@pontive/pontkit-loader 1.0.0

package/dist/core-elements-version.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The exact `@pontive/pontkit-core` release this build loads from the CDN.
+ *
+ * It is the version installed as a dev dependency when the package was built —
+ * i.e. the one the test suite ran against — baked in by `define` in
+ * vite.config.ts and vitest.config.ts (see scripts/core-elements-version.mjs).
+ * An exact version, never a range: an exact release is immutable on the CDN,
+ * cacheable forever, and the only form that admits an integrity hash.
+ *
+ * Nothing at runtime may replace this with "whatever is newest" — that is the
+ * defect it exists to end. The platform's runtime-config endpoint will be
+ * allowed to override it, because that answer is the one the platform has
+ * gated (pontive-spec/21-element-versioning-and-compatibility.md §9).
+ */
+export declare const CORE_ELEMENTS_VERSION: string;

package/dist/index.cjs

@@ -0,0 +1,2 @@
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const $=__CORE_ELEMENTS_VERSION__,U=["/__auth/auth/v1/runtime-config","/auth/v1/runtime-config"],j=1500,K=/^\d+\.\d+\.\d+$/;function F(t){return typeof t=="string"&&K.test(t)}function b(t){return typeof t=="string"&&/^https?:\/\//.test(t)}function P(t){return typeof t=="string"&&/^sha(256|384|512)-[A-Za-z0-9+/]+=*$/.test(t)}async function V(t={}){const a=t.fetchImpl??globalThis.fetch;if(typeof a!="function")return null;const l=t.urls??D(),d=t.timeoutMs??j;for(const e of l){const p=await W(a,e,d);if(p)return p}return null}function D(){return typeof window<"u"&&typeof window.__pontRuntimeConfigUrl=="string"?[window.__pontRuntimeConfigUrl]:U}async function W(t,a,l){const d=typeof AbortController=="function"?new AbortController:null,e=d?setTimeout(()=>d.abort(),l):null;try{const p=await t(a,{headers:{accept:"application/json"},signal:d?.signal});if(!p.ok)return null;const n=await p.json();if(!n||!F(n.core_elements_version))return null;const g={core_elements_version:n.core_elements_version,source:typeof n.source=="string"?n.source:void 0,catalog_revision:typeof n.catalog_revision=="number"?n.catalog_revision:void 0};return n.assets&&b(n.assets.js)&&b(n.assets.css)&&(g.assets={js:n.assets.js,css:n.assets.css}),n.integrity&&P(n.integrity.js)&&P(n.integrity.css)&&(g.integrity={js:n.integrity.js,css:n.integrity.css}),g}catch{return null}finally{e&&clearTimeout(e)}}let v=null,T=null;const S="@pontive/pontkit-core",q=[t=>`https://cdn.jsdelivr.net/npm/${S}@${t}/dist/index.mjs`,t=>`https://unpkg.com/${S}@${t}/dist/index.mjs`,t=>`https://esm.sh/${S}@${t}/dist/index.mjs`],z=[t=>`https://cdn.jsdelivr.net/npm/${S}@${t}/dist/styles.css`,t=>`https://unpkg.com/${S}@${t}/dist/styles.css`,t=>`https://esm.sh/${S}@${t}/dist/styles.css`],B=$;function X(t,a){return new Promise((l,d)=>{const e=document.createElement("link");e.rel="stylesheet",e.href=t,a&&(e.integrity=a,e.crossOrigin="anonymous"),e.onload=()=>l(),e.onerror=p=>d(p),document.head.appendChild(e)})}function Z(t,a){return new Promise((l,d)=>{const e=document.createElement("script");e.type="module",e.src=t,e.integrity=a,e.crossOrigin="anonymous",e.onload=()=>l(),e.onerror=()=>d(new Error(`core-elements module at ${t} failed to load or did not match its integrity hash`)),document.head.appendChild(e)}).then(()=>import(t))}async function x(){return typeof window>"u"||typeof document>"u"?null:window.__pontLoaded?window.__pontCoreSdk:window.__pontLoading?window.__pontLoading:(T||(T=J().catch(t=>{throw T=null,window.__pontLoading=void 0,t}),window.__pontLoading=T),T)}async function J(){const t=await V(),a=t?.core_elements_version??B,l=q.map(n=>n(a)),d=z.map(n=>n(a));t?.assets&&(l.unshift(t.assets.js),d.unshift(t.assets.css));const e=t?.integrity;let p=null;for(let n=0;n<l.length;n++){const g=l[n],G=d[n];try{let R=function(i){if(!i)return i;const C=[];let _=!1,m=null;const h=new Promise(o=>{m=o}),y=new Proxy(i,{get(o,c,f){if(c==="configure")return(...u)=>{const r=o.configure?.(...u);_=!0;try{C.forEach(({prop:w,args:I,resolve:A,reject:E})=>{try{const M=o[w].apply(o,I);M&&typeof M.then=="function"?M.then(A).catch(E):A(M)}catch(L){E(L)}})}catch{}C.length=0;try{y.__configured=!0}catch{}return m?.(),r};const s=o[c];return typeof s=="function"?(...u)=>{if(!_)return new Promise((r,w)=>{C.push({prop:c,args:u,resolve:r,reject:w})});try{return s.apply(o,u)}catch(r){throw r}}:s}});try{y.__whenConfigured=h,y.__configured=_}catch{}try{i.__whenConfigured=h,i.__configured=_;const o=i.configure;typeof o=="function"&&(i.configure=(...f)=>{const s=o.apply(i,f);_=!0;try{C.forEach(({prop:u,args:r,resolve:w,reject:I})=>{try{const E=i[u].apply(i,r);E&&typeof E.then=="function"?E.then(w).catch(I):w(E)}catch(A){I(A)}})}catch{}C.length=0;try{i.__configured=!0}catch{}return m?.(),s});const c=i.startLoginflow;typeof c=="function"&&(i.startLoginflow=(...f)=>_?c.apply(i,f):new Promise((s,u)=>{h.then(()=>{try{const r=c.apply(i,f);r&&typeof r.then=="function"?r.then(s).catch(u):s(r)}catch(r){u(r)}}).catch(()=>{try{const r=c.apply(i,f);r&&typeof r.then=="function"?r.then(s).catch(u):s(r)}catch(r){u(r)}})}))}catch{}try{h.then(()=>{setTimeout(()=>{try{document.querySelectorAll("pont-signin, pont-signup").forEach(o=>{try{if(o.__pontInitRetried)return;o.__pontInitRetried=!0;const c=o.__pontRetryInit;if(typeof c=="function"){try{c.call(o)}catch(f){console.error(f)}return}if(o.__pontFailedForConfig)try{o.connectedCallback?.()}catch(f){console.error(f)}}catch{}})}catch{}},0)})}catch{}return y};await X(G,e?.css);const k=e?await Z(g,e.js):await import(g),H=k.useAuthProvider?.(),N=R(H);try{k.Auth=N,k.useAuthProvider=()=>N}catch{}window.__pontCoreSdk={...k,Auth:N},v=window.__pontCoreSdk,window.__pontLoaded=!0,window.__pontLoading=void 0;try{const i=C=>{const _=customElements.get(C);if(!_)return;const m=_.prototype;if(m.__pontConfiguredPatched)return;m.__pontConfiguredPatched=!0;const h=m.connectedCallback;typeof h=="function"&&(m.connectedCallback=function(...y){const o=window.__pontCoreSdk?.Auth,c=o?.__whenConfigured,f=!!o?.__configured;if(c&&!f){c.then(()=>{try{h.apply(this,y)}catch(s){console.error(s)}}).catch(()=>{try{h.apply(this,y)}catch(s){console.error(s)}});return}try{h.apply(this,y)}catch(s){if(s&&typeof s.message=="string"&&s.message.includes("Auth.configure() must be called")&&c){c.then(()=>{try{h.apply(this,y)}catch(u){console.error(u)}});return}throw s}})};["pont-signin","pont-signup"].forEach(i)}catch{}return console.log(`PontKit Web Components loaded (${a}) from:`,g),v}catch(R){console.error(`Failed loading from ${g}`,R),p=R}}throw console.error("❌ Failed to load PontKit web components from all CDNs.",p),p}let O=null;async function Q(){typeof window>"u"||window.__pontCoreSdk?.openAccountSettingsModal||(O||(O=x().then(()=>{window.__pontCoreSdk?.openAccountSettingsModal||console.warn("[pontive-react] Core sdk loaded but modal functions are missing.")}).catch(t=>{throw console.error("[pontive-react] Failed to load core SDK:",t),t})),await O)}exports.CORE_ELEMENTS_VERSION=$;exports.RUNTIME_CONFIG_PATHS=U;exports.RUNTIME_CONFIG_TIMEOUT_MS=j;exports.ensureCoreSdkLoaded=Q;exports.fetchRuntimeConfig=V;exports.isExactVersion=F;exports.isSriHash=P;exports.loadWebComponents=x;
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","sources":["../src/core-elements-version.ts","../src/runtime-config.ts","../src/load-web-components.ts","../src/sdk-loaded.ts"],"sourcesContent":["/**\n * The exact `@pontive/pontkit-core` release this build loads from the CDN.\n *\n * It is the version installed as a dev dependency when the package was built —\n * i.e. the one the test suite ran against — baked in by `define` in\n * vite.config.ts and vitest.config.ts (see scripts/core-elements-version.mjs).\n * An exact version, never a range: an exact release is immutable on the CDN,\n * cacheable forever, and the only form that admits an integrity hash.\n *\n * Nothing at runtime may replace this with \"whatever is newest\" — that is the\n * defect it exists to end. The platform's runtime-config endpoint will be\n * allowed to override it, because that answer is the one the platform has\n * gated (pontive-spec/21-element-versioning-and-compatibility.md §9).\n */\nexport const CORE_ELEMENTS_VERSION: string = __CORE_ELEMENTS_VERSION__;\n","// Which @pontive/pontkit-core release to load, asked of the platform.\n//\n// The platform decides which release a project's screens render with — one\n// deployment default, an optional per-project canary — and publishes the answer\n// at `GET /auth/v1/runtime-config` on the project's auth server\n// (pontive-spec/21-element-versioning-and-compatibility.md §9). This package\n// reads it once, before importing the bundle, so an embedded widget renders\n// with the same release the hosted login pages do. The build-time stamp\n// (CORE_ELEMENTS_VERSION) is the fallback when the answer cannot be read.\n//\n// The endpoint is reached through the app's own origin when the SDK's proxy is\n// mounted (`/__auth/auth/v1/...`), and directly on `/auth/v1/...` when the app\n// itself runs on the auth domain. Both are tried; a host page can name a URL\n// outright with `window.__pontRuntimeConfigUrl`.\n\n/** The shape of GET /auth/v1/runtime-config. */\nexport interface RuntimeConfig {\n  core_elements_version: string;\n  catalog_revision?: number;\n  source?: string;\n  assets?: { js: string; css: string };\n  /**\n   * Subresource-integrity hashes (\"sha384-…\") of the release's module and\n   * stylesheet, recorded by the platform when the release was gated. When\n   * present the loader passes them to the browser, which refuses bytes that\n   * differ — from the platform origin or from any public CDN alike.\n   */\n  integrity?: { js: string; css: string };\n}\n\nexport const RUNTIME_CONFIG_PATHS = [\n  \"/__auth/auth/v1/runtime-config\",\n  \"/auth/v1/runtime-config\",\n] as const;\n\n/** How long to wait for the platform before loading the stamped release. */\nexport const RUNTIME_CONFIG_TIMEOUT_MS = 1500;\n\nconst EXACT_VERSION = /^\\d+\\.\\d+\\.\\d+$/;\n\nexport interface FetchRuntimeConfigOptions {\n  fetchImpl?: typeof fetch;\n  urls?: readonly string[];\n  timeoutMs?: number;\n}\n\n/** Whether `value` names one release rather than a range or garbage. */\nexport function isExactVersion(value: unknown): value is string {\n  return typeof value === \"string\" && EXACT_VERSION.test(value);\n}\n\nfunction isHttpUrl(value: unknown): value is string {\n  return typeof value === \"string\" && /^https?:\\/\\//.test(value);\n}\n\n/** Whether `value` is a well-formed SRI value the browser will accept. */\nexport function isSriHash(value: unknown): value is string {\n  return typeof value === \"string\" && /^sha(256|384|512)-[A-Za-z0-9+/]+=*$/.test(value);\n}\n\n/**\n * Reads the platform's runtime config, or null when no candidate URL answers\n * with one that can be trusted. Never throws: the caller's fallback is the\n * stamped release, and a reachability problem should not become a page error.\n */\nexport async function fetchRuntimeConfig(\n  options: FetchRuntimeConfigOptions = {},\n): Promise<RuntimeConfig | null> {\n  const fetchImpl = options.fetchImpl ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") return null;\n\n  const urls = options.urls ?? candidateUrls();\n  const timeoutMs = options.timeoutMs ?? RUNTIME_CONFIG_TIMEOUT_MS;\n\n  for (const url of urls) {\n    const config = await readOne(fetchImpl, url, timeoutMs);\n    if (config) return config;\n  }\n\n  return null;\n}\n\nfunction candidateUrls(): readonly string[] {\n  if (typeof window !== \"undefined\" && typeof window.__pontRuntimeConfigUrl === \"string\") {\n    return [window.__pontRuntimeConfigUrl];\n  }\n\n  return RUNTIME_CONFIG_PATHS;\n}\n\nasync function readOne(\n  fetchImpl: typeof fetch,\n  url: string,\n  timeoutMs: number,\n): Promise<RuntimeConfig | null> {\n  const controller = typeof AbortController === \"function\" ? new AbortController() : null;\n  const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;\n\n  try {\n    const response = await fetchImpl(url, {\n      headers: { accept: \"application/json\" },\n      signal: controller?.signal,\n    });\n    if (!response.ok) return null;\n\n    const body = (await response.json()) as Partial<RuntimeConfig> | null;\n    if (!body || !isExactVersion(body.core_elements_version)) return null;\n\n    const config: RuntimeConfig = {\n      core_elements_version: body.core_elements_version,\n      source: typeof body.source === \"string\" ? body.source : undefined,\n      catalog_revision:\n        typeof body.catalog_revision === \"number\" ? body.catalog_revision : undefined,\n    };\n\n    // Assets are taken only as a pair of absolute URLs; anything else means\n    // \"load from the CDN list by version\".\n    if (body.assets && isHttpUrl(body.assets.js) && isHttpUrl(body.assets.css)) {\n      config.assets = { js: body.assets.js, css: body.assets.css };\n    }\n\n    // Half a pair is no pair: the browser would check one file and not the\n    // other, and nobody would notice the unchecked one.\n    if (body.integrity && isSriHash(body.integrity.js) && isSriHash(body.integrity.css)) {\n      config.integrity = { js: body.integrity.js, css: body.integrity.css };\n    }\n\n    return config;\n  } catch {\n    return null;\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n","import { CORE_ELEMENTS_VERSION } from \"./core-elements-version\";\nimport { fetchRuntimeConfig } from \"./runtime-config\";\n\nlet coreSdk: any = null;\n\n// The load in flight, if any. This is the guard, and it is a promise rather\n// than a boolean on purpose: a flag set before the first `await` let a second\n// concurrent caller return `coreSdk` while it was still null, log that the\n// SDK's modal functions were missing, and carry on as if it were ready. A\n// promise gives every caller the same eventual answer. It is cleared on failure\n// so a later call can retry rather than inherit a latched failure.\nlet loadPromise: Promise<any> | null = null;\n\nconst PACKAGE_NAME = \"@pontive/pontkit-core\";\n\n// Base CDN templates (version will be injected)\nconst CDN_TEMPLATES = [\n  (v: string) =>\n    `https://cdn.jsdelivr.net/npm/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n  (v: string) => `https://unpkg.com/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n  (v: string) => `https://esm.sh/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n];\n\nconst CSS_TEMPLATES = [\n  (v: string) =>\n    `https://cdn.jsdelivr.net/npm/${PACKAGE_NAME}@${v}/dist/styles.css`,\n  (v: string) => `https://unpkg.com/${PACKAGE_NAME}@${v}/dist/styles.css`,\n  (v: string) => `https://esm.sh/${PACKAGE_NAME}@${v}/dist/styles.css`,\n];\n\n// Which release loads is decided by the PLATFORM, and failing that at BUILD\n// time — never by asking a registry at runtime. This package used to fetch jsDelivr's version list and take the\n// newest entry of any major — the `1.x` filter had been commented out — with\n// `^1` as the fallback when the fetch failed, a different major from the 2.x\n// the wrappers target. Whatever npm happened to hold newest is not a version\n// anyone tested against, and a customer's page picked it up on the next reload\n// with nothing in their build having changed.\n//\n// Now the project's auth server says which release its screens load\n// (GET /auth/v1/runtime-config, see ./runtime-config.ts), so an embedded widget\n// renders with the same bundle the hosted login pages do, and a canary or a\n// promotion reaches it without a rebuild. CORE_ELEMENTS_VERSION — the exact\n// release this package was built and tested with — is the fallback when that\n// endpoint cannot be read.\nconst FALLBACK_VERSION = CORE_ELEMENTS_VERSION;\n\nfunction loadCss(url: string, integrity?: string) {\n  return new Promise<void>((resolve, reject) => {\n    const link = document.createElement(\"link\");\n    link.rel = \"stylesheet\";\n    link.href = url;\n    if (integrity) {\n      // SRI is only enforced on a CORS-mode fetch; the platform origin and the\n      // public CDNs all answer with Access-Control-Allow-Origin: *.\n      link.integrity = integrity;\n      link.crossOrigin = \"anonymous\";\n    }\n    link.onload = () => resolve();\n    link.onerror = (err) => reject(err);\n    document.head.appendChild(link);\n  });\n}\n\n// Loads the module through a <script type=\"module\"> carrying the integrity\n// attribute, then imports it. A dynamic import() cannot carry SRI, but the\n// script element can, and once it has fetched and verified the module the\n// browser's module map holds it under that URL — the import() that follows\n// resolves from the map without a second fetch. A hash mismatch fails the\n// script's load, the promise rejects, and the loader moves to the next\n// source, which is the right outcome: bytes the platform did not gate must not\n// run, wherever they came from.\nfunction loadVerifiedModule(url: string, integrity: string): Promise<any> {\n  return new Promise<void>((resolve, reject) => {\n    const script = document.createElement(\"script\");\n    script.type = \"module\";\n    script.src = url;\n    script.integrity = integrity;\n    script.crossOrigin = \"anonymous\";\n    script.onload = () => resolve();\n    script.onerror = () =>\n      reject(new Error(`core-elements module at ${url} failed to load or did not match its integrity hash`));\n    document.head.appendChild(script);\n  }).then(\n    () =>\n      import(\n        /* webpackIgnore: true */\n        /* turbopackIgnore: true */\n        /* @vite-ignore */\n        url\n      ),\n  );\n}\n\nexport async function loadWebComponents(): Promise<any> {\n  // No DOM means no custom elements to define and no CDN to fetch from.\n  //\n  // Returning rather than throwing matters because src/index.ts calls this at\n  // module scope: under a server renderer the rejection surfaced as a console\n  // error on every render, reporting a failure that is not one. Checked before\n  // the guards below so the browser still loads normally after hydration.\n  if (typeof window === \"undefined\" || typeof document === \"undefined\") {\n    return null;\n  }\n\n  // Another copy of this package on the same page already finished loading.\n  if (window.__pontLoaded) {\n    return window.__pontCoreSdk;\n  }\n\n  // Another copy of this package on the same page is loading right now.\n  if (window.__pontLoading) {\n    return window.__pontLoading;\n  }\n\n  if (!loadPromise) {\n    loadPromise = loadFromCdn().catch((err) => {\n      loadPromise = null;\n      window.__pontLoading = undefined;\n      throw err;\n    });\n\n    window.__pontLoading = loadPromise;\n  }\n\n  return loadPromise;\n}\n\nasync function loadFromCdn(): Promise<any> {\n  const runtime = await fetchRuntimeConfig();\n  const resolvedVersion = runtime?.core_elements_version ?? FALLBACK_VERSION;\n\n  const CDN_SOURCES = CDN_TEMPLATES.map((fn) => fn(resolvedVersion));\n  const CSS_SOURCES = CSS_TEMPLATES.map((fn) => fn(resolvedVersion));\n\n  // The platform's own asset location goes first when it names one; the public\n  // CDNs stay as the fallback list for the same version.\n  if (runtime?.assets) {\n    CDN_SOURCES.unshift(runtime.assets.js);\n    CSS_SOURCES.unshift(runtime.assets.css);\n  }\n\n  // The hashes describe the npm release's bytes, which every source below\n  // serves verbatim, so they apply to all of them — not only to the\n  // platform's. A source whose bytes differ is a source that must not run.\n  const integrity = runtime?.integrity;\n\n  let lastError: unknown = null;\n\n  for (let i = 0; i < CDN_SOURCES.length; i++) {\n    const cdn = CDN_SOURCES[i];\n    const cssCdn = CSS_SOURCES[i];\n\n    try {\n      // 2️⃣ Load CSS first\n      await loadCss(cssCdn, integrity?.css);\n\n      // 3️⃣ Load JS module\n      //\n      // All three ignore directives, and none of them is optional.\n      //\n      // `cdn` is a full URL resolved at runtime, so a bundler that tries to\n      // resolve it statically cannot: webpack and Turbopack turn a dynamic\n      // import with a variable specifier into a module-graph lookup and throw\n      // `Cannot find module 'https://…'` at runtime — no network request is ever\n      // made, and the message reads as though the CDN were at fault. Next.js\n      // uses Turbopack in development and webpack in production, so an app\n      // built with it failed on every CDN in the list identically.\n      //\n      // `@vite-ignore` alone covered only Vite. Each bundler reads its own\n      // comment and ignores the others, so all three coexist and each one keeps\n      // this a real runtime import.\n      const module: any = integrity\n        ? await loadVerifiedModule(cdn, integrity.js)\n        : await import(\n            /* webpackIgnore: true */\n            /* turbopackIgnore: true */\n            /* @vite-ignore */\n            cdn\n          );\n\n      // 4️⃣ Expose globally\n      // Wrap Auth so calls made before `configure()` won't throw. Instead\n      // we queue them and flush once configure() is called by the provider.\n      function createSafeAuth(auth: any) {\n        if (!auth) return auth;\n        type QItem = {\n          prop: string | symbol;\n          args: any[];\n          resolve: (v: any) => void;\n          reject: (e: any) => void;\n        };\n        const queue: QItem[] = [];\n        let configured = false;\n\n        // Expose a configured promise and flag on the proxy so other parts\n        // of the app can wait for Auth to be configured (helps avoid errors\n        // thrown by custom elements that start flows on connect).\n        let resolveWhenConfigured: (() => void) | null = null;\n        const whenConfigured = new Promise<void>((res) => {\n          resolveWhenConfigured = res;\n        });\n\n        const proxy = new Proxy(auth, {\n          get(target, prop, receiver) {\n            if (prop === \"configure\") {\n              return (...args: any[]) => {\n                const res = (target as any).configure?.(...args);\n                configured = true;\n                try {\n                  // flush queued calls\n                  queue.forEach(({ prop: p, args: a, resolve, reject }) => {\n                    try {\n                      const fn = (target as any)[p];\n                      const r = fn.apply(target, a);\n                      if (r && typeof r.then === \"function\") {\n                        r.then(resolve).catch(reject);\n                      } else {\n                        resolve(r);\n                      }\n                    } catch (err) {\n                      reject(err);\n                    }\n                  });\n                } catch (e) {\n                  // ignore flushing errors\n                }\n                queue.length = 0;\n                // mark proxy as configured and resolve the promise\n                try {\n                  (proxy as any).__configured = true;\n                } catch (e) {\n                  /* ignore */\n                }\n                resolveWhenConfigured?.();\n                return res;\n              };\n            }\n\n            const val = (target as any)[prop];\n            if (typeof val === \"function\") {\n              return (...args: any[]) => {\n                if (!configured) {\n                  // queue the call and return a Promise that resolves when flushed\n                  return new Promise((resolve, reject) => {\n                    queue.push({ prop, args, resolve, reject });\n                  });\n                }\n                try {\n                  return val.apply(target, args);\n                } catch (e) {\n                  // preserve throwing behavior for already-configured\n                  throw e;\n                }\n              };\n            }\n            return val;\n          },\n        });\n\n        // Attach the whenConfigured promise and configured flag to the proxy\n        try {\n          (proxy as any).__whenConfigured = whenConfigured;\n          (proxy as any).__configured = configured;\n        } catch (e) {\n          /* ignore */\n        }\n\n        // Also patch the original `auth` object (if present) so that direct\n        // imports and in-module usages get queued behavior too. This ensures\n        // that calls like `Auth.startLoginflow()` won't throw even if they\n        // happen before `configure()` is invoked.\n        try {\n          // Mark the original with the same hooks\n          (auth as any).__whenConfigured = whenConfigured;\n          (auth as any).__configured = configured;\n\n          const origConfigure = (auth as any).configure;\n          if (typeof origConfigure === \"function\") {\n            (auth as any).configure = (...args: any[]) => {\n              const res = origConfigure.apply(auth, args);\n              configured = true;\n              try {\n                queue.forEach(({ prop: p, args: a, resolve, reject }) => {\n                  try {\n                    const fn = (auth as any)[p];\n                    const r = fn.apply(auth, a);\n                    if (r && typeof r.then === \"function\") {\n                      r.then(resolve).catch(reject);\n                    } else {\n                      resolve(r);\n                    }\n                  } catch (err) {\n                    reject(err);\n                  }\n                });\n              } catch (e) {\n                /* ignore */\n              }\n              queue.length = 0;\n              try {\n                (auth as any).__configured = true;\n              } catch (e) {\n                /* ignore */\n              }\n              resolveWhenConfigured?.();\n              return res;\n            };\n          }\n\n          const origStart = (auth as any).startLoginflow;\n          if (typeof origStart === \"function\") {\n            (auth as any).startLoginflow = (...args: any[]) => {\n              if (!configured) {\n                return new Promise((resolve, reject) => {\n                  whenConfigured\n                    .then(() => {\n                      try {\n                        const r = origStart.apply(auth, args);\n                        if (r && typeof r.then === \"function\") {\n                          r.then(resolve).catch(reject);\n                        } else {\n                          resolve(r);\n                        }\n                      } catch (err) {\n                        reject(err);\n                      }\n                    })\n                    .catch(() => {\n                      try {\n                        const r = origStart.apply(auth, args);\n                        if (r && typeof r.then === \"function\") {\n                          r.then(resolve).catch(reject);\n                        } else {\n                          resolve(r);\n                        }\n                      } catch (err) {\n                        reject(err);\n                      }\n                    });\n                });\n              }\n\n              return origStart.apply(auth, args);\n            };\n          }\n        } catch (e) {\n          /* ignore */\n        }\n\n        // When auth is configured, call an explicit retry method on any\n        // sign-in/up elements that implement it. Prefer an explicit retry\n        // API so elements can be idempotent and avoid duplicate flows.\n        try {\n          whenConfigured.then(() => {\n            setTimeout(() => {\n              try {\n                document\n                  .querySelectorAll(\"pont-signin, pont-signup\")\n                  .forEach((el) => {\n                    try {\n                      if ((el as any).__pontInitRetried) return;\n                      (el as any).__pontInitRetried = true;\n                      // Prefer an explicit retry API implemented by the element\n                      // (e.g., `__pontRetryInit`) to avoid re-running the\n                      // entire `connectedCallback` which may cause duplicates.\n                      const retry = (el as any).__pontRetryInit;\n                      if (typeof retry === \"function\") {\n                        try {\n                          retry.call(el);\n                        } catch (e) {\n                          console.error(e);\n                        }\n                        return;\n                      }\n\n                      // Fallback: only call connectedCallback if the element\n                      // provides an explicit flag saying it previously failed\n                      // due to missing Auth (set by our connectedCallback wrapper\n                      // when we detect that specific error).\n                      if ((el as any).__pontFailedForConfig) {\n                        try {\n                          (el as any).connectedCallback?.();\n                        } catch (e) {\n                          console.error(e);\n                        }\n                      }\n                    } catch (_) {\n                      // ignore per-element errors\n                    }\n                  });\n              } catch (_) {\n                /* ignore */\n              }\n            }, 0);\n          });\n        } catch (e) {\n          /* ignore */\n        }\n\n        return proxy;\n      }\n\n      // Replace module exports so consumers that import `Auth` directly\n      // get the safe proxy as well. Also ensure `useAuthProvider()` returns\n      // the proxy.\n      const realAuth = module.useAuthProvider?.();\n      const safeAuth = createSafeAuth(realAuth);\n\n      try {\n        (module as any).Auth = safeAuth;\n        (module as any).useAuthProvider = () => safeAuth;\n      } catch (e) {\n        /* ignore */\n      }\n\n      window.__pontCoreSdk = {\n        ...module,\n        Auth: safeAuth,\n      };\n\n      coreSdk = window.__pontCoreSdk;\n\n      // Set only once the SDK is actually on the window, so a copy of this\n      // package that sees the flag can trust what it reads next to it.\n      window.__pontLoaded = true;\n      window.__pontLoading = undefined;\n\n      // Patch known elements that may start flows on connect so they wait\n      // for Auth to be configured instead of throwing. This avoids noisy\n      // runtime errors like \"Auth.configure() must be called\".\n      try {\n        const patchElement = (tagName: string) => {\n          const ctor = customElements.get(tagName);\n          if (!ctor) return;\n          const proto = ctor.prototype as any;\n          if (proto.__pontConfiguredPatched) return;\n          proto.__pontConfiguredPatched = true;\n\n          const orig = proto.connectedCallback;\n          if (typeof orig !== \"function\") return;\n\n          proto.connectedCallback = function (...args: any[]) {\n            const auth = window.__pontCoreSdk?.Auth as any;\n            const whenConfigured = auth?.__whenConfigured as\n              | Promise<void>\n              | undefined;\n            const configured = !!auth?.__configured;\n\n            if (whenConfigured && !configured) {\n              // delay initial connect work until Auth is configured\n              whenConfigured\n                .then(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (e) {\n                    console.error(e);\n                  }\n                })\n                .catch(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (e) {\n                    console.error(e);\n                  }\n                });\n              return;\n            }\n\n            try {\n              orig.apply(this, args);\n            } catch (e: any) {\n              // If it still throws with the configure error, retry after configured\n              if (\n                e &&\n                typeof e.message === \"string\" &&\n                e.message.includes(\"Auth.configure() must be called\") &&\n                whenConfigured\n              ) {\n                whenConfigured.then(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (err) {\n                    console.error(err);\n                  }\n                });\n                return;\n              }\n              throw e;\n            }\n          };\n        };\n\n        // Elements known to start auth flows on connect\n        [\"pont-signin\", \"pont-signup\"].forEach(patchElement);\n      } catch (e) {\n        /* ignore patch errors */\n      }\n\n      console.log(\n        `PontKit Web Components loaded (${resolvedVersion}) from:`,\n        cdn,\n      );\n\n      return coreSdk;\n    } catch (err) {\n      console.error(`Failed loading from ${cdn}`, err);\n      lastError = err;\n    }\n  }\n\n  console.error(\n    \"❌ Failed to load PontKit web components from all CDNs.\",\n    lastError,\n  );\n  throw lastError;\n}\n","import { loadWebComponents } from \"./load-web-components\";\n\nlet coreSdkLoadPromise: Promise<void> | null = null;\n\n/**\n * Ensures the core SDK is loaded and the global functions are available.\n * Returns a promise that resolves when the SDK is ready.\n */\nexport async function ensureCoreSdkLoaded(): Promise<void> {\n  // Nothing to ensure without a browser, and the check below would throw before\n  // reaching loadWebComponents' own guard.\n  if (typeof window === \"undefined\") {\n    return;\n  }\n\n  // If the functions already exist, we're done.\n  if (window.__pontCoreSdk?.openAccountSettingsModal) {\n    return;\n  }\n\n  // Otherwise, start loading the SDK if not already loading.\n  if (!coreSdkLoadPromise) {\n    coreSdkLoadPromise = loadWebComponents()\n      .then(() => {\n        // The first SDK script attaches the functions synchronously when it executes.\n        if (!window.__pontCoreSdk?.openAccountSettingsModal) {\n          console.warn(\n            \"[pontive-react] Core sdk loaded but modal functions are missing.\",\n          );\n        }\n      })\n      .catch((err) => {\n        console.error(\"[pontive-react] Failed to load core SDK:\", err);\n        throw err;\n      });\n  }\n\n  await coreSdkLoadPromise;\n}\n"],"names":["CORE_ELEMENTS_VERSION","RUNTIME_CONFIG_PATHS","RUNTIME_CONFIG_TIMEOUT_MS","EXACT_VERSION","isExactVersion","value","isHttpUrl","isSriHash","fetchRuntimeConfig","options","fetchImpl","urls","candidateUrls","timeoutMs","url","config","readOne","controller","timer","response","body","coreSdk","loadPromise","PACKAGE_NAME","CDN_TEMPLATES","v","CSS_TEMPLATES","FALLBACK_VERSION","loadCss","integrity","resolve","reject","link","err","loadVerifiedModule","script","loadWebComponents","loadFromCdn","runtime","resolvedVersion","CDN_SOURCES","fn","CSS_SOURCES","lastError","i","cdn","cssCdn","createSafeAuth","auth","queue","configured","resolveWhenConfigured","whenConfigured","res","proxy","target","prop","receiver","args","p","a","r","val","e","origConfigure","origStart","el","retry","module","realAuth","safeAuth","patchElement","tagName","ctor","proto","orig","coreSdkLoadPromise","ensureCoreSdkLoaded"],"mappings":"gFAcO,MAAMA,EAAgC,0BCgBhCC,EAAuB,CAClC,iCACA,yBACF,EAGaC,EAA4B,KAEnCC,EAAgB,kBASf,SAASC,EAAeC,EAAiC,CAC9D,OAAO,OAAOA,GAAU,UAAYF,EAAc,KAAKE,CAAK,CAC9D,CAEA,SAASC,EAAUD,EAAiC,CAClD,OAAO,OAAOA,GAAU,UAAY,eAAe,KAAKA,CAAK,CAC/D,CAGO,SAASE,EAAUF,EAAiC,CACzD,OAAO,OAAOA,GAAU,UAAY,sCAAsC,KAAKA,CAAK,CACtF,CAOA,eAAsBG,EACpBC,EAAqC,GACN,CAC/B,MAAMC,EAAYD,EAAQ,WAAa,WAAW,MAClD,GAAI,OAAOC,GAAc,WAAY,OAAO,KAE5C,MAAMC,EAAOF,EAAQ,MAAQG,EAAA,EACvBC,EAAYJ,EAAQ,WAAaP,EAEvC,UAAWY,KAAOH,EAAM,CACtB,MAAMI,EAAS,MAAMC,EAAQN,EAAWI,EAAKD,CAAS,EACtD,GAAIE,EAAQ,OAAOA,CACrB,CAEA,OAAO,IACT,CAEA,SAASH,GAAmC,CAC1C,OAAI,OAAO,OAAW,KAAe,OAAO,OAAO,wBAA2B,SACrE,CAAC,OAAO,sBAAsB,EAGhCX,CACT,CAEA,eAAee,EACbN,EACAI,EACAD,EAC+B,CAC/B,MAAMI,EAAa,OAAO,iBAAoB,WAAa,IAAI,gBAAoB,KAC7EC,EAAQD,EAAa,WAAW,IAAMA,EAAW,MAAA,EAASJ,CAAS,EAAI,KAE7E,GAAI,CACF,MAAMM,EAAW,MAAMT,EAAUI,EAAK,CACpC,QAAS,CAAE,OAAQ,kBAAA,EACnB,OAAQG,GAAY,MAAA,CACrB,EACD,GAAI,CAACE,EAAS,GAAI,OAAO,KAEzB,MAAMC,EAAQ,MAAMD,EAAS,KAAA,EAC7B,GAAI,CAACC,GAAQ,CAAChB,EAAegB,EAAK,qBAAqB,EAAG,OAAO,KAEjE,MAAML,EAAwB,CAC5B,sBAAuBK,EAAK,sBAC5B,OAAQ,OAAOA,EAAK,QAAW,SAAWA,EAAK,OAAS,OACxD,iBACE,OAAOA,EAAK,kBAAqB,SAAWA,EAAK,iBAAmB,MAAA,EAKxE,OAAIA,EAAK,QAAUd,EAAUc,EAAK,OAAO,EAAE,GAAKd,EAAUc,EAAK,OAAO,GAAG,IACvEL,EAAO,OAAS,CAAE,GAAIK,EAAK,OAAO,GAAI,IAAKA,EAAK,OAAO,GAAA,GAKrDA,EAAK,WAAab,EAAUa,EAAK,UAAU,EAAE,GAAKb,EAAUa,EAAK,UAAU,GAAG,IAChFL,EAAO,UAAY,CAAE,GAAIK,EAAK,UAAU,GAAI,IAAKA,EAAK,UAAU,GAAA,GAG3DL,CACT,MAAQ,CACN,OAAO,IACT,QAAA,CACMG,gBAAoBA,CAAK,CAC/B,CACF,CClIA,IAAIG,EAAe,KAQfC,EAAmC,KAEvC,MAAMC,EAAe,wBAGfC,EAAgB,CACnBC,GACC,gCAAgCF,CAAY,IAAIE,CAAC,kBAClDA,GAAc,qBAAqBF,CAAY,IAAIE,CAAC,kBACpDA,GAAc,kBAAkBF,CAAY,IAAIE,CAAC,iBACpD,EAEMC,EAAgB,CACnBD,GACC,gCAAgCF,CAAY,IAAIE,CAAC,mBAClDA,GAAc,qBAAqBF,CAAY,IAAIE,CAAC,mBACpDA,GAAc,kBAAkBF,CAAY,IAAIE,CAAC,kBACpD,EAgBME,EAAmB3B,EAEzB,SAAS4B,EAAQd,EAAae,EAAoB,CAChD,OAAO,IAAI,QAAc,CAACC,EAASC,IAAW,CAC5C,MAAMC,EAAO,SAAS,cAAc,MAAM,EAC1CA,EAAK,IAAM,aACXA,EAAK,KAAOlB,EACRe,IAGFG,EAAK,UAAYH,EACjBG,EAAK,YAAc,aAErBA,EAAK,OAAS,IAAMF,EAAA,EACpBE,EAAK,QAAWC,GAAQF,EAAOE,CAAG,EAClC,SAAS,KAAK,YAAYD,CAAI,CAChC,CAAC,CACH,CAUA,SAASE,EAAmBpB,EAAae,EAAiC,CACxE,OAAO,IAAI,QAAc,CAACC,EAASC,IAAW,CAC5C,MAAMI,EAAS,SAAS,cAAc,QAAQ,EAC9CA,EAAO,KAAO,SACdA,EAAO,IAAMrB,EACbqB,EAAO,UAAYN,EACnBM,EAAO,YAAc,YACrBA,EAAO,OAAS,IAAML,EAAA,EACtBK,EAAO,QAAU,IACfJ,EAAO,IAAI,MAAM,2BAA2BjB,CAAG,qDAAqD,CAAC,EACvG,SAAS,KAAK,YAAYqB,CAAM,CAClC,CAAC,EAAE,KACD,IACE,OAIErB,EAAA,CAGR,CAEA,eAAsBsB,GAAkC,CAOtD,OAAI,OAAO,OAAW,KAAe,OAAO,SAAa,IAChD,KAIL,OAAO,aACF,OAAO,cAIZ,OAAO,cACF,OAAO,eAGXd,IACHA,EAAce,EAAA,EAAc,MAAOJ,GAAQ,CACzC,MAAAX,EAAc,KACd,OAAO,cAAgB,OACjBW,CACR,CAAC,EAED,OAAO,cAAgBX,GAGlBA,EACT,CAEA,eAAee,GAA4B,CACzC,MAAMC,EAAU,MAAM9B,EAAA,EAChB+B,EAAkBD,GAAS,uBAAyBX,EAEpDa,EAAchB,EAAc,IAAKiB,GAAOA,EAAGF,CAAe,CAAC,EAC3DG,EAAchB,EAAc,IAAKe,GAAOA,EAAGF,CAAe,CAAC,EAI7DD,GAAS,SACXE,EAAY,QAAQF,EAAQ,OAAO,EAAE,EACrCI,EAAY,QAAQJ,EAAQ,OAAO,GAAG,GAMxC,MAAMT,EAAYS,GAAS,UAE3B,IAAIK,EAAqB,KAEzB,QAASC,EAAI,EAAGA,EAAIJ,EAAY,OAAQI,IAAK,CAC3C,MAAMC,EAAML,EAAYI,CAAC,EACnBE,EAASJ,EAAYE,CAAC,EAE5B,GAAI,CA+BF,IAASG,EAAT,SAAwBC,EAAW,CACjC,GAAI,CAACA,EAAM,OAAOA,EAOlB,MAAMC,EAAiB,CAAA,EACvB,IAAIC,EAAa,GAKbC,EAA6C,KACjD,MAAMC,EAAiB,IAAI,QAAeC,GAAQ,CAChDF,EAAwBE,CAC1B,CAAC,EAEKC,EAAQ,IAAI,MAAMN,EAAM,CAC5B,IAAIO,EAAQC,EAAMC,EAAU,CAC1B,GAAID,IAAS,YACX,MAAO,IAAIE,IAAgB,CACzB,MAAML,EAAOE,EAAe,YAAY,GAAGG,CAAI,EAC/CR,EAAa,GACb,GAAI,CAEFD,EAAM,QAAQ,CAAC,CAAE,KAAMU,EAAG,KAAMC,EAAG,QAAA9B,EAAS,OAAAC,KAAa,CACvD,GAAI,CAEF,MAAM8B,EADMN,EAAeI,CAAC,EACf,MAAMJ,EAAQK,CAAC,EACxBC,GAAK,OAAOA,EAAE,MAAS,WACzBA,EAAE,KAAK/B,CAAO,EAAE,MAAMC,CAAM,EAE5BD,EAAQ+B,CAAC,CAEb,OAAS5B,EAAK,CACZF,EAAOE,CAAG,CACZ,CACF,CAAC,CACH,MAAY,CAEZ,CACAgB,EAAM,OAAS,EAEf,GAAI,CACDK,EAAc,aAAe,EAChC,MAAY,CAEZ,CACA,OAAAH,IAAA,EACOE,CACT,EAGF,MAAMS,EAAOP,EAAeC,CAAI,EAChC,OAAI,OAAOM,GAAQ,WACV,IAAIJ,IAAgB,CACzB,GAAI,CAACR,EAEH,OAAO,IAAI,QAAQ,CAACpB,EAASC,IAAW,CACtCkB,EAAM,KAAK,CAAE,KAAAO,EAAM,KAAAE,EAAM,QAAA5B,EAAS,OAAAC,EAAQ,CAC5C,CAAC,EAEH,GAAI,CACF,OAAO+B,EAAI,MAAMP,EAAQG,CAAI,CAC/B,OAASK,EAAG,CAEV,MAAMA,CACR,CACF,EAEKD,CACT,CAAA,CACD,EAGD,GAAI,CACDR,EAAc,iBAAmBF,EACjCE,EAAc,aAAeJ,CAChC,MAAY,CAEZ,CAMA,GAAI,CAEDF,EAAa,iBAAmBI,EAChCJ,EAAa,aAAeE,EAE7B,MAAMc,EAAiBhB,EAAa,UAChC,OAAOgB,GAAkB,aAC1BhB,EAAa,UAAY,IAAIU,IAAgB,CAC5C,MAAML,EAAMW,EAAc,MAAMhB,EAAMU,CAAI,EAC1CR,EAAa,GACb,GAAI,CACFD,EAAM,QAAQ,CAAC,CAAE,KAAMU,EAAG,KAAMC,EAAG,QAAA9B,EAAS,OAAAC,KAAa,CACvD,GAAI,CAEF,MAAM8B,EADMb,EAAaW,CAAC,EACb,MAAMX,EAAMY,CAAC,EACtBC,GAAK,OAAOA,EAAE,MAAS,WACzBA,EAAE,KAAK/B,CAAO,EAAE,MAAMC,CAAM,EAE5BD,EAAQ+B,CAAC,CAEb,OAAS5B,EAAK,CACZF,EAAOE,CAAG,CACZ,CACF,CAAC,CACH,MAAY,CAEZ,CACAgB,EAAM,OAAS,EACf,GAAI,CACDD,EAAa,aAAe,EAC/B,MAAY,CAEZ,CACA,OAAAG,IAAA,EACOE,CACT,GAGF,MAAMY,EAAajB,EAAa,eAC5B,OAAOiB,GAAc,aACtBjB,EAAa,eAAiB,IAAIU,IAC5BR,EA8BEe,EAAU,MAAMjB,EAAMU,CAAI,EA7BxB,IAAI,QAAQ,CAAC5B,EAASC,IAAW,CACtCqB,EACG,KAAK,IAAM,CACV,GAAI,CACF,MAAM,EAAIa,EAAU,MAAMjB,EAAMU,CAAI,EAChC,GAAK,OAAO,EAAE,MAAS,WACzB,EAAE,KAAK5B,CAAO,EAAE,MAAMC,CAAM,EAE5BD,EAAQ,CAAC,CAEb,OAASG,EAAK,CACZF,EAAOE,CAAG,CACZ,CACF,CAAC,EACA,MAAM,IAAM,CACX,GAAI,CACF,MAAM,EAAIgC,EAAU,MAAMjB,EAAMU,CAAI,EAChC,GAAK,OAAO,EAAE,MAAS,WACzB,EAAE,KAAK5B,CAAO,EAAE,MAAMC,CAAM,EAE5BD,EAAQ,CAAC,CAEb,OAASG,EAAK,CACZF,EAAOE,CAAG,CACZ,CACF,CAAC,CACL,CAAC,EAMT,MAAY,CAEZ,CAKA,GAAI,CACFmB,EAAe,KAAK,IAAM,CACxB,WAAW,IAAM,CACf,GAAI,CACF,SACG,iBAAiB,0BAA0B,EAC3C,QAASc,GAAO,CACf,GAAI,CACF,GAAKA,EAAW,kBAAmB,OAClCA,EAAW,kBAAoB,GAIhC,MAAMC,EAASD,EAAW,gBAC1B,GAAI,OAAOC,GAAU,WAAY,CAC/B,GAAI,CACFA,EAAM,KAAKD,CAAE,CACf,OAASH,EAAG,CACV,QAAQ,MAAMA,CAAC,CACjB,CACA,MACF,CAMA,GAAKG,EAAW,sBACd,GAAI,CACDA,EAAW,oBAAA,CACd,OAASH,EAAG,CACV,QAAQ,MAAMA,CAAC,CACjB,CAEJ,MAAY,CAEZ,CACF,CAAC,CACL,MAAY,CAEZ,CACF,EAAG,CAAC,CACN,CAAC,CACH,MAAY,CAEZ,CAEA,OAAOT,CACT,EAtPA,MAAM1B,EAAQkB,EAAQjB,GAAW,GAAG,EAiBpC,MAAMuC,EAAcvC,EAChB,MAAMK,EAAmBW,EAAKhB,EAAU,EAAE,EAC1C,MAAM,OAIJgB,GAoOAwB,EAAWD,EAAO,kBAAA,EAClBE,EAAWvB,EAAesB,CAAQ,EAExC,GAAI,CACDD,EAAe,KAAOE,EACtBF,EAAe,gBAAkB,IAAME,CAC1C,MAAY,CAEZ,CAEA,OAAO,cAAgB,CACrB,GAAGF,EACH,KAAME,CAAA,EAGRjD,EAAU,OAAO,cAIjB,OAAO,aAAe,GACtB,OAAO,cAAgB,OAKvB,GAAI,CACF,MAAMkD,EAAgBC,GAAoB,CACxC,MAAMC,EAAO,eAAe,IAAID,CAAO,EACvC,GAAI,CAACC,EAAM,OACX,MAAMC,EAAQD,EAAK,UACnB,GAAIC,EAAM,wBAAyB,OACnCA,EAAM,wBAA0B,GAEhC,MAAMC,EAAOD,EAAM,kBACf,OAAOC,GAAS,aAEpBD,EAAM,kBAAoB,YAAahB,EAAa,CAClD,MAAMV,EAAO,OAAO,eAAe,KAC7BI,EAAiBJ,GAAM,iBAGvBE,EAAa,CAAC,CAACF,GAAM,aAE3B,GAAII,GAAkB,CAACF,EAAY,CAEjCE,EACG,KAAK,IAAM,CACV,GAAI,CACFuB,EAAK,MAAM,KAAMjB,CAAI,CACvB,OAASK,EAAG,CACV,QAAQ,MAAMA,CAAC,CACjB,CACF,CAAC,EACA,MAAM,IAAM,CACX,GAAI,CACFY,EAAK,MAAM,KAAMjB,CAAI,CACvB,OAASK,EAAG,CACV,QAAQ,MAAMA,CAAC,CACjB,CACF,CAAC,EACH,MACF,CAEA,GAAI,CACFY,EAAK,MAAM,KAAMjB,CAAI,CACvB,OAASK,EAAQ,CAEf,GACEA,GACA,OAAOA,EAAE,SAAY,UACrBA,EAAE,QAAQ,SAAS,iCAAiC,GACpDX,EACA,CACAA,EAAe,KAAK,IAAM,CACxB,GAAI,CACFuB,EAAK,MAAM,KAAMjB,CAAI,CACvB,OAASzB,EAAK,CACZ,QAAQ,MAAMA,CAAG,CACnB,CACF,CAAC,EACD,MACF,CACA,MAAM8B,CACR,CACF,EACF,EAGA,CAAC,cAAe,aAAa,EAAE,QAAQQ,CAAY,CACrD,MAAY,CAEZ,CAEA,eAAQ,IACN,kCAAkChC,CAAe,UACjDM,CAAA,EAGKxB,CACT,OAASY,EAAK,CACZ,QAAQ,MAAM,uBAAuBY,CAAG,GAAIZ,CAAG,EAC/CU,EAAYV,CACd,CACF,CAEA,cAAQ,MACN,yDACAU,CAAA,EAEIA,CACR,CCjgBA,IAAIiC,EAA2C,KAM/C,eAAsBC,GAAqC,CAGrD,OAAO,OAAW,KAKlB,OAAO,eAAe,2BAKrBD,IACHA,EAAqBxC,IAClB,KAAK,IAAM,CAEL,OAAO,eAAe,0BACzB,QAAQ,KACN,kEAAA,CAGN,CAAC,EACA,MAAOH,GAAQ,CACd,cAAQ,MAAM,2CAA4CA,CAAG,EACvDA,CACR,CAAC,GAGL,MAAM2C,EACR"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The CDN loader.
+ *
+ * Every framework binding sits on this: it resolves which @pontive/pontkit-core
+ * release to load, fetches it with its integrity hashes, and puts the SDK on
+ * the window where the elements and the bindings can both find it.
+ *
+ * Kept separate from the bindings because Vue, Svelte and Solid need almost
+ * nothing else, and must not pull in React to get it.
+ */
+export { loadWebComponents } from './load-web-components';
+export { ensureCoreSdkLoaded } from './sdk-loaded';
+export { fetchRuntimeConfig, isExactVersion, isSriHash, RUNTIME_CONFIG_PATHS, RUNTIME_CONFIG_TIMEOUT_MS, } from './runtime-config';
+export { CORE_ELEMENTS_VERSION } from './core-elements-version';

package/dist/index.js

@@ -0,0 +1,311 @@
+const F = __CORE_ELEMENTS_VERSION__, U = [
+  "/__auth/auth/v1/runtime-config",
+  "/auth/v1/runtime-config"
+], x = 1500, V = /^\d+\.\d+\.\d+$/;
+function K(t) {
+  return typeof t == "string" && V.test(t);
+}
+function I(t) {
+  return typeof t == "string" && /^https?:\/\//.test(t);
+}
+function M(t) {
+  return typeof t == "string" && /^sha(256|384|512)-[A-Za-z0-9+/]+=*$/.test(t);
+}
+async function D(t = {}) {
+  const a = t.fetchImpl ?? globalThis.fetch;
+  if (typeof a != "function") return null;
+  const l = t.urls ?? G(), f = t.timeoutMs ?? x;
+  for (const e of l) {
+    const p = await H(a, e, f);
+    if (p) return p;
+  }
+  return null;
+}
+function G() {
+  return typeof window < "u" && typeof window.__pontRuntimeConfigUrl == "string" ? [window.__pontRuntimeConfigUrl] : U;
+}
+async function H(t, a, l) {
+  const f = typeof AbortController == "function" ? new AbortController() : null, e = f ? setTimeout(() => f.abort(), l) : null;
+  try {
+    const p = await t(a, {
+      headers: { accept: "application/json" },
+      signal: f?.signal
+    });
+    if (!p.ok) return null;
+    const n = await p.json();
+    if (!n || !K(n.core_elements_version)) return null;
+    const g = {
+      core_elements_version: n.core_elements_version,
+      source: typeof n.source == "string" ? n.source : void 0,
+      catalog_revision: typeof n.catalog_revision == "number" ? n.catalog_revision : void 0
+    };
+    return n.assets && I(n.assets.js) && I(n.assets.css) && (g.assets = { js: n.assets.js, css: n.assets.css }), n.integrity && M(n.integrity.js) && M(n.integrity.css) && (g.integrity = { js: n.integrity.js, css: n.integrity.css }), g;
+  } catch {
+    return null;
+  } finally {
+    e && clearTimeout(e);
+  }
+}
+let N = null, k = null;
+const S = "@pontive/pontkit-core", W = [
+  (t) => `https://cdn.jsdelivr.net/npm/${S}@${t}/dist/index.mjs`,
+  (t) => `https://unpkg.com/${S}@${t}/dist/index.mjs`,
+  (t) => `https://esm.sh/${S}@${t}/dist/index.mjs`
+], q = [
+  (t) => `https://cdn.jsdelivr.net/npm/${S}@${t}/dist/styles.css`,
+  (t) => `https://unpkg.com/${S}@${t}/dist/styles.css`,
+  (t) => `https://esm.sh/${S}@${t}/dist/styles.css`
+], z = F;
+function B(t, a) {
+  return new Promise((l, f) => {
+    const e = document.createElement("link");
+    e.rel = "stylesheet", e.href = t, a && (e.integrity = a, e.crossOrigin = "anonymous"), e.onload = () => l(), e.onerror = (p) => f(p), document.head.appendChild(e);
+  });
+}
+function X(t, a) {
+  return new Promise((l, f) => {
+    const e = document.createElement("script");
+    e.type = "module", e.src = t, e.integrity = a, e.crossOrigin = "anonymous", e.onload = () => l(), e.onerror = () => f(new Error(`core-elements module at ${t} failed to load or did not match its integrity hash`)), document.head.appendChild(e);
+  }).then(
+    () => import(
+      /* webpackIgnore: true */
+      /* turbopackIgnore: true */
+      /* @vite-ignore */
+      t
+    )
+  );
+}
+async function Z() {
+  return typeof window > "u" || typeof document > "u" ? null : window.__pontLoaded ? window.__pontCoreSdk : window.__pontLoading ? window.__pontLoading : (k || (k = J().catch((t) => {
+    throw k = null, window.__pontLoading = void 0, t;
+  }), window.__pontLoading = k), k);
+}
+async function J() {
+  const t = await D(), a = t?.core_elements_version ?? z, l = W.map((n) => n(a)), f = q.map((n) => n(a));
+  t?.assets && (l.unshift(t.assets.js), f.unshift(t.assets.css));
+  const e = t?.integrity;
+  let p = null;
+  for (let n = 0; n < l.length; n++) {
+    const g = l[n], O = f[n];
+    try {
+      let P = function(i) {
+        if (!i) return i;
+        const C = [];
+        let _ = !1, m = null;
+        const h = new Promise((o) => {
+          m = o;
+        }), y = new Proxy(i, {
+          get(o, c, d) {
+            if (c === "configure")
+              return (...u) => {
+                const r = o.configure?.(...u);
+                _ = !0;
+                try {
+                  C.forEach(({ prop: w, args: $, resolve: A, reject: E }) => {
+                    try {
+                      const v = o[w].apply(o, $);
+                      v && typeof v.then == "function" ? v.then(A).catch(E) : A(v);
+                    } catch (b) {
+                      E(b);
+                    }
+                  });
+                } catch {
+                }
+                C.length = 0;
+                try {
+                  y.__configured = !0;
+                } catch {
+                }
+                return m?.(), r;
+              };
+            const s = o[c];
+            return typeof s == "function" ? (...u) => {
+              if (!_)
+                return new Promise((r, w) => {
+                  C.push({ prop: c, args: u, resolve: r, reject: w });
+                });
+              try {
+                return s.apply(o, u);
+              } catch (r) {
+                throw r;
+              }
+            } : s;
+          }
+        });
+        try {
+          y.__whenConfigured = h, y.__configured = _;
+        } catch {
+        }
+        try {
+          i.__whenConfigured = h, i.__configured = _;
+          const o = i.configure;
+          typeof o == "function" && (i.configure = (...d) => {
+            const s = o.apply(i, d);
+            _ = !0;
+            try {
+              C.forEach(({ prop: u, args: r, resolve: w, reject: $ }) => {
+                try {
+                  const E = i[u].apply(i, r);
+                  E && typeof E.then == "function" ? E.then(w).catch($) : w(E);
+                } catch (A) {
+                  $(A);
+                }
+              });
+            } catch {
+            }
+            C.length = 0;
+            try {
+              i.__configured = !0;
+            } catch {
+            }
+            return m?.(), s;
+          });
+          const c = i.startLoginflow;
+          typeof c == "function" && (i.startLoginflow = (...d) => _ ? c.apply(i, d) : new Promise((s, u) => {
+            h.then(() => {
+              try {
+                const r = c.apply(i, d);
+                r && typeof r.then == "function" ? r.then(s).catch(u) : s(r);
+              } catch (r) {
+                u(r);
+              }
+            }).catch(() => {
+              try {
+                const r = c.apply(i, d);
+                r && typeof r.then == "function" ? r.then(s).catch(u) : s(r);
+              } catch (r) {
+                u(r);
+              }
+            });
+          }));
+        } catch {
+        }
+        try {
+          h.then(() => {
+            setTimeout(() => {
+              try {
+                document.querySelectorAll("pont-signin, pont-signup").forEach((o) => {
+                  try {
+                    if (o.__pontInitRetried) return;
+                    o.__pontInitRetried = !0;
+                    const c = o.__pontRetryInit;
+                    if (typeof c == "function") {
+                      try {
+                        c.call(o);
+                      } catch (d) {
+                        console.error(d);
+                      }
+                      return;
+                    }
+                    if (o.__pontFailedForConfig)
+                      try {
+                        o.connectedCallback?.();
+                      } catch (d) {
+                        console.error(d);
+                      }
+                  } catch {
+                  }
+                });
+              } catch {
+              }
+            }, 0);
+          });
+        } catch {
+        }
+        return y;
+      };
+      await B(O, e?.css);
+      const L = e ? await X(g, e.js) : await import(
+        /* webpackIgnore: true */
+        /* turbopackIgnore: true */
+        /* @vite-ignore */
+        g
+      ), j = L.useAuthProvider?.(), R = P(j);
+      try {
+        L.Auth = R, L.useAuthProvider = () => R;
+      } catch {
+      }
+      window.__pontCoreSdk = {
+        ...L,
+        Auth: R
+      }, N = window.__pontCoreSdk, window.__pontLoaded = !0, window.__pontLoading = void 0;
+      try {
+        const i = (C) => {
+          const _ = customElements.get(C);
+          if (!_) return;
+          const m = _.prototype;
+          if (m.__pontConfiguredPatched) return;
+          m.__pontConfiguredPatched = !0;
+          const h = m.connectedCallback;
+          typeof h == "function" && (m.connectedCallback = function(...y) {
+            const o = window.__pontCoreSdk?.Auth, c = o?.__whenConfigured, d = !!o?.__configured;
+            if (c && !d) {
+              c.then(() => {
+                try {
+                  h.apply(this, y);
+                } catch (s) {
+                  console.error(s);
+                }
+              }).catch(() => {
+                try {
+                  h.apply(this, y);
+                } catch (s) {
+                  console.error(s);
+                }
+              });
+              return;
+            }
+            try {
+              h.apply(this, y);
+            } catch (s) {
+              if (s && typeof s.message == "string" && s.message.includes("Auth.configure() must be called") && c) {
+                c.then(() => {
+                  try {
+                    h.apply(this, y);
+                  } catch (u) {
+                    console.error(u);
+                  }
+                });
+                return;
+              }
+              throw s;
+            }
+          });
+        };
+        ["pont-signin", "pont-signup"].forEach(i);
+      } catch {
+      }
+      return console.log(
+        `PontKit Web Components loaded (${a}) from:`,
+        g
+      ), N;
+    } catch (P) {
+      console.error(`Failed loading from ${g}`, P), p = P;
+    }
+  }
+  throw console.error(
+    "❌ Failed to load PontKit web components from all CDNs.",
+    p
+  ), p;
+}
+let T = null;
+async function Q() {
+  typeof window > "u" || window.__pontCoreSdk?.openAccountSettingsModal || (T || (T = Z().then(() => {
+    window.__pontCoreSdk?.openAccountSettingsModal || console.warn(
+      "[pontive-react] Core sdk loaded but modal functions are missing."
+    );
+  }).catch((t) => {
+    throw console.error("[pontive-react] Failed to load core SDK:", t), t;
+  })), await T);
+}
+export {
+  F as CORE_ELEMENTS_VERSION,
+  U as RUNTIME_CONFIG_PATHS,
+  x as RUNTIME_CONFIG_TIMEOUT_MS,
+  Q as ensureCoreSdkLoaded,
+  D as fetchRuntimeConfig,
+  K as isExactVersion,
+  M as isSriHash,
+  Z as loadWebComponents
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../src/core-elements-version.ts","../src/runtime-config.ts","../src/load-web-components.ts","../src/sdk-loaded.ts"],"sourcesContent":["/**\n * The exact `@pontive/pontkit-core` release this build loads from the CDN.\n *\n * It is the version installed as a dev dependency when the package was built —\n * i.e. the one the test suite ran against — baked in by `define` in\n * vite.config.ts and vitest.config.ts (see scripts/core-elements-version.mjs).\n * An exact version, never a range: an exact release is immutable on the CDN,\n * cacheable forever, and the only form that admits an integrity hash.\n *\n * Nothing at runtime may replace this with \"whatever is newest\" — that is the\n * defect it exists to end. The platform's runtime-config endpoint will be\n * allowed to override it, because that answer is the one the platform has\n * gated (pontive-spec/21-element-versioning-and-compatibility.md §9).\n */\nexport const CORE_ELEMENTS_VERSION: string = __CORE_ELEMENTS_VERSION__;\n","// Which @pontive/pontkit-core release to load, asked of the platform.\n//\n// The platform decides which release a project's screens render with — one\n// deployment default, an optional per-project canary — and publishes the answer\n// at `GET /auth/v1/runtime-config` on the project's auth server\n// (pontive-spec/21-element-versioning-and-compatibility.md §9). This package\n// reads it once, before importing the bundle, so an embedded widget renders\n// with the same release the hosted login pages do. The build-time stamp\n// (CORE_ELEMENTS_VERSION) is the fallback when the answer cannot be read.\n//\n// The endpoint is reached through the app's own origin when the SDK's proxy is\n// mounted (`/__auth/auth/v1/...`), and directly on `/auth/v1/...` when the app\n// itself runs on the auth domain. Both are tried; a host page can name a URL\n// outright with `window.__pontRuntimeConfigUrl`.\n\n/** The shape of GET /auth/v1/runtime-config. */\nexport interface RuntimeConfig {\n  core_elements_version: string;\n  catalog_revision?: number;\n  source?: string;\n  assets?: { js: string; css: string };\n  /**\n   * Subresource-integrity hashes (\"sha384-…\") of the release's module and\n   * stylesheet, recorded by the platform when the release was gated. When\n   * present the loader passes them to the browser, which refuses bytes that\n   * differ — from the platform origin or from any public CDN alike.\n   */\n  integrity?: { js: string; css: string };\n}\n\nexport const RUNTIME_CONFIG_PATHS = [\n  \"/__auth/auth/v1/runtime-config\",\n  \"/auth/v1/runtime-config\",\n] as const;\n\n/** How long to wait for the platform before loading the stamped release. */\nexport const RUNTIME_CONFIG_TIMEOUT_MS = 1500;\n\nconst EXACT_VERSION = /^\\d+\\.\\d+\\.\\d+$/;\n\nexport interface FetchRuntimeConfigOptions {\n  fetchImpl?: typeof fetch;\n  urls?: readonly string[];\n  timeoutMs?: number;\n}\n\n/** Whether `value` names one release rather than a range or garbage. */\nexport function isExactVersion(value: unknown): value is string {\n  return typeof value === \"string\" && EXACT_VERSION.test(value);\n}\n\nfunction isHttpUrl(value: unknown): value is string {\n  return typeof value === \"string\" && /^https?:\\/\\//.test(value);\n}\n\n/** Whether `value` is a well-formed SRI value the browser will accept. */\nexport function isSriHash(value: unknown): value is string {\n  return typeof value === \"string\" && /^sha(256|384|512)-[A-Za-z0-9+/]+=*$/.test(value);\n}\n\n/**\n * Reads the platform's runtime config, or null when no candidate URL answers\n * with one that can be trusted. Never throws: the caller's fallback is the\n * stamped release, and a reachability problem should not become a page error.\n */\nexport async function fetchRuntimeConfig(\n  options: FetchRuntimeConfigOptions = {},\n): Promise<RuntimeConfig | null> {\n  const fetchImpl = options.fetchImpl ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") return null;\n\n  const urls = options.urls ?? candidateUrls();\n  const timeoutMs = options.timeoutMs ?? RUNTIME_CONFIG_TIMEOUT_MS;\n\n  for (const url of urls) {\n    const config = await readOne(fetchImpl, url, timeoutMs);\n    if (config) return config;\n  }\n\n  return null;\n}\n\nfunction candidateUrls(): readonly string[] {\n  if (typeof window !== \"undefined\" && typeof window.__pontRuntimeConfigUrl === \"string\") {\n    return [window.__pontRuntimeConfigUrl];\n  }\n\n  return RUNTIME_CONFIG_PATHS;\n}\n\nasync function readOne(\n  fetchImpl: typeof fetch,\n  url: string,\n  timeoutMs: number,\n): Promise<RuntimeConfig | null> {\n  const controller = typeof AbortController === \"function\" ? new AbortController() : null;\n  const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;\n\n  try {\n    const response = await fetchImpl(url, {\n      headers: { accept: \"application/json\" },\n      signal: controller?.signal,\n    });\n    if (!response.ok) return null;\n\n    const body = (await response.json()) as Partial<RuntimeConfig> | null;\n    if (!body || !isExactVersion(body.core_elements_version)) return null;\n\n    const config: RuntimeConfig = {\n      core_elements_version: body.core_elements_version,\n      source: typeof body.source === \"string\" ? body.source : undefined,\n      catalog_revision:\n        typeof body.catalog_revision === \"number\" ? body.catalog_revision : undefined,\n    };\n\n    // Assets are taken only as a pair of absolute URLs; anything else means\n    // \"load from the CDN list by version\".\n    if (body.assets && isHttpUrl(body.assets.js) && isHttpUrl(body.assets.css)) {\n      config.assets = { js: body.assets.js, css: body.assets.css };\n    }\n\n    // Half a pair is no pair: the browser would check one file and not the\n    // other, and nobody would notice the unchecked one.\n    if (body.integrity && isSriHash(body.integrity.js) && isSriHash(body.integrity.css)) {\n      config.integrity = { js: body.integrity.js, css: body.integrity.css };\n    }\n\n    return config;\n  } catch {\n    return null;\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n","import { CORE_ELEMENTS_VERSION } from \"./core-elements-version\";\nimport { fetchRuntimeConfig } from \"./runtime-config\";\n\nlet coreSdk: any = null;\n\n// The load in flight, if any. This is the guard, and it is a promise rather\n// than a boolean on purpose: a flag set before the first `await` let a second\n// concurrent caller return `coreSdk` while it was still null, log that the\n// SDK's modal functions were missing, and carry on as if it were ready. A\n// promise gives every caller the same eventual answer. It is cleared on failure\n// so a later call can retry rather than inherit a latched failure.\nlet loadPromise: Promise<any> | null = null;\n\nconst PACKAGE_NAME = \"@pontive/pontkit-core\";\n\n// Base CDN templates (version will be injected)\nconst CDN_TEMPLATES = [\n  (v: string) =>\n    `https://cdn.jsdelivr.net/npm/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n  (v: string) => `https://unpkg.com/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n  (v: string) => `https://esm.sh/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n];\n\nconst CSS_TEMPLATES = [\n  (v: string) =>\n    `https://cdn.jsdelivr.net/npm/${PACKAGE_NAME}@${v}/dist/styles.css`,\n  (v: string) => `https://unpkg.com/${PACKAGE_NAME}@${v}/dist/styles.css`,\n  (v: string) => `https://esm.sh/${PACKAGE_NAME}@${v}/dist/styles.css`,\n];\n\n// Which release loads is decided by the PLATFORM, and failing that at BUILD\n// time — never by asking a registry at runtime. This package used to fetch jsDelivr's version list and take the\n// newest entry of any major — the `1.x` filter had been commented out — with\n// `^1` as the fallback when the fetch failed, a different major from the 2.x\n// the wrappers target. Whatever npm happened to hold newest is not a version\n// anyone tested against, and a customer's page picked it up on the next reload\n// with nothing in their build having changed.\n//\n// Now the project's auth server says which release its screens load\n// (GET /auth/v1/runtime-config, see ./runtime-config.ts), so an embedded widget\n// renders with the same bundle the hosted login pages do, and a canary or a\n// promotion reaches it without a rebuild. CORE_ELEMENTS_VERSION — the exact\n// release this package was built and tested with — is the fallback when that\n// endpoint cannot be read.\nconst FALLBACK_VERSION = CORE_ELEMENTS_VERSION;\n\nfunction loadCss(url: string, integrity?: string) {\n  return new Promise<void>((resolve, reject) => {\n    const link = document.createElement(\"link\");\n    link.rel = \"stylesheet\";\n    link.href = url;\n    if (integrity) {\n      // SRI is only enforced on a CORS-mode fetch; the platform origin and the\n      // public CDNs all answer with Access-Control-Allow-Origin: *.\n      link.integrity = integrity;\n      link.crossOrigin = \"anonymous\";\n    }\n    link.onload = () => resolve();\n    link.onerror = (err) => reject(err);\n    document.head.appendChild(link);\n  });\n}\n\n// Loads the module through a <script type=\"module\"> carrying the integrity\n// attribute, then imports it. A dynamic import() cannot carry SRI, but the\n// script element can, and once it has fetched and verified the module the\n// browser's module map holds it under that URL — the import() that follows\n// resolves from the map without a second fetch. A hash mismatch fails the\n// script's load, the promise rejects, and the loader moves to the next\n// source, which is the right outcome: bytes the platform did not gate must not\n// run, wherever they came from.\nfunction loadVerifiedModule(url: string, integrity: string): Promise<any> {\n  return new Promise<void>((resolve, reject) => {\n    const script = document.createElement(\"script\");\n    script.type = \"module\";\n    script.src = url;\n    script.integrity = integrity;\n    script.crossOrigin = \"anonymous\";\n    script.onload = () => resolve();\n    script.onerror = () =>\n      reject(new Error(`core-elements module at ${url} failed to load or did not match its integrity hash`));\n    document.head.appendChild(script);\n  }).then(\n    () =>\n      import(\n        /* webpackIgnore: true */\n        /* turbopackIgnore: true */\n        /* @vite-ignore */\n        url\n      ),\n  );\n}\n\nexport async function loadWebComponents(): Promise<any> {\n  // No DOM means no custom elements to define and no CDN to fetch from.\n  //\n  // Returning rather than throwing matters because src/index.ts calls this at\n  // module scope: under a server renderer the rejection surfaced as a console\n  // error on every render, reporting a failure that is not one. Checked before\n  // the guards below so the browser still loads normally after hydration.\n  if (typeof window === \"undefined\" || typeof document === \"undefined\") {\n    return null;\n  }\n\n  // Another copy of this package on the same page already finished loading.\n  if (window.__pontLoaded) {\n    return window.__pontCoreSdk;\n  }\n\n  // Another copy of this package on the same page is loading right now.\n  if (window.__pontLoading) {\n    return window.__pontLoading;\n  }\n\n  if (!loadPromise) {\n    loadPromise = loadFromCdn().catch((err) => {\n      loadPromise = null;\n      window.__pontLoading = undefined;\n      throw err;\n    });\n\n    window.__pontLoading = loadPromise;\n  }\n\n  return loadPromise;\n}\n\nasync function loadFromCdn(): Promise<any> {\n  const runtime = await fetchRuntimeConfig();\n  const resolvedVersion = runtime?.core_elements_version ?? FALLBACK_VERSION;\n\n  const CDN_SOURCES = CDN_TEMPLATES.map((fn) => fn(resolvedVersion));\n  const CSS_SOURCES = CSS_TEMPLATES.map((fn) => fn(resolvedVersion));\n\n  // The platform's own asset location goes first when it names one; the public\n  // CDNs stay as the fallback list for the same version.\n  if (runtime?.assets) {\n    CDN_SOURCES.unshift(runtime.assets.js);\n    CSS_SOURCES.unshift(runtime.assets.css);\n  }\n\n  // The hashes describe the npm release's bytes, which every source below\n  // serves verbatim, so they apply to all of them — not only to the\n  // platform's. A source whose bytes differ is a source that must not run.\n  const integrity = runtime?.integrity;\n\n  let lastError: unknown = null;\n\n  for (let i = 0; i < CDN_SOURCES.length; i++) {\n    const cdn = CDN_SOURCES[i];\n    const cssCdn = CSS_SOURCES[i];\n\n    try {\n      // 2️⃣ Load CSS first\n      await loadCss(cssCdn, integrity?.css);\n\n      // 3️⃣ Load JS module\n      //\n      // All three ignore directives, and none of them is optional.\n      //\n      // `cdn` is a full URL resolved at runtime, so a bundler that tries to\n      // resolve it statically cannot: webpack and Turbopack turn a dynamic\n      // import with a variable specifier into a module-graph lookup and throw\n      // `Cannot find module 'https://…'` at runtime — no network request is ever\n      // made, and the message reads as though the CDN were at fault. Next.js\n      // uses Turbopack in development and webpack in production, so an app\n      // built with it failed on every CDN in the list identically.\n      //\n      // `@vite-ignore` alone covered only Vite. Each bundler reads its own\n      // comment and ignores the others, so all three coexist and each one keeps\n      // this a real runtime import.\n      const module: any = integrity\n        ? await loadVerifiedModule(cdn, integrity.js)\n        : await import(\n            /* webpackIgnore: true */\n            /* turbopackIgnore: true */\n            /* @vite-ignore */\n            cdn\n          );\n\n      // 4️⃣ Expose globally\n      // Wrap Auth so calls made before `configure()` won't throw. Instead\n      // we queue them and flush once configure() is called by the provider.\n      function createSafeAuth(auth: any) {\n        if (!auth) return auth;\n        type QItem = {\n          prop: string | symbol;\n          args: any[];\n          resolve: (v: any) => void;\n          reject: (e: any) => void;\n        };\n        const queue: QItem[] = [];\n        let configured = false;\n\n        // Expose a configured promise and flag on the proxy so other parts\n        // of the app can wait for Auth to be configured (helps avoid errors\n        // thrown by custom elements that start flows on connect).\n        let resolveWhenConfigured: (() => void) | null = null;\n        const whenConfigured = new Promise<void>((res) => {\n          resolveWhenConfigured = res;\n        });\n\n        const proxy = new Proxy(auth, {\n          get(target, prop, receiver) {\n            if (prop === \"configure\") {\n              return (...args: any[]) => {\n                const res = (target as any).configure?.(...args);\n                configured = true;\n                try {\n                  // flush queued calls\n                  queue.forEach(({ prop: p, args: a, resolve, reject }) => {\n                    try {\n                      const fn = (target as any)[p];\n                      const r = fn.apply(target, a);\n                      if (r && typeof r.then === \"function\") {\n                        r.then(resolve).catch(reject);\n                      } else {\n                        resolve(r);\n                      }\n                    } catch (err) {\n                      reject(err);\n                    }\n                  });\n                } catch (e) {\n                  // ignore flushing errors\n                }\n                queue.length = 0;\n                // mark proxy as configured and resolve the promise\n                try {\n                  (proxy as any).__configured = true;\n                } catch (e) {\n                  /* ignore */\n                }\n                resolveWhenConfigured?.();\n                return res;\n              };\n            }\n\n            const val = (target as any)[prop];\n            if (typeof val === \"function\") {\n              return (...args: any[]) => {\n                if (!configured) {\n                  // queue the call and return a Promise that resolves when flushed\n                  return new Promise((resolve, reject) => {\n                    queue.push({ prop, args, resolve, reject });\n                  });\n                }\n                try {\n                  return val.apply(target, args);\n                } catch (e) {\n                  // preserve throwing behavior for already-configured\n                  throw e;\n                }\n              };\n            }\n            return val;\n          },\n        });\n\n        // Attach the whenConfigured promise and configured flag to the proxy\n        try {\n          (proxy as any).__whenConfigured = whenConfigured;\n          (proxy as any).__configured = configured;\n        } catch (e) {\n          /* ignore */\n        }\n\n        // Also patch the original `auth` object (if present) so that direct\n        // imports and in-module usages get queued behavior too. This ensures\n        // that calls like `Auth.startLoginflow()` won't throw even if they\n        // happen before `configure()` is invoked.\n        try {\n          // Mark the original with the same hooks\n          (auth as any).__whenConfigured = whenConfigured;\n          (auth as any).__configured = configured;\n\n          const origConfigure = (auth as any).configure;\n          if (typeof origConfigure === \"function\") {\n            (auth as any).configure = (...args: any[]) => {\n              const res = origConfigure.apply(auth, args);\n              configured = true;\n              try {\n                queue.forEach(({ prop: p, args: a, resolve, reject }) => {\n                  try {\n                    const fn = (auth as any)[p];\n                    const r = fn.apply(auth, a);\n                    if (r && typeof r.then === \"function\") {\n                      r.then(resolve).catch(reject);\n                    } else {\n                      resolve(r);\n                    }\n                  } catch (err) {\n                    reject(err);\n                  }\n                });\n              } catch (e) {\n                /* ignore */\n              }\n              queue.length = 0;\n              try {\n                (auth as any).__configured = true;\n              } catch (e) {\n                /* ignore */\n              }\n              resolveWhenConfigured?.();\n              return res;\n            };\n          }\n\n          const origStart = (auth as any).startLoginflow;\n          if (typeof origStart === \"function\") {\n            (auth as any).startLoginflow = (...args: any[]) => {\n              if (!configured) {\n                return new Promise((resolve, reject) => {\n                  whenConfigured\n                    .then(() => {\n                      try {\n                        const r = origStart.apply(auth, args);\n                        if (r && typeof r.then === \"function\") {\n                          r.then(resolve).catch(reject);\n                        } else {\n                          resolve(r);\n                        }\n                      } catch (err) {\n                        reject(err);\n                      }\n                    })\n                    .catch(() => {\n                      try {\n                        const r = origStart.apply(auth, args);\n                        if (r && typeof r.then === \"function\") {\n                          r.then(resolve).catch(reject);\n                        } else {\n                          resolve(r);\n                        }\n                      } catch (err) {\n                        reject(err);\n                      }\n                    });\n                });\n              }\n\n              return origStart.apply(auth, args);\n            };\n          }\n        } catch (e) {\n          /* ignore */\n        }\n\n        // When auth is configured, call an explicit retry method on any\n        // sign-in/up elements that implement it. Prefer an explicit retry\n        // API so elements can be idempotent and avoid duplicate flows.\n        try {\n          whenConfigured.then(() => {\n            setTimeout(() => {\n              try {\n                document\n                  .querySelectorAll(\"pont-signin, pont-signup\")\n                  .forEach((el) => {\n                    try {\n                      if ((el as any).__pontInitRetried) return;\n                      (el as any).__pontInitRetried = true;\n                      // Prefer an explicit retry API implemented by the element\n                      // (e.g., `__pontRetryInit`) to avoid re-running the\n                      // entire `connectedCallback` which may cause duplicates.\n                      const retry = (el as any).__pontRetryInit;\n                      if (typeof retry === \"function\") {\n                        try {\n                          retry.call(el);\n                        } catch (e) {\n                          console.error(e);\n                        }\n                        return;\n                      }\n\n                      // Fallback: only call connectedCallback if the element\n                      // provides an explicit flag saying it previously failed\n                      // due to missing Auth (set by our connectedCallback wrapper\n                      // when we detect that specific error).\n                      if ((el as any).__pontFailedForConfig) {\n                        try {\n                          (el as any).connectedCallback?.();\n                        } catch (e) {\n                          console.error(e);\n                        }\n                      }\n                    } catch (_) {\n                      // ignore per-element errors\n                    }\n                  });\n              } catch (_) {\n                /* ignore */\n              }\n            }, 0);\n          });\n        } catch (e) {\n          /* ignore */\n        }\n\n        return proxy;\n      }\n\n      // Replace module exports so consumers that import `Auth` directly\n      // get the safe proxy as well. Also ensure `useAuthProvider()` returns\n      // the proxy.\n      const realAuth = module.useAuthProvider?.();\n      const safeAuth = createSafeAuth(realAuth);\n\n      try {\n        (module as any).Auth = safeAuth;\n        (module as any).useAuthProvider = () => safeAuth;\n      } catch (e) {\n        /* ignore */\n      }\n\n      window.__pontCoreSdk = {\n        ...module,\n        Auth: safeAuth,\n      };\n\n      coreSdk = window.__pontCoreSdk;\n\n      // Set only once the SDK is actually on the window, so a copy of this\n      // package that sees the flag can trust what it reads next to it.\n      window.__pontLoaded = true;\n      window.__pontLoading = undefined;\n\n      // Patch known elements that may start flows on connect so they wait\n      // for Auth to be configured instead of throwing. This avoids noisy\n      // runtime errors like \"Auth.configure() must be called\".\n      try {\n        const patchElement = (tagName: string) => {\n          const ctor = customElements.get(tagName);\n          if (!ctor) return;\n          const proto = ctor.prototype as any;\n          if (proto.__pontConfiguredPatched) return;\n          proto.__pontConfiguredPatched = true;\n\n          const orig = proto.connectedCallback;\n          if (typeof orig !== \"function\") return;\n\n          proto.connectedCallback = function (...args: any[]) {\n            const auth = window.__pontCoreSdk?.Auth as any;\n            const whenConfigured = auth?.__whenConfigured as\n              | Promise<void>\n              | undefined;\n            const configured = !!auth?.__configured;\n\n            if (whenConfigured && !configured) {\n              // delay initial connect work until Auth is configured\n              whenConfigured\n                .then(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (e) {\n                    console.error(e);\n                  }\n                })\n                .catch(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (e) {\n                    console.error(e);\n                  }\n                });\n              return;\n            }\n\n            try {\n              orig.apply(this, args);\n            } catch (e: any) {\n              // If it still throws with the configure error, retry after configured\n              if (\n                e &&\n                typeof e.message === \"string\" &&\n                e.message.includes(\"Auth.configure() must be called\") &&\n                whenConfigured\n              ) {\n                whenConfigured.then(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (err) {\n                    console.error(err);\n                  }\n                });\n                return;\n              }\n              throw e;\n            }\n          };\n        };\n\n        // Elements known to start auth flows on connect\n        [\"pont-signin\", \"pont-signup\"].forEach(patchElement);\n      } catch (e) {\n        /* ignore patch errors */\n      }\n\n      console.log(\n        `PontKit Web Components loaded (${resolvedVersion}) from:`,\n        cdn,\n      );\n\n      return coreSdk;\n    } catch (err) {\n      console.error(`Failed loading from ${cdn}`, err);\n      lastError = err;\n    }\n  }\n\n  console.error(\n    \"❌ Failed to load PontKit web components from all CDNs.\",\n    lastError,\n  );\n  throw lastError;\n}\n","import { loadWebComponents } from \"./load-web-components\";\n\nlet coreSdkLoadPromise: Promise<void> | null = null;\n\n/**\n * Ensures the core SDK is loaded and the global functions are available.\n * Returns a promise that resolves when the SDK is ready.\n */\nexport async function ensureCoreSdkLoaded(): Promise<void> {\n  // Nothing to ensure without a browser, and the check below would throw before\n  // reaching loadWebComponents' own guard.\n  if (typeof window === \"undefined\") {\n    return;\n  }\n\n  // If the functions already exist, we're done.\n  if (window.__pontCoreSdk?.openAccountSettingsModal) {\n    return;\n  }\n\n  // Otherwise, start loading the SDK if not already loading.\n  if (!coreSdkLoadPromise) {\n    coreSdkLoadPromise = loadWebComponents()\n      .then(() => {\n        // The first SDK script attaches the functions synchronously when it executes.\n        if (!window.__pontCoreSdk?.openAccountSettingsModal) {\n          console.warn(\n            \"[pontive-react] Core sdk loaded but modal functions are missing.\",\n          );\n        }\n      })\n      .catch((err) => {\n        console.error(\"[pontive-react] Failed to load core SDK:\", err);\n        throw err;\n      });\n  }\n\n  await coreSdkLoadPromise;\n}\n"],"names":["CORE_ELEMENTS_VERSION","RUNTIME_CONFIG_PATHS","RUNTIME_CONFIG_TIMEOUT_MS","EXACT_VERSION","isExactVersion","value","isHttpUrl","isSriHash","fetchRuntimeConfig","options","fetchImpl","urls","candidateUrls","timeoutMs","url","config","readOne","controller","timer","response","body","coreSdk","loadPromise","PACKAGE_NAME","CDN_TEMPLATES","v","CSS_TEMPLATES","FALLBACK_VERSION","loadCss","integrity","resolve","reject","link","err","loadVerifiedModule","script","loadWebComponents","loadFromCdn","runtime","resolvedVersion","CDN_SOURCES","fn","CSS_SOURCES","lastError","i","cdn","cssCdn","createSafeAuth","auth","queue","configured","resolveWhenConfigured","whenConfigured","res","proxy","target","prop","receiver","args","p","a","r","val","e","origConfigure","origStart","el","retry","module","realAuth","safeAuth","patchElement","tagName","ctor","proto","orig","coreSdkLoadPromise","ensureCoreSdkLoaded"],"mappings":"AAcO,MAAMA,IAAgC,2BCgBhCC,IAAuB;AAAA,EAClC;AAAA,EACA;AACF,GAGaC,IAA4B,MAEnCC,IAAgB;AASf,SAASC,EAAeC,GAAiC;AAC9D,SAAO,OAAOA,KAAU,YAAYF,EAAc,KAAKE,CAAK;AAC9D;AAEA,SAASC,EAAUD,GAAiC;AAClD,SAAO,OAAOA,KAAU,YAAY,eAAe,KAAKA,CAAK;AAC/D;AAGO,SAASE,EAAUF,GAAiC;AACzD,SAAO,OAAOA,KAAU,YAAY,sCAAsC,KAAKA,CAAK;AACtF;AAOA,eAAsBG,EACpBC,IAAqC,IACN;AAC/B,QAAMC,IAAYD,EAAQ,aAAa,WAAW;AAClD,MAAI,OAAOC,KAAc,WAAY,QAAO;AAE5C,QAAMC,IAAOF,EAAQ,QAAQG,EAAA,GACvBC,IAAYJ,EAAQ,aAAaP;AAEvC,aAAWY,KAAOH,GAAM;AACtB,UAAMI,IAAS,MAAMC,EAAQN,GAAWI,GAAKD,CAAS;AACtD,QAAIE,EAAQ,QAAOA;AAAA,EACrB;AAEA,SAAO;AACT;AAEA,SAASH,IAAmC;AAC1C,SAAI,OAAO,SAAW,OAAe,OAAO,OAAO,0BAA2B,WACrE,CAAC,OAAO,sBAAsB,IAGhCX;AACT;AAEA,eAAee,EACbN,GACAI,GACAD,GAC+B;AAC/B,QAAMI,IAAa,OAAO,mBAAoB,aAAa,IAAI,oBAAoB,MAC7EC,IAAQD,IAAa,WAAW,MAAMA,EAAW,MAAA,GAASJ,CAAS,IAAI;AAE7E,MAAI;AACF,UAAMM,IAAW,MAAMT,EAAUI,GAAK;AAAA,MACpC,SAAS,EAAE,QAAQ,mBAAA;AAAA,MACnB,QAAQG,GAAY;AAAA,IAAA,CACrB;AACD,QAAI,CAACE,EAAS,GAAI,QAAO;AAEzB,UAAMC,IAAQ,MAAMD,EAAS,KAAA;AAC7B,QAAI,CAACC,KAAQ,CAAChB,EAAegB,EAAK,qBAAqB,EAAG,QAAO;AAEjE,UAAML,IAAwB;AAAA,MAC5B,uBAAuBK,EAAK;AAAA,MAC5B,QAAQ,OAAOA,EAAK,UAAW,WAAWA,EAAK,SAAS;AAAA,MACxD,kBACE,OAAOA,EAAK,oBAAqB,WAAWA,EAAK,mBAAmB;AAAA,IAAA;AAKxE,WAAIA,EAAK,UAAUd,EAAUc,EAAK,OAAO,EAAE,KAAKd,EAAUc,EAAK,OAAO,GAAG,MACvEL,EAAO,SAAS,EAAE,IAAIK,EAAK,OAAO,IAAI,KAAKA,EAAK,OAAO,IAAA,IAKrDA,EAAK,aAAab,EAAUa,EAAK,UAAU,EAAE,KAAKb,EAAUa,EAAK,UAAU,GAAG,MAChFL,EAAO,YAAY,EAAE,IAAIK,EAAK,UAAU,IAAI,KAAKA,EAAK,UAAU,IAAA,IAG3DL;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT,UAAA;AACE,IAAIG,kBAAoBA,CAAK;AAAA,EAC/B;AACF;AClIA,IAAIG,IAAe,MAQfC,IAAmC;AAEvC,MAAMC,IAAe,yBAGfC,IAAgB;AAAA,EACpB,CAACC,MACC,gCAAgCF,CAAY,IAAIE,CAAC;AAAA,EACnD,CAACA,MAAc,qBAAqBF,CAAY,IAAIE,CAAC;AAAA,EACrD,CAACA,MAAc,kBAAkBF,CAAY,IAAIE,CAAC;AACpD,GAEMC,IAAgB;AAAA,EACpB,CAACD,MACC,gCAAgCF,CAAY,IAAIE,CAAC;AAAA,EACnD,CAACA,MAAc,qBAAqBF,CAAY,IAAIE,CAAC;AAAA,EACrD,CAACA,MAAc,kBAAkBF,CAAY,IAAIE,CAAC;AACpD,GAgBME,IAAmB3B;AAEzB,SAAS4B,EAAQd,GAAae,GAAoB;AAChD,SAAO,IAAI,QAAc,CAACC,GAASC,MAAW;AAC5C,UAAMC,IAAO,SAAS,cAAc,MAAM;AAC1C,IAAAA,EAAK,MAAM,cACXA,EAAK,OAAOlB,GACRe,MAGFG,EAAK,YAAYH,GACjBG,EAAK,cAAc,cAErBA,EAAK,SAAS,MAAMF,EAAA,GACpBE,EAAK,UAAU,CAACC,MAAQF,EAAOE,CAAG,GAClC,SAAS,KAAK,YAAYD,CAAI;AAAA,EAChC,CAAC;AACH;AAUA,SAASE,EAAmBpB,GAAae,GAAiC;AACxE,SAAO,IAAI,QAAc,CAACC,GAASC,MAAW;AAC5C,UAAMI,IAAS,SAAS,cAAc,QAAQ;AAC9C,IAAAA,EAAO,OAAO,UACdA,EAAO,MAAMrB,GACbqB,EAAO,YAAYN,GACnBM,EAAO,cAAc,aACrBA,EAAO,SAAS,MAAML,EAAA,GACtBK,EAAO,UAAU,MACfJ,EAAO,IAAI,MAAM,2BAA2BjB,CAAG,qDAAqD,CAAC,GACvG,SAAS,KAAK,YAAYqB,CAAM;AAAA,EAClC,CAAC,EAAE;AAAA,IACD,MACE;AAAA;AAAA;AAAA;AAAA,MAIErB;AAAA;AAAA,EAAA;AAGR;AAEA,eAAsBsB,IAAkC;AAOtD,SAAI,OAAO,SAAW,OAAe,OAAO,WAAa,MAChD,OAIL,OAAO,eACF,OAAO,gBAIZ,OAAO,gBACF,OAAO,iBAGXd,MACHA,IAAce,EAAA,EAAc,MAAM,CAACJ,MAAQ;AACzC,UAAAX,IAAc,MACd,OAAO,gBAAgB,QACjBW;AAAA,EACR,CAAC,GAED,OAAO,gBAAgBX,IAGlBA;AACT;AAEA,eAAee,IAA4B;AACzC,QAAMC,IAAU,MAAM9B,EAAA,GAChB+B,IAAkBD,GAAS,yBAAyBX,GAEpDa,IAAchB,EAAc,IAAI,CAACiB,MAAOA,EAAGF,CAAe,CAAC,GAC3DG,IAAchB,EAAc,IAAI,CAACe,MAAOA,EAAGF,CAAe,CAAC;AAIjE,EAAID,GAAS,WACXE,EAAY,QAAQF,EAAQ,OAAO,EAAE,GACrCI,EAAY,QAAQJ,EAAQ,OAAO,GAAG;AAMxC,QAAMT,IAAYS,GAAS;AAE3B,MAAIK,IAAqB;AAEzB,WAASC,IAAI,GAAGA,IAAIJ,EAAY,QAAQI,KAAK;AAC3C,UAAMC,IAAML,EAAYI,CAAC,GACnBE,IAASJ,EAAYE,CAAC;AAE5B,QAAI;AA+BF,UAASG,IAAT,SAAwBC,GAAW;AACjC,YAAI,CAACA,EAAM,QAAOA;AAOlB,cAAMC,IAAiB,CAAA;AACvB,YAAIC,IAAa,IAKbC,IAA6C;AACjD,cAAMC,IAAiB,IAAI,QAAc,CAACC,MAAQ;AAChD,UAAAF,IAAwBE;AAAA,QAC1B,CAAC,GAEKC,IAAQ,IAAI,MAAMN,GAAM;AAAA,UAC5B,IAAIO,GAAQC,GAAMC,GAAU;AAC1B,gBAAID,MAAS;AACX,qBAAO,IAAIE,MAAgB;AACzB,sBAAML,IAAOE,EAAe,YAAY,GAAGG,CAAI;AAC/C,gBAAAR,IAAa;AACb,oBAAI;AAEF,kBAAAD,EAAM,QAAQ,CAAC,EAAE,MAAMU,GAAG,MAAMC,GAAG,SAAA9B,GAAS,QAAAC,QAAa;AACvD,wBAAI;AAEF,4BAAM8B,IADMN,EAAeI,CAAC,EACf,MAAMJ,GAAQK,CAAC;AAC5B,sBAAIC,KAAK,OAAOA,EAAE,QAAS,aACzBA,EAAE,KAAK/B,CAAO,EAAE,MAAMC,CAAM,IAE5BD,EAAQ+B,CAAC;AAAA,oBAEb,SAAS5B,GAAK;AACZ,sBAAAF,EAAOE,CAAG;AAAA,oBACZ;AAAA,kBACF,CAAC;AAAA,gBACH,QAAY;AAAA,gBAEZ;AACA,gBAAAgB,EAAM,SAAS;AAEf,oBAAI;AACD,kBAAAK,EAAc,eAAe;AAAA,gBAChC,QAAY;AAAA,gBAEZ;AACA,uBAAAH,IAAA,GACOE;AAAA,cACT;AAGF,kBAAMS,IAAOP,EAAeC,CAAI;AAChC,mBAAI,OAAOM,KAAQ,aACV,IAAIJ,MAAgB;AACzB,kBAAI,CAACR;AAEH,uBAAO,IAAI,QAAQ,CAACpB,GAASC,MAAW;AACtC,kBAAAkB,EAAM,KAAK,EAAE,MAAAO,GAAM,MAAAE,GAAM,SAAA5B,GAAS,QAAAC,GAAQ;AAAA,gBAC5C,CAAC;AAEH,kBAAI;AACF,uBAAO+B,EAAI,MAAMP,GAAQG,CAAI;AAAA,cAC/B,SAASK,GAAG;AAEV,sBAAMA;AAAA,cACR;AAAA,YACF,IAEKD;AAAA,UACT;AAAA,QAAA,CACD;AAGD,YAAI;AACD,UAAAR,EAAc,mBAAmBF,GACjCE,EAAc,eAAeJ;AAAA,QAChC,QAAY;AAAA,QAEZ;AAMA,YAAI;AAED,UAAAF,EAAa,mBAAmBI,GAChCJ,EAAa,eAAeE;AAE7B,gBAAMc,IAAiBhB,EAAa;AACpC,UAAI,OAAOgB,KAAkB,eAC1BhB,EAAa,YAAY,IAAIU,MAAgB;AAC5C,kBAAML,IAAMW,EAAc,MAAMhB,GAAMU,CAAI;AAC1C,YAAAR,IAAa;AACb,gBAAI;AACF,cAAAD,EAAM,QAAQ,CAAC,EAAE,MAAMU,GAAG,MAAMC,GAAG,SAAA9B,GAAS,QAAAC,QAAa;AACvD,oBAAI;AAEF,wBAAM8B,IADMb,EAAaW,CAAC,EACb,MAAMX,GAAMY,CAAC;AAC1B,kBAAIC,KAAK,OAAOA,EAAE,QAAS,aACzBA,EAAE,KAAK/B,CAAO,EAAE,MAAMC,CAAM,IAE5BD,EAAQ+B,CAAC;AAAA,gBAEb,SAAS5B,GAAK;AACZ,kBAAAF,EAAOE,CAAG;AAAA,gBACZ;AAAA,cACF,CAAC;AAAA,YACH,QAAY;AAAA,YAEZ;AACA,YAAAgB,EAAM,SAAS;AACf,gBAAI;AACD,cAAAD,EAAa,eAAe;AAAA,YAC/B,QAAY;AAAA,YAEZ;AACA,mBAAAG,IAAA,GACOE;AAAA,UACT;AAGF,gBAAMY,IAAajB,EAAa;AAChC,UAAI,OAAOiB,KAAc,eACtBjB,EAAa,iBAAiB,IAAIU,MAC5BR,IA8BEe,EAAU,MAAMjB,GAAMU,CAAI,IA7BxB,IAAI,QAAQ,CAAC5B,GAASC,MAAW;AACtC,YAAAqB,EACG,KAAK,MAAM;AACV,kBAAI;AACF,sBAAM,IAAIa,EAAU,MAAMjB,GAAMU,CAAI;AACpC,gBAAI,KAAK,OAAO,EAAE,QAAS,aACzB,EAAE,KAAK5B,CAAO,EAAE,MAAMC,CAAM,IAE5BD,EAAQ,CAAC;AAAA,cAEb,SAASG,GAAK;AACZ,gBAAAF,EAAOE,CAAG;AAAA,cACZ;AAAA,YACF,CAAC,EACA,MAAM,MAAM;AACX,kBAAI;AACF,sBAAM,IAAIgC,EAAU,MAAMjB,GAAMU,CAAI;AACpC,gBAAI,KAAK,OAAO,EAAE,QAAS,aACzB,EAAE,KAAK5B,CAAO,EAAE,MAAMC,CAAM,IAE5BD,EAAQ,CAAC;AAAA,cAEb,SAASG,GAAK;AACZ,gBAAAF,EAAOE,CAAG;AAAA,cACZ;AAAA,YACF,CAAC;AAAA,UACL,CAAC;AAAA,QAMT,QAAY;AAAA,QAEZ;AAKA,YAAI;AACF,UAAAmB,EAAe,KAAK,MAAM;AACxB,uBAAW,MAAM;AACf,kBAAI;AACF,yBACG,iBAAiB,0BAA0B,EAC3C,QAAQ,CAACc,MAAO;AACf,sBAAI;AACF,wBAAKA,EAAW,kBAAmB;AAClC,oBAAAA,EAAW,oBAAoB;AAIhC,0BAAMC,IAASD,EAAW;AAC1B,wBAAI,OAAOC,KAAU,YAAY;AAC/B,0BAAI;AACF,wBAAAA,EAAM,KAAKD,CAAE;AAAA,sBACf,SAASH,GAAG;AACV,gCAAQ,MAAMA,CAAC;AAAA,sBACjB;AACA;AAAA,oBACF;AAMA,wBAAKG,EAAW;AACd,0BAAI;AACD,wBAAAA,EAAW,oBAAA;AAAA,sBACd,SAASH,GAAG;AACV,gCAAQ,MAAMA,CAAC;AAAA,sBACjB;AAAA,kBAEJ,QAAY;AAAA,kBAEZ;AAAA,gBACF,CAAC;AAAA,cACL,QAAY;AAAA,cAEZ;AAAA,YACF,GAAG,CAAC;AAAA,UACN,CAAC;AAAA,QACH,QAAY;AAAA,QAEZ;AAEA,eAAOT;AAAA,MACT;AAtPA,YAAM1B,EAAQkB,GAAQjB,GAAW,GAAG;AAiBpC,YAAMuC,IAAcvC,IAChB,MAAMK,EAAmBW,GAAKhB,EAAU,EAAE,IAC1C,MAAM;AAAA;AAAA;AAAA;AAAA,QAIJgB;AAAA,SAoOAwB,IAAWD,EAAO,kBAAA,GAClBE,IAAWvB,EAAesB,CAAQ;AAExC,UAAI;AACD,QAAAD,EAAe,OAAOE,GACtBF,EAAe,kBAAkB,MAAME;AAAA,MAC1C,QAAY;AAAA,MAEZ;AAEA,aAAO,gBAAgB;AAAA,QACrB,GAAGF;AAAA,QACH,MAAME;AAAA,MAAA,GAGRjD,IAAU,OAAO,eAIjB,OAAO,eAAe,IACtB,OAAO,gBAAgB;AAKvB,UAAI;AACF,cAAMkD,IAAe,CAACC,MAAoB;AACxC,gBAAMC,IAAO,eAAe,IAAID,CAAO;AACvC,cAAI,CAACC,EAAM;AACX,gBAAMC,IAAQD,EAAK;AACnB,cAAIC,EAAM,wBAAyB;AACnC,UAAAA,EAAM,0BAA0B;AAEhC,gBAAMC,IAAOD,EAAM;AACnB,UAAI,OAAOC,KAAS,eAEpBD,EAAM,oBAAoB,YAAahB,GAAa;AAClD,kBAAMV,IAAO,OAAO,eAAe,MAC7BI,IAAiBJ,GAAM,kBAGvBE,IAAa,CAAC,CAACF,GAAM;AAE3B,gBAAII,KAAkB,CAACF,GAAY;AAEjC,cAAAE,EACG,KAAK,MAAM;AACV,oBAAI;AACF,kBAAAuB,EAAK,MAAM,MAAMjB,CAAI;AAAA,gBACvB,SAASK,GAAG;AACV,0BAAQ,MAAMA,CAAC;AAAA,gBACjB;AAAA,cACF,CAAC,EACA,MAAM,MAAM;AACX,oBAAI;AACF,kBAAAY,EAAK,MAAM,MAAMjB,CAAI;AAAA,gBACvB,SAASK,GAAG;AACV,0BAAQ,MAAMA,CAAC;AAAA,gBACjB;AAAA,cACF,CAAC;AACH;AAAA,YACF;AAEA,gBAAI;AACF,cAAAY,EAAK,MAAM,MAAMjB,CAAI;AAAA,YACvB,SAASK,GAAQ;AAEf,kBACEA,KACA,OAAOA,EAAE,WAAY,YACrBA,EAAE,QAAQ,SAAS,iCAAiC,KACpDX,GACA;AACA,gBAAAA,EAAe,KAAK,MAAM;AACxB,sBAAI;AACF,oBAAAuB,EAAK,MAAM,MAAMjB,CAAI;AAAA,kBACvB,SAASzB,GAAK;AACZ,4BAAQ,MAAMA,CAAG;AAAA,kBACnB;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AACA,oBAAM8B;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAGA,SAAC,eAAe,aAAa,EAAE,QAAQQ,CAAY;AAAA,MACrD,QAAY;AAAA,MAEZ;AAEA,qBAAQ;AAAA,QACN,kCAAkChC,CAAe;AAAA,QACjDM;AAAA,MAAA,GAGKxB;AAAA,IACT,SAASY,GAAK;AACZ,cAAQ,MAAM,uBAAuBY,CAAG,IAAIZ,CAAG,GAC/CU,IAAYV;AAAA,IACd;AAAA,EACF;AAEA,gBAAQ;AAAA,IACN;AAAA,IACAU;AAAA,EAAA,GAEIA;AACR;ACjgBA,IAAIiC,IAA2C;AAM/C,eAAsBC,IAAqC;AAGzD,EAAI,OAAO,SAAW,OAKlB,OAAO,eAAe,6BAKrBD,MACHA,IAAqBxC,IAClB,KAAK,MAAM;AAEV,IAAK,OAAO,eAAe,4BACzB,QAAQ;AAAA,MACN;AAAA,IAAA;AAAA,EAGN,CAAC,EACA,MAAM,CAACH,MAAQ;AACd,kBAAQ,MAAM,4CAA4CA,CAAG,GACvDA;AAAA,EACR,CAAC,IAGL,MAAM2C;AACR;"}

package/dist/load-web-components.d.ts

@@ -0,0 +1 @@
+export declare function loadWebComponents(): Promise<any>;

package/dist/runtime-config.d.ts

@@ -0,0 +1,38 @@
+/** The shape of GET /auth/v1/runtime-config. */
+export interface RuntimeConfig {
+    core_elements_version: string;
+    catalog_revision?: number;
+    source?: string;
+    assets?: {
+        js: string;
+        css: string;
+    };
+    /**
+     * Subresource-integrity hashes ("sha384-…") of the release's module and
+     * stylesheet, recorded by the platform when the release was gated. When
+     * present the loader passes them to the browser, which refuses bytes that
+     * differ — from the platform origin or from any public CDN alike.
+     */
+    integrity?: {
+        js: string;
+        css: string;
+    };
+}
+export declare const RUNTIME_CONFIG_PATHS: readonly ["/__auth/auth/v1/runtime-config", "/auth/v1/runtime-config"];
+/** How long to wait for the platform before loading the stamped release. */
+export declare const RUNTIME_CONFIG_TIMEOUT_MS = 1500;
+export interface FetchRuntimeConfigOptions {
+    fetchImpl?: typeof fetch;
+    urls?: readonly string[];
+    timeoutMs?: number;
+}
+/** Whether `value` names one release rather than a range or garbage. */
+export declare function isExactVersion(value: unknown): value is string;
+/** Whether `value` is a well-formed SRI value the browser will accept. */
+export declare function isSriHash(value: unknown): value is string;
+/**
+ * Reads the platform's runtime config, or null when no candidate URL answers
+ * with one that can be trusted. Never throws: the caller's fallback is the
+ * stamped release, and a reachability problem should not become a page error.
+ */
+export declare function fetchRuntimeConfig(options?: FetchRuntimeConfigOptions): Promise<RuntimeConfig | null>;

package/dist/sdk-loaded.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Ensures the core SDK is loaded and the global functions are available.
+ * Returns a promise that resolves when the SDK is ready.
+ */
+export declare function ensureCoreSdkLoaded(): Promise<void>;

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@pontive/pontkit-loader",
+  "version": "1.0.0",
+  "license": "MIT",
+  "description": "Loads @pontive/pontkit-core from the CDN at the release the platform decides.",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "vite build",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@pontive/pontkit-core": "1.1.1"
+  }
+}