@unisim/sdk 0.141.6 → 0.141.8

package/dist/nativeOAuth.d.ts

@@ -0,0 +1,208 @@
+import type { useUniversal } from './provider.js';
+import { type OAuthProvider, type OAuthReturnError } from './oauth.js';
+type Supabase = ReturnType<typeof useUniversal>['supabase'];
+/** The host of every app's callback: `<bundle id>://auth-callback`. */
+export declare const NATIVE_OAUTH_CALLBACK_HOST = "auth-callback";
+export type NativePlatform = 'ios' | 'android';
+export interface NativeOAuthSupport {
+    platform: NativePlatform;
+    /** `<bundle id>://auth-callback` — where Supabase sends the browser back to. */
+    callbackUrl: string;
+    /** True where Apple is the OS sheet rather than a browser page (iOS). */
+    appleNative: boolean;
+}
+/**
+ * The native half: three methods on the EXISTING `UnisimSuiteAuth` plugin.
+ *
+ * ⚠️ On that plugin rather than a new one on purpose — Capacitor resolves
+ * plugins through a `capacitor.plugins.json` generated per app, so a new
+ * plugin class would be missing from every app until each re-synced, and
+ * missing looks like nothing at all. See the note in UnisimSuiteAuthPlugin.
+ */
+export interface NativeOAuthPlugin {
+    oauthSupport(): Promise<{
+        platform?: string;
+        callbackUrl?: string;
+        appleNative?: boolean;
+    }>;
+    oauthStart(options: {
+        url: string;
+    }): Promise<{
+        url?: string | null;
+        cancelled?: boolean;
+    }>;
+    appleSignIn(): Promise<{
+        cancelled?: boolean;
+        identityToken?: string | null;
+        nonce?: string | null;
+        givenName?: string | null;
+        familyName?: string | null;
+    }>;
+}
+/** Validate what the plugin reported; anything unexpected reads as "unsupported". */
+export declare function normaliseNativeSupport(raw: unknown): NativeOAuthSupport | null;
+/**
+ * Whether this build can do native provider sign-in, and how. Null in a
+ * browser, and in a native build whose plugin predates it (an app synced
+ * against an older SDK) — the dialog then offers no provider tab at all, which
+ * is the honest page.
+ */
+export declare function nativeOAuthSupport(plugin?: NativeOAuthPlugin | null): Promise<NativeOAuthSupport | null>;
+/**
+ * The providers a native shell should offer, given what the project has
+ * switched on.
+ *
+ * ⚠️ App Review guideline 4.8: an iPhone app offering Google or Microsoft
+ * sign-in must offer Sign in with Apple too. So on iOS the provider list is
+ * all-or-nothing on Apple — if Apple is off, Google and Microsoft are withheld
+ * as well, and the app offers the email code alone (which 4.8 accepts). Android
+ * has no such rule; there Apple, where on, is a browser page like the others.
+ */
+export declare function nativeProvidersToOffer(enabled: readonly OAuthProvider[], support: NativeOAuthSupport | null): OAuthProvider[];
+interface CryptoLike {
+    getRandomValues<T extends ArrayBufferView>(array: T): T;
+    subtle?: {
+        digest(algorithm: string, data: BufferSource): Promise<ArrayBuffer>;
+    };
+}
+export interface PkcePair {
+    verifier: string;
+    challenge: string;
+    /** GoTrue's spelling — lower-case, as supabase-js sends it. */
+    method: 's256' | 'plain';
+}
+/** RFC 4648 §5 base64url, no padding — RFC 7636's encoding of the challenge. */
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+/**
+ * The S256 challenge for a verifier, or the verifier itself as a `plain`
+ * challenge where WebCrypto is unavailable — the same fallback supabase-js
+ * makes. `crypto.subtle` exists only in a secure context, and whether a
+ * Capacitor origin counts is WebKit's decision, not ours.
+ *
+ * `plain` still protects the thing PKCE is here for: the verifier travels
+ * app → browser in the authorize URL and never through the redirect an
+ * interloper could intercept.
+ */
+export declare function pkceChallenge(verifier: string, cryptoImpl?: CryptoLike | null): Promise<{
+    challenge: string;
+    method: 's256' | 'plain';
+}>;
+/** A fresh verifier (64 hex characters — inside RFC 7636's 43–128) and its challenge. */
+export declare function createPkcePair(cryptoImpl?: CryptoLike | null): Promise<PkcePair>;
+export interface NativeAuthorizeUrlInput {
+    supabaseUrl: string;
+    provider: OAuthProvider;
+    /** The app's deep link, from `nativeOAuthSupport().callbackUrl`. */
+    redirectTo: string;
+    pkce: {
+        challenge: string;
+        method: 's256' | 'plain';
+    };
+    loginHint?: string;
+    /**
+     * Link the provider to the signed-in (anonymous) user instead of signing in.
+     * Uses the identities endpoint, which must be called WITH the user's bearer
+     * token and answers JSON `{ url }` — see `skip_http_redirect`.
+     */
+    link?: boolean;
+}
+/**
+ * The GoTrue URL that starts a provider round trip, carrying the PKCE
+ * challenge. Sign-in: open it in the system browser. Link: fetch it with the
+ * user's JWT and open the `url` it answers with.
+ */
+export declare function buildNativeAuthorizeUrl(input: NativeAuthorizeUrlInput): string;
+export interface CustomSchemeUrlParts {
+    scheme: string;
+    host: string;
+    path: string;
+    query: URLSearchParams;
+    fragment: URLSearchParams;
+}
+/**
+ * Split `scheme://host/path?query#fragment` by hand.
+ *
+ * ⚠️ Not `new URL()`: for a non-special scheme (anything that isn't http,
+ * file, …) older Android System WebViews return an EMPTY host and fold the
+ * authority into the path, so `url.host === 'auth-callback'` would fail on
+ * some phones and pass on the test machine.
+ */
+export declare function splitCustomSchemeUrl(value: string): CustomSchemeUrlParts | null;
+export type NativeOAuthCallback = {
+    kind: 'code';
+    code: string;
+} | {
+    kind: 'error';
+    error: OAuthReturnError;
+} | {
+    kind: 'invalid';
+    reason: string;
+};
+/**
+ * Read the deep link Supabase sent the browser back to.
+ *
+ * Errors are read from the query string AND the fragment, for the reason
+ * `readOAuthError` gives. Success must be a `code` in the query: tokens in a
+ * fragment are refused (see the header) — they would mean the project ignored
+ * the PKCE challenge, and accepting them is how an injected callback signs
+ * someone into the wrong account.
+ */
+export declare function parseNativeOAuthCallback(received: string, expected: string): NativeOAuthCallback;
+type NativeError = {
+    message: string;
+    code: string | null;
+};
+/**
+ * A GoTrue error body as `{ code, message }`, in the codes the web flow
+ * produces. GoTrue has used two shapes — `{ code: 422, error_code, msg }` and,
+ * on the newer API version, `{ code: 'manual_linking_disabled', message }` —
+ * and OAuth-style `{ error, error_description }` besides.
+ */
+export declare function gotrueError(body: unknown, status: number): NativeError;
+export interface NativeOAuthOptions {
+    /** `config.supabaseUrl` — the GoTrue calls are made directly (see header). */
+    supabaseUrl: string;
+    /** `config.supabaseAnonKey`. */
+    anonKey: string;
+    /** A typed email, passed to Google/Microsoft as `login_hint`. */
+    loginHint?: string;
+    /**
+     * Sign in as a fresh user even over a trial session — the recovery path for
+     * `identity_already_exists`, and only after the user has agreed to leave the
+     * trial's work behind. See `abandonTrialAndSignInNative`.
+     */
+    forceNewSession?: boolean;
+    /** Test seams. */
+    plugin?: NativeOAuthPlugin | null;
+    fetchImpl?: typeof fetch;
+    cryptoImpl?: CryptoLike | null;
+}
+export interface NativeOAuthResult {
+    /**
+     * `signed-in`: the session is installed (and in the shared store).
+     * `cancelled`: the person closed the sheet or the browser — not an error,
+     * say nothing. `error`: see `error`, which carries the web flow's codes.
+     */
+    status: 'signed-in' | 'cancelled' | 'error';
+    /** `link` when a trial session was being upgraded in place. */
+    mode: 'link' | 'signin';
+    error: NativeError | null;
+}
+/**
+ * Apple / Google / Microsoft sign-in from a native shell, upgrading a trial
+ * session in place where there is one. Unlike the web `startOAuthSignIn` this
+ * resolves when the whole round trip is over — the app never navigates away.
+ */
+export declare function startNativeOAuthSignIn(supabase: Supabase, provider: OAuthProvider, options: NativeOAuthOptions): Promise<NativeOAuthResult>;
+/**
+ * The native escape hatch for `identity_already_exists`: sign in as the
+ * provider's existing account, leaving the trial's work behind. Call it only
+ * after the user has agreed to that.
+ *
+ * Unlike the web `abandonTrialAndSignIn` there is no sign-out first: the new
+ * session simply replaces the trial one when it lands, so a person who cancels
+ * the sheet still has their trial.
+ */
+export declare function abandonTrialAndSignInNative(supabase: Supabase, provider: OAuthProvider, options: NativeOAuthOptions): Promise<NativeOAuthResult>;
+export {};
+//# sourceMappingURL=nativeOAuth.d.ts.map

package/dist/nativeOAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nativeOAuth.d.ts","sourceRoot":"","sources":["../src/nativeOAuth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,EAAyC,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAgE7G,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,UAAU,CAAC,CAAA;AAE3D,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,kBAAkB,CAAA;AAEzD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,SAAS,CAAA;AAE9C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,cAAc,CAAA;IACxB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,WAAW,EAAE,OAAO,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,IAAI,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC3F,UAAU,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC3F,WAAW,IAAI,OAAO,CAAC;QACrB,SAAS,CAAC,EAAE,OAAO,CAAA;QACnB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC3B,CAAC,CAAA;CACH;AAMD,qFAAqF;AACrF,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAS9E;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,GAAE,iBAAiB,GAAG,IAA0B,GACrD,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAQpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GACjC,aAAa,EAAE,CAIjB;AAID,UAAU,UAAU;IAClB,eAAe,CAAC,CAAC,SAAS,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAA;IACvD,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;KAAE,CAAA;CACjF;AAMD,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;CACzB;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIzD;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,UAAU,GAAG,IAAsB,GAC9C,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC,CAW1D;AAED,yFAAyF;AACzF,wBAAsB,cAAc,CAAC,UAAU,GAAE,UAAU,GAAG,IAAsB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQvG;AAID,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,aAAa,CAAA;IACvB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IACrD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAc9E;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,eAAe,CAAA;IACtB,QAAQ,EAAE,eAAe,CAAA;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAU/E;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvC;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,mBAAmB,CAchG;AAID,KAAK,WAAW,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAA;AAW3D;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAQtE;AAoDD,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAA;IACnB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,kBAAkB;IAClB,MAAM,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACjC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,MAAM,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO,CAAA;IAC3C,+DAA+D;IAC/D,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAA;IACvB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;CAC1B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAuD5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAE5B"}

package/dist/nativeOAuth.js

@@ -0,0 +1,372 @@
+'use client';
+import { capacitorPlugin } from './sessionStorage.js';
+import { loginHintParams, oauthErrorFromParams } from './oauth.js';
+/** The host of every app's callback: `<bundle id>://auth-callback`. */
+export const NATIVE_OAUTH_CALLBACK_HOST = 'auth-callback';
+function nativeOAuthPlugin() {
+    return capacitorPlugin('UnisimSuiteAuth');
+}
+/** Validate what the plugin reported; anything unexpected reads as "unsupported". */
+export function normaliseNativeSupport(raw) {
+    const r = raw;
+    if (!r || typeof r !== 'object')
+        return null;
+    const platform = r.platform === 'ios' || r.platform === 'android' ? r.platform : null;
+    const callbackUrl = typeof r.callbackUrl === 'string' ? r.callbackUrl : '';
+    const parts = splitCustomSchemeUrl(callbackUrl);
+    if (!platform || !parts || parts.host !== NATIVE_OAUTH_CALLBACK_HOST)
+        return null;
+    if (parts.scheme === 'http' || parts.scheme === 'https')
+        return null;
+    return { platform, callbackUrl, appleNative: platform === 'ios' && r.appleNative === true };
+}
+/**
+ * Whether this build can do native provider sign-in, and how. Null in a
+ * browser, and in a native build whose plugin predates it (an app synced
+ * against an older SDK) — the dialog then offers no provider tab at all, which
+ * is the honest page.
+ */
+export async function nativeOAuthSupport(plugin = nativeOAuthPlugin()) {
+    if (!plugin || typeof plugin.oauthSupport !== 'function')
+        return null;
+    try {
+        return normaliseNativeSupport(await plugin.oauthSupport());
+    }
+    catch {
+        // An older native half answers "not implemented" here.
+        return null;
+    }
+}
+/**
+ * The providers a native shell should offer, given what the project has
+ * switched on.
+ *
+ * ⚠️ App Review guideline 4.8: an iPhone app offering Google or Microsoft
+ * sign-in must offer Sign in with Apple too. So on iOS the provider list is
+ * all-or-nothing on Apple — if Apple is off, Google and Microsoft are withheld
+ * as well, and the app offers the email code alone (which 4.8 accepts). Android
+ * has no such rule; there Apple, where on, is a browser page like the others.
+ */
+export function nativeProvidersToOffer(enabled, support) {
+    if (!support)
+        return [];
+    if (support.platform === 'ios' && !enabled.includes('apple'))
+        return [];
+    return [...enabled];
+}
+function defaultCrypto() {
+    return globalThis.crypto ?? null;
+}
+/** RFC 4648 §5 base64url, no padding — RFC 7636's encoding of the challenge. */
+export function base64UrlEncode(bytes) {
+    let binary = '';
+    for (const b of bytes)
+        binary += String.fromCharCode(b);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/**
+ * The S256 challenge for a verifier, or the verifier itself as a `plain`
+ * challenge where WebCrypto is unavailable — the same fallback supabase-js
+ * makes. `crypto.subtle` exists only in a secure context, and whether a
+ * Capacitor origin counts is WebKit's decision, not ours.
+ *
+ * `plain` still protects the thing PKCE is here for: the verifier travels
+ * app → browser in the authorize URL and never through the redirect an
+ * interloper could intercept.
+ */
+export async function pkceChallenge(verifier, cryptoImpl = defaultCrypto()) {
+    const subtle = cryptoImpl?.subtle;
+    if (subtle && typeof TextEncoder !== 'undefined') {
+        try {
+            const digest = await subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+            return { challenge: base64UrlEncode(new Uint8Array(digest)), method: 's256' };
+        }
+        catch {
+            /* fall through to plain */
+        }
+    }
+    return { challenge: verifier, method: 'plain' };
+}
+/** A fresh verifier (64 hex characters — inside RFC 7636's 43–128) and its challenge. */
+export async function createPkcePair(cryptoImpl = defaultCrypto()) {
+    if (!cryptoImpl || typeof cryptoImpl.getRandomValues !== 'function') {
+        throw new Error('No secure random source to start a sign-in with');
+    }
+    const bytes = cryptoImpl.getRandomValues(new Uint8Array(32));
+    const verifier = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+    const { challenge, method } = await pkceChallenge(verifier, cryptoImpl);
+    return { verifier, challenge, method };
+}
+/**
+ * The GoTrue URL that starts a provider round trip, carrying the PKCE
+ * challenge. Sign-in: open it in the system browser. Link: fetch it with the
+ * user's JWT and open the `url` it answers with.
+ */
+export function buildNativeAuthorizeUrl(input) {
+    const base = input.supabaseUrl.replace(/\/+$/, '');
+    const path = input.link ? '/auth/v1/user/identities/authorize' : '/auth/v1/authorize';
+    const params = new URLSearchParams({
+        provider: input.provider,
+        redirect_to: input.redirectTo,
+        code_challenge: input.pkce.challenge,
+        code_challenge_method: input.pkce.method,
+    });
+    for (const [key, value] of Object.entries(loginHintParams(input.provider, input.loginHint) ?? {})) {
+        params.set(key, value);
+    }
+    if (input.link)
+        params.set('skip_http_redirect', 'true');
+    return `${base}${path}?${params.toString()}`;
+}
+/**
+ * Split `scheme://host/path?query#fragment` by hand.
+ *
+ * ⚠️ Not `new URL()`: for a non-special scheme (anything that isn't http,
+ * file, …) older Android System WebViews return an EMPTY host and fold the
+ * authority into the path, so `url.host === 'auth-callback'` would fail on
+ * some phones and pass on the test machine.
+ */
+export function splitCustomSchemeUrl(value) {
+    const m = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^/?#]*)([^?#]*)(\?[^#]*)?(#.*)?$/.exec(value);
+    if (!m)
+        return null;
+    return {
+        scheme: (m[1] ?? '').toLowerCase(),
+        host: (m[2] ?? '').toLowerCase(),
+        path: m[3] ?? '',
+        query: new URLSearchParams((m[4] ?? '').slice(1)),
+        fragment: new URLSearchParams((m[5] ?? '').slice(1)),
+    };
+}
+/**
+ * Read the deep link Supabase sent the browser back to.
+ *
+ * Errors are read from the query string AND the fragment, for the reason
+ * `readOAuthError` gives. Success must be a `code` in the query: tokens in a
+ * fragment are refused (see the header) — they would mean the project ignored
+ * the PKCE challenge, and accepting them is how an injected callback signs
+ * someone into the wrong account.
+ */
+export function parseNativeOAuthCallback(received, expected) {
+    const got = splitCustomSchemeUrl(received);
+    const want = splitCustomSchemeUrl(expected);
+    if (!got || !want || got.scheme !== want.scheme || got.host !== want.host) {
+        return { kind: 'invalid', reason: 'not this app\'s callback address' };
+    }
+    const error = oauthErrorFromParams([got.query, got.fragment]);
+    if (error)
+        return { kind: 'error', error };
+    const code = got.query.get('code');
+    if (code)
+        return { kind: 'code', code };
+    if (got.fragment.has('access_token')) {
+        return { kind: 'invalid', reason: 'tokens instead of a code' };
+    }
+    return { kind: 'invalid', reason: 'no code' };
+}
+function str(value) {
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
+/**
+ * A GoTrue error body as `{ code, message }`, in the codes the web flow
+ * produces. GoTrue has used two shapes — `{ code: 422, error_code, msg }` and,
+ * on the newer API version, `{ code: 'manual_linking_disabled', message }` —
+ * and OAuth-style `{ error, error_description }` besides.
+ */
+export function gotrueError(body, status) {
+    const b = (body ?? {});
+    return {
+        code: str(b.error_code) ?? str(b.code) ?? str(b.error),
+        message: str(b.msg) ?? str(b.message) ?? str(b.error_description) ?? str(b.error) ??
+            `Sign-in failed (HTTP ${status})`,
+    };
+}
+async function gotrue(fetchImpl, url, init) {
+    let res;
+    try {
+        res = await fetchImpl(url, init);
+    }
+    catch (err) {
+        return { ok: false, error: { code: 'network_error', message: err?.message || 'Network error' } };
+    }
+    let body = {};
+    try {
+        body = ((await res.json()) ?? {});
+    }
+    catch {
+        /* an empty or non-JSON body — the status still says what happened */
+    }
+    if (!res.ok)
+        return { ok: false, error: gotrueError(body, res.status) };
+    return { ok: true, body };
+}
+function headers(anonKey, bearer) {
+    const h = { apikey: anonKey, 'Content-Type': 'application/json' };
+    if (bearer)
+        h.Authorization = `Bearer ${bearer}`;
+    return h;
+}
+function sessionFrom(body) {
+    const access_token = str(body.access_token);
+    const refresh_token = str(body.refresh_token);
+    return access_token && refresh_token ? { access_token, refresh_token } : null;
+}
+function pluginError(err, fallbackCode) {
+    const e = err;
+    return {
+        code: e?.code !== undefined && e?.code !== null ? String(e.code) : fallbackCode,
+        message: e?.message || 'Sign-in could not be started',
+    };
+}
+const BAD_RESPONSE = { code: 'invalid_response', message: 'Sign-in returned no session.' };
+/**
+ * Apple / Google / Microsoft sign-in from a native shell, upgrading a trial
+ * session in place where there is one. Unlike the web `startOAuthSignIn` this
+ * resolves when the whole round trip is over — the app never navigates away.
+ */
+export async function startNativeOAuthSignIn(supabase, provider, options) {
+    const plugin = options.plugin === undefined ? nativeOAuthPlugin() : options.plugin;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const base = options.supabaseUrl.replace(/\/+$/, '');
+    let mode = 'signin';
+    const fail = (error) => ({ status: 'error', mode, error });
+    const support = await nativeOAuthSupport(plugin);
+    if (!plugin || !support) {
+        return fail({ code: 'native_oauth_unavailable', message: 'This app cannot open a sign-in window.' });
+    }
+    // The trial check mirrors oauth.ts: anonymous → link, everyone else → sign in.
+    let bearer = null;
+    if (!options.forceNewSession) {
+        const { data } = await supabase.auth.getSession();
+        const session = data.session;
+        if (session?.user?.is_anonymous === true && session?.access_token) {
+            mode = 'link';
+            bearer = session.access_token;
+        }
+    }
+    const leg = provider === 'apple' && support.appleNative
+        ? await viaAppleSheet(plugin, base, options.anonKey, bearer, fetchImpl)
+        : await viaSystemBrowser(plugin, support, provider, base, options, bearer, fetchImpl);
+    if ('cancelled' in leg)
+        return { status: 'cancelled', mode, error: null };
+    if ('error' in leg)
+        return fail(leg.error);
+    // Through the client, so it lands in the storage adapter (the shared suite
+    // store) and every onAuthStateChange listener hears SIGNED_IN.
+    const { error } = await supabase.auth.setSession(leg.session);
+    if (error) {
+        const e = error;
+        return fail({ message: e.message ?? 'Sign-in failed', code: e.code ?? null });
+    }
+    // Apple hands over the name ONCE, on the first sign-in, and never puts it in
+    // the token — keep it or it is gone. Never fatal.
+    const given = leg.name?.given ?? null;
+    const family = leg.name?.family ?? null;
+    if (given || family) {
+        const fullName = [given, family].filter(Boolean).join(' ');
+        try {
+            await supabase.auth.updateUser({
+                data: { full_name: fullName, ...(given ? { given_name: given } : {}), ...(family ? { family_name: family } : {}) },
+            });
+        }
+        catch {
+            /* the sign-in itself succeeded */
+        }
+    }
+    return { status: 'signed-in', mode, error: null };
+}
+/**
+ * The native escape hatch for `identity_already_exists`: sign in as the
+ * provider's existing account, leaving the trial's work behind. Call it only
+ * after the user has agreed to that.
+ *
+ * Unlike the web `abandonTrialAndSignIn` there is no sign-out first: the new
+ * session simply replaces the trial one when it lands, so a person who cancels
+ * the sheet still has their trial.
+ */
+export function abandonTrialAndSignInNative(supabase, provider, options) {
+    return startNativeOAuthSignIn(supabase, provider, { ...options, forceNewSession: true });
+}
+async function viaAppleSheet(plugin, base, anonKey, bearer, fetchImpl) {
+    let res;
+    try {
+        res = await plugin.appleSignIn();
+    }
+    catch (err) {
+        return { error: pluginError(err, 'apple_signin_failed') };
+    }
+    if (res?.cancelled)
+        return { cancelled: true };
+    if (!res?.identityToken || !res.nonce) {
+        return { error: { code: 'apple_no_token', message: 'Apple did not return a sign-in token.' } };
+    }
+    // The RAW nonce: the sheet sent Apple its SHA-256, and GoTrue hashes this to
+    // compare against the token's `nonce` claim.
+    const body = { provider: 'apple', id_token: res.identityToken, nonce: res.nonce };
+    if (bearer)
+        body.link_identity = true;
+    const r = await gotrue(fetchImpl, `${base}/auth/v1/token?grant_type=id_token`, {
+        method: 'POST',
+        headers: headers(anonKey, bearer),
+        body: JSON.stringify(body),
+    });
+    if (!r.ok)
+        return { error: r.error };
+    const session = sessionFrom(r.body);
+    if (!session)
+        return { error: BAD_RESPONSE };
+    return { session, name: { given: res.givenName ?? null, family: res.familyName ?? null } };
+}
+async function viaSystemBrowser(plugin, support, provider, base, options, bearer, fetchImpl) {
+    let pkce;
+    try {
+        pkce = await createPkcePair(options.cryptoImpl === undefined ? defaultCrypto() : options.cryptoImpl);
+    }
+    catch (err) {
+        return { error: { code: 'pkce_unavailable', message: err.message } };
+    }
+    let url = buildNativeAuthorizeUrl({
+        supabaseUrl: base,
+        provider,
+        redirectTo: support.callbackUrl,
+        pkce,
+        loginHint: options.loginHint,
+        link: bearer !== null,
+    });
+    if (bearer) {
+        // The identities endpoint needs the trial user's JWT, which a browser tab
+        // cannot carry — so ask for the provider URL here and open THAT.
+        const r = await gotrue(fetchImpl, url, { method: 'GET', headers: headers(options.anonKey, bearer) });
+        if (!r.ok)
+            return { error: r.error };
+        const providerUrl = str(r.body.url);
+        if (!providerUrl)
+            return { error: BAD_RESPONSE };
+        url = providerUrl;
+    }
+    let res;
+    try {
+        res = await plugin.oauthStart({ url });
+    }
+    catch (err) {
+        return { error: pluginError(err, 'browser_failed') };
+    }
+    if (res?.cancelled)
+        return { cancelled: true };
+    const callback = parseNativeOAuthCallback(res?.url ?? '', support.callbackUrl);
+    if (callback.kind === 'error')
+        return { error: callback.error };
+    if (callback.kind === 'invalid') {
+        return { error: { code: 'invalid_callback', message: `Sign-in came back in a form this app does not accept (${callback.reason}).` } };
+    }
+    const r = await gotrue(fetchImpl, `${base}/auth/v1/token?grant_type=pkce`, {
+        method: 'POST',
+        headers: headers(options.anonKey, null),
+        body: JSON.stringify({ auth_code: callback.code, code_verifier: pkce.verifier }),
+    });
+    if (!r.ok)
+        return { error: r.error };
+    const session = sessionFrom(r.body);
+    return session ? { session } : { error: BAD_RESPONSE };
+}
+//# sourceMappingURL=nativeOAuth.js.map

package/dist/nativeOAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nativeOAuth.js","sourceRoot":"","sources":["../src/nativeOAuth.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAGZ,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAA6C,MAAM,YAAY,CAAA;AAkE7G,uEAAuE;AACvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAA;AAgCzD,SAAS,iBAAiB;IACxB,OAAO,eAAe,CAAoB,iBAAiB,CAAC,CAAA;AAC9D,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,MAAM,CAAC,GAAG,GAA8F,CAAA;IACxG,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC5C,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IACrF,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAA;IAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,0BAA0B;QAAE,OAAO,IAAI,CAAA;IACjF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACpE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,EAAE,CAAA;AAC7F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAmC,iBAAiB,EAAE;IAEtD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IACrE,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;QACvD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAiC,EACjC,OAAkC;IAElC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IACvE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAA;AACrB,CAAC;AASD,SAAS,aAAa;IACpB,OAAQ,UAAsC,CAAC,MAAM,IAAI,IAAI,CAAA;AAC/D,CAAC;AASD,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACvD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,aAAgC,aAAa,EAAE;IAE/C,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,CAAA;IACjC,IAAI,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YACjF,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AACjD,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,aAAgC,aAAa,EAAE;IAClF,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACnF,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IACvE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;AACxC,CAAC;AAmBD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA8B;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,oBAAoB,CAAA;IACrF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;QACpC,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;KACzC,CAAC,CAAA;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAClG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,KAAK,CAAC,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;IACxD,OAAO,GAAG,IAAI,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;AAC9C,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,CAAC,GAAG,mEAAmE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzF,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAClC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAChC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAChB,KAAK,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjD,QAAQ,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KACrD,CAAA;AACH,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,QAAgB;IACzE,MAAM,GAAG,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAA;IACxE,CAAC;IACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7D,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAClC,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAA;IAChE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;AAC/C,CAAC;AAWD,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,MAAc;IACvD,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAA;IACjD,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QACtD,OAAO,EACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YACxE,wBAAwB,MAAM,GAAG;KACpC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,SAAuB,EACvB,GAAW,EACX,IAAiB;IAEjB,IAAI,GAAa,CAAA;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAG,GAAa,EAAE,OAAO,IAAI,eAAe,EAAE,EAAE,CAAA;IAC7G,CAAC;IACD,IAAI,IAAI,GAA4B,EAAE,CAAA;IACtC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAA4B,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAA;IACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,MAAqB;IACrD,MAAM,CAAC,GAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;IACzF,IAAI,MAAM;QAAE,CAAC,CAAC,aAAa,GAAG,UAAU,MAAM,EAAE,CAAA;IAChD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B;IAChD,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC3C,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC7C,OAAO,YAAY,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,YAAoB;IACrD,MAAM,CAAC,GAAG,GAA0D,CAAA;IACpE,OAAO;QACL,IAAI,EAAE,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY;QAC/E,OAAO,EAAE,CAAC,EAAE,OAAO,IAAI,8BAA8B;KACtD,CAAA;AACH,CAAC;AAED,MAAM,YAAY,GAAgB,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAA;AAwCvG;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAkB,EAClB,QAAuB,EACvB,OAA2B;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAA;IAClF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAEpD,IAAI,IAAI,GAA8B,QAAQ,CAAA;IAC9C,MAAM,IAAI,GAAG,CAAC,KAAkB,EAAqB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE1F,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAChD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAA;IACtG,CAAC;IAED,+EAA+E;IAC/E,IAAI,MAAM,GAAkB,IAAI,CAAA;IAChC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAA;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC5B,IAAK,OAAO,EAAE,IAA+C,EAAE,YAAY,KAAK,IAAI,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC9G,IAAI,GAAG,MAAM,CAAA;YACb,MAAM,GAAG,OAAO,CAAC,YAAY,CAAA;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAc,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW;QAChE,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC;QACvE,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IAEvF,IAAI,WAAW,IAAI,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACzE,IAAI,OAAO,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAE1C,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC7D,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,KAA4C,CAAA;QACtD,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,6EAA6E;IAC7E,kDAAkD;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAA;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,CAAA;IACvC,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1D,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC7B,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACnH,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAkB,EAClB,QAAuB,EACvB,OAA2B;IAE3B,OAAO,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAA;AAC1F,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAyB,EACzB,IAAY,EACZ,OAAe,EACf,MAAqB,EACrB,SAAuB;IAEvB,IAAI,GAA0D,CAAA;IAC9D,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAA;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,GAAG,EAAE,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAC9C,IAAI,CAAC,GAAG,EAAE,aAAa,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,uCAAuC,EAAE,EAAE,CAAA;IAChG,CAAC;IAED,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,IAAI,GAA4B,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;IAC1G,IAAI,MAAM;QAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAA;IAErC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,oCAAoC,EAAE;QAC7E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAA;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;IAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,EAAE,CAAA;AAC5F,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,MAAyB,EACzB,OAA2B,EAC3B,QAAuB,EACvB,IAAY,EACZ,OAA2B,EAC3B,MAAqB,EACrB,SAAuB;IAEvB,IAAI,IAAc,CAAA;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACtG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,CAAA;IACjF,CAAC;IAED,IAAI,GAAG,GAAG,uBAAuB,CAAC;QAChC,WAAW,EAAE,IAAI;QACjB,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,WAAW;QAC/B,IAAI;QACJ,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,MAAM,KAAK,IAAI;KACtB,CAAC,CAAA;IAEF,IAAI,MAAM,EAAE,CAAC;QACX,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACpG,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;QACpC,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;QAChD,GAAG,GAAG,WAAW,CAAA;IACnB,CAAC;IAED,IAAI,GAAyD,CAAA;IAC7D,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAA;IACtD,CAAC;IACD,IAAI,GAAG,EAAE,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAE9C,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9E,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAA;IAC/D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,yDAAyD,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAA;IACvI,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,gCAAgC,EAAE;QACzE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;QACvC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;KACjF,CAAC,CAAA;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACnC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;AACxD,CAAC"}

package/dist/oauth.d.ts

@@ -115,6 +115,12 @@ export interface OAuthReturnError {
  * in — the single worst outcome for this feature.
  */
 export declare function readOAuthError(href?: string): OAuthReturnError | null;
+/**
+ * The first OAuth failure found in a list of parameter sets (query, then
+ * fragment). Shared with `nativeOAuth.ts`, which reads the same parameters off
+ * an app's deep link — the codes are GoTrue's either way.
+ */
+export declare function oauthErrorFromParams(sources: URLSearchParams[]): OAuthReturnError | null;
 /**
  * Strip the OAuth error params from the address bar without adding a history
  * entry, so a reload (or a second attempt) doesn't resurrect a dead error.

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AA+BjD,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,UAAU,CAAC,CAAA;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAA;AAExD;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EAAiC,CAAA;AAErF,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAIlE;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAA;IACtD,oEAAoE;IACpE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAA;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,aAAa,EACvB,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAuB3B;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,aAAa,EAAE,CAAC,CAkB1B;AAID,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAkBrE;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAStC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,OAAO,CAInG;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,OAAO,CAIvG"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AA+BjD,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,UAAU,CAAC,CAAA;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAA;AAExD;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EAAiC,CAAA;AAErF,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAIlE;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAA;IACtD,oEAAoE;IACpE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAA;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,aAAa,EACvB,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAuB3B;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,aAAa,EAAE,CAAC,CAkB1B;AAID,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAIrE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAexF;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAStC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,OAAO,CAInG;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,OAAO,CAIvG"}

package/dist/oauth.js

@@ -122,7 +122,15 @@ export function readOAuthError(href) {
     if (!href && typeof window === 'undefined')
         return null;
     const url = new URL(href ?? window.location.href);
-    for (const params of [url.searchParams, new URLSearchParams(url.hash.replace(/^#/, ''))]) {
+    return oauthErrorFromParams([url.searchParams, new URLSearchParams(url.hash.replace(/^#/, ''))]);
+}
+/**
+ * The first OAuth failure found in a list of parameter sets (query, then
+ * fragment). Shared with `nativeOAuth.ts`, which reads the same parameters off
+ * an app's deep link — the codes are GoTrue's either way.
+ */
+export function oauthErrorFromParams(sources) {
+    for (const params of sources) {
         const bucket = params.get('error');
         const code = params.get('error_code');
         const description = params.get('error_description');