@shuttle.technology/authorization 0.0.0-stage → 0.1.0

package/dist/client.js

@@ -0,0 +1,754 @@
+import { AuthorizationError, ClientFlowError, canonicalDecimal, identityMethods, integer, newHandoffBinding, opaqueId, parseAuthorizationError, record, rfc3339Millis, } from "./auth.js";
+import { parseConfirmationChallenge, parseHostedIdentityFlow, parseIdentityFlowCallback, parseIdentityList, parseLocalOperationResult, parseOperationConfirmationCallback, parseOperationEnvelope, parsePasskeyBootstrapResult, parseVerifiedIdentityResult, validateLocalOperationCreate, } from "./slice4.js";
+import { StreamsReads } from "./streams.js";
+import { LinkedWallets } from "./linkedWallets.js";
+export { LinkedWallets, eventOfTransaction, isWalletLimitRefusal, resumeCursor, sendEvents, transferFinal, WalletLimitRefusals } from "./linkedWallets.js";
+import { parseUserWalletOperationEnvelope, parseWalletResult, validateUserWalletCreate, } from "./walletOperations.js";
+import { pageEnvelope, pageProjection, pageRequest } from "./pages.js";
+export { AuthorizationError, ClientFlowError } from "./auth.js";
+export { pollAuthoritative } from "./poll.js";
+export { MaxTransferCommentBytes, MaxWalletMessageBytes, ReplaceActions, transferComment, walletMaterialPurged } from "./walletOperations.js";
+export async function initializeAuthorizationClient(configuration, dependencies) {
+    validateConfiguration(configuration);
+    const crypto = dependencies.crypto ?? globalThis.crypto;
+    // The platform fetch must be called on its global: stored on the dependencies
+    // object and called from there, a browser rejects it as an illegal invocation.
+    const platformFetch = globalThis.fetch;
+    const fetch = dependencies.fetch ?? (typeof platformFetch === "function" ? ((url, init) => platformFetch.call(globalThis, url, init)) : undefined);
+    if (!crypto?.subtle || typeof crypto.getRandomValues !== "function" || typeof fetch !== "function")
+        throw new ClientFlowError("runtime_capability_unavailable");
+    let publicConfiguration;
+    if (configuration.channel === "web") {
+        const web = dependencies;
+        if (typeof web.currentOrigin !== "function" || web.currentOrigin() !== configuration.applicationOrigin || typeof web.openHosted !== "function") {
+            throw new ClientFlowError("origin_mismatch");
+        }
+        publicConfiguration = await readPublicConfiguration(configuration, fetch);
+    }
+    else {
+        const mobile = dependencies;
+        const bridge = mobile.browserBridge;
+        if (!mobile.secureStorage || !bridge || typeof bridge.verifyAssociatedRedirect !== "function" || typeof bridge.openSystemBrowser !== "function") {
+            throw new ClientFlowError("mobile_association_unverified");
+        }
+        let verification;
+        try {
+            verification = await bridge.verifyAssociatedRedirect({
+                redirectUri: configuration.redirectUri,
+                applicationIdentifier: configuration.mobileApplicationIdentifier,
+            });
+        }
+        catch {
+            throw new ClientFlowError("mobile_association_unverified");
+        }
+        if (!exactMobileAssociation(verification, configuration.redirectUri, configuration.mobileApplicationIdentifier)) {
+            throw new ClientFlowError("mobile_association_unverified");
+        }
+    }
+    const normalized = {
+        fetch,
+        crypto,
+        now: dependencies.now ?? Date.now,
+        launch: configuration.channel === "web"
+            ? async (url) => dependencies.openHosted(url)
+            : async (url) => { await dependencies.browserBridge.openSystemBrowser(url); },
+        secureStorage: configuration.channel === "mobile" ? dependencies.secureStorage : undefined,
+    };
+    return new AuthorizationClient(configuration, normalized, publicConfiguration);
+}
+export class AuthorizationClient {
+    capabilities;
+    publicConfiguration;
+    #configuration;
+    #dependencies;
+    #pending = new Map();
+    #identityFlows = new Map();
+    #confirmations = new Map();
+    #refreshKey;
+    #accessToken;
+    #csrfToken;
+    #session;
+    #refreshInFlight;
+    constructor(configuration, dependencies, publicConfiguration) {
+        this.#configuration = Object.freeze({ ...configuration, methods: Object.freeze([...configuration.methods]) });
+        this.#dependencies = dependencies;
+        this.publicConfiguration = publicConfiguration;
+        this.capabilities = Object.freeze({ mode: "mode_b", channel: configuration.channel, methods: Object.freeze([...configuration.methods]) });
+        this.#refreshKey = `authorization:${configuration.tenantId}:${configuration.applicationId}:${configuration.environmentId}:${configuration.publishableClientId}:refresh`;
+    }
+    get hasSession() { return this.#accessToken !== undefined; }
+    signup(method) { return this.#begin("signup", method); }
+    login(method) { return this.#begin("login", method); }
+    bootstrapPasskey(signal) {
+        return this.#beginIdentityFlow("bootstrap", "/v1/identity/passkey-bootstrap", undefined, signal);
+    }
+    verifyIdentity(method, signal) {
+        return this.#beginIdentityFlow("verification", "/v1/identity-verifications", method, signal);
+    }
+    async completePasskeyBootstrap(callbackUri, signal) {
+        const { callback, pending } = this.#identityFlowCallback(callbackUri, "bootstrap");
+        const authority = await this.#accessForWrite(signal);
+        const payload = await this.#json("/v1/identity/passkey-bootstrap/complete", {
+            method: "POST",
+            body: JSON.stringify({ client_id: this.#configuration.publishableClientId, flow_id: callback.flowId, code: callback.code, verifier: pending.verifier, redirect_uri: this.#configuration.redirectUri }),
+            accessToken: authority.token,
+            signal,
+        });
+        const result = parsePasskeyBootstrapResult(payload);
+        this.#identityFlows.delete(callback.flowId);
+        return result;
+    }
+    /** identities lists the account's own active sign-in methods; a passkey names its credential. */
+    async identities(signal) {
+        return parseIdentityList(await this.#protectedGet("/v1/identities", signal));
+    }
+    async completeIdentityVerification(callbackUri, signal) {
+        const { callback, pending } = this.#identityFlowCallback(callbackUri, "verification");
+        const authority = await this.#accessForWrite(signal);
+        const payload = await this.#json("/v1/identity-verifications/complete", {
+            method: "POST",
+            body: JSON.stringify({ client_id: this.#configuration.publishableClientId, flow_id: callback.flowId, code: callback.code, verifier: pending.verifier, redirect_uri: this.#configuration.redirectUri }),
+            accessToken: authority.token,
+            signal,
+        });
+        const result = parseVerifiedIdentityResult(payload, this.#dependencies.now());
+        this.#identityFlows.delete(callback.flowId);
+        return result;
+    }
+    async createOperation(create, idempotencyKey, signal) {
+        const authority = await this.#accessForWrite(signal);
+        if (!opaqueId(idempotencyKey))
+            throw new ClientFlowError("invalid_idempotency_key");
+        validateLocalOperationCreate(create, authority.session.accountId);
+        const payload = await this.#json("/v1/operations", {
+            method: "POST", body: JSON.stringify(create), accessToken: authority.token, idempotencyKey, signal,
+        });
+        return parseOperationEnvelope(payload).operation;
+    }
+    createIdentityLink(verifiedIdentityHandle, idempotencyKey, signal) {
+        const ownerId = this.#session?.accountId ?? "";
+        return this.createOperation({ kind: "identity.link", owner_type: "account", owner_id: ownerId, payload: { verified_identity_handle: verifiedIdentityHandle } }, idempotencyKey, signal);
+    }
+    createIdentityUnlink(identityId, idempotencyKey, signal) {
+        const ownerId = this.#session?.accountId ?? "";
+        return this.createOperation({ kind: "identity.unlink", owner_type: "account", owner_id: ownerId, payload: { identity_id: identityId } }, idempotencyKey, signal);
+    }
+    createSessionRevocation(sessionId, idempotencyKey, signal) {
+        const ownerId = this.#session?.accountId ?? "";
+        return this.createOperation({ kind: "session.revoke", owner_type: "account", owner_id: ownerId, payload: { session_id: sessionId } }, idempotencyKey, signal);
+    }
+    createServiceGrant(input, idempotencyKey, signal) {
+        const ownerId = this.#session?.accountId ?? "";
+        const payload = { service_principal_id: input.servicePrincipalId, enabled: input.enabled, scopes: [...input.scopes] };
+        if (input.externalRef !== undefined)
+            payload.external_ref = input.externalRef;
+        return this.createOperation({ kind: "service_grant.set", owner_type: "account", owner_id: ownerId, wallet_id: input.walletId, payload }, idempotencyKey, signal);
+    }
+    async operation(operationId, signal) {
+        if (!opaqueId(operationId))
+            throw new ClientFlowError("invalid_operation_id");
+        return parseOperationEnvelope(await this.#protectedGet(`/v1/operations/${encodeURIComponent(operationId)}`, signal)).operation;
+    }
+    async challengeOperation(operationId, credentialId, signal) {
+        if (!opaqueId(operationId) || !opaqueId(credentialId))
+            throw new ClientFlowError("invalid_confirmation_request");
+        const authority = await this.#accessForWrite(signal);
+        const binding = await newHandoffBinding(this.#dependencies.crypto);
+        const payload = await this.#json(`/v1/operations/${encodeURIComponent(operationId)}/challenge`, {
+            method: "POST",
+            body: JSON.stringify({ credential_id: credentialId, redirect_uri: this.#configuration.redirectUri, state: binding.state }),
+            accessToken: authority.token,
+            signal,
+        });
+        const challenge = parseConfirmationChallenge(payload, this.#dependencies.now());
+        const expiresAtMs = rfc3339Millis(challenge.expiresAt);
+        if (expiresAtMs === undefined)
+            throw new ClientFlowError("invalid_server_response");
+        this.#confirmations.set(operationId, { state: binding.state, operationId, expiresAtMs });
+        try {
+            await this.#dependencies.launch(challenge.confirmationLocation);
+        }
+        catch (error) {
+            this.#confirmations.delete(operationId);
+            throw error;
+        }
+        return challenge;
+    }
+    async completeOperationConfirmation(callbackUri, signal) {
+        const operationId = this.#acceptConfirmationCallback(callbackUri);
+        const operation = await this.operation(operationId, signal);
+        this.#confirmations.delete(operationId);
+        return operation;
+    }
+    /**
+     * createWalletOperation admits one Mode B wallet intent on POST /v1/operations.
+     * The closed body is validated locally against the current session account
+     * before the request leaves the client (source §1.3, §2.2).
+     */
+    async createWalletOperation(create, idempotencyKey, signal) {
+        const authority = await this.#accessForWrite(signal);
+        if (!opaqueId(idempotencyKey))
+            throw new ClientFlowError("invalid_idempotency_key");
+        validateUserWalletCreate(create, authority.session.accountId);
+        const payload = await this.#json("/v1/operations", {
+            method: "POST", body: JSON.stringify(create), accessToken: authority.token, idempotencyKey, signal,
+        });
+        return parseUserWalletOperationEnvelope(payload).operation;
+    }
+    createWallet(input, idempotencyKey, signal) {
+        return this.createWalletOperation({
+            kind: "wallet.create", owner_type: "account", owner_id: this.#session?.accountId ?? "",
+            payload: { network: input.network, recipient_public_key: input.recipientPublicKey },
+        }, idempotencyKey, signal);
+    }
+    signWithWallet(input, idempotencyKey, signal) {
+        return this.createWalletOperation({
+            kind: "wallet.sign", owner_type: "account", owner_id: this.#session?.accountId ?? "", wallet_id: input.walletId,
+            payload: { network: input.network, message_base64url: input.messageBase64url },
+        }, idempotencyKey, signal);
+    }
+    sendFromWallet(input, idempotencyKey, signal) {
+        return this.createWalletOperation({
+            kind: "wallet.send", owner_type: "account", owner_id: this.#session?.accountId ?? "", wallet_id: input.walletId,
+            payload: { network: input.network, asset: "native", recipient: input.recipient, amount_raw: input.amountRaw, max_fee_raw: input.maxFeeRaw },
+        }, idempotencyKey, signal);
+    }
+    exportWallet(input, idempotencyKey, signal) {
+        return this.createWalletOperation({
+            kind: "wallet.export", owner_type: "account", owner_id: this.#session?.accountId ?? "", wallet_id: input.walletId,
+            payload: { recipient_public_key: input.recipientPublicKey },
+        }, idempotencyKey, signal);
+    }
+    recoverWallet(input, idempotencyKey, signal) {
+        return this.createWalletOperation({
+            kind: "wallet.recover", owner_type: "account", owner_id: this.#session?.accountId ?? "", wallet_id: input.walletId,
+            payload: { expected_generation: input.expectedGeneration, recipient_public_key: input.recipientPublicKey },
+        }, idempotencyKey, signal);
+    }
+    /** walletOperation reads the safe wallet status on GET /v1/operations/{operation_id}. */
+    async walletOperation(operationId, signal) {
+        if (!opaqueId(operationId))
+            throw new ClientFlowError("invalid_operation_id");
+        return parseUserWalletOperationEnvelope(await this.#protectedGet(`/v1/operations/${encodeURIComponent(operationId)}`, signal)).operation;
+    }
+    /**
+     * challengeWalletOperation reuses the shared confirmation challenge route and
+     * pending-state bookkeeping; the wallet and local challenge contracts are the
+     * same closed response.
+     */
+    challengeWalletOperation(operationId, credentialId, signal) {
+        return this.challengeOperation(operationId, credentialId, signal);
+    }
+    async completeWalletOperationConfirmation(callbackUri, signal) {
+        const operationId = this.#acceptConfirmationCallback(callbackUri);
+        const operation = await this.walletOperation(operationId, signal);
+        this.#confirmations.delete(operationId);
+        return operation;
+    }
+    /**
+     * executeWalletOperation claims one confirmed wallet effect. The first claim
+     * answers 202 and an exact replay answers 200; both carry the same operation.
+     */
+    async executeWalletOperation(operationId, version, idempotencyKey, signal) {
+        if (!opaqueId(operationId) || !canonicalDecimal(version) || !opaqueId(idempotencyKey))
+            throw new ClientFlowError("invalid_execute_request");
+        const authority = await this.#accessForWrite(signal);
+        const payload = await this.#json(`/v1/operations/${encodeURIComponent(operationId)}/execute`, {
+            method: "POST", accessToken: authority.token, idempotencyKey, ifMatch: version, signal,
+        });
+        return parseUserWalletOperationEnvelope(payload).operation;
+    }
+    /** walletOperationResult reads the protected wallet output for its frozen recipient. */
+    async walletOperationResult(operationId, signal) {
+        if (!opaqueId(operationId))
+            throw new ClientFlowError("invalid_operation_id");
+        return parseWalletResult(await this.#protectedGet(`/v1/operations/${encodeURIComponent(operationId)}/result`, signal), operationId);
+    }
+    async executeOperation(operationId, version, idempotencyKey, signal) {
+        if (!opaqueId(operationId) || !canonicalDecimal(version) || !opaqueId(idempotencyKey))
+            throw new ClientFlowError("invalid_execute_request");
+        const authority = await this.#accessForWrite(signal);
+        const payload = await this.#json(`/v1/operations/${encodeURIComponent(operationId)}/execute`, {
+            method: "POST", accessToken: authority.token, idempotencyKey, ifMatch: version, signal,
+        });
+        return parseOperationEnvelope(payload).operation;
+    }
+    /** HTTP-only Auth-owned links and session-authorized Streams registration. */
+    linkedWallets() {
+        return new LinkedWallets({
+            get: (path, signal) => this.#protectedGet(path, signal),
+            stream: (path, signal) => this.#protectedStream(path, signal),
+            write: async (path, method, body, signal, idempotencyKey, version) => {
+                const authority = await this.#accessForWrite(signal);
+                const payload = await this.#json(path, { method, body: body === undefined ? undefined : JSON.stringify(body), accessToken: authority.token, signal, idempotencyKey, ifMatch: version });
+                return { payload, accountId: authority.session.accountId };
+            },
+            accountId: () => this.#session?.accountId ?? "",
+            now: () => this.#dependencies.now(),
+        });
+    }
+    /**
+     * streams binds the two authorized Streams reads of source §2.6 to this
+     * session's protected GET, so the account caller reuses the one access-token
+     * and refresh path. The read contract, its types and its bounds live in the
+     * `./streams` entry point, which this file deliberately does not re-export; a
+     * service caller constructs `StreamsReads` there with its own credentialed
+     * GET. The caller supplies the stable `idempotencyKey` in each read's options;
+     * it is forwarded unchanged on the original GET and any protected 401 retry.
+     */
+    streams() {
+        return new StreamsReads({ scope: "account", get: (path, signal, idempotencyKey) => this.#protectedGet(path, signal, idempotencyKey) });
+    }
+    async operationResult(operationId, signal) {
+        if (!opaqueId(operationId))
+            throw new ClientFlowError("invalid_operation_id");
+        return parseLocalOperationResult(await this.#protectedGet(`/v1/operations/${encodeURIComponent(operationId)}/result`, signal));
+    }
+    cancel(attemptId) {
+        this.#pending.delete(attemptId);
+        return "local_canceled";
+    }
+    async exchangeHandoff(callbackUri, signal) {
+        const callback = exactCallback(callbackUri, this.#configuration.redirectUri);
+        const attempt = this.#pending.get(callback.attemptId);
+        if (!attempt)
+            throw new ClientFlowError("unknown_attempt");
+        if (attempt.state !== callback.state)
+            throw new ClientFlowError("state_mismatch");
+        if (this.#dependencies.now() / 1_000 >= attempt.expiresAt) {
+            this.#pending.delete(callback.attemptId);
+            throw new ClientFlowError("attempt_expired");
+        }
+        const payload = await this.#json("/v1/auth/exchange", {
+            method: "POST",
+            body: JSON.stringify({
+                client_id: this.#configuration.publishableClientId,
+                attempt_id: callback.attemptId,
+                code: callback.code,
+                verifier: attempt.verifier,
+                redirect_uri: this.#configuration.redirectUri,
+            }),
+            signal,
+        });
+        const session = await this.#acceptSession(payload, true);
+        this.#pending.delete(callback.attemptId);
+        return session;
+    }
+    restoreSession(signal) { return this.#refresh(signal); }
+    refreshSession(signal) { return this.#refresh(signal); }
+    async logout(signal) {
+        const token = this.#accessToken;
+        const csrf = this.#csrfToken;
+        this.#accessToken = undefined;
+        this.#csrfToken = undefined;
+        this.#session = undefined;
+        try {
+            if (this.#dependencies.secureStorage)
+                await this.#dependencies.secureStorage.delete(this.#refreshKey);
+            if (!token || (this.#configuration.channel === "web" && !csrf))
+                return { localCleared: true, serverDisposition: "server_unconfirmed" };
+            const payload = await this.#json("/v1/auth/logout", {
+                method: "POST",
+                body: JSON.stringify({ client_id: this.#configuration.publishableClientId }),
+                accessToken: token,
+                csrfToken: csrf,
+                signal,
+            });
+            const result = record(payload, ["request_id", "server_disposition"]);
+            if (!opaqueId(result.request_id) || result.server_disposition !== "server_revoked")
+                throw new ClientFlowError("invalid_server_response");
+            return { localCleared: true, serverDisposition: "server_revoked" };
+        }
+        catch {
+            return { localCleared: true, serverDisposition: "server_unconfirmed" };
+        }
+    }
+    async me(signal) {
+        const payload = await this.#protectedGet("/v1/me", signal);
+        const root = record(payload, ["request_id", "account", "session_id", "server_time"]);
+        const account = record(root.account, ["account_id", "version", "setup_required"]);
+        if (!opaqueId(root.request_id) || !opaqueId(account.account_id) || !canonicalDecimal(account.version) || typeof account.setup_required !== "boolean" || !opaqueId(root.session_id) || !integer(root.server_time)) {
+            throw new ClientFlowError("invalid_server_response");
+        }
+        return { requestId: root.request_id, account: { accountId: account.account_id, version: account.version, setupRequired: account.setup_required }, sessionId: root.session_id, serverTime: root.server_time };
+    }
+    async sessions(input) {
+        const page = pageRequest("/v1/sessions", input);
+        const payload = await this.#protectedGet(page.path, page.signal);
+        const root = pageEnvelope(payload);
+        const items = root.items.map((value) => {
+            const item = record(value, ["session_id", "client_id", "state", "created_at", "expires_at", "current"]);
+            if (!opaqueId(item.session_id) || !opaqueId(item.client_id) || typeof item.state !== "string" || typeof item.created_at !== "string" || typeof item.expires_at !== "string" || typeof item.current !== "boolean")
+                throw new ClientFlowError("invalid_server_response");
+            return { sessionId: item.session_id, clientId: item.client_id, state: item.state, createdAt: item.created_at, expiresAt: item.expires_at, current: item.current };
+        });
+        return pageProjection(root.request_id, items, root.has_more, root.next_cursor);
+    }
+    async wallets(input) {
+        const page = pageRequest("/v1/wallets", input);
+        const payload = await this.#protectedGet(page.path, page.signal);
+        const root = pageEnvelope(payload);
+        const items = root.items.map((value) => {
+            const item = record(value, ["wallet_id", "network", "address", "state", "generation", "mapping_version"]);
+            if (!opaqueId(item.wallet_id) || typeof item.network !== "string" || typeof item.address !== "string" || typeof item.state !== "string" || !canonicalDecimal(item.generation) || !canonicalDecimal(item.mapping_version))
+                throw new ClientFlowError("invalid_server_response");
+            return { walletId: item.wallet_id, network: item.network, address: item.address, state: item.state, generation: item.generation, mappingVersion: item.mapping_version };
+        });
+        return pageProjection(root.request_id, items, root.has_more, root.next_cursor);
+    }
+    async #begin(intent, method) {
+        if (!identityMethods.includes(method) || !this.#configuration.methods.includes(method))
+            throw new ClientFlowError("method_unavailable");
+        const binding = await newHandoffBinding(this.#dependencies.crypto);
+        const payload = await this.#json("/v1/auth/attempts", {
+            method: "POST",
+            body: JSON.stringify({
+                client_id: this.#configuration.publishableClientId,
+                intent,
+                method,
+                redirect_uri: this.#configuration.redirectUri,
+                state: binding.state,
+                code_challenge: binding.challenge,
+                code_challenge_method: "S256",
+            }),
+        });
+        const root = record(payload, ["request_id", "attempt_id", "launch_url", "expires_at"]);
+        if (!opaqueId(root.request_id) || !opaqueId(root.attempt_id) || !httpsURL(root.launch_url) || !integer(root.expires_at) || root.expires_at <= this.#dependencies.now() / 1_000) {
+            throw new ClientFlowError("invalid_server_response");
+        }
+        const attempt = { requestId: root.request_id, attemptId: root.attempt_id, launchUrl: root.launch_url, expiresAt: root.expires_at };
+        this.#pending.set(attempt.attemptId, { state: binding.state, verifier: binding.verifier, expiresAt: attempt.expiresAt });
+        await this.#dependencies.launch(attempt.launchUrl);
+        return attempt;
+    }
+    async #beginIdentityFlow(kind, path, method, signal) {
+        if ((kind === "bootstrap" && !this.#configuration.methods.includes("passkey")) || (method !== undefined && (!identityMethods.includes(method) || !this.#configuration.methods.includes(method)))) {
+            throw new ClientFlowError("method_unavailable");
+        }
+        const authority = await this.#accessForWrite(signal);
+        const binding = await newHandoffBinding(this.#dependencies.crypto);
+        const body = {
+            client_id: this.#configuration.publishableClientId,
+            redirect_uri: this.#configuration.redirectUri,
+            state: binding.state,
+            code_challenge: binding.challenge,
+            code_challenge_method: "S256",
+        };
+        if (method !== undefined)
+            body.method = method;
+        const payload = await this.#json(path, { method: "POST", body: JSON.stringify(body), accessToken: authority.token, signal });
+        const flow = parseHostedIdentityFlow(payload, this.#dependencies.now());
+        this.#identityFlows.set(flow.flowId, { kind, state: binding.state, verifier: binding.verifier, expiresAt: flow.expiresAt });
+        try {
+            await this.#dependencies.launch(flow.launchUrl);
+        }
+        catch (error) {
+            this.#identityFlows.delete(flow.flowId);
+            throw error;
+        }
+        return flow;
+    }
+    #identityFlowCallback(callbackUri, expectedKind) {
+        const callback = parseIdentityFlowCallback(callbackUri, this.#configuration.redirectUri);
+        const pending = this.#identityFlows.get(callback.flowId);
+        if (!pending || pending.kind !== expectedKind)
+            throw new ClientFlowError("unknown_identity_flow");
+        if (pending.state !== callback.state)
+            throw new ClientFlowError("state_mismatch");
+        if (this.#dependencies.now() / 1_000 >= pending.expiresAt) {
+            this.#identityFlows.delete(callback.flowId);
+            throw new ClientFlowError("identity_flow_expired");
+        }
+        return { callback, pending };
+    }
+    /**
+     * #acceptConfirmationCallback applies the shared local confirmation checks:
+     * exact redirect, the in-memory state for that operation, and the challenge
+     * deadline. It never asserts a server disposition.
+     */
+    #acceptConfirmationCallback(callbackUri) {
+        const callback = parseOperationConfirmationCallback(callbackUri, this.#configuration.redirectUri);
+        const pending = this.#confirmations.get(callback.operationId);
+        if (!pending)
+            throw new ClientFlowError("unknown_confirmation");
+        if (pending.state !== callback.state)
+            throw new ClientFlowError("state_mismatch");
+        if (this.#dependencies.now() >= pending.expiresAtMs) {
+            this.#confirmations.delete(callback.operationId);
+            throw new ClientFlowError("confirmation_expired");
+        }
+        return callback.operationId;
+    }
+    async #accessForWrite(signal) {
+        if (!this.#accessToken || !this.#session)
+            throw new ClientFlowError("session_unavailable");
+        if (this.#dependencies.now() / 1_000 >= this.#session.accessExpiresAt)
+            await this.#refresh(signal);
+        if (!this.#accessToken || !this.#session)
+            throw new ClientFlowError("session_unavailable");
+        return { token: this.#accessToken, session: this.#session };
+    }
+    #refresh(signal) {
+        if (this.#refreshInFlight)
+            return this.#refreshInFlight;
+        const operation = this.#performRefresh(signal).finally(() => { this.#refreshInFlight = undefined; });
+        this.#refreshInFlight = operation;
+        return operation;
+    }
+    async #performRefresh(signal) {
+        if (this.#configuration.channel === "web") {
+            const binding = await newHandoffBinding(this.#dependencies.crypto);
+            const start = new URL("/v1/auth/restore", this.#configuration.authorizationOrigin);
+            start.searchParams.set("client_id", this.#configuration.publishableClientId);
+            start.searchParams.set("redirect_uri", this.#configuration.redirectUri);
+            start.searchParams.set("state", binding.state);
+            start.searchParams.set("code_challenge", binding.challenge);
+            start.searchParams.set("code_challenge_method", "S256");
+            const returned = await this.#dependencies.launch(start.toString());
+            if (typeof returned !== "string")
+                throw new ClientFlowError("restore_redirect_unavailable");
+            const handoff = exactRestoreCallback(returned, this.#configuration.redirectUri);
+            if (handoff.state !== binding.state)
+                throw new ClientFlowError("state_mismatch");
+            const payload = await this.#json("/v1/auth/restore", {
+                method: "POST",
+                body: JSON.stringify({
+                    client_id: this.#configuration.publishableClientId,
+                    restore_id: handoff.restoreId,
+                    code: handoff.code,
+                    verifier: binding.verifier,
+                    redirect_uri: this.#configuration.redirectUri,
+                }),
+                signal,
+            });
+            return this.#acceptSession(payload, false);
+        }
+        const refreshToken = await this.#dependencies.secureStorage?.get(this.#refreshKey);
+        if (!refreshToken)
+            throw new ClientFlowError("mobile_refresh_unavailable");
+        const payload = await this.#json("/v1/auth/refresh", {
+            method: "POST",
+            body: JSON.stringify({ client_id: this.#configuration.publishableClientId, refresh_token: refreshToken }),
+            signal,
+        });
+        return this.#acceptSession(payload, false);
+    }
+    async #acceptSession(payload, exchange) {
+        const channelField = this.#configuration.channel === "web" ? "csrf_token" : "refresh_token";
+        const required = ["request_id", "access_token", "expires_at", "account_id", "session_id", channelField];
+        if (exchange)
+            required.push("setup_required");
+        const root = record(payload, required);
+        if (!opaqueId(root.request_id) || typeof root.access_token !== "string" || root.access_token.length === 0 || !integer(root.expires_at) || !opaqueId(root.account_id) || !opaqueId(root.session_id) || (exchange && typeof root.setup_required !== "boolean") || typeof root[channelField] !== "string" || root[channelField].length === 0) {
+            throw new ClientFlowError("invalid_server_response");
+        }
+        const session = {
+            requestId: root.request_id,
+            accessExpiresAt: root.expires_at,
+            accountId: root.account_id,
+            sessionId: root.session_id,
+            setupRequired: exchange ? root.setup_required : this.#session?.setupRequired,
+        };
+        if (session.setupRequired === undefined)
+            delete session.setupRequired;
+        if (this.#configuration.channel === "web") {
+            this.#csrfToken = root.csrf_token;
+        }
+        else {
+            try {
+                await this.#dependencies.secureStorage?.set(this.#refreshKey, root.refresh_token);
+            }
+            catch {
+                try {
+                    await this.#dependencies.secureStorage?.delete(this.#refreshKey);
+                }
+                catch { /* fail closed locally */ }
+                this.#accessToken = undefined;
+                this.#session = undefined;
+                throw new ClientFlowError("secure_storage_unavailable");
+            }
+        }
+        this.#accessToken = root.access_token;
+        this.#session = session;
+        return { ...session };
+    }
+    async #protectedGet(path, signal, idempotencyKey) {
+        if (!this.#accessToken || !this.#session)
+            throw new ClientFlowError("session_unavailable");
+        if (this.#dependencies.now() / 1_000 >= this.#session.accessExpiresAt)
+            await this.#refresh(signal);
+        const attemptedToken = this.#accessToken;
+        try {
+            return await this.#json(path, { method: "GET", accessToken: attemptedToken, idempotencyKey, signal });
+        }
+        catch (error) {
+            if (!(error instanceof AuthorizationError) || error.status !== 401 || error.code !== "UNAUTHORIZED")
+                throw error;
+            if (this.#accessToken === attemptedToken)
+                await this.#refresh(signal);
+            return this.#json(path, { method: "GET", accessToken: this.#accessToken, idempotencyKey, signal });
+        }
+    }
+    /** Opens a long-lived answer with the session's access token, refreshed once if the server no longer takes it. */
+    async #protectedStream(path, signal) {
+        const open = (token) => this.#dependencies.fetch(`${this.#configuration.authorizationOrigin}${path}`, {
+            method: "GET", headers: { Accept: "text/event-stream", Authorization: `Bearer ${token}` },
+            credentials: this.#configuration.channel === "web" ? "include" : "omit", cache: "no-store", signal,
+        });
+        const first = await this.#accessForWrite(signal);
+        let response = await open(first.token);
+        if (response.status === 401) {
+            if (this.#accessToken === first.token)
+                await this.#refresh(signal);
+            response = await open((await this.#accessForWrite(signal)).token);
+        }
+        if (!response.ok)
+            throw parseAuthorizationError(await response.json(), response.status);
+        if (!response.body || !(response.headers?.get("content-type") ?? "").startsWith("text/event-stream"))
+            throw new ClientFlowError("invalid_server_response");
+        return response.body;
+    }
+    async #json(path, options) {
+        const headers = { Accept: "application/json" };
+        if (options.body !== undefined)
+            headers["Content-Type"] = "application/json";
+        if (options.accessToken)
+            headers.Authorization = `Bearer ${options.accessToken}`;
+        if (options.csrfToken)
+            headers["X-CSRF-Token"] = options.csrfToken;
+        if (options.idempotencyKey)
+            headers["Idempotency-Key"] = options.idempotencyKey;
+        if (options.ifMatch)
+            headers["If-Match"] = options.ifMatch;
+        const response = await this.#dependencies.fetch(`${this.#configuration.authorizationOrigin}${path}`, {
+            method: options.method,
+            headers,
+            body: options.body,
+            credentials: this.#configuration.channel === "web" ? "include" : "omit",
+            cache: "no-store",
+            signal: options.signal,
+        });
+        const payload = await response.json();
+        if (!response.ok)
+            throw parseAuthorizationError(payload, response.status);
+        return payload;
+    }
+}
+async function readPublicConfiguration(configuration, fetch) {
+    const response = await fetch(`${configuration.authorizationOrigin}/v1/public/clients/${encodeURIComponent(configuration.publishableClientId)}`, {
+        method: "GET",
+        headers: { Accept: "application/json" },
+        credentials: "omit",
+        cache: "no-store",
+    });
+    const payload = await response.json();
+    if (!response.ok)
+        throw parseAuthorizationError(payload, response.status);
+    const root = record(payload, ["request_id", "client"]);
+    const client = record(root.client, ["id", "name", "environment_id", "methods", "provider_origin", "rp_id", "redirects", "platform"]);
+    if (!opaqueId(root.request_id) || client.id !== configuration.publishableClientId || typeof client.name !== "string" || client.name.length < 1 || client.name.length > 128 || client.environment_id !== configuration.environmentId || !Array.isArray(client.methods) || client.methods.length < 1 || client.methods.length > identityMethods.length || !client.methods.every((method) => typeof method === "string" && identityMethods.includes(method)) || new Set(client.methods).size !== client.methods.length || !sameStrings(client.methods, configuration.methods) || client.provider_origin !== configuration.authorizationOrigin || typeof client.rp_id !== "string" || client.rp_id.length === 0 || !Array.isArray(client.redirects) || client.redirects.length < 1 || client.redirects.length > 20 || !client.redirects.every((redirect) => typeof redirect === "string" && exactHttpsRedirect(redirect)) || new Set(client.redirects).size !== client.redirects.length || !client.redirects.includes(configuration.redirectUri) || client.platform !== "web") {
+        throw new ClientFlowError("invalid_public_configuration");
+    }
+    return Object.freeze({
+        requestId: root.request_id,
+        id: client.id,
+        name: client.name,
+        environmentId: client.environment_id,
+        methods: Object.freeze([...client.methods]),
+        providerOrigin: client.provider_origin,
+        rpId: client.rp_id,
+        redirects: Object.freeze([...client.redirects]),
+        platform: client.platform,
+    });
+}
+function validateConfiguration(configuration) {
+    const allowedFields = ["applicationId", "applicationOrigin", "authorizationOrigin", "channel", "environmentId", "methods", "mobileApplicationIdentifier", "mode", "publishableClientId", "redirectUri", "tenantId"];
+    if (Object.keys(configuration).some((field) => !allowedFields.includes(field)))
+        throw new ClientFlowError("invalid_public_configuration");
+    if (configuration.mode !== "mode_b" || (configuration.channel !== "web" && configuration.channel !== "mobile") || !exactHttpsOrigin(configuration.authorizationOrigin) || !exactHttpsRedirect(configuration.redirectUri) || !opaqueId(configuration.publishableClientId) || !opaqueId(configuration.tenantId) || !opaqueId(configuration.applicationId) || !opaqueId(configuration.environmentId) || configuration.methods.length === 0 || new Set(configuration.methods).size !== configuration.methods.length || configuration.methods.some((method) => !identityMethods.includes(method))) {
+        throw new ClientFlowError("invalid_public_configuration");
+    }
+    if (configuration.channel === "web" && (!configuration.applicationOrigin || !exactHttpsOrigin(configuration.applicationOrigin) || configuration.mobileApplicationIdentifier !== undefined))
+        throw new ClientFlowError("invalid_public_configuration");
+    if (configuration.channel === "mobile" && (configuration.applicationOrigin !== undefined || !mobileApplicationIdentifier(configuration.mobileApplicationIdentifier)))
+        throw new ClientFlowError("invalid_public_configuration");
+}
+function mobileApplicationIdentifier(value) {
+    return typeof value === "string" && /^[A-Za-z0-9._-]{1,255}$/.test(value);
+}
+function exactMobileAssociation(value, redirectUri, applicationIdentifier) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const result = value;
+    return Object.keys(result).length === 3 && result.source === "os_verified_https_association" && result.redirectUri === redirectUri && result.applicationIdentifier === applicationIdentifier;
+}
+function exactHttpsOrigin(value) {
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === "https:" && parsed.username === "" && parsed.password === "" && parsed.pathname === "/" && parsed.search === "" && parsed.hash === "" && parsed.origin === value;
+    }
+    catch {
+        return false;
+    }
+}
+function exactHttpsRedirect(value) {
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === "https:" && parsed.username === "" && parsed.password === "" && parsed.search === "" && parsed.hash === "";
+    }
+    catch {
+        return false;
+    }
+}
+function httpsURL(value) {
+    if (typeof value !== "string")
+        return false;
+    try {
+        return new URL(value).protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+function exactCallback(value, expected) {
+    let callback;
+    try {
+        callback = new URL(value);
+    }
+    catch {
+        throw new ClientFlowError("invalid_callback");
+    }
+    const target = new URL(expected);
+    if (`${callback.origin}${callback.pathname}` !== `${target.origin}${target.pathname}` || callback.hash !== "" || callback.searchParams.size !== 3)
+        throw new ClientFlowError("invalid_callback");
+    const code = callback.searchParams.getAll("code");
+    const state = callback.searchParams.getAll("state");
+    const attemptId = callback.searchParams.getAll("attempt_id");
+    if (code.length !== 1 || state.length !== 1 || attemptId.length !== 1 || code[0] === "" || state[0] === "" || !opaqueId(attemptId[0]))
+        throw new ClientFlowError("invalid_callback");
+    return { code: code[0], state: state[0], attemptId: attemptId[0] };
+}
+function exactRestoreCallback(value, expected) {
+    let callback;
+    try {
+        callback = new URL(value);
+    }
+    catch {
+        throw new ClientFlowError("invalid_callback");
+    }
+    const target = new URL(expected);
+    if (`${callback.origin}${callback.pathname}` !== `${target.origin}${target.pathname}` || callback.hash !== "" || callback.searchParams.size !== 3)
+        throw new ClientFlowError("invalid_callback");
+    const code = callback.searchParams.getAll("code");
+    const state = callback.searchParams.getAll("state");
+    const restoreId = callback.searchParams.getAll("restore_id");
+    if (code.length !== 1 || state.length !== 1 || restoreId.length !== 1 || code[0] === "" || state[0] === "" || !opaqueId(restoreId[0]))
+        throw new ClientFlowError("invalid_callback");
+    return { code: code[0], state: state[0], restoreId: restoreId[0] };
+}
+function sameStrings(left, right) {
+    if (left.length !== right.length)
+        return false;
+    const expected = new Set(right);
+    return left.every((value) => typeof value === "string" && expected.has(value));
+}