@hraness/suite-accounts 0.9.20

package/dist/browser-session.js

@@ -0,0 +1,208 @@
+// src/oidc-continuation.ts
+function htmlAttribute(value) {
+  return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&#39;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+function inlineJson(value) {
+  return JSON.stringify(value).replaceAll("&", "\\u0026").replaceAll("<", "\\u003c").replaceAll(">", "\\u003e").replaceAll("\u2028", "\\u2028").replaceAll("\u2029", "\\u2029");
+}
+var SUITE_OIDC_JUST_SIGNED_IN_STORAGE_KEY = "hraness:suite:signed-in:v1";
+function createOidcContinuationResponse(returnTo, nonce, cookies) {
+  const headers = new Headers({
+    "cache-control": "no-store",
+    "content-security-policy": [
+      "default-src 'none'",
+      "base-uri 'none'",
+      "form-action 'none'",
+      "frame-ancestors 'none'",
+      `script-src 'nonce-${nonce}'`
+    ].join("; "),
+    "content-type": "text/html; charset=utf-8",
+    pragma: "no-cache",
+    "referrer-policy": "no-referrer",
+    "x-content-type-options": "nosniff",
+    "x-frame-options": "DENY"
+  });
+  for (const cookie of cookies)
+    headers.append("set-cookie", cookie);
+  const body = [
+    "<!doctype html>",
+    '<html lang="en">',
+    "<head>",
+    '<meta charset="utf-8">',
+    '<meta name="viewport" content="width=device-width, initial-scale=1">',
+    "<title>Signed in</title>",
+    "</head>",
+    "<body>",
+    "<p>Signed in.</p>",
+    `<p><a href="${htmlAttribute(returnTo)}">Continue</a></p>`,
+    `<script nonce="${nonce}">try{sessionStorage.setItem(${inlineJson(SUITE_OIDC_JUST_SIGNED_IN_STORAGE_KEY)},"1")}catch{}location.replace(${inlineJson(returnTo)});</script>`,
+    "</body>",
+    "</html>"
+  ].join("");
+  return new Response(body, { headers, status: 200 });
+}
+
+// src/browser-session.ts
+var MAXIMUM_SESSION_RESPONSE_BYTES = 32768;
+var SESSION_PATH = "/api/suite-auth/session";
+var REFRESH_PATH = "/api/suite-auth/refresh";
+var SIGN_OUT_PATH = "/api/suite-auth/sign-out";
+var SUITE_OIDC_REFRESH_LOCK_NAME = "jungle-suite-accounts:oidc-refresh:v1";
+var SUITE_OIDC_SESSION_CHANNEL_NAME = "jungle-suite-accounts:oidc-session:v1";
+var SIGNED_OUT_EVENT = Object.freeze({
+  kind: "signed_out",
+  version: "suite-oidc-session-event-v1"
+});
+var localRefresh = null;
+function isExactRefreshRequired(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length === 1 && Reflect.get(value, "kind") === "refresh_required";
+}
+async function readBoundedJson(response) {
+  const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+  if (contentType !== "application/json" || response.body === null) {
+    throw new Error("The suite session response was not JSON.");
+  }
+  const declaredLength = response.headers.get("content-length");
+  if (declaredLength !== null && (!/^(?:0|[1-9]\d*)$/u.test(declaredLength) || Number(declaredLength) > MAXIMUM_SESSION_RESPONSE_BYTES)) {
+    await response.body.cancel().catch(() => {
+      return;
+    });
+    throw new Error("The suite session response was too large.");
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const result = await reader.read();
+      if (result.done)
+        break;
+      total += result.value.byteLength;
+      if (total > MAXIMUM_SESSION_RESPONSE_BYTES) {
+        await reader.cancel().catch(() => {
+          return;
+        });
+        throw new Error("The suite session response was too large.");
+      }
+      chunks.push(result.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+}
+async function requestJson(fetcher, path, method) {
+  const response = await fetcher(path, {
+    cache: "no-store",
+    credentials: "same-origin",
+    headers: { accept: "application/json" },
+    method,
+    redirect: "error"
+  });
+  const value = await readBoundedJson(response);
+  if (!response.ok) {
+    throw new Error("The suite session request failed.");
+  }
+  return value;
+}
+function exactSignedOut(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length === 1 && Reflect.get(value, "kind") === "signed_out";
+}
+function broadcastSuiteOidcBrowserSignOut() {
+  if (typeof BroadcastChannel === "undefined")
+    return;
+  const channel = new BroadcastChannel(SUITE_OIDC_SESSION_CHANNEL_NAME);
+  try {
+    channel.postMessage(SIGNED_OUT_EVENT);
+  } finally {
+    channel.close();
+  }
+}
+function subscribeSuiteOidcBrowserSignOut(listener) {
+  if (typeof BroadcastChannel === "undefined")
+    return () => {
+      return;
+    };
+  const channel = new BroadcastChannel(SUITE_OIDC_SESSION_CHANNEL_NAME);
+  const onMessage = (event) => {
+    const value = event.data;
+    if (typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length === 2 && Reflect.get(value, "kind") === SIGNED_OUT_EVENT.kind && Reflect.get(value, "version") === SIGNED_OUT_EVENT.version) {
+      listener();
+    }
+  };
+  channel.addEventListener("message", onMessage);
+  return () => {
+    channel.removeEventListener("message", onMessage);
+    channel.close();
+  };
+}
+async function withLocalRefreshLock(task) {
+  if (localRefresh !== null)
+    return await localRefresh;
+  const pending = task();
+  localRefresh = pending;
+  try {
+    return await pending;
+  } finally {
+    if (localRefresh === pending)
+      localRefresh = null;
+  }
+}
+async function withRefreshLock(task, injectedLock) {
+  if (injectedLock !== undefined) {
+    return injectedLock === null ? await withLocalRefreshLock(task) : await injectedLock(SUITE_OIDC_REFRESH_LOCK_NAME, task);
+  }
+  if (typeof navigator !== "undefined" && navigator.locks !== undefined) {
+    return await navigator.locks.request(SUITE_OIDC_REFRESH_LOCK_NAME, { mode: "exclusive" }, task);
+  }
+  return await withLocalRefreshLock(task);
+}
+async function loadSuiteOidcBrowserSession(dependencies = {}) {
+  const fetcher = dependencies.fetch ?? globalThis.fetch;
+  const withExclusiveLock = dependencies.withExclusiveLock;
+  const current = await requestJson(fetcher, SESSION_PATH, "GET");
+  if (!isExactRefreshRequired(current))
+    return current;
+  return await withRefreshLock(async () => {
+    const latest = await requestJson(fetcher, SESSION_PATH, "GET");
+    return isExactRefreshRequired(latest) ? await requestJson(fetcher, REFRESH_PATH, "POST") : latest;
+  }, withExclusiveLock);
+}
+async function signOutSuiteOidcBrowserSession(dependencies = {}) {
+  const fetcher = dependencies.fetch ?? globalThis.fetch;
+  const notifySignedOut = dependencies.notifySignedOut ?? broadcastSuiteOidcBrowserSignOut;
+  const withExclusiveLock = dependencies.withExclusiveLock;
+  await withRefreshLock(async () => {
+    const value = await requestJson(fetcher, SIGN_OUT_PATH, "POST");
+    if (!exactSignedOut(value)) {
+      throw new Error("The suite sign-out response was invalid.");
+    }
+  }, withExclusiveLock);
+  notifySignedOut();
+}
+function consumeSuiteOidcJustSignedIn() {
+  try {
+    if (typeof sessionStorage === "undefined" || sessionStorage.getItem(SUITE_OIDC_JUST_SIGNED_IN_STORAGE_KEY) === null) {
+      return false;
+    }
+    sessionStorage.removeItem(SUITE_OIDC_JUST_SIGNED_IN_STORAGE_KEY);
+    return true;
+  } catch {
+    return false;
+  }
+}
+export {
+  subscribeSuiteOidcBrowserSignOut,
+  signOutSuiteOidcBrowserSession,
+  loadSuiteOidcBrowserSession,
+  consumeSuiteOidcJustSignedIn,
+  broadcastSuiteOidcBrowserSignOut,
+  SUITE_OIDC_SESSION_CHANNEL_NAME,
+  SUITE_OIDC_REFRESH_LOCK_NAME
+};

package/dist/client-configuration.js

@@ -0,0 +1,470 @@
+// src/identity/consumers.ts
+import { err, ok } from "@hraness/result";
+
+// src/immutable.ts
+function deepFreeze(value) {
+  const visited = new WeakSet;
+  function freezeOwned(current) {
+    if (current === null || typeof current !== "object")
+      return;
+    if (visited.has(current))
+      return;
+    visited.add(current);
+    for (const key of Reflect.ownKeys(current)) {
+      const descriptor = Object.getOwnPropertyDescriptor(current, key);
+      if (descriptor !== undefined && "value" in descriptor) {
+        freezeOwned(descriptor.value);
+      }
+    }
+    Object.freeze(current);
+  }
+  freezeOwned(value);
+  return value;
+}
+
+// src/identity/consumers.ts
+var SUITE_CONSUMER_IDS = deepFreeze([
+  "accounts",
+  "act60",
+  "elders",
+  "soundfish",
+  "oh-computer",
+  "draw-money",
+  "oprte",
+  "sponge"
+]);
+var LEGACY_SUITE_CONSUMER_IDS = deepFreeze([
+  "kitchen"
+]);
+function parseSuiteConsumerId(value) {
+  switch (value) {
+    case "accounts":
+    case "act60":
+    case "elders":
+    case "soundfish":
+    case "oh-computer":
+    case "draw-money":
+    case "oprte":
+    case "sponge":
+      return ok(value);
+    case "kitchen":
+      return ok("oprte");
+    default:
+      return err("invalid-consumer");
+  }
+}
+
+// src/registry.ts
+var SUITE_ACCOUNTS_REMOTE_ENVIRONMENTS = deepFreeze([
+  "production"
+]);
+var accountsCookies = deepFreeze({
+  chunked: ["account_data", "session_data"],
+  names: [
+    "account_data",
+    "convex_jwt",
+    "dont_remember",
+    "session_data",
+    "session_token"
+  ]
+});
+var consumerCookies = deepFreeze({
+  chunked: ["session_data"],
+  names: ["dont_remember", "session_data", "session_token"]
+});
+var SUITE_ACCOUNTS_DEPLOYMENTS = deepFreeze({
+  production: {
+    accountsOrigin: "https://account.hraness.com",
+    convexSiteUrl: "https://qualified-marmot-22.convex.site",
+    convexUrl: "https://qualified-marmot-22.convex.cloud"
+  }
+});
+function unsupported(siteUrl) {
+  return { billingReturn: { kind: "unsupported" }, siteUrl };
+}
+function oidcSite(id, displayName, productionSiteUrl) {
+  return {
+    auth: { basePath: "/api/suite-auth", kind: "oidc-rp" },
+    displayName,
+    environments: {
+      production: unsupported(productionSiteUrl)
+    },
+    id
+  };
+}
+var SUITE_ACCOUNTS_REGISTERED_CONSUMER_IDS = deepFreeze([
+  "accounts",
+  "act60",
+  "soundfish",
+  "oh-computer",
+  "draw-money",
+  "sponge"
+]);
+var SUITE_ACCOUNTS_CONSUMERS = deepFreeze({
+  accounts: {
+    auth: {
+      basePath: "/api/auth",
+      cookies: accountsCookies,
+      kind: "authority"
+    },
+    displayName: "Accounts",
+    environments: {
+      production: {
+        billingReturn: { kind: "supported", path: "/account" },
+        siteUrl: "https://account.hraness.com"
+      }
+    },
+    id: "accounts"
+  },
+  act60: oidcSite("act60", "ACT60", "https://act60.me"),
+  soundfish: {
+    auth: { basePath: "/api/suite-auth", kind: "oidc-rp" },
+    displayName: "Soundfish",
+    environments: {
+      production: unsupported("https://sound.fish")
+    },
+    id: "soundfish"
+  },
+  "oh-computer": oidcSite("oh-computer", "Oh", "https://oh.computer"),
+  "draw-money": {
+    auth: {
+      basePath: "/api/auth",
+      cookies: consumerCookies,
+      kind: "proxy"
+    },
+    displayName: "Draw Money",
+    environments: {
+      production: unsupported("https://draw.money")
+    },
+    id: "draw-money"
+  },
+  sponge: oidcSite("sponge", "Sponge", "https://spongesearch.com")
+});
+var SUITE_ACCOUNTS_CURRENT_ORIGIN_OVERRIDES = deepFreeze({
+  sponge: {
+    production: unsupported("https://sponge.computer")
+  }
+});
+var SUITE_ACCOUNTS_CURRENT_CONSUMER_IDS = deepFreeze([
+  "accounts",
+  "act60",
+  "soundfish",
+  "oh-computer",
+  "sponge",
+  "peopleblade",
+  "aicharts",
+  "hraness",
+  "soulscrape",
+  "platonik",
+  "ghostget",
+  "alt",
+  "algal"
+]);
+function currentOidcSite(id, displayName, productionSiteUrl) {
+  return {
+    auth: { basePath: "/api/suite-auth", kind: "oidc-rp" },
+    displayName,
+    environments: {
+      production: unsupported(productionSiteUrl)
+    },
+    id
+  };
+}
+var SUITE_ACCOUNTS_CURRENT_CONSUMERS = deepFreeze({
+  accounts: SUITE_ACCOUNTS_CONSUMERS.accounts,
+  act60: SUITE_ACCOUNTS_CONSUMERS.act60,
+  soundfish: SUITE_ACCOUNTS_CONSUMERS.soundfish,
+  "oh-computer": SUITE_ACCOUNTS_CONSUMERS["oh-computer"],
+  sponge: currentOidcSite("sponge", "Sponge", SUITE_ACCOUNTS_CURRENT_ORIGIN_OVERRIDES.sponge.production.siteUrl),
+  peopleblade: currentOidcSite("peopleblade", "PeopleBlade", "https://peopleblade.com"),
+  aicharts: currentOidcSite("aicharts", "AI Charts", "https://aicharts.io"),
+  hraness: currentOidcSite("hraness", "Hraness", "https://hraness.com"),
+  soulscrape: currentOidcSite("soulscrape", "Soulscrape", "https://soulscrape.com"),
+  platonik: currentOidcSite("platonik", "Platonik", "https://platonik.space"),
+  ghostget: currentOidcSite("ghostget", "Ghostget", "https://ghostget.com"),
+  alt: currentOidcSite("alt", "Alt", "https://alt.dog"),
+  algal: currentOidcSite("algal", "Algal", "https://algal.cloud")
+});
+var SUITE_ACCOUNTS_ACTIVE_CONSUMER_IDS = deepFreeze([
+  "accounts",
+  "act60",
+  "soundfish",
+  "oh-computer",
+  "sponge"
+]);
+var SUITE_EMAIL_OTP_REQUIRED_OIDC_CONSUMER_IDS = deepFreeze(SUITE_ACCOUNTS_REGISTERED_CONSUMER_IDS.filter((consumer) => SUITE_ACCOUNTS_CONSUMERS[consumer].auth.kind === "oidc-rp"));
+function suiteAccountsConsumerRequiresEmailOtp(consumer) {
+  return SUITE_EMAIL_OTP_REQUIRED_OIDC_CONSUMER_IDS.includes(consumer);
+}
+var SUITE_ACCOUNTS_LINKED_OIDC_CONSUMER_IDS = deepFreeze([
+  "soundfish"
+]);
+var SUITE_ACCOUNTS_CURRENT_EMAIL_OTP_REQUIRED_OIDC_CONSUMER_IDS = deepFreeze(SUITE_ACCOUNTS_CURRENT_CONSUMER_IDS.filter((consumer) => SUITE_ACCOUNTS_CURRENT_CONSUMERS[consumer].auth.kind === "oidc-rp"));
+var SUITE_ACCOUNTS_CURRENT_LINKED_OIDC_CONSUMER_IDS = deepFreeze([
+  "soundfish",
+  "peopleblade",
+  "ghostget"
+]);
+var SUITE_ACCOUNTS_CURRENT_BROWSER_DEVICE_CODE_CONSUMER_IDS = deepFreeze([
+  "act60",
+  "soundfish",
+  "oh-computer",
+  "sponge",
+  "peopleblade",
+  "aicharts",
+  "hraness",
+  "soulscrape",
+  "platonik",
+  "ghostget",
+  "alt"
+]);
+var SUITE_ACCOUNTS_CURRENT_DEVICE_CLIENT_IDS = deepFreeze([
+  "algal-cli"
+]);
+var SUITE_ACCOUNTS_CURRENT_DEVICE_CLIENTS = deepFreeze({
+  "algal-cli": {
+    consumer: "algal",
+    displayName: "Algal CLI",
+    environments: ["production"],
+    id: "algal-cli"
+  }
+});
+function isSuiteAccountsConsumerId(value) {
+  return typeof value === "string" && SUITE_CONSUMER_IDS.includes(value);
+}
+function isSuiteAccountsRegisteredConsumerId(value) {
+  return typeof value === "string" && SUITE_ACCOUNTS_REGISTERED_CONSUMER_IDS.includes(value);
+}
+function isSuiteAccountsOidcConsumerId(value) {
+  return isSuiteAccountsRegisteredConsumerId(value) && SUITE_ACCOUNTS_CONSUMERS[value].auth.kind === "oidc-rp";
+}
+function isSuiteAccountsLinkedOidcConsumerId(value) {
+  return SUITE_ACCOUNTS_LINKED_OIDC_CONSUMER_IDS.includes(value);
+}
+function isSuiteAccountsOAuthConsumerId(value) {
+  return isSuiteAccountsRegisteredConsumerId(value) && SUITE_ACCOUNTS_CONSUMERS[value].auth.kind === "oidc-rp";
+}
+function isSuiteAccountsCurrentConsumerId(value) {
+  return typeof value === "string" && SUITE_ACCOUNTS_CURRENT_CONSUMER_IDS.includes(value);
+}
+function isSuiteAccountsCurrentOidcConsumerId(value) {
+  return getSuiteAccountsCurrentConsumer(value).auth.kind === "oidc-rp";
+}
+function isSuiteAccountsCurrentLinkedOidcConsumerId(value) {
+  return SUITE_ACCOUNTS_CURRENT_LINKED_OIDC_CONSUMER_IDS.includes(value);
+}
+function isSuiteAccountsCurrentOAuthConsumerId(value) {
+  return getSuiteAccountsCurrentConsumer(value).auth.kind === "oidc-rp";
+}
+function isSuiteAccountsCurrentBrowserDeviceCodeConsumerId(value) {
+  return typeof value === "string" && SUITE_ACCOUNTS_CURRENT_BROWSER_DEVICE_CODE_CONSUMER_IDS.includes(value);
+}
+function isSuiteAccountsCurrentDeviceClientId(value) {
+  return typeof value === "string" && SUITE_ACCOUNTS_CURRENT_DEVICE_CLIENT_IDS.includes(value);
+}
+function suiteAccountsCurrentConsumerRequiresEmailOtp(consumer) {
+  return SUITE_ACCOUNTS_CURRENT_EMAIL_OTP_REQUIRED_OIDC_CONSUMER_IDS.includes(consumer);
+}
+function getSuiteAccountsConsumer(consumer) {
+  return SUITE_ACCOUNTS_CONSUMERS[consumer];
+}
+function getSuiteAccountsConsumerEnvironment(consumer, environment) {
+  if (!isSuiteAccountsRegisteredConsumerId(consumer))
+    return null;
+  const registration = getSuiteAccountsConsumer(consumer);
+  return registration.environments[environment] ?? null;
+}
+function getSuiteAccountsCurrentConsumer(consumer) {
+  return SUITE_ACCOUNTS_CURRENT_CONSUMERS[consumer];
+}
+function getSuiteAccountsCurrentConsumerEnvironment(consumer, environment) {
+  if (!isSuiteAccountsCurrentConsumerId(consumer))
+    return null;
+  return getSuiteAccountsCurrentConsumer(consumer).environments[environment] ?? null;
+}
+function isSuiteAccountsActiveConsumerId(value) {
+  return SUITE_ACCOUNTS_ACTIVE_CONSUMER_IDS.includes(value);
+}
+function getSuiteAccountsDeployment(environment) {
+  return SUITE_ACCOUNTS_DEPLOYMENTS[environment];
+}
+
+// src/urls.ts
+var SUITE_ACCOUNTS_OAUTH_RESOURCE = "https://hraness.com/suite";
+var CENTRAL_PATHS = deepFreeze({
+  account: "/account",
+  home: "/",
+  login: "/login"
+});
+function suiteAccountsCentralUrl(environment, destination) {
+  return new URL(CENTRAL_PATHS[destination], getSuiteAccountsDeployment(environment).accountsOrigin).href;
+}
+function suiteAccountsBillingReturnUrl(consumer, environment) {
+  const consumerEnvironment = getSuiteAccountsConsumerEnvironment(consumer, environment);
+  if (consumerEnvironment === null)
+    return null;
+  return consumerEnvironment.billingReturn.kind === "supported" ? new URL(consumerEnvironment.billingReturn.path, consumerEnvironment.siteUrl).href : null;
+}
+function suiteAccountsOidcClientRegistration(consumer, environment) {
+  if (!isSuiteAccountsConsumerId(consumer) || !isSuiteAccountsOAuthConsumerId(consumer))
+    return null;
+  const consumerEnvironment = getSuiteAccountsConsumerEnvironment(consumer, environment);
+  if (consumerEnvironment === null)
+    return null;
+  return deepFreeze({
+    callbackUrl: new URL("/api/suite-auth/callback", consumerEnvironment.siteUrl).href,
+    clientId: `hraness:${consumer}:${environment}:v1`
+  });
+}
+function suiteAccountsCurrentOidcClientRegistration(consumer, environment) {
+  if (!isSuiteAccountsCurrentConsumerId(consumer) || !isSuiteAccountsCurrentOAuthConsumerId(consumer))
+    return null;
+  const consumerEnvironment = getSuiteAccountsCurrentConsumerEnvironment(consumer, environment);
+  if (consumerEnvironment === null)
+    return null;
+  return deepFreeze({
+    callbackUrl: new URL("/api/suite-auth/callback", consumerEnvironment.siteUrl).href,
+    clientId: `hraness:${consumer}:${environment}:v1`
+  });
+}
+function suiteAccountsOidcClientRequiresEmailOtp(clientId) {
+  if (typeof clientId !== "string")
+    return false;
+  return SUITE_EMAIL_OTP_REQUIRED_OIDC_CONSUMER_IDS.some((consumer) => suiteAccountsOidcClientRegistration(consumer, "production")?.clientId === clientId);
+}
+function suiteAccountsCurrentOidcClientRequiresEmailOtp(clientId) {
+  if (typeof clientId !== "string")
+    return false;
+  return SUITE_ACCOUNTS_CURRENT_EMAIL_OTP_REQUIRED_OIDC_CONSUMER_IDS.some((consumer) => suiteAccountsCurrentOidcClientRegistration(consumer, "production")?.clientId === clientId);
+}
+var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+function suiteAccountsCurrentDeviceClientRegistration(deviceClient, environment) {
+  if (!isSuiteAccountsCurrentDeviceClientId(deviceClient))
+    return null;
+  const registration = SUITE_ACCOUNTS_CURRENT_DEVICE_CLIENTS[deviceClient];
+  if (!registration.environments.includes(environment) || suiteAccountsCurrentOidcClientRegistration(registration.consumer, environment) === null) {
+    return null;
+  }
+  return deepFreeze({
+    clientId: `hraness:${deviceClient}:${environment}:v1`,
+    consumer: registration.consumer,
+    grantTypes: [DEVICE_CODE_GRANT_TYPE],
+    redirectUris: [],
+    scopes: ["openid", "email", "profile"],
+    tokenEndpointAuthMethod: "none"
+  });
+}
+function suiteAccountsCurrentDeviceCodeClientAllowed(clientId) {
+  if (typeof clientId !== "string")
+    return false;
+  return SUITE_ACCOUNTS_CURRENT_DEVICE_CLIENT_IDS.some((deviceClient) => suiteAccountsCurrentDeviceClientRegistration(deviceClient, "production")?.clientId === clientId) || SUITE_ACCOUNTS_CURRENT_BROWSER_DEVICE_CODE_CONSUMER_IDS.some((consumer) => isSuiteAccountsCurrentBrowserDeviceCodeConsumerId(consumer) && suiteAccountsCurrentOidcClientRegistration(consumer, "production")?.clientId === clientId);
+}
+function suiteAccountsOidcProviderConfiguration(environment) {
+  const issuer = getSuiteAccountsDeployment(environment).accountsOrigin;
+  const authBase = new URL("/api/auth/", issuer);
+  return deepFreeze({
+    authorizationEndpoint: new URL("oauth2/authorize", authBase).href,
+    deviceAuthorizationEndpoint: new URL("oauth2/device_authorization", authBase).href,
+    deviceTokenEndpoint: new URL("oauth2/device/token", authBase).href,
+    discoveryEndpoint: new URL("/.well-known/openid-configuration", issuer).href,
+    entitlementReceiptEndpoint: new URL("/suite/entitlements/receipt", issuer).href,
+    identityLinkReceiptEndpoint: new URL("/suite/identity-links/receipt", issuer).href,
+    issuer,
+    jwksEndpoint: new URL("jwks", authBase).href,
+    resource: SUITE_ACCOUNTS_OAUTH_RESOURCE,
+    revocationEndpoint: new URL("oauth2/revoke", authBase).href,
+    tokenEndpoint: new URL("oauth2/token", authBase).href,
+    userInfoAudience: new URL("oauth2/userinfo", authBase).href
+  });
+}
+
+// src/client-configuration.ts
+import { err as err2, isRecord, ok as ok2 } from "@hraness/result";
+var SUITE_ACCOUNTS_CLIENT_CONFIGURATION_VERSION = "suite-accounts-client-configuration-v1";
+var SUITE_ACCOUNTS_WIRE_VERSION = "v1";
+var BINDING_KEYS = [
+  "authMode",
+  "callbackUrl",
+  "clientId",
+  "consumer",
+  "environment",
+  "origin"
+];
+function snapshotBinding(input) {
+  if (!isRecord(input))
+    return null;
+  try {
+    const descriptors = Object.getOwnPropertyDescriptors(input);
+    const keys = Reflect.ownKeys(descriptors);
+    if (keys.length !== BINDING_KEYS.length || keys.some((key) => typeof key !== "string" || !BINDING_KEYS.includes(key))) {
+      return null;
+    }
+    for (const key of BINDING_KEYS) {
+      const descriptor = descriptors[key];
+      if (descriptor === undefined || !("value" in descriptor))
+        return null;
+    }
+    return {
+      authMode: descriptors.authMode.value,
+      callbackUrl: descriptors.callbackUrl.value,
+      clientId: descriptors.clientId.value,
+      consumer: descriptors.consumer.value,
+      environment: descriptors.environment.value,
+      origin: descriptors.origin.value
+    };
+  } catch {
+    return null;
+  }
+}
+function freezeConfiguration(binding, authBasePath, provider) {
+  return deepFreeze({
+    authBasePath,
+    binding,
+    configurationVersion: SUITE_ACCOUNTS_CLIENT_CONFIGURATION_VERSION,
+    provider,
+    wireVersion: SUITE_ACCOUNTS_WIRE_VERSION
+  });
+}
+function createSuiteAccountsClientConfiguration(input) {
+  const binding = snapshotBinding(input);
+  if (binding === null)
+    return err2("invalid-binding");
+  if (!isSuiteAccountsCurrentConsumerId(binding.consumer)) {
+    return err2("invalid-consumer");
+  }
+  if (binding.environment !== "production") {
+    return err2("invalid-environment");
+  }
+  const consumer = binding.consumer;
+  const environment = binding.environment;
+  const registration = getSuiteAccountsCurrentConsumer(consumer);
+  const deployed = getSuiteAccountsCurrentConsumerEnvironment(consumer, environment);
+  if (deployed === null || binding.origin !== deployed.siteUrl) {
+    return err2("invalid-origin");
+  }
+  if (binding.authMode !== registration.auth.kind) {
+    return err2("invalid-auth-mode");
+  }
+  const oauth = suiteAccountsCurrentOidcClientRegistration(consumer, environment);
+  const expectedClientId = oauth?.clientId ?? null;
+  const expectedCallbackUrl = oauth?.callbackUrl ?? null;
+  if (binding.clientId !== expectedClientId) {
+    return err2("invalid-client-id");
+  }
+  if (binding.callbackUrl !== expectedCallbackUrl) {
+    return err2("invalid-callback-url");
+  }
+  return ok2(freezeConfiguration({
+    authMode: registration.auth.kind,
+    callbackUrl: expectedCallbackUrl,
+    clientId: expectedClientId,
+    consumer,
+    environment,
+    origin: deployed.siteUrl
+  }, registration.auth.basePath, suiteAccountsOidcProviderConfiguration(environment)));
+}
+export {
+  createSuiteAccountsClientConfiguration,
+  SUITE_ACCOUNTS_WIRE_VERSION,
+  SUITE_ACCOUNTS_CLIENT_CONFIGURATION_VERSION
+};