@pontive/pontkit-loader 1.0.0 → 1.0.2

package/dist/index.cjs

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const $=__CORE_ELEMENTS_VERSION__,U=["/__auth/auth/v1/runtime-config","/auth/v1/runtime-config"],j=1500,K=/^\d+\.\d+\.\d+$/;function F(t){return typeof t=="string"&&K.test(t)}function b(t){return typeof t=="string"&&/^https?:\/\//.test(t)}function P(t){return typeof t=="string"&&/^sha(256|384|512)-[A-Za-z0-9+/]+=*$/.test(t)}async function V(t={}){const a=t.fetchImpl??globalThis.fetch;if(typeof a!="function")return null;const l=t.urls??D(),d=t.timeoutMs??j;for(const e of l){const p=await W(a,e,d);if(p)return p}return null}function D(){return typeof window<"u"&&typeof window.__pontRuntimeConfigUrl=="string"?[window.__pontRuntimeConfigUrl]:U}async function W(t,a,l){const d=typeof AbortController=="function"?new AbortController:null,e=d?setTimeout(()=>d.abort(),l):null;try{const p=await t(a,{headers:{accept:"application/json"},signal:d?.signal});if(!p.ok)return null;const n=await p.json();if(!n||!F(n.core_elements_version))return null;const g={core_elements_version:n.core_elements_version,source:typeof n.source=="string"?n.source:void 0,catalog_revision:typeof n.catalog_revision=="number"?n.catalog_revision:void 0};return n.assets&&b(n.assets.js)&&b(n.assets.css)&&(g.assets={js:n.assets.js,css:n.assets.css}),n.integrity&&P(n.integrity.js)&&P(n.integrity.css)&&(g.integrity={js:n.integrity.js,css:n.integrity.css}),g}catch{return null}finally{e&&clearTimeout(e)}}let v=null,T=null;const S="@pontive/pontkit-core",q=[t=>`https://cdn.jsdelivr.net/npm/${S}@${t}/dist/index.mjs`,t=>`https://unpkg.com/${S}@${t}/dist/index.mjs`,t=>`https://esm.sh/${S}@${t}/dist/index.mjs`],z=[t=>`https://cdn.jsdelivr.net/npm/${S}@${t}/dist/styles.css`,t=>`https://unpkg.com/${S}@${t}/dist/styles.css`,t=>`https://esm.sh/${S}@${t}/dist/styles.css`],B=$;function X(t,a){return new Promise((l,d)=>{const e=document.createElement("link");e.rel="stylesheet",e.href=t,a&&(e.integrity=a,e.crossOrigin="anonymous"),e.onload=()=>l(),e.onerror=p=>d(p),document.head.appendChild(e)})}function Z(t,a){return new Promise((l,d)=>{const e=document.createElement("script");e.type="module",e.src=t,e.integrity=a,e.crossOrigin="anonymous",e.onload=()=>l(),e.onerror=()=>d(new Error(`core-elements module at ${t} failed to load or did not match its integrity hash`)),document.head.appendChild(e)}).then(()=>import(t))}async function x(){return typeof window>"u"||typeof document>"u"?null:window.__pontLoaded?window.__pontCoreSdk:window.__pontLoading?window.__pontLoading:(T||(T=J().catch(t=>{throw T=null,window.__pontLoading=void 0,t}),window.__pontLoading=T),T)}async function J(){const t=await V(),a=t?.core_elements_version??B,l=q.map(n=>n(a)),d=z.map(n=>n(a));t?.assets&&(l.unshift(t.assets.js),d.unshift(t.assets.css));const e=t?.integrity;let p=null;for(let n=0;n<l.length;n++){const g=l[n],G=d[n];try{let R=function(i){if(!i)return i;const C=[];let _=!1,m=null;const h=new Promise(o=>{m=o}),y=new Proxy(i,{get(o,c,f){if(c==="configure")return(...u)=>{const r=o.configure?.(...u);_=!0;try{C.forEach(({prop:w,args:I,resolve:A,reject:E})=>{try{const M=o[w].apply(o,I);M&&typeof M.then=="function"?M.then(A).catch(E):A(M)}catch(L){E(L)}})}catch{}C.length=0;try{y.__configured=!0}catch{}return m?.(),r};const s=o[c];return typeof s=="function"?(...u)=>{if(!_)return new Promise((r,w)=>{C.push({prop:c,args:u,resolve:r,reject:w})});try{return s.apply(o,u)}catch(r){throw r}}:s}});try{y.__whenConfigured=h,y.__configured=_}catch{}try{i.__whenConfigured=h,i.__configured=_;const o=i.configure;typeof o=="function"&&(i.configure=(...f)=>{const s=o.apply(i,f);_=!0;try{C.forEach(({prop:u,args:r,resolve:w,reject:I})=>{try{const E=i[u].apply(i,r);E&&typeof E.then=="function"?E.then(w).catch(I):w(E)}catch(A){I(A)}})}catch{}C.length=0;try{i.__configured=!0}catch{}return m?.(),s});const c=i.startLoginflow;typeof c=="function"&&(i.startLoginflow=(...f)=>_?c.apply(i,f):new Promise((s,u)=>{h.then(()=>{try{const r=c.apply(i,f);r&&typeof r.then=="function"?r.then(s).catch(u):s(r)}catch(r){u(r)}}).catch(()=>{try{const r=c.apply(i,f);r&&typeof r.then=="function"?r.then(s).catch(u):s(r)}catch(r){u(r)}})}))}catch{}try{h.then(()=>{setTimeout(()=>{try{document.querySelectorAll("pont-signin, pont-signup").forEach(o=>{try{if(o.__pontInitRetried)return;o.__pontInitRetried=!0;const c=o.__pontRetryInit;if(typeof c=="function"){try{c.call(o)}catch(f){console.error(f)}return}if(o.__pontFailedForConfig)try{o.connectedCallback?.()}catch(f){console.error(f)}}catch{}})}catch{}},0)})}catch{}return y};await X(G,e?.css);const k=e?await Z(g,e.js):await import(g),H=k.useAuthProvider?.(),N=R(H);try{k.Auth=N,k.useAuthProvider=()=>N}catch{}window.__pontCoreSdk={...k,Auth:N},v=window.__pontCoreSdk,window.__pontLoaded=!0,window.__pontLoading=void 0;try{const i=C=>{const _=customElements.get(C);if(!_)return;const m=_.prototype;if(m.__pontConfiguredPatched)return;m.__pontConfiguredPatched=!0;const h=m.connectedCallback;typeof h=="function"&&(m.connectedCallback=function(...y){const o=window.__pontCoreSdk?.Auth,c=o?.__whenConfigured,f=!!o?.__configured;if(c&&!f){c.then(()=>{try{h.apply(this,y)}catch(s){console.error(s)}}).catch(()=>{try{h.apply(this,y)}catch(s){console.error(s)}});return}try{h.apply(this,y)}catch(s){if(s&&typeof s.message=="string"&&s.message.includes("Auth.configure() must be called")&&c){c.then(()=>{try{h.apply(this,y)}catch(u){console.error(u)}});return}throw s}})};["pont-signin","pont-signup"].forEach(i)}catch{}return console.log(`PontKit Web Components loaded (${a}) from:`,g),v}catch(R){console.error(`Failed loading from ${g}`,R),p=R}}throw console.error("❌ Failed to load PontKit web components from all CDNs.",p),p}let O=null;async function Q(){typeof window>"u"||window.__pontCoreSdk?.openAccountSettingsModal||(O||(O=x().then(()=>{window.__pontCoreSdk?.openAccountSettingsModal||console.warn("[pontive-react] Core sdk loaded but modal functions are missing.")}).catch(t=>{throw console.error("[pontive-react] Failed to load core SDK:",t),t})),await O)}exports.CORE_ELEMENTS_VERSION=$;exports.RUNTIME_CONFIG_PATHS=U;exports.RUNTIME_CONFIG_TIMEOUT_MS=j;exports.ensureCoreSdkLoaded=Q;exports.fetchRuntimeConfig=V;exports.isExactVersion=F;exports.isSriHash=P;exports.loadWebComponents=x;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const $="1.1.1",U=["/__auth/auth/v1/runtime-config","/auth/v1/runtime-config"],j=1500,K=/^\d+\.\d+\.\d+$/;function F(t){return typeof t=="string"&&K.test(t)}function b(t){return typeof t=="string"&&/^https?:\/\//.test(t)}function N(t){return typeof t=="string"&&/^sha(256|384|512)-[A-Za-z0-9+/]+=*$/.test(t)}async function V(t={}){const a=t.fetchImpl??globalThis.fetch;if(typeof a!="function")return null;const l=t.urls??D(),d=t.timeoutMs??j;for(const e of l){const p=await W(a,e,d);if(p)return p}return null}function D(){return typeof window<"u"&&typeof window.__pontRuntimeConfigUrl=="string"?[window.__pontRuntimeConfigUrl]:U}async function W(t,a,l){const d=typeof AbortController=="function"?new AbortController:null,e=d?setTimeout(()=>d.abort(),l):null;try{const p=await t(a,{headers:{accept:"application/json"},signal:d?.signal});if(!p.ok)return null;const n=await p.json();if(!n||!F(n.core_elements_version))return null;const g={core_elements_version:n.core_elements_version,source:typeof n.source=="string"?n.source:void 0,catalog_revision:typeof n.catalog_revision=="number"?n.catalog_revision:void 0};return n.assets&&b(n.assets.js)&&b(n.assets.css)&&(g.assets={js:n.assets.js,css:n.assets.css}),n.integrity&&N(n.integrity.js)&&N(n.integrity.css)&&(g.integrity={js:n.integrity.js,css:n.integrity.css}),g}catch{return null}finally{e&&clearTimeout(e)}}let v=null,T=null;const E="@pontive/pontkit-core",q=[t=>`https://cdn.jsdelivr.net/npm/${E}@${t}/dist/index.mjs`,t=>`https://unpkg.com/${E}@${t}/dist/index.mjs`,t=>`https://esm.sh/${E}@${t}/dist/index.mjs`],z=[t=>`https://cdn.jsdelivr.net/npm/${E}@${t}/dist/styles.css`,t=>`https://unpkg.com/${E}@${t}/dist/styles.css`,t=>`https://esm.sh/${E}@${t}/dist/styles.css`],B=$;function X(t,a){return new Promise((l,d)=>{const e=document.createElement("link");e.rel="stylesheet",e.href=t,a&&(e.integrity=a,e.crossOrigin="anonymous"),e.onload=()=>l(),e.onerror=p=>d(p),document.head.appendChild(e)})}function Z(t,a){return new Promise((l,d)=>{const e=document.createElement("script");e.type="module",e.src=t,e.integrity=a,e.crossOrigin="anonymous",e.onload=()=>l(),e.onerror=()=>d(new Error(`core-elements module at ${t} failed to load or did not match its integrity hash`)),document.head.appendChild(e)}).then(()=>import(t))}async function x(){return typeof window>"u"||typeof document>"u"?null:window.__pontLoaded?window.__pontCoreSdk:window.__pontLoading?window.__pontLoading:(T||(T=J().catch(t=>{throw T=null,window.__pontLoading=void 0,t}),window.__pontLoading=T),T)}async function J(){const t=await V(),a=t?.core_elements_version??B,l=q.map(n=>n(a)),d=z.map(n=>n(a));t?.assets&&(l.unshift(t.assets.js),d.unshift(t.assets.css));const e=t?.integrity;let p=null;for(let n=0;n<l.length;n++){const g=l[n],G=d[n];try{let k=function(i){if(!i)return i;const C=[];let _=!1,m=null;const h=new Promise(o=>{m=o}),y=new Proxy(i,{get(o,c,f){if(c==="configure")return(...u)=>{const r=o.configure?.(...u);_=!0;try{C.forEach(({prop:w,args:I,resolve:A,reject:S})=>{try{const M=o[w].apply(o,I);M&&typeof M.then=="function"?M.then(A).catch(S):A(M)}catch(O){S(O)}})}catch{}C.length=0;try{y.__configured=!0}catch{}return m?.(),r};const s=o[c];return typeof s=="function"?(...u)=>{if(!_)return new Promise((r,w)=>{C.push({prop:c,args:u,resolve:r,reject:w})});try{return s.apply(o,u)}catch(r){throw r}}:s}});try{y.__whenConfigured=h,y.__configured=_}catch{}try{i.__whenConfigured=h,i.__configured=_;const o=i.configure;typeof o=="function"&&(i.configure=(...f)=>{const s=o.apply(i,f);_=!0;try{C.forEach(({prop:u,args:r,resolve:w,reject:I})=>{try{const S=i[u].apply(i,r);S&&typeof S.then=="function"?S.then(w).catch(I):w(S)}catch(A){I(A)}})}catch{}C.length=0;try{i.__configured=!0}catch{}return m?.(),s});const c=i.startLoginflow;typeof c=="function"&&(i.startLoginflow=(...f)=>_?c.apply(i,f):new Promise((s,u)=>{h.then(()=>{try{const r=c.apply(i,f);r&&typeof r.then=="function"?r.then(s).catch(u):s(r)}catch(r){u(r)}}).catch(()=>{try{const r=c.apply(i,f);r&&typeof r.then=="function"?r.then(s).catch(u):s(r)}catch(r){u(r)}})}))}catch{}try{h.then(()=>{setTimeout(()=>{try{document.querySelectorAll("pont-signin, pont-signup").forEach(o=>{try{if(o.__pontInitRetried)return;o.__pontInitRetried=!0;const c=o.__pontRetryInit;if(typeof c=="function"){try{c.call(o)}catch(f){console.error(f)}return}if(o.__pontFailedForConfig)try{o.connectedCallback?.()}catch(f){console.error(f)}}catch{}})}catch{}},0)})}catch{}return y};await X(G,e?.css);const P=e?await Z(g,e.js):await import(g),H=P.useAuthProvider?.(),R=k(H);try{P.Auth=R,P.useAuthProvider=()=>R}catch{}window.__pontCoreSdk={...P,Auth:R},v=window.__pontCoreSdk,window.__pontLoaded=!0,window.__pontLoading=void 0;try{const i=C=>{const _=customElements.get(C);if(!_)return;const m=_.prototype;if(m.__pontConfiguredPatched)return;m.__pontConfiguredPatched=!0;const h=m.connectedCallback;typeof h=="function"&&(m.connectedCallback=function(...y){const o=window.__pontCoreSdk?.Auth,c=o?.__whenConfigured,f=!!o?.__configured;if(c&&!f){c.then(()=>{try{h.apply(this,y)}catch(s){console.error(s)}}).catch(()=>{try{h.apply(this,y)}catch(s){console.error(s)}});return}try{h.apply(this,y)}catch(s){if(s&&typeof s.message=="string"&&s.message.includes("Auth.configure() must be called")&&c){c.then(()=>{try{h.apply(this,y)}catch(u){console.error(u)}});return}throw s}})};["pont-signin","pont-signup"].forEach(i)}catch{}return console.log(`PontKit Web Components loaded (${a}) from:`,g),v}catch(k){console.error(`Failed loading from ${g}`,k),p=k}}throw console.error("❌ Failed to load PontKit web components from all CDNs.",p),p}let L=null;async function Q(){typeof window>"u"||window.__pontCoreSdk?.openAccountSettingsModal||(L||(L=x().then(()=>{window.__pontCoreSdk?.openAccountSettingsModal||console.warn("[pontive-react] Core sdk loaded but modal functions are missing.")}).catch(t=>{throw console.error("[pontive-react] Failed to load core SDK:",t),t})),await L)}exports.CORE_ELEMENTS_VERSION=$;exports.RUNTIME_CONFIG_PATHS=U;exports.RUNTIME_CONFIG_TIMEOUT_MS=j;exports.ensureCoreSdkLoaded=Q;exports.fetchRuntimeConfig=V;exports.isExactVersion=F;exports.isSriHash=N;exports.loadWebComponents=x;
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","sources":["../src/core-elements-version.ts","../src/runtime-config.ts","../src/load-web-components.ts","../src/sdk-loaded.ts"],"sourcesContent":["/**\n * The exact `@pontive/pontkit-core` release this build loads from the CDN.\n *\n * It is the version installed as a dev dependency when the package was built —\n * i.e. the one the test suite ran against — baked in by `define` in\n * vite.config.ts and vitest.config.ts (see scripts/core-elements-version.mjs).\n * An exact version, never a range: an exact release is immutable on the CDN,\n * cacheable forever, and the only form that admits an integrity hash.\n *\n * Nothing at runtime may replace this with \"whatever is newest\" — that is the\n * defect it exists to end. The platform's runtime-config endpoint will be\n * allowed to override it, because that answer is the one the platform has\n * gated (pontive-spec/21-element-versioning-and-compatibility.md §9).\n */\nexport const CORE_ELEMENTS_VERSION: string = __CORE_ELEMENTS_VERSION__;\n","// Which @pontive/pontkit-core release to load, asked of the platform.\n//\n// The platform decides which release a project's screens render with — one\n// deployment default, an optional per-project canary — and publishes the answer\n// at `GET /auth/v1/runtime-config` on the project's auth server\n// (pontive-spec/21-element-versioning-and-compatibility.md §9). This package\n// reads it once, before importing the bundle, so an embedded widget renders\n// with the same release the hosted login pages do. The build-time stamp\n// (CORE_ELEMENTS_VERSION) is the fallback when the answer cannot be read.\n//\n// The endpoint is reached through the app's own origin when the SDK's proxy is\n// mounted (`/__auth/auth/v1/...`), and directly on `/auth/v1/...` when the app\n// itself runs on the auth domain. Both are tried; a host page can name a URL\n// outright with `window.__pontRuntimeConfigUrl`.\n\n/** The shape of GET /auth/v1/runtime-config. */\nexport interface RuntimeConfig {\n  core_elements_version: string;\n  catalog_revision?: number;\n  source?: string;\n  assets?: { js: string; css: string };\n  /**\n   * Subresource-integrity hashes (\"sha384-…\") of the release's module and\n   * stylesheet, recorded by the platform when the release was gated. When\n   * present the loader passes them to the browser, which refuses bytes that\n   * differ — from the platform origin or from any public CDN alike.\n   */\n  integrity?: { js: string; css: string };\n}\n\nexport const RUNTIME_CONFIG_PATHS = [\n  \"/__auth/auth/v1/runtime-config\",\n  \"/auth/v1/runtime-config\",\n] as const;\n\n/** How long to wait for the platform before loading the stamped release. */\nexport const RUNTIME_CONFIG_TIMEOUT_MS = 1500;\n\nconst EXACT_VERSION = /^\\d+\\.\\d+\\.\\d+$/;\n\nexport interface FetchRuntimeConfigOptions {\n  fetchImpl?: typeof fetch;\n  urls?: readonly string[];\n  timeoutMs?: number;\n}\n\n/** Whether `value` names one release rather than a range or garbage. */\nexport function isExactVersion(value: unknown): value is string {\n  return typeof value === \"string\" && EXACT_VERSION.test(value);\n}\n\nfunction isHttpUrl(value: unknown): value is string {\n  return typeof value === \"string\" && /^https?:\\/\\//.test(value);\n}\n\n/** Whether `value` is a well-formed SRI value the browser will accept. */\nexport function isSriHash(value: unknown): value is string {\n  return typeof value === \"string\" && /^sha(256|384|512)-[A-Za-z0-9+/]+=*$/.test(value);\n}\n\n/**\n * Reads the platform's runtime config, or null when no candidate URL answers\n * with one that can be trusted. Never throws: the caller's fallback is the\n * stamped release, and a reachability problem should not become a page error.\n */\nexport async function fetchRuntimeConfig(\n  options: FetchRuntimeConfigOptions = {},\n): Promise<RuntimeConfig | null> {\n  const fetchImpl = options.fetchImpl ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") return null;\n\n  const urls = options.urls ?? candidateUrls();\n  const timeoutMs = options.timeoutMs ?? RUNTIME_CONFIG_TIMEOUT_MS;\n\n  for (const url of urls) {\n    const config = await readOne(fetchImpl, url, timeoutMs);\n    if (config) return config;\n  }\n\n  return null;\n}\n\nfunction candidateUrls(): readonly string[] {\n  if (typeof window !== \"undefined\" && typeof window.__pontRuntimeConfigUrl === \"string\") {\n    return [window.__pontRuntimeConfigUrl];\n  }\n\n  return RUNTIME_CONFIG_PATHS;\n}\n\nasync function readOne(\n  fetchImpl: typeof fetch,\n  url: string,\n  timeoutMs: number,\n): Promise<RuntimeConfig | null> {\n  const controller = typeof AbortController === \"function\" ? new AbortController() : null;\n  const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;\n\n  try {\n    const response = await fetchImpl(url, {\n      headers: { accept: \"application/json\" },\n      signal: controller?.signal,\n    });\n    if (!response.ok) return null;\n\n    const body = (await response.json()) as Partial<RuntimeConfig> | null;\n    if (!body || !isExactVersion(body.core_elements_version)) return null;\n\n    const config: RuntimeConfig = {\n      core_elements_version: body.core_elements_version,\n      source: typeof body.source === \"string\" ? body.source : undefined,\n      catalog_revision:\n        typeof body.catalog_revision === \"number\" ? body.catalog_revision : undefined,\n    };\n\n    // Assets are taken only as a pair of absolute URLs; anything else means\n    // \"load from the CDN list by version\".\n    if (body.assets && isHttpUrl(body.assets.js) && isHttpUrl(body.assets.css)) {\n      config.assets = { js: body.assets.js, css: body.assets.css };\n    }\n\n    // Half a pair is no pair: the browser would check one file and not the\n    // other, and nobody would notice the unchecked one.\n    if (body.integrity && isSriHash(body.integrity.js) && isSriHash(body.integrity.css)) {\n      config.integrity = { js: body.integrity.js, css: body.integrity.css };\n    }\n\n    return config;\n  } catch {\n    return null;\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n","import { CORE_ELEMENTS_VERSION } from \"./core-elements-version\";\nimport { fetchRuntimeConfig } from \"./runtime-config\";\n\nlet coreSdk: any = null;\n\n// The load in flight, if any. This is the guard, and it is a promise rather\n// than a boolean on purpose: a flag set before the first `await` let a second\n// concurrent caller return `coreSdk` while it was still null, log that the\n// SDK's modal functions were missing, and carry on as if it were ready. A\n// promise gives every caller the same eventual answer. It is cleared on failure\n// so a later call can retry rather than inherit a latched failure.\nlet loadPromise: Promise<any> | null = null;\n\nconst PACKAGE_NAME = \"@pontive/pontkit-core\";\n\n// Base CDN templates (version will be injected)\nconst CDN_TEMPLATES = [\n  (v: string) =>\n    `https://cdn.jsdelivr.net/npm/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n  (v: string) => `https://unpkg.com/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n  (v: string) => `https://esm.sh/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n];\n\nconst CSS_TEMPLATES = [\n  (v: string) =>\n    `https://cdn.jsdelivr.net/npm/${PACKAGE_NAME}@${v}/dist/styles.css`,\n  (v: string) => `https://unpkg.com/${PACKAGE_NAME}@${v}/dist/styles.css`,\n  (v: string) => `https://esm.sh/${PACKAGE_NAME}@${v}/dist/styles.css`,\n];\n\n// Which release loads is decided by the PLATFORM, and failing that at BUILD\n// time — never by asking a registry at runtime. This package used to fetch jsDelivr's version list and take the\n// newest entry of any major — the `1.x` filter had been commented out — with\n// `^1` as the fallback when the fetch failed, a different major from the 2.x\n// the wrappers target. Whatever npm happened to hold newest is not a version\n// anyone tested against, and a customer's page picked it up on the next reload\n// with nothing in their build having changed.\n//\n// Now the project's auth server says which release its screens load\n// (GET /auth/v1/runtime-config, see ./runtime-config.ts), so an embedded widget\n// renders with the same bundle the hosted login pages do, and a canary or a\n// promotion reaches it without a rebuild. CORE_ELEMENTS_VERSION — the exact\n// release this package was built and tested with — is the fallback when that\n// endpoint cannot be read.\nconst FALLBACK_VERSION = CORE_ELEMENTS_VERSION;\n\nfunction loadCss(url: string, integrity?: string) {\n  return new Promise<void>((resolve, reject) => {\n    const link = document.createElement(\"link\");\n    link.rel = \"stylesheet\";\n    link.href = url;\n    if (integrity) {\n      // SRI is only enforced on a CORS-mode fetch; the platform origin and the\n      // public CDNs all answer with Access-Control-Allow-Origin: *.\n      link.integrity = integrity;\n      link.crossOrigin = \"anonymous\";\n    }\n    link.onload = () => resolve();\n    link.onerror = (err) => reject(err);\n    document.head.appendChild(link);\n  });\n}\n\n// Loads the module through a <script type=\"module\"> carrying the integrity\n// attribute, then imports it. A dynamic import() cannot carry SRI, but the\n// script element can, and once it has fetched and verified the module the\n// browser's module map holds it under that URL — the import() that follows\n// resolves from the map without a second fetch. A hash mismatch fails the\n// script's load, the promise rejects, and the loader moves to the next\n// source, which is the right outcome: bytes the platform did not gate must not\n// run, wherever they came from.\nfunction loadVerifiedModule(url: string, integrity: string): Promise<any> {\n  return new Promise<void>((resolve, reject) => {\n    const script = document.createElement(\"script\");\n    script.type = \"module\";\n    script.src = url;\n    script.integrity = integrity;\n    script.crossOrigin = \"anonymous\";\n    script.onload = () => resolve();\n    script.onerror = () =>\n      reject(new Error(`core-elements module at ${url} failed to load or did not match its integrity hash`));\n    document.head.appendChild(script);\n  }).then(\n    () =>\n      import(\n        /* webpackIgnore: true */\n        /* turbopackIgnore: true */\n        /* @vite-ignore */\n        url\n      ),\n  );\n}\n\nexport async function loadWebComponents(): Promise<any> {\n  // No DOM means no custom elements to define and no CDN to fetch from.\n  //\n  // Returning rather than throwing matters because src/index.ts calls this at\n  // module scope: under a server renderer the rejection surfaced as a console\n  // error on every render, reporting a failure that is not one. Checked before\n  // the guards below so the browser still loads normally after hydration.\n  if (typeof window === \"undefined\" || typeof document === \"undefined\") {\n    return null;\n  }\n\n  // Another copy of this package on the same page already finished loading.\n  if (window.__pontLoaded) {\n    return window.__pontCoreSdk;\n  }\n\n  // Another copy of this package on the same page is loading right now.\n  if (window.__pontLoading) {\n    return window.__pontLoading;\n  }\n\n  if (!loadPromise) {\n    loadPromise = loadFromCdn().catch((err) => {\n      loadPromise = null;\n      window.__pontLoading = undefined;\n      throw err;\n    });\n\n    window.__pontLoading = loadPromise;\n  }\n\n  return loadPromise;\n}\n\nasync function loadFromCdn(): Promise<any> {\n  const runtime = await fetchRuntimeConfig();\n  const resolvedVersion = runtime?.core_elements_version ?? FALLBACK_VERSION;\n\n  const CDN_SOURCES = CDN_TEMPLATES.map((fn) => fn(resolvedVersion));\n  const CSS_SOURCES = CSS_TEMPLATES.map((fn) => fn(resolvedVersion));\n\n  // The platform's own asset location goes first when it names one; the public\n  // CDNs stay as the fallback list for the same version.\n  if (runtime?.assets) {\n    CDN_SOURCES.unshift(runtime.assets.js);\n    CSS_SOURCES.unshift(runtime.assets.css);\n  }\n\n  // The hashes describe the npm release's bytes, which every source below\n  // serves verbatim, so they apply to all of them — not only to the\n  // platform's. A source whose bytes differ is a source that must not run.\n  const integrity = runtime?.integrity;\n\n  let lastError: unknown = null;\n\n  for (let i = 0; i < CDN_SOURCES.length; i++) {\n    const cdn = CDN_SOURCES[i];\n    const cssCdn = CSS_SOURCES[i];\n\n    try {\n      // 2️⃣ Load CSS first\n      await loadCss(cssCdn, integrity?.css);\n\n      // 3️⃣ Load JS module\n      //\n      // All three ignore directives, and none of them is optional.\n      //\n      // `cdn` is a full URL resolved at runtime, so a bundler that tries to\n      // resolve it statically cannot: webpack and Turbopack turn a dynamic\n      // import with a variable specifier into a module-graph lookup and throw\n      // `Cannot find module 'https://…'` at runtime — no network request is ever\n      // made, and the message reads as though the CDN were at fault. Next.js\n      // uses Turbopack in development and webpack in production, so an app\n      // built with it failed on every CDN in the list identically.\n      //\n      // `@vite-ignore` alone covered only Vite. Each bundler reads its own\n      // comment and ignores the others, so all three coexist and each one keeps\n      // this a real runtime import.\n      const module: any = integrity\n        ? await loadVerifiedModule(cdn, integrity.js)\n        : await import(\n            /* webpackIgnore: true */\n            /* turbopackIgnore: true */\n            /* @vite-ignore */\n            cdn\n          );\n\n      // 4️⃣ Expose globally\n      // Wrap Auth so calls made before `configure()` won't throw. Instead\n      // we queue them and flush once configure() is called by the provider.\n      function createSafeAuth(auth: any) {\n        if (!auth) return auth;\n        type QItem = {\n          prop: string | symbol;\n          args: any[];\n          resolve: (v: any) => void;\n          reject: (e: any) => void;\n        };\n        const queue: QItem[] = [];\n        let configured = false;\n\n        // Expose a configured promise and flag on the proxy so other parts\n        // of the app can wait for Auth to be configured (helps avoid errors\n        // thrown by custom elements that start flows on connect).\n        let resolveWhenConfigured: (() => void) | null = null;\n        const whenConfigured = new Promise<void>((res) => {\n          resolveWhenConfigured = res;\n        });\n\n        const proxy = new Proxy(auth, {\n          get(target, prop, receiver) {\n            if (prop === \"configure\") {\n              return (...args: any[]) => {\n                const res = (target as any).configure?.(...args);\n                configured = true;\n                try {\n                  // flush queued calls\n                  queue.forEach(({ prop: p, args: a, resolve, reject }) => {\n                    try {\n                      const fn = (target as any)[p];\n                      const r = fn.apply(target, a);\n                      if (r && typeof r.then === \"function\") {\n                        r.then(resolve).catch(reject);\n                      } else {\n                        resolve(r);\n                      }\n                    } catch (err) {\n                      reject(err);\n                    }\n                  });\n                } catch (e) {\n                  // ignore flushing errors\n                }\n                queue.length = 0;\n                // mark proxy as configured and resolve the promise\n                try {\n                  (proxy as any).__configured = true;\n                } catch (e) {\n                  /* ignore */\n                }\n                resolveWhenConfigured?.();\n                return res;\n              };\n            }\n\n            const val = (target as any)[prop];\n            if (typeof val === \"function\") {\n              return (...args: any[]) => {\n                if (!configured) {\n                  // queue the call and return a Promise that resolves when flushed\n                  return new Promise((resolve, reject) => {\n                    queue.push({ prop, args, resolve, reject });\n                  });\n                }\n                try {\n                  return val.apply(target, args);\n                } catch (e) {\n                  // preserve throwing behavior for already-configured\n                  throw e;\n                }\n              };\n            }\n            return val;\n          },\n        });\n\n        // Attach the whenConfigured promise and configured flag to the proxy\n        try {\n          (proxy as any).__whenConfigured = whenConfigured;\n          (proxy as any).__configured = configured;\n        } catch (e) {\n          /* ignore */\n        }\n\n        // Also patch the original `auth` object (if present) so that direct\n        // imports and in-module usages get queued behavior too. This ensures\n        // that calls like `Auth.startLoginflow()` won't throw even if they\n        // happen before `configure()` is invoked.\n        try {\n          // Mark the original with the same hooks\n          (auth as any).__whenConfigured = whenConfigured;\n          (auth as any).__configured = configured;\n\n          const origConfigure = (auth as any).configure;\n          if (typeof origConfigure === \"function\") {\n            (auth as any).configure = (...args: any[]) => {\n              const res = origConfigure.apply(auth, args);\n              configured = true;\n              try {\n                queue.forEach(({ prop: p, args: a, resolve, reject }) => {\n                  try {\n                    const fn = (auth as any)[p];\n                    const r = fn.apply(auth, a);\n                    if (r && typeof r.then === \"function\") {\n                      r.then(resolve).catch(reject);\n                    } else {\n                      resolve(r);\n                    }\n                  } catch (err) {\n                    reject(err);\n                  }\n                });\n              } catch (e) {\n                /* ignore */\n              }\n              queue.length = 0;\n              try {\n                (auth as any).__configured = true;\n              } catch (e) {\n                /* ignore */\n              }\n              resolveWhenConfigured?.();\n              return res;\n            };\n          }\n\n          const origStart = (auth as any).startLoginflow;\n          if (typeof origStart === \"function\") {\n            (auth as any).startLoginflow = (...args: any[]) => {\n              if (!configured) {\n                return new Promise((resolve, reject) => {\n                  whenConfigured\n                    .then(() => {\n                      try {\n                        const r = origStart.apply(auth, args);\n                        if (r && typeof r.then === \"function\") {\n                          r.then(resolve).catch(reject);\n                        } else {\n                          resolve(r);\n                        }\n                      } catch (err) {\n                        reject(err);\n                      }\n                    })\n                    .catch(() => {\n                      try {\n                        const r = origStart.apply(auth, args);\n                        if (r && typeof r.then === \"function\") {\n                          r.then(resolve).catch(reject);\n                        } else {\n                          resolve(r);\n                        }\n                      } catch (err) {\n                        reject(err);\n                      }\n                    });\n                });\n              }\n\n              return origStart.apply(auth, args);\n            };\n          }\n        } catch (e) {\n          /* ignore */\n        }\n\n        // When auth is configured, call an explicit retry method on any\n        // sign-in/up elements that implement it. Prefer an explicit retry\n        // API so elements can be idempotent and avoid duplicate flows.\n        try {\n          whenConfigured.then(() => {\n            setTimeout(() => {\n              try {\n                document\n                  .querySelectorAll(\"pont-signin, pont-signup\")\n                  .forEach((el) => {\n                    try {\n                      if ((el as any).__pontInitRetried) return;\n                      (el as any).__pontInitRetried = true;\n                      // Prefer an explicit retry API implemented by the element\n                      // (e.g., `__pontRetryInit`) to avoid re-running the\n                      // entire `connectedCallback` which may cause duplicates.\n                      const retry = (el as any).__pontRetryInit;\n                      if (typeof retry === \"function\") {\n                        try {\n                          retry.call(el);\n                        } catch (e) {\n                          console.error(e);\n                        }\n                        return;\n                      }\n\n                      // Fallback: only call connectedCallback if the element\n                      // provides an explicit flag saying it previously failed\n                      // due to missing Auth (set by our connectedCallback wrapper\n                      // when we detect that specific error).\n                      if ((el as any).__pontFailedForConfig) {\n                        try {\n                          (el as any).connectedCallback?.();\n                        } catch (e) {\n                          console.error(e);\n                        }\n                      }\n                    } catch (_) {\n                      // ignore per-element errors\n                    }\n                  });\n              } catch (_) {\n                /* ignore */\n              }\n            }, 0);\n          });\n        } catch (e) {\n          /* ignore */\n        }\n\n        return proxy;\n      }\n\n      // Replace module exports so consumers that import `Auth` directly\n      // get the safe proxy as well. Also ensure `useAuthProvider()` returns\n      // the proxy.\n      const realAuth = module.useAuthProvider?.();\n      const safeAuth = createSafeAuth(realAuth);\n\n      try {\n        (module as any).Auth = safeAuth;\n        (module as any).useAuthProvider = () => safeAuth;\n      } catch (e) {\n        /* ignore */\n      }\n\n      window.__pontCoreSdk = {\n        ...module,\n        Auth: safeAuth,\n      };\n\n      coreSdk = window.__pontCoreSdk;\n\n      // Set only once the SDK is actually on the window, so a copy of this\n      // package that sees the flag can trust what it reads next to it.\n      window.__pontLoaded = true;\n      window.__pontLoading = undefined;\n\n      // Patch known elements that may start flows on connect so they wait\n      // for Auth to be configured instead of throwing. This avoids noisy\n      // runtime errors like \"Auth.configure() must be called\".\n      try {\n        const patchElement = (tagName: string) => {\n          const ctor = customElements.get(tagName);\n          if (!ctor) return;\n          const proto = ctor.prototype as any;\n          if (proto.__pontConfiguredPatched) return;\n          proto.__pontConfiguredPatched = true;\n\n          const orig = proto.connectedCallback;\n          if (typeof orig !== \"function\") return;\n\n          proto.connectedCallback = function (...args: any[]) {\n            const auth = window.__pontCoreSdk?.Auth as any;\n            const whenConfigured = auth?.__whenConfigured as\n              | Promise<void>\n              | undefined;\n            const configured = !!auth?.__configured;\n\n            if (whenConfigured && !configured) {\n              // delay initial connect work until Auth is configured\n              whenConfigured\n                .then(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (e) {\n                    console.error(e);\n                  }\n                })\n                .catch(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (e) {\n                    console.error(e);\n                  }\n                });\n              return;\n            }\n\n            try {\n              orig.apply(this, args);\n            } catch (e: any) {\n              // If it still throws with the configure error, retry after configured\n              if (\n                e &&\n                typeof e.message === \"string\" &&\n                e.message.includes(\"Auth.configure() must be called\") &&\n                whenConfigured\n              ) {\n                whenConfigured.then(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (err) {\n                    console.error(err);\n                  }\n                });\n                return;\n              }\n              throw e;\n            }\n          };\n        };\n\n        // Elements known to start auth flows on connect\n        [\"pont-signin\", \"pont-signup\"].forEach(patchElement);\n      } catch (e) {\n        /* ignore patch errors */\n      }\n\n      console.log(\n        `PontKit Web Components loaded (${resolvedVersion}) from:`,\n        cdn,\n      );\n\n      return coreSdk;\n    } catch (err) {\n      console.error(`Failed loading from ${cdn}`, err);\n      lastError = err;\n    }\n  }\n\n  console.error(\n    \"❌ Failed to load PontKit web components from all CDNs.\",\n    lastError,\n  );\n  throw lastError;\n}\n","import { loadWebComponents } from \"./load-web-components\";\n\nlet coreSdkLoadPromise: Promise<void> | null = null;\n\n/**\n * Ensures the core SDK is loaded and the global functions are available.\n * Returns a promise that resolves when the SDK is ready.\n */\nexport async function ensureCoreSdkLoaded(): Promise<void> {\n  // Nothing to ensure without a browser, and the check below would throw before\n  // reaching loadWebComponents' own guard.\n  if (typeof window === \"undefined\") {\n    return;\n  }\n\n  // If the functions already exist, we're done.\n  if (window.__pontCoreSdk?.openAccountSettingsModal) {\n    return;\n  }\n\n  // Otherwise, start loading the SDK if not already loading.\n  if (!coreSdkLoadPromise) {\n    coreSdkLoadPromise = loadWebComponents()\n      .then(() => {\n        // The first SDK script attaches the functions synchronously when it executes.\n        if (!window.__pontCoreSdk?.openAccountSettingsModal) {\n          console.warn(\n            \"[pontive-react] Core sdk loaded but modal functions are missing.\",\n          );\n        }\n      })\n      .catch((err) => {\n        console.error(\"[pontive-react] Failed to load core SDK:\", err);\n        throw err;\n      });\n  }\n\n  await coreSdkLoadPromise;\n}\n"],"names":["CORE_ELEMENTS_VERSION","RUNTIME_CONFIG_PATHS","RUNTIME_CONFIG_TIMEOUT_MS","EXACT_VERSION","isExactVersion","value","isHttpUrl","isSriHash","fetchRuntimeConfig","options","fetchImpl","urls","candidateUrls","timeoutMs","url","config","readOne","controller","timer","response","body","coreSdk","loadPromise","PACKAGE_NAME","CDN_TEMPLATES","v","CSS_TEMPLATES","FALLBACK_VERSION","loadCss","integrity","resolve","reject","link","err","loadVerifiedModule","script","loadWebComponents","loadFromCdn","runtime","resolvedVersion","CDN_SOURCES","fn","CSS_SOURCES","lastError","i","cdn","cssCdn","createSafeAuth","auth","queue","configured","resolveWhenConfigured","whenConfigured","res","proxy","target","prop","receiver","args","p","a","r","val","e","origConfigure","origStart","el","retry","module","realAuth","safeAuth","patchElement","tagName","ctor","proto","orig","coreSdkLoadPromise","ensureCoreSdkLoaded"],"mappings":"gFAcO,MAAMA,EAAgC,0BCgBhCC,EAAuB,CAClC,iCACA,yBACF,EAGaC,EAA4B,KAEnCC,EAAgB,kBASf,SAASC,EAAeC,EAAiC,CAC9D,OAAO,OAAOA,GAAU,UAAYF,EAAc,KAAKE,CAAK,CAC9D,CAEA,SAASC,EAAUD,EAAiC,CAClD,OAAO,OAAOA,GAAU,UAAY,eAAe,KAAKA,CAAK,CAC/D,CAGO,SAASE,EAAUF,EAAiC,CACzD,OAAO,OAAOA,GAAU,UAAY,sCAAsC,KAAKA,CAAK,CACtF,CAOA,eAAsBG,EACpBC,EAAqC,GACN,CAC/B,MAAMC,EAAYD,EAAQ,WAAa,WAAW,MAClD,GAAI,OAAOC,GAAc,WAAY,OAAO,KAE5C,MAAMC,EAAOF,EAAQ,MAAQG,EAAA,EACvBC,EAAYJ,EAAQ,WAAaP,EAEvC,UAAWY,KAAOH,EAAM,CACtB,MAAMI,EAAS,MAAMC,EAAQN,EAAWI,EAAKD,CAAS,EACtD,GAAIE,EAAQ,OAAOA,CACrB,CAEA,OAAO,IACT,CAEA,SAASH,GAAmC,CAC1C,OAAI,OAAO,OAAW,KAAe,OAAO,OAAO,wBAA2B,SACrE,CAAC,OAAO,sBAAsB,EAGhCX,CACT,CAEA,eAAee,EACbN,EACAI,EACAD,EAC+B,CAC/B,MAAMI,EAAa,OAAO,iBAAoB,WAAa,IAAI,gBAAoB,KAC7EC,EAAQD,EAAa,WAAW,IAAMA,EAAW,MAAA,EAASJ,CAAS,EAAI,KAE7E,GAAI,CACF,MAAMM,EAAW,MAAMT,EAAUI,EAAK,CACpC,QAAS,CAAE,OAAQ,kBAAA,EACnB,OAAQG,GAAY,MAAA,CACrB,EACD,GAAI,CAACE,EAAS,GAAI,OAAO,KAEzB,MAAMC,EAAQ,MAAMD,EAAS,KAAA,EAC7B,GAAI,CAACC,GAAQ,CAAChB,EAAegB,EAAK,qBAAqB,EAAG,OAAO,KAEjE,MAAML,EAAwB,CAC5B,sBAAuBK,EAAK,sBAC5B,OAAQ,OAAOA,EAAK,QAAW,SAAWA,EAAK,OAAS,OACxD,iBACE,OAAOA,EAAK,kBAAqB,SAAWA,EAAK,iBAAmB,MAAA,EAKxE,OAAIA,EAAK,QAAUd,EAAUc,EAAK,OAAO,EAAE,GAAKd,EAAUc,EAAK,OAAO,GAAG,IACvEL,EAAO,OAAS,CAAE,GAAIK,EAAK,OAAO,GAAI,IAAKA,EAAK,OAAO,GAAA,GAKrDA,EAAK,WAAab,EAAUa,EAAK,UAAU,EAAE,GAAKb,EAAUa,EAAK,UAAU,GAAG,IAChFL,EAAO,UAAY,CAAE,GAAIK,EAAK,UAAU,GAAI,IAAKA,EAAK,UAAU,GAAA,GAG3DL,CACT,MAAQ,CACN,OAAO,IACT,QAAA,CACMG,gBAAoBA,CAAK,CAC/B,CACF,CClIA,IAAIG,EAAe,KAQfC,EAAmC,KAEvC,MAAMC,EAAe,wBAGfC,EAAgB,CACnBC,GACC,gCAAgCF,CAAY,IAAIE,CAAC,kBAClDA,GAAc,qBAAqBF,CAAY,IAAIE,CAAC,kBACpDA,GAAc,kBAAkBF,CAAY,IAAIE,CAAC,iBACpD,EAEMC,EAAgB,CACnBD,GACC,gCAAgCF,CAAY,IAAIE,CAAC,mBAClDA,GAAc,qBAAqBF,CAAY,IAAIE,CAAC,mBACpDA,GAAc,kBAAkBF,CAAY,IAAIE,CAAC,kBACpD,EAgBME,EAAmB3B,EAEzB,SAAS4B,EAAQd,EAAae,EAAoB,CAChD,OAAO,IAAI,QAAc,CAACC,EAASC,IAAW,CAC5C,MAAMC,EAAO,SAAS,cAAc,MAAM,EAC1CA,EAAK,IAAM,aACXA,EAAK,KAAOlB,EACRe,IAGFG,EAAK,UAAYH,EACjBG,EAAK,YAAc,aAErBA,EAAK,OAAS,IAAMF,EAAA,EACpBE,EAAK,QAAWC,GAAQF,EAAOE,CAAG,EAClC,SAAS,KAAK,YAAYD,CAAI,CAChC,CAAC,CACH,CAUA,SAASE,EAAmBpB,EAAae,EAAiC,CACxE,OAAO,IAAI,QAAc,CAACC,EAASC,IAAW,CAC5C,MAAMI,EAAS,SAAS,cAAc,QAAQ,EAC9CA,EAAO,KAAO,SACdA,EAAO,IAAMrB,EACbqB,EAAO,UAAYN,EACnBM,EAAO,YAAc,YACrBA,EAAO,OAAS,IAAML,EAAA,EACtBK,EAAO,QAAU,IACfJ,EAAO,IAAI,MAAM,2BAA2BjB,CAAG,qDAAqD,CAAC,EACvG,SAAS,KAAK,YAAYqB,CAAM,CAClC,CAAC,EAAE,KACD,IACE,OAIErB,EAAA,CAGR,CAEA,eAAsBsB,GAAkC,CAOtD,OAAI,OAAO,OAAW,KAAe,OAAO,SAAa,IAChD,KAIL,OAAO,aACF,OAAO,cAIZ,OAAO,cACF,OAAO,eAGXd,IACHA,EAAce,EAAA,EAAc,MAAOJ,GAAQ,CACzC,MAAAX,EAAc,KACd,OAAO,cAAgB,OACjBW,CACR,CAAC,EAED,OAAO,cAAgBX,GAGlBA,EACT,CAEA,eAAee,GAA4B,CACzC,MAAMC,EAAU,MAAM9B,EAAA,EAChB+B,EAAkBD,GAAS,uBAAyBX,EAEpDa,EAAchB,EAAc,IAAKiB,GAAOA,EAAGF,CAAe,CAAC,EAC3DG,EAAchB,EAAc,IAAKe,GAAOA,EAAGF,CAAe,CAAC,EAI7DD,GAAS,SACXE,EAAY,QAAQF,EAAQ,OAAO,EAAE,EACrCI,EAAY,QAAQJ,EAAQ,OAAO,GAAG,GAMxC,MAAMT,EAAYS,GAAS,UAE3B,IAAIK,EAAqB,KAEzB,QAASC,EAAI,EAAGA,EAAIJ,EAAY,OAAQI,IAAK,CAC3C,MAAMC,EAAML,EAAYI,CAAC,EACnBE,EAASJ,EAAYE,CAAC,EAE5B,GAAI,CA+BF,IAASG,EAAT,SAAwBC,EAAW,CACjC,GAAI,CAACA,EAAM,OAAOA,EAOlB,MAAMC,EAAiB,CAAA,EACvB,IAAIC,EAAa,GAKbC,EAA6C,KACjD,MAAMC,EAAiB,IAAI,QAAeC,GAAQ,CAChDF,EAAwBE,CAC1B,CAAC,EAEKC,EAAQ,IAAI,MAAMN,EAAM,CAC5B,IAAIO,EAAQC,EAAMC,EAAU,CAC1B,GAAID,IAAS,YACX,MAAO,IAAIE,IAAgB,CACzB,MAAML,EAAOE,EAAe,YAAY,GAAGG,CAAI,EAC/CR,EAAa,GACb,GAAI,CAEFD,EAAM,QAAQ,CAAC,CAAE,KAAMU,EAAG,KAAMC,EAAG,QAAA9B,EAAS,OAAAC,KAAa,CACvD,GAAI,CAEF,MAAM8B,EADMN,EAAeI,CAAC,EACf,MAAMJ,EAAQK,CAAC,EACxBC,GAAK,OAAOA,EAAE,MAAS,WACzBA,EAAE,KAAK/B,CAAO,EAAE,MAAMC,CAAM,EAE5BD,EAAQ+B,CAAC,CAEb,OAAS5B,EAAK,CACZF,EAAOE,CAAG,CACZ,CACF,CAAC,CACH,MAAY,CAEZ,CACAgB,EAAM,OAAS,EAEf,GAAI,CACDK,EAAc,aAAe,EAChC,MAAY,CAEZ,CACA,OAAAH,IAAA,EACOE,CACT,EAGF,MAAMS,EAAOP,EAAeC,CAAI,EAChC,OAAI,OAAOM,GAAQ,WACV,IAAIJ,IAAgB,CACzB,GAAI,CAACR,EAEH,OAAO,IAAI,QAAQ,CAACpB,EAASC,IAAW,CACtCkB,EAAM,KAAK,CAAE,KAAAO,EAAM,KAAAE,EAAM,QAAA5B,EAAS,OAAAC,EAAQ,CAC5C,CAAC,EAEH,GAAI,CACF,OAAO+B,EAAI,MAAMP,EAAQG,CAAI,CAC/B,OAASK,EAAG,CAEV,MAAMA,CACR,CACF,EAEKD,CACT,CAAA,CACD,EAGD,GAAI,CACDR,EAAc,iBAAmBF,EACjCE,EAAc,aAAeJ,CAChC,MAAY,CAEZ,CAMA,GAAI,CAEDF,EAAa,iBAAmBI,EAChCJ,EAAa,aAAeE,EAE7B,MAAMc,EAAiBhB,EAAa,UAChC,OAAOgB,GAAkB,aAC1BhB,EAAa,UAAY,IAAIU,IAAgB,CAC5C,MAAML,EAAMW,EAAc,MAAMhB,EAAMU,CAAI,EAC1CR,EAAa,GACb,GAAI,CACFD,EAAM,QAAQ,CAAC,CAAE,KAAMU,EAAG,KAAMC,EAAG,QAAA9B,EAAS,OAAAC,KAAa,CACvD,GAAI,CAEF,MAAM8B,EADMb,EAAaW,CAAC,EACb,MAAMX,EAAMY,CAAC,EACtBC,GAAK,OAAOA,EAAE,MAAS,WACzBA,EAAE,KAAK/B,CAAO,EAAE,MAAMC,CAAM,EAE5BD,EAAQ+B,CAAC,CAEb,OAAS5B,EAAK,CACZF,EAAOE,CAAG,CACZ,CACF,CAAC,CACH,MAAY,CAEZ,CACAgB,EAAM,OAAS,EACf,GAAI,CACDD,EAAa,aAAe,EAC/B,MAAY,CAEZ,CACA,OAAAG,IAAA,EACOE,CACT,GAGF,MAAMY,EAAajB,EAAa,eAC5B,OAAOiB,GAAc,aACtBjB,EAAa,eAAiB,IAAIU,IAC5BR,EA8BEe,EAAU,MAAMjB,EAAMU,CAAI,EA7BxB,IAAI,QAAQ,CAAC5B,EAASC,IAAW,CACtCqB,EACG,KAAK,IAAM,CACV,GAAI,CACF,MAAM,EAAIa,EAAU,MAAMjB,EAAMU,CAAI,EAChC,GAAK,OAAO,EAAE,MAAS,WACzB,EAAE,KAAK5B,CAAO,EAAE,MAAMC,CAAM,EAE5BD,EAAQ,CAAC,CAEb,OAASG,EAAK,CACZF,EAAOE,CAAG,CACZ,CACF,CAAC,EACA,MAAM,IAAM,CACX,GAAI,CACF,MAAM,EAAIgC,EAAU,MAAMjB,EAAMU,CAAI,EAChC,GAAK,OAAO,EAAE,MAAS,WACzB,EAAE,KAAK5B,CAAO,EAAE,MAAMC,CAAM,EAE5BD,EAAQ,CAAC,CAEb,OAASG,EAAK,CACZF,EAAOE,CAAG,CACZ,CACF,CAAC,CACL,CAAC,EAMT,MAAY,CAEZ,CAKA,GAAI,CACFmB,EAAe,KAAK,IAAM,CACxB,WAAW,IAAM,CACf,GAAI,CACF,SACG,iBAAiB,0BAA0B,EAC3C,QAASc,GAAO,CACf,GAAI,CACF,GAAKA,EAAW,kBAAmB,OAClCA,EAAW,kBAAoB,GAIhC,MAAMC,EAASD,EAAW,gBAC1B,GAAI,OAAOC,GAAU,WAAY,CAC/B,GAAI,CACFA,EAAM,KAAKD,CAAE,CACf,OAASH,EAAG,CACV,QAAQ,MAAMA,CAAC,CACjB,CACA,MACF,CAMA,GAAKG,EAAW,sBACd,GAAI,CACDA,EAAW,oBAAA,CACd,OAASH,EAAG,CACV,QAAQ,MAAMA,CAAC,CACjB,CAEJ,MAAY,CAEZ,CACF,CAAC,CACL,MAAY,CAEZ,CACF,EAAG,CAAC,CACN,CAAC,CACH,MAAY,CAEZ,CAEA,OAAOT,CACT,EAtPA,MAAM1B,EAAQkB,EAAQjB,GAAW,GAAG,EAiBpC,MAAMuC,EAAcvC,EAChB,MAAMK,EAAmBW,EAAKhB,EAAU,EAAE,EAC1C,MAAM,OAIJgB,GAoOAwB,EAAWD,EAAO,kBAAA,EAClBE,EAAWvB,EAAesB,CAAQ,EAExC,GAAI,CACDD,EAAe,KAAOE,EACtBF,EAAe,gBAAkB,IAAME,CAC1C,MAAY,CAEZ,CAEA,OAAO,cAAgB,CACrB,GAAGF,EACH,KAAME,CAAA,EAGRjD,EAAU,OAAO,cAIjB,OAAO,aAAe,GACtB,OAAO,cAAgB,OAKvB,GAAI,CACF,MAAMkD,EAAgBC,GAAoB,CACxC,MAAMC,EAAO,eAAe,IAAID,CAAO,EACvC,GAAI,CAACC,EAAM,OACX,MAAMC,EAAQD,EAAK,UACnB,GAAIC,EAAM,wBAAyB,OACnCA,EAAM,wBAA0B,GAEhC,MAAMC,EAAOD,EAAM,kBACf,OAAOC,GAAS,aAEpBD,EAAM,kBAAoB,YAAahB,EAAa,CAClD,MAAMV,EAAO,OAAO,eAAe,KAC7BI,EAAiBJ,GAAM,iBAGvBE,EAAa,CAAC,CAACF,GAAM,aAE3B,GAAII,GAAkB,CAACF,EAAY,CAEjCE,EACG,KAAK,IAAM,CACV,GAAI,CACFuB,EAAK,MAAM,KAAMjB,CAAI,CACvB,OAASK,EAAG,CACV,QAAQ,MAAMA,CAAC,CACjB,CACF,CAAC,EACA,MAAM,IAAM,CACX,GAAI,CACFY,EAAK,MAAM,KAAMjB,CAAI,CACvB,OAASK,EAAG,CACV,QAAQ,MAAMA,CAAC,CACjB,CACF,CAAC,EACH,MACF,CAEA,GAAI,CACFY,EAAK,MAAM,KAAMjB,CAAI,CACvB,OAASK,EAAQ,CAEf,GACEA,GACA,OAAOA,EAAE,SAAY,UACrBA,EAAE,QAAQ,SAAS,iCAAiC,GACpDX,EACA,CACAA,EAAe,KAAK,IAAM,CACxB,GAAI,CACFuB,EAAK,MAAM,KAAMjB,CAAI,CACvB,OAASzB,EAAK,CACZ,QAAQ,MAAMA,CAAG,CACnB,CACF,CAAC,EACD,MACF,CACA,MAAM8B,CACR,CACF,EACF,EAGA,CAAC,cAAe,aAAa,EAAE,QAAQQ,CAAY,CACrD,MAAY,CAEZ,CAEA,eAAQ,IACN,kCAAkChC,CAAe,UACjDM,CAAA,EAGKxB,CACT,OAASY,EAAK,CACZ,QAAQ,MAAM,uBAAuBY,CAAG,GAAIZ,CAAG,EAC/CU,EAAYV,CACd,CACF,CAEA,cAAQ,MACN,yDACAU,CAAA,EAEIA,CACR,CCjgBA,IAAIiC,EAA2C,KAM/C,eAAsBC,GAAqC,CAGrD,OAAO,OAAW,KAKlB,OAAO,eAAe,2BAKrBD,IACHA,EAAqBxC,IAClB,KAAK,IAAM,CAEL,OAAO,eAAe,0BACzB,QAAQ,KACN,kEAAA,CAGN,CAAC,EACA,MAAOH,GAAQ,CACd,cAAQ,MAAM,2CAA4CA,CAAG,EACvDA,CACR,CAAC,GAGL,MAAM2C,EACR"}
+{"version":3,"file":"index.cjs","sources":["../src/core-elements-version.ts","../src/runtime-config.ts","../src/load-web-components.ts","../src/sdk-loaded.ts"],"sourcesContent":["/**\n * The exact `@pontive/pontkit-core` release this build loads from the CDN.\n *\n * It is the version installed as a dev dependency when the package was built —\n * i.e. the one the test suite ran against — baked in by `define` in\n * vite.config.ts and vitest.config.ts (see scripts/core-elements-version.mjs).\n * An exact version, never a range: an exact release is immutable on the CDN,\n * cacheable forever, and the only form that admits an integrity hash.\n *\n * Nothing at runtime may replace this with \"whatever is newest\" — that is the\n * defect it exists to end. The platform's runtime-config endpoint will be\n * allowed to override it, because that answer is the one the platform has\n * gated (pontive-spec/21-element-versioning-and-compatibility.md §9).\n */\nexport const CORE_ELEMENTS_VERSION: string = __CORE_ELEMENTS_VERSION__;\n","// Which @pontive/pontkit-core release to load, asked of the platform.\n//\n// The platform decides which release a project's screens render with — one\n// deployment default, an optional per-project canary — and publishes the answer\n// at `GET /auth/v1/runtime-config` on the project's auth server\n// (pontive-spec/21-element-versioning-and-compatibility.md §9). This package\n// reads it once, before importing the bundle, so an embedded widget renders\n// with the same release the hosted login pages do. The build-time stamp\n// (CORE_ELEMENTS_VERSION) is the fallback when the answer cannot be read.\n//\n// The endpoint is reached through the app's own origin when the SDK's proxy is\n// mounted (`/__auth/auth/v1/...`), and directly on `/auth/v1/...` when the app\n// itself runs on the auth domain. Both are tried; a host page can name a URL\n// outright with `window.__pontRuntimeConfigUrl`.\n\n/** The shape of GET /auth/v1/runtime-config. */\nexport interface RuntimeConfig {\n  core_elements_version: string;\n  catalog_revision?: number;\n  source?: string;\n  assets?: { js: string; css: string };\n  /**\n   * Subresource-integrity hashes (\"sha384-…\") of the release's module and\n   * stylesheet, recorded by the platform when the release was gated. When\n   * present the loader passes them to the browser, which refuses bytes that\n   * differ — from the platform origin or from any public CDN alike.\n   */\n  integrity?: { js: string; css: string };\n}\n\nexport const RUNTIME_CONFIG_PATHS = [\n  \"/__auth/auth/v1/runtime-config\",\n  \"/auth/v1/runtime-config\",\n] as const;\n\n/** How long to wait for the platform before loading the stamped release. */\nexport const RUNTIME_CONFIG_TIMEOUT_MS = 1500;\n\nconst EXACT_VERSION = /^\\d+\\.\\d+\\.\\d+$/;\n\nexport interface FetchRuntimeConfigOptions {\n  fetchImpl?: typeof fetch;\n  urls?: readonly string[];\n  timeoutMs?: number;\n}\n\n/** Whether `value` names one release rather than a range or garbage. */\nexport function isExactVersion(value: unknown): value is string {\n  return typeof value === \"string\" && EXACT_VERSION.test(value);\n}\n\nfunction isHttpUrl(value: unknown): value is string {\n  return typeof value === \"string\" && /^https?:\\/\\//.test(value);\n}\n\n/** Whether `value` is a well-formed SRI value the browser will accept. */\nexport function isSriHash(value: unknown): value is string {\n  return typeof value === \"string\" && /^sha(256|384|512)-[A-Za-z0-9+/]+=*$/.test(value);\n}\n\n/**\n * Reads the platform's runtime config, or null when no candidate URL answers\n * with one that can be trusted. Never throws: the caller's fallback is the\n * stamped release, and a reachability problem should not become a page error.\n */\nexport async function fetchRuntimeConfig(\n  options: FetchRuntimeConfigOptions = {},\n): Promise<RuntimeConfig | null> {\n  const fetchImpl = options.fetchImpl ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") return null;\n\n  const urls = options.urls ?? candidateUrls();\n  const timeoutMs = options.timeoutMs ?? RUNTIME_CONFIG_TIMEOUT_MS;\n\n  for (const url of urls) {\n    const config = await readOne(fetchImpl, url, timeoutMs);\n    if (config) return config;\n  }\n\n  return null;\n}\n\nfunction candidateUrls(): readonly string[] {\n  if (typeof window !== \"undefined\" && typeof window.__pontRuntimeConfigUrl === \"string\") {\n    return [window.__pontRuntimeConfigUrl];\n  }\n\n  return RUNTIME_CONFIG_PATHS;\n}\n\nasync function readOne(\n  fetchImpl: typeof fetch,\n  url: string,\n  timeoutMs: number,\n): Promise<RuntimeConfig | null> {\n  const controller = typeof AbortController === \"function\" ? new AbortController() : null;\n  const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;\n\n  try {\n    const response = await fetchImpl(url, {\n      headers: { accept: \"application/json\" },\n      signal: controller?.signal,\n    });\n    if (!response.ok) return null;\n\n    const body = (await response.json()) as Partial<RuntimeConfig> | null;\n    if (!body || !isExactVersion(body.core_elements_version)) return null;\n\n    const config: RuntimeConfig = {\n      core_elements_version: body.core_elements_version,\n      source: typeof body.source === \"string\" ? body.source : undefined,\n      catalog_revision:\n        typeof body.catalog_revision === \"number\" ? body.catalog_revision : undefined,\n    };\n\n    // Assets are taken only as a pair of absolute URLs; anything else means\n    // \"load from the CDN list by version\".\n    if (body.assets && isHttpUrl(body.assets.js) && isHttpUrl(body.assets.css)) {\n      config.assets = { js: body.assets.js, css: body.assets.css };\n    }\n\n    // Half a pair is no pair: the browser would check one file and not the\n    // other, and nobody would notice the unchecked one.\n    if (body.integrity && isSriHash(body.integrity.js) && isSriHash(body.integrity.css)) {\n      config.integrity = { js: body.integrity.js, css: body.integrity.css };\n    }\n\n    return config;\n  } catch {\n    return null;\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n","import { CORE_ELEMENTS_VERSION } from \"./core-elements-version\";\nimport { fetchRuntimeConfig } from \"./runtime-config\";\n\nlet coreSdk: any = null;\n\n// The load in flight, if any. This is the guard, and it is a promise rather\n// than a boolean on purpose: a flag set before the first `await` let a second\n// concurrent caller return `coreSdk` while it was still null, log that the\n// SDK's modal functions were missing, and carry on as if it were ready. A\n// promise gives every caller the same eventual answer. It is cleared on failure\n// so a later call can retry rather than inherit a latched failure.\nlet loadPromise: Promise<any> | null = null;\n\nconst PACKAGE_NAME = \"@pontive/pontkit-core\";\n\n// Base CDN templates (version will be injected)\nconst CDN_TEMPLATES = [\n  (v: string) =>\n    `https://cdn.jsdelivr.net/npm/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n  (v: string) => `https://unpkg.com/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n  (v: string) => `https://esm.sh/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n];\n\nconst CSS_TEMPLATES = [\n  (v: string) =>\n    `https://cdn.jsdelivr.net/npm/${PACKAGE_NAME}@${v}/dist/styles.css`,\n  (v: string) => `https://unpkg.com/${PACKAGE_NAME}@${v}/dist/styles.css`,\n  (v: string) => `https://esm.sh/${PACKAGE_NAME}@${v}/dist/styles.css`,\n];\n\n// Which release loads is decided by the PLATFORM, and failing that at BUILD\n// time — never by asking a registry at runtime. This package used to fetch jsDelivr's version list and take the\n// newest entry of any major — the `1.x` filter had been commented out — with\n// `^1` as the fallback when the fetch failed, a different major from the 2.x\n// the wrappers target. Whatever npm happened to hold newest is not a version\n// anyone tested against, and a customer's page picked it up on the next reload\n// with nothing in their build having changed.\n//\n// Now the project's auth server says which release its screens load\n// (GET /auth/v1/runtime-config, see ./runtime-config.ts), so an embedded widget\n// renders with the same bundle the hosted login pages do, and a canary or a\n// promotion reaches it without a rebuild. CORE_ELEMENTS_VERSION — the exact\n// release this package was built and tested with — is the fallback when that\n// endpoint cannot be read.\nconst FALLBACK_VERSION = CORE_ELEMENTS_VERSION;\n\nfunction loadCss(url: string, integrity?: string) {\n  return new Promise<void>((resolve, reject) => {\n    const link = document.createElement(\"link\");\n    link.rel = \"stylesheet\";\n    link.href = url;\n    if (integrity) {\n      // SRI is only enforced on a CORS-mode fetch; the platform origin and the\n      // public CDNs all answer with Access-Control-Allow-Origin: *.\n      link.integrity = integrity;\n      link.crossOrigin = \"anonymous\";\n    }\n    link.onload = () => resolve();\n    link.onerror = (err) => reject(err);\n    document.head.appendChild(link);\n  });\n}\n\n// Loads the module through a <script type=\"module\"> carrying the integrity\n// attribute, then imports it. A dynamic import() cannot carry SRI, but the\n// script element can, and once it has fetched and verified the module the\n// browser's module map holds it under that URL — the import() that follows\n// resolves from the map without a second fetch. A hash mismatch fails the\n// script's load, the promise rejects, and the loader moves to the next\n// source, which is the right outcome: bytes the platform did not gate must not\n// run, wherever they came from.\nfunction loadVerifiedModule(url: string, integrity: string): Promise<any> {\n  return new Promise<void>((resolve, reject) => {\n    const script = document.createElement(\"script\");\n    script.type = \"module\";\n    script.src = url;\n    script.integrity = integrity;\n    script.crossOrigin = \"anonymous\";\n    script.onload = () => resolve();\n    script.onerror = () =>\n      reject(new Error(`core-elements module at ${url} failed to load or did not match its integrity hash`));\n    document.head.appendChild(script);\n  }).then(\n    () =>\n      import(\n        /* webpackIgnore: true */\n        /* turbopackIgnore: true */\n        /* @vite-ignore */\n        url\n      ),\n  );\n}\n\nexport async function loadWebComponents(): Promise<any> {\n  // No DOM means no custom elements to define and no CDN to fetch from.\n  //\n  // Returning rather than throwing matters because src/index.ts calls this at\n  // module scope: under a server renderer the rejection surfaced as a console\n  // error on every render, reporting a failure that is not one. Checked before\n  // the guards below so the browser still loads normally after hydration.\n  if (typeof window === \"undefined\" || typeof document === \"undefined\") {\n    return null;\n  }\n\n  // Another copy of this package on the same page already finished loading.\n  if (window.__pontLoaded) {\n    return window.__pontCoreSdk;\n  }\n\n  // Another copy of this package on the same page is loading right now.\n  if (window.__pontLoading) {\n    return window.__pontLoading;\n  }\n\n  if (!loadPromise) {\n    loadPromise = loadFromCdn().catch((err) => {\n      loadPromise = null;\n      window.__pontLoading = undefined;\n      throw err;\n    });\n\n    window.__pontLoading = loadPromise;\n  }\n\n  return loadPromise;\n}\n\nasync function loadFromCdn(): Promise<any> {\n  const runtime = await fetchRuntimeConfig();\n  const resolvedVersion = runtime?.core_elements_version ?? FALLBACK_VERSION;\n\n  const CDN_SOURCES = CDN_TEMPLATES.map((fn) => fn(resolvedVersion));\n  const CSS_SOURCES = CSS_TEMPLATES.map((fn) => fn(resolvedVersion));\n\n  // The platform's own asset location goes first when it names one; the public\n  // CDNs stay as the fallback list for the same version.\n  if (runtime?.assets) {\n    CDN_SOURCES.unshift(runtime.assets.js);\n    CSS_SOURCES.unshift(runtime.assets.css);\n  }\n\n  // The hashes describe the npm release's bytes, which every source below\n  // serves verbatim, so they apply to all of them — not only to the\n  // platform's. A source whose bytes differ is a source that must not run.\n  const integrity = runtime?.integrity;\n\n  let lastError: unknown = null;\n\n  for (let i = 0; i < CDN_SOURCES.length; i++) {\n    const cdn = CDN_SOURCES[i];\n    const cssCdn = CSS_SOURCES[i];\n\n    try {\n      // 2️⃣ Load CSS first\n      await loadCss(cssCdn, integrity?.css);\n\n      // 3️⃣ Load JS module\n      //\n      // All three ignore directives, and none of them is optional.\n      //\n      // `cdn` is a full URL resolved at runtime, so a bundler that tries to\n      // resolve it statically cannot: webpack and Turbopack turn a dynamic\n      // import with a variable specifier into a module-graph lookup and throw\n      // `Cannot find module 'https://…'` at runtime — no network request is ever\n      // made, and the message reads as though the CDN were at fault. Next.js\n      // uses Turbopack in development and webpack in production, so an app\n      // built with it failed on every CDN in the list identically.\n      //\n      // `@vite-ignore` alone covered only Vite. Each bundler reads its own\n      // comment and ignores the others, so all three coexist and each one keeps\n      // this a real runtime import.\n      const module: any = integrity\n        ? await loadVerifiedModule(cdn, integrity.js)\n        : await import(\n            /* webpackIgnore: true */\n            /* turbopackIgnore: true */\n            /* @vite-ignore */\n            cdn\n          );\n\n      // 4️⃣ Expose globally\n      // Wrap Auth so calls made before `configure()` won't throw. Instead\n      // we queue them and flush once configure() is called by the provider.\n      function createSafeAuth(auth: any) {\n        if (!auth) return auth;\n        type QItem = {\n          prop: string | symbol;\n          args: any[];\n          resolve: (v: any) => void;\n          reject: (e: any) => void;\n        };\n        const queue: QItem[] = [];\n        let configured = false;\n\n        // Expose a configured promise and flag on the proxy so other parts\n        // of the app can wait for Auth to be configured (helps avoid errors\n        // thrown by custom elements that start flows on connect).\n        let resolveWhenConfigured: (() => void) | null = null;\n        const whenConfigured = new Promise<void>((res) => {\n          resolveWhenConfigured = res;\n        });\n\n        const proxy = new Proxy(auth, {\n          get(target, prop, receiver) {\n            if (prop === \"configure\") {\n              return (...args: any[]) => {\n                const res = (target as any).configure?.(...args);\n                configured = true;\n                try {\n                  // flush queued calls\n                  queue.forEach(({ prop: p, args: a, resolve, reject }) => {\n                    try {\n                      const fn = (target as any)[p];\n                      const r = fn.apply(target, a);\n                      if (r && typeof r.then === \"function\") {\n                        r.then(resolve).catch(reject);\n                      } else {\n                        resolve(r);\n                      }\n                    } catch (err) {\n                      reject(err);\n                    }\n                  });\n                } catch (e) {\n                  // ignore flushing errors\n                }\n                queue.length = 0;\n                // mark proxy as configured and resolve the promise\n                try {\n                  (proxy as any).__configured = true;\n                } catch (e) {\n                  /* ignore */\n                }\n                resolveWhenConfigured?.();\n                return res;\n              };\n            }\n\n            const val = (target as any)[prop];\n            if (typeof val === \"function\") {\n              return (...args: any[]) => {\n                if (!configured) {\n                  // queue the call and return a Promise that resolves when flushed\n                  return new Promise((resolve, reject) => {\n                    queue.push({ prop, args, resolve, reject });\n                  });\n                }\n                try {\n                  return val.apply(target, args);\n                } catch (e) {\n                  // preserve throwing behavior for already-configured\n                  throw e;\n                }\n              };\n            }\n            return val;\n          },\n        });\n\n        // Attach the whenConfigured promise and configured flag to the proxy\n        try {\n          (proxy as any).__whenConfigured = whenConfigured;\n          (proxy as any).__configured = configured;\n        } catch (e) {\n          /* ignore */\n        }\n\n        // Also patch the original `auth` object (if present) so that direct\n        // imports and in-module usages get queued behavior too. This ensures\n        // that calls like `Auth.startLoginflow()` won't throw even if they\n        // happen before `configure()` is invoked.\n        try {\n          // Mark the original with the same hooks\n          (auth as any).__whenConfigured = whenConfigured;\n          (auth as any).__configured = configured;\n\n          const origConfigure = (auth as any).configure;\n          if (typeof origConfigure === \"function\") {\n            (auth as any).configure = (...args: any[]) => {\n              const res = origConfigure.apply(auth, args);\n              configured = true;\n              try {\n                queue.forEach(({ prop: p, args: a, resolve, reject }) => {\n                  try {\n                    const fn = (auth as any)[p];\n                    const r = fn.apply(auth, a);\n                    if (r && typeof r.then === \"function\") {\n                      r.then(resolve).catch(reject);\n                    } else {\n                      resolve(r);\n                    }\n                  } catch (err) {\n                    reject(err);\n                  }\n                });\n              } catch (e) {\n                /* ignore */\n              }\n              queue.length = 0;\n              try {\n                (auth as any).__configured = true;\n              } catch (e) {\n                /* ignore */\n              }\n              resolveWhenConfigured?.();\n              return res;\n            };\n          }\n\n          const origStart = (auth as any).startLoginflow;\n          if (typeof origStart === \"function\") {\n            (auth as any).startLoginflow = (...args: any[]) => {\n              if (!configured) {\n                return new Promise((resolve, reject) => {\n                  whenConfigured\n                    .then(() => {\n                      try {\n                        const r = origStart.apply(auth, args);\n                        if (r && typeof r.then === \"function\") {\n                          r.then(resolve).catch(reject);\n                        } else {\n                          resolve(r);\n                        }\n                      } catch (err) {\n                        reject(err);\n                      }\n                    })\n                    .catch(() => {\n                      try {\n                        const r = origStart.apply(auth, args);\n                        if (r && typeof r.then === \"function\") {\n                          r.then(resolve).catch(reject);\n                        } else {\n                          resolve(r);\n                        }\n                      } catch (err) {\n                        reject(err);\n                      }\n                    });\n                });\n              }\n\n              return origStart.apply(auth, args);\n            };\n          }\n        } catch (e) {\n          /* ignore */\n        }\n\n        // When auth is configured, call an explicit retry method on any\n        // sign-in/up elements that implement it. Prefer an explicit retry\n        // API so elements can be idempotent and avoid duplicate flows.\n        try {\n          whenConfigured.then(() => {\n            setTimeout(() => {\n              try {\n                document\n                  .querySelectorAll(\"pont-signin, pont-signup\")\n                  .forEach((el) => {\n                    try {\n                      if ((el as any).__pontInitRetried) return;\n                      (el as any).__pontInitRetried = true;\n                      // Prefer an explicit retry API implemented by the element\n                      // (e.g., `__pontRetryInit`) to avoid re-running the\n                      // entire `connectedCallback` which may cause duplicates.\n                      const retry = (el as any).__pontRetryInit;\n                      if (typeof retry === \"function\") {\n                        try {\n                          retry.call(el);\n                        } catch (e) {\n                          console.error(e);\n                        }\n                        return;\n                      }\n\n                      // Fallback: only call connectedCallback if the element\n                      // provides an explicit flag saying it previously failed\n                      // due to missing Auth (set by our connectedCallback wrapper\n                      // when we detect that specific error).\n                      if ((el as any).__pontFailedForConfig) {\n                        try {\n                          (el as any).connectedCallback?.();\n                        } catch (e) {\n                          console.error(e);\n                        }\n                      }\n                    } catch (_) {\n                      // ignore per-element errors\n                    }\n                  });\n              } catch (_) {\n                /* ignore */\n              }\n            }, 0);\n          });\n        } catch (e) {\n          /* ignore */\n        }\n\n        return proxy;\n      }\n\n      // Replace module exports so consumers that import `Auth` directly\n      // get the safe proxy as well. Also ensure `useAuthProvider()` returns\n      // the proxy.\n      const realAuth = module.useAuthProvider?.();\n      const safeAuth = createSafeAuth(realAuth);\n\n      try {\n        (module as any).Auth = safeAuth;\n        (module as any).useAuthProvider = () => safeAuth;\n      } catch (e) {\n        /* ignore */\n      }\n\n      window.__pontCoreSdk = {\n        ...module,\n        Auth: safeAuth,\n      };\n\n      coreSdk = window.__pontCoreSdk;\n\n      // Set only once the SDK is actually on the window, so a copy of this\n      // package that sees the flag can trust what it reads next to it.\n      window.__pontLoaded = true;\n      window.__pontLoading = undefined;\n\n      // Patch known elements that may start flows on connect so they wait\n      // for Auth to be configured instead of throwing. This avoids noisy\n      // runtime errors like \"Auth.configure() must be called\".\n      try {\n        const patchElement = (tagName: string) => {\n          const ctor = customElements.get(tagName);\n          if (!ctor) return;\n          const proto = ctor.prototype as any;\n          if (proto.__pontConfiguredPatched) return;\n          proto.__pontConfiguredPatched = true;\n\n          const orig = proto.connectedCallback;\n          if (typeof orig !== \"function\") return;\n\n          proto.connectedCallback = function (...args: any[]) {\n            const auth = window.__pontCoreSdk?.Auth as any;\n            const whenConfigured = auth?.__whenConfigured as\n              | Promise<void>\n              | undefined;\n            const configured = !!auth?.__configured;\n\n            if (whenConfigured && !configured) {\n              // delay initial connect work until Auth is configured\n              whenConfigured\n                .then(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (e) {\n                    console.error(e);\n                  }\n                })\n                .catch(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (e) {\n                    console.error(e);\n                  }\n                });\n              return;\n            }\n\n            try {\n              orig.apply(this, args);\n            } catch (e: any) {\n              // If it still throws with the configure error, retry after configured\n              if (\n                e &&\n                typeof e.message === \"string\" &&\n                e.message.includes(\"Auth.configure() must be called\") &&\n                whenConfigured\n              ) {\n                whenConfigured.then(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (err) {\n                    console.error(err);\n                  }\n                });\n                return;\n              }\n              throw e;\n            }\n          };\n        };\n\n        // Elements known to start auth flows on connect\n        [\"pont-signin\", \"pont-signup\"].forEach(patchElement);\n      } catch (e) {\n        /* ignore patch errors */\n      }\n\n      console.log(\n        `PontKit Web Components loaded (${resolvedVersion}) from:`,\n        cdn,\n      );\n\n      return coreSdk;\n    } catch (err) {\n      console.error(`Failed loading from ${cdn}`, err);\n      lastError = err;\n    }\n  }\n\n  console.error(\n    \"❌ Failed to load PontKit web components from all CDNs.\",\n    lastError,\n  );\n  throw lastError;\n}\n","import { loadWebComponents } from \"./load-web-components\";\n\nlet coreSdkLoadPromise: Promise<void> | null = null;\n\n/**\n * Ensures the core SDK is loaded and the global functions are available.\n * Returns a promise that resolves when the SDK is ready.\n */\nexport async function ensureCoreSdkLoaded(): Promise<void> {\n  // Nothing to ensure without a browser, and the check below would throw before\n  // reaching loadWebComponents' own guard.\n  if (typeof window === \"undefined\") {\n    return;\n  }\n\n  // If the functions already exist, we're done.\n  if (window.__pontCoreSdk?.openAccountSettingsModal) {\n    return;\n  }\n\n  // Otherwise, start loading the SDK if not already loading.\n  if (!coreSdkLoadPromise) {\n    coreSdkLoadPromise = loadWebComponents()\n      .then(() => {\n        // The first SDK script attaches the functions synchronously when it executes.\n        if (!window.__pontCoreSdk?.openAccountSettingsModal) {\n          console.warn(\n            \"[pontive-react] Core sdk loaded but modal functions are missing.\",\n          );\n        }\n      })\n      .catch((err) => {\n        console.error(\"[pontive-react] Failed to load core SDK:\", err);\n        throw err;\n      });\n  }\n\n  await coreSdkLoadPromise;\n}\n"],"names":["CORE_ELEMENTS_VERSION","RUNTIME_CONFIG_PATHS","RUNTIME_CONFIG_TIMEOUT_MS","EXACT_VERSION","isExactVersion","value","isHttpUrl","isSriHash","fetchRuntimeConfig","options","fetchImpl","urls","candidateUrls","timeoutMs","url","config","readOne","controller","timer","response","body","coreSdk","loadPromise","PACKAGE_NAME","CDN_TEMPLATES","v","CSS_TEMPLATES","FALLBACK_VERSION","loadCss","integrity","resolve","reject","link","err","loadVerifiedModule","script","loadWebComponents","loadFromCdn","runtime","resolvedVersion","CDN_SOURCES","fn","CSS_SOURCES","lastError","i","cdn","cssCdn","createSafeAuth","auth","queue","configured","resolveWhenConfigured","whenConfigured","res","proxy","target","prop","receiver","args","p","a","r","val","e","origConfigure","origStart","el","retry","module","realAuth","safeAuth","patchElement","tagName","ctor","proto","orig","coreSdkLoadPromise","ensureCoreSdkLoaded"],"mappings":"gFAcO,MAAMA,EAAgC,QCgBhCC,EAAuB,CAClC,iCACA,yBACF,EAGaC,EAA4B,KAEnCC,EAAgB,kBASf,SAASC,EAAeC,EAAiC,CAC9D,OAAO,OAAOA,GAAU,UAAYF,EAAc,KAAKE,CAAK,CAC9D,CAEA,SAASC,EAAUD,EAAiC,CAClD,OAAO,OAAOA,GAAU,UAAY,eAAe,KAAKA,CAAK,CAC/D,CAGO,SAASE,EAAUF,EAAiC,CACzD,OAAO,OAAOA,GAAU,UAAY,sCAAsC,KAAKA,CAAK,CACtF,CAOA,eAAsBG,EACpBC,EAAqC,GACN,CAC/B,MAAMC,EAAYD,EAAQ,WAAa,WAAW,MAClD,GAAI,OAAOC,GAAc,WAAY,OAAO,KAE5C,MAAMC,EAAOF,EAAQ,MAAQG,EAAA,EACvBC,EAAYJ,EAAQ,WAAaP,EAEvC,UAAWY,KAAOH,EAAM,CACtB,MAAMI,EAAS,MAAMC,EAAQN,EAAWI,EAAKD,CAAS,EACtD,GAAIE,EAAQ,OAAOA,CACrB,CAEA,OAAO,IACT,CAEA,SAASH,GAAmC,CAC1C,OAAI,OAAO,OAAW,KAAe,OAAO,OAAO,wBAA2B,SACrE,CAAC,OAAO,sBAAsB,EAGhCX,CACT,CAEA,eAAee,EACbN,EACAI,EACAD,EAC+B,CAC/B,MAAMI,EAAa,OAAO,iBAAoB,WAAa,IAAI,gBAAoB,KAC7EC,EAAQD,EAAa,WAAW,IAAMA,EAAW,MAAA,EAASJ,CAAS,EAAI,KAE7E,GAAI,CACF,MAAMM,EAAW,MAAMT,EAAUI,EAAK,CACpC,QAAS,CAAE,OAAQ,kBAAA,EACnB,OAAQG,GAAY,MAAA,CACrB,EACD,GAAI,CAACE,EAAS,GAAI,OAAO,KAEzB,MAAMC,EAAQ,MAAMD,EAAS,KAAA,EAC7B,GAAI,CAACC,GAAQ,CAAChB,EAAegB,EAAK,qBAAqB,EAAG,OAAO,KAEjE,MAAML,EAAwB,CAC5B,sBAAuBK,EAAK,sBAC5B,OAAQ,OAAOA,EAAK,QAAW,SAAWA,EAAK,OAAS,OACxD,iBACE,OAAOA,EAAK,kBAAqB,SAAWA,EAAK,iBAAmB,MAAA,EAKxE,OAAIA,EAAK,QAAUd,EAAUc,EAAK,OAAO,EAAE,GAAKd,EAAUc,EAAK,OAAO,GAAG,IACvEL,EAAO,OAAS,CAAE,GAAIK,EAAK,OAAO,GAAI,IAAKA,EAAK,OAAO,GAAA,GAKrDA,EAAK,WAAab,EAAUa,EAAK,UAAU,EAAE,GAAKb,EAAUa,EAAK,UAAU,GAAG,IAChFL,EAAO,UAAY,CAAE,GAAIK,EAAK,UAAU,GAAI,IAAKA,EAAK,UAAU,GAAA,GAG3DL,CACT,MAAQ,CACN,OAAO,IACT,QAAA,CACMG,gBAAoBA,CAAK,CAC/B,CACF,CClIA,IAAIG,EAAe,KAQfC,EAAmC,KAEvC,MAAMC,EAAe,wBAGfC,EAAgB,CACnBC,GACC,gCAAgCF,CAAY,IAAIE,CAAC,kBAClDA,GAAc,qBAAqBF,CAAY,IAAIE,CAAC,kBACpDA,GAAc,kBAAkBF,CAAY,IAAIE,CAAC,iBACpD,EAEMC,EAAgB,CACnBD,GACC,gCAAgCF,CAAY,IAAIE,CAAC,mBAClDA,GAAc,qBAAqBF,CAAY,IAAIE,CAAC,mBACpDA,GAAc,kBAAkBF,CAAY,IAAIE,CAAC,kBACpD,EAgBME,EAAmB3B,EAEzB,SAAS4B,EAAQd,EAAae,EAAoB,CAChD,OAAO,IAAI,QAAc,CAACC,EAASC,IAAW,CAC5C,MAAMC,EAAO,SAAS,cAAc,MAAM,EAC1CA,EAAK,IAAM,aACXA,EAAK,KAAOlB,EACRe,IAGFG,EAAK,UAAYH,EACjBG,EAAK,YAAc,aAErBA,EAAK,OAAS,IAAMF,EAAA,EACpBE,EAAK,QAAWC,GAAQF,EAAOE,CAAG,EAClC,SAAS,KAAK,YAAYD,CAAI,CAChC,CAAC,CACH,CAUA,SAASE,EAAmBpB,EAAae,EAAiC,CACxE,OAAO,IAAI,QAAc,CAACC,EAASC,IAAW,CAC5C,MAAMI,EAAS,SAAS,cAAc,QAAQ,EAC9CA,EAAO,KAAO,SACdA,EAAO,IAAMrB,EACbqB,EAAO,UAAYN,EACnBM,EAAO,YAAc,YACrBA,EAAO,OAAS,IAAML,EAAA,EACtBK,EAAO,QAAU,IACfJ,EAAO,IAAI,MAAM,2BAA2BjB,CAAG,qDAAqD,CAAC,EACvG,SAAS,KAAK,YAAYqB,CAAM,CAClC,CAAC,EAAE,KACD,IACE,OAIErB,EAAA,CAGR,CAEA,eAAsBsB,GAAkC,CAOtD,OAAI,OAAO,OAAW,KAAe,OAAO,SAAa,IAChD,KAIL,OAAO,aACF,OAAO,cAIZ,OAAO,cACF,OAAO,eAGXd,IACHA,EAAce,EAAA,EAAc,MAAOJ,GAAQ,CACzC,MAAAX,EAAc,KACd,OAAO,cAAgB,OACjBW,CACR,CAAC,EAED,OAAO,cAAgBX,GAGlBA,EACT,CAEA,eAAee,GAA4B,CACzC,MAAMC,EAAU,MAAM9B,EAAA,EAChB+B,EAAkBD,GAAS,uBAAyBX,EAEpDa,EAAchB,EAAc,IAAKiB,GAAOA,EAAGF,CAAe,CAAC,EAC3DG,EAAchB,EAAc,IAAKe,GAAOA,EAAGF,CAAe,CAAC,EAI7DD,GAAS,SACXE,EAAY,QAAQF,EAAQ,OAAO,EAAE,EACrCI,EAAY,QAAQJ,EAAQ,OAAO,GAAG,GAMxC,MAAMT,EAAYS,GAAS,UAE3B,IAAIK,EAAqB,KAEzB,QAASC,EAAI,EAAGA,EAAIJ,EAAY,OAAQI,IAAK,CAC3C,MAAMC,EAAML,EAAYI,CAAC,EACnBE,EAASJ,EAAYE,CAAC,EAE5B,GAAI,CA+BF,IAASG,EAAT,SAAwBC,EAAW,CACjC,GAAI,CAACA,EAAM,OAAOA,EAOlB,MAAMC,EAAiB,CAAA,EACvB,IAAIC,EAAa,GAKbC,EAA6C,KACjD,MAAMC,EAAiB,IAAI,QAAeC,GAAQ,CAChDF,EAAwBE,CAC1B,CAAC,EAEKC,EAAQ,IAAI,MAAMN,EAAM,CAC5B,IAAIO,EAAQC,EAAMC,EAAU,CAC1B,GAAID,IAAS,YACX,MAAO,IAAIE,IAAgB,CACzB,MAAML,EAAOE,EAAe,YAAY,GAAGG,CAAI,EAC/CR,EAAa,GACb,GAAI,CAEFD,EAAM,QAAQ,CAAC,CAAE,KAAMU,EAAG,KAAMC,EAAG,QAAA9B,EAAS,OAAAC,KAAa,CACvD,GAAI,CAEF,MAAM8B,EADMN,EAAeI,CAAC,EACf,MAAMJ,EAAQK,CAAC,EACxBC,GAAK,OAAOA,EAAE,MAAS,WACzBA,EAAE,KAAK/B,CAAO,EAAE,MAAMC,CAAM,EAE5BD,EAAQ+B,CAAC,CAEb,OAAS5B,EAAK,CACZF,EAAOE,CAAG,CACZ,CACF,CAAC,CACH,MAAY,CAEZ,CACAgB,EAAM,OAAS,EAEf,GAAI,CACDK,EAAc,aAAe,EAChC,MAAY,CAEZ,CACA,OAAAH,IAAA,EACOE,CACT,EAGF,MAAMS,EAAOP,EAAeC,CAAI,EAChC,OAAI,OAAOM,GAAQ,WACV,IAAIJ,IAAgB,CACzB,GAAI,CAACR,EAEH,OAAO,IAAI,QAAQ,CAACpB,EAASC,IAAW,CACtCkB,EAAM,KAAK,CAAE,KAAAO,EAAM,KAAAE,EAAM,QAAA5B,EAAS,OAAAC,EAAQ,CAC5C,CAAC,EAEH,GAAI,CACF,OAAO+B,EAAI,MAAMP,EAAQG,CAAI,CAC/B,OAASK,EAAG,CAEV,MAAMA,CACR,CACF,EAEKD,CACT,CAAA,CACD,EAGD,GAAI,CACDR,EAAc,iBAAmBF,EACjCE,EAAc,aAAeJ,CAChC,MAAY,CAEZ,CAMA,GAAI,CAEDF,EAAa,iBAAmBI,EAChCJ,EAAa,aAAeE,EAE7B,MAAMc,EAAiBhB,EAAa,UAChC,OAAOgB,GAAkB,aAC1BhB,EAAa,UAAY,IAAIU,IAAgB,CAC5C,MAAML,EAAMW,EAAc,MAAMhB,EAAMU,CAAI,EAC1CR,EAAa,GACb,GAAI,CACFD,EAAM,QAAQ,CAAC,CAAE,KAAMU,EAAG,KAAMC,EAAG,QAAA9B,EAAS,OAAAC,KAAa,CACvD,GAAI,CAEF,MAAM8B,EADMb,EAAaW,CAAC,EACb,MAAMX,EAAMY,CAAC,EACtBC,GAAK,OAAOA,EAAE,MAAS,WACzBA,EAAE,KAAK/B,CAAO,EAAE,MAAMC,CAAM,EAE5BD,EAAQ+B,CAAC,CAEb,OAAS5B,EAAK,CACZF,EAAOE,CAAG,CACZ,CACF,CAAC,CACH,MAAY,CAEZ,CACAgB,EAAM,OAAS,EACf,GAAI,CACDD,EAAa,aAAe,EAC/B,MAAY,CAEZ,CACA,OAAAG,IAAA,EACOE,CACT,GAGF,MAAMY,EAAajB,EAAa,eAC5B,OAAOiB,GAAc,aACtBjB,EAAa,eAAiB,IAAIU,IAC5BR,EA8BEe,EAAU,MAAMjB,EAAMU,CAAI,EA7BxB,IAAI,QAAQ,CAAC5B,EAASC,IAAW,CACtCqB,EACG,KAAK,IAAM,CACV,GAAI,CACF,MAAM,EAAIa,EAAU,MAAMjB,EAAMU,CAAI,EAChC,GAAK,OAAO,EAAE,MAAS,WACzB,EAAE,KAAK5B,CAAO,EAAE,MAAMC,CAAM,EAE5BD,EAAQ,CAAC,CAEb,OAASG,EAAK,CACZF,EAAOE,CAAG,CACZ,CACF,CAAC,EACA,MAAM,IAAM,CACX,GAAI,CACF,MAAM,EAAIgC,EAAU,MAAMjB,EAAMU,CAAI,EAChC,GAAK,OAAO,EAAE,MAAS,WACzB,EAAE,KAAK5B,CAAO,EAAE,MAAMC,CAAM,EAE5BD,EAAQ,CAAC,CAEb,OAASG,EAAK,CACZF,EAAOE,CAAG,CACZ,CACF,CAAC,CACL,CAAC,EAMT,MAAY,CAEZ,CAKA,GAAI,CACFmB,EAAe,KAAK,IAAM,CACxB,WAAW,IAAM,CACf,GAAI,CACF,SACG,iBAAiB,0BAA0B,EAC3C,QAASc,GAAO,CACf,GAAI,CACF,GAAKA,EAAW,kBAAmB,OAClCA,EAAW,kBAAoB,GAIhC,MAAMC,EAASD,EAAW,gBAC1B,GAAI,OAAOC,GAAU,WAAY,CAC/B,GAAI,CACFA,EAAM,KAAKD,CAAE,CACf,OAASH,EAAG,CACV,QAAQ,MAAMA,CAAC,CACjB,CACA,MACF,CAMA,GAAKG,EAAW,sBACd,GAAI,CACDA,EAAW,oBAAA,CACd,OAASH,EAAG,CACV,QAAQ,MAAMA,CAAC,CACjB,CAEJ,MAAY,CAEZ,CACF,CAAC,CACL,MAAY,CAEZ,CACF,EAAG,CAAC,CACN,CAAC,CACH,MAAY,CAEZ,CAEA,OAAOT,CACT,EAtPA,MAAM1B,EAAQkB,EAAQjB,GAAW,GAAG,EAiBpC,MAAMuC,EAAcvC,EAChB,MAAMK,EAAmBW,EAAKhB,EAAU,EAAE,EAC1C,MAAM,OAIJgB,GAoOAwB,EAAWD,EAAO,kBAAA,EAClBE,EAAWvB,EAAesB,CAAQ,EAExC,GAAI,CACDD,EAAe,KAAOE,EACtBF,EAAe,gBAAkB,IAAME,CAC1C,MAAY,CAEZ,CAEA,OAAO,cAAgB,CACrB,GAAGF,EACH,KAAME,CAAA,EAGRjD,EAAU,OAAO,cAIjB,OAAO,aAAe,GACtB,OAAO,cAAgB,OAKvB,GAAI,CACF,MAAMkD,EAAgBC,GAAoB,CACxC,MAAMC,EAAO,eAAe,IAAID,CAAO,EACvC,GAAI,CAACC,EAAM,OACX,MAAMC,EAAQD,EAAK,UACnB,GAAIC,EAAM,wBAAyB,OACnCA,EAAM,wBAA0B,GAEhC,MAAMC,EAAOD,EAAM,kBACf,OAAOC,GAAS,aAEpBD,EAAM,kBAAoB,YAAahB,EAAa,CAClD,MAAMV,EAAO,OAAO,eAAe,KAC7BI,EAAiBJ,GAAM,iBAGvBE,EAAa,CAAC,CAACF,GAAM,aAE3B,GAAII,GAAkB,CAACF,EAAY,CAEjCE,EACG,KAAK,IAAM,CACV,GAAI,CACFuB,EAAK,MAAM,KAAMjB,CAAI,CACvB,OAASK,EAAG,CACV,QAAQ,MAAMA,CAAC,CACjB,CACF,CAAC,EACA,MAAM,IAAM,CACX,GAAI,CACFY,EAAK,MAAM,KAAMjB,CAAI,CACvB,OAASK,EAAG,CACV,QAAQ,MAAMA,CAAC,CACjB,CACF,CAAC,EACH,MACF,CAEA,GAAI,CACFY,EAAK,MAAM,KAAMjB,CAAI,CACvB,OAASK,EAAQ,CAEf,GACEA,GACA,OAAOA,EAAE,SAAY,UACrBA,EAAE,QAAQ,SAAS,iCAAiC,GACpDX,EACA,CACAA,EAAe,KAAK,IAAM,CACxB,GAAI,CACFuB,EAAK,MAAM,KAAMjB,CAAI,CACvB,OAASzB,EAAK,CACZ,QAAQ,MAAMA,CAAG,CACnB,CACF,CAAC,EACD,MACF,CACA,MAAM8B,CACR,CACF,EACF,EAGA,CAAC,cAAe,aAAa,EAAE,QAAQQ,CAAY,CACrD,MAAY,CAEZ,CAEA,eAAQ,IACN,kCAAkChC,CAAe,UACjDM,CAAA,EAGKxB,CACT,OAASY,EAAK,CACZ,QAAQ,MAAM,uBAAuBY,CAAG,GAAIZ,CAAG,EAC/CU,EAAYV,CACd,CACF,CAEA,cAAQ,MACN,yDACAU,CAAA,EAEIA,CACR,CCjgBA,IAAIiC,EAA2C,KAM/C,eAAsBC,GAAqC,CAGrD,OAAO,OAAW,KAKlB,OAAO,eAAe,2BAKrBD,IACHA,EAAqBxC,IAClB,KAAK,IAAM,CAEL,OAAO,eAAe,0BACzB,QAAQ,KACN,kEAAA,CAGN,CAAC,EACA,MAAOH,GAAQ,CACd,cAAQ,MAAM,2CAA4CA,CAAG,EACvDA,CACR,CAAC,GAGL,MAAM2C,EACR"}

package/dist/index.js

@@ -1,30 +1,30 @@
-const F = __CORE_ELEMENTS_VERSION__, U = [
+const j = "1.1.1", F = [
   "/__auth/auth/v1/runtime-config",
   "/auth/v1/runtime-config"
-], x = 1500, V = /^\d+\.\d+\.\d+$/;
-function K(t) {
-  return typeof t == "string" && V.test(t);
+], J = 1500, x = /^\d+\.\d+\.\d+$/;
+function V(t) {
+  return typeof t == "string" && x.test(t);
 }
-function I(t) {
+function R(t) {
   return typeof t == "string" && /^https?:\/\//.test(t);
 }
-function M(t) {
+function b(t) {
   return typeof t == "string" && /^sha(256|384|512)-[A-Za-z0-9+/]+=*$/.test(t);
 }
-async function D(t = {}) {
+async function K(t = {}) {
   const a = t.fetchImpl ?? globalThis.fetch;
   if (typeof a != "function") return null;
-  const l = t.urls ?? G(), f = t.timeoutMs ?? x;
+  const l = t.urls ?? D(), f = t.timeoutMs ?? 1500;
   for (const e of l) {
-    const p = await H(a, e, f);
+    const p = await G(a, e, f);
     if (p) return p;
   }
   return null;
 }
-function G() {
-  return typeof window < "u" && typeof window.__pontRuntimeConfigUrl == "string" ? [window.__pontRuntimeConfigUrl] : U;
+function D() {
+  return typeof window < "u" && typeof window.__pontRuntimeConfigUrl == "string" ? [window.__pontRuntimeConfigUrl] : F;
 }
-async function H(t, a, l) {
+async function G(t, a, l) {
   const f = typeof AbortController == "function" ? new AbortController() : null, e = f ? setTimeout(() => f.abort(), l) : null;
   try {
     const p = await t(a, {
@@ -33,13 +33,13 @@ async function H(t, a, l) {
     });
     if (!p.ok) return null;
     const n = await p.json();
-    if (!n || !K(n.core_elements_version)) return null;
+    if (!n || !V(n.core_elements_version)) return null;
     const g = {
       core_elements_version: n.core_elements_version,
       source: typeof n.source == "string" ? n.source : void 0,
       catalog_revision: typeof n.catalog_revision == "number" ? n.catalog_revision : void 0
     };
-    return n.assets && I(n.assets.js) && I(n.assets.css) && (g.assets = { js: n.assets.js, css: n.assets.css }), n.integrity && M(n.integrity.js) && M(n.integrity.css) && (g.integrity = { js: n.integrity.js, css: n.integrity.css }), g;
+    return n.assets && R(n.assets.js) && R(n.assets.css) && (g.assets = { js: n.assets.js, css: n.assets.css }), n.integrity && b(n.integrity.js) && b(n.integrity.css) && (g.integrity = { js: n.integrity.js, css: n.integrity.css }), g;
   } catch {
     return null;
   } finally {
@@ -47,22 +47,22 @@ async function H(t, a, l) {
   }
 }
 let N = null, k = null;
-const S = "@pontive/pontkit-core", W = [
-  (t) => `https://cdn.jsdelivr.net/npm/${S}@${t}/dist/index.mjs`,
-  (t) => `https://unpkg.com/${S}@${t}/dist/index.mjs`,
-  (t) => `https://esm.sh/${S}@${t}/dist/index.mjs`
-], q = [
-  (t) => `https://cdn.jsdelivr.net/npm/${S}@${t}/dist/styles.css`,
-  (t) => `https://unpkg.com/${S}@${t}/dist/styles.css`,
-  (t) => `https://esm.sh/${S}@${t}/dist/styles.css`
-], z = F;
-function B(t, a) {
+const E = "@pontive/pontkit-core", H = [
+  (t) => `https://cdn.jsdelivr.net/npm/${E}@${t}/dist/index.mjs`,
+  (t) => `https://unpkg.com/${E}@${t}/dist/index.mjs`,
+  (t) => `https://esm.sh/${E}@${t}/dist/index.mjs`
+], W = [
+  (t) => `https://cdn.jsdelivr.net/npm/${E}@${t}/dist/styles.css`,
+  (t) => `https://unpkg.com/${E}@${t}/dist/styles.css`,
+  (t) => `https://esm.sh/${E}@${t}/dist/styles.css`
+], q = j;
+function z(t, a) {
   return new Promise((l, f) => {
     const e = document.createElement("link");
     e.rel = "stylesheet", e.href = t, a && (e.integrity = a, e.crossOrigin = "anonymous"), e.onload = () => l(), e.onerror = (p) => f(p), document.head.appendChild(e);
   });
 }
-function X(t, a) {
+function B(t, a) {
   return new Promise((l, f) => {
     const e = document.createElement("script");
     e.type = "module", e.src = t, e.integrity = a, e.crossOrigin = "anonymous", e.onload = () => l(), e.onerror = () => f(new Error(`core-elements module at ${t} failed to load or did not match its integrity hash`)), document.head.appendChild(e);
@@ -75,13 +75,13 @@ function X(t, a) {
     )
   );
 }
-async function Z() {
-  return typeof window > "u" || typeof document > "u" ? null : window.__pontLoaded ? window.__pontCoreSdk : window.__pontLoading ? window.__pontLoading : (k || (k = J().catch((t) => {
+async function X() {
+  return typeof window > "u" || typeof document > "u" ? null : window.__pontLoaded ? window.__pontCoreSdk : window.__pontLoading ? window.__pontLoading : (k || (k = Z().catch((t) => {
     throw k = null, window.__pontLoading = void 0, t;
   }), window.__pontLoading = k), k);
 }
-async function J() {
-  const t = await D(), a = t?.core_elements_version ?? z, l = W.map((n) => n(a)), f = q.map((n) => n(a));
+async function Z() {
+  const t = await K(), a = t?.core_elements_version ?? q, l = H.map((n) => n(a)), f = W.map((n) => n(a));
   t?.assets && (l.unshift(t.assets.js), f.unshift(t.assets.css));
   const e = t?.integrity;
   let p = null;
@@ -101,12 +101,12 @@ async function J() {
                 const r = o.configure?.(...u);
                 _ = !0;
                 try {
-                  C.forEach(({ prop: w, args: $, resolve: A, reject: E }) => {
+                  C.forEach(({ prop: w, args: $, resolve: A, reject: S }) => {
                     try {
                       const v = o[w].apply(o, $);
-                      v && typeof v.then == "function" ? v.then(A).catch(E) : A(v);
-                    } catch (b) {
-                      E(b);
+                      v && typeof v.then == "function" ? v.then(A).catch(S) : A(v);
+                    } catch (M) {
+                      S(M);
                     }
                   });
                 } catch {
@@ -145,8 +145,8 @@ async function J() {
             try {
               C.forEach(({ prop: u, args: r, resolve: w, reject: $ }) => {
                 try {
-                  const E = i[u].apply(i, r);
-                  E && typeof E.then == "function" ? E.then(w).catch($) : w(E);
+                  const S = i[u].apply(i, r);
+                  S && typeof S.then == "function" ? S.then(w).catch($) : w(S);
                 } catch (A) {
                   $(A);
                 }
@@ -214,20 +214,20 @@ async function J() {
         }
         return y;
       };
-      await B(O, e?.css);
-      const L = e ? await X(g, e.js) : await import(
+      await z(O, e?.css);
+      const T = e ? await B(g, e.js) : await import(
         /* webpackIgnore: true */
         /* turbopackIgnore: true */
         /* @vite-ignore */
         g
-      ), j = L.useAuthProvider?.(), R = P(j);
+      ), U = T.useAuthProvider?.(), I = P(U);
       try {
-        L.Auth = R, L.useAuthProvider = () => R;
+        T.Auth = I, T.useAuthProvider = () => I;
       } catch {
       }
       window.__pontCoreSdk = {
-        ...L,
-        Auth: R
+        ...T,
+        Auth: I
       }, N = window.__pontCoreSdk, window.__pontLoaded = !0, window.__pontLoading = void 0;
       try {
         const i = (C) => {
@@ -288,24 +288,24 @@ async function J() {
     p
   ), p;
 }
-let T = null;
+let L = null;
 async function Q() {
-  typeof window > "u" || window.__pontCoreSdk?.openAccountSettingsModal || (T || (T = Z().then(() => {
+  typeof window > "u" || window.__pontCoreSdk?.openAccountSettingsModal || (L || (L = X().then(() => {
     window.__pontCoreSdk?.openAccountSettingsModal || console.warn(
       "[pontive-react] Core sdk loaded but modal functions are missing."
     );
   }).catch((t) => {
     throw console.error("[pontive-react] Failed to load core SDK:", t), t;
-  })), await T);
+  })), await L);
 }
 export {
-  F as CORE_ELEMENTS_VERSION,
-  U as RUNTIME_CONFIG_PATHS,
-  x as RUNTIME_CONFIG_TIMEOUT_MS,
+  j as CORE_ELEMENTS_VERSION,
+  F as RUNTIME_CONFIG_PATHS,
+  J as RUNTIME_CONFIG_TIMEOUT_MS,
   Q as ensureCoreSdkLoaded,
-  D as fetchRuntimeConfig,
-  K as isExactVersion,
-  M as isSriHash,
-  Z as loadWebComponents
+  K as fetchRuntimeConfig,
+  V as isExactVersion,
+  b as isSriHash,
+  X as loadWebComponents
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../src/core-elements-version.ts","../src/runtime-config.ts","../src/load-web-components.ts","../src/sdk-loaded.ts"],"sourcesContent":["/**\n * The exact `@pontive/pontkit-core` release this build loads from the CDN.\n *\n * It is the version installed as a dev dependency when the package was built —\n * i.e. the one the test suite ran against — baked in by `define` in\n * vite.config.ts and vitest.config.ts (see scripts/core-elements-version.mjs).\n * An exact version, never a range: an exact release is immutable on the CDN,\n * cacheable forever, and the only form that admits an integrity hash.\n *\n * Nothing at runtime may replace this with \"whatever is newest\" — that is the\n * defect it exists to end. The platform's runtime-config endpoint will be\n * allowed to override it, because that answer is the one the platform has\n * gated (pontive-spec/21-element-versioning-and-compatibility.md §9).\n */\nexport const CORE_ELEMENTS_VERSION: string = __CORE_ELEMENTS_VERSION__;\n","// Which @pontive/pontkit-core release to load, asked of the platform.\n//\n// The platform decides which release a project's screens render with — one\n// deployment default, an optional per-project canary — and publishes the answer\n// at `GET /auth/v1/runtime-config` on the project's auth server\n// (pontive-spec/21-element-versioning-and-compatibility.md §9). This package\n// reads it once, before importing the bundle, so an embedded widget renders\n// with the same release the hosted login pages do. The build-time stamp\n// (CORE_ELEMENTS_VERSION) is the fallback when the answer cannot be read.\n//\n// The endpoint is reached through the app's own origin when the SDK's proxy is\n// mounted (`/__auth/auth/v1/...`), and directly on `/auth/v1/...` when the app\n// itself runs on the auth domain. Both are tried; a host page can name a URL\n// outright with `window.__pontRuntimeConfigUrl`.\n\n/** The shape of GET /auth/v1/runtime-config. */\nexport interface RuntimeConfig {\n  core_elements_version: string;\n  catalog_revision?: number;\n  source?: string;\n  assets?: { js: string; css: string };\n  /**\n   * Subresource-integrity hashes (\"sha384-…\") of the release's module and\n   * stylesheet, recorded by the platform when the release was gated. When\n   * present the loader passes them to the browser, which refuses bytes that\n   * differ — from the platform origin or from any public CDN alike.\n   */\n  integrity?: { js: string; css: string };\n}\n\nexport const RUNTIME_CONFIG_PATHS = [\n  \"/__auth/auth/v1/runtime-config\",\n  \"/auth/v1/runtime-config\",\n] as const;\n\n/** How long to wait for the platform before loading the stamped release. */\nexport const RUNTIME_CONFIG_TIMEOUT_MS = 1500;\n\nconst EXACT_VERSION = /^\\d+\\.\\d+\\.\\d+$/;\n\nexport interface FetchRuntimeConfigOptions {\n  fetchImpl?: typeof fetch;\n  urls?: readonly string[];\n  timeoutMs?: number;\n}\n\n/** Whether `value` names one release rather than a range or garbage. */\nexport function isExactVersion(value: unknown): value is string {\n  return typeof value === \"string\" && EXACT_VERSION.test(value);\n}\n\nfunction isHttpUrl(value: unknown): value is string {\n  return typeof value === \"string\" && /^https?:\\/\\//.test(value);\n}\n\n/** Whether `value` is a well-formed SRI value the browser will accept. */\nexport function isSriHash(value: unknown): value is string {\n  return typeof value === \"string\" && /^sha(256|384|512)-[A-Za-z0-9+/]+=*$/.test(value);\n}\n\n/**\n * Reads the platform's runtime config, or null when no candidate URL answers\n * with one that can be trusted. Never throws: the caller's fallback is the\n * stamped release, and a reachability problem should not become a page error.\n */\nexport async function fetchRuntimeConfig(\n  options: FetchRuntimeConfigOptions = {},\n): Promise<RuntimeConfig | null> {\n  const fetchImpl = options.fetchImpl ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") return null;\n\n  const urls = options.urls ?? candidateUrls();\n  const timeoutMs = options.timeoutMs ?? RUNTIME_CONFIG_TIMEOUT_MS;\n\n  for (const url of urls) {\n    const config = await readOne(fetchImpl, url, timeoutMs);\n    if (config) return config;\n  }\n\n  return null;\n}\n\nfunction candidateUrls(): readonly string[] {\n  if (typeof window !== \"undefined\" && typeof window.__pontRuntimeConfigUrl === \"string\") {\n    return [window.__pontRuntimeConfigUrl];\n  }\n\n  return RUNTIME_CONFIG_PATHS;\n}\n\nasync function readOne(\n  fetchImpl: typeof fetch,\n  url: string,\n  timeoutMs: number,\n): Promise<RuntimeConfig | null> {\n  const controller = typeof AbortController === \"function\" ? new AbortController() : null;\n  const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;\n\n  try {\n    const response = await fetchImpl(url, {\n      headers: { accept: \"application/json\" },\n      signal: controller?.signal,\n    });\n    if (!response.ok) return null;\n\n    const body = (await response.json()) as Partial<RuntimeConfig> | null;\n    if (!body || !isExactVersion(body.core_elements_version)) return null;\n\n    const config: RuntimeConfig = {\n      core_elements_version: body.core_elements_version,\n      source: typeof body.source === \"string\" ? body.source : undefined,\n      catalog_revision:\n        typeof body.catalog_revision === \"number\" ? body.catalog_revision : undefined,\n    };\n\n    // Assets are taken only as a pair of absolute URLs; anything else means\n    // \"load from the CDN list by version\".\n    if (body.assets && isHttpUrl(body.assets.js) && isHttpUrl(body.assets.css)) {\n      config.assets = { js: body.assets.js, css: body.assets.css };\n    }\n\n    // Half a pair is no pair: the browser would check one file and not the\n    // other, and nobody would notice the unchecked one.\n    if (body.integrity && isSriHash(body.integrity.js) && isSriHash(body.integrity.css)) {\n      config.integrity = { js: body.integrity.js, css: body.integrity.css };\n    }\n\n    return config;\n  } catch {\n    return null;\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n","import { CORE_ELEMENTS_VERSION } from \"./core-elements-version\";\nimport { fetchRuntimeConfig } from \"./runtime-config\";\n\nlet coreSdk: any = null;\n\n// The load in flight, if any. This is the guard, and it is a promise rather\n// than a boolean on purpose: a flag set before the first `await` let a second\n// concurrent caller return `coreSdk` while it was still null, log that the\n// SDK's modal functions were missing, and carry on as if it were ready. A\n// promise gives every caller the same eventual answer. It is cleared on failure\n// so a later call can retry rather than inherit a latched failure.\nlet loadPromise: Promise<any> | null = null;\n\nconst PACKAGE_NAME = \"@pontive/pontkit-core\";\n\n// Base CDN templates (version will be injected)\nconst CDN_TEMPLATES = [\n  (v: string) =>\n    `https://cdn.jsdelivr.net/npm/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n  (v: string) => `https://unpkg.com/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n  (v: string) => `https://esm.sh/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n];\n\nconst CSS_TEMPLATES = [\n  (v: string) =>\n    `https://cdn.jsdelivr.net/npm/${PACKAGE_NAME}@${v}/dist/styles.css`,\n  (v: string) => `https://unpkg.com/${PACKAGE_NAME}@${v}/dist/styles.css`,\n  (v: string) => `https://esm.sh/${PACKAGE_NAME}@${v}/dist/styles.css`,\n];\n\n// Which release loads is decided by the PLATFORM, and failing that at BUILD\n// time — never by asking a registry at runtime. This package used to fetch jsDelivr's version list and take the\n// newest entry of any major — the `1.x` filter had been commented out — with\n// `^1` as the fallback when the fetch failed, a different major from the 2.x\n// the wrappers target. Whatever npm happened to hold newest is not a version\n// anyone tested against, and a customer's page picked it up on the next reload\n// with nothing in their build having changed.\n//\n// Now the project's auth server says which release its screens load\n// (GET /auth/v1/runtime-config, see ./runtime-config.ts), so an embedded widget\n// renders with the same bundle the hosted login pages do, and a canary or a\n// promotion reaches it without a rebuild. CORE_ELEMENTS_VERSION — the exact\n// release this package was built and tested with — is the fallback when that\n// endpoint cannot be read.\nconst FALLBACK_VERSION = CORE_ELEMENTS_VERSION;\n\nfunction loadCss(url: string, integrity?: string) {\n  return new Promise<void>((resolve, reject) => {\n    const link = document.createElement(\"link\");\n    link.rel = \"stylesheet\";\n    link.href = url;\n    if (integrity) {\n      // SRI is only enforced on a CORS-mode fetch; the platform origin and the\n      // public CDNs all answer with Access-Control-Allow-Origin: *.\n      link.integrity = integrity;\n      link.crossOrigin = \"anonymous\";\n    }\n    link.onload = () => resolve();\n    link.onerror = (err) => reject(err);\n    document.head.appendChild(link);\n  });\n}\n\n// Loads the module through a <script type=\"module\"> carrying the integrity\n// attribute, then imports it. A dynamic import() cannot carry SRI, but the\n// script element can, and once it has fetched and verified the module the\n// browser's module map holds it under that URL — the import() that follows\n// resolves from the map without a second fetch. A hash mismatch fails the\n// script's load, the promise rejects, and the loader moves to the next\n// source, which is the right outcome: bytes the platform did not gate must not\n// run, wherever they came from.\nfunction loadVerifiedModule(url: string, integrity: string): Promise<any> {\n  return new Promise<void>((resolve, reject) => {\n    const script = document.createElement(\"script\");\n    script.type = \"module\";\n    script.src = url;\n    script.integrity = integrity;\n    script.crossOrigin = \"anonymous\";\n    script.onload = () => resolve();\n    script.onerror = () =>\n      reject(new Error(`core-elements module at ${url} failed to load or did not match its integrity hash`));\n    document.head.appendChild(script);\n  }).then(\n    () =>\n      import(\n        /* webpackIgnore: true */\n        /* turbopackIgnore: true */\n        /* @vite-ignore */\n        url\n      ),\n  );\n}\n\nexport async function loadWebComponents(): Promise<any> {\n  // No DOM means no custom elements to define and no CDN to fetch from.\n  //\n  // Returning rather than throwing matters because src/index.ts calls this at\n  // module scope: under a server renderer the rejection surfaced as a console\n  // error on every render, reporting a failure that is not one. Checked before\n  // the guards below so the browser still loads normally after hydration.\n  if (typeof window === \"undefined\" || typeof document === \"undefined\") {\n    return null;\n  }\n\n  // Another copy of this package on the same page already finished loading.\n  if (window.__pontLoaded) {\n    return window.__pontCoreSdk;\n  }\n\n  // Another copy of this package on the same page is loading right now.\n  if (window.__pontLoading) {\n    return window.__pontLoading;\n  }\n\n  if (!loadPromise) {\n    loadPromise = loadFromCdn().catch((err) => {\n      loadPromise = null;\n      window.__pontLoading = undefined;\n      throw err;\n    });\n\n    window.__pontLoading = loadPromise;\n  }\n\n  return loadPromise;\n}\n\nasync function loadFromCdn(): Promise<any> {\n  const runtime = await fetchRuntimeConfig();\n  const resolvedVersion = runtime?.core_elements_version ?? FALLBACK_VERSION;\n\n  const CDN_SOURCES = CDN_TEMPLATES.map((fn) => fn(resolvedVersion));\n  const CSS_SOURCES = CSS_TEMPLATES.map((fn) => fn(resolvedVersion));\n\n  // The platform's own asset location goes first when it names one; the public\n  // CDNs stay as the fallback list for the same version.\n  if (runtime?.assets) {\n    CDN_SOURCES.unshift(runtime.assets.js);\n    CSS_SOURCES.unshift(runtime.assets.css);\n  }\n\n  // The hashes describe the npm release's bytes, which every source below\n  // serves verbatim, so they apply to all of them — not only to the\n  // platform's. A source whose bytes differ is a source that must not run.\n  const integrity = runtime?.integrity;\n\n  let lastError: unknown = null;\n\n  for (let i = 0; i < CDN_SOURCES.length; i++) {\n    const cdn = CDN_SOURCES[i];\n    const cssCdn = CSS_SOURCES[i];\n\n    try {\n      // 2️⃣ Load CSS first\n      await loadCss(cssCdn, integrity?.css);\n\n      // 3️⃣ Load JS module\n      //\n      // All three ignore directives, and none of them is optional.\n      //\n      // `cdn` is a full URL resolved at runtime, so a bundler that tries to\n      // resolve it statically cannot: webpack and Turbopack turn a dynamic\n      // import with a variable specifier into a module-graph lookup and throw\n      // `Cannot find module 'https://…'` at runtime — no network request is ever\n      // made, and the message reads as though the CDN were at fault. Next.js\n      // uses Turbopack in development and webpack in production, so an app\n      // built with it failed on every CDN in the list identically.\n      //\n      // `@vite-ignore` alone covered only Vite. Each bundler reads its own\n      // comment and ignores the others, so all three coexist and each one keeps\n      // this a real runtime import.\n      const module: any = integrity\n        ? await loadVerifiedModule(cdn, integrity.js)\n        : await import(\n            /* webpackIgnore: true */\n            /* turbopackIgnore: true */\n            /* @vite-ignore */\n            cdn\n          );\n\n      // 4️⃣ Expose globally\n      // Wrap Auth so calls made before `configure()` won't throw. Instead\n      // we queue them and flush once configure() is called by the provider.\n      function createSafeAuth(auth: any) {\n        if (!auth) return auth;\n        type QItem = {\n          prop: string | symbol;\n          args: any[];\n          resolve: (v: any) => void;\n          reject: (e: any) => void;\n        };\n        const queue: QItem[] = [];\n        let configured = false;\n\n        // Expose a configured promise and flag on the proxy so other parts\n        // of the app can wait for Auth to be configured (helps avoid errors\n        // thrown by custom elements that start flows on connect).\n        let resolveWhenConfigured: (() => void) | null = null;\n        const whenConfigured = new Promise<void>((res) => {\n          resolveWhenConfigured = res;\n        });\n\n        const proxy = new Proxy(auth, {\n          get(target, prop, receiver) {\n            if (prop === \"configure\") {\n              return (...args: any[]) => {\n                const res = (target as any).configure?.(...args);\n                configured = true;\n                try {\n                  // flush queued calls\n                  queue.forEach(({ prop: p, args: a, resolve, reject }) => {\n                    try {\n                      const fn = (target as any)[p];\n                      const r = fn.apply(target, a);\n                      if (r && typeof r.then === \"function\") {\n                        r.then(resolve).catch(reject);\n                      } else {\n                        resolve(r);\n                      }\n                    } catch (err) {\n                      reject(err);\n                    }\n                  });\n                } catch (e) {\n                  // ignore flushing errors\n                }\n                queue.length = 0;\n                // mark proxy as configured and resolve the promise\n                try {\n                  (proxy as any).__configured = true;\n                } catch (e) {\n                  /* ignore */\n                }\n                resolveWhenConfigured?.();\n                return res;\n              };\n            }\n\n            const val = (target as any)[prop];\n            if (typeof val === \"function\") {\n              return (...args: any[]) => {\n                if (!configured) {\n                  // queue the call and return a Promise that resolves when flushed\n                  return new Promise((resolve, reject) => {\n                    queue.push({ prop, args, resolve, reject });\n                  });\n                }\n                try {\n                  return val.apply(target, args);\n                } catch (e) {\n                  // preserve throwing behavior for already-configured\n                  throw e;\n                }\n              };\n            }\n            return val;\n          },\n        });\n\n        // Attach the whenConfigured promise and configured flag to the proxy\n        try {\n          (proxy as any).__whenConfigured = whenConfigured;\n          (proxy as any).__configured = configured;\n        } catch (e) {\n          /* ignore */\n        }\n\n        // Also patch the original `auth` object (if present) so that direct\n        // imports and in-module usages get queued behavior too. This ensures\n        // that calls like `Auth.startLoginflow()` won't throw even if they\n        // happen before `configure()` is invoked.\n        try {\n          // Mark the original with the same hooks\n          (auth as any).__whenConfigured = whenConfigured;\n          (auth as any).__configured = configured;\n\n          const origConfigure = (auth as any).configure;\n          if (typeof origConfigure === \"function\") {\n            (auth as any).configure = (...args: any[]) => {\n              const res = origConfigure.apply(auth, args);\n              configured = true;\n              try {\n                queue.forEach(({ prop: p, args: a, resolve, reject }) => {\n                  try {\n                    const fn = (auth as any)[p];\n                    const r = fn.apply(auth, a);\n                    if (r && typeof r.then === \"function\") {\n                      r.then(resolve).catch(reject);\n                    } else {\n                      resolve(r);\n                    }\n                  } catch (err) {\n                    reject(err);\n                  }\n                });\n              } catch (e) {\n                /* ignore */\n              }\n              queue.length = 0;\n              try {\n                (auth as any).__configured = true;\n              } catch (e) {\n                /* ignore */\n              }\n              resolveWhenConfigured?.();\n              return res;\n            };\n          }\n\n          const origStart = (auth as any).startLoginflow;\n          if (typeof origStart === \"function\") {\n            (auth as any).startLoginflow = (...args: any[]) => {\n              if (!configured) {\n                return new Promise((resolve, reject) => {\n                  whenConfigured\n                    .then(() => {\n                      try {\n                        const r = origStart.apply(auth, args);\n                        if (r && typeof r.then === \"function\") {\n                          r.then(resolve).catch(reject);\n                        } else {\n                          resolve(r);\n                        }\n                      } catch (err) {\n                        reject(err);\n                      }\n                    })\n                    .catch(() => {\n                      try {\n                        const r = origStart.apply(auth, args);\n                        if (r && typeof r.then === \"function\") {\n                          r.then(resolve).catch(reject);\n                        } else {\n                          resolve(r);\n                        }\n                      } catch (err) {\n                        reject(err);\n                      }\n                    });\n                });\n              }\n\n              return origStart.apply(auth, args);\n            };\n          }\n        } catch (e) {\n          /* ignore */\n        }\n\n        // When auth is configured, call an explicit retry method on any\n        // sign-in/up elements that implement it. Prefer an explicit retry\n        // API so elements can be idempotent and avoid duplicate flows.\n        try {\n          whenConfigured.then(() => {\n            setTimeout(() => {\n              try {\n                document\n                  .querySelectorAll(\"pont-signin, pont-signup\")\n                  .forEach((el) => {\n                    try {\n                      if ((el as any).__pontInitRetried) return;\n                      (el as any).__pontInitRetried = true;\n                      // Prefer an explicit retry API implemented by the element\n                      // (e.g., `__pontRetryInit`) to avoid re-running the\n                      // entire `connectedCallback` which may cause duplicates.\n                      const retry = (el as any).__pontRetryInit;\n                      if (typeof retry === \"function\") {\n                        try {\n                          retry.call(el);\n                        } catch (e) {\n                          console.error(e);\n                        }\n                        return;\n                      }\n\n                      // Fallback: only call connectedCallback if the element\n                      // provides an explicit flag saying it previously failed\n                      // due to missing Auth (set by our connectedCallback wrapper\n                      // when we detect that specific error).\n                      if ((el as any).__pontFailedForConfig) {\n                        try {\n                          (el as any).connectedCallback?.();\n                        } catch (e) {\n                          console.error(e);\n                        }\n                      }\n                    } catch (_) {\n                      // ignore per-element errors\n                    }\n                  });\n              } catch (_) {\n                /* ignore */\n              }\n            }, 0);\n          });\n        } catch (e) {\n          /* ignore */\n        }\n\n        return proxy;\n      }\n\n      // Replace module exports so consumers that import `Auth` directly\n      // get the safe proxy as well. Also ensure `useAuthProvider()` returns\n      // the proxy.\n      const realAuth = module.useAuthProvider?.();\n      const safeAuth = createSafeAuth(realAuth);\n\n      try {\n        (module as any).Auth = safeAuth;\n        (module as any).useAuthProvider = () => safeAuth;\n      } catch (e) {\n        /* ignore */\n      }\n\n      window.__pontCoreSdk = {\n        ...module,\n        Auth: safeAuth,\n      };\n\n      coreSdk = window.__pontCoreSdk;\n\n      // Set only once the SDK is actually on the window, so a copy of this\n      // package that sees the flag can trust what it reads next to it.\n      window.__pontLoaded = true;\n      window.__pontLoading = undefined;\n\n      // Patch known elements that may start flows on connect so they wait\n      // for Auth to be configured instead of throwing. This avoids noisy\n      // runtime errors like \"Auth.configure() must be called\".\n      try {\n        const patchElement = (tagName: string) => {\n          const ctor = customElements.get(tagName);\n          if (!ctor) return;\n          const proto = ctor.prototype as any;\n          if (proto.__pontConfiguredPatched) return;\n          proto.__pontConfiguredPatched = true;\n\n          const orig = proto.connectedCallback;\n          if (typeof orig !== \"function\") return;\n\n          proto.connectedCallback = function (...args: any[]) {\n            const auth = window.__pontCoreSdk?.Auth as any;\n            const whenConfigured = auth?.__whenConfigured as\n              | Promise<void>\n              | undefined;\n            const configured = !!auth?.__configured;\n\n            if (whenConfigured && !configured) {\n              // delay initial connect work until Auth is configured\n              whenConfigured\n                .then(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (e) {\n                    console.error(e);\n                  }\n                })\n                .catch(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (e) {\n                    console.error(e);\n                  }\n                });\n              return;\n            }\n\n            try {\n              orig.apply(this, args);\n            } catch (e: any) {\n              // If it still throws with the configure error, retry after configured\n              if (\n                e &&\n                typeof e.message === \"string\" &&\n                e.message.includes(\"Auth.configure() must be called\") &&\n                whenConfigured\n              ) {\n                whenConfigured.then(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (err) {\n                    console.error(err);\n                  }\n                });\n                return;\n              }\n              throw e;\n            }\n          };\n        };\n\n        // Elements known to start auth flows on connect\n        [\"pont-signin\", \"pont-signup\"].forEach(patchElement);\n      } catch (e) {\n        /* ignore patch errors */\n      }\n\n      console.log(\n        `PontKit Web Components loaded (${resolvedVersion}) from:`,\n        cdn,\n      );\n\n      return coreSdk;\n    } catch (err) {\n      console.error(`Failed loading from ${cdn}`, err);\n      lastError = err;\n    }\n  }\n\n  console.error(\n    \"❌ Failed to load PontKit web components from all CDNs.\",\n    lastError,\n  );\n  throw lastError;\n}\n","import { loadWebComponents } from \"./load-web-components\";\n\nlet coreSdkLoadPromise: Promise<void> | null = null;\n\n/**\n * Ensures the core SDK is loaded and the global functions are available.\n * Returns a promise that resolves when the SDK is ready.\n */\nexport async function ensureCoreSdkLoaded(): Promise<void> {\n  // Nothing to ensure without a browser, and the check below would throw before\n  // reaching loadWebComponents' own guard.\n  if (typeof window === \"undefined\") {\n    return;\n  }\n\n  // If the functions already exist, we're done.\n  if (window.__pontCoreSdk?.openAccountSettingsModal) {\n    return;\n  }\n\n  // Otherwise, start loading the SDK if not already loading.\n  if (!coreSdkLoadPromise) {\n    coreSdkLoadPromise = loadWebComponents()\n      .then(() => {\n        // The first SDK script attaches the functions synchronously when it executes.\n        if (!window.__pontCoreSdk?.openAccountSettingsModal) {\n          console.warn(\n            \"[pontive-react] Core sdk loaded but modal functions are missing.\",\n          );\n        }\n      })\n      .catch((err) => {\n        console.error(\"[pontive-react] Failed to load core SDK:\", err);\n        throw err;\n      });\n  }\n\n  await coreSdkLoadPromise;\n}\n"],"names":["CORE_ELEMENTS_VERSION","RUNTIME_CONFIG_PATHS","RUNTIME_CONFIG_TIMEOUT_MS","EXACT_VERSION","isExactVersion","value","isHttpUrl","isSriHash","fetchRuntimeConfig","options","fetchImpl","urls","candidateUrls","timeoutMs","url","config","readOne","controller","timer","response","body","coreSdk","loadPromise","PACKAGE_NAME","CDN_TEMPLATES","v","CSS_TEMPLATES","FALLBACK_VERSION","loadCss","integrity","resolve","reject","link","err","loadVerifiedModule","script","loadWebComponents","loadFromCdn","runtime","resolvedVersion","CDN_SOURCES","fn","CSS_SOURCES","lastError","i","cdn","cssCdn","createSafeAuth","auth","queue","configured","resolveWhenConfigured","whenConfigured","res","proxy","target","prop","receiver","args","p","a","r","val","e","origConfigure","origStart","el","retry","module","realAuth","safeAuth","patchElement","tagName","ctor","proto","orig","coreSdkLoadPromise","ensureCoreSdkLoaded"],"mappings":"AAcO,MAAMA,IAAgC,2BCgBhCC,IAAuB;AAAA,EAClC;AAAA,EACA;AACF,GAGaC,IAA4B,MAEnCC,IAAgB;AASf,SAASC,EAAeC,GAAiC;AAC9D,SAAO,OAAOA,KAAU,YAAYF,EAAc,KAAKE,CAAK;AAC9D;AAEA,SAASC,EAAUD,GAAiC;AAClD,SAAO,OAAOA,KAAU,YAAY,eAAe,KAAKA,CAAK;AAC/D;AAGO,SAASE,EAAUF,GAAiC;AACzD,SAAO,OAAOA,KAAU,YAAY,sCAAsC,KAAKA,CAAK;AACtF;AAOA,eAAsBG,EACpBC,IAAqC,IACN;AAC/B,QAAMC,IAAYD,EAAQ,aAAa,WAAW;AAClD,MAAI,OAAOC,KAAc,WAAY,QAAO;AAE5C,QAAMC,IAAOF,EAAQ,QAAQG,EAAA,GACvBC,IAAYJ,EAAQ,aAAaP;AAEvC,aAAWY,KAAOH,GAAM;AACtB,UAAMI,IAAS,MAAMC,EAAQN,GAAWI,GAAKD,CAAS;AACtD,QAAIE,EAAQ,QAAOA;AAAA,EACrB;AAEA,SAAO;AACT;AAEA,SAASH,IAAmC;AAC1C,SAAI,OAAO,SAAW,OAAe,OAAO,OAAO,0BAA2B,WACrE,CAAC,OAAO,sBAAsB,IAGhCX;AACT;AAEA,eAAee,EACbN,GACAI,GACAD,GAC+B;AAC/B,QAAMI,IAAa,OAAO,mBAAoB,aAAa,IAAI,oBAAoB,MAC7EC,IAAQD,IAAa,WAAW,MAAMA,EAAW,MAAA,GAASJ,CAAS,IAAI;AAE7E,MAAI;AACF,UAAMM,IAAW,MAAMT,EAAUI,GAAK;AAAA,MACpC,SAAS,EAAE,QAAQ,mBAAA;AAAA,MACnB,QAAQG,GAAY;AAAA,IAAA,CACrB;AACD,QAAI,CAACE,EAAS,GAAI,QAAO;AAEzB,UAAMC,IAAQ,MAAMD,EAAS,KAAA;AAC7B,QAAI,CAACC,KAAQ,CAAChB,EAAegB,EAAK,qBAAqB,EAAG,QAAO;AAEjE,UAAML,IAAwB;AAAA,MAC5B,uBAAuBK,EAAK;AAAA,MAC5B,QAAQ,OAAOA,EAAK,UAAW,WAAWA,EAAK,SAAS;AAAA,MACxD,kBACE,OAAOA,EAAK,oBAAqB,WAAWA,EAAK,mBAAmB;AAAA,IAAA;AAKxE,WAAIA,EAAK,UAAUd,EAAUc,EAAK,OAAO,EAAE,KAAKd,EAAUc,EAAK,OAAO,GAAG,MACvEL,EAAO,SAAS,EAAE,IAAIK,EAAK,OAAO,IAAI,KAAKA,EAAK,OAAO,IAAA,IAKrDA,EAAK,aAAab,EAAUa,EAAK,UAAU,EAAE,KAAKb,EAAUa,EAAK,UAAU,GAAG,MAChFL,EAAO,YAAY,EAAE,IAAIK,EAAK,UAAU,IAAI,KAAKA,EAAK,UAAU,IAAA,IAG3DL;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT,UAAA;AACE,IAAIG,kBAAoBA,CAAK;AAAA,EAC/B;AACF;AClIA,IAAIG,IAAe,MAQfC,IAAmC;AAEvC,MAAMC,IAAe,yBAGfC,IAAgB;AAAA,EACpB,CAACC,MACC,gCAAgCF,CAAY,IAAIE,CAAC;AAAA,EACnD,CAACA,MAAc,qBAAqBF,CAAY,IAAIE,CAAC;AAAA,EACrD,CAACA,MAAc,kBAAkBF,CAAY,IAAIE,CAAC;AACpD,GAEMC,IAAgB;AAAA,EACpB,CAACD,MACC,gCAAgCF,CAAY,IAAIE,CAAC;AAAA,EACnD,CAACA,MAAc,qBAAqBF,CAAY,IAAIE,CAAC;AAAA,EACrD,CAACA,MAAc,kBAAkBF,CAAY,IAAIE,CAAC;AACpD,GAgBME,IAAmB3B;AAEzB,SAAS4B,EAAQd,GAAae,GAAoB;AAChD,SAAO,IAAI,QAAc,CAACC,GAASC,MAAW;AAC5C,UAAMC,IAAO,SAAS,cAAc,MAAM;AAC1C,IAAAA,EAAK,MAAM,cACXA,EAAK,OAAOlB,GACRe,MAGFG,EAAK,YAAYH,GACjBG,EAAK,cAAc,cAErBA,EAAK,SAAS,MAAMF,EAAA,GACpBE,EAAK,UAAU,CAACC,MAAQF,EAAOE,CAAG,GAClC,SAAS,KAAK,YAAYD,CAAI;AAAA,EAChC,CAAC;AACH;AAUA,SAASE,EAAmBpB,GAAae,GAAiC;AACxE,SAAO,IAAI,QAAc,CAACC,GAASC,MAAW;AAC5C,UAAMI,IAAS,SAAS,cAAc,QAAQ;AAC9C,IAAAA,EAAO,OAAO,UACdA,EAAO,MAAMrB,GACbqB,EAAO,YAAYN,GACnBM,EAAO,cAAc,aACrBA,EAAO,SAAS,MAAML,EAAA,GACtBK,EAAO,UAAU,MACfJ,EAAO,IAAI,MAAM,2BAA2BjB,CAAG,qDAAqD,CAAC,GACvG,SAAS,KAAK,YAAYqB,CAAM;AAAA,EAClC,CAAC,EAAE;AAAA,IACD,MACE;AAAA;AAAA;AAAA;AAAA,MAIErB;AAAA;AAAA,EAAA;AAGR;AAEA,eAAsBsB,IAAkC;AAOtD,SAAI,OAAO,SAAW,OAAe,OAAO,WAAa,MAChD,OAIL,OAAO,eACF,OAAO,gBAIZ,OAAO,gBACF,OAAO,iBAGXd,MACHA,IAAce,EAAA,EAAc,MAAM,CAACJ,MAAQ;AACzC,UAAAX,IAAc,MACd,OAAO,gBAAgB,QACjBW;AAAA,EACR,CAAC,GAED,OAAO,gBAAgBX,IAGlBA;AACT;AAEA,eAAee,IAA4B;AACzC,QAAMC,IAAU,MAAM9B,EAAA,GAChB+B,IAAkBD,GAAS,yBAAyBX,GAEpDa,IAAchB,EAAc,IAAI,CAACiB,MAAOA,EAAGF,CAAe,CAAC,GAC3DG,IAAchB,EAAc,IAAI,CAACe,MAAOA,EAAGF,CAAe,CAAC;AAIjE,EAAID,GAAS,WACXE,EAAY,QAAQF,EAAQ,OAAO,EAAE,GACrCI,EAAY,QAAQJ,EAAQ,OAAO,GAAG;AAMxC,QAAMT,IAAYS,GAAS;AAE3B,MAAIK,IAAqB;AAEzB,WAASC,IAAI,GAAGA,IAAIJ,EAAY,QAAQI,KAAK;AAC3C,UAAMC,IAAML,EAAYI,CAAC,GACnBE,IAASJ,EAAYE,CAAC;AAE5B,QAAI;AA+BF,UAASG,IAAT,SAAwBC,GAAW;AACjC,YAAI,CAACA,EAAM,QAAOA;AAOlB,cAAMC,IAAiB,CAAA;AACvB,YAAIC,IAAa,IAKbC,IAA6C;AACjD,cAAMC,IAAiB,IAAI,QAAc,CAACC,MAAQ;AAChD,UAAAF,IAAwBE;AAAA,QAC1B,CAAC,GAEKC,IAAQ,IAAI,MAAMN,GAAM;AAAA,UAC5B,IAAIO,GAAQC,GAAMC,GAAU;AAC1B,gBAAID,MAAS;AACX,qBAAO,IAAIE,MAAgB;AACzB,sBAAML,IAAOE,EAAe,YAAY,GAAGG,CAAI;AAC/C,gBAAAR,IAAa;AACb,oBAAI;AAEF,kBAAAD,EAAM,QAAQ,CAAC,EAAE,MAAMU,GAAG,MAAMC,GAAG,SAAA9B,GAAS,QAAAC,QAAa;AACvD,wBAAI;AAEF,4BAAM8B,IADMN,EAAeI,CAAC,EACf,MAAMJ,GAAQK,CAAC;AAC5B,sBAAIC,KAAK,OAAOA,EAAE,QAAS,aACzBA,EAAE,KAAK/B,CAAO,EAAE,MAAMC,CAAM,IAE5BD,EAAQ+B,CAAC;AAAA,oBAEb,SAAS5B,GAAK;AACZ,sBAAAF,EAAOE,CAAG;AAAA,oBACZ;AAAA,kBACF,CAAC;AAAA,gBACH,QAAY;AAAA,gBAEZ;AACA,gBAAAgB,EAAM,SAAS;AAEf,oBAAI;AACD,kBAAAK,EAAc,eAAe;AAAA,gBAChC,QAAY;AAAA,gBAEZ;AACA,uBAAAH,IAAA,GACOE;AAAA,cACT;AAGF,kBAAMS,IAAOP,EAAeC,CAAI;AAChC,mBAAI,OAAOM,KAAQ,aACV,IAAIJ,MAAgB;AACzB,kBAAI,CAACR;AAEH,uBAAO,IAAI,QAAQ,CAACpB,GAASC,MAAW;AACtC,kBAAAkB,EAAM,KAAK,EAAE,MAAAO,GAAM,MAAAE,GAAM,SAAA5B,GAAS,QAAAC,GAAQ;AAAA,gBAC5C,CAAC;AAEH,kBAAI;AACF,uBAAO+B,EAAI,MAAMP,GAAQG,CAAI;AAAA,cAC/B,SAASK,GAAG;AAEV,sBAAMA;AAAA,cACR;AAAA,YACF,IAEKD;AAAA,UACT;AAAA,QAAA,CACD;AAGD,YAAI;AACD,UAAAR,EAAc,mBAAmBF,GACjCE,EAAc,eAAeJ;AAAA,QAChC,QAAY;AAAA,QAEZ;AAMA,YAAI;AAED,UAAAF,EAAa,mBAAmBI,GAChCJ,EAAa,eAAeE;AAE7B,gBAAMc,IAAiBhB,EAAa;AACpC,UAAI,OAAOgB,KAAkB,eAC1BhB,EAAa,YAAY,IAAIU,MAAgB;AAC5C,kBAAML,IAAMW,EAAc,MAAMhB,GAAMU,CAAI;AAC1C,YAAAR,IAAa;AACb,gBAAI;AACF,cAAAD,EAAM,QAAQ,CAAC,EAAE,MAAMU,GAAG,MAAMC,GAAG,SAAA9B,GAAS,QAAAC,QAAa;AACvD,oBAAI;AAEF,wBAAM8B,IADMb,EAAaW,CAAC,EACb,MAAMX,GAAMY,CAAC;AAC1B,kBAAIC,KAAK,OAAOA,EAAE,QAAS,aACzBA,EAAE,KAAK/B,CAAO,EAAE,MAAMC,CAAM,IAE5BD,EAAQ+B,CAAC;AAAA,gBAEb,SAAS5B,GAAK;AACZ,kBAAAF,EAAOE,CAAG;AAAA,gBACZ;AAAA,cACF,CAAC;AAAA,YACH,QAAY;AAAA,YAEZ;AACA,YAAAgB,EAAM,SAAS;AACf,gBAAI;AACD,cAAAD,EAAa,eAAe;AAAA,YAC/B,QAAY;AAAA,YAEZ;AACA,mBAAAG,IAAA,GACOE;AAAA,UACT;AAGF,gBAAMY,IAAajB,EAAa;AAChC,UAAI,OAAOiB,KAAc,eACtBjB,EAAa,iBAAiB,IAAIU,MAC5BR,IA8BEe,EAAU,MAAMjB,GAAMU,CAAI,IA7BxB,IAAI,QAAQ,CAAC5B,GAASC,MAAW;AACtC,YAAAqB,EACG,KAAK,MAAM;AACV,kBAAI;AACF,sBAAM,IAAIa,EAAU,MAAMjB,GAAMU,CAAI;AACpC,gBAAI,KAAK,OAAO,EAAE,QAAS,aACzB,EAAE,KAAK5B,CAAO,EAAE,MAAMC,CAAM,IAE5BD,EAAQ,CAAC;AAAA,cAEb,SAASG,GAAK;AACZ,gBAAAF,EAAOE,CAAG;AAAA,cACZ;AAAA,YACF,CAAC,EACA,MAAM,MAAM;AACX,kBAAI;AACF,sBAAM,IAAIgC,EAAU,MAAMjB,GAAMU,CAAI;AACpC,gBAAI,KAAK,OAAO,EAAE,QAAS,aACzB,EAAE,KAAK5B,CAAO,EAAE,MAAMC,CAAM,IAE5BD,EAAQ,CAAC;AAAA,cAEb,SAASG,GAAK;AACZ,gBAAAF,EAAOE,CAAG;AAAA,cACZ;AAAA,YACF,CAAC;AAAA,UACL,CAAC;AAAA,QAMT,QAAY;AAAA,QAEZ;AAKA,YAAI;AACF,UAAAmB,EAAe,KAAK,MAAM;AACxB,uBAAW,MAAM;AACf,kBAAI;AACF,yBACG,iBAAiB,0BAA0B,EAC3C,QAAQ,CAACc,MAAO;AACf,sBAAI;AACF,wBAAKA,EAAW,kBAAmB;AAClC,oBAAAA,EAAW,oBAAoB;AAIhC,0BAAMC,IAASD,EAAW;AAC1B,wBAAI,OAAOC,KAAU,YAAY;AAC/B,0BAAI;AACF,wBAAAA,EAAM,KAAKD,CAAE;AAAA,sBACf,SAASH,GAAG;AACV,gCAAQ,MAAMA,CAAC;AAAA,sBACjB;AACA;AAAA,oBACF;AAMA,wBAAKG,EAAW;AACd,0BAAI;AACD,wBAAAA,EAAW,oBAAA;AAAA,sBACd,SAASH,GAAG;AACV,gCAAQ,MAAMA,CAAC;AAAA,sBACjB;AAAA,kBAEJ,QAAY;AAAA,kBAEZ;AAAA,gBACF,CAAC;AAAA,cACL,QAAY;AAAA,cAEZ;AAAA,YACF,GAAG,CAAC;AAAA,UACN,CAAC;AAAA,QACH,QAAY;AAAA,QAEZ;AAEA,eAAOT;AAAA,MACT;AAtPA,YAAM1B,EAAQkB,GAAQjB,GAAW,GAAG;AAiBpC,YAAMuC,IAAcvC,IAChB,MAAMK,EAAmBW,GAAKhB,EAAU,EAAE,IAC1C,MAAM;AAAA;AAAA;AAAA;AAAA,QAIJgB;AAAA,SAoOAwB,IAAWD,EAAO,kBAAA,GAClBE,IAAWvB,EAAesB,CAAQ;AAExC,UAAI;AACD,QAAAD,EAAe,OAAOE,GACtBF,EAAe,kBAAkB,MAAME;AAAA,MAC1C,QAAY;AAAA,MAEZ;AAEA,aAAO,gBAAgB;AAAA,QACrB,GAAGF;AAAA,QACH,MAAME;AAAA,MAAA,GAGRjD,IAAU,OAAO,eAIjB,OAAO,eAAe,IACtB,OAAO,gBAAgB;AAKvB,UAAI;AACF,cAAMkD,IAAe,CAACC,MAAoB;AACxC,gBAAMC,IAAO,eAAe,IAAID,CAAO;AACvC,cAAI,CAACC,EAAM;AACX,gBAAMC,IAAQD,EAAK;AACnB,cAAIC,EAAM,wBAAyB;AACnC,UAAAA,EAAM,0BAA0B;AAEhC,gBAAMC,IAAOD,EAAM;AACnB,UAAI,OAAOC,KAAS,eAEpBD,EAAM,oBAAoB,YAAahB,GAAa;AAClD,kBAAMV,IAAO,OAAO,eAAe,MAC7BI,IAAiBJ,GAAM,kBAGvBE,IAAa,CAAC,CAACF,GAAM;AAE3B,gBAAII,KAAkB,CAACF,GAAY;AAEjC,cAAAE,EACG,KAAK,MAAM;AACV,oBAAI;AACF,kBAAAuB,EAAK,MAAM,MAAMjB,CAAI;AAAA,gBACvB,SAASK,GAAG;AACV,0BAAQ,MAAMA,CAAC;AAAA,gBACjB;AAAA,cACF,CAAC,EACA,MAAM,MAAM;AACX,oBAAI;AACF,kBAAAY,EAAK,MAAM,MAAMjB,CAAI;AAAA,gBACvB,SAASK,GAAG;AACV,0BAAQ,MAAMA,CAAC;AAAA,gBACjB;AAAA,cACF,CAAC;AACH;AAAA,YACF;AAEA,gBAAI;AACF,cAAAY,EAAK,MAAM,MAAMjB,CAAI;AAAA,YACvB,SAASK,GAAQ;AAEf,kBACEA,KACA,OAAOA,EAAE,WAAY,YACrBA,EAAE,QAAQ,SAAS,iCAAiC,KACpDX,GACA;AACA,gBAAAA,EAAe,KAAK,MAAM;AACxB,sBAAI;AACF,oBAAAuB,EAAK,MAAM,MAAMjB,CAAI;AAAA,kBACvB,SAASzB,GAAK;AACZ,4BAAQ,MAAMA,CAAG;AAAA,kBACnB;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AACA,oBAAM8B;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAGA,SAAC,eAAe,aAAa,EAAE,QAAQQ,CAAY;AAAA,MACrD,QAAY;AAAA,MAEZ;AAEA,qBAAQ;AAAA,QACN,kCAAkChC,CAAe;AAAA,QACjDM;AAAA,MAAA,GAGKxB;AAAA,IACT,SAASY,GAAK;AACZ,cAAQ,MAAM,uBAAuBY,CAAG,IAAIZ,CAAG,GAC/CU,IAAYV;AAAA,IACd;AAAA,EACF;AAEA,gBAAQ;AAAA,IACN;AAAA,IACAU;AAAA,EAAA,GAEIA;AACR;ACjgBA,IAAIiC,IAA2C;AAM/C,eAAsBC,IAAqC;AAGzD,EAAI,OAAO,SAAW,OAKlB,OAAO,eAAe,6BAKrBD,MACHA,IAAqBxC,IAClB,KAAK,MAAM;AAEV,IAAK,OAAO,eAAe,4BACzB,QAAQ;AAAA,MACN;AAAA,IAAA;AAAA,EAGN,CAAC,EACA,MAAM,CAACH,MAAQ;AACd,kBAAQ,MAAM,4CAA4CA,CAAG,GACvDA;AAAA,EACR,CAAC,IAGL,MAAM2C;AACR;"}
+{"version":3,"file":"index.js","sources":["../src/core-elements-version.ts","../src/runtime-config.ts","../src/load-web-components.ts","../src/sdk-loaded.ts"],"sourcesContent":["/**\n * The exact `@pontive/pontkit-core` release this build loads from the CDN.\n *\n * It is the version installed as a dev dependency when the package was built —\n * i.e. the one the test suite ran against — baked in by `define` in\n * vite.config.ts and vitest.config.ts (see scripts/core-elements-version.mjs).\n * An exact version, never a range: an exact release is immutable on the CDN,\n * cacheable forever, and the only form that admits an integrity hash.\n *\n * Nothing at runtime may replace this with \"whatever is newest\" — that is the\n * defect it exists to end. The platform's runtime-config endpoint will be\n * allowed to override it, because that answer is the one the platform has\n * gated (pontive-spec/21-element-versioning-and-compatibility.md §9).\n */\nexport const CORE_ELEMENTS_VERSION: string = __CORE_ELEMENTS_VERSION__;\n","// Which @pontive/pontkit-core release to load, asked of the platform.\n//\n// The platform decides which release a project's screens render with — one\n// deployment default, an optional per-project canary — and publishes the answer\n// at `GET /auth/v1/runtime-config` on the project's auth server\n// (pontive-spec/21-element-versioning-and-compatibility.md §9). This package\n// reads it once, before importing the bundle, so an embedded widget renders\n// with the same release the hosted login pages do. The build-time stamp\n// (CORE_ELEMENTS_VERSION) is the fallback when the answer cannot be read.\n//\n// The endpoint is reached through the app's own origin when the SDK's proxy is\n// mounted (`/__auth/auth/v1/...`), and directly on `/auth/v1/...` when the app\n// itself runs on the auth domain. Both are tried; a host page can name a URL\n// outright with `window.__pontRuntimeConfigUrl`.\n\n/** The shape of GET /auth/v1/runtime-config. */\nexport interface RuntimeConfig {\n  core_elements_version: string;\n  catalog_revision?: number;\n  source?: string;\n  assets?: { js: string; css: string };\n  /**\n   * Subresource-integrity hashes (\"sha384-…\") of the release's module and\n   * stylesheet, recorded by the platform when the release was gated. When\n   * present the loader passes them to the browser, which refuses bytes that\n   * differ — from the platform origin or from any public CDN alike.\n   */\n  integrity?: { js: string; css: string };\n}\n\nexport const RUNTIME_CONFIG_PATHS = [\n  \"/__auth/auth/v1/runtime-config\",\n  \"/auth/v1/runtime-config\",\n] as const;\n\n/** How long to wait for the platform before loading the stamped release. */\nexport const RUNTIME_CONFIG_TIMEOUT_MS = 1500;\n\nconst EXACT_VERSION = /^\\d+\\.\\d+\\.\\d+$/;\n\nexport interface FetchRuntimeConfigOptions {\n  fetchImpl?: typeof fetch;\n  urls?: readonly string[];\n  timeoutMs?: number;\n}\n\n/** Whether `value` names one release rather than a range or garbage. */\nexport function isExactVersion(value: unknown): value is string {\n  return typeof value === \"string\" && EXACT_VERSION.test(value);\n}\n\nfunction isHttpUrl(value: unknown): value is string {\n  return typeof value === \"string\" && /^https?:\\/\\//.test(value);\n}\n\n/** Whether `value` is a well-formed SRI value the browser will accept. */\nexport function isSriHash(value: unknown): value is string {\n  return typeof value === \"string\" && /^sha(256|384|512)-[A-Za-z0-9+/]+=*$/.test(value);\n}\n\n/**\n * Reads the platform's runtime config, or null when no candidate URL answers\n * with one that can be trusted. Never throws: the caller's fallback is the\n * stamped release, and a reachability problem should not become a page error.\n */\nexport async function fetchRuntimeConfig(\n  options: FetchRuntimeConfigOptions = {},\n): Promise<RuntimeConfig | null> {\n  const fetchImpl = options.fetchImpl ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") return null;\n\n  const urls = options.urls ?? candidateUrls();\n  const timeoutMs = options.timeoutMs ?? RUNTIME_CONFIG_TIMEOUT_MS;\n\n  for (const url of urls) {\n    const config = await readOne(fetchImpl, url, timeoutMs);\n    if (config) return config;\n  }\n\n  return null;\n}\n\nfunction candidateUrls(): readonly string[] {\n  if (typeof window !== \"undefined\" && typeof window.__pontRuntimeConfigUrl === \"string\") {\n    return [window.__pontRuntimeConfigUrl];\n  }\n\n  return RUNTIME_CONFIG_PATHS;\n}\n\nasync function readOne(\n  fetchImpl: typeof fetch,\n  url: string,\n  timeoutMs: number,\n): Promise<RuntimeConfig | null> {\n  const controller = typeof AbortController === \"function\" ? new AbortController() : null;\n  const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;\n\n  try {\n    const response = await fetchImpl(url, {\n      headers: { accept: \"application/json\" },\n      signal: controller?.signal,\n    });\n    if (!response.ok) return null;\n\n    const body = (await response.json()) as Partial<RuntimeConfig> | null;\n    if (!body || !isExactVersion(body.core_elements_version)) return null;\n\n    const config: RuntimeConfig = {\n      core_elements_version: body.core_elements_version,\n      source: typeof body.source === \"string\" ? body.source : undefined,\n      catalog_revision:\n        typeof body.catalog_revision === \"number\" ? body.catalog_revision : undefined,\n    };\n\n    // Assets are taken only as a pair of absolute URLs; anything else means\n    // \"load from the CDN list by version\".\n    if (body.assets && isHttpUrl(body.assets.js) && isHttpUrl(body.assets.css)) {\n      config.assets = { js: body.assets.js, css: body.assets.css };\n    }\n\n    // Half a pair is no pair: the browser would check one file and not the\n    // other, and nobody would notice the unchecked one.\n    if (body.integrity && isSriHash(body.integrity.js) && isSriHash(body.integrity.css)) {\n      config.integrity = { js: body.integrity.js, css: body.integrity.css };\n    }\n\n    return config;\n  } catch {\n    return null;\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n","import { CORE_ELEMENTS_VERSION } from \"./core-elements-version\";\nimport { fetchRuntimeConfig } from \"./runtime-config\";\n\nlet coreSdk: any = null;\n\n// The load in flight, if any. This is the guard, and it is a promise rather\n// than a boolean on purpose: a flag set before the first `await` let a second\n// concurrent caller return `coreSdk` while it was still null, log that the\n// SDK's modal functions were missing, and carry on as if it were ready. A\n// promise gives every caller the same eventual answer. It is cleared on failure\n// so a later call can retry rather than inherit a latched failure.\nlet loadPromise: Promise<any> | null = null;\n\nconst PACKAGE_NAME = \"@pontive/pontkit-core\";\n\n// Base CDN templates (version will be injected)\nconst CDN_TEMPLATES = [\n  (v: string) =>\n    `https://cdn.jsdelivr.net/npm/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n  (v: string) => `https://unpkg.com/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n  (v: string) => `https://esm.sh/${PACKAGE_NAME}@${v}/dist/index.mjs`,\n];\n\nconst CSS_TEMPLATES = [\n  (v: string) =>\n    `https://cdn.jsdelivr.net/npm/${PACKAGE_NAME}@${v}/dist/styles.css`,\n  (v: string) => `https://unpkg.com/${PACKAGE_NAME}@${v}/dist/styles.css`,\n  (v: string) => `https://esm.sh/${PACKAGE_NAME}@${v}/dist/styles.css`,\n];\n\n// Which release loads is decided by the PLATFORM, and failing that at BUILD\n// time — never by asking a registry at runtime. This package used to fetch jsDelivr's version list and take the\n// newest entry of any major — the `1.x` filter had been commented out — with\n// `^1` as the fallback when the fetch failed, a different major from the 2.x\n// the wrappers target. Whatever npm happened to hold newest is not a version\n// anyone tested against, and a customer's page picked it up on the next reload\n// with nothing in their build having changed.\n//\n// Now the project's auth server says which release its screens load\n// (GET /auth/v1/runtime-config, see ./runtime-config.ts), so an embedded widget\n// renders with the same bundle the hosted login pages do, and a canary or a\n// promotion reaches it without a rebuild. CORE_ELEMENTS_VERSION — the exact\n// release this package was built and tested with — is the fallback when that\n// endpoint cannot be read.\nconst FALLBACK_VERSION = CORE_ELEMENTS_VERSION;\n\nfunction loadCss(url: string, integrity?: string) {\n  return new Promise<void>((resolve, reject) => {\n    const link = document.createElement(\"link\");\n    link.rel = \"stylesheet\";\n    link.href = url;\n    if (integrity) {\n      // SRI is only enforced on a CORS-mode fetch; the platform origin and the\n      // public CDNs all answer with Access-Control-Allow-Origin: *.\n      link.integrity = integrity;\n      link.crossOrigin = \"anonymous\";\n    }\n    link.onload = () => resolve();\n    link.onerror = (err) => reject(err);\n    document.head.appendChild(link);\n  });\n}\n\n// Loads the module through a <script type=\"module\"> carrying the integrity\n// attribute, then imports it. A dynamic import() cannot carry SRI, but the\n// script element can, and once it has fetched and verified the module the\n// browser's module map holds it under that URL — the import() that follows\n// resolves from the map without a second fetch. A hash mismatch fails the\n// script's load, the promise rejects, and the loader moves to the next\n// source, which is the right outcome: bytes the platform did not gate must not\n// run, wherever they came from.\nfunction loadVerifiedModule(url: string, integrity: string): Promise<any> {\n  return new Promise<void>((resolve, reject) => {\n    const script = document.createElement(\"script\");\n    script.type = \"module\";\n    script.src = url;\n    script.integrity = integrity;\n    script.crossOrigin = \"anonymous\";\n    script.onload = () => resolve();\n    script.onerror = () =>\n      reject(new Error(`core-elements module at ${url} failed to load or did not match its integrity hash`));\n    document.head.appendChild(script);\n  }).then(\n    () =>\n      import(\n        /* webpackIgnore: true */\n        /* turbopackIgnore: true */\n        /* @vite-ignore */\n        url\n      ),\n  );\n}\n\nexport async function loadWebComponents(): Promise<any> {\n  // No DOM means no custom elements to define and no CDN to fetch from.\n  //\n  // Returning rather than throwing matters because src/index.ts calls this at\n  // module scope: under a server renderer the rejection surfaced as a console\n  // error on every render, reporting a failure that is not one. Checked before\n  // the guards below so the browser still loads normally after hydration.\n  if (typeof window === \"undefined\" || typeof document === \"undefined\") {\n    return null;\n  }\n\n  // Another copy of this package on the same page already finished loading.\n  if (window.__pontLoaded) {\n    return window.__pontCoreSdk;\n  }\n\n  // Another copy of this package on the same page is loading right now.\n  if (window.__pontLoading) {\n    return window.__pontLoading;\n  }\n\n  if (!loadPromise) {\n    loadPromise = loadFromCdn().catch((err) => {\n      loadPromise = null;\n      window.__pontLoading = undefined;\n      throw err;\n    });\n\n    window.__pontLoading = loadPromise;\n  }\n\n  return loadPromise;\n}\n\nasync function loadFromCdn(): Promise<any> {\n  const runtime = await fetchRuntimeConfig();\n  const resolvedVersion = runtime?.core_elements_version ?? FALLBACK_VERSION;\n\n  const CDN_SOURCES = CDN_TEMPLATES.map((fn) => fn(resolvedVersion));\n  const CSS_SOURCES = CSS_TEMPLATES.map((fn) => fn(resolvedVersion));\n\n  // The platform's own asset location goes first when it names one; the public\n  // CDNs stay as the fallback list for the same version.\n  if (runtime?.assets) {\n    CDN_SOURCES.unshift(runtime.assets.js);\n    CSS_SOURCES.unshift(runtime.assets.css);\n  }\n\n  // The hashes describe the npm release's bytes, which every source below\n  // serves verbatim, so they apply to all of them — not only to the\n  // platform's. A source whose bytes differ is a source that must not run.\n  const integrity = runtime?.integrity;\n\n  let lastError: unknown = null;\n\n  for (let i = 0; i < CDN_SOURCES.length; i++) {\n    const cdn = CDN_SOURCES[i];\n    const cssCdn = CSS_SOURCES[i];\n\n    try {\n      // 2️⃣ Load CSS first\n      await loadCss(cssCdn, integrity?.css);\n\n      // 3️⃣ Load JS module\n      //\n      // All three ignore directives, and none of them is optional.\n      //\n      // `cdn` is a full URL resolved at runtime, so a bundler that tries to\n      // resolve it statically cannot: webpack and Turbopack turn a dynamic\n      // import with a variable specifier into a module-graph lookup and throw\n      // `Cannot find module 'https://…'` at runtime — no network request is ever\n      // made, and the message reads as though the CDN were at fault. Next.js\n      // uses Turbopack in development and webpack in production, so an app\n      // built with it failed on every CDN in the list identically.\n      //\n      // `@vite-ignore` alone covered only Vite. Each bundler reads its own\n      // comment and ignores the others, so all three coexist and each one keeps\n      // this a real runtime import.\n      const module: any = integrity\n        ? await loadVerifiedModule(cdn, integrity.js)\n        : await import(\n            /* webpackIgnore: true */\n            /* turbopackIgnore: true */\n            /* @vite-ignore */\n            cdn\n          );\n\n      // 4️⃣ Expose globally\n      // Wrap Auth so calls made before `configure()` won't throw. Instead\n      // we queue them and flush once configure() is called by the provider.\n      function createSafeAuth(auth: any) {\n        if (!auth) return auth;\n        type QItem = {\n          prop: string | symbol;\n          args: any[];\n          resolve: (v: any) => void;\n          reject: (e: any) => void;\n        };\n        const queue: QItem[] = [];\n        let configured = false;\n\n        // Expose a configured promise and flag on the proxy so other parts\n        // of the app can wait for Auth to be configured (helps avoid errors\n        // thrown by custom elements that start flows on connect).\n        let resolveWhenConfigured: (() => void) | null = null;\n        const whenConfigured = new Promise<void>((res) => {\n          resolveWhenConfigured = res;\n        });\n\n        const proxy = new Proxy(auth, {\n          get(target, prop, receiver) {\n            if (prop === \"configure\") {\n              return (...args: any[]) => {\n                const res = (target as any).configure?.(...args);\n                configured = true;\n                try {\n                  // flush queued calls\n                  queue.forEach(({ prop: p, args: a, resolve, reject }) => {\n                    try {\n                      const fn = (target as any)[p];\n                      const r = fn.apply(target, a);\n                      if (r && typeof r.then === \"function\") {\n                        r.then(resolve).catch(reject);\n                      } else {\n                        resolve(r);\n                      }\n                    } catch (err) {\n                      reject(err);\n                    }\n                  });\n                } catch (e) {\n                  // ignore flushing errors\n                }\n                queue.length = 0;\n                // mark proxy as configured and resolve the promise\n                try {\n                  (proxy as any).__configured = true;\n                } catch (e) {\n                  /* ignore */\n                }\n                resolveWhenConfigured?.();\n                return res;\n              };\n            }\n\n            const val = (target as any)[prop];\n            if (typeof val === \"function\") {\n              return (...args: any[]) => {\n                if (!configured) {\n                  // queue the call and return a Promise that resolves when flushed\n                  return new Promise((resolve, reject) => {\n                    queue.push({ prop, args, resolve, reject });\n                  });\n                }\n                try {\n                  return val.apply(target, args);\n                } catch (e) {\n                  // preserve throwing behavior for already-configured\n                  throw e;\n                }\n              };\n            }\n            return val;\n          },\n        });\n\n        // Attach the whenConfigured promise and configured flag to the proxy\n        try {\n          (proxy as any).__whenConfigured = whenConfigured;\n          (proxy as any).__configured = configured;\n        } catch (e) {\n          /* ignore */\n        }\n\n        // Also patch the original `auth` object (if present) so that direct\n        // imports and in-module usages get queued behavior too. This ensures\n        // that calls like `Auth.startLoginflow()` won't throw even if they\n        // happen before `configure()` is invoked.\n        try {\n          // Mark the original with the same hooks\n          (auth as any).__whenConfigured = whenConfigured;\n          (auth as any).__configured = configured;\n\n          const origConfigure = (auth as any).configure;\n          if (typeof origConfigure === \"function\") {\n            (auth as any).configure = (...args: any[]) => {\n              const res = origConfigure.apply(auth, args);\n              configured = true;\n              try {\n                queue.forEach(({ prop: p, args: a, resolve, reject }) => {\n                  try {\n                    const fn = (auth as any)[p];\n                    const r = fn.apply(auth, a);\n                    if (r && typeof r.then === \"function\") {\n                      r.then(resolve).catch(reject);\n                    } else {\n                      resolve(r);\n                    }\n                  } catch (err) {\n                    reject(err);\n                  }\n                });\n              } catch (e) {\n                /* ignore */\n              }\n              queue.length = 0;\n              try {\n                (auth as any).__configured = true;\n              } catch (e) {\n                /* ignore */\n              }\n              resolveWhenConfigured?.();\n              return res;\n            };\n          }\n\n          const origStart = (auth as any).startLoginflow;\n          if (typeof origStart === \"function\") {\n            (auth as any).startLoginflow = (...args: any[]) => {\n              if (!configured) {\n                return new Promise((resolve, reject) => {\n                  whenConfigured\n                    .then(() => {\n                      try {\n                        const r = origStart.apply(auth, args);\n                        if (r && typeof r.then === \"function\") {\n                          r.then(resolve).catch(reject);\n                        } else {\n                          resolve(r);\n                        }\n                      } catch (err) {\n                        reject(err);\n                      }\n                    })\n                    .catch(() => {\n                      try {\n                        const r = origStart.apply(auth, args);\n                        if (r && typeof r.then === \"function\") {\n                          r.then(resolve).catch(reject);\n                        } else {\n                          resolve(r);\n                        }\n                      } catch (err) {\n                        reject(err);\n                      }\n                    });\n                });\n              }\n\n              return origStart.apply(auth, args);\n            };\n          }\n        } catch (e) {\n          /* ignore */\n        }\n\n        // When auth is configured, call an explicit retry method on any\n        // sign-in/up elements that implement it. Prefer an explicit retry\n        // API so elements can be idempotent and avoid duplicate flows.\n        try {\n          whenConfigured.then(() => {\n            setTimeout(() => {\n              try {\n                document\n                  .querySelectorAll(\"pont-signin, pont-signup\")\n                  .forEach((el) => {\n                    try {\n                      if ((el as any).__pontInitRetried) return;\n                      (el as any).__pontInitRetried = true;\n                      // Prefer an explicit retry API implemented by the element\n                      // (e.g., `__pontRetryInit`) to avoid re-running the\n                      // entire `connectedCallback` which may cause duplicates.\n                      const retry = (el as any).__pontRetryInit;\n                      if (typeof retry === \"function\") {\n                        try {\n                          retry.call(el);\n                        } catch (e) {\n                          console.error(e);\n                        }\n                        return;\n                      }\n\n                      // Fallback: only call connectedCallback if the element\n                      // provides an explicit flag saying it previously failed\n                      // due to missing Auth (set by our connectedCallback wrapper\n                      // when we detect that specific error).\n                      if ((el as any).__pontFailedForConfig) {\n                        try {\n                          (el as any).connectedCallback?.();\n                        } catch (e) {\n                          console.error(e);\n                        }\n                      }\n                    } catch (_) {\n                      // ignore per-element errors\n                    }\n                  });\n              } catch (_) {\n                /* ignore */\n              }\n            }, 0);\n          });\n        } catch (e) {\n          /* ignore */\n        }\n\n        return proxy;\n      }\n\n      // Replace module exports so consumers that import `Auth` directly\n      // get the safe proxy as well. Also ensure `useAuthProvider()` returns\n      // the proxy.\n      const realAuth = module.useAuthProvider?.();\n      const safeAuth = createSafeAuth(realAuth);\n\n      try {\n        (module as any).Auth = safeAuth;\n        (module as any).useAuthProvider = () => safeAuth;\n      } catch (e) {\n        /* ignore */\n      }\n\n      window.__pontCoreSdk = {\n        ...module,\n        Auth: safeAuth,\n      };\n\n      coreSdk = window.__pontCoreSdk;\n\n      // Set only once the SDK is actually on the window, so a copy of this\n      // package that sees the flag can trust what it reads next to it.\n      window.__pontLoaded = true;\n      window.__pontLoading = undefined;\n\n      // Patch known elements that may start flows on connect so they wait\n      // for Auth to be configured instead of throwing. This avoids noisy\n      // runtime errors like \"Auth.configure() must be called\".\n      try {\n        const patchElement = (tagName: string) => {\n          const ctor = customElements.get(tagName);\n          if (!ctor) return;\n          const proto = ctor.prototype as any;\n          if (proto.__pontConfiguredPatched) return;\n          proto.__pontConfiguredPatched = true;\n\n          const orig = proto.connectedCallback;\n          if (typeof orig !== \"function\") return;\n\n          proto.connectedCallback = function (...args: any[]) {\n            const auth = window.__pontCoreSdk?.Auth as any;\n            const whenConfigured = auth?.__whenConfigured as\n              | Promise<void>\n              | undefined;\n            const configured = !!auth?.__configured;\n\n            if (whenConfigured && !configured) {\n              // delay initial connect work until Auth is configured\n              whenConfigured\n                .then(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (e) {\n                    console.error(e);\n                  }\n                })\n                .catch(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (e) {\n                    console.error(e);\n                  }\n                });\n              return;\n            }\n\n            try {\n              orig.apply(this, args);\n            } catch (e: any) {\n              // If it still throws with the configure error, retry after configured\n              if (\n                e &&\n                typeof e.message === \"string\" &&\n                e.message.includes(\"Auth.configure() must be called\") &&\n                whenConfigured\n              ) {\n                whenConfigured.then(() => {\n                  try {\n                    orig.apply(this, args);\n                  } catch (err) {\n                    console.error(err);\n                  }\n                });\n                return;\n              }\n              throw e;\n            }\n          };\n        };\n\n        // Elements known to start auth flows on connect\n        [\"pont-signin\", \"pont-signup\"].forEach(patchElement);\n      } catch (e) {\n        /* ignore patch errors */\n      }\n\n      console.log(\n        `PontKit Web Components loaded (${resolvedVersion}) from:`,\n        cdn,\n      );\n\n      return coreSdk;\n    } catch (err) {\n      console.error(`Failed loading from ${cdn}`, err);\n      lastError = err;\n    }\n  }\n\n  console.error(\n    \"❌ Failed to load PontKit web components from all CDNs.\",\n    lastError,\n  );\n  throw lastError;\n}\n","import { loadWebComponents } from \"./load-web-components\";\n\nlet coreSdkLoadPromise: Promise<void> | null = null;\n\n/**\n * Ensures the core SDK is loaded and the global functions are available.\n * Returns a promise that resolves when the SDK is ready.\n */\nexport async function ensureCoreSdkLoaded(): Promise<void> {\n  // Nothing to ensure without a browser, and the check below would throw before\n  // reaching loadWebComponents' own guard.\n  if (typeof window === \"undefined\") {\n    return;\n  }\n\n  // If the functions already exist, we're done.\n  if (window.__pontCoreSdk?.openAccountSettingsModal) {\n    return;\n  }\n\n  // Otherwise, start loading the SDK if not already loading.\n  if (!coreSdkLoadPromise) {\n    coreSdkLoadPromise = loadWebComponents()\n      .then(() => {\n        // The first SDK script attaches the functions synchronously when it executes.\n        if (!window.__pontCoreSdk?.openAccountSettingsModal) {\n          console.warn(\n            \"[pontive-react] Core sdk loaded but modal functions are missing.\",\n          );\n        }\n      })\n      .catch((err) => {\n        console.error(\"[pontive-react] Failed to load core SDK:\", err);\n        throw err;\n      });\n  }\n\n  await coreSdkLoadPromise;\n}\n"],"names":["CORE_ELEMENTS_VERSION","RUNTIME_CONFIG_PATHS","RUNTIME_CONFIG_TIMEOUT_MS","EXACT_VERSION","isExactVersion","value","isHttpUrl","isSriHash","fetchRuntimeConfig","options","fetchImpl","urls","candidateUrls","timeoutMs","url","config","readOne","controller","timer","response","body","coreSdk","loadPromise","PACKAGE_NAME","CDN_TEMPLATES","v","CSS_TEMPLATES","FALLBACK_VERSION","loadCss","integrity","resolve","reject","link","err","loadVerifiedModule","script","loadWebComponents","loadFromCdn","runtime","resolvedVersion","CDN_SOURCES","fn","CSS_SOURCES","lastError","i","cdn","cssCdn","createSafeAuth","auth","queue","configured","resolveWhenConfigured","whenConfigured","res","proxy","target","prop","receiver","args","p","a","r","val","e","origConfigure","origStart","el","retry","module","realAuth","safeAuth","patchElement","tagName","ctor","proto","orig","coreSdkLoadPromise","ensureCoreSdkLoaded"],"mappings":"AAcO,MAAMA,IAAgC,SCgBhCC,IAAuB;AAAA,EAClC;AAAA,EACA;AACF,GAGaC,IAA4B,MAEnCC,IAAgB;AASf,SAASC,EAAeC,GAAiC;AAC9D,SAAO,OAAOA,KAAU,YAAYF,EAAc,KAAKE,CAAK;AAC9D;AAEA,SAASC,EAAUD,GAAiC;AAClD,SAAO,OAAOA,KAAU,YAAY,eAAe,KAAKA,CAAK;AAC/D;AAGO,SAASE,EAAUF,GAAiC;AACzD,SAAO,OAAOA,KAAU,YAAY,sCAAsC,KAAKA,CAAK;AACtF;AAOA,eAAsBG,EACpBC,IAAqC,IACN;AAC/B,QAAMC,IAAYD,EAAQ,aAAa,WAAW;AAClD,MAAI,OAAOC,KAAc,WAAY,QAAO;AAE5C,QAAMC,IAAOF,EAAQ,QAAQG,EAAA,GACvBC,IAAYJ,EAAQ,aAAa;AAEvC,aAAWK,KAAOH,GAAM;AACtB,UAAMI,IAAS,MAAMC,EAAQN,GAAWI,GAAKD,CAAS;AACtD,QAAIE,EAAQ,QAAOA;AAAA,EACrB;AAEA,SAAO;AACT;AAEA,SAASH,IAAmC;AAC1C,SAAI,OAAO,SAAW,OAAe,OAAO,OAAO,0BAA2B,WACrE,CAAC,OAAO,sBAAsB,IAGhCX;AACT;AAEA,eAAee,EACbN,GACAI,GACAD,GAC+B;AAC/B,QAAMI,IAAa,OAAO,mBAAoB,aAAa,IAAI,oBAAoB,MAC7EC,IAAQD,IAAa,WAAW,MAAMA,EAAW,MAAA,GAASJ,CAAS,IAAI;AAE7E,MAAI;AACF,UAAMM,IAAW,MAAMT,EAAUI,GAAK;AAAA,MACpC,SAAS,EAAE,QAAQ,mBAAA;AAAA,MACnB,QAAQG,GAAY;AAAA,IAAA,CACrB;AACD,QAAI,CAACE,EAAS,GAAI,QAAO;AAEzB,UAAMC,IAAQ,MAAMD,EAAS,KAAA;AAC7B,QAAI,CAACC,KAAQ,CAAChB,EAAegB,EAAK,qBAAqB,EAAG,QAAO;AAEjE,UAAML,IAAwB;AAAA,MAC5B,uBAAuBK,EAAK;AAAA,MAC5B,QAAQ,OAAOA,EAAK,UAAW,WAAWA,EAAK,SAAS;AAAA,MACxD,kBACE,OAAOA,EAAK,oBAAqB,WAAWA,EAAK,mBAAmB;AAAA,IAAA;AAKxE,WAAIA,EAAK,UAAUd,EAAUc,EAAK,OAAO,EAAE,KAAKd,EAAUc,EAAK,OAAO,GAAG,MACvEL,EAAO,SAAS,EAAE,IAAIK,EAAK,OAAO,IAAI,KAAKA,EAAK,OAAO,IAAA,IAKrDA,EAAK,aAAab,EAAUa,EAAK,UAAU,EAAE,KAAKb,EAAUa,EAAK,UAAU,GAAG,MAChFL,EAAO,YAAY,EAAE,IAAIK,EAAK,UAAU,IAAI,KAAKA,EAAK,UAAU,IAAA,IAG3DL;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT,UAAA;AACE,IAAIG,kBAAoBA,CAAK;AAAA,EAC/B;AACF;AClIA,IAAIG,IAAe,MAQfC,IAAmC;AAEvC,MAAMC,IAAe,yBAGfC,IAAgB;AAAA,EACpB,CAACC,MACC,gCAAgCF,CAAY,IAAIE,CAAC;AAAA,EACnD,CAACA,MAAc,qBAAqBF,CAAY,IAAIE,CAAC;AAAA,EACrD,CAACA,MAAc,kBAAkBF,CAAY,IAAIE,CAAC;AACpD,GAEMC,IAAgB;AAAA,EACpB,CAACD,MACC,gCAAgCF,CAAY,IAAIE,CAAC;AAAA,EACnD,CAACA,MAAc,qBAAqBF,CAAY,IAAIE,CAAC;AAAA,EACrD,CAACA,MAAc,kBAAkBF,CAAY,IAAIE,CAAC;AACpD,GAgBME,IAAmB3B;AAEzB,SAAS4B,EAAQd,GAAae,GAAoB;AAChD,SAAO,IAAI,QAAc,CAACC,GAASC,MAAW;AAC5C,UAAMC,IAAO,SAAS,cAAc,MAAM;AAC1C,IAAAA,EAAK,MAAM,cACXA,EAAK,OAAOlB,GACRe,MAGFG,EAAK,YAAYH,GACjBG,EAAK,cAAc,cAErBA,EAAK,SAAS,MAAMF,EAAA,GACpBE,EAAK,UAAU,CAACC,MAAQF,EAAOE,CAAG,GAClC,SAAS,KAAK,YAAYD,CAAI;AAAA,EAChC,CAAC;AACH;AAUA,SAASE,EAAmBpB,GAAae,GAAiC;AACxE,SAAO,IAAI,QAAc,CAACC,GAASC,MAAW;AAC5C,UAAMI,IAAS,SAAS,cAAc,QAAQ;AAC9C,IAAAA,EAAO,OAAO,UACdA,EAAO,MAAMrB,GACbqB,EAAO,YAAYN,GACnBM,EAAO,cAAc,aACrBA,EAAO,SAAS,MAAML,EAAA,GACtBK,EAAO,UAAU,MACfJ,EAAO,IAAI,MAAM,2BAA2BjB,CAAG,qDAAqD,CAAC,GACvG,SAAS,KAAK,YAAYqB,CAAM;AAAA,EAClC,CAAC,EAAE;AAAA,IACD,MACE;AAAA;AAAA;AAAA;AAAA,MAIErB;AAAA;AAAA,EAAA;AAGR;AAEA,eAAsBsB,IAAkC;AAOtD,SAAI,OAAO,SAAW,OAAe,OAAO,WAAa,MAChD,OAIL,OAAO,eACF,OAAO,gBAIZ,OAAO,gBACF,OAAO,iBAGXd,MACHA,IAAce,EAAA,EAAc,MAAM,CAACJ,MAAQ;AACzC,UAAAX,IAAc,MACd,OAAO,gBAAgB,QACjBW;AAAA,EACR,CAAC,GAED,OAAO,gBAAgBX,IAGlBA;AACT;AAEA,eAAee,IAA4B;AACzC,QAAMC,IAAU,MAAM9B,EAAA,GAChB+B,IAAkBD,GAAS,yBAAyBX,GAEpDa,IAAchB,EAAc,IAAI,CAACiB,MAAOA,EAAGF,CAAe,CAAC,GAC3DG,IAAchB,EAAc,IAAI,CAACe,MAAOA,EAAGF,CAAe,CAAC;AAIjE,EAAID,GAAS,WACXE,EAAY,QAAQF,EAAQ,OAAO,EAAE,GACrCI,EAAY,QAAQJ,EAAQ,OAAO,GAAG;AAMxC,QAAMT,IAAYS,GAAS;AAE3B,MAAIK,IAAqB;AAEzB,WAASC,IAAI,GAAGA,IAAIJ,EAAY,QAAQI,KAAK;AAC3C,UAAMC,IAAML,EAAYI,CAAC,GACnBE,IAASJ,EAAYE,CAAC;AAE5B,QAAI;AA+BF,UAASG,IAAT,SAAwBC,GAAW;AACjC,YAAI,CAACA,EAAM,QAAOA;AAOlB,cAAMC,IAAiB,CAAA;AACvB,YAAIC,IAAa,IAKbC,IAA6C;AACjD,cAAMC,IAAiB,IAAI,QAAc,CAACC,MAAQ;AAChD,UAAAF,IAAwBE;AAAA,QAC1B,CAAC,GAEKC,IAAQ,IAAI,MAAMN,GAAM;AAAA,UAC5B,IAAIO,GAAQC,GAAMC,GAAU;AAC1B,gBAAID,MAAS;AACX,qBAAO,IAAIE,MAAgB;AACzB,sBAAML,IAAOE,EAAe,YAAY,GAAGG,CAAI;AAC/C,gBAAAR,IAAa;AACb,oBAAI;AAEF,kBAAAD,EAAM,QAAQ,CAAC,EAAE,MAAMU,GAAG,MAAMC,GAAG,SAAA9B,GAAS,QAAAC,QAAa;AACvD,wBAAI;AAEF,4BAAM8B,IADMN,EAAeI,CAAC,EACf,MAAMJ,GAAQK,CAAC;AAC5B,sBAAIC,KAAK,OAAOA,EAAE,QAAS,aACzBA,EAAE,KAAK/B,CAAO,EAAE,MAAMC,CAAM,IAE5BD,EAAQ+B,CAAC;AAAA,oBAEb,SAAS5B,GAAK;AACZ,sBAAAF,EAAOE,CAAG;AAAA,oBACZ;AAAA,kBACF,CAAC;AAAA,gBACH,QAAY;AAAA,gBAEZ;AACA,gBAAAgB,EAAM,SAAS;AAEf,oBAAI;AACD,kBAAAK,EAAc,eAAe;AAAA,gBAChC,QAAY;AAAA,gBAEZ;AACA,uBAAAH,IAAA,GACOE;AAAA,cACT;AAGF,kBAAMS,IAAOP,EAAeC,CAAI;AAChC,mBAAI,OAAOM,KAAQ,aACV,IAAIJ,MAAgB;AACzB,kBAAI,CAACR;AAEH,uBAAO,IAAI,QAAQ,CAACpB,GAASC,MAAW;AACtC,kBAAAkB,EAAM,KAAK,EAAE,MAAAO,GAAM,MAAAE,GAAM,SAAA5B,GAAS,QAAAC,GAAQ;AAAA,gBAC5C,CAAC;AAEH,kBAAI;AACF,uBAAO+B,EAAI,MAAMP,GAAQG,CAAI;AAAA,cAC/B,SAASK,GAAG;AAEV,sBAAMA;AAAA,cACR;AAAA,YACF,IAEKD;AAAA,UACT;AAAA,QAAA,CACD;AAGD,YAAI;AACD,UAAAR,EAAc,mBAAmBF,GACjCE,EAAc,eAAeJ;AAAA,QAChC,QAAY;AAAA,QAEZ;AAMA,YAAI;AAED,UAAAF,EAAa,mBAAmBI,GAChCJ,EAAa,eAAeE;AAE7B,gBAAMc,IAAiBhB,EAAa;AACpC,UAAI,OAAOgB,KAAkB,eAC1BhB,EAAa,YAAY,IAAIU,MAAgB;AAC5C,kBAAML,IAAMW,EAAc,MAAMhB,GAAMU,CAAI;AAC1C,YAAAR,IAAa;AACb,gBAAI;AACF,cAAAD,EAAM,QAAQ,CAAC,EAAE,MAAMU,GAAG,MAAMC,GAAG,SAAA9B,GAAS,QAAAC,QAAa;AACvD,oBAAI;AAEF,wBAAM8B,IADMb,EAAaW,CAAC,EACb,MAAMX,GAAMY,CAAC;AAC1B,kBAAIC,KAAK,OAAOA,EAAE,QAAS,aACzBA,EAAE,KAAK/B,CAAO,EAAE,MAAMC,CAAM,IAE5BD,EAAQ+B,CAAC;AAAA,gBAEb,SAAS5B,GAAK;AACZ,kBAAAF,EAAOE,CAAG;AAAA,gBACZ;AAAA,cACF,CAAC;AAAA,YACH,QAAY;AAAA,YAEZ;AACA,YAAAgB,EAAM,SAAS;AACf,gBAAI;AACD,cAAAD,EAAa,eAAe;AAAA,YAC/B,QAAY;AAAA,YAEZ;AACA,mBAAAG,IAAA,GACOE;AAAA,UACT;AAGF,gBAAMY,IAAajB,EAAa;AAChC,UAAI,OAAOiB,KAAc,eACtBjB,EAAa,iBAAiB,IAAIU,MAC5BR,IA8BEe,EAAU,MAAMjB,GAAMU,CAAI,IA7BxB,IAAI,QAAQ,CAAC5B,GAASC,MAAW;AACtC,YAAAqB,EACG,KAAK,MAAM;AACV,kBAAI;AACF,sBAAM,IAAIa,EAAU,MAAMjB,GAAMU,CAAI;AACpC,gBAAI,KAAK,OAAO,EAAE,QAAS,aACzB,EAAE,KAAK5B,CAAO,EAAE,MAAMC,CAAM,IAE5BD,EAAQ,CAAC;AAAA,cAEb,SAASG,GAAK;AACZ,gBAAAF,EAAOE,CAAG;AAAA,cACZ;AAAA,YACF,CAAC,EACA,MAAM,MAAM;AACX,kBAAI;AACF,sBAAM,IAAIgC,EAAU,MAAMjB,GAAMU,CAAI;AACpC,gBAAI,KAAK,OAAO,EAAE,QAAS,aACzB,EAAE,KAAK5B,CAAO,EAAE,MAAMC,CAAM,IAE5BD,EAAQ,CAAC;AAAA,cAEb,SAASG,GAAK;AACZ,gBAAAF,EAAOE,CAAG;AAAA,cACZ;AAAA,YACF,CAAC;AAAA,UACL,CAAC;AAAA,QAMT,QAAY;AAAA,QAEZ;AAKA,YAAI;AACF,UAAAmB,EAAe,KAAK,MAAM;AACxB,uBAAW,MAAM;AACf,kBAAI;AACF,yBACG,iBAAiB,0BAA0B,EAC3C,QAAQ,CAACc,MAAO;AACf,sBAAI;AACF,wBAAKA,EAAW,kBAAmB;AAClC,oBAAAA,EAAW,oBAAoB;AAIhC,0BAAMC,IAASD,EAAW;AAC1B,wBAAI,OAAOC,KAAU,YAAY;AAC/B,0BAAI;AACF,wBAAAA,EAAM,KAAKD,CAAE;AAAA,sBACf,SAASH,GAAG;AACV,gCAAQ,MAAMA,CAAC;AAAA,sBACjB;AACA;AAAA,oBACF;AAMA,wBAAKG,EAAW;AACd,0BAAI;AACD,wBAAAA,EAAW,oBAAA;AAAA,sBACd,SAASH,GAAG;AACV,gCAAQ,MAAMA,CAAC;AAAA,sBACjB;AAAA,kBAEJ,QAAY;AAAA,kBAEZ;AAAA,gBACF,CAAC;AAAA,cACL,QAAY;AAAA,cAEZ;AAAA,YACF,GAAG,CAAC;AAAA,UACN,CAAC;AAAA,QACH,QAAY;AAAA,QAEZ;AAEA,eAAOT;AAAA,MACT;AAtPA,YAAM1B,EAAQkB,GAAQjB,GAAW,GAAG;AAiBpC,YAAMuC,IAAcvC,IAChB,MAAMK,EAAmBW,GAAKhB,EAAU,EAAE,IAC1C,MAAM;AAAA;AAAA;AAAA;AAAA,QAIJgB;AAAA,SAoOAwB,IAAWD,EAAO,kBAAA,GAClBE,IAAWvB,EAAesB,CAAQ;AAExC,UAAI;AACD,QAAAD,EAAe,OAAOE,GACtBF,EAAe,kBAAkB,MAAME;AAAA,MAC1C,QAAY;AAAA,MAEZ;AAEA,aAAO,gBAAgB;AAAA,QACrB,GAAGF;AAAA,QACH,MAAME;AAAA,MAAA,GAGRjD,IAAU,OAAO,eAIjB,OAAO,eAAe,IACtB,OAAO,gBAAgB;AAKvB,UAAI;AACF,cAAMkD,IAAe,CAACC,MAAoB;AACxC,gBAAMC,IAAO,eAAe,IAAID,CAAO;AACvC,cAAI,CAACC,EAAM;AACX,gBAAMC,IAAQD,EAAK;AACnB,cAAIC,EAAM,wBAAyB;AACnC,UAAAA,EAAM,0BAA0B;AAEhC,gBAAMC,IAAOD,EAAM;AACnB,UAAI,OAAOC,KAAS,eAEpBD,EAAM,oBAAoB,YAAahB,GAAa;AAClD,kBAAMV,IAAO,OAAO,eAAe,MAC7BI,IAAiBJ,GAAM,kBAGvBE,IAAa,CAAC,CAACF,GAAM;AAE3B,gBAAII,KAAkB,CAACF,GAAY;AAEjC,cAAAE,EACG,KAAK,MAAM;AACV,oBAAI;AACF,kBAAAuB,EAAK,MAAM,MAAMjB,CAAI;AAAA,gBACvB,SAASK,GAAG;AACV,0BAAQ,MAAMA,CAAC;AAAA,gBACjB;AAAA,cACF,CAAC,EACA,MAAM,MAAM;AACX,oBAAI;AACF,kBAAAY,EAAK,MAAM,MAAMjB,CAAI;AAAA,gBACvB,SAASK,GAAG;AACV,0BAAQ,MAAMA,CAAC;AAAA,gBACjB;AAAA,cACF,CAAC;AACH;AAAA,YACF;AAEA,gBAAI;AACF,cAAAY,EAAK,MAAM,MAAMjB,CAAI;AAAA,YACvB,SAASK,GAAQ;AAEf,kBACEA,KACA,OAAOA,EAAE,WAAY,YACrBA,EAAE,QAAQ,SAAS,iCAAiC,KACpDX,GACA;AACA,gBAAAA,EAAe,KAAK,MAAM;AACxB,sBAAI;AACF,oBAAAuB,EAAK,MAAM,MAAMjB,CAAI;AAAA,kBACvB,SAASzB,GAAK;AACZ,4BAAQ,MAAMA,CAAG;AAAA,kBACnB;AAAA,gBACF,CAAC;AACD;AAAA,cACF;AACA,oBAAM8B;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAGA,SAAC,eAAe,aAAa,EAAE,QAAQQ,CAAY;AAAA,MACrD,QAAY;AAAA,MAEZ;AAEA,qBAAQ;AAAA,QACN,kCAAkChC,CAAe;AAAA,QACjDM;AAAA,MAAA,GAGKxB;AAAA,IACT,SAASY,GAAK;AACZ,cAAQ,MAAM,uBAAuBY,CAAG,IAAIZ,CAAG,GAC/CU,IAAYV;AAAA,IACd;AAAA,EACF;AAEA,gBAAQ;AAAA,IACN;AAAA,IACAU;AAAA,EAAA,GAEIA;AACR;ACjgBA,IAAIiC,IAA2C;AAM/C,eAAsBC,IAAqC;AAGzD,EAAI,OAAO,SAAW,OAKlB,OAAO,eAAe,6BAKrBD,MACHA,IAAqBxC,IAClB,KAAK,MAAM;AAEV,IAAK,OAAO,eAAe,4BACzB,QAAQ;AAAA,MACN;AAAA,IAAA;AAAA,EAGN,CAAC,EACA,MAAM,CAACH,MAAQ;AACd,kBAAQ,MAAM,4CAA4CA,CAAG,GACvDA;AAAA,EACR,CAAC,IAGL,MAAM2C;AACR;"}

package/dist/proxy/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The framework-neutral half of the auth proxy.
+ *
+ * An app is cross-site with its auth server unless the auth endpoints are
+ * served from the app's own origin, and a cross-site refresh cookie is a
+ * third-party cookie: dropped by Safari outright, withheld everywhere under
+ * SameSite=Lax. A proxy on the app's origin is what makes those cookies
+ * first-party.
+ *
+ * None of this is Next-specific, and the Vite adapter is here rather than in
+ * @pontive/pontkit-nextjs because a Vite app depending on a package named for
+ * another meta-framework is a wart, not a design. @pontive/pontkit-nextjs keeps
+ * only its own adapter and imports these primitives.
+ *
+ * Nothing here imports Vite: the proxy entry is described structurally, so a
+ * consumer's Vite version is not part of this package's types.
+ */
+export { DEFAULT_BASE_PATH, DEFAULT_FORWARDED_PATHS, authOrigin, isUnder, normaliseBasePath, } from './target';
+export { viteAuthProxy } from './vite';
+export type { ViteAuthProxyOptions, ViteProxyEntry } from './vite';

package/dist/proxy/target.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Where a proxied request is sent, and which requests are sent at all.
+ *
+ * Deliberately not shared with `resolveAuthBaseUrl` in the SDK, which answers a
+ * different question. That one resolves what the BROWSER should call and its
+ * most useful answer — a bare path like `/__auth` — is meaningless here: a
+ * proxy runs on a server, where there is no page origin for a path to be
+ * relative to. Sharing them would mean one function with a mode flag, and the
+ * mode that is wrong in either direction is silent.
+ */
+/**
+ * The endpoints an app-level proxy has to carry, and the reason the list is
+ * short.
+ *
+ * These are the requests the browser makes with `fetch` — the auth flow, the
+ * token endpoint, userinfo, logout, branding CSS. They are the ones that need
+ * to be same-origin, because they are the ones carrying cookies under
+ * `SameSite=Lax`.
+ *
+ * Everything else on the auth server is a top-level navigation — `/authorize`,
+ * the hosted sign-in page, `/end_session` as a redirect — and a `Lax` cookie is
+ * sent on those already, whatever origin they are served from. Proxying them
+ * would not help, and it would break: the authorization server builds those
+ * URLs absolute, on its own hostname, so the browser leaves the proxy at the
+ * first redirect anyway.
+ *
+ * The two prefixes are the same pair the dev-server proxy uses (auth-api,
+ * `docs/auth-domains-and-token-storage.md` §3). That is not a coincidence to be
+ * tidied away: local development against a shared sandbox domain is the same
+ * cross-site problem this solves in production, and the two configurations
+ * being identical is what makes the local one a rehearsal.
+ */
+export declare const DEFAULT_FORWARDED_PATHS: readonly ["/auth/v1", "/oauth2"];
+/**
+ * Where the endpoints hang off the app's own origin.
+ *
+ * `__`-prefixed by convention — Clerk uses `/__clerk`, Firebase `/__/auth` —
+ * because it has to be a path no real route of the app will ever want.
+ */
+export declare const DEFAULT_BASE_PATH = "/__auth";
+/**
+ * The auth server, as an origin.
+ *
+ * Accepts `tenant.idp.us.pontive.app` or `https://tenant.idp.us.pontive.app`,
+ * and nothing with a path: the upstream path comes from the incoming request,
+ * and a base path here would be silently prepended to endpoints the auth server
+ * does not serve.
+ *
+ * `http://` is inferred for loopback only, and accepted only there. A proxy is
+ * the one hop a refresh token cannot be carried over in the clear — it is the
+ * hop that exists precisely so the cookie is first-party — and the failure is
+ * invisible from the browser, which sees its own `https://` origin either way.
+ */
+export declare function authOrigin(authHost: string): string;
+/**
+ * A base path with a leading slash and no trailing one, so joining is
+ * unambiguous.
+ *
+ * `"/"` normalises to `""`, which mounts the endpoints at the origin root —
+ * `/auth/v1/...` and `/oauth2/...` where the app itself is served. That is the
+ * shape a Vite dev server has always used, and it stays available because in
+ * development the app owns the whole origin and there is nothing to collide
+ * with. A deployed app usually does not, which is what the prefix is for.
+ */
+export declare function normaliseBasePath(basePath: string): string;
+/** Whether `pathname` is `prefix` itself or something under it. */
+export declare function isUnder(pathname: string, prefix: string): boolean;

package/dist/proxy/vite.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The shape of one entry in Vite's `server.proxy`.
+ *
+ * Declared here rather than imported from Vite so that nothing which imports
+ * this module needs Vite installed, and so the published types do not depend on
+ * a particular version of it. It is structural: Vite accepts this object.
+ */
+export interface ViteProxyEntry {
+    target: string;
+    changeOrigin: boolean;
+    rewrite: (path: string) => string;
+}
+export interface ViteAuthProxyOptions {
+    authHost: string;
+    basePath?: string;
+    paths?: readonly string[];
+}
+/**
+ * The auth endpoints, proxied through a Vite dev server.
+ *
+ * ```ts
+ * // vite.config.ts
+ * server: { proxy: viteAuthProxy({ authHost: env.VITE_SB_AUTH_DOMAIN }) }
+ * ```
+ *
+ * Vite already has a proxy; what it does not have is the knowledge of which
+ * paths to carry and what to do with Host, and both of those are easy to get
+ * wrong in ways that fail silently. So this is a config generator rather than a
+ * request handler — `createAuthProxy` is for runtimes that have no proxy of
+ * their own.
+ *
+ * Worth doing even where the browser would tolerate the cross-site setup,
+ * because it is the same topology production runs on: a dev server that proxies
+ * is rehearsing the deployment, and a dev server that does not is testing a
+ * configuration no user will ever have. It is also the only way an embedded
+ * sign-in flow works in Safari, which blocks third-party cookies outright.
+ */
+export declare function viteAuthProxy(options: ViteAuthProxyOptions): Record<string, ViteProxyEntry>;

package/dist/proxy.cjs

@@ -0,0 +1,2 @@
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const n=["/auth/v1","/oauth2"],a="/__auth";function h(r){const t=(r??"").trim();if(!t)throw new TypeError("authHost is required");const o=/^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/i.test(t.replace(/^https?:\/\//i,"").split("/")[0]),s=/^https?:\/\//i.test(t)?"":`${o?"http":"https"}://`;let e;try{e=new URL(`${s}${t}`)}catch{throw new TypeError(`authHost "${t}" is not a hostname or an origin`)}if(e.pathname!=="/"||e.search||e.hash)throw new TypeError(`authHost "${t}" must be a bare origin — the path comes from the request being proxied`);if(e.protocol!=="https:"&&!o)throw new TypeError(`authHost "${t}" must be https outside loopback`);return e.origin}function u(r){const t=(r??"").trim().replace(/\/+$/,"");if(t==="")return"";if(!t.startsWith("/"))throw new TypeError(`basePath "${r}" must start with "/"`);return t}function p(r,t){return r===t||r.startsWith(`${t}/`)}function l(r){const t=h(r.authHost),o=u(r.basePath??a),s=r.paths??n,e={};for(const c of s)e[`${o}${c}`]={target:t,changeOrigin:!0,rewrite:i=>o?i.replace(o,""):i};return e}exports.DEFAULT_BASE_PATH=a;exports.DEFAULT_FORWARDED_PATHS=n;exports.authOrigin=h;exports.isUnder=p;exports.normaliseBasePath=u;exports.viteAuthProxy=l;
+//# sourceMappingURL=proxy.cjs.map

package/dist/proxy.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.cjs","sources":["../src/proxy/target.ts","../src/proxy/vite.ts"],"sourcesContent":["/**\n * Where a proxied request is sent, and which requests are sent at all.\n *\n * Deliberately not shared with `resolveAuthBaseUrl` in the SDK, which answers a\n * different question. That one resolves what the BROWSER should call and its\n * most useful answer — a bare path like `/__auth` — is meaningless here: a\n * proxy runs on a server, where there is no page origin for a path to be\n * relative to. Sharing them would mean one function with a mode flag, and the\n * mode that is wrong in either direction is silent.\n */\n\n/**\n * The endpoints an app-level proxy has to carry, and the reason the list is\n * short.\n *\n * These are the requests the browser makes with `fetch` — the auth flow, the\n * token endpoint, userinfo, logout, branding CSS. They are the ones that need\n * to be same-origin, because they are the ones carrying cookies under\n * `SameSite=Lax`.\n *\n * Everything else on the auth server is a top-level navigation — `/authorize`,\n * the hosted sign-in page, `/end_session` as a redirect — and a `Lax` cookie is\n * sent on those already, whatever origin they are served from. Proxying them\n * would not help, and it would break: the authorization server builds those\n * URLs absolute, on its own hostname, so the browser leaves the proxy at the\n * first redirect anyway.\n *\n * The two prefixes are the same pair the dev-server proxy uses (auth-api,\n * `docs/auth-domains-and-token-storage.md` §3). That is not a coincidence to be\n * tidied away: local development against a shared sandbox domain is the same\n * cross-site problem this solves in production, and the two configurations\n * being identical is what makes the local one a rehearsal.\n */\nexport const DEFAULT_FORWARDED_PATHS = [\"/auth/v1\", \"/oauth2\"] as const;\n\n/**\n * Where the endpoints hang off the app's own origin.\n *\n * `__`-prefixed by convention — Clerk uses `/__clerk`, Firebase `/__/auth` —\n * because it has to be a path no real route of the app will ever want.\n */\nexport const DEFAULT_BASE_PATH = \"/__auth\";\n\n/**\n * The auth server, as an origin.\n *\n * Accepts `tenant.idp.us.pontive.app` or `https://tenant.idp.us.pontive.app`,\n * and nothing with a path: the upstream path comes from the incoming request,\n * and a base path here would be silently prepended to endpoints the auth server\n * does not serve.\n *\n * `http://` is inferred for loopback only, and accepted only there. A proxy is\n * the one hop a refresh token cannot be carried over in the clear — it is the\n * hop that exists precisely so the cookie is first-party — and the failure is\n * invisible from the browser, which sees its own `https://` origin either way.\n */\nexport function authOrigin(authHost: string): string {\n  const configured = (authHost ?? \"\").trim();\n\n  if (!configured) {\n    throw new TypeError(\"authHost is required\");\n  }\n\n  const loopback = /^(localhost|127\\.0\\.0\\.1|\\[::1\\])(:\\d+)?$/i.test(\n    configured.replace(/^https?:\\/\\//i, \"\").split(\"/\")[0],\n  );\n\n  const scheme = /^https?:\\/\\//i.test(configured) ? \"\" : `${loopback ? \"http\" : \"https\"}://`;\n\n  let url: URL;\n  try {\n    url = new URL(`${scheme}${configured}`);\n  } catch {\n    throw new TypeError(`authHost \"${configured}\" is not a hostname or an origin`);\n  }\n\n  if (url.pathname !== \"/\" || url.search || url.hash) {\n    throw new TypeError(\n      `authHost \"${configured}\" must be a bare origin — the path comes from the request being proxied`,\n    );\n  }\n\n  if (url.protocol !== \"https:\" && !loopback) {\n    throw new TypeError(`authHost \"${configured}\" must be https outside loopback`);\n  }\n\n  return url.origin;\n}\n\n/**\n * A base path with a leading slash and no trailing one, so joining is\n * unambiguous.\n *\n * `\"/\"` normalises to `\"\"`, which mounts the endpoints at the origin root —\n * `/auth/v1/...` and `/oauth2/...` where the app itself is served. That is the\n * shape a Vite dev server has always used, and it stays available because in\n * development the app owns the whole origin and there is nothing to collide\n * with. A deployed app usually does not, which is what the prefix is for.\n */\nexport function normaliseBasePath(basePath: string): string {\n  const trimmed = (basePath ?? \"\").trim().replace(/\\/+$/, \"\");\n\n  if (trimmed === \"\") {\n    return \"\";\n  }\n\n  if (!trimmed.startsWith(\"/\")) {\n    throw new TypeError(`basePath \"${basePath}\" must start with \"/\"`);\n  }\n\n  return trimmed;\n}\n\n/** Whether `pathname` is `prefix` itself or something under it. */\nexport function isUnder(pathname: string, prefix: string): boolean {\n  return pathname === prefix || pathname.startsWith(`${prefix}/`);\n}\n","import {\n  DEFAULT_BASE_PATH,\n  DEFAULT_FORWARDED_PATHS,\n  authOrigin,\n  normaliseBasePath,\n} from \"./target\";\n\n/**\n * The shape of one entry in Vite's `server.proxy`.\n *\n * Declared here rather than imported from Vite so that nothing which imports\n * this module needs Vite installed, and so the published types do not depend on\n * a particular version of it. It is structural: Vite accepts this object.\n */\nexport interface ViteProxyEntry {\n  target: string;\n  changeOrigin: boolean;\n  rewrite: (path: string) => string;\n}\n\nexport interface ViteAuthProxyOptions {\n  authHost: string;\n  basePath?: string;\n  paths?: readonly string[];\n}\n\n/**\n * The auth endpoints, proxied through a Vite dev server.\n *\n * ```ts\n * // vite.config.ts\n * server: { proxy: viteAuthProxy({ authHost: env.VITE_SB_AUTH_DOMAIN }) }\n * ```\n *\n * Vite already has a proxy; what it does not have is the knowledge of which\n * paths to carry and what to do with Host, and both of those are easy to get\n * wrong in ways that fail silently. So this is a config generator rather than a\n * request handler — `createAuthProxy` is for runtimes that have no proxy of\n * their own.\n *\n * Worth doing even where the browser would tolerate the cross-site setup,\n * because it is the same topology production runs on: a dev server that proxies\n * is rehearsing the deployment, and a dev server that does not is testing a\n * configuration no user will ever have. It is also the only way an embedded\n * sign-in flow works in Safari, which blocks third-party cookies outright.\n */\nexport function viteAuthProxy(\n  options: ViteAuthProxyOptions,\n): Record<string, ViteProxyEntry> {\n  const target = authOrigin(options.authHost);\n  const basePath = normaliseBasePath(options.basePath ?? DEFAULT_BASE_PATH);\n  const paths = options.paths ?? DEFAULT_FORWARDED_PATHS;\n\n  const proxy: Record<string, ViteProxyEntry> = {};\n\n  for (const prefix of paths) {\n    proxy[`${basePath}${prefix}`] = {\n      target,\n      // The single most important line, and the one a hand-written config\n      // leaves out. Without it the auth server is asked to answer as\n      // `localhost:5173` — a Host it has no project for — and the reply is a\n      // CORS refusal and an empty issuer rather than anything that says so.\n      changeOrigin: true,\n      // Only the base path comes off. The prefix below it is the path the auth\n      // server actually serves.\n      rewrite: (path: string) => (basePath ? path.replace(basePath, \"\") : path),\n    };\n  }\n\n  return proxy;\n}\n"],"names":["DEFAULT_FORWARDED_PATHS","DEFAULT_BASE_PATH","authOrigin","authHost","configured","loopback","scheme","url","normaliseBasePath","basePath","trimmed","isUnder","pathname","prefix","viteAuthProxy","options","target","paths","proxy","path"],"mappings":"gFAiCO,MAAMA,EAA0B,CAAC,WAAY,SAAS,EAQhDC,EAAoB,UAe1B,SAASC,EAAWC,EAA0B,CACnD,MAAMC,GAAcD,GAAY,IAAI,KAAA,EAEpC,GAAI,CAACC,EACH,MAAM,IAAI,UAAU,sBAAsB,EAG5C,MAAMC,EAAW,6CAA6C,KAC5DD,EAAW,QAAQ,gBAAiB,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,CAAA,EAGhDE,EAAS,gBAAgB,KAAKF,CAAU,EAAI,GAAK,GAAGC,EAAW,OAAS,OAAO,MAErF,IAAIE,EACJ,GAAI,CACFA,EAAM,IAAI,IAAI,GAAGD,CAAM,GAAGF,CAAU,EAAE,CACxC,MAAQ,CACN,MAAM,IAAI,UAAU,aAAaA,CAAU,kCAAkC,CAC/E,CAEA,GAAIG,EAAI,WAAa,KAAOA,EAAI,QAAUA,EAAI,KAC5C,MAAM,IAAI,UACR,aAAaH,CAAU,yEAAA,EAI3B,GAAIG,EAAI,WAAa,UAAY,CAACF,EAChC,MAAM,IAAI,UAAU,aAAaD,CAAU,kCAAkC,EAG/E,OAAOG,EAAI,MACb,CAYO,SAASC,EAAkBC,EAA0B,CAC1D,MAAMC,GAAWD,GAAY,IAAI,OAAO,QAAQ,OAAQ,EAAE,EAE1D,GAAIC,IAAY,GACd,MAAO,GAGT,GAAI,CAACA,EAAQ,WAAW,GAAG,EACzB,MAAM,IAAI,UAAU,aAAaD,CAAQ,uBAAuB,EAGlE,OAAOC,CACT,CAGO,SAASC,EAAQC,EAAkBC,EAAyB,CACjE,OAAOD,IAAaC,GAAUD,EAAS,WAAW,GAAGC,CAAM,GAAG,CAChE,CCtEO,SAASC,EACdC,EACgC,CAChC,MAAMC,EAASd,EAAWa,EAAQ,QAAQ,EACpCN,EAAWD,EAAkBO,EAAQ,UAAYd,CAAiB,EAClEgB,EAAQF,EAAQ,OAASf,EAEzBkB,EAAwC,CAAA,EAE9C,UAAWL,KAAUI,EACnBC,EAAM,GAAGT,CAAQ,GAAGI,CAAM,EAAE,EAAI,CAC9B,OAAAG,EAKA,aAAc,GAGd,QAAUG,GAAkBV,EAAWU,EAAK,QAAQV,EAAU,EAAE,EAAIU,CAAA,EAIxE,OAAOD,CACT"}

package/dist/proxy.js

@@ -0,0 +1,58 @@
+const i = ["/auth/v1", "/oauth2"], a = "/__auth";
+function c(r) {
+  const t = (r ?? "").trim();
+  if (!t)
+    throw new TypeError("authHost is required");
+  const o = /^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/i.test(
+    t.replace(/^https?:\/\//i, "").split("/")[0]
+  ), s = /^https?:\/\//i.test(t) ? "" : `${o ? "http" : "https"}://`;
+  let e;
+  try {
+    e = new URL(`${s}${t}`);
+  } catch {
+    throw new TypeError(`authHost "${t}" is not a hostname or an origin`);
+  }
+  if (e.pathname !== "/" || e.search || e.hash)
+    throw new TypeError(
+      `authHost "${t}" must be a bare origin — the path comes from the request being proxied`
+    );
+  if (e.protocol !== "https:" && !o)
+    throw new TypeError(`authHost "${t}" must be https outside loopback`);
+  return e.origin;
+}
+function u(r) {
+  const t = (r ?? "").trim().replace(/\/+$/, "");
+  if (t === "")
+    return "";
+  if (!t.startsWith("/"))
+    throw new TypeError(`basePath "${r}" must start with "/"`);
+  return t;
+}
+function p(r, t) {
+  return r === t || r.startsWith(`${t}/`);
+}
+function f(r) {
+  const t = c(r.authHost), o = u(r.basePath ?? a), s = r.paths ?? i, e = {};
+  for (const h of s)
+    e[`${o}${h}`] = {
+      target: t,
+      // The single most important line, and the one a hand-written config
+      // leaves out. Without it the auth server is asked to answer as
+      // `localhost:5173` — a Host it has no project for — and the reply is a
+      // CORS refusal and an empty issuer rather than anything that says so.
+      changeOrigin: !0,
+      // Only the base path comes off. The prefix below it is the path the auth
+      // server actually serves.
+      rewrite: (n) => o ? n.replace(o, "") : n
+    };
+  return e;
+}
+export {
+  a as DEFAULT_BASE_PATH,
+  i as DEFAULT_FORWARDED_PATHS,
+  c as authOrigin,
+  p as isUnder,
+  u as normaliseBasePath,
+  f as viteAuthProxy
+};
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sources":["../src/proxy/target.ts","../src/proxy/vite.ts"],"sourcesContent":["/**\n * Where a proxied request is sent, and which requests are sent at all.\n *\n * Deliberately not shared with `resolveAuthBaseUrl` in the SDK, which answers a\n * different question. That one resolves what the BROWSER should call and its\n * most useful answer — a bare path like `/__auth` — is meaningless here: a\n * proxy runs on a server, where there is no page origin for a path to be\n * relative to. Sharing them would mean one function with a mode flag, and the\n * mode that is wrong in either direction is silent.\n */\n\n/**\n * The endpoints an app-level proxy has to carry, and the reason the list is\n * short.\n *\n * These are the requests the browser makes with `fetch` — the auth flow, the\n * token endpoint, userinfo, logout, branding CSS. They are the ones that need\n * to be same-origin, because they are the ones carrying cookies under\n * `SameSite=Lax`.\n *\n * Everything else on the auth server is a top-level navigation — `/authorize`,\n * the hosted sign-in page, `/end_session` as a redirect — and a `Lax` cookie is\n * sent on those already, whatever origin they are served from. Proxying them\n * would not help, and it would break: the authorization server builds those\n * URLs absolute, on its own hostname, so the browser leaves the proxy at the\n * first redirect anyway.\n *\n * The two prefixes are the same pair the dev-server proxy uses (auth-api,\n * `docs/auth-domains-and-token-storage.md` §3). That is not a coincidence to be\n * tidied away: local development against a shared sandbox domain is the same\n * cross-site problem this solves in production, and the two configurations\n * being identical is what makes the local one a rehearsal.\n */\nexport const DEFAULT_FORWARDED_PATHS = [\"/auth/v1\", \"/oauth2\"] as const;\n\n/**\n * Where the endpoints hang off the app's own origin.\n *\n * `__`-prefixed by convention — Clerk uses `/__clerk`, Firebase `/__/auth` —\n * because it has to be a path no real route of the app will ever want.\n */\nexport const DEFAULT_BASE_PATH = \"/__auth\";\n\n/**\n * The auth server, as an origin.\n *\n * Accepts `tenant.idp.us.pontive.app` or `https://tenant.idp.us.pontive.app`,\n * and nothing with a path: the upstream path comes from the incoming request,\n * and a base path here would be silently prepended to endpoints the auth server\n * does not serve.\n *\n * `http://` is inferred for loopback only, and accepted only there. A proxy is\n * the one hop a refresh token cannot be carried over in the clear — it is the\n * hop that exists precisely so the cookie is first-party — and the failure is\n * invisible from the browser, which sees its own `https://` origin either way.\n */\nexport function authOrigin(authHost: string): string {\n  const configured = (authHost ?? \"\").trim();\n\n  if (!configured) {\n    throw new TypeError(\"authHost is required\");\n  }\n\n  const loopback = /^(localhost|127\\.0\\.0\\.1|\\[::1\\])(:\\d+)?$/i.test(\n    configured.replace(/^https?:\\/\\//i, \"\").split(\"/\")[0],\n  );\n\n  const scheme = /^https?:\\/\\//i.test(configured) ? \"\" : `${loopback ? \"http\" : \"https\"}://`;\n\n  let url: URL;\n  try {\n    url = new URL(`${scheme}${configured}`);\n  } catch {\n    throw new TypeError(`authHost \"${configured}\" is not a hostname or an origin`);\n  }\n\n  if (url.pathname !== \"/\" || url.search || url.hash) {\n    throw new TypeError(\n      `authHost \"${configured}\" must be a bare origin — the path comes from the request being proxied`,\n    );\n  }\n\n  if (url.protocol !== \"https:\" && !loopback) {\n    throw new TypeError(`authHost \"${configured}\" must be https outside loopback`);\n  }\n\n  return url.origin;\n}\n\n/**\n * A base path with a leading slash and no trailing one, so joining is\n * unambiguous.\n *\n * `\"/\"` normalises to `\"\"`, which mounts the endpoints at the origin root —\n * `/auth/v1/...` and `/oauth2/...` where the app itself is served. That is the\n * shape a Vite dev server has always used, and it stays available because in\n * development the app owns the whole origin and there is nothing to collide\n * with. A deployed app usually does not, which is what the prefix is for.\n */\nexport function normaliseBasePath(basePath: string): string {\n  const trimmed = (basePath ?? \"\").trim().replace(/\\/+$/, \"\");\n\n  if (trimmed === \"\") {\n    return \"\";\n  }\n\n  if (!trimmed.startsWith(\"/\")) {\n    throw new TypeError(`basePath \"${basePath}\" must start with \"/\"`);\n  }\n\n  return trimmed;\n}\n\n/** Whether `pathname` is `prefix` itself or something under it. */\nexport function isUnder(pathname: string, prefix: string): boolean {\n  return pathname === prefix || pathname.startsWith(`${prefix}/`);\n}\n","import {\n  DEFAULT_BASE_PATH,\n  DEFAULT_FORWARDED_PATHS,\n  authOrigin,\n  normaliseBasePath,\n} from \"./target\";\n\n/**\n * The shape of one entry in Vite's `server.proxy`.\n *\n * Declared here rather than imported from Vite so that nothing which imports\n * this module needs Vite installed, and so the published types do not depend on\n * a particular version of it. It is structural: Vite accepts this object.\n */\nexport interface ViteProxyEntry {\n  target: string;\n  changeOrigin: boolean;\n  rewrite: (path: string) => string;\n}\n\nexport interface ViteAuthProxyOptions {\n  authHost: string;\n  basePath?: string;\n  paths?: readonly string[];\n}\n\n/**\n * The auth endpoints, proxied through a Vite dev server.\n *\n * ```ts\n * // vite.config.ts\n * server: { proxy: viteAuthProxy({ authHost: env.VITE_SB_AUTH_DOMAIN }) }\n * ```\n *\n * Vite already has a proxy; what it does not have is the knowledge of which\n * paths to carry and what to do with Host, and both of those are easy to get\n * wrong in ways that fail silently. So this is a config generator rather than a\n * request handler — `createAuthProxy` is for runtimes that have no proxy of\n * their own.\n *\n * Worth doing even where the browser would tolerate the cross-site setup,\n * because it is the same topology production runs on: a dev server that proxies\n * is rehearsing the deployment, and a dev server that does not is testing a\n * configuration no user will ever have. It is also the only way an embedded\n * sign-in flow works in Safari, which blocks third-party cookies outright.\n */\nexport function viteAuthProxy(\n  options: ViteAuthProxyOptions,\n): Record<string, ViteProxyEntry> {\n  const target = authOrigin(options.authHost);\n  const basePath = normaliseBasePath(options.basePath ?? DEFAULT_BASE_PATH);\n  const paths = options.paths ?? DEFAULT_FORWARDED_PATHS;\n\n  const proxy: Record<string, ViteProxyEntry> = {};\n\n  for (const prefix of paths) {\n    proxy[`${basePath}${prefix}`] = {\n      target,\n      // The single most important line, and the one a hand-written config\n      // leaves out. Without it the auth server is asked to answer as\n      // `localhost:5173` — a Host it has no project for — and the reply is a\n      // CORS refusal and an empty issuer rather than anything that says so.\n      changeOrigin: true,\n      // Only the base path comes off. The prefix below it is the path the auth\n      // server actually serves.\n      rewrite: (path: string) => (basePath ? path.replace(basePath, \"\") : path),\n    };\n  }\n\n  return proxy;\n}\n"],"names":["DEFAULT_FORWARDED_PATHS","DEFAULT_BASE_PATH","authOrigin","authHost","configured","loopback","scheme","url","normaliseBasePath","basePath","trimmed","isUnder","pathname","prefix","viteAuthProxy","options","target","paths","proxy","path"],"mappings":"AAiCO,MAAMA,IAA0B,CAAC,YAAY,SAAS,GAQhDC,IAAoB;AAe1B,SAASC,EAAWC,GAA0B;AACnD,QAAMC,KAAcD,KAAY,IAAI,KAAA;AAEpC,MAAI,CAACC;AACH,UAAM,IAAI,UAAU,sBAAsB;AAG5C,QAAMC,IAAW,6CAA6C;AAAA,IAC5DD,EAAW,QAAQ,iBAAiB,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,EAAA,GAGhDE,IAAS,gBAAgB,KAAKF,CAAU,IAAI,KAAK,GAAGC,IAAW,SAAS,OAAO;AAErF,MAAIE;AACJ,MAAI;AACF,IAAAA,IAAM,IAAI,IAAI,GAAGD,CAAM,GAAGF,CAAU,EAAE;AAAA,EACxC,QAAQ;AACN,UAAM,IAAI,UAAU,aAAaA,CAAU,kCAAkC;AAAA,EAC/E;AAEA,MAAIG,EAAI,aAAa,OAAOA,EAAI,UAAUA,EAAI;AAC5C,UAAM,IAAI;AAAA,MACR,aAAaH,CAAU;AAAA,IAAA;AAI3B,MAAIG,EAAI,aAAa,YAAY,CAACF;AAChC,UAAM,IAAI,UAAU,aAAaD,CAAU,kCAAkC;AAG/E,SAAOG,EAAI;AACb;AAYO,SAASC,EAAkBC,GAA0B;AAC1D,QAAMC,KAAWD,KAAY,IAAI,OAAO,QAAQ,QAAQ,EAAE;AAE1D,MAAIC,MAAY;AACd,WAAO;AAGT,MAAI,CAACA,EAAQ,WAAW,GAAG;AACzB,UAAM,IAAI,UAAU,aAAaD,CAAQ,uBAAuB;AAGlE,SAAOC;AACT;AAGO,SAASC,EAAQC,GAAkBC,GAAyB;AACjE,SAAOD,MAAaC,KAAUD,EAAS,WAAW,GAAGC,CAAM,GAAG;AAChE;ACtEO,SAASC,EACdC,GACgC;AAChC,QAAMC,IAASd,EAAWa,EAAQ,QAAQ,GACpCN,IAAWD,EAAkBO,EAAQ,YAAYd,CAAiB,GAClEgB,IAAQF,EAAQ,SAASf,GAEzBkB,IAAwC,CAAA;AAE9C,aAAWL,KAAUI;AACnB,IAAAC,EAAM,GAAGT,CAAQ,GAAGI,CAAM,EAAE,IAAI;AAAA,MAC9B,QAAAG;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,cAAc;AAAA;AAAA;AAAA,MAGd,SAAS,CAACG,MAAkBV,IAAWU,EAAK,QAAQV,GAAU,EAAE,IAAIU;AAAA,IAAA;AAIxE,SAAOD;AACT;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pontive/pontkit-loader",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "license": "MIT",
   "description": "Loads @pontive/pontkit-core from the CDN at the release the platform decides.",
   "type": "module",
@@ -12,6 +12,11 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
+    },
+    "./proxy": {
+      "types": "./dist/proxy/index.d.ts",
+      "import": "./dist/proxy.js",
+      "require": "./dist/proxy.cjs"
     }
   },
   "files": [