@hexclave/dashboard-ui-components 1.0.0 → 1.0.1

package/dist/dashboard-ui-components.global.js

@@ -1641,19 +1641,23 @@ This is likely an error in Hexclave. Please make sure you are running the newest
     if (errorSinks.has(sink)) return;
     errorSinks.add(sink);
   }
-  registerErrorSink((location, error, ...extraArgs) => {
-    console.error(`\x1B[41mCaptured error in ${location}:`, errorToNiceString(error), ...extraArgs, "\x1B[0m");
+  registerErrorSink((location, error, level, ...extraArgs) => {
+    (level === "warning" ? console.warn : console.error)(`${level === "warning" ? "\x1B[43m" : "\x1B[41m"}Captured ${level === "warning" ? "warning" : "error"} in ${location}:`, errorToNiceString(error), ...extraArgs, "\x1B[0m");
   });
-  registerErrorSink((location, error, ...extraArgs) => {
+  registerErrorSink((location, error, level, ...extraArgs) => {
     globalVar.stackCapturedErrors = globalVar.stackCapturedErrors ?? [];
     globalVar.stackCapturedErrors.push({
       location,
       error,
+      level,
       extraArgs
     });
   });
+  function dispatchToSinks(location, error, level) {
+    for (const sink of errorSinks) sink(location, error, level, ...error && (typeof error === "object" || typeof error === "function") && "customCaptureExtraArgs" in error && Array.isArray(error.customCaptureExtraArgs) ? error.customCaptureExtraArgs : []);
+  }
   function captureError(location, error) {
-    for (const sink of errorSinks) sink(location, error, ...error && (typeof error === "object" || typeof error === "function") && "customCaptureExtraArgs" in error && Array.isArray(error.customCaptureExtraArgs) ? error.customCaptureExtraArgs : []);
+    dispatchToSinks(location, error, "error");
   }
   var _a;
   var StatusError = (_a = class extends Error {
@@ -4442,1322 +4446,444 @@ This is likely an error in Hexclave. Please make sure you are running the newest
     return Object.assign(Result.error(new RetryError(errors)), { attempts: totalAttempts });
   }
 
-  // ../stack-shared/dist/esm/utils/maps.js
-  var _Symbol$toStringTag;
-  var _Symbol$toStringTag2;
-  var _Symbol$toStringTag3;
-  var WeakRefIfAvailable = class {
-    constructor(value) {
-      if (typeof WeakRef === "undefined") this._ref = { deref: () => value };
-      else this._ref = new WeakRef(value);
-    }
-    deref() {
-      return this._ref.deref();
-    }
-  };
-  var _a2;
-  var IterableWeakMap = (_a2 = class {
-    constructor(entries) {
-      this[_Symbol$toStringTag] = "IterableWeakMap";
-      const mappedEntries = entries?.map((e40) => [e40[0], {
-        value: e40[1],
-        keyRef: new WeakRefIfAvailable(e40[0])
-      }]);
-      this._weakMap = new WeakMap(mappedEntries ?? []);
-      this._keyRefs = new Set(mappedEntries?.map((e40) => e40[1].keyRef) ?? []);
-    }
-    get(key) {
-      return this._weakMap.get(key)?.value;
-    }
-    set(key, value) {
-      const updated = {
-        value,
-        keyRef: this._weakMap.get(key)?.keyRef ?? new WeakRefIfAvailable(key)
-      };
-      this._weakMap.set(key, updated);
-      this._keyRefs.add(updated.keyRef);
-      return this;
-    }
-    delete(key) {
-      const res = this._weakMap.get(key);
-      if (res) {
-        this._weakMap.delete(key);
-        this._keyRefs.delete(res.keyRef);
-        return true;
-      }
-      return false;
-    }
-    has(key) {
-      return this._weakMap.has(key) && this._keyRefs.has(this._weakMap.get(key).keyRef);
-    }
-    *[Symbol.iterator]() {
-      for (const keyRef of this._keyRefs) {
-        const key = keyRef.deref();
-        const existing = key ? this._weakMap.get(key) : void 0;
-        if (!key) this._keyRefs.delete(keyRef);
-        else if (existing) yield [key, existing.value];
-      }
+  // ../stack-shared/dist/esm/utils/bytes.js
+  function decodeBase64(input) {
+    return new Uint8Array(atob(input).split("").map((char) => char.charCodeAt(0)));
+  }
+  function isBase64(input) {
+    return /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(input);
+  }
+
+  // ../stack-shared/dist/esm/utils/urls.js
+  function createUrlIfValid(...args) {
+    try {
+      return new URL(...args);
+    } catch (e40) {
+      return null;
     }
-  }, _Symbol$toStringTag = Symbol.toStringTag, _a2);
-  var _a3;
-  var MaybeWeakMap = (_a3 = class {
-    constructor(entries) {
-      this[_Symbol$toStringTag2] = "MaybeWeakMap";
-      const entriesArray = [...entries ?? []];
-      this._primitiveMap = new Map(entriesArray.filter((e40) => !this._isAllowedInWeakMap(e40[0])));
-      this._weakMap = new IterableWeakMap(entriesArray.filter((e40) => this._isAllowedInWeakMap(e40[0])));
+  }
+  function isValidUrl(url) {
+    return !!createUrlIfValid(url);
+  }
+  function isValidHostname(hostname) {
+    if (!hostname || hostname.startsWith(".") || hostname.endsWith(".") || hostname.includes("..")) return false;
+    const url = createUrlIfValid(`https://${hostname}`);
+    if (!url) return false;
+    return url.hostname === hostname;
+  }
+  function isValidHostnameWithWildcards(hostname) {
+    if (!hostname) return false;
+    if (!hostname.includes("*")) return isValidHostname(hostname);
+    if (hostname.startsWith(".") || hostname.endsWith(".")) return false;
+    if (hostname.includes("..")) return false;
+    const testHostname = hostname.replace(/\*+/g, "wildcard");
+    if (!/^[a-zA-Z0-9.-]+$/.test(testHostname)) return false;
+    const segments = hostname.split(/\*+/);
+    for (let i = 0; i < segments.length; i++) {
+      const segment = segments[i];
+      if (segment === "") continue;
+      if (i === 0 && segment.startsWith(".")) return false;
+      if (i === segments.length - 1 && segment.endsWith(".")) return false;
+      if (segment.includes("..")) return false;
     }
-    _isAllowedInWeakMap(key) {
-      return typeof key === "object" && key !== null || typeof key === "symbol" && Symbol.keyFor(key) === void 0;
+    return true;
+  }
+
+  // ../stack-shared/dist/esm/known-errors.js
+  var KnownError = class extends StatusError {
+    constructor(statusCode, humanReadableMessage, details) {
+      super(statusCode, humanReadableMessage);
+      this.statusCode = statusCode;
+      this.humanReadableMessage = humanReadableMessage;
+      this.details = details;
+      this.__stackKnownErrorBrand = "stack-known-error-brand-sentinel";
+      this.name = "KnownError";
     }
-    get(key) {
-      if (this._isAllowedInWeakMap(key)) return this._weakMap.get(key);
-      else return this._primitiveMap.get(key);
+    static isKnownError(error) {
+      return typeof error === "object" && error !== null && "__stackKnownErrorBrand" in error && error.__stackKnownErrorBrand === "stack-known-error-brand-sentinel";
     }
-    set(key, value) {
-      if (this._isAllowedInWeakMap(key)) this._weakMap.set(key, value);
-      else this._primitiveMap.set(key, value);
-      return this;
+    getBody() {
+      return new TextEncoder().encode(JSON.stringify(this.toDescriptiveJson(), void 0, 2));
     }
-    delete(key) {
-      if (this._isAllowedInWeakMap(key)) return this._weakMap.delete(key);
-      else return this._primitiveMap.delete(key);
+    getHeaders() {
+      return {
+        "Content-Type": ["application/json; charset=utf-8"],
+        "X-Stack-Known-Error": [this.errorCode],
+        "X-Hexclave-Known-Error": [this.errorCode]
+      };
     }
-    has(key) {
-      if (this._isAllowedInWeakMap(key)) return this._weakMap.has(key);
-      else return this._primitiveMap.has(key);
+    toDescriptiveJson() {
+      return {
+        code: this.errorCode,
+        ...this.details ? { details: this.details } : {},
+        error: this.humanReadableMessage
+      };
     }
-    *[Symbol.iterator]() {
-      yield* this._primitiveMap;
-      yield* this._weakMap;
+    get errorCode() {
+      return this.constructor.errorCode ?? throwErr(`Can't find error code for this KnownError. Is its constructor a KnownErrorConstructor? ${this}`);
     }
-  }, _Symbol$toStringTag2 = Symbol.toStringTag, _a3);
-  var _a4;
-  var DependenciesMap = (_a4 = class {
-    constructor() {
-      this._inner = {
-        map: new MaybeWeakMap(),
-        hasValue: false,
-        value: void 0
-      };
-      this[_Symbol$toStringTag3] = "DependenciesMap";
+    static constructorArgsFromJson(json) {
+      return [
+        400,
+        json.message,
+        json
+      ];
     }
-    _valueToResult(inner) {
-      if (inner.hasValue) return Result.ok(inner.value);
-      else return Result.error(void 0);
+    static fromJson(json) {
+      for (const [_, KnownErrorType] of Object.entries(KnownErrors)) if (json.code === KnownErrorType.prototype.errorCode) return new KnownErrorType(...KnownErrorType.constructorArgsFromJson(json));
+      throw new Error(`An error occurred. Please update your version of the Hexclave SDK. ${json.code}: ${json.message}`);
     }
-    _unwrapFromInner(dependencies, inner) {
-      if (dependencies.length === 0) return this._valueToResult(inner);
-      else {
-        const [key, ...rest] = dependencies;
-        const newInner = inner.map.get(key);
-        if (!newInner) return Result.error(void 0);
-        return this._unwrapFromInner(rest, newInner);
+  };
+  function createKnownErrorConstructor(SuperClass, errorCode, create, constructorArgsFromJson) {
+    const createFn = create === "inherit" ? identityArgs : create;
+    const constructorArgsFromJsonFn = constructorArgsFromJson === "inherit" ? SuperClass.constructorArgsFromJson : constructorArgsFromJson;
+    const _KnownErrorImpl = class _KnownErrorImpl extends SuperClass {
+      constructor(...args) {
+        super(...createFn(...args));
+        this.name = `KnownError<${errorCode}>`;
+        this.constructorArgs = args;
       }
-    }
-    _setInInner(dependencies, value, inner) {
-      if (dependencies.length === 0) {
-        const res = this._valueToResult(inner);
-        if (value.status === "ok") {
-          inner.hasValue = true;
-          inner.value = value.data;
-        } else {
-          inner.hasValue = false;
-          inner.value = void 0;
+      static constructorArgsFromJson(json) {
+        return constructorArgsFromJsonFn(json.details);
+      }
+      static isInstance(error) {
+        if (!KnownError.isKnownError(error)) return false;
+        let current = error;
+        while (true) {
+          current = Object.getPrototypeOf(current);
+          if (!current) break;
+          if ("errorCode" in current.constructor && current.constructor.errorCode === errorCode) return true;
         }
-        return res;
-      } else {
-        const [key, ...rest] = dependencies;
-        let newInner = inner.map.get(key);
-        if (!newInner) inner.map.set(key, newInner = {
-          map: new MaybeWeakMap(),
-          hasValue: false,
-          value: void 0
-        });
-        return this._setInInner(rest, value, newInner);
+        return false;
       }
-    }
-    *_iterateInner(dependencies, inner) {
-      if (inner.hasValue) yield [dependencies, inner.value];
-      for (const [key, value] of inner.map) yield* this._iterateInner([...dependencies, key], value);
-    }
-    get(dependencies) {
-      return Result.or(this._unwrapFromInner(dependencies, this._inner), void 0);
-    }
-    set(dependencies, value) {
-      this._setInInner(dependencies, Result.ok(value), this._inner);
-      return this;
-    }
-    delete(dependencies) {
-      return this._setInInner(dependencies, Result.error(void 0), this._inner).status === "ok";
-    }
-    has(dependencies) {
-      return this._unwrapFromInner(dependencies, this._inner).status === "ok";
-    }
-    clear() {
-      this._inner = {
-        map: new MaybeWeakMap(),
-        hasValue: false,
-        value: void 0
-      };
-    }
-    *[Symbol.iterator]() {
-      yield* this._iterateInner([], this._inner);
-    }
-  }, _Symbol$toStringTag3 = Symbol.toStringTag, _a4);
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/platform/browser/globalThis.js
-  var _globalThis = typeof globalThis === "object" ? globalThis : typeof self === "object" ? self : typeof window === "object" ? window : typeof global === "object" ? global : {};
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/version.js
-  var VERSION = "1.9.0";
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/internal/semver.js
-  var re = /^(\d+)\.(\d+)\.(\d+)(-(.+))?$/;
-  function _makeCompatibilityCheck(ownVersion) {
-    var acceptedVersions = /* @__PURE__ */ new Set([ownVersion]);
-    var rejectedVersions = /* @__PURE__ */ new Set();
-    var myVersionMatch = ownVersion.match(re);
-    if (!myVersionMatch) {
-      return function() {
-        return false;
-      };
-    }
-    var ownVersionParsed = {
-      major: +myVersionMatch[1],
-      minor: +myVersionMatch[2],
-      patch: +myVersionMatch[3],
-      prerelease: myVersionMatch[4]
-    };
-    if (ownVersionParsed.prerelease != null) {
-      return function isExactmatch(globalVersion) {
-        return globalVersion === ownVersion;
-      };
-    }
-    function _reject(v) {
-      rejectedVersions.add(v);
-      return false;
-    }
-    function _accept(v) {
-      acceptedVersions.add(v);
-      return true;
-    }
-    return function isCompatible2(globalVersion) {
-      if (acceptedVersions.has(globalVersion)) {
-        return true;
-      }
-      if (rejectedVersions.has(globalVersion)) {
-        return false;
-      }
-      var globalVersionMatch = globalVersion.match(re);
-      if (!globalVersionMatch) {
-        return _reject(globalVersion);
-      }
-      var globalVersionParsed = {
-        major: +globalVersionMatch[1],
-        minor: +globalVersionMatch[2],
-        patch: +globalVersionMatch[3],
-        prerelease: globalVersionMatch[4]
-      };
-      if (globalVersionParsed.prerelease != null) {
-        return _reject(globalVersion);
-      }
-      if (ownVersionParsed.major !== globalVersionParsed.major) {
-        return _reject(globalVersion);
-      }
-      if (ownVersionParsed.major === 0) {
-        if (ownVersionParsed.minor === globalVersionParsed.minor && ownVersionParsed.patch <= globalVersionParsed.patch) {
-          return _accept(globalVersion);
-        }
-        return _reject(globalVersion);
-      }
-      if (ownVersionParsed.minor <= globalVersionParsed.minor) {
-        return _accept(globalVersion);
-      }
-      return _reject(globalVersion);
     };
+    _KnownErrorImpl.errorCode = errorCode;
+    let KnownErrorImpl = _KnownErrorImpl;
+    return KnownErrorImpl;
   }
-  var isCompatible = _makeCompatibilityCheck(VERSION);
+  var UnsupportedError = createKnownErrorConstructor(KnownError, "UNSUPPORTED_ERROR", (originalErrorCode) => [
+    500,
+    `An error occurred that is not currently supported (possibly because it was added in a version of Stack that is newer than this client). The original unsupported error code was: ${originalErrorCode}`,
+    { originalErrorCode }
+  ], (json) => [json?.originalErrorCode ?? throwErr("originalErrorCode not found in UnsupportedError details")]);
+  var BodyParsingError = createKnownErrorConstructor(KnownError, "BODY_PARSING_ERROR", (message) => [400, message], (json) => [json.message]);
+  var SchemaError = createKnownErrorConstructor(KnownError, "SCHEMA_ERROR", (message) => [
+    400,
+    message || throwErr("SchemaError requires a message"),
+    { message }
+  ], (json) => [json.message]);
+  var AllOverloadsFailed = createKnownErrorConstructor(KnownError, "ALL_OVERLOADS_FAILED", (overloadErrors) => [
+    400,
+    deindent`
+      This endpoint has multiple overloads, but they all failed to process the request.
 
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/internal/global-utils.js
-  var major = VERSION.split(".")[0];
-  var GLOBAL_OPENTELEMETRY_API_KEY = Symbol.for("opentelemetry.js.api." + major);
-  var _global = _globalThis;
-  function registerGlobal(type, instance, diag, allowOverride) {
-    var _a5;
-    if (allowOverride === void 0) {
-      allowOverride = false;
-    }
-    var api = _global[GLOBAL_OPENTELEMETRY_API_KEY] = (_a5 = _global[GLOBAL_OPENTELEMETRY_API_KEY]) !== null && _a5 !== void 0 ? _a5 : {
-      version: VERSION
-    };
-    if (!allowOverride && api[type]) {
-      var err = new Error("@opentelemetry/api: Attempted duplicate registration of API: " + type);
-      diag.error(err.stack || err.message);
-      return false;
-    }
-    if (api.version !== VERSION) {
-      var err = new Error("@opentelemetry/api: Registration of version v" + api.version + " for " + type + " does not match previously registered API v" + VERSION);
-      diag.error(err.stack || err.message);
-      return false;
-    }
-    api[type] = instance;
-    diag.debug("@opentelemetry/api: Registered a global for " + type + " v" + VERSION + ".");
-    return true;
-  }
-  function getGlobal(type) {
-    var _a5, _b;
-    var globalVersion = (_a5 = _global[GLOBAL_OPENTELEMETRY_API_KEY]) === null || _a5 === void 0 ? void 0 : _a5.version;
-    if (!globalVersion || !isCompatible(globalVersion)) {
-      return;
-    }
-    return (_b = _global[GLOBAL_OPENTELEMETRY_API_KEY]) === null || _b === void 0 ? void 0 : _b[type];
-  }
-  function unregisterGlobal(type, diag) {
-    diag.debug("@opentelemetry/api: Unregistering a global for " + type + " v" + VERSION + ".");
-    var api = _global[GLOBAL_OPENTELEMETRY_API_KEY];
-    if (api) {
-      delete api[type];
+        ${overloadErrors.map((e40, i) => deindent`
+          Overload ${i + 1}: ${JSON.stringify(e40, void 0, 2)}
+        `).join("\n\n")}
+    `,
+    { overload_errors: overloadErrors }
+  ], (json) => [json?.overload_errors ?? throwErr("overload_errors not found in AllOverloadsFailed details")]);
+  var ProjectAuthenticationError = createKnownErrorConstructor(KnownError, "PROJECT_AUTHENTICATION_ERROR", "inherit", "inherit");
+  var InvalidProjectAuthentication = createKnownErrorConstructor(ProjectAuthenticationError, "INVALID_PROJECT_AUTHENTICATION", "inherit", "inherit");
+  var ProjectKeyWithoutAccessType = createKnownErrorConstructor(InvalidProjectAuthentication, "PROJECT_KEY_WITHOUT_ACCESS_TYPE", () => [400, "Either an API key or an admin access token was provided, but the x-hexclave-access-type header is missing. Set it to 'client', 'server', or 'admin' as appropriate. (The legacy x-stack-access-type header is also accepted.)"], () => []);
+  var InvalidAccessType = createKnownErrorConstructor(InvalidProjectAuthentication, "INVALID_ACCESS_TYPE", (accessType) => [400, `The x-hexclave-access-type header must be 'client', 'server', or 'admin', but was '${accessType}'. (The legacy x-stack-access-type header is also accepted.)`], (json) => [json?.accessType ?? throwErr("accessType not found in InvalidAccessType details")]);
+  var AccessTypeWithoutProjectId = createKnownErrorConstructor(InvalidProjectAuthentication, "ACCESS_TYPE_WITHOUT_PROJECT_ID", (accessType) => [
+    400,
+    deindent`
+      The x-hexclave-access-type header was '${accessType}', but the x-hexclave-project-id header was not provided. (The legacy x-stack-access-type and x-stack-project-id headers are also accepted.)
+      
+      For more information, see the docs on REST API authentication: https://docs.hexclave.com/rest-api/overview#authentication
+    `,
+    { request_type: accessType }
+  ], (json) => [json.request_type]);
+  var AccessTypeRequired = createKnownErrorConstructor(InvalidProjectAuthentication, "ACCESS_TYPE_REQUIRED", () => [400, deindent`
+      You must specify an access level for this Hexclave project. Make sure project API keys are provided (eg. x-hexclave-publishable-client-key) and you set the x-hexclave-access-type header to 'client', 'server', or 'admin'. (The legacy x-stack-* equivalents are also accepted.)
+      
+      For more information, see the docs on REST API authentication: https://docs.hexclave.com/rest-api/overview#authentication
+    `], () => []);
+  var InsufficientAccessType = createKnownErrorConstructor(InvalidProjectAuthentication, "INSUFFICIENT_ACCESS_TYPE", (actualAccessType, allowedAccessTypes) => [
+    401,
+    `The x-hexclave-access-type header must be ${allowedAccessTypes.map((s8) => `'${s8}'`).join(" or ")}, but was '${actualAccessType}'. (The legacy x-stack-access-type header is also accepted.)`,
+    {
+      actual_access_type: actualAccessType,
+      allowed_access_types: allowedAccessTypes
     }
-  }
+  ], (json) => [json.actual_access_type, json.allowed_access_types]);
+  var InvalidPublishableClientKey = createKnownErrorConstructor(InvalidProjectAuthentication, "INVALID_PUBLISHABLE_CLIENT_KEY", (projectId) => [
+    401,
+    `The publishable key is not valid for the project ${JSON.stringify(projectId)}. Does the project and/or the key exist?`,
+    { project_id: projectId }
+  ], (json) => [json.project_id]);
+  var InvalidSecretServerKey = createKnownErrorConstructor(InvalidProjectAuthentication, "INVALID_SECRET_SERVER_KEY", (projectId) => [
+    401,
+    `The secret server key is not valid for the project ${JSON.stringify(projectId)}. Does the project and/or the key exist?`,
+    { project_id: projectId }
+  ], (json) => [json.project_id]);
+  var InvalidSuperSecretAdminKey = createKnownErrorConstructor(InvalidProjectAuthentication, "INVALID_SUPER_SECRET_ADMIN_KEY", (projectId) => [
+    401,
+    `The super secret admin key is not valid for the project ${JSON.stringify(projectId)}. Does the project and/or the key exist?`,
+    { project_id: projectId }
+  ], (json) => [json.project_id]);
+  var InvalidAdminAccessToken = createKnownErrorConstructor(InvalidProjectAuthentication, "INVALID_ADMIN_ACCESS_TOKEN", "inherit", "inherit");
+  var UnparsableAdminAccessToken = createKnownErrorConstructor(InvalidAdminAccessToken, "UNPARSABLE_ADMIN_ACCESS_TOKEN", () => [401, "Admin access token is not parsable."], () => []);
+  var AdminAccessTokenExpired = createKnownErrorConstructor(InvalidAdminAccessToken, "ADMIN_ACCESS_TOKEN_EXPIRED", (expiredAt) => [
+    401,
+    `Admin access token has expired. Please refresh it and try again.${expiredAt ? ` (The access token expired at ${expiredAt.toISOString()}.)` : ""}`,
+    { expired_at_millis: expiredAt?.getTime() ?? null }
+  ], (json) => [json.expired_at_millis ? new Date(json.expired_at_millis) : void 0]);
+  var InvalidProjectForAdminAccessToken = createKnownErrorConstructor(InvalidAdminAccessToken, "INVALID_PROJECT_FOR_ADMIN_ACCESS_TOKEN", () => [401, "Admin access tokens must be created on the internal project."], () => []);
+  var AdminAccessTokenIsNotAdmin = createKnownErrorConstructor(InvalidAdminAccessToken, "ADMIN_ACCESS_TOKEN_IS_NOT_ADMIN", () => [401, "Admin access token does not have the required permissions to access this project."], () => []);
+  var ProjectAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationError, "PROJECT_AUTHENTICATION_REQUIRED", "inherit", "inherit");
+  var ClientAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationRequired, "CLIENT_AUTHENTICATION_REQUIRED", () => [401, "The publishable client key must be provided."], () => []);
+  var PublishableClientKeyRequiredForProject = createKnownErrorConstructor(ProjectAuthenticationRequired, "PUBLISHABLE_CLIENT_KEY_REQUIRED_FOR_PROJECT", (projectId) => [
+    401,
+    "Publishable client keys are required for this project. Create one in Project Keys, or disable this requirement there to allow keyless client access.",
+    { project_id: projectId ?? null }
+  ], (json) => [json.project_id ?? void 0]);
+  var ServerAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationRequired, "SERVER_AUTHENTICATION_REQUIRED", () => [401, "The secret server key must be provided."], () => []);
+  var ClientOrServerAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationRequired, "CLIENT_OR_SERVER_AUTHENTICATION_REQUIRED", () => [401, "Either the publishable client key or the secret server key must be provided."], () => []);
+  var ClientOrAdminAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationRequired, "CLIENT_OR_ADMIN_AUTHENTICATION_REQUIRED", () => [401, "Either the publishable client key or the super secret admin key must be provided."], () => []);
+  var ClientOrServerOrAdminAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationRequired, "CLIENT_OR_SERVER_OR_ADMIN_AUTHENTICATION_REQUIRED", () => [401, "Either the publishable client key, the secret server key, or the super secret admin key must be provided."], () => []);
+  var AdminAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationRequired, "ADMIN_AUTHENTICATION_REQUIRED", () => [401, "The super secret admin key must be provided."], () => []);
+  var ExpectedInternalProject = createKnownErrorConstructor(ProjectAuthenticationError, "EXPECTED_INTERNAL_PROJECT", () => [401, "The project ID is expected to be internal."], () => []);
+  var SessionAuthenticationError = createKnownErrorConstructor(KnownError, "SESSION_AUTHENTICATION_ERROR", "inherit", "inherit");
+  var InvalidSessionAuthentication = createKnownErrorConstructor(SessionAuthenticationError, "INVALID_SESSION_AUTHENTICATION", "inherit", "inherit");
+  var InvalidAccessToken = createKnownErrorConstructor(InvalidSessionAuthentication, "INVALID_ACCESS_TOKEN", "inherit", "inherit");
+  var UnparsableAccessToken = createKnownErrorConstructor(InvalidAccessToken, "UNPARSABLE_ACCESS_TOKEN", () => [401, "Access token is not parsable."], () => []);
+  var AccessTokenExpired = createKnownErrorConstructor(InvalidAccessToken, "ACCESS_TOKEN_EXPIRED", (expiredAt, projectId, userId, refreshTokenId) => [
+    401,
+    deindent`
+      Access token has expired. Please refresh it and try again.${expiredAt ? ` (The access token expired at ${expiredAt.toISOString()}.)` : ""}${projectId ? ` Project ID: ${projectId}.` : ""}${userId ? ` User ID: ${userId}.` : ""}${refreshTokenId ? ` Refresh token ID: ${refreshTokenId}.` : ""}
 
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/diag/ComponentLogger.js
-  var __read = function(o21, n9) {
-    var m5 = typeof Symbol === "function" && o21[Symbol.iterator];
-    if (!m5) return o21;
-    var i = m5.call(o21), r7, ar = [], e40;
-    try {
-      while ((n9 === void 0 || n9-- > 0) && !(r7 = i.next()).done) ar.push(r7.value);
-    } catch (error) {
-      e40 = { error };
-    } finally {
-      try {
-        if (r7 && !r7.done && (m5 = i["return"])) m5.call(i);
-      } finally {
-        if (e40) throw e40.error;
-      }
+      Debug info: Most likely, you fetched the access token before it expired (for example, in a server component, pre-rendered page, or on page load), but then didn't refresh it before it expired. If this is the case, and you're using the SDK, make sure you call getAccessToken() every time you need to use the access token. If you're not using the SDK, make sure you refresh the access token with the refresh endpoint.
+    `,
+    {
+      expired_at_millis: expiredAt?.getTime() ?? null,
+      project_id: projectId ?? null,
+      user_id: userId ?? null,
+      refresh_token_id: refreshTokenId ?? null
     }
-    return ar;
-  };
-  var __spreadArray = function(to, from, pack) {
-    if (pack || arguments.length === 2) for (var i = 0, l3 = from.length, ar; i < l3; i++) {
-      if (ar || !(i in from)) {
-        if (!ar) ar = Array.prototype.slice.call(from, 0, i);
-        ar[i] = from[i];
-      }
+  ], (json) => [
+    json.expired_at_millis ? new Date(json.expired_at_millis) : void 0,
+    json.project_id ?? void 0,
+    json.user_id ?? void 0,
+    json.refresh_token_id ?? void 0
+  ]);
+  var InvalidProjectForAccessToken = createKnownErrorConstructor(InvalidAccessToken, "INVALID_PROJECT_FOR_ACCESS_TOKEN", (expectedProjectId, actualProjectId) => [
+    401,
+    `Access token not valid for this project. Expected project ID ${JSON.stringify(expectedProjectId)}, but the token is for project ID ${JSON.stringify(actualProjectId)}.`,
+    {
+      expected_project_id: expectedProjectId,
+      actual_project_id: actualProjectId
     }
-    return to.concat(ar || Array.prototype.slice.call(from));
-  };
-  var DiagComponentLogger = (
-    /** @class */
-    function() {
-      function DiagComponentLogger2(props) {
-        this._namespace = props.namespace || "DiagComponentLogger";
-      }
-      DiagComponentLogger2.prototype.debug = function() {
-        var args = [];
-        for (var _i = 0; _i < arguments.length; _i++) {
-          args[_i] = arguments[_i];
-        }
-        return logProxy("debug", this._namespace, args);
-      };
-      DiagComponentLogger2.prototype.error = function() {
-        var args = [];
-        for (var _i = 0; _i < arguments.length; _i++) {
-          args[_i] = arguments[_i];
-        }
-        return logProxy("error", this._namespace, args);
-      };
-      DiagComponentLogger2.prototype.info = function() {
-        var args = [];
-        for (var _i = 0; _i < arguments.length; _i++) {
-          args[_i] = arguments[_i];
-        }
-        return logProxy("info", this._namespace, args);
-      };
-      DiagComponentLogger2.prototype.warn = function() {
-        var args = [];
-        for (var _i = 0; _i < arguments.length; _i++) {
-          args[_i] = arguments[_i];
-        }
-        return logProxy("warn", this._namespace, args);
-      };
-      DiagComponentLogger2.prototype.verbose = function() {
-        var args = [];
-        for (var _i = 0; _i < arguments.length; _i++) {
-          args[_i] = arguments[_i];
-        }
-        return logProxy("verbose", this._namespace, args);
-      };
-      return DiagComponentLogger2;
-    }()
-  );
-  function logProxy(funcName, namespace, args) {
-    var logger = getGlobal("diag");
-    if (!logger) {
-      return;
+  ], (json) => [json.expected_project_id, json.actual_project_id]);
+  var RefreshTokenError = createKnownErrorConstructor(KnownError, "REFRESH_TOKEN_ERROR", "inherit", "inherit");
+  var RefreshTokenNotFoundOrExpired = createKnownErrorConstructor(RefreshTokenError, "REFRESH_TOKEN_NOT_FOUND_OR_EXPIRED", () => [401, "Refresh token not found for this project, or the session has expired/been revoked."], () => []);
+  var CannotDeleteCurrentSession = createKnownErrorConstructor(RefreshTokenError, "CANNOT_DELETE_CURRENT_SESSION", () => [400, "Cannot delete the current session."], () => []);
+  var ProviderRejected = createKnownErrorConstructor(RefreshTokenError, "PROVIDER_REJECTED", () => [401, "The provider refused to refresh their token. This usually means that the provider used to authenticate the user no longer regards this session as valid, and the user must re-authenticate."], () => []);
+  var UserWithEmailAlreadyExists = createKnownErrorConstructor(KnownError, "USER_EMAIL_ALREADY_EXISTS", (email, wouldWorkIfEmailWasVerified = false) => [
+    409,
+    `A user with email ${JSON.stringify(email)} already exists${wouldWorkIfEmailWasVerified ? " but the email is not verified. Please login to your existing account with the method you used to sign up, and then verify your email to sign in with this login method." : "."}`,
+    {
+      email,
+      would_work_if_email_was_verified: wouldWorkIfEmailWasVerified
     }
-    args.unshift(namespace);
-    return logger[funcName].apply(logger, __spreadArray([], __read(args), false));
-  }
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/diag/types.js
-  var DiagLogLevel;
-  (function(DiagLogLevel2) {
-    DiagLogLevel2[DiagLogLevel2["NONE"] = 0] = "NONE";
-    DiagLogLevel2[DiagLogLevel2["ERROR"] = 30] = "ERROR";
-    DiagLogLevel2[DiagLogLevel2["WARN"] = 50] = "WARN";
-    DiagLogLevel2[DiagLogLevel2["INFO"] = 60] = "INFO";
-    DiagLogLevel2[DiagLogLevel2["DEBUG"] = 70] = "DEBUG";
-    DiagLogLevel2[DiagLogLevel2["VERBOSE"] = 80] = "VERBOSE";
-    DiagLogLevel2[DiagLogLevel2["ALL"] = 9999] = "ALL";
-  })(DiagLogLevel || (DiagLogLevel = {}));
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/diag/internal/logLevelLogger.js
-  function createLogLevelDiagLogger(maxLevel, logger) {
-    if (maxLevel < DiagLogLevel.NONE) {
-      maxLevel = DiagLogLevel.NONE;
-    } else if (maxLevel > DiagLogLevel.ALL) {
-      maxLevel = DiagLogLevel.ALL;
+  ], (json) => [json.email, json.would_work_if_email_was_verified ?? false]);
+  var EmailNotVerified = createKnownErrorConstructor(KnownError, "EMAIL_NOT_VERIFIED", () => [400, "The email is not verified."], () => []);
+  var CannotGetOwnUserWithoutUser = createKnownErrorConstructor(KnownError, "CANNOT_GET_OWN_USER_WITHOUT_USER", () => [400, "You have specified 'me' as a userId, but did not provide authentication for a user."], () => []);
+  var UserIdDoesNotExist = createKnownErrorConstructor(KnownError, "USER_ID_DOES_NOT_EXIST", (userId) => [
+    400,
+    `The given user with the ID ${userId} does not exist.`,
+    { user_id: userId }
+  ], (json) => [json.user_id]);
+  var UserNotFound = createKnownErrorConstructor(KnownError, "USER_NOT_FOUND", () => [404, "User not found."], () => []);
+  var RestrictedUserNotAllowed = createKnownErrorConstructor(KnownError, "RESTRICTED_USER_NOT_ALLOWED", (restrictedReason) => [
+    403,
+    `The user in the access token is in restricted state. Reason: ${restrictedReason.type}. Please pass the X-Stack-Allow-Restricted-User header if this is intended.`,
+    { restricted_reason: restrictedReason }
+  ], (json) => [json.restricted_reason ?? { type: "anonymous" }]);
+  var ProjectNotFound = createKnownErrorConstructor(KnownError, "PROJECT_NOT_FOUND", (projectId) => {
+    if (typeof projectId !== "string") throw new HexclaveAssertionError("projectId of KnownErrors.ProjectNotFound must be a string");
+    return [
+      404,
+      `Project ${projectId} not found or is not accessible with the current user.`,
+      { project_id: projectId }
+    ];
+  }, (json) => [json.project_id]);
+  var CurrentProjectNotFound = createKnownErrorConstructor(KnownError, "CURRENT_PROJECT_NOT_FOUND", (projectId) => [
+    400,
+    `The current project with ID ${projectId} was not found. Please check the value of the x-hexclave-project-id header. (The legacy x-stack-project-id header is also accepted.)`,
+    { project_id: projectId }
+  ], (json) => [json.project_id]);
+  var BranchDoesNotExist = createKnownErrorConstructor(KnownError, "BRANCH_DOES_NOT_EXIST", (branchId) => [
+    400,
+    `The branch with ID ${branchId} does not exist.`,
+    { branch_id: branchId }
+  ], (json) => [json.branch_id]);
+  var SignUpNotEnabled = createKnownErrorConstructor(KnownError, "SIGN_UP_NOT_ENABLED", () => [400, "Creation of new accounts is not enabled for this project. Please ask the project owner to enable it."], () => []);
+  var SignUpRejected = createKnownErrorConstructor(KnownError, "SIGN_UP_REJECTED", (message) => [
+    403,
+    message ?? "Your sign up was rejected by an administrator's sign-up rule.",
+    { message: message ?? "Your sign up was rejected by an administrator's sign-up rule." }
+  ], (json) => [json.message]);
+  var BotChallengeRequired = createKnownErrorConstructor(KnownError, "BOT_CHALLENGE_REQUIRED", () => [409, "An additional bot challenge is required before sign-up can continue."], () => []);
+  var BotChallengeFailed = createKnownErrorConstructor(KnownError, "BOT_CHALLENGE_FAILED", (message) => [
+    400,
+    message,
+    { message }
+  ], (json) => [json.message]);
+  var PasswordAuthenticationNotEnabled = createKnownErrorConstructor(KnownError, "PASSWORD_AUTHENTICATION_NOT_ENABLED", () => [400, "Password authentication is not enabled for this project."], () => []);
+  var DataVaultStoreDoesNotExist = createKnownErrorConstructor(KnownError, "DATA_VAULT_STORE_DOES_NOT_EXIST", (storeId) => [
+    400,
+    `Data vault store with ID ${storeId} does not exist.`,
+    { store_id: storeId }
+  ], (json) => [json.store_id]);
+  var DataVaultStoreHashedKeyDoesNotExist = createKnownErrorConstructor(KnownError, "DATA_VAULT_STORE_HASHED_KEY_DOES_NOT_EXIST", (storeId, hashedKey) => [
+    400,
+    `Data vault store with ID ${storeId} does not contain a key with hash ${hashedKey}.`,
+    {
+      store_id: storeId,
+      hashed_key: hashedKey
     }
-    logger = logger || {};
-    function _filterFunc(funcName, theLevel) {
-      var theFunc = logger[funcName];
-      if (typeof theFunc === "function" && maxLevel >= theLevel) {
-        return theFunc.bind(logger);
-      }
-      return function() {
-      };
+  ], (json) => [json.store_id, json.hashed_key]);
+  var PasskeyAuthenticationNotEnabled = createKnownErrorConstructor(KnownError, "PASSKEY_AUTHENTICATION_NOT_ENABLED", () => [400, "Passkey authentication is not enabled for this project."], () => []);
+  var AnonymousAccountsNotEnabled = createKnownErrorConstructor(KnownError, "ANONYMOUS_ACCOUNTS_NOT_ENABLED", () => [400, "Anonymous accounts are not enabled for this project."], () => []);
+  var AnonymousAuthenticationNotAllowed = createKnownErrorConstructor(KnownError, "ANONYMOUS_AUTHENTICATION_NOT_ALLOWED", () => [401, "X-Stack-Access-Token is for an anonymous user, but anonymous users are not enabled. Set the X-Stack-Allow-Anonymous-User header of this request to 'true' to allow anonymous users."], () => []);
+  var EmailPasswordMismatch = createKnownErrorConstructor(KnownError, "EMAIL_PASSWORD_MISMATCH", () => [400, "Wrong e-mail or password."], () => []);
+  var RedirectUrlNotWhitelisted = createKnownErrorConstructor(KnownError, "REDIRECT_URL_NOT_WHITELISTED", () => [400, "Redirect URL not whitelisted. Did you forget to add this domain to the trusted domains list on the Hexclave dashboard?"], () => []);
+  var PasswordRequirementsNotMet = createKnownErrorConstructor(KnownError, "PASSWORD_REQUIREMENTS_NOT_MET", "inherit", "inherit");
+  var PasswordTooShort = createKnownErrorConstructor(PasswordRequirementsNotMet, "PASSWORD_TOO_SHORT", (minLength) => [
+    400,
+    `Password too short. Minimum length is ${minLength}.`,
+    { min_length: minLength }
+  ], (json) => [json?.min_length ?? throwErr("min_length not found in PasswordTooShort details")]);
+  var PasswordTooLong = createKnownErrorConstructor(PasswordRequirementsNotMet, "PASSWORD_TOO_LONG", (maxLength) => [
+    400,
+    `Password too long. Maximum length is ${maxLength}.`,
+    { maxLength }
+  ], (json) => [json?.maxLength ?? throwErr("maxLength not found in PasswordTooLong details")]);
+  var UserDoesNotHavePassword = createKnownErrorConstructor(KnownError, "USER_DOES_NOT_HAVE_PASSWORD", () => [400, "This user does not have password authentication enabled."], () => []);
+  var VerificationCodeError = createKnownErrorConstructor(KnownError, "VERIFICATION_ERROR", "inherit", "inherit");
+  var VerificationCodeNotFound = createKnownErrorConstructor(VerificationCodeError, "VERIFICATION_CODE_NOT_FOUND", () => [404, "The verification code does not exist for this project."], () => []);
+  var VerificationCodeExpired = createKnownErrorConstructor(VerificationCodeError, "VERIFICATION_CODE_EXPIRED", () => [400, "The verification code has expired."], () => []);
+  var VerificationCodeAlreadyUsed = createKnownErrorConstructor(VerificationCodeError, "VERIFICATION_CODE_ALREADY_USED", () => [409, "The verification link has already been used."], () => []);
+  var VerificationCodeMaxAttemptsReached = createKnownErrorConstructor(VerificationCodeError, "VERIFICATION_CODE_MAX_ATTEMPTS_REACHED", () => [400, "The verification code nonce has reached the maximum number of attempts. This code is not valid anymore."], () => []);
+  var PasswordConfirmationMismatch = createKnownErrorConstructor(KnownError, "PASSWORD_CONFIRMATION_MISMATCH", () => [400, "Passwords do not match."], () => []);
+  var EmailAlreadyVerified = createKnownErrorConstructor(KnownError, "EMAIL_ALREADY_VERIFIED", () => [409, "The e-mail is already verified."], () => []);
+  var EmailNotAssociatedWithUser = createKnownErrorConstructor(KnownError, "EMAIL_NOT_ASSOCIATED_WITH_USER", () => [400, "The e-mail is not associated with a user that could log in with that e-mail."], () => []);
+  var EmailIsNotPrimaryEmail = createKnownErrorConstructor(KnownError, "EMAIL_IS_NOT_PRIMARY_EMAIL", (email, primaryEmail) => [
+    400,
+    `The given e-mail (${email}) must equal the user's primary e-mail (${primaryEmail}).`,
+    {
+      email,
+      primary_email: primaryEmail
     }
-    return {
-      error: _filterFunc("error", DiagLogLevel.ERROR),
-      warn: _filterFunc("warn", DiagLogLevel.WARN),
-      info: _filterFunc("info", DiagLogLevel.INFO),
-      debug: _filterFunc("debug", DiagLogLevel.DEBUG),
-      verbose: _filterFunc("verbose", DiagLogLevel.VERBOSE)
-    };
-  }
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/api/diag.js
-  var __read2 = function(o21, n9) {
-    var m5 = typeof Symbol === "function" && o21[Symbol.iterator];
-    if (!m5) return o21;
-    var i = m5.call(o21), r7, ar = [], e40;
-    try {
-      while ((n9 === void 0 || n9-- > 0) && !(r7 = i.next()).done) ar.push(r7.value);
-    } catch (error) {
-      e40 = { error };
-    } finally {
-      try {
-        if (r7 && !r7.done && (m5 = i["return"])) m5.call(i);
-      } finally {
-        if (e40) throw e40.error;
-      }
+  ], (json) => [json.email, json.primary_email]);
+  var PasskeyRegistrationFailed = createKnownErrorConstructor(KnownError, "PASSKEY_REGISTRATION_FAILED", (message) => [400, message], (json) => [json.message]);
+  var PasskeyWebAuthnError = createKnownErrorConstructor(KnownError, "PASSKEY_WEBAUTHN_ERROR", (message, code) => [
+    400,
+    message,
+    {
+      message,
+      code
     }
-    return ar;
-  };
-  var __spreadArray2 = function(to, from, pack) {
-    if (pack || arguments.length === 2) for (var i = 0, l3 = from.length, ar; i < l3; i++) {
-      if (ar || !(i in from)) {
-        if (!ar) ar = Array.prototype.slice.call(from, 0, i);
-        ar[i] = from[i];
-      }
+  ], (json) => [json.message, json.code]);
+  var PasskeyAuthenticationFailed = createKnownErrorConstructor(KnownError, "PASSKEY_AUTHENTICATION_FAILED", (message) => [400, message], (json) => [json.message]);
+  var PermissionNotFound = createKnownErrorConstructor(KnownError, "PERMISSION_NOT_FOUND", (permissionId) => [
+    404,
+    `Permission "${permissionId}" not found. Make sure you created it on the dashboard.`,
+    { permission_id: permissionId }
+  ], (json) => [json.permission_id]);
+  var PermissionScopeMismatch = createKnownErrorConstructor(KnownError, "WRONG_PERMISSION_SCOPE", (permissionId, expectedScope, actualScope) => [
+    404,
+    `Permission ${JSON.stringify(permissionId)} not found. (It was found for a different scope ${JSON.stringify(actualScope)}, but scope ${JSON.stringify(expectedScope)} was expected.)`,
+    {
+      permission_id: permissionId,
+      expected_scope: expectedScope,
+      actual_scope: actualScope
     }
-    return to.concat(ar || Array.prototype.slice.call(from));
-  };
-  var API_NAME = "diag";
-  var DiagAPI = (
-    /** @class */
-    function() {
-      function DiagAPI2() {
-        function _logProxy(funcName) {
-          return function() {
-            var args = [];
-            for (var _i = 0; _i < arguments.length; _i++) {
-              args[_i] = arguments[_i];
-            }
-            var logger = getGlobal("diag");
-            if (!logger)
-              return;
-            return logger[funcName].apply(logger, __spreadArray2([], __read2(args), false));
-          };
-        }
-        var self2 = this;
-        var setLogger = function(logger, optionsOrLogLevel) {
-          var _a5, _b, _c;
-          if (optionsOrLogLevel === void 0) {
-            optionsOrLogLevel = { logLevel: DiagLogLevel.INFO };
-          }
-          if (logger === self2) {
-            var err = new Error("Cannot use diag as the logger for itself. Please use a DiagLogger implementation like ConsoleDiagLogger or a custom implementation");
-            self2.error((_a5 = err.stack) !== null && _a5 !== void 0 ? _a5 : err.message);
-            return false;
-          }
-          if (typeof optionsOrLogLevel === "number") {
-            optionsOrLogLevel = {
-              logLevel: optionsOrLogLevel
-            };
-          }
-          var oldLogger = getGlobal("diag");
-          var newLogger = createLogLevelDiagLogger((_b = optionsOrLogLevel.logLevel) !== null && _b !== void 0 ? _b : DiagLogLevel.INFO, logger);
-          if (oldLogger && !optionsOrLogLevel.suppressOverrideMessage) {
-            var stack = (_c = new Error().stack) !== null && _c !== void 0 ? _c : "<failed to generate stacktrace>";
-            oldLogger.warn("Current logger will be overwritten from " + stack);
-            newLogger.warn("Current logger will overwrite one already registered from " + stack);
-          }
-          return registerGlobal("diag", newLogger, self2, true);
-        };
-        self2.setLogger = setLogger;
-        self2.disable = function() {
-          unregisterGlobal(API_NAME, self2);
-        };
-        self2.createComponentLogger = function(options) {
-          return new DiagComponentLogger(options);
-        };
-        self2.verbose = _logProxy("verbose");
-        self2.debug = _logProxy("debug");
-        self2.info = _logProxy("info");
-        self2.warn = _logProxy("warn");
-        self2.error = _logProxy("error");
-      }
-      DiagAPI2.instance = function() {
-        if (!this._instance) {
-          this._instance = new DiagAPI2();
-        }
-        return this._instance;
-      };
-      return DiagAPI2;
-    }()
-  );
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/context/context.js
-  function createContextKey(description) {
-    return Symbol.for(description);
-  }
-  var BaseContext = (
-    /** @class */
-    /* @__PURE__ */ function() {
-      function BaseContext2(parentContext) {
-        var self2 = this;
-        self2._currentContext = parentContext ? new Map(parentContext) : /* @__PURE__ */ new Map();
-        self2.getValue = function(key) {
-          return self2._currentContext.get(key);
-        };
-        self2.setValue = function(key, value) {
-          var context = new BaseContext2(self2._currentContext);
-          context._currentContext.set(key, value);
-          return context;
-        };
-        self2.deleteValue = function(key) {
-          var context = new BaseContext2(self2._currentContext);
-          context._currentContext.delete(key);
-          return context;
-        };
-      }
-      return BaseContext2;
-    }()
-  );
-  var ROOT_CONTEXT = new BaseContext();
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/context/NoopContextManager.js
-  var __read3 = function(o21, n9) {
-    var m5 = typeof Symbol === "function" && o21[Symbol.iterator];
-    if (!m5) return o21;
-    var i = m5.call(o21), r7, ar = [], e40;
-    try {
-      while ((n9 === void 0 || n9-- > 0) && !(r7 = i.next()).done) ar.push(r7.value);
-    } catch (error) {
-      e40 = { error };
-    } finally {
-      try {
-        if (r7 && !r7.done && (m5 = i["return"])) m5.call(i);
-      } finally {
-        if (e40) throw e40.error;
-      }
+  ], (json) => [
+    json.permission_id,
+    json.expected_scope,
+    json.actual_scope
+  ]);
+  var ContainedPermissionNotFound = createKnownErrorConstructor(KnownError, "CONTAINED_PERMISSION_NOT_FOUND", (permissionId) => [
+    400,
+    `Contained permission with ID "${permissionId}" not found. Make sure you created it on the dashboard.`,
+    { permission_id: permissionId }
+  ], (json) => [json.permission_id]);
+  var TeamNotFound = createKnownErrorConstructor(KnownError, "TEAM_NOT_FOUND", (teamId) => [
+    404,
+    `Team ${teamId} not found.`,
+    { team_id: teamId }
+  ], (json) => [json.team_id]);
+  createKnownErrorConstructor(KnownError, "TEAM_ALREADY_EXISTS", (teamId) => [
+    409,
+    `Team ${teamId} already exists.`,
+    { team_id: teamId }
+  ], (json) => [json.team_id]);
+  var TeamMembershipNotFound = createKnownErrorConstructor(KnownError, "TEAM_MEMBERSHIP_NOT_FOUND", (teamId, userId) => [
+    404,
+    `User ${userId} is not found in team ${teamId}.`,
+    {
+      team_id: teamId,
+      user_id: userId
     }
-    return ar;
-  };
-  var __spreadArray3 = function(to, from, pack) {
-    if (pack || arguments.length === 2) for (var i = 0, l3 = from.length, ar; i < l3; i++) {
-      if (ar || !(i in from)) {
-        if (!ar) ar = Array.prototype.slice.call(from, 0, i);
-        ar[i] = from[i];
-      }
+  ], (json) => [json.team_id, json.user_id]);
+  var TeamInvitationRestrictedUserNotAllowed = createKnownErrorConstructor(KnownError, "TEAM_INVITATION_RESTRICTED_USER_NOT_ALLOWED", (restrictedReason) => [
+    403,
+    `Restricted users cannot accept team invitations. Reason: ${restrictedReason.type}. Please complete the onboarding process before accepting team invitations.`,
+    { restricted_reason: restrictedReason }
+  ], (json) => [json.restricted_reason ?? { type: "anonymous" }]);
+  var TeamInvitationEmailMismatch = createKnownErrorConstructor(KnownError, "TEAM_INVITATION_EMAIL_MISMATCH", () => [403, "This team invitation was sent to a different email address. Sign in with the invited email, or add and verify that email on your account, then try again."], () => []);
+  var EmailTemplateAlreadyExists = createKnownErrorConstructor(KnownError, "EMAIL_TEMPLATE_ALREADY_EXISTS", () => [409, "Email template already exists."], () => []);
+  var OAuthConnectionNotConnectedToUser = createKnownErrorConstructor(KnownError, "OAUTH_CONNECTION_NOT_CONNECTED_TO_USER", () => [400, "The OAuth connection is not connected to any user."], () => []);
+  var OAuthConnectionAlreadyConnectedToAnotherUser = createKnownErrorConstructor(KnownError, "OAUTH_CONNECTION_ALREADY_CONNECTED_TO_ANOTHER_USER", () => [409, "The OAuth connection is already connected to another user."], () => []);
+  var OAuthConnectionDoesNotHaveRequiredScope = createKnownErrorConstructor(KnownError, "OAUTH_CONNECTION_DOES_NOT_HAVE_REQUIRED_SCOPE", () => [400, "The OAuth connection does not have the required scope."], () => []);
+  var OAuthAccessTokenNotAvailable = createKnownErrorConstructor(KnownError, "OAUTH_ACCESS_TOKEN_NOT_AVAILABLE", (provider, details) => [
+    400,
+    `Failed to retrieve an OAuth access token for the connected account (provider: ${provider}). ${details}`,
+    {
+      provider,
+      details
     }
-    return to.concat(ar || Array.prototype.slice.call(from));
-  };
-  var NoopContextManager = (
-    /** @class */
-    function() {
-      function NoopContextManager2() {
-      }
-      NoopContextManager2.prototype.active = function() {
-        return ROOT_CONTEXT;
-      };
-      NoopContextManager2.prototype.with = function(_context, fn, thisArg) {
-        var args = [];
-        for (var _i = 3; _i < arguments.length; _i++) {
-          args[_i - 3] = arguments[_i];
-        }
-        return fn.call.apply(fn, __spreadArray3([thisArg], __read3(args), false));
-      };
-      NoopContextManager2.prototype.bind = function(_context, target) {
-        return target;
-      };
-      NoopContextManager2.prototype.enable = function() {
-        return this;
-      };
-      NoopContextManager2.prototype.disable = function() {
-        return this;
-      };
-      return NoopContextManager2;
-    }()
-  );
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/api/context.js
-  var __read4 = function(o21, n9) {
-    var m5 = typeof Symbol === "function" && o21[Symbol.iterator];
-    if (!m5) return o21;
-    var i = m5.call(o21), r7, ar = [], e40;
-    try {
-      while ((n9 === void 0 || n9-- > 0) && !(r7 = i.next()).done) ar.push(r7.value);
-    } catch (error) {
-      e40 = { error };
-    } finally {
-      try {
-        if (r7 && !r7.done && (m5 = i["return"])) m5.call(i);
-      } finally {
-        if (e40) throw e40.error;
-      }
+  ], (json) => [json.provider, json.details]);
+  var OAuthExtraScopeNotAvailableWithSharedOAuthKeys = createKnownErrorConstructor(KnownError, "OAUTH_EXTRA_SCOPE_NOT_AVAILABLE_WITH_SHARED_OAUTH_KEYS", () => [400, "Extra scopes are not available with shared OAuth keys. Please add your own OAuth keys on the Stack dashboard to use extra scopes."], () => []);
+  var OAuthAccessTokenNotAvailableWithSharedOAuthKeys = createKnownErrorConstructor(KnownError, "OAUTH_ACCESS_TOKEN_NOT_AVAILABLE_WITH_SHARED_OAUTH_KEYS", () => [400, "Access tokens are not available with shared OAuth keys. Please add your own OAuth keys on the Stack dashboard to use access tokens."], () => []);
+  var InvalidOAuthClientIdOrSecret = createKnownErrorConstructor(KnownError, "INVALID_OAUTH_CLIENT_ID_OR_SECRET", (clientId) => [
+    400,
+    "The OAuth client ID or secret is invalid. The client ID must be equal to the project ID (potentially with a hash and a branch ID), and the client secret must be a publishable client key.",
+    { client_id: clientId ?? null }
+  ], (json) => [json.client_id ?? void 0]);
+  var InvalidScope = createKnownErrorConstructor(KnownError, "INVALID_SCOPE", (scope) => [400, `The scope "${scope}" is not a valid OAuth scope for Stack.`], (json) => [json.scope]);
+  var UserAlreadyConnectedToAnotherOAuthConnection = createKnownErrorConstructor(KnownError, "USER_ALREADY_CONNECTED_TO_ANOTHER_OAUTH_CONNECTION", () => [409, "The user is already connected to another OAuth account. Did you maybe selected the wrong account?"], () => []);
+  var OuterOAuthTimeout = createKnownErrorConstructor(KnownError, "OUTER_OAUTH_TIMEOUT", () => [408, "The OAuth flow has timed out. Please sign in again."], () => []);
+  var OAuthProviderNotFoundOrNotEnabled = createKnownErrorConstructor(KnownError, "OAUTH_PROVIDER_NOT_FOUND_OR_NOT_ENABLED", () => [400, "The OAuth provider is not found or not enabled."], () => []);
+  var AppleBundleIdNotConfigured = createKnownErrorConstructor(KnownError, "APPLE_BUNDLE_ID_NOT_CONFIGURED", () => [400, "Apple Sign In is enabled, but no Bundle IDs are configured. Please add your app's Bundle ID in the Hexclave dashboard under OAuth Providers > Apple > Apple Bundle IDs."], () => []);
+  var OAuthProviderAccountIdAlreadyUsedForSignIn = createKnownErrorConstructor(KnownError, "OAUTH_PROVIDER_ACCOUNT_ID_ALREADY_USED_FOR_SIGN_IN", () => [400, `A provider with the same account ID is already used for signing in.`], () => []);
+  var MultiFactorAuthenticationRequired = createKnownErrorConstructor(KnownError, "MULTI_FACTOR_AUTHENTICATION_REQUIRED", (attemptCode) => [
+    400,
+    `Multi-factor authentication is required for this user.`,
+    { attempt_code: attemptCode }
+  ], (json) => [json.attempt_code]);
+  var InvalidTotpCode = createKnownErrorConstructor(KnownError, "INVALID_TOTP_CODE", () => [400, "The TOTP code is invalid. Please try again."], () => []);
+  var UserAuthenticationRequired = createKnownErrorConstructor(KnownError, "USER_AUTHENTICATION_REQUIRED", () => [401, "User authentication required for this endpoint."], () => []);
+  var TeamMembershipAlreadyExists = createKnownErrorConstructor(KnownError, "TEAM_MEMBERSHIP_ALREADY_EXISTS", () => [409, "Team membership already exists."], () => []);
+  var ProjectPermissionRequired = createKnownErrorConstructor(KnownError, "PROJECT_PERMISSION_REQUIRED", (userId, permissionId) => [
+    401,
+    `User ${userId} does not have permission ${permissionId}.`,
+    {
+      user_id: userId,
+      permission_id: permissionId
     }
-    return ar;
-  };
-  var __spreadArray4 = function(to, from, pack) {
-    if (pack || arguments.length === 2) for (var i = 0, l3 = from.length, ar; i < l3; i++) {
-      if (ar || !(i in from)) {
-        if (!ar) ar = Array.prototype.slice.call(from, 0, i);
-        ar[i] = from[i];
-      }
-    }
-    return to.concat(ar || Array.prototype.slice.call(from));
-  };
-  var API_NAME2 = "context";
-  var NOOP_CONTEXT_MANAGER = new NoopContextManager();
-  var ContextAPI = (
-    /** @class */
-    function() {
-      function ContextAPI2() {
-      }
-      ContextAPI2.getInstance = function() {
-        if (!this._instance) {
-          this._instance = new ContextAPI2();
-        }
-        return this._instance;
-      };
-      ContextAPI2.prototype.setGlobalContextManager = function(contextManager) {
-        return registerGlobal(API_NAME2, contextManager, DiagAPI.instance());
-      };
-      ContextAPI2.prototype.active = function() {
-        return this._getContextManager().active();
-      };
-      ContextAPI2.prototype.with = function(context, fn, thisArg) {
-        var _a5;
-        var args = [];
-        for (var _i = 3; _i < arguments.length; _i++) {
-          args[_i - 3] = arguments[_i];
-        }
-        return (_a5 = this._getContextManager()).with.apply(_a5, __spreadArray4([context, fn, thisArg], __read4(args), false));
-      };
-      ContextAPI2.prototype.bind = function(context, target) {
-        return this._getContextManager().bind(context, target);
-      };
-      ContextAPI2.prototype._getContextManager = function() {
-        return getGlobal(API_NAME2) || NOOP_CONTEXT_MANAGER;
-      };
-      ContextAPI2.prototype.disable = function() {
-        this._getContextManager().disable();
-        unregisterGlobal(API_NAME2, DiagAPI.instance());
-      };
-      return ContextAPI2;
-    }()
-  );
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/trace_flags.js
-  var TraceFlags;
-  (function(TraceFlags2) {
-    TraceFlags2[TraceFlags2["NONE"] = 0] = "NONE";
-    TraceFlags2[TraceFlags2["SAMPLED"] = 1] = "SAMPLED";
-  })(TraceFlags || (TraceFlags = {}));
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/invalid-span-constants.js
-  var INVALID_SPANID = "0000000000000000";
-  var INVALID_TRACEID = "00000000000000000000000000000000";
-  var INVALID_SPAN_CONTEXT = {
-    traceId: INVALID_TRACEID,
-    spanId: INVALID_SPANID,
-    traceFlags: TraceFlags.NONE
-  };
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/NonRecordingSpan.js
-  var NonRecordingSpan = (
-    /** @class */
-    function() {
-      function NonRecordingSpan2(_spanContext) {
-        if (_spanContext === void 0) {
-          _spanContext = INVALID_SPAN_CONTEXT;
-        }
-        this._spanContext = _spanContext;
-      }
-      NonRecordingSpan2.prototype.spanContext = function() {
-        return this._spanContext;
-      };
-      NonRecordingSpan2.prototype.setAttribute = function(_key, _value) {
-        return this;
-      };
-      NonRecordingSpan2.prototype.setAttributes = function(_attributes) {
-        return this;
-      };
-      NonRecordingSpan2.prototype.addEvent = function(_name, _attributes) {
-        return this;
-      };
-      NonRecordingSpan2.prototype.addLink = function(_link) {
-        return this;
-      };
-      NonRecordingSpan2.prototype.addLinks = function(_links) {
-        return this;
-      };
-      NonRecordingSpan2.prototype.setStatus = function(_status) {
-        return this;
-      };
-      NonRecordingSpan2.prototype.updateName = function(_name) {
-        return this;
-      };
-      NonRecordingSpan2.prototype.end = function(_endTime) {
-      };
-      NonRecordingSpan2.prototype.isRecording = function() {
-        return false;
-      };
-      NonRecordingSpan2.prototype.recordException = function(_exception, _time) {
-      };
-      return NonRecordingSpan2;
-    }()
-  );
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/context-utils.js
-  var SPAN_KEY = createContextKey("OpenTelemetry Context Key SPAN");
-  function getSpan(context) {
-    return context.getValue(SPAN_KEY) || void 0;
-  }
-  function getActiveSpan() {
-    return getSpan(ContextAPI.getInstance().active());
-  }
-  function setSpan(context, span) {
-    return context.setValue(SPAN_KEY, span);
-  }
-  function deleteSpan(context) {
-    return context.deleteValue(SPAN_KEY);
-  }
-  function setSpanContext(context, spanContext) {
-    return setSpan(context, new NonRecordingSpan(spanContext));
-  }
-  function getSpanContext(context) {
-    var _a5;
-    return (_a5 = getSpan(context)) === null || _a5 === void 0 ? void 0 : _a5.spanContext();
-  }
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/spancontext-utils.js
-  var VALID_TRACEID_REGEX = /^([0-9a-f]{32})$/i;
-  var VALID_SPANID_REGEX = /^[0-9a-f]{16}$/i;
-  function isValidTraceId(traceId) {
-    return VALID_TRACEID_REGEX.test(traceId) && traceId !== INVALID_TRACEID;
-  }
-  function isValidSpanId(spanId) {
-    return VALID_SPANID_REGEX.test(spanId) && spanId !== INVALID_SPANID;
-  }
-  function isSpanContextValid(spanContext) {
-    return isValidTraceId(spanContext.traceId) && isValidSpanId(spanContext.spanId);
-  }
-  function wrapSpanContext(spanContext) {
-    return new NonRecordingSpan(spanContext);
-  }
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/NoopTracer.js
-  var contextApi = ContextAPI.getInstance();
-  var NoopTracer = (
-    /** @class */
-    function() {
-      function NoopTracer2() {
-      }
-      NoopTracer2.prototype.startSpan = function(name, options, context) {
-        if (context === void 0) {
-          context = contextApi.active();
-        }
-        var root = Boolean(options === null || options === void 0 ? void 0 : options.root);
-        if (root) {
-          return new NonRecordingSpan();
-        }
-        var parentFromContext = context && getSpanContext(context);
-        if (isSpanContext(parentFromContext) && isSpanContextValid(parentFromContext)) {
-          return new NonRecordingSpan(parentFromContext);
-        } else {
-          return new NonRecordingSpan();
-        }
-      };
-      NoopTracer2.prototype.startActiveSpan = function(name, arg2, arg3, arg4) {
-        var opts;
-        var ctx;
-        var fn;
-        if (arguments.length < 2) {
-          return;
-        } else if (arguments.length === 2) {
-          fn = arg2;
-        } else if (arguments.length === 3) {
-          opts = arg2;
-          fn = arg3;
-        } else {
-          opts = arg2;
-          ctx = arg3;
-          fn = arg4;
-        }
-        var parentContext = ctx !== null && ctx !== void 0 ? ctx : contextApi.active();
-        var span = this.startSpan(name, opts, parentContext);
-        var contextWithSpanSet = setSpan(parentContext, span);
-        return contextApi.with(contextWithSpanSet, fn, void 0, span);
-      };
-      return NoopTracer2;
-    }()
-  );
-  function isSpanContext(spanContext) {
-    return typeof spanContext === "object" && typeof spanContext["spanId"] === "string" && typeof spanContext["traceId"] === "string" && typeof spanContext["traceFlags"] === "number";
-  }
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/ProxyTracer.js
-  var NOOP_TRACER = new NoopTracer();
-  var ProxyTracer = (
-    /** @class */
-    function() {
-      function ProxyTracer2(_provider, name, version, options) {
-        this._provider = _provider;
-        this.name = name;
-        this.version = version;
-        this.options = options;
-      }
-      ProxyTracer2.prototype.startSpan = function(name, options, context) {
-        return this._getTracer().startSpan(name, options, context);
-      };
-      ProxyTracer2.prototype.startActiveSpan = function(_name, _options, _context, _fn) {
-        var tracer2 = this._getTracer();
-        return Reflect.apply(tracer2.startActiveSpan, tracer2, arguments);
-      };
-      ProxyTracer2.prototype._getTracer = function() {
-        if (this._delegate) {
-          return this._delegate;
-        }
-        var tracer2 = this._provider.getDelegateTracer(this.name, this.version, this.options);
-        if (!tracer2) {
-          return NOOP_TRACER;
-        }
-        this._delegate = tracer2;
-        return this._delegate;
-      };
-      return ProxyTracer2;
-    }()
-  );
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/NoopTracerProvider.js
-  var NoopTracerProvider = (
-    /** @class */
-    function() {
-      function NoopTracerProvider2() {
-      }
-      NoopTracerProvider2.prototype.getTracer = function(_name, _version, _options) {
-        return new NoopTracer();
-      };
-      return NoopTracerProvider2;
-    }()
-  );
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/ProxyTracerProvider.js
-  var NOOP_TRACER_PROVIDER = new NoopTracerProvider();
-  var ProxyTracerProvider = (
-    /** @class */
-    function() {
-      function ProxyTracerProvider2() {
-      }
-      ProxyTracerProvider2.prototype.getTracer = function(name, version, options) {
-        var _a5;
-        return (_a5 = this.getDelegateTracer(name, version, options)) !== null && _a5 !== void 0 ? _a5 : new ProxyTracer(this, name, version, options);
-      };
-      ProxyTracerProvider2.prototype.getDelegate = function() {
-        var _a5;
-        return (_a5 = this._delegate) !== null && _a5 !== void 0 ? _a5 : NOOP_TRACER_PROVIDER;
-      };
-      ProxyTracerProvider2.prototype.setDelegate = function(delegate) {
-        this._delegate = delegate;
-      };
-      ProxyTracerProvider2.prototype.getDelegateTracer = function(name, version, options) {
-        var _a5;
-        return (_a5 = this._delegate) === null || _a5 === void 0 ? void 0 : _a5.getTracer(name, version, options);
-      };
-      return ProxyTracerProvider2;
-    }()
-  );
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/api/trace.js
-  var API_NAME3 = "trace";
-  var TraceAPI = (
-    /** @class */
-    function() {
-      function TraceAPI2() {
-        this._proxyTracerProvider = new ProxyTracerProvider();
-        this.wrapSpanContext = wrapSpanContext;
-        this.isSpanContextValid = isSpanContextValid;
-        this.deleteSpan = deleteSpan;
-        this.getSpan = getSpan;
-        this.getActiveSpan = getActiveSpan;
-        this.getSpanContext = getSpanContext;
-        this.setSpan = setSpan;
-        this.setSpanContext = setSpanContext;
-      }
-      TraceAPI2.getInstance = function() {
-        if (!this._instance) {
-          this._instance = new TraceAPI2();
-        }
-        return this._instance;
-      };
-      TraceAPI2.prototype.setGlobalTracerProvider = function(provider) {
-        var success = registerGlobal(API_NAME3, this._proxyTracerProvider, DiagAPI.instance());
-        if (success) {
-          this._proxyTracerProvider.setDelegate(provider);
-        }
-        return success;
-      };
-      TraceAPI2.prototype.getTracerProvider = function() {
-        return getGlobal(API_NAME3) || this._proxyTracerProvider;
-      };
-      TraceAPI2.prototype.getTracer = function(name, version) {
-        return this.getTracerProvider().getTracer(name, version);
-      };
-      TraceAPI2.prototype.disable = function() {
-        unregisterGlobal(API_NAME3, DiagAPI.instance());
-        this._proxyTracerProvider = new ProxyTracerProvider();
-      };
-      return TraceAPI2;
-    }()
-  );
-
-  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace-api.js
-  var trace = TraceAPI.getInstance();
-
-  // ../stack-shared/dist/esm/utils/telemetry.js
-  var tracer = trace.getTracer("stack-tracer");
-  async function traceSpan(optionsOrDescription, fn) {
-    let options = typeof optionsOrDescription === "string" ? { description: optionsOrDescription } : optionsOrDescription;
-    return await tracer.startActiveSpan(`STACK: ${options.description}`, async (span) => {
-      if (options.attributes) for (const [key, value] of Object.entries(options.attributes)) span.setAttribute(key, value);
-      try {
-        return await fn(span);
-      } finally {
-        span.end();
-      }
-    });
-  }
-
-  // ../stack-shared/dist/esm/known-errors.js
-  var KnownError = class extends StatusError {
-    constructor(statusCode, humanReadableMessage, details) {
-      super(statusCode, humanReadableMessage);
-      this.statusCode = statusCode;
-      this.humanReadableMessage = humanReadableMessage;
-      this.details = details;
-      this.__stackKnownErrorBrand = "stack-known-error-brand-sentinel";
-      this.name = "KnownError";
-    }
-    static isKnownError(error) {
-      return typeof error === "object" && error !== null && "__stackKnownErrorBrand" in error && error.__stackKnownErrorBrand === "stack-known-error-brand-sentinel";
-    }
-    getBody() {
-      return new TextEncoder().encode(JSON.stringify(this.toDescriptiveJson(), void 0, 2));
-    }
-    getHeaders() {
-      return {
-        "Content-Type": ["application/json; charset=utf-8"],
-        "X-Stack-Known-Error": [this.errorCode],
-        "X-Hexclave-Known-Error": [this.errorCode]
-      };
-    }
-    toDescriptiveJson() {
-      return {
-        code: this.errorCode,
-        ...this.details ? { details: this.details } : {},
-        error: this.humanReadableMessage
-      };
-    }
-    get errorCode() {
-      return this.constructor.errorCode ?? throwErr(`Can't find error code for this KnownError. Is its constructor a KnownErrorConstructor? ${this}`);
-    }
-    static constructorArgsFromJson(json) {
-      return [
-        400,
-        json.message,
-        json
-      ];
-    }
-    static fromJson(json) {
-      for (const [_, KnownErrorType] of Object.entries(KnownErrors)) if (json.code === KnownErrorType.prototype.errorCode) return new KnownErrorType(...KnownErrorType.constructorArgsFromJson(json));
-      throw new Error(`An error occurred. Please update your version of the Hexclave SDK. ${json.code}: ${json.message}`);
-    }
-  };
-  function createKnownErrorConstructor(SuperClass, errorCode, create, constructorArgsFromJson) {
-    const createFn = create === "inherit" ? identityArgs : create;
-    const constructorArgsFromJsonFn = constructorArgsFromJson === "inherit" ? SuperClass.constructorArgsFromJson : constructorArgsFromJson;
-    const _KnownErrorImpl = class _KnownErrorImpl extends SuperClass {
-      constructor(...args) {
-        super(...createFn(...args));
-        this.name = `KnownError<${errorCode}>`;
-        this.constructorArgs = args;
-      }
-      static constructorArgsFromJson(json) {
-        return constructorArgsFromJsonFn(json.details);
-      }
-      static isInstance(error) {
-        if (!KnownError.isKnownError(error)) return false;
-        let current = error;
-        while (true) {
-          current = Object.getPrototypeOf(current);
-          if (!current) break;
-          if ("errorCode" in current.constructor && current.constructor.errorCode === errorCode) return true;
-        }
-        return false;
-      }
-    };
-    _KnownErrorImpl.errorCode = errorCode;
-    let KnownErrorImpl = _KnownErrorImpl;
-    return KnownErrorImpl;
-  }
-  var UnsupportedError = createKnownErrorConstructor(KnownError, "UNSUPPORTED_ERROR", (originalErrorCode) => [
-    500,
-    `An error occurred that is not currently supported (possibly because it was added in a version of Stack that is newer than this client). The original unsupported error code was: ${originalErrorCode}`,
-    { originalErrorCode }
-  ], (json) => [json?.originalErrorCode ?? throwErr("originalErrorCode not found in UnsupportedError details")]);
-  var BodyParsingError = createKnownErrorConstructor(KnownError, "BODY_PARSING_ERROR", (message) => [400, message], (json) => [json.message]);
-  var SchemaError = createKnownErrorConstructor(KnownError, "SCHEMA_ERROR", (message) => [
-    400,
-    message || throwErr("SchemaError requires a message"),
-    { message }
-  ], (json) => [json.message]);
-  var AllOverloadsFailed = createKnownErrorConstructor(KnownError, "ALL_OVERLOADS_FAILED", (overloadErrors) => [
-    400,
-    deindent`
-      This endpoint has multiple overloads, but they all failed to process the request.
-
-        ${overloadErrors.map((e40, i) => deindent`
-          Overload ${i + 1}: ${JSON.stringify(e40, void 0, 2)}
-        `).join("\n\n")}
-    `,
-    { overload_errors: overloadErrors }
-  ], (json) => [json?.overload_errors ?? throwErr("overload_errors not found in AllOverloadsFailed details")]);
-  var ProjectAuthenticationError = createKnownErrorConstructor(KnownError, "PROJECT_AUTHENTICATION_ERROR", "inherit", "inherit");
-  var InvalidProjectAuthentication = createKnownErrorConstructor(ProjectAuthenticationError, "INVALID_PROJECT_AUTHENTICATION", "inherit", "inherit");
-  var ProjectKeyWithoutAccessType = createKnownErrorConstructor(InvalidProjectAuthentication, "PROJECT_KEY_WITHOUT_ACCESS_TYPE", () => [400, "Either an API key or an admin access token was provided, but the x-hexclave-access-type header is missing. Set it to 'client', 'server', or 'admin' as appropriate. (The legacy x-stack-access-type header is also accepted.)"], () => []);
-  var InvalidAccessType = createKnownErrorConstructor(InvalidProjectAuthentication, "INVALID_ACCESS_TYPE", (accessType) => [400, `The x-hexclave-access-type header must be 'client', 'server', or 'admin', but was '${accessType}'. (The legacy x-stack-access-type header is also accepted.)`], (json) => [json?.accessType ?? throwErr("accessType not found in InvalidAccessType details")]);
-  var AccessTypeWithoutProjectId = createKnownErrorConstructor(InvalidProjectAuthentication, "ACCESS_TYPE_WITHOUT_PROJECT_ID", (accessType) => [
-    400,
-    deindent`
-      The x-hexclave-access-type header was '${accessType}', but the x-hexclave-project-id header was not provided. (The legacy x-stack-access-type and x-stack-project-id headers are also accepted.)
-      
-      For more information, see the docs on REST API authentication: https://docs.hexclave.com/rest-api/overview#authentication
-    `,
-    { request_type: accessType }
-  ], (json) => [json.request_type]);
-  var AccessTypeRequired = createKnownErrorConstructor(InvalidProjectAuthentication, "ACCESS_TYPE_REQUIRED", () => [400, deindent`
-      You must specify an access level for this Hexclave project. Make sure project API keys are provided (eg. x-hexclave-publishable-client-key) and you set the x-hexclave-access-type header to 'client', 'server', or 'admin'. (The legacy x-stack-* equivalents are also accepted.)
-      
-      For more information, see the docs on REST API authentication: https://docs.hexclave.com/rest-api/overview#authentication
-    `], () => []);
-  var InsufficientAccessType = createKnownErrorConstructor(InvalidProjectAuthentication, "INSUFFICIENT_ACCESS_TYPE", (actualAccessType, allowedAccessTypes) => [
-    401,
-    `The x-hexclave-access-type header must be ${allowedAccessTypes.map((s8) => `'${s8}'`).join(" or ")}, but was '${actualAccessType}'. (The legacy x-stack-access-type header is also accepted.)`,
-    {
-      actual_access_type: actualAccessType,
-      allowed_access_types: allowedAccessTypes
-    }
-  ], (json) => [json.actual_access_type, json.allowed_access_types]);
-  var InvalidPublishableClientKey = createKnownErrorConstructor(InvalidProjectAuthentication, "INVALID_PUBLISHABLE_CLIENT_KEY", (projectId) => [
-    401,
-    `The publishable key is not valid for the project ${JSON.stringify(projectId)}. Does the project and/or the key exist?`,
-    { project_id: projectId }
-  ], (json) => [json.project_id]);
-  var InvalidSecretServerKey = createKnownErrorConstructor(InvalidProjectAuthentication, "INVALID_SECRET_SERVER_KEY", (projectId) => [
-    401,
-    `The secret server key is not valid for the project ${JSON.stringify(projectId)}. Does the project and/or the key exist?`,
-    { project_id: projectId }
-  ], (json) => [json.project_id]);
-  var InvalidSuperSecretAdminKey = createKnownErrorConstructor(InvalidProjectAuthentication, "INVALID_SUPER_SECRET_ADMIN_KEY", (projectId) => [
-    401,
-    `The super secret admin key is not valid for the project ${JSON.stringify(projectId)}. Does the project and/or the key exist?`,
-    { project_id: projectId }
-  ], (json) => [json.project_id]);
-  var InvalidAdminAccessToken = createKnownErrorConstructor(InvalidProjectAuthentication, "INVALID_ADMIN_ACCESS_TOKEN", "inherit", "inherit");
-  var UnparsableAdminAccessToken = createKnownErrorConstructor(InvalidAdminAccessToken, "UNPARSABLE_ADMIN_ACCESS_TOKEN", () => [401, "Admin access token is not parsable."], () => []);
-  var AdminAccessTokenExpired = createKnownErrorConstructor(InvalidAdminAccessToken, "ADMIN_ACCESS_TOKEN_EXPIRED", (expiredAt) => [
-    401,
-    `Admin access token has expired. Please refresh it and try again.${expiredAt ? ` (The access token expired at ${expiredAt.toISOString()}.)` : ""}`,
-    { expired_at_millis: expiredAt?.getTime() ?? null }
-  ], (json) => [json.expired_at_millis ? new Date(json.expired_at_millis) : void 0]);
-  var InvalidProjectForAdminAccessToken = createKnownErrorConstructor(InvalidAdminAccessToken, "INVALID_PROJECT_FOR_ADMIN_ACCESS_TOKEN", () => [401, "Admin access tokens must be created on the internal project."], () => []);
-  var AdminAccessTokenIsNotAdmin = createKnownErrorConstructor(InvalidAdminAccessToken, "ADMIN_ACCESS_TOKEN_IS_NOT_ADMIN", () => [401, "Admin access token does not have the required permissions to access this project."], () => []);
-  var ProjectAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationError, "PROJECT_AUTHENTICATION_REQUIRED", "inherit", "inherit");
-  var ClientAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationRequired, "CLIENT_AUTHENTICATION_REQUIRED", () => [401, "The publishable client key must be provided."], () => []);
-  var PublishableClientKeyRequiredForProject = createKnownErrorConstructor(ProjectAuthenticationRequired, "PUBLISHABLE_CLIENT_KEY_REQUIRED_FOR_PROJECT", (projectId) => [
-    401,
-    "Publishable client keys are required for this project. Create one in Project Keys, or disable this requirement there to allow keyless client access.",
-    { project_id: projectId ?? null }
-  ], (json) => [json.project_id ?? void 0]);
-  var ServerAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationRequired, "SERVER_AUTHENTICATION_REQUIRED", () => [401, "The secret server key must be provided."], () => []);
-  var ClientOrServerAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationRequired, "CLIENT_OR_SERVER_AUTHENTICATION_REQUIRED", () => [401, "Either the publishable client key or the secret server key must be provided."], () => []);
-  var ClientOrAdminAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationRequired, "CLIENT_OR_ADMIN_AUTHENTICATION_REQUIRED", () => [401, "Either the publishable client key or the super secret admin key must be provided."], () => []);
-  var ClientOrServerOrAdminAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationRequired, "CLIENT_OR_SERVER_OR_ADMIN_AUTHENTICATION_REQUIRED", () => [401, "Either the publishable client key, the secret server key, or the super secret admin key must be provided."], () => []);
-  var AdminAuthenticationRequired = createKnownErrorConstructor(ProjectAuthenticationRequired, "ADMIN_AUTHENTICATION_REQUIRED", () => [401, "The super secret admin key must be provided."], () => []);
-  var ExpectedInternalProject = createKnownErrorConstructor(ProjectAuthenticationError, "EXPECTED_INTERNAL_PROJECT", () => [401, "The project ID is expected to be internal."], () => []);
-  var SessionAuthenticationError = createKnownErrorConstructor(KnownError, "SESSION_AUTHENTICATION_ERROR", "inherit", "inherit");
-  var InvalidSessionAuthentication = createKnownErrorConstructor(SessionAuthenticationError, "INVALID_SESSION_AUTHENTICATION", "inherit", "inherit");
-  var InvalidAccessToken = createKnownErrorConstructor(InvalidSessionAuthentication, "INVALID_ACCESS_TOKEN", "inherit", "inherit");
-  var UnparsableAccessToken = createKnownErrorConstructor(InvalidAccessToken, "UNPARSABLE_ACCESS_TOKEN", () => [401, "Access token is not parsable."], () => []);
-  var AccessTokenExpired = createKnownErrorConstructor(InvalidAccessToken, "ACCESS_TOKEN_EXPIRED", (expiredAt, projectId, userId, refreshTokenId) => [
-    401,
-    deindent`
-      Access token has expired. Please refresh it and try again.${expiredAt ? ` (The access token expired at ${expiredAt.toISOString()}.)` : ""}${projectId ? ` Project ID: ${projectId}.` : ""}${userId ? ` User ID: ${userId}.` : ""}${refreshTokenId ? ` Refresh token ID: ${refreshTokenId}.` : ""}
-
-      Debug info: Most likely, you fetched the access token before it expired (for example, in a server component, pre-rendered page, or on page load), but then didn't refresh it before it expired. If this is the case, and you're using the SDK, make sure you call getAccessToken() every time you need to use the access token. If you're not using the SDK, make sure you refresh the access token with the refresh endpoint.
-    `,
-    {
-      expired_at_millis: expiredAt?.getTime() ?? null,
-      project_id: projectId ?? null,
-      user_id: userId ?? null,
-      refresh_token_id: refreshTokenId ?? null
-    }
-  ], (json) => [
-    json.expired_at_millis ? new Date(json.expired_at_millis) : void 0,
-    json.project_id ?? void 0,
-    json.user_id ?? void 0,
-    json.refresh_token_id ?? void 0
-  ]);
-  var InvalidProjectForAccessToken = createKnownErrorConstructor(InvalidAccessToken, "INVALID_PROJECT_FOR_ACCESS_TOKEN", (expectedProjectId, actualProjectId) => [
-    401,
-    `Access token not valid for this project. Expected project ID ${JSON.stringify(expectedProjectId)}, but the token is for project ID ${JSON.stringify(actualProjectId)}.`,
-    {
-      expected_project_id: expectedProjectId,
-      actual_project_id: actualProjectId
-    }
-  ], (json) => [json.expected_project_id, json.actual_project_id]);
-  var RefreshTokenError = createKnownErrorConstructor(KnownError, "REFRESH_TOKEN_ERROR", "inherit", "inherit");
-  var RefreshTokenNotFoundOrExpired = createKnownErrorConstructor(RefreshTokenError, "REFRESH_TOKEN_NOT_FOUND_OR_EXPIRED", () => [401, "Refresh token not found for this project, or the session has expired/been revoked."], () => []);
-  var CannotDeleteCurrentSession = createKnownErrorConstructor(RefreshTokenError, "CANNOT_DELETE_CURRENT_SESSION", () => [400, "Cannot delete the current session."], () => []);
-  var ProviderRejected = createKnownErrorConstructor(RefreshTokenError, "PROVIDER_REJECTED", () => [401, "The provider refused to refresh their token. This usually means that the provider used to authenticate the user no longer regards this session as valid, and the user must re-authenticate."], () => []);
-  var UserWithEmailAlreadyExists = createKnownErrorConstructor(KnownError, "USER_EMAIL_ALREADY_EXISTS", (email, wouldWorkIfEmailWasVerified = false) => [
-    409,
-    `A user with email ${JSON.stringify(email)} already exists${wouldWorkIfEmailWasVerified ? " but the email is not verified. Please login to your existing account with the method you used to sign up, and then verify your email to sign in with this login method." : "."}`,
-    {
-      email,
-      would_work_if_email_was_verified: wouldWorkIfEmailWasVerified
-    }
-  ], (json) => [json.email, json.would_work_if_email_was_verified ?? false]);
-  var EmailNotVerified = createKnownErrorConstructor(KnownError, "EMAIL_NOT_VERIFIED", () => [400, "The email is not verified."], () => []);
-  var CannotGetOwnUserWithoutUser = createKnownErrorConstructor(KnownError, "CANNOT_GET_OWN_USER_WITHOUT_USER", () => [400, "You have specified 'me' as a userId, but did not provide authentication for a user."], () => []);
-  var UserIdDoesNotExist = createKnownErrorConstructor(KnownError, "USER_ID_DOES_NOT_EXIST", (userId) => [
-    400,
-    `The given user with the ID ${userId} does not exist.`,
-    { user_id: userId }
-  ], (json) => [json.user_id]);
-  var UserNotFound = createKnownErrorConstructor(KnownError, "USER_NOT_FOUND", () => [404, "User not found."], () => []);
-  var RestrictedUserNotAllowed = createKnownErrorConstructor(KnownError, "RESTRICTED_USER_NOT_ALLOWED", (restrictedReason) => [
-    403,
-    `The user in the access token is in restricted state. Reason: ${restrictedReason.type}. Please pass the X-Stack-Allow-Restricted-User header if this is intended.`,
-    { restricted_reason: restrictedReason }
-  ], (json) => [json.restricted_reason ?? { type: "anonymous" }]);
-  var ProjectNotFound = createKnownErrorConstructor(KnownError, "PROJECT_NOT_FOUND", (projectId) => {
-    if (typeof projectId !== "string") throw new HexclaveAssertionError("projectId of KnownErrors.ProjectNotFound must be a string");
-    return [
-      404,
-      `Project ${projectId} not found or is not accessible with the current user.`,
-      { project_id: projectId }
-    ];
-  }, (json) => [json.project_id]);
-  var CurrentProjectNotFound = createKnownErrorConstructor(KnownError, "CURRENT_PROJECT_NOT_FOUND", (projectId) => [
-    400,
-    `The current project with ID ${projectId} was not found. Please check the value of the x-hexclave-project-id header. (The legacy x-stack-project-id header is also accepted.)`,
-    { project_id: projectId }
-  ], (json) => [json.project_id]);
-  var BranchDoesNotExist = createKnownErrorConstructor(KnownError, "BRANCH_DOES_NOT_EXIST", (branchId) => [
-    400,
-    `The branch with ID ${branchId} does not exist.`,
-    { branch_id: branchId }
-  ], (json) => [json.branch_id]);
-  var SignUpNotEnabled = createKnownErrorConstructor(KnownError, "SIGN_UP_NOT_ENABLED", () => [400, "Creation of new accounts is not enabled for this project. Please ask the project owner to enable it."], () => []);
-  var SignUpRejected = createKnownErrorConstructor(KnownError, "SIGN_UP_REJECTED", (message) => [
-    403,
-    message ?? "Your sign up was rejected by an administrator's sign-up rule.",
-    { message: message ?? "Your sign up was rejected by an administrator's sign-up rule." }
-  ], (json) => [json.message]);
-  var BotChallengeRequired = createKnownErrorConstructor(KnownError, "BOT_CHALLENGE_REQUIRED", () => [409, "An additional bot challenge is required before sign-up can continue."], () => []);
-  var BotChallengeFailed = createKnownErrorConstructor(KnownError, "BOT_CHALLENGE_FAILED", (message) => [
-    400,
-    message,
-    { message }
-  ], (json) => [json.message]);
-  var PasswordAuthenticationNotEnabled = createKnownErrorConstructor(KnownError, "PASSWORD_AUTHENTICATION_NOT_ENABLED", () => [400, "Password authentication is not enabled for this project."], () => []);
-  var DataVaultStoreDoesNotExist = createKnownErrorConstructor(KnownError, "DATA_VAULT_STORE_DOES_NOT_EXIST", (storeId) => [
-    400,
-    `Data vault store with ID ${storeId} does not exist.`,
-    { store_id: storeId }
-  ], (json) => [json.store_id]);
-  var DataVaultStoreHashedKeyDoesNotExist = createKnownErrorConstructor(KnownError, "DATA_VAULT_STORE_HASHED_KEY_DOES_NOT_EXIST", (storeId, hashedKey) => [
-    400,
-    `Data vault store with ID ${storeId} does not contain a key with hash ${hashedKey}.`,
-    {
-      store_id: storeId,
-      hashed_key: hashedKey
-    }
-  ], (json) => [json.store_id, json.hashed_key]);
-  var PasskeyAuthenticationNotEnabled = createKnownErrorConstructor(KnownError, "PASSKEY_AUTHENTICATION_NOT_ENABLED", () => [400, "Passkey authentication is not enabled for this project."], () => []);
-  var AnonymousAccountsNotEnabled = createKnownErrorConstructor(KnownError, "ANONYMOUS_ACCOUNTS_NOT_ENABLED", () => [400, "Anonymous accounts are not enabled for this project."], () => []);
-  var AnonymousAuthenticationNotAllowed = createKnownErrorConstructor(KnownError, "ANONYMOUS_AUTHENTICATION_NOT_ALLOWED", () => [401, "X-Stack-Access-Token is for an anonymous user, but anonymous users are not enabled. Set the X-Stack-Allow-Anonymous-User header of this request to 'true' to allow anonymous users."], () => []);
-  var EmailPasswordMismatch = createKnownErrorConstructor(KnownError, "EMAIL_PASSWORD_MISMATCH", () => [400, "Wrong e-mail or password."], () => []);
-  var RedirectUrlNotWhitelisted = createKnownErrorConstructor(KnownError, "REDIRECT_URL_NOT_WHITELISTED", () => [400, "Redirect URL not whitelisted. Did you forget to add this domain to the trusted domains list on the Hexclave dashboard?"], () => []);
-  var PasswordRequirementsNotMet = createKnownErrorConstructor(KnownError, "PASSWORD_REQUIREMENTS_NOT_MET", "inherit", "inherit");
-  var PasswordTooShort = createKnownErrorConstructor(PasswordRequirementsNotMet, "PASSWORD_TOO_SHORT", (minLength) => [
-    400,
-    `Password too short. Minimum length is ${minLength}.`,
-    { min_length: minLength }
-  ], (json) => [json?.min_length ?? throwErr("min_length not found in PasswordTooShort details")]);
-  var PasswordTooLong = createKnownErrorConstructor(PasswordRequirementsNotMet, "PASSWORD_TOO_LONG", (maxLength) => [
-    400,
-    `Password too long. Maximum length is ${maxLength}.`,
-    { maxLength }
-  ], (json) => [json?.maxLength ?? throwErr("maxLength not found in PasswordTooLong details")]);
-  var UserDoesNotHavePassword = createKnownErrorConstructor(KnownError, "USER_DOES_NOT_HAVE_PASSWORD", () => [400, "This user does not have password authentication enabled."], () => []);
-  var VerificationCodeError = createKnownErrorConstructor(KnownError, "VERIFICATION_ERROR", "inherit", "inherit");
-  var VerificationCodeNotFound = createKnownErrorConstructor(VerificationCodeError, "VERIFICATION_CODE_NOT_FOUND", () => [404, "The verification code does not exist for this project."], () => []);
-  var VerificationCodeExpired = createKnownErrorConstructor(VerificationCodeError, "VERIFICATION_CODE_EXPIRED", () => [400, "The verification code has expired."], () => []);
-  var VerificationCodeAlreadyUsed = createKnownErrorConstructor(VerificationCodeError, "VERIFICATION_CODE_ALREADY_USED", () => [409, "The verification link has already been used."], () => []);
-  var VerificationCodeMaxAttemptsReached = createKnownErrorConstructor(VerificationCodeError, "VERIFICATION_CODE_MAX_ATTEMPTS_REACHED", () => [400, "The verification code nonce has reached the maximum number of attempts. This code is not valid anymore."], () => []);
-  var PasswordConfirmationMismatch = createKnownErrorConstructor(KnownError, "PASSWORD_CONFIRMATION_MISMATCH", () => [400, "Passwords do not match."], () => []);
-  var EmailAlreadyVerified = createKnownErrorConstructor(KnownError, "EMAIL_ALREADY_VERIFIED", () => [409, "The e-mail is already verified."], () => []);
-  var EmailNotAssociatedWithUser = createKnownErrorConstructor(KnownError, "EMAIL_NOT_ASSOCIATED_WITH_USER", () => [400, "The e-mail is not associated with a user that could log in with that e-mail."], () => []);
-  var EmailIsNotPrimaryEmail = createKnownErrorConstructor(KnownError, "EMAIL_IS_NOT_PRIMARY_EMAIL", (email, primaryEmail) => [
-    400,
-    `The given e-mail (${email}) must equal the user's primary e-mail (${primaryEmail}).`,
-    {
-      email,
-      primary_email: primaryEmail
-    }
-  ], (json) => [json.email, json.primary_email]);
-  var PasskeyRegistrationFailed = createKnownErrorConstructor(KnownError, "PASSKEY_REGISTRATION_FAILED", (message) => [400, message], (json) => [json.message]);
-  var PasskeyWebAuthnError = createKnownErrorConstructor(KnownError, "PASSKEY_WEBAUTHN_ERROR", (message, code) => [
-    400,
-    message,
-    {
-      message,
-      code
-    }
-  ], (json) => [json.message, json.code]);
-  var PasskeyAuthenticationFailed = createKnownErrorConstructor(KnownError, "PASSKEY_AUTHENTICATION_FAILED", (message) => [400, message], (json) => [json.message]);
-  var PermissionNotFound = createKnownErrorConstructor(KnownError, "PERMISSION_NOT_FOUND", (permissionId) => [
-    404,
-    `Permission "${permissionId}" not found. Make sure you created it on the dashboard.`,
-    { permission_id: permissionId }
-  ], (json) => [json.permission_id]);
-  var PermissionScopeMismatch = createKnownErrorConstructor(KnownError, "WRONG_PERMISSION_SCOPE", (permissionId, expectedScope, actualScope) => [
-    404,
-    `Permission ${JSON.stringify(permissionId)} not found. (It was found for a different scope ${JSON.stringify(actualScope)}, but scope ${JSON.stringify(expectedScope)} was expected.)`,
-    {
-      permission_id: permissionId,
-      expected_scope: expectedScope,
-      actual_scope: actualScope
-    }
-  ], (json) => [
-    json.permission_id,
-    json.expected_scope,
-    json.actual_scope
-  ]);
-  var ContainedPermissionNotFound = createKnownErrorConstructor(KnownError, "CONTAINED_PERMISSION_NOT_FOUND", (permissionId) => [
-    400,
-    `Contained permission with ID "${permissionId}" not found. Make sure you created it on the dashboard.`,
-    { permission_id: permissionId }
-  ], (json) => [json.permission_id]);
-  var TeamNotFound = createKnownErrorConstructor(KnownError, "TEAM_NOT_FOUND", (teamId) => [
-    404,
-    `Team ${teamId} not found.`,
-    { team_id: teamId }
-  ], (json) => [json.team_id]);
-  createKnownErrorConstructor(KnownError, "TEAM_ALREADY_EXISTS", (teamId) => [
-    409,
-    `Team ${teamId} already exists.`,
-    { team_id: teamId }
-  ], (json) => [json.team_id]);
-  var TeamMembershipNotFound = createKnownErrorConstructor(KnownError, "TEAM_MEMBERSHIP_NOT_FOUND", (teamId, userId) => [
-    404,
-    `User ${userId} is not found in team ${teamId}.`,
-    {
-      team_id: teamId,
-      user_id: userId
-    }
-  ], (json) => [json.team_id, json.user_id]);
-  var TeamInvitationRestrictedUserNotAllowed = createKnownErrorConstructor(KnownError, "TEAM_INVITATION_RESTRICTED_USER_NOT_ALLOWED", (restrictedReason) => [
-    403,
-    `Restricted users cannot accept team invitations. Reason: ${restrictedReason.type}. Please complete the onboarding process before accepting team invitations.`,
-    { restricted_reason: restrictedReason }
-  ], (json) => [json.restricted_reason ?? { type: "anonymous" }]);
-  var TeamInvitationEmailMismatch = createKnownErrorConstructor(KnownError, "TEAM_INVITATION_EMAIL_MISMATCH", () => [403, "This team invitation was sent to a different email address. Sign in with the invited email, or add and verify that email on your account, then try again."], () => []);
-  var EmailTemplateAlreadyExists = createKnownErrorConstructor(KnownError, "EMAIL_TEMPLATE_ALREADY_EXISTS", () => [409, "Email template already exists."], () => []);
-  var OAuthConnectionNotConnectedToUser = createKnownErrorConstructor(KnownError, "OAUTH_CONNECTION_NOT_CONNECTED_TO_USER", () => [400, "The OAuth connection is not connected to any user."], () => []);
-  var OAuthConnectionAlreadyConnectedToAnotherUser = createKnownErrorConstructor(KnownError, "OAUTH_CONNECTION_ALREADY_CONNECTED_TO_ANOTHER_USER", () => [409, "The OAuth connection is already connected to another user."], () => []);
-  var OAuthConnectionDoesNotHaveRequiredScope = createKnownErrorConstructor(KnownError, "OAUTH_CONNECTION_DOES_NOT_HAVE_REQUIRED_SCOPE", () => [400, "The OAuth connection does not have the required scope."], () => []);
-  var OAuthAccessTokenNotAvailable = createKnownErrorConstructor(KnownError, "OAUTH_ACCESS_TOKEN_NOT_AVAILABLE", (provider, details) => [
-    400,
-    `Failed to retrieve an OAuth access token for the connected account (provider: ${provider}). ${details}`,
-    {
-      provider,
-      details
-    }
-  ], (json) => [json.provider, json.details]);
-  var OAuthExtraScopeNotAvailableWithSharedOAuthKeys = createKnownErrorConstructor(KnownError, "OAUTH_EXTRA_SCOPE_NOT_AVAILABLE_WITH_SHARED_OAUTH_KEYS", () => [400, "Extra scopes are not available with shared OAuth keys. Please add your own OAuth keys on the Stack dashboard to use extra scopes."], () => []);
-  var OAuthAccessTokenNotAvailableWithSharedOAuthKeys = createKnownErrorConstructor(KnownError, "OAUTH_ACCESS_TOKEN_NOT_AVAILABLE_WITH_SHARED_OAUTH_KEYS", () => [400, "Access tokens are not available with shared OAuth keys. Please add your own OAuth keys on the Stack dashboard to use access tokens."], () => []);
-  var InvalidOAuthClientIdOrSecret = createKnownErrorConstructor(KnownError, "INVALID_OAUTH_CLIENT_ID_OR_SECRET", (clientId) => [
-    400,
-    "The OAuth client ID or secret is invalid. The client ID must be equal to the project ID (potentially with a hash and a branch ID), and the client secret must be a publishable client key.",
-    { client_id: clientId ?? null }
-  ], (json) => [json.client_id ?? void 0]);
-  var InvalidScope = createKnownErrorConstructor(KnownError, "INVALID_SCOPE", (scope) => [400, `The scope "${scope}" is not a valid OAuth scope for Stack.`], (json) => [json.scope]);
-  var UserAlreadyConnectedToAnotherOAuthConnection = createKnownErrorConstructor(KnownError, "USER_ALREADY_CONNECTED_TO_ANOTHER_OAUTH_CONNECTION", () => [409, "The user is already connected to another OAuth account. Did you maybe selected the wrong account?"], () => []);
-  var OuterOAuthTimeout = createKnownErrorConstructor(KnownError, "OUTER_OAUTH_TIMEOUT", () => [408, "The OAuth flow has timed out. Please sign in again."], () => []);
-  var OAuthProviderNotFoundOrNotEnabled = createKnownErrorConstructor(KnownError, "OAUTH_PROVIDER_NOT_FOUND_OR_NOT_ENABLED", () => [400, "The OAuth provider is not found or not enabled."], () => []);
-  var AppleBundleIdNotConfigured = createKnownErrorConstructor(KnownError, "APPLE_BUNDLE_ID_NOT_CONFIGURED", () => [400, "Apple Sign In is enabled, but no Bundle IDs are configured. Please add your app's Bundle ID in the Hexclave dashboard under OAuth Providers > Apple > Apple Bundle IDs."], () => []);
-  var OAuthProviderAccountIdAlreadyUsedForSignIn = createKnownErrorConstructor(KnownError, "OAUTH_PROVIDER_ACCOUNT_ID_ALREADY_USED_FOR_SIGN_IN", () => [400, `A provider with the same account ID is already used for signing in.`], () => []);
-  var MultiFactorAuthenticationRequired = createKnownErrorConstructor(KnownError, "MULTI_FACTOR_AUTHENTICATION_REQUIRED", (attemptCode) => [
-    400,
-    `Multi-factor authentication is required for this user.`,
-    { attempt_code: attemptCode }
-  ], (json) => [json.attempt_code]);
-  var InvalidTotpCode = createKnownErrorConstructor(KnownError, "INVALID_TOTP_CODE", () => [400, "The TOTP code is invalid. Please try again."], () => []);
-  var UserAuthenticationRequired = createKnownErrorConstructor(KnownError, "USER_AUTHENTICATION_REQUIRED", () => [401, "User authentication required for this endpoint."], () => []);
-  var TeamMembershipAlreadyExists = createKnownErrorConstructor(KnownError, "TEAM_MEMBERSHIP_ALREADY_EXISTS", () => [409, "Team membership already exists."], () => []);
-  var ProjectPermissionRequired = createKnownErrorConstructor(KnownError, "PROJECT_PERMISSION_REQUIRED", (userId, permissionId) => [
-    401,
-    `User ${userId} does not have permission ${permissionId}.`,
-    {
-      user_id: userId,
-      permission_id: permissionId
-    }
-  ], (json) => [json.user_id, json.permission_id]);
-  var TeamPermissionRequired = createKnownErrorConstructor(KnownError, "TEAM_PERMISSION_REQUIRED", (teamId, userId, permissionId) => [
-    401,
-    `User ${userId} does not have permission ${permissionId} in team ${teamId}.`,
-    {
-      team_id: teamId,
-      user_id: userId,
-      permission_id: permissionId
+  ], (json) => [json.user_id, json.permission_id]);
+  var TeamPermissionRequired = createKnownErrorConstructor(KnownError, "TEAM_PERMISSION_REQUIRED", (teamId, userId, permissionId) => [
+    401,
+    `User ${userId} does not have permission ${permissionId} in team ${teamId}.`,
+    {
+      team_id: teamId,
+      user_id: userId,
+      permission_id: permissionId
     }
   ], (json) => [
     json.team_id,
@@ -6117,49 +5243,6 @@ This is likely an error in Hexclave. Please make sure you are running the newest
     knownErrorCodes.add(KnownError2.errorCode);
   }
 
-  // ../stack-shared/dist/esm/utils/bytes.js
-  function decodeBase64(input) {
-    return new Uint8Array(atob(input).split("").map((char) => char.charCodeAt(0)));
-  }
-  function isBase64(input) {
-    return /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(input);
-  }
-
-  // ../stack-shared/dist/esm/utils/urls.js
-  function createUrlIfValid(...args) {
-    try {
-      return new URL(...args);
-    } catch (e40) {
-      return null;
-    }
-  }
-  function isValidUrl(url) {
-    return !!createUrlIfValid(url);
-  }
-  function isValidHostname(hostname) {
-    if (!hostname || hostname.startsWith(".") || hostname.endsWith(".") || hostname.includes("..")) return false;
-    const url = createUrlIfValid(`https://${hostname}`);
-    if (!url) return false;
-    return url.hostname === hostname;
-  }
-  function isValidHostnameWithWildcards(hostname) {
-    if (!hostname) return false;
-    if (!hostname.includes("*")) return isValidHostname(hostname);
-    if (hostname.startsWith(".") || hostname.endsWith(".")) return false;
-    if (hostname.includes("..")) return false;
-    const testHostname = hostname.replace(/\*+/g, "wildcard");
-    if (!/^[a-zA-Z0-9.-]+$/.test(testHostname)) return false;
-    const segments = hostname.split(/\*+/);
-    for (let i = 0; i < segments.length; i++) {
-      const segment = segments[i];
-      if (segment === "") continue;
-      if (i === 0 && segment.startsWith(".")) return false;
-      if (i === segments.length - 1 && segment.endsWith(".")) return false;
-      if (segment.includes("..")) return false;
-    }
-    return true;
-  }
-
   // ../../node_modules/.pnpm/yup@1.7.1/node_modules/yup/index.esm.js
   var import_property_expr = __toESM(require_property_expr());
   var import_tiny_case = __toESM(require_tiny_case());
@@ -6199,11 +5282,11 @@ This is likely an error in Hexclave. Please make sure you are running the newest
   function toArray(value) {
     return value == null ? [] : [].concat(value);
   }
-  var _Symbol$toStringTag4;
+  var _Symbol$toStringTag;
   var _Symbol$hasInstance;
-  var _Symbol$toStringTag22;
+  var _Symbol$toStringTag2;
   var strReg = /\$\{\s*(\w+)\s*\}/g;
-  _Symbol$toStringTag4 = Symbol.toStringTag;
+  _Symbol$toStringTag = Symbol.toStringTag;
   var ValidationErrorNoStack = class {
     constructor(errorOrErrors, value, field, type) {
       this.name = void 0;
@@ -6214,7 +5297,7 @@ This is likely an error in Hexclave. Please make sure you are running the newest
       this.params = void 0;
       this.errors = void 0;
       this.inner = void 0;
-      this[_Symbol$toStringTag4] = "Error";
+      this[_Symbol$toStringTag] = "Error";
       this.name = "ValidationError";
       this.value = value;
       this.path = field;
@@ -6234,7 +5317,7 @@ This is likely an error in Hexclave. Please make sure you are running the newest
     }
   };
   _Symbol$hasInstance = Symbol.hasInstance;
-  _Symbol$toStringTag22 = Symbol.toStringTag;
+  _Symbol$toStringTag2 = Symbol.toStringTag;
   var ValidationError = class _ValidationError extends Error {
     static formatError(message, params) {
       const path = params.label || params.path || "this";
@@ -6261,7 +5344,7 @@ This is likely an error in Hexclave. Please make sure you are running the newest
       this.params = void 0;
       this.errors = [];
       this.inner = [];
-      this[_Symbol$toStringTag22] = "Error";
+      this[_Symbol$toStringTag2] = "Error";
       this.name = errorNoStack.name;
       this.message = errorNoStack.message;
       this.type = errorNoStack.type;
@@ -8954,6 +8037,10 @@ attempted value: ${formattedValue}
     description: 'OAuth client secret. Needs to be specified when using type="standard"',
     exampleValue: "google-oauth-client-secret"
   } });
+  var oauthCustomCallbackUrlSchema = urlSchema.meta({ openapiField: {
+    description: "The OAuth redirect/callback URL sent to the provider. When omitted, the default callback URL is used. Cannot be set for shared providers.",
+    exampleValue: "https://api.hexclave.com/api/v1/auth/oauth/callback/google"
+  } });
   var oauthFacebookConfigIdSchema = yupString().meta({ openapiField: { description: "The configuration id for Facebook business login (for things like ads and marketing). This is only required if you are using the standard OAuth with Facebook and you are using Facebook business login." } });
   var oauthMicrosoftTenantIdSchema = yupString().meta({ openapiField: { description: "The Microsoft tenant id for Microsoft directory. This is only required if you are using the standard OAuth with Microsoft and you have an Azure AD tenant." } });
   var oauthAppleBundleIdsSchema = yupArray(yupString().defined()).meta({ openapiField: {
@@ -9424,283 +8511,1204 @@ attempted value: ${formattedValue}
     workflow_path: yupString().optional()
   }), yupObject({ type: yupString().oneOf(["pushed-from-unknown"]).defined() }), yupObject({ type: yupString().oneOf(["unlinked"]).defined() }));
 
-  // ../../node_modules/.pnpm/async-mutex@0.5.0/node_modules/async-mutex/index.mjs
-  var E_TIMEOUT = new Error("timeout while waiting for mutex to become available");
-  var E_ALREADY_LOCKED = new Error("mutex already locked");
-  var E_CANCELED = new Error("request for lock canceled");
-  var __awaiter$2 = function(thisArg, _arguments, P, generator) {
-    function adopt(value) {
-      return value instanceof P ? value : new P(function(resolve) {
-        resolve(value);
-      });
+  // ../../node_modules/.pnpm/async-mutex@0.5.0/node_modules/async-mutex/index.mjs
+  var E_TIMEOUT = new Error("timeout while waiting for mutex to become available");
+  var E_ALREADY_LOCKED = new Error("mutex already locked");
+  var E_CANCELED = new Error("request for lock canceled");
+  var __awaiter$2 = function(thisArg, _arguments, P, generator) {
+    function adopt(value) {
+      return value instanceof P ? value : new P(function(resolve) {
+        resolve(value);
+      });
+    }
+    return new (P || (P = Promise))(function(resolve, reject) {
+      function fulfilled(value) {
+        try {
+          step(generator.next(value));
+        } catch (e40) {
+          reject(e40);
+        }
+      }
+      function rejected2(value) {
+        try {
+          step(generator["throw"](value));
+        } catch (e40) {
+          reject(e40);
+        }
+      }
+      function step(result) {
+        result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected2);
+      }
+      step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+  };
+  var Semaphore = class {
+    constructor(_value, _cancelError = E_CANCELED) {
+      this._value = _value;
+      this._cancelError = _cancelError;
+      this._queue = [];
+      this._weightedWaiters = [];
+    }
+    acquire(weight = 1, priority = 0) {
+      if (weight <= 0)
+        throw new Error(`invalid weight ${weight}: must be positive`);
+      return new Promise((resolve, reject) => {
+        const task = { resolve, reject, weight, priority };
+        const i = findIndexFromEnd(this._queue, (other) => priority <= other.priority);
+        if (i === -1 && weight <= this._value) {
+          this._dispatchItem(task);
+        } else {
+          this._queue.splice(i + 1, 0, task);
+        }
+      });
+    }
+    runExclusive(callback_1) {
+      return __awaiter$2(this, arguments, void 0, function* (callback, weight = 1, priority = 0) {
+        const [value, release] = yield this.acquire(weight, priority);
+        try {
+          return yield callback(value);
+        } finally {
+          release();
+        }
+      });
+    }
+    waitForUnlock(weight = 1, priority = 0) {
+      if (weight <= 0)
+        throw new Error(`invalid weight ${weight}: must be positive`);
+      if (this._couldLockImmediately(weight, priority)) {
+        return Promise.resolve();
+      } else {
+        return new Promise((resolve) => {
+          if (!this._weightedWaiters[weight - 1])
+            this._weightedWaiters[weight - 1] = [];
+          insertSorted(this._weightedWaiters[weight - 1], { resolve, priority });
+        });
+      }
+    }
+    isLocked() {
+      return this._value <= 0;
+    }
+    getValue() {
+      return this._value;
+    }
+    setValue(value) {
+      this._value = value;
+      this._dispatchQueue();
+    }
+    release(weight = 1) {
+      if (weight <= 0)
+        throw new Error(`invalid weight ${weight}: must be positive`);
+      this._value += weight;
+      this._dispatchQueue();
+    }
+    cancel() {
+      this._queue.forEach((entry) => entry.reject(this._cancelError));
+      this._queue = [];
+    }
+    _dispatchQueue() {
+      this._drainUnlockWaiters();
+      while (this._queue.length > 0 && this._queue[0].weight <= this._value) {
+        this._dispatchItem(this._queue.shift());
+        this._drainUnlockWaiters();
+      }
+    }
+    _dispatchItem(item) {
+      const previousValue = this._value;
+      this._value -= item.weight;
+      item.resolve([previousValue, this._newReleaser(item.weight)]);
+    }
+    _newReleaser(weight) {
+      let called = false;
+      return () => {
+        if (called)
+          return;
+        called = true;
+        this.release(weight);
+      };
+    }
+    _drainUnlockWaiters() {
+      if (this._queue.length === 0) {
+        for (let weight = this._value; weight > 0; weight--) {
+          const waiters = this._weightedWaiters[weight - 1];
+          if (!waiters)
+            continue;
+          waiters.forEach((waiter) => waiter.resolve());
+          this._weightedWaiters[weight - 1] = [];
+        }
+      } else {
+        const queuedPriority = this._queue[0].priority;
+        for (let weight = this._value; weight > 0; weight--) {
+          const waiters = this._weightedWaiters[weight - 1];
+          if (!waiters)
+            continue;
+          const i = waiters.findIndex((waiter) => waiter.priority <= queuedPriority);
+          (i === -1 ? waiters : waiters.splice(0, i)).forEach((waiter) => waiter.resolve());
+        }
+      }
+    }
+    _couldLockImmediately(weight, priority) {
+      return (this._queue.length === 0 || this._queue[0].priority < priority) && weight <= this._value;
+    }
+  };
+  function insertSorted(a26, v) {
+    const i = findIndexFromEnd(a26, (other) => v.priority <= other.priority);
+    a26.splice(i + 1, 0, v);
+  }
+  function findIndexFromEnd(a26, predicate) {
+    for (let i = a26.length - 1; i >= 0; i--) {
+      if (predicate(a26[i])) {
+        return i;
+      }
+    }
+    return -1;
+  }
+
+  // ../stack-shared/dist/esm/utils/locks.js
+  var ReadWriteLock = class {
+    constructor() {
+      this.semaphore = new Semaphore(1);
+      this.readers = 0;
+      this.readersMutex = new Semaphore(1);
+    }
+    async withReadLock(callback) {
+      await this._acquireReadLock();
+      try {
+        return await callback();
+      } finally {
+        await this._releaseReadLock();
+      }
+    }
+    async withWriteLock(callback) {
+      await this._acquireWriteLock();
+      try {
+        return await callback();
+      } finally {
+        await this._releaseWriteLock();
+      }
+    }
+    async _acquireReadLock() {
+      await this.readersMutex.acquire();
+      try {
+        this.readers += 1;
+        if (this.readers === 1) await this.semaphore.acquire();
+      } finally {
+        this.readersMutex.release();
+      }
+    }
+    async _releaseReadLock() {
+      await this.readersMutex.acquire();
+      try {
+        this.readers -= 1;
+        if (this.readers === 0) this.semaphore.release();
+      } finally {
+        this.readersMutex.release();
+      }
+    }
+    async _acquireWriteLock() {
+      await this.semaphore.acquire();
+    }
+    async _releaseWriteLock() {
+      this.semaphore.release();
+    }
+  };
+
+  // ../stack-shared/dist/esm/utils/stores.js
+  var storeLock = new ReadWriteLock();
+
+  // ../stack-shared/dist/esm/interface/client-interface.js
+  var USER_AGENT;
+  if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) USER_AGENT = `oauth4webapi/v3.8.3`;
+  var ERR_INVALID_ARG_VALUE = "ERR_INVALID_ARG_VALUE";
+  function CodedTypeError(message, code, cause) {
+    const err = new TypeError(message, { cause });
+    Object.assign(err, { code });
+    return err;
+  }
+  var allowInsecureRequests = Symbol();
+  var clockSkew = Symbol();
+  var clockTolerance = Symbol();
+  var customFetch = Symbol();
+  var jweDecrypt = Symbol();
+  var encoder = new TextEncoder();
+  var decoder = new TextDecoder();
+  var encodeBase64Url;
+  if (Uint8Array.prototype.toBase64) encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) input = new Uint8Array(input);
+    return input.toBase64({
+      alphabet: "base64url",
+      omitPadding: true
+    });
+  };
+  else {
+    const CHUNK_SIZE = 32768;
+    encodeBase64Url = (input) => {
+      if (input instanceof ArrayBuffer) input = new Uint8Array(input);
+      const arr = [];
+      for (let i = 0; i < input.byteLength; i += CHUNK_SIZE) arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+      return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+    };
+  }
+  var decodeBase64Url;
+  if (Uint8Array.fromBase64) decodeBase64Url = (input) => {
+    try {
+      return Uint8Array.fromBase64(input, { alphabet: "base64url" });
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+  else decodeBase64Url = (input) => {
+    try {
+      const binary = atob(input.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, ""));
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+      return bytes;
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+  var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
+    try {
+      return new URL(url, base);
+    } catch {
+      return null;
+    }
+  };
+  var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
+  var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
+  var quotedParamMatcher = "(" + tokenMatch + ')\\s*=\\s*"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
+  var paramMatcher = "(" + tokenMatch + ")\\s*=\\s*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)";
+  var schemeRE = new RegExp("^[,\\s]*(" + tokenMatch + ")");
+  var quotedParamRE = new RegExp("^[,\\s]*" + quotedParamMatcher + "[,\\s]*(.*)");
+  var unquotedParamRE = new RegExp("^[,\\s]*" + paramMatcher + "[,\\s]*(.*)");
+  var token68ParamRE = new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
+  var nopkce = Symbol();
+  var expectNoNonce = Symbol();
+  var skipAuthTimeCheck = Symbol();
+  var skipStateCheck = Symbol();
+  var expectNoState = Symbol();
+  var _expectedIssuer = Symbol();
+  var botChallengeKnownErrors = [KnownErrors.BotChallengeRequired, KnownErrors.BotChallengeFailed];
+
+  // ../stack-shared/dist/esm/utils/maps.js
+  var _Symbol$toStringTag3;
+  var _Symbol$toStringTag22;
+  var _Symbol$toStringTag32;
+  var WeakRefIfAvailable = class {
+    constructor(value) {
+      if (typeof WeakRef === "undefined") this._ref = { deref: () => value };
+      else this._ref = new WeakRef(value);
+    }
+    deref() {
+      return this._ref.deref();
+    }
+  };
+  var _a2;
+  var IterableWeakMap = (_a2 = class {
+    constructor(entries) {
+      this[_Symbol$toStringTag3] = "IterableWeakMap";
+      const mappedEntries = entries?.map((e40) => [e40[0], {
+        value: e40[1],
+        keyRef: new WeakRefIfAvailable(e40[0])
+      }]);
+      this._weakMap = new WeakMap(mappedEntries ?? []);
+      this._keyRefs = new Set(mappedEntries?.map((e40) => e40[1].keyRef) ?? []);
+    }
+    get(key) {
+      return this._weakMap.get(key)?.value;
+    }
+    set(key, value) {
+      const updated = {
+        value,
+        keyRef: this._weakMap.get(key)?.keyRef ?? new WeakRefIfAvailable(key)
+      };
+      this._weakMap.set(key, updated);
+      this._keyRefs.add(updated.keyRef);
+      return this;
+    }
+    delete(key) {
+      const res = this._weakMap.get(key);
+      if (res) {
+        this._weakMap.delete(key);
+        this._keyRefs.delete(res.keyRef);
+        return true;
+      }
+      return false;
+    }
+    has(key) {
+      return this._weakMap.has(key) && this._keyRefs.has(this._weakMap.get(key).keyRef);
+    }
+    *[Symbol.iterator]() {
+      for (const keyRef of this._keyRefs) {
+        const key = keyRef.deref();
+        const existing = key ? this._weakMap.get(key) : void 0;
+        if (!key) this._keyRefs.delete(keyRef);
+        else if (existing) yield [key, existing.value];
+      }
+    }
+  }, _Symbol$toStringTag3 = Symbol.toStringTag, _a2);
+  var _a3;
+  var MaybeWeakMap = (_a3 = class {
+    constructor(entries) {
+      this[_Symbol$toStringTag22] = "MaybeWeakMap";
+      const entriesArray = [...entries ?? []];
+      this._primitiveMap = new Map(entriesArray.filter((e40) => !this._isAllowedInWeakMap(e40[0])));
+      this._weakMap = new IterableWeakMap(entriesArray.filter((e40) => this._isAllowedInWeakMap(e40[0])));
+    }
+    _isAllowedInWeakMap(key) {
+      return typeof key === "object" && key !== null || typeof key === "symbol" && Symbol.keyFor(key) === void 0;
+    }
+    get(key) {
+      if (this._isAllowedInWeakMap(key)) return this._weakMap.get(key);
+      else return this._primitiveMap.get(key);
+    }
+    set(key, value) {
+      if (this._isAllowedInWeakMap(key)) this._weakMap.set(key, value);
+      else this._primitiveMap.set(key, value);
+      return this;
+    }
+    delete(key) {
+      if (this._isAllowedInWeakMap(key)) return this._weakMap.delete(key);
+      else return this._primitiveMap.delete(key);
+    }
+    has(key) {
+      if (this._isAllowedInWeakMap(key)) return this._weakMap.has(key);
+      else return this._primitiveMap.has(key);
+    }
+    *[Symbol.iterator]() {
+      yield* this._primitiveMap;
+      yield* this._weakMap;
+    }
+  }, _Symbol$toStringTag22 = Symbol.toStringTag, _a3);
+  var _a4;
+  var DependenciesMap = (_a4 = class {
+    constructor() {
+      this._inner = {
+        map: new MaybeWeakMap(),
+        hasValue: false,
+        value: void 0
+      };
+      this[_Symbol$toStringTag32] = "DependenciesMap";
+    }
+    _valueToResult(inner) {
+      if (inner.hasValue) return Result.ok(inner.value);
+      else return Result.error(void 0);
+    }
+    _unwrapFromInner(dependencies, inner) {
+      if (dependencies.length === 0) return this._valueToResult(inner);
+      else {
+        const [key, ...rest] = dependencies;
+        const newInner = inner.map.get(key);
+        if (!newInner) return Result.error(void 0);
+        return this._unwrapFromInner(rest, newInner);
+      }
+    }
+    _setInInner(dependencies, value, inner) {
+      if (dependencies.length === 0) {
+        const res = this._valueToResult(inner);
+        if (value.status === "ok") {
+          inner.hasValue = true;
+          inner.value = value.data;
+        } else {
+          inner.hasValue = false;
+          inner.value = void 0;
+        }
+        return res;
+      } else {
+        const [key, ...rest] = dependencies;
+        let newInner = inner.map.get(key);
+        if (!newInner) inner.map.set(key, newInner = {
+          map: new MaybeWeakMap(),
+          hasValue: false,
+          value: void 0
+        });
+        return this._setInInner(rest, value, newInner);
+      }
+    }
+    *_iterateInner(dependencies, inner) {
+      if (inner.hasValue) yield [dependencies, inner.value];
+      for (const [key, value] of inner.map) yield* this._iterateInner([...dependencies, key], value);
+    }
+    get(dependencies) {
+      return Result.or(this._unwrapFromInner(dependencies, this._inner), void 0);
+    }
+    set(dependencies, value) {
+      this._setInInner(dependencies, Result.ok(value), this._inner);
+      return this;
+    }
+    delete(dependencies) {
+      return this._setInInner(dependencies, Result.error(void 0), this._inner).status === "ok";
+    }
+    has(dependencies) {
+      return this._unwrapFromInner(dependencies, this._inner).status === "ok";
+    }
+    clear() {
+      this._inner = {
+        map: new MaybeWeakMap(),
+        hasValue: false,
+        value: void 0
+      };
+    }
+    *[Symbol.iterator]() {
+      yield* this._iterateInner([], this._inner);
+    }
+  }, _Symbol$toStringTag32 = Symbol.toStringTag, _a4);
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/platform/browser/globalThis.js
+  var _globalThis = typeof globalThis === "object" ? globalThis : typeof self === "object" ? self : typeof window === "object" ? window : typeof global === "object" ? global : {};
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/version.js
+  var VERSION = "1.9.0";
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/internal/semver.js
+  var re = /^(\d+)\.(\d+)\.(\d+)(-(.+))?$/;
+  function _makeCompatibilityCheck(ownVersion) {
+    var acceptedVersions = /* @__PURE__ */ new Set([ownVersion]);
+    var rejectedVersions = /* @__PURE__ */ new Set();
+    var myVersionMatch = ownVersion.match(re);
+    if (!myVersionMatch) {
+      return function() {
+        return false;
+      };
+    }
+    var ownVersionParsed = {
+      major: +myVersionMatch[1],
+      minor: +myVersionMatch[2],
+      patch: +myVersionMatch[3],
+      prerelease: myVersionMatch[4]
+    };
+    if (ownVersionParsed.prerelease != null) {
+      return function isExactmatch(globalVersion) {
+        return globalVersion === ownVersion;
+      };
+    }
+    function _reject(v) {
+      rejectedVersions.add(v);
+      return false;
+    }
+    function _accept(v) {
+      acceptedVersions.add(v);
+      return true;
+    }
+    return function isCompatible2(globalVersion) {
+      if (acceptedVersions.has(globalVersion)) {
+        return true;
+      }
+      if (rejectedVersions.has(globalVersion)) {
+        return false;
+      }
+      var globalVersionMatch = globalVersion.match(re);
+      if (!globalVersionMatch) {
+        return _reject(globalVersion);
+      }
+      var globalVersionParsed = {
+        major: +globalVersionMatch[1],
+        minor: +globalVersionMatch[2],
+        patch: +globalVersionMatch[3],
+        prerelease: globalVersionMatch[4]
+      };
+      if (globalVersionParsed.prerelease != null) {
+        return _reject(globalVersion);
+      }
+      if (ownVersionParsed.major !== globalVersionParsed.major) {
+        return _reject(globalVersion);
+      }
+      if (ownVersionParsed.major === 0) {
+        if (ownVersionParsed.minor === globalVersionParsed.minor && ownVersionParsed.patch <= globalVersionParsed.patch) {
+          return _accept(globalVersion);
+        }
+        return _reject(globalVersion);
+      }
+      if (ownVersionParsed.minor <= globalVersionParsed.minor) {
+        return _accept(globalVersion);
+      }
+      return _reject(globalVersion);
+    };
+  }
+  var isCompatible = _makeCompatibilityCheck(VERSION);
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/internal/global-utils.js
+  var major = VERSION.split(".")[0];
+  var GLOBAL_OPENTELEMETRY_API_KEY = Symbol.for("opentelemetry.js.api." + major);
+  var _global = _globalThis;
+  function registerGlobal(type, instance, diag, allowOverride) {
+    var _a5;
+    if (allowOverride === void 0) {
+      allowOverride = false;
+    }
+    var api = _global[GLOBAL_OPENTELEMETRY_API_KEY] = (_a5 = _global[GLOBAL_OPENTELEMETRY_API_KEY]) !== null && _a5 !== void 0 ? _a5 : {
+      version: VERSION
+    };
+    if (!allowOverride && api[type]) {
+      var err = new Error("@opentelemetry/api: Attempted duplicate registration of API: " + type);
+      diag.error(err.stack || err.message);
+      return false;
+    }
+    if (api.version !== VERSION) {
+      var err = new Error("@opentelemetry/api: Registration of version v" + api.version + " for " + type + " does not match previously registered API v" + VERSION);
+      diag.error(err.stack || err.message);
+      return false;
+    }
+    api[type] = instance;
+    diag.debug("@opentelemetry/api: Registered a global for " + type + " v" + VERSION + ".");
+    return true;
+  }
+  function getGlobal(type) {
+    var _a5, _b;
+    var globalVersion = (_a5 = _global[GLOBAL_OPENTELEMETRY_API_KEY]) === null || _a5 === void 0 ? void 0 : _a5.version;
+    if (!globalVersion || !isCompatible(globalVersion)) {
+      return;
+    }
+    return (_b = _global[GLOBAL_OPENTELEMETRY_API_KEY]) === null || _b === void 0 ? void 0 : _b[type];
+  }
+  function unregisterGlobal(type, diag) {
+    diag.debug("@opentelemetry/api: Unregistering a global for " + type + " v" + VERSION + ".");
+    var api = _global[GLOBAL_OPENTELEMETRY_API_KEY];
+    if (api) {
+      delete api[type];
+    }
+  }
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/diag/ComponentLogger.js
+  var __read = function(o21, n9) {
+    var m5 = typeof Symbol === "function" && o21[Symbol.iterator];
+    if (!m5) return o21;
+    var i = m5.call(o21), r7, ar = [], e40;
+    try {
+      while ((n9 === void 0 || n9-- > 0) && !(r7 = i.next()).done) ar.push(r7.value);
+    } catch (error) {
+      e40 = { error };
+    } finally {
+      try {
+        if (r7 && !r7.done && (m5 = i["return"])) m5.call(i);
+      } finally {
+        if (e40) throw e40.error;
+      }
+    }
+    return ar;
+  };
+  var __spreadArray = function(to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l3 = from.length, ar; i < l3; i++) {
+      if (ar || !(i in from)) {
+        if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+        ar[i] = from[i];
+      }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+  };
+  var DiagComponentLogger = (
+    /** @class */
+    function() {
+      function DiagComponentLogger2(props) {
+        this._namespace = props.namespace || "DiagComponentLogger";
+      }
+      DiagComponentLogger2.prototype.debug = function() {
+        var args = [];
+        for (var _i = 0; _i < arguments.length; _i++) {
+          args[_i] = arguments[_i];
+        }
+        return logProxy("debug", this._namespace, args);
+      };
+      DiagComponentLogger2.prototype.error = function() {
+        var args = [];
+        for (var _i = 0; _i < arguments.length; _i++) {
+          args[_i] = arguments[_i];
+        }
+        return logProxy("error", this._namespace, args);
+      };
+      DiagComponentLogger2.prototype.info = function() {
+        var args = [];
+        for (var _i = 0; _i < arguments.length; _i++) {
+          args[_i] = arguments[_i];
+        }
+        return logProxy("info", this._namespace, args);
+      };
+      DiagComponentLogger2.prototype.warn = function() {
+        var args = [];
+        for (var _i = 0; _i < arguments.length; _i++) {
+          args[_i] = arguments[_i];
+        }
+        return logProxy("warn", this._namespace, args);
+      };
+      DiagComponentLogger2.prototype.verbose = function() {
+        var args = [];
+        for (var _i = 0; _i < arguments.length; _i++) {
+          args[_i] = arguments[_i];
+        }
+        return logProxy("verbose", this._namespace, args);
+      };
+      return DiagComponentLogger2;
+    }()
+  );
+  function logProxy(funcName, namespace, args) {
+    var logger = getGlobal("diag");
+    if (!logger) {
+      return;
+    }
+    args.unshift(namespace);
+    return logger[funcName].apply(logger, __spreadArray([], __read(args), false));
+  }
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/diag/types.js
+  var DiagLogLevel;
+  (function(DiagLogLevel2) {
+    DiagLogLevel2[DiagLogLevel2["NONE"] = 0] = "NONE";
+    DiagLogLevel2[DiagLogLevel2["ERROR"] = 30] = "ERROR";
+    DiagLogLevel2[DiagLogLevel2["WARN"] = 50] = "WARN";
+    DiagLogLevel2[DiagLogLevel2["INFO"] = 60] = "INFO";
+    DiagLogLevel2[DiagLogLevel2["DEBUG"] = 70] = "DEBUG";
+    DiagLogLevel2[DiagLogLevel2["VERBOSE"] = 80] = "VERBOSE";
+    DiagLogLevel2[DiagLogLevel2["ALL"] = 9999] = "ALL";
+  })(DiagLogLevel || (DiagLogLevel = {}));
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/diag/internal/logLevelLogger.js
+  function createLogLevelDiagLogger(maxLevel, logger) {
+    if (maxLevel < DiagLogLevel.NONE) {
+      maxLevel = DiagLogLevel.NONE;
+    } else if (maxLevel > DiagLogLevel.ALL) {
+      maxLevel = DiagLogLevel.ALL;
+    }
+    logger = logger || {};
+    function _filterFunc(funcName, theLevel) {
+      var theFunc = logger[funcName];
+      if (typeof theFunc === "function" && maxLevel >= theLevel) {
+        return theFunc.bind(logger);
+      }
+      return function() {
+      };
+    }
+    return {
+      error: _filterFunc("error", DiagLogLevel.ERROR),
+      warn: _filterFunc("warn", DiagLogLevel.WARN),
+      info: _filterFunc("info", DiagLogLevel.INFO),
+      debug: _filterFunc("debug", DiagLogLevel.DEBUG),
+      verbose: _filterFunc("verbose", DiagLogLevel.VERBOSE)
+    };
+  }
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/api/diag.js
+  var __read2 = function(o21, n9) {
+    var m5 = typeof Symbol === "function" && o21[Symbol.iterator];
+    if (!m5) return o21;
+    var i = m5.call(o21), r7, ar = [], e40;
+    try {
+      while ((n9 === void 0 || n9-- > 0) && !(r7 = i.next()).done) ar.push(r7.value);
+    } catch (error) {
+      e40 = { error };
+    } finally {
+      try {
+        if (r7 && !r7.done && (m5 = i["return"])) m5.call(i);
+      } finally {
+        if (e40) throw e40.error;
+      }
+    }
+    return ar;
+  };
+  var __spreadArray2 = function(to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l3 = from.length, ar; i < l3; i++) {
+      if (ar || !(i in from)) {
+        if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+        ar[i] = from[i];
+      }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+  };
+  var API_NAME = "diag";
+  var DiagAPI = (
+    /** @class */
+    function() {
+      function DiagAPI2() {
+        function _logProxy(funcName) {
+          return function() {
+            var args = [];
+            for (var _i = 0; _i < arguments.length; _i++) {
+              args[_i] = arguments[_i];
+            }
+            var logger = getGlobal("diag");
+            if (!logger)
+              return;
+            return logger[funcName].apply(logger, __spreadArray2([], __read2(args), false));
+          };
+        }
+        var self2 = this;
+        var setLogger = function(logger, optionsOrLogLevel) {
+          var _a5, _b, _c;
+          if (optionsOrLogLevel === void 0) {
+            optionsOrLogLevel = { logLevel: DiagLogLevel.INFO };
+          }
+          if (logger === self2) {
+            var err = new Error("Cannot use diag as the logger for itself. Please use a DiagLogger implementation like ConsoleDiagLogger or a custom implementation");
+            self2.error((_a5 = err.stack) !== null && _a5 !== void 0 ? _a5 : err.message);
+            return false;
+          }
+          if (typeof optionsOrLogLevel === "number") {
+            optionsOrLogLevel = {
+              logLevel: optionsOrLogLevel
+            };
+          }
+          var oldLogger = getGlobal("diag");
+          var newLogger = createLogLevelDiagLogger((_b = optionsOrLogLevel.logLevel) !== null && _b !== void 0 ? _b : DiagLogLevel.INFO, logger);
+          if (oldLogger && !optionsOrLogLevel.suppressOverrideMessage) {
+            var stack = (_c = new Error().stack) !== null && _c !== void 0 ? _c : "<failed to generate stacktrace>";
+            oldLogger.warn("Current logger will be overwritten from " + stack);
+            newLogger.warn("Current logger will overwrite one already registered from " + stack);
+          }
+          return registerGlobal("diag", newLogger, self2, true);
+        };
+        self2.setLogger = setLogger;
+        self2.disable = function() {
+          unregisterGlobal(API_NAME, self2);
+        };
+        self2.createComponentLogger = function(options) {
+          return new DiagComponentLogger(options);
+        };
+        self2.verbose = _logProxy("verbose");
+        self2.debug = _logProxy("debug");
+        self2.info = _logProxy("info");
+        self2.warn = _logProxy("warn");
+        self2.error = _logProxy("error");
+      }
+      DiagAPI2.instance = function() {
+        if (!this._instance) {
+          this._instance = new DiagAPI2();
+        }
+        return this._instance;
+      };
+      return DiagAPI2;
+    }()
+  );
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/context/context.js
+  function createContextKey(description) {
+    return Symbol.for(description);
+  }
+  var BaseContext = (
+    /** @class */
+    /* @__PURE__ */ function() {
+      function BaseContext2(parentContext) {
+        var self2 = this;
+        self2._currentContext = parentContext ? new Map(parentContext) : /* @__PURE__ */ new Map();
+        self2.getValue = function(key) {
+          return self2._currentContext.get(key);
+        };
+        self2.setValue = function(key, value) {
+          var context = new BaseContext2(self2._currentContext);
+          context._currentContext.set(key, value);
+          return context;
+        };
+        self2.deleteValue = function(key) {
+          var context = new BaseContext2(self2._currentContext);
+          context._currentContext.delete(key);
+          return context;
+        };
+      }
+      return BaseContext2;
+    }()
+  );
+  var ROOT_CONTEXT = new BaseContext();
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/context/NoopContextManager.js
+  var __read3 = function(o21, n9) {
+    var m5 = typeof Symbol === "function" && o21[Symbol.iterator];
+    if (!m5) return o21;
+    var i = m5.call(o21), r7, ar = [], e40;
+    try {
+      while ((n9 === void 0 || n9-- > 0) && !(r7 = i.next()).done) ar.push(r7.value);
+    } catch (error) {
+      e40 = { error };
+    } finally {
+      try {
+        if (r7 && !r7.done && (m5 = i["return"])) m5.call(i);
+      } finally {
+        if (e40) throw e40.error;
+      }
     }
-    return new (P || (P = Promise))(function(resolve, reject) {
-      function fulfilled(value) {
-        try {
-          step(generator.next(value));
-        } catch (e40) {
-          reject(e40);
+    return ar;
+  };
+  var __spreadArray3 = function(to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l3 = from.length, ar; i < l3; i++) {
+      if (ar || !(i in from)) {
+        if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+        ar[i] = from[i];
+      }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+  };
+  var NoopContextManager = (
+    /** @class */
+    function() {
+      function NoopContextManager2() {
+      }
+      NoopContextManager2.prototype.active = function() {
+        return ROOT_CONTEXT;
+      };
+      NoopContextManager2.prototype.with = function(_context, fn, thisArg) {
+        var args = [];
+        for (var _i = 3; _i < arguments.length; _i++) {
+          args[_i - 3] = arguments[_i];
         }
+        return fn.call.apply(fn, __spreadArray3([thisArg], __read3(args), false));
+      };
+      NoopContextManager2.prototype.bind = function(_context, target) {
+        return target;
+      };
+      NoopContextManager2.prototype.enable = function() {
+        return this;
+      };
+      NoopContextManager2.prototype.disable = function() {
+        return this;
+      };
+      return NoopContextManager2;
+    }()
+  );
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/api/context.js
+  var __read4 = function(o21, n9) {
+    var m5 = typeof Symbol === "function" && o21[Symbol.iterator];
+    if (!m5) return o21;
+    var i = m5.call(o21), r7, ar = [], e40;
+    try {
+      while ((n9 === void 0 || n9-- > 0) && !(r7 = i.next()).done) ar.push(r7.value);
+    } catch (error) {
+      e40 = { error };
+    } finally {
+      try {
+        if (r7 && !r7.done && (m5 = i["return"])) m5.call(i);
+      } finally {
+        if (e40) throw e40.error;
       }
-      function rejected2(value) {
-        try {
-          step(generator["throw"](value));
-        } catch (e40) {
-          reject(e40);
+    }
+    return ar;
+  };
+  var __spreadArray4 = function(to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l3 = from.length, ar; i < l3; i++) {
+      if (ar || !(i in from)) {
+        if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+        ar[i] = from[i];
+      }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+  };
+  var API_NAME2 = "context";
+  var NOOP_CONTEXT_MANAGER = new NoopContextManager();
+  var ContextAPI = (
+    /** @class */
+    function() {
+      function ContextAPI2() {
+      }
+      ContextAPI2.getInstance = function() {
+        if (!this._instance) {
+          this._instance = new ContextAPI2();
+        }
+        return this._instance;
+      };
+      ContextAPI2.prototype.setGlobalContextManager = function(contextManager) {
+        return registerGlobal(API_NAME2, contextManager, DiagAPI.instance());
+      };
+      ContextAPI2.prototype.active = function() {
+        return this._getContextManager().active();
+      };
+      ContextAPI2.prototype.with = function(context, fn, thisArg) {
+        var _a5;
+        var args = [];
+        for (var _i = 3; _i < arguments.length; _i++) {
+          args[_i - 3] = arguments[_i];
+        }
+        return (_a5 = this._getContextManager()).with.apply(_a5, __spreadArray4([context, fn, thisArg], __read4(args), false));
+      };
+      ContextAPI2.prototype.bind = function(context, target) {
+        return this._getContextManager().bind(context, target);
+      };
+      ContextAPI2.prototype._getContextManager = function() {
+        return getGlobal(API_NAME2) || NOOP_CONTEXT_MANAGER;
+      };
+      ContextAPI2.prototype.disable = function() {
+        this._getContextManager().disable();
+        unregisterGlobal(API_NAME2, DiagAPI.instance());
+      };
+      return ContextAPI2;
+    }()
+  );
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/trace_flags.js
+  var TraceFlags;
+  (function(TraceFlags2) {
+    TraceFlags2[TraceFlags2["NONE"] = 0] = "NONE";
+    TraceFlags2[TraceFlags2["SAMPLED"] = 1] = "SAMPLED";
+  })(TraceFlags || (TraceFlags = {}));
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/invalid-span-constants.js
+  var INVALID_SPANID = "0000000000000000";
+  var INVALID_TRACEID = "00000000000000000000000000000000";
+  var INVALID_SPAN_CONTEXT = {
+    traceId: INVALID_TRACEID,
+    spanId: INVALID_SPANID,
+    traceFlags: TraceFlags.NONE
+  };
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/NonRecordingSpan.js
+  var NonRecordingSpan = (
+    /** @class */
+    function() {
+      function NonRecordingSpan2(_spanContext) {
+        if (_spanContext === void 0) {
+          _spanContext = INVALID_SPAN_CONTEXT;
         }
+        this._spanContext = _spanContext;
       }
-      function step(result) {
-        result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected2);
+      NonRecordingSpan2.prototype.spanContext = function() {
+        return this._spanContext;
+      };
+      NonRecordingSpan2.prototype.setAttribute = function(_key, _value) {
+        return this;
+      };
+      NonRecordingSpan2.prototype.setAttributes = function(_attributes) {
+        return this;
+      };
+      NonRecordingSpan2.prototype.addEvent = function(_name, _attributes) {
+        return this;
+      };
+      NonRecordingSpan2.prototype.addLink = function(_link) {
+        return this;
+      };
+      NonRecordingSpan2.prototype.addLinks = function(_links) {
+        return this;
+      };
+      NonRecordingSpan2.prototype.setStatus = function(_status) {
+        return this;
+      };
+      NonRecordingSpan2.prototype.updateName = function(_name) {
+        return this;
+      };
+      NonRecordingSpan2.prototype.end = function(_endTime) {
+      };
+      NonRecordingSpan2.prototype.isRecording = function() {
+        return false;
+      };
+      NonRecordingSpan2.prototype.recordException = function(_exception, _time) {
+      };
+      return NonRecordingSpan2;
+    }()
+  );
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/context-utils.js
+  var SPAN_KEY = createContextKey("OpenTelemetry Context Key SPAN");
+  function getSpan(context) {
+    return context.getValue(SPAN_KEY) || void 0;
+  }
+  function getActiveSpan() {
+    return getSpan(ContextAPI.getInstance().active());
+  }
+  function setSpan(context, span) {
+    return context.setValue(SPAN_KEY, span);
+  }
+  function deleteSpan(context) {
+    return context.deleteValue(SPAN_KEY);
+  }
+  function setSpanContext(context, spanContext) {
+    return setSpan(context, new NonRecordingSpan(spanContext));
+  }
+  function getSpanContext(context) {
+    var _a5;
+    return (_a5 = getSpan(context)) === null || _a5 === void 0 ? void 0 : _a5.spanContext();
+  }
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/spancontext-utils.js
+  var VALID_TRACEID_REGEX = /^([0-9a-f]{32})$/i;
+  var VALID_SPANID_REGEX = /^[0-9a-f]{16}$/i;
+  function isValidTraceId(traceId) {
+    return VALID_TRACEID_REGEX.test(traceId) && traceId !== INVALID_TRACEID;
+  }
+  function isValidSpanId(spanId) {
+    return VALID_SPANID_REGEX.test(spanId) && spanId !== INVALID_SPANID;
+  }
+  function isSpanContextValid(spanContext) {
+    return isValidTraceId(spanContext.traceId) && isValidSpanId(spanContext.spanId);
+  }
+  function wrapSpanContext(spanContext) {
+    return new NonRecordingSpan(spanContext);
+  }
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/NoopTracer.js
+  var contextApi = ContextAPI.getInstance();
+  var NoopTracer = (
+    /** @class */
+    function() {
+      function NoopTracer2() {
       }
-      step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-  };
-  var Semaphore = class {
-    constructor(_value, _cancelError = E_CANCELED) {
-      this._value = _value;
-      this._cancelError = _cancelError;
-      this._queue = [];
-      this._weightedWaiters = [];
-    }
-    acquire(weight = 1, priority = 0) {
-      if (weight <= 0)
-        throw new Error(`invalid weight ${weight}: must be positive`);
-      return new Promise((resolve, reject) => {
-        const task = { resolve, reject, weight, priority };
-        const i = findIndexFromEnd(this._queue, (other) => priority <= other.priority);
-        if (i === -1 && weight <= this._value) {
-          this._dispatchItem(task);
+      NoopTracer2.prototype.startSpan = function(name, options, context) {
+        if (context === void 0) {
+          context = contextApi.active();
+        }
+        var root = Boolean(options === null || options === void 0 ? void 0 : options.root);
+        if (root) {
+          return new NonRecordingSpan();
+        }
+        var parentFromContext = context && getSpanContext(context);
+        if (isSpanContext(parentFromContext) && isSpanContextValid(parentFromContext)) {
+          return new NonRecordingSpan(parentFromContext);
         } else {
-          this._queue.splice(i + 1, 0, task);
+          return new NonRecordingSpan();
         }
-      });
-    }
-    runExclusive(callback_1) {
-      return __awaiter$2(this, arguments, void 0, function* (callback, weight = 1, priority = 0) {
-        const [value, release] = yield this.acquire(weight, priority);
-        try {
-          return yield callback(value);
-        } finally {
-          release();
+      };
+      NoopTracer2.prototype.startActiveSpan = function(name, arg2, arg3, arg4) {
+        var opts;
+        var ctx;
+        var fn;
+        if (arguments.length < 2) {
+          return;
+        } else if (arguments.length === 2) {
+          fn = arg2;
+        } else if (arguments.length === 3) {
+          opts = arg2;
+          fn = arg3;
+        } else {
+          opts = arg2;
+          ctx = arg3;
+          fn = arg4;
         }
-      });
-    }
-    waitForUnlock(weight = 1, priority = 0) {
-      if (weight <= 0)
-        throw new Error(`invalid weight ${weight}: must be positive`);
-      if (this._couldLockImmediately(weight, priority)) {
-        return Promise.resolve();
-      } else {
-        return new Promise((resolve) => {
-          if (!this._weightedWaiters[weight - 1])
-            this._weightedWaiters[weight - 1] = [];
-          insertSorted(this._weightedWaiters[weight - 1], { resolve, priority });
-        });
-      }
-    }
-    isLocked() {
-      return this._value <= 0;
-    }
-    getValue() {
-      return this._value;
-    }
-    setValue(value) {
-      this._value = value;
-      this._dispatchQueue();
-    }
-    release(weight = 1) {
-      if (weight <= 0)
-        throw new Error(`invalid weight ${weight}: must be positive`);
-      this._value += weight;
-      this._dispatchQueue();
-    }
-    cancel() {
-      this._queue.forEach((entry) => entry.reject(this._cancelError));
-      this._queue = [];
-    }
-    _dispatchQueue() {
-      this._drainUnlockWaiters();
-      while (this._queue.length > 0 && this._queue[0].weight <= this._value) {
-        this._dispatchItem(this._queue.shift());
-        this._drainUnlockWaiters();
+        var parentContext = ctx !== null && ctx !== void 0 ? ctx : contextApi.active();
+        var span = this.startSpan(name, opts, parentContext);
+        var contextWithSpanSet = setSpan(parentContext, span);
+        return contextApi.with(contextWithSpanSet, fn, void 0, span);
+      };
+      return NoopTracer2;
+    }()
+  );
+  function isSpanContext(spanContext) {
+    return typeof spanContext === "object" && typeof spanContext["spanId"] === "string" && typeof spanContext["traceId"] === "string" && typeof spanContext["traceFlags"] === "number";
+  }
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/ProxyTracer.js
+  var NOOP_TRACER = new NoopTracer();
+  var ProxyTracer = (
+    /** @class */
+    function() {
+      function ProxyTracer2(_provider, name, version, options) {
+        this._provider = _provider;
+        this.name = name;
+        this.version = version;
+        this.options = options;
       }
-    }
-    _dispatchItem(item) {
-      const previousValue = this._value;
-      this._value -= item.weight;
-      item.resolve([previousValue, this._newReleaser(item.weight)]);
-    }
-    _newReleaser(weight) {
-      let called = false;
-      return () => {
-        if (called)
-          return;
-        called = true;
-        this.release(weight);
+      ProxyTracer2.prototype.startSpan = function(name, options, context) {
+        return this._getTracer().startSpan(name, options, context);
       };
-    }
-    _drainUnlockWaiters() {
-      if (this._queue.length === 0) {
-        for (let weight = this._value; weight > 0; weight--) {
-          const waiters = this._weightedWaiters[weight - 1];
-          if (!waiters)
-            continue;
-          waiters.forEach((waiter) => waiter.resolve());
-          this._weightedWaiters[weight - 1] = [];
+      ProxyTracer2.prototype.startActiveSpan = function(_name, _options, _context, _fn) {
+        var tracer2 = this._getTracer();
+        return Reflect.apply(tracer2.startActiveSpan, tracer2, arguments);
+      };
+      ProxyTracer2.prototype._getTracer = function() {
+        if (this._delegate) {
+          return this._delegate;
         }
-      } else {
-        const queuedPriority = this._queue[0].priority;
-        for (let weight = this._value; weight > 0; weight--) {
-          const waiters = this._weightedWaiters[weight - 1];
-          if (!waiters)
-            continue;
-          const i = waiters.findIndex((waiter) => waiter.priority <= queuedPriority);
-          (i === -1 ? waiters : waiters.splice(0, i)).forEach((waiter) => waiter.resolve());
+        var tracer2 = this._provider.getDelegateTracer(this.name, this.version, this.options);
+        if (!tracer2) {
+          return NOOP_TRACER;
         }
-      }
-    }
-    _couldLockImmediately(weight, priority) {
-      return (this._queue.length === 0 || this._queue[0].priority < priority) && weight <= this._value;
-    }
-  };
-  function insertSorted(a26, v) {
-    const i = findIndexFromEnd(a26, (other) => v.priority <= other.priority);
-    a26.splice(i + 1, 0, v);
-  }
-  function findIndexFromEnd(a26, predicate) {
-    for (let i = a26.length - 1; i >= 0; i--) {
-      if (predicate(a26[i])) {
-        return i;
-      }
-    }
-    return -1;
-  }
+        this._delegate = tracer2;
+        return this._delegate;
+      };
+      return ProxyTracer2;
+    }()
+  );
 
-  // ../stack-shared/dist/esm/utils/locks.js
-  var ReadWriteLock = class {
-    constructor() {
-      this.semaphore = new Semaphore(1);
-      this.readers = 0;
-      this.readersMutex = new Semaphore(1);
-    }
-    async withReadLock(callback) {
-      await this._acquireReadLock();
-      try {
-        return await callback();
-      } finally {
-        await this._releaseReadLock();
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/NoopTracerProvider.js
+  var NoopTracerProvider = (
+    /** @class */
+    function() {
+      function NoopTracerProvider2() {
       }
-    }
-    async withWriteLock(callback) {
-      await this._acquireWriteLock();
-      try {
-        return await callback();
-      } finally {
-        await this._releaseWriteLock();
+      NoopTracerProvider2.prototype.getTracer = function(_name, _version, _options) {
+        return new NoopTracer();
+      };
+      return NoopTracerProvider2;
+    }()
+  );
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace/ProxyTracerProvider.js
+  var NOOP_TRACER_PROVIDER = new NoopTracerProvider();
+  var ProxyTracerProvider = (
+    /** @class */
+    function() {
+      function ProxyTracerProvider2() {
       }
-    }
-    async _acquireReadLock() {
-      await this.readersMutex.acquire();
-      try {
-        this.readers += 1;
-        if (this.readers === 1) await this.semaphore.acquire();
-      } finally {
-        this.readersMutex.release();
+      ProxyTracerProvider2.prototype.getTracer = function(name, version, options) {
+        var _a5;
+        return (_a5 = this.getDelegateTracer(name, version, options)) !== null && _a5 !== void 0 ? _a5 : new ProxyTracer(this, name, version, options);
+      };
+      ProxyTracerProvider2.prototype.getDelegate = function() {
+        var _a5;
+        return (_a5 = this._delegate) !== null && _a5 !== void 0 ? _a5 : NOOP_TRACER_PROVIDER;
+      };
+      ProxyTracerProvider2.prototype.setDelegate = function(delegate) {
+        this._delegate = delegate;
+      };
+      ProxyTracerProvider2.prototype.getDelegateTracer = function(name, version, options) {
+        var _a5;
+        return (_a5 = this._delegate) === null || _a5 === void 0 ? void 0 : _a5.getTracer(name, version, options);
+      };
+      return ProxyTracerProvider2;
+    }()
+  );
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/api/trace.js
+  var API_NAME3 = "trace";
+  var TraceAPI = (
+    /** @class */
+    function() {
+      function TraceAPI2() {
+        this._proxyTracerProvider = new ProxyTracerProvider();
+        this.wrapSpanContext = wrapSpanContext;
+        this.isSpanContextValid = isSpanContextValid;
+        this.deleteSpan = deleteSpan;
+        this.getSpan = getSpan;
+        this.getActiveSpan = getActiveSpan;
+        this.getSpanContext = getSpanContext;
+        this.setSpan = setSpan;
+        this.setSpanContext = setSpanContext;
       }
-    }
-    async _releaseReadLock() {
-      await this.readersMutex.acquire();
+      TraceAPI2.getInstance = function() {
+        if (!this._instance) {
+          this._instance = new TraceAPI2();
+        }
+        return this._instance;
+      };
+      TraceAPI2.prototype.setGlobalTracerProvider = function(provider) {
+        var success = registerGlobal(API_NAME3, this._proxyTracerProvider, DiagAPI.instance());
+        if (success) {
+          this._proxyTracerProvider.setDelegate(provider);
+        }
+        return success;
+      };
+      TraceAPI2.prototype.getTracerProvider = function() {
+        return getGlobal(API_NAME3) || this._proxyTracerProvider;
+      };
+      TraceAPI2.prototype.getTracer = function(name, version) {
+        return this.getTracerProvider().getTracer(name, version);
+      };
+      TraceAPI2.prototype.disable = function() {
+        unregisterGlobal(API_NAME3, DiagAPI.instance());
+        this._proxyTracerProvider = new ProxyTracerProvider();
+      };
+      return TraceAPI2;
+    }()
+  );
+
+  // ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace-api.js
+  var trace = TraceAPI.getInstance();
+
+  // ../stack-shared/dist/esm/utils/telemetry.js
+  var tracer = trace.getTracer("stack-tracer");
+  async function traceSpan(optionsOrDescription, fn) {
+    let options = typeof optionsOrDescription === "string" ? { description: optionsOrDescription } : optionsOrDescription;
+    return await tracer.startActiveSpan(`STACK: ${options.description}`, async (span) => {
+      if (options.attributes) for (const [key, value] of Object.entries(options.attributes)) span.setAttribute(key, value);
       try {
-        this.readers -= 1;
-        if (this.readers === 0) this.semaphore.release();
+        return await fn(span);
       } finally {
-        this.readersMutex.release();
+        span.end();
       }
-    }
-    async _acquireWriteLock() {
-      await this.semaphore.acquire();
-    }
-    async _releaseWriteLock() {
-      this.semaphore.release();
-    }
-  };
-
-  // ../stack-shared/dist/esm/utils/stores.js
-  var storeLock = new ReadWriteLock();
-
-  // ../stack-shared/dist/esm/interface/client-interface.js
-  var USER_AGENT;
-  if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) USER_AGENT = `oauth4webapi/v3.8.3`;
-  var ERR_INVALID_ARG_VALUE = "ERR_INVALID_ARG_VALUE";
-  function CodedTypeError(message, code, cause) {
-    const err = new TypeError(message, { cause });
-    Object.assign(err, { code });
-    return err;
-  }
-  var allowInsecureRequests = Symbol();
-  var clockSkew = Symbol();
-  var clockTolerance = Symbol();
-  var customFetch = Symbol();
-  var jweDecrypt = Symbol();
-  var encoder = new TextEncoder();
-  var decoder = new TextDecoder();
-  var encodeBase64Url;
-  if (Uint8Array.prototype.toBase64) encodeBase64Url = (input) => {
-    if (input instanceof ArrayBuffer) input = new Uint8Array(input);
-    return input.toBase64({
-      alphabet: "base64url",
-      omitPadding: true
     });
-  };
-  else {
-    const CHUNK_SIZE = 32768;
-    encodeBase64Url = (input) => {
-      if (input instanceof ArrayBuffer) input = new Uint8Array(input);
-      const arr = [];
-      for (let i = 0; i < input.byteLength; i += CHUNK_SIZE) arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-      return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
-    };
   }
-  var decodeBase64Url;
-  if (Uint8Array.fromBase64) decodeBase64Url = (input) => {
-    try {
-      return Uint8Array.fromBase64(input, { alphabet: "base64url" });
-    } catch (cause) {
-      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
-    }
-  };
-  else decodeBase64Url = (input) => {
-    try {
-      const binary = atob(input.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, ""));
-      const bytes = new Uint8Array(binary.length);
-      for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-      return bytes;
-    } catch (cause) {
-      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
-    }
-  };
-  var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
-    try {
-      return new URL(url, base);
-    } catch {
-      return null;
-    }
-  };
-  var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
-  var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
-  var quotedParamMatcher = "(" + tokenMatch + ')\\s*=\\s*"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
-  var paramMatcher = "(" + tokenMatch + ")\\s*=\\s*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)";
-  var schemeRE = new RegExp("^[,\\s]*(" + tokenMatch + ")");
-  var quotedParamRE = new RegExp("^[,\\s]*" + quotedParamMatcher + "[,\\s]*(.*)");
-  var unquotedParamRE = new RegExp("^[,\\s]*" + paramMatcher + "[,\\s]*(.*)");
-  var token68ParamRE = new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
-  var nopkce = Symbol();
-  var expectNoNonce = Symbol();
-  var skipAuthTimeCheck = Symbol();
-  var skipStateCheck = Symbol();
-  var expectNoState = Symbol();
-  var _expectedIssuer = Symbol();
-  var botChallengeKnownErrors = [KnownErrors.BotChallengeRequired, KnownErrors.BotChallengeFailed];
 
   // ../stack-shared/dist/esm/utils/promises.js
   var neverResolvePromise = pending(new Promise(() => {
@@ -17568,6 +17576,7 @@ For more information, see https://radix-ui.com/primitives/docs/components/${titl
           const pill = /* @__PURE__ */ jsxs(
             "button",
             {
+              type: "button",
               onClick: () => handleClick(option.id),
               disabled: loadingOptionId !== null,
               className: cn(
@@ -18663,6 +18672,11 @@ ${colorConfig.map(([key, itemConfig]) => {
     const compareInnerRadius = pie?.compareInnerRadius ?? 36;
     const compareOuterRadius = pie?.compareOuterRadius ?? 52;
     const containerClassName = pie?.className ?? DEFAULT_PIE_CLASSNAME;
+    const showDateRange = pie?.showDateRange ?? true;
+    const centerTextMaxWidth = Math.max(64, innerRadius * 2 - 28);
+    const segmentTransitionStyle = {
+      transition: "opacity 180ms ease-out"
+    };
     const canonicalSeries = primarySegmentSeries.length > 0 ? primarySegmentSeries : compareSegmentSeries;
     const usePrimaryForCanonical = primarySegmentSeries.length > 0;
     const compareValueByKey = (0, import_react28.useMemo)(() => {
@@ -18728,14 +18742,31 @@ ${colorConfig.map(([key, itemConfig]) => {
       });
       return config;
     }, [canonicalSeries, segmentColors]);
-    const activeRow = hoverKey ? legendRows.find((r7) => r7.key === hoverKey) ?? null : null;
+    const activeRow = hoverKey != null ? legendRows.find((r7) => r7.key === hoverKey) ?? null : null;
+    const [centerDisplayKey, setCenterDisplayKey] = (0, import_react28.useState)(null);
+    const [centerDisplayVisible, setCenterDisplayVisible] = (0, import_react28.useState)(true);
+    const centerDisplayRow = centerDisplayKey != null ? legendRows.find((r7) => r7.key === centerDisplayKey) ?? null : null;
+    (0, import_react28.useEffect)(() => {
+      const nextKey = activeRow?.key ?? null;
+      if (nextKey === centerDisplayKey) {
+        return;
+      }
+      setCenterDisplayVisible(false);
+      const timeoutId = window.setTimeout(() => {
+        setCenterDisplayKey(nextKey);
+        setCenterDisplayVisible(true);
+      }, 120);
+      return () => {
+        window.clearTimeout(timeoutId);
+      };
+    }, [activeRow?.key, centerDisplayKey]);
     const activeDelta = activeRow ? formatDelta(activeRow.value, activeRow.prevValue) : formatDelta(aggregatedPrimaryTotal, aggregatedCompareTotal);
     const windowDays = visibleEnd - visibleStart + 1;
     const startLabel = fmtValue(fullData[visibleStart].ts, xFormatKind);
     const endLabel = fmtValue(fullData[visibleEnd].ts, xFormatKind);
     const outerData = legendRows.map((r7) => ({ name: cssIdent(r7.key), hoverKey: r7.key, value: r7.value, fill: r7.fill }));
     const innerData = legendRows.map((r7) => ({ name: cssIdent(r7.key), hoverKey: r7.key, value: r7.prevValue, fill: r7.fillCompare }));
-    const activeIdx = hoverKey ? legendRows.findIndex((r7) => r7.key === hoverKey) : -1;
+    const activeIdx = hoverKey != null ? legendRows.findIndex((r7) => r7.key === hoverKey) : -1;
     return /* @__PURE__ */ jsxs(
       "div",
       {
@@ -18789,6 +18820,7 @@ ${colorConfig.map(([key, itemConfig]) => {
                               {
                                 fill: `var(--color-${d.name})`,
                                 opacity: inactive ? 0.22 : 1,
+                                style: segmentTransitionStyle,
                                 onMouseEnter: () => setHoverKey(d.hoverKey),
                                 onMouseLeave: () => setHoverKey(null)
                               },
@@ -18819,6 +18851,7 @@ ${colorConfig.map(([key, itemConfig]) => {
                               {
                                 fill: `var(--color-compare-${d.name})`,
                                 opacity: inactive ? 0.22 : 0.95,
+                                style: segmentTransitionStyle,
                                 onMouseEnter: () => setHoverKey(d.hoverKey),
                                 onMouseLeave: () => setHoverKey(null)
                               },
@@ -18830,13 +18863,22 @@ ${colorConfig.map(([key, itemConfig]) => {
                     ]
                   }
                 ) }),
-                /* @__PURE__ */ jsxs("div", { className: "pointer-events-none absolute inset-0 flex flex-col items-center justify-center text-center", children: [
-                  /* @__PURE__ */ jsx("span", { className: "block max-w-[68px] truncate font-mono text-[9px] uppercase tracking-wider text-muted-foreground", children: activeRow ? activeRow.label : strings.pieTotalCenter }),
-                  /* @__PURE__ */ jsx("span", { className: "mt-0.5 block max-w-[72px] truncate font-mono text-xl font-semibold leading-none tabular-nums text-foreground", children: fmtValue(activeRow ? activeRow.value : canonicalTotal, yFormatKind) })
-                ] })
+                /* @__PURE__ */ jsxs(
+                  "div",
+                  {
+                    className: cn(
+                      "pointer-events-none absolute inset-0 flex flex-col items-center justify-center text-center transition-opacity duration-200 ease-out",
+                      centerDisplayVisible ? "opacity-100" : "opacity-35"
+                    ),
+                    children: [
+                      /* @__PURE__ */ jsx("span", { className: "block truncate font-mono text-[9px] uppercase tracking-wider text-muted-foreground", style: { maxWidth: centerTextMaxWidth }, children: centerDisplayRow ? centerDisplayRow.label : strings.pieTotalCenter }),
+                      /* @__PURE__ */ jsx("span", { className: "mt-0.5 block truncate font-mono text-xl font-semibold leading-none tabular-nums text-foreground", style: { maxWidth: centerTextMaxWidth }, children: fmtValue(centerDisplayRow ? centerDisplayRow.value : canonicalTotal, yFormatKind) })
+                    ]
+                  }
+                )
               ] }),
-              /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 text-center", children: [
-                /* @__PURE__ */ jsxs("span", { className: "font-mono text-[10px] uppercase tracking-wider text-muted-foreground/80", children: [
+              (showDateRange || showCompare) && /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 text-center", children: [
+                showDateRange && /* @__PURE__ */ jsxs("span", { className: "font-mono text-[10px] uppercase tracking-wider text-muted-foreground/80", children: [
                   startLabel,
                   " \u2013 ",
                   endLabel
@@ -18857,7 +18899,7 @@ ${colorConfig.map(([key, itemConfig]) => {
                   onFocus: () => setHoverKey(r7.key),
                   onBlur: () => setHoverKey(null),
                   className: cn(
-                    "flex w-full items-center gap-2.5 rounded-md px-2 py-1.5 text-left transition-[background-color,opacity] duration-150 hover:bg-foreground/[0.04] hover:transition-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-foreground/20",
+                    "flex w-full items-center gap-2.5 rounded-md px-2 py-1.5 text-left transition-[background-color,opacity] duration-200 ease-out hover:bg-foreground/[0.04] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-foreground/20",
                     isActive && "bg-foreground/[0.05]",
                     dimmed && "opacity-50"
                   ),