@hexclave/shared 1.0.0

package/dist/esm/interface/client-interface.js

@@ -0,0 +1,1946 @@
+import { HexclaveAssertionError, throwErr } from "../utils/errors.js";
+import { filterUndefined, filterUndefinedOrNull } from "../utils/objects.js";
+import { deindent } from "../utils/strings.js";
+import { publishableClientKeyNotNecessarySentinel } from "../utils/oauth.js";
+import { Result } from "../utils/results.js";
+import { KnownError, KnownErrors } from "../known-errors.js";
+import { urlString } from "../utils/urls.js";
+import { AccessToken, InternalSession } from "../sessions.js";
+import { generateSecureRandomString } from "../utils/crypto.js";
+import { globalVar } from "../utils/globals.js";
+import { HTTP_METHODS } from "../utils/http.js";
+import { wait } from "../utils/promises.js";
+
+//#region ../../node_modules/.pnpm/oauth4webapi@3.8.3/node_modules/oauth4webapi/build/index.js
+let USER_AGENT;
+if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) USER_AGENT = `oauth4webapi/v3.8.3`;
+function looseInstanceOf(input, expected) {
+	if (input == null) return false;
+	try {
+		return input instanceof expected || Object.getPrototypeOf(input)[Symbol.toStringTag] === expected.prototype[Symbol.toStringTag];
+	} catch {
+		return false;
+	}
+}
+const ERR_INVALID_ARG_VALUE = "ERR_INVALID_ARG_VALUE";
+const ERR_INVALID_ARG_TYPE = "ERR_INVALID_ARG_TYPE";
+function CodedTypeError(message, code, cause) {
+	const err = new TypeError(message, { cause });
+	Object.assign(err, { code });
+	return err;
+}
+const allowInsecureRequests = Symbol();
+const clockSkew = Symbol();
+const clockTolerance = Symbol();
+const customFetch = Symbol();
+const jweDecrypt = Symbol();
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+function buf(input) {
+	if (typeof input === "string") return encoder.encode(input);
+	return decoder.decode(input);
+}
+let encodeBase64Url;
+if (Uint8Array.prototype.toBase64) encodeBase64Url = (input) => {
+	if (input instanceof ArrayBuffer) input = new Uint8Array(input);
+	return input.toBase64({
+		alphabet: "base64url",
+		omitPadding: true
+	});
+};
+else {
+	const CHUNK_SIZE = 32768;
+	encodeBase64Url = (input) => {
+		if (input instanceof ArrayBuffer) input = new Uint8Array(input);
+		const arr = [];
+		for (let i = 0; i < input.byteLength; i += CHUNK_SIZE) arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+		return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+	};
+}
+let decodeBase64Url;
+if (Uint8Array.fromBase64) decodeBase64Url = (input) => {
+	try {
+		return Uint8Array.fromBase64(input, { alphabet: "base64url" });
+	} catch (cause) {
+		throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+	}
+};
+else decodeBase64Url = (input) => {
+	try {
+		const binary = atob(input.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, ""));
+		const bytes = new Uint8Array(binary.length);
+		for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+		return bytes;
+	} catch (cause) {
+		throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+	}
+};
+function b64u(input) {
+	if (typeof input === "string") return decodeBase64Url(input);
+	return encodeBase64Url(input);
+}
+var UnsupportedOperationError = class extends Error {
+	code;
+	constructor(message, options) {
+		super(message, options);
+		this.name = this.constructor.name;
+		this.code = UNSUPPORTED_OPERATION;
+		Error.captureStackTrace?.(this, this.constructor);
+	}
+};
+var OperationProcessingError = class extends Error {
+	code;
+	constructor(message, options) {
+		super(message, options);
+		this.name = this.constructor.name;
+		if (options?.code) this.code = options?.code;
+		Error.captureStackTrace?.(this, this.constructor);
+	}
+};
+function OPE(message, code, cause) {
+	return new OperationProcessingError(message, {
+		code,
+		cause
+	});
+}
+function isJsonObject(input) {
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return false;
+	return true;
+}
+function prepareHeaders(input) {
+	if (looseInstanceOf(input, Headers)) input = Object.fromEntries(input.entries());
+	const headers = new Headers(input ?? {});
+	if (USER_AGENT && !headers.has("user-agent")) headers.set("user-agent", USER_AGENT);
+	if (headers.has("authorization")) throw CodedTypeError("\"options.headers\" must not include the \"authorization\" header name", ERR_INVALID_ARG_VALUE);
+	return headers;
+}
+function signal(url, value) {
+	if (value !== void 0) {
+		if (typeof value === "function") value = value(url.href);
+		if (!(value instanceof AbortSignal)) throw CodedTypeError("\"options.signal\" must return or be an instance of AbortSignal", ERR_INVALID_ARG_TYPE);
+		return value;
+	}
+}
+function assertNumber(input, allow0, it, code, cause) {
+	try {
+		if (typeof input !== "number" || !Number.isFinite(input)) throw CodedTypeError(`${it} must be a number`, ERR_INVALID_ARG_TYPE, cause);
+		if (input > 0) return;
+		if (allow0) {
+			if (input !== 0) throw CodedTypeError(`${it} must be a non-negative number`, ERR_INVALID_ARG_VALUE, cause);
+			return;
+		}
+		throw CodedTypeError(`${it} must be a positive number`, ERR_INVALID_ARG_VALUE, cause);
+	} catch (err) {
+		if (code) throw OPE(err.message, code, cause);
+		throw err;
+	}
+}
+function assertString(input, it, code, cause) {
+	try {
+		if (typeof input !== "string") throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);
+		if (input.length === 0) throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);
+	} catch (err) {
+		if (code) throw OPE(err.message, code, cause);
+		throw err;
+	}
+}
+function assertApplicationJson(response) {
+	assertContentType(response, "application/json");
+}
+function notJson(response, ...types) {
+	let msg = "\"response\" content-type must be ";
+	if (types.length > 2) {
+		const last = types.pop();
+		msg += `${types.join(", ")}, or ${last}`;
+	} else if (types.length === 2) msg += `${types[0]} or ${types[1]}`;
+	else msg += types[0];
+	return OPE(msg, RESPONSE_IS_NOT_JSON, response);
+}
+function assertContentType(response, contentType) {
+	if (getContentType(response) !== contentType) throw notJson(response, contentType);
+}
+function getClockSkew(client) {
+	const skew = client?.[clockSkew];
+	return typeof skew === "number" && Number.isFinite(skew) ? skew : 0;
+}
+function getClockTolerance(client) {
+	const tolerance = client?.[clockTolerance];
+	return typeof tolerance === "number" && Number.isFinite(tolerance) && Math.sign(tolerance) !== -1 ? tolerance : 30;
+}
+function epochTime() {
+	return Math.floor(Date.now() / 1e3);
+}
+function assertAs(as) {
+	if (typeof as !== "object" || as === null) throw CodedTypeError("\"as\" must be an object", ERR_INVALID_ARG_TYPE);
+	assertString(as.issuer, "\"as.issuer\"");
+}
+function assertClient(client) {
+	if (typeof client !== "object" || client === null) throw CodedTypeError("\"client\" must be an object", ERR_INVALID_ARG_TYPE);
+	assertString(client.client_id, "\"client.client_id\"");
+}
+function ClientSecretPost(clientSecret) {
+	assertString(clientSecret, "\"clientSecret\"");
+	return (_as, client, body, _headers) => {
+		body.set("client_id", client.client_id);
+		body.set("client_secret", clientSecret);
+	};
+}
+const URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
+	try {
+		return new URL(url, base);
+	} catch {
+		return null;
+	}
+};
+function checkProtocol(url, enforceHttps) {
+	if (enforceHttps && url.protocol !== "https:") throw OPE("only requests to HTTPS are allowed", HTTP_REQUEST_FORBIDDEN, url);
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw OPE("only HTTP and HTTPS requests are allowed", REQUEST_PROTOCOL_FORBIDDEN, url);
+}
+function validateEndpoint(value, endpoint, useMtlsAlias, enforceHttps) {
+	let url;
+	if (typeof value !== "string" || !(url = URLParse(value))) throw OPE(`authorization server metadata does not contain a valid ${useMtlsAlias ? `"as.mtls_endpoint_aliases.${endpoint}"` : `"as.${endpoint}"`}`, value === void 0 ? MISSING_SERVER_METADATA : INVALID_SERVER_METADATA, { attribute: useMtlsAlias ? `mtls_endpoint_aliases.${endpoint}` : endpoint });
+	checkProtocol(url, enforceHttps);
+	return url;
+}
+function resolveEndpoint(as, endpoint, useMtlsAlias, enforceHttps) {
+	if (useMtlsAlias && as.mtls_endpoint_aliases && endpoint in as.mtls_endpoint_aliases) return validateEndpoint(as.mtls_endpoint_aliases[endpoint], endpoint, useMtlsAlias, enforceHttps);
+	return validateEndpoint(as[endpoint], endpoint, useMtlsAlias, enforceHttps);
+}
+var ResponseBodyError = class extends Error {
+	cause;
+	code;
+	error;
+	status;
+	error_description;
+	response;
+	constructor(message, options) {
+		super(message, options);
+		this.name = this.constructor.name;
+		this.code = RESPONSE_BODY_ERROR;
+		this.cause = options.cause;
+		this.error = options.cause.error;
+		this.status = options.response.status;
+		this.error_description = options.cause.error_description;
+		Object.defineProperty(this, "response", {
+			enumerable: false,
+			value: options.response
+		});
+		Error.captureStackTrace?.(this, this.constructor);
+	}
+};
+var AuthorizationResponseError = class extends Error {
+	cause;
+	code;
+	error;
+	error_description;
+	constructor(message, options) {
+		super(message, options);
+		this.name = this.constructor.name;
+		this.code = AUTHORIZATION_RESPONSE_ERROR;
+		this.cause = options.cause;
+		this.error = options.cause.get("error");
+		this.error_description = options.cause.get("error_description") ?? void 0;
+		Error.captureStackTrace?.(this, this.constructor);
+	}
+};
+var WWWAuthenticateChallengeError = class extends Error {
+	cause;
+	code;
+	response;
+	status;
+	constructor(message, options) {
+		super(message, options);
+		this.name = this.constructor.name;
+		this.code = WWW_AUTHENTICATE_CHALLENGE;
+		this.cause = options.cause;
+		this.status = options.response.status;
+		this.response = options.response;
+		Object.defineProperty(this, "response", { enumerable: false });
+		Error.captureStackTrace?.(this, this.constructor);
+	}
+};
+const tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
+const token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
+const quotedParamMatcher = "(" + tokenMatch + ")\\s*=\\s*\"((?:[^\"\\\\]|\\\\[\\s\\S])*)\"";
+const paramMatcher = "(" + tokenMatch + ")\\s*=\\s*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)";
+const schemeRE = new RegExp("^[,\\s]*(" + tokenMatch + ")");
+const quotedParamRE = new RegExp("^[,\\s]*" + quotedParamMatcher + "[,\\s]*(.*)");
+const unquotedParamRE = new RegExp("^[,\\s]*" + paramMatcher + "[,\\s]*(.*)");
+const token68ParamRE = new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
+function parseWwwAuthenticateChallenges(response) {
+	if (!looseInstanceOf(response, Response)) throw CodedTypeError("\"response\" must be an instance of Response", ERR_INVALID_ARG_TYPE);
+	const header = response.headers.get("www-authenticate");
+	if (header === null) return;
+	const challenges = [];
+	let rest = header;
+	while (rest) {
+		let match = rest.match(schemeRE);
+		const scheme = match?.["1"].toLowerCase();
+		if (!scheme) return;
+		const afterScheme = rest.substring(match[0].length);
+		if (afterScheme && !afterScheme.match(/^[\s,]/)) return;
+		const spaceMatch = afterScheme.match(/^\s+(.*)$/);
+		const hasParameters = !!spaceMatch;
+		rest = spaceMatch ? spaceMatch[1] : void 0;
+		const parameters = {};
+		let token68;
+		if (hasParameters) while (rest) {
+			let key;
+			let value;
+			if (match = rest.match(quotedParamRE)) {
+				[, key, value, rest] = match;
+				if (value.includes("\\")) try {
+					value = JSON.parse(`"${value}"`);
+				} catch {}
+				parameters[key.toLowerCase()] = value;
+				continue;
+			}
+			if (match = rest.match(unquotedParamRE)) {
+				[, key, value, rest] = match;
+				parameters[key.toLowerCase()] = value;
+				continue;
+			}
+			if (match = rest.match(token68ParamRE)) {
+				if (Object.keys(parameters).length) break;
+				[, token68, rest] = match;
+				break;
+			}
+			return;
+		}
+		else rest = afterScheme || void 0;
+		const challenge = {
+			scheme,
+			parameters
+		};
+		if (token68) challenge.token68 = token68;
+		challenges.push(challenge);
+	}
+	if (!challenges.length) return;
+	return challenges;
+}
+async function parseOAuthResponseErrorBody(response) {
+	if (response.status > 399 && response.status < 500) {
+		assertReadableResponse(response);
+		assertApplicationJson(response);
+		try {
+			const json = await response.clone().json();
+			if (isJsonObject(json) && typeof json.error === "string" && json.error.length) return json;
+		} catch {}
+	}
+}
+async function checkOAuthBodyError(response, expected, label) {
+	if (response.status !== expected) {
+		checkAuthenticationChallenges(response);
+		let err;
+		if (err = await parseOAuthResponseErrorBody(response)) {
+			await response.body?.cancel();
+			throw new ResponseBodyError("server responded with an error in the response body", {
+				cause: err,
+				response
+			});
+		}
+		throw OPE(`"response" is not a conform ${label} response (unexpected HTTP status code)`, RESPONSE_IS_NOT_CONFORM, response);
+	}
+}
+function assertDPoP(option) {
+	if (!branded.has(option)) throw CodedTypeError("\"options.DPoP\" is not a valid DPoPHandle", ERR_INVALID_ARG_VALUE);
+}
+function getContentType(input) {
+	return input.headers.get("content-type")?.split(";")[0];
+}
+async function authenticatedRequest(as, client, clientAuthentication, url, body, headers, options) {
+	await clientAuthentication(as, client, body, headers);
+	headers.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8");
+	return (options?.[customFetch] || fetch)(url.href, {
+		body,
+		headers: Object.fromEntries(headers.entries()),
+		method: "POST",
+		redirect: "manual",
+		signal: signal(url, options?.signal)
+	});
+}
+async function tokenEndpointRequest(as, client, clientAuthentication, grantType, parameters, options) {
+	const url = resolveEndpoint(as, "token_endpoint", client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);
+	parameters.set("grant_type", grantType);
+	const headers = prepareHeaders(options?.headers);
+	headers.set("accept", "application/json");
+	if (options?.DPoP !== void 0) {
+		assertDPoP(options.DPoP);
+		await options.DPoP.addProof(url, headers, "POST");
+	}
+	const response = await authenticatedRequest(as, client, clientAuthentication, url, parameters, headers, options);
+	options?.DPoP?.cacheNonce(response, url);
+	return response;
+}
+async function refreshTokenGrantRequest(as, client, clientAuthentication, refreshToken, options) {
+	assertAs(as);
+	assertClient(client);
+	assertString(refreshToken, "\"refreshToken\"");
+	const parameters = new URLSearchParams(options?.additionalParameters);
+	parameters.set("refresh_token", refreshToken);
+	return tokenEndpointRequest(as, client, clientAuthentication, "refresh_token", parameters, options);
+}
+const idTokenClaims = /* @__PURE__ */ new WeakMap();
+const jwtRefs = /* @__PURE__ */ new WeakMap();
+function getValidatedIdTokenClaims(ref) {
+	if (!ref.id_token) return;
+	const claims = idTokenClaims.get(ref);
+	if (!claims) throw CodedTypeError("\"ref\" was already garbage collected or did not resolve from the proper sources", ERR_INVALID_ARG_VALUE);
+	return claims;
+}
+async function processGenericAccessTokenResponse(as, client, response, additionalRequiredIdTokenClaims, decryptFn, recognizedTokenTypes) {
+	assertAs(as);
+	assertClient(client);
+	if (!looseInstanceOf(response, Response)) throw CodedTypeError("\"response\" must be an instance of Response", ERR_INVALID_ARG_TYPE);
+	await checkOAuthBodyError(response, 200, "Token Endpoint");
+	assertReadableResponse(response);
+	const json = await getResponseJsonBody(response);
+	assertString(json.access_token, "\"response\" body \"access_token\" property", INVALID_RESPONSE, { body: json });
+	assertString(json.token_type, "\"response\" body \"token_type\" property", INVALID_RESPONSE, { body: json });
+	json.token_type = json.token_type.toLowerCase();
+	if (json.expires_in !== void 0) {
+		let expiresIn = typeof json.expires_in !== "number" ? parseFloat(json.expires_in) : json.expires_in;
+		assertNumber(expiresIn, true, "\"response\" body \"expires_in\" property", INVALID_RESPONSE, { body: json });
+		json.expires_in = expiresIn;
+	}
+	if (json.refresh_token !== void 0) assertString(json.refresh_token, "\"response\" body \"refresh_token\" property", INVALID_RESPONSE, { body: json });
+	if (json.scope !== void 0 && typeof json.scope !== "string") throw OPE("\"response\" body \"scope\" property must be a string", INVALID_RESPONSE, { body: json });
+	if (json.id_token !== void 0) {
+		assertString(json.id_token, "\"response\" body \"id_token\" property", INVALID_RESPONSE, { body: json });
+		const requiredClaims = [
+			"aud",
+			"exp",
+			"iat",
+			"iss",
+			"sub"
+		];
+		if (client.require_auth_time === true) requiredClaims.push("auth_time");
+		if (client.default_max_age !== void 0) {
+			assertNumber(client.default_max_age, true, "\"client.default_max_age\"");
+			requiredClaims.push("auth_time");
+		}
+		if (additionalRequiredIdTokenClaims?.length) requiredClaims.push(...additionalRequiredIdTokenClaims);
+		const { claims, jwt } = await validateJwt(json.id_token, checkSigningAlgorithm.bind(void 0, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported, "RS256"), getClockSkew(client), getClockTolerance(client), decryptFn).then(validatePresence.bind(void 0, requiredClaims)).then(validateIssuer.bind(void 0, as)).then(validateAudience.bind(void 0, client.client_id));
+		if (Array.isArray(claims.aud) && claims.aud.length !== 1) {
+			if (claims.azp === void 0) throw OPE("ID Token \"aud\" (audience) claim includes additional untrusted audiences", JWT_CLAIM_COMPARISON, {
+				claims,
+				claim: "aud"
+			});
+			if (claims.azp !== client.client_id) throw OPE("unexpected ID Token \"azp\" (authorized party) claim value", JWT_CLAIM_COMPARISON, {
+				expected: client.client_id,
+				claims,
+				claim: "azp"
+			});
+		}
+		if (claims.auth_time !== void 0) assertNumber(claims.auth_time, true, "ID Token \"auth_time\" (authentication time)", INVALID_RESPONSE, { claims });
+		jwtRefs.set(response, jwt);
+		idTokenClaims.set(json, claims);
+	}
+	if (recognizedTokenTypes?.[json.token_type] !== void 0) recognizedTokenTypes[json.token_type](response, json);
+	else if (json.token_type !== "dpop" && json.token_type !== "bearer") throw new UnsupportedOperationError("unsupported `token_type` value", { cause: { body: json } });
+	return json;
+}
+function checkAuthenticationChallenges(response) {
+	let challenges;
+	if (challenges = parseWwwAuthenticateChallenges(response)) throw new WWWAuthenticateChallengeError("server responded with a challenge in the WWW-Authenticate HTTP Header", {
+		cause: challenges,
+		response
+	});
+}
+async function processRefreshTokenResponse(as, client, response, options) {
+	return processGenericAccessTokenResponse(as, client, response, void 0, options?.[jweDecrypt], options?.recognizedTokenTypes);
+}
+function validateAudience(expected, result) {
+	if (Array.isArray(result.claims.aud)) {
+		if (!result.claims.aud.includes(expected)) throw OPE("unexpected JWT \"aud\" (audience) claim value", JWT_CLAIM_COMPARISON, {
+			expected,
+			claims: result.claims,
+			claim: "aud"
+		});
+	} else if (result.claims.aud !== expected) throw OPE("unexpected JWT \"aud\" (audience) claim value", JWT_CLAIM_COMPARISON, {
+		expected,
+		claims: result.claims,
+		claim: "aud"
+	});
+	return result;
+}
+function validateIssuer(as, result) {
+	const expected = as[_expectedIssuer]?.(result) ?? as.issuer;
+	if (result.claims.iss !== expected) throw OPE("unexpected JWT \"iss\" (issuer) claim value", JWT_CLAIM_COMPARISON, {
+		expected,
+		claims: result.claims,
+		claim: "iss"
+	});
+	return result;
+}
+const branded = /* @__PURE__ */ new WeakSet();
+function brand(searchParams) {
+	branded.add(searchParams);
+	return searchParams;
+}
+const nopkce = Symbol();
+async function authorizationCodeGrantRequest(as, client, clientAuthentication, callbackParameters, redirectUri, codeVerifier, options) {
+	assertAs(as);
+	assertClient(client);
+	if (!branded.has(callbackParameters)) throw CodedTypeError("\"callbackParameters\" must be an instance of URLSearchParams obtained from \"validateAuthResponse()\", or \"validateJwtAuthResponse()", ERR_INVALID_ARG_VALUE);
+	assertString(redirectUri, "\"redirectUri\"");
+	const code = getURLSearchParameter(callbackParameters, "code");
+	if (!code) throw OPE("no authorization code in \"callbackParameters\"", INVALID_RESPONSE);
+	const parameters = new URLSearchParams(options?.additionalParameters);
+	parameters.set("redirect_uri", redirectUri);
+	parameters.set("code", code);
+	if (codeVerifier !== nopkce) {
+		assertString(codeVerifier, "\"codeVerifier\"");
+		parameters.set("code_verifier", codeVerifier);
+	}
+	return tokenEndpointRequest(as, client, clientAuthentication, "authorization_code", parameters, options);
+}
+const jwtClaimNames = {
+	aud: "audience",
+	c_hash: "code hash",
+	client_id: "client id",
+	exp: "expiration time",
+	iat: "issued at",
+	iss: "issuer",
+	jti: "jwt id",
+	nonce: "nonce",
+	s_hash: "state hash",
+	sub: "subject",
+	ath: "access token hash",
+	htm: "http method",
+	htu: "http uri",
+	cnf: "confirmation",
+	auth_time: "authentication time"
+};
+function validatePresence(required, result) {
+	for (const claim of required) if (result.claims[claim] === void 0) throw OPE(`JWT "${claim}" (${jwtClaimNames[claim]}) claim missing`, INVALID_RESPONSE, { claims: result.claims });
+	return result;
+}
+const expectNoNonce = Symbol();
+const skipAuthTimeCheck = Symbol();
+async function processAuthorizationCodeResponse(as, client, response, options) {
+	if (typeof options?.expectedNonce === "string" || typeof options?.maxAge === "number" || options?.requireIdToken) return processAuthorizationCodeOpenIDResponse(as, client, response, options.expectedNonce, options.maxAge, options[jweDecrypt], options.recognizedTokenTypes);
+	return processAuthorizationCodeOAuth2Response(as, client, response, options?.[jweDecrypt], options?.recognizedTokenTypes);
+}
+async function processAuthorizationCodeOpenIDResponse(as, client, response, expectedNonce, maxAge, decryptFn, recognizedTokenTypes) {
+	const additionalRequiredClaims = [];
+	switch (expectedNonce) {
+		case void 0:
+			expectedNonce = expectNoNonce;
+			break;
+		case expectNoNonce: break;
+		default:
+			assertString(expectedNonce, "\"expectedNonce\" argument");
+			additionalRequiredClaims.push("nonce");
+	}
+	maxAge ??= client.default_max_age;
+	switch (maxAge) {
+		case void 0:
+			maxAge = skipAuthTimeCheck;
+			break;
+		case skipAuthTimeCheck: break;
+		default:
+			assertNumber(maxAge, true, "\"maxAge\" argument");
+			additionalRequiredClaims.push("auth_time");
+	}
+	const result = await processGenericAccessTokenResponse(as, client, response, additionalRequiredClaims, decryptFn, recognizedTokenTypes);
+	assertString(result.id_token, "\"response\" body \"id_token\" property", INVALID_RESPONSE, { body: result });
+	const claims = getValidatedIdTokenClaims(result);
+	if (maxAge !== skipAuthTimeCheck) {
+		const now = epochTime() + getClockSkew(client);
+		const tolerance = getClockTolerance(client);
+		if (claims.auth_time + maxAge < now - tolerance) throw OPE("too much time has elapsed since the last End-User authentication", JWT_TIMESTAMP_CHECK, {
+			claims,
+			now,
+			tolerance,
+			claim: "auth_time"
+		});
+	}
+	if (expectedNonce === expectNoNonce) {
+		if (claims.nonce !== void 0) throw OPE("unexpected ID Token \"nonce\" claim value", JWT_CLAIM_COMPARISON, {
+			expected: void 0,
+			claims,
+			claim: "nonce"
+		});
+	} else if (claims.nonce !== expectedNonce) throw OPE("unexpected ID Token \"nonce\" claim value", JWT_CLAIM_COMPARISON, {
+		expected: expectedNonce,
+		claims,
+		claim: "nonce"
+	});
+	return result;
+}
+async function processAuthorizationCodeOAuth2Response(as, client, response, decryptFn, recognizedTokenTypes) {
+	const result = await processGenericAccessTokenResponse(as, client, response, void 0, decryptFn, recognizedTokenTypes);
+	const claims = getValidatedIdTokenClaims(result);
+	if (claims) {
+		if (client.default_max_age !== void 0) {
+			assertNumber(client.default_max_age, true, "\"client.default_max_age\"");
+			const now = epochTime() + getClockSkew(client);
+			const tolerance = getClockTolerance(client);
+			if (claims.auth_time + client.default_max_age < now - tolerance) throw OPE("too much time has elapsed since the last End-User authentication", JWT_TIMESTAMP_CHECK, {
+				claims,
+				now,
+				tolerance,
+				claim: "auth_time"
+			});
+		}
+		if (claims.nonce !== void 0) throw OPE("unexpected ID Token \"nonce\" claim value", JWT_CLAIM_COMPARISON, {
+			expected: void 0,
+			claims,
+			claim: "nonce"
+		});
+	}
+	return result;
+}
+const WWW_AUTHENTICATE_CHALLENGE = "OAUTH_WWW_AUTHENTICATE_CHALLENGE";
+const RESPONSE_BODY_ERROR = "OAUTH_RESPONSE_BODY_ERROR";
+const UNSUPPORTED_OPERATION = "OAUTH_UNSUPPORTED_OPERATION";
+const AUTHORIZATION_RESPONSE_ERROR = "OAUTH_AUTHORIZATION_RESPONSE_ERROR";
+const PARSE_ERROR = "OAUTH_PARSE_ERROR";
+const INVALID_RESPONSE = "OAUTH_INVALID_RESPONSE";
+const RESPONSE_IS_NOT_JSON = "OAUTH_RESPONSE_IS_NOT_JSON";
+const RESPONSE_IS_NOT_CONFORM = "OAUTH_RESPONSE_IS_NOT_CONFORM";
+const HTTP_REQUEST_FORBIDDEN = "OAUTH_HTTP_REQUEST_FORBIDDEN";
+const REQUEST_PROTOCOL_FORBIDDEN = "OAUTH_REQUEST_PROTOCOL_FORBIDDEN";
+const JWT_TIMESTAMP_CHECK = "OAUTH_JWT_TIMESTAMP_CHECK_FAILED";
+const JWT_CLAIM_COMPARISON = "OAUTH_JWT_CLAIM_COMPARISON_FAILED";
+const MISSING_SERVER_METADATA = "OAUTH_MISSING_SERVER_METADATA";
+const INVALID_SERVER_METADATA = "OAUTH_INVALID_SERVER_METADATA";
+function assertReadableResponse(response) {
+	if (response.bodyUsed) throw CodedTypeError("\"response\" body has been used already", ERR_INVALID_ARG_VALUE);
+}
+async function validateJwt(jws, checkAlg, clockSkew, clockTolerance, decryptJwt) {
+	let { 0: protectedHeader, 1: payload, length } = jws.split(".");
+	if (length === 5) if (decryptJwt !== void 0) {
+		jws = await decryptJwt(jws);
+		({0: protectedHeader, 1: payload, length} = jws.split("."));
+	} else throw new UnsupportedOperationError("JWE decryption is not configured", { cause: jws });
+	if (length !== 3) throw OPE("Invalid JWT", INVALID_RESPONSE, jws);
+	let header;
+	try {
+		header = JSON.parse(buf(b64u(protectedHeader)));
+	} catch (cause) {
+		throw OPE("failed to parse JWT Header body as base64url encoded JSON", PARSE_ERROR, cause);
+	}
+	if (!isJsonObject(header)) throw OPE("JWT Header must be a top level object", INVALID_RESPONSE, jws);
+	checkAlg(header);
+	if (header.crit !== void 0) throw new UnsupportedOperationError("no JWT \"crit\" header parameter extensions are supported", { cause: { header } });
+	let claims;
+	try {
+		claims = JSON.parse(buf(b64u(payload)));
+	} catch (cause) {
+		throw OPE("failed to parse JWT Payload body as base64url encoded JSON", PARSE_ERROR, cause);
+	}
+	if (!isJsonObject(claims)) throw OPE("JWT Payload must be a top level object", INVALID_RESPONSE, jws);
+	const now = epochTime() + clockSkew;
+	if (claims.exp !== void 0) {
+		if (typeof claims.exp !== "number") throw OPE("unexpected JWT \"exp\" (expiration time) claim type", INVALID_RESPONSE, { claims });
+		if (claims.exp <= now - clockTolerance) throw OPE("unexpected JWT \"exp\" (expiration time) claim value, expiration is past current timestamp", JWT_TIMESTAMP_CHECK, {
+			claims,
+			now,
+			tolerance: clockTolerance,
+			claim: "exp"
+		});
+	}
+	if (claims.iat !== void 0) {
+		if (typeof claims.iat !== "number") throw OPE("unexpected JWT \"iat\" (issued at) claim type", INVALID_RESPONSE, { claims });
+	}
+	if (claims.iss !== void 0) {
+		if (typeof claims.iss !== "string") throw OPE("unexpected JWT \"iss\" (issuer) claim type", INVALID_RESPONSE, { claims });
+	}
+	if (claims.nbf !== void 0) {
+		if (typeof claims.nbf !== "number") throw OPE("unexpected JWT \"nbf\" (not before) claim type", INVALID_RESPONSE, { claims });
+		if (claims.nbf > now + clockTolerance) throw OPE("unexpected JWT \"nbf\" (not before) claim value", JWT_TIMESTAMP_CHECK, {
+			claims,
+			now,
+			tolerance: clockTolerance,
+			claim: "nbf"
+		});
+	}
+	if (claims.aud !== void 0) {
+		if (typeof claims.aud !== "string" && !Array.isArray(claims.aud)) throw OPE("unexpected JWT \"aud\" (audience) claim type", INVALID_RESPONSE, { claims });
+	}
+	return {
+		header,
+		claims,
+		jwt: jws
+	};
+}
+function checkSigningAlgorithm(client, issuer, fallback, header) {
+	if (client !== void 0) {
+		if (typeof client === "string" ? header.alg !== client : !client.includes(header.alg)) throw OPE("unexpected JWT \"alg\" header parameter", INVALID_RESPONSE, {
+			header,
+			expected: client,
+			reason: "client configuration"
+		});
+		return;
+	}
+	if (Array.isArray(issuer)) {
+		if (!issuer.includes(header.alg)) throw OPE("unexpected JWT \"alg\" header parameter", INVALID_RESPONSE, {
+			header,
+			expected: issuer,
+			reason: "authorization server metadata"
+		});
+		return;
+	}
+	if (fallback !== void 0) {
+		if (typeof fallback === "string" ? header.alg !== fallback : typeof fallback === "function" ? !fallback(header.alg) : !fallback.includes(header.alg)) throw OPE("unexpected JWT \"alg\" header parameter", INVALID_RESPONSE, {
+			header,
+			expected: fallback,
+			reason: "default value"
+		});
+		return;
+	}
+	throw OPE("missing client or server configuration to verify used JWT \"alg\" header parameter", void 0, {
+		client,
+		issuer,
+		fallback
+	});
+}
+function getURLSearchParameter(parameters, name) {
+	const { 0: value, length } = parameters.getAll(name);
+	if (length > 1) throw OPE(`"${name}" parameter must be provided only once`, INVALID_RESPONSE);
+	return value;
+}
+const skipStateCheck = Symbol();
+const expectNoState = Symbol();
+function validateAuthResponse(as, client, parameters, expectedState) {
+	assertAs(as);
+	assertClient(client);
+	if (parameters instanceof URL) parameters = parameters.searchParams;
+	if (!(parameters instanceof URLSearchParams)) throw CodedTypeError("\"parameters\" must be an instance of URLSearchParams, or URL", ERR_INVALID_ARG_TYPE);
+	if (getURLSearchParameter(parameters, "response")) throw OPE("\"parameters\" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()", INVALID_RESPONSE, { parameters });
+	const iss = getURLSearchParameter(parameters, "iss");
+	const state = getURLSearchParameter(parameters, "state");
+	if (!iss && as.authorization_response_iss_parameter_supported) throw OPE("response parameter \"iss\" (issuer) missing", INVALID_RESPONSE, { parameters });
+	if (iss && iss !== as.issuer) throw OPE("unexpected \"iss\" (issuer) response parameter value", INVALID_RESPONSE, {
+		expected: as.issuer,
+		parameters
+	});
+	switch (expectedState) {
+		case void 0:
+		case expectNoState:
+			if (state !== void 0) throw OPE("unexpected \"state\" response parameter encountered", INVALID_RESPONSE, {
+				expected: void 0,
+				parameters
+			});
+			break;
+		case skipStateCheck: break;
+		default:
+			assertString(expectedState, "\"expectedState\" argument");
+			if (state !== expectedState) throw OPE(state === void 0 ? "response parameter \"state\" missing" : "unexpected \"state\" response parameter value", INVALID_RESPONSE, {
+				expected: expectedState,
+				parameters
+			});
+	}
+	if (getURLSearchParameter(parameters, "error")) throw new AuthorizationResponseError("authorization response from the server is an error", { cause: parameters });
+	const id_token = getURLSearchParameter(parameters, "id_token");
+	const token = getURLSearchParameter(parameters, "token");
+	if (id_token !== void 0 || token !== void 0) throw new UnsupportedOperationError("implicit and hybrid flows are not supported");
+	return brand(new URLSearchParams(parameters));
+}
+async function getResponseJsonBody(response, check = assertApplicationJson) {
+	let json;
+	try {
+		json = await response.json();
+	} catch (cause) {
+		check(response);
+		throw OPE("failed to parse \"response\" body as JSON", PARSE_ERROR, cause);
+	}
+	if (!isJsonObject(json)) throw OPE("\"response\" body must be a top level object", INVALID_RESPONSE, { body: json });
+	return json;
+}
+const _expectedIssuer = Symbol();
+
+//#endregion
+//#region src/interface/client-interface.ts
+const botChallengeKnownErrors = [KnownErrors.BotChallengeRequired, KnownErrors.BotChallengeFailed];
+function isBotChallengeKnownError(error) {
+	return KnownErrors.BotChallengeRequired.isInstance(error) || KnownErrors.BotChallengeFailed.isInstance(error);
+}
+function getBotChallengeRequestFields(botChallenge, context) {
+	if (botChallenge?.unavailable) {
+		if (botChallenge.token != null || botChallenge.phase != null) throw new HexclaveAssertionError(`${context} bot challenge unavailability cannot be combined with a token or phase.`);
+		return { bot_challenge_unavailable: "true" };
+	}
+	const challengeToken = botChallenge?.token?.trim() || void 0;
+	if (botChallenge?.phase === "visible") {
+		if (challengeToken == null) return { bot_challenge_unavailable: "true" };
+		return {
+			bot_challenge_token: challengeToken,
+			bot_challenge_phase: "visible"
+		};
+	}
+	if (challengeToken == null) {
+		if (botChallenge?.phase != null) throw new HexclaveAssertionError(`${context} bot challenge phase options require a token.`);
+		return {};
+	}
+	if (botChallenge?.phase == null) return { bot_challenge_token: challengeToken };
+	return {
+		bot_challenge_token: challengeToken,
+		bot_challenge_phase: "invisible"
+	};
+}
+async function encodeAnalyticsBody(jsonBody, options) {
+	if (options.keepalive) return {
+		body: jsonBody,
+		contentType: "application/json"
+	};
+	const CompressionStreamCtor = globalVar.CompressionStream;
+	if (typeof CompressionStreamCtor !== "function" || typeof Blob === "undefined" || typeof Response === "undefined") return {
+		body: jsonBody,
+		contentType: "application/json"
+	};
+	try {
+		const stream = new Blob([jsonBody]).stream().pipeThrough(new CompressionStreamCtor("gzip"));
+		const buffer = await new Response(stream).arrayBuffer();
+		return {
+			body: new Uint8Array(buffer),
+			contentType: "application/octet-stream"
+		};
+	} catch {
+		return {
+			body: jsonBody,
+			contentType: "application/json"
+		};
+	}
+}
+var HexclaveClientInterface = class {
+	constructor(options) {
+		this.options = options;
+		this._requestListeners = /* @__PURE__ */ new Set();
+		this._sticky = null;
+		this._initialProbeRate = options.probeRate ?? .3;
+	}
+	addRequestListener(listener) {
+		this._requestListeners.add(listener);
+		return () => {
+			this._requestListeners.delete(listener);
+		};
+	}
+	get projectId() {
+		return this.options.projectId;
+	}
+	getApiUrl() {
+		return this.options.getBaseUrl() + "/api/v1";
+	}
+	getApiUrls() {
+		return this.options.getApiUrls().map((u) => u + "/api/v1");
+	}
+	/**
+	* Returns the best-known-good API URL: the sticky fallback if we're in
+	* fallback mode, otherwise the primary. Use for browser-navigated URLs
+	* (e.g. OAuth authorize) where _withFallback can't help.
+	*/
+	getBestApiUrl() {
+		const apiUrls = this.getApiUrls();
+		if (this._sticky && apiUrls[this._sticky.index]) return apiUrls[this._sticky.index];
+		return apiUrls[0];
+	}
+	/**
+	* Routes a request through an ordered URL list with automatic failover.
+	*
+	* The URL list is [primary, ...fallbacks]. The logic has two modes:
+	*
+	* **Normal mode** (`_sticky` is null) — try each URL in order. If a
+	* non-primary URL succeeds, enter sticky mode on that index.
+	*
+	* **Sticky mode** — a previous request already failed over. We remember
+	* which URL worked and go there directly. Occasionally (controlled by a
+	* decaying probe rate) we probe the primary to see if it recovered:
+	*   - Probe succeeds → exit sticky mode, use result.
+	*   - Probe fails → halve probe rate, use sticky URL.
+	*   - Sticky URL fails → exit sticky mode, do a full iteration.
+	*
+	* In both modes, a full iteration tries every URL once per pass for 2
+	* passes before giving up. KnownErrors and 4xx API responses (except 429)
+	* are never retried (they're application-level, not network-level).
+	*
+	* Single-URL lists skip all of this and use 5-retry behavior directly.
+	*/
+	async _withFallback(cb) {
+		const apiUrls = this.getApiUrls();
+		if (apiUrls.length <= 1) return await cb(apiUrls[0], {
+			maxAttempts: 5,
+			skipDiagnostics: false
+		});
+		if (this._sticky) {
+			const result = await this._tryStickyUrl(apiUrls, cb);
+			if (result !== void 0) return result;
+		}
+		return await this._iterateUrls(apiUrls, cb);
+	}
+	_shouldSkipFallback(error) {
+		return error instanceof KnownError || this._isNonRetryableApiResponseError(error);
+	}
+	_isNonRetryableApiResponseError(error) {
+		const response = this._getApiResponseFromError(error);
+		return response != null && response.status >= 400 && response.status < 500;
+	}
+	_getApiResponseFromError(error, seenErrors = /* @__PURE__ */ new Set()) {
+		if (error instanceof Response) return error;
+		if (!(error instanceof Error) || seenErrors.has(error)) return null;
+		seenErrors.add(error);
+		return this._getApiResponseFromError(error.cause, seenErrors);
+	}
+	/**
+	* Attempts the sticky URL, optionally probing primary first.
+	* Returns the result on success, or `undefined` if we should fall through to full iteration.
+	*/
+	async _tryStickyUrl(apiUrls, cb) {
+		const sticky = this._sticky;
+		if (Math.random() < sticky.probeRate) try {
+			const result = await cb(apiUrls[0], {
+				maxAttempts: 1,
+				skipDiagnostics: true
+			});
+			this._sticky = null;
+			return result;
+		} catch (e) {
+			if (this._shouldSkipFallback(e)) throw e;
+			sticky.probeRate = Math.max(sticky.probeRate * .5, .01);
+		}
+		try {
+			return await cb(apiUrls[sticky.index], {
+				maxAttempts: 1,
+				skipDiagnostics: true
+			});
+		} catch (e) {
+			if (this._shouldSkipFallback(e)) throw e;
+			this._sticky = null;
+			return;
+		}
+	}
+	/**
+	* Tries every URL in order for up to 2 passes.
+	* If a non-primary URL (index > 0) succeeds, enters sticky mode on it.
+	*/
+	async _iterateUrls(apiUrls, cb) {
+		let lastError;
+		for (let pass = 0; pass < 2; pass++) for (let i = 0; i < apiUrls.length; i++) try {
+			const result = await cb(apiUrls[i], {
+				maxAttempts: 1,
+				skipDiagnostics: true
+			});
+			if (i > 0) this._sticky = {
+				index: i,
+				probeRate: this._initialProbeRate
+			};
+			return result;
+		} catch (e) {
+			if (this._shouldSkipFallback(e)) throw e;
+			lastError = e instanceof Error ? e : new Error(String(e));
+		}
+		throw lastError;
+	}
+	getAnalyticsApiUrl() {
+		return (this.options.getAnalyticsBaseUrl ?? this.options.getBaseUrl)() + "/api/v1";
+	}
+	async runNetworkDiagnostics(session, requestType) {
+		if (this.pendingNetworkDiagnostics) return await this.pendingNetworkDiagnostics;
+		this.pendingNetworkDiagnostics = this._runNetworkDiagnosticsInner(session, requestType);
+		try {
+			return await this.pendingNetworkDiagnostics;
+		} finally {
+			this.pendingNetworkDiagnostics = void 0;
+		}
+	}
+	async _runNetworkDiagnosticsInner(session, requestType) {
+		const tryRequest = async (cb) => {
+			try {
+				await cb();
+				return "OK";
+			} catch (e) {
+				return `${e}`;
+			}
+		};
+		const cfTrace = await tryRequest(async () => {
+			const res = await fetch("https://1.1.1.1/cdn-cgi/trace");
+			if (!res.ok) throw new Error(`${res.status} ${res.statusText}: ${await res.text()}`);
+		});
+		const baseUrlBackend = await tryRequest(async () => {
+			const res = await fetch(new URL("/health", this.getApiUrl()));
+			if (!res.ok) throw new Error(`${res.status} ${res.statusText}: ${await res.text()}`);
+		});
+		const prodDashboard = await tryRequest(async () => {
+			const res = await fetch("https://app.hexclave.com/health");
+			if (!res.ok) throw new Error(`${res.status} ${res.statusText}: ${await res.text()}`);
+		});
+		const prodBackend = await tryRequest(async () => {
+			const res = await fetch("https://api.hexclave.com/health");
+			if (!res.ok) throw new Error(`${res.status} ${res.statusText}: ${await res.text()}`);
+		});
+		return {
+			"navigator?.onLine": globalVar.navigator?.onLine,
+			cfTrace,
+			baseUrlBackend,
+			prodDashboard,
+			prodBackend
+		};
+	}
+	async _createNetworkError(cause, session, requestType) {
+		return new Error(deindent`
+      Hexclave is unable to connect to the server. Please check your internet connection and try again.
+
+      If the problem persists, please contact support and provide a screenshot of your entire browser console.
+
+      ${cause}
+
+      ${JSON.stringify(await this.runNetworkDiagnostics(session, requestType), null, 2)}
+    `, { cause });
+	}
+	async _networkRetry(cb, session, requestType, options) {
+		const retriedResult = await Result.retry(cb, options?.maxAttempts ?? 5, { exponentialDelayBase: 1e3 });
+		if (retriedResult.status === "error") {
+			if (globalVar.navigator && globalVar.navigator.onLine === false) throw new Error("You are offline. Please check your internet connection and try again. (window.navigator.onLine is false)", { cause: retriedResult.error });
+			if (options?.skipDiagnostics) throw retriedResult.error;
+			throw await this._createNetworkError(retriedResult.error, session, requestType);
+		}
+		return retriedResult.data;
+	}
+	async _networkRetryException(cb, session, requestType, options) {
+		return await this._networkRetry(async () => await Result.fromThrowingAsync(cb), session, requestType, options);
+	}
+	async fetchNewAccessToken(refreshToken) {
+		if ("projectOwnerSession" in this.options) throw new Error("Admin session token is currently not supported for fetching new access token. Did you try to log in on a StackApp initiated with the admin session?");
+		const clientSecret = this.options.publishableClientKey ?? publishableClientKeyNotNecessarySentinel;
+		return await this._withFallback(async (apiUrl, retryOptions) => {
+			return await this._fetchNewAccessTokenInner(refreshToken, clientSecret, apiUrl, retryOptions);
+		});
+	}
+	async _fetchNewAccessTokenInner(refreshToken, clientSecret, apiUrl, retryOptions) {
+		const tokenEndpoint = apiUrl + "/auth/oauth/token";
+		const as = {
+			issuer: this.options.getBaseUrl(),
+			algorithm: "oauth2",
+			token_endpoint: tokenEndpoint
+		};
+		const client = {
+			client_id: this.projectId,
+			client_secret: clientSecret
+		};
+		const clientAuthentication = ClientSecretPost(clientSecret);
+		const allowInsecure = tokenEndpoint.startsWith("http://");
+		const response = await this._networkRetryException(async () => {
+			const rawResponse = await refreshTokenGrantRequest(as, client, clientAuthentication, refreshToken.token, allowInsecure ? { [allowInsecureRequests]: true } : void 0);
+			const response = await this._processResponse(rawResponse);
+			if (response.status === "error") {
+				const error = response.error;
+				if (KnownErrors.RefreshTokenError.isInstance(error)) return null;
+				throw error;
+			}
+			if (!response.data.ok) {
+				const body = await response.data.text();
+				throw new Error(`Failed to send refresh token request: ${response.status} ${body}`, { cause: response.data });
+			}
+			return response.data;
+		}, void 0, void 0, retryOptions);
+		if (!response) return null;
+		let result;
+		try {
+			result = await processRefreshTokenResponse(as, client, response);
+		} catch (e) {
+			if (e instanceof ResponseBodyError) throw new HexclaveAssertionError("ResponseBodyError when processing refresh token response", {
+				cause: e.cause,
+				code: e.code,
+				error: e.error
+			});
+			throw new HexclaveAssertionError("Unexpected error when processing refresh token response", { cause: e });
+		}
+		if (!result.access_token) throw new HexclaveAssertionError("Access token not found in token endpoint response, this is weird!");
+		return AccessToken.createIfValid(result.access_token) ?? throwErr("Access token in fetchNewAccessToken is invalid, looks like the backend is returning an invalid token!", { result });
+	}
+	async sendClientRequest(path, requestOptions, session, requestType = "client", apiUrlOverride, retryOptions) {
+		session ??= this.createSession({ refreshToken: null });
+		if (apiUrlOverride) return await this._networkRetry(() => this.sendClientRequestInner(path, requestOptions, session, requestType, apiUrlOverride, retryOptions), session, requestType, retryOptions);
+		return await this._withFallback(async (apiUrl, fallbackRetryOptions) => {
+			return await this._networkRetry(() => this.sendClientRequestInner(path, requestOptions, session, requestType, apiUrl, retryOptions), session, requestType, {
+				...fallbackRetryOptions,
+				...retryOptions
+			});
+		});
+	}
+	createSession(options) {
+		return new InternalSession({
+			refreshAccessTokenCallback: async (refreshToken) => await this.fetchNewAccessToken(refreshToken),
+			...options
+		});
+	}
+	async sendSessionReplayBatch(body, session, options) {
+		try {
+			const response = await this.sendClientRequest("/session-replays/batch", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body,
+				keepalive: options.keepalive
+			}, session, "client", this.getAnalyticsApiUrl(), {
+				maxAttempts: 1,
+				skipDiagnostics: true
+			});
+			return Result.ok(response);
+		} catch (e) {
+			return Result.error(e instanceof Error ? e : new Error(String(e)));
+		}
+	}
+	async sendAnalyticsEventBatch(body, session, options) {
+		try {
+			const encoded = await encodeAnalyticsBody(body, { keepalive: options.keepalive });
+			const response = await this.sendClientRequest("/analytics/events/batch", {
+				method: "POST",
+				headers: { "Content-Type": encoded.contentType },
+				body: encoded.body,
+				keepalive: options.keepalive
+			}, session, "client", this.getAnalyticsApiUrl(), {
+				maxAttempts: 1,
+				skipDiagnostics: true
+			});
+			return Result.ok(response);
+		} catch (e) {
+			return Result.error(e instanceof Error ? e : new Error(String(e)));
+		}
+	}
+	async sendClientRequestAndCatchKnownError(path, requestOptions, tokenStoreOrNull, errorsToCatch) {
+		try {
+			return Result.ok(await this.sendClientRequest(path, requestOptions, tokenStoreOrNull));
+		} catch (e) {
+			for (const errorType of errorsToCatch) if (errorType.isInstance(e)) return Result.error(e);
+			throw e;
+		}
+	}
+	async sendClientRequestInner(path, options, session, requestType, apiUrlOverride, innerOptions) {
+		/**
+		* `tokenObj === null` means the session is invalid/not logged in
+		*/
+		let tokenObj = await session.getOrFetchLikelyValidTokens(2e4, null);
+		let adminSession = null;
+		let adminTokenObj = null;
+		if ("projectOwnerSession" in this.options) {
+			const projectOwnerSession = this.options.projectOwnerSession;
+			if (typeof projectOwnerSession === "function") {
+				const accessTokenString = await projectOwnerSession();
+				if (accessTokenString) {
+					const accessToken = AccessToken.createIfValid(accessTokenString);
+					if (accessToken) adminTokenObj = {
+						accessToken,
+						refreshToken: null
+					};
+				}
+			} else {
+				adminSession = projectOwnerSession;
+				adminTokenObj = await projectOwnerSession.getOrFetchLikelyValidTokens(2e4, null);
+			}
+		}
+		await this.options.prepareRequest?.();
+		let url = (apiUrlOverride ?? this.getApiUrl()) + path;
+		if (url.endsWith("/")) url = url.slice(0, -1);
+		const params = {
+			..."WebSocketPair" in globalVar ? {} : { credentials: "omit" },
+			...options,
+			headers: {
+				"X-Hexclave-Override-Error-Status": "true",
+				"X-Hexclave-Project-Id": this.projectId,
+				"X-Hexclave-Access-Type": requestType,
+				"X-Hexclave-Client-Version": this.options.clientVersion,
+				...tokenObj ? { "X-Hexclave-Access-Token": tokenObj.accessToken.token } : {},
+				...tokenObj?.refreshToken ? { "X-Hexclave-Refresh-Token": tokenObj.refreshToken.token } : {},
+				"X-Hexclave-Allow-Anonymous-User": "true",
+				..."publishableClientKey" in this.options && this.options.publishableClientKey ? { "X-Hexclave-Publishable-Client-Key": this.options.publishableClientKey } : {},
+				...adminTokenObj ? { "X-Hexclave-Admin-Access-Token": adminTokenObj.accessToken.token } : {},
+				"X-Hexclave-Random-Nonce": generateSecureRandomString(),
+				"ngrok-skip-browser-warning": "true",
+				...this.options.extraRequestHeaders,
+				...options.headers
+			},
+			..."WebSocketPair" in globalVar ? {} : { cache: "no-store" }
+		};
+		const startTime = performance.now();
+		let rawRes;
+		try {
+			rawRes = await fetch(url, params);
+		} catch (e) {
+			if (this._requestListeners.size > 0) {
+				const entry = {
+					path,
+					method: (params.method ?? "GET").toUpperCase(),
+					duration: Math.round(performance.now() - startTime),
+					error: e instanceof Error ? e.message : "Network error"
+				};
+				this._requestListeners.forEach((l) => l(entry));
+			}
+			if (e instanceof TypeError) if (HTTP_METHODS[params.method ?? "GET"].idempotent) return Result.error(e);
+			else if (innerOptions?.skipDiagnostics) throw e;
+			else throw await this._createNetworkError(e, session, requestType);
+			throw e;
+		}
+		const preprocessedRes = await this._preprocessResponse(rawRes);
+		if (this._requestListeners.size > 0) {
+			const entry = {
+				path,
+				method: (params.method ?? "GET").toUpperCase(),
+				status: preprocessedRes.status,
+				duration: Math.round(performance.now() - startTime)
+			};
+			this._requestListeners.forEach((l) => l(entry));
+		}
+		const processedRes = await this._processResponse(preprocessedRes);
+		if (processedRes.status === "error") {
+			if (KnownErrors.InvalidAccessToken.isInstance(processedRes.error)) {
+				if (!tokenObj) throw new HexclaveAssertionError("Received invalid access token, but session is not logged in", {
+					tokenObj,
+					processedRes
+				});
+				session.markAccessTokenExpired(tokenObj.accessToken);
+				return Result.error(processedRes.error);
+			}
+			if (adminSession && (KnownErrors.InvalidAdminAccessToken.isInstance(processedRes.error) || KnownErrors.ApiKeyNotFound.isInstance(processedRes.error))) {
+				if (!adminTokenObj) throw new HexclaveAssertionError("Received invalid admin access token, but admin session is not logged in", {
+					adminTokenObj,
+					processedRes
+				});
+				adminSession.markAccessTokenExpired(adminTokenObj.accessToken);
+				return Result.error(processedRes.error);
+			}
+			throw processedRes.error;
+		}
+		const res = Object.assign(processedRes.data, { usedTokens: tokenObj });
+		if (res.ok) return Result.ok(res);
+		else if (res.status === 429) {
+			const retryAfter = res.headers.get("Retry-After");
+			if (retryAfter !== null) {
+				console.log(`Rate limited while sending request to ${url}. Will retry after ${retryAfter} seconds...`);
+				await wait(Number(retryAfter) * 1e3);
+				return Result.error(/* @__PURE__ */ new Error(`Rate limited, retrying after ${retryAfter} seconds`));
+			}
+			console.log(`Rate limited while sending request to ${url}, no retry-after header received. Retrying...`);
+			return Result.error(/* @__PURE__ */ new Error("Rate limited, no retry-after header received"));
+		} else {
+			const error = await res.text();
+			if (res.status >= 400 && res.status < 500) throw new Error(`Failed to send request to ${url}: ${res.status} ${error}`, { cause: res });
+			const errorObj = new HexclaveAssertionError(`Failed to send request to ${url}: ${res.status} ${error}`, {
+				request: params,
+				res,
+				path
+			});
+			if (res.status === 508 && error.includes("INFINITE_LOOP_DETECTED")) return Result.error(errorObj);
+			throw errorObj;
+		}
+	}
+	async _preprocessResponse(rawRes) {
+		let res = rawRes;
+		if (rawRes.headers.has("x-hexclave-actual-status") || rawRes.headers.has("x-stack-actual-status")) {
+			const actualStatus = Number(rawRes.headers.get("x-hexclave-actual-status") ?? rawRes.headers.get("x-stack-actual-status"));
+			res = new Response(rawRes.body, {
+				status: actualStatus,
+				statusText: rawRes.statusText,
+				headers: rawRes.headers
+			});
+		}
+		return res;
+	}
+	async _processResponse(res) {
+		if (res.headers.has("x-hexclave-known-error") || res.headers.has("x-stack-known-error")) {
+			const errorJson = await res.json();
+			if ((res.headers.get("x-hexclave-known-error") ?? res.headers.get("x-stack-known-error")) !== errorJson.code) throw new HexclaveAssertionError("Mismatch between x-hexclave-known-error/x-stack-known-error header and error code in body; the server's response is invalid");
+			const error = KnownError.fromJson(errorJson);
+			return Result.error(error);
+		}
+		return Result.ok(res);
+	}
+	async checkFeatureSupport(options) {
+		throw new HexclaveAssertionError(await (await this.sendClientRequest("/check-feature-support", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(options)
+		}, null)).text());
+	}
+	async sendForgotPasswordEmail(email, callbackUrl) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/password/send-reset-code", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				email,
+				callback_url: callbackUrl
+			})
+		}, null, [KnownErrors.UserNotFound]);
+		if (res.status === "error") return Result.error(res.error);
+		else return Result.ok(void 0);
+	}
+	async sendVerificationEmail(email, callbackUrl, session) {
+		const res = await this.sendClientRequestAndCatchKnownError("/contact-channels/send-verification-code", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				email,
+				callback_url: callbackUrl
+			})
+		}, session, [KnownErrors.EmailAlreadyVerified]);
+		if (res.status === "error") return res.error;
+	}
+	async sendMagicLinkEmail(email, callbackUrl, botChallenge) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/otp/send-sign-in-code", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				email,
+				callback_url: callbackUrl,
+				...getBotChallengeRequestFields(botChallenge, "Magic link sign-in")
+			})
+		}, null, [KnownErrors.RedirectUrlNotWhitelisted, ...botChallengeKnownErrors]);
+		if (res.status === "error") return Result.error(res.error);
+		else return Result.ok(await res.data.json());
+	}
+	async resetPassword(options) {
+		const res = await this.sendClientRequestAndCatchKnownError("onlyVerifyCode" in options ? "/auth/password/reset/check-code" : "/auth/password/reset", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				code: options.code,
+				..."password" in options ? { password: options.password } : {}
+			})
+		}, null, [KnownErrors.VerificationCodeError]);
+		if (res.status === "error") return Result.error(res.error);
+		else return Result.ok(void 0);
+	}
+	async updatePassword(options, session) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/password/update", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				old_password: options.oldPassword,
+				new_password: options.newPassword
+			})
+		}, session, [KnownErrors.PasswordConfirmationMismatch, KnownErrors.PasswordRequirementsNotMet]);
+		if (res.status === "error") return res.error;
+	}
+	async setPassword(options, session) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/password/set", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(options)
+		}, session, [KnownErrors.PasswordRequirementsNotMet]);
+		if (res.status === "error") return res.error;
+	}
+	async verifyPasswordResetCode(code) {
+		const res = await this.resetPassword({
+			code,
+			onlyVerifyCode: true
+		});
+		if (res.status === "error") return Result.error(res.error);
+		else return Result.ok(void 0);
+	}
+	async verifyEmail(code) {
+		const res = await this.sendClientRequestAndCatchKnownError("/contact-channels/verify", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ code })
+		}, null, [KnownErrors.VerificationCodeError]);
+		if (res.status === "error") return Result.error(res.error);
+		else return Result.ok(void 0);
+	}
+	async initiatePasskeyRegistration(options, session) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/passkey/initiate-passkey-registration", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(options)
+		}, session, []);
+		if (res.status === "error") return Result.error(res.error);
+		return Result.ok(await res.data.json());
+	}
+	async registerPasskey(options, session) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/passkey/register", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(options)
+		}, session, [KnownErrors.PasskeyRegistrationFailed]);
+		if (res.status === "error") return Result.error(res.error);
+		return Result.ok(void 0);
+	}
+	async initiatePasskeyAuthentication(options, session) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/passkey/initiate-passkey-authentication", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(options)
+		}, session, []);
+		if (res.status === "error") return Result.error(res.error);
+		return Result.ok(await res.data.json());
+	}
+	async sendTeamInvitation(options) {
+		await this.sendClientRequest("/team-invitations/send-code", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				email: options.email,
+				team_id: options.teamId,
+				callback_url: options.callbackUrl
+			})
+		}, options.session);
+	}
+	async acceptTeamInvitation(options) {
+		const res = await this.sendClientRequestAndCatchKnownError(options.type === "check" ? "/team-invitations/accept/check-code" : options.type === "details" ? "/team-invitations/accept/details" : "/team-invitations/accept", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ code: options.code })
+		}, options.session, [KnownErrors.VerificationCodeError, KnownErrors.TeamInvitationEmailMismatch]);
+		if (res.status === "error") return Result.error(res.error);
+		else return Result.ok(await res.data.json());
+	}
+	async totpMfa(attemptCode, totp, session) {
+		const result = await (await this.sendClientRequest("/auth/mfa/sign-in", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				code: attemptCode,
+				type: "totp",
+				totp
+			})
+		}, session)).json();
+		return {
+			accessToken: result.access_token,
+			refreshToken: result.refresh_token,
+			newUser: result.is_new_user
+		};
+	}
+	async signInWithCredential(email, password, session) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/password/sign-in", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				email,
+				password
+			})
+		}, session, [KnownErrors.EmailPasswordMismatch]);
+		if (res.status === "error") return Result.error(res.error);
+		const result = await res.data.json();
+		return Result.ok({
+			accessToken: result.access_token,
+			refreshToken: result.refresh_token
+		});
+	}
+	async signUpWithCredential(email, password, emailVerificationRedirectUrl, session, botChallenge) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/password/sign-up", {
+			headers: { "Content-Type": "application/json" },
+			method: "POST",
+			body: JSON.stringify({
+				email,
+				password,
+				verification_callback_url: emailVerificationRedirectUrl,
+				...getBotChallengeRequestFields(botChallenge, "Credential sign-up")
+			})
+		}, session, [
+			KnownErrors.UserWithEmailAlreadyExists,
+			KnownErrors.PasswordRequirementsNotMet,
+			...botChallengeKnownErrors
+		]);
+		if (res.status === "error") return Result.error(res.error);
+		const result = await res.data.json();
+		return Result.ok({
+			accessToken: result.access_token,
+			refreshToken: result.refresh_token
+		});
+	}
+	async signUpAnonymously(session) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/anonymous/sign-up", { method: "POST" }, session, []);
+		if (res.status === "error") return Result.error(res.error);
+		const result = await res.data.json();
+		return Result.ok({
+			accessToken: result.access_token,
+			refreshToken: result.refresh_token
+		});
+	}
+	async signInWithMagicLink(code, session) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/otp/sign-in", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ code })
+		}, session, [KnownErrors.VerificationCodeError]);
+		if (res.status === "error") return Result.error(res.error);
+		const result = await res.data.json();
+		return Result.ok({
+			accessToken: result.access_token,
+			refreshToken: result.refresh_token,
+			newUser: result.is_new_user
+		});
+	}
+	async signInWithMfa(totp, code, session) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/mfa/sign-in", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				type: "totp",
+				totp,
+				code
+			})
+		}, session, [KnownErrors.VerificationCodeError]);
+		if (res.status === "error") return Result.error(res.error);
+		const result = await res.data.json();
+		return Result.ok({
+			accessToken: result.access_token,
+			refreshToken: result.refresh_token,
+			newUser: result.is_new_user
+		});
+	}
+	async signInWithPasskey(body, session) {
+		const res = await this.sendClientRequestAndCatchKnownError("/auth/passkey/sign-in", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(body)
+		}, session, [KnownErrors.PasskeyAuthenticationFailed]);
+		if (res.status === "error") return Result.error(res.error);
+		const result = await res.data.json();
+		return Result.ok({
+			accessToken: result.access_token,
+			refreshToken: result.refresh_token
+		});
+	}
+	async getOAuthUrl(options) {
+		const updatedRedirectUrl = new URL(options.redirectUrl);
+		for (const key of ["code", "state"]) {
+			if (updatedRedirectUrl.searchParams.has(key)) console.warn("Redirect URL already contains " + key + " parameter, removing it as it will be overwritten by the OAuth callback");
+			updatedRedirectUrl.searchParams.delete(key);
+		}
+		if ("projectOwnerSession" in this.options) throw new Error("Admin session token is currently not supported for OAuth");
+		const clientSecret = this.options.publishableClientKey ?? publishableClientKeyNotNecessarySentinel;
+		const url = new URL(this.getBestApiUrl() + "/auth/oauth/authorize/" + options.provider.toLowerCase());
+		url.searchParams.set("client_id", this.projectId);
+		url.searchParams.set("client_secret", clientSecret);
+		url.searchParams.set("redirect_uri", updatedRedirectUrl.toString());
+		url.searchParams.set("scope", "legacy");
+		url.searchParams.set("state", options.state);
+		url.searchParams.set("grant_type", "authorization_code");
+		url.searchParams.set("code_challenge", options.codeChallenge);
+		url.searchParams.set("code_challenge_method", "S256");
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("type", options.type);
+		url.searchParams.set("error_redirect_url", options.errorRedirectUrl);
+		const tokens = await options.session.getOrFetchLikelyValidTokens(45e3, 6e4);
+		if (tokens) url.searchParams.set("token", tokens.accessToken.token);
+		if (options.afterCallbackRedirectUrl) url.searchParams.set("after_callback_redirect_url", options.afterCallbackRedirectUrl);
+		if (options.providerScope) url.searchParams.set("provider_scope", options.providerScope);
+		for (const [key, value] of Object.entries(getBotChallengeRequestFields(options.botChallenge, `OAuth ${options.type}`))) url.searchParams.set(key, value);
+		return url.toString();
+	}
+	async authorizeOAuth(options) {
+		if (typeof window === "undefined") throw new HexclaveAssertionError("authorizeOAuth can currently only be called in a browser environment");
+		await this.options.prepareRequest?.();
+		const url = new URL(await this.getOAuthUrl(options));
+		url.searchParams.set("hexclave_response_mode", "json");
+		url.searchParams.set("stack_response_mode", "json");
+		let rawRes;
+		try {
+			rawRes = await fetch(url, { method: "GET" });
+		} catch (error) {
+			if (error instanceof TypeError) throw await this._createNetworkError(error, options.session, "client");
+			throw error;
+		}
+		const processedResponse = await this._processResponse(rawRes);
+		if (processedResponse.status === "error") {
+			if (isBotChallengeKnownError(processedResponse.error)) return Result.error(processedResponse.error);
+			throw processedResponse.error;
+		}
+		if (processedResponse.data.status !== 200) throw new HexclaveAssertionError(`OAuth authorize returned an unexpected status: ${processedResponse.data.status}`);
+		const body = await processedResponse.data.json();
+		if (body == null || typeof body !== "object" || Array.isArray(body)) throw new HexclaveAssertionError("OAuth authorize response body must be an object", { body });
+		const location = body.location;
+		if (typeof location !== "string") throw new HexclaveAssertionError("OAuth authorize response is missing a redirect location", { body });
+		return Result.ok(location);
+	}
+	async callOAuthCallback(options) {
+		if ("projectOwnerSession" in this.options) throw new Error("Admin session token is currently not supported for OAuth");
+		const clientSecret = this.options.publishableClientKey ?? publishableClientKeyNotNecessarySentinel;
+		return await this._withFallback(async (apiUrl) => {
+			return await this._callOAuthCallbackInner(options, clientSecret, apiUrl);
+		});
+	}
+	async _callOAuthCallbackInner(options, clientSecret, apiUrl) {
+		const tokenEndpoint = apiUrl + "/auth/oauth/token";
+		const as = {
+			issuer: this.options.getBaseUrl(),
+			algorithm: "oauth2",
+			token_endpoint: tokenEndpoint
+		};
+		const client = {
+			client_id: this.projectId,
+			client_secret: clientSecret
+		};
+		const clientAuthentication = ClientSecretPost(clientSecret);
+		const allowInsecure = tokenEndpoint.startsWith("http://");
+		let params;
+		try {
+			params = validateAuthResponse(as, client, options.oauthParams, options.state);
+		} catch (e) {
+			if (e instanceof AuthorizationResponseError) throw new HexclaveAssertionError("Authorization response error when validating outer OAuth response", {
+				cause: Object.fromEntries(e.cause),
+				code: e.code,
+				error: e.error
+			});
+			throw new HexclaveAssertionError("Unexpected error when validating outer OAuth response", { cause: e });
+		}
+		const response = await authorizationCodeGrantRequest(as, client, clientAuthentication, params, options.redirectUri, options.codeVerifier, allowInsecure ? { [allowInsecureRequests]: true } : void 0);
+		let result;
+		try {
+			result = await processAuthorizationCodeResponse(as, client, response);
+		} catch (e) {
+			if (e instanceof ResponseBodyError) {
+				if (e.cause.code === "MULTI_FACTOR_AUTHENTICATION_REQUIRED") throw new KnownErrors.MultiFactorAuthenticationRequired(e.cause.details.attempt_code);
+				throw new HexclaveAssertionError("Outer OAuth error during authorization code response", {
+					cause: e.cause,
+					code: e.code,
+					error: e.error
+				});
+			}
+			throw new HexclaveAssertionError("Unexpected error when processing authorization code response", { cause: e });
+		}
+		return {
+			newUser: result.is_new_user,
+			afterCallbackRedirectUrl: result.after_callback_redirect_url,
+			accessToken: result.access_token,
+			refreshToken: result.refresh_token ?? throwErr("Refresh token not found in outer OAuth response")
+		};
+	}
+	async signOut(session) {
+		if (await session.getOrFetchLikelyValidTokens(2e4, null)) {
+			const resOrError = await this.sendClientRequestAndCatchKnownError("/auth/sessions/current", {
+				method: "DELETE",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({})
+			}, session, [KnownErrors.RefreshTokenError]);
+			if (resOrError.status === "error") if (KnownErrors.RefreshTokenError.isInstance(resOrError.error)) {} else throw new HexclaveAssertionError("Unexpected error", { cause: resOrError.error });
+		}
+		session.markInvalid();
+	}
+	async getClientUserByToken(session) {
+		const responseOrError = await this.sendClientRequestAndCatchKnownError("/users/me", {}, session, [KnownErrors.CannotGetOwnUserWithoutUser]);
+		if (responseOrError.status === "error") if (KnownErrors.CannotGetOwnUserWithoutUser.isInstance(responseOrError.error)) return null;
+		else throw new HexclaveAssertionError("Unexpected uncaught error", { cause: responseOrError.error });
+		const user = await responseOrError.data.json();
+		if (!user) throw new HexclaveAssertionError("User endpoint returned null; this should never happen");
+		return user;
+	}
+	async listTeamInvitations(options, session) {
+		return (await (await this.sendClientRequest("/team-invitations?" + new URLSearchParams({ team_id: options.teamId }), {}, session)).json()).items;
+	}
+	async listCurrentUserTeamInvitations(session) {
+		return (await (await this.sendClientRequest("/team-invitations?" + new URLSearchParams({ user_id: "me" }), {}, session)).json()).items;
+	}
+	async acceptTeamInvitationById(invitationId, session) {
+		await this.sendClientRequest(urlString`/team-invitations/${invitationId}/accept` + "?" + new URLSearchParams({ user_id: "me" }), { method: "POST" }, session);
+	}
+	async revokeTeamInvitation(invitationId, teamId, session) {
+		await this.sendClientRequest(`/team-invitations/${invitationId}?team_id=${teamId}`, { method: "DELETE" }, session);
+	}
+	async listTeamMemberProfiles(options, session) {
+		return (await (await this.sendClientRequest("/team-member-profiles?" + new URLSearchParams(filterUndefined({
+			team_id: options.teamId,
+			user_id: options.userId
+		})), {}, session)).json()).items;
+	}
+	async getTeamMemberProfile(options, session) {
+		return await (await this.sendClientRequest(`/team-member-profiles/${options.teamId}/${options.userId}`, {}, session)).json();
+	}
+	async leaveTeam(teamId, session) {
+		await this.sendClientRequest(`/team-memberships/${teamId}/me`, {
+			method: "DELETE",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({})
+		}, session);
+	}
+	async updateTeamMemberProfile(options, session) {
+		await this.sendClientRequest(`/team-member-profiles/${options.teamId}/${options.userId}`, {
+			method: "PATCH",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(options.profile)
+		}, session);
+	}
+	async updateTeam(options, session) {
+		await this.sendClientRequest(`/teams/${options.teamId}`, {
+			method: "PATCH",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(options.data)
+		}, session);
+	}
+	async listCurrentUserTeamPermissions(options, session) {
+		return (await (await this.sendClientRequest(`/team-permissions?team_id=${options.teamId}&user_id=me&recursive=${options.recursive}`, {}, session)).json()).items;
+	}
+	async listCurrentUserProjectPermissions(options, session) {
+		return (await (await this.sendClientRequest(`/project-permissions?user_id=me&recursive=${options.recursive}`, {}, session)).json()).items;
+	}
+	async listCurrentUserTeams(session) {
+		return (await (await this.sendClientRequest("/teams?user_id=me", {}, session)).json()).items;
+	}
+	async getClientProject() {
+		const responseOrError = await this.sendClientRequestAndCatchKnownError("/projects/current", {}, null, [KnownErrors.ProjectNotFound]);
+		if (responseOrError.status === "error") return Result.error(responseOrError.error);
+		const project = await responseOrError.data.json();
+		return Result.ok(project);
+	}
+	async updateClientUser(update, session) {
+		await this.sendClientRequest("/users/me", {
+			method: "PATCH",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(update)
+		}, session);
+	}
+	async listProjects(session) {
+		const response = await this.sendClientRequest("/internal/projects", {}, session);
+		if (!response.ok) throw new Error("Failed to list projects: " + response.status + " " + await response.text());
+		return (await response.json()).items;
+	}
+	async createProject(project, session) {
+		const fetchResponse = await this.sendClientRequest("/internal/projects", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(project)
+		}, session);
+		if (!fetchResponse.ok) throw new Error("Failed to create project: " + fetchResponse.status + " " + await fetchResponse.text());
+		return await fetchResponse.json();
+	}
+	async createProviderAccessToken(provider, scope, session) {
+		return await (await this.sendClientRequest(`/connected-accounts/me/${provider}/access-token`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ scope })
+		}, session)).json();
+	}
+	/**
+	* Get access token for a specific connected account by provider ID and provider account ID.
+	* This is the preferred method when dealing with multiple accounts of the same provider.
+	*/
+	async createProviderAccessTokenByAccount(providerId, providerAccountId, scope, session) {
+		return await (await this.sendClientRequest(`/connected-accounts/me/${encodeURIComponent(providerId)}/${encodeURIComponent(providerAccountId)}/access-token`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ scope })
+		}, session)).json();
+	}
+	/**
+	* List all connected accounts for the current user.
+	*/
+	async listConnectedAccounts(session) {
+		return await (await this.sendClientRequest(`/connected-accounts/me`, { method: "GET" }, session)).json();
+	}
+	async createClientTeam(data, session) {
+		return await (await this.sendClientRequest("/teams", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(data)
+		}, session)).json();
+	}
+	async deleteTeam(teamId, session) {
+		await this.sendClientRequest(`/teams/${teamId}`, { method: "DELETE" }, session);
+	}
+	async deleteCurrentUser(session) {
+		await this.sendClientRequest("/users/me", { method: "DELETE" }, session);
+	}
+	async createClientContactChannel(data, session) {
+		return await (await this.sendClientRequest("/contact-channels", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(data)
+		}, session)).json();
+	}
+	async updateClientContactChannel(id, data, session) {
+		return await (await this.sendClientRequest(`/contact-channels/me/${id}`, {
+			method: "PATCH",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(data)
+		}, session)).json();
+	}
+	async deleteClientContactChannel(id, session) {
+		await this.sendClientRequest(`/contact-channels/me/${id}`, { method: "DELETE" }, session);
+	}
+	async deleteSession(sessionId, session) {
+		await this.sendClientRequest(`/auth/sessions/${sessionId}?user_id=me`, { method: "DELETE" }, session);
+	}
+	async listSessions(session) {
+		return await (await this.sendClientRequest("/auth/sessions?user_id=me", { method: "GET" }, session)).json();
+	}
+	async listClientContactChannels(session) {
+		return (await (await this.sendClientRequest("/contact-channels?user_id=me", { method: "GET" }, session)).json()).items;
+	}
+	async sendCurrentUserContactChannelVerificationEmail(contactChannelId, callbackUrl, session) {
+		const responseOrError = await this.sendClientRequestAndCatchKnownError(`/contact-channels/me/${contactChannelId}/send-verification-code`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ callback_url: callbackUrl })
+		}, session, [KnownErrors.EmailAlreadyVerified]);
+		if (responseOrError.status === "error") return Result.error(responseOrError.error);
+		return Result.ok(void 0);
+	}
+	async cliLogin(loginCode, refreshToken, session) {
+		const responseOrError = await this.sendClientRequestAndCatchKnownError("/auth/cli/complete", {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				login_code: loginCode,
+				refresh_token: refreshToken
+			})
+		}, session, [KnownErrors.SchemaError]);
+		if (responseOrError.status === "error") return Result.error(responseOrError.error);
+		return Result.ok(void 0);
+	}
+	async _getApiKeyRequestInfo(options) {
+		if ("user_id" in options && "team_id" in options) throw new HexclaveAssertionError("Cannot specify both user_id and team_id in _getApiKeyRequestInfo");
+		return {
+			endpoint: "team_id" in options ? "/team-api-keys" : "/user-api-keys",
+			queryParams: new URLSearchParams(filterUndefinedOrNull(options))
+		};
+	}
+	async listProjectApiKeys(options, session, requestType) {
+		const sendRequest = (requestType === "client" ? this.sendClientRequest : this.sendServerRequest).bind(this);
+		const { endpoint, queryParams } = await this._getApiKeyRequestInfo(options);
+		return (await (await sendRequest(`${endpoint}?${queryParams.toString()}`, { method: "GET" }, session, requestType)).json()).items;
+	}
+	async createProjectApiKey(data, session, requestType) {
+		const sendRequest = (requestType === "client" ? this.sendClientRequest : this.sendServerRequest).bind(this);
+		const { endpoint } = await this._getApiKeyRequestInfo(data);
+		return await (await sendRequest(`${endpoint}`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(data)
+		}, session, requestType)).json();
+	}
+	async getProjectApiKey(options, keyId, session, requestType) {
+		const sendRequest = (requestType === "client" ? this.sendClientRequest : this.sendServerRequest).bind(this);
+		const { endpoint, queryParams } = await this._getApiKeyRequestInfo(options);
+		return await (await sendRequest(`${endpoint}/${keyId}?${queryParams.toString()}`, { method: "GET" }, session, requestType)).json();
+	}
+	async updateProjectApiKey(options, keyId, data, session, requestType) {
+		const sendRequest = (requestType === "client" ? this.sendClientRequest : this.sendServerRequest).bind(this);
+		const { endpoint, queryParams } = await this._getApiKeyRequestInfo(options);
+		return await (await sendRequest(`${endpoint}/${keyId}?${queryParams.toString()}`, {
+			method: "PATCH",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(data)
+		}, session, requestType)).json();
+	}
+	async checkProjectApiKey(type, apiKey, session, requestType) {
+		const result = await (requestType === "client" ? this.sendClientRequestAndCatchKnownError : this.sendServerRequestAndCatchKnownError).bind(this)(`/${type}-api-keys/check`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ api_key: apiKey })
+		}, session, [KnownErrors.ApiKeyNotValid]);
+		if (result.status === "error") return null;
+		return await result.data.json();
+	}
+	async listNotificationCategories(session) {
+		return (await (await this.sendClientRequest(`/emails/notification-preference/me`, {}, session)).json()).items;
+	}
+	async setNotificationsEnabled(notificationCategoryId, enabled, session) {
+		await this.sendClientRequest(`/emails/notification-preference/me/${notificationCategoryId}`, {
+			method: "PATCH",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ enabled })
+		}, session);
+	}
+	async getOAuthProvider(userId, providerId, session) {
+		return await (await this.sendClientRequest(`/oauth-providers/${userId}/${providerId}`, { method: "GET" }, session)).json();
+	}
+	async updateOAuthProvider(userId, providerId, data, session) {
+		return await (await this.sendClientRequest(`/oauth-providers/${userId}/${providerId}`, {
+			method: "PATCH",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(data)
+		}, session)).json();
+	}
+	async listOAuthProviders(options = {}, session) {
+		const queryParams = new URLSearchParams(filterUndefined(options));
+		return (await (await this.sendClientRequest(`/oauth-providers${queryParams.toString() ? `?${queryParams.toString()}` : ""}`, { method: "GET" }, session)).json()).items;
+	}
+	async deleteOAuthProvider(userId, providerId, session) {
+		return await (await this.sendClientRequest(`/oauth-providers/${userId}/${providerId}`, { method: "DELETE" }, session)).json();
+	}
+	async getItem(options, session, requestType = "client") {
+		let customerType;
+		let customerId;
+		if ("userId" in options) {
+			customerType = "user";
+			customerId = options.userId;
+		} else if ("teamId" in options) {
+			customerType = "team";
+			customerId = options.teamId;
+		} else if ("customCustomerId" in options) {
+			customerType = "custom";
+			customerId = options.customCustomerId;
+		} else throw new HexclaveAssertionError("getItem requires one of userId, teamId, or customCustomerId");
+		return await (await (requestType === "client" ? this.sendClientRequest : this.sendServerRequest).bind(this)(urlString`/payments/items/${customerType}/${customerId}/${options.itemId}`, {}, session, requestType)).json();
+	}
+	async listProducts(options, session, requestType = "client") {
+		const queryParams = new URLSearchParams(filterUndefined({
+			cursor: options.cursor,
+			limit: options.limit !== void 0 ? options.limit.toString() : void 0
+		}));
+		const path = urlString`/payments/products/${options.customer_type}/${options.customer_id}`;
+		return await (await (requestType === "client" ? this.sendClientRequest : this.sendServerRequest).bind(this)(`${path}${queryParams.toString() ? `?${queryParams.toString()}` : ""}`, {}, session, requestType)).json();
+	}
+	async listInvoices(options, session) {
+		const queryParams = new URLSearchParams(filterUndefined({
+			cursor: options.cursor,
+			limit: options.limit !== void 0 ? options.limit.toString() : void 0
+		}));
+		const path = urlString`/payments/invoices/${options.customer_type}/${options.customer_id}`;
+		return await (await this.sendClientRequest(`${path}${queryParams.toString() ? `?${queryParams.toString()}` : ""}`, {}, session)).json();
+	}
+	async cancelSubscription(options, session) {
+		const queryParams = new URLSearchParams(filterUndefined({ subscription_id: options.subscription_id }));
+		const path = urlString`/payments/products/${options.customer_type}/${options.customer_id}/${options.product_id}`;
+		await this.sendClientRequest(`${path}${queryParams.toString() ? `?${queryParams.toString()}` : ""}`, { method: "DELETE" }, session);
+	}
+	async switchSubscription(options, session) {
+		await this.sendClientRequest(urlString`/payments/products/${options.customer_type}/${options.customer_id}/switch`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				from_product_id: options.from_product_id,
+				to_product_id: options.to_product_id,
+				price_id: options.price_id,
+				quantity: options.quantity
+			})
+		}, session);
+	}
+	async createCheckoutUrl(customer_type, customer_id, productIdOrInline, session, returnUrl, requestType = "client") {
+		const productBody = typeof productIdOrInline === "string" ? { product_id: productIdOrInline } : { product_inline: productIdOrInline };
+		const { url } = await (await (requestType === "client" ? this.sendClientRequest : this.sendServerRequest).bind(this)("/payments/purchases/create-purchase-url", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				customer_type,
+				customer_id,
+				...productBody,
+				return_url: returnUrl
+			})
+		}, session, requestType)).json();
+		return url;
+	}
+	async getCustomerBilling(customerType, customerId, session) {
+		return await (await this.sendClientRequest(urlString`/payments/billing/${customerType}/${customerId}`, {}, session)).json();
+	}
+	async createCustomerPaymentMethodSetupIntent(customerType, customerId, session) {
+		return await (await this.sendClientRequest(urlString`/payments/payment-method/${customerType}/${customerId}/setup-intent`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({})
+		}, session)).json();
+	}
+	async setDefaultCustomerPaymentMethodFromSetupIntent(customerType, customerId, setupIntentId, session) {
+		return await (await this.sendClientRequest(urlString`/payments/payment-method/${customerType}/${customerId}/set-default`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ setup_intent_id: setupIntentId })
+		}, session)).json();
+	}
+	async transferProject(internalProjectSession, projectIdToTransfer, newTeamId) {
+		if (this.options.projectId !== "internal") throw new HexclaveAssertionError("HexclaveClientInterface.transferProject() is only available for internal projects (please specify the project ID in the constructor)");
+		await this.sendClientRequest("/internal/projects/transfer", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				project_id: projectIdToTransfer,
+				new_team_id: newTeamId
+			})
+		}, internalProjectSession);
+	}
+};
+
+//#endregion
+export { HexclaveClientInterface };
+//# sourceMappingURL=client-interface.js.map