@absolutejs/auth 0.56.18 → 0.57.0

package/dist/client/vue.js.map

@@ -1,26 +1,11 @@
 {
   "version": 3,
-  "sources": ["../node_modules/@simplewebauthn/browser/esm/helpers/bufferToBase64URLString.js", "../node_modules/@simplewebauthn/browser/esm/helpers/base64URLStringToBuffer.js", "../node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthn.js", "../node_modules/@simplewebauthn/browser/esm/helpers/toPublicKeyCredentialDescriptor.js", "../node_modules/@simplewebauthn/browser/esm/helpers/isValidDomain.js", "../node_modules/@simplewebauthn/browser/esm/helpers/webAuthnError.js", "../node_modules/@simplewebauthn/browser/esm/helpers/identifyRegistrationError.js", "../node_modules/@simplewebauthn/browser/esm/helpers/webAuthnAbortService.js", "../node_modules/@simplewebauthn/browser/esm/helpers/toAuthenticatorAttachment.js", "../node_modules/@simplewebauthn/browser/esm/methods/startRegistration.js", "../node_modules/@simplewebauthn/browser/esm/helpers/browserSupportsWebAuthnAutofill.js", "../node_modules/@simplewebauthn/browser/esm/helpers/identifyAuthenticationError.js", "../node_modules/@simplewebauthn/browser/esm/methods/startAuthentication.js", "../node_modules/@simplewebauthn/browser/esm/helpers/platformAuthenticatorIsAvailable.js", "../node_modules/@simplewebauthn/browser/esm/index.js", "../src/client/vue.ts", "../src/client/passkeyHelpers.ts"],
+  "sources": ["../src/client/vue.ts", "../src/client/passkeyHelpers.ts"],
   "sourcesContent": [
-    "/**\n * Convert the given array buffer into a Base64URL-encoded string. Ideal for converting various\n * credential response ArrayBuffers to string for sending back to the server as JSON.\n *\n * Helper method to compliment `base64URLStringToBuffer`\n */\nexport function bufferToBase64URLString(buffer) {\n    const bytes = new Uint8Array(buffer);\n    let str = '';\n    for (const charCode of bytes) {\n        str += String.fromCharCode(charCode);\n    }\n    const base64String = btoa(str);\n    return base64String.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n",
-    "/**\n * Convert from a Base64URL-encoded string to an Array Buffer. Best used when converting a\n * credential ID from a JSON string to an ArrayBuffer, like in allowCredentials or\n * excludeCredentials\n *\n * Helper method to compliment `bufferToBase64URLString`\n */\nexport function base64URLStringToBuffer(base64URLString) {\n    // Convert from Base64URL to Base64\n    const base64 = base64URLString.replace(/-/g, '+').replace(/_/g, '/');\n    /**\n     * Pad with '=' until it's a multiple of four\n     * (4 - (85 % 4 = 1) = 3) % 4 = 3 padding\n     * (4 - (86 % 4 = 2) = 2) % 4 = 2 padding\n     * (4 - (87 % 4 = 3) = 1) % 4 = 1 padding\n     * (4 - (88 % 4 = 0) = 4) % 4 = 0 padding\n     */\n    const padLength = (4 - (base64.length % 4)) % 4;\n    const padded = base64.padEnd(base64.length + padLength, '=');\n    // Convert to a binary string\n    const binary = atob(padded);\n    // Convert binary string to buffer\n    const buffer = new ArrayBuffer(binary.length);\n    const bytes = new Uint8Array(buffer);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return buffer;\n}\n",
-    "/**\n * Determine if the browser is capable of Webauthn\n */\nexport function browserSupportsWebAuthn() {\n    return _browserSupportsWebAuthnInternals.stubThis(globalThis?.PublicKeyCredential !== undefined &&\n        typeof globalThis.PublicKeyCredential === 'function');\n}\n/**\n * Make it possible to stub the return value during testing\n * @ignore Don't include this in docs output\n */\nexport const _browserSupportsWebAuthnInternals = {\n    stubThis: (value) => value,\n};\n",
-    "import { base64URLStringToBuffer } from './base64URLStringToBuffer.js';\nexport function toPublicKeyCredentialDescriptor(descriptor) {\n    const { id } = descriptor;\n    return {\n        ...descriptor,\n        id: base64URLStringToBuffer(id),\n        /**\n         * `descriptor.transports` is an array of our `AuthenticatorTransportFuture` that includes newer\n         * transports that TypeScript's DOM lib is ignorant of. Convince TS that our list of transports\n         * are fine to pass to WebAuthn since browsers will recognize the new value.\n         */\n        transports: descriptor.transports,\n    };\n}\n",
-    "/**\n * A simple test to determine if a hostname is a properly-formatted domain name\n *\n * A \"valid domain\" is defined here: https://url.spec.whatwg.org/#valid-domain\n *\n * Regex was originally sourced from here, then remixed to add punycode support:\n * https://www.oreilly.com/library/view/regular-expressions-cookbook/9781449327453/ch08s15.html\n */\nexport function isValidDomain(hostname) {\n    return (\n    // Consider localhost valid as well since it's okay wrt Secure Contexts\n    hostname === 'localhost' ||\n        // Support punycode (ACE) or ascii labels and domains\n        /^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(hostname));\n}\n",
-    "/**\n * A custom Error used to return a more nuanced error detailing _why_ one of the eight documented\n * errors in the spec was raised after calling `navigator.credentials.create()` or\n * `navigator.credentials.get()`:\n *\n * - `AbortError`\n * - `ConstraintError`\n * - `InvalidStateError`\n * - `NotAllowedError`\n * - `NotSupportedError`\n * - `SecurityError`\n * - `TypeError`\n * - `UnknownError`\n *\n * Error messages were determined through investigation of the spec to determine under which\n * scenarios a given error would be raised.\n */\nexport class WebAuthnError extends Error {\n    constructor({ message, code, cause, name, }) {\n        // @ts-ignore: help Rollup understand that `cause` is okay to set\n        super(message, { cause });\n        Object.defineProperty(this, \"code\", {\n            enumerable: true,\n            configurable: true,\n            writable: true,\n            value: void 0\n        });\n        this.name = name ?? cause.name;\n        this.code = code;\n    }\n}\n",
-    "import { isValidDomain } from './isValidDomain.js';\nimport { WebAuthnError } from './webAuthnError.js';\n/**\n * Attempt to intuit _why_ an error was raised after calling `navigator.credentials.create()`\n */\nexport function identifyRegistrationError({ error, options, }) {\n    const { publicKey } = options;\n    if (!publicKey) {\n        throw Error('options was missing required publicKey property');\n    }\n    if (error.name === 'AbortError') {\n        if (options.signal instanceof AbortSignal) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 16)\n            return new WebAuthnError({\n                message: 'Registration ceremony was sent an abort signal',\n                code: 'ERROR_CEREMONY_ABORTED',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'ConstraintError') {\n        if (publicKey.authenticatorSelection?.requireResidentKey === true) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 4)\n            return new WebAuthnError({\n                message: 'Discoverable credentials were required but no available authenticator supported it',\n                code: 'ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT',\n                cause: error,\n            });\n        }\n        else if (\n        // @ts-ignore: `mediation` doesn't yet exist on CredentialCreationOptions but it's possible as of Sept 2024\n        options.mediation === 'conditional' &&\n            publicKey.authenticatorSelection?.userVerification === 'required') {\n            // https://w3c.github.io/webauthn/#sctn-createCredential (Step 22.4)\n            return new WebAuthnError({\n                message: 'User verification was required during automatic registration but it could not be performed',\n                code: 'ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE',\n                cause: error,\n            });\n        }\n        else if (publicKey.authenticatorSelection?.userVerification === 'required') {\n            // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 5)\n            return new WebAuthnError({\n                message: 'User verification was required but no available authenticator supported it',\n                code: 'ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'InvalidStateError') {\n        // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 20)\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 3)\n        return new WebAuthnError({\n            message: 'The authenticator was previously registered',\n            code: 'ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED',\n            cause: error,\n        });\n    }\n    else if (error.name === 'NotAllowedError') {\n        /**\n         * Pass the error directly through. Platforms are overloading this error beyond what the spec\n         * defines and we don't want to overwrite potentially useful error messages.\n         */\n        return new WebAuthnError({\n            message: error.message,\n            code: 'ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY',\n            cause: error,\n        });\n    }\n    else if (error.name === 'NotSupportedError') {\n        const validPubKeyCredParams = publicKey.pubKeyCredParams.filter((param) => param.type === 'public-key');\n        if (validPubKeyCredParams.length === 0) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 10)\n            return new WebAuthnError({\n                message: 'No entry in pubKeyCredParams was of type \"public-key\"',\n                code: 'ERROR_MALFORMED_PUBKEYCREDPARAMS',\n                cause: error,\n            });\n        }\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 2)\n        return new WebAuthnError({\n            message: 'No available authenticator supported any of the specified pubKeyCredParams algorithms',\n            code: 'ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG',\n            cause: error,\n        });\n    }\n    else if (error.name === 'SecurityError') {\n        const effectiveDomain = globalThis.location.hostname;\n        if (!isValidDomain(effectiveDomain)) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 7)\n            return new WebAuthnError({\n                message: `${globalThis.location.hostname} is an invalid domain`,\n                code: 'ERROR_INVALID_DOMAIN',\n                cause: error,\n            });\n        }\n        else if (publicKey.rp.id !== effectiveDomain) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 8)\n            return new WebAuthnError({\n                message: `The RP ID \"${publicKey.rp.id}\" is invalid for this domain`,\n                code: 'ERROR_INVALID_RP_ID',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'TypeError') {\n        if (publicKey.user.id.byteLength < 1 || publicKey.user.id.byteLength > 64) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 5)\n            return new WebAuthnError({\n                message: 'User ID was not between 1 and 64 characters',\n                code: 'ERROR_INVALID_USER_ID_LENGTH',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'UnknownError') {\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 1)\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-make-cred (Step 8)\n        return new WebAuthnError({\n            message: 'The authenticator was unable to process the specified options, or could not create a new credential',\n            code: 'ERROR_AUTHENTICATOR_GENERAL_ERROR',\n            cause: error,\n        });\n    }\n    return error;\n}\n",
-    "class BaseWebAuthnAbortService {\n    constructor() {\n        Object.defineProperty(this, \"controller\", {\n            enumerable: true,\n            configurable: true,\n            writable: true,\n            value: void 0\n        });\n    }\n    createNewAbortSignal() {\n        // Abort any existing calls to navigator.credentials.create() or navigator.credentials.get()\n        if (this.controller) {\n            const abortError = new Error('Cancelling existing WebAuthn API call for new one');\n            abortError.name = 'AbortError';\n            this.controller.abort(abortError);\n        }\n        const newController = new AbortController();\n        this.controller = newController;\n        return newController.signal;\n    }\n    cancelCeremony() {\n        if (this.controller) {\n            const abortError = new Error('Manually cancelling existing WebAuthn API call');\n            abortError.name = 'AbortError';\n            this.controller.abort(abortError);\n            this.controller = undefined;\n        }\n    }\n}\n/**\n * A service singleton to help ensure that only a single WebAuthn ceremony is active at a time.\n *\n * Users of **@simplewebauthn/browser** shouldn't typically need to use this, but it can help e.g.\n * developers building projects that use client-side routing to better control the behavior of\n * their UX in response to router navigation events.\n */\nexport const WebAuthnAbortService = new BaseWebAuthnAbortService();\n",
-    "const attachments = ['cross-platform', 'platform'];\n/**\n * If possible coerce a `string` value into a known `AuthenticatorAttachment`\n */\nexport function toAuthenticatorAttachment(attachment) {\n    if (!attachment) {\n        return;\n    }\n    if (attachments.indexOf(attachment) < 0) {\n        return;\n    }\n    return attachment;\n}\n",
-    "import { bufferToBase64URLString } from '../helpers/bufferToBase64URLString.js';\nimport { base64URLStringToBuffer } from '../helpers/base64URLStringToBuffer.js';\nimport { browserSupportsWebAuthn } from '../helpers/browserSupportsWebAuthn.js';\nimport { toPublicKeyCredentialDescriptor } from '../helpers/toPublicKeyCredentialDescriptor.js';\nimport { identifyRegistrationError } from '../helpers/identifyRegistrationError.js';\nimport { WebAuthnAbortService } from '../helpers/webAuthnAbortService.js';\nimport { toAuthenticatorAttachment } from '../helpers/toAuthenticatorAttachment.js';\n/**\n * Begin authenticator \"registration\" via WebAuthn attestation\n *\n * @param optionsJSON Output from **@simplewebauthn/server**'s `generateRegistrationOptions()`\n * @param useAutoRegister (Optional) Try to silently create a passkey with the password manager that the user just signed in with. Defaults to `false`.\n */\nexport async function startRegistration(options) {\n    // @ts-ignore: Intentionally check for old call structure to warn about improper API call\n    if (!options.optionsJSON && options.challenge) {\n        console.warn('startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.');\n        // @ts-ignore: Reassign the options, passed in as a positional argument, to the expected variable\n        options = { optionsJSON: options };\n    }\n    const { optionsJSON, useAutoRegister = false } = options;\n    if (!browserSupportsWebAuthn()) {\n        throw new Error('WebAuthn is not supported in this browser');\n    }\n    // We need to convert some values to Uint8Arrays before passing the credentials to the navigator\n    const publicKey = {\n        ...optionsJSON,\n        challenge: base64URLStringToBuffer(optionsJSON.challenge),\n        user: {\n            ...optionsJSON.user,\n            id: base64URLStringToBuffer(optionsJSON.user.id),\n        },\n        excludeCredentials: optionsJSON.excludeCredentials?.map(toPublicKeyCredentialDescriptor),\n    };\n    // Prepare options for `.create()`\n    const createOptions = {};\n    /**\n     * Try to use conditional create to register a passkey for the user with the password manager\n     * the user just used to authenticate with. The user won't be shown any prominent UI by the\n     * browser.\n     */\n    if (useAutoRegister) {\n        // @ts-ignore: `mediation` doesn't yet exist on CredentialCreationOptions but it's possible as of Sept 2024\n        createOptions.mediation = 'conditional';\n    }\n    // Finalize options\n    createOptions.publicKey = publicKey;\n    // Set up the ability to cancel this request if the user attempts another\n    createOptions.signal = WebAuthnAbortService.createNewAbortSignal();\n    // Wait for the user to complete attestation\n    let credential;\n    try {\n        credential = (await navigator.credentials.create(createOptions));\n    }\n    catch (err) {\n        throw identifyRegistrationError({ error: err, options: createOptions });\n    }\n    if (!credential) {\n        throw new Error('Registration was not completed');\n    }\n    const { id, rawId, response, type } = credential;\n    // Continue to play it safe with `getTransports()` for now, even when L3 types say it's required\n    let transports = undefined;\n    if (typeof response.getTransports === 'function') {\n        transports = response.getTransports();\n    }\n    // L3 says this is required, but browser and webview support are still not guaranteed.\n    let responsePublicKeyAlgorithm = undefined;\n    if (typeof response.getPublicKeyAlgorithm === 'function') {\n        try {\n            responsePublicKeyAlgorithm = response.getPublicKeyAlgorithm();\n        }\n        catch (error) {\n            warnOnBrokenImplementation('getPublicKeyAlgorithm()', error);\n        }\n    }\n    let responsePublicKey = undefined;\n    if (typeof response.getPublicKey === 'function') {\n        try {\n            const _publicKey = response.getPublicKey();\n            if (_publicKey !== null) {\n                responsePublicKey = bufferToBase64URLString(_publicKey);\n            }\n        }\n        catch (error) {\n            warnOnBrokenImplementation('getPublicKey()', error);\n        }\n    }\n    // L3 says this is required, but browser and webview support are still not guaranteed.\n    let responseAuthenticatorData;\n    if (typeof response.getAuthenticatorData === 'function') {\n        try {\n            responseAuthenticatorData = bufferToBase64URLString(response.getAuthenticatorData());\n        }\n        catch (error) {\n            warnOnBrokenImplementation('getAuthenticatorData()', error);\n        }\n    }\n    return {\n        id,\n        rawId: bufferToBase64URLString(rawId),\n        response: {\n            attestationObject: bufferToBase64URLString(response.attestationObject),\n            clientDataJSON: bufferToBase64URLString(response.clientDataJSON),\n            transports,\n            publicKeyAlgorithm: responsePublicKeyAlgorithm,\n            publicKey: responsePublicKey,\n            authenticatorData: responseAuthenticatorData,\n        },\n        type,\n        clientExtensionResults: credential.getClientExtensionResults(),\n        authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment),\n    };\n}\n/**\n * Visibly warn when we detect an issue related to a passkey provider intercepting WebAuthn API\n * calls\n */\nfunction warnOnBrokenImplementation(methodName, cause) {\n    console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${methodName}. You should report this error to them.\\n`, cause);\n}\n",
-    "import { browserSupportsWebAuthn } from './browserSupportsWebAuthn.js';\n/**\n * Determine if the browser supports conditional UI, so that WebAuthn credentials can\n * be shown to the user in the browser's typical password autofill popup.\n */\nexport function browserSupportsWebAuthnAutofill() {\n    if (!browserSupportsWebAuthn()) {\n        return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));\n    }\n    /**\n     * I don't like the `as unknown` here but there's a `declare var PublicKeyCredential` in\n     * TS' DOM lib that's making it difficult for me to just go `as PublicKeyCredentialFuture` as I\n     * want. I think I'm fine with this for now since it's _supposed_ to be temporary, until TS types\n     * have a chance to catch up.\n     */\n    const globalPublicKeyCredential = globalThis\n        .PublicKeyCredential;\n    if (globalPublicKeyCredential?.isConditionalMediationAvailable === undefined) {\n        return _browserSupportsWebAuthnAutofillInternals.stubThis(new Promise((resolve) => resolve(false)));\n    }\n    return _browserSupportsWebAuthnAutofillInternals.stubThis(globalPublicKeyCredential.isConditionalMediationAvailable());\n}\n// Make it possible to stub the return value during testing\nexport const _browserSupportsWebAuthnAutofillInternals = {\n    stubThis: (value) => value,\n};\n",
-    "import { isValidDomain } from './isValidDomain.js';\nimport { WebAuthnError } from './webAuthnError.js';\n/**\n * Attempt to intuit _why_ an error was raised after calling `navigator.credentials.get()`\n */\nexport function identifyAuthenticationError({ error, options, }) {\n    const { publicKey } = options;\n    if (!publicKey) {\n        throw Error('options was missing required publicKey property');\n    }\n    if (error.name === 'AbortError') {\n        if (options.signal instanceof AbortSignal) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-createCredential (Step 16)\n            return new WebAuthnError({\n                message: 'Authentication ceremony was sent an abort signal',\n                code: 'ERROR_CEREMONY_ABORTED',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'NotAllowedError') {\n        /**\n         * Pass the error directly through. Platforms are overloading this error beyond what the spec\n         * defines and we don't want to overwrite potentially useful error messages.\n         */\n        return new WebAuthnError({\n            message: error.message,\n            code: 'ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY',\n            cause: error,\n        });\n    }\n    else if (error.name === 'SecurityError') {\n        const effectiveDomain = globalThis.location.hostname;\n        if (!isValidDomain(effectiveDomain)) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-discover-from-external-source (Step 5)\n            return new WebAuthnError({\n                message: `${globalThis.location.hostname} is an invalid domain`,\n                code: 'ERROR_INVALID_DOMAIN',\n                cause: error,\n            });\n        }\n        else if (publicKey.rpId !== effectiveDomain) {\n            // https://www.w3.org/TR/webauthn-2/#sctn-discover-from-external-source (Step 6)\n            return new WebAuthnError({\n                message: `The RP ID \"${publicKey.rpId}\" is invalid for this domain`,\n                code: 'ERROR_INVALID_RP_ID',\n                cause: error,\n            });\n        }\n    }\n    else if (error.name === 'UnknownError') {\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion (Step 1)\n        // https://www.w3.org/TR/webauthn-2/#sctn-op-get-assertion (Step 12)\n        return new WebAuthnError({\n            message: 'The authenticator was unable to process the specified options, or could not create a new assertion signature',\n            code: 'ERROR_AUTHENTICATOR_GENERAL_ERROR',\n            cause: error,\n        });\n    }\n    return error;\n}\n",
-    "import { bufferToBase64URLString } from '../helpers/bufferToBase64URLString.js';\nimport { base64URLStringToBuffer } from '../helpers/base64URLStringToBuffer.js';\nimport { browserSupportsWebAuthn } from '../helpers/browserSupportsWebAuthn.js';\nimport { browserSupportsWebAuthnAutofill } from '../helpers/browserSupportsWebAuthnAutofill.js';\nimport { toPublicKeyCredentialDescriptor } from '../helpers/toPublicKeyCredentialDescriptor.js';\nimport { identifyAuthenticationError } from '../helpers/identifyAuthenticationError.js';\nimport { WebAuthnAbortService } from '../helpers/webAuthnAbortService.js';\nimport { toAuthenticatorAttachment } from '../helpers/toAuthenticatorAttachment.js';\n/**\n * Begin authenticator \"login\" via WebAuthn assertion\n *\n * @param optionsJSON Output from **@simplewebauthn/server**'s `generateAuthenticationOptions()`\n * @param useBrowserAutofill (Optional) Initialize conditional UI to enable logging in via browser autofill prompts. Defaults to `false`.\n * @param verifyBrowserAutofillInput (Optional) Ensure a suitable `<input>` element is present when `useBrowserAutofill` is `true`. Defaults to `true`.\n */\nexport async function startAuthentication(options) {\n    // @ts-ignore: Intentionally check for old call structure to warn about improper API call\n    if (!options.optionsJSON && options.challenge) {\n        console.warn('startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information.');\n        // @ts-ignore: Reassign the options, passed in as a positional argument, to the expected variable\n        options = { optionsJSON: options };\n    }\n    const { optionsJSON, useBrowserAutofill = false, verifyBrowserAutofillInput = true, } = options;\n    if (!browserSupportsWebAuthn()) {\n        throw new Error('WebAuthn is not supported in this browser');\n    }\n    // We need to avoid passing empty array to avoid blocking retrieval\n    // of public key\n    let allowCredentials;\n    if (optionsJSON.allowCredentials?.length !== 0) {\n        allowCredentials = optionsJSON.allowCredentials?.map(toPublicKeyCredentialDescriptor);\n    }\n    // We need to convert some values to Uint8Arrays before passing the credentials to the navigator\n    const publicKey = {\n        ...optionsJSON,\n        challenge: base64URLStringToBuffer(optionsJSON.challenge),\n        allowCredentials,\n    };\n    // Prepare options for `.get()`\n    const getOptions = {};\n    /**\n     * Set up the page to prompt the user to select a credential for authentication via the browser's\n     * input autofill mechanism.\n     */\n    if (useBrowserAutofill) {\n        if (!(await browserSupportsWebAuthnAutofill())) {\n            throw Error('Browser does not support WebAuthn autofill');\n        }\n        // Check for an <input> with \"webauthn\" in its `autocomplete` attribute\n        const eligibleInputs = document.querySelectorAll(\"input[autocomplete$='webauthn']\");\n        // WebAuthn autofill requires at least one valid input\n        if (eligibleInputs.length < 1 && verifyBrowserAutofillInput) {\n            throw Error('No <input> with \"webauthn\" as the only or last value in its `autocomplete` attribute was detected');\n        }\n        // `CredentialMediationRequirement` doesn't know about \"conditional\" yet as of\n        // typescript@4.6.3\n        getOptions.mediation = 'conditional';\n        // Conditional UI requires an empty allow list\n        publicKey.allowCredentials = [];\n    }\n    // Finalize options\n    getOptions.publicKey = publicKey;\n    // Set up the ability to cancel this request if the user attempts another\n    getOptions.signal = WebAuthnAbortService.createNewAbortSignal();\n    // Wait for the user to complete assertion\n    let credential;\n    try {\n        credential = (await navigator.credentials.get(getOptions));\n    }\n    catch (err) {\n        throw identifyAuthenticationError({ error: err, options: getOptions });\n    }\n    if (!credential) {\n        throw new Error('Authentication was not completed');\n    }\n    const { id, rawId, response, type } = credential;\n    let userHandle = undefined;\n    if (response.userHandle) {\n        userHandle = bufferToBase64URLString(response.userHandle);\n    }\n    // Convert values to base64 to make it easier to send back to the server\n    return {\n        id,\n        rawId: bufferToBase64URLString(rawId),\n        response: {\n            authenticatorData: bufferToBase64URLString(response.authenticatorData),\n            clientDataJSON: bufferToBase64URLString(response.clientDataJSON),\n            signature: bufferToBase64URLString(response.signature),\n            userHandle,\n        },\n        type,\n        clientExtensionResults: credential.getClientExtensionResults(),\n        authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment),\n    };\n}\n",
-    "import { browserSupportsWebAuthn } from './browserSupportsWebAuthn.js';\n/**\n * Determine whether the browser can communicate with a built-in authenticator, like\n * Touch ID, Android fingerprint scanner, or Windows Hello.\n *\n * This method will _not_ be able to tell you the name of the platform authenticator.\n */\nexport function platformAuthenticatorIsAvailable() {\n    if (!browserSupportsWebAuthn()) {\n        return new Promise((resolve) => resolve(false));\n    }\n    return PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();\n}\n",
-    "export * from './methods/startRegistration.js';\nexport * from './methods/startAuthentication.js';\nexport * from './helpers/browserSupportsWebAuthn.js';\nexport * from './helpers/platformAuthenticatorIsAvailable.js';\nexport * from './helpers/browserSupportsWebAuthnAutofill.js';\nexport * from './helpers/base64URLStringToBuffer.js';\nexport * from './helpers/bufferToBase64URLString.js';\nexport * from './helpers/webAuthnAbortService.js';\nexport * from './helpers/webAuthnError.js';\nexport * from './types/index.js';\n",
-    "// Thin Vue composables over `createAuthClient`, mirroring `./react`. Same `{ data, error,\n// isPending, mutate, reset }` shape — only the reactivity is Vue's (refs + onScopeDispose).\n// Bring your own form / UI; these are primitives.\n\nimport { onScopeDispose, ref, type Ref } from 'vue';\nimport type { AuthClient, AuthClientError } from './createAuthClient';\nimport {\n\trunConditionalAuthentication,\n\trunPasskeyRegistration\n} from './passkeyHelpers';\n\ntype Mutator<Args, Data> = (\n\targs: Args\n) => Promise<{ data: Data | null; error: AuthClientError | null }>;\n\ntype MutationState<Args, Data> = {\n\tdata: Ref<Data | null>;\n\terror: Ref<AuthClientError | null>;\n\tisPending: Ref<boolean>;\n\tmutate: Mutator<Args, Data>;\n\treset: () => void;\n};\n\n// Generic mutation composable. The exported composables are 1-2 line specializations of\n// this — kept private so consumers depend on the named API, not this internal shape.\nconst useMutation = <Args, Data>(\n\trun: Mutator<Args, Data>\n): MutationState<Args, Data> => {\n\tconst data: Ref<Data | null> = ref(null);\n\tconst error: Ref<AuthClientError | null> = ref(null);\n\tconst isPending = ref(false);\n\tlet alive = true;\n\tonScopeDispose(() => {\n\t\talive = false;\n\t});\n\n\tconst mutate: Mutator<Args, Data> = async (args) => {\n\t\tisPending.value = true;\n\t\terror.value = null;\n\t\tconst result = await run(args);\n\t\tif (alive) {\n\t\t\tdata.value = result.data;\n\t\t\terror.value = result.error;\n\t\t\tisPending.value = false;\n\t\t}\n\n\t\treturn result;\n\t};\n\n\tconst reset = () => {\n\t\tdata.value = null;\n\t\terror.value = null;\n\t\tisPending.value = false;\n\t};\n\n\treturn { data, error, isPending, mutate, reset };\n};\n\nexport const useMagicLink = (client: AuthClient) =>\n\tuseMutation(client.passwordless.requestMagicLink);\n\n// Conditional-UI WebAuthn — see the React doc for the wire-up pattern. Returns refs you\n// `v-bind` into your sign-in template; `start()` kicks off the browser-autofill ceremony.\nexport const usePasskeyAutofill = (client: AuthClient) => {\n\tconst data: Ref<{ status: 'authenticated' } | null> = ref(null);\n\tconst error: Ref<AuthClientError | null> = ref(null);\n\tconst isPending = ref(false);\n\tlet alive = true;\n\tonScopeDispose(() => {\n\t\talive = false;\n\t});\n\n\tconst start = async () => {\n\t\tisPending.value = true;\n\t\terror.value = null;\n\t\tconst result = await runConditionalAuthentication(client);\n\t\tif (alive) {\n\t\t\tdata.value = result.data;\n\t\t\terror.value = result.error;\n\t\t\tisPending.value = false;\n\t\t}\n\t};\n\n\tconst cancel = () => {\n\t\tisPending.value = false;\n\t};\n\n\treturn { cancel, data, error, isPending, start };\n};\n\n// \"Upgrade to passkey\" prompt — see the React doc. `shouldPrompt` is a computed-style ref\n// that's true when the signed-in user has no passkeys yet.\nexport const useUpgradeToPasskey = (client: AuthClient) => {\n\tconst passkeys: Ref<unknown[] | null> = ref(null);\n\tconst error: Ref<AuthClientError | null> = ref(null);\n\tconst isPending = ref(true);\n\tlet alive = true;\n\tonScopeDispose(() => {\n\t\talive = false;\n\t});\n\n\tconst refetch = async () => {\n\t\tisPending.value = true;\n\t\tconst result = await client.passkeys.list();\n\t\tif (alive) {\n\t\t\tpasskeys.value = result.data;\n\t\t\terror.value = result.error;\n\t\t\tisPending.value = false;\n\t\t}\n\t};\n\n\tconst register = async () => {\n\t\tconst result = await runPasskeyRegistration(client);\n\t\tif (result.error === null) await refetch();\n\n\t\treturn result;\n\t};\n\n\tvoid refetch();\n\tconst shouldPrompt = ref(false);\n\tconst updateShouldPrompt = () => {\n\t\tshouldPrompt.value =\n\t\t\tpasskeys.value !== null && passkeys.value.length === 0;\n\t};\n\t// Update shouldPrompt whenever the list changes via refetch/register.\n\tconst wrappedRefetch = async () => {\n\t\tawait refetch();\n\t\tupdateShouldPrompt();\n\t};\n\tconst wrappedRegister = async () => {\n\t\tconst result = await register();\n\t\tupdateShouldPrompt();\n\n\t\treturn result;\n\t};\n\n\treturn {\n\t\terror,\n\t\tisPending,\n\t\tpasskeys,\n\t\trefetch: wrappedRefetch,\n\t\tregister: wrappedRegister,\n\t\tshouldPrompt\n\t};\n};\n\nexport const useMfaChallenge = (client: AuthClient) =>\n\tuseMutation(client.mfa.challenge);\n\nexport const usePasswordReset = (client: AuthClient) =>\n\tuseMutation(client.passwordReset.request);\n\n// Query composable for the user's active sessions; refetch() reruns it, revoke(sessionId)\n// kills one and refetches. Same `{ data, error, isPending }` triplet as the mutations so\n// the consumer can render one way.\nexport const useSessions = (client: AuthClient) => {\n\tconst data: Ref<unknown[] | null> = ref(null);\n\tconst error: Ref<AuthClientError | null> = ref(null);\n\tconst isPending = ref(true);\n\tlet alive = true;\n\tonScopeDispose(() => {\n\t\talive = false;\n\t});\n\n\tconst refetch = async () => {\n\t\tisPending.value = true;\n\t\tconst result = await client.sessions.list();\n\t\tif (alive) {\n\t\t\tdata.value = result.data;\n\t\t\terror.value = result.error;\n\t\t\tisPending.value = false;\n\t\t}\n\t};\n\n\tconst revoke = async (sessionId: string) => {\n\t\tconst result = await client.sessions.revoke(sessionId);\n\t\tif (result.error === null) await refetch();\n\n\t\treturn result;\n\t};\n\n\tvoid refetch();\n\n\treturn { data, error, isPending, refetch, revoke };\n};\n\nexport const useSignIn = (client: AuthClient) =>\n\tuseMutation(client.signIn.email);\n\nexport const useSignOut = (client: AuthClient) => useMutation(client.signOut);\n\nexport const useSignUp = (client: AuthClient) =>\n\tuseMutation(client.signUp.email);\n",
-    "// Framework-agnostic glue between the WebAuthn ceremonies the package exposes via\n// `createAuthClient` and the browser's `navigator.credentials.{get,create}` APIs.\n// Used by the framework composables (`./react`, `./vue`, `./solid`, `./svelte`) so the\n// React + Vue + Solid + Svelte hooks all share the same imperative core; the framework\n// wrappers only add reactivity.\n//\n// `@simplewebauthn/browser` is an OPTIONAL peer dep — consumers that don't import any\n// of the passkey composables never load it. We dynamic-import lazily on first call so a\n// non-passkey consumer pays nothing at module load.\n\nimport type { AuthClient, AuthClientError } from './createAuthClient';\n\ntype StartAuthentication = (options: {\n\toptionsJSON: unknown;\n\tuseBrowserAutofill?: boolean;\n}) => Promise<unknown>;\n\ntype StartRegistration = (options: {\n\toptionsJSON: unknown;\n}) => Promise<unknown>;\n\nconst loadBrowser = async () => {\n\tconst mod: {\n\t\tstartAuthentication: StartAuthentication;\n\t\tstartRegistration: StartRegistration;\n\t} =\n\t\t// eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- @simplewebauthn/browser is an optional peer dep; the dynamic import is gated by composable use sites + the shape matches the upstream signature we depend on\n\t\t(await import('@simplewebauthn/browser')) as {\n\t\t\tstartAuthentication: StartAuthentication;\n\t\t\tstartRegistration: StartRegistration;\n\t\t};\n\n\treturn mod;\n};\n\nconst errorFor = (caught: unknown): AuthClientError => ({\n\tbody: null,\n\tmessage: caught instanceof Error ? caught.message : 'webauthn_failed',\n\tstatus: 0\n});\n\n// Runs the WebAuthn authentication ceremony in conditional-UI mode (the browser surfaces\n// saved passkeys directly via autofill on a focused `<input autocomplete=\"webauthn\">`).\n// Returns the same `{ data, error }` shape `createAuthClient` already uses, so composables\n// can pipe the result into their state setters unchanged.\nexport const runConditionalAuthentication = async (client: AuthClient) => {\n\tif (typeof window === 'undefined' || !window.PublicKeyCredential) {\n\t\treturn {\n\t\t\tdata: null,\n\t\t\terror: errorFor(new Error('webauthn_unavailable'))\n\t\t};\n\t}\n\tconst options = await client.passkeys.authenticateOptions();\n\tif (options.error) return { data: null, error: options.error };\n\ttry {\n\t\tconst { startAuthentication } = await loadBrowser();\n\t\tconst credential = await startAuthentication({\n\t\t\toptionsJSON: options.data,\n\t\t\tuseBrowserAutofill: true\n\t\t});\n\n\t\treturn client.passkeys.authenticateVerify(credential);\n\t} catch (caught) {\n\t\treturn { data: null, error: errorFor(caught) };\n\t}\n};\n\n// Runs the WebAuthn registration ceremony for the currently authenticated user. Used by\n// the \"upgrade to passkey\" prompt — after a password sign-in, surface a \"save a passkey\n// to this device for next time?\" CTA.\nexport const runPasskeyRegistration = async (client: AuthClient) => {\n\tif (typeof window === 'undefined' || !window.PublicKeyCredential) {\n\t\treturn {\n\t\t\tdata: null,\n\t\t\terror: errorFor(new Error('webauthn_unavailable'))\n\t\t};\n\t}\n\tconst options = await client.passkeys.registerOptions();\n\tif (options.error) return { data: null, error: options.error };\n\ttry {\n\t\tconst { startRegistration } = await loadBrowser();\n\t\tconst credential = await startRegistration({\n\t\t\toptionsJSON: options.data\n\t\t});\n\n\t\treturn client.passkeys.registerVerify(credential);\n\t} catch (caught) {\n\t\treturn { data: null, error: errorFor(caught) };\n\t}\n};\n"
+    "// Thin Vue composables over `createAuthClient`, mirroring `./react`. Same `{ data, error,\n// isPending, mutate, reset }` shape — only the reactivity is Vue's (refs + onScopeDispose).\n// Bring your own form / UI; these are primitives.\n\nimport { onScopeDispose, ref, type Ref } from 'vue';\nimport type { AuthClient, AuthClientError } from './createAuthClient';\nimport {\n\trunConditionalAuthentication,\n\trunPasskeyRegistration\n} from './passkeyHelpers';\n\ntype Mutator<Args, Data> = (\n\targs: Args\n) => Promise<{ data: Data | null; error: AuthClientError | null }>;\n\ntype MutationState<Args, Data> = {\n\tdata: Ref<Data | null>;\n\terror: Ref<AuthClientError | null>;\n\tisPending: Ref<boolean>;\n\tmutate: Mutator<Args, Data>;\n\treset: () => void;\n};\n\n// Generic mutation composable. The exported composables are 1-2 line specializations of\n// this — kept private so consumers depend on the named API, not this internal shape.\nconst useMutation = <Args, Data>(\n\trun: Mutator<Args, Data>\n): MutationState<Args, Data> => {\n\tconst data: Ref<Data | null> = ref(null);\n\tconst error: Ref<AuthClientError | null> = ref(null);\n\tconst isPending = ref(false);\n\tlet alive = true;\n\tonScopeDispose(() => {\n\t\talive = false;\n\t});\n\n\tconst mutate: Mutator<Args, Data> = async (args) => {\n\t\tisPending.value = true;\n\t\terror.value = null;\n\t\tconst result = await run(args);\n\t\tif (alive) {\n\t\t\tdata.value = result.data;\n\t\t\terror.value = result.error;\n\t\t\tisPending.value = false;\n\t\t}\n\n\t\treturn result;\n\t};\n\n\tconst reset = () => {\n\t\tdata.value = null;\n\t\terror.value = null;\n\t\tisPending.value = false;\n\t};\n\n\treturn { data, error, isPending, mutate, reset };\n};\n\nexport const useMagicLink = (client: AuthClient) =>\n\tuseMutation(client.passwordless.requestMagicLink);\nexport const useMfaChallenge = (client: AuthClient) =>\n\tuseMutation(client.mfa.challenge);\nexport const usePasskeyAutofill = (client: AuthClient) => {\n\tconst data: Ref<{ status: 'authenticated' } | null> = ref(null);\n\tconst error: Ref<AuthClientError | null> = ref(null);\n\tconst isPending = ref(false);\n\tlet alive = true;\n\tonScopeDispose(() => {\n\t\talive = false;\n\t});\n\n\tconst start = async () => {\n\t\tisPending.value = true;\n\t\terror.value = null;\n\t\tconst result = await runConditionalAuthentication(client);\n\t\tif (alive) {\n\t\t\tdata.value = result.data;\n\t\t\terror.value = result.error;\n\t\t\tisPending.value = false;\n\t\t}\n\t};\n\n\tconst cancel = () => {\n\t\tisPending.value = false;\n\t};\n\n\treturn { cancel, data, error, isPending, start };\n};\nexport const usePasswordReset = (client: AuthClient) =>\n\tuseMutation(client.passwordReset.request);\nexport const useSessions = (client: AuthClient) => {\n\tconst data: Ref<unknown[] | null> = ref(null);\n\tconst error: Ref<AuthClientError | null> = ref(null);\n\tconst isPending = ref(true);\n\tlet alive = true;\n\tonScopeDispose(() => {\n\t\talive = false;\n\t});\n\n\tconst refetch = async () => {\n\t\tisPending.value = true;\n\t\tconst result = await client.sessions.list();\n\t\tif (alive) {\n\t\t\tdata.value = result.data;\n\t\t\terror.value = result.error;\n\t\t\tisPending.value = false;\n\t\t}\n\t};\n\n\tconst revoke = async (sessionId: string) => {\n\t\tconst result = await client.sessions.revoke(sessionId);\n\t\tif (result.error === null) await refetch();\n\n\t\treturn result;\n\t};\n\n\tvoid refetch();\n\n\treturn { data, error, isPending, refetch, revoke };\n};\nexport const useSignIn = (client: AuthClient) =>\n\tuseMutation(client.signIn.email);\nexport const useSignOut = (client: AuthClient) => useMutation(client.signOut);\nexport const useSignUp = (client: AuthClient) =>\n\tuseMutation(client.signUp.email);\nexport const useUpgradeToPasskey = (client: AuthClient) => {\n\tconst passkeys: Ref<unknown[] | null> = ref(null);\n\tconst error: Ref<AuthClientError | null> = ref(null);\n\tconst isPending = ref(true);\n\tlet alive = true;\n\tonScopeDispose(() => {\n\t\talive = false;\n\t});\n\n\tconst refetch = async () => {\n\t\tisPending.value = true;\n\t\tconst result = await client.passkeys.list();\n\t\tif (alive) {\n\t\t\tpasskeys.value = result.data;\n\t\t\terror.value = result.error;\n\t\t\tisPending.value = false;\n\t\t}\n\t};\n\n\tconst register = async () => {\n\t\tconst result = await runPasskeyRegistration(client);\n\t\tif (result.error === null) await refetch();\n\n\t\treturn result;\n\t};\n\n\tvoid refetch();\n\tconst shouldPrompt = ref(false);\n\tconst updateShouldPrompt = () => {\n\t\tshouldPrompt.value =\n\t\t\tpasskeys.value !== null && passkeys.value.length === 0;\n\t};\n\t// Update shouldPrompt whenever the list changes via refetch/register.\n\tconst wrappedRefetch = async () => {\n\t\tawait refetch();\n\t\tupdateShouldPrompt();\n\t};\n\tconst wrappedRegister = async () => {\n\t\tconst result = await register();\n\t\tupdateShouldPrompt();\n\n\t\treturn result;\n\t};\n\n\treturn {\n\t\terror,\n\t\tisPending,\n\t\tpasskeys,\n\t\trefetch: wrappedRefetch,\n\t\tregister: wrappedRegister,\n\t\tshouldPrompt\n\t};\n};\n",
+    "// Framework-agnostic glue between the WebAuthn ceremonies the package exposes via\n// `createAuthClient` and the browser's `navigator.credentials.{get,create}` APIs.\n// Used by the framework composables (`./react`, `./vue`, `./solid`, `./svelte`) so the\n// React + Vue + Solid + Svelte hooks all share the same imperative core; the framework\n// wrappers only add reactivity.\n//\n// `@simplewebauthn/browser` is an OPTIONAL peer dep — consumers that don't import any\n// of the passkey composables never load it. We dynamic-import lazily on first call so a\n// non-passkey consumer pays nothing at module load.\n\nimport type { AuthClient, AuthClientError } from './createAuthClient';\n\nconst loadBrowser = () => import('@simplewebauthn/browser');\n\nconst errorFor = (caught: unknown): AuthClientError => ({\n\tbody: null,\n\tmessage: caught instanceof Error ? caught.message : 'webauthn_failed',\n\tstatus: 0\n});\n\n// Runs the WebAuthn authentication ceremony in conditional-UI mode (the browser surfaces\n// saved passkeys directly via autofill on a focused `<input autocomplete=\"webauthn\">`).\n// Returns the same `{ data, error }` shape `createAuthClient` already uses, so composables\n// can pipe the result into their state setters unchanged.\nexport const runConditionalAuthentication = async (client: AuthClient) => {\n\tif (typeof window === 'undefined' || !window.PublicKeyCredential) {\n\t\treturn {\n\t\t\tdata: null,\n\t\t\terror: errorFor(new Error('webauthn_unavailable'))\n\t\t};\n\t}\n\tconst options = await client.passkeys.authenticateOptions();\n\tif (options.error) return { data: null, error: options.error };\n\ttry {\n\t\tconst { startAuthentication } = await loadBrowser();\n\t\tconst credential = await startAuthentication({\n\t\t\toptionsJSON: options.data,\n\t\t\tuseBrowserAutofill: true\n\t\t});\n\n\t\treturn client.passkeys.authenticateVerify(credential);\n\t} catch (caught) {\n\t\treturn { data: null, error: errorFor(caught) };\n\t}\n};\n\n// Runs the WebAuthn registration ceremony for the currently authenticated user. Used by\n// the \"upgrade to passkey\" prompt — after a password sign-in, surface a \"save a passkey\n// to this device for next time?\" CTA.\nexport const runPasskeyRegistration = async (client: AuthClient) => {\n\tif (typeof window === 'undefined' || !window.PublicKeyCredential) {\n\t\treturn {\n\t\t\tdata: null,\n\t\t\terror: errorFor(new Error('webauthn_unavailable'))\n\t\t};\n\t}\n\tconst options = await client.passkeys.registerOptions();\n\tif (options.error) return { data: null, error: options.error };\n\ttry {\n\t\tconst { startRegistration } = await loadBrowser();\n\t\tconst credential = await startRegistration({\n\t\t\toptionsJSON: options.data\n\t\t});\n\n\t\treturn client.passkeys.registerVerify(credential);\n\t} catch (caught) {\n\t\treturn { data: null, error: errorFor(caught) };\n\t}\n};\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMO,SAAS,uBAAuB,CAAC,QAAQ;AAAA,EAC5C,MAAM,QAAQ,IAAI,WAAW,MAAM;AAAA,EACnC,IAAI,MAAM;AAAA,EACV,WAAW,YAAY,OAAO;AAAA,IAC1B,OAAO,OAAO,aAAa,QAAQ;AAAA,EACvC;AAAA,EACA,MAAM,eAAe,KAAK,GAAG;AAAA,EAC7B,OAAO,aAAa,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,MAAM,EAAE;AAAA;;;ACNzE,SAAS,uBAAuB,CAAC,iBAAiB;AAAA,EAErD,MAAM,SAAS,gBAAgB,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAAA,EAQnE,MAAM,aAAa,IAAK,OAAO,SAAS,KAAM;AAAA,EAC9C,MAAM,SAAS,OAAO,OAAO,OAAO,SAAS,WAAW,GAAG;AAAA,EAE3D,MAAM,SAAS,KAAK,MAAM;AAAA,EAE1B,MAAM,SAAS,IAAI,YAAY,OAAO,MAAM;AAAA,EAC5C,MAAM,QAAQ,IAAI,WAAW,MAAM;AAAA,EACnC,SAAS,IAAI,EAAG,IAAI,OAAO,QAAQ,KAAK;AAAA,IACpC,MAAM,KAAK,OAAO,WAAW,CAAC;AAAA,EAClC;AAAA,EACA,OAAO;AAAA;;;ACxBJ,SAAS,uBAAuB,GAAG;AAAA,EACtC,OAAO,kCAAkC,SAAS,YAAY,wBAAwB,aAClF,OAAO,WAAW,wBAAwB,UAAU;AAAA;AAAA,IAM/C;AAAA;AAAA,sCAAoC;AAAA,IAC7C,UAAU,CAAC,UAAU;AAAA,EACzB;AAAA;;;ACZO,SAAS,+BAA+B,CAAC,YAAY;AAAA,EACxD,QAAQ,OAAO;AAAA,EACf,OAAO;AAAA,OACA;AAAA,IACH,IAAI,wBAAwB,EAAE;AAAA,IAM9B,YAAY,WAAW;AAAA,EAC3B;AAAA;AAAA;;;ACJG,SAAS,aAAa,CAAC,UAAU;AAAA,EACpC,OAEA,aAAa,eAET,4EAA4E,KAAK,QAAQ;AAAA;;;ICIpF;AAAA;AAAA,kBAAN,MAAM,sBAAsB,MAAM;AAAA,IACrC,WAAW,GAAG,SAAS,MAAM,OAAO,QAAS;AAAA,MAEzC,MAAM,SAAS,EAAE,MAAM,CAAC;AAAA,MACxB,OAAO,eAAe,MAAM,QAAQ;AAAA,QAChC,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,UAAU;AAAA,QACV,OAAY;AAAA,MAChB,CAAC;AAAA,MACD,KAAK,OAAO,QAAQ,MAAM;AAAA,MAC1B,KAAK,OAAO;AAAA;AAAA,EAEpB;AAAA;;;ACzBO,SAAS,yBAAyB,GAAG,OAAO,WAAY;AAAA,EAC3D,QAAQ,cAAc;AAAA,EACtB,IAAI,CAAC,WAAW;AAAA,IACZ,MAAM,MAAM,iDAAiD;AAAA,EACjE;AAAA,EACA,IAAI,MAAM,SAAS,cAAc;AAAA,IAC7B,IAAI,QAAQ,kBAAkB,aAAa;AAAA,MAEvC,OAAO,IAAI,cAAc;AAAA,QACrB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,OAAO;AAAA,MACX,CAAC;AAAA,IACL;AAAA,EACJ,EACK,SAAI,MAAM,SAAS,mBAAmB;AAAA,IACvC,IAAI,UAAU,wBAAwB,uBAAuB,MAAM;AAAA,MAE/D,OAAO,IAAI,cAAc;AAAA,QACrB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,OAAO;AAAA,MACX,CAAC;AAAA,IACL,EACK,SAEL,QAAQ,cAAc,iBAClB,UAAU,wBAAwB,qBAAqB,YAAY;AAAA,MAEnE,OAAO,IAAI,cAAc;AAAA,QACrB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,OAAO;AAAA,MACX,CAAC;AAAA,IACL,EACK,SAAI,UAAU,wBAAwB,qBAAqB,YAAY;AAAA,MAExE,OAAO,IAAI,cAAc;AAAA,QACrB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,OAAO;AAAA,MACX,CAAC;AAAA,IACL;AAAA,EACJ,EACK,SAAI,MAAM,SAAS,qBAAqB;AAAA,IAGzC,OAAO,IAAI,cAAc;AAAA,MACrB,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,IACX,CAAC;AAAA,EACL,EACK,SAAI,MAAM,SAAS,mBAAmB;AAAA,IAKvC,OAAO,IAAI,cAAc;AAAA,MACrB,SAAS,MAAM;AAAA,MACf,MAAM;AAAA,MACN,OAAO;AAAA,IACX,CAAC;AAAA,EACL,EACK,SAAI,MAAM,SAAS,qBAAqB;AAAA,IACzC,MAAM,wBAAwB,UAAU,iBAAiB,OAAO,CAAC,UAAU,MAAM,SAAS,YAAY;AAAA,IACtG,IAAI,sBAAsB,WAAW,GAAG;AAAA,MAEpC,OAAO,IAAI,cAAc;AAAA,QACrB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,OAAO;AAAA,MACX,CAAC;AAAA,IACL;AAAA,IAEA,OAAO,IAAI,cAAc;AAAA,MACrB,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,IACX,CAAC;AAAA,EACL,EACK,SAAI,MAAM,SAAS,iBAAiB;AAAA,IACrC,MAAM,kBAAkB,WAAW,SAAS;AAAA,IAC5C,IAAI,CAAC,cAAc,eAAe,GAAG;AAAA,MAEjC,OAAO,IAAI,cAAc;AAAA,QACrB,SAAS,GAAG,WAAW,SAAS;AAAA,QAChC,MAAM;AAAA,QACN,OAAO;AAAA,MACX,CAAC;AAAA,IACL,EACK,SAAI,UAAU,GAAG,OAAO,iBAAiB;AAAA,MAE1C,OAAO,IAAI,cAAc;AAAA,QACrB,SAAS,cAAc,UAAU,GAAG;AAAA,QACpC,MAAM;AAAA,QACN,OAAO;AAAA,MACX,CAAC;AAAA,IACL;AAAA,EACJ,EACK,SAAI,MAAM,SAAS,aAAa;AAAA,IACjC,IAAI,UAAU,KAAK,GAAG,aAAa,KAAK,UAAU,KAAK,GAAG,aAAa,IAAI;AAAA,MAEvE,OAAO,IAAI,cAAc;AAAA,QACrB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,OAAO;AAAA,MACX,CAAC;AAAA,IACL;AAAA,EACJ,EACK,SAAI,MAAM,SAAS,gBAAgB;AAAA,IAGpC,OAAO,IAAI,cAAc;AAAA,MACrB,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AAAA,EACA,OAAO;AAAA;AAAA;AAAA,EA3HX;AAAA;;;ACDA,MAAM,yBAAyB;AAAA,EAC3B,WAAW,GAAG;AAAA,IACV,OAAO,eAAe,MAAM,cAAc;AAAA,MACtC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAY;AAAA,IAChB,CAAC;AAAA;AAAA,EAEL,oBAAoB,GAAG;AAAA,IAEnB,IAAI,KAAK,YAAY;AAAA,MACjB,MAAM,aAAa,IAAI,MAAM,mDAAmD;AAAA,MAChF,WAAW,OAAO;AAAA,MAClB,KAAK,WAAW,MAAM,UAAU;AAAA,IACpC;AAAA,IACA,MAAM,gBAAgB,IAAI;AAAA,IAC1B,KAAK,aAAa;AAAA,IAClB,OAAO,cAAc;AAAA;AAAA,EAEzB,cAAc,GAAG;AAAA,IACb,IAAI,KAAK,YAAY;AAAA,MACjB,MAAM,aAAa,IAAI,MAAM,gDAAgD;AAAA,MAC7E,WAAW,OAAO;AAAA,MAClB,KAAK,WAAW,MAAM,UAAU;AAAA,MAChC,KAAK,aAAa;AAAA,IACtB;AAAA;AAER;AAAA,IAQa;AAAA;AAAA,yBAAuB,IAAI;AAAA;;;AChCjC,SAAS,yBAAyB,CAAC,YAAY;AAAA,EAClD,IAAI,CAAC,YAAY;AAAA,IACb;AAAA,EACJ;AAAA,EACA,IAAI,YAAY,QAAQ,UAAU,IAAI,GAAG;AAAA,IACrC;AAAA,EACJ;AAAA,EACA,OAAO;AAAA;AAAA,IAXL;AAAA;AAAA,gBAAc,CAAC,kBAAkB,UAAU;AAAA;;;ACajD,eAAsB,iBAAiB,CAAC,SAAS;AAAA,EAE7C,IAAI,CAAC,QAAQ,eAAe,QAAQ,WAAW;AAAA,IAC3C,QAAQ,KAAK,4TAA4T;AAAA,IAEzU,UAAU,EAAE,aAAa,QAAQ;AAAA,EACrC;AAAA,EACA,QAAQ,aAAa,kBAAkB,UAAU;AAAA,EACjD,IAAI,CAAC,wBAAwB,GAAG;AAAA,IAC5B,MAAM,IAAI,MAAM,2CAA2C;AAAA,EAC/D;AAAA,EAEA,MAAM,YAAY;AAAA,OACX;AAAA,IACH,WAAW,wBAAwB,YAAY,SAAS;AAAA,IACxD,MAAM;AAAA,SACC,YAAY;AAAA,MACf,IAAI,wBAAwB,YAAY,KAAK,EAAE;AAAA,IACnD;AAAA,IACA,oBAAoB,YAAY,oBAAoB,IAAI,+BAA+B;AAAA,EAC3F;AAAA,EAEA,MAAM,gBAAgB,CAAC;AAAA,EAMvB,IAAI,iBAAiB;AAAA,IAEjB,cAAc,YAAY;AAAA,EAC9B;AAAA,EAEA,cAAc,YAAY;AAAA,EAE1B,cAAc,SAAS,qBAAqB,qBAAqB;AAAA,EAEjE,IAAI;AAAA,EACJ,IAAI;AAAA,IACA,aAAc,MAAM,UAAU,YAAY,OAAO,aAAa;AAAA,IAElE,OAAO,KAAK;AAAA,IACR,MAAM,0BAA0B,EAAE,OAAO,KAAK,SAAS,cAAc,CAAC;AAAA;AAAA,EAE1E,IAAI,CAAC,YAAY;AAAA,IACb,MAAM,IAAI,MAAM,gCAAgC;AAAA,EACpD;AAAA,EACA,QAAQ,IAAI,OAAO,UAAU,SAAS;AAAA,EAEtC,IAAI,aAAa;AAAA,EACjB,IAAI,OAAO,SAAS,kBAAkB,YAAY;AAAA,IAC9C,aAAa,SAAS,cAAc;AAAA,EACxC;AAAA,EAEA,IAAI,6BAA6B;AAAA,EACjC,IAAI,OAAO,SAAS,0BAA0B,YAAY;AAAA,IACtD,IAAI;AAAA,MACA,6BAA6B,SAAS,sBAAsB;AAAA,MAEhE,OAAO,OAAO;AAAA,MACV,2BAA2B,2BAA2B,KAAK;AAAA;AAAA,EAEnE;AAAA,EACA,IAAI,oBAAoB;AAAA,EACxB,IAAI,OAAO,SAAS,iBAAiB,YAAY;AAAA,IAC7C,IAAI;AAAA,MACA,MAAM,aAAa,SAAS,aAAa;AAAA,MACzC,IAAI,eAAe,MAAM;AAAA,QACrB,oBAAoB,wBAAwB,UAAU;AAAA,MAC1D;AAAA,MAEJ,OAAO,OAAO;AAAA,MACV,2BAA2B,kBAAkB,KAAK;AAAA;AAAA,EAE1D;AAAA,EAEA,IAAI;AAAA,EACJ,IAAI,OAAO,SAAS,yBAAyB,YAAY;AAAA,IACrD,IAAI;AAAA,MACA,4BAA4B,wBAAwB,SAAS,qBAAqB,CAAC;AAAA,MAEvF,OAAO,OAAO;AAAA,MACV,2BAA2B,0BAA0B,KAAK;AAAA;AAAA,EAElE;AAAA,EACA,OAAO;AAAA,IACH;AAAA,IACA,OAAO,wBAAwB,KAAK;AAAA,IACpC,UAAU;AAAA,MACN,mBAAmB,wBAAwB,SAAS,iBAAiB;AAAA,MACrE,gBAAgB,wBAAwB,SAAS,cAAc;AAAA,MAC/D;AAAA,MACA,oBAAoB;AAAA,MACpB,WAAW;AAAA,MACX,mBAAmB;AAAA,IACvB;AAAA,IACA;AAAA,IACA,wBAAwB,WAAW,0BAA0B;AAAA,IAC7D,yBAAyB,0BAA0B,WAAW,uBAAuB;AAAA,EACzF;AAAA;AAMJ,SAAS,0BAA0B,CAAC,YAAY,OAAO;AAAA,EACnD,QAAQ,KAAK,yFAAyF;AAAA,GAAuD,KAAK;AAAA;AAAA;AAAA,EArHtK;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;;;ACDO,SAAS,+BAA+B,GAAG;AAAA,EAC9C,IAAI,CAAC,wBAAwB,GAAG;AAAA,IAC5B,OAAO,0CAA0C,SAAS,IAAI,QAAQ,CAAC,YAAY,QAAQ,KAAK,CAAC,CAAC;AAAA,EACtG;AAAA,EAOA,MAAM,4BAA4B,WAC7B;AAAA,EACL,IAAI,2BAA2B,oCAAoC,WAAW;AAAA,IAC1E,OAAO,0CAA0C,SAAS,IAAI,QAAQ,CAAC,YAAY,QAAQ,KAAK,CAAC,CAAC;AAAA,EACtG;AAAA,EACA,OAAO,0CAA0C,SAAS,0BAA0B,gCAAgC,CAAC;AAAA;AAAA,IAG5G;AAAA;AAAA,EAvBb;AAAA,EAuBa,4CAA4C;AAAA,IACrD,UAAU,CAAC,UAAU;AAAA,EACzB;AAAA;;;ACpBO,SAAS,2BAA2B,GAAG,OAAO,WAAY;AAAA,EAC7D,QAAQ,cAAc;AAAA,EACtB,IAAI,CAAC,WAAW;AAAA,IACZ,MAAM,MAAM,iDAAiD;AAAA,EACjE;AAAA,EACA,IAAI,MAAM,SAAS,cAAc;AAAA,IAC7B,IAAI,QAAQ,kBAAkB,aAAa;AAAA,MAEvC,OAAO,IAAI,cAAc;AAAA,QACrB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,OAAO;AAAA,MACX,CAAC;AAAA,IACL;AAAA,EACJ,EACK,SAAI,MAAM,SAAS,mBAAmB;AAAA,IAKvC,OAAO,IAAI,cAAc;AAAA,MACrB,SAAS,MAAM;AAAA,MACf,MAAM;AAAA,MACN,OAAO;AAAA,IACX,CAAC;AAAA,EACL,EACK,SAAI,MAAM,SAAS,iBAAiB;AAAA,IACrC,MAAM,kBAAkB,WAAW,SAAS;AAAA,IAC5C,IAAI,CAAC,cAAc,eAAe,GAAG;AAAA,MAEjC,OAAO,IAAI,cAAc;AAAA,QACrB,SAAS,GAAG,WAAW,SAAS;AAAA,QAChC,MAAM;AAAA,QACN,OAAO;AAAA,MACX,CAAC;AAAA,IACL,EACK,SAAI,UAAU,SAAS,iBAAiB;AAAA,MAEzC,OAAO,IAAI,cAAc;AAAA,QACrB,SAAS,cAAc,UAAU;AAAA,QACjC,MAAM;AAAA,QACN,OAAO;AAAA,MACX,CAAC;AAAA,IACL;AAAA,EACJ,EACK,SAAI,MAAM,SAAS,gBAAgB;AAAA,IAGpC,OAAO,IAAI,cAAc;AAAA,MACrB,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AAAA,EACA,OAAO;AAAA;AAAA;AAAA,EA1DX;AAAA;;;ACcA,eAAsB,mBAAmB,CAAC,SAAS;AAAA,EAE/C,IAAI,CAAC,QAAQ,eAAe,QAAQ,WAAW;AAAA,IAC3C,QAAQ,KAAK,8TAA8T;AAAA,IAE3U,UAAU,EAAE,aAAa,QAAQ;AAAA,EACrC;AAAA,EACA,QAAQ,aAAa,qBAAqB,OAAO,6BAA6B,SAAU;AAAA,EACxF,IAAI,CAAC,wBAAwB,GAAG;AAAA,IAC5B,MAAM,IAAI,MAAM,2CAA2C;AAAA,EAC/D;AAAA,EAGA,IAAI;AAAA,EACJ,IAAI,YAAY,kBAAkB,WAAW,GAAG;AAAA,IAC5C,mBAAmB,YAAY,kBAAkB,IAAI,+BAA+B;AAAA,EACxF;AAAA,EAEA,MAAM,YAAY;AAAA,OACX;AAAA,IACH,WAAW,wBAAwB,YAAY,SAAS;AAAA,IACxD;AAAA,EACJ;AAAA,EAEA,MAAM,aAAa,CAAC;AAAA,EAKpB,IAAI,oBAAoB;AAAA,IACpB,IAAI,CAAE,MAAM,gCAAgC,GAAI;AAAA,MAC5C,MAAM,MAAM,4CAA4C;AAAA,IAC5D;AAAA,IAEA,MAAM,iBAAiB,SAAS,iBAAiB,iCAAiC;AAAA,IAElF,IAAI,eAAe,SAAS,KAAK,4BAA4B;AAAA,MACzD,MAAM,MAAM,mGAAmG;AAAA,IACnH;AAAA,IAGA,WAAW,YAAY;AAAA,IAEvB,UAAU,mBAAmB,CAAC;AAAA,EAClC;AAAA,EAEA,WAAW,YAAY;AAAA,EAEvB,WAAW,SAAS,qBAAqB,qBAAqB;AAAA,EAE9D,IAAI;AAAA,EACJ,IAAI;AAAA,IACA,aAAc,MAAM,UAAU,YAAY,IAAI,UAAU;AAAA,IAE5D,OAAO,KAAK;AAAA,IACR,MAAM,4BAA4B,EAAE,OAAO,KAAK,SAAS,WAAW,CAAC;AAAA;AAAA,EAEzE,IAAI,CAAC,YAAY;AAAA,IACb,MAAM,IAAI,MAAM,kCAAkC;AAAA,EACtD;AAAA,EACA,QAAQ,IAAI,OAAO,UAAU,SAAS;AAAA,EACtC,IAAI,aAAa;AAAA,EACjB,IAAI,SAAS,YAAY;AAAA,IACrB,aAAa,wBAAwB,SAAS,UAAU;AAAA,EAC5D;AAAA,EAEA,OAAO;AAAA,IACH;AAAA,IACA,OAAO,wBAAwB,KAAK;AAAA,IACpC,UAAU;AAAA,MACN,mBAAmB,wBAAwB,SAAS,iBAAiB;AAAA,MACrE,gBAAgB,wBAAwB,SAAS,cAAc;AAAA,MAC/D,WAAW,wBAAwB,SAAS,SAAS;AAAA,MACrD;AAAA,IACJ;AAAA,IACA;AAAA,IACA,wBAAwB,WAAW,0BAA0B;AAAA,IAC7D,yBAAyB,0BAA0B,WAAW,uBAAuB;AAAA,EACzF;AAAA;AAAA;AAAA,EA3FJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;;;ACAO,SAAS,gCAAgC,GAAG;AAAA,EAC/C,IAAI,CAAC,wBAAwB,GAAG;AAAA,IAC5B,OAAO,IAAI,QAAQ,CAAC,YAAY,QAAQ,KAAK,CAAC;AAAA,EAClD;AAAA,EACA,OAAO,oBAAoB,8CAA8C;AAAA;AAAA;AAAA,EAX7E;AAAA;;;;;;;;;;;;;;;;;;;;;ECAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;;;ACLA;;;ACiBA,IAAM,cAAc,YAAY;AAAA,EAC/B,MAAM,MAKJ;AAAA,EAKF,OAAO;AAAA;AAGR,IAAM,WAAW,CAAC,YAAsC;AAAA,EACvD,MAAM;AAAA,EACN,SAAS,kBAAkB,QAAQ,OAAO,UAAU;AAAA,EACpD,QAAQ;AACT;AAMO,IAAM,+BAA+B,OAAO,WAAuB;AAAA,EACzE,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,qBAAqB;AAAA,IACjE,OAAO;AAAA,MACN,MAAM;AAAA,MACN,OAAO,SAAS,IAAI,MAAM,sBAAsB,CAAC;AAAA,IAClD;AAAA,EACD;AAAA,EACA,MAAM,UAAU,MAAM,OAAO,SAAS,oBAAoB;AAAA,EAC1D,IAAI,QAAQ;AAAA,IAAO,OAAO,EAAE,MAAM,MAAM,OAAO,QAAQ,MAAM;AAAA,EAC7D,IAAI;AAAA,IACH,QAAQ,8CAAwB,MAAM,YAAY;AAAA,IAClD,MAAM,aAAa,MAAM,qBAAoB;AAAA,MAC5C,aAAa,QAAQ;AAAA,MACrB,oBAAoB;AAAA,IACrB,CAAC;AAAA,IAED,OAAO,OAAO,SAAS,mBAAmB,UAAU;AAAA,IACnD,OAAO,QAAQ;AAAA,IAChB,OAAO,EAAE,MAAM,MAAM,OAAO,SAAS,MAAM,EAAE;AAAA;AAAA;AAOxC,IAAM,yBAAyB,OAAO,WAAuB;AAAA,EACnE,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,qBAAqB;AAAA,IACjE,OAAO;AAAA,MACN,MAAM;AAAA,MACN,OAAO,SAAS,IAAI,MAAM,sBAAsB,CAAC;AAAA,IAClD;AAAA,EACD;AAAA,EACA,MAAM,UAAU,MAAM,OAAO,SAAS,gBAAgB;AAAA,EACtD,IAAI,QAAQ;AAAA,IAAO,OAAO,EAAE,MAAM,MAAM,OAAO,QAAQ,MAAM;AAAA,EAC7D,IAAI;AAAA,IACH,QAAQ,0CAAsB,MAAM,YAAY;AAAA,IAChD,MAAM,aAAa,MAAM,mBAAkB;AAAA,MAC1C,aAAa,QAAQ;AAAA,IACtB,CAAC;AAAA,IAED,OAAO,OAAO,SAAS,eAAe,UAAU;AAAA,IAC/C,OAAO,QAAQ;AAAA,IAChB,OAAO,EAAE,MAAM,MAAM,OAAO,SAAS,MAAM,EAAE;AAAA;AAAA;;;AD9D/C,IAAM,cAAc,CACnB,QAC+B;AAAA,EAC/B,MAAM,OAAyB,IAAI,IAAI;AAAA,EACvC,MAAM,QAAqC,IAAI,IAAI;AAAA,EACnD,MAAM,YAAY,IAAI,KAAK;AAAA,EAC3B,IAAI,QAAQ;AAAA,EACZ,eAAe,MAAM;AAAA,IACpB,QAAQ;AAAA,GACR;AAAA,EAED,MAAM,SAA8B,OAAO,SAAS;AAAA,IACnD,UAAU,QAAQ;AAAA,IAClB,MAAM,QAAQ;AAAA,IACd,MAAM,SAAS,MAAM,IAAI,IAAI;AAAA,IAC7B,IAAI,OAAO;AAAA,MACV,KAAK,QAAQ,OAAO;AAAA,MACpB,MAAM,QAAQ,OAAO;AAAA,MACrB,UAAU,QAAQ;AAAA,IACnB;AAAA,IAEA,OAAO;AAAA;AAAA,EAGR,MAAM,QAAQ,MAAM;AAAA,IACnB,KAAK,QAAQ;AAAA,IACb,MAAM,QAAQ;AAAA,IACd,UAAU,QAAQ;AAAA;AAAA,EAGnB,OAAO,EAAE,MAAM,OAAO,WAAW,QAAQ,MAAM;AAAA;AAGzC,IAAM,eAAe,CAAC,WAC5B,YAAY,OAAO,aAAa,gBAAgB;AAI1C,IAAM,qBAAqB,CAAC,WAAuB;AAAA,EACzD,MAAM,OAAgD,IAAI,IAAI;AAAA,EAC9D,MAAM,QAAqC,IAAI,IAAI;AAAA,EACnD,MAAM,YAAY,IAAI,KAAK;AAAA,EAC3B,IAAI,QAAQ;AAAA,EACZ,eAAe,MAAM;AAAA,IACpB,QAAQ;AAAA,GACR;AAAA,EAED,MAAM,QAAQ,YAAY;AAAA,IACzB,UAAU,QAAQ;AAAA,IAClB,MAAM,QAAQ;AAAA,IACd,MAAM,SAAS,MAAM,6BAA6B,MAAM;AAAA,IACxD,IAAI,OAAO;AAAA,MACV,KAAK,QAAQ,OAAO;AAAA,MACpB,MAAM,QAAQ,OAAO;AAAA,MACrB,UAAU,QAAQ;AAAA,IACnB;AAAA;AAAA,EAGD,MAAM,SAAS,MAAM;AAAA,IACpB,UAAU,QAAQ;AAAA;AAAA,EAGnB,OAAO,EAAE,QAAQ,MAAM,OAAO,WAAW,MAAM;AAAA;AAKzC,IAAM,sBAAsB,CAAC,WAAuB;AAAA,EAC1D,MAAM,WAAkC,IAAI,IAAI;AAAA,EAChD,MAAM,QAAqC,IAAI,IAAI;AAAA,EACnD,MAAM,YAAY,IAAI,IAAI;AAAA,EAC1B,IAAI,QAAQ;AAAA,EACZ,eAAe,MAAM;AAAA,IACpB,QAAQ;AAAA,GACR;AAAA,EAED,MAAM,UAAU,YAAY;AAAA,IAC3B,UAAU,QAAQ;AAAA,IAClB,MAAM,SAAS,MAAM,OAAO,SAAS,KAAK;AAAA,IAC1C,IAAI,OAAO;AAAA,MACV,SAAS,QAAQ,OAAO;AAAA,MACxB,MAAM,QAAQ,OAAO;AAAA,MACrB,UAAU,QAAQ;AAAA,IACnB;AAAA;AAAA,EAGD,MAAM,WAAW,YAAY;AAAA,IAC5B,MAAM,SAAS,MAAM,uBAAuB,MAAM;AAAA,IAClD,IAAI,OAAO,UAAU;AAAA,MAAM,MAAM,QAAQ;AAAA,IAEzC,OAAO;AAAA;AAAA,EAGH,QAAQ;AAAA,EACb,MAAM,eAAe,IAAI,KAAK;AAAA,EAC9B,MAAM,qBAAqB,MAAM;AAAA,IAChC,aAAa,QACZ,SAAS,UAAU,QAAQ,SAAS,MAAM,WAAW;AAAA;AAAA,EAGvD,MAAM,iBAAiB,YAAY;AAAA,IAClC,MAAM,QAAQ;AAAA,IACd,mBAAmB;AAAA;AAAA,EAEpB,MAAM,kBAAkB,YAAY;AAAA,IACnC,MAAM,SAAS,MAAM,SAAS;AAAA,IAC9B,mBAAmB;AAAA,IAEnB,OAAO;AAAA;AAAA,EAGR,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,UAAU;AAAA,IACV;AAAA,EACD;AAAA;AAGM,IAAM,kBAAkB,CAAC,WAC/B,YAAY,OAAO,IAAI,SAAS;AAE1B,IAAM,mBAAmB,CAAC,WAChC,YAAY,OAAO,cAAc,OAAO;AAKlC,IAAM,cAAc,CAAC,WAAuB;AAAA,EAClD,MAAM,OAA8B,IAAI,IAAI;AAAA,EAC5C,MAAM,QAAqC,IAAI,IAAI;AAAA,EACnD,MAAM,YAAY,IAAI,IAAI;AAAA,EAC1B,IAAI,QAAQ;AAAA,EACZ,eAAe,MAAM;AAAA,IACpB,QAAQ;AAAA,GACR;AAAA,EAED,MAAM,UAAU,YAAY;AAAA,IAC3B,UAAU,QAAQ;AAAA,IAClB,MAAM,SAAS,MAAM,OAAO,SAAS,KAAK;AAAA,IAC1C,IAAI,OAAO;AAAA,MACV,KAAK,QAAQ,OAAO;AAAA,MACpB,MAAM,QAAQ,OAAO;AAAA,MACrB,UAAU,QAAQ;AAAA,IACnB;AAAA;AAAA,EAGD,MAAM,SAAS,OAAO,cAAsB;AAAA,IAC3C,MAAM,SAAS,MAAM,OAAO,SAAS,OAAO,SAAS;AAAA,IACrD,IAAI,OAAO,UAAU;AAAA,MAAM,MAAM,QAAQ;AAAA,IAEzC,OAAO;AAAA;AAAA,EAGH,QAAQ;AAAA,EAEb,OAAO,EAAE,MAAM,OAAO,WAAW,SAAS,OAAO;AAAA;AAG3C,IAAM,YAAY,CAAC,WACzB,YAAY,OAAO,OAAO,KAAK;AAEzB,IAAM,aAAa,CAAC,WAAuB,YAAY,OAAO,OAAO;AAErE,IAAM,YAAY,CAAC,WACzB,YAAY,OAAO,OAAO,KAAK;",
-  "debugId": "C5E071974ABF18D364756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA;;;ACQA,IAAM,cAAc,MAAa;AAEjC,IAAM,WAAW,CAAC,YAAsC;AAAA,EACvD,MAAM;AAAA,EACN,SAAS,kBAAkB,QAAQ,OAAO,UAAU;AAAA,EACpD,QAAQ;AACT;AAMO,IAAM,+BAA+B,OAAO,WAAuB;AAAA,EACzE,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,qBAAqB;AAAA,IACjE,OAAO;AAAA,MACN,MAAM;AAAA,MACN,OAAO,SAAS,IAAI,MAAM,sBAAsB,CAAC;AAAA,IAClD;AAAA,EACD;AAAA,EACA,MAAM,UAAU,MAAM,OAAO,SAAS,oBAAoB;AAAA,EAC1D,IAAI,QAAQ;AAAA,IAAO,OAAO,EAAE,MAAM,MAAM,OAAO,QAAQ,MAAM;AAAA,EAC7D,IAAI;AAAA,IACH,QAAQ,wBAAwB,MAAM,YAAY;AAAA,IAClD,MAAM,aAAa,MAAM,oBAAoB;AAAA,MAC5C,aAAa,QAAQ;AAAA,MACrB,oBAAoB;AAAA,IACrB,CAAC;AAAA,IAED,OAAO,OAAO,SAAS,mBAAmB,UAAU;AAAA,IACnD,OAAO,QAAQ;AAAA,IAChB,OAAO,EAAE,MAAM,MAAM,OAAO,SAAS,MAAM,EAAE;AAAA;AAAA;AAOxC,IAAM,yBAAyB,OAAO,WAAuB;AAAA,EACnE,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,qBAAqB;AAAA,IACjE,OAAO;AAAA,MACN,MAAM;AAAA,MACN,OAAO,SAAS,IAAI,MAAM,sBAAsB,CAAC;AAAA,IAClD;AAAA,EACD;AAAA,EACA,MAAM,UAAU,MAAM,OAAO,SAAS,gBAAgB;AAAA,EACtD,IAAI,QAAQ;AAAA,IAAO,OAAO,EAAE,MAAM,MAAM,OAAO,QAAQ,MAAM;AAAA,EAC7D,IAAI;AAAA,IACH,QAAQ,sBAAsB,MAAM,YAAY;AAAA,IAChD,MAAM,aAAa,MAAM,kBAAkB;AAAA,MAC1C,aAAa,QAAQ;AAAA,IACtB,CAAC;AAAA,IAED,OAAO,OAAO,SAAS,eAAe,UAAU;AAAA,IAC/C,OAAO,QAAQ;AAAA,IAChB,OAAO,EAAE,MAAM,MAAM,OAAO,SAAS,MAAM,EAAE;AAAA;AAAA;;;ADzC/C,IAAM,cAAc,CACnB,QAC+B;AAAA,EAC/B,MAAM,OAAyB,IAAI,IAAI;AAAA,EACvC,MAAM,QAAqC,IAAI,IAAI;AAAA,EACnD,MAAM,YAAY,IAAI,KAAK;AAAA,EAC3B,IAAI,QAAQ;AAAA,EACZ,eAAe,MAAM;AAAA,IACpB,QAAQ;AAAA,GACR;AAAA,EAED,MAAM,SAA8B,OAAO,SAAS;AAAA,IACnD,UAAU,QAAQ;AAAA,IAClB,MAAM,QAAQ;AAAA,IACd,MAAM,SAAS,MAAM,IAAI,IAAI;AAAA,IAC7B,IAAI,OAAO;AAAA,MACV,KAAK,QAAQ,OAAO;AAAA,MACpB,MAAM,QAAQ,OAAO;AAAA,MACrB,UAAU,QAAQ;AAAA,IACnB;AAAA,IAEA,OAAO;AAAA;AAAA,EAGR,MAAM,QAAQ,MAAM;AAAA,IACnB,KAAK,QAAQ;AAAA,IACb,MAAM,QAAQ;AAAA,IACd,UAAU,QAAQ;AAAA;AAAA,EAGnB,OAAO,EAAE,MAAM,OAAO,WAAW,QAAQ,MAAM;AAAA;AAGzC,IAAM,eAAe,CAAC,WAC5B,YAAY,OAAO,aAAa,gBAAgB;AAC1C,IAAM,kBAAkB,CAAC,WAC/B,YAAY,OAAO,IAAI,SAAS;AAC1B,IAAM,qBAAqB,CAAC,WAAuB;AAAA,EACzD,MAAM,OAAgD,IAAI,IAAI;AAAA,EAC9D,MAAM,QAAqC,IAAI,IAAI;AAAA,EACnD,MAAM,YAAY,IAAI,KAAK;AAAA,EAC3B,IAAI,QAAQ;AAAA,EACZ,eAAe,MAAM;AAAA,IACpB,QAAQ;AAAA,GACR;AAAA,EAED,MAAM,QAAQ,YAAY;AAAA,IACzB,UAAU,QAAQ;AAAA,IAClB,MAAM,QAAQ;AAAA,IACd,MAAM,SAAS,MAAM,6BAA6B,MAAM;AAAA,IACxD,IAAI,OAAO;AAAA,MACV,KAAK,QAAQ,OAAO;AAAA,MACpB,MAAM,QAAQ,OAAO;AAAA,MACrB,UAAU,QAAQ;AAAA,IACnB;AAAA;AAAA,EAGD,MAAM,SAAS,MAAM;AAAA,IACpB,UAAU,QAAQ;AAAA;AAAA,EAGnB,OAAO,EAAE,QAAQ,MAAM,OAAO,WAAW,MAAM;AAAA;AAEzC,IAAM,mBAAmB,CAAC,WAChC,YAAY,OAAO,cAAc,OAAO;AAClC,IAAM,cAAc,CAAC,WAAuB;AAAA,EAClD,MAAM,OAA8B,IAAI,IAAI;AAAA,EAC5C,MAAM,QAAqC,IAAI,IAAI;AAAA,EACnD,MAAM,YAAY,IAAI,IAAI;AAAA,EAC1B,IAAI,QAAQ;AAAA,EACZ,eAAe,MAAM;AAAA,IACpB,QAAQ;AAAA,GACR;AAAA,EAED,MAAM,UAAU,YAAY;AAAA,IAC3B,UAAU,QAAQ;AAAA,IAClB,MAAM,SAAS,MAAM,OAAO,SAAS,KAAK;AAAA,IAC1C,IAAI,OAAO;AAAA,MACV,KAAK,QAAQ,OAAO;AAAA,MACpB,MAAM,QAAQ,OAAO;AAAA,MACrB,UAAU,QAAQ;AAAA,IACnB;AAAA;AAAA,EAGD,MAAM,SAAS,OAAO,cAAsB;AAAA,IAC3C,MAAM,SAAS,MAAM,OAAO,SAAS,OAAO,SAAS;AAAA,IACrD,IAAI,OAAO,UAAU;AAAA,MAAM,MAAM,QAAQ;AAAA,IAEzC,OAAO;AAAA;AAAA,EAGH,QAAQ;AAAA,EAEb,OAAO,EAAE,MAAM,OAAO,WAAW,SAAS,OAAO;AAAA;AAE3C,IAAM,YAAY,CAAC,WACzB,YAAY,OAAO,OAAO,KAAK;AACzB,IAAM,aAAa,CAAC,WAAuB,YAAY,OAAO,OAAO;AACrE,IAAM,YAAY,CAAC,WACzB,YAAY,OAAO,OAAO,KAAK;AACzB,IAAM,sBAAsB,CAAC,WAAuB;AAAA,EAC1D,MAAM,WAAkC,IAAI,IAAI;AAAA,EAChD,MAAM,QAAqC,IAAI,IAAI;AAAA,EACnD,MAAM,YAAY,IAAI,IAAI;AAAA,EAC1B,IAAI,QAAQ;AAAA,EACZ,eAAe,MAAM;AAAA,IACpB,QAAQ;AAAA,GACR;AAAA,EAED,MAAM,UAAU,YAAY;AAAA,IAC3B,UAAU,QAAQ;AAAA,IAClB,MAAM,SAAS,MAAM,OAAO,SAAS,KAAK;AAAA,IAC1C,IAAI,OAAO;AAAA,MACV,SAAS,QAAQ,OAAO;AAAA,MACxB,MAAM,QAAQ,OAAO;AAAA,MACrB,UAAU,QAAQ;AAAA,IACnB;AAAA;AAAA,EAGD,MAAM,WAAW,YAAY;AAAA,IAC5B,MAAM,SAAS,MAAM,uBAAuB,MAAM;AAAA,IAClD,IAAI,OAAO,UAAU;AAAA,MAAM,MAAM,QAAQ;AAAA,IAEzC,OAAO;AAAA;AAAA,EAGH,QAAQ;AAAA,EACb,MAAM,eAAe,IAAI,KAAK;AAAA,EAC9B,MAAM,qBAAqB,MAAM;AAAA,IAChC,aAAa,QACZ,SAAS,UAAU,QAAQ,SAAS,MAAM,WAAW;AAAA;AAAA,EAGvD,MAAM,iBAAiB,YAAY;AAAA,IAClC,MAAM,QAAQ;AAAA,IACd,mBAAmB;AAAA;AAAA,EAEpB,MAAM,kBAAkB,YAAY;AAAA,IACnC,MAAM,SAAS,MAAM,SAAS;AAAA,IAC9B,mBAAmB;AAAA,IAEnB,OAAO;AAAA;AAAA,EAGR,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,UAAU;AAAA,IACV;AAAA,EACD;AAAA;",
+  "debugId": "EE211E94DA65525164756E2164756E21",
   "names": []
 }

package/dist/credentials/import.d.ts

@@ -21,7 +21,22 @@ export type ImportUsersOptions<UserType> = {
     concurrency?: number;
     credentialStore: CredentialStore;
 };
-export declare const importUser: <UserType>(input: ImportableUser<UserType>, options: ImportUsersOptions<UserType>) => Promise<ImportUserResult<UserType>>;
+export declare const importUser: <UserType>(input: ImportableUser<UserType>, options: ImportUsersOptions<UserType>) => Promise<{
+    error: string;
+    ok: false;
+    user: UserType;
+    credential?: undefined;
+} | {
+    ok: true;
+    user: UserType;
+    readonly error?: undefined;
+    credential?: undefined;
+} | {
+    credential: CredentialRecord;
+    ok: true;
+    user: UserType;
+    readonly error?: undefined;
+}>;
 export declare const importUsers: <UserType>(inputs: readonly ImportableUser<UserType>[], options: ImportUsersOptions<UserType>) => Promise<{
     failed: number;
     results: ImportUserResult<UserType>[];

package/dist/credentials/register.d.ts

@@ -29,7 +29,7 @@ export declare const credentialsRegister: <UserType>({ authSessionStore, cookieS
             query: unknown;
             headers: unknown;
             response: {
-                [x: string]: any;
+                [x: number]: {};
             };
         };
     };

package/dist/credentials/routes.d.ts

@@ -29,7 +29,7 @@ export declare const credentialRoutes: <UserType>(config: CredentialRouteProps<U
             query: unknown;
             headers: unknown;
             response: {
-                [x: string]: any;
+                [x: number]: {};
             };
         };
     };

package/dist/fingerprint-client/index.js

@@ -51,11 +51,12 @@ var readCanvas = () => {
     return;
   }
 };
+var isOfflineAudioContextCtor = (value) => typeof value === "function";
 var resolveOfflineAudioContextCtor = () => {
   if (typeof OfflineAudioContext !== "undefined")
     return OfflineAudioContext;
-  const legacy = globalThis;
-  return legacy.webkitOfflineAudioContext;
+  const legacy = Reflect.get(globalThis, "webkitOfflineAudioContext");
+  return isOfflineAudioContextCtor(legacy) ? legacy : undefined;
 };
 var sumAbs = (samples) => {
   let total = 0;
@@ -182,5 +183,5 @@ export {
   collectDeviceFingerprint
 };
 
-//# debugId=58DA2A773086368664756E2164756E21
+//# debugId=5AAB5F70FF6848B464756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/fingerprint-client/index.js.map

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../../src/fingerprint-client/index.ts"],
   "sourcesContent": [
-    "// Browser-side device fingerprint collector.\n//\n// `collectDeviceFingerprint()` reads ~10 signals from the browser (canvas render,\n// AudioContext, WebGL renderer, font enumeration, screen geometry, navigator.languages,\n// timezone, hardware concurrency, device memory, pixel ratio), normalizes them, and\n// hashes the canonical JSON into a stable base64url SHA-256 `deviceId`.\n//\n// Self-hosted equivalent of FingerprintJS's open-source library. Each individual signal\n// is weak on its own — but their combination is highly stable across sessions for the\n// same browser+device, and varies sharply across different browsers/devices. The same\n// algorithms underpin every commercial fingerprinter; only the proprietary data network\n// (cross-customer reputation) is what SaaS vendors charge for, and that's a non-goal here.\n//\n// Imported via `@absolutejs/auth/fingerprint-client` — server bundle does NOT pull this in\n// (browser globals like `window` would explode there). The client SDK + your sign-in form\n// call this, send the result as `x-client-fingerprint`, and the server (riskConfig / adaptive)\n// uses it as the deviceId instead of the weak UA+IP fallback.\n\nconst CANVAS_TEXT = 'absoluteAuth-fp 🔐';\nconst CANVAS_WIDTH = 280;\nconst CANVAS_HEIGHT = 60;\nconst AUDIO_SAMPLES_COUNT = 4500;\nconst AUDIO_OSC_FREQ = 10_000;\nconst AUDIO_COMPRESSOR_THRESHOLD = -50;\nconst AUDIO_COMPRESSOR_KNEE = 40;\nconst AUDIO_COMPRESSOR_RATIO = 12;\nconst AUDIO_COMPRESSOR_ATTACK = 0;\nconst AUDIO_COMPRESSOR_RELEASE = 0.25;\nconst AUDIO_SAMPLE_RATE = 44_100;\nconst FONT_PROBE = 'mmmmmmmmmlli';\nconst FONT_PROBE_PX = '72px';\nconst FONT_PROBE_OFFSCREEN_PX = -9999;\nconst FONT_BASE_FAMILIES = ['monospace', 'sans-serif', 'serif'] as const;\nconst POPULAR_FONTS = [\n\t'Arial',\n\t'Arial Black',\n\t'Comic Sans MS',\n\t'Courier New',\n\t'Georgia',\n\t'Helvetica',\n\t'Impact',\n\t'Lucida Console',\n\t'Times New Roman',\n\t'Trebuchet MS',\n\t'Verdana',\n\t'monospace',\n\t'sans-serif',\n\t'serif'\n];\n\nexport type FingerprintSignals = {\n\taudio?: number;\n\tcanvas?: string;\n\tdeviceMemory?: number;\n\tfonts?: string[];\n\thardwareConcurrency?: number;\n\tlanguages?: readonly string[];\n\tpixelRatio?: number;\n\tplatform?: string;\n\tscreen?: { colorDepth: number; height: number; width: number };\n\ttimezone?: string;\n\tuserAgent?: string;\n\twebgl?: { renderer?: string; vendor?: string };\n};\n\nexport type DeviceFingerprint = {\n\tdeviceId: string;\n\tsignals: FingerprintSignals;\n};\n\n// Canvas hash: render text + a curve + a couple of rectangles + return the data URL\n// (its pixel content hashes differently across GPUs, drivers, browser versions, font\n// renderers). Wrapped in try/catch because privacy-mode browsers throw on getContext.\nconst readCanvas = () => {\n\ttry {\n\t\tconst canvas = document.createElement('canvas');\n\t\tcanvas.width = CANVAS_WIDTH;\n\t\tcanvas.height = CANVAS_HEIGHT;\n\t\tconst context = canvas.getContext('2d');\n\t\tif (context === null) return undefined;\n\t\tcontext.textBaseline = 'top';\n\t\tcontext.font = '14px Arial';\n\t\tcontext.fillStyle = '#f60';\n\t\tcontext.fillRect(125, 1, 62, 20);\n\t\tcontext.fillStyle = '#069';\n\t\tcontext.fillText(CANVAS_TEXT, 2, 15);\n\t\tcontext.fillStyle = 'rgba(102, 204, 0, 0.7)';\n\t\tcontext.fillText(CANVAS_TEXT, 4, 17);\n\n\t\treturn canvas.toDataURL();\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\ntype LegacyOfflineCtxGlobal = {\n\twebkitOfflineAudioContext?: typeof OfflineAudioContext;\n};\n\nconst resolveOfflineAudioContextCtor = () => {\n\tif (typeof OfflineAudioContext !== 'undefined') return OfflineAudioContext;\n\t// eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- vendor-prefixed legacy API; no TS type ships for it\n\tconst legacy = globalThis as LegacyOfflineCtxGlobal;\n\n\treturn legacy.webkitOfflineAudioContext;\n};\n\nconst sumAbs = (samples: Float32Array) => {\n\tlet total = 0;\n\tfor (const sample of samples) total += Math.abs(sample);\n\n\treturn total;\n};\n\n// Audio hash: instantiate an offline audio context, push a brief oscillator + dynamics\n// compressor through it, read back the rendered buffer's sum. Different audio stacks\n// produce subtly different floating-point outputs.\nconst readAudio = async () => {\n\ttry {\n\t\tconst ContextCtor = resolveOfflineAudioContextCtor();\n\t\tif (ContextCtor === undefined) return undefined;\n\t\tconst context = new ContextCtor(\n\t\t\t1,\n\t\t\tAUDIO_SAMPLES_COUNT,\n\t\t\tAUDIO_SAMPLE_RATE\n\t\t);\n\t\tconst oscillator = context.createOscillator();\n\t\toscillator.type = 'triangle';\n\t\toscillator.frequency.value = AUDIO_OSC_FREQ;\n\t\tconst compressor = context.createDynamicsCompressor();\n\t\tcompressor.threshold.value = AUDIO_COMPRESSOR_THRESHOLD;\n\t\tcompressor.knee.value = AUDIO_COMPRESSOR_KNEE;\n\t\tcompressor.ratio.value = AUDIO_COMPRESSOR_RATIO;\n\t\t// `reduction` is read-only on the modern spec (the constant exists for the\n\t\t// outdated browsers that originally exposed it as a writable AudioParam;\n\t\t// we don't bother setting it — the fingerprint is plenty stable without).\n\t\tcompressor.attack.value = AUDIO_COMPRESSOR_ATTACK;\n\t\tcompressor.release.value = AUDIO_COMPRESSOR_RELEASE;\n\t\toscillator.connect(compressor);\n\t\tcompressor.connect(context.destination);\n\t\toscillator.start(0);\n\t\tconst buffer = await context.startRendering();\n\n\t\treturn sumAbs(buffer.getChannelData(0));\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// WebGL hash: the renderer + vendor strings include GPU model + driver — highly stable,\n// highly distinctive. Behind the WEBGL_debug_renderer_info extension on most browsers.\nconst readWebgl = () => {\n\ttry {\n\t\tconst canvas = document.createElement('canvas');\n\t\tconst context =\n\t\t\tcanvas.getContext('webgl') ??\n\t\t\tcanvas.getContext('experimental-webgl');\n\t\tif (\n\t\t\tcontext === null ||\n\t\t\t!('getExtension' in context) ||\n\t\t\t!('getParameter' in context)\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst debug = context.getExtension('WEBGL_debug_renderer_info');\n\t\tif (debug === null) return undefined;\n\n\t\treturn {\n\t\t\trenderer: String(\n\t\t\t\tcontext.getParameter(debug.UNMASKED_RENDERER_WEBGL) ?? ''\n\t\t\t),\n\t\t\tvendor: String(\n\t\t\t\tcontext.getParameter(debug.UNMASKED_VENDOR_WEBGL) ?? ''\n\t\t\t)\n\t\t};\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// Width of `probe` rendered in `family` on the given span — used to detect installed\n// fonts (different widths than the fallback ⇒ font is present).\nconst measureFamily = (span: HTMLSpanElement, family: string) => {\n\tspan.style.fontFamily = family;\n\n\treturn span.offsetWidth;\n};\n\nconst detectFontPresent = (\n\tspan: HTMLSpanElement,\n\tfont: string,\n\tbaseline: Record<string, number>\n) =>\n\tFONT_BASE_FAMILIES.some(\n\t\t(family) =>\n\t\t\tmeasureFamily(span, `'${font}', ${family}`) !== baseline[family]\n\t);\n\n// Font enumeration: a font is \"installed\" if the rendered width of a probe string differs\n// from the same string in a known fallback. Compares against monospace + sans-serif +\n// serif and counts a match if any of them produce a different width.\nconst readFonts = () => {\n\ttry {\n\t\tconst span = document.createElement('span');\n\t\tspan.style.position = 'absolute';\n\t\tspan.style.left = `${FONT_PROBE_OFFSCREEN_PX}px`;\n\t\tspan.style.fontSize = FONT_PROBE_PX;\n\t\tspan.textContent = FONT_PROBE;\n\t\tdocument.body.appendChild(span);\n\n\t\tconst baseline: Record<string, number> = Object.fromEntries(\n\t\t\tFONT_BASE_FAMILIES.map((family) => [\n\t\t\t\tfamily,\n\t\t\t\tmeasureFamily(span, family)\n\t\t\t])\n\t\t);\n\t\tconst present = POPULAR_FONTS.filter((font) =>\n\t\t\tdetectFontPresent(span, font, baseline)\n\t\t);\n\n\t\tdocument.body.removeChild(span);\n\n\t\treturn present;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\nconst readScreen = () => {\n\tif (typeof screen === 'undefined') return undefined;\n\n\treturn {\n\t\tcolorDepth: screen.colorDepth,\n\t\theight: screen.height,\n\t\twidth: screen.width\n\t};\n};\n\nconst readTimezone = () => {\n\ttry {\n\t\treturn Intl.DateTimeFormat().resolvedOptions().timeZone;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// Canonical JSON identical to the server-side `fingerprintDevice` canonicalizer: keys\n// sorted at every depth so identical signals produce identical hashes regardless of\n// insertion order. Inlined here to keep the client bundle free of server-side imports.\nconst canonical = (signals: FingerprintSignals) =>\n\tJSON.stringify(signals, (_key, value) =>\n\t\tvalue === null || typeof value !== 'object' || Array.isArray(value)\n\t\t\t? value\n\t\t\t: Object.fromEntries(\n\t\t\t\t\tObject.entries(value).sort((left, right) =>\n\t\t\t\t\t\tleft[0].localeCompare(right[0])\n\t\t\t\t\t)\n\t\t\t\t)\n\t);\n\nconst sha256Base64Url = async (input: string) => {\n\tconst bytes = await crypto.subtle.digest(\n\t\t'SHA-256',\n\t\tnew TextEncoder().encode(input)\n\t);\n\tconst binary = String.fromCharCode(...new Uint8Array(bytes));\n\n\treturn btoa(binary)\n\t\t.replace(/\\+/g, '-')\n\t\t.replace(/\\//g, '_')\n\t\t.replace(/=+$/, '');\n};\n\n// Collect every signal we can, hash them, return both so the caller can persist the raw\n// signals (for debugging / drift detection) while sending just the deviceId on the wire.\nexport const collectDeviceFingerprint =\n\tasync (): Promise<DeviceFingerprint> => {\n\t\tif (typeof window === 'undefined' || typeof document === 'undefined') {\n\t\t\tthrow new Error(\n\t\t\t\t'collectDeviceFingerprint must run in a browser — server-side use the @absolutejs/auth fingerprintDevice helper instead'\n\t\t\t);\n\t\t}\n\t\tconst [canvas, audio, webgl, fonts] = await Promise.all([\n\t\t\tPromise.resolve(readCanvas()),\n\t\t\treadAudio(),\n\t\t\tPromise.resolve(readWebgl()),\n\t\t\tPromise.resolve(readFonts())\n\t\t]);\n\n\t\tconst deviceMemory =\n\t\t\t'deviceMemory' in navigator\n\t\t\t\t? Reflect.get(navigator, 'deviceMemory')\n\t\t\t\t: undefined;\n\t\tconst signals: FingerprintSignals = {\n\t\t\taudio,\n\t\t\tcanvas,\n\t\t\tdeviceMemory:\n\t\t\t\ttypeof deviceMemory === 'number' ? deviceMemory : undefined,\n\t\t\tfonts,\n\t\t\thardwareConcurrency: navigator.hardwareConcurrency,\n\t\t\tlanguages: navigator.languages,\n\t\t\tpixelRatio: window.devicePixelRatio,\n\t\t\tplatform: navigator.platform,\n\t\t\tscreen: readScreen(),\n\t\t\ttimezone: readTimezone(),\n\t\t\tuserAgent: navigator.userAgent,\n\t\t\twebgl\n\t\t};\n\n\t\treturn { deviceId: await sha256Base64Url(canonical(signals)), signals };\n\t};\n"
+    "// Browser-side device fingerprint collector.\n//\n// `collectDeviceFingerprint()` reads ~10 signals from the browser (canvas render,\n// AudioContext, WebGL renderer, font enumeration, screen geometry, navigator.languages,\n// timezone, hardware concurrency, device memory, pixel ratio), normalizes them, and\n// hashes the canonical JSON into a stable base64url SHA-256 `deviceId`.\n//\n// Self-hosted equivalent of FingerprintJS's open-source library. Each individual signal\n// is weak on its own — but their combination is highly stable across sessions for the\n// same browser+device, and varies sharply across different browsers/devices. The same\n// algorithms underpin every commercial fingerprinter; only the proprietary data network\n// (cross-customer reputation) is what SaaS vendors charge for, and that's a non-goal here.\n//\n// Imported via `@absolutejs/auth/fingerprint-client` — server bundle does NOT pull this in\n// (browser globals like `window` would explode there). The client SDK + your sign-in form\n// call this, send the result as `x-client-fingerprint`, and the server (riskConfig / adaptive)\n// uses it as the deviceId instead of the weak UA+IP fallback.\n\nconst CANVAS_TEXT = 'absoluteAuth-fp 🔐';\nconst CANVAS_WIDTH = 280;\nconst CANVAS_HEIGHT = 60;\nconst AUDIO_SAMPLES_COUNT = 4500;\nconst AUDIO_OSC_FREQ = 10_000;\nconst AUDIO_COMPRESSOR_THRESHOLD = -50;\nconst AUDIO_COMPRESSOR_KNEE = 40;\nconst AUDIO_COMPRESSOR_RATIO = 12;\nconst AUDIO_COMPRESSOR_ATTACK = 0;\nconst AUDIO_COMPRESSOR_RELEASE = 0.25;\nconst AUDIO_SAMPLE_RATE = 44_100;\nconst FONT_PROBE = 'mmmmmmmmmlli';\nconst FONT_PROBE_PX = '72px';\nconst FONT_PROBE_OFFSCREEN_PX = -9999;\nconst FONT_BASE_FAMILIES = ['monospace', 'sans-serif', 'serif'] as const;\nconst POPULAR_FONTS = [\n\t'Arial',\n\t'Arial Black',\n\t'Comic Sans MS',\n\t'Courier New',\n\t'Georgia',\n\t'Helvetica',\n\t'Impact',\n\t'Lucida Console',\n\t'Times New Roman',\n\t'Trebuchet MS',\n\t'Verdana',\n\t'monospace',\n\t'sans-serif',\n\t'serif'\n];\n\nexport type FingerprintSignals = {\n\taudio?: number;\n\tcanvas?: string;\n\tdeviceMemory?: number;\n\tfonts?: string[];\n\thardwareConcurrency?: number;\n\tlanguages?: readonly string[];\n\tpixelRatio?: number;\n\tplatform?: string;\n\tscreen?: { colorDepth: number; height: number; width: number };\n\ttimezone?: string;\n\tuserAgent?: string;\n\twebgl?: { renderer?: string; vendor?: string };\n};\n\nexport type DeviceFingerprint = {\n\tdeviceId: string;\n\tsignals: FingerprintSignals;\n};\n\n// Canvas hash: render text + a curve + a couple of rectangles + return the data URL\n// (its pixel content hashes differently across GPUs, drivers, browser versions, font\n// renderers). Wrapped in try/catch because privacy-mode browsers throw on getContext.\nconst readCanvas = () => {\n\ttry {\n\t\tconst canvas = document.createElement('canvas');\n\t\tcanvas.width = CANVAS_WIDTH;\n\t\tcanvas.height = CANVAS_HEIGHT;\n\t\tconst context = canvas.getContext('2d');\n\t\tif (context === null) return undefined;\n\t\tcontext.textBaseline = 'top';\n\t\tcontext.font = '14px Arial';\n\t\tcontext.fillStyle = '#f60';\n\t\tcontext.fillRect(125, 1, 62, 20);\n\t\tcontext.fillStyle = '#069';\n\t\tcontext.fillText(CANVAS_TEXT, 2, 15);\n\t\tcontext.fillStyle = 'rgba(102, 204, 0, 0.7)';\n\t\tcontext.fillText(CANVAS_TEXT, 4, 17);\n\n\t\treturn canvas.toDataURL();\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\nconst isOfflineAudioContextCtor = (\n\tvalue: unknown\n): value is typeof OfflineAudioContext => typeof value === 'function';\n\nconst resolveOfflineAudioContextCtor = () => {\n\tif (typeof OfflineAudioContext !== 'undefined') return OfflineAudioContext;\n\tconst legacy: unknown = Reflect.get(\n\t\tglobalThis,\n\t\t'webkitOfflineAudioContext'\n\t);\n\n\treturn isOfflineAudioContextCtor(legacy) ? legacy : undefined;\n};\n\nconst sumAbs = (samples: Float32Array) => {\n\tlet total = 0;\n\tfor (const sample of samples) total += Math.abs(sample);\n\n\treturn total;\n};\n\n// Audio hash: instantiate an offline audio context, push a brief oscillator + dynamics\n// compressor through it, read back the rendered buffer's sum. Different audio stacks\n// produce subtly different floating-point outputs.\nconst readAudio = async () => {\n\ttry {\n\t\tconst ContextCtor = resolveOfflineAudioContextCtor();\n\t\tif (ContextCtor === undefined) return undefined;\n\t\tconst context = new ContextCtor(\n\t\t\t1,\n\t\t\tAUDIO_SAMPLES_COUNT,\n\t\t\tAUDIO_SAMPLE_RATE\n\t\t);\n\t\tconst oscillator = context.createOscillator();\n\t\toscillator.type = 'triangle';\n\t\toscillator.frequency.value = AUDIO_OSC_FREQ;\n\t\tconst compressor = context.createDynamicsCompressor();\n\t\tcompressor.threshold.value = AUDIO_COMPRESSOR_THRESHOLD;\n\t\tcompressor.knee.value = AUDIO_COMPRESSOR_KNEE;\n\t\tcompressor.ratio.value = AUDIO_COMPRESSOR_RATIO;\n\t\t// `reduction` is read-only on the modern spec (the constant exists for the\n\t\t// outdated browsers that originally exposed it as a writable AudioParam;\n\t\t// we don't bother setting it — the fingerprint is plenty stable without).\n\t\tcompressor.attack.value = AUDIO_COMPRESSOR_ATTACK;\n\t\tcompressor.release.value = AUDIO_COMPRESSOR_RELEASE;\n\t\toscillator.connect(compressor);\n\t\tcompressor.connect(context.destination);\n\t\toscillator.start(0);\n\t\tconst buffer = await context.startRendering();\n\n\t\treturn sumAbs(buffer.getChannelData(0));\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// WebGL hash: the renderer + vendor strings include GPU model + driver — highly stable,\n// highly distinctive. Behind the WEBGL_debug_renderer_info extension on most browsers.\nconst readWebgl = () => {\n\ttry {\n\t\tconst canvas = document.createElement('canvas');\n\t\tconst context =\n\t\t\tcanvas.getContext('webgl') ??\n\t\t\tcanvas.getContext('experimental-webgl');\n\t\tif (\n\t\t\tcontext === null ||\n\t\t\t!('getExtension' in context) ||\n\t\t\t!('getParameter' in context)\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst debug = context.getExtension('WEBGL_debug_renderer_info');\n\t\tif (debug === null) return undefined;\n\n\t\treturn {\n\t\t\trenderer: String(\n\t\t\t\tcontext.getParameter(debug.UNMASKED_RENDERER_WEBGL) ?? ''\n\t\t\t),\n\t\t\tvendor: String(\n\t\t\t\tcontext.getParameter(debug.UNMASKED_VENDOR_WEBGL) ?? ''\n\t\t\t)\n\t\t};\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// Width of `probe` rendered in `family` on the given span — used to detect installed\n// fonts (different widths than the fallback ⇒ font is present).\nconst measureFamily = (span: HTMLSpanElement, family: string) => {\n\tspan.style.fontFamily = family;\n\n\treturn span.offsetWidth;\n};\n\nconst detectFontPresent = (\n\tspan: HTMLSpanElement,\n\tfont: string,\n\tbaseline: Record<string, number>\n) =>\n\tFONT_BASE_FAMILIES.some(\n\t\t(family) =>\n\t\t\tmeasureFamily(span, `'${font}', ${family}`) !== baseline[family]\n\t);\n\n// Font enumeration: a font is \"installed\" if the rendered width of a probe string differs\n// from the same string in a known fallback. Compares against monospace + sans-serif +\n// serif and counts a match if any of them produce a different width.\nconst readFonts = () => {\n\ttry {\n\t\tconst span = document.createElement('span');\n\t\tspan.style.position = 'absolute';\n\t\tspan.style.left = `${FONT_PROBE_OFFSCREEN_PX}px`;\n\t\tspan.style.fontSize = FONT_PROBE_PX;\n\t\tspan.textContent = FONT_PROBE;\n\t\tdocument.body.appendChild(span);\n\n\t\tconst baseline: Record<string, number> = Object.fromEntries(\n\t\t\tFONT_BASE_FAMILIES.map((family) => [\n\t\t\t\tfamily,\n\t\t\t\tmeasureFamily(span, family)\n\t\t\t])\n\t\t);\n\t\tconst present = POPULAR_FONTS.filter((font) =>\n\t\t\tdetectFontPresent(span, font, baseline)\n\t\t);\n\n\t\tdocument.body.removeChild(span);\n\n\t\treturn present;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\nconst readScreen = () => {\n\tif (typeof screen === 'undefined') return undefined;\n\n\treturn {\n\t\tcolorDepth: screen.colorDepth,\n\t\theight: screen.height,\n\t\twidth: screen.width\n\t};\n};\n\nconst readTimezone = () => {\n\ttry {\n\t\treturn Intl.DateTimeFormat().resolvedOptions().timeZone;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// Canonical JSON identical to the server-side `fingerprintDevice` canonicalizer: keys\n// sorted at every depth so identical signals produce identical hashes regardless of\n// insertion order. Inlined here to keep the client bundle free of server-side imports.\nconst canonical = (signals: FingerprintSignals) =>\n\tJSON.stringify(signals, (_key, value) =>\n\t\tvalue === null || typeof value !== 'object' || Array.isArray(value)\n\t\t\t? value\n\t\t\t: Object.fromEntries(\n\t\t\t\t\tObject.entries(value).sort((left, right) =>\n\t\t\t\t\t\tleft[0].localeCompare(right[0])\n\t\t\t\t\t)\n\t\t\t\t)\n\t);\n\nconst sha256Base64Url = async (input: string) => {\n\tconst bytes = await crypto.subtle.digest(\n\t\t'SHA-256',\n\t\tnew TextEncoder().encode(input)\n\t);\n\tconst binary = String.fromCharCode(...new Uint8Array(bytes));\n\n\treturn btoa(binary)\n\t\t.replace(/\\+/g, '-')\n\t\t.replace(/\\//g, '_')\n\t\t.replace(/=+$/, '');\n};\n\n// Collect every signal we can, hash them, return both so the caller can persist the raw\n// signals (for debugging / drift detection) while sending just the deviceId on the wire.\nexport const collectDeviceFingerprint =\n\tasync (): Promise<DeviceFingerprint> => {\n\t\tif (typeof window === 'undefined' || typeof document === 'undefined') {\n\t\t\tthrow new Error(\n\t\t\t\t'collectDeviceFingerprint must run in a browser — server-side use the @absolutejs/auth fingerprintDevice helper instead'\n\t\t\t);\n\t\t}\n\t\tconst [canvas, audio, webgl, fonts] = await Promise.all([\n\t\t\tPromise.resolve(readCanvas()),\n\t\t\treadAudio(),\n\t\t\tPromise.resolve(readWebgl()),\n\t\t\tPromise.resolve(readFonts())\n\t\t]);\n\n\t\tconst deviceMemory =\n\t\t\t'deviceMemory' in navigator\n\t\t\t\t? Reflect.get(navigator, 'deviceMemory')\n\t\t\t\t: undefined;\n\t\tconst signals: FingerprintSignals = {\n\t\t\taudio,\n\t\t\tcanvas,\n\t\t\tdeviceMemory:\n\t\t\t\ttypeof deviceMemory === 'number' ? deviceMemory : undefined,\n\t\t\tfonts,\n\t\t\thardwareConcurrency: navigator.hardwareConcurrency,\n\t\t\tlanguages: navigator.languages,\n\t\t\tpixelRatio: window.devicePixelRatio,\n\t\t\tplatform: navigator.platform,\n\t\t\tscreen: readScreen(),\n\t\t\ttimezone: readTimezone(),\n\t\t\tuserAgent: navigator.userAgent,\n\t\t\twebgl\n\t\t};\n\n\t\treturn { deviceId: await sha256Base64Url(canonical(signals)), signals };\n\t};\n"
   ],
-  "mappings": ";AAkBA,IAAM,cAAc;AACpB,IAAM,eAAe;AACrB,IAAM,gBAAgB;AACtB,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AACvB,IAAM,6BAA6B;AACnC,IAAM,wBAAwB;AAC9B,IAAM,yBAAyB;AAC/B,IAAM,0BAA0B;AAChC,IAAM,2BAA2B;AACjC,IAAM,oBAAoB;AAC1B,IAAM,aAAa;AACnB,IAAM,gBAAgB;AACtB,IAAM,0BAA0B;AAChC,IAAM,qBAAqB,CAAC,aAAa,cAAc,OAAO;AAC9D,IAAM,gBAAgB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAyBA,IAAM,aAAa,MAAM;AAAA,EACxB,IAAI;AAAA,IACH,MAAM,SAAS,SAAS,cAAc,QAAQ;AAAA,IAC9C,OAAO,QAAQ;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,MAAM,UAAU,OAAO,WAAW,IAAI;AAAA,IACtC,IAAI,YAAY;AAAA,MAAM;AAAA,IACtB,QAAQ,eAAe;AAAA,IACvB,QAAQ,OAAO;AAAA,IACf,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,KAAK,GAAG,IAAI,EAAE;AAAA,IAC/B,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,aAAa,GAAG,EAAE;AAAA,IACnC,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,aAAa,GAAG,EAAE;AAAA,IAEnC,OAAO,OAAO,UAAU;AAAA,IACvB,MAAM;AAAA,IACP;AAAA;AAAA;AAQF,IAAM,iCAAiC,MAAM;AAAA,EAC5C,IAAI,OAAO,wBAAwB;AAAA,IAAa,OAAO;AAAA,EAEvD,MAAM,SAAS;AAAA,EAEf,OAAO,OAAO;AAAA;AAGf,IAAM,SAAS,CAAC,YAA0B;AAAA,EACzC,IAAI,QAAQ;AAAA,EACZ,WAAW,UAAU;AAAA,IAAS,SAAS,KAAK,IAAI,MAAM;AAAA,EAEtD,OAAO;AAAA;AAMR,IAAM,YAAY,YAAY;AAAA,EAC7B,IAAI;AAAA,IACH,MAAM,cAAc,+BAA+B;AAAA,IACnD,IAAI,gBAAgB;AAAA,MAAW;AAAA,IAC/B,MAAM,UAAU,IAAI,YACnB,GACA,qBACA,iBACD;AAAA,IACA,MAAM,aAAa,QAAQ,iBAAiB;AAAA,IAC5C,WAAW,OAAO;AAAA,IAClB,WAAW,UAAU,QAAQ;AAAA,IAC7B,MAAM,aAAa,QAAQ,yBAAyB;AAAA,IACpD,WAAW,UAAU,QAAQ;AAAA,IAC7B,WAAW,KAAK,QAAQ;AAAA,IACxB,WAAW,MAAM,QAAQ;AAAA,IAIzB,WAAW,OAAO,QAAQ;AAAA,IAC1B,WAAW,QAAQ,QAAQ;AAAA,IAC3B,WAAW,QAAQ,UAAU;AAAA,IAC7B,WAAW,QAAQ,QAAQ,WAAW;AAAA,IACtC,WAAW,MAAM,CAAC;AAAA,IAClB,MAAM,SAAS,MAAM,QAAQ,eAAe;AAAA,IAE5C,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC;AAAA,IACrC,MAAM;AAAA,IACP;AAAA;AAAA;AAMF,IAAM,YAAY,MAAM;AAAA,EACvB,IAAI;AAAA,IACH,MAAM,SAAS,SAAS,cAAc,QAAQ;AAAA,IAC9C,MAAM,UACL,OAAO,WAAW,OAAO,KACzB,OAAO,WAAW,oBAAoB;AAAA,IACvC,IACC,YAAY,QACZ,EAAE,kBAAkB,YACpB,EAAE,kBAAkB,UACnB;AAAA,MACD;AAAA,IACD;AAAA,IACA,MAAM,QAAQ,QAAQ,aAAa,2BAA2B;AAAA,IAC9D,IAAI,UAAU;AAAA,MAAM;AAAA,IAEpB,OAAO;AAAA,MACN,UAAU,OACT,QAAQ,aAAa,MAAM,uBAAuB,KAAK,EACxD;AAAA,MACA,QAAQ,OACP,QAAQ,aAAa,MAAM,qBAAqB,KAAK,EACtD;AAAA,IACD;AAAA,IACC,MAAM;AAAA,IACP;AAAA;AAAA;AAMF,IAAM,gBAAgB,CAAC,MAAuB,WAAmB;AAAA,EAChE,KAAK,MAAM,aAAa;AAAA,EAExB,OAAO,KAAK;AAAA;AAGb,IAAM,oBAAoB,CACzB,MACA,MACA,aAEA,mBAAmB,KAClB,CAAC,WACA,cAAc,MAAM,IAAI,UAAU,QAAQ,MAAM,SAAS,OAC3D;AAKD,IAAM,YAAY,MAAM;AAAA,EACvB,IAAI;AAAA,IACH,MAAM,OAAO,SAAS,cAAc,MAAM;AAAA,IAC1C,KAAK,MAAM,WAAW;AAAA,IACtB,KAAK,MAAM,OAAO,GAAG;AAAA,IACrB,KAAK,MAAM,WAAW;AAAA,IACtB,KAAK,cAAc;AAAA,IACnB,SAAS,KAAK,YAAY,IAAI;AAAA,IAE9B,MAAM,WAAmC,OAAO,YAC/C,mBAAmB,IAAI,CAAC,WAAW;AAAA,MAClC;AAAA,MACA,cAAc,MAAM,MAAM;AAAA,IAC3B,CAAC,CACF;AAAA,IACA,MAAM,UAAU,cAAc,OAAO,CAAC,SACrC,kBAAkB,MAAM,MAAM,QAAQ,CACvC;AAAA,IAEA,SAAS,KAAK,YAAY,IAAI;AAAA,IAE9B,OAAO;AAAA,IACN,MAAM;AAAA,IACP;AAAA;AAAA;AAIF,IAAM,aAAa,MAAM;AAAA,EACxB,IAAI,OAAO,WAAW;AAAA,IAAa;AAAA,EAEnC,OAAO;AAAA,IACN,YAAY,OAAO;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,OAAO,OAAO;AAAA,EACf;AAAA;AAGD,IAAM,eAAe,MAAM;AAAA,EAC1B,IAAI;AAAA,IACH,OAAO,KAAK,eAAe,EAAE,gBAAgB,EAAE;AAAA,IAC9C,MAAM;AAAA,IACP;AAAA;AAAA;AAOF,IAAM,YAAY,CAAC,YAClB,KAAK,UAAU,SAAS,CAAC,MAAM,UAC9B,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,IAC/D,QACA,OAAO,YACP,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,MAAM,UACjC,KAAK,GAAG,cAAc,MAAM,EAAE,CAC/B,CACD,CACH;AAED,IAAM,kBAAkB,OAAO,UAAkB;AAAA,EAChD,MAAM,QAAQ,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,YAAY,EAAE,OAAO,KAAK,CAC/B;AAAA,EACA,MAAM,SAAS,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC;AAAA,EAE3D,OAAO,KAAK,MAAM,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAAA;AAKb,IAAM,2BACZ,YAAwC;AAAA,EACvC,IAAI,OAAO,WAAW,eAAe,OAAO,aAAa,aAAa;AAAA,IACrE,MAAM,IAAI,MACT,wHACD;AAAA,EACD;AAAA,EACA,OAAO,QAAQ,OAAO,OAAO,SAAS,MAAM,QAAQ,IAAI;AAAA,IACvD,QAAQ,QAAQ,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC3B,QAAQ,QAAQ,UAAU,CAAC;AAAA,EAC5B,CAAC;AAAA,EAED,MAAM,eACL,kBAAkB,YACf,QAAQ,IAAI,WAAW,cAAc,IACrC;AAAA,EACJ,MAAM,UAA8B;AAAA,IACnC;AAAA,IACA;AAAA,IACA,cACC,OAAO,iBAAiB,WAAW,eAAe;AAAA,IACnD;AAAA,IACA,qBAAqB,UAAU;AAAA,IAC/B,WAAW,UAAU;AAAA,IACrB,YAAY,OAAO;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,QAAQ,WAAW;AAAA,IACnB,UAAU,aAAa;AAAA,IACvB,WAAW,UAAU;AAAA,IACrB;AAAA,EACD;AAAA,EAEA,OAAO,EAAE,UAAU,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,QAAQ;AAAA;",
-  "debugId": "58DA2A773086368664756E2164756E21",
+  "mappings": ";AAkBA,IAAM,cAAc;AACpB,IAAM,eAAe;AACrB,IAAM,gBAAgB;AACtB,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AACvB,IAAM,6BAA6B;AACnC,IAAM,wBAAwB;AAC9B,IAAM,yBAAyB;AAC/B,IAAM,0BAA0B;AAChC,IAAM,2BAA2B;AACjC,IAAM,oBAAoB;AAC1B,IAAM,aAAa;AACnB,IAAM,gBAAgB;AACtB,IAAM,0BAA0B;AAChC,IAAM,qBAAqB,CAAC,aAAa,cAAc,OAAO;AAC9D,IAAM,gBAAgB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAyBA,IAAM,aAAa,MAAM;AAAA,EACxB,IAAI;AAAA,IACH,MAAM,SAAS,SAAS,cAAc,QAAQ;AAAA,IAC9C,OAAO,QAAQ;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,MAAM,UAAU,OAAO,WAAW,IAAI;AAAA,IACtC,IAAI,YAAY;AAAA,MAAM;AAAA,IACtB,QAAQ,eAAe;AAAA,IACvB,QAAQ,OAAO;AAAA,IACf,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,KAAK,GAAG,IAAI,EAAE;AAAA,IAC/B,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,aAAa,GAAG,EAAE;AAAA,IACnC,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,aAAa,GAAG,EAAE;AAAA,IAEnC,OAAO,OAAO,UAAU;AAAA,IACvB,MAAM;AAAA,IACP;AAAA;AAAA;AAIF,IAAM,4BAA4B,CACjC,UACyC,OAAO,UAAU;AAE3D,IAAM,iCAAiC,MAAM;AAAA,EAC5C,IAAI,OAAO,wBAAwB;AAAA,IAAa,OAAO;AAAA,EACvD,MAAM,SAAkB,QAAQ,IAC/B,YACA,2BACD;AAAA,EAEA,OAAO,0BAA0B,MAAM,IAAI,SAAS;AAAA;AAGrD,IAAM,SAAS,CAAC,YAA0B;AAAA,EACzC,IAAI,QAAQ;AAAA,EACZ,WAAW,UAAU;AAAA,IAAS,SAAS,KAAK,IAAI,MAAM;AAAA,EAEtD,OAAO;AAAA;AAMR,IAAM,YAAY,YAAY;AAAA,EAC7B,IAAI;AAAA,IACH,MAAM,cAAc,+BAA+B;AAAA,IACnD,IAAI,gBAAgB;AAAA,MAAW;AAAA,IAC/B,MAAM,UAAU,IAAI,YACnB,GACA,qBACA,iBACD;AAAA,IACA,MAAM,aAAa,QAAQ,iBAAiB;AAAA,IAC5C,WAAW,OAAO;AAAA,IAClB,WAAW,UAAU,QAAQ;AAAA,IAC7B,MAAM,aAAa,QAAQ,yBAAyB;AAAA,IACpD,WAAW,UAAU,QAAQ;AAAA,IAC7B,WAAW,KAAK,QAAQ;AAAA,IACxB,WAAW,MAAM,QAAQ;AAAA,IAIzB,WAAW,OAAO,QAAQ;AAAA,IAC1B,WAAW,QAAQ,QAAQ;AAAA,IAC3B,WAAW,QAAQ,UAAU;AAAA,IAC7B,WAAW,QAAQ,QAAQ,WAAW;AAAA,IACtC,WAAW,MAAM,CAAC;AAAA,IAClB,MAAM,SAAS,MAAM,QAAQ,eAAe;AAAA,IAE5C,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC;AAAA,IACrC,MAAM;AAAA,IACP;AAAA;AAAA;AAMF,IAAM,YAAY,MAAM;AAAA,EACvB,IAAI;AAAA,IACH,MAAM,SAAS,SAAS,cAAc,QAAQ;AAAA,IAC9C,MAAM,UACL,OAAO,WAAW,OAAO,KACzB,OAAO,WAAW,oBAAoB;AAAA,IACvC,IACC,YAAY,QACZ,EAAE,kBAAkB,YACpB,EAAE,kBAAkB,UACnB;AAAA,MACD;AAAA,IACD;AAAA,IACA,MAAM,QAAQ,QAAQ,aAAa,2BAA2B;AAAA,IAC9D,IAAI,UAAU;AAAA,MAAM;AAAA,IAEpB,OAAO;AAAA,MACN,UAAU,OACT,QAAQ,aAAa,MAAM,uBAAuB,KAAK,EACxD;AAAA,MACA,QAAQ,OACP,QAAQ,aAAa,MAAM,qBAAqB,KAAK,EACtD;AAAA,IACD;AAAA,IACC,MAAM;AAAA,IACP;AAAA;AAAA;AAMF,IAAM,gBAAgB,CAAC,MAAuB,WAAmB;AAAA,EAChE,KAAK,MAAM,aAAa;AAAA,EAExB,OAAO,KAAK;AAAA;AAGb,IAAM,oBAAoB,CACzB,MACA,MACA,aAEA,mBAAmB,KAClB,CAAC,WACA,cAAc,MAAM,IAAI,UAAU,QAAQ,MAAM,SAAS,OAC3D;AAKD,IAAM,YAAY,MAAM;AAAA,EACvB,IAAI;AAAA,IACH,MAAM,OAAO,SAAS,cAAc,MAAM;AAAA,IAC1C,KAAK,MAAM,WAAW;AAAA,IACtB,KAAK,MAAM,OAAO,GAAG;AAAA,IACrB,KAAK,MAAM,WAAW;AAAA,IACtB,KAAK,cAAc;AAAA,IACnB,SAAS,KAAK,YAAY,IAAI;AAAA,IAE9B,MAAM,WAAmC,OAAO,YAC/C,mBAAmB,IAAI,CAAC,WAAW;AAAA,MAClC;AAAA,MACA,cAAc,MAAM,MAAM;AAAA,IAC3B,CAAC,CACF;AAAA,IACA,MAAM,UAAU,cAAc,OAAO,CAAC,SACrC,kBAAkB,MAAM,MAAM,QAAQ,CACvC;AAAA,IAEA,SAAS,KAAK,YAAY,IAAI;AAAA,IAE9B,OAAO;AAAA,IACN,MAAM;AAAA,IACP;AAAA;AAAA;AAIF,IAAM,aAAa,MAAM;AAAA,EACxB,IAAI,OAAO,WAAW;AAAA,IAAa;AAAA,EAEnC,OAAO;AAAA,IACN,YAAY,OAAO;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,OAAO,OAAO;AAAA,EACf;AAAA;AAGD,IAAM,eAAe,MAAM;AAAA,EAC1B,IAAI;AAAA,IACH,OAAO,KAAK,eAAe,EAAE,gBAAgB,EAAE;AAAA,IAC9C,MAAM;AAAA,IACP;AAAA;AAAA;AAOF,IAAM,YAAY,CAAC,YAClB,KAAK,UAAU,SAAS,CAAC,MAAM,UAC9B,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,IAC/D,QACA,OAAO,YACP,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,MAAM,UACjC,KAAK,GAAG,cAAc,MAAM,EAAE,CAC/B,CACD,CACH;AAED,IAAM,kBAAkB,OAAO,UAAkB;AAAA,EAChD,MAAM,QAAQ,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,YAAY,EAAE,OAAO,KAAK,CAC/B;AAAA,EACA,MAAM,SAAS,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC;AAAA,EAE3D,OAAO,KAAK,MAAM,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAAA;AAKb,IAAM,2BACZ,YAAwC;AAAA,EACvC,IAAI,OAAO,WAAW,eAAe,OAAO,aAAa,aAAa;AAAA,IACrE,MAAM,IAAI,MACT,wHACD;AAAA,EACD;AAAA,EACA,OAAO,QAAQ,OAAO,OAAO,SAAS,MAAM,QAAQ,IAAI;AAAA,IACvD,QAAQ,QAAQ,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC3B,QAAQ,QAAQ,UAAU,CAAC;AAAA,EAC5B,CAAC;AAAA,EAED,MAAM,eACL,kBAAkB,YACf,QAAQ,IAAI,WAAW,cAAc,IACrC;AAAA,EACJ,MAAM,UAA8B;AAAA,IACnC;AAAA,IACA;AAAA,IACA,cACC,OAAO,iBAAiB,WAAW,eAAe;AAAA,IACnD;AAAA,IACA,qBAAqB,UAAU;AAAA,IAC/B,WAAW,UAAU;AAAA,IACrB,YAAY,OAAO;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,QAAQ,WAAW;AAAA,IACnB,UAAU,aAAa;AAAA,IACvB,WAAW,UAAU;AAAA,IACrB;AAAA,EACD;AAAA,EAEA,OAAO,EAAE,UAAU,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,QAAQ;AAAA;",
+  "debugId": "5AAB5F70FF6848B464756E2164756E21",
   "names": []
 }

package/dist/index.d.ts

@@ -563,7 +563,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
                 query: unknown;
                 headers: unknown;
                 response: {
-                    [x: string]: any;
+                    [x: number]: {};
                 };
             };
         };
@@ -745,7 +745,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
                 query: unknown;
                 headers: unknown;
                 response: {
-                    [x: string]: any;
+                    [x: number]: {};
                 };
             };
         };
@@ -3434,7 +3434,7 @@ export { createInMemoryVaultStore } from './vault/inMemoryVaultStore';
 export { createNeonVaultStore, createPostgresVaultStore, vaultEntriesTable } from './vault/postgresVaultStore';
 export { createFederatedTokenStore, getOrRefreshFederatedTokens } from './federation/tokenStore';
 export type { FederatedTokenRefresher, FederatedTokenSet, FederatedTokenStore } from './federation/tokenStore';
-export type { AuthSessionStore } from './session/types';
+export { decodeSessionUserRecord, type AuthSessionStore, type SessionUserDecoder } from './session/types';
 export { isAuthIntent, isUserSessionId, isValidUser } from './typeGuards';
 export { AuthIdentityConflictError } from './errors';
 export { sessionStore } from './session/state';