@oddington/sdk 0.1.11 → 0.1.12

package/dist/auth-provider.js

@@ -0,0 +1,3909 @@
+function __rest(s, e) {
+  var t = {};
+  for (var p in s) Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0 && (t[p] = s[p]);
+  if (s != null && typeof Object.getOwnPropertySymbols == "function")
+    for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++)
+      e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]) && (t[p[i]] = s[p[i]]);
+  return t;
+}
+
+var version = "2.116.0";
+
+var AUTO_REFRESH_TICK_DURATION_MS = 30 * 1e3, AUTO_REFRESH_TICK_THRESHOLD = 3, EXPIRY_MARGIN_MS = AUTO_REFRESH_TICK_THRESHOLD * AUTO_REFRESH_TICK_DURATION_MS, REFRESH_FAILURE_COOLDOWN_MS = 2 * AUTO_REFRESH_TICK_DURATION_MS, GOTRUE_URL = "http://localhost:9999", STORAGE_KEY = "supabase.auth.token";
+var DEFAULT_HEADERS = { "X-Client-Info": `gotrue-js/${version}` };
+var API_VERSION_HEADER_NAME = "X-Supabase-Api-Version", API_VERSIONS = {
+  "2024-01-01": {
+    timestamp: Date.parse("2024-01-01T00:00:00.0Z"),
+    name: "2024-01-01"
+  }
+}, BASE64URL_REGEX = /^([a-z0-9_-]{4})*($|[a-z0-9_-]{3}$|[a-z0-9_-]{2}$)$/i, PKCE_FLOW_ID_PARAM = "sb_flow_id", PKCE_MAX_CONCURRENT_FLOWS = 5, JWKS_TTL = 600 * 1e3;
+
+var AuthError = class extends Error {
+  constructor(message, status, code) {
+    super(message), this.__isAuthError = !0, this.name = "AuthError", this.status = status, this.code = code;
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      message: this.message,
+      status: this.status,
+      code: this.code
+    };
+  }
+};
+function isAuthError(error) {
+  return typeof error == "object" && error !== null && "__isAuthError" in error;
+}
+var AuthApiError = class extends AuthError {
+  constructor(message, status, code) {
+    super(message, status, code), this.name = "AuthApiError", this.status = status, this.code = code;
+  }
+};
+function isAuthApiError(error) {
+  return isAuthError(error) && error.name === "AuthApiError";
+}
+var AuthUnknownError = class extends AuthError {
+  constructor(message, originalError) {
+    super(message), this.name = "AuthUnknownError", this.originalError = originalError;
+  }
+}, CustomAuthError = class extends AuthError {
+  constructor(message, name, status, code) {
+    super(message, status, code), this.name = name, this.status = status;
+  }
+}, AuthSessionMissingError = class extends CustomAuthError {
+  constructor() {
+    super("Auth session missing!", "AuthSessionMissingError", 400, void 0);
+  }
+};
+function isAuthSessionMissingError(error) {
+  return isAuthError(error) && error.name === "AuthSessionMissingError";
+}
+var AuthInvalidTokenResponseError = class extends CustomAuthError {
+  constructor() {
+    super("Auth session or user missing", "AuthInvalidTokenResponseError", 500, void 0);
+  }
+}, AuthInvalidCredentialsError = class extends CustomAuthError {
+  constructor(message) {
+    super(message, "AuthInvalidCredentialsError", 400, void 0);
+  }
+}, AuthImplicitGrantRedirectError = class extends CustomAuthError {
+  constructor(message, details = null) {
+    super(message, "AuthImplicitGrantRedirectError", 500, void 0), this.details = null, this.details = details;
+  }
+  toJSON() {
+    return Object.assign(Object.assign({}, super.toJSON()), { details: this.details });
+  }
+};
+function isAuthImplicitGrantRedirectError(error) {
+  return isAuthError(error) && error.name === "AuthImplicitGrantRedirectError";
+}
+var AuthPKCEGrantCodeExchangeError = class extends CustomAuthError {
+  constructor(message, details = null) {
+    super(message, "AuthPKCEGrantCodeExchangeError", 500, void 0), this.details = null, this.details = details;
+  }
+  toJSON() {
+    return Object.assign(Object.assign({}, super.toJSON()), { details: this.details });
+  }
+}, AuthPKCECodeVerifierMissingError = class extends CustomAuthError {
+  constructor() {
+    super("PKCE code verifier not found in storage. This can happen if the auth flow was initiated in a different browser or device, or if the storage was cleared. For SSR frameworks (Next.js, SvelteKit, etc.), use @supabase/ssr on both the server and client to store the code verifier in cookies.", "AuthPKCECodeVerifierMissingError", 400, "pkce_code_verifier_not_found");
+  }
+};
+var AuthRetryableFetchError = class extends CustomAuthError {
+  constructor(message, status) {
+    super(message, "AuthRetryableFetchError", status, void 0);
+  }
+};
+function isAuthRetryableFetchError(error) {
+  return isAuthError(error) && error.name === "AuthRetryableFetchError";
+}
+var AuthRefreshDiscardedError = class extends CustomAuthError {
+  constructor(message = "Refresh result discarded: session state changed mid-flight (e.g., concurrent signOut)") {
+    super(message, "AuthRefreshDiscardedError", 409, void 0);
+  }
+};
+function isAuthRefreshDiscardedError(error) {
+  return isAuthError(error) && error.name === "AuthRefreshDiscardedError";
+}
+var AuthWeakPasswordError = class extends CustomAuthError {
+  constructor(message, status, reasons) {
+    super(message, "AuthWeakPasswordError", status, "weak_password"), this.reasons = reasons;
+  }
+  toJSON() {
+    return Object.assign(Object.assign({}, super.toJSON()), { reasons: this.reasons });
+  }
+};
+var AuthInvalidJwtError = class extends CustomAuthError {
+  constructor(message) {
+    super(message, "AuthInvalidJwtError", 400, "invalid_jwt");
+  }
+};
+
+var TO_BASE64URL = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_".split(""), IGNORE_BASE64URL = ` 	
+\r=`.split(""), FROM_BASE64URL = (() => {
+  let charMap = new Array(128);
+  for (let i = 0; i < charMap.length; i += 1)
+    charMap[i] = -1;
+  for (let i = 0; i < IGNORE_BASE64URL.length; i += 1)
+    charMap[IGNORE_BASE64URL[i].charCodeAt(0)] = -2;
+  for (let i = 0; i < TO_BASE64URL.length; i += 1)
+    charMap[TO_BASE64URL[i].charCodeAt(0)] = i;
+  return charMap;
+})();
+function byteToBase64URL(byte, state, emit) {
+  if (byte !== null)
+    for (state.queue = state.queue << 8 | byte, state.queuedBits += 8; state.queuedBits >= 6; ) {
+      let pos = state.queue >> state.queuedBits - 6 & 63;
+      emit(TO_BASE64URL[pos]), state.queuedBits -= 6;
+    }
+  else if (state.queuedBits > 0)
+    for (state.queue = state.queue << 6 - state.queuedBits, state.queuedBits = 6; state.queuedBits >= 6; ) {
+      let pos = state.queue >> state.queuedBits - 6 & 63;
+      emit(TO_BASE64URL[pos]), state.queuedBits -= 6;
+    }
+}
+function byteFromBase64URL(charCode, state, emit) {
+  let bits = FROM_BASE64URL[charCode];
+  if (bits > -1)
+    for (state.queue = state.queue << 6 | bits, state.queuedBits += 6; state.queuedBits >= 8; )
+      emit(state.queue >> state.queuedBits - 8 & 255), state.queuedBits -= 8;
+  else {
+    if (bits === -2)
+      return;
+    throw new Error(`Invalid Base64-URL character "${String.fromCharCode(charCode)}"`);
+  }
+}
+function stringFromBase64URL(str) {
+  let conv = [], utf8Emit = (codepoint) => {
+    conv.push(String.fromCodePoint(codepoint));
+  }, utf8State = {
+    utf8seq: 0,
+    codepoint: 0
+  }, b64State = { queue: 0, queuedBits: 0 }, byteEmit = (byte) => {
+    stringFromUTF8(byte, utf8State, utf8Emit);
+  };
+  for (let i = 0; i < str.length; i += 1)
+    byteFromBase64URL(str.charCodeAt(i), b64State, byteEmit);
+  return conv.join("");
+}
+function codepointToUTF8(codepoint, emit) {
+  if (codepoint <= 127) {
+    emit(codepoint);
+    return;
+  } else if (codepoint <= 2047) {
+    emit(192 | codepoint >> 6), emit(128 | codepoint & 63);
+    return;
+  } else if (codepoint <= 65535) {
+    emit(224 | codepoint >> 12), emit(128 | codepoint >> 6 & 63), emit(128 | codepoint & 63);
+    return;
+  } else if (codepoint <= 1114111) {
+    emit(240 | codepoint >> 18), emit(128 | codepoint >> 12 & 63), emit(128 | codepoint >> 6 & 63), emit(128 | codepoint & 63);
+    return;
+  }
+  throw new Error(`Unrecognized Unicode codepoint: ${codepoint.toString(16)}`);
+}
+function stringToUTF8(str, emit) {
+  for (let i = 0; i < str.length; i += 1) {
+    let codepoint = str.charCodeAt(i);
+    if (codepoint > 55295 && codepoint <= 56319) {
+      let highSurrogate = (codepoint - 55296) * 1024 & 65535;
+      codepoint = (str.charCodeAt(i + 1) - 56320 & 65535 | highSurrogate) + 65536, i += 1;
+    }
+    codepointToUTF8(codepoint, emit);
+  }
+}
+function stringFromUTF8(byte, state, emit) {
+  if (state.utf8seq === 0) {
+    if (byte <= 127) {
+      emit(byte);
+      return;
+    }
+    for (let leadingBit = 1; leadingBit < 6; leadingBit += 1)
+      if ((byte >> 7 - leadingBit & 1) === 0) {
+        state.utf8seq = leadingBit;
+        break;
+      }
+    if (state.utf8seq === 2)
+      state.codepoint = byte & 31;
+    else if (state.utf8seq === 3)
+      state.codepoint = byte & 15;
+    else if (state.utf8seq === 4)
+      state.codepoint = byte & 7;
+    else
+      throw new Error("Invalid UTF-8 sequence");
+    state.utf8seq -= 1;
+  } else if (state.utf8seq > 0) {
+    if (byte <= 127)
+      throw new Error("Invalid UTF-8 sequence");
+    state.codepoint = state.codepoint << 6 | byte & 63, state.utf8seq -= 1, state.utf8seq === 0 && emit(state.codepoint);
+  }
+}
+function base64UrlToUint8Array(str) {
+  let result = [], state = { queue: 0, queuedBits: 0 }, onByte = (byte) => {
+    result.push(byte);
+  };
+  for (let i = 0; i < str.length; i += 1)
+    byteFromBase64URL(str.charCodeAt(i), state, onByte);
+  return new Uint8Array(result);
+}
+function stringToUint8Array(str) {
+  let result = [];
+  return stringToUTF8(str, (byte) => result.push(byte)), new Uint8Array(result);
+}
+function bytesToBase64URL(bytes) {
+  let result = [], state = { queue: 0, queuedBits: 0 }, onChar = (char) => {
+    result.push(char);
+  };
+  return bytes.forEach((byte) => byteToBase64URL(byte, state, onChar)), byteToBase64URL(null, state, onChar), result.join("");
+}
+
+function expiresAt(expiresIn) {
+  return Math.round(Date.now() / 1e3) + expiresIn;
+}
+function generateCallbackId() {
+  return /* @__PURE__ */ Symbol("auth-callback");
+}
+var isBrowser = () => typeof window < "u" && typeof document < "u", localStorageWriteTests = {
+  tested: !1,
+  writable: !1
+}, supportsLocalStorage = () => {
+  if (!isBrowser())
+    return !1;
+  try {
+    if (typeof globalThis.localStorage != "object")
+      return !1;
+  } catch {
+    return !1;
+  }
+  if (localStorageWriteTests.tested)
+    return localStorageWriteTests.writable;
+  let randomKey = `lswt-${Math.random()}${Math.random()}`;
+  try {
+    globalThis.localStorage.setItem(randomKey, randomKey), globalThis.localStorage.removeItem(randomKey), localStorageWriteTests.tested = !0, localStorageWriteTests.writable = !0;
+  } catch {
+    localStorageWriteTests.tested = !0, localStorageWriteTests.writable = !1;
+  }
+  return localStorageWriteTests.writable;
+};
+function parseParametersFromURL(href) {
+  let result = {}, url = new URL(href);
+  if (url.hash && url.hash[0] === "#")
+    try {
+      new URLSearchParams(url.hash.substring(1)).forEach((value, key) => {
+        result[key] = value;
+      });
+    } catch {
+    }
+  return url.searchParams.forEach((value, key) => {
+    result[key] = value;
+  }), result;
+}
+var resolveFetch = (customFetch) => customFetch ? (...args) => customFetch(...args) : (...args) => fetch(...args), looksLikeFetchResponse = (maybeResponse) => typeof maybeResponse == "object" && maybeResponse !== null && "status" in maybeResponse && "ok" in maybeResponse && "json" in maybeResponse && typeof maybeResponse.json == "function", setItemAsync = async (storage, key, data) => {
+  await storage.setItem(key, JSON.stringify(data));
+}, getItemAsync = async (storage, key) => {
+  let value = await storage.getItem(key);
+  if (!value)
+    return null;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}, removeItemAsync = async (storage, key) => {
+  await storage.removeItem(key);
+}, Deferred = class _Deferred {
+  constructor() {
+    this.promise = new _Deferred.promiseConstructor((res, rej) => {
+      this.resolve = res, this.reject = rej;
+    });
+  }
+};
+Deferred.promiseConstructor = Promise;
+function decodeJWT(token) {
+  let parts = token.split(".");
+  if (parts.length !== 3)
+    throw new AuthInvalidJwtError("Invalid JWT structure");
+  for (let i = 0; i < parts.length; i++)
+    if (!BASE64URL_REGEX.test(parts[i]))
+      throw new AuthInvalidJwtError("JWT not in base64url format");
+  return {
+    // using base64url lib
+    header: JSON.parse(stringFromBase64URL(parts[0])),
+    payload: JSON.parse(stringFromBase64URL(parts[1])),
+    signature: base64UrlToUint8Array(parts[2]),
+    raw: {
+      header: parts[0],
+      payload: parts[1]
+    }
+  };
+}
+async function sleep(time) {
+  return await new Promise((accept) => {
+    setTimeout(() => accept(null), time);
+  });
+}
+function retryable(fn, isRetryable) {
+  return new Promise((accept, reject) => {
+    (async () => {
+      for (let attempt = 0; attempt < 1 / 0; attempt++)
+        try {
+          let result = await fn(attempt);
+          if (!isRetryable(attempt, null, result)) {
+            accept(result);
+            return;
+          }
+        } catch (e) {
+          if (!isRetryable(attempt, e)) {
+            reject(e);
+            return;
+          }
+        }
+    })();
+  });
+}
+function dec2hex(dec) {
+  return ("0" + dec.toString(16)).substr(-2);
+}
+function generatePKCEVerifier() {
+  let array = new Uint32Array(56);
+  if (typeof crypto > "u") {
+    let charSet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~", charSetLen = charSet.length, verifier = "";
+    for (let i = 0; i < 56; i++)
+      verifier += charSet.charAt(Math.floor(Math.random() * charSetLen));
+    return verifier;
+  }
+  return crypto.getRandomValues(array), Array.from(array, dec2hex).join("");
+}
+async function sha256(randomString) {
+  let encodedData = new TextEncoder().encode(randomString), hash = await crypto.subtle.digest("SHA-256", encodedData), bytes = new Uint8Array(hash);
+  return Array.from(bytes).map((c) => String.fromCharCode(c)).join("");
+}
+async function generatePKCEChallenge(verifier) {
+  if (!(typeof crypto < "u" && typeof crypto.subtle < "u" && typeof TextEncoder < "u"))
+    return console.warn("WebCrypto API is not supported. Code challenge method will default to use plain instead of sha256."), verifier;
+  let hashed = await sha256(verifier);
+  return btoa(hashed).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var PKCE_FLOW_ID_PATTERN = /^[a-zA-Z0-9_-]{8,64}$/;
+function validatePKCEFlowId(flowId) {
+  return typeof flowId == "string" && PKCE_FLOW_ID_PATTERN.test(flowId) ? flowId : null;
+}
+function generatePKCEFlowId() {
+  if (typeof crypto < "u" && typeof crypto.getRandomValues == "function") {
+    let bytes = new Uint8Array(16);
+    return crypto.getRandomValues(bytes), Array.from(bytes, dec2hex).join("");
+  }
+  let flowId = "";
+  for (let i = 0; i < 32; i++)
+    flowId += Math.floor(Math.random() * 16).toString(16);
+  return flowId;
+}
+var pkceVerifierSlotKey = (storageKey, flowId) => `${storageKey}-flow-${flowId}-code-verifier`, pkceFlowIndexKey = (storageKey) => `${storageKey}-flows-code-verifier`;
+async function getPKCEFlowIndex(storage, storageKey) {
+  let index = await getItemAsync(storage, pkceFlowIndexKey(storageKey));
+  return Array.isArray(index) ? index.filter((id) => validatePKCEFlowId(id) !== null) : [];
+}
+async function storePKCEVerifier(storage, storageKey, flowId, verifier, onEvictFlow) {
+  await setItemAsync(storage, pkceVerifierSlotKey(storageKey, flowId), verifier);
+  let index = (await getPKCEFlowIndex(storage, storageKey)).filter((id) => id !== flowId);
+  for (index.push(flowId); index.length > PKCE_MAX_CONCURRENT_FLOWS; ) {
+    let evicted = index.shift();
+    await removeItemAsync(storage, pkceVerifierSlotKey(storageKey, evicted)), onEvictFlow?.(evicted);
+  }
+  await setItemAsync(storage, pkceFlowIndexKey(storageKey), index), await setItemAsync(storage, `${storageKey}-code-verifier`, verifier);
+}
+async function retrievePKCEVerifier(storage, storageKey, flowId) {
+  if (flowId) {
+    let verifier2 = await getItemAsync(storage, pkceVerifierSlotKey(storageKey, flowId));
+    return { verifier: typeof verifier2 == "string" ? verifier2 : null, flowId };
+  }
+  let verifier = await getItemAsync(storage, `${storageKey}-code-verifier`);
+  return { verifier: typeof verifier == "string" ? verifier : null, flowId: null };
+}
+async function removePKCEVerifier(storage, storageKey, flowId) {
+  let legacyKey = `${storageKey}-code-verifier`;
+  if (!flowId) {
+    await removeItemAsync(storage, legacyKey);
+    return;
+  }
+  let slotKey = pkceVerifierSlotKey(storageKey, flowId), slotValue = await getItemAsync(storage, slotKey);
+  await removeItemAsync(storage, slotKey);
+  let index = await getPKCEFlowIndex(storage, storageKey), remaining = index.filter((id) => id !== flowId);
+  remaining.length !== index.length && (remaining.length > 0 ? await setItemAsync(storage, pkceFlowIndexKey(storageKey), remaining) : await removeItemAsync(storage, pkceFlowIndexKey(storageKey))), slotValue != null && slotValue === await getItemAsync(storage, legacyKey) && await removeItemAsync(storage, legacyKey);
+}
+async function removeAllPKCEVerifiers(storage, storageKey) {
+  let index = await getPKCEFlowIndex(storage, storageKey);
+  for (let flowId of index)
+    await removeItemAsync(storage, pkceVerifierSlotKey(storageKey, flowId));
+  await removeItemAsync(storage, pkceFlowIndexKey(storageKey)), await removeItemAsync(storage, `${storageKey}-code-verifier`);
+}
+function appendFlowIdToRedirectTo(redirectTo, flowId) {
+  let hashIndex = redirectTo.indexOf("#"), base = hashIndex === -1 ? redirectTo : redirectTo.slice(0, hashIndex), fragment = hashIndex === -1 ? "" : redirectTo.slice(hashIndex), queryIndex = base.indexOf("?");
+  if (queryIndex !== -1) {
+    let path = base.slice(0, queryIndex), remaining = base.slice(queryIndex + 1).split("&").filter((pair) => pair !== "" && pair !== PKCE_FLOW_ID_PARAM && !pair.startsWith(`${PKCE_FLOW_ID_PARAM}=`));
+    base = remaining.length > 0 ? `${path}?${remaining.join("&")}` : path;
+  }
+  let separator = base.includes("?") ? "&" : "?";
+  return `${base}${separator}${PKCE_FLOW_ID_PARAM}=${encodeURIComponent(flowId)}${fragment}`;
+}
+async function getCodeChallengeAndMethod(storage, storageKey, isPasswordRecovery = !1, onEvictFlow) {
+  let codeVerifier = generatePKCEVerifier(), storedCodeVerifier = codeVerifier;
+  isPasswordRecovery && (storedCodeVerifier += "/recovery");
+  let flowId = generatePKCEFlowId();
+  await storePKCEVerifier(storage, storageKey, flowId, storedCodeVerifier, onEvictFlow);
+  let codeChallenge = await generatePKCEChallenge(codeVerifier);
+  return [codeChallenge, codeVerifier === codeChallenge ? "plain" : "s256", flowId];
+}
+var API_VERSION_REGEX = /^2[0-9]{3}-(0[1-9]|1[0-2])-(0[1-9]|1[0-9]|2[0-9]|3[0-1])$/i;
+function parseResponseAPIVersion(response) {
+  let apiVersion = response.headers.get(API_VERSION_HEADER_NAME);
+  if (!apiVersion || !apiVersion.match(API_VERSION_REGEX))
+    return null;
+  try {
+    return /* @__PURE__ */ new Date(`${apiVersion}T00:00:00.0Z`);
+  } catch {
+    return null;
+  }
+}
+function validateExp(exp) {
+  if (!exp)
+    throw new Error("Missing exp claim");
+  let timeNow = Math.floor(Date.now() / 1e3);
+  if (exp <= timeNow)
+    throw new Error("JWT has expired");
+}
+function getAlgorithm(alg) {
+  switch (alg) {
+    case "RS256":
+      return {
+        name: "RSASSA-PKCS1-v1_5",
+        hash: { name: "SHA-256" }
+      };
+    case "ES256":
+      return {
+        name: "ECDSA",
+        namedCurve: "P-256",
+        hash: { name: "SHA-256" }
+      };
+    default:
+      throw new Error("Invalid alg claim");
+  }
+}
+var UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function validateUUID(str) {
+  if (!UUID_REGEX.test(str))
+    throw new Error("@supabase/auth-js: Expected parameter to be UUID but is not");
+}
+function assertPasskeyExperimentalEnabled(experimental) {
+  if (!experimental.passkey)
+    throw new Error("@supabase/auth-js: the passkey API is experimental and disabled by default. Enable it by passing `auth: { experimental: { passkey: true } }` to createClient (or to the GoTrueClient constructor).");
+}
+function assertRecoveryCodesExperimentalEnabled(experimental) {
+  if (!experimental.recoveryCodes)
+    throw new Error("@supabase/auth-js: the MFA recovery codes API is experimental and disabled by default. Enable it by passing `auth: { experimental: { recoveryCodes: true } }` to createClient (or to the GoTrueClient constructor).");
+}
+function userNotAvailableProxy() {
+  let proxyTarget = {};
+  return new Proxy(proxyTarget, {
+    get: (target, prop) => {
+      if (prop === "__isUserNotAvailableProxy")
+        return !0;
+      if (typeof prop == "symbol") {
+        let sProp = prop.toString();
+        if (sProp === "Symbol(Symbol.toPrimitive)" || sProp === "Symbol(Symbol.toStringTag)" || sProp === "Symbol(util.inspect.custom)")
+          return;
+      }
+      throw new Error(`@supabase/auth-js: client was created with userStorage option and there was no user stored in the user storage. Accessing the "${prop}" property of the session object is not supported. Please use getUser() instead.`);
+    },
+    set: (_target, prop) => {
+      throw new Error(`@supabase/auth-js: client was created with userStorage option and there was no user stored in the user storage. Setting the "${prop}" property of the session object is not supported. Please use getUser() to fetch a user object you can manipulate.`);
+    },
+    deleteProperty: (_target, prop) => {
+      throw new Error(`@supabase/auth-js: client was created with userStorage option and there was no user stored in the user storage. Deleting the "${prop}" property of the session object is not supported. Please use getUser() to fetch a user object you can manipulate.`);
+    }
+  });
+}
+function insecureUserWarningProxy(user, suppressWarningRef) {
+  return new Proxy(user, {
+    get: (target, prop, receiver) => {
+      if (prop === "__isInsecureUserWarningProxy")
+        return !0;
+      if (typeof prop == "symbol") {
+        let sProp = prop.toString();
+        if (sProp === "Symbol(Symbol.toPrimitive)" || sProp === "Symbol(Symbol.toStringTag)" || sProp === "Symbol(util.inspect.custom)" || sProp === "Symbol(nodejs.util.inspect.custom)")
+          return Reflect.get(target, prop, receiver);
+      }
+      return !suppressWarningRef.value && typeof prop == "string" && (console.warn("Using the user object as returned from supabase.auth.getSession() or from some supabase.auth.onAuthStateChange() events could be insecure! This value comes directly from the storage medium (usually cookies on the server) and may not be authentic. Use supabase.auth.getUser() instead which authenticates the data by contacting the Supabase Auth server."), suppressWarningRef.value = !0), Reflect.get(target, prop, receiver);
+    }
+  });
+}
+function deepClone(obj) {
+  return JSON.parse(JSON.stringify(obj));
+}
+
+var _getErrorMessage = (err) => {
+  if (typeof err == "object" && err !== null) {
+    let e = err;
+    if (typeof e.msg == "string")
+      return e.msg;
+    if (typeof e.message == "string")
+      return e.message;
+    if (typeof e.error_description == "string")
+      return e.error_description;
+    if (typeof e.error == "string")
+      return e.error;
+  }
+  return JSON.stringify(err);
+}, NETWORK_ERROR_CODES = [
+  500,
+  501,
+  502,
+  503,
+  504,
+  520,
+  521,
+  522,
+  523,
+  524,
+  525,
+  526,
+  527,
+  528,
+  529,
+  530
+];
+async function handleError(error) {
+  var _a;
+  if (!looksLikeFetchResponse(error))
+    throw new AuthRetryableFetchError(_getErrorMessage(error), 0);
+  let data;
+  try {
+    data = await error.json();
+  } catch (e) {
+    throw NETWORK_ERROR_CODES.includes(error.status) ? new AuthRetryableFetchError(error.statusText || `HTTP ${error.status}`, error.status) : new AuthUnknownError(_getErrorMessage(e), e);
+  }
+  if (NETWORK_ERROR_CODES.includes(error.status))
+    throw new AuthRetryableFetchError(_getErrorMessage(data), error.status);
+  let errorCode, responseAPIVersion = parseResponseAPIVersion(error);
+  if (responseAPIVersion && responseAPIVersion.getTime() >= API_VERSIONS["2024-01-01"].timestamp && typeof data == "object" && data && typeof data.code == "string" ? errorCode = data.code : typeof data == "object" && data && typeof data.error_code == "string" && (errorCode = data.error_code), errorCode) {
+    if (errorCode === "weak_password")
+      throw new AuthWeakPasswordError(_getErrorMessage(data), error.status, ((_a = data.weak_password) === null || _a === void 0 ? void 0 : _a.reasons) || []);
+    if (errorCode === "session_not_found")
+      throw new AuthSessionMissingError();
+  } else if (typeof data == "object" && data && typeof data.weak_password == "object" && data.weak_password && Array.isArray(data.weak_password.reasons) && data.weak_password.reasons.length && data.weak_password.reasons.reduce((a, i) => a && typeof i == "string", !0))
+    throw new AuthWeakPasswordError(_getErrorMessage(data), error.status, data.weak_password.reasons);
+  throw new AuthApiError(_getErrorMessage(data), error.status || 500, errorCode);
+}
+var _getRequestParams = (method, options, parameters, body) => {
+  let params = { method, headers: options?.headers || {} };
+  return method === "GET" ? params : (params.headers = Object.assign({ "Content-Type": "application/json;charset=UTF-8" }, options?.headers), params.body = JSON.stringify(body), Object.assign(Object.assign({}, params), parameters));
+};
+async function _request(fetcher, method, url, options) {
+  var _a;
+  let headers = Object.assign({}, options?.headers);
+  headers[API_VERSION_HEADER_NAME] || (headers[API_VERSION_HEADER_NAME] = API_VERSIONS["2024-01-01"].name), options?.jwt && (headers.Authorization = `Bearer ${options.jwt}`);
+  let qs = (_a = options?.query) !== null && _a !== void 0 ? _a : {};
+  options?.redirectTo && (qs.redirect_to = options.redirectTo);
+  let queryString = Object.keys(qs).length ? "?" + new URLSearchParams(qs).toString() : "", data = await _handleRequest(fetcher, method, url + queryString, {
+    headers,
+    noResolveJson: options?.noResolveJson
+  }, {}, options?.body);
+  return options?.xform ? options?.xform(data) : { data: Object.assign({}, data), error: null };
+}
+async function _handleRequest(fetcher, method, url, options, parameters, body) {
+  let requestParams = _getRequestParams(method, options, parameters, body), result;
+  try {
+    result = await fetcher(url, Object.assign({}, requestParams));
+  } catch (e) {
+    throw new AuthRetryableFetchError(_getErrorMessage(e), 0);
+  }
+  if (result.ok || await handleError(result), options?.noResolveJson)
+    return result;
+  try {
+    return await result.json();
+  } catch (e) {
+    await handleError(e);
+  }
+}
+function _sessionResponse(data) {
+  var _a;
+  let session = null;
+  hasSession(data) && (session = Object.assign({}, data), data.expires_at || (session.expires_at = expiresAt(data.expires_in)));
+  let user = (_a = data.user) !== null && _a !== void 0 ? _a : typeof data?.id == "string" ? data : null;
+  return { data: { session, user }, error: null };
+}
+function _sessionResponsePassword(data) {
+  let response = _sessionResponse(data);
+  return !response.error && data.weak_password && typeof data.weak_password == "object" && Array.isArray(data.weak_password.reasons) && data.weak_password.reasons.length && data.weak_password.message && typeof data.weak_password.message == "string" && data.weak_password.reasons.reduce((a, i) => a && typeof i == "string", !0) && (response.data.weak_password = data.weak_password), response;
+}
+function _userResponse(data) {
+  var _a;
+  return { data: { user: (_a = data.user) !== null && _a !== void 0 ? _a : data }, error: null };
+}
+function _ssoResponse(data) {
+  return { data, error: null };
+}
+function _generateLinkResponse(data) {
+  let { action_link, email_otp, hashed_token, redirect_to, verification_type } = data, rest = __rest(data, ["action_link", "email_otp", "hashed_token", "redirect_to", "verification_type"]), properties = {
+    action_link,
+    email_otp,
+    hashed_token,
+    redirect_to,
+    verification_type
+  }, user = Object.assign({}, rest);
+  return {
+    data: {
+      properties,
+      user
+    },
+    error: null
+  };
+}
+function _noResolveJsonResponse(data) {
+  return data;
+}
+function hasSession(data) {
+  return !!data.access_token && !!data.refresh_token && !!data.expires_in;
+}
+
+var SIGN_OUT_SCOPES = ["global", "local", "others"];
+
+var GoTrueAdminApi = class {
+  constructor({ url = "", headers = {}, fetch: fetch2, experimental }) {
+    this.url = url, this.headers = headers, this.fetch = resolveFetch(fetch2), this.experimental = experimental ?? {}, this.mfa = {
+      listFactors: this._listFactors.bind(this),
+      deleteFactor: this._deleteFactor.bind(this)
+    }, this.oauth = {
+      listClients: this._listOAuthClients.bind(this),
+      createClient: this._createOAuthClient.bind(this),
+      getClient: this._getOAuthClient.bind(this),
+      updateClient: this._updateOAuthClient.bind(this),
+      deleteClient: this._deleteOAuthClient.bind(this),
+      regenerateClientSecret: this._regenerateOAuthClientSecret.bind(this)
+    }, this.customProviders = {
+      listProviders: this._listCustomProviders.bind(this),
+      createProvider: this._createCustomProvider.bind(this),
+      getProvider: this._getCustomProvider.bind(this),
+      updateProvider: this._updateCustomProvider.bind(this),
+      deleteProvider: this._deleteCustomProvider.bind(this)
+    }, this.passkey = {
+      listPasskeys: this._adminListPasskeys.bind(this),
+      deletePasskey: this._adminDeletePasskey.bind(this)
+    };
+  }
+  async signOut(jwt, scope = SIGN_OUT_SCOPES[0]) {
+    if (SIGN_OUT_SCOPES.indexOf(scope) < 0)
+      throw new Error(`@supabase/auth-js: Parameter scope must be one of ${SIGN_OUT_SCOPES.join(", ")}`);
+    try {
+      return await _request(this.fetch, "POST", `${this.url}/logout?scope=${scope}`, {
+        headers: this.headers,
+        jwt,
+        noResolveJson: !0
+      }), { data: null, error: null };
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async inviteUserByEmail(email, options = {}) {
+    try {
+      return await _request(this.fetch, "POST", `${this.url}/invite`, {
+        body: { email, data: options.data },
+        headers: this.headers,
+        redirectTo: options.redirectTo,
+        xform: _userResponse
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: { user: null }, error };
+      throw error;
+    }
+  }
+  async generateLink(params) {
+    try {
+      let { options } = params, rest = __rest(params, ["options"]), body = Object.assign(Object.assign({}, rest), options);
+      return "newEmail" in rest && (body.new_email = rest?.newEmail, delete body.newEmail), await _request(this.fetch, "POST", `${this.url}/admin/generate_link`, {
+        body,
+        headers: this.headers,
+        xform: _generateLinkResponse,
+        redirectTo: options?.redirectTo
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return {
+          data: {
+            properties: null,
+            user: null
+          },
+          error
+        };
+      throw error;
+    }
+  }
+  // User Admin API
+  async createUser(attributes) {
+    try {
+      return await _request(this.fetch, "POST", `${this.url}/admin/users`, {
+        body: attributes,
+        headers: this.headers,
+        xform: _userResponse
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: { user: null }, error };
+      throw error;
+    }
+  }
+  async listUsers(params) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    try {
+      let pagination = { nextPage: null, lastPage: 0, total: 0 }, response = await _request(this.fetch, "GET", `${this.url}/admin/users`, {
+        headers: this.headers,
+        noResolveJson: !0,
+        query: {
+          page: (_b = (_a = params?.page) === null || _a === void 0 ? void 0 : _a.toString()) !== null && _b !== void 0 ? _b : "",
+          per_page: (_d = (_c = params?.perPage) === null || _c === void 0 ? void 0 : _c.toString()) !== null && _d !== void 0 ? _d : ""
+        },
+        xform: _noResolveJsonResponse
+      });
+      if (response.error)
+        throw response.error;
+      let users = await response.json(), total = (_e = response.headers.get("x-total-count")) !== null && _e !== void 0 ? _e : 0, links = (_g = (_f = response.headers.get("link")) === null || _f === void 0 ? void 0 : _f.split(",")) !== null && _g !== void 0 ? _g : [];
+      return links.length > 0 && (links.forEach((link) => {
+        let page = parseInt(link.split(";")[0].split("=")[1].substring(0, 1)), rel = JSON.parse(link.split(";")[1].split("=")[1]);
+        pagination[`${rel}Page`] = page;
+      }), pagination.total = parseInt(total)), { data: Object.assign(Object.assign({}, users), pagination), error: null };
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: { users: [] }, error };
+      throw error;
+    }
+  }
+  async getUserById(uid) {
+    validateUUID(uid);
+    try {
+      return await _request(this.fetch, "GET", `${this.url}/admin/users/${uid}`, {
+        headers: this.headers,
+        xform: _userResponse
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: { user: null }, error };
+      throw error;
+    }
+  }
+  async updateUserById(uid, attributes) {
+    validateUUID(uid);
+    try {
+      return await _request(this.fetch, "PUT", `${this.url}/admin/users/${uid}`, {
+        body: attributes,
+        headers: this.headers,
+        xform: _userResponse
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: { user: null }, error };
+      throw error;
+    }
+  }
+  async deleteUser(id, shouldSoftDelete = !1) {
+    validateUUID(id);
+    try {
+      return await _request(this.fetch, "DELETE", `${this.url}/admin/users/${id}`, {
+        headers: this.headers,
+        body: {
+          should_soft_delete: shouldSoftDelete
+        },
+        xform: _userResponse
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: { user: null }, error };
+      throw error;
+    }
+  }
+  async _listFactors(params) {
+    validateUUID(params.userId);
+    try {
+      let { data, error } = await _request(this.fetch, "GET", `${this.url}/admin/users/${params.userId}/factors`, {
+        headers: this.headers,
+        xform: (factors) => ({ data: { factors }, error: null })
+      });
+      return { data, error };
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async _deleteFactor(params) {
+    validateUUID(params.userId), validateUUID(params.id);
+    try {
+      return { data: await _request(this.fetch, "DELETE", `${this.url}/admin/users/${params.userId}/factors/${params.id}`, {
+        headers: this.headers
+      }), error: null };
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async _listOAuthClients(params) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    try {
+      let pagination = { nextPage: null, lastPage: 0, total: 0 }, response = await _request(this.fetch, "GET", `${this.url}/admin/oauth/clients`, {
+        headers: this.headers,
+        noResolveJson: !0,
+        query: {
+          page: (_b = (_a = params?.page) === null || _a === void 0 ? void 0 : _a.toString()) !== null && _b !== void 0 ? _b : "",
+          per_page: (_d = (_c = params?.perPage) === null || _c === void 0 ? void 0 : _c.toString()) !== null && _d !== void 0 ? _d : ""
+        },
+        xform: _noResolveJsonResponse
+      });
+      if (response.error)
+        throw response.error;
+      let clients = await response.json(), total = (_e = response.headers.get("x-total-count")) !== null && _e !== void 0 ? _e : 0, links = (_g = (_f = response.headers.get("link")) === null || _f === void 0 ? void 0 : _f.split(",")) !== null && _g !== void 0 ? _g : [];
+      return links.length > 0 && (links.forEach((link) => {
+        let page = parseInt(link.split(";")[0].split("=")[1].substring(0, 1)), rel = JSON.parse(link.split(";")[1].split("=")[1]);
+        pagination[`${rel}Page`] = page;
+      }), pagination.total = parseInt(total)), { data: Object.assign(Object.assign({}, clients), pagination), error: null };
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: { clients: [] }, error };
+      throw error;
+    }
+  }
+  async _createOAuthClient(params) {
+    try {
+      return await _request(this.fetch, "POST", `${this.url}/admin/oauth/clients`, {
+        body: params,
+        headers: this.headers,
+        xform: (client) => ({ data: client, error: null })
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async _getOAuthClient(clientId) {
+    try {
+      return await _request(this.fetch, "GET", `${this.url}/admin/oauth/clients/${clientId}`, {
+        headers: this.headers,
+        xform: (client) => ({ data: client, error: null })
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async _updateOAuthClient(clientId, params) {
+    try {
+      return await _request(this.fetch, "PUT", `${this.url}/admin/oauth/clients/${clientId}`, {
+        body: params,
+        headers: this.headers,
+        xform: (client) => ({ data: client, error: null })
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async _deleteOAuthClient(clientId) {
+    try {
+      return await _request(this.fetch, "DELETE", `${this.url}/admin/oauth/clients/${clientId}`, {
+        headers: this.headers,
+        noResolveJson: !0
+      }), { data: null, error: null };
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async _regenerateOAuthClientSecret(clientId) {
+    try {
+      return await _request(this.fetch, "POST", `${this.url}/admin/oauth/clients/${clientId}/regenerate_secret`, {
+        headers: this.headers,
+        xform: (client) => ({ data: client, error: null })
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async _listCustomProviders(params) {
+    try {
+      let query = {};
+      return params?.type && (query.type = params.type), await _request(this.fetch, "GET", `${this.url}/admin/custom-providers`, {
+        headers: this.headers,
+        query,
+        xform: (data) => {
+          var _a;
+          return { data: { providers: (_a = data?.providers) !== null && _a !== void 0 ? _a : [] }, error: null };
+        }
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: { providers: [] }, error };
+      throw error;
+    }
+  }
+  async _createCustomProvider(params) {
+    try {
+      return await _request(this.fetch, "POST", `${this.url}/admin/custom-providers`, {
+        body: params,
+        headers: this.headers,
+        xform: (provider) => ({ data: provider, error: null })
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async _getCustomProvider(identifier) {
+    try {
+      return await _request(this.fetch, "GET", `${this.url}/admin/custom-providers/${identifier}`, {
+        headers: this.headers,
+        xform: (provider) => ({ data: provider, error: null })
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async _updateCustomProvider(identifier, params) {
+    try {
+      return await _request(this.fetch, "PUT", `${this.url}/admin/custom-providers/${identifier}`, {
+        body: params,
+        headers: this.headers,
+        xform: (provider) => ({ data: provider, error: null })
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async _deleteCustomProvider(identifier) {
+    try {
+      return await _request(this.fetch, "DELETE", `${this.url}/admin/custom-providers/${identifier}`, {
+        headers: this.headers,
+        noResolveJson: !0
+      }), { data: null, error: null };
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async _adminListPasskeys(params) {
+    assertPasskeyExperimentalEnabled(this.experimental), validateUUID(params.userId);
+    try {
+      return await _request(this.fetch, "GET", `${this.url}/admin/users/${params.userId}/passkeys`, { headers: this.headers, xform: (data) => ({ data, error: null }) });
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+  async _adminDeletePasskey(params) {
+    assertPasskeyExperimentalEnabled(this.experimental), validateUUID(params.userId), validateUUID(params.passkeyId);
+    try {
+      return await _request(this.fetch, "DELETE", `${this.url}/admin/users/${params.userId}/passkeys/${params.passkeyId}`, { headers: this.headers, noResolveJson: !0 }), { data: null, error: null };
+    } catch (error) {
+      if (isAuthError(error))
+        return { data: null, error };
+      throw error;
+    }
+  }
+};
+
+function memoryLocalStorageAdapter(store = {}) {
+  return {
+    getItem: (key) => store[key] || null,
+    setItem: (key, value) => {
+      store[key] = value;
+    },
+    removeItem: (key) => {
+      delete store[key];
+    }
+  };
+}
+
+var internals = {
+  debug: !!(globalThis && supportsLocalStorage() && globalThis.localStorage && globalThis.localStorage.getItem("supabase.gotrue-js.locks.debug") === "true")
+}, LockAcquireTimeoutError = class extends Error {
+  constructor(message) {
+    super(message), this.isAcquireTimeout = !0;
+  }
+};
+
+function polyfillGlobalThis() {
+  if (typeof globalThis != "object")
+    try {
+      Object.defineProperty(Object.prototype, "__magic__", {
+        get: function() {
+          return this;
+        },
+        configurable: !0
+      }), __magic__.globalThis = __magic__, delete Object.prototype.__magic__;
+    } catch {
+      typeof self < "u" && (self.globalThis = self);
+    }
+}
+
+function getAddress(address) {
+  if (!/^0x[a-fA-F0-9]{40}$/.test(address))
+    throw new Error(`@supabase/auth-js: Address "${address}" is invalid.`);
+  return address.toLowerCase();
+}
+function fromHex(hex) {
+  return parseInt(hex, 16);
+}
+function toHex(value) {
+  let bytes = new TextEncoder().encode(value);
+  return "0x" + Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function createSiweMessage(parameters) {
+  var _a;
+  let { chainId, domain, expirationTime, issuedAt = /* @__PURE__ */ new Date(), nonce, notBefore, requestId, resources, scheme, uri, version: version2 } = parameters;
+  {
+    if (!Number.isInteger(chainId))
+      throw new Error(`@supabase/auth-js: Invalid SIWE message field "chainId". Chain ID must be a EIP-155 chain ID. Provided value: ${chainId}`);
+    if (!domain)
+      throw new Error('@supabase/auth-js: Invalid SIWE message field "domain". Domain must be provided.');
+    if (nonce && nonce.length < 8)
+      throw new Error(`@supabase/auth-js: Invalid SIWE message field "nonce". Nonce must be at least 8 characters. Provided value: ${nonce}`);
+    if (!uri)
+      throw new Error('@supabase/auth-js: Invalid SIWE message field "uri". URI must be provided.');
+    if (version2 !== "1")
+      throw new Error(`@supabase/auth-js: Invalid SIWE message field "version". Version must be '1'. Provided value: ${version2}`);
+    if (!((_a = parameters.statement) === null || _a === void 0) && _a.includes(`
+`))
+      throw new Error(`@supabase/auth-js: Invalid SIWE message field "statement". Statement must not include '\\n'. Provided value: ${parameters.statement}`);
+  }
+  let address = getAddress(parameters.address), origin = scheme ? `${scheme}://${domain}` : domain, statement = parameters.statement ? `${parameters.statement}
+` : "", prefix = `${origin} wants you to sign in with your Ethereum account:
+${address}
+
+${statement}`, suffix = `URI: ${uri}
+Version: ${version2}
+Chain ID: ${chainId}${nonce ? `
+Nonce: ${nonce}` : ""}
+Issued At: ${issuedAt.toISOString()}`;
+  if (expirationTime && (suffix += `
+Expiration Time: ${expirationTime.toISOString()}`), notBefore && (suffix += `
+Not Before: ${notBefore.toISOString()}`), requestId && (suffix += `
+Request ID: ${requestId}`), resources) {
+    let content = `
+Resources:`;
+    for (let resource of resources) {
+      if (!resource || typeof resource != "string")
+        throw new Error(`@supabase/auth-js: Invalid SIWE message field "resources". Every resource must be a valid string. Provided value: ${resource}`);
+      content += `
+- ${resource}`;
+    }
+    suffix += content;
+  }
+  return `${prefix}
+${suffix}`;
+}
+
+var WebAuthnError = class extends Error {
+  constructor({ message, code, cause, name }) {
+    var _a;
+    super(message, { cause }), this.__isWebAuthnError = !0, this.name = (_a = name ?? (cause instanceof Error ? cause.name : void 0)) !== null && _a !== void 0 ? _a : "Unknown Error", this.code = code;
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      message: this.message,
+      code: this.code
+    };
+  }
+}, WebAuthnUnknownError = class extends WebAuthnError {
+  constructor(message, originalError) {
+    super({
+      code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+      cause: originalError,
+      message
+    }), this.name = "WebAuthnUnknownError", this.originalError = originalError;
+  }
+};
+function identifyRegistrationError({ error, options }) {
+  var _a, _b, _c;
+  let { publicKey } = options;
+  if (!publicKey)
+    throw Error("options was missing required publicKey property");
+  if (error.name === "AbortError") {
+    if (options.signal instanceof AbortSignal)
+      return new WebAuthnError({
+        message: "Registration ceremony was sent an abort signal",
+        code: "ERROR_CEREMONY_ABORTED",
+        cause: error
+      });
+  } else if (error.name === "ConstraintError") {
+    if (((_a = publicKey.authenticatorSelection) === null || _a === void 0 ? void 0 : _a.requireResidentKey) === !0)
+      return new WebAuthnError({
+        message: "Discoverable credentials were required but no available authenticator supported it",
+        code: "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",
+        cause: error
+      });
+    if (
+      // @ts-ignore: `mediation` doesn't yet exist on CredentialCreationOptions but it's possible as of Sept 2024
+      options.mediation === "conditional" && ((_b = publicKey.authenticatorSelection) === null || _b === void 0 ? void 0 : _b.userVerification) === "required"
+    )
+      return new WebAuthnError({
+        message: "User verification was required during automatic registration but it could not be performed",
+        code: "ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",
+        cause: error
+      });
+    if (((_c = publicKey.authenticatorSelection) === null || _c === void 0 ? void 0 : _c.userVerification) === "required")
+      return new WebAuthnError({
+        message: "User verification was required but no available authenticator supported it",
+        code: "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",
+        cause: error
+      });
+  } else {
+    if (error.name === "InvalidStateError")
+      return new WebAuthnError({
+        message: "The authenticator was previously registered",
+        code: "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",
+        cause: error
+      });
+    if (error.name === "NotAllowedError")
+      return new WebAuthnError({
+        message: error.message,
+        code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+        cause: error
+      });
+    if (error.name === "NotSupportedError")
+      return publicKey.pubKeyCredParams.filter((param) => param.type === "public-key").length === 0 ? new WebAuthnError({
+        message: 'No entry in pubKeyCredParams was of type "public-key"',
+        code: "ERROR_MALFORMED_PUBKEYCREDPARAMS",
+        cause: error
+      }) : new WebAuthnError({
+        message: "No available authenticator supported any of the specified pubKeyCredParams algorithms",
+        code: "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",
+        cause: error
+      });
+    if (error.name === "SecurityError") {
+      let effectiveDomain = window.location.hostname;
+      if (isValidDomain(effectiveDomain)) {
+        if (publicKey.rp.id !== effectiveDomain)
+          return new WebAuthnError({
+            message: `The RP ID "${publicKey.rp.id}" is invalid for this domain`,
+            code: "ERROR_INVALID_RP_ID",
+            cause: error
+          });
+      } else return new WebAuthnError({
+        message: `${window.location.hostname} is an invalid domain`,
+        code: "ERROR_INVALID_DOMAIN",
+        cause: error
+      });
+    } else if (error.name === "TypeError") {
+      if (publicKey.user.id.byteLength < 1 || publicKey.user.id.byteLength > 64)
+        return new WebAuthnError({
+          message: "User ID was not between 1 and 64 characters",
+          code: "ERROR_INVALID_USER_ID_LENGTH",
+          cause: error
+        });
+    } else if (error.name === "UnknownError")
+      return new WebAuthnError({
+        message: "The authenticator was unable to process the specified options, or could not create a new credential",
+        code: "ERROR_AUTHENTICATOR_GENERAL_ERROR",
+        cause: error
+      });
+  }
+  return new WebAuthnError({
+    message: "a Non-Webauthn related error has occurred",
+    code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+    cause: error
+  });
+}
+function identifyAuthenticationError({ error, options }) {
+  let { publicKey } = options;
+  if (!publicKey)
+    throw Error("options was missing required publicKey property");
+  if (error.name === "AbortError") {
+    if (options.signal instanceof AbortSignal)
+      return new WebAuthnError({
+        message: "Authentication ceremony was sent an abort signal",
+        code: "ERROR_CEREMONY_ABORTED",
+        cause: error
+      });
+  } else {
+    if (error.name === "NotAllowedError")
+      return new WebAuthnError({
+        message: error.message,
+        code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+        cause: error
+      });
+    if (error.name === "SecurityError") {
+      let effectiveDomain = window.location.hostname;
+      if (isValidDomain(effectiveDomain)) {
+        if (publicKey.rpId !== effectiveDomain)
+          return new WebAuthnError({
+            message: `The RP ID "${publicKey.rpId}" is invalid for this domain`,
+            code: "ERROR_INVALID_RP_ID",
+            cause: error
+          });
+      } else return new WebAuthnError({
+        message: `${window.location.hostname} is an invalid domain`,
+        code: "ERROR_INVALID_DOMAIN",
+        cause: error
+      });
+    } else if (error.name === "UnknownError")
+      return new WebAuthnError({
+        message: "The authenticator was unable to process the specified options, or could not create a new assertion signature",
+        code: "ERROR_AUTHENTICATOR_GENERAL_ERROR",
+        cause: error
+      });
+  }
+  return new WebAuthnError({
+    message: "a Non-Webauthn related error has occurred",
+    code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+    cause: error
+  });
+}
+
+var WebAuthnAbortService = class {
+  createNewAbortSignal() {
+    if (this.controller) {
+      let abortError = new Error("Cancelling existing WebAuthn API call for new one");
+      abortError.name = "AbortError", this.controller.abort(abortError);
+    }
+    let newController = new AbortController();
+    return this.controller = newController, newController.signal;
+  }
+  cancelCeremony() {
+    if (this.controller) {
+      let abortError = new Error("Manually cancelling existing WebAuthn API call");
+      abortError.name = "AbortError", this.controller.abort(abortError), this.controller = void 0;
+    }
+  }
+}, webAuthnAbortService = new WebAuthnAbortService();
+function deserializeCredentialCreationOptions(options) {
+  if (!options)
+    throw new Error("Credential creation options are required");
+  if (typeof PublicKeyCredential < "u" && "parseCreationOptionsFromJSON" in PublicKeyCredential && typeof PublicKeyCredential.parseCreationOptionsFromJSON == "function")
+    return PublicKeyCredential.parseCreationOptionsFromJSON(
+      /** we assert the options here as typescript still doesn't know about future webauthn types */
+      options
+    );
+  let { challenge: challengeStr, user: userOpts, excludeCredentials } = options, restOptions = __rest(
+    options,
+    ["challenge", "user", "excludeCredentials"]
+  ), challenge = base64UrlToUint8Array(challengeStr).buffer, user = Object.assign(Object.assign({}, userOpts), { id: base64UrlToUint8Array(userOpts.id).buffer }), result = Object.assign(Object.assign({}, restOptions), {
+    challenge,
+    user
+  });
+  if (excludeCredentials && excludeCredentials.length > 0) {
+    result.excludeCredentials = new Array(excludeCredentials.length);
+    for (let i = 0; i < excludeCredentials.length; i++) {
+      let cred = excludeCredentials[i];
+      result.excludeCredentials[i] = Object.assign(Object.assign({}, cred), {
+        id: base64UrlToUint8Array(cred.id).buffer,
+        type: cred.type || "public-key",
+        // Cast transports to handle future transport types like "cable"
+        transports: cred.transports
+      });
+    }
+  }
+  return result;
+}
+function deserializeCredentialRequestOptions(options) {
+  if (!options)
+    throw new Error("Credential request options are required");
+  if (typeof PublicKeyCredential < "u" && "parseRequestOptionsFromJSON" in PublicKeyCredential && typeof PublicKeyCredential.parseRequestOptionsFromJSON == "function")
+    return PublicKeyCredential.parseRequestOptionsFromJSON(options);
+  let { challenge: challengeStr, allowCredentials } = options, restOptions = __rest(
+    options,
+    ["challenge", "allowCredentials"]
+  ), challenge = base64UrlToUint8Array(challengeStr).buffer, result = Object.assign(Object.assign({}, restOptions), { challenge });
+  if (allowCredentials && allowCredentials.length > 0) {
+    result.allowCredentials = new Array(allowCredentials.length);
+    for (let i = 0; i < allowCredentials.length; i++) {
+      let cred = allowCredentials[i];
+      result.allowCredentials[i] = Object.assign(Object.assign({}, cred), {
+        id: base64UrlToUint8Array(cred.id).buffer,
+        type: cred.type || "public-key",
+        // Cast transports to handle future transport types like "cable"
+        transports: cred.transports
+      });
+    }
+  }
+  return result;
+}
+function serializeCredentialCreationResponse(credential) {
+  var _a;
+  if ("toJSON" in credential && typeof credential.toJSON == "function")
+    return credential.toJSON();
+  let credentialWithAttachment = credential;
+  return {
+    id: credential.id,
+    rawId: credential.id,
+    response: {
+      attestationObject: bytesToBase64URL(new Uint8Array(credential.response.attestationObject)),
+      clientDataJSON: bytesToBase64URL(new Uint8Array(credential.response.clientDataJSON))
+    },
+    type: "public-key",
+    clientExtensionResults: credential.getClientExtensionResults(),
+    // Convert null to undefined and cast to AuthenticatorAttachment type
+    authenticatorAttachment: (_a = credentialWithAttachment.authenticatorAttachment) !== null && _a !== void 0 ? _a : void 0
+  };
+}
+function serializeCredentialRequestResponse(credential) {
+  var _a;
+  if ("toJSON" in credential && typeof credential.toJSON == "function")
+    return credential.toJSON();
+  let credentialWithAttachment = credential, clientExtensionResults = credential.getClientExtensionResults(), assertionResponse = credential.response;
+  return {
+    id: credential.id,
+    rawId: credential.id,
+    // W3C spec expects rawId to match id for JSON format
+    response: {
+      authenticatorData: bytesToBase64URL(new Uint8Array(assertionResponse.authenticatorData)),
+      clientDataJSON: bytesToBase64URL(new Uint8Array(assertionResponse.clientDataJSON)),
+      signature: bytesToBase64URL(new Uint8Array(assertionResponse.signature)),
+      userHandle: assertionResponse.userHandle ? bytesToBase64URL(new Uint8Array(assertionResponse.userHandle)) : void 0
+    },
+    type: "public-key",
+    clientExtensionResults,
+    // Convert null to undefined and cast to AuthenticatorAttachment type
+    authenticatorAttachment: (_a = credentialWithAttachment.authenticatorAttachment) !== null && _a !== void 0 ? _a : void 0
+  };
+}
+function isValidDomain(hostname) {
+  return (
+    // Consider localhost valid as well since it's okay wrt Secure Contexts
+    hostname === "localhost" || /^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(hostname)
+  );
+}
+function browserSupportsWebAuthn() {
+  var _a, _b;
+  return !!(isBrowser() && "PublicKeyCredential" in window && window.PublicKeyCredential && "credentials" in navigator && typeof ((_a = navigator?.credentials) === null || _a === void 0 ? void 0 : _a.create) == "function" && typeof ((_b = navigator?.credentials) === null || _b === void 0 ? void 0 : _b.get) == "function");
+}
+async function createCredential(options) {
+  try {
+    let response = await navigator.credentials.create(
+      /** we assert the type here until typescript types are updated */
+      options
+    );
+    return response ? response instanceof PublicKeyCredential ? { data: response, error: null } : {
+      data: null,
+      error: new WebAuthnUnknownError("Browser returned unexpected credential type", response)
+    } : {
+      data: null,
+      error: new WebAuthnUnknownError("Empty credential response", response)
+    };
+  } catch (err) {
+    return {
+      data: null,
+      error: identifyRegistrationError({
+        error: err,
+        options
+      })
+    };
+  }
+}
+async function getCredential(options) {
+  try {
+    let response = await navigator.credentials.get(
+      /** we assert the type here until typescript types are updated */
+      options
+    );
+    return response ? response instanceof PublicKeyCredential ? { data: response, error: null } : {
+      data: null,
+      error: new WebAuthnUnknownError("Browser returned unexpected credential type", response)
+    } : {
+      data: null,
+      error: new WebAuthnUnknownError("Empty credential response", response)
+    };
+  } catch (err) {
+    return {
+      data: null,
+      error: identifyAuthenticationError({
+        error: err,
+        options
+      })
+    };
+  }
+}
+var DEFAULT_CREATION_OPTIONS = {
+  hints: ["security-key"],
+  authenticatorSelection: {
+    authenticatorAttachment: "cross-platform",
+    requireResidentKey: !1,
+    /** set to preferred because older yubikeys don't have PIN/Biometric */
+    userVerification: "preferred",
+    residentKey: "discouraged"
+  },
+  attestation: "direct"
+}, DEFAULT_REQUEST_OPTIONS = {
+  /** set to preferred because older yubikeys don't have PIN/Biometric */
+  userVerification: "preferred",
+  hints: ["security-key"],
+  attestation: "direct"
+};
+function deepMerge(...sources) {
+  let isObject = (val) => val !== null && typeof val == "object" && !Array.isArray(val), isArrayBufferLike = (val) => val instanceof ArrayBuffer || ArrayBuffer.isView(val), result = {};
+  for (let source of sources)
+    if (source)
+      for (let key in source) {
+        let value = source[key];
+        if (value !== void 0)
+          if (Array.isArray(value))
+            result[key] = value;
+          else if (isArrayBufferLike(value))
+            result[key] = value;
+          else if (isObject(value)) {
+            let existing = result[key];
+            isObject(existing) ? result[key] = deepMerge(existing, value) : result[key] = deepMerge(value);
+          } else
+            result[key] = value;
+      }
+  return result;
+}
+function mergeCredentialCreationOptions(baseOptions, overrides) {
+  return deepMerge(DEFAULT_CREATION_OPTIONS, baseOptions, overrides || {});
+}
+function mergeCredentialRequestOptions(baseOptions, overrides) {
+  return deepMerge(DEFAULT_REQUEST_OPTIONS, baseOptions, overrides || {});
+}
+var WebAuthnApi = class {
+  constructor(client) {
+    this.client = client, this.enroll = this._enroll.bind(this), this.challenge = this._challenge.bind(this), this.verify = this._verify.bind(this), this.authenticate = this._authenticate.bind(this), this.register = this._register.bind(this);
+  }
+  async _enroll(params) {
+    return this.client.mfa.enroll(Object.assign(Object.assign({}, params), { factorType: "webauthn" }));
+  }
+  async _challenge({ factorId, webauthn, friendlyName, signal }, overrides) {
+    var _a;
+    try {
+      let { data: challengeResponse, error: challengeError } = await this.client.mfa.challenge({
+        factorId,
+        webauthn
+      });
+      if (!challengeResponse)
+        return { data: null, error: challengeError };
+      let abortSignal = signal ?? webAuthnAbortService.createNewAbortSignal();
+      if (challengeResponse.webauthn.type === "create") {
+        let { user } = challengeResponse.webauthn.credential_options.publicKey;
+        if (!user.name) {
+          let nameToUse = friendlyName;
+          if (nameToUse)
+            user.name = `${user.id}:${nameToUse}`;
+          else {
+            let userData = (await this.client.getUser()).data.user, fallbackName = ((_a = userData?.user_metadata) === null || _a === void 0 ? void 0 : _a.name) || userData?.email || userData?.id || "User";
+            user.name = `${user.id}:${fallbackName}`;
+          }
+        }
+        user.displayName || (user.displayName = user.name);
+      }
+      switch (challengeResponse.webauthn.type) {
+        case "create": {
+          let options = mergeCredentialCreationOptions(challengeResponse.webauthn.credential_options.publicKey, overrides?.create), { data, error } = await createCredential({
+            publicKey: options,
+            signal: abortSignal
+          });
+          return data ? {
+            data: {
+              factorId,
+              challengeId: challengeResponse.id,
+              webauthn: {
+                type: challengeResponse.webauthn.type,
+                credential_response: data
+              }
+            },
+            error: null
+          } : { data: null, error };
+        }
+        case "request": {
+          let options = mergeCredentialRequestOptions(challengeResponse.webauthn.credential_options.publicKey, overrides?.request), { data, error } = await getCredential(Object.assign(Object.assign({}, challengeResponse.webauthn.credential_options), { publicKey: options, signal: abortSignal }));
+          return data ? {
+            data: {
+              factorId,
+              challengeId: challengeResponse.id,
+              webauthn: {
+                type: challengeResponse.webauthn.type,
+                credential_response: data
+              }
+            },
+            error: null
+          } : { data: null, error };
+        }
+      }
+    } catch (error) {
+      return isAuthError(error) ? { data: null, error } : {
+        data: null,
+        error: new AuthUnknownError("Unexpected error in challenge", error)
+      };
+    }
+  }
+  /**
+   * Verify a WebAuthn credential with the server.
+   * Completes the WebAuthn ceremony by sending the credential to the server for verification.
+   *
+   * @experimental This method is experimental and may change in future releases
+   * @param {Object} params - Verification parameters
+   * @param {string} params.challengeId - ID of the challenge being verified
+   * @param {string} params.factorId - ID of the WebAuthn factor
+   * @param {MFAVerifyWebauthnParams<T>['webauthn']} params.webauthn - WebAuthn credential response
+   * @returns {Promise<AuthMFAVerifyResponse>} Verification result with session or error
+   * @see {@link https://w3c.github.io/webauthn/#sctn-verifying-assertion W3C WebAuthn Spec - Verifying an Authentication Assertion}
+   * */
+  async _verify({ challengeId, factorId, webauthn }) {
+    return this.client.mfa.verify({
+      factorId,
+      challengeId,
+      webauthn
+    });
+  }
+  async _authenticate({ factorId, webauthn: { rpId = typeof window < "u" ? window.location.hostname : void 0, rpOrigins = typeof window < "u" ? [window.location.origin] : void 0, signal } = {} }, overrides) {
+    if (!rpId)
+      return {
+        data: null,
+        error: new AuthError("rpId is required for WebAuthn authentication")
+      };
+    try {
+      if (!browserSupportsWebAuthn())
+        return {
+          data: null,
+          error: new AuthUnknownError("Browser does not support WebAuthn", null)
+        };
+      let { data: challengeResponse, error: challengeError } = await this.challenge({
+        factorId,
+        webauthn: { rpId, rpOrigins },
+        signal
+      }, { request: overrides });
+      if (!challengeResponse)
+        return { data: null, error: challengeError };
+      let { webauthn } = challengeResponse;
+      return this._verify({
+        factorId,
+        challengeId: challengeResponse.challengeId,
+        webauthn: {
+          type: webauthn.type,
+          rpId,
+          rpOrigins,
+          credential_response: webauthn.credential_response
+        }
+      });
+    } catch (error) {
+      return isAuthError(error) ? { data: null, error } : {
+        data: null,
+        error: new AuthUnknownError("Unexpected error in authenticate", error)
+      };
+    }
+  }
+  async _register({ friendlyName, webauthn: { rpId = typeof window < "u" ? window.location.hostname : void 0, rpOrigins = typeof window < "u" ? [window.location.origin] : void 0, signal } = {} }, overrides) {
+    if (!rpId)
+      return {
+        data: null,
+        error: new AuthError("rpId is required for WebAuthn registration")
+      };
+    try {
+      if (!browserSupportsWebAuthn())
+        return {
+          data: null,
+          error: new AuthUnknownError("Browser does not support WebAuthn", null)
+        };
+      let { data: factor, error: enrollError } = await this._enroll({
+        friendlyName
+      });
+      if (!factor)
+        return await this.client.mfa.listFactors().then((factors) => {
+          var _a;
+          return (_a = factors.data) === null || _a === void 0 ? void 0 : _a.all.find((v) => v.factor_type === "webauthn" && v.friendly_name === friendlyName && v.status === "unverified");
+        }).then((factor2) => factor2 ? this.client.mfa.unenroll({ factorId: factor2?.id }) : void 0), { data: null, error: enrollError };
+      let { data: challengeResponse, error: challengeError } = await this._challenge({
+        factorId: factor.id,
+        friendlyName: factor.friendly_name,
+        webauthn: { rpId, rpOrigins },
+        signal
+      }, {
+        create: overrides
+      });
+      return challengeResponse ? this._verify({
+        factorId: factor.id,
+        challengeId: challengeResponse.challengeId,
+        webauthn: {
+          rpId,
+          rpOrigins,
+          type: challengeResponse.webauthn.type,
+          credential_response: challengeResponse.webauthn.credential_response
+        }
+      }) : { data: null, error: challengeError };
+    } catch (error) {
+      return isAuthError(error) ? { data: null, error } : {
+        data: null,
+        error: new AuthUnknownError("Unexpected error in register", error)
+      };
+    }
+  }
+};
+
+polyfillGlobalThis();
+var DEFAULT_OPTIONS = {
+  url: GOTRUE_URL,
+  storageKey: STORAGE_KEY,
+  autoRefreshToken: !0,
+  persistSession: !0,
+  detectSessionInUrl: !0,
+  headers: DEFAULT_HEADERS,
+  flowType: "implicit",
+  debug: !1,
+  hasCustomAuthorizationHeader: !1,
+  throwOnError: !1,
+  lockAcquireTimeout: 5e3,
+  // 5 seconds. Only used when a custom `lock` is supplied. TODO(v3): remove.
+  skipAutoInitialize: !1,
+  experimental: {}
+};
+var GLOBAL_JWKS = {}, deprecatedLockWarned = !1, GoTrueClient = class _GoTrueClient {
+  get jwks() {
+    var _a, _b;
+    return (_b = (_a = GLOBAL_JWKS[this.storageKey]) === null || _a === void 0 ? void 0 : _a.jwks) !== null && _b !== void 0 ? _b : { keys: [] };
+  }
+  set jwks(value) {
+    GLOBAL_JWKS[this.storageKey] = Object.assign(Object.assign({}, GLOBAL_JWKS[this.storageKey]), { jwks: value });
+  }
+  get jwks_cached_at() {
+    var _a, _b;
+    return (_b = (_a = GLOBAL_JWKS[this.storageKey]) === null || _a === void 0 ? void 0 : _a.cachedAt) !== null && _b !== void 0 ? _b : Number.MIN_SAFE_INTEGER;
+  }
+  set jwks_cached_at(value) {
+    GLOBAL_JWKS[this.storageKey] = Object.assign(Object.assign({}, GLOBAL_JWKS[this.storageKey]), { cachedAt: value });
+  }
+  constructor(options) {
+    var _a, _b, _c;
+    this.userStorage = null, this.memoryStorage = null, this.stateChangeEmitters = /* @__PURE__ */ new Map(), this.autoRefreshTicker = null, this.autoRefreshTickTimeout = null, this.visibilityChangedCallback = null, this.refreshingDeferred = null, this.lastRefreshFailure = null, this._sessionRemovalEpoch = 0, this.initializePromise = null, this._pendingInitNotifications = null, this.detectSessionInUrl = !0, this.hasCustomAuthorizationHeader = !1, this.suppressGetSessionWarning = !1, this.lock = null, this.lockAcquired = !1, this.pendingInLock = [], this.broadcastChannel = null, this.logger = console.log;
+    let settings = Object.assign(Object.assign({}, DEFAULT_OPTIONS), options);
+    if (this.storageKey = settings.storageKey, this.instanceID = (_a = _GoTrueClient.nextInstanceID[this.storageKey]) !== null && _a !== void 0 ? _a : 0, _GoTrueClient.nextInstanceID[this.storageKey] = this.instanceID + 1, this.logDebugMessages = !!settings.debug, typeof settings.debug == "function" && (this.logger = settings.debug), this.instanceID > 0 && isBrowser()) {
+      let message = `${this._logPrefix()} Multiple GoTrueClient instances detected in the same browser context. It is not an error, but this should be avoided as it may produce undefined behavior when used concurrently under the same storage key.`;
+      console.warn(message), this.logDebugMessages && console.trace(message);
+    }
+    if (this.persistSession = settings.persistSession, this.autoRefreshToken = settings.autoRefreshToken, this.experimental = (_b = settings.experimental) !== null && _b !== void 0 ? _b : {}, this.admin = new GoTrueAdminApi({
+      url: settings.url,
+      headers: settings.headers,
+      fetch: settings.fetch,
+      experimental: this.experimental
+    }), this.url = settings.url, this.headers = settings.headers, this.fetch = resolveFetch(settings.fetch), this.detectSessionInUrl = settings.detectSessionInUrl, this.flowType = settings.flowType, this.hasCustomAuthorizationHeader = settings.hasCustomAuthorizationHeader, this.throwOnError = settings.throwOnError, this.lockAcquireTimeout = settings.lockAcquireTimeout, settings.lock != null && (this.lock = settings.lock, deprecatedLockWarned || (deprecatedLockWarned = !0, console.warn(`${this._logPrefix()} The "lock" option is deprecated and will be removed in v3. The client now coordinates session refreshes without a lock, so most apps can drop the option. See https://github.com/supabase/supabase-js/blob/master/packages/core/auth-js/migrations/lockless-coordination.md`))), this.jwks || (this.jwks = { keys: [] }, this.jwks_cached_at = Number.MIN_SAFE_INTEGER), this.mfa = {
+      verify: this._verify.bind(this),
+      enroll: this._enroll.bind(this),
+      unenroll: this._unenroll.bind(this),
+      challenge: this._challenge.bind(this),
+      listFactors: this._listFactors.bind(this),
+      challengeAndVerify: this._challengeAndVerify.bind(this),
+      getAuthenticatorAssuranceLevel: this._getAuthenticatorAssuranceLevel.bind(this),
+      webauthn: new WebAuthnApi(this),
+      recoveryCodes: {
+        getStatus: this._getRecoveryCodesStatus.bind(this),
+        generate: this._generateRecoveryCodes.bind(this),
+        verify: this._verifyRecoveryCode.bind(this),
+        regenerate: this._regenerateRecoveryCodes.bind(this),
+        unenroll: this._unenrollRecoveryCodes.bind(this)
+      }
+    }, this.oauth = {
+      getAuthorizationDetails: this._getAuthorizationDetails.bind(this),
+      approveAuthorization: this._approveAuthorization.bind(this),
+      denyAuthorization: this._denyAuthorization.bind(this),
+      listGrants: this._listOAuthGrants.bind(this),
+      revokeGrant: this._revokeOAuthGrant.bind(this)
+    }, this.passkey = {
+      startRegistration: this._startPasskeyRegistration.bind(this),
+      verifyRegistration: this._verifyPasskeyRegistration.bind(this),
+      startAuthentication: this._startPasskeyAuthentication.bind(this),
+      verifyAuthentication: this._verifyPasskeyAuthentication.bind(this),
+      list: this._listPasskeys.bind(this),
+      update: this._updatePasskey.bind(this),
+      delete: this._deletePasskey.bind(this)
+    }, this.persistSession ? (settings.storage ? this.storage = settings.storage : supportsLocalStorage() ? this.storage = globalThis.localStorage : (this.memoryStorage = {}, this.storage = memoryLocalStorageAdapter(this.memoryStorage)), settings.userStorage && (this.userStorage = settings.userStorage)) : (this.memoryStorage = {}, this.storage = memoryLocalStorageAdapter(this.memoryStorage)), isBrowser() && globalThis.BroadcastChannel && this.persistSession && this.storageKey) {
+      try {
+        this.broadcastChannel = new globalThis.BroadcastChannel(this.storageKey);
+      } catch (e) {
+        console.error("Failed to create a new BroadcastChannel, multi-tab state changes will not be available", e);
+      }
+      (_c = this.broadcastChannel) === null || _c === void 0 || _c.addEventListener("message", async (event) => {
+        this._debug("received broadcast notification from other tab or client", event), (event.data.event === "TOKEN_REFRESHED" || event.data.event === "SIGNED_IN") && (this.lastRefreshFailure = null);
+        try {
+          await this._notifyAllSubscribers(event.data.event, event.data.session, !1);
+        } catch (error) {
+          this._debug("#broadcastChannel", "error", error);
+        }
+      });
+    }
+    settings.skipAutoInitialize || this.initialize().catch((error) => {
+      this._debug("#initialize()", "error", error);
+    });
+  }
+  isThrowOnErrorEnabled() {
+    return this.throwOnError;
+  }
+  _returnResult(result) {
+    if (this.throwOnError && result && result.error)
+      throw result.error;
+    return result;
+  }
+  _logPrefix() {
+    return `GoTrueClient@${this.storageKey}:${this.instanceID} (${version}) ${(/* @__PURE__ */ new Date()).toISOString()}`;
+  }
+  _debug(...args) {
+    return this.logDebugMessages && this.logger(this._logPrefix(), ...args), this;
+  }
+  async initialize() {
+    var _a;
+    if (this.initializePromise)
+      return await this.initializePromise;
+    this._pendingInitNotifications = [], this.initializePromise = (async () => this.lock != null ? await this._acquireLock(this.lockAcquireTimeout, async () => await this._initialize()) : await this._initialize())();
+    let result = await this.initializePromise, queue = (_a = this._pendingInitNotifications) !== null && _a !== void 0 ? _a : [];
+    this._pendingInitNotifications = null;
+    for (let n of queue)
+      await this._notifyAllSubscribers(n.event, n.session, n.broadcast);
+    return result;
+  }
+  async _initialize() {
+    var _a;
+    try {
+      let params = {}, callbackUrlType = "none";
+      if (isBrowser() && (params = parseParametersFromURL(window.location.href), this._isImplicitGrantCallback(params) ? callbackUrlType = "implicit" : await this._isPKCECallback(params) && (callbackUrlType = "pkce")), isBrowser() && this.detectSessionInUrl && callbackUrlType !== "none") {
+        let { data, error } = await this._getSessionFromURL(params, callbackUrlType);
+        if (error) {
+          if (this._debug("#_initialize()", "error detecting session from URL", error), isAuthImplicitGrantRedirectError(error)) {
+            let errorCode = (_a = error.details) === null || _a === void 0 ? void 0 : _a.code;
+            if (errorCode === "identity_already_exists" || errorCode === "identity_not_found" || errorCode === "single_identity_not_deletable")
+              return { error };
+          }
+          return { error };
+        }
+        let { session, redirectType } = data;
+        return this._debug("#_initialize()", "detected session in URL", session, "redirect type", redirectType), await this._saveSession(session), setTimeout(async () => {
+          redirectType === "recovery" ? await this._notifyAllSubscribers("PASSWORD_RECOVERY", session) : await this._notifyAllSubscribers("SIGNED_IN", session);
+        }, 0), { error: null };
+      }
+      return await this._recoverAndRefresh(), { error: null };
+    } catch (error) {
+      return isAuthError(error) ? this._returnResult({ error }) : this._returnResult({
+        error: new AuthUnknownError("Unexpected error during initialization", error)
+      });
+    } finally {
+      await this._handleVisibilityChange(), this._debug("#_initialize()", "end");
+    }
+  }
+  async signInAnonymously(credentials) {
+    var _a, _b, _c;
+    try {
+      let res = await _request(this.fetch, "POST", `${this.url}/signup`, {
+        headers: this.headers,
+        body: {
+          data: (_b = (_a = credentials?.options) === null || _a === void 0 ? void 0 : _a.data) !== null && _b !== void 0 ? _b : {},
+          gotrue_meta_security: { captcha_token: (_c = credentials?.options) === null || _c === void 0 ? void 0 : _c.captchaToken }
+        },
+        xform: _sessionResponse
+      }), { data, error } = res;
+      if (error || !data)
+        return this._returnResult({ data: { user: null, session: null }, error });
+      let session = data.session, user = data.user;
+      return data.session && (await this._saveSession(data.session), await this._notifyAllSubscribers("SIGNED_IN", session)), this._returnResult({ data: { user, session }, error: null });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: { user: null, session: null }, error });
+      throw error;
+    }
+  }
+  async signUp(credentials) {
+    var _a, _b, _c;
+    let flowId = null;
+    try {
+      let res;
+      if ("email" in credentials) {
+        let { email, password, options } = credentials, codeChallenge = null, codeChallengeMethod = null;
+        this.flowType === "pkce" && ([codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod()), res = await _request(this.fetch, "POST", `${this.url}/signup`, {
+          headers: this.headers,
+          redirectTo: this._maybeAppendFlowIdToRedirect(options?.emailRedirectTo, flowId),
+          body: {
+            email,
+            password,
+            data: (_a = options?.data) !== null && _a !== void 0 ? _a : {},
+            gotrue_meta_security: { captcha_token: options?.captchaToken },
+            code_challenge: codeChallenge,
+            code_challenge_method: codeChallengeMethod
+          },
+          xform: _sessionResponse
+        });
+      } else if ("phone" in credentials) {
+        let { phone, password, options } = credentials;
+        res = await _request(this.fetch, "POST", `${this.url}/signup`, {
+          headers: this.headers,
+          body: {
+            phone,
+            password,
+            data: (_b = options?.data) !== null && _b !== void 0 ? _b : {},
+            channel: (_c = options?.channel) !== null && _c !== void 0 ? _c : "sms",
+            gotrue_meta_security: { captcha_token: options?.captchaToken }
+          },
+          xform: _sessionResponse
+        });
+      } else
+        throw new AuthInvalidCredentialsError("You must provide either an email or phone number and a password");
+      let { data, error } = res;
+      if (error || !data)
+        return await removePKCEVerifier(this.storage, this.storageKey, flowId), this._returnResult({ data: { user: null, session: null }, error });
+      let session = data.session, user = data.user;
+      return data.session && (await this._saveSession(data.session), await this._notifyAllSubscribers("SIGNED_IN", session)), this._returnResult({ data: { user, session }, error: null });
+    } catch (error) {
+      if (await removePKCEVerifier(this.storage, this.storageKey, flowId), isAuthError(error))
+        return this._returnResult({ data: { user: null, session: null }, error });
+      throw error;
+    }
+  }
+  async signInWithPassword(credentials) {
+    try {
+      let res;
+      if ("email" in credentials) {
+        let { email, password, options } = credentials;
+        res = await _request(this.fetch, "POST", `${this.url}/token?grant_type=password`, {
+          headers: this.headers,
+          body: {
+            email,
+            password,
+            gotrue_meta_security: { captcha_token: options?.captchaToken }
+          },
+          xform: _sessionResponsePassword
+        });
+      } else if ("phone" in credentials) {
+        let { phone, password, options } = credentials;
+        res = await _request(this.fetch, "POST", `${this.url}/token?grant_type=password`, {
+          headers: this.headers,
+          body: {
+            phone,
+            password,
+            gotrue_meta_security: { captcha_token: options?.captchaToken }
+          },
+          xform: _sessionResponsePassword
+        });
+      } else
+        throw new AuthInvalidCredentialsError("You must provide either an email or phone number and a password");
+      let { data, error } = res;
+      if (error)
+        return this._returnResult({ data: { user: null, session: null }, error });
+      if (!data || !data.session || !data.user) {
+        let invalidTokenError = new AuthInvalidTokenResponseError();
+        return this._returnResult({ data: { user: null, session: null }, error: invalidTokenError });
+      }
+      return data.session && (await this._saveSession(data.session), await this._notifyAllSubscribers("SIGNED_IN", data.session)), this._returnResult({
+        data: Object.assign({ user: data.user, session: data.session }, data.weak_password ? { weakPassword: data.weak_password } : null),
+        error
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: { user: null, session: null }, error });
+      throw error;
+    }
+  }
+  async signInWithOAuth(credentials) {
+    var _a, _b, _c, _d;
+    return await this._handleProviderSignIn(credentials.provider, {
+      redirectTo: (_a = credentials.options) === null || _a === void 0 ? void 0 : _a.redirectTo,
+      scopes: (_b = credentials.options) === null || _b === void 0 ? void 0 : _b.scopes,
+      queryParams: (_c = credentials.options) === null || _c === void 0 ? void 0 : _c.queryParams,
+      skipBrowserRedirect: (_d = credentials.options) === null || _d === void 0 ? void 0 : _d.skipBrowserRedirect
+    });
+  }
+  async exchangeCodeForSession(authCode, options) {
+    return await this.initializePromise, this.lock != null ? this._acquireLock(this.lockAcquireTimeout, async () => this._exchangeCodeForSession(authCode, options)) : this._exchangeCodeForSession(authCode, options);
+  }
+  async signInWithWeb3(credentials) {
+    let { chain } = credentials;
+    switch (chain) {
+      case "ethereum":
+        return await this.signInWithEthereum(credentials);
+      case "solana":
+        return await this.signInWithSolana(credentials);
+      default:
+        throw new Error(`@supabase/auth-js: Unsupported chain "${chain}"`);
+    }
+  }
+  async signInWithEthereum(credentials) {
+    var _a, _b, _c, _d, _f, _g, _h, _j, _k, _l, _m;
+    let message, signature;
+    if ("message" in credentials)
+      message = credentials.message, signature = credentials.signature;
+    else {
+      let { chain, wallet, statement, options } = credentials, resolvedWallet;
+      if (isBrowser())
+        if (typeof wallet == "object")
+          resolvedWallet = wallet;
+        else {
+          let windowAny = window;
+          if ("ethereum" in windowAny && typeof windowAny.ethereum == "object" && "request" in windowAny.ethereum && typeof windowAny.ethereum.request == "function")
+            resolvedWallet = windowAny.ethereum;
+          else
+            throw new Error("@supabase/auth-js: No compatible Ethereum wallet interface on the window object (window.ethereum) detected. Make sure the user already has a wallet installed and connected for this app. Prefer passing the wallet interface object directly to signInWithWeb3({ chain: 'ethereum', wallet: resolvedUserWallet }) instead.");
+        }
+      else {
+        if (typeof wallet != "object" || !options?.url)
+          throw new Error("@supabase/auth-js: Both wallet and url must be specified in non-browser environments.");
+        resolvedWallet = wallet;
+      }
+      let url = new URL((_a = options?.url) !== null && _a !== void 0 ? _a : window.location.href), accounts = await resolvedWallet.request({
+        method: "eth_requestAccounts"
+      }).then((accs) => accs).catch(() => {
+        throw new Error("@supabase/auth-js: Wallet method eth_requestAccounts is missing or invalid");
+      });
+      if (!accounts || accounts.length === 0)
+        throw new Error("@supabase/auth-js: No accounts available. Please ensure the wallet is connected.");
+      let address = getAddress(accounts[0]), chainId = (_b = options?.signInWithEthereum) === null || _b === void 0 ? void 0 : _b.chainId;
+      if (!chainId) {
+        let chainIdHex = await resolvedWallet.request({
+          method: "eth_chainId"
+        });
+        chainId = fromHex(chainIdHex);
+      }
+      let siweMessage = {
+        domain: url.host,
+        address,
+        statement,
+        uri: url.href,
+        version: "1",
+        chainId,
+        nonce: (_c = options?.signInWithEthereum) === null || _c === void 0 ? void 0 : _c.nonce,
+        issuedAt: (_f = (_d = options?.signInWithEthereum) === null || _d === void 0 ? void 0 : _d.issuedAt) !== null && _f !== void 0 ? _f : /* @__PURE__ */ new Date(),
+        expirationTime: (_g = options?.signInWithEthereum) === null || _g === void 0 ? void 0 : _g.expirationTime,
+        notBefore: (_h = options?.signInWithEthereum) === null || _h === void 0 ? void 0 : _h.notBefore,
+        requestId: (_j = options?.signInWithEthereum) === null || _j === void 0 ? void 0 : _j.requestId,
+        resources: (_k = options?.signInWithEthereum) === null || _k === void 0 ? void 0 : _k.resources
+      };
+      message = createSiweMessage(siweMessage), signature = await resolvedWallet.request({
+        method: "personal_sign",
+        params: [toHex(message), address]
+      });
+    }
+    try {
+      let { data, error } = await _request(this.fetch, "POST", `${this.url}/token?grant_type=web3`, {
+        headers: this.headers,
+        body: Object.assign({
+          chain: "ethereum",
+          message,
+          signature
+        }, !((_l = credentials.options) === null || _l === void 0) && _l.captchaToken ? { gotrue_meta_security: { captcha_token: (_m = credentials.options) === null || _m === void 0 ? void 0 : _m.captchaToken } } : null),
+        xform: _sessionResponse
+      });
+      if (error)
+        throw error;
+      if (!data || !data.session || !data.user) {
+        let invalidTokenError = new AuthInvalidTokenResponseError();
+        return this._returnResult({ data: { user: null, session: null }, error: invalidTokenError });
+      }
+      return data.session && (await this._saveSession(data.session), await this._notifyAllSubscribers("SIGNED_IN", data.session)), this._returnResult({ data: Object.assign({}, data), error });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: { user: null, session: null }, error });
+      throw error;
+    }
+  }
+  async signInWithSolana(credentials) {
+    var _a, _b, _c, _d, _f, _g, _h, _j, _k, _l, _m, _o;
+    let message, signature;
+    if ("message" in credentials)
+      message = credentials.message, signature = credentials.signature;
+    else {
+      let { chain, wallet, statement, options } = credentials, resolvedWallet;
+      if (isBrowser())
+        if (typeof wallet == "object")
+          resolvedWallet = wallet;
+        else {
+          let windowAny = window;
+          if ("solana" in windowAny && typeof windowAny.solana == "object" && ("signIn" in windowAny.solana && typeof windowAny.solana.signIn == "function" || "signMessage" in windowAny.solana && typeof windowAny.solana.signMessage == "function"))
+            resolvedWallet = windowAny.solana;
+          else
+            throw new Error("@supabase/auth-js: No compatible Solana wallet interface on the window object (window.solana) detected. Make sure the user already has a wallet installed and connected for this app. Prefer passing the wallet interface object directly to signInWithWeb3({ chain: 'solana', wallet: resolvedUserWallet }) instead.");
+        }
+      else {
+        if (typeof wallet != "object" || !options?.url)
+          throw new Error("@supabase/auth-js: Both wallet and url must be specified in non-browser environments.");
+        resolvedWallet = wallet;
+      }
+      let url = new URL((_a = options?.url) !== null && _a !== void 0 ? _a : window.location.href);
+      if ("signIn" in resolvedWallet && resolvedWallet.signIn) {
+        let output = await resolvedWallet.signIn(Object.assign(Object.assign(Object.assign({ issuedAt: (/* @__PURE__ */ new Date()).toISOString() }, options?.signInWithSolana), {
+          // non-overridable properties
+          version: "1",
+          domain: url.host,
+          uri: url.href
+        }), statement ? { statement } : null)), outputToProcess;
+        if (Array.isArray(output) && output[0] && typeof output[0] == "object")
+          outputToProcess = output[0];
+        else if (output && typeof output == "object" && "signedMessage" in output && "signature" in output)
+          outputToProcess = output;
+        else
+          throw new Error("@supabase/auth-js: Wallet method signIn() returned unrecognized value");
+        if ("signedMessage" in outputToProcess && "signature" in outputToProcess && (typeof outputToProcess.signedMessage == "string" || outputToProcess.signedMessage instanceof Uint8Array) && outputToProcess.signature instanceof Uint8Array)
+          message = typeof outputToProcess.signedMessage == "string" ? outputToProcess.signedMessage : new TextDecoder().decode(outputToProcess.signedMessage), signature = outputToProcess.signature;
+        else
+          throw new Error("@supabase/auth-js: Wallet method signIn() API returned object without signedMessage and signature fields");
+      } else {
+        if (!("signMessage" in resolvedWallet) || typeof resolvedWallet.signMessage != "function" || !("publicKey" in resolvedWallet) || typeof resolvedWallet != "object" || !resolvedWallet.publicKey || !("toBase58" in resolvedWallet.publicKey) || typeof resolvedWallet.publicKey.toBase58 != "function")
+          throw new Error("@supabase/auth-js: Wallet does not have a compatible signMessage() and publicKey.toBase58() API");
+        message = [
+          `${url.host} wants you to sign in with your Solana account:`,
+          resolvedWallet.publicKey.toBase58(),
+          ...statement ? ["", statement, ""] : [""],
+          "Version: 1",
+          `URI: ${url.href}`,
+          `Issued At: ${(_c = (_b = options?.signInWithSolana) === null || _b === void 0 ? void 0 : _b.issuedAt) !== null && _c !== void 0 ? _c : (/* @__PURE__ */ new Date()).toISOString()}`,
+          ...!((_d = options?.signInWithSolana) === null || _d === void 0) && _d.notBefore ? [`Not Before: ${options.signInWithSolana.notBefore}`] : [],
+          ...!((_f = options?.signInWithSolana) === null || _f === void 0) && _f.expirationTime ? [`Expiration Time: ${options.signInWithSolana.expirationTime}`] : [],
+          ...!((_g = options?.signInWithSolana) === null || _g === void 0) && _g.chainId ? [`Chain ID: ${options.signInWithSolana.chainId}`] : [],
+          ...!((_h = options?.signInWithSolana) === null || _h === void 0) && _h.nonce ? [`Nonce: ${options.signInWithSolana.nonce}`] : [],
+          ...!((_j = options?.signInWithSolana) === null || _j === void 0) && _j.requestId ? [`Request ID: ${options.signInWithSolana.requestId}`] : [],
+          ...!((_l = (_k = options?.signInWithSolana) === null || _k === void 0 ? void 0 : _k.resources) === null || _l === void 0) && _l.length ? [
+            "Resources",
+            ...options.signInWithSolana.resources.map((resource) => `- ${resource}`)
+          ] : []
+        ].join(`
+`);
+        let maybeSignature = await resolvedWallet.signMessage(new TextEncoder().encode(message), "utf8");
+        if (!maybeSignature || !(maybeSignature instanceof Uint8Array))
+          throw new Error("@supabase/auth-js: Wallet signMessage() API returned an recognized value");
+        signature = maybeSignature;
+      }
+    }
+    try {
+      let { data, error } = await _request(this.fetch, "POST", `${this.url}/token?grant_type=web3`, {
+        headers: this.headers,
+        body: Object.assign({ chain: "solana", message, signature: bytesToBase64URL(signature) }, !((_m = credentials.options) === null || _m === void 0) && _m.captchaToken ? { gotrue_meta_security: { captcha_token: (_o = credentials.options) === null || _o === void 0 ? void 0 : _o.captchaToken } } : null),
+        xform: _sessionResponse
+      });
+      if (error)
+        throw error;
+      if (!data || !data.session || !data.user) {
+        let invalidTokenError = new AuthInvalidTokenResponseError();
+        return this._returnResult({ data: { user: null, session: null }, error: invalidTokenError });
+      }
+      return data.session && (await this._saveSession(data.session), await this._notifyAllSubscribers("SIGNED_IN", data.session)), this._returnResult({ data: Object.assign({}, data), error });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: { user: null, session: null }, error });
+      throw error;
+    }
+  }
+  async _exchangeCodeForSession(authCode, options) {
+    let hasExplicitFlowId = options?.flowId != null, requestedFlowId = hasExplicitFlowId ? validatePKCEFlowId(options?.flowId) : isBrowser() ? validatePKCEFlowId(parseParametersFromURL(window.location.href)[PKCE_FLOW_ID_PARAM]) : null;
+    hasExplicitFlowId && !requestedFlowId && this._debug("#_exchangeCodeForSession()", "provided flowId is not a valid flow id", options?.flowId);
+    let { verifier: storageItem, flowId } = hasExplicitFlowId && !requestedFlowId ? { verifier: null, flowId: null } : await retrievePKCEVerifier(this.storage, this.storageKey, requestedFlowId), [codeVerifier, redirectType] = (storageItem ?? "").split("/");
+    try {
+      if (!codeVerifier && this.flowType === "pkce")
+        throw new AuthPKCECodeVerifierMissingError();
+      let { data, error } = await _request(this.fetch, "POST", `${this.url}/token?grant_type=pkce`, {
+        headers: this.headers,
+        body: {
+          auth_code: authCode,
+          code_verifier: codeVerifier
+        },
+        xform: _sessionResponse
+      });
+      if (await removePKCEVerifier(this.storage, this.storageKey, flowId), error)
+        throw error;
+      if (!data || !data.session || !data.user) {
+        let invalidTokenError = new AuthInvalidTokenResponseError();
+        return this._returnResult({
+          data: { user: null, session: null, redirectType: null },
+          error: invalidTokenError
+        });
+      }
+      return data.session && (await this._saveSession(data.session), await this._notifyAllSubscribers(redirectType === "recovery" ? "PASSWORD_RECOVERY" : "SIGNED_IN", data.session)), this._returnResult({ data: Object.assign(Object.assign({}, data), { redirectType: redirectType ?? null }), error });
+    } catch (error) {
+      if (await removePKCEVerifier(this.storage, this.storageKey, flowId), isAuthError(error))
+        return this._returnResult({
+          data: { user: null, session: null, redirectType: null },
+          error
+        });
+      throw error;
+    }
+  }
+  async signInWithIdToken(credentials) {
+    try {
+      let { options, provider, token, access_token, nonce } = credentials, res = await _request(this.fetch, "POST", `${this.url}/token?grant_type=id_token`, {
+        headers: this.headers,
+        body: {
+          provider,
+          id_token: token,
+          access_token,
+          nonce,
+          gotrue_meta_security: { captcha_token: options?.captchaToken }
+        },
+        xform: _sessionResponse
+      }), { data, error } = res;
+      if (error)
+        return this._returnResult({ data: { user: null, session: null }, error });
+      if (!data || !data.session || !data.user) {
+        let invalidTokenError = new AuthInvalidTokenResponseError();
+        return this._returnResult({ data: { user: null, session: null }, error: invalidTokenError });
+      }
+      return data.session && (await this._saveSession(data.session), await this._notifyAllSubscribers("SIGNED_IN", data.session)), this._returnResult({ data, error });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: { user: null, session: null }, error });
+      throw error;
+    }
+  }
+  async signInWithOtp(credentials) {
+    var _a, _b, _c, _d, _f;
+    let flowId = null;
+    try {
+      if ("email" in credentials) {
+        let { email, options } = credentials, codeChallenge = null, codeChallengeMethod = null;
+        this.flowType === "pkce" && ([codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod());
+        let { error } = await _request(this.fetch, "POST", `${this.url}/otp`, {
+          headers: this.headers,
+          body: {
+            email,
+            data: (_a = options?.data) !== null && _a !== void 0 ? _a : {},
+            create_user: (_b = options?.shouldCreateUser) !== null && _b !== void 0 ? _b : !0,
+            gotrue_meta_security: { captcha_token: options?.captchaToken },
+            code_challenge: codeChallenge,
+            code_challenge_method: codeChallengeMethod
+          },
+          redirectTo: this._maybeAppendFlowIdToRedirect(options?.emailRedirectTo, flowId)
+        });
+        return this._returnResult({ data: { user: null, session: null }, error });
+      }
+      if ("phone" in credentials) {
+        let { phone, options } = credentials, { data, error } = await _request(this.fetch, "POST", `${this.url}/otp`, {
+          headers: this.headers,
+          body: {
+            phone,
+            data: (_c = options?.data) !== null && _c !== void 0 ? _c : {},
+            create_user: (_d = options?.shouldCreateUser) !== null && _d !== void 0 ? _d : !0,
+            gotrue_meta_security: { captcha_token: options?.captchaToken },
+            channel: (_f = options?.channel) !== null && _f !== void 0 ? _f : "sms"
+          }
+        });
+        return this._returnResult({
+          data: { user: null, session: null, messageId: data?.message_id },
+          error
+        });
+      }
+      throw new AuthInvalidCredentialsError("You must provide either an email or phone number.");
+    } catch (error) {
+      if (await removePKCEVerifier(this.storage, this.storageKey, flowId), isAuthError(error))
+        return this._returnResult({ data: { user: null, session: null }, error });
+      throw error;
+    }
+  }
+  async verifyOtp(params) {
+    var _a, _b;
+    try {
+      let redirectTo, captchaToken;
+      "options" in params && (redirectTo = (_a = params.options) === null || _a === void 0 ? void 0 : _a.redirectTo, captchaToken = (_b = params.options) === null || _b === void 0 ? void 0 : _b.captchaToken);
+      let { data, error } = await _request(this.fetch, "POST", `${this.url}/verify`, {
+        headers: this.headers,
+        body: Object.assign(Object.assign({}, params), { gotrue_meta_security: { captcha_token: captchaToken } }),
+        redirectTo,
+        xform: _sessionResponse
+      });
+      if (error)
+        throw error;
+      if (!data)
+        throw new Error("An error occurred on token verification.");
+      let session = data.session, user = data.user;
+      return session?.access_token && (await this._saveSession(session), await this._notifyAllSubscribers(params.type == "recovery" ? "PASSWORD_RECOVERY" : "SIGNED_IN", session)), this._returnResult({ data: { user, session }, error: null });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: { user: null, session: null }, error });
+      throw error;
+    }
+  }
+  async signInWithSSO(params) {
+    var _a, _b, _c, _d;
+    let flowId = null;
+    try {
+      let codeChallenge = null, codeChallengeMethod = null;
+      this.flowType === "pkce" && ([codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod());
+      let result = await _request(this.fetch, "POST", `${this.url}/sso`, {
+        body: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, "providerId" in params ? { provider_id: params.providerId } : null), "domain" in params ? { domain: params.domain } : null), { redirect_to: this._maybeAppendFlowIdToRedirect((_a = params.options) === null || _a === void 0 ? void 0 : _a.redirectTo, flowId) }), !((_b = params?.options) === null || _b === void 0) && _b.captchaToken ? { gotrue_meta_security: { captcha_token: params.options.captchaToken } } : null), { skip_http_redirect: !0, code_challenge: codeChallenge, code_challenge_method: codeChallengeMethod }),
+        headers: this.headers,
+        xform: _ssoResponse
+      });
+      return !((_c = result.data) === null || _c === void 0) && _c.url && isBrowser() && !(!((_d = params.options) === null || _d === void 0) && _d.skipBrowserRedirect) && window.location.assign(result.data.url), this._returnResult(result);
+    } catch (error) {
+      if (await removePKCEVerifier(this.storage, this.storageKey, flowId), isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async reauthenticate() {
+    return await this.initializePromise, this.lock != null ? await this._acquireLock(this.lockAcquireTimeout, async () => await this._reauthenticate()) : await this._reauthenticate();
+  }
+  async _reauthenticate() {
+    try {
+      return await this._useSession(async (result) => {
+        let { data: { session }, error: sessionError } = result;
+        if (sessionError)
+          throw sessionError;
+        if (!session)
+          throw new AuthSessionMissingError();
+        let { error } = await _request(this.fetch, "GET", `${this.url}/reauthenticate`, {
+          headers: this.headers,
+          jwt: session.access_token
+        });
+        return this._returnResult({ data: { user: null, session: null }, error });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: { user: null, session: null }, error });
+      throw error;
+    }
+  }
+  async resend(credentials) {
+    let flowId = null;
+    try {
+      let endpoint = `${this.url}/resend`;
+      if ("email" in credentials) {
+        let { email, type, options } = credentials, codeChallenge = null, codeChallengeMethod = null;
+        this.flowType === "pkce" && ([codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod());
+        let { error } = await _request(this.fetch, "POST", endpoint, {
+          headers: this.headers,
+          body: {
+            email,
+            type,
+            gotrue_meta_security: { captcha_token: options?.captchaToken },
+            code_challenge: codeChallenge,
+            code_challenge_method: codeChallengeMethod
+          },
+          redirectTo: this._maybeAppendFlowIdToRedirect(options?.emailRedirectTo, flowId)
+        });
+        return error && await removePKCEVerifier(this.storage, this.storageKey, flowId), this._returnResult({ data: { user: null, session: null }, error });
+      } else if ("phone" in credentials) {
+        let { phone, type, options } = credentials, { data, error } = await _request(this.fetch, "POST", endpoint, {
+          headers: this.headers,
+          body: {
+            phone,
+            type,
+            gotrue_meta_security: { captcha_token: options?.captchaToken }
+          }
+        });
+        return this._returnResult({
+          data: { user: null, session: null, messageId: data?.message_id },
+          error
+        });
+      }
+      throw new AuthInvalidCredentialsError("You must provide either an email or phone number and a type");
+    } catch (error) {
+      if (await removePKCEVerifier(this.storage, this.storageKey, flowId), isAuthError(error))
+        return this._returnResult({ data: { user: null, session: null }, error });
+      throw error;
+    }
+  }
+  async getSession() {
+    return await this.initializePromise, this.lock != null ? await this._acquireLock(this.lockAcquireTimeout, async () => this._useSession(async (result) => result)) : await this._useSession(async (result) => result);
+  }
+  async _acquireLock(acquireTimeout, fn) {
+    this._debug("#_acquireLock", "begin", acquireTimeout);
+    try {
+      if (this.lockAcquired) {
+        let last = this.pendingInLock.length ? this.pendingInLock[this.pendingInLock.length - 1] : Promise.resolve(), result = (async () => (await last, await fn()))();
+        return this.pendingInLock.push((async () => {
+          try {
+            await result;
+          } catch {
+          }
+        })()), result;
+      }
+      return await this.lock(`lock:${this.storageKey}`, acquireTimeout, async () => {
+        this._debug("#_acquireLock", "lock acquired for storage key", this.storageKey);
+        try {
+          this.lockAcquired = !0;
+          let result = fn();
+          for (this.pendingInLock.push((async () => {
+            try {
+              await result;
+            } catch {
+            }
+          })()), await result; this.pendingInLock.length; ) {
+            let waitOn = [...this.pendingInLock];
+            await Promise.all(waitOn), this.pendingInLock.splice(0, waitOn.length);
+          }
+          return await result;
+        } finally {
+          this._debug("#_acquireLock", "lock released for storage key", this.storageKey), this.lockAcquired = !1;
+        }
+      });
+    } finally {
+      this._debug("#_acquireLock", "end");
+    }
+  }
+  async _useSession(fn) {
+    this._debug("#_useSession", "begin");
+    try {
+      let result = await this.__loadSession();
+      return await fn(result);
+    } finally {
+      this._debug("#_useSession", "end");
+    }
+  }
+  async __loadSession() {
+    this._debug("#__loadSession()", "begin"), this.lock != null && !this.lockAcquired && this._debug("#__loadSession()", "used outside of an acquired lock!", new Error().stack);
+    try {
+      let currentSession = null, maybeSession = await getItemAsync(this.storage, this.storageKey);
+      if (this._debug("#getSession()", "session from storage", maybeSession), maybeSession !== null && (this._isValidSession(maybeSession) ? currentSession = maybeSession : (this._debug("#getSession()", "session from storage is not valid"), await this._removeSession())), !currentSession)
+        return { data: { session: null }, error: null };
+      let hasExpired = currentSession.expires_at ? currentSession.expires_at * 1e3 - Date.now() < EXPIRY_MARGIN_MS : !1;
+      if (this._debug("#__loadSession()", `session has${hasExpired ? "" : " not"} expired`, "expires_at", currentSession.expires_at), !hasExpired) {
+        if (this.userStorage) {
+          let maybeUser = await getItemAsync(this.userStorage, this.storageKey + "-user");
+          maybeUser?.user ? currentSession.user = maybeUser.user : currentSession.user = userNotAvailableProxy();
+        }
+        if (this.storage.isServer && currentSession.user && !currentSession.user.__isUserNotAvailableProxy) {
+          let suppressWarningRef = { value: this.suppressGetSessionWarning };
+          currentSession.user = insecureUserWarningProxy(currentSession.user, suppressWarningRef), suppressWarningRef.value && (this.suppressGetSessionWarning = !0);
+        }
+        return { data: { session: currentSession }, error: null };
+      }
+      let { data: session, error } = await this._callRefreshToken(currentSession.refresh_token);
+      if (error) {
+        if (!!(currentSession.expires_at && currentSession.expires_at * 1e3 > Date.now())) {
+          let stillStored = await getItemAsync(this.storage, this.storageKey);
+          if (stillStored && stillStored.refresh_token === currentSession.refresh_token)
+            return this._returnResult({ data: { session: currentSession }, error: null });
+        }
+        return this._returnResult({ data: { session: null }, error });
+      }
+      return this._returnResult({ data: { session }, error: null });
+    } finally {
+      this._debug("#__loadSession()", "end");
+    }
+  }
+  async getUser(jwt) {
+    if (jwt)
+      return await this._getUser(jwt);
+    await this.initializePromise;
+    let result;
+    return this.lock != null ? result = await this._acquireLock(this.lockAcquireTimeout, async () => await this._getUser()) : result = await this._getUser(), result.data.user && (this.suppressGetSessionWarning = !0), result;
+  }
+  async _getUser(jwt) {
+    try {
+      return jwt ? await _request(this.fetch, "GET", `${this.url}/user`, {
+        headers: this.headers,
+        jwt,
+        xform: _userResponse
+      }) : await this._useSession(async (result) => {
+        var _a, _b, _c;
+        let { data, error } = result;
+        if (error)
+          throw error;
+        return !(!((_a = data.session) === null || _a === void 0) && _a.access_token) && !this.hasCustomAuthorizationHeader ? { data: { user: null }, error: new AuthSessionMissingError() } : await _request(this.fetch, "GET", `${this.url}/user`, {
+          headers: this.headers,
+          jwt: (_c = (_b = data.session) === null || _b === void 0 ? void 0 : _b.access_token) !== null && _c !== void 0 ? _c : void 0,
+          xform: _userResponse
+        });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return isAuthSessionMissingError(error) && await this._removeSession(), this._returnResult({ data: { user: null }, error });
+      throw error;
+    }
+  }
+  async updateUser(attributes, options = {}) {
+    return await this.initializePromise, this.lock != null ? await this._acquireLock(this.lockAcquireTimeout, async () => await this._updateUser(attributes, options)) : await this._updateUser(attributes, options);
+  }
+  async _updateUser(attributes, options = {}) {
+    let flowId = null;
+    try {
+      return await this._useSession(async (result) => {
+        let { data: sessionData, error: sessionError } = result;
+        if (sessionError)
+          throw sessionError;
+        if (!sessionData.session)
+          throw new AuthSessionMissingError();
+        let session = sessionData.session, codeChallenge = null, codeChallengeMethod = null;
+        this.flowType === "pkce" && attributes.email != null && ([codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod());
+        let { data, error: userError } = await _request(this.fetch, "PUT", `${this.url}/user`, {
+          headers: this.headers,
+          redirectTo: this._maybeAppendFlowIdToRedirect(options?.emailRedirectTo, flowId),
+          body: Object.assign(Object.assign({}, attributes), { code_challenge: codeChallenge, code_challenge_method: codeChallengeMethod }),
+          jwt: session.access_token,
+          xform: _userResponse
+        });
+        if (userError)
+          throw userError;
+        return session.user = data.user, await this._saveSession(session), await this._notifyAllSubscribers("USER_UPDATED", session), this._returnResult({ data: { user: session.user }, error: null });
+      });
+    } catch (error) {
+      if (await removePKCEVerifier(this.storage, this.storageKey, flowId), isAuthError(error))
+        return this._returnResult({ data: { user: null }, error });
+      throw error;
+    }
+  }
+  async setSession(currentSession) {
+    return await this.initializePromise, this.lock != null ? await this._acquireLock(this.lockAcquireTimeout, async () => await this._setSession(currentSession)) : await this._setSession(currentSession);
+  }
+  async _setSession(currentSession) {
+    try {
+      if (!currentSession.access_token || !currentSession.refresh_token)
+        throw new AuthSessionMissingError();
+      let timeNow = Date.now() / 1e3, expiresAt2 = timeNow, hasExpired = !0, session = null, { payload } = decodeJWT(currentSession.access_token);
+      if (payload.exp && (expiresAt2 = payload.exp, hasExpired = expiresAt2 <= timeNow), hasExpired) {
+        let { data: refreshedSession, error } = await this._callRefreshToken(currentSession.refresh_token);
+        if (error)
+          return this._returnResult({ data: { user: null, session: null }, error });
+        if (!refreshedSession)
+          return { data: { user: null, session: null }, error: null };
+        session = refreshedSession;
+      } else {
+        let { data, error } = await this._getUser(currentSession.access_token);
+        if (error)
+          return this._returnResult({ data: { user: null, session: null }, error });
+        session = {
+          access_token: currentSession.access_token,
+          refresh_token: currentSession.refresh_token,
+          user: data.user,
+          token_type: "bearer",
+          expires_in: expiresAt2 - timeNow,
+          expires_at: expiresAt2
+        }, await this._saveSession(session), await this._notifyAllSubscribers("SIGNED_IN", session);
+      }
+      return this._returnResult({ data: { user: session.user, session }, error: null });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: { session: null, user: null }, error });
+      throw error;
+    }
+  }
+  async refreshSession(currentSession) {
+    return await this.initializePromise, this.lock != null ? await this._acquireLock(this.lockAcquireTimeout, async () => await this._refreshSession(currentSession)) : await this._refreshSession(currentSession);
+  }
+  async _refreshSession(currentSession) {
+    try {
+      return await this._useSession(async (result) => {
+        var _a;
+        if (!currentSession) {
+          let { data, error: error2 } = result;
+          if (error2)
+            throw error2;
+          currentSession = (_a = data.session) !== null && _a !== void 0 ? _a : void 0;
+        }
+        if (!currentSession?.refresh_token)
+          throw new AuthSessionMissingError();
+        let { data: session, error } = await this._callRefreshToken(currentSession.refresh_token);
+        return error ? this._returnResult({ data: { user: null, session: null }, error }) : session ? this._returnResult({ data: { user: session.user, session }, error: null }) : this._returnResult({ data: { user: null, session: null }, error: null });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: { user: null, session: null }, error });
+      throw error;
+    }
+  }
+  async _getSessionFromURL(params, callbackUrlType) {
+    var _a;
+    try {
+      if (!isBrowser())
+        throw new AuthImplicitGrantRedirectError("No browser detected.");
+      if (params.error || params.error_description || params.error_code)
+        throw new AuthImplicitGrantRedirectError(params.error_description || "Error in URL with unspecified error_description", {
+          error: params.error || "unspecified_error",
+          code: params.error_code || "unspecified_code"
+        });
+      switch (callbackUrlType) {
+        case "implicit":
+          if (this.flowType === "pkce")
+            throw new AuthPKCEGrantCodeExchangeError("Not a valid PKCE flow url.");
+          break;
+        case "pkce":
+          if (this.flowType === "implicit")
+            throw new AuthImplicitGrantRedirectError("Not a valid implicit grant flow url.");
+          break;
+        default:
+      }
+      if (callbackUrlType === "pkce") {
+        if (this._debug("#_initialize()", "begin", "is PKCE flow", !0), !params.code)
+          throw new AuthPKCEGrantCodeExchangeError("No code detected.");
+        let { data: data2, error: error2 } = await this._exchangeCodeForSession(params.code, {
+          flowId: params[PKCE_FLOW_ID_PARAM]
+        });
+        if (error2)
+          throw error2;
+        let url = new URL(window.location.href);
+        return url.searchParams.delete("code"), url.searchParams.delete(PKCE_FLOW_ID_PARAM), window.history.replaceState(window.history.state, "", url.toString()), {
+          data: { session: data2.session, redirectType: (_a = data2.redirectType) !== null && _a !== void 0 ? _a : null },
+          error: null
+        };
+      }
+      let { provider_token, provider_refresh_token, access_token, refresh_token, expires_in, expires_at, token_type } = params;
+      if (!access_token || !expires_in || !refresh_token || !token_type)
+        throw new AuthImplicitGrantRedirectError("No session defined in URL");
+      let timeNow = Math.round(Date.now() / 1e3), expiresIn = parseInt(expires_in), expiresAt2 = timeNow + expiresIn;
+      expires_at && (expiresAt2 = parseInt(expires_at));
+      let actuallyExpiresIn = expiresAt2 - timeNow;
+      actuallyExpiresIn * 1e3 <= AUTO_REFRESH_TICK_DURATION_MS && console.warn(`@supabase/gotrue-js: Session as retrieved from URL expires in ${actuallyExpiresIn}s, should have been closer to ${expiresIn}s`);
+      let issuedAt = expiresAt2 - expiresIn;
+      timeNow - issuedAt >= 120 ? console.warn("@supabase/gotrue-js: Session as retrieved from URL was issued over 120s ago, URL could be stale", issuedAt, expiresAt2, timeNow) : timeNow - issuedAt < 0 && console.warn("@supabase/gotrue-js: Session as retrieved from URL was issued in the future? Check the device clock for skew", issuedAt, expiresAt2, timeNow);
+      let { data, error } = await this._getUser(access_token);
+      if (error)
+        throw error;
+      let session = {
+        provider_token,
+        provider_refresh_token,
+        access_token,
+        expires_in: expiresIn,
+        expires_at: expiresAt2,
+        refresh_token,
+        token_type,
+        user: data.user
+      };
+      return window.location.hash = "", this._debug("#_getSessionFromURL()", "clearing window.location.hash"), this._returnResult({ data: { session, redirectType: params.type }, error: null });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: { session: null, redirectType: null }, error });
+      throw error;
+    }
+  }
+  _isImplicitGrantCallback(params) {
+    return typeof this.detectSessionInUrl == "function" ? this.detectSessionInUrl(new URL(window.location.href), params) : !!(params.access_token || params.error || params.error_description || params.error_code);
+  }
+  async _isPKCECallback(params) {
+    if (!params.code)
+      return !1;
+    let flowId = validatePKCEFlowId(params[PKCE_FLOW_ID_PARAM]);
+    return flowId && await getItemAsync(this.storage, pkceVerifierSlotKey(this.storageKey, flowId)) ? !0 : !!await getItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+  }
+  async signOut(options = { scope: "global" }) {
+    return await this.initializePromise, this.lock != null ? await this._acquireLock(this.lockAcquireTimeout, async () => await this._signOut(options)) : await this._signOut(options);
+  }
+  async _signOut({ scope } = { scope: "global" }) {
+    return await this._useSession(async (result) => {
+      var _a;
+      let removeCurrentSession = async () => {
+        await this._removeSession();
+      }, { data, error: sessionError } = result;
+      if (sessionError && !isAuthSessionMissingError(sessionError))
+        return this._returnResult({ error: sessionError });
+      let accessToken = (_a = data.session) === null || _a === void 0 ? void 0 : _a.access_token;
+      if (accessToken) {
+        let { error } = await this.admin.signOut(accessToken, scope);
+        if (error && !(isAuthApiError(error) && (error.status === 404 || error.status === 401 || error.status === 403) || isAuthSessionMissingError(error)))
+          return scope !== "others" && await removeCurrentSession(), this._returnResult({ error });
+      }
+      return scope !== "others" && await removeCurrentSession(), this._returnResult({ error: null });
+    });
+  }
+  /**  *
+   * @category Auth
+   *
+   * @remarks
+   * - Subscribes to important events occurring on the user's session.
+   * - Use on the frontend/client. It is less useful on the server.
+   * - Events are emitted across tabs to keep your application's UI up-to-date. Some events can fire very frequently, based on the number of tabs open. Use a quick and efficient callback function, and defer or debounce as many operations as you can to be performed outside of the callback.
+   * - Callbacks can be `async` and can safely call other Supabase auth methods (`getUser`, `setSession`, etc.) from inside the callback.
+   * - Keep callbacks quick. Events are awaited in order, so a slow callback delays subsequent events to subscribers in this tab.
+   * - Emitted events:
+   *   - `INITIAL_SESSION`
+   *     - Emitted right after the Supabase client is constructed and the initial session from storage is loaded.
+   *   - `SIGNED_IN`
+   *     - Emitted each time a user session is confirmed or re-established, including on user sign in and when refocusing a tab.
+   *     - Avoid making assumptions as to when this event is fired, this may occur even when the user is already signed in. Instead, check the user object attached to the event to see if a new user has signed in and update your application's UI.
+   *     - This event can fire very frequently depending on the number of tabs open in your application.
+   *   - `SIGNED_OUT`
+   *     - Emitted when the user signs out. This can be after:
+   *       - A call to `supabase.auth.signOut()`.
+   *       - After the user's session has expired for any reason:
+   *         - User has signed out on another device.
+   *         - The session has reached its timebox limit or inactivity timeout.
+   *         - User has signed in on another device with single session per user enabled.
+   *         - Check the [User Sessions](/docs/guides/auth/sessions) docs for more information.
+   *     - Use this to clean up any local storage your application has associated with the user.
+   *   - `TOKEN_REFRESHED`
+   *     - Emitted each time a new access and refresh token are fetched for the signed in user.
+   *     - It's best practice and highly recommended to extract the access token (JWT) and store it in memory for further use in your application.
+   *       - Avoid frequent calls to `supabase.auth.getSession()` for the same purpose.
+   *     - There is a background process that keeps track of when the session should be refreshed so you will always receive valid tokens by listening to this event.
+   *     - The frequency of this event is related to the JWT expiry limit configured on your project.
+   *   - `USER_UPDATED`
+   *     - Emitted each time the `supabase.auth.updateUser()` method finishes successfully. Listen to it to update your application's UI based on new profile information.
+   *   - `PASSWORD_RECOVERY`
+   *     - Emitted instead of the `SIGNED_IN` event when the user lands on a page that includes a password recovery link in the URL.
+   *     - Use it to show a UI to the user where they can [reset their password](/docs/guides/auth/passwords#resetting-a-users-password-forgot-password).
+   *
+   * @example Listen to auth changes
+   * ```js
+   * const { data } = supabase.auth.onAuthStateChange((event, session) => {
+   *   console.log(event, session)
+   *
+   *   if (event === 'INITIAL_SESSION') {
+   *     // handle initial session
+   *   } else if (event === 'SIGNED_IN') {
+   *     // handle sign in event
+   *   } else if (event === 'SIGNED_OUT') {
+   *     // handle sign out event
+   *   } else if (event === 'PASSWORD_RECOVERY') {
+   *     // handle password recovery event
+   *   } else if (event === 'TOKEN_REFRESHED') {
+   *     // handle token refreshed event
+   *   } else if (event === 'USER_UPDATED') {
+   *     // handle user updated event
+   *   }
+   * })
+   *
+   * // call unsubscribe to remove the callback
+   * data.subscription.unsubscribe()
+   * ```
+   *
+   * @exampleDescription Listen to sign out
+   * Make sure you clear out any local data, such as local and session storage, after the client library has detected the user's sign out.
+   *
+   * @example Listen to sign out
+   * ```js
+   * supabase.auth.onAuthStateChange((event, session) => {
+   *   if (event === 'SIGNED_OUT') {
+   *     console.log('SIGNED_OUT', session)
+   *
+   *     // clear local and session storage
+   *     [
+   *       window.localStorage,
+   *       window.sessionStorage,
+   *     ].forEach((storage) => {
+   *       Object.entries(storage)
+   *         .forEach(([key]) => {
+   *           storage.removeItem(key)
+   *         })
+   *     })
+   *   }
+   * })
+   * ```
+   *
+   * @exampleDescription Store OAuth provider tokens on sign in
+   * When using [OAuth (Social Login)](/docs/guides/auth/social-login) you sometimes wish to get access to the provider's access token and refresh token, in order to call provider APIs in the name of the user.
+   *
+   * For example, if you are using [Sign in with Google](/docs/guides/auth/social-login/auth-google) you may want to use the provider token to call Google APIs on behalf of the user. Supabase Auth does not keep track of the provider access and refresh token, but does return them for you once, immediately after sign in. You can use the `onAuthStateChange` method to listen for the presence of the provider tokens and store them in local storage. You can further send them to your server's APIs for use on the backend.
+   *
+   * Finally, make sure you remove them from local storage on the `SIGNED_OUT` event. If the OAuth provider supports token revocation, make sure you call those APIs either from the frontend or schedule them to be called on the backend.
+   *
+   * @example Store OAuth provider tokens on sign in
+   * ```js
+   * // Register this immediately after calling createClient!
+   * // Because signInWithOAuth causes a redirect, you need to fetch the
+   * // provider tokens from the callback.
+   * supabase.auth.onAuthStateChange((event, session) => {
+   *   if (session && session.provider_token) {
+   *     window.localStorage.setItem('oauth_provider_token', session.provider_token)
+   *   }
+   *
+   *   if (session && session.provider_refresh_token) {
+   *     window.localStorage.setItem('oauth_provider_refresh_token', session.provider_refresh_token)
+   *   }
+   *
+   *   if (event === 'SIGNED_OUT') {
+   *     window.localStorage.removeItem('oauth_provider_token')
+   *     window.localStorage.removeItem('oauth_provider_refresh_token')
+   *   }
+   * })
+   * ```
+   *
+   * @exampleDescription Use React Context for the User's session
+   * Instead of relying on `supabase.auth.getSession()` within your React components, you can use a [React Context](https://react.dev/reference/react/createContext) to store the latest session information from the `onAuthStateChange` callback and access it that way.
+   *
+   * @example Use React Context for the User's session
+   * ```js
+   * const SessionContext = React.createContext(null)
+   *
+   * function main() {
+   *   const [session, setSession] = React.useState(null)
+   *
+   *   React.useEffect(() => {
+   *     const {data: { subscription }} = supabase.auth.onAuthStateChange(
+   *       (event, session) => {
+   *         if (event === 'SIGNED_OUT') {
+   *           setSession(null)
+   *         } else if (session) {
+   *           setSession(session)
+   *         }
+   *       })
+   *
+   *     return () => {
+   *       subscription.unsubscribe()
+   *     }
+   *   }, [])
+   *
+   *   return (
+   *     <SessionContext.Provider value={session}>
+   *       <App />
+   *     </SessionContext.Provider>
+   *   )
+   * }
+   * ```
+   *
+   * @example Listen to password recovery events
+   * ```js
+   * supabase.auth.onAuthStateChange((event, session) => {
+   *   if (event === 'PASSWORD_RECOVERY') {
+   *     console.log('PASSWORD_RECOVERY', session)
+   *     // show screen to update user's password
+   *     showPasswordResetScreen(true)
+   *   }
+   * })
+   * ```
+   *
+   * @example Listen to sign in
+   * ```js
+   * supabase.auth.onAuthStateChange((event, session) => {
+   *   if (event === 'SIGNED_IN') console.log('SIGNED_IN', session)
+   * })
+   * ```
+   *
+   * @example Listen to token refresh
+   * ```js
+   * supabase.auth.onAuthStateChange((event, session) => {
+   *   if (event === 'TOKEN_REFRESHED') console.log('TOKEN_REFRESHED', session)
+   * })
+   * ```
+   *
+   * @example Listen to user updates
+   * ```js
+   * supabase.auth.onAuthStateChange((event, session) => {
+   *   if (event === 'USER_UPDATED') console.log('USER_UPDATED', session)
+   * })
+   * ```
+   */
+  onAuthStateChange(callback) {
+    let id = generateCallbackId(), subscription = {
+      id,
+      callback,
+      unsubscribe: () => {
+        this._debug("#unsubscribe()", "state change callback with id removed", id), this.stateChangeEmitters.delete(id);
+      }
+    };
+    return this._debug("#onAuthStateChange()", "registered callback with id", id), this.stateChangeEmitters.set(id, subscription), (async () => (await this.initializePromise, this.lock != null ? await this._acquireLock(this.lockAcquireTimeout, async () => {
+      this._emitInitialSession(id);
+    }) : await this._emitInitialSession(id)))(), { data: { subscription } };
+  }
+  async _emitInitialSession(id) {
+    return await this._useSession(async (result) => {
+      var _a, _b;
+      try {
+        let { data: { session }, error } = result;
+        if (error)
+          throw error;
+        await ((_a = this.stateChangeEmitters.get(id)) === null || _a === void 0 ? void 0 : _a.callback("INITIAL_SESSION", session)), this._debug("INITIAL_SESSION", "callback id", id, "session", session);
+      } catch (err) {
+        if (await ((_b = this.stateChangeEmitters.get(id)) === null || _b === void 0 ? void 0 : _b.callback("INITIAL_SESSION", null)), this._debug("INITIAL_SESSION", "callback id", id, "error", err), isAuthRefreshDiscardedError(err))
+          return;
+        isAuthSessionMissingError(err) || isAuthRetryableFetchError(err) || isAuthApiError(err) && (err.code === "refresh_token_not_found" || err.code === "refresh_token_already_used" || err.code === "session_expired") ? console.warn(err) : console.error(err);
+      }
+    });
+  }
+  async resetPasswordForEmail(email, options = {}) {
+    let codeChallenge = null, codeChallengeMethod = null, flowId = null;
+    this.flowType === "pkce" && ([codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod(
+      !0
+      // isPasswordRecovery
+    ));
+    try {
+      return await _request(this.fetch, "POST", `${this.url}/recover`, {
+        body: {
+          email,
+          code_challenge: codeChallenge,
+          code_challenge_method: codeChallengeMethod,
+          gotrue_meta_security: { captcha_token: options.captchaToken }
+        },
+        headers: this.headers,
+        redirectTo: this._maybeAppendFlowIdToRedirect(options.redirectTo, flowId)
+      });
+    } catch (error) {
+      if (await removePKCEVerifier(this.storage, this.storageKey, flowId), isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async getUserIdentities() {
+    var _a;
+    try {
+      let { data, error } = await this.getUser();
+      if (error)
+        throw error;
+      return this._returnResult({ data: { identities: (_a = data.user.identities) !== null && _a !== void 0 ? _a : [] }, error: null });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  /**  *
+   * @category Auth
+   *
+   * @remarks
+   * - The **Enable Manual Linking** option must be enabled from your [project's authentication settings](/dashboard/project/_/auth/providers).
+   * - The user needs to be signed in to call `linkIdentity()`.
+   * - If the candidate identity is already linked to the existing user or another user, `linkIdentity()` will fail.
+   * - If `linkIdentity` is run in the browser, the user is automatically redirected to the returned URL. On the server, you should handle the redirect.
+   *
+   * @example Link an identity to a user
+   * ```js
+   * const { data, error } = await supabase.auth.linkIdentity({
+   *   provider: 'github'
+   * })
+   * ```
+   *
+   * @exampleResponse Link an identity to a user
+   * ```json
+   * {
+   *   data: {
+   *     provider: 'github',
+   *     url: <PROVIDER_URL_TO_REDIRECT_TO>,
+   *     flowId: <PKCE_FLOW_ID_OR_NULL>
+   *   },
+   *   error: null
+   * }
+   * ```
+   */
+  async linkIdentity(credentials) {
+    return "token" in credentials ? this.linkIdentityIdToken(credentials) : this.linkIdentityOAuth(credentials);
+  }
+  async linkIdentityOAuth(credentials) {
+    var _a;
+    let flowId = null;
+    try {
+      let { data, error } = await this._useSession(async (result) => {
+        var _a2, _b, _c, _d, _f;
+        let { data: data2, error: error2 } = result;
+        if (error2)
+          throw error2;
+        let { url, flowId: urlFlowId } = await this._getUrlForProvider(`${this.url}/user/identities/authorize`, credentials.provider, {
+          redirectTo: (_a2 = credentials.options) === null || _a2 === void 0 ? void 0 : _a2.redirectTo,
+          scopes: (_b = credentials.options) === null || _b === void 0 ? void 0 : _b.scopes,
+          queryParams: (_c = credentials.options) === null || _c === void 0 ? void 0 : _c.queryParams,
+          skipBrowserRedirect: !0
+        });
+        return flowId = urlFlowId, await _request(this.fetch, "GET", url, {
+          headers: this.headers,
+          jwt: (_f = (_d = data2.session) === null || _d === void 0 ? void 0 : _d.access_token) !== null && _f !== void 0 ? _f : void 0
+        });
+      });
+      if (error)
+        throw error;
+      return isBrowser() && !(!((_a = credentials.options) === null || _a === void 0) && _a.skipBrowserRedirect) && window.location.assign(data?.url), this._returnResult({
+        data: { provider: credentials.provider, url: data?.url, flowId },
+        error: null
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({
+          data: { provider: credentials.provider, url: null, flowId },
+          error
+        });
+      throw error;
+    }
+  }
+  async linkIdentityIdToken(credentials) {
+    return await this._useSession(async (result) => {
+      var _a;
+      try {
+        let { error: sessionError, data: { session } } = result;
+        if (sessionError)
+          throw sessionError;
+        let { options, provider, token, access_token, nonce } = credentials, res = await _request(this.fetch, "POST", `${this.url}/token?grant_type=id_token`, {
+          headers: this.headers,
+          jwt: (_a = session?.access_token) !== null && _a !== void 0 ? _a : void 0,
+          body: {
+            provider,
+            id_token: token,
+            access_token,
+            nonce,
+            link_identity: !0,
+            gotrue_meta_security: { captcha_token: options?.captchaToken }
+          },
+          xform: _sessionResponse
+        }), { data, error } = res;
+        return error ? this._returnResult({ data: { user: null, session: null }, error }) : !data || !data.session || !data.user ? this._returnResult({
+          data: { user: null, session: null },
+          error: new AuthInvalidTokenResponseError()
+        }) : (data.session && (await this._saveSession(data.session), await this._notifyAllSubscribers("USER_UPDATED", data.session)), this._returnResult({ data, error }));
+      } catch (error) {
+        if (await removePKCEVerifier(this.storage, this.storageKey, null), isAuthError(error))
+          return this._returnResult({ data: { user: null, session: null }, error });
+        throw error;
+      }
+    });
+  }
+  async unlinkIdentity(identity) {
+    try {
+      return await this._useSession(async (result) => {
+        var _a, _b;
+        let { data, error } = result;
+        if (error)
+          throw error;
+        return await _request(this.fetch, "DELETE", `${this.url}/user/identities/${identity.identity_id}`, {
+          headers: this.headers,
+          jwt: (_b = (_a = data.session) === null || _a === void 0 ? void 0 : _a.access_token) !== null && _b !== void 0 ? _b : void 0
+        });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _refreshAccessToken(refreshToken) {
+    let debugName = "#_refreshAccessToken()";
+    this._debug(debugName, "begin");
+    try {
+      let startedAt = Date.now();
+      return await retryable(async (attempt) => (attempt > 0 && await sleep(200 * Math.pow(2, attempt - 1)), this._debug(debugName, "refreshing attempt", attempt), await _request(this.fetch, "POST", `${this.url}/token?grant_type=refresh_token`, {
+        body: { refresh_token: refreshToken },
+        headers: this.headers,
+        xform: _sessionResponse
+      })), (attempt, error) => {
+        let nextBackOffInterval = 200 * Math.pow(2, attempt);
+        return error && isAuthRetryableFetchError(error) && // retryable only if the request can be sent before the backoff overflows the tick duration
+        Date.now() + nextBackOffInterval - startedAt < AUTO_REFRESH_TICK_DURATION_MS;
+      });
+    } catch (error) {
+      if (this._debug(debugName, "error", error), isAuthError(error))
+        return this._returnResult({ data: { session: null, user: null }, error });
+      throw error;
+    } finally {
+      this._debug(debugName, "end");
+    }
+  }
+  _isValidSession(maybeSession) {
+    return typeof maybeSession == "object" && maybeSession !== null && "access_token" in maybeSession && "refresh_token" in maybeSession && "expires_at" in maybeSession;
+  }
+  async _handleProviderSignIn(provider, options) {
+    let { url, flowId } = await this._getUrlForProvider(`${this.url}/authorize`, provider, {
+      redirectTo: options.redirectTo,
+      scopes: options.scopes,
+      queryParams: options.queryParams
+    });
+    return this._debug("#_handleProviderSignIn()", "provider", provider, "options", options, "url", url), isBrowser() && !options.skipBrowserRedirect && window.location.assign(url), { data: { provider, url, flowId }, error: null };
+  }
+  async _recoverAndRefresh() {
+    var _a, _b;
+    let debugName = "#_recoverAndRefresh()";
+    this._debug(debugName, "begin");
+    try {
+      let currentSession = await getItemAsync(this.storage, this.storageKey);
+      if (currentSession && this.userStorage) {
+        let maybeUser = await getItemAsync(this.userStorage, this.storageKey + "-user");
+        !this.storage.isServer && Object.is(this.storage, this.userStorage) && !maybeUser && (maybeUser = { user: currentSession.user }, await setItemAsync(this.userStorage, this.storageKey + "-user", maybeUser)), currentSession.user = (_a = maybeUser?.user) !== null && _a !== void 0 ? _a : userNotAvailableProxy();
+      } else if (currentSession && !currentSession.user && !currentSession.user) {
+        let separateUser = await getItemAsync(this.storage, this.storageKey + "-user");
+        separateUser && separateUser?.user ? (currentSession.user = separateUser.user, await removeItemAsync(this.storage, this.storageKey + "-user"), await setItemAsync(this.storage, this.storageKey, currentSession)) : currentSession.user = userNotAvailableProxy();
+      }
+      if (this._debug(debugName, "session from storage", currentSession), !this._isValidSession(currentSession)) {
+        this._debug(debugName, "session is not valid"), currentSession !== null && await this._removeSession();
+        return;
+      }
+      let expiresWithMargin = ((_b = currentSession.expires_at) !== null && _b !== void 0 ? _b : 1 / 0) * 1e3 - Date.now() < EXPIRY_MARGIN_MS;
+      if (this._debug(debugName, `session has${expiresWithMargin ? "" : " not"} expired with margin of ${EXPIRY_MARGIN_MS}s`), expiresWithMargin) {
+        if (this.autoRefreshToken && currentSession.refresh_token) {
+          let { error } = await this._callRefreshToken(currentSession.refresh_token);
+          error && (isAuthRefreshDiscardedError(error) ? this._debug(debugName, "refresh discarded by commit guard", error) : this._debug(debugName, "refresh failed", error));
+        }
+      } else if (currentSession.user && currentSession.user.__isUserNotAvailableProxy === !0)
+        try {
+          let { data, error: userError } = await this._getUser(currentSession.access_token);
+          !userError && data?.user ? (currentSession.user = data.user, await this._saveSession(currentSession), await this._notifyAllSubscribers("SIGNED_IN", currentSession)) : this._debug(debugName, "could not get user data, skipping SIGNED_IN notification");
+        } catch (getUserError) {
+          console.error("Error getting user data:", getUserError), this._debug(debugName, "error getting user data, skipping SIGNED_IN notification", getUserError);
+        }
+      else
+        await this._notifyAllSubscribers("SIGNED_IN", currentSession);
+    } catch (err) {
+      this._debug(debugName, "error", err), isAuthRetryableFetchError(err) ? console.warn(err) : console.error(err);
+      return;
+    } finally {
+      this._debug(debugName, "end");
+    }
+  }
+  async _callRefreshToken(refreshToken) {
+    var _a, _b;
+    if (!refreshToken)
+      throw new AuthSessionMissingError();
+    if (this.refreshingDeferred)
+      return this.refreshingDeferred.promise;
+    if (this.lastRefreshFailure && this.lastRefreshFailure.refreshToken === refreshToken && Date.now() < this.lastRefreshFailure.expiresAt)
+      return this._debug("#_callRefreshToken()", "returning cached failure (cooldown active)"), this.lastRefreshFailure.result;
+    let debugName = "#_callRefreshToken()";
+    this._debug(debugName, "begin");
+    try {
+      this.refreshingDeferred = new Deferred(), this.refreshingDeferred.promise.then(void 0, () => {
+      });
+      let storedAtStart = await getItemAsync(this.storage, this.storageKey), { data, error } = await this._refreshAccessToken(refreshToken);
+      if (error)
+        throw error;
+      if (!data.session)
+        throw new AuthSessionMissingError();
+      let storedAfter = await getItemAsync(this.storage, this.storageKey);
+      if (storedAtStart !== null && (storedAfter === null || storedAfter.refresh_token !== storedAtStart.refresh_token)) {
+        this._debug(debugName, "commit guard: storage changed since refresh started, discarding rotated tokens", {
+          // Presence indicators only — never log refresh token fragments,
+          // even partial. Logs may be forwarded to third-party services.
+          startedWith: "present",
+          nowHolds: storedAfter ? "replaced" : "cleared"
+        });
+        let discarded = {
+          data: null,
+          error: new AuthRefreshDiscardedError()
+        };
+        return this.refreshingDeferred.resolve(discarded), discarded;
+      }
+      let epochBeforeSave = this._sessionRemovalEpoch;
+      if (await this._saveSession(data.session), this._sessionRemovalEpoch !== epochBeforeSave) {
+        this._debug(debugName, "commit guard (post-save): _removeSession ran during _saveSession, undoing write"), await removeItemAsync(this.storage, this.storageKey), this.userStorage && await removeItemAsync(this.userStorage, this.storageKey + "-user");
+        let discarded = {
+          data: null,
+          error: new AuthRefreshDiscardedError()
+        };
+        return this.refreshingDeferred.resolve(discarded), discarded;
+      }
+      await this._notifyAllSubscribers("TOKEN_REFRESHED", data.session);
+      let result = { data: data.session, error: null };
+      return this.lastRefreshFailure = null, this.refreshingDeferred.resolve(result), result;
+    } catch (error) {
+      if (this._debug(debugName, "error", error), isAuthError(error)) {
+        let result = { data: null, error };
+        if (!isAuthRetryableFetchError(error)) {
+          let storedNow = await getItemAsync(this.storage, this.storageKey);
+          !!(storedNow?.expires_at && storedNow.expires_at * 1e3 > Date.now()) ? this._debug(debugName, "proactive refresh failed, access token still valid \u2014 preserving session") : await this._removeSession();
+        }
+        return this.lastRefreshFailure = {
+          refreshToken,
+          result,
+          expiresAt: Date.now() + REFRESH_FAILURE_COOLDOWN_MS
+        }, (_a = this.refreshingDeferred) === null || _a === void 0 || _a.resolve(result), result;
+      }
+      throw (_b = this.refreshingDeferred) === null || _b === void 0 || _b.reject(error), error;
+    } finally {
+      this.refreshingDeferred = null, this._debug(debugName, "end");
+    }
+  }
+  async _notifyAllSubscribers(event, session, broadcast = !0) {
+    if (this._pendingInitNotifications !== null && broadcast) {
+      this._pendingInitNotifications.push({ event, session, broadcast });
+      return;
+    }
+    let debugName = `#_notifyAllSubscribers(${event})`;
+    this._debug(debugName, "begin", session, `broadcast = ${broadcast}`);
+    try {
+      this.broadcastChannel && broadcast && this.broadcastChannel.postMessage({ event, session });
+      let errors = [], promises = Array.from(this.stateChangeEmitters.values()).map(async (x) => {
+        try {
+          await x.callback(event, session);
+        } catch (e) {
+          errors.push(e);
+        }
+      });
+      if (await Promise.all(promises), errors.length > 0) {
+        for (let i = 0; i < errors.length; i += 1)
+          console.error(errors[i]);
+        throw errors[0];
+      }
+    } finally {
+      this._debug(debugName, "end");
+    }
+  }
+  async _saveSession(session) {
+    this._debug("#_saveSession()", session), this.suppressGetSessionWarning = !0;
+    let sessionToProcess = Object.assign({}, session), userIsProxy = sessionToProcess.user && sessionToProcess.user.__isUserNotAvailableProxy === !0;
+    if (this.userStorage) {
+      !userIsProxy && sessionToProcess.user && await setItemAsync(this.userStorage, this.storageKey + "-user", {
+        user: sessionToProcess.user
+      });
+      let mainSessionData = Object.assign({}, sessionToProcess);
+      delete mainSessionData.user;
+      let clonedMainSessionData = deepClone(mainSessionData);
+      await setItemAsync(this.storage, this.storageKey, clonedMainSessionData);
+    } else {
+      let clonedSession = deepClone(sessionToProcess);
+      await setItemAsync(this.storage, this.storageKey, clonedSession);
+    }
+  }
+  async _removeSession() {
+    this._sessionRemovalEpoch += 1, this._debug("#_removeSession()"), this.lastRefreshFailure = null, this.suppressGetSessionWarning = !1, await removeItemAsync(this.storage, this.storageKey), await removeAllPKCEVerifiers(this.storage, this.storageKey), await removeItemAsync(this.storage, this.storageKey + "-user"), this.userStorage && await removeItemAsync(this.userStorage, this.storageKey + "-user"), await this._notifyAllSubscribers("SIGNED_OUT", null);
+  }
+  _removeVisibilityChangedCallback() {
+    this._debug("#_removeVisibilityChangedCallback()");
+    let callback = this.visibilityChangedCallback;
+    this.visibilityChangedCallback = null;
+    try {
+      callback && isBrowser() && window?.removeEventListener && window.removeEventListener("visibilitychange", callback);
+    } catch (e) {
+      console.error("removing visibilitychange callback failed", e);
+    }
+  }
+  async _startAutoRefresh() {
+    await this._stopAutoRefresh(), this._debug("#_startAutoRefresh()");
+    let ticker = setInterval(() => this._autoRefreshTokenTick(), AUTO_REFRESH_TICK_DURATION_MS);
+    this.autoRefreshTicker = ticker, ticker && typeof ticker == "object" && typeof ticker.unref == "function" ? ticker.unref() : typeof Deno < "u" && typeof Deno.unrefTimer == "function" && Deno.unrefTimer(ticker);
+    let timeout = setTimeout(async () => {
+      await this.initializePromise, await this._autoRefreshTokenTick();
+    }, 0);
+    this.autoRefreshTickTimeout = timeout, timeout && typeof timeout == "object" && typeof timeout.unref == "function" ? timeout.unref() : typeof Deno < "u" && typeof Deno.unrefTimer == "function" && Deno.unrefTimer(timeout);
+  }
+  async _stopAutoRefresh() {
+    this._debug("#_stopAutoRefresh()");
+    let ticker = this.autoRefreshTicker;
+    this.autoRefreshTicker = null, ticker && clearInterval(ticker);
+    let timeout = this.autoRefreshTickTimeout;
+    this.autoRefreshTickTimeout = null, timeout && clearTimeout(timeout);
+  }
+  async startAutoRefresh() {
+    this._removeVisibilityChangedCallback(), await this._startAutoRefresh();
+  }
+  async stopAutoRefresh() {
+    this._removeVisibilityChangedCallback(), await this._stopAutoRefresh();
+  }
+  async dispose() {
+    var _a;
+    this._removeVisibilityChangedCallback(), await this._stopAutoRefresh(), (_a = this.broadcastChannel) === null || _a === void 0 || _a.close(), this.broadcastChannel = null, this.stateChangeEmitters.clear();
+  }
+  async _autoRefreshTokenTick() {
+    if (this._debug("#_autoRefreshTokenTick()", "begin"), this.lock != null) {
+      try {
+        await this._acquireLock(0, async () => {
+          try {
+            let now = Date.now();
+            try {
+              return await this._useSession(async (result) => {
+                let { data: { session } } = result;
+                if (!session || !session.refresh_token || !session.expires_at) {
+                  this._debug("#_autoRefreshTokenTick()", "no session");
+                  return;
+                }
+                let expiresInTicks = Math.floor((session.expires_at * 1e3 - now) / AUTO_REFRESH_TICK_DURATION_MS);
+                this._debug("#_autoRefreshTokenTick()", `access token expires in ${expiresInTicks} ticks, a tick lasts ${AUTO_REFRESH_TICK_DURATION_MS}ms, refresh threshold is ${AUTO_REFRESH_TICK_THRESHOLD} ticks`), expiresInTicks <= AUTO_REFRESH_TICK_THRESHOLD && await this._callRefreshToken(session.refresh_token);
+              });
+            } catch (e) {
+              console.error("Auto refresh tick failed with error. This is likely a transient error.", e);
+            }
+          } finally {
+            this._debug("#_autoRefreshTokenTick()", "end");
+          }
+        });
+      } catch (e) {
+        if (e instanceof LockAcquireTimeoutError)
+          this._debug("auto refresh token tick lock not available");
+        else
+          throw e;
+      }
+      return;
+    }
+    if (this.refreshingDeferred !== null) {
+      this._debug("#_autoRefreshTokenTick()", "refresh already in flight, skipping");
+      return;
+    }
+    try {
+      let now = Date.now();
+      try {
+        await this._useSession(async (result) => {
+          let { data: { session } } = result;
+          if (!session || !session.refresh_token || !session.expires_at) {
+            this._debug("#_autoRefreshTokenTick()", "no session");
+            return;
+          }
+          let expiresInTicks = Math.floor((session.expires_at * 1e3 - now) / AUTO_REFRESH_TICK_DURATION_MS);
+          this._debug("#_autoRefreshTokenTick()", `access token expires in ${expiresInTicks} ticks, a tick lasts ${AUTO_REFRESH_TICK_DURATION_MS}ms, refresh threshold is ${AUTO_REFRESH_TICK_THRESHOLD} ticks`), expiresInTicks <= AUTO_REFRESH_TICK_THRESHOLD && await this._callRefreshToken(session.refresh_token);
+        });
+      } catch (e) {
+        console.error("Auto refresh tick failed with error. This is likely a transient error.", e);
+      }
+    } finally {
+      this._debug("#_autoRefreshTokenTick()", "end");
+    }
+  }
+  async _handleVisibilityChange() {
+    if (this._debug("#_handleVisibilityChange()"), !isBrowser() || !window?.addEventListener)
+      return this.autoRefreshToken && this.startAutoRefresh(), !1;
+    try {
+      this.visibilityChangedCallback = async () => {
+        try {
+          await this._onVisibilityChanged(!1);
+        } catch (error) {
+          this._debug("#visibilityChangedCallback", "error", error);
+        }
+      }, window?.addEventListener("visibilitychange", this.visibilityChangedCallback), await this._onVisibilityChanged(!0);
+    } catch (error) {
+      console.error("_handleVisibilityChange", error);
+    }
+  }
+  async _onVisibilityChanged(calledFromInitialize) {
+    let methodName = `#_onVisibilityChanged(${calledFromInitialize})`;
+    if (this._debug(methodName, "visibilityState", document.visibilityState), document.visibilityState === "visible") {
+      if (this.autoRefreshToken && this._startAutoRefresh(), !calledFromInitialize)
+        if (await this.initializePromise, this.lock != null)
+          await this._acquireLock(this.lockAcquireTimeout, async () => {
+            if (document.visibilityState !== "visible") {
+              this._debug(methodName, "acquired the lock to recover the session, but the browser visibilityState is no longer visible, aborting");
+              return;
+            }
+            await this._recoverAndRefresh();
+          });
+        else {
+          if (document.visibilityState !== "visible") {
+            this._debug(methodName, "visibilityState is no longer visible, skipping recovery");
+            return;
+          }
+          await this._recoverAndRefresh();
+        }
+    } else document.visibilityState === "hidden" && this.autoRefreshToken && this._stopAutoRefresh();
+  }
+  async _getUrlForProvider(url, provider, options) {
+    let redirectTo = options?.redirectTo, codeChallenge = null, codeChallengeMethod = null, flowId = null;
+    this.flowType === "pkce" && ([codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod(), redirectTo = this._maybeAppendFlowIdToRedirect(redirectTo, flowId));
+    let urlParams = [`provider=${encodeURIComponent(provider)}`];
+    if (redirectTo && urlParams.push(`redirect_to=${encodeURIComponent(redirectTo)}`), options?.scopes && urlParams.push(`scopes=${encodeURIComponent(options.scopes)}`), codeChallenge != null && codeChallengeMethod != null) {
+      let flowParams = new URLSearchParams({
+        code_challenge: `${encodeURIComponent(codeChallenge)}`,
+        code_challenge_method: `${encodeURIComponent(codeChallengeMethod)}`
+      });
+      urlParams.push(flowParams.toString());
+    }
+    if (options?.queryParams) {
+      let query = new URLSearchParams(options.queryParams);
+      urlParams.push(query.toString());
+    }
+    return options?.skipBrowserRedirect && urlParams.push(`skip_http_redirect=${options.skipBrowserRedirect}`), { url: `${url}?${urlParams.join("&")}`, flowId };
+  }
+  _maybeAppendFlowIdToRedirect(redirectTo, flowId) {
+    return !redirectTo || !flowId || !this.experimental.appendPkceFlowIdToRedirects ? redirectTo ?? void 0 : appendFlowIdToRedirectTo(redirectTo, flowId);
+  }
+  async _getCodeChallengeAndMethod(isPasswordRecovery = !1) {
+    return getCodeChallengeAndMethod(this.storage, this.storageKey, isPasswordRecovery, (evictedFlowId) => this._debug("#_getCodeChallengeAndMethod()", "evicted oldest pending PKCE verifier slot", evictedFlowId));
+  }
+  async _unenroll(params) {
+    try {
+      return await this._useSession(async (result) => {
+        var _a;
+        let { data: sessionData, error: sessionError } = result;
+        return sessionError ? this._returnResult({ data: null, error: sessionError }) : await _request(this.fetch, "DELETE", `${this.url}/factors/${params.factorId}`, {
+          headers: this.headers,
+          jwt: (_a = sessionData?.session) === null || _a === void 0 ? void 0 : _a.access_token
+        });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _enroll(params) {
+    try {
+      return await this._useSession(async (result) => {
+        var _a, _b;
+        let { data: sessionData, error: sessionError } = result;
+        if (sessionError)
+          return this._returnResult({ data: null, error: sessionError });
+        let body = Object.assign({ friendly_name: params.friendlyName, factor_type: params.factorType }, params.factorType === "phone" ? { phone: params.phone } : params.factorType === "totp" ? { issuer: params.issuer } : {}), { data, error } = await _request(this.fetch, "POST", `${this.url}/factors`, {
+          body,
+          headers: this.headers,
+          jwt: (_a = sessionData?.session) === null || _a === void 0 ? void 0 : _a.access_token
+        });
+        return error ? this._returnResult({ data: null, error }) : (params.factorType === "totp" && data.type === "totp" && (!((_b = data?.totp) === null || _b === void 0) && _b.qr_code) && (data.totp.qr_code = `data:image/svg+xml;utf-8,${data.totp.qr_code}`), this._returnResult({ data, error: null }));
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _verify(params) {
+    let run = async () => {
+      try {
+        return await this._useSession(async (result) => {
+          var _a;
+          let { data: sessionData, error: sessionError } = result;
+          if (sessionError)
+            return this._returnResult({ data: null, error: sessionError });
+          let body = Object.assign({ challenge_id: params.challengeId }, "webauthn" in params ? {
+            webauthn: Object.assign(Object.assign({}, params.webauthn), { credential_response: params.webauthn.type === "create" ? serializeCredentialCreationResponse(params.webauthn.credential_response) : serializeCredentialRequestResponse(params.webauthn.credential_response) })
+          } : { code: params.code }), { data, error } = await _request(this.fetch, "POST", `${this.url}/factors/${params.factorId}/verify`, {
+            body,
+            headers: this.headers,
+            jwt: (_a = sessionData?.session) === null || _a === void 0 ? void 0 : _a.access_token
+          });
+          return error ? this._returnResult({ data: null, error }) : (await this._saveSession(Object.assign({ expires_at: Math.round(Date.now() / 1e3) + data.expires_in }, data)), await this._notifyAllSubscribers("MFA_CHALLENGE_VERIFIED", data), this._returnResult({ data, error }));
+        });
+      } catch (error) {
+        if (isAuthError(error))
+          return this._returnResult({ data: null, error });
+        throw error;
+      }
+    };
+    return this.lock != null ? this._acquireLock(this.lockAcquireTimeout, run) : run();
+  }
+  async _challenge(params) {
+    let run = async () => {
+      try {
+        return await this._useSession(async (result) => {
+          var _a;
+          let { data: sessionData, error: sessionError } = result;
+          if (sessionError)
+            return this._returnResult({ data: null, error: sessionError });
+          let response = await _request(this.fetch, "POST", `${this.url}/factors/${params.factorId}/challenge`, {
+            body: params,
+            headers: this.headers,
+            jwt: (_a = sessionData?.session) === null || _a === void 0 ? void 0 : _a.access_token
+          });
+          if (response.error)
+            return response;
+          let { data } = response;
+          if (data.type !== "webauthn")
+            return { data, error: null };
+          switch (data.webauthn.type) {
+            case "create":
+              return {
+                data: Object.assign(Object.assign({}, data), { webauthn: Object.assign(Object.assign({}, data.webauthn), { credential_options: Object.assign(Object.assign({}, data.webauthn.credential_options), { publicKey: deserializeCredentialCreationOptions(data.webauthn.credential_options.publicKey) }) }) }),
+                error: null
+              };
+            case "request":
+              return {
+                data: Object.assign(Object.assign({}, data), { webauthn: Object.assign(Object.assign({}, data.webauthn), { credential_options: Object.assign(Object.assign({}, data.webauthn.credential_options), { publicKey: deserializeCredentialRequestOptions(data.webauthn.credential_options.publicKey) }) }) }),
+                error: null
+              };
+          }
+        });
+      } catch (error) {
+        if (isAuthError(error))
+          return this._returnResult({ data: null, error });
+        throw error;
+      }
+    };
+    return this.lock != null ? this._acquireLock(this.lockAcquireTimeout, run) : run();
+  }
+  async _challengeAndVerify(params) {
+    let { data: challengeData, error: challengeError } = await this._challenge({
+      factorId: params.factorId
+    });
+    return challengeError ? this._returnResult({ data: null, error: challengeError }) : await this._verify({
+      factorId: params.factorId,
+      challengeId: challengeData.id,
+      code: params.code
+    });
+  }
+  async _listFactors() {
+    var _a;
+    let { data: { user }, error: userError } = await this.getUser();
+    if (userError)
+      return { data: null, error: userError };
+    let data = {
+      all: [],
+      phone: [],
+      totp: [],
+      webauthn: [],
+      recovery_code: []
+    };
+    for (let factor of (_a = user?.factors) !== null && _a !== void 0 ? _a : [])
+      data.all.push(factor), factor.status === "verified" && factor.factor_type in data && Array.isArray(data[factor.factor_type]) && data[factor.factor_type].push(factor);
+    return {
+      data,
+      error: null
+    };
+  }
+  async _getAuthenticatorAssuranceLevel(jwt) {
+    var _a, _b, _c, _d;
+    if (jwt)
+      try {
+        let { payload: payload2 } = decodeJWT(jwt), currentLevel2 = null;
+        payload2.aal && (currentLevel2 = payload2.aal);
+        let nextLevel2 = currentLevel2, { data: { user }, error: userError } = await this.getUser(jwt);
+        if (userError)
+          return this._returnResult({ data: null, error: userError });
+        ((_b = (_a = user?.factors) === null || _a === void 0 ? void 0 : _a.filter((factor) => factor.status === "verified")) !== null && _b !== void 0 ? _b : []).length > 0 && (nextLevel2 = "aal2");
+        let currentAuthenticationMethods2 = payload2.amr || [];
+        return { data: { currentLevel: currentLevel2, nextLevel: nextLevel2, currentAuthenticationMethods: currentAuthenticationMethods2 }, error: null };
+      } catch (error) {
+        if (isAuthError(error))
+          return this._returnResult({ data: null, error });
+        throw error;
+      }
+    let { data: { session }, error: sessionError } = await this.getSession();
+    if (sessionError)
+      return this._returnResult({ data: null, error: sessionError });
+    if (!session)
+      return {
+        data: { currentLevel: null, nextLevel: null, currentAuthenticationMethods: [] },
+        error: null
+      };
+    let { payload } = decodeJWT(session.access_token), currentLevel = null;
+    payload.aal && (currentLevel = payload.aal);
+    let nextLevel = currentLevel;
+    ((_d = (_c = session.user.factors) === null || _c === void 0 ? void 0 : _c.filter((factor) => factor.status === "verified")) !== null && _d !== void 0 ? _d : []).length > 0 && (nextLevel = "aal2");
+    let currentAuthenticationMethods = payload.amr || [];
+    return { data: { currentLevel, nextLevel, currentAuthenticationMethods }, error: null };
+  }
+  async _getRecoveryCodesStatus() {
+    assertRecoveryCodesExperimentalEnabled(this.experimental);
+    try {
+      return await this._useSession(async (result) => {
+        var _a;
+        let { data: sessionData, error: sessionError } = result;
+        if (sessionError)
+          return this._returnResult({ data: null, error: sessionError });
+        let { data, error } = await _request(this.fetch, "GET", `${this.url}/factors/recovery-codes`, {
+          headers: this.headers,
+          jwt: (_a = sessionData?.session) === null || _a === void 0 ? void 0 : _a.access_token
+        });
+        return error ? this._returnResult({ data: null, error }) : this._returnResult({ data, error: null });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _generateRecoveryCodes(params) {
+    assertRecoveryCodesExperimentalEnabled(this.experimental);
+    try {
+      return await this._useSession(async (result) => {
+        var _a;
+        let { data: sessionData, error: sessionError } = result;
+        if (sessionError)
+          return this._returnResult({ data: null, error: sessionError });
+        let { data, error } = await _request(this.fetch, "POST", `${this.url}/factors/recovery-codes`, {
+          // The body is optional server-side; only send one when a name was given.
+          body: params?.friendlyName ? { friendly_name: params.friendlyName } : void 0,
+          headers: this.headers,
+          jwt: (_a = sessionData?.session) === null || _a === void 0 ? void 0 : _a.access_token
+        });
+        return error ? this._returnResult({ data: null, error }) : this._returnResult({ data, error: null });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _verifyRecoveryCode(params) {
+    assertRecoveryCodesExperimentalEnabled(this.experimental);
+    let run = async () => {
+      try {
+        return await this._useSession(async (result) => {
+          var _a;
+          let { data: sessionData, error: sessionError } = result;
+          if (sessionError)
+            return this._returnResult({ data: null, error: sessionError });
+          let { data, error } = await _request(this.fetch, "POST", `${this.url}/factors/recovery-codes/verify`, {
+            body: { code: params.code },
+            headers: this.headers,
+            jwt: (_a = sessionData?.session) === null || _a === void 0 ? void 0 : _a.access_token
+          });
+          if (error)
+            return this._returnResult({ data: null, error });
+          let session = Object.assign({ expires_at: expiresAt(data.expires_in) }, data);
+          return await this._saveSession(session), await this._notifyAllSubscribers("MFA_CHALLENGE_VERIFIED", session), this._returnResult({ data, error: null });
+        });
+      } catch (error) {
+        if (isAuthError(error))
+          return this._returnResult({ data: null, error });
+        throw error;
+      }
+    };
+    return this.lock != null ? this._acquireLock(this.lockAcquireTimeout, run) : run();
+  }
+  async _regenerateRecoveryCodes() {
+    assertRecoveryCodesExperimentalEnabled(this.experimental);
+    try {
+      return await this._useSession(async (result) => {
+        var _a;
+        let { data: sessionData, error: sessionError } = result;
+        if (sessionError)
+          return this._returnResult({ data: null, error: sessionError });
+        let { data, error } = await _request(this.fetch, "POST", `${this.url}/factors/recovery-codes/regenerate`, {
+          headers: this.headers,
+          jwt: (_a = sessionData?.session) === null || _a === void 0 ? void 0 : _a.access_token
+        });
+        return error ? this._returnResult({ data: null, error }) : this._returnResult({ data, error: null });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _unenrollRecoveryCodes() {
+    assertRecoveryCodesExperimentalEnabled(this.experimental);
+    try {
+      return await this._useSession(async (result) => {
+        var _a;
+        let { data: sessionData, error: sessionError } = result;
+        if (sessionError)
+          return this._returnResult({ data: null, error: sessionError });
+        let { data, error } = await _request(this.fetch, "DELETE", `${this.url}/factors/recovery-codes`, {
+          headers: this.headers,
+          jwt: (_a = sessionData?.session) === null || _a === void 0 ? void 0 : _a.access_token
+        });
+        return error ? this._returnResult({ data: null, error }) : this._returnResult({ data, error: null });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _getAuthorizationDetails(authorizationId) {
+    try {
+      return await this._useSession(async (result) => {
+        let { data: { session }, error: sessionError } = result;
+        return sessionError ? this._returnResult({ data: null, error: sessionError }) : session ? await _request(this.fetch, "GET", `${this.url}/oauth/authorizations/${authorizationId}`, {
+          headers: this.headers,
+          jwt: session.access_token,
+          xform: (data) => ({ data, error: null })
+        }) : this._returnResult({ data: null, error: new AuthSessionMissingError() });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _approveAuthorization(authorizationId, options) {
+    try {
+      return await this._useSession(async (result) => {
+        let { data: { session }, error: sessionError } = result;
+        if (sessionError)
+          return this._returnResult({ data: null, error: sessionError });
+        if (!session)
+          return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+        let response = await _request(this.fetch, "POST", `${this.url}/oauth/authorizations/${authorizationId}/consent`, {
+          headers: this.headers,
+          jwt: session.access_token,
+          body: { action: "approve" },
+          xform: (data) => ({ data, error: null })
+        });
+        return response.data && response.data.redirect_url && isBrowser() && !options?.skipBrowserRedirect && window.location.assign(response.data.redirect_url), response;
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _denyAuthorization(authorizationId, options) {
+    try {
+      return await this._useSession(async (result) => {
+        let { data: { session }, error: sessionError } = result;
+        if (sessionError)
+          return this._returnResult({ data: null, error: sessionError });
+        if (!session)
+          return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+        let response = await _request(this.fetch, "POST", `${this.url}/oauth/authorizations/${authorizationId}/consent`, {
+          headers: this.headers,
+          jwt: session.access_token,
+          body: { action: "deny" },
+          xform: (data) => ({ data, error: null })
+        });
+        return response.data && response.data.redirect_url && isBrowser() && !options?.skipBrowserRedirect && window.location.assign(response.data.redirect_url), response;
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _listOAuthGrants() {
+    try {
+      return await this._useSession(async (result) => {
+        let { data: { session }, error: sessionError } = result;
+        return sessionError ? this._returnResult({ data: null, error: sessionError }) : session ? await _request(this.fetch, "GET", `${this.url}/user/oauth/grants`, {
+          headers: this.headers,
+          jwt: session.access_token,
+          xform: (data) => ({ data, error: null })
+        }) : this._returnResult({ data: null, error: new AuthSessionMissingError() });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _revokeOAuthGrant(options) {
+    try {
+      return await this._useSession(async (result) => {
+        let { data: { session }, error: sessionError } = result;
+        return sessionError ? this._returnResult({ data: null, error: sessionError }) : session ? (await _request(this.fetch, "DELETE", `${this.url}/user/oauth/grants`, {
+          headers: this.headers,
+          jwt: session.access_token,
+          query: { client_id: options.clientId },
+          noResolveJson: !0
+        }), { data: {}, error: null }) : this._returnResult({ data: null, error: new AuthSessionMissingError() });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async fetchJwk(kid, jwks = { keys: [] }) {
+    let jwk = jwks.keys.find((key) => key.kid === kid);
+    if (jwk)
+      return jwk;
+    let now = Date.now();
+    if (jwk = this.jwks.keys.find((key) => key.kid === kid), jwk && this.jwks_cached_at + JWKS_TTL > now)
+      return jwk;
+    let { data, error } = await _request(this.fetch, "GET", `${this.url}/.well-known/jwks.json`, {
+      headers: this.headers
+    });
+    if (error)
+      throw error;
+    return !data.keys || data.keys.length === 0 || (this.jwks = data, this.jwks_cached_at = now, jwk = data.keys.find((key) => key.kid === kid), !jwk) ? null : jwk;
+  }
+  async getClaims(jwt, options = {}) {
+    try {
+      let token = jwt;
+      if (!token) {
+        let { data, error } = await this.getSession();
+        if (error || !data.session)
+          return this._returnResult({ data: null, error });
+        token = data.session.access_token;
+      }
+      let { header, payload, signature, raw: { header: rawHeader, payload: rawPayload } } = decodeJWT(token);
+      if (!options?.allowExpired)
+        try {
+          validateExp(payload.exp);
+        } catch (e) {
+          throw new AuthInvalidJwtError(e instanceof Error ? e.message : "JWT validation failed");
+        }
+      let signingKey = !header.alg || header.alg.startsWith("HS") || !header.kid || !("crypto" in globalThis && "subtle" in globalThis.crypto) ? null : await this.fetchJwk(header.kid, options?.keys ? { keys: options.keys } : options?.jwks);
+      if (!signingKey) {
+        let { error } = await this.getUser(token);
+        if (error)
+          throw error;
+        return {
+          data: {
+            claims: payload,
+            header,
+            signature
+          },
+          error: null
+        };
+      }
+      let algorithm = getAlgorithm(header.alg), publicKey = await crypto.subtle.importKey("jwk", signingKey, algorithm, !0, [
+        "verify"
+      ]);
+      if (!await crypto.subtle.verify(algorithm, publicKey, signature, stringToUint8Array(`${rawHeader}.${rawPayload}`)))
+        throw new AuthInvalidJwtError("Invalid JWT signature");
+      return {
+        data: {
+          claims: payload,
+          header,
+          signature
+        },
+        error: null
+      };
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  // --- Passkey Methods ---
+  async signInWithPasskey(credentials) {
+    var _a, _b, _c;
+    assertPasskeyExperimentalEnabled(this.experimental);
+    try {
+      if (!browserSupportsWebAuthn())
+        return this._returnResult({
+          data: null,
+          error: new AuthUnknownError("Browser does not support WebAuthn", null)
+        });
+      let { data: options, error: optionsError } = await this._startPasskeyAuthentication({
+        options: { captchaToken: (_a = credentials?.options) === null || _a === void 0 ? void 0 : _a.captchaToken }
+      });
+      if (optionsError || !options)
+        return this._returnResult({ data: null, error: optionsError });
+      let publicKeyOptions = deserializeCredentialRequestOptions(options.options), signal = (_c = (_b = credentials?.options) === null || _b === void 0 ? void 0 : _b.signal) !== null && _c !== void 0 ? _c : webAuthnAbortService.createNewAbortSignal(), { data: credential, error: credentialError } = await getCredential({
+        publicKey: publicKeyOptions,
+        signal
+      });
+      if (credentialError || !credential)
+        return this._returnResult({
+          data: null,
+          error: credentialError ?? new AuthUnknownError("WebAuthn ceremony failed", null)
+        });
+      let serialized = serializeCredentialRequestResponse(credential);
+      return this._verifyPasskeyAuthentication({
+        challengeId: options.challenge_id,
+        credential: serialized
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async registerPasskey(credentials) {
+    var _a, _b;
+    assertPasskeyExperimentalEnabled(this.experimental);
+    try {
+      if (!browserSupportsWebAuthn())
+        return this._returnResult({
+          data: null,
+          error: new AuthUnknownError("Browser does not support WebAuthn", null)
+        });
+      let { data: options, error: optionsError } = await this._startPasskeyRegistration();
+      if (optionsError || !options)
+        return this._returnResult({ data: null, error: optionsError });
+      let publicKeyOptions = deserializeCredentialCreationOptions(options.options), signal = (_b = (_a = credentials?.options) === null || _a === void 0 ? void 0 : _a.signal) !== null && _b !== void 0 ? _b : webAuthnAbortService.createNewAbortSignal(), { data: credential, error: credentialError } = await createCredential({
+        publicKey: publicKeyOptions,
+        signal
+      });
+      if (credentialError || !credential)
+        return this._returnResult({
+          data: null,
+          error: credentialError ?? new AuthUnknownError("WebAuthn ceremony failed", null)
+        });
+      let serialized = serializeCredentialCreationResponse(credential);
+      return this._verifyPasskeyRegistration({
+        challengeId: options.challenge_id,
+        credential: serialized
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _startPasskeyRegistration() {
+    assertPasskeyExperimentalEnabled(this.experimental);
+    try {
+      return await this._useSession(async (result) => {
+        let { data: { session }, error: sessionError } = result;
+        if (sessionError)
+          return this._returnResult({ data: null, error: sessionError });
+        if (!session)
+          return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+        let { data, error } = await _request(this.fetch, "POST", `${this.url}/passkeys/registration/options`, {
+          headers: this.headers,
+          jwt: session.access_token,
+          body: {}
+        });
+        return error ? this._returnResult({ data: null, error }) : this._returnResult({ data, error: null });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _verifyPasskeyRegistration(params) {
+    assertPasskeyExperimentalEnabled(this.experimental);
+    try {
+      return await this._useSession(async (result) => {
+        let { data: { session }, error: sessionError } = result;
+        if (sessionError)
+          return this._returnResult({ data: null, error: sessionError });
+        if (!session)
+          return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+        let { data, error } = await _request(this.fetch, "POST", `${this.url}/passkeys/registration/verify`, {
+          headers: this.headers,
+          jwt: session.access_token,
+          body: {
+            challenge_id: params.challengeId,
+            credential: params.credential
+          }
+        });
+        return error ? this._returnResult({ data: null, error }) : this._returnResult({ data, error: null });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _startPasskeyAuthentication(params) {
+    var _a;
+    assertPasskeyExperimentalEnabled(this.experimental);
+    try {
+      let { data, error } = await _request(this.fetch, "POST", `${this.url}/passkeys/authentication/options`, {
+        headers: this.headers,
+        body: {
+          gotrue_meta_security: { captcha_token: (_a = params?.options) === null || _a === void 0 ? void 0 : _a.captchaToken }
+        }
+      });
+      return error ? this._returnResult({ data: null, error }) : this._returnResult({ data, error: null });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _verifyPasskeyAuthentication(params) {
+    assertPasskeyExperimentalEnabled(this.experimental);
+    try {
+      let { data, error } = await _request(this.fetch, "POST", `${this.url}/passkeys/authentication/verify`, {
+        headers: this.headers,
+        body: {
+          challenge_id: params.challengeId,
+          credential: params.credential
+        },
+        xform: _sessionResponse
+      });
+      return error ? this._returnResult({ data: null, error }) : (data.session && (await this._saveSession(data.session), await this._notifyAllSubscribers("SIGNED_IN", data.session)), this._returnResult({ data, error: null }));
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _listPasskeys() {
+    assertPasskeyExperimentalEnabled(this.experimental);
+    try {
+      return await this._useSession(async (result) => {
+        let { data: { session }, error: sessionError } = result;
+        if (sessionError)
+          return this._returnResult({ data: null, error: sessionError });
+        if (!session)
+          return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+        let { data, error } = await _request(this.fetch, "GET", `${this.url}/passkeys`, {
+          headers: this.headers,
+          jwt: session.access_token,
+          xform: (data2) => ({ data: data2, error: null })
+        });
+        return error ? this._returnResult({ data: null, error }) : this._returnResult({ data, error: null });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _updatePasskey(params) {
+    assertPasskeyExperimentalEnabled(this.experimental);
+    try {
+      return await this._useSession(async (result) => {
+        let { data: { session }, error: sessionError } = result;
+        if (sessionError)
+          return this._returnResult({ data: null, error: sessionError });
+        if (!session)
+          return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+        let { data, error } = await _request(this.fetch, "PATCH", `${this.url}/passkeys/${params.passkeyId}`, {
+          headers: this.headers,
+          jwt: session.access_token,
+          body: { friendly_name: params.friendlyName }
+        });
+        return error ? this._returnResult({ data: null, error }) : this._returnResult({ data, error: null });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+  async _deletePasskey(params) {
+    assertPasskeyExperimentalEnabled(this.experimental);
+    try {
+      return await this._useSession(async (result) => {
+        let { data: { session }, error: sessionError } = result;
+        if (sessionError)
+          return this._returnResult({ data: null, error: sessionError });
+        if (!session)
+          return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+        let { error } = await _request(this.fetch, "DELETE", `${this.url}/passkeys/${params.passkeyId}`, {
+          headers: this.headers,
+          jwt: session.access_token,
+          noResolveJson: !0
+        });
+        return error ? this._returnResult({ data: null, error }) : this._returnResult({ data: null, error: null });
+      });
+    } catch (error) {
+      if (isAuthError(error))
+        return this._returnResult({ data: null, error });
+      throw error;
+    }
+  }
+};
+GoTrueClient.nextInstanceID = {};
+var GoTrueClient_default = GoTrueClient;
+
+var AuthClient = GoTrueClient_default, AuthClient_default = AuthClient;
+export {
+  AuthClient_default as AuthClient
+};