@authowl/core 0.16.1 → 0.18.0

package/dist/chunk-PYXM7X2H.js

@@ -0,0 +1 @@
+import {p,o,i,z,s,q as q$1,y,r,w,B as B$1,E as E$1,x,t,A,v,u}from'./chunk-V3MSLXXB.js';import {a}from'./chunk-T5SH3ZZP.js';function Mi(e){let t=e?.enabledMethods??["password"],n=t.includes("password"),i=t.includes("passkey"),o=e?.authentication,a=e?.mfa;return {emailSignUp:o?.email.signUp??t.some(p=>p==="password"||p==="magic_link"||p==="email_otp"),passwordSignUp:o?.password.signUp??n,phoneSignUp:o?.phone.signUp??t.includes("phone_otp"),passwordSignIn:o?.email.signIn.includes("password")??n,passwordMinLength:o?.password.minLength??8,passwordMaxLength:o?.password.maxLength??128,magicLinkSignIn:o?.email.signIn.includes("magic_link")??t.includes("magic_link"),emailOtpSignIn:o?.email.signIn.includes("email_otp")??t.includes("email_otp"),phoneSignIn:o?.phone.signIn??t.includes("phone_otp"),usernameSignIn:o?.username.signIn??false,collectUsername:o?.username.collectOnSignUp??false,passkeySignIn:o?.passkey.signIn??i,passkeyAdd:o?.passkey.add??i,firstLastName:e?.userModel?.firstLastName??false,emailChange:e===null?false:e.userModel?.emailChange??true,accountDeletion:e?.userModel?.accountDeletion??e?.accountDeletion??false,emailVerificationRequired:e?.emailVerification?.required??e?.requireEmailVerification??false,emailVerificationMethod:e?.emailVerification?.method??"link",totp:a?.totp??e?.twoFactor??false,mfaRequired:a?.required??e?.mfaRequired??false,backupCodes:a?.backupCodes??e?.twoFactor??false,legacyNameField:e?.authentication===void 0}}var ce=class extends Error{status;requestId;constructor(t,n,i){super(`${t} request failed with status ${n.status}.`),this.name="AuthOwlHttpError",this.status=n.status,this.requestId=i;}};function ee(e,t,n={}){let i=new Headers(n.init?.headers);return i.set("x-publishable-key",e.publishableKey),p({fetchImpl:e.fetch,url:t,init:{...n.init,headers:i},allowHttpLoopback:e.decoded.env==="test",...n.timeoutMs===void 0?{}:{timeoutMs:n.timeoutMs},...n.maxResponseBytes===void 0?{}:{maxResponseBytes:n.maxResponseBytes},...n.decode===void 0?{}:{decode:n.decode}})}function _e(e,t){if(!e.response.ok)throw new ce(t,e.response,e.requestId);return e.data}var hn="x-authowl-turnstile-token",An=1e4,On=32,yn=2e4;function L(e,t){return {post:(n,i,o,a)=>e.request(n,{method:"POST",body:i,fetchOptions:o,decode:a}),mutation:async(n,i)=>{let o=await n;return o.error===null&&(i===void 0||o.data!==null&&i(o.data))&&t(),o}}}function ge(e,t=e.projectBaseURL){return {async request(n,i$1={}){let o$1=kn(t,n,i$1.query),a=i$1.method??(i$1.body===void 0?"GET":"POST"),p=new Headers(i$1.fetchOptions?.headers);i$1.fetchOptions?.authChallengeToken&&p.set(hn,i$1.fetchOptions.authChallengeToken),i$1.body!==void 0&&p.set("content-type","application/json");let f={method:a,headers:p,credentials:i$1.credentials??"include",...i$1.body===void 0?{}:{body:JSON.stringify(i$1.body)}},l=Object.freeze({method:a,path:n});await i$1.fetchOptions?.onRequest?.(l);let A=wn(a,i$1.fetchOptions),r;try{r=await bn(e,o$1,{...f,signal:i$1.fetchOptions?.signal},A);}catch(h){let R=Fe(h);return await i$1.fetchOptions?.onError?.(de(l,R,Sn(h))),{data:null,error:R}}let{response:s,requestId:g}=r,y=vn(n,r.data),u=y;if(s.ok)try{u=pe(y),i$1.decode&&(u=i$1.decode(u));}catch{let h=Fe(new o("invalid_response",g));return await i$1.fetchOptions?.onError?.(de(l,h,"invalid_response")),{data:null,error:h}}let d=Object.freeze({...l,status:s.status,...g===void 0?{}:{requestId:g}});if(await i$1.fetchOptions?.onResponse?.(d),!s.ok){let h=Rn(s,y,g);return h.code===i&&e.session.tokens.dropChallenge(),await i$1.fetchOptions?.onError?.(de(l,h,"api")),{data:null,error:h}}return await i$1.fetchOptions?.onSuccess?.(d),{data:u,error:null}}}}async function bn(e,t,n,i){let o$1=Date.now()+An;for(let a=0;a<i;a+=1){let p=o$1-Date.now();if(p<=0)throw new o("timeout");try{let f=await ee(e,t,{init:n,timeoutMs:Math.max(1,Math.ceil(p))});if(f.response.status<500||a===i-1)return f}catch(f){if(a===i-1||!(f instanceof o)||f.kind!=="network")throw f}await Tn(50*2**a,n.signal,o$1);}throw new o("network")}function wn(e,t){if(e!=="GET"||t?.authChallengeToken)return 1;let n=t?.retry;return typeof n!="number"||!Number.isFinite(n)?1:Math.min(Math.max(Math.trunc(n),0),3)+1}function kn(e,t,n){let i=new URL(`${e}${t.startsWith("/")?t:`/${t}`}`);for(let[o,a]of Object.entries(n??{}))a!==void 0&&i.searchParams.set(o,String(a));return i.toString()}function Rn(e,t,n){let i=B(t)?t:{},o=In(i,e.headers);return {status:e.status,statusText:e.statusText,code:typeof i.code=="string"?i.code:void 0,...n===void 0?{}:{requestId:n},...typeof i.current_version=="number"?{currentVersion:i.current_version}:{},...o!==void 0?{retryAfterSeconds:o}:{},message:typeof i.message=="string"?i.message:typeof i.error=="string"?i.error:typeof i.detail=="string"?i.detail:e.statusText||"Request failed"}}function In(e,t){let n=(typeof e.retryAfterSeconds=="number"&&Number.isFinite(e.retryAfterSeconds)?e.retryAfterSeconds:void 0)??Le(t.get("retry-after"))??Le(t.get("x-retry-after"));if(n!==void 0)return Math.min(Math.max(Math.trunc(n),1),86400)}function Le(e){if(!e)return;let t=e.trim();if(!/^\d+$/.test(t))return;let n=Number(t);return Number.isFinite(n)?n:void 0}function Fe(e){let t=e instanceof o?e.kind:"network";return {status:0,...{aborted:{statusText:"ABORTED",code:"REQUEST_ABORTED",message:"The request was cancelled."},timeout:{statusText:"TIMEOUT",code:"REQUEST_TIMEOUT",message:"The request timed out."},response_too_large:{statusText:"INVALID_RESPONSE",code:"RESPONSE_TOO_LARGE",message:"The service response was too large."},invalid_response:{statusText:"INVALID_RESPONSE",code:"INVALID_RESPONSE",message:"The service returned an invalid response."},network:{statusText:"FETCH_ERROR",code:"FETCH_ERROR",message:"Network request failed."}}[t],...e instanceof o&&e.requestId?{requestId:e.requestId}:{}}}function de(e,t,n){return Object.freeze({...e,status:t.status??0,...t.requestId===void 0?{}:{requestId:t.requestId},failure:n})}function Sn(e){return e instanceof o?e.kind:"network"}function Tn(e,t,n){return new Promise((i,o$1)=>{if(t?.aborted){o$1(new o("aborted"));return}let a=n-Date.now();if(a<=0){o$1(new o("timeout"));return}let p=Math.min(e,a),f=()=>{clearTimeout(l),o$1(new o("aborted"));},l=setTimeout(()=>{t?.removeEventListener("abort",f),Date.now()>=n?o$1(new o("timeout")):i();},p);t?.addEventListener("abort",f,{once:true}),t?.aborted&&f();})}function pe(e,t="",n=0,i={nodes:0}){if(i.nodes+=1,n>On||i.nodes>yn)throw new Error("response traversal limit exceeded");if(typeof e=="string"&&/^(?:createdAt|updatedAt|expiresAt)$/.test(t)){let o=new Date(e);return Number.isNaN(o.getTime())?e:o}return Array.isArray(e)?e.map(o=>pe(o,"",n+1,i)):B(e)?Object.fromEntries(Object.entries(e).map(([o,a])=>[o,Pn(o)?a:pe(a,o,n+1,i)])):e}function Pn(e){return e==="metadata"||e==="public_metadata"||e==="unsafe_metadata"||e==="private_metadata"||e==="publicMetadata"||e==="unsafeMetadata"||e==="privateMetadata"}function vn(e,t){if(e==="/list-sessions"&&Array.isArray(t))return t.map(o=>B(o)?le(o):o);if(!B(t))return t;let i=e==="/change-password"||e==="/passkey/verify-authentication"||e==="/phone-otp/verify"||e==="/sign-up/email"||e.startsWith("/sign-in/")||e.startsWith("/two-factor/verify-")?le(t):t;return e==="/sign-up/email"&&!("sessionCreated"in i)&&(i={...i,sessionCreated:typeof t.token=="string"&&t.token.length>0}),(e==="/get-session"||e==="/passkey/verify-authentication")&&B(i.session)&&(i={...i,session:le(i.session)}),i}function le(e){if(!Object.hasOwn(e,"token"))return e;let t={...e};return delete t.token,t}function B(e){return !!e&&typeof e=="object"&&!Array.isArray(e)}function qe(){let e=globalThis.crypto.getRandomValues(new Uint8Array(16));e[6]=e[6]&15|64,e[8]=e[8]&63|128;let t=Array.from(e,n=>n.toString(16).padStart(2,"0")).join("");return `${t.slice(0,8)}-${t.slice(8,12)}-${t.slice(12,16)}-${t.slice(16,20)}-${t.slice(20)}`}function He({http:e,probe:t,tokens:n,channelName:i}){let o=new Set,a=null,p=null,f=null,l=null,A=null,r=null,s,g=O=>{d(O);};s={data:null,isPending:true,isRefetching:false,error:null,refetch:g};function y(O){s=O;for(let I of o)I();}async function u(O){return e.request("/get-session",{query:O?.query,decode:me})}function d(O){if(O?.query?.disableCookieCache===true)return R(O);if(l)return l;if(A)return A;let I=R(O).finally(()=>{A===I&&(A=null);});return A=I,I}function h(){if(l)return l;let O=R({query:{disableCookieCache:true}}).finally(()=>{l===O&&(l=null);});return l=O,O}async function R(O){f?.abort();let I=new AbortController;f=I,y({...s,isPending:s.data===null&&s.error===null,isRefetching:s.data!==null});let K=n.beginRead(),Y=await e.request("/get-session",{query:O?.query,fetchOptions:{signal:I.signal},decode:me});if(f===I&&(f=null,y({data:Y.data,error:Y.error,isPending:false,isRefetching:false,refetch:g}),Y.error===null)){if(Y.data===null){K.endIfDead();return}await x(K);}}async function x(O){if(n.needsProbe()){if(!O.carriedToken){O.recordCookieVerdict(true);return}return r||Ce(O)}}function Ce(O){let I=t.request("/get-session",{query:{disableCookieCache:true},decode:me}).then(K=>{r===I&&K.error===null&&O.recordCookieVerdict(K.data!==null);}).finally(()=>{r===I&&(r=null);});return r=I,I}function De(){a?.postMessage({type:"session-changed"});}function mn(){if(typeof window>"u"||p)return;let O=()=>{d();},I=()=>{document.visibilityState==="visible"&&d();};window.addEventListener("focus",O),document.addEventListener("visibilitychange",I),typeof BroadcastChannel<"u"&&(a=new BroadcastChannel(i),a.addEventListener("message",O)),p=()=>{window.removeEventListener("focus",O),document.removeEventListener("visibilitychange",I),a?.close(),a=null,p=null;};}function fn(O){return o.add(O),o.size===1&&(mn(),d()),()=>{if(o.delete(O),o.size===0){let I=f;f=null,A=null,l=null,I?.abort(),p?.();}}}return n.measureWith(()=>{n.needsProbe()&&Ce(n.beginRead());}),{store:{subscribe:fn,getSnapshot:()=>s,refresh:h},getSession:u,notifyMutation(){De(),r&&r.catch(()=>{}).then(()=>{!n.needsProbe()&&n.hasToken()&&De();}),o.size>0&&d({query:{disableCookieCache:true}});}}}function me(e){if(e===null)return null;let t=q$1(e);return (t.session===void 0||t.user===void 0)&&y(),{session:x(t.session),user:w(t.user)}}async function Ve(e,t){return e.request("/user/metadata",{fetchOptions:t,decode:Be})}async function Ke(e,t,n){return e.request("/user/metadata",{method:"PATCH",body:{expected_version:t.expectedVersion,unsafe_metadata:t.unsafeMetadata},fetchOptions:n,decode:Be})}function Be(e){let t=q$1(e),n=z(t.public_metadata),i=z(t.unsafe_metadata);if(!Number.isSafeInteger(t.metadata_version)||t.metadata_version<0)throw new TypeError("Invalid AuthOwl metadata response");return {publicMetadata:n,unsafeMetadata:i,metadataVersion:t.metadata_version}}function Ge(e,t){let{post:n,mutation:i}=L(e,t);return {getMetadata:o=>Ve(e,o),updateUnsafeMetadata:(o,a)=>Ke(e,o,a),updateProfile:(o,a)=>i(n("/update-user",o,a,j)),changeEmail:(o,a)=>i(n("/change-email",o,a,j)),changePassword:(o,a)=>i(n("/change-password",o,a,zn)),listSessions:o=>e.request("/list-sessions",{fetchOptions:o,decode:Cn}),revokeSession:({sessionId:o},a)=>i(n("/revoke-session",{sessionId:o},a,j)),revokeOtherSessions:o=>i(n("/revoke-other-sessions",{},o,j)),listSocialAccounts:async o=>{let a=await e.request("/list-accounts",{fetchOptions:o,decode:Dn});if(!a.data)return {data:null,error:a.error};let p=a.data.length>1;return {...a,data:a.data.filter(f=>f.providerId!=="credential").map(f=>({...f,canUnlink:p}))}},linkSocial:(o,a)=>n("/link-social",o,a,xn),unlinkSocial:(o,a)=>i(n("/unlink-account",o,a,j)),delete:(o={},a)=>i(n("/delete-user",o,a,En))}}function j(e){let t=q$1(e);return {status:s(t.status)}}function zn(e){let t=q$1(e);return {user:w(t.user)}}function Cn(e){return Array.isArray(e)||y(),e.map(t$1=>{let n=q$1(t$1);return {id:r(n.id),userId:r(n.userId),createdAt:t(n.createdAt),updatedAt:t(n.updatedAt),expiresAt:t(n.expiresAt),...je("ipAddress",v(n,"ipAddress")),...je("userAgent",v(n,"userAgent"))}})}function Dn(e){return Array.isArray(e)||y(),e.map(t$1=>{let n=q$1(t$1);return {id:r(n.id),userId:r(n.userId),providerId:r(n.providerId),accountId:r(n.accountId),scopes:u(n.scopes),createdAt:t(n.createdAt),updatedAt:t(n.updatedAt)}})}function xn(e){let t=q$1(e);return {url:r(t.url),redirect:s(t.redirect)}}function En(e){let t=q$1(e);return {success:s(t.success),message:r(t.message)}}function je(e,t){return t===void 0?{}:{[e]:t}}var Nn=new Set(["pending","accepted","rejected","canceled"]),fe=1e4;function Je(e){let t=q$1(e);return t.recipientHint!==null&&t.recipientHint!=="new_user"&&y(),{recipientHint:t.recipientHint}}function F(e,t$1,n){let i=q$1(e),o={id:b(i.id),name:b(i.name),slug:b(i.slug),createdAt:t(i.createdAt),...G("logo",v(i,"logo")),...G("metadata",i.metadata===void 0?void 0:A(i.metadata))};return E(o.id,t$1),E(o.slug,n),o}function We(e){return U(e,F)}function he(e,t,n){return e===null?null:(t===null&&y(),F(e,t,n))}function Xe(e,t,n){if(e===null)return null;let i=q$1(e),o=F(i,t,n);return {...o,members:U(i.members,a=>st(a,o.id)),invitations:U(i.invitations,a=>M(a,void 0,o.id))}}function Ae(e,t,n=false){let i=U(e,o=>J(o));return n||X(i.map(o=>o.organizationId),t),i}function $e(e,t){let n=U(e,i=>Oe(i));return X(n.map(i=>i.teamId),t),n}function Oe(e,t$1,n){let i=q$1(e),o={id:b(i.id),teamId:b(i.teamId),userId:b(i.userId),createdAt:t(i.createdAt)};return E(o.teamId,t$1),E(o.userId,n),o}function Ye(e,t,n){return e===null?null:(t===null&&y(),J(e,t,n))}function Qe(e,t){let n=q$1(e);return (!Number.isSafeInteger(n.total)||n.total<0)&&y(),{members:Un(n.members,t),total:n.total}}function M(e,t$1,n){let i=q$1(e),o=b(i.status);Nn.has(o)||y();let a={id:b(i.id),organizationId:b(i.organizationId),email:W(i.email),role:b(i.role),status:o,inviterId:b(i.inviterId),expiresAt:t(i.expiresAt),createdAt:t(i.createdAt)};return E(a.id,t$1),E(a.organizationId,n),a}function Ze(e,t){let n=U(e,i=>M(i));return X(n.map(i=>i.organizationId),t),n}function et(e){return U(e,t=>{let n=q$1(t);return {...M(n),organizationName:W(n.organizationName)}})}function tt(e,t){let n=q$1(e);return {...M(n,t),organizationName:b(n.organizationName),organizationSlug:b(n.organizationSlug),inviterEmail:ut(n.inviterEmail)}}function nt(e,t){let n=q$1(e),i=M(n.invitation,t);return {invitation:i,member:q(n.member,void 0,i.organizationId)}}function it(e,t){let n=q$1(e);return n.member!==null&&y(),{invitation:n.invitation===null?null:M(n.invitation,t),member:null}}function ot(e,t){return e===null?null:M(e,t)}function rt(e,t,n){let i=q$1(e);return {member:q(i.member,n,t)}}function q(e,t$1,n){let i=q$1(e),o={id:b(i.id),organizationId:b(i.organizationId),userId:b(i.userId),role:b(i.role),createdAt:t(i.createdAt),...i.user===void 0?{}:{user:ct(i.user)}};return E(o.id,t$1),E(o.organizationId,n),o}function at(e,t){let n=U(e,i=>{let o=q$1(i);return {organizationId:b(o.organizationId),data:{role:b(o.role),...G("permission",o.permission===void 0?void 0:Mn(o.permission)),...G("customPermissionKeys",o.customPermissionKeys===void 0?void 0:u(o.customPermissionKeys))}}});return X(n.map(i=>i.organizationId),t),n.map(i=>i.data)}function J(e,t$1,n){let i=q$1(e),o=i.updatedAt,a={id:b(i.id),name:W(i.name),organizationId:b(i.organizationId),createdAt:t(i.createdAt),...o===void 0?{}:{updatedAt:t(o)}};return E(a.id,t$1),E(a.organizationId,n),a}function ye(e){let t=q$1(e);return {message:W(t.message)}}function st(e,t){let n=q$1(e);return {...q(n,void 0,t),user:ct(n.user)}}function Un(e,t){let n=U(e,i=>st(i));return X(n.map(i=>i.organizationId),t),n}function Mn(e){let t=q$1(e),n={};for(let[i,o]of Object.entries(t))(i==="__proto__"||i==="constructor"||i==="prototype"||i.length===0||i.length>fe||!Array.isArray(o))&&y(),n[i]=o.map(a=>b(a));return n}function b(e){let t=r(e);return (t.length===0||t.length>fe)&&y(),t}function W(e){if(e==null)return "";let t=r(e);return t.length>fe&&y(),t}function ut(e){return e===null?null:b(e)}function E(e,t){t!==void 0&&e!==t&&y();}function X(e,t){let n=t??e[0];n!==void 0&&e.some(i=>i!==n)&&y();}function ct(e){let t=q$1(e);return {id:b(t.id),name:W(t.name),email:ut(t.email),...G("image",v(t,"image"))}}function U(e,t){return Array.isArray(e)||y(),e.map(n=>t(n))}function G(e,t){return t===void 0?{}:{[e]:t}}function dt(e,t,n=()=>null){let{post:i,mutation:o}=L(e,t),a=new Set,p=()=>{for(let r of a)try{r();}catch{}},f=new Map,l=(r,s,g,y)=>{if(g)return e.request(r,{query:s,fetchOptions:g,decode:y});let u=`${r}\0${JSON.stringify(s??null)}`,d=f.get(u);if(d)return d;let h=e.request(r,{query:s,decode:y}).finally(()=>{f.delete(u);});return f.set(u,h),h},A=async r=>{let s=await o(r).finally(()=>f.clear());return s.error===null&&p(),s};return {subscribe(r){return a.add(r),()=>a.delete(r)},create:(r,s)=>A(i("/organization/create",r,s,F)),list:r=>l("/organization/list",void 0,r,We),get:(r={},s)=>l("/organization/get-full-organization",{organizationId:r.organizationId,organizationSlug:r.organizationSlug,membersLimit:r.membersLimit},s,g=>Xe(g,r.organizationId,r.organizationSlug)),setActive:(r,s)=>A(i("/organization/set-active",r,s,g=>he(g,r.organizationId,r.organizationSlug))),createTeam:(r,s)=>A(i("/organization/create-team",r,s,g=>J(g,void 0,r.organizationId))),listTeams:(r={},s)=>l("/organization/list-teams",{organizationId:r.organizationId},s,g=>Ae(g,r.organizationId)),updateTeam:(r,s)=>A(i("/organization/update-team",r,s,g=>J(g,r.teamId,r.data.organizationId))),removeTeam:(r,s)=>A(i("/organization/remove-team",r,s,ye)),listUserTeams:r=>l("/organization/list-user-teams",void 0,r,s=>Ae(s,void 0,true)),listTeamMembers:(r={},s)=>l("/organization/list-team-members",{teamId:r.teamId},s,g=>$e(g,r.teamId)),addTeamMember:(r,s)=>A(i("/organization/add-team-member",r,s,g=>Oe(g,r.teamId,r.userId))),removeTeamMember:(r,s)=>A(i("/organization/remove-team-member",r,s,ye)),setActiveTeam:(r,s)=>A(i("/organization/set-active-team",r,s,g=>Ye(g,r.teamId))),update:(r,s)=>A(i("/organization/update",r,s,g=>he(g,r.organizationId))),delete:(r,s)=>A(i("/organization/delete",r,s,g=>F(g,r.organizationId))),listMembers:(r={},s)=>l("/organization/list-members",{organizationId:r.organizationId,organizationSlug:r.organizationSlug,limit:r.limit,offset:r.offset,sortBy:r.sortBy,sortDirection:r.sortDirection,filterField:r.filterField,filterValue:r.filterValue,filterOperator:r.filterOperator},s,g=>Qe(g,r.organizationId)),inviteMember:(r,s)=>A(i("/organization/invite-member",r,s,g=>M(g,void 0,r.organizationId))),listInvitations:(r={},s)=>l("/organization/list-invitations",{organizationId:r.organizationId},s,g=>Ze(g,r.organizationId)),listUserInvitations:r=>l("/organization/list-user-invitations",void 0,r,et),getInvitation:(r,s)=>l("/organization/get-invitation",{id:r.id},s,g=>tt(g,r.id)),getInvitationRecipientHint:(r,s)=>l("/organization/invitation-recipient-hint",{invitationId:r.invitationId},s,Je),acceptInvitation:(r,s)=>A(i("/organization/accept-invitation",r,s,g=>nt(g,r.invitationId))),rejectInvitation:(r,s)=>A(i("/organization/reject-invitation",r,s,g=>it(g,r.invitationId))),cancelInvitation:(r,s)=>A(i("/organization/cancel-invitation",r,s,g=>ot(g,r.invitationId))),removeMember:(r,s)=>A(i("/organization/remove-member",r,s,g=>rt(g,r.organizationId,r.memberIdOrEmail.includes("@")?void 0:r.memberIdOrEmail))),updateMemberRole:(r,s)=>A(i("/organization/update-member-role",r,s,g=>q(g,r.memberId,r.organizationId))),leave:(r,s)=>A(i("/organization/leave",r,s,g=>q(g,void 0,r.organizationId))),listRoles:(r={},s)=>l("/organization/list-roles",{organizationId:r.organizationId},s,g=>at(g,r.organizationId)),has:r=>E$1(n(),r),hasPermission:r=>B$1(n(),r.permission)}}var lt=4096,_n=4096,Ln=100,Fn=256,qn=16,Hn=64,Vn=12;function we(e){let t=q$1(e);return t.twoFactorRedirect===true?((t.user!==void 0||t.redirect!==void 0||t.url!==void 0)&&y(),{twoFactorRedirect:true,...t.twoFactorMethods===void 0?{}:{twoFactorMethods:zt(t.twoFactorMethods,qn,Hn)}}):(t.twoFactorRedirect!==void 0&&y(),{redirect:s(t.redirect),...Jn(t,"url"),user:w(t.user)})}function pt(e){let t=q$1(e);return {user:w(t.user)}}function gt(e){let t=q$1(e);return {sessionCreated:s(t.sessionCreated),user:w(t.user)}}function mt(e,t){let n=q$1(e),i=s(n.redirect);n.user===null&&y();let o=n.user!==void 0&&n.user!==null,a=n.url!==void 0&&n.url!==null;return i?((o||!a)&&y(),{redirect:true,url:be(n.url,t)}):(o===a&&y(),o?{redirect:false,user:w(n.user)}:{redirect:false,url:be(n.url,t)})}function ft(e,t){let n=q$1(e);return (n.redirect!==true||n.user!==void 0)&&y(),{redirect:true,url:be(n.url,t)}}function ht(e){return {status:s(q$1(e).status)}}function At(e){return {success:s(q$1(e).success)}}function Ot(e){return q$1(e).status!=="pending"&&y(),{status:"pending"}}function yt(e){let t=q$1(e);if(t.kind==="authowl_turnstile")return {kind:"authowl_turnstile"};t.kind!=="akedly_shield_v1_2"&&y();let n=q$1(t.turnstile),i=n.siteKey===null?null:r(n.siteKey);return {kind:"akedly_shield_v1_2",connectionId:r(t.connectionId),challenge:r(t.challenge),difficulty:Kn(t.difficulty),challengeToken:r(t.challengeToken),challengeRequired:s(t.challengeRequired),turnstile:{required:s(n.required),siteKey:i}}}function Kn(e){return (!Number.isSafeInteger(e)||Number(e)<0||Number(e)>Vn)&&y(),Number(e)}function bt(e){let t=q$1(e);return (t.status!==true||t.sessionCreated!==true)&&y(),{status:true,sessionCreated:true,user:Bn(t.user)}}function ke(e){return {status:s(q$1(e).status)}}function wt(e){return {status:s(q$1(e).status)}}function kt(e){let t=q$1(e);return {status:s(t.status),user:w(t.user)}}function Rt(e){return {success:s(q$1(e).success)}}function It(e){let t=q$1(e);return {totpURI:Gn(t.totpURI),backupCodes:vt(t.backupCodes)}}function St(e){return {status:s(q$1(e).status)}}function te(e){return q$1(e).status!==true&&y(),{status:true}}function Tt(e){return {status:s(q$1(e).status)}}function Pt(e){let t=q$1(e);return t.status!==void 0&&t.status!==true&&y(),{backupCodes:vt(t.backupCodes)}}function Bn(e){let t$1=q$1(e);return {id:H(t$1.id,512),...Wn(t$1,"name",1024),phoneNumber:H(t$1.phoneNumber,64),phoneNumberVerified:s(t$1.phoneNumberVerified),...t$1.createdAt===void 0?{}:{createdAt:t(t$1.createdAt)},...t$1.updatedAt===void 0?{}:{updatedAt:t(t$1.updatedAt)}}}function be(e,t){let n=H(e,lt);/[\u0000-\u0020\u007f]/u.test(n)&&y();let i;try{i=new URL(n);}catch{return y()}return (i.username||i.password)&&y(),i.protocol==="https:"||t&&i.protocol==="http:"&&jn(i.hostname)?i.href:y()}function jn(e){let t=e.toLowerCase();return t==="localhost"||t==="127.0.0.1"||t==="[::1]"}function Gn(e){let t=H(e,_n),n;try{n=new URL(t);}catch{return y()}let i=n.searchParams.get("secret");return (n.protocol!=="otpauth:"||n.hostname.toLowerCase()!=="totp"||n.username||n.password||n.hash||i===null||i.length===0||i.length>512||/\s/u.test(i))&&y(),t}function vt(e){return zt(e,Ln,Fn)}function zt(e,t,n){(!Array.isArray(e)||e.length===0||e.length>t)&&y();let i=e.map(o=>H(o,n));return i.some(o=>o.trim().length===0)&&y(),new Set(i).size!==i.length&&y(),i}function H(e,t){let n=r(e);return (n.length===0||n.length>t)&&y(),n}function Jn(e,t){let n=e[t];return n==null?{}:{[t]:H(n,lt)}}function Wn(e,t,n){let i=v(e,t);return i===void 0?{}:(i!==null&&i.length>n&&y(),{[t]:i})}var Ct=new Set([1564,8206,8207,8234,8235,8236,8237,8238,8294,8295,8296,8297]),ne=new Set([9,10,11,12,13,32,133,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288,65279]);function ie(e){if(e===void 0)return {valid:true,value:void 0};for(let n of e){let i=n.codePointAt(0);if(i===void 0||xt(n,i)||Dt(i)||Ct.has(i))return {valid:false}}let t=Xn(e);return Re(t)?{valid:true,value:t}:{valid:false}}function Re(e){let t=0,n,i;for(let o of e){if(t+=1,t>256)return  false;let a=o.codePointAt(0);if(a===void 0||xt(o,a)||Dt(a)||Ct.has(a))return  false;n??=a,i=a;}return t>0&&n!==void 0&&i!==void 0&&!ne.has(n)&&!ne.has(i)}function oe(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_PASSKEY_NAME",message:"Passkey names must contain 1 to 256 safe Unicode characters."}}}function Xn(e){let t=0,n=e.length;for(;t<n;){let i=e.codePointAt(t);if(i===void 0||!ne.has(i))break;t+=i>65535?2:1;}for(;n>t;){let i=e.codePointAt(n-1);if(i===void 0)break;let a=i>=56320&&i<=57343?n-2:n-1,p=e.codePointAt(a);if(p===void 0||!ne.has(p))break;n=a;}return e.slice(t,n)}function Dt(e){return e>=0&&e<=31||e>=127&&e<=159}function xt(e,t){return e.length===1&&t>=55296&&t<=57343}var Ut=12,Mt=5e3,$n=8,Yn=1e3,Qn=16,Et=512,_t=100,Lt=8192,Zn=32768,Ie=1024,Nt=256,Te=64,ei=6e5,ti=/^[A-Za-z0-9_-]+$/u,ni=/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u,ii=/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u,oi=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/u,ri=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu,Ft=new Set(["discouraged","preferred","required"]),ai=new Set(["singleDevice","multiDevice"]),qt=new Set(["ble","cable","hybrid","internal","nfc","smart-card","usb"]),Ht=new Set(["hybrid","security-key","client-device"]),si=new Set(["none","indirect","direct","enterprise"]),ui=new Set(["fido-u2f","packed","android-safetynet","android-key","tpm","apple","none"]),ci=new Set(["platform","cross-platform"]),di=new Set(["discouraged","preferred","required"]),li=new Set([-8,-7,-257]);function Vt(e){let t=z(e,Ut,Mt);return {challenge:Qt(t.challenge),...T("timeout",$t(t.timeout)),...T("rpId",Zt(t.rpId)),...T("allowCredentials",Xt(t.allowCredentials)),...T("userVerification",$(t.userVerification,Ft)),...T("hints",re(t.hints,Ht)),...T("extensions",Yt(t.extensions))}}function Kt(e){let t=z(e,Ut,Mt);return {challenge:Qt(t.challenge),rp:pi(t.rp),user:gi(t.user),pubKeyCredParams:mi(t.pubKeyCredParams),...T("timeout",$t(t.timeout)),...T("excludeCredentials",Xt(t.excludeCredentials)),...T("authenticatorSelection",fi(t.authenticatorSelection)),...T("attestation",$(t.attestation,si)),...T("attestationFormats",re(t.attestationFormats,ui)),...T("hints",re(t.hints,Ht)),...T("extensions",Yt(t.extensions))}}function Bt(e){let t=q$1(e),n=x(t.session),i=w(t.user);return n.userId!==i.id&&y(),{session:n,user:i}}function Pe(e){let t$1=q$1(e),n=t$1.counter;(!Number.isSafeInteger(n)||n<0)&&y();let i=ve(t$1.deviceType,ai),o=s(t$1.backedUp);return o&&i!=="multiDevice"&&y(),{id:V(t$1.id,Nt),...Oi(t$1),publicKey:hi(t$1.publicKey,Zn),userId:V(t$1.userId,Nt),credentialID:se(t$1.credentialID,Lt),counter:n,deviceType:i,backedUp:o,...yi(t$1),createdAt:t(t$1.createdAt),...bi(t$1)}}function jt(e,t,n){let i=Pe(e);return (i.credentialID!==t||(n===void 0?i.name!==void 0&&i.name!==null:i.name!==n))&&y(),i}function Gt(e){(!Array.isArray(e)||e.length>_t)&&y();let t=e.map(Pe);return ae(t.map(n=>n.id)),ae(t.map(n=>n.credentialID)),t.length>1&&t.some(n=>n.userId!==t[0]?.userId)&&y(),t}function Jt(e,t,n){let i=q$1(e),o=Pe(i.passkey);return (o.id!==t||o.name!==n)&&y(),{passkey:o}}function Wt(e){return q$1(e).status!==true&&y(),{status:true}}function pi(e){let t=q$1(e);return {name:Se(t.name,Ie),...T("id",Zt(t.id))}}function gi(e){let t=q$1(e);return {id:se(t.id,128,1,64),name:Se(t.name,Ie),displayName:Se(t.displayName,Ie)}}function mi(e){(!Array.isArray(e)||e.length===0||e.length>Te)&&y();let t=e.map(n=>{let i=q$1(n);return (i.type!=="public-key"||!Number.isSafeInteger(i.alg)||!li.has(i.alg))&&y(),{type:"public-key",alg:i.alg}});return wi(t.map(n=>n.alg)),t}function Xt(e){if(e===void 0)return;(!Array.isArray(e)||e.length>_t)&&y();let t=e.map(n=>{let i=q$1(n);return i.type!=="public-key"&&y(),{type:"public-key",id:se(i.id,Lt),...T("transports",re(i.transports,qt))}});return ae(t.map(n=>n.id)),t}function fi(e){if(e===void 0)return;let t=q$1(e);t.requireResidentKey!==void 0&&typeof t.requireResidentKey!="boolean"&&y();let n=$(t.residentKey,di);return t.requireResidentKey!==void 0&&n!==void 0&&t.requireResidentKey!==(n==="required")&&y(),{...T("authenticatorAttachment",$(t.authenticatorAttachment,ci)),...T("residentKey",n),...T("requireResidentKey",t.requireResidentKey),...T("userVerification",$(t.userVerification,Ft))}}function $t(e){return e!==void 0&&(typeof e!="number"||!Number.isFinite(e)||e<0||e>ei)&&y(),e}function Yt(e){return e===void 0?void 0:z(e,$n,Yn)}function re(e,t){if(e===void 0)return;(!Array.isArray(e)||e.length>Te)&&y();let n=e.map(i=>ve(i,t));return ae(n),n}function $(e,t){if(e!==void 0)return ve(e,t)}function Qt(e){return se(e,Math.ceil(Et*4/3),Qn,Et)}function se(e,t,n=1,i=Number.POSITIVE_INFINITY){let o=V(e,t),a=o.length%4,p=Ai(o.at(-1)??""),f=Math.floor(o.length*3/4);return (!ti.test(o)||a===1||a===2&&(p&15)!==0||a===3&&(p&3)!==0||f<n||f>i)&&y(),o}function V(e,t){let n=r(e);return (n.length===0||n.length>t)&&y(),n}function Se(e,t){let n=V(e,t);return ii.test(n)&&y(),n}function Zt(e){if(e===void 0)return;let t=V(e,253);return t!=="localhost"&&(t.endsWith(".")||!t.includes(".")||t.split(".").some(n=>!oi.test(n)))&&y(),t}function hi(e,t){let n=V(e,t),i=n.endsWith("=="),o=!i&&n.endsWith("="),a=n.at(i?-3:o?-2:-1)??"",p=en(a);return (n.length%4!==0||!ni.test(n)||i&&(p&15)!==0||o&&(p&3)!==0)&&y(),n}function Ai(e){return en(e,true)}function en(e,t=false){return (t?"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/").indexOf(e)}function Oi(e){let t=v(e,"name");return t===void 0?{}:(t!==null&&!Re(t)&&y(),{name:t})}function yi(e){let t=v(e,"transports");if(t==null||t==="")return t===void 0?{}:{transports:t};let n=t.split(",");return (n.length>Te||n.some(i=>!qt.has(i))||new Set(n).size!==n.length)&&y(),{transports:t}}function bi(e){let t=v(e,"aaguid");return t==null?t===void 0?{}:{aaguid:null}:(ri.test(t)||y(),{aaguid:t})}function ve(e,t){let n=r(e);return t.has(n)||y(),n}function T(e,t){return t===void 0?{}:{[e]:t}}function ae(e){new Set(e).size!==e.length&&y();}function wi(e){new Set(e).size!==e.length&&y();}function ki(e,t){if(!t)return e;let n=t.catch(()=>{});return n.then(()=>{n=null;}),{async request(i,o){return n&&await n,e.request(i,o)}}}var tn=new Map;function Ri(e,t,n){let i=tn.get(n);if(!i){let o=new URLSearchParams(window.location.hash.slice(1)).get("authowl_code");if(!o)return;i=import('./session-handoff-6FBH3GFJ.js').then(a=>a.completeCrossSiteSignIn(e,t,o)),tn.set(n,i);}return i}function nn(e){return !a()||e.idToken||e.disableRedirect?"legacy":"first-party"}function Ii(e,t=()=>{},n=Pi){let i=ge(e),o=e.session.tokens,a$1=a()?Ri(i,o,e.decoded.projectId):void 0,p=ki(i,a$1),f=He({http:p,probe:ge({...e,fetch:e.session.probe}),tokens:o,channelName:`authowl:${e.decoded.projectId}`}),l=n(p,f.notifyMutation),A=()=>{f.notifyMutation(),t();},{post:r,mutation:s}=L(p,A),g=e.decoded.env==="test",y=u=>{o.beginSession({remember:u?.rememberMe!==false});};return {sessionStore:f.store,getSession:f.getSession,account:Ge(p,A),organization:dt(p,A,()=>f.store.getSnapshot().data?.session.membership??null),signIn:{email:(u,d)=>(y(u),s(r("/sign-in/email",u,d,we),h=>!("twoFactorRedirect"in h))),username:(u,d)=>(y(u),s(r("/sign-in/username",u,d,we),h=>!("twoFactorRedirect"in h))),social:async(u,d)=>{if(y(),nn(u)==="first-party"){let{beginCrossSiteSignIn:R}=await import('./session-handoff-6FBH3GFJ.js'),x=await R(e,{kind:"social",provider:u.provider,callbackURL:u.callbackURL,errorCallbackURL:u.errorCallbackURL,newUserCallbackURL:u.newUserCallbackURL,scopes:u.scopes,loginHint:u.loginHint,requestSignUp:u.requestSignUp});if(x)return window.location.assign(x),{data:{redirect:true,url:x},error:null}}let h=await s(r("/sign-in/social",u,d,R=>mt(R,g)),R=>"user"in R);return h.error!==null||h.data===null||"url"in h.data&&h.data.redirect&&!u.disableRedirect&&typeof window<"u"&&window.location.assign(h.data.url),h},sso:async(u,d)=>{if(nn(u)==="first-party"){let{beginCrossSiteSignIn:R}=await import('./session-handoff-6FBH3GFJ.js'),x=await R(e,{kind:"sso",email:u.email,providerId:u.providerId,domain:u.domain,organizationSlug:u.organizationSlug,callbackURL:u.callbackURL,errorCallbackURL:u.errorCallbackURL,newUserCallbackURL:u.newUserCallbackURL});if(x)return window.location.assign(x),{data:{url:x,redirect:true},error:null}}let h=await r("/sign-in/sso",u,d,R=>ft(R,g));return h.error!==null||h.data===null||typeof window<"u"&&window.location.assign(h.data.url),h},magicLink:(u,d)=>r("/sign-in/magic-link",u,d,ht),emailOtp:(u,d)=>(y(),s(r("/sign-in/email-otp",u,d,pt))),passkey:(u,d)=>(y(),l.signIn(u,d))},signUp:{email:(u,d)=>(y(),s(r("/sign-up/email",u,d,gt),h=>h.sessionCreated))},emailOtp:{sendVerificationOtp:(u,d)=>r("/email-otp/send-verification-otp",u,d,At),verifyEmail:(u,d)=>(y(),s(r("/email-otp/verify-email",u,d,kt)))},phoneOtp:{prepare:u=>r("/phone-otp/challenge",{},u,yt),start:(u,d)=>r("/phone-otp/start",{...u,idempotencyKey:u.idempotencyKey??qe()},d,Ot),verify:(u,d)=>(y(),s(r("/phone-otp/verify",u,d,bt)))},requestPasswordReset:(u,d)=>r("/request-password-reset",u,d,ke),resetPassword:(u,d)=>r("/reset-password",u,d,ke),sendVerificationEmail:(u,d)=>r("/send-verification-email",u,d,wt),passkey:{addPasskey:(u,d)=>l.add(u,d),listUserPasskeys:()=>p.request("/passkey/list-user-passkeys",{decode:Gt}),updatePasskey:async(u,d)=>{let h=ie(u.name);if(!h.valid||h.value===void 0)return oe();let R=h.value;return r("/passkey/update-passkey",{...u,name:R},d,x=>Jt(x,u.id,R))},deletePasskey:(u,d)=>r("/passkey/delete-passkey",u,d,Wt)},twoFactor:{enable:(u,d)=>r("/two-factor/enable",u,d,It),disable:(u,d)=>s(r("/two-factor/disable",u,d,St),h=>h.status),verifyTotp:(u,d)=>s(r("/two-factor/verify-totp",u,d,te)),verifyBackupCode:(u,d)=>s(r("/two-factor/verify-backup-code",u,d,te)),sendOtp:(u={},d)=>r("/two-factor/send-otp",u,d,Tt),verifyOtp:(u,d)=>s(r("/two-factor/verify-otp",u,d,te)),generateBackupCodes:(u,d)=>r("/two-factor/generate-backup-codes",u,d,Pt)},signOut:u=>s(p.request("/sign-out",{method:"POST",body:{},fetchOptions:u,decode:Rt}).then(d=>(o.endSession(),d)),d=>d.success)}}function wo(e,t=()=>{},n){let i=Ii(e,t,n);return n?{...i,signIn:{email:i.signIn.email,username:i.signIn.username,social:on(i),magicLink:i.signIn.magicLink,emailOtp:i.signIn.emailOtp,passkey:i.signIn.passkey},passkey:{listUserPasskeys:i.passkey.listUserPasskeys,updatePasskey:i.passkey.updatePasskey,deletePasskey:i.passkey.deletePasskey,addPasskey:i.passkey.addPasskey}}:{...i,signIn:{email:i.signIn.email,username:i.signIn.username,social:on(i),magicLink:i.signIn.magicLink,emailOtp:i.signIn.emailOtp},passkey:{listUserPasskeys:i.passkey.listUserPasskeys,updatePasskey:i.passkey.updatePasskey,deletePasskey:i.passkey.deletePasskey}}}function on(e){return async(t,n)=>{if(!t?.idToken||typeof t.idToken.token!="string"||t.idToken.token==="")return Si();let i=await e.signIn.social({...t,disableRedirect:true},n);return i.data!==null&&"url"in i.data?Ti():i}}function Si(){return Promise.resolve({data:null,error:{status:400,statusText:"BAD_REQUEST",code:"NATIVE_SOCIAL_ID_TOKEN_REQUIRED",message:"Native social sign-in requires a provider ID token."}})}function Ti(){return Promise.resolve({data:null,error:{status:502,statusText:"BAD_GATEWAY",code:"INVALID_NATIVE_SOCIAL_RESPONSE",message:"The server returned a redirect for native ID-token sign-in."}})}function Pi(){return {signIn:()=>rn(),add:()=>rn()}}function rn(){return Promise.resolve({data:null,error:{status:400,statusText:"BAD_REQUEST",code:"PASSKEY_BROWSER_REQUIRED",message:"This passkey ceremony requires a browser with WebAuthn."}})}function So(e,t,n){let i=new Map;return {async signIn(o={},a){let p=await e.request("/passkey/generate-authenticate-options");if(!p.data)return un(p.error);let f;try{f=Vt(p.data);}catch{return an()}let l;try{l=await n.authenticate({optionsJSON:f,useBrowserAutofill:o.autoFill});}catch(y){return cn(n,y,"AUTH_CANCELLED","Passkey authentication was cancelled.")}if(!vi(l))return sn();let{clientExtensionResults:A,...r}=l,s=i.get(l.id);if(s)return s;let g=(async()=>{let y=await e.request("/passkey/verify-authentication",{method:"POST",body:{response:r},fetchOptions:a,decode:Bt});return y.data&&t(),y})();i.set(l.id,g);try{return await g}finally{i.get(l.id)===g&&i.delete(l.id);}},async add(o={},a){let p=ie(o.name);if(!p.valid)return oe();let f=await e.request("/passkey/generate-register-options",{query:{name:p.value,authenticatorAttachment:o.authenticatorAttachment}});if(!f.data)return un(f.error);let l;try{l=Kt(f.data);}catch{return an()}let A;try{A=await n.register({optionsJSON:l});}catch(y){return cn(n,y,"REGISTRATION_CANCELLED","Passkey registration was cancelled.")}if(!zi(A))return sn();let{clientExtensionResults:r,...s}=A,g=await e.request("/passkey/verify-registration",{method:"POST",body:{response:s,name:p.value},fetchOptions:a,decode:y=>jt(y,A.id,p.value)});return g.data&&t(),g}}}function an(){return {data:null,error:{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned invalid WebAuthn options."}}}function sn(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_WEBAUTHN_RESPONSE",message:"The platform returned an invalid passkey response."}}}function ln(e){if(!e||typeof e!="object")return  false;let t=e;return typeof t.id=="string"&&t.id.length>0&&typeof t.rawId=="string"&&t.rawId.length>0&&t.type==="public-key"&&!!t.response&&typeof t.response=="object"}function vi(e){if(!ln(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.authenticatorData=="string"&&typeof t.signature=="string"&&(t.userHandle===void 0||typeof t.userHandle=="string")}function zi(e){if(!ln(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.attestationObject=="string"}function un(e){return {data:null,error:e??{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned no WebAuthn options."}}}function cn(e,t,n,i){let o=Di(t,"page does not have focus"),a=e.errorCode?.(t),p=a!==void 0?a==="ERROR_CEREMONY_ABORTED":dn(t)==="AbortError",f=n!=="AUTH_CANCELLED",l=Ci(a,dn(t),f);return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:o?"PASSKEY_PAGE_NOT_FOCUSED":p?n:a??"PASSKEY_BROWSER_ERROR",message:o?"Keep this page focused while completing the passkey prompt.":p?i:l}}}function Ci(e,t,n){switch(e){case "ERROR_INVALID_DOMAIN":case "ERROR_INVALID_RP_ID":return "Passkeys are not set up for this site\u2019s domain.";case "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED":return "This device already has a passkey for this account.";case "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEY_ALGS":case "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT":case "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT":return "This device cannot create a passkey for this site.";}return t==="NotAllowedError"?n?"No passkey was created. The prompt was dismissed or timed out.":"No passkey was used. This device may not have one saved for this site yet, or the prompt was dismissed.":t==="SecurityError"?"Passkeys are not set up for this site\u2019s domain.":n?"Passkey registration did not complete.":"Passkey sign-in did not complete."}function dn(e){return e&&typeof e=="object"&&"name"in e&&typeof e.name=="string"?e.name:void 0}function Di(e,t){let n=t.toLowerCase(),i=new Set,o=e;for(;o&&typeof o=="object"&&!i.has(o);){if(i.add(o),"message"in o&&typeof o.message=="string"&&o.message.toLowerCase().includes(n))return  true;o="cause"in o?o.cause:void 0;}return  false}async function zo(e){let n=`${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}/public-config`;return _e(await ee(e,n,{init:{method:"GET",credentials:"omit"},maxResponseBytes:256*1024,decode:i=>xi(i,e)}),"public-config")}function xi(e,t){let n=z(e),i=n.environmentId,o=n.environmentType,a=`${new URL(t.apiUrl).origin}/api/projects/${t.decoded.projectId}/auth`;if(typeof n.applicationId!="string"||!Ei(n.applicationId)||i!==t.decoded.projectId||o!=="development"&&o!=="production"||n.authBaseUrl!==a)throw D();let p=P(n.branding),f=P(n.legal);if(!ze(n.enabledMethods,64)||!ze(n.socialProviders,64)||!gn(p,["appName","logoUrl","primaryColor"])||p.showAppName!==void 0&&typeof p.showAppName!="boolean"||p.alignment!==void 0&&p.alignment!=="left"&&p.alignment!=="center"&&p.alignment!=="right"||p.theme!==void 0&&p.theme!=="light"&&p.theme!=="dark"&&p.theme!=="system"||!gn(f,["termsUrl","privacyUrl"])||!Number.isSafeInteger(f.version)||f.version<0||typeof f.required!="boolean")throw D();if(n.socialProviderClientIds!==void 0){let l=P(n.socialProviderClientIds);if(Object.keys(l).length>64||Object.values(l).some(A=>typeof A!="string"||A.length>2048))throw D()}if(!_(n,["requireEmailVerification","twoFactor","mfaRequired","accountDeletion","organizations","sso","badge"])||!pn(n.turnstileSiteKey)||!pn(n.authTurnstileSiteKey)||typeof n.locale!="string"||n.locale.length===0||n.locale.length>64||!Number.isSafeInteger(n.configVersion)||n.configVersion<0)throw D();if(n.jwtIssuer!==null){let l=P(n.jwtIssuer);if(l.issuer!==a||l.jwksUrl!==`${a}/jwks`||l.aud!==t.decoded.projectId)throw D()}if(n.signUp!==void 0){let l=P(n.signUp).mode;if(typeof l!="string"||!["open","restricted","allowlist","waitlist"].includes(l))throw D()}if(n.authentication!==void 0&&Ni(n.authentication),n.emailVerification!==void 0){let l=P(n.emailVerification);if(!_(l,["required"])||l.method!=="link"&&l.method!=="code")throw D()}if(n.userModel!==void 0&&!_(P(n.userModel),["requireEmail","firstLastName","emailChange","accountDeletion"]))throw D();if(n.mfa!==void 0){let l=P(n.mfa);if(!_(l,["totp","required","backupCodes"])||(l.required===true||l.backupCodes===true)&&l.totp!==true)throw D()}return n}function Ei(e){return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}function D(){return new TypeError("public-config returned an invalid response")}function P(e){if(!e||typeof e!="object"||Array.isArray(e))throw D();return e}function pn(e){return e===null||typeof e=="string"&&e.length<=4096}function Ni(e){let t=P(e),n=P(t.email),i=P(t.password),o=i.minLength!==void 0||i.maxLength!==void 0;if(!_(n,["signUp"])||!ze(n.signIn,3)||n.signIn.some(a=>a!=="password"&&a!=="magic_link"&&a!=="email_otp")||!_(P(t.phone),["signUp","signIn"])||!_(i,["signUp","add"])||o&&(!Number.isSafeInteger(i.minLength)||!Number.isSafeInteger(i.maxLength)||i.minLength<1||i.maxLength>4096||i.minLength>i.maxLength)||!_(P(t.passkey),["signIn","add"])||!Ui(P(t.passkey).relyingPartyId)||!_(P(t.username),["collectOnSignUp","signIn"]))throw D()}function Ui(e){return e==null||typeof e=="string"}function _(e,t){return t.every(n=>typeof e[n]=="boolean")}function gn(e,t){return t.every(n=>e[n]===void 0||typeof e[n]=="string"&&e[n].length<=4096)}function ze(e,t){return Array.isArray(e)&&e.length<=t&&e.every(n=>typeof n=="string"&&n.length<=128)&&new Set(e).size===e.length}export{Mi as a,ce as b,ee as c,_e as d,hn as e,ge as f,qe as g,Ii as h,wo as i,So as j,zo as k};

package/dist/{client-BebgV6Rp.d.cts → client-BR25f1an.d.cts}

@@ -1,5 +1,49 @@
 import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-B05mzhtA.cjs';
 
+/**
+ * The organization invitation an emailed link is asking this browser to accept.
+ *
+ * The link lands on the TENANT'S OWN page carrying `?authowl_invitation=<id>`,
+ * and the only route that can redeem it needs a session the visitor usually does
+ * not have yet. So the id has to survive an entire sign-up or sign-in - which
+ * means surviving that flow's redirects: the OAuth round trip, the email
+ * verification round trip (which can land on a different page entirely), the MFA
+ * hold, and whatever navigation the operator's own `redirectTo` performs. A query
+ * parameter survives none of those, so it is read once, moved into storage, and
+ * taken out of the URL.
+ *
+ * Best-effort storage, deliberately: a browser that refuses `localStorage`
+ * degrades to "this invitation is claimable until you navigate", which is worse
+ * than the ideal and much better than a sign-in that throws.
+ */
+declare const INVITATION_QUERY_PARAM = "authowl_invitation";
+/**
+ * The only hint value that exists. There is deliberately no `existing_user`:
+ * absence has to stay ambiguous across an existing account, an older AuthOwl,
+ * and an account created between the invite and the click - so it can never be
+ * read as proof that an address IS registered.
+ */
+type InvitationRecipientHint = 'new_user';
+type InvitationClaim = {
+    id: string;
+    /** Epoch milliseconds, for age display and for expiring a forgotten claim. */
+    capturedAt: number;
+};
+/** Claims older than this are dropped unread: a month-old link is not a pending intent. */
+declare const INVITATION_CLAIM_MAX_AGE_MS: number;
+/**
+ * Read `?authowl_invitation` once, stash it, and strip it from the URL.
+ *
+ * Namespaced and only ours - a bare `invitation` belongs to the tenant's app as
+ * much as to us, and rewriting their parameters is not ours to do. Returns the
+ * captured claim, or the one already stashed when there is no parameter, so a
+ * caller can render from a single call.
+ */
+declare function captureInvitationClaim(now?: number): InvitationClaim | null;
+/** The stashed claim, or null when there is none, it is unreadable, or it is stale. */
+declare function readInvitationClaim(now?: number): InvitationClaim | null;
+declare function clearInvitationClaim(): void;
+
 type EnvironmentType = 'development' | 'production';
 /**
  * The public, publishable-key-safe project config the SDK renders its sign-in
@@ -489,10 +533,59 @@ interface OrganizationTeam {
     createdAt: Date;
     updatedAt?: Date;
 }
+/** A user's membership in a team. Teams group organization members; they grant no authority. */
+interface OrganizationTeamMember {
+    id: string;
+    teamId: string;
+    userId: string;
+    createdAt: Date;
+}
+interface CreateOrganizationTeamOptions {
+    /** The team name shown to organization members. */
+    name: string;
+    /** Defaults to the caller's active organization. */
+    organizationId?: string;
+}
 interface ListOrganizationTeamsOptions {
     /** Defaults to the caller's active organization. */
     organizationId?: string;
 }
+interface UpdateOrganizationTeamOptions {
+    teamId: string;
+    data: {
+        /** The new team name. */
+        name?: string;
+        /** Defaults to the caller's active organization. */
+        organizationId?: string;
+    };
+}
+interface RemoveOrganizationTeamOptions {
+    teamId: string;
+    /** Defaults to the caller's active organization. */
+    organizationId?: string;
+}
+interface RemoveOrganizationTeamData {
+    message: string;
+}
+interface ListOrganizationTeamMembersOptions {
+    /** Defaults to the caller's active team. */
+    teamId?: string;
+}
+interface AddOrganizationTeamMemberOptions {
+    teamId: string;
+    userId: string;
+    /** Defaults to the caller's active organization. */
+    organizationId?: string;
+}
+interface RemoveOrganizationTeamMemberOptions {
+    teamId: string;
+    userId: string;
+    /** Defaults to the caller's active organization. */
+    organizationId?: string;
+}
+interface RemoveOrganizationTeamMemberData {
+    message: string;
+}
 interface SetActiveTeamOptions {
     /** The team to make active, or null to clear it. Must be a team the caller is on. */
     teamId: string | null;
@@ -535,6 +628,12 @@ interface ListOrganizationInvitationsOptions {
 interface GetOrganizationInvitationOptions {
     id: string;
 }
+interface GetInvitationRecipientHintOptions {
+    invitationId: string;
+}
+interface InvitationRecipientHintData {
+    recipientHint: InvitationRecipientHint | null;
+}
 interface OrganizationInvitationActionOptions {
     invitationId: string;
 }
@@ -575,17 +674,46 @@ interface OrganizationRoleSummary {
     role: string;
     /** The role's ⊆14 system-statement document (engine shape); advisory here. */
     permission?: unknown;
+    /**
+     * The custom `org:<feature>:<action>` permission keys this role grants.
+     *
+     * These cannot appear in `permission`: that is the engine's own document, and
+     * a custom id does not fit its shape - so a custom role reads as an empty
+     * document there while genuinely granting these. This is the field a role
+     * picker needs to show what a custom role does.
+     *
+     * Absent when the role grants none, and absent from any AuthOwl that does not
+     * report them, so an empty array is never confused with "not told". Advisory,
+     * like everything else on this type: the boundary is server-side.
+     */
+    customPermissionKeys?: string[];
 }
 interface OrganizationClient {
+    /** @internal Subscribe to successful organization mutations. Used by framework bindings. */
+    subscribe(listener: () => void): () => void;
     create(params: CreateOrganizationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<Organization>>;
     list(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<Organization[]>>;
     get(params?: GetOrganizationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationDetails | null>>;
     setActive(params: SetActiveOrganizationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<Organization | null>>;
+    /** Create a named grouping of members inside an organization. A team grants no authority. */
+    createTeam(params: CreateOrganizationTeamOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeam>>;
     /**
      * The teams of an organization, for resolving the team ids carried in the
      * membership claim to names. Requires membership of that organization.
      */
     listTeams(params?: ListOrganizationTeamsOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeam[]>>;
+    /** Rename a team. Team membership remains grouping-only and grants no authority. */
+    updateTeam(params: UpdateOrganizationTeamOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeam>>;
+    /** Remove a team and its grouping memberships from an organization. */
+    removeTeam(params: RemoveOrganizationTeamOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<RemoveOrganizationTeamData>>;
+    /** List every team the signed-in user belongs to across their organizations. */
+    listUserTeams(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeam[]>>;
+    /** List the grouping memberships for a team, defaulting to the active team. */
+    listTeamMembers(params?: ListOrganizationTeamMembersOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeamMember[]>>;
+    /** Add an existing organization member to a team. This grants no authority. */
+    addTeamMember(params: AddOrganizationTeamMemberOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeamMember>>;
+    /** Remove an organization member from a team without changing their organization role. */
+    removeTeamMember(params: RemoveOrganizationTeamMemberOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<RemoveOrganizationTeamMemberData>>;
     /**
      * Select the caller's active team, which surfaces as `activeTeamId` on the session
      * and `team_id` in the project token. Only a team the caller is on can be made
@@ -600,6 +728,11 @@ interface OrganizationClient {
     listInvitations(params?: ListOrganizationInvitationsOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation[]>>;
     listUserInvitations(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationUserInvitation[]>>;
     getInvitation(params: GetOrganizationInvitationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitationDetails>>;
+    /**
+     * Resolve the invitation's pre-authentication screen hint without exposing
+     * its recipient, organization, or existence. `null` means only "not told".
+     */
+    getInvitationRecipientHint(params: GetInvitationRecipientHintOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<InvitationRecipientHintData>>;
     acceptInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AcceptOrganizationInvitationData>>;
     rejectInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<RejectOrganizationInvitationData>>;
     cancelInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation | null>>;
@@ -769,6 +902,11 @@ interface SessionState {
 interface SessionStore {
     subscribe(listener: () => void): () => void;
     getSnapshot(): SessionState;
+    /**
+     * Re-read the session from the server, bypassing the cookie cache, and publish
+     * the resulting snapshot to subscribers. Concurrent calls share one request.
+     */
+    refresh(): Promise<void>;
 }
 /** Standard `{ data, error }` envelope returned by the client's auth actions. */
 interface AuthActionResult<T = Record<string, unknown>> {
@@ -1342,4 +1480,4 @@ interface AuthOwlClient {
  */
 declare function createAuthOwlClient(config: ResolvedAuthConfig): AuthOwlClient;
 
-export { type ListOrganizationMembersOptions as $, type AkedlyShieldStartProof as A, type DisableTwoFactorOptions as B, type ChangeEmailOptions as C, type DeleteAccountData as D, type EmailAuthData as E, type EmailOtpAuthData as F, type EmailOtpSignInOptions as G, type EmailOtpType as H, type EmailSignInOptions as I, type EmailSignUpData as J, type EmailSignUpOptions as K, type EnableTwoFactorOptions as L, type EnvironmentType as M, type GenerateBackupCodesOptions as N, type GetOrganizationInvitationOptions as O, type PhoneOtpChallengeData as P, type GetOrganizationOptions as Q, type GetToken as R, type GetTokenOptions as S, type InviteOrganizationMemberOptions as T, type JsonObject as U, type JsonPrimitive as V, type JsonValue as W, type LeaveOrganizationOptions as X, type LinkSocialData as Y, type LinkSocialOptions as Z, type ListOrganizationInvitationsOptions as _, AUTH_CHALLENGE_HEADER as a, type UsernameSignInOptions as a$, type ListOrganizationRolesOptions as a0, type ListOrganizationTeamsOptions as a1, type MagicLinkData as a2, type MagicLinkSignInOptions as a3, type Organization as a4, type OrganizationClient as a5, type OrganizationDetails as a6, type OrganizationFilterOperator as a7, type OrganizationInvitation as a8, type OrganizationInvitationActionOptions as a9, type SendOtpData as aA, type SendTwoFactorOtpData as aB, type SendTwoFactorOtpOptions as aC, type SendVerificationOtpOptions as aD, type SessionState as aE, type SessionStore as aF, type SetActiveOrganizationOptions as aG, type SetActiveTeamOptions as aH, type SignOutData as aI, type SocialAccount as aJ, type SocialAuthData as aK, type SocialIdTokenOptions as aL, type SocialSignInOptions as aM, type TokenClient as aN, type TwoFactorBackupCodesData as aO, type TwoFactorEnableData as aP, type TwoFactorRedirectData as aQ, type TwoFactorStatusData as aR, type TwoFactorVerifyData as aS, type UnlinkSocialOptions as aT, type UpdateOrganizationMemberRoleOptions as aU, type UpdateOrganizationOptions as aV, type UpdatePasskeyData as aW, type UpdatePasskeyOptions as aX, type UpdateProfileOptions as aY, type UpdateUnsafeMetadataOptions as aZ, type UserMetadata as a_, type OrganizationInvitationDetails as aa, type OrganizationInvitationStatus as ab, type OrganizationMember as ac, type OrganizationMemberUser as ad, type OrganizationMemberWithUser as ae, type OrganizationMembersData as af, type OrganizationRoleSummary as ag, type OrganizationSelector as ah, type OrganizationTeam as ai, type OrganizationUserInvitation as aj, type PasskeyAuthData as ak, type PasskeySignInOptions as al, type PasswordResetData as am, type PhoneAuthUser as an, type PhoneOtpStartData as ao, type PhoneOtpStartOptions as ap, type PhoneOtpVerifyData as aq, type PhoneOtpVerifyOptions as ar, type ProjectCapabilities as as, type PublicConfig as at, type RejectOrganizationInvitationData as au, type RemoveOrganizationMemberData as av, type RemoveOrganizationMemberOptions as aw, type RequestPasswordResetOptions as ax, type ResetPasswordOptions as ay, type RevokeSessionOptions as az, type AcceptOrganizationInvitationData as b, type VerifyBackupCodeOptions as b0, type VerifyEmailOtpData as b1, type VerifyEmailOtpOptions as b2, type VerifyTotpOptions as b3, type VerifyTwoFactorOtpOptions as b4, type WaitlistJoinData as b5, type WaitlistJoinOptions as b6, acceptConsent as b7, createAuthOwlClient as b8, createTokenClient as b9, getConsentStatus as ba, getPublicConfig as bb, resolveProjectCapabilities as bc, createAuthHttpClient as bd, type AuthHttpClient as be, type AccountClient as c, type AccountSession as d, type AccountStatusData as e, type ActionFetchOptions as f, type AddPasskeyOptions as g, type AuthActionResult as h, type AuthClientError as i, type AuthErrorContext as j, type AuthOwlClient as k, type AuthOwlErrorCode as l, type AuthPasskey as m, type AuthRequestContext as n, type AuthResponseContext as o, type AuthSession as p, type AuthUser as q, type ChangePasswordData as r, type ChangePasswordOptions as s, type ConsentAcceptResult as t, type ConsentStatus as u, type CreateOrganizationOptions as v, type DeleteAccountOptions as w, type DeleteOrganizationOptions as x, type DeletePasskeyData as y, type DeletePasskeyOptions as z };
+export { type JsonPrimitive as $, type AkedlyShieldStartProof as A, type DeletePasskeyData as B, type ChangeEmailOptions as C, type DeleteAccountData as D, type DeletePasskeyOptions as E, type DisableTwoFactorOptions as F, type EmailAuthData as G, type EmailOtpAuthData as H, type EmailOtpSignInOptions as I, type EmailOtpType as J, type EmailSignInOptions as K, type EmailSignUpData as L, type EmailSignUpOptions as M, type EnableTwoFactorOptions as N, type EnvironmentType as O, type PhoneOtpChallengeData as P, type GenerateBackupCodesOptions as Q, type GetOrganizationInvitationOptions as R, type GetOrganizationOptions as S, type GetToken as T, type GetTokenOptions as U, INVITATION_CLAIM_MAX_AGE_MS as V, INVITATION_QUERY_PARAM as W, type InvitationClaim as X, type InvitationRecipientHint as Y, type InviteOrganizationMemberOptions as Z, type JsonObject as _, AUTH_CHALLENGE_HEADER as a, type TwoFactorEnableData as a$, type JsonValue as a0, type LeaveOrganizationOptions as a1, type LinkSocialData as a2, type LinkSocialOptions as a3, type ListOrganizationInvitationsOptions as a4, type ListOrganizationMembersOptions as a5, type ListOrganizationRolesOptions as a6, type ListOrganizationTeamMembersOptions as a7, type ListOrganizationTeamsOptions as a8, type MagicLinkData as a9, type ProjectCapabilities as aA, type PublicConfig as aB, type RejectOrganizationInvitationData as aC, type RemoveOrganizationMemberData as aD, type RemoveOrganizationMemberOptions as aE, type RemoveOrganizationTeamData as aF, type RemoveOrganizationTeamMemberData as aG, type RemoveOrganizationTeamMemberOptions as aH, type RemoveOrganizationTeamOptions as aI, type RequestPasswordResetOptions as aJ, type ResetPasswordOptions as aK, type RevokeSessionOptions as aL, type SendOtpData as aM, type SendTwoFactorOtpData as aN, type SendTwoFactorOtpOptions as aO, type SendVerificationOtpOptions as aP, type SessionState as aQ, type SessionStore as aR, type SetActiveOrganizationOptions as aS, type SetActiveTeamOptions as aT, type SignOutData as aU, type SocialAccount as aV, type SocialAuthData as aW, type SocialIdTokenOptions as aX, type SocialSignInOptions as aY, type TokenClient as aZ, type TwoFactorBackupCodesData as a_, type MagicLinkSignInOptions as aa, type Organization as ab, type OrganizationClient as ac, type OrganizationDetails as ad, type OrganizationFilterOperator as ae, type OrganizationInvitation as af, type OrganizationInvitationActionOptions as ag, type OrganizationInvitationDetails as ah, type OrganizationInvitationStatus as ai, type OrganizationMember as aj, type OrganizationMemberUser as ak, type OrganizationMemberWithUser as al, type OrganizationMembersData as am, type OrganizationRoleSummary as an, type OrganizationSelector as ao, type OrganizationTeam as ap, type OrganizationTeamMember as aq, type OrganizationUserInvitation as ar, type PasskeyAuthData as as, type PasskeySignInOptions as at, type PasswordResetData as au, type PhoneAuthUser as av, type PhoneOtpStartData as aw, type PhoneOtpStartOptions as ax, type PhoneOtpVerifyData as ay, type PhoneOtpVerifyOptions as az, type AcceptOrganizationInvitationData as b, type TwoFactorRedirectData as b0, type TwoFactorStatusData as b1, type TwoFactorVerifyData as b2, type UnlinkSocialOptions as b3, type UpdateOrganizationMemberRoleOptions as b4, type UpdateOrganizationOptions as b5, type UpdateOrganizationTeamOptions as b6, type UpdatePasskeyData as b7, type UpdatePasskeyOptions as b8, type UpdateProfileOptions as b9, type UpdateUnsafeMetadataOptions as ba, type UserMetadata as bb, type UsernameSignInOptions as bc, type VerifyBackupCodeOptions as bd, type VerifyEmailOtpData as be, type VerifyEmailOtpOptions as bf, type VerifyTotpOptions as bg, type VerifyTwoFactorOtpOptions as bh, type WaitlistJoinData as bi, type WaitlistJoinOptions as bj, acceptConsent as bk, captureInvitationClaim as bl, clearInvitationClaim as bm, createAuthOwlClient as bn, createTokenClient as bo, getConsentStatus as bp, getPublicConfig as bq, readInvitationClaim as br, resolveProjectCapabilities as bs, createAuthHttpClient as bt, type AuthHttpClient as bu, type AccountClient as c, type AccountSession as d, type AccountStatusData as e, type ActionFetchOptions as f, type AddOrganizationTeamMemberOptions as g, type AddPasskeyOptions as h, type AuthActionResult as i, type AuthClientError as j, type AuthErrorContext as k, type AuthOwlClient as l, type AuthOwlErrorCode as m, type AuthPasskey as n, type AuthRequestContext as o, type AuthResponseContext as p, type AuthSession as q, type AuthUser as r, type ChangePasswordData as s, type ChangePasswordOptions as t, type ConsentAcceptResult as u, type ConsentStatus as v, type CreateOrganizationOptions as w, type CreateOrganizationTeamOptions as x, type DeleteAccountOptions as y, type DeleteOrganizationOptions as z };

package/dist/{client-FwJ8dBsF.d.ts → client-Bk-ZkgAJ.d.ts}

@@ -1,5 +1,49 @@
 import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-B05mzhtA.js';
 
+/**
+ * The organization invitation an emailed link is asking this browser to accept.
+ *
+ * The link lands on the TENANT'S OWN page carrying `?authowl_invitation=<id>`,
+ * and the only route that can redeem it needs a session the visitor usually does
+ * not have yet. So the id has to survive an entire sign-up or sign-in - which
+ * means surviving that flow's redirects: the OAuth round trip, the email
+ * verification round trip (which can land on a different page entirely), the MFA
+ * hold, and whatever navigation the operator's own `redirectTo` performs. A query
+ * parameter survives none of those, so it is read once, moved into storage, and
+ * taken out of the URL.
+ *
+ * Best-effort storage, deliberately: a browser that refuses `localStorage`
+ * degrades to "this invitation is claimable until you navigate", which is worse
+ * than the ideal and much better than a sign-in that throws.
+ */
+declare const INVITATION_QUERY_PARAM = "authowl_invitation";
+/**
+ * The only hint value that exists. There is deliberately no `existing_user`:
+ * absence has to stay ambiguous across an existing account, an older AuthOwl,
+ * and an account created between the invite and the click - so it can never be
+ * read as proof that an address IS registered.
+ */
+type InvitationRecipientHint = 'new_user';
+type InvitationClaim = {
+    id: string;
+    /** Epoch milliseconds, for age display and for expiring a forgotten claim. */
+    capturedAt: number;
+};
+/** Claims older than this are dropped unread: a month-old link is not a pending intent. */
+declare const INVITATION_CLAIM_MAX_AGE_MS: number;
+/**
+ * Read `?authowl_invitation` once, stash it, and strip it from the URL.
+ *
+ * Namespaced and only ours - a bare `invitation` belongs to the tenant's app as
+ * much as to us, and rewriting their parameters is not ours to do. Returns the
+ * captured claim, or the one already stashed when there is no parameter, so a
+ * caller can render from a single call.
+ */
+declare function captureInvitationClaim(now?: number): InvitationClaim | null;
+/** The stashed claim, or null when there is none, it is unreadable, or it is stale. */
+declare function readInvitationClaim(now?: number): InvitationClaim | null;
+declare function clearInvitationClaim(): void;
+
 type EnvironmentType = 'development' | 'production';
 /**
  * The public, publishable-key-safe project config the SDK renders its sign-in
@@ -489,10 +533,59 @@ interface OrganizationTeam {
     createdAt: Date;
     updatedAt?: Date;
 }
+/** A user's membership in a team. Teams group organization members; they grant no authority. */
+interface OrganizationTeamMember {
+    id: string;
+    teamId: string;
+    userId: string;
+    createdAt: Date;
+}
+interface CreateOrganizationTeamOptions {
+    /** The team name shown to organization members. */
+    name: string;
+    /** Defaults to the caller's active organization. */
+    organizationId?: string;
+}
 interface ListOrganizationTeamsOptions {
     /** Defaults to the caller's active organization. */
     organizationId?: string;
 }
+interface UpdateOrganizationTeamOptions {
+    teamId: string;
+    data: {
+        /** The new team name. */
+        name?: string;
+        /** Defaults to the caller's active organization. */
+        organizationId?: string;
+    };
+}
+interface RemoveOrganizationTeamOptions {
+    teamId: string;
+    /** Defaults to the caller's active organization. */
+    organizationId?: string;
+}
+interface RemoveOrganizationTeamData {
+    message: string;
+}
+interface ListOrganizationTeamMembersOptions {
+    /** Defaults to the caller's active team. */
+    teamId?: string;
+}
+interface AddOrganizationTeamMemberOptions {
+    teamId: string;
+    userId: string;
+    /** Defaults to the caller's active organization. */
+    organizationId?: string;
+}
+interface RemoveOrganizationTeamMemberOptions {
+    teamId: string;
+    userId: string;
+    /** Defaults to the caller's active organization. */
+    organizationId?: string;
+}
+interface RemoveOrganizationTeamMemberData {
+    message: string;
+}
 interface SetActiveTeamOptions {
     /** The team to make active, or null to clear it. Must be a team the caller is on. */
     teamId: string | null;
@@ -535,6 +628,12 @@ interface ListOrganizationInvitationsOptions {
 interface GetOrganizationInvitationOptions {
     id: string;
 }
+interface GetInvitationRecipientHintOptions {
+    invitationId: string;
+}
+interface InvitationRecipientHintData {
+    recipientHint: InvitationRecipientHint | null;
+}
 interface OrganizationInvitationActionOptions {
     invitationId: string;
 }
@@ -575,17 +674,46 @@ interface OrganizationRoleSummary {
     role: string;
     /** The role's ⊆14 system-statement document (engine shape); advisory here. */
     permission?: unknown;
+    /**
+     * The custom `org:<feature>:<action>` permission keys this role grants.
+     *
+     * These cannot appear in `permission`: that is the engine's own document, and
+     * a custom id does not fit its shape - so a custom role reads as an empty
+     * document there while genuinely granting these. This is the field a role
+     * picker needs to show what a custom role does.
+     *
+     * Absent when the role grants none, and absent from any AuthOwl that does not
+     * report them, so an empty array is never confused with "not told". Advisory,
+     * like everything else on this type: the boundary is server-side.
+     */
+    customPermissionKeys?: string[];
 }
 interface OrganizationClient {
+    /** @internal Subscribe to successful organization mutations. Used by framework bindings. */
+    subscribe(listener: () => void): () => void;
     create(params: CreateOrganizationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<Organization>>;
     list(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<Organization[]>>;
     get(params?: GetOrganizationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationDetails | null>>;
     setActive(params: SetActiveOrganizationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<Organization | null>>;
+    /** Create a named grouping of members inside an organization. A team grants no authority. */
+    createTeam(params: CreateOrganizationTeamOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeam>>;
     /**
      * The teams of an organization, for resolving the team ids carried in the
      * membership claim to names. Requires membership of that organization.
      */
     listTeams(params?: ListOrganizationTeamsOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeam[]>>;
+    /** Rename a team. Team membership remains grouping-only and grants no authority. */
+    updateTeam(params: UpdateOrganizationTeamOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeam>>;
+    /** Remove a team and its grouping memberships from an organization. */
+    removeTeam(params: RemoveOrganizationTeamOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<RemoveOrganizationTeamData>>;
+    /** List every team the signed-in user belongs to across their organizations. */
+    listUserTeams(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeam[]>>;
+    /** List the grouping memberships for a team, defaulting to the active team. */
+    listTeamMembers(params?: ListOrganizationTeamMembersOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeamMember[]>>;
+    /** Add an existing organization member to a team. This grants no authority. */
+    addTeamMember(params: AddOrganizationTeamMemberOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeamMember>>;
+    /** Remove an organization member from a team without changing their organization role. */
+    removeTeamMember(params: RemoveOrganizationTeamMemberOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<RemoveOrganizationTeamMemberData>>;
     /**
      * Select the caller's active team, which surfaces as `activeTeamId` on the session
      * and `team_id` in the project token. Only a team the caller is on can be made
@@ -600,6 +728,11 @@ interface OrganizationClient {
     listInvitations(params?: ListOrganizationInvitationsOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation[]>>;
     listUserInvitations(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationUserInvitation[]>>;
     getInvitation(params: GetOrganizationInvitationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitationDetails>>;
+    /**
+     * Resolve the invitation's pre-authentication screen hint without exposing
+     * its recipient, organization, or existence. `null` means only "not told".
+     */
+    getInvitationRecipientHint(params: GetInvitationRecipientHintOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<InvitationRecipientHintData>>;
     acceptInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AcceptOrganizationInvitationData>>;
     rejectInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<RejectOrganizationInvitationData>>;
     cancelInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation | null>>;
@@ -769,6 +902,11 @@ interface SessionState {
 interface SessionStore {
     subscribe(listener: () => void): () => void;
     getSnapshot(): SessionState;
+    /**
+     * Re-read the session from the server, bypassing the cookie cache, and publish
+     * the resulting snapshot to subscribers. Concurrent calls share one request.
+     */
+    refresh(): Promise<void>;
 }
 /** Standard `{ data, error }` envelope returned by the client's auth actions. */
 interface AuthActionResult<T = Record<string, unknown>> {
@@ -1342,4 +1480,4 @@ interface AuthOwlClient {
  */
 declare function createAuthOwlClient(config: ResolvedAuthConfig): AuthOwlClient;
 
-export { type ListOrganizationMembersOptions as $, type AkedlyShieldStartProof as A, type DisableTwoFactorOptions as B, type ChangeEmailOptions as C, type DeleteAccountData as D, type EmailAuthData as E, type EmailOtpAuthData as F, type EmailOtpSignInOptions as G, type EmailOtpType as H, type EmailSignInOptions as I, type EmailSignUpData as J, type EmailSignUpOptions as K, type EnableTwoFactorOptions as L, type EnvironmentType as M, type GenerateBackupCodesOptions as N, type GetOrganizationInvitationOptions as O, type PhoneOtpChallengeData as P, type GetOrganizationOptions as Q, type GetToken as R, type GetTokenOptions as S, type InviteOrganizationMemberOptions as T, type JsonObject as U, type JsonPrimitive as V, type JsonValue as W, type LeaveOrganizationOptions as X, type LinkSocialData as Y, type LinkSocialOptions as Z, type ListOrganizationInvitationsOptions as _, AUTH_CHALLENGE_HEADER as a, type UsernameSignInOptions as a$, type ListOrganizationRolesOptions as a0, type ListOrganizationTeamsOptions as a1, type MagicLinkData as a2, type MagicLinkSignInOptions as a3, type Organization as a4, type OrganizationClient as a5, type OrganizationDetails as a6, type OrganizationFilterOperator as a7, type OrganizationInvitation as a8, type OrganizationInvitationActionOptions as a9, type SendOtpData as aA, type SendTwoFactorOtpData as aB, type SendTwoFactorOtpOptions as aC, type SendVerificationOtpOptions as aD, type SessionState as aE, type SessionStore as aF, type SetActiveOrganizationOptions as aG, type SetActiveTeamOptions as aH, type SignOutData as aI, type SocialAccount as aJ, type SocialAuthData as aK, type SocialIdTokenOptions as aL, type SocialSignInOptions as aM, type TokenClient as aN, type TwoFactorBackupCodesData as aO, type TwoFactorEnableData as aP, type TwoFactorRedirectData as aQ, type TwoFactorStatusData as aR, type TwoFactorVerifyData as aS, type UnlinkSocialOptions as aT, type UpdateOrganizationMemberRoleOptions as aU, type UpdateOrganizationOptions as aV, type UpdatePasskeyData as aW, type UpdatePasskeyOptions as aX, type UpdateProfileOptions as aY, type UpdateUnsafeMetadataOptions as aZ, type UserMetadata as a_, type OrganizationInvitationDetails as aa, type OrganizationInvitationStatus as ab, type OrganizationMember as ac, type OrganizationMemberUser as ad, type OrganizationMemberWithUser as ae, type OrganizationMembersData as af, type OrganizationRoleSummary as ag, type OrganizationSelector as ah, type OrganizationTeam as ai, type OrganizationUserInvitation as aj, type PasskeyAuthData as ak, type PasskeySignInOptions as al, type PasswordResetData as am, type PhoneAuthUser as an, type PhoneOtpStartData as ao, type PhoneOtpStartOptions as ap, type PhoneOtpVerifyData as aq, type PhoneOtpVerifyOptions as ar, type ProjectCapabilities as as, type PublicConfig as at, type RejectOrganizationInvitationData as au, type RemoveOrganizationMemberData as av, type RemoveOrganizationMemberOptions as aw, type RequestPasswordResetOptions as ax, type ResetPasswordOptions as ay, type RevokeSessionOptions as az, type AcceptOrganizationInvitationData as b, type VerifyBackupCodeOptions as b0, type VerifyEmailOtpData as b1, type VerifyEmailOtpOptions as b2, type VerifyTotpOptions as b3, type VerifyTwoFactorOtpOptions as b4, type WaitlistJoinData as b5, type WaitlistJoinOptions as b6, acceptConsent as b7, createAuthOwlClient as b8, createTokenClient as b9, getConsentStatus as ba, getPublicConfig as bb, resolveProjectCapabilities as bc, createAuthHttpClient as bd, type AuthHttpClient as be, type AccountClient as c, type AccountSession as d, type AccountStatusData as e, type ActionFetchOptions as f, type AddPasskeyOptions as g, type AuthActionResult as h, type AuthClientError as i, type AuthErrorContext as j, type AuthOwlClient as k, type AuthOwlErrorCode as l, type AuthPasskey as m, type AuthRequestContext as n, type AuthResponseContext as o, type AuthSession as p, type AuthUser as q, type ChangePasswordData as r, type ChangePasswordOptions as s, type ConsentAcceptResult as t, type ConsentStatus as u, type CreateOrganizationOptions as v, type DeleteAccountOptions as w, type DeleteOrganizationOptions as x, type DeletePasskeyData as y, type DeletePasskeyOptions as z };
+export { type JsonPrimitive as $, type AkedlyShieldStartProof as A, type DeletePasskeyData as B, type ChangeEmailOptions as C, type DeleteAccountData as D, type DeletePasskeyOptions as E, type DisableTwoFactorOptions as F, type EmailAuthData as G, type EmailOtpAuthData as H, type EmailOtpSignInOptions as I, type EmailOtpType as J, type EmailSignInOptions as K, type EmailSignUpData as L, type EmailSignUpOptions as M, type EnableTwoFactorOptions as N, type EnvironmentType as O, type PhoneOtpChallengeData as P, type GenerateBackupCodesOptions as Q, type GetOrganizationInvitationOptions as R, type GetOrganizationOptions as S, type GetToken as T, type GetTokenOptions as U, INVITATION_CLAIM_MAX_AGE_MS as V, INVITATION_QUERY_PARAM as W, type InvitationClaim as X, type InvitationRecipientHint as Y, type InviteOrganizationMemberOptions as Z, type JsonObject as _, AUTH_CHALLENGE_HEADER as a, type TwoFactorEnableData as a$, type JsonValue as a0, type LeaveOrganizationOptions as a1, type LinkSocialData as a2, type LinkSocialOptions as a3, type ListOrganizationInvitationsOptions as a4, type ListOrganizationMembersOptions as a5, type ListOrganizationRolesOptions as a6, type ListOrganizationTeamMembersOptions as a7, type ListOrganizationTeamsOptions as a8, type MagicLinkData as a9, type ProjectCapabilities as aA, type PublicConfig as aB, type RejectOrganizationInvitationData as aC, type RemoveOrganizationMemberData as aD, type RemoveOrganizationMemberOptions as aE, type RemoveOrganizationTeamData as aF, type RemoveOrganizationTeamMemberData as aG, type RemoveOrganizationTeamMemberOptions as aH, type RemoveOrganizationTeamOptions as aI, type RequestPasswordResetOptions as aJ, type ResetPasswordOptions as aK, type RevokeSessionOptions as aL, type SendOtpData as aM, type SendTwoFactorOtpData as aN, type SendTwoFactorOtpOptions as aO, type SendVerificationOtpOptions as aP, type SessionState as aQ, type SessionStore as aR, type SetActiveOrganizationOptions as aS, type SetActiveTeamOptions as aT, type SignOutData as aU, type SocialAccount as aV, type SocialAuthData as aW, type SocialIdTokenOptions as aX, type SocialSignInOptions as aY, type TokenClient as aZ, type TwoFactorBackupCodesData as a_, type MagicLinkSignInOptions as aa, type Organization as ab, type OrganizationClient as ac, type OrganizationDetails as ad, type OrganizationFilterOperator as ae, type OrganizationInvitation as af, type OrganizationInvitationActionOptions as ag, type OrganizationInvitationDetails as ah, type OrganizationInvitationStatus as ai, type OrganizationMember as aj, type OrganizationMemberUser as ak, type OrganizationMemberWithUser as al, type OrganizationMembersData as am, type OrganizationRoleSummary as an, type OrganizationSelector as ao, type OrganizationTeam as ap, type OrganizationTeamMember as aq, type OrganizationUserInvitation as ar, type PasskeyAuthData as as, type PasskeySignInOptions as at, type PasswordResetData as au, type PhoneAuthUser as av, type PhoneOtpStartData as aw, type PhoneOtpStartOptions as ax, type PhoneOtpVerifyData as ay, type PhoneOtpVerifyOptions as az, type AcceptOrganizationInvitationData as b, type TwoFactorRedirectData as b0, type TwoFactorStatusData as b1, type TwoFactorVerifyData as b2, type UnlinkSocialOptions as b3, type UpdateOrganizationMemberRoleOptions as b4, type UpdateOrganizationOptions as b5, type UpdateOrganizationTeamOptions as b6, type UpdatePasskeyData as b7, type UpdatePasskeyOptions as b8, type UpdateProfileOptions as b9, type UpdateUnsafeMetadataOptions as ba, type UserMetadata as bb, type UsernameSignInOptions as bc, type VerifyBackupCodeOptions as bd, type VerifyEmailOtpData as be, type VerifyEmailOtpOptions as bf, type VerifyTotpOptions as bg, type VerifyTwoFactorOtpOptions as bh, type WaitlistJoinData as bi, type WaitlistJoinOptions as bj, acceptConsent as bk, captureInvitationClaim as bl, clearInvitationClaim as bm, createAuthOwlClient as bn, createTokenClient as bo, getConsentStatus as bp, getPublicConfig as bq, readInvitationClaim as br, resolveProjectCapabilities as bs, createAuthHttpClient as bt, type AuthHttpClient as bu, type AccountClient as c, type AccountSession as d, type AccountStatusData as e, type ActionFetchOptions as f, type AddOrganizationTeamMemberOptions as g, type AddPasskeyOptions as h, type AuthActionResult as i, type AuthClientError as j, type AuthErrorContext as k, type AuthOwlClient as l, type AuthOwlErrorCode as m, type AuthPasskey as n, type AuthRequestContext as o, type AuthResponseContext as p, type AuthSession as q, type AuthUser as r, type ChangePasswordData as s, type ChangePasswordOptions as t, type ConsentAcceptResult as u, type ConsentStatus as v, type CreateOrganizationOptions as w, type CreateOrganizationTeamOptions as x, type DeleteAccountOptions as y, type DeleteOrganizationOptions as z };