@authowl/core 0.19.0 → 0.21.0

package/dist/chunk-5NL5GJW6.js

@@ -0,0 +1 @@
+function n(){let e=globalThis.crypto.getRandomValues(new Uint8Array(16));e[6]=e[6]&15|64,e[8]=e[8]&63|128;let t=Array.from(e,r=>r.toString(16).padStart(2,"0")).join("");return `${t.slice(0,8)}-${t.slice(8,12)}-${t.slice(12,16)}-${t.slice(16,20)}-${t.slice(20)}`}export{n as a};

package/dist/chunk-MW6RNUTR.js

@@ -0,0 +1 @@
+import {a as a$1}from'./chunk-5NL5GJW6.js';function a(i,c,r,t=a$1()){return {locale:c,correlationId:t,noticeVersionIds:i.notices.map(e=>e.noticeVersionId),consentDecisions:i.consentPurposes.flatMap(e=>{let n=i.notices.find(s=>s.purposeCodes.includes(e.code));return n?[{purposeCode:e.code,purposeVersionId:e.purposeVersionId,noticeVersionId:n.noticeVersionId,decision:r.has(e.code)?"granted":"refused",guardianRequired:false,guardianEvidenceId:null}]:[]})}}export{a};

package/dist/chunk-Y2VJN76I.js

@@ -0,0 +1 @@
+import {a}from'./chunk-5NL5GJW6.js';import {p,o,i,q as q$1,y,r,t,z,s,w,B as B$1,E as E$1,x,A,v,u}from'./chunk-V3MSLXXB.js';import {a as a$1}from'./chunk-T5SH3ZZP.js';function to(e){let t=e?.enabledMethods??["password"],n=t.includes("password"),i=t.includes("passkey"),o=e?.authentication,a=e?.mfa;return {emailSignUp:o?.email.signUp??t.some(p=>p==="password"||p==="magic_link"||p==="email_otp"),passwordSignUp:o?.password.signUp??n,phoneSignUp:o?.phone.signUp??t.includes("phone_otp"),passwordSignIn:o?.email.signIn.includes("password")??n,passwordMinLength:o?.password.minLength??8,passwordMaxLength:o?.password.maxLength??128,magicLinkSignIn:o?.email.signIn.includes("magic_link")??t.includes("magic_link"),emailOtpSignIn:o?.email.signIn.includes("email_otp")??t.includes("email_otp"),phoneSignIn:o?.phone.signIn??t.includes("phone_otp"),usernameSignIn:o?.username.signIn??false,collectUsername:o?.username.collectOnSignUp??false,passkeySignIn:o?.passkey.signIn??i,passkeyAdd:o?.passkey.add??i,firstLastName:e?.userModel?.firstLastName??false,emailChange:e===null?false:e.userModel?.emailChange??true,accountDeletion:e?.userModel?.accountDeletion??e?.accountDeletion??false,emailVerificationRequired:e?.emailVerification?.required??e?.requireEmailVerification??false,emailVerificationMethod:e?.emailVerification?.method??"link",totp:a?.totp??e?.twoFactor??false,mfaRequired:a?.required??e?.mfaRequired??false,backupCodes:a?.backupCodes??e?.twoFactor??false,legacyNameField:e?.authentication===void 0}}var he=class extends Error{status;requestId;constructor(t,n,i){super(`${t} request failed with status ${n.status}.`),this.name="AuthOwlHttpError",this.status=n.status,this.requestId=i;}};function oe(e,t,n={}){let i=new Headers(n.init?.headers);return i.set("x-publishable-key",e.publishableKey),p({fetchImpl:e.fetch,url:t,init:{...n.init,headers:i},allowHttpLoopback:e.decoded.env==="test",...n.timeoutMs===void 0?{}:{timeoutMs:n.timeoutMs},...n.maxResponseBytes===void 0?{}:{maxResponseBytes:n.maxResponseBytes},...n.decode===void 0?{}:{decode:n.decode}})}function Be(e,t){if(!e.response.ok)throw new he(t,e.response,e.requestId);return e.data}var L=new Map,Tn=/^[a-z]{2}$/;function ro(e,t){if(typeof window>"u")return ()=>{};if(t===null)return L.delete(e),()=>{};let n=t.trim().toLowerCase();if(!Tn.test(n))return ()=>{};let i=Symbol(e),o=L.get(e)??[];return o.push({token:i,locale:n}),L.set(e,o),()=>{let a=L.get(e);if(!a)return;let p=a.filter(m=>m.token!==i);p.length===0?L.delete(e):L.set(e,p);}}function je(e){return typeof window>"u"?null:L.get(e)?.at(-1)?.locale??null}var Pn="x-authowl-turnstile-token",Cn="x-authowl-locale",zn=1e4,Dn=32,xn=2e4;function q(e,t){return {post:(n,i,o,a)=>e.request(n,{method:"POST",body:i,fetchOptions:o,decode:a}),mutation:async(n,i)=>{let o=await n;return o.error===null&&(i===void 0||o.data!==null&&i(o.data))&&t(),o}}}function be(e,t=e.projectBaseURL){return {async request(n,i$1={}){let o$1=Un(t,n,i$1.query),a=i$1.method??(i$1.body===void 0?"GET":"POST"),p=new Headers(i$1.fetchOptions?.headers);i$1.fetchOptions?.authChallengeToken&&p.set(Pn,i$1.fetchOptions.authChallengeToken);let m=je(e.decoded.projectId);m&&p.set(Cn,m),i$1.body!==void 0&&p.set("content-type","application/json");let l={method:a,headers:p,credentials:i$1.credentials??"include",...i$1.body===void 0?{}:{body:JSON.stringify(i$1.body)}},h=Object.freeze({method:a,path:n});await i$1.fetchOptions?.onRequest?.(h);let r=Nn(a,i$1.fetchOptions),s;try{s=await En(e,o$1,{...l,signal:i$1.fetchOptions?.signal},r);}catch(b){let C=Je(b);return await i$1.fetchOptions?.onError?.(Ae(h,C,Ln(b))),{data:null,error:C}}let{response:f,requestId:y}=s,u=Hn(n,s.data),g=u;if(f.ok)try{g=Oe(u),i$1.decode&&(g=i$1.decode(g));}catch{let b=Je(new o("invalid_response",y));return await i$1.fetchOptions?.onError?.(Ae(h,b,"invalid_response")),{data:null,error:b}}let A=Object.freeze({...h,status:f.status,...y===void 0?{}:{requestId:y}});if(await i$1.fetchOptions?.onResponse?.(A),!f.ok){let b=Mn(f,u,y);return b.code===i&&e.session.tokens.dropChallenge(),await i$1.fetchOptions?.onError?.(Ae(h,b,"api")),{data:null,error:b}}return await i$1.fetchOptions?.onSuccess?.(A),{data:g,error:null}}}}async function En(e,t,n,i){let o$1=Date.now()+zn;for(let a=0;a<i;a+=1){let p=o$1-Date.now();if(p<=0)throw new o("timeout");try{let m=await oe(e,t,{init:n,timeoutMs:Math.max(1,Math.ceil(p))});if(m.response.status<500||a===i-1)return m}catch(m){if(a===i-1||!(m instanceof o)||m.kind!=="network")throw m}await Fn(50*2**a,n.signal,o$1);}throw new o("network")}function Nn(e,t){if(e!=="GET"||t?.authChallengeToken)return 1;let n=t?.retry;return typeof n!="number"||!Number.isFinite(n)?1:Math.min(Math.max(Math.trunc(n),0),3)+1}function Un(e,t,n){let i=new URL(`${e}${t.startsWith("/")?t:`/${t}`}`);for(let[o,a]of Object.entries(n??{}))a!==void 0&&i.searchParams.set(o,String(a));return i.toString()}function Mn(e,t,n){let i=G(t)?t:{},o=_n(i,e.headers);return {status:e.status,statusText:e.statusText,code:typeof i.code=="string"?i.code:void 0,...n===void 0?{}:{requestId:n},...typeof i.current_version=="number"?{currentVersion:i.current_version}:{},...o!==void 0?{retryAfterSeconds:o}:{},message:typeof i.message=="string"?i.message:typeof i.error=="string"?i.error:typeof i.detail=="string"?i.detail:e.statusText||"Request failed"}}function _n(e,t){let n=(typeof e.retryAfterSeconds=="number"&&Number.isFinite(e.retryAfterSeconds)?e.retryAfterSeconds:void 0)??Ge(t.get("retry-after"))??Ge(t.get("x-retry-after"));if(n!==void 0)return Math.min(Math.max(Math.trunc(n),1),86400)}function Ge(e){if(!e)return;let t=e.trim();if(!/^\d+$/.test(t))return;let n=Number(t);return Number.isFinite(n)?n:void 0}function Je(e){let t=e instanceof o?e.kind:"network";return {status:0,...{aborted:{statusText:"ABORTED",code:"REQUEST_ABORTED",message:"The request was cancelled."},timeout:{statusText:"TIMEOUT",code:"REQUEST_TIMEOUT",message:"The request timed out."},response_too_large:{statusText:"INVALID_RESPONSE",code:"RESPONSE_TOO_LARGE",message:"The service response was too large."},invalid_response:{statusText:"INVALID_RESPONSE",code:"INVALID_RESPONSE",message:"The service returned an invalid response."},network:{statusText:"FETCH_ERROR",code:"FETCH_ERROR",message:"Network request failed."}}[t],...e instanceof o&&e.requestId?{requestId:e.requestId}:{}}}function Ae(e,t,n){return Object.freeze({...e,status:t.status??0,...t.requestId===void 0?{}:{requestId:t.requestId},failure:n})}function Ln(e){return e instanceof o?e.kind:"network"}function Fn(e,t,n){return new Promise((i,o$1)=>{if(t?.aborted){o$1(new o("aborted"));return}let a=n-Date.now();if(a<=0){o$1(new o("timeout"));return}let p=Math.min(e,a),m=()=>{clearTimeout(l),o$1(new o("aborted"));},l=setTimeout(()=>{t?.removeEventListener("abort",m),Date.now()>=n?o$1(new o("timeout")):i();},p);t?.addEventListener("abort",m,{once:true}),t?.aborted&&m();})}function Oe(e,t="",n=0,i={nodes:0}){if(i.nodes+=1,n>Dn||i.nodes>xn)throw new Error("response traversal limit exceeded");if(typeof e=="string"&&/^(?:createdAt|updatedAt|expiresAt)$/.test(t)){let o=new Date(e);return Number.isNaN(o.getTime())?e:o}return Array.isArray(e)?e.map(o=>Oe(o,"",n+1,i)):G(e)?Object.fromEntries(Object.entries(e).map(([o,a])=>[o,qn(o)?a:Oe(a,o,n+1,i)])):e}function qn(e){return e==="metadata"||e==="public_metadata"||e==="unsafe_metadata"||e==="private_metadata"||e==="publicMetadata"||e==="unsafeMetadata"||e==="privateMetadata"}function Hn(e,t){if(e==="/list-sessions"&&Array.isArray(t))return t.map(o=>G(o)?ye(o):o);if(!G(t))return t;let i=e==="/change-password"||e==="/passkey/verify-authentication"||e==="/phone-otp/verify"||e==="/sign-up/email"||e.startsWith("/sign-in/")||e.startsWith("/two-factor/verify-")?ye(t):t;return e==="/sign-up/email"&&!("sessionCreated"in i)&&(i={...i,sessionCreated:typeof t.token=="string"&&t.token.length>0}),(e==="/get-session"||e==="/passkey/verify-authentication")&&G(i.session)&&(i={...i,session:ye(i.session)}),i}function ye(e){if(!Object.hasOwn(e,"token"))return e;let t={...e};return delete t.token,t}function G(e){return !!e&&typeof e=="object"&&!Array.isArray(e)}function We(e){return {listConsentPreferences:t=>e.request("/privacy/consent-decisions",{fetchOptions:t,decode:Vn}),recordConsent:(t,n)=>e.request("/privacy/consent-decisions",{method:"POST",body:{...t,correlationId:t.correlationId??a()},fetchOptions:n,decode:Bn}),listRightsRequests:t=>e.request("/privacy/rights",{fetchOptions:t,decode:jn}),createRightsRequest:(t,n)=>e.request("/privacy/rights",{method:"POST",body:t,fetchOptions:n,decode:Gn})}}function Vn(e){let t=q$1(e);return Array.isArray(t.preferences)||y(),{preferences:t.preferences.map(Kn)}}function Kn(e){let t=q$1(e);return {purposeId:r(t.purposeId),purposeVersionId:r(t.purposeVersionId),code:r(t.code),state:Jn(t.state,["granted","refused","withdrawn"]),updatedAt:re(t.updatedAt),decidedAt:re(t.decidedAt)}}function Bn(e){let t=q$1(e);return t.recorded!==true&&y(),{recorded:true,decision:J(t.decision,["granted","refused","withdrawn"]),decidedAt:ae(t.decidedAt)}}function jn(e){let t=q$1(e);return Array.isArray(t.requests)||y(),{requests:t.requests.map(Xe)}}function Gn(e){return {request:Xe(q$1(e).request)}}function Xe(e){let t=q$1(e);return {id:r(t.id),rightType:J(t.rightType,["access","correction","portability","erasure","restriction","objection","consent_withdrawal"]),state:J(t.state,["received","identity_pending","in_progress","restricted","completed","denied","withdrawn"]),locale:J(t.locale,["en","ar"]),receivedAt:ae(t.receivedAt),acknowledgedAt:re(t.acknowledgedAt),fulfilmentDeadline:ae(t.fulfilmentDeadline),completedAt:re(t.completedAt)}}function re(e){return e===null?null:ae(e)}function ae(e){if(e instanceof Date)return t(e);typeof e!="string"&&y();let t$1=new Date(e);return Number.isNaN(t$1.getTime())&&y(),t$1}function J(e,t){return (typeof e!="string"||!t.includes(e))&&y(),e}function Jn(e,t){return e===null?null:J(e,t)}function Ye({http:e,probe:t,tokens:n,channelName:i}){let o=new Set,a=null,p=null,m=null,l=null,h=null,r=null,s,f=O=>{g(O);};s={data:null,isPending:true,isRefetching:false,error:null,refetch:f};function y(O){s=O;for(let v of o)v();}async function u(O){return e.request("/get-session",{query:O?.query,decode:we})}function g(O){if(O?.query?.disableCookieCache===true)return b(O);if(l)return l;if(h)return h;let v=b(O).finally(()=>{h===v&&(h=null);});return h=v,v}function A(){if(l)return l;let O=b({query:{disableCookieCache:true}}).finally(()=>{l===O&&(l=null);});return l=O,O}async function b(O){m?.abort();let v=new AbortController;m=v,y({...s,isPending:s.data===null&&s.error===null,isRefetching:s.data!==null});let j=n.beginRead(),ee=await e.request("/get-session",{query:O?.query,fetchOptions:{signal:v.signal},decode:we});if(m===v&&(m=null,y({data:ee.data,error:ee.error,isPending:false,isRefetching:false,refetch:f}),ee.error===null)){if(ee.data===null){j.endIfDead();return}await C(j);}}async function C(O){if(n.needsProbe()){if(!O.carriedToken){O.recordCookieVerdict(true);return}return r||_e(O)}}function _e(O){let v=t.request("/get-session",{query:{disableCookieCache:true},decode:we}).then(j=>{r===v&&j.error===null&&O.recordCookieVerdict(j.data!==null);}).finally(()=>{r===v&&(r=null);});return r=v,v}function Le(){a?.postMessage({type:"session-changed"});}function Sn(){if(typeof window>"u"||p)return;let O=()=>{g();},v=()=>{document.visibilityState==="visible"&&g();};window.addEventListener("focus",O),document.addEventListener("visibilitychange",v),typeof BroadcastChannel<"u"&&(a=new BroadcastChannel(i),a.addEventListener("message",O)),p=()=>{window.removeEventListener("focus",O),document.removeEventListener("visibilitychange",v),a?.close(),a=null,p=null;};}function vn(O){return o.add(O),o.size===1&&(Sn(),g()),()=>{if(o.delete(O),o.size===0){let v=m;m=null,h=null,l=null,v?.abort(),p?.();}}}return n.measureWith(()=>{n.needsProbe()&&_e(n.beginRead());}),{store:{subscribe:vn,getSnapshot:()=>s,refresh:A},getSession:u,notifyMutation(){Le(),r&&r.catch(()=>{}).then(()=>{!n.needsProbe()&&n.hasToken()&&Le();}),o.size>0&&g({query:{disableCookieCache:true}});}}}function we(e){if(e===null)return null;let t=q$1(e);return (t.session===void 0||t.user===void 0)&&y(),{session:x(t.session),user:w(t.user)}}async function $e(e,t){return e.request("/user/metadata",{fetchOptions:t,decode:Ze})}async function Qe(e,t,n){return e.request("/user/metadata",{method:"PATCH",body:{expected_version:t.expectedVersion,unsafe_metadata:t.unsafeMetadata},fetchOptions:n,decode:Ze})}function Ze(e){let t=q$1(e),n=z(t.public_metadata),i=z(t.unsafe_metadata);if(!Number.isSafeInteger(t.metadata_version)||t.metadata_version<0)throw new TypeError("Invalid AuthOwl metadata response");return {publicMetadata:n,unsafeMetadata:i,metadataVersion:t.metadata_version}}function tt(e,t){let{post:n,mutation:i}=q(e,t);return {getMetadata:o=>$e(e,o),updateUnsafeMetadata:(o,a)=>Qe(e,o,a),updateProfile:(o,a)=>i(n("/update-user",o,a,W)),changeEmail:(o,a)=>i(n("/change-email",o,a,W)),changePassword:(o,a)=>i(n("/change-password",o,a,Wn)),listSessions:o=>e.request("/list-sessions",{fetchOptions:o,decode:Xn}),revokeSession:({sessionId:o},a)=>i(n("/revoke-session",{sessionId:o},a,W)),revokeOtherSessions:o=>i(n("/revoke-other-sessions",{},o,W)),listSocialAccounts:async o=>{let a=await e.request("/list-accounts",{fetchOptions:o,decode:Yn});if(!a.data)return {data:null,error:a.error};let p=a.data.length>1;return {...a,data:a.data.filter(m=>m.providerId!=="credential").map(m=>({...m,canUnlink:p}))}},linkSocial:(o,a)=>n("/link-social",o,a,$n),unlinkSocial:(o,a)=>i(n("/unlink-account",o,a,W)),delete:(o={},a)=>i(n("/delete-user",o,a,Qn))}}function W(e){let t=q$1(e);return {status:s(t.status)}}function Wn(e){let t=q$1(e);return {user:w(t.user)}}function Xn(e){return Array.isArray(e)||y(),e.map(t$1=>{let n=q$1(t$1);return {id:r(n.id),userId:r(n.userId),createdAt:t(n.createdAt),updatedAt:t(n.updatedAt),expiresAt:t(n.expiresAt),...et("ipAddress",v(n,"ipAddress")),...et("userAgent",v(n,"userAgent"))}})}function Yn(e){return Array.isArray(e)||y(),e.map(t$1=>{let n=q$1(t$1);return {id:r(n.id),userId:r(n.userId),providerId:r(n.providerId),accountId:r(n.accountId),scopes:u(n.scopes),createdAt:t(n.createdAt),updatedAt:t(n.updatedAt)}})}function $n(e){let t=q$1(e);return {url:r(t.url),redirect:s(t.redirect)}}function Qn(e){let t=q$1(e);return {success:s(t.success),message:r(t.message)}}function et(e,t){return t===void 0?{}:{[e]:t}}var Zn=new Set(["pending","accepted","rejected","canceled"]),ke=1e4;function nt(e){let t=q$1(e);return t.recipientHint!==null&&t.recipientHint!=="new_user"&&y(),{recipientHint:t.recipientHint}}function H(e,t$1,n){let i=q$1(e),o={id:k(i.id),name:k(i.name),slug:k(i.slug),createdAt:t(i.createdAt),...X("logo",v(i,"logo")),...X("metadata",i.metadata===void 0?void 0:A(i.metadata))};return E(o.id,t$1),E(o.slug,n),o}function it(e){return U(e,H)}function Re(e,t,n){return e===null?null:(t===null&&y(),H(e,t,n))}function ot(e,t,n){if(e===null)return null;let i=q$1(e),o=H(i,t,n);return {...o,members:U(i.members,a=>ht(a,o.id)),invitations:U(i.invitations,a=>M(a,void 0,o.id))}}function Ie(e,t,n=false){let i=U(e,o=>Y(o));return n||Q(i.map(o=>o.organizationId),t),i}function rt(e,t){let n=U(e,i=>Se(i));return Q(n.map(i=>i.teamId),t),n}function Se(e,t$1,n){let i=q$1(e),o={id:k(i.id),teamId:k(i.teamId),userId:k(i.userId),createdAt:t(i.createdAt)};return E(o.teamId,t$1),E(o.userId,n),o}function at(e,t,n){return e===null?null:(t===null&&y(),Y(e,t,n))}function st(e,t){let n=q$1(e);return (!Number.isSafeInteger(n.total)||n.total<0)&&y(),{members:ei(n.members,t),total:n.total}}function M(e,t$1,n){let i=q$1(e),o=k(i.status);Zn.has(o)||y();let a={id:k(i.id),organizationId:k(i.organizationId),email:$(i.email),role:k(i.role),status:o,inviterId:k(i.inviterId),expiresAt:t(i.expiresAt),createdAt:t(i.createdAt)};return E(a.id,t$1),E(a.organizationId,n),a}function ut(e,t){let n=U(e,i=>M(i));return Q(n.map(i=>i.organizationId),t),n}function ct(e){return U(e,t=>{let n=q$1(t);return {...M(n),organizationName:$(n.organizationName)}})}function dt(e,t){let n=q$1(e);return {...M(n,t),organizationName:k(n.organizationName),organizationSlug:k(n.organizationSlug),inviterEmail:At(n.inviterEmail)}}function lt(e,t){let n=q$1(e),i=M(n.invitation,t);return {invitation:i,member:V(n.member,void 0,i.organizationId)}}function pt(e,t){let n=q$1(e);return n.member!==null&&y(),{invitation:n.invitation===null?null:M(n.invitation,t),member:null}}function gt(e,t){return e===null?null:M(e,t)}function ft(e,t,n){let i=q$1(e);return {member:V(i.member,n,t)}}function V(e,t$1,n){let i=q$1(e),o={id:k(i.id),organizationId:k(i.organizationId),userId:k(i.userId),role:k(i.role),createdAt:t(i.createdAt),...i.user===void 0?{}:{user:yt(i.user)}};return E(o.id,t$1),E(o.organizationId,n),o}function mt(e,t){let n=U(e,i=>{let o=q$1(i);return {organizationId:k(o.organizationId),data:{role:k(o.role),...X("permission",o.permission===void 0?void 0:ti(o.permission)),...X("customPermissionKeys",o.customPermissionKeys===void 0?void 0:u(o.customPermissionKeys))}}});return Q(n.map(i=>i.organizationId),t),n.map(i=>i.data)}function Y(e,t$1,n){let i=q$1(e),o=i.updatedAt,a={id:k(i.id),name:$(i.name),organizationId:k(i.organizationId),createdAt:t(i.createdAt),...o===void 0?{}:{updatedAt:t(o)}};return E(a.id,t$1),E(a.organizationId,n),a}function ve(e){let t=q$1(e);return {message:$(t.message)}}function ht(e,t){let n=q$1(e);return {...V(n,void 0,t),user:yt(n.user)}}function ei(e,t){let n=U(e,i=>ht(i));return Q(n.map(i=>i.organizationId),t),n}function ti(e){let t=q$1(e),n={};for(let[i,o]of Object.entries(t))(i==="__proto__"||i==="constructor"||i==="prototype"||i.length===0||i.length>ke||!Array.isArray(o))&&y(),n[i]=o.map(a=>k(a));return n}function k(e){let t=r(e);return (t.length===0||t.length>ke)&&y(),t}function $(e){if(e==null)return "";let t=r(e);return t.length>ke&&y(),t}function At(e){return e===null?null:k(e)}function E(e,t){t!==void 0&&e!==t&&y();}function Q(e,t){let n=t??e[0];n!==void 0&&e.some(i=>i!==n)&&y();}function yt(e){let t=q$1(e);return {id:k(t.id),name:$(t.name),email:At(t.email),...X("image",v(t,"image"))}}function U(e,t){return Array.isArray(e)||y(),e.map(n=>t(n))}function X(e,t){return t===void 0?{}:{[e]:t}}function Ot(e,t,n=()=>null){let{post:i,mutation:o}=q(e,t),a=new Set,p=()=>{for(let r of a)try{r();}catch{}},m=new Map,l=(r,s,f,y)=>{if(f)return e.request(r,{query:s,fetchOptions:f,decode:y});let u=`${r}\0${JSON.stringify(s??null)}`,g=m.get(u);if(g)return g;let A=e.request(r,{query:s,decode:y}).finally(()=>{m.delete(u);});return m.set(u,A),A},h=async r=>{let s=await o(r).finally(()=>m.clear());return s.error===null&&p(),s};return {subscribe(r){return a.add(r),()=>a.delete(r)},create:(r,s)=>h(i("/organization/create",r,s,H)),list:r=>l("/organization/list",void 0,r,it),get:(r={},s)=>l("/organization/get-full-organization",{organizationId:r.organizationId,organizationSlug:r.organizationSlug,membersLimit:r.membersLimit},s,f=>ot(f,r.organizationId,r.organizationSlug)),setActive:(r,s)=>h(i("/organization/set-active",r,s,f=>Re(f,r.organizationId,r.organizationSlug))),createTeam:(r,s)=>h(i("/organization/create-team",r,s,f=>Y(f,void 0,r.organizationId))),listTeams:(r={},s)=>l("/organization/list-teams",{organizationId:r.organizationId},s,f=>Ie(f,r.organizationId)),updateTeam:(r,s)=>h(i("/organization/update-team",r,s,f=>Y(f,r.teamId,r.data.organizationId))),removeTeam:(r,s)=>h(i("/organization/remove-team",r,s,ve)),listUserTeams:r=>l("/organization/list-user-teams",void 0,r,s=>Ie(s,void 0,true)),listTeamMembers:(r={},s)=>l("/organization/list-team-members",{teamId:r.teamId},s,f=>rt(f,r.teamId)),addTeamMember:(r,s)=>h(i("/organization/add-team-member",r,s,f=>Se(f,r.teamId,r.userId))),removeTeamMember:(r,s)=>h(i("/organization/remove-team-member",r,s,ve)),setActiveTeam:(r,s)=>h(i("/organization/set-active-team",r,s,f=>at(f,r.teamId))),update:(r,s)=>h(i("/organization/update",r,s,f=>Re(f,r.organizationId))),delete:(r,s)=>h(i("/organization/delete",r,s,f=>H(f,r.organizationId))),listMembers:(r={},s)=>l("/organization/list-members",{organizationId:r.organizationId,organizationSlug:r.organizationSlug,limit:r.limit,offset:r.offset,sortBy:r.sortBy,sortDirection:r.sortDirection,filterField:r.filterField,filterValue:r.filterValue,filterOperator:r.filterOperator},s,f=>st(f,r.organizationId)),inviteMember:(r,s)=>h(i("/organization/invite-member",r,s,f=>M(f,void 0,r.organizationId))),listInvitations:(r={},s)=>l("/organization/list-invitations",{organizationId:r.organizationId},s,f=>ut(f,r.organizationId)),listUserInvitations:r=>l("/organization/list-user-invitations",void 0,r,ct),getInvitation:(r,s)=>l("/organization/get-invitation",{id:r.id},s,f=>dt(f,r.id)),getInvitationRecipientHint:(r,s)=>l("/organization/invitation-recipient-hint",{invitationId:r.invitationId},s,nt),acceptInvitation:(r,s)=>h(i("/organization/accept-invitation",r,s,f=>lt(f,r.invitationId))),rejectInvitation:(r,s)=>h(i("/organization/reject-invitation",r,s,f=>pt(f,r.invitationId))),cancelInvitation:(r,s)=>h(i("/organization/cancel-invitation",r,s,f=>gt(f,r.invitationId))),removeMember:(r,s)=>h(i("/organization/remove-member",r,s,f=>ft(f,r.organizationId,r.memberIdOrEmail.includes("@")?void 0:r.memberIdOrEmail))),updateMemberRole:(r,s)=>h(i("/organization/update-member-role",r,s,f=>V(f,r.memberId,r.organizationId))),leave:(r,s)=>h(i("/organization/leave",r,s,f=>V(f,void 0,r.organizationId))),listRoles:(r={},s)=>l("/organization/list-roles",{organizationId:r.organizationId},s,f=>mt(f,r.organizationId)),has:r=>E$1(n(),r),hasPermission:r=>B$1(n(),r.permission)}}var bt=4096,ni=4096,ii=100,oi=256,ri=16,ai=64,si=12;function Pe(e){let t=q$1(e);return t.twoFactorRedirect===true?((t.user!==void 0||t.redirect!==void 0||t.url!==void 0)&&y(),{twoFactorRedirect:true,...t.twoFactorMethods===void 0?{}:{twoFactorMethods:Lt(t.twoFactorMethods,ri,ai)}}):(t.twoFactorRedirect!==void 0&&y(),{redirect:s(t.redirect),...pi(t,"url"),user:w(t.user)})}function wt(e){let t=q$1(e);return {user:w(t.user)}}function kt(e){let t=q$1(e);return {sessionCreated:s(t.sessionCreated),user:w(t.user)}}function Rt(e,t){let n=q$1(e),i=s(n.redirect);n.user===null&&y();let o=n.user!==void 0&&n.user!==null,a=n.url!==void 0&&n.url!==null;return i?((o||!a)&&y(),{redirect:true,url:Te(n.url,t)}):(o===a&&y(),o?{redirect:false,user:w(n.user)}:{redirect:false,url:Te(n.url,t)})}function It(e,t){let n=q$1(e);return (n.redirect!==true||n.user!==void 0)&&y(),{redirect:true,url:Te(n.url,t)}}function St(e){return {status:s(q$1(e).status)}}function vt(e){return {success:s(q$1(e).success)}}function Tt(e){return q$1(e).status!=="pending"&&y(),{status:"pending"}}function Pt(e){let t=q$1(e);if(t.kind==="authowl_turnstile")return {kind:"authowl_turnstile"};t.kind!=="akedly_shield_v1_2"&&y();let n=q$1(t.turnstile),i=n.siteKey===null?null:r(n.siteKey);return {kind:"akedly_shield_v1_2",connectionId:r(t.connectionId),challenge:r(t.challenge),difficulty:ui(t.difficulty),challengeToken:r(t.challengeToken),challengeRequired:s(t.challengeRequired),turnstile:{required:s(n.required),siteKey:i}}}function ui(e){return (!Number.isSafeInteger(e)||Number(e)<0||Number(e)>si)&&y(),Number(e)}function Ct(e){let t=q$1(e);return (t.status!==true||t.sessionCreated!==true)&&y(),{status:true,sessionCreated:true,user:ci(t.user)}}function Ce(e){return {status:s(q$1(e).status)}}function zt(e){return {status:s(q$1(e).status)}}function Dt(e){let t=q$1(e);return {status:s(t.status),user:w(t.user)}}function xt(e){return {success:s(q$1(e).success)}}function Et(e){let t=q$1(e);return {totpURI:li(t.totpURI),backupCodes:_t(t.backupCodes)}}function Nt(e){return {status:s(q$1(e).status)}}function se(e){return q$1(e).status!==true&&y(),{status:true}}function Ut(e){return {status:s(q$1(e).status)}}function Mt(e){let t=q$1(e);return t.status!==void 0&&t.status!==true&&y(),{backupCodes:_t(t.backupCodes)}}function ci(e){let t$1=q$1(e);return {id:K(t$1.id,512),...gi(t$1,"name",1024),phoneNumber:K(t$1.phoneNumber,64),phoneNumberVerified:s(t$1.phoneNumberVerified),...t$1.createdAt===void 0?{}:{createdAt:t(t$1.createdAt)},...t$1.updatedAt===void 0?{}:{updatedAt:t(t$1.updatedAt)}}}function Te(e,t){let n=K(e,bt);/[\u0000-\u0020\u007f]/u.test(n)&&y();let i;try{i=new URL(n);}catch{return y()}return (i.username||i.password)&&y(),i.protocol==="https:"||t&&i.protocol==="http:"&&di(i.hostname)?i.href:y()}function di(e){let t=e.toLowerCase();return t==="localhost"||t==="127.0.0.1"||t==="[::1]"}function li(e){let t=K(e,ni),n;try{n=new URL(t);}catch{return y()}let i=n.searchParams.get("secret");return (n.protocol!=="otpauth:"||n.hostname.toLowerCase()!=="totp"||n.username||n.password||n.hash||i===null||i.length===0||i.length>512||/\s/u.test(i))&&y(),t}function _t(e){return Lt(e,ii,oi)}function Lt(e,t,n){(!Array.isArray(e)||e.length===0||e.length>t)&&y();let i=e.map(o=>K(o,n));return i.some(o=>o.trim().length===0)&&y(),new Set(i).size!==i.length&&y(),i}function K(e,t){let n=r(e);return (n.length===0||n.length>t)&&y(),n}function pi(e,t){let n=e[t];return n==null?{}:{[t]:K(n,bt)}}function gi(e,t,n){let i=v(e,t);return i===void 0?{}:(i!==null&&i.length>n&&y(),{[t]:i})}var Ft=new Set([1564,8206,8207,8234,8235,8236,8237,8238,8294,8295,8296,8297]),ue=new Set([9,10,11,12,13,32,133,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288,65279]);function ce(e){if(e===void 0)return {valid:true,value:void 0};for(let n of e){let i=n.codePointAt(0);if(i===void 0||Ht(n,i)||qt(i)||Ft.has(i))return {valid:false}}let t=fi(e);return ze(t)?{valid:true,value:t}:{valid:false}}function ze(e){let t=0,n,i;for(let o of e){if(t+=1,t>256)return  false;let a=o.codePointAt(0);if(a===void 0||Ht(o,a)||qt(a)||Ft.has(a))return  false;n??=a,i=a;}return t>0&&n!==void 0&&i!==void 0&&!ue.has(n)&&!ue.has(i)}function de(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_PASSKEY_NAME",message:"Passkey names must contain 1 to 256 safe Unicode characters."}}}function fi(e){let t=0,n=e.length;for(;t<n;){let i=e.codePointAt(t);if(i===void 0||!ue.has(i))break;t+=i>65535?2:1;}for(;n>t;){let i=e.codePointAt(n-1);if(i===void 0)break;let a=i>=56320&&i<=57343?n-2:n-1,p=e.codePointAt(a);if(p===void 0||!ue.has(p))break;n=a;}return e.slice(t,n)}function qt(e){return e>=0&&e<=31||e>=127&&e<=159}function Ht(e,t){return e.length===1&&t>=55296&&t<=57343}var Bt=12,jt=5e3,mi=8,hi=1e3,Ai=16,Vt=512,Gt=100,Jt=8192,yi=32768,De=1024,Kt=256,Ee=64,Oi=6e5,bi=/^[A-Za-z0-9_-]+$/u,wi=/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u,ki=/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u,Ri=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/u,Ii=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu,Wt=new Set(["discouraged","preferred","required"]),Si=new Set(["singleDevice","multiDevice"]),Xt=new Set(["ble","cable","hybrid","internal","nfc","smart-card","usb"]),Yt=new Set(["hybrid","security-key","client-device"]),vi=new Set(["none","indirect","direct","enterprise"]),Ti=new Set(["fido-u2f","packed","android-safetynet","android-key","tpm","apple","none"]),Pi=new Set(["platform","cross-platform"]),Ci=new Set(["discouraged","preferred","required"]),zi=new Set([-8,-7,-257]);function $t(e){let t=z(e,Bt,jt);return {challenge:un(t.challenge),...T("timeout",an(t.timeout)),...T("rpId",cn(t.rpId)),...T("allowCredentials",rn(t.allowCredentials)),...T("userVerification",Z(t.userVerification,Wt)),...T("hints",le(t.hints,Yt)),...T("extensions",sn(t.extensions))}}function Qt(e){let t=z(e,Bt,jt);return {challenge:un(t.challenge),rp:Di(t.rp),user:xi(t.user),pubKeyCredParams:Ei(t.pubKeyCredParams),...T("timeout",an(t.timeout)),...T("excludeCredentials",rn(t.excludeCredentials)),...T("authenticatorSelection",Ni(t.authenticatorSelection)),...T("attestation",Z(t.attestation,vi)),...T("attestationFormats",le(t.attestationFormats,Ti)),...T("hints",le(t.hints,Yt)),...T("extensions",sn(t.extensions))}}function Zt(e){let t=q$1(e),n=x(t.session),i=w(t.user);return n.userId!==i.id&&y(),{session:n,user:i}}function Ne(e){let t$1=q$1(e),n=t$1.counter;(!Number.isSafeInteger(n)||n<0)&&y();let i=Ue(t$1.deviceType,Si),o=s(t$1.backedUp);return o&&i!=="multiDevice"&&y(),{id:B(t$1.id,Kt),..._i(t$1),publicKey:Ui(t$1.publicKey,yi),userId:B(t$1.userId,Kt),credentialID:ge(t$1.credentialID,Jt),counter:n,deviceType:i,backedUp:o,...Li(t$1),createdAt:t(t$1.createdAt),...Fi(t$1)}}function en(e,t,n){let i=Ne(e);return (i.credentialID!==t||(n===void 0?i.name!==void 0&&i.name!==null:i.name!==n))&&y(),i}function tn(e){(!Array.isArray(e)||e.length>Gt)&&y();let t=e.map(Ne);return pe(t.map(n=>n.id)),pe(t.map(n=>n.credentialID)),t.length>1&&t.some(n=>n.userId!==t[0]?.userId)&&y(),t}function nn(e,t,n){let i=q$1(e),o=Ne(i.passkey);return (o.id!==t||o.name!==n)&&y(),{passkey:o}}function on(e){return q$1(e).status!==true&&y(),{status:true}}function Di(e){let t=q$1(e);return {name:xe(t.name,De),...T("id",cn(t.id))}}function xi(e){let t=q$1(e);return {id:ge(t.id,128,1,64),name:xe(t.name,De),displayName:xe(t.displayName,De)}}function Ei(e){(!Array.isArray(e)||e.length===0||e.length>Ee)&&y();let t=e.map(n=>{let i=q$1(n);return (i.type!=="public-key"||!Number.isSafeInteger(i.alg)||!zi.has(i.alg))&&y(),{type:"public-key",alg:i.alg}});return qi(t.map(n=>n.alg)),t}function rn(e){if(e===void 0)return;(!Array.isArray(e)||e.length>Gt)&&y();let t=e.map(n=>{let i=q$1(n);return i.type!=="public-key"&&y(),{type:"public-key",id:ge(i.id,Jt),...T("transports",le(i.transports,Xt))}});return pe(t.map(n=>n.id)),t}function Ni(e){if(e===void 0)return;let t=q$1(e);t.requireResidentKey!==void 0&&typeof t.requireResidentKey!="boolean"&&y();let n=Z(t.residentKey,Ci);return t.requireResidentKey!==void 0&&n!==void 0&&t.requireResidentKey!==(n==="required")&&y(),{...T("authenticatorAttachment",Z(t.authenticatorAttachment,Pi)),...T("residentKey",n),...T("requireResidentKey",t.requireResidentKey),...T("userVerification",Z(t.userVerification,Wt))}}function an(e){return e!==void 0&&(typeof e!="number"||!Number.isFinite(e)||e<0||e>Oi)&&y(),e}function sn(e){return e===void 0?void 0:z(e,mi,hi)}function le(e,t){if(e===void 0)return;(!Array.isArray(e)||e.length>Ee)&&y();let n=e.map(i=>Ue(i,t));return pe(n),n}function Z(e,t){if(e!==void 0)return Ue(e,t)}function un(e){return ge(e,Math.ceil(Vt*4/3),Ai,Vt)}function ge(e,t,n=1,i=Number.POSITIVE_INFINITY){let o=B(e,t),a=o.length%4,p=Mi(o.at(-1)??""),m=Math.floor(o.length*3/4);return (!bi.test(o)||a===1||a===2&&(p&15)!==0||a===3&&(p&3)!==0||m<n||m>i)&&y(),o}function B(e,t){let n=r(e);return (n.length===0||n.length>t)&&y(),n}function xe(e,t){let n=B(e,t);return ki.test(n)&&y(),n}function cn(e){if(e===void 0)return;let t=B(e,253);return t!=="localhost"&&(t.endsWith(".")||!t.includes(".")||t.split(".").some(n=>!Ri.test(n)))&&y(),t}function Ui(e,t){let n=B(e,t),i=n.endsWith("=="),o=!i&&n.endsWith("="),a=n.at(i?-3:o?-2:-1)??"",p=dn(a);return (n.length%4!==0||!wi.test(n)||i&&(p&15)!==0||o&&(p&3)!==0)&&y(),n}function Mi(e){return dn(e,true)}function dn(e,t=false){return (t?"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/").indexOf(e)}function _i(e){let t=v(e,"name");return t===void 0?{}:(t!==null&&!ze(t)&&y(),{name:t})}function Li(e){let t=v(e,"transports");if(t==null||t==="")return t===void 0?{}:{transports:t};let n=t.split(",");return (n.length>Ee||n.some(i=>!Xt.has(i))||new Set(n).size!==n.length)&&y(),{transports:t}}function Fi(e){let t=v(e,"aaguid");return t==null?t===void 0?{}:{aaguid:null}:(Ii.test(t)||y(),{aaguid:t})}function Ue(e,t){let n=r(e);return t.has(n)||y(),n}function T(e,t){return t===void 0?{}:{[e]:t}}function pe(e){new Set(e).size!==e.length&&y();}function qi(e){new Set(e).size!==e.length&&y();}function Hi(e,t){if(!t)return e;let n=t.catch(()=>{});return n.then(()=>{n=null;}),{async request(i,o){return n&&await n,e.request(i,o)}}}var ln=new Map;function Vi(e,t,n){let i=ln.get(n);if(!i){let o=new URLSearchParams(window.location.hash.slice(1)).get("authowl_code");if(!o)return;i=import('./session-handoff-6FBH3GFJ.js').then(a=>a.completeCrossSiteSignIn(e,t,o)),ln.set(n,i);}return i}function pn(e){return !a$1()||e.idToken||e.disableRedirect?"legacy":"first-party"}function Ki(e,t=()=>{},n=Gi){let i=be(e),o=e.session.tokens,a$2=a$1()?Vi(i,o,e.decoded.projectId):void 0,p=Hi(i,a$2),m=Ye({http:p,probe:be({...e,fetch:e.session.probe}),tokens:o,channelName:`authowl:${e.decoded.projectId}`}),l=n(p,m.notifyMutation),h=()=>{m.notifyMutation(),t();},{post:r,mutation:s}=q(p,h),f=e.decoded.env==="test",y=u=>{o.beginSession({remember:u?.rememberMe!==false});};return {sessionStore:m.store,getSession:m.getSession,account:tt(p,h),organization:Ot(p,h,()=>m.store.getSnapshot().data?.session.membership??null),privacy:We(p),signIn:{email:(u,g)=>(y(u),s(r("/sign-in/email",u,g,Pe),A=>!("twoFactorRedirect"in A))),username:(u,g)=>(y(u),s(r("/sign-in/username",u,g,Pe),A=>!("twoFactorRedirect"in A))),social:async(u,g)=>{if(y(),pn(u)==="first-party"){let{beginCrossSiteSignIn:b}=await import('./session-handoff-6FBH3GFJ.js'),C=await b(e,{kind:"social",provider:u.provider,callbackURL:u.callbackURL,errorCallbackURL:u.errorCallbackURL,newUserCallbackURL:u.newUserCallbackURL,scopes:u.scopes,loginHint:u.loginHint,requestSignUp:u.requestSignUp});if(C)return window.location.assign(C),{data:{redirect:true,url:C},error:null}}let A=await s(r("/sign-in/social",u,g,b=>Rt(b,f)),b=>"user"in b);return A.error!==null||A.data===null||"url"in A.data&&A.data.redirect&&!u.disableRedirect&&typeof window<"u"&&window.location.assign(A.data.url),A},sso:async(u,g)=>{if(pn(u)==="first-party"){let{beginCrossSiteSignIn:b}=await import('./session-handoff-6FBH3GFJ.js'),C=await b(e,{kind:"sso",email:u.email,providerId:u.providerId,domain:u.domain,organizationSlug:u.organizationSlug,callbackURL:u.callbackURL,errorCallbackURL:u.errorCallbackURL,newUserCallbackURL:u.newUserCallbackURL});if(C)return window.location.assign(C),{data:{url:C,redirect:true},error:null}}let A=await r("/sign-in/sso",u,g,b=>It(b,f));return A.error!==null||A.data===null||typeof window<"u"&&window.location.assign(A.data.url),A},magicLink:(u,g)=>r("/sign-in/magic-link",u,g,St),emailOtp:(u,g)=>(y(),s(r("/sign-in/email-otp",u,g,wt))),passkey:(u,g)=>(y(),l.signIn(u,g))},signUp:{email:(u,g)=>(y(),s(r("/sign-up/email",u,g,kt),A=>A.sessionCreated))},emailOtp:{sendVerificationOtp:(u,g)=>r("/email-otp/send-verification-otp",u,g,vt),verifyEmail:(u,g)=>(y(),s(r("/email-otp/verify-email",u,g,Dt)))},phoneOtp:{prepare:u=>r("/phone-otp/challenge",{},u,Pt),start:(u,g)=>r("/phone-otp/start",{...u,idempotencyKey:u.idempotencyKey??a()},g,Tt),verify:(u,g)=>(y(),s(r("/phone-otp/verify",u,g,Ct)))},requestPasswordReset:(u,g)=>r("/request-password-reset",u,g,Ce),resetPassword:(u,g)=>r("/reset-password",u,g,Ce),sendVerificationEmail:(u,g)=>r("/send-verification-email",u,g,zt),passkey:{addPasskey:(u,g)=>l.add(u,g),listUserPasskeys:()=>p.request("/passkey/list-user-passkeys",{decode:tn}),updatePasskey:async(u,g)=>{let A=ce(u.name);if(!A.valid||A.value===void 0)return de();let b=A.value;return r("/passkey/update-passkey",{...u,name:b},g,C=>nn(C,u.id,b))},deletePasskey:(u,g)=>r("/passkey/delete-passkey",u,g,on)},twoFactor:{enable:(u,g)=>r("/two-factor/enable",u,g,Et),disable:(u,g)=>s(r("/two-factor/disable",u,g,Nt),A=>A.status),verifyTotp:(u,g)=>s(r("/two-factor/verify-totp",u,g,se)),verifyBackupCode:(u,g)=>s(r("/two-factor/verify-backup-code",u,g,se)),sendOtp:(u={},g)=>r("/two-factor/send-otp",u,g,Ut),verifyOtp:(u,g)=>s(r("/two-factor/verify-otp",u,g,se)),generateBackupCodes:(u,g)=>r("/two-factor/generate-backup-codes",u,g,Mt)},signOut:u=>s(p.request("/sign-out",{method:"POST",body:{},fetchOptions:u,decode:xt}).then(g=>(o.endSession(),g)),g=>g.success)}}function Go(e,t=()=>{},n){let i=Ki(e,t,n);return n?{...i,signIn:{email:i.signIn.email,username:i.signIn.username,social:gn(i),magicLink:i.signIn.magicLink,emailOtp:i.signIn.emailOtp,passkey:i.signIn.passkey},passkey:{listUserPasskeys:i.passkey.listUserPasskeys,updatePasskey:i.passkey.updatePasskey,deletePasskey:i.passkey.deletePasskey,addPasskey:i.passkey.addPasskey}}:{...i,signIn:{email:i.signIn.email,username:i.signIn.username,social:gn(i),magicLink:i.signIn.magicLink,emailOtp:i.signIn.emailOtp},passkey:{listUserPasskeys:i.passkey.listUserPasskeys,updatePasskey:i.passkey.updatePasskey,deletePasskey:i.passkey.deletePasskey}}}function gn(e){return async(t,n)=>{if(!t?.idToken||typeof t.idToken.token!="string"||t.idToken.token==="")return Bi();let i=await e.signIn.social({...t,disableRedirect:true},n);return i.data!==null&&"url"in i.data?ji():i}}function Bi(){return Promise.resolve({data:null,error:{status:400,statusText:"BAD_REQUEST",code:"NATIVE_SOCIAL_ID_TOKEN_REQUIRED",message:"Native social sign-in requires a provider ID token."}})}function ji(){return Promise.resolve({data:null,error:{status:502,statusText:"BAD_GATEWAY",code:"INVALID_NATIVE_SOCIAL_RESPONSE",message:"The server returned a redirect for native ID-token sign-in."}})}function Gi(){return {signIn:()=>fn(),add:()=>fn()}}function fn(){return Promise.resolve({data:null,error:{status:400,statusText:"BAD_REQUEST",code:"PASSKEY_BROWSER_REQUIRED",message:"This passkey ceremony requires a browser with WebAuthn."}})}function Yo(e,t,n){let i=new Map;return {async signIn(o={},a){let p=await e.request("/passkey/generate-authenticate-options");if(!p.data)return An(p.error);let m;try{m=$t(p.data);}catch{return mn()}let l;try{l=await n.authenticate({optionsJSON:m,useBrowserAutofill:o.autoFill});}catch(y){return yn(n,y,"AUTH_CANCELLED","Passkey authentication was cancelled.")}if(!Ji(l))return hn();let{clientExtensionResults:h,...r}=l,s=i.get(l.id);if(s)return s;let f=(async()=>{let y=await e.request("/passkey/verify-authentication",{method:"POST",body:{response:r},fetchOptions:a,decode:Zt});return y.data&&t(),y})();i.set(l.id,f);try{return await f}finally{i.get(l.id)===f&&i.delete(l.id);}},async add(o={},a){let p=ce(o.name);if(!p.valid)return de();let m=await e.request("/passkey/generate-register-options",{query:{name:p.value,authenticatorAttachment:o.authenticatorAttachment}});if(!m.data)return An(m.error);let l;try{l=Qt(m.data);}catch{return mn()}let h;try{h=await n.register({optionsJSON:l});}catch(y){return yn(n,y,"REGISTRATION_CANCELLED","Passkey registration was cancelled.")}if(!Wi(h))return hn();let{clientExtensionResults:r,...s}=h,f=await e.request("/passkey/verify-registration",{method:"POST",body:{response:s,name:p.value},fetchOptions:a,decode:y=>en(y,h.id,p.value)});return f.data&&t(),f}}}function mn(){return {data:null,error:{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned invalid WebAuthn options."}}}function hn(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_WEBAUTHN_RESPONSE",message:"The platform returned an invalid passkey response."}}}function bn(e){if(!e||typeof e!="object")return  false;let t=e;return typeof t.id=="string"&&t.id.length>0&&typeof t.rawId=="string"&&t.rawId.length>0&&t.type==="public-key"&&!!t.response&&typeof t.response=="object"}function Ji(e){if(!bn(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.authenticatorData=="string"&&typeof t.signature=="string"&&(t.userHandle===void 0||typeof t.userHandle=="string")}function Wi(e){if(!bn(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.attestationObject=="string"}function An(e){return {data:null,error:e??{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned no WebAuthn options."}}}function yn(e,t,n,i){let o=Yi(t,"page does not have focus"),a=e.errorCode?.(t),p=a!==void 0?a==="ERROR_CEREMONY_ABORTED":On(t)==="AbortError",m=n!=="AUTH_CANCELLED",l=Xi(a,On(t),m);return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:o?"PASSKEY_PAGE_NOT_FOCUSED":p?n:a??"PASSKEY_BROWSER_ERROR",message:o?"Keep this page focused while completing the passkey prompt.":p?i:l}}}function Xi(e,t,n){switch(e){case "ERROR_INVALID_DOMAIN":case "ERROR_INVALID_RP_ID":return "Passkeys are not set up for this site\u2019s domain.";case "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED":return "This device already has a passkey for this account.";case "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEY_ALGS":case "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT":case "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT":return "This device cannot create a passkey for this site.";}return t==="NotAllowedError"?n?"No passkey was created. The prompt was dismissed or timed out.":"No passkey was used. This device may not have one saved for this site yet, or the prompt was dismissed.":t==="SecurityError"?"Passkeys are not set up for this site\u2019s domain.":n?"Passkey registration did not complete.":"Passkey sign-in did not complete."}function On(e){return e&&typeof e=="object"&&"name"in e&&typeof e.name=="string"?e.name:void 0}function Yi(e,t){let n=t.toLowerCase(),i=new Set,o=e;for(;o&&typeof o=="object"&&!i.has(o);){if(i.add(o),"message"in o&&typeof o.message=="string"&&o.message.toLowerCase().includes(n))return  true;o="cause"in o?o.cause:void 0;}return  false}async function er(e){let n=`${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}/public-config`;return Be(await oe(e,n,{init:{method:"GET",credentials:"omit"},maxResponseBytes:256*1024,decode:i=>$i(i,e)}),"public-config")}function $i(e,t){let n=z(e),i=n.environmentId,o=n.environmentType,a=`${new URL(t.apiUrl).origin}/api/projects/${t.decoded.projectId}/auth`;if(typeof n.applicationId!="string"||!Me(n.applicationId)||i!==t.decoded.projectId||o!=="development"&&o!=="production"||n.authBaseUrl!==a)throw P();let p=S(n.branding),m=S(n.legal);if(!F(n.enabledMethods,64)||!F(n.socialProviders,64)||!In(p,["appName","logoUrl","primaryColor"])||p.showAppName!==void 0&&typeof p.showAppName!="boolean"||p.alignment!==void 0&&p.alignment!=="left"&&p.alignment!=="center"&&p.alignment!=="right"||p.theme!==void 0&&p.theme!=="light"&&p.theme!=="dark"&&p.theme!=="system"||!In(m,["termsUrl","privacyUrl"])||!Number.isSafeInteger(m.version)||m.version<0||typeof m.required!="boolean")throw P();if(n.socialProviderClientIds!==void 0){let l=S(n.socialProviderClientIds);if(Object.keys(l).length>64||Object.values(l).some(h=>typeof h!="string"||h.length>2048))throw P()}if(!_(n,["requireEmailVerification","twoFactor","mfaRequired","accountDeletion","organizations","sso","badge"])||!wn(n.turnstileSiteKey)||!wn(n.authTurnstileSiteKey)||typeof n.locale!="string"||n.locale.length===0||n.locale.length>64||!Number.isSafeInteger(n.configVersion)||n.configVersion<0)throw P();if(n.jwtIssuer!==null){let l=S(n.jwtIssuer);if(l.issuer!==a||l.jwksUrl!==`${a}/jwks`||l.aud!==t.decoded.projectId)throw P()}if(n.signUp!==void 0){let l=S(n.signUp).mode;if(typeof l!="string"||!["open","restricted","allowlist","waitlist"].includes(l))throw P()}if(n.authentication!==void 0&&Qi(n.authentication),n.privacy!==void 0&&Zi(n.privacy),n.emailVerification!==void 0){let l=S(n.emailVerification);if(!_(l,["required"])||l.method!=="link"&&l.method!=="code")throw P()}if(n.userModel!==void 0&&!_(S(n.userModel),["requireEmail","firstLastName","emailChange","accountDeletion"]))throw P();if(n.mfa!==void 0){let l=S(n.mfa);if(!_(l,["totp","required","backupCodes"])||(l.required===true||l.backupCodes===true)&&l.totp!==true)throw P()}if(n.captcha===void 0||n.captcha===null)n.captcha=typeof n.authTurnstileSiteKey=="string"&&n.authTurnstileSiteKey.length>0?{provider:"turnstile",siteKey:n.authTurnstileSiteKey}:null;else {let l=S(n.captcha);if(typeof l.provider!="string"||l.provider.length===0||l.provider.length>64||typeof l.siteKey!="string"||l.siteKey.length===0||l.siteKey.length>512)throw P();n.captcha={provider:l.provider,siteKey:l.siteKey};}return n}function Me(e){return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}function P(){return new TypeError("public-config returned an invalid response")}function S(e){if(!e||typeof e!="object"||Array.isArray(e))throw P();return e}function wn(e){return e===null||typeof e=="string"&&e.length<=4096}function Qi(e){let t=S(e),n=S(t.email),i=S(t.password),o=i.minLength!==void 0||i.maxLength!==void 0;if(!_(n,["signUp"])||!F(n.signIn,3)||n.signIn.some(a=>a!=="password"&&a!=="magic_link"&&a!=="email_otp")||!_(S(t.phone),["signUp","signIn"])||!_(i,["signUp","add"])||o&&(!Number.isSafeInteger(i.minLength)||!Number.isSafeInteger(i.maxLength)||i.minLength<1||i.maxLength>4096||i.minLength>i.maxLength)||!_(S(t.passkey),["signIn","add"])||!eo(S(t.passkey).relyingPartyId)||!_(S(t.username),["collectOnSignUp","signIn"]))throw P()}function Zi(e){let t=S(e);if(!Array.isArray(t.notices)||!Array.isArray(t.consentPurposes)||t.notices.length>64||t.consentPurposes.length>64)throw P();for(let n of t.notices){let i=S(n);if(kn(i,"noticeId","noticeVersionId"),fe(i.title,512),fe(i.body,1e5),Rn(i.digest),!F(i.activityCodes,128)||!F(i.purposeCodes,128)||typeof i.effectiveFrom!="string"||!Number.isFinite(Date.parse(i.effectiveFrom)))throw P()}for(let n of t.consentPurposes){let i=S(n);if(kn(i,"purposeId","purposeVersionId"),fe(i.title,512),fe(i.description,1e4),Rn(i.digest),!F(i.activityCodes,128)||!F(i.dataCategories,128))throw P()}}function kn(e,t,n){if(typeof e[t]!="string"||!Me(e[t])||typeof e[n]!="string"||!Me(e[n])||typeof e.code!="string"||!/^[a-z][a-z0-9_]{0,63}$/.test(e.code)||!Number.isSafeInteger(e.version)||e.version<1)throw P()}function fe(e,t){let n=S(e);if(typeof n.en!="string"||n.en.length===0||n.en.length>t||typeof n.ar!="string"||n.ar.length===0||n.ar.length>t)throw P()}function Rn(e){let t=S(e);if(typeof t.en!="string"||!/^[a-f0-9]{64}$/.test(t.en)||typeof t.ar!="string"||!/^[a-f0-9]{64}$/.test(t.ar))throw P()}function eo(e){return e==null||typeof e=="string"}function _(e,t){return t.every(n=>typeof e[n]=="boolean")}function In(e,t){return t.every(n=>e[n]===void 0||typeof e[n]=="string"&&e[n].length<=4096)}function F(e,t){return Array.isArray(e)&&e.length<=t&&e.every(n=>typeof n=="string"&&n.length<=128)&&new Set(e).size===e.length}export{to as a,he as b,oe as c,Be as d,ro as e,je as f,Pn as g,Cn as h,be as i,We as j,Ki as k,Go as l,Yo as m,er as n};

package/dist/{client-CgM5jSLp.d.ts → client-2xyOK_yb.d.cts}

@@ -1,4 +1,4 @@
-import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-B05mzhtA.js';
+import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-DSqmZLkN.cjs';
 
 /**
  * The organization invitation an emailed link is asking this browser to accept.
@@ -174,6 +174,50 @@ type PublicConfig = {
         version: number;
         required: boolean;
     };
+    /** Published, bilingual privacy notices and optional consent purposes. */
+    privacy?: {
+        notices: Array<{
+            noticeId: string;
+            noticeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            body: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            purposeCodes: string[];
+            effectiveFrom: string;
+        }>;
+        consentPurposes: Array<{
+            purposeId: string;
+            purposeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            description: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            dataCategories: string[];
+        }>;
+    };
     /**
      * Whether the project lets signed-in users enrol a second factor (TOTP). A
      * capability flag, not a sign-in method (so it's absent from `enabledMethods`):
@@ -230,38 +274,6 @@ type PublicConfig = {
  */
 declare function getPublicConfig(config: ResolvedAuthConfig): Promise<PublicConfig>;
 
-/** One compatibility boundary for project-controlled authentication UI. */
-type ProjectCapabilities = {
-    emailSignUp: boolean;
-    passwordSignUp: boolean;
-    phoneSignUp: boolean;
-    passwordSignIn: boolean;
-    passwordMinLength: number;
-    passwordMaxLength: number;
-    magicLinkSignIn: boolean;
-    emailOtpSignIn: boolean;
-    phoneSignIn: boolean;
-    usernameSignIn: boolean;
-    collectUsername: boolean;
-    passkeySignIn: boolean;
-    passkeyAdd: boolean;
-    firstLastName: boolean;
-    emailChange: boolean;
-    accountDeletion: boolean;
-    emailVerificationRequired: boolean;
-    emailVerificationMethod: 'link' | 'code';
-    totp: boolean;
-    mfaRequired: boolean;
-    backupCodes: boolean;
-    /** Preserve the pre-plan-35 display-name field only for an older server. */
-    legacyNameField: boolean;
-};
-/**
- * Resolve current and legacy public-config shapes once, rather than spreading
- * compatibility checks through each platform's components.
- */
-declare function resolveProjectCapabilities(config: PublicConfig | null): ProjectCapabilities;
-
 /** Legal-consent status for the signed-in user (server contract: `GET /consent`). */
 type ConsentStatus = {
     /** Whether the project has an active consent gate at all. */
@@ -331,21 +343,6 @@ type TokenClient = {
  */
 declare function createTokenClient(config: ResolvedAuthConfig): TokenClient;
 
-declare const AUTH_CHALLENGE_HEADER = "x-authowl-turnstile-token";
-type ResponseDecoder<T> = (value: unknown) => T;
-type AuthHttpRequest<T = unknown> = {
-    method?: 'GET' | 'POST' | 'PATCH';
-    body?: unknown;
-    query?: Record<string, string | number | boolean | undefined>;
-    fetchOptions?: ActionFetchOptions;
-    decode?: ResponseDecoder<T>;
-    credentials?: RequestCredentials;
-};
-interface AuthHttpClient {
-    request<T>(path: string, options?: AuthHttpRequest<T>): Promise<AuthActionResult<T>>;
-}
-declare function createAuthHttpClient(config: ResolvedAuthConfig, baseURL?: string): AuthHttpClient;
-
 type JsonPrimitive = string | number | boolean | null;
 type JsonValue = JsonPrimitive | JsonObject | JsonValue[];
 type JsonObject = {
@@ -794,6 +791,58 @@ interface OrganizationClient {
     }): boolean;
 }
 
+type PrivacyLocale = 'en' | 'ar';
+type PrivacyConsentState = 'granted' | 'refused' | 'withdrawn';
+type PrivacyRightType = 'access' | 'correction' | 'portability' | 'erasure' | 'restriction' | 'objection' | 'consent_withdrawal';
+type PrivacyRightState = 'received' | 'identity_pending' | 'in_progress' | 'restricted' | 'completed' | 'denied' | 'withdrawn';
+interface PrivacyConsentPreference {
+    purposeId: string;
+    purposeVersionId: string;
+    code: string;
+    state: PrivacyConsentState | null;
+    updatedAt: Date | null;
+    decidedAt: Date | null;
+}
+interface PrivacyRightsRequest {
+    id: string;
+    rightType: PrivacyRightType;
+    state: PrivacyRightState;
+    locale: PrivacyLocale;
+    receivedAt: Date;
+    acknowledgedAt: Date | null;
+    fulfilmentDeadline: Date;
+    completedAt: Date | null;
+}
+interface RecordPrivacyConsentOptions {
+    purposeCode: string;
+    purposeVersionId: string;
+    noticeVersionId: string;
+    decision: PrivacyConsentState;
+    locale: PrivacyLocale;
+    /** Stable retry key. A secure UUID is generated when omitted. */
+    correlationId?: string;
+}
+interface CreatePrivacyRightsRequestOptions {
+    rightType: PrivacyRightType;
+    locale: PrivacyLocale;
+}
+interface PrivacyClient {
+    listConsentPreferences(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<{
+        preferences: PrivacyConsentPreference[];
+    }>>;
+    recordConsent(params: RecordPrivacyConsentOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<{
+        recorded: true;
+        decision: PrivacyConsentState;
+        decidedAt: Date;
+    }>>;
+    listRightsRequests(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<{
+        requests: PrivacyRightsRequest[];
+    }>>;
+    createRightsRequest(params: CreatePrivacyRightsRequestOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<{
+        request: PrivacyRightsRequest;
+    }>>;
+}
+
 /**
  * The narrow, portable surface of the underlying auth client that this SDK
  * depends on and re-exports.
@@ -1033,6 +1082,24 @@ interface EmailSignUpOptions {
      * this automatically when it renders the consent checkbox.
      */
     consentVersion?: number;
+    /**
+     * Exact published notice versions rendered by the sign-up surface, together
+     * with purpose-specific choices. Current <SignUp/> builds this from public
+     * config automatically; headless clients should echo the same projection.
+     */
+    privacyEvidence?: {
+        locale: 'en' | 'ar';
+        correlationId: string;
+        noticeVersionIds: string[];
+        consentDecisions: Array<{
+            purposeCode: string;
+            purposeVersionId: string;
+            noticeVersionId: string;
+            decision: 'granted' | 'refused';
+            guardianRequired: boolean;
+            guardianEvidenceId: string | null;
+        }>;
+    };
 }
 interface WaitlistJoinOptions {
     email: string;
@@ -1383,6 +1450,8 @@ interface AuthOwlClient {
     account: AccountClient;
     /** Signed-in organization, membership, role, and invitation actions. */
     organization: OrganizationClient;
+    /** Signed-in privacy preferences and data-subject-rights actions. */
+    privacy: PrivacyClient;
     signIn: {
         /**
          * Email + password sign-in. For a two-factor-enrolled user the result is a
@@ -1514,4 +1583,4 @@ interface AuthOwlClient {
  */
 declare function createAuthOwlClient(config: ResolvedAuthConfig): AuthOwlClient;
 
-export { type JsonPrimitive as $, type AkedlyShieldStartProof as A, type DeletePasskeyData as B, type ChangeEmailOptions as C, type DeleteAccountData as D, type DeletePasskeyOptions as E, type DisableTwoFactorOptions as F, type EmailAuthData as G, type EmailOtpAuthData as H, type EmailOtpSignInOptions as I, type EmailOtpType as J, type EmailSignInOptions as K, type EmailSignUpData as L, type EmailSignUpOptions as M, type EnableTwoFactorOptions as N, type EnvironmentType as O, type PhoneOtpChallengeData as P, type GenerateBackupCodesOptions as Q, type GetOrganizationInvitationOptions as R, type GetOrganizationOptions as S, type GetToken as T, type GetTokenOptions as U, INVITATION_CLAIM_MAX_AGE_MS as V, INVITATION_QUERY_PARAM as W, type InvitationClaim as X, type InvitationRecipientHint as Y, type InviteOrganizationMemberOptions as Z, type JsonObject as _, AUTH_CHALLENGE_HEADER as a, type TwoFactorEnableData as a$, type JsonValue as a0, type LeaveOrganizationOptions as a1, type LinkSocialData as a2, type LinkSocialOptions as a3, type ListOrganizationInvitationsOptions as a4, type ListOrganizationMembersOptions as a5, type ListOrganizationRolesOptions as a6, type ListOrganizationTeamMembersOptions as a7, type ListOrganizationTeamsOptions as a8, type MagicLinkData as a9, type ProjectCapabilities as aA, type PublicConfig as aB, type RejectOrganizationInvitationData as aC, type RemoveOrganizationMemberData as aD, type RemoveOrganizationMemberOptions as aE, type RemoveOrganizationTeamData as aF, type RemoveOrganizationTeamMemberData as aG, type RemoveOrganizationTeamMemberOptions as aH, type RemoveOrganizationTeamOptions as aI, type RequestPasswordResetOptions as aJ, type ResetPasswordOptions as aK, type RevokeSessionOptions as aL, type SendOtpData as aM, type SendTwoFactorOtpData as aN, type SendTwoFactorOtpOptions as aO, type SendVerificationOtpOptions as aP, type SessionState as aQ, type SessionStore as aR, type SetActiveOrganizationOptions as aS, type SetActiveTeamOptions as aT, type SignOutData as aU, type SocialAccount as aV, type SocialAuthData as aW, type SocialIdTokenOptions as aX, type SocialSignInOptions as aY, type TokenClient as aZ, type TwoFactorBackupCodesData as a_, type MagicLinkSignInOptions as aa, type Organization as ab, type OrganizationClient as ac, type OrganizationDetails as ad, type OrganizationFilterOperator as ae, type OrganizationInvitation as af, type OrganizationInvitationActionOptions as ag, type OrganizationInvitationDetails as ah, type OrganizationInvitationStatus as ai, type OrganizationMember as aj, type OrganizationMemberUser as ak, type OrganizationMemberWithUser as al, type OrganizationMembersData as am, type OrganizationRoleSummary as an, type OrganizationSelector as ao, type OrganizationTeam as ap, type OrganizationTeamMember as aq, type OrganizationUserInvitation as ar, type PasskeyAuthData as as, type PasskeySignInOptions as at, type PasswordResetData as au, type PhoneAuthUser as av, type PhoneOtpStartData as aw, type PhoneOtpStartOptions as ax, type PhoneOtpVerifyData as ay, type PhoneOtpVerifyOptions as az, type AcceptOrganizationInvitationData as b, type TwoFactorRedirectData as b0, type TwoFactorStatusData as b1, type TwoFactorVerifyData as b2, type UnlinkSocialOptions as b3, type UpdateOrganizationMemberRoleOptions as b4, type UpdateOrganizationOptions as b5, type UpdateOrganizationTeamOptions as b6, type UpdatePasskeyData as b7, type UpdatePasskeyOptions as b8, type UpdateProfileOptions as b9, type UpdateUnsafeMetadataOptions as ba, type UserMetadata as bb, type UsernameSignInOptions as bc, type VerifyBackupCodeOptions as bd, type VerifyEmailOtpData as be, type VerifyEmailOtpOptions as bf, type VerifyTotpOptions as bg, type VerifyTwoFactorOtpOptions as bh, type WaitlistJoinData as bi, type WaitlistJoinOptions as bj, acceptConsent as bk, captureInvitationClaim as bl, clearInvitationClaim as bm, createAuthOwlClient as bn, createTokenClient as bo, getConsentStatus as bp, getPublicConfig as bq, readInvitationClaim as br, resolveProjectCapabilities as bs, createAuthHttpClient as bt, type AuthHttpClient as bu, type AccountClient as c, type AccountSession as d, type AccountStatusData as e, type ActionFetchOptions as f, type AddOrganizationTeamMemberOptions as g, type AddPasskeyOptions as h, type AuthActionResult as i, type AuthClientError as j, type AuthErrorContext as k, type AuthOwlClient as l, type AuthOwlErrorCode as m, type AuthPasskey as n, type AuthRequestContext as o, type AuthResponseContext as p, type AuthSession as q, type AuthUser as r, type ChangePasswordData as s, type ChangePasswordOptions as t, type ConsentAcceptResult as u, type ConsentStatus as v, type CreateOrganizationOptions as w, type CreateOrganizationTeamOptions as x, type DeleteAccountOptions as y, type DeleteOrganizationOptions as z };
+export { type EmailAuthData as $, type ActionFetchOptions as A, type AccountClient as B, type CreatePrivacyRightsRequestOptions as C, type AccountSession as D, type AccountStatusData as E, type AddOrganizationTeamMemberOptions as F, type AuthErrorContext as G, type AuthOwlErrorCode as H, type AuthRequestContext as I, type AuthResponseContext as J, type ChangeEmailOptions as K, type ChangePasswordData as L, type ChangePasswordOptions as M, type ConsentAcceptResult as N, type Organization as O, type PublicConfig as P, type ConsentStatus as Q, type RecordPrivacyConsentOptions as R, type SocialIdTokenOptions as S, type CreateOrganizationOptions as T, type CreateOrganizationTeamOptions as U, type DeleteAccountData as V, type DeleteAccountOptions as W, type DeleteOrganizationOptions as X, type DeletePasskeyData as Y, type DeletePasskeyOptions as Z, type DisableTwoFactorOptions as _, type AuthActionResult as a, type SendTwoFactorOtpOptions as a$, type EmailOtpAuthData as a0, type EmailOtpSignInOptions as a1, type EmailOtpType as a2, type EmailSignInOptions as a3, type EmailSignUpData as a4, type EmailSignUpOptions as a5, type EnableTwoFactorOptions as a6, type EnvironmentType as a7, type GenerateBackupCodesOptions as a8, type GetOrganizationInvitationOptions as a9, type OrganizationMember as aA, type OrganizationMemberUser as aB, type OrganizationMemberWithUser as aC, type OrganizationMembersData as aD, type OrganizationRoleSummary as aE, type OrganizationSelector as aF, type OrganizationTeam as aG, type OrganizationTeamMember as aH, type OrganizationUserInvitation as aI, type PasswordResetData as aJ, type PhoneAuthUser as aK, type PhoneOtpStartData as aL, type PhoneOtpStartOptions as aM, type PhoneOtpVerifyData as aN, type PhoneOtpVerifyOptions as aO, type RejectOrganizationInvitationData as aP, type RemoveOrganizationMemberData as aQ, type RemoveOrganizationMemberOptions as aR, type RemoveOrganizationTeamData as aS, type RemoveOrganizationTeamMemberData as aT, type RemoveOrganizationTeamMemberOptions as aU, type RemoveOrganizationTeamOptions as aV, type RequestPasswordResetOptions as aW, type ResetPasswordOptions as aX, type RevokeSessionOptions as aY, type SendOtpData as aZ, type SendTwoFactorOtpData as a_, type GetOrganizationOptions as aa, type GetToken as ab, type GetTokenOptions as ac, INVITATION_CLAIM_MAX_AGE_MS as ad, INVITATION_QUERY_PARAM as ae, type InvitationClaim as af, type InvitationRecipientHint as ag, type InviteOrganizationMemberOptions as ah, type JsonObject as ai, type JsonPrimitive as aj, type JsonValue as ak, type LeaveOrganizationOptions as al, type LinkSocialData as am, type LinkSocialOptions as an, type ListOrganizationInvitationsOptions as ao, type ListOrganizationMembersOptions as ap, type ListOrganizationRolesOptions as aq, type ListOrganizationTeamMembersOptions as ar, type ListOrganizationTeamsOptions as as, type MagicLinkData as at, type MagicLinkSignInOptions as au, type OrganizationFilterOperator as av, type OrganizationInvitation as aw, type OrganizationInvitationActionOptions as ax, type OrganizationInvitationDetails as ay, type OrganizationInvitationStatus as az, type AuthOwlClient as b, type SendVerificationOtpOptions as b0, type SetActiveTeamOptions as b1, type SignOutData as b2, type SocialAccount as b3, type SocialSignInOptions as b4, type TokenClient as b5, type TwoFactorBackupCodesData as b6, type TwoFactorEnableData as b7, type TwoFactorRedirectData as b8, type TwoFactorStatusData as b9, type TwoFactorVerifyData as ba, type UnlinkSocialOptions as bb, type UpdateOrganizationMemberRoleOptions as bc, type UpdateOrganizationOptions as bd, type UpdateOrganizationTeamOptions as be, type UpdatePasskeyData as bf, type UpdatePasskeyOptions as bg, type UpdateProfileOptions as bh, type UpdateUnsafeMetadataOptions as bi, type UserMetadata as bj, type UsernameSignInOptions as bk, type VerifyBackupCodeOptions as bl, type VerifyEmailOtpData as bm, type VerifyEmailOtpOptions as bn, type VerifyTotpOptions as bo, type VerifyTwoFactorOtpOptions as bp, type WaitlistJoinData as bq, type WaitlistJoinOptions as br, acceptConsent as bs, captureInvitationClaim as bt, clearInvitationClaim as bu, createAuthOwlClient as bv, createTokenClient as bw, getConsentStatus as bx, readInvitationClaim as by, type PasskeySignInOptions as c, type PasskeyAuthData as d, type AddPasskeyOptions as e, type AuthPasskey as f, type AuthClientError as g, type AuthSession as h, type AuthUser as i, type OrganizationClient as j, type OrganizationDetails as k, type PrivacyClient as l, type PrivacyConsentPreference as m, type PrivacyConsentState as n, type PrivacyLocale as o, type PrivacyRightState as p, type PrivacyRightType as q, type PrivacyRightsRequest as r, type SessionState as s, type SessionStore as t, type SetActiveOrganizationOptions as u, type SocialAuthData as v, getPublicConfig as w, type PhoneOtpChallengeData as x, type AkedlyShieldStartProof as y, type AcceptOrganizationInvitationData as z };

package/dist/{client-CbTdWXNE.d.cts → client-Za31KAN3.d.ts}

@@ -1,4 +1,4 @@
-import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-B05mzhtA.cjs';
+import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-DSqmZLkN.js';
 
 /**
  * The organization invitation an emailed link is asking this browser to accept.
@@ -174,6 +174,50 @@ type PublicConfig = {
         version: number;
         required: boolean;
     };
+    /** Published, bilingual privacy notices and optional consent purposes. */
+    privacy?: {
+        notices: Array<{
+            noticeId: string;
+            noticeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            body: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            purposeCodes: string[];
+            effectiveFrom: string;
+        }>;
+        consentPurposes: Array<{
+            purposeId: string;
+            purposeVersionId: string;
+            code: string;
+            version: number;
+            title: {
+                en: string;
+                ar: string;
+            };
+            description: {
+                en: string;
+                ar: string;
+            };
+            digest: {
+                en: string;
+                ar: string;
+            };
+            activityCodes: string[];
+            dataCategories: string[];
+        }>;
+    };
     /**
      * Whether the project lets signed-in users enrol a second factor (TOTP). A
      * capability flag, not a sign-in method (so it's absent from `enabledMethods`):
@@ -230,38 +274,6 @@ type PublicConfig = {
  */
 declare function getPublicConfig(config: ResolvedAuthConfig): Promise<PublicConfig>;
 
-/** One compatibility boundary for project-controlled authentication UI. */
-type ProjectCapabilities = {
-    emailSignUp: boolean;
-    passwordSignUp: boolean;
-    phoneSignUp: boolean;
-    passwordSignIn: boolean;
-    passwordMinLength: number;
-    passwordMaxLength: number;
-    magicLinkSignIn: boolean;
-    emailOtpSignIn: boolean;
-    phoneSignIn: boolean;
-    usernameSignIn: boolean;
-    collectUsername: boolean;
-    passkeySignIn: boolean;
-    passkeyAdd: boolean;
-    firstLastName: boolean;
-    emailChange: boolean;
-    accountDeletion: boolean;
-    emailVerificationRequired: boolean;
-    emailVerificationMethod: 'link' | 'code';
-    totp: boolean;
-    mfaRequired: boolean;
-    backupCodes: boolean;
-    /** Preserve the pre-plan-35 display-name field only for an older server. */
-    legacyNameField: boolean;
-};
-/**
- * Resolve current and legacy public-config shapes once, rather than spreading
- * compatibility checks through each platform's components.
- */
-declare function resolveProjectCapabilities(config: PublicConfig | null): ProjectCapabilities;
-
 /** Legal-consent status for the signed-in user (server contract: `GET /consent`). */
 type ConsentStatus = {
     /** Whether the project has an active consent gate at all. */
@@ -331,21 +343,6 @@ type TokenClient = {
  */
 declare function createTokenClient(config: ResolvedAuthConfig): TokenClient;
 
-declare const AUTH_CHALLENGE_HEADER = "x-authowl-turnstile-token";
-type ResponseDecoder<T> = (value: unknown) => T;
-type AuthHttpRequest<T = unknown> = {
-    method?: 'GET' | 'POST' | 'PATCH';
-    body?: unknown;
-    query?: Record<string, string | number | boolean | undefined>;
-    fetchOptions?: ActionFetchOptions;
-    decode?: ResponseDecoder<T>;
-    credentials?: RequestCredentials;
-};
-interface AuthHttpClient {
-    request<T>(path: string, options?: AuthHttpRequest<T>): Promise<AuthActionResult<T>>;
-}
-declare function createAuthHttpClient(config: ResolvedAuthConfig, baseURL?: string): AuthHttpClient;
-
 type JsonPrimitive = string | number | boolean | null;
 type JsonValue = JsonPrimitive | JsonObject | JsonValue[];
 type JsonObject = {
@@ -794,6 +791,58 @@ interface OrganizationClient {
     }): boolean;
 }
 
+type PrivacyLocale = 'en' | 'ar';
+type PrivacyConsentState = 'granted' | 'refused' | 'withdrawn';
+type PrivacyRightType = 'access' | 'correction' | 'portability' | 'erasure' | 'restriction' | 'objection' | 'consent_withdrawal';
+type PrivacyRightState = 'received' | 'identity_pending' | 'in_progress' | 'restricted' | 'completed' | 'denied' | 'withdrawn';
+interface PrivacyConsentPreference {
+    purposeId: string;
+    purposeVersionId: string;
+    code: string;
+    state: PrivacyConsentState | null;
+    updatedAt: Date | null;
+    decidedAt: Date | null;
+}
+interface PrivacyRightsRequest {
+    id: string;
+    rightType: PrivacyRightType;
+    state: PrivacyRightState;
+    locale: PrivacyLocale;
+    receivedAt: Date;
+    acknowledgedAt: Date | null;
+    fulfilmentDeadline: Date;
+    completedAt: Date | null;
+}
+interface RecordPrivacyConsentOptions {
+    purposeCode: string;
+    purposeVersionId: string;
+    noticeVersionId: string;
+    decision: PrivacyConsentState;
+    locale: PrivacyLocale;
+    /** Stable retry key. A secure UUID is generated when omitted. */
+    correlationId?: string;
+}
+interface CreatePrivacyRightsRequestOptions {
+    rightType: PrivacyRightType;
+    locale: PrivacyLocale;
+}
+interface PrivacyClient {
+    listConsentPreferences(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<{
+        preferences: PrivacyConsentPreference[];
+    }>>;
+    recordConsent(params: RecordPrivacyConsentOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<{
+        recorded: true;
+        decision: PrivacyConsentState;
+        decidedAt: Date;
+    }>>;
+    listRightsRequests(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<{
+        requests: PrivacyRightsRequest[];
+    }>>;
+    createRightsRequest(params: CreatePrivacyRightsRequestOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<{
+        request: PrivacyRightsRequest;
+    }>>;
+}
+
 /**
  * The narrow, portable surface of the underlying auth client that this SDK
  * depends on and re-exports.
@@ -1033,6 +1082,24 @@ interface EmailSignUpOptions {
      * this automatically when it renders the consent checkbox.
      */
     consentVersion?: number;
+    /**
+     * Exact published notice versions rendered by the sign-up surface, together
+     * with purpose-specific choices. Current <SignUp/> builds this from public
+     * config automatically; headless clients should echo the same projection.
+     */
+    privacyEvidence?: {
+        locale: 'en' | 'ar';
+        correlationId: string;
+        noticeVersionIds: string[];
+        consentDecisions: Array<{
+            purposeCode: string;
+            purposeVersionId: string;
+            noticeVersionId: string;
+            decision: 'granted' | 'refused';
+            guardianRequired: boolean;
+            guardianEvidenceId: string | null;
+        }>;
+    };
 }
 interface WaitlistJoinOptions {
     email: string;
@@ -1383,6 +1450,8 @@ interface AuthOwlClient {
     account: AccountClient;
     /** Signed-in organization, membership, role, and invitation actions. */
     organization: OrganizationClient;
+    /** Signed-in privacy preferences and data-subject-rights actions. */
+    privacy: PrivacyClient;
     signIn: {
         /**
          * Email + password sign-in. For a two-factor-enrolled user the result is a
@@ -1514,4 +1583,4 @@ interface AuthOwlClient {
  */
 declare function createAuthOwlClient(config: ResolvedAuthConfig): AuthOwlClient;
 
-export { type JsonPrimitive as $, type AkedlyShieldStartProof as A, type DeletePasskeyData as B, type ChangeEmailOptions as C, type DeleteAccountData as D, type DeletePasskeyOptions as E, type DisableTwoFactorOptions as F, type EmailAuthData as G, type EmailOtpAuthData as H, type EmailOtpSignInOptions as I, type EmailOtpType as J, type EmailSignInOptions as K, type EmailSignUpData as L, type EmailSignUpOptions as M, type EnableTwoFactorOptions as N, type EnvironmentType as O, type PhoneOtpChallengeData as P, type GenerateBackupCodesOptions as Q, type GetOrganizationInvitationOptions as R, type GetOrganizationOptions as S, type GetToken as T, type GetTokenOptions as U, INVITATION_CLAIM_MAX_AGE_MS as V, INVITATION_QUERY_PARAM as W, type InvitationClaim as X, type InvitationRecipientHint as Y, type InviteOrganizationMemberOptions as Z, type JsonObject as _, AUTH_CHALLENGE_HEADER as a, type TwoFactorEnableData as a$, type JsonValue as a0, type LeaveOrganizationOptions as a1, type LinkSocialData as a2, type LinkSocialOptions as a3, type ListOrganizationInvitationsOptions as a4, type ListOrganizationMembersOptions as a5, type ListOrganizationRolesOptions as a6, type ListOrganizationTeamMembersOptions as a7, type ListOrganizationTeamsOptions as a8, type MagicLinkData as a9, type ProjectCapabilities as aA, type PublicConfig as aB, type RejectOrganizationInvitationData as aC, type RemoveOrganizationMemberData as aD, type RemoveOrganizationMemberOptions as aE, type RemoveOrganizationTeamData as aF, type RemoveOrganizationTeamMemberData as aG, type RemoveOrganizationTeamMemberOptions as aH, type RemoveOrganizationTeamOptions as aI, type RequestPasswordResetOptions as aJ, type ResetPasswordOptions as aK, type RevokeSessionOptions as aL, type SendOtpData as aM, type SendTwoFactorOtpData as aN, type SendTwoFactorOtpOptions as aO, type SendVerificationOtpOptions as aP, type SessionState as aQ, type SessionStore as aR, type SetActiveOrganizationOptions as aS, type SetActiveTeamOptions as aT, type SignOutData as aU, type SocialAccount as aV, type SocialAuthData as aW, type SocialIdTokenOptions as aX, type SocialSignInOptions as aY, type TokenClient as aZ, type TwoFactorBackupCodesData as a_, type MagicLinkSignInOptions as aa, type Organization as ab, type OrganizationClient as ac, type OrganizationDetails as ad, type OrganizationFilterOperator as ae, type OrganizationInvitation as af, type OrganizationInvitationActionOptions as ag, type OrganizationInvitationDetails as ah, type OrganizationInvitationStatus as ai, type OrganizationMember as aj, type OrganizationMemberUser as ak, type OrganizationMemberWithUser as al, type OrganizationMembersData as am, type OrganizationRoleSummary as an, type OrganizationSelector as ao, type OrganizationTeam as ap, type OrganizationTeamMember as aq, type OrganizationUserInvitation as ar, type PasskeyAuthData as as, type PasskeySignInOptions as at, type PasswordResetData as au, type PhoneAuthUser as av, type PhoneOtpStartData as aw, type PhoneOtpStartOptions as ax, type PhoneOtpVerifyData as ay, type PhoneOtpVerifyOptions as az, type AcceptOrganizationInvitationData as b, type TwoFactorRedirectData as b0, type TwoFactorStatusData as b1, type TwoFactorVerifyData as b2, type UnlinkSocialOptions as b3, type UpdateOrganizationMemberRoleOptions as b4, type UpdateOrganizationOptions as b5, type UpdateOrganizationTeamOptions as b6, type UpdatePasskeyData as b7, type UpdatePasskeyOptions as b8, type UpdateProfileOptions as b9, type UpdateUnsafeMetadataOptions as ba, type UserMetadata as bb, type UsernameSignInOptions as bc, type VerifyBackupCodeOptions as bd, type VerifyEmailOtpData as be, type VerifyEmailOtpOptions as bf, type VerifyTotpOptions as bg, type VerifyTwoFactorOtpOptions as bh, type WaitlistJoinData as bi, type WaitlistJoinOptions as bj, acceptConsent as bk, captureInvitationClaim as bl, clearInvitationClaim as bm, createAuthOwlClient as bn, createTokenClient as bo, getConsentStatus as bp, getPublicConfig as bq, readInvitationClaim as br, resolveProjectCapabilities as bs, createAuthHttpClient as bt, type AuthHttpClient as bu, type AccountClient as c, type AccountSession as d, type AccountStatusData as e, type ActionFetchOptions as f, type AddOrganizationTeamMemberOptions as g, type AddPasskeyOptions as h, type AuthActionResult as i, type AuthClientError as j, type AuthErrorContext as k, type AuthOwlClient as l, type AuthOwlErrorCode as m, type AuthPasskey as n, type AuthRequestContext as o, type AuthResponseContext as p, type AuthSession as q, type AuthUser as r, type ChangePasswordData as s, type ChangePasswordOptions as t, type ConsentAcceptResult as u, type ConsentStatus as v, type CreateOrganizationOptions as w, type CreateOrganizationTeamOptions as x, type DeleteAccountOptions as y, type DeleteOrganizationOptions as z };
+export { type EmailAuthData as $, type ActionFetchOptions as A, type AccountClient as B, type CreatePrivacyRightsRequestOptions as C, type AccountSession as D, type AccountStatusData as E, type AddOrganizationTeamMemberOptions as F, type AuthErrorContext as G, type AuthOwlErrorCode as H, type AuthRequestContext as I, type AuthResponseContext as J, type ChangeEmailOptions as K, type ChangePasswordData as L, type ChangePasswordOptions as M, type ConsentAcceptResult as N, type Organization as O, type PublicConfig as P, type ConsentStatus as Q, type RecordPrivacyConsentOptions as R, type SocialIdTokenOptions as S, type CreateOrganizationOptions as T, type CreateOrganizationTeamOptions as U, type DeleteAccountData as V, type DeleteAccountOptions as W, type DeleteOrganizationOptions as X, type DeletePasskeyData as Y, type DeletePasskeyOptions as Z, type DisableTwoFactorOptions as _, type AuthActionResult as a, type SendTwoFactorOtpOptions as a$, type EmailOtpAuthData as a0, type EmailOtpSignInOptions as a1, type EmailOtpType as a2, type EmailSignInOptions as a3, type EmailSignUpData as a4, type EmailSignUpOptions as a5, type EnableTwoFactorOptions as a6, type EnvironmentType as a7, type GenerateBackupCodesOptions as a8, type GetOrganizationInvitationOptions as a9, type OrganizationMember as aA, type OrganizationMemberUser as aB, type OrganizationMemberWithUser as aC, type OrganizationMembersData as aD, type OrganizationRoleSummary as aE, type OrganizationSelector as aF, type OrganizationTeam as aG, type OrganizationTeamMember as aH, type OrganizationUserInvitation as aI, type PasswordResetData as aJ, type PhoneAuthUser as aK, type PhoneOtpStartData as aL, type PhoneOtpStartOptions as aM, type PhoneOtpVerifyData as aN, type PhoneOtpVerifyOptions as aO, type RejectOrganizationInvitationData as aP, type RemoveOrganizationMemberData as aQ, type RemoveOrganizationMemberOptions as aR, type RemoveOrganizationTeamData as aS, type RemoveOrganizationTeamMemberData as aT, type RemoveOrganizationTeamMemberOptions as aU, type RemoveOrganizationTeamOptions as aV, type RequestPasswordResetOptions as aW, type ResetPasswordOptions as aX, type RevokeSessionOptions as aY, type SendOtpData as aZ, type SendTwoFactorOtpData as a_, type GetOrganizationOptions as aa, type GetToken as ab, type GetTokenOptions as ac, INVITATION_CLAIM_MAX_AGE_MS as ad, INVITATION_QUERY_PARAM as ae, type InvitationClaim as af, type InvitationRecipientHint as ag, type InviteOrganizationMemberOptions as ah, type JsonObject as ai, type JsonPrimitive as aj, type JsonValue as ak, type LeaveOrganizationOptions as al, type LinkSocialData as am, type LinkSocialOptions as an, type ListOrganizationInvitationsOptions as ao, type ListOrganizationMembersOptions as ap, type ListOrganizationRolesOptions as aq, type ListOrganizationTeamMembersOptions as ar, type ListOrganizationTeamsOptions as as, type MagicLinkData as at, type MagicLinkSignInOptions as au, type OrganizationFilterOperator as av, type OrganizationInvitation as aw, type OrganizationInvitationActionOptions as ax, type OrganizationInvitationDetails as ay, type OrganizationInvitationStatus as az, type AuthOwlClient as b, type SendVerificationOtpOptions as b0, type SetActiveTeamOptions as b1, type SignOutData as b2, type SocialAccount as b3, type SocialSignInOptions as b4, type TokenClient as b5, type TwoFactorBackupCodesData as b6, type TwoFactorEnableData as b7, type TwoFactorRedirectData as b8, type TwoFactorStatusData as b9, type TwoFactorVerifyData as ba, type UnlinkSocialOptions as bb, type UpdateOrganizationMemberRoleOptions as bc, type UpdateOrganizationOptions as bd, type UpdateOrganizationTeamOptions as be, type UpdatePasskeyData as bf, type UpdatePasskeyOptions as bg, type UpdateProfileOptions as bh, type UpdateUnsafeMetadataOptions as bi, type UserMetadata as bj, type UsernameSignInOptions as bk, type VerifyBackupCodeOptions as bl, type VerifyEmailOtpData as bm, type VerifyEmailOtpOptions as bn, type VerifyTotpOptions as bo, type VerifyTwoFactorOtpOptions as bp, type WaitlistJoinData as bq, type WaitlistJoinOptions as br, acceptConsent as bs, captureInvitationClaim as bt, clearInvitationClaim as bu, createAuthOwlClient as bv, createTokenClient as bw, getConsentStatus as bx, readInvitationClaim as by, type PasskeySignInOptions as c, type PasskeyAuthData as d, type AddPasskeyOptions as e, type AuthPasskey as f, type AuthClientError as g, type AuthSession as h, type AuthUser as i, type OrganizationClient as j, type OrganizationDetails as k, type PrivacyClient as l, type PrivacyConsentPreference as m, type PrivacyConsentState as n, type PrivacyLocale as o, type PrivacyRightState as p, type PrivacyRightType as q, type PrivacyRightsRequest as r, type SessionState as s, type SessionStore as t, type SetActiveOrganizationOptions as u, type SocialAuthData as v, getPublicConfig as w, type PhoneOtpChallengeData as x, type AkedlyShieldStartProof as y, type AcceptOrganizationInvitationData as z };

package/dist/cookie-BqcfagTw.d.cts

@@ -0,0 +1,30 @@
+/**
+ * The exact session-cookie name the auth server sets for a given project.
+ *
+ * Single source of truth for the cookie name across the SDK. The server
+ * (the AuthOwl server project factory) configures
+ * `advanced.cookiePrefix = "p_" + <projectId without dashes>` and
+ * `useSecureCookies` in production; the auth engine then names the session
+ * cookie `${securePrefix}${cookiePrefix}.session_token`, where `securePrefix`
+ * is `__Secure-` for secure cookies and empty otherwise:
+ *
+ *   dev  (http):  p_<idNoDashes>.session_token
+ *   prod (https): __Secure-p_<idNoDashes>.session_token
+ *
+ * Verified 2026-07-06 against the auth engine's `getCookies()` with the server's
+ * real config (see CONTRACTS section 5 and `cookie.test.ts`). Note the engine
+ * joins the prefix and name with a dot (`.`), not an underscore, and uses the
+ * `__Secure-` (not `__Host-`) prefix - both are easy to get wrong by hand, and
+ * getting them wrong makes `auth()` forward a cookie the server never set. If an
+ * auth-engine upgrade changes cookie naming, re-verify and update this function,
+ * the `cookie.test.ts` fixtures, and CONTRACTS section 5 together.
+ *
+ * `secure` must reflect the SERVER's cookie mode: callers holding the auth API
+ * URL derive it from the protocol (`https:` => secure). Callers that cannot
+ * know it (the UX-only redirect middleware) should check both variants.
+ */
+declare function sessionCookieName(projectId: string, opts?: {
+    secure?: boolean;
+}): string;
+
+export { sessionCookieName as s };