0, react_1.useEffect)(() => {
+        refresh();
+    }, [refresh]);
+    const register = (0, react_1.useCallback)(async (deviceName) => {
+        await auth.passkey.register(deviceName);
+        await refresh();
+    }, [auth, refresh]);
+    const remove = (0, react_1.useCallback)(async (id) => {
+        await auth.passkey.delete(id);
+        await refresh();
+    }, [auth, refresh]);
+    return { passkeys, loading, error, refresh, register, remove };
+}
 //# sourceMappingURL=index.js.map

package/dist/auth/react/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/react/index.tsx"],"names":[],"mappings":";AAAA,YAAY,CAAA;;AA4CZ,kDAqCC;AAED,0BAQC;AAMD,0BAEC;;AAjGD,iCAOc;AACd,sCAAgE;AAgChE,MAAM,WAAW,GAAG,IAAA,qBAAa,EAA0B,IAAI,CAAC,CAAA;AAEhE,SAAgB,mBAAmB,CAAC,EAClC,QAAQ,EACR,GAAG,IAAI,EACsC;IAC7C,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,IAAI,GAAG,IAAA,eAAO,EAClB,GAAG,EAAE,CAAC,IAAI,oBAAW,CAAC,IAAI,CAAC;IAC3B,uDAAuD;IACvD,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAClD,CAAA;IACD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,IAAA,gBAAQ,EAAyB,IAAI,CAAC,IAAI,CAAC,CAAA;IACnE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAA;IAE5C,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE;YAChD,OAAO,CAAC,CAAC,CAAC,CAAA;YACV,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,OAAO,WAAW,CAAA;IACpB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAEV,MAAM,KAAK,GAAG,IAAA,eAAO,EACnB,GAAG,EAAE,CAAC,CAAC;QACL,IAAI;QACJ,IAAI;QACJ,OAAO;QACP,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;QAC7B,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnD,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;KACxC,CAAC,EACF,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CACtB,CAAA;IAED,OAAO,uBAAC,WAAW,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAAwB,CAAA;AAC9E,CAAC;AAED,SAAgB,OAAO;IACrB,MAAM,GAAG,GAAG,IAAA,kBAAU,EAAC,WAAW,CAAC,CAAA;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,SAAgB,OAAO;IACrB,OAAO,OAAO,EAAE,CAAC,IAAI,CAAA;AACvB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/react/index.tsx"],"names":[],"mappings":";AAAA,YAAY,CAAA;;AA6DZ,kDA6DC;AAED,0BAQC;AAMD,0BAEC;AAMD,kCA0CC;AAMD,kCAiCC;AAMD,wBA4DC;AAMD,kCAmDC;;AA5VD,iCAQc;AACd,sCAAgE;AAgDhE,MAAM,WAAW,GAAG,IAAA,qBAAa,EAA0B,IAAI,CAAC,CAAA;AAEhE,SAAgB,mBAAmB,CAAC,EAClC,QAAQ,EACR,mBAAmB,GAAG,IAAI,EAC1B,GAAG,IAAI,EAOR;IACC,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,IAAI,GAAG,IAAA,eAAO,EAClB,GAAG,EAAE,CAAC,IAAI,oBAAW,CAAC,IAAI,CAAC;IAC3B,uDAAuD;IACvD,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAClD,CAAA;IACD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,IAAA,gBAAQ,EAAyB,IAAI,CAAC,IAAI,CAAC,CAAA;IACnE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAA;IAE5C,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE;YAChD,OAAO,CAAC,CAAC,CAAC,CAAA;YACV,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,OAAO,WAAW,CAAA;IACpB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAEV,kEAAkE;IAClE,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,IAAI,CAAC,mBAAmB;YAAE,OAAM;QAChC,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAM;QACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,OAAM;QAC3D,IAAI,CAAC,uBAAuB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACxC,4DAA4D;YAC5D,iCAAiC;QACnC,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAE/B,MAAM,KAAK,GAAG,IAAA,eAAO,EACnB,GAAG,EAAE,CAAC,CAAC;QACL,IAAI;QACJ,IAAI;QACJ,OAAO;QACP,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;QAC7B,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnD,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACvC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACnC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3C,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACjD,kBAAkB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3D,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE;KAC9D,CAAC,EACF,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CACtB,CAAA;IAED,OAAO,uBAAC,WAAW,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAAwB,CAAA;AAC9E,CAAC;AAED,SAAgB,OAAO;IACrB,MAAM,GAAG,GAAG,IAAA,kBAAU,EAAC,WAAW,CAAC,CAAA;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,SAAgB,OAAO;IACrB,OAAO,OAAO,EAAE,CAAC,IAAI,CAAA;AACvB,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW;IAOzB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAA;IAChC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,IAAA,gBAAQ,EAA0B,IAAI,CAAC,CAAA;IACvE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAA,gBAAQ,EAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAAe,IAAI,CAAC,CAAA;IAEtD,MAAM,OAAO,GAAG,IAAA,mBAAW,EAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,WAAW,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;YACtC,WAAW,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACzD,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAEhB,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,OAAO,EAAE,CAAA;IACX,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,MAAM,MAAM,GAAG,IAAA,mBAAW,EACxB,KAAK,EAAE,EAAU,EAAE,EAAE;QACnB,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;QAC5B,MAAM,OAAO,EAAE,CAAA;IACjB,CAAC,EACD,CAAC,IAAI,EAAE,OAAO,CAAC,CAChB,CAAA;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AACtD,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW;IAMzB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAA;IAChC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,IAAA,gBAAQ,EAAyB,IAAI,CAAC,CAAA;IACtE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAA,gBAAQ,EAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAAe,IAAI,CAAC,CAAA;IAEtD,MAAM,OAAO,GAAG,IAAA,mBAAW,EAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,WAAW,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;YACrC,WAAW,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACzD,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAEhB,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,OAAO,EAAE,CAAA;IACX,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,MAAM;IASpB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAA;IAChC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,IAAA,gBAAQ,EAAmB,IAAI,CAAC,CAAA;IAC5D,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAA,gBAAQ,EAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAAe,IAAI,CAAC,CAAA;IAEtD,MAAM,OAAO,GAAG,IAAA,mBAAW,EAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS,CAAC,IAAI,CAAC,CAAA;YACf,OAAM;QACR,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAA;YACvC,SAAS,CAAC,IAAI,CAAC,CAAA;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACzD,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAEhB,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,OAAO,EAAE,CAAA;IACX,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,MAAM,oBAAoB,GAAG,IAAA,mBAAW,EACtC,KAAK,EAAE,IAAY,EAAE,EAAE;QACrB,MAAM,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,OAAO,EAAE,CAAA;IACjB,CAAC,EACD,CAAC,IAAI,EAAE,OAAO,CAAC,CAChB,CAAA;IAED,MAAM,WAAW,GAAG,IAAA,mBAAW,EAC7B,KAAK,EAAE,eAAuB,EAAE,EAAE;QAChC,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAA;QAC3C,MAAM,OAAO,EAAE,CAAA;IACjB,CAAC,EACD,CAAC,IAAI,EAAE,OAAO,CAAC,CAChB,CAAA;IAED,OAAO;QACL,MAAM;QACN,OAAO;QACP,KAAK;QACL,OAAO;QACP,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE;QACvC,oBAAoB;QACpB,WAAW;KACZ,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW;IAQzB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAA;IAChC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,IAAA,gBAAQ,EAA0B,IAAI,CAAC,CAAA;IACvE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAA,gBAAQ,EAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAAe,IAAI,CAAC,CAAA;IAEtD,MAAM,OAAO,GAAG,IAAA,mBAAW,EAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,WAAW,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YACtC,WAAW,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACzD,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAEhB,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,OAAO,EAAE,CAAA;IACX,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAC1B,KAAK,EAAE,UAAmB,EAAE,EAAE;QAC5B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QACvC,MAAM,OAAO,EAAE,CAAA;IACjB,CAAC,EACD,CAAC,IAAI,EAAE,OAAO,CAAC,CAChB,CAAA;IAED,MAAM,MAAM,GAAG,IAAA,mBAAW,EACxB,KAAK,EAAE,EAAU,EAAE,EAAE;QACnB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC7B,MAAM,OAAO,EAAE,CAAA;IACjB,CAAC,EACD,CAAC,IAAI,EAAE,OAAO,CAAC,CAChB,CAAA;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAChE,CAAC"}

package/dist/auth/types.d.ts

@@ -47,4 +47,59 @@ export declare class SentroyAuthError extends Error {
     readonly status: number;
     constructor(code: string, message: string, status: number);
 }
+/**
+ * Login response when MFA is enrolled — first step returns mfaRequired+
+ * mfaToken; second step `verifyMfa(mfaToken, code)` issues final tokens.
+ */
+export interface MfaChallengeResponse {
+    mfaRequired: true;
+    mfaToken: string;
+    factorType: "totp";
+}
+/** Discriminated union — Login may resolve to tokens OR MFA challenge. */
+export type LoginOutcome = {
+    kind: "tokens";
+    data: LoginResponse;
+} | {
+    kind: "mfa";
+    data: MfaChallengeResponse;
+};
+export interface SessionSummary {
+    id: string;
+    refreshTokenPrefix: string;
+    userAgent: string | null;
+    ip: string | null;
+    expiresAt: string;
+    createdAt: string;
+}
+export interface ActivityEntry {
+    id: string;
+    action: string;
+    ipAddress: string | null;
+    createdAt: string;
+    details: Record<string, unknown> | null;
+}
+export interface MfaStatus {
+    enrolled: boolean;
+    factorType?: "totp";
+    verifiedAt?: string | null;
+    recoveryCodesRemaining?: number;
+}
+export interface MfaEnrollResponse {
+    secret: string;
+    otpauthUri: string;
+}
+export interface MfaVerifyEnrollmentResponse {
+    enrolled: true;
+    recoveryCodes: string[];
+}
+export interface PasskeySummary {
+    id: string;
+    credentialIdPrefix: string;
+    deviceName: string | null;
+    transports: string[];
+    lastUsedAt: string | null;
+    createdAt: string;
+}
+export type SocialProvider = "google" | "github" | "facebook" | "microsoft" | "twitter" | "apple";
 //# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,OAAO,CAAA;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,QAAQ,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,eAAe,CAAA;IACrB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,QAAQ,CAAA;IACpB,yBAAyB,CAAC,EAAE,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,eAAe,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,QAAQ,CAAA;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBACX,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM1D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,OAAO,CAAA;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,QAAQ,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,eAAe,CAAA;IACrB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,QAAQ,CAAA;IACpB,yBAAyB,CAAC,EAAE,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,eAAe,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,QAAQ,CAAA;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBACX,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM1D;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,IAAI,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,0EAA0E;AAC1E,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAAA;AAE/C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,kBAAkB,EAAE,MAAM,CAAA;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,OAAO,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,IAAI,CAAA;IACd,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,kBAAkB,EAAE,MAAM,CAAA;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,WAAW,GACX,SAAS,GACT,OAAO,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentroy-co/client-sdk",
-  "version": "2.13.8",
+  "version": "2.13.9",
   "description": "TypeScript SDK + CLI for the Sentroy platform — mail, storage, env vault + React components.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -95,10 +95,14 @@
     "node": ">=18.0.0"
   },
   "peerDependencies": {
+    "@simplewebauthn/browser": "^13.0.0",
     "react": ">=18.0.0",
     "react-dom": ">=18.0.0"
   },
   "peerDependenciesMeta": {
+    "@simplewebauthn/browser": {
+      "optional": true
+    },
     "react": {
       "optional": true
     },

package/src/auth/admin/index.ts

@@ -1,34 +1,220 @@
 import { AuthHttp } from "../http"
-import type { SentroyAuthUser } from "../types"
+import type {
+  SentroyAuthUser,
+  SignupResponse,
+  LoginResponse,
+  LoginOutcome,
+  AuthTokensResponse,
+  MfaChallengeResponse,
+} from "../types"
 
 /**
  * Server-side Sentroy Auth admin SDK. **Node only — apiKey browser'a
- * koymayın**; bu sınıf Project'in master `aps_` token'ını taşır ve
- * Sentroy üzerindeki user pool'a yetki vermez.
+ * koymayın**; bu sınıf Project'in master `aps_` token'ını taşır.
  *
- * Tipik kullanım: backend, kendi `/api/auth/...` proxy'sinde RP-spesifik
- * authorization yapar, sonra `admin.users.get(...)` ile Sentroy'dan
- * end-user'ı çeker. JWT verify de bu SDK üzerinden — tüm akış stateless.
+ * Tüm public auth endpoint'lerini apiKey'le proxy eder ve JWT'yi local
+ * verify edebilir (JWKS cache + RSA Subtle). RP backend tipik akış:
+ *
+ *   const admin = new SentroyAuthAdmin({ projectSlug, apiKey })
+ *   const out = await admin.users.signIn({ email, password })
+ *   if (out.kind === "tokens") setCookie(out.data.accessToken, ...)
+ *   else // MFA flow
+ *
+ *   // Mid-request: verify
+ *   const claims = await admin.verifyIdToken(req.cookies.accessToken)
+ *
+ * Token persistence yok — server-side request-scoped; caller cookie /
+ * session / DB nereye isterse oraya yazar.
  */
 
 export interface SentroyAuthAdminOptions {
   authBaseUrl?: string
   projectSlug: string
   apiKey: string
+  /** JWKS cache TTL (saniye). Default 3600 (1 saat) — JWT rotation
+   *  grace period'una uyumlu; daha agresif rotation yapan project'ler
+   *  daha düşük set edebilir. */
+  jwksCacheTtl?: number
+}
+
+interface CachedJwks {
+  keys: Record<string, unknown>[]
+  expiresAt: number
 }
 
 export class SentroyAuthAdmin {
   private readonly http: AuthHttp
-  private cachedJwks: { keys: Record<string, unknown>[] } | null = null
+  private readonly jwksCacheTtl: number
+  private cachedJwks: CachedJwks | null = null
 
   constructor(opts: SentroyAuthAdminOptions) {
     this.http = new AuthHttp(opts)
+    this.jwksCacheTtl = opts.jwksCacheTtl ?? 3600
+  }
+
+  get projectSlug(): string {
+    return this.http.projectSlug
+  }
+
+  get baseUrl(): string {
+    return this.http.baseUrl
   }
 
   // ─── User pool admin ──────────────────────────────────────────────────
 
   users = {
-    list: (opts: {
+    /**
+     * Server-side signup proxy. apiKey backend'de — browser'a sızmaz.
+     * Email verification project config'ine bağlı: required ise
+     * `emailVerificationRequired: true` döner, tokens undefined.
+     */
+    create: (input: {
+      email: string
+      password: string
+      displayName?: string
+      metadata?: Record<string, unknown>
+    }): Promise<SignupResponse> =>
+      this.http.request<SignupResponse>("/signup", {
+        method: "POST",
+        json: input,
+      }),
+
+    /**
+     * Server-side login proxy. MFA-aware: tokens VEYA MFA challenge.
+     * RP backend `out.kind === "mfa"` ise kullanıcıdan code alıp
+     * `users.verifyMfa(...)` çağırır.
+     */
+    signIn: async (input: {
+      email: string
+      password: string
+      rememberMe?: boolean
+    }): Promise<LoginOutcome> => {
+      const res = await this.http.request<
+        LoginResponse | MfaChallengeResponse
+      >("/login", { method: "POST", json: input })
+      if ("mfaRequired" in res && res.mfaRequired) {
+        return { kind: "mfa", data: res }
+      }
+      return { kind: "tokens", data: res as LoginResponse }
+    },
+
+    /** MFA verify ikinci adımı — `signIn` kind:"mfa" döndüyse. */
+    verifyMfa: (input: {
+      mfaToken: string
+      code?: string
+      recoveryCode?: string
+    }): Promise<LoginResponse> =>
+      this.http.request<LoginResponse>("/login/mfa/verify", {
+        method: "POST",
+        json: input,
+      }),
+
+    /** Refresh access token (rotation). Yeni refresh + access döner. */
+    refresh: (refreshToken: string): Promise<AuthTokensResponse> =>
+      this.http.request<AuthTokensResponse>("/refresh", {
+        method: "POST",
+        json: { refreshToken },
+      }),
+
+    /** Logout (refresh token revoke). */
+    signOut: (refreshToken: string): Promise<void> =>
+      this.http
+        .request<void>("/logout", {
+          method: "POST",
+          json: { refreshToken },
+        })
+        .then(() => undefined),
+
+    /** Verify email — link'ten gelen token. */
+    verifyEmail: (token: string): Promise<{ user: SentroyAuthUser }> =>
+      this.http.request<{ user: SentroyAuthUser }>("/verify-email", {
+        method: "POST",
+        json: { token },
+      }),
+
+    /** Password reset mail tetikle. */
+    requestPasswordReset: (email: string): Promise<void> =>
+      this.http
+        .request<void>("/password-reset/request", {
+          method: "POST",
+          json: { email },
+        })
+        .then(() => undefined),
+
+    /** Reset token + yeni şifre ile finalize. */
+    confirmPasswordReset: (input: {
+      token: string
+      newPassword: string
+    }): Promise<{ user: SentroyAuthUser }> =>
+      this.http.request<{ user: SentroyAuthUser }>("/password-reset/confirm", {
+        method: "POST",
+        json: input,
+      }),
+
+    /** Magic-link mail tetikle. */
+    sendMagicLink: (input: {
+      email: string
+      redirectUri?: string
+    }): Promise<void> =>
+      this.http
+        .request<void>("/magic-link/request", {
+          method: "POST",
+          json: input,
+        })
+        .then(() => undefined),
+
+    /** Magic-link token consume → login. */
+    consumeMagicLink: (token: string): Promise<LoginResponse> =>
+      this.http.request<LoginResponse>("/magic-link/consume", {
+        method: "POST",
+        json: { token },
+      }),
+
+    /** Davet token'ı ile yeni hesap + login. */
+    acceptInvitation: (input: {
+      token: string
+      password: string
+      displayName?: string
+    }): Promise<LoginResponse> =>
+      this.http.request<LoginResponse>("/invitation/accept", {
+        method: "POST",
+        json: input,
+      }),
+
+    /**
+     * Access token ile remote /me — JWT'ye bağımlı kalmadan canlı
+     * profile çek. Token expire ise SentroyAuthError fırlatır.
+     */
+    getUser: (accessToken: string): Promise<SentroyAuthUser> =>
+      this.http.request<SentroyAuthUser>("/me", {
+        method: "GET",
+        bearer: accessToken,
+      }),
+
+    /**
+     * Token bazlı userinfo (OIDC tarzı). `/userinfo` claims response —
+     * SentroyAuthUser shape'inden daha minimal olabilir.
+     */
+    getUserinfo: (
+      accessToken: string,
+    ): Promise<{
+      sub: string
+      email?: string
+      email_verified?: boolean
+      name?: string
+      picture?: string
+    }> =>
+      this.http.request("/userinfo", {
+        method: "GET",
+        bearer: accessToken,
+      }),
+
+    /**
+     * Admin list (paginated). **Şu an public API yok** — dashboard
+     * cookie-auth `/api/companies/[slug]/auth-projects/[id]/users`
+     * kullan. v2'de stk_ token'lı admin endpoint açılacak.
+     */
+    list: (_opts: {
       limit?: number
       skip?: number
       emailVerified?: boolean
@@ -39,18 +225,19 @@ export class SentroyAuthAdmin {
       throw new Error(
         "admin.users.list requires session-authenticated admin API; use dashboard /api/companies/[slug]/auth-projects/[id]/users instead. (v2 admin SDK will proxy this with stk_ tokens.)",
       )
-      // NOTE Phase 5+: SDK admin endpoint'leri public path'lere taşınmadı;
-      // şu an `/api/companies/...` cookie-auth ile. v2'de `/api/v1/admin/...`
-      // RP token'ı ile authenticate eden ayrı public admin layer eklenir.
     },
   }
 
   // ─── ID token verification ─────────────────────────────────────────────
 
   /**
-   * Local verify — JWKS cache'lenir (5dk TTL), JWT signature kontrolü
-   * RS256 ile RP backend'inde stateless yapılır. `iss`/`aud` claim
-   * eşleşmesi de kontrol edilir.
+   * Local verify — JWKS cache'lenir (default 1h TTL, opts ile değişir),
+   * JWT signature RS256 ile WebCrypto Subtle üzerinden verify edilir.
+   * `iss`/`aud` claim eşleşmesi de kontrol edilir.
+   *
+   * Throw'lar: malformed JWT, expired, iss/aud mismatch, key not found,
+   * signature mismatch. Tipik kullanım `try/catch` içinde — fail ise
+   * 401 dön.
    */
   async verifyIdToken(token: string): Promise<{
     sub: string
@@ -62,6 +249,7 @@ export class SentroyAuthAdmin {
     aud: string
     iat: number
     exp: number
+    [claim: string]: unknown
   }> {
     const parts = token.split(".")
     if (parts.length !== 3) {
@@ -83,12 +271,14 @@ export class SentroyAuthAdmin {
     if (typeof claims.exp !== "number" || claims.exp * 1000 < Date.now()) {
       throw new Error("Token expired.")
     }
-    // iss + aud check
     const expectedIssSuffix = `/p/${this.http.projectSlug}`
-    if (typeof claims.iss !== "string" || !claims.iss.endsWith(expectedIssSuffix)) {
+    if (
+      typeof claims.iss !== "string" ||
+      !claims.iss.endsWith(expectedIssSuffix)
+    ) {
       throw new Error("Issuer mismatch.")
     }
-    // aud == project apiKeyPrefix (12 chars). API key first 12 = aud check.
+    // aud == project apiKeyPrefix (first 12 chars of api key)
     if (
       typeof claims.aud !== "string" ||
       !this.http.apiKey?.startsWith(claims.aud)
@@ -111,17 +301,22 @@ export class SentroyAuthAdmin {
     return claims as never
   }
 
+  /** JWKS cache'ini elle temizle (key rotation sonrası). */
+  invalidateJwksCache(): void {
+    this.cachedJwks = null
+  }
+
   private async fetchJwks(): Promise<{ keys: Record<string, unknown>[] }> {
-    if (this.cachedJwks) return this.cachedJwks
-    const jwks = await this.http.request<{ keys: Record<string, unknown>[] }>(
-      "/jwks.json",
-      { method: "GET" },
-    )
-    this.cachedJwks = jwks
-    // 5dk cache — basit setTimeout invalidation
-    setTimeout(() => {
-      this.cachedJwks = null
-    }, 5 * 60 * 1000)
+    if (this.cachedJwks && this.cachedJwks.expiresAt > Date.now()) {
+      return { keys: this.cachedJwks.keys }
+    }
+    const jwks = await this.http.request<{
+      keys: Record<string, unknown>[]
+    }>("/jwks.json", { method: "GET" })
+    this.cachedJwks = {
+      keys: jwks.keys,
+      expiresAt: Date.now() + this.jwksCacheTtl * 1000,
+    }
     return jwks
   }
 }
@@ -167,7 +362,9 @@ async function verifyRsaSignature(input: {
   const subtle =
     typeof crypto !== "undefined" && crypto.subtle ? crypto.subtle : null
   if (!subtle) {
-    throw new Error("Web Crypto unavailable — upgrade Node >= 18 or run in a browser.")
+    throw new Error(
+      "Web Crypto unavailable — upgrade Node >= 18 or run in a browser.",
+    )
   }
   const key = await subtle.importKey(
     "jwk",
@@ -176,9 +373,8 @@ async function verifyRsaSignature(input: {
     false,
     ["verify"],
   )
-  // Web Crypto types want ArrayBuffer-backed BufferSource. TypeScript
-  // can't prove Uint8Array isn't SharedArrayBuffer-backed (DOM lib edge);
-  // bytes are created fresh from base64 decode so ArrayBuffer-safe — cast.
+  // Web Crypto types want ArrayBuffer-backed BufferSource. Bytes are
+  // created fresh from base64 decode so they are ArrayBuffer-safe.
   const sigBytes = base64UrlToBytes(input.sigB64) as Uint8Array
   const dataBytes = new TextEncoder().encode(input.data) as Uint8Array
   const ok = await subtle.verify(