@authowl/core 0.21.0 → 0.22.0

package/README.md

@@ -140,6 +140,51 @@ redirects, abort after five seconds, stream at most 64 KiB, and accept at most
 `code`; authorization helpers `has()` and `hasPermission()` continue to fail
 closed for token failures while surfacing configuration failures.
 
+Token purpose is enforced together with the JOSE media type. The general
+verifier accepts declared `session`, `template`, and `access` tokens, rejects ID
+tokens by default, and requires `typ: at+jwt` for access tokens (`typ: JWT` for
+every other purpose). Use `tokenUse: 'access'` to narrow an API verifier to one
+kind, and `requireTokenUse: true` after every issuer in your estate emits the
+claim. Legacy tokens without `token_use` remain temporarily compatible only
+when their `typ` is `JWT`. The authority helpers `has()`, `hasPermission()`,
+`requirePermission()`, `requireGrant()`, and `requireOrg()` always require a
+session token, even if a broader verifier configuration is supplied.
+
+For route handlers, prefer the throwing gates so a forgotten boolean check
+cannot accidentally allow the request:
+
+```ts
+import {
+  isAuthorizationError,
+  requirePermission,
+} from '@authowl/core/server';
+
+try {
+  const identity = await requirePermission(bearerToken, 'org:invoices:read');
+
+  const invoice = await db.invoice.find(invoiceId);
+  if (
+    identity.claims.org_id !== organizationId
+    || invoice.organizationId !== organizationId
+    || invoice.userId !== identity.sub
+  ) {
+    return new Response('Forbidden', { status: 403 });
+  }
+} catch (error) {
+  if (isAuthorizationError(error)) {
+    return new Response(error.message, { status: error.status });
+  }
+  throw error;
+}
+```
+
+`requireAuth`, `requirePermission`, `requireGrant`, and `requireOrg` return a
+verified identity or throw `AuthorizationError`. Missing and invalid tokens
+share one 401 response. A verified caller without the required authority gets
+403. JWKS outages and server misconfiguration remain operational errors rather
+than being mislabeled as bad credentials. These gates verify identity and token
+claims only - your query must still enforce tenant scope and resource ownership.
+
 ## Headless account and organization management
 
 Use the AuthOwl-owned `account` and `organization` namespaces when you are
@@ -191,11 +236,17 @@ to sign in again and retry the action. Organization ownership conflicts return
 `ORGANIZATION_LAST_OWNER`. Disabled and cross-project resources return 404.
 Public metadata is server-authored. Unsafe metadata is end-user-owned and must
 be treated as untrusted. Private metadata has no browser SDK surface.
-Durable browser session tokens stay in HttpOnly cookies and never appear in
-`@authowl/react`'s `useSession()`, action results, or `listSessions()`. Core
-exposes only the framework-neutral `client.sessionStore`. Session management uses
-stable session ids. This is distinct from `getToken()`, which intentionally
-mints a short-lived backend JWT and caches it in memory only.
+Durable browser session tokens stay in HttpOnly cookies whenever the browser
+proves that its cross-site partition keeps them. A browser that blocks that
+cookie receives a bearer fallback bound at mint time to a non-extractable P-256
+key stored for the tenant application's origin. Every later request carries a
+fresh method-, URL-, and token-bound proof, so copying the token alone is not
+enough to replay the session. Losing the browser key revokes only that session
+and requires sign-in again. No token appears in `@authowl/react`'s
+`useSession()`, action results, or `listSessions()`. Core exposes only the
+framework-neutral `client.sessionStore`. Session management uses stable session
+ids. This is distinct from `getToken()`, which intentionally mints a short-lived
+backend JWT and caches it in memory only.
 
 ## Protected public-auth actions
 

package/dist/{chunk-Y2VJN76I.js → chunk-6GILD4LY.js}

@@ -1 +1 @@
-import {a}from'./chunk-5NL5GJW6.js';import {p,o,i,q as q$1,y,r,t,z,s,w,B as B$1,E as E$1,x,A,v,u}from'./chunk-V3MSLXXB.js';import {a as a$1}from'./chunk-T5SH3ZZP.js';function to(e){let t=e?.enabledMethods??["password"],n=t.includes("password"),i=t.includes("passkey"),o=e?.authentication,a=e?.mfa;return {emailSignUp:o?.email.signUp??t.some(p=>p==="password"||p==="magic_link"||p==="email_otp"),passwordSignUp:o?.password.signUp??n,phoneSignUp:o?.phone.signUp??t.includes("phone_otp"),passwordSignIn:o?.email.signIn.includes("password")??n,passwordMinLength:o?.password.minLength??8,passwordMaxLength:o?.password.maxLength??128,magicLinkSignIn:o?.email.signIn.includes("magic_link")??t.includes("magic_link"),emailOtpSignIn:o?.email.signIn.includes("email_otp")??t.includes("email_otp"),phoneSignIn:o?.phone.signIn??t.includes("phone_otp"),usernameSignIn:o?.username.signIn??false,collectUsername:o?.username.collectOnSignUp??false,passkeySignIn:o?.passkey.signIn??i,passkeyAdd:o?.passkey.add??i,firstLastName:e?.userModel?.firstLastName??false,emailChange:e===null?false:e.userModel?.emailChange??true,accountDeletion:e?.userModel?.accountDeletion??e?.accountDeletion??false,emailVerificationRequired:e?.emailVerification?.required??e?.requireEmailVerification??false,emailVerificationMethod:e?.emailVerification?.method??"link",totp:a?.totp??e?.twoFactor??false,mfaRequired:a?.required??e?.mfaRequired??false,backupCodes:a?.backupCodes??e?.twoFactor??false,legacyNameField:e?.authentication===void 0}}var he=class extends Error{status;requestId;constructor(t,n,i){super(`${t} request failed with status ${n.status}.`),this.name="AuthOwlHttpError",this.status=n.status,this.requestId=i;}};function oe(e,t,n={}){let i=new Headers(n.init?.headers);return i.set("x-publishable-key",e.publishableKey),p({fetchImpl:e.fetch,url:t,init:{...n.init,headers:i},allowHttpLoopback:e.decoded.env==="test",...n.timeoutMs===void 0?{}:{timeoutMs:n.timeoutMs},...n.maxResponseBytes===void 0?{}:{maxResponseBytes:n.maxResponseBytes},...n.decode===void 0?{}:{decode:n.decode}})}function Be(e,t){if(!e.response.ok)throw new he(t,e.response,e.requestId);return e.data}var L=new Map,Tn=/^[a-z]{2}$/;function ro(e,t){if(typeof window>"u")return ()=>{};if(t===null)return L.delete(e),()=>{};let n=t.trim().toLowerCase();if(!Tn.test(n))return ()=>{};let i=Symbol(e),o=L.get(e)??[];return o.push({token:i,locale:n}),L.set(e,o),()=>{let a=L.get(e);if(!a)return;let p=a.filter(m=>m.token!==i);p.length===0?L.delete(e):L.set(e,p);}}function je(e){return typeof window>"u"?null:L.get(e)?.at(-1)?.locale??null}var Pn="x-authowl-turnstile-token",Cn="x-authowl-locale",zn=1e4,Dn=32,xn=2e4;function q(e,t){return {post:(n,i,o,a)=>e.request(n,{method:"POST",body:i,fetchOptions:o,decode:a}),mutation:async(n,i)=>{let o=await n;return o.error===null&&(i===void 0||o.data!==null&&i(o.data))&&t(),o}}}function be(e,t=e.projectBaseURL){return {async request(n,i$1={}){let o$1=Un(t,n,i$1.query),a=i$1.method??(i$1.body===void 0?"GET":"POST"),p=new Headers(i$1.fetchOptions?.headers);i$1.fetchOptions?.authChallengeToken&&p.set(Pn,i$1.fetchOptions.authChallengeToken);let m=je(e.decoded.projectId);m&&p.set(Cn,m),i$1.body!==void 0&&p.set("content-type","application/json");let l={method:a,headers:p,credentials:i$1.credentials??"include",...i$1.body===void 0?{}:{body:JSON.stringify(i$1.body)}},h=Object.freeze({method:a,path:n});await i$1.fetchOptions?.onRequest?.(h);let r=Nn(a,i$1.fetchOptions),s;try{s=await En(e,o$1,{...l,signal:i$1.fetchOptions?.signal},r);}catch(b){let C=Je(b);return await i$1.fetchOptions?.onError?.(Ae(h,C,Ln(b))),{data:null,error:C}}let{response:f,requestId:y}=s,u=Hn(n,s.data),g=u;if(f.ok)try{g=Oe(u),i$1.decode&&(g=i$1.decode(g));}catch{let b=Je(new o("invalid_response",y));return await i$1.fetchOptions?.onError?.(Ae(h,b,"invalid_response")),{data:null,error:b}}let A=Object.freeze({...h,status:f.status,...y===void 0?{}:{requestId:y}});if(await i$1.fetchOptions?.onResponse?.(A),!f.ok){let b=Mn(f,u,y);return b.code===i&&e.session.tokens.dropChallenge(),await i$1.fetchOptions?.onError?.(Ae(h,b,"api")),{data:null,error:b}}return await i$1.fetchOptions?.onSuccess?.(A),{data:g,error:null}}}}async function En(e,t,n,i){let o$1=Date.now()+zn;for(let a=0;a<i;a+=1){let p=o$1-Date.now();if(p<=0)throw new o("timeout");try{let m=await oe(e,t,{init:n,timeoutMs:Math.max(1,Math.ceil(p))});if(m.response.status<500||a===i-1)return m}catch(m){if(a===i-1||!(m instanceof o)||m.kind!=="network")throw m}await Fn(50*2**a,n.signal,o$1);}throw new o("network")}function Nn(e,t){if(e!=="GET"||t?.authChallengeToken)return 1;let n=t?.retry;return typeof n!="number"||!Number.isFinite(n)?1:Math.min(Math.max(Math.trunc(n),0),3)+1}function Un(e,t,n){let i=new URL(`${e}${t.startsWith("/")?t:`/${t}`}`);for(let[o,a]of Object.entries(n??{}))a!==void 0&&i.searchParams.set(o,String(a));return i.toString()}function Mn(e,t,n){let i=G(t)?t:{},o=_n(i,e.headers);return {status:e.status,statusText:e.statusText,code:typeof i.code=="string"?i.code:void 0,...n===void 0?{}:{requestId:n},...typeof i.current_version=="number"?{currentVersion:i.current_version}:{},...o!==void 0?{retryAfterSeconds:o}:{},message:typeof i.message=="string"?i.message:typeof i.error=="string"?i.error:typeof i.detail=="string"?i.detail:e.statusText||"Request failed"}}function _n(e,t){let n=(typeof e.retryAfterSeconds=="number"&&Number.isFinite(e.retryAfterSeconds)?e.retryAfterSeconds:void 0)??Ge(t.get("retry-after"))??Ge(t.get("x-retry-after"));if(n!==void 0)return Math.min(Math.max(Math.trunc(n),1),86400)}function Ge(e){if(!e)return;let t=e.trim();if(!/^\d+$/.test(t))return;let n=Number(t);return Number.isFinite(n)?n:void 0}function Je(e){let t=e instanceof o?e.kind:"network";return {status:0,...{aborted:{statusText:"ABORTED",code:"REQUEST_ABORTED",message:"The request was cancelled."},timeout:{statusText:"TIMEOUT",code:"REQUEST_TIMEOUT",message:"The request timed out."},response_too_large:{statusText:"INVALID_RESPONSE",code:"RESPONSE_TOO_LARGE",message:"The service response was too large."},invalid_response:{statusText:"INVALID_RESPONSE",code:"INVALID_RESPONSE",message:"The service returned an invalid response."},network:{statusText:"FETCH_ERROR",code:"FETCH_ERROR",message:"Network request failed."}}[t],...e instanceof o&&e.requestId?{requestId:e.requestId}:{}}}function Ae(e,t,n){return Object.freeze({...e,status:t.status??0,...t.requestId===void 0?{}:{requestId:t.requestId},failure:n})}function Ln(e){return e instanceof o?e.kind:"network"}function Fn(e,t,n){return new Promise((i,o$1)=>{if(t?.aborted){o$1(new o("aborted"));return}let a=n-Date.now();if(a<=0){o$1(new o("timeout"));return}let p=Math.min(e,a),m=()=>{clearTimeout(l),o$1(new o("aborted"));},l=setTimeout(()=>{t?.removeEventListener("abort",m),Date.now()>=n?o$1(new o("timeout")):i();},p);t?.addEventListener("abort",m,{once:true}),t?.aborted&&m();})}function Oe(e,t="",n=0,i={nodes:0}){if(i.nodes+=1,n>Dn||i.nodes>xn)throw new Error("response traversal limit exceeded");if(typeof e=="string"&&/^(?:createdAt|updatedAt|expiresAt)$/.test(t)){let o=new Date(e);return Number.isNaN(o.getTime())?e:o}return Array.isArray(e)?e.map(o=>Oe(o,"",n+1,i)):G(e)?Object.fromEntries(Object.entries(e).map(([o,a])=>[o,qn(o)?a:Oe(a,o,n+1,i)])):e}function qn(e){return e==="metadata"||e==="public_metadata"||e==="unsafe_metadata"||e==="private_metadata"||e==="publicMetadata"||e==="unsafeMetadata"||e==="privateMetadata"}function Hn(e,t){if(e==="/list-sessions"&&Array.isArray(t))return t.map(o=>G(o)?ye(o):o);if(!G(t))return t;let i=e==="/change-password"||e==="/passkey/verify-authentication"||e==="/phone-otp/verify"||e==="/sign-up/email"||e.startsWith("/sign-in/")||e.startsWith("/two-factor/verify-")?ye(t):t;return e==="/sign-up/email"&&!("sessionCreated"in i)&&(i={...i,sessionCreated:typeof t.token=="string"&&t.token.length>0}),(e==="/get-session"||e==="/passkey/verify-authentication")&&G(i.session)&&(i={...i,session:ye(i.session)}),i}function ye(e){if(!Object.hasOwn(e,"token"))return e;let t={...e};return delete t.token,t}function G(e){return !!e&&typeof e=="object"&&!Array.isArray(e)}function We(e){return {listConsentPreferences:t=>e.request("/privacy/consent-decisions",{fetchOptions:t,decode:Vn}),recordConsent:(t,n)=>e.request("/privacy/consent-decisions",{method:"POST",body:{...t,correlationId:t.correlationId??a()},fetchOptions:n,decode:Bn}),listRightsRequests:t=>e.request("/privacy/rights",{fetchOptions:t,decode:jn}),createRightsRequest:(t,n)=>e.request("/privacy/rights",{method:"POST",body:t,fetchOptions:n,decode:Gn})}}function Vn(e){let t=q$1(e);return Array.isArray(t.preferences)||y(),{preferences:t.preferences.map(Kn)}}function Kn(e){let t=q$1(e);return {purposeId:r(t.purposeId),purposeVersionId:r(t.purposeVersionId),code:r(t.code),state:Jn(t.state,["granted","refused","withdrawn"]),updatedAt:re(t.updatedAt),decidedAt:re(t.decidedAt)}}function Bn(e){let t=q$1(e);return t.recorded!==true&&y(),{recorded:true,decision:J(t.decision,["granted","refused","withdrawn"]),decidedAt:ae(t.decidedAt)}}function jn(e){let t=q$1(e);return Array.isArray(t.requests)||y(),{requests:t.requests.map(Xe)}}function Gn(e){return {request:Xe(q$1(e).request)}}function Xe(e){let t=q$1(e);return {id:r(t.id),rightType:J(t.rightType,["access","correction","portability","erasure","restriction","objection","consent_withdrawal"]),state:J(t.state,["received","identity_pending","in_progress","restricted","completed","denied","withdrawn"]),locale:J(t.locale,["en","ar"]),receivedAt:ae(t.receivedAt),acknowledgedAt:re(t.acknowledgedAt),fulfilmentDeadline:ae(t.fulfilmentDeadline),completedAt:re(t.completedAt)}}function re(e){return e===null?null:ae(e)}function ae(e){if(e instanceof Date)return t(e);typeof e!="string"&&y();let t$1=new Date(e);return Number.isNaN(t$1.getTime())&&y(),t$1}function J(e,t){return (typeof e!="string"||!t.includes(e))&&y(),e}function Jn(e,t){return e===null?null:J(e,t)}function Ye({http:e,probe:t,tokens:n,channelName:i}){let o=new Set,a=null,p=null,m=null,l=null,h=null,r=null,s,f=O=>{g(O);};s={data:null,isPending:true,isRefetching:false,error:null,refetch:f};function y(O){s=O;for(let v of o)v();}async function u(O){return e.request("/get-session",{query:O?.query,decode:we})}function g(O){if(O?.query?.disableCookieCache===true)return b(O);if(l)return l;if(h)return h;let v=b(O).finally(()=>{h===v&&(h=null);});return h=v,v}function A(){if(l)return l;let O=b({query:{disableCookieCache:true}}).finally(()=>{l===O&&(l=null);});return l=O,O}async function b(O){m?.abort();let v=new AbortController;m=v,y({...s,isPending:s.data===null&&s.error===null,isRefetching:s.data!==null});let j=n.beginRead(),ee=await e.request("/get-session",{query:O?.query,fetchOptions:{signal:v.signal},decode:we});if(m===v&&(m=null,y({data:ee.data,error:ee.error,isPending:false,isRefetching:false,refetch:f}),ee.error===null)){if(ee.data===null){j.endIfDead();return}await C(j);}}async function C(O){if(n.needsProbe()){if(!O.carriedToken){O.recordCookieVerdict(true);return}return r||_e(O)}}function _e(O){let v=t.request("/get-session",{query:{disableCookieCache:true},decode:we}).then(j=>{r===v&&j.error===null&&O.recordCookieVerdict(j.data!==null);}).finally(()=>{r===v&&(r=null);});return r=v,v}function Le(){a?.postMessage({type:"session-changed"});}function Sn(){if(typeof window>"u"||p)return;let O=()=>{g();},v=()=>{document.visibilityState==="visible"&&g();};window.addEventListener("focus",O),document.addEventListener("visibilitychange",v),typeof BroadcastChannel<"u"&&(a=new BroadcastChannel(i),a.addEventListener("message",O)),p=()=>{window.removeEventListener("focus",O),document.removeEventListener("visibilitychange",v),a?.close(),a=null,p=null;};}function vn(O){return o.add(O),o.size===1&&(Sn(),g()),()=>{if(o.delete(O),o.size===0){let v=m;m=null,h=null,l=null,v?.abort(),p?.();}}}return n.measureWith(()=>{n.needsProbe()&&_e(n.beginRead());}),{store:{subscribe:vn,getSnapshot:()=>s,refresh:A},getSession:u,notifyMutation(){Le(),r&&r.catch(()=>{}).then(()=>{!n.needsProbe()&&n.hasToken()&&Le();}),o.size>0&&g({query:{disableCookieCache:true}});}}}function we(e){if(e===null)return null;let t=q$1(e);return (t.session===void 0||t.user===void 0)&&y(),{session:x(t.session),user:w(t.user)}}async function $e(e,t){return e.request("/user/metadata",{fetchOptions:t,decode:Ze})}async function Qe(e,t,n){return e.request("/user/metadata",{method:"PATCH",body:{expected_version:t.expectedVersion,unsafe_metadata:t.unsafeMetadata},fetchOptions:n,decode:Ze})}function Ze(e){let t=q$1(e),n=z(t.public_metadata),i=z(t.unsafe_metadata);if(!Number.isSafeInteger(t.metadata_version)||t.metadata_version<0)throw new TypeError("Invalid AuthOwl metadata response");return {publicMetadata:n,unsafeMetadata:i,metadataVersion:t.metadata_version}}function tt(e,t){let{post:n,mutation:i}=q(e,t);return {getMetadata:o=>$e(e,o),updateUnsafeMetadata:(o,a)=>Qe(e,o,a),updateProfile:(o,a)=>i(n("/update-user",o,a,W)),changeEmail:(o,a)=>i(n("/change-email",o,a,W)),changePassword:(o,a)=>i(n("/change-password",o,a,Wn)),listSessions:o=>e.request("/list-sessions",{fetchOptions:o,decode:Xn}),revokeSession:({sessionId:o},a)=>i(n("/revoke-session",{sessionId:o},a,W)),revokeOtherSessions:o=>i(n("/revoke-other-sessions",{},o,W)),listSocialAccounts:async o=>{let a=await e.request("/list-accounts",{fetchOptions:o,decode:Yn});if(!a.data)return {data:null,error:a.error};let p=a.data.length>1;return {...a,data:a.data.filter(m=>m.providerId!=="credential").map(m=>({...m,canUnlink:p}))}},linkSocial:(o,a)=>n("/link-social",o,a,$n),unlinkSocial:(o,a)=>i(n("/unlink-account",o,a,W)),delete:(o={},a)=>i(n("/delete-user",o,a,Qn))}}function W(e){let t=q$1(e);return {status:s(t.status)}}function Wn(e){let t=q$1(e);return {user:w(t.user)}}function Xn(e){return Array.isArray(e)||y(),e.map(t$1=>{let n=q$1(t$1);return {id:r(n.id),userId:r(n.userId),createdAt:t(n.createdAt),updatedAt:t(n.updatedAt),expiresAt:t(n.expiresAt),...et("ipAddress",v(n,"ipAddress")),...et("userAgent",v(n,"userAgent"))}})}function Yn(e){return Array.isArray(e)||y(),e.map(t$1=>{let n=q$1(t$1);return {id:r(n.id),userId:r(n.userId),providerId:r(n.providerId),accountId:r(n.accountId),scopes:u(n.scopes),createdAt:t(n.createdAt),updatedAt:t(n.updatedAt)}})}function $n(e){let t=q$1(e);return {url:r(t.url),redirect:s(t.redirect)}}function Qn(e){let t=q$1(e);return {success:s(t.success),message:r(t.message)}}function et(e,t){return t===void 0?{}:{[e]:t}}var Zn=new Set(["pending","accepted","rejected","canceled"]),ke=1e4;function nt(e){let t=q$1(e);return t.recipientHint!==null&&t.recipientHint!=="new_user"&&y(),{recipientHint:t.recipientHint}}function H(e,t$1,n){let i=q$1(e),o={id:k(i.id),name:k(i.name),slug:k(i.slug),createdAt:t(i.createdAt),...X("logo",v(i,"logo")),...X("metadata",i.metadata===void 0?void 0:A(i.metadata))};return E(o.id,t$1),E(o.slug,n),o}function it(e){return U(e,H)}function Re(e,t,n){return e===null?null:(t===null&&y(),H(e,t,n))}function ot(e,t,n){if(e===null)return null;let i=q$1(e),o=H(i,t,n);return {...o,members:U(i.members,a=>ht(a,o.id)),invitations:U(i.invitations,a=>M(a,void 0,o.id))}}function Ie(e,t,n=false){let i=U(e,o=>Y(o));return n||Q(i.map(o=>o.organizationId),t),i}function rt(e,t){let n=U(e,i=>Se(i));return Q(n.map(i=>i.teamId),t),n}function Se(e,t$1,n){let i=q$1(e),o={id:k(i.id),teamId:k(i.teamId),userId:k(i.userId),createdAt:t(i.createdAt)};return E(o.teamId,t$1),E(o.userId,n),o}function at(e,t,n){return e===null?null:(t===null&&y(),Y(e,t,n))}function st(e,t){let n=q$1(e);return (!Number.isSafeInteger(n.total)||n.total<0)&&y(),{members:ei(n.members,t),total:n.total}}function M(e,t$1,n){let i=q$1(e),o=k(i.status);Zn.has(o)||y();let a={id:k(i.id),organizationId:k(i.organizationId),email:$(i.email),role:k(i.role),status:o,inviterId:k(i.inviterId),expiresAt:t(i.expiresAt),createdAt:t(i.createdAt)};return E(a.id,t$1),E(a.organizationId,n),a}function ut(e,t){let n=U(e,i=>M(i));return Q(n.map(i=>i.organizationId),t),n}function ct(e){return U(e,t=>{let n=q$1(t);return {...M(n),organizationName:$(n.organizationName)}})}function dt(e,t){let n=q$1(e);return {...M(n,t),organizationName:k(n.organizationName),organizationSlug:k(n.organizationSlug),inviterEmail:At(n.inviterEmail)}}function lt(e,t){let n=q$1(e),i=M(n.invitation,t);return {invitation:i,member:V(n.member,void 0,i.organizationId)}}function pt(e,t){let n=q$1(e);return n.member!==null&&y(),{invitation:n.invitation===null?null:M(n.invitation,t),member:null}}function gt(e,t){return e===null?null:M(e,t)}function ft(e,t,n){let i=q$1(e);return {member:V(i.member,n,t)}}function V(e,t$1,n){let i=q$1(e),o={id:k(i.id),organizationId:k(i.organizationId),userId:k(i.userId),role:k(i.role),createdAt:t(i.createdAt),...i.user===void 0?{}:{user:yt(i.user)}};return E(o.id,t$1),E(o.organizationId,n),o}function mt(e,t){let n=U(e,i=>{let o=q$1(i);return {organizationId:k(o.organizationId),data:{role:k(o.role),...X("permission",o.permission===void 0?void 0:ti(o.permission)),...X("customPermissionKeys",o.customPermissionKeys===void 0?void 0:u(o.customPermissionKeys))}}});return Q(n.map(i=>i.organizationId),t),n.map(i=>i.data)}function Y(e,t$1,n){let i=q$1(e),o=i.updatedAt,a={id:k(i.id),name:$(i.name),organizationId:k(i.organizationId),createdAt:t(i.createdAt),...o===void 0?{}:{updatedAt:t(o)}};return E(a.id,t$1),E(a.organizationId,n),a}function ve(e){let t=q$1(e);return {message:$(t.message)}}function ht(e,t){let n=q$1(e);return {...V(n,void 0,t),user:yt(n.user)}}function ei(e,t){let n=U(e,i=>ht(i));return Q(n.map(i=>i.organizationId),t),n}function ti(e){let t=q$1(e),n={};for(let[i,o]of Object.entries(t))(i==="__proto__"||i==="constructor"||i==="prototype"||i.length===0||i.length>ke||!Array.isArray(o))&&y(),n[i]=o.map(a=>k(a));return n}function k(e){let t=r(e);return (t.length===0||t.length>ke)&&y(),t}function $(e){if(e==null)return "";let t=r(e);return t.length>ke&&y(),t}function At(e){return e===null?null:k(e)}function E(e,t){t!==void 0&&e!==t&&y();}function Q(e,t){let n=t??e[0];n!==void 0&&e.some(i=>i!==n)&&y();}function yt(e){let t=q$1(e);return {id:k(t.id),name:$(t.name),email:At(t.email),...X("image",v(t,"image"))}}function U(e,t){return Array.isArray(e)||y(),e.map(n=>t(n))}function X(e,t){return t===void 0?{}:{[e]:t}}function Ot(e,t,n=()=>null){let{post:i,mutation:o}=q(e,t),a=new Set,p=()=>{for(let r of a)try{r();}catch{}},m=new Map,l=(r,s,f,y)=>{if(f)return e.request(r,{query:s,fetchOptions:f,decode:y});let u=`${r}\0${JSON.stringify(s??null)}`,g=m.get(u);if(g)return g;let A=e.request(r,{query:s,decode:y}).finally(()=>{m.delete(u);});return m.set(u,A),A},h=async r=>{let s=await o(r).finally(()=>m.clear());return s.error===null&&p(),s};return {subscribe(r){return a.add(r),()=>a.delete(r)},create:(r,s)=>h(i("/organization/create",r,s,H)),list:r=>l("/organization/list",void 0,r,it),get:(r={},s)=>l("/organization/get-full-organization",{organizationId:r.organizationId,organizationSlug:r.organizationSlug,membersLimit:r.membersLimit},s,f=>ot(f,r.organizationId,r.organizationSlug)),setActive:(r,s)=>h(i("/organization/set-active",r,s,f=>Re(f,r.organizationId,r.organizationSlug))),createTeam:(r,s)=>h(i("/organization/create-team",r,s,f=>Y(f,void 0,r.organizationId))),listTeams:(r={},s)=>l("/organization/list-teams",{organizationId:r.organizationId},s,f=>Ie(f,r.organizationId)),updateTeam:(r,s)=>h(i("/organization/update-team",r,s,f=>Y(f,r.teamId,r.data.organizationId))),removeTeam:(r,s)=>h(i("/organization/remove-team",r,s,ve)),listUserTeams:r=>l("/organization/list-user-teams",void 0,r,s=>Ie(s,void 0,true)),listTeamMembers:(r={},s)=>l("/organization/list-team-members",{teamId:r.teamId},s,f=>rt(f,r.teamId)),addTeamMember:(r,s)=>h(i("/organization/add-team-member",r,s,f=>Se(f,r.teamId,r.userId))),removeTeamMember:(r,s)=>h(i("/organization/remove-team-member",r,s,ve)),setActiveTeam:(r,s)=>h(i("/organization/set-active-team",r,s,f=>at(f,r.teamId))),update:(r,s)=>h(i("/organization/update",r,s,f=>Re(f,r.organizationId))),delete:(r,s)=>h(i("/organization/delete",r,s,f=>H(f,r.organizationId))),listMembers:(r={},s)=>l("/organization/list-members",{organizationId:r.organizationId,organizationSlug:r.organizationSlug,limit:r.limit,offset:r.offset,sortBy:r.sortBy,sortDirection:r.sortDirection,filterField:r.filterField,filterValue:r.filterValue,filterOperator:r.filterOperator},s,f=>st(f,r.organizationId)),inviteMember:(r,s)=>h(i("/organization/invite-member",r,s,f=>M(f,void 0,r.organizationId))),listInvitations:(r={},s)=>l("/organization/list-invitations",{organizationId:r.organizationId},s,f=>ut(f,r.organizationId)),listUserInvitations:r=>l("/organization/list-user-invitations",void 0,r,ct),getInvitation:(r,s)=>l("/organization/get-invitation",{id:r.id},s,f=>dt(f,r.id)),getInvitationRecipientHint:(r,s)=>l("/organization/invitation-recipient-hint",{invitationId:r.invitationId},s,nt),acceptInvitation:(r,s)=>h(i("/organization/accept-invitation",r,s,f=>lt(f,r.invitationId))),rejectInvitation:(r,s)=>h(i("/organization/reject-invitation",r,s,f=>pt(f,r.invitationId))),cancelInvitation:(r,s)=>h(i("/organization/cancel-invitation",r,s,f=>gt(f,r.invitationId))),removeMember:(r,s)=>h(i("/organization/remove-member",r,s,f=>ft(f,r.organizationId,r.memberIdOrEmail.includes("@")?void 0:r.memberIdOrEmail))),updateMemberRole:(r,s)=>h(i("/organization/update-member-role",r,s,f=>V(f,r.memberId,r.organizationId))),leave:(r,s)=>h(i("/organization/leave",r,s,f=>V(f,void 0,r.organizationId))),listRoles:(r={},s)=>l("/organization/list-roles",{organizationId:r.organizationId},s,f=>mt(f,r.organizationId)),has:r=>E$1(n(),r),hasPermission:r=>B$1(n(),r.permission)}}var bt=4096,ni=4096,ii=100,oi=256,ri=16,ai=64,si=12;function Pe(e){let t=q$1(e);return t.twoFactorRedirect===true?((t.user!==void 0||t.redirect!==void 0||t.url!==void 0)&&y(),{twoFactorRedirect:true,...t.twoFactorMethods===void 0?{}:{twoFactorMethods:Lt(t.twoFactorMethods,ri,ai)}}):(t.twoFactorRedirect!==void 0&&y(),{redirect:s(t.redirect),...pi(t,"url"),user:w(t.user)})}function wt(e){let t=q$1(e);return {user:w(t.user)}}function kt(e){let t=q$1(e);return {sessionCreated:s(t.sessionCreated),user:w(t.user)}}function Rt(e,t){let n=q$1(e),i=s(n.redirect);n.user===null&&y();let o=n.user!==void 0&&n.user!==null,a=n.url!==void 0&&n.url!==null;return i?((o||!a)&&y(),{redirect:true,url:Te(n.url,t)}):(o===a&&y(),o?{redirect:false,user:w(n.user)}:{redirect:false,url:Te(n.url,t)})}function It(e,t){let n=q$1(e);return (n.redirect!==true||n.user!==void 0)&&y(),{redirect:true,url:Te(n.url,t)}}function St(e){return {status:s(q$1(e).status)}}function vt(e){return {success:s(q$1(e).success)}}function Tt(e){return q$1(e).status!=="pending"&&y(),{status:"pending"}}function Pt(e){let t=q$1(e);if(t.kind==="authowl_turnstile")return {kind:"authowl_turnstile"};t.kind!=="akedly_shield_v1_2"&&y();let n=q$1(t.turnstile),i=n.siteKey===null?null:r(n.siteKey);return {kind:"akedly_shield_v1_2",connectionId:r(t.connectionId),challenge:r(t.challenge),difficulty:ui(t.difficulty),challengeToken:r(t.challengeToken),challengeRequired:s(t.challengeRequired),turnstile:{required:s(n.required),siteKey:i}}}function ui(e){return (!Number.isSafeInteger(e)||Number(e)<0||Number(e)>si)&&y(),Number(e)}function Ct(e){let t=q$1(e);return (t.status!==true||t.sessionCreated!==true)&&y(),{status:true,sessionCreated:true,user:ci(t.user)}}function Ce(e){return {status:s(q$1(e).status)}}function zt(e){return {status:s(q$1(e).status)}}function Dt(e){let t=q$1(e);return {status:s(t.status),user:w(t.user)}}function xt(e){return {success:s(q$1(e).success)}}function Et(e){let t=q$1(e);return {totpURI:li(t.totpURI),backupCodes:_t(t.backupCodes)}}function Nt(e){return {status:s(q$1(e).status)}}function se(e){return q$1(e).status!==true&&y(),{status:true}}function Ut(e){return {status:s(q$1(e).status)}}function Mt(e){let t=q$1(e);return t.status!==void 0&&t.status!==true&&y(),{backupCodes:_t(t.backupCodes)}}function ci(e){let t$1=q$1(e);return {id:K(t$1.id,512),...gi(t$1,"name",1024),phoneNumber:K(t$1.phoneNumber,64),phoneNumberVerified:s(t$1.phoneNumberVerified),...t$1.createdAt===void 0?{}:{createdAt:t(t$1.createdAt)},...t$1.updatedAt===void 0?{}:{updatedAt:t(t$1.updatedAt)}}}function Te(e,t){let n=K(e,bt);/[\u0000-\u0020\u007f]/u.test(n)&&y();let i;try{i=new URL(n);}catch{return y()}return (i.username||i.password)&&y(),i.protocol==="https:"||t&&i.protocol==="http:"&&di(i.hostname)?i.href:y()}function di(e){let t=e.toLowerCase();return t==="localhost"||t==="127.0.0.1"||t==="[::1]"}function li(e){let t=K(e,ni),n;try{n=new URL(t);}catch{return y()}let i=n.searchParams.get("secret");return (n.protocol!=="otpauth:"||n.hostname.toLowerCase()!=="totp"||n.username||n.password||n.hash||i===null||i.length===0||i.length>512||/\s/u.test(i))&&y(),t}function _t(e){return Lt(e,ii,oi)}function Lt(e,t,n){(!Array.isArray(e)||e.length===0||e.length>t)&&y();let i=e.map(o=>K(o,n));return i.some(o=>o.trim().length===0)&&y(),new Set(i).size!==i.length&&y(),i}function K(e,t){let n=r(e);return (n.length===0||n.length>t)&&y(),n}function pi(e,t){let n=e[t];return n==null?{}:{[t]:K(n,bt)}}function gi(e,t,n){let i=v(e,t);return i===void 0?{}:(i!==null&&i.length>n&&y(),{[t]:i})}var Ft=new Set([1564,8206,8207,8234,8235,8236,8237,8238,8294,8295,8296,8297]),ue=new Set([9,10,11,12,13,32,133,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288,65279]);function ce(e){if(e===void 0)return {valid:true,value:void 0};for(let n of e){let i=n.codePointAt(0);if(i===void 0||Ht(n,i)||qt(i)||Ft.has(i))return {valid:false}}let t=fi(e);return ze(t)?{valid:true,value:t}:{valid:false}}function ze(e){let t=0,n,i;for(let o of e){if(t+=1,t>256)return  false;let a=o.codePointAt(0);if(a===void 0||Ht(o,a)||qt(a)||Ft.has(a))return  false;n??=a,i=a;}return t>0&&n!==void 0&&i!==void 0&&!ue.has(n)&&!ue.has(i)}function de(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_PASSKEY_NAME",message:"Passkey names must contain 1 to 256 safe Unicode characters."}}}function fi(e){let t=0,n=e.length;for(;t<n;){let i=e.codePointAt(t);if(i===void 0||!ue.has(i))break;t+=i>65535?2:1;}for(;n>t;){let i=e.codePointAt(n-1);if(i===void 0)break;let a=i>=56320&&i<=57343?n-2:n-1,p=e.codePointAt(a);if(p===void 0||!ue.has(p))break;n=a;}return e.slice(t,n)}function qt(e){return e>=0&&e<=31||e>=127&&e<=159}function Ht(e,t){return e.length===1&&t>=55296&&t<=57343}var Bt=12,jt=5e3,mi=8,hi=1e3,Ai=16,Vt=512,Gt=100,Jt=8192,yi=32768,De=1024,Kt=256,Ee=64,Oi=6e5,bi=/^[A-Za-z0-9_-]+$/u,wi=/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u,ki=/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u,Ri=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/u,Ii=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu,Wt=new Set(["discouraged","preferred","required"]),Si=new Set(["singleDevice","multiDevice"]),Xt=new Set(["ble","cable","hybrid","internal","nfc","smart-card","usb"]),Yt=new Set(["hybrid","security-key","client-device"]),vi=new Set(["none","indirect","direct","enterprise"]),Ti=new Set(["fido-u2f","packed","android-safetynet","android-key","tpm","apple","none"]),Pi=new Set(["platform","cross-platform"]),Ci=new Set(["discouraged","preferred","required"]),zi=new Set([-8,-7,-257]);function $t(e){let t=z(e,Bt,jt);return {challenge:un(t.challenge),...T("timeout",an(t.timeout)),...T("rpId",cn(t.rpId)),...T("allowCredentials",rn(t.allowCredentials)),...T("userVerification",Z(t.userVerification,Wt)),...T("hints",le(t.hints,Yt)),...T("extensions",sn(t.extensions))}}function Qt(e){let t=z(e,Bt,jt);return {challenge:un(t.challenge),rp:Di(t.rp),user:xi(t.user),pubKeyCredParams:Ei(t.pubKeyCredParams),...T("timeout",an(t.timeout)),...T("excludeCredentials",rn(t.excludeCredentials)),...T("authenticatorSelection",Ni(t.authenticatorSelection)),...T("attestation",Z(t.attestation,vi)),...T("attestationFormats",le(t.attestationFormats,Ti)),...T("hints",le(t.hints,Yt)),...T("extensions",sn(t.extensions))}}function Zt(e){let t=q$1(e),n=x(t.session),i=w(t.user);return n.userId!==i.id&&y(),{session:n,user:i}}function Ne(e){let t$1=q$1(e),n=t$1.counter;(!Number.isSafeInteger(n)||n<0)&&y();let i=Ue(t$1.deviceType,Si),o=s(t$1.backedUp);return o&&i!=="multiDevice"&&y(),{id:B(t$1.id,Kt),..._i(t$1),publicKey:Ui(t$1.publicKey,yi),userId:B(t$1.userId,Kt),credentialID:ge(t$1.credentialID,Jt),counter:n,deviceType:i,backedUp:o,...Li(t$1),createdAt:t(t$1.createdAt),...Fi(t$1)}}function en(e,t,n){let i=Ne(e);return (i.credentialID!==t||(n===void 0?i.name!==void 0&&i.name!==null:i.name!==n))&&y(),i}function tn(e){(!Array.isArray(e)||e.length>Gt)&&y();let t=e.map(Ne);return pe(t.map(n=>n.id)),pe(t.map(n=>n.credentialID)),t.length>1&&t.some(n=>n.userId!==t[0]?.userId)&&y(),t}function nn(e,t,n){let i=q$1(e),o=Ne(i.passkey);return (o.id!==t||o.name!==n)&&y(),{passkey:o}}function on(e){return q$1(e).status!==true&&y(),{status:true}}function Di(e){let t=q$1(e);return {name:xe(t.name,De),...T("id",cn(t.id))}}function xi(e){let t=q$1(e);return {id:ge(t.id,128,1,64),name:xe(t.name,De),displayName:xe(t.displayName,De)}}function Ei(e){(!Array.isArray(e)||e.length===0||e.length>Ee)&&y();let t=e.map(n=>{let i=q$1(n);return (i.type!=="public-key"||!Number.isSafeInteger(i.alg)||!zi.has(i.alg))&&y(),{type:"public-key",alg:i.alg}});return qi(t.map(n=>n.alg)),t}function rn(e){if(e===void 0)return;(!Array.isArray(e)||e.length>Gt)&&y();let t=e.map(n=>{let i=q$1(n);return i.type!=="public-key"&&y(),{type:"public-key",id:ge(i.id,Jt),...T("transports",le(i.transports,Xt))}});return pe(t.map(n=>n.id)),t}function Ni(e){if(e===void 0)return;let t=q$1(e);t.requireResidentKey!==void 0&&typeof t.requireResidentKey!="boolean"&&y();let n=Z(t.residentKey,Ci);return t.requireResidentKey!==void 0&&n!==void 0&&t.requireResidentKey!==(n==="required")&&y(),{...T("authenticatorAttachment",Z(t.authenticatorAttachment,Pi)),...T("residentKey",n),...T("requireResidentKey",t.requireResidentKey),...T("userVerification",Z(t.userVerification,Wt))}}function an(e){return e!==void 0&&(typeof e!="number"||!Number.isFinite(e)||e<0||e>Oi)&&y(),e}function sn(e){return e===void 0?void 0:z(e,mi,hi)}function le(e,t){if(e===void 0)return;(!Array.isArray(e)||e.length>Ee)&&y();let n=e.map(i=>Ue(i,t));return pe(n),n}function Z(e,t){if(e!==void 0)return Ue(e,t)}function un(e){return ge(e,Math.ceil(Vt*4/3),Ai,Vt)}function ge(e,t,n=1,i=Number.POSITIVE_INFINITY){let o=B(e,t),a=o.length%4,p=Mi(o.at(-1)??""),m=Math.floor(o.length*3/4);return (!bi.test(o)||a===1||a===2&&(p&15)!==0||a===3&&(p&3)!==0||m<n||m>i)&&y(),o}function B(e,t){let n=r(e);return (n.length===0||n.length>t)&&y(),n}function xe(e,t){let n=B(e,t);return ki.test(n)&&y(),n}function cn(e){if(e===void 0)return;let t=B(e,253);return t!=="localhost"&&(t.endsWith(".")||!t.includes(".")||t.split(".").some(n=>!Ri.test(n)))&&y(),t}function Ui(e,t){let n=B(e,t),i=n.endsWith("=="),o=!i&&n.endsWith("="),a=n.at(i?-3:o?-2:-1)??"",p=dn(a);return (n.length%4!==0||!wi.test(n)||i&&(p&15)!==0||o&&(p&3)!==0)&&y(),n}function Mi(e){return dn(e,true)}function dn(e,t=false){return (t?"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/").indexOf(e)}function _i(e){let t=v(e,"name");return t===void 0?{}:(t!==null&&!ze(t)&&y(),{name:t})}function Li(e){let t=v(e,"transports");if(t==null||t==="")return t===void 0?{}:{transports:t};let n=t.split(",");return (n.length>Ee||n.some(i=>!Xt.has(i))||new Set(n).size!==n.length)&&y(),{transports:t}}function Fi(e){let t=v(e,"aaguid");return t==null?t===void 0?{}:{aaguid:null}:(Ii.test(t)||y(),{aaguid:t})}function Ue(e,t){let n=r(e);return t.has(n)||y(),n}function T(e,t){return t===void 0?{}:{[e]:t}}function pe(e){new Set(e).size!==e.length&&y();}function qi(e){new Set(e).size!==e.length&&y();}function Hi(e,t){if(!t)return e;let n=t.catch(()=>{});return n.then(()=>{n=null;}),{async request(i,o){return n&&await n,e.request(i,o)}}}var ln=new Map;function Vi(e,t,n){let i=ln.get(n);if(!i){let o=new URLSearchParams(window.location.hash.slice(1)).get("authowl_code");if(!o)return;i=import('./session-handoff-6FBH3GFJ.js').then(a=>a.completeCrossSiteSignIn(e,t,o)),ln.set(n,i);}return i}function pn(e){return !a$1()||e.idToken||e.disableRedirect?"legacy":"first-party"}function Ki(e,t=()=>{},n=Gi){let i=be(e),o=e.session.tokens,a$2=a$1()?Vi(i,o,e.decoded.projectId):void 0,p=Hi(i,a$2),m=Ye({http:p,probe:be({...e,fetch:e.session.probe}),tokens:o,channelName:`authowl:${e.decoded.projectId}`}),l=n(p,m.notifyMutation),h=()=>{m.notifyMutation(),t();},{post:r,mutation:s}=q(p,h),f=e.decoded.env==="test",y=u=>{o.beginSession({remember:u?.rememberMe!==false});};return {sessionStore:m.store,getSession:m.getSession,account:tt(p,h),organization:Ot(p,h,()=>m.store.getSnapshot().data?.session.membership??null),privacy:We(p),signIn:{email:(u,g)=>(y(u),s(r("/sign-in/email",u,g,Pe),A=>!("twoFactorRedirect"in A))),username:(u,g)=>(y(u),s(r("/sign-in/username",u,g,Pe),A=>!("twoFactorRedirect"in A))),social:async(u,g)=>{if(y(),pn(u)==="first-party"){let{beginCrossSiteSignIn:b}=await import('./session-handoff-6FBH3GFJ.js'),C=await b(e,{kind:"social",provider:u.provider,callbackURL:u.callbackURL,errorCallbackURL:u.errorCallbackURL,newUserCallbackURL:u.newUserCallbackURL,scopes:u.scopes,loginHint:u.loginHint,requestSignUp:u.requestSignUp});if(C)return window.location.assign(C),{data:{redirect:true,url:C},error:null}}let A=await s(r("/sign-in/social",u,g,b=>Rt(b,f)),b=>"user"in b);return A.error!==null||A.data===null||"url"in A.data&&A.data.redirect&&!u.disableRedirect&&typeof window<"u"&&window.location.assign(A.data.url),A},sso:async(u,g)=>{if(pn(u)==="first-party"){let{beginCrossSiteSignIn:b}=await import('./session-handoff-6FBH3GFJ.js'),C=await b(e,{kind:"sso",email:u.email,providerId:u.providerId,domain:u.domain,organizationSlug:u.organizationSlug,callbackURL:u.callbackURL,errorCallbackURL:u.errorCallbackURL,newUserCallbackURL:u.newUserCallbackURL});if(C)return window.location.assign(C),{data:{url:C,redirect:true},error:null}}let A=await r("/sign-in/sso",u,g,b=>It(b,f));return A.error!==null||A.data===null||typeof window<"u"&&window.location.assign(A.data.url),A},magicLink:(u,g)=>r("/sign-in/magic-link",u,g,St),emailOtp:(u,g)=>(y(),s(r("/sign-in/email-otp",u,g,wt))),passkey:(u,g)=>(y(),l.signIn(u,g))},signUp:{email:(u,g)=>(y(),s(r("/sign-up/email",u,g,kt),A=>A.sessionCreated))},emailOtp:{sendVerificationOtp:(u,g)=>r("/email-otp/send-verification-otp",u,g,vt),verifyEmail:(u,g)=>(y(),s(r("/email-otp/verify-email",u,g,Dt)))},phoneOtp:{prepare:u=>r("/phone-otp/challenge",{},u,Pt),start:(u,g)=>r("/phone-otp/start",{...u,idempotencyKey:u.idempotencyKey??a()},g,Tt),verify:(u,g)=>(y(),s(r("/phone-otp/verify",u,g,Ct)))},requestPasswordReset:(u,g)=>r("/request-password-reset",u,g,Ce),resetPassword:(u,g)=>r("/reset-password",u,g,Ce),sendVerificationEmail:(u,g)=>r("/send-verification-email",u,g,zt),passkey:{addPasskey:(u,g)=>l.add(u,g),listUserPasskeys:()=>p.request("/passkey/list-user-passkeys",{decode:tn}),updatePasskey:async(u,g)=>{let A=ce(u.name);if(!A.valid||A.value===void 0)return de();let b=A.value;return r("/passkey/update-passkey",{...u,name:b},g,C=>nn(C,u.id,b))},deletePasskey:(u,g)=>r("/passkey/delete-passkey",u,g,on)},twoFactor:{enable:(u,g)=>r("/two-factor/enable",u,g,Et),disable:(u,g)=>s(r("/two-factor/disable",u,g,Nt),A=>A.status),verifyTotp:(u,g)=>s(r("/two-factor/verify-totp",u,g,se)),verifyBackupCode:(u,g)=>s(r("/two-factor/verify-backup-code",u,g,se)),sendOtp:(u={},g)=>r("/two-factor/send-otp",u,g,Ut),verifyOtp:(u,g)=>s(r("/two-factor/verify-otp",u,g,se)),generateBackupCodes:(u,g)=>r("/two-factor/generate-backup-codes",u,g,Mt)},signOut:u=>s(p.request("/sign-out",{method:"POST",body:{},fetchOptions:u,decode:xt}).then(g=>(o.endSession(),g)),g=>g.success)}}function Go(e,t=()=>{},n){let i=Ki(e,t,n);return n?{...i,signIn:{email:i.signIn.email,username:i.signIn.username,social:gn(i),magicLink:i.signIn.magicLink,emailOtp:i.signIn.emailOtp,passkey:i.signIn.passkey},passkey:{listUserPasskeys:i.passkey.listUserPasskeys,updatePasskey:i.passkey.updatePasskey,deletePasskey:i.passkey.deletePasskey,addPasskey:i.passkey.addPasskey}}:{...i,signIn:{email:i.signIn.email,username:i.signIn.username,social:gn(i),magicLink:i.signIn.magicLink,emailOtp:i.signIn.emailOtp},passkey:{listUserPasskeys:i.passkey.listUserPasskeys,updatePasskey:i.passkey.updatePasskey,deletePasskey:i.passkey.deletePasskey}}}function gn(e){return async(t,n)=>{if(!t?.idToken||typeof t.idToken.token!="string"||t.idToken.token==="")return Bi();let i=await e.signIn.social({...t,disableRedirect:true},n);return i.data!==null&&"url"in i.data?ji():i}}function Bi(){return Promise.resolve({data:null,error:{status:400,statusText:"BAD_REQUEST",code:"NATIVE_SOCIAL_ID_TOKEN_REQUIRED",message:"Native social sign-in requires a provider ID token."}})}function ji(){return Promise.resolve({data:null,error:{status:502,statusText:"BAD_GATEWAY",code:"INVALID_NATIVE_SOCIAL_RESPONSE",message:"The server returned a redirect for native ID-token sign-in."}})}function Gi(){return {signIn:()=>fn(),add:()=>fn()}}function fn(){return Promise.resolve({data:null,error:{status:400,statusText:"BAD_REQUEST",code:"PASSKEY_BROWSER_REQUIRED",message:"This passkey ceremony requires a browser with WebAuthn."}})}function Yo(e,t,n){let i=new Map;return {async signIn(o={},a){let p=await e.request("/passkey/generate-authenticate-options");if(!p.data)return An(p.error);let m;try{m=$t(p.data);}catch{return mn()}let l;try{l=await n.authenticate({optionsJSON:m,useBrowserAutofill:o.autoFill});}catch(y){return yn(n,y,"AUTH_CANCELLED","Passkey authentication was cancelled.")}if(!Ji(l))return hn();let{clientExtensionResults:h,...r}=l,s=i.get(l.id);if(s)return s;let f=(async()=>{let y=await e.request("/passkey/verify-authentication",{method:"POST",body:{response:r},fetchOptions:a,decode:Zt});return y.data&&t(),y})();i.set(l.id,f);try{return await f}finally{i.get(l.id)===f&&i.delete(l.id);}},async add(o={},a){let p=ce(o.name);if(!p.valid)return de();let m=await e.request("/passkey/generate-register-options",{query:{name:p.value,authenticatorAttachment:o.authenticatorAttachment}});if(!m.data)return An(m.error);let l;try{l=Qt(m.data);}catch{return mn()}let h;try{h=await n.register({optionsJSON:l});}catch(y){return yn(n,y,"REGISTRATION_CANCELLED","Passkey registration was cancelled.")}if(!Wi(h))return hn();let{clientExtensionResults:r,...s}=h,f=await e.request("/passkey/verify-registration",{method:"POST",body:{response:s,name:p.value},fetchOptions:a,decode:y=>en(y,h.id,p.value)});return f.data&&t(),f}}}function mn(){return {data:null,error:{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned invalid WebAuthn options."}}}function hn(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_WEBAUTHN_RESPONSE",message:"The platform returned an invalid passkey response."}}}function bn(e){if(!e||typeof e!="object")return  false;let t=e;return typeof t.id=="string"&&t.id.length>0&&typeof t.rawId=="string"&&t.rawId.length>0&&t.type==="public-key"&&!!t.response&&typeof t.response=="object"}function Ji(e){if(!bn(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.authenticatorData=="string"&&typeof t.signature=="string"&&(t.userHandle===void 0||typeof t.userHandle=="string")}function Wi(e){if(!bn(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.attestationObject=="string"}function An(e){return {data:null,error:e??{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned no WebAuthn options."}}}function yn(e,t,n,i){let o=Yi(t,"page does not have focus"),a=e.errorCode?.(t),p=a!==void 0?a==="ERROR_CEREMONY_ABORTED":On(t)==="AbortError",m=n!=="AUTH_CANCELLED",l=Xi(a,On(t),m);return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:o?"PASSKEY_PAGE_NOT_FOCUSED":p?n:a??"PASSKEY_BROWSER_ERROR",message:o?"Keep this page focused while completing the passkey prompt.":p?i:l}}}function Xi(e,t,n){switch(e){case "ERROR_INVALID_DOMAIN":case "ERROR_INVALID_RP_ID":return "Passkeys are not set up for this site\u2019s domain.";case "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED":return "This device already has a passkey for this account.";case "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEY_ALGS":case "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT":case "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT":return "This device cannot create a passkey for this site.";}return t==="NotAllowedError"?n?"No passkey was created. The prompt was dismissed or timed out.":"No passkey was used. This device may not have one saved for this site yet, or the prompt was dismissed.":t==="SecurityError"?"Passkeys are not set up for this site\u2019s domain.":n?"Passkey registration did not complete.":"Passkey sign-in did not complete."}function On(e){return e&&typeof e=="object"&&"name"in e&&typeof e.name=="string"?e.name:void 0}function Yi(e,t){let n=t.toLowerCase(),i=new Set,o=e;for(;o&&typeof o=="object"&&!i.has(o);){if(i.add(o),"message"in o&&typeof o.message=="string"&&o.message.toLowerCase().includes(n))return  true;o="cause"in o?o.cause:void 0;}return  false}async function er(e){let n=`${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}/public-config`;return Be(await oe(e,n,{init:{method:"GET",credentials:"omit"},maxResponseBytes:256*1024,decode:i=>$i(i,e)}),"public-config")}function $i(e,t){let n=z(e),i=n.environmentId,o=n.environmentType,a=`${new URL(t.apiUrl).origin}/api/projects/${t.decoded.projectId}/auth`;if(typeof n.applicationId!="string"||!Me(n.applicationId)||i!==t.decoded.projectId||o!=="development"&&o!=="production"||n.authBaseUrl!==a)throw P();let p=S(n.branding),m=S(n.legal);if(!F(n.enabledMethods,64)||!F(n.socialProviders,64)||!In(p,["appName","logoUrl","primaryColor"])||p.showAppName!==void 0&&typeof p.showAppName!="boolean"||p.alignment!==void 0&&p.alignment!=="left"&&p.alignment!=="center"&&p.alignment!=="right"||p.theme!==void 0&&p.theme!=="light"&&p.theme!=="dark"&&p.theme!=="system"||!In(m,["termsUrl","privacyUrl"])||!Number.isSafeInteger(m.version)||m.version<0||typeof m.required!="boolean")throw P();if(n.socialProviderClientIds!==void 0){let l=S(n.socialProviderClientIds);if(Object.keys(l).length>64||Object.values(l).some(h=>typeof h!="string"||h.length>2048))throw P()}if(!_(n,["requireEmailVerification","twoFactor","mfaRequired","accountDeletion","organizations","sso","badge"])||!wn(n.turnstileSiteKey)||!wn(n.authTurnstileSiteKey)||typeof n.locale!="string"||n.locale.length===0||n.locale.length>64||!Number.isSafeInteger(n.configVersion)||n.configVersion<0)throw P();if(n.jwtIssuer!==null){let l=S(n.jwtIssuer);if(l.issuer!==a||l.jwksUrl!==`${a}/jwks`||l.aud!==t.decoded.projectId)throw P()}if(n.signUp!==void 0){let l=S(n.signUp).mode;if(typeof l!="string"||!["open","restricted","allowlist","waitlist"].includes(l))throw P()}if(n.authentication!==void 0&&Qi(n.authentication),n.privacy!==void 0&&Zi(n.privacy),n.emailVerification!==void 0){let l=S(n.emailVerification);if(!_(l,["required"])||l.method!=="link"&&l.method!=="code")throw P()}if(n.userModel!==void 0&&!_(S(n.userModel),["requireEmail","firstLastName","emailChange","accountDeletion"]))throw P();if(n.mfa!==void 0){let l=S(n.mfa);if(!_(l,["totp","required","backupCodes"])||(l.required===true||l.backupCodes===true)&&l.totp!==true)throw P()}if(n.captcha===void 0||n.captcha===null)n.captcha=typeof n.authTurnstileSiteKey=="string"&&n.authTurnstileSiteKey.length>0?{provider:"turnstile",siteKey:n.authTurnstileSiteKey}:null;else {let l=S(n.captcha);if(typeof l.provider!="string"||l.provider.length===0||l.provider.length>64||typeof l.siteKey!="string"||l.siteKey.length===0||l.siteKey.length>512)throw P();n.captcha={provider:l.provider,siteKey:l.siteKey};}return n}function Me(e){return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}function P(){return new TypeError("public-config returned an invalid response")}function S(e){if(!e||typeof e!="object"||Array.isArray(e))throw P();return e}function wn(e){return e===null||typeof e=="string"&&e.length<=4096}function Qi(e){let t=S(e),n=S(t.email),i=S(t.password),o=i.minLength!==void 0||i.maxLength!==void 0;if(!_(n,["signUp"])||!F(n.signIn,3)||n.signIn.some(a=>a!=="password"&&a!=="magic_link"&&a!=="email_otp")||!_(S(t.phone),["signUp","signIn"])||!_(i,["signUp","add"])||o&&(!Number.isSafeInteger(i.minLength)||!Number.isSafeInteger(i.maxLength)||i.minLength<1||i.maxLength>4096||i.minLength>i.maxLength)||!_(S(t.passkey),["signIn","add"])||!eo(S(t.passkey).relyingPartyId)||!_(S(t.username),["collectOnSignUp","signIn"]))throw P()}function Zi(e){let t=S(e);if(!Array.isArray(t.notices)||!Array.isArray(t.consentPurposes)||t.notices.length>64||t.consentPurposes.length>64)throw P();for(let n of t.notices){let i=S(n);if(kn(i,"noticeId","noticeVersionId"),fe(i.title,512),fe(i.body,1e5),Rn(i.digest),!F(i.activityCodes,128)||!F(i.purposeCodes,128)||typeof i.effectiveFrom!="string"||!Number.isFinite(Date.parse(i.effectiveFrom)))throw P()}for(let n of t.consentPurposes){let i=S(n);if(kn(i,"purposeId","purposeVersionId"),fe(i.title,512),fe(i.description,1e4),Rn(i.digest),!F(i.activityCodes,128)||!F(i.dataCategories,128))throw P()}}function kn(e,t,n){if(typeof e[t]!="string"||!Me(e[t])||typeof e[n]!="string"||!Me(e[n])||typeof e.code!="string"||!/^[a-z][a-z0-9_]{0,63}$/.test(e.code)||!Number.isSafeInteger(e.version)||e.version<1)throw P()}function fe(e,t){let n=S(e);if(typeof n.en!="string"||n.en.length===0||n.en.length>t||typeof n.ar!="string"||n.ar.length===0||n.ar.length>t)throw P()}function Rn(e){let t=S(e);if(typeof t.en!="string"||!/^[a-f0-9]{64}$/.test(t.en)||typeof t.ar!="string"||!/^[a-f0-9]{64}$/.test(t.ar))throw P()}function eo(e){return e==null||typeof e=="string"}function _(e,t){return t.every(n=>typeof e[n]=="boolean")}function In(e,t){return t.every(n=>e[n]===void 0||typeof e[n]=="string"&&e[n].length<=4096)}function F(e,t){return Array.isArray(e)&&e.length<=t&&e.every(n=>typeof n=="string"&&n.length<=128)&&new Set(e).size===e.length}export{to as a,he as b,oe as c,Be as d,ro as e,je as f,Pn as g,Cn as h,be as i,We as j,Ki as k,Go as l,Yo as m,er as n};
+import {a}from'./chunk-5NL5GJW6.js';import {p,o,i,q as q$1,y,r,t,z,s,w,B as B$1,E as E$1,x,A,v,u}from'./chunk-IB6TFQFD.js';import {a as a$1}from'./chunk-T5SH3ZZP.js';function to(e){let t=e?.enabledMethods??["password"],n=t.includes("password"),i=t.includes("passkey"),o=e?.authentication,a=e?.mfa;return {emailSignUp:o?.email.signUp??t.some(p=>p==="password"||p==="magic_link"||p==="email_otp"),passwordSignUp:o?.password.signUp??n,phoneSignUp:o?.phone.signUp??t.includes("phone_otp"),passwordSignIn:o?.email.signIn.includes("password")??n,passwordMinLength:o?.password.minLength??8,passwordMaxLength:o?.password.maxLength??128,magicLinkSignIn:o?.email.signIn.includes("magic_link")??t.includes("magic_link"),emailOtpSignIn:o?.email.signIn.includes("email_otp")??t.includes("email_otp"),phoneSignIn:o?.phone.signIn??t.includes("phone_otp"),usernameSignIn:o?.username.signIn??false,collectUsername:o?.username.collectOnSignUp??false,passkeySignIn:o?.passkey.signIn??i,passkeyAdd:o?.passkey.add??i,firstLastName:e?.userModel?.firstLastName??false,emailChange:e===null?false:e.userModel?.emailChange??true,accountDeletion:e?.userModel?.accountDeletion??e?.accountDeletion??false,emailVerificationRequired:e?.emailVerification?.required??e?.requireEmailVerification??false,emailVerificationMethod:e?.emailVerification?.method??"link",totp:a?.totp??e?.twoFactor??false,mfaRequired:a?.required??e?.mfaRequired??false,backupCodes:a?.backupCodes??e?.twoFactor??false,legacyNameField:e?.authentication===void 0}}var he=class extends Error{status;requestId;constructor(t,n,i){super(`${t} request failed with status ${n.status}.`),this.name="AuthOwlHttpError",this.status=n.status,this.requestId=i;}};function oe(e,t,n={}){let i=new Headers(n.init?.headers);return i.set("x-publishable-key",e.publishableKey),p({fetchImpl:e.fetch,url:t,init:{...n.init,headers:i},allowHttpLoopback:e.decoded.env==="test",...n.timeoutMs===void 0?{}:{timeoutMs:n.timeoutMs},...n.maxResponseBytes===void 0?{}:{maxResponseBytes:n.maxResponseBytes},...n.decode===void 0?{}:{decode:n.decode}})}function Be(e,t){if(!e.response.ok)throw new he(t,e.response,e.requestId);return e.data}var L=new Map,Pn=/^[a-z]{2}$/;function ro(e,t){if(typeof window>"u")return ()=>{};if(t===null)return L.delete(e),()=>{};let n=t.trim().toLowerCase();if(!Pn.test(n))return ()=>{};let i=Symbol(e),o=L.get(e)??[];return o.push({token:i,locale:n}),L.set(e,o),()=>{let a=L.get(e);if(!a)return;let p=a.filter(m=>m.token!==i);p.length===0?L.delete(e):L.set(e,p);}}function je(e){return typeof window>"u"?null:L.get(e)?.at(-1)?.locale??null}var Tn="x-authowl-turnstile-token",Cn="x-authowl-locale",zn=1e4,Dn=32,xn=2e4;function q(e,t){return {post:(n,i,o,a)=>e.request(n,{method:"POST",body:i,fetchOptions:o,decode:a}),mutation:async(n,i)=>{let o=await n;return o.error===null&&(i===void 0||o.data!==null&&i(o.data))&&t(),o}}}function be(e,t=e.projectBaseURL){return {async request(n,i$1={}){let o$1=Un(t,n,i$1.query),a=i$1.method??(i$1.body===void 0?"GET":"POST"),p=new Headers(i$1.fetchOptions?.headers);i$1.fetchOptions?.authChallengeToken&&p.set(Tn,i$1.fetchOptions.authChallengeToken);let m=je(e.decoded.projectId);m&&p.set(Cn,m),i$1.body!==void 0&&p.set("content-type","application/json");let d={method:a,headers:p,credentials:i$1.credentials??"include",...i$1.body===void 0?{}:{body:JSON.stringify(i$1.body)}},h=Object.freeze({method:a,path:n});await i$1.fetchOptions?.onRequest?.(h);let r=Nn(a,i$1.fetchOptions),s;try{s=await En(e,o$1,{...d,signal:i$1.fetchOptions?.signal},r);}catch(b){let C=Je(b);return await i$1.fetchOptions?.onError?.(Ae(h,C,Ln(b))),{data:null,error:C}}let{response:f,requestId:y}=s,u=Hn(n,s.data),g=u;if(f.ok)try{g=Oe(u),i$1.decode&&(g=i$1.decode(g));}catch{let b=Je(new o("invalid_response",y));return await i$1.fetchOptions?.onError?.(Ae(h,b,"invalid_response")),{data:null,error:b}}let A=Object.freeze({...h,status:f.status,...y===void 0?{}:{requestId:y}});if(await i$1.fetchOptions?.onResponse?.(A),!f.ok){let b=Mn(f,u,y);return b.code===i&&e.session.tokens.dropChallenge(),await i$1.fetchOptions?.onError?.(Ae(h,b,"api")),{data:null,error:b}}return await i$1.fetchOptions?.onSuccess?.(A),{data:g,error:null}}}}async function En(e,t,n,i){let o$1=Date.now()+zn;for(let a=0;a<i;a+=1){let p=o$1-Date.now();if(p<=0)throw new o("timeout");try{let m=await oe(e,t,{init:n,timeoutMs:Math.max(1,Math.ceil(p))});if(m.response.status<500||a===i-1)return m}catch(m){if(a===i-1||!(m instanceof o)||m.kind!=="network")throw m}await Fn(50*2**a,n.signal,o$1);}throw new o("network")}function Nn(e,t){if(e!=="GET"||t?.authChallengeToken)return 1;let n=t?.retry;return typeof n!="number"||!Number.isFinite(n)?1:Math.min(Math.max(Math.trunc(n),0),3)+1}function Un(e,t,n){let i=new URL(`${e}${t.startsWith("/")?t:`/${t}`}`);for(let[o,a]of Object.entries(n??{}))a!==void 0&&i.searchParams.set(o,String(a));return i.toString()}function Mn(e,t,n){let i=G(t)?t:{},o=_n(i,e.headers);return {status:e.status,statusText:e.statusText,code:typeof i.code=="string"?i.code:void 0,...n===void 0?{}:{requestId:n},...typeof i.current_version=="number"?{currentVersion:i.current_version}:{},...o!==void 0?{retryAfterSeconds:o}:{},message:typeof i.message=="string"?i.message:typeof i.error=="string"?i.error:typeof i.detail=="string"?i.detail:e.statusText||"Request failed"}}function _n(e,t){let n=(typeof e.retryAfterSeconds=="number"&&Number.isFinite(e.retryAfterSeconds)?e.retryAfterSeconds:void 0)??Ge(t.get("retry-after"))??Ge(t.get("x-retry-after"));if(n!==void 0)return Math.min(Math.max(Math.trunc(n),1),86400)}function Ge(e){if(!e)return;let t=e.trim();if(!/^\d+$/.test(t))return;let n=Number(t);return Number.isFinite(n)?n:void 0}function Je(e){let t=e instanceof o?e.kind:"network";return {status:0,...{aborted:{statusText:"ABORTED",code:"REQUEST_ABORTED",message:"The request was cancelled."},timeout:{statusText:"TIMEOUT",code:"REQUEST_TIMEOUT",message:"The request timed out."},response_too_large:{statusText:"INVALID_RESPONSE",code:"RESPONSE_TOO_LARGE",message:"The service response was too large."},invalid_response:{statusText:"INVALID_RESPONSE",code:"INVALID_RESPONSE",message:"The service returned an invalid response."},network:{statusText:"FETCH_ERROR",code:"FETCH_ERROR",message:"Network request failed."}}[t],...e instanceof o&&e.requestId?{requestId:e.requestId}:{}}}function Ae(e,t,n){return Object.freeze({...e,status:t.status??0,...t.requestId===void 0?{}:{requestId:t.requestId},failure:n})}function Ln(e){return e instanceof o?e.kind:"network"}function Fn(e,t,n){return new Promise((i,o$1)=>{if(t?.aborted){o$1(new o("aborted"));return}let a=n-Date.now();if(a<=0){o$1(new o("timeout"));return}let p=Math.min(e,a),m=()=>{clearTimeout(d),o$1(new o("aborted"));},d=setTimeout(()=>{t?.removeEventListener("abort",m),Date.now()>=n?o$1(new o("timeout")):i();},p);t?.addEventListener("abort",m,{once:true}),t?.aborted&&m();})}function Oe(e,t="",n=0,i={nodes:0}){if(i.nodes+=1,n>Dn||i.nodes>xn)throw new Error("response traversal limit exceeded");if(typeof e=="string"&&/^(?:createdAt|updatedAt|expiresAt)$/.test(t)){let o=new Date(e);return Number.isNaN(o.getTime())?e:o}return Array.isArray(e)?e.map(o=>Oe(o,"",n+1,i)):G(e)?Object.fromEntries(Object.entries(e).map(([o,a])=>[o,qn(o)?a:Oe(a,o,n+1,i)])):e}function qn(e){return e==="metadata"||e==="public_metadata"||e==="unsafe_metadata"||e==="private_metadata"||e==="publicMetadata"||e==="unsafeMetadata"||e==="privateMetadata"}function Hn(e,t){if(e==="/list-sessions"&&Array.isArray(t))return t.map(o=>G(o)?ye(o):o);if(!G(t))return t;let i=e==="/change-password"||e==="/passkey/verify-authentication"||e==="/phone-otp/verify"||e==="/sign-up/email"||e.startsWith("/sign-in/")||e.startsWith("/two-factor/verify-")?ye(t):t;return e==="/sign-up/email"&&!("sessionCreated"in i)&&(i={...i,sessionCreated:typeof t.token=="string"&&t.token.length>0}),(e==="/get-session"||e==="/passkey/verify-authentication")&&G(i.session)&&(i={...i,session:ye(i.session)}),i}function ye(e){if(!Object.hasOwn(e,"token"))return e;let t={...e};return delete t.token,t}function G(e){return !!e&&typeof e=="object"&&!Array.isArray(e)}function We(e){return {listConsentPreferences:t=>e.request("/privacy/consent-decisions",{fetchOptions:t,decode:Vn}),recordConsent:(t,n)=>e.request("/privacy/consent-decisions",{method:"POST",body:{...t,correlationId:t.correlationId??a()},fetchOptions:n,decode:Bn}),listRightsRequests:t=>e.request("/privacy/rights",{fetchOptions:t,decode:jn}),createRightsRequest:(t,n)=>e.request("/privacy/rights",{method:"POST",body:t,fetchOptions:n,decode:Gn})}}function Vn(e){let t=q$1(e);return Array.isArray(t.preferences)||y(),{preferences:t.preferences.map(Kn)}}function Kn(e){let t=q$1(e);return {purposeId:r(t.purposeId),purposeVersionId:r(t.purposeVersionId),code:r(t.code),state:Jn(t.state,["granted","refused","withdrawn"]),updatedAt:re(t.updatedAt),decidedAt:re(t.decidedAt)}}function Bn(e){let t=q$1(e);return t.recorded!==true&&y(),{recorded:true,decision:J(t.decision,["granted","refused","withdrawn"]),decidedAt:ae(t.decidedAt)}}function jn(e){let t=q$1(e);return Array.isArray(t.requests)||y(),{requests:t.requests.map(Xe)}}function Gn(e){return {request:Xe(q$1(e).request)}}function Xe(e){let t=q$1(e);return {id:r(t.id),rightType:J(t.rightType,["access","correction","portability","erasure","restriction","objection","consent_withdrawal"]),state:J(t.state,["received","identity_pending","in_progress","restricted","completed","denied","withdrawn"]),locale:J(t.locale,["en","ar"]),receivedAt:ae(t.receivedAt),acknowledgedAt:re(t.acknowledgedAt),fulfilmentDeadline:ae(t.fulfilmentDeadline),completedAt:re(t.completedAt)}}function re(e){return e===null?null:ae(e)}function ae(e){if(e instanceof Date)return t(e);typeof e!="string"&&y();let t$1=new Date(e);return Number.isNaN(t$1.getTime())&&y(),t$1}function J(e,t){return (typeof e!="string"||!t.includes(e))&&y(),e}function Jn(e,t){return e===null?null:J(e,t)}function $e({http:e,probe:t,tokens:n,channelName:i}){let o=new Set,a=null,p=null,m=null,d=null,h=null,r=null,s,f=O=>{g(O);};s={data:null,isPending:true,isRefetching:false,error:null,refetch:f};function y(O){s=O;for(let v of o)v();}async function u(O){return e.request("/get-session",{query:O?.query,decode:we})}function g(O){if(O?.query?.disableCookieCache===true)return b(O);if(d)return d;if(h)return h;let v=b(O).finally(()=>{h===v&&(h=null);});return h=v,v}function A(){if(d)return d;let O=b({query:{disableCookieCache:true}}).finally(()=>{d===O&&(d=null);});return d=O,O}async function b(O){m?.abort();let v=new AbortController;m=v,y({...s,isPending:s.data===null&&s.error===null,isRefetching:s.data!==null});let j=n.beginRead(),ee=await e.request("/get-session",{query:O?.query,fetchOptions:{signal:v.signal},decode:we});if(m===v&&(m=null,y({data:ee.data,error:ee.error,isPending:false,isRefetching:false,refetch:f}),ee.error===null)){if(ee.data===null){j.endIfDead();return}await C(j);}}async function C(O){if(n.needsProbe()){if(!O.carriedToken){O.recordCookieVerdict(true);return}return r||_e(O)}}function _e(O){let v=t.request("/get-session",{query:{disableCookieCache:true},decode:we}).then(j=>{r===v&&j.error===null&&O.recordCookieVerdict(j.data!==null);}).finally(()=>{r===v&&(r=null);});return r=v,v}function Le(){a?.postMessage({type:"session-changed"});}function Sn(){if(typeof window>"u"||p)return;let O=()=>{g();},v=()=>{document.visibilityState==="visible"&&g();};window.addEventListener("focus",O),document.addEventListener("visibilitychange",v),typeof BroadcastChannel<"u"&&(a=new BroadcastChannel(i),a.addEventListener("message",O)),p=()=>{window.removeEventListener("focus",O),document.removeEventListener("visibilitychange",v),a?.close(),a=null,p=null;};}function vn(O){return o.add(O),o.size===1&&(Sn(),g()),()=>{if(o.delete(O),o.size===0){let v=m;m=null,h=null,d=null,v?.abort(),p?.();}}}return n.measureWith(()=>{n.needsProbe()&&_e(n.beginRead());}),{store:{subscribe:vn,getSnapshot:()=>s,refresh:A},getSession:u,notifyMutation(){Le(),r&&r.catch(()=>{}).then(()=>{!n.needsProbe()&&n.hasToken()&&Le();}),o.size>0&&g({query:{disableCookieCache:true}});}}}function we(e){if(e===null)return null;let t=q$1(e);return (t.session===void 0||t.user===void 0)&&y(),{session:x(t.session),user:w(t.user)}}async function Ye(e,t){return e.request("/user/metadata",{fetchOptions:t,decode:Ze})}async function Qe(e,t,n){return e.request("/user/metadata",{method:"PATCH",body:{expected_version:t.expectedVersion,unsafe_metadata:t.unsafeMetadata},fetchOptions:n,decode:Ze})}function Ze(e){let t=q$1(e),n=z(t.public_metadata),i=z(t.unsafe_metadata);if(!Number.isSafeInteger(t.metadata_version)||t.metadata_version<0)throw new TypeError("Invalid AuthOwl metadata response");return {publicMetadata:n,unsafeMetadata:i,metadataVersion:t.metadata_version}}function tt(e,t){let{post:n,mutation:i}=q(e,t);return {getMetadata:o=>Ye(e,o),updateUnsafeMetadata:(o,a)=>Qe(e,o,a),updateProfile:(o,a)=>i(n("/update-user",o,a,W)),changeEmail:(o,a)=>i(n("/change-email",o,a,W)),changePassword:(o,a)=>i(n("/change-password",o,a,Wn)),listSessions:o=>e.request("/list-sessions",{fetchOptions:o,decode:Xn}),revokeSession:({sessionId:o},a)=>i(n("/revoke-session",{sessionId:o},a,W)),revokeOtherSessions:o=>i(n("/revoke-other-sessions",{},o,W)),listSocialAccounts:async o=>{let a=await e.request("/list-accounts",{fetchOptions:o,decode:$n});if(!a.data)return {data:null,error:a.error};let p=a.data.length>1;return {...a,data:a.data.filter(m=>m.providerId!=="credential").map(m=>({...m,canUnlink:p}))}},linkSocial:(o,a)=>n("/link-social",o,a,Yn),unlinkSocial:(o,a)=>i(n("/unlink-account",o,a,W)),delete:(o={},a)=>i(n("/delete-user",o,a,Qn))}}function W(e){let t=q$1(e);return {status:s(t.status)}}function Wn(e){let t=q$1(e);return {user:w(t.user)}}function Xn(e){return Array.isArray(e)||y(),e.map(t$1=>{let n=q$1(t$1);return {id:r(n.id),userId:r(n.userId),createdAt:t(n.createdAt),updatedAt:t(n.updatedAt),expiresAt:t(n.expiresAt),...et("ipAddress",v(n,"ipAddress")),...et("userAgent",v(n,"userAgent"))}})}function $n(e){return Array.isArray(e)||y(),e.map(t$1=>{let n=q$1(t$1);return {id:r(n.id),userId:r(n.userId),providerId:r(n.providerId),accountId:r(n.accountId),scopes:u(n.scopes),createdAt:t(n.createdAt),updatedAt:t(n.updatedAt)}})}function Yn(e){let t=q$1(e);return {url:r(t.url),redirect:s(t.redirect)}}function Qn(e){let t=q$1(e);return {success:s(t.success),message:r(t.message)}}function et(e,t){return t===void 0?{}:{[e]:t}}var Zn=new Set(["pending","accepted","rejected","canceled"]),ke=1e4;function nt(e){let t=q$1(e);return t.recipientHint!==null&&t.recipientHint!=="new_user"&&y(),{recipientHint:t.recipientHint}}function H(e,t$1,n){let i=q$1(e),o={id:k(i.id),name:k(i.name),slug:k(i.slug),createdAt:t(i.createdAt),...X("logo",v(i,"logo")),...X("metadata",i.metadata===void 0?void 0:A(i.metadata))};return E(o.id,t$1),E(o.slug,n),o}function it(e){return U(e,H)}function Re(e,t,n){return e===null?null:(t===null&&y(),H(e,t,n))}function ot(e,t,n){if(e===null)return null;let i=q$1(e),o=H(i,t,n);return {...o,members:U(i.members,a=>ht(a,o.id)),invitations:U(i.invitations,a=>M(a,void 0,o.id))}}function Ie(e,t,n=false){let i=U(e,o=>$(o));return n||Q(i.map(o=>o.organizationId),t),i}function rt(e,t){let n=U(e,i=>Se(i));return Q(n.map(i=>i.teamId),t),n}function Se(e,t$1,n){let i=q$1(e),o={id:k(i.id),teamId:k(i.teamId),userId:k(i.userId),createdAt:t(i.createdAt)};return E(o.teamId,t$1),E(o.userId,n),o}function at(e,t,n){return e===null?null:(t===null&&y(),$(e,t,n))}function st(e,t){let n=q$1(e);return (!Number.isSafeInteger(n.total)||n.total<0)&&y(),{members:ei(n.members,t),total:n.total}}function M(e,t$1,n){let i=q$1(e),o=k(i.status);Zn.has(o)||y();let a={id:k(i.id),organizationId:k(i.organizationId),email:Y(i.email),role:k(i.role),status:o,inviterId:k(i.inviterId),expiresAt:t(i.expiresAt),createdAt:t(i.createdAt)};return E(a.id,t$1),E(a.organizationId,n),a}function ut(e,t){let n=U(e,i=>M(i));return Q(n.map(i=>i.organizationId),t),n}function ct(e){return U(e,t=>{let n=q$1(t);return {...M(n),organizationName:Y(n.organizationName)}})}function dt(e,t){let n=q$1(e);return {...M(n,t),organizationName:k(n.organizationName),organizationSlug:k(n.organizationSlug),inviterEmail:At(n.inviterEmail)}}function lt(e,t){let n=q$1(e),i=M(n.invitation,t);return {invitation:i,member:V(n.member,void 0,i.organizationId)}}function pt(e,t){let n=q$1(e);return n.member!==null&&y(),{invitation:n.invitation===null?null:M(n.invitation,t),member:null}}function gt(e,t){return e===null?null:M(e,t)}function ft(e,t,n){let i=q$1(e);return {member:V(i.member,n,t)}}function V(e,t$1,n){let i=q$1(e),o={id:k(i.id),organizationId:k(i.organizationId),userId:k(i.userId),role:k(i.role),createdAt:t(i.createdAt),...i.user===void 0?{}:{user:yt(i.user)}};return E(o.id,t$1),E(o.organizationId,n),o}function mt(e,t){let n=U(e,i=>{let o=q$1(i);return {organizationId:k(o.organizationId),data:{role:k(o.role),...X("permission",o.permission===void 0?void 0:ti(o.permission)),...X("customPermissionKeys",o.customPermissionKeys===void 0?void 0:u(o.customPermissionKeys))}}});return Q(n.map(i=>i.organizationId),t),n.map(i=>i.data)}function $(e,t$1,n){let i=q$1(e),o=i.updatedAt,a={id:k(i.id),name:Y(i.name),organizationId:k(i.organizationId),createdAt:t(i.createdAt),...o===void 0?{}:{updatedAt:t(o)}};return E(a.id,t$1),E(a.organizationId,n),a}function ve(e){let t=q$1(e);return {message:Y(t.message)}}function ht(e,t){let n=q$1(e);return {...V(n,void 0,t),user:yt(n.user)}}function ei(e,t){let n=U(e,i=>ht(i));return Q(n.map(i=>i.organizationId),t),n}function ti(e){let t=q$1(e),n={};for(let[i,o]of Object.entries(t))(i==="__proto__"||i==="constructor"||i==="prototype"||i.length===0||i.length>ke||!Array.isArray(o))&&y(),n[i]=o.map(a=>k(a));return n}function k(e){let t=r(e);return (t.length===0||t.length>ke)&&y(),t}function Y(e){if(e==null)return "";let t=r(e);return t.length>ke&&y(),t}function At(e){return e===null?null:k(e)}function E(e,t){t!==void 0&&e!==t&&y();}function Q(e,t){let n=t??e[0];n!==void 0&&e.some(i=>i!==n)&&y();}function yt(e){let t=q$1(e);return {id:k(t.id),name:Y(t.name),email:At(t.email),...X("image",v(t,"image"))}}function U(e,t){return Array.isArray(e)||y(),e.map(n=>t(n))}function X(e,t){return t===void 0?{}:{[e]:t}}function Ot(e,t,n=()=>null){let{post:i,mutation:o}=q(e,t),a=new Set,p=()=>{for(let r of a)try{r();}catch{}},m=new Map,d=(r,s,f,y)=>{if(f)return e.request(r,{query:s,fetchOptions:f,decode:y});let u=`${r}\0${JSON.stringify(s??null)}`,g=m.get(u);if(g)return g;let A=e.request(r,{query:s,decode:y}).finally(()=>{m.delete(u);});return m.set(u,A),A},h=async r=>{let s=await o(r).finally(()=>m.clear());return s.error===null&&p(),s};return {subscribe(r){return a.add(r),()=>a.delete(r)},create:(r,s)=>h(i("/organization/create",r,s,H)),list:r=>d("/organization/list",void 0,r,it),get:(r={},s)=>d("/organization/get-full-organization",{organizationId:r.organizationId,organizationSlug:r.organizationSlug,membersLimit:r.membersLimit},s,f=>ot(f,r.organizationId,r.organizationSlug)),setActive:(r,s)=>h(i("/organization/set-active",r,s,f=>Re(f,r.organizationId,r.organizationSlug))),createTeam:(r,s)=>h(i("/organization/create-team",r,s,f=>$(f,void 0,r.organizationId))),listTeams:(r={},s)=>d("/organization/list-teams",{organizationId:r.organizationId},s,f=>Ie(f,r.organizationId)),updateTeam:(r,s)=>h(i("/organization/update-team",r,s,f=>$(f,r.teamId,r.data.organizationId))),removeTeam:(r,s)=>h(i("/organization/remove-team",r,s,ve)),listUserTeams:r=>d("/organization/list-user-teams",void 0,r,s=>Ie(s,void 0,true)),listTeamMembers:(r={},s)=>d("/organization/list-team-members",{teamId:r.teamId},s,f=>rt(f,r.teamId)),addTeamMember:(r,s)=>h(i("/organization/add-team-member",r,s,f=>Se(f,r.teamId,r.userId))),removeTeamMember:(r,s)=>h(i("/organization/remove-team-member",r,s,ve)),setActiveTeam:(r,s)=>h(i("/organization/set-active-team",r,s,f=>at(f,r.teamId))),update:(r,s)=>h(i("/organization/update",r,s,f=>Re(f,r.organizationId))),delete:(r,s)=>h(i("/organization/delete",r,s,f=>H(f,r.organizationId))),listMembers:(r={},s)=>d("/organization/list-members",{organizationId:r.organizationId,organizationSlug:r.organizationSlug,limit:r.limit,offset:r.offset,sortBy:r.sortBy,sortDirection:r.sortDirection,filterField:r.filterField,filterValue:r.filterValue,filterOperator:r.filterOperator},s,f=>st(f,r.organizationId)),inviteMember:(r,s)=>h(i("/organization/invite-member",r,s,f=>M(f,void 0,r.organizationId))),listInvitations:(r={},s)=>d("/organization/list-invitations",{organizationId:r.organizationId},s,f=>ut(f,r.organizationId)),listUserInvitations:r=>d("/organization/list-user-invitations",void 0,r,ct),getInvitation:(r,s)=>d("/organization/get-invitation",{id:r.id},s,f=>dt(f,r.id)),getInvitationRecipientHint:(r,s)=>d("/organization/invitation-recipient-hint",{invitationId:r.invitationId},s,nt),acceptInvitation:(r,s)=>h(i("/organization/accept-invitation",r,s,f=>lt(f,r.invitationId))),rejectInvitation:(r,s)=>h(i("/organization/reject-invitation",r,s,f=>pt(f,r.invitationId))),cancelInvitation:(r,s)=>h(i("/organization/cancel-invitation",r,s,f=>gt(f,r.invitationId))),removeMember:(r,s)=>h(i("/organization/remove-member",r,s,f=>ft(f,r.organizationId,r.memberIdOrEmail.includes("@")?void 0:r.memberIdOrEmail))),updateMemberRole:(r,s)=>h(i("/organization/update-member-role",r,s,f=>V(f,r.memberId,r.organizationId))),leave:(r,s)=>h(i("/organization/leave",r,s,f=>V(f,void 0,r.organizationId))),listRoles:(r={},s)=>d("/organization/list-roles",{organizationId:r.organizationId},s,f=>mt(f,r.organizationId)),has:r=>E$1(n(),r),hasPermission:r=>B$1(n(),r.permission)}}var bt=4096,ni=4096,ii=100,oi=256,ri=16,ai=64,si=12;function Te(e){let t=q$1(e);return t.twoFactorRedirect===true?((t.user!==void 0||t.redirect!==void 0||t.url!==void 0)&&y(),{twoFactorRedirect:true,...t.twoFactorMethods===void 0?{}:{twoFactorMethods:Lt(t.twoFactorMethods,ri,ai)}}):(t.twoFactorRedirect!==void 0&&y(),{redirect:s(t.redirect),...pi(t,"url"),user:w(t.user)})}function wt(e){let t=q$1(e);return {user:w(t.user)}}function kt(e){let t=q$1(e);return {sessionCreated:s(t.sessionCreated),user:w(t.user)}}function Rt(e,t){let n=q$1(e),i=s(n.redirect);n.user===null&&y();let o=n.user!==void 0&&n.user!==null,a=n.url!==void 0&&n.url!==null;return i?((o||!a)&&y(),{redirect:true,url:Pe(n.url,t)}):(o===a&&y(),o?{redirect:false,user:w(n.user)}:{redirect:false,url:Pe(n.url,t)})}function It(e,t){let n=q$1(e);return (n.redirect!==true||n.user!==void 0)&&y(),{redirect:true,url:Pe(n.url,t)}}function St(e){return {status:s(q$1(e).status)}}function vt(e){return {success:s(q$1(e).success)}}function Pt(e){return q$1(e).status!=="pending"&&y(),{status:"pending"}}function Tt(e){let t=q$1(e);if(t.kind==="authowl_turnstile")return {kind:"authowl_turnstile"};t.kind!=="akedly_shield_v1_2"&&y();let n=q$1(t.turnstile),i=n.siteKey===null?null:r(n.siteKey);return {kind:"akedly_shield_v1_2",connectionId:r(t.connectionId),challenge:r(t.challenge),difficulty:ui(t.difficulty),challengeToken:r(t.challengeToken),challengeRequired:s(t.challengeRequired),turnstile:{required:s(n.required),siteKey:i}}}function ui(e){return (!Number.isSafeInteger(e)||Number(e)<0||Number(e)>si)&&y(),Number(e)}function Ct(e){let t=q$1(e);return (t.status!==true||t.sessionCreated!==true)&&y(),{status:true,sessionCreated:true,user:ci(t.user)}}function Ce(e){return {status:s(q$1(e).status)}}function zt(e){return {status:s(q$1(e).status)}}function Dt(e){let t=q$1(e);return {status:s(t.status),user:w(t.user)}}function xt(e){return {success:s(q$1(e).success)}}function Et(e){let t=q$1(e);return {totpURI:li(t.totpURI),backupCodes:_t(t.backupCodes)}}function Nt(e){return {status:s(q$1(e).status)}}function se(e){return q$1(e).status!==true&&y(),{status:true}}function Ut(e){return {status:s(q$1(e).status)}}function Mt(e){let t=q$1(e);return t.status!==void 0&&t.status!==true&&y(),{backupCodes:_t(t.backupCodes)}}function ci(e){let t$1=q$1(e);return {id:K(t$1.id,512),...gi(t$1,"name",1024),phoneNumber:K(t$1.phoneNumber,64),phoneNumberVerified:s(t$1.phoneNumberVerified),...t$1.createdAt===void 0?{}:{createdAt:t(t$1.createdAt)},...t$1.updatedAt===void 0?{}:{updatedAt:t(t$1.updatedAt)}}}function Pe(e,t){let n=K(e,bt);/[\u0000-\u0020\u007f]/u.test(n)&&y();let i;try{i=new URL(n);}catch{return y()}return (i.username||i.password)&&y(),i.protocol==="https:"||t&&i.protocol==="http:"&&di(i.hostname)?i.href:y()}function di(e){let t=e.toLowerCase();return t==="localhost"||t==="127.0.0.1"||t==="[::1]"}function li(e){let t=K(e,ni),n;try{n=new URL(t);}catch{return y()}let i=n.searchParams.get("secret");return (n.protocol!=="otpauth:"||n.hostname.toLowerCase()!=="totp"||n.username||n.password||n.hash||i===null||i.length===0||i.length>512||/\s/u.test(i))&&y(),t}function _t(e){return Lt(e,ii,oi)}function Lt(e,t,n){(!Array.isArray(e)||e.length===0||e.length>t)&&y();let i=e.map(o=>K(o,n));return i.some(o=>o.trim().length===0)&&y(),new Set(i).size!==i.length&&y(),i}function K(e,t){let n=r(e);return (n.length===0||n.length>t)&&y(),n}function pi(e,t){let n=e[t];return n==null?{}:{[t]:K(n,bt)}}function gi(e,t,n){let i=v(e,t);return i===void 0?{}:(i!==null&&i.length>n&&y(),{[t]:i})}var Ft=new Set([1564,8206,8207,8234,8235,8236,8237,8238,8294,8295,8296,8297]),ue=new Set([9,10,11,12,13,32,133,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288,65279]);function ce(e){if(e===void 0)return {valid:true,value:void 0};for(let n of e){let i=n.codePointAt(0);if(i===void 0||Ht(n,i)||qt(i)||Ft.has(i))return {valid:false}}let t=fi(e);return ze(t)?{valid:true,value:t}:{valid:false}}function ze(e){let t=0,n,i;for(let o of e){if(t+=1,t>256)return  false;let a=o.codePointAt(0);if(a===void 0||Ht(o,a)||qt(a)||Ft.has(a))return  false;n??=a,i=a;}return t>0&&n!==void 0&&i!==void 0&&!ue.has(n)&&!ue.has(i)}function de(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_PASSKEY_NAME",message:"Passkey names must contain 1 to 256 safe Unicode characters."}}}function fi(e){let t=0,n=e.length;for(;t<n;){let i=e.codePointAt(t);if(i===void 0||!ue.has(i))break;t+=i>65535?2:1;}for(;n>t;){let i=e.codePointAt(n-1);if(i===void 0)break;let a=i>=56320&&i<=57343?n-2:n-1,p=e.codePointAt(a);if(p===void 0||!ue.has(p))break;n=a;}return e.slice(t,n)}function qt(e){return e>=0&&e<=31||e>=127&&e<=159}function Ht(e,t){return e.length===1&&t>=55296&&t<=57343}var Bt=12,jt=5e3,mi=8,hi=1e3,Ai=16,Vt=512,Gt=100,Jt=8192,yi=32768,De=1024,Kt=256,Ee=64,Oi=6e5,bi=/^[A-Za-z0-9_-]+$/u,wi=/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u,ki=/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u,Ri=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/u,Ii=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu,Wt=new Set(["discouraged","preferred","required"]),Si=new Set(["singleDevice","multiDevice"]),Xt=new Set(["ble","cable","hybrid","internal","nfc","smart-card","usb"]),$t=new Set(["hybrid","security-key","client-device"]),vi=new Set(["none","indirect","direct","enterprise"]),Pi=new Set(["fido-u2f","packed","android-safetynet","android-key","tpm","apple","none"]),Ti=new Set(["platform","cross-platform"]),Ci=new Set(["discouraged","preferred","required"]),zi=new Set([-8,-7,-257]);function Yt(e){let t=z(e,Bt,jt);return {challenge:un(t.challenge),...P("timeout",an(t.timeout)),...P("rpId",cn(t.rpId)),...P("allowCredentials",rn(t.allowCredentials)),...P("userVerification",Z(t.userVerification,Wt)),...P("hints",le(t.hints,$t)),...P("extensions",sn(t.extensions))}}function Qt(e){let t=z(e,Bt,jt);return {challenge:un(t.challenge),rp:Di(t.rp),user:xi(t.user),pubKeyCredParams:Ei(t.pubKeyCredParams),...P("timeout",an(t.timeout)),...P("excludeCredentials",rn(t.excludeCredentials)),...P("authenticatorSelection",Ni(t.authenticatorSelection)),...P("attestation",Z(t.attestation,vi)),...P("attestationFormats",le(t.attestationFormats,Pi)),...P("hints",le(t.hints,$t)),...P("extensions",sn(t.extensions))}}function Zt(e){let t=q$1(e),n=x(t.session),i=w(t.user);return n.userId!==i.id&&y(),{session:n,user:i}}function Ne(e){let t$1=q$1(e),n=t$1.counter;(!Number.isSafeInteger(n)||n<0)&&y();let i=Ue(t$1.deviceType,Si),o=s(t$1.backedUp);return o&&i!=="multiDevice"&&y(),{id:B(t$1.id,Kt),..._i(t$1),publicKey:Ui(t$1.publicKey,yi),userId:B(t$1.userId,Kt),credentialID:ge(t$1.credentialID,Jt),counter:n,deviceType:i,backedUp:o,...Li(t$1),createdAt:t(t$1.createdAt),...Fi(t$1)}}function en(e,t,n){let i=Ne(e);return (i.credentialID!==t||(n===void 0?i.name!==void 0&&i.name!==null:i.name!==n))&&y(),i}function tn(e){(!Array.isArray(e)||e.length>Gt)&&y();let t=e.map(Ne);return pe(t.map(n=>n.id)),pe(t.map(n=>n.credentialID)),t.length>1&&t.some(n=>n.userId!==t[0]?.userId)&&y(),t}function nn(e,t,n){let i=q$1(e),o=Ne(i.passkey);return (o.id!==t||o.name!==n)&&y(),{passkey:o}}function on(e){return q$1(e).status!==true&&y(),{status:true}}function Di(e){let t=q$1(e);return {name:xe(t.name,De),...P("id",cn(t.id))}}function xi(e){let t=q$1(e);return {id:ge(t.id,128,1,64),name:xe(t.name,De),displayName:xe(t.displayName,De)}}function Ei(e){(!Array.isArray(e)||e.length===0||e.length>Ee)&&y();let t=e.map(n=>{let i=q$1(n);return (i.type!=="public-key"||!Number.isSafeInteger(i.alg)||!zi.has(i.alg))&&y(),{type:"public-key",alg:i.alg}});return qi(t.map(n=>n.alg)),t}function rn(e){if(e===void 0)return;(!Array.isArray(e)||e.length>Gt)&&y();let t=e.map(n=>{let i=q$1(n);return i.type!=="public-key"&&y(),{type:"public-key",id:ge(i.id,Jt),...P("transports",le(i.transports,Xt))}});return pe(t.map(n=>n.id)),t}function Ni(e){if(e===void 0)return;let t=q$1(e);t.requireResidentKey!==void 0&&typeof t.requireResidentKey!="boolean"&&y();let n=Z(t.residentKey,Ci);return t.requireResidentKey!==void 0&&n!==void 0&&t.requireResidentKey!==(n==="required")&&y(),{...P("authenticatorAttachment",Z(t.authenticatorAttachment,Ti)),...P("residentKey",n),...P("requireResidentKey",t.requireResidentKey),...P("userVerification",Z(t.userVerification,Wt))}}function an(e){return e!==void 0&&(typeof e!="number"||!Number.isFinite(e)||e<0||e>Oi)&&y(),e}function sn(e){return e===void 0?void 0:z(e,mi,hi)}function le(e,t){if(e===void 0)return;(!Array.isArray(e)||e.length>Ee)&&y();let n=e.map(i=>Ue(i,t));return pe(n),n}function Z(e,t){if(e!==void 0)return Ue(e,t)}function un(e){return ge(e,Math.ceil(Vt*4/3),Ai,Vt)}function ge(e,t,n=1,i=Number.POSITIVE_INFINITY){let o=B(e,t),a=o.length%4,p=Mi(o.at(-1)??""),m=Math.floor(o.length*3/4);return (!bi.test(o)||a===1||a===2&&(p&15)!==0||a===3&&(p&3)!==0||m<n||m>i)&&y(),o}function B(e,t){let n=r(e);return (n.length===0||n.length>t)&&y(),n}function xe(e,t){let n=B(e,t);return ki.test(n)&&y(),n}function cn(e){if(e===void 0)return;let t=B(e,253);return t!=="localhost"&&(t.endsWith(".")||!t.includes(".")||t.split(".").some(n=>!Ri.test(n)))&&y(),t}function Ui(e,t){let n=B(e,t),i=n.endsWith("=="),o=!i&&n.endsWith("="),a=n.at(i?-3:o?-2:-1)??"",p=dn(a);return (n.length%4!==0||!wi.test(n)||i&&(p&15)!==0||o&&(p&3)!==0)&&y(),n}function Mi(e){return dn(e,true)}function dn(e,t=false){return (t?"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/").indexOf(e)}function _i(e){let t=v(e,"name");return t===void 0?{}:(t!==null&&!ze(t)&&y(),{name:t})}function Li(e){let t=v(e,"transports");if(t==null||t==="")return t===void 0?{}:{transports:t};let n=t.split(",");return (n.length>Ee||n.some(i=>!Xt.has(i))||new Set(n).size!==n.length)&&y(),{transports:t}}function Fi(e){let t=v(e,"aaguid");return t==null?t===void 0?{}:{aaguid:null}:(Ii.test(t)||y(),{aaguid:t})}function Ue(e,t){let n=r(e);return t.has(n)||y(),n}function P(e,t){return t===void 0?{}:{[e]:t}}function pe(e){new Set(e).size!==e.length&&y();}function qi(e){new Set(e).size!==e.length&&y();}function Hi(e,t){if(!t)return e;let n=t.catch(()=>{});return n.then(()=>{n=null;}),{async request(i,o){return n&&await n,e.request(i,o)}}}var ln=new Map;function Vi(e,t,n){let i=ln.get(n);if(!i){let o=new URLSearchParams(window.location.hash.slice(1)).get("authowl_code");if(!o)return;i=import('./session-handoff-ICVIFI3C.js').then(a=>a.completeCrossSiteSignIn(e,t,o)),ln.set(n,i);}return i}function pn(e){return !a$1()||e.idToken||e.disableRedirect?"legacy":"first-party"}function Ki(e,t=()=>{},n=Gi){let i=be(e),o=e.session.tokens,a$2=a$1()?Vi(i,e.session,e.decoded.projectId):void 0,p=Hi(i,a$2),m=$e({http:p,probe:be({...e,fetch:e.session.probe}),tokens:o,channelName:`authowl:${e.decoded.projectId}`}),d=n(p,m.notifyMutation),h=()=>{m.notifyMutation(),t();},{post:r,mutation:s}=q(p,h),f=e.decoded.env==="test",y=u=>e.session.prepareSession({remember:u?.rememberMe!==false});return {sessionStore:m.store,getSession:m.getSession,account:tt(p,h),organization:Ot(p,h,()=>m.store.getSnapshot().data?.session.membership??null),privacy:We(p),signIn:{email:async(u,g)=>(await y(u),s(r("/sign-in/email",u,g,Te),A=>!("twoFactorRedirect"in A))),username:async(u,g)=>(await y(u),s(r("/sign-in/username",u,g,Te),A=>!("twoFactorRedirect"in A))),social:async(u,g)=>{if(await y(),pn(u)==="first-party"){let{beginCrossSiteSignIn:b}=await import('./session-handoff-ICVIFI3C.js'),C=await b(e,{kind:"social",provider:u.provider,callbackURL:u.callbackURL,errorCallbackURL:u.errorCallbackURL,newUserCallbackURL:u.newUserCallbackURL,scopes:u.scopes,loginHint:u.loginHint,requestSignUp:u.requestSignUp});if(C)return window.location.assign(C),{data:{redirect:true,url:C},error:null}}let A=await s(r("/sign-in/social",u,g,b=>Rt(b,f)),b=>"user"in b);return A.error!==null||A.data===null||"url"in A.data&&A.data.redirect&&!u.disableRedirect&&typeof window<"u"&&window.location.assign(A.data.url),A},sso:async(u,g)=>{if(pn(u)==="first-party"){let{beginCrossSiteSignIn:b}=await import('./session-handoff-ICVIFI3C.js'),C=await b(e,{kind:"sso",email:u.email,providerId:u.providerId,domain:u.domain,organizationSlug:u.organizationSlug,callbackURL:u.callbackURL,errorCallbackURL:u.errorCallbackURL,newUserCallbackURL:u.newUserCallbackURL});if(C)return window.location.assign(C),{data:{url:C,redirect:true},error:null}}let A=await r("/sign-in/sso",u,g,b=>It(b,f));return A.error!==null||A.data===null||typeof window<"u"&&window.location.assign(A.data.url),A},magicLink:(u,g)=>r("/sign-in/magic-link",u,g,St),emailOtp:async(u,g)=>(await y(),s(r("/sign-in/email-otp",u,g,wt))),passkey:async(u,g)=>(await y(),d.signIn(u,g))},signUp:{email:async(u,g)=>(await y(),s(r("/sign-up/email",u,g,kt),A=>A.sessionCreated))},emailOtp:{sendVerificationOtp:(u,g)=>r("/email-otp/send-verification-otp",u,g,vt),verifyEmail:async(u,g)=>(await y(),s(r("/email-otp/verify-email",u,g,Dt)))},phoneOtp:{prepare:u=>r("/phone-otp/challenge",{},u,Tt),start:(u,g)=>r("/phone-otp/start",{...u,idempotencyKey:u.idempotencyKey??a()},g,Pt),verify:async(u,g)=>(await y(),s(r("/phone-otp/verify",u,g,Ct)))},requestPasswordReset:(u,g)=>r("/request-password-reset",u,g,Ce),resetPassword:(u,g)=>r("/reset-password",u,g,Ce),sendVerificationEmail:(u,g)=>r("/send-verification-email",u,g,zt),passkey:{addPasskey:(u,g)=>d.add(u,g),listUserPasskeys:()=>p.request("/passkey/list-user-passkeys",{decode:tn}),updatePasskey:async(u,g)=>{let A=ce(u.name);if(!A.valid||A.value===void 0)return de();let b=A.value;return r("/passkey/update-passkey",{...u,name:b},g,C=>nn(C,u.id,b))},deletePasskey:(u,g)=>r("/passkey/delete-passkey",u,g,on)},twoFactor:{enable:(u,g)=>r("/two-factor/enable",u,g,Et),disable:(u,g)=>s(r("/two-factor/disable",u,g,Nt),A=>A.status),verifyTotp:(u,g)=>s(r("/two-factor/verify-totp",u,g,se)),verifyBackupCode:(u,g)=>s(r("/two-factor/verify-backup-code",u,g,se)),sendOtp:(u={},g)=>r("/two-factor/send-otp",u,g,Ut),verifyOtp:(u,g)=>s(r("/two-factor/verify-otp",u,g,se)),generateBackupCodes:(u,g)=>r("/two-factor/generate-backup-codes",u,g,Mt)},signOut:u=>s(p.request("/sign-out",{method:"POST",body:{},fetchOptions:u,decode:xt}).then(g=>(o.endSession(),g)),g=>g.success)}}function Go(e,t=()=>{},n){let i=Ki(e,t,n);return n?{...i,signIn:{email:i.signIn.email,username:i.signIn.username,social:gn(i),magicLink:i.signIn.magicLink,emailOtp:i.signIn.emailOtp,passkey:i.signIn.passkey},passkey:{listUserPasskeys:i.passkey.listUserPasskeys,updatePasskey:i.passkey.updatePasskey,deletePasskey:i.passkey.deletePasskey,addPasskey:i.passkey.addPasskey}}:{...i,signIn:{email:i.signIn.email,username:i.signIn.username,social:gn(i),magicLink:i.signIn.magicLink,emailOtp:i.signIn.emailOtp},passkey:{listUserPasskeys:i.passkey.listUserPasskeys,updatePasskey:i.passkey.updatePasskey,deletePasskey:i.passkey.deletePasskey}}}function gn(e){return async(t,n)=>{if(!t?.idToken||typeof t.idToken.token!="string"||t.idToken.token==="")return Bi();let i=await e.signIn.social({...t,disableRedirect:true},n);return i.data!==null&&"url"in i.data?ji():i}}function Bi(){return Promise.resolve({data:null,error:{status:400,statusText:"BAD_REQUEST",code:"NATIVE_SOCIAL_ID_TOKEN_REQUIRED",message:"Native social sign-in requires a provider ID token."}})}function ji(){return Promise.resolve({data:null,error:{status:502,statusText:"BAD_GATEWAY",code:"INVALID_NATIVE_SOCIAL_RESPONSE",message:"The server returned a redirect for native ID-token sign-in."}})}function Gi(){return {signIn:()=>fn(),add:()=>fn()}}function fn(){return Promise.resolve({data:null,error:{status:400,statusText:"BAD_REQUEST",code:"PASSKEY_BROWSER_REQUIRED",message:"This passkey ceremony requires a browser with WebAuthn."}})}function $o(e,t,n){let i=new Map;return {async signIn(o={},a){let p=await e.request("/passkey/generate-authenticate-options");if(!p.data)return An(p.error);let m;try{m=Yt(p.data);}catch{return mn()}let d;try{d=await n.authenticate({optionsJSON:m,useBrowserAutofill:o.autoFill});}catch(y){return yn(n,y,"AUTH_CANCELLED","Passkey authentication was cancelled.")}if(!Ji(d))return hn();let{clientExtensionResults:h,...r}=d,s=i.get(d.id);if(s)return s;let f=(async()=>{let y=await e.request("/passkey/verify-authentication",{method:"POST",body:{response:r},fetchOptions:a,decode:Zt});return y.data&&t(),y})();i.set(d.id,f);try{return await f}finally{i.get(d.id)===f&&i.delete(d.id);}},async add(o={},a){let p=ce(o.name);if(!p.valid)return de();let m=await e.request("/passkey/generate-register-options",{query:{name:p.value,authenticatorAttachment:o.authenticatorAttachment}});if(!m.data)return An(m.error);let d;try{d=Qt(m.data);}catch{return mn()}let h;try{h=await n.register({optionsJSON:d});}catch(y){return yn(n,y,"REGISTRATION_CANCELLED","Passkey registration was cancelled.")}if(!Wi(h))return hn();let{clientExtensionResults:r,...s}=h,f=await e.request("/passkey/verify-registration",{method:"POST",body:{response:s,name:p.value},fetchOptions:a,decode:y=>en(y,h.id,p.value)});return f.data&&t(),f}}}function mn(){return {data:null,error:{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned invalid WebAuthn options."}}}function hn(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_WEBAUTHN_RESPONSE",message:"The platform returned an invalid passkey response."}}}function bn(e){if(!e||typeof e!="object")return  false;let t=e;return typeof t.id=="string"&&t.id.length>0&&typeof t.rawId=="string"&&t.rawId.length>0&&t.type==="public-key"&&!!t.response&&typeof t.response=="object"}function Ji(e){if(!bn(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.authenticatorData=="string"&&typeof t.signature=="string"&&(t.userHandle===void 0||typeof t.userHandle=="string")}function Wi(e){if(!bn(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.attestationObject=="string"}function An(e){return {data:null,error:e??{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned no WebAuthn options."}}}function yn(e,t,n,i){let o=$i(t,"page does not have focus"),a=e.errorCode?.(t),p=a!==void 0?a==="ERROR_CEREMONY_ABORTED":On(t)==="AbortError",m=n!=="AUTH_CANCELLED",d=Xi(a,On(t),m);return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:o?"PASSKEY_PAGE_NOT_FOCUSED":p?n:a??"PASSKEY_BROWSER_ERROR",message:o?"Keep this page focused while completing the passkey prompt.":p?i:d}}}function Xi(e,t,n){switch(e){case "ERROR_INVALID_DOMAIN":case "ERROR_INVALID_RP_ID":return "Passkeys are not set up for this site\u2019s domain.";case "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED":return "This device already has a passkey for this account.";case "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEY_ALGS":case "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT":case "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT":return "This device cannot create a passkey for this site.";}return t==="NotAllowedError"?n?"No passkey was created. The prompt was dismissed or timed out.":"No passkey was used. This device may not have one saved for this site yet, or the prompt was dismissed.":t==="SecurityError"?"Passkeys are not set up for this site\u2019s domain.":n?"Passkey registration did not complete.":"Passkey sign-in did not complete."}function On(e){return e&&typeof e=="object"&&"name"in e&&typeof e.name=="string"?e.name:void 0}function $i(e,t){let n=t.toLowerCase(),i=new Set,o=e;for(;o&&typeof o=="object"&&!i.has(o);){if(i.add(o),"message"in o&&typeof o.message=="string"&&o.message.toLowerCase().includes(n))return  true;o="cause"in o?o.cause:void 0;}return  false}async function er(e){let t=`${e.apiUrl}/api/projects/${e.decoded.projectId}/public-config`;return Be(await oe(e,t,{init:{method:"GET",credentials:"omit"},maxResponseBytes:256*1024,decode:n=>Yi(n,e)}),"public-config")}function Yi(e,t){let n=z(e),i=n.environmentId,o=n.environmentType,a=`${t.apiUrl}/api/projects/${t.decoded.projectId}/auth`;if(typeof n.applicationId!="string"||!Me(n.applicationId)||i!==t.decoded.projectId||o!=="development"&&o!=="production"||n.authBaseUrl!==a)throw T();let p=S(n.branding),m=S(n.legal);if(!F(n.enabledMethods,64)||!F(n.socialProviders,64)||!In(p,["appName","logoUrl","primaryColor"])||p.showAppName!==void 0&&typeof p.showAppName!="boolean"||p.alignment!==void 0&&p.alignment!=="left"&&p.alignment!=="center"&&p.alignment!=="right"||p.theme!==void 0&&p.theme!=="light"&&p.theme!=="dark"&&p.theme!=="system"||!In(m,["termsUrl","privacyUrl"])||!Number.isSafeInteger(m.version)||m.version<0||typeof m.required!="boolean")throw T();if(n.socialProviderClientIds!==void 0){let d=S(n.socialProviderClientIds);if(Object.keys(d).length>64||Object.values(d).some(h=>typeof h!="string"||h.length>2048))throw T()}if(!_(n,["requireEmailVerification","twoFactor","mfaRequired","accountDeletion","organizations","sso","badge"])||!wn(n.turnstileSiteKey)||!wn(n.authTurnstileSiteKey)||typeof n.locale!="string"||n.locale.length===0||n.locale.length>64||!Number.isSafeInteger(n.configVersion)||n.configVersion<0)throw T();if(n.jwtIssuer!==null){let d=S(n.jwtIssuer),h=new URL(d.issuer),r=`${h.origin}/api/projects/${t.decoded.projectId}/auth`;if(d.issuer!==r||d.jwksUrl!==`${r}/jwks`||d.aud!==t.decoded.projectId||h.protocol!=="https:"&&h.origin!==t.apiUrl)throw T()}if(n.signUp!==void 0){let d=S(n.signUp).mode;if(typeof d!="string"||!["open","restricted","allowlist","waitlist"].includes(d))throw T()}if(n.authentication!==void 0&&Qi(n.authentication),n.privacy!==void 0&&Zi(n.privacy),n.emailVerification!==void 0){let d=S(n.emailVerification);if(!_(d,["required"])||d.method!=="link"&&d.method!=="code")throw T()}if(n.userModel!==void 0&&!_(S(n.userModel),["requireEmail","firstLastName","emailChange","accountDeletion"]))throw T();if(n.mfa!==void 0){let d=S(n.mfa);if(!_(d,["totp","required","backupCodes"])||(d.required===true||d.backupCodes===true)&&d.totp!==true)throw T()}if(n.captcha===void 0||n.captcha===null)n.captcha=typeof n.authTurnstileSiteKey=="string"&&n.authTurnstileSiteKey.length>0?{provider:"turnstile",siteKey:n.authTurnstileSiteKey}:null;else {let d=S(n.captcha);if(typeof d.provider!="string"||d.provider.length===0||d.provider.length>64||typeof d.siteKey!="string"||d.siteKey.length===0||d.siteKey.length>512)throw T();n.captcha={provider:d.provider,siteKey:d.siteKey};}return n}function Me(e){return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}function T(){return new TypeError("public-config returned an invalid response")}function S(e){if(!e||typeof e!="object"||Array.isArray(e))throw T();return e}function wn(e){return e===null||typeof e=="string"&&e.length<=4096}function Qi(e){let t=S(e),n=S(t.email),i=S(t.password),o=i.minLength!==void 0||i.maxLength!==void 0;if(!_(n,["signUp"])||!F(n.signIn,3)||n.signIn.some(a=>a!=="password"&&a!=="magic_link"&&a!=="email_otp")||!_(S(t.phone),["signUp","signIn"])||!_(i,["signUp","add"])||o&&(!Number.isSafeInteger(i.minLength)||!Number.isSafeInteger(i.maxLength)||i.minLength<1||i.maxLength>4096||i.minLength>i.maxLength)||!_(S(t.passkey),["signIn","add"])||!eo(S(t.passkey).relyingPartyId)||!_(S(t.username),["collectOnSignUp","signIn"]))throw T()}function Zi(e){let t=S(e);if(!Array.isArray(t.notices)||!Array.isArray(t.consentPurposes)||t.notices.length>64||t.consentPurposes.length>64)throw T();for(let n of t.notices){let i=S(n);if(kn(i,"noticeId","noticeVersionId"),fe(i.title,512),fe(i.body,1e5),Rn(i.digest),!F(i.activityCodes,128)||!F(i.purposeCodes,128)||typeof i.effectiveFrom!="string"||!Number.isFinite(Date.parse(i.effectiveFrom)))throw T()}for(let n of t.consentPurposes){let i=S(n);if(kn(i,"purposeId","purposeVersionId"),fe(i.title,512),fe(i.description,1e4),Rn(i.digest),!F(i.activityCodes,128)||!F(i.dataCategories,128))throw T()}}function kn(e,t,n){if(typeof e[t]!="string"||!Me(e[t])||typeof e[n]!="string"||!Me(e[n])||typeof e.code!="string"||!/^[a-z][a-z0-9_]{0,63}$/.test(e.code)||!Number.isSafeInteger(e.version)||e.version<1)throw T()}function fe(e,t){let n=S(e);if(typeof n.en!="string"||n.en.length===0||n.en.length>t||typeof n.ar!="string"||n.ar.length===0||n.ar.length>t)throw T()}function Rn(e){let t=S(e);if(typeof t.en!="string"||!/^[a-f0-9]{64}$/.test(t.en)||typeof t.ar!="string"||!/^[a-f0-9]{64}$/.test(t.ar))throw T()}function eo(e){return e==null||typeof e=="string"}function _(e,t){return t.every(n=>typeof e[n]=="boolean")}function In(e,t){return t.every(n=>e[n]===void 0||typeof e[n]=="string"&&e[n].length<=4096)}function F(e,t){return Array.isArray(e)&&e.length<=t&&e.every(n=>typeof n=="string"&&n.length<=128)&&new Set(e).size===e.length}export{to as a,he as b,oe as c,Be as d,ro as e,je as f,Tn as g,Cn as h,be as i,We as j,Ki as k,Go as l,$o as m,er as n};

package/dist/chunk-IB6TFQFD.js

@@ -0,0 +1,2 @@
+var we=/^(pk_(live|test))_([0-9a-f-]{36})_([A-Za-z0-9]{20,})$/i,Te=/^sk_/i;function Y(e){if(typeof e!="string"||e.length===0)throw new Error("publishableKey is required");if(Te.test(e))throw new Error("A secret key was passed where a publishable key was expected. Never embed secret keys in client code.");let t=we.exec(e);if(!t)throw new Error("publishableKey is malformed; expected pk_(live|test)_<uuid>_<base62>");return {prefix:t[1].toLowerCase(),env:t[2].toLowerCase(),projectId:t[3].toLowerCase()}}function nt(e,t){let n=`p_${e.toLowerCase().replace(/-/g,"")}`;return `${t?.secure?"__Secure-":""}${n}.session_token`}function U(e,t){try{return e?.getItem(t)??null}catch{return null}}function P(e,t,n){try{n===null?e?.removeItem(t):e?.setItem(t,n);}catch{}}function H(){try{return globalThis.localStorage}catch{return}}function C(){try{return globalThis.sessionStorage}catch{return}}var Re="authowl.session-challenge",Se=e=>`${Re}.${e}`,ke="set-auth-challenge",D="x-authowl-challenge";function it(e){let t=e.get(D);return v(t)?X(t).some(([n,r])=>n.endsWith(".dont_remember")&&r.length>0):false}var at="INVALID_TWO_FACTOR_COOKIE",Ee=2048,v=e=>e!==null&&e.length<=Ee,Q=/^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]+$/;function X(e){let t=[];for(let n of e.split(";")){let r=n.trimStart(),o=r.indexOf("=");o<=0||t.push([r.slice(0,o).trimEnd(),r.slice(o+1)]);}return t}function Z(e){let t=Se(e),n=new Map;function r(){return n.size===0?null:[...n].map(([a,u])=>`${a}=${u}`).join("; ")}function o(){let a=r();P(C(),t,v(a)?a:null);}function l(a){for(let[u,h]of X(a))Q.test(u)&&(h===""?n.delete(u):Q.test(h)&&n.set(u,h));}let d=U(C(),t);return v(d)&&l(d),{presentOn(a){let u=r();a.delete(D),v(u)&&a.set(D,u);},observe(a){let u=a.get(ke);v(u)&&(l(u),o());},clear(){n.clear(),o();}}}var ee="set-auth-token",te="x-authowl-session-transport",ne="bearer";var F=/^http:\/\/(?:(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*localhost|127\.0\.0\.1|\[::1\])(?::\d+)?(?:\/|$)/i;function T(e,t){throw new Error(`${e}: ${t}`)}function Oe(e){return /^https?:\/\/[^/?#]*(\/[^?#]*)?$/i.exec(e)?.[1]??""}function re(e,{label:t,allowHttpLoopback:n}){(typeof e!="string"||e.length===0)&&T(t,"required"),e!==e.trim()&&T(t,"surrounding whitespace"),(e.includes("?")||e.includes("#"))&&T(t,"query or fragment forbidden"),(e.includes("\\")||/%[0-9a-f]{2}/i.test(e))&&T(t,"path must be unencoded");let r;try{r=new URL(e);}catch{T(t,"absolute URL required");}return (r.username||r.password)&&T(t,"credentials forbidden"),r.protocol!=="https:"&&r.protocol!=="http:"&&T(t,"HTTPS required"),r.protocol==="http:"&&(!n||!F.test(e))&&T(t,"HTTPS required except exact loopback"),r}function se(e,t){let n;try{n=new URL(String(e));}catch{throw new TypeError("Transport URL must be absolute.")}if(n.username||n.password||n.hash)throw new TypeError("Transport URL must not contain credentials or a fragment.");let r=n.toString();if(n.protocol!=="https:"&&!(n.protocol==="http:"&&t.allowHttpLoopback&&F.test(r)))throw new TypeError("Transport URL must use HTTPS except on approved loopback.");return n}function oe(e,t,n){let r=Oe(e);(r.includes("//")||r.split("/").some(o=>o==="."||o==="..")||r!==""&&r!==t.pathname)&&T(n,"path traversal or duplicate separator");}function ie(e,t){(typeof e!="string"||!/^https?:\/\/[^/?#@\\\s]+\/?$/i.test(e))&&T("apiUrl","origin required");let n;try{n=new URL(e);}catch{T("apiUrl","origin required");}return n.protocol==="http:"&&(!t.allowHttpLoopback||!F.test(e))&&T("apiUrl","HTTPS required except exact loopback"),n.origin}function ct(e,t,n={allowHttpLoopback:false}){let r=re(e,{label:"issuer",allowHttpLoopback:n.allowHttpLoopback}),o=re(t,{label:"jwksUri",allowHttpLoopback:n.allowHttpLoopback});return oe(e,r,"issuer"),oe(t,o,"jwksUri"),r.pathname!=="/"&&r.pathname.endsWith("/")&&T("issuer","trailing slash forbidden"),{issuer:r.toString().replace(/\/$/,""),jwksUri:o.toString()}}var xe="authowl.session-token",Ae="authowl.session-binding",_e="authowl.cookie-transport",le="ok",ue="bearer",Le=e=>`${xe}.${e}`,Ue=e=>`${Ae}.${e}`,Pe=e=>`${_e}.${e}`;function Ce(e){return e===le?"cookies":e===ue?"bearer":"unknown"}function He(e){return e==="cookies"?le:e==="bearer"?ue:null}function Ke(e){let t=Le(e),n=Ue(e),r=Pe(e),o=Z(e),l=null,d=null,a=null,u=false,h=null,b=Ce(U(H(),r)),O=()=>b==="unknown",i=0,p=null,c=false;function L(){let s=U(C(),t);if(s!==null)return u=true,s;let g=U(H(),t);return g!==null?(u=false,g):null}function f(){return U(C(),n)??U(H(),n)}l=L(),d=l===null?null:f(),l!==null&&O()&&(c=true);function R(){if(!(!c||!p)){c=false;try{p();}catch{}}}function w(){let s=b==="bearer"?l:null,g=s===null?null:d,[K,G]=u?[C(),H()]:[H(),C()];P(G,t,null),P(G,n,null),P(K,t,s),P(K,n,g);}function x(s){s!==null&&h!==null&&(u=h,h=null),s!==null&&a!==null?(d=a,a=null):s===null&&(d=null),l=s,w(),s!==null&&O()&&(c=true,R());}function S(s){b=s,P(H(),r,He(s));}function A(){S("unknown"),c=false;}function k(){return l===null&&(l=L(),d=l===null?null:f()),l}function N(){let s=L();return s!==null&&(l=s,d=f()),l}function ye(s){N()===s&&w();}function M(){i+=1,h=null,a=null,u=false,x(null),o.clear(),A();}let W=()=>b!=="cookies";return {hasToken:()=>k()!==null,bindingThumbprint:()=>(k(),d),declareOn(s){if(s.has("authorization"))return  false;let g=k();return !g&&!W()?false:(g&&s.set("authorization",`Bearer ${g}`),s.set(te,ne),o.presentOn(s),true)},wantsToken:W,needsProbe:O,observe(s){let g=s.get(ee);g&&x(g),o.observe(s);},dropChallenge:o.clear,measureWith(s){p=s,R();},beginRead(){let s=k(),g=i;return {carriedToken:s!==null,endIfDead(){s!==null&&N()===s&&i===g&&M();},recordCookieVerdict(K){if(i===g&&O()){if(S(K?"cookies":"bearer"),K){x(null);return}ye(s);}}}},beginSession({remember:s}){i+=1,h=!s,o.clear(),A();},useCookieTransport(){k()===null&&(a=null,S("cookies"));},completeCookieTransport(){S("cookies"),x(null);},useBoundBearerTransport(s,g){if(!s)throw new Error("A session proof thumbprint is required.");a=s,g||(h=true),S("bearer");},endSession:M}}var ae=new Map;function ce(e){let t=ae.get(e);if(t)return t;let n=Ke(e);return ae.set(e,n),n}var V="x-authowl-session-proof",de="x-authowl-session-binding",pe="x-authowl-session-binding-proof",I=()=>import('./session-proof-client-JPZY63IN.js');function ve(e,t){return t?.headers?new Headers(t.headers):typeof e=="object"&&e!==null&&"headers"in e?new Headers(e.headers):new Headers}function fe(e,t){let n=ce(e.projectId),r=(i,p)=>(t??globalThis.fetch)(i,p),o=typeof globalThis.location=="object"&&typeof globalThis.location.origin=="string"&&globalThis.location.origin!=="null"?globalThis.location.origin:null,l=null,d=false,a=()=>new Headers({"x-publishable-key":e.publishableKey});async function u(i){let p=i.get("authorization");p&&await I().then(c=>c.abandonSession(r,`${e.projectBaseURL}/session/abandon`,a(),p));}async function h(i){l=null,d=false;let p=await I().then(c=>c.prepareSenderConstrainedSession({tokens:n,start:i,clientOrigin:o,fetcher:r,projectBaseURL:e.projectBaseURL,headers:a()}));l=p.binding,d=p.cookieOnly;}return {fetch:async(i,p)=>{if(p?.credentials==="omit"||!n.wantsToken())return r(i,p);let c=ve(i,p),L=n.declareOn(c),f=c.get("authorization"),R=(p?.method??(typeof i=="object"&&i!==null&&"method"in i?i.method:"GET")).toUpperCase(),w=typeof i=="string"?i:i instanceof URL?i.toString():i.url;if(L&&o){let S=!!f;if(f){let A=f.replace(/^Bearer\s+/i,""),k=n.bindingThumbprint();if(k)try{c.set(V,await I().then(N=>N.createStoredSessionProof({origin:o,expectedThumbprint:k,method:R,url:w,token:A})));}catch{await u(c),n.endSession(),c.delete("authorization"),c.delete(V),c.delete(de),c.delete(pe),S=false;}}if(l){let A=l;c.set(de,A.nonce),c.set(S?pe:V,await I().then(k=>k.createSessionProof({key:A.key,method:R,url:w,token:A.nonce})));}}let x=await r(i,{...p,headers:c});return L&&(x.status===401&&f&&(new URL(w).pathname.endsWith("/get-session")||new URL(w).pathname.endsWith("/sign-out"))?(await u(c),n.endSession(),l=null,d=false):(n.observe(x.headers),x.headers.has("set-auth-token")&&(d&&n.completeCookieTransport(),l=null,d=false))),x},probe:r,tokens:n,prepareSession:h}}function Ne(e){if(!e||typeof e!="object")throw new Error("AuthConfig is required");let t=Y(e.publishableKey),n=ie(e.apiUrl,{allowHttpLoopback:t.env==="test"});return {publishableKey:e.publishableKey,apiUrl:n,decoded:t,projectBaseURL:`${n}/api/projects/${t.projectId}/auth`}}function Rt(e){let t=Ne(e),{fetch:n,...r}=fe({projectId:t.decoded.projectId,projectBaseURL:t.projectBaseURL,publishableKey:t.publishableKey},e.fetch);return {...e,...t,fetch:n,session:r}}var Ie=1e4,Be=1024*1024,B=class extends Error{kind;requestId;constructor(t,n){super(Je(t)),this.name="TransportError",this.kind=t,this.requestId=n;}},ge=new WeakSet;function m(e,t){let n=new B(e,t);return ge.add(n),n}async function Et({fetchImpl:e,url:t,init:n={},timeoutMs:r=Ie,maxResponseBytes:o=Be,allowHttpLoopback:l=false,decode:d}){be(r,"timeoutMs"),be(o,"maxResponseBytes");let a=se(t,{allowHttpLoopback:l}),u=n.signal,h=new AbortController,b=null,O,i=new Promise(f=>{O=f;}),p=f=>{b===null&&(b=f,O({type:"abort",kind:f}),h.abort());},c=()=>p("aborted");u?.addEventListener("abort",c,{once:true});let L=setTimeout(()=>p("timeout"),r);u?.aborted&&c();try{if(b!==null)throw m(b);let f;try{f=await Promise.race([e(a.toString(),{...n,redirect:"error",signal:h.signal}).then(k=>({type:"response",response:k})),i]);}catch{throw m(b??"network")}if(f.type==="abort")throw m(f.kind);if(!je(f.response))throw m("invalid_response");let R=f.response,w=qe(R.headers),x=await De(R,o,i,()=>b,w),S=ze(R,x,w),A;try{A=R.ok&&d?d(S,Object.freeze({status:R.status})):S;}catch{throw m("invalid_response",w)}return {response:R,data:A,...w===void 0?{}:{requestId:w}}}catch(f){throw f instanceof B&&ge.has(f)?f:m(b??"network")}finally{clearTimeout(L),u?.removeEventListener("abort",c);}}function je(e){if(!e||typeof e!="object")return  false;let t=e;return Number.isInteger(t.status)&&t.status>=0&&t.status<=599&&typeof t.statusText=="string"&&typeof t.ok=="boolean"&&typeof t.headers?.get=="function"&&(t.body===null||typeof t.body=="object"&&typeof t.body?.getReader=="function"&&typeof t.body.cancel=="function")}async function De(e,t,n,r,o){let l=e.headers.get("content-length");if(l!==null){if(!/^\d+$/.test(l))throw he(e.body),m("invalid_response",o);if(Number(l)>t)throw he(e.body),m("response_too_large",o)}if(!e.body)return "";let d;try{d=e.body.getReader();}catch{throw m("network",o)}let a=[],u=0,h=null;try{for(;;){let i;try{i=await Promise.race([d.read(),n]);}catch{h=m(r()??"network",o);break}if(Fe(i)){h=m(i.kind,o);break}let{done:p,value:c}=i;if(p)break;if(c.byteLength!==0){if(u+=c.byteLength,u>t){h=m("response_too_large",o);break}a.push(c);}}}finally{h&&Ve(d);try{d.releaseLock();}catch{}}if(h)throw h;let b=new Uint8Array(u),O=0;for(let i of a)b.set(i,O),O+=i.byteLength;try{return new TextDecoder("utf-8",{fatal:!0}).decode(b)}catch{throw m("invalid_response",o)}}function Fe(e){return "type"in e&&e.type==="abort"}function he(e){if(e)try{e.cancel().catch(()=>{});}catch{}}function Ve(e){try{e.cancel().catch(()=>{});}catch{}}function ze(e,t,n){if(e.status===204||e.status===205)return null;let r=$e(e.headers.get("content-type"));if(!e.ok&&(!r||t.length===0))return null;if(!r||t.length===0)throw m("invalid_response",n);try{return JSON.parse(t)}catch{if(!e.ok)return null;throw m("invalid_response",n)}}function $e(e){if(e===null)return  false;let t=e.split(";",1)[0]?.trim().toLowerCase();return t==="application/json"||t?.endsWith("+json")===true}function qe(e){let t=e.get("x-request-id")?.trim();if(!(!t||t.length>256||!/^[A-Za-z0-9._:-]+$/.test(t)))return t}function be(e,t){if(!Number.isInteger(e)||e<=0)throw new TypeError(`${t} must be a positive integer.`)}function Je(e){switch(e){case "aborted":return "The request was cancelled.";case "timeout":return "The request timed out.";case "response_too_large":return "The response exceeded the allowed size.";case "invalid_response":return "The service returned an invalid response.";case "network":return "The network request could not be completed."}}function Me(e,t){return !e||!t?false:e.permissions.includes(t)}function We(e,t){return !e||!t?false:e.teams?.includes(t)??false}function Ge(e,t){return e?e.roles===void 0?e.role===t:e.roles.includes(t):false}function Ye(e,t){if(!e)return  false;let{role:n,permission:r,teamId:o}=t;return !(n===void 0&&r===void 0&&o===void 0||n!==void 0&&!Ge(e,n)||r!==void 0&&!e.permissions.includes(r)||o!==void 0&&!We(e,o))}function xt(e){return {has:t=>Ye(e,t),hasPermission:t=>Me(e,t.permission)}}var Qe=new Set(["__proto__","constructor","prototype"]);function J(e){(!e||typeof e!="object"||Array.isArray(e))&&y();let t=Object.getPrototypeOf(e);return t!==Object.prototype&&t!==null&&y(),e}function j(e){return typeof e!="string"&&y(),e}function Xe(e){return typeof e!="boolean"&&y(),e}function $(e){return (!(e instanceof Date)||Number.isNaN(e.getTime()))&&y(),e}function z(e){return (!Array.isArray(e)||!e.every(t=>typeof t=="string"))&&y(),[...e]}function _(e,t){let n=e[t];return n==null||typeof n=="string"?n:y()}function me(e,t){let n=e[t];return n==null||typeof n=="boolean"?n:y()}function _t(e){let t=J(e),n=t.email;return n!==null&&typeof n!="string"&&y(),{id:j(t.id),email:n,emailVerified:Xe(t.emailVerified),createdAt:$(t.createdAt),updatedAt:$(t.updatedAt),...E("phoneNumber",_(t,"phoneNumber")),...E("username",_(t,"username")),...E("displayUsername",_(t,"displayUsername")),...E("firstName",_(t,"firstName")),...E("lastName",_(t,"lastName")),...E("name",_(t,"name")),...E("image",_(t,"image")),...E("twoFactorEnabled",me(t,"twoFactorEnabled"))}}function Lt(e){let t=J(e),n=t.membership;return {id:j(t.id),userId:j(t.userId),expiresAt:$(t.expiresAt),...E("activeOrganizationId",_(t,"activeOrganizationId")),...E("activeTeamId",_(t,"activeTeamId")),...E("membership",n==null?n:et(n)),...E("pendingMfaEnrollment",me(t,"pendingMfaEnrollment"))}}function y(){throw new TypeError("AuthOwl response does not match its runtime contract.")}function Ut(e,t=20,n=1e4){return (!e||typeof e!="object"||Array.isArray(e))&&y(),Ze(e,t,n)}function Ze(e,t=20,n=1e4){return q(e,0,{nodes:0},t,n)}function et(e){let t=J(e);return {role:j(t.role),...t.roles===void 0?{}:{roles:z(t.roles)},permissions:z(t.permissions),...t.teams===void 0?{}:{teams:z(t.teams)}}}function q(e,t,n,r,o){if(n.nodes+=1,(t>r||n.nodes>o)&&y(),e===null||typeof e=="string"||typeof e=="boolean")return e;if(typeof e=="number")return Number.isFinite(e)||y(),e;if(Array.isArray(e))return e.map(a=>q(a,t+1,n,r,o));(!e||typeof e!="object")&&y();let l=Object.getPrototypeOf(e);l!==Object.prototype&&l!==null&&y();let d={};for(let[a,u]of Object.entries(e))Qe.has(a)&&y(),d[a]=q(u,t+1,n,r,o);return d}function E(e,t){return t===void 0?{}:{[e]:t}}
+export{Ze as A,Me as B,We as C,Ge as D,Ye as E,xt as F,Y as a,nt as b,se as c,ct as d,U as e,P as f,H as g,it as h,at as i,ee as j,te as k,ne as l,Ne as m,Rt as n,B as o,Et as p,J as q,j as r,Xe as s,$ as t,z as u,_ as v,_t as w,Lt as x,y,Ut as z};

package/dist/{client-2xyOK_yb.d.cts → client-BHufZSky.d.ts}

@@ -1,4 +1,4 @@
-import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-DSqmZLkN.cjs';
+import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-BIify9hZ.js';
 
 /**
  * The organization invitation an emailed link is asking this browser to accept.
@@ -71,7 +71,11 @@ type PublicConfig = {
     environmentId: string;
     /** Environment class that determines key prefixes and billing treatment. */
     environmentType: EnvironmentType;
-    /** Canonical authentication endpoint for this environment. */
+    /**
+     * Authentication endpoint used by this SDK instance. Hosted portals and
+     * custom domains keep this same-origin even when the stable JWT issuer uses
+     * the platform's canonical origin.
+     */
     authBaseUrl: string;
     /**
      * Public acquisition mode. Optional only for rolling compatibility with
@@ -243,8 +247,8 @@ type PublicConfig = {
      * JWT issuer (server contract CONTRACTS §8). Non-null only when the project's
      * issuer toggle is on: exactly what a third-party verifier needs (Convex
      * `auth.config.ts` = `{ type: "customJwt", issuer, jwks: jwksUrl,
-     * applicationID: aud, algorithm: "ES256" }`). `getToken` mints from
-     * `<issuer>/token`.
+     * applicationID: aud, algorithm: "ES256" }`). The issuer remains stable when
+     * `authBaseUrl` follows a hosted or custom account-portal origin.
      */
     jwtIssuer: {
         issuer: string;

package/dist/{client-Za31KAN3.d.ts → client-w6no1OpC.d.cts}

@@ -1,4 +1,4 @@
-import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-DSqmZLkN.js';
+import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-BIify9hZ.cjs';
 
 /**
  * The organization invitation an emailed link is asking this browser to accept.
@@ -71,7 +71,11 @@ type PublicConfig = {
     environmentId: string;
     /** Environment class that determines key prefixes and billing treatment. */
     environmentType: EnvironmentType;
-    /** Canonical authentication endpoint for this environment. */
+    /**
+     * Authentication endpoint used by this SDK instance. Hosted portals and
+     * custom domains keep this same-origin even when the stable JWT issuer uses
+     * the platform's canonical origin.
+     */
     authBaseUrl: string;
     /**
      * Public acquisition mode. Optional only for rolling compatibility with
@@ -243,8 +247,8 @@ type PublicConfig = {
      * JWT issuer (server contract CONTRACTS §8). Non-null only when the project's
      * issuer toggle is on: exactly what a third-party verifier needs (Convex
      * `auth.config.ts` = `{ type: "customJwt", issuer, jwks: jwksUrl,
-     * applicationID: aud, algorithm: "ES256" }`). `getToken` mints from
-     * `<issuer>/token`.
+     * applicationID: aud, algorithm: "ES256" }`). The issuer remains stable when
+     * `authBaseUrl` follows a hosted or custom account-portal origin.
      */
     jwtIssuer: {
         issuer: string;

package/dist/{idempotency-BidZZuun.d.ts → idempotency-DFT3sJwb.d.ts}

@@ -1,5 +1,5 @@
-import { P as PublicConfig, A as ActionFetchOptions, a as AuthActionResult } from './client-Za31KAN3.js';
-import { R as ResolvedAuthConfig } from './organization-membership-DSqmZLkN.js';
+import { P as PublicConfig, A as ActionFetchOptions, a as AuthActionResult } from './client-BHufZSky.js';
+import { R as ResolvedAuthConfig } from './organization-membership-BIify9hZ.js';
 
 /** One compatibility boundary for project-controlled authentication UI. */
 type ProjectCapabilities = {

package/dist/{idempotency-BWgUuHGa.d.cts → idempotency-MKQZa2OJ.d.cts}

@@ -1,5 +1,5 @@
-import { P as PublicConfig, A as ActionFetchOptions, a as AuthActionResult } from './client-2xyOK_yb.cjs';
-import { R as ResolvedAuthConfig } from './organization-membership-DSqmZLkN.cjs';
+import { P as PublicConfig, A as ActionFetchOptions, a as AuthActionResult } from './client-w6no1OpC.cjs';
+import { R as ResolvedAuthConfig } from './organization-membership-BIify9hZ.cjs';
 
 /** One compatibility boundary for project-controlled authentication UI. */
 type ProjectCapabilities = {