@authowl/core 0.23.0 → 0.24.0

package/README.md

@@ -232,7 +232,19 @@ For example, a custom UI may call `authowl.signIn.username(...)` only when
 registration only when `capabilities.authentication?.passkey.add` is true.
 
 Sensitive mutations can return `SESSION_NOT_FRESH` with HTTP 403. Ask the user
-to sign in again and retry the action. Organization ownership conflicts return
+to sign in again and retry the action.
+
+Turning two-factor off, and reissuing backup codes, can instead return
+`SECOND_FACTOR_REQUIRED` with HTTP 403. The remedy is NOT the one above: the
+session must have PROVED a second factor recently, and signing in again does not
+do that for a user whose device is trusted, or who arrived by social sign-in or
+inbound SSO - each mints a fresh session that never ran the challenge, so
+retrying after a fresh sign-in fails identically. Collect a code instead
+(`twoFactor.verifyTotp`, `verifyBackupCode`, or `verifyOtp` where the posture
+allows it) on the signed-in session, then replay the original request unchanged.
+`@authowl/react` does this for you in `<UserProfile />` and
+`<BackupCodesManager />`, and exposes `useStepUpAction` for custom UIs built on
+`useMFA()`. Organization ownership conflicts return
 `ORGANIZATION_LAST_OWNER`. Disabled and cross-project resources return 404.
 Public metadata is server-authored. Unsafe metadata is end-user-owned and must
 be treated as untrusted. Private metadata has no browser SDK surface.

package/dist/{config-CyUwyJ9B.d.cts → config-ZhNp65dI.d.cts}

@@ -1074,7 +1074,7 @@ type AuthErrorContext = Readonly<AuthRequestContext & {
     failure: 'api' | 'aborted' | 'timeout' | 'network' | 'response_too_large' | 'invalid_response';
 }>;
 /** Stable AuthOwl policy codes that callers can handle without matching messages. */
-type AuthOwlErrorCode = 'MAU_BUDGET_REACHED' | 'BOT_CHALLENGE_FAILED' | 'VERSION_CONFLICT' | 'SESSION_NOT_FRESH' | 'EMAIL_OTP_RECOVERY_DISABLED' | 'ORGANIZATION_LAST_OWNER' | 'ORGANIZATION_NOT_FOUND' | 'MEMBER_NOT_FOUND' | 'INVITATION_NOT_FOUND' | 'EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION' | 'EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION' | 'YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION';
+type AuthOwlErrorCode = 'MAU_BUDGET_REACHED' | 'BOT_CHALLENGE_FAILED' | 'VERSION_CONFLICT' | 'SESSION_NOT_FRESH' | 'SECOND_FACTOR_REQUIRED' | 'EMAIL_OTP_RECOVERY_DISABLED' | 'ORGANIZATION_LAST_OWNER' | 'ORGANIZATION_NOT_FOUND' | 'MEMBER_NOT_FOUND' | 'INVITATION_NOT_FOUND' | 'EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION' | 'EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION' | 'YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION';
 /** Framework-neutral reactive session snapshot. */
 interface SessionState {
     data: {

package/dist/{config-CyUwyJ9B.d.ts → config-ZhNp65dI.d.ts}

@@ -1074,7 +1074,7 @@ type AuthErrorContext = Readonly<AuthRequestContext & {
     failure: 'api' | 'aborted' | 'timeout' | 'network' | 'response_too_large' | 'invalid_response';
 }>;
 /** Stable AuthOwl policy codes that callers can handle without matching messages. */
-type AuthOwlErrorCode = 'MAU_BUDGET_REACHED' | 'BOT_CHALLENGE_FAILED' | 'VERSION_CONFLICT' | 'SESSION_NOT_FRESH' | 'EMAIL_OTP_RECOVERY_DISABLED' | 'ORGANIZATION_LAST_OWNER' | 'ORGANIZATION_NOT_FOUND' | 'MEMBER_NOT_FOUND' | 'INVITATION_NOT_FOUND' | 'EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION' | 'EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION' | 'YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION';
+type AuthOwlErrorCode = 'MAU_BUDGET_REACHED' | 'BOT_CHALLENGE_FAILED' | 'VERSION_CONFLICT' | 'SESSION_NOT_FRESH' | 'SECOND_FACTOR_REQUIRED' | 'EMAIL_OTP_RECOVERY_DISABLED' | 'ORGANIZATION_LAST_OWNER' | 'ORGANIZATION_NOT_FOUND' | 'MEMBER_NOT_FOUND' | 'INVITATION_NOT_FOUND' | 'EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION' | 'EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION' | 'YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION';
 /** Framework-neutral reactive session snapshot. */
 interface SessionState {
     data: {

package/dist/{idempotency-fDhUiiGz.d.ts → idempotency-BbNZaxT8.d.ts}

@@ -1,5 +1,5 @@
-import { R as ResolvedAuthConfig, A as ActionFetchOptions, a as AuthActionResult } from './config-CyUwyJ9B.js';
-import { P as PublicConfig } from './public-config-Drxchm7N.js';
+import { R as ResolvedAuthConfig, A as ActionFetchOptions, a as AuthActionResult } from './config-ZhNp65dI.js';
+import { P as PublicConfig } from './public-config-BfuiC8Ph.js';
 
 declare const AUTH_CHALLENGE_HEADER = "x-authowl-turnstile-token";
 /**

package/dist/{idempotency-mYtBlnGY.d.cts → idempotency-CG0ZpMnW.d.cts}

@@ -1,5 +1,5 @@
-import { R as ResolvedAuthConfig, A as ActionFetchOptions, a as AuthActionResult } from './config-CyUwyJ9B.cjs';
-import { P as PublicConfig } from './public-config-DojOd5F7.cjs';
+import { R as ResolvedAuthConfig, A as ActionFetchOptions, a as AuthActionResult } from './config-ZhNp65dI.cjs';
+import { P as PublicConfig } from './public-config-DdTDwDF7.cjs';
 
 declare const AUTH_CHALLENGE_HEADER = "x-authowl-turnstile-token";
 /**

package/dist/index.cjs

@@ -1,3 +1,3 @@
-'use strict';var _o=Object.defineProperty;var ot=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(i){throw n=[i],i}};var Xt=(e,t)=>{for(var n in t)_o(e,n,{get:t[n],enumerable:true});};var wn={};Xt(wn,{abandonSession:()=>gn,bindingNonce:()=>An,boundedSessionFetch:()=>De,clearSessionProofKeyMemoryForTests:()=>ir,cookieCapability:()=>fn,createSessionProof:()=>On,createStoredSessionProof:()=>cr,prepareSenderConstrainedSession:()=>tr,sessionProofKey:()=>_e});async function De(e,t,n,i){let o=new AbortController,r,c=new Promise((u,a)=>{r=setTimeout(()=>{o.abort(),a(new Error("AuthOwl session transport request timed out."));},i);});try{return await Promise.race([e(t,{...n,signal:o.signal}),c])}finally{clearTimeout(r);}}async function fn(e,t,n){let i=await De(e,t,{method:"POST",credentials:"include",headers:n},1e4);if(i.status===404||i.status===405)return "legacy";if(i.status!==204)throw new Error("AuthOwl cookie capability check failed.");let o=await De(e,t,{method:"GET",credentials:"include",headers:n},1e4);if(o.status===404||o.status===405)return "legacy";if(o.status!==200)throw new Error("AuthOwl cookie capability check failed.");let r=await o.text();if(new TextEncoder().encode(r).byteLength>128)throw new Error("AuthOwl cookie capability response is invalid.");let c;try{c=JSON.parse(r);}catch{throw new Error("AuthOwl cookie capability response is invalid.")}if(!c||typeof c!="object"||Array.isArray(c)||Object.keys(c).length!==1||typeof c.cookieSupported!="boolean")throw new Error("AuthOwl cookie capability response is invalid.");return c.cookieSupported}async function gn(e,t,n,i){let o=new Headers(n);o.set("authorization",i),o.set("x-authowl-session-transport","bearer");try{await De(e,t,{method:"POST",credentials:"include",headers:o},2e3);}catch{}}async function tr(e){let{tokens:t}=e;if(t.beginSession(e.start),!e.clientOrigin)return {binding:null,cookieOnly:false};let n=null;if(t.hasToken()){let r=t.bindingThumbprint();if(r)try{let c=await _e(e.clientOrigin);if(c.thumbprint!==r)throw new Error("Session proof key changed.");n=c;}catch{let c=new Headers;t.declareOn(c);let u=c.get("authorization");u&&await gn(e.fetcher,`${e.projectBaseURL}/session/abandon`,e.headers,u),t.endSession(),t.beginSession(e.start);}}let i;try{i=await fn(e.fetcher,`${e.projectBaseURL}/session/cookie-capability`,e.headers);}catch{return t.useCookieTransport(),{binding:null,cookieOnly:false}}if(i==="legacy")return {binding:null,cookieOnly:false};if(i)return t.hasToken()?{binding:null,cookieOnly:true}:(t.useCookieTransport(),{binding:null,cookieOnly:false});let o=n??await _e(e.clientOrigin);return t.useBoundBearerTransport(o.thumbprint,o.persistent),{binding:{key:o,nonce:An()},cookieOnly:false}}function ce(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function xe(e){return new TextEncoder().encode(e)}async function mn(e){return ce(new Uint8Array(await crypto.subtle.digest("SHA-256",xe(e))))}function hn(e){return e.kty==="EC"&&e.crv==="P-256"&&typeof e.x=="string"&&e.x.length>0&&typeof e.y=="string"&&e.y.length>0&&e.d===void 0}async function yn(e){return mn(JSON.stringify({crv:e.crv,kty:e.kty,x:e.x,y:e.y}))}function nr(e){if(!e||typeof e!="object")return  false;let t=e,n=t.algorithm;return t.type==="private"&&t.extractable===false&&t.usages.length===1&&t.usages[0]==="sign"&&n.name==="ECDSA"&&n.namedCurve==="P-256"}function ir(){Ce.clear();}async function or(e){if(!e||typeof e!="object")return null;let t=e;if(!nr(t.privateKey)||!t.publicJwk||!hn(t.publicJwk))return null;let n=await yn(t.publicJwk);return t.thumbprint!==n?null:{privateKey:t.privateKey,publicJwk:t.publicJwk,thumbprint:n,persistent:true}}function bn(){return typeof indexedDB>"u"?Promise.resolve(null):new Promise(e=>{let t;try{t=indexedDB.open(er,1);}catch{e(null);return}t.onupgradeneeded=()=>{t.result.objectStoreNames.contains(ue)||t.result.createObjectStore(ue,{keyPath:"origin"});},t.onsuccess=()=>e(t.result),t.onerror=()=>e(null),t.onblocked=()=>e(null);})}async function pn(e){let t=await bn();if(!t)return null;try{let n=await new Promise(i=>{let o=t.transaction(ue,"readonly").objectStore(ue).get(e);o.onsuccess=()=>i(o.result),o.onerror=()=>i(null);});return await or(n)}finally{t.close();}}async function rr(e,t){let n=await bn();if(!n)return "unavailable";try{return await new Promise(i=>{let o;try{o=n.transaction(ue,"readwrite"),o.objectStore(ue).add({origin:e,privateKey:t.privateKey,publicJwk:t.publicJwk,thumbprint:t.thumbprint});}catch{i("unavailable");return}o.oncomplete=()=>i("stored"),o.onerror=()=>{let r=o.error;i(r?.name==="ConstraintError"?"conflict":"unavailable");},o.onabort=()=>{let r=o.error;i(r?.name==="ConstraintError"?"conflict":"unavailable");};})}finally{n.close();}}async function sr(){let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},false,["sign","verify"]),t=await crypto.subtle.exportKey("jwk",e.publicKey);if(!hn(t))throw new Error("The browser produced an invalid proof key.");return {privateKey:e.privateKey,publicJwk:t,thumbprint:await yn(t),persistent:false}}function _e(e){let t=Ce.get(e);if(t)return t;let n=(async()=>{let i=await pn(e);if(i)return i;let o=await sr(),r=await rr(e,o);return r==="stored"?{...o,persistent:true}:r==="conflict"?await pn(e)??o:o})();return Ce.set(e,n),n.catch(()=>Ce.delete(e)),n}function An(){return ce(crypto.getRandomValues(new Uint8Array(32)))}function ar(e){let t=new URL(e);return t.search="",t.hash="",t.toString()}async function On(e){let t=ce(xe(JSON.stringify({typ:Qo,alg:Zo,jwk:e.key.publicJwk}))),n=ce(xe(JSON.stringify({htm:e.method.toUpperCase(),htu:ar(e.url),iat:Math.floor(Date.now()/1e3),jti:ce(crypto.getRandomValues(new Uint8Array(16))),ath:await mn(e.token)}))),i=`${t}.${n}`,o=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e.key.privateKey,xe(i));return `${i}.${ce(new Uint8Array(o))}`}async function cr(e){let t=await _e(e.origin);if(t.thumbprint!==e.expectedThumbprint)throw new Error("Session proof key changed.");return On({key:t,method:e.method,url:e.url,token:e.token})}var Qo,Zo,er,ue,Ce,Sn=ot(()=>{"use strict";Qo="pop+jwt",Zo="ES256",er="authowl-session-proof",ue="origin-keys",Ce=new Map;});function Oe(){return typeof window<"u"&&typeof document<"u"&&typeof crypto<"u"&&typeof crypto.subtle?.digest=="function"}var St=ot(()=>{"use strict";});var Xe={};Xt(Xe,{beginCrossSiteSignIn:()=>Ys,challengeFor:()=>ro,completeCrossSiteSignIn:()=>Xs,takeHandoffCode:()=>Mt});function oo(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function ro(e){let t=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e));return oo(new Uint8Array(t))}function $s(){return oo(crypto.getRandomValues(new Uint8Array(Bs)))}function so(e,t){let n=window.location.protocol==="https:"?"; Secure":"";document.cookie=`${io}=${e}; Path=/; Max-Age=${t}; SameSite=Lax${n}`;}function Gs(){for(let e of document.cookie.split(";")){let t=e.indexOf("=");if(!(t<0)&&e.slice(0,t).trim()===io)return e.slice(t+1).trim()||null}return null}function Ws(){so("",0);}function no(e){return new URL(e,window.location.href).toString()}async function Ys(e,t){let n=t.callbackURL?no(t.callbackURL):null;if(n&&new URL(n).origin!==window.location.origin)return null;let i=$s(),o=new URL(`${e.projectBaseURL}/session/start`);if(o.searchParams.set("pk",e.publishableKey),o.searchParams.set("kind",t.kind),t.kind==="social")o.searchParams.set("provider",t.provider),t.scopes?.length&&o.searchParams.set("scopes",t.scopes.join(",")),t.loginHint&&o.searchParams.set("loginHint",t.loginHint),t.requestSignUp!==void 0&&o.searchParams.set("requestSignUp",t.requestSignUp?"1":"0");else for(let c of Js){let u=t[c];u&&o.searchParams.set(c,u);}let r=`${window.location.origin}${window.location.pathname}${window.location.search}`;o.searchParams.set("cb",n??r);for(let[c,u]of [["err",t.errorCallbackURL],["new",t.newUserCallbackURL]])u&&o.searchParams.set(c,no(u));return o.searchParams.set("challenge",await ro(i)),so(i,js),o.toString()}function Mt(e){if(typeof window>"u")return null;let t=window.location.hash;if(!t.includes(Lt))return null;let n=new URLSearchParams(t.replace(/^#/,"")),i=n.get(Lt);if(!i||e!==void 0&&i!==e)return null;n.delete(Lt);let o=n.toString();return window.history.replaceState(window.history.state,"",`${window.location.pathname}${window.location.search}${o?`#${o}`:""}`),i}async function Xs(e,t,n){if(!Oe())return  false;let i=n??Mt();if(!i)return  false;n&&Mt(n);let o=Gs();if(Ws(),!o)return  false;await t.prepareSession({remember:true});let{error:r}=await e.request("/session/exchange",{method:"POST",body:{code:i,verifier:o}});return r===null}var io,Lt,Bs,js,Js,Qe=ot(()=>{"use strict";St();io="authowl_handoff_verifier",Lt="authowl_code",Bs=32,js=900,Js=["email","providerId","domain","organizationSlug"];});var Uo=/^(pk_(live|test))_([0-9a-f-]{36})_([A-Za-z0-9]{20,})$/i,No=/^sk_/i;function rt(e){if(typeof e!="string"||e.length===0)throw new Error("publishableKey is required");if(No.test(e))throw new Error("A secret key was passed where a publishable key was expected. Never embed secret keys in client code.");let t=Uo.exec(e);if(!t)throw new Error("publishableKey is malformed; expected pk_(live|test)_<uuid>_<base62>");return {prefix:t[1].toLowerCase(),env:t[2].toLowerCase(),projectId:t[3].toLowerCase()}}function zo(e,t){let n=`p_${e.toLowerCase().replace(/-/g,"")}`;return `${t?.secure?"__Secure-":""}${n}.session_token`}var Qt=/^http:\/\/(?:(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*localhost|127\.0\.0\.1|\[::1\])(?::\d+)?(?:\/|$)/i;function st(e,t){throw new Error(`${e}: ${t}`)}function Zt(e,t){let n;try{n=new URL(String(e));}catch{throw new TypeError("Transport URL must be absolute.")}if(n.username||n.password||n.hash)throw new TypeError("Transport URL must not contain credentials or a fragment.");let i=n.toString();if(n.protocol!=="https:"&&!(n.protocol==="http:"&&t.allowHttpLoopback&&Qt.test(i)))throw new TypeError("Transport URL must use HTTPS except on approved loopback.");return n}function en(e,t){(typeof e!="string"||!/^https?:\/\/[^/?#@\\\s]+\/?$/i.test(e))&&st("apiUrl","origin required");let n;try{n=new URL(e);}catch{st("apiUrl","origin required");}return n.protocol==="http:"&&(!t.allowHttpLoopback||!Qt.test(e))&&st("apiUrl","HTTPS required except exact loopback"),n.origin}function H(e,t){try{return e?.getItem(t)??null}catch{return null}}function M(e,t,n){try{n===null?e?.removeItem(t):e?.setItem(t,n);}catch{}}function U(){try{return globalThis.localStorage}catch{return}}function Z(){try{return globalThis.sessionStorage}catch{return}}var Lo="authowl.session-challenge",Mo=e=>`${Lo}.${e}`,Fo="set-auth-challenge",at="x-authowl-challenge";function Ko(e){let t=e.get(at);return me(t)?on(t).some(([n,i])=>n.endsWith(".dont_remember")&&i.length>0):false}var nn="INVALID_TWO_FACTOR_COOKIE",Vo=2048,me=e=>e!==null&&e.length<=Vo,tn=/^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]+$/;function on(e){let t=[];for(let n of e.split(";")){let i=n.trimStart(),o=i.indexOf("=");o<=0||t.push([i.slice(0,o).trimEnd(),i.slice(o+1)]);}return t}function rn(e){let t=Mo(e),n=new Map;function i(){return n.size===0?null:[...n].map(([u,a])=>`${u}=${a}`).join("; ")}function o(){let u=i();M(Z(),t,me(u)?u:null);}function r(u){for(let[a,h]of on(u))tn.test(a)&&(h===""?n.delete(a):tn.test(h)&&n.set(a,h));}let c=H(Z(),t);return me(c)&&r(c),{presentOn(u){let a=i();u.delete(at),me(a)&&u.set(at,a);},observe(u){let a=u.get(Fo);me(a)&&(r(a),o());},clear(){n.clear(),o();}}}var ct="set-auth-token",ut="x-authowl-session-transport",lt="bearer";var Ho="authowl.session-token",qo="authowl.session-binding",Bo="authowl.cookie-transport",an="ok",cn="bearer",jo=e=>`${Ho}.${e}`,Jo=e=>`${qo}.${e}`,$o=e=>`${Bo}.${e}`;function Go(e){return e===an?"cookies":e===cn?"bearer":"unknown"}function Wo(e){return e==="cookies"?an:e==="bearer"?cn:null}function Yo(e){let t=jo(e),n=Jo(e),i=$o(e),o=rn(e),r=new Set;function c(O){for(let L of r)try{L(O);}catch{}}let u=null,a=null,h=null,s=false,l=null,p=Go(H(U(),i)),y=()=>p==="unknown",b=0,S=null,d=false;function g(){let O=H(Z(),t);if(O!==null)return s=true,O;let L=H(U(),t);return L!==null?(s=false,L):null}function A(){return H(Z(),n)??H(U(),n)}u=g(),a=u===null?null:A(),u!==null&&y()&&(d=true);function k(){if(!(!d||!S)){d=false;try{S();}catch{}}}function T(){let O=p==="bearer"?u:null,L=O===null?null:a,[ge,Yt]=s?[Z(),U()]:[U(),Z()];M(Yt,t,null),M(Yt,n,null),M(ge,t,O),M(ge,n,L);}function _(O){O!==null&&l!==null&&(s=l,l=null),O!==null&&h!==null?(a=h,h=null):O===null&&(a=null),u=O,T(),O!==null&&y()&&(d=true,k());}function K(O){p=O,M(U(),i,Wo(O));}function w(){K("unknown"),d=false;}function I(){return u===null&&(u=g(),a=u===null?null:A()),u}function Q(){let O=g();return O!==null&&(u=O,a=A()),u}function ae(O){Q()===O&&T();}function Gt(){b+=1,l=null,h=null,s=false,_(null),o.clear(),w(),c({type:"endSession"});}let Wt=()=>p!=="cookies";return {subscribeLifecycle(O){return r.add(O),()=>r.delete(O)},hasToken:()=>I()!==null,bindingThumbprint:()=>(I(),a),declareOn(O){if(O.has("authorization"))return  false;let L=I();return !L&&!Wt()?false:(L&&O.set("authorization",`Bearer ${L}`),O.set(ut,lt),o.presentOn(O),true)},wantsToken:Wt,needsProbe:y,observe(O){let L=O.get(ct);L&&_(L),o.observe(O);},dropChallenge:o.clear,measureWith(O){S=O,k();},beginRead(){let O=I(),L=b;return {carriedToken:O!==null,endIfDead(){O!==null&&Q()===O&&b===L&&Gt();},recordCookieVerdict(ge){if(b===L&&y()){if(K(ge?"cookies":"bearer"),ge){_(null);return}ae(O);}}}},beginSession({remember:O}){b+=1,l=!O,o.clear(),w(),c({type:"beginSession",remember:O});},useCookieTransport(){I()===null&&(h=null,K("cookies"));},completeCookieTransport(){K("cookies"),_(null);},useBoundBearerTransport(O,L){if(!O)throw new Error("A session proof thumbprint is required.");h=O,L||(l=true),K("bearer");},endSession:Gt}}var sn=new Map;function un(e){let t=sn.get(e);if(t)return t;let n=Yo(e);return sn.set(e,n),n}var ln=Symbol.for("authowl.session-transport-integration.v1");function Xo(e,t){return Object.defineProperty(e,ln,{value:t,configurable:false,enumerable:false,writable:false}),e}function dn(e){return e?e[ln]??null:null}var dt="x-authowl-session-proof",Rn="x-authowl-session-binding",kn="x-authowl-session-binding-proof",Ue=()=>Promise.resolve().then(()=>(Sn(),wn));function ur(e,t){return t?.headers?new Headers(t.headers):typeof e=="object"&&e!==null&&"headers"in e?new Headers(e.headers):new Headers}function Tn(e,t){let n=un(e.projectId),i=(p,y)=>(t??globalThis.fetch)(p,y),o=typeof globalThis.location=="object"&&typeof globalThis.location.origin=="string"&&globalThis.location.origin!=="null"?globalThis.location.origin:null,r=null,c=false,u=()=>new Headers({"x-publishable-key":e.publishableKey});async function a(p){let y=p.get("authorization");y&&await Ue().then(b=>b.abandonSession(i,`${e.projectBaseURL}/session/abandon`,u(),y));}async function h(p){r=null,c=false;let y=await Ue().then(b=>b.prepareSenderConstrainedSession({tokens:n,start:p,clientOrigin:o,fetcher:i,projectBaseURL:e.projectBaseURL,headers:u()}));r=y.binding,c=y.cookieOnly;}return {fetch:async(p,y)=>{if(y?.credentials==="omit"||!n.wantsToken())return i(p,y);let b=ur(p,y),S=n.declareOn(b),d=b.get("authorization"),g=(y?.method??(typeof p=="object"&&p!==null&&"method"in p?p.method:"GET")).toUpperCase(),A=typeof p=="string"?p:p instanceof URL?p.toString():p.url;if(S&&o){let T=!!d;if(d){let _=d.replace(/^Bearer\s+/i,""),K=n.bindingThumbprint();if(K)try{b.set(dt,await Ue().then(w=>w.createStoredSessionProof({origin:o,expectedThumbprint:K,method:g,url:A,token:_})));}catch{await a(b),n.endSession(),b.delete("authorization"),b.delete(dt),b.delete(Rn),b.delete(kn),T=false;}}if(r){let _=r;b.set(Rn,_.nonce),b.set(T?kn:dt,await Ue().then(K=>K.createSessionProof({key:_.key,method:g,url:A,token:_.nonce})));}}let k=await i(p,{...y,headers:b});return S&&(k.status===401&&d&&(new URL(A).pathname.endsWith("/get-session")||new URL(A).pathname.endsWith("/sign-out"))?(await a(b),n.endSession(),r=null,c=false):(n.observe(k.headers),k.headers.has("set-auth-token")&&(c&&n.completeCookieTransport(),r=null,c=false))),k},probe:i,tokens:n,integration:dn(t),prepareSession:h}}function In(e){if(!e||typeof e!="object")throw new Error("AuthConfig is required");let t=rt(e.publishableKey),n=en(e.apiUrl,{allowHttpLoopback:t.env==="test"});return {publishableKey:e.publishableKey,apiUrl:n,decoded:t,projectBaseURL:`${n}/api/projects/${t.projectId}/auth`}}function lr(e){let t=In(e),{fetch:n,...i}=Tn({projectId:t.decoded.projectId,projectBaseURL:t.projectBaseURL,publishableKey:t.publishableKey},e.fetch);return {...e,...t,fetch:n,session:i}}var pt="authowl_invitation",ft="authowl.invitation-claim",Pn=/^[A-Za-z0-9_-]{1,128}$/,En=10080*60*1e3;function dr(e=Date.now()){if(typeof window>"u")return he(e);let t;try{t=new URL(window.location.href);}catch{return he(e)}let n=t.searchParams.get(pt);if(n===null)return he(e);t.searchParams.delete(pt);try{window.history.replaceState(window.history.state,"",t.toString());}catch{}if(!Pn.test(n))return he(e);let i={id:n,capturedAt:e};return M(U(),ft,JSON.stringify(i)),i}function he(e=Date.now()){let t=H(U(),ft);if(t===null)return null;let n;try{n=JSON.parse(t);}catch{return ye(),null}if(typeof n!="object"||n===null)return ye(),null;let{id:i,capturedAt:o}=n;return typeof i!="string"||!Pn.test(i)||typeof o!="number"||e-o>En?(ye(),null):{id:i,capturedAt:o}}function ye(){M(U(),ft,null);}var vn="authowl.last-used-method",pr=/^(password|username|magic-link|email-otp|phone-otp|passkey|sso|social:[a-z0-9][a-z0-9_-]{0,63})$/,gt=e=>`${vn}.${e}`;function ze(e){return pr.test(e)}function fr(e){let t=H(U(),gt(e));return t===null||!ze(t)?null:t}function gr(e,t){ze(t)&&(M(U(),Ne(e),null),M(U(),gt(e),t));}var Ne=e=>`${vn}.pending.${e}`;function mr(e,t){ze(t)&&M(U(),Ne(e),t);}function hr(e,t){let n=H(U(),Ne(e));M(U(),Ne(e),null),t&&n!==null&&ze(n)&&M(U(),gt(e),n);}function yr(e){let t=e?.enabledMethods??["password"],n=t.includes("password"),i=t.includes("passkey"),o=e?.authentication,r=e?.mfa;return {emailSignUp:o?.email.signUp??t.some(c=>c==="password"||c==="magic_link"||c==="email_otp"),passwordSignUp:o?.password.signUp??n,phoneSignUp:o?.phone.signUp??t.includes("phone_otp"),passwordSignIn:o?.email.signIn.includes("password")??n,passwordMinLength:o?.password.minLength??8,passwordMaxLength:o?.password.maxLength??128,magicLinkSignIn:o?.email.signIn.includes("magic_link")??t.includes("magic_link"),emailOtpSignIn:o?.email.signIn.includes("email_otp")??t.includes("email_otp"),phoneSignIn:o?.phone.signIn??t.includes("phone_otp"),usernameSignIn:o?.username.signIn??false,collectUsername:o?.username.collectOnSignUp??false,passkeySignIn:o?.passkey.signIn??i,passkeyAdd:o?.passkey.add??i,firstLastName:e?.userModel?.firstLastName??false,emailChange:e===null?false:e.userModel?.emailChange??true,accountDeletion:e?.userModel?.accountDeletion??e?.accountDeletion??false,emailVerificationRequired:e?.emailVerification?.required??e?.requireEmailVerification??false,emailVerificationMethod:e?.emailVerification?.method??"link",totp:r?.totp??e?.twoFactor??false,mfaRequired:r?.required??e?.mfaRequired??false,backupCodes:r?.backupCodes??e?.twoFactor??false,legacyNameField:e?.authentication===void 0}}var br=1e4,Ar=1024*1024,F=class extends Error{kind;requestId;constructor(t,n){super(Pr(t)),this.name="TransportError",this.kind=t,this.requestId=n;}},Dn=new WeakSet;function V(e,t){let n=new F(e,t);return Dn.add(n),n}async function _n({fetchImpl:e,url:t,init:n={},timeoutMs:i=br,maxResponseBytes:o=Ar,allowHttpLoopback:r=false,decode:c}){xn(i,"timeoutMs"),xn(o,"maxResponseBytes");let u=Zt(t,{allowHttpLoopback:r}),a=n.signal,h=new AbortController,s=null,l,p=new Promise(d=>{l=d;}),y=d=>{s===null&&(s=d,l({type:"abort",kind:d}),h.abort());},b=()=>y("aborted");a?.addEventListener("abort",b,{once:true});let S=setTimeout(()=>y("timeout"),i);a?.aborted&&b();try{if(s!==null)throw V(s);let d;try{d=await Promise.race([e(u.toString(),{...n,redirect:"error",signal:h.signal}).then(K=>({type:"response",response:K})),p]);}catch{throw V(s??"network")}if(d.type==="abort")throw V(d.kind);if(!Or(d.response))throw V("invalid_response");let g=d.response,A=Ir(g.headers),k=await wr(g,o,p,()=>s,A),T=kr(g,k,A),_;try{_=g.ok&&c?c(T,Object.freeze({status:g.status})):T;}catch{throw V("invalid_response",A)}return {response:g,data:_,...A===void 0?{}:{requestId:A}}}catch(d){throw d instanceof F&&Dn.has(d)?d:V(s??"network")}finally{clearTimeout(S),a?.removeEventListener("abort",b);}}function Or(e){if(!e||typeof e!="object")return  false;let t=e;return Number.isInteger(t.status)&&t.status>=0&&t.status<=599&&typeof t.statusText=="string"&&typeof t.ok=="boolean"&&typeof t.headers?.get=="function"&&(t.body===null||typeof t.body=="object"&&typeof t.body?.getReader=="function"&&typeof t.body.cancel=="function")}async function wr(e,t,n,i,o){let r=e.headers.get("content-length");if(r!==null){if(!/^\d+$/.test(r))throw Cn(e.body),V("invalid_response",o);if(Number(r)>t)throw Cn(e.body),V("response_too_large",o)}if(!e.body)return "";let c;try{c=e.body.getReader();}catch{throw V("network",o)}let u=[],a=0,h=null;try{for(;;){let p;try{p=await Promise.race([c.read(),n]);}catch{h=V(i()??"network",o);break}if(Sr(p)){h=V(p.kind,o);break}let{done:y,value:b}=p;if(y)break;if(b.byteLength!==0){if(a+=b.byteLength,a>t){h=V("response_too_large",o);break}u.push(b);}}}finally{h&&Rr(c);try{c.releaseLock();}catch{}}if(h)throw h;let s=new Uint8Array(a),l=0;for(let p of u)s.set(p,l),l+=p.byteLength;try{return new TextDecoder("utf-8",{fatal:!0}).decode(s)}catch{throw V("invalid_response",o)}}function Sr(e){return "type"in e&&e.type==="abort"}function Cn(e){if(e)try{e.cancel().catch(()=>{});}catch{}}function Rr(e){try{e.cancel().catch(()=>{});}catch{}}function kr(e,t,n){if(e.status===204||e.status===205)return null;let i=Tr(e.headers.get("content-type"));if(!e.ok&&(!i||t.length===0))return null;if(!i||t.length===0)throw V("invalid_response",n);try{return JSON.parse(t)}catch{if(!e.ok)return null;throw V("invalid_response",n)}}function Tr(e){if(e===null)return  false;let t=e.split(";",1)[0]?.trim().toLowerCase();return t==="application/json"||t?.endsWith("+json")===true}function Ir(e){let t=e.get("x-request-id")?.trim();if(!(!t||t.length>256||!/^[A-Za-z0-9._:-]+$/.test(t)))return t}function xn(e,t){if(!Number.isInteger(e)||e<=0)throw new TypeError(`${t} must be a positive integer.`)}function Pr(e){switch(e){case "aborted":return "The request was cancelled.";case "timeout":return "The request timed out.";case "response_too_large":return "The response exceeded the allowed size.";case "invalid_response":return "The service returned an invalid response.";case "network":return "The network request could not be completed."}}var Le=class extends Error{status;requestId;constructor(t,n,i){super(`${t} request failed with status ${n.status}.`),this.name="AuthOwlHttpError",this.status=n.status,this.requestId=i;}};function $(e,t,n={}){let i=new Headers(n.init?.headers);return i.set("x-publishable-key",e.publishableKey),_n({fetchImpl:e.fetch,url:t,init:{...n.init,headers:i},allowHttpLoopback:e.decoded.env==="test",...n.timeoutMs===void 0?{}:{timeoutMs:n.timeoutMs},...n.maxResponseBytes===void 0?{}:{maxResponseBytes:n.maxResponseBytes},...n.decode===void 0?{}:{decode:n.decode}})}function ee(e,t){if(!e.response.ok)throw new Le(t,e.response,e.requestId);return e.data}var te=new Map,Er=/^[a-z]{2}$/;function vr(e,t){if(typeof window>"u")return ()=>{};if(t===null)return te.delete(e),()=>{};let n=t.trim().toLowerCase();if(!Er.test(n))return ()=>{};let i=Symbol(e),o=te.get(e)??[];return o.push({token:i,locale:n}),te.set(e,o),()=>{let r=te.get(e);if(!r)return;let c=r.filter(u=>u.token!==i);c.length===0?te.delete(e):te.set(e,c);}}function mt(e){return typeof window>"u"?null:te.get(e)?.at(-1)?.locale??null}var zn="x-authowl-turnstile-token",Ln="x-authowl-locale",Cr=1e4,xr=32,Dr=2e4;function ne(e,t){return {post:(n,i,o,r)=>e.request(n,{method:"POST",body:i,fetchOptions:o,decode:r}),mutation:async(n,i)=>{let o=await n;return o.error===null&&(i===void 0||o.data!==null&&i(o.data))&&await t(),o}}}function Ae(e,t=e.projectBaseURL){return {async request(n,i={}){let o=Nr(t,n,i.query),r=i.method??(i.body===void 0?"GET":"POST"),c=new Headers(i.fetchOptions?.headers);i.fetchOptions?.authChallengeToken&&c.set(zn,i.fetchOptions.authChallengeToken);let u=mt(e.decoded.projectId);u&&c.set(Ln,u),i.body!==void 0&&c.set("content-type","application/json");let a={method:r,headers:c,credentials:i.credentials??"include",...i.body===void 0?{}:{body:JSON.stringify(i.body)}},h=Object.freeze({method:r,path:n});await i.fetchOptions?.onRequest?.(h);let s=Ur(r,i.fetchOptions),l;try{l=await _r(e,o,{...a,signal:i.fetchOptions?.signal},s);}catch(g){let A=Nn(g);return await i.fetchOptions?.onError?.(ht(h,A,Mr(g))),{data:null,error:A}}let{response:p,requestId:y}=l,b=Vr(n,l.data),S=b;if(p.ok)try{S=bt(b),i.decode&&(S=i.decode(S));}catch{let g=Nn(new F("invalid_response",y));return await i.fetchOptions?.onError?.(ht(h,g,"invalid_response")),{data:null,error:g}}let d=Object.freeze({...h,status:p.status,...y===void 0?{}:{requestId:y}});if(await i.fetchOptions?.onResponse?.(d),!p.ok){let g=zr(p,b,y);return g.code===nn&&e.session.tokens.dropChallenge(),await i.fetchOptions?.onError?.(ht(h,g,"api")),{data:null,error:g}}return await i.fetchOptions?.onSuccess?.(d),{data:S,error:null}}}}async function _r(e,t,n,i){let o=Date.now()+Cr;for(let r=0;r<i;r+=1){let c=o-Date.now();if(c<=0)throw new F("timeout");try{let u=await $(e,t,{init:n,timeoutMs:Math.max(1,Math.ceil(c))});if(u.response.status<500||r===i-1)return u}catch(u){if(r===i-1||!(u instanceof F)||u.kind!=="network")throw u}await Fr(50*2**r,n.signal,o);}throw new F("network")}function Ur(e,t){if(e!=="GET"||t?.authChallengeToken)return 1;let n=t?.retry;return typeof n!="number"||!Number.isFinite(n)?1:Math.min(Math.max(Math.trunc(n),0),3)+1}function Nr(e,t,n){let i=new URL(`${e}${t.startsWith("/")?t:`/${t}`}`);for(let[o,r]of Object.entries(n??{}))r!==void 0&&i.searchParams.set(o,String(r));return i.toString()}function zr(e,t,n){let i=be(t)?t:{},o=Lr(i,e.headers);return {status:e.status,statusText:e.statusText,code:typeof i.code=="string"?i.code:void 0,...n===void 0?{}:{requestId:n},...typeof i.current_version=="number"?{currentVersion:i.current_version}:{},...o!==void 0?{retryAfterSeconds:o}:{},message:typeof i.message=="string"?i.message:typeof i.error=="string"?i.error:typeof i.detail=="string"?i.detail:e.statusText||"Request failed"}}function Lr(e,t){let n=(typeof e.retryAfterSeconds=="number"&&Number.isFinite(e.retryAfterSeconds)?e.retryAfterSeconds:void 0)??Un(t.get("retry-after"))??Un(t.get("x-retry-after"));if(n!==void 0)return Math.min(Math.max(Math.trunc(n),1),86400)}function Un(e){if(!e)return;let t=e.trim();if(!/^\d+$/.test(t))return;let n=Number(t);return Number.isFinite(n)?n:void 0}function Nn(e){let t=e instanceof F?e.kind:"network";return {status:0,...{aborted:{statusText:"ABORTED",code:"REQUEST_ABORTED",message:"The request was cancelled."},timeout:{statusText:"TIMEOUT",code:"REQUEST_TIMEOUT",message:"The request timed out."},response_too_large:{statusText:"INVALID_RESPONSE",code:"RESPONSE_TOO_LARGE",message:"The service response was too large."},invalid_response:{statusText:"INVALID_RESPONSE",code:"INVALID_RESPONSE",message:"The service returned an invalid response."},network:{statusText:"FETCH_ERROR",code:"FETCH_ERROR",message:"Network request failed."}}[t],...e instanceof F&&e.requestId?{requestId:e.requestId}:{}}}function ht(e,t,n){return Object.freeze({...e,status:t.status??0,...t.requestId===void 0?{}:{requestId:t.requestId},failure:n})}function Mr(e){return e instanceof F?e.kind:"network"}function Fr(e,t,n){return new Promise((i,o)=>{if(t?.aborted){o(new F("aborted"));return}let r=n-Date.now();if(r<=0){o(new F("timeout"));return}let c=Math.min(e,r),u=()=>{clearTimeout(a),o(new F("aborted"));},a=setTimeout(()=>{t?.removeEventListener("abort",u),Date.now()>=n?o(new F("timeout")):i();},c);t?.addEventListener("abort",u,{once:true}),t?.aborted&&u();})}function bt(e,t="",n=0,i={nodes:0}){if(i.nodes+=1,n>xr||i.nodes>Dr)throw new Error("response traversal limit exceeded");if(typeof e=="string"&&/^(?:createdAt|updatedAt|expiresAt)$/.test(t)){let o=new Date(e);return Number.isNaN(o.getTime())?e:o}return Array.isArray(e)?e.map(o=>bt(o,"",n+1,i)):be(e)?Object.fromEntries(Object.entries(e).map(([o,r])=>[o,Kr(o)?r:bt(r,o,n+1,i)])):e}function Kr(e){return e==="metadata"||e==="public_metadata"||e==="unsafe_metadata"||e==="private_metadata"||e==="publicMetadata"||e==="unsafeMetadata"||e==="privateMetadata"}function Vr(e,t){if(e==="/list-sessions"&&Array.isArray(t))return t.map(o=>be(o)?yt(o):o);if(!be(t))return t;let i=e==="/change-password"||e==="/passkey/verify-authentication"||e==="/phone-otp/verify"||e==="/sign-up/email"||e.startsWith("/sign-in/")||e.startsWith("/two-factor/verify-")?yt(t):t;return e==="/sign-up/email"&&!("sessionCreated"in i)&&(i={...i,sessionCreated:typeof t.token=="string"&&t.token.length>0}),(e==="/get-session"||e==="/passkey/verify-authentication")&&be(i.session)&&(i={...i,session:yt(i.session)}),i}function yt(e){if(!Object.hasOwn(e,"token"))return e;let t={...e};return delete t.token,t}function be(e){return !!e&&typeof e=="object"&&!Array.isArray(e)}var Hr=new Set(["__proto__","constructor","prototype"]);function m(e){(!e||typeof e!="object"||Array.isArray(e))&&f();let t=Object.getPrototypeOf(e);return t!==Object.prototype&&t!==null&&f(),e}function R(e){return typeof e!="string"&&f(),e}function P(e){return typeof e!="boolean"&&f(),e}function E(e){return (!(e instanceof Date)||Number.isNaN(e.getTime()))&&f(),e}function ie(e){return (!Array.isArray(e)||!e.every(t=>typeof t=="string"))&&f(),[...e]}function x(e,t){let n=e[t];return n==null||typeof n=="string"?n:f()}function Mn(e,t){let n=e[t];return n==null||typeof n=="boolean"?n:f()}function B(e){let t=m(e),n=t.email;return n!==null&&typeof n!="string"&&f(),{id:R(t.id),email:n,emailVerified:P(t.emailVerified),createdAt:E(t.createdAt),updatedAt:E(t.updatedAt),...q("phoneNumber",x(t,"phoneNumber")),...q("username",x(t,"username")),...q("displayUsername",x(t,"displayUsername")),...q("firstName",x(t,"firstName")),...q("lastName",x(t,"lastName")),...q("name",x(t,"name")),...q("image",x(t,"image")),...q("twoFactorEnabled",Mn(t,"twoFactorEnabled"))}}function Me(e){let t=m(e),n=t.membership;return {id:R(t.id),userId:R(t.userId),expiresAt:E(t.expiresAt),...q("activeOrganizationId",x(t,"activeOrganizationId")),...q("activeTeamId",x(t,"activeTeamId")),...q("membership",n==null?n:qr(n)),...q("pendingMfaEnrollment",Mn(t,"pendingMfaEnrollment"))}}function f(){throw new TypeError("AuthOwl response does not match its runtime contract.")}function G(e,t=20,n=1e4){return (!e||typeof e!="object"||Array.isArray(e))&&f(),Ot(e,t,n)}function Ot(e,t=20,n=1e4){return At(e,0,{nodes:0},t,n)}function qr(e){let t=m(e);return {role:R(t.role),...t.roles===void 0?{}:{roles:ie(t.roles)},permissions:ie(t.permissions),...t.teams===void 0?{}:{teams:ie(t.teams)}}}function At(e,t,n,i,o){if(n.nodes+=1,(t>i||n.nodes>o)&&f(),e===null||typeof e=="string"||typeof e=="boolean")return e;if(typeof e=="number")return Number.isFinite(e)||f(),e;if(Array.isArray(e))return e.map(u=>At(u,t+1,n,i,o));(!e||typeof e!="object")&&f();let r=Object.getPrototypeOf(e);r!==Object.prototype&&r!==null&&f();let c={};for(let[u,a]of Object.entries(e))Hr.has(u)&&f(),c[u]=At(a,t+1,n,i,o);return c}function q(e,t){return t===void 0?{}:{[e]:t}}function Fn({http:e,probe:t,tokens:n,channelName:i}){let o=new Set,r=null,c=null,u=null,a=null,h=null,s=null,l,p=w=>{S(w);};l={data:null,isPending:true,isRefetching:false,error:null,refetch:p};function y(w){l=w;for(let I of o)I();}async function b(w){return e.request("/get-session",{query:w?.query,decode:wt})}function S(w){if(w?.query?.disableCookieCache===true)return g(w);if(a)return a;if(h)return h;let I=g(w).finally(()=>{h===I&&(h=null);});return h=I,I}function d(){if(a)return a;let w=g({query:{disableCookieCache:true}}).finally(()=>{a===w&&(a=null);});return a=w,w}async function g(w){u?.abort();let I=new AbortController;u=I,y({...l,isPending:l.data===null&&l.error===null,isRefetching:l.data!==null});let Q=n.beginRead(),ae=await e.request("/get-session",{query:w?.query,fetchOptions:{signal:I.signal},decode:wt});if(u===I&&(u=null,y({data:ae.data,error:ae.error,isPending:false,isRefetching:false,refetch:p}),ae.error===null)){if(ae.data===null){Q.endIfDead();return}await A(Q);}}async function A(w){if(n.needsProbe()){if(!w.carriedToken){w.recordCookieVerdict(true);return}return s||k(w)}}function k(w){let I=t.request("/get-session",{query:{disableCookieCache:true},decode:wt}).then(Q=>{s===I&&Q.error===null&&w.recordCookieVerdict(Q.data!==null);}).finally(()=>{s===I&&(s=null);});return s=I,I}function T(){r?.postMessage({type:"session-changed"});}function _(){if(typeof window>"u"||c)return;let w=()=>{S();},I=()=>{document.visibilityState==="visible"&&S();};window.addEventListener("focus",w),document.addEventListener("visibilitychange",I),typeof BroadcastChannel<"u"&&(r=new BroadcastChannel(i),r.addEventListener("message",w)),c=()=>{window.removeEventListener("focus",w),document.removeEventListener("visibilitychange",I),r?.close(),r=null,c=null;};}function K(w){return o.add(w),o.size===1&&(_(),S()),()=>{if(o.delete(w),o.size===0){let I=u;u=null,h=null,a=null,I?.abort(),c?.();}}}return n.measureWith(()=>{n.needsProbe()&&k(n.beginRead());}),{store:{subscribe:K,getSnapshot:()=>l,refresh:d},getSession:b,notifyMutation(){T(),s&&s.catch(()=>{}).then(()=>{!n.needsProbe()&&n.hasToken()&&T();}),o.size>0&&S({query:{disableCookieCache:true}});}}}function wt(e){if(e===null)return null;let t=m(e);return (t.session===void 0||t.user===void 0)&&f(),{session:Me(t.session),user:B(t.user)}}St();function we(){let e=globalThis.crypto.getRandomValues(new Uint8Array(16));e[6]=e[6]&15|64,e[8]=e[8]&63|128;let t=Array.from(e,n=>n.toString(16).padStart(2,"0")).join("");return `${t.slice(0,8)}-${t.slice(8,12)}-${t.slice(12,16)}-${t.slice(16,20)}-${t.slice(20)}`}async function Kn(e,t){return e.request("/user/metadata",{fetchOptions:t,decode:Hn})}async function Vn(e,t,n){return e.request("/user/metadata",{method:"PATCH",body:{expected_version:t.expectedVersion,unsafe_metadata:t.unsafeMetadata},fetchOptions:n,decode:Hn})}function Hn(e){let t=m(e),n=G(t.public_metadata),i=G(t.unsafe_metadata);if(!Number.isSafeInteger(t.metadata_version)||t.metadata_version<0)throw new TypeError("Invalid AuthOwl metadata response");return {publicMetadata:n,unsafeMetadata:i,metadataVersion:t.metadata_version}}function Bn(e,t){let{post:n,mutation:i}=ne(e,t);return {getMetadata:o=>Kn(e,o),updateUnsafeMetadata:(o,r)=>Vn(e,o,r),updateProfile:(o,r)=>i(n("/update-user",o,r,Se)),changeEmail:(o,r)=>i(n("/change-email",o,r,Se)),changePassword:(o,r)=>i(n("/change-password",o,r,Br)),listSessions:o=>e.request("/list-sessions",{fetchOptions:o,decode:jr}),revokeSession:({sessionId:o},r)=>i(n("/revoke-session",{sessionId:o},r,Se)),revokeOtherSessions:o=>i(n("/revoke-other-sessions",{},o,Se)),listSocialAccounts:async o=>{let r=await e.request("/list-accounts",{fetchOptions:o,decode:Jr});if(!r.data)return {data:null,error:r.error};let c=r.data.length>1;return {...r,data:r.data.filter(u=>u.providerId!=="credential").map(u=>({...u,canUnlink:c}))}},linkSocial:(o,r)=>n("/link-social",o,r,$r),unlinkSocial:(o,r)=>i(n("/unlink-account",o,r,Se)),delete:(o={},r)=>i(n("/delete-user",o,r,Gr))}}function Se(e){let t=m(e);return {status:P(t.status)}}function Br(e){let t=m(e);return {user:B(t.user)}}function jr(e){return Array.isArray(e)||f(),e.map(t=>{let n=m(t);return {id:R(n.id),userId:R(n.userId),createdAt:E(n.createdAt),updatedAt:E(n.updatedAt),expiresAt:E(n.expiresAt),...qn("ipAddress",x(n,"ipAddress")),...qn("userAgent",x(n,"userAgent"))}})}function Jr(e){return Array.isArray(e)||f(),e.map(t=>{let n=m(t);return {id:R(n.id),userId:R(n.userId),providerId:R(n.providerId),accountId:R(n.accountId),scopes:ie(n.scopes),createdAt:E(n.createdAt),updatedAt:E(n.updatedAt)}})}function $r(e){let t=m(e);return {url:R(t.url),redirect:P(t.redirect)}}function Gr(e){let t=m(e);return {success:P(t.success),message:R(t.message)}}function qn(e,t){return t===void 0?{}:{[e]:t}}function Fe(e,t){return !e||!t?false:e.permissions.includes(t)}function jn(e,t){return !e||!t?false:e.teams?.includes(t)??false}function Jn(e,t){return e?e.roles===void 0?e.role===t:e.roles.includes(t):false}function Ke(e,t){if(!e)return  false;let{role:n,permission:i,teamId:o}=t;return !(n===void 0&&i===void 0&&o===void 0||n!==void 0&&!Jn(e,n)||i!==void 0&&!e.permissions.includes(i)||o!==void 0&&!jn(e,o))}function Wr(e){return {has:t=>Ke(e,t),hasPermission:t=>Fe(e,t.permission)}}var Yr=new Set(["pending","accepted","rejected","canceled"]),Rt=1e4;function $n(e){let t=m(e);return t.recipientHint!==null&&t.recipientHint!=="new_user"&&f(),{recipientHint:t.recipientHint}}function le(e,t,n){let i=m(e),o={id:v(i.id),name:v(i.name),slug:v(i.slug),createdAt:E(i.createdAt),...Re("logo",x(i,"logo")),...Re("metadata",i.metadata===void 0?void 0:Ot(i.metadata))};return J(o.id,t),J(o.slug,n),o}function Gn(e){return W(e,le)}function kt(e,t,n){return e===null?null:(t===null&&f(),le(e,t,n))}function Wn(e,t,n){if(e===null)return null;let i=m(e),o=le(i,t,n);return {...o,members:W(i.members,r=>ai(r,o.id)),invitations:W(i.invitations,r=>Y(r,void 0,o.id))}}function Tt(e,t,n=false){let i=W(e,o=>ke(o));return n||Ie(i.map(o=>o.organizationId),t),i}function Yn(e,t){let n=W(e,i=>It(i));return Ie(n.map(i=>i.teamId),t),n}function It(e,t,n){let i=m(e),o={id:v(i.id),teamId:v(i.teamId),userId:v(i.userId),createdAt:E(i.createdAt)};return J(o.teamId,t),J(o.userId,n),o}function Xn(e,t,n){return e===null?null:(t===null&&f(),ke(e,t,n))}function Qn(e,t){let n=m(e);return (!Number.isSafeInteger(n.total)||n.total<0)&&f(),{members:Xr(n.members,t),total:n.total}}function Y(e,t,n){let i=m(e),o=v(i.status);Yr.has(o)||f();let r={id:v(i.id),organizationId:v(i.organizationId),email:Te(i.email),role:v(i.role),status:o,inviterId:v(i.inviterId),expiresAt:E(i.expiresAt),createdAt:E(i.createdAt)};return J(r.id,t),J(r.organizationId,n),r}function Zn(e,t){let n=W(e,i=>Y(i));return Ie(n.map(i=>i.organizationId),t),n}function ei(e){return W(e,t=>{let n=m(t);return {...Y(n),organizationName:Te(n.organizationName)}})}function ti(e,t){let n=m(e);return {...Y(n,t),organizationName:v(n.organizationName),organizationSlug:v(n.organizationSlug),inviterEmail:ci(n.inviterEmail)}}function ni(e,t){let n=m(e),i=Y(n.invitation,t);return {invitation:i,member:de(n.member,void 0,i.organizationId)}}function ii(e,t){let n=m(e);return n.member!==null&&f(),{invitation:n.invitation===null?null:Y(n.invitation,t),member:null}}function oi(e,t){return e===null?null:Y(e,t)}function ri(e,t,n){let i=m(e);return {member:de(i.member,n,t)}}function de(e,t,n){let i=m(e),o={id:v(i.id),organizationId:v(i.organizationId),userId:v(i.userId),role:v(i.role),createdAt:E(i.createdAt),...i.user===void 0?{}:{user:ui(i.user)}};return J(o.id,t),J(o.organizationId,n),o}function si(e,t){let n=W(e,i=>{let o=m(i);return {organizationId:v(o.organizationId),data:{role:v(o.role),...Re("permission",o.permission===void 0?void 0:Qr(o.permission)),...Re("customPermissionKeys",o.customPermissionKeys===void 0?void 0:ie(o.customPermissionKeys))}}});return Ie(n.map(i=>i.organizationId),t),n.map(i=>i.data)}function ke(e,t,n){let i=m(e),o=i.updatedAt,r={id:v(i.id),name:Te(i.name),organizationId:v(i.organizationId),createdAt:E(i.createdAt),...o===void 0?{}:{updatedAt:E(o)}};return J(r.id,t),J(r.organizationId,n),r}function Pt(e){let t=m(e);return {message:Te(t.message)}}function ai(e,t){let n=m(e);return {...de(n,void 0,t),user:ui(n.user)}}function Xr(e,t){let n=W(e,i=>ai(i));return Ie(n.map(i=>i.organizationId),t),n}function Qr(e){let t=m(e),n={};for(let[i,o]of Object.entries(t))(i==="__proto__"||i==="constructor"||i==="prototype"||i.length===0||i.length>Rt||!Array.isArray(o))&&f(),n[i]=o.map(r=>v(r));return n}function v(e){let t=R(e);return (t.length===0||t.length>Rt)&&f(),t}function Te(e){if(e==null)return "";let t=R(e);return t.length>Rt&&f(),t}function ci(e){return e===null?null:v(e)}function J(e,t){t!==void 0&&e!==t&&f();}function Ie(e,t){let n=t??e[0];n!==void 0&&e.some(i=>i!==n)&&f();}function ui(e){let t=m(e);return {id:v(t.id),name:Te(t.name),email:ci(t.email),...Re("image",x(t,"image"))}}function W(e,t){return Array.isArray(e)||f(),e.map(n=>t(n))}function Re(e,t){return t===void 0?{}:{[e]:t}}function li(e,t,n=()=>null){let{post:i,mutation:o}=ne(e,t),r=new Set,c=()=>{for(let s of r)try{s();}catch{}},u=new Map,a=(s,l,p,y)=>{if(p)return e.request(s,{query:l,fetchOptions:p,decode:y});let b=`${s}\0${JSON.stringify(l??null)}`,S=u.get(b);if(S)return S;let d=e.request(s,{query:l,decode:y}).finally(()=>{u.delete(b);});return u.set(b,d),d},h=async s=>{let l=await o(s).finally(()=>u.clear());return l.error===null&&c(),l};return {subscribe(s){return r.add(s),()=>r.delete(s)},create:(s,l)=>h(i("/organization/create",s,l,le)),list:s=>a("/organization/list",void 0,s,Gn),get:(s={},l)=>a("/organization/get-full-organization",{organizationId:s.organizationId,organizationSlug:s.organizationSlug,membersLimit:s.membersLimit},l,p=>Wn(p,s.organizationId,s.organizationSlug)),setActive:(s,l)=>h(i("/organization/set-active",s,l,p=>kt(p,s.organizationId,s.organizationSlug))),createTeam:(s,l)=>h(i("/organization/create-team",s,l,p=>ke(p,void 0,s.organizationId))),listTeams:(s={},l)=>a("/organization/list-teams",{organizationId:s.organizationId},l,p=>Tt(p,s.organizationId)),updateTeam:(s,l)=>h(i("/organization/update-team",s,l,p=>ke(p,s.teamId,s.data.organizationId))),removeTeam:(s,l)=>h(i("/organization/remove-team",s,l,Pt)),listUserTeams:s=>a("/organization/list-user-teams",void 0,s,l=>Tt(l,void 0,true)),listTeamMembers:(s={},l)=>a("/organization/list-team-members",{teamId:s.teamId},l,p=>Yn(p,s.teamId)),addTeamMember:(s,l)=>h(i("/organization/add-team-member",s,l,p=>It(p,s.teamId,s.userId))),removeTeamMember:(s,l)=>h(i("/organization/remove-team-member",s,l,Pt)),setActiveTeam:(s,l)=>h(i("/organization/set-active-team",s,l,p=>Xn(p,s.teamId))),update:(s,l)=>h(i("/organization/update",s,l,p=>kt(p,s.organizationId))),delete:(s,l)=>h(i("/organization/delete",s,l,p=>le(p,s.organizationId))),listMembers:(s={},l)=>a("/organization/list-members",{organizationId:s.organizationId,organizationSlug:s.organizationSlug,limit:s.limit,offset:s.offset,sortBy:s.sortBy,sortDirection:s.sortDirection,filterField:s.filterField,filterValue:s.filterValue,filterOperator:s.filterOperator},l,p=>Qn(p,s.organizationId)),inviteMember:(s,l)=>h(i("/organization/invite-member",s,l,p=>Y(p,void 0,s.organizationId))),listInvitations:(s={},l)=>a("/organization/list-invitations",{organizationId:s.organizationId},l,p=>Zn(p,s.organizationId)),listUserInvitations:s=>a("/organization/list-user-invitations",void 0,s,ei),getInvitation:(s,l)=>a("/organization/get-invitation",{id:s.id},l,p=>ti(p,s.id)),getInvitationRecipientHint:(s,l)=>a("/organization/invitation-recipient-hint",{invitationId:s.invitationId},l,$n),acceptInvitation:(s,l)=>h(i("/organization/accept-invitation",s,l,p=>ni(p,s.invitationId))),rejectInvitation:(s,l)=>h(i("/organization/reject-invitation",s,l,p=>ii(p,s.invitationId))),cancelInvitation:(s,l)=>h(i("/organization/cancel-invitation",s,l,p=>oi(p,s.invitationId))),removeMember:(s,l)=>h(i("/organization/remove-member",s,l,p=>ri(p,s.organizationId,s.memberIdOrEmail.includes("@")?void 0:s.memberIdOrEmail))),updateMemberRole:(s,l)=>h(i("/organization/update-member-role",s,l,p=>de(p,s.memberId,s.organizationId))),leave:(s,l)=>h(i("/organization/leave",s,l,p=>de(p,void 0,s.organizationId))),listRoles:(s={},l)=>a("/organization/list-roles",{organizationId:s.organizationId},l,p=>si(p,s.organizationId)),has:s=>Ke(n(),s),hasPermission:s=>Fe(n(),s.permission)}}function qe(e){return {listConsentPreferences:t=>e.request("/privacy/consent-decisions",{fetchOptions:t,decode:Zr}),recordConsent:(t,n)=>e.request("/privacy/consent-decisions",{method:"POST",body:{...t,correlationId:t.correlationId??we()},fetchOptions:n,decode:ts}),listRightsRequests:t=>e.request("/privacy/rights",{fetchOptions:t,decode:ns}),createRightsRequest:(t,n)=>e.request("/privacy/rights",{method:"POST",body:t,fetchOptions:n,decode:is})}}function Zr(e){let t=m(e);return Array.isArray(t.preferences)||f(),{preferences:t.preferences.map(es)}}function es(e){let t=m(e);return {purposeId:R(t.purposeId),purposeVersionId:R(t.purposeVersionId),code:R(t.code),state:os(t.state,["granted","refused","withdrawn"]),updatedAt:Ve(t.updatedAt),decidedAt:Ve(t.decidedAt)}}function ts(e){let t=m(e);return t.recorded!==true&&f(),{recorded:true,decision:Pe(t.decision,["granted","refused","withdrawn"]),decidedAt:He(t.decidedAt)}}function ns(e){let t=m(e);return Array.isArray(t.requests)||f(),{requests:t.requests.map(di)}}function is(e){return {request:di(m(e).request)}}function di(e){let t=m(e);return {id:R(t.id),rightType:Pe(t.rightType,["access","correction","portability","erasure","restriction","objection","consent_withdrawal"]),state:Pe(t.state,["received","identity_pending","in_progress","restricted","completed","denied","withdrawn"]),locale:Pe(t.locale,["en","ar"]),receivedAt:He(t.receivedAt),acknowledgedAt:Ve(t.acknowledgedAt),fulfilmentDeadline:He(t.fulfilmentDeadline),completedAt:Ve(t.completedAt)}}function Ve(e){return e===null?null:He(e)}function He(e){if(e instanceof Date)return E(e);typeof e!="string"&&f();let t=new Date(e);return Number.isNaN(t.getTime())&&f(),t}function Pe(e,t){return (typeof e!="string"||!t.includes(e))&&f(),e}function os(e,t){return e===null?null:Pe(e,t)}var pi=4096,rs=4096,ss=100,as=256,cs=16,us=64,ls=12;function vt(e){let t=m(e);return t.twoFactorRedirect===true?((t.user!==void 0||t.redirect!==void 0||t.url!==void 0)&&f(),{twoFactorRedirect:true,...t.twoFactorMethods===void 0?{}:{twoFactorMethods:Ci(t.twoFactorMethods,cs,us)}}):(t.twoFactorRedirect!==void 0&&f(),{redirect:P(t.redirect),...ms(t,"url"),user:B(t.user)})}function fi(e){let t=m(e);return {user:B(t.user)}}function gi(e){let t=m(e);return {sessionCreated:P(t.sessionCreated),user:B(t.user)}}function mi(e,t){let n=m(e),i=P(n.redirect);n.user===null&&f();let o=n.user!==void 0&&n.user!==null,r=n.url!==void 0&&n.url!==null;return i?((o||!r)&&f(),{redirect:true,url:Et(n.url,t)}):(o===r&&f(),o?{redirect:false,user:B(n.user)}:{redirect:false,url:Et(n.url,t)})}function hi(e,t){let n=m(e);return (n.redirect!==true||n.user!==void 0)&&f(),{redirect:true,url:Et(n.url,t)}}function yi(e){return {status:P(m(e).status)}}function bi(e){return {success:P(m(e).success)}}function Ai(e){return m(e).status!=="pending"&&f(),{status:"pending"}}function Oi(e){let t=m(e);if(t.kind==="authowl_turnstile")return {kind:"authowl_turnstile"};t.kind!=="akedly_shield_v1_2"&&f();let n=m(t.turnstile),i=n.siteKey===null?null:R(n.siteKey);return {kind:"akedly_shield_v1_2",connectionId:R(t.connectionId),challenge:R(t.challenge),difficulty:ds(t.difficulty),challengeToken:R(t.challengeToken),challengeRequired:P(t.challengeRequired),turnstile:{required:P(n.required),siteKey:i}}}function ds(e){return (!Number.isSafeInteger(e)||Number(e)<0||Number(e)>ls)&&f(),Number(e)}function wi(e){let t=m(e);return (t.status!==true||t.sessionCreated!==true)&&f(),{status:true,sessionCreated:true,user:ps(t.user)}}function Ct(e){return {status:P(m(e).status)}}function Si(e){return {status:P(m(e).status)}}function Ri(e){let t=m(e);return {status:P(t.status),user:B(t.user)}}function ki(e){return {success:P(m(e).success)}}function Ti(e){let t=m(e);return {totpURI:gs(t.totpURI),backupCodes:vi(t.backupCodes)}}function Ii(e){return {status:P(m(e).status)}}function Be(e){return m(e).status!==true&&f(),{status:true}}function Pi(e){return {status:P(m(e).status)}}function Ei(e){let t=m(e);return t.status!==void 0&&t.status!==true&&f(),{backupCodes:vi(t.backupCodes)}}function ps(e){let t=m(e);return {id:pe(t.id,512),...hs(t,"name",1024),phoneNumber:pe(t.phoneNumber,64),phoneNumberVerified:P(t.phoneNumberVerified),...t.createdAt===void 0?{}:{createdAt:E(t.createdAt)},...t.updatedAt===void 0?{}:{updatedAt:E(t.updatedAt)}}}function Et(e,t){let n=pe(e,pi);/[\u0000-\u0020\u007f]/u.test(n)&&f();let i;try{i=new URL(n);}catch{return f()}return (i.username||i.password)&&f(),i.protocol==="https:"||t&&i.protocol==="http:"&&fs(i.hostname)?i.href:f()}function fs(e){let t=e.toLowerCase();return t==="localhost"||t==="127.0.0.1"||t==="[::1]"}function gs(e){let t=pe(e,rs),n;try{n=new URL(t);}catch{return f()}let i=n.searchParams.get("secret");return (n.protocol!=="otpauth:"||n.hostname.toLowerCase()!=="totp"||n.username||n.password||n.hash||i===null||i.length===0||i.length>512||/\s/u.test(i))&&f(),t}function vi(e){return Ci(e,ss,as)}function Ci(e,t,n){(!Array.isArray(e)||e.length===0||e.length>t)&&f();let i=e.map(o=>pe(o,n));return i.some(o=>o.trim().length===0)&&f(),new Set(i).size!==i.length&&f(),i}function pe(e,t){let n=R(e);return (n.length===0||n.length>t)&&f(),n}function ms(e,t){let n=e[t];return n==null?{}:{[t]:pe(n,pi)}}function hs(e,t,n){let i=x(e,t);return i===void 0?{}:(i!==null&&i.length>n&&f(),{[t]:i})}var xi=new Set([1564,8206,8207,8234,8235,8236,8237,8238,8294,8295,8296,8297]),je=new Set([9,10,11,12,13,32,133,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288,65279]);function Je(e){if(e===void 0)return {valid:true,value:void 0};for(let n of e){let i=n.codePointAt(0);if(i===void 0||_i(n,i)||Di(i)||xi.has(i))return {valid:false}}let t=ys(e);return xt(t)?{valid:true,value:t}:{valid:false}}function xt(e){let t=0,n,i;for(let o of e){if(t+=1,t>256)return  false;let r=o.codePointAt(0);if(r===void 0||_i(o,r)||Di(r)||xi.has(r))return  false;n??=r,i=r;}return t>0&&n!==void 0&&i!==void 0&&!je.has(n)&&!je.has(i)}function $e(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_PASSKEY_NAME",message:"Passkey names must contain 1 to 256 safe Unicode characters."}}}function ys(e){let t=0,n=e.length;for(;t<n;){let i=e.codePointAt(t);if(i===void 0||!je.has(i))break;t+=i>65535?2:1;}for(;n>t;){let i=e.codePointAt(n-1);if(i===void 0)break;let r=i>=56320&&i<=57343?n-2:n-1,c=e.codePointAt(r);if(c===void 0||!je.has(c))break;n=r;}return e.slice(t,n)}function Di(e){return e>=0&&e<=31||e>=127&&e<=159}function _i(e,t){return e.length===1&&t>=55296&&t<=57343}var zi=12,Li=5e3,bs=8,As=1e3,Os=16,Ui=512,Mi=100,Fi=8192,ws=32768,Dt=1024,Ni=256,Ut=64,Ss=6e5,Rs=/^[A-Za-z0-9_-]+$/u,ks=/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u,Ts=/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u,Is=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/u,Ps=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu,Ki=new Set(["discouraged","preferred","required"]),Es=new Set(["singleDevice","multiDevice"]),Vi=new Set(["ble","cable","hybrid","internal","nfc","smart-card","usb"]),Hi=new Set(["hybrid","security-key","client-device"]),vs=new Set(["none","indirect","direct","enterprise"]),Cs=new Set(["fido-u2f","packed","android-safetynet","android-key","tpm","apple","none"]),xs=new Set(["platform","cross-platform"]),Ds=new Set(["discouraged","preferred","required"]),_s=new Set([-8,-7,-257]);function qi(e){let t=G(e,zi,Li);return {challenge:Zi(t.challenge),...N("timeout",Xi(t.timeout)),...N("rpId",eo(t.rpId)),...N("allowCredentials",Yi(t.allowCredentials)),...N("userVerification",Ee(t.userVerification,Ki)),...N("hints",Ge(t.hints,Hi)),...N("extensions",Qi(t.extensions))}}function Bi(e){let t=G(e,zi,Li);return {challenge:Zi(t.challenge),rp:Us(t.rp),user:Ns(t.user),pubKeyCredParams:zs(t.pubKeyCredParams),...N("timeout",Xi(t.timeout)),...N("excludeCredentials",Yi(t.excludeCredentials)),...N("authenticatorSelection",Ls(t.authenticatorSelection)),...N("attestation",Ee(t.attestation,vs)),...N("attestationFormats",Ge(t.attestationFormats,Cs)),...N("hints",Ge(t.hints,Hi)),...N("extensions",Qi(t.extensions))}}function ji(e){let t=m(e),n=Me(t.session),i=B(t.user);return n.userId!==i.id&&f(),{session:n,user:i}}function Nt(e){let t=m(e),n=t.counter;(!Number.isSafeInteger(n)||n<0)&&f();let i=zt(t.deviceType,Es),o=P(t.backedUp);return o&&i!=="multiDevice"&&f(),{id:fe(t.id,Ni),...Ks(t),publicKey:Ms(t.publicKey,ws),userId:fe(t.userId,Ni),credentialID:Ye(t.credentialID,Fi),counter:n,deviceType:i,backedUp:o,...Vs(t),createdAt:E(t.createdAt),...Hs(t)}}function Ji(e,t,n){let i=Nt(e);return (i.credentialID!==t||(n===void 0?i.name!==void 0&&i.name!==null:i.name!==n))&&f(),i}function $i(e){(!Array.isArray(e)||e.length>Mi)&&f();let t=e.map(Nt);return We(t.map(n=>n.id)),We(t.map(n=>n.credentialID)),t.length>1&&t.some(n=>n.userId!==t[0]?.userId)&&f(),t}function Gi(e,t,n){let i=m(e),o=Nt(i.passkey);return (o.id!==t||o.name!==n)&&f(),{passkey:o}}function Wi(e){return m(e).status!==true&&f(),{status:true}}function Us(e){let t=m(e);return {name:_t(t.name,Dt),...N("id",eo(t.id))}}function Ns(e){let t=m(e);return {id:Ye(t.id,128,1,64),name:_t(t.name,Dt),displayName:_t(t.displayName,Dt)}}function zs(e){(!Array.isArray(e)||e.length===0||e.length>Ut)&&f();let t=e.map(n=>{let i=m(n);return (i.type!=="public-key"||!Number.isSafeInteger(i.alg)||!_s.has(i.alg))&&f(),{type:"public-key",alg:i.alg}});return qs(t.map(n=>n.alg)),t}function Yi(e){if(e===void 0)return;(!Array.isArray(e)||e.length>Mi)&&f();let t=e.map(n=>{let i=m(n);return i.type!=="public-key"&&f(),{type:"public-key",id:Ye(i.id,Fi),...N("transports",Ge(i.transports,Vi))}});return We(t.map(n=>n.id)),t}function Ls(e){if(e===void 0)return;let t=m(e);t.requireResidentKey!==void 0&&typeof t.requireResidentKey!="boolean"&&f();let n=Ee(t.residentKey,Ds);return t.requireResidentKey!==void 0&&n!==void 0&&t.requireResidentKey!==(n==="required")&&f(),{...N("authenticatorAttachment",Ee(t.authenticatorAttachment,xs)),...N("residentKey",n),...N("requireResidentKey",t.requireResidentKey),...N("userVerification",Ee(t.userVerification,Ki))}}function Xi(e){return e!==void 0&&(typeof e!="number"||!Number.isFinite(e)||e<0||e>Ss)&&f(),e}function Qi(e){return e===void 0?void 0:G(e,bs,As)}function Ge(e,t){if(e===void 0)return;(!Array.isArray(e)||e.length>Ut)&&f();let n=e.map(i=>zt(i,t));return We(n),n}function Ee(e,t){if(e!==void 0)return zt(e,t)}function Zi(e){return Ye(e,Math.ceil(Ui*4/3),Os,Ui)}function Ye(e,t,n=1,i=Number.POSITIVE_INFINITY){let o=fe(e,t),r=o.length%4,c=Fs(o.at(-1)??""),u=Math.floor(o.length*3/4);return (!Rs.test(o)||r===1||r===2&&(c&15)!==0||r===3&&(c&3)!==0||u<n||u>i)&&f(),o}function fe(e,t){let n=R(e);return (n.length===0||n.length>t)&&f(),n}function _t(e,t){let n=fe(e,t);return Ts.test(n)&&f(),n}function eo(e){if(e===void 0)return;let t=fe(e,253);return t!=="localhost"&&(t.endsWith(".")||!t.includes(".")||t.split(".").some(n=>!Is.test(n)))&&f(),t}function Ms(e,t){let n=fe(e,t),i=n.endsWith("=="),o=!i&&n.endsWith("="),r=n.at(i?-3:o?-2:-1)??"",c=to(r);return (n.length%4!==0||!ks.test(n)||i&&(c&15)!==0||o&&(c&3)!==0)&&f(),n}function Fs(e){return to(e,true)}function to(e,t=false){return (t?"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/").indexOf(e)}function Ks(e){let t=x(e,"name");return t===void 0?{}:(t!==null&&!xt(t)&&f(),{name:t})}function Vs(e){let t=x(e,"transports");if(t==null||t==="")return t===void 0?{}:{transports:t};let n=t.split(",");return (n.length>Ut||n.some(i=>!Vi.has(i))||new Set(n).size!==n.length)&&f(),{transports:t}}function Hs(e){let t=x(e,"aaguid");return t==null?t===void 0?{}:{aaguid:null}:(Ps.test(t)||f(),{aaguid:t})}function zt(e,t){let n=R(e);return t.has(n)||f(),n}function N(e,t){return t===void 0?{}:{[e]:t}}function We(e){new Set(e).size!==e.length&&f();}function qs(e){new Set(e).size!==e.length&&f();}function Qs(e,t){if(!t)return e;let n=t.catch(()=>{});return n.then(()=>{n=null;}),{async request(i,o){return n&&await n,e.request(i,o)}}}var ao=new Map;function Zs(e,t,n){let i=ao.get(n);if(!i){let o=new URLSearchParams(window.location.hash.slice(1)).get("authowl_code");if(!o)return;i=Promise.resolve().then(()=>(Qe(),Xe)).then(r=>r.completeCrossSiteSignIn(e,t,o)),ao.set(n,i);}return i}function co(e){return !Oe()||e.idToken||e.disableRedirect?"legacy":"first-party"}function lo(e,t=()=>{},n=ea){let i=Ae(e),o=e.session.tokens,r=Oe()?Zs(i,e.session,e.decoded.projectId):void 0,c=Qs(i,r),u=Fn({http:c,probe:Ae({...e,fetch:e.session.probe}),tokens:o,channelName:`authowl:${e.decoded.projectId}`});e.session.integration?.connect({authenticatedFetch:e.fetch,sessionStore:u.store,subscribeLifecycle:d=>o.subscribeLifecycle(d)});let a=()=>{u.notifyMutation(),t();},h=async()=>{await e.session.integration?.sessionEstablished(),a();},s=n(c,h),{post:l,mutation:p}=ne(c,a),{mutation:y}=ne(c,h),b=e.decoded.env==="test",S=d=>e.session.prepareSession({remember:d?.rememberMe!==false});return {sessionStore:u.store,getSession:u.getSession,account:Bn(c,a),organization:li(c,a,()=>u.store.getSnapshot().data?.session.membership??null),privacy:qe(c),signIn:{email:async(d,g)=>(await S(d),y(l("/sign-in/email",d,g,vt),A=>!("twoFactorRedirect"in A))),username:async(d,g)=>(await S(d),y(l("/sign-in/username",d,g,vt),A=>!("twoFactorRedirect"in A))),social:async(d,g)=>{if(await S(),co(d)==="first-party"){let{beginCrossSiteSignIn:k}=await Promise.resolve().then(()=>(Qe(),Xe)),T=await k(e,{kind:"social",provider:d.provider,callbackURL:d.callbackURL,errorCallbackURL:d.errorCallbackURL,newUserCallbackURL:d.newUserCallbackURL,scopes:d.scopes,loginHint:d.loginHint,requestSignUp:d.requestSignUp});if(T)return window.location.assign(T),{data:{redirect:true,url:T},error:null}}let A=await y(l("/sign-in/social",d,g,k=>mi(k,b)),k=>"user"in k);return A.error!==null||A.data===null||"url"in A.data&&A.data.redirect&&!d.disableRedirect&&typeof window<"u"&&window.location.assign(A.data.url),A},sso:async(d,g)=>{if(co(d)==="first-party"){let{beginCrossSiteSignIn:k}=await Promise.resolve().then(()=>(Qe(),Xe)),T=await k(e,{kind:"sso",email:d.email,providerId:d.providerId,domain:d.domain,organizationSlug:d.organizationSlug,callbackURL:d.callbackURL,errorCallbackURL:d.errorCallbackURL,newUserCallbackURL:d.newUserCallbackURL});if(T)return window.location.assign(T),{data:{url:T,redirect:true},error:null}}let A=await l("/sign-in/sso",d,g,k=>hi(k,b));return A.error!==null||A.data===null||typeof window<"u"&&window.location.assign(A.data.url),A},magicLink:(d,g)=>l("/sign-in/magic-link",d,g,yi),emailOtp:async(d,g)=>(await S(),y(l("/sign-in/email-otp",d,g,fi))),passkey:async(d,g)=>(await S(),s.signIn(d,g))},signUp:{email:async(d,g)=>(await S(),y(l("/sign-up/email",d,g,gi),A=>A.sessionCreated))},emailOtp:{sendVerificationOtp:(d,g)=>l("/email-otp/send-verification-otp",d,g,bi),verifyEmail:async(d,g)=>(await S(),y(l("/email-otp/verify-email",d,g,Ri)))},phoneOtp:{prepare:d=>l("/phone-otp/challenge",{},d,Oi),start:(d,g)=>l("/phone-otp/start",{...d,idempotencyKey:d.idempotencyKey??we()},g,Ai),verify:async(d,g)=>(await S(),y(l("/phone-otp/verify",d,g,wi)))},requestPasswordReset:(d,g)=>l("/request-password-reset",d,g,Ct),resetPassword:(d,g)=>l("/reset-password",d,g,Ct),sendVerificationEmail:(d,g)=>l("/send-verification-email",d,g,Si),passkey:{addPasskey:(d,g)=>s.add(d,g),listUserPasskeys:()=>c.request("/passkey/list-user-passkeys",{decode:$i}),updatePasskey:async(d,g)=>{let A=Je(d.name);if(!A.valid||A.value===void 0)return $e();let k=A.value;return l("/passkey/update-passkey",{...d,name:k},g,T=>Gi(T,d.id,k))},deletePasskey:(d,g)=>l("/passkey/delete-passkey",d,g,Wi)},twoFactor:{enable:(d,g)=>l("/two-factor/enable",d,g,Ti),disable:(d,g)=>p(l("/two-factor/disable",d,g,Ii),A=>A.status),verifyTotp:(d,g)=>y(l("/two-factor/verify-totp",d,g,Be)),verifyBackupCode:(d,g)=>y(l("/two-factor/verify-backup-code",d,g,Be)),sendOtp:(d={},g)=>l("/two-factor/send-otp",d,g,Pi),verifyOtp:(d,g)=>y(l("/two-factor/verify-otp",d,g,Be)),generateBackupCodes:(d,g)=>l("/two-factor/generate-backup-codes",d,g,Ei)},signOut:d=>p(c.request("/sign-out",{method:"POST",body:{},fetchOptions:d,decode:ki}).then(g=>(o.endSession(),e.session.integration?.sessionEnded().then(()=>g)??g)),g=>g.success)}}function ea(){return {signIn:()=>uo(),add:()=>uo()}}function uo(){return Promise.resolve({data:null,error:{status:400,statusText:"BAD_REQUEST",code:"PASSKEY_BROWSER_REQUIRED",message:"This passkey ceremony requires a browser with WebAuthn."}})}function yo(e,t,n){let i=new Map;return {async signIn(o={},r){let c=await e.request("/passkey/generate-authenticate-options");if(!c.data)return go(c.error);let u;try{u=qi(c.data);}catch{return po()}let a;try{a=await n.authenticate({optionsJSON:u,useBrowserAutofill:o.autoFill});}catch(y){return mo(n,y,"AUTH_CANCELLED","Passkey authentication was cancelled.")}if(!ta(a))return fo();let{clientExtensionResults:h,...s}=a,l=i.get(a.id);if(l)return l;let p=(async()=>{let y=await e.request("/passkey/verify-authentication",{method:"POST",body:{response:s},fetchOptions:r,decode:ji});return y.data&&await t(),y})();i.set(a.id,p);try{return await p}finally{i.get(a.id)===p&&i.delete(a.id);}},async add(o={},r){let c=Je(o.name);if(!c.valid)return $e();let u=await e.request("/passkey/generate-register-options",{query:{name:c.value,authenticatorAttachment:o.authenticatorAttachment}});if(!u.data)return go(u.error);let a;try{a=Bi(u.data);}catch{return po()}let h;try{h=await n.register({optionsJSON:a});}catch(y){return mo(n,y,"REGISTRATION_CANCELLED","Passkey registration was cancelled.")}if(!na(h))return fo();let{clientExtensionResults:s,...l}=h,p=await e.request("/passkey/verify-registration",{method:"POST",body:{response:l,name:c.value},fetchOptions:r,decode:y=>Ji(y,h.id,c.value)});return p.data&&t(),p}}}function po(){return {data:null,error:{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned invalid WebAuthn options."}}}function fo(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_WEBAUTHN_RESPONSE",message:"The platform returned an invalid passkey response."}}}function bo(e){if(!e||typeof e!="object")return  false;let t=e;return typeof t.id=="string"&&t.id.length>0&&typeof t.rawId=="string"&&t.rawId.length>0&&t.type==="public-key"&&!!t.response&&typeof t.response=="object"}function ta(e){if(!bo(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.authenticatorData=="string"&&typeof t.signature=="string"&&(t.userHandle===void 0||typeof t.userHandle=="string")}function na(e){if(!bo(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.attestationObject=="string"}function go(e){return {data:null,error:e??{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned no WebAuthn options."}}}function mo(e,t,n,i){let o=oa(t,"page does not have focus"),r=e.errorCode?.(t),c=r!==void 0?r==="ERROR_CEREMONY_ABORTED":ho(t)==="AbortError",u=n!=="AUTH_CANCELLED",a=ia(r,ho(t),u);return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:o?"PASSKEY_PAGE_NOT_FOCUSED":c?n:r??"PASSKEY_BROWSER_ERROR",message:o?"Keep this page focused while completing the passkey prompt.":c?i:a}}}function ia(e,t,n){switch(e){case "ERROR_INVALID_DOMAIN":case "ERROR_INVALID_RP_ID":return "Passkeys are not set up for this site\u2019s domain.";case "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED":return "This device already has a passkey for this account.";case "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEY_ALGS":case "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT":case "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT":return "This device cannot create a passkey for this site.";}return t==="NotAllowedError"?n?"No passkey was created. The prompt was dismissed or timed out.":"No passkey was used. This device may not have one saved for this site yet, or the prompt was dismissed.":t==="SecurityError"?"Passkeys are not set up for this site\u2019s domain.":n?"Passkey registration did not complete.":"Passkey sign-in did not complete."}function ho(e){return e&&typeof e=="object"&&"name"in e&&typeof e.name=="string"?e.name:void 0}function oa(e,t){let n=t.toLowerCase(),i=new Set,o=e;for(;o&&typeof o=="object"&&!i.has(o);){if(i.add(o),"message"in o&&typeof o.message=="string"&&o.message.toLowerCase().includes(n))return  true;o="cause"in o?o.cause:void 0;}return  false}function j(e){let t=new Uint8Array(e),n="";for(let o of t)n+=String.fromCharCode(o);return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function oe(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=(4-t.length%4)%4,i=t.padEnd(t.length+n,"="),o=atob(i),r=new ArrayBuffer(o.length),c=new Uint8Array(r);for(let u=0;u<o.length;u++)c[u]=o.charCodeAt(u);return r}function re(){return ra.stubThis(globalThis?.PublicKeyCredential!==void 0&&typeof globalThis.PublicKeyCredential=="function")}var ra={stubThis:e=>e};function Ze(e){let{id:t}=e;return {...e,id:oe(t),transports:e.transports}}function et(e){return e==="localhost"||/^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(e)}var C=class extends Error{constructor({message:t,code:n,cause:i,name:o}){super(t,{cause:i}),Object.defineProperty(this,"code",{enumerable:true,configurable:true,writable:true,value:void 0}),this.name=o??i.name,this.code=n;}};function Ao({error:e,options:t}){let{publicKey:n}=t;if(!n)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(t.signal instanceof AbortSignal)return new C({message:"Registration ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else if(e.name==="ConstraintError"){if(n.authenticatorSelection?.requireResidentKey===true)return new C({message:"Discoverable credentials were required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",cause:e});if(t.mediation==="conditional"&&n.authenticatorSelection?.userVerification==="required")return new C({message:"User verification was required during automatic registration but it could not be performed",code:"ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",cause:e});if(n.authenticatorSelection?.userVerification==="required")return new C({message:"User verification was required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",cause:e})}else {if(e.name==="InvalidStateError")return new C({message:"The authenticator was previously registered",code:"ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",cause:e});if(e.name==="NotAllowedError")return new C({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="NotSupportedError")return n.pubKeyCredParams.filter(o=>o.type==="public-key").length===0?new C({message:'No entry in pubKeyCredParams was of type "public-key"',code:"ERROR_MALFORMED_PUBKEYCREDPARAMS",cause:e}):new C({message:"No available authenticator supported any of the specified pubKeyCredParams algorithms",code:"ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",cause:e});if(e.name==="SecurityError"){let i=globalThis.location.hostname;if(et(i)){if(n.rp.id!==i)return new C({message:`The RP ID "${n.rp.id}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new C({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="TypeError"){if(n.user.id.byteLength<1||n.user.id.byteLength>64)return new C({message:"User ID was not between 1 and 64 characters",code:"ERROR_INVALID_USER_ID_LENGTH",cause:e})}else if(e.name==="UnknownError")return new C({message:"The authenticator was unable to process the specified options, or could not create a new credential",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}var Ft=class{constructor(){Object.defineProperty(this,"controller",{enumerable:true,configurable:true,writable:true,value:void 0});}createNewAbortSignal(){if(this.controller){let n=new Error("Cancelling existing WebAuthn API call for new one");n.name="AbortError",this.controller.abort(n);}let t=new AbortController;return this.controller=t,t.signal}cancelCeremony(){if(this.controller){let t=new Error("Manually cancelling existing WebAuthn API call");t.name="AbortError",this.controller.abort(t),this.controller=void 0;}}},tt=new Ft;var sa=["cross-platform","platform"];function nt(e){if(e&&!(sa.indexOf(e)<0))return e}async function Oo(e){!e.optionsJSON&&e.challenge&&(console.warn("startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});let{optionsJSON:t,useAutoRegister:n=false}=e;if(!re())throw new Error("WebAuthn is not supported in this browser");let i={...t,challenge:oe(t.challenge),user:{...t.user,id:oe(t.user.id)},excludeCredentials:t.excludeCredentials?.map(Ze)},o={};n&&(o.mediation="conditional"),o.publicKey=i,o.signal=tt.createNewAbortSignal();let r;try{r=await navigator.credentials.create(o);}catch(b){throw Ao({error:b,options:o})}if(!r)throw new Error("Registration was not completed");let{id:c,rawId:u,response:a,type:h}=r,s;typeof a.getTransports=="function"&&(s=a.getTransports());let l;if(typeof a.getPublicKeyAlgorithm=="function")try{l=a.getPublicKeyAlgorithm();}catch(b){Kt("getPublicKeyAlgorithm()",b);}let p;if(typeof a.getPublicKey=="function")try{let b=a.getPublicKey();b!==null&&(p=j(b));}catch(b){Kt("getPublicKey()",b);}let y;if(typeof a.getAuthenticatorData=="function")try{y=j(a.getAuthenticatorData());}catch(b){Kt("getAuthenticatorData()",b);}return {id:c,rawId:j(u),response:{attestationObject:j(a.attestationObject),clientDataJSON:j(a.clientDataJSON),transports:s,publicKeyAlgorithm:l,publicKey:p,authenticatorData:y},type:h,clientExtensionResults:r.getClientExtensionResults(),authenticatorAttachment:nt(r.authenticatorAttachment)}}function Kt(e,t){console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${e}. You should report this error to them.
-`,t);}function wo(){if(!re())return Vt.stubThis(new Promise(t=>t(false)));let e=globalThis.PublicKeyCredential;return e?.isConditionalMediationAvailable===void 0?Vt.stubThis(new Promise(t=>t(false))):Vt.stubThis(e.isConditionalMediationAvailable())}var Vt={stubThis:e=>e};function So({error:e,options:t}){let{publicKey:n}=t;if(!n)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(t.signal instanceof AbortSignal)return new C({message:"Authentication ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else {if(e.name==="NotAllowedError")return new C({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="SecurityError"){let i=globalThis.location.hostname;if(et(i)){if(n.rpId!==i)return new C({message:`The RP ID "${n.rpId}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new C({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="UnknownError")return new C({message:"The authenticator was unable to process the specified options, or could not create a new assertion signature",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}async function Ro(e){!e.optionsJSON&&e.challenge&&(console.warn("startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});let{optionsJSON:t,useBrowserAutofill:n=false,verifyBrowserAutofillInput:i=true}=e;if(!re())throw new Error("WebAuthn is not supported in this browser");let o;t.allowCredentials?.length!==0&&(o=t.allowCredentials?.map(Ze));let r={...t,challenge:oe(t.challenge),allowCredentials:o},c={};if(n){if(!await wo())throw Error("Browser does not support WebAuthn autofill");if(document.querySelectorAll("input[autocomplete$='webauthn']").length<1&&i)throw Error('No <input> with "webauthn" as the only or last value in its `autocomplete` attribute was detected');c.mediation="conditional",r.allowCredentials=[];}c.publicKey=r,c.signal=tt.createNewAbortSignal();let u;try{u=await navigator.credentials.get(c);}catch(y){throw So({error:y,options:c})}if(!u)throw new Error("Authentication was not completed");let{id:a,rawId:h,response:s,type:l}=u,p;return s.userHandle&&(p=j(s.userHandle)),{id:a,rawId:j(h),response:{authenticatorData:j(s.authenticatorData),clientDataJSON:j(s.clientDataJSON),signature:j(s.signature),userHandle:p},type:l,clientExtensionResults:u.getClientExtensionResults(),authenticatorAttachment:nt(u.authenticatorAttachment)}}var ko={authenticate:e=>Ro(e),register:e=>Oo(e),errorCode:e=>e instanceof C?e.code:void 0};function Io(e){return `${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}/consent`}async function Ht(e){let t=await $(e,Io(e),{init:{method:"GET",credentials:"include"},maxResponseBytes:65536,decode:aa});return t.response.status===401?{required:false}:ee(t,"consent status")}async function qt(e,t){if(!Number.isSafeInteger(t)||t<1)throw new TypeError("Consent version must be a positive integer.");return ee(await $(e,Io(e),{init:{method:"POST",headers:{"content-type":"application/json"},credentials:"include",body:JSON.stringify({version:t})},maxResponseBytes:64*1024,decode:ca}),"consent accept")}function aa(e){let t=m(e),n=P(t.required),i=ua(t.needsConsent),o=Po(t.version),r=To(t.termsUrl),c=To(t.privacyUrl);return {required:n,...i===void 0?{}:{needsConsent:i},...o===void 0?{}:{version:o},...r===void 0?{}:{termsUrl:r},...c===void 0?{}:{privacyUrl:c}}}function ca(e){let t=m(e),n=Po(t.version);return {ok:P(t.ok),...n===void 0?{}:{version:n}}}function ua(e){if(e===void 0||typeof e=="boolean")return e;throw new TypeError("Invalid consent response.")}function Po(e){if(e===void 0||Number.isSafeInteger(e)&&e>=1)return e;throw new TypeError("Invalid consent response.")}function To(e){if(e===void 0||typeof e=="string"&&e.length<=4096)return e;throw new TypeError("Invalid consent response.")}var la=30;function da(e){return typeof e?.exp=="number"?e.exp:null}function pa(e){let t=e.split(".")[1];if(!t)return null;try{let n=t.replace(/-/g,"+").replace(/_/g,"/"),i=JSON.parse(atob(n));return typeof i=="object"&&i!==null?i:null}catch{return null}}function Bt(e){let t=new Map;async function n(r={}){let c=r.template===void 0?null:r.template.trim().toLowerCase();if(c==="")throw new TypeError("Template missing");let u=c??"",a=t.get(u);a||(a={activeKey:null,cachedByKey:new Map,inflight:null,sequence:0},t.set(u,a));let h=r.forceRefresh===true;if(!h){let b=a.activeKey?a.cachedByKey.get(a.activeKey):null;if(b&&b.exp-Date.now()/1e3>la)return b.token;if(a.inflight)return a.inflight}let s=++a.sequence,l=()=>t.get(u)===a&&a.sequence===s,p=(async()=>{let b=c?`${e.projectBaseURL}/token/${encodeURIComponent(c)}`:`${e.projectBaseURL}/token`,S=await $(e,b,{init:{method:"GET",credentials:"include"},maxResponseBytes:64*1024,decode:_=>fa(_,c!==null)});if(S.response.status===401)return l()&&i(),null;let d=ee(S,"token"),g=d.policyVersion,A=d.token,k=pa(A),T=da(k);if(l())if(T!==null){let _=typeof k?.sub=="string"?k.sub:null,K=typeof k?.org_id=="string"?k.org_id:null;if(!c||_){let w=JSON.stringify([e.projectBaseURL,_,K,c,g]);a.cachedByKey.clear(),a.cachedByKey.set(w,{token:A,exp:T}),a.activeKey=w;}else o(a);}else o(a);return A})();if(h)return p;let y=p.finally(()=>{a.inflight===y&&(a.inflight=null);});return a.inflight=y,y}function i(){t.clear();}function o(r){r.cachedByKey.clear(),r.activeKey=null;}return {getToken:n,clear:i}}function fa(e,t){let n=m(e),i=R(n.token);if(i.length===0||i.length>32*1024)throw new TypeError("Invalid token response.");if(!t)return {token:i,policyVersion:0};let o=m(n.template);if(!Number.isSafeInteger(o.policyVersion)||o.policyVersion<1)throw new TypeError("Invalid token response.");return {token:i,policyVersion:o.policyVersion}}function ga(e){let t=Bt(e),n=lo(e,t.clear,(u,a)=>yo(u,a,ko)),i=Ae(e,`${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}`),o=qe(i),r=u=>(...a)=>(t.clear(),u(...a)),c={getConsentStatus:()=>Ht(e),acceptConsent:u=>qt(e,u),getToken:t.getToken,privacy:o,waitlist:{join:(u,a)=>i.request("/waitlist",{method:"POST",body:u,fetchOptions:a,credentials:"omit"})},account:{...n.account,updateUnsafeMetadata:r(n.account.updateUnsafeMetadata),updateProfile:r(n.account.updateProfile),changeEmail:r(n.account.changeEmail),changePassword:r(n.account.changePassword),revokeSession:r(n.account.revokeSession),delete:r(n.account.delete)},signIn:{email:r(n.signIn.email),username:r(n.signIn.username),social:r(n.signIn.social),sso:n.signIn.sso,magicLink:n.signIn.magicLink,emailOtp:r(n.signIn.emailOtp),passkey:r(n.signIn.passkey)},signUp:{email:r(n.signUp.email)},emailOtp:{...n.emailOtp,verifyEmail:r(n.emailOtp.verifyEmail)},twoFactor:{enable:n.twoFactor.enable,disable:r(n.twoFactor.disable),verifyTotp:r(n.twoFactor.verifyTotp),verifyBackupCode:r(n.twoFactor.verifyBackupCode),sendOtp:n.twoFactor.sendOtp,verifyOtp:r(n.twoFactor.verifyOtp),generateBackupCodes:n.twoFactor.generateBackupCodes},phoneOtp:{prepare:n.phoneOtp.prepare,start:n.phoneOtp.start,verify:r(n.phoneOtp.verify)},signOut:r(n.signOut)};return {...n,...c}}async function ma(e){if(typeof window>"u")throw new Error("Akedly Shield challenges must be solved in a browser.");let t=await ha(),n=e.challengeRequired?await t.solvePow(e.challenge,e.difficulty):null,i=e.turnstile.required?await t.getTurnstileToken(ya(e.turnstile.siteKey)):void 0;return {connectionId:e.connectionId,...n?{challengeToken:e.challengeToken,nonce:n.nonce}:{},...i?{turnstileToken:i}:{}}}async function ha(){return import('@akedly/shield')}function ya(e){if(!e)throw new Error("Akedly Shield did not provide a Turnstile site key.");return e}async function ba(e){let t=`${e.apiUrl}/api/projects/${e.decoded.projectId}/public-config`;return ee(await $(e,t,{init:{method:"GET",credentials:"omit"},maxResponseBytes:256*1024,decode:n=>Aa(n,e)}),"public-config")}function Aa(e,t){let n=G(e),i=n.environmentId,o=n.environmentType,r=`${t.apiUrl}/api/projects/${t.decoded.projectId}/auth`;if(typeof n.applicationId!="string"||!jt(n.applicationId)||i!==t.decoded.projectId||o!=="development"&&o!=="production"||n.authBaseUrl!==r)throw z();let c=D(n.branding),u=D(n.legal);if(!se(n.enabledMethods,64)||!se(n.socialProviders,64)||!xo(c,["appName","logoUrl","primaryColor"])||c.showAppName!==void 0&&typeof c.showAppName!="boolean"||c.alignment!==void 0&&c.alignment!=="left"&&c.alignment!=="center"&&c.alignment!=="right"||c.theme!==void 0&&c.theme!=="light"&&c.theme!=="dark"&&c.theme!=="system"||!xo(u,["termsUrl","privacyUrl"])||!Number.isSafeInteger(u.version)||u.version<0||typeof u.required!="boolean")throw z();if(n.socialProviderClientIds!==void 0){let a=D(n.socialProviderClientIds);if(Object.keys(a).length>64||Object.values(a).some(h=>typeof h!="string"||h.length>2048))throw z()}if(!X(n,["requireEmailVerification","twoFactor","mfaRequired","accountDeletion","organizations","sso","badge"])||!Eo(n.turnstileSiteKey)||!Eo(n.authTurnstileSiteKey)||typeof n.locale!="string"||n.locale.length===0||n.locale.length>64||!Number.isSafeInteger(n.configVersion)||n.configVersion<0)throw z();if(n.jwtIssuer!==null){let a=D(n.jwtIssuer),h=new URL(a.issuer),s=`${h.origin}/api/projects/${t.decoded.projectId}/auth`;if(a.issuer!==s||a.jwksUrl!==`${s}/jwks`||a.aud!==t.decoded.projectId||h.protocol!=="https:"&&h.origin!==t.apiUrl)throw z()}if(n.signUp!==void 0){let a=D(n.signUp).mode;if(typeof a!="string"||!["open","restricted","allowlist","waitlist"].includes(a))throw z()}if(n.authentication!==void 0&&Oa(n.authentication),n.privacy!==void 0&&wa(n.privacy),n.emailVerification!==void 0){let a=D(n.emailVerification);if(!X(a,["required"])||a.method!=="link"&&a.method!=="code")throw z()}if(n.userModel!==void 0&&!X(D(n.userModel),["requireEmail","firstLastName","emailChange","accountDeletion"]))throw z();if(n.mfa!==void 0){let a=D(n.mfa);if(!X(a,["totp","required","backupCodes"])||a.emailOtpFallback!==void 0&&typeof a.emailOtpFallback!="boolean"||a.trustDevice!==void 0&&typeof a.trustDevice!="boolean"||(a.required===true||a.backupCodes===true)&&a.totp!==true)throw z()}if(n.captcha===void 0||n.captcha===null)n.captcha=typeof n.authTurnstileSiteKey=="string"&&n.authTurnstileSiteKey.length>0?{provider:"turnstile",siteKey:n.authTurnstileSiteKey}:null;else {let a=D(n.captcha);if(typeof a.provider!="string"||a.provider.length===0||a.provider.length>64||typeof a.siteKey!="string"||a.siteKey.length===0||a.siteKey.length>512)throw z();n.captcha={provider:a.provider,siteKey:a.siteKey};}return n}function jt(e){return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}function z(){return new TypeError("public-config returned an invalid response")}function D(e){if(!e||typeof e!="object"||Array.isArray(e))throw z();return e}function Eo(e){return e===null||typeof e=="string"&&e.length<=4096}function Oa(e){let t=D(e),n=D(t.email),i=D(t.password),o=i.minLength!==void 0||i.maxLength!==void 0;if(!X(n,["signUp"])||!se(n.signIn,3)||n.signIn.some(r=>r!=="password"&&r!=="magic_link"&&r!=="email_otp")||!X(D(t.phone),["signUp","signIn"])||!X(i,["signUp","add"])||o&&(!Number.isSafeInteger(i.minLength)||!Number.isSafeInteger(i.maxLength)||i.minLength<1||i.maxLength>4096||i.minLength>i.maxLength)||!X(D(t.passkey),["signIn","add"])||!Sa(D(t.passkey).relyingPartyId)||!X(D(t.username),["collectOnSignUp","signIn"]))throw z()}function wa(e){let t=D(e);if(!Array.isArray(t.notices)||!Array.isArray(t.consentPurposes)||t.notices.length>64||t.consentPurposes.length>64)throw z();for(let n of t.notices){let i=D(n);if(vo(i,"noticeId","noticeVersionId"),it(i.title,512),it(i.body,1e5),Co(i.digest),!se(i.activityCodes,128)||!se(i.purposeCodes,128)||typeof i.effectiveFrom!="string"||!Number.isFinite(Date.parse(i.effectiveFrom)))throw z()}for(let n of t.consentPurposes){let i=D(n);if(vo(i,"purposeId","purposeVersionId"),it(i.title,512),it(i.description,1e4),Co(i.digest),!se(i.activityCodes,128)||!se(i.dataCategories,128))throw z()}}function vo(e,t,n){if(typeof e[t]!="string"||!jt(e[t])||typeof e[n]!="string"||!jt(e[n])||typeof e.code!="string"||!/^[a-z][a-z0-9_]{0,63}$/.test(e.code)||!Number.isSafeInteger(e.version)||e.version<1)throw z()}function it(e,t){let n=D(e);if(typeof n.en!="string"||n.en.length===0||n.en.length>t||typeof n.ar!="string"||n.ar.length===0||n.ar.length>t)throw z()}function Co(e){let t=D(e);if(typeof t.en!="string"||!/^[a-f0-9]{64}$/.test(t.en)||typeof t.ar!="string"||!/^[a-f0-9]{64}$/.test(t.ar))throw z()}function Sa(e){return e==null||typeof e=="string"}function X(e,t){return t.every(n=>typeof e[n]=="boolean")}function xo(e,t){return t.every(n=>e[n]===void 0||typeof e[n]=="string"&&e[n].length<=4096)}function se(e,t){return Array.isArray(e)&&e.length<=t&&e.every(n=>typeof n=="string"&&n.length<=128)&&new Set(e).size===e.length}var ve=class extends Error{constructor(n,i){super(n);this.cause=i;this.name="AuthOwlError";}cause},Jt=class extends ve{constructor(n,i){super(`Rate limited. Retry after ${n}s.`,i);this.retryAfterSeconds=n;this.name="RateLimitedError";}retryAfterSeconds},$t=class extends ve{constructor(t="invalid publishable key",n){super(t,n),this.name="InvalidKeyError";}};var Do=["en","ar"];function Ra(e){return e==="ar"?"rtl":"ltr"}function ka(e){return typeof e=="string"&&Do.includes(e)}
-exports.AUTH_CHALLENGE_HEADER=zn;exports.AUTH_LOCALE_HEADER=Ln;exports.AuthOwlError=ve;exports.AuthOwlHttpError=Le;exports.INVITATION_CLAIM_MAX_AGE_MS=En;exports.INVITATION_QUERY_PARAM=pt;exports.InvalidKeyError=$t;exports.LOCALES=Do;exports.RateLimitedError=Jt;exports.SESSION_TOKEN_HEADER=ct;exports.SESSION_TRANSPORT_BEARER=lt;exports.SESSION_TRANSPORT_HEADER=ut;exports.TransportError=F;exports.acceptConsent=qt;exports.activeLocale=mt;exports.captureInvitationClaim=dr;exports.clearInvitationClaim=ye;exports.createAuthOwlClient=ga;exports.createIdempotencyKey=we;exports.createMembershipHas=Wr;exports.createTokenClient=Bt;exports.decodePublishableKey=rt;exports.directionFor=Ra;exports.getConsentStatus=Ht;exports.getPublicConfig=ba;exports.isLocale=ka;exports.membershipHas=Ke;exports.membershipHasPermission=Fe;exports.membershipHasRole=Jn;exports.membershipHasTeam=jn;exports.readInvitationClaim=he;exports.readLastUsedSignInMethod=fr;exports.recordLastUsedSignInMethod=gr;exports.rememberPendingSignInMethod=mr;exports.resolveAuthTarget=In;exports.resolveConfig=lr;exports.resolveProjectCapabilities=yr;exports.sessionChallengeIsEphemeral=Ko;exports.sessionCookieName=zo;exports.setActiveLocale=vr;exports.settlePendingSignInMethod=hr;exports.solvePhoneOtpChallenge=ma;exports.withSessionTransportIntegration=Xo;
+'use strict';var No=Object.defineProperty;var ot=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(i){throw n=[i],i}};var Qt=(e,t)=>{for(var n in t)No(e,n,{get:t[n],enumerable:true});};var Sn={};Qt(Sn,{abandonSession:()=>mn,bindingNonce:()=>On,boundedSessionFetch:()=>De,clearSessionProofKeyMemoryForTests:()=>rr,cookieCapability:()=>gn,createSessionProof:()=>wn,createStoredSessionProof:()=>lr,prepareSenderConstrainedSession:()=>ir,sessionProofKey:()=>_e});async function De(e,t,n,i){let o=new AbortController,r,c=new Promise((u,a)=>{r=setTimeout(()=>{o.abort(),a(new Error("AuthOwl session transport request timed out."));},i);});try{return await Promise.race([e(t,{...n,signal:o.signal}),c])}finally{clearTimeout(r);}}async function gn(e,t,n){let i=await De(e,t,{method:"POST",credentials:"include",headers:n},1e4);if(i.status===404||i.status===405)return "legacy";if(i.status!==204)throw new Error("AuthOwl cookie capability check failed.");let o=await De(e,t,{method:"GET",credentials:"include",headers:n},1e4);if(o.status===404||o.status===405)return "legacy";if(o.status!==200)throw new Error("AuthOwl cookie capability check failed.");let r=await o.text();if(new TextEncoder().encode(r).byteLength>128)throw new Error("AuthOwl cookie capability response is invalid.");let c;try{c=JSON.parse(r);}catch{throw new Error("AuthOwl cookie capability response is invalid.")}if(!c||typeof c!="object"||Array.isArray(c)||Object.keys(c).length!==1||typeof c.cookieSupported!="boolean")throw new Error("AuthOwl cookie capability response is invalid.");return c.cookieSupported}async function mn(e,t,n,i){let o=new Headers(n);o.set("authorization",i),o.set("x-authowl-session-transport","bearer");try{await De(e,t,{method:"POST",credentials:"include",headers:o},2e3);}catch{}}async function ir(e){let{tokens:t}=e;if(t.beginSession(e.start),!e.clientOrigin)return {binding:null,cookieOnly:false};let n=null;if(t.hasToken()){let r=t.bindingThumbprint();if(r)try{let c=await _e(e.clientOrigin);if(c.thumbprint!==r)throw new Error("Session proof key changed.");n=c;}catch{let c=new Headers;t.declareOn(c);let u=c.get("authorization");u&&await mn(e.fetcher,`${e.projectBaseURL}/session/abandon`,e.headers,u),t.endSession(),t.beginSession(e.start);}}let i;try{i=await gn(e.fetcher,`${e.projectBaseURL}/session/cookie-capability`,e.headers);}catch{return t.useCookieTransport(),{binding:null,cookieOnly:false}}if(i==="legacy")return {binding:null,cookieOnly:false};if(i)return t.hasToken()?{binding:null,cookieOnly:true}:(t.useCookieTransport(),{binding:null,cookieOnly:false});let o=n??await _e(e.clientOrigin);return t.useBoundBearerTransport(o.thumbprint,o.persistent),{binding:{key:o,nonce:On()},cookieOnly:false}}function ce(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function xe(e){return new TextEncoder().encode(e)}async function hn(e){return ce(new Uint8Array(await crypto.subtle.digest("SHA-256",xe(e))))}function yn(e){return e.kty==="EC"&&e.crv==="P-256"&&typeof e.x=="string"&&e.x.length>0&&typeof e.y=="string"&&e.y.length>0&&e.d===void 0}async function bn(e){return hn(JSON.stringify({crv:e.crv,kty:e.kty,x:e.x,y:e.y}))}function or(e){if(!e||typeof e!="object")return  false;let t=e,n=t.algorithm;return t.type==="private"&&t.extractable===false&&t.usages.length===1&&t.usages[0]==="sign"&&n.name==="ECDSA"&&n.namedCurve==="P-256"}function rr(){Ce.clear();}async function sr(e){if(!e||typeof e!="object")return null;let t=e;if(!or(t.privateKey)||!t.publicJwk||!yn(t.publicJwk))return null;let n=await bn(t.publicJwk);return t.thumbprint!==n?null:{privateKey:t.privateKey,publicJwk:t.publicJwk,thumbprint:n,persistent:true}}function An(){return typeof indexedDB>"u"?Promise.resolve(null):new Promise(e=>{let t;try{t=indexedDB.open(nr,1);}catch{e(null);return}t.onupgradeneeded=()=>{t.result.objectStoreNames.contains(ue)||t.result.createObjectStore(ue,{keyPath:"origin"});},t.onsuccess=()=>e(t.result),t.onerror=()=>e(null),t.onblocked=()=>e(null);})}async function fn(e){let t=await An();if(!t)return null;try{let n=await new Promise(i=>{let o=t.transaction(ue,"readonly").objectStore(ue).get(e);o.onsuccess=()=>i(o.result),o.onerror=()=>i(null);});return await sr(n)}finally{t.close();}}async function ar(e,t){let n=await An();if(!n)return "unavailable";try{return await new Promise(i=>{let o;try{o=n.transaction(ue,"readwrite"),o.objectStore(ue).add({origin:e,privateKey:t.privateKey,publicJwk:t.publicJwk,thumbprint:t.thumbprint});}catch{i("unavailable");return}o.oncomplete=()=>i("stored"),o.onerror=()=>{let r=o.error;i(r?.name==="ConstraintError"?"conflict":"unavailable");},o.onabort=()=>{let r=o.error;i(r?.name==="ConstraintError"?"conflict":"unavailable");};})}finally{n.close();}}async function cr(){let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},false,["sign","verify"]),t=await crypto.subtle.exportKey("jwk",e.publicKey);if(!yn(t))throw new Error("The browser produced an invalid proof key.");return {privateKey:e.privateKey,publicJwk:t,thumbprint:await bn(t),persistent:false}}function _e(e){let t=Ce.get(e);if(t)return t;let n=(async()=>{let i=await fn(e);if(i)return i;let o=await cr(),r=await ar(e,o);return r==="stored"?{...o,persistent:true}:r==="conflict"?await fn(e)??o:o})();return Ce.set(e,n),n.catch(()=>Ce.delete(e)),n}function On(){return ce(crypto.getRandomValues(new Uint8Array(32)))}function ur(e){let t=new URL(e);return t.search="",t.hash="",t.toString()}async function wn(e){let t=ce(xe(JSON.stringify({typ:er,alg:tr,jwk:e.key.publicJwk}))),n=ce(xe(JSON.stringify({htm:e.method.toUpperCase(),htu:ur(e.url),iat:Math.floor(Date.now()/1e3),jti:ce(crypto.getRandomValues(new Uint8Array(16))),ath:await hn(e.token)}))),i=`${t}.${n}`,o=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e.key.privateKey,xe(i));return `${i}.${ce(new Uint8Array(o))}`}async function lr(e){let t=await _e(e.origin);if(t.thumbprint!==e.expectedThumbprint)throw new Error("Session proof key changed.");return wn({key:t,method:e.method,url:e.url,token:e.token})}var er,tr,nr,ue,Ce,Rn=ot(()=>{"use strict";er="pop+jwt",tr="ES256",nr="authowl-session-proof",ue="origin-keys",Ce=new Map;});function Oe(){return typeof window<"u"&&typeof document<"u"&&typeof crypto<"u"&&typeof crypto.subtle?.digest=="function"}var Rt=ot(()=>{"use strict";});var Xe={};Qt(Xe,{beginCrossSiteSignIn:()=>ia,challengeFor:()=>ao,completeCrossSiteSignIn:()=>oa,takeHandoffCode:()=>Ft});function so(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function ao(e){let t=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e));return so(new Uint8Array(t))}function ea(){return so(crypto.getRandomValues(new Uint8Array(Xs)))}function co(e,t){let n=window.location.protocol==="https:"?"; Secure":"";document.cookie=`${ro}=${e}; Path=/; Max-Age=${t}; SameSite=Lax${n}`;}function ta(){for(let e of document.cookie.split(";")){let t=e.indexOf("=");if(!(t<0)&&e.slice(0,t).trim()===ro)return e.slice(t+1).trim()||null}return null}function na(){co("",0);}function oo(e){return new URL(e,window.location.href).toString()}async function ia(e,t){let n=t.callbackURL?oo(t.callbackURL):null;if(n&&new URL(n).origin!==window.location.origin)return null;let i=ea(),o=new URL(`${e.projectBaseURL}/session/start`);if(o.searchParams.set("pk",e.publishableKey),o.searchParams.set("kind",t.kind),t.kind==="social")o.searchParams.set("provider",t.provider),t.scopes?.length&&o.searchParams.set("scopes",t.scopes.join(",")),t.loginHint&&o.searchParams.set("loginHint",t.loginHint),t.requestSignUp!==void 0&&o.searchParams.set("requestSignUp",t.requestSignUp?"1":"0");else for(let c of Zs){let u=t[c];u&&o.searchParams.set(c,u);}let r=`${window.location.origin}${window.location.pathname}${window.location.search}`;o.searchParams.set("cb",n??r);for(let[c,u]of [["err",t.errorCallbackURL],["new",t.newUserCallbackURL]])u&&o.searchParams.set(c,oo(u));return o.searchParams.set("challenge",await ao(i)),co(i,Qs),o.toString()}function Ft(e){if(typeof window>"u")return null;let t=window.location.hash;if(!t.includes(Mt))return null;let n=new URLSearchParams(t.replace(/^#/,"")),i=n.get(Mt);if(!i||e!==void 0&&i!==e)return null;n.delete(Mt);let o=n.toString();return window.history.replaceState(window.history.state,"",`${window.location.pathname}${window.location.search}${o?`#${o}`:""}`),i}async function oa(e,t,n){if(!Oe())return  false;let i=n??Ft();if(!i)return  false;n&&Ft(n);let o=ta();if(na(),!o)return  false;await t.prepareSession({remember:true});let{error:r}=await e.request("/session/exchange",{method:"POST",body:{code:i,verifier:o}});return r===null}var ro,Mt,Xs,Qs,Zs,Qe=ot(()=>{"use strict";Rt();ro="authowl_handoff_verifier",Mt="authowl_code",Xs=32,Qs=900,Zs=["email","providerId","domain","organizationSlug"];});var zo=/^(pk_(live|test))_([0-9a-f-]{36})_([A-Za-z0-9]{20,})$/i,Lo=/^sk_/i;function rt(e){if(typeof e!="string"||e.length===0)throw new Error("publishableKey is required");if(Lo.test(e))throw new Error("A secret key was passed where a publishable key was expected. Never embed secret keys in client code.");let t=zo.exec(e);if(!t)throw new Error("publishableKey is malformed; expected pk_(live|test)_<uuid>_<base62>");return {prefix:t[1].toLowerCase(),env:t[2].toLowerCase(),projectId:t[3].toLowerCase()}}function Mo(e,t){let n=`p_${e.toLowerCase().replace(/-/g,"")}`;return `${t?.secure?"__Secure-":""}${n}.session_token`}var Zt=/^http:\/\/(?:(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*localhost|127\.0\.0\.1|\[::1\])(?::\d+)?(?:\/|$)/i;function st(e,t){throw new Error(`${e}: ${t}`)}function en(e,t){let n;try{n=new URL(String(e));}catch{throw new TypeError("Transport URL must be absolute.")}if(n.username||n.password||n.hash)throw new TypeError("Transport URL must not contain credentials or a fragment.");let i=n.toString();if(n.protocol!=="https:"&&!(n.protocol==="http:"&&t.allowHttpLoopback&&Zt.test(i)))throw new TypeError("Transport URL must use HTTPS except on approved loopback.");return n}function tn(e,t){(typeof e!="string"||!/^https?:\/\/[^/?#@\\\s]+\/?$/i.test(e))&&st("apiUrl","origin required");let n;try{n=new URL(e);}catch{st("apiUrl","origin required");}return n.protocol==="http:"&&(!t.allowHttpLoopback||!Zt.test(e))&&st("apiUrl","HTTPS required except exact loopback"),n.origin}function V(e,t){try{return e?.getItem(t)??null}catch{return null}}function N(e,t,n){try{n===null?e?.removeItem(t):e?.setItem(t,n);}catch{}}function C(){try{return globalThis.localStorage}catch{return}}function Z(){try{return globalThis.sessionStorage}catch{return}}var Fo="authowl.session-challenge",Ko=e=>`${Fo}.${e}`,Vo="set-auth-challenge",at="x-authowl-challenge";function Ho(e){let t=e.get(at);return me(t)?rn(t).some(([n,i])=>n.endsWith(".dont_remember")&&i.length>0):false}var on="INVALID_TWO_FACTOR_COOKIE",qo=2048,me=e=>e!==null&&e.length<=qo,nn=/^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]+$/;function rn(e){let t=[];for(let n of e.split(";")){let i=n.trimStart(),o=i.indexOf("=");o<=0||t.push([i.slice(0,o).trimEnd(),i.slice(o+1)]);}return t}function sn(e){let t=Ko(e),n=new Map;function i(){return n.size===0?null:[...n].map(([u,a])=>`${u}=${a}`).join("; ")}function o(){let u=i();N(Z(),t,me(u)?u:null);}function r(u){for(let[a,h]of rn(u))nn.test(a)&&(h===""?n.delete(a):nn.test(h)&&n.set(a,h));}let c=V(Z(),t);return me(c)&&r(c),{presentOn(u){let a=i();u.delete(at),me(a)&&u.set(at,a);},observe(u){let a=u.get(Vo);me(a)&&(r(a),o());},clear(){n.clear(),o();}}}var ct="set-auth-token",ut="x-authowl-session-transport",lt="bearer";var Bo="authowl.session-token",jo="authowl.session-binding",Jo="authowl.cookie-transport",cn="ok",un="bearer",$o=e=>`${Bo}.${e}`,Go=e=>`${jo}.${e}`,Wo=e=>`${Jo}.${e}`;function Yo(e){return e===cn?"cookies":e===un?"bearer":"unknown"}function Xo(e){return e==="cookies"?cn:e==="bearer"?un:null}function Qo(e){let t=$o(e),n=Go(e),i=Wo(e),o=sn(e),r=new Set;function c(O){for(let M of r)try{M(O);}catch{}}let u=null,a=null,h=null,s=false,l=null,p=Yo(V(C(),i)),y=()=>p==="unknown",b=0,S=null,d=false;function g(){let O=V(Z(),t);if(O!==null)return s=true,O;let M=V(C(),t);return M!==null?(s=false,M):null}function A(){return V(Z(),n)??V(C(),n)}u=g(),a=u===null?null:A(),u!==null&&y()&&(d=true);function k(){if(!(!d||!S)){d=false;try{S();}catch{}}}function T(){let O=p==="bearer"?u:null,M=O===null?null:a,[ge,Xt]=s?[Z(),C()]:[C(),Z()];N(Xt,t,null),N(Xt,n,null),N(ge,t,O),N(ge,n,M);}function U(O){O!==null&&l!==null&&(s=l,l=null),O!==null&&h!==null?(a=h,h=null):O===null&&(a=null),u=O,T(),O!==null&&y()&&(d=true,k());}function K(O){p=O,N(C(),i,Xo(O));}function w(){K("unknown"),d=false;}function I(){return u===null&&(u=g(),a=u===null?null:A()),u}function Q(){let O=g();return O!==null&&(u=O,a=A()),u}function ae(O){Q()===O&&T();}function Wt(){b+=1,l=null,h=null,s=false,U(null),o.clear(),w(),c({type:"endSession"});}let Yt=()=>p!=="cookies";return {subscribeLifecycle(O){return r.add(O),()=>r.delete(O)},hasToken:()=>I()!==null,bindingThumbprint:()=>(I(),a),declareOn(O){if(O.has("authorization"))return  false;let M=I();return !M&&!Yt()?false:(M&&O.set("authorization",`Bearer ${M}`),O.set(ut,lt),o.presentOn(O),true)},wantsToken:Yt,needsProbe:y,observe(O){let M=O.get(ct);M&&U(M),o.observe(O);},dropChallenge:o.clear,measureWith(O){S=O,k();},beginRead(){let O=I(),M=b;return {carriedToken:O!==null,endIfDead(){O!==null&&Q()===O&&b===M&&Wt();},recordCookieVerdict(ge){if(b===M&&y()){if(K(ge?"cookies":"bearer"),ge){U(null);return}ae(O);}}}},beginSession({remember:O}){b+=1,l=!O,o.clear(),w(),c({type:"beginSession",remember:O});},useCookieTransport(){I()===null&&(h=null,K("cookies"));},completeCookieTransport(){K("cookies"),U(null);},useBoundBearerTransport(O,M){if(!O)throw new Error("A session proof thumbprint is required.");h=O,M||(l=true),K("bearer");},endSession:Wt}}var an=new Map;function ln(e){let t=an.get(e);if(t)return t;let n=Qo(e);return an.set(e,n),n}var dn=Symbol.for("authowl.session-transport-integration.v1");function Zo(e,t){return Object.defineProperty(e,dn,{value:t,configurable:false,enumerable:false,writable:false}),e}function pn(e){return e?e[dn]??null:null}var dt="x-authowl-session-proof",kn="x-authowl-session-binding",Tn="x-authowl-session-binding-proof",Ue=()=>Promise.resolve().then(()=>(Rn(),Sn));function dr(e,t){return t?.headers?new Headers(t.headers):typeof e=="object"&&e!==null&&"headers"in e?new Headers(e.headers):new Headers}function In(e,t){let n=ln(e.projectId),i=(p,y)=>(t??globalThis.fetch)(p,y),o=typeof globalThis.location=="object"&&typeof globalThis.location.origin=="string"&&globalThis.location.origin!=="null"?globalThis.location.origin:null,r=null,c=false,u=()=>new Headers({"x-publishable-key":e.publishableKey});async function a(p){let y=p.get("authorization");y&&await Ue().then(b=>b.abandonSession(i,`${e.projectBaseURL}/session/abandon`,u(),y));}async function h(p){r=null,c=false;let y=await Ue().then(b=>b.prepareSenderConstrainedSession({tokens:n,start:p,clientOrigin:o,fetcher:i,projectBaseURL:e.projectBaseURL,headers:u()}));r=y.binding,c=y.cookieOnly;}return {fetch:async(p,y)=>{if(y?.credentials==="omit"||!n.wantsToken())return i(p,y);let b=dr(p,y),S=n.declareOn(b),d=b.get("authorization"),g=(y?.method??(typeof p=="object"&&p!==null&&"method"in p?p.method:"GET")).toUpperCase(),A=typeof p=="string"?p:p instanceof URL?p.toString():p.url;if(S&&o){let T=!!d;if(d){let U=d.replace(/^Bearer\s+/i,""),K=n.bindingThumbprint();if(K)try{b.set(dt,await Ue().then(w=>w.createStoredSessionProof({origin:o,expectedThumbprint:K,method:g,url:A,token:U})));}catch{await a(b),n.endSession(),b.delete("authorization"),b.delete(dt),b.delete(kn),b.delete(Tn),T=false;}}if(r){let U=r;b.set(kn,U.nonce),b.set(T?Tn:dt,await Ue().then(K=>K.createSessionProof({key:U.key,method:g,url:A,token:U.nonce})));}}let k=await i(p,{...y,headers:b});return S&&(k.status===401&&d&&(new URL(A).pathname.endsWith("/get-session")||new URL(A).pathname.endsWith("/sign-out"))?(await a(b),n.endSession(),r=null,c=false):(n.observe(k.headers),k.headers.has("set-auth-token")&&(c&&n.completeCookieTransport(),r=null,c=false))),k},probe:i,tokens:n,integration:pn(t),prepareSession:h}}function Pn(e){if(!e||typeof e!="object")throw new Error("AuthConfig is required");let t=rt(e.publishableKey),n=tn(e.apiUrl,{allowHttpLoopback:t.env==="test"});return {publishableKey:e.publishableKey,apiUrl:n,decoded:t,projectBaseURL:`${n}/api/projects/${t.projectId}/auth`}}function pr(e){let t=Pn(e),{fetch:n,...i}=In({projectId:t.decoded.projectId,projectBaseURL:t.projectBaseURL,publishableKey:t.publishableKey},e.fetch);return {...e,...t,fetch:n,session:i}}var pt="authowl_invitation",ft="authowl.invitation-claim",En=/^[A-Za-z0-9_-]{1,128}$/,vn=10080*60*1e3;function fr(e=Date.now()){if(typeof window>"u")return he(e);let t;try{t=new URL(window.location.href);}catch{return he(e)}let n=t.searchParams.get(pt);if(n===null)return he(e);t.searchParams.delete(pt);try{window.history.replaceState(window.history.state,"",t.toString());}catch{}if(!En.test(n))return he(e);let i={id:n,capturedAt:e};return N(C(),ft,JSON.stringify(i)),i}function he(e=Date.now()){let t=V(C(),ft);if(t===null)return null;let n;try{n=JSON.parse(t);}catch{return ye(),null}if(typeof n!="object"||n===null)return ye(),null;let{id:i,capturedAt:o}=n;return typeof i!="string"||!En.test(i)||typeof o!="number"||e-o>vn?(ye(),null):{id:i,capturedAt:o}}function ye(){N(C(),ft,null);}var Cn="authowl.last-used-method",gr=/^(password|username|magic-link|email-otp|phone-otp|passkey|sso|social:[a-z0-9][a-z0-9_-]{0,63})$/,gt=e=>`${Cn}.${e}`;function ze(e){return gr.test(e)}function mr(e){let t=V(C(),gt(e));return t===null||!ze(t)?null:t}function hr(e,t){ze(t)&&(N(C(),Ne(e),null),N(C(),gt(e),t));}var Ne=e=>`${Cn}.pending.${e}`;function yr(e,t){ze(t)&&N(C(),Ne(e),t);}function br(e,t){let n=V(C(),Ne(e));N(C(),Ne(e),null),t&&n!==null&&ze(n)&&N(C(),gt(e),n);}var Ar="authowl.passkey-offer",xn="done",Or=720*60*60*1e3,mt=(e,t)=>`${Ar}.${e}.${t}`;function wr(e,t,n=Date.now()){let i=V(C(),mt(e,t));if(i===null)return  true;if(i===xn)return  false;let o=Number(i);if(!Number.isFinite(o))return  true;let r=n-o;return r<0||r>=Or}function Sr(e,t,n=Date.now()){N(C(),mt(e,t),String(n));}function Rr(e,t){N(C(),mt(e,t),xn);}function kr(e){let t=e?.enabledMethods??["password"],n=t.includes("password"),i=t.includes("passkey"),o=e?.authentication,r=e?.mfa;return {emailSignUp:o?.email.signUp??t.some(c=>c==="password"||c==="magic_link"||c==="email_otp"),passwordSignUp:o?.password.signUp??n,phoneSignUp:o?.phone.signUp??t.includes("phone_otp"),passwordSignIn:o?.email.signIn.includes("password")??n,passwordMinLength:o?.password.minLength??8,passwordMaxLength:o?.password.maxLength??128,magicLinkSignIn:o?.email.signIn.includes("magic_link")??t.includes("magic_link"),emailOtpSignIn:o?.email.signIn.includes("email_otp")??t.includes("email_otp"),phoneSignIn:o?.phone.signIn??t.includes("phone_otp"),usernameSignIn:o?.username.signIn??false,collectUsername:o?.username.collectOnSignUp??false,passkeySignIn:o?.passkey.signIn??i,passkeyAdd:o?.passkey.add??i,firstLastName:e?.userModel?.firstLastName??false,emailChange:e===null?false:e.userModel?.emailChange??true,accountDeletion:e?.userModel?.accountDeletion??e?.accountDeletion??false,emailVerificationRequired:e?.emailVerification?.required??e?.requireEmailVerification??false,emailVerificationMethod:e?.emailVerification?.method??"link",totp:r?.totp??e?.twoFactor??false,mfaRequired:r?.required??e?.mfaRequired??false,backupCodes:r?.backupCodes??e?.twoFactor??false,legacyNameField:e?.authentication===void 0}}var Tr=1e4,Ir=1024*1024,F=class extends Error{kind;requestId;constructor(t,n){super(Ur(t)),this.name="TransportError",this.kind=t,this.requestId=n;}},Un=new WeakSet;function H(e,t){let n=new F(e,t);return Un.add(n),n}async function Nn({fetchImpl:e,url:t,init:n={},timeoutMs:i=Tr,maxResponseBytes:o=Ir,allowHttpLoopback:r=false,decode:c}){_n(i,"timeoutMs"),_n(o,"maxResponseBytes");let u=en(t,{allowHttpLoopback:r}),a=n.signal,h=new AbortController,s=null,l,p=new Promise(d=>{l=d;}),y=d=>{s===null&&(s=d,l({type:"abort",kind:d}),h.abort());},b=()=>y("aborted");a?.addEventListener("abort",b,{once:true});let S=setTimeout(()=>y("timeout"),i);a?.aborted&&b();try{if(s!==null)throw H(s);let d;try{d=await Promise.race([e(u.toString(),{...n,redirect:"error",signal:h.signal}).then(K=>({type:"response",response:K})),p]);}catch{throw H(s??"network")}if(d.type==="abort")throw H(d.kind);if(!Pr(d.response))throw H("invalid_response");let g=d.response,A=_r(g.headers),k=await Er(g,o,p,()=>s,A),T=xr(g,k,A),U;try{U=g.ok&&c?c(T,Object.freeze({status:g.status})):T;}catch{throw H("invalid_response",A)}return {response:g,data:U,...A===void 0?{}:{requestId:A}}}catch(d){throw d instanceof F&&Un.has(d)?d:H(s??"network")}finally{clearTimeout(S),a?.removeEventListener("abort",b);}}function Pr(e){if(!e||typeof e!="object")return  false;let t=e;return Number.isInteger(t.status)&&t.status>=0&&t.status<=599&&typeof t.statusText=="string"&&typeof t.ok=="boolean"&&typeof t.headers?.get=="function"&&(t.body===null||typeof t.body=="object"&&typeof t.body?.getReader=="function"&&typeof t.body.cancel=="function")}async function Er(e,t,n,i,o){let r=e.headers.get("content-length");if(r!==null){if(!/^\d+$/.test(r))throw Dn(e.body),H("invalid_response",o);if(Number(r)>t)throw Dn(e.body),H("response_too_large",o)}if(!e.body)return "";let c;try{c=e.body.getReader();}catch{throw H("network",o)}let u=[],a=0,h=null;try{for(;;){let p;try{p=await Promise.race([c.read(),n]);}catch{h=H(i()??"network",o);break}if(vr(p)){h=H(p.kind,o);break}let{done:y,value:b}=p;if(y)break;if(b.byteLength!==0){if(a+=b.byteLength,a>t){h=H("response_too_large",o);break}u.push(b);}}}finally{h&&Cr(c);try{c.releaseLock();}catch{}}if(h)throw h;let s=new Uint8Array(a),l=0;for(let p of u)s.set(p,l),l+=p.byteLength;try{return new TextDecoder("utf-8",{fatal:!0}).decode(s)}catch{throw H("invalid_response",o)}}function vr(e){return "type"in e&&e.type==="abort"}function Dn(e){if(e)try{e.cancel().catch(()=>{});}catch{}}function Cr(e){try{e.cancel().catch(()=>{});}catch{}}function xr(e,t,n){if(e.status===204||e.status===205)return null;let i=Dr(e.headers.get("content-type"));if(!e.ok&&(!i||t.length===0))return null;if(!i||t.length===0)throw H("invalid_response",n);try{return JSON.parse(t)}catch{if(!e.ok)return null;throw H("invalid_response",n)}}function Dr(e){if(e===null)return  false;let t=e.split(";",1)[0]?.trim().toLowerCase();return t==="application/json"||t?.endsWith("+json")===true}function _r(e){let t=e.get("x-request-id")?.trim();if(!(!t||t.length>256||!/^[A-Za-z0-9._:-]+$/.test(t)))return t}function _n(e,t){if(!Number.isInteger(e)||e<=0)throw new TypeError(`${t} must be a positive integer.`)}function Ur(e){switch(e){case "aborted":return "The request was cancelled.";case "timeout":return "The request timed out.";case "response_too_large":return "The response exceeded the allowed size.";case "invalid_response":return "The service returned an invalid response.";case "network":return "The network request could not be completed."}}var Le=class extends Error{status;requestId;constructor(t,n,i){super(`${t} request failed with status ${n.status}.`),this.name="AuthOwlHttpError",this.status=n.status,this.requestId=i;}};function $(e,t,n={}){let i=new Headers(n.init?.headers);return i.set("x-publishable-key",e.publishableKey),Nn({fetchImpl:e.fetch,url:t,init:{...n.init,headers:i},allowHttpLoopback:e.decoded.env==="test",...n.timeoutMs===void 0?{}:{timeoutMs:n.timeoutMs},...n.maxResponseBytes===void 0?{}:{maxResponseBytes:n.maxResponseBytes},...n.decode===void 0?{}:{decode:n.decode}})}function ee(e,t){if(!e.response.ok)throw new Le(t,e.response,e.requestId);return e.data}var te=new Map,Nr=/^[a-z]{2}$/;function zr(e,t){if(typeof window>"u")return ()=>{};if(t===null)return te.delete(e),()=>{};let n=t.trim().toLowerCase();if(!Nr.test(n))return ()=>{};let i=Symbol(e),o=te.get(e)??[];return o.push({token:i,locale:n}),te.set(e,o),()=>{let r=te.get(e);if(!r)return;let c=r.filter(u=>u.token!==i);c.length===0?te.delete(e):te.set(e,c);}}function ht(e){return typeof window>"u"?null:te.get(e)?.at(-1)?.locale??null}var Mn="x-authowl-turnstile-token",Fn="x-authowl-locale",Lr=1e4,Mr=32,Fr=2e4;function ne(e,t){return {post:(n,i,o,r)=>e.request(n,{method:"POST",body:i,fetchOptions:o,decode:r}),mutation:async(n,i)=>{let o=await n;return o.error===null&&(i===void 0||o.data!==null&&i(o.data))&&await t(),o}}}function Ae(e,t=e.projectBaseURL){return {async request(n,i={}){let o=Hr(t,n,i.query),r=i.method??(i.body===void 0?"GET":"POST"),c=new Headers(i.fetchOptions?.headers);i.fetchOptions?.authChallengeToken&&c.set(Mn,i.fetchOptions.authChallengeToken);let u=ht(e.decoded.projectId);u&&c.set(Fn,u),i.body!==void 0&&c.set("content-type","application/json");let a={method:r,headers:c,credentials:i.credentials??"include",...i.body===void 0?{}:{body:JSON.stringify(i.body)}},h=Object.freeze({method:r,path:n});await i.fetchOptions?.onRequest?.(h);let s=Vr(r,i.fetchOptions),l;try{l=await Kr(e,o,{...a,signal:i.fetchOptions?.signal},s);}catch(g){let A=Ln(g);return await i.fetchOptions?.onError?.(yt(h,A,jr(g))),{data:null,error:A}}let{response:p,requestId:y}=l,b=Gr(n,l.data),S=b;if(p.ok)try{S=At(b),i.decode&&(S=i.decode(S));}catch{let g=Ln(new F("invalid_response",y));return await i.fetchOptions?.onError?.(yt(h,g,"invalid_response")),{data:null,error:g}}let d=Object.freeze({...h,status:p.status,...y===void 0?{}:{requestId:y}});if(await i.fetchOptions?.onResponse?.(d),!p.ok){let g=qr(p,b,y);return g.code===on&&e.session.tokens.dropChallenge(),await i.fetchOptions?.onError?.(yt(h,g,"api")),{data:null,error:g}}return await i.fetchOptions?.onSuccess?.(d),{data:S,error:null}}}}async function Kr(e,t,n,i){let o=Date.now()+Lr;for(let r=0;r<i;r+=1){let c=o-Date.now();if(c<=0)throw new F("timeout");try{let u=await $(e,t,{init:n,timeoutMs:Math.max(1,Math.ceil(c))});if(u.response.status<500||r===i-1)return u}catch(u){if(r===i-1||!(u instanceof F)||u.kind!=="network")throw u}await Jr(50*2**r,n.signal,o);}throw new F("network")}function Vr(e,t){if(e!=="GET"||t?.authChallengeToken)return 1;let n=t?.retry;return typeof n!="number"||!Number.isFinite(n)?1:Math.min(Math.max(Math.trunc(n),0),3)+1}function Hr(e,t,n){let i=new URL(`${e}${t.startsWith("/")?t:`/${t}`}`);for(let[o,r]of Object.entries(n??{}))r!==void 0&&i.searchParams.set(o,String(r));return i.toString()}function qr(e,t,n){let i=be(t)?t:{},o=Br(i,e.headers);return {status:e.status,statusText:e.statusText,code:typeof i.code=="string"?i.code:void 0,...n===void 0?{}:{requestId:n},...typeof i.current_version=="number"?{currentVersion:i.current_version}:{},...o!==void 0?{retryAfterSeconds:o}:{},message:typeof i.message=="string"?i.message:typeof i.error=="string"?i.error:typeof i.detail=="string"?i.detail:e.statusText||"Request failed"}}function Br(e,t){let n=(typeof e.retryAfterSeconds=="number"&&Number.isFinite(e.retryAfterSeconds)?e.retryAfterSeconds:void 0)??zn(t.get("retry-after"))??zn(t.get("x-retry-after"));if(n!==void 0)return Math.min(Math.max(Math.trunc(n),1),86400)}function zn(e){if(!e)return;let t=e.trim();if(!/^\d+$/.test(t))return;let n=Number(t);return Number.isFinite(n)?n:void 0}function Ln(e){let t=e instanceof F?e.kind:"network";return {status:0,...{aborted:{statusText:"ABORTED",code:"REQUEST_ABORTED",message:"The request was cancelled."},timeout:{statusText:"TIMEOUT",code:"REQUEST_TIMEOUT",message:"The request timed out."},response_too_large:{statusText:"INVALID_RESPONSE",code:"RESPONSE_TOO_LARGE",message:"The service response was too large."},invalid_response:{statusText:"INVALID_RESPONSE",code:"INVALID_RESPONSE",message:"The service returned an invalid response."},network:{statusText:"FETCH_ERROR",code:"FETCH_ERROR",message:"Network request failed."}}[t],...e instanceof F&&e.requestId?{requestId:e.requestId}:{}}}function yt(e,t,n){return Object.freeze({...e,status:t.status??0,...t.requestId===void 0?{}:{requestId:t.requestId},failure:n})}function jr(e){return e instanceof F?e.kind:"network"}function Jr(e,t,n){return new Promise((i,o)=>{if(t?.aborted){o(new F("aborted"));return}let r=n-Date.now();if(r<=0){o(new F("timeout"));return}let c=Math.min(e,r),u=()=>{clearTimeout(a),o(new F("aborted"));},a=setTimeout(()=>{t?.removeEventListener("abort",u),Date.now()>=n?o(new F("timeout")):i();},c);t?.addEventListener("abort",u,{once:true}),t?.aborted&&u();})}function At(e,t="",n=0,i={nodes:0}){if(i.nodes+=1,n>Mr||i.nodes>Fr)throw new Error("response traversal limit exceeded");if(typeof e=="string"&&/^(?:createdAt|updatedAt|expiresAt)$/.test(t)){let o=new Date(e);return Number.isNaN(o.getTime())?e:o}return Array.isArray(e)?e.map(o=>At(o,"",n+1,i)):be(e)?Object.fromEntries(Object.entries(e).map(([o,r])=>[o,$r(o)?r:At(r,o,n+1,i)])):e}function $r(e){return e==="metadata"||e==="public_metadata"||e==="unsafe_metadata"||e==="private_metadata"||e==="publicMetadata"||e==="unsafeMetadata"||e==="privateMetadata"}function Gr(e,t){if(e==="/list-sessions"&&Array.isArray(t))return t.map(o=>be(o)?bt(o):o);if(!be(t))return t;let i=e==="/change-password"||e==="/passkey/verify-authentication"||e==="/phone-otp/verify"||e==="/sign-up/email"||e.startsWith("/sign-in/")||e.startsWith("/two-factor/verify-")?bt(t):t;return e==="/sign-up/email"&&!("sessionCreated"in i)&&(i={...i,sessionCreated:typeof t.token=="string"&&t.token.length>0}),(e==="/get-session"||e==="/passkey/verify-authentication")&&be(i.session)&&(i={...i,session:bt(i.session)}),i}function bt(e){if(!Object.hasOwn(e,"token"))return e;let t={...e};return delete t.token,t}function be(e){return !!e&&typeof e=="object"&&!Array.isArray(e)}var Wr=new Set(["__proto__","constructor","prototype"]);function m(e){(!e||typeof e!="object"||Array.isArray(e))&&f();let t=Object.getPrototypeOf(e);return t!==Object.prototype&&t!==null&&f(),e}function R(e){return typeof e!="string"&&f(),e}function P(e){return typeof e!="boolean"&&f(),e}function E(e){return (!(e instanceof Date)||Number.isNaN(e.getTime()))&&f(),e}function ie(e){return (!Array.isArray(e)||!e.every(t=>typeof t=="string"))&&f(),[...e]}function D(e,t){let n=e[t];return n==null||typeof n=="string"?n:f()}function Kn(e,t){let n=e[t];return n==null||typeof n=="boolean"?n:f()}function B(e){let t=m(e),n=t.email;return n!==null&&typeof n!="string"&&f(),{id:R(t.id),email:n,emailVerified:P(t.emailVerified),createdAt:E(t.createdAt),updatedAt:E(t.updatedAt),...q("phoneNumber",D(t,"phoneNumber")),...q("username",D(t,"username")),...q("displayUsername",D(t,"displayUsername")),...q("firstName",D(t,"firstName")),...q("lastName",D(t,"lastName")),...q("name",D(t,"name")),...q("image",D(t,"image")),...q("twoFactorEnabled",Kn(t,"twoFactorEnabled"))}}function Me(e){let t=m(e),n=t.membership;return {id:R(t.id),userId:R(t.userId),expiresAt:E(t.expiresAt),...q("activeOrganizationId",D(t,"activeOrganizationId")),...q("activeTeamId",D(t,"activeTeamId")),...q("membership",n==null?n:Yr(n)),...q("pendingMfaEnrollment",Kn(t,"pendingMfaEnrollment"))}}function f(){throw new TypeError("AuthOwl response does not match its runtime contract.")}function G(e,t=20,n=1e4){return (!e||typeof e!="object"||Array.isArray(e))&&f(),wt(e,t,n)}function wt(e,t=20,n=1e4){return Ot(e,0,{nodes:0},t,n)}function Yr(e){let t=m(e);return {role:R(t.role),...t.roles===void 0?{}:{roles:ie(t.roles)},permissions:ie(t.permissions),...t.teams===void 0?{}:{teams:ie(t.teams)}}}function Ot(e,t,n,i,o){if(n.nodes+=1,(t>i||n.nodes>o)&&f(),e===null||typeof e=="string"||typeof e=="boolean")return e;if(typeof e=="number")return Number.isFinite(e)||f(),e;if(Array.isArray(e))return e.map(u=>Ot(u,t+1,n,i,o));(!e||typeof e!="object")&&f();let r=Object.getPrototypeOf(e);r!==Object.prototype&&r!==null&&f();let c={};for(let[u,a]of Object.entries(e))Wr.has(u)&&f(),c[u]=Ot(a,t+1,n,i,o);return c}function q(e,t){return t===void 0?{}:{[e]:t}}function Vn({http:e,probe:t,tokens:n,channelName:i}){let o=new Set,r=null,c=null,u=null,a=null,h=null,s=null,l,p=w=>{S(w);};l={data:null,isPending:true,isRefetching:false,error:null,refetch:p};function y(w){l=w;for(let I of o)I();}async function b(w){return e.request("/get-session",{query:w?.query,decode:St})}function S(w){if(w?.query?.disableCookieCache===true)return g(w);if(a)return a;if(h)return h;let I=g(w).finally(()=>{h===I&&(h=null);});return h=I,I}function d(){if(a)return a;let w=g({query:{disableCookieCache:true}}).finally(()=>{a===w&&(a=null);});return a=w,w}async function g(w){u?.abort();let I=new AbortController;u=I,y({...l,isPending:l.data===null&&l.error===null,isRefetching:l.data!==null});let Q=n.beginRead(),ae=await e.request("/get-session",{query:w?.query,fetchOptions:{signal:I.signal},decode:St});if(u===I&&(u=null,y({data:ae.data,error:ae.error,isPending:false,isRefetching:false,refetch:p}),ae.error===null)){if(ae.data===null){Q.endIfDead();return}await A(Q);}}async function A(w){if(n.needsProbe()){if(!w.carriedToken){w.recordCookieVerdict(true);return}return s||k(w)}}function k(w){let I=t.request("/get-session",{query:{disableCookieCache:true},decode:St}).then(Q=>{s===I&&Q.error===null&&w.recordCookieVerdict(Q.data!==null);}).finally(()=>{s===I&&(s=null);});return s=I,I}function T(){r?.postMessage({type:"session-changed"});}function U(){if(typeof window>"u"||c)return;let w=()=>{S();},I=()=>{document.visibilityState==="visible"&&S();};window.addEventListener("focus",w),document.addEventListener("visibilitychange",I),typeof BroadcastChannel<"u"&&(r=new BroadcastChannel(i),r.addEventListener("message",w)),c=()=>{window.removeEventListener("focus",w),document.removeEventListener("visibilitychange",I),r?.close(),r=null,c=null;};}function K(w){return o.add(w),o.size===1&&(U(),S()),()=>{if(o.delete(w),o.size===0){let I=u;u=null,h=null,a=null,I?.abort(),c?.();}}}return n.measureWith(()=>{n.needsProbe()&&k(n.beginRead());}),{store:{subscribe:K,getSnapshot:()=>l,refresh:d},getSession:b,notifyMutation(){T(),s&&s.catch(()=>{}).then(()=>{!n.needsProbe()&&n.hasToken()&&T();}),o.size>0&&S({query:{disableCookieCache:true}});}}}function St(e){if(e===null)return null;let t=m(e);return (t.session===void 0||t.user===void 0)&&f(),{session:Me(t.session),user:B(t.user)}}Rt();function we(){let e=globalThis.crypto.getRandomValues(new Uint8Array(16));e[6]=e[6]&15|64,e[8]=e[8]&63|128;let t=Array.from(e,n=>n.toString(16).padStart(2,"0")).join("");return `${t.slice(0,8)}-${t.slice(8,12)}-${t.slice(12,16)}-${t.slice(16,20)}-${t.slice(20)}`}async function Hn(e,t){return e.request("/user/metadata",{fetchOptions:t,decode:Bn})}async function qn(e,t,n){return e.request("/user/metadata",{method:"PATCH",body:{expected_version:t.expectedVersion,unsafe_metadata:t.unsafeMetadata},fetchOptions:n,decode:Bn})}function Bn(e){let t=m(e),n=G(t.public_metadata),i=G(t.unsafe_metadata);if(!Number.isSafeInteger(t.metadata_version)||t.metadata_version<0)throw new TypeError("Invalid AuthOwl metadata response");return {publicMetadata:n,unsafeMetadata:i,metadataVersion:t.metadata_version}}function Jn(e,t){let{post:n,mutation:i}=ne(e,t);return {getMetadata:o=>Hn(e,o),updateUnsafeMetadata:(o,r)=>qn(e,o,r),updateProfile:(o,r)=>i(n("/update-user",o,r,Se)),changeEmail:(o,r)=>i(n("/change-email",o,r,Se)),changePassword:(o,r)=>i(n("/change-password",o,r,Xr)),listSessions:o=>e.request("/list-sessions",{fetchOptions:o,decode:Qr}),revokeSession:({sessionId:o},r)=>i(n("/revoke-session",{sessionId:o},r,Se)),revokeOtherSessions:o=>i(n("/revoke-other-sessions",{},o,Se)),listSocialAccounts:async o=>{let r=await e.request("/list-accounts",{fetchOptions:o,decode:Zr});if(!r.data)return {data:null,error:r.error};let c=r.data.length>1;return {...r,data:r.data.filter(u=>u.providerId!=="credential").map(u=>({...u,canUnlink:c}))}},linkSocial:(o,r)=>n("/link-social",o,r,es),unlinkSocial:(o,r)=>i(n("/unlink-account",o,r,Se)),delete:(o={},r)=>i(n("/delete-user",o,r,ts))}}function Se(e){let t=m(e);return {status:P(t.status)}}function Xr(e){let t=m(e);return {user:B(t.user)}}function Qr(e){return Array.isArray(e)||f(),e.map(t=>{let n=m(t);return {id:R(n.id),userId:R(n.userId),createdAt:E(n.createdAt),updatedAt:E(n.updatedAt),expiresAt:E(n.expiresAt),...jn("ipAddress",D(n,"ipAddress")),...jn("userAgent",D(n,"userAgent"))}})}function Zr(e){return Array.isArray(e)||f(),e.map(t=>{let n=m(t);return {id:R(n.id),userId:R(n.userId),providerId:R(n.providerId),accountId:R(n.accountId),scopes:ie(n.scopes),createdAt:E(n.createdAt),updatedAt:E(n.updatedAt)}})}function es(e){let t=m(e);return {url:R(t.url),redirect:P(t.redirect)}}function ts(e){let t=m(e);return {success:P(t.success),message:R(t.message)}}function jn(e,t){return t===void 0?{}:{[e]:t}}function Fe(e,t){return !e||!t?false:e.permissions.includes(t)}function $n(e,t){return !e||!t?false:e.teams?.includes(t)??false}function Gn(e,t){return e?e.roles===void 0?e.role===t:e.roles.includes(t):false}function Ke(e,t){if(!e)return  false;let{role:n,permission:i,teamId:o}=t;return !(n===void 0&&i===void 0&&o===void 0||n!==void 0&&!Gn(e,n)||i!==void 0&&!e.permissions.includes(i)||o!==void 0&&!$n(e,o))}function ns(e){return {has:t=>Ke(e,t),hasPermission:t=>Fe(e,t.permission)}}var is=new Set(["pending","accepted","rejected","canceled"]),kt=1e4;function Wn(e){let t=m(e);return t.recipientHint!==null&&t.recipientHint!=="new_user"&&f(),{recipientHint:t.recipientHint}}function le(e,t,n){let i=m(e),o={id:v(i.id),name:v(i.name),slug:v(i.slug),createdAt:E(i.createdAt),...Re("logo",D(i,"logo")),...Re("metadata",i.metadata===void 0?void 0:wt(i.metadata))};return J(o.id,t),J(o.slug,n),o}function Yn(e){return W(e,le)}function Tt(e,t,n){return e===null?null:(t===null&&f(),le(e,t,n))}function Xn(e,t,n){if(e===null)return null;let i=m(e),o=le(i,t,n);return {...o,members:W(i.members,r=>ui(r,o.id)),invitations:W(i.invitations,r=>Y(r,void 0,o.id))}}function It(e,t,n=false){let i=W(e,o=>ke(o));return n||Ie(i.map(o=>o.organizationId),t),i}function Qn(e,t){let n=W(e,i=>Pt(i));return Ie(n.map(i=>i.teamId),t),n}function Pt(e,t,n){let i=m(e),o={id:v(i.id),teamId:v(i.teamId),userId:v(i.userId),createdAt:E(i.createdAt)};return J(o.teamId,t),J(o.userId,n),o}function Zn(e,t,n){return e===null?null:(t===null&&f(),ke(e,t,n))}function ei(e,t){let n=m(e);return (!Number.isSafeInteger(n.total)||n.total<0)&&f(),{members:os(n.members,t),total:n.total}}function Y(e,t,n){let i=m(e),o=v(i.status);is.has(o)||f();let r={id:v(i.id),organizationId:v(i.organizationId),email:Te(i.email),role:v(i.role),status:o,inviterId:v(i.inviterId),expiresAt:E(i.expiresAt),createdAt:E(i.createdAt)};return J(r.id,t),J(r.organizationId,n),r}function ti(e,t){let n=W(e,i=>Y(i));return Ie(n.map(i=>i.organizationId),t),n}function ni(e){return W(e,t=>{let n=m(t);return {...Y(n),organizationName:Te(n.organizationName)}})}function ii(e,t){let n=m(e);return {...Y(n,t),organizationName:v(n.organizationName),organizationSlug:v(n.organizationSlug),inviterEmail:li(n.inviterEmail)}}function oi(e,t){let n=m(e),i=Y(n.invitation,t);return {invitation:i,member:de(n.member,void 0,i.organizationId)}}function ri(e,t){let n=m(e);return n.member!==null&&f(),{invitation:n.invitation===null?null:Y(n.invitation,t),member:null}}function si(e,t){return e===null?null:Y(e,t)}function ai(e,t,n){let i=m(e);return {member:de(i.member,n,t)}}function de(e,t,n){let i=m(e),o={id:v(i.id),organizationId:v(i.organizationId),userId:v(i.userId),role:v(i.role),createdAt:E(i.createdAt),...i.user===void 0?{}:{user:di(i.user)}};return J(o.id,t),J(o.organizationId,n),o}function ci(e,t){let n=W(e,i=>{let o=m(i);return {organizationId:v(o.organizationId),data:{role:v(o.role),...Re("permission",o.permission===void 0?void 0:rs(o.permission)),...Re("customPermissionKeys",o.customPermissionKeys===void 0?void 0:ie(o.customPermissionKeys))}}});return Ie(n.map(i=>i.organizationId),t),n.map(i=>i.data)}function ke(e,t,n){let i=m(e),o=i.updatedAt,r={id:v(i.id),name:Te(i.name),organizationId:v(i.organizationId),createdAt:E(i.createdAt),...o===void 0?{}:{updatedAt:E(o)}};return J(r.id,t),J(r.organizationId,n),r}function Et(e){let t=m(e);return {message:Te(t.message)}}function ui(e,t){let n=m(e);return {...de(n,void 0,t),user:di(n.user)}}function os(e,t){let n=W(e,i=>ui(i));return Ie(n.map(i=>i.organizationId),t),n}function rs(e){let t=m(e),n={};for(let[i,o]of Object.entries(t))(i==="__proto__"||i==="constructor"||i==="prototype"||i.length===0||i.length>kt||!Array.isArray(o))&&f(),n[i]=o.map(r=>v(r));return n}function v(e){let t=R(e);return (t.length===0||t.length>kt)&&f(),t}function Te(e){if(e==null)return "";let t=R(e);return t.length>kt&&f(),t}function li(e){return e===null?null:v(e)}function J(e,t){t!==void 0&&e!==t&&f();}function Ie(e,t){let n=t??e[0];n!==void 0&&e.some(i=>i!==n)&&f();}function di(e){let t=m(e);return {id:v(t.id),name:Te(t.name),email:li(t.email),...Re("image",D(t,"image"))}}function W(e,t){return Array.isArray(e)||f(),e.map(n=>t(n))}function Re(e,t){return t===void 0?{}:{[e]:t}}function pi(e,t,n=()=>null){let{post:i,mutation:o}=ne(e,t),r=new Set,c=()=>{for(let s of r)try{s();}catch{}},u=new Map,a=(s,l,p,y)=>{if(p)return e.request(s,{query:l,fetchOptions:p,decode:y});let b=`${s}\0${JSON.stringify(l??null)}`,S=u.get(b);if(S)return S;let d=e.request(s,{query:l,decode:y}).finally(()=>{u.delete(b);});return u.set(b,d),d},h=async s=>{let l=await o(s).finally(()=>u.clear());return l.error===null&&c(),l};return {subscribe(s){return r.add(s),()=>r.delete(s)},create:(s,l)=>h(i("/organization/create",s,l,le)),list:s=>a("/organization/list",void 0,s,Yn),get:(s={},l)=>a("/organization/get-full-organization",{organizationId:s.organizationId,organizationSlug:s.organizationSlug,membersLimit:s.membersLimit},l,p=>Xn(p,s.organizationId,s.organizationSlug)),setActive:(s,l)=>h(i("/organization/set-active",s,l,p=>Tt(p,s.organizationId,s.organizationSlug))),createTeam:(s,l)=>h(i("/organization/create-team",s,l,p=>ke(p,void 0,s.organizationId))),listTeams:(s={},l)=>a("/organization/list-teams",{organizationId:s.organizationId},l,p=>It(p,s.organizationId)),updateTeam:(s,l)=>h(i("/organization/update-team",s,l,p=>ke(p,s.teamId,s.data.organizationId))),removeTeam:(s,l)=>h(i("/organization/remove-team",s,l,Et)),listUserTeams:s=>a("/organization/list-user-teams",void 0,s,l=>It(l,void 0,true)),listTeamMembers:(s={},l)=>a("/organization/list-team-members",{teamId:s.teamId},l,p=>Qn(p,s.teamId)),addTeamMember:(s,l)=>h(i("/organization/add-team-member",s,l,p=>Pt(p,s.teamId,s.userId))),removeTeamMember:(s,l)=>h(i("/organization/remove-team-member",s,l,Et)),setActiveTeam:(s,l)=>h(i("/organization/set-active-team",s,l,p=>Zn(p,s.teamId))),update:(s,l)=>h(i("/organization/update",s,l,p=>Tt(p,s.organizationId))),delete:(s,l)=>h(i("/organization/delete",s,l,p=>le(p,s.organizationId))),listMembers:(s={},l)=>a("/organization/list-members",{organizationId:s.organizationId,organizationSlug:s.organizationSlug,limit:s.limit,offset:s.offset,sortBy:s.sortBy,sortDirection:s.sortDirection,filterField:s.filterField,filterValue:s.filterValue,filterOperator:s.filterOperator},l,p=>ei(p,s.organizationId)),inviteMember:(s,l)=>h(i("/organization/invite-member",s,l,p=>Y(p,void 0,s.organizationId))),listInvitations:(s={},l)=>a("/organization/list-invitations",{organizationId:s.organizationId},l,p=>ti(p,s.organizationId)),listUserInvitations:s=>a("/organization/list-user-invitations",void 0,s,ni),getInvitation:(s,l)=>a("/organization/get-invitation",{id:s.id},l,p=>ii(p,s.id)),getInvitationRecipientHint:(s,l)=>a("/organization/invitation-recipient-hint",{invitationId:s.invitationId},l,Wn),acceptInvitation:(s,l)=>h(i("/organization/accept-invitation",s,l,p=>oi(p,s.invitationId))),rejectInvitation:(s,l)=>h(i("/organization/reject-invitation",s,l,p=>ri(p,s.invitationId))),cancelInvitation:(s,l)=>h(i("/organization/cancel-invitation",s,l,p=>si(p,s.invitationId))),removeMember:(s,l)=>h(i("/organization/remove-member",s,l,p=>ai(p,s.organizationId,s.memberIdOrEmail.includes("@")?void 0:s.memberIdOrEmail))),updateMemberRole:(s,l)=>h(i("/organization/update-member-role",s,l,p=>de(p,s.memberId,s.organizationId))),leave:(s,l)=>h(i("/organization/leave",s,l,p=>de(p,void 0,s.organizationId))),listRoles:(s={},l)=>a("/organization/list-roles",{organizationId:s.organizationId},l,p=>ci(p,s.organizationId)),has:s=>Ke(n(),s),hasPermission:s=>Fe(n(),s.permission)}}function qe(e){return {listConsentPreferences:t=>e.request("/privacy/consent-decisions",{fetchOptions:t,decode:ss}),recordConsent:(t,n)=>e.request("/privacy/consent-decisions",{method:"POST",body:{...t,correlationId:t.correlationId??we()},fetchOptions:n,decode:cs}),listRightsRequests:t=>e.request("/privacy/rights",{fetchOptions:t,decode:us}),createRightsRequest:(t,n)=>e.request("/privacy/rights",{method:"POST",body:t,fetchOptions:n,decode:ls})}}function ss(e){let t=m(e);return Array.isArray(t.preferences)||f(),{preferences:t.preferences.map(as)}}function as(e){let t=m(e);return {purposeId:R(t.purposeId),purposeVersionId:R(t.purposeVersionId),code:R(t.code),state:ds(t.state,["granted","refused","withdrawn"]),updatedAt:Ve(t.updatedAt),decidedAt:Ve(t.decidedAt)}}function cs(e){let t=m(e);return t.recorded!==true&&f(),{recorded:true,decision:Pe(t.decision,["granted","refused","withdrawn"]),decidedAt:He(t.decidedAt)}}function us(e){let t=m(e);return Array.isArray(t.requests)||f(),{requests:t.requests.map(fi)}}function ls(e){return {request:fi(m(e).request)}}function fi(e){let t=m(e);return {id:R(t.id),rightType:Pe(t.rightType,["access","correction","portability","erasure","restriction","objection","consent_withdrawal"]),state:Pe(t.state,["received","identity_pending","in_progress","restricted","completed","denied","withdrawn"]),locale:Pe(t.locale,["en","ar"]),receivedAt:He(t.receivedAt),acknowledgedAt:Ve(t.acknowledgedAt),fulfilmentDeadline:He(t.fulfilmentDeadline),completedAt:Ve(t.completedAt)}}function Ve(e){return e===null?null:He(e)}function He(e){if(e instanceof Date)return E(e);typeof e!="string"&&f();let t=new Date(e);return Number.isNaN(t.getTime())&&f(),t}function Pe(e,t){return (typeof e!="string"||!t.includes(e))&&f(),e}function ds(e,t){return e===null?null:Pe(e,t)}var gi=4096,ps=4096,fs=100,gs=256,ms=16,hs=64,ys=12;function Ct(e){let t=m(e);return t.twoFactorRedirect===true?((t.user!==void 0||t.redirect!==void 0||t.url!==void 0)&&f(),{twoFactorRedirect:true,...t.twoFactorMethods===void 0?{}:{twoFactorMethods:Di(t.twoFactorMethods,ms,hs)}}):(t.twoFactorRedirect!==void 0&&f(),{redirect:P(t.redirect),...Ss(t,"url"),user:B(t.user)})}function mi(e){let t=m(e);return {user:B(t.user)}}function hi(e){let t=m(e);return {sessionCreated:P(t.sessionCreated),user:B(t.user)}}function yi(e,t){let n=m(e),i=P(n.redirect);n.user===null&&f();let o=n.user!==void 0&&n.user!==null,r=n.url!==void 0&&n.url!==null;return i?((o||!r)&&f(),{redirect:true,url:vt(n.url,t)}):(o===r&&f(),o?{redirect:false,user:B(n.user)}:{redirect:false,url:vt(n.url,t)})}function bi(e,t){let n=m(e);return (n.redirect!==true||n.user!==void 0)&&f(),{redirect:true,url:vt(n.url,t)}}function Ai(e){return {status:P(m(e).status)}}function Oi(e){return {success:P(m(e).success)}}function wi(e){return m(e).status!=="pending"&&f(),{status:"pending"}}function Si(e){let t=m(e);if(t.kind==="authowl_turnstile")return {kind:"authowl_turnstile"};t.kind!=="akedly_shield_v1_2"&&f();let n=m(t.turnstile),i=n.siteKey===null?null:R(n.siteKey);return {kind:"akedly_shield_v1_2",connectionId:R(t.connectionId),challenge:R(t.challenge),difficulty:bs(t.difficulty),challengeToken:R(t.challengeToken),challengeRequired:P(t.challengeRequired),turnstile:{required:P(n.required),siteKey:i}}}function bs(e){return (!Number.isSafeInteger(e)||Number(e)<0||Number(e)>ys)&&f(),Number(e)}function Ri(e){let t=m(e);return (t.status!==true||t.sessionCreated!==true)&&f(),{status:true,sessionCreated:true,user:As(t.user)}}function xt(e){return {status:P(m(e).status)}}function ki(e){return {status:P(m(e).status)}}function Ti(e){let t=m(e);return {status:P(t.status),user:B(t.user)}}function Ii(e){return {success:P(m(e).success)}}function Pi(e){let t=m(e);return {totpURI:ws(t.totpURI),backupCodes:xi(t.backupCodes)}}function Ei(e){return {status:P(m(e).status)}}function Be(e){return m(e).status!==true&&f(),{status:true}}function vi(e){return {status:P(m(e).status)}}function Ci(e){let t=m(e);return t.status!==void 0&&t.status!==true&&f(),{backupCodes:xi(t.backupCodes)}}function As(e){let t=m(e);return {id:pe(t.id,512),...Rs(t,"name",1024),phoneNumber:pe(t.phoneNumber,64),phoneNumberVerified:P(t.phoneNumberVerified),...t.createdAt===void 0?{}:{createdAt:E(t.createdAt)},...t.updatedAt===void 0?{}:{updatedAt:E(t.updatedAt)}}}function vt(e,t){let n=pe(e,gi);/[\u0000-\u0020\u007f]/u.test(n)&&f();let i;try{i=new URL(n);}catch{return f()}return (i.username||i.password)&&f(),i.protocol==="https:"||t&&i.protocol==="http:"&&Os(i.hostname)?i.href:f()}function Os(e){let t=e.toLowerCase();return t==="localhost"||t==="127.0.0.1"||t==="[::1]"}function ws(e){let t=pe(e,ps),n;try{n=new URL(t);}catch{return f()}let i=n.searchParams.get("secret");return (n.protocol!=="otpauth:"||n.hostname.toLowerCase()!=="totp"||n.username||n.password||n.hash||i===null||i.length===0||i.length>512||/\s/u.test(i))&&f(),t}function xi(e){return Di(e,fs,gs)}function Di(e,t,n){(!Array.isArray(e)||e.length===0||e.length>t)&&f();let i=e.map(o=>pe(o,n));return i.some(o=>o.trim().length===0)&&f(),new Set(i).size!==i.length&&f(),i}function pe(e,t){let n=R(e);return (n.length===0||n.length>t)&&f(),n}function Ss(e,t){let n=e[t];return n==null?{}:{[t]:pe(n,gi)}}function Rs(e,t,n){let i=D(e,t);return i===void 0?{}:(i!==null&&i.length>n&&f(),{[t]:i})}var _i=new Set([1564,8206,8207,8234,8235,8236,8237,8238,8294,8295,8296,8297]),je=new Set([9,10,11,12,13,32,133,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288,65279]);function Je(e){if(e===void 0)return {valid:true,value:void 0};for(let n of e){let i=n.codePointAt(0);if(i===void 0||Ni(n,i)||Ui(i)||_i.has(i))return {valid:false}}let t=ks(e);return Dt(t)?{valid:true,value:t}:{valid:false}}function Dt(e){let t=0,n,i;for(let o of e){if(t+=1,t>256)return  false;let r=o.codePointAt(0);if(r===void 0||Ni(o,r)||Ui(r)||_i.has(r))return  false;n??=r,i=r;}return t>0&&n!==void 0&&i!==void 0&&!je.has(n)&&!je.has(i)}function $e(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_PASSKEY_NAME",message:"Passkey names must contain 1 to 256 safe Unicode characters."}}}function ks(e){let t=0,n=e.length;for(;t<n;){let i=e.codePointAt(t);if(i===void 0||!je.has(i))break;t+=i>65535?2:1;}for(;n>t;){let i=e.codePointAt(n-1);if(i===void 0)break;let r=i>=56320&&i<=57343?n-2:n-1,c=e.codePointAt(r);if(c===void 0||!je.has(c))break;n=r;}return e.slice(t,n)}function Ui(e){return e>=0&&e<=31||e>=127&&e<=159}function Ni(e,t){return e.length===1&&t>=55296&&t<=57343}var Mi=12,Fi=5e3,Ts=8,Is=1e3,Ps=16,zi=512,Ki=100,Vi=8192,Es=32768,_t=1024,Li=256,Nt=64,vs=6e5,Cs=/^[A-Za-z0-9_-]+$/u,xs=/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u,Ds=/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u,_s=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/u,Us=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu,Hi=new Set(["discouraged","preferred","required"]),Ns=new Set(["singleDevice","multiDevice"]),qi=new Set(["ble","cable","hybrid","internal","nfc","smart-card","usb"]),Bi=new Set(["hybrid","security-key","client-device"]),zs=new Set(["none","indirect","direct","enterprise"]),Ls=new Set(["fido-u2f","packed","android-safetynet","android-key","tpm","apple","none"]),Ms=new Set(["platform","cross-platform"]),Fs=new Set(["discouraged","preferred","required"]),Ks=new Set([-8,-7,-257]);function ji(e){let t=G(e,Mi,Fi);return {challenge:to(t.challenge),...z("timeout",Zi(t.timeout)),...z("rpId",no(t.rpId)),...z("allowCredentials",Qi(t.allowCredentials)),...z("userVerification",Ee(t.userVerification,Hi)),...z("hints",Ge(t.hints,Bi)),...z("extensions",eo(t.extensions))}}function Ji(e){let t=G(e,Mi,Fi);return {challenge:to(t.challenge),rp:Vs(t.rp),user:Hs(t.user),pubKeyCredParams:qs(t.pubKeyCredParams),...z("timeout",Zi(t.timeout)),...z("excludeCredentials",Qi(t.excludeCredentials)),...z("authenticatorSelection",Bs(t.authenticatorSelection)),...z("attestation",Ee(t.attestation,zs)),...z("attestationFormats",Ge(t.attestationFormats,Ls)),...z("hints",Ge(t.hints,Bi)),...z("extensions",eo(t.extensions))}}function $i(e){let t=m(e),n=Me(t.session),i=B(t.user);return n.userId!==i.id&&f(),{session:n,user:i}}function zt(e){let t=m(e),n=t.counter;(!Number.isSafeInteger(n)||n<0)&&f();let i=Lt(t.deviceType,Ns),o=P(t.backedUp);return o&&i!=="multiDevice"&&f(),{id:fe(t.id,Li),...$s(t),publicKey:js(t.publicKey,Es),userId:fe(t.userId,Li),credentialID:Ye(t.credentialID,Vi),counter:n,deviceType:i,backedUp:o,...Gs(t),createdAt:E(t.createdAt),...Ws(t)}}function Gi(e,t,n){let i=zt(e);return (i.credentialID!==t||(n===void 0?i.name!==void 0&&i.name!==null:i.name!==n))&&f(),i}function Wi(e){(!Array.isArray(e)||e.length>Ki)&&f();let t=e.map(zt);return We(t.map(n=>n.id)),We(t.map(n=>n.credentialID)),t.length>1&&t.some(n=>n.userId!==t[0]?.userId)&&f(),t}function Yi(e,t,n){let i=m(e),o=zt(i.passkey);return (o.id!==t||o.name!==n)&&f(),{passkey:o}}function Xi(e){return m(e).status!==true&&f(),{status:true}}function Vs(e){let t=m(e);return {name:Ut(t.name,_t),...z("id",no(t.id))}}function Hs(e){let t=m(e);return {id:Ye(t.id,128,1,64),name:Ut(t.name,_t),displayName:Ut(t.displayName,_t)}}function qs(e){(!Array.isArray(e)||e.length===0||e.length>Nt)&&f();let t=e.map(n=>{let i=m(n);return (i.type!=="public-key"||!Number.isSafeInteger(i.alg)||!Ks.has(i.alg))&&f(),{type:"public-key",alg:i.alg}});return Ys(t.map(n=>n.alg)),t}function Qi(e){if(e===void 0)return;(!Array.isArray(e)||e.length>Ki)&&f();let t=e.map(n=>{let i=m(n);return i.type!=="public-key"&&f(),{type:"public-key",id:Ye(i.id,Vi),...z("transports",Ge(i.transports,qi))}});return We(t.map(n=>n.id)),t}function Bs(e){if(e===void 0)return;let t=m(e);t.requireResidentKey!==void 0&&typeof t.requireResidentKey!="boolean"&&f();let n=Ee(t.residentKey,Fs);return t.requireResidentKey!==void 0&&n!==void 0&&t.requireResidentKey!==(n==="required")&&f(),{...z("authenticatorAttachment",Ee(t.authenticatorAttachment,Ms)),...z("residentKey",n),...z("requireResidentKey",t.requireResidentKey),...z("userVerification",Ee(t.userVerification,Hi))}}function Zi(e){return e!==void 0&&(typeof e!="number"||!Number.isFinite(e)||e<0||e>vs)&&f(),e}function eo(e){return e===void 0?void 0:G(e,Ts,Is)}function Ge(e,t){if(e===void 0)return;(!Array.isArray(e)||e.length>Nt)&&f();let n=e.map(i=>Lt(i,t));return We(n),n}function Ee(e,t){if(e!==void 0)return Lt(e,t)}function to(e){return Ye(e,Math.ceil(zi*4/3),Ps,zi)}function Ye(e,t,n=1,i=Number.POSITIVE_INFINITY){let o=fe(e,t),r=o.length%4,c=Js(o.at(-1)??""),u=Math.floor(o.length*3/4);return (!Cs.test(o)||r===1||r===2&&(c&15)!==0||r===3&&(c&3)!==0||u<n||u>i)&&f(),o}function fe(e,t){let n=R(e);return (n.length===0||n.length>t)&&f(),n}function Ut(e,t){let n=fe(e,t);return Ds.test(n)&&f(),n}function no(e){if(e===void 0)return;let t=fe(e,253);return t!=="localhost"&&(t.endsWith(".")||!t.includes(".")||t.split(".").some(n=>!_s.test(n)))&&f(),t}function js(e,t){let n=fe(e,t),i=n.endsWith("=="),o=!i&&n.endsWith("="),r=n.at(i?-3:o?-2:-1)??"",c=io(r);return (n.length%4!==0||!xs.test(n)||i&&(c&15)!==0||o&&(c&3)!==0)&&f(),n}function Js(e){return io(e,true)}function io(e,t=false){return (t?"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/").indexOf(e)}function $s(e){let t=D(e,"name");return t===void 0?{}:(t!==null&&!Dt(t)&&f(),{name:t})}function Gs(e){let t=D(e,"transports");if(t==null||t==="")return t===void 0?{}:{transports:t};let n=t.split(",");return (n.length>Nt||n.some(i=>!qi.has(i))||new Set(n).size!==n.length)&&f(),{transports:t}}function Ws(e){let t=D(e,"aaguid");return t==null?t===void 0?{}:{aaguid:null}:(Us.test(t)||f(),{aaguid:t})}function Lt(e,t){let n=R(e);return t.has(n)||f(),n}function z(e,t){return t===void 0?{}:{[e]:t}}function We(e){new Set(e).size!==e.length&&f();}function Ys(e){new Set(e).size!==e.length&&f();}function ra(e,t){if(!t)return e;let n=t.catch(()=>{});return n.then(()=>{n=null;}),{async request(i,o){return n&&await n,e.request(i,o)}}}var uo=new Map;function sa(e,t,n){let i=uo.get(n);if(!i){let o=new URLSearchParams(window.location.hash.slice(1)).get("authowl_code");if(!o)return;i=Promise.resolve().then(()=>(Qe(),Xe)).then(r=>r.completeCrossSiteSignIn(e,t,o)),uo.set(n,i);}return i}function lo(e){return !Oe()||e.idToken||e.disableRedirect?"legacy":"first-party"}function fo(e,t=()=>{},n=aa){let i=Ae(e),o=e.session.tokens,r=Oe()?sa(i,e.session,e.decoded.projectId):void 0,c=ra(i,r),u=Vn({http:c,probe:Ae({...e,fetch:e.session.probe}),tokens:o,channelName:`authowl:${e.decoded.projectId}`});e.session.integration?.connect({authenticatedFetch:e.fetch,sessionStore:u.store,subscribeLifecycle:d=>o.subscribeLifecycle(d)});let a=()=>{u.notifyMutation(),t();},h=async()=>{await e.session.integration?.sessionEstablished(),a();},s=n(c,h),{post:l,mutation:p}=ne(c,a),{mutation:y}=ne(c,h),b=e.decoded.env==="test",S=d=>e.session.prepareSession({remember:d?.rememberMe!==false});return {sessionStore:u.store,getSession:u.getSession,account:Jn(c,a),organization:pi(c,a,()=>u.store.getSnapshot().data?.session.membership??null),privacy:qe(c),signIn:{email:async(d,g)=>(await S(d),y(l("/sign-in/email",d,g,Ct),A=>!("twoFactorRedirect"in A))),username:async(d,g)=>(await S(d),y(l("/sign-in/username",d,g,Ct),A=>!("twoFactorRedirect"in A))),social:async(d,g)=>{if(await S(),lo(d)==="first-party"){let{beginCrossSiteSignIn:k}=await Promise.resolve().then(()=>(Qe(),Xe)),T=await k(e,{kind:"social",provider:d.provider,callbackURL:d.callbackURL,errorCallbackURL:d.errorCallbackURL,newUserCallbackURL:d.newUserCallbackURL,scopes:d.scopes,loginHint:d.loginHint,requestSignUp:d.requestSignUp});if(T)return window.location.assign(T),{data:{redirect:true,url:T},error:null}}let A=await y(l("/sign-in/social",d,g,k=>yi(k,b)),k=>"user"in k);return A.error!==null||A.data===null||"url"in A.data&&A.data.redirect&&!d.disableRedirect&&typeof window<"u"&&window.location.assign(A.data.url),A},sso:async(d,g)=>{if(lo(d)==="first-party"){let{beginCrossSiteSignIn:k}=await Promise.resolve().then(()=>(Qe(),Xe)),T=await k(e,{kind:"sso",email:d.email,providerId:d.providerId,domain:d.domain,organizationSlug:d.organizationSlug,callbackURL:d.callbackURL,errorCallbackURL:d.errorCallbackURL,newUserCallbackURL:d.newUserCallbackURL});if(T)return window.location.assign(T),{data:{url:T,redirect:true},error:null}}let A=await l("/sign-in/sso",d,g,k=>bi(k,b));return A.error!==null||A.data===null||typeof window<"u"&&window.location.assign(A.data.url),A},magicLink:(d,g)=>l("/sign-in/magic-link",d,g,Ai),emailOtp:async(d,g)=>(await S(),y(l("/sign-in/email-otp",d,g,mi))),passkey:async(d,g)=>(await S(),s.signIn(d,g))},signUp:{email:async(d,g)=>(await S(),y(l("/sign-up/email",d,g,hi),A=>A.sessionCreated))},emailOtp:{sendVerificationOtp:(d,g)=>l("/email-otp/send-verification-otp",d,g,Oi),verifyEmail:async(d,g)=>(await S(),y(l("/email-otp/verify-email",d,g,Ti)))},phoneOtp:{prepare:d=>l("/phone-otp/challenge",{},d,Si),start:(d,g)=>l("/phone-otp/start",{...d,idempotencyKey:d.idempotencyKey??we()},g,wi),verify:async(d,g)=>(await S(),y(l("/phone-otp/verify",d,g,Ri)))},requestPasswordReset:(d,g)=>l("/request-password-reset",d,g,xt),resetPassword:(d,g)=>l("/reset-password",d,g,xt),sendVerificationEmail:(d,g)=>l("/send-verification-email",d,g,ki),passkey:{addPasskey:(d,g)=>s.add(d,g),listUserPasskeys:()=>c.request("/passkey/list-user-passkeys",{decode:Wi}),updatePasskey:async(d,g)=>{let A=Je(d.name);if(!A.valid||A.value===void 0)return $e();let k=A.value;return l("/passkey/update-passkey",{...d,name:k},g,T=>Yi(T,d.id,k))},deletePasskey:(d,g)=>l("/passkey/delete-passkey",d,g,Xi)},twoFactor:{enable:(d,g)=>l("/two-factor/enable",d,g,Pi),disable:(d,g)=>p(l("/two-factor/disable",d,g,Ei),A=>A.status),verifyTotp:(d,g)=>y(l("/two-factor/verify-totp",d,g,Be)),verifyBackupCode:(d,g)=>y(l("/two-factor/verify-backup-code",d,g,Be)),sendOtp:(d={},g)=>l("/two-factor/send-otp",d,g,vi),verifyOtp:(d,g)=>y(l("/two-factor/verify-otp",d,g,Be)),generateBackupCodes:(d,g)=>l("/two-factor/generate-backup-codes",d,g,Ci)},signOut:d=>p(c.request("/sign-out",{method:"POST",body:{},fetchOptions:d,decode:Ii}).then(g=>(o.endSession(),e.session.integration?.sessionEnded().then(()=>g)??g)),g=>g.success)}}function aa(){return {signIn:()=>po(),add:()=>po()}}function po(){return Promise.resolve({data:null,error:{status:400,statusText:"BAD_REQUEST",code:"PASSKEY_BROWSER_REQUIRED",message:"This passkey ceremony requires a browser with WebAuthn."}})}function Ao(e,t,n){let i=new Map;return {async signIn(o={},r){let c=await e.request("/passkey/generate-authenticate-options");if(!c.data)return ho(c.error);let u;try{u=ji(c.data);}catch{return go()}let a;try{a=await n.authenticate({optionsJSON:u,useBrowserAutofill:o.autoFill});}catch(y){return yo(n,y,"AUTH_CANCELLED","Passkey authentication was cancelled.")}if(!ca(a))return mo();let{clientExtensionResults:h,...s}=a,l=i.get(a.id);if(l)return l;let p=(async()=>{let y=await e.request("/passkey/verify-authentication",{method:"POST",body:{response:s},fetchOptions:r,decode:$i});return y.data&&await t(),y})();i.set(a.id,p);try{return await p}finally{i.get(a.id)===p&&i.delete(a.id);}},async add(o={},r){let c=Je(o.name);if(!c.valid)return $e();let u=await e.request("/passkey/generate-register-options",{query:{name:c.value,authenticatorAttachment:o.authenticatorAttachment}});if(!u.data)return ho(u.error);let a;try{a=Ji(u.data);}catch{return go()}let h;try{h=await n.register({optionsJSON:a});}catch(y){return yo(n,y,"REGISTRATION_CANCELLED","Passkey registration was cancelled.")}if(!ua(h))return mo();let{clientExtensionResults:s,...l}=h,p=await e.request("/passkey/verify-registration",{method:"POST",body:{response:l,name:c.value},fetchOptions:r,decode:y=>Gi(y,h.id,c.value)});return p.data&&t(),p}}}function go(){return {data:null,error:{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned invalid WebAuthn options."}}}function mo(){return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:"INVALID_WEBAUTHN_RESPONSE",message:"The platform returned an invalid passkey response."}}}function Oo(e){if(!e||typeof e!="object")return  false;let t=e;return typeof t.id=="string"&&t.id.length>0&&typeof t.rawId=="string"&&t.rawId.length>0&&t.type==="public-key"&&!!t.response&&typeof t.response=="object"}function ca(e){if(!Oo(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.authenticatorData=="string"&&typeof t.signature=="string"&&(t.userHandle===void 0||typeof t.userHandle=="string")}function ua(e){if(!Oo(e))return  false;let t=e.response;return typeof t.clientDataJSON=="string"&&typeof t.attestationObject=="string"}function ho(e){return {data:null,error:e??{status:502,statusText:"BAD_GATEWAY",code:"INVALID_WEBAUTHN_OPTIONS",message:"The server returned no WebAuthn options."}}}function yo(e,t,n,i){let o=da(t,"page does not have focus"),r=e.errorCode?.(t),c=r!==void 0?r==="ERROR_CEREMONY_ABORTED":bo(t)==="AbortError",u=n!=="AUTH_CANCELLED",a=la(r,bo(t),u);return {data:null,error:{status:400,statusText:"BAD_REQUEST",code:o?"PASSKEY_PAGE_NOT_FOCUSED":c?n:r??"PASSKEY_BROWSER_ERROR",message:o?"Keep this page focused while completing the passkey prompt.":c?i:a}}}function la(e,t,n){switch(e){case "ERROR_INVALID_DOMAIN":case "ERROR_INVALID_RP_ID":return "Passkeys are not set up for this site\u2019s domain.";case "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED":return "This device already has a passkey for this account.";case "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEY_ALGS":case "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT":case "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT":return "This device cannot create a passkey for this site.";}return t==="NotAllowedError"?n?"No passkey was created. The prompt was dismissed or timed out.":"No passkey was used. This device may not have one saved for this site yet, or the prompt was dismissed.":t==="SecurityError"?"Passkeys are not set up for this site\u2019s domain.":n?"Passkey registration did not complete.":"Passkey sign-in did not complete."}function bo(e){return e&&typeof e=="object"&&"name"in e&&typeof e.name=="string"?e.name:void 0}function da(e,t){let n=t.toLowerCase(),i=new Set,o=e;for(;o&&typeof o=="object"&&!i.has(o);){if(i.add(o),"message"in o&&typeof o.message=="string"&&o.message.toLowerCase().includes(n))return  true;o="cause"in o?o.cause:void 0;}return  false}function j(e){let t=new Uint8Array(e),n="";for(let o of t)n+=String.fromCharCode(o);return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function oe(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=(4-t.length%4)%4,i=t.padEnd(t.length+n,"="),o=atob(i),r=new ArrayBuffer(o.length),c=new Uint8Array(r);for(let u=0;u<o.length;u++)c[u]=o.charCodeAt(u);return r}function re(){return pa.stubThis(globalThis?.PublicKeyCredential!==void 0&&typeof globalThis.PublicKeyCredential=="function")}var pa={stubThis:e=>e};function Ze(e){let{id:t}=e;return {...e,id:oe(t),transports:e.transports}}function et(e){return e==="localhost"||/^((xn--[a-z0-9-]+|[a-z0-9]+(-[a-z0-9]+)*)\.)+([a-z]{2,}|xn--[a-z0-9-]+)$/i.test(e)}var x=class extends Error{constructor({message:t,code:n,cause:i,name:o}){super(t,{cause:i}),Object.defineProperty(this,"code",{enumerable:true,configurable:true,writable:true,value:void 0}),this.name=o??i.name,this.code=n;}};function wo({error:e,options:t}){let{publicKey:n}=t;if(!n)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(t.signal instanceof AbortSignal)return new x({message:"Registration ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else if(e.name==="ConstraintError"){if(n.authenticatorSelection?.requireResidentKey===true)return new x({message:"Discoverable credentials were required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",cause:e});if(t.mediation==="conditional"&&n.authenticatorSelection?.userVerification==="required")return new x({message:"User verification was required during automatic registration but it could not be performed",code:"ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",cause:e});if(n.authenticatorSelection?.userVerification==="required")return new x({message:"User verification was required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",cause:e})}else {if(e.name==="InvalidStateError")return new x({message:"The authenticator was previously registered",code:"ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",cause:e});if(e.name==="NotAllowedError")return new x({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="NotSupportedError")return n.pubKeyCredParams.filter(o=>o.type==="public-key").length===0?new x({message:'No entry in pubKeyCredParams was of type "public-key"',code:"ERROR_MALFORMED_PUBKEYCREDPARAMS",cause:e}):new x({message:"No available authenticator supported any of the specified pubKeyCredParams algorithms",code:"ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",cause:e});if(e.name==="SecurityError"){let i=globalThis.location.hostname;if(et(i)){if(n.rp.id!==i)return new x({message:`The RP ID "${n.rp.id}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new x({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="TypeError"){if(n.user.id.byteLength<1||n.user.id.byteLength>64)return new x({message:"User ID was not between 1 and 64 characters",code:"ERROR_INVALID_USER_ID_LENGTH",cause:e})}else if(e.name==="UnknownError")return new x({message:"The authenticator was unable to process the specified options, or could not create a new credential",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}var Kt=class{constructor(){Object.defineProperty(this,"controller",{enumerable:true,configurable:true,writable:true,value:void 0});}createNewAbortSignal(){if(this.controller){let n=new Error("Cancelling existing WebAuthn API call for new one");n.name="AbortError",this.controller.abort(n);}let t=new AbortController;return this.controller=t,t.signal}cancelCeremony(){if(this.controller){let t=new Error("Manually cancelling existing WebAuthn API call");t.name="AbortError",this.controller.abort(t),this.controller=void 0;}}},tt=new Kt;var fa=["cross-platform","platform"];function nt(e){if(e&&!(fa.indexOf(e)<0))return e}async function So(e){!e.optionsJSON&&e.challenge&&(console.warn("startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});let{optionsJSON:t,useAutoRegister:n=false}=e;if(!re())throw new Error("WebAuthn is not supported in this browser");let i={...t,challenge:oe(t.challenge),user:{...t.user,id:oe(t.user.id)},excludeCredentials:t.excludeCredentials?.map(Ze)},o={};n&&(o.mediation="conditional"),o.publicKey=i,o.signal=tt.createNewAbortSignal();let r;try{r=await navigator.credentials.create(o);}catch(b){throw wo({error:b,options:o})}if(!r)throw new Error("Registration was not completed");let{id:c,rawId:u,response:a,type:h}=r,s;typeof a.getTransports=="function"&&(s=a.getTransports());let l;if(typeof a.getPublicKeyAlgorithm=="function")try{l=a.getPublicKeyAlgorithm();}catch(b){Vt("getPublicKeyAlgorithm()",b);}let p;if(typeof a.getPublicKey=="function")try{let b=a.getPublicKey();b!==null&&(p=j(b));}catch(b){Vt("getPublicKey()",b);}let y;if(typeof a.getAuthenticatorData=="function")try{y=j(a.getAuthenticatorData());}catch(b){Vt("getAuthenticatorData()",b);}return {id:c,rawId:j(u),response:{attestationObject:j(a.attestationObject),clientDataJSON:j(a.clientDataJSON),transports:s,publicKeyAlgorithm:l,publicKey:p,authenticatorData:y},type:h,clientExtensionResults:r.getClientExtensionResults(),authenticatorAttachment:nt(r.authenticatorAttachment)}}function Vt(e,t){console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${e}. You should report this error to them.
+`,t);}function Ro(){if(!re())return Ht.stubThis(new Promise(t=>t(false)));let e=globalThis.PublicKeyCredential;return e?.isConditionalMediationAvailable===void 0?Ht.stubThis(new Promise(t=>t(false))):Ht.stubThis(e.isConditionalMediationAvailable())}var Ht={stubThis:e=>e};function ko({error:e,options:t}){let{publicKey:n}=t;if(!n)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(t.signal instanceof AbortSignal)return new x({message:"Authentication ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else {if(e.name==="NotAllowedError")return new x({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="SecurityError"){let i=globalThis.location.hostname;if(et(i)){if(n.rpId!==i)return new x({message:`The RP ID "${n.rpId}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new x({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="UnknownError")return new x({message:"The authenticator was unable to process the specified options, or could not create a new assertion signature",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}async function To(e){!e.optionsJSON&&e.challenge&&(console.warn("startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});let{optionsJSON:t,useBrowserAutofill:n=false,verifyBrowserAutofillInput:i=true}=e;if(!re())throw new Error("WebAuthn is not supported in this browser");let o;t.allowCredentials?.length!==0&&(o=t.allowCredentials?.map(Ze));let r={...t,challenge:oe(t.challenge),allowCredentials:o},c={};if(n){if(!await Ro())throw Error("Browser does not support WebAuthn autofill");if(document.querySelectorAll("input[autocomplete$='webauthn']").length<1&&i)throw Error('No <input> with "webauthn" as the only or last value in its `autocomplete` attribute was detected');c.mediation="conditional",r.allowCredentials=[];}c.publicKey=r,c.signal=tt.createNewAbortSignal();let u;try{u=await navigator.credentials.get(c);}catch(y){throw ko({error:y,options:c})}if(!u)throw new Error("Authentication was not completed");let{id:a,rawId:h,response:s,type:l}=u,p;return s.userHandle&&(p=j(s.userHandle)),{id:a,rawId:j(h),response:{authenticatorData:j(s.authenticatorData),clientDataJSON:j(s.clientDataJSON),signature:j(s.signature),userHandle:p},type:l,clientExtensionResults:u.getClientExtensionResults(),authenticatorAttachment:nt(u.authenticatorAttachment)}}var Io={authenticate:e=>To(e),register:e=>So(e),errorCode:e=>e instanceof x?e.code:void 0};function Eo(e){return `${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}/consent`}async function qt(e){let t=await $(e,Eo(e),{init:{method:"GET",credentials:"include"},maxResponseBytes:65536,decode:ga});return t.response.status===401?{required:false}:ee(t,"consent status")}async function Bt(e,t){if(!Number.isSafeInteger(t)||t<1)throw new TypeError("Consent version must be a positive integer.");return ee(await $(e,Eo(e),{init:{method:"POST",headers:{"content-type":"application/json"},credentials:"include",body:JSON.stringify({version:t})},maxResponseBytes:64*1024,decode:ma}),"consent accept")}function ga(e){let t=m(e),n=P(t.required),i=ha(t.needsConsent),o=vo(t.version),r=Po(t.termsUrl),c=Po(t.privacyUrl);return {required:n,...i===void 0?{}:{needsConsent:i},...o===void 0?{}:{version:o},...r===void 0?{}:{termsUrl:r},...c===void 0?{}:{privacyUrl:c}}}function ma(e){let t=m(e),n=vo(t.version);return {ok:P(t.ok),...n===void 0?{}:{version:n}}}function ha(e){if(e===void 0||typeof e=="boolean")return e;throw new TypeError("Invalid consent response.")}function vo(e){if(e===void 0||Number.isSafeInteger(e)&&e>=1)return e;throw new TypeError("Invalid consent response.")}function Po(e){if(e===void 0||typeof e=="string"&&e.length<=4096)return e;throw new TypeError("Invalid consent response.")}var ya=30;function ba(e){return typeof e?.exp=="number"?e.exp:null}function Aa(e){let t=e.split(".")[1];if(!t)return null;try{let n=t.replace(/-/g,"+").replace(/_/g,"/"),i=JSON.parse(atob(n));return typeof i=="object"&&i!==null?i:null}catch{return null}}function jt(e){let t=new Map;async function n(r={}){let c=r.template===void 0?null:r.template.trim().toLowerCase();if(c==="")throw new TypeError("Template missing");let u=c??"",a=t.get(u);a||(a={activeKey:null,cachedByKey:new Map,inflight:null,sequence:0},t.set(u,a));let h=r.forceRefresh===true;if(!h){let b=a.activeKey?a.cachedByKey.get(a.activeKey):null;if(b&&b.exp-Date.now()/1e3>ya)return b.token;if(a.inflight)return a.inflight}let s=++a.sequence,l=()=>t.get(u)===a&&a.sequence===s,p=(async()=>{let b=c?`${e.projectBaseURL}/token/${encodeURIComponent(c)}`:`${e.projectBaseURL}/token`,S=await $(e,b,{init:{method:"GET",credentials:"include"},maxResponseBytes:64*1024,decode:U=>Oa(U,c!==null)});if(S.response.status===401)return l()&&i(),null;let d=ee(S,"token"),g=d.policyVersion,A=d.token,k=Aa(A),T=ba(k);if(l())if(T!==null){let U=typeof k?.sub=="string"?k.sub:null,K=typeof k?.org_id=="string"?k.org_id:null;if(!c||U){let w=JSON.stringify([e.projectBaseURL,U,K,c,g]);a.cachedByKey.clear(),a.cachedByKey.set(w,{token:A,exp:T}),a.activeKey=w;}else o(a);}else o(a);return A})();if(h)return p;let y=p.finally(()=>{a.inflight===y&&(a.inflight=null);});return a.inflight=y,y}function i(){t.clear();}function o(r){r.cachedByKey.clear(),r.activeKey=null;}return {getToken:n,clear:i}}function Oa(e,t){let n=m(e),i=R(n.token);if(i.length===0||i.length>32*1024)throw new TypeError("Invalid token response.");if(!t)return {token:i,policyVersion:0};let o=m(n.template);if(!Number.isSafeInteger(o.policyVersion)||o.policyVersion<1)throw new TypeError("Invalid token response.");return {token:i,policyVersion:o.policyVersion}}function wa(e){let t=jt(e),n=fo(e,t.clear,(u,a)=>Ao(u,a,Io)),i=Ae(e,`${new URL(e.apiUrl).origin}/api/projects/${e.decoded.projectId}`),o=qe(i),r=u=>(...a)=>(t.clear(),u(...a)),c={getConsentStatus:()=>qt(e),acceptConsent:u=>Bt(e,u),getToken:t.getToken,privacy:o,waitlist:{join:(u,a)=>i.request("/waitlist",{method:"POST",body:u,fetchOptions:a,credentials:"omit"})},account:{...n.account,updateUnsafeMetadata:r(n.account.updateUnsafeMetadata),updateProfile:r(n.account.updateProfile),changeEmail:r(n.account.changeEmail),changePassword:r(n.account.changePassword),revokeSession:r(n.account.revokeSession),delete:r(n.account.delete)},signIn:{email:r(n.signIn.email),username:r(n.signIn.username),social:r(n.signIn.social),sso:n.signIn.sso,magicLink:n.signIn.magicLink,emailOtp:r(n.signIn.emailOtp),passkey:r(n.signIn.passkey)},signUp:{email:r(n.signUp.email)},emailOtp:{...n.emailOtp,verifyEmail:r(n.emailOtp.verifyEmail)},twoFactor:{enable:n.twoFactor.enable,disable:r(n.twoFactor.disable),verifyTotp:r(n.twoFactor.verifyTotp),verifyBackupCode:r(n.twoFactor.verifyBackupCode),sendOtp:n.twoFactor.sendOtp,verifyOtp:r(n.twoFactor.verifyOtp),generateBackupCodes:n.twoFactor.generateBackupCodes},phoneOtp:{prepare:n.phoneOtp.prepare,start:n.phoneOtp.start,verify:r(n.phoneOtp.verify)},signOut:r(n.signOut)};return {...n,...c}}async function Sa(e){if(typeof window>"u")throw new Error("Akedly Shield challenges must be solved in a browser.");let t=await Ra(),n=e.challengeRequired?await t.solvePow(e.challenge,e.difficulty):null,i=e.turnstile.required?await t.getTurnstileToken(ka(e.turnstile.siteKey)):void 0;return {connectionId:e.connectionId,...n?{challengeToken:e.challengeToken,nonce:n.nonce}:{},...i?{turnstileToken:i}:{}}}async function Ra(){return import('@akedly/shield')}function ka(e){if(!e)throw new Error("Akedly Shield did not provide a Turnstile site key.");return e}async function Ta(e){let t=`${e.apiUrl}/api/projects/${e.decoded.projectId}/public-config`;return ee(await $(e,t,{init:{method:"GET",credentials:"omit"},maxResponseBytes:256*1024,decode:n=>Ia(n,e)}),"public-config")}function Ia(e,t){let n=G(e),i=n.environmentId,o=n.environmentType,r=`${t.apiUrl}/api/projects/${t.decoded.projectId}/auth`;if(typeof n.applicationId!="string"||!Jt(n.applicationId)||i!==t.decoded.projectId||o!=="development"&&o!=="production"||n.authBaseUrl!==r)throw L();let c=_(n.branding),u=_(n.legal);if(!se(n.enabledMethods,64)||!se(n.socialProviders,64)||!_o(c,["appName","logoUrl","primaryColor"])||c.showAppName!==void 0&&typeof c.showAppName!="boolean"||c.alignment!==void 0&&c.alignment!=="left"&&c.alignment!=="center"&&c.alignment!=="right"||c.theme!==void 0&&c.theme!=="light"&&c.theme!=="dark"&&c.theme!=="system"||!_o(u,["termsUrl","privacyUrl"])||!Number.isSafeInteger(u.version)||u.version<0||typeof u.required!="boolean")throw L();if(n.socialProviderClientIds!==void 0){let a=_(n.socialProviderClientIds);if(Object.keys(a).length>64||Object.values(a).some(h=>typeof h!="string"||h.length>2048))throw L()}if(!X(n,["requireEmailVerification","twoFactor","mfaRequired","accountDeletion","organizations","sso","badge"])||!Co(n.turnstileSiteKey)||!Co(n.authTurnstileSiteKey)||typeof n.locale!="string"||n.locale.length===0||n.locale.length>64||!Number.isSafeInteger(n.configVersion)||n.configVersion<0)throw L();if(n.jwtIssuer!==null){let a=_(n.jwtIssuer),h=new URL(a.issuer),s=`${h.origin}/api/projects/${t.decoded.projectId}/auth`;if(a.issuer!==s||a.jwksUrl!==`${s}/jwks`||a.aud!==t.decoded.projectId||h.protocol!=="https:"&&h.origin!==t.apiUrl)throw L()}if(n.signUp!==void 0){let a=_(n.signUp).mode;if(typeof a!="string"||!["open","restricted","allowlist","waitlist"].includes(a))throw L()}if(n.authentication!==void 0&&Pa(n.authentication),n.privacy!==void 0&&Ea(n.privacy),n.emailVerification!==void 0){let a=_(n.emailVerification);if(!X(a,["required"])||a.method!=="link"&&a.method!=="code")throw L()}if(n.userModel!==void 0&&!X(_(n.userModel),["requireEmail","firstLastName","emailChange","accountDeletion"]))throw L();if(n.mfa!==void 0){let a=_(n.mfa);if(!X(a,["totp","required","backupCodes"])||a.emailOtpFallback!==void 0&&typeof a.emailOtpFallback!="boolean"||a.trustDevice!==void 0&&typeof a.trustDevice!="boolean"||(a.required===true||a.backupCodes===true)&&a.totp!==true)throw L()}if(n.captcha===void 0||n.captcha===null)n.captcha=typeof n.authTurnstileSiteKey=="string"&&n.authTurnstileSiteKey.length>0?{provider:"turnstile",siteKey:n.authTurnstileSiteKey}:null;else {let a=_(n.captcha);if(typeof a.provider!="string"||a.provider.length===0||a.provider.length>64||typeof a.siteKey!="string"||a.siteKey.length===0||a.siteKey.length>512)throw L();n.captcha={provider:a.provider,siteKey:a.siteKey};}return n}function Jt(e){return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}function L(){return new TypeError("public-config returned an invalid response")}function _(e){if(!e||typeof e!="object"||Array.isArray(e))throw L();return e}function Co(e){return e===null||typeof e=="string"&&e.length<=4096}function Pa(e){let t=_(e),n=_(t.email),i=_(t.password),o=i.minLength!==void 0||i.maxLength!==void 0;if(!X(n,["signUp"])||!se(n.signIn,3)||n.signIn.some(r=>r!=="password"&&r!=="magic_link"&&r!=="email_otp")||!X(_(t.phone),["signUp","signIn"])||!X(i,["signUp","add"])||o&&(!Number.isSafeInteger(i.minLength)||!Number.isSafeInteger(i.maxLength)||i.minLength<1||i.maxLength>4096||i.minLength>i.maxLength)||!X(_(t.passkey),["signIn","add"])||!va(_(t.passkey).relyingPartyId)||!X(_(t.username),["collectOnSignUp","signIn"]))throw L()}function Ea(e){let t=_(e);if(!Array.isArray(t.notices)||!Array.isArray(t.consentPurposes)||t.notices.length>64||t.consentPurposes.length>64)throw L();for(let n of t.notices){let i=_(n);if(xo(i,"noticeId","noticeVersionId"),it(i.title,512),it(i.body,1e5),Do(i.digest),!se(i.activityCodes,128)||!se(i.purposeCodes,128)||typeof i.effectiveFrom!="string"||!Number.isFinite(Date.parse(i.effectiveFrom)))throw L()}for(let n of t.consentPurposes){let i=_(n);if(xo(i,"purposeId","purposeVersionId"),it(i.title,512),it(i.description,1e4),Do(i.digest),!se(i.activityCodes,128)||!se(i.dataCategories,128))throw L()}}function xo(e,t,n){if(typeof e[t]!="string"||!Jt(e[t])||typeof e[n]!="string"||!Jt(e[n])||typeof e.code!="string"||!/^[a-z][a-z0-9_]{0,63}$/.test(e.code)||!Number.isSafeInteger(e.version)||e.version<1)throw L()}function it(e,t){let n=_(e);if(typeof n.en!="string"||n.en.length===0||n.en.length>t||typeof n.ar!="string"||n.ar.length===0||n.ar.length>t)throw L()}function Do(e){let t=_(e);if(typeof t.en!="string"||!/^[a-f0-9]{64}$/.test(t.en)||typeof t.ar!="string"||!/^[a-f0-9]{64}$/.test(t.ar))throw L()}function va(e){return e==null||typeof e=="string"}function X(e,t){return t.every(n=>typeof e[n]=="boolean")}function _o(e,t){return t.every(n=>e[n]===void 0||typeof e[n]=="string"&&e[n].length<=4096)}function se(e,t){return Array.isArray(e)&&e.length<=t&&e.every(n=>typeof n=="string"&&n.length<=128)&&new Set(e).size===e.length}var ve=class extends Error{constructor(n,i){super(n);this.cause=i;this.name="AuthOwlError";}cause},$t=class extends ve{constructor(n,i){super(`Rate limited. Retry after ${n}s.`,i);this.retryAfterSeconds=n;this.name="RateLimitedError";}retryAfterSeconds},Gt=class extends ve{constructor(t="invalid publishable key",n){super(t,n),this.name="InvalidKeyError";}};var Uo=["en","ar"];function Ca(e){return e==="ar"?"rtl":"ltr"}function xa(e){return typeof e=="string"&&Uo.includes(e)}
+exports.AUTH_CHALLENGE_HEADER=Mn;exports.AUTH_LOCALE_HEADER=Fn;exports.AuthOwlError=ve;exports.AuthOwlHttpError=Le;exports.INVITATION_CLAIM_MAX_AGE_MS=vn;exports.INVITATION_QUERY_PARAM=pt;exports.InvalidKeyError=Gt;exports.LOCALES=Uo;exports.RateLimitedError=$t;exports.SESSION_TOKEN_HEADER=ct;exports.SESSION_TRANSPORT_BEARER=lt;exports.SESSION_TRANSPORT_HEADER=ut;exports.TransportError=F;exports.acceptConsent=Bt;exports.activeLocale=ht;exports.captureInvitationClaim=fr;exports.clearInvitationClaim=ye;exports.createAuthOwlClient=wa;exports.createIdempotencyKey=we;exports.createMembershipHas=ns;exports.createTokenClient=jt;exports.decodePublishableKey=rt;exports.directionFor=Ca;exports.getConsentStatus=qt;exports.getPublicConfig=Ta;exports.isLocale=xa;exports.membershipHas=Ke;exports.membershipHasPermission=Fe;exports.membershipHasRole=Gn;exports.membershipHasTeam=$n;exports.passkeyOfferIsDue=wr;exports.readInvitationClaim=he;exports.readLastUsedSignInMethod=mr;exports.recordLastUsedSignInMethod=hr;exports.recordPasskeyOfferDismissed=Sr;exports.recordPasskeyOfferSettled=Rr;exports.rememberPendingSignInMethod=yr;exports.resolveAuthTarget=Pn;exports.resolveConfig=pr;exports.resolveProjectCapabilities=kr;exports.sessionChallengeIsEphemeral=Ho;exports.sessionCookieName=Mo;exports.setActiveLocale=zr;exports.settlePendingSignInMethod=br;exports.solvePhoneOtpChallenge=Sa;exports.withSessionTransportIntegration=Zo;

package/dist/index.d.cts

@@ -1,9 +1,9 @@
-import { E as PhoneOtpChallengeData, F as AkedlyShieldStartProof } from './config-CyUwyJ9B.cjs';
-export { G as AcceptOrganizationInvitationData, I as AccountClient, J as AccountSession, K as AccountStatusData, A as ActionFetchOptions, L as AddOrganizationTeamMemberOptions, d as AddPasskeyOptions, a as AuthActionResult, g as AuthClientError, f as AuthConfig, M as AuthErrorContext, b as AuthOwlClient, N as AuthOwlErrorCode, e as AuthPasskey, Q as AuthRequestContext, T as AuthResponseContext, h as AuthSession, i as AuthUser, U as ChangeEmailOptions, V as ChangePasswordData, W as ChangePasswordOptions, X as ConsentAcceptResult, Y as ConsentStatus, Z as CreateOrganizationOptions, _ as CreateOrganizationTeamOptions, C as CreatePrivacyRightsRequestOptions, D as DecodedPublishableKey, $ as DeleteAccountData, a0 as DeleteAccountOptions, a1 as DeleteOrganizationOptions, a2 as DeletePasskeyData, a3 as DeletePasskeyOptions, a4 as DisableTwoFactorOptions, a5 as EmailAuthData, a6 as EmailOtpAuthData, a7 as EmailOtpSignInOptions, a8 as EmailOtpType, a9 as EmailSignInOptions, aa as EmailSignUpData, ab as EmailSignUpOptions, ac as EnableTwoFactorOptions, ad as GenerateBackupCodesOptions, ae as GetOrganizationInvitationOptions, af as GetOrganizationOptions, ag as GetToken, ah as GetTokenOptions, H as HasParams, ai as INVITATION_CLAIM_MAX_AGE_MS, aj as INVITATION_QUERY_PARAM, ak as InvitationClaim, al as InvitationRecipientHint, am as InviteOrganizationMemberOptions, an as JsonObject, ao as JsonPrimitive, ap as JsonValue, aq as LeaveOrganizationOptions, ar as LinkSocialData, as as LinkSocialOptions, at as ListOrganizationInvitationsOptions, au as ListOrganizationMembersOptions, av as ListOrganizationRolesOptions, aw as ListOrganizationTeamMembersOptions, ax as ListOrganizationTeamsOptions, ay as MagicLinkData, az as MagicLinkSignInOptions, O as Organization, j as OrganizationClient, k as OrganizationDetails, aA as OrganizationFilterOperator, aB as OrganizationInvitation, aC as OrganizationInvitationActionOptions, aD as OrganizationInvitationDetails, aE as OrganizationInvitationStatus, aF as OrganizationMember, aG as OrganizationMemberUser, aH as OrganizationMemberWithUser, aI as OrganizationMembersData, l as OrganizationMembership, aJ as OrganizationRoleSummary, aK as OrganizationSelector, aL as OrganizationTeam, aM as OrganizationTeamMember, aN as OrganizationUserInvitation, c as PasskeyAuthData, P as PasskeySignInOptions, aO as PasswordResetData, aP as PhoneAuthUser, aQ as PhoneOtpStartData, aR as PhoneOtpStartOptions, aS as PhoneOtpVerifyData, aT as PhoneOtpVerifyOptions, m as PrivacyClient, n as PrivacyConsentPreference, o as PrivacyConsentState, p as PrivacyLocale, q as PrivacyRightState, r as PrivacyRightType, s as PrivacyRightsRequest, t as RecordPrivacyConsentOptions, aU as RejectOrganizationInvitationData, aV as RemoveOrganizationMemberData, aW as RemoveOrganizationMemberOptions, aX as RemoveOrganizationTeamData, aY as RemoveOrganizationTeamMemberData, aZ as RemoveOrganizationTeamMemberOptions, a_ as RemoveOrganizationTeamOptions, a$ as RequestPasswordResetOptions, b0 as ResetPasswordOptions, R as ResolvedAuthConfig, b1 as ResolvedAuthTarget, b2 as RevokeSessionOptions, b3 as SendOtpData, b4 as SendTwoFactorOtpData, b5 as SendTwoFactorOtpOptions, b6 as SendVerificationOtpOptions, b7 as SessionLifecycleEvent, u as SessionState, v as SessionStore, b8 as SessionTransportConnection, b9 as SessionTransportIntegration, w as SetActiveOrganizationOptions, ba as SetActiveTeamOptions, bb as SignOutData, bc as SocialAccount, x as SocialAuthData, S as SocialIdTokenOptions, bd as SocialSignInOptions, be as TokenClient, bf as TransportError, bg as TransportErrorKind, bh as TwoFactorBackupCodesData, bi as TwoFactorEnableData, bj as TwoFactorRedirectData, bk as TwoFactorStatusData, bl as TwoFactorVerifyData, bm as UnlinkSocialOptions, bn as UpdateOrganizationMemberRoleOptions, bo as UpdateOrganizationOptions, bp as UpdateOrganizationTeamOptions, bq as UpdatePasskeyData, br as UpdatePasskeyOptions, bs as UpdateProfileOptions, bt as UpdateUnsafeMetadataOptions, bu as UserMetadata, bv as UsernameSignInOptions, bw as VerifyBackupCodeOptions, bx as VerifyEmailOtpData, by as VerifyEmailOtpOptions, bz as VerifyTotpOptions, bA as VerifyTwoFactorOtpOptions, bB as WaitlistJoinData, bC as WaitlistJoinOptions, bD as acceptConsent, bE as captureInvitationClaim, bF as clearInvitationClaim, bG as createAuthOwlClient, y as createMembershipHas, bH as createTokenClient, z as decodePublishableKey, bI as getConsentStatus, bJ as membershipHas, bK as membershipHasPermission, bL as membershipHasRole, bM as membershipHasTeam, bN as readInvitationClaim, bO as resolveAuthTarget, B as resolveConfig, bP as withSessionTransportIntegration } from './config-CyUwyJ9B.cjs';
+import { E as PhoneOtpChallengeData, F as AkedlyShieldStartProof } from './config-ZhNp65dI.cjs';
+export { G as AcceptOrganizationInvitationData, I as AccountClient, J as AccountSession, K as AccountStatusData, A as ActionFetchOptions, L as AddOrganizationTeamMemberOptions, d as AddPasskeyOptions, a as AuthActionResult, g as AuthClientError, f as AuthConfig, M as AuthErrorContext, b as AuthOwlClient, N as AuthOwlErrorCode, e as AuthPasskey, Q as AuthRequestContext, T as AuthResponseContext, h as AuthSession, i as AuthUser, U as ChangeEmailOptions, V as ChangePasswordData, W as ChangePasswordOptions, X as ConsentAcceptResult, Y as ConsentStatus, Z as CreateOrganizationOptions, _ as CreateOrganizationTeamOptions, C as CreatePrivacyRightsRequestOptions, D as DecodedPublishableKey, $ as DeleteAccountData, a0 as DeleteAccountOptions, a1 as DeleteOrganizationOptions, a2 as DeletePasskeyData, a3 as DeletePasskeyOptions, a4 as DisableTwoFactorOptions, a5 as EmailAuthData, a6 as EmailOtpAuthData, a7 as EmailOtpSignInOptions, a8 as EmailOtpType, a9 as EmailSignInOptions, aa as EmailSignUpData, ab as EmailSignUpOptions, ac as EnableTwoFactorOptions, ad as GenerateBackupCodesOptions, ae as GetOrganizationInvitationOptions, af as GetOrganizationOptions, ag as GetToken, ah as GetTokenOptions, H as HasParams, ai as INVITATION_CLAIM_MAX_AGE_MS, aj as INVITATION_QUERY_PARAM, ak as InvitationClaim, al as InvitationRecipientHint, am as InviteOrganizationMemberOptions, an as JsonObject, ao as JsonPrimitive, ap as JsonValue, aq as LeaveOrganizationOptions, ar as LinkSocialData, as as LinkSocialOptions, at as ListOrganizationInvitationsOptions, au as ListOrganizationMembersOptions, av as ListOrganizationRolesOptions, aw as ListOrganizationTeamMembersOptions, ax as ListOrganizationTeamsOptions, ay as MagicLinkData, az as MagicLinkSignInOptions, O as Organization, j as OrganizationClient, k as OrganizationDetails, aA as OrganizationFilterOperator, aB as OrganizationInvitation, aC as OrganizationInvitationActionOptions, aD as OrganizationInvitationDetails, aE as OrganizationInvitationStatus, aF as OrganizationMember, aG as OrganizationMemberUser, aH as OrganizationMemberWithUser, aI as OrganizationMembersData, l as OrganizationMembership, aJ as OrganizationRoleSummary, aK as OrganizationSelector, aL as OrganizationTeam, aM as OrganizationTeamMember, aN as OrganizationUserInvitation, c as PasskeyAuthData, P as PasskeySignInOptions, aO as PasswordResetData, aP as PhoneAuthUser, aQ as PhoneOtpStartData, aR as PhoneOtpStartOptions, aS as PhoneOtpVerifyData, aT as PhoneOtpVerifyOptions, m as PrivacyClient, n as PrivacyConsentPreference, o as PrivacyConsentState, p as PrivacyLocale, q as PrivacyRightState, r as PrivacyRightType, s as PrivacyRightsRequest, t as RecordPrivacyConsentOptions, aU as RejectOrganizationInvitationData, aV as RemoveOrganizationMemberData, aW as RemoveOrganizationMemberOptions, aX as RemoveOrganizationTeamData, aY as RemoveOrganizationTeamMemberData, aZ as RemoveOrganizationTeamMemberOptions, a_ as RemoveOrganizationTeamOptions, a$ as RequestPasswordResetOptions, b0 as ResetPasswordOptions, R as ResolvedAuthConfig, b1 as ResolvedAuthTarget, b2 as RevokeSessionOptions, b3 as SendOtpData, b4 as SendTwoFactorOtpData, b5 as SendTwoFactorOtpOptions, b6 as SendVerificationOtpOptions, b7 as SessionLifecycleEvent, u as SessionState, v as SessionStore, b8 as SessionTransportConnection, b9 as SessionTransportIntegration, w as SetActiveOrganizationOptions, ba as SetActiveTeamOptions, bb as SignOutData, bc as SocialAccount, x as SocialAuthData, S as SocialIdTokenOptions, bd as SocialSignInOptions, be as TokenClient, bf as TransportError, bg as TransportErrorKind, bh as TwoFactorBackupCodesData, bi as TwoFactorEnableData, bj as TwoFactorRedirectData, bk as TwoFactorStatusData, bl as TwoFactorVerifyData, bm as UnlinkSocialOptions, bn as UpdateOrganizationMemberRoleOptions, bo as UpdateOrganizationOptions, bp as UpdateOrganizationTeamOptions, bq as UpdatePasskeyData, br as UpdatePasskeyOptions, bs as UpdateProfileOptions, bt as UpdateUnsafeMetadataOptions, bu as UserMetadata, bv as UsernameSignInOptions, bw as VerifyBackupCodeOptions, bx as VerifyEmailOtpData, by as VerifyEmailOtpOptions, bz as VerifyTotpOptions, bA as VerifyTwoFactorOtpOptions, bB as WaitlistJoinData, bC as WaitlistJoinOptions, bD as acceptConsent, bE as captureInvitationClaim, bF as clearInvitationClaim, bG as createAuthOwlClient, y as createMembershipHas, bH as createTokenClient, z as decodePublishableKey, bI as getConsentStatus, bJ as membershipHas, bK as membershipHasPermission, bL as membershipHasRole, bM as membershipHasTeam, bN as readInvitationClaim, bO as resolveAuthTarget, B as resolveConfig, bP as withSessionTransportIntegration } from './config-ZhNp65dI.cjs';
 export { s as sessionCookieName } from './cookie-BqcfagTw.cjs';
 export { S as SESSION_TOKEN_HEADER, a as SESSION_TRANSPORT_BEARER, b as SESSION_TRANSPORT_HEADER } from './session-transport-contract-HDPYRum8.cjs';
-export { b as AUTH_CHALLENGE_HEADER, d as AUTH_LOCALE_HEADER, P as ProjectCapabilities, a as createIdempotencyKey, r as resolveProjectCapabilities } from './idempotency-mYtBlnGY.cjs';
-export { E as EnvironmentType, P as PublicConfig, g as getPublicConfig } from './public-config-DojOd5F7.cjs';
+export { b as AUTH_CHALLENGE_HEADER, d as AUTH_LOCALE_HEADER, P as ProjectCapabilities, a as createIdempotencyKey, r as resolveProjectCapabilities } from './idempotency-CG0ZpMnW.cjs';
+export { E as EnvironmentType, P as PublicConfig, g as getPublicConfig } from './public-config-DdTDwDF7.cjs';
 export { a as LOCALES, L as Locale, d as directionFor, i as isLocale } from './index-DgVPDEYx.cjs';
 
 /**
@@ -86,6 +86,20 @@ declare function rememberPendingSignInMethod(projectId: string, method: LastUsed
  */
 declare function settlePendingSignInMethod(projectId: string, signedIn: boolean): void;
 
+/**
+ * True when the offer may be shown.
+ *
+ * Every uncertainty answers the same way - never asked, storage refused, a
+ * value that is not ours - because the sensible response to all of them is to
+ * ask, which is recoverable. The only values that suppress it are ones this
+ * module wrote.
+ */
+declare function passkeyOfferIsDue(projectId: string, userId: string, now?: number): boolean;
+/** The user declined. Ask again after the cool-off. */
+declare function recordPasskeyOfferDismissed(projectId: string, userId: string, now?: number): void;
+/** A passkey now exists because of the offer. Stop asking on this browser. */
+declare function recordPasskeyOfferSettled(projectId: string, userId: string): void;
+
 /**
  * Complete Akedly Shield's browser-only proof ceremony. The provider package is
  * lazy-loaded only when the server-selected route requires it.
@@ -116,4 +130,4 @@ declare class AuthOwlHttpError extends Error {
 declare function setActiveLocale(projectId: string, locale: string | null): () => void;
 declare function activeLocale(projectId: string): string | null;
 
-export { AkedlyShieldStartProof, AuthOwlError, AuthOwlHttpError, InvalidKeyError, type LastUsedSignInMethod, PhoneOtpChallengeData, RateLimitedError, activeLocale, readLastUsedSignInMethod, recordLastUsedSignInMethod, rememberPendingSignInMethod, sessionChallengeIsEphemeral, setActiveLocale, settlePendingSignInMethod, solvePhoneOtpChallenge };
+export { AkedlyShieldStartProof, AuthOwlError, AuthOwlHttpError, InvalidKeyError, type LastUsedSignInMethod, PhoneOtpChallengeData, RateLimitedError, activeLocale, passkeyOfferIsDue, readLastUsedSignInMethod, recordLastUsedSignInMethod, recordPasskeyOfferDismissed, recordPasskeyOfferSettled, rememberPendingSignInMethod, sessionChallengeIsEphemeral, setActiveLocale, settlePendingSignInMethod, solvePhoneOtpChallenge };