@authowl/core 0.22.1 → 0.24.0

package/dist/index.d.cts

@@ -1,9 +1,9 @@
-export { A as AuthConfig, D as DecodedPublishableKey, H as HasParams, O as OrganizationMembership, R as ResolvedAuthConfig, a as ResolvedAuthTarget, T as TransportError, b as TransportErrorKind, c as createMembershipHas, d as decodePublishableKey, m as membershipHas, e as membershipHasPermission, f as membershipHasRole, g as membershipHasTeam, h as resolveAuthTarget, r as resolveConfig } from './organization-membership-BIify9hZ.cjs';
+import { E as PhoneOtpChallengeData, F as AkedlyShieldStartProof } from './config-ZhNp65dI.cjs';
+export { G as AcceptOrganizationInvitationData, I as AccountClient, J as AccountSession, K as AccountStatusData, A as ActionFetchOptions, L as AddOrganizationTeamMemberOptions, d as AddPasskeyOptions, a as AuthActionResult, g as AuthClientError, f as AuthConfig, M as AuthErrorContext, b as AuthOwlClient, N as AuthOwlErrorCode, e as AuthPasskey, Q as AuthRequestContext, T as AuthResponseContext, h as AuthSession, i as AuthUser, U as ChangeEmailOptions, V as ChangePasswordData, W as ChangePasswordOptions, X as ConsentAcceptResult, Y as ConsentStatus, Z as CreateOrganizationOptions, _ as CreateOrganizationTeamOptions, C as CreatePrivacyRightsRequestOptions, D as DecodedPublishableKey, $ as DeleteAccountData, a0 as DeleteAccountOptions, a1 as DeleteOrganizationOptions, a2 as DeletePasskeyData, a3 as DeletePasskeyOptions, a4 as DisableTwoFactorOptions, a5 as EmailAuthData, a6 as EmailOtpAuthData, a7 as EmailOtpSignInOptions, a8 as EmailOtpType, a9 as EmailSignInOptions, aa as EmailSignUpData, ab as EmailSignUpOptions, ac as EnableTwoFactorOptions, ad as GenerateBackupCodesOptions, ae as GetOrganizationInvitationOptions, af as GetOrganizationOptions, ag as GetToken, ah as GetTokenOptions, H as HasParams, ai as INVITATION_CLAIM_MAX_AGE_MS, aj as INVITATION_QUERY_PARAM, ak as InvitationClaim, al as InvitationRecipientHint, am as InviteOrganizationMemberOptions, an as JsonObject, ao as JsonPrimitive, ap as JsonValue, aq as LeaveOrganizationOptions, ar as LinkSocialData, as as LinkSocialOptions, at as ListOrganizationInvitationsOptions, au as ListOrganizationMembersOptions, av as ListOrganizationRolesOptions, aw as ListOrganizationTeamMembersOptions, ax as ListOrganizationTeamsOptions, ay as MagicLinkData, az as MagicLinkSignInOptions, O as Organization, j as OrganizationClient, k as OrganizationDetails, aA as OrganizationFilterOperator, aB as OrganizationInvitation, aC as OrganizationInvitationActionOptions, aD as OrganizationInvitationDetails, aE as OrganizationInvitationStatus, aF as OrganizationMember, aG as OrganizationMemberUser, aH as OrganizationMemberWithUser, aI as OrganizationMembersData, l as OrganizationMembership, aJ as OrganizationRoleSummary, aK as OrganizationSelector, aL as OrganizationTeam, aM as OrganizationTeamMember, aN as OrganizationUserInvitation, c as PasskeyAuthData, P as PasskeySignInOptions, aO as PasswordResetData, aP as PhoneAuthUser, aQ as PhoneOtpStartData, aR as PhoneOtpStartOptions, aS as PhoneOtpVerifyData, aT as PhoneOtpVerifyOptions, m as PrivacyClient, n as PrivacyConsentPreference, o as PrivacyConsentState, p as PrivacyLocale, q as PrivacyRightState, r as PrivacyRightType, s as PrivacyRightsRequest, t as RecordPrivacyConsentOptions, aU as RejectOrganizationInvitationData, aV as RemoveOrganizationMemberData, aW as RemoveOrganizationMemberOptions, aX as RemoveOrganizationTeamData, aY as RemoveOrganizationTeamMemberData, aZ as RemoveOrganizationTeamMemberOptions, a_ as RemoveOrganizationTeamOptions, a$ as RequestPasswordResetOptions, b0 as ResetPasswordOptions, R as ResolvedAuthConfig, b1 as ResolvedAuthTarget, b2 as RevokeSessionOptions, b3 as SendOtpData, b4 as SendTwoFactorOtpData, b5 as SendTwoFactorOtpOptions, b6 as SendVerificationOtpOptions, b7 as SessionLifecycleEvent, u as SessionState, v as SessionStore, b8 as SessionTransportConnection, b9 as SessionTransportIntegration, w as SetActiveOrganizationOptions, ba as SetActiveTeamOptions, bb as SignOutData, bc as SocialAccount, x as SocialAuthData, S as SocialIdTokenOptions, bd as SocialSignInOptions, be as TokenClient, bf as TransportError, bg as TransportErrorKind, bh as TwoFactorBackupCodesData, bi as TwoFactorEnableData, bj as TwoFactorRedirectData, bk as TwoFactorStatusData, bl as TwoFactorVerifyData, bm as UnlinkSocialOptions, bn as UpdateOrganizationMemberRoleOptions, bo as UpdateOrganizationOptions, bp as UpdateOrganizationTeamOptions, bq as UpdatePasskeyData, br as UpdatePasskeyOptions, bs as UpdateProfileOptions, bt as UpdateUnsafeMetadataOptions, bu as UserMetadata, bv as UsernameSignInOptions, bw as VerifyBackupCodeOptions, bx as VerifyEmailOtpData, by as VerifyEmailOtpOptions, bz as VerifyTotpOptions, bA as VerifyTwoFactorOtpOptions, bB as WaitlistJoinData, bC as WaitlistJoinOptions, bD as acceptConsent, bE as captureInvitationClaim, bF as clearInvitationClaim, bG as createAuthOwlClient, y as createMembershipHas, bH as createTokenClient, z as decodePublishableKey, bI as getConsentStatus, bJ as membershipHas, bK as membershipHasPermission, bL as membershipHasRole, bM as membershipHasTeam, bN as readInvitationClaim, bO as resolveAuthTarget, B as resolveConfig, bP as withSessionTransportIntegration } from './config-ZhNp65dI.cjs';
 export { s as sessionCookieName } from './cookie-BqcfagTw.cjs';
-import { x as PhoneOtpChallengeData, y as AkedlyShieldStartProof } from './client-BwZ1bqU4.cjs';
-export { z as AcceptOrganizationInvitationData, B as AccountClient, D as AccountSession, E as AccountStatusData, A as ActionFetchOptions, F as AddOrganizationTeamMemberOptions, e as AddPasskeyOptions, a as AuthActionResult, g as AuthClientError, G as AuthErrorContext, b as AuthOwlClient, H as AuthOwlErrorCode, f as AuthPasskey, I as AuthRequestContext, J as AuthResponseContext, h as AuthSession, i as AuthUser, K as ChangeEmailOptions, L as ChangePasswordData, M as ChangePasswordOptions, N as ConsentAcceptResult, Q as ConsentStatus, T as CreateOrganizationOptions, U as CreateOrganizationTeamOptions, C as CreatePrivacyRightsRequestOptions, V as DeleteAccountData, W as DeleteAccountOptions, X as DeleteOrganizationOptions, Y as DeletePasskeyData, Z as DeletePasskeyOptions, _ as DisableTwoFactorOptions, $ as EmailAuthData, a0 as EmailOtpAuthData, a1 as EmailOtpSignInOptions, a2 as EmailOtpType, a3 as EmailSignInOptions, a4 as EmailSignUpData, a5 as EmailSignUpOptions, a6 as EnableTwoFactorOptions, a7 as EnvironmentType, a8 as GenerateBackupCodesOptions, a9 as GetOrganizationInvitationOptions, aa as GetOrganizationOptions, ab as GetToken, ac as GetTokenOptions, ad as INVITATION_CLAIM_MAX_AGE_MS, ae as INVITATION_QUERY_PARAM, af as InvitationClaim, ag as InvitationRecipientHint, ah as InviteOrganizationMemberOptions, ai as JsonObject, aj as JsonPrimitive, ak as JsonValue, al as LeaveOrganizationOptions, am as LinkSocialData, an as LinkSocialOptions, ao as ListOrganizationInvitationsOptions, ap as ListOrganizationMembersOptions, aq as ListOrganizationRolesOptions, ar as ListOrganizationTeamMembersOptions, as as ListOrganizationTeamsOptions, at as MagicLinkData, au as MagicLinkSignInOptions, O as Organization, j as OrganizationClient, k as OrganizationDetails, av as OrganizationFilterOperator, aw as OrganizationInvitation, ax as OrganizationInvitationActionOptions, ay as OrganizationInvitationDetails, az as OrganizationInvitationStatus, aA as OrganizationMember, aB as OrganizationMemberUser, aC as OrganizationMemberWithUser, aD as OrganizationMembersData, aE as OrganizationRoleSummary, aF as OrganizationSelector, aG as OrganizationTeam, aH as OrganizationTeamMember, aI as OrganizationUserInvitation, d as PasskeyAuthData, c as PasskeySignInOptions, aJ as PasswordResetData, aK as PhoneAuthUser, aL as PhoneOtpStartData, aM as PhoneOtpStartOptions, aN as PhoneOtpVerifyData, aO as PhoneOtpVerifyOptions, l as PrivacyClient, m as PrivacyConsentPreference, n as PrivacyConsentState, o as PrivacyLocale, p as PrivacyRightState, q as PrivacyRightType, r as PrivacyRightsRequest, P as PublicConfig, R as RecordPrivacyConsentOptions, aP as RejectOrganizationInvitationData, aQ as RemoveOrganizationMemberData, aR as RemoveOrganizationMemberOptions, aS as RemoveOrganizationTeamData, aT as RemoveOrganizationTeamMemberData, aU as RemoveOrganizationTeamMemberOptions, aV as RemoveOrganizationTeamOptions, aW as RequestPasswordResetOptions, aX as ResetPasswordOptions, aY as RevokeSessionOptions, aZ as SendOtpData, a_ as SendTwoFactorOtpData, a$ as SendTwoFactorOtpOptions, b0 as SendVerificationOtpOptions, s as SessionState, t as SessionStore, u as SetActiveOrganizationOptions, b1 as SetActiveTeamOptions, b2 as SignOutData, b3 as SocialAccount, v as SocialAuthData, S as SocialIdTokenOptions, b4 as SocialSignInOptions, b5 as TokenClient, b6 as TwoFactorBackupCodesData, b7 as TwoFactorEnableData, b8 as TwoFactorRedirectData, b9 as TwoFactorStatusData, ba as TwoFactorVerifyData, bb as UnlinkSocialOptions, bc as UpdateOrganizationMemberRoleOptions, bd as UpdateOrganizationOptions, be as UpdateOrganizationTeamOptions, bf as UpdatePasskeyData, bg as UpdatePasskeyOptions, bh as UpdateProfileOptions, bi as UpdateUnsafeMetadataOptions, bj as UserMetadata, bk as UsernameSignInOptions, bl as VerifyBackupCodeOptions, bm as VerifyEmailOtpData, bn as VerifyEmailOtpOptions, bo as VerifyTotpOptions, bp as VerifyTwoFactorOtpOptions, bq as WaitlistJoinData, br as WaitlistJoinOptions, bs as acceptConsent, bt as captureInvitationClaim, bu as clearInvitationClaim, bv as createAuthOwlClient, bw as createTokenClient, bx as getConsentStatus, w as getPublicConfig, by as readInvitationClaim } from './client-BwZ1bqU4.cjs';
 export { S as SESSION_TOKEN_HEADER, a as SESSION_TRANSPORT_BEARER, b as SESSION_TRANSPORT_HEADER } from './session-transport-contract-HDPYRum8.cjs';
-export { b as AUTH_CHALLENGE_HEADER, d as AUTH_LOCALE_HEADER, P as ProjectCapabilities, a as createIdempotencyKey, r as resolveProjectCapabilities } from './idempotency-BfRYS8qn.cjs';
+export { b as AUTH_CHALLENGE_HEADER, d as AUTH_LOCALE_HEADER, P as ProjectCapabilities, a as createIdempotencyKey, r as resolveProjectCapabilities } from './idempotency-CG0ZpMnW.cjs';
+export { E as EnvironmentType, P as PublicConfig, g as getPublicConfig } from './public-config-DdTDwDF7.cjs';
 export { a as LOCALES, L as Locale, d as directionFor, i as isLocale } from './index-DgVPDEYx.cjs';
 
 /**
@@ -86,6 +86,20 @@ declare function rememberPendingSignInMethod(projectId: string, method: LastUsed
  */
 declare function settlePendingSignInMethod(projectId: string, signedIn: boolean): void;
 
+/**
+ * True when the offer may be shown.
+ *
+ * Every uncertainty answers the same way - never asked, storage refused, a
+ * value that is not ours - because the sensible response to all of them is to
+ * ask, which is recoverable. The only values that suppress it are ones this
+ * module wrote.
+ */
+declare function passkeyOfferIsDue(projectId: string, userId: string, now?: number): boolean;
+/** The user declined. Ask again after the cool-off. */
+declare function recordPasskeyOfferDismissed(projectId: string, userId: string, now?: number): void;
+/** A passkey now exists because of the offer. Stop asking on this browser. */
+declare function recordPasskeyOfferSettled(projectId: string, userId: string): void;
+
 /**
  * Complete Akedly Shield's browser-only proof ceremony. The provider package is
  * lazy-loaded only when the server-selected route requires it.
@@ -116,4 +130,4 @@ declare class AuthOwlHttpError extends Error {
 declare function setActiveLocale(projectId: string, locale: string | null): () => void;
 declare function activeLocale(projectId: string): string | null;
 
-export { AkedlyShieldStartProof, AuthOwlError, AuthOwlHttpError, InvalidKeyError, type LastUsedSignInMethod, PhoneOtpChallengeData, RateLimitedError, activeLocale, readLastUsedSignInMethod, recordLastUsedSignInMethod, rememberPendingSignInMethod, sessionChallengeIsEphemeral, setActiveLocale, settlePendingSignInMethod, solvePhoneOtpChallenge };
+export { AkedlyShieldStartProof, AuthOwlError, AuthOwlHttpError, InvalidKeyError, type LastUsedSignInMethod, PhoneOtpChallengeData, RateLimitedError, activeLocale, passkeyOfferIsDue, readLastUsedSignInMethod, recordLastUsedSignInMethod, recordPasskeyOfferDismissed, recordPasskeyOfferSettled, rememberPendingSignInMethod, sessionChallengeIsEphemeral, setActiveLocale, settlePendingSignInMethod, solvePhoneOtpChallenge };

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-export { A as AuthConfig, D as DecodedPublishableKey, H as HasParams, O as OrganizationMembership, R as ResolvedAuthConfig, a as ResolvedAuthTarget, T as TransportError, b as TransportErrorKind, c as createMembershipHas, d as decodePublishableKey, m as membershipHas, e as membershipHasPermission, f as membershipHasRole, g as membershipHasTeam, h as resolveAuthTarget, r as resolveConfig } from './organization-membership-BIify9hZ.js';
+import { E as PhoneOtpChallengeData, F as AkedlyShieldStartProof } from './config-ZhNp65dI.js';
+export { G as AcceptOrganizationInvitationData, I as AccountClient, J as AccountSession, K as AccountStatusData, A as ActionFetchOptions, L as AddOrganizationTeamMemberOptions, d as AddPasskeyOptions, a as AuthActionResult, g as AuthClientError, f as AuthConfig, M as AuthErrorContext, b as AuthOwlClient, N as AuthOwlErrorCode, e as AuthPasskey, Q as AuthRequestContext, T as AuthResponseContext, h as AuthSession, i as AuthUser, U as ChangeEmailOptions, V as ChangePasswordData, W as ChangePasswordOptions, X as ConsentAcceptResult, Y as ConsentStatus, Z as CreateOrganizationOptions, _ as CreateOrganizationTeamOptions, C as CreatePrivacyRightsRequestOptions, D as DecodedPublishableKey, $ as DeleteAccountData, a0 as DeleteAccountOptions, a1 as DeleteOrganizationOptions, a2 as DeletePasskeyData, a3 as DeletePasskeyOptions, a4 as DisableTwoFactorOptions, a5 as EmailAuthData, a6 as EmailOtpAuthData, a7 as EmailOtpSignInOptions, a8 as EmailOtpType, a9 as EmailSignInOptions, aa as EmailSignUpData, ab as EmailSignUpOptions, ac as EnableTwoFactorOptions, ad as GenerateBackupCodesOptions, ae as GetOrganizationInvitationOptions, af as GetOrganizationOptions, ag as GetToken, ah as GetTokenOptions, H as HasParams, ai as INVITATION_CLAIM_MAX_AGE_MS, aj as INVITATION_QUERY_PARAM, ak as InvitationClaim, al as InvitationRecipientHint, am as InviteOrganizationMemberOptions, an as JsonObject, ao as JsonPrimitive, ap as JsonValue, aq as LeaveOrganizationOptions, ar as LinkSocialData, as as LinkSocialOptions, at as ListOrganizationInvitationsOptions, au as ListOrganizationMembersOptions, av as ListOrganizationRolesOptions, aw as ListOrganizationTeamMembersOptions, ax as ListOrganizationTeamsOptions, ay as MagicLinkData, az as MagicLinkSignInOptions, O as Organization, j as OrganizationClient, k as OrganizationDetails, aA as OrganizationFilterOperator, aB as OrganizationInvitation, aC as OrganizationInvitationActionOptions, aD as OrganizationInvitationDetails, aE as OrganizationInvitationStatus, aF as OrganizationMember, aG as OrganizationMemberUser, aH as OrganizationMemberWithUser, aI as OrganizationMembersData, l as OrganizationMembership, aJ as OrganizationRoleSummary, aK as OrganizationSelector, aL as OrganizationTeam, aM as OrganizationTeamMember, aN as OrganizationUserInvitation, c as PasskeyAuthData, P as PasskeySignInOptions, aO as PasswordResetData, aP as PhoneAuthUser, aQ as PhoneOtpStartData, aR as PhoneOtpStartOptions, aS as PhoneOtpVerifyData, aT as PhoneOtpVerifyOptions, m as PrivacyClient, n as PrivacyConsentPreference, o as PrivacyConsentState, p as PrivacyLocale, q as PrivacyRightState, r as PrivacyRightType, s as PrivacyRightsRequest, t as RecordPrivacyConsentOptions, aU as RejectOrganizationInvitationData, aV as RemoveOrganizationMemberData, aW as RemoveOrganizationMemberOptions, aX as RemoveOrganizationTeamData, aY as RemoveOrganizationTeamMemberData, aZ as RemoveOrganizationTeamMemberOptions, a_ as RemoveOrganizationTeamOptions, a$ as RequestPasswordResetOptions, b0 as ResetPasswordOptions, R as ResolvedAuthConfig, b1 as ResolvedAuthTarget, b2 as RevokeSessionOptions, b3 as SendOtpData, b4 as SendTwoFactorOtpData, b5 as SendTwoFactorOtpOptions, b6 as SendVerificationOtpOptions, b7 as SessionLifecycleEvent, u as SessionState, v as SessionStore, b8 as SessionTransportConnection, b9 as SessionTransportIntegration, w as SetActiveOrganizationOptions, ba as SetActiveTeamOptions, bb as SignOutData, bc as SocialAccount, x as SocialAuthData, S as SocialIdTokenOptions, bd as SocialSignInOptions, be as TokenClient, bf as TransportError, bg as TransportErrorKind, bh as TwoFactorBackupCodesData, bi as TwoFactorEnableData, bj as TwoFactorRedirectData, bk as TwoFactorStatusData, bl as TwoFactorVerifyData, bm as UnlinkSocialOptions, bn as UpdateOrganizationMemberRoleOptions, bo as UpdateOrganizationOptions, bp as UpdateOrganizationTeamOptions, bq as UpdatePasskeyData, br as UpdatePasskeyOptions, bs as UpdateProfileOptions, bt as UpdateUnsafeMetadataOptions, bu as UserMetadata, bv as UsernameSignInOptions, bw as VerifyBackupCodeOptions, bx as VerifyEmailOtpData, by as VerifyEmailOtpOptions, bz as VerifyTotpOptions, bA as VerifyTwoFactorOtpOptions, bB as WaitlistJoinData, bC as WaitlistJoinOptions, bD as acceptConsent, bE as captureInvitationClaim, bF as clearInvitationClaim, bG as createAuthOwlClient, y as createMembershipHas, bH as createTokenClient, z as decodePublishableKey, bI as getConsentStatus, bJ as membershipHas, bK as membershipHasPermission, bL as membershipHasRole, bM as membershipHasTeam, bN as readInvitationClaim, bO as resolveAuthTarget, B as resolveConfig, bP as withSessionTransportIntegration } from './config-ZhNp65dI.js';
 export { s as sessionCookieName } from './cookie-BqcfagTw.js';
-import { x as PhoneOtpChallengeData, y as AkedlyShieldStartProof } from './client-DXypEWpf.js';
-export { z as AcceptOrganizationInvitationData, B as AccountClient, D as AccountSession, E as AccountStatusData, A as ActionFetchOptions, F as AddOrganizationTeamMemberOptions, e as AddPasskeyOptions, a as AuthActionResult, g as AuthClientError, G as AuthErrorContext, b as AuthOwlClient, H as AuthOwlErrorCode, f as AuthPasskey, I as AuthRequestContext, J as AuthResponseContext, h as AuthSession, i as AuthUser, K as ChangeEmailOptions, L as ChangePasswordData, M as ChangePasswordOptions, N as ConsentAcceptResult, Q as ConsentStatus, T as CreateOrganizationOptions, U as CreateOrganizationTeamOptions, C as CreatePrivacyRightsRequestOptions, V as DeleteAccountData, W as DeleteAccountOptions, X as DeleteOrganizationOptions, Y as DeletePasskeyData, Z as DeletePasskeyOptions, _ as DisableTwoFactorOptions, $ as EmailAuthData, a0 as EmailOtpAuthData, a1 as EmailOtpSignInOptions, a2 as EmailOtpType, a3 as EmailSignInOptions, a4 as EmailSignUpData, a5 as EmailSignUpOptions, a6 as EnableTwoFactorOptions, a7 as EnvironmentType, a8 as GenerateBackupCodesOptions, a9 as GetOrganizationInvitationOptions, aa as GetOrganizationOptions, ab as GetToken, ac as GetTokenOptions, ad as INVITATION_CLAIM_MAX_AGE_MS, ae as INVITATION_QUERY_PARAM, af as InvitationClaim, ag as InvitationRecipientHint, ah as InviteOrganizationMemberOptions, ai as JsonObject, aj as JsonPrimitive, ak as JsonValue, al as LeaveOrganizationOptions, am as LinkSocialData, an as LinkSocialOptions, ao as ListOrganizationInvitationsOptions, ap as ListOrganizationMembersOptions, aq as ListOrganizationRolesOptions, ar as ListOrganizationTeamMembersOptions, as as ListOrganizationTeamsOptions, at as MagicLinkData, au as MagicLinkSignInOptions, O as Organization, j as OrganizationClient, k as OrganizationDetails, av as OrganizationFilterOperator, aw as OrganizationInvitation, ax as OrganizationInvitationActionOptions, ay as OrganizationInvitationDetails, az as OrganizationInvitationStatus, aA as OrganizationMember, aB as OrganizationMemberUser, aC as OrganizationMemberWithUser, aD as OrganizationMembersData, aE as OrganizationRoleSummary, aF as OrganizationSelector, aG as OrganizationTeam, aH as OrganizationTeamMember, aI as OrganizationUserInvitation, d as PasskeyAuthData, c as PasskeySignInOptions, aJ as PasswordResetData, aK as PhoneAuthUser, aL as PhoneOtpStartData, aM as PhoneOtpStartOptions, aN as PhoneOtpVerifyData, aO as PhoneOtpVerifyOptions, l as PrivacyClient, m as PrivacyConsentPreference, n as PrivacyConsentState, o as PrivacyLocale, p as PrivacyRightState, q as PrivacyRightType, r as PrivacyRightsRequest, P as PublicConfig, R as RecordPrivacyConsentOptions, aP as RejectOrganizationInvitationData, aQ as RemoveOrganizationMemberData, aR as RemoveOrganizationMemberOptions, aS as RemoveOrganizationTeamData, aT as RemoveOrganizationTeamMemberData, aU as RemoveOrganizationTeamMemberOptions, aV as RemoveOrganizationTeamOptions, aW as RequestPasswordResetOptions, aX as ResetPasswordOptions, aY as RevokeSessionOptions, aZ as SendOtpData, a_ as SendTwoFactorOtpData, a$ as SendTwoFactorOtpOptions, b0 as SendVerificationOtpOptions, s as SessionState, t as SessionStore, u as SetActiveOrganizationOptions, b1 as SetActiveTeamOptions, b2 as SignOutData, b3 as SocialAccount, v as SocialAuthData, S as SocialIdTokenOptions, b4 as SocialSignInOptions, b5 as TokenClient, b6 as TwoFactorBackupCodesData, b7 as TwoFactorEnableData, b8 as TwoFactorRedirectData, b9 as TwoFactorStatusData, ba as TwoFactorVerifyData, bb as UnlinkSocialOptions, bc as UpdateOrganizationMemberRoleOptions, bd as UpdateOrganizationOptions, be as UpdateOrganizationTeamOptions, bf as UpdatePasskeyData, bg as UpdatePasskeyOptions, bh as UpdateProfileOptions, bi as UpdateUnsafeMetadataOptions, bj as UserMetadata, bk as UsernameSignInOptions, bl as VerifyBackupCodeOptions, bm as VerifyEmailOtpData, bn as VerifyEmailOtpOptions, bo as VerifyTotpOptions, bp as VerifyTwoFactorOtpOptions, bq as WaitlistJoinData, br as WaitlistJoinOptions, bs as acceptConsent, bt as captureInvitationClaim, bu as clearInvitationClaim, bv as createAuthOwlClient, bw as createTokenClient, bx as getConsentStatus, w as getPublicConfig, by as readInvitationClaim } from './client-DXypEWpf.js';
 export { S as SESSION_TOKEN_HEADER, a as SESSION_TRANSPORT_BEARER, b as SESSION_TRANSPORT_HEADER } from './session-transport-contract-HDPYRum8.js';
-export { b as AUTH_CHALLENGE_HEADER, d as AUTH_LOCALE_HEADER, P as ProjectCapabilities, a as createIdempotencyKey, r as resolveProjectCapabilities } from './idempotency-BWMPd3B7.js';
+export { b as AUTH_CHALLENGE_HEADER, d as AUTH_LOCALE_HEADER, P as ProjectCapabilities, a as createIdempotencyKey, r as resolveProjectCapabilities } from './idempotency-BbNZaxT8.js';
+export { E as EnvironmentType, P as PublicConfig, g as getPublicConfig } from './public-config-BfuiC8Ph.js';
 export { a as LOCALES, L as Locale, d as directionFor, i as isLocale } from './index-DgVPDEYx.js';
 
 /**
@@ -86,6 +86,20 @@ declare function rememberPendingSignInMethod(projectId: string, method: LastUsed
  */
 declare function settlePendingSignInMethod(projectId: string, signedIn: boolean): void;
 
+/**
+ * True when the offer may be shown.
+ *
+ * Every uncertainty answers the same way - never asked, storage refused, a
+ * value that is not ours - because the sensible response to all of them is to
+ * ask, which is recoverable. The only values that suppress it are ones this
+ * module wrote.
+ */
+declare function passkeyOfferIsDue(projectId: string, userId: string, now?: number): boolean;
+/** The user declined. Ask again after the cool-off. */
+declare function recordPasskeyOfferDismissed(projectId: string, userId: string, now?: number): void;
+/** A passkey now exists because of the offer. Stop asking on this browser. */
+declare function recordPasskeyOfferSettled(projectId: string, userId: string): void;
+
 /**
  * Complete Akedly Shield's browser-only proof ceremony. The provider package is
  * lazy-loaded only when the server-selected route requires it.
@@ -116,4 +130,4 @@ declare class AuthOwlHttpError extends Error {
 declare function setActiveLocale(projectId: string, locale: string | null): () => void;
 declare function activeLocale(projectId: string): string | null;
 
-export { AkedlyShieldStartProof, AuthOwlError, AuthOwlHttpError, InvalidKeyError, type LastUsedSignInMethod, PhoneOtpChallengeData, RateLimitedError, activeLocale, readLastUsedSignInMethod, recordLastUsedSignInMethod, rememberPendingSignInMethod, sessionChallengeIsEphemeral, setActiveLocale, settlePendingSignInMethod, solvePhoneOtpChallenge };
+export { AkedlyShieldStartProof, AuthOwlError, AuthOwlHttpError, InvalidKeyError, type LastUsedSignInMethod, PhoneOtpChallengeData, RateLimitedError, activeLocale, passkeyOfferIsDue, readLastUsedSignInMethod, recordLastUsedSignInMethod, recordPasskeyOfferDismissed, recordPasskeyOfferSettled, rememberPendingSignInMethod, sessionChallengeIsEphemeral, setActiveLocale, settlePendingSignInMethod, solvePhoneOtpChallenge };

package/dist/index.js

@@ -1,3 +1,3 @@
-import {c as c$1,d as d$1,k,m,i,j}from'./chunk-DVVGVPDH.js';export{g as AUTH_CHALLENGE_HEADER,h as AUTH_LOCALE_HEADER,b as AuthOwlHttpError,f as activeLocale,n as getPublicConfig,a as resolveProjectCapabilities,e as setActiveLocale}from'./chunk-DVVGVPDH.js';export{a as LOCALES,b as directionFor,c as isLocale}from'./chunk-M4QJVSXT.js';export{a as createIdempotencyKey}from'./chunk-5NL5GJW6.js';import {f,g,e,q as q$1,s,r}from'./chunk-IB6TFQFD.js';export{j as SESSION_TOKEN_HEADER,l as SESSION_TRANSPORT_BEARER,k as SESSION_TRANSPORT_HEADER,o as TransportError,F as createMembershipHas,a as decodePublishableKey,E as membershipHas,B as membershipHasPermission,D as membershipHasRole,C as membershipHasTeam,m as resolveAuthTarget,n as resolveConfig,h as sessionChallengeIsEphemeral,b as sessionCookieName}from'./chunk-IB6TFQFD.js';import'./chunk-T5SH3ZZP.js';var M="authowl_invitation",V="authowl.invitation-claim",ie=/^[A-Za-z0-9_-]{1,128}$/,re=10080*60*1e3;function qe(e=Date.now()){if(typeof window>"u")return C(e);let t;try{t=new URL(window.location.href);}catch{return C(e)}let n=t.searchParams.get(M);if(n===null)return C(e);t.searchParams.delete(M);try{window.history.replaceState(window.history.state,"",t.toString());}catch{}if(!ie.test(n))return C(e);let o={id:n,capturedAt:e};return f(g(),V,JSON.stringify(o)),o}function C(e$1=Date.now()){let t=e(g(),V);if(t===null)return null;let n;try{n=JSON.parse(t);}catch{return P(),null}if(typeof n!="object"||n===null)return P(),null;let{id:o,capturedAt:a}=n;return typeof o!="string"||!ie.test(o)||typeof a!="number"||e$1-a>re?(P(),null):{id:o,capturedAt:a}}function P(){f(g(),V,null);}var ae="authowl.last-used-method",He=/^(password|username|magic-link|email-otp|phone-otp|passkey|sso|social:[a-z0-9][a-z0-9_-]{0,63})$/,K=e=>`${ae}.${e}`;function D(e){return He.test(e)}function Ge(e$1){let t=e(g(),K(e$1));return t===null||!D(t)?null:t}function Je(e,t){D(t)&&(f(g(),x(e),null),f(g(),K(e),t));}var x=e=>`${ae}.pending.${e}`;function We(e,t){D(t)&&f(g(),x(e),t);}function $e(e$1,t){let n=e(g(),x(e$1));f(g(),x(e$1),null),t&&n!==null&&D(n)&&f(g(),K(e$1),n);}function d(e){let t=new Uint8Array(e),n="";for(let a of t)n+=String.fromCharCode(a);return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function O(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=(4-t.length%4)%4,o=t.padEnd(t.length+n,"="),a=atob(o),i=new ArrayBuffer(a.length),l=new Uint8Array(i);for(let s=0;s<a.length;s++)l[s]=a.charCodeAt(s);return i}function A(){return je.stubThis(globalThis?.PublicKeyCredential!==void 0&&typeof globalThis.PublicKeyCredential=="function")}var je={stubThis:e=>e};function v(e){let{id:t}=e;return {...e,id:O(t),transports:e.transports}}function _(e){return e==="localhost"||/^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(e)}var c=class extends Error{constructor({message:t,code:n,cause:o,name:a}){super(t,{cause:o}),Object.defineProperty(this,"code",{enumerable:true,configurable:true,writable:true,value:void 0}),this.name=a??o.name,this.code=n;}};function se({error:e,options:t}){let{publicKey:n}=t;if(!n)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(t.signal instanceof AbortSignal)return new c({message:"Registration ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else if(e.name==="ConstraintError"){if(n.authenticatorSelection?.requireResidentKey===true)return new c({message:"Discoverable credentials were required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",cause:e});if(t.mediation==="conditional"&&n.authenticatorSelection?.userVerification==="required")return new c({message:"User verification was required during automatic registration but it could not be performed",code:"ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",cause:e});if(n.authenticatorSelection?.userVerification==="required")return new c({message:"User verification was required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",cause:e})}else {if(e.name==="InvalidStateError")return new c({message:"The authenticator was previously registered",code:"ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",cause:e});if(e.name==="NotAllowedError")return new c({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="NotSupportedError")return n.pubKeyCredParams.filter(a=>a.type==="public-key").length===0?new c({message:'No entry in pubKeyCredParams was of type "public-key"',code:"ERROR_MALFORMED_PUBKEYCREDPARAMS",cause:e}):new c({message:"No available authenticator supported any of the specified pubKeyCredParams algorithms",code:"ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",cause:e});if(e.name==="SecurityError"){let o=globalThis.location.hostname;if(_(o)){if(n.rp.id!==o)return new c({message:`The RP ID "${n.rp.id}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new c({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="TypeError"){if(n.user.id.byteLength<1||n.user.id.byteLength>64)return new c({message:"User ID was not between 1 and 64 characters",code:"ERROR_INVALID_USER_ID_LENGTH",cause:e})}else if(e.name==="UnknownError")return new c({message:"The authenticator was unable to process the specified options, or could not create a new credential",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}var z=class{constructor(){Object.defineProperty(this,"controller",{enumerable:true,configurable:true,writable:true,value:void 0});}createNewAbortSignal(){if(this.controller){let n=new Error("Cancelling existing WebAuthn API call for new one");n.name="AbortError",this.controller.abort(n);}let t=new AbortController;return this.controller=t,t.signal}cancelCeremony(){if(this.controller){let t=new Error("Manually cancelling existing WebAuthn API call");t.name="AbortError",this.controller.abort(t),this.controller=void 0;}}},U=new z;var Ye=["cross-platform","platform"];function N(e){if(e&&!(Ye.indexOf(e)<0))return e}async function ce(e){!e.optionsJSON&&e.challenge&&(console.warn("startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});let{optionsJSON:t,useAutoRegister:n=false}=e;if(!A())throw new Error("WebAuthn is not supported in this browser");let o={...t,challenge:O(t.challenge),user:{...t.user,id:O(t.user.id)},excludeCredentials:t.excludeCredentials?.map(v)},a={};n&&(a.mediation="conditional"),a.publicKey=o,a.signal=U.createNewAbortSignal();let i;try{i=await navigator.credentials.create(a);}catch(p){throw se({error:p,options:a})}if(!i)throw new Error("Registration was not completed");let{id:l,rawId:s,response:r,type:b}=i,m;typeof r.getTransports=="function"&&(m=r.getTransports());let y;if(typeof r.getPublicKeyAlgorithm=="function")try{y=r.getPublicKeyAlgorithm();}catch(p){B("getPublicKeyAlgorithm()",p);}let h;if(typeof r.getPublicKey=="function")try{let p=r.getPublicKey();p!==null&&(h=d(p));}catch(p){B("getPublicKey()",p);}let f;if(typeof r.getAuthenticatorData=="function")try{f=d(r.getAuthenticatorData());}catch(p){B("getAuthenticatorData()",p);}return {id:l,rawId:d(s),response:{attestationObject:d(r.attestationObject),clientDataJSON:d(r.clientDataJSON),transports:m,publicKeyAlgorithm:y,publicKey:h,authenticatorData:f},type:b,clientExtensionResults:i.getClientExtensionResults(),authenticatorAttachment:N(i.authenticatorAttachment)}}function B(e,t){console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${e}. You should report this error to them.
-`,t);}function le(){if(!A())return q.stubThis(new Promise(t=>t(false)));let e=globalThis.PublicKeyCredential;return e?.isConditionalMediationAvailable===void 0?q.stubThis(new Promise(t=>t(false))):q.stubThis(e.isConditionalMediationAvailable())}var q={stubThis:e=>e};function pe({error:e,options:t}){let{publicKey:n}=t;if(!n)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(t.signal instanceof AbortSignal)return new c({message:"Authentication ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else {if(e.name==="NotAllowedError")return new c({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="SecurityError"){let o=globalThis.location.hostname;if(_(o)){if(n.rpId!==o)return new c({message:`The RP ID "${n.rpId}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new c({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="UnknownError")return new c({message:"The authenticator was unable to process the specified options, or could not create a new assertion signature",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}async function ue(e){!e.optionsJSON&&e.challenge&&(console.warn("startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});let{optionsJSON:t,useBrowserAutofill:n=false,verifyBrowserAutofillInput:o=true}=e;if(!A())throw new Error("WebAuthn is not supported in this browser");let a;t.allowCredentials?.length!==0&&(a=t.allowCredentials?.map(v));let i={...t,challenge:O(t.challenge),allowCredentials:a},l={};if(n){if(!await le())throw Error("Browser does not support WebAuthn autofill");if(document.querySelectorAll("input[autocomplete$='webauthn']").length<1&&o)throw Error('No <input> with "webauthn" as the only or last value in its `autocomplete` attribute was detected');l.mediation="conditional",i.allowCredentials=[];}l.publicKey=i,l.signal=U.createNewAbortSignal();let s;try{s=await navigator.credentials.get(l);}catch(f){throw pe({error:f,options:l})}if(!s)throw new Error("Authentication was not completed");let{id:r,rawId:b,response:m,type:y}=s,h;return m.userHandle&&(h=d(m.userHandle)),{id:r,rawId:d(b),response:{authenticatorData:d(m.authenticatorData),clientDataJSON:d(m.clientDataJSON),signature:d(m.signature),userHandle:h},type:y,clientExtensionResults:s.getClientExtensionResults(),authenticatorAttachment:N(s.authenticatorAttachment)}}var de={authenticate:e=>ue(e),register:e=>ce(e),errorCode:e=>e instanceof c?e.code:void 0};function fe(e){return `${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}/consent`}async function H(e){let t=await c$1(e,fe(e),{init:{method:"GET",credentials:"include"},maxResponseBytes:65536,decode:Qe});return t.response.status===401?{required:false}:d$1(t,"consent status")}async function G(e,t){if(!Number.isSafeInteger(t)||t<1)throw new TypeError("Consent version must be a positive integer.");return d$1(await c$1(e,fe(e),{init:{method:"POST",headers:{"content-type":"application/json"},credentials:"include",body:JSON.stringify({version:t})},maxResponseBytes:64*1024,decode:Xe}),"consent accept")}function Qe(e){let t=q$1(e),n=s(t.required),o=Ze(t.needsConsent),a=ge(t.version),i=me(t.termsUrl),l=me(t.privacyUrl);return {required:n,...o===void 0?{}:{needsConsent:o},...a===void 0?{}:{version:a},...i===void 0?{}:{termsUrl:i},...l===void 0?{}:{privacyUrl:l}}}function Xe(e){let t=q$1(e),n=ge(t.version);return {ok:s(t.ok),...n===void 0?{}:{version:n}}}function Ze(e){if(e===void 0||typeof e=="boolean")return e;throw new TypeError("Invalid consent response.")}function ge(e){if(e===void 0||Number.isSafeInteger(e)&&e>=1)return e;throw new TypeError("Invalid consent response.")}function me(e){if(e===void 0||typeof e=="string"&&e.length<=4096)return e;throw new TypeError("Invalid consent response.")}var et=30;function tt(e){return typeof e?.exp=="number"?e.exp:null}function nt(e){let t=e.split(".")[1];if(!t)return null;try{let n=t.replace(/-/g,"+").replace(/_/g,"/"),o=JSON.parse(atob(n));return typeof o=="object"&&o!==null?o:null}catch{return null}}function J(e){let t=new Map;async function n(i={}){let l=i.template===void 0?null:i.template.trim().toLowerCase();if(l==="")throw new TypeError("Template missing");let s=l??"",r=t.get(s);r||(r={activeKey:null,cachedByKey:new Map,inflight:null,sequence:0},t.set(s,r));let b=i.forceRefresh===true;if(!b){let p=r.activeKey?r.cachedByKey.get(r.activeKey):null;if(p&&p.exp-Date.now()/1e3>et)return p.token;if(r.inflight)return r.inflight}let m=++r.sequence,y=()=>t.get(s)===r&&r.sequence===m,h=(async()=>{let p=l?`${e.projectBaseURL}/token/${encodeURIComponent(l)}`:`${e.projectBaseURL}/token`,j=await c$1(e,p,{init:{method:"GET",credentials:"include"},maxResponseBytes:64*1024,decode:k=>ot(k,l!==null)});if(j.response.status===401)return y()&&o(),null;let Y=d$1(j,"token"),he=Y.policyVersion,L=Y.token,w=nt(L),Q=tt(w);if(y())if(Q!==null){let k=typeof w?.sub=="string"?w.sub:null,ye=typeof w?.org_id=="string"?w.org_id:null;if(!l||k){let X=JSON.stringify([e.projectBaseURL,k,ye,l,he]);r.cachedByKey.clear(),r.cachedByKey.set(X,{token:L,exp:Q}),r.activeKey=X;}else a(r);}else a(r);return L})();if(b)return h;let f=h.finally(()=>{r.inflight===f&&(r.inflight=null);});return r.inflight=f,f}function o(){t.clear();}function a(i){i.cachedByKey.clear(),i.activeKey=null;}return {getToken:n,clear:o}}function ot(e,t){let n=q$1(e),o=r(n.token);if(o.length===0||o.length>32*1024)throw new TypeError("Invalid token response.");if(!t)return {token:o,policyVersion:0};let a=q$1(n.template);if(!Number.isSafeInteger(a.policyVersion)||a.policyVersion<1)throw new TypeError("Invalid token response.");return {token:o,policyVersion:a.policyVersion}}function it(e){let t=J(e),n=k(e,t.clear,(s,r)=>m(s,r,de)),o=i(e,`${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}`),a=j(o),i$1=s=>(...r)=>(t.clear(),s(...r)),l={getConsentStatus:()=>H(e),acceptConsent:s=>G(e,s),getToken:t.getToken,privacy:a,waitlist:{join:(s,r)=>o.request("/waitlist",{method:"POST",body:s,fetchOptions:r,credentials:"omit"})},account:{...n.account,updateUnsafeMetadata:i$1(n.account.updateUnsafeMetadata),updateProfile:i$1(n.account.updateProfile),changeEmail:i$1(n.account.changeEmail),changePassword:i$1(n.account.changePassword),revokeSession:i$1(n.account.revokeSession),delete:i$1(n.account.delete)},signIn:{email:i$1(n.signIn.email),username:i$1(n.signIn.username),social:i$1(n.signIn.social),sso:n.signIn.sso,magicLink:n.signIn.magicLink,emailOtp:i$1(n.signIn.emailOtp),passkey:i$1(n.signIn.passkey)},signUp:{email:i$1(n.signUp.email)},emailOtp:{...n.emailOtp,verifyEmail:i$1(n.emailOtp.verifyEmail)},twoFactor:{enable:n.twoFactor.enable,disable:i$1(n.twoFactor.disable),verifyTotp:i$1(n.twoFactor.verifyTotp),verifyBackupCode:i$1(n.twoFactor.verifyBackupCode),sendOtp:n.twoFactor.sendOtp,verifyOtp:i$1(n.twoFactor.verifyOtp),generateBackupCodes:n.twoFactor.generateBackupCodes},phoneOtp:{prepare:n.phoneOtp.prepare,start:n.phoneOtp.start,verify:i$1(n.phoneOtp.verify)},signOut:i$1(n.signOut)};return {...n,...l}}async function rt(e){if(typeof window>"u")throw new Error("Akedly Shield challenges must be solved in a browser.");let t=await at(),n=e.challengeRequired?await t.solvePow(e.challenge,e.difficulty):null,o=e.turnstile.required?await t.getTurnstileToken(st(e.turnstile.siteKey)):void 0;return {connectionId:e.connectionId,...n?{challengeToken:e.challengeToken,nonce:n.nonce}:{},...o?{turnstileToken:o}:{}}}async function at(){return import('@akedly/shield')}function st(e){if(!e)throw new Error("Akedly Shield did not provide a Turnstile site key.");return e}var I=class extends Error{constructor(n,o){super(n);this.cause=o;this.name="AuthOwlError";}cause},W=class extends I{constructor(n,o){super(`Rate limited. Retry after ${n}s.`,o);this.retryAfterSeconds=n;this.name="RateLimitedError";}retryAfterSeconds},$=class extends I{constructor(t="invalid publishable key",n){super(t,n),this.name="InvalidKeyError";}};
-export{I as AuthOwlError,re as INVITATION_CLAIM_MAX_AGE_MS,M as INVITATION_QUERY_PARAM,$ as InvalidKeyError,W as RateLimitedError,G as acceptConsent,qe as captureInvitationClaim,P as clearInvitationClaim,it as createAuthOwlClient,J as createTokenClient,H as getConsentStatus,C as readInvitationClaim,Ge as readLastUsedSignInMethod,Je as recordLastUsedSignInMethod,We as rememberPendingSignInMethod,$e as settlePendingSignInMethod,rt as solvePhoneOtpChallenge};
+import {c as c$1,d,k,m as m$1,i,j as j$1}from'./chunk-LBCOMERN.js';export{g as AUTH_CHALLENGE_HEADER,h as AUTH_LOCALE_HEADER,b as AuthOwlHttpError,f as activeLocale,n as getPublicConfig,a as resolveProjectCapabilities,e as setActiveLocale}from'./chunk-LBCOMERN.js';export{a as LOCALES,b as directionFor,c as isLocale}from'./chunk-M4QJVSXT.js';export{a as createIdempotencyKey}from'./chunk-5NL5GJW6.js';import {f,g,e,r,t,s}from'./chunk-YL2FF2VS.js';export{j as SESSION_TOKEN_HEADER,l as SESSION_TRANSPORT_BEARER,k as SESSION_TRANSPORT_HEADER,p as TransportError,G as createMembershipHas,a as decodePublishableKey,F as membershipHas,C as membershipHasPermission,E as membershipHasRole,D as membershipHasTeam,n as resolveAuthTarget,o as resolveConfig,h as sessionChallengeIsEphemeral,b as sessionCookieName,m as withSessionTransportIntegration}from'./chunk-YL2FF2VS.js';import'./chunk-T5SH3ZZP.js';var M="authowl_invitation",V="authowl.invitation-claim",re=/^[A-Za-z0-9_-]{1,128}$/,ae=10080*60*1e3;function Je(e=Date.now()){if(typeof window>"u")return C(e);let t;try{t=new URL(window.location.href);}catch{return C(e)}let n=t.searchParams.get(M);if(n===null)return C(e);t.searchParams.delete(M);try{window.history.replaceState(window.history.state,"",t.toString());}catch{}if(!re.test(n))return C(e);let o={id:n,capturedAt:e};return f(g(),V,JSON.stringify(o)),o}function C(e$1=Date.now()){let t=e(g(),V);if(t===null)return null;let n;try{n=JSON.parse(t);}catch{return P(),null}if(typeof n!="object"||n===null)return P(),null;let{id:o,capturedAt:a}=n;return typeof o!="string"||!re.test(o)||typeof a!="number"||e$1-a>ae?(P(),null):{id:o,capturedAt:a}}function P(){f(g(),V,null);}var se="authowl.last-used-method",We=/^(password|username|magic-link|email-otp|phone-otp|passkey|sso|social:[a-z0-9][a-z0-9_-]{0,63})$/,K=e=>`${se}.${e}`;function D(e){return We.test(e)}function $e(e$1){let t=e(g(),K(e$1));return t===null||!D(t)?null:t}function je(e,t){D(t)&&(f(g(),x(e),null),f(g(),K(e),t));}var x=e=>`${se}.pending.${e}`;function Ye(e,t){D(t)&&f(g(),x(e),t);}function Qe(e$1,t){let n=e(g(),x(e$1));f(g(),x(e$1),null),t&&n!==null&&D(n)&&f(g(),K(e$1),n);}var Xe="authowl.passkey-offer",ce="done",Ze=720*60*60*1e3,z=(e,t)=>`${Xe}.${e}.${t}`;function et(e$1,t,n=Date.now()){let o=e(g(),z(e$1,t));if(o===null)return  true;if(o===ce)return  false;let a=Number(o);if(!Number.isFinite(a))return  true;let i=n-a;return i<0||i>=Ze}function tt(e,t,n=Date.now()){f(g(),z(e,t),String(n));}function nt(e,t){f(g(),z(e,t),ce);}function m(e){let t=new Uint8Array(e),n="";for(let a of t)n+=String.fromCharCode(a);return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function A(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=(4-t.length%4)%4,o=t.padEnd(t.length+n,"="),a=atob(o),i=new ArrayBuffer(a.length),l=new Uint8Array(i);for(let s=0;s<a.length;s++)l[s]=a.charCodeAt(s);return i}function b(){return ot.stubThis(globalThis?.PublicKeyCredential!==void 0&&typeof globalThis.PublicKeyCredential=="function")}var ot={stubThis:e=>e};function v(e){let{id:t}=e;return {...e,id:A(t),transports:e.transports}}function _(e){return e==="localhost"||/^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(e)}var c=class extends Error{constructor({message:t,code:n,cause:o,name:a}){super(t,{cause:o}),Object.defineProperty(this,"code",{enumerable:true,configurable:true,writable:true,value:void 0}),this.name=a??o.name,this.code=n;}};function le({error:e,options:t}){let{publicKey:n}=t;if(!n)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(t.signal instanceof AbortSignal)return new c({message:"Registration ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else if(e.name==="ConstraintError"){if(n.authenticatorSelection?.requireResidentKey===true)return new c({message:"Discoverable credentials were required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",cause:e});if(t.mediation==="conditional"&&n.authenticatorSelection?.userVerification==="required")return new c({message:"User verification was required during automatic registration but it could not be performed",code:"ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",cause:e});if(n.authenticatorSelection?.userVerification==="required")return new c({message:"User verification was required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",cause:e})}else {if(e.name==="InvalidStateError")return new c({message:"The authenticator was previously registered",code:"ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",cause:e});if(e.name==="NotAllowedError")return new c({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="NotSupportedError")return n.pubKeyCredParams.filter(a=>a.type==="public-key").length===0?new c({message:'No entry in pubKeyCredParams was of type "public-key"',code:"ERROR_MALFORMED_PUBKEYCREDPARAMS",cause:e}):new c({message:"No available authenticator supported any of the specified pubKeyCredParams algorithms",code:"ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",cause:e});if(e.name==="SecurityError"){let o=globalThis.location.hostname;if(_(o)){if(n.rp.id!==o)return new c({message:`The RP ID "${n.rp.id}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new c({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="TypeError"){if(n.user.id.byteLength<1||n.user.id.byteLength>64)return new c({message:"User ID was not between 1 and 64 characters",code:"ERROR_INVALID_USER_ID_LENGTH",cause:e})}else if(e.name==="UnknownError")return new c({message:"The authenticator was unable to process the specified options, or could not create a new credential",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}var B=class{constructor(){Object.defineProperty(this,"controller",{enumerable:true,configurable:true,writable:true,value:void 0});}createNewAbortSignal(){if(this.controller){let n=new Error("Cancelling existing WebAuthn API call for new one");n.name="AbortError",this.controller.abort(n);}let t=new AbortController;return this.controller=t,t.signal}cancelCeremony(){if(this.controller){let t=new Error("Manually cancelling existing WebAuthn API call");t.name="AbortError",this.controller.abort(t),this.controller=void 0;}}},U=new B;var it=["cross-platform","platform"];function N(e){if(e&&!(it.indexOf(e)<0))return e}async function pe(e){!e.optionsJSON&&e.challenge&&(console.warn("startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});let{optionsJSON:t,useAutoRegister:n=false}=e;if(!b())throw new Error("WebAuthn is not supported in this browser");let o={...t,challenge:A(t.challenge),user:{...t.user,id:A(t.user.id)},excludeCredentials:t.excludeCredentials?.map(v)},a={};n&&(a.mediation="conditional"),a.publicKey=o,a.signal=U.createNewAbortSignal();let i;try{i=await navigator.credentials.create(a);}catch(p){throw le({error:p,options:a})}if(!i)throw new Error("Registration was not completed");let{id:l,rawId:s,response:r,type:R}=i,f;typeof r.getTransports=="function"&&(f=r.getTransports());let y;if(typeof r.getPublicKeyAlgorithm=="function")try{y=r.getPublicKeyAlgorithm();}catch(p){q("getPublicKeyAlgorithm()",p);}let h;if(typeof r.getPublicKey=="function")try{let p=r.getPublicKey();p!==null&&(h=m(p));}catch(p){q("getPublicKey()",p);}let g;if(typeof r.getAuthenticatorData=="function")try{g=m(r.getAuthenticatorData());}catch(p){q("getAuthenticatorData()",p);}return {id:l,rawId:m(s),response:{attestationObject:m(r.attestationObject),clientDataJSON:m(r.clientDataJSON),transports:f,publicKeyAlgorithm:y,publicKey:h,authenticatorData:g},type:R,clientExtensionResults:i.getClientExtensionResults(),authenticatorAttachment:N(i.authenticatorAttachment)}}function q(e,t){console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${e}. You should report this error to them.
+`,t);}function ue(){if(!b())return H.stubThis(new Promise(t=>t(false)));let e=globalThis.PublicKeyCredential;return e?.isConditionalMediationAvailable===void 0?H.stubThis(new Promise(t=>t(false))):H.stubThis(e.isConditionalMediationAvailable())}var H={stubThis:e=>e};function de({error:e,options:t}){let{publicKey:n}=t;if(!n)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(t.signal instanceof AbortSignal)return new c({message:"Authentication ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else {if(e.name==="NotAllowedError")return new c({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="SecurityError"){let o=globalThis.location.hostname;if(_(o)){if(n.rpId!==o)return new c({message:`The RP ID "${n.rpId}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new c({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="UnknownError")return new c({message:"The authenticator was unable to process the specified options, or could not create a new assertion signature",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}async function me(e){!e.optionsJSON&&e.challenge&&(console.warn("startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});let{optionsJSON:t,useBrowserAutofill:n=false,verifyBrowserAutofillInput:o=true}=e;if(!b())throw new Error("WebAuthn is not supported in this browser");let a;t.allowCredentials?.length!==0&&(a=t.allowCredentials?.map(v));let i={...t,challenge:A(t.challenge),allowCredentials:a},l={};if(n){if(!await ue())throw Error("Browser does not support WebAuthn autofill");if(document.querySelectorAll("input[autocomplete$='webauthn']").length<1&&o)throw Error('No <input> with "webauthn" as the only or last value in its `autocomplete` attribute was detected');l.mediation="conditional",i.allowCredentials=[];}l.publicKey=i,l.signal=U.createNewAbortSignal();let s;try{s=await navigator.credentials.get(l);}catch(g){throw de({error:g,options:l})}if(!s)throw new Error("Authentication was not completed");let{id:r,rawId:R,response:f,type:y}=s,h;return f.userHandle&&(h=m(f.userHandle)),{id:r,rawId:m(R),response:{authenticatorData:m(f.authenticatorData),clientDataJSON:m(f.clientDataJSON),signature:m(f.signature),userHandle:h},type:y,clientExtensionResults:s.getClientExtensionResults(),authenticatorAttachment:N(s.authenticatorAttachment)}}var fe={authenticate:e=>me(e),register:e=>pe(e),errorCode:e=>e instanceof c?e.code:void 0};function he(e){return `${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}/consent`}async function G(e){let t=await c$1(e,he(e),{init:{method:"GET",credentials:"include"},maxResponseBytes:65536,decode:rt});return t.response.status===401?{required:false}:d(t,"consent status")}async function J(e,t){if(!Number.isSafeInteger(t)||t<1)throw new TypeError("Consent version must be a positive integer.");return d(await c$1(e,he(e),{init:{method:"POST",headers:{"content-type":"application/json"},credentials:"include",body:JSON.stringify({version:t})},maxResponseBytes:64*1024,decode:at}),"consent accept")}function rt(e){let t$1=r(e),n=t(t$1.required),o=st(t$1.needsConsent),a=ye(t$1.version),i=ge(t$1.termsUrl),l=ge(t$1.privacyUrl);return {required:n,...o===void 0?{}:{needsConsent:o},...a===void 0?{}:{version:a},...i===void 0?{}:{termsUrl:i},...l===void 0?{}:{privacyUrl:l}}}function at(e){let t$1=r(e),n=ye(t$1.version);return {ok:t(t$1.ok),...n===void 0?{}:{version:n}}}function st(e){if(e===void 0||typeof e=="boolean")return e;throw new TypeError("Invalid consent response.")}function ye(e){if(e===void 0||Number.isSafeInteger(e)&&e>=1)return e;throw new TypeError("Invalid consent response.")}function ge(e){if(e===void 0||typeof e=="string"&&e.length<=4096)return e;throw new TypeError("Invalid consent response.")}var ct=30;function lt(e){return typeof e?.exp=="number"?e.exp:null}function pt(e){let t=e.split(".")[1];if(!t)return null;try{let n=t.replace(/-/g,"+").replace(/_/g,"/"),o=JSON.parse(atob(n));return typeof o=="object"&&o!==null?o:null}catch{return null}}function W(e){let t=new Map;async function n(i={}){let l=i.template===void 0?null:i.template.trim().toLowerCase();if(l==="")throw new TypeError("Template missing");let s=l??"",r=t.get(s);r||(r={activeKey:null,cachedByKey:new Map,inflight:null,sequence:0},t.set(s,r));let R=i.forceRefresh===true;if(!R){let p=r.activeKey?r.cachedByKey.get(r.activeKey):null;if(p&&p.exp-Date.now()/1e3>ct)return p.token;if(r.inflight)return r.inflight}let f=++r.sequence,y=()=>t.get(s)===r&&r.sequence===f,h=(async()=>{let p=l?`${e.projectBaseURL}/token/${encodeURIComponent(l)}`:`${e.projectBaseURL}/token`,Y=await c$1(e,p,{init:{method:"GET",credentials:"include"},maxResponseBytes:64*1024,decode:k=>ut(k,l!==null)});if(Y.response.status===401)return y()&&o(),null;let Q=d(Y,"token"),Oe=Q.policyVersion,F=Q.token,S=pt(F),X=lt(S);if(y())if(X!==null){let k=typeof S?.sub=="string"?S.sub:null,Ae=typeof S?.org_id=="string"?S.org_id:null;if(!l||k){let Z=JSON.stringify([e.projectBaseURL,k,Ae,l,Oe]);r.cachedByKey.clear(),r.cachedByKey.set(Z,{token:F,exp:X}),r.activeKey=Z;}else a(r);}else a(r);return F})();if(R)return h;let g=h.finally(()=>{r.inflight===g&&(r.inflight=null);});return r.inflight=g,g}function o(){t.clear();}function a(i){i.cachedByKey.clear(),i.activeKey=null;}return {getToken:n,clear:o}}function ut(e,t){let n=r(e),o=s(n.token);if(o.length===0||o.length>32*1024)throw new TypeError("Invalid token response.");if(!t)return {token:o,policyVersion:0};let a=r(n.template);if(!Number.isSafeInteger(a.policyVersion)||a.policyVersion<1)throw new TypeError("Invalid token response.");return {token:o,policyVersion:a.policyVersion}}function dt(e){let t=W(e),n=k(e,t.clear,(s,r)=>m$1(s,r,fe)),o=i(e,`${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}`),a=j$1(o),i$1=s=>(...r)=>(t.clear(),s(...r)),l={getConsentStatus:()=>G(e),acceptConsent:s=>J(e,s),getToken:t.getToken,privacy:a,waitlist:{join:(s,r)=>o.request("/waitlist",{method:"POST",body:s,fetchOptions:r,credentials:"omit"})},account:{...n.account,updateUnsafeMetadata:i$1(n.account.updateUnsafeMetadata),updateProfile:i$1(n.account.updateProfile),changeEmail:i$1(n.account.changeEmail),changePassword:i$1(n.account.changePassword),revokeSession:i$1(n.account.revokeSession),delete:i$1(n.account.delete)},signIn:{email:i$1(n.signIn.email),username:i$1(n.signIn.username),social:i$1(n.signIn.social),sso:n.signIn.sso,magicLink:n.signIn.magicLink,emailOtp:i$1(n.signIn.emailOtp),passkey:i$1(n.signIn.passkey)},signUp:{email:i$1(n.signUp.email)},emailOtp:{...n.emailOtp,verifyEmail:i$1(n.emailOtp.verifyEmail)},twoFactor:{enable:n.twoFactor.enable,disable:i$1(n.twoFactor.disable),verifyTotp:i$1(n.twoFactor.verifyTotp),verifyBackupCode:i$1(n.twoFactor.verifyBackupCode),sendOtp:n.twoFactor.sendOtp,verifyOtp:i$1(n.twoFactor.verifyOtp),generateBackupCodes:n.twoFactor.generateBackupCodes},phoneOtp:{prepare:n.phoneOtp.prepare,start:n.phoneOtp.start,verify:i$1(n.phoneOtp.verify)},signOut:i$1(n.signOut)};return {...n,...l}}async function mt(e){if(typeof window>"u")throw new Error("Akedly Shield challenges must be solved in a browser.");let t=await ft(),n=e.challengeRequired?await t.solvePow(e.challenge,e.difficulty):null,o=e.turnstile.required?await t.getTurnstileToken(gt(e.turnstile.siteKey)):void 0;return {connectionId:e.connectionId,...n?{challengeToken:e.challengeToken,nonce:n.nonce}:{},...o?{turnstileToken:o}:{}}}async function ft(){return import('@akedly/shield')}function gt(e){if(!e)throw new Error("Akedly Shield did not provide a Turnstile site key.");return e}var I=class extends Error{constructor(n,o){super(n);this.cause=o;this.name="AuthOwlError";}cause},$=class extends I{constructor(n,o){super(`Rate limited. Retry after ${n}s.`,o);this.retryAfterSeconds=n;this.name="RateLimitedError";}retryAfterSeconds},j=class extends I{constructor(t="invalid publishable key",n){super(t,n),this.name="InvalidKeyError";}};
+export{I as AuthOwlError,ae as INVITATION_CLAIM_MAX_AGE_MS,M as INVITATION_QUERY_PARAM,j as InvalidKeyError,$ as RateLimitedError,J as acceptConsent,Je as captureInvitationClaim,P as clearInvitationClaim,dt as createAuthOwlClient,W as createTokenClient,G as getConsentStatus,et as passkeyOfferIsDue,C as readInvitationClaim,$e as readLastUsedSignInMethod,je as recordLastUsedSignInMethod,tt as recordPasskeyOfferDismissed,nt as recordPasskeyOfferSettled,Ye as rememberPendingSignInMethod,Qe as settlePendingSignInMethod,mt as solvePhoneOtpChallenge};