nuxt4, and some changes on packages

2025-08-19 21:38:30 +03:30
parent 61fee6c3da
commit 5b6f1a1cdf
900 changed files with 11139 additions and 15161 deletions
@@ -13,6 +13,7 @@ var __rest = (this && this.__rest) || function (s, e) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const fetch_1 = require("./lib/fetch");
 const helpers_1 = require("./lib/helpers");
+const types_1 = require("./lib/types");
 const errors_1 = require("./lib/errors");
 class GoTrueAdminApi {
    constructor({ url = '', headers = {}, fetch, }) {
@@ -29,7 +30,10 @@ class GoTrueAdminApi {
     * @param jwt A valid, logged-in JWT.
     * @param scope The logout sope.
     */
-    async signOut(jwt, scope = 'global') {
+    async signOut(jwt, scope = types_1.SIGN_OUT_SCOPES[0]) {
+        if (types_1.SIGN_OUT_SCOPES.indexOf(scope) < 0) {
+            throw new Error(`@supabase/auth-js: Parameter scope must be one of ${types_1.SIGN_OUT_SCOPES.join(', ')}`);
+        }
        try {
            await (0, fetch_1._request)(this.fetch, 'POST', `${this.url}/logout?scope=${scope}`, {
                headers: this.headers,
@@ -171,6 +175,7 @@ class GoTrueAdminApi {
     * This function should only be called on a server. Never expose your `service_role` key in the browser.
     */
    async getUserById(uid) {
+        (0, helpers_1.validateUUID)(uid);
        try {
            return await (0, fetch_1._request)(this.fetch, 'GET', `${this.url}/admin/users/${uid}`, {
                headers: this.headers,
@@ -192,6 +197,7 @@ class GoTrueAdminApi {
     * This function should only be called on a server. Never expose your `service_role` key in the browser.
     */
    async updateUserById(uid, attributes) {
+        (0, helpers_1.validateUUID)(uid);
        try {
            return await (0, fetch_1._request)(this.fetch, 'PUT', `${this.url}/admin/users/${uid}`, {
                body: attributes,
@@ -216,6 +222,7 @@ class GoTrueAdminApi {
     * This function should only be called on a server. Never expose your `service_role` key in the browser.
     */
    async deleteUser(id, shouldSoftDelete = false) {
+        (0, helpers_1.validateUUID)(id);
        try {
            return await (0, fetch_1._request)(this.fetch, 'DELETE', `${this.url}/admin/users/${id}`, {
                headers: this.headers,
@@ -233,6 +240,7 @@ class GoTrueAdminApi {
        }
    }
    async _listFactors(params) {
+        (0, helpers_1.validateUUID)(params.userId);
        try {
            const { data, error } = await (0, fetch_1._request)(this.fetch, 'GET', `${this.url}/admin/users/${params.userId}/factors`, {
                headers: this.headers,
@@ -250,6 +258,8 @@ class GoTrueAdminApi {
        }
    }
    async _deleteFactor(params) {
+        (0, helpers_1.validateUUID)(params.userId);
+        (0, helpers_1.validateUUID)(params.id);
        try {
            const data = await (0, fetch_1._request)(this.fetch, 'DELETE', `${this.url}/admin/users/${params.userId}/factors/${params.id}`, {
                headers: this.headers,
@@ -13,6 +13,7 @@ const polyfills_1 = require("./lib/polyfills");
 const version_1 = require("./lib/version");
 const locks_1 = require("./lib/locks");
 const base64url_1 = require("./lib/base64url");
+const helpers_2 = require("./lib/helpers");
 (0, polyfills_1.polyfillGlobalThis)(); // Make "globalThis" available
 const DEFAULT_OPTIONS = {
    url: constants_1.GOTRUE_URL,
@@ -28,12 +29,25 @@ const DEFAULT_OPTIONS = {
 async function lockNoOp(name, acquireTimeout, fn) {
    return await fn();
 }
+/**
+ * Caches JWKS values for all clients created in the same environment. This is
+ * especially useful for shared-memory execution environments such as Vercel's
+ * Fluid Compute, AWS Lambda or Supabase's Edge Functions. Regardless of how
+ * many clients are created, if they share the same storage key they will use
+ * the same JWKS cache, significantly speeding up getClaims() with asymmetric
+ * JWTs.
+ */
+const GLOBAL_JWKS = {};
 class GoTrueClient {
    /**
     * Create a new client for use in the browser.
     */
    constructor(options) {
        var _a, _b;
+        /**
+         * @experimental
+         */
+        this.userStorage = null;
        this.memoryStorage = null;
        this.stateChangeEmitters = new Map();
        this.autoRefreshTicker = null;
@@ -90,8 +104,10 @@ class GoTrueClient {
        else {
            this.lock = lockNoOp;
        }
-        this.jwks = { keys: [] };
-        this.jwks_cached_at = Number.MIN_SAFE_INTEGER;
+        if (!this.jwks) {
+            this.jwks = { keys: [] };
+            this.jwks_cached_at = Number.MIN_SAFE_INTEGER;
+        }
        this.mfa = {
            verify: this._verify.bind(this),
            enroll: this._enroll.bind(this),
@@ -107,13 +123,16 @@ class GoTrueClient {
            }
            else {
                if ((0, helpers_1.supportsLocalStorage)()) {
-                    this.storage = local_storage_1.localStorageAdapter;
+                    this.storage = globalThis.localStorage;
                }
                else {
                    this.memoryStorage = {};
                    this.storage = (0, local_storage_1.memoryLocalStorageAdapter)(this.memoryStorage);
                }
            }
+            if (settings.userStorage) {
+                this.userStorage = settings.userStorage;
+            }
        }
        else {
            this.memoryStorage = {};
@@ -133,6 +152,23 @@ class GoTrueClient {
        }
        this.initialize();
    }
+    /**
+     * The JWKS used for verifying asymmetric JWTs
+     */
+    get jwks() {
+        var _a, _b;
+        return (_b = (_a = GLOBAL_JWKS[this.storageKey]) === null || _a === void 0 ? void 0 : _a.jwks) !== null && _b !== void 0 ? _b : { keys: [] };
+    }
+    set jwks(value) {
+        GLOBAL_JWKS[this.storageKey] = Object.assign(Object.assign({}, GLOBAL_JWKS[this.storageKey]), { jwks: value });
+    }
+    get jwks_cached_at() {
+        var _a, _b;
+        return (_b = (_a = GLOBAL_JWKS[this.storageKey]) === null || _a === void 0 ? void 0 : _a.cachedAt) !== null && _b !== void 0 ? _b : Number.MIN_SAFE_INTEGER;
+    }
+    set jwks_cached_at(value) {
+        GLOBAL_JWKS[this.storageKey] = Object.assign(Object.assign({}, GLOBAL_JWKS[this.storageKey]), { cachedAt: value });
+    }
    _debug(...args) {
        if (this.logDebugMessages) {
            this.logger(`GoTrueClient@${this.instanceID} (${version_1.version}) ${new Date().toISOString()}`, ...args);
@@ -415,6 +451,157 @@ class GoTrueClient {
            return this._exchangeCodeForSession(authCode);
        });
    }
+    /**
+     * Signs in a user by verifying a message signed by the user's private key.
+     * Only Solana supported at this time, using the Sign in with Solana standard.
+     */
+    async signInWithWeb3(credentials) {
+        const { chain } = credentials;
+        if (chain === 'solana') {
+            return await this.signInWithSolana(credentials);
+        }
+        throw new Error(`@supabase/auth-js: Unsupported chain "${chain}"`);
+    }
+    async signInWithSolana(credentials) {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
+        let message;
+        let signature;
+        if ('message' in credentials) {
+            message = credentials.message;
+            signature = credentials.signature;
+        }
+        else {
+            const { chain, wallet, statement, options } = credentials;
+            let resolvedWallet;
+            if (!(0, helpers_1.isBrowser)()) {
+                if (typeof wallet !== 'object' || !(options === null || options === void 0 ? void 0 : options.url)) {
+                    throw new Error('@supabase/auth-js: Both wallet and url must be specified in non-browser environments.');
+                }
+                resolvedWallet = wallet;
+            }
+            else if (typeof wallet === 'object') {
+                resolvedWallet = wallet;
+            }
+            else {
+                const windowAny = window;
+                if ('solana' in windowAny &&
+                    typeof windowAny.solana === 'object' &&
+                    (('signIn' in windowAny.solana && typeof windowAny.solana.signIn === 'function') ||
+                        ('signMessage' in windowAny.solana &&
+                            typeof windowAny.solana.signMessage === 'function'))) {
+                    resolvedWallet = windowAny.solana;
+                }
+                else {
+                    throw new Error(`@supabase/auth-js: No compatible Solana wallet interface on the window object (window.solana) detected. Make sure the user already has a wallet installed and connected for this app. Prefer passing the wallet interface object directly to signInWithWeb3({ chain: 'solana', wallet: resolvedUserWallet }) instead.`);
+                }
+            }
+            const url = new URL((_a = options === null || options === void 0 ? void 0 : options.url) !== null && _a !== void 0 ? _a : window.location.href);
+            if ('signIn' in resolvedWallet && resolvedWallet.signIn) {
+                const output = await resolvedWallet.signIn(Object.assign(Object.assign(Object.assign({ issuedAt: new Date().toISOString() }, options === null || options === void 0 ? void 0 : options.signInWithSolana), { 
+                    // non-overridable properties
+                    version: '1', domain: url.host, uri: url.href }), (statement ? { statement } : null)));
+                let outputToProcess;
+                if (Array.isArray(output) && output[0] && typeof output[0] === 'object') {
+                    outputToProcess = output[0];
+                }
+                else if (output &&
+                    typeof output === 'object' &&
+                    'signedMessage' in output &&
+                    'signature' in output) {
+                    outputToProcess = output;
+                }
+                else {
+                    throw new Error('@supabase/auth-js: Wallet method signIn() returned unrecognized value');
+                }
+                if ('signedMessage' in outputToProcess &&
+                    'signature' in outputToProcess &&
+                    (typeof outputToProcess.signedMessage === 'string' ||
+                        outputToProcess.signedMessage instanceof Uint8Array) &&
+                    outputToProcess.signature instanceof Uint8Array) {
+                    message =
+                        typeof outputToProcess.signedMessage === 'string'
+                            ? outputToProcess.signedMessage
+                            : new TextDecoder().decode(outputToProcess.signedMessage);
+                    signature = outputToProcess.signature;
+                }
+                else {
+                    throw new Error('@supabase/auth-js: Wallet method signIn() API returned object without signedMessage and signature fields');
+                }
+            }
+            else {
+                if (!('signMessage' in resolvedWallet) ||
+                    typeof resolvedWallet.signMessage !== 'function' ||
+                    !('publicKey' in resolvedWallet) ||
+                    typeof resolvedWallet !== 'object' ||
+                    !resolvedWallet.publicKey ||
+                    !('toBase58' in resolvedWallet.publicKey) ||
+                    typeof resolvedWallet.publicKey.toBase58 !== 'function') {
+                    throw new Error('@supabase/auth-js: Wallet does not have a compatible signMessage() and publicKey.toBase58() API');
+                }
+                message = [
+                    `${url.host} wants you to sign in with your Solana account:`,
+                    resolvedWallet.publicKey.toBase58(),
+                    ...(statement ? ['', statement, ''] : ['']),
+                    'Version: 1',
+                    `URI: ${url.href}`,
+                    `Issued At: ${(_c = (_b = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _b === void 0 ? void 0 : _b.issuedAt) !== null && _c !== void 0 ? _c : new Date().toISOString()}`,
+                    ...(((_d = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _d === void 0 ? void 0 : _d.notBefore)
+                        ? [`Not Before: ${options.signInWithSolana.notBefore}`]
+                        : []),
+                    ...(((_e = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _e === void 0 ? void 0 : _e.expirationTime)
+                        ? [`Expiration Time: ${options.signInWithSolana.expirationTime}`]
+                        : []),
+                    ...(((_f = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _f === void 0 ? void 0 : _f.chainId)
+                        ? [`Chain ID: ${options.signInWithSolana.chainId}`]
+                        : []),
+                    ...(((_g = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _g === void 0 ? void 0 : _g.nonce) ? [`Nonce: ${options.signInWithSolana.nonce}`] : []),
+                    ...(((_h = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _h === void 0 ? void 0 : _h.requestId)
+                        ? [`Request ID: ${options.signInWithSolana.requestId}`]
+                        : []),
+                    ...(((_k = (_j = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _j === void 0 ? void 0 : _j.resources) === null || _k === void 0 ? void 0 : _k.length)
+                        ? [
+                            'Resources',
+                            ...options.signInWithSolana.resources.map((resource) => `- ${resource}`),
+                        ]
+                        : []),
+                ].join('\n');
+                const maybeSignature = await resolvedWallet.signMessage(new TextEncoder().encode(message), 'utf8');
+                if (!maybeSignature || !(maybeSignature instanceof Uint8Array)) {
+                    throw new Error('@supabase/auth-js: Wallet signMessage() API returned an recognized value');
+                }
+                signature = maybeSignature;
+            }
+        }
+        try {
+            const { data, error } = await (0, fetch_1._request)(this.fetch, 'POST', `${this.url}/token?grant_type=web3`, {
+                headers: this.headers,
+                body: Object.assign({ chain: 'solana', message, signature: (0, base64url_1.bytesToBase64URL)(signature) }, (((_l = credentials.options) === null || _l === void 0 ? void 0 : _l.captchaToken)
+                    ? { gotrue_meta_security: { captcha_token: (_m = credentials.options) === null || _m === void 0 ? void 0 : _m.captchaToken } }
+                    : null)),
+                xform: fetch_1._sessionResponse,
+            });
+            if (error) {
+                throw error;
+            }
+            if (!data || !data.session || !data.user) {
+                return {
+                    data: { user: null, session: null },
+                    error: new errors_1.AuthInvalidTokenResponseError(),
+                };
+            }
+            if (data.session) {
+                await this._saveSession(data.session);
+                await this._notifyAllSubscribers('SIGNED_IN', data.session);
+            }
+            return { data: Object.assign({}, data), error };
+        }
+        catch (error) {
+            if ((0, errors_1.isAuthError)(error)) {
+                return { data: { user: null, session: null }, error };
+            }
+            throw error;
+        }
+    }
    async _exchangeCodeForSession(authCode) {
        const storageItem = await (0, helpers_1.getItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
        const [codeVerifier, redirectType] = (storageItem !== null && storageItem !== void 0 ? storageItem : '').split('/');
@@ -834,7 +1021,16 @@ class GoTrueClient {
                : false;
            this._debug('#__loadSession()', `session has${hasExpired ? '' : ' not'} expired`, 'expires_at', currentSession.expires_at);
            if (!hasExpired) {
-                if (this.storage.isServer) {
+                if (this.userStorage) {
+                    const maybeUser = (await (0, helpers_1.getItemAsync)(this.userStorage, this.storageKey + '-user'));
+                    if (maybeUser === null || maybeUser === void 0 ? void 0 : maybeUser.user) {
+                        currentSession.user = maybeUser.user;
+                    }
+                    else {
+                        currentSession.user = (0, helpers_1.userNotAvailableProxy)();
+                    }
+                }
+                if (this.storage.isServer && currentSession.user) {
                    let suppressWarning = this.suppressGetSessionWarning;
                    const proxySession = new Proxy(currentSession, {
                        get: (target, prop, receiver) => {
@@ -1430,11 +1626,39 @@ class GoTrueClient {
     * Note: this method is async to accommodate for AsyncStorage e.g. in React native.
     */
    async _recoverAndRefresh() {
-        var _a;
+        var _a, _b;
        const debugName = '#_recoverAndRefresh()';
        this._debug(debugName, 'begin');
        try {
-            const currentSession = await (0, helpers_1.getItemAsync)(this.storage, this.storageKey);
+            const currentSession = (await (0, helpers_1.getItemAsync)(this.storage, this.storageKey));
+            if (currentSession && this.userStorage) {
+                let maybeUser = (await (0, helpers_1.getItemAsync)(this.userStorage, this.storageKey + '-user'));
+                if (!this.storage.isServer && Object.is(this.storage, this.userStorage) && !maybeUser) {
+                    // storage and userStorage are the same storage medium, for example
+                    // window.localStorage if userStorage does not have the user from
+                    // storage stored, store it first thereby migrating the user object
+                    // from storage -> userStorage
+                    maybeUser = { user: currentSession.user };
+                    await (0, helpers_1.setItemAsync)(this.userStorage, this.storageKey + '-user', maybeUser);
+                }
+                currentSession.user = (_a = maybeUser === null || maybeUser === void 0 ? void 0 : maybeUser.user) !== null && _a !== void 0 ? _a : (0, helpers_1.userNotAvailableProxy)();
+            }
+            else if (currentSession && !currentSession.user) {
+                // user storage is not set, let's check if it was previously enabled so
+                // we bring back the storage as it should be
+                if (!currentSession.user) {
+                    // test if userStorage was previously enabled and the storage medium was the same, to move the user back under the same key
+                    const separateUser = (await (0, helpers_1.getItemAsync)(this.storage, this.storageKey + '-user'));
+                    if (separateUser && (separateUser === null || separateUser === void 0 ? void 0 : separateUser.user)) {
+                        currentSession.user = separateUser.user;
+                        await (0, helpers_1.removeItemAsync)(this.storage, this.storageKey + '-user');
+                        await (0, helpers_1.setItemAsync)(this.storage, this.storageKey, currentSession);
+                    }
+                    else {
+                        currentSession.user = (0, helpers_1.userNotAvailableProxy)();
+                    }
+                }
+            }
            this._debug(debugName, 'session from storage', currentSession);
            if (!this._isValidSession(currentSession)) {
                this._debug(debugName, 'session is not valid');
@@ -1443,7 +1667,7 @@ class GoTrueClient {
                }
                return;
            }
-            const expiresWithMargin = ((_a = currentSession.expires_at) !== null && _a !== void 0 ? _a : Infinity) * 1000 - Date.now() < constants_1.EXPIRY_MARGIN_MS;
+            const expiresWithMargin = ((_b = currentSession.expires_at) !== null && _b !== void 0 ? _b : Infinity) * 1000 - Date.now() < constants_1.EXPIRY_MARGIN_MS;
            this._debug(debugName, `session has${expiresWithMargin ? '' : ' not'} expired with margin of ${constants_1.EXPIRY_MARGIN_MS}s`);
            if (expiresWithMargin) {
                if (this.autoRefreshToken && currentSession.refresh_token) {
@@ -1457,6 +1681,25 @@ class GoTrueClient {
                    }
                }
            }
+            else if (currentSession.user &&
+                currentSession.user.__isUserNotAvailableProxy === true) {
+                // If we have a proxy user, try to get the real user data
+                try {
+                    const { data, error: userError } = await this._getUser(currentSession.access_token);
+                    if (!userError && (data === null || data === void 0 ? void 0 : data.user)) {
+                        currentSession.user = data.user;
+                        await this._saveSession(currentSession);
+                        await this._notifyAllSubscribers('SIGNED_IN', currentSession);
+                    }
+                    else {
+                        this._debug(debugName, 'could not get user data, skipping SIGNED_IN notification');
+                    }
+                }
+                catch (getUserError) {
+                    console.error('Error getting user data:', getUserError);
+                    this._debug(debugName, 'error getting user data, skipping SIGNED_IN notification', getUserError);
+                }
+            }
            else {
                // no need to persist currentSession again, as we just loaded it from
                // local storage; persisting it again may overwrite a value saved by
@@ -1552,11 +1795,45 @@ class GoTrueClient {
        // _saveSession is always called whenever a new session has been acquired
        // so we can safely suppress the warning returned by future getSession calls
        this.suppressGetSessionWarning = true;
-        await (0, helpers_1.setItemAsync)(this.storage, this.storageKey, session);
+        // Create a shallow copy to work with, to avoid mutating the original session object if it's used elsewhere
+        const sessionToProcess = Object.assign({}, session);
+        const userIsProxy = sessionToProcess.user && sessionToProcess.user.__isUserNotAvailableProxy === true;
+        if (this.userStorage) {
+            if (!userIsProxy && sessionToProcess.user) {
+                // If it's a real user object, save it to userStorage.
+                await (0, helpers_1.setItemAsync)(this.userStorage, this.storageKey + '-user', {
+                    user: sessionToProcess.user,
+                });
+            }
+            else if (userIsProxy) {
+                // If it's the proxy, it means user was not found in userStorage.
+                // We should ensure no stale user data for this key exists in userStorage if we were to save null,
+                // or simply not save the proxy. For now, we don't save the proxy here.
+                // If there's a need to clear userStorage if user becomes proxy, that logic would go here.
+            }
+            // Prepare the main session data for primary storage: remove the user property before cloning
+            // This is important because the original session.user might be the proxy
+            const mainSessionData = Object.assign({}, sessionToProcess);
+            delete mainSessionData.user; // Remove user (real or proxy) before cloning for main storage
+            const clonedMainSessionData = (0, helpers_2.deepClone)(mainSessionData);
+            await (0, helpers_1.setItemAsync)(this.storage, this.storageKey, clonedMainSessionData);
+        }
+        else {
+            // No userStorage is configured.
+            // In this case, session.user should ideally not be a proxy.
+            // If it were, structuredClone would fail. This implies an issue elsewhere if user is a proxy here
+            const clonedSession = (0, helpers_2.deepClone)(sessionToProcess); // sessionToProcess still has its original user property
+            await (0, helpers_1.setItemAsync)(this.storage, this.storageKey, clonedSession);
+        }
    }
    async _removeSession() {
        this._debug('#_removeSession()');
        await (0, helpers_1.removeItemAsync)(this.storage, this.storageKey);
+        await (0, helpers_1.removeItemAsync)(this.storage, this.storageKey + '-code-verifier');
+        await (0, helpers_1.removeItemAsync)(this.storage, this.storageKey + '-user');
+        if (this.userStorage) {
+            await (0, helpers_1.removeItemAsync)(this.userStorage, this.storageKey + '-user');
+        }
        await this._notifyAllSubscribers('SIGNED_OUT', null);
    }
    /**
@@ -1982,10 +2259,11 @@ class GoTrueClient {
        if (jwk) {
            return jwk;
        }
+        const now = Date.now();
        // try fetching from cache
        jwk = this.jwks.keys.find((key) => key.kid === kid);
        // jwk exists and jwks isn't stale
-        if (jwk && this.jwks_cached_at + constants_1.JWKS_TTL > Date.now()) {
+        if (jwk && this.jwks_cached_at + constants_1.JWKS_TTL > now) {
            return jwk;
        }
        // jwk isn't cached in memory so we need to fetch it from the well-known endpoint
@@ -1996,22 +2274,34 @@ class GoTrueClient {
            throw error;
        }
        if (!data.keys || data.keys.length === 0) {
-            throw new errors_1.AuthInvalidJwtError('JWKS is empty');
+            return null;
        }
        this.jwks = data;
-        this.jwks_cached_at = Date.now();
+        this.jwks_cached_at = now;
        // Find the signing key
        jwk = data.keys.find((key) => key.kid === kid);
        if (!jwk) {
-            throw new errors_1.AuthInvalidJwtError('No matching signing key found in JWKS');
+            return null;
        }
        return jwk;
    }
    /**
-     * @experimental This method may change in future versions.
-     * @description Gets the claims from a JWT. If the JWT is symmetric JWTs, it will call getUser() to verify against the server. If the JWT is asymmetric, it will be verified against the JWKS using the WebCrypto API.
+     * Extracts the JWT claims present in the access token by first verifying the
+     * JWT against the server's JSON Web Key Set endpoint
+     * `/.well-known/jwks.json` which is often cached, resulting in significantly
+     * faster responses. Prefer this method over {@link #getUser} which always
+     * sends a request to the Auth server for each JWT.
+     *
+     * If the project is not using an asymmetric JWT signing key (like ECC or
+     * RSA) it always sends a request to the Auth server (similar to {@link
+     * #getUser}) to verify the JWT.
+     *
+     * @param jwt An optional specific JWT you wish to verify, not the one you
+     *            can obtain from {@link #getSession}.
+     * @param options Various additional options that allow you to customize the
+     *                behavior of this method.
     */
-    async getClaims(jwt, jwks = { keys: [] }) {
+    async getClaims(jwt, options = {}) {
        try {
            let token = jwt;
            if (!token) {
@@ -2022,12 +2312,18 @@ class GoTrueClient {
                token = data.session.access_token;
            }
            const { header, payload, signature, raw: { header: rawHeader, payload: rawPayload }, } = (0, helpers_1.decodeJWT)(token);
-            // Reject expired JWTs
-            (0, helpers_1.validateExp)(payload.exp);
+            if (!(options === null || options === void 0 ? void 0 : options.allowExpired)) {
+                // Reject expired JWTs should only happen if jwt argument was passed
+                (0, helpers_1.validateExp)(payload.exp);
+            }
+            const signingKey = !header.alg ||
+                header.alg.startsWith('HS') ||
+                !header.kid ||
+                !('crypto' in globalThis && 'subtle' in globalThis.crypto)
+                ? null
+                : await this.fetchJwk(header.kid, (options === null || options === void 0 ? void 0 : options.keys) ? { keys: options.keys } : options === null || options === void 0 ? void 0 : options.jwks);
            // If symmetric algorithm or WebCrypto API is unavailable, fallback to getUser()
-            if (!header.kid ||
-                header.alg === 'HS256' ||
-                !('crypto' in globalThis && 'subtle' in globalThis.crypto)) {
+            if (!signingKey) {
                const { error } = await this.getUser(token);
                if (error) {
                    throw error;
@@ -2043,7 +2339,6 @@ class GoTrueClient {
                };
            }
            const algorithm = (0, helpers_1.getAlgorithm)(header.alg);
-            const signingKey = await this.fetchJwk(header.kid, jwks);
            // Convert JWK to CryptoKey
            const publicKey = await crypto.subtle.importKey('jwk', signingKey, algorithm, true, [
                'verify',
@@ -17,7 +17,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.lockInternals = exports.NavigatorLockAcquireTimeoutError = exports.navigatorLock = exports.AuthClient = exports.AuthAdminApi = exports.GoTrueClient = exports.GoTrueAdminApi = void 0;
+exports.processLock = exports.lockInternals = exports.NavigatorLockAcquireTimeoutError = exports.navigatorLock = exports.AuthClient = exports.AuthAdminApi = exports.GoTrueClient = exports.GoTrueAdminApi = void 0;
 const GoTrueAdminApi_1 = __importDefault(require("./GoTrueAdminApi"));
 exports.GoTrueAdminApi = GoTrueAdminApi_1.default;
 const GoTrueClient_1 = __importDefault(require("./GoTrueClient"));
@@ -32,4 +32,5 @@ var locks_1 = require("./lib/locks");
 Object.defineProperty(exports, "navigatorLock", { enumerable: true, get: function () { return locks_1.navigatorLock; } });
 Object.defineProperty(exports, "NavigatorLockAcquireTimeoutError", { enumerable: true, get: function () { return locks_1.NavigatorLockAcquireTimeoutError; } });
 Object.defineProperty(exports, "lockInternals", { enumerable: true, get: function () { return locks_1.internals; } });
+Object.defineProperty(exports, "processLock", { enumerable: true, get: function () { return locks_1.processLock; } });
 //# sourceMappingURL=index.js.map
@@ -5,7 +5,7 @@
 * that repo!
 */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.stringToUint8Array = exports.base64UrlToUint8Array = exports.stringFromUTF8 = exports.stringToUTF8 = exports.codepointToUTF8 = exports.stringFromBase64URL = exports.stringToBase64URL = exports.byteFromBase64URL = exports.byteToBase64URL = void 0;
+exports.bytesToBase64URL = exports.stringToUint8Array = exports.base64UrlToUint8Array = exports.stringFromUTF8 = exports.stringToUTF8 = exports.codepointToUTF8 = exports.stringFromBase64URL = exports.stringToBase64URL = exports.byteFromBase64URL = exports.byteToBase64URL = void 0;
 /**
 * An array of characters that encode 6 bits into a Base64-URL alphabet
 * character.
@@ -255,4 +255,16 @@ function stringToUint8Array(str) {
    return new Uint8Array(result);
 }
 exports.stringToUint8Array = stringToUint8Array;
+function bytesToBase64URL(bytes) {
+    const result = [];
+    const state = { queue: 0, queuedBits: 0 };
+    const onChar = (char) => {
+        result.push(char);
+    };
+    bytes.forEach((byte) => byteToBase64URL(byte, state, onChar));
+    // always call with `null` after processing all bytes
+    byteToBase64URL(null, state, onChar);
+    return result.join('');
+}
+exports.bytesToBase64URL = bytesToBase64URL;
 //# sourceMappingURL=base64url.js.map
@@ -27,5 +27,5 @@ exports.API_VERSIONS = {
    },
 };
 exports.BASE64URL_REGEX = /^([a-z0-9_-]{4})*($|[a-z0-9_-]{3}$|[a-z0-9_-]{2}$)$/i;
-exports.JWKS_TTL = 600000; // 10 minutes
+exports.JWKS_TTL = 10 * 60 * 1000; // 10 minutes
 //# sourceMappingURL=constants.js.map
@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
    return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getAlgorithm = exports.validateExp = exports.parseResponseAPIVersion = exports.getCodeChallengeAndMethod = exports.generatePKCEChallenge = exports.generatePKCEVerifier = exports.retryable = exports.sleep = exports.decodeJWT = exports.Deferred = exports.removeItemAsync = exports.getItemAsync = exports.setItemAsync = exports.looksLikeFetchResponse = exports.resolveFetch = exports.parseParametersFromURL = exports.supportsLocalStorage = exports.isBrowser = exports.uuid = exports.expiresAt = void 0;
+exports.deepClone = exports.userNotAvailableProxy = exports.validateUUID = exports.getAlgorithm = exports.validateExp = exports.parseResponseAPIVersion = exports.getCodeChallengeAndMethod = exports.generatePKCEChallenge = exports.generatePKCEVerifier = exports.retryable = exports.sleep = exports.decodeJWT = exports.Deferred = exports.removeItemAsync = exports.getItemAsync = exports.setItemAsync = exports.looksLikeFetchResponse = exports.resolveFetch = exports.parseParametersFromURL = exports.supportsLocalStorage = exports.isBrowser = exports.uuid = exports.expiresAt = void 0;
 const constants_1 = require("./constants");
 const errors_1 = require("./errors");
 const base64url_1 = require("./base64url");
@@ -331,4 +331,48 @@ function getAlgorithm(alg) {
    }
 }
 exports.getAlgorithm = getAlgorithm;
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function validateUUID(str) {
+    if (!UUID_REGEX.test(str)) {
+        throw new Error('@supabase/auth-js: Expected parameter to be UUID but is not');
+    }
+}
+exports.validateUUID = validateUUID;
+function userNotAvailableProxy() {
+    const proxyTarget = {};
+    return new Proxy(proxyTarget, {
+        get: (target, prop) => {
+            if (prop === '__isUserNotAvailableProxy') {
+                return true;
+            }
+            // Preventative check for common problematic symbols during cloning/inspection
+            // These symbols might be accessed by structuredClone or other internal mechanisms.
+            if (typeof prop === 'symbol') {
+                const sProp = prop.toString();
+                if (sProp === 'Symbol(Symbol.toPrimitive)' ||
+                    sProp === 'Symbol(Symbol.toStringTag)' ||
+                    sProp === 'Symbol(util.inspect.custom)') {
+                    // Node.js util.inspect
+                    return undefined;
+                }
+            }
+            throw new Error(`@supabase/auth-js: client was created with userStorage option and there was no user stored in the user storage. Accessing the "${prop}" property of the session object is not supported. Please use getUser() instead.`);
+        },
+        set: (_target, prop) => {
+            throw new Error(`@supabase/auth-js: client was created with userStorage option and there was no user stored in the user storage. Setting the "${prop}" property of the session object is not supported. Please use getUser() to fetch a user object you can manipulate.`);
+        },
+        deleteProperty: (_target, prop) => {
+            throw new Error(`@supabase/auth-js: client was created with userStorage option and there was no user stored in the user storage. Deleting the "${prop}" property of the session object is not supported. Please use getUser() to fetch a user object you can manipulate.`);
+        },
+    });
+}
+exports.userNotAvailableProxy = userNotAvailableProxy;
+/**
+ * Deep clones a JSON-serializable object using JSON.parse(JSON.stringify(obj)).
+ * Note: Only works for JSON-safe data.
+ */
+function deepClone(obj) {
+    return JSON.parse(JSON.stringify(obj));
+}
+exports.deepClone = deepClone;
 //# sourceMappingURL=helpers.js.map
@@ -1,30 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.memoryLocalStorageAdapter = exports.localStorageAdapter = void 0;
-const helpers_1 = require("./helpers");
-/**
- * Provides safe access to the globalThis.localStorage property.
- */
-exports.localStorageAdapter = {
-    getItem: (key) => {
-        if (!(0, helpers_1.supportsLocalStorage)()) {
-            return null;
-        }
-        return globalThis.localStorage.getItem(key);
-    },
-    setItem: (key, value) => {
-        if (!(0, helpers_1.supportsLocalStorage)()) {
-            return;
-        }
-        globalThis.localStorage.setItem(key, value);
-    },
-    removeItem: (key) => {
-        if (!(0, helpers_1.supportsLocalStorage)()) {
-            return;
-        }
-        globalThis.localStorage.removeItem(key);
-    },
-};
+exports.memoryLocalStorageAdapter = void 0;
 /**
 * Returns a localStorage-like object that stores the key-value pairs in
 * memory.
@@ -1,3 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIGN_OUT_SCOPES = void 0;
+exports.SIGN_OUT_SCOPES = ['global', 'local', 'others'];
 //# sourceMappingURL=types.js.map
@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.version = void 0;
-exports.version = '2.69.1';
+exports.version = '2.71.1';
 //# sourceMappingURL=version.js.map