@supabase/gotrue-js 3.0.0-next.2 → 3.0.0-next.21

package/dist/module/GoTrueClient.js

@@ -2,14 +2,14 @@ import GoTrueAdminApi from './GoTrueAdminApi';
 import { AUTO_REFRESH_TICK_DURATION_MS, AUTO_REFRESH_TICK_THRESHOLD, DEFAULT_HEADERS, EXPIRY_MARGIN_MS, GOTRUE_URL, JWKS_TTL, STORAGE_KEY, } from './lib/constants';
 import { AuthImplicitGrantRedirectError, AuthInvalidCredentialsError, AuthInvalidJwtError, AuthInvalidTokenResponseError, AuthPKCECodeVerifierMissingError, AuthPKCEGrantCodeExchangeError, AuthSessionMissingError, AuthUnknownError, isAuthApiError, isAuthError, isAuthImplicitGrantRedirectError, isAuthRetryableFetchError, isAuthSessionMissingError, } from './lib/errors';
 import { _request, _sessionResponse, _sessionResponsePassword, _ssoResponse, _userResponse, } from './lib/fetch';
-import { decodeJWT, deepClone, Deferred, generateCallbackId, getAlgorithm, getCodeChallengeAndMethod, getItemAsync, insecureUserWarningProxy, isBrowser, parseParametersFromURL, removeItemAsync, resolveFetch, retryable, setItemAsync, sleep, supportsLocalStorage, userNotAvailableProxy, validateExp, } from './lib/helpers';
+import { assertPasskeyExperimentalEnabled, decodeJWT, deepClone, Deferred, generateCallbackId, getAlgorithm, getCodeChallengeAndMethod, getItemAsync, insecureUserWarningProxy, isBrowser, parseParametersFromURL, removeItemAsync, resolveFetch, retryable, setItemAsync, sleep, supportsLocalStorage, userNotAvailableProxy, validateExp, } from './lib/helpers';
 import { memoryLocalStorageAdapter } from './lib/local-storage';
 import { LockAcquireTimeoutError, navigatorLock } from './lib/locks';
 import { polyfillGlobalThis } from './lib/polyfills';
 import { version } from './lib/version';
 import { bytesToBase64URL, stringToUint8Array } from './lib/base64url';
 import { createSiweMessage, fromHex, getAddress, toHex, } from './lib/web3/ethereum';
-import { deserializeCredentialCreationOptions, deserializeCredentialRequestOptions, serializeCredentialCreationResponse, serializeCredentialRequestResponse, WebAuthnApi, } from './lib/webauthn';
+import { createCredential, deserializeCredentialCreationOptions, deserializeCredentialRequestOptions, getCredential, serializeCredentialCreationResponse, serializeCredentialRequestResponse, browserSupportsWebAuthn, webAuthnAbortService, WebAuthnApi, } from './lib/webauthn';
 polyfillGlobalThis(); // Make "globalThis" available
 const DEFAULT_OPTIONS = {
     url: GOTRUE_URL,
@@ -24,6 +24,7 @@ const DEFAULT_OPTIONS = {
     throwOnError: false,
     lockAcquireTimeout: 5000, // 5 seconds
     skipAutoInitialize: false,
+    experimental: {},
 };
 async function lockNoOp(name, acquireTimeout, fn) {
     return await fn();
@@ -62,7 +63,7 @@ class GoTrueClient {
      * ```ts
      * import { createClient } from '@supabase/supabase-js'
      *
-     * const supabase = createClient('https://xyzcompany.supabase.co', 'publishable-or-anon-key')
+     * const supabase = createClient('https://xyzcompany.supabase.co', 'your-publishable-key')
      * const { data, error } = await supabase.auth.getUser()
      * ```
      *
@@ -72,13 +73,13 @@ class GoTrueClient {
      *
      * const auth = new GoTrueClient({
      *   url: 'https://xyzcompany.supabase.co/auth/v1',
-     *   headers: { apikey: 'publishable-or-anon-key' },
+     *   headers: { apikey: 'your-publishable-key' },
      *   storageKey: 'supabase-auth',
      * })
      * ```
      */
     constructor(options) {
-        var _a, _b, _c;
+        var _a, _b, _c, _d;
         /**
          * @experimental
          */
@@ -123,10 +124,12 @@ class GoTrueClient {
         }
         this.persistSession = settings.persistSession;
         this.autoRefreshToken = settings.autoRefreshToken;
+        this.experimental = (_b = settings.experimental) !== null && _b !== void 0 ? _b : {};
         this.admin = new GoTrueAdminApi({
             url: settings.url,
             headers: settings.headers,
             fetch: settings.fetch,
+            experimental: this.experimental,
         });
         this.url = settings.url;
         this.headers = settings.headers;
@@ -140,7 +143,7 @@ class GoTrueClient {
         if (settings.lock) {
             this.lock = settings.lock;
         }
-        else if (this.persistSession && isBrowser() && ((_b = globalThis === null || globalThis === void 0 ? void 0 : globalThis.navigator) === null || _b === void 0 ? void 0 : _b.locks)) {
+        else if (this.persistSession && isBrowser() && ((_c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.navigator) === null || _c === void 0 ? void 0 : _c.locks)) {
             this.lock = navigatorLock;
         }
         else {
@@ -167,6 +170,15 @@ class GoTrueClient {
             listGrants: this._listOAuthGrants.bind(this),
             revokeGrant: this._revokeOAuthGrant.bind(this),
         };
+        this.passkey = {
+            startRegistration: this._startPasskeyRegistration.bind(this),
+            verifyRegistration: this._verifyPasskeyRegistration.bind(this),
+            startAuthentication: this._startPasskeyAuthentication.bind(this),
+            verifyAuthentication: this._verifyPasskeyAuthentication.bind(this),
+            list: this._listPasskeys.bind(this),
+            update: this._updatePasskey.bind(this),
+            delete: this._deletePasskey.bind(this),
+        };
         if (this.persistSession) {
             if (settings.storage) {
                 this.storage = settings.storage;
@@ -195,7 +207,7 @@ class GoTrueClient {
             catch (e) {
                 console.error('Failed to create a new BroadcastChannel, multi-tab state changes will not be available', e);
             }
-            (_c = this.broadcastChannel) === null || _c === void 0 ? void 0 : _c.addEventListener('message', async (event) => {
+            (_d = this.broadcastChannel) === null || _d === void 0 ? void 0 : _d.addEventListener('message', async (event) => {
                 this._debug('received broadcast notification from other tab or client', event);
                 try {
                     await this._notifyAllSubscribers(event.data.event, event.data.session, false); // broadcast = false so we don't get an endless loop of messages
@@ -1210,7 +1222,7 @@ class GoTrueClient {
         }
     }
     async signInWithEthereum(credentials) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
+        var _a, _b, _c, _d, _f, _g, _h, _j, _k, _l, _m;
         // TODO: flatten type
         let message;
         let signature;
@@ -1270,11 +1282,11 @@ class GoTrueClient {
                 version: '1',
                 chainId: chainId,
                 nonce: (_c = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _c === void 0 ? void 0 : _c.nonce,
-                issuedAt: (_e = (_d = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _d === void 0 ? void 0 : _d.issuedAt) !== null && _e !== void 0 ? _e : new Date(),
-                expirationTime: (_f = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _f === void 0 ? void 0 : _f.expirationTime,
-                notBefore: (_g = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _g === void 0 ? void 0 : _g.notBefore,
-                requestId: (_h = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _h === void 0 ? void 0 : _h.requestId,
-                resources: (_j = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _j === void 0 ? void 0 : _j.resources,
+                issuedAt: (_f = (_d = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _d === void 0 ? void 0 : _d.issuedAt) !== null && _f !== void 0 ? _f : new Date(),
+                expirationTime: (_g = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _g === void 0 ? void 0 : _g.expirationTime,
+                notBefore: (_h = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _h === void 0 ? void 0 : _h.notBefore,
+                requestId: (_j = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _j === void 0 ? void 0 : _j.requestId,
+                resources: (_k = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _k === void 0 ? void 0 : _k.resources,
             };
             message = createSiweMessage(siweMessage);
             // Sign message
@@ -1287,8 +1299,8 @@ class GoTrueClient {
             const { data, error } = await _request(this.fetch, 'POST', `${this.url}/token?grant_type=web3`, {
                 headers: this.headers,
                 body: Object.assign({ chain: 'ethereum', message,
-                    signature }, (((_k = credentials.options) === null || _k === void 0 ? void 0 : _k.captchaToken)
-                    ? { gotrue_meta_security: { captcha_token: (_l = credentials.options) === null || _l === void 0 ? void 0 : _l.captchaToken } }
+                    signature }, (((_l = credentials.options) === null || _l === void 0 ? void 0 : _l.captchaToken)
+                    ? { gotrue_meta_security: { captcha_token: (_m = credentials.options) === null || _m === void 0 ? void 0 : _m.captchaToken } }
                     : null)),
                 xform: _sessionResponse,
             });
@@ -1313,7 +1325,7 @@ class GoTrueClient {
         }
     }
     async signInWithSolana(credentials) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
+        var _a, _b, _c, _d, _f, _g, _h, _j, _k, _l, _m, _o;
         let message;
         let signature;
         if ('message' in credentials) {
@@ -1398,17 +1410,17 @@ class GoTrueClient {
                     ...(((_d = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _d === void 0 ? void 0 : _d.notBefore)
                         ? [`Not Before: ${options.signInWithSolana.notBefore}`]
                         : []),
-                    ...(((_e = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _e === void 0 ? void 0 : _e.expirationTime)
+                    ...(((_f = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _f === void 0 ? void 0 : _f.expirationTime)
                         ? [`Expiration Time: ${options.signInWithSolana.expirationTime}`]
                         : []),
-                    ...(((_f = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _f === void 0 ? void 0 : _f.chainId)
+                    ...(((_g = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _g === void 0 ? void 0 : _g.chainId)
                         ? [`Chain ID: ${options.signInWithSolana.chainId}`]
                         : []),
-                    ...(((_g = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _g === void 0 ? void 0 : _g.nonce) ? [`Nonce: ${options.signInWithSolana.nonce}`] : []),
-                    ...(((_h = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _h === void 0 ? void 0 : _h.requestId)
+                    ...(((_h = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _h === void 0 ? void 0 : _h.nonce) ? [`Nonce: ${options.signInWithSolana.nonce}`] : []),
+                    ...(((_j = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _j === void 0 ? void 0 : _j.requestId)
                         ? [`Request ID: ${options.signInWithSolana.requestId}`]
                         : []),
-                    ...(((_k = (_j = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _j === void 0 ? void 0 : _j.resources) === null || _k === void 0 ? void 0 : _k.length)
+                    ...(((_l = (_k = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _k === void 0 ? void 0 : _k.resources) === null || _l === void 0 ? void 0 : _l.length)
                         ? [
                             'Resources',
                             ...options.signInWithSolana.resources.map((resource) => `- ${resource}`),
@@ -1425,8 +1437,8 @@ class GoTrueClient {
         try {
             const { data, error } = await _request(this.fetch, 'POST', `${this.url}/token?grant_type=web3`, {
                 headers: this.headers,
-                body: Object.assign({ chain: 'solana', message, signature: bytesToBase64URL(signature) }, (((_l = credentials.options) === null || _l === void 0 ? void 0 : _l.captchaToken)
-                    ? { gotrue_meta_security: { captcha_token: (_m = credentials.options) === null || _m === void 0 ? void 0 : _m.captchaToken } }
+                body: Object.assign({ chain: 'solana', message, signature: bytesToBase64URL(signature) }, (((_m = credentials.options) === null || _m === void 0 ? void 0 : _m.captchaToken)
+                    ? { gotrue_meta_security: { captcha_token: (_o = credentials.options) === null || _o === void 0 ? void 0 : _o.captchaToken } }
                     : null)),
                 xform: _sessionResponse,
             });
@@ -1478,7 +1490,7 @@ class GoTrueClient {
             }
             if (data.session) {
                 await this._saveSession(data.session);
-                await this._notifyAllSubscribers('SIGNED_IN', data.session);
+                await this._notifyAllSubscribers(redirectType === 'recovery' ? 'PASSWORD_RECOVERY' : 'SIGNED_IN', data.session);
             }
             return this._returnResult({ data: Object.assign(Object.assign({}, data), { redirectType: redirectType !== null && redirectType !== void 0 ? redirectType : null }), error });
         }
@@ -1681,7 +1693,7 @@ class GoTrueClient {
      * ```
      */
     async signInWithOtp(credentials) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _f;
         try {
             if ('email' in credentials) {
                 const { email, options } = credentials;
@@ -1714,7 +1726,7 @@ class GoTrueClient {
                         data: (_c = options === null || options === void 0 ? void 0 : options.data) !== null && _c !== void 0 ? _c : {},
                         create_user: (_d = options === null || options === void 0 ? void 0 : options.shouldCreateUser) !== null && _d !== void 0 ? _d : true,
                         gotrue_meta_security: { captcha_token: options === null || options === void 0 ? void 0 : options.captchaToken },
-                        channel: (_e = options === null || options === void 0 ? void 0 : options.channel) !== null && _e !== void 0 ? _e : 'sms',
+                        channel: (_f = options === null || options === void 0 ? void 0 : options.channel) !== null && _f !== void 0 ? _f : 'sms',
                     },
                 });
                 return this._returnResult({
@@ -1960,7 +1972,7 @@ class GoTrueClient {
      * ```
      */
     async signInWithSSO(params) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _f;
         try {
             let codeChallenge = null;
             let codeChallengeMethod = null;
@@ -1976,7 +1988,7 @@ class GoTrueClient {
                 xform: _ssoResponse,
             });
             // Automatically redirect in browser unless skipBrowserRedirect is true
-            if (((_d = result.data) === null || _d === void 0 ? void 0 : _d.url) && isBrowser() && !((_e = params.options) === null || _e === void 0 ? void 0 : _e.skipBrowserRedirect)) {
+            if (((_d = result.data) === null || _d === void 0 ? void 0 : _d.url) && isBrowser() && !((_f = params.options) === null || _f === void 0 ? void 0 : _f.skipBrowserRedirect)) {
                 window.location.assign(result.data.url);
             }
             return this._returnResult(result);
@@ -2249,7 +2261,7 @@ class GoTrueClient {
                     try {
                         await result;
                     }
-                    catch (e) {
+                    catch (_e) {
                         // we just care if it finished
                     }
                 })());
@@ -3007,6 +3019,7 @@ class GoTrueClient {
      * Gets the session data from a URL string
      */
     async _getSessionFromURL(params, callbackUrlType) {
+        var _a;
         try {
             if (!isBrowser())
                 throw new AuthImplicitGrantRedirectError('No browser detected.');
@@ -3045,7 +3058,10 @@ class GoTrueClient {
                 const url = new URL(window.location.href);
                 url.searchParams.delete('code');
                 window.history.replaceState(window.history.state, '', url.toString());
-                return { data: { session: data.session, redirectType: null }, error: null };
+                return {
+                    data: { session: data.session, redirectType: (_a = data.redirectType) !== null && _a !== void 0 ? _a : null },
+                    error: null,
+                };
             }
             const { provider_token, provider_refresh_token, access_token, refresh_token, expires_in, expires_at, token_type, } = params;
             if (!access_token || !expires_in || !refresh_token || !token_type) {
@@ -3121,24 +3137,35 @@ class GoTrueClient {
      *
      * If using `others` scope, no `SIGNED_OUT` event is fired!
      *
+     * **Warning:** the default `scope` is `'global'`. This signs the user out of
+     * **every device they are currently signed in on**, not just the current
+     * tab/session. If you only want to sign the user out of the current session
+     * (the behavior most other auth libraries default to), pass
+     * `{ scope: 'local' }` explicitly.
+     *
      * @category Auth
      *
      * @remarks
      * - In order to use the `signOut()` method, the user needs to be signed in first.
-     * - By default, `signOut()` uses the global scope, which signs out all other sessions that the user is logged into as well. Customize this behavior by passing a scope parameter.
+     * - By default, `signOut()` uses the **global** scope, which signs out the user
+     *   on every device they are signed in on (not just the current one). Pass
+     *   `{ scope: 'local' }` to only sign out the current session. This is
+     *   usually what apps want on a "Sign out" button, especially when users
+     *   sign in from multiple devices and do not expect signing out of one to
+     *   terminate the others.
      * - Since Supabase Auth uses JWTs for authentication, the access token JWT will be valid until it's expired. When the user signs out, Supabase revokes the refresh token and deletes the JWT from the client-side. This does not revoke the JWT and it will still be valid until it expires.
      *
-     * @example Sign out (all sessions)
+     * @example Sign out of every device (global – default)
      * ```js
      * const { error } = await supabase.auth.signOut()
      * ```
      *
-     * @example Sign out (current session)
+     * @example Sign out only the current session (recommended for most apps)
      * ```js
      * const { error } = await supabase.auth.signOut({ scope: 'local' })
      * ```
      *
-     * @example Sign out (other sessions)
+     * @example Sign out of all other sessions, keep the current one
      * ```js
      * const { error } = await supabase.auth.signOut({ scope: 'others' })
      * ```
@@ -3592,7 +3619,7 @@ class GoTrueClient {
         var _a;
         try {
             const { data, error } = await this._useSession(async (result) => {
-                var _a, _b, _c, _d, _e;
+                var _a, _b, _c, _d, _f;
                 const { data, error } = result;
                 if (error)
                     throw error;
@@ -3604,7 +3631,7 @@ class GoTrueClient {
                 });
                 return await _request(this.fetch, 'GET', url, {
                     headers: this.headers,
-                    jwt: (_e = (_d = data.session) === null || _d === void 0 ? void 0 : _d.access_token) !== null && _e !== void 0 ? _e : undefined,
+                    jwt: (_f = (_d = data.session) === null || _d === void 0 ? void 0 : _d.access_token) !== null && _f !== void 0 ? _f : undefined,
                 });
             });
             if (error)
@@ -4187,7 +4214,7 @@ class GoTrueClient {
             });
         }
         catch (e) {
-            if (e.isAcquireTimeout || e instanceof LockAcquireTimeoutError) {
+            if (e instanceof LockAcquireTimeoutError) {
                 this._debug('auto refresh token tick lock not available');
             }
             else {
@@ -4852,6 +4879,331 @@ class GoTrueClient {
             throw error;
         }
     }
+    // --- Passkey Methods ---
+    /**
+     * Sign in with a passkey. Handles the full WebAuthn ceremony:
+     * 1. Fetches authentication challenge from server
+     * 2. Prompts user via navigator.credentials.get()
+     * 3. Verifies credential with server and creates session
+     *
+     * Requires `auth.experimental.passkey: true`.
+     */
+    async signInWithPasskey(credentials) {
+        var _a, _b, _c;
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            if (!browserSupportsWebAuthn()) {
+                return this._returnResult({
+                    data: null,
+                    error: new AuthUnknownError('Browser does not support WebAuthn', null),
+                });
+            }
+            // 1. Get challenge options from server
+            const { data: options, error: optionsError } = await this._startPasskeyAuthentication({
+                options: { captchaToken: (_a = credentials === null || credentials === void 0 ? void 0 : credentials.options) === null || _a === void 0 ? void 0 : _a.captchaToken },
+            });
+            if (optionsError || !options) {
+                return this._returnResult({ data: null, error: optionsError });
+            }
+            // 2. Deserialize and prompt user via browser WebAuthn API
+            const publicKeyOptions = deserializeCredentialRequestOptions(options.options);
+            const signal = (_c = (_b = credentials === null || credentials === void 0 ? void 0 : credentials.options) === null || _b === void 0 ? void 0 : _b.signal) !== null && _c !== void 0 ? _c : webAuthnAbortService.createNewAbortSignal();
+            const { data: credential, error: credentialError } = await getCredential({
+                publicKey: publicKeyOptions,
+                signal,
+            });
+            if (credentialError || !credential) {
+                return this._returnResult({
+                    data: null,
+                    error: credentialError !== null && credentialError !== void 0 ? credentialError : new AuthUnknownError('WebAuthn ceremony failed', null),
+                });
+            }
+            // 3. Serialize and verify with server
+            const serialized = serializeCredentialRequestResponse(credential);
+            return this._verifyPasskeyAuthentication({
+                challengeId: options.challenge_id,
+                credential: serialized,
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Register a passkey for the current authenticated user. Handles the full WebAuthn ceremony:
+     * 1. Fetches registration challenge from server
+     * 2. Prompts user via navigator.credentials.create()
+     * 3. Verifies credential with server
+     *
+     * Requires an active session. Requires `auth.experimental.passkey: true`.
+     */
+    async registerPasskey(credentials) {
+        var _a, _b;
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            if (!browserSupportsWebAuthn()) {
+                return this._returnResult({
+                    data: null,
+                    error: new AuthUnknownError('Browser does not support WebAuthn', null),
+                });
+            }
+            // 1. Get challenge options from server
+            const { data: options, error: optionsError } = await this._startPasskeyRegistration();
+            if (optionsError || !options) {
+                return this._returnResult({ data: null, error: optionsError });
+            }
+            // 2. Deserialize and prompt user via browser WebAuthn API
+            const publicKeyOptions = deserializeCredentialCreationOptions(options.options);
+            const signal = (_b = (_a = credentials === null || credentials === void 0 ? void 0 : credentials.options) === null || _a === void 0 ? void 0 : _a.signal) !== null && _b !== void 0 ? _b : webAuthnAbortService.createNewAbortSignal();
+            const { data: credential, error: credentialError } = await createCredential({
+                publicKey: publicKeyOptions,
+                signal,
+            });
+            if (credentialError || !credential) {
+                return this._returnResult({
+                    data: null,
+                    error: credentialError !== null && credentialError !== void 0 ? credentialError : new AuthUnknownError('WebAuthn ceremony failed', null),
+                });
+            }
+            // 3. Serialize and verify with server
+            const serialized = serializeCredentialCreationResponse(credential);
+            return this._verifyPasskeyRegistration({
+                challengeId: options.challenge_id,
+                credential: serialized,
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Start passkey registration for the current authenticated user.
+     * Returns WebAuthn credential creation options to pass to navigator.credentials.create().
+     */
+    async _startPasskeyRegistration() {
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                if (!session) {
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                const { data, error } = await _request(this.fetch, 'POST', `${this.url}/passkeys/registration/options`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    body: {},
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Verify passkey registration with the credential response.
+     * The credentialResponse should be the serialized output of navigator.credentials.create().
+     */
+    async _verifyPasskeyRegistration(params) {
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                if (!session) {
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                const { data, error } = await _request(this.fetch, 'POST', `${this.url}/passkeys/registration/verify`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    body: {
+                        challenge_id: params.challengeId,
+                        credential: params.credential,
+                    },
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Start passkey authentication.
+     * Returns WebAuthn credential request options to pass to navigator.credentials.get().
+     */
+    async _startPasskeyAuthentication(params) {
+        var _a;
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            const { data, error } = await _request(this.fetch, 'POST', `${this.url}/passkeys/authentication/options`, {
+                headers: this.headers,
+                body: {
+                    gotrue_meta_security: { captcha_token: (_a = params === null || params === void 0 ? void 0 : params.options) === null || _a === void 0 ? void 0 : _a.captchaToken },
+                },
+            });
+            if (error) {
+                return this._returnResult({ data: null, error });
+            }
+            return this._returnResult({ data, error: null });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Verify passkey authentication and create a session.
+     * The credential should be the serialized output of navigator.credentials.get().
+     */
+    async _verifyPasskeyAuthentication(params) {
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            const { data, error } = await _request(this.fetch, 'POST', `${this.url}/passkeys/authentication/verify`, {
+                headers: this.headers,
+                body: {
+                    challenge_id: params.challengeId,
+                    credential: params.credential,
+                },
+                xform: _sessionResponse,
+            });
+            if (error) {
+                return this._returnResult({ data: null, error });
+            }
+            if (data.session) {
+                await this._saveSession(data.session);
+                await this._notifyAllSubscribers('SIGNED_IN', data.session);
+            }
+            return this._returnResult({ data, error: null });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * List all passkeys for the current user.
+     */
+    async _listPasskeys() {
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                if (!session) {
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                const { data, error } = await _request(this.fetch, 'GET', `${this.url}/passkeys`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    xform: (data) => ({ data, error: null }),
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Update a passkey.
+     */
+    async _updatePasskey(params) {
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                if (!session) {
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                const { data, error } = await _request(this.fetch, 'PATCH', `${this.url}/passkeys/${params.passkeyId}`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    body: { friendly_name: params.friendlyName },
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Delete a passkey.
+     */
+    async _deletePasskey(params) {
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                if (!session) {
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                const { error } = await _request(this.fetch, 'DELETE', `${this.url}/passkeys/${params.passkeyId}`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    noResolveJson: true,
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data: null, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
 }
 GoTrueClient.nextInstanceID = {};
 export default GoTrueClient;