@syndew/oluso-sdk 0.0.0-stage → 0.1.0

package/dist/index.mjs

@@ -0,0 +1,2095 @@
+// src/client.ts
+var OlusoClient = class {
+  constructor(config) {
+    this.listeners = /* @__PURE__ */ new Map();
+    if (!config.serverUrl) {
+      throw new Error("serverUrl is required");
+    }
+    this.config = {
+      ...config,
+      serverUrl: config.serverUrl.replace(/\/$/, "")
+      // Remove trailing slash
+    };
+    this.fetchFn = config.fetch || globalThis.fetch.bind(globalThis);
+  }
+  /**
+   * Get journey information including form fields. Journeys are named by slug.
+   */
+  async getJourney(slug) {
+    const response = await this.request(`/api/public/journeys/${encodeURIComponent(slug)}`);
+    return response;
+  }
+  /**
+   * Submit data to a data collection journey (waitlist, contact, survey, etc.)
+   */
+  async submit(slug, data, options) {
+    try {
+      const result = await this.request(`/api/public/journeys/${encodeURIComponent(slug)}/submit`, {
+        method: "POST",
+        body: {
+          data,
+          metadata: {
+            ...options?.metadata,
+            referrer: typeof document !== "undefined" ? document.referrer : void 0,
+            userAgent: typeof navigator !== "undefined" ? navigator.userAgent : void 0
+          },
+          honeypot: options?.honeypot
+        }
+      });
+      this.emit({
+        type: "submission:success",
+        slug,
+        data: result
+      });
+      return result;
+    } catch (error) {
+      this.emit({
+        type: "submission:error",
+        slug,
+        error: error instanceof Error ? error : new Error(String(error))
+      });
+      throw error;
+    }
+  }
+  /**
+   * Start a multi-step journey and run its first step. Without data the session's `step`
+   * is the first step to render; with data, that is the first step's input.
+   */
+  async startJourney(slug, data) {
+    const session = await this.request(
+      `/api/public/journeys/${encodeURIComponent(slug)}/start`,
+      { method: "POST", body: { data } }
+    );
+    this.emit({
+      type: "journey:started",
+      slug: session.slug,
+      sessionId: session.sessionId,
+      data: session
+    });
+    return session;
+  }
+  /**
+   * Start a sign-in (or any authentication) journey for a public client. When the session completes it carries an
+   * authorization code, redeemed at the token endpoint with the PKCE verifier and redirect_uri "postmessage". Use
+   * this when your app keeps its own tokens; OlusoAuth.mountSignIn does the whole round trip for you.
+   */
+  async startAuthJourney(slug, auth, data) {
+    const session = await this.request(
+      `/api/public/journeys/${encodeURIComponent(slug)}/start`,
+      {
+        method: "POST",
+        body: { data, clientId: auth.clientId, codeChallenge: auth.codeChallenge, codeChallengeMethod: "S256", scope: auth.scope }
+      }
+    );
+    this.emit({ type: "journey:started", slug: session.slug, sessionId: session.sessionId, data: session });
+    return session;
+  }
+  /**
+   * Submit input (or an action such as "resend") for the session's current step.
+   * The result is the session afterwards: the next step to render, or the completion.
+   */
+  async submitStep(sessionId, data, action) {
+    const result = await this.request(
+      `/api/public/journeys/sessions/${encodeURIComponent(sessionId)}/step`,
+      { method: "POST", body: { data, action } }
+    );
+    this.emit({
+      type: result.completed ? "journey:completed" : result.success ? "journey:step" : "journey:error",
+      slug: result.slug,
+      sessionId,
+      data: result
+    });
+    return result;
+  }
+  /**
+   * Submit the current step the way a form posts it: every field, files under their field's name, and the
+   * clicked button's name and value. Use this for steps with file fields; `action` is a step action such as "init".
+   */
+  async submitStepForm(sessionId, form, action) {
+    if (action) form.set("__journey_action", action);
+    const result = await this.request(
+      `/api/public/journeys/sessions/${encodeURIComponent(sessionId)}/step`,
+      { method: "POST", body: form }
+    );
+    this.emit({
+      type: result.completed ? "journey:completed" : result.success ? "journey:step" : "journey:error",
+      slug: result.slug,
+      sessionId,
+      data: result
+    });
+    return result;
+  }
+  /** The server this client talks to */
+  get serverUrl() {
+    return this.config.serverUrl;
+  }
+  /**
+   * Get where a multi-step session stands (status, current step), without running it
+   */
+  async getSession(sessionId) {
+    return this.request(`/api/public/journeys/sessions/${encodeURIComponent(sessionId)}`);
+  }
+  /**
+   * URL of the hosted journey page (/journey/start/{slug}) to redirect to
+   */
+  getJourneyUrl(slug, options) {
+    const params = new URLSearchParams();
+    if (this.config.tenant) params.set("tenant", this.config.tenant);
+    if (options?.redirectUri) {
+      params.set("redirect_uri", options.redirectUri);
+    }
+    if (options?.state) {
+      params.set("state", options.state);
+    }
+    return `${this.config.serverUrl}/journey/start/${encodeURIComponent(slug)}?${params}`;
+  }
+  /**
+   * URL of the hosted journey page (/journey/start/{slug}) for an iframe
+   */
+  getEmbedUrl(slug, options) {
+    const params = new URLSearchParams({ embed: "true" });
+    if (this.config.tenant) params.set("tenant", this.config.tenant);
+    if (options?.theme) {
+      params.set("theme", options.theme);
+    }
+    if (options?.hideHeader) {
+      params.set("hideHeader", "true");
+    }
+    return `${this.config.serverUrl}/journey/start/${encodeURIComponent(slug)}?${params}`;
+  }
+  /**
+   * Subscribe to SDK events
+   */
+  on(event, listener) {
+    if (!this.listeners.has(event)) {
+      this.listeners.set(event, /* @__PURE__ */ new Set());
+    }
+    this.listeners.get(event).add(listener);
+    return () => {
+      this.listeners.get(event)?.delete(listener);
+    };
+  }
+  /**
+   * Unsubscribe from SDK events
+   */
+  off(event, listener) {
+    this.listeners.get(event)?.delete(listener);
+  }
+  emit(event) {
+    this.listeners.get(event.type)?.forEach((listener) => listener(event));
+    this.listeners.get("*")?.forEach((listener) => listener(event));
+  }
+  async request(path, options) {
+    const url = `${this.config.serverUrl}${path}`;
+    const method = options?.method || "GET";
+    const isForm = typeof FormData !== "undefined" && options?.body instanceof FormData;
+    const headers = {};
+    if (this.config.tenant) {
+      headers["X-Tenant-ID"] = this.config.tenant;
+    }
+    if (!isForm) {
+      headers["Content-Type"] = "application/json";
+    }
+    if (this.config.apiKey) {
+      headers["X-API-Key"] = this.config.apiKey;
+    }
+    if (this.config.headers) {
+      Object.assign(headers, await this.config.headers({ method, url }));
+    }
+    const response = await this.fetchFn(url, {
+      method,
+      headers,
+      body: options?.body === void 0 ? void 0 : isForm ? options.body : JSON.stringify(options.body),
+      credentials: "include"
+      // Include cookies for session management
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ message: response.statusText }));
+      throw new OlusoError(
+        error.message || `Request failed: ${response.status}`,
+        response.status,
+        error.code,
+        error.errors
+      );
+    }
+    return response.json();
+  }
+};
+var OlusoError = class extends Error {
+  constructor(message, status, code, fieldErrors) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.fieldErrors = fieldErrors;
+    this.name = "OlusoError";
+  }
+};
+
+// src/journey/conditions.ts
+var ALIASES = {
+  eq: "eq",
+  equals: "eq",
+  "==": "eq",
+  "=": "eq",
+  ne: "ne",
+  neq: "ne",
+  notequals: "ne",
+  "!=": "ne",
+  gt: "gt",
+  ">": "gt",
+  greaterthan: "gt",
+  gte: "gte",
+  ">=": "gte",
+  greaterthanorequals: "gte",
+  lt: "lt",
+  "<": "lt",
+  lessthan: "lt",
+  lte: "lte",
+  "<=": "lte",
+  lessthanorequals: "lte",
+  contains: "contains",
+  notcontains: "not_contains",
+  "!contains": "not_contains",
+  startswith: "starts_with",
+  endswith: "ends_with",
+  exists: "exists",
+  notnull: "exists",
+  isset: "exists",
+  notexists: "not_exists",
+  null: "not_exists",
+  isnotset: "not_exists",
+  empty: "empty",
+  notempty: "not_empty",
+  in: "in",
+  notin: "not_in",
+  "!in": "not_in",
+  regex: "regex",
+  matches: "regex",
+  true: "true",
+  false: "false"
+};
+function normalizeOperator(op) {
+  if (!op) return void 0;
+  return ALIASES[op.trim().toLowerCase().replace(/_/g, "")];
+}
+var same = (a, b) => a.localeCompare(b, void 0, { sensitivity: "accent" }) === 0;
+function order(actual, expected) {
+  if (expected === void 0) return void 0;
+  const a = Number(actual);
+  const e = Number(expected);
+  if (actual.trim() !== "" && expected.trim() !== "" && !Number.isNaN(a) && !Number.isNaN(e)) return a === e ? 0 : a < e ? -1 : 1;
+  const ad = Date.parse(actual);
+  const ed = Date.parse(expected);
+  if (!Number.isNaN(ad) && !Number.isNaN(ed)) return ad === ed ? 0 : ad < ed ? -1 : 1;
+  return actual.localeCompare(expected, void 0, { sensitivity: "accent" });
+}
+function compare(actual, op, expected) {
+  const lower = actual.toLowerCase();
+  const want = (expected ?? "").toLowerCase();
+  switch (op) {
+    case "eq":
+      return same(actual, expected ?? "");
+    case "ne":
+      return !same(actual, expected ?? "");
+    case "gt": {
+      const o = order(actual, expected);
+      return o !== void 0 && o > 0;
+    }
+    case "gte": {
+      const o = order(actual, expected);
+      return o !== void 0 && o >= 0;
+    }
+    case "lt": {
+      const o = order(actual, expected);
+      return o !== void 0 && o < 0;
+    }
+    case "lte": {
+      const o = order(actual, expected);
+      return o !== void 0 && o <= 0;
+    }
+    case "contains":
+      return lower.includes(want);
+    case "not_contains":
+      return !lower.includes(want);
+    case "starts_with":
+      return lower.startsWith(want);
+    case "ends_with":
+      return lower.endsWith(want);
+    case "regex":
+      if (!expected) return false;
+      try {
+        return new RegExp(expected, "i").test(actual);
+      } catch {
+        return false;
+      }
+    default:
+      return false;
+  }
+}
+function expectedList(expected) {
+  if (!expected || !expected.trim()) return [];
+  const trimmed = expected.trim();
+  if (trimmed.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (Array.isArray(parsed)) return parsed.map(String);
+    } catch {
+      return [];
+    }
+  }
+  return trimmed.split(",").map((v) => v.trim()).filter(Boolean);
+}
+var truthy = (v) => v.toLowerCase() !== "false" && v !== "0";
+function conditionMet(condition, values) {
+  const op = normalizeOperator(condition.operator);
+  const present = values.filter((v) => v !== "");
+  const members = () => present.flatMap((v) => v.split(",").map((p) => p.trim()).filter(Boolean));
+  switch (op) {
+    case "exists":
+    case "not_empty":
+      return present.length > 0;
+    case "not_exists":
+    case "empty":
+      return present.length === 0;
+    case "ne":
+      return !present.some((v) => compare(v, "eq", condition.value));
+    case "not_contains":
+      return !present.some((v) => compare(v, "contains", condition.value));
+    case "in": {
+      const list = expectedList(condition.value);
+      return members().some((m) => list.some((e) => same(m, e)));
+    }
+    case "not_in": {
+      const list = expectedList(condition.value);
+      return !members().some((m) => list.some((e) => same(m, e)));
+    }
+    case "true":
+      return present.some(truthy);
+    case "false":
+      return !present.some(truthy);
+    case void 0:
+      return false;
+    default:
+      return present.some((v) => compare(v, op, condition.value));
+  }
+}
+
+// src/journey/styles.ts
+var JOURNEY_STYLES = `
+.oluso-journey {
+  --oluso-accent: #4f46e5;
+  --oluso-accent-contrast: #ffffff;
+  --oluso-fg: #111827;
+  --oluso-muted: #6b7280;
+  --oluso-bg: #ffffff;
+  --oluso-field-bg: #ffffff;
+  --oluso-border: #d1d5db;
+  --oluso-danger: #b91c1c;
+  --oluso-danger-bg: #fef2f2;
+  --oluso-notice-bg: #eff6ff;
+  --oluso-notice: #1d4ed8;
+  --oluso-radius: 8px;
+  --oluso-gap: 14px;
+  --oluso-font: inherit;
+  font-family: var(--oluso-font);
+  color: var(--oluso-fg);
+  font-size: 15px;
+  line-height: 1.5;
+}
+.oluso-journey[data-theme="dark"] {
+  --oluso-fg: #f3f4f6;
+  --oluso-muted: #9ca3af;
+  --oluso-bg: #111827;
+  --oluso-field-bg: #1f2937;
+  --oluso-border: #374151;
+  --oluso-danger: #fca5a5;
+  --oluso-danger-bg: rgba(185, 28, 28, 0.15);
+  --oluso-notice-bg: rgba(59, 130, 246, 0.15);
+  --oluso-notice: #93c5fd;
+}
+@media (prefers-color-scheme: dark) {
+  .oluso-journey[data-theme="auto"] {
+    --oluso-fg: #f3f4f6;
+    --oluso-muted: #9ca3af;
+    --oluso-bg: #111827;
+    --oluso-field-bg: #1f2937;
+    --oluso-border: #374151;
+    --oluso-danger: #fca5a5;
+    --oluso-danger-bg: rgba(185, 28, 28, 0.15);
+    --oluso-notice-bg: rgba(59, 130, 246, 0.15);
+    --oluso-notice: #93c5fd;
+  }
+}
+.oluso-journey *, .oluso-journey *::before, .oluso-journey *::after { box-sizing: border-box; }
+.oluso-journey__form { display: flex; flex-direction: column; gap: var(--oluso-gap); margin: 0; }
+.oluso-journey__title { font-size: 1.25em; font-weight: 600; margin: 0; }
+.oluso-journey__description { color: var(--oluso-muted); margin: 0; white-space: pre-line; }
+.oluso-journey__alert { border-radius: var(--oluso-radius); padding: 10px 12px; margin: 0; }
+.oluso-journey__alert--error { background: var(--oluso-danger-bg); color: var(--oluso-danger); }
+.oluso-journey__alert--notice { background: var(--oluso-notice-bg); color: var(--oluso-notice); }
+.oluso-journey__group { display: flex; flex-direction: column; gap: var(--oluso-gap); border: 0; margin: 0; padding: 0; }
+.oluso-journey__field { display: flex; flex-direction: column; gap: 6px; }
+.oluso-journey__field[hidden] { display: none; }
+.oluso-journey__label { font-weight: 500; }
+.oluso-journey__required { color: var(--oluso-danger); margin-left: 2px; }
+.oluso-journey__input, .oluso-journey__select, .oluso-journey__textarea {
+  width: 100%; font: inherit; color: var(--oluso-fg); background: var(--oluso-field-bg);
+  border: 1px solid var(--oluso-border); border-radius: var(--oluso-radius); padding: 9px 11px; min-height: 40px;
+}
+.oluso-journey__input:focus, .oluso-journey__select:focus, .oluso-journey__textarea:focus {
+  outline: 2px solid var(--oluso-accent); outline-offset: 1px; border-color: transparent;
+}
+.oluso-journey__input[aria-invalid="true"], .oluso-journey__select[aria-invalid="true"], .oluso-journey__textarea[aria-invalid="true"] {
+  border-color: var(--oluso-danger);
+}
+.oluso-journey__input--otp { letter-spacing: 0.4em; font-variant-numeric: tabular-nums; text-align: center; font-size: 1.2em; }
+.oluso-journey__phone { display: flex; gap: 8px; }
+.oluso-journey__phone .oluso-journey__select { width: auto; max-width: 45%; }
+.oluso-journey__choices { display: flex; flex-direction: column; gap: 8px; }
+.oluso-journey__choice { display: flex; gap: 10px; align-items: flex-start; cursor: pointer; }
+.oluso-journey__choice input { margin-top: 3px; accent-color: var(--oluso-accent); }
+.oluso-journey__choice-description { display: block; color: var(--oluso-muted); font-size: 0.9em; }
+.oluso-journey__help, .oluso-journey__hint { color: var(--oluso-muted); font-size: 0.875em; margin: 0; }
+.oluso-journey__error { color: var(--oluso-danger); font-size: 0.875em; margin: 0; }
+.oluso-journey__content { margin: 0; white-space: pre-line; }
+.oluso-journey__actions { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; }
+.oluso-journey__button {
+  font: inherit; font-weight: 500; border-radius: var(--oluso-radius); padding: 9px 16px; min-height: 40px; cursor: pointer;
+  border: 1px solid var(--oluso-border); background: var(--oluso-field-bg); color: var(--oluso-fg);
+}
+.oluso-journey__button--primary { background: var(--oluso-accent); color: var(--oluso-accent-contrast); border-color: var(--oluso-accent); }
+.oluso-journey__button--primary:only-child, .oluso-journey__actions--stacked .oluso-journey__button--primary { flex: 1 1 auto; }
+.oluso-journey__button--link { background: none; border: 0; color: var(--oluso-accent); padding: 4px 0; min-height: 0; }
+.oluso-journey__button--cancel { background: none; }
+.oluso-journey__button:disabled { opacity: 0.6; cursor: progress; }
+.oluso-journey__enter { position: absolute; left: -10000px; width: 1px; height: 1px; overflow: hidden; }
+.oluso-journey__action-line { display: flex; flex-wrap: wrap; gap: 6px; align-items: baseline; margin: 0; }
+.oluso-journey__links { display: flex; flex-wrap: wrap; gap: 12px; font-size: 0.9em; }
+.oluso-journey__links a { color: var(--oluso-accent); }
+.oluso-journey__qr { display: flex; flex-direction: column; align-items: center; gap: 8px; }
+.oluso-journey__qr img { width: 180px; height: 180px; background: #fff; padding: 8px; border-radius: var(--oluso-radius); }
+.oluso-journey__code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; word-break: break-all; }
+.oluso-journey__codes { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 6px; margin: 0; padding: 0; list-style: none; }
+.oluso-journey__codes li { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; padding: 6px 8px; border: 1px solid var(--oluso-border); border-radius: 6px; text-align: center; }
+.oluso-journey__status { color: var(--oluso-muted); text-align: center; padding: 16px 0; }
+.oluso-journey__done { text-align: center; padding: 8px 0; }
+`;
+var injected = false;
+function injectJourneyStyles() {
+  if (injected || typeof document === "undefined") return;
+  const style = document.createElement("style");
+  style.setAttribute("data-oluso-journey", "");
+  style.textContent = JOURNEY_STYLES;
+  document.head.appendChild(style);
+  injected = true;
+}
+
+// src/journey/webauthn.ts
+function base64UrlToBuffer(value) {
+  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes.buffer;
+}
+function bufferToBase64Url(buffer) {
+  if (!buffer) return null;
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function credentialDescriptors(list) {
+  if (!Array.isArray(list)) return void 0;
+  return list.map((c) => ({
+    type: c.type ?? "public-key",
+    id: base64UrlToBuffer(String(c.id)),
+    transports: c.transports
+  }));
+}
+function requestOptions(publicKey) {
+  return {
+    ...publicKey,
+    challenge: base64UrlToBuffer(String(publicKey.challenge)),
+    allowCredentials: credentialDescriptors(publicKey.allowCredentials)
+  };
+}
+function creationOptions(publicKey) {
+  const user = publicKey.user ?? {};
+  return {
+    ...publicKey,
+    challenge: base64UrlToBuffer(String(publicKey.challenge)),
+    user: { ...user, id: base64UrlToBuffer(String(user.id)) },
+    excludeCredentials: credentialDescriptors(publicKey.excludeCredentials)
+  };
+}
+async function getAssertion(publicKey) {
+  const credential = await navigator.credentials.get({ publicKey: requestOptions(publicKey) });
+  if (!credential) throw new Error("No passkey was chosen");
+  const response = credential.response;
+  return JSON.stringify({
+    id: credential.id,
+    rawId: bufferToBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: bufferToBase64Url(response.clientDataJSON),
+      authenticatorData: bufferToBase64Url(response.authenticatorData),
+      signature: bufferToBase64Url(response.signature),
+      userHandle: bufferToBase64Url(response.userHandle)
+    },
+    authenticatorAttachment: credential.authenticatorAttachment ?? null
+  });
+}
+async function createCredential(publicKey) {
+  const credential = await navigator.credentials.create({ publicKey: creationOptions(publicKey) });
+  if (!credential) throw new Error("No passkey was created");
+  const response = credential.response;
+  return JSON.stringify({
+    id: credential.id,
+    rawId: bufferToBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: bufferToBase64Url(response.clientDataJSON),
+      attestationObject: bufferToBase64Url(response.attestationObject),
+      transports: typeof response.getTransports === "function" ? response.getTransports() : void 0
+    },
+    authenticatorAttachment: credential.authenticatorAttachment ?? null
+  });
+}
+
+// src/journey/render.ts
+var DEFAULT_LABELS = {
+  loading: "Loading\u2026",
+  completed: "All done. Thank you.",
+  failed: "Something went wrong. Please try again.",
+  expired: "This session has expired. Please start again.",
+  restart: "Start again",
+  takePhoto: "Take a photo",
+  copy: "Copy",
+  copied: "Copied",
+  passkey: "Use your passkey",
+  retry: "Try again",
+  waiting: "Waiting\u2026",
+  unavailable: "This step can\u2019t be shown here."
+};
+function el(tag, className, text) {
+  const node = document.createElement(tag);
+  if (className) node.className = className;
+  if (text !== void 0) node.textContent = text;
+  return node;
+}
+var uid = 0;
+function mountJourney(container, options) {
+  const labels = { ...DEFAULT_LABELS, ...options.labels };
+  const client = options.client;
+  const id = `oluso-j${++uid}`;
+  let session;
+  let destroyed = false;
+  let timers = [];
+  if (!options.unstyled) injectJourneyStyles();
+  const root = el("div", "oluso-journey");
+  root.setAttribute("data-theme", options.theme ?? "auto");
+  container.appendChild(root);
+  const clearTimers = () => {
+    timers.forEach((t) => window.clearInterval(t));
+    timers = [];
+  };
+  const status = (text) => {
+    root.replaceChildren(el("p", "oluso-journey__status", text));
+  };
+  const fail = (error) => {
+    const err = error instanceof Error ? error : new Error(String(error));
+    options.onError?.(err, session);
+    return err;
+  };
+  const canRestart = () => Boolean(options.slug || options.start);
+  const begin = async () => {
+    clearTimers();
+    status(labels.loading);
+    try {
+      const started = options.start ? await options.start() : options.slug ? await client.startJourney(options.slug, options.data) : options.session;
+      if (!started) throw new Error("mountJourney needs a slug, a session or a start function");
+      await show(started);
+    } catch (error) {
+      showProblem(fail(error).message);
+    }
+  };
+  const show = async (next) => {
+    if (destroyed) return;
+    clearTimers();
+    session = next;
+    options.onStep?.(next);
+    if (next.completed) {
+      if (next.redirectUrl) {
+        await options.onComplete?.(next);
+        redirect(next.redirectUrl, next);
+        return;
+      }
+      if (options.showCompletion !== false) {
+        const done = el("div", "oluso-journey__done");
+        done.appendChild(el("p", "oluso-journey__content", next.message || labels.completed));
+        root.replaceChildren(done);
+      } else {
+        root.replaceChildren();
+      }
+      await options.onComplete?.(next);
+      return;
+    }
+    if (next.status !== "in_progress") {
+      const message = next.status === "expired" ? labels.expired : next.errorDescription || labels.failed;
+      fail(new Error(message));
+      showProblem(message);
+      return;
+    }
+    if (next.redirectUrl) {
+      redirect(next.redirectUrl, next);
+      return;
+    }
+    if (next.step?.form) {
+      renderForm(next.step.form);
+    } else if (next.step?.html) {
+      renderHtml(next.step.html);
+    } else {
+      showProblem(labels.unavailable);
+    }
+  };
+  const redirect = (url, current) => {
+    if (options.onRedirect) options.onRedirect(url, current);
+    else window.location.assign(url);
+  };
+  const showProblem = (message) => {
+    const box = el("div", "oluso-journey__form");
+    box.appendChild(el("p", "oluso-journey__alert oluso-journey__alert--error", message));
+    if (canRestart()) {
+      const again = el("button", "oluso-journey__button oluso-journey__button--primary", labels.restart);
+      again.type = "button";
+      again.addEventListener("click", () => void begin());
+      const row = el("div", "oluso-journey__actions");
+      row.appendChild(again);
+      box.appendChild(row);
+    }
+    root.replaceChildren(box);
+  };
+  const post = async (form, action) => {
+    if (!session) return;
+    const next = await client.submitStepForm(session.sessionId, form, action);
+    await show(next);
+  };
+  const submitting = (form, busy) => {
+    form.setAttribute("aria-busy", String(busy));
+    form.querySelectorAll("button").forEach((b) => b.disabled = busy);
+  };
+  const send = async (form, action, extra) => {
+    const data = action?.postsFields === false ? new FormData() : new FormData(form);
+    if (action?.name) data.append(action.name, action.value ?? "");
+    if (action?.values) for (const [k, v] of Object.entries(action.values)) data.append(k, v);
+    if (extra) for (const [k, v] of Object.entries(extra)) data.set(k, v);
+    submitting(form, true);
+    try {
+      await post(data);
+    } catch (error) {
+      submitting(form, false);
+      const message = fail(error).message;
+      let alert = form.querySelector("[data-oluso-request-error]");
+      if (!alert) {
+        alert = el("p", "oluso-journey__alert oluso-journey__alert--error");
+        alert.setAttribute("data-oluso-request-error", "");
+        alert.setAttribute("role", "alert");
+        form.prepend(alert);
+      }
+      alert.textContent = message;
+    }
+  };
+  const renderForm = (step) => {
+    const form = el("form", "oluso-journey__form");
+    if (step.title) form.appendChild(el("h2", "oluso-journey__title", step.title));
+    if (step.description) form.appendChild(el("p", "oluso-journey__description", step.description));
+    if (step.error) {
+      const alert = el("p", "oluso-journey__alert oluso-journey__alert--error", step.error);
+      alert.setAttribute("role", "alert");
+      form.appendChild(alert);
+    }
+    if (step.notice) {
+      const notice = el("p", "oluso-journey__alert oluso-journey__alert--notice", step.notice);
+      notice.setAttribute("role", "status");
+      form.appendChild(notice);
+    }
+    const wrappers = [];
+    for (const field of step.fields) {
+      const rendered = renderField(field);
+      if (!rendered) continue;
+      form.appendChild(rendered);
+      if (field.showWhen || field.showWhenAll?.length) wrappers.push({ field, wrapper: rendered });
+    }
+    if (step.widget) {
+      const widget = renderWidget(step.widget, form);
+      if (widget) form.appendChild(widget);
+    }
+    if (step.links.length > 0) {
+      const links = el("div", "oluso-journey__links");
+      for (const link of step.links) {
+        const a = el("a", void 0, link.label);
+        a.href = link.url;
+        a.target = "_blank";
+        a.rel = "noopener noreferrer";
+        links.appendChild(a);
+      }
+      form.appendChild(links);
+    }
+    if (step.actions.length > 0) {
+      const row = el("div", "oluso-journey__actions");
+      const primary = step.actions.findIndex((a) => a.kind === "primary");
+      if (primary >= 0) {
+        const enter = el("button", "oluso-journey__enter");
+        enter.type = "submit";
+        enter.tabIndex = -1;
+        enter.setAttribute("aria-hidden", "true");
+        enter.dataset.olusoAction = String(primary);
+        form.prepend(enter);
+      }
+      const described = [];
+      step.actions.forEach((action, index) => {
+        const button = el("button", `oluso-journey__button oluso-journey__button--${action.kind}`, action.label);
+        button.type = "submit";
+        button.formNoValidate = action.skipValidation || action.postsFields === false;
+        button.dataset.olusoAction = String(index);
+        if (action.description) {
+          const line = el("p", "oluso-journey__action-line");
+          line.appendChild(el("span", "oluso-journey__help", action.description));
+          line.appendChild(button);
+          described.push(line);
+        } else {
+          row.appendChild(button);
+        }
+      });
+      if (row.childElementCount > 0) form.appendChild(row);
+      described.forEach((line) => form.appendChild(line));
+    }
+    const applyConditions = () => {
+      for (const { field, wrapper } of wrappers) {
+        const conditions = [...field.showWhen ? [field.showWhen] : [], ...field.showWhenAll ?? []];
+        const shown = conditions.every((c) => conditionMet(c, currentValues(form.elements.namedItem(c.field))));
+        wrapper.hidden = !shown;
+        wrapper.querySelectorAll("input, select, textarea").forEach((input) => {
+          input.disabled = !shown || input.dataset.olusoReadonly === "true";
+        });
+      }
+    };
+    form.addEventListener("input", (event) => {
+      applyConditions();
+      const target = event.target;
+      const wrapper = target.closest(".oluso-journey__field");
+      wrapper?.querySelectorAll('[aria-invalid="true"]').forEach((n) => n.removeAttribute("aria-invalid"));
+      wrapper?.querySelector(".oluso-journey__error")?.remove();
+    });
+    form.addEventListener("change", applyConditions);
+    applyConditions();
+    form.addEventListener("submit", (event) => {
+      event.preventDefault();
+      const submitter = event.submitter;
+      const index = submitter?.dataset.olusoAction;
+      const action = index !== void 0 ? step.actions[Number(index)] : step.actions.find((a) => a.kind === "primary");
+      if (action?.confirm && submitter && submitter.dataset.olusoConfirming !== "true") {
+        submitter.dataset.olusoConfirming = "true";
+        submitter.textContent = action.confirm;
+        submitter.setAttribute("aria-live", "polite");
+        return;
+      }
+      void send(form, action);
+    });
+    root.replaceChildren(form);
+    const focus = form.querySelector("[autofocus]") ?? form.querySelector("input:not([type=hidden]):not([disabled]), select, textarea");
+    focus?.focus({ preventScroll: true });
+  };
+  const renderField = (field) => {
+    const fieldId = `${id}-${field.name}`;
+    if (field.type === "hidden") {
+      const input = el("input");
+      input.type = "hidden";
+      input.name = field.name;
+      input.value = field.value ?? "";
+      return input;
+    }
+    const wrapper = el("div", "oluso-journey__field");
+    if (field.group) wrapper.dataset.group = field.group;
+    if (field.type === "content") {
+      if (field.label) wrapper.appendChild(el("p", "oluso-journey__label", field.label));
+      wrapper.appendChild(el("p", "oluso-journey__content", field.value ?? ""));
+      return wrapper;
+    }
+    const label = () => {
+      if (!field.label) return;
+      const l = el("label", "oluso-journey__label", field.label);
+      l.htmlFor = fieldId;
+      if (field.required) {
+        const marker = el("span", "oluso-journey__required", "*");
+        marker.setAttribute("aria-hidden", "true");
+        l.appendChild(marker);
+      }
+      wrapper.appendChild(l);
+    };
+    const describedBy = [];
+    const common = (input) => {
+      input.id = fieldId;
+      input.name = field.name;
+      input.required = field.required;
+      if (field.readOnly) {
+        if (input instanceof HTMLSelectElement) input.disabled = true;
+        else input.readOnly = true;
+        input.dataset.olusoReadonly = String(input instanceof HTMLSelectElement);
+      }
+      if (field.autofocus) input.autofocus = true;
+      if (field.autocomplete) input.setAttribute("autocomplete", field.autocomplete);
+      if (field.error) input.setAttribute("aria-invalid", "true");
+    };
+    switch (field.type) {
+      case "textarea": {
+        label();
+        const input = el("textarea", "oluso-journey__textarea");
+        common(input);
+        input.value = field.value ?? "";
+        if (field.placeholder) input.placeholder = field.placeholder;
+        if (field.rows) input.rows = field.rows;
+        if (field.minLength) input.minLength = field.minLength;
+        if (field.maxLength) input.maxLength = field.maxLength;
+        wrapper.appendChild(input);
+        break;
+      }
+      case "select": {
+        label();
+        const input = el("select", "oluso-journey__select");
+        common(input);
+        const blank = el("option", void 0, field.placeholder ?? "");
+        blank.value = "";
+        input.appendChild(blank);
+        for (const option of field.options ?? []) {
+          const o = el("option", void 0, option.label);
+          o.value = option.value;
+          o.disabled = option.disabled;
+          o.selected = option.value === field.value;
+          input.appendChild(o);
+        }
+        wrapper.appendChild(input);
+        break;
+      }
+      case "radio": {
+        const group = el("fieldset", "oluso-journey__group");
+        if (field.label) {
+          const legend = el("legend", "oluso-journey__label", field.label);
+          if (field.required) legend.appendChild(el("span", "oluso-journey__required", "*"));
+          group.appendChild(legend);
+        }
+        const choices = el("div", "oluso-journey__choices");
+        (field.options ?? []).forEach((option, i) => {
+          const choice = el("label", "oluso-journey__choice");
+          const input = el("input");
+          input.type = "radio";
+          input.name = field.name;
+          input.value = option.value;
+          input.id = `${fieldId}-${i}`;
+          input.required = field.required;
+          input.disabled = option.disabled || field.readOnly;
+          input.checked = option.value === field.value;
+          const text = el("span", void 0, option.label);
+          if (option.description) text.appendChild(el("span", "oluso-journey__choice-description", option.description));
+          choice.append(input, text);
+          choices.appendChild(choice);
+        });
+        group.appendChild(choices);
+        wrapper.appendChild(group);
+        break;
+      }
+      case "checkbox": {
+        if (field.placeholder) label();
+        const choice = el("label", "oluso-journey__choice");
+        const input = el("input");
+        input.type = "checkbox";
+        input.value = "true";
+        common(input);
+        input.checked = field.value === "true";
+        if (field.readOnly) {
+          input.setAttribute("aria-readonly", "true");
+          input.addEventListener("click", (e) => e.preventDefault());
+        }
+        const text = el("span", void 0, field.placeholder ?? field.label ?? "");
+        if (!field.placeholder && field.required) text.appendChild(el("span", "oluso-journey__required", "*"));
+        choice.append(input, text);
+        wrapper.appendChild(choice);
+        break;
+      }
+      case "file": {
+        label();
+        const input = el("input", "oluso-journey__input");
+        input.type = "file";
+        common(input);
+        input.readOnly = false;
+        input.disabled = field.readOnly;
+        if (field.accept) input.accept = field.accept;
+        input.multiple = (field.maxFiles ?? 1) > 1;
+        input.required = field.required && !field.capture;
+        wrapper.appendChild(input);
+        if (field.capture && !field.readOnly) {
+          const cameraLabel = el("label", "oluso-journey__hint", labels.takePhoto);
+          cameraLabel.htmlFor = `${fieldId}-camera`;
+          const camera = el("input", "oluso-journey__input");
+          camera.type = "file";
+          camera.id = `${fieldId}-camera`;
+          camera.name = field.name;
+          camera.accept = "image/*";
+          camera.setAttribute("capture", field.capture);
+          wrapper.append(cameraLabel, camera);
+        }
+        break;
+      }
+      case "tel": {
+        label();
+        if (field.countries && field.countries.length > 0) {
+          const row = el("div", "oluso-journey__phone");
+          const country = el("select", "oluso-journey__select");
+          country.name = `${field.name}__country`;
+          country.setAttribute("aria-label", field.label ?? field.name);
+          country.disabled = field.readOnly;
+          for (const c of field.countries) {
+            const o = el("option", void 0, `${c.flag ? c.flag + " " : ""}${c.name} (${c.dialCode})`);
+            o.value = c.code;
+            o.selected = c.code === field.country;
+            country.appendChild(o);
+          }
+          const input = el("input", "oluso-journey__input");
+          input.type = "tel";
+          input.inputMode = "tel";
+          common(input);
+          input.value = field.value ?? "";
+          if (field.placeholder) input.placeholder = field.placeholder;
+          row.append(country, input);
+          wrapper.appendChild(row);
+        } else {
+          const input = textInput(field, "tel");
+          common(input);
+          wrapper.appendChild(input);
+        }
+        break;
+      }
+      case "otp": {
+        label();
+        const input = el("input", "oluso-journey__input oluso-journey__input--otp");
+        input.type = "text";
+        input.inputMode = "numeric";
+        common(input);
+        input.setAttribute("autocomplete", field.autocomplete ?? "one-time-code");
+        if (field.maxLength) {
+          input.maxLength = field.maxLength;
+          input.minLength = field.minLength ?? field.maxLength;
+        }
+        input.pattern = field.pattern ?? "[0-9]*";
+        input.value = field.value ?? "";
+        wrapper.appendChild(input);
+        break;
+      }
+      default: {
+        label();
+        const known = ["text", "email", "password", "number", "date", "url", "tel"];
+        const input = textInput(field, known.includes(field.type) ? field.type : "text");
+        common(input);
+        wrapper.appendChild(input);
+      }
+    }
+    if (field.description) {
+      const help = el("p", "oluso-journey__help", field.description);
+      help.id = `${fieldId}-help`;
+      describedBy.push(help.id);
+      wrapper.appendChild(help);
+    }
+    if (field.hint) {
+      const hint = el("p", "oluso-journey__hint", field.hint);
+      hint.id = `${fieldId}-hint`;
+      describedBy.push(hint.id);
+      wrapper.appendChild(hint);
+    }
+    if (field.error) {
+      const error = el("p", "oluso-journey__error", field.error);
+      error.id = `${fieldId}-error`;
+      describedBy.push(error.id);
+      wrapper.appendChild(error);
+    }
+    if (describedBy.length > 0) {
+      Array.from(wrapper.querySelectorAll("[id]")).find((n) => n.id === fieldId)?.setAttribute("aria-describedby", describedBy.join(" "));
+    }
+    return wrapper;
+  };
+  const textInput = (field, type) => {
+    const input = el("input", "oluso-journey__input");
+    input.type = type;
+    input.value = field.value ?? "";
+    if (field.placeholder) input.placeholder = field.placeholder;
+    if (field.pattern) input.pattern = field.pattern;
+    if (field.patternError) {
+      input.title = field.patternError;
+      input.addEventListener("invalid", () => {
+        if (input.validity.patternMismatch) input.setCustomValidity(field.patternError);
+      });
+      input.addEventListener("input", () => input.setCustomValidity(""));
+    }
+    if (field.minLength) input.minLength = field.minLength;
+    if (field.maxLength) input.maxLength = field.maxLength;
+    if (field.min) input.min = field.min;
+    if (field.max) input.max = field.max;
+    if (type === "number") input.step = "any";
+    return input;
+  };
+  const renderWidget = (widget, form) => {
+    const data = widget.data ?? {};
+    const box = el("div", "oluso-journey__widget");
+    const result = (value) => {
+      if (!widget.resultField) return;
+      let input = Array.from(form.querySelectorAll("input[type=hidden]")).find((n) => n.name === widget.resultField) ?? null;
+      if (!input) {
+        input = el("input");
+        input.type = "hidden";
+        input.name = widget.resultField;
+        form.appendChild(input);
+      }
+      input.value = value;
+    };
+    switch (widget.type) {
+      case "webauthn_get":
+      case "webauthn_create": {
+        const run = el("button", "oluso-journey__button oluso-journey__button--primary", widget.submit?.label ?? labels.passkey);
+        run.type = "button";
+        const go = async () => {
+          run.disabled = true;
+          try {
+            const options2 = await webAuthnOptions(data);
+            const publicKey = options2.publicKey;
+            let extra = options2.extra;
+            const credential = widget.type === "webauthn_get" ? await getAssertion(publicKey) : await createCredential(publicKey);
+            result(credential);
+            const naming = data.credentialName;
+            if (naming?.field) {
+              const attachment = JSON.parse(credential).authenticatorAttachment;
+              const name = attachment === "platform" ? naming.platform : attachment === "cross-platform" ? naming.crossPlatform : naming.other;
+              (extra ?? (extra = {}))[naming.field] = name ?? "";
+            }
+            await send(form, widget.submit, extra);
+          } catch (error) {
+            run.disabled = false;
+            run.textContent = labels.retry;
+            options.onError?.(error instanceof Error ? error : new Error(String(error)), session);
+          }
+        };
+        run.addEventListener("click", () => void go());
+        box.appendChild(run);
+        if (typeof PublicKeyCredential !== "undefined") queueMicrotask(() => void go());
+        return box;
+      }
+      case "verification_connect": {
+        const options2 = data.options ?? {};
+        const reference = typeof data.referenceOption === "string" ? options2[data.referenceOption] : void 0;
+        const field = typeof data.referenceField === "string" ? data.referenceField : "reference_id";
+        const callback = async (withReference) => {
+          const values = new FormData();
+          if (withReference) values.set(field, reference == null ? "" : String(reference));
+          submitting(form, true);
+          try {
+            await post(values, "callback");
+          } catch (error) {
+            submitting(form, false);
+            fail(error);
+          }
+        };
+        const start = async () => {
+          await loadScript(String(data.scriptUrl));
+          const Ctor = window[typeof data.global === "string" ? data.global : "Connect"];
+          if (!Ctor) throw new Error("The verification widget could not be loaded");
+          const connect = new Ctor({
+            ...options2,
+            onSuccess: () => void callback(true),
+            onError: () => void callback(false),
+            onClose: () => void 0
+          });
+          connect.setup?.();
+          connect.open();
+          return connect;
+        };
+        let instance;
+        const open = () => {
+          if (instance) {
+            void instance.then((c) => c.open());
+            return;
+          }
+          instance = start();
+          instance.catch((error) => {
+            instance = void 0;
+            fail(error);
+          });
+        };
+        if (widget.submit) {
+          const button = el("button", `oluso-journey__button oluso-journey__button--${widget.submit.kind}`, widget.submit.label);
+          button.type = "button";
+          button.addEventListener("click", open);
+          box.appendChild(button);
+        }
+        open();
+        return box;
+      }
+      case "captcha": {
+        const target = el("div", "oluso-journey__captcha");
+        box.appendChild(target);
+        void renderCaptcha(target, data, (token) => {
+          result(token);
+          if (widget.submit) void send(form, widget.submit);
+        }).catch((error) => options.onError?.(error instanceof Error ? error : new Error(String(error)), session));
+        return box;
+      }
+      case "qr": {
+        const qr = el("div", "oluso-journey__qr");
+        if (typeof data.image === "string") {
+          const img = el("img");
+          img.src = data.image;
+          img.alt = "";
+          qr.appendChild(img);
+        }
+        if (typeof data.secret === "string") {
+          if (typeof data.secretLabel === "string") qr.appendChild(el("span", "oluso-journey__help", data.secretLabel));
+          qr.appendChild(el("code", "oluso-journey__code", data.secret));
+        } else if (typeof data.value === "string" && typeof data.image !== "string") qr.appendChild(el("code", "oluso-journey__code", data.value));
+        box.appendChild(qr);
+        return box;
+      }
+      case "codes": {
+        const codes = Array.isArray(data.codes) ? data.codes.map(String) : [];
+        const list = el("ul", "oluso-journey__codes");
+        codes.forEach((c) => list.appendChild(el("li", void 0, c)));
+        const copy = el("button", "oluso-journey__button", labels.copy);
+        copy.type = "button";
+        copy.addEventListener("click", () => {
+          void navigator.clipboard?.writeText(codes.join("\n")).then(() => copy.textContent = labels.copied);
+        });
+        box.append(list, copy);
+        return box;
+      }
+      case "poll": {
+        const seconds = Math.max(2, Number(data.intervalSeconds) || 5);
+        const stopAt = Number(data.maxSeconds) > 0 ? Date.now() + Number(data.maxSeconds) * 1e3 : Infinity;
+        const rendered = session?.currentStep;
+        timers.push(window.setInterval(() => {
+          if (Date.now() > stopAt) {
+            clearTimers();
+            return;
+          }
+          if (!session || document.hidden) return;
+          void client.getSession(session.sessionId).then(async (now) => {
+            if (now.status !== "in_progress" || now.currentStep !== rendered) {
+              clearTimers();
+              await post(new FormData(), "init");
+            }
+          }).catch(() => void 0);
+        }, seconds * 1e3));
+        return null;
+      }
+      default:
+        return null;
+    }
+  };
+  const webAuthnOptions = async (data) => {
+    if (data.publicKey) return { publicKey: data.publicKey, extra: void 0 };
+    const url = String(data.optionsUrl);
+    const absolute = /^https?:/i.test(url) ? url : `${client.serverUrl}${url.startsWith("/") ? "" : "/"}${url}`;
+    const method = String(data.optionsMethod ?? "POST").toUpperCase();
+    const response = await fetch(absolute, {
+      method,
+      headers: { "Content-Type": "application/json" },
+      body: method === "GET" ? void 0 : JSON.stringify(data.optionsBody ?? {}),
+      credentials: "include"
+    });
+    if (!response.ok) throw new Error(labels.failed);
+    const json = await response.json();
+    const extra = {};
+    if (typeof data.idProperty === "string" && typeof data.idField === "string" && json[data.idProperty] != null) {
+      extra[data.idField] = String(json[data.idProperty]);
+    }
+    return { publicKey: json.options ?? json, extra };
+  };
+  const renderHtml = (html) => {
+    const wrapper = el("div", "oluso-journey__html");
+    wrapper.innerHTML = html;
+    wrapper.querySelectorAll("script").forEach((s) => s.remove());
+    wrapper.addEventListener("submit", (event) => {
+      const form = event.target;
+      event.preventDefault();
+      const submitter = event.submitter;
+      const data = new FormData(form);
+      if (submitter?.name) data.append(submitter.name, submitter.value);
+      data.delete("__RequestVerificationToken");
+      submitting(form, true);
+      post(data).catch((error) => {
+        submitting(form, false);
+        fail(error);
+      });
+    });
+    root.replaceChildren(wrapper);
+  };
+  void (options.session ? show(options.session) : begin());
+  return {
+    get session() {
+      return session;
+    },
+    restart: begin,
+    destroy() {
+      destroyed = true;
+      clearTimers();
+      root.remove();
+    }
+  };
+}
+function currentValues(item) {
+  if (!item) return [];
+  const inputs = item instanceof RadioNodeList ? Array.from(item) : [item];
+  return inputs.flatMap((node) => {
+    const input = node;
+    if (input.disabled) return [];
+    if (input.type === "checkbox" || input.type === "radio") return input.checked ? [input.value] : [];
+    if (input instanceof HTMLSelectElement && input.multiple) return Array.from(input.selectedOptions).map((o) => o.value);
+    return [input.value];
+  });
+}
+var loadedScripts = /* @__PURE__ */ new Map();
+function loadScript(src) {
+  let loading = loadedScripts.get(src);
+  if (!loading) {
+    loading = new Promise((resolve, reject) => {
+      const tag = document.createElement("script");
+      tag.src = src;
+      tag.async = true;
+      tag.onload = () => resolve();
+      tag.onerror = () => {
+        loadedScripts.delete(src);
+        reject(new Error("A script the step needs could not be loaded"));
+      };
+      document.head.appendChild(tag);
+    });
+    loadedScripts.set(src, loading);
+  }
+  return loading;
+}
+var CAPTCHA_SCRIPTS = {
+  recaptcha: { src: "https://www.google.com/recaptcha/api.js?render=explicit&onload=", global: "grecaptcha" },
+  hcaptcha: { src: "https://js.hcaptcha.com/1/api.js?render=explicit&onload=", global: "hcaptcha" },
+  turnstile: { src: "https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit&onload=", global: "turnstile" }
+};
+async function renderCaptcha(target, data, done) {
+  const provider = String(data.provider ?? "recaptcha").toLowerCase();
+  const script = CAPTCHA_SCRIPTS[provider];
+  if (!script) throw new Error(`Captcha provider '${provider}' isn't supported`);
+  const w = window;
+  if (!w[script.global]) {
+    const callback = `__olusoCaptcha${Date.now()}`;
+    await new Promise((resolve, reject) => {
+      w[callback] = () => resolve();
+      const tag = document.createElement("script");
+      tag.src = script.src + callback + (data.language ? `&hl=${encodeURIComponent(String(data.language))}` : "");
+      tag.async = true;
+      tag.onerror = () => reject(new Error("The captcha could not be loaded"));
+      document.head.appendChild(tag);
+    });
+  }
+  const api = w[script.global];
+  const siteKey = String(data.siteKey ?? "");
+  if (provider === "recaptcha" && data.version === "v3" && api.execute) {
+    api.ready?.(() => void api.execute(siteKey, { action: String(data.action ?? "submit") }).then(done));
+    return;
+  }
+  api.render(target, {
+    sitekey: siteKey,
+    theme: data.theme,
+    size: data.size,
+    action: data.action,
+    callback: (token) => done(token)
+  });
+}
+
+// src/auth/storage.ts
+var STORAGE_KEY = "oluso_auth_tokens";
+var MemoryStorage = class {
+  constructor() {
+    this.tokens = null;
+  }
+  getTokens() {
+    if (this.tokens && Date.now() / 1e3 >= this.tokens.expiresAt) {
+      this.tokens = null;
+    }
+    return this.tokens;
+  }
+  setTokens(tokens) {
+    this.tokens = tokens;
+  }
+  clear() {
+    this.tokens = null;
+  }
+};
+var BrowserStorage = class {
+  constructor(type) {
+    this.store = type === "localStorage" ? localStorage : sessionStorage;
+  }
+  getTokens() {
+    try {
+      const raw = this.store.getItem(STORAGE_KEY);
+      if (!raw) return null;
+      const tokens = JSON.parse(raw);
+      if (Date.now() / 1e3 >= tokens.expiresAt) {
+        this.clear();
+        return null;
+      }
+      return tokens;
+    } catch {
+      return null;
+    }
+  }
+  setTokens(tokens) {
+    this.store.setItem(STORAGE_KEY, JSON.stringify(tokens));
+  }
+  clear() {
+    this.store.removeItem(STORAGE_KEY);
+  }
+};
+function createStorage(type) {
+  if (type === "memory") return new MemoryStorage();
+  return new BrowserStorage(type);
+}
+
+// src/auth/client.ts
+var OlusoAuth = class {
+  constructor(config) {
+    this.user = null;
+    this.resolvedEndpoints = null;
+    this.discoveryPromise = null;
+    /** PKCE verifiers of inline journeys still in progress, by session */
+    this.journeyVerifiers = /* @__PURE__ */ new Map();
+    if (!config.serverUrl || !config.tenant || !config.clientId) {
+      throw new Error("serverUrl, tenant, and clientId are required");
+    }
+    this.config = {
+      scopes: "openid profile email",
+      signInJourney: "signin",
+      signUpJourney: "signup",
+      passwordResetJourney: "password-reset",
+      storage: "memory",
+      ...config,
+      serverUrl: config.serverUrl.replace(/\/$/, "")
+    };
+    this.storage = createStorage(this.config.storage);
+    const tokens = this.storage.getTokens();
+    if (tokens) {
+      this.user = this.parseIdToken(tokens.idToken);
+    }
+  }
+  // =========================================================================
+  // Journey Auth (inline or modal)
+  // =========================================================================
+  /**
+   * Sign in.
+   * - With data: run the sign-in journey inline with these inputs (programmatic, first-party
+   *   only). If another step follows (e.g. MFA), the result has requiresStep, sessionId and
+   *   the step to render; continue with continueStep().
+   * - Without data: open the hosted journey in a secure iframe modal (safe for any site)
+   */
+  async signIn(data) {
+    if (data) {
+      return this.executeJourney(this.config.signInJourney, data);
+    }
+    return this.openAuthModal("signin");
+  }
+  /**
+   * Sign up.
+   * - With data: run the sign-up journey inline (programmatic, first-party only)
+   * - Without data: open the hosted journey in a secure iframe modal
+   */
+  async signUp(data) {
+    if (data) {
+      return this.executeJourney(this.config.signUpJourney, data);
+    }
+    return this.openAuthModal("signup");
+  }
+  /**
+   * Sign in with a passkey (WebAuthn).
+   * No form or iframe needed — the browser shows a native biometric/key prompt.
+   * Works with discoverable credentials (usernameless) or username-based flow.
+   *
+   * @example
+   * ```typescript
+   * // Discoverable credential (passkey autofill or prompt)
+   * const result = await auth.signInWithPasskey();
+   *
+   * // Username-based (shows credentials for specific user)
+   * const result = await auth.signInWithPasskey({ username: 'user@example.com' });
+   *
+   * // Conditional mediation (passkey suggestions in input fields)
+   * const result = await auth.signInWithPasskey({ conditional: true });
+   * ```
+   */
+  async signInWithPasskey(options) {
+    if (!window.PublicKeyCredential) {
+      return { success: false, error: "WebAuthn is not supported in this browser" };
+    }
+    const { verifier, challenge } = await this.generatePkce();
+    const optionsUrl = `${this.config.serverUrl}/connect/webauthn/assertion-options`;
+    const optionsResponse = await fetch(optionsUrl, {
+      method: "POST",
+      headers: this.buildHeaders(),
+      body: JSON.stringify({
+        clientId: this.config.clientId,
+        username: options?.username,
+        scope: this.config.scopes,
+        codeChallenge: challenge,
+        codeChallengeMethod: "S256"
+      })
+    });
+    if (!optionsResponse.ok) {
+      const err = await optionsResponse.json().catch(() => ({ error_description: "Failed to get passkey options" }));
+      return { success: false, error: err.error_description || err.error };
+    }
+    const assertionOptions = await optionsResponse.json();
+    const publicKeyOptions = {
+      challenge: this.base64UrlDecode(assertionOptions.challenge),
+      timeout: assertionOptions.timeout,
+      rpId: assertionOptions.rpId,
+      userVerification: assertionOptions.userVerification || "preferred",
+      allowCredentials: assertionOptions.allowCredentials?.map((c) => ({
+        type: c.type,
+        id: this.base64UrlDecode(c.id),
+        transports: c.transports
+      }))
+    };
+    let credential;
+    try {
+      const getOptions = {
+        publicKey: publicKeyOptions,
+        signal: options?.signal
+      };
+      if (options?.conditional) {
+        getOptions.mediation = "conditional";
+      }
+      credential = await navigator.credentials.get(getOptions);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Passkey request failed";
+      if (err instanceof DOMException && err.name === "AbortError") {
+        return { success: false, error: "cancelled" };
+      }
+      if (err instanceof DOMException && err.name === "NotAllowedError") {
+        return { success: false, error: "cancelled" };
+      }
+      return { success: false, error: message };
+    }
+    if (!credential) {
+      return { success: false, error: "No credential returned" };
+    }
+    const assertionResponse = credential.response;
+    const responsePayload = JSON.stringify({
+      id: credential.id,
+      rawId: this.base64UrlEncode(new Uint8Array(credential.rawId)),
+      type: credential.type,
+      response: {
+        clientDataJSON: this.base64UrlEncode(new Uint8Array(assertionResponse.clientDataJSON)),
+        authenticatorData: this.base64UrlEncode(new Uint8Array(assertionResponse.authenticatorData)),
+        signature: this.base64UrlEncode(new Uint8Array(assertionResponse.signature)),
+        userHandle: assertionResponse.userHandle ? this.base64UrlEncode(new Uint8Array(assertionResponse.userHandle)) : null
+      }
+    });
+    const verifyUrl = `${this.config.serverUrl}/connect/webauthn/assertion`;
+    const verifyResponse = await fetch(verifyUrl, {
+      method: "POST",
+      headers: this.buildHeaders(),
+      body: JSON.stringify({
+        clientId: this.config.clientId,
+        assertionId: assertionOptions.assertionId,
+        assertionResponse: responsePayload,
+        codeChallenge: challenge,
+        codeChallengeMethod: "S256",
+        scope: this.config.scopes
+      })
+    });
+    if (!verifyResponse.ok) {
+      const err = await verifyResponse.json().catch(() => ({ error_description: "Passkey verification failed" }));
+      return { success: false, error: err.error_description || err.error };
+    }
+    const { code } = await verifyResponse.json();
+    return this.exchangeCodeForTokens(code, verifier, "postmessage");
+  }
+  /**
+   * Sign in with FedCM (Federated Credential Management).
+   * Opens a browser-native account picker — no redirect or popup needed.
+   * Requires the user to be already authenticated on the Oluso server (has session cookie).
+   *
+   * Browser support: Chrome/Edge 132+ (the provider `params` that carry the PKCE challenge).
+   * The page origin must be registered for the client (CORS origin or redirect URI).
+   *
+   * @example
+   * ```typescript
+   * const result = await auth.signInWithFedCM();
+   * if (result.success) {
+   *   console.log('Signed in as', result.user.name);
+   * }
+   * ```
+   */
+  async signInWithFedCM(options) {
+    if (!("IdentityCredential" in window)) {
+      return { success: false, error: "FedCM is not supported in this browser" };
+    }
+    const { verifier, challenge } = await this.generatePkce();
+    try {
+      const credential = await navigator.credentials.get({
+        identity: {
+          providers: [{
+            configURL: `${this.config.serverUrl}/fedcm/config.json`,
+            clientId: this.config.clientId,
+            nonce: options?.nonce,
+            loginHint: options?.loginHint,
+            params: {
+              code_challenge: challenge,
+              code_challenge_method: "S256",
+              scope: this.config.scopes
+            }
+          }]
+        },
+        mediation: options?.autoReauth ? "optional" : "required"
+      });
+      if (!credential?.token) {
+        return { success: false, error: "No credential returned from FedCM" };
+      }
+      return this.exchangeCodeForTokens(credential.token, verifier, "fedcm");
+    } catch (err) {
+      if (err instanceof DOMException && err.name === "AbortError") {
+        return { success: false, error: "cancelled" };
+      }
+      if (err instanceof DOMException && err.name === "NetworkError") {
+        return { success: false, error: "FedCM network error \u2014 user may not be signed in to the identity provider" };
+      }
+      const message = err instanceof Error ? err.message : "FedCM request failed";
+      return { success: false, error: message };
+    }
+  }
+  /**
+   * Render the sign-in journey into `container` and sign in without leaving the page, e.g. in a modal when the
+   * session has expired. Every step the journey has (password, MFA, passkey, consent) is shown; when it completes,
+   * the code is redeemed and `onSignedIn` gets the result.
+   */
+  mountSignIn(container, options = {}) {
+    const client = new OlusoClient({ serverUrl: this.config.serverUrl, tenant: this.config.tenant, apiKey: this.config.apiKey });
+    let verifier = "";
+    return mountJourney(container, {
+      client,
+      theme: options.theme,
+      unstyled: options.unstyled,
+      labels: options.labels,
+      showCompletion: false,
+      onError: options.onError,
+      onRedirect: options.onRedirect,
+      start: async () => {
+        const pkce = await this.generatePkce();
+        verifier = pkce.verifier;
+        return client.startAuthJourney(
+          options.journey ?? this.config.signInJourney,
+          { clientId: this.config.clientId, codeChallenge: pkce.challenge, scope: this.config.scopes }
+        );
+      },
+      onComplete: async (session) => {
+        const result = session.code ? await this.exchangeCodeForTokens(session.code, verifier, "postmessage") : { success: false, error: session.errorDescription || session.error || "Authentication failed", code: session.error };
+        options.onSignedIn?.(result);
+      }
+    });
+  }
+  /**
+   * Continue an inline journey with the input for its current step (e.g. an MFA code)
+   */
+  async continueStep(sessionId, data) {
+    const verifier = this.journeyVerifiers.get(sessionId);
+    if (!verifier) {
+      return { success: false, error: "This journey was not started by this client", code: "invalid_session" };
+    }
+    const url = `${this.config.serverUrl}/api/public/journeys/sessions/${encodeURIComponent(sessionId)}/step`;
+    const response = await fetch(url, {
+      method: "POST",
+      headers: this.buildHeaders(),
+      body: JSON.stringify({ data }),
+      credentials: "include"
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ message: "Step failed" }));
+      return { success: false, error: error.error_description || error.message, code: error.error || error.code };
+    }
+    return this.handleJourneyResult(await response.json(), verifier);
+  }
+  /**
+   * Get the fields/config of a data-collection journey (for rendering in UI)
+   */
+  async getJourneyStep(journeySlug) {
+    const url = `${this.config.serverUrl}/api/public/journeys/${encodeURIComponent(journeySlug)}`;
+    const response = await fetch(url, {
+      headers: this.buildHeaders(),
+      credentials: "include"
+    });
+    if (!response.ok) return null;
+    const journey = await response.json();
+    return {
+      step: "initial",
+      fields: journey.fields || [],
+      title: journey.ui?.title || journey.name,
+      description: journey.description
+    };
+  }
+  // =========================================================================
+  // OIDC Redirect Flow
+  // =========================================================================
+  /**
+   * Redirect to the Oluso login page (standard OIDC Authorization Code + PKCE)
+   */
+  async loginWithRedirect(options) {
+    const { verifier, challenge } = await this.generatePkce();
+    sessionStorage.setItem("oluso_pkce_verifier", verifier);
+    if (options?.state) {
+      sessionStorage.setItem("oluso_auth_state", options.state);
+    }
+    const endpoints = await this.getEndpoints();
+    const params = new URLSearchParams({
+      response_type: "code",
+      client_id: this.config.clientId,
+      redirect_uri: this.config.redirectUri || window.location.origin + "/callback",
+      scope: this.config.scopes,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      tenant: this.config.tenant
+    });
+    if (options?.prompt) params.set("prompt", options.prompt);
+    if (options?.state) params.set("state", options.state);
+    window.location.href = `${endpoints.authorization}?${params}`;
+  }
+  /**
+   * Handle the OIDC callback (exchange code for tokens)
+   */
+  async handleCallback(callbackUrl) {
+    const url = new URL(callbackUrl || window.location.href);
+    const code = url.searchParams.get("code");
+    const error = url.searchParams.get("error");
+    if (error) {
+      return { success: false, error: url.searchParams.get("error_description") || error, code: error };
+    }
+    if (!code) {
+      return { success: false, error: "No authorization code in callback" };
+    }
+    const verifier = sessionStorage.getItem("oluso_pkce_verifier");
+    sessionStorage.removeItem("oluso_pkce_verifier");
+    if (!verifier) {
+      return { success: false, error: "PKCE verifier not found" };
+    }
+    return this.exchangeCodeForTokens(code, verifier, this.config.redirectUri || window.location.origin + "/callback");
+  }
+  // =========================================================================
+  // Token & User Management
+  // =========================================================================
+  /**
+   * Get the current user (null if not authenticated)
+   */
+  getUser() {
+    return this.user;
+  }
+  /**
+   * Check if user is authenticated (has valid tokens)
+   */
+  isAuthenticated() {
+    return this.user !== null && this.storage.getTokens() !== null;
+  }
+  /**
+   * Get the current access token (for API calls)
+   */
+  getAccessToken() {
+    return this.storage.getTokens()?.accessToken ?? null;
+  }
+  /**
+   * Check if user has a specific role
+   */
+  hasRole(role) {
+    return this.user?.roles.includes(role) ?? false;
+  }
+  /**
+   * Check if user has any of the specified roles
+   */
+  hasAnyRole(...roles) {
+    return roles.some((r) => this.hasRole(r));
+  }
+  /**
+   * Check if user has a specific permission
+   */
+  hasPermission(permission) {
+    return this.user?.permissions.includes(permission) ?? false;
+  }
+  /**
+   * Refresh the access token using the refresh token
+   */
+  async refreshToken() {
+    const tokens = this.storage.getTokens();
+    if (!tokens?.refreshToken) return false;
+    const endpoints = await this.getEndpoints();
+    const response = await fetch(endpoints.token, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: this.config.clientId,
+        refresh_token: tokens.refreshToken
+      })
+    });
+    if (!response.ok) {
+      this.logout();
+      return false;
+    }
+    const tokenData = await response.json();
+    this.processTokenResponse(tokenData);
+    return true;
+  }
+  /**
+   * Log out — clear tokens and optionally redirect to end session.
+   * If redirect is true, uses discovered or configured end_session_endpoint.
+   */
+  logout(options) {
+    const tokens = this.storage.getTokens();
+    this.storage.clear();
+    this.user = null;
+    this.config.onAuthStateChange?.(null);
+    if (options?.redirect && tokens?.idToken) {
+      if (this.resolvedEndpoints?.endSession || this.config.endpoints?.endSession) {
+        const params = new URLSearchParams({
+          id_token_hint: tokens.idToken,
+          post_logout_redirect_uri: options.postLogoutRedirectUri || window.location.origin
+        });
+        window.location.href = `${this.resolvedEndpoints?.endSession || this.config.endpoints?.endSession}?${params}`;
+      } else {
+        this.getEndpoints().then((endpoints) => {
+          const params = new URLSearchParams({
+            id_token_hint: tokens.idToken,
+            post_logout_redirect_uri: options.postLogoutRedirectUri || window.location.origin
+          });
+          window.location.href = `${endpoints.endSession}?${params}`;
+        });
+      }
+    }
+  }
+  /**
+   * Fetch the user's profile from the userinfo endpoint
+   */
+  async fetchUserInfo() {
+    const token = this.getAccessToken();
+    if (!token) return null;
+    const endpoints = await this.getEndpoints();
+    const response = await fetch(endpoints.userinfo, {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!response.ok) return null;
+    const claims = await response.json();
+    this.user = this.claimsToUser(claims);
+    this.config.onAuthStateChange?.(this.user);
+    return this.user;
+  }
+  // =========================================================================
+  // Private Helpers
+  // =========================================================================
+  /**
+   * Opens a secure iframe modal for authentication.
+   * Credentials are entered inside the iframe (auth server origin).
+   * Returns tokens via postMessage + PKCE code exchange.
+   */
+  async openAuthModal(mode) {
+    const { verifier, challenge } = await this.generatePkce();
+    const journeySlug = mode === "signin" ? this.config.signInJourney : this.config.signUpJourney;
+    const params = new URLSearchParams({
+      journey: journeySlug,
+      client_id: this.config.clientId,
+      origin: window.location.origin,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      scope: this.config.scopes
+    });
+    const iframeSrc = `${this.config.serverUrl}/embed/auth?${params}`;
+    return new Promise((resolve) => {
+      const overlay = document.createElement("div");
+      overlay.style.cssText = "position:fixed;inset:0;background:rgba(0,0,0,0.6);backdrop-filter:blur(4px);z-index:99999;display:flex;align-items:center;justify-content:center;padding:24px;";
+      const modal = document.createElement("div");
+      modal.style.cssText = "background:#fff;border-radius:16px;width:100%;max-width:420px;max-height:90vh;overflow:hidden;box-shadow:0 25px 50px -12px rgba(0,0,0,0.25);";
+      const header = document.createElement("div");
+      header.style.cssText = "display:flex;justify-content:flex-end;padding:12px 16px 0;";
+      const closeBtn = document.createElement("button");
+      closeBtn.innerHTML = "&times;";
+      closeBtn.style.cssText = "background:none;border:none;cursor:pointer;color:#9ca3af;font-size:20px;padding:4px;border-radius:6px;";
+      header.appendChild(closeBtn);
+      const iframe = document.createElement("iframe");
+      iframe.src = iframeSrc;
+      iframe.allow = "camera; microphone";
+      iframe.style.cssText = "border:none;width:100%;min-height:300px;";
+      const branding = document.createElement("div");
+      branding.style.cssText = "display:none;text-align:center;padding:10px 0;font-size:11px;color:#9ca3af;border-top:1px solid #e5e7eb;font-family:-apple-system,BlinkMacSystemFont,sans-serif;";
+      branding.innerHTML = 'Powered by <a href="https://oluso.io" target="_blank" rel="noopener" style="color:#9ca3af;text-decoration:none;">Oluso</a>';
+      modal.appendChild(header);
+      modal.appendChild(iframe);
+      modal.appendChild(branding);
+      overlay.appendChild(modal);
+      document.body.appendChild(overlay);
+      document.body.style.overflow = "hidden";
+      const cleanup = () => {
+        window.removeEventListener("message", messageHandler);
+        document.removeEventListener("keydown", escHandler);
+        document.body.style.overflow = "";
+        overlay.remove();
+      };
+      const cancel = () => {
+        cleanup();
+        resolve({ success: false, error: "cancelled" });
+      };
+      closeBtn.addEventListener("click", cancel);
+      overlay.addEventListener("click", (e) => {
+        if (e.target === overlay) cancel();
+      });
+      const escHandler = (e) => {
+        if (e.key === "Escape") cancel();
+      };
+      document.addEventListener("keydown", escHandler);
+      const messageHandler = async (event) => {
+        const serverOrigin = new URL(this.config.serverUrl).origin;
+        if (event.origin !== serverOrigin) return;
+        const data = event.data;
+        if (!data || typeof data !== "object") return;
+        if (data.type === "oluso:auth:code") {
+          cleanup();
+          const result = await this.exchangeCodeForTokens(data.code, verifier, "postmessage");
+          resolve(result);
+        } else if (data.type === "oluso:auth:error") {
+          cleanup();
+          resolve({ success: false, error: data.error });
+        } else if (data.type === "oluso:auth:ready") {
+          branding.style.display = data.hideBranding ? "none" : "block";
+        } else if (data.type === "oluso:auth:resize" && typeof data.height === "number") {
+          iframe.style.height = `${data.height}px`;
+        }
+      };
+      window.addEventListener("message", messageHandler);
+    });
+  }
+  /**
+   * Get OIDC endpoints — uses manual overrides, falls back to discovery.
+   */
+  async getEndpoints() {
+    if (this.config.endpoints?.authorization && this.config.endpoints?.token) {
+      const base = this.config.serverUrl;
+      return {
+        authorization: this.config.endpoints.authorization,
+        token: this.config.endpoints.token,
+        userinfo: this.config.endpoints.userinfo || `${base}/connect/userinfo`,
+        endSession: this.config.endpoints.endSession || `${base}/connect/endsession`,
+        jwks: this.config.endpoints.jwks || `${base}/.well-known/openid-configuration/jwks`
+      };
+    }
+    if (this.resolvedEndpoints) {
+      return this.resolvedEndpoints;
+    }
+    if (!this.discoveryPromise) {
+      this.discoveryPromise = this.discoverEndpoints();
+    }
+    this.resolvedEndpoints = await this.discoveryPromise;
+    return this.resolvedEndpoints;
+  }
+  async discoverEndpoints() {
+    const base = this.config.serverUrl;
+    const wellKnownUrl = `${base}/.well-known/openid-configuration`;
+    try {
+      const response = await fetch(wellKnownUrl);
+      if (!response.ok) {
+        return this.defaultEndpoints();
+      }
+      const doc = await response.json();
+      return {
+        authorization: doc.authorization_endpoint || `${base}/connect/authorize`,
+        token: doc.token_endpoint || `${base}/connect/token`,
+        userinfo: doc.userinfo_endpoint || `${base}/connect/userinfo`,
+        endSession: doc.end_session_endpoint || `${base}/connect/endsession`,
+        jwks: doc.jwks_uri || `${base}/.well-known/openid-configuration/jwks`
+      };
+    } catch {
+      return this.defaultEndpoints();
+    }
+  }
+  defaultEndpoints() {
+    const base = this.config.serverUrl;
+    return {
+      authorization: `${base}/connect/authorize`,
+      token: `${base}/connect/token`,
+      userinfo: `${base}/connect/userinfo`,
+      endSession: `${base}/connect/endsession`,
+      jwks: `${base}/.well-known/openid-configuration/jwks`
+    };
+  }
+  async executeJourney(journeySlug, data) {
+    const { verifier, challenge } = await this.generatePkce();
+    const url = `${this.config.serverUrl}/api/public/journeys/${encodeURIComponent(journeySlug)}/start`;
+    const response = await fetch(url, {
+      method: "POST",
+      headers: this.buildHeaders(),
+      body: JSON.stringify({
+        data,
+        clientId: this.config.clientId,
+        codeChallenge: challenge,
+        codeChallengeMethod: "S256",
+        scope: this.config.scopes
+      }),
+      credentials: "include"
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ message: "Auth failed" }));
+      return { success: false, error: error.error_description || error.message, code: error.error || error.code };
+    }
+    return this.handleJourneyResult(await response.json(), verifier);
+  }
+  /**
+   * Completed: redeem the code with the journey's verifier. In progress: hand back the step
+   * to render (an error from the step's last input, e.g. a wrong password, rides along).
+   */
+  async handleJourneyResult(session, verifier) {
+    if (session.completed && session.code) {
+      this.journeyVerifiers.delete(session.sessionId);
+      return this.exchangeCodeForTokens(session.code, verifier, "postmessage");
+    }
+    if (session.status === "in_progress") {
+      this.journeyVerifiers.set(session.sessionId, verifier);
+      const stepError = session.step?.model?.errorMessage ?? session.step?.model?.formError;
+      return {
+        success: false,
+        requiresStep: session.step?.type ?? session.currentStep,
+        sessionId: session.sessionId,
+        step: session.step,
+        redirectUrl: session.redirectUrl,
+        error: typeof stepError === "string" ? stepError : void 0
+      };
+    }
+    this.journeyVerifiers.delete(session.sessionId);
+    return {
+      success: false,
+      error: session.errorDescription || session.error || "Authentication failed",
+      code: session.error
+    };
+  }
+  processTokenResponse(tokenData) {
+    const tokens = {
+      accessToken: tokenData.access_token,
+      idToken: tokenData.id_token,
+      refreshToken: tokenData.refresh_token,
+      expiresAt: Math.floor(Date.now() / 1e3) + (tokenData.expires_in || 3600),
+      tokenType: tokenData.token_type || "Bearer",
+      scope: tokenData.scope
+    };
+    this.storage.setTokens(tokens);
+    this.user = this.parseIdToken(tokens.idToken);
+    this.config.onAuthStateChange?.(this.user);
+    return { success: true, user: this.user, tokens };
+  }
+  parseIdToken(idToken) {
+    if (!idToken) return null;
+    try {
+      const parts = idToken.split(".");
+      if (parts.length !== 3) return null;
+      const payload = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
+      return this.claimsToUser(payload);
+    } catch {
+      return null;
+    }
+  }
+  claimsToUser(claims) {
+    return {
+      sub: claims.sub,
+      name: claims.name || claims.preferred_username,
+      email: claims.email,
+      emailVerified: claims.email_verified,
+      roles: this.parseArrayClaim(claims.role || claims.roles),
+      permissions: this.parseArrayClaim(claims.permission || claims.permissions),
+      tenantId: claims.tenant_id,
+      claims
+    };
+  }
+  parseArrayClaim(claim) {
+    if (!claim) return [];
+    if (Array.isArray(claim)) return claim.map(String);
+    if (typeof claim === "string") return [claim];
+    return [];
+  }
+  buildHeaders() {
+    const headers = {
+      "Content-Type": "application/json",
+      "X-Tenant-ID": this.config.tenant
+    };
+    if (this.config.apiKey) {
+      headers["X-API-Key"] = this.config.apiKey;
+    }
+    return headers;
+  }
+  async generatePkce() {
+    const array = new Uint8Array(32);
+    crypto.getRandomValues(array);
+    const verifier = this.base64UrlEncode(array);
+    const encoder = new TextEncoder();
+    const digest = await crypto.subtle.digest("SHA-256", encoder.encode(verifier));
+    const challenge = this.base64UrlEncode(new Uint8Array(digest));
+    return { verifier, challenge };
+  }
+  base64UrlEncode(buffer) {
+    let binary = "";
+    for (let i = 0; i < buffer.length; i++) {
+      binary += String.fromCharCode(buffer[i]);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  base64UrlDecode(str) {
+    const base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+    const padding = "=".repeat((4 - base64.length % 4) % 4);
+    const binary = atob(base64 + padding);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+  }
+  /**
+   * Exchange an authorization code for tokens via the token endpoint.
+   * Used by passkey, FedCM, and modal auth flows.
+   */
+  async exchangeCodeForTokens(code, verifier, redirectUri) {
+    const endpoints = await this.getEndpoints();
+    const response = await fetch(endpoints.token, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: this.config.clientId,
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: verifier
+      })
+    });
+    if (!response.ok) {
+      const err = await response.json().catch(() => ({ error_description: "Token exchange failed" }));
+      return { success: false, error: err.error_description || err.error };
+    }
+    const tokenData = await response.json();
+    return this.processTokenResponse(tokenData);
+  }
+};
+
+// src/index.ts
+function createClient(config) {
+  return new OlusoClient(config);
+}
+export {
+  OlusoAuth,
+  OlusoClient,
+  OlusoError,
+  conditionMet,
+  createClient,
+  mountJourney
+};
+//# sourceMappingURL=index.mjs.map