@stackframe/stack 2.4.0 → 2.4.1

package/dist/esm/providers/component-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/providers/component-provider.tsx"],"sourcesContent":["'use client';\n\nimport React, { createContext, useContext } from 'react';\nimport { Button } from '../components-core/button';\nimport { Container } from '../components-core/container';\nimport { Separator } from '../components-core/separator';\nimport { Input } from '../components-core/input';\nimport { Link } from '../components-core/link';\nimport { Label } from '../components-core/label';\nimport { Text } from '../components-core/text';\nimport { Card, CardHeader, CardContent, CardFooter } from '../components-core/card';\nimport { Popover, PopoverTrigger, PopoverContent } from '../components-core/popover';\nimport { \n  DropdownMenu,\n  DropdownMenuTrigger,\n  DropdownMenuContent,\n  DropdownMenuItem,\n  DropdownMenuLabel,\n  DropdownMenuSeparator,\n} from '../components-core/dropdown';\nimport { Avatar, AvatarFallback, AvatarImage } from '../components-core/avatar';\nimport { Collapsible, CollapsibleTrigger, CollapsibleContent } from '../components-core/collapsible';\nimport { Tabs, TabsList, TabsContent, TabsTrigger } from '../components-core/tabs';\nimport { Skeleton } from '../components-core/skeleton';\n\nexport const Components = {\n  Input,\n  Button,\n  Container,\n  Separator,\n  Label,\n  Link,\n  Text,\n  Popover,\n  PopoverTrigger,\n  PopoverContent,\n  DropdownMenu,\n  DropdownMenuTrigger,\n  DropdownMenuContent,\n  DropdownMenuItem,\n  DropdownMenuLabel,\n  DropdownMenuSeparator,\n  Avatar,\n  AvatarFallback,\n  AvatarImage,\n  Collapsible,\n  CollapsibleTrigger,\n  CollapsibleContent,\n  Card,\n  CardHeader,\n  CardContent,\n  CardFooter,\n  Tabs,\n  TabsList,\n  TabsContent,\n  TabsTrigger,\n  Skeleton,\n} as const;\n\nexport type ComponentConfig = {\n  components?: Partial<typeof Components>,\n}\n\nconst ComponentContext = createContext<typeof Components | undefined>(undefined);\n\nexport function useComponents() {\n  const context = useContext(ComponentContext);\n  if (!context) {\n    throw new Error('Stack UI components must be used within a StackTheme');\n  }\n  return context;\n}\n\nexport function StackComponentProvider(props: { children?: React.ReactNode } & ComponentConfig) {\n  return (\n    <ComponentContext.Provider value={{ ...Components, ...props.components }}>\n      {props.children}\n    </ComponentContext.Provider>\n  );\n}\n"],"mappings":";;;AAEA,SAAgB,eAAe,kBAAkB;AACjD,SAAS,cAAc;AACvB,SAAS,iBAAiB;AAC1B,SAAS,iBAAiB;AAC1B,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,MAAM,YAAY,aAAa,kBAAkB;AAC1D,SAAS,SAAS,gBAAgB,sBAAsB;AACxD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,QAAQ,gBAAgB,mBAAmB;AACpD,SAAS,aAAa,oBAAoB,0BAA0B;AACpE,SAAS,MAAM,UAAU,aAAa,mBAAmB;AACzD,SAAS,gBAAgB;AAoDrB;AAlDG,IAAM,aAAa;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMA,IAAM,mBAAmB,cAA6C,MAAS;AAExE,SAAS,gBAAgB;AAC9B,QAAM,UAAU,WAAW,gBAAgB;AAC3C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAyD;AAC9F,SACE,oBAAC,iBAAiB,UAAjB,EAA0B,OAAO,EAAE,GAAG,YAAY,GAAG,MAAM,WAAW,GACpE,gBAAM,UACT;AAEJ;","names":[]}

package/dist/esm/providers/design-provider.js

@@ -34,3 +34,4 @@ export {
   StackDesignProvider,
   useDesign
 };
+//# sourceMappingURL=design-provider.js.map

package/dist/esm/providers/design-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/providers/design-provider.tsx"],"sourcesContent":["'use client';\n\nimport React from 'react';\nimport { createContext, useContext } from \"react\";\nimport { DEFAULT_COLORS } from '../utils/constants';\n\ntype Colors = {\n  primaryColor: string,\n  secondaryColor: string,\n  backgroundColor: string,\n  neutralColor: string,\n}\n\nexport type ColorPalette = {\n  light: Colors,\n  dark: Colors,\n};\n\ntype Breakpoints = {\n  xs: number,\n  sm: number,\n  md: number,\n  lg: number,\n  xl: number,\n};\n\ntype DesignContextValue = {\n  colors: ColorPalette,\n  breakpoints: Breakpoints,\n}\n\nexport type DesignConfig = {\n  colors?: Partial<ColorPalette>,\n  breakpoints?: Partial<Breakpoints>,\n}\n\nconst DesignContext = createContext<DesignContextValue | undefined>(undefined);\n\nconst defaultBreakpoints: Breakpoints = {\n  xs: 400,\n  sm: 600,\n  md: 900,\n  lg: 1200,\n  xl: 1536,\n};\n\nexport function StackDesignProvider(props: { children?: React.ReactNode } & DesignConfig) {\n  const designValue = {\n    colors: { \n      dark: { ...DEFAULT_COLORS.dark, ...props.colors?.dark }, \n      light: { ...DEFAULT_COLORS.light, ...props.colors?.light } \n    },\n    breakpoints: { ...defaultBreakpoints, ...props.breakpoints },\n  };\n\n  return (\n    <DesignContext.Provider value={designValue}>\n      {props.children}\n    </DesignContext.Provider> \n  );\n}\n\nexport function useDesign(): DesignContextValue {\n  const context = useContext(DesignContext);\n  if (!context) {\n    throw new Error(\"useDesign must be used within a StackTheme\");\n  }\n  return context;\n}\n"],"mappings":";;;AAGA,SAAS,eAAe,kBAAkB;AAC1C,SAAS,sBAAsB;AAoD3B;AApBJ,IAAM,gBAAgB,cAA8C,MAAS;AAE7E,IAAM,qBAAkC;AAAA,EACtC,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AACN;AAEO,SAAS,oBAAoB,OAAsD;AACxF,QAAM,cAAc;AAAA,IAClB,QAAQ;AAAA,MACN,MAAM,EAAE,GAAG,eAAe,MAAM,GAAG,MAAM,QAAQ,KAAK;AAAA,MACtD,OAAO,EAAE,GAAG,eAAe,OAAO,GAAG,MAAM,QAAQ,MAAM;AAAA,IAC3D;AAAA,IACA,aAAa,EAAE,GAAG,oBAAoB,GAAG,MAAM,YAAY;AAAA,EAC7D;AAEA,SACE,oBAAC,cAAc,UAAd,EAAuB,OAAO,aAC5B,gBAAM,UACT;AAEJ;AAEO,SAAS,YAAgC;AAC9C,QAAM,UAAU,WAAW,aAAa;AACxC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,SAAO;AACT;","names":[]}

package/dist/esm/providers/joy-provider.js

@@ -33,3 +33,4 @@ export {
   StackJoyTheme,
   defaultComponents
 };
+//# sourceMappingURL=joy-provider.js.map

package/dist/esm/providers/joy-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/providers/joy-provider.tsx"],"sourcesContent":["'use client';\n\nimport { StackTheme, ThemeConfig } from \"./theme-provider\";\nimport { useColorScheme } from \"@mui/joy\";\nimport { Button } from '../components-core-joy/button';\nimport { Input } from '../components-core-joy/input';\nimport { Text } from '../components-core-joy/text';\nimport { Separator } from '../components-core-joy/separator';\nimport { Tabs, TabsList, TabsTrigger, TabsContent } from '../components-core-joy/tabs';\n\nexport const defaultComponents = {\n  Button,\n  Input,\n  Text,\n  Separator,\n  Tabs,\n  TabsList,\n  TabsTrigger,\n  TabsContent,\n};\n\nexport function StackJoyTheme(props : { theme?: ThemeConfig, children?: React.ReactNode }) {\n  const mergedTheme = {\n    components: {\n      ...defaultComponents,\n      ...props.theme?.components,\n    },\n    ...props.theme,\n  };\n\n  return (\n    <StackTheme theme={mergedTheme}>\n      {props.children}\n    </StackTheme>\n  );\n}"],"mappings":";;;AAEA,SAAS,kBAA+B;AAExC,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,iBAAiB;AAC1B,SAAS,MAAM,UAAU,aAAa,mBAAmB;AAuBrD;AArBG,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,cAAc,OAA6D;AACzF,QAAM,cAAc;AAAA,IAClB,YAAY;AAAA,MACV,GAAG;AAAA,MACH,GAAG,MAAM,OAAO;AAAA,IAClB;AAAA,IACA,GAAG,MAAM;AAAA,EACX;AAEA,SACE,oBAAC,cAAW,OAAO,aAChB,gBAAM,UACT;AAEJ;","names":[]}

package/dist/esm/providers/stack-provider-client.js

@@ -29,3 +29,4 @@ export {
   StackProviderClient,
   UserSetter
 };
+//# sourceMappingURL=stack-provider-client.js.map

package/dist/esm/providers/stack-provider-client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/providers/stack-provider-client.tsx"],"sourcesContent":["\"use client\";\n\nimport { use, useEffect } from \"react\";\nimport { StackClientApp, StackClientAppJson, stackAppInternalsSymbol } from \"../lib/stack-app\";\nimport React from \"react\";\nimport { UserJson } from \"@stackframe/stack-shared\";\nimport { useStackApp } from \"..\";\n\nexport const StackContext = React.createContext<null | {\n  app: StackClientApp<true>,\n}>(null);\n\nexport function StackProviderClient(props: {\n  appJson: StackClientAppJson<true, string>,\n  children?: React.ReactNode,\n}) {\n  const appJson = props.appJson;\n  const app = StackClientApp[stackAppInternalsSymbol].fromClientJson(appJson);\n\n  if (process.env.NODE_ENV === \"development\") {\n    (globalThis as any).stackApp = app;\n  }\n  \n  return (\n    <StackContext.Provider value={{ app }}>\n      {props.children}\n    </StackContext.Provider>\n  );\n}\n\nexport function UserSetter(props: { userJsonPromise: Promise<UserJson | null> }) {\n  const app = useStackApp();\n  useEffect(() => {\n    const promise = (async () => await props.userJsonPromise)();  // there is a Next.js bug where Promises passed by server components return `undefined` as their `then` value, so wrap it in a normal promise\n    app[stackAppInternalsSymbol].setCurrentUser(promise);\n  }, []);\n  return null;\n}\n"],"mappings":";;;AAEA,SAAc,iBAAiB;AAC/B,SAAS,gBAAoC,+BAA+B;AAC5E,OAAO,WAAW;AAElB,SAAS,mBAAmB;AAkBxB;AAhBG,IAAM,eAAe,MAAM,cAE/B,IAAI;AAEA,SAAS,oBAAoB,OAGjC;AACD,QAAM,UAAU,MAAM;AACtB,QAAM,MAAM,eAAe,uBAAuB,EAAE,eAAe,OAAO;AAE1E,MAAI,QAAQ,IAAI,aAAa,eAAe;AAC1C,IAAC,WAAmB,WAAW;AAAA,EACjC;AAEA,SACE,oBAAC,aAAa,UAAb,EAAsB,OAAO,EAAE,IAAI,GACjC,gBAAM,UACT;AAEJ;AAEO,SAAS,WAAW,OAAsD;AAC/E,QAAM,MAAM,YAAY;AACxB,YAAU,MAAM;AACd,UAAM,WAAW,YAAY,MAAM,MAAM,iBAAiB;AAC1D,QAAI,uBAAuB,EAAE,eAAe,OAAO;AAAA,EACrD,GAAG,CAAC,CAAC;AACL,SAAO;AACT;","names":[]}

package/dist/esm/providers/stack-provider.js

@@ -19,3 +19,4 @@ function UserFetcher(props) {
 export {
   StackProvider as default
 };
+//# sourceMappingURL=stack-provider.js.map

package/dist/esm/providers/stack-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/providers/stack-provider.tsx"],"sourcesContent":["import React, { Suspense } from 'react';\nimport { StackClientApp, stackAppInternalsSymbol } from '../lib/stack-app';\nimport { StackProviderClient, UserSetter } from './stack-provider-client';\n\n\nexport default function StackProvider({\n  children,\n  app,\n}: {\n  children: React.ReactNode,\n  app: StackClientApp<true>,\n}) {\n  return (\n    <StackProviderClient appJson={app[stackAppInternalsSymbol].toClientJson()}>\n      <Suspense fallback={null}>\n        <UserFetcher app={app} />\n      </Suspense>\n      {children}\n    </StackProviderClient>\n  );\n}\n\nfunction UserFetcher(props: { app: StackClientApp<true> }) {\n  const userPromise = props.app.getUser().then((user) => user?.toJson() ?? null);\n  return <UserSetter userJsonPromise={userPromise} />;\n}\n"],"mappings":";AAAA,SAAgB,gBAAgB;AAChC,SAAyB,+BAA+B;AACxD,SAAS,qBAAqB,kBAAkB;AAW5C,SAEI,KAFJ;AARW,SAAR,cAA+B;AAAA,EACpC;AAAA,EACA;AACF,GAGG;AACD,SACE,qBAAC,uBAAoB,SAAS,IAAI,uBAAuB,EAAE,aAAa,GACtE;AAAA,wBAAC,YAAS,UAAU,MAClB,8BAAC,eAAY,KAAU,GACzB;AAAA,IACC;AAAA,KACH;AAEJ;AAEA,SAAS,YAAY,OAAsC;AACzD,QAAM,cAAc,MAAM,IAAI,QAAQ,EAAE,KAAK,CAAC,SAAS,MAAM,OAAO,KAAK,IAAI;AAC7E,SAAO,oBAAC,cAAW,iBAAiB,aAAa;AACnD;","names":[]}

package/dist/esm/providers/styled-components-registry.js

@@ -22,3 +22,4 @@ function StyledComponentsRegistry({
 export {
   StyledComponentsRegistry as default
 };
+//# sourceMappingURL=styled-components-registry.js.map

package/dist/esm/providers/styled-components-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/providers/styled-components-registry.tsx"],"sourcesContent":["'use client';\n \nimport React, { useState } from 'react';\nimport { useServerInsertedHTML } from 'next/navigation';\nimport { ServerStyleSheet, StyleSheetManager } from 'styled-components';\n \nexport default function StyledComponentsRegistry({\n  children,\n}: {\n  children: React.ReactNode,\n}) {\n  // Only create stylesheet once with lazy initial state\n  // x-ref: https://reactjs.org/docs/hooks-reference.html#lazy-initial-state\n  const [styledComponentsStyleSheet] = useState(() => new ServerStyleSheet());\n \n  useServerInsertedHTML(() => {\n    const styles = styledComponentsStyleSheet.getStyleElement();\n    styledComponentsStyleSheet.instance.clearTag();\n    return <>{styles}</>;\n  });\n \n  if (typeof window !== 'undefined') return <>{children}</>;\n \n  return (\n    <StyleSheetManager sheet={styledComponentsStyleSheet.instance}>\n      {children}\n    </StyleSheetManager>\n  );\n}"],"mappings":";;;AAEA,SAAgB,gBAAgB;AAChC,SAAS,6BAA6B;AACtC,SAAS,kBAAkB,yBAAyB;AAczC;AAZI,SAAR,yBAA0C;AAAA,EAC/C;AACF,GAEG;AAGD,QAAM,CAAC,0BAA0B,IAAI,SAAS,MAAM,IAAI,iBAAiB,CAAC;AAE1E,wBAAsB,MAAM;AAC1B,UAAM,SAAS,2BAA2B,gBAAgB;AAC1D,+BAA2B,SAAS,SAAS;AAC7C,WAAO,gCAAG,kBAAO;AAAA,EACnB,CAAC;AAED,MAAI,OAAO,WAAW;AAAa,WAAO,gCAAG,UAAS;AAEtD,SACE,oBAAC,qBAAkB,OAAO,2BAA2B,UAClD,UACH;AAEJ;","names":[]}

package/dist/esm/providers/theme-provider.js

@@ -20,3 +20,4 @@ function StackTheme({
 export {
   StackTheme
 };
+//# sourceMappingURL=theme-provider.js.map

package/dist/esm/providers/theme-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/providers/theme-provider.tsx"],"sourcesContent":["'use client';\n\nimport React from \"react\";\nimport { StackDesignProvider, DesignConfig } from \"./design-provider\";\nimport { StackComponentProvider, ComponentConfig } from \"./component-provider\";\nimport StyledComponentsRegistry from \"./styled-components-registry\";\nimport { BrowserScript } from \"../utils/browser-script\";\n\nexport type ThemeConfig = DesignConfig & ComponentConfig;\n\nexport function StackTheme({\n  theme,\n  children,\n} : { \n  children?: React.ReactNode,\n  theme?: DesignConfig & ComponentConfig,\n}) {\n  const componentProps = { components: theme?.components };\n\n  return (\n    <StyledComponentsRegistry>\n      <BrowserScript />\n      <StackDesignProvider {...theme}>\n        <StackComponentProvider {...componentProps}>\n          {children}\n        </StackComponentProvider>\n      </StackDesignProvider>\n    </StyledComponentsRegistry>\n  );\n}"],"mappings":";;;AAGA,SAAS,2BAAyC;AAClD,SAAS,8BAA+C;AACxD,OAAO,8BAA8B;AACrC,SAAS,qBAAqB;AAc1B,SACE,KADF;AAVG,SAAS,WAAW;AAAA,EACzB;AAAA,EACA;AACF,GAGG;AACD,QAAM,iBAAiB,EAAE,YAAY,OAAO,WAAW;AAEvD,SACE,qBAAC,4BACC;AAAA,wBAAC,iBAAc;AAAA,IACf,oBAAC,uBAAqB,GAAG,OACvB,8BAAC,0BAAwB,GAAG,gBACzB,UACH,GACF;AAAA,KACF;AAEJ;","names":[]}

package/dist/esm/utils/browser-script.js

@@ -23,3 +23,4 @@ function BrowserScript() {
 export {
   BrowserScript
 };
+//# sourceMappingURL=browser-script.js.map

package/dist/esm/utils/browser-script.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/browser-script.tsx"],"sourcesContent":["const script = () => {\n  const observer = new MutationObserver((mutations) => {\n    mutations.forEach((mutation) => {\n      if (mutation.attributeName === 'data-joy-color-scheme') {\n        const joyColorScheme = document.documentElement.getAttribute('data-joy-color-scheme');\n        if (!joyColorScheme) {\n          return;\n        }\n        document.documentElement.setAttribute('data-theme', joyColorScheme);\n      }\n    });\n  });\n\n  observer.observe(document.documentElement, {\n    attributes: true,\n    attributeFilter: ['data-joy-color-scheme'],\n  });\n};\n\nexport function BrowserScript() {\n  return (\n    <script dangerouslySetInnerHTML={{ __html: `(${script.toString()})()` }}/>\n  );\n}"],"mappings":";AAqBI;AArBJ,IAAM,SAAS,MAAM;AACnB,QAAM,WAAW,IAAI,iBAAiB,CAAC,cAAc;AACnD,cAAU,QAAQ,CAAC,aAAa;AAC9B,UAAI,SAAS,kBAAkB,yBAAyB;AACtD,cAAM,iBAAiB,SAAS,gBAAgB,aAAa,uBAAuB;AACpF,YAAI,CAAC,gBAAgB;AACnB;AAAA,QACF;AACA,iBAAS,gBAAgB,aAAa,cAAc,cAAc;AAAA,MACpE;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAED,WAAS,QAAQ,SAAS,iBAAiB;AAAA,IACzC,YAAY;AAAA,IACZ,iBAAiB,CAAC,uBAAuB;AAAA,EAC3C,CAAC;AACH;AAEO,SAAS,gBAAgB;AAC9B,SACE,oBAAC,YAAO,yBAAyB,EAAE,QAAQ,IAAI,OAAO,SAAS,CAAC,MAAM,GAAE;AAE5E;","names":[]}

package/dist/esm/utils/constants.js

@@ -32,3 +32,4 @@ export {
   SECONDARY_FONT_COLORS,
   SELECTED_BACKGROUND_COLORS
 };
+//# sourceMappingURL=constants.js.map

package/dist/esm/utils/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/constants.tsx"],"sourcesContent":["export const FONT_SIZES = {'xs': '0.75rem', 'sm': '0.875rem', 'md': '1rem', 'lg': '1.25rem', 'xl': '1.5rem'};\nexport const LINE_HEIGHTS = {'xs': '1rem', 'sm': '1.25rem', 'md': '1.5rem', 'lg': '1.75rem', 'xl': '2rem'};\nexport const FONT_FAMILY = 'ui-sans-serif, system-ui, sans-serif, \"Apple Color Emoji\", \"Segoe UI Emoji\", \"Segoe UI Symbol\", \"Noto Color Emoji\"';\nexport const PRIMARY_FONT_COLORS = { 'dark': 'white', 'light': 'black' };\nexport const SECONDARY_FONT_COLORS = { 'dark': '#a8a8a8', 'light': '#737373' };\nexport const SELECTED_BACKGROUND_COLORS = { 'dark': 'rgba(255, 255, 255, 0.1)', 'light': 'rgba(0, 0, 0, 0.04)' };\nexport const LINK_COLORS = { 'dark': '#fff', 'light': '#000' };\nexport const BORDER_RADIUS = '0.375rem';\nexport const DEFAULT_COLORS = ({\n  dark: {\n    primaryColor: '#570df8',\n    secondaryColor: '#404040',\n    backgroundColor: 'black',\n    neutralColor: '#27272a',\n  },\n  light: {\n    primaryColor: '#570df8',\n    secondaryColor: '#e0e0e0',\n    backgroundColor: 'white',\n    neutralColor: '#e4e4e7',\n  },\n} as const);"],"mappings":";AAAO,IAAM,aAAa,EAAC,MAAM,WAAW,MAAM,YAAY,MAAM,QAAQ,MAAM,WAAW,MAAM,SAAQ;AACpG,IAAM,eAAe,EAAC,MAAM,QAAQ,MAAM,WAAW,MAAM,UAAU,MAAM,WAAW,MAAM,OAAM;AAClG,IAAM,cAAc;AACpB,IAAM,sBAAsB,EAAE,QAAQ,SAAS,SAAS,QAAQ;AAChE,IAAM,wBAAwB,EAAE,QAAQ,WAAW,SAAS,UAAU;AACtE,IAAM,6BAA6B,EAAE,QAAQ,4BAA4B,SAAS,sBAAsB;AACxG,IAAM,cAAc,EAAE,QAAQ,QAAQ,SAAS,OAAO;AACtD,IAAM,gBAAgB;AACtB,IAAM,iBAAkB;AAAA,EAC7B,MAAM;AAAA,IACJ,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,cAAc;AAAA,EAChB;AAAA,EACA,OAAO;AAAA,IACL,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,cAAc;AAAA,EAChB;AACF;","names":[]}

package/dist/esm/utils/email.js

@@ -8,3 +8,4 @@ function validateEmail(email) {
 export {
   validateEmail
 };
+//# sourceMappingURL=email.js.map

package/dist/esm/utils/email.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/email.tsx"],"sourcesContent":["import * as yup from \"yup\";\n\nexport function validateEmail(email: string): boolean {\n  if (typeof email !== \"string\") throw new Error(\"Email must be a string\");\n  return yup.string().email().isValidSync(email);\n};\n"],"mappings":";AAAA,YAAY,SAAS;AAEd,SAAS,cAAc,OAAwB;AACpD,MAAI,OAAO,UAAU;AAAU,UAAM,IAAI,MAAM,wBAAwB;AACvE,SAAW,WAAO,EAAE,MAAM,EAAE,YAAY,KAAK;AAC/C;","names":[]}

package/dist/esm/utils/next.js

@@ -5,3 +5,4 @@ function isClient() {
 export {
   isClient
 };
+//# sourceMappingURL=next.js.map

package/dist/esm/utils/next.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/next.tsx"],"sourcesContent":["export function isClient() {\n  // TODO improve function name (could be confused because this may return false in client components during SSR)\n  return typeof window !== \"undefined\";\n}\n"],"mappings":";AAAO,SAAS,WAAW;AAEzB,SAAO,OAAO,WAAW;AAC3B;","names":[]}

package/dist/esm/utils/url.js

@@ -19,3 +19,4 @@ export {
   autoRedirect,
   constructRedirectUrl
 };
+//# sourceMappingURL=url.js.map

package/dist/esm/utils/url.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/url.tsx"],"sourcesContent":["export function autoRedirect() {\n  const url = new URL(window.location.href);\n  const redirectUrl = url.searchParams.get(\"auto-redirect-url\");\n  if (redirectUrl) {\n    const urlObject = new URL(redirectUrl);\n    if (urlObject.origin !== window.location.origin) {\n      throw new Error(\"auto-redirect-url is not same origin (\" + urlObject.origin + \" !== \" + window.location.origin + \")\");\n    }\n    url.searchParams.delete(\"auto-redirect-url\");\n    window.location.replace(urlObject.href);\n  }\n}\n\nexport function constructRedirectUrl(redirectUrl: URL | string | undefined) {\n  const url = redirectUrl ? new URL(redirectUrl, window.location.href) : new URL(window.location.href);\n  return url.href.split(\"#\")[0];\n}\n"],"mappings":";AAAO,SAAS,eAAe;AAC7B,QAAM,MAAM,IAAI,IAAI,OAAO,SAAS,IAAI;AACxC,QAAM,cAAc,IAAI,aAAa,IAAI,mBAAmB;AAC5D,MAAI,aAAa;AACf,UAAM,YAAY,IAAI,IAAI,WAAW;AACrC,QAAI,UAAU,WAAW,OAAO,SAAS,QAAQ;AAC/C,YAAM,IAAI,MAAM,2CAA2C,UAAU,SAAS,UAAU,OAAO,SAAS,SAAS,GAAG;AAAA,IACtH;AACA,QAAI,aAAa,OAAO,mBAAmB;AAC3C,WAAO,SAAS,QAAQ,UAAU,IAAI;AAAA,EACxC;AACF;AAEO,SAAS,qBAAqB,aAAuC;AAC1E,QAAM,MAAM,cAAc,IAAI,IAAI,aAAa,OAAO,SAAS,IAAI,IAAI,IAAI,IAAI,OAAO,SAAS,IAAI;AACnG,SAAO,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC;AAC9B;","names":[]}

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 export { default as StackProvider } from './providers/stack-provider.mjs';
 export { useStackApp, useUser } from './lib/hooks.mjs';
-export { ApiKeySet, ApiKeySetFirstView, CurrentUser, Project, ServerUser, StackAdminApp, StackClientApp, StackServerApp } from './lib/stack-app.mjs';
+export { ApiKeySet, ApiKeySetFirstView, CurrentUser, ServerPermission as Permission, Project, ServerPermission, ServerTeam, ServerTeamMember, ServerUser, StackAdminApp, StackClientApp, StackServerApp, Team, TeamMember } from './lib/stack-app.mjs';
 export { default as StackHandler } from './components-page/stack-handler.mjs';
 export { default as SignIn } from './components-page/sign-in.mjs';
 export { default as SignUp } from './components-page/sign-up.mjs';
@@ -25,6 +25,7 @@ import '@stackframe/stack-shared';
 import '@stackframe/stack-shared/dist/interface/clientInterface';
 import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/interface/adminInterface';
+import '@stackframe/stack-shared/dist/interface/serverInterface';
 import '@radix-ui/react-tabs';
 import '@radix-ui/react-collapsible';
 import '@radix-ui/react-avatar';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { default as StackProvider } from './providers/stack-provider.js';
 export { useStackApp, useUser } from './lib/hooks.js';
-export { ApiKeySet, ApiKeySetFirstView, CurrentUser, Project, ServerUser, StackAdminApp, StackClientApp, StackServerApp } from './lib/stack-app.js';
+export { ApiKeySet, ApiKeySetFirstView, CurrentUser, ServerPermission as Permission, Project, ServerPermission, ServerTeam, ServerTeamMember, ServerUser, StackAdminApp, StackClientApp, StackServerApp, Team, TeamMember } from './lib/stack-app.js';
 export { default as StackHandler } from './components-page/stack-handler.js';
 export { default as SignIn } from './components-page/sign-in.js';
 export { default as SignUp } from './components-page/sign-up.js';
@@ -25,6 +25,7 @@ import '@stackframe/stack-shared';
 import '@stackframe/stack-shared/dist/interface/clientInterface';
 import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/interface/adminInterface';
+import '@stackframe/stack-shared/dist/interface/serverInterface';
 import '@radix-ui/react-tabs';
 import '@radix-ui/react-collapsible';
 import '@radix-ui/react-avatar';

package/dist/index.js

@@ -104,3 +104,4 @@ __reExport(src_exports, require("./components-core"), module.exports);
   useUser,
   ...require("./components-core")
 });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.tsx"],"sourcesContent":["export { default as StackProvider } from \"./providers/stack-provider\";\n\nexport { useUser, useStackApp } from \"./lib/hooks\";\nexport { StackClientApp, StackServerApp, StackAdminApp } from \"./lib/stack-app\";\n\nexport { default as StackHandler } from \"./components-page/stack-handler\";\nexport { default as SignIn } from \"./components-page/sign-in\";\nexport { default as SignUp } from \"./components-page/sign-up\";\nexport { default as EmailVerification } from \"./components-page/email-verification\";\nexport { default as PasswordReset } from \"./components-page/password-reset\";\nexport { default as ForgotPassword } from \"./components-page/forgot-password\";\nexport { default as MessageCard } from \"./components/message-card\";\n\nexport { default as CredentialSignIn } from \"./components/credential-sign-in\";\nexport { default as CredentialSignUp } from \"./components/credential-sign-up\";\nexport { default as OAuthButton } from \"./components/oauth-button\";\nexport { default as OAuthGroup } from \"./components/oauth-group\";\nexport { default as PasswordField } from \"./components/password-field\";\nexport { default as UserButton } from \"./components/user-button\";\nexport { default as AccountSettings } from \"./components-page/account-settings\";\n\nexport { useDesign } from './providers/design-provider';\nexport type { ColorPalette } from './providers/design-provider';\nexport { useComponents } from './providers/component-provider';\nexport { StackTheme } from './providers/theme-provider';\nexport type { ThemeConfig } from './providers/theme-provider';\n\nexport type { \n  CurrentUser, \n  Project, \n  ServerUser as ServerUser, \n  ApiKeySetFirstView, \n  ApiKeySet, \n  ServerTeam, \n  Team, \n  TeamMember,\n  ServerTeamMember,\n  ServerPermission as Permission,\n  ServerPermission,\n} from './lib/stack-app';\n\nexport * from './components-core';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAyC;AAEzC,mBAAqC;AACrC,uBAA8D;AAE9D,2BAAwC;AACxC,qBAAkC;AAClC,qBAAkC;AAClC,gCAA6C;AAC7C,4BAAyC;AACzC,6BAA0C;AAC1C,0BAAuC;AAEvC,gCAA4C;AAC5C,gCAA4C;AAC5C,0BAAuC;AACvC,yBAAsC;AACtC,4BAAyC;AACzC,yBAAsC;AACtC,8BAA2C;AAE3C,6BAA0B;AAE1B,gCAA8B;AAC9B,4BAA2B;AAiB3B,wBAAc,8BAzCd;","names":[]}

package/dist/joy.js

@@ -28,3 +28,4 @@ var import_joy_provider = require("./providers/joy-provider");
 0 && (module.exports = {
   StackJoyTheme
 });
+//# sourceMappingURL=joy.js.map

package/dist/joy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/joy.tsx"],"sourcesContent":["export { StackJoyTheme } from './providers/joy-provider';"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAA8B;","names":[]}

package/dist/lib/auth.js

@@ -86,3 +86,4 @@ async function callOAuthCallback(iface, tokenStore, redirectUrl) {
   callOAuthCallback,
   signInWithOAuth
 });
+//# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/auth.ts"],"sourcesContent":["import { StackClientInterface } from \"@stackframe/stack-shared\";\nimport { saveVerifierAndState, getVerifierAndState } from \"./cookie\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { TokenStore } from \"@stackframe/stack-shared/dist/interface/clientInterface\";\nimport { neverResolve, wait } from \"@stackframe/stack-shared/dist/utils/promises\";\nimport { StackAssertionError } from \"@stackframe/stack-shared/dist/utils/errors\";\n\nexport async function signInWithOAuth(\n  iface: StackClientInterface,\n  {\n    provider,\n    redirectUrl,\n  } : { \n    provider: string,\n    redirectUrl?: string,\n  }\n) {\n  redirectUrl = constructRedirectUrl(redirectUrl);\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl(\n    provider,\n    redirectUrl,\n    codeChallenge,\n    state,\n  );\n  window.location.assign(location);\n  await neverResolve();\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n * \n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\nfunction consumeOAuthCallbackQueryParams(expectedState: string): null | URL {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      return null;\n    }\n  }\n\n  if (expectedState !== originalUrl.searchParams.get(\"state\")) {\n    // If the state doesn't match, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return originalUrl; \n}\n\nexport async function callOAuthCallback(\n  iface: StackClientInterface,\n  tokenStore: TokenStore,\n  redirectUrl: string,\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const { codeVerifier, state } = getVerifierAndState();\n  if (!codeVerifier || !state) {\n    throw new Error(\"Invalid OAuth callback URL parameters. It seems like the OAuth flow was interrupted, so please try again.\");\n  }\n  const originalUrl = consumeOAuthCallbackQueryParams(state);\n  if (!originalUrl) return null;\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback)\n  try {\n    return await iface.callOAuthCallback(\n      originalUrl.searchParams,\n      constructRedirectUrl(redirectUrl),\n      codeVerifier,\n      state,\n      tokenStore,\n    );\n  } catch (e) {\n    throw new StackAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,oBAA0D;AAC1D,iBAAqC;AAErC,sBAAmC;AACnC,oBAAoC;AAEpC,eAAsB,gBACpB,OACA;AAAA,EACE;AAAA,EACA;AACF,GAIA;AACA,oBAAc,iCAAqB,WAAW;AAC9C,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAOA,SAAS,gCAAgC,eAAmC;AAC1E,QAAM,iBAAiB,CAAC,QAAQ,OAAO;AACvC,QAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;AAChD,aAAW,SAAS,gBAAgB;AAClC,QAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;AACxC,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,kBAAkB,YAAY,aAAa,IAAI,OAAO,GAAG;AAG3D,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,IAAI,IAAI,WAAW;AAClC,aAAW,SAAS,gBAAgB;AAClC,WAAO,aAAa,OAAO,KAAK;AAAA,EAClC;AAQA,SAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AAErD,SAAO;AACT;AAEA,eAAsB,kBACpB,OACA,YACA,aACA;AAIA,QAAM,EAAE,cAAc,MAAM,QAAI,mCAAoB;AACpD,MAAI,CAAC,gBAAgB,CAAC,OAAO;AAC3B,UAAM,IAAI,MAAM,2GAA2G;AAAA,EAC7H;AACA,QAAM,cAAc,gCAAgC,KAAK;AACzD,MAAI,CAAC;AAAa,WAAO;AAIzB,MAAI;AACF,WAAO,MAAM,MAAM;AAAA,MACjB,YAAY;AAAA,UACZ,iCAAqB,WAAW;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AACV,UAAM,IAAI,kCAAoB,6DAA6D,EAAE,OAAO,EAAE,CAAC;AAAA,EACzG;AACF;","names":[]}

package/dist/lib/cookie.js

@@ -168,14 +168,14 @@ var expectNoState = Symbol();
 
 // src/lib/cookie.ts
 var import_js_cookie = __toESM(require("js-cookie"));
-var import_stack_sc = require("@stackframe/stack-sc");
+var import_force_server = require("@stackframe/stack-sc/force-server");
 function isRscCookieUnavailableError(e) {
   const allowedMessageSnippets = ["was called outside a request scope", "cookies() expects to have requestAsyncStorage"];
   return typeof e?.message === "string" && allowedMessageSnippets.some((msg) => e.message.includes(msg));
 }
 function getCookie(name) {
   try {
-    return (0, import_stack_sc.cookies)().get(name)?.value ?? null;
+    return (0, import_force_server.cookies)().get(name)?.value ?? null;
   } catch (e) {
     if (isRscCookieUnavailableError(e)) {
       return import_js_cookie.default.get(name) ?? null;
@@ -193,7 +193,7 @@ function setOrDeleteCookie(name, value, options = {}) {
 }
 function deleteCookie(name) {
   try {
-    (0, import_stack_sc.cookies)().delete(name);
+    (0, import_force_server.cookies)().delete(name);
   } catch (e) {
     if (isRscCookieUnavailableError(e)) {
       import_js_cookie.default.remove(name);
@@ -204,7 +204,7 @@ function deleteCookie(name) {
 }
 function setCookie(name, value, options = {}) {
   try {
-    (0, import_stack_sc.cookies)().set(name, value, {
+    (0, import_force_server.cookies)().set(name, value, {
       maxAge: options.maxAge
     });
   } catch (e) {
@@ -246,3 +246,4 @@ function getVerifierAndState() {
   setCookie,
   setOrDeleteCookie
 });
+//# sourceMappingURL=cookie.js.map

package/dist/lib/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/cookie.ts","../../../../node_modules/.pnpm/oauth4webapi@2.10.3/node_modules/oauth4webapi/build/index.js"],"sourcesContent":["import { generateRandomCodeVerifier, generateRandomState, calculatePKCECodeChallenge } from \"oauth4webapi\";\nimport Cookies from \"js-cookie\";\nimport { cookies as rscCookies } from '@stackframe/stack-sc/force-server';\n\ntype SetCookieOptions = { maxAge?: number };\n\nfunction isRscCookieUnavailableError(e: any) {\n  const allowedMessageSnippets = [\"was called outside a request scope\", \"cookies() expects to have requestAsyncStorage\"];\n  return typeof e?.message === \"string\" && allowedMessageSnippets.some(msg => e.message.includes(msg));\n}\n\nexport function getCookie(name: string): string | null {\n  try {\n    return rscCookies().get(name)?.value ?? null;\n  } catch (e: any) {\n    if (isRscCookieUnavailableError(e)) {\n      return Cookies.get(name) ?? null;\n    } else {\n      throw e;\n    }\n  }\n}\n\nexport function setOrDeleteCookie(name: string, value: string | null, options: SetCookieOptions = {}) {\n  if (value === null) {\n    deleteCookie(name);\n  } else {\n    setCookie(name, value, options);\n  }\n}\n\nexport function deleteCookie(name: string) {\n  try {\n    rscCookies().delete(name);\n  } catch (e: any) {\n    if (isRscCookieUnavailableError(e)) {\n      Cookies.remove(name);\n    } else {\n      throw e;\n    }\n  }\n}\n\nexport function setCookie(name: string, value: string, options: SetCookieOptions = {}) {\n  try {\n    rscCookies().set(name, value, {\n      maxAge: options.maxAge,\n    });\n  } catch (e: any) {\n    if (isRscCookieUnavailableError(e)) {\n      Cookies.set(name, value, {\n        secure: window.location.protocol === \"https:\",\n        expires: options.maxAge === undefined ? undefined : new Date(Date.now() + (options.maxAge) * 1000),\n      });\n    } else {\n      throw e;\n    }\n  }\n}\n\nexport async function saveVerifierAndState() {\n  const codeVerifier = generateRandomCodeVerifier();\n  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);\n  const state = generateRandomState();\n\n  setCookie(\"stack-code-verifier\", codeVerifier, { maxAge: 60 * 10 });\n  setCookie(\"stack-state\", state, { maxAge: 60 * 10 });\n\n  return {\n    codeChallenge,\n    state,\n  };\n}\n\nexport function getVerifierAndState() {\n  const codeVerifier = getCookie(\"stack-code-verifier\");\n  const state = getCookie(\"stack-state\");\n  return {\n    codeVerifier,\n    state,\n  };\n}\n","let USER_AGENT;\nif (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {\n    const NAME = 'oauth4webapi';\n    const VERSION = 'v2.10.3';\n    USER_AGENT = `${NAME}/${VERSION}`;\n}\nfunction looseInstanceOf(input, expected) {\n    if (input == null) {\n        return false;\n    }\n    try {\n        return (input instanceof expected ||\n            Object.getPrototypeOf(input)[Symbol.toStringTag] === expected.prototype[Symbol.toStringTag]);\n    }\n    catch {\n        return false;\n    }\n}\nexport const clockSkew = Symbol();\nexport const clockTolerance = Symbol();\nexport const customFetch = Symbol();\nexport const useMtlsAlias = Symbol();\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\nfunction buf(input) {\n    if (typeof input === 'string') {\n        return encoder.encode(input);\n    }\n    return decoder.decode(input);\n}\nconst CHUNK_SIZE = 0x8000;\nfunction encodeBase64Url(input) {\n    if (input instanceof ArrayBuffer) {\n        input = new Uint8Array(input);\n    }\n    const arr = [];\n    for (let i = 0; i < input.byteLength; i += CHUNK_SIZE) {\n        arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n    }\n    return btoa(arr.join('')).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\nfunction decodeBase64Url(input) {\n    try {\n        const binary = atob(input.replace(/-/g, '+').replace(/_/g, '/').replace(/\\s/g, ''));\n        const bytes = new Uint8Array(binary.length);\n        for (let i = 0; i < binary.length; i++) {\n            bytes[i] = binary.charCodeAt(i);\n        }\n        return bytes;\n    }\n    catch (cause) {\n        throw new OPE('The input to be decoded is not correctly encoded.', { cause });\n    }\n}\nfunction b64u(input) {\n    if (typeof input === 'string') {\n        return decodeBase64Url(input);\n    }\n    return encodeBase64Url(input);\n}\nclass LRU {\n    constructor(maxSize) {\n        this.cache = new Map();\n        this._cache = new Map();\n        this.maxSize = maxSize;\n    }\n    get(key) {\n        let v = this.cache.get(key);\n        if (v) {\n            return v;\n        }\n        if ((v = this._cache.get(key))) {\n            this.update(key, v);\n            return v;\n        }\n        return undefined;\n    }\n    has(key) {\n        return this.cache.has(key) || this._cache.has(key);\n    }\n    set(key, value) {\n        if (this.cache.has(key)) {\n            this.cache.set(key, value);\n        }\n        else {\n            this.update(key, value);\n        }\n        return this;\n    }\n    delete(key) {\n        if (this.cache.has(key)) {\n            return this.cache.delete(key);\n        }\n        if (this._cache.has(key)) {\n            return this._cache.delete(key);\n        }\n        return false;\n    }\n    update(key, value) {\n        this.cache.set(key, value);\n        if (this.cache.size >= this.maxSize) {\n            this._cache = this.cache;\n            this.cache = new Map();\n        }\n    }\n}\nexport class UnsupportedOperationError extends Error {\n    constructor(message) {\n        super(message ?? 'operation not supported');\n        this.name = this.constructor.name;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class OperationProcessingError extends Error {\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nconst OPE = OperationProcessingError;\nconst dpopNonces = new LRU(100);\nfunction isCryptoKey(key) {\n    return key instanceof CryptoKey;\n}\nfunction isPrivateKey(key) {\n    return isCryptoKey(key) && key.type === 'private';\n}\nfunction isPublicKey(key) {\n    return isCryptoKey(key) && key.type === 'public';\n}\nconst SUPPORTED_JWS_ALGS = [\n    'PS256',\n    'ES256',\n    'RS256',\n    'PS384',\n    'ES384',\n    'RS384',\n    'PS512',\n    'ES512',\n    'RS512',\n    'EdDSA',\n];\nfunction processDpopNonce(response) {\n    try {\n        const nonce = response.headers.get('dpop-nonce');\n        if (nonce) {\n            dpopNonces.set(new URL(response.url).origin, nonce);\n        }\n    }\n    catch { }\n    return response;\n}\nfunction normalizeTyp(value) {\n    return value.toLowerCase().replace(/^application\\//, '');\n}\nfunction isJsonObject(input) {\n    if (input === null || typeof input !== 'object' || Array.isArray(input)) {\n        return false;\n    }\n    return true;\n}\nfunction prepareHeaders(input) {\n    if (looseInstanceOf(input, Headers)) {\n        input = Object.fromEntries(input.entries());\n    }\n    const headers = new Headers(input);\n    if (USER_AGENT && !headers.has('user-agent')) {\n        headers.set('user-agent', USER_AGENT);\n    }\n    if (headers.has('authorization')) {\n        throw new TypeError('\"options.headers\" must not include the \"authorization\" header name');\n    }\n    if (headers.has('dpop')) {\n        throw new TypeError('\"options.headers\" must not include the \"dpop\" header name');\n    }\n    return headers;\n}\nfunction signal(value) {\n    if (typeof value === 'function') {\n        value = value();\n    }\n    if (!(value instanceof AbortSignal)) {\n        throw new TypeError('\"options.signal\" must return or be an instance of AbortSignal');\n    }\n    return value;\n}\nexport async function discoveryRequest(issuerIdentifier, options) {\n    if (!(issuerIdentifier instanceof URL)) {\n        throw new TypeError('\"issuerIdentifier\" must be an instance of URL');\n    }\n    if (issuerIdentifier.protocol !== 'https:' && issuerIdentifier.protocol !== 'http:') {\n        throw new TypeError('\"issuer.protocol\" must be \"https:\" or \"http:\"');\n    }\n    const url = new URL(issuerIdentifier.href);\n    switch (options?.algorithm) {\n        case undefined:\n        case 'oidc':\n            url.pathname = `${url.pathname}/.well-known/openid-configuration`.replace('//', '/');\n            break;\n        case 'oauth2':\n            if (url.pathname === '/') {\n                url.pathname = '.well-known/oauth-authorization-server';\n            }\n            else {\n                url.pathname = `.well-known/oauth-authorization-server/${url.pathname}`.replace('//', '/');\n            }\n            break;\n        default:\n            throw new TypeError('\"options.algorithm\" must be \"oidc\" (default), or \"oauth2\"');\n    }\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    return (options?.[customFetch] || fetch)(url.href, {\n        headers: Object.fromEntries(headers.entries()),\n        method: 'GET',\n        redirect: 'manual',\n        signal: options?.signal ? signal(options.signal) : null,\n    }).then(processDpopNonce);\n}\nfunction validateString(input) {\n    return typeof input === 'string' && input.length !== 0;\n}\nexport async function processDiscoveryResponse(expectedIssuerIdentifier, response) {\n    if (!(expectedIssuerIdentifier instanceof URL)) {\n        throw new TypeError('\"expectedIssuer\" must be an instance of URL');\n    }\n    if (!looseInstanceOf(response, Response)) {\n        throw new TypeError('\"response\" must be an instance of Response');\n    }\n    if (response.status !== 200) {\n        throw new OPE('\"response\" is not a conform Authorization Server Metadata response');\n    }\n    assertReadableResponse(response);\n    let json;\n    try {\n        json = await response.json();\n    }\n    catch (cause) {\n        throw new OPE('failed to parse \"response\" body as JSON', { cause });\n    }\n    if (!isJsonObject(json)) {\n        throw new OPE('\"response\" body must be a top level object');\n    }\n    if (!validateString(json.issuer)) {\n        throw new OPE('\"response\" body \"issuer\" property must be a non-empty string');\n    }\n    if (new URL(json.issuer).href !== expectedIssuerIdentifier.href) {\n        throw new OPE('\"response\" body \"issuer\" does not match \"expectedIssuer\"');\n    }\n    return json;\n}\nfunction randomBytes() {\n    return b64u(crypto.getRandomValues(new Uint8Array(32)));\n}\nexport function generateRandomCodeVerifier() {\n    return randomBytes();\n}\nexport function generateRandomState() {\n    return randomBytes();\n}\nexport function generateRandomNonce() {\n    return randomBytes();\n}\nexport async function calculatePKCECodeChallenge(codeVerifier) {\n    if (!validateString(codeVerifier)) {\n        throw new TypeError('\"codeVerifier\" must be a non-empty string');\n    }\n    return b64u(await crypto.subtle.digest('SHA-256', buf(codeVerifier)));\n}\nfunction getKeyAndKid(input) {\n    if (input instanceof CryptoKey) {\n        return { key: input };\n    }\n    if (!(input?.key instanceof CryptoKey)) {\n        return {};\n    }\n    if (input.kid !== undefined && !validateString(input.kid)) {\n        throw new TypeError('\"kid\" must be a non-empty string');\n    }\n    return { key: input.key, kid: input.kid };\n}\nfunction formUrlEncode(token) {\n    return encodeURIComponent(token).replace(/%20/g, '+');\n}\nfunction clientSecretBasic(clientId, clientSecret) {\n    const username = formUrlEncode(clientId);\n    const password = formUrlEncode(clientSecret);\n    const credentials = btoa(`${username}:${password}`);\n    return `Basic ${credentials}`;\n}\nfunction psAlg(key) {\n    switch (key.algorithm.hash.name) {\n        case 'SHA-256':\n            return 'PS256';\n        case 'SHA-384':\n            return 'PS384';\n        case 'SHA-512':\n            return 'PS512';\n        default:\n            throw new UnsupportedOperationError('unsupported RsaHashedKeyAlgorithm hash name');\n    }\n}\nfunction rsAlg(key) {\n    switch (key.algorithm.hash.name) {\n        case 'SHA-256':\n            return 'RS256';\n        case 'SHA-384':\n            return 'RS384';\n        case 'SHA-512':\n            return 'RS512';\n        default:\n            throw new UnsupportedOperationError('unsupported RsaHashedKeyAlgorithm hash name');\n    }\n}\nfunction esAlg(key) {\n    switch (key.algorithm.namedCurve) {\n        case 'P-256':\n            return 'ES256';\n        case 'P-384':\n            return 'ES384';\n        case 'P-521':\n            return 'ES512';\n        default:\n            throw new UnsupportedOperationError('unsupported EcKeyAlgorithm namedCurve');\n    }\n}\nfunction keyToJws(key) {\n    switch (key.algorithm.name) {\n        case 'RSA-PSS':\n            return psAlg(key);\n        case 'RSASSA-PKCS1-v1_5':\n            return rsAlg(key);\n        case 'ECDSA':\n            return esAlg(key);\n        case 'Ed25519':\n        case 'Ed448':\n            return 'EdDSA';\n        default:\n            throw new UnsupportedOperationError('unsupported CryptoKey algorithm name');\n    }\n}\nfunction getClockSkew(client) {\n    const skew = client?.[clockSkew];\n    return typeof skew === 'number' && Number.isFinite(skew) ? skew : 0;\n}\nfunction getClockTolerance(client) {\n    const tolerance = client?.[clockTolerance];\n    return typeof tolerance === 'number' && Number.isFinite(tolerance) && Math.sign(tolerance) !== -1\n        ? tolerance\n        : 30;\n}\nfunction epochTime() {\n    return Math.floor(Date.now() / 1000);\n}\nfunction clientAssertion(as, client) {\n    const now = epochTime() + getClockSkew(client);\n    return {\n        jti: randomBytes(),\n        aud: [as.issuer, as.token_endpoint],\n        exp: now + 60,\n        iat: now,\n        nbf: now,\n        iss: client.client_id,\n        sub: client.client_id,\n    };\n}\nasync function privateKeyJwt(as, client, key, kid) {\n    return jwt({\n        alg: keyToJws(key),\n        kid,\n    }, clientAssertion(as, client), key);\n}\nfunction assertAs(as) {\n    if (typeof as !== 'object' || as === null) {\n        throw new TypeError('\"as\" must be an object');\n    }\n    if (!validateString(as.issuer)) {\n        throw new TypeError('\"as.issuer\" property must be a non-empty string');\n    }\n    return true;\n}\nfunction assertClient(client) {\n    if (typeof client !== 'object' || client === null) {\n        throw new TypeError('\"client\" must be an object');\n    }\n    if (!validateString(client.client_id)) {\n        throw new TypeError('\"client.client_id\" property must be a non-empty string');\n    }\n    return true;\n}\nfunction assertClientSecret(clientSecret) {\n    if (!validateString(clientSecret)) {\n        throw new TypeError('\"client.client_secret\" property must be a non-empty string');\n    }\n    return clientSecret;\n}\nfunction assertNoClientPrivateKey(clientAuthMethod, clientPrivateKey) {\n    if (clientPrivateKey !== undefined) {\n        throw new TypeError(`\"options.clientPrivateKey\" property must not be provided when ${clientAuthMethod} client authentication method is used.`);\n    }\n}\nfunction assertNoClientSecret(clientAuthMethod, clientSecret) {\n    if (clientSecret !== undefined) {\n        throw new TypeError(`\"client.client_secret\" property must not be provided when ${clientAuthMethod} client authentication method is used.`);\n    }\n}\nasync function clientAuthentication(as, client, body, headers, clientPrivateKey) {\n    body.delete('client_secret');\n    body.delete('client_assertion_type');\n    body.delete('client_assertion');\n    switch (client.token_endpoint_auth_method) {\n        case undefined:\n        case 'client_secret_basic': {\n            assertNoClientPrivateKey('client_secret_basic', clientPrivateKey);\n            headers.set('authorization', clientSecretBasic(client.client_id, assertClientSecret(client.client_secret)));\n            break;\n        }\n        case 'client_secret_post': {\n            assertNoClientPrivateKey('client_secret_post', clientPrivateKey);\n            body.set('client_id', client.client_id);\n            body.set('client_secret', assertClientSecret(client.client_secret));\n            break;\n        }\n        case 'private_key_jwt': {\n            assertNoClientSecret('private_key_jwt', client.client_secret);\n            if (clientPrivateKey === undefined) {\n                throw new TypeError('\"options.clientPrivateKey\" must be provided when \"client.token_endpoint_auth_method\" is \"private_key_jwt\"');\n            }\n            const { key, kid } = getKeyAndKid(clientPrivateKey);\n            if (!isPrivateKey(key)) {\n                throw new TypeError('\"options.clientPrivateKey.key\" must be a private CryptoKey');\n            }\n            body.set('client_id', client.client_id);\n            body.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');\n            body.set('client_assertion', await privateKeyJwt(as, client, key, kid));\n            break;\n        }\n        case 'tls_client_auth':\n        case 'self_signed_tls_client_auth':\n        case 'none': {\n            assertNoClientSecret(client.token_endpoint_auth_method, client.client_secret);\n            assertNoClientPrivateKey(client.token_endpoint_auth_method, clientPrivateKey);\n            body.set('client_id', client.client_id);\n            break;\n        }\n        default:\n            throw new UnsupportedOperationError('unsupported client token_endpoint_auth_method');\n    }\n}\nasync function jwt(header, claimsSet, key) {\n    if (!key.usages.includes('sign')) {\n        throw new TypeError('CryptoKey instances used for signing assertions must include \"sign\" in their \"usages\"');\n    }\n    const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(claimsSet)))}`;\n    const signature = b64u(await crypto.subtle.sign(keyToSubtle(key), key, buf(input)));\n    return `${input}.${signature}`;\n}\nexport async function issueRequestObject(as, client, parameters, privateKey) {\n    assertAs(as);\n    assertClient(client);\n    parameters = new URLSearchParams(parameters);\n    const { key, kid } = getKeyAndKid(privateKey);\n    if (!isPrivateKey(key)) {\n        throw new TypeError('\"privateKey.key\" must be a private CryptoKey');\n    }\n    parameters.set('client_id', client.client_id);\n    const now = epochTime() + getClockSkew(client);\n    const claims = {\n        ...Object.fromEntries(parameters.entries()),\n        jti: randomBytes(),\n        aud: as.issuer,\n        exp: now + 60,\n        iat: now,\n        nbf: now,\n        iss: client.client_id,\n    };\n    let resource;\n    if (parameters.has('resource') &&\n        (resource = parameters.getAll('resource')) &&\n        resource.length > 1) {\n        claims.resource = resource;\n    }\n    {\n        let value = parameters.get('max_age');\n        if (value !== null) {\n            claims.max_age = parseInt(value, 10);\n            if (!Number.isFinite(claims.max_age)) {\n                throw new OPE('\"max_age\" parameter must be a number');\n            }\n        }\n    }\n    {\n        let value = parameters.get('claims');\n        if (value !== null) {\n            try {\n                claims.claims = JSON.parse(value);\n            }\n            catch (cause) {\n                throw new OPE('failed to parse the \"claims\" parameter as JSON', { cause });\n            }\n            if (!isJsonObject(claims.claims)) {\n                throw new OPE('\"claims\" parameter must be a JSON with a top level object');\n            }\n        }\n    }\n    {\n        let value = parameters.get('authorization_details');\n        if (value !== null) {\n            try {\n                claims.authorization_details = JSON.parse(value);\n            }\n            catch (cause) {\n                throw new OPE('failed to parse the \"authorization_details\" parameter as JSON', { cause });\n            }\n            if (!Array.isArray(claims.authorization_details)) {\n                throw new OPE('\"authorization_details\" parameter must be a JSON with a top level array');\n            }\n        }\n    }\n    return jwt({\n        alg: keyToJws(key),\n        typ: 'oauth-authz-req+jwt',\n        kid,\n    }, claims, key);\n}\nasync function dpopProofJwt(headers, options, url, htm, clockSkew, accessToken) {\n    const { privateKey, publicKey, nonce = dpopNonces.get(url.origin) } = options;\n    if (!isPrivateKey(privateKey)) {\n        throw new TypeError('\"DPoP.privateKey\" must be a private CryptoKey');\n    }\n    if (!isPublicKey(publicKey)) {\n        throw new TypeError('\"DPoP.publicKey\" must be a public CryptoKey');\n    }\n    if (nonce !== undefined && !validateString(nonce)) {\n        throw new TypeError('\"DPoP.nonce\" must be a non-empty string or undefined');\n    }\n    if (!publicKey.extractable) {\n        throw new TypeError('\"DPoP.publicKey.extractable\" must be true');\n    }\n    const now = epochTime() + clockSkew;\n    const proof = await jwt({\n        alg: keyToJws(privateKey),\n        typ: 'dpop+jwt',\n        jwk: await publicJwk(publicKey),\n    }, {\n        iat: now,\n        jti: randomBytes(),\n        htm,\n        nonce,\n        htu: `${url.origin}${url.pathname}`,\n        ath: accessToken ? b64u(await crypto.subtle.digest('SHA-256', buf(accessToken))) : undefined,\n    }, privateKey);\n    headers.set('dpop', proof);\n}\nlet jwkCache;\nasync function getSetPublicJwkCache(key) {\n    const { kty, e, n, x, y, crv } = await crypto.subtle.exportKey('jwk', key);\n    const jwk = { kty, e, n, x, y, crv };\n    jwkCache.set(key, jwk);\n    return jwk;\n}\nasync function publicJwk(key) {\n    jwkCache || (jwkCache = new WeakMap());\n    return jwkCache.get(key) || getSetPublicJwkCache(key);\n}\nfunction validateEndpoint(value, endpoint, options) {\n    if (typeof value !== 'string') {\n        if (options?.[useMtlsAlias]) {\n            throw new TypeError(`\"as.mtls_endpoint_aliases.${endpoint}\" must be a string`);\n        }\n        throw new TypeError(`\"as.${endpoint}\" must be a string`);\n    }\n    return new URL(value);\n}\nfunction resolveEndpoint(as, endpoint, options) {\n    if (options?.[useMtlsAlias] && as.mtls_endpoint_aliases && endpoint in as.mtls_endpoint_aliases) {\n        return validateEndpoint(as.mtls_endpoint_aliases[endpoint], endpoint, options);\n    }\n    return validateEndpoint(as[endpoint], endpoint);\n}\nexport async function pushedAuthorizationRequest(as, client, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'pushed_authorization_request_endpoint', options);\n    const body = new URLSearchParams(parameters);\n    body.set('client_id', client.client_id);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    if (options?.DPoP !== undefined) {\n        await dpopProofJwt(headers, options.DPoP, url, 'POST', getClockSkew(client));\n    }\n    return authenticatedRequest(as, client, 'POST', url, body, headers, options);\n}\nexport function isOAuth2Error(input) {\n    const value = input;\n    if (typeof value !== 'object' || Array.isArray(value) || value === null) {\n        return false;\n    }\n    return value.error !== undefined;\n}\nfunction unquote(value) {\n    if (value.length >= 2 && value[0] === '\"' && value[value.length - 1] === '\"') {\n        return value.slice(1, -1);\n    }\n    return value;\n}\nconst SPLIT_REGEXP = /((?:,|, )?[0-9a-zA-Z!#$%&'*+-.^_`|~]+=)/;\nconst SCHEMES_REGEXP = /(?:^|, ?)([0-9a-zA-Z!#$%&'*+\\-.^_`|~]+)(?=$|[ ,])/g;\nfunction wwwAuth(scheme, params) {\n    const arr = params.split(SPLIT_REGEXP).slice(1);\n    if (!arr.length) {\n        return { scheme: scheme.toLowerCase(), parameters: {} };\n    }\n    arr[arr.length - 1] = arr[arr.length - 1].replace(/,$/, '');\n    const parameters = {};\n    for (let i = 1; i < arr.length; i += 2) {\n        const idx = i;\n        if (arr[idx][0] === '\"') {\n            while (arr[idx].slice(-1) !== '\"' && ++i < arr.length) {\n                arr[idx] += arr[i];\n            }\n        }\n        const key = arr[idx - 1].replace(/^(?:, ?)|=$/g, '').toLowerCase();\n        parameters[key] = unquote(arr[idx]);\n    }\n    return {\n        scheme: scheme.toLowerCase(),\n        parameters,\n    };\n}\nexport function parseWwwAuthenticateChallenges(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw new TypeError('\"response\" must be an instance of Response');\n    }\n    const header = response.headers.get('www-authenticate');\n    if (header === null) {\n        return undefined;\n    }\n    const result = [];\n    for (const { 1: scheme, index } of header.matchAll(SCHEMES_REGEXP)) {\n        result.push([scheme, index]);\n    }\n    if (!result.length) {\n        return undefined;\n    }\n    const challenges = result.map(([scheme, indexOf], i, others) => {\n        const next = others[i + 1];\n        let parameters;\n        if (next) {\n            parameters = header.slice(indexOf, next[1]);\n        }\n        else {\n            parameters = header.slice(indexOf);\n        }\n        return wwwAuth(scheme, parameters);\n    });\n    return challenges;\n}\nexport async function processPushedAuthorizationResponse(as, client, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw new TypeError('\"response\" must be an instance of Response');\n    }\n    if (response.status !== 201) {\n        let err;\n        if ((err = await handleOAuthBodyError(response))) {\n            return err;\n        }\n        throw new OPE('\"response\" is not a conform Pushed Authorization Request Endpoint response');\n    }\n    assertReadableResponse(response);\n    let json;\n    try {\n        json = await response.json();\n    }\n    catch (cause) {\n        throw new OPE('failed to parse \"response\" body as JSON', { cause });\n    }\n    if (!isJsonObject(json)) {\n        throw new OPE('\"response\" body must be a top level object');\n    }\n    if (!validateString(json.request_uri)) {\n        throw new OPE('\"response\" body \"request_uri\" property must be a non-empty string');\n    }\n    if (typeof json.expires_in !== 'number' || json.expires_in <= 0) {\n        throw new OPE('\"response\" body \"expires_in\" property must be a positive number');\n    }\n    return json;\n}\nexport async function protectedResourceRequest(accessToken, method, url, headers, body, options) {\n    if (!validateString(accessToken)) {\n        throw new TypeError('\"accessToken\" must be a non-empty string');\n    }\n    if (!(url instanceof URL)) {\n        throw new TypeError('\"url\" must be an instance of URL');\n    }\n    headers = prepareHeaders(headers);\n    if (options?.DPoP === undefined) {\n        headers.set('authorization', `Bearer ${accessToken}`);\n    }\n    else {\n        await dpopProofJwt(headers, options.DPoP, url, 'GET', getClockSkew({ [clockSkew]: options?.[clockSkew] }), accessToken);\n        headers.set('authorization', `DPoP ${accessToken}`);\n    }\n    return (options?.[customFetch] || fetch)(url.href, {\n        body,\n        headers: Object.fromEntries(headers.entries()),\n        method,\n        redirect: 'manual',\n        signal: options?.signal ? signal(options.signal) : null,\n    }).then(processDpopNonce);\n}\nexport async function userInfoRequest(as, client, accessToken, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'userinfo_endpoint', options);\n    const headers = prepareHeaders(options?.headers);\n    if (client.userinfo_signed_response_alg) {\n        headers.set('accept', 'application/jwt');\n    }\n    else {\n        headers.set('accept', 'application/json');\n        headers.append('accept', 'application/jwt');\n    }\n    return protectedResourceRequest(accessToken, 'GET', url, headers, null, {\n        ...options,\n        [clockSkew]: getClockSkew(client),\n    });\n}\nlet jwksCache;\nasync function getPublicSigKeyFromIssuerJwksUri(as, options, header) {\n    const { alg, kid } = header;\n    checkSupportedJwsAlg(alg);\n    let jwks;\n    let age;\n    jwksCache || (jwksCache = new WeakMap());\n    if (jwksCache.has(as)) {\n        ;\n        ({ jwks, age } = jwksCache.get(as));\n        if (age >= 300) {\n            jwksCache.delete(as);\n            return getPublicSigKeyFromIssuerJwksUri(as, options, header);\n        }\n    }\n    else {\n        jwks = await jwksRequest(as, options).then(processJwksResponse);\n        age = 0;\n        jwksCache.set(as, {\n            jwks,\n            iat: epochTime(),\n            get age() {\n                return epochTime() - this.iat;\n            },\n        });\n    }\n    let kty;\n    switch (alg.slice(0, 2)) {\n        case 'RS':\n        case 'PS':\n            kty = 'RSA';\n            break;\n        case 'ES':\n            kty = 'EC';\n            break;\n        case 'Ed':\n            kty = 'OKP';\n            break;\n        default:\n            throw new UnsupportedOperationError();\n    }\n    const candidates = jwks.keys.filter((jwk) => {\n        if (jwk.kty !== kty) {\n            return false;\n        }\n        if (kid !== undefined && kid !== jwk.kid) {\n            return false;\n        }\n        if (jwk.alg !== undefined && alg !== jwk.alg) {\n            return false;\n        }\n        if (jwk.use !== undefined && jwk.use !== 'sig') {\n            return false;\n        }\n        if (jwk.key_ops?.includes('verify') === false) {\n            return false;\n        }\n        switch (true) {\n            case alg === 'ES256' && jwk.crv !== 'P-256':\n            case alg === 'ES384' && jwk.crv !== 'P-384':\n            case alg === 'ES512' && jwk.crv !== 'P-521':\n            case alg === 'EdDSA' && !(jwk.crv === 'Ed25519' || jwk.crv === 'Ed448'):\n                return false;\n        }\n        return true;\n    });\n    const { 0: jwk, length } = candidates;\n    if (!length) {\n        if (age >= 60) {\n            jwksCache.delete(as);\n            return getPublicSigKeyFromIssuerJwksUri(as, options, header);\n        }\n        throw new OPE('error when selecting a JWT verification key, no applicable keys found');\n    }\n    if (length !== 1) {\n        throw new OPE('error when selecting a JWT verification key, multiple applicable keys found, a \"kid\" JWT Header Parameter is required');\n    }\n    const key = await importJwk(alg, jwk);\n    if (key.type !== 'public') {\n        throw new OPE('jwks_uri must only contain public keys');\n    }\n    return key;\n}\nexport const skipSubjectCheck = Symbol();\nfunction getContentType(response) {\n    return response.headers.get('content-type')?.split(';')[0];\n}\nexport async function processUserInfoResponse(as, client, expectedSubject, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw new TypeError('\"response\" must be an instance of Response');\n    }\n    if (response.status !== 200) {\n        throw new OPE('\"response\" is not a conform UserInfo Endpoint response');\n    }\n    let json;\n    if (getContentType(response) === 'application/jwt') {\n        assertReadableResponse(response);\n        const { claims } = await validateJwt(await response.text(), checkSigningAlgorithm.bind(undefined, client.userinfo_signed_response_alg, as.userinfo_signing_alg_values_supported), noSignatureCheck, getClockSkew(client), getClockTolerance(client))\n            .then(validateOptionalAudience.bind(undefined, client.client_id))\n            .then(validateOptionalIssuer.bind(undefined, as.issuer));\n        json = claims;\n    }\n    else {\n        if (client.userinfo_signed_response_alg) {\n            throw new OPE('JWT UserInfo Response expected');\n        }\n        assertReadableResponse(response);\n        try {\n            json = await response.json();\n        }\n        catch (cause) {\n            throw new OPE('failed to parse \"response\" body as JSON', { cause });\n        }\n    }\n    if (!isJsonObject(json)) {\n        throw new OPE('\"response\" body must be a top level object');\n    }\n    if (!validateString(json.sub)) {\n        throw new OPE('\"response\" body \"sub\" property must be a non-empty string');\n    }\n    switch (expectedSubject) {\n        case skipSubjectCheck:\n            break;\n        default:\n            if (!validateString(expectedSubject)) {\n                throw new OPE('\"expectedSubject\" must be a non-empty string');\n            }\n            if (json.sub !== expectedSubject) {\n                throw new OPE('unexpected \"response\" body \"sub\" value');\n            }\n    }\n    return json;\n}\nasync function authenticatedRequest(as, client, method, url, body, headers, options) {\n    await clientAuthentication(as, client, body, headers, options?.clientPrivateKey);\n    headers.set('content-type', 'application/x-www-form-urlencoded;charset=UTF-8');\n    return (options?.[customFetch] || fetch)(url.href, {\n        body,\n        headers: Object.fromEntries(headers.entries()),\n        method,\n        redirect: 'manual',\n        signal: options?.signal ? signal(options.signal) : null,\n    }).then(processDpopNonce);\n}\nasync function tokenEndpointRequest(as, client, grantType, parameters, options) {\n    const url = resolveEndpoint(as, 'token_endpoint', options);\n    parameters.set('grant_type', grantType);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    if (options?.DPoP !== undefined) {\n        await dpopProofJwt(headers, options.DPoP, url, 'POST', getClockSkew(client));\n    }\n    return authenticatedRequest(as, client, 'POST', url, parameters, headers, options);\n}\nexport async function refreshTokenGrantRequest(as, client, refreshToken, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!validateString(refreshToken)) {\n        throw new TypeError('\"refreshToken\" must be a non-empty string');\n    }\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('refresh_token', refreshToken);\n    return tokenEndpointRequest(as, client, 'refresh_token', parameters, options);\n}\nconst idTokenClaims = new WeakMap();\nexport function getValidatedIdTokenClaims(ref) {\n    if (!ref.id_token) {\n        return undefined;\n    }\n    const claims = idTokenClaims.get(ref);\n    if (!claims) {\n        throw new TypeError('\"ref\" was already garbage collected or did not resolve from the proper sources');\n    }\n    return claims;\n}\nasync function processGenericAccessTokenResponse(as, client, response, ignoreIdToken = false, ignoreRefreshToken = false) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw new TypeError('\"response\" must be an instance of Response');\n    }\n    if (response.status !== 200) {\n        let err;\n        if ((err = await handleOAuthBodyError(response))) {\n            return err;\n        }\n        throw new OPE('\"response\" is not a conform Token Endpoint response');\n    }\n    assertReadableResponse(response);\n    let json;\n    try {\n        json = await response.json();\n    }\n    catch (cause) {\n        throw new OPE('failed to parse \"response\" body as JSON', { cause });\n    }\n    if (!isJsonObject(json)) {\n        throw new OPE('\"response\" body must be a top level object');\n    }\n    if (!validateString(json.access_token)) {\n        throw new OPE('\"response\" body \"access_token\" property must be a non-empty string');\n    }\n    if (!validateString(json.token_type)) {\n        throw new OPE('\"response\" body \"token_type\" property must be a non-empty string');\n    }\n    json.token_type = json.token_type.toLowerCase();\n    if (json.token_type !== 'dpop' && json.token_type !== 'bearer') {\n        throw new UnsupportedOperationError('unsupported `token_type` value');\n    }\n    if (json.expires_in !== undefined &&\n        (typeof json.expires_in !== 'number' || json.expires_in <= 0)) {\n        throw new OPE('\"response\" body \"expires_in\" property must be a positive number');\n    }\n    if (!ignoreRefreshToken &&\n        json.refresh_token !== undefined &&\n        !validateString(json.refresh_token)) {\n        throw new OPE('\"response\" body \"refresh_token\" property must be a non-empty string');\n    }\n    if (json.scope !== undefined && typeof json.scope !== 'string') {\n        throw new OPE('\"response\" body \"scope\" property must be a string');\n    }\n    if (!ignoreIdToken) {\n        if (json.id_token !== undefined && !validateString(json.id_token)) {\n            throw new OPE('\"response\" body \"id_token\" property must be a non-empty string');\n        }\n        if (json.id_token) {\n            const { claims } = await validateJwt(json.id_token, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported), noSignatureCheck, getClockSkew(client), getClockTolerance(client))\n                .then(validatePresence.bind(undefined, ['aud', 'exp', 'iat', 'iss', 'sub']))\n                .then(validateIssuer.bind(undefined, as.issuer))\n                .then(validateAudience.bind(undefined, client.client_id));\n            if (Array.isArray(claims.aud) && claims.aud.length !== 1 && claims.azp !== client.client_id) {\n                throw new OPE('unexpected ID Token \"azp\" (authorized party) claim value');\n            }\n            if (client.require_auth_time && typeof claims.auth_time !== 'number') {\n                throw new OPE('unexpected ID Token \"auth_time\" (authentication time) claim value');\n            }\n            idTokenClaims.set(json, claims);\n        }\n    }\n    return json;\n}\nexport async function processRefreshTokenResponse(as, client, response) {\n    return processGenericAccessTokenResponse(as, client, response);\n}\nfunction validateOptionalAudience(expected, result) {\n    if (result.claims.aud !== undefined) {\n        return validateAudience(expected, result);\n    }\n    return result;\n}\nfunction validateAudience(expected, result) {\n    if (Array.isArray(result.claims.aud)) {\n        if (!result.claims.aud.includes(expected)) {\n            throw new OPE('unexpected JWT \"aud\" (audience) claim value');\n        }\n    }\n    else if (result.claims.aud !== expected) {\n        throw new OPE('unexpected JWT \"aud\" (audience) claim value');\n    }\n    return result;\n}\nfunction validateOptionalIssuer(expected, result) {\n    if (result.claims.iss !== undefined) {\n        return validateIssuer(expected, result);\n    }\n    return result;\n}\nfunction validateIssuer(expected, result) {\n    if (result.claims.iss !== expected) {\n        throw new OPE('unexpected JWT \"iss\" (issuer) claim value');\n    }\n    return result;\n}\nconst branded = new WeakSet();\nfunction brand(searchParams) {\n    branded.add(searchParams);\n    return searchParams;\n}\nexport async function authorizationCodeGrantRequest(as, client, callbackParameters, redirectUri, codeVerifier, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!branded.has(callbackParameters)) {\n        throw new TypeError('\"callbackParameters\" must be an instance of URLSearchParams obtained from \"validateAuthResponse()\", or \"validateJwtAuthResponse()');\n    }\n    if (!validateString(redirectUri)) {\n        throw new TypeError('\"redirectUri\" must be a non-empty string');\n    }\n    if (!validateString(codeVerifier)) {\n        throw new TypeError('\"codeVerifier\" must be a non-empty string');\n    }\n    const code = getURLSearchParameter(callbackParameters, 'code');\n    if (!code) {\n        throw new OPE('no authorization code in \"callbackParameters\"');\n    }\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('redirect_uri', redirectUri);\n    parameters.set('code_verifier', codeVerifier);\n    parameters.set('code', code);\n    return tokenEndpointRequest(as, client, 'authorization_code', parameters, options);\n}\nconst jwtClaimNames = {\n    aud: 'audience',\n    c_hash: 'code hash',\n    client_id: 'client id',\n    exp: 'expiration time',\n    iat: 'issued at',\n    iss: 'issuer',\n    jti: 'jwt id',\n    nonce: 'nonce',\n    s_hash: 'state hash',\n    sub: 'subject',\n    ath: 'access token hash',\n    htm: 'http method',\n    htu: 'http uri',\n    cnf: 'confirmation',\n};\nfunction validatePresence(required, result) {\n    for (const claim of required) {\n        if (result.claims[claim] === undefined) {\n            throw new OPE(`JWT \"${claim}\" (${jwtClaimNames[claim]}) claim missing`);\n        }\n    }\n    return result;\n}\nexport const expectNoNonce = Symbol();\nexport const skipAuthTimeCheck = Symbol();\nexport async function processAuthorizationCodeOpenIDResponse(as, client, response, expectedNonce, maxAge) {\n    const result = await processGenericAccessTokenResponse(as, client, response);\n    if (isOAuth2Error(result)) {\n        return result;\n    }\n    if (!validateString(result.id_token)) {\n        throw new OPE('\"response\" body \"id_token\" property must be a non-empty string');\n    }\n    maxAge ?? (maxAge = client.default_max_age ?? skipAuthTimeCheck);\n    const claims = getValidatedIdTokenClaims(result);\n    if ((client.require_auth_time || maxAge !== skipAuthTimeCheck) &&\n        claims.auth_time === undefined) {\n        throw new OPE('ID Token \"auth_time\" (authentication time) claim missing');\n    }\n    if (maxAge !== skipAuthTimeCheck) {\n        if (typeof maxAge !== 'number' || maxAge < 0) {\n            throw new TypeError('\"options.max_age\" must be a non-negative number');\n        }\n        const now = epochTime() + getClockSkew(client);\n        const tolerance = getClockTolerance(client);\n        if (claims.auth_time + maxAge < now - tolerance) {\n            throw new OPE('too much time has elapsed since the last End-User authentication');\n        }\n    }\n    switch (expectedNonce) {\n        case undefined:\n        case expectNoNonce:\n            if (claims.nonce !== undefined) {\n                throw new OPE('unexpected ID Token \"nonce\" claim value');\n            }\n            break;\n        default:\n            if (!validateString(expectedNonce)) {\n                throw new TypeError('\"expectedNonce\" must be a non-empty string');\n            }\n            if (claims.nonce === undefined) {\n                throw new OPE('ID Token \"nonce\" claim missing');\n            }\n            if (claims.nonce !== expectedNonce) {\n                throw new OPE('unexpected ID Token \"nonce\" claim value');\n            }\n    }\n    return result;\n}\nexport async function processAuthorizationCodeOAuth2Response(as, client, response) {\n    const result = await processGenericAccessTokenResponse(as, client, response, true);\n    if (isOAuth2Error(result)) {\n        return result;\n    }\n    if (result.id_token !== undefined) {\n        if (typeof result.id_token === 'string' && result.id_token.length) {\n            throw new OPE('Unexpected ID Token returned, use processAuthorizationCodeOpenIDResponse() for OpenID Connect callback processing');\n        }\n        delete result.id_token;\n    }\n    return result;\n}\nfunction checkJwtType(expected, result) {\n    if (typeof result.header.typ !== 'string' || normalizeTyp(result.header.typ) !== expected) {\n        throw new OPE('unexpected JWT \"typ\" header parameter value');\n    }\n    return result;\n}\nexport async function clientCredentialsGrantRequest(as, client, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    return tokenEndpointRequest(as, client, 'client_credentials', new URLSearchParams(parameters), options);\n}\nexport async function processClientCredentialsResponse(as, client, response) {\n    const result = await processGenericAccessTokenResponse(as, client, response, true, true);\n    if (isOAuth2Error(result)) {\n        return result;\n    }\n    return result;\n}\nexport async function revocationRequest(as, client, token, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!validateString(token)) {\n        throw new TypeError('\"token\" must be a non-empty string');\n    }\n    const url = resolveEndpoint(as, 'revocation_endpoint', options);\n    const body = new URLSearchParams(options?.additionalParameters);\n    body.set('token', token);\n    const headers = prepareHeaders(options?.headers);\n    headers.delete('accept');\n    return authenticatedRequest(as, client, 'POST', url, body, headers, options);\n}\nexport async function processRevocationResponse(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw new TypeError('\"response\" must be an instance of Response');\n    }\n    if (response.status !== 200) {\n        let err;\n        if ((err = await handleOAuthBodyError(response))) {\n            return err;\n        }\n        throw new OPE('\"response\" is not a conform Revocation Endpoint response');\n    }\n    return undefined;\n}\nfunction assertReadableResponse(response) {\n    if (response.bodyUsed) {\n        throw new TypeError('\"response\" body has been used already');\n    }\n}\nexport async function introspectionRequest(as, client, token, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!validateString(token)) {\n        throw new TypeError('\"token\" must be a non-empty string');\n    }\n    const url = resolveEndpoint(as, 'introspection_endpoint', options);\n    const body = new URLSearchParams(options?.additionalParameters);\n    body.set('token', token);\n    const headers = prepareHeaders(options?.headers);\n    if (options?.requestJwtResponse ?? client.introspection_signed_response_alg) {\n        headers.set('accept', 'application/token-introspection+jwt');\n    }\n    else {\n        headers.set('accept', 'application/json');\n    }\n    return authenticatedRequest(as, client, 'POST', url, body, headers, options);\n}\nexport async function processIntrospectionResponse(as, client, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw new TypeError('\"response\" must be an instance of Response');\n    }\n    if (response.status !== 200) {\n        let err;\n        if ((err = await handleOAuthBodyError(response))) {\n            return err;\n        }\n        throw new OPE('\"response\" is not a conform Introspection Endpoint response');\n    }\n    let json;\n    if (getContentType(response) === 'application/token-introspection+jwt') {\n        assertReadableResponse(response);\n        const { claims } = await validateJwt(await response.text(), checkSigningAlgorithm.bind(undefined, client.introspection_signed_response_alg, as.introspection_signing_alg_values_supported), noSignatureCheck, getClockSkew(client), getClockTolerance(client))\n            .then(checkJwtType.bind(undefined, 'token-introspection+jwt'))\n            .then(validatePresence.bind(undefined, ['aud', 'iat', 'iss']))\n            .then(validateIssuer.bind(undefined, as.issuer))\n            .then(validateAudience.bind(undefined, client.client_id));\n        json = claims.token_introspection;\n        if (!isJsonObject(json)) {\n            throw new OPE('JWT \"token_introspection\" claim must be a JSON object');\n        }\n    }\n    else {\n        assertReadableResponse(response);\n        try {\n            json = await response.json();\n        }\n        catch (cause) {\n            throw new OPE('failed to parse \"response\" body as JSON', { cause });\n        }\n        if (!isJsonObject(json)) {\n            throw new OPE('\"response\" body must be a top level object');\n        }\n    }\n    if (typeof json.active !== 'boolean') {\n        throw new OPE('\"response\" body \"active\" property must be a boolean');\n    }\n    return json;\n}\nasync function jwksRequest(as, options) {\n    assertAs(as);\n    const url = resolveEndpoint(as, 'jwks_uri');\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    headers.append('accept', 'application/jwk-set+json');\n    return (options?.[customFetch] || fetch)(url.href, {\n        headers: Object.fromEntries(headers.entries()),\n        method: 'GET',\n        redirect: 'manual',\n        signal: options?.signal ? signal(options.signal) : null,\n    }).then(processDpopNonce);\n}\nasync function processJwksResponse(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw new TypeError('\"response\" must be an instance of Response');\n    }\n    if (response.status !== 200) {\n        throw new OPE('\"response\" is not a conform JSON Web Key Set response');\n    }\n    assertReadableResponse(response);\n    let json;\n    try {\n        json = await response.json();\n    }\n    catch (cause) {\n        throw new OPE('failed to parse \"response\" body as JSON', { cause });\n    }\n    if (!isJsonObject(json)) {\n        throw new OPE('\"response\" body must be a top level object');\n    }\n    if (!Array.isArray(json.keys)) {\n        throw new OPE('\"response\" body \"keys\" property must be an array');\n    }\n    if (!Array.prototype.every.call(json.keys, isJsonObject)) {\n        throw new OPE('\"response\" body \"keys\" property members must be JWK formatted objects');\n    }\n    return json;\n}\nasync function handleOAuthBodyError(response) {\n    if (response.status > 399 && response.status < 500) {\n        assertReadableResponse(response);\n        try {\n            const json = await response.json();\n            if (isJsonObject(json) && typeof json.error === 'string' && json.error.length) {\n                if (json.error_description !== undefined && typeof json.error_description !== 'string') {\n                    delete json.error_description;\n                }\n                if (json.error_uri !== undefined && typeof json.error_uri !== 'string') {\n                    delete json.error_uri;\n                }\n                if (json.algs !== undefined && typeof json.algs !== 'string') {\n                    delete json.algs;\n                }\n                if (json.scope !== undefined && typeof json.scope !== 'string') {\n                    delete json.scope;\n                }\n                return json;\n            }\n        }\n        catch { }\n    }\n    return undefined;\n}\nfunction checkSupportedJwsAlg(alg) {\n    if (!SUPPORTED_JWS_ALGS.includes(alg)) {\n        throw new UnsupportedOperationError('unsupported JWS \"alg\" identifier');\n    }\n    return alg;\n}\nfunction checkRsaKeyAlgorithm(algorithm) {\n    if (typeof algorithm.modulusLength !== 'number' || algorithm.modulusLength < 2048) {\n        throw new OPE(`${algorithm.name} modulusLength must be at least 2048 bits`);\n    }\n}\nfunction ecdsaHashName(namedCurve) {\n    switch (namedCurve) {\n        case 'P-256':\n            return 'SHA-256';\n        case 'P-384':\n            return 'SHA-384';\n        case 'P-521':\n            return 'SHA-512';\n        default:\n            throw new UnsupportedOperationError();\n    }\n}\nfunction keyToSubtle(key) {\n    switch (key.algorithm.name) {\n        case 'ECDSA':\n            return {\n                name: key.algorithm.name,\n                hash: ecdsaHashName(key.algorithm.namedCurve),\n            };\n        case 'RSA-PSS': {\n            checkRsaKeyAlgorithm(key.algorithm);\n            switch (key.algorithm.hash.name) {\n                case 'SHA-256':\n                case 'SHA-384':\n                case 'SHA-512':\n                    return {\n                        name: key.algorithm.name,\n                        saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3,\n                    };\n                default:\n                    throw new UnsupportedOperationError();\n            }\n        }\n        case 'RSASSA-PKCS1-v1_5':\n            checkRsaKeyAlgorithm(key.algorithm);\n            return key.algorithm.name;\n        case 'Ed448':\n        case 'Ed25519':\n            return key.algorithm.name;\n    }\n    throw new UnsupportedOperationError();\n}\nconst noSignatureCheck = Symbol();\nasync function validateJwt(jws, checkAlg, getKey, clockSkew, clockTolerance) {\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature, length } = jws.split('.');\n    if (length === 5) {\n        throw new UnsupportedOperationError('JWE structure JWTs are not supported');\n    }\n    if (length !== 3) {\n        throw new OPE('Invalid JWT');\n    }\n    let header;\n    try {\n        header = JSON.parse(buf(b64u(protectedHeader)));\n    }\n    catch (cause) {\n        throw new OPE('failed to parse JWT Header body as base64url encoded JSON', { cause });\n    }\n    if (!isJsonObject(header)) {\n        throw new OPE('JWT Header must be a top level object');\n    }\n    checkAlg(header);\n    if (header.crit !== undefined) {\n        throw new OPE('unexpected JWT \"crit\" header parameter');\n    }\n    const signature = b64u(encodedSignature);\n    let key;\n    if (getKey !== noSignatureCheck) {\n        key = await getKey(header);\n        const input = `${protectedHeader}.${payload}`;\n        const verified = await crypto.subtle.verify(keyToSubtle(key), key, signature, buf(input));\n        if (!verified) {\n            throw new OPE('JWT signature verification failed');\n        }\n    }\n    let claims;\n    try {\n        claims = JSON.parse(buf(b64u(payload)));\n    }\n    catch (cause) {\n        throw new OPE('failed to parse JWT Payload body as base64url encoded JSON', { cause });\n    }\n    if (!isJsonObject(claims)) {\n        throw new OPE('JWT Payload must be a top level object');\n    }\n    const now = epochTime() + clockSkew;\n    if (claims.exp !== undefined) {\n        if (typeof claims.exp !== 'number') {\n            throw new OPE('unexpected JWT \"exp\" (expiration time) claim type');\n        }\n        if (claims.exp <= now - clockTolerance) {\n            throw new OPE('unexpected JWT \"exp\" (expiration time) claim value, timestamp is <= now()');\n        }\n    }\n    if (claims.iat !== undefined) {\n        if (typeof claims.iat !== 'number') {\n            throw new OPE('unexpected JWT \"iat\" (issued at) claim type');\n        }\n    }\n    if (claims.iss !== undefined) {\n        if (typeof claims.iss !== 'string') {\n            throw new OPE('unexpected JWT \"iss\" (issuer) claim type');\n        }\n    }\n    if (claims.nbf !== undefined) {\n        if (typeof claims.nbf !== 'number') {\n            throw new OPE('unexpected JWT \"nbf\" (not before) claim type');\n        }\n        if (claims.nbf > now + clockTolerance) {\n            throw new OPE('unexpected JWT \"nbf\" (not before) claim value, timestamp is > now()');\n        }\n    }\n    if (claims.aud !== undefined) {\n        if (typeof claims.aud !== 'string' && !Array.isArray(claims.aud)) {\n            throw new OPE('unexpected JWT \"aud\" (audience) claim type');\n        }\n    }\n    return { header, claims, signature, key };\n}\nexport async function validateJwtAuthResponse(as, client, parameters, expectedState, options) {\n    assertAs(as);\n    assertClient(client);\n    if (parameters instanceof URL) {\n        parameters = parameters.searchParams;\n    }\n    if (!(parameters instanceof URLSearchParams)) {\n        throw new TypeError('\"parameters\" must be an instance of URLSearchParams, or URL');\n    }\n    const response = getURLSearchParameter(parameters, 'response');\n    if (!response) {\n        throw new OPE('\"parameters\" does not contain a JARM response');\n    }\n    if (typeof as.jwks_uri !== 'string') {\n        throw new TypeError('\"as.jwks_uri\" must be a string');\n    }\n    const { claims } = await validateJwt(response, checkSigningAlgorithm.bind(undefined, client.authorization_signed_response_alg, as.authorization_signing_alg_values_supported), getPublicSigKeyFromIssuerJwksUri.bind(undefined, as, options), getClockSkew(client), getClockTolerance(client))\n        .then(validatePresence.bind(undefined, ['aud', 'exp', 'iss']))\n        .then(validateIssuer.bind(undefined, as.issuer))\n        .then(validateAudience.bind(undefined, client.client_id));\n    const result = new URLSearchParams();\n    for (const [key, value] of Object.entries(claims)) {\n        if (typeof value === 'string' && key !== 'aud') {\n            result.set(key, value);\n        }\n    }\n    return validateAuthResponse(as, client, result, expectedState);\n}\nasync function idTokenHash(alg, data, key) {\n    let algorithm;\n    switch (alg) {\n        case 'RS256':\n        case 'PS256':\n        case 'ES256':\n            algorithm = 'SHA-256';\n            break;\n        case 'RS384':\n        case 'PS384':\n        case 'ES384':\n            algorithm = 'SHA-384';\n            break;\n        case 'RS512':\n        case 'PS512':\n        case 'ES512':\n            algorithm = 'SHA-512';\n            break;\n        case 'EdDSA':\n            if (key.algorithm.name === 'Ed25519') {\n                algorithm = 'SHA-512';\n                break;\n            }\n            throw new UnsupportedOperationError();\n        default:\n            throw new UnsupportedOperationError();\n    }\n    const digest = await crypto.subtle.digest(algorithm, buf(data));\n    return b64u(digest.slice(0, digest.byteLength / 2));\n}\nasync function idTokenHashMatches(data, actual, alg, key) {\n    const expected = await idTokenHash(alg, data, key);\n    return actual === expected;\n}\nexport async function validateDetachedSignatureResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options) {\n    assertAs(as);\n    assertClient(client);\n    if (parameters instanceof URL) {\n        if (!parameters.hash.length) {\n            throw new TypeError('\"parameters\" as an instance of URL must contain a hash (fragment) with the Authorization Response parameters');\n        }\n        parameters = new URLSearchParams(parameters.hash.slice(1));\n    }\n    if (!(parameters instanceof URLSearchParams)) {\n        throw new TypeError('\"parameters\" must be an instance of URLSearchParams');\n    }\n    parameters = new URLSearchParams(parameters);\n    const id_token = getURLSearchParameter(parameters, 'id_token');\n    parameters.delete('id_token');\n    switch (expectedState) {\n        case undefined:\n        case expectNoState:\n            break;\n        default:\n            if (!validateString(expectedState)) {\n                throw new TypeError('\"expectedState\" must be a non-empty string');\n            }\n    }\n    const result = validateAuthResponse({\n        ...as,\n        authorization_response_iss_parameter_supported: false,\n    }, client, parameters, expectedState);\n    if (isOAuth2Error(result)) {\n        return result;\n    }\n    if (!id_token) {\n        throw new OPE('\"parameters\" does not contain an ID Token');\n    }\n    const code = getURLSearchParameter(parameters, 'code');\n    if (!code) {\n        throw new OPE('\"parameters\" does not contain an Authorization Code');\n    }\n    if (typeof as.jwks_uri !== 'string') {\n        throw new TypeError('\"as.jwks_uri\" must be a string');\n    }\n    const requiredClaims = [\n        'aud',\n        'exp',\n        'iat',\n        'iss',\n        'sub',\n        'nonce',\n        'c_hash',\n    ];\n    if (typeof expectedState === 'string') {\n        requiredClaims.push('s_hash');\n    }\n    const { claims, header, key } = await validateJwt(id_token, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported), getPublicSigKeyFromIssuerJwksUri.bind(undefined, as, options), getClockSkew(client), getClockTolerance(client))\n        .then(validatePresence.bind(undefined, requiredClaims))\n        .then(validateIssuer.bind(undefined, as.issuer))\n        .then(validateAudience.bind(undefined, client.client_id));\n    const clockSkew = getClockSkew(client);\n    const now = epochTime() + clockSkew;\n    if (claims.iat < now - 3600) {\n        throw new OPE('unexpected JWT \"iat\" (issued at) claim value, it is too far in the past');\n    }\n    if (typeof claims.c_hash !== 'string' ||\n        (await idTokenHashMatches(code, claims.c_hash, header.alg, key)) !== true) {\n        throw new OPE('invalid ID Token \"c_hash\" (code hash) claim value');\n    }\n    if (claims.s_hash !== undefined && typeof expectedState !== 'string') {\n        throw new OPE('could not verify ID Token \"s_hash\" (state hash) claim value');\n    }\n    if (typeof expectedState === 'string' &&\n        (typeof claims.s_hash !== 'string' ||\n            (await idTokenHashMatches(expectedState, claims.s_hash, header.alg, key)) !== true)) {\n        throw new OPE('invalid ID Token \"s_hash\" (state hash) claim value');\n    }\n    if (client.require_auth_time !== undefined && typeof claims.auth_time !== 'number') {\n        throw new OPE('unexpected ID Token \"auth_time\" (authentication time) claim value');\n    }\n    maxAge ?? (maxAge = client.default_max_age ?? skipAuthTimeCheck);\n    if ((client.require_auth_time || maxAge !== skipAuthTimeCheck) &&\n        claims.auth_time === undefined) {\n        throw new OPE('ID Token \"auth_time\" (authentication time) claim missing');\n    }\n    if (maxAge !== skipAuthTimeCheck) {\n        if (typeof maxAge !== 'number' || maxAge < 0) {\n            throw new TypeError('\"options.max_age\" must be a non-negative number');\n        }\n        const now = epochTime() + getClockSkew(client);\n        const tolerance = getClockTolerance(client);\n        if (claims.auth_time + maxAge < now - tolerance) {\n            throw new OPE('too much time has elapsed since the last End-User authentication');\n        }\n    }\n    if (!validateString(expectedNonce)) {\n        throw new TypeError('\"expectedNonce\" must be a non-empty string');\n    }\n    if (claims.nonce !== expectedNonce) {\n        throw new OPE('unexpected ID Token \"nonce\" claim value');\n    }\n    if (Array.isArray(claims.aud) && claims.aud.length !== 1 && claims.azp !== client.client_id) {\n        throw new OPE('unexpected ID Token \"azp\" (authorized party) claim value');\n    }\n    return result;\n}\nfunction checkSigningAlgorithm(client, issuer, header) {\n    if (client !== undefined) {\n        if (header.alg !== client) {\n            throw new OPE('unexpected JWT \"alg\" header parameter');\n        }\n        return;\n    }\n    if (Array.isArray(issuer)) {\n        if (!issuer.includes(header.alg)) {\n            throw new OPE('unexpected JWT \"alg\" header parameter');\n        }\n        return;\n    }\n    if (header.alg !== 'RS256') {\n        throw new OPE('unexpected JWT \"alg\" header parameter');\n    }\n}\nfunction getURLSearchParameter(parameters, name) {\n    const { 0: value, length } = parameters.getAll(name);\n    if (length > 1) {\n        throw new OPE(`\"${name}\" parameter must be provided only once`);\n    }\n    return value;\n}\nexport const skipStateCheck = Symbol();\nexport const expectNoState = Symbol();\nexport function validateAuthResponse(as, client, parameters, expectedState) {\n    assertAs(as);\n    assertClient(client);\n    if (parameters instanceof URL) {\n        parameters = parameters.searchParams;\n    }\n    if (!(parameters instanceof URLSearchParams)) {\n        throw new TypeError('\"parameters\" must be an instance of URLSearchParams, or URL');\n    }\n    if (getURLSearchParameter(parameters, 'response')) {\n        throw new OPE('\"parameters\" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()');\n    }\n    const iss = getURLSearchParameter(parameters, 'iss');\n    const state = getURLSearchParameter(parameters, 'state');\n    if (!iss && as.authorization_response_iss_parameter_supported) {\n        throw new OPE('response parameter \"iss\" (issuer) missing');\n    }\n    if (iss && iss !== as.issuer) {\n        throw new OPE('unexpected \"iss\" (issuer) response parameter value');\n    }\n    switch (expectedState) {\n        case undefined:\n        case expectNoState:\n            if (state !== undefined) {\n                throw new OPE('unexpected \"state\" response parameter encountered');\n            }\n            break;\n        case skipStateCheck:\n            break;\n        default:\n            if (!validateString(expectedState)) {\n                throw new OPE('\"expectedState\" must be a non-empty string');\n            }\n            if (state === undefined) {\n                throw new OPE('response parameter \"state\" missing');\n            }\n            if (state !== expectedState) {\n                throw new OPE('unexpected \"state\" response parameter value');\n            }\n    }\n    const error = getURLSearchParameter(parameters, 'error');\n    if (error) {\n        return {\n            error,\n            error_description: getURLSearchParameter(parameters, 'error_description'),\n            error_uri: getURLSearchParameter(parameters, 'error_uri'),\n        };\n    }\n    const id_token = getURLSearchParameter(parameters, 'id_token');\n    const token = getURLSearchParameter(parameters, 'token');\n    if (id_token !== undefined || token !== undefined) {\n        throw new UnsupportedOperationError('implicit and hybrid flows are not supported');\n    }\n    return brand(new URLSearchParams(parameters));\n}\nfunction algToSubtle(alg, crv) {\n    switch (alg) {\n        case 'PS256':\n        case 'PS384':\n        case 'PS512':\n            return { name: 'RSA-PSS', hash: `SHA-${alg.slice(-3)}` };\n        case 'RS256':\n        case 'RS384':\n        case 'RS512':\n            return { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${alg.slice(-3)}` };\n        case 'ES256':\n        case 'ES384':\n            return { name: 'ECDSA', namedCurve: `P-${alg.slice(-3)}` };\n        case 'ES512':\n            return { name: 'ECDSA', namedCurve: 'P-521' };\n        case 'EdDSA': {\n            switch (crv) {\n                case 'Ed25519':\n                case 'Ed448':\n                    return crv;\n                default:\n                    throw new UnsupportedOperationError();\n            }\n        }\n        default:\n            throw new UnsupportedOperationError();\n    }\n}\nasync function importJwk(alg, jwk) {\n    const { ext, key_ops, use, ...key } = jwk;\n    return crypto.subtle.importKey('jwk', key, algToSubtle(alg, jwk.crv), true, ['verify']);\n}\nexport async function deviceAuthorizationRequest(as, client, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'device_authorization_endpoint', options);\n    const body = new URLSearchParams(parameters);\n    body.set('client_id', client.client_id);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    return authenticatedRequest(as, client, 'POST', url, body, headers, options);\n}\nexport async function processDeviceAuthorizationResponse(as, client, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw new TypeError('\"response\" must be an instance of Response');\n    }\n    if (response.status !== 200) {\n        let err;\n        if ((err = await handleOAuthBodyError(response))) {\n            return err;\n        }\n        throw new OPE('\"response\" is not a conform Device Authorization Endpoint response');\n    }\n    assertReadableResponse(response);\n    let json;\n    try {\n        json = await response.json();\n    }\n    catch (cause) {\n        throw new OPE('failed to parse \"response\" body as JSON', { cause });\n    }\n    if (!isJsonObject(json)) {\n        throw new OPE('\"response\" body must be a top level object');\n    }\n    if (!validateString(json.device_code)) {\n        throw new OPE('\"response\" body \"device_code\" property must be a non-empty string');\n    }\n    if (!validateString(json.user_code)) {\n        throw new OPE('\"response\" body \"user_code\" property must be a non-empty string');\n    }\n    if (!validateString(json.verification_uri)) {\n        throw new OPE('\"response\" body \"verification_uri\" property must be a non-empty string');\n    }\n    if (typeof json.expires_in !== 'number' || json.expires_in <= 0) {\n        throw new OPE('\"response\" body \"expires_in\" property must be a positive number');\n    }\n    if (json.verification_uri_complete !== undefined &&\n        !validateString(json.verification_uri_complete)) {\n        throw new OPE('\"response\" body \"verification_uri_complete\" property must be a non-empty string');\n    }\n    if (json.interval !== undefined && (typeof json.interval !== 'number' || json.interval <= 0)) {\n        throw new OPE('\"response\" body \"interval\" property must be a positive number');\n    }\n    return json;\n}\nexport async function deviceCodeGrantRequest(as, client, deviceCode, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!validateString(deviceCode)) {\n        throw new TypeError('\"deviceCode\" must be a non-empty string');\n    }\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('device_code', deviceCode);\n    return tokenEndpointRequest(as, client, 'urn:ietf:params:oauth:grant-type:device_code', parameters, options);\n}\nexport async function processDeviceCodeResponse(as, client, response) {\n    return processGenericAccessTokenResponse(as, client, response);\n}\nexport async function generateKeyPair(alg, options) {\n    if (!validateString(alg)) {\n        throw new TypeError('\"alg\" must be a non-empty string');\n    }\n    const algorithm = algToSubtle(alg, alg === 'EdDSA' ? options?.crv ?? 'Ed25519' : undefined);\n    if (alg.startsWith('PS') || alg.startsWith('RS')) {\n        Object.assign(algorithm, {\n            modulusLength: options?.modulusLength ?? 2048,\n            publicExponent: new Uint8Array([0x01, 0x00, 0x01]),\n        });\n    }\n    return (crypto.subtle.generateKey(algorithm, options?.extractable ?? false, ['sign', 'verify']));\n}\nfunction normalizeHtu(htu) {\n    const url = new URL(htu);\n    url.search = '';\n    url.hash = '';\n    return url.href;\n}\nasync function validateDPoP(as, request, accessToken, accessTokenClaims, options) {\n    const header = request.headers.get('dpop');\n    if (header === null) {\n        throw new OPE('operation indicated DPoP use but the request has no DPoP HTTP Header');\n    }\n    if (request.headers.get('authorization')?.toLowerCase().startsWith('dpop ') === false) {\n        throw new OPE(`operation indicated DPoP use but the request's Authorization HTTP Header scheme is not DPoP`);\n    }\n    if (typeof accessTokenClaims.cnf?.jkt !== 'string') {\n        throw new OPE('operation indicated DPoP use but the JWT Access Token has no jkt confirmation claim');\n    }\n    const clockSkew = getClockSkew(options);\n    const proof = await validateJwt(header, checkSigningAlgorithm.bind(undefined, undefined, as?.dpop_signing_alg_values_supported || SUPPORTED_JWS_ALGS), async ({ jwk, alg }) => {\n        if (!jwk) {\n            throw new OPE('DPoP Proof is missing the jwk header parameter');\n        }\n        const key = await importJwk(alg, jwk);\n        if (key.type !== 'public') {\n            throw new OPE('DPoP Proof jwk header parameter must contain a public key');\n        }\n        return key;\n    }, clockSkew, getClockTolerance(options))\n        .then(checkJwtType.bind(undefined, 'dpop+jwt'))\n        .then(validatePresence.bind(undefined, ['iat', 'jti', 'ath', 'htm', 'htu']));\n    const now = epochTime() + clockSkew;\n    const diff = Math.abs(now - proof.claims.iat);\n    if (diff > 300) {\n        throw new OPE('DPoP Proof iat is not recent enough');\n    }\n    if (proof.claims.htm !== request.method) {\n        throw new OPE('DPoP Proof htm mismatch');\n    }\n    if (typeof proof.claims.htu !== 'string' ||\n        normalizeHtu(proof.claims.htu) !== normalizeHtu(request.url)) {\n        throw new OPE('DPoP Proof htu mismatch');\n    }\n    {\n        const expected = b64u(await crypto.subtle.digest('SHA-256', encoder.encode(accessToken)));\n        if (proof.claims.ath !== expected) {\n            throw new OPE('DPoP Proof ath mismatch');\n        }\n    }\n    {\n        let components;\n        switch (proof.header.jwk.kty) {\n            case 'EC':\n                components = {\n                    crv: proof.header.jwk.crv,\n                    kty: proof.header.jwk.kty,\n                    x: proof.header.jwk.x,\n                    y: proof.header.jwk.y,\n                };\n                break;\n            case 'OKP':\n                components = {\n                    crv: proof.header.jwk.crv,\n                    kty: proof.header.jwk.kty,\n                    x: proof.header.jwk.x,\n                };\n                break;\n            case 'RSA':\n                components = {\n                    e: proof.header.jwk.e,\n                    kty: proof.header.jwk.kty,\n                    n: proof.header.jwk.n,\n                };\n                break;\n            default:\n                throw new UnsupportedOperationError();\n        }\n        const expected = b64u(await crypto.subtle.digest('SHA-256', encoder.encode(JSON.stringify(components))));\n        if (accessTokenClaims.cnf.jkt !== expected) {\n            throw new OPE('JWT Access Token confirmation mismatch');\n        }\n    }\n}\nexport async function validateJwtAccessToken(as, request, expectedAudience, options) {\n    assertAs(as);\n    if (!looseInstanceOf(request, Request)) {\n        throw new TypeError('\"request\" must be an instance of Request');\n    }\n    if (!validateString(expectedAudience)) {\n        throw new OPE('\"expectedAudience\" must be a non-empty string');\n    }\n    const authorization = request.headers.get('authorization');\n    if (authorization === null) {\n        throw new OPE('\"request\" is missing an Authorization HTTP Header');\n    }\n    let { 0: scheme, 1: accessToken, length } = authorization.split(' ');\n    scheme = scheme.toLowerCase();\n    switch (scheme) {\n        case 'dpop':\n        case 'bearer':\n            break;\n        default:\n            throw new UnsupportedOperationError('unsupported Authorization HTTP Header scheme');\n    }\n    if (length !== 2) {\n        throw new OPE('invalid Authorization HTTP Header format');\n    }\n    const requiredClaims = [\n        'iss',\n        'exp',\n        'aud',\n        'sub',\n        'iat',\n        'jti',\n        'client_id',\n    ];\n    if (options?.requireDPoP || scheme === 'dpop' || request.headers.has('dpop')) {\n        requiredClaims.push('cnf');\n    }\n    const { claims } = await validateJwt(accessToken, checkSigningAlgorithm.bind(undefined, undefined, SUPPORTED_JWS_ALGS), getPublicSigKeyFromIssuerJwksUri.bind(undefined, as, options), getClockSkew(options), getClockTolerance(options))\n        .then(checkJwtType.bind(undefined, 'at+jwt'))\n        .then(validatePresence.bind(undefined, requiredClaims))\n        .then(validateIssuer.bind(undefined, as.issuer))\n        .then(validateAudience.bind(undefined, expectedAudience));\n    for (const claim of ['client_id', 'jti', 'sub']) {\n        if (typeof claims[claim] !== 'string') {\n            throw new OPE(`unexpected JWT \"${claim}\" claim type`);\n        }\n    }\n    if ('cnf' in claims) {\n        if (!isJsonObject(claims.cnf)) {\n            throw new OPE('unexpected JWT \"cnf\" (confirmation) claim value');\n        }\n        const { 0: cnf, length } = Object.keys(claims.cnf);\n        if (length) {\n            if (length !== 1) {\n                throw new UnsupportedOperationError('multiple confirmation claims are not supported');\n            }\n            if (cnf !== 'jkt') {\n                throw new UnsupportedOperationError('unsupported JWT Confirmation method');\n            }\n        }\n    }\n    if (options?.requireDPoP ||\n        scheme === 'dpop' ||\n        claims.cnf?.jkt !== undefined ||\n        request.headers.has('dpop')) {\n        await validateDPoP(as, request, accessToken, claims, options);\n    }\n    return claims;\n}\nexport const experimentalCustomFetch = customFetch;\nexport const experimental_customFetch = customFetch;\nexport const experimentalUseMtlsAlias = useMtlsAlias;\nexport const experimental_useMtlsAlias = useMtlsAlias;\nexport const experimental_validateDetachedSignatureResponse = validateDetachedSignatureResponse;\nexport const experimental_validateJwtAccessToken = validateJwtAccessToken;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAI;AACJ,IAAI,OAAO,cAAc,eAAe,CAAC,UAAU,WAAW,aAAa,cAAc,GAAG;AACxF,QAAM,OAAO;AACb,QAAM,UAAU;AAChB,eAAa,GAAG,IAAI,IAAI,OAAO;AACnC;AAaO,IAAM,YAAY,OAAO;AACzB,IAAM,iBAAiB,OAAO;AAC9B,IAAM,cAAc,OAAO;AAC3B,IAAM,eAAe,OAAO;AACnC,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAChC,SAAS,IAAI,OAAO;AAChB,MAAI,OAAO,UAAU,UAAU;AAC3B,WAAO,QAAQ,OAAO,KAAK;AAAA,EAC/B;AACA,SAAO,QAAQ,OAAO,KAAK;AAC/B;AACA,IAAM,aAAa;AACnB,SAAS,gBAAgB,OAAO;AAC5B,MAAI,iBAAiB,aAAa;AAC9B,YAAQ,IAAI,WAAW,KAAK;AAAA,EAChC;AACA,QAAM,MAAM,CAAC;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,YAAY,KAAK,YAAY;AACnD,QAAI,KAAK,OAAO,aAAa,MAAM,MAAM,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,CAAC;AAAA,EAC/E;AACA,SAAO,KAAK,IAAI,KAAK,EAAE,CAAC,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG;AACtF;AACA,SAAS,gBAAgB,OAAO;AAC5B,MAAI;AACA,UAAM,SAAS,KAAK,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,OAAO,EAAE,CAAC;AAClF,UAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACpC,YAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,IAClC;AACA,WAAO;AAAA,EACX,SACO,OAAO;AACV,UAAM,IAAI,IAAI,qDAAqD,EAAE,MAAM,CAAC;AAAA,EAChF;AACJ;AACA,SAAS,KAAK,OAAO;AACjB,MAAI,OAAO,UAAU,UAAU;AAC3B,WAAO,gBAAgB,KAAK;AAAA,EAChC;AACA,SAAO,gBAAgB,KAAK;AAChC;AACA,IAAM,MAAN,MAAU;AAAA,EACN,YAAY,SAAS;AACjB,SAAK,QAAQ,oBAAI,IAAI;AACrB,SAAK,SAAS,oBAAI,IAAI;AACtB,SAAK,UAAU;AAAA,EACnB;AAAA,EACA,IAAI,KAAK;AACL,QAAI,IAAI,KAAK,MAAM,IAAI,GAAG;AAC1B,QAAI,GAAG;AACH,aAAO;AAAA,IACX;AACA,QAAK,IAAI,KAAK,OAAO,IAAI,GAAG,GAAI;AAC5B,WAAK,OAAO,KAAK,CAAC;AAClB,aAAO;AAAA,IACX;AACA,WAAO;AAAA,EACX;AAAA,EACA,IAAI,KAAK;AACL,WAAO,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,OAAO,IAAI,GAAG;AAAA,EACrD;AAAA,EACA,IAAI,KAAK,OAAO;AACZ,QAAI,KAAK,MAAM,IAAI,GAAG,GAAG;AACrB,WAAK,MAAM,IAAI,KAAK,KAAK;AAAA,IAC7B,OACK;AACD,WAAK,OAAO,KAAK,KAAK;AAAA,IAC1B;AACA,WAAO;AAAA,EACX;AAAA,EACA,OAAO,KAAK;AACR,QAAI,KAAK,MAAM,IAAI,GAAG,GAAG;AACrB,aAAO,KAAK,MAAM,OAAO,GAAG;AAAA,IAChC;AACA,QAAI,KAAK,OAAO,IAAI,GAAG,GAAG;AACtB,aAAO,KAAK,OAAO,OAAO,GAAG;AAAA,IACjC;AACA,WAAO;AAAA,EACX;AAAA,EACA,OAAO,KAAK,OAAO;AACf,SAAK,MAAM,IAAI,KAAK,KAAK;AACzB,QAAI,KAAK,MAAM,QAAQ,KAAK,SAAS;AACjC,WAAK,SAAS,KAAK;AACnB,WAAK,QAAQ,oBAAI,IAAI;AAAA,IACzB;AAAA,EACJ;AACJ;AAQO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAChD,YAAY,SAAS,SAAS;AAC1B,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO,KAAK,YAAY;AAC7B,UAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA,EACpD;AACJ;AACA,IAAM,MAAM;AACZ,IAAM,aAAa,IAAI,IAAI,GAAG;AAmG9B,SAAS,eAAe,OAAO;AAC3B,SAAO,OAAO,UAAU,YAAY,MAAM,WAAW;AACzD;AA8BA,SAAS,cAAc;AACnB,SAAO,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AAC1D;AACO,SAAS,6BAA6B;AACzC,SAAO,YAAY;AACvB;AACO,SAAS,sBAAsB;AAClC,SAAO,YAAY;AACvB;AAIA,eAAsB,2BAA2B,cAAc;AAC3D,MAAI,CAAC,eAAe,YAAY,GAAG;AAC/B,UAAM,IAAI,UAAU,2CAA2C;AAAA,EACnE;AACA,SAAO,KAAK,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC;AACxE;AAiiBO,IAAM,mBAAmB,OAAO;AAmPhC,IAAM,gBAAgB,OAAO;AAC7B,IAAM,oBAAoB,OAAO;AA6RxC,IAAM,mBAAmB,OAAO;AA0QzB,IAAM,iBAAiB,OAAO;AAC9B,IAAM,gBAAgB,OAAO;;;ADzkDpC,uBAAoB;AACpB,0BAAsC;AAItC,SAAS,4BAA4B,GAAQ;AAC3C,QAAM,yBAAyB,CAAC,sCAAsC,+CAA+C;AACrH,SAAO,OAAO,GAAG,YAAY,YAAY,uBAAuB,KAAK,SAAO,EAAE,QAAQ,SAAS,GAAG,CAAC;AACrG;AAEO,SAAS,UAAU,MAA6B;AACrD,MAAI;AACF,eAAO,oBAAAA,SAAW,EAAE,IAAI,IAAI,GAAG,SAAS;AAAA,EAC1C,SAAS,GAAQ;AACf,QAAI,4BAA4B,CAAC,GAAG;AAClC,aAAO,iBAAAC,QAAQ,IAAI,IAAI,KAAK;AAAA,IAC9B,OAAO;AACL,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEO,SAAS,kBAAkB,MAAc,OAAsB,UAA4B,CAAC,GAAG;AACpG,MAAI,UAAU,MAAM;AAClB,iBAAa,IAAI;AAAA,EACnB,OAAO;AACL,cAAU,MAAM,OAAO,OAAO;AAAA,EAChC;AACF;AAEO,SAAS,aAAa,MAAc;AACzC,MAAI;AACF,4BAAAD,SAAW,EAAE,OAAO,IAAI;AAAA,EAC1B,SAAS,GAAQ;AACf,QAAI,4BAA4B,CAAC,GAAG;AAClC,uBAAAC,QAAQ,OAAO,IAAI;AAAA,IACrB,OAAO;AACL,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEO,SAAS,UAAU,MAAc,OAAe,UAA4B,CAAC,GAAG;AACrF,MAAI;AACF,4BAAAD,SAAW,EAAE,IAAI,MAAM,OAAO;AAAA,MAC5B,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH,SAAS,GAAQ;AACf,QAAI,4BAA4B,CAAC,GAAG;AAClC,uBAAAC,QAAQ,IAAI,MAAM,OAAO;AAAA,QACvB,QAAQ,OAAO,SAAS,aAAa;AAAA,QACrC,SAAS,QAAQ,WAAW,SAAY,SAAY,IAAI,KAAK,KAAK,IAAI,IAAK,QAAQ,SAAU,GAAI;AAAA,MACnG,CAAC;AAAA,IACH,OAAO;AACL,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAsB,uBAAuB;AAC3C,QAAM,eAAe,2BAA2B;AAChD,QAAM,gBAAgB,MAAM,2BAA2B,YAAY;AACnE,QAAM,QAAQ,oBAAoB;AAElC,YAAU,uBAAuB,cAAc,EAAE,QAAQ,KAAK,GAAG,CAAC;AAClE,YAAU,eAAe,OAAO,EAAE,QAAQ,KAAK,GAAG,CAAC;AAEnD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,sBAAsB;AACpC,QAAM,eAAe,UAAU,qBAAqB;AACpD,QAAM,QAAQ,UAAU,aAAa;AACrC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;","names":["rscCookies","Cookies"]}

package/dist/lib/hooks.d.mts

@@ -3,6 +3,7 @@ import '@stackframe/stack-shared';
 import '@stackframe/stack-shared/dist/interface/clientInterface';
 import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/interface/adminInterface';
+import '@stackframe/stack-shared/dist/interface/serverInterface';
 
 /**
  * Returns the current user object. Equivalent to `useStackApp().useUser()`.

package/dist/lib/hooks.d.ts

@@ -3,6 +3,7 @@ import '@stackframe/stack-shared';
 import '@stackframe/stack-shared/dist/interface/clientInterface';
 import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/interface/adminInterface';
+import '@stackframe/stack-shared/dist/interface/serverInterface';
 
 /**
  * Returns the current user object. Equivalent to `useStackApp().useUser()`.

package/dist/lib/hooks.js

@@ -53,3 +53,4 @@ function useStackApp(options = {}) {
   useStackApp,
   useUser
 });
+//# sourceMappingURL=hooks.js.map

package/dist/lib/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/hooks.ts"],"sourcesContent":["import { CurrentUser, GetUserOptions as AppGetUserOptions, StackClientApp, CurrentInternalUser } from \"./stack-app\";\nimport { StackContext } from \"../providers/stack-provider-client\";\nimport { useContext } from \"react\";\n\n/**\n * Returns the current user object. Equivalent to `useStackApp().useUser()`.\n * \n * @returns the current user\n */\n\ntype GetUserOptions = AppGetUserOptions & {\n  projectIdMustMatch?: string,\n}\n\nexport function useUser(options: GetUserOptions & { or: 'redirect' | 'throw', projectIdMustMatch: \"internal\" }): CurrentInternalUser;\nexport function useUser(options: GetUserOptions & { or: 'redirect' | 'throw' }): CurrentUser;\nexport function useUser(options: GetUserOptions & { projectIdMustMatch: \"internal\" }): CurrentInternalUser | null;\nexport function useUser(options?: GetUserOptions): CurrentUser | CurrentInternalUser | null;\nexport function useUser(options: GetUserOptions = {}): CurrentUser | CurrentInternalUser | null {\n  const stackApp = useStackApp(options);\n  if (options.projectIdMustMatch && stackApp.projectId !== options.projectIdMustMatch) {\n    throw new Error(\"Unexpected project ID in useStackApp: \" + stackApp.projectId);\n  }\n  if (options.projectIdMustMatch === \"internal\") {\n    return stackApp.useUser(options) as CurrentInternalUser;\n  } else {\n    return stackApp.useUser(options) as CurrentUser;\n  }\n}\n\n/**\n * Returns the current Stack app associated with the StackProvider.\n * \n * @returns the current Stack app\n */\nexport function useStackApp<ProjectId extends string>(options: { projectIdMustMatch?: ProjectId } = {}): StackClientApp<true, ProjectId> {\n  const context = useContext(StackContext);\n  if (context === null) {\n    throw new Error(\"useStackApp must be used within a StackProvider\");\n  }\n  const stackApp = context.app;\n  if (options.projectIdMustMatch && stackApp.projectId !== options.projectIdMustMatch) {\n    throw new Error(\"Unexpected project ID in useStackApp: \" + stackApp.projectId);\n  }\n  return stackApp as StackClientApp<true, ProjectId>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,mCAA6B;AAC7B,mBAA2B;AAgBpB,SAAS,QAAQ,UAA0B,CAAC,GAA6C;AAC9F,QAAM,WAAW,YAAY,OAAO;AACpC,MAAI,QAAQ,sBAAsB,SAAS,cAAc,QAAQ,oBAAoB;AACnF,UAAM,IAAI,MAAM,2CAA2C,SAAS,SAAS;AAAA,EAC/E;AACA,MAAI,QAAQ,uBAAuB,YAAY;AAC7C,WAAO,SAAS,QAAQ,OAAO;AAAA,EACjC,OAAO;AACL,WAAO,SAAS,QAAQ,OAAO;AAAA,EACjC;AACF;AAOO,SAAS,YAAsC,UAA8C,CAAC,GAAoC;AACvI,QAAM,cAAU,yBAAW,yCAAY;AACvC,MAAI,YAAY,MAAM;AACpB,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,WAAW,QAAQ;AACzB,MAAI,QAAQ,sBAAsB,SAAS,cAAc,QAAQ,oBAAoB;AACnF,UAAM,IAAI,MAAM,2CAA2C,SAAS,SAAS;AAAA,EAC/E;AACA,SAAO;AACT;","names":[]}