@authowl/core 0.17.0 → 0.18.1

package/README.md

@@ -14,6 +14,18 @@ directly.
 pnpm add @authowl/core
 ```
 
+## Upgrade notes
+
+### 2026-08-22 — organization member email is nullable
+
+`OrganizationMemberUser.email` is `string | null`. It was widened from `string`
+in **0.16.0**, a minor release, so servers can withhold internal placeholder
+addresses without breaking decoding. Do not assume every organization member's
+address is visible to the current caller.
+
+Before using the field as a string, provide a fallback
+(`const email = user.email ?? '';`) or guard against `null`.
+
 ## Framework-neutral session state
 
 Core has no React dependency. It exposes a standard external store for custom

package/dist/chunk-PYXM7X2H.js

@@ -0,0 +1 @@
+import {p,o,i,z,s,q as q$1,y,r,w,B as B$1,E as E$1,x,t,A,v,u}from'./chunk-V3MSLXXB.js';import {a}from'./chunk-T5SH3ZZP.js';function Mi(e){let t=e?.enabledMethods??["password"],n=t.includes("password"),i=t.includes("passkey"),o=e?.authentication,a=e?.mfa;return {emailSignUp:o?.email.signUp??t.some(p=>p==="password"||p==="magic_link"||p==="email_otp"),passwordSignUp:o?.password.signUp??n,phoneSignUp:o?.phone.signUp??t.includes("phone_otp"),passwordSignIn:o?.email.signIn.includes("password")??n,passwordMinLength:o?.password.minLength??8,passwordMaxLength:o?.password.maxLength??128,magicLinkSignIn:o?.email.signIn.includes("magic_link")??t.includes("magic_link"),emailOtpSignIn:o?.email.signIn.includes("email_otp")??t.includes("email_otp"),phoneSignIn:o?.phone.signIn??t.includes("phone_otp"),usernameSignIn:o?.username.signIn??false,collectUsername:o?.username.collectOnSignUp??false,passkeySignIn:o?.passkey.signIn??i,passkeyAdd:o?.passkey.add??i,firstLastName:e?.userModel?.firstLastName??false,emailChange:e===null?false:e.userModel?.emailChange??true,accountDeletion:e?.userModel?.accountDeletion??e?.accountDeletion??false,emailVerificationRequired:e?.emailVerification?.required??e?.requireEmailVerification??false,emailVerificationMethod:e?.emailVerification?.method??"link",totp:a?.totp??e?.twoFactor??false,mfaRequired:a?.required??e?.mfaRequired??false,backupCodes:a?.backupCodes??e?.twoFactor??false,legacyNameField:e?.authentication===void 0}}var ce=class extends Error{status;requestId;constructor(t,n,i){super(`${t} request failed with status ${n.status}.`),this.name="AuthOwlHttpError",this.status=n.status,this.requestId=i;}};function ee(e,t,n={}){let i=new Headers(n.init?.headers);return i.set("x-publishable-key",e.publishableKey),p({fetchImpl:e.fetch,url:t,init:{...n.init,headers:i},allowHttpLoopback:e.decoded.env==="test",...n.timeoutMs===void 0?{}:{timeoutMs:n.timeoutMs},...n.maxResponseBytes===void 0?{}:{maxResponseBytes:n.maxResponseBytes},...n.decode===void 0?{}:{decode:n.decode}})}function _e(e,t){if(!e.response.ok)throw new ce(t,e.response,e.requestId);return e.data}var hn="x-authowl-turnstile-token",An=1e4,On=32,yn=2e4;function L(e,t){return {post:(n,i,o,a)=>e.request(n,{method:"POST",body:i,fetchOptions:o,decode:a}),mutation:async(n,i)=>{let o=await n;return o.error===null&&(i===void 0||o.data!==null&&i(o.data))&&t(),o}}}function ge(e,t=e.projectBaseURL){return {async request(n,i$1={}){let o$1=kn(t,n,i$1.query),a=i$1.method??(i$1.body===void 0?"GET":"POST"),p=new Headers(i$1.fetchOptions?.headers);i$1.fetchOptions?.authChallengeToken&&p.set(hn,i$1.fetchOptions.authChallengeToken),i$1.body!==void 0&&p.set("content-type","application/json");let f={method:a,headers:p,credentials:i$1.credentials??"include",...i$1.body===void 0?{}:{body:JSON.stringify(i$1.body)}},l=Object.freeze({method:a,path:n});await i$1.fetchOptions?.onRequest?.(l);let A=wn(a,i$1.fetchOptions),r;try{r=await bn(e,o$1,{...f,signal:i$1.fetchOptions?.signal},A);}catch(h){let R=Fe(h);return await i$1.fetchOptions?.onError?.(de(l,R,Sn(h))),{data:null,error:R}}let{response:s,requestId:g}=r,y=vn(n,r.data),u=y;if(s.ok)try{u=pe(y),i$1.decode&&(u=i$1.decode(u));}catch{let h=Fe(new o("invalid_response",g));return await i$1.fetchOptions?.onError?.(de(l,h,"invalid_response")),{data:null,error:h}}let d=Object.freeze({...l,status:s.status,...g===void 0?{}:{requestId:g}});if(await i$1.fetchOptions?.onResponse?.(d),!s.ok){let h=Rn(s,y,g);return h.code===i&&e.session.tokens.dropChallenge(),await i$1.fetchOptions?.onError?.(de(l,h,"api")),{data:null,error:h}}return await i$1.fetchOptions?.onSuccess?.(d),{data:u,error:null}}}}async function bn(e,t,n,i){let o$1=Date.now()+An;for(let a=0;a<i;a+=1){let p=o$1-Date.now();if(p<=0)throw new o("timeout");try{let f=await ee(e,t,{init:n,timeoutMs:Math.max(1,Math.ceil(p))});if(f.response.status<500||a===i-1)return f}catch(f){if(a===i-1||!(f instanceof o)||f.kind!=="network")throw f}await Tn(50*2**a,n.signal,o$1);}throw new o("network")}function wn(e,t){if(e!=="GET"||t?.authChallengeToken)return 1;let n=t?.retry;return typeof n!="number"||!Number.isFinite(n)?1:Math.min(Math.max(Math.trunc(n),0),3)+1}function kn(e,t,n){let i=new URL(`${e}${t.startsWith("/")?t:`/${t}`}`);for(let[o,a]of Object.entries(n??{}))a!==void 0&&i.searchParams.set(o,String(a));return i.toString()}function Rn(e,t,n){let i=B(t)?t:{},o=In(i,e.headers);return {status:e.status,statusText:e.statusText,code:typeof i.code=="string"?i.code:void 0,...n===void 0?{}:{requestId:n},...typeof i.current_version=="number"?{currentVersion:i.current_version}:{},...o!==void 0?{retryAfterSeconds:o}:{},message:typeof i.message=="string"?i.message:typeof i.error=="string"?i.error:typeof i.detail=="string"?i.detail:e.statusText||"Request failed"}}function In(e,t){let n=(typeof e.retryAfterSeconds=="number"&&Number.isFinite(e.retryAfterSeconds)?e.retryAfterSeconds:void 0)??Le(t.get("retry-after"))??Le(t.get("x-retry-after"));if(n!==void 0)return Math.min(Math.max(Math.trunc(n),1),86400)}function Le(e){if(!e)return;let t=e.trim();if(!/^\d+$/.test(t))return;let n=Number(t);return Number.isFinite(n)?n:void 0}function Fe(e){let t=e instanceof o?e.kind:"network";return {status:0,...{aborted:{statusText:"ABORTED",code:"REQUEST_ABORTED",message:"The request was cancelled."},timeout:{statusText:"TIMEOUT",code:"REQUEST_TIMEOUT",message:"The request timed out."},response_too_large:{statusText:"INVALID_RESPONSE",code:"RESPONSE_TOO_LARGE",message:"The service response was too large."},invalid_response:{statusText:"INVALID_RESPONSE",code:"INVALID_RESPONSE",message:"The service returned an invalid response."},network:{statusText:"FETCH_ERROR",code:"FETCH_ERROR",message:"Network request failed."}}[t],...e instanceof o&&e.requestId?{requestId:e.requestId}:{}}}function de(e,t,n){return Object.freeze({...e,status:t.status??0,...t.requestId===void 0?{}:{requestId:t.requestId},failure:n})}function Sn(e){return e instanceof o?e.kind:"network"}function Tn(e,t,n){return new Promise((i,o$1)=>{if(t?.aborted){o$1(new o("aborted"));return}let a=n-Date.now();if(a<=0){o$1(new o("timeout"));return}let p=Math.min(e,a),f=()=>{clearTimeout(l),o$1(new o("aborted"));},l=setTimeout(()=>{t?.removeEventListener("abort",f),Date.now()>=n?o$1(new o("timeout")):i();},p);t?.addEventListener("abort",f,{once:true}),t?.aborted&&f();})}function pe(e,t="",n=0,i={nodes:0}){if(i.nodes+=1,n>On||i.nodes>yn)throw new Error("response traversal limit exceeded");if(typeof e=="string"&&/^(?:createdAt|updatedAt|expiresAt)$/.test(t)){let o=new Date(e);return Number.isNaN(o.getTime())?e:o}return Array.isArray(e)?e.map(o=>pe(o,"",n+1,i)):B(e)?Object.fromEntries(Object.entries(e).map(([o,a])=>[o,Pn(o)?a:pe(a,o,n+1,i)])):e}function Pn(e){return e==="metadata"||e==="public_metadata"||e==="unsafe_metadata"||e==="private_metadata"||e==="publicMetadata"||e==="unsafeMetadata"||e==="privateMetadata"}function vn(e,t){if(e==="/list-sessions"&&Array.isArray(t))return t.map(o=>B(o)?le(o):o);if(!B(t))return t;let i=e==="/change-password"||e==="/passkey/verify-authentication"||e==="/phone-otp/verify"||e==="/sign-up/email"||e.startsWith("/sign-in/")||e.startsWith("/two-factor/verify-")?le(t):t;return e==="/sign-up/email"&&!("sessionCreated"in i)&&(i={...i,sessionCreated:typeof t.token=="string"&&t.token.length>0}),(e==="/get-session"||e==="/passkey/verify-authentication")&&B(i.session)&&(i={...i,session:le(i.session)}),i}function le(e){if(!Object.hasOwn(e,"token"))return e;let t={...e};return delete t.token,t}function B(e){return !!e&&typeof e=="object"&&!Array.isArray(e)}function qe(){let e=globalThis.crypto.getRandomValues(new Uint8Array(16));e[6]=e[6]&15|64,e[8]=e[8]&63|128;let t=Array.from(e,n=>n.toString(16).padStart(2,"0")).join("");return `${t.slice(0,8)}-${t.slice(8,12)}-${t.slice(12,16)}-${t.slice(16,20)}-${t.slice(20)}`}function He({http:e,probe:t,tokens:n,channelName:i}){let o=new Set,a=null,p=null,f=null,l=null,A=null,r=null,s,g=O=>{d(O);};s={data:null,isPending:true,isRefetching:false,error:null,refetch:g};function y(O){s=O;for(let I of o)I();}async function u(O){return e.request("/get-session",{query:O?.query,decode:me})}function d(O){if(O?.query?.disableCookieCache===true)return R(O);if(l)return l;if(A)return A;let I=R(O).finally(()=>{A===I&&(A=null);});return A=I,I}function h(){if(l)return l;let O=R({query:{disableCookieCache:true}}).finally(()=>{l===O&&(l=null);});return l=O,O}async function R(O){f?.abort();let I=new AbortController;f=I,y({...s,isPending:s.data===null&&s.error===null,isRefetching:s.data!==null});let K=n.beginRead(),Y=await e.request("/get-session",{query:O?.query,fetchOptions:{signal:I.signal},decode:me});if(f===I&&(f=null,y({data:Y.data,error:Y.error,isPending:false,isRefetching:false,refetch:g}),Y.error===null)){if(Y.data===null){K.endIfDead();return}await x(K);}}async function x(O){if(n.needsProbe()){if(!O.carriedToken){O.recordCookieVerdict(true);return}return r||Ce(O)}}function Ce(O){let I=t.request("/get-session",{query:{disableCookieCache:true},decode:me}).then(K=>{r===I&&K.error===null&&O.recordCookieVerdict(K.data!==null);}).finally(()=>{r===I&&(r=null);});return r=I,I}function De(){a?.postMessage({type:"session-changed"});}function mn(){if(typeof window>"u"||p)return;let O=()=>{d();},I=()=>{document.visibilityState==="visible"&&d();};window.addEventListener("focus",O),document.addEventListener("visibilitychange",I),typeof BroadcastChannel<"u"&&(a=new BroadcastChannel(i),a.addEventListener("message",O)),p=()=>{window.removeEventListener("focus",O),document.removeEventListener("visibilitychange",I),a?.close(),a=null,p=null;};}function fn(O){return o.add(O),o.size===1&&(mn(),d()),()=>{if(o.delete(O),o.size===0){let I=f;f=null,A=null,l=null,I?.abort(),p?.();}}}return n.measureWith(()=>{n.needsProbe()&&Ce(n.beginRead());}),{store:{subscribe:fn,getSnapshot:()=>s,refresh:h},getSession:u,notifyMutation(){De(),r&&r.catch(()=>{}).then(()=>{!n.needsProbe()&&n.hasToken()&&De();}),o.size>0&&d({query:{disableCookieCache:true}});}}}function me(e){if(e===null)return null;let t=q$1(e);return (t.session===void 0||t.user===void 0)&&y(),{session:x(t.session),user:w(t.user)}}async function Ve(e,t){return e.request("/user/metadata",{fetchOptions:t,decode:Be})}async function Ke(e,t,n){return e.request("/user/metadata",{method:"PATCH",body:{expected_version:t.expectedVersion,unsafe_metadata:t.unsafeMetadata},fetchOptions:n,decode:Be})}function Be(e){let t=q$1(e),n=z(t.public_metadata),i=z(t.unsafe_metadata);if(!Number.isSafeInteger(t.metadata_version)||t.metadata_version<0)throw new TypeError("Invalid AuthOwl metadata response");return {publicMetadata:n,unsafeMetadata:i,metadataVersion:t.metadata_version}}function Ge(e,t){let{post:n,mutation:i}=L(e,t);return {getMetadata:o=>Ve(e,o),updateUnsafeMetadata:(o,a)=>Ke(e,o,a),updateProfile:(o,a)=>i(n("/update-user",o,a,j)),changeEmail:(o,a)=>i(n("/change-email",o,a,j)),changePassword:(o,a)=>i(n("/change-password",o,a,zn)),listSessions:o=>e.request("/list-sessions",{fetchOptions:o,decode:Cn}),revokeSession:({sessionId:o},a)=>i(n("/revoke-session",{sessionId:o},a,j)),revokeOtherSessions:o=>i(n("/revoke-other-sessions",{},o,j)),listSocialAccounts:async o=>{let a=await e.request("/list-accounts",{fetchOptions:o,decode:Dn});if(!a.data)return {data:null,error:a.error};let p=a.data.length>1;return {...a,data:a.data.filter(f=>f.providerId!=="credential").map(f=>({...f,canUnlink:p}))}},linkSocial:(o,a)=>n("/link-social",o,a,xn),unlinkSocial:(o,a)=>i(n("/unlink-account",o,a,j)),delete:(o={},a)=>i(n("/delete-user",o,a,En))}}function j(e){let t=q$1(e);return {status:s(t.status)}}function zn(e){let t=q$1(e);return {user:w(t.user)}}function Cn(e){return Array.isArray(e)||y(),e.map(t$1=>{let n=q$1(t$1);return {id:r(n.id),userId:r(n.userId),createdAt:t(n.createdAt),updatedAt:t(n.updatedAt),expiresAt:t(n.expiresAt),...je("ipAddress",v(n,"ipAddress")),...je("userAgent",v(n,"userAgent"))}})}function Dn(e){return Array.isArray(e)||y(),e.map(t$1=>{let n=q$1(t$1);return {id:r(n.id),userId:r(n.userId),providerId:r(n.providerId),accountId:r(n.accountId),scopes:u(n.scopes),createdAt:t(n.createdAt),updatedAt:t(n.updatedAt)}})}function xn(e){let t=q$1(e);return {url:r(t.url),redirect:s(t.redirect)}}function En(e){let t=q$1(e);return {success:s(t.success),message:r(t.message)}}function je(e,t){return t===void 0?{}:{[e]:t}}var Nn=new Set(["pending","accepted","rejected","canceled"]),fe=1e4;function Je(e){let t=q$1(e);return t.recipientHint!==null&&t.recipientHint!=="new_user"&&y(),{recipientHint:t.recipientHint}}function F(e,t$1,n){let i=q$1(e),o={id:b(i.id),name:b(i.name),slug:b(i.slug),createdAt:t(i.createdAt),...G("logo",v(i,"logo")),...G("metadata",i.metadata===void 0?void 0:A(i.metadata))};return E(o.id,t$1),E(o.slug,n),o}function We(e){return U(e,F)}function he(e,t,n){return e===null?null:(t===null&&y(),F(e,t,n))}function Xe(e,t,n){if(e===null)return null;let i=q$1(e),o=F(i,t,n);return {...o,members:U(i.members,a=>st(a,o.id)),invitations:U(i.invitations,a=>M(a,void 0,o.id))}}function Ae(e,t,n=false){let i=U(e,o=>J(o));return n||X(i.map(o=>o.organizationId),t),i}function $e(e,t){let n=U(e,i=>Oe(i));return X(n.map(i=>i.teamId),t),n}function Oe(e,t$1,n){let i=q$1(e),o={id:b(i.id),teamId:b(i.teamId),userId:b(i.userId),createdAt:t(i.createdAt)};return E(o.teamId,t$1),E(o.userId,n),o}function Ye(e,t,n){return e===null?null:(t===null&&y(),J(e,t,n))}function Qe(e,t){let n=q$1(e);return (!Number.isSafeInteger(n.total)||n.total<0)&&y(),{members:Un(n.members,t),total:n.total}}function M(e,t$1,n){let i=q$1(e),o=b(i.status);Nn.has(o)||y();let a={id:b(i.id),organizationId:b(i.organizationId),email:W(i.email),role:b(i.role),status:o,inviterId:b(i.inviterId),expiresAt:t(i.expiresAt),createdAt:t(i.createdAt)};return E(a.id,t$1),E(a.organizationId,n),a}function Ze(e,t){let n=U(e,i=>M(i));return X(n.map(i=>i.organizationId),t),n}function et(e){return U(e,t=>{let n=q$1(t);return {...M(n),organizationName:W(n.organizationName)}})}function tt(e,t){let n=q$1(e);return {...M(n,t),organizationName:b(n.organizationName),organizationSlug:b(n.organizationSlug),inviterEmail:ut(n.inviterEmail)}}function nt(e,t){let n=q$1(e),i=M(n.invitation,t);return {invitation:i,member:q(n.member,void 0,i.organizationId)}}function it(e,t){let n=q$1(e);return n.member!==null&&y(),{invitation:n.invitation===null?null:M(n.invitation,t),member:null}}function ot(e,t){return e===null?null:M(e,t)}function rt(e,t,n){let i=q$1(e);return {member:q(i.member,n,t)}}function q(e,t$1,n){let i=q$1(e),o={id:b(i.id),organizationId:b(i.organizationId),userId:b(i.userId),role:b(i.role),createdAt:t(i.createdAt),...i.user===void 0?{}:{user:ct(i.user)}};return E(o.id,t$1),E(o.organizationId,n),o}function at(e,t){let n=U(e,i=>{let o=q$1(i);return {organizationId:b(o.organizationId),data:{role:b(o.role),...G("permission",o.permission===void 0?void 0:Mn(o.permission)),...G("customPermissionKeys",o.customPermissionKeys===void 0?void 0:u(o.customPermissionKeys))}}});return X(n.map(i=>i.organizationId),t),n.map(i=>i.data)}function J(e,t$1,n){let i=q$1(e),o=i.updatedAt,a={id:b(i.id),name:W(i.name),organizationId:b(i.organizationId),createdAt:t(i.createdAt),...o===void 0?{}:{updatedAt:t(o)}};return E(a.id,t$1),E(a.organizationId,n),a}function ye(e){let t=q$1(e);return {message:W(t.message)}}function st(e,t){let n=q$1(e);return {...q(n,void 0,t),user:ct(n.user)}}function Un(e,t){let n=U(e,i=>st(i));return X(n.map(i=>i.organizationId),t),n}function Mn(e){let t=q$1(e),n={};for(let[i,o]of Object.entries(t))(i==="__proto__"||i==="constructor"||i==="prototype"||i.length===0||i.length>fe||!Array.isArray(o))&&y(),n[i]=o.map(a=>b(a));return n}function b(e){let t=r(e);return (t.length===0||t.length>fe)&&y(),t}function W(e){if(e==null)return "";let t=r(e);return t.length>fe&&y(),t}function ut(e){return e===null?null:b(e)}function E(e,t){t!==void 0&&e!==t&&y();}function X(e,t){let n=t??e[0];n!==void 0&&e.some(i=>i!==n)&&y();}function ct(e){let t=q$1(e);return {id:b(t.id),name:W(t.name),email:ut(t.email),...G("image",v(t,"image"))}}function U(e,t){return Array.isArray(e)||y(),e.map(n=>t(n))}function G(e,t){return t===void 0?{}:{[e]:t}}function dt(e,t,n=()=>null){let{post:i,mutation:o}=L(e,t),a=new Set,p=()=>{for(let r of a)try{r();}catch{}},f=new Map,l=(r,s,g,y)=>{if(g)return e.request(r,{query:s,fetchOptions:g,decode:y});let u=`${r}\0${JSON.stringify(s??null)}`,d=f.get(u);if(d)return d;let h=e.request(r,{query:s,decode:y}).finally(()=>{f.delete(u);});return f.set(u,h),h},A=async r=>{let s=await o(r).finally(()=>f.clear());return s.error===null&&p(),s};return {subscribe(r){return a.add(r),()=>a.delete(r)},create:(r,s)=>A(i("/organization/create",r,s,F)),list:r=>l("/organization/list",void 0,r,We),get:(r={},s)=>l("/organization/get-full-organization",{organizationId:r.organizationId,organizationSlug:r.organizationSlug,membersLimit:r.membersLimit},s,g=>Xe(g,r.organizationId,r.organizationSlug)),setActive:(r,s)=>A(i("/organization/set-active",r,s,g=>he(g,r.organizationId,r.organizationSlug))),createTeam:(r,s)=>A(i("/organization/create-team",r,s,g=>J(g,void 0,r.organizationId))),listTeams:(r={},s)=>l("/organization/list-teams",{organizationId:r.organizationId},s,g=>Ae(g,r.organizationId)),updateTeam:(r,s)=>A(i("/organization/update-team",r,s,g=>J(g,r.teamId,r.data.organizationId))),removeTeam:(r,s)=>A(i("/organization/remove-team",r,s,ye)),listUserTeams:r=>l("/organization/list-user-teams",void 0,r,s=>Ae(s,void 0,true)),listTeamMembers:(r={},s)=>l("/organization/list-team-members",{teamId:r.teamId},s,g=>$e(g,r.teamId)),addTeamMember:(r,s)=>A(i("/organization/add-team-member",r,s,g=>Oe(g,r.teamId,r.userId))),removeTeamMember:(r,s)=>A(i("/organization/remove-team-member",r,s,ye)),setActiveTeam:(r,s)=>A(i("/organization/set-active-team",r,s,g=>Ye(g,r.teamId))),update:(r,s)=>A(i("/organization/update",r,s,g=>he(g,r.organizationId))),delete:(r,s)=>A(i("/organization/delete",r,s,g=>F(g,r.organizationId))),listMembers:(r={},s)=>l("/organization/list-members",{organizationId:r.organizationId,organizationSlug:r.organizationSlug,limit:r.limit,offset:r.offset,sortBy:r.sortBy,sortDirection:r.sortDirection,filterField:r.filterField,filterValue:r.filterValue,filterOperator:r.filterOperator},s,g=>Qe(g,r.organizationId)),inviteMember:(r,s)=>A(i("/organization/invite-member",r,s,g=>M(g,void 0,r.organizationId))),listInvitations:(r={},s)=>l("/organization/list-invitations",{organizationId:r.organizationId},s,g=>Ze(g,r.organizationId)),listUserInvitations:r=>l("/organization/list-user-invitations",void 0,r,et),getInvitation:(r,s)=>l("/organization/get-invitation",{id:r.id},s,g=>tt(g,r.id)),getInvitationRecipientHint:(r,s)=>l("/organization/invitation-recipient-hint",{invitationId:r.invitationId},s,Je),acceptInvitation:(r,s)=>A(i("/organization/accept-invitation",r,s,g=>nt(g,r.invitationId))),rejectInvitation:(r,s)=>A(i("/organization/reject-invitation",r,s,g=>it(g,r.invitationId))),cancelInvitation:(r,s)=>A(i("/organization/cancel-invitation",r,s,g=>ot(g,r.invitationId))),removeMember:(r,s)=>A(i("/organization/remove-member",r,s,g=>rt(g,r.organizationId,r.memberIdOrEmail.includes("@")?void 0:r.memberIdOrEmail))),updateMemberRole:(r,s)=>A(i("/organization/update-member-role",r,s,g=>q(g,r.memberId,r.organizationId))),leave:(r,s)=>A(i("/organization/leave",r,s,g=>q(g,void 0,r.organizationId))),listRoles:(r={},s)=>l("/organization/list-roles",{organizationId:r.organizationId},s,g=>at(g,r.organizationId)),has:r=>E$1(n(),r),hasPermission:r=>B$1(n(),r.permission)}}var lt=4096,_n=4096,Ln=100,Fn=256,qn=16,Hn=64,Vn=12;function we(e){let t=q$1(e);return t.twoFactorRedirect===true?((t.user!==void 0||t.redirect!==void 0||t.url!==void 0)&&y(),{twoFactorRedirect:true,...t.twoFactorMethods===void 0?{}:{twoFactorMethods:zt(t.twoFactorMethods,qn,Hn)}}):(t.twoFactorRedirect!==void 0&&y(),{redirect:s(t.redirect),...Jn(t,"url"),user:w(t.user)})}function pt(e){let t=q$1(e);return {user:w(t.user)}}function gt(e){let t=q$1(e);return {sessionCreated:s(t.sessionCreated),user:w(t.user)}}function mt(e,t){let n=q$1(e),i=s(n.redirect);n.user===null&&y();let o=n.user!==void 0&&n.user!==null,a=n.url!==void 0&&n.url!==null;return i?((o||!a)&&y(),{redirect:true,url:be(n.url,t)}):(o===a&&y(),o?{redirect:false,user:w(n.user)}:{redirect:false,url:be(n.url,t)})}function ft(e,t){let n=q$1(e);return (n.redirect!==true||n.user!==void 0)&&y(),{redirect:true,url:be(n.url,t)}}function ht(e){return {status:s(q$1(e).status)}}function At(e){return {success:s(q$1(e).success)}}function Ot(e){return q$1(e).status!=="pending"&&y(),{status:"pending"}}function yt(e){let t=q$1(e);if(t.kind==="authowl_turnstile")return {kind:"authowl_turnstile"};t.kind!=="akedly_shield_v1_2"&&y();let n=q$1(t.turnstile),i=n.siteKey===null?null:r(n.siteKey);return {kind:"akedly_shield_v1_2",connectionId:r(t.connectionId),challenge:r(t.challenge),difficulty:Kn(t.difficulty),challengeToken:r(t.challengeToken),challengeRequired:s(t.challengeRequired),turnstile:{required:s(n.required),siteKey:i}}}function Kn(e){return (!Number.isSafeInteger(e)||Number(e)<0||Number(e)>Vn)&&y(),Number(e)}function bt(e){let t=q$1(e);return (t.status!==true||t.sessionCreated!==true)&&y(),{status:true,sessionCreated:true,user:Bn(t.user)}}function ke(e){return {status:s(q$1(e).status)}}function wt(e){return {status:s(q$1(e).status)}}function kt(e){let t=q$1(e);return {status:s(t.status),user:w(t.user)}}function Rt(e){return {success:s(q$1(e).success)}}function It(e){let t=q$1(e);return {totpURI:Gn(t.totpURI),backupCodes:vt(t.backupCodes)}}function St(e){return {status:s(q$1(e).status)}}function te(e){return q$1(e).status!==true&&y(),{status:true}}function Tt(e){return {status:s(q$1(e).status)}}function Pt(e){let t=q$1(e);return t.status!==void 0&&t.status!==true&&y(),{backupCodes:vt(t.backupCodes)}}function Bn(e){let t$1=q$1(e);return {id:H(t$1.id,512),...Wn(t$1,"name",1024),phoneNumber:H(t$1.phoneNumber,64),phoneNumberVerified:s(t$1.phoneNumberVerified),...t$1.createdAt===void 0?{}:{createdAt:t(t$1.createdAt)},...t$1.updatedAt===void 0?{}:{updatedAt:t(t$1.updatedAt)}}}function be(e,t){let n=H(e,lt);/[\u0000-\u0020\u007f]/u.test(n)&&y();let i;try{i=new URL(n);}catch{return y()}return (i.username||i.password)&&y(),i.protocol==="https:"||t&&i.protocol==="http:"&&jn(i.hostname)?i.href:y()}function jn(e){let t=e.toLowerCase();return t==="localhost"||t==="127.0.0.1"||t==="[::1]"}function Gn(e){let t=H(e,_n),n;try{n=new URL(t);}catch{return y()}let i=n.searchParams.get("secret");return (n.protocol!=="otpauth:"||n.hostname.toLowerCase()!=="totp"||n.username||n.password||n.hash||i===null||i.length===0||i.length>512||/\s/u.test(i))&&y(),t}function vt(e){return zt(e,Ln,Fn)}function zt(e,t,n){(!Array.isArray(e)||e.length===0||e.length>t)&&y();let i=e.map(o=>H(o,n));return i.some(o=>o.trim().length===0)&&y(),new Set(i).size!==i.length&&y(),i}function H(e,t){let n=r(e);return (n.length===0||n.length>t)&&y(),n}function Jn(e,t){let n=e[t];return n==null?{}:{[t]:H(n,lt)}}function Wn(e,t,n){let i=v(e,t);return i===void 0?{}:(i!==null&&i.length>n&&y(),{[t]:i})}var Ct=new Set([1564,8206,8207,8234,8235,8236,8237,8238,8294,8295,8296,8297]),ne=new Set([9,10,11,12,13,32,133,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288,65279]);function ie(e){if(e===void 0)return {valid:true,value:void 0};for(let n of e){let i=n.codePointAt(0);if(i===void 0||xt(n,i)||Dt(i)||Ct.has(i))return {valid:false}}let t=Xn(e);return Re(t)?{valid:true,value:t}:{valid:false}}function Re(e){let t=0,n,i;for(let o of e){if(t+=1,t>256)return  false;let a=o.codePointAt(0);if(a===void 0||xt(o,a)||Dt(a)||Ct.has(a))return  false;n??=a,i=a;}return t>0&&n!==void 0&&i!==void 0&&!ne.has(n)&&!ne.has(i)}function oe(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_PASSKEY_NAME",message:"Passkey names must contain 1 to 256 safe Unicode characters."}}}function Xn(e){let t=0,n=e.length;for(;t<n;){let i=e.codePointAt(t);if(i===void 0||!ne.has(i))break;t+=i>65535?2:1;}for(;n>t;){let i=e.codePointAt(n-1);if(i===void 0)break;let a=i>=56320&&i<=57343?n-2:n-1,p=e.codePointAt(a);if(p===void 0||!ne.has(p))break;n=a;}return e.slice(t,n)}function Dt(e){return e>=0&&e<=31||e>=127&&e<=159}function xt(e,t){return e.length===1&&t>=55296&&t<=57343}var Ut=12,Mt=5e3,$n=8,Yn=1e3,Qn=16,Et=512,_t=100,Lt=8192,Zn=32768,Ie=1024,Nt=256,Te=64,ei=6e5,ti=/^[A-Za-z0-9_-]+$/u,ni=/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u,ii=/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u,oi=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/u,ri=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu,Ft=new Set(["discouraged","preferred","required"]),ai=new Set(["singleDevice","multiDevice"]),qt=new Set(["ble","cable","hybrid","internal","nfc","smart-card","usb"]),Ht=new Set(["hybrid","security-key","client-device"]),si=new Set(["none","indirect","direct","enterprise"]),ui=new Set(["fido-u2f","packed","android-safetynet","android-key","tpm","apple","none"]),ci=new Set(["platform","cross-platform"]),di=new Set(["discouraged","preferred","required"]),li=new Set([-8,-7,-257]);function Vt(e){let t=z(e,Ut,Mt);return {challenge:Qt(t.challenge),...T("timeout",$t(t.timeout)),...T("rpId",Zt(t.rpId)),...T("allowCredentials",Xt(t.allowCredentials)),...T("userVerification",$(t.userVerification,Ft)),...T("hints",re(t.hints,Ht)),...T("extensions",Yt(t.extensions))}}function Kt(e){let t=z(e,Ut,Mt);return {challenge:Qt(t.challenge),rp:pi(t.rp),user:gi(t.user),pubKeyCredParams:mi(t.pubKeyCredParams),...T("timeout",$t(t.timeout)),...T("excludeCredentials",Xt(t.excludeCredentials)),...T("authenticatorSelection",fi(t.authenticatorSelection)),...T("attestation",$(t.attestation,si)),...T("attestationFormats",re(t.attestationFormats,ui)),...T("hints",re(t.hints,Ht)),...T("extensions",Yt(t.extensions))}}function Bt(e){let t=q$1(e),n=x(t.session),i=w(t.user);return n.userId!==i.id&&y(),{session:n,user:i}}function Pe(e){let t$1=q$1(e),n=t$1.counter;(!Number.isSafeInteger(n)||n<0)&&y();let i=ve(t$1.deviceType,ai),o=s(t$1.backedUp);return o&&i!=="multiDevice"&&y(),{id:V(t$1.id,Nt),...Oi(t$1),publicKey:hi(t$1.publicKey,Zn),userId:V(t$1.userId,Nt),credentialID:se(t$1.credentialID,Lt),counter:n,deviceType:i,backedUp:o,...yi(t$1),createdAt:t(t$1.createdAt),...bi(t$1)}}function jt(e,t,n){let i=Pe(e);return (i.credentialID!==t||(n===void 0?i.name!==void 0&&i.name!==null:i.name!==n))&&y(),i}function Gt(e){(!Array.isArray(e)||e.length>_t)&&y();let t=e.map(Pe);return ae(t.map(n=>n.id)),ae(t.map(n=>n.credentialID)),t.length>1&&t.some(n=>n.userId!==t[0]?.userId)&&y(),t}function Jt(e,t,n){let i=q$1(e),o=Pe(i.passkey);return (o.id!==t||o.name!==n)&&y(),{passkey:o}}function Wt(e){return q$1(e).status!==true&&y(),{status:true}}function pi(e){let t=q$1(e);return {name:Se(t.name,Ie),...T("id",Zt(t.id))}}function gi(e){let t=q$1(e);return {id:se(t.id,128,1,64),name:Se(t.name,Ie),displayName:Se(t.displayName,Ie)}}function mi(e){(!Array.isArray(e)||e.length===0||e.length>Te)&&y();let t=e.map(n=>{let i=q$1(n);return (i.type!=="public-key"||!Number.isSafeInteger(i.alg)||!li.has(i.alg))&&y(),{type:"public-key",alg:i.alg}});return wi(t.map(n=>n.alg)),t}function Xt(e){if(e===void 0)return;(!Array.isArray(e)||e.length>_t)&&y();let t=e.map(n=>{let i=q$1(n);return i.type!=="public-key"&&y(),{type:"public-key",id:se(i.id,Lt),...T("transports",re(i.transports,qt))}});return ae(t.map(n=>n.id)),t}function fi(e){if(e===void 0)return;let t=q$1(e);t.requireResidentKey!==void 0&&typeof t.requireResidentKey!="boolean"&&y();let n=$(t.residentKey,di);return t.requireResidentKey!==void 0&&n!==void 0&&t.requireResidentKey!==(n==="required")&&y(),{...T("authenticatorAttachment",$(t.authenticatorAttachment,ci)),...T("residentKey",n),...T("requireResidentKey",t.requireResidentKey),...T("userVerification",$(t.userVerification,Ft))}}function $t(e){return e!==void 0&&(typeof e!="number"||!Number.isFinite(e)||e<0||e>ei)&&y(),e}function Yt(e){return e===void 0?void 0:z(e,$n,Yn)}function re(e,t){if(e===void 0)return;(!Array.isArray(e)||e.length>Te)&&y();let n=e.map(i=>ve(i,t));return ae(n),n}function $(e,t){if(e!==void 0)return ve(e,t)}function Qt(e){return se(e,Math.ceil(Et*4/3),Qn,Et)}function se(e,t,n=1,i=Number.POSITIVE_INFINITY){let o=V(e,t),a=o.length%4,p=Ai(o.at(-1)??""),f=Math.floor(o.length*3/4);return (!ti.test(o)||a===1||a===2&&(p&15)!==0||a===3&&(p&3)!==0||f<n||f>i)&&y(),o}function V(e,t){let n=r(e);return (n.length===0||n.length>t)&&y(),n}function Se(e,t){let n=V(e,t);return ii.test(n)&&y(),n}function Zt(e){if(e===void 0)return;let t=V(e,253);return t!=="localhost"&&(t.endsWith(".")||!t.includes(".")||t.split(".").some(n=>!oi.test(n)))&&y(),t}function hi(e,t){let n=V(e,t),i=n.endsWith("=="),o=!i&&n.endsWith("="),a=n.at(i?-3:o?-2:-1)??"",p=en(a);return (n.length%4!==0||!ni.test(n)||i&&(p&15)!==0||o&&(p&3)!==0)&&y(),n}function Ai(e){return en(e,true)}function en(e,t=false){return (t?"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/").indexOf(e)}function Oi(e){let t=v(e,"name");return t===void 0?{}:(t!==null&&!Re(t)&&y(),{name:t})}function yi(e){let t=v(e,"transports");if(t==null||t==="")return t===void 0?{}:{transports:t};let n=t.split(",");return (n.length>Te||n.some(i=>!qt.has(i))||new Set(n).size!==n.length)&&y(),{transports:t}}function bi(e){let t=v(e,"aaguid");return t==null?t===void 0?{}:{aaguid:null}:(ri.test(t)||y(),{aaguid:t})}function ve(e,t){let n=r(e);return t.has(n)||y(),n}function T(e,t){return t===void 0?{}:{[e]:t}}function ae(e){new Set(e).size!==e.length&&y();}function wi(e){new Set(e).size!==e.length&&y();}function ki(e,t){if(!t)return e;let n=t.catch(()=>{});return n.then(()=>{n=null;}),{async request(i,o){return n&&await n,e.request(i,o)}}}var tn=new Map;function Ri(e,t,n){let i=tn.get(n);if(!i){let o=new URLSearchParams(window.location.hash.slice(1)).get("authowl_code");if(!o)return;i=import('./session-handoff-6FBH3GFJ.js').then(a=>a.completeCrossSiteSignIn(e,t,o)),tn.set(n,i);}return i}function nn(e){return !a()||e.idToken||e.disableRedirect?"legacy":"first-party"}function Ii(e,t=()=>{},n=Pi){let i=ge(e),o=e.session.tokens,a$1=a()?Ri(i,o,e.decoded.projectId):void 0,p=ki(i,a$1),f=He({http:p,probe:ge({...e,fetch:e.session.probe}),tokens:o,channelName:`authowl:${e.decoded.projectId}`}),l=n(p,f.notifyMutation),A=()=>{f.notifyMutation(),t();},{post:r,mutation:s}=L(p,A),g=e.decoded.env==="test",y=u=>{o.beginSession({remember:u?.rememberMe!==false});};return {sessionStore:f.store,getSession:f.getSession,account:Ge(p,A),organization:dt(p,A,()=>f.store.getSnapshot().data?.session.membership??null),signIn:{email:(u,d)=>(y(u),s(r("/sign-in/email",u,d,we),h=>!("twoFactorRedirect"in h))),username:(u,d)=>(y(u),s(r("/sign-in/username",u,d,we),h=>!("twoFactorRedirect"in h))),social:async(u,d)=>{if(y(),nn(u)==="first-party"){let{beginCrossSiteSignIn:R}=await import('./session-handoff-6FBH3GFJ.js'),x=await R(e,{kind:"social",provider:u.provider,callbackURL:u.callbackURL,errorCallbackURL:u.errorCallbackURL,newUserCallbackURL:u.newUserCallbackURL,scopes:u.scopes,loginHint:u.loginHint,requestSignUp:u.requestSignUp});if(x)return window.location.assign(x),{data:{redirect:true,url:x},error:null}}let h=await s(r("/sign-in/social",u,d,R=>mt(R,g)),R=>"user"in R);return h.error!==null||h.data===null||"url"in h.data&&h.data.redirect&&!u.disableRedirect&&typeof window<"u"&&window.location.assign(h.data.url),h},sso:async(u,d)=>{if(nn(u)==="first-party"){let{beginCrossSiteSignIn:R}=await import('./session-handoff-6FBH3GFJ.js'),x=await R(e,{kind:"sso",email:u.email,providerId:u.providerId,domain:u.domain,organizationSlug:u.organizationSlug,callbackURL:u.callbackURL,errorCallbackURL:u.errorCallbackURL,newUserCallbackURL:u.newUserCallbackURL});if(x)return window.location.assign(x),{data:{url:x,redirect:true},error:null}}let h=await r("/sign-in/sso",u,d,R=>ft(R,g));return h.error!==null||h.data===null||typeof window<"u"&&window.location.assign(h.data.url),h},magicLink:(u,d)=>r("/sign-in/magic-link",u,d,ht),emailOtp:(u,d)=>(y(),s(r("/sign-in/email-otp",u,d,pt))),passkey:(u,d)=>(y(),l.signIn(u,d))},signUp:{email:(u,d)=>(y(),s(r("/sign-up/email",u,d,gt),h=>h.sessionCreated))},emailOtp:{sendVerificationOtp:(u,d)=>r("/email-otp/send-verification-otp",u,d,At),verifyEmail:(u,d)=>(y(),s(r("/email-otp/verify-email",u,d,kt)))},phoneOtp:{prepare:u=>r("/phone-otp/challenge",{},u,yt),start:(u,d)=>r("/phone-otp/start",{...u,idempotencyKey:u.idempotencyKey??qe()},d,Ot),verify:(u,d)=>(y(),s(r("/phone-otp/verify",u,d,bt)))},requestPasswordReset:(u,d)=>r("/request-password-reset",u,d,ke),resetPassword:(u,d)=>r("/reset-password",u,d,ke),sendVerificationEmail:(u,d)=>r("/send-verification-email",u,d,wt),passkey:{addPasskey:(u,d)=>l.add(u,d),listUserPasskeys:()=>p.request("/passkey/list-user-passkeys",{decode:Gt}),updatePasskey:async(u,d)=>{let h=ie(u.name);if(!h.valid||h.value===void 0)return oe();let R=h.value;return r("/passkey/update-passkey",{...u,name:R},d,x=>Jt(x,u.id,R))},deletePasskey:(u,d)=>r("/passkey/delete-passkey",u,d,Wt)},twoFactor:{enable:(u,d)=>r("/two-factor/enable",u,d,It),disable:(u,d)=>s(r("/two-factor/disable",u,d,St),h=>h.status),verifyTotp:(u,d)=>s(r("/two-factor/verify-totp",u,d,te)),verifyBackupCode:(u,d)=>s(r("/two-factor/verify-backup-code",u,d,te)),sendOtp:(u={},d)=>r("/two-factor/send-otp",u,d,Tt),verifyOtp:(u,d)=>s(r("/two-factor/verify-otp",u,d,te)),generateBackupCodes:(u,d)=>r("/two-factor/generate-backup-codes",u,d,Pt)},signOut:u=>s(p.request("/sign-out",{method:"POST",body:{},fetchOptions:u,decode:Rt}).then(d=>(o.endSession(),d)),d=>d.success)}}function wo(e,t=()=>{},n){let i=Ii(e,t,n);return n?{...i,signIn:{email:i.signIn.email,username:i.signIn.username,social:on(i),magicLink:i.signIn.magicLink,emailOtp:i.signIn.emailOtp,passkey:i.signIn.passkey},passkey:{listUserPasskeys:i.passkey.listUserPasskeys,updatePasskey:i.passkey.updatePasskey,deletePasskey:i.passkey.deletePasskey,addPasskey:i.passkey.addPasskey}}:{...i,signIn:{email:i.signIn.email,username:i.signIn.username,social:on(i),magicLink:i.signIn.magicLink,emailOtp:i.signIn.emailOtp},passkey:{listUserPasskeys:i.passkey.listUserPasskeys,updatePasskey:i.passkey.updatePasskey,deletePasskey:i.passkey.deletePasskey}}}function on(e){return async(t,n)=>{if(!t?.idToken||typeof t.idToken.token!="string"||t.idToken.token==="")return Si();let i=await e.signIn.social({...t,disableRedirect:true},n);return i.data!==null&&"url"in i.data?Ti():i}}function Si(){return Promise.resolve({data:null,error:{status:400,statusText:"BAD_REQUEST",code:"NATIVE_SOCIAL_ID_TOKEN_REQUIRED",message:"Native social sign-in requires a provider ID token."}})}function Ti(){return Promise.resolve({data:null,error:{status:502,statusText:"BAD_GATEWAY",code:"INVALID_NATIVE_SOCIAL_RESPONSE",message:"The server returned a redirect for native ID-token sign-in."}})}function Pi(){return {signIn:()=>rn(),add:()=>rn()}}function rn(){return Promise.resolve({data:null,error:{status:400,statusText:"BAD_REQUEST",code:"PASSKEY_BROWSER_REQUIRED",message:"This passkey ceremony requires a browser with WebAuthn."}})}function So(e,t,n){let i=new Map;return {async signIn(o={},a){let p=await e.request("/passkey/generate-authenticate-options");if(!p.data)return un(p.error);let f;try{f=Vt(p.data);}catch{return an()}let l;try{l=await n.authenticate({optionsJSON:f,useBrowserAutofill:o.autoFill});}catch(y){return cn(n,y,"AUTH_CANCELLED","Passkey authentication was cancelled.")}if(!vi(l))return sn();let{clientExtensionResults:A,...r}=l,s=i.get(l.id);if(s)return s;let g=(async()=>{let y=await e.request("/passkey/verify-authentication",{method:"POST",body:{response:r},fetchOptions:a,decode:Bt});return y.data&&t(),y})();i.set(l.id,g);try{return await g}finally{i.get(l.id)===g&&i.delete(l.id);}},async add(o={},a){let p=ie(o.name);if(!p.valid)return oe();let f=await e.request("/passkey/generate-register-options",{query:{name:p.value,authenticatorAttachment:o.authenticatorAttachment}});if(!f.data)return un(f.error);let l;try{l=Kt(f.data);}catch{return an()}let A;try{A=await n.register({optionsJSON:l});}catch(y){return cn(n,y,"REGISTRATION_CANCELLED","Passkey registration was cancelled.")}if(!zi(A))return sn();let{clientExtensionResults:r,...s}=A,g=await e.request("/passkey/verify-registration",{method:"POST",body:{response:s,name:p.value},fetchOptions:a,decode:y=>jt(y,A.id,p.value)});return g.data&&t(),g}}}function an(){return {data:null,error:{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned invalid WebAuthn options."}}}function sn(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_WEBAUTHN_RESPONSE",message:"The platform returned an invalid passkey response."}}}function ln(e){if(!e||typeof e!="object")return  false;let t=e;return typeof t.id=="string"&&t.id.length>0&&typeof t.rawId=="string"&&t.rawId.length>0&&t.type==="public-key"&&!!t.response&&typeof t.response=="object"}function vi(e){if(!ln(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.authenticatorData=="string"&&typeof t.signature=="string"&&(t.userHandle===void 0||typeof t.userHandle=="string")}function zi(e){if(!ln(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.attestationObject=="string"}function un(e){return {data:null,error:e??{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned no WebAuthn options."}}}function cn(e,t,n,i){let o=Di(t,"page does not have focus"),a=e.errorCode?.(t),p=a!==void 0?a==="ERROR_CEREMONY_ABORTED":dn(t)==="AbortError",f=n!=="AUTH_CANCELLED",l=Ci(a,dn(t),f);return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:o?"PASSKEY_PAGE_NOT_FOCUSED":p?n:a??"PASSKEY_BROWSER_ERROR",message:o?"Keep this page focused while completing the passkey prompt.":p?i:l}}}function Ci(e,t,n){switch(e){case "ERROR_INVALID_DOMAIN":case "ERROR_INVALID_RP_ID":return "Passkeys are not set up for this site\u2019s domain.";case "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED":return "This device already has a passkey for this account.";case "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEY_ALGS":case "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT":case "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT":return "This device cannot create a passkey for this site.";}return t==="NotAllowedError"?n?"No passkey was created. The prompt was dismissed or timed out.":"No passkey was used. This device may not have one saved for this site yet, or the prompt was dismissed.":t==="SecurityError"?"Passkeys are not set up for this site\u2019s domain.":n?"Passkey registration did not complete.":"Passkey sign-in did not complete."}function dn(e){return e&&typeof e=="object"&&"name"in e&&typeof e.name=="string"?e.name:void 0}function Di(e,t){let n=t.toLowerCase(),i=new Set,o=e;for(;o&&typeof o=="object"&&!i.has(o);){if(i.add(o),"message"in o&&typeof o.message=="string"&&o.message.toLowerCase().includes(n))return  true;o="cause"in o?o.cause:void 0;}return  false}async function zo(e){let n=`${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}/public-config`;return _e(await ee(e,n,{init:{method:"GET",credentials:"omit"},maxResponseBytes:256*1024,decode:i=>xi(i,e)}),"public-config")}function xi(e,t){let n=z(e),i=n.environmentId,o=n.environmentType,a=`${new URL(t.apiUrl).origin}/api/projects/${t.decoded.projectId}/auth`;if(typeof n.applicationId!="string"||!Ei(n.applicationId)||i!==t.decoded.projectId||o!=="development"&&o!=="production"||n.authBaseUrl!==a)throw D();let p=P(n.branding),f=P(n.legal);if(!ze(n.enabledMethods,64)||!ze(n.socialProviders,64)||!gn(p,["appName","logoUrl","primaryColor"])||p.showAppName!==void 0&&typeof p.showAppName!="boolean"||p.alignment!==void 0&&p.alignment!=="left"&&p.alignment!=="center"&&p.alignment!=="right"||p.theme!==void 0&&p.theme!=="light"&&p.theme!=="dark"&&p.theme!=="system"||!gn(f,["termsUrl","privacyUrl"])||!Number.isSafeInteger(f.version)||f.version<0||typeof f.required!="boolean")throw D();if(n.socialProviderClientIds!==void 0){let l=P(n.socialProviderClientIds);if(Object.keys(l).length>64||Object.values(l).some(A=>typeof A!="string"||A.length>2048))throw D()}if(!_(n,["requireEmailVerification","twoFactor","mfaRequired","accountDeletion","organizations","sso","badge"])||!pn(n.turnstileSiteKey)||!pn(n.authTurnstileSiteKey)||typeof n.locale!="string"||n.locale.length===0||n.locale.length>64||!Number.isSafeInteger(n.configVersion)||n.configVersion<0)throw D();if(n.jwtIssuer!==null){let l=P(n.jwtIssuer);if(l.issuer!==a||l.jwksUrl!==`${a}/jwks`||l.aud!==t.decoded.projectId)throw D()}if(n.signUp!==void 0){let l=P(n.signUp).mode;if(typeof l!="string"||!["open","restricted","allowlist","waitlist"].includes(l))throw D()}if(n.authentication!==void 0&&Ni(n.authentication),n.emailVerification!==void 0){let l=P(n.emailVerification);if(!_(l,["required"])||l.method!=="link"&&l.method!=="code")throw D()}if(n.userModel!==void 0&&!_(P(n.userModel),["requireEmail","firstLastName","emailChange","accountDeletion"]))throw D();if(n.mfa!==void 0){let l=P(n.mfa);if(!_(l,["totp","required","backupCodes"])||(l.required===true||l.backupCodes===true)&&l.totp!==true)throw D()}return n}function Ei(e){return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}function D(){return new TypeError("public-config returned an invalid response")}function P(e){if(!e||typeof e!="object"||Array.isArray(e))throw D();return e}function pn(e){return e===null||typeof e=="string"&&e.length<=4096}function Ni(e){let t=P(e),n=P(t.email),i=P(t.password),o=i.minLength!==void 0||i.maxLength!==void 0;if(!_(n,["signUp"])||!ze(n.signIn,3)||n.signIn.some(a=>a!=="password"&&a!=="magic_link"&&a!=="email_otp")||!_(P(t.phone),["signUp","signIn"])||!_(i,["signUp","add"])||o&&(!Number.isSafeInteger(i.minLength)||!Number.isSafeInteger(i.maxLength)||i.minLength<1||i.maxLength>4096||i.minLength>i.maxLength)||!_(P(t.passkey),["signIn","add"])||!Ui(P(t.passkey).relyingPartyId)||!_(P(t.username),["collectOnSignUp","signIn"]))throw D()}function Ui(e){return e==null||typeof e=="string"}function _(e,t){return t.every(n=>typeof e[n]=="boolean")}function gn(e,t){return t.every(n=>e[n]===void 0||typeof e[n]=="string"&&e[n].length<=4096)}function ze(e,t){return Array.isArray(e)&&e.length<=t&&e.every(n=>typeof n=="string"&&n.length<=128)&&new Set(e).size===e.length}export{Mi as a,ce as b,ee as c,_e as d,hn as e,ge as f,qe as g,Ii as h,wo as i,So as j,zo as k};

package/dist/{client-BkPncYVH.d.ts → client-BfXYqxAr.d.ts}

@@ -1,5 +1,49 @@
 import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-B05mzhtA.js';
 
+/**
+ * The organization invitation an emailed link is asking this browser to accept.
+ *
+ * The link lands on the TENANT'S OWN page carrying `?authowl_invitation=<id>`,
+ * and the only route that can redeem it needs a session the visitor usually does
+ * not have yet. So the id has to survive an entire sign-up or sign-in - which
+ * means surviving that flow's redirects: the OAuth round trip, the email
+ * verification round trip (which can land on a different page entirely), the MFA
+ * hold, and whatever navigation the operator's own `redirectTo` performs. A query
+ * parameter survives none of those, so it is read once, moved into storage, and
+ * taken out of the URL.
+ *
+ * Best-effort storage, deliberately: a browser that refuses `localStorage`
+ * degrades to "this invitation is claimable until you navigate", which is worse
+ * than the ideal and much better than a sign-in that throws.
+ */
+declare const INVITATION_QUERY_PARAM = "authowl_invitation";
+/**
+ * The only hint value that exists. There is deliberately no `existing_user`:
+ * absence has to stay ambiguous across an existing account, an older AuthOwl,
+ * and an account created between the invite and the click - so it can never be
+ * read as proof that an address IS registered.
+ */
+type InvitationRecipientHint = 'new_user';
+type InvitationClaim = {
+    id: string;
+    /** Epoch milliseconds, for age display and for expiring a forgotten claim. */
+    capturedAt: number;
+};
+/** Claims older than this are dropped unread: a month-old link is not a pending intent. */
+declare const INVITATION_CLAIM_MAX_AGE_MS: number;
+/**
+ * Read `?authowl_invitation` once, stash it, and strip it from the URL.
+ *
+ * Namespaced and only ours - a bare `invitation` belongs to the tenant's app as
+ * much as to us, and rewriting their parameters is not ours to do. Returns the
+ * captured claim, or the one already stashed when there is no parameter, so a
+ * caller can render from a single call.
+ */
+declare function captureInvitationClaim(now?: number): InvitationClaim | null;
+/** The stashed claim, or null when there is none, it is unreadable, or it is stale. */
+declare function readInvitationClaim(now?: number): InvitationClaim | null;
+declare function clearInvitationClaim(): void;
+
 type EnvironmentType = 'development' | 'production';
 /**
  * The public, publishable-key-safe project config the SDK renders its sign-in
@@ -581,9 +625,17 @@ interface InviteOrganizationMemberOptions {
 interface ListOrganizationInvitationsOptions {
     organizationId?: string;
 }
+/** Options for resolving an invitation addressed to the signed-in session's own email. */
 interface GetOrganizationInvitationOptions {
+    /** Invitation id, resolved only when the signed-in session's own email is the recipient. */
     id: string;
 }
+interface GetInvitationRecipientHintOptions {
+    invitationId: string;
+}
+interface InvitationRecipientHintData {
+    recipientHint: InvitationRecipientHint | null;
+}
 interface OrganizationInvitationActionOptions {
     invitationId: string;
 }
@@ -624,6 +676,19 @@ interface OrganizationRoleSummary {
     role: string;
     /** The role's ⊆14 system-statement document (engine shape); advisory here. */
     permission?: unknown;
+    /**
+     * The custom `org:<feature>:<action>` permission keys this role grants.
+     *
+     * These cannot appear in `permission`: that is the engine's own document, and
+     * a custom id does not fit its shape - so a custom role reads as an empty
+     * document there while genuinely granting these. This is the field a role
+     * picker needs to show what a custom role does.
+     *
+     * Absent when the role grants none, and absent from any AuthOwl that does not
+     * report them, so an empty array is never confused with "not told". Advisory,
+     * like everything else on this type: the boundary is server-side.
+     */
+    customPermissionKeys?: string[];
 }
 interface OrganizationClient {
     /** @internal Subscribe to successful organization mutations. Used by framework bindings. */
@@ -664,7 +729,23 @@ interface OrganizationClient {
     inviteMember(params: InviteOrganizationMemberOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation>>;
     listInvitations(params?: ListOrganizationInvitationsOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation[]>>;
     listUserInvitations(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationUserInvitation[]>>;
+    /**
+     * Resolves an invitation only when its recipient is the signed-in session's own email.
+     *
+     * This recipient-only behaviour is a deliberate access control, not a bug. An inviter
+     * listing invitations they sent should call `listInvitations({ organizationId })`
+     * instead - `getInvitation` will not resolve one for them, because they are not its
+     * recipient.
+     *
+     * Depending on the project's email-verification policy, being the recipient may not be
+     * sufficient on its own.
+     */
     getInvitation(params: GetOrganizationInvitationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitationDetails>>;
+    /**
+     * Resolve the invitation's pre-authentication screen hint without exposing
+     * its recipient, organization, or existence. `null` means only "not told".
+     */
+    getInvitationRecipientHint(params: GetInvitationRecipientHintOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<InvitationRecipientHintData>>;
     acceptInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AcceptOrganizationInvitationData>>;
     rejectInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<RejectOrganizationInvitationData>>;
     cancelInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation | null>>;
@@ -1412,4 +1493,4 @@ interface AuthOwlClient {
  */
 declare function createAuthOwlClient(config: ResolvedAuthConfig): AuthOwlClient;
 
-export { type LinkSocialOptions as $, type AkedlyShieldStartProof as A, type DeletePasskeyData as B, type ChangeEmailOptions as C, type DeleteAccountData as D, type DeletePasskeyOptions as E, type DisableTwoFactorOptions as F, type EmailAuthData as G, type EmailOtpAuthData as H, type EmailOtpSignInOptions as I, type EmailOtpType as J, type EmailSignInOptions as K, type EmailSignUpData as L, type EmailSignUpOptions as M, type EnableTwoFactorOptions as N, type EnvironmentType as O, type PhoneOtpChallengeData as P, type GenerateBackupCodesOptions as Q, type GetOrganizationInvitationOptions as R, type GetOrganizationOptions as S, type GetToken as T, type GetTokenOptions as U, type InviteOrganizationMemberOptions as V, type JsonObject as W, type JsonPrimitive as X, type JsonValue as Y, type LeaveOrganizationOptions as Z, type LinkSocialData as _, AUTH_CHALLENGE_HEADER as a, type UnlinkSocialOptions as a$, type ListOrganizationInvitationsOptions as a0, type ListOrganizationMembersOptions as a1, type ListOrganizationRolesOptions as a2, type ListOrganizationTeamMembersOptions as a3, type ListOrganizationTeamsOptions as a4, type MagicLinkData as a5, type MagicLinkSignInOptions as a6, type Organization as a7, type OrganizationClient as a8, type OrganizationDetails as a9, type RemoveOrganizationMemberOptions as aA, type RemoveOrganizationTeamData as aB, type RemoveOrganizationTeamMemberData as aC, type RemoveOrganizationTeamMemberOptions as aD, type RemoveOrganizationTeamOptions as aE, type RequestPasswordResetOptions as aF, type ResetPasswordOptions as aG, type RevokeSessionOptions as aH, type SendOtpData as aI, type SendTwoFactorOtpData as aJ, type SendTwoFactorOtpOptions as aK, type SendVerificationOtpOptions as aL, type SessionState as aM, type SessionStore as aN, type SetActiveOrganizationOptions as aO, type SetActiveTeamOptions as aP, type SignOutData as aQ, type SocialAccount as aR, type SocialAuthData as aS, type SocialIdTokenOptions as aT, type SocialSignInOptions as aU, type TokenClient as aV, type TwoFactorBackupCodesData as aW, type TwoFactorEnableData as aX, type TwoFactorRedirectData as aY, type TwoFactorStatusData as aZ, type TwoFactorVerifyData as a_, type OrganizationFilterOperator as aa, type OrganizationInvitation as ab, type OrganizationInvitationActionOptions as ac, type OrganizationInvitationDetails as ad, type OrganizationInvitationStatus as ae, type OrganizationMember as af, type OrganizationMemberUser as ag, type OrganizationMemberWithUser as ah, type OrganizationMembersData as ai, type OrganizationRoleSummary as aj, type OrganizationSelector as ak, type OrganizationTeam as al, type OrganizationTeamMember as am, type OrganizationUserInvitation as an, type PasskeyAuthData as ao, type PasskeySignInOptions as ap, type PasswordResetData as aq, type PhoneAuthUser as ar, type PhoneOtpStartData as as, type PhoneOtpStartOptions as at, type PhoneOtpVerifyData as au, type PhoneOtpVerifyOptions as av, type ProjectCapabilities as aw, type PublicConfig as ax, type RejectOrganizationInvitationData as ay, type RemoveOrganizationMemberData as az, type AcceptOrganizationInvitationData as b, type UpdateOrganizationMemberRoleOptions as b0, type UpdateOrganizationOptions as b1, type UpdateOrganizationTeamOptions as b2, type UpdatePasskeyData as b3, type UpdatePasskeyOptions as b4, type UpdateProfileOptions as b5, type UpdateUnsafeMetadataOptions as b6, type UserMetadata as b7, type UsernameSignInOptions as b8, type VerifyBackupCodeOptions as b9, type VerifyEmailOtpData as ba, type VerifyEmailOtpOptions as bb, type VerifyTotpOptions as bc, type VerifyTwoFactorOtpOptions as bd, type WaitlistJoinData as be, type WaitlistJoinOptions as bf, acceptConsent as bg, createAuthOwlClient as bh, createTokenClient as bi, getConsentStatus as bj, getPublicConfig as bk, resolveProjectCapabilities as bl, createAuthHttpClient as bm, type AuthHttpClient as bn, type AccountClient as c, type AccountSession as d, type AccountStatusData as e, type ActionFetchOptions as f, type AddOrganizationTeamMemberOptions as g, type AddPasskeyOptions as h, type AuthActionResult as i, type AuthClientError as j, type AuthErrorContext as k, type AuthOwlClient as l, type AuthOwlErrorCode as m, type AuthPasskey as n, type AuthRequestContext as o, type AuthResponseContext as p, type AuthSession as q, type AuthUser as r, type ChangePasswordData as s, type ChangePasswordOptions as t, type ConsentAcceptResult as u, type ConsentStatus as v, type CreateOrganizationOptions as w, type CreateOrganizationTeamOptions as x, type DeleteAccountOptions as y, type DeleteOrganizationOptions as z };
+export { type JsonPrimitive as $, type AkedlyShieldStartProof as A, type DeletePasskeyData as B, type ChangeEmailOptions as C, type DeleteAccountData as D, type DeletePasskeyOptions as E, type DisableTwoFactorOptions as F, type EmailAuthData as G, type EmailOtpAuthData as H, type EmailOtpSignInOptions as I, type EmailOtpType as J, type EmailSignInOptions as K, type EmailSignUpData as L, type EmailSignUpOptions as M, type EnableTwoFactorOptions as N, type EnvironmentType as O, type PhoneOtpChallengeData as P, type GenerateBackupCodesOptions as Q, type GetOrganizationInvitationOptions as R, type GetOrganizationOptions as S, type GetToken as T, type GetTokenOptions as U, INVITATION_CLAIM_MAX_AGE_MS as V, INVITATION_QUERY_PARAM as W, type InvitationClaim as X, type InvitationRecipientHint as Y, type InviteOrganizationMemberOptions as Z, type JsonObject as _, AUTH_CHALLENGE_HEADER as a, type TwoFactorEnableData as a$, type JsonValue as a0, type LeaveOrganizationOptions as a1, type LinkSocialData as a2, type LinkSocialOptions as a3, type ListOrganizationInvitationsOptions as a4, type ListOrganizationMembersOptions as a5, type ListOrganizationRolesOptions as a6, type ListOrganizationTeamMembersOptions as a7, type ListOrganizationTeamsOptions as a8, type MagicLinkData as a9, type ProjectCapabilities as aA, type PublicConfig as aB, type RejectOrganizationInvitationData as aC, type RemoveOrganizationMemberData as aD, type RemoveOrganizationMemberOptions as aE, type RemoveOrganizationTeamData as aF, type RemoveOrganizationTeamMemberData as aG, type RemoveOrganizationTeamMemberOptions as aH, type RemoveOrganizationTeamOptions as aI, type RequestPasswordResetOptions as aJ, type ResetPasswordOptions as aK, type RevokeSessionOptions as aL, type SendOtpData as aM, type SendTwoFactorOtpData as aN, type SendTwoFactorOtpOptions as aO, type SendVerificationOtpOptions as aP, type SessionState as aQ, type SessionStore as aR, type SetActiveOrganizationOptions as aS, type SetActiveTeamOptions as aT, type SignOutData as aU, type SocialAccount as aV, type SocialAuthData as aW, type SocialIdTokenOptions as aX, type SocialSignInOptions as aY, type TokenClient as aZ, type TwoFactorBackupCodesData as a_, type MagicLinkSignInOptions as aa, type Organization as ab, type OrganizationClient as ac, type OrganizationDetails as ad, type OrganizationFilterOperator as ae, type OrganizationInvitation as af, type OrganizationInvitationActionOptions as ag, type OrganizationInvitationDetails as ah, type OrganizationInvitationStatus as ai, type OrganizationMember as aj, type OrganizationMemberUser as ak, type OrganizationMemberWithUser as al, type OrganizationMembersData as am, type OrganizationRoleSummary as an, type OrganizationSelector as ao, type OrganizationTeam as ap, type OrganizationTeamMember as aq, type OrganizationUserInvitation as ar, type PasskeyAuthData as as, type PasskeySignInOptions as at, type PasswordResetData as au, type PhoneAuthUser as av, type PhoneOtpStartData as aw, type PhoneOtpStartOptions as ax, type PhoneOtpVerifyData as ay, type PhoneOtpVerifyOptions as az, type AcceptOrganizationInvitationData as b, type TwoFactorRedirectData as b0, type TwoFactorStatusData as b1, type TwoFactorVerifyData as b2, type UnlinkSocialOptions as b3, type UpdateOrganizationMemberRoleOptions as b4, type UpdateOrganizationOptions as b5, type UpdateOrganizationTeamOptions as b6, type UpdatePasskeyData as b7, type UpdatePasskeyOptions as b8, type UpdateProfileOptions as b9, type UpdateUnsafeMetadataOptions as ba, type UserMetadata as bb, type UsernameSignInOptions as bc, type VerifyBackupCodeOptions as bd, type VerifyEmailOtpData as be, type VerifyEmailOtpOptions as bf, type VerifyTotpOptions as bg, type VerifyTwoFactorOtpOptions as bh, type WaitlistJoinData as bi, type WaitlistJoinOptions as bj, acceptConsent as bk, captureInvitationClaim as bl, clearInvitationClaim as bm, createAuthOwlClient as bn, createTokenClient as bo, getConsentStatus as bp, getPublicConfig as bq, readInvitationClaim as br, resolveProjectCapabilities as bs, createAuthHttpClient as bt, type AuthHttpClient as bu, type AccountClient as c, type AccountSession as d, type AccountStatusData as e, type ActionFetchOptions as f, type AddOrganizationTeamMemberOptions as g, type AddPasskeyOptions as h, type AuthActionResult as i, type AuthClientError as j, type AuthErrorContext as k, type AuthOwlClient as l, type AuthOwlErrorCode as m, type AuthPasskey as n, type AuthRequestContext as o, type AuthResponseContext as p, type AuthSession as q, type AuthUser as r, type ChangePasswordData as s, type ChangePasswordOptions as t, type ConsentAcceptResult as u, type ConsentStatus as v, type CreateOrganizationOptions as w, type CreateOrganizationTeamOptions as x, type DeleteAccountOptions as y, type DeleteOrganizationOptions as z };

package/dist/{client-CEqVpSLs.d.cts → client-C1rudBpQ.d.cts}

@@ -1,5 +1,49 @@
 import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-B05mzhtA.cjs';
 
+/**
+ * The organization invitation an emailed link is asking this browser to accept.
+ *
+ * The link lands on the TENANT'S OWN page carrying `?authowl_invitation=<id>`,
+ * and the only route that can redeem it needs a session the visitor usually does
+ * not have yet. So the id has to survive an entire sign-up or sign-in - which
+ * means surviving that flow's redirects: the OAuth round trip, the email
+ * verification round trip (which can land on a different page entirely), the MFA
+ * hold, and whatever navigation the operator's own `redirectTo` performs. A query
+ * parameter survives none of those, so it is read once, moved into storage, and
+ * taken out of the URL.
+ *
+ * Best-effort storage, deliberately: a browser that refuses `localStorage`
+ * degrades to "this invitation is claimable until you navigate", which is worse
+ * than the ideal and much better than a sign-in that throws.
+ */
+declare const INVITATION_QUERY_PARAM = "authowl_invitation";
+/**
+ * The only hint value that exists. There is deliberately no `existing_user`:
+ * absence has to stay ambiguous across an existing account, an older AuthOwl,
+ * and an account created between the invite and the click - so it can never be
+ * read as proof that an address IS registered.
+ */
+type InvitationRecipientHint = 'new_user';
+type InvitationClaim = {
+    id: string;
+    /** Epoch milliseconds, for age display and for expiring a forgotten claim. */
+    capturedAt: number;
+};
+/** Claims older than this are dropped unread: a month-old link is not a pending intent. */
+declare const INVITATION_CLAIM_MAX_AGE_MS: number;
+/**
+ * Read `?authowl_invitation` once, stash it, and strip it from the URL.
+ *
+ * Namespaced and only ours - a bare `invitation` belongs to the tenant's app as
+ * much as to us, and rewriting their parameters is not ours to do. Returns the
+ * captured claim, or the one already stashed when there is no parameter, so a
+ * caller can render from a single call.
+ */
+declare function captureInvitationClaim(now?: number): InvitationClaim | null;
+/** The stashed claim, or null when there is none, it is unreadable, or it is stale. */
+declare function readInvitationClaim(now?: number): InvitationClaim | null;
+declare function clearInvitationClaim(): void;
+
 type EnvironmentType = 'development' | 'production';
 /**
  * The public, publishable-key-safe project config the SDK renders its sign-in
@@ -581,9 +625,17 @@ interface InviteOrganizationMemberOptions {
 interface ListOrganizationInvitationsOptions {
     organizationId?: string;
 }
+/** Options for resolving an invitation addressed to the signed-in session's own email. */
 interface GetOrganizationInvitationOptions {
+    /** Invitation id, resolved only when the signed-in session's own email is the recipient. */
     id: string;
 }
+interface GetInvitationRecipientHintOptions {
+    invitationId: string;
+}
+interface InvitationRecipientHintData {
+    recipientHint: InvitationRecipientHint | null;
+}
 interface OrganizationInvitationActionOptions {
     invitationId: string;
 }
@@ -624,6 +676,19 @@ interface OrganizationRoleSummary {
     role: string;
     /** The role's ⊆14 system-statement document (engine shape); advisory here. */
     permission?: unknown;
+    /**
+     * The custom `org:<feature>:<action>` permission keys this role grants.
+     *
+     * These cannot appear in `permission`: that is the engine's own document, and
+     * a custom id does not fit its shape - so a custom role reads as an empty
+     * document there while genuinely granting these. This is the field a role
+     * picker needs to show what a custom role does.
+     *
+     * Absent when the role grants none, and absent from any AuthOwl that does not
+     * report them, so an empty array is never confused with "not told". Advisory,
+     * like everything else on this type: the boundary is server-side.
+     */
+    customPermissionKeys?: string[];
 }
 interface OrganizationClient {
     /** @internal Subscribe to successful organization mutations. Used by framework bindings. */
@@ -664,7 +729,23 @@ interface OrganizationClient {
     inviteMember(params: InviteOrganizationMemberOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation>>;
     listInvitations(params?: ListOrganizationInvitationsOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation[]>>;
     listUserInvitations(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationUserInvitation[]>>;
+    /**
+     * Resolves an invitation only when its recipient is the signed-in session's own email.
+     *
+     * This recipient-only behaviour is a deliberate access control, not a bug. An inviter
+     * listing invitations they sent should call `listInvitations({ organizationId })`
+     * instead - `getInvitation` will not resolve one for them, because they are not its
+     * recipient.
+     *
+     * Depending on the project's email-verification policy, being the recipient may not be
+     * sufficient on its own.
+     */
     getInvitation(params: GetOrganizationInvitationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitationDetails>>;
+    /**
+     * Resolve the invitation's pre-authentication screen hint without exposing
+     * its recipient, organization, or existence. `null` means only "not told".
+     */
+    getInvitationRecipientHint(params: GetInvitationRecipientHintOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<InvitationRecipientHintData>>;
     acceptInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AcceptOrganizationInvitationData>>;
     rejectInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<RejectOrganizationInvitationData>>;
     cancelInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation | null>>;
@@ -1412,4 +1493,4 @@ interface AuthOwlClient {
  */
 declare function createAuthOwlClient(config: ResolvedAuthConfig): AuthOwlClient;
 
-export { type LinkSocialOptions as $, type AkedlyShieldStartProof as A, type DeletePasskeyData as B, type ChangeEmailOptions as C, type DeleteAccountData as D, type DeletePasskeyOptions as E, type DisableTwoFactorOptions as F, type EmailAuthData as G, type EmailOtpAuthData as H, type EmailOtpSignInOptions as I, type EmailOtpType as J, type EmailSignInOptions as K, type EmailSignUpData as L, type EmailSignUpOptions as M, type EnableTwoFactorOptions as N, type EnvironmentType as O, type PhoneOtpChallengeData as P, type GenerateBackupCodesOptions as Q, type GetOrganizationInvitationOptions as R, type GetOrganizationOptions as S, type GetToken as T, type GetTokenOptions as U, type InviteOrganizationMemberOptions as V, type JsonObject as W, type JsonPrimitive as X, type JsonValue as Y, type LeaveOrganizationOptions as Z, type LinkSocialData as _, AUTH_CHALLENGE_HEADER as a, type UnlinkSocialOptions as a$, type ListOrganizationInvitationsOptions as a0, type ListOrganizationMembersOptions as a1, type ListOrganizationRolesOptions as a2, type ListOrganizationTeamMembersOptions as a3, type ListOrganizationTeamsOptions as a4, type MagicLinkData as a5, type MagicLinkSignInOptions as a6, type Organization as a7, type OrganizationClient as a8, type OrganizationDetails as a9, type RemoveOrganizationMemberOptions as aA, type RemoveOrganizationTeamData as aB, type RemoveOrganizationTeamMemberData as aC, type RemoveOrganizationTeamMemberOptions as aD, type RemoveOrganizationTeamOptions as aE, type RequestPasswordResetOptions as aF, type ResetPasswordOptions as aG, type RevokeSessionOptions as aH, type SendOtpData as aI, type SendTwoFactorOtpData as aJ, type SendTwoFactorOtpOptions as aK, type SendVerificationOtpOptions as aL, type SessionState as aM, type SessionStore as aN, type SetActiveOrganizationOptions as aO, type SetActiveTeamOptions as aP, type SignOutData as aQ, type SocialAccount as aR, type SocialAuthData as aS, type SocialIdTokenOptions as aT, type SocialSignInOptions as aU, type TokenClient as aV, type TwoFactorBackupCodesData as aW, type TwoFactorEnableData as aX, type TwoFactorRedirectData as aY, type TwoFactorStatusData as aZ, type TwoFactorVerifyData as a_, type OrganizationFilterOperator as aa, type OrganizationInvitation as ab, type OrganizationInvitationActionOptions as ac, type OrganizationInvitationDetails as ad, type OrganizationInvitationStatus as ae, type OrganizationMember as af, type OrganizationMemberUser as ag, type OrganizationMemberWithUser as ah, type OrganizationMembersData as ai, type OrganizationRoleSummary as aj, type OrganizationSelector as ak, type OrganizationTeam as al, type OrganizationTeamMember as am, type OrganizationUserInvitation as an, type PasskeyAuthData as ao, type PasskeySignInOptions as ap, type PasswordResetData as aq, type PhoneAuthUser as ar, type PhoneOtpStartData as as, type PhoneOtpStartOptions as at, type PhoneOtpVerifyData as au, type PhoneOtpVerifyOptions as av, type ProjectCapabilities as aw, type PublicConfig as ax, type RejectOrganizationInvitationData as ay, type RemoveOrganizationMemberData as az, type AcceptOrganizationInvitationData as b, type UpdateOrganizationMemberRoleOptions as b0, type UpdateOrganizationOptions as b1, type UpdateOrganizationTeamOptions as b2, type UpdatePasskeyData as b3, type UpdatePasskeyOptions as b4, type UpdateProfileOptions as b5, type UpdateUnsafeMetadataOptions as b6, type UserMetadata as b7, type UsernameSignInOptions as b8, type VerifyBackupCodeOptions as b9, type VerifyEmailOtpData as ba, type VerifyEmailOtpOptions as bb, type VerifyTotpOptions as bc, type VerifyTwoFactorOtpOptions as bd, type WaitlistJoinData as be, type WaitlistJoinOptions as bf, acceptConsent as bg, createAuthOwlClient as bh, createTokenClient as bi, getConsentStatus as bj, getPublicConfig as bk, resolveProjectCapabilities as bl, createAuthHttpClient as bm, type AuthHttpClient as bn, type AccountClient as c, type AccountSession as d, type AccountStatusData as e, type ActionFetchOptions as f, type AddOrganizationTeamMemberOptions as g, type AddPasskeyOptions as h, type AuthActionResult as i, type AuthClientError as j, type AuthErrorContext as k, type AuthOwlClient as l, type AuthOwlErrorCode as m, type AuthPasskey as n, type AuthRequestContext as o, type AuthResponseContext as p, type AuthSession as q, type AuthUser as r, type ChangePasswordData as s, type ChangePasswordOptions as t, type ConsentAcceptResult as u, type ConsentStatus as v, type CreateOrganizationOptions as w, type CreateOrganizationTeamOptions as x, type DeleteAccountOptions as y, type DeleteOrganizationOptions as z };
+export { type JsonPrimitive as $, type AkedlyShieldStartProof as A, type DeletePasskeyData as B, type ChangeEmailOptions as C, type DeleteAccountData as D, type DeletePasskeyOptions as E, type DisableTwoFactorOptions as F, type EmailAuthData as G, type EmailOtpAuthData as H, type EmailOtpSignInOptions as I, type EmailOtpType as J, type EmailSignInOptions as K, type EmailSignUpData as L, type EmailSignUpOptions as M, type EnableTwoFactorOptions as N, type EnvironmentType as O, type PhoneOtpChallengeData as P, type GenerateBackupCodesOptions as Q, type GetOrganizationInvitationOptions as R, type GetOrganizationOptions as S, type GetToken as T, type GetTokenOptions as U, INVITATION_CLAIM_MAX_AGE_MS as V, INVITATION_QUERY_PARAM as W, type InvitationClaim as X, type InvitationRecipientHint as Y, type InviteOrganizationMemberOptions as Z, type JsonObject as _, AUTH_CHALLENGE_HEADER as a, type TwoFactorEnableData as a$, type JsonValue as a0, type LeaveOrganizationOptions as a1, type LinkSocialData as a2, type LinkSocialOptions as a3, type ListOrganizationInvitationsOptions as a4, type ListOrganizationMembersOptions as a5, type ListOrganizationRolesOptions as a6, type ListOrganizationTeamMembersOptions as a7, type ListOrganizationTeamsOptions as a8, type MagicLinkData as a9, type ProjectCapabilities as aA, type PublicConfig as aB, type RejectOrganizationInvitationData as aC, type RemoveOrganizationMemberData as aD, type RemoveOrganizationMemberOptions as aE, type RemoveOrganizationTeamData as aF, type RemoveOrganizationTeamMemberData as aG, type RemoveOrganizationTeamMemberOptions as aH, type RemoveOrganizationTeamOptions as aI, type RequestPasswordResetOptions as aJ, type ResetPasswordOptions as aK, type RevokeSessionOptions as aL, type SendOtpData as aM, type SendTwoFactorOtpData as aN, type SendTwoFactorOtpOptions as aO, type SendVerificationOtpOptions as aP, type SessionState as aQ, type SessionStore as aR, type SetActiveOrganizationOptions as aS, type SetActiveTeamOptions as aT, type SignOutData as aU, type SocialAccount as aV, type SocialAuthData as aW, type SocialIdTokenOptions as aX, type SocialSignInOptions as aY, type TokenClient as aZ, type TwoFactorBackupCodesData as a_, type MagicLinkSignInOptions as aa, type Organization as ab, type OrganizationClient as ac, type OrganizationDetails as ad, type OrganizationFilterOperator as ae, type OrganizationInvitation as af, type OrganizationInvitationActionOptions as ag, type OrganizationInvitationDetails as ah, type OrganizationInvitationStatus as ai, type OrganizationMember as aj, type OrganizationMemberUser as ak, type OrganizationMemberWithUser as al, type OrganizationMembersData as am, type OrganizationRoleSummary as an, type OrganizationSelector as ao, type OrganizationTeam as ap, type OrganizationTeamMember as aq, type OrganizationUserInvitation as ar, type PasskeyAuthData as as, type PasskeySignInOptions as at, type PasswordResetData as au, type PhoneAuthUser as av, type PhoneOtpStartData as aw, type PhoneOtpStartOptions as ax, type PhoneOtpVerifyData as ay, type PhoneOtpVerifyOptions as az, type AcceptOrganizationInvitationData as b, type TwoFactorRedirectData as b0, type TwoFactorStatusData as b1, type TwoFactorVerifyData as b2, type UnlinkSocialOptions as b3, type UpdateOrganizationMemberRoleOptions as b4, type UpdateOrganizationOptions as b5, type UpdateOrganizationTeamOptions as b6, type UpdatePasskeyData as b7, type UpdatePasskeyOptions as b8, type UpdateProfileOptions as b9, type UpdateUnsafeMetadataOptions as ba, type UserMetadata as bb, type UsernameSignInOptions as bc, type VerifyBackupCodeOptions as bd, type VerifyEmailOtpData as be, type VerifyEmailOtpOptions as bf, type VerifyTotpOptions as bg, type VerifyTwoFactorOtpOptions as bh, type WaitlistJoinData as bi, type WaitlistJoinOptions as bj, acceptConsent as bk, captureInvitationClaim as bl, clearInvitationClaim as bm, createAuthOwlClient as bn, createTokenClient as bo, getConsentStatus as bp, getPublicConfig as bq, readInvitationClaim as br, resolveProjectCapabilities as bs, createAuthHttpClient as bt, type AuthHttpClient as bu, type AccountClient as c, type AccountSession as d, type AccountStatusData as e, type ActionFetchOptions as f, type AddOrganizationTeamMemberOptions as g, type AddPasskeyOptions as h, type AuthActionResult as i, type AuthClientError as j, type AuthErrorContext as k, type AuthOwlClient as l, type AuthOwlErrorCode as m, type AuthPasskey as n, type AuthRequestContext as o, type AuthResponseContext as p, type AuthSession as q, type AuthUser as r, type ChangePasswordData as s, type ChangePasswordOptions as t, type ConsentAcceptResult as u, type ConsentStatus as v, type CreateOrganizationOptions as w, type CreateOrganizationTeamOptions as x, type DeleteAccountOptions as y, type DeleteOrganizationOptions as z };