@fanvue/builder-sdk 0.3.0 → 0.4.0

package/dist/{core-CvVOMyqr.js → schemas-DbyHF7Xi.js}

@@ -1,40 +1,6 @@
 //#region \0rolldown/runtime.js
 var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 //#endregion
-//#region src/core/constants.ts
-/** The `Bearer ` token prefix (includes trailing space). */
-const BEARER_PREFIX = "Bearer ";
-/** Response header carrying a refreshed session JWT back to the client. */
-const HEADER_UPDATED_SESSION = "X-Updated-Session";
-//#endregion
-//#region src/core/defaults.ts
-/** Default OAuth scopes requested during authorization. */
-const DEFAULT_SCOPES = "openid offline_access offline";
-/** Default OAuth issuer URL for Fanvue authentication. */
-const DEFAULT_ISSUER_URL = "https://auth.fanvue.com";
-/** Default base URL for the Fanvue API. */
-const DEFAULT_API_BASE_URL = "https://api.fanvue.com";
-/** Default base URL for the Fanvue platform (embedded authorize-on-behalf). */
-const DEFAULT_PLATFORM_URL = "https://www.fanvue.com";
-/** The Fanvue API version header value sent with every request. */
-const API_VERSION = "2025-06-26";
-/**
-* Validates that a URL belongs to the `fanvue.com` domain.
-*
-* @param url - The URL string to validate.
-* @throws If the URL is malformed or its hostname is not `fanvue.com`
-*   (or a subdomain of it).
-*/
-function assertFanvueDomain(url) {
-	let hostname;
-	try {
-		hostname = new URL(url).hostname;
-	} catch {
-		throw new Error(`Invalid apiBaseUrl: "${url}" is not a valid URL.`);
-	}
-	if (hostname !== "fanvue.com" && !hostname.endsWith(".fanvue.com")) throw new Error(`Invalid apiBaseUrl: "${url}" must be a fanvue.com domain (e.g. https://api.fanvue.com).`);
-}
-//#endregion
 //#region node_modules/.pnpm/neverthrow@8.2.0/node_modules/neverthrow/dist/index.cjs.js
 var require_index_cjs = /* @__PURE__ */ __commonJSMin(((exports) => {
 	const defaultErrorConfig = { withStackTrace: false };
@@ -521,126 +487,6 @@ var require_index_cjs = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.okAsync = okAsync;
 	exports.safeTry = safeTry;
 }));
-if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 "));
-const ERR_INVALID_ARG_VALUE = "ERR_INVALID_ARG_VALUE";
-const ERR_INVALID_ARG_TYPE = "ERR_INVALID_ARG_TYPE";
-function CodedTypeError(message, code, cause) {
-	const err = new TypeError(message, { cause });
-	Object.assign(err, { code });
-	return err;
-}
-const encoder$1 = new TextEncoder();
-const decoder$1 = new TextDecoder();
-function buf(input) {
-	if (typeof input === "string") return encoder$1.encode(input);
-	return decoder$1.decode(input);
-}
-let encodeBase64Url;
-if (Uint8Array.prototype.toBase64) encodeBase64Url = (input) => {
-	if (input instanceof ArrayBuffer) input = new Uint8Array(input);
-	return input.toBase64({
-		alphabet: "base64url",
-		omitPadding: true
-	});
-};
-else {
-	const CHUNK_SIZE = 32768;
-	encodeBase64Url = (input) => {
-		if (input instanceof ArrayBuffer) input = new Uint8Array(input);
-		const arr = [];
-		for (let i = 0; i < input.byteLength; i += CHUNK_SIZE) arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-		return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
-	};
-}
-let decodeBase64Url;
-if (Uint8Array.fromBase64) decodeBase64Url = (input) => {
-	try {
-		return Uint8Array.fromBase64(input, { alphabet: "base64url" });
-	} catch (cause) {
-		throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
-	}
-};
-else decodeBase64Url = (input) => {
-	try {
-		const binary = atob(input.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, ""));
-		const bytes = new Uint8Array(binary.length);
-		for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-		return bytes;
-	} catch (cause) {
-		throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
-	}
-};
-function b64u(input) {
-	if (typeof input === "string") return decodeBase64Url(input);
-	return encodeBase64Url(input);
-}
-var OperationProcessingError = class extends Error {
-	code;
-	constructor(message, options) {
-		super(message, options);
-		this.name = this.constructor.name;
-		if (options?.code) this.code = options?.code;
-		Error.captureStackTrace?.(this, this.constructor);
-	}
-};
-function OPE(message, code, cause) {
-	return new OperationProcessingError(message, {
-		code,
-		cause
-	});
-}
-function assertString(input, it, code, cause) {
-	try {
-		if (typeof input !== "string") throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);
-		if (input.length === 0) throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);
-	} catch (err) {
-		if (code) throw OPE(err.message, code, cause);
-		throw err;
-	}
-}
-function randomBytes() {
-	return b64u(crypto.getRandomValues(new Uint8Array(32)));
-}
-function generateRandomCodeVerifier() {
-	return randomBytes();
-}
-function generateRandomState() {
-	return randomBytes();
-}
-async function calculatePKCECodeChallenge(codeVerifier) {
-	assertString(codeVerifier, "codeVerifier");
-	return b64u(await crypto.subtle.digest("SHA-256", buf(codeVerifier)));
-}
-URL.parse;
-const tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
-const token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
-const quotedParamMatcher = "(" + tokenMatch + ")\\s*=\\s*\"((?:[^\"\\\\]|\\\\[\\s\\S])*)\"";
-const paramMatcher = "(" + tokenMatch + ")\\s*=\\s*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)";
-new RegExp("^[,\\s]*(" + tokenMatch + ")");
-new RegExp("^[,\\s]*" + quotedParamMatcher + "[,\\s]*(.*)");
-new RegExp("^[,\\s]*" + paramMatcher + "[,\\s]*(.*)");
-new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
-//#endregion
-//#region src/core/json.ts
-var import_index_cjs = require_index_cjs();
-const ERROR_RAW_TEXT_MAX_LENGTH = 500;
-/**
-* Safely parses a JSON string, returning a `Result` instead of throwing.
-*
-* @param text - The raw text to parse as JSON.
-* @returns `ok(parsed)` on success, or `err({ code, rawText, message })` on failure.
-*/
-function safeJsonParse(text) {
-	try {
-		return (0, import_index_cjs.ok)(JSON.parse(text));
-	} catch (e) {
-		return (0, import_index_cjs.err)({
-			code: "JSON_PARSE_ERROR",
-			rawText: text.length > ERROR_RAW_TEXT_MAX_LENGTH ? text.slice(0, ERROR_RAW_TEXT_MAX_LENGTH) + "..." : text,
-			message: e instanceof Error ? e.message : "Failed to parse JSON"
-		});
-	}
-}
 Object.freeze({ status: "aborted" });
 function $constructor(name, initializer, params) {
 	function init(inst, def) {
@@ -777,7 +623,7 @@ function slugify(input) {
 	return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
 }
 const captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};
-function isObject$1(data) {
+function isObject(data) {
 	return typeof data === "object" && data !== null && !Array.isArray(data);
 }
 const allowsEval = cached(() => {
@@ -790,12 +636,12 @@ const allowsEval = cached(() => {
 	}
 });
 function isPlainObject(o) {
-	if (isObject$1(o) === false) return false;
+	if (isObject(o) === false) return false;
 	const ctor = o.constructor;
 	if (ctor === void 0) return true;
 	if (typeof ctor !== "function") return true;
 	const prot = ctor.prototype;
-	if (isObject$1(prot) === false) return false;
+	if (isObject(prot) === false) return false;
 	if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) return false;
 	return true;
 }
@@ -1067,6 +913,59 @@ function formatError(error, mapper = (issue) => issue.message) {
 	processError(error);
 	return fieldErrors;
 }
+/** Format a ZodError as a human-readable string in the following form.
+*
+* From
+*
+* ```ts
+* ZodError {
+*   issues: [
+*     {
+*       expected: 'string',
+*       code: 'invalid_type',
+*       path: [ 'username' ],
+*       message: 'Invalid input: expected string'
+*     },
+*     {
+*       expected: 'number',
+*       code: 'invalid_type',
+*       path: [ 'favoriteNumbers', 1 ],
+*       message: 'Invalid input: expected number'
+*     }
+*   ];
+* }
+* ```
+*
+* to
+*
+* ```
+* username
+*   ✖ Expected number, received string at "username
+* favoriteNumbers[0]
+*   ✖ Invalid input: expected number
+* ```
+*/
+function toDotPath(_path) {
+	const segs = [];
+	const path = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+	for (const seg of path) if (typeof seg === "number") segs.push(`[${seg}]`);
+	else if (typeof seg === "symbol") segs.push(`[${JSON.stringify(String(seg))}]`);
+	else if (/[^\w$]/.test(seg)) segs.push(`[${JSON.stringify(seg)}]`);
+	else {
+		if (segs.length) segs.push(".");
+		segs.push(seg);
+	}
+	return segs.join("");
+}
+function prettifyError(error) {
+	const lines = [];
+	const issues = [...error.issues].sort((a, b) => (a.path ?? []).length - (b.path ?? []).length);
+	for (const issue of issues) {
+		lines.push(`✖ ${issue.message}`);
+		if (issue.path?.length) lines.push(`  → at ${toDotPath(issue.path)}`);
+	}
+	return lines.join("\n");
+}
 //#endregion
 //#region node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/parse.js
 const _parse = (_Err) => (schema, value, _ctx, _params) => {
@@ -2130,13 +2029,13 @@ const $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
 		}
 		return propValues;
 	});
-	const isObject = isObject$1;
+	const isObject$2 = isObject;
 	const catchall = def.catchall;
 	let value;
 	inst._zod.parse = (payload, ctx) => {
 		value ?? (value = _normalized.value);
 		const input = payload.value;
-		if (!isObject(input)) {
+		if (!isObject$2(input)) {
 			payload.issues.push({
 				expected: "object",
 				code: "invalid_type",
@@ -2230,7 +2129,7 @@ const $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def)
 		return (payload, ctx) => fn(shape, payload, ctx);
 	};
 	let fastpass;
-	const isObject = isObject$1;
+	const isObject$1 = isObject;
 	const jit = !globalConfig.jitless;
 	const fastEnabled = jit && allowsEval.value;
 	const catchall = def.catchall;
@@ -2238,7 +2137,7 @@ const $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def)
 	inst._zod.parse = (payload, ctx) => {
 		value ?? (value = _normalized.value);
 		const input = payload.value;
-		if (!isObject(input)) {
+		if (!isObject$1(input)) {
 			payload.issues.push({
 				expected: "object",
 				code: "invalid_type",
@@ -2411,6 +2310,97 @@ function handleIntersectionResults(result, left, right) {
 	result.value = merged.data;
 	return result;
 }
+const $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
+	$ZodType.init(inst, def);
+	inst._zod.parse = (payload, ctx) => {
+		const input = payload.value;
+		if (!isPlainObject(input)) {
+			payload.issues.push({
+				expected: "record",
+				code: "invalid_type",
+				input,
+				inst
+			});
+			return payload;
+		}
+		const proms = [];
+		const values = def.keyType._zod.values;
+		if (values) {
+			payload.value = {};
+			const recordKeys = /* @__PURE__ */ new Set();
+			for (const key of values) if (typeof key === "string" || typeof key === "number" || typeof key === "symbol") {
+				recordKeys.add(typeof key === "number" ? key.toString() : key);
+				const result = def.valueType._zod.run({
+					value: input[key],
+					issues: []
+				}, ctx);
+				if (result instanceof Promise) proms.push(result.then((result) => {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[key] = result.value;
+				}));
+				else {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[key] = result.value;
+				}
+			}
+			let unrecognized;
+			for (const key in input) if (!recordKeys.has(key)) {
+				unrecognized = unrecognized ?? [];
+				unrecognized.push(key);
+			}
+			if (unrecognized && unrecognized.length > 0) payload.issues.push({
+				code: "unrecognized_keys",
+				input,
+				inst,
+				keys: unrecognized
+			});
+		} else {
+			payload.value = {};
+			for (const key of Reflect.ownKeys(input)) {
+				if (key === "__proto__") continue;
+				let keyResult = def.keyType._zod.run({
+					value: key,
+					issues: []
+				}, ctx);
+				if (keyResult instanceof Promise) throw new Error("Async schemas not supported in object keys currently");
+				if (typeof key === "string" && number$1.test(key) && keyResult.issues.length) {
+					const retryResult = def.keyType._zod.run({
+						value: Number(key),
+						issues: []
+					}, ctx);
+					if (retryResult instanceof Promise) throw new Error("Async schemas not supported in object keys currently");
+					if (retryResult.issues.length === 0) keyResult = retryResult;
+				}
+				if (keyResult.issues.length) {
+					if (def.mode === "loose") payload.value[key] = input[key];
+					else payload.issues.push({
+						code: "invalid_key",
+						origin: "record",
+						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
+						input: key,
+						path: [key],
+						inst
+					});
+					continue;
+				}
+				const result = def.valueType._zod.run({
+					value: input[key],
+					issues: []
+				}, ctx);
+				if (result instanceof Promise) proms.push(result.then((result) => {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[keyResult.value] = result.value;
+				}));
+				else {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[keyResult.value] = result.value;
+				}
+			}
+		}
+		if (proms.length) return Promise.all(proms).then(() => payload);
+		return payload;
+	};
+});
 const $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
 	$ZodType.init(inst, def);
 	const values = getEnumValues(def.entries);
@@ -2429,6 +2419,24 @@ const $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
 		return payload;
 	};
 });
+const $ZodLiteral = /* @__PURE__ */ $constructor("$ZodLiteral", (inst, def) => {
+	$ZodType.init(inst, def);
+	if (def.values.length === 0) throw new Error("Cannot create literal schema with no valid values");
+	const values = new Set(def.values);
+	inst._zod.values = values;
+	inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$`);
+	inst._zod.parse = (payload, _ctx) => {
+		const input = payload.value;
+		if (values.has(input)) return payload;
+		payload.issues.push({
+			code: "invalid_value",
+			values: def.values,
+			input,
+			inst
+		});
+		return payload;
+	};
+});
 const $ZodTransform = /* @__PURE__ */ $constructor("$ZodTransform", (inst, def) => {
 	$ZodType.init(inst, def);
 	inst._zod.parse = (payload, ctx) => {
@@ -3551,6 +3559,27 @@ const enumProcessor = (schema, _ctx, json, _params) => {
 	if (values.every((v) => typeof v === "string")) json.type = "string";
 	json.enum = values;
 };
+const literalProcessor = (schema, ctx, json, _params) => {
+	const def = schema._zod.def;
+	const vals = [];
+	for (const val of def.values) if (val === void 0) {
+		if (ctx.unrepresentable === "throw") throw new Error("Literal `undefined` cannot be represented in JSON Schema");
+	} else if (typeof val === "bigint") if (ctx.unrepresentable === "throw") throw new Error("BigInt literals cannot be represented in JSON Schema");
+	else vals.push(Number(val));
+	else vals.push(val);
+	if (vals.length === 0) {} else if (vals.length === 1) {
+		const val = vals[0];
+		json.type = val === null ? "null" : typeof val;
+		if (ctx.target === "draft-04" || ctx.target === "openapi-3.0") json.enum = [val];
+		else json.const = val;
+	} else {
+		if (vals.every((v) => typeof v === "number")) json.type = "number";
+		if (vals.every((v) => typeof v === "string")) json.type = "string";
+		if (vals.every((v) => typeof v === "boolean")) json.type = "boolean";
+		if (vals.every((v) => v === null)) json.type = "null";
+		json.enum = vals;
+	}
+};
 const customProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Custom types cannot be represented in JSON Schema");
 };
@@ -3633,6 +3662,39 @@ const intersectionProcessor = (schema, ctx, json, params) => {
 	const isSimpleIntersection = (val) => "allOf" in val && Object.keys(val).length === 1;
 	json.allOf = [...isSimpleIntersection(a) ? a.allOf : [a], ...isSimpleIntersection(b) ? b.allOf : [b]];
 };
+const recordProcessor = (schema, ctx, _json, params) => {
+	const json = _json;
+	const def = schema._zod.def;
+	json.type = "object";
+	const keyType = def.keyType;
+	const patterns = keyType._zod.bag?.patterns;
+	if (def.mode === "loose" && patterns && patterns.size > 0) {
+		const valueSchema = process(def.valueType, ctx, {
+			...params,
+			path: [
+				...params.path,
+				"patternProperties",
+				"*"
+			]
+		});
+		json.patternProperties = {};
+		for (const pattern of patterns) json.patternProperties[pattern.source] = valueSchema;
+	} else {
+		if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") json.propertyNames = process(def.keyType, ctx, {
+			...params,
+			path: [...params.path, "propertyNames"]
+		});
+		json.additionalProperties = process(def.valueType, ctx, {
+			...params,
+			path: [...params.path, "additionalProperties"]
+		});
+	}
+	const keyValues = keyType._zod.values;
+	if (keyValues) {
+		const validKeyValues = [...keyValues].filter((v) => typeof v === "string" || typeof v === "number");
+		if (validKeyValues.length > 0) json.required = validKeyValues;
+	}
+};
 const nullableProcessor = (schema, ctx, json, params) => {
 	const def = schema._zod.def;
 	const inner = process(def.innerType, ctx, params);
@@ -3754,8 +3816,8 @@ const parse = /* @__PURE__ */ _parse(ZodRealError);
 const parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
 const safeParse = /* @__PURE__ */ _safeParse(ZodRealError);
 const safeParseAsync = /* @__PURE__ */ _safeParseAsync(ZodRealError);
-const encode$2 = /* @__PURE__ */ _encode(ZodRealError);
-const decode$1 = /* @__PURE__ */ _decode(ZodRealError);
+const encode = /* @__PURE__ */ _encode(ZodRealError);
+const decode = /* @__PURE__ */ _decode(ZodRealError);
 const encodeAsync = /* @__PURE__ */ _encodeAsync(ZodRealError);
 const decodeAsync = /* @__PURE__ */ _decodeAsync(ZodRealError);
 const safeEncode = /* @__PURE__ */ _safeEncode(ZodRealError);
@@ -3793,8 +3855,8 @@ const ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
 	inst.parseAsync = async (data, params) => parseAsync(inst, data, params, { callee: inst.parseAsync });
 	inst.safeParseAsync = async (data, params) => safeParseAsync(inst, data, params);
 	inst.spa = inst.safeParseAsync;
-	inst.encode = (data, params) => encode$2(inst, data, params);
-	inst.decode = (data, params) => decode$1(inst, data, params);
+	inst.encode = (data, params) => encode(inst, data, params);
+	inst.decode = (data, params) => decode(inst, data, params);
 	inst.encodeAsync = async (data, params) => encodeAsync(inst, data, params);
 	inst.decodeAsync = async (data, params) => decodeAsync(inst, data, params);
 	inst.safeEncode = (data, params) => safeEncode(inst, data, params);
@@ -4125,6 +4187,21 @@ function intersection(left, right) {
 		right
 	});
 }
+const ZodRecord = /* @__PURE__ */ $constructor("ZodRecord", (inst, def) => {
+	$ZodRecord.init(inst, def);
+	ZodType.init(inst, def);
+	inst._zod.processJSONSchema = (ctx, json, params) => recordProcessor(inst, ctx, json, params);
+	inst.keyType = def.keyType;
+	inst.valueType = def.valueType;
+});
+function record(keyType, valueType, params) {
+	return new ZodRecord({
+		type: "record",
+		keyType,
+		valueType,
+		...normalizeParams(params)
+	});
+}
 const ZodEnum = /* @__PURE__ */ $constructor("ZodEnum", (inst, def) => {
 	$ZodEnum.init(inst, def);
 	ZodType.init(inst, def);
@@ -4162,6 +4239,23 @@ function _enum(values, params) {
 		...normalizeParams(params)
 	});
 }
+const ZodLiteral = /* @__PURE__ */ $constructor("ZodLiteral", (inst, def) => {
+	$ZodLiteral.init(inst, def);
+	ZodType.init(inst, def);
+	inst._zod.processJSONSchema = (ctx, json, params) => literalProcessor(inst, ctx, json, params);
+	inst.values = new Set(def.values);
+	Object.defineProperty(inst, "value", { get() {
+		if (def.values.length > 1) throw new Error("This schema contains multiple valid literal values. Use `.values` instead.");
+		return def.values[0];
+	} });
+});
+function literal(value, params) {
+	return new ZodLiteral({
+		type: "literal",
+		values: Array.isArray(value) ? value : [value],
+		...normalizeParams(params)
+	});
+}
 const ZodTransform = /* @__PURE__ */ $constructor("ZodTransform", (inst, def) => {
 	$ZodTransform.init(inst, def);
 	ZodType.init(inst, def);
@@ -4326,1501 +4420,6 @@ function superRefine(fn) {
 	return /* @__PURE__ */ _superRefine(fn);
 }
 //#endregion
-//#region src/core/schemas.ts
-/** Zod schema for the raw token response from the OAuth token endpoint. */
-const TokenResponseSchema = object({
-	access_token: string(),
-	refresh_token: string().nullable().optional().default(null),
-	expires_in: number(),
-	token_type: string(),
-	scope: string().nullable().optional().default(null),
-	id_token: string().nullable().optional().default(null)
-});
-/** Zod schema for a Fanvue user profile. */
-const FanvueUserSchema = object({
-	uuid: string(),
-	email: string(),
-	handle: string(),
-	displayName: string(),
-	isCreator: boolean(),
-	avatarUrl: string().nullable(),
-	bannerUrl: string().nullable(),
-	createdAt: string(),
-	updatedAt: string().nullable()
-});
-/** Zod schema for the authorize-on-behalf response from the Fanvue platform. */
-const AuthorizeOnBehalfResponseSchema = object({
-	code: string(),
-	state: string()
-});
-/** Zod schema for the session JWT payload. */
-const SessionPayloadSchema = object({
-	accessToken: string(),
-	refreshToken: string().nullable(),
-	expiresAt: number(),
-	tokenType: string().nullable(),
-	scope: string().nullable(),
-	idToken: string().nullable(),
-	userUuid: string(),
-	handle: string(),
-	displayName: string(),
-	isCreator: boolean(),
-	avatarUrl: string().nullable()
-}).passthrough();
-//#endregion
-//#region src/core/oauth.ts
-const CONTENT_TYPE_FORM_URLENCODED = "application/x-www-form-urlencoded";
-const OAUTH_TOKEN_ENDPOINT = "/oauth2/token";
-/**
-* Builds an OAuth 2.0 authorization URL with PKCE parameters.
-*
-* @param config - The OAuth configuration.
-* @param opts - Optional overrides. Pass `state` to use a deterministic state value.
-* @returns The authorization URL, the PKCE code verifier, and the state parameter.
-*/
-async function createAuthorizationUrl(config, opts = null) {
-	const codeVerifier = generateRandomCodeVerifier();
-	const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);
-	const state = opts?.state ?? generateRandomState();
-	const issuerUrl = config.issuerUrl ?? "https://auth.fanvue.com";
-	const scope = config.scopes !== null ? `${DEFAULT_SCOPES} ${config.scopes}`.trim() : DEFAULT_SCOPES;
-	const url = new URL(`${issuerUrl}/oauth2/auth`);
-	url.searchParams.set("response_type", "code");
-	url.searchParams.set("client_id", config.clientId);
-	url.searchParams.set("redirect_uri", config.redirectUri);
-	url.searchParams.set("scope", scope);
-	url.searchParams.set("state", state);
-	url.searchParams.set("code_challenge", codeChallenge);
-	url.searchParams.set("code_challenge_method", "S256");
-	if (config.responseMode !== null) url.searchParams.set("response_mode", config.responseMode);
-	if (config.prompt !== null) url.searchParams.set("prompt", config.prompt);
-	return {
-		url,
-		codeVerifier,
-		state
-	};
-}
-/**
-* Exchanges an authorization code for tokens using the OAuth token endpoint.
-*
-* @param config - The OAuth configuration.
-* @param opts - The authorization code, PKCE code verifier, and optional redirect URI override.
-* @returns A `Result` containing `TokenResponse` on success or `OAuthError` on failure.
-*/
-async function exchangeCodeForToken(config, opts) {
-	const issuerUrl = config.issuerUrl ?? "https://auth.fanvue.com";
-	const body = new URLSearchParams({
-		grant_type: "authorization_code",
-		code: opts.code,
-		redirect_uri: opts.redirectUri ?? config.redirectUri,
-		client_id: config.clientId,
-		code_verifier: opts.codeVerifier
-	});
-	let response;
-	try {
-		response = await fetch(`${issuerUrl}${OAUTH_TOKEN_ENDPOINT}`, {
-			method: "POST",
-			headers: {
-				"Content-Type": CONTENT_TYPE_FORM_URLENCODED,
-				Authorization: `Basic ${btoa(`${config.clientId}:${config.clientSecret}`)}`
-			},
-			body
-		});
-	} catch (error) {
-		return (0, import_index_cjs.err)({
-			code: "TOKEN_EXCHANGE_FAILED",
-			statusCode: 0,
-			message: `Network error during token exchange: ${error instanceof Error ? error.message : String(error)}`
-		});
-	}
-	if (!response.ok) return (0, import_index_cjs.err)({
-		code: "TOKEN_EXCHANGE_FAILED",
-		statusCode: response.status,
-		message: `Token exchange failed: ${response.status} ${response.statusText}`
-	});
-	const parseResult = safeJsonParse(await response.text());
-	if (parseResult.isErr()) {
-		const { rawText, message } = parseResult.error;
-		return (0, import_index_cjs.err)({
-			code: "OAUTH_JSON_PARSE_ERROR",
-			rawText,
-			message
-		});
-	}
-	const validated = TokenResponseSchema.safeParse(parseResult.value);
-	if (!validated.success) return (0, import_index_cjs.err)({
-		code: "OAUTH_VALIDATION_ERROR",
-		message: validated.error.message
-	});
-	return (0, import_index_cjs.ok)(validated.data);
-}
-/**
-* Refreshes an access token using a refresh token.
-*
-* @param config - The OAuth configuration.
-* @param refreshToken - The refresh token to use.
-* @returns A `Result` containing `TokenResponse` on success or `OAuthError` on failure.
-*/
-async function refreshAccessToken(config, refreshToken) {
-	const issuerUrl = config.issuerUrl ?? "https://auth.fanvue.com";
-	const body = new URLSearchParams({
-		grant_type: "refresh_token",
-		refresh_token: refreshToken,
-		client_id: config.clientId
-	});
-	let response;
-	try {
-		response = await fetch(`${issuerUrl}${OAUTH_TOKEN_ENDPOINT}`, {
-			method: "POST",
-			headers: {
-				"Content-Type": CONTENT_TYPE_FORM_URLENCODED,
-				Authorization: `Basic ${btoa(`${config.clientId}:${config.clientSecret}`)}`
-			},
-			body
-		});
-	} catch (error) {
-		return (0, import_index_cjs.err)({
-			code: "TOKEN_REFRESH_FAILED",
-			statusCode: 0,
-			message: `Network error during token refresh: ${error instanceof Error ? error.message : String(error)}`
-		});
-	}
-	if (!response.ok) return (0, import_index_cjs.err)({
-		code: "TOKEN_REFRESH_FAILED",
-		statusCode: response.status,
-		message: `Token refresh failed: ${response.status} ${response.statusText}`
-	});
-	const parseResult = safeJsonParse(await response.text());
-	if (parseResult.isErr()) {
-		const { rawText, message } = parseResult.error;
-		return (0, import_index_cjs.err)({
-			code: "OAUTH_JSON_PARSE_ERROR",
-			rawText,
-			message
-		});
-	}
-	const validated = TokenResponseSchema.safeParse(parseResult.value);
-	if (!validated.success) return (0, import_index_cjs.err)({
-		code: "OAUTH_VALIDATION_ERROR",
-		message: validated.error.message
-	});
-	return (0, import_index_cjs.ok)(validated.data);
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/buffer_utils.js
-const encoder = new TextEncoder();
-const decoder = new TextDecoder();
-function concat(...buffers) {
-	const size = buffers.reduce((acc, { length }) => acc + length, 0);
-	const buf = new Uint8Array(size);
-	let i = 0;
-	for (const buffer of buffers) {
-		buf.set(buffer, i);
-		i += buffer.length;
-	}
-	return buf;
-}
-function encode$1(string) {
-	const bytes = new Uint8Array(string.length);
-	for (let i = 0; i < string.length; i++) {
-		const code = string.charCodeAt(i);
-		if (code > 127) throw new TypeError("non-ASCII string encountered in encode()");
-		bytes[i] = code;
-	}
-	return bytes;
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/base64.js
-function encodeBase64(input) {
-	if (Uint8Array.prototype.toBase64) return input.toBase64();
-	const CHUNK_SIZE = 32768;
-	const arr = [];
-	for (let i = 0; i < input.length; i += CHUNK_SIZE) arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-	return btoa(arr.join(""));
-}
-function decodeBase64(encoded) {
-	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(encoded);
-	const binary = atob(encoded);
-	const bytes = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	return bytes;
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/util/base64url.js
-function decode(input) {
-	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), { alphabet: "base64url" });
-	let encoded = input;
-	if (encoded instanceof Uint8Array) encoded = decoder.decode(encoded);
-	encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
-	try {
-		return decodeBase64(encoded);
-	} catch {
-		throw new TypeError("The input to be decoded is not correctly encoded.");
-	}
-}
-function encode(input) {
-	let unencoded = input;
-	if (typeof unencoded === "string") unencoded = encoder.encode(unencoded);
-	if (Uint8Array.prototype.toBase64) return unencoded.toBase64({
-		alphabet: "base64url",
-		omitPadding: true
-	});
-	return encodeBase64(unencoded).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/crypto_key.js
-const unusable = (name, prop = "algorithm.name") => /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-const isAlgorithm = (algorithm, name) => algorithm.name === name;
-function getHashLength(hash) {
-	return parseInt(hash.name.slice(4), 10);
-}
-function checkHashLength(algorithm, expected) {
-	if (getHashLength(algorithm.hash) !== expected) throw unusable(`SHA-${expected}`, "algorithm.hash");
-}
-function getNamedCurve(alg) {
-	switch (alg) {
-		case "ES256": return "P-256";
-		case "ES384": return "P-384";
-		case "ES512": return "P-521";
-		default: throw new Error("unreachable");
-	}
-}
-function checkUsage(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-function checkSigCryptoKey(key, alg, usage) {
-	switch (alg) {
-		case "HS256":
-		case "HS384":
-		case "HS512":
-			if (!isAlgorithm(key.algorithm, "HMAC")) throw unusable("HMAC");
-			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
-			break;
-		case "RS256":
-		case "RS384":
-		case "RS512":
-			if (!isAlgorithm(key.algorithm, "RSASSA-PKCS1-v1_5")) throw unusable("RSASSA-PKCS1-v1_5");
-			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
-			break;
-		case "PS256":
-		case "PS384":
-		case "PS512":
-			if (!isAlgorithm(key.algorithm, "RSA-PSS")) throw unusable("RSA-PSS");
-			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
-			break;
-		case "Ed25519":
-		case "EdDSA":
-			if (!isAlgorithm(key.algorithm, "Ed25519")) throw unusable("Ed25519");
-			break;
-		case "ML-DSA-44":
-		case "ML-DSA-65":
-		case "ML-DSA-87":
-			if (!isAlgorithm(key.algorithm, alg)) throw unusable(alg);
-			break;
-		case "ES256":
-		case "ES384":
-		case "ES512": {
-			if (!isAlgorithm(key.algorithm, "ECDSA")) throw unusable("ECDSA");
-			const expected = getNamedCurve(alg);
-			if (key.algorithm.namedCurve !== expected) throw unusable(expected, "algorithm.namedCurve");
-			break;
-		}
-		default: throw new TypeError("CryptoKey does not support this operation");
-	}
-	checkUsage(key, usage);
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/invalid_key_input.js
-function message(msg, actual, ...types) {
-	types = types.filter(Boolean);
-	if (types.length > 2) {
-		const last = types.pop();
-		msg += `one of type ${types.join(", ")}, or ${last}.`;
-	} else if (types.length === 2) msg += `one of type ${types[0]} or ${types[1]}.`;
-	else msg += `of type ${types[0]}.`;
-	if (actual == null) msg += ` Received ${actual}`;
-	else if (typeof actual === "function" && actual.name) msg += ` Received function ${actual.name}`;
-	else if (typeof actual === "object" && actual != null) {
-		if (actual.constructor?.name) msg += ` Received an instance of ${actual.constructor.name}`;
-	}
-	return msg;
-}
-const invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
-const withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/util/errors.js
-var JOSEError = class extends Error {
-	static code = "ERR_JOSE_GENERIC";
-	code = "ERR_JOSE_GENERIC";
-	constructor(message, options) {
-		super(message, options);
-		this.name = this.constructor.name;
-		Error.captureStackTrace?.(this, this.constructor);
-	}
-};
-var JWTClaimValidationFailed = class extends JOSEError {
-	static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-	code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-	claim;
-	reason;
-	payload;
-	constructor(message, payload, claim = "unspecified", reason = "unspecified") {
-		super(message, { cause: {
-			claim,
-			reason,
-			payload
-		} });
-		this.claim = claim;
-		this.reason = reason;
-		this.payload = payload;
-	}
-};
-var JWTExpired = class extends JOSEError {
-	static code = "ERR_JWT_EXPIRED";
-	code = "ERR_JWT_EXPIRED";
-	claim;
-	reason;
-	payload;
-	constructor(message, payload, claim = "unspecified", reason = "unspecified") {
-		super(message, { cause: {
-			claim,
-			reason,
-			payload
-		} });
-		this.claim = claim;
-		this.reason = reason;
-		this.payload = payload;
-	}
-};
-var JOSEAlgNotAllowed = class extends JOSEError {
-	static code = "ERR_JOSE_ALG_NOT_ALLOWED";
-	code = "ERR_JOSE_ALG_NOT_ALLOWED";
-};
-var JOSENotSupported = class extends JOSEError {
-	static code = "ERR_JOSE_NOT_SUPPORTED";
-	code = "ERR_JOSE_NOT_SUPPORTED";
-};
-var JWSInvalid = class extends JOSEError {
-	static code = "ERR_JWS_INVALID";
-	code = "ERR_JWS_INVALID";
-};
-var JWTInvalid = class extends JOSEError {
-	static code = "ERR_JWT_INVALID";
-	code = "ERR_JWT_INVALID";
-};
-Symbol.asyncIterator;
-var JWSSignatureVerificationFailed = class extends JOSEError {
-	static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-	code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-	constructor(message = "signature verification failed", options) {
-		super(message, options);
-	}
-};
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/is_key_like.js
-const isCryptoKey = (key) => {
-	if (key?.[Symbol.toStringTag] === "CryptoKey") return true;
-	try {
-		return key instanceof CryptoKey;
-	} catch {
-		return false;
-	}
-};
-const isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
-const isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/helpers.js
-function assertNotSet(value, name) {
-	if (value) throw new TypeError(`${name} can only be called once`);
-}
-function decodeBase64url(value, label, ErrorClass) {
-	try {
-		return decode(value);
-	} catch {
-		throw new ErrorClass(`Failed to base64url decode the ${label}`);
-	}
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/type_checks.js
-const isObjectLike = (value) => typeof value === "object" && value !== null;
-function isObject(input) {
-	if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") return false;
-	if (Object.getPrototypeOf(input) === null) return true;
-	let proto = input;
-	while (Object.getPrototypeOf(proto) !== null) proto = Object.getPrototypeOf(proto);
-	return Object.getPrototypeOf(input) === proto;
-}
-function isDisjoint(...headers) {
-	const sources = headers.filter(Boolean);
-	if (sources.length === 0 || sources.length === 1) return true;
-	let acc;
-	for (const header of sources) {
-		const parameters = Object.keys(header);
-		if (!acc || acc.size === 0) {
-			acc = new Set(parameters);
-			continue;
-		}
-		for (const parameter of parameters) {
-			if (acc.has(parameter)) return false;
-			acc.add(parameter);
-		}
-	}
-	return true;
-}
-const isJWK = (key) => isObject(key) && typeof key.kty === "string";
-const isPrivateJWK = (key) => key.kty !== "oct" && (key.kty === "AKP" && typeof key.priv === "string" || typeof key.d === "string");
-const isPublicJWK = (key) => key.kty !== "oct" && key.d === void 0 && key.priv === void 0;
-const isSecretJWK = (key) => key.kty === "oct" && typeof key.k === "string";
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/signing.js
-function checkKeyLength(alg, key) {
-	if (alg.startsWith("RS") || alg.startsWith("PS")) {
-		const { modulusLength } = key.algorithm;
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-	}
-}
-function subtleAlgorithm(alg, algorithm) {
-	const hash = `SHA-${alg.slice(-3)}`;
-	switch (alg) {
-		case "HS256":
-		case "HS384":
-		case "HS512": return {
-			hash,
-			name: "HMAC"
-		};
-		case "PS256":
-		case "PS384":
-		case "PS512": return {
-			hash,
-			name: "RSA-PSS",
-			saltLength: parseInt(alg.slice(-3), 10) >> 3
-		};
-		case "RS256":
-		case "RS384":
-		case "RS512": return {
-			hash,
-			name: "RSASSA-PKCS1-v1_5"
-		};
-		case "ES256":
-		case "ES384":
-		case "ES512": return {
-			hash,
-			name: "ECDSA",
-			namedCurve: algorithm.namedCurve
-		};
-		case "Ed25519":
-		case "EdDSA": return { name: "Ed25519" };
-		case "ML-DSA-44":
-		case "ML-DSA-65":
-		case "ML-DSA-87": return { name: alg };
-		default: throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-	}
-}
-async function getSigKey(alg, key, usage) {
-	if (key instanceof Uint8Array) {
-		if (!alg.startsWith("HS")) throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
-		return crypto.subtle.importKey("raw", key, {
-			hash: `SHA-${alg.slice(-3)}`,
-			name: "HMAC"
-		}, false, [usage]);
-	}
-	checkSigCryptoKey(key, alg, usage);
-	return key;
-}
-async function sign(alg, key, data) {
-	const cryptoKey = await getSigKey(alg, key, "sign");
-	checkKeyLength(alg, cryptoKey);
-	const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);
-	return new Uint8Array(signature);
-}
-async function verify(alg, key, signature, data) {
-	const cryptoKey = await getSigKey(alg, key, "verify");
-	checkKeyLength(alg, cryptoKey);
-	const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
-	try {
-		return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
-	} catch {
-		return false;
-	}
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/jwk_to_key.js
-const unsupportedAlg = "Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value";
-function subtleMapping(jwk) {
-	let algorithm;
-	let keyUsages;
-	switch (jwk.kty) {
-		case "AKP":
-			switch (jwk.alg) {
-				case "ML-DSA-44":
-				case "ML-DSA-65":
-				case "ML-DSA-87":
-					algorithm = { name: jwk.alg };
-					keyUsages = jwk.priv ? ["sign"] : ["verify"];
-					break;
-				default: throw new JOSENotSupported(unsupportedAlg);
-			}
-			break;
-		case "RSA":
-			switch (jwk.alg) {
-				case "PS256":
-				case "PS384":
-				case "PS512":
-					algorithm = {
-						name: "RSA-PSS",
-						hash: `SHA-${jwk.alg.slice(-3)}`
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "RS256":
-				case "RS384":
-				case "RS512":
-					algorithm = {
-						name: "RSASSA-PKCS1-v1_5",
-						hash: `SHA-${jwk.alg.slice(-3)}`
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "RSA-OAEP":
-				case "RSA-OAEP-256":
-				case "RSA-OAEP-384":
-				case "RSA-OAEP-512":
-					algorithm = {
-						name: "RSA-OAEP",
-						hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`
-					};
-					keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
-					break;
-				default: throw new JOSENotSupported(unsupportedAlg);
-			}
-			break;
-		case "EC":
-			switch (jwk.alg) {
-				case "ES256":
-				case "ES384":
-				case "ES512":
-					algorithm = {
-						name: "ECDSA",
-						namedCurve: {
-							ES256: "P-256",
-							ES384: "P-384",
-							ES512: "P-521"
-						}[jwk.alg]
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "ECDH-ES":
-				case "ECDH-ES+A128KW":
-				case "ECDH-ES+A192KW":
-				case "ECDH-ES+A256KW":
-					algorithm = {
-						name: "ECDH",
-						namedCurve: jwk.crv
-					};
-					keyUsages = jwk.d ? ["deriveBits"] : [];
-					break;
-				default: throw new JOSENotSupported(unsupportedAlg);
-			}
-			break;
-		case "OKP":
-			switch (jwk.alg) {
-				case "Ed25519":
-				case "EdDSA":
-					algorithm = { name: "Ed25519" };
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "ECDH-ES":
-				case "ECDH-ES+A128KW":
-				case "ECDH-ES+A192KW":
-				case "ECDH-ES+A256KW":
-					algorithm = { name: jwk.crv };
-					keyUsages = jwk.d ? ["deriveBits"] : [];
-					break;
-				default: throw new JOSENotSupported(unsupportedAlg);
-			}
-			break;
-		default: throw new JOSENotSupported("Invalid or unsupported JWK \"kty\" (Key Type) Parameter value");
-	}
-	return {
-		algorithm,
-		keyUsages
-	};
-}
-async function jwkToKey(jwk) {
-	if (!jwk.alg) throw new TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
-	const { algorithm, keyUsages } = subtleMapping(jwk);
-	const keyData = { ...jwk };
-	if (keyData.kty !== "AKP") delete keyData.alg;
-	delete keyData.use;
-	return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/normalize_key.js
-const unusableForAlg = "given KeyObject instance cannot be used for this algorithm";
-let cache;
-const handleJWK = async (key, jwk, alg, freeze = false) => {
-	cache ||= /* @__PURE__ */ new WeakMap();
-	let cached = cache.get(key);
-	if (cached?.[alg]) return cached[alg];
-	const cryptoKey = await jwkToKey({
-		...jwk,
-		alg
-	});
-	if (freeze) Object.freeze(key);
-	if (!cached) cache.set(key, { [alg]: cryptoKey });
-	else cached[alg] = cryptoKey;
-	return cryptoKey;
-};
-const handleKeyObject = (keyObject, alg) => {
-	cache ||= /* @__PURE__ */ new WeakMap();
-	let cached = cache.get(keyObject);
-	if (cached?.[alg]) return cached[alg];
-	const isPublic = keyObject.type === "public";
-	const extractable = isPublic ? true : false;
-	let cryptoKey;
-	if (keyObject.asymmetricKeyType === "x25519") {
-		switch (alg) {
-			case "ECDH-ES":
-			case "ECDH-ES+A128KW":
-			case "ECDH-ES+A192KW":
-			case "ECDH-ES+A256KW": break;
-			default: throw new TypeError(unusableForAlg);
-		}
-		cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ["deriveBits"]);
-	}
-	if (keyObject.asymmetricKeyType === "ed25519") {
-		if (alg !== "EdDSA" && alg !== "Ed25519") throw new TypeError(unusableForAlg);
-		cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [isPublic ? "verify" : "sign"]);
-	}
-	switch (keyObject.asymmetricKeyType) {
-		case "ml-dsa-44":
-		case "ml-dsa-65":
-		case "ml-dsa-87":
-			if (alg !== keyObject.asymmetricKeyType.toUpperCase()) throw new TypeError(unusableForAlg);
-			cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [isPublic ? "verify" : "sign"]);
-	}
-	if (keyObject.asymmetricKeyType === "rsa") {
-		let hash;
-		switch (alg) {
-			case "RSA-OAEP":
-				hash = "SHA-1";
-				break;
-			case "RS256":
-			case "PS256":
-			case "RSA-OAEP-256":
-				hash = "SHA-256";
-				break;
-			case "RS384":
-			case "PS384":
-			case "RSA-OAEP-384":
-				hash = "SHA-384";
-				break;
-			case "RS512":
-			case "PS512":
-			case "RSA-OAEP-512":
-				hash = "SHA-512";
-				break;
-			default: throw new TypeError(unusableForAlg);
-		}
-		if (alg.startsWith("RSA-OAEP")) return keyObject.toCryptoKey({
-			name: "RSA-OAEP",
-			hash
-		}, extractable, isPublic ? ["encrypt"] : ["decrypt"]);
-		cryptoKey = keyObject.toCryptoKey({
-			name: alg.startsWith("PS") ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
-			hash
-		}, extractable, [isPublic ? "verify" : "sign"]);
-	}
-	if (keyObject.asymmetricKeyType === "ec") {
-		const namedCurve = new Map([
-			["prime256v1", "P-256"],
-			["secp384r1", "P-384"],
-			["secp521r1", "P-521"]
-		]).get(keyObject.asymmetricKeyDetails?.namedCurve);
-		if (!namedCurve) throw new TypeError(unusableForAlg);
-		const expectedCurve = {
-			ES256: "P-256",
-			ES384: "P-384",
-			ES512: "P-521"
-		};
-		if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) cryptoKey = keyObject.toCryptoKey({
-			name: "ECDSA",
-			namedCurve
-		}, extractable, [isPublic ? "verify" : "sign"]);
-		if (alg.startsWith("ECDH-ES")) cryptoKey = keyObject.toCryptoKey({
-			name: "ECDH",
-			namedCurve
-		}, extractable, isPublic ? [] : ["deriveBits"]);
-	}
-	if (!cryptoKey) throw new TypeError(unusableForAlg);
-	if (!cached) cache.set(keyObject, { [alg]: cryptoKey });
-	else cached[alg] = cryptoKey;
-	return cryptoKey;
-};
-async function normalizeKey(key, alg) {
-	if (key instanceof Uint8Array) return key;
-	if (isCryptoKey(key)) return key;
-	if (isKeyObject(key)) {
-		if (key.type === "secret") return key.export();
-		if ("toCryptoKey" in key && typeof key.toCryptoKey === "function") try {
-			return handleKeyObject(key, alg);
-		} catch (err) {
-			if (err instanceof TypeError) throw err;
-		}
-		return handleJWK(key, key.export({ format: "jwk" }), alg);
-	}
-	if (isJWK(key)) {
-		if (key.k) return decode(key.k);
-		return handleJWK(key, key, alg, true);
-	}
-	throw new Error("unreachable");
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/validate_crit.js
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-	if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) throw new Err("\"crit\" (Critical) Header Parameter MUST be integrity protected");
-	if (!protectedHeader || protectedHeader.crit === void 0) return /* @__PURE__ */ new Set();
-	if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) throw new Err("\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present");
-	let recognized;
-	if (recognizedOption !== void 0) recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
-	else recognized = recognizedDefault;
-	for (const parameter of protectedHeader.crit) {
-		if (!recognized.has(parameter)) throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-		if (joseHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-		if (recognized.get(parameter) && protectedHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-	}
-	return new Set(protectedHeader.crit);
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/validate_algorithms.js
-function validateAlgorithms(option, algorithms) {
-	if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) throw new TypeError(`"${option}" option must be an array of strings`);
-	if (!algorithms) return;
-	return new Set(algorithms);
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/check_key_type.js
-const tag = (key) => key?.[Symbol.toStringTag];
-const jwkMatchesOp = (alg, key, usage) => {
-	if (key.use !== void 0) {
-		let expected;
-		switch (usage) {
-			case "sign":
-			case "verify":
-				expected = "sig";
-				break;
-			case "encrypt":
-			case "decrypt":
-				expected = "enc";
-				break;
-		}
-		if (key.use !== expected) throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-	}
-	if (key.alg !== void 0 && key.alg !== alg) throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
-	if (Array.isArray(key.key_ops)) {
-		let expectedKeyOp;
-		switch (true) {
-			case usage === "sign" || usage === "verify":
-			case alg === "dir":
-			case alg.includes("CBC-HS"):
-				expectedKeyOp = usage;
-				break;
-			case alg.startsWith("PBES2"):
-				expectedKeyOp = "deriveBits";
-				break;
-			case /^A\d{3}(?:GCM)?(?:KW)?$/.test(alg):
-				if (!alg.includes("GCM") && alg.endsWith("KW")) expectedKeyOp = usage === "encrypt" ? "wrapKey" : "unwrapKey";
-				else expectedKeyOp = usage;
-				break;
-			case usage === "encrypt" && alg.startsWith("RSA"):
-				expectedKeyOp = "wrapKey";
-				break;
-			case usage === "decrypt":
-				expectedKeyOp = alg.startsWith("RSA") ? "unwrapKey" : "deriveBits";
-				break;
-		}
-		if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
-	}
-	return true;
-};
-const symmetricTypeCheck = (alg, key, usage) => {
-	if (key instanceof Uint8Array) return;
-	if (isJWK(key)) {
-		if (isSecretJWK(key) && jwkMatchesOp(alg, key, usage)) return;
-		throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
-	}
-	if (!isKeyLike(key)) throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array"));
-	if (key.type !== "secret") throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
-};
-const asymmetricTypeCheck = (alg, key, usage) => {
-	if (isJWK(key)) switch (usage) {
-		case "decrypt":
-		case "sign":
-			if (isPrivateJWK(key) && jwkMatchesOp(alg, key, usage)) return;
-			throw new TypeError(`JSON Web Key for this operation must be a private JWK`);
-		case "encrypt":
-		case "verify":
-			if (isPublicJWK(key) && jwkMatchesOp(alg, key, usage)) return;
-			throw new TypeError(`JSON Web Key for this operation must be a public JWK`);
-	}
-	if (!isKeyLike(key)) throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
-	if (key.type === "secret") throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
-	if (key.type === "public") switch (usage) {
-		case "sign": throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
-		case "decrypt": throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
-	}
-	if (key.type === "private") switch (usage) {
-		case "verify": throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
-		case "encrypt": throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
-	}
-};
-function checkKeyType(alg, key, usage) {
-	switch (alg.substring(0, 2)) {
-		case "A1":
-		case "A2":
-		case "di":
-		case "HS":
-		case "PB":
-			symmetricTypeCheck(alg, key, usage);
-			break;
-		default: asymmetricTypeCheck(alg, key, usage);
-	}
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/jws/flattened/verify.js
-async function flattenedVerify(jws, key, options) {
-	if (!isObject(jws)) throw new JWSInvalid("Flattened JWS must be an object");
-	if (jws.protected === void 0 && jws.header === void 0) throw new JWSInvalid("Flattened JWS must have either of the \"protected\" or \"header\" members");
-	if (jws.protected !== void 0 && typeof jws.protected !== "string") throw new JWSInvalid("JWS Protected Header incorrect type");
-	if (jws.payload === void 0) throw new JWSInvalid("JWS Payload missing");
-	if (typeof jws.signature !== "string") throw new JWSInvalid("JWS Signature missing or incorrect type");
-	if (jws.header !== void 0 && !isObject(jws.header)) throw new JWSInvalid("JWS Unprotected Header incorrect type");
-	let parsedProt = {};
-	if (jws.protected) try {
-		const protectedHeader = decode(jws.protected);
-		parsedProt = JSON.parse(decoder.decode(protectedHeader));
-	} catch {
-		throw new JWSInvalid("JWS Protected Header is invalid");
-	}
-	if (!isDisjoint(parsedProt, jws.header)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-	const joseHeader = {
-		...parsedProt,
-		...jws.header
-	};
-	const extensions = validateCrit(JWSInvalid, new Map([["b64", true]]), options?.crit, parsedProt, joseHeader);
-	let b64 = true;
-	if (extensions.has("b64")) {
-		b64 = parsedProt.b64;
-		if (typeof b64 !== "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
-	}
-	const { alg } = joseHeader;
-	if (typeof alg !== "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
-	const algorithms = options && validateAlgorithms("algorithms", options.algorithms);
-	if (algorithms && !algorithms.has(alg)) throw new JOSEAlgNotAllowed("\"alg\" (Algorithm) Header Parameter value not allowed");
-	if (b64) {
-		if (typeof jws.payload !== "string") throw new JWSInvalid("JWS Payload must be a string");
-	} else if (typeof jws.payload !== "string" && !(jws.payload instanceof Uint8Array)) throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
-	let resolvedKey = false;
-	if (typeof key === "function") {
-		key = await key(parsedProt, jws);
-		resolvedKey = true;
-	}
-	checkKeyType(alg, key, "verify");
-	const data = concat(jws.protected !== void 0 ? encode$1(jws.protected) : new Uint8Array(), encode$1("."), typeof jws.payload === "string" ? b64 ? encode$1(jws.payload) : encoder.encode(jws.payload) : jws.payload);
-	const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
-	const k = await normalizeKey(key, alg);
-	if (!await verify(alg, k, signature, data)) throw new JWSSignatureVerificationFailed();
-	let payload;
-	if (b64) payload = decodeBase64url(jws.payload, "payload", JWSInvalid);
-	else if (typeof jws.payload === "string") payload = encoder.encode(jws.payload);
-	else payload = jws.payload;
-	const result = { payload };
-	if (jws.protected !== void 0) result.protectedHeader = parsedProt;
-	if (jws.header !== void 0) result.unprotectedHeader = jws.header;
-	if (resolvedKey) return {
-		...result,
-		key: k
-	};
-	return result;
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/jws/compact/verify.js
-async function compactVerify(jws, key, options) {
-	if (jws instanceof Uint8Array) jws = decoder.decode(jws);
-	if (typeof jws !== "string") throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
-	const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
-	if (length !== 3) throw new JWSInvalid("Invalid Compact JWS");
-	const verified = await flattenedVerify({
-		payload,
-		protected: protectedHeader,
-		signature
-	}, key, options);
-	const result = {
-		payload: verified.payload,
-		protectedHeader: verified.protectedHeader
-	};
-	if (typeof key === "function") return {
-		...result,
-		key: verified.key
-	};
-	return result;
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
-const epoch = (date) => Math.floor(date.getTime() / 1e3);
-const minute = 60;
-const hour = minute * 60;
-const day = hour * 24;
-const week = day * 7;
-const year = day * 365.25;
-const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
-function secs(str) {
-	const matched = REGEX.exec(str);
-	if (!matched || matched[4] && matched[1]) throw new TypeError("Invalid time period format");
-	const value = parseFloat(matched[2]);
-	const unit = matched[3].toLowerCase();
-	let numericDate;
-	switch (unit) {
-		case "sec":
-		case "secs":
-		case "second":
-		case "seconds":
-		case "s":
-			numericDate = Math.round(value);
-			break;
-		case "minute":
-		case "minutes":
-		case "min":
-		case "mins":
-		case "m":
-			numericDate = Math.round(value * minute);
-			break;
-		case "hour":
-		case "hours":
-		case "hr":
-		case "hrs":
-		case "h":
-			numericDate = Math.round(value * hour);
-			break;
-		case "day":
-		case "days":
-		case "d":
-			numericDate = Math.round(value * day);
-			break;
-		case "week":
-		case "weeks":
-		case "w":
-			numericDate = Math.round(value * week);
-			break;
-		default:
-			numericDate = Math.round(value * year);
-			break;
-	}
-	if (matched[1] === "-" || matched[4] === "ago") return -numericDate;
-	return numericDate;
-}
-function validateInput(label, input) {
-	if (!Number.isFinite(input)) throw new TypeError(`Invalid ${label} input`);
-	return input;
-}
-const normalizeTyp = (value) => {
-	if (value.includes("/")) return value.toLowerCase();
-	return `application/${value.toLowerCase()}`;
-};
-const checkAudiencePresence = (audPayload, audOption) => {
-	if (typeof audPayload === "string") return audOption.includes(audPayload);
-	if (Array.isArray(audPayload)) return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
-	return false;
-};
-function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-	let payload;
-	try {
-		payload = JSON.parse(decoder.decode(encodedPayload));
-	} catch {}
-	if (!isObject(payload)) throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
-	const { typ } = options;
-	if (typ && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) throw new JWTClaimValidationFailed("unexpected \"typ\" JWT header value", payload, "typ", "check_failed");
-	const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
-	const presenceCheck = [...requiredClaims];
-	if (maxTokenAge !== void 0) presenceCheck.push("iat");
-	if (audience !== void 0) presenceCheck.push("aud");
-	if (subject !== void 0) presenceCheck.push("sub");
-	if (issuer !== void 0) presenceCheck.push("iss");
-	for (const claim of new Set(presenceCheck.reverse())) if (!(claim in payload)) throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-	if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) throw new JWTClaimValidationFailed("unexpected \"iss\" claim value", payload, "iss", "check_failed");
-	if (subject && payload.sub !== subject) throw new JWTClaimValidationFailed("unexpected \"sub\" claim value", payload, "sub", "check_failed");
-	if (audience && !checkAudiencePresence(payload.aud, typeof audience === "string" ? [audience] : audience)) throw new JWTClaimValidationFailed("unexpected \"aud\" claim value", payload, "aud", "check_failed");
-	let tolerance;
-	switch (typeof options.clockTolerance) {
-		case "string":
-			tolerance = secs(options.clockTolerance);
-			break;
-		case "number":
-			tolerance = options.clockTolerance;
-			break;
-		case "undefined":
-			tolerance = 0;
-			break;
-		default: throw new TypeError("Invalid clockTolerance option type");
-	}
-	const { currentDate } = options;
-	const now = epoch(currentDate || /* @__PURE__ */ new Date());
-	if ((payload.iat !== void 0 || maxTokenAge) && typeof payload.iat !== "number") throw new JWTClaimValidationFailed("\"iat\" claim must be a number", payload, "iat", "invalid");
-	if (payload.nbf !== void 0) {
-		if (typeof payload.nbf !== "number") throw new JWTClaimValidationFailed("\"nbf\" claim must be a number", payload, "nbf", "invalid");
-		if (payload.nbf > now + tolerance) throw new JWTClaimValidationFailed("\"nbf\" claim timestamp check failed", payload, "nbf", "check_failed");
-	}
-	if (payload.exp !== void 0) {
-		if (typeof payload.exp !== "number") throw new JWTClaimValidationFailed("\"exp\" claim must be a number", payload, "exp", "invalid");
-		if (payload.exp <= now - tolerance) throw new JWTExpired("\"exp\" claim timestamp check failed", payload, "exp", "check_failed");
-	}
-	if (maxTokenAge) {
-		const age = now - payload.iat;
-		const max = typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge);
-		if (age - tolerance > max) throw new JWTExpired("\"iat\" claim timestamp check failed (too far in the past)", payload, "iat", "check_failed");
-		if (age < 0 - tolerance) throw new JWTClaimValidationFailed("\"iat\" claim timestamp check failed (it should be in the past)", payload, "iat", "check_failed");
-	}
-	return payload;
-}
-var JWTClaimsBuilder = class {
-	#payload;
-	constructor(payload) {
-		if (!isObject(payload)) throw new TypeError("JWT Claims Set MUST be an object");
-		this.#payload = structuredClone(payload);
-	}
-	data() {
-		return encoder.encode(JSON.stringify(this.#payload));
-	}
-	get iss() {
-		return this.#payload.iss;
-	}
-	set iss(value) {
-		this.#payload.iss = value;
-	}
-	get sub() {
-		return this.#payload.sub;
-	}
-	set sub(value) {
-		this.#payload.sub = value;
-	}
-	get aud() {
-		return this.#payload.aud;
-	}
-	set aud(value) {
-		this.#payload.aud = value;
-	}
-	set jti(value) {
-		this.#payload.jti = value;
-	}
-	set nbf(value) {
-		if (typeof value === "number") this.#payload.nbf = validateInput("setNotBefore", value);
-		else if (value instanceof Date) this.#payload.nbf = validateInput("setNotBefore", epoch(value));
-		else this.#payload.nbf = epoch(/* @__PURE__ */ new Date()) + secs(value);
-	}
-	set exp(value) {
-		if (typeof value === "number") this.#payload.exp = validateInput("setExpirationTime", value);
-		else if (value instanceof Date) this.#payload.exp = validateInput("setExpirationTime", epoch(value));
-		else this.#payload.exp = epoch(/* @__PURE__ */ new Date()) + secs(value);
-	}
-	set iat(value) {
-		if (value === void 0) this.#payload.iat = epoch(/* @__PURE__ */ new Date());
-		else if (value instanceof Date) this.#payload.iat = validateInput("setIssuedAt", epoch(value));
-		else if (typeof value === "string") this.#payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value));
-		else this.#payload.iat = validateInput("setIssuedAt", value);
-	}
-};
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/jwt/verify.js
-async function jwtVerify(jwt, key, options) {
-	const verified = await compactVerify(jwt, key, options);
-	if (verified.protectedHeader.crit?.includes("b64") && verified.protectedHeader.b64 === false) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-	const result = {
-		payload: validateClaimsSet(verified.protectedHeader, verified.payload, options),
-		protectedHeader: verified.protectedHeader
-	};
-	if (typeof key === "function") return {
-		...result,
-		key: verified.key
-	};
-	return result;
-}
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/jws/flattened/sign.js
-var FlattenedSign = class {
-	#payload;
-	#protectedHeader;
-	#unprotectedHeader;
-	constructor(payload) {
-		if (!(payload instanceof Uint8Array)) throw new TypeError("payload must be an instance of Uint8Array");
-		this.#payload = payload;
-	}
-	setProtectedHeader(protectedHeader) {
-		assertNotSet(this.#protectedHeader, "setProtectedHeader");
-		this.#protectedHeader = protectedHeader;
-		return this;
-	}
-	setUnprotectedHeader(unprotectedHeader) {
-		assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader");
-		this.#unprotectedHeader = unprotectedHeader;
-		return this;
-	}
-	async sign(key, options) {
-		if (!this.#protectedHeader && !this.#unprotectedHeader) throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
-		if (!isDisjoint(this.#protectedHeader, this.#unprotectedHeader)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-		const joseHeader = {
-			...this.#protectedHeader,
-			...this.#unprotectedHeader
-		};
-		const extensions = validateCrit(JWSInvalid, new Map([["b64", true]]), options?.crit, this.#protectedHeader, joseHeader);
-		let b64 = true;
-		if (extensions.has("b64")) {
-			b64 = this.#protectedHeader.b64;
-			if (typeof b64 !== "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
-		}
-		const { alg } = joseHeader;
-		if (typeof alg !== "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
-		checkKeyType(alg, key, "sign");
-		let payloadS;
-		let payloadB;
-		if (b64) {
-			payloadS = encode(this.#payload);
-			payloadB = encode$1(payloadS);
-		} else {
-			payloadB = this.#payload;
-			payloadS = "";
-		}
-		let protectedHeaderString;
-		let protectedHeaderBytes;
-		if (this.#protectedHeader) {
-			protectedHeaderString = encode(JSON.stringify(this.#protectedHeader));
-			protectedHeaderBytes = encode$1(protectedHeaderString);
-		} else {
-			protectedHeaderString = "";
-			protectedHeaderBytes = new Uint8Array();
-		}
-		const data = concat(protectedHeaderBytes, encode$1("."), payloadB);
-		const jws = {
-			signature: encode(await sign(alg, await normalizeKey(key, alg), data)),
-			payload: payloadS
-		};
-		if (this.#unprotectedHeader) jws.header = this.#unprotectedHeader;
-		if (this.#protectedHeader) jws.protected = protectedHeaderString;
-		return jws;
-	}
-};
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/jws/compact/sign.js
-var CompactSign = class {
-	#flattened;
-	constructor(payload) {
-		this.#flattened = new FlattenedSign(payload);
-	}
-	setProtectedHeader(protectedHeader) {
-		this.#flattened.setProtectedHeader(protectedHeader);
-		return this;
-	}
-	async sign(key, options) {
-		const jws = await this.#flattened.sign(key, options);
-		if (jws.payload === void 0) throw new TypeError("use the flattened module for creating JWS with b64: false");
-		return `${jws.protected}.${jws.payload}.${jws.signature}`;
-	}
-};
-//#endregion
-//#region node_modules/.pnpm/jose@6.2.1/node_modules/jose/dist/webapi/jwt/sign.js
-var SignJWT = class {
-	#protectedHeader;
-	#jwt;
-	constructor(payload = {}) {
-		this.#jwt = new JWTClaimsBuilder(payload);
-	}
-	setIssuer(issuer) {
-		this.#jwt.iss = issuer;
-		return this;
-	}
-	setSubject(subject) {
-		this.#jwt.sub = subject;
-		return this;
-	}
-	setAudience(audience) {
-		this.#jwt.aud = audience;
-		return this;
-	}
-	setJti(jwtId) {
-		this.#jwt.jti = jwtId;
-		return this;
-	}
-	setNotBefore(input) {
-		this.#jwt.nbf = input;
-		return this;
-	}
-	setExpirationTime(input) {
-		this.#jwt.exp = input;
-		return this;
-	}
-	setIssuedAt(input) {
-		this.#jwt.iat = input;
-		return this;
-	}
-	setProtectedHeader(protectedHeader) {
-		this.#protectedHeader = protectedHeader;
-		return this;
-	}
-	async sign(key, options) {
-		const sig = new CompactSign(this.#jwt.data());
-		sig.setProtectedHeader(this.#protectedHeader);
-		if (Array.isArray(this.#protectedHeader?.crit) && this.#protectedHeader.crit.includes("b64") && this.#protectedHeader.b64 === false) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-		return sig.sign(key, options);
-	}
-};
-//#endregion
-//#region src/core/session.ts
-/**
-* Creates a signed JWT containing the given session payload.
-*
-* @param secret - The secret key used to sign the JWT.
-* @param payload - The session data to embed in the token.
-* @param expiresIn - How long until the token expires (e.g., `"30d"`), or `null` for the default (`"30d"`).
-* @returns The signed JWT string.
-*/
-async function createSessionJwt(secret, payload, expiresIn = null) {
-	const key = new TextEncoder().encode(secret);
-	return new SignJWT({ ...payload }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(expiresIn ?? "30d").sign(key);
-}
-/**
-* Verifies a session JWT and returns the validated session payload.
-*
-* @param secret - The secret key used to verify the JWT signature.
-* @param token - The JWT string to verify.
-* @returns A {@link Result} containing the validated {@link SessionPayload}, or a {@link SessionVerifyError}.
-*/
-async function verifySessionJwt(secret, token) {
-	const key = new TextEncoder().encode(secret);
-	let payload;
-	try {
-		payload = (await jwtVerify(token, key)).payload;
-	} catch (e) {
-		return (0, import_index_cjs.err)({
-			code: "JWT_VERIFY_FAILED",
-			message: e instanceof Error ? e.message : "JWT verification failed"
-		});
-	}
-	const parsed = SessionPayloadSchema.safeParse(payload);
-	if (!parsed.success) return (0, import_index_cjs.err)({
-		code: "SESSION_VALIDATION_ERROR",
-		message: parsed.error.message
-	});
-	return (0, import_index_cjs.ok)(parsed.data);
-}
-//#endregion
-//#region src/core/embedded.ts
-const AUTHORIZE_ON_BEHALF_PATH = "/api/v1/app-integrations/authorize-on-behalf";
-const SESSION_TOKEN_QUERY_PARAM = "token";
-const THEME_QUERY_PARAM = "theme";
-/**
-* Extracts the embedded session token from a URL.
-*
-* When Fanvue opens an embedded app, it loads the app's embed URL with a
-* short-lived session token appended as a `?token=` query parameter.
-*
-* @param url - The URL to read the token from (e.g. `window.location.href`).
-* @returns The session token, or `null` when absent or the URL is malformed.
-*/
-function getSessionTokenFromUrl(url) {
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		return null;
-	}
-	const token = parsed.searchParams.get(SESSION_TOKEN_QUERY_PARAM);
-	return token !== null && token.length > 0 ? token : null;
-}
-/**
-* Extracts the creator's active colour scheme from a URL.
-*
-* When Fanvue opens an embedded app, it appends the creator's resolved colour
-* scheme as a `?theme=` query parameter (`light` or `dark`), letting the app
-* theme-match Fanvue.
-*
-* @param url - The URL to read the theme from (e.g. `window.location.href`).
-* @returns The {@link FanvueTheme}, or `null` when absent, unrecognised, or the
-*   URL is malformed (e.g. the app was opened outside Fanvue).
-*/
-function getThemeFromUrl(url) {
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		return null;
-	}
-	const theme = parsed.searchParams.get(THEME_QUERY_PARAM);
-	return theme === "light" || theme === "dark" ? theme : null;
-}
-/**
-* Requests an authorization code from the Fanvue platform on behalf of the
-* creator currently using the embedded app.
-*
-* This is the "authorize" half of the delegated flow: the platform verifies
-* the session token, runs the OAuth authorize as the creator, and returns the
-* resulting authorization code. The PKCE verifier and client secret never
-* leave the caller — only the challenge is sent.
-*
-* Most apps should use {@link exchangeSessionToken}, which composes this with
-* the code exchange.
-*
-* @param config - The embedded auth configuration.
-* @param sessionToken - The short-lived session token received in the iframe.
-* @param opts - The PKCE code challenge and state to bind the code to.
-* @returns A `Result` containing the authorization code on success or
-*   {@link EmbeddedAuthError} on failure.
-*/
-async function requestAuthorizationCodeOnBehalf(config, sessionToken, opts) {
-	const platformUrl = config.platformUrl ?? "https://www.fanvue.com";
-	let response;
-	try {
-		response = await fetch(`${platformUrl}${AUTHORIZE_ON_BEHALF_PATH}`, {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				Authorization: `Bearer ${sessionToken}`
-			},
-			body: JSON.stringify({
-				code_challenge: opts.codeChallenge,
-				code_challenge_method: "S256",
-				state: opts.state
-			})
-		});
-	} catch (error) {
-		return (0, import_index_cjs.err)({
-			code: "AUTHORIZE_ON_BEHALF_FAILED",
-			statusCode: 0,
-			message: `Network error during authorize-on-behalf: ${error instanceof Error ? error.message : String(error)}`
-		});
-	}
-	if (response.status === 401) return (0, import_index_cjs.err)({
-		code: "SESSION_TOKEN_REJECTED",
-		statusCode: response.status,
-		message: "The platform rejected the session token. Session tokens expire after ~60 seconds — reopen the embedded surface to receive a fresh one."
-	});
-	if (response.status === 403) return (0, import_index_cjs.err)({
-		code: "CONSENT_REQUIRED",
-		statusCode: response.status,
-		message: "The creator has not approved (or has revoked) consent for this app. Consent is granted on the Fanvue consent screen when the surface is opened."
-	});
-	if (!response.ok) return (0, import_index_cjs.err)({
-		code: "AUTHORIZE_ON_BEHALF_FAILED",
-		statusCode: response.status,
-		message: `authorize-on-behalf failed: ${response.status} ${response.statusText}`
-	});
-	const parseResult = safeJsonParse(await response.text());
-	if (parseResult.isErr()) {
-		const { rawText, message } = parseResult.error;
-		return (0, import_index_cjs.err)({
-			code: "EMBEDDED_JSON_PARSE_ERROR",
-			rawText,
-			message
-		});
-	}
-	const validated = AuthorizeOnBehalfResponseSchema.safeParse(parseResult.value);
-	if (!validated.success) return (0, import_index_cjs.err)({
-		code: "EMBEDDED_VALIDATION_ERROR",
-		message: validated.error.message
-	});
-	if (validated.data.state !== opts.state) return (0, import_index_cjs.err)({
-		code: "AUTHORIZE_STATE_MISMATCH",
-		message: "authorize-on-behalf returned a different state than was sent."
-	});
-	return (0, import_index_cjs.ok)({ code: validated.data.code });
-}
-/**
-* Exchanges an embedded session token for OAuth access and refresh tokens.
-*
-* Runs the complete delegated authorize-on-behalf flow:
-*
-* 1. Generates a PKCE verifier/challenge pair and a random `state`.
-* 2. Asks the Fanvue platform to authorize as the creator
-*    ({@link requestAuthorizationCodeOnBehalf}).
-* 3. Exchanges the returned code at the token endpoint using the client
-*    secret and PKCE verifier.
-*
-* Must run server-side: it uses the client secret. The session token should
-* be used promptly — it expires after ~60 seconds.
-*
-* @param config - The embedded auth configuration. `redirectUri` must be a
-*   redirect URI registered on the OAuth client (it is never visited; it only
-*   binds the authorization code).
-* @param sessionToken - The short-lived session token received in the iframe.
-* @returns A `Result` containing {@link TokenResponse} on success or an
-*   {@link EmbeddedAuthError} / {@link OAuthError} on failure.
-*/
-async function exchangeSessionToken(config, sessionToken) {
-	const codeVerifier = generateRandomCodeVerifier();
-	const codeResult = await requestAuthorizationCodeOnBehalf(config, sessionToken, {
-		codeChallenge: await calculatePKCECodeChallenge(codeVerifier),
-		state: generateRandomState()
-	});
-	if (codeResult.isErr()) return (0, import_index_cjs.err)(codeResult.error);
-	return exchangeCodeForToken(config, {
-		code: codeResult.value.code,
-		codeVerifier,
-		redirectUri: null
-	});
-}
-//#endregion
-//#region src/core/client.ts
-/**
-* Creates a new {@link FanvueClient} for making authenticated requests to the Fanvue API.
-*
-* @param accessToken - The OAuth access token to authenticate requests.
-* @param apiBaseUrl - The base URL for the Fanvue API, or `null` to use the default.
-* @returns A {@link FanvueClient} instance.
-*/
-function createFanvueClient(accessToken, apiBaseUrl) {
-	if (apiBaseUrl != null) assertFanvueDomain(apiBaseUrl);
-	const baseUrl = apiBaseUrl ?? "https://api.fanvue.com";
-	async function fetchApi(path) {
-		let response;
-		try {
-			response = await fetch(`${baseUrl}${path}`, { headers: {
-				Authorization: `Bearer ${accessToken}`,
-				"X-Fanvue-API-Version": API_VERSION
-			} });
-		} catch (error) {
-			return (0, import_index_cjs.err)({
-				code: "API_REQUEST_FAILED",
-				statusCode: 0,
-				message: `Network error: ${error instanceof Error ? error.message : String(error)}`
-			});
-		}
-		if (!response.ok) return (0, import_index_cjs.err)({
-			code: "API_REQUEST_FAILED",
-			statusCode: response.status,
-			message: `API request failed: ${response.status} ${response.statusText}`
-		});
-		const parseResult = safeJsonParse(await response.text());
-		if (parseResult.isErr()) {
-			const { rawText, message } = parseResult.error;
-			return (0, import_index_cjs.err)({
-				code: "API_JSON_PARSE_ERROR",
-				rawText,
-				message
-			});
-		}
-		return (0, import_index_cjs.ok)(parseResult.value);
-	}
-	async function getCurrentUser() {
-		const result = await fetchApi("/users/me");
-		if (result.isErr()) return (0, import_index_cjs.err)(result.error);
-		const validated = FanvueUserSchema.safeParse(result.value);
-		if (!validated.success) return (0, import_index_cjs.err)({
-			code: "API_VALIDATION_ERROR",
-			message: validated.error.message
-		});
-		return (0, import_index_cjs.ok)(validated.data);
-	}
-	return { getCurrentUser };
-}
-//#endregion
-export { assertFanvueDomain as C, DEFAULT_SCOPES as S, HEADER_UPDATED_SESSION as T, safeJsonParse as _, requestAuthorizationCodeOnBehalf as a, DEFAULT_ISSUER_URL as b, createAuthorizationUrl as c, AuthorizeOnBehalfResponseSchema as d, FanvueUserSchema as f, string as g, object as h, getThemeFromUrl as i, exchangeCodeForToken as l, TokenResponseSchema as m, exchangeSessionToken as n, createSessionJwt as o, SessionPayloadSchema as p, getSessionTokenFromUrl as r, verifySessionJwt as s, createFanvueClient as t, refreshAccessToken as u, API_VERSION as v, BEARER_PREFIX as w, DEFAULT_PLATFORM_URL as x, DEFAULT_API_BASE_URL as y };
+export { number as a, string as c, prettifyError as d, require_index_cjs as f, literal as i, union as l, array as n, object as o, boolean as r, record as s, _enum as t, unknown as u };
 
-//# sourceMappingURL=core-CvVOMyqr.js.map
+//# sourceMappingURL=schemas-DbyHF7Xi.js.map