@smarthivelabs-devs/auth-sdk 0.1.0 → 1.1.0

package/README.md

@@ -0,0 +1,402 @@
+# @smarthivelabs-devs/auth-sdk
+
+Core JavaScript/TypeScript SDK for SmartHive Auth. Framework-agnostic — works in the browser, Node.js 18+, and React Native. This is the foundation that `auth-react`, `auth-expo`, and `auth-server` are all built on.
+
+---
+
+## Installation
+
+```bash
+npm install @smarthivelabs-devs/auth-sdk
+# or
+pnpm add @smarthivelabs-devs/auth-sdk
+# or
+yarn add @smarthivelabs-devs/auth-sdk
+```
+
+---
+
+## Prerequisites
+
+You need a SmartHive Auth project. From your SmartHive dashboard grab:
+
+- `projectId` — e.g. `proj_abc123`
+- `publishableKey` — e.g. `pk_live_abc123`
+- `baseUrl` — the URL of your SmartHive Auth service instance
+
+---
+
+## Quick Start
+
+```ts
+import { initAuth } from "@smarthivelabs-devs/auth-sdk";
+
+const client = initAuth({
+  projectId: "proj_abc123",
+  publishableKey: "pk_live_abc123",
+  baseUrl: "https://auth.myapp.com",
+  redirectUri: "https://myapp.com/auth/callback",
+});
+
+// Initialize (validates your project config against the server)
+await client.initialize();
+
+// Redirect the user to the SmartHive login page
+await client.login();
+```
+
+---
+
+## Configuration
+
+```ts
+interface SmartHiveAuthConfig {
+  /** Your SmartHive project ID */
+  projectId: string;
+
+  /** Your publishable (public) key */
+  publishableKey: string;
+
+  /** Base URL of your SmartHive Auth service */
+  baseUrl: string;
+
+  /**
+   * Custom branded auth domain (e.g. "https://auth.myapp.com").
+   * Used as the entry point for login/token flows.
+   * Falls back to baseUrl if not set.
+   */
+  authDomain?: string;
+
+  /**
+   * Fallback auth domain if authDomain is unreachable.
+   * Useful for high-availability setups.
+   */
+  fallbackAuthDomain?: string;
+
+  /** Default OAuth redirect URI after login */
+  redirectUri?: string;
+
+  /** Custom persistent storage adapter (default: localStorage in browser) */
+  storage?: AuthStorage;
+
+  /** Custom temporary storage for PKCE values (default: sessionStorage in browser) */
+  temporaryStorage?: AuthStorage;
+}
+```
+
+---
+
+## API Reference
+
+### `initAuth(config)`
+
+Creates and returns a `SmartHiveAuthClient`. Call this once at your app's entry point.
+
+```ts
+const client = initAuth({
+  projectId: "proj_abc123",
+  publishableKey: "pk_live_abc123",
+  baseUrl: "https://auth.myapp.com",
+});
+```
+
+---
+
+### `client.initialize()`
+
+Validates your project configuration with the SmartHive server. Call this before any auth operations.
+
+```ts
+await client.initialize();
+```
+
+Throws `SmartHiveAuthError` with code `project_not_found` if the project or key is invalid.
+
+---
+
+### `client.login(options?)`
+
+Starts the OAuth 2.0 + PKCE login flow by redirecting the user to the SmartHive login page.
+
+```ts
+// Basic login (uses redirectUri from config)
+await client.login();
+
+// Override the redirect URI for this login attempt
+await client.login({ redirectUri: "https://myapp.com/auth/callback" });
+
+// Pass custom state (returned in the callback URL)
+await client.login({ state: "my-custom-state" });
+```
+
+---
+
+### `client.handleCallback(options?)`
+
+Completes the OAuth flow on your callback route. Exchanges the authorization code for tokens and persists the session.
+
+```ts
+// In your /auth/callback page — reads from window.location automatically
+const session = await client.handleCallback();
+
+// Or pass the URL explicitly (useful in SSR or React Native)
+const session = await client.handleCallback({ url: "https://myapp.com/auth/callback?code=...&state=..." });
+
+console.log(session.accessToken);
+console.log(session.refreshToken);
+console.log(session.expiresAt); // Unix timestamp in ms
+```
+
+Throws `SmartHiveAuthError` with codes:
+- `callback_failed` — missing code or URL
+- `state_mismatch` — possible CSRF attack
+- `pkce_missing` — PKCE verifier not found (session expired between steps)
+- `token_error` — server rejected the code exchange
+
+---
+
+### `client.getSession()`
+
+Returns the current session from storage, or `null` if not signed in. Does not refresh expired tokens automatically.
+
+```ts
+const session = await client.getSession();
+if (session) {
+  console.log("Signed in:", session.accessToken);
+} else {
+  console.log("Not signed in");
+}
+```
+
+---
+
+### `client.getAccessToken()`
+
+Returns a valid access token. Automatically refreshes using the refresh token if the access token is within 30 seconds of expiry.
+
+```ts
+const token = await client.getAccessToken();
+if (token) {
+  // token is always fresh when truthy
+}
+```
+
+---
+
+### `client.getAuthorizationHeader()`
+
+Returns a `{ authorization: "Bearer <token>" }` header object ready to spread into fetch options. Returns an empty object if not signed in.
+
+```ts
+const headers = await client.getAuthorizationHeader();
+const res = await fetch("/api/protected", { headers });
+```
+
+---
+
+### `client.fetch(input, init?)`
+
+Drop-in replacement for `fetch` that automatically injects the `Authorization` header.
+
+```ts
+// Identical to native fetch, but auth is handled automatically
+const res = await client.fetch("/api/user/profile");
+const res2 = await client.fetch("https://api.myapp.com/data", {
+  method: "POST",
+  body: JSON.stringify({ name: "Alice" }),
+  headers: { "content-type": "application/json" },
+});
+```
+
+---
+
+### `client.refreshSession()`
+
+Explicitly refreshes the session using the stored refresh token. Returns the new session, or `null` if the refresh token is missing or expired (which also clears the stored session).
+
+```ts
+const newSession = await client.refreshSession();
+if (!newSession) {
+  // Refresh token expired — user must log in again
+  await client.login();
+}
+```
+
+---
+
+### `client.logout()`
+
+Clears the local session and calls the server-side sign-out endpoint.
+
+```ts
+await client.logout();
+// User is now signed out — redirect them to your home/login page
+```
+
+---
+
+### `client.getUser()`
+
+Fetches the current user's profile from the SmartHive userinfo endpoint. Returns `null` if not signed in.
+
+```ts
+const user = await client.getUser();
+console.log(user); // { sub: "user_123", email: "alice@example.com", ... }
+```
+
+---
+
+### `client.verifyToken(token)`
+
+Verifies a raw access token against the SmartHive userinfo endpoint. Returns `true` if the token is valid and accepted by the server.
+
+```ts
+const isValid = await client.verifyToken(rawToken);
+```
+
+---
+
+## Custom Storage Adapter
+
+By default the SDK uses `localStorage` for persistent storage and `sessionStorage` for PKCE state. Provide your own adapter to use any other storage backend (IndexedDB, AsyncStorage, SecureStore, Redis, etc.).
+
+```ts
+import { initAuth, type AuthStorage } from "@smarthivelabs-devs/auth-sdk";
+
+const myStorage: AuthStorage = {
+  getItem: async (key) => {
+    return await myDatabase.get(key);
+  },
+  setItem: async (key, value) => {
+    await myDatabase.set(key, value);
+  },
+  removeItem: async (key) => {
+    await myDatabase.delete(key);
+  },
+};
+
+const client = initAuth({
+  projectId: "proj_abc123",
+  publishableKey: "pk_live_abc123",
+  baseUrl: "https://auth.myapp.com",
+  storage: myStorage,
+});
+```
+
+---
+
+## PKCE Helpers
+
+Low-level PKCE utilities exported for advanced use cases (e.g. building your own auth client on top of this SDK).
+
+```ts
+import {
+  generateCodeVerifier,
+  generateCodeChallenge,
+} from "@smarthivelabs-devs/auth-sdk";
+
+const verifier = await generateCodeVerifier();  // random 32-byte base64url string
+const challenge = await generateCodeChallenge(verifier); // SHA-256(verifier), base64url encoded
+```
+
+Uses the Web Crypto API — works in browsers and Node.js 18+.
+
+---
+
+## Error Handling
+
+All async methods throw `SmartHiveAuthError` on failure.
+
+```ts
+import { SmartHiveAuthError } from "@smarthivelabs-devs/auth-sdk";
+
+try {
+  await client.login();
+} catch (err) {
+  if (err instanceof SmartHiveAuthError) {
+    console.error(err.code);    // e.g. "project_not_found"
+    console.error(err.message); // human-readable description
+  }
+}
+```
+
+Common error codes:
+
+| Code | When |
+|---|---|
+| `project_not_found` | `initialize()` — invalid projectId or publishableKey |
+| `callback_failed` | `handleCallback()` — no code in URL |
+| `state_mismatch` | `handleCallback()` — OAuth state doesn't match (CSRF) |
+| `pkce_missing` | `handleCallback()` — PKCE verifier not in storage |
+| `token_error` | `handleCallback()` — server rejected code exchange |
+
+---
+
+## Vanilla JS/TS Example (Full Flow)
+
+```ts
+import { initAuth, SmartHiveAuthError } from "@smarthivelabs-devs/auth-sdk";
+
+const client = initAuth({
+  projectId: import.meta.env.VITE_AUTH_PROJECT_ID,
+  publishableKey: import.meta.env.VITE_AUTH_PUBLISHABLE_KEY,
+  baseUrl: import.meta.env.VITE_AUTH_BASE_URL,
+  redirectUri: `${window.location.origin}/auth/callback`,
+});
+
+// Entry point — runs on every page load
+await client.initialize();
+const session = await client.getSession();
+
+// Login button
+document.getElementById("login-btn")?.addEventListener("click", () => {
+  client.login();
+});
+
+// Logout button
+document.getElementById("logout-btn")?.addEventListener("click", async () => {
+  await client.logout();
+  window.location.href = "/";
+});
+
+// Callback page (e.g. /auth/callback)
+if (window.location.pathname === "/auth/callback") {
+  try {
+    await client.handleCallback();
+    window.location.href = "/dashboard";
+  } catch (err) {
+    if (err instanceof SmartHiveAuthError) {
+      console.error("Auth failed:", err.code, err.message);
+    }
+  }
+}
+```
+
+---
+
+## TypeScript Types
+
+```ts
+import type {
+  SmartHiveAuthConfig,
+  SmartHiveAuthClient,
+  AuthSession,
+  AuthStorage,
+} from "@smarthivelabs-devs/auth-sdk";
+```
+
+---
+
+## Related Packages
+
+| Package | Use case |
+|---|---|
+| [`@smarthivelabs-devs/auth-react`](https://www.npmjs.com/package/@smarthivelabs-devs/auth-react) | React web apps — provider, hooks, components |
+| [`@smarthivelabs-devs/auth-expo`](https://www.npmjs.com/package/@smarthivelabs-devs/auth-expo) | React Native / Expo apps |
+| [`@smarthivelabs-devs/auth-server`](https://www.npmjs.com/package/@smarthivelabs-devs/auth-server) | Express / Next.js server-side JWT verification |
+
+---
+
+## License
+
+MIT © SmartHive Labs

package/dist/index.cjs

@@ -73,11 +73,17 @@ function sessionStorageAdapter() {
 function normalizeBaseUrl(baseUrl) {
   return baseUrl.replace(/\/$/, "");
 }
+function envFromPublishableKey(publishableKey) {
+  const match = publishableKey.match(/^pk_(dev|staging|prod)_/);
+  return match ? match[1] : "prod";
+}
 function initAuth(config) {
   const baseUrl = normalizeBaseUrl(config.baseUrl);
   const authBase = normalizeBaseUrl(config.authDomain ?? config.baseUrl);
   const storage = config.storage ?? browserStorage();
   const tempStorage = config.temporaryStorage ?? sessionStorageAdapter();
+  const environment = envFromPublishableKey(config.publishableKey);
+  const headlessBase = `${baseUrl}/${environment}/api/auth/headless`;
   async function saveSession(session) {
     if (!session) {
       await storage.removeItem(smartHiveAuthStorageKeys.session);
@@ -89,6 +95,106 @@ function initAuth(config) {
     const raw = await storage.getItem(smartHiveAuthStorageKeys.session);
     return raw ? JSON.parse(raw) : null;
   }
+  function rawToSession(raw) {
+    return {
+      accessToken: raw.access_token,
+      refreshToken: raw.refresh_token,
+      expiresAt: Date.now() + raw.expires_in * 1e3,
+      user: raw.user
+    };
+  }
+  async function headlessPost(path, body) {
+    const res = await fetch(`${headlessBase}${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({}));
+      throw new SmartHiveAuthError(
+        err.error ?? "request_failed",
+        err.message ?? `Request to ${path} failed.`
+      );
+    }
+    return res.json();
+  }
+  async function headlessSignInAndSave(path, body) {
+    const raw = await headlessPost(path, body);
+    const result = rawToSession(raw);
+    await saveSession(result);
+    return result;
+  }
+  const headless = {
+    signIn: {
+      async email({ email, password }) {
+        return headlessSignInAndSave("/sign-in/email", { email, password });
+      },
+      phone: {
+        async sendOtp({ phoneNumber }) {
+          await headlessPost("/phone/send-otp", { phoneNumber });
+        },
+        async verify({ phoneNumber, code }) {
+          return headlessSignInAndSave("/phone/verify", { phoneNumber, code });
+        }
+      },
+      emailOtp: {
+        async send({ email }) {
+          await headlessPost("/email-otp/send", { email });
+        },
+        async verify({ email, code }) {
+          return headlessSignInAndSave("/email-otp/verify", { email, code });
+        }
+      },
+      magicLink: {
+        async send({ email, callbackURL }) {
+          await headlessPost("/magic-link/send", { email, ...callbackURL ? { callbackURL } : {} });
+        }
+      }
+    },
+    signUp: {
+      async email({ email, password, name }) {
+        const res = await fetch(`${headlessBase}/sign-up/email`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ email, password, name })
+        });
+        if (res.status === 202) {
+          return { accessToken: "", refreshToken: "", expiresAt: 0, requiresVerification: true };
+        }
+        if (!res.ok) {
+          const err = await res.json().catch(() => ({}));
+          throw new SmartHiveAuthError(err.error ?? "sign_up_failed", err.message ?? "Sign up failed.");
+        }
+        const raw = await res.json();
+        const result = { ...rawToSession(raw), requiresVerification: false };
+        await saveSession(result);
+        return result;
+      }
+    },
+    async refreshToken({ refreshToken }) {
+      const raw = await headlessPost("/token/refresh", { refresh_token: refreshToken });
+      const updated = {
+        ...await readSession() ?? {},
+        accessToken: raw.access_token,
+        expiresAt: Date.now() + raw.expires_in * 1e3
+      };
+      await saveSession(updated);
+      return { accessToken: raw.access_token, expiresAt: updated.expiresAt };
+    },
+    async signOut({ refreshToken } = {}) {
+      const session = await readSession();
+      const token = refreshToken ?? session?.refreshToken;
+      await saveSession(null);
+      if (token) {
+        await fetch(`${headlessBase}/sign-out`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ refresh_token: token })
+        }).catch(() => {
+        });
+      }
+    }
+  };
   const client = {
     async initialize() {
       const response = await fetch(
@@ -222,7 +328,8 @@ function initAuth(config) {
         headers: { authorization: `Bearer ${token}` }
       });
       return response.ok ? response.json() : null;
-    }
+    },
+    headless
   };
   return client;
 }

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export interface SmartHiveAuthConfig {\n  projectId: string;\n  publishableKey: string;\n  baseUrl: string;\n  /** Custom branded auth domain, e.g. \"https://auth.myapp.com\". Used as the entry point for login/token flows. Falls back to baseUrl. */\n  authDomain?: string;\n  /** Fallback auth domain if authDomain is unreachable, e.g. \"https://auth.smarthivelabs.dev\". */\n  fallbackAuthDomain?: string;\n  redirectUri?: string;\n  storage?: AuthStorage;\n  temporaryStorage?: AuthStorage;\n}\n\nexport interface AuthStorage {\n  getItem(key: string): string | null | Promise<string | null>;\n  setItem(key: string, value: string): void | Promise<void>;\n  removeItem(key: string): void | Promise<void>;\n}\n\nexport interface AuthSession {\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  user?: unknown;\n}\n\nexport interface SmartHiveAuthClient {\n  initialize(): Promise<void>;\n  login(options?: { redirectUri?: string; state?: string }): Promise<void>;\n  handleCallback(options?: { url?: string }): Promise<AuthSession>;\n  logout(): Promise<void>;\n  getSession(): Promise<AuthSession | null>;\n  getAccessToken(): Promise<string | null>;\n  getAuthorizationHeader(): Promise<Record<string, string>>;\n  fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;\n  refreshSession(): Promise<AuthSession | null>;\n  verifyToken(token: string): Promise<boolean>;\n  getUser(): Promise<unknown>;\n}\n\nexport class SmartHiveAuthError extends Error {\n  constructor(public code: string, message: string) {\n    super(message);\n    this.name = \"SmartHiveAuthError\";\n  }\n}\n\n// ── PKCE helpers (Web Crypto — works in browser + Node 18+) ──────────────────\n\nexport async function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64urlEncode(array);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return base64urlEncode(new Uint8Array(digest));\n}\n\nfunction base64urlEncode(buffer: Uint8Array): string {\n  let str = \"\";\n  for (const byte of buffer) str += String.fromCharCode(byte);\n  return btoa(str).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n// ── Storage keys ─────────────────────────────────────────────────────────────\n\nexport const smartHiveAuthStorageKeys = {\n  session: \"smarthive.auth.session\",\n  pkceVerifier: \"smarthive.auth.pkce_verifier\",\n  pkceState: \"smarthive.auth.pkce_state\"\n} as const;\n\nfunction browserStorage(): AuthStorage {\n  return {\n    getItem: (key) => globalThis.localStorage?.getItem(key) ?? null,\n    setItem: (key, value) => globalThis.localStorage?.setItem(key, value),\n    removeItem: (key) => globalThis.localStorage?.removeItem(key)\n  };\n}\n\nfunction sessionStorageAdapter(): Pick<AuthStorage, \"getItem\" | \"setItem\" | \"removeItem\"> {\n  return {\n    getItem: (key) => globalThis.sessionStorage?.getItem(key) ?? null,\n    setItem: (key, value) => globalThis.sessionStorage?.setItem(key, value),\n    removeItem: (key) => globalThis.sessionStorage?.removeItem(key)\n  };\n}\n\nfunction normalizeBaseUrl(baseUrl: string) {\n  return baseUrl.replace(/\\/$/, \"\");\n}\n\n// ── Factory ───────────────────────────────────────────────────────────────────\n\nexport function initAuth(config: SmartHiveAuthConfig): SmartHiveAuthClient {\n  const baseUrl = normalizeBaseUrl(config.baseUrl);\n  const authBase = normalizeBaseUrl(config.authDomain ?? config.baseUrl);\n  const storage = config.storage ?? browserStorage();\n  const tempStorage = config.temporaryStorage ?? sessionStorageAdapter();\n\n  async function saveSession(session: AuthSession | null) {\n    if (!session) { await storage.removeItem(smartHiveAuthStorageKeys.session); return; }\n    await storage.setItem(smartHiveAuthStorageKeys.session, JSON.stringify(session));\n  }\n\n  async function readSession(): Promise<AuthSession | null> {\n    const raw = await storage.getItem(smartHiveAuthStorageKeys.session);\n    return raw ? JSON.parse(raw) as AuthSession : null;\n  }\n\n  const client: SmartHiveAuthClient = {\n    async initialize() {\n      const response = await fetch(\n        `${baseUrl}/sdk/config?projectId=${encodeURIComponent(config.projectId)}&publishableKey=${encodeURIComponent(config.publishableKey)}`\n      );\n      if (!response.ok) throw new SmartHiveAuthError(\"project_not_found\", \"Smart Hive Auth project configuration was not found.\");\n    },\n\n    async login(options) {\n      const redirectUri = options?.redirectUri ?? config.redirectUri ?? globalThis.location?.href;\n      const state = options?.state ?? crypto.randomUUID();\n      const verifier = await generateCodeVerifier();\n      const challenge = await generateCodeChallenge(verifier);\n\n      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceVerifier, verifier);\n      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceState, state);\n\n      const url = new URL(`${authBase}/api/auth/oauth2/authorize`);\n      url.searchParams.set(\"project_id\", config.projectId);\n      url.searchParams.set(\"publishable_key\", config.publishableKey);\n      url.searchParams.set(\"response_type\", \"code\");\n      url.searchParams.set(\"redirect_uri\", redirectUri);\n      url.searchParams.set(\"state\", state);\n      url.searchParams.set(\"code_challenge\", challenge);\n      url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n      globalThis.location.assign(url.toString());\n    },\n\n    async handleCallback(options) {\n      const href = options?.url ?? globalThis.location?.href;\n      if (!href) throw new SmartHiveAuthError(\"callback_failed\", \"No URL provided for callback handling.\");\n\n      const url = new URL(href);\n      const code = url.searchParams.get(\"code\");\n      const returnedState = url.searchParams.get(\"state\");\n\n      if (!code) throw new SmartHiveAuthError(\"callback_failed\", \"No authorization code in callback URL.\");\n\n      const storedState = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceState);\n      if (!storedState || !returnedState || storedState !== returnedState) {\n        throw new SmartHiveAuthError(\"state_mismatch\", \"OAuth state mismatch — possible CSRF attack.\");\n      }\n\n      const verifier = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceVerifier);\n      if (!verifier) {\n        throw new SmartHiveAuthError(\"pkce_missing\", \"Missing PKCE verifier for authorization code exchange.\");\n      }\n      const redirectUri = config.redirectUri ?? (url.origin + url.pathname);\n\n      const body = new URLSearchParams({\n        grant_type: \"authorization_code\",\n        code,\n        redirect_uri: redirectUri,\n        client_id: config.publishableKey\n      });\n      body.set(\"code_verifier\", verifier);\n\n      const response = await fetch(`${authBase}/api/auth/oauth2/token`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body\n      });\n\n      if (!response.ok) {\n        const err = await response.json().catch(() => ({})) as { error?: string; error_description?: string };\n        throw new SmartHiveAuthError(err.error ?? \"token_error\", err.error_description ?? \"Token exchange failed.\");\n      }\n\n      const tokenBody = await response.json() as {\n        access_token: string;\n        refresh_token?: string;\n        expires_in?: number;\n        token_type?: string;\n      };\n\n      const session: AuthSession = {\n        accessToken: tokenBody.access_token,\n        refreshToken: tokenBody.refresh_token,\n        expiresAt: tokenBody.expires_in ? Date.now() + tokenBody.expires_in * 1000 : undefined\n      };\n\n      await saveSession(session);\n      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceVerifier);\n      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceState);\n\n      return session;\n    },\n\n    async logout() {\n      await saveSession(null);\n      await fetch(`${baseUrl}/api/auth/sign-out`, { method: \"POST\", credentials: \"include\" });\n    },\n\n    getSession: readSession,\n\n    async getAccessToken() {\n      const session = await readSession();\n      if (!session) return null;\n      if (session.expiresAt && Date.now() > session.expiresAt - 30000) {\n        return (await client.refreshSession())?.accessToken ?? null;\n      }\n      return session.accessToken;\n    },\n\n    async getAuthorizationHeader() {\n      const token = await client.getAccessToken();\n      const headers: Record<string, string> = {};\n      if (token) headers.authorization = `Bearer ${token}`;\n      return headers;\n    },\n\n    async fetch(input, init = {}) {\n      const authHeader = await client.getAuthorizationHeader();\n      const headers = new Headers(init.headers);\n      for (const [key, value] of Object.entries(authHeader)) {\n        headers.set(key, value);\n      }\n      return fetch(input, { ...init, headers });\n    },\n\n    async refreshSession() {\n      const session = await readSession();\n      if (!session?.refreshToken) return session;\n      const response = await fetch(`${baseUrl}/api/auth/oauth2/token`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          grant_type: \"refresh_token\",\n          refresh_token: session.refreshToken\n        })\n      });\n      if (!response.ok) { await saveSession(null); return null; }\n      const body = await response.json() as { access_token: string; refresh_token?: string; expires_in?: number };\n      const nextSession: AuthSession = {\n        ...session,\n        accessToken: body.access_token,\n        refreshToken: body.refresh_token ?? session.refreshToken,\n        expiresAt: body.expires_in ? Date.now() + body.expires_in * 1000 : session.expiresAt\n      };\n      await saveSession(nextSession);\n      return nextSession;\n    },\n\n    async verifyToken(token) {\n      if (token.split(\".\").length !== 3) return false;\n      const response = await fetch(`${authBase}/api/auth/oauth2/userinfo`, {\n        headers: { authorization: `Bearer ${token}` }\n      });\n      return response.ok;\n    },\n\n    async getUser() {\n      const token = await client.getAccessToken();\n      if (!token) return null;\n      const response = await fetch(`${baseUrl}/api/auth/oauth2/userinfo`, {\n        headers: { authorization: `Bearer ${token}` }\n      });\n      return response.ok ? response.json() : null;\n    }\n  };\n\n  return client;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwCO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAmB,MAAc,SAAiB;AAChD,UAAM,OAAO;AADI;AAEjB,SAAK,OAAO;AAAA,EACd;AAAA,EAHmB;AAIrB;AAIA,eAAsB,uBAAwC;AAC5D,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,MAAM;AACV,aAAW,QAAQ,OAAQ,QAAO,OAAO,aAAa,IAAI;AAC1D,SAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC5E;AAIO,IAAM,2BAA2B;AAAA,EACtC,SAAS;AAAA,EACT,cAAc;AAAA,EACd,WAAW;AACb;AAEA,SAAS,iBAA8B;AACrC,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,WAAW,cAAc,QAAQ,GAAG,KAAK;AAAA,IAC3D,SAAS,CAAC,KAAK,UAAU,WAAW,cAAc,QAAQ,KAAK,KAAK;AAAA,IACpE,YAAY,CAAC,QAAQ,WAAW,cAAc,WAAW,GAAG;AAAA,EAC9D;AACF;AAEA,SAAS,wBAAiF;AACxF,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,WAAW,gBAAgB,QAAQ,GAAG,KAAK;AAAA,IAC7D,SAAS,CAAC,KAAK,UAAU,WAAW,gBAAgB,QAAQ,KAAK,KAAK;AAAA,IACtE,YAAY,CAAC,QAAQ,WAAW,gBAAgB,WAAW,GAAG;AAAA,EAChE;AACF;AAEA,SAAS,iBAAiB,SAAiB;AACzC,SAAO,QAAQ,QAAQ,OAAO,EAAE;AAClC;AAIO,SAAS,SAAS,QAAkD;AACzE,QAAM,UAAU,iBAAiB,OAAO,OAAO;AAC/C,QAAM,WAAW,iBAAiB,OAAO,cAAc,OAAO,OAAO;AACrE,QAAM,UAAU,OAAO,WAAW,eAAe;AACjD,QAAM,cAAc,OAAO,oBAAoB,sBAAsB;AAErE,iBAAe,YAAY,SAA6B;AACtD,QAAI,CAAC,SAAS;AAAE,YAAM,QAAQ,WAAW,yBAAyB,OAAO;AAAG;AAAA,IAAQ;AACpF,UAAM,QAAQ,QAAQ,yBAAyB,SAAS,KAAK,UAAU,OAAO,CAAC;AAAA,EACjF;AAEA,iBAAe,cAA2C;AACxD,UAAM,MAAM,MAAM,QAAQ,QAAQ,yBAAyB,OAAO;AAClE,WAAO,MAAM,KAAK,MAAM,GAAG,IAAmB;AAAA,EAChD;AAEA,QAAM,SAA8B;AAAA,IAClC,MAAM,aAAa;AACjB,YAAM,WAAW,MAAM;AAAA,QACrB,GAAG,OAAO,yBAAyB,mBAAmB,OAAO,SAAS,CAAC,mBAAmB,mBAAmB,OAAO,cAAc,CAAC;AAAA,MACrI;AACA,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AAAA,IAC5H;AAAA,IAEA,MAAM,MAAM,SAAS;AACnB,YAAM,cAAc,SAAS,eAAe,OAAO,eAAe,WAAW,UAAU;AACvF,YAAM,QAAQ,SAAS,SAAS,OAAO,WAAW;AAClD,YAAM,WAAW,MAAM,qBAAqB;AAC5C,YAAM,YAAY,MAAM,sBAAsB,QAAQ;AAEtD,YAAM,YAAY,QAAQ,yBAAyB,cAAc,QAAQ;AACzE,YAAM,YAAY,QAAQ,yBAAyB,WAAW,KAAK;AAEnE,YAAM,MAAM,IAAI,IAAI,GAAG,QAAQ,4BAA4B;AAC3D,UAAI,aAAa,IAAI,cAAc,OAAO,SAAS;AACnD,UAAI,aAAa,IAAI,mBAAmB,OAAO,cAAc;AAC7D,UAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,UAAI,aAAa,IAAI,gBAAgB,WAAW;AAChD,UAAI,aAAa,IAAI,SAAS,KAAK;AACnC,UAAI,aAAa,IAAI,kBAAkB,SAAS;AAChD,UAAI,aAAa,IAAI,yBAAyB,MAAM;AAEpD,iBAAW,SAAS,OAAO,IAAI,SAAS,CAAC;AAAA,IAC3C;AAAA,IAEA,MAAM,eAAe,SAAS;AAC5B,YAAM,OAAO,SAAS,OAAO,WAAW,UAAU;AAClD,UAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,mBAAmB,wCAAwC;AAEnG,YAAM,MAAM,IAAI,IAAI,IAAI;AACxB,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,gBAAgB,IAAI,aAAa,IAAI,OAAO;AAElD,UAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,mBAAmB,wCAAwC;AAEnG,YAAM,cAAc,MAAM,YAAY,QAAQ,yBAAyB,SAAS;AAChF,UAAI,CAAC,eAAe,CAAC,iBAAiB,gBAAgB,eAAe;AACnE,cAAM,IAAI,mBAAmB,kBAAkB,mDAA8C;AAAA,MAC/F;AAEA,YAAM,WAAW,MAAM,YAAY,QAAQ,yBAAyB,YAAY;AAChF,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,mBAAmB,gBAAgB,wDAAwD;AAAA,MACvG;AACA,YAAM,cAAc,OAAO,eAAgB,IAAI,SAAS,IAAI;AAE5D,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,YAAY;AAAA,QACZ;AAAA,QACA,cAAc;AAAA,QACd,WAAW,OAAO;AAAA,MACpB,CAAC;AACD,WAAK,IAAI,iBAAiB,QAAQ;AAElC,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,0BAA0B;AAAA,QAChE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,cAAM,IAAI,mBAAmB,IAAI,SAAS,eAAe,IAAI,qBAAqB,wBAAwB;AAAA,MAC5G;AAEA,YAAM,YAAY,MAAM,SAAS,KAAK;AAOtC,YAAM,UAAuB;AAAA,QAC3B,aAAa,UAAU;AAAA,QACvB,cAAc,UAAU;AAAA,QACxB,WAAW,UAAU,aAAa,KAAK,IAAI,IAAI,UAAU,aAAa,MAAO;AAAA,MAC/E;AAEA,YAAM,YAAY,OAAO;AACzB,YAAM,YAAY,WAAW,yBAAyB,YAAY;AAClE,YAAM,YAAY,WAAW,yBAAyB,SAAS;AAE/D,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,SAAS;AACb,YAAM,YAAY,IAAI;AACtB,YAAM,MAAM,GAAG,OAAO,sBAAsB,EAAE,QAAQ,QAAQ,aAAa,UAAU,CAAC;AAAA,IACxF;AAAA,IAEA,YAAY;AAAA,IAEZ,MAAM,iBAAiB;AACrB,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,CAAC,QAAS,QAAO;AACrB,UAAI,QAAQ,aAAa,KAAK,IAAI,IAAI,QAAQ,YAAY,KAAO;AAC/D,gBAAQ,MAAM,OAAO,eAAe,IAAI,eAAe;AAAA,MACzD;AACA,aAAO,QAAQ;AAAA,IACjB;AAAA,IAEA,MAAM,yBAAyB;AAC7B,YAAM,QAAQ,MAAM,OAAO,eAAe;AAC1C,YAAM,UAAkC,CAAC;AACzC,UAAI,MAAO,SAAQ,gBAAgB,UAAU,KAAK;AAClD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,MAAM,OAAO,OAAO,CAAC,GAAG;AAC5B,YAAM,aAAa,MAAM,OAAO,uBAAuB;AACvD,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,gBAAQ,IAAI,KAAK,KAAK;AAAA,MACxB;AACA,aAAO,MAAM,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAC1C;AAAA,IAEA,MAAM,iBAAiB;AACrB,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,CAAC,SAAS,aAAc,QAAO;AACnC,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,0BAA0B;AAAA,QAC/D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,IAAI,gBAAgB;AAAA,UACxB,YAAY;AAAA,UACZ,eAAe,QAAQ;AAAA,QACzB,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAAE,cAAM,YAAY,IAAI;AAAG,eAAO;AAAA,MAAM;AAC1D,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,cAA2B;AAAA,QAC/B,GAAG;AAAA,QACH,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK,iBAAiB,QAAQ;AAAA,QAC5C,WAAW,KAAK,aAAa,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO,QAAQ;AAAA,MAC7E;AACA,YAAM,YAAY,WAAW;AAC7B,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,UAAI,MAAM,MAAM,GAAG,EAAE,WAAW,EAAG,QAAO;AAC1C,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,6BAA6B;AAAA,QACnE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,UAAU;AACd,YAAM,QAAQ,MAAM,OAAO,eAAe;AAC1C,UAAI,CAAC,MAAO,QAAO;AACnB,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,6BAA6B;AAAA,QAClE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO,SAAS,KAAK,SAAS,KAAK,IAAI;AAAA,IACzC;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export interface SmartHiveAuthConfig {\n  projectId: string;\n  publishableKey: string;\n  baseUrl: string;\n  /** Custom branded auth domain, e.g. \"https://auth.myapp.com\". Used as the entry point for login/token flows. Falls back to baseUrl. */\n  authDomain?: string;\n  /** Fallback auth domain if authDomain is unreachable, e.g. \"https://auth.smarthivelabs.dev\". */\n  fallbackAuthDomain?: string;\n  redirectUri?: string;\n  storage?: AuthStorage;\n  temporaryStorage?: AuthStorage;\n}\n\nexport interface AuthStorage {\n  getItem(key: string): string | null | Promise<string | null>;\n  setItem(key: string, value: string): void | Promise<void>;\n  removeItem(key: string): void | Promise<void>;\n}\n\nexport interface AuthSession {\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  user?: unknown;\n}\n\n// ── Headless types ────────────────────────────────────────────────────────────\n\nexport interface HeadlessSignInResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresAt: number;\n  user?: unknown;\n}\n\nexport interface HeadlessSignUpResult extends HeadlessSignInResult {\n  /** True when email verification is required before the account can be used. */\n  requiresVerification?: boolean;\n}\n\nexport interface HeadlessClient {\n  signIn: {\n    /**\n     * Sign in with email and password. No browser redirect.\n     * Returns tokens immediately on success.\n     */\n    email(params: { email: string; password: string }): Promise<HeadlessSignInResult>;\n\n    phone: {\n      /**\n       * Send a one-time code to a phone number.\n       * Call `verify` with the code the user receives.\n       */\n      sendOtp(params: { phoneNumber: string }): Promise<void>;\n      /**\n       * Verify the OTP sent to the phone number and return tokens on success.\n       */\n      verify(params: { phoneNumber: string; code: string }): Promise<HeadlessSignInResult>;\n    };\n\n    emailOtp: {\n      /**\n       * Send a one-time code to an email address.\n       * Call `verify` with the code the user receives.\n       */\n      send(params: { email: string }): Promise<void>;\n      /**\n       * Verify the OTP sent to the email address and return tokens on success.\n       */\n      verify(params: { email: string; code: string }): Promise<HeadlessSignInResult>;\n    };\n\n    magicLink: {\n      /**\n       * Send a magic link to the given email address.\n       * The user clicks the link — no token is returned here.\n       */\n      send(params: { email: string; callbackURL?: string }): Promise<void>;\n    };\n  };\n\n  signUp: {\n    /**\n     * Create a new account with email and password. No browser redirect.\n     * If email verification is required, `requiresVerification` will be true\n     * and no tokens will be present — the user must verify before signing in.\n     */\n    email(params: { email: string; password: string; name?: string }): Promise<HeadlessSignUpResult>;\n  };\n\n  /** Refresh an expired access token using the refresh token. */\n  refreshToken(params: { refreshToken: string }): Promise<{ accessToken: string; expiresAt: number }>;\n\n  /** Sign the user out and invalidate their session on the server. */\n  signOut(params?: { refreshToken?: string }): Promise<void>;\n}\n\nexport interface SmartHiveAuthClient {\n  initialize(): Promise<void>;\n  login(options?: { redirectUri?: string; state?: string }): Promise<void>;\n  handleCallback(options?: { url?: string }): Promise<AuthSession>;\n  logout(): Promise<void>;\n  getSession(): Promise<AuthSession | null>;\n  getAccessToken(): Promise<string | null>;\n  getAuthorizationHeader(): Promise<Record<string, string>>;\n  fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;\n  refreshSession(): Promise<AuthSession | null>;\n  verifyToken(token: string): Promise<boolean>;\n  getUser(): Promise<unknown>;\n  /**\n   * Direct credential-based authentication — no browser redirect.\n   * Use these methods when you want full control of the sign-in UI\n   * (e.g. native mobile apps with custom login screens).\n   */\n  headless: HeadlessClient;\n}\n\nexport class SmartHiveAuthError extends Error {\n  constructor(public code: string, message: string) {\n    super(message);\n    this.name = \"SmartHiveAuthError\";\n  }\n}\n\n// ── PKCE helpers (Web Crypto — works in browser + Node 18+) ──────────────────\n\nexport async function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64urlEncode(array);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return base64urlEncode(new Uint8Array(digest));\n}\n\nfunction base64urlEncode(buffer: Uint8Array): string {\n  let str = \"\";\n  for (const byte of buffer) str += String.fromCharCode(byte);\n  return btoa(str).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n// ── Storage keys ─────────────────────────────────────────────────────────────\n\nexport const smartHiveAuthStorageKeys = {\n  session: \"smarthive.auth.session\",\n  pkceVerifier: \"smarthive.auth.pkce_verifier\",\n  pkceState: \"smarthive.auth.pkce_state\"\n} as const;\n\nfunction browserStorage(): AuthStorage {\n  return {\n    getItem: (key) => globalThis.localStorage?.getItem(key) ?? null,\n    setItem: (key, value) => globalThis.localStorage?.setItem(key, value),\n    removeItem: (key) => globalThis.localStorage?.removeItem(key)\n  };\n}\n\nfunction sessionStorageAdapter(): Pick<AuthStorage, \"getItem\" | \"setItem\" | \"removeItem\"> {\n  return {\n    getItem: (key) => globalThis.sessionStorage?.getItem(key) ?? null,\n    setItem: (key, value) => globalThis.sessionStorage?.setItem(key, value),\n    removeItem: (key) => globalThis.sessionStorage?.removeItem(key)\n  };\n}\n\nfunction normalizeBaseUrl(baseUrl: string) {\n  return baseUrl.replace(/\\/$/, \"\");\n}\n\n/** Extract the environment prefix from a publishable key (pk_dev_*, pk_staging_*, pk_prod_*). */\nfunction envFromPublishableKey(publishableKey: string): string {\n  const match = publishableKey.match(/^pk_(dev|staging|prod)_/);\n  return match ? match[1] : \"prod\";\n}\n\n// ── Headless response shape from the backend ──────────────────────────────────\n\ninterface RawHeadlessResponse {\n  access_token: string;\n  refresh_token: string;\n  expires_in: number;\n  token_type: string;\n  user?: unknown;\n  requires_verification?: boolean;\n  message?: string;\n}\n\n// ── Factory ───────────────────────────────────────────────────────────────────\n\nexport function initAuth(config: SmartHiveAuthConfig): SmartHiveAuthClient {\n  const baseUrl = normalizeBaseUrl(config.baseUrl);\n  const authBase = normalizeBaseUrl(config.authDomain ?? config.baseUrl);\n  const storage = config.storage ?? browserStorage();\n  const tempStorage = config.temporaryStorage ?? sessionStorageAdapter();\n  const environment = envFromPublishableKey(config.publishableKey);\n  const headlessBase = `${baseUrl}/${environment}/api/auth/headless`;\n\n  async function saveSession(session: AuthSession | null) {\n    if (!session) { await storage.removeItem(smartHiveAuthStorageKeys.session); return; }\n    await storage.setItem(smartHiveAuthStorageKeys.session, JSON.stringify(session));\n  }\n\n  async function readSession(): Promise<AuthSession | null> {\n    const raw = await storage.getItem(smartHiveAuthStorageKeys.session);\n    return raw ? JSON.parse(raw) as AuthSession : null;\n  }\n\n  function rawToSession(raw: RawHeadlessResponse): HeadlessSignInResult {\n    return {\n      accessToken: raw.access_token,\n      refreshToken: raw.refresh_token,\n      expiresAt: Date.now() + raw.expires_in * 1000,\n      user: raw.user,\n    };\n  }\n\n  async function headlessPost(path: string, body: Record<string, unknown>): Promise<RawHeadlessResponse> {\n    const res = await fetch(`${headlessBase}${path}`, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!res.ok) {\n      const err = await res.json().catch(() => ({})) as { error?: string; message?: string };\n      throw new SmartHiveAuthError(\n        err.error ?? \"request_failed\",\n        err.message ?? `Request to ${path} failed.`\n      );\n    }\n\n    return res.json() as Promise<RawHeadlessResponse>;\n  }\n\n  async function headlessSignInAndSave(path: string, body: Record<string, unknown>): Promise<HeadlessSignInResult> {\n    const raw = await headlessPost(path, body);\n    const result = rawToSession(raw);\n    await saveSession(result);\n    return result;\n  }\n\n  const headless: HeadlessClient = {\n    signIn: {\n      async email({ email, password }) {\n        return headlessSignInAndSave(\"/sign-in/email\", { email, password });\n      },\n\n      phone: {\n        async sendOtp({ phoneNumber }) {\n          await headlessPost(\"/phone/send-otp\", { phoneNumber });\n        },\n        async verify({ phoneNumber, code }) {\n          return headlessSignInAndSave(\"/phone/verify\", { phoneNumber, code });\n        },\n      },\n\n      emailOtp: {\n        async send({ email }) {\n          await headlessPost(\"/email-otp/send\", { email });\n        },\n        async verify({ email, code }) {\n          return headlessSignInAndSave(\"/email-otp/verify\", { email, code });\n        },\n      },\n\n      magicLink: {\n        async send({ email, callbackURL }) {\n          await headlessPost(\"/magic-link/send\", { email, ...(callbackURL ? { callbackURL } : {}) });\n        },\n      },\n    },\n\n    signUp: {\n      async email({ email, password, name }) {\n        const res = await fetch(`${headlessBase}/sign-up/email`, {\n          method: \"POST\",\n          headers: { \"content-type\": \"application/json\" },\n          body: JSON.stringify({ email, password, name }),\n        });\n\n        // 202 = account created but email verification required\n        if (res.status === 202) {\n          return { accessToken: \"\", refreshToken: \"\", expiresAt: 0, requiresVerification: true };\n        }\n\n        if (!res.ok) {\n          const err = await res.json().catch(() => ({})) as { error?: string; message?: string };\n          throw new SmartHiveAuthError(err.error ?? \"sign_up_failed\", err.message ?? \"Sign up failed.\");\n        }\n\n        const raw = await res.json() as RawHeadlessResponse;\n        const result: HeadlessSignUpResult = { ...rawToSession(raw), requiresVerification: false };\n        await saveSession(result);\n        return result;\n      },\n    },\n\n    async refreshToken({ refreshToken }) {\n      const raw = await headlessPost(\"/token/refresh\", { refresh_token: refreshToken });\n      const updated: AuthSession = {\n        ...(await readSession() ?? {}),\n        accessToken: raw.access_token,\n        expiresAt: Date.now() + raw.expires_in * 1000,\n      };\n      await saveSession(updated);\n      return { accessToken: raw.access_token, expiresAt: updated.expiresAt! };\n    },\n\n    async signOut({ refreshToken } = {}) {\n      const session = await readSession();\n      const token = refreshToken ?? session?.refreshToken;\n      await saveSession(null);\n      if (token) {\n        await fetch(`${headlessBase}/sign-out`, {\n          method: \"POST\",\n          headers: { \"content-type\": \"application/json\" },\n          body: JSON.stringify({ refresh_token: token }),\n        }).catch(() => {});\n      }\n    },\n  };\n\n  const client: SmartHiveAuthClient = {\n    async initialize() {\n      const response = await fetch(\n        `${baseUrl}/sdk/config?projectId=${encodeURIComponent(config.projectId)}&publishableKey=${encodeURIComponent(config.publishableKey)}`\n      );\n      if (!response.ok) throw new SmartHiveAuthError(\"project_not_found\", \"Smart Hive Auth project configuration was not found.\");\n    },\n\n    async login(options) {\n      const redirectUri = options?.redirectUri ?? config.redirectUri ?? globalThis.location?.href;\n      const state = options?.state ?? crypto.randomUUID();\n      const verifier = await generateCodeVerifier();\n      const challenge = await generateCodeChallenge(verifier);\n\n      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceVerifier, verifier);\n      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceState, state);\n\n      const url = new URL(`${authBase}/api/auth/oauth2/authorize`);\n      url.searchParams.set(\"project_id\", config.projectId);\n      url.searchParams.set(\"publishable_key\", config.publishableKey);\n      url.searchParams.set(\"response_type\", \"code\");\n      url.searchParams.set(\"redirect_uri\", redirectUri);\n      url.searchParams.set(\"state\", state);\n      url.searchParams.set(\"code_challenge\", challenge);\n      url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n      globalThis.location.assign(url.toString());\n    },\n\n    async handleCallback(options) {\n      const href = options?.url ?? globalThis.location?.href;\n      if (!href) throw new SmartHiveAuthError(\"callback_failed\", \"No URL provided for callback handling.\");\n\n      const url = new URL(href);\n      const code = url.searchParams.get(\"code\");\n      const returnedState = url.searchParams.get(\"state\");\n\n      if (!code) throw new SmartHiveAuthError(\"callback_failed\", \"No authorization code in callback URL.\");\n\n      const storedState = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceState);\n      if (!storedState || !returnedState || storedState !== returnedState) {\n        throw new SmartHiveAuthError(\"state_mismatch\", \"OAuth state mismatch — possible CSRF attack.\");\n      }\n\n      const verifier = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceVerifier);\n      if (!verifier) {\n        throw new SmartHiveAuthError(\"pkce_missing\", \"Missing PKCE verifier for authorization code exchange.\");\n      }\n      const redirectUri = config.redirectUri ?? (url.origin + url.pathname);\n\n      const body = new URLSearchParams({\n        grant_type: \"authorization_code\",\n        code,\n        redirect_uri: redirectUri,\n        client_id: config.publishableKey\n      });\n      body.set(\"code_verifier\", verifier);\n\n      const response = await fetch(`${authBase}/api/auth/oauth2/token`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body\n      });\n\n      if (!response.ok) {\n        const err = await response.json().catch(() => ({})) as { error?: string; error_description?: string };\n        throw new SmartHiveAuthError(err.error ?? \"token_error\", err.error_description ?? \"Token exchange failed.\");\n      }\n\n      const tokenBody = await response.json() as {\n        access_token: string;\n        refresh_token?: string;\n        expires_in?: number;\n        token_type?: string;\n      };\n\n      const session: AuthSession = {\n        accessToken: tokenBody.access_token,\n        refreshToken: tokenBody.refresh_token,\n        expiresAt: tokenBody.expires_in ? Date.now() + tokenBody.expires_in * 1000 : undefined\n      };\n\n      await saveSession(session);\n      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceVerifier);\n      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceState);\n\n      return session;\n    },\n\n    async logout() {\n      await saveSession(null);\n      await fetch(`${baseUrl}/api/auth/sign-out`, { method: \"POST\", credentials: \"include\" });\n    },\n\n    getSession: readSession,\n\n    async getAccessToken() {\n      const session = await readSession();\n      if (!session) return null;\n      if (session.expiresAt && Date.now() > session.expiresAt - 30000) {\n        return (await client.refreshSession())?.accessToken ?? null;\n      }\n      return session.accessToken;\n    },\n\n    async getAuthorizationHeader() {\n      const token = await client.getAccessToken();\n      const headers: Record<string, string> = {};\n      if (token) headers.authorization = `Bearer ${token}`;\n      return headers;\n    },\n\n    async fetch(input, init = {}) {\n      const authHeader = await client.getAuthorizationHeader();\n      const headers = new Headers(init.headers);\n      for (const [key, value] of Object.entries(authHeader)) {\n        headers.set(key, value);\n      }\n      return fetch(input, { ...init, headers });\n    },\n\n    async refreshSession() {\n      const session = await readSession();\n      if (!session?.refreshToken) return session;\n      const response = await fetch(`${baseUrl}/api/auth/oauth2/token`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          grant_type: \"refresh_token\",\n          refresh_token: session.refreshToken\n        })\n      });\n      if (!response.ok) { await saveSession(null); return null; }\n      const body = await response.json() as { access_token: string; refresh_token?: string; expires_in?: number };\n      const nextSession: AuthSession = {\n        ...session,\n        accessToken: body.access_token,\n        refreshToken: body.refresh_token ?? session.refreshToken,\n        expiresAt: body.expires_in ? Date.now() + body.expires_in * 1000 : session.expiresAt\n      };\n      await saveSession(nextSession);\n      return nextSession;\n    },\n\n    async verifyToken(token) {\n      if (token.split(\".\").length !== 3) return false;\n      const response = await fetch(`${authBase}/api/auth/oauth2/userinfo`, {\n        headers: { authorization: `Bearer ${token}` }\n      });\n      return response.ok;\n    },\n\n    async getUser() {\n      const token = await client.getAccessToken();\n      if (!token) return null;\n      const response = await fetch(`${baseUrl}/api/auth/oauth2/userinfo`, {\n        headers: { authorization: `Bearer ${token}` }\n      });\n      return response.ok ? response.json() : null;\n    },\n\n    headless,\n  };\n\n  return client;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqHO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAmB,MAAc,SAAiB;AAChD,UAAM,OAAO;AADI;AAEjB,SAAK,OAAO;AAAA,EACd;AAAA,EAHmB;AAIrB;AAIA,eAAsB,uBAAwC;AAC5D,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,MAAM;AACV,aAAW,QAAQ,OAAQ,QAAO,OAAO,aAAa,IAAI;AAC1D,SAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC5E;AAIO,IAAM,2BAA2B;AAAA,EACtC,SAAS;AAAA,EACT,cAAc;AAAA,EACd,WAAW;AACb;AAEA,SAAS,iBAA8B;AACrC,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,WAAW,cAAc,QAAQ,GAAG,KAAK;AAAA,IAC3D,SAAS,CAAC,KAAK,UAAU,WAAW,cAAc,QAAQ,KAAK,KAAK;AAAA,IACpE,YAAY,CAAC,QAAQ,WAAW,cAAc,WAAW,GAAG;AAAA,EAC9D;AACF;AAEA,SAAS,wBAAiF;AACxF,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,WAAW,gBAAgB,QAAQ,GAAG,KAAK;AAAA,IAC7D,SAAS,CAAC,KAAK,UAAU,WAAW,gBAAgB,QAAQ,KAAK,KAAK;AAAA,IACtE,YAAY,CAAC,QAAQ,WAAW,gBAAgB,WAAW,GAAG;AAAA,EAChE;AACF;AAEA,SAAS,iBAAiB,SAAiB;AACzC,SAAO,QAAQ,QAAQ,OAAO,EAAE;AAClC;AAGA,SAAS,sBAAsB,gBAAgC;AAC7D,QAAM,QAAQ,eAAe,MAAM,yBAAyB;AAC5D,SAAO,QAAQ,MAAM,CAAC,IAAI;AAC5B;AAgBO,SAAS,SAAS,QAAkD;AACzE,QAAM,UAAU,iBAAiB,OAAO,OAAO;AAC/C,QAAM,WAAW,iBAAiB,OAAO,cAAc,OAAO,OAAO;AACrE,QAAM,UAAU,OAAO,WAAW,eAAe;AACjD,QAAM,cAAc,OAAO,oBAAoB,sBAAsB;AACrE,QAAM,cAAc,sBAAsB,OAAO,cAAc;AAC/D,QAAM,eAAe,GAAG,OAAO,IAAI,WAAW;AAE9C,iBAAe,YAAY,SAA6B;AACtD,QAAI,CAAC,SAAS;AAAE,YAAM,QAAQ,WAAW,yBAAyB,OAAO;AAAG;AAAA,IAAQ;AACpF,UAAM,QAAQ,QAAQ,yBAAyB,SAAS,KAAK,UAAU,OAAO,CAAC;AAAA,EACjF;AAEA,iBAAe,cAA2C;AACxD,UAAM,MAAM,MAAM,QAAQ,QAAQ,yBAAyB,OAAO;AAClE,WAAO,MAAM,KAAK,MAAM,GAAG,IAAmB;AAAA,EAChD;AAEA,WAAS,aAAa,KAAgD;AACpE,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,WAAW,KAAK,IAAI,IAAI,IAAI,aAAa;AAAA,MACzC,MAAM,IAAI;AAAA,IACZ;AAAA,EACF;AAEA,iBAAe,aAAa,MAAc,MAA6D;AACrG,UAAM,MAAM,MAAM,MAAM,GAAG,YAAY,GAAG,IAAI,IAAI;AAAA,MAChD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC7C,YAAM,IAAI;AAAA,QACR,IAAI,SAAS;AAAA,QACb,IAAI,WAAW,cAAc,IAAI;AAAA,MACnC;AAAA,IACF;AAEA,WAAO,IAAI,KAAK;AAAA,EAClB;AAEA,iBAAe,sBAAsB,MAAc,MAA8D;AAC/G,UAAM,MAAM,MAAM,aAAa,MAAM,IAAI;AACzC,UAAM,SAAS,aAAa,GAAG;AAC/B,UAAM,YAAY,MAAM;AACxB,WAAO;AAAA,EACT;AAEA,QAAM,WAA2B;AAAA,IAC/B,QAAQ;AAAA,MACN,MAAM,MAAM,EAAE,OAAO,SAAS,GAAG;AAC/B,eAAO,sBAAsB,kBAAkB,EAAE,OAAO,SAAS,CAAC;AAAA,MACpE;AAAA,MAEA,OAAO;AAAA,QACL,MAAM,QAAQ,EAAE,YAAY,GAAG;AAC7B,gBAAM,aAAa,mBAAmB,EAAE,YAAY,CAAC;AAAA,QACvD;AAAA,QACA,MAAM,OAAO,EAAE,aAAa,KAAK,GAAG;AAClC,iBAAO,sBAAsB,iBAAiB,EAAE,aAAa,KAAK,CAAC;AAAA,QACrE;AAAA,MACF;AAAA,MAEA,UAAU;AAAA,QACR,MAAM,KAAK,EAAE,MAAM,GAAG;AACpB,gBAAM,aAAa,mBAAmB,EAAE,MAAM,CAAC;AAAA,QACjD;AAAA,QACA,MAAM,OAAO,EAAE,OAAO,KAAK,GAAG;AAC5B,iBAAO,sBAAsB,qBAAqB,EAAE,OAAO,KAAK,CAAC;AAAA,QACnE;AAAA,MACF;AAAA,MAEA,WAAW;AAAA,QACT,MAAM,KAAK,EAAE,OAAO,YAAY,GAAG;AACjC,gBAAM,aAAa,oBAAoB,EAAE,OAAO,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC,EAAG,CAAC;AAAA,QAC3F;AAAA,MACF;AAAA,IACF;AAAA,IAEA,QAAQ;AAAA,MACN,MAAM,MAAM,EAAE,OAAO,UAAU,KAAK,GAAG;AACrC,cAAM,MAAM,MAAM,MAAM,GAAG,YAAY,kBAAkB;AAAA,UACvD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,UAAU,KAAK,CAAC;AAAA,QAChD,CAAC;AAGD,YAAI,IAAI,WAAW,KAAK;AACtB,iBAAO,EAAE,aAAa,IAAI,cAAc,IAAI,WAAW,GAAG,sBAAsB,KAAK;AAAA,QACvF;AAEA,YAAI,CAAC,IAAI,IAAI;AACX,gBAAM,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC7C,gBAAM,IAAI,mBAAmB,IAAI,SAAS,kBAAkB,IAAI,WAAW,iBAAiB;AAAA,QAC9F;AAEA,cAAM,MAAM,MAAM,IAAI,KAAK;AAC3B,cAAM,SAA+B,EAAE,GAAG,aAAa,GAAG,GAAG,sBAAsB,MAAM;AACzF,cAAM,YAAY,MAAM;AACxB,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,EAAE,aAAa,GAAG;AACnC,YAAM,MAAM,MAAM,aAAa,kBAAkB,EAAE,eAAe,aAAa,CAAC;AAChF,YAAM,UAAuB;AAAA,QAC3B,GAAI,MAAM,YAAY,KAAK,CAAC;AAAA,QAC5B,aAAa,IAAI;AAAA,QACjB,WAAW,KAAK,IAAI,IAAI,IAAI,aAAa;AAAA,MAC3C;AACA,YAAM,YAAY,OAAO;AACzB,aAAO,EAAE,aAAa,IAAI,cAAc,WAAW,QAAQ,UAAW;AAAA,IACxE;AAAA,IAEA,MAAM,QAAQ,EAAE,aAAa,IAAI,CAAC,GAAG;AACnC,YAAM,UAAU,MAAM,YAAY;AAClC,YAAM,QAAQ,gBAAgB,SAAS;AACvC,YAAM,YAAY,IAAI;AACtB,UAAI,OAAO;AACT,cAAM,MAAM,GAAG,YAAY,aAAa;AAAA,UACtC,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,eAAe,MAAM,CAAC;AAAA,QAC/C,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAA8B;AAAA,IAClC,MAAM,aAAa;AACjB,YAAM,WAAW,MAAM;AAAA,QACrB,GAAG,OAAO,yBAAyB,mBAAmB,OAAO,SAAS,CAAC,mBAAmB,mBAAmB,OAAO,cAAc,CAAC;AAAA,MACrI;AACA,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AAAA,IAC5H;AAAA,IAEA,MAAM,MAAM,SAAS;AACnB,YAAM,cAAc,SAAS,eAAe,OAAO,eAAe,WAAW,UAAU;AACvF,YAAM,QAAQ,SAAS,SAAS,OAAO,WAAW;AAClD,YAAM,WAAW,MAAM,qBAAqB;AAC5C,YAAM,YAAY,MAAM,sBAAsB,QAAQ;AAEtD,YAAM,YAAY,QAAQ,yBAAyB,cAAc,QAAQ;AACzE,YAAM,YAAY,QAAQ,yBAAyB,WAAW,KAAK;AAEnE,YAAM,MAAM,IAAI,IAAI,GAAG,QAAQ,4BAA4B;AAC3D,UAAI,aAAa,IAAI,cAAc,OAAO,SAAS;AACnD,UAAI,aAAa,IAAI,mBAAmB,OAAO,cAAc;AAC7D,UAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,UAAI,aAAa,IAAI,gBAAgB,WAAW;AAChD,UAAI,aAAa,IAAI,SAAS,KAAK;AACnC,UAAI,aAAa,IAAI,kBAAkB,SAAS;AAChD,UAAI,aAAa,IAAI,yBAAyB,MAAM;AAEpD,iBAAW,SAAS,OAAO,IAAI,SAAS,CAAC;AAAA,IAC3C;AAAA,IAEA,MAAM,eAAe,SAAS;AAC5B,YAAM,OAAO,SAAS,OAAO,WAAW,UAAU;AAClD,UAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,mBAAmB,wCAAwC;AAEnG,YAAM,MAAM,IAAI,IAAI,IAAI;AACxB,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,gBAAgB,IAAI,aAAa,IAAI,OAAO;AAElD,UAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,mBAAmB,wCAAwC;AAEnG,YAAM,cAAc,MAAM,YAAY,QAAQ,yBAAyB,SAAS;AAChF,UAAI,CAAC,eAAe,CAAC,iBAAiB,gBAAgB,eAAe;AACnE,cAAM,IAAI,mBAAmB,kBAAkB,mDAA8C;AAAA,MAC/F;AAEA,YAAM,WAAW,MAAM,YAAY,QAAQ,yBAAyB,YAAY;AAChF,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,mBAAmB,gBAAgB,wDAAwD;AAAA,MACvG;AACA,YAAM,cAAc,OAAO,eAAgB,IAAI,SAAS,IAAI;AAE5D,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,YAAY;AAAA,QACZ;AAAA,QACA,cAAc;AAAA,QACd,WAAW,OAAO;AAAA,MACpB,CAAC;AACD,WAAK,IAAI,iBAAiB,QAAQ;AAElC,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,0BAA0B;AAAA,QAChE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,cAAM,IAAI,mBAAmB,IAAI,SAAS,eAAe,IAAI,qBAAqB,wBAAwB;AAAA,MAC5G;AAEA,YAAM,YAAY,MAAM,SAAS,KAAK;AAOtC,YAAM,UAAuB;AAAA,QAC3B,aAAa,UAAU;AAAA,QACvB,cAAc,UAAU;AAAA,QACxB,WAAW,UAAU,aAAa,KAAK,IAAI,IAAI,UAAU,aAAa,MAAO;AAAA,MAC/E;AAEA,YAAM,YAAY,OAAO;AACzB,YAAM,YAAY,WAAW,yBAAyB,YAAY;AAClE,YAAM,YAAY,WAAW,yBAAyB,SAAS;AAE/D,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,SAAS;AACb,YAAM,YAAY,IAAI;AACtB,YAAM,MAAM,GAAG,OAAO,sBAAsB,EAAE,QAAQ,QAAQ,aAAa,UAAU,CAAC;AAAA,IACxF;AAAA,IAEA,YAAY;AAAA,IAEZ,MAAM,iBAAiB;AACrB,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,CAAC,QAAS,QAAO;AACrB,UAAI,QAAQ,aAAa,KAAK,IAAI,IAAI,QAAQ,YAAY,KAAO;AAC/D,gBAAQ,MAAM,OAAO,eAAe,IAAI,eAAe;AAAA,MACzD;AACA,aAAO,QAAQ;AAAA,IACjB;AAAA,IAEA,MAAM,yBAAyB;AAC7B,YAAM,QAAQ,MAAM,OAAO,eAAe;AAC1C,YAAM,UAAkC,CAAC;AACzC,UAAI,MAAO,SAAQ,gBAAgB,UAAU,KAAK;AAClD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,MAAM,OAAO,OAAO,CAAC,GAAG;AAC5B,YAAM,aAAa,MAAM,OAAO,uBAAuB;AACvD,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,gBAAQ,IAAI,KAAK,KAAK;AAAA,MACxB;AACA,aAAO,MAAM,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAC1C;AAAA,IAEA,MAAM,iBAAiB;AACrB,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,CAAC,SAAS,aAAc,QAAO;AACnC,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,0BAA0B;AAAA,QAC/D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,IAAI,gBAAgB;AAAA,UACxB,YAAY;AAAA,UACZ,eAAe,QAAQ;AAAA,QACzB,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAAE,cAAM,YAAY,IAAI;AAAG,eAAO;AAAA,MAAM;AAC1D,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,cAA2B;AAAA,QAC/B,GAAG;AAAA,QACH,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK,iBAAiB,QAAQ;AAAA,QAC5C,WAAW,KAAK,aAAa,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO,QAAQ;AAAA,MAC7E;AACA,YAAM,YAAY,WAAW;AAC7B,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,UAAI,MAAM,MAAM,GAAG,EAAE,WAAW,EAAG,QAAO;AAC1C,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,6BAA6B;AAAA,QACnE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,UAAU;AACd,YAAM,QAAQ,MAAM,OAAO,eAAe;AAC1C,UAAI,CAAC,MAAO,QAAO;AACnB,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,6BAA6B;AAAA,QAClE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO,SAAS,KAAK,SAAS,KAAK,IAAI;AAAA,IACzC;AAAA,IAEA;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/index.d.cts

@@ -21,6 +21,93 @@ interface AuthSession {
     expiresAt?: number;
     user?: unknown;
 }
+interface HeadlessSignInResult {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    user?: unknown;
+}
+interface HeadlessSignUpResult extends HeadlessSignInResult {
+    /** True when email verification is required before the account can be used. */
+    requiresVerification?: boolean;
+}
+interface HeadlessClient {
+    signIn: {
+        /**
+         * Sign in with email and password. No browser redirect.
+         * Returns tokens immediately on success.
+         */
+        email(params: {
+            email: string;
+            password: string;
+        }): Promise<HeadlessSignInResult>;
+        phone: {
+            /**
+             * Send a one-time code to a phone number.
+             * Call `verify` with the code the user receives.
+             */
+            sendOtp(params: {
+                phoneNumber: string;
+            }): Promise<void>;
+            /**
+             * Verify the OTP sent to the phone number and return tokens on success.
+             */
+            verify(params: {
+                phoneNumber: string;
+                code: string;
+            }): Promise<HeadlessSignInResult>;
+        };
+        emailOtp: {
+            /**
+             * Send a one-time code to an email address.
+             * Call `verify` with the code the user receives.
+             */
+            send(params: {
+                email: string;
+            }): Promise<void>;
+            /**
+             * Verify the OTP sent to the email address and return tokens on success.
+             */
+            verify(params: {
+                email: string;
+                code: string;
+            }): Promise<HeadlessSignInResult>;
+        };
+        magicLink: {
+            /**
+             * Send a magic link to the given email address.
+             * The user clicks the link — no token is returned here.
+             */
+            send(params: {
+                email: string;
+                callbackURL?: string;
+            }): Promise<void>;
+        };
+    };
+    signUp: {
+        /**
+         * Create a new account with email and password. No browser redirect.
+         * If email verification is required, `requiresVerification` will be true
+         * and no tokens will be present — the user must verify before signing in.
+         */
+        email(params: {
+            email: string;
+            password: string;
+            name?: string;
+        }): Promise<HeadlessSignUpResult>;
+    };
+    /** Refresh an expired access token using the refresh token. */
+    refreshToken(params: {
+        refreshToken: string;
+    }): Promise<{
+        accessToken: string;
+        expiresAt: number;
+    }>;
+    /** Sign the user out and invalidate their session on the server. */
+    signOut(params?: {
+        refreshToken?: string;
+    }): Promise<void>;
+}
 interface SmartHiveAuthClient {
     initialize(): Promise<void>;
     login(options?: {
@@ -38,6 +125,12 @@ interface SmartHiveAuthClient {
     refreshSession(): Promise<AuthSession | null>;
     verifyToken(token: string): Promise<boolean>;
     getUser(): Promise<unknown>;
+    /**
+     * Direct credential-based authentication — no browser redirect.
+     * Use these methods when you want full control of the sign-in UI
+     * (e.g. native mobile apps with custom login screens).
+     */
+    headless: HeadlessClient;
 }
 declare class SmartHiveAuthError extends Error {
     code: string;
@@ -52,4 +145,4 @@ declare const smartHiveAuthStorageKeys: {
 };
 declare function initAuth(config: SmartHiveAuthConfig): SmartHiveAuthClient;
 
-export { type AuthSession, type AuthStorage, type SmartHiveAuthClient, type SmartHiveAuthConfig, SmartHiveAuthError, generateCodeChallenge, generateCodeVerifier, initAuth, smartHiveAuthStorageKeys };
+export { type AuthSession, type AuthStorage, type HeadlessClient, type HeadlessSignInResult, type HeadlessSignUpResult, type SmartHiveAuthClient, type SmartHiveAuthConfig, SmartHiveAuthError, generateCodeChallenge, generateCodeVerifier, initAuth, smartHiveAuthStorageKeys };

package/dist/index.d.ts

@@ -21,6 +21,93 @@ interface AuthSession {
     expiresAt?: number;
     user?: unknown;
 }
+interface HeadlessSignInResult {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    user?: unknown;
+}
+interface HeadlessSignUpResult extends HeadlessSignInResult {
+    /** True when email verification is required before the account can be used. */
+    requiresVerification?: boolean;
+}
+interface HeadlessClient {
+    signIn: {
+        /**
+         * Sign in with email and password. No browser redirect.
+         * Returns tokens immediately on success.
+         */
+        email(params: {
+            email: string;
+            password: string;
+        }): Promise<HeadlessSignInResult>;
+        phone: {
+            /**
+             * Send a one-time code to a phone number.
+             * Call `verify` with the code the user receives.
+             */
+            sendOtp(params: {
+                phoneNumber: string;
+            }): Promise<void>;
+            /**
+             * Verify the OTP sent to the phone number and return tokens on success.
+             */
+            verify(params: {
+                phoneNumber: string;
+                code: string;
+            }): Promise<HeadlessSignInResult>;
+        };
+        emailOtp: {
+            /**
+             * Send a one-time code to an email address.
+             * Call `verify` with the code the user receives.
+             */
+            send(params: {
+                email: string;
+            }): Promise<void>;
+            /**
+             * Verify the OTP sent to the email address and return tokens on success.
+             */
+            verify(params: {
+                email: string;
+                code: string;
+            }): Promise<HeadlessSignInResult>;
+        };
+        magicLink: {
+            /**
+             * Send a magic link to the given email address.
+             * The user clicks the link — no token is returned here.
+             */
+            send(params: {
+                email: string;
+                callbackURL?: string;
+            }): Promise<void>;
+        };
+    };
+    signUp: {
+        /**
+         * Create a new account with email and password. No browser redirect.
+         * If email verification is required, `requiresVerification` will be true
+         * and no tokens will be present — the user must verify before signing in.
+         */
+        email(params: {
+            email: string;
+            password: string;
+            name?: string;
+        }): Promise<HeadlessSignUpResult>;
+    };
+    /** Refresh an expired access token using the refresh token. */
+    refreshToken(params: {
+        refreshToken: string;
+    }): Promise<{
+        accessToken: string;
+        expiresAt: number;
+    }>;
+    /** Sign the user out and invalidate their session on the server. */
+    signOut(params?: {
+        refreshToken?: string;
+    }): Promise<void>;
+}
 interface SmartHiveAuthClient {
     initialize(): Promise<void>;
     login(options?: {
@@ -38,6 +125,12 @@ interface SmartHiveAuthClient {
     refreshSession(): Promise<AuthSession | null>;
     verifyToken(token: string): Promise<boolean>;
     getUser(): Promise<unknown>;
+    /**
+     * Direct credential-based authentication — no browser redirect.
+     * Use these methods when you want full control of the sign-in UI
+     * (e.g. native mobile apps with custom login screens).
+     */
+    headless: HeadlessClient;
 }
 declare class SmartHiveAuthError extends Error {
     code: string;
@@ -52,4 +145,4 @@ declare const smartHiveAuthStorageKeys: {
 };
 declare function initAuth(config: SmartHiveAuthConfig): SmartHiveAuthClient;
 
-export { type AuthSession, type AuthStorage, type SmartHiveAuthClient, type SmartHiveAuthConfig, SmartHiveAuthError, generateCodeChallenge, generateCodeVerifier, initAuth, smartHiveAuthStorageKeys };
+export { type AuthSession, type AuthStorage, type HeadlessClient, type HeadlessSignInResult, type HeadlessSignUpResult, type SmartHiveAuthClient, type SmartHiveAuthConfig, SmartHiveAuthError, generateCodeChallenge, generateCodeVerifier, initAuth, smartHiveAuthStorageKeys };

package/dist/index.js

@@ -45,11 +45,17 @@ function sessionStorageAdapter() {
 function normalizeBaseUrl(baseUrl) {
   return baseUrl.replace(/\/$/, "");
 }
+function envFromPublishableKey(publishableKey) {
+  const match = publishableKey.match(/^pk_(dev|staging|prod)_/);
+  return match ? match[1] : "prod";
+}
 function initAuth(config) {
   const baseUrl = normalizeBaseUrl(config.baseUrl);
   const authBase = normalizeBaseUrl(config.authDomain ?? config.baseUrl);
   const storage = config.storage ?? browserStorage();
   const tempStorage = config.temporaryStorage ?? sessionStorageAdapter();
+  const environment = envFromPublishableKey(config.publishableKey);
+  const headlessBase = `${baseUrl}/${environment}/api/auth/headless`;
   async function saveSession(session) {
     if (!session) {
       await storage.removeItem(smartHiveAuthStorageKeys.session);
@@ -61,6 +67,106 @@ function initAuth(config) {
     const raw = await storage.getItem(smartHiveAuthStorageKeys.session);
     return raw ? JSON.parse(raw) : null;
   }
+  function rawToSession(raw) {
+    return {
+      accessToken: raw.access_token,
+      refreshToken: raw.refresh_token,
+      expiresAt: Date.now() + raw.expires_in * 1e3,
+      user: raw.user
+    };
+  }
+  async function headlessPost(path, body) {
+    const res = await fetch(`${headlessBase}${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({}));
+      throw new SmartHiveAuthError(
+        err.error ?? "request_failed",
+        err.message ?? `Request to ${path} failed.`
+      );
+    }
+    return res.json();
+  }
+  async function headlessSignInAndSave(path, body) {
+    const raw = await headlessPost(path, body);
+    const result = rawToSession(raw);
+    await saveSession(result);
+    return result;
+  }
+  const headless = {
+    signIn: {
+      async email({ email, password }) {
+        return headlessSignInAndSave("/sign-in/email", { email, password });
+      },
+      phone: {
+        async sendOtp({ phoneNumber }) {
+          await headlessPost("/phone/send-otp", { phoneNumber });
+        },
+        async verify({ phoneNumber, code }) {
+          return headlessSignInAndSave("/phone/verify", { phoneNumber, code });
+        }
+      },
+      emailOtp: {
+        async send({ email }) {
+          await headlessPost("/email-otp/send", { email });
+        },
+        async verify({ email, code }) {
+          return headlessSignInAndSave("/email-otp/verify", { email, code });
+        }
+      },
+      magicLink: {
+        async send({ email, callbackURL }) {
+          await headlessPost("/magic-link/send", { email, ...callbackURL ? { callbackURL } : {} });
+        }
+      }
+    },
+    signUp: {
+      async email({ email, password, name }) {
+        const res = await fetch(`${headlessBase}/sign-up/email`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ email, password, name })
+        });
+        if (res.status === 202) {
+          return { accessToken: "", refreshToken: "", expiresAt: 0, requiresVerification: true };
+        }
+        if (!res.ok) {
+          const err = await res.json().catch(() => ({}));
+          throw new SmartHiveAuthError(err.error ?? "sign_up_failed", err.message ?? "Sign up failed.");
+        }
+        const raw = await res.json();
+        const result = { ...rawToSession(raw), requiresVerification: false };
+        await saveSession(result);
+        return result;
+      }
+    },
+    async refreshToken({ refreshToken }) {
+      const raw = await headlessPost("/token/refresh", { refresh_token: refreshToken });
+      const updated = {
+        ...await readSession() ?? {},
+        accessToken: raw.access_token,
+        expiresAt: Date.now() + raw.expires_in * 1e3
+      };
+      await saveSession(updated);
+      return { accessToken: raw.access_token, expiresAt: updated.expiresAt };
+    },
+    async signOut({ refreshToken } = {}) {
+      const session = await readSession();
+      const token = refreshToken ?? session?.refreshToken;
+      await saveSession(null);
+      if (token) {
+        await fetch(`${headlessBase}/sign-out`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ refresh_token: token })
+        }).catch(() => {
+        });
+      }
+    }
+  };
   const client = {
     async initialize() {
       const response = await fetch(
@@ -194,7 +300,8 @@ function initAuth(config) {
         headers: { authorization: `Bearer ${token}` }
       });
       return response.ok ? response.json() : null;
-    }
+    },
+    headless
   };
   return client;
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export interface SmartHiveAuthConfig {\n  projectId: string;\n  publishableKey: string;\n  baseUrl: string;\n  /** Custom branded auth domain, e.g. \"https://auth.myapp.com\". Used as the entry point for login/token flows. Falls back to baseUrl. */\n  authDomain?: string;\n  /** Fallback auth domain if authDomain is unreachable, e.g. \"https://auth.smarthivelabs.dev\". */\n  fallbackAuthDomain?: string;\n  redirectUri?: string;\n  storage?: AuthStorage;\n  temporaryStorage?: AuthStorage;\n}\n\nexport interface AuthStorage {\n  getItem(key: string): string | null | Promise<string | null>;\n  setItem(key: string, value: string): void | Promise<void>;\n  removeItem(key: string): void | Promise<void>;\n}\n\nexport interface AuthSession {\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  user?: unknown;\n}\n\nexport interface SmartHiveAuthClient {\n  initialize(): Promise<void>;\n  login(options?: { redirectUri?: string; state?: string }): Promise<void>;\n  handleCallback(options?: { url?: string }): Promise<AuthSession>;\n  logout(): Promise<void>;\n  getSession(): Promise<AuthSession | null>;\n  getAccessToken(): Promise<string | null>;\n  getAuthorizationHeader(): Promise<Record<string, string>>;\n  fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;\n  refreshSession(): Promise<AuthSession | null>;\n  verifyToken(token: string): Promise<boolean>;\n  getUser(): Promise<unknown>;\n}\n\nexport class SmartHiveAuthError extends Error {\n  constructor(public code: string, message: string) {\n    super(message);\n    this.name = \"SmartHiveAuthError\";\n  }\n}\n\n// ── PKCE helpers (Web Crypto — works in browser + Node 18+) ──────────────────\n\nexport async function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64urlEncode(array);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return base64urlEncode(new Uint8Array(digest));\n}\n\nfunction base64urlEncode(buffer: Uint8Array): string {\n  let str = \"\";\n  for (const byte of buffer) str += String.fromCharCode(byte);\n  return btoa(str).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n// ── Storage keys ─────────────────────────────────────────────────────────────\n\nexport const smartHiveAuthStorageKeys = {\n  session: \"smarthive.auth.session\",\n  pkceVerifier: \"smarthive.auth.pkce_verifier\",\n  pkceState: \"smarthive.auth.pkce_state\"\n} as const;\n\nfunction browserStorage(): AuthStorage {\n  return {\n    getItem: (key) => globalThis.localStorage?.getItem(key) ?? null,\n    setItem: (key, value) => globalThis.localStorage?.setItem(key, value),\n    removeItem: (key) => globalThis.localStorage?.removeItem(key)\n  };\n}\n\nfunction sessionStorageAdapter(): Pick<AuthStorage, \"getItem\" | \"setItem\" | \"removeItem\"> {\n  return {\n    getItem: (key) => globalThis.sessionStorage?.getItem(key) ?? null,\n    setItem: (key, value) => globalThis.sessionStorage?.setItem(key, value),\n    removeItem: (key) => globalThis.sessionStorage?.removeItem(key)\n  };\n}\n\nfunction normalizeBaseUrl(baseUrl: string) {\n  return baseUrl.replace(/\\/$/, \"\");\n}\n\n// ── Factory ───────────────────────────────────────────────────────────────────\n\nexport function initAuth(config: SmartHiveAuthConfig): SmartHiveAuthClient {\n  const baseUrl = normalizeBaseUrl(config.baseUrl);\n  const authBase = normalizeBaseUrl(config.authDomain ?? config.baseUrl);\n  const storage = config.storage ?? browserStorage();\n  const tempStorage = config.temporaryStorage ?? sessionStorageAdapter();\n\n  async function saveSession(session: AuthSession | null) {\n    if (!session) { await storage.removeItem(smartHiveAuthStorageKeys.session); return; }\n    await storage.setItem(smartHiveAuthStorageKeys.session, JSON.stringify(session));\n  }\n\n  async function readSession(): Promise<AuthSession | null> {\n    const raw = await storage.getItem(smartHiveAuthStorageKeys.session);\n    return raw ? JSON.parse(raw) as AuthSession : null;\n  }\n\n  const client: SmartHiveAuthClient = {\n    async initialize() {\n      const response = await fetch(\n        `${baseUrl}/sdk/config?projectId=${encodeURIComponent(config.projectId)}&publishableKey=${encodeURIComponent(config.publishableKey)}`\n      );\n      if (!response.ok) throw new SmartHiveAuthError(\"project_not_found\", \"Smart Hive Auth project configuration was not found.\");\n    },\n\n    async login(options) {\n      const redirectUri = options?.redirectUri ?? config.redirectUri ?? globalThis.location?.href;\n      const state = options?.state ?? crypto.randomUUID();\n      const verifier = await generateCodeVerifier();\n      const challenge = await generateCodeChallenge(verifier);\n\n      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceVerifier, verifier);\n      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceState, state);\n\n      const url = new URL(`${authBase}/api/auth/oauth2/authorize`);\n      url.searchParams.set(\"project_id\", config.projectId);\n      url.searchParams.set(\"publishable_key\", config.publishableKey);\n      url.searchParams.set(\"response_type\", \"code\");\n      url.searchParams.set(\"redirect_uri\", redirectUri);\n      url.searchParams.set(\"state\", state);\n      url.searchParams.set(\"code_challenge\", challenge);\n      url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n      globalThis.location.assign(url.toString());\n    },\n\n    async handleCallback(options) {\n      const href = options?.url ?? globalThis.location?.href;\n      if (!href) throw new SmartHiveAuthError(\"callback_failed\", \"No URL provided for callback handling.\");\n\n      const url = new URL(href);\n      const code = url.searchParams.get(\"code\");\n      const returnedState = url.searchParams.get(\"state\");\n\n      if (!code) throw new SmartHiveAuthError(\"callback_failed\", \"No authorization code in callback URL.\");\n\n      const storedState = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceState);\n      if (!storedState || !returnedState || storedState !== returnedState) {\n        throw new SmartHiveAuthError(\"state_mismatch\", \"OAuth state mismatch — possible CSRF attack.\");\n      }\n\n      const verifier = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceVerifier);\n      if (!verifier) {\n        throw new SmartHiveAuthError(\"pkce_missing\", \"Missing PKCE verifier for authorization code exchange.\");\n      }\n      const redirectUri = config.redirectUri ?? (url.origin + url.pathname);\n\n      const body = new URLSearchParams({\n        grant_type: \"authorization_code\",\n        code,\n        redirect_uri: redirectUri,\n        client_id: config.publishableKey\n      });\n      body.set(\"code_verifier\", verifier);\n\n      const response = await fetch(`${authBase}/api/auth/oauth2/token`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body\n      });\n\n      if (!response.ok) {\n        const err = await response.json().catch(() => ({})) as { error?: string; error_description?: string };\n        throw new SmartHiveAuthError(err.error ?? \"token_error\", err.error_description ?? \"Token exchange failed.\");\n      }\n\n      const tokenBody = await response.json() as {\n        access_token: string;\n        refresh_token?: string;\n        expires_in?: number;\n        token_type?: string;\n      };\n\n      const session: AuthSession = {\n        accessToken: tokenBody.access_token,\n        refreshToken: tokenBody.refresh_token,\n        expiresAt: tokenBody.expires_in ? Date.now() + tokenBody.expires_in * 1000 : undefined\n      };\n\n      await saveSession(session);\n      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceVerifier);\n      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceState);\n\n      return session;\n    },\n\n    async logout() {\n      await saveSession(null);\n      await fetch(`${baseUrl}/api/auth/sign-out`, { method: \"POST\", credentials: \"include\" });\n    },\n\n    getSession: readSession,\n\n    async getAccessToken() {\n      const session = await readSession();\n      if (!session) return null;\n      if (session.expiresAt && Date.now() > session.expiresAt - 30000) {\n        return (await client.refreshSession())?.accessToken ?? null;\n      }\n      return session.accessToken;\n    },\n\n    async getAuthorizationHeader() {\n      const token = await client.getAccessToken();\n      const headers: Record<string, string> = {};\n      if (token) headers.authorization = `Bearer ${token}`;\n      return headers;\n    },\n\n    async fetch(input, init = {}) {\n      const authHeader = await client.getAuthorizationHeader();\n      const headers = new Headers(init.headers);\n      for (const [key, value] of Object.entries(authHeader)) {\n        headers.set(key, value);\n      }\n      return fetch(input, { ...init, headers });\n    },\n\n    async refreshSession() {\n      const session = await readSession();\n      if (!session?.refreshToken) return session;\n      const response = await fetch(`${baseUrl}/api/auth/oauth2/token`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          grant_type: \"refresh_token\",\n          refresh_token: session.refreshToken\n        })\n      });\n      if (!response.ok) { await saveSession(null); return null; }\n      const body = await response.json() as { access_token: string; refresh_token?: string; expires_in?: number };\n      const nextSession: AuthSession = {\n        ...session,\n        accessToken: body.access_token,\n        refreshToken: body.refresh_token ?? session.refreshToken,\n        expiresAt: body.expires_in ? Date.now() + body.expires_in * 1000 : session.expiresAt\n      };\n      await saveSession(nextSession);\n      return nextSession;\n    },\n\n    async verifyToken(token) {\n      if (token.split(\".\").length !== 3) return false;\n      const response = await fetch(`${authBase}/api/auth/oauth2/userinfo`, {\n        headers: { authorization: `Bearer ${token}` }\n      });\n      return response.ok;\n    },\n\n    async getUser() {\n      const token = await client.getAccessToken();\n      if (!token) return null;\n      const response = await fetch(`${baseUrl}/api/auth/oauth2/userinfo`, {\n        headers: { authorization: `Bearer ${token}` }\n      });\n      return response.ok ? response.json() : null;\n    }\n  };\n\n  return client;\n}\n"],"mappings":";AAwCO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAmB,MAAc,SAAiB;AAChD,UAAM,OAAO;AADI;AAEjB,SAAK,OAAO;AAAA,EACd;AAAA,EAHmB;AAIrB;AAIA,eAAsB,uBAAwC;AAC5D,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,MAAM;AACV,aAAW,QAAQ,OAAQ,QAAO,OAAO,aAAa,IAAI;AAC1D,SAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC5E;AAIO,IAAM,2BAA2B;AAAA,EACtC,SAAS;AAAA,EACT,cAAc;AAAA,EACd,WAAW;AACb;AAEA,SAAS,iBAA8B;AACrC,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,WAAW,cAAc,QAAQ,GAAG,KAAK;AAAA,IAC3D,SAAS,CAAC,KAAK,UAAU,WAAW,cAAc,QAAQ,KAAK,KAAK;AAAA,IACpE,YAAY,CAAC,QAAQ,WAAW,cAAc,WAAW,GAAG;AAAA,EAC9D;AACF;AAEA,SAAS,wBAAiF;AACxF,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,WAAW,gBAAgB,QAAQ,GAAG,KAAK;AAAA,IAC7D,SAAS,CAAC,KAAK,UAAU,WAAW,gBAAgB,QAAQ,KAAK,KAAK;AAAA,IACtE,YAAY,CAAC,QAAQ,WAAW,gBAAgB,WAAW,GAAG;AAAA,EAChE;AACF;AAEA,SAAS,iBAAiB,SAAiB;AACzC,SAAO,QAAQ,QAAQ,OAAO,EAAE;AAClC;AAIO,SAAS,SAAS,QAAkD;AACzE,QAAM,UAAU,iBAAiB,OAAO,OAAO;AAC/C,QAAM,WAAW,iBAAiB,OAAO,cAAc,OAAO,OAAO;AACrE,QAAM,UAAU,OAAO,WAAW,eAAe;AACjD,QAAM,cAAc,OAAO,oBAAoB,sBAAsB;AAErE,iBAAe,YAAY,SAA6B;AACtD,QAAI,CAAC,SAAS;AAAE,YAAM,QAAQ,WAAW,yBAAyB,OAAO;AAAG;AAAA,IAAQ;AACpF,UAAM,QAAQ,QAAQ,yBAAyB,SAAS,KAAK,UAAU,OAAO,CAAC;AAAA,EACjF;AAEA,iBAAe,cAA2C;AACxD,UAAM,MAAM,MAAM,QAAQ,QAAQ,yBAAyB,OAAO;AAClE,WAAO,MAAM,KAAK,MAAM,GAAG,IAAmB;AAAA,EAChD;AAEA,QAAM,SAA8B;AAAA,IAClC,MAAM,aAAa;AACjB,YAAM,WAAW,MAAM;AAAA,QACrB,GAAG,OAAO,yBAAyB,mBAAmB,OAAO,SAAS,CAAC,mBAAmB,mBAAmB,OAAO,cAAc,CAAC;AAAA,MACrI;AACA,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AAAA,IAC5H;AAAA,IAEA,MAAM,MAAM,SAAS;AACnB,YAAM,cAAc,SAAS,eAAe,OAAO,eAAe,WAAW,UAAU;AACvF,YAAM,QAAQ,SAAS,SAAS,OAAO,WAAW;AAClD,YAAM,WAAW,MAAM,qBAAqB;AAC5C,YAAM,YAAY,MAAM,sBAAsB,QAAQ;AAEtD,YAAM,YAAY,QAAQ,yBAAyB,cAAc,QAAQ;AACzE,YAAM,YAAY,QAAQ,yBAAyB,WAAW,KAAK;AAEnE,YAAM,MAAM,IAAI,IAAI,GAAG,QAAQ,4BAA4B;AAC3D,UAAI,aAAa,IAAI,cAAc,OAAO,SAAS;AACnD,UAAI,aAAa,IAAI,mBAAmB,OAAO,cAAc;AAC7D,UAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,UAAI,aAAa,IAAI,gBAAgB,WAAW;AAChD,UAAI,aAAa,IAAI,SAAS,KAAK;AACnC,UAAI,aAAa,IAAI,kBAAkB,SAAS;AAChD,UAAI,aAAa,IAAI,yBAAyB,MAAM;AAEpD,iBAAW,SAAS,OAAO,IAAI,SAAS,CAAC;AAAA,IAC3C;AAAA,IAEA,MAAM,eAAe,SAAS;AAC5B,YAAM,OAAO,SAAS,OAAO,WAAW,UAAU;AAClD,UAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,mBAAmB,wCAAwC;AAEnG,YAAM,MAAM,IAAI,IAAI,IAAI;AACxB,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,gBAAgB,IAAI,aAAa,IAAI,OAAO;AAElD,UAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,mBAAmB,wCAAwC;AAEnG,YAAM,cAAc,MAAM,YAAY,QAAQ,yBAAyB,SAAS;AAChF,UAAI,CAAC,eAAe,CAAC,iBAAiB,gBAAgB,eAAe;AACnE,cAAM,IAAI,mBAAmB,kBAAkB,mDAA8C;AAAA,MAC/F;AAEA,YAAM,WAAW,MAAM,YAAY,QAAQ,yBAAyB,YAAY;AAChF,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,mBAAmB,gBAAgB,wDAAwD;AAAA,MACvG;AACA,YAAM,cAAc,OAAO,eAAgB,IAAI,SAAS,IAAI;AAE5D,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,YAAY;AAAA,QACZ;AAAA,QACA,cAAc;AAAA,QACd,WAAW,OAAO;AAAA,MACpB,CAAC;AACD,WAAK,IAAI,iBAAiB,QAAQ;AAElC,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,0BAA0B;AAAA,QAChE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,cAAM,IAAI,mBAAmB,IAAI,SAAS,eAAe,IAAI,qBAAqB,wBAAwB;AAAA,MAC5G;AAEA,YAAM,YAAY,MAAM,SAAS,KAAK;AAOtC,YAAM,UAAuB;AAAA,QAC3B,aAAa,UAAU;AAAA,QACvB,cAAc,UAAU;AAAA,QACxB,WAAW,UAAU,aAAa,KAAK,IAAI,IAAI,UAAU,aAAa,MAAO;AAAA,MAC/E;AAEA,YAAM,YAAY,OAAO;AACzB,YAAM,YAAY,WAAW,yBAAyB,YAAY;AAClE,YAAM,YAAY,WAAW,yBAAyB,SAAS;AAE/D,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,SAAS;AACb,YAAM,YAAY,IAAI;AACtB,YAAM,MAAM,GAAG,OAAO,sBAAsB,EAAE,QAAQ,QAAQ,aAAa,UAAU,CAAC;AAAA,IACxF;AAAA,IAEA,YAAY;AAAA,IAEZ,MAAM,iBAAiB;AACrB,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,CAAC,QAAS,QAAO;AACrB,UAAI,QAAQ,aAAa,KAAK,IAAI,IAAI,QAAQ,YAAY,KAAO;AAC/D,gBAAQ,MAAM,OAAO,eAAe,IAAI,eAAe;AAAA,MACzD;AACA,aAAO,QAAQ;AAAA,IACjB;AAAA,IAEA,MAAM,yBAAyB;AAC7B,YAAM,QAAQ,MAAM,OAAO,eAAe;AAC1C,YAAM,UAAkC,CAAC;AACzC,UAAI,MAAO,SAAQ,gBAAgB,UAAU,KAAK;AAClD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,MAAM,OAAO,OAAO,CAAC,GAAG;AAC5B,YAAM,aAAa,MAAM,OAAO,uBAAuB;AACvD,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,gBAAQ,IAAI,KAAK,KAAK;AAAA,MACxB;AACA,aAAO,MAAM,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAC1C;AAAA,IAEA,MAAM,iBAAiB;AACrB,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,CAAC,SAAS,aAAc,QAAO;AACnC,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,0BAA0B;AAAA,QAC/D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,IAAI,gBAAgB;AAAA,UACxB,YAAY;AAAA,UACZ,eAAe,QAAQ;AAAA,QACzB,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAAE,cAAM,YAAY,IAAI;AAAG,eAAO;AAAA,MAAM;AAC1D,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,cAA2B;AAAA,QAC/B,GAAG;AAAA,QACH,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK,iBAAiB,QAAQ;AAAA,QAC5C,WAAW,KAAK,aAAa,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO,QAAQ;AAAA,MAC7E;AACA,YAAM,YAAY,WAAW;AAC7B,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,UAAI,MAAM,MAAM,GAAG,EAAE,WAAW,EAAG,QAAO;AAC1C,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,6BAA6B;AAAA,QACnE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,UAAU;AACd,YAAM,QAAQ,MAAM,OAAO,eAAe;AAC1C,UAAI,CAAC,MAAO,QAAO;AACnB,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,6BAA6B;AAAA,QAClE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO,SAAS,KAAK,SAAS,KAAK,IAAI;AAAA,IACzC;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export interface SmartHiveAuthConfig {\n  projectId: string;\n  publishableKey: string;\n  baseUrl: string;\n  /** Custom branded auth domain, e.g. \"https://auth.myapp.com\". Used as the entry point for login/token flows. Falls back to baseUrl. */\n  authDomain?: string;\n  /** Fallback auth domain if authDomain is unreachable, e.g. \"https://auth.smarthivelabs.dev\". */\n  fallbackAuthDomain?: string;\n  redirectUri?: string;\n  storage?: AuthStorage;\n  temporaryStorage?: AuthStorage;\n}\n\nexport interface AuthStorage {\n  getItem(key: string): string | null | Promise<string | null>;\n  setItem(key: string, value: string): void | Promise<void>;\n  removeItem(key: string): void | Promise<void>;\n}\n\nexport interface AuthSession {\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  user?: unknown;\n}\n\n// ── Headless types ────────────────────────────────────────────────────────────\n\nexport interface HeadlessSignInResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresAt: number;\n  user?: unknown;\n}\n\nexport interface HeadlessSignUpResult extends HeadlessSignInResult {\n  /** True when email verification is required before the account can be used. */\n  requiresVerification?: boolean;\n}\n\nexport interface HeadlessClient {\n  signIn: {\n    /**\n     * Sign in with email and password. No browser redirect.\n     * Returns tokens immediately on success.\n     */\n    email(params: { email: string; password: string }): Promise<HeadlessSignInResult>;\n\n    phone: {\n      /**\n       * Send a one-time code to a phone number.\n       * Call `verify` with the code the user receives.\n       */\n      sendOtp(params: { phoneNumber: string }): Promise<void>;\n      /**\n       * Verify the OTP sent to the phone number and return tokens on success.\n       */\n      verify(params: { phoneNumber: string; code: string }): Promise<HeadlessSignInResult>;\n    };\n\n    emailOtp: {\n      /**\n       * Send a one-time code to an email address.\n       * Call `verify` with the code the user receives.\n       */\n      send(params: { email: string }): Promise<void>;\n      /**\n       * Verify the OTP sent to the email address and return tokens on success.\n       */\n      verify(params: { email: string; code: string }): Promise<HeadlessSignInResult>;\n    };\n\n    magicLink: {\n      /**\n       * Send a magic link to the given email address.\n       * The user clicks the link — no token is returned here.\n       */\n      send(params: { email: string; callbackURL?: string }): Promise<void>;\n    };\n  };\n\n  signUp: {\n    /**\n     * Create a new account with email and password. No browser redirect.\n     * If email verification is required, `requiresVerification` will be true\n     * and no tokens will be present — the user must verify before signing in.\n     */\n    email(params: { email: string; password: string; name?: string }): Promise<HeadlessSignUpResult>;\n  };\n\n  /** Refresh an expired access token using the refresh token. */\n  refreshToken(params: { refreshToken: string }): Promise<{ accessToken: string; expiresAt: number }>;\n\n  /** Sign the user out and invalidate their session on the server. */\n  signOut(params?: { refreshToken?: string }): Promise<void>;\n}\n\nexport interface SmartHiveAuthClient {\n  initialize(): Promise<void>;\n  login(options?: { redirectUri?: string; state?: string }): Promise<void>;\n  handleCallback(options?: { url?: string }): Promise<AuthSession>;\n  logout(): Promise<void>;\n  getSession(): Promise<AuthSession | null>;\n  getAccessToken(): Promise<string | null>;\n  getAuthorizationHeader(): Promise<Record<string, string>>;\n  fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;\n  refreshSession(): Promise<AuthSession | null>;\n  verifyToken(token: string): Promise<boolean>;\n  getUser(): Promise<unknown>;\n  /**\n   * Direct credential-based authentication — no browser redirect.\n   * Use these methods when you want full control of the sign-in UI\n   * (e.g. native mobile apps with custom login screens).\n   */\n  headless: HeadlessClient;\n}\n\nexport class SmartHiveAuthError extends Error {\n  constructor(public code: string, message: string) {\n    super(message);\n    this.name = \"SmartHiveAuthError\";\n  }\n}\n\n// ── PKCE helpers (Web Crypto — works in browser + Node 18+) ──────────────────\n\nexport async function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64urlEncode(array);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return base64urlEncode(new Uint8Array(digest));\n}\n\nfunction base64urlEncode(buffer: Uint8Array): string {\n  let str = \"\";\n  for (const byte of buffer) str += String.fromCharCode(byte);\n  return btoa(str).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n// ── Storage keys ─────────────────────────────────────────────────────────────\n\nexport const smartHiveAuthStorageKeys = {\n  session: \"smarthive.auth.session\",\n  pkceVerifier: \"smarthive.auth.pkce_verifier\",\n  pkceState: \"smarthive.auth.pkce_state\"\n} as const;\n\nfunction browserStorage(): AuthStorage {\n  return {\n    getItem: (key) => globalThis.localStorage?.getItem(key) ?? null,\n    setItem: (key, value) => globalThis.localStorage?.setItem(key, value),\n    removeItem: (key) => globalThis.localStorage?.removeItem(key)\n  };\n}\n\nfunction sessionStorageAdapter(): Pick<AuthStorage, \"getItem\" | \"setItem\" | \"removeItem\"> {\n  return {\n    getItem: (key) => globalThis.sessionStorage?.getItem(key) ?? null,\n    setItem: (key, value) => globalThis.sessionStorage?.setItem(key, value),\n    removeItem: (key) => globalThis.sessionStorage?.removeItem(key)\n  };\n}\n\nfunction normalizeBaseUrl(baseUrl: string) {\n  return baseUrl.replace(/\\/$/, \"\");\n}\n\n/** Extract the environment prefix from a publishable key (pk_dev_*, pk_staging_*, pk_prod_*). */\nfunction envFromPublishableKey(publishableKey: string): string {\n  const match = publishableKey.match(/^pk_(dev|staging|prod)_/);\n  return match ? match[1] : \"prod\";\n}\n\n// ── Headless response shape from the backend ──────────────────────────────────\n\ninterface RawHeadlessResponse {\n  access_token: string;\n  refresh_token: string;\n  expires_in: number;\n  token_type: string;\n  user?: unknown;\n  requires_verification?: boolean;\n  message?: string;\n}\n\n// ── Factory ───────────────────────────────────────────────────────────────────\n\nexport function initAuth(config: SmartHiveAuthConfig): SmartHiveAuthClient {\n  const baseUrl = normalizeBaseUrl(config.baseUrl);\n  const authBase = normalizeBaseUrl(config.authDomain ?? config.baseUrl);\n  const storage = config.storage ?? browserStorage();\n  const tempStorage = config.temporaryStorage ?? sessionStorageAdapter();\n  const environment = envFromPublishableKey(config.publishableKey);\n  const headlessBase = `${baseUrl}/${environment}/api/auth/headless`;\n\n  async function saveSession(session: AuthSession | null) {\n    if (!session) { await storage.removeItem(smartHiveAuthStorageKeys.session); return; }\n    await storage.setItem(smartHiveAuthStorageKeys.session, JSON.stringify(session));\n  }\n\n  async function readSession(): Promise<AuthSession | null> {\n    const raw = await storage.getItem(smartHiveAuthStorageKeys.session);\n    return raw ? JSON.parse(raw) as AuthSession : null;\n  }\n\n  function rawToSession(raw: RawHeadlessResponse): HeadlessSignInResult {\n    return {\n      accessToken: raw.access_token,\n      refreshToken: raw.refresh_token,\n      expiresAt: Date.now() + raw.expires_in * 1000,\n      user: raw.user,\n    };\n  }\n\n  async function headlessPost(path: string, body: Record<string, unknown>): Promise<RawHeadlessResponse> {\n    const res = await fetch(`${headlessBase}${path}`, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n\n    if (!res.ok) {\n      const err = await res.json().catch(() => ({})) as { error?: string; message?: string };\n      throw new SmartHiveAuthError(\n        err.error ?? \"request_failed\",\n        err.message ?? `Request to ${path} failed.`\n      );\n    }\n\n    return res.json() as Promise<RawHeadlessResponse>;\n  }\n\n  async function headlessSignInAndSave(path: string, body: Record<string, unknown>): Promise<HeadlessSignInResult> {\n    const raw = await headlessPost(path, body);\n    const result = rawToSession(raw);\n    await saveSession(result);\n    return result;\n  }\n\n  const headless: HeadlessClient = {\n    signIn: {\n      async email({ email, password }) {\n        return headlessSignInAndSave(\"/sign-in/email\", { email, password });\n      },\n\n      phone: {\n        async sendOtp({ phoneNumber }) {\n          await headlessPost(\"/phone/send-otp\", { phoneNumber });\n        },\n        async verify({ phoneNumber, code }) {\n          return headlessSignInAndSave(\"/phone/verify\", { phoneNumber, code });\n        },\n      },\n\n      emailOtp: {\n        async send({ email }) {\n          await headlessPost(\"/email-otp/send\", { email });\n        },\n        async verify({ email, code }) {\n          return headlessSignInAndSave(\"/email-otp/verify\", { email, code });\n        },\n      },\n\n      magicLink: {\n        async send({ email, callbackURL }) {\n          await headlessPost(\"/magic-link/send\", { email, ...(callbackURL ? { callbackURL } : {}) });\n        },\n      },\n    },\n\n    signUp: {\n      async email({ email, password, name }) {\n        const res = await fetch(`${headlessBase}/sign-up/email`, {\n          method: \"POST\",\n          headers: { \"content-type\": \"application/json\" },\n          body: JSON.stringify({ email, password, name }),\n        });\n\n        // 202 = account created but email verification required\n        if (res.status === 202) {\n          return { accessToken: \"\", refreshToken: \"\", expiresAt: 0, requiresVerification: true };\n        }\n\n        if (!res.ok) {\n          const err = await res.json().catch(() => ({})) as { error?: string; message?: string };\n          throw new SmartHiveAuthError(err.error ?? \"sign_up_failed\", err.message ?? \"Sign up failed.\");\n        }\n\n        const raw = await res.json() as RawHeadlessResponse;\n        const result: HeadlessSignUpResult = { ...rawToSession(raw), requiresVerification: false };\n        await saveSession(result);\n        return result;\n      },\n    },\n\n    async refreshToken({ refreshToken }) {\n      const raw = await headlessPost(\"/token/refresh\", { refresh_token: refreshToken });\n      const updated: AuthSession = {\n        ...(await readSession() ?? {}),\n        accessToken: raw.access_token,\n        expiresAt: Date.now() + raw.expires_in * 1000,\n      };\n      await saveSession(updated);\n      return { accessToken: raw.access_token, expiresAt: updated.expiresAt! };\n    },\n\n    async signOut({ refreshToken } = {}) {\n      const session = await readSession();\n      const token = refreshToken ?? session?.refreshToken;\n      await saveSession(null);\n      if (token) {\n        await fetch(`${headlessBase}/sign-out`, {\n          method: \"POST\",\n          headers: { \"content-type\": \"application/json\" },\n          body: JSON.stringify({ refresh_token: token }),\n        }).catch(() => {});\n      }\n    },\n  };\n\n  const client: SmartHiveAuthClient = {\n    async initialize() {\n      const response = await fetch(\n        `${baseUrl}/sdk/config?projectId=${encodeURIComponent(config.projectId)}&publishableKey=${encodeURIComponent(config.publishableKey)}`\n      );\n      if (!response.ok) throw new SmartHiveAuthError(\"project_not_found\", \"Smart Hive Auth project configuration was not found.\");\n    },\n\n    async login(options) {\n      const redirectUri = options?.redirectUri ?? config.redirectUri ?? globalThis.location?.href;\n      const state = options?.state ?? crypto.randomUUID();\n      const verifier = await generateCodeVerifier();\n      const challenge = await generateCodeChallenge(verifier);\n\n      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceVerifier, verifier);\n      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceState, state);\n\n      const url = new URL(`${authBase}/api/auth/oauth2/authorize`);\n      url.searchParams.set(\"project_id\", config.projectId);\n      url.searchParams.set(\"publishable_key\", config.publishableKey);\n      url.searchParams.set(\"response_type\", \"code\");\n      url.searchParams.set(\"redirect_uri\", redirectUri);\n      url.searchParams.set(\"state\", state);\n      url.searchParams.set(\"code_challenge\", challenge);\n      url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n      globalThis.location.assign(url.toString());\n    },\n\n    async handleCallback(options) {\n      const href = options?.url ?? globalThis.location?.href;\n      if (!href) throw new SmartHiveAuthError(\"callback_failed\", \"No URL provided for callback handling.\");\n\n      const url = new URL(href);\n      const code = url.searchParams.get(\"code\");\n      const returnedState = url.searchParams.get(\"state\");\n\n      if (!code) throw new SmartHiveAuthError(\"callback_failed\", \"No authorization code in callback URL.\");\n\n      const storedState = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceState);\n      if (!storedState || !returnedState || storedState !== returnedState) {\n        throw new SmartHiveAuthError(\"state_mismatch\", \"OAuth state mismatch — possible CSRF attack.\");\n      }\n\n      const verifier = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceVerifier);\n      if (!verifier) {\n        throw new SmartHiveAuthError(\"pkce_missing\", \"Missing PKCE verifier for authorization code exchange.\");\n      }\n      const redirectUri = config.redirectUri ?? (url.origin + url.pathname);\n\n      const body = new URLSearchParams({\n        grant_type: \"authorization_code\",\n        code,\n        redirect_uri: redirectUri,\n        client_id: config.publishableKey\n      });\n      body.set(\"code_verifier\", verifier);\n\n      const response = await fetch(`${authBase}/api/auth/oauth2/token`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body\n      });\n\n      if (!response.ok) {\n        const err = await response.json().catch(() => ({})) as { error?: string; error_description?: string };\n        throw new SmartHiveAuthError(err.error ?? \"token_error\", err.error_description ?? \"Token exchange failed.\");\n      }\n\n      const tokenBody = await response.json() as {\n        access_token: string;\n        refresh_token?: string;\n        expires_in?: number;\n        token_type?: string;\n      };\n\n      const session: AuthSession = {\n        accessToken: tokenBody.access_token,\n        refreshToken: tokenBody.refresh_token,\n        expiresAt: tokenBody.expires_in ? Date.now() + tokenBody.expires_in * 1000 : undefined\n      };\n\n      await saveSession(session);\n      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceVerifier);\n      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceState);\n\n      return session;\n    },\n\n    async logout() {\n      await saveSession(null);\n      await fetch(`${baseUrl}/api/auth/sign-out`, { method: \"POST\", credentials: \"include\" });\n    },\n\n    getSession: readSession,\n\n    async getAccessToken() {\n      const session = await readSession();\n      if (!session) return null;\n      if (session.expiresAt && Date.now() > session.expiresAt - 30000) {\n        return (await client.refreshSession())?.accessToken ?? null;\n      }\n      return session.accessToken;\n    },\n\n    async getAuthorizationHeader() {\n      const token = await client.getAccessToken();\n      const headers: Record<string, string> = {};\n      if (token) headers.authorization = `Bearer ${token}`;\n      return headers;\n    },\n\n    async fetch(input, init = {}) {\n      const authHeader = await client.getAuthorizationHeader();\n      const headers = new Headers(init.headers);\n      for (const [key, value] of Object.entries(authHeader)) {\n        headers.set(key, value);\n      }\n      return fetch(input, { ...init, headers });\n    },\n\n    async refreshSession() {\n      const session = await readSession();\n      if (!session?.refreshToken) return session;\n      const response = await fetch(`${baseUrl}/api/auth/oauth2/token`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          grant_type: \"refresh_token\",\n          refresh_token: session.refreshToken\n        })\n      });\n      if (!response.ok) { await saveSession(null); return null; }\n      const body = await response.json() as { access_token: string; refresh_token?: string; expires_in?: number };\n      const nextSession: AuthSession = {\n        ...session,\n        accessToken: body.access_token,\n        refreshToken: body.refresh_token ?? session.refreshToken,\n        expiresAt: body.expires_in ? Date.now() + body.expires_in * 1000 : session.expiresAt\n      };\n      await saveSession(nextSession);\n      return nextSession;\n    },\n\n    async verifyToken(token) {\n      if (token.split(\".\").length !== 3) return false;\n      const response = await fetch(`${authBase}/api/auth/oauth2/userinfo`, {\n        headers: { authorization: `Bearer ${token}` }\n      });\n      return response.ok;\n    },\n\n    async getUser() {\n      const token = await client.getAccessToken();\n      if (!token) return null;\n      const response = await fetch(`${baseUrl}/api/auth/oauth2/userinfo`, {\n        headers: { authorization: `Bearer ${token}` }\n      });\n      return response.ok ? response.json() : null;\n    },\n\n    headless,\n  };\n\n  return client;\n}\n"],"mappings":";AAqHO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAmB,MAAc,SAAiB;AAChD,UAAM,OAAO;AADI;AAEjB,SAAK,OAAO;AAAA,EACd;AAAA,EAHmB;AAIrB;AAIA,eAAsB,uBAAwC;AAC5D,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,MAAM;AACV,aAAW,QAAQ,OAAQ,QAAO,OAAO,aAAa,IAAI;AAC1D,SAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC5E;AAIO,IAAM,2BAA2B;AAAA,EACtC,SAAS;AAAA,EACT,cAAc;AAAA,EACd,WAAW;AACb;AAEA,SAAS,iBAA8B;AACrC,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,WAAW,cAAc,QAAQ,GAAG,KAAK;AAAA,IAC3D,SAAS,CAAC,KAAK,UAAU,WAAW,cAAc,QAAQ,KAAK,KAAK;AAAA,IACpE,YAAY,CAAC,QAAQ,WAAW,cAAc,WAAW,GAAG;AAAA,EAC9D;AACF;AAEA,SAAS,wBAAiF;AACxF,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,WAAW,gBAAgB,QAAQ,GAAG,KAAK;AAAA,IAC7D,SAAS,CAAC,KAAK,UAAU,WAAW,gBAAgB,QAAQ,KAAK,KAAK;AAAA,IACtE,YAAY,CAAC,QAAQ,WAAW,gBAAgB,WAAW,GAAG;AAAA,EAChE;AACF;AAEA,SAAS,iBAAiB,SAAiB;AACzC,SAAO,QAAQ,QAAQ,OAAO,EAAE;AAClC;AAGA,SAAS,sBAAsB,gBAAgC;AAC7D,QAAM,QAAQ,eAAe,MAAM,yBAAyB;AAC5D,SAAO,QAAQ,MAAM,CAAC,IAAI;AAC5B;AAgBO,SAAS,SAAS,QAAkD;AACzE,QAAM,UAAU,iBAAiB,OAAO,OAAO;AAC/C,QAAM,WAAW,iBAAiB,OAAO,cAAc,OAAO,OAAO;AACrE,QAAM,UAAU,OAAO,WAAW,eAAe;AACjD,QAAM,cAAc,OAAO,oBAAoB,sBAAsB;AACrE,QAAM,cAAc,sBAAsB,OAAO,cAAc;AAC/D,QAAM,eAAe,GAAG,OAAO,IAAI,WAAW;AAE9C,iBAAe,YAAY,SAA6B;AACtD,QAAI,CAAC,SAAS;AAAE,YAAM,QAAQ,WAAW,yBAAyB,OAAO;AAAG;AAAA,IAAQ;AACpF,UAAM,QAAQ,QAAQ,yBAAyB,SAAS,KAAK,UAAU,OAAO,CAAC;AAAA,EACjF;AAEA,iBAAe,cAA2C;AACxD,UAAM,MAAM,MAAM,QAAQ,QAAQ,yBAAyB,OAAO;AAClE,WAAO,MAAM,KAAK,MAAM,GAAG,IAAmB;AAAA,EAChD;AAEA,WAAS,aAAa,KAAgD;AACpE,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,WAAW,KAAK,IAAI,IAAI,IAAI,aAAa;AAAA,MACzC,MAAM,IAAI;AAAA,IACZ;AAAA,EACF;AAEA,iBAAe,aAAa,MAAc,MAA6D;AACrG,UAAM,MAAM,MAAM,MAAM,GAAG,YAAY,GAAG,IAAI,IAAI;AAAA,MAChD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC7C,YAAM,IAAI;AAAA,QACR,IAAI,SAAS;AAAA,QACb,IAAI,WAAW,cAAc,IAAI;AAAA,MACnC;AAAA,IACF;AAEA,WAAO,IAAI,KAAK;AAAA,EAClB;AAEA,iBAAe,sBAAsB,MAAc,MAA8D;AAC/G,UAAM,MAAM,MAAM,aAAa,MAAM,IAAI;AACzC,UAAM,SAAS,aAAa,GAAG;AAC/B,UAAM,YAAY,MAAM;AACxB,WAAO;AAAA,EACT;AAEA,QAAM,WAA2B;AAAA,IAC/B,QAAQ;AAAA,MACN,MAAM,MAAM,EAAE,OAAO,SAAS,GAAG;AAC/B,eAAO,sBAAsB,kBAAkB,EAAE,OAAO,SAAS,CAAC;AAAA,MACpE;AAAA,MAEA,OAAO;AAAA,QACL,MAAM,QAAQ,EAAE,YAAY,GAAG;AAC7B,gBAAM,aAAa,mBAAmB,EAAE,YAAY,CAAC;AAAA,QACvD;AAAA,QACA,MAAM,OAAO,EAAE,aAAa,KAAK,GAAG;AAClC,iBAAO,sBAAsB,iBAAiB,EAAE,aAAa,KAAK,CAAC;AAAA,QACrE;AAAA,MACF;AAAA,MAEA,UAAU;AAAA,QACR,MAAM,KAAK,EAAE,MAAM,GAAG;AACpB,gBAAM,aAAa,mBAAmB,EAAE,MAAM,CAAC;AAAA,QACjD;AAAA,QACA,MAAM,OAAO,EAAE,OAAO,KAAK,GAAG;AAC5B,iBAAO,sBAAsB,qBAAqB,EAAE,OAAO,KAAK,CAAC;AAAA,QACnE;AAAA,MACF;AAAA,MAEA,WAAW;AAAA,QACT,MAAM,KAAK,EAAE,OAAO,YAAY,GAAG;AACjC,gBAAM,aAAa,oBAAoB,EAAE,OAAO,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC,EAAG,CAAC;AAAA,QAC3F;AAAA,MACF;AAAA,IACF;AAAA,IAEA,QAAQ;AAAA,MACN,MAAM,MAAM,EAAE,OAAO,UAAU,KAAK,GAAG;AACrC,cAAM,MAAM,MAAM,MAAM,GAAG,YAAY,kBAAkB;AAAA,UACvD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,UAAU,KAAK,CAAC;AAAA,QAChD,CAAC;AAGD,YAAI,IAAI,WAAW,KAAK;AACtB,iBAAO,EAAE,aAAa,IAAI,cAAc,IAAI,WAAW,GAAG,sBAAsB,KAAK;AAAA,QACvF;AAEA,YAAI,CAAC,IAAI,IAAI;AACX,gBAAM,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC7C,gBAAM,IAAI,mBAAmB,IAAI,SAAS,kBAAkB,IAAI,WAAW,iBAAiB;AAAA,QAC9F;AAEA,cAAM,MAAM,MAAM,IAAI,KAAK;AAC3B,cAAM,SAA+B,EAAE,GAAG,aAAa,GAAG,GAAG,sBAAsB,MAAM;AACzF,cAAM,YAAY,MAAM;AACxB,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,EAAE,aAAa,GAAG;AACnC,YAAM,MAAM,MAAM,aAAa,kBAAkB,EAAE,eAAe,aAAa,CAAC;AAChF,YAAM,UAAuB;AAAA,QAC3B,GAAI,MAAM,YAAY,KAAK,CAAC;AAAA,QAC5B,aAAa,IAAI;AAAA,QACjB,WAAW,KAAK,IAAI,IAAI,IAAI,aAAa;AAAA,MAC3C;AACA,YAAM,YAAY,OAAO;AACzB,aAAO,EAAE,aAAa,IAAI,cAAc,WAAW,QAAQ,UAAW;AAAA,IACxE;AAAA,IAEA,MAAM,QAAQ,EAAE,aAAa,IAAI,CAAC,GAAG;AACnC,YAAM,UAAU,MAAM,YAAY;AAClC,YAAM,QAAQ,gBAAgB,SAAS;AACvC,YAAM,YAAY,IAAI;AACtB,UAAI,OAAO;AACT,cAAM,MAAM,GAAG,YAAY,aAAa;AAAA,UACtC,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,eAAe,MAAM,CAAC;AAAA,QAC/C,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAA8B;AAAA,IAClC,MAAM,aAAa;AACjB,YAAM,WAAW,MAAM;AAAA,QACrB,GAAG,OAAO,yBAAyB,mBAAmB,OAAO,SAAS,CAAC,mBAAmB,mBAAmB,OAAO,cAAc,CAAC;AAAA,MACrI;AACA,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AAAA,IAC5H;AAAA,IAEA,MAAM,MAAM,SAAS;AACnB,YAAM,cAAc,SAAS,eAAe,OAAO,eAAe,WAAW,UAAU;AACvF,YAAM,QAAQ,SAAS,SAAS,OAAO,WAAW;AAClD,YAAM,WAAW,MAAM,qBAAqB;AAC5C,YAAM,YAAY,MAAM,sBAAsB,QAAQ;AAEtD,YAAM,YAAY,QAAQ,yBAAyB,cAAc,QAAQ;AACzE,YAAM,YAAY,QAAQ,yBAAyB,WAAW,KAAK;AAEnE,YAAM,MAAM,IAAI,IAAI,GAAG,QAAQ,4BAA4B;AAC3D,UAAI,aAAa,IAAI,cAAc,OAAO,SAAS;AACnD,UAAI,aAAa,IAAI,mBAAmB,OAAO,cAAc;AAC7D,UAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,UAAI,aAAa,IAAI,gBAAgB,WAAW;AAChD,UAAI,aAAa,IAAI,SAAS,KAAK;AACnC,UAAI,aAAa,IAAI,kBAAkB,SAAS;AAChD,UAAI,aAAa,IAAI,yBAAyB,MAAM;AAEpD,iBAAW,SAAS,OAAO,IAAI,SAAS,CAAC;AAAA,IAC3C;AAAA,IAEA,MAAM,eAAe,SAAS;AAC5B,YAAM,OAAO,SAAS,OAAO,WAAW,UAAU;AAClD,UAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,mBAAmB,wCAAwC;AAEnG,YAAM,MAAM,IAAI,IAAI,IAAI;AACxB,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,gBAAgB,IAAI,aAAa,IAAI,OAAO;AAElD,UAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,mBAAmB,wCAAwC;AAEnG,YAAM,cAAc,MAAM,YAAY,QAAQ,yBAAyB,SAAS;AAChF,UAAI,CAAC,eAAe,CAAC,iBAAiB,gBAAgB,eAAe;AACnE,cAAM,IAAI,mBAAmB,kBAAkB,mDAA8C;AAAA,MAC/F;AAEA,YAAM,WAAW,MAAM,YAAY,QAAQ,yBAAyB,YAAY;AAChF,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,mBAAmB,gBAAgB,wDAAwD;AAAA,MACvG;AACA,YAAM,cAAc,OAAO,eAAgB,IAAI,SAAS,IAAI;AAE5D,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,YAAY;AAAA,QACZ;AAAA,QACA,cAAc;AAAA,QACd,WAAW,OAAO;AAAA,MACpB,CAAC;AACD,WAAK,IAAI,iBAAiB,QAAQ;AAElC,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,0BAA0B;AAAA,QAChE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,cAAM,IAAI,mBAAmB,IAAI,SAAS,eAAe,IAAI,qBAAqB,wBAAwB;AAAA,MAC5G;AAEA,YAAM,YAAY,MAAM,SAAS,KAAK;AAOtC,YAAM,UAAuB;AAAA,QAC3B,aAAa,UAAU;AAAA,QACvB,cAAc,UAAU;AAAA,QACxB,WAAW,UAAU,aAAa,KAAK,IAAI,IAAI,UAAU,aAAa,MAAO;AAAA,MAC/E;AAEA,YAAM,YAAY,OAAO;AACzB,YAAM,YAAY,WAAW,yBAAyB,YAAY;AAClE,YAAM,YAAY,WAAW,yBAAyB,SAAS;AAE/D,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,SAAS;AACb,YAAM,YAAY,IAAI;AACtB,YAAM,MAAM,GAAG,OAAO,sBAAsB,EAAE,QAAQ,QAAQ,aAAa,UAAU,CAAC;AAAA,IACxF;AAAA,IAEA,YAAY;AAAA,IAEZ,MAAM,iBAAiB;AACrB,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,CAAC,QAAS,QAAO;AACrB,UAAI,QAAQ,aAAa,KAAK,IAAI,IAAI,QAAQ,YAAY,KAAO;AAC/D,gBAAQ,MAAM,OAAO,eAAe,IAAI,eAAe;AAAA,MACzD;AACA,aAAO,QAAQ;AAAA,IACjB;AAAA,IAEA,MAAM,yBAAyB;AAC7B,YAAM,QAAQ,MAAM,OAAO,eAAe;AAC1C,YAAM,UAAkC,CAAC;AACzC,UAAI,MAAO,SAAQ,gBAAgB,UAAU,KAAK;AAClD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,MAAM,OAAO,OAAO,CAAC,GAAG;AAC5B,YAAM,aAAa,MAAM,OAAO,uBAAuB;AACvD,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,gBAAQ,IAAI,KAAK,KAAK;AAAA,MACxB;AACA,aAAO,MAAM,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAC1C;AAAA,IAEA,MAAM,iBAAiB;AACrB,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,CAAC,SAAS,aAAc,QAAO;AACnC,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,0BAA0B;AAAA,QAC/D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,IAAI,gBAAgB;AAAA,UACxB,YAAY;AAAA,UACZ,eAAe,QAAQ;AAAA,QACzB,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAAE,cAAM,YAAY,IAAI;AAAG,eAAO;AAAA,MAAM;AAC1D,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,cAA2B;AAAA,QAC/B,GAAG;AAAA,QACH,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK,iBAAiB,QAAQ;AAAA,QAC5C,WAAW,KAAK,aAAa,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO,QAAQ;AAAA,MAC7E;AACA,YAAM,YAAY,WAAW;AAC7B,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,UAAI,MAAM,MAAM,GAAG,EAAE,WAAW,EAAG,QAAO;AAC1C,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,6BAA6B;AAAA,QACnE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,UAAU;AACd,YAAM,QAAQ,MAAM,OAAO,eAAe;AAC1C,UAAI,CAAC,MAAO,QAAO;AACnB,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,6BAA6B;AAAA,QAClE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO,SAAS,KAAK,SAAS,KAAK,IAAI;AAAA,IACzC;AAAA,IAEA;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smarthivelabs-devs/auth-sdk",
-  "version": "0.1.0",
+  "version": "1.1.0",
   "description": "SmartHive Auth JavaScript/TypeScript SDK — core client for browser, Node.js, and React Native",
   "license": "MIT",
   "repository": {