@synqauth/js 0.0.0 → 0.3.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as problemError, i as isSynqError, n as secureUrl, o as toSynqError, r as SynqError, t as createApiClient } from "./api-Cf9K1Rc9.js";
+import { a as readSavedSignIn, c as SynqError, d as toSynqError, i as newSignIn, l as isSynqError, n as secureUrl, r as SignInFlow, s as solveEmailWork, t as createApiClient, u as problemError } from "./api-BGeXhXo6.js";
 import * as oauth from "oauth4webapi";
 //#region src/storage.ts
 /**
@@ -159,6 +159,7 @@ var Client = class {
 			redirectUri: this.#options.redirectUri,
 			resource: options.resource ?? this.#options.resource,
 			maxAge: options.maxAge,
+			...options.acr?.essential ? { acr: [...options.acr.values] } : {},
 			createdAt: now()
 		};
 		const url = new URL(server.authorization_endpoint);
@@ -181,6 +182,15 @@ var Client = class {
 		if (options.maxAge !== void 0) params.set("max_age", String(options.maxAge));
 		if (options.loginHint) params.set("login_hint", options.loginHint);
 		if (options.method) params.set("synq_method", options.method);
+		if (options.acr) {
+			if (options.acr.values.length === 0) throw new SynqError("invalid_options", "acr needs at least one value");
+			if (params.has("acr_values") || params.has("claims")) throw new SynqError("invalid_options", "acr_values and claims come from the acr option");
+			if (options.acr.essential) params.set("claims", JSON.stringify({ id_token: { acr: {
+				essential: true,
+				values: [...options.acr.values]
+			} } }));
+			else params.set("acr_values", options.acr.values.join(" "));
+		}
 		await this.#transactions.set(TRANSACTION_PREFIX + transaction.state, JSON.stringify(transaction));
 		if (!options.pushed) return url;
 		if (!server.pushed_authorization_request_endpoint) throw new SynqError("discovery_failed", "The issuer takes no pushed authorization requests");
@@ -224,6 +234,7 @@ var Client = class {
 				requireIdToken: true
 			});
 			const claims = oauth.getValidatedIdTokenClaims(result);
+			if (transaction.acr && !(claims?.acr && transaction.acr.includes(claims.acr))) throw new SynqError("unmet_authentication_requirements", "The sign-in did not reach the level this app requires");
 			this.#generation += 1;
 			await this.#clear();
 			const session = await this.#save(result, claims);
@@ -271,8 +282,42 @@ var Client = class {
 			this.#listeners.delete(listener);
 		};
 	}
+	startSignIn({ endUserIp, ...options } = {}) {
+		return new SignInFlow(this.#signInPort(endUserIp), newSignIn(options.scope ?? this.#options.scope ?? "openid", {
+			...options,
+			resource: options.resource ?? this.#options.resource
+		}));
+	}
+	resumeSignIn(saved, options = {}) {
+		return new SignInFlow(this.#signInPort(options.endUserIp), readSavedSignIn(saved));
+	}
+	/** What a flow needs of this client: its issuer, its credentials, and keeping the session. */
+	#signInPort(endUserIp) {
+		return {
+			...endUserIp ? { headers: { "synq-end-user-ip": endUserIp } } : {},
+			server: () => this.#discover(),
+			client: this.#client,
+			auth: this.#auth,
+			fetch: this.#options.fetch ?? globalThis.fetch.bind(globalThis),
+			finish: async (result, claims) => {
+				this.#generation += 1;
+				await this.#clear();
+				const session = await this.#save(result, claims, void 0, "app");
+				this.#emit({
+					type: "signed-in",
+					session
+				});
+				return session;
+			},
+			hosted: (options) => this.signIn({
+				...options.method ? { method: options.method } : {},
+				...options.loginHint ? { loginHint: options.loginHint } : {}
+			})
+		};
+	}
 	async signOut(options = {}) {
 		const stored = await this.#load();
+		if (options.stay) await this.#endBrandSession(stored);
 		const refreshToken = await this.#readRefreshToken();
 		this.#generation += 1;
 		await this.#clear();
@@ -291,7 +336,7 @@ var Client = class {
 		} catch (error) {
 			if (attempt === 2) console.warn("@synqauth/js: revoking the refresh token at sign-out failed; it stays usable until it expires", toSynqError(error).code);
 		}
-		if (!server.end_session_endpoint) return null;
+		if (options.stay || !server.end_session_endpoint || stored?.via === "app") return null;
 		const url = new URL(server.end_session_endpoint);
 		url.searchParams.set("client_id", this.#options.clientId);
 		if (stored?.idToken) url.searchParams.set("id_token_hint", stored.idToken);
@@ -378,6 +423,48 @@ var Client = class {
 		});
 		return session;
 	}
+	/**
+	* Ends the browser session at the brand that `stored`'s ID token names,
+	* as the app, at the issuer's session revocation endpoint (AERO-2684).
+	* Nothing to end for a session signed in on the app's own screens (its
+	* refresh token's revocation ends it) or without an ID token.
+	*/
+	async #endBrandSession(stored) {
+		if (!this.#options.clientSecret) throw new SynqError("invalid_options", "Ending the brand's session from here takes a confidential app's clientSecret: sign out with the redirect instead");
+		if (!stored?.idToken || stored.via === "app") return;
+		const server = await this.#discover();
+		const endpoint = server.synq_session_revocation_endpoint;
+		if (typeof endpoint !== "string") throw new SynqError("discovery_failed", "The issuer can't end a session from here (no synq_session_revocation_endpoint)");
+		const url = secureUrl(endpoint, "The session revocation endpoint");
+		const body = new URLSearchParams({ id_token_hint: stored.idToken });
+		const headers = new Headers({
+			accept: "application/json",
+			"content-type": "application/x-www-form-urlencoded"
+		});
+		await this.#auth(server, this.#client, body, headers);
+		let response;
+		try {
+			response = await (this.#options.fetch ?? fetch)(url, {
+				method: "POST",
+				headers,
+				body,
+				redirect: "manual"
+			});
+		} catch (error) {
+			throw toSynqError(error);
+		}
+		if (response.ok) return;
+		let answer = {};
+		try {
+			answer = await response.json();
+		} catch {}
+		const code = typeof answer.error === "string" ? answer.error : "invalid_response";
+		const description = typeof answer.error_description === "string" ? answer.error_description : void 0;
+		throw new SynqError(code, description ?? `Synq answered ${response.status}`, {
+			status: response.status,
+			description
+		});
+	}
 	#discover() {
 		this.#server ??= (async () => {
 			try {
@@ -394,14 +481,15 @@ var Client = class {
 		})();
 		return this.#server;
 	}
-	async #save(result, claims, previous) {
+	async #save(result, claims, previous, via = previous?.via ?? "hosted") {
 		const stored = {
 			accessToken: result.access_token,
 			tokenType: result.token_type,
 			expiresAt: result.expires_in === void 0 ? void 0 : now() + result.expires_in,
 			scope: result.scope ?? previous?.scope,
 			idToken: result.id_token ?? previous?.idToken,
-			claims
+			claims,
+			via
 		};
 		this.#session = stored;
 		await this.#storage.set(SESSION_KEY, JSON.stringify(stored));
@@ -432,6 +520,7 @@ var Client = class {
 	async #public(stored) {
 		return {
 			...stored,
+			via: stored.via ?? "hosted",
 			refreshable: await this.#readRefreshToken() !== void 0
 		};
 	}
@@ -471,11 +560,12 @@ function accountApiUrl(issuer) {
 /** A client for the brand's account API, for an app that holds its own session: everything the signed-in person can do to their own account. */
 function createAccountClient(options) {
 	if (typeof options.accessToken !== "function") throw new SynqError("invalid_options", "Give the account client an accessToken function");
-	const raw = createApiClient({
+	const api = createApiClient({
 		baseUrl: accountApiUrl(options.issuer),
 		credential: options.accessToken,
 		fetch: options.fetch
 	});
+	const raw = api;
 	async function run(send, pick) {
 		try {
 			const json = await send();
@@ -494,18 +584,89 @@ function createAccountClient(options) {
 		...request,
 		signal: opts.signal
 	}));
-	const list = (path, opts = {}) => run(() => raw.get(path, { signal: opts.signal }), (json) => json.data);
+	const pages = api.paginate;
+	const list = (path, opts = {}) => run(async () => {
+		const all = [];
+		for await (const item of pages(path, {
+			query: { limit: 200 },
+			signal: opts.signal
+		})) all.push(item);
+		return all;
+	});
 	const change = (method, path, opts = {}, request = {}) => run(() => raw[method](path, {
 		...request,
 		idempotencyKey: opts.idempotencyKey ?? crypto.randomUUID(),
 		signal: opts.signal
 	}), (json) => json === void 0 ? null : json);
+	async function uploadPicture(picture, opts = {}) {
+		const bytes = new Uint8Array(picture instanceof Uint8Array ? picture : picture instanceof ArrayBuffer ? picture : await picture.arrayBuffer());
+		const contentType = opts.contentType ?? (typeof Blob !== "undefined" && picture instanceof Blob ? picture.type : "");
+		if (!contentType) return {
+			data: null,
+			error: new SynqError("invalid_options", "Say what the picture is: its contentType")
+		};
+		const key = opts.idempotencyKey;
+		const started = await change("post", "/v1/profile/picture/uploads", {
+			...opts,
+			idempotencyKey: key && `${key}:upload`
+		}, { body: {
+			content_type: contentType,
+			content_length: bytes.byteLength
+		} });
+		if (started.error) return started;
+		try {
+			const put = await (options.fetch ?? fetch)(started.data.url, {
+				method: "PUT",
+				headers: started.data.headers,
+				body: bytes,
+				signal: opts.signal
+			});
+			await put.body?.cancel();
+			if (!put.ok) return {
+				data: null,
+				error: new SynqError("network_error", `Synq's storage refused the picture (${put.status})`, { status: put.status })
+			};
+		} catch (error) {
+			return {
+				data: null,
+				error: new SynqError("network_error", String(error), { cause: error })
+			};
+		}
+		return change("put", "/v1/profile/picture", {
+			...opts,
+			idempotencyKey: key && `${key}:choose`
+		}, { body: { file_id: started.data.file_id } });
+	}
+	async function linkWay(method, opts) {
+		if (method !== "passkey") return change("post", "/v1/link-requests", opts, { body: { method } });
+		const offered = await list("/v1/link-methods", { signal: opts?.signal });
+		if (offered.error) return offered;
+		if (!offered.data.some((one) => one.method === "passkey")) return {
+			data: null,
+			error: new SynqError("sign_in_method_unavailable", "This brand doesn’t offer passkeys", { status: 409 })
+		};
+		return {
+			data: {
+				method: "passkey",
+				authorization_params: {
+					prompt: "login",
+					synq_intent: "add-passkey"
+				}
+			},
+			error: null
+		};
+	}
 	return {
 		me: (opts) => read("/v1/profile", opts),
 		user: {
 			update: (changes, opts) => change("patch", "/v1/profile", opts, { body: changes }),
 			metadata: (opts) => read("/v1/metadata", opts),
-			usernameAvailable: (username, opts) => read("/v1/usernames/{username}", opts, { path: { username } })
+			usernameAvailable: (username, opts) => read("/v1/usernames/{username}", opts, { path: { username } }),
+			picture: {
+				upload: uploadPicture,
+				fromAccount: (identity, opts) => change("put", "/v1/profile/picture", opts, { body: { identity } }),
+				remove: (opts) => change("delete", "/v1/profile/picture", opts)
+			}
 		},
 		wallets: {
 			list: (opts) => list("/v1/wallets", opts),
@@ -513,11 +674,14 @@ function createAccountClient(options) {
 				path: { wallet },
 				body: changes
 			}),
-			remove: (wallet, opts) => change("delete", "/v1/identities/{identity}", opts, { path: { identity: wallet } })
+			remove: (wallet, opts) => change("delete", "/v1/identities/{identity}", opts, { path: { identity: wallet } }),
+			add: (siws, opts) => change("post", "/v1/wallets", opts, { body: { siws } }),
+			move: (ticket, opts) => change("post", "/v1/wallet-moves", opts, { body: { ticket } })
 		},
 		accounts: {
 			list: (opts) => list("/v1/identities", opts),
-			link: (method, opts) => change("post", "/v1/link-requests", opts, { body: { method } }),
+			linkable: (opts) => list("/v1/link-methods", opts),
+			link: linkWay,
 			unlink: (identity, opts) => change("delete", "/v1/identities/{identity}", opts, { path: { identity } })
 		},
 		sessions: {
@@ -534,6 +698,12 @@ function createAccountClient(options) {
 			list: (opts) => list("/v1/consents", opts),
 			withdraw: (consent, opts) => change("delete", "/v1/consents/{consent}", opts, { path: { consent } })
 		},
+		apiKeys: {
+			apis: (opts) => list("/v1/apis", opts),
+			list: (opts) => list("/v1/api-keys", opts),
+			create: (input, opts) => change("post", "/v1/api-keys", opts, { body: input }),
+			revoke: (key, opts) => change("delete", "/v1/api-keys/{key}", opts, { path: { key } })
+		},
 		activity: (opts) => list("/v1/sign-ins", opts),
 		deletion: {
 			schedule: (opts) => change("post", "/v1/deletion", opts),
@@ -541,6 +711,146 @@ function createAccountClient(options) {
 		}
 	};
 }
+/**
+* The conflict a `wallet_in_use` error carries (AERO-2683): whether the
+* wallet is the other account's only way in, and the `move_ticket` that
+* moves it here, or null. Undefined for any other error.
+*/
+function walletConflict(error) {
+	if (!(error instanceof SynqError) || error.code !== "wallet_in_use") return void 0;
+	const conflict = error.cause?.conflict;
+	if (!conflict || typeof conflict.only_way_in !== "boolean") return void 0;
+	return {
+		only_way_in: conflict.only_way_in,
+		move_ticket: typeof conflict.move_ticket === "string" ? conflict.move_ticket : null,
+		expires_at: typeof conflict.expires_at === "string" ? conflict.expires_at : null
+	};
+}
+//#endregion
+//#region src/generated/challenge.ts
+/** The ways in an app's own screens sign people in with (`synq_method`). */
+const CHALLENGE_METHODS = [
+	"password",
+	"email",
+	"passkey",
+	"wallet",
+	"test"
+];
+/** What went wrong with a step (`synq_problem`): branch on it, never on the English. */
+const CHALLENGE_PROBLEMS = [
+	"missing",
+	"invalid_email",
+	"wrong_credentials",
+	"email_taken",
+	"password_too_short",
+	"password_too_long",
+	"password_guessable",
+	"password_breached",
+	"wrong_code",
+	"code_expired",
+	"code_used_up",
+	"address_suppressed",
+	"team_only",
+	"send_failed",
+	"work_required",
+	"passkey_failed",
+	"passkey_unknown",
+	"passkey_expired",
+	"wallet_failed",
+	"wallet_expired",
+	"slow_down",
+	"locked",
+	"limited"
+];
+//#endregion
+//#region src/sign-in-methods.ts
+/** Where the issuer lists an app's sign-in methods. */
+function signInMethodsUrl(issuer, clientId) {
+	const base = secureUrl(issuer, "The issuer");
+	const url = new URL(`${base.href.replace(/\/+$/, "")}/sign-in/methods`);
+	url.searchParams.set("client_id", clientId);
+	return url;
+}
+/**
+* The ways `clientId`'s sign-in offers at `issuer`, in the brand's order:
+* public, so it works for someone signed out, from a server or the app's own
+* pages (the issuer lets the origins of the app's redirect URIs read it).
+* The issuer lets it be kept a minute. Throws a `SynqError`: the issuer's
+* `invalid_client` for an app it doesn't know, `network_error`, or
+* `invalid_response`.
+*/
+async function signInMethods(options) {
+	if (!options.clientId) throw new SynqError("invalid_options", "The clientId is missing");
+	const url = signInMethodsUrl(options.issuer, options.clientId);
+	let response;
+	try {
+		response = await (options.fetch ?? fetch)(url, {
+			headers: { accept: "application/json" },
+			...options.signal ? { signal: options.signal } : {}
+		});
+	} catch (error) {
+		throw toSynqError(error);
+	}
+	let body;
+	try {
+		body = await response.json();
+	} catch (error) {
+		throw new SynqError("invalid_response", "Synq answered the sign-in methods with no JSON", {
+			status: response.status,
+			cause: error
+		});
+	}
+	if (!response.ok) {
+		const { error, error_description: description } = body ?? {};
+		const code = typeof error === "string" ? error : "invalid_response";
+		const detail = typeof description === "string" ? description : void 0;
+		throw new SynqError(code, detail ?? code, {
+			status: response.status,
+			description: detail
+		});
+	}
+	return readMethodList(body);
+}
+/** `body` as a method list, checked: what the issuer and any route mount answer. */
+function readMethodList(body) {
+	const list = body;
+	if (!list || typeof list !== "object" || !Array.isArray(list.methods) || typeof list.show_last_used !== "boolean" || !list.methods.every((method) => method !== null && typeof method === "object" && typeof method.id === "string" && typeof method.kind === "string" && typeof method.name === "string" && (method.icon === null || typeof method.icon === "string") && typeof method.in_place === "boolean" && typeof method.popup === "boolean" && Array.isArray(method.scopes))) throw new SynqError("invalid_response", "Synq's sign-in methods weren't a list of methods");
+	return {
+		methods: list.methods,
+		show_last_used: list.show_last_used
+	};
+}
+/** Marks the apps people open links from add to their built-in browser's user agent. */
+const IN_APP_MARKS = [
+	/\bTwitter(?:Android)?\b/i,
+	/\bLinkedInApp\b/i,
+	/\bSlack(?:_SSB)?\//i,
+	/\bInstagram\b/i,
+	/\bFB(?:AN|AV|_IAB)\b/,
+	/\bmusical_ly|\bTikTok\b|\bBytedanceWebview\b/i,
+	/\bSnapchat\b/i,
+	/\bLine\//,
+	/\bMicroMessenger\b/i
+];
+/**
+* Whether the page is in another app's built-in browser, where some ways in
+* fail: Google refuses to sign anyone in there (`disallowed_useragent`),
+* and passkeys usually can't be reached. `android-webview` for an Android
+* app's web view, `ios-in-app` for an iPhone or iPad app's, null for a real
+* browser (or when unsure). Hide those methods there, or offer to open the
+* page in the browser. Reads `userAgent`, the browser's own by default; a
+* server passes the request's.
+*/
+function embeddedBrowser(userAgent) {
+	const agent = userAgent ?? (typeof navigator === "undefined" ? void 0 : navigator.userAgent) ?? "";
+	if (!agent) return null;
+	const ios = /\b(iPhone|iPad|iPod)\b/.test(agent);
+	const android = /\bAndroid\b/.test(agent);
+	if (android && /;\s*wv\)/.test(agent)) return "android-webview";
+	if (IN_APP_MARKS.some((mark) => mark.test(agent))) return ios ? "ios-in-app" : android ? "android-webview" : null;
+	if (ios && /AppleWebKit\//.test(agent) && !/\bSafari\//.test(agent)) return "ios-in-app";
+	return null;
+}
 //#endregion
 //#region src/generated/errors.ts
 /** Each `code` a Synq API's problem documents carry, with its HTTP status. */
@@ -556,6 +866,7 @@ const ERROR_CODES = {
 	idempotency_key_conflict: 422,
 	idempotency_key_in_flight: 409,
 	conflict: 409,
+	ambiguous_name: 409,
 	org_slug_taken: 409,
 	issuer_slug_taken: 409,
 	issuer_slug_immutable: 422,
@@ -571,7 +882,13 @@ const ERROR_CODES = {
 	passkey_exists: 409,
 	sign_in_method_unavailable: 409,
 	identity_limit_reached: 409,
+	wallet_in_use: 409,
+	wallet_signature_rejected: 400,
 	connection_rejected: 422,
+	own_app_required: 422,
+	scope_not_allowed: 422,
+	scope_unavailable: 422,
+	scope_needs_own_app: 422,
 	token_gates_unavailable: 409,
 	passkey_rejected: 400,
 	email_undeliverable: 422,
@@ -584,6 +901,7 @@ const ERROR_CODES = {
 	no_billing_account: 409,
 	no_subscription: 409,
 	payment_failed: 402,
+	trial_unavailable: 409,
 	custom_domain_exists: 409,
 	hostname_taken: 409,
 	invalid_hostname: 422,
@@ -597,9 +915,224 @@ const ERROR_CODES = {
 	upload_expired: 410,
 	file_rejected: 422,
 	upload_limit_reached: 409,
+	picture_unavailable: 409,
+	api_keys_not_allowed: 403,
+	api_key_limit_reached: 409,
 	rate_limited: 429,
+	method_not_allowed: 405,
 	internal_error: 500,
-	service_unavailable: 503
+	service_unavailable: 503,
+	storage_unavailable: 503
 };
 //#endregion
-export { ERROR_CODES, SynqError, accountApiUrl, browserLocalStorage, browserSessionStorage, createAccountClient, createSynqClient, isSynqError, linkSignIn, memoryStorage, problemError };
+//#region src/avatar.ts
+/** The four 32-bit words of cyrb128 over `seed`. */
+function cyrb128(seed) {
+	let h1 = 1779033703;
+	let h2 = 3144134277;
+	let h3 = 1013904242;
+	let h4 = 2773480762;
+	for (let i = 0; i < seed.length; i++) {
+		const k = seed.charCodeAt(i);
+		h1 = h2 ^ Math.imul(h1 ^ k, 597399067);
+		h2 = h3 ^ Math.imul(h2 ^ k, 2869860233);
+		h3 = h4 ^ Math.imul(h3 ^ k, 951274213);
+		h4 = h1 ^ Math.imul(h4 ^ k, 2716044179);
+	}
+	h1 = Math.imul(h3 ^ h1 >>> 18, 597399067);
+	h2 = Math.imul(h4 ^ h2 >>> 22, 2869860233);
+	h3 = Math.imul(h1 ^ h3 >>> 17, 951274213);
+	h4 = Math.imul(h2 ^ h4 >>> 19, 2716044179);
+	h1 ^= h2 ^ h3 ^ h4;
+	h2 ^= h1;
+	h3 ^= h1;
+	h4 ^= h1;
+	return [
+		h1 >>> 0,
+		h2 >>> 0,
+		h3 >>> 0,
+		h4 >>> 0
+	];
+}
+/**
+* Which of a set of default pictures is the person's: of `set`, the one
+* whose id (`idOf`, the item itself for strings: a file id, a name, a URL
+* that never changes) scores highest with their seed (rendezvous hashing).
+* The same seed always picks the same one, and the set can grow and shrink
+* around it: adding one to a set of n moves only about 1 in n + 1 people,
+* to the new one, and removing one moves only the people who had it.
+* Undefined for an empty set.
+*/
+function defaultPick(seed, set, idOf = String) {
+	let best;
+	let high = -1;
+	let low = -1;
+	for (const item of set) {
+		const [w0, w1] = cyrb128(`${seed}:${idOf(item)}`);
+		if (w0 > high || w0 === high && w1 > low) {
+			best = item;
+			high = w0;
+			low = w1;
+		}
+	}
+	return best;
+}
+/** sRGB, 0 to 1 per channel, of OKLCH `l c h` (h in degrees), unclipped. */
+function oklchToLinear(l, c, h) {
+	const rad = h * Math.PI / 180;
+	const a = c * Math.cos(rad);
+	const b = c * Math.sin(rad);
+	const l_ = (l + .3963377774 * a + .2158037573 * b) ** 3;
+	const m_ = (l - .1055613458 * a - .0638541728 * b) ** 3;
+	const s_ = (l - .0894841775 * a - 1.291485548 * b) ** 3;
+	return [
+		4.0767416621 * l_ - 3.3077115913 * m_ + .2309699292 * s_,
+		-1.2684380046 * l_ + 2.6097574011 * m_ - .3413193965 * s_,
+		-.0041960863 * l_ - .7034186147 * m_ + 1.707614701 * s_
+	];
+}
+const inGamut = (rgb) => rgb.every((v) => v >= -1e-6 && v <= 1 + 1e-6);
+const encode = (v) => {
+	const x = Math.min(1, Math.max(0, v));
+	const e = x <= .0031308 ? 12.92 * x : 1.055 * x ** (1 / 2.4) - .055;
+	return Math.round(e * 255);
+};
+const decode = (byte) => {
+	const x = byte / 255;
+	return x <= .04045 ? x / 12.92 : ((x + .055) / 1.055) ** 2.4;
+};
+/** OKLCH as an sRGB byte triple, its chroma cut back until it fits sRGB. */
+function oklchBytes(l, c, h) {
+	let rgb = oklchToLinear(l, c, h);
+	if (!inGamut(rgb)) {
+		let low = 0;
+		let high = c;
+		for (let i = 0; i < 24; i++) {
+			const mid = (low + high) / 2;
+			if (inGamut(oklchToLinear(l, mid, h))) low = mid;
+			else high = mid;
+		}
+		rgb = oklchToLinear(l, low, h);
+	}
+	return [
+		encode(rgb[0]),
+		encode(rgb[1]),
+		encode(rgb[2])
+	];
+}
+const hex = (bytes) => `#${bytes.map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+/** WCAG's contrast of white on `bytes`. */
+function whiteContrast(bytes) {
+	const [r, g, b] = bytes.map(decode);
+	return 1.05 / (.2126 * r + .7152 * g + .0722 * b + .05);
+}
+/** OKLCH as hex, darkened in steps of 0.01 until white on it is at least 4.5:1 when `forWhite`. */
+function color(l, c, h, forWhite) {
+	let lightness = l;
+	let bytes = oklchBytes(lightness, c, h);
+	while (forWhite && whiteContrast(bytes) < 4.5 && lightness > .2) {
+		lightness = Math.round((lightness - .01) * 100) / 100;
+		bytes = oklchBytes(lightness, c, h);
+	}
+	return hex(bytes);
+}
+/**
+* How much a hue is in the band where a dark color turns olive or brown
+* (yellows, 55° to 125° in OKLCH): 1 at its middle, 0 outside it.
+*/
+function muddiness(hue) {
+	const off = Math.abs((hue - 90 + 540) % 360 - 180);
+	return off >= 35 ? 0 : Math.cos(off / 35 * (Math.PI / 2)) ** 2;
+}
+/**
+* A monogram's hue: the circle without that band, spread evenly over the
+* rest, since white text needs a darkness that band can't have and stay
+* clean.
+*/
+function monogramHue(hue) {
+	const spread = hue * 290 / 360;
+	return Math.round(spread < 55 ? spread : spread + 70) % 360;
+}
+/**
+* What the avatar for `seed` is drawn from: its two colors, angle,
+* highlight and, for a monogram, its initials. `avatarSvg` draws it; draw
+* it yourself from these to match it in another renderer.
+*/
+function avatarParts(seed, options = {}) {
+	const [w0, w1, w2, w3] = cyrb128(seed);
+	const h1 = w0 % 360;
+	const h2 = (h1 + 40 + w1 % 80) % 360;
+	const text = options.style === "monogram" ? cleanInitials(options.initials) : void 0;
+	const monogram = text !== void 0;
+	const lift = Math.round(muddiness(h2) * 12) / 100;
+	const m1 = monogramHue(h1);
+	const step = 25 + w1 % 45;
+	const near = (m1 + step) % 360;
+	const m2 = near >= 55 && near < 125 ? (m1 - step + 360) % 360 : near;
+	return {
+		from: monogram ? color(.55, .12, m1, true) : color(.82, .1, h1, false),
+		to: monogram ? color(.45, .12, m2, true) : color(.62 + lift, .14, h2, false),
+		angle: w2 % 360,
+		highlight: {
+			x: 16 + w3 % 32,
+			y: 16 + (w3 >>> 5) % 32
+		},
+		...monogram ? { text } : {}
+	};
+}
+/** At most two letters, uppercase, or undefined for none. */
+function cleanInitials(initials) {
+	const letters = [...(initials ?? "").replace(/[\s\p{C}]/gu, "")].slice(0, 2).join("");
+	return letters ? letters.toUpperCase() : void 0;
+}
+/** Up to two initials of a name, a username or an email address's local part; never of a wallet address. */
+function initialsOf(person) {
+	const candidates = [
+		person.name,
+		person.username,
+		person.email?.split("@")[0]
+	];
+	for (const candidate of candidates) {
+		const text = candidate?.trim();
+		if (!text || WALLET.test(text)) continue;
+		const letters = text.split(/[\s._-]+/u).filter((word) => /\p{L}|\p{N}/u.test(word)).slice(0, 2).map((word) => [...word.replace(/^[^\p{L}\p{N}]+/u, "")][0] ?? "").join("");
+		if (letters) return letters.toUpperCase();
+	}
+}
+/**
+* What `person`'s avatar is drawn from (AERO-2704): their picture and its
+* source, and for a default, their seed, initials and the brand's own
+* default. Give the picture when its source is one the app shows, else the
+* app's own art from `seed` (`defaultPick` over the app's set), else
+* `defaultPicture`, else Synq's (`avatarSvg(seed)`).
+*/
+function avatarOf(person) {
+	const picture = person.picture || void 0;
+	return {
+		picture,
+		source: person.picture_source || (picture ? "url" : "none"),
+		seed: person.avatar_seed || person.sub || person.id || "",
+		initials: initialsOf({
+			name: person.name,
+			username: person.preferred_username ?? person.username,
+			email: person.email
+		}),
+		defaultPicture: person.default_picture || void 0
+	};
+}
+/** A Solana address as people see one: base58, 32 to 44 characters. */
+const WALLET = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+const escapeText = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+/**
+* The avatar as an SVG document: one square of the gradient, which its
+* container clips to a circle, and the highlight over it. `id` names its two
+* gradients (`<id>g`, `<id>h`), so two on one page never share one.
+*/
+function avatarSvg(seed, options = {}) {
+	const parts = avatarParts(seed, options);
+	const id = (options.id ?? "av").replace(/[^A-Za-z0-9_-]/g, "");
+	const text = parts.text ? `<text x="32" y="32" dy=".35em" text-anchor="middle" font-family="system-ui,sans-serif" font-size="26" font-weight="600" fill="#fff">${escapeText(parts.text)}</text>` : "";
+	return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" aria-hidden="true"><defs><linearGradient id="${id}g" gradientTransform="rotate(${parts.angle} .5 .5)"><stop offset="0" stop-color="${parts.from}"/><stop offset="1" stop-color="${parts.to}"/></linearGradient><radialGradient id="${id}h"><stop offset="0" stop-color="#fff" stop-opacity=".3"/><stop offset="1" stop-color="#fff" stop-opacity="0"/></radialGradient></defs><rect width="64" height="64" fill="url(#${id}g)"/><circle cx="${parts.highlight.x}" cy="${parts.highlight.y}" r="26" fill="url(#${id}h)"/>${text}</svg>`;
+}
+//#endregion
+export { CHALLENGE_METHODS, CHALLENGE_PROBLEMS, ERROR_CODES, SignInFlow, SynqError, accountApiUrl, avatarOf, avatarParts, avatarSvg, browserLocalStorage, browserSessionStorage, createAccountClient, createSynqClient, cyrb128, defaultPick, embeddedBrowser, initialsOf, isSynqError, linkSignIn, memoryStorage, problemError, readMethodList, signInMethods, signInMethodsUrl, solveEmailWork, walletConflict };