@finueva/auth 0.3.0 → 0.5.0

package/dist/device.js

@@ -0,0 +1,936 @@
+//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
+const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
+const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
+const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+function jsonParseTransform(key, value) {
+	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+		warnKeyDropped(key);
+		return;
+	}
+	return value;
+}
+function warnKeyDropped(key) {
+	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
+}
+function destr(value, options = {}) {
+	if (typeof value !== "string") return value;
+	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
+	const _value = value.trim();
+	if (_value.length <= 9) switch (_value.toLowerCase()) {
+		case "true": return true;
+		case "false": return false;
+		case "undefined": return;
+		case "null": return null;
+		case "nan": return NaN;
+		case "infinity": return Number.POSITIVE_INFINITY;
+		case "-infinity": return Number.NEGATIVE_INFINITY;
+	}
+	if (!JsonSigRx.test(value)) {
+		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
+		return value;
+	}
+	try {
+		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
+			if (options.strict) throw new Error("[destr] Possible prototype pollution");
+			return JSON.parse(value, jsonParseTransform);
+		}
+		return JSON.parse(value);
+	} catch (error) {
+		if (options.strict) throw error;
+		return value;
+	}
+}
+String.fromCharCode;
+const HASH_RE = /#/g;
+const AMPERSAND_RE = /&/g;
+const SLASH_RE = /\//g;
+const EQUAL_RE = /=/g;
+const PLUS_RE = /\+/g;
+const ENC_CARET_RE = /%5e/gi;
+const ENC_BACKTICK_RE = /%60/gi;
+const ENC_PIPE_RE = /%7c/gi;
+const ENC_SPACE_RE = /%20/gi;
+function encode(text) {
+	return encodeURI("" + text).replace(ENC_PIPE_RE, "|");
+}
+function encodeQueryValue(input) {
+	return encode(typeof input === "string" ? input : JSON.stringify(input)).replace(PLUS_RE, "%2B").replace(ENC_SPACE_RE, "+").replace(HASH_RE, "%23").replace(AMPERSAND_RE, "%26").replace(ENC_BACKTICK_RE, "`").replace(ENC_CARET_RE, "^").replace(SLASH_RE, "%2F");
+}
+function encodeQueryKey(text) {
+	return encodeQueryValue(text).replace(EQUAL_RE, "%3D");
+}
+function decode(text = "") {
+	try {
+		return decodeURIComponent("" + text);
+	} catch {
+		return "" + text;
+	}
+}
+function decodeQueryKey(text) {
+	return decode(text.replace(PLUS_RE, " "));
+}
+function decodeQueryValue(text) {
+	return decode(text.replace(PLUS_RE, " "));
+}
+function parseQuery(parametersString = "") {
+	const object = Object.create(null);
+	if (parametersString[0] === "?") parametersString = parametersString.slice(1);
+	for (const parameter of parametersString.split("&")) {
+		const s = parameter.match(/([^=]+)=?(.*)/) || [];
+		if (s.length < 2) continue;
+		const key = decodeQueryKey(s[1]);
+		if (key === "__proto__" || key === "constructor") continue;
+		const value = decodeQueryValue(s[2] || "");
+		if (object[key] === void 0) object[key] = value;
+		else if (Array.isArray(object[key])) object[key].push(value);
+		else object[key] = [object[key], value];
+	}
+	return object;
+}
+function encodeQueryItem(key, value) {
+	if (typeof value === "number" || typeof value === "boolean") value = String(value);
+	if (!value) return encodeQueryKey(key);
+	if (Array.isArray(value)) return value.map((_value) => `${encodeQueryKey(key)}=${encodeQueryValue(_value)}`).join("&");
+	return `${encodeQueryKey(key)}=${encodeQueryValue(value)}`;
+}
+function stringifyQuery(query) {
+	return Object.keys(query).filter((k) => query[k] !== void 0).map((k) => encodeQueryItem(k, query[k])).filter(Boolean).join("&");
+}
+const PROTOCOL_STRICT_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{1,2})/;
+const PROTOCOL_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{2})?/;
+const PROTOCOL_RELATIVE_REGEX = /^([/\\]\s*){2,}[^/\\]/;
+const TRAILING_SLASH_RE = /\/$|\/\?|\/#/;
+const JOIN_LEADING_SLASH_RE = /^\.?\//;
+function hasProtocol(inputString, opts = {}) {
+	if (typeof opts === "boolean") opts = { acceptRelative: opts };
+	if (opts.strict) return PROTOCOL_STRICT_REGEX.test(inputString);
+	return PROTOCOL_REGEX.test(inputString) || (opts.acceptRelative ? PROTOCOL_RELATIVE_REGEX.test(inputString) : false);
+}
+function hasTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return input.endsWith("/");
+	return TRAILING_SLASH_RE.test(input);
+}
+function withoutTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return (hasTrailingSlash(input) ? input.slice(0, -1) : input) || "/";
+	if (!hasTrailingSlash(input, true)) return input || "/";
+	let path = input;
+	let fragment = "";
+	const fragmentIndex = input.indexOf("#");
+	if (fragmentIndex !== -1) {
+		path = input.slice(0, fragmentIndex);
+		fragment = input.slice(fragmentIndex);
+	}
+	const [s0, ...s] = path.split("?");
+	return ((s0.endsWith("/") ? s0.slice(0, -1) : s0) || "/") + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
+}
+function withTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return input.endsWith("/") ? input : input + "/";
+	if (hasTrailingSlash(input, true)) return input || "/";
+	let path = input;
+	let fragment = "";
+	const fragmentIndex = input.indexOf("#");
+	if (fragmentIndex !== -1) {
+		path = input.slice(0, fragmentIndex);
+		fragment = input.slice(fragmentIndex);
+		if (!path) return fragment;
+	}
+	const [s0, ...s] = path.split("?");
+	return s0 + "/" + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
+}
+function withBase(input, base) {
+	if (isEmptyURL(base) || hasProtocol(input)) return input;
+	const _base = withoutTrailingSlash(base);
+	if (input.startsWith(_base)) {
+		const nextChar = input[_base.length];
+		if (!nextChar || nextChar === "/" || nextChar === "?") return input;
+	}
+	return joinURL(_base, input);
+}
+function withQuery(input, query) {
+	const parsed = parseURL(input);
+	parsed.search = stringifyQuery({
+		...parseQuery(parsed.search),
+		...query
+	});
+	return stringifyParsedURL(parsed);
+}
+function isEmptyURL(url) {
+	return !url || url === "/";
+}
+function isNonEmptyURL(url) {
+	return url && url !== "/";
+}
+function joinURL(base, ...input) {
+	let url = base || "";
+	for (const segment of input.filter((url2) => isNonEmptyURL(url2))) if (url) {
+		const _segment = segment.replace(JOIN_LEADING_SLASH_RE, "");
+		url = withTrailingSlash(url) + _segment;
+	} else url = segment;
+	return url;
+}
+const protocolRelative = Symbol.for("ufo:protocolRelative");
+function parseURL(input = "", defaultProto) {
+	const _specialProtoMatch = input.match(/^[\s\0]*(blob:|data:|javascript:|vbscript:)(.*)/i);
+	if (_specialProtoMatch) {
+		const [, _proto, _pathname = ""] = _specialProtoMatch;
+		return {
+			protocol: _proto.toLowerCase(),
+			pathname: _pathname,
+			href: _proto + _pathname,
+			auth: "",
+			host: "",
+			search: "",
+			hash: ""
+		};
+	}
+	if (!hasProtocol(input, { acceptRelative: true })) return defaultProto ? parseURL(defaultProto + input) : parsePath(input);
+	const [, protocol = "", auth, hostAndPath = ""] = input.replace(/\\/g, "/").match(/^[\s\0]*([\w+.-]{2,}:)?\/\/([^/@]+@)?(.*)/) || [];
+	let [, host = "", path = ""] = hostAndPath.match(/([^#/?]*)(.*)?/) || [];
+	if (protocol === "file:") path = path.replace(/\/(?=[A-Za-z]:)/, "");
+	const { pathname, search, hash } = parsePath(path);
+	return {
+		protocol: protocol.toLowerCase(),
+		auth: auth ? auth.slice(0, Math.max(0, auth.length - 1)) : "",
+		host,
+		pathname,
+		search,
+		hash,
+		[protocolRelative]: !protocol
+	};
+}
+function parsePath(input = "") {
+	const [pathname = "", search = "", hash = ""] = (input.match(/([^#?]*)(\?[^#]*)?(#.*)?/) || []).splice(1);
+	return {
+		pathname,
+		search,
+		hash
+	};
+}
+function stringifyParsedURL(parsed) {
+	const pathname = parsed.pathname || "";
+	const search = parsed.search ? (parsed.search.startsWith("?") ? "" : "?") + parsed.search : "";
+	const hash = parsed.hash || "";
+	const auth = parsed.auth ? parsed.auth + "@" : "";
+	const host = parsed.host || "";
+	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
+var FetchError = class extends Error {
+	constructor(message, opts) {
+		super(message, opts);
+		this.name = "FetchError";
+		if (opts?.cause && !this.cause) this.cause = opts.cause;
+	}
+};
+function createFetchError(ctx) {
+	const errorMessage = ctx.error?.message || ctx.error?.toString() || "";
+	const method = ctx.request?.method || ctx.options?.method || "GET";
+	const url = ctx.request?.url || String(ctx.request) || "/";
+	const fetchError = new FetchError(`${`[${method}] ${JSON.stringify(url)}`}: ${ctx.response ? `${ctx.response.status} ${ctx.response.statusText}` : "<no response>"}${errorMessage ? ` ${errorMessage}` : ""}`, ctx.error ? { cause: ctx.error } : void 0);
+	for (const key of [
+		"request",
+		"options",
+		"response"
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx[key];
+	} });
+	for (const [key, refKey] of [
+		["data", "_data"],
+		["status", "status"],
+		["statusCode", "status"],
+		["statusText", "statusText"],
+		["statusMessage", "statusText"]
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx.response && ctx.response[refKey];
+	} });
+	return fetchError;
+}
+const payloadMethods = new Set(Object.freeze([
+	"PATCH",
+	"POST",
+	"PUT",
+	"DELETE"
+]));
+function isPayloadMethod(method = "GET") {
+	return payloadMethods.has(method.toUpperCase());
+}
+function isJSONSerializable(value) {
+	if (value === void 0) return false;
+	const t = typeof value;
+	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
+	if (t !== "object") return false;
+	if (Array.isArray(value)) return true;
+	if (value.buffer) return false;
+	if (value instanceof FormData || value instanceof URLSearchParams) return false;
+	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
+}
+const textTypes = new Set([
+	"image/svg",
+	"application/xml",
+	"application/xhtml",
+	"application/html"
+]);
+const JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
+function detectResponseType(_contentType = "") {
+	if (!_contentType) return "json";
+	const contentType = _contentType.split(";").shift() || "";
+	if (JSON_RE.test(contentType)) return "json";
+	if (contentType === "text/event-stream") return "stream";
+	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
+	return "blob";
+}
+function resolveFetchOptions(request, input, defaults, Headers) {
+	const headers = mergeHeaders(input?.headers ?? request?.headers, defaults?.headers, Headers);
+	let query;
+	if (defaults?.query || defaults?.params || input?.params || input?.query) query = {
+		...defaults?.params,
+		...defaults?.query,
+		...input?.params,
+		...input?.query
+	};
+	return {
+		...defaults,
+		...input,
+		query,
+		params: query,
+		headers
+	};
+}
+function mergeHeaders(input, defaults, Headers) {
+	if (!defaults) return new Headers(input);
+	const headers = new Headers(defaults);
+	if (input) for (const [key, value] of Symbol.iterator in input || Array.isArray(input) ? input : new Headers(input)) headers.set(key, value);
+	return headers;
+}
+async function callHooks(context, hooks) {
+	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
+	else await hooks(context);
+}
+const retryStatusCodes = new Set([
+	408,
+	409,
+	425,
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+const nullBodyResponses = new Set([
+	101,
+	204,
+	205,
+	304
+]);
+function createFetch(globalOptions = {}) {
+	const { fetch = globalThis.fetch, Headers = globalThis.Headers, AbortController = globalThis.AbortController } = globalOptions;
+	async function onError(context) {
+		const isAbort = context.error && context.error.name === "AbortError" && !context.options.timeout || false;
+		if (context.options.retry !== false && !isAbort) {
+			let retries;
+			if (typeof context.options.retry === "number") retries = context.options.retry;
+			else retries = isPayloadMethod(context.options.method) ? 0 : 1;
+			const responseCode = context.response && context.response.status || 500;
+			if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
+				const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
+				if (retryDelay > 0) await new Promise((resolve) => setTimeout(resolve, retryDelay));
+				return $fetchRaw(context.request, {
+					...context.options,
+					retry: retries - 1
+				});
+			}
+		}
+		const error = createFetchError(context);
+		if (Error.captureStackTrace) Error.captureStackTrace(error, $fetchRaw);
+		throw error;
+	}
+	const $fetchRaw = async function $fetchRaw2(_request, _options = {}) {
+		const context = {
+			request: _request,
+			options: resolveFetchOptions(_request, _options, globalOptions.defaults, Headers),
+			response: void 0,
+			error: void 0
+		};
+		if (context.options.method) context.options.method = context.options.method.toUpperCase();
+		if (context.options.onRequest) {
+			await callHooks(context, context.options.onRequest);
+			if (!(context.options.headers instanceof Headers)) context.options.headers = new Headers(context.options.headers || {});
+		}
+		if (typeof context.request === "string") {
+			if (context.options.baseURL) context.request = withBase(context.request, context.options.baseURL);
+			if (context.options.query) {
+				context.request = withQuery(context.request, context.options.query);
+				delete context.options.query;
+			}
+			if ("query" in context.options) delete context.options.query;
+			if ("params" in context.options) delete context.options.params;
+		}
+		if (context.options.body && isPayloadMethod(context.options.method)) {
+			if (isJSONSerializable(context.options.body)) {
+				const contentType = context.options.headers.get("content-type");
+				if (typeof context.options.body !== "string") context.options.body = contentType === "application/x-www-form-urlencoded" ? new URLSearchParams(context.options.body).toString() : JSON.stringify(context.options.body);
+				if (!contentType) context.options.headers.set("content-type", "application/json");
+				if (!context.options.headers.has("accept")) context.options.headers.set("accept", "application/json");
+			} else if ("pipeTo" in context.options.body && typeof context.options.body.pipeTo === "function" || typeof context.options.body.pipe === "function") {
+				if (!("duplex" in context.options)) context.options.duplex = "half";
+			}
+		}
+		let abortTimeout;
+		if (!context.options.signal && context.options.timeout) {
+			const controller = new AbortController();
+			abortTimeout = setTimeout(() => {
+				const error = new Error("[TimeoutError]: The operation was aborted due to timeout");
+				error.name = "TimeoutError";
+				error.code = 23;
+				controller.abort(error);
+			}, context.options.timeout);
+			context.options.signal = controller.signal;
+		}
+		try {
+			context.response = await fetch(context.request, context.options);
+		} catch (error) {
+			context.error = error;
+			if (context.options.onRequestError) await callHooks(context, context.options.onRequestError);
+			return await onError(context);
+		} finally {
+			if (abortTimeout) clearTimeout(abortTimeout);
+		}
+		if ((context.response.body || context.response._bodyInit) && !nullBodyResponses.has(context.response.status) && context.options.method !== "HEAD") {
+			const responseType = (context.options.parseResponse ? "json" : context.options.responseType) || detectResponseType(context.response.headers.get("content-type") || "");
+			switch (responseType) {
+				case "json": {
+					const data = await context.response.text();
+					const parseFunction = context.options.parseResponse || destr;
+					context.response._data = parseFunction(data);
+					break;
+				}
+				case "stream":
+					context.response._data = context.response.body || context.response._bodyInit;
+					break;
+				default: context.response._data = await context.response[responseType]();
+			}
+		}
+		if (context.options.onResponse) await callHooks(context, context.options.onResponse);
+		if (!context.options.ignoreResponseError && context.response.status >= 400 && context.response.status < 600) {
+			if (context.options.onResponseError) await callHooks(context, context.options.onResponseError);
+			return await onError(context);
+		}
+		return context.response;
+	};
+	const $fetch = async function $fetch2(request, options) {
+		return (await $fetchRaw(request, options))._data;
+	};
+	$fetch.raw = $fetchRaw;
+	$fetch.native = (...args) => fetch(...args);
+	$fetch.create = (defaultOptions = {}, customGlobalOptions = {}) => createFetch({
+		...globalOptions,
+		...customGlobalOptions,
+		defaults: {
+			...globalOptions.defaults,
+			...customGlobalOptions.defaults,
+			...defaultOptions
+		}
+	});
+	return $fetch;
+}
+//#endregion
+//#region src/errors.ts
+const messages = {
+	invalid_credentials: "The credentials are invalid.",
+	authentication_required: "Authentication is required.",
+	request_origin_denied: "The request origin is not allowed.",
+	invalid_invitation: "The invitation is invalid.",
+	invitation_unavailable: "The invitation is not available.",
+	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	email_verification_required: "Email verification is required.",
+	invalid_workspace_selection: "The workspace selection is invalid.",
+	organization_context_too_large: "The organization context is too large.",
+	credential_rate_limited: "Credential requests are temporarily limited.",
+	state_conflict: "The authentication state conflicts with the request.",
+	access_denied: "Access is denied.",
+	identity_authority_unavailable: "Authentication is temporarily unavailable."
+};
+var AuthError = class extends Error {
+	code;
+	status;
+	retryAfterSeconds;
+	constructor(code, status, retryAfterSeconds) {
+		super(messages[code]);
+		this.name = "AuthError";
+		this.code = code;
+		this.status = status;
+		this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
+//#endregion
+//#region src/shared.ts
+const id = /^[A-Za-z0-9_-]{1,128}$/;
+const email = /^[^\s@]+@[^\s@]+$/;
+function normalizeOrigin(value, name) {
+	if (value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	}
+	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
+	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== value) throw new TypeError(`${name} must be an ASCII HTTP origin`);
+	return url.origin;
+}
+function normalizeTimeout(value) {
+	const timeout = value ?? 1e4;
+	if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 6e4) throw new TypeError("timeoutMs must be an integer from 1 to 60000");
+	return timeout;
+}
+function normalizeSession(value) {
+	if (value === null) return null;
+	if (!isObject(value) || !isObject(value.session) || !isObject(value.user)) throw authorityUnavailable();
+	const expiresAt = toDate(value.session.expiresAt);
+	const image = value.user.image;
+	if (!isId(value.session.id) || !expiresAt || !isId(value.user.id) || typeof value.user.name !== "string" || value.user.name.length > 256 || typeof value.user.email !== "string" || value.user.email.length > 320 || !email.test(value.user.email) || typeof value.user.emailVerified !== "boolean" || image !== null && image !== void 0 && (typeof image !== "string" || image.length > 2048)) throw authorityUnavailable();
+	return {
+		id: value.session.id,
+		expiresAt,
+		user: {
+			id: value.user.id,
+			name: value.user.name,
+			email: value.user.email,
+			emailVerified: value.user.emailVerified,
+			image: image ?? null
+		}
+	};
+}
+function fromAuthorityError(value, fallbackStatus, retryAfter) {
+	const mapped = mapError(isObject(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
+	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
+}
+function authorityUnavailable() {
+	return new AuthError("identity_authority_unavailable", 503);
+}
+function mapError(code, status) {
+	if (code === "authentication_required") return {
+		code,
+		status: 401
+	};
+	if (code === "request_origin_denied") return {
+		code,
+		status: 403
+	};
+	if (code === "invalid_workspace_selection") return {
+		code,
+		status: 422
+	};
+	if (code === "organization_context_too_large") return {
+		code,
+		status: 422
+	};
+	if (code === "credential_rate_limited") return {
+		code,
+		status: 429
+	};
+	if (code === "identity_authority_unavailable") return {
+		code,
+		status: 503
+	};
+	if (status === 401 || status === 400) return {
+		code: "invalid_credentials",
+		status: 401
+	};
+	if (status === 403) return {
+		code: "access_denied",
+		status: 403
+	};
+	if (status === 409) return {
+		code: "state_conflict",
+		status: 409
+	};
+	if (status === 422) return {
+		code: "invalid_workspace_selection",
+		status: 422
+	};
+	if (status === 429) return {
+		code: "credential_rate_limited",
+		status: 429
+	};
+	return {
+		code: "identity_authority_unavailable",
+		status: 503
+	};
+}
+function parseRetryAfter(value) {
+	if (!value || !/^\d+$/.test(value)) return void 0;
+	const seconds = Number(value);
+	return Number.isSafeInteger(seconds) && seconds >= 1 && seconds <= 3600 ? seconds : void 0;
+}
+function toDate(value) {
+	const result = value instanceof Date ? value : typeof value === "string" ? new Date(value) : void 0;
+	return result && Number.isFinite(result.getTime()) ? result : void 0;
+}
+function isId(value) {
+	return typeof value === "string" && id.test(value);
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/http.ts
+const MAX_RESPONSE_BYTES = 64 * 1024;
+async function requestJsonResponse(url, options) {
+	let response;
+	try {
+		response = await createFetch({ fetch: options.fetch }).raw(url, {
+			method: options.method,
+			headers: options.headers,
+			body: options.body,
+			credentials: "include",
+			retry: 0,
+			timeout: options.timeoutMs,
+			redirect: "manual",
+			signal: options.signal,
+			responseType: "stream",
+			ignoreResponseError: true
+		});
+	} catch {
+		throw authorityUnavailable();
+	}
+	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
+		const body = contentType === "application/json" ? await readJson(response) : void 0;
+		await response.body?.cancel();
+		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
+	}
+	return {
+		value: await readJson(response),
+		headers: response.headers
+	};
+}
+async function readJson(response) {
+	const length = response.headers.get("content-length");
+	if (length && (!/^\d+$/.test(length) || Number(length) > MAX_RESPONSE_BYTES)) {
+		await response.body?.cancel();
+		throw authorityUnavailable();
+	}
+	if (!response.body) throw authorityUnavailable();
+	const reader = response.body.getReader();
+	const chunks = [];
+	let size = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > MAX_RESPONSE_BYTES) throw authorityUnavailable();
+			chunks.push(value);
+		}
+	} catch (error) {
+		await reader.cancel();
+		throw error;
+	} finally {
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	try {
+		return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+	} catch {
+		throw authorityUnavailable();
+	}
+}
+//#endregion
+//#region src/device.ts
+const DEVICE_SCOPE = "openid";
+const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const MAX_TOKEN_BYTES = 16 * 1024;
+const MAX_POLLING_MS = 900 * 1e3;
+const errorMessages = {
+	device_access_denied: "Device authorization was denied.",
+	device_authorization_cancelled: "Device authorization was cancelled.",
+	device_code_expired: "Device authorization expired.",
+	invalid_device_authorization: "Device authorization is invalid.",
+	identity_authority_unavailable: "Authentication is temporarily unavailable."
+};
+var DeviceAuthorizationError = class extends Error {
+	code;
+	constructor(code) {
+		super(errorMessages[code]);
+		this.name = "DeviceAuthorizationError";
+		this.code = code;
+	}
+};
+function createDeviceAuth(options) {
+	if (!options || typeof options !== "object") throw new TypeError("device options are required");
+	const authOrigin = normalizeOrigin(options.authOrigin, "authOrigin");
+	if (!/^[A-Za-z0-9._~-]{1,64}$/.test(options.clientId)) throw new TypeError("clientId is invalid");
+	if (options.persistence && !validPersistence(options.persistence)) throw new TypeError("persistence must implement read, replace, and delete");
+	const requestFetch = options.fetch ?? globalThis.fetch;
+	if (typeof requestFetch !== "function") throw new TypeError("fetch is required");
+	const now = options.now ?? Date.now;
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	const maxPollingMs = options.maxPollingMs ?? 600 * 1e3;
+	if (!Number.isSafeInteger(maxPollingMs) || maxPollingMs < 1 || maxPollingMs > MAX_POLLING_MS) throw new TypeError("maxPollingMs must be an integer from 1 to 900000");
+	let token = null;
+	let hydrated = false;
+	let hydration = null;
+	async function getToken() {
+		if (!hydrated) {
+			hydration ??= hydrate().finally(() => {
+				hydration = null;
+			});
+			await hydration;
+		}
+		if (token && token.expiresAt.getTime() <= now()) {
+			token = null;
+			await removePersisted();
+		}
+		return token ? copyToken(token) : null;
+	}
+	async function hydrate() {
+		try {
+			const loaded = options.persistence ? normalizeToken(await persistenceCall((signal) => options.persistence.read(signal)), now()) : null;
+			if (options.persistence && !loaded) await persistenceCall((signal) => options.persistence.delete(signal));
+			token = loaded;
+		} catch {
+			token = null;
+			throw unavailable();
+		} finally {
+			hydrated = true;
+		}
+	}
+	async function requestAuthorization(requestOptions = {}) {
+		if (requestOptions.signal?.aborted) throw cancelled();
+		try {
+			return normalizeAuthorization((await requestJsonResponse(`${authOrigin}/api/v1/auth/device/code`, {
+				fetch: requestFetch,
+				timeoutMs,
+				method: "POST",
+				body: {
+					client_id: options.clientId,
+					scope: DEVICE_SCOPE
+				},
+				signal: requestOptions.signal,
+				mapError: () => invalid()
+			})).value, now());
+		} catch (error) {
+			if (requestOptions.signal?.aborted) throw cancelled();
+			if (error instanceof DeviceAuthorizationError) throw error;
+			throw unavailable();
+		}
+	}
+	async function pollForToken(authorization, pollOptions = {}) {
+		if (pollOptions.signal?.aborted) throw cancelled();
+		const normalized = normalizeAuthorizationInput(authorization, now());
+		const startedAt = now();
+		const deadline = Math.min(normalized.expiresAt.getTime(), startedAt + maxPollingMs);
+		let intervalMs = normalized.intervalSeconds * 1e3;
+		while (true) {
+			await wait(intervalMs, pollOptions.signal, deadline, now);
+			const requestBudget = deadline - now();
+			if (requestBudget <= 0) throw expired();
+			let response;
+			try {
+				response = await requestJsonResponse(`${authOrigin}/api/v1/auth/device/token`, {
+					fetch: requestFetch,
+					timeoutMs: Math.min(timeoutMs, requestBudget),
+					method: "POST",
+					body: {
+						grant_type: GRANT_TYPE,
+						device_code: normalized.deviceCode,
+						client_id: options.clientId
+					},
+					signal: pollOptions.signal,
+					mapError(value) {
+						return new DeviceProtocolError(isObject(value) && typeof value.error === "string" ? value.error : void 0);
+					}
+				});
+			} catch (error) {
+				if (pollOptions.signal?.aborted) throw cancelled();
+				if (now() >= deadline) throw expired();
+				if (error instanceof DeviceProtocolError) {
+					if (error.protocolCode === "authorization_pending") continue;
+					if (error.protocolCode === "slow_down") {
+						intervalMs += 5e3;
+						continue;
+					}
+					if (error.protocolCode === "access_denied") throw new DeviceAuthorizationError("device_access_denied");
+					if (error.protocolCode === "expired_token") throw expired();
+					if (error.protocolCode === "invalid_grant" || error.protocolCode === "invalid_request") throw invalid();
+				}
+				throw unavailable();
+			}
+			if (now() >= deadline) throw expired();
+			const next = normalizeTokenResponse(response.value, now());
+			if (options.persistence) try {
+				await persistenceCall((signal) => options.persistence.replace(copyToken(next), signal));
+			} catch {
+				token = null;
+				hydrated = true;
+				await persistenceCall((signal) => options.persistence.delete(signal)).catch(() => void 0);
+				throw unavailable();
+			}
+			token = next;
+			hydrated = true;
+			return copyToken(next);
+		}
+	}
+	async function authenticated(path, body) {
+		const current = await getToken();
+		if (!current) return null;
+		try {
+			return await requestJsonResponse(`${authOrigin}/api/v1/auth/${path}`, {
+				fetch: requestFetch,
+				timeoutMs,
+				method: body ? "POST" : "GET",
+				headers: { authorization: `Bearer ${current.accessToken}` },
+				body
+			});
+		} catch {
+			throw unavailable();
+		}
+	}
+	async function revoke(path) {
+		const current = await getToken();
+		if (!current) return;
+		try {
+			await requestJsonResponse(`${authOrigin}/api/v1/auth/${path}`, {
+				fetch: requestFetch,
+				timeoutMs,
+				method: "POST",
+				headers: { authorization: `Bearer ${current.accessToken}` },
+				body: path === "revoke-session" ? { token: current.accessToken } : void 0
+			});
+		} catch {
+			throw unavailable();
+		}
+		token = null;
+		await removePersisted();
+	}
+	async function removePersisted() {
+		if (!options.persistence) return;
+		try {
+			await persistenceCall((signal) => options.persistence.delete(signal));
+		} catch {
+			throw unavailable();
+		}
+	}
+	return {
+		requestAuthorization,
+		pollForToken,
+		getToken,
+		async getSession() {
+			const response = await authenticated("get-session");
+			return response ? normalizeSession(response.value) : null;
+		},
+		revokeCurrentDevice: () => revoke("revoke-session"),
+		revokeAllSessions: () => revoke("revoke-sessions")
+	};
+	async function persistenceCall(operation) {
+		const controller = new AbortController();
+		let timer;
+		try {
+			return await Promise.race([Promise.resolve().then(() => operation(controller.signal)), new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					controller.abort();
+					reject(unavailable());
+				}, Math.min(timeoutMs, 1e3));
+			})]);
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+	}
+}
+var DeviceProtocolError = class extends Error {
+	protocolCode;
+	constructor(protocolCode) {
+		super("Device authorization request failed");
+		this.protocolCode = protocolCode;
+	}
+};
+function normalizeAuthorization(value, currentTime) {
+	if (!isObject(value) || !boundedSecret(value.device_code) || typeof value.user_code !== "string" || !/^[A-Z0-9-]{1,32}$/.test(value.user_code) || !exactHttpsOrLocalUri(value.verification_uri) || !exactHttpsOrLocalUri(value.verification_uri_complete) || !Number.isSafeInteger(value.expires_in) || value.expires_in < 1 || value.expires_in > 900 || !Number.isSafeInteger(value.interval) || value.interval < 1 || value.interval > 60) throw unavailable();
+	return {
+		deviceCode: value.device_code,
+		userCode: value.user_code,
+		verificationUri: value.verification_uri,
+		verificationUriComplete: value.verification_uri_complete,
+		expiresAt: new Date(currentTime + value.expires_in * 1e3),
+		intervalSeconds: value.interval
+	};
+}
+function normalizeAuthorizationInput(value, currentTime) {
+	if (!value || !boundedSecret(value.deviceCode) || typeof value.userCode !== "string" || !exactHttpsOrLocalUri(value.verificationUri) || !exactHttpsOrLocalUri(value.verificationUriComplete) || !(value.expiresAt instanceof Date) || !Number.isFinite(value.expiresAt.getTime()) || value.expiresAt.getTime() <= currentTime || !Number.isSafeInteger(value.intervalSeconds) || value.intervalSeconds < 1 || value.intervalSeconds > 60) throw invalid();
+	return value;
+}
+function normalizeTokenResponse(value, currentTime) {
+	if (!isObject(value) || !boundedSecret(value.access_token) || value.token_type !== "Bearer" || value.scope !== DEVICE_SCOPE || !Number.isSafeInteger(value.expires_in) || value.expires_in < 1 || value.expires_in > 744 * 60 * 60) throw unavailable();
+	return {
+		accessToken: value.access_token,
+		tokenType: "Bearer",
+		expiresAt: new Date(currentTime + value.expires_in * 1e3),
+		scope: DEVICE_SCOPE
+	};
+}
+function normalizeToken(value, currentTime) {
+	if (value === null) return null;
+	if (!value || !boundedSecret(value.accessToken) || value.tokenType !== "Bearer" || value.scope !== DEVICE_SCOPE || !(value.expiresAt instanceof Date) || !Number.isFinite(value.expiresAt.getTime())) throw unavailable();
+	return value.expiresAt.getTime() > currentTime ? copyToken(value) : null;
+}
+function copyToken(value) {
+	return {
+		...value,
+		expiresAt: new Date(value.expiresAt)
+	};
+}
+function boundedSecret(value) {
+	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= MAX_TOKEN_BYTES;
+}
+function exactHttpsOrLocalUri(value) {
+	if (typeof value !== "string" || value.length > 2048 || /[^\x20-\x7e]/.test(value)) return false;
+	try {
+		const url = new URL(value);
+		const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1";
+		return !url.username && !url.password && (url.protocol === "https:" || local && url.protocol === "http:");
+	} catch {
+		return false;
+	}
+}
+function validPersistence(value) {
+	return typeof value.read === "function" && typeof value.replace === "function" && typeof value.delete === "function";
+}
+async function wait(milliseconds, signal, deadline, now) {
+	if (signal?.aborted) throw cancelled();
+	const remaining = deadline - now();
+	if (remaining <= 0 || milliseconds > remaining) throw expired();
+	await new Promise((resolve, reject) => {
+		const timeout = setTimeout(done, milliseconds);
+		function done() {
+			signal?.removeEventListener("abort", abort);
+			resolve();
+		}
+		function abort() {
+			clearTimeout(timeout);
+			signal?.removeEventListener("abort", abort);
+			reject(cancelled());
+		}
+		signal?.addEventListener("abort", abort, { once: true });
+	});
+}
+function invalid() {
+	return new DeviceAuthorizationError("invalid_device_authorization");
+}
+function expired() {
+	return new DeviceAuthorizationError("device_code_expired");
+}
+function cancelled() {
+	return new DeviceAuthorizationError("device_authorization_cancelled");
+}
+function unavailable() {
+	return new DeviceAuthorizationError("identity_authority_unavailable");
+}
+//#endregion
+export { DeviceAuthorizationError, createDeviceAuth };