@cimplify/sdk 0.66.0 → 0.68.0

package/dist/{chunk-AVQL3TSJ.js → chunk-WCSAZRNC.js}

@@ -1758,8 +1758,20 @@ var LinkService = class {
   }
   async verifyOtp(input, opts) {
     const idempotencyKey = opts?.idempotencyKey ?? generateIdempotencyKey();
+    const { business_id: _ignoredBusinessId, ...body } = input;
     const result = await safe(
-      this.client.linkPost("/v1/link/auth/verify-otp", input, { idempotencyKey })
+      this.client.linkPost("/v1/link/auth/verify-otp", body, { idempotencyKey })
+    );
+    if (result.ok && result.value.session_token) {
+      this.client.setAccessToken(result.value.session_token);
+    }
+    return result;
+  }
+  async refreshSession(sessionToken, opts) {
+    const idempotencyKey = opts?.idempotencyKey ?? generateIdempotencyKey();
+    const body = sessionToken ? { session_token: sessionToken } : {};
+    const result = await safe(
+      this.client.linkPost("/v1/link/auth/refresh", body, { idempotencyKey })
     );
     if (result.ok && result.value.session_token) {
       this.client.setAccessToken(result.value.session_token);
@@ -2241,30 +2253,39 @@ var MESSAGE_TYPES = {
   SET_TOKEN: "set_token",
   SET_CART: "set_cart",
   GET_DATA: "get_data",
+  NAVIGATE: "navigate",
   REFRESH_TOKEN: "refresh_token",
   LOGOUT: "logout",
   PROCESS_CHECKOUT: "process_checkout",
   ABORT_CHECKOUT: "abort_checkout",
   READY: "ready",
   HEIGHT_CHANGE: "height_change",
-  AUTHENTICATED: "authenticated",
-  REQUIRES_OTP: "requires_otp",
   ERROR: "error",
   ADDRESS_CHANGED: "address_changed",
   ADDRESS_SELECTED: "address_selected",
   PAYMENT_METHOD_SELECTED: "payment_method_selected",
-  TOKEN_REFRESHED: "token_refreshed",
   LOGOUT_COMPLETE: "logout_complete",
+  AUTH_REQUESTED: "auth_requested",
   CONTACT_PROVIDED: "contact_provided",
   CHECKOUT_STATUS: "checkout_status",
   CHECKOUT_COMPLETE: "checkout_complete",
   ORDER_TYPE_CHANGED: "order_type_changed",
   REQUEST_SUBMIT: "request_submit"
 };
+var ELEMENTS_AUTH_CONTACT_TYPES = {
+  EMAIL: "email",
+  PHONE: "phone"
+};
+var ELEMENTS_AUTH_PROMPTS = {
+  LOGIN: "login"
+};
+var ELEMENTS_AUTH_MODES = {
+  CHECKOUT: "checkout",
+  DEFAULT: "default"
+};
 var EVENT_TYPES = {
   READY: "ready",
   AUTHENTICATED: "authenticated",
-  REQUIRES_OTP: "requires_otp",
   ERROR: "error",
   CHANGE: "change",
   BLUR: "blur",
@@ -2273,6 +2294,326 @@ var EVENT_TYPES = {
   REQUEST_SUBMIT: "request_submit"
 };
 
+// src/internal/pkce.ts
+var VERIFIER_BYTES = 64;
+async function generatePkce() {
+  const random = new Uint8Array(VERIFIER_BYTES);
+  crypto.getRandomValues(random);
+  const verifier = base64UrlEncode(random);
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  const challenge = base64UrlEncode(new Uint8Array(digest));
+  return { verifier, challenge, method: "S256" };
+}
+function generateState(byteLength = 16) {
+  const buf = new Uint8Array(byteLength);
+  crypto.getRandomValues(buf);
+  return base64UrlEncode(buf);
+}
+function base64UrlEncode(bytes) {
+  let str = "";
+  for (const byte of bytes) str += String.fromCharCode(byte);
+  return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/internal/pkce-cookie.ts
+var PKCE_COOKIE = "cimplify_pkce";
+var PKCE_COOKIE_PATH = "/auth";
+var PKCE_COOKIE_MAX_AGE_SECONDS = 600;
+function encodePkceState(state) {
+  return encodeURIComponent(JSON.stringify(state));
+}
+function decodePkceState(raw) {
+  try {
+    const parsed = JSON.parse(decodeURIComponent(raw));
+    if (typeof parsed?.verifier === "string" && typeof parsed.state === "string" && typeof parsed.returnTo === "string") {
+      return { verifier: parsed.verifier, state: parsed.state, returnTo: parsed.returnTo };
+    }
+  } catch {
+  }
+  return null;
+}
+
+// src/internal/discovery.ts
+var DEFAULT_ISSUER = "https://api.cimplify.io";
+var DEFAULT_AUTHORIZATION_ENDPOINT = "https://auth.cimplify.io/oauth/authorize";
+function fallbackAuthorizationEndpoint(issuerBase) {
+  if (issuerBase === DEFAULT_ISSUER) return DEFAULT_AUTHORIZATION_ENDPOINT;
+  throw new Error(
+    `OIDC discovery for "${issuerBase}" is unreachable and no fallback authorize endpoint is known for it. Make discovery reachable (enable CORS) or pass authUrl.`
+  );
+}
+var cache = /* @__PURE__ */ new Map();
+function fetchDiscovery(issuer) {
+  const base = issuer.replace(/\/$/, "");
+  let pending = cache.get(base);
+  if (!pending) {
+    pending = fetch(`${base}/.well-known/openid-configuration`).then((res) => {
+      if (!res.ok) throw new Error(`oidc discovery failed: ${res.status}`);
+      return res.json();
+    });
+    pending.catch(() => cache.delete(base));
+    cache.set(base, pending);
+  }
+  return pending;
+}
+async function getAuthorizationEndpoint(issuer) {
+  const base = issuer.replace(/\/$/, "");
+  try {
+    const doc = await fetchDiscovery(base);
+    if (doc.authorization_endpoint) return doc.authorization_endpoint;
+  } catch {
+  }
+  return fallbackAuthorizationEndpoint(base);
+}
+
+// src/internal/modal-iframe.ts
+function openModalIframe(opts) {
+  const overlay = document.createElement("div");
+  overlay.dataset.cimplifyModal = "1";
+  Object.assign(overlay.style, {
+    position: "fixed",
+    inset: "0",
+    background: "rgba(15, 18, 24, 0.55)",
+    zIndex: "2147483647",
+    display: "grid",
+    placeItems: "center",
+    backdropFilter: "blur(2px)"
+  });
+  const card = document.createElement("div");
+  Object.assign(card.style, {
+    width: `${opts.width ?? 480}px`,
+    maxWidth: "calc(100vw - 24px)",
+    height: `${opts.height ?? 720}px`,
+    maxHeight: "calc(100vh - 32px)"
+  });
+  const iframe = document.createElement("iframe");
+  iframe.src = opts.src;
+  iframe.style.width = "100%";
+  iframe.style.height = "100%";
+  iframe.style.border = "none";
+  iframe.style.background = "transparent";
+  iframe.setAttribute(
+    "sandbox",
+    opts.sandbox ?? "allow-scripts allow-same-origin allow-forms allow-popups"
+  );
+  iframe.setAttribute("allow", "publickey-credentials-get; publickey-credentials-create");
+  card.appendChild(iframe);
+  overlay.appendChild(card);
+  document.body.appendChild(overlay);
+  const close = () => {
+    overlay.remove();
+    document.removeEventListener("keydown", onKey);
+    opts.onClose?.();
+  };
+  const onKey = (e) => {
+    if (e.key === "Escape") close();
+  };
+  overlay.addEventListener("click", (e) => {
+    if (e.target === overlay) close();
+  });
+  document.addEventListener("keydown", onKey);
+  return { iframe, close };
+}
+
+// src/sign-in.ts
+var DEFAULT_SCOPE = "openid email phone profile";
+var DEFAULT_SILENT_TIMEOUT_MS = 900;
+var RESPONSE_TYPE_CODE = "code";
+var RESPONSE_MODE_WEB_MESSAGE = "web_message";
+var RESPONSE_MODE_QUERY = "query";
+var PROMPT_NONE = "none";
+var AUTHORIZATION_RESPONSE_MESSAGE_TYPE = "authorization_response";
+var ERROR_STATE_MISMATCH = "state_mismatch";
+var ERROR_CALLBACK_FAILED = "callback_failed";
+var ERROR_CALLBACK_EXCEPTION = "callback_exception";
+var ERROR_CANCELLED = "cancelled";
+var ERROR_LOGIN_REQUIRED = "login_required";
+var ERROR_CONSENT_REQUIRED = "consent_required";
+var ERROR_INTERACTION_REQUIRED = "interaction_required";
+var INTERACTIVE_AUTH_ERRORS = /* @__PURE__ */ new Set([
+  ERROR_LOGIN_REQUIRED,
+  ERROR_CONSENT_REQUIRED,
+  ERROR_INTERACTION_REQUIRED
+]);
+function buildAuthorizeUrl(opts, authorizeEndpoint, pkce, state, urlOpts) {
+  const params = new URLSearchParams({
+    response_type: RESPONSE_TYPE_CODE,
+    response_mode: urlOpts.responseMode,
+    client_id: opts.clientId,
+    redirect_uri: opts.redirectUri,
+    scope: opts.scope ?? DEFAULT_SCOPE,
+    state,
+    code_challenge: pkce.challenge,
+    code_challenge_method: pkce.method
+  });
+  if (opts.loginHint) params.set("login_hint", opts.loginHint);
+  if (urlOpts.prompt) params.set("prompt", urlOpts.prompt);
+  if (opts.uiMode) params.set("ui_mode", opts.uiMode);
+  return `${authorizeEndpoint}?${params.toString()}`;
+}
+async function exchangeAuthorizationCode(callbackUri, pkce, state, code) {
+  const res = await fetch(callbackUri, {
+    method: "POST",
+    credentials: "include",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ code, codeVerifier: pkce.verifier, state })
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw { error: ERROR_CALLBACK_FAILED, description: body };
+  }
+  const payload = await res.json().catch(() => ({}));
+  return {
+    accessToken: payload.accessToken ?? payload.access_token,
+    expiresIn: payload.expiresIn ?? payload.expires_in,
+    scope: payload.scope
+  };
+}
+async function trySilentModalSignIn(opts, authorizeEndpoint, callbackUri, pkce, state) {
+  const expectedOrigin = new URL(authorizeEndpoint).origin;
+  const iframe = document.createElement("iframe");
+  iframe.style.display = "none";
+  iframe.setAttribute("aria-hidden", "true");
+  iframe.setAttribute("sandbox", "allow-scripts allow-same-origin");
+  iframe.src = buildAuthorizeUrl(opts, authorizeEndpoint, pkce, state, {
+    responseMode: RESPONSE_MODE_WEB_MESSAGE,
+    prompt: PROMPT_NONE
+  });
+  return new Promise((resolve) => {
+    let settled = false;
+    let handler = () => {
+    };
+    const timeout = setTimeout(() => finish(false), opts.silentTimeoutMs ?? DEFAULT_SILENT_TIMEOUT_MS);
+    const cleanup = () => {
+      window.removeEventListener("message", handler);
+      iframe.remove();
+      clearTimeout(timeout);
+    };
+    const finish = (handled) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve(handled);
+    };
+    handler = async (event) => {
+      if (event.origin !== expectedOrigin) return;
+      const data = event.data;
+      if (!data || typeof data !== "object" || data.type !== AUTHORIZATION_RESPONSE_MESSAGE_TYPE) return;
+      const response = data.response;
+      if (response.error) {
+        if (INTERACTIVE_AUTH_ERRORS.has(response.error)) {
+          finish(false);
+          return;
+        }
+        opts.onError?.({ error: response.error, description: response.error_description });
+        finish(true);
+        return;
+      }
+      if (!response.code) return;
+      if (response.state !== state) {
+        opts.onError?.({ error: ERROR_STATE_MISMATCH });
+        finish(true);
+        return;
+      }
+      try {
+        opts.onSuccess?.(await exchangeAuthorizationCode(callbackUri, pkce, state, response.code));
+      } catch (e) {
+        const err2 = e;
+        opts.onError?.({
+          error: err2.error ?? ERROR_CALLBACK_EXCEPTION,
+          description: err2.description ?? String(e)
+        });
+      }
+      finish(true);
+    };
+    window.addEventListener("message", handler);
+    document.body.appendChild(iframe);
+  });
+}
+function resolveAuthorizeEndpoint(opts) {
+  if (opts.authUrl) {
+    return Promise.resolve(`${opts.authUrl.replace(/\/$/, "")}/oauth/authorize`);
+  }
+  return getAuthorizationEndpoint(opts.issuer ?? DEFAULT_ISSUER);
+}
+async function startSignIn(opts) {
+  const callbackUri = opts.callbackUri ?? "/auth/callback";
+  const pkce = await generatePkce();
+  const state = generateState();
+  const authorizeEndpoint = await resolveAuthorizeEndpoint(opts);
+  if ((opts.mode ?? "redirect") === "redirect") {
+    startRedirectSignIn(opts, authorizeEndpoint, pkce, state);
+    return;
+  }
+  if (opts.silentFirst && !opts.prompt) {
+    const handledSilently = await trySilentModalSignIn(opts, authorizeEndpoint, callbackUri, pkce, state);
+    if (handledSilently) {
+      return;
+    }
+  }
+  const src = buildAuthorizeUrl(opts, authorizeEndpoint, pkce, state, {
+    responseMode: RESPONSE_MODE_WEB_MESSAGE,
+    prompt: opts.prompt
+  });
+  const expectedOrigin = new URL(authorizeEndpoint).origin;
+  let completed = false;
+  let handler = () => {
+  };
+  const modal = openModalIframe({
+    src,
+    onClose: () => {
+      window.removeEventListener("message", handler);
+      if (!completed) {
+        opts.onError?.({ error: ERROR_CANCELLED });
+      }
+    }
+  });
+  handler = async (event) => {
+    if (event.origin !== expectedOrigin) return;
+    const data = event.data;
+    if (!data || typeof data !== "object" || data.type !== AUTHORIZATION_RESPONSE_MESSAGE_TYPE) return;
+    const response = data.response;
+    if (response.error) {
+      completed = true;
+      modal.close();
+      opts.onError?.({ error: response.error, description: response.error_description });
+      return;
+    }
+    if (!response.code) return;
+    if (response.state !== state) {
+      completed = true;
+      modal.close();
+      opts.onError?.({ error: ERROR_STATE_MISMATCH });
+      return;
+    }
+    try {
+      const result = await exchangeAuthorizationCode(callbackUri, pkce, state, response.code);
+      completed = true;
+      modal.close();
+      opts.onSuccess?.(result);
+    } catch (e) {
+      const err2 = e;
+      completed = true;
+      opts.onError?.({
+        error: err2.error ?? ERROR_CALLBACK_EXCEPTION,
+        description: err2.description ?? String(e)
+      });
+      modal.close();
+    }
+  };
+  window.addEventListener("message", handler);
+}
+function startRedirectSignIn(opts, authorizeEndpoint, pkce, state) {
+  const returnTo = opts.returnTo ?? window.location.pathname + window.location.search;
+  const cookieValue = encodePkceState({ verifier: pkce.verifier, state, returnTo });
+  const secure = window.location.protocol === "https:" ? "; Secure" : "";
+  document.cookie = `${PKCE_COOKIE}=${cookieValue}; Path=${PKCE_COOKIE_PATH}; Max-Age=${PKCE_COOKIE_MAX_AGE_SECONDS}; SameSite=Lax${secure}`;
+  window.location.assign(buildAuthorizeUrl(opts, authorizeEndpoint, pkce, state, {
+    responseMode: RESPONSE_MODE_QUERY,
+    prompt: opts.prompt
+  }));
+}
+
 // src/elements.ts
 function toCheckoutError(code, message, recoverable) {
   const hint = chunkXA3ZNR75_js.getErrorHint(code);
@@ -2288,12 +2629,36 @@ function toCheckoutError(code, message, recoverable) {
   };
 }
 var DEFAULT_LINK_URL = "https://link.cimplify.io";
+var AUTH_CONTACT_TYPES = new Set(Object.values(ELEMENTS_AUTH_CONTACT_TYPES));
+var AUTH_MODES = new Set(Object.values(ELEMENTS_AUTH_MODES));
+var AUTH_PROMPTS = new Set(Object.values(ELEMENTS_AUTH_PROMPTS));
 function generateNonce() {
   if (typeof crypto !== "undefined" && crypto.randomUUID) {
     return crypto.randomUUID().replace(/-/g, "").slice(0, 16);
   }
   return Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2);
 }
+function readPublicEnv(name) {
+  try {
+    const processLike = globalThis.process;
+    const value = processLike?.env?.[name];
+    return value && value.trim() ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function decodeJwtSub(token) {
+  const [, payload] = token.split(".");
+  if (!payload || typeof atob === "undefined") return "";
+  try {
+    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
+    const parsed = JSON.parse(atob(padded));
+    return typeof parsed.sub === "string" ? parsed.sub : "";
+  } catch {
+    return "";
+  }
+}
 function isAllowedOrigin(origin) {
   try {
     const url = new URL(origin);
@@ -2309,7 +2674,21 @@ function isAllowedOrigin(origin) {
     return false;
   }
 }
-var KNOWN_IFRAME_TYPES = new Set(Object.values(MESSAGE_TYPES));
+var KNOWN_IFRAME_TYPES = /* @__PURE__ */ new Set([
+  MESSAGE_TYPES.READY,
+  MESSAGE_TYPES.HEIGHT_CHANGE,
+  MESSAGE_TYPES.AUTH_REQUESTED,
+  MESSAGE_TYPES.ERROR,
+  MESSAGE_TYPES.ADDRESS_CHANGED,
+  MESSAGE_TYPES.ADDRESS_SELECTED,
+  MESSAGE_TYPES.PAYMENT_METHOD_SELECTED,
+  MESSAGE_TYPES.CONTACT_PROVIDED,
+  MESSAGE_TYPES.LOGOUT_COMPLETE,
+  MESSAGE_TYPES.CHECKOUT_STATUS,
+  MESSAGE_TYPES.CHECKOUT_COMPLETE,
+  MESSAGE_TYPES.ORDER_TYPE_CHANGED,
+  MESSAGE_TYPES.REQUEST_SUBMIT
+]);
 function parseIframeMessage(data) {
   if (!data || typeof data !== "object") {
     return null;
@@ -2319,11 +2698,17 @@ function parseIframeMessage(data) {
     return null;
   }
   switch (record.type) {
-    case MESSAGE_TYPES.AUTHENTICATED:
-      if (typeof record.token !== "string") return null;
-      break;
-    case MESSAGE_TYPES.TOKEN_REFRESHED:
-      if (typeof record.token !== "string") return null;
+    case MESSAGE_TYPES.AUTH_REQUESTED:
+      if (record.loginHint !== void 0 && typeof record.loginHint !== "string") return null;
+      if (record.contactType !== void 0 && (typeof record.contactType !== "string" || !AUTH_CONTACT_TYPES.has(record.contactType))) {
+        return null;
+      }
+      if (record.mode !== void 0 && (typeof record.mode !== "string" || !AUTH_MODES.has(record.mode))) {
+        return null;
+      }
+      if (record.prompt !== void 0 && (typeof record.prompt !== "string" || !AUTH_PROMPTS.has(record.prompt))) {
+        return null;
+      }
       break;
     case MESSAGE_TYPES.ADDRESS_CHANGED:
     case MESSAGE_TYPES.ADDRESS_SELECTED:
@@ -2341,13 +2726,13 @@ function parseIframeMessage(data) {
     case MESSAGE_TYPES.CHECKOUT_COMPLETE:
       if (typeof record.success !== "boolean") return null;
       break;
+    case MESSAGE_TYPES.CHECKOUT_STATUS:
+      if (typeof record.status !== "string" || !record.context || typeof record.context !== "object") return null;
+      break;
     case MESSAGE_TYPES.READY:
     case MESSAGE_TYPES.HEIGHT_CHANGE:
       if (typeof record.height !== "number") return null;
       break;
-    case MESSAGE_TYPES.REQUIRES_OTP:
-      if (typeof record.contactMasked !== "string") return null;
-      break;
     case MESSAGE_TYPES.ORDER_TYPE_CHANGED:
       if (typeof record.orderType !== "string") return null;
       break;
@@ -2364,6 +2749,7 @@ var CimplifyElements = class {
     this.addressData = null;
     this.paymentData = null;
     this.checkoutInProgress = false;
+    this.authInProgress = false;
     this.activeCheckoutAbort = null;
     this.businessIdResolvePromise = null;
     this.client = client;
@@ -2522,7 +2908,6 @@ var CimplifyElements = class {
         customer_id: this.customerId ?? void 0
       };
       const timeoutMs = options.timeout_ms ?? 18e4;
-      const paymentWindow = checkoutElement.getContentWindow();
       return new Promise((resolve) => {
         let settled = false;
         const cleanup = () => {
@@ -2558,18 +2943,7 @@ var CimplifyElements = class {
           if (!message) {
             return;
           }
-          if (message.type === MESSAGE_TYPES.LOGOUT_COMPLETE) {
-            checkoutElement.sendMessage({ type: MESSAGE_TYPES.ABORT_CHECKOUT });
-            settle(
-              toCheckoutError(
-                "AUTH_LOST",
-                "Authentication was cleared during checkout.",
-                true
-              )
-            );
-            return;
-          }
-          if (paymentWindow && event.source && event.source !== paymentWindow) {
+          if (!checkoutElement._acceptsMessageEvent(event, message)) {
             return;
           }
           if (message.type === MESSAGE_TYPES.CHECKOUT_STATUS) {
@@ -2585,6 +2959,16 @@ var CimplifyElements = class {
               enrolled_in_link: message.enrolled_in_link
             });
           }
+          if (message.type === MESSAGE_TYPES.LOGOUT_COMPLETE) {
+            checkoutElement.sendMessage({ type: MESSAGE_TYPES.ABORT_CHECKOUT });
+            settle(
+              toCheckoutError(
+                "AUTH_LOST",
+                "Authentication was cleared during checkout.",
+                true
+              )
+            );
+          }
         };
         if (typeof window !== "undefined") {
           window.addEventListener("message", handleCheckoutMessage);
@@ -2644,12 +3028,7 @@ var CimplifyElements = class {
     return this.options.appearance;
   }
   async hydrateCustomerData() {
-    if (!this.accessToken || this.customerData) {
-      return;
-    }
-    if (!this.client.getAccessToken()) {
-      this.client.setAccessToken(this.accessToken);
-    }
+    if (!this.accessToken || this.customerData) return;
     const linkDataResult = await this.client.link.getLinkData();
     if (!linkDataResult.ok || !linkDataResult.value?.customer) {
       return;
@@ -2660,6 +3039,85 @@ var CimplifyElements = class {
       email: customer.email || null,
       phone: customer.phone || null
     };
+    this.customerId = customer.id;
+  }
+  sourceElementFor(event, message) {
+    for (const element of this.elements.values()) {
+      if (element._acceptsMessageEvent(event, message)) {
+        return element;
+      }
+    }
+    return null;
+  }
+  async applyAccessToken(token) {
+    this.accessToken = token;
+    this.accountId = decodeJwtSub(token);
+    this.client.setAccessToken(token);
+    await this.hydrateCustomerData();
+    return {
+      accountId: this.accountId ?? "",
+      customerId: this.customerId ?? "",
+      token,
+      customer: this.customerData ?? { name: "", email: null, phone: null }
+    };
+  }
+  broadcastAccessToken(token) {
+    this.elements.forEach((element) => {
+      element.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
+    });
+  }
+  startEmbeddedAuth(sourceElement, request) {
+    if (this.authInProgress) return;
+    const auth = this.options.auth ?? {};
+    const clientId = auth.clientId ?? readPublicEnv("NEXT_PUBLIC_CIMPLIFY_CLIENT_ID");
+    const redirectUri = auth.redirectUri ?? readPublicEnv("NEXT_PUBLIC_CIMPLIFY_REDIRECT_URI");
+    if (!clientId || !redirectUri) {
+      sourceElement._emitError({
+        code: "AUTH_CONFIG_REQUIRED",
+        message: "Cimplify OAuth clientId and redirectUri are required."
+      });
+      return;
+    }
+    this.authInProgress = true;
+    void startSignIn({
+      clientId,
+      redirectUri,
+      callbackUri: auth.callbackUri,
+      scope: auth.scope,
+      issuer: auth.issuer,
+      authUrl: auth.authUrl,
+      loginHint: request.loginHint,
+      prompt: request.prompt,
+      uiMode: request.mode,
+      mode: "modal",
+      silentFirst: request.mode === ELEMENTS_AUTH_MODES.CHECKOUT && request.prompt !== ELEMENTS_AUTH_PROMPTS.LOGIN,
+      onSuccess: async ({ accessToken }) => {
+        this.authInProgress = false;
+        if (!accessToken) {
+          sourceElement._emitError({
+            code: "AUTH_CALLBACK_MISSING_TOKEN",
+            message: "Sign-in callback did not return an access token."
+          });
+          return;
+        }
+        const data = await this.applyAccessToken(accessToken);
+        this.broadcastAccessToken(accessToken);
+        sourceElement._emitAuthenticated(data);
+      },
+      onError: (err2) => {
+        this.authInProgress = false;
+        sourceElement._emitError({
+          code: err2.error,
+          message: err2.description ?? err2.error
+        });
+      }
+    }).catch((error) => {
+      this.authInProgress = false;
+      sourceElement._emitError({
+        code: "AUTH_START_FAILED",
+        message: error instanceof Error ? error.message : "Unable to start sign-in."
+      });
+    });
   }
   handleMessage(event) {
     if (!isAllowedOrigin(event.origin)) {
@@ -2667,26 +3125,11 @@ var CimplifyElements = class {
     }
     const message = parseIframeMessage(event.data);
     if (!message) return;
+    const sourceElement = this.sourceElementFor(event, message);
+    if (!sourceElement) return;
     switch (message.type) {
-      case MESSAGE_TYPES.AUTHENTICATED:
-        const customer = message.customer ?? {
-          name: "",
-          email: null,
-          phone: null
-        };
-        this.accessToken = message.token;
-        this.accountId = message.accountId;
-        this.customerId = message.customerId;
-        this.customerData = customer;
-        this.client.setAccessToken(message.token);
-        this.elements.forEach((element, type) => {
-          if (type !== ELEMENT_TYPES.AUTH && type !== ELEMENT_TYPES.CHECKOUT) {
-            element.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token: message.token });
-          }
-        });
-        break;
-      case MESSAGE_TYPES.TOKEN_REFRESHED:
-        this.accessToken = message.token;
+      case MESSAGE_TYPES.AUTH_REQUESTED:
+        this.startEmbeddedAuth(sourceElement, message);
         break;
       case MESSAGE_TYPES.ADDRESS_CHANGED:
       case MESSAGE_TYPES.ADDRESS_SELECTED:
@@ -2856,6 +3299,17 @@ var CimplifyElement = class {
   isMounted() {
     return this.mounted && Boolean(this.iframe) && this.iframe?.isConnected === true;
   }
+  _acceptsMessageEvent(event, message) {
+    const iframeWindow = this.iframe?.contentWindow;
+    if (!iframeWindow || event.source !== iframeWindow) return false;
+    return message.nonce === this.nonce;
+  }
+  _emitAuthenticated(data) {
+    this.emit(EVENT_TYPES.AUTHENTICATED, data);
+  }
+  _emitError(error) {
+    this.emit(EVENT_TYPES.ERROR, error);
+  }
   async createIframe() {
     if (!this.container) return;
     const resolvedBusinessId = this.businessId ?? await this.parent.resolveBusinessId();
@@ -2899,17 +3353,9 @@ var CimplifyElement = class {
     if (!isAllowedOrigin(event.origin)) {
       return;
     }
-    const data = event.data;
-    if (data?.nonce) {
-      if (data.nonce !== this.nonce) return;
-    } else {
-      const iframeWindow = this.iframe?.contentWindow;
-      if (iframeWindow && event.source && event.source !== iframeWindow) {
-        return;
-      }
-    }
     const message = parseIframeMessage(event.data);
     if (!message) return;
+    if (!this._acceptsMessageEvent(event, message)) return;
     switch (message.type) {
       case MESSAGE_TYPES.READY:
         this.ready = true;
@@ -2928,7 +3374,7 @@ var CimplifyElement = class {
             submitLabel: this.options.submitLabel
           });
           const token = this.parent.getAccessToken();
-          if (token && this.type !== ELEMENT_TYPES.AUTH) {
+          if (token) {
             this.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
           }
           this.pendingInit = null;
@@ -2939,22 +3385,6 @@ var CimplifyElement = class {
       case MESSAGE_TYPES.HEIGHT_CHANGE:
         if (this.iframe) this.iframe.style.height = `${message.height}px`;
         break;
-      case MESSAGE_TYPES.AUTHENTICATED:
-        const customer = message.customer ?? {
-          name: "",
-          email: null,
-          phone: null
-        };
-        this.emit(EVENT_TYPES.AUTHENTICATED, {
-          accountId: message.accountId,
-          customerId: message.customerId,
-          token: message.token,
-          customer
-        });
-        break;
-      case MESSAGE_TYPES.REQUIRES_OTP:
-        this.emit(EVENT_TYPES.REQUIRES_OTP, { contactMasked: message.contactMasked });
-        break;
       case MESSAGE_TYPES.ERROR:
         this.emit(EVENT_TYPES.ERROR, { code: message.code, message: message.message });
         break;
@@ -3010,7 +3440,11 @@ exports.CimplifyElement = CimplifyElement;
 exports.CimplifyElements = CimplifyElements;
 exports.DEFAULT_COUNTRY = DEFAULT_COUNTRY;
 exports.DEFAULT_CURRENCY = DEFAULT_CURRENCY;
+exports.DEFAULT_ISSUER = DEFAULT_ISSUER;
 exports.DEVICE_TYPE = DEVICE_TYPE;
+exports.ELEMENTS_AUTH_CONTACT_TYPES = ELEMENTS_AUTH_CONTACT_TYPES;
+exports.ELEMENTS_AUTH_MODES = ELEMENTS_AUTH_MODES;
+exports.ELEMENTS_AUTH_PROMPTS = ELEMENTS_AUTH_PROMPTS;
 exports.ELEMENT_TYPES = ELEMENT_TYPES;
 exports.EVENT_TYPES = EVENT_TYPES;
 exports.FxService = FxService;
@@ -3028,14 +3462,20 @@ exports.PAYMENT_METHOD = PAYMENT_METHOD;
 exports.PAYMENT_MUTATION = PAYMENT_MUTATION;
 exports.PAYMENT_STATE = PAYMENT_STATE;
 exports.PICKUP_TIME_TYPE = PICKUP_TIME_TYPE;
+exports.PKCE_COOKIE = PKCE_COOKIE;
+exports.PKCE_COOKIE_PATH = PKCE_COOKIE_PATH;
 exports.SchedulingService = SchedulingService;
 exports.combine = combine;
 exports.combineObject = combineObject;
 exports.createElements = createElements;
+exports.decodePkceState = decodePkceState;
 exports.err = err;
 exports.flatMap = flatMap;
 exports.fromPromise = fromPromise;
 exports.generateIdempotencyKey = generateIdempotencyKey;
+exports.generatePkce = generatePkce;
+exports.generateState = generateState;
+exports.getAuthorizationEndpoint = getAuthorizationEndpoint;
 exports.getOrElse = getOrElse;
 exports.isErr = isErr;
 exports.isOk = isOk;
@@ -3043,6 +3483,7 @@ exports.mapError = mapError;
 exports.mapResult = mapResult;
 exports.ok = ok;
 exports.safe = safe;
+exports.startSignIn = startSignIn;
 exports.toNullable = toNullable;
 exports.tryCatch = tryCatch;
 exports.unwrap = unwrap;