@authowl/core 0.12.0 → 0.13.0

package/dist/index.d.cts

@@ -1,8 +1,17 @@
 export { A as AuthConfig, D as DecodedPublishableKey, H as HasParams, O as OrganizationMembership, R as ResolvedAuthConfig, c as createMembershipHas, d as decodePublishableKey, m as membershipHas, a as membershipHasPermission, b as membershipHasTeam, r as resolveConfig, s as sessionCookieName } from './organization-membership-B3m6PbmO.cjs';
-export { A as AUTH_CHALLENGE_HEADER, a as AcceptOrganizationInvitationData, b as AccountClient, c as AccountSession, d as AccountStatusData, e as ActionFetchOptions, f as AddPasskeyOptions, g as AuthActionResult, h as AuthClientError, i as AuthErrorContext, j as AuthOwlClient, k as AuthOwlErrorCode, l as AuthPasskey, m as AuthRequestContext, n as AuthResponseContext, o as AuthSession, p as AuthUser, C as ChangeEmailOptions, q as ChangePasswordData, r as ChangePasswordOptions, s as ConsentAcceptResult, t as ConsentStatus, u as CreateOrganizationOptions, D as DeleteAccountData, v as DeleteAccountOptions, w as DeleteOrganizationOptions, x as DeletePasskeyData, y as DeletePasskeyOptions, z as DisableTwoFactorOptions, E as EmailAuthData, B as EmailOtpAuthData, F as EmailOtpSignInOptions, G as EmailOtpType, H as EmailSignInOptions, I as EmailSignUpData, J as EmailSignUpOptions, K as EnableTwoFactorOptions, L as EnvironmentType, M as GenerateBackupCodesOptions, N as GetOrganizationInvitationOptions, O as GetOrganizationOptions, P as GetToken, Q as GetTokenOptions, R as InviteOrganizationMemberOptions, S as JsonObject, T as JsonPrimitive, U as JsonValue, V as LeaveOrganizationOptions, W as LinkSocialData, X as LinkSocialOptions, Y as ListOrganizationInvitationsOptions, Z as ListOrganizationMembersOptions, _ as ListOrganizationRolesOptions, $ as ListOrganizationTeamsOptions, a0 as MagicLinkData, a1 as MagicLinkSignInOptions, a2 as Organization, a3 as OrganizationClient, a4 as OrganizationDetails, a5 as OrganizationFilterOperator, a6 as OrganizationInvitation, a7 as OrganizationInvitationActionOptions, a8 as OrganizationInvitationDetails, a9 as OrganizationInvitationStatus, aa as OrganizationMember, ab as OrganizationMemberUser, ac as OrganizationMemberWithUser, ad as OrganizationMembersData, ae as OrganizationRoleSummary, af as OrganizationSelector, ag as OrganizationTeam, ah as OrganizationUserInvitation, ai as PasskeyAuthData, aj as PasskeySignInOptions, ak as PasswordResetData, al as PhoneAuthUser, am as PhoneOtpStartData, an as PhoneOtpStartOptions, ao as PhoneOtpVerifyData, ap as PhoneOtpVerifyOptions, aq as ProjectCapabilities, ar as PublicConfig, as as RejectOrganizationInvitationData, at as RemoveOrganizationMemberData, au as RemoveOrganizationMemberOptions, av as RequestPasswordResetOptions, aw as ResetPasswordOptions, ax as RevokeSessionOptions, ay as SendOtpData, az as SendTwoFactorOtpData, aA as SendTwoFactorOtpOptions, aB as SendVerificationOtpOptions, aC as SessionState, aD as SessionStore, aE as SetActiveOrganizationOptions, aF as SetActiveTeamOptions, aG as SignOutData, aH as SocialAccount, aI as SocialAuthData, aJ as SocialIdTokenOptions, aK as SocialSignInOptions, aL as TokenClient, aM as TwoFactorBackupCodesData, aN as TwoFactorEnableData, aO as TwoFactorRedirectData, aP as TwoFactorStatusData, aQ as TwoFactorVerifyData, aR as UnlinkSocialOptions, aS as UpdateOrganizationMemberRoleOptions, aT as UpdateOrganizationOptions, aU as UpdatePasskeyData, aV as UpdatePasskeyOptions, aW as UpdateProfileOptions, aX as UpdateUnsafeMetadataOptions, aY as UserMetadata, aZ as UsernameSignInOptions, a_ as VerifyBackupCodeOptions, a$ as VerifyEmailOtpData, b0 as VerifyEmailOtpOptions, b1 as VerifyTotpOptions, b2 as VerifyTwoFactorOtpOptions, b3 as WaitlistJoinData, b4 as WaitlistJoinOptions, b5 as acceptConsent, b6 as createAuthOwlClient, b7 as createTokenClient, b8 as getConsentStatus, b9 as getPublicConfig, ba as resolveProjectCapabilities } from './client-1cjryEHU.cjs';
+import { P as PhoneOtpChallengeData, A as AkedlyShieldStartProof } from './client-DOOkDLWg.cjs';
+export { a as AUTH_CHALLENGE_HEADER, b as AcceptOrganizationInvitationData, c as AccountClient, d as AccountSession, e as AccountStatusData, f as ActionFetchOptions, g as AddPasskeyOptions, h as AuthActionResult, i as AuthClientError, j as AuthErrorContext, k as AuthOwlClient, l as AuthOwlErrorCode, m as AuthPasskey, n as AuthRequestContext, o as AuthResponseContext, p as AuthSession, q as AuthUser, C as ChangeEmailOptions, r as ChangePasswordData, s as ChangePasswordOptions, t as ConsentAcceptResult, u as ConsentStatus, v as CreateOrganizationOptions, D as DeleteAccountData, w as DeleteAccountOptions, x as DeleteOrganizationOptions, y as DeletePasskeyData, z as DeletePasskeyOptions, B as DisableTwoFactorOptions, E as EmailAuthData, F as EmailOtpAuthData, G as EmailOtpSignInOptions, H as EmailOtpType, I as EmailSignInOptions, J as EmailSignUpData, K as EmailSignUpOptions, L as EnableTwoFactorOptions, M as EnvironmentType, N as GenerateBackupCodesOptions, O as GetOrganizationInvitationOptions, Q as GetOrganizationOptions, R as GetToken, S as GetTokenOptions, T as InviteOrganizationMemberOptions, U as JsonObject, V as JsonPrimitive, W as JsonValue, X as LeaveOrganizationOptions, Y as LinkSocialData, Z as LinkSocialOptions, _ as ListOrganizationInvitationsOptions, $ as ListOrganizationMembersOptions, a0 as ListOrganizationRolesOptions, a1 as ListOrganizationTeamsOptions, a2 as MagicLinkData, a3 as MagicLinkSignInOptions, a4 as Organization, a5 as OrganizationClient, a6 as OrganizationDetails, a7 as OrganizationFilterOperator, a8 as OrganizationInvitation, a9 as OrganizationInvitationActionOptions, aa as OrganizationInvitationDetails, ab as OrganizationInvitationStatus, ac as OrganizationMember, ad as OrganizationMemberUser, ae as OrganizationMemberWithUser, af as OrganizationMembersData, ag as OrganizationRoleSummary, ah as OrganizationSelector, ai as OrganizationTeam, aj as OrganizationUserInvitation, ak as PasskeyAuthData, al as PasskeySignInOptions, am as PasswordResetData, an as PhoneAuthUser, ao as PhoneOtpStartData, ap as PhoneOtpStartOptions, aq as PhoneOtpVerifyData, ar as PhoneOtpVerifyOptions, as as ProjectCapabilities, at as PublicConfig, au as RejectOrganizationInvitationData, av as RemoveOrganizationMemberData, aw as RemoveOrganizationMemberOptions, ax as RequestPasswordResetOptions, ay as ResetPasswordOptions, az as RevokeSessionOptions, aA as SendOtpData, aB as SendTwoFactorOtpData, aC as SendTwoFactorOtpOptions, aD as SendVerificationOtpOptions, aE as SessionState, aF as SessionStore, aG as SetActiveOrganizationOptions, aH as SetActiveTeamOptions, aI as SignOutData, aJ as SocialAccount, aK as SocialAuthData, aL as SocialIdTokenOptions, aM as SocialSignInOptions, aN as TokenClient, aO as TwoFactorBackupCodesData, aP as TwoFactorEnableData, aQ as TwoFactorRedirectData, aR as TwoFactorStatusData, aS as TwoFactorVerifyData, aT as UnlinkSocialOptions, aU as UpdateOrganizationMemberRoleOptions, aV as UpdateOrganizationOptions, aW as UpdatePasskeyData, aX as UpdatePasskeyOptions, aY as UpdateProfileOptions, aZ as UpdateUnsafeMetadataOptions, a_ as UserMetadata, a$ as UsernameSignInOptions, b0 as VerifyBackupCodeOptions, b1 as VerifyEmailOtpData, b2 as VerifyEmailOtpOptions, b3 as VerifyTotpOptions, b4 as VerifyTwoFactorOtpOptions, b5 as WaitlistJoinData, b6 as WaitlistJoinOptions, b7 as acceptConsent, b8 as createAuthOwlClient, b9 as createTokenClient, ba as getConsentStatus, bb as getPublicConfig, bc as resolveProjectCapabilities } from './client-DOOkDLWg.cjs';
 export { T as TransportError, a as TransportErrorKind } from './transport-DcWDTRd4.cjs';
 export { L as LOCALES, a as Locale, d as directionFor, i as isLocale } from './index-hIdXOzRp.cjs';
 
+/**
+ * Complete Akedly Shield's browser-only proof ceremony. The provider package is
+ * lazy-loaded only when the server-selected route requires it.
+ */
+declare function solvePhoneOtpChallenge(challenge: Extract<PhoneOtpChallengeData, {
+    kind: 'akedly_shield_v1_2';
+}>): Promise<AkedlyShieldStartProof>;
+
 /** Create a cryptographically random RFC 4122 v4 key for retry-safe write actions. */
 declare function createIdempotencyKey(): string;
 
@@ -25,4 +34,4 @@ declare class AuthOwlHttpError extends Error {
     constructor(label: string, response: Response, requestId?: string);
 }
 
-export { AuthOwlError, AuthOwlHttpError, InvalidKeyError, RateLimitedError, createIdempotencyKey };
+export { AkedlyShieldStartProof, AuthOwlError, AuthOwlHttpError, InvalidKeyError, PhoneOtpChallengeData, RateLimitedError, createIdempotencyKey, solvePhoneOtpChallenge };

package/dist/index.d.ts

@@ -1,8 +1,17 @@
 export { A as AuthConfig, D as DecodedPublishableKey, H as HasParams, O as OrganizationMembership, R as ResolvedAuthConfig, c as createMembershipHas, d as decodePublishableKey, m as membershipHas, a as membershipHasPermission, b as membershipHasTeam, r as resolveConfig, s as sessionCookieName } from './organization-membership-B3m6PbmO.js';
-export { A as AUTH_CHALLENGE_HEADER, a as AcceptOrganizationInvitationData, b as AccountClient, c as AccountSession, d as AccountStatusData, e as ActionFetchOptions, f as AddPasskeyOptions, g as AuthActionResult, h as AuthClientError, i as AuthErrorContext, j as AuthOwlClient, k as AuthOwlErrorCode, l as AuthPasskey, m as AuthRequestContext, n as AuthResponseContext, o as AuthSession, p as AuthUser, C as ChangeEmailOptions, q as ChangePasswordData, r as ChangePasswordOptions, s as ConsentAcceptResult, t as ConsentStatus, u as CreateOrganizationOptions, D as DeleteAccountData, v as DeleteAccountOptions, w as DeleteOrganizationOptions, x as DeletePasskeyData, y as DeletePasskeyOptions, z as DisableTwoFactorOptions, E as EmailAuthData, B as EmailOtpAuthData, F as EmailOtpSignInOptions, G as EmailOtpType, H as EmailSignInOptions, I as EmailSignUpData, J as EmailSignUpOptions, K as EnableTwoFactorOptions, L as EnvironmentType, M as GenerateBackupCodesOptions, N as GetOrganizationInvitationOptions, O as GetOrganizationOptions, P as GetToken, Q as GetTokenOptions, R as InviteOrganizationMemberOptions, S as JsonObject, T as JsonPrimitive, U as JsonValue, V as LeaveOrganizationOptions, W as LinkSocialData, X as LinkSocialOptions, Y as ListOrganizationInvitationsOptions, Z as ListOrganizationMembersOptions, _ as ListOrganizationRolesOptions, $ as ListOrganizationTeamsOptions, a0 as MagicLinkData, a1 as MagicLinkSignInOptions, a2 as Organization, a3 as OrganizationClient, a4 as OrganizationDetails, a5 as OrganizationFilterOperator, a6 as OrganizationInvitation, a7 as OrganizationInvitationActionOptions, a8 as OrganizationInvitationDetails, a9 as OrganizationInvitationStatus, aa as OrganizationMember, ab as OrganizationMemberUser, ac as OrganizationMemberWithUser, ad as OrganizationMembersData, ae as OrganizationRoleSummary, af as OrganizationSelector, ag as OrganizationTeam, ah as OrganizationUserInvitation, ai as PasskeyAuthData, aj as PasskeySignInOptions, ak as PasswordResetData, al as PhoneAuthUser, am as PhoneOtpStartData, an as PhoneOtpStartOptions, ao as PhoneOtpVerifyData, ap as PhoneOtpVerifyOptions, aq as ProjectCapabilities, ar as PublicConfig, as as RejectOrganizationInvitationData, at as RemoveOrganizationMemberData, au as RemoveOrganizationMemberOptions, av as RequestPasswordResetOptions, aw as ResetPasswordOptions, ax as RevokeSessionOptions, ay as SendOtpData, az as SendTwoFactorOtpData, aA as SendTwoFactorOtpOptions, aB as SendVerificationOtpOptions, aC as SessionState, aD as SessionStore, aE as SetActiveOrganizationOptions, aF as SetActiveTeamOptions, aG as SignOutData, aH as SocialAccount, aI as SocialAuthData, aJ as SocialIdTokenOptions, aK as SocialSignInOptions, aL as TokenClient, aM as TwoFactorBackupCodesData, aN as TwoFactorEnableData, aO as TwoFactorRedirectData, aP as TwoFactorStatusData, aQ as TwoFactorVerifyData, aR as UnlinkSocialOptions, aS as UpdateOrganizationMemberRoleOptions, aT as UpdateOrganizationOptions, aU as UpdatePasskeyData, aV as UpdatePasskeyOptions, aW as UpdateProfileOptions, aX as UpdateUnsafeMetadataOptions, aY as UserMetadata, aZ as UsernameSignInOptions, a_ as VerifyBackupCodeOptions, a$ as VerifyEmailOtpData, b0 as VerifyEmailOtpOptions, b1 as VerifyTotpOptions, b2 as VerifyTwoFactorOtpOptions, b3 as WaitlistJoinData, b4 as WaitlistJoinOptions, b5 as acceptConsent, b6 as createAuthOwlClient, b7 as createTokenClient, b8 as getConsentStatus, b9 as getPublicConfig, ba as resolveProjectCapabilities } from './client-CzV2XWt6.js';
+import { P as PhoneOtpChallengeData, A as AkedlyShieldStartProof } from './client-jpaYv3wu.js';
+export { a as AUTH_CHALLENGE_HEADER, b as AcceptOrganizationInvitationData, c as AccountClient, d as AccountSession, e as AccountStatusData, f as ActionFetchOptions, g as AddPasskeyOptions, h as AuthActionResult, i as AuthClientError, j as AuthErrorContext, k as AuthOwlClient, l as AuthOwlErrorCode, m as AuthPasskey, n as AuthRequestContext, o as AuthResponseContext, p as AuthSession, q as AuthUser, C as ChangeEmailOptions, r as ChangePasswordData, s as ChangePasswordOptions, t as ConsentAcceptResult, u as ConsentStatus, v as CreateOrganizationOptions, D as DeleteAccountData, w as DeleteAccountOptions, x as DeleteOrganizationOptions, y as DeletePasskeyData, z as DeletePasskeyOptions, B as DisableTwoFactorOptions, E as EmailAuthData, F as EmailOtpAuthData, G as EmailOtpSignInOptions, H as EmailOtpType, I as EmailSignInOptions, J as EmailSignUpData, K as EmailSignUpOptions, L as EnableTwoFactorOptions, M as EnvironmentType, N as GenerateBackupCodesOptions, O as GetOrganizationInvitationOptions, Q as GetOrganizationOptions, R as GetToken, S as GetTokenOptions, T as InviteOrganizationMemberOptions, U as JsonObject, V as JsonPrimitive, W as JsonValue, X as LeaveOrganizationOptions, Y as LinkSocialData, Z as LinkSocialOptions, _ as ListOrganizationInvitationsOptions, $ as ListOrganizationMembersOptions, a0 as ListOrganizationRolesOptions, a1 as ListOrganizationTeamsOptions, a2 as MagicLinkData, a3 as MagicLinkSignInOptions, a4 as Organization, a5 as OrganizationClient, a6 as OrganizationDetails, a7 as OrganizationFilterOperator, a8 as OrganizationInvitation, a9 as OrganizationInvitationActionOptions, aa as OrganizationInvitationDetails, ab as OrganizationInvitationStatus, ac as OrganizationMember, ad as OrganizationMemberUser, ae as OrganizationMemberWithUser, af as OrganizationMembersData, ag as OrganizationRoleSummary, ah as OrganizationSelector, ai as OrganizationTeam, aj as OrganizationUserInvitation, ak as PasskeyAuthData, al as PasskeySignInOptions, am as PasswordResetData, an as PhoneAuthUser, ao as PhoneOtpStartData, ap as PhoneOtpStartOptions, aq as PhoneOtpVerifyData, ar as PhoneOtpVerifyOptions, as as ProjectCapabilities, at as PublicConfig, au as RejectOrganizationInvitationData, av as RemoveOrganizationMemberData, aw as RemoveOrganizationMemberOptions, ax as RequestPasswordResetOptions, ay as ResetPasswordOptions, az as RevokeSessionOptions, aA as SendOtpData, aB as SendTwoFactorOtpData, aC as SendTwoFactorOtpOptions, aD as SendVerificationOtpOptions, aE as SessionState, aF as SessionStore, aG as SetActiveOrganizationOptions, aH as SetActiveTeamOptions, aI as SignOutData, aJ as SocialAccount, aK as SocialAuthData, aL as SocialIdTokenOptions, aM as SocialSignInOptions, aN as TokenClient, aO as TwoFactorBackupCodesData, aP as TwoFactorEnableData, aQ as TwoFactorRedirectData, aR as TwoFactorStatusData, aS as TwoFactorVerifyData, aT as UnlinkSocialOptions, aU as UpdateOrganizationMemberRoleOptions, aV as UpdateOrganizationOptions, aW as UpdatePasskeyData, aX as UpdatePasskeyOptions, aY as UpdateProfileOptions, aZ as UpdateUnsafeMetadataOptions, a_ as UserMetadata, a$ as UsernameSignInOptions, b0 as VerifyBackupCodeOptions, b1 as VerifyEmailOtpData, b2 as VerifyEmailOtpOptions, b3 as VerifyTotpOptions, b4 as VerifyTwoFactorOtpOptions, b5 as WaitlistJoinData, b6 as WaitlistJoinOptions, b7 as acceptConsent, b8 as createAuthOwlClient, b9 as createTokenClient, ba as getConsentStatus, bb as getPublicConfig, bc as resolveProjectCapabilities } from './client-jpaYv3wu.js';
 export { T as TransportError, a as TransportErrorKind } from './transport-DcWDTRd4.js';
 export { L as LOCALES, a as Locale, d as directionFor, i as isLocale } from './index-hIdXOzRp.js';
 
+/**
+ * Complete Akedly Shield's browser-only proof ceremony. The provider package is
+ * lazy-loaded only when the server-selected route requires it.
+ */
+declare function solvePhoneOtpChallenge(challenge: Extract<PhoneOtpChallengeData, {
+    kind: 'akedly_shield_v1_2';
+}>): Promise<AkedlyShieldStartProof>;
+
 /** Create a cryptographically random RFC 4122 v4 key for retry-safe write actions. */
 declare function createIdempotencyKey(): string;
 
@@ -25,4 +34,4 @@ declare class AuthOwlHttpError extends Error {
     constructor(label: string, response: Response, requestId?: string);
 }
 
-export { AuthOwlError, AuthOwlHttpError, InvalidKeyError, RateLimitedError, createIdempotencyKey };
+export { AkedlyShieldStartProof, AuthOwlError, AuthOwlHttpError, InvalidKeyError, PhoneOtpChallengeData, RateLimitedError, createIdempotencyKey, solvePhoneOtpChallenge };

package/dist/index.js

@@ -1,3 +1,3 @@
-export{a as LOCALES,b as directionFor,c as isLocale}from'./chunk-M4QJVSXT.js';import {i,j as j$1,e,g,c as c$1}from'./chunk-SM5LS47O.js';export{b as AUTH_CHALLENGE_HEADER,h as AuthOwlHttpError,d as createIdempotencyKey,k as getPublicConfig,a as resolveProjectCapabilities}from'./chunk-SM5LS47O.js';import {h as h$1,j as j$2,i as i$1}from'./chunk-KPXCQZUX.js';export{f as TransportError,v as createMembershipHas,a as decodePublishableKey,u as membershipHas,s as membershipHasPermission,t as membershipHasTeam,e as resolveConfig,b as sessionCookieName}from'./chunk-KPXCQZUX.js';function u(e){let t=new Uint8Array(e),n="";for(let o of t)n+=String.fromCharCode(o);return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function h(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=(4-t.length%4)%4,i=t.padEnd(t.length+n,"="),o=atob(i),a=new ArrayBuffer(o.length),s=new Uint8Array(a);for(let p=0;p<o.length;p++)s[p]=o.charCodeAt(p);return a}function O(){return be.stubThis(globalThis?.PublicKeyCredential!==void 0&&typeof globalThis.PublicKeyCredential=="function")}var be={stubThis:e=>e};function C(e){let{id:t}=e;return {...e,id:h(t),transports:e.transports}}function T(e){return e==="localhost"||/^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(e)}var c=class extends Error{constructor({message:t,code:n,cause:i,name:o}){super(t,{cause:i}),Object.defineProperty(this,"code",{enumerable:true,configurable:true,writable:true,value:void 0}),this.name=o??i.name,this.code=n;}};function W({error:e,options:t}){let{publicKey:n}=t;if(!n)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(t.signal instanceof AbortSignal)return new c({message:"Registration ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else if(e.name==="ConstraintError"){if(n.authenticatorSelection?.requireResidentKey===true)return new c({message:"Discoverable credentials were required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",cause:e});if(t.mediation==="conditional"&&n.authenticatorSelection?.userVerification==="required")return new c({message:"User verification was required during automatic registration but it could not be performed",code:"ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",cause:e});if(n.authenticatorSelection?.userVerification==="required")return new c({message:"User verification was required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",cause:e})}else {if(e.name==="InvalidStateError")return new c({message:"The authenticator was previously registered",code:"ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",cause:e});if(e.name==="NotAllowedError")return new c({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="NotSupportedError")return n.pubKeyCredParams.filter(o=>o.type==="public-key").length===0?new c({message:'No entry in pubKeyCredParams was of type "public-key"',code:"ERROR_MALFORMED_PUBKEYCREDPARAMS",cause:e}):new c({message:"No available authenticator supported any of the specified pubKeyCredParams algorithms",code:"ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",cause:e});if(e.name==="SecurityError"){let i=globalThis.location.hostname;if(T(i)){if(n.rp.id!==i)return new c({message:`The RP ID "${n.rp.id}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new c({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="TypeError"){if(n.user.id.byteLength<1||n.user.id.byteLength>64)return new c({message:"User ID was not between 1 and 64 characters",code:"ERROR_INVALID_USER_ID_LENGTH",cause:e})}else if(e.name==="UnknownError")return new c({message:"The authenticator was unable to process the specified options, or could not create a new credential",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}var I=class{constructor(){Object.defineProperty(this,"controller",{enumerable:true,configurable:true,writable:true,value:void 0});}createNewAbortSignal(){if(this.controller){let n=new Error("Cancelling existing WebAuthn API call for new one");n.name="AbortError",this.controller.abort(n);}let t=new AbortController;return this.controller=t,t.signal}cancelCeremony(){if(this.controller){let t=new Error("Manually cancelling existing WebAuthn API call");t.name="AbortError",this.controller.abort(t),this.controller=void 0;}}},P=new I;var Re=["cross-platform","platform"];function k(e){if(e&&!(Re.indexOf(e)<0))return e}async function j(e){!e.optionsJSON&&e.challenge&&(console.warn("startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});let{optionsJSON:t,useAutoRegister:n=false}=e;if(!O())throw new Error("WebAuthn is not supported in this browser");let i={...t,challenge:h(t.challenge),user:{...t.user,id:h(t.user.id)},excludeCredentials:t.excludeCredentials?.map(C)},o={};n&&(o.mediation="conditional"),o.publicKey=i,o.signal=P.createNewAbortSignal();let a;try{a=await navigator.credentials.create(o);}catch(l){throw W({error:l,options:o})}if(!a)throw new Error("Registration was not completed");let{id:s,rawId:p,response:r,type:y}=a,m;typeof r.getTransports=="function"&&(m=r.getTransports());let g;if(typeof r.getPublicKeyAlgorithm=="function")try{g=r.getPublicKeyAlgorithm();}catch(l){U("getPublicKeyAlgorithm()",l);}let f;if(typeof r.getPublicKey=="function")try{let l=r.getPublicKey();l!==null&&(f=u(l));}catch(l){U("getPublicKey()",l);}let d;if(typeof r.getAuthenticatorData=="function")try{d=u(r.getAuthenticatorData());}catch(l){U("getAuthenticatorData()",l);}return {id:s,rawId:u(p),response:{attestationObject:u(r.attestationObject),clientDataJSON:u(r.clientDataJSON),transports:m,publicKeyAlgorithm:g,publicKey:f,authenticatorData:d},type:y,clientExtensionResults:a.getClientExtensionResults(),authenticatorAttachment:k(a.authenticatorAttachment)}}function U(e,t){console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${e}. You should report this error to them.
-`,t);}function $(){if(!O())return v.stubThis(new Promise(t=>t(false)));let e=globalThis.PublicKeyCredential;return e?.isConditionalMediationAvailable===void 0?v.stubThis(new Promise(t=>t(false))):v.stubThis(e.isConditionalMediationAvailable())}var v={stubThis:e=>e};function Y({error:e,options:t}){let{publicKey:n}=t;if(!n)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(t.signal instanceof AbortSignal)return new c({message:"Authentication ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else {if(e.name==="NotAllowedError")return new c({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="SecurityError"){let i=globalThis.location.hostname;if(T(i)){if(n.rpId!==i)return new c({message:`The RP ID "${n.rpId}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new c({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="UnknownError")return new c({message:"The authenticator was unable to process the specified options, or could not create a new assertion signature",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}async function Q(e){!e.optionsJSON&&e.challenge&&(console.warn("startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});let{optionsJSON:t,useBrowserAutofill:n=false,verifyBrowserAutofillInput:i=true}=e;if(!O())throw new Error("WebAuthn is not supported in this browser");let o;t.allowCredentials?.length!==0&&(o=t.allowCredentials?.map(C));let a={...t,challenge:h(t.challenge),allowCredentials:o},s={};if(n){if(!await $())throw Error("Browser does not support WebAuthn autofill");if(document.querySelectorAll("input[autocomplete$='webauthn']").length<1&&i)throw Error('No <input> with "webauthn" as the only or last value in its `autocomplete` attribute was detected');s.mediation="conditional",a.allowCredentials=[];}s.publicKey=a,s.signal=P.createNewAbortSignal();let p;try{p=await navigator.credentials.get(s);}catch(d){throw Y({error:d,options:s})}if(!p)throw new Error("Authentication was not completed");let{id:r,rawId:y,response:m,type:g}=p,f;return m.userHandle&&(f=u(m.userHandle)),{id:r,rawId:u(y),response:{authenticatorData:u(m.authenticatorData),clientDataJSON:u(m.clientDataJSON),signature:u(m.signature),userHandle:f},type:g,clientExtensionResults:p.getClientExtensionResults(),authenticatorAttachment:k(p.authenticatorAttachment)}}var Z={authenticate:e=>Q(e),register:e=>j(e),errorCode:e=>e instanceof c?e.code:void 0};function ee(e){return `${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}/consent`}async function _(e){let t=await i(e,ee(e),{init:{method:"GET",credentials:"include"},maxResponseBytes:65536,decode:we});return t.response.status===401?{required:false}:j$1(t,"consent status")}async function F(e,t){if(!Number.isSafeInteger(t)||t<1)throw new TypeError("Consent version must be a positive integer.");return j$1(await i(e,ee(e),{init:{method:"POST",headers:{"content-type":"application/json"},credentials:"include",body:JSON.stringify({version:t})},maxResponseBytes:64*1024,decode:Ee}),"consent accept")}function we(e){let t=h$1(e),n=j$2(t.required),i=Se(t.needsConsent),o=te(t.version),a=X(t.termsUrl),s=X(t.privacyUrl);return {required:n,...i===void 0?{}:{needsConsent:i},...o===void 0?{}:{version:o},...a===void 0?{}:{termsUrl:a},...s===void 0?{}:{privacyUrl:s}}}function Ee(e){let t=h$1(e),n=te(t.version);return {ok:j$2(t.ok),...n===void 0?{}:{version:n}}}function Se(e){if(e===void 0||typeof e=="boolean")return e;throw new TypeError("Invalid consent response.")}function te(e){if(e===void 0||Number.isSafeInteger(e)&&e>=1)return e;throw new TypeError("Invalid consent response.")}function X(e){if(e===void 0||typeof e=="string"&&e.length<=4096)return e;throw new TypeError("Invalid consent response.")}var Ce=30;function Te(e){return typeof e?.exp=="number"?e.exp:null}function Pe(e){let t=e.split(".")[1];if(!t)return null;try{let n=t.replace(/-/g,"+").replace(/_/g,"/"),i=JSON.parse(atob(n));return typeof i=="object"&&i!==null?i:null}catch{return null}}function N(e){let t=new Map;async function n(a={}){let s=a.template===void 0?null:a.template.trim().toLowerCase();if(s==="")throw new TypeError("Template missing");let p=s??"",r=t.get(p);r||(r={activeKey:null,cachedByKey:new Map,inflight:null,sequence:0},t.set(p,r));let y=a.forceRefresh===true;if(!y){let l=r.activeKey?r.cachedByKey.get(r.activeKey):null;if(l&&l.exp-Date.now()/1e3>Ce)return l.token;if(r.inflight)return r.inflight}let m=++r.sequence,g=()=>t.get(p)===r&&r.sequence===m,f=(async()=>{let l=s?`${e.projectBaseURL}/token/${encodeURIComponent(s)}`:`${e.projectBaseURL}/token`,K=await i(e,l,{init:{method:"GET",credentials:"include"},maxResponseBytes:64*1024,decode:S=>ke(S,s!==null)});if(K.response.status===401)return g()&&i$1(),null;let z=j$1(K,"token"),ne=z.policyVersion,x=z.token,b=Pe(x),M=Te(b);if(g())if(M!==null){let S=typeof b?.sub=="string"?b.sub:null,oe=typeof b?.org_id=="string"?b.org_id:null;if(!s||S){let B=JSON.stringify([e.projectBaseURL,S,oe,s,ne]);r.cachedByKey.clear(),r.cachedByKey.set(B,{token:x,exp:M}),r.activeKey=B;}else o(r);}else o(r);return x})();if(y)return f;let d=f.finally(()=>{r.inflight===d&&(r.inflight=null);});return r.inflight=d,d}function i$1(){t.clear();}function o(a){a.cachedByKey.clear(),a.activeKey=null;}return {getToken:n,clear:i$1}}function ke(e,t){let n=h$1(e),i=i$1(n.token);if(i.length===0||i.length>32*1024)throw new TypeError("Invalid token response.");if(!t)return {token:i,policyVersion:0};let o=h$1(n.template);if(!Number.isSafeInteger(o.policyVersion)||o.policyVersion<1)throw new TypeError("Invalid token response.");return {token:i,policyVersion:o.policyVersion}}function xe(e$1){let t=N(e$1),n=e(e$1,t.clear,(s,p)=>g(s,p,Z)),i=c$1(e$1,`${new URL(e$1.apiUrl).origin}/api/projects/${e$1.decoded.projectId}`),o=s=>(...p)=>(t.clear(),s(...p)),a={getConsentStatus:()=>_(e$1),acceptConsent:s=>F(e$1,s),getToken:t.getToken,waitlist:{join:(s,p)=>i.request("/waitlist",{method:"POST",body:s,fetchOptions:p,credentials:"omit"})},account:{...n.account,updateUnsafeMetadata:o(n.account.updateUnsafeMetadata),updateProfile:o(n.account.updateProfile),changeEmail:o(n.account.changeEmail),changePassword:o(n.account.changePassword),revokeSession:o(n.account.revokeSession),delete:o(n.account.delete)},signIn:{email:o(n.signIn.email),username:o(n.signIn.username),social:o(n.signIn.social),sso:n.signIn.sso,magicLink:n.signIn.magicLink,emailOtp:o(n.signIn.emailOtp),passkey:o(n.signIn.passkey)},signUp:{email:o(n.signUp.email)},emailOtp:{...n.emailOtp,verifyEmail:o(n.emailOtp.verifyEmail)},twoFactor:{enable:n.twoFactor.enable,disable:o(n.twoFactor.disable),verifyTotp:o(n.twoFactor.verifyTotp),verifyBackupCode:o(n.twoFactor.verifyBackupCode),sendOtp:n.twoFactor.sendOtp,verifyOtp:o(n.twoFactor.verifyOtp),generateBackupCodes:n.twoFactor.generateBackupCodes},phoneOtp:{start:n.phoneOtp.start,verify:o(n.phoneOtp.verify)},signOut:o(n.signOut)};return {...n,...a}}var E=class extends Error{constructor(n,i){super(n);this.cause=i;this.name="AuthOwlError";}cause},L=class extends E{constructor(n,i){super(`Rate limited. Retry after ${n}s.`,i);this.retryAfterSeconds=n;this.name="RateLimitedError";}retryAfterSeconds},V=class extends E{constructor(t="invalid publishable key",n){super(t,n),this.name="InvalidKeyError";}};
-export{E as AuthOwlError,V as InvalidKeyError,L as RateLimitedError,F as acceptConsent,xe as createAuthOwlClient,N as createTokenClient,_ as getConsentStatus};
+export{a as LOCALES,b as directionFor,c as isLocale}from'./chunk-M4QJVSXT.js';import {i,j as j$1,e,g as g$1,c as c$1}from'./chunk-VZTAYWAD.js';export{b as AUTH_CHALLENGE_HEADER,h as AuthOwlHttpError,d as createIdempotencyKey,k as getPublicConfig,a as resolveProjectCapabilities}from'./chunk-VZTAYWAD.js';import {h,j as j$2,i as i$1}from'./chunk-KPXCQZUX.js';export{f as TransportError,v as createMembershipHas,a as decodePublishableKey,u as membershipHas,s as membershipHasPermission,t as membershipHasTeam,e as resolveConfig,b as sessionCookieName}from'./chunk-KPXCQZUX.js';function u(e){let n=new Uint8Array(e),t="";for(let o of n)t+=String.fromCharCode(o);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function g(e){let n=e.replace(/-/g,"+").replace(/_/g,"/"),t=(4-n.length%4)%4,i=n.padEnd(n.length+t,"="),o=atob(i),s=new ArrayBuffer(o.length),a=new Uint8Array(s);for(let l=0;l<o.length;l++)a[l]=o.charCodeAt(l);return s}function y(){return be.stubThis(globalThis?.PublicKeyCredential!==void 0&&typeof globalThis.PublicKeyCredential=="function")}var be={stubThis:e=>e};function C(e){let{id:n}=e;return {...e,id:g(n),transports:e.transports}}function T(e){return e==="localhost"||/^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(e)}var c=class extends Error{constructor({message:n,code:t,cause:i,name:o}){super(n,{cause:i}),Object.defineProperty(this,"code",{enumerable:true,configurable:true,writable:true,value:void 0}),this.name=o??i.name,this.code=t;}};function W({error:e,options:n}){let{publicKey:t}=n;if(!t)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(n.signal instanceof AbortSignal)return new c({message:"Registration ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else if(e.name==="ConstraintError"){if(t.authenticatorSelection?.requireResidentKey===true)return new c({message:"Discoverable credentials were required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",cause:e});if(n.mediation==="conditional"&&t.authenticatorSelection?.userVerification==="required")return new c({message:"User verification was required during automatic registration but it could not be performed",code:"ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",cause:e});if(t.authenticatorSelection?.userVerification==="required")return new c({message:"User verification was required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",cause:e})}else {if(e.name==="InvalidStateError")return new c({message:"The authenticator was previously registered",code:"ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",cause:e});if(e.name==="NotAllowedError")return new c({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="NotSupportedError")return t.pubKeyCredParams.filter(o=>o.type==="public-key").length===0?new c({message:'No entry in pubKeyCredParams was of type "public-key"',code:"ERROR_MALFORMED_PUBKEYCREDPARAMS",cause:e}):new c({message:"No available authenticator supported any of the specified pubKeyCredParams algorithms",code:"ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",cause:e});if(e.name==="SecurityError"){let i=globalThis.location.hostname;if(T(i)){if(t.rp.id!==i)return new c({message:`The RP ID "${t.rp.id}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new c({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="TypeError"){if(t.user.id.byteLength<1||t.user.id.byteLength>64)return new c({message:"User ID was not between 1 and 64 characters",code:"ERROR_INVALID_USER_ID_LENGTH",cause:e})}else if(e.name==="UnknownError")return new c({message:"The authenticator was unable to process the specified options, or could not create a new credential",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}var I=class{constructor(){Object.defineProperty(this,"controller",{enumerable:true,configurable:true,writable:true,value:void 0});}createNewAbortSignal(){if(this.controller){let t=new Error("Cancelling existing WebAuthn API call for new one");t.name="AbortError",this.controller.abort(t);}let n=new AbortController;return this.controller=n,n.signal}cancelCeremony(){if(this.controller){let n=new Error("Manually cancelling existing WebAuthn API call");n.name="AbortError",this.controller.abort(n),this.controller=void 0;}}},k=new I;var Re=["cross-platform","platform"];function P(e){if(e&&!(Re.indexOf(e)<0))return e}async function j(e){!e.optionsJSON&&e.challenge&&(console.warn("startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});let{optionsJSON:n,useAutoRegister:t=false}=e;if(!y())throw new Error("WebAuthn is not supported in this browser");let i={...n,challenge:g(n.challenge),user:{...n.user,id:g(n.user.id)},excludeCredentials:n.excludeCredentials?.map(C)},o={};t&&(o.mediation="conditional"),o.publicKey=i,o.signal=k.createNewAbortSignal();let s;try{s=await navigator.credentials.create(o);}catch(p){throw W({error:p,options:o})}if(!s)throw new Error("Registration was not completed");let{id:a,rawId:l,response:r,type:O}=s,d;typeof r.getTransports=="function"&&(d=r.getTransports());let h;if(typeof r.getPublicKeyAlgorithm=="function")try{h=r.getPublicKeyAlgorithm();}catch(p){U("getPublicKeyAlgorithm()",p);}let f;if(typeof r.getPublicKey=="function")try{let p=r.getPublicKey();p!==null&&(f=u(p));}catch(p){U("getPublicKey()",p);}let m;if(typeof r.getAuthenticatorData=="function")try{m=u(r.getAuthenticatorData());}catch(p){U("getAuthenticatorData()",p);}return {id:a,rawId:u(l),response:{attestationObject:u(r.attestationObject),clientDataJSON:u(r.clientDataJSON),transports:d,publicKeyAlgorithm:h,publicKey:f,authenticatorData:m},type:O,clientExtensionResults:s.getClientExtensionResults(),authenticatorAttachment:P(s.authenticatorAttachment)}}function U(e,n){console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${e}. You should report this error to them.
+`,n);}function $(){if(!y())return v.stubThis(new Promise(n=>n(false)));let e=globalThis.PublicKeyCredential;return e?.isConditionalMediationAvailable===void 0?v.stubThis(new Promise(n=>n(false))):v.stubThis(e.isConditionalMediationAvailable())}var v={stubThis:e=>e};function Y({error:e,options:n}){let{publicKey:t}=n;if(!t)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(n.signal instanceof AbortSignal)return new c({message:"Authentication ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else {if(e.name==="NotAllowedError")return new c({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="SecurityError"){let i=globalThis.location.hostname;if(T(i)){if(t.rpId!==i)return new c({message:`The RP ID "${t.rpId}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new c({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="UnknownError")return new c({message:"The authenticator was unable to process the specified options, or could not create a new assertion signature",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}async function Q(e){!e.optionsJSON&&e.challenge&&(console.warn("startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});let{optionsJSON:n,useBrowserAutofill:t=false,verifyBrowserAutofillInput:i=true}=e;if(!y())throw new Error("WebAuthn is not supported in this browser");let o;n.allowCredentials?.length!==0&&(o=n.allowCredentials?.map(C));let s={...n,challenge:g(n.challenge),allowCredentials:o},a={};if(t){if(!await $())throw Error("Browser does not support WebAuthn autofill");if(document.querySelectorAll("input[autocomplete$='webauthn']").length<1&&i)throw Error('No <input> with "webauthn" as the only or last value in its `autocomplete` attribute was detected');a.mediation="conditional",s.allowCredentials=[];}a.publicKey=s,a.signal=k.createNewAbortSignal();let l;try{l=await navigator.credentials.get(a);}catch(m){throw Y({error:m,options:a})}if(!l)throw new Error("Authentication was not completed");let{id:r,rawId:O,response:d,type:h}=l,f;return d.userHandle&&(f=u(d.userHandle)),{id:r,rawId:u(O),response:{authenticatorData:u(d.authenticatorData),clientDataJSON:u(d.clientDataJSON),signature:u(d.signature),userHandle:f},type:h,clientExtensionResults:l.getClientExtensionResults(),authenticatorAttachment:P(l.authenticatorAttachment)}}var Z={authenticate:e=>Q(e),register:e=>j(e),errorCode:e=>e instanceof c?e.code:void 0};function ee(e){return `${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}/consent`}async function _(e){let n=await i(e,ee(e),{init:{method:"GET",credentials:"include"},maxResponseBytes:65536,decode:we});return n.response.status===401?{required:false}:j$1(n,"consent status")}async function F(e,n){if(!Number.isSafeInteger(n)||n<1)throw new TypeError("Consent version must be a positive integer.");return j$1(await i(e,ee(e),{init:{method:"POST",headers:{"content-type":"application/json"},credentials:"include",body:JSON.stringify({version:n})},maxResponseBytes:64*1024,decode:Se}),"consent accept")}function we(e){let n=h(e),t=j$2(n.required),i=Ee(n.needsConsent),o=te(n.version),s=X(n.termsUrl),a=X(n.privacyUrl);return {required:t,...i===void 0?{}:{needsConsent:i},...o===void 0?{}:{version:o},...s===void 0?{}:{termsUrl:s},...a===void 0?{}:{privacyUrl:a}}}function Se(e){let n=h(e),t=te(n.version);return {ok:j$2(n.ok),...t===void 0?{}:{version:t}}}function Ee(e){if(e===void 0||typeof e=="boolean")return e;throw new TypeError("Invalid consent response.")}function te(e){if(e===void 0||Number.isSafeInteger(e)&&e>=1)return e;throw new TypeError("Invalid consent response.")}function X(e){if(e===void 0||typeof e=="string"&&e.length<=4096)return e;throw new TypeError("Invalid consent response.")}var Ce=30;function Te(e){return typeof e?.exp=="number"?e.exp:null}function ke(e){let n=e.split(".")[1];if(!n)return null;try{let t=n.replace(/-/g,"+").replace(/_/g,"/"),i=JSON.parse(atob(t));return typeof i=="object"&&i!==null?i:null}catch{return null}}function N(e){let n=new Map;async function t(s={}){let a=s.template===void 0?null:s.template.trim().toLowerCase();if(a==="")throw new TypeError("Template missing");let l=a??"",r=n.get(l);r||(r={activeKey:null,cachedByKey:new Map,inflight:null,sequence:0},n.set(l,r));let O=s.forceRefresh===true;if(!O){let p=r.activeKey?r.cachedByKey.get(r.activeKey):null;if(p&&p.exp-Date.now()/1e3>Ce)return p.token;if(r.inflight)return r.inflight}let d=++r.sequence,h=()=>n.get(l)===r&&r.sequence===d,f=(async()=>{let p=a?`${e.projectBaseURL}/token/${encodeURIComponent(a)}`:`${e.projectBaseURL}/token`,K=await i(e,p,{init:{method:"GET",credentials:"include"},maxResponseBytes:64*1024,decode:E=>Pe(E,a!==null)});if(K.response.status===401)return h()&&i$1(),null;let z=j$1(K,"token"),ne=z.policyVersion,x=z.token,b=ke(x),M=Te(b);if(h())if(M!==null){let E=typeof b?.sub=="string"?b.sub:null,oe=typeof b?.org_id=="string"?b.org_id:null;if(!a||E){let B=JSON.stringify([e.projectBaseURL,E,oe,a,ne]);r.cachedByKey.clear(),r.cachedByKey.set(B,{token:x,exp:M}),r.activeKey=B;}else o(r);}else o(r);return x})();if(O)return f;let m=f.finally(()=>{r.inflight===m&&(r.inflight=null);});return r.inflight=m,m}function i$1(){n.clear();}function o(s){s.cachedByKey.clear(),s.activeKey=null;}return {getToken:t,clear:i$1}}function Pe(e,n){let t=h(e),i=i$1(t.token);if(i.length===0||i.length>32*1024)throw new TypeError("Invalid token response.");if(!n)return {token:i,policyVersion:0};let o=h(t.template);if(!Number.isSafeInteger(o.policyVersion)||o.policyVersion<1)throw new TypeError("Invalid token response.");return {token:i,policyVersion:o.policyVersion}}function xe(e$1){let n=N(e$1),t=e(e$1,n.clear,(a,l)=>g$1(a,l,Z)),i=c$1(e$1,`${new URL(e$1.apiUrl).origin}/api/projects/${e$1.decoded.projectId}`),o=a=>(...l)=>(n.clear(),a(...l)),s={getConsentStatus:()=>_(e$1),acceptConsent:a=>F(e$1,a),getToken:n.getToken,waitlist:{join:(a,l)=>i.request("/waitlist",{method:"POST",body:a,fetchOptions:l,credentials:"omit"})},account:{...t.account,updateUnsafeMetadata:o(t.account.updateUnsafeMetadata),updateProfile:o(t.account.updateProfile),changeEmail:o(t.account.changeEmail),changePassword:o(t.account.changePassword),revokeSession:o(t.account.revokeSession),delete:o(t.account.delete)},signIn:{email:o(t.signIn.email),username:o(t.signIn.username),social:o(t.signIn.social),sso:t.signIn.sso,magicLink:t.signIn.magicLink,emailOtp:o(t.signIn.emailOtp),passkey:o(t.signIn.passkey)},signUp:{email:o(t.signUp.email)},emailOtp:{...t.emailOtp,verifyEmail:o(t.emailOtp.verifyEmail)},twoFactor:{enable:t.twoFactor.enable,disable:o(t.twoFactor.disable),verifyTotp:o(t.twoFactor.verifyTotp),verifyBackupCode:o(t.twoFactor.verifyBackupCode),sendOtp:t.twoFactor.sendOtp,verifyOtp:o(t.twoFactor.verifyOtp),generateBackupCodes:t.twoFactor.generateBackupCodes},phoneOtp:{prepare:t.phoneOtp.prepare,start:t.phoneOtp.start,verify:o(t.phoneOtp.verify)},signOut:o(t.signOut)};return {...t,...s}}async function De(e){if(typeof window>"u")throw new Error("Akedly Shield challenges must be solved in a browser.");let n=await Ie(),t=e.challengeRequired?await n.solvePow(e.challenge,e.difficulty):null,i=e.turnstile.required?await n.getTurnstileToken(Ue(e.turnstile.siteKey)):void 0;return {connectionId:e.connectionId,...t?{challengeToken:e.challengeToken,nonce:t.nonce}:{},...i?{turnstileToken:i}:{}}}async function Ie(){return import('@akedly/shield')}function Ue(e){if(!e)throw new Error("Akedly Shield did not provide a Turnstile site key.");return e}var S=class extends Error{constructor(t,i){super(t);this.cause=i;this.name="AuthOwlError";}cause},L=class extends S{constructor(t,i){super(`Rate limited. Retry after ${t}s.`,i);this.retryAfterSeconds=t;this.name="RateLimitedError";}retryAfterSeconds},V=class extends S{constructor(n="invalid publishable key",t){super(n,t),this.name="InvalidKeyError";}};
+export{S as AuthOwlError,V as InvalidKeyError,L as RateLimitedError,F as acceptConsent,xe as createAuthOwlClient,N as createTokenClient,_ as getConsentStatus,De as solvePhoneOtpChallenge};