@tdfc/sunbreak-react 0.1.12 → 0.1.14

package/dist/index.cjs

@@ -3,7 +3,7 @@
 var react = require('react');
 var jsxRuntime = require('react/jsx-runtime');
 
-var tn=Object.defineProperty;var jt=e=>{throw TypeError(e)};var rn=(e,t,r)=>t in e?tn(e,t,{enumerable:true,configurable:true,writable:true,value:r}):e[t]=r;var M=(e,t,r)=>rn(e,typeof t!="symbol"?t+"":t,r),Ut=(e,t,r)=>t.has(e)||jt("Cannot "+r);var h=(e,t,r)=>(Ut(e,t,"read from private field"),r?r.call(e):t.get(e)),U=(e,t,r)=>t.has(e)?jt("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,r),N=(e,t,r,n)=>(Ut(e,t,"write to private field"),t.set(e,r),r);var xe=async(e,t,r)=>{switch(e.name){case "custom":return {method:"provider_jwt",issuer:"custom",token:t,meta:r||{}};case "privy":return {method:"provider_jwt",issuer:"privy",token:t,meta:{app_id:e.appId}};case "dynamic":return e.expectedAud?{method:"provider_jwt",issuer:"dynamic",token:t,meta:{env_id:e.envId,expected_aud:e.expectedAud}}:{method:"provider_jwt",issuer:"dynamic",token:t,meta:{env_id:e.envId}};default:throw new Error(`Unknown adapter: ${e}`)}};var nn="sunbreak-kv",Ke="kv",Ge="sunbreak_dpop_meta_v1",T="sunbreak_dpop_key_v1",Ce="ES256",A="P-256",Te=e=>`${Ge}:${e}`,Nt=()=>new Promise((e,t)=>{let r=indexedDB.open(nn,1);r.onupgradeneeded=()=>r.result.createObjectStore(Ke),r.onsuccess=()=>e(r.result),r.onerror=()=>t(r.error);}),I=async e=>{try{let t=await Nt();return await new Promise((r,n)=>{let a=t.transaction(Ke,"readonly").objectStore(Ke).get(e);a.onsuccess=()=>r(a.result),a.onerror=()=>n(a.error);})}catch{return}},E=async(e,t)=>{let r=await Nt();await new Promise((n,o)=>{let i=r.transaction(Ke,"readwrite").objectStore(Ke).put(t,e);i.onsuccess=()=>n(),i.onerror=()=>o(i.error);});};var on=e=>{let t=new URL(e);if(t.protocol!=="https:"&&t.hostname!=="localhost"&&t.hostname!=="127.0.0.1")throw new Error("Sunbreak: insecure base URL");return t.hash="",t.origin},an=e=>e.replace(/\/+$/,""),dt=e=>{let t=an(e);return on(t)};function ht(e){let t=new URL(e.baseUrl),r=t.host,n=e.meta.lastHost??null,o=sn(n);return e.setLastHost(o),t.host=`${o}.${r}`,t.origin}var sn=e=>{for(let t=0;t<pt.length;t++){let r=pt[Math.floor(Math.random()*pt.length)].toLowerCase();if(r!==e)return r}return "alpha"},pt=["Alpha","Bravo","Charlie","Delta","Echo","Foxtrot","Golf","Hotel","India","Juliett","Kilo","Lima","Mike","November","Oscar","Papa","Quebec","Romeo","Sierra","Tango","Uniform","Victor","Whiskey","X-ray","Yankee","Zulu"];var F=(e,t)=>{let r={clientId:e.clientId,wallet:e.wallet,ifPolicyHash:e.meta.lastPolicyHash||void 0,ifPolicyProof:e.meta.lastPolicyProof||void 0,...t};Object.keys(r).forEach(o=>r[o]===void 0&&delete r[o]);let n=JSON.stringify(r);return btoa(n)};var cn=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","via"]),ln=new Set(["user-agent","referer","origin","host","content-length","sec-fetch-site","sec-fetch-mode","sec-fetch-dest","sec-fetch-user","sec-ch-ua","sec-ch-ua-mobile","sec-ch-ua-platform","sec-ch-ua-platform-version","sec-ch-ua-full-version","sec-ch-ua-arch","sec-ch-ua-model","sec-ch-ua-bitness","cookie","set-cookie"]),un=new Set(["dpop","x-sunbreak-meta"]),fn=64,Ft=2048,dn=64;function yt(e){let t={};if(!e)return t;let r=e instanceof Headers?Array.from(e.entries()):Object.entries(e),n=0;for(let[o,a]of r){if(n>=dn)break;if(o==null||a==null)continue;let i=String(o).toLowerCase().trim();if(!i||i.length>fn||cn.has(i)||ln.has(i)||un.has(i))continue;let c=String(a);c.length>Ft&&(c=c.slice(0,Ft)),t[i]=c,n++;}return t}var re=new TextEncoder,we=new TextDecoder;function Bt(...e){let t=e.reduce((o,{length:a})=>o+a,0),r=new Uint8Array(t),n=0;for(let o of e)r.set(o,n),n+=o.length;return r}function Gt(e){if(Uint8Array.prototype.toBase64)return e.toBase64();let t=32768,r=[];for(let n=0;n<e.length;n+=t)r.push(String.fromCharCode.apply(null,e.subarray(n,n+t)));return btoa(r.join(""))}function Vt(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}function qt(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(typeof e=="string"?e:we.decode(e),{alphabet:"base64url"});let t=e;t instanceof Uint8Array&&(t=we.decode(t)),t=t.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"");try{return Vt(t)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}}function Ve(e){let t=e;return typeof t=="string"&&(t=re.encode(t)),Uint8Array.prototype.toBase64?t.toBase64({alphabet:"base64url",omitPadding:true}):Gt(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}var ue=class extends Error{constructor(r,n){super(r,n);M(this,"code","ERR_JOSE_GENERIC");this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor);}};M(ue,"code","ERR_JOSE_GENERIC");var D=class extends ue{constructor(){super(...arguments);M(this,"code","ERR_JOSE_NOT_SUPPORTED");}};M(D,"code","ERR_JOSE_NOT_SUPPORTED");var ne=class extends ue{constructor(){super(...arguments);M(this,"code","ERR_JWS_INVALID");}};M(ne,"code","ERR_JWS_INVALID");var Ie=class extends ue{constructor(){super(...arguments);M(this,"code","ERR_JWT_INVALID");}};M(Ie,"code","ERR_JWT_INVALID");var zt,Xt,mt=class extends(Xt=ue,zt=Symbol.asyncIterator,Xt){constructor(r="multiple matching keys found in the JSON Web Key Set",n){super(r,n);M(this,zt);M(this,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");}};M(mt,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");function q(e,t="algorithm.name"){return new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`)}function ge(e,t){return e.name===t}function wt(e){return parseInt(e.name.slice(4),10)}function yn(e){switch(e){case "ES256":return "P-256";case "ES384":return "P-384";case "ES512":return "P-521";default:throw new Error("unreachable")}}function mn(e,t){if(!e.usages.includes(t))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function Yt(e,t,r){switch(t){case "HS256":case "HS384":case "HS512":{if(!ge(e.algorithm,"HMAC"))throw q("HMAC");let n=parseInt(t.slice(2),10);if(wt(e.algorithm.hash)!==n)throw q(`SHA-${n}`,"algorithm.hash");break}case "RS256":case "RS384":case "RS512":{if(!ge(e.algorithm,"RSASSA-PKCS1-v1_5"))throw q("RSASSA-PKCS1-v1_5");let n=parseInt(t.slice(2),10);if(wt(e.algorithm.hash)!==n)throw q(`SHA-${n}`,"algorithm.hash");break}case "PS256":case "PS384":case "PS512":{if(!ge(e.algorithm,"RSA-PSS"))throw q("RSA-PSS");let n=parseInt(t.slice(2),10);if(wt(e.algorithm.hash)!==n)throw q(`SHA-${n}`,"algorithm.hash");break}case "Ed25519":case "EdDSA":{if(!ge(e.algorithm,"Ed25519"))throw q("Ed25519");break}case "ML-DSA-44":case "ML-DSA-65":case "ML-DSA-87":{if(!ge(e.algorithm,t))throw q(t);break}case "ES256":case "ES384":case "ES512":{if(!ge(e.algorithm,"ECDSA"))throw q("ECDSA");let n=yn(t);if(e.algorithm.namedCurve!==n)throw q(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}mn(e,r);}function Zt(e,t,...r){if(r=r.filter(Boolean),r.length>2){let n=r.pop();e+=`one of type ${r.join(", ")}, or ${n}.`;}else r.length===2?e+=`one of type ${r[0]} or ${r[1]}.`:e+=`of type ${r[0]}.`;return t==null?e+=` Received ${t}`:typeof t=="function"&&t.name?e+=` Received function ${t.name}`:typeof t=="object"&&t!=null&&t.constructor?.name&&(e+=` Received an instance of ${t.constructor.name}`),e}var Qt=(e,...t)=>Zt("Key must be ",e,...t);function gt(e,t,...r){return Zt(`Key for the ${e} algorithm must be `,t,...r)}function bt(e){return e?.[Symbol.toStringTag]==="CryptoKey"}function St(e){return e?.[Symbol.toStringTag]==="KeyObject"}var Rt=e=>bt(e)||St(e);var er=(...e)=>{let t=e.filter(Boolean);if(t.length===0||t.length===1)return  true;let r;for(let n of t){let o=Object.keys(n);if(!r||r.size===0){r=new Set(o);continue}for(let a of o){if(r.has(a))return  false;r.add(a);}}return  true};function wn(e){return typeof e=="object"&&e!==null}var qe=e=>{if(!wn(e)||Object.prototype.toString.call(e)!=="[object Object]")return  false;if(Object.getPrototypeOf(e)===null)return  true;let t=e;for(;Object.getPrototypeOf(t)!==null;)t=Object.getPrototypeOf(t);return Object.getPrototypeOf(e)===t};var tr=(e,t)=>{if(e.startsWith("RS")||e.startsWith("PS")){let{modulusLength:r}=t.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}};function gn(e){let t,r;switch(e.kty){case "AKP":{switch(e.alg){case "ML-DSA-44":case "ML-DSA-65":case "ML-DSA-87":t={name:e.alg},r=e.priv?["sign"]:["verify"];break;default:throw new D('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case "RSA":{switch(e.alg){case "PS256":case "PS384":case "PS512":t={name:"RSA-PSS",hash:`SHA-${e.alg.slice(-3)}`},r=e.d?["sign"]:["verify"];break;case "RS256":case "RS384":case "RS512":t={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${e.alg.slice(-3)}`},r=e.d?["sign"]:["verify"];break;case "RSA-OAEP":case "RSA-OAEP-256":case "RSA-OAEP-384":case "RSA-OAEP-512":t={name:"RSA-OAEP",hash:`SHA-${parseInt(e.alg.slice(-3),10)||1}`},r=e.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new D('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case "EC":{switch(e.alg){case "ES256":t={name:"ECDSA",namedCurve:"P-256"},r=e.d?["sign"]:["verify"];break;case "ES384":t={name:"ECDSA",namedCurve:"P-384"},r=e.d?["sign"]:["verify"];break;case "ES512":t={name:"ECDSA",namedCurve:"P-521"},r=e.d?["sign"]:["verify"];break;case "ECDH-ES":case "ECDH-ES+A128KW":case "ECDH-ES+A192KW":case "ECDH-ES+A256KW":t={name:"ECDH",namedCurve:e.crv},r=e.d?["deriveBits"]:[];break;default:throw new D('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case "OKP":{switch(e.alg){case "Ed25519":case "EdDSA":t={name:"Ed25519"},r=e.d?["sign"]:["verify"];break;case "ECDH-ES":case "ECDH-ES+A128KW":case "ECDH-ES+A192KW":case "ECDH-ES+A256KW":t={name:e.crv},r=e.d?["deriveBits"]:[];break;default:throw new D('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}default:throw new D('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return {algorithm:t,keyUsages:r}}var rr=async e=>{if(!e.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:t,keyUsages:r}=gn(e),n={...e};return n.kty!=="AKP"&&delete n.alg,delete n.use,crypto.subtle.importKey("jwk",n,t,e.ext??!(e.d||e.priv),e.key_ops??r)};var nr=(e,t,r,n,o)=>{if(o.crit!==void 0&&n?.crit===void 0)throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return new Set;if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(i=>typeof i!="string"||i.length===0))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let a;r!==void 0?a=new Map([...Object.entries(r),...t.entries()]):a=t;for(let i of n.crit){if(!a.has(i))throw new D(`Extension Header Parameter "${i}" is not recognized`);if(o[i]===void 0)throw new e(`Extension Header Parameter "${i}" is missing`);if(a.get(i)&&n[i]===void 0)throw new e(`Extension Header Parameter "${i}" MUST be integrity protected`)}return new Set(n.crit)};function We(e){return qe(e)&&typeof e.kty=="string"}function or(e){return e.kty!=="oct"&&(e.kty==="AKP"&&typeof e.priv=="string"||typeof e.d=="string")}function ar(e){return e.kty!=="oct"&&typeof e.d>"u"&&typeof e.priv>"u"}function ir(e){return e.kty==="oct"&&typeof e.k=="string"}var be,sr=async(e,t,r,n=false)=>{be||(be=new WeakMap);let o=be.get(e);if(o?.[r])return o[r];let a=await rr({...t,alg:r});return n&&Object.freeze(e),o?o[r]=a:be.set(e,{[r]:a}),a},Sn=(e,t)=>{be||(be=new WeakMap);let r=be.get(e);if(r?.[t])return r[t];let n=e.type==="public",o=!!n,a;if(e.asymmetricKeyType==="x25519"){switch(t){case "ECDH-ES":case "ECDH-ES+A128KW":case "ECDH-ES+A192KW":case "ECDH-ES+A256KW":break;default:throw new TypeError("given KeyObject instance cannot be used for this algorithm")}a=e.toCryptoKey(e.asymmetricKeyType,o,n?[]:["deriveBits"]);}if(e.asymmetricKeyType==="ed25519"){if(t!=="EdDSA"&&t!=="Ed25519")throw new TypeError("given KeyObject instance cannot be used for this algorithm");a=e.toCryptoKey(e.asymmetricKeyType,o,[n?"verify":"sign"]);}switch(e.asymmetricKeyType){case "ml-dsa-44":case "ml-dsa-65":case "ml-dsa-87":{if(t!==e.asymmetricKeyType.toUpperCase())throw new TypeError("given KeyObject instance cannot be used for this algorithm");a=e.toCryptoKey(e.asymmetricKeyType,o,[n?"verify":"sign"]);}}if(e.asymmetricKeyType==="rsa"){let i;switch(t){case "RSA-OAEP":i="SHA-1";break;case "RS256":case "PS256":case "RSA-OAEP-256":i="SHA-256";break;case "RS384":case "PS384":case "RSA-OAEP-384":i="SHA-384";break;case "RS512":case "PS512":case "RSA-OAEP-512":i="SHA-512";break;default:throw new TypeError("given KeyObject instance cannot be used for this algorithm")}if(t.startsWith("RSA-OAEP"))return e.toCryptoKey({name:"RSA-OAEP",hash:i},o,n?["encrypt"]:["decrypt"]);a=e.toCryptoKey({name:t.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:i},o,[n?"verify":"sign"]);}if(e.asymmetricKeyType==="ec"){let c=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(e.asymmetricKeyDetails?.namedCurve);if(!c)throw new TypeError("given KeyObject instance cannot be used for this algorithm");t==="ES256"&&c==="P-256"&&(a=e.toCryptoKey({name:"ECDSA",namedCurve:c},o,[n?"verify":"sign"])),t==="ES384"&&c==="P-384"&&(a=e.toCryptoKey({name:"ECDSA",namedCurve:c},o,[n?"verify":"sign"])),t==="ES512"&&c==="P-521"&&(a=e.toCryptoKey({name:"ECDSA",namedCurve:c},o,[n?"verify":"sign"])),t.startsWith("ECDH-ES")&&(a=e.toCryptoKey({name:"ECDH",namedCurve:c},o,n?[]:["deriveBits"]));}if(!a)throw new TypeError("given KeyObject instance cannot be used for this algorithm");return r?r[t]=a:be.set(e,{[t]:a}),a},cr=async(e,t)=>{if(e instanceof Uint8Array||bt(e))return e;if(St(e)){if(e.type==="secret")return e.export();if("toCryptoKey"in e&&typeof e.toCryptoKey=="function")try{return Sn(e,t)}catch(n){if(n instanceof TypeError)throw n}let r=e.export({format:"jwk"});return sr(e,r,t)}if(We(e))return e.k?qt(e.k):sr(e,e,t,true);throw new Error("unreachable")};var Se=e=>e?.[Symbol.toStringTag],Et=(e,t,r)=>{if(t.use!==void 0){let n;switch(r){case "sign":case "verify":n="sig";break;case "encrypt":case "decrypt":n="enc";break}if(t.use!==n)throw new TypeError(`Invalid key for this operation, its "use" must be "${n}" when present`)}if(t.alg!==void 0&&t.alg!==e)throw new TypeError(`Invalid key for this operation, its "alg" must be "${e}" when present`);if(Array.isArray(t.key_ops)){let n;switch(true){case(r==="sign"):case e==="dir":case e.includes("CBC-HS"):n=r;break;case e.startsWith("PBES2"):n="deriveBits";break;case /^A\d{3}(?:GCM)?(?:KW)?$/.test(e):!e.includes("GCM")&&e.endsWith("KW")?n="unwrapKey":n=r;break;case(r==="encrypt"):n="wrapKey";break;case r==="decrypt":n=e.startsWith("RSA")?"unwrapKey":"deriveBits";break}if(n&&t.key_ops?.includes?.(n)===false)throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${n}" when present`)}return  true},Rn=(e,t,r)=>{if(!(t instanceof Uint8Array)){if(We(t)){if(ir(t)&&Et(e,t,r))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!Rt(t))throw new TypeError(gt(e,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if(t.type!=="secret")throw new TypeError(`${Se(t)} instances for symmetric algorithms must be of type "secret"`)}},En=(e,t,r)=>{if(We(t))switch(r){case "decrypt":case "sign":if(or(t)&&Et(e,t,r))return;throw new TypeError("JSON Web Key for this operation be a private JWK");case "encrypt":case "verify":if(ar(t)&&Et(e,t,r))return;throw new TypeError("JSON Web Key for this operation be a public JWK")}if(!Rt(t))throw new TypeError(gt(e,t,"CryptoKey","KeyObject","JSON Web Key"));if(t.type==="secret")throw new TypeError(`${Se(t)} instances for asymmetric algorithms must not be of type "secret"`);if(t.type==="public")switch(r){case "sign":throw new TypeError(`${Se(t)} instances for asymmetric algorithm signing must be of type "private"`);case "decrypt":throw new TypeError(`${Se(t)} instances for asymmetric algorithm decryption must be of type "private"`);}if(t.type==="private")switch(r){case "verify":throw new TypeError(`${Se(t)} instances for asymmetric algorithm verifying must be of type "public"`);case "encrypt":throw new TypeError(`${Se(t)} instances for asymmetric algorithm encryption must be of type "public"`);}},lr=(e,t,r)=>{e.startsWith("HS")||e==="dir"||e.startsWith("PBES2")||/^A(?:128|192|256)(?:GCM)?(?:KW)?$/.test(e)||/^A(?:128|192|256)CBC-HS(?:256|384|512)$/.test(e)?Rn(e,t,r):En(e,t,r);};var ur=(e,t)=>{let r=`SHA-${e.slice(-3)}`;switch(e){case "HS256":case "HS384":case "HS512":return {hash:r,name:"HMAC"};case "PS256":case "PS384":case "PS512":return {hash:r,name:"RSA-PSS",saltLength:parseInt(e.slice(-3),10)>>3};case "RS256":case "RS384":case "RS512":return {hash:r,name:"RSASSA-PKCS1-v1_5"};case "ES256":case "ES384":case "ES512":return {hash:r,name:"ECDSA",namedCurve:t.namedCurve};case "Ed25519":case "EdDSA":return {name:"Ed25519"};case "ML-DSA-44":case "ML-DSA-65":case "ML-DSA-87":return {name:e};default:throw new D(`alg ${e} is not supported either by JOSE or your javascript runtime`)}};var fr=async(e,t,r)=>{if(t instanceof Uint8Array){if(!e.startsWith("HS"))throw new TypeError(Qt(t,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",t,{hash:`SHA-${e.slice(-3)}`,name:"HMAC"},false,[r])}return Yt(t,e,r),t};var ie=e=>Math.floor(e.getTime()/1e3);var kn=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,ze=e=>{let t=kn.exec(e);if(!t||t[4]&&t[1])throw new TypeError("Invalid time period format");let r=parseFloat(t[2]),n=t[3].toLowerCase(),o;switch(n){case "sec":case "secs":case "second":case "seconds":case "s":o=Math.round(r);break;case "minute":case "minutes":case "min":case "mins":case "m":o=Math.round(r*60);break;case "hour":case "hours":case "hr":case "hrs":case "h":o=Math.round(r*3600);break;case "day":case "days":case "d":o=Math.round(r*86400);break;case "week":case "weeks":case "w":o=Math.round(r*604800);break;default:o=Math.round(r*31557600);break}return t[1]==="-"||t[4]==="ago"?-o:o};function fe(e,t){if(!Number.isFinite(t))throw new TypeError(`Invalid ${e} input`);return t}var x,Xe=class{constructor(t){U(this,x);if(!qe(t))throw new TypeError("JWT Claims Set MUST be an object");N(this,x,structuredClone(t));}data(){return re.encode(JSON.stringify(h(this,x)))}get iss(){return h(this,x).iss}set iss(t){h(this,x).iss=t;}get sub(){return h(this,x).sub}set sub(t){h(this,x).sub=t;}get aud(){return h(this,x).aud}set aud(t){h(this,x).aud=t;}set jti(t){h(this,x).jti=t;}set nbf(t){typeof t=="number"?h(this,x).nbf=fe("setNotBefore",t):t instanceof Date?h(this,x).nbf=fe("setNotBefore",ie(t)):h(this,x).nbf=ie(new Date)+ze(t);}set exp(t){typeof t=="number"?h(this,x).exp=fe("setExpirationTime",t):t instanceof Date?h(this,x).exp=fe("setExpirationTime",ie(t)):h(this,x).exp=ie(new Date)+ze(t);}set iat(t){typeof t>"u"?h(this,x).iat=ie(new Date):t instanceof Date?h(this,x).iat=fe("setIssuedAt",ie(t)):typeof t=="string"?h(this,x).iat=fe("setIssuedAt",ie(new Date)+ze(t)):h(this,x).iat=fe("setIssuedAt",t);}};x=new WeakMap;var dr=async(e,t,r)=>{let n=await fr(e,t,"sign");tr(e,n);let o=await crypto.subtle.sign(ur(e,n.algorithm),n,r);return new Uint8Array(o)};var Je,L,z,Ye=class{constructor(t){U(this,Je);U(this,L);U(this,z);if(!(t instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");N(this,Je,t);}setProtectedHeader(t){if(h(this,L))throw new TypeError("setProtectedHeader can only be called once");return N(this,L,t),this}setUnprotectedHeader(t){if(h(this,z))throw new TypeError("setUnprotectedHeader can only be called once");return N(this,z,t),this}async sign(t,r){if(!h(this,L)&&!h(this,z))throw new ne("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!er(h(this,L),h(this,z)))throw new ne("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let n={...h(this,L),...h(this,z)},o=nr(ne,new Map([["b64",true]]),r?.crit,h(this,L),n),a=true;if(o.has("b64")&&(a=h(this,L).b64,typeof a!="boolean"))throw new ne('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:i}=n;if(typeof i!="string"||!i)throw new ne('JWS "alg" (Algorithm) Header Parameter missing or invalid');lr(i,t,"sign");let c=h(this,Je);a&&(c=re.encode(Ve(c)));let u;h(this,L)?u=re.encode(Ve(JSON.stringify(h(this,L)))):u=re.encode("");let s=Bt(u,re.encode("."),c),l=await cr(t,i),p=await dr(i,l,s),f={signature:Ve(p),payload:""};return a&&(f.payload=we.decode(c)),h(this,z)&&(f.header=h(this,z)),h(this,L)&&(f.protected=we.decode(u)),f}};Je=new WeakMap,L=new WeakMap,z=new WeakMap;var Re,Ze=class{constructor(t){U(this,Re);N(this,Re,new Ye(t));}setProtectedHeader(t){return h(this,Re).setProtectedHeader(t),this}async sign(t,r){let n=await h(this,Re).sign(t,r);if(n.payload===void 0)throw new TypeError("use the flattened module for creating JWS with b64: false");return `${n.protected}.${n.payload}.${n.signature}`}};Re=new WeakMap;var se,$,de=class{constructor(t={}){U(this,se);U(this,$);N(this,$,new Xe(t));}setIssuer(t){return h(this,$).iss=t,this}setSubject(t){return h(this,$).sub=t,this}setAudience(t){return h(this,$).aud=t,this}setJti(t){return h(this,$).jti=t,this}setNotBefore(t){return h(this,$).nbf=t,this}setExpirationTime(t){return h(this,$).exp=t,this}setIssuedAt(t){return h(this,$).iat=t,this}setProtectedHeader(t){return N(this,se,t),this}async sign(t,r){let n=new Ze(h(this,$).data());if(n.setProtectedHeader(h(this,se)),Array.isArray(h(this,se)?.crit)&&h(this,se).crit.includes("b64")&&h(this,se).b64===false)throw new Ie("JWTs MUST NOT use unencoded payload");return n.sign(t,r)}};se=new WeakMap,$=new WeakMap;var Pn=e=>btoa(String.fromCharCode(...new Uint8Array(e))).replaceAll("+","-").replaceAll("/","_").replaceAll("=",""),Qe=async e=>{let t=new TextEncoder().encode(e),r=await crypto.subtle.digest("SHA-256",t);return Pn(r)},B=async e=>{let{method:t,url:r,nonce:n,ath:o,privateKey:a,publicJwk:i}=e,c={htm:t.toUpperCase(),htu:r,jti:crypto.randomUUID(),iat:Math.floor(Date.now()/1e3)};return n&&(c.nonce=n),o&&(c.ath=o),await new de(c).setProtectedHeader({alg:"ES256",typ:"dpop+jwt",jwk:i}).sign(a)};var _=async e=>{let t={crv:e.crv,kty:"EC",x:e.x,y:e.y},r=JSON.stringify(t),n=new TextEncoder().encode(r),o=await crypto.subtle.digest("SHA-256",n);return btoa(String.fromCharCode(...new Uint8Array(o))).replaceAll("+","-").replaceAll("/","_").replaceAll("=","")};async function pe(e){let{rootPrivateKey:t,rootPublicJwk:r,childJkt:n,clientId:o,sid:a,ttlSec:i=300}=e,c=Math.floor(Date.now()/1e3),u=c+Math.max(60,Math.min(i,3600)),s={child_jkt:n,client_id:o,aud:"issuer",iat:c,exp:u,jti:crypto.randomUUID()};return a&&(s.sid=a),await new de(s).setProtectedHeader({alg:"ES256",typ:"pode+jwt",jwk:r}).sign(t)}function De(e,t=300){return e.replace(/<[^>]*>/g,"").slice(0,t)}async function Le(e){let t=e.status,r=Array.from(e.headers.keys()).some(c=>c.toLowerCase().startsWith("x-amzn-waf")),n,o,a=e.headers.get("content-type")||"";if(a.includes("application/json"))try{let c=await e.clone().json();n=typeof c?.error=="string"?c.error:void 0,o=typeof c?.detail=="string"?c.detail:void 0;}catch{}let i=t===403&&!r&&!a.includes("application/json");return {status:t,code:n,detail:o,waf:r,alb403:i}}function he(e,t){let r=new Error(e);return r.status=t.status,r.code=t.code,r.detail=t.detail,r.waf=t.waf,r.alb403=t.alb403,r}var kt=e=>/^0x[a-fA-F0-9]{40}$/.test(e),X=(e,t)=>!e||!t?false:kt(e)&&kt(t)?e.toLowerCase()===t.toLowerCase():e===t;var Ee={boundWallet:null,clientId:null,jkt:null,refreshId:null,lastPolicyHash:null,lastPolicyProof:null,lastHost:null,rootJkt:null},Pt=react.createContext(void 0);function wr(e){try{return JSON.parse(localStorage.getItem(e)||"null")??Ee}catch{return Ee}}function xn(e,t){try{localStorage.setItem(e,JSON.stringify(t));}catch{}}var At=({children:e,clientId:t})=>{let[r,n]=react.useState(Ee),o=react.useRef(false),[a,i]=react.useState(false),c=react.useMemo(()=>Te(t),[t]);react.useEffect(()=>{let d=true;return (async()=>{let y=await I(c)??await I(Ge)??wr(c);d&&(n({...Ee,...y}),o.current=true,i(true));})(),()=>{d=false;}},[c]),react.useEffect(()=>{o.current&&(async()=>(await E(c,r),xn(c,r)))();},[r,c]);let u=react.useCallback(d=>n(w=>({...w,refreshId:d})),[]),s=react.useCallback(d=>n(w=>({...w,lastPolicyHash:d})),[]),l=react.useCallback(d=>n(w=>({...w,lastPolicyProof:d})),[]),p=react.useCallback(d=>n(w=>({...w,lastHost:d})),[]),f=react.useCallback(d=>n(w=>({...w,rootJkt:d})),[]),g=async()=>{try{let d=localStorage.getItem(c);if(d){let w=JSON.parse(d);if(typeof w?.refreshId=="string"&&w.refreshId)return w.refreshId}}catch{}try{let d=await I(c);if(typeof d?.refreshId=="string"&&d.refreshId)return d.refreshId}catch{}return null},b=react.useCallback(d=>n(w=>({...w,boundWallet:d})),[]),R=react.useCallback(d=>n(w=>({...w,clientId:d})),[]),m=react.useCallback(d=>n(w=>({...w,jkt:d})),[]),k=react.useCallback(()=>n(Ee),[]),S=react.useCallback(async()=>{let w=await I(c)??wr(c);n({...Ee,...w});},[]),H=react.useMemo(()=>({meta:r,setBoundWallet:b,setClientId:R,setJkt:m,resetMeta:k,reload:S,setRefreshId:u,getRefreshId:g,ready:a,setLastPolicyHash:s,setLastPolicyProof:l,setLastHost:p,setRootJkt:f}),[r,b,R,m,k,S,a,u,g,s,l,p,f]);return jsxRuntime.jsx(Pt.Provider,{value:H,children:e})};function vt(){let e=react.useContext(Pt);if(!e)throw new Error("useMeta must be used within <MetaProvider>");return e}var br=`${T}:wrap`;async function et(){try{let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:A},!1,["sign","verify"]),t=`${T}:probe_safe`;await E(t,{fmt:"cryptokey",privKey:e.privateKey});let r=await I(t);return await E(t,void 0),!!(r&&r.privKey)}catch{return  false}}async function Tn(){try{let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:A},!0,["sign","verify"]),t=`${T}:probe`;await E(t,{fmt:"cryptokey",privKey:e.privateKey});let r=await I(t);return await E(t,void 0),!!(r&&r.privKey)}catch{return  false}}function Pe(e){let t={...e};return delete t.d,t.kty="EC",t.crv=A,t.alg=Ce,t.use="sig",t}async function Sr(){let e=await I(br);if(!e){let t=new Uint8Array(32);crypto.getRandomValues(t),e=t.buffer,await E(br,e);}return crypto.subtle.importKey("raw",e,{name:"AES-GCM",length:256},false,["encrypt","decrypt"])}async function xt(e){let t=await Sr(),r=new Uint8Array(12);crypto.getRandomValues(r);let n=new TextEncoder().encode(JSON.stringify(e));return {encPrivJwk:await crypto.subtle.encrypt({name:"AES-GCM",iv:r},t,n),iv:r.buffer}}async function In(e,t){let r=await Sr(),n=await crypto.subtle.decrypt({name:"AES-GCM",iv:t},r,e);return JSON.parse(new TextDecoder().decode(new Uint8Array(n)))}var Kt=()=>{let e=react.useRef(null),t=react.useRef(null),r=react.useCallback(async()=>{let u=await I(T);if(!u)return  false;if(u.fmt==="cryptokey"){let l=u;if(!l.privKey)return await E(T,void 0),false;let p=l.privKey;try{if(p.extractable&&await et()){let g=await crypto.subtle.exportKey("jwk",p),b=await crypto.subtle.importKey("jwk",g,{name:"ECDSA",namedCurve:A},!1,["sign"]),R={fmt:"cryptokey",privKey:b,pubJwk:Pe(l.pubJwk)};await E(T,R),p=b;}}catch{}return e.current=p,t.current=Pe(l.pubJwk),true}if(u.fmt==="encjwk"){let l=u;try{let p=await In(l.encPrivJwk,l.iv),f=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:A},!1,["sign"]);return e.current=f,t.current=Pe(l.pubJwk),!0}catch{return await E(T,void 0),false}}let s=u;if(s&&s.d){let{d:l,...p}=s,f=Pe(p),g=await et(),b=g||await Tn();if(b&&g){let S=await crypto.subtle.importKey("jwk",s,{name:"ECDSA",namedCurve:A},false,["sign"]);return await E(T,{fmt:"cryptokey",privKey:S,pubJwk:f}),e.current=S,t.current=f,true}if(b){let S=await crypto.subtle.importKey("jwk",s,{name:"ECDSA",namedCurve:A},true,["sign"]);return await E(T,{fmt:"cryptokey",privKey:S,pubJwk:f}),e.current=S,t.current=f,true}let{encPrivJwk:R,iv:m}=await xt(s);await E(T,{fmt:"encjwk",encPrivJwk:R,iv:m,pubJwk:f});let k=await crypto.subtle.importKey("jwk",s,{name:"ECDSA",namedCurve:A},false,["sign"]);return e.current=k,t.current=f,true}return await E(T,void 0),false},[]),n=react.useCallback(async(u,s)=>{await E(T,{fmt:"cryptokey",privKey:u,pubJwk:s});},[]),o=react.useCallback(async(u,s)=>{let{encPrivJwk:l,iv:p}=await xt(u);await E(T,{fmt:"encjwk",encPrivJwk:l,iv:p,pubJwk:s});},[]),a=react.useCallback(async()=>{if(e.current&&t.current||await r())return;let u=await et(),s=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:A},true,["sign","verify"]),l=Pe(await crypto.subtle.exportKey("jwk",s.publicKey)),p=await crypto.subtle.exportKey("jwk",s.privateKey);if(u){let f=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:A},false,["sign"]);await n(f,l),e.current=f,t.current=l;}else {await o(p,l);let f=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:A},false,["sign"]);e.current=f,t.current=l;}},[r,n,o]),i=react.useCallback(async()=>{let u=await et(),s=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:A},true,["sign","verify"]),l=Pe(await crypto.subtle.exportKey("jwk",s.publicKey)),p=await crypto.subtle.exportKey("jwk",s.privateKey);if(u){let f=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:A},false,["sign"]);await E(T,{fmt:"cryptokey",privKey:f,pubJwk:l}),e.current=f,t.current=l;}else {let{encPrivJwk:f,iv:g}=await xt(p);await E(T,{fmt:"encjwk",encPrivJwk:f,iv:g,pubJwk:l});let b=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:A},false,["sign"]);e.current=b,t.current=l;}},[]),c=react.useCallback(async()=>{await E(T,void 0),e.current=null,t.current=null;},[]);return {ensureKeypair:a,rotate:i,clear:c,privRef:e,pubJwkRef:t}};var Z="sunbreak_root_key_v1",Er=`${Z}:wrap`;async function kr(){try{let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:A},!1,["sign","verify"]),t=`${Z}:probe_safe`;await E(t,{fmt:"cryptokey",privKey:e.privateKey,createdAt:Date.now(),pubJwk:{}});let r=await I(t);return await E(t,void 0),!!(r&&r.privKey)}catch{return  false}}function tt(e){let t={...e};return delete t.d,t.kty="EC",t.crv=A,t.alg=Ce,t.use="sig",t}async function Pr(){let e=await I(Er);if(!e){let t=new Uint8Array(32);crypto.getRandomValues(t),e=t.buffer,await E(Er,e);}return crypto.subtle.importKey("raw",e,{name:"AES-GCM",length:256},false,["encrypt","decrypt"])}async function Wn(e){let t=await Pr(),r=new Uint8Array(12);crypto.getRandomValues(r);let n=new TextEncoder().encode(JSON.stringify(e));return {encPrivJwk:await crypto.subtle.encrypt({name:"AES-GCM",iv:r},t,n),iv:r.buffer}}async function Jn(e,t){let r=await Pr(),n=await crypto.subtle.decrypt({name:"AES-GCM",iv:t},r,e);return JSON.parse(new TextDecoder().decode(new Uint8Array(n)))}var Tt=()=>{let e=react.useRef(null),t=react.useRef(null),r=react.useCallback(async()=>{let a=await I(Z);if(!a)return  false;if(a.fmt==="cryptokey"){let i=a;if(!i.privKey)return await E(Z,void 0),false;let c=i.privKey;try{if(c.extractable&&await kr()){let s=await crypto.subtle.exportKey("jwk",c),l=await crypto.subtle.importKey("jwk",s,{name:"ECDSA",namedCurve:A},!1,["sign"]),p={fmt:"cryptokey",privKey:l,pubJwk:tt(i.pubJwk),createdAt:i.createdAt};await E(Z,p),c=l;}}catch{}return e.current=c,t.current=tt(i.pubJwk),true}if(a.fmt==="encjwk"){let i=a;try{let c=await Jn(i.encPrivJwk,i.iv),u=await crypto.subtle.importKey("jwk",c,{name:"ECDSA",namedCurve:A},!1,["sign"]);return e.current=u,t.current=tt(i.pubJwk),!0}catch{return await E(Z,void 0),false}}return await E(Z,void 0),false},[]),n=react.useCallback(async()=>{if(e.current&&t.current||await r())return;let a=await kr(),i=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:A},true,["sign","verify"]),c=tt(await crypto.subtle.exportKey("jwk",i.publicKey)),u=Date.now(),s=await crypto.subtle.exportKey("jwk",i.privateKey);if(a){let l=await crypto.subtle.importKey("jwk",s,{name:"ECDSA",namedCurve:A},false,["sign"]);await E(Z,{fmt:"cryptokey",privKey:l,pubJwk:c,createdAt:u}),e.current=l,t.current=c;}else {let{encPrivJwk:l,iv:p}=await Wn(s);await E(Z,{fmt:"encjwk",encPrivJwk:l,iv:p,pubJwk:c,createdAt:u});let g=await crypto.subtle.importKey("jwk",s,{name:"ECDSA",namedCurve:A},false,["sign"]);e.current=g,t.current=c;}},[r]),o=react.useCallback(async()=>{await E(Z,void 0),e.current=null,t.current=null;},[]);return {ensureRootKeypair:n,clear:o,rootPrivRef:e,rootPubJwkRef:t}};var _e=class e{constructor(t,r=false){this.colors={flow:"#00D9FF",state:"#00FF88",decision:"#FFB800",api:"#B388FF",guard:"#FFEA00",error:"#FF5252",warn:"#FF9100",info:"#90CAF9"};this.enabled=r,this.prefix=t?`[Sunbreak:${t.slice(0,8)}]`:"[Sunbreak]";}log(t,r,n){if(!this.enabled)return;let o=this.colors[t],a=new Date().toISOString().slice(11,23),i=this.getEmoji(t);console.log(`%c${i} ${this.prefix} [${a}] [${t.toUpperCase()}]%c ${r}`,`color: ${o}; font-weight: bold`,"color: inherit; font-weight: normal",n!==void 0?n:"");}getEmoji(t){switch(t){case "flow":return "\u{1F504}";case "state":return "\u{1F500}";case "decision":return "\u{1F914}";case "api":return "\u{1F4E1}";case "guard":return "\u{1F6E1}\uFE0F";case "error":return "\u274C";case "warn":return "\u26A0\uFE0F";case "info":return "\u2139\uFE0F";default:return "\u2022"}}flow(t,r,n){this.log("flow",`[${t.toUpperCase()}] ${r}`,n);}state(t,r,n,o){this.log("state",`${t} \u2192 ${r}: ${n}`,o);}decision(t,r,n,o){this.log("decision",`${t} = ${r?"\u2713 YES":"\u2717 NO"} (${n})`,o);}api(t,r,n){let o=n.status,i=o>=200&&o<300?"\u2713":"\u2717";this.log("api",`${i} ${t} ${r} \u2192 ${o}${n.error?` (${n.error})`:""}`,n.data);}guard(t,r,n,o){this.log("guard",`${t}: ${r?"\u2713 PASS":"\u2717 BLOCK"} (${n})`,o);}error(t,r){this.log("error",t,r);}warn(t,r){this.log("warn",t,r);}info(t,r){this.log("info",t,r);}group(t){this.enabled&&console.group(`${this.prefix} ${t}`);}groupEnd(){this.enabled&&console.groupEnd();}child(t){let r=new e(void 0,this.enabled);return r.prefix=`${this.prefix}[${t}]`,r}},It=null;function Ar(){return It||(It=new _e(void 0,false)),It}var rt=class{constructor(t){this.currentState="unknown";this.previousState="unknown";this.logger=Ar();this.hadSessionHistory=false;this.inActiveSession=false;t&&this.initialize(t);}initialize(t){if(this.currentState!=="unknown"){this.logger.info(`Skipping initialization - state already set to ${this.currentState}`);let n=!!(t.boundWallet||t.refreshId);this.hadSessionHistory=n;return}this.logger.group("\u{1F527} Initializing Session State Machine");let r=!!(t.boundWallet||t.refreshId);this.hadSessionHistory=r,this.logger.info("Initial context",{wallet:t.wallet,boundWallet:t.boundWallet,refreshId:t.refreshId?"present":"null",hasToken:t.hasToken,authenticated:t.authenticated,hasHistory:r}),t.authenticated&&t.hasToken?(this.transition("authenticated","Has valid token"),this.inActiveSession=true):r?this.transition("refreshable","Has session history"):this.transition("unregistered","No session history"),this.logger.groupEnd();}transition(t,r){if(this.currentState===t){this.logger.info(`State unchanged: ${t} (${r})`);return}this.previousState=this.currentState,this.currentState=t,this.logger.state(this.previousState,t,r);}getState(){return this.currentState}isInActiveSession(){return this.inActiveSession}markHadSession(){this.hadSessionHistory||(this.logger.info("Marked hadSessionHistory = true"),this.hadSessionHistory=true);}clearSessionHistory(){this.logger.info("Cleared session history"),this.hadSessionHistory=false,this.inActiveSession=false;}onProbeComplete(t){if(this.logger.flow("probe","Probe completed, determining initial state"),this.currentState!=="unknown"){this.logger.warn("Probe called but state is not UNKNOWN",{currentState:this.currentState});return}!!(t.boundWallet||t.refreshId)||this.hadSessionHistory?this.transition("refreshable","Session history found"):this.transition("unregistered","No session history");}onRegisterSuccess(t){this.logger.flow("register","Register succeeded"),this.transition("authenticated","Register succeeded"),this.inActiveSession=true,this.hadSessionHistory=true;}onRegisterFailure(t){this.logger.flow("register",`Register failed: ${t}`);}onRefreshSuccess(t){this.logger.flow("refresh","Refresh succeeded"),this.transition("authenticated","Refresh succeeded"),this.inActiveSession=true;}onRefreshExpired(){this.logger.flow("refresh","Refresh failed: session expired (missing refresh identifier)"),this.transition("expired","Session expired"),this.inActiveSession=false;}onRefreshFailure(t){this.logger.flow("refresh",`Refresh failed: ${t}`);}onTokenExpired(){this.logger.flow("token","Token expired"),this.currentState==="authenticated"&&this.transition("refreshable","Token expired");}onWalletChange(t,r,n){if(this.logger.flow("wallet",`Wallet changed: ${t||"null"} \u2192 ${r||"null"}`),!r){this.transition("unknown","Wallet disconnected"),this.inActiveSession=false;return}r.toLowerCase()===n.boundWallet?.toLowerCase()?(this.hadSessionHistory=true,this.transition("refreshable","Wallet reconnected with session history")):(this.transition("unregistered","Wallet changed to different address"),this.inActiveSession=false);}onWalletDisconnect(){this.logger.flow("wallet","Wallet disconnected"),this.transition("unknown","Wallet disconnected"),this.inActiveSession=false;}shouldAttemptProbe(){let t=this.currentState==="unknown";return this.logger.decision("Should attempt probe?",t,`State is ${this.currentState}`),t}shouldAttemptRefresh(t){if(this.currentState!=="refreshable"&&this.currentState!=="authenticated")return this.logger.decision("Should attempt refresh?",false,`State is ${this.currentState}, not REFRESHABLE or AUTHENTICATED`),false;if(!(t.boundWallet||t.wallet))return this.logger.decision("Should attempt refresh?",false,"No wallet available (neither boundWallet nor current wallet)"),false;if(t.wallet&&t.boundWallet&&t.wallet.toLowerCase()!==t.boundWallet.toLowerCase())return this.logger.decision("Should attempt refresh?",false,"Wallet mismatch"),false;if(t.hasToken&&t.tokenExpiry){let n=Math.floor(Date.now()/1e3);if(t.tokenExpiry-n>5&&this.currentState==="authenticated")return this.logger.decision("Should attempt refresh?",false,"Token still valid"),false}return this.logger.decision("Should attempt refresh?",true,`State is ${this.currentState}, token ${t.hasToken?"present":"missing"}`),true}shouldAttemptRegister(t){return this.inActiveSession?(this.logger.decision("Should attempt register?",false,"Already in active session - proof changes ignored"),false):this.currentState!=="unregistered"&&this.currentState!=="expired"?(this.logger.decision("Should attempt register?",false,`State is ${this.currentState}, not UNREGISTERED or EXPIRED`),false):t.wallet?t.hasProof?t.authenticated&&t.hasToken?(this.logger.decision("Should attempt register?",false,"Already authenticated"),false):(this.logger.decision("Should attempt register?",true,`State is ${this.currentState}, have wallet + proof`),true):(this.logger.decision("Should attempt register?",false,"No proof available"),false):(this.logger.decision("Should attempt register?",false,"No wallet connected"),false)}shouldWaitForInitialRefresh(t,r){return this.currentState!=="refreshable"||t?false:r.wallet&&r.boundWallet&&r.wallet.toLowerCase()===r.boundWallet.toLowerCase()?(this.logger.decision("Should wait for initial refresh?",true,"Returning user - let refresh attempt first"),true):false}getStateReport(t){return `
+var yn=Object.defineProperty;var er=e=>{throw TypeError(e)};var gn=(e,t,r)=>t in e?yn(e,t,{enumerable:true,configurable:true,writable:true,value:r}):e[t]=r;var O=(e,t,r)=>gn(e,typeof t!="symbol"?t+"":t,r),tr=(e,t,r)=>t.has(e)||er("Cannot "+r);var m=(e,t,r)=>(tr(e,t,"read from private field"),r?r.call(e):t.get(e)),F=(e,t,r)=>t.has(e)?er("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,r),B=(e,t,r,n)=>(tr(e,t,"write to private field"),t.set(e,r),r);var ze=e=>{let t=5381;for(let r=0;r<e.length;r++)t=t*33^e.charCodeAt(r);return (t>>>0).toString(16).padStart(8,"0")},Ke=e=>{try{return e.method==="provider_jwt"?`${e.issuer}:${ze(e.token)}`:e.method==="siwe"||e.method==="eip191"?`${e.method}:${ze(e.signature)}`:e.method==="ed25519"?`ed25519:${ze(e.signatureBase64)}`:null}catch{return null}},Ce=async(e,t,r)=>{switch(e.name){case "custom":return {method:"provider_jwt",issuer:"custom",token:t,meta:r||{}};case "privy":return {method:"provider_jwt",issuer:"privy",token:t,meta:{app_id:e.appId}};case "dynamic":return e.expectedAud?{method:"provider_jwt",issuer:"dynamic",token:t,meta:{env_id:e.envId,expected_aud:e.expectedAud}}:{method:"provider_jwt",issuer:"dynamic",token:t,meta:{env_id:e.envId}};default:throw new Error(`Unknown adapter: ${e}`)}};var bn="sunbreak-kv",Ie="kv",Xe="sunbreak_dpop_meta_v1",I="sunbreak_dpop_key_v1",Te="ES256",E="P-256",We=e=>`${Xe}:${e}`,rr=()=>new Promise((e,t)=>{let r=indexedDB.open(bn,1);r.onupgradeneeded=()=>r.result.createObjectStore(Ie),r.onsuccess=()=>e(r.result),r.onerror=()=>t(r.error);}),T=async e=>{try{let t=await rr();return await new Promise((r,n)=>{let a=t.transaction(Ie,"readonly").objectStore(Ie).get(e);a.onsuccess=()=>r(a.result),a.onerror=()=>n(a.error);})}catch{return}},S=async(e,t)=>{let r=await rr();await new Promise((n,o)=>{let i=r.transaction(Ie,"readwrite").objectStore(Ie).put(t,e);i.onsuccess=()=>n(),i.onerror=()=>o(i.error);});};var Sn=e=>{let t=new URL(e);if(t.protocol!=="https:"&&t.hostname!=="localhost"&&t.hostname!=="127.0.0.1")throw new Error("Sunbreak: insecure base URL");return t.hash="",t.origin},Rn=e=>e.replace(/\/+$/,""),yt=e=>{let t=Rn(e);return Sn(t)};function bt(e){let t=new URL(e.baseUrl),r=t.host,n=e.meta.lastHost??null,o=kn(n);return e.setLastHost(o),t.host=`${o}.${r}`,t.origin}var kn=e=>{for(let t=0;t<gt.length;t++){let r=gt[Math.floor(Math.random()*gt.length)].toLowerCase();if(r!==e)return r}return "alpha"},gt=["Alpha","Bravo","Charlie","Delta","Echo","Foxtrot","Golf","Hotel","India","Juliett","Kilo","Lima","Mike","November","Oscar","Papa","Quebec","Romeo","Sierra","Tango","Uniform","Victor","Whiskey","X-ray","Yankee","Zulu"];var G=(e,t)=>{let r={clientId:e.clientId,wallet:e.wallet,ifPolicyHash:e.meta.lastPolicyHash||void 0,ifPolicyProof:e.meta.lastPolicyProof||void 0,...t};Object.keys(r).forEach(o=>r[o]===void 0&&delete r[o]);let n=JSON.stringify(r);return btoa(n)};var En=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","via"]),Pn=new Set(["user-agent","referer","origin","host","content-length","sec-fetch-site","sec-fetch-mode","sec-fetch-dest","sec-fetch-user","sec-ch-ua","sec-ch-ua-mobile","sec-ch-ua-platform","sec-ch-ua-platform-version","sec-ch-ua-full-version","sec-ch-ua-arch","sec-ch-ua-model","sec-ch-ua-bitness","cookie","set-cookie"]),vn=new Set(["dpop","x-sunbreak-meta"]),An=64,nr=2048,xn=64;function St(e){let t={};if(!e)return t;let r=e instanceof Headers?Array.from(e.entries()):Object.entries(e),n=0;for(let[o,a]of r){if(n>=xn)break;if(o==null||a==null)continue;let i=String(o).toLowerCase().trim();if(!i||i.length>An||En.has(i)||Pn.has(i)||vn.has(i))continue;let s=String(a);s.length>nr&&(s=s.slice(0,nr)),t[i]=s,n++;}return t}var ne=new TextEncoder,ge=new TextDecoder;function or(...e){let t=e.reduce((o,{length:a})=>o+a,0),r=new Uint8Array(t),n=0;for(let o of e)r.set(o,n),n+=o.length;return r}function ar(e){if(Uint8Array.prototype.toBase64)return e.toBase64();let t=32768,r=[];for(let n=0;n<e.length;n+=t)r.push(String.fromCharCode.apply(null,e.subarray(n,n+t)));return btoa(r.join(""))}function ir(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}function sr(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(typeof e=="string"?e:ge.decode(e),{alphabet:"base64url"});let t=e;t instanceof Uint8Array&&(t=ge.decode(t)),t=t.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"");try{return ir(t)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}}function Ye(e){let t=e;return typeof t=="string"&&(t=ne.encode(t)),Uint8Array.prototype.toBase64?t.toBase64({alphabet:"base64url",omitPadding:true}):ar(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}var fe=class extends Error{constructor(r,n){super(r,n);O(this,"code","ERR_JOSE_GENERIC");this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor);}};O(fe,"code","ERR_JOSE_GENERIC");var L=class extends fe{constructor(){super(...arguments);O(this,"code","ERR_JOSE_NOT_SUPPORTED");}};O(L,"code","ERR_JOSE_NOT_SUPPORTED");var oe=class extends fe{constructor(){super(...arguments);O(this,"code","ERR_JWS_INVALID");}};O(oe,"code","ERR_JWS_INVALID");var Je=class extends fe{constructor(){super(...arguments);O(this,"code","ERR_JWT_INVALID");}};O(Je,"code","ERR_JWT_INVALID");var cr,lr,Rt=class extends(lr=fe,cr=Symbol.asyncIterator,lr){constructor(r="multiple matching keys found in the JSON Web Key Set",n){super(r,n);O(this,cr);O(this,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");}};O(Rt,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");function Y(e,t="algorithm.name"){return new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`)}function be(e,t){return e.name===t}function kt(e){return parseInt(e.name.slice(4),10)}function In(e){switch(e){case "ES256":return "P-256";case "ES384":return "P-384";case "ES512":return "P-521";default:throw new Error("unreachable")}}function Tn(e,t){if(!e.usages.includes(t))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function ur(e,t,r){switch(t){case "HS256":case "HS384":case "HS512":{if(!be(e.algorithm,"HMAC"))throw Y("HMAC");let n=parseInt(t.slice(2),10);if(kt(e.algorithm.hash)!==n)throw Y(`SHA-${n}`,"algorithm.hash");break}case "RS256":case "RS384":case "RS512":{if(!be(e.algorithm,"RSASSA-PKCS1-v1_5"))throw Y("RSASSA-PKCS1-v1_5");let n=parseInt(t.slice(2),10);if(kt(e.algorithm.hash)!==n)throw Y(`SHA-${n}`,"algorithm.hash");break}case "PS256":case "PS384":case "PS512":{if(!be(e.algorithm,"RSA-PSS"))throw Y("RSA-PSS");let n=parseInt(t.slice(2),10);if(kt(e.algorithm.hash)!==n)throw Y(`SHA-${n}`,"algorithm.hash");break}case "Ed25519":case "EdDSA":{if(!be(e.algorithm,"Ed25519"))throw Y("Ed25519");break}case "ML-DSA-44":case "ML-DSA-65":case "ML-DSA-87":{if(!be(e.algorithm,t))throw Y(t);break}case "ES256":case "ES384":case "ES512":{if(!be(e.algorithm,"ECDSA"))throw Y("ECDSA");let n=In(t);if(e.algorithm.namedCurve!==n)throw Y(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}Tn(e,r);}function fr(e,t,...r){if(r=r.filter(Boolean),r.length>2){let n=r.pop();e+=`one of type ${r.join(", ")}, or ${n}.`;}else r.length===2?e+=`one of type ${r[0]} or ${r[1]}.`:e+=`of type ${r[0]}.`;return t==null?e+=` Received ${t}`:typeof t=="function"&&t.name?e+=` Received function ${t.name}`:typeof t=="object"&&t!=null&&t.constructor?.name&&(e+=` Received an instance of ${t.constructor.name}`),e}var dr=(e,...t)=>fr("Key must be ",e,...t);function Et(e,t,...r){return fr(`Key for the ${e} algorithm must be `,t,...r)}function Pt(e){return e?.[Symbol.toStringTag]==="CryptoKey"}function vt(e){return e?.[Symbol.toStringTag]==="KeyObject"}var At=e=>Pt(e)||vt(e);var pr=(...e)=>{let t=e.filter(Boolean);if(t.length===0||t.length===1)return  true;let r;for(let n of t){let o=Object.keys(n);if(!r||r.size===0){r=new Set(o);continue}for(let a of o){if(r.has(a))return  false;r.add(a);}}return  true};function Wn(e){return typeof e=="object"&&e!==null}var Ze=e=>{if(!Wn(e)||Object.prototype.toString.call(e)!=="[object Object]")return  false;if(Object.getPrototypeOf(e)===null)return  true;let t=e;for(;Object.getPrototypeOf(t)!==null;)t=Object.getPrototypeOf(t);return Object.getPrototypeOf(e)===t};var hr=(e,t)=>{if(e.startsWith("RS")||e.startsWith("PS")){let{modulusLength:r}=t.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}};function Jn(e){let t,r;switch(e.kty){case "AKP":{switch(e.alg){case "ML-DSA-44":case "ML-DSA-65":case "ML-DSA-87":t={name:e.alg},r=e.priv?["sign"]:["verify"];break;default:throw new L('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case "RSA":{switch(e.alg){case "PS256":case "PS384":case "PS512":t={name:"RSA-PSS",hash:`SHA-${e.alg.slice(-3)}`},r=e.d?["sign"]:["verify"];break;case "RS256":case "RS384":case "RS512":t={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${e.alg.slice(-3)}`},r=e.d?["sign"]:["verify"];break;case "RSA-OAEP":case "RSA-OAEP-256":case "RSA-OAEP-384":case "RSA-OAEP-512":t={name:"RSA-OAEP",hash:`SHA-${parseInt(e.alg.slice(-3),10)||1}`},r=e.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new L('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case "EC":{switch(e.alg){case "ES256":t={name:"ECDSA",namedCurve:"P-256"},r=e.d?["sign"]:["verify"];break;case "ES384":t={name:"ECDSA",namedCurve:"P-384"},r=e.d?["sign"]:["verify"];break;case "ES512":t={name:"ECDSA",namedCurve:"P-521"},r=e.d?["sign"]:["verify"];break;case "ECDH-ES":case "ECDH-ES+A128KW":case "ECDH-ES+A192KW":case "ECDH-ES+A256KW":t={name:"ECDH",namedCurve:e.crv},r=e.d?["deriveBits"]:[];break;default:throw new L('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case "OKP":{switch(e.alg){case "Ed25519":case "EdDSA":t={name:"Ed25519"},r=e.d?["sign"]:["verify"];break;case "ECDH-ES":case "ECDH-ES+A128KW":case "ECDH-ES+A192KW":case "ECDH-ES+A256KW":t={name:e.crv},r=e.d?["deriveBits"]:[];break;default:throw new L('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}default:throw new L('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return {algorithm:t,keyUsages:r}}var mr=async e=>{if(!e.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:t,keyUsages:r}=Jn(e),n={...e};return n.kty!=="AKP"&&delete n.alg,delete n.use,crypto.subtle.importKey("jwk",n,t,e.ext??!(e.d||e.priv),e.key_ops??r)};var wr=(e,t,r,n,o)=>{if(o.crit!==void 0&&n?.crit===void 0)throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return new Set;if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(i=>typeof i!="string"||i.length===0))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let a;r!==void 0?a=new Map([...Object.entries(r),...t.entries()]):a=t;for(let i of n.crit){if(!a.has(i))throw new L(`Extension Header Parameter "${i}" is not recognized`);if(o[i]===void 0)throw new e(`Extension Header Parameter "${i}" is missing`);if(a.get(i)&&n[i]===void 0)throw new e(`Extension Header Parameter "${i}" MUST be integrity protected`)}return new Set(n.crit)};function De(e){return Ze(e)&&typeof e.kty=="string"}function yr(e){return e.kty!=="oct"&&(e.kty==="AKP"&&typeof e.priv=="string"||typeof e.d=="string")}function gr(e){return e.kty!=="oct"&&typeof e.d>"u"&&typeof e.priv>"u"}function br(e){return e.kty==="oct"&&typeof e.k=="string"}var Se,Sr=async(e,t,r,n=false)=>{Se||(Se=new WeakMap);let o=Se.get(e);if(o?.[r])return o[r];let a=await mr({...t,alg:r});return n&&Object.freeze(e),o?o[r]=a:Se.set(e,{[r]:a}),a},_n=(e,t)=>{Se||(Se=new WeakMap);let r=Se.get(e);if(r?.[t])return r[t];let n=e.type==="public",o=!!n,a;if(e.asymmetricKeyType==="x25519"){switch(t){case "ECDH-ES":case "ECDH-ES+A128KW":case "ECDH-ES+A192KW":case "ECDH-ES+A256KW":break;default:throw new TypeError("given KeyObject instance cannot be used for this algorithm")}a=e.toCryptoKey(e.asymmetricKeyType,o,n?[]:["deriveBits"]);}if(e.asymmetricKeyType==="ed25519"){if(t!=="EdDSA"&&t!=="Ed25519")throw new TypeError("given KeyObject instance cannot be used for this algorithm");a=e.toCryptoKey(e.asymmetricKeyType,o,[n?"verify":"sign"]);}switch(e.asymmetricKeyType){case "ml-dsa-44":case "ml-dsa-65":case "ml-dsa-87":{if(t!==e.asymmetricKeyType.toUpperCase())throw new TypeError("given KeyObject instance cannot be used for this algorithm");a=e.toCryptoKey(e.asymmetricKeyType,o,[n?"verify":"sign"]);}}if(e.asymmetricKeyType==="rsa"){let i;switch(t){case "RSA-OAEP":i="SHA-1";break;case "RS256":case "PS256":case "RSA-OAEP-256":i="SHA-256";break;case "RS384":case "PS384":case "RSA-OAEP-384":i="SHA-384";break;case "RS512":case "PS512":case "RSA-OAEP-512":i="SHA-512";break;default:throw new TypeError("given KeyObject instance cannot be used for this algorithm")}if(t.startsWith("RSA-OAEP"))return e.toCryptoKey({name:"RSA-OAEP",hash:i},o,n?["encrypt"]:["decrypt"]);a=e.toCryptoKey({name:t.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:i},o,[n?"verify":"sign"]);}if(e.asymmetricKeyType==="ec"){let s=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(e.asymmetricKeyDetails?.namedCurve);if(!s)throw new TypeError("given KeyObject instance cannot be used for this algorithm");t==="ES256"&&s==="P-256"&&(a=e.toCryptoKey({name:"ECDSA",namedCurve:s},o,[n?"verify":"sign"])),t==="ES384"&&s==="P-384"&&(a=e.toCryptoKey({name:"ECDSA",namedCurve:s},o,[n?"verify":"sign"])),t==="ES512"&&s==="P-521"&&(a=e.toCryptoKey({name:"ECDSA",namedCurve:s},o,[n?"verify":"sign"])),t.startsWith("ECDH-ES")&&(a=e.toCryptoKey({name:"ECDH",namedCurve:s},o,n?[]:["deriveBits"]));}if(!a)throw new TypeError("given KeyObject instance cannot be used for this algorithm");return r?r[t]=a:Se.set(e,{[t]:a}),a},Rr=async(e,t)=>{if(e instanceof Uint8Array||Pt(e))return e;if(vt(e)){if(e.type==="secret")return e.export();if("toCryptoKey"in e&&typeof e.toCryptoKey=="function")try{return _n(e,t)}catch(n){if(n instanceof TypeError)throw n}let r=e.export({format:"jwk"});return Sr(e,r,t)}if(De(e))return e.k?sr(e.k):Sr(e,e,t,true);throw new Error("unreachable")};var Re=e=>e?.[Symbol.toStringTag],xt=(e,t,r)=>{if(t.use!==void 0){let n;switch(r){case "sign":case "verify":n="sig";break;case "encrypt":case "decrypt":n="enc";break}if(t.use!==n)throw new TypeError(`Invalid key for this operation, its "use" must be "${n}" when present`)}if(t.alg!==void 0&&t.alg!==e)throw new TypeError(`Invalid key for this operation, its "alg" must be "${e}" when present`);if(Array.isArray(t.key_ops)){let n;switch(true){case(r==="sign"):case e==="dir":case e.includes("CBC-HS"):n=r;break;case e.startsWith("PBES2"):n="deriveBits";break;case /^A\d{3}(?:GCM)?(?:KW)?$/.test(e):!e.includes("GCM")&&e.endsWith("KW")?n="unwrapKey":n=r;break;case(r==="encrypt"):n="wrapKey";break;case r==="decrypt":n=e.startsWith("RSA")?"unwrapKey":"deriveBits";break}if(n&&t.key_ops?.includes?.(n)===false)throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${n}" when present`)}return  true},Mn=(e,t,r)=>{if(!(t instanceof Uint8Array)){if(De(t)){if(br(t)&&xt(e,t,r))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!At(t))throw new TypeError(Et(e,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if(t.type!=="secret")throw new TypeError(`${Re(t)} instances for symmetric algorithms must be of type "secret"`)}},Ln=(e,t,r)=>{if(De(t))switch(r){case "decrypt":case "sign":if(yr(t)&&xt(e,t,r))return;throw new TypeError("JSON Web Key for this operation be a private JWK");case "encrypt":case "verify":if(gr(t)&&xt(e,t,r))return;throw new TypeError("JSON Web Key for this operation be a public JWK")}if(!At(t))throw new TypeError(Et(e,t,"CryptoKey","KeyObject","JSON Web Key"));if(t.type==="secret")throw new TypeError(`${Re(t)} instances for asymmetric algorithms must not be of type "secret"`);if(t.type==="public")switch(r){case "sign":throw new TypeError(`${Re(t)} instances for asymmetric algorithm signing must be of type "private"`);case "decrypt":throw new TypeError(`${Re(t)} instances for asymmetric algorithm decryption must be of type "private"`);}if(t.type==="private")switch(r){case "verify":throw new TypeError(`${Re(t)} instances for asymmetric algorithm verifying must be of type "public"`);case "encrypt":throw new TypeError(`${Re(t)} instances for asymmetric algorithm encryption must be of type "public"`);}},kr=(e,t,r)=>{e.startsWith("HS")||e==="dir"||e.startsWith("PBES2")||/^A(?:128|192|256)(?:GCM)?(?:KW)?$/.test(e)||/^A(?:128|192|256)CBC-HS(?:256|384|512)$/.test(e)?Mn(e,t,r):Ln(e,t,r);};var Er=(e,t)=>{let r=`SHA-${e.slice(-3)}`;switch(e){case "HS256":case "HS384":case "HS512":return {hash:r,name:"HMAC"};case "PS256":case "PS384":case "PS512":return {hash:r,name:"RSA-PSS",saltLength:parseInt(e.slice(-3),10)>>3};case "RS256":case "RS384":case "RS512":return {hash:r,name:"RSASSA-PKCS1-v1_5"};case "ES256":case "ES384":case "ES512":return {hash:r,name:"ECDSA",namedCurve:t.namedCurve};case "Ed25519":case "EdDSA":return {name:"Ed25519"};case "ML-DSA-44":case "ML-DSA-65":case "ML-DSA-87":return {name:e};default:throw new L(`alg ${e} is not supported either by JOSE or your javascript runtime`)}};var Pr=async(e,t,r)=>{if(t instanceof Uint8Array){if(!e.startsWith("HS"))throw new TypeError(dr(t,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",t,{hash:`SHA-${e.slice(-3)}`,name:"HMAC"},false,[r])}return ur(t,e,r),t};var ie=e=>Math.floor(e.getTime()/1e3);var Hn=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,Qe=e=>{let t=Hn.exec(e);if(!t||t[4]&&t[1])throw new TypeError("Invalid time period format");let r=parseFloat(t[2]),n=t[3].toLowerCase(),o;switch(n){case "sec":case "secs":case "second":case "seconds":case "s":o=Math.round(r);break;case "minute":case "minutes":case "min":case "mins":case "m":o=Math.round(r*60);break;case "hour":case "hours":case "hr":case "hrs":case "h":o=Math.round(r*3600);break;case "day":case "days":case "d":o=Math.round(r*86400);break;case "week":case "weeks":case "w":o=Math.round(r*604800);break;default:o=Math.round(r*31557600);break}return t[1]==="-"||t[4]==="ago"?-o:o};function de(e,t){if(!Number.isFinite(t))throw new TypeError(`Invalid ${e} input`);return t}var v,et=class{constructor(t){F(this,v);if(!Ze(t))throw new TypeError("JWT Claims Set MUST be an object");B(this,v,structuredClone(t));}data(){return ne.encode(JSON.stringify(m(this,v)))}get iss(){return m(this,v).iss}set iss(t){m(this,v).iss=t;}get sub(){return m(this,v).sub}set sub(t){m(this,v).sub=t;}get aud(){return m(this,v).aud}set aud(t){m(this,v).aud=t;}set jti(t){m(this,v).jti=t;}set nbf(t){typeof t=="number"?m(this,v).nbf=de("setNotBefore",t):t instanceof Date?m(this,v).nbf=de("setNotBefore",ie(t)):m(this,v).nbf=ie(new Date)+Qe(t);}set exp(t){typeof t=="number"?m(this,v).exp=de("setExpirationTime",t):t instanceof Date?m(this,v).exp=de("setExpirationTime",ie(t)):m(this,v).exp=ie(new Date)+Qe(t);}set iat(t){typeof t>"u"?m(this,v).iat=ie(new Date):t instanceof Date?m(this,v).iat=de("setIssuedAt",ie(t)):typeof t=="string"?m(this,v).iat=de("setIssuedAt",ie(new Date)+Qe(t)):m(this,v).iat=de("setIssuedAt",t);}};v=new WeakMap;var vr=async(e,t,r)=>{let n=await Pr(e,t,"sign");hr(e,n);let o=await crypto.subtle.sign(Er(e,n.algorithm),n,r);return new Uint8Array(o)};var _e,H,Z,tt=class{constructor(t){F(this,_e);F(this,H);F(this,Z);if(!(t instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");B(this,_e,t);}setProtectedHeader(t){if(m(this,H))throw new TypeError("setProtectedHeader can only be called once");return B(this,H,t),this}setUnprotectedHeader(t){if(m(this,Z))throw new TypeError("setUnprotectedHeader can only be called once");return B(this,Z,t),this}async sign(t,r){if(!m(this,H)&&!m(this,Z))throw new oe("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!pr(m(this,H),m(this,Z)))throw new oe("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let n={...m(this,H),...m(this,Z)},o=wr(oe,new Map([["b64",true]]),r?.crit,m(this,H),n),a=true;if(o.has("b64")&&(a=m(this,H).b64,typeof a!="boolean"))throw new oe('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:i}=n;if(typeof i!="string"||!i)throw new oe('JWS "alg" (Algorithm) Header Parameter missing or invalid');kr(i,t,"sign");let s=m(this,_e);a&&(s=ne.encode(Ye(s)));let u;m(this,H)?u=ne.encode(Ye(JSON.stringify(m(this,H)))):u=ne.encode("");let l=or(u,ne.encode("."),s),c=await Rr(t,i),p=await vr(i,c,l),d={signature:Ye(p),payload:""};return a&&(d.payload=ge.decode(s)),m(this,Z)&&(d.header=m(this,Z)),m(this,H)&&(d.protected=ge.decode(u)),d}};_e=new WeakMap,H=new WeakMap,Z=new WeakMap;var ke,rt=class{constructor(t){F(this,ke);B(this,ke,new tt(t));}setProtectedHeader(t){return m(this,ke).setProtectedHeader(t),this}async sign(t,r){let n=await m(this,ke).sign(t,r);if(n.payload===void 0)throw new TypeError("use the flattened module for creating JWS with b64: false");return `${n.protected}.${n.payload}.${n.signature}`}};ke=new WeakMap;var se,j,pe=class{constructor(t={}){F(this,se);F(this,j);B(this,j,new et(t));}setIssuer(t){return m(this,j).iss=t,this}setSubject(t){return m(this,j).sub=t,this}setAudience(t){return m(this,j).aud=t,this}setJti(t){return m(this,j).jti=t,this}setNotBefore(t){return m(this,j).nbf=t,this}setExpirationTime(t){return m(this,j).exp=t,this}setIssuedAt(t){return m(this,j).iat=t,this}setProtectedHeader(t){return B(this,se,t),this}async sign(t,r){let n=new rt(m(this,j).data());if(n.setProtectedHeader(m(this,se)),Array.isArray(m(this,se)?.crit)&&m(this,se).crit.includes("b64")&&m(this,se).b64===false)throw new Je("JWTs MUST NOT use unencoded payload");return n.sign(t,r)}};se=new WeakMap,j=new WeakMap;var $n=e=>btoa(String.fromCharCode(...new Uint8Array(e))).replaceAll("+","-").replaceAll("/","_").replaceAll("=",""),nt=async e=>{let t=new TextEncoder().encode(e),r=await crypto.subtle.digest("SHA-256",t);return $n(r)},V=async e=>{let{method:t,url:r,nonce:n,ath:o,privateKey:a,publicJwk:i}=e,s={htm:t.toUpperCase(),htu:r,jti:crypto.randomUUID(),iat:Math.floor(Date.now()/1e3)};return n&&(s.nonce=n),o&&(s.ath=o),await new pe(s).setProtectedHeader({alg:"ES256",typ:"dpop+jwt",jwk:i}).sign(a)};var $=async e=>{let t={crv:e.crv,kty:"EC",x:e.x,y:e.y},r=JSON.stringify(t),n=new TextEncoder().encode(r),o=await crypto.subtle.digest("SHA-256",n);return btoa(String.fromCharCode(...new Uint8Array(o))).replaceAll("+","-").replaceAll("/","_").replaceAll("=","")};async function he(e){let{rootPrivateKey:t,rootPublicJwk:r,childJkt:n,clientId:o,sid:a,ttlSec:i=300}=e,s=Math.floor(Date.now()/1e3),u=s+Math.max(60,Math.min(i,3600)),l={child_jkt:n,client_id:o,aud:"issuer",iat:s,exp:u,jti:crypto.randomUUID()};return a&&(l.sid=a),await new pe(l).setProtectedHeader({alg:"ES256",typ:"pode+jwt",jwk:r}).sign(t)}function Me(e,t=300){return e.replace(/<[^>]*>/g,"").slice(0,t)}async function Le(e){let t=e.status,r=Array.from(e.headers.keys()).some(s=>s.toLowerCase().startsWith("x-amzn-waf")),n,o,a=e.headers.get("content-type")||"";if(a.includes("application/json"))try{let s=await e.clone().json();n=typeof s?.error=="string"?s.error:void 0,o=typeof s?.detail=="string"?s.detail:void 0;}catch{}let i=t===403&&!r&&!a.includes("application/json");return {status:t,code:n,detail:o,waf:r,alb403:i}}function me(e,t){let r=new Error(e);return r.status=t.status,r.code=t.code,r.detail=t.detail,r.waf=t.waf,r.alb403=t.alb403,r}var ot=e=>/^0x[a-fA-F0-9]{40}$/.test(e),ce=e=>ot(e)?e.toLowerCase():e,A=(e,t)=>!e||!t?false:ot(e)&&ot(t)?e.toLowerCase()===t.toLowerCase():e===t;var Ee={boundWallet:null,clientId:null,jkt:null,refreshId:null,lastPolicyHash:null,lastPolicyProof:null,lastHost:null,rootJkt:null,registeredProofId:null},Kt=react.createContext(void 0);function Ir(e){try{return JSON.parse(localStorage.getItem(e)||"null")??Ee}catch{return Ee}}function Nn(e,t){try{localStorage.setItem(e,JSON.stringify(t));}catch{}}var Ct=({children:e,clientId:t})=>{let[r,n]=react.useState(Ee),o=react.useRef(false),[a,i]=react.useState(false),s=react.useMemo(()=>We(t),[t]);react.useEffect(()=>{let h=true;return (async()=>{let y=await T(s)??await T(Xe)??Ir(s);h&&(n({...Ee,...y}),o.current=true,i(true));})(),()=>{h=false;}},[s]),react.useEffect(()=>{o.current&&(async()=>(await S(s,r),Nn(s,r)))();},[r,s]);let u=react.useCallback(h=>n(f=>({...f,refreshId:h})),[]),l=react.useCallback(h=>n(f=>({...f,lastPolicyHash:h})),[]),c=react.useCallback(h=>n(f=>({...f,lastPolicyProof:h})),[]),p=react.useCallback(h=>n(f=>({...f,lastHost:h})),[]),d=react.useCallback(h=>n(f=>({...f,rootJkt:h})),[]),g=react.useCallback(h=>n(f=>({...f,registeredProofId:h})),[]),R=async()=>{try{let h=localStorage.getItem(s);if(h){let f=JSON.parse(h);if(typeof f?.refreshId=="string"&&f.refreshId)return f.refreshId}}catch{}try{let h=await T(s);if(typeof h?.refreshId=="string"&&h.refreshId)return h.refreshId}catch{}return null},K=react.useCallback(h=>n(f=>({...f,boundWallet:h})),[]),w=react.useCallback(h=>n(f=>({...f,clientId:h})),[]),k=react.useCallback(h=>n(f=>({...f,jkt:h})),[]),b=react.useCallback(()=>n(Ee),[]),J=react.useCallback(async()=>{let f=await T(s)??Ir(s);n({...Ee,...f});},[]),M=react.useMemo(()=>({meta:r,setBoundWallet:K,setClientId:w,setJkt:k,resetMeta:b,reload:J,setRefreshId:u,getRefreshId:R,ready:a,setLastPolicyHash:l,setLastPolicyProof:c,setLastHost:p,setRootJkt:d,setRegisteredProofId:g}),[r,K,w,k,b,J,a,u,R,l,c,p,d,g]);return jsxRuntime.jsx(Kt.Provider,{value:M,children:e})};function It(){let e=react.useContext(Kt);if(!e)throw new Error("useMeta must be used within <MetaProvider>");return e}var Wr=`${I}:wrap`;async function at(){try{let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},!1,["sign","verify"]),t=`${I}:probe_safe`;await S(t,{fmt:"cryptokey",privKey:e.privateKey});let r=await T(t);return await S(t,void 0),!!(r&&r.privKey)}catch{return  false}}async function Bn(){try{let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},!0,["sign","verify"]),t=`${I}:probe`;await S(t,{fmt:"cryptokey",privKey:e.privateKey});let r=await T(t);return await S(t,void 0),!!(r&&r.privKey)}catch{return  false}}function ve(e){let{d:t,...r}=e;return {...r,kty:"EC",crv:E,alg:Te,use:"sig"}}async function Jr(){let e=await T(Wr);if(!e){let t=new Uint8Array(32);crypto.getRandomValues(t),e=t.buffer,await S(Wr,e);}return crypto.subtle.importKey("raw",e,{name:"AES-GCM",length:256},false,["encrypt","decrypt"])}async function Tt(e){let t=await Jr(),r=new Uint8Array(12);crypto.getRandomValues(r);let n=new TextEncoder().encode(JSON.stringify(e));return {encPrivJwk:await crypto.subtle.encrypt({name:"AES-GCM",iv:r},t,n),iv:r.buffer}}async function Gn(e,t){let r=await Jr(),n=await crypto.subtle.decrypt({name:"AES-GCM",iv:t},r,e);return JSON.parse(new TextDecoder().decode(new Uint8Array(n)))}var Wt=()=>{let e=react.useRef(null),t=react.useRef(null),r=react.useCallback(async()=>{let u=await T(I);if(!u)return  false;if(u.fmt==="cryptokey"){let c=u;if(!c.privKey)return await S(I,void 0),false;let p=c.privKey;try{if(p.extractable&&await at()){let g=await crypto.subtle.exportKey("jwk",p),R=await crypto.subtle.importKey("jwk",g,{name:"ECDSA",namedCurve:E},!1,["sign"]),K={fmt:"cryptokey",privKey:R,pubJwk:ve(c.pubJwk)};await S(I,K),p=R;}}catch{}return e.current=p,t.current=ve(c.pubJwk),true}if(u.fmt==="encjwk"){let c=u;try{let p=await Gn(c.encPrivJwk,c.iv),d=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},!1,["sign"]);return e.current=d,t.current=ve(c.pubJwk),!0}catch{return await S(I,void 0),false}}let l=u;if(l&&l.d){let{d:c,...p}=l,d=ve(p),g=await at(),R=g||await Bn();if(R&&g){let b=await crypto.subtle.importKey("jwk",l,{name:"ECDSA",namedCurve:E},false,["sign"]);return await S(I,{fmt:"cryptokey",privKey:b,pubJwk:d}),e.current=b,t.current=d,true}if(R){let b=await crypto.subtle.importKey("jwk",l,{name:"ECDSA",namedCurve:E},true,["sign"]);return await S(I,{fmt:"cryptokey",privKey:b,pubJwk:d}),e.current=b,t.current=d,true}let{encPrivJwk:K,iv:w}=await Tt(l);await S(I,{fmt:"encjwk",encPrivJwk:K,iv:w,pubJwk:d});let k=await crypto.subtle.importKey("jwk",l,{name:"ECDSA",namedCurve:E},false,["sign"]);return e.current=k,t.current=d,true}return await S(I,void 0),false},[]),n=react.useCallback(async(u,l)=>{await S(I,{fmt:"cryptokey",privKey:u,pubJwk:l});},[]),o=react.useCallback(async(u,l)=>{let{encPrivJwk:c,iv:p}=await Tt(u);await S(I,{fmt:"encjwk",encPrivJwk:c,iv:p,pubJwk:l});},[]),a=react.useCallback(async()=>{if(e.current&&t.current||await r())return;let u=await at(),l=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},true,["sign","verify"]),c=ve(await crypto.subtle.exportKey("jwk",l.publicKey)),p=await crypto.subtle.exportKey("jwk",l.privateKey);if(u){let d=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},false,["sign"]);await n(d,c),e.current=d,t.current=c;}else {await o(p,c);let d=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},false,["sign"]);e.current=d,t.current=c;}},[r,n,o]),i=react.useCallback(async()=>{let u=await at(),l=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},true,["sign","verify"]),c=ve(await crypto.subtle.exportKey("jwk",l.publicKey)),p=await crypto.subtle.exportKey("jwk",l.privateKey);if(u){let d=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},false,["sign"]);await S(I,{fmt:"cryptokey",privKey:d,pubJwk:c}),e.current=d,t.current=c;}else {let{encPrivJwk:d,iv:g}=await Tt(p);await S(I,{fmt:"encjwk",encPrivJwk:d,iv:g,pubJwk:c});let R=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},false,["sign"]);e.current=R,t.current=c;}},[]),s=react.useCallback(async()=>{await S(I,void 0),e.current=null,t.current=null;},[]);return {ensureKeypair:a,rotate:i,clear:s,privRef:e,pubJwkRef:t}};var Q="sunbreak_root_key_v1",_r=`${Q}:wrap`;async function Mr(){try{let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},!1,["sign","verify"]),t=`${Q}:probe_safe`;await S(t,{fmt:"cryptokey",privKey:e.privateKey,createdAt:Date.now(),pubJwk:{}});let r=await T(t);return await S(t,void 0),!!(r&&r.privKey)}catch{return  false}}function it(e){let{d:t,...r}=e;return {...r,kty:"EC",crv:E,alg:Te,use:"sig"}}async function Lr(){let e=await T(_r);if(!e){let t=new Uint8Array(32);crypto.getRandomValues(t),e=t.buffer,await S(_r,e);}return crypto.subtle.importKey("raw",e,{name:"AES-GCM",length:256},false,["encrypt","decrypt"])}async function Vn(e){let t=await Lr(),r=new Uint8Array(12);crypto.getRandomValues(r);let n=new TextEncoder().encode(JSON.stringify(e));return {encPrivJwk:await crypto.subtle.encrypt({name:"AES-GCM",iv:r},t,n),iv:r.buffer}}async function qn(e,t){let r=await Lr(),n=await crypto.subtle.decrypt({name:"AES-GCM",iv:t},r,e);return JSON.parse(new TextDecoder().decode(new Uint8Array(n)))}var Dt=()=>{let e=react.useRef(null),t=react.useRef(null),r=react.useCallback(async()=>{let a=await T(Q);if(!a)return  false;if(a.fmt==="cryptokey"){let i=a;if(!i.privKey)return await S(Q,void 0),false;let s=i.privKey;try{if(s.extractable&&await Mr()){let l=await crypto.subtle.exportKey("jwk",s),c=await crypto.subtle.importKey("jwk",l,{name:"ECDSA",namedCurve:E},!1,["sign"]),p={fmt:"cryptokey",privKey:c,pubJwk:it(i.pubJwk),createdAt:i.createdAt};await S(Q,p),s=c;}}catch{}return e.current=s,t.current=it(i.pubJwk),true}if(a.fmt==="encjwk"){let i=a;try{let s=await qn(i.encPrivJwk,i.iv),u=await crypto.subtle.importKey("jwk",s,{name:"ECDSA",namedCurve:E},!1,["sign"]);return e.current=u,t.current=it(i.pubJwk),!0}catch{return await S(Q,void 0),false}}return await S(Q,void 0),false},[]),n=react.useCallback(async()=>{if(e.current&&t.current||await r())return;let a=await Mr(),i=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},true,["sign","verify"]),s=it(await crypto.subtle.exportKey("jwk",i.publicKey)),u=Date.now(),l=await crypto.subtle.exportKey("jwk",i.privateKey);if(a){let c=await crypto.subtle.importKey("jwk",l,{name:"ECDSA",namedCurve:E},false,["sign"]);await S(Q,{fmt:"cryptokey",privKey:c,pubJwk:s,createdAt:u}),e.current=c,t.current=s;}else {let{encPrivJwk:c,iv:p}=await Vn(l);await S(Q,{fmt:"encjwk",encPrivJwk:c,iv:p,pubJwk:s,createdAt:u});let g=await crypto.subtle.importKey("jwk",l,{name:"ECDSA",namedCurve:E},false,["sign"]);e.current=g,t.current=s;}},[r]),o=react.useCallback(async()=>{await S(Q,void 0),e.current=null,t.current=null;},[]);return {ensureRootKeypair:n,clear:o,rootPrivRef:e,rootPubJwkRef:t}};var He=class e{constructor(t,r=false){this.colors={flow:"#00D9FF",state:"#00FF88",decision:"#FFB800",api:"#B388FF",guard:"#FFEA00",error:"#FF5252",warn:"#FF9100",info:"#90CAF9"};this.enabled=r,this.prefix=t?`[Sunbreak:${t.slice(0,8)}]`:"[Sunbreak]";}log(t,r,n){if(!this.enabled)return;let o=this.colors[t],a=new Date().toISOString().slice(11,23),i=this.getEmoji(t);console.log(`%c${i} ${this.prefix} [${a}] [${t.toUpperCase()}]%c ${r}`,`color: ${o}; font-weight: bold`,"color: inherit; font-weight: normal",n!==void 0?n:"");}getEmoji(t){switch(t){case "flow":return "\u{1F504}";case "state":return "\u{1F500}";case "decision":return "\u{1F914}";case "api":return "\u{1F4E1}";case "guard":return "\u{1F6E1}\uFE0F";case "error":return "\u274C";case "warn":return "\u26A0\uFE0F";case "info":return "\u2139\uFE0F";default:return "\u2022"}}flow(t,r,n){this.log("flow",`[${t.toUpperCase()}] ${r}`,n);}state(t,r,n,o){this.log("state",`${t} \u2192 ${r}: ${n}`,o);}decision(t,r,n,o){this.log("decision",`${t} = ${r?"\u2713 YES":"\u2717 NO"} (${n})`,o);}api(t,r,n){let o=n.status,i=o>=200&&o<300?"\u2713":"\u2717";this.log("api",`${i} ${t} ${r} \u2192 ${o}${n.error?` (${n.error})`:""}`,n.data);}guard(t,r,n,o){this.log("guard",`${t}: ${r?"\u2713 PASS":"\u2717 BLOCK"} (${n})`,o);}error(t,r){this.log("error",t,r);}warn(t,r){this.log("warn",t,r);}info(t,r){this.log("info",t,r);}group(t){this.enabled&&console.group(`${this.prefix} ${t}`);}groupEnd(){this.enabled&&console.groupEnd();}child(t){let r=new e(void 0,this.enabled);return r.prefix=`${this.prefix}[${t}]`,r}},_t=null;function Hr(){return _t||(_t=new He(void 0,false)),_t}var $e=class{constructor(t){this.currentState="unknown";this.previousState="unknown";this.logger=Hr();this.hadSessionHistory=false;this.inActiveSession=false;t&&this.initialize(t);}initialize(t){if(this.currentState!=="unknown"){this.logger.info(`Skipping initialization - state already set to ${this.currentState}`);let n=!!(t.boundWallet||t.refreshId);this.hadSessionHistory=n;return}this.logger.group("\u{1F527} Initializing Session State Machine");let r=!!(t.boundWallet||t.refreshId);this.hadSessionHistory=r,this.logger.info("Initial context",{wallet:t.wallet,boundWallet:t.boundWallet,refreshId:t.refreshId?"present":"null",hasToken:t.hasToken,authenticated:t.authenticated,hasHistory:r}),t.authenticated&&t.hasToken?(this.transition("authenticated","Has valid token"),this.inActiveSession=true):r?this.transition("refreshable","Has session history"):this.transition("unregistered","No session history"),this.logger.groupEnd();}transition(t,r){if(this.currentState===t){this.logger.info(`State unchanged: ${t} (${r})`);return}this.previousState=this.currentState,this.currentState=t,this.logger.state(this.previousState,t,r);}getState(){return this.currentState}isInActiveSession(){return this.inActiveSession}markHadSession(){this.hadSessionHistory||(this.logger.info("Marked hadSessionHistory = true"),this.hadSessionHistory=true);}clearSessionHistory(){this.logger.info("Cleared session history"),this.hadSessionHistory=false,this.inActiveSession=false;}onNewCredentialsReceived(){this.inActiveSession&&(this.logger.info("New credentials received while in active session - allowing re-registration"),this.inActiveSession=false,this.transition("unregistered","New credentials received"));}onProbeComplete(t){if(this.logger.flow("probe","Probe completed, determining initial state"),this.currentState!=="unknown"){this.logger.warn("Probe called but state is not UNKNOWN",{currentState:this.currentState});return}!!(t.boundWallet||t.refreshId)||this.hadSessionHistory?this.transition("refreshable","Session history found"):this.transition("unregistered","No session history");}onRegisterSuccess(t){this.logger.flow("register","Register succeeded"),this.transition("authenticated","Register succeeded"),this.inActiveSession=true,this.hadSessionHistory=true;}onRegisterFailure(t){this.logger.flow("register",`Register failed: ${t}`);}onRefreshSuccess(t){this.logger.flow("refresh","Refresh succeeded"),this.transition("authenticated","Refresh succeeded"),this.inActiveSession=true;}onRefreshExpired(){this.logger.flow("refresh","Refresh failed: session expired (missing refresh identifier)"),this.transition("expired","Session expired"),this.inActiveSession=false;}onRefreshFailure(t){this.logger.flow("refresh",`Refresh failed: ${t}`);}onTokenExpired(){this.logger.flow("token","Token expired"),this.currentState==="authenticated"&&this.transition("refreshable","Token expired");}onWalletChange(t,r,n){if(this.logger.flow("wallet",`Wallet changed: ${t||"null"} \u2192 ${r||"null"}`),!r){this.transition("unknown","Wallet disconnected"),this.inActiveSession=false;return}A(r,n.boundWallet)?(this.hadSessionHistory=true,this.transition("refreshable","Wallet reconnected with session history")):(this.transition("unregistered","Wallet changed to different address"),this.inActiveSession=false);}onWalletDisconnect(){this.logger.flow("wallet","Wallet disconnected"),this.transition("unknown","Wallet disconnected"),this.inActiveSession=false;}shouldAttemptProbe(){let t=this.currentState==="unknown";return this.logger.decision("Should attempt probe?",t,`State is ${this.currentState}`),t}shouldAttemptRefresh(t){if(this.currentState!=="refreshable"&&this.currentState!=="authenticated")return this.logger.decision("Should attempt refresh?",false,`State is ${this.currentState}, not REFRESHABLE or AUTHENTICATED`),false;if(!(t.boundWallet||t.wallet))return this.logger.decision("Should attempt refresh?",false,"No wallet available (neither boundWallet nor current wallet)"),false;if(t.wallet&&t.boundWallet&&!A(t.wallet,t.boundWallet))return this.logger.decision("Should attempt refresh?",false,"Wallet mismatch"),false;if(t.hasToken&&t.tokenExpiry){let n=Math.floor(Date.now()/1e3);if(t.tokenExpiry-n>5&&this.currentState==="authenticated")return this.logger.decision("Should attempt refresh?",false,"Token still valid"),false}return this.logger.decision("Should attempt refresh?",true,`State is ${this.currentState}, token ${t.hasToken?"present":"missing"}`),true}shouldAttemptRegister(t){return this.inActiveSession?(this.logger.decision("Should attempt register?",false,"Already in active session - proof changes ignored"),false):this.currentState!=="unregistered"&&this.currentState!=="expired"?(this.logger.decision("Should attempt register?",false,`State is ${this.currentState}, not UNREGISTERED or EXPIRED`),false):t.wallet?t.hasProof?t.authenticated&&t.hasToken?(this.logger.decision("Should attempt register?",false,"Already authenticated"),false):(this.logger.decision("Should attempt register?",true,`State is ${this.currentState}, have wallet + proof`),true):(this.logger.decision("Should attempt register?",false,"No proof available"),false):(this.logger.decision("Should attempt register?",false,"No wallet connected"),false)}shouldWaitForInitialRefresh(t,r){return this.currentState!=="refreshable"||t?false:r.wallet&&r.boundWallet&&A(r.wallet,r.boundWallet)?(this.logger.decision("Should wait for initial refresh?",true,"Returning user - let refresh attempt first"),true):false}getStateReport(t){return `
 \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
 \u2502  Session State Machine Report          \u2502
 \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
@@ -19,7 +19,7 @@ var tn=Object.defineProperty;var jt=e=>{throw TypeError(e)};var rn=(e,t,r)=>t in
 \u2502 Authenticated:    ${String(t.authenticated).padEnd(20)} \u2502
 \u2502 Has Proof:        ${String(t.hasProof).padEnd(20)} \u2502
 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
-    `.trim()}};var Dn=()=>crypto.randomUUID(),vr=e=>{let{clientId:t,wallet:r,base:n="https://api.tdfc.com",fetchImpl:o,timeoutMs:a=15e3,proof:i=null,providerAdapter:c,refreshDeps:u=[],debug:s}=e,l=dt(n),p=typeof window<"u"?(o??fetch).bind(window):o??fetch,{meta:f,setBoundWallet:g,setJkt:b,setRefreshId:R,getRefreshId:m,setLastPolicyHash:k,setLastPolicyProof:S,setLastHost:H,setRootJkt:d,ready:w}=vt(),{ensureRootKeypair:y,rootPrivRef:P,rootPubJwkRef:C}=Tt(),O=react.useCallback(async()=>{await y();try{if(!f.rootJkt&&C.current){let te=await _(C.current);d(te);}}catch{}},[y,f.rootJkt,C]),{ensureKeypair:ve,rotate:K,privRef:Oe,pubJwkRef:je}=Kt(),[Lt,J]=react.useState(false),[V,j]=react.useState(0),[ee,ce]=react.useState(null),[ae,ot]=react.useState(null),[at,it]=react.useState(null),[Dr,Lr]=react.useState(null),_r=react.useRef(null),Hr=react.useRef(null),Mr=react.useRef(null),$r=react.useRef(null),Or=react.useRef(null),jr=react.useRef(null),Ur=react.useRef(null),Nr=react.useRef(false),Fr=react.useRef(false),Br=react.useRef(void 0),Ue=react.useRef(false),st=react.useRef(false),_t=react.useRef(null),le=react.useRef(null);le.current||(le.current=new Promise(te=>{_t.current=te;}));let ct=react.useRef(null),Gr=react.useRef(i),Vr=react.useRef(null),me=react.useRef(null);if(!me.current){let te=s??false;me.current=new _e(t,te);}let Ht=s??false;me.current&&me.current.enabled!==Ht&&(me.current.enabled=Ht);let lt=react.useRef(null);lt.current||(lt.current=new rt);let Ne=react.useRef(null),Mt=react.useRef(null),Fe=react.useRef(null),$t=()=>Date.now(),qr=()=>(Fe.current??0)>0&&Fe.current<$t(),ut=react.useCallback((te,en=15e3)=>{let Ot=Dn();return Ne.current=Ot,Mt.current=te,Fe.current=$t()+Math.max(1e3,en),Ot},[]),zr=react.useCallback(()=>((!Ne.current||qr())&&ut("adhoc",1e4),Ne.current),[ut]),ft=react.useRef(null),Be=react.useRef(null);Be.current||(Be.current=new Promise(te=>{ft.current=te;}));let Xr=react.useCallback(async()=>{!Ue.current&&Be.current&&await Be.current;},[]),Yr=react.useCallback(()=>{Ue.current||(Ue.current=true,ft.current?.(),ft.current=null);},[]),Zr=react.useCallback(async()=>{!st.current&&le.current&&await le.current;},[]),Qr=react.useCallback(async()=>{!st.current&&le.current&&await le.current,ct.current&&await ct.current;},[]);return {clientId:t,wallet:r,baseUrl:l,fetchImpl:p,timeoutMs:a,providerAdapter:c,refreshDeps:u,ensureKeypair:ve,rotate:K,ensureRootKeypair:O,rootPrivRef:P,rootPubJwkRef:C,privRef:Oe,pubJwkRef:je,meta:f,setBoundWallet:g,setJkt:b,setRefreshId:R,accessTokenRef:Mr,tokenExpRef:$r,authenticated:Lt,setAuthenticated:J,loadingCount:V,setLoadingCount:j,error:ee,setError:ce,allowed:ae,setAllowed:ot,sessionExpiry:at,setSessionExpiry:it,sessionData:Dr,setSessionData:Lr,authWalletRef:Hr,refreshLock:Or,registerLock:jr,sessionLock:Ur,didInitialRefresh:Nr,didInitialSession:Fr,prevWalletRef:Br,initResolvedRef:st,initReady:le,initResolveRef:_t,rotateLock:ct,waitReady:Zr,awaitKeyStable:Qr,proofRef:Gr,registerCooldownUntilRef:_r,reqIdRef:Ne,flowLabelRef:Mt,flowExpireRef:Fe,beginFlow:ut,currentReqId:zr,awaitProbe:Xr,markProbed:Yr,hasProbedRef:Ue,getRefreshId:m,setLastPolicyHash:k,setLastPolicyProof:S,setLastHost:H,setRootJkt:d,metaReady:w,probeLock:Vr,stateMachine:lt.current,logger:me.current}};var G=e=>e.accessTokenRef.current??null,Q=e=>{let t=e.privRef.current;if(!t)throw new Error("Sunbreak: private key not initialized");return t},W=e=>{let t=e.pubJwkRef.current;if(!t)throw new Error("Sunbreak: public JWK not initialized");return t};var Ln=(e,t)=>`${e.toUpperCase()} ${t}`;async function He(e,t,r,n){if(!t)return e.logger.guard("register",false,"No wallet provided"),false;e.logger.flow("register","Starting register flow",{wallet:t});let o=He._nonceCacheRef||(He._nonceCacheRef={map:new Map});try{await e.waitReady(),await e.awaitKeyStable(),await e.awaitProbe(),await e.ensureKeypair(),e.setError(null),e.beginFlow("register",2e4);let a;try{if(await e.ensureRootKeypair(),e.rootPrivRef.current&&e.rootPubJwkRef.current){if(!e.meta.rootJkt)try{let y=await _(e.rootPubJwkRef.current);e.setRootJkt?.(y);}catch{}let d=await _(W(e)),w=await e.getRefreshId();a=await pe({rootPrivateKey:e.rootPrivRef.current,rootPublicJwk:e.rootPubJwkRef.current,childJkt:d,clientId:e.clientId,sid:w||void 0,ttlSec:300});}}catch(d){e.logger.warn("Failed to create PODE for register",d);}let i=e.currentReqId(),c="/auth/register",u=`${e.baseUrl}${c}`,s=new URL(e.baseUrl).origin,l="POST",p=`${s}${c}`,f=Ln(l,p),g=o.map.get(f),b=await B({method:l,url:p,nonce:g,privateKey:Q(e),publicJwk:W(e)}),R=async d=>e.fetchImpl(u,{method:l,headers:{"content-type":"application/json","x-sunbreak-meta":F(e,{reqId:i,pode:a||void 0}),...d},credentials:"include",body:JSON.stringify({wallet:t,proof:r})}),m=await R({DPoP:b}),k=d=>{let w=d.headers.get("dpop-nonce");w&&o.map.set(f,w);};if(m.status===401){e.logger.info("Register got 401, retrying with nonce");let d=m.headers.get("www-authenticate"),y=(d&&d.match(/dpop-nonce="([^"]+)"/i))?.[1];if(y){o.map.set(f,y);let P=await B({method:l,url:p,nonce:y,privateKey:Q(e),publicJwk:W(e)});m=await R({DPoP:P});}}if(k(m),e.logger.api(l,c,{status:m.status}),!m.ok){let d=await Le(m);if((m.headers.get("content-type")||"").includes("application/json")){let y;try{y=await m.clone().json();}catch{}let P=De(y&&(y.error||y.message||y.detail)||`HTTP ${m.status}`);throw he(P,d)}else {let y=d.waf?"Blocked by WAF (403)":d.alb403?"Blocked at origin (ALB 403)":`HTTP ${m.status}`;throw he(y,d)}}let S=await m.json();e.logger.info("Register succeeded",{expiresIn:S.expiresIn,hasRefreshId:!!S.refreshId}),e.accessTokenRef.current=S.access,e.authWalletRef.current=t.toLowerCase(),e.setAuthenticated(!0);try{let d=Math.floor(Date.now()/1e3);e.tokenExpRef.current=d+(S.expiresIn??0);}catch{}e.didInitialRefresh.current=!0,e.setBoundWallet(t),e.setLastPolicyHash(null),e.setLastPolicyProof(null);try{e.setJkt(await _(W(e)));}catch{}try{let d={...e.meta,boundWallet:t,clientId:e.meta.clientId??e.clientId,jkt:e.meta.jkt??null,refreshId:S.refreshId??null};e.setRefreshId(S.refreshId??null);let w=Te(e.clientId);await E(w,d);try{localStorage.setItem(w,JSON.stringify(d));}catch{}}catch{}let H={wallet:t,boundWallet:t,refreshId:S.refreshId??null,hasToken:!0,tokenExpiry:e.tokenExpRef.current,hasProof:!0,authenticated:!0};return e.stateMachine.onRegisterSuccess(H),!0}catch(a){let i=Number(a?.status||0),c=String(a?.code||"").toLowerCase(),u=String(a?.message||"").toLowerCase(),s=Math.floor(Math.random()*1e3);e.logger.error("Register failed",{status:i,code:c,msg:u}),e.stateMachine.onRegisterFailure(`${c||u||"Unknown error"}`);let l=c==="session_exists"||c==="already_authenticated"||u.includes("already")&&(u.includes("session")||u.includes("authenticated")),p=(i===401||i===403)&&c==="replay";if((l||p)&&n?.refreshFallback&&(!e.meta.boundWallet||e.meta.boundWallet.toLowerCase()===t.toLowerCase())){e.logger.info("Register failed with recoverable error, attempting refresh fallback",{code:c,isSessionExists:l,isReplay:p});try{if(await n.refreshFallback())return e.logger.info("Refresh fallback succeeded after register failure"),e.meta.boundWallet||e.setBoundWallet(t),!0}catch(g){e.logger.warn("Refresh fallback failed",g);}}if(p){if(e.providerAdapter)try{let f=await e.providerAdapter.getToken()??null;if(f)return await e.awaitKeyStable(),await e.ensureKeypair(),await e.rotate(),e.proofRef.current=await xe(e.providerAdapter,f),e.registerCooldownUntilRef.current=Date.now()+5e3+s,!1}catch{}else return e.proofRef.current=null,e.setError("Proof replayed; please sign a fresh proof."),e.registerCooldownUntilRef.current=Date.now()+1e4+s,false;return e.registerCooldownUntilRef.current=Date.now()+8e3+s,false}if(l)return e.setError("Session already exists. Try refreshing the page."),e.registerCooldownUntilRef.current=Date.now()+3e3+s,false;if(i===403&&(a?.waf||a?.alb403))return e.setError(u||"Forbidden at edge/origin"),e.registerCooldownUntilRef.current=Date.now()+3e4+s,false;if(i===403)return e.setError(c||u||"Forbidden"),e.registerCooldownUntilRef.current=Date.now()+15e3+s,false;if(i===429||i===503){e.setError(c||u||"Rate limited / unavailable");let f=i===429?5e3:8e3;return e.registerCooldownUntilRef.current=Date.now()+f+s,false}return e.setError(c||u||"Register failed"),e.registerCooldownUntilRef.current=Date.now()+5e3+s,false}}var _n=(e,t)=>`${e.toUpperCase()} ${t}`;function Me(e){if(e.refreshLock.current)return e.logger.guard("refreshLock",false,"Refresh already in progress"),e.refreshLock.current;if(e.registerLock.current){e.logger.guard("registerLock",false,"Registration in progress, waiting");let t=e.registerLock.current.then(()=>{if(e.authenticated&&G(e))return  true;if(G(e)){let n=e.tokenExpRef.current,o=Math.floor(Date.now()/1e3);if(!!n&&n-o>5)return  true}return  false});return e.refreshLock.current=t.finally(()=>{e.refreshLock.current=null;}),e.refreshLock.current}return e.logger.flow("refresh","Starting refresh flow"),e.refreshLock.current=(async()=>{try{await e.waitReady(),await e.awaitKeyStable(),await e.awaitProbe();let t=e.meta.boundWallet||e.wallet;if(!t)return e.logger.warn("No wallet available for refresh (neither boundWallet nor current wallet)"),!1;if(e.wallet&&e.meta.boundWallet&&!X(e.wallet,e.meta.boundWallet))return e.logger.warn("Wallet mismatch during refresh",{current:e.wallet,bound:e.meta.boundWallet}),e.accessTokenRef.current=null,e.setAuthenticated(!1),!1;let r=G(e);if(r){let y=e.tokenExpRef.current,P=Math.floor(Date.now()/1e3);if(!!r&&!!y&&y-P>5)return e.logger.info("Token still valid, skipping refresh"),!0}e.beginFlow("refresh",15e3);let n=e.currentReqId();await e.ensureKeypair();let o;try{if(await e.ensureRootKeypair(),e.rootPrivRef.current&&e.rootPubJwkRef.current){if(!e.meta.rootJkt)try{let C=await _(e.rootPubJwkRef.current);e.setRootJkt?.(C);}catch{}let y=await _(W(e)),P=await e.getRefreshId();o=await pe({rootPrivateKey:e.rootPrivRef.current,rootPublicJwk:e.rootPubJwkRef.current,childJkt:y,clientId:e.clientId,sid:P||void 0,ttlSec:300});}}catch(y){e.logger.warn("Failed to create PODE for refresh",y);}let a="/auth/refresh",i=`${e.baseUrl}${a}`,c=new URL(e.baseUrl).origin,u="POST",s=`${c}${a}`,l=_n(u,s),p=Me._nonceCacheRef||(Me._nonceCacheRef={map:new Map}),f=async y=>await B({method:u,url:s,nonce:y,privateKey:Q(e),publicJwk:W(e)}),g=await e.getRefreshId(),b={"x-sunbreak-meta":F(e,{reqId:n,refreshId:g||void 0,pode:o||void 0,wallet:t}),"content-type":"application/json"},R=async y=>e.fetchImpl(i,{method:u,headers:{DPoP:y,...b},credentials:"include",body:"{}"}),m=y=>{let P=y.headers.get("dpop-nonce");P&&p.map.set(l,P);},k=await R(await f(p.map.get(l)));if(k.status===401){e.logger.info("Refresh got 401, retrying with nonce");let y=k.headers.get("www-authenticate"),C=(y&&y.match(/dpop-nonce="([^"]+)"/i))?.[1];C&&(p.map.set(l,C),k=await R(await f(C)));}if(m(k),e.logger.api(u,a,{status:k.status}),!k.ok){try{if((k.headers.get("content-type")||"").includes("application/json")){let P=await k.clone().json().catch(()=>{}),C=P&&(P.error||P.code||P.message)||"",O=String(C).toLowerCase();if(O.includes("missing")&&O.includes("refresh")){e.logger.warn("Refresh session expired (missing refresh identifier)"),e.stateMachine.onRefreshExpired();try{e.setRefreshId?.(null);}catch{}e.accessTokenRef.current=null,e.setAuthenticated(!1);}else e.logger.warn("Refresh failed",{error:C}),e.stateMachine.onRefreshFailure(String(C));}}catch{}return !1}let S=await k.json();e.logger.info("Refresh succeeded",{expiresIn:S.expiresIn,hasRefreshId:!!S.refreshId}),e.accessTokenRef.current=S.access,e.setAuthenticated(!0);let H=(e.wallet&&(!e.meta.boundWallet||e.meta.boundWallet===e.wallet)?e.wallet:e.meta.boundWallet)||null;e.authWalletRef.current=H?H.toLowerCase():null;try{let y=Math.floor(Date.now()/1e3);e.tokenExpRef.current=y+(S.expiresIn??0);}catch{}try{e.setJkt(await _(W(e)));}catch{}S.refreshId&&e.setRefreshId(S.refreshId);let d=y=>!y||y==="null"||y==="undefined"?null:y,w={wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:d(S.refreshId??e.meta.refreshId??null),hasToken:!0,tokenExpiry:e.tokenExpRef.current,hasProof:!!e.proofRef.current,authenticated:!0};return e.stateMachine.onRefreshSuccess(w),!0}finally{e.refreshLock.current=null;}})(),e.refreshLock.current}var Hn=(e,t)=>`${e.toUpperCase()} ${t}`,Wt=new Map,$e;try{let e=globalThis;$e=e.__sunbreak_page_probe_guard??(e.__sunbreak_page_probe_guard=new Set);}catch{$e=new Set;}var Mn=e=>{try{let t=new URL(e.baseUrl).origin;return `${e.clientId}::${t}`}catch{return `${e.clientId}::${e.baseUrl}`}};async function xr(e){let t=Mn(e);if(e.probeLock.current){e.logger.guard("probeLock",false,"Probe already in progress, waiting"),await e.probeLock.current,e.markProbed();return}if(e.hasProbedRef.current){e.logger.guard("hasProbedRef",false,"Already probed in this session"),e.markProbed();return}if($e.has(t)){e.logger.guard("pageProbeGuard",false,"Already probed for this page load"),e.markProbed();return}$e.add(t),e.logger.flow("probe","Starting probe flow",{clientId:e.clientId,pageKey:t});let r=(async()=>{let n=new URL(e.baseUrl).origin;try{if(await e.awaitKeyStable(),await e.ensureKeypair(),!e.rootPrivRef.current)try{await e.ensureRootKeypair();}catch{}let o;if(e.rootPrivRef.current&&e.rootPubJwkRef.current)try{let m=await _(W(e));o=await pe({rootPrivateKey:e.rootPrivRef.current,rootPublicJwk:e.rootPubJwkRef.current,childJkt:m,clientId:e.clientId,ttlSec:300});}catch(m){e.logger.warn("Failed to create PODE for probe",m);}let a="POST",i="/auth/probe",c=`${e.baseUrl}${i}`,u=`${n}${i}`,s=Hn(a,u),l=async m=>B({method:a,url:u,nonce:m,privateKey:Q(e),publicJwk:W(e)}),p=async m=>e.fetchImpl(c,{method:a,headers:{DPoP:m,"x-sunbreak-meta":F(e,{pode:o}),"content-type":"application/json"},credentials:"include",body:"{}"}),f=m=>{let k=m.headers.get("dpop-nonce");k&&Wt.set(s,k);},g=await p(await l(Wt.get(s)));if(f(g),g.status===401){e.logger.info("Probe got 401, retrying with nonce from www-authenticate");let m=g.headers.get("www-authenticate"),S=(m&&m.match(/dpop-nonce="([^"]+)"/i))?.[1];S&&(Wt.set(s,S),g=await p(await l(S)),f(g));}e.logger.api(a,i,{status:g.status});let b=m=>!m||m==="null"||m==="undefined"?null:m,R={wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:b(e.meta.refreshId),hasToken:!!e.accessTokenRef.current,tokenExpiry:e.tokenExpRef.current||null,hasProof:!!e.proofRef.current,authenticated:e.authenticated};e.stateMachine.onProbeComplete(R);}catch(o){e.logger.error("Probe failed",o);try{$e.delete(t);}catch{}}finally{e.markProbed(),e.logger.flow("probe","Probe flow completed");}})();e.probeLock.current=r;try{await r;}finally{e.probeLock.current=null;}}var Kr=e=>{let t=react.useCallback(()=>Me(e),[e]),r=react.useCallback(async()=>{let o=Date.now(),a=e.registerCooldownUntilRef.current??0;if(o<a){e.logger.guard("registerCooldown",false,"Cooldown active");return}if(!e.wallet){e.logger.guard("attemptRegister",false,"No wallet");return}if(!e.initResolvedRef.current){e.logger.guard("attemptRegister",false,"Not initialized");return}if(e.refreshLock.current){e.logger.guard("attemptRegister",false,"Refresh in progress");return}if(e.registerLock.current){e.logger.guard("attemptRegister",false,"Register already in progress");return}let i=s=>!s||s==="null"||s==="undefined"?null:s,c={wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:i(e.meta.refreshId),hasToken:!!G(e),tokenExpiry:e.tokenExpRef.current||null,hasProof:!!e.proofRef.current,authenticated:e.authenticated};if(!e.stateMachine.shouldAttemptRegister(c)){e.logger.guard("attemptRegister",false,`State machine blocked (state: ${e.stateMachine.getState()}, inActiveSession: ${e.stateMachine.isInActiveSession()})`);return}let u=e.proofRef.current;if(!u){e.logger.guard("attemptRegister",false,"No proof available");return}e.logger.guard("attemptRegister",true,"All guards passed, proceeding"),await e.awaitKeyStable(),e.registerLock.current=(async()=>{try{await He(e,e.wallet,u,{refreshFallback:async()=>{e.logger.info("Attempting refresh as fallback after register failure");let l=!!e.meta.boundWallet;!l&&e.wallet&&e.setBoundWallet(e.wallet);try{return await Me(e)}catch{return l||e.setBoundWallet(null),!1}}})&&(e.didInitialSession.current=!0);}catch(s){e.setError(s?.message||String(s)||"Register failed");}finally{e.registerLock.current=null;}})();},[e]),n=react.useCallback(async o=>{let a=()=>(e.registerCooldownUntilRef.current??0)>Date.now();if(!e.providerAdapter||a())return;let i=await xe(e.providerAdapter,o);e.proofRef.current=i;},[e]);return {refresh:t,register:(o,a,i)=>He(e,o,a,i),attemptRegister:r,setProofFromAdapterToken:n}};var $n=(e,t)=>`${e.toUpperCase()} ${t}`,On=(e,t)=>!!e&&!!t&&e.toLowerCase()===t.toLowerCase();async function nt(e,t,r,n,o,a={}){e.setLoadingCount(s=>s+1),e.setError(null);let i=n.startsWith("/api/session"),c=new AbortController,u=setTimeout(()=>c.abort(),e.timeoutMs);try{await e.waitReady(),await e.awaitKeyStable(),await e.awaitProbe(),await e.ensureKeypair();let l=`${i?ht(e):e.baseUrl}${n.startsWith("/")?"":"/"}${n}`,f=`${new URL(e.baseUrl).origin}${n.startsWith("/")?"":"/"}${n}`,g=$n(r,f),b=n.startsWith("/auth/"),R=!1,m=!1,k=e.currentReqId(),S=nt._nonceCacheRef||(nt._nonceCacheRef={map:new Map}),H=J=>{let V=J.headers.get("dpop-nonce");V&&S.map.set(g,V);},d=!!e.wallet&&!!e.authWalletRef.current&&e.wallet.toLowerCase()!==e.authWalletRef.current.toLowerCase(),w=()=>b||!e.wallet?!1:!!(e.authenticated||On(e.wallet,e.meta.boundWallet)||typeof e.meta.refreshId=="string"&&e.meta.refreshId),y,P,C=async()=>{if(b||d)return;try{let ce=G(e),ae=e.tokenExpRef.current,ot=Math.floor(Date.now()/1e3),at=!!ae&&ae-ot<=60;if(ce){if(at&&!await t().catch(()=>!1))return}else if(!w()||!await t().catch(()=>!1))return}catch{}let J=G(e);if(!J)return;let V=await Qe(J),j=S.map.get(g),ee=await B({method:r,url:f,nonce:j,ath:V,privateKey:Q(e),publicJwk:W(e)});y=`Bearer ${e.accessTokenRef.current}`,P=ee;};await C();let O={"content-type":"application/json","x-sunbreak-auth":y||"","x-sunbreak-meta":F(e,{reqId:k,auth:y,ifPolicyHash:e.meta.lastPolicyHash||void 0,ifPolicyProof:e.meta.lastPolicyProof||void 0}),...yt(a.headers)};P&&(O.DPoP=P);let ve=async()=>e.fetchImpl(l,{...a,method:r,headers:O,body:o!==void 0?JSON.stringify(o):void 0,credentials:"include",signal:c.signal}),K=await ve(),Oe=K.headers.get("x-sunbreak-policy-hash"),je=K.headers.get("x-sunbreak-policy-proof");if(Oe&&e.setLastPolicyHash(Oe),je&&e.setLastPolicyProof(je),H(K),K.status===401&&!b){let J=G(e),V=K.headers.get("www-authenticate"),ee=(V&&V.match(/dpop-nonce="([^"]+)"/i))?.[1];if(!d&&ee&&J&&!m){m=!0,S.map.set(g,ee);let ce=await Qe(J),ae=await B({method:r,url:f,nonce:ee,ath:ce,privateKey:Q(e),publicJwk:W(e)});y=`Bearer ${e.accessTokenRef.current}`,P=ae,O["x-sunbreak-meta"]=F(e,{reqId:k,auth:y}),O.DPoP=P,K=await ve(),H(K);}if(K.status===401&&!R&&(R=!0,!d&&w())){let ce=await t(),ae=G(e);ce&&ae&&!d&&(await C(),O["x-sunbreak-meta"]=F(e,{reqId:k,auth:y}),P&&(O.DPoP=P),K=await ve(),H(K));}if(K.status===401)throw new Error("Unauthorized")}if(!K.ok){let J=await Le(K);if((K.headers.get("content-type")||"").includes("application/json")){let j=await K.json().catch(()=>{}),ee=De(j&&(j.error||j.message||j.detail)||`HTTP ${K.status}`);throw he(ee,J)}else {let j=J.waf?"Blocked by WAF (403)":J.alb403?"Blocked at origin (ALB 403)":`HTTP ${K.status}`;throw he(j,J)}}return (K.headers.get("content-type")||"").includes("application/json")?await K.json():void 0}finally{clearTimeout(u),e.setLoadingCount(s=>Math.max(0,s-1));}}var Cr=(e,t)=>react.useCallback(async(r,n,o,a={})=>nt(e,t,r,n,o,a),[e,t]);async function Tr(e,t){let r=await t("GET","/api/session");if(r){e.setAllowed(!!r.allowed),e.setSessionData(r),e.setSessionExpiry(r.expiry??null);let n=r?.wallet;typeof n=="string"&&n&&e.setBoundWallet(n.toLowerCase());}return r}var Ir=(e,t)=>({session:react.useCallback(async()=>{if(e.wallet&&!(e.meta.boundWallet&&!X(e.wallet,e.meta.boundWallet)))return e.sessionLock.current||(e.sessionLock.current=(async()=>{try{return await Tr(e,t)}catch(n){throw e.logger.error("Session request failed",n),n}finally{e.sessionLock.current=null;}})()),e.sessionLock.current},[e,t])});var Wr=(e,t)=>{let{refresh:r,session:n,attemptRegister:o,setProofFromAdapterToken:a,proofProp:i}=t,c=()=>(e.registerCooldownUntilRef.current??0)>Date.now(),u=()=>{let s=l=>!l||l==="null"||l==="undefined"?null:l;return {wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:s(e.meta.refreshId),hasToken:!!e.accessTokenRef.current,tokenExpiry:e.tokenExpRef.current||null,hasProof:!!e.proofRef.current,authenticated:e.authenticated}};react.useEffect(()=>{if(!e.metaReady)return;let s=true;return (async()=>{try{if(await e.waitReady(),!s||(await e.awaitKeyStable(),!s)||(await e.ensureRootKeypair(),!s))return;let l=u();e.stateMachine.initialize(l),await xr(e);}catch(l){if(!s)return;e.logger.error("Probe initialization failed",l);}})(),()=>{s=false;}},[e.metaReady]),react.useEffect(()=>{let s=e.prevWalletRef.current;if(e.prevWalletRef.current=e.wallet,e.wallet!==s&&(e.didInitialRefresh.current=false),!e.wallet){e.logger.flow("wallet","Wallet disconnected"),e.stateMachine.onWalletDisconnect(),e.setAllowed(null),e.setSessionExpiry(null),e.setSessionData(null),e.setAuthenticated(false),e.accessTokenRef.current=null,e.proofRef.current=null,e.setError(null),e.didInitialSession.current=false,e.authWalletRef.current=null,e.setLastPolicyHash(null),e.setLastPolicyProof(null),e.didInitialRefresh.current=false;return}if(s&&e.wallet&&s!==e.wallet){e.logger.flow("wallet",`Wallet changed: ${s} \u2192 ${e.wallet}`);let l=u();e.stateMachine.onWalletChange(s,e.wallet,l),e.proofRef.current=null,e.accessTokenRef.current=null,e.setAuthenticated(false),e.didInitialSession.current=false,e.authWalletRef.current=null,e.setLastPolicyHash(null),e.setLastPolicyProof(null),e.rotateLock.current=(async()=>{await e.rotate();})().catch(()=>{}).finally(()=>{e.rotateLock.current=null;});}if(!s&&e.wallet){if(e.logger.flow("wallet",`Wallet connected: ${e.wallet}`),e.didInitialSession.current=false,!e.metaReady){e.logger.info("Wallet connected but meta not ready, deferring state machine update");return}let l=u();e.stateMachine.onWalletChange(null,e.wallet,l);}},[e.wallet,e.metaReady]),react.useEffect(()=>{if(!e.providerAdapter||c()||!e.metaReady||!e.wallet)return;if(e.stateMachine.isInActiveSession()){e.logger.decision("Provider adapter should trigger register?",false,"Already in active session");return}if(e.authenticated){e.logger.decision("Provider adapter should trigger register?",false,"Already authenticated");return}let s=u();if(e.stateMachine.shouldWaitForInitialRefresh(e.didInitialRefresh.current,s)){e.logger.decision("Provider adapter should wait for initial refresh?",true,"Returning user - refresh first");return}e.logger.decision("Provider adapter should trigger register?",true,`Fetching token (state: ${e.stateMachine.getState()})`);let l=false;return (async()=>{try{let p=e.providerAdapter.getToken(),f=new Promise((b,R)=>setTimeout(()=>R(new Error("Provider adapter timeout (30s)")),3e4)),g=await Promise.race([p,f]).catch(b=>(e.logger.warn("Provider adapter getToken failed",b),null))??null;if(await e.awaitKeyStable(),l||!g)return;try{let b=g.split(".");if(b[1]){let R=JSON.parse(atob(b[1]));e.logger.info("Provider adapter: got token",{wallet:e.wallet,jwtSub:R.sub,jwtWallet:R.wallet||R.linked_accounts?.[0]?.address,jwtExp:R.exp,jwtIat:R.iat});}}catch{e.logger.info("Provider adapter: got token (could not decode)");}await a(g),await o();}catch(p){e.logger.error("Provider adapter flow failed",p);}})(),()=>{l=true;}},[e.providerAdapter,e.wallet,e.meta.boundWallet,e.metaReady,e.registerCooldownUntilRef,e.didInitialRefresh,e.authenticated,...e.refreshDeps]),react.useEffect(()=>{if(typeof i<"u"&&(e.proofRef.current=i??null,i&&e.logger.info("Proof prop updated",{hasProof:!!i})),!e.metaReady)return;let s=u();if(!e.stateMachine.shouldAttemptRegister(s)){e.logger.decision("Proof prop should trigger register?",false,`State machine says no (state: ${e.stateMachine.getState()}, inActiveSession: ${e.stateMachine.isInActiveSession()})`);return}if(e.stateMachine.shouldWaitForInitialRefresh(e.didInitialRefresh.current,s)){e.logger.decision("Proof prop should wait for initial refresh?",true,"Returning user - refresh first");return}let l=!!e.wallet,p=!!e.proofRef.current;l&&p&&e.initResolvedRef.current&&!c()&&(e.logger.info("Proof prop conditions met, attempting register"),o());},[i,e.wallet,e.authenticated,e.meta.boundWallet,e.metaReady,e.providerAdapter,e.initResolvedRef,e.didInitialRefresh,o]),react.useEffect(()=>{if(!e.metaReady||e.didInitialRefresh.current)return;e.didInitialRefresh.current=true;let s=true;return (async()=>{try{await e.waitReady(),await e.awaitProbe();let l=u();if(e.accessTokenRef.current||e.authenticated){e.logger.info("Already authenticated, skipping initial refresh"),e.wallet&&!e.didInitialSession.current&&(e.didInitialSession.current=!0,await n());return}if(!e.stateMachine.shouldAttemptRefresh(l)){e.logger.decision("Should attempt initial refresh?",!1,`State: ${e.stateMachine.getState()}`);return}e.logger.decision("Should attempt initial refresh?",!0,`State: ${e.stateMachine.getState()}`);let f=await r();if(!s)return;e.setAuthenticated(f),f&&e.wallet&&!e.didInitialSession.current&&(e.didInitialSession.current=!0,await n());}catch(l){if(!s)return;e.setAuthenticated(false),e.setError(l?.message||String(l)||"Unknown error");}})(),()=>{s=false;}},[e.wallet,e.meta.boundWallet,e.meta.refreshId,e.metaReady,e.didInitialRefresh,r,n]),react.useEffect(()=>{e.initResolvedRef.current||(async()=>{if(await e.ensureKeypair(),!e.wallet){e.initResolvedRef.current=true,e.initResolveRef.current?.();return}e.meta.boundWallet&&!X(e.meta.boundWallet,e.wallet)&&(e.rotateLock.current=(async()=>{e.accessTokenRef.current=null,e.setAuthenticated(false);})().catch(()=>{}).finally(()=>{e.rotateLock.current=null;}),e.rotateLock.current&&await e.rotateLock.current),e.initResolvedRef.current=true,e.initResolveRef.current?.();})();},[e]),react.useEffect(()=>{(async()=>{if(e.authenticated&&e.wallet&&!(e.meta.boundWallet&&!X(e.wallet,e.meta.boundWallet))&&!e.didInitialSession.current){e.didInitialSession.current=true;try{e.logger.flow("session","Calling session after authentication"),await n();}catch(s){e.setError(s?.message||String(s));}}})();},[e.authenticated,e.wallet,e.meta.boundWallet,n]),react.useEffect(()=>{e.wallet&&e.authWalletRef.current&&!X(e.wallet,e.authWalletRef.current)&&(e.logger.warn("Wallet mismatch detected, clearing auth",{current:e.wallet,authWallet:e.authWalletRef.current}),e.accessTokenRef.current=null,e.setAuthenticated(false));},[e.wallet,e.authWalletRef.current]),react.useEffect(()=>{let p=()=>{let b=Math.floor(Date.now()/1e3),R=e.tokenExpRef.current,m=e.sessionExpiry,k=!!R&&R-b<=30&&R-b>0,S=!!m&&m-b<=3600&&m-b>0;return {tokenSoon:k,sessionSoon:S}},f=async()=>{try{if(!e.authenticated||!e.wallet||e.meta.boundWallet&&!X(e.wallet,e.meta.boundWallet))return;let{tokenSoon:b,sessionSoon:R}=p();(b||R)&&(e.logger.info("Refreshing on focus",{tokenSoon:b,sessionSoon:R}),await r()&&R&&await n());}catch{}},g=async()=>{document.visibilityState==="visible"&&await f();};return window.addEventListener("focus",f),document.addEventListener("visibilitychange",g),()=>{window.removeEventListener("focus",f),document.removeEventListener("visibilitychange",g);}},[e,e.sessionExpiry,r,n]);};var Jr=react.createContext(void 0),Gn=e=>{let t=vr(e),{refresh:r,attemptRegister:n,setProofFromAdapterToken:o}=Kr(t),a=Cr(t,r),{session:i}=Ir(t,a);Wr(t,{refresh:r,session:i,attemptRegister:n,setProofFromAdapterToken:o,proofProp:e.proof});let c=react.useMemo(()=>({get:(u,s)=>a("GET",u,void 0,s),post:(u,s,l)=>a("POST",u,s,l),session:i,refresh:r,authenticated:t.authenticated,loading:t.loadingCount>0,error:t.error,allowed:t.allowed,sessionExpiry:t.sessionExpiry,sessionData:t.sessionData,wallet:t.wallet}),[a,i,r,t.authenticated,t.loadingCount,t.error,t.allowed,t.sessionExpiry,t.sessionData,t.wallet]);return jsxRuntime.jsx(Jr.Provider,{value:c,children:e.children})},Vn=e=>jsxRuntime.jsx(At,{clientId:e.clientId,children:jsxRuntime.jsx(Gn,{...e})}),qn=()=>{let e=react.useContext(Jr);if(!e)throw new Error("useSunbreak must be used within a SunbreakProvider");return e};
+    `.trim()}};var zn=()=>crypto.randomUUID(),$r=e=>{let{clientId:t,wallet:r,base:n="https://api.sunbreak.com",fetchImpl:o,timeoutMs:a=15e3,proof:i=null,providerAdapter:s,refreshDeps:u=[],debug:l}=e,c=yt(n),p=typeof window<"u"?(o??fetch).bind(window):o??fetch,{meta:d,setBoundWallet:g,setJkt:R,setRefreshId:K,getRefreshId:w,setLastPolicyHash:k,setLastPolicyProof:b,setLastHost:J,setRootJkt:M,setRegisteredProofId:h,ready:f}=It(),{ensureRootKeypair:y,rootPrivRef:C,rootPubJwkRef:D}=Dt(),xe=react.useCallback(async()=>{await y();try{if(!d.rootJkt&&D.current){let re=await $(D.current);M(re);}}catch{}},[y,d.rootJkt,D]),{ensureKeypair:x,rotate:Ue,privRef:Fe,pubJwkRef:qt}=Wt(),[_,X]=react.useState(false),[U,te]=react.useState(0),[le,ae]=react.useState(null),[lt,ut]=react.useState(null),[ft,qr]=react.useState(null),[zr,Xr]=react.useState(null),Yr=react.useRef(null),Zr=react.useRef(null),Qr=react.useRef(null),en=react.useRef(null),tn=react.useRef(null),rn=react.useRef(null),nn=react.useRef(null),on=react.useRef(false),an=react.useRef(false),sn=react.useRef(void 0),Be=react.useRef(false),dt=react.useRef(false),zt=react.useRef(null),ue=react.useRef(null);ue.current||(ue.current=new Promise(re=>{zt.current=re;}));let pt=react.useRef(null),cn=react.useRef(i),ln=react.useRef(null),ye=react.useRef(null);if(!ye.current){let re=l??false;ye.current=new He(t,re);}let Xt=l??false;ye.current&&ye.current.enabled!==Xt&&(ye.current.enabled=Xt);let ht=react.useRef(null);ht.current||(ht.current=new $e);let Ge=react.useRef(null),Yt=react.useRef(null),Ve=react.useRef(null),Zt=()=>Date.now(),un=()=>(Ve.current??0)>0&&Ve.current<Zt(),mt=react.useCallback((re,wn=15e3)=>{let Qt=zn();return Ge.current=Qt,Yt.current=re,Ve.current=Zt()+Math.max(1e3,wn),Qt},[]),fn=react.useCallback(()=>((!Ge.current||un())&&mt("adhoc",1e4),Ge.current),[mt]),wt=react.useRef(null),qe=react.useRef(null);qe.current||(qe.current=new Promise(re=>{wt.current=re;}));let dn=react.useCallback(async()=>{!Be.current&&qe.current&&await qe.current;},[]),pn=react.useCallback(()=>{Be.current||(Be.current=true,wt.current?.(),wt.current=null);},[]),hn=react.useCallback(async()=>{!dt.current&&ue.current&&await ue.current;},[]),mn=react.useCallback(async()=>{!dt.current&&ue.current&&await ue.current,pt.current&&await pt.current;},[]);return {clientId:t,wallet:r,baseUrl:c,fetchImpl:p,timeoutMs:a,providerAdapter:s,refreshDeps:u,ensureKeypair:x,rotate:Ue,ensureRootKeypair:xe,rootPrivRef:C,rootPubJwkRef:D,privRef:Fe,pubJwkRef:qt,meta:d,setBoundWallet:g,setJkt:R,setRefreshId:K,accessTokenRef:Qr,tokenExpRef:en,authenticated:_,setAuthenticated:X,loadingCount:U,setLoadingCount:te,error:le,setError:ae,allowed:lt,setAllowed:ut,sessionExpiry:ft,setSessionExpiry:qr,sessionData:zr,setSessionData:Xr,authWalletRef:Zr,refreshLock:tn,registerLock:rn,sessionLock:nn,didInitialRefresh:on,didInitialSession:an,prevWalletRef:sn,initResolvedRef:dt,initReady:ue,initResolveRef:zt,rotateLock:pt,waitReady:hn,awaitKeyStable:mn,proofRef:cn,registerCooldownUntilRef:Yr,reqIdRef:Ge,flowLabelRef:Yt,flowExpireRef:Ve,beginFlow:mt,currentReqId:fn,awaitProbe:dn,markProbed:pn,hasProbedRef:Be,getRefreshId:w,setLastPolicyHash:k,setLastPolicyProof:b,setLastHost:J,setRootJkt:M,setRegisteredProofId:h,metaReady:f,probeLock:ln,stateMachine:ht.current,logger:ye.current}};var z=e=>e.accessTokenRef.current??null,ee=e=>{let t=e.privRef.current;if(!t)throw new Error("Sunbreak: private key not initialized");return t},W=e=>{let t=e.pubJwkRef.current;if(!t)throw new Error("Sunbreak: public JWK not initialized");return t};var Xn=(e,t)=>`${e.toUpperCase()} ${t}`;async function Oe(e,t,r,n){if(!t)return e.logger.guard("register",false,"No wallet provided"),false;e.logger.flow("register","Starting register flow",{wallet:t});let o=Oe._nonceCacheRef||(Oe._nonceCacheRef={map:new Map});try{await e.waitReady(),await e.awaitKeyStable(),await e.awaitProbe(),await e.ensureKeypair(),e.setError(null),e.beginFlow("register",2e4);let a;try{if(await e.ensureRootKeypair(),e.rootPrivRef.current&&e.rootPubJwkRef.current){if(!e.meta.rootJkt)try{let y=await $(e.rootPubJwkRef.current);e.setRootJkt?.(y);}catch{}let h=await $(W(e)),f=await e.getRefreshId();a=await he({rootPrivateKey:e.rootPrivRef.current,rootPublicJwk:e.rootPubJwkRef.current,childJkt:h,clientId:e.clientId,sid:f||void 0,ttlSec:300});}}catch(h){e.logger.warn("Failed to create PODE for register",h);}let i=e.currentReqId(),s="/auth/register",u=`${e.baseUrl}${s}`,l=new URL(e.baseUrl).origin,c="POST",p=`${l}${s}`,d=Xn(c,p),g=o.map.get(d),R=await V({method:c,url:p,nonce:g,privateKey:ee(e),publicJwk:W(e)}),K=async h=>e.fetchImpl(u,{method:c,headers:{"content-type":"application/json","x-sunbreak-meta":G(e,{reqId:i,pode:a||void 0}),...h},credentials:"include",body:JSON.stringify({wallet:t,proof:r})}),w=await K({DPoP:R}),k=h=>{let f=h.headers.get("dpop-nonce");f&&o.map.set(d,f);};if(w.status===401){e.logger.info("Register got 401, retrying with nonce");let h=w.headers.get("www-authenticate"),y=(h&&h.match(/dpop-nonce="([^"]+)"/i))?.[1];if(y){o.map.set(d,y);let C=await V({method:c,url:p,nonce:y,privateKey:ee(e),publicJwk:W(e)});w=await K({DPoP:C});}}if(k(w),e.logger.api(c,s,{status:w.status}),!w.ok){let h=await Le(w);if((w.headers.get("content-type")||"").includes("application/json")){let y;try{y=await w.clone().json();}catch{}let C=Me(y&&(y.error||y.message||y.detail)||`HTTP ${w.status}`);throw me(C,h)}else {let y=h.waf?"Blocked by WAF (403)":h.alb403?"Blocked at origin (ALB 403)":`HTTP ${w.status}`;throw me(y,h)}}let b=await w.json();e.logger.info("Register succeeded",{expiresIn:b.expiresIn,hasRefreshId:!!b.refreshId}),e.accessTokenRef.current=b.access,e.authWalletRef.current=ce(t),e.setAuthenticated(!0);try{let h=Math.floor(Date.now()/1e3);e.tokenExpRef.current=h+(b.expiresIn??0);}catch{}e.didInitialRefresh.current=!0,e.setBoundWallet(ce(t)),e.setLastPolicyHash(null),e.setLastPolicyProof(null);try{e.setJkt(await $(W(e)));}catch{}let J=Ke(r);e.setRegisteredProofId(J);try{let h={...e.meta,boundWallet:t,clientId:e.meta.clientId??e.clientId,jkt:e.meta.jkt??null,refreshId:b.refreshId??null,registeredProofId:J};e.setRefreshId(b.refreshId??null);let f=We(e.clientId);await S(f,h);try{localStorage.setItem(f,JSON.stringify(h));}catch(y){e.logger.warn("Failed to persist meta to localStorage",y);}}catch(h){e.logger.warn("Failed to persist session metadata",h);}let M={wallet:t,boundWallet:t,refreshId:b.refreshId??null,hasToken:!0,tokenExpiry:e.tokenExpRef.current,hasProof:!0,authenticated:!0};return e.stateMachine.onRegisterSuccess(M),!0}catch(a){let i=a,s=Number(i?.status||0),u=String(i?.code||"").toLowerCase(),l=String(i?.message||"").toLowerCase(),c=Math.floor(Math.random()*1e3);e.logger.error("Register failed",{status:s,code:u,msg:l}),e.stateMachine.onRegisterFailure(`${u||l||"Unknown error"}`);let p=u==="session_exists"||u==="already_authenticated"||l.includes("already")&&(l.includes("session")||l.includes("authenticated")),d=(s===401||s===403)&&u==="replay";if((p||d)&&n?.refreshFallback&&(!e.meta.boundWallet||A(e.meta.boundWallet,t))){e.logger.info("Register failed with recoverable error, attempting refresh fallback",{code:u,isSessionExists:p,isReplay:d});try{if(await n.refreshFallback())return e.logger.info("Refresh fallback succeeded after register failure"),e.meta.boundWallet||e.setBoundWallet(t),!0}catch(R){e.logger.warn("Refresh fallback failed",R);}}if(d){if(e.providerAdapter)try{let g=await e.providerAdapter.getToken()??null;if(g)return await e.awaitKeyStable(),await e.ensureKeypair(),await e.rotate(),e.proofRef.current=await Ce(e.providerAdapter,g),e.registerCooldownUntilRef.current=Date.now()+5e3+c,!1}catch{}else return e.proofRef.current=null,e.setError("Proof replayed; please sign a fresh proof."),e.registerCooldownUntilRef.current=Date.now()+1e4+c,false;return e.registerCooldownUntilRef.current=Date.now()+8e3+c,false}if(p)return e.setError("Session already exists. Try refreshing the page."),e.registerCooldownUntilRef.current=Date.now()+3e3+c,false;if(s===403&&(i?.waf||i?.alb403))return e.setError(l||"Forbidden at edge/origin"),e.registerCooldownUntilRef.current=Date.now()+3e4+c,false;if(s===403)return e.setError(u||l||"Forbidden"),e.registerCooldownUntilRef.current=Date.now()+15e3+c,false;if(s===429||s===503){e.setError(u||l||"Rate limited / unavailable");let g=s===429?5e3:8e3;return e.registerCooldownUntilRef.current=Date.now()+g+c,false}return e.setError(u||l||"Register failed"),e.registerCooldownUntilRef.current=Date.now()+5e3+c,false}}var Yn=(e,t)=>`${e.toUpperCase()} ${t}`;function je(e){if(e.refreshLock.current)return e.logger.guard("refreshLock",false,"Refresh already in progress"),e.refreshLock.current;if(e.registerLock.current){e.logger.guard("registerLock",false,"Registration in progress, waiting");let t=e.registerLock.current.then(()=>{if(e.authenticated&&z(e))return  true;if(z(e)){let n=e.tokenExpRef.current,o=Math.floor(Date.now()/1e3);if(!!n&&n-o>5)return  true}return  false});return e.refreshLock.current=t.finally(()=>{e.refreshLock.current=null;}),e.refreshLock.current}return e.logger.flow("refresh","Starting refresh flow"),e.refreshLock.current=(async()=>{try{await e.waitReady(),await e.awaitKeyStable(),await e.awaitProbe();let t=e.meta.boundWallet||e.wallet;if(!t)return e.logger.warn("No wallet available for refresh (neither boundWallet nor current wallet)"),!1;if(e.wallet&&e.meta.boundWallet&&!A(e.wallet,e.meta.boundWallet))return e.logger.warn("Wallet mismatch during refresh",{current:e.wallet,bound:e.meta.boundWallet}),e.accessTokenRef.current=null,e.setAuthenticated(!1),!1;let r=z(e);if(r){let f=e.tokenExpRef.current,y=Math.floor(Date.now()/1e3);if(!!r&&!!f&&f-y>5)return e.logger.info("Token still valid, skipping refresh"),!0}e.beginFlow("refresh",15e3);let n=e.currentReqId();await e.ensureKeypair();let o;try{if(await e.ensureRootKeypair(),e.rootPrivRef.current&&e.rootPubJwkRef.current){if(!e.meta.rootJkt)try{let C=await $(e.rootPubJwkRef.current);e.setRootJkt?.(C);}catch{}let f=await $(W(e)),y=await e.getRefreshId();o=await he({rootPrivateKey:e.rootPrivRef.current,rootPublicJwk:e.rootPubJwkRef.current,childJkt:f,clientId:e.clientId,sid:y||void 0,ttlSec:300});}}catch(f){e.logger.warn("Failed to create PODE for refresh",f);}let a="/auth/refresh",i=`${e.baseUrl}${a}`,s=new URL(e.baseUrl).origin,u="POST",l=`${s}${a}`,c=Yn(u,l),p=je._nonceCacheRef||(je._nonceCacheRef={map:new Map}),d=async f=>await V({method:u,url:l,nonce:f,privateKey:ee(e),publicJwk:W(e)}),g=await e.getRefreshId(),R={"x-sunbreak-meta":G(e,{reqId:n,refreshId:g||void 0,pode:o||void 0,wallet:t}),"content-type":"application/json"},K=async f=>e.fetchImpl(i,{method:u,headers:{DPoP:f,...R},credentials:"include",body:"{}"}),w=f=>{let y=f.headers.get("dpop-nonce");y&&p.map.set(c,y);},k=await K(await d(p.map.get(c)));if(k.status===401){e.logger.info("Refresh got 401, retrying with nonce");let f=k.headers.get("www-authenticate"),C=(f&&f.match(/dpop-nonce="([^"]+)"/i))?.[1];C&&(p.map.set(c,C),k=await K(await d(C)));}if(w(k),e.logger.api(u,a,{status:k.status}),!k.ok){try{if((k.headers.get("content-type")||"").includes("application/json")){let y=await k.clone().json().catch(()=>{}),C=y&&(y.error||y.code||y.message)||"",D=String(C).toLowerCase();if(D.includes("missing")&&D.includes("refresh")){e.logger.warn("Refresh session expired (missing refresh identifier)"),e.stateMachine.onRefreshExpired();try{e.setRefreshId?.(null);}catch{}e.accessTokenRef.current=null,e.setAuthenticated(!1);}else e.logger.warn("Refresh failed",{error:C}),e.stateMachine.onRefreshFailure(String(C));}}catch{}return !1}let b=await k.json();e.logger.info("Refresh succeeded",{expiresIn:b.expiresIn,hasRefreshId:!!b.refreshId}),e.accessTokenRef.current=b.access,e.setAuthenticated(!0);let J=(e.wallet&&(!e.meta.boundWallet||e.meta.boundWallet===e.wallet)?e.wallet:e.meta.boundWallet)||null;e.authWalletRef.current=J?ce(J):null;try{let f=Math.floor(Date.now()/1e3);e.tokenExpRef.current=f+(b.expiresIn??0);}catch{}try{e.setJkt(await $(W(e)));}catch{}b.refreshId&&e.setRefreshId(b.refreshId);let M=f=>!f||f==="null"||f==="undefined"?null:f,h={wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:M(b.refreshId??e.meta.refreshId??null),hasToken:!0,tokenExpiry:e.tokenExpRef.current,hasProof:!!e.proofRef.current,authenticated:!0};return e.stateMachine.onRefreshSuccess(h),!0}finally{e.refreshLock.current=null;}})(),e.refreshLock.current}var Zn=(e,t)=>`${e.toUpperCase()} ${t}`,Mt=new Map,Ne;try{let e=globalThis;Ne=e.__sunbreak_page_probe_guard??(e.__sunbreak_page_probe_guard=new Set);}catch{Ne=new Set;}var Qn=e=>{try{let t=new URL(e.baseUrl).origin;return `${e.clientId}::${t}`}catch{return `${e.clientId}::${e.baseUrl}`}};async function Or(e){let t=Qn(e);if(e.probeLock.current){e.logger.guard("probeLock",false,"Probe already in progress, waiting"),await e.probeLock.current,e.markProbed();return}if(e.hasProbedRef.current){e.logger.guard("hasProbedRef",false,"Already probed in this session"),e.markProbed();return}if(Ne.has(t)){e.logger.guard("pageProbeGuard",false,"Already probed for this page load"),e.markProbed();return}Ne.add(t),e.logger.flow("probe","Starting probe flow",{clientId:e.clientId,pageKey:t});let r=(async()=>{let n=new URL(e.baseUrl).origin;try{if(await e.awaitKeyStable(),await e.ensureKeypair(),!e.rootPrivRef.current)try{await e.ensureRootKeypair();}catch{}let o;if(e.rootPrivRef.current&&e.rootPubJwkRef.current)try{let w=await $(W(e));o=await he({rootPrivateKey:e.rootPrivRef.current,rootPublicJwk:e.rootPubJwkRef.current,childJkt:w,clientId:e.clientId,ttlSec:300});}catch(w){e.logger.warn("Failed to create PODE for probe",w);}let a="POST",i="/auth/probe",s=`${e.baseUrl}${i}`,u=`${n}${i}`,l=Zn(a,u),c=async w=>V({method:a,url:u,nonce:w,privateKey:ee(e),publicJwk:W(e)}),p=async w=>e.fetchImpl(s,{method:a,headers:{DPoP:w,"x-sunbreak-meta":G(e,{pode:o}),"content-type":"application/json"},credentials:"include",body:"{}"}),d=w=>{let k=w.headers.get("dpop-nonce");k&&Mt.set(l,k);},g=await p(await c(Mt.get(l)));if(d(g),g.status===401){e.logger.info("Probe got 401, retrying with nonce from www-authenticate");let w=g.headers.get("www-authenticate"),b=(w&&w.match(/dpop-nonce="([^"]+)"/i))?.[1];b&&(Mt.set(l,b),g=await p(await c(b)),d(g));}e.logger.api(a,i,{status:g.status});let R=w=>!w||w==="null"||w==="undefined"?null:w,K={wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:R(e.meta.refreshId),hasToken:!!e.accessTokenRef.current,tokenExpiry:e.tokenExpRef.current||null,hasProof:!!e.proofRef.current,authenticated:e.authenticated};e.stateMachine.onProbeComplete(K);}catch(o){e.logger.error("Probe failed",o);try{Ne.delete(t);}catch{}}finally{e.markProbed(),e.logger.flow("probe","Probe flow completed");}})();e.probeLock.current=r;try{await r;}finally{e.probeLock.current=null;}}var jr=e=>{let t=react.useCallback(()=>je(e),[e]),r=react.useCallback(async()=>{let o=Date.now(),a=e.registerCooldownUntilRef.current??0;if(o<a){e.logger.guard("registerCooldown",false,"Cooldown active");return}if(!e.wallet){e.logger.guard("attemptRegister",false,"No wallet");return}if(!e.initResolvedRef.current){e.logger.guard("attemptRegister",false,"Not initialized");return}if(e.refreshLock.current){e.logger.guard("attemptRegister",false,"Refresh in progress");return}if(e.registerLock.current){e.logger.guard("attemptRegister",false,"Register already in progress");return}let i=c=>!c||c==="null"||c==="undefined"?null:c,s={wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:i(e.meta.refreshId),hasToken:!!z(e),tokenExpiry:e.tokenExpRef.current||null,hasProof:!!e.proofRef.current,authenticated:e.authenticated};if(!e.stateMachine.shouldAttemptRegister(s)){e.logger.guard("attemptRegister",false,`State machine blocked (state: ${e.stateMachine.getState()}, inActiveSession: ${e.stateMachine.isInActiveSession()})`);return}let u=e.proofRef.current;if(!u){e.logger.guard("attemptRegister",false,"No proof available");return}e.logger.guard("attemptRegister",true,"All guards passed, proceeding");let l=(async()=>{try{await e.awaitKeyStable(),await Oe(e,e.wallet,u,{refreshFallback:async()=>{e.logger.info("Attempting refresh as fallback after register failure");let c=!!e.meta.boundWallet;!c&&e.wallet&&e.setBoundWallet(e.wallet);try{return await je(e)}catch{return c||e.setBoundWallet(null),!1}}});}catch(c){let p=c;e.setError(p?.message||String(c)||"Register failed");}finally{e.registerLock.current=null;}})();e.registerLock.current=l;},[e]),n=react.useCallback(async o=>{let a=()=>(e.registerCooldownUntilRef.current??0)>Date.now();if(!e.providerAdapter||a())return;let i=await Ce(e.providerAdapter,o);e.proofRef.current=i;},[e]);return {refresh:t,register:(o,a,i)=>Oe(e,o,a,i),attemptRegister:r,setProofFromAdapterToken:n}};var eo=(e,t)=>`${e.toUpperCase()} ${t}`;async function st(e,t,r,n,o,a={}){e.setLoadingCount(l=>l+1),e.setError(null);let i=n.startsWith("/api/session"),s=new AbortController,u=setTimeout(()=>s.abort(),e.timeoutMs);try{await e.waitReady(),await e.awaitKeyStable(),await e.awaitProbe(),await e.ensureKeypair();let c=`${i?bt(e):e.baseUrl}${n.startsWith("/")?"":"/"}${n}`,d=`${new URL(e.baseUrl).origin}${n.startsWith("/")?"":"/"}${n}`,g=eo(r,d),R=n.startsWith("/auth/"),K=!1,w=!1,k=e.currentReqId(),b=st._nonceCacheRef||(st._nonceCacheRef={map:new Map}),J=_=>{let X=_.headers.get("dpop-nonce");X&&b.map.set(g,X);},M=!!e.wallet&&!!e.authWalletRef.current&&!A(e.wallet,e.authWalletRef.current),h=()=>R||!e.wallet?!1:!!(e.authenticated||A(e.wallet,e.meta.boundWallet)||typeof e.meta.refreshId=="string"&&e.meta.refreshId),f,y,C=async()=>{if(R||M)return;try{let le=z(e),ae=e.tokenExpRef.current,lt=Math.floor(Date.now()/1e3),ut=!!ae&&ae-lt<=60;if(le){if(ut&&!await t().catch(()=>!1))return}else if(!h()||!await t().catch(()=>!1))return}catch{}let _=z(e);if(!_)return;let X=await nt(_),U=b.map.get(g),te=await V({method:r,url:d,nonce:U,ath:X,privateKey:ee(e),publicJwk:W(e)});f=`Bearer ${e.accessTokenRef.current}`,y=te;};await C();let D={"content-type":"application/json","x-sunbreak-auth":f||"","x-sunbreak-meta":G(e,{reqId:k,auth:f,ifPolicyHash:e.meta.lastPolicyHash||void 0,ifPolicyProof:e.meta.lastPolicyProof||void 0}),...St(a.headers)};y&&(D.DPoP=y);let xe=async()=>e.fetchImpl(c,{...a,method:r,headers:D,body:o!==void 0?JSON.stringify(o):void 0,credentials:"include",signal:s.signal}),x=await xe(),Ue=x.headers.get("x-sunbreak-policy-hash"),Fe=x.headers.get("x-sunbreak-policy-proof");if(Ue&&e.setLastPolicyHash(Ue),Fe&&e.setLastPolicyProof(Fe),J(x),x.status===401&&!R){let _=z(e),X=x.headers.get("www-authenticate"),te=(X&&X.match(/dpop-nonce="([^"]+)"/i))?.[1];if(!M&&te&&_&&!w){w=!0,b.map.set(g,te);let le=await nt(_),ae=await V({method:r,url:d,nonce:te,ath:le,privateKey:ee(e),publicJwk:W(e)});f=`Bearer ${e.accessTokenRef.current}`,y=ae,D["x-sunbreak-meta"]=G(e,{reqId:k,auth:f}),D.DPoP=y,x=await xe(),J(x);}if(x.status===401&&!K&&(K=!0,!M&&h())){let le=await t(),ae=z(e);le&&ae&&!M&&(await C(),D["x-sunbreak-meta"]=G(e,{reqId:k,auth:f}),y&&(D.DPoP=y),x=await xe(),J(x));}if(x.status===401)throw new Error("Unauthorized")}if(!x.ok){let _=await Le(x);if((x.headers.get("content-type")||"").includes("application/json")){let U=await x.json().catch(()=>{}),te=Me(U&&(U.error||U.message||U.detail)||`HTTP ${x.status}`);throw me(te,_)}else {let U=_.waf?"Blocked by WAF (403)":_.alb403?"Blocked at origin (ALB 403)":`HTTP ${x.status}`;throw me(U,_)}}return (x.headers.get("content-type")||"").includes("application/json")?await x.json():void 0}finally{clearTimeout(u),e.setLoadingCount(l=>Math.max(0,l-1));}}var Nr=(e,t)=>react.useCallback(async(r,n,o,a={})=>st(e,t,r,n,o,a),[e,t]);async function Ur(e,t){let r=await t("GET","/api/session");if(r){e.setAllowed(!!r.allowed),e.setSessionData(r),e.setSessionExpiry(r.expiry??null);let n=r?.wallet;typeof n=="string"&&n&&e.setBoundWallet(ce(n));}return r}var Fr=(e,t)=>({session:react.useCallback(async()=>{if(e.wallet&&!(e.meta.boundWallet&&!A(e.wallet,e.meta.boundWallet)))return e.sessionLock.current||(e.sessionLock.current=(async()=>{try{return await Ur(e,t)}catch(n){throw e.logger.error("Session request failed",n),n}finally{e.sessionLock.current=null;}})()),e.sessionLock.current},[e,t])});var ct=e=>(e.registerCooldownUntilRef.current??0)>Date.now(),Br=e=>{if(!e)return null;let t=e.indexOf(":");return t>0?e.slice(0,t):null},no=e=>!e||e==="null"||e==="undefined"?null:e,N=e=>({wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:no(e.meta.refreshId),hasToken:!!e.accessTokenRef.current,tokenExpiry:e.tokenExpRef.current||null,hasProof:!!e.proofRef.current,authenticated:e.authenticated});var Ht=e=>{react.useEffect(()=>{if(!e.metaReady)return;let t=true;return (async()=>{try{if(await e.waitReady(),!t||(await e.awaitKeyStable(),!t)||(await e.ensureRootKeypair(),!t))return;let r=N(e);e.stateMachine.initialize(r),await Or(e);}catch(r){if(!t)return;e.logger.error("Probe initialization failed",r);}})(),()=>{t=false;}},[e.metaReady]);};var $t=e=>{react.useEffect(()=>{let t=e.prevWalletRef.current;if(e.prevWalletRef.current=e.wallet,e.wallet!==t&&e.hasProbedRef.current&&!e.refreshLock.current&&(e.didInitialRefresh.current=false),!e.wallet){e.logger.flow("wallet","Wallet disconnected"),e.stateMachine.onWalletDisconnect(),e.setAllowed(null),e.setSessionExpiry(null),e.setSessionData(null),e.setAuthenticated(false),e.accessTokenRef.current=null,e.proofRef.current=null,e.setError(null),e.didInitialSession.current=false,e.authWalletRef.current=null,e.setLastPolicyHash(null),e.setLastPolicyProof(null),e.hasProbedRef.current&&!e.refreshLock.current&&(e.didInitialRefresh.current=false);return}if(t&&e.wallet&&t!==e.wallet){e.logger.flow("wallet",`Wallet changed: ${t} \u2192 ${e.wallet}`);let r=N(e);e.stateMachine.onWalletChange(t,e.wallet,r),e.proofRef.current=null,e.accessTokenRef.current=null,e.setAuthenticated(false),e.didInitialSession.current=false,e.authWalletRef.current=null,e.setLastPolicyHash(null),e.setLastPolicyProof(null),e.rotateLock.current=(async()=>{await e.rotate();})().catch(()=>{}).finally(()=>{e.rotateLock.current=null;});}if(!t&&e.wallet){if(e.logger.flow("wallet",`Wallet connected: ${e.wallet}`),e.didInitialSession.current=false,!e.metaReady){e.logger.info("Wallet connected but meta not ready, deferring state machine update");return}let r=N(e);e.stateMachine.onWalletChange(null,e.wallet,r);}},[e.wallet,e.metaReady]);};var Ot=(e,t)=>{let{attemptRegister:r,setProofFromAdapterToken:n}=t;react.useEffect(()=>{if(!e.providerAdapter||ct(e)||!e.metaReady||!e.wallet)return;let o=N(e);if(e.stateMachine.isInActiveSession()){e.logger.decision("Provider adapter should trigger register?",false,`Already in active session (state: ${e.stateMachine.getState()})`);return}if(e.stateMachine.shouldWaitForInitialRefresh(e.didInitialRefresh.current,o)){e.logger.decision("Provider adapter should wait for initial refresh?",true,"Returning user - refresh first");return}e.logger.decision("Provider adapter should trigger register?",true,`Fetching token (state: ${e.stateMachine.getState()})`);let a=false;return (async()=>{try{let i=e.providerAdapter.getToken(),s=new Promise((l,c)=>setTimeout(()=>c(new Error("Provider adapter timeout (30s)")),3e4)),u=await Promise.race([i,s]).catch(l=>(e.logger.warn("Provider adapter getToken failed",l),null))??null;if(await e.awaitKeyStable(),a||!u)return;try{let l=u.split(".");if(l[1]){let c=JSON.parse(atob(l[1]));e.logger.info("Provider adapter: got token",{wallet:e.wallet,jwtSub:c.sub,jwtWallet:c.wallet||c.linked_accounts?.[0]?.address,jwtExp:c.exp,jwtIat:c.iat});}}catch{e.logger.info("Provider adapter: got token (could not decode)");}await n(u),await r();}catch(i){e.logger.error("Provider adapter flow failed",i);}})(),()=>{a=true;}},[e.providerAdapter,e.wallet,e.meta.boundWallet,e.metaReady,e.registerCooldownUntilRef,e.didInitialRefresh,...e.refreshDeps]);};var jt=(e,t)=>{let{proofProp:r,attemptRegister:n}=t;react.useEffect(()=>{if(typeof r<"u"&&(e.proofRef.current=r??null,r&&e.logger.info("Proof prop updated",{hasProof:!!r})),!e.metaReady)return;let o=N(e),a=!!e.wallet,i=!!e.proofRef.current,s=false,u=e.proofRef.current?.method,l=u==="siwe"||u==="eip191";if(i&&e.stateMachine.isInActiveSession())if(l){let p=Ke(e.proofRef.current),d=e.meta.registeredProofId;if(p&&d){let g=Br(d),R=g==="siwe"||g==="eip191";if(R&&p!==d)e.logger.info("Proof prop: SIWE/EIP191 credentials changed, allowing re-registration",{old:d,new:p}),e.stateMachine.onNewCredentialsReceived(),e.accessTokenRef.current=null,e.setAuthenticated(false),e.didInitialSession.current=false,s=true;else if(R){e.logger.decision("Proof prop should trigger register?",false,"Already authenticated with same SIWE/EIP191 credentials");return}else e.logger.info("Proof prop: switching from provider JWT to SIWE/EIP191, allowing re-registration",{old:d,new:p}),e.stateMachine.onNewCredentialsReceived(),e.accessTokenRef.current=null,e.setAuthenticated(false),e.didInitialSession.current=false,s=true;}}else {e.logger.decision("Proof prop should trigger register?",false,`Already in active session, no credential change detection for ${u}`);return}let c=s?N(e):o;if(!e.stateMachine.shouldAttemptRegister(c)){e.logger.decision("Proof prop should trigger register?",false,`State machine says no (state: ${e.stateMachine.getState()}, inActiveSession: ${e.stateMachine.isInActiveSession()})`);return}if(e.stateMachine.shouldWaitForInitialRefresh(e.didInitialRefresh.current,c)){e.logger.decision("Proof prop should wait for initial refresh?",true,"Returning user - refresh first");return}a&&i&&e.initResolvedRef.current&&!ct(e)&&(e.logger.info("Proof prop conditions met, attempting register"),n());},[r,e.wallet,e.authenticated,e.meta.boundWallet,e.meta.registeredProofId,e.metaReady,e.providerAdapter,e.initResolvedRef,e.didInitialRefresh,n]);};var Nt=(e,t)=>{let{refresh:r,session:n}=t;react.useEffect(()=>{if(!e.metaReady||e.didInitialRefresh.current)return;e.didInitialRefresh.current=true;let o=true;return (async()=>{try{await e.waitReady(),await e.awaitProbe();let a=N(e);if(e.accessTokenRef.current||e.authenticated){e.logger.info("Already authenticated, skipping initial refresh"),e.wallet&&!e.didInitialSession.current&&(e.didInitialSession.current=!0,await n());return}if(!e.stateMachine.shouldAttemptRefresh(a)){e.logger.decision("Should attempt initial refresh?",!1,`State: ${e.stateMachine.getState()}`);return}e.logger.decision("Should attempt initial refresh?",!0,`State: ${e.stateMachine.getState()}`);let s=await r();if(!o)return;e.setAuthenticated(s),s&&e.wallet&&!e.didInitialSession.current&&(e.didInitialSession.current=!0,await n());}catch(a){if(!o)return;let i=a;e.setAuthenticated(false),e.setError(i?.message||String(a)||"Unknown error");}})(),()=>{o=false;}},[e.wallet,e.meta.boundWallet,e.meta.refreshId,e.metaReady,e.didInitialRefresh,r,n]);};var Ut=e=>{react.useEffect(()=>{e.initResolvedRef.current||(async()=>{if(await e.ensureKeypair(),!e.wallet){e.initResolvedRef.current=true,e.initResolveRef.current?.();return}e.meta.boundWallet&&!A(e.meta.boundWallet,e.wallet)&&(e.rotateLock.current=(async()=>{e.accessTokenRef.current=null,e.setAuthenticated(false);})().catch(()=>{}).finally(()=>{e.rotateLock.current=null;}),e.rotateLock.current&&await e.rotateLock.current),e.initResolvedRef.current=true,e.initResolveRef.current?.();})();},[e]);};var Ft=(e,t)=>{let{session:r}=t;react.useEffect(()=>{(async()=>{if(e.authenticated&&e.wallet&&e.accessTokenRef.current&&!(e.meta.boundWallet&&!A(e.wallet,e.meta.boundWallet))&&!e.didInitialSession.current){e.didInitialSession.current=true;try{e.logger.flow("session","Calling session after authentication"),await r();}catch(n){let o=n;e.setError(o?.message||String(n));}}})();},[e.authenticated,e.wallet,e.meta.boundWallet,r]);};var Bt=e=>{react.useEffect(()=>{e.wallet&&e.authWalletRef.current&&!A(e.wallet,e.authWalletRef.current)&&(e.logger.warn("Wallet mismatch detected, clearing auth",{current:e.wallet,authWallet:e.authWalletRef.current}),e.accessTokenRef.current=null,e.setAuthenticated(false));},[e.wallet,e.authWalletRef.current]);};var Gt=(e,t)=>{let{refresh:r,session:n}=t;react.useEffect(()=>{let i=()=>{let l=Math.floor(Date.now()/1e3),c=e.tokenExpRef.current,p=e.sessionExpiry,d=!!c&&c-l<=30&&c-l>0,g=!!p&&p-l<=3600&&p-l>0;return {tokenSoon:d,sessionSoon:g}},s=async()=>{try{if(!e.authenticated||!e.wallet||e.meta.boundWallet&&!A(e.wallet,e.meta.boundWallet))return;let{tokenSoon:l,sessionSoon:c}=i();(l||c)&&(e.logger.info("Refreshing on focus",{tokenSoon:l,sessionSoon:c}),await r()&&c&&await n());}catch{}},u=async()=>{document.visibilityState==="visible"&&await s();};return window.addEventListener("focus",s),document.addEventListener("visibilitychange",u),()=>{window.removeEventListener("focus",s),document.removeEventListener("visibilitychange",u);}},[e,e.sessionExpiry,r,n]);};var Gr=(e,t)=>{let{refresh:r,session:n,attemptRegister:o,setProofFromAdapterToken:a,proofProp:i}=t;Ht(e),$t(e),Ot(e,{attemptRegister:o,setProofFromAdapterToken:a}),jt(e,{proofProp:i,attemptRegister:o}),Nt(e,{refresh:r,session:n}),Ut(e),Ft(e,{session:n}),Bt(e),Gt(e,{refresh:r,session:n});};var Vr=react.createContext(void 0),yo=e=>{let t=$r(e),{refresh:r,attemptRegister:n,setProofFromAdapterToken:o}=jr(t),a=Nr(t,r),{session:i}=Fr(t,a);Gr(t,{refresh:r,session:i,attemptRegister:n,setProofFromAdapterToken:o,proofProp:e.proof});let s=react.useMemo(()=>({get:(u,l)=>a("GET",u,void 0,l),post:(u,l,c)=>a("POST",u,l,c),session:i,refresh:r,authenticated:t.authenticated,loading:t.loadingCount>0,error:t.error,allowed:t.allowed,sessionExpiry:t.sessionExpiry,sessionData:t.sessionData,wallet:t.wallet}),[a,i,r,t.authenticated,t.loadingCount,t.error,t.allowed,t.sessionExpiry,t.sessionData,t.wallet]);return jsxRuntime.jsx(Vr.Provider,{value:s,children:e.children})},go=e=>jsxRuntime.jsx(Ct,{clientId:e.clientId,children:jsxRuntime.jsx(yo,{...e})}),bo=()=>{let e=react.useContext(Vr);if(!e)throw new Error("useSunbreak must be used within a SunbreakProvider");return e};
 
-exports.SunbreakProvider = Vn;
-exports.useSunbreak = qn;
+exports.SunbreakProvider = go;
+exports.useSunbreak = bo;

package/dist/index.d.cts

@@ -20,7 +20,7 @@ type ProviderJwtProof = {
     method: "provider_jwt";
     issuer: "custom";
     token: string;
-    meta: any;
+    meta: Record<string, unknown>;
 };
 type SiweProof = {
     method: "siwe";
@@ -50,7 +50,7 @@ type ProviderAdapter = {
 } | {
     name: "custom";
     getToken: () => Promise<string | null | undefined>;
-    meta: any;
+    meta: Record<string, unknown>;
 };
 interface SessionResp {
     allowed: boolean;

package/dist/index.d.ts

@@ -20,7 +20,7 @@ type ProviderJwtProof = {
     method: "provider_jwt";
     issuer: "custom";
     token: string;
-    meta: any;
+    meta: Record<string, unknown>;
 };
 type SiweProof = {
     method: "siwe";
@@ -50,7 +50,7 @@ type ProviderAdapter = {
 } | {
     name: "custom";
     getToken: () => Promise<string | null | undefined>;
-    meta: any;
+    meta: Record<string, unknown>;
 };
 interface SessionResp {
     allowed: boolean;