@supabase/lite 0.7.0 → 0.7.1-next.1

package/dist/vite/index.d.ts

@@ -930,9 +930,22 @@ interface AuthConfig {
         enable_signup?: boolean;
         enable_confirmations?: boolean;
         double_confirm_changes?: boolean;
+        otp_length?: number;
+        otp_expiry?: number;
+        smtp?: {
+            sender_name?: string;
+            admin_email?: string;
+        };
+        template?: Partial<Record<EmailTemplateType, EmailTemplateConfig>>;
     };
     enable_confirmations?: boolean;
     site_url?: string;
+    additional_redirect_urls?: string[];
+}
+type EmailTemplateType = "invite" | "confirmation" | "recovery" | "magic_link" | "email_change";
+interface EmailTemplateConfig {
+    subject?: string;
+    content_path?: string;
 }
 
 type Dialect$1 = "postgres" | "sqlite";
@@ -1043,6 +1056,11 @@ interface MailMeta {
     tokenNew?: string;
     tokenHashNew?: string;
     redirectTo?: string;
+    /** Current (old) email — used as the `Email` template var for email change. */
+    currentEmail?: string;
+    /** Pending (new) email — used as the `NewEmail` template var for email change. */
+    newEmail?: string;
+    data?: string;
 }
 
 declare class AuthService {
@@ -1055,6 +1073,18 @@ declare class AuthService {
     private sessionTimeboxSeconds?;
     private sessionInactivitySeconds?;
     constructor(repo: AuthRepository, config: AuthConfig, mailer: Mailer);
+    private get otpLength();
+    private get otpExpirySeconds();
+    /**
+     * Returns a safe post-verification redirect target: `redirectTo` if allowed,
+     * otherwise `site_url`. Mirrors GoTrue's `IsRedirectURLValid`:
+     *   - same scheme + host + port as `site_url` (any path; port ignored for
+     *     loopback hosts), or
+     *   - a glob match of `additional_redirect_urls` against the full URL
+     *     (patterns use `.`/`/` as separators, so `*` does not cross them but
+     *     `**` does).
+     */
+    resolveEmailRedirect(redirectTo?: string | null): string;
     signUp(email: string | undefined, password: string | undefined, data?: Record<string, unknown>): Promise<{
         user: UserResponse;
         session?: SessionResponse;
@@ -1089,7 +1119,8 @@ declare class AuthService {
     private mapUserToResponse;
     private mapIdentityToResponse;
     private findUserByTokenAndType;
-    private otpMatchesStoredTokenHash;
+    private static readonly SENT_AT_COLUMN;
+    private isTokenExpired;
     private getTokenColumnsForType;
     private createAuditLog;
 }
@@ -1621,6 +1652,15 @@ declare function createServer(app: App, options?: ServerOptions): hono_hono_base
             status: 200;
         };
     };
+} & {
+    "/verify": {
+        $get: {
+            input: {};
+            output: undefined;
+            outputFormat: "redirect";
+            status: 303;
+        };
+    };
 } & {
     "/recover": {
         $post: {

package/package.json

@@ -1,6 +1,6 @@
 {
    "name": "@supabase/lite",
-   "version": "0.7.0",
+   "version": "0.7.1-next.1",
    "description": "Lightweight TypeScript-native Supabase implementation on SQLite (alpha). PostgREST + GoTrue compatible — use @supabase/supabase-js as-is.",
    "license": "Apache-2.0",
    "type": "module",