@tdfc/sunbreak-react 0.2.0 → 0.2.2

package/dist/index.cjs

@@ -1,2 +1,26 @@
-'use strict';var A=require('react'),sunbreakCore=require('@tdfc/sunbreak-core'),jsxRuntime=require('react/jsx-runtime');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var A__default=/*#__PURE__*/_interopDefault(A);var C;try{let e=globalThis;C=e.__sunbreak_page_refresh_guard??(e.__sunbreak_page_refresh_guard=new Map);}catch{C=new Map;}function $(e,r){try{let t=new URL(r).origin;return `${e}::${t}`}catch{return `${e}::${r}`}}function z(e,r,t,a=[],n={current:false}){let i=A.useRef(null);A.useEffect(()=>{if(!e||!r||!t)return;let o=`${r}:${t.name}`;if(i.current===o||e.registerCooldownActive()||e.isInActiveSession())return;let u=false;return (async()=>{try{if(await e.awaitProbeReady(),u||e.isInActiveSession()||e.shouldWaitForInitialRefresh(n.current))return;let c=t.getToken(),f=new Promise((b,k)=>setTimeout(()=>k(new Error("Provider timeout (30s)")),3e4)),g=await Promise.race([c,f]).catch(()=>null);if(await e.awaitKeyStable(),u||!g)return;let l=await sunbreakCore.makeProviderProofFromAdapter(t,g);await e.register(r,l)&&!u&&(i.current=o);}catch(c){!u&&e&&e.setError(c instanceof Error?c:new Error(String(c))),e.logger.error("Provider adapter auth failed",c);}})(),()=>{u=true;}},[e,r,t,JSON.stringify(a)]);}function J(e,r,t,a={current:false}){let n=A.useRef(null);A.useEffect(()=>{if(!e||!r||!t)return;let i=sunbreakCore.computeProofFingerprint(t);if(n.current===i)return;let o=e.getRegisteredProofId();if(e.authenticated&&o&&i!==o&&(t.method==="siwe"||t.method==="eip191")&&(e.logger.info("Detected credential change (SIWE/EIP-191 signature changed), clearing session"),e.handleProofChange(t)),e.isInActiveSession()||e.registerCooldownActive()||e.shouldWaitForInitialRefresh(a.current))return;let s=false;return (async()=>{try{if(await e.awaitProbeReady(),s)return;await e.register(r,t)&&!s&&(n.current=i);}catch(f){!s&&e&&e.setError(f instanceof Error?f:new Error(String(f))),e.logger.error("Manual proof auth failed",f);}})(),()=>{s=true;}},[e,r,t,e?.authenticated]);}function V(e,r,t,a,n={current:false},i={current:false}){let o=A.useRef(false),u=A.useRef(r);A.useEffect(()=>{let s=u.current;u.current=r,s!==r&&e&&e.probeCompleted!==false&&!e?.isRefreshInProgress()&&(o.current=false,i.current=false,n.current=false,C.delete($(t,a)));},[e,r,t,a,n]),A.useEffect(()=>{if(!e||o.current)return;o.current=true;let s=false;return (async()=>{try{if(await e.awaitProbeReady(),s||(n.current=!0,!e.shouldAttemptRefresh()))return;let f=$(t,a),g=C.get(f);if(g){let b=await g;if(s)return;b&&!i.current&&(i.current=!0,await e.session());return}let l=e.refresh();C.set(f,l);let d;try{d=await l;}catch(b){throw C.delete(f),b}if(s)return;d&&!i.current&&(i.current=!0,await e.session());}catch(f){!s&&e&&e.setError(f instanceof Error?f:new Error(String(f))),e.logger.warn("Initial refresh failed",f);}})(),()=>{s=true;}},[e,r,t,a]);}function X(e,r,t={current:false}){let a=A.useRef(false);A.useEffect(()=>{if(!e)return;let n=e.authenticated,i=a.current;if(a.current=n,!i&&n&&!t.current){if(!r||!e.getAccessToken())return;let o=e.getBoundWallet();if(o&&!sunbreakCore.walletsMatch(r,o))return;t.current=true;let u=false;return e.session().then(()=>{u||e.logger.info("Session data loaded after authentication");}).catch(s=>{u||(e&&e.setError(s instanceof Error?s:new Error(String(s))),e.logger.warn("Failed to load session after auth",s));}),()=>{u=true;}}n||(t.current=false);},[e,e?.authenticated,r]);}function H(e,r){let t=A.useRef(void 0);A.useEffect(()=>{if(!e)return;let a=t.current;t.current=r;let n=false;return (async()=>{try{if(a===void 0){r&&await e.notifyWalletChange(null,r);return}if(n)return;if(a&&r&&!sunbreakCore.walletsMatch(a,r)){await e.walletSwitch(a,r);return}if(a&&!r){if(await e.disconnect(),n)return;e.notifyWalletDisconnect();return}if(!a&&r){await e.notifyWalletChange(null,r);return}if(e.authenticated&&r){let o=e.getBoundWallet();if(o&&!sunbreakCore.walletsMatch(r,o)){if(e.logger.warn("Wallet mismatch detected, clearing auth",{current:r?.slice(0,8),bound:o?.slice(0,8)}),await e.disconnect(),n)return;await e.notifyWalletChange(o,r);}}}catch(o){n||e.logger.error("Wallet change failed",o);}})(),()=>{n=true;}},[e,r]);}function Q(e){A.useEffect(()=>{if(!e)return;let r=new AbortController,t=false,a=async()=>{if(!(t||r.signal.aborted))try{t=!0;let i=e.getState();if(!i.authenticated)return;let o=e.getBoundWallet(),u=e.getWallet();if(!u||o&&!sunbreakCore.walletsMatch(u,o))return;let s=Math.floor(Date.now()/1e3),c=30,f=3600,g=e.getTokenExpiry(),l=g?g-s<=c&&g-s>0:!1,d=i.session?.expiry,b=d?d-s<=f&&d-s>0:!1;if(l||b){if(r.signal.aborted)return;let k=await e.refresh();if(r.signal.aborted)return;k&&b&&await e.session();}}catch(i){r.signal.aborted||e.logger.error("Focus refresh failed",i);}finally{t=false;}},n=()=>{document.visibilityState==="visible"&&a();};return window.addEventListener("focus",a),document.addEventListener("visibilitychange",n),()=>{r.abort(),window.removeEventListener("focus",a),document.removeEventListener("visibilitychange",n);}},[e]);}function j(e){let{client:r,clientId:t,baseUrl:a,wallet:n,proof:i,providerAdapter:o,refreshDeps:u=[]}=e,s=A.useRef(false),c=A.useRef(false);z(r,n,o,u,s),J(r,n,i,s),V(r,n,t,a,s,c),X(r,n,c),H(r,n),Q(r);}var q=A.createContext(void 0),oe=({children:e,clientId:r,baseUrl:t,base:a,wallet:n,proof:i,providerAdapter:o,debug:u=false,fetchImpl:s,timeoutMs:c,refreshDeps:f=[]})=>{let g=t||a||"https://api.sunbreak.com",l=A.useRef(null),[d,b]=A.useState(null),[k,I]=A.useState(false),[O,D]=A.useState(0),[F,L]=A.useState(null),[v,N]=A.useState(null);A.useEffect(()=>{l.current&&l.current.updateConfig({wallet:n,providerAdapter:o,debug:u});},[d,n,o,u]),j({client:d,clientId:r,baseUrl:g,wallet:n,proof:i,providerAdapter:o,refreshDeps:f}),A.useEffect(()=>{let p=true;return (async()=>{let{adapter:y}=await sunbreakCore.createStorageAdapter(),h=new sunbreakCore.SunbreakClient({clientId:r,baseUrl:g,wallet:n,providerAdapter:o,debug:u,fetchImpl:s,timeoutMs:c},y);if(!p)return;l.current=h,b(h),h.on("stateChange",()=>{let P=h.getState();I(P.authenticated),D(P.loading),L(P.error),N(P.session);}),u&&h.on("policyChange",P=>{h.logger.info("Policy changed:",P);});let R=h.getState();I(R.authenticated),D(R.loading),L(R.error),N(R.session);try{await h.probe();}catch(P){h.logger.error("Probe initialization failed",P);}})(),()=>{p=false,l.current&&l.current.removeAllListeners();}},[]);let W=A__default.default.useCallback((p,E)=>{let y=l.current;return y?y.get(p,E):Promise.resolve(void 0)},[]),_=A__default.default.useCallback((p,E,y)=>{let h=l.current;return h?h.post(p,E,y):Promise.resolve(void 0)},[]),T=A__default.default.useCallback(()=>{let p=l.current;return p?p.session():Promise.resolve(void 0)},[]),M=A__default.default.useCallback(()=>{let p=l.current;return p?p.refresh():Promise.resolve(false)},[]),B=A.useMemo(()=>d?{get:W,post:_,session:T,refresh:M,authenticated:k,loading:O>0,error:F,errorDetail:d.getState().lastError,allowed:v?.allowed??null,sessionExpiry:v?.expiry??null,sessionData:v,wallet:n}:{get:W,post:_,session:T,refresh:M,authenticated:false,loading:false,error:null,errorDetail:void 0,allowed:null,sessionExpiry:null,sessionData:null,wallet:n},[d,k,O,F,v,n,W,_,T,M]);return jsxRuntime.jsx(q.Provider,{value:B,children:e})},se=()=>{let e=A.useContext(q);if(!e)throw new Error("useSunbreak must be used within a SunbreakProvider");return e};var he="0.2.0";
-Object.defineProperty(exports,"isEvmAddress",{enumerable:true,get:function(){return sunbreakCore.isEvmAddress}});Object.defineProperty(exports,"normalizeWallet",{enumerable:true,get:function(){return sunbreakCore.normalizeWallet}});Object.defineProperty(exports,"walletsMatch",{enumerable:true,get:function(){return sunbreakCore.walletsMatch}});exports.SunbreakProvider=oe;exports.useSunbreak=se;exports.version=he;
+'use strict';
+
+var react = require('react');
+var jsxRuntime = require('react/jsx-runtime');
+
+var bn=Object.defineProperty;var er=e=>{throw TypeError(e)};var Rn=(e,t,r)=>t in e?bn(e,t,{enumerable:true,configurable:true,writable:true,value:r}):e[t]=r;var O=(e,t,r)=>Rn(e,typeof t!="symbol"?t+"":t,r),tr=(e,t,r)=>t.has(e)||er("Cannot "+r);var m=(e,t,r)=>(tr(e,t,"read from private field"),r?r.call(e):t.get(e)),B=(e,t,r)=>t.has(e)?er("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,r),F=(e,t,r,n)=>(tr(e,t,"write to private field"),t.set(e,r),r);var ze=e=>{let t=5381;for(let r=0;r<e.length;r++)t=t*33^e.charCodeAt(r);return (t>>>0).toString(16).padStart(8,"0")},Ce=e=>{try{return e.method==="provider_jwt"?`${e.issuer}:${ze(e.token)}`:e.method==="siwe"||e.method==="eip191"?`${e.method}:${ze(e.signature)}`:e.method==="ed25519"?`ed25519:${ze(e.signatureBase64)}`:null}catch{return null}},ye=async(e,t,r)=>{switch(e.name){case "custom":return {method:"provider_jwt",issuer:"custom",token:t,meta:r||{}};case "privy":return {method:"provider_jwt",issuer:"privy",token:t,meta:{app_id:e.appId}};case "dynamic":return e.expectedAud?{method:"provider_jwt",issuer:"dynamic",token:t,meta:{env_id:e.envId,expected_aud:e.expectedAud}}:{method:"provider_jwt",issuer:"dynamic",token:t,meta:{env_id:e.envId}};default:throw new Error(`Unknown adapter: ${e}`)}};var kn="sunbreak-kv",Ie="kv",Xe="sunbreak_dpop_meta_v1",I="sunbreak_dpop_key_v1",Te="ES256",E="P-256",We=e=>`${Xe}:${e}`,rr=()=>new Promise((e,t)=>{let r=indexedDB.open(kn,1);r.onupgradeneeded=()=>r.result.createObjectStore(Ie),r.onsuccess=()=>e(r.result),r.onerror=()=>t(r.error);}),T=async e=>{try{let t=await rr();return await new Promise((r,n)=>{let i=t.transaction(Ie,"readonly").objectStore(Ie).get(e);i.onsuccess=()=>r(i.result),i.onerror=()=>n(i.error);})}catch{return}},R=async(e,t)=>{let r=await rr();await new Promise((n,a)=>{let o=r.transaction(Ie,"readwrite").objectStore(Ie).put(t,e);o.onsuccess=()=>n(),o.onerror=()=>a(o.error);});};var En=e=>{let t=new URL(e);if(t.protocol!=="https:"&&t.hostname!=="localhost"&&t.hostname!=="127.0.0.1")throw new Error("Sunbreak: insecure base URL");return t.hash="",t.origin},Pn=e=>e.replace(/\/+$/,""),yt=e=>{let t=Pn(e);return En(t)};function bt(e){let t=new URL(e.baseUrl),r=t.host,n=e.meta.lastHost??null,a=vn(n);return e.setLastHost(a),t.host=`${a}.${r}`,t.origin}var vn=e=>{for(let t=0;t<St.length;t++){let r=St[Math.floor(Math.random()*St.length)].toLowerCase();if(r!==e)return r}return "alpha"},St=["Alpha","Bravo","Charlie","Delta","Echo","Foxtrot","Golf","Hotel","India","Juliett","Kilo","Lima","Mike","November","Oscar","Papa","Quebec","Romeo","Sierra","Tango","Uniform","Victor","Whiskey","X-ray","Yankee","Zulu"];var V=(e,t)=>{let r={clientId:e.clientId,wallet:e.wallet,ifPolicyHash:e.meta.lastPolicyHash||void 0,ifPolicyProof:e.meta.lastPolicyProof||void 0,...t};Object.keys(r).forEach(a=>r[a]===void 0&&delete r[a]);let n=JSON.stringify(r);return btoa(n)};var An=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","via"]),xn=new Set(["user-agent","referer","origin","host","content-length","sec-fetch-site","sec-fetch-mode","sec-fetch-dest","sec-fetch-user","sec-ch-ua","sec-ch-ua-mobile","sec-ch-ua-platform","sec-ch-ua-platform-version","sec-ch-ua-full-version","sec-ch-ua-arch","sec-ch-ua-model","sec-ch-ua-bitness","cookie","set-cookie"]),Kn=new Set(["dpop","x-sunbreak-meta"]),Cn=64,nr=2048,In=64;function Rt(e){let t={};if(!e)return t;let r=e instanceof Headers?Array.from(e.entries()):Object.entries(e),n=0;for(let[a,i]of r){if(n>=In)break;if(a==null||i==null)continue;let o=String(a).toLowerCase().trim();if(!o||o.length>Cn||An.has(o)||xn.has(o)||Kn.has(o))continue;let s=String(i);s.length>nr&&(s=s.slice(0,nr)),t[o]=s,n++;}return t}var ne=new TextEncoder,Se=new TextDecoder;function or(...e){let t=e.reduce((a,{length:i})=>a+i,0),r=new Uint8Array(t),n=0;for(let a of e)r.set(a,n),n+=a.length;return r}function ar(e){if(Uint8Array.prototype.toBase64)return e.toBase64();let t=32768,r=[];for(let n=0;n<e.length;n+=t)r.push(String.fromCharCode.apply(null,e.subarray(n,n+t)));return btoa(r.join(""))}function ir(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}function sr(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(typeof e=="string"?e:Se.decode(e),{alphabet:"base64url"});let t=e;t instanceof Uint8Array&&(t=Se.decode(t)),t=t.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"");try{return ir(t)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}}function Ye(e){let t=e;return typeof t=="string"&&(t=ne.encode(t)),Uint8Array.prototype.toBase64?t.toBase64({alphabet:"base64url",omitPadding:true}):ar(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}var fe=class extends Error{constructor(r,n){super(r,n);O(this,"code","ERR_JOSE_GENERIC");this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor);}};O(fe,"code","ERR_JOSE_GENERIC");var L=class extends fe{constructor(){super(...arguments);O(this,"code","ERR_JOSE_NOT_SUPPORTED");}};O(L,"code","ERR_JOSE_NOT_SUPPORTED");var oe=class extends fe{constructor(){super(...arguments);O(this,"code","ERR_JWS_INVALID");}};O(oe,"code","ERR_JWS_INVALID");var _e=class extends fe{constructor(){super(...arguments);O(this,"code","ERR_JWT_INVALID");}};O(_e,"code","ERR_JWT_INVALID");var cr,lr,kt=class extends(lr=fe,cr=Symbol.asyncIterator,lr){constructor(r="multiple matching keys found in the JSON Web Key Set",n){super(r,n);O(this,cr);O(this,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");}};O(kt,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");function Y(e,t="algorithm.name"){return new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`)}function be(e,t){return e.name===t}function Et(e){return parseInt(e.name.slice(4),10)}function _n(e){switch(e){case "ES256":return "P-256";case "ES384":return "P-384";case "ES512":return "P-521";default:throw new Error("unreachable")}}function Jn(e,t){if(!e.usages.includes(t))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function ur(e,t,r){switch(t){case "HS256":case "HS384":case "HS512":{if(!be(e.algorithm,"HMAC"))throw Y("HMAC");let n=parseInt(t.slice(2),10);if(Et(e.algorithm.hash)!==n)throw Y(`SHA-${n}`,"algorithm.hash");break}case "RS256":case "RS384":case "RS512":{if(!be(e.algorithm,"RSASSA-PKCS1-v1_5"))throw Y("RSASSA-PKCS1-v1_5");let n=parseInt(t.slice(2),10);if(Et(e.algorithm.hash)!==n)throw Y(`SHA-${n}`,"algorithm.hash");break}case "PS256":case "PS384":case "PS512":{if(!be(e.algorithm,"RSA-PSS"))throw Y("RSA-PSS");let n=parseInt(t.slice(2),10);if(Et(e.algorithm.hash)!==n)throw Y(`SHA-${n}`,"algorithm.hash");break}case "Ed25519":case "EdDSA":{if(!be(e.algorithm,"Ed25519"))throw Y("Ed25519");break}case "ML-DSA-44":case "ML-DSA-65":case "ML-DSA-87":{if(!be(e.algorithm,t))throw Y(t);break}case "ES256":case "ES384":case "ES512":{if(!be(e.algorithm,"ECDSA"))throw Y("ECDSA");let n=_n(t);if(e.algorithm.namedCurve!==n)throw Y(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}Jn(e,r);}function fr(e,t,...r){if(r=r.filter(Boolean),r.length>2){let n=r.pop();e+=`one of type ${r.join(", ")}, or ${n}.`;}else r.length===2?e+=`one of type ${r[0]} or ${r[1]}.`:e+=`of type ${r[0]}.`;return t==null?e+=` Received ${t}`:typeof t=="function"&&t.name?e+=` Received function ${t.name}`:typeof t=="object"&&t!=null&&t.constructor?.name&&(e+=` Received an instance of ${t.constructor.name}`),e}var dr=(e,...t)=>fr("Key must be ",e,...t);function Pt(e,t,...r){return fr(`Key for the ${e} algorithm must be `,t,...r)}function vt(e){return e?.[Symbol.toStringTag]==="CryptoKey"}function At(e){return e?.[Symbol.toStringTag]==="KeyObject"}var xt=e=>vt(e)||At(e);var pr=(...e)=>{let t=e.filter(Boolean);if(t.length===0||t.length===1)return  true;let r;for(let n of t){let a=Object.keys(n);if(!r||r.size===0){r=new Set(a);continue}for(let i of a){if(r.has(i))return  false;r.add(i);}}return  true};function Dn(e){return typeof e=="object"&&e!==null}var Ze=e=>{if(!Dn(e)||Object.prototype.toString.call(e)!=="[object Object]")return  false;if(Object.getPrototypeOf(e)===null)return  true;let t=e;for(;Object.getPrototypeOf(t)!==null;)t=Object.getPrototypeOf(t);return Object.getPrototypeOf(e)===t};var hr=(e,t)=>{if(e.startsWith("RS")||e.startsWith("PS")){let{modulusLength:r}=t.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}};function Mn(e){let t,r;switch(e.kty){case "AKP":{switch(e.alg){case "ML-DSA-44":case "ML-DSA-65":case "ML-DSA-87":t={name:e.alg},r=e.priv?["sign"]:["verify"];break;default:throw new L('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case "RSA":{switch(e.alg){case "PS256":case "PS384":case "PS512":t={name:"RSA-PSS",hash:`SHA-${e.alg.slice(-3)}`},r=e.d?["sign"]:["verify"];break;case "RS256":case "RS384":case "RS512":t={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${e.alg.slice(-3)}`},r=e.d?["sign"]:["verify"];break;case "RSA-OAEP":case "RSA-OAEP-256":case "RSA-OAEP-384":case "RSA-OAEP-512":t={name:"RSA-OAEP",hash:`SHA-${parseInt(e.alg.slice(-3),10)||1}`},r=e.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new L('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case "EC":{switch(e.alg){case "ES256":t={name:"ECDSA",namedCurve:"P-256"},r=e.d?["sign"]:["verify"];break;case "ES384":t={name:"ECDSA",namedCurve:"P-384"},r=e.d?["sign"]:["verify"];break;case "ES512":t={name:"ECDSA",namedCurve:"P-521"},r=e.d?["sign"]:["verify"];break;case "ECDH-ES":case "ECDH-ES+A128KW":case "ECDH-ES+A192KW":case "ECDH-ES+A256KW":t={name:"ECDH",namedCurve:e.crv},r=e.d?["deriveBits"]:[];break;default:throw new L('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case "OKP":{switch(e.alg){case "Ed25519":case "EdDSA":t={name:"Ed25519"},r=e.d?["sign"]:["verify"];break;case "ECDH-ES":case "ECDH-ES+A128KW":case "ECDH-ES+A192KW":case "ECDH-ES+A256KW":t={name:e.crv},r=e.d?["deriveBits"]:[];break;default:throw new L('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}default:throw new L('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return {algorithm:t,keyUsages:r}}var mr=async e=>{if(!e.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:t,keyUsages:r}=Mn(e),n={...e};return n.kty!=="AKP"&&delete n.alg,delete n.use,crypto.subtle.importKey("jwk",n,t,e.ext??!(e.d||e.priv),e.key_ops??r)};var gr=(e,t,r,n,a)=>{if(a.crit!==void 0&&n?.crit===void 0)throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return new Set;if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(o=>typeof o!="string"||o.length===0))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let i;r!==void 0?i=new Map([...Object.entries(r),...t.entries()]):i=t;for(let o of n.crit){if(!i.has(o))throw new L(`Extension Header Parameter "${o}" is not recognized`);if(a[o]===void 0)throw new e(`Extension Header Parameter "${o}" is missing`);if(i.get(o)&&n[o]===void 0)throw new e(`Extension Header Parameter "${o}" MUST be integrity protected`)}return new Set(n.crit)};function Je(e){return Ze(e)&&typeof e.kty=="string"}function wr(e){return e.kty!=="oct"&&(e.kty==="AKP"&&typeof e.priv=="string"||typeof e.d=="string")}function yr(e){return e.kty!=="oct"&&typeof e.d>"u"&&typeof e.priv>"u"}function Sr(e){return e.kty==="oct"&&typeof e.k=="string"}var Re,br=async(e,t,r,n=false)=>{Re||(Re=new WeakMap);let a=Re.get(e);if(a?.[r])return a[r];let i=await mr({...t,alg:r});return n&&Object.freeze(e),a?a[r]=i:Re.set(e,{[r]:i}),i},Hn=(e,t)=>{Re||(Re=new WeakMap);let r=Re.get(e);if(r?.[t])return r[t];let n=e.type==="public",a=!!n,i;if(e.asymmetricKeyType==="x25519"){switch(t){case "ECDH-ES":case "ECDH-ES+A128KW":case "ECDH-ES+A192KW":case "ECDH-ES+A256KW":break;default:throw new TypeError("given KeyObject instance cannot be used for this algorithm")}i=e.toCryptoKey(e.asymmetricKeyType,a,n?[]:["deriveBits"]);}if(e.asymmetricKeyType==="ed25519"){if(t!=="EdDSA"&&t!=="Ed25519")throw new TypeError("given KeyObject instance cannot be used for this algorithm");i=e.toCryptoKey(e.asymmetricKeyType,a,[n?"verify":"sign"]);}switch(e.asymmetricKeyType){case "ml-dsa-44":case "ml-dsa-65":case "ml-dsa-87":{if(t!==e.asymmetricKeyType.toUpperCase())throw new TypeError("given KeyObject instance cannot be used for this algorithm");i=e.toCryptoKey(e.asymmetricKeyType,a,[n?"verify":"sign"]);}}if(e.asymmetricKeyType==="rsa"){let o;switch(t){case "RSA-OAEP":o="SHA-1";break;case "RS256":case "PS256":case "RSA-OAEP-256":o="SHA-256";break;case "RS384":case "PS384":case "RSA-OAEP-384":o="SHA-384";break;case "RS512":case "PS512":case "RSA-OAEP-512":o="SHA-512";break;default:throw new TypeError("given KeyObject instance cannot be used for this algorithm")}if(t.startsWith("RSA-OAEP"))return e.toCryptoKey({name:"RSA-OAEP",hash:o},a,n?["encrypt"]:["decrypt"]);i=e.toCryptoKey({name:t.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:o},a,[n?"verify":"sign"]);}if(e.asymmetricKeyType==="ec"){let s=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(e.asymmetricKeyDetails?.namedCurve);if(!s)throw new TypeError("given KeyObject instance cannot be used for this algorithm");t==="ES256"&&s==="P-256"&&(i=e.toCryptoKey({name:"ECDSA",namedCurve:s},a,[n?"verify":"sign"])),t==="ES384"&&s==="P-384"&&(i=e.toCryptoKey({name:"ECDSA",namedCurve:s},a,[n?"verify":"sign"])),t==="ES512"&&s==="P-521"&&(i=e.toCryptoKey({name:"ECDSA",namedCurve:s},a,[n?"verify":"sign"])),t.startsWith("ECDH-ES")&&(i=e.toCryptoKey({name:"ECDH",namedCurve:s},a,n?[]:["deriveBits"]));}if(!i)throw new TypeError("given KeyObject instance cannot be used for this algorithm");return r?r[t]=i:Re.set(e,{[t]:i}),i},Rr=async(e,t)=>{if(e instanceof Uint8Array||vt(e))return e;if(At(e)){if(e.type==="secret")return e.export();if("toCryptoKey"in e&&typeof e.toCryptoKey=="function")try{return Hn(e,t)}catch(n){if(n instanceof TypeError)throw n}let r=e.export({format:"jwk"});return br(e,r,t)}if(Je(e))return e.k?sr(e.k):br(e,e,t,true);throw new Error("unreachable")};var ke=e=>e?.[Symbol.toStringTag],Kt=(e,t,r)=>{if(t.use!==void 0){let n;switch(r){case "sign":case "verify":n="sig";break;case "encrypt":case "decrypt":n="enc";break}if(t.use!==n)throw new TypeError(`Invalid key for this operation, its "use" must be "${n}" when present`)}if(t.alg!==void 0&&t.alg!==e)throw new TypeError(`Invalid key for this operation, its "alg" must be "${e}" when present`);if(Array.isArray(t.key_ops)){let n;switch(true){case(r==="sign"):case e==="dir":case e.includes("CBC-HS"):n=r;break;case e.startsWith("PBES2"):n="deriveBits";break;case /^A\d{3}(?:GCM)?(?:KW)?$/.test(e):!e.includes("GCM")&&e.endsWith("KW")?n="unwrapKey":n=r;break;case(r==="encrypt"):n="wrapKey";break;case r==="decrypt":n=e.startsWith("RSA")?"unwrapKey":"deriveBits";break}if(n&&t.key_ops?.includes?.(n)===false)throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${n}" when present`)}return  true},$n=(e,t,r)=>{if(!(t instanceof Uint8Array)){if(Je(t)){if(Sr(t)&&Kt(e,t,r))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!xt(t))throw new TypeError(Pt(e,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if(t.type!=="secret")throw new TypeError(`${ke(t)} instances for symmetric algorithms must be of type "secret"`)}},On=(e,t,r)=>{if(Je(t))switch(r){case "decrypt":case "sign":if(wr(t)&&Kt(e,t,r))return;throw new TypeError("JSON Web Key for this operation be a private JWK");case "encrypt":case "verify":if(yr(t)&&Kt(e,t,r))return;throw new TypeError("JSON Web Key for this operation be a public JWK")}if(!xt(t))throw new TypeError(Pt(e,t,"CryptoKey","KeyObject","JSON Web Key"));if(t.type==="secret")throw new TypeError(`${ke(t)} instances for asymmetric algorithms must not be of type "secret"`);if(t.type==="public")switch(r){case "sign":throw new TypeError(`${ke(t)} instances for asymmetric algorithm signing must be of type "private"`);case "decrypt":throw new TypeError(`${ke(t)} instances for asymmetric algorithm decryption must be of type "private"`);}if(t.type==="private")switch(r){case "verify":throw new TypeError(`${ke(t)} instances for asymmetric algorithm verifying must be of type "public"`);case "encrypt":throw new TypeError(`${ke(t)} instances for asymmetric algorithm encryption must be of type "public"`);}},kr=(e,t,r)=>{e.startsWith("HS")||e==="dir"||e.startsWith("PBES2")||/^A(?:128|192|256)(?:GCM)?(?:KW)?$/.test(e)||/^A(?:128|192|256)CBC-HS(?:256|384|512)$/.test(e)?$n(e,t,r):On(e,t,r);};var Er=(e,t)=>{let r=`SHA-${e.slice(-3)}`;switch(e){case "HS256":case "HS384":case "HS512":return {hash:r,name:"HMAC"};case "PS256":case "PS384":case "PS512":return {hash:r,name:"RSA-PSS",saltLength:parseInt(e.slice(-3),10)>>3};case "RS256":case "RS384":case "RS512":return {hash:r,name:"RSASSA-PKCS1-v1_5"};case "ES256":case "ES384":case "ES512":return {hash:r,name:"ECDSA",namedCurve:t.namedCurve};case "Ed25519":case "EdDSA":return {name:"Ed25519"};case "ML-DSA-44":case "ML-DSA-65":case "ML-DSA-87":return {name:e};default:throw new L(`alg ${e} is not supported either by JOSE or your javascript runtime`)}};var Pr=async(e,t,r)=>{if(t instanceof Uint8Array){if(!e.startsWith("HS"))throw new TypeError(dr(t,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",t,{hash:`SHA-${e.slice(-3)}`,name:"HMAC"},false,[r])}return ur(t,e,r),t};var ie=e=>Math.floor(e.getTime()/1e3);var Nn=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,Qe=e=>{let t=Nn.exec(e);if(!t||t[4]&&t[1])throw new TypeError("Invalid time period format");let r=parseFloat(t[2]),n=t[3].toLowerCase(),a;switch(n){case "sec":case "secs":case "second":case "seconds":case "s":a=Math.round(r);break;case "minute":case "minutes":case "min":case "mins":case "m":a=Math.round(r*60);break;case "hour":case "hours":case "hr":case "hrs":case "h":a=Math.round(r*3600);break;case "day":case "days":case "d":a=Math.round(r*86400);break;case "week":case "weeks":case "w":a=Math.round(r*604800);break;default:a=Math.round(r*31557600);break}return t[1]==="-"||t[4]==="ago"?-a:a};function de(e,t){if(!Number.isFinite(t))throw new TypeError(`Invalid ${e} input`);return t}var A,et=class{constructor(t){B(this,A);if(!Ze(t))throw new TypeError("JWT Claims Set MUST be an object");F(this,A,structuredClone(t));}data(){return ne.encode(JSON.stringify(m(this,A)))}get iss(){return m(this,A).iss}set iss(t){m(this,A).iss=t;}get sub(){return m(this,A).sub}set sub(t){m(this,A).sub=t;}get aud(){return m(this,A).aud}set aud(t){m(this,A).aud=t;}set jti(t){m(this,A).jti=t;}set nbf(t){typeof t=="number"?m(this,A).nbf=de("setNotBefore",t):t instanceof Date?m(this,A).nbf=de("setNotBefore",ie(t)):m(this,A).nbf=ie(new Date)+Qe(t);}set exp(t){typeof t=="number"?m(this,A).exp=de("setExpirationTime",t):t instanceof Date?m(this,A).exp=de("setExpirationTime",ie(t)):m(this,A).exp=ie(new Date)+Qe(t);}set iat(t){typeof t>"u"?m(this,A).iat=ie(new Date):t instanceof Date?m(this,A).iat=de("setIssuedAt",ie(t)):typeof t=="string"?m(this,A).iat=de("setIssuedAt",ie(new Date)+Qe(t)):m(this,A).iat=de("setIssuedAt",t);}};A=new WeakMap;var vr=async(e,t,r)=>{let n=await Pr(e,t,"sign");hr(e,n);let a=await crypto.subtle.sign(Er(e,n.algorithm),n,r);return new Uint8Array(a)};var De,H,Z,tt=class{constructor(t){B(this,De);B(this,H);B(this,Z);if(!(t instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");F(this,De,t);}setProtectedHeader(t){if(m(this,H))throw new TypeError("setProtectedHeader can only be called once");return F(this,H,t),this}setUnprotectedHeader(t){if(m(this,Z))throw new TypeError("setUnprotectedHeader can only be called once");return F(this,Z,t),this}async sign(t,r){if(!m(this,H)&&!m(this,Z))throw new oe("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!pr(m(this,H),m(this,Z)))throw new oe("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let n={...m(this,H),...m(this,Z)},a=gr(oe,new Map([["b64",true]]),r?.crit,m(this,H),n),i=true;if(a.has("b64")&&(i=m(this,H).b64,typeof i!="boolean"))throw new oe('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:o}=n;if(typeof o!="string"||!o)throw new oe('JWS "alg" (Algorithm) Header Parameter missing or invalid');kr(o,t,"sign");let s=m(this,De);i&&(s=ne.encode(Ye(s)));let l;m(this,H)?l=ne.encode(Ye(JSON.stringify(m(this,H)))):l=ne.encode("");let u=or(l,ne.encode("."),s),c=await Rr(t,o),p=await vr(o,c,u),d={signature:Ye(p),payload:""};return i&&(d.payload=Se.decode(s)),m(this,Z)&&(d.header=m(this,Z)),m(this,H)&&(d.protected=Se.decode(l)),d}};De=new WeakMap,H=new WeakMap,Z=new WeakMap;var Ee,rt=class{constructor(t){B(this,Ee);F(this,Ee,new tt(t));}setProtectedHeader(t){return m(this,Ee).setProtectedHeader(t),this}async sign(t,r){let n=await m(this,Ee).sign(t,r);if(n.payload===void 0)throw new TypeError("use the flattened module for creating JWS with b64: false");return `${n.protected}.${n.payload}.${n.signature}`}};Ee=new WeakMap;var se,N,pe=class{constructor(t={}){B(this,se);B(this,N);F(this,N,new et(t));}setIssuer(t){return m(this,N).iss=t,this}setSubject(t){return m(this,N).sub=t,this}setAudience(t){return m(this,N).aud=t,this}setJti(t){return m(this,N).jti=t,this}setNotBefore(t){return m(this,N).nbf=t,this}setExpirationTime(t){return m(this,N).exp=t,this}setIssuedAt(t){return m(this,N).iat=t,this}setProtectedHeader(t){return F(this,se,t),this}async sign(t,r){let n=new rt(m(this,N).data());if(n.setProtectedHeader(m(this,se)),Array.isArray(m(this,se)?.crit)&&m(this,se).crit.includes("b64")&&m(this,se).b64===false)throw new _e("JWTs MUST NOT use unencoded payload");return n.sign(t,r)}};se=new WeakMap,N=new WeakMap;var Un=e=>btoa(String.fromCharCode(...new Uint8Array(e))).replaceAll("+","-").replaceAll("/","_").replaceAll("=",""),nt=async e=>{let t=new TextEncoder().encode(e),r=await crypto.subtle.digest("SHA-256",t);return Un(r)},G=async e=>{let{method:t,url:r,nonce:n,ath:a,privateKey:i,publicJwk:o}=e,s={htm:t.toUpperCase(),htu:r,jti:crypto.randomUUID(),iat:Math.floor(Date.now()/1e3)};return n&&(s.nonce=n),a&&(s.ath=a),await new pe(s).setProtectedHeader({alg:"ES256",typ:"dpop+jwt",jwk:o}).sign(i)};var $=async e=>{let t={crv:e.crv,kty:"EC",x:e.x,y:e.y},r=JSON.stringify(t),n=new TextEncoder().encode(r),a=await crypto.subtle.digest("SHA-256",n);return btoa(String.fromCharCode(...new Uint8Array(a))).replaceAll("+","-").replaceAll("/","_").replaceAll("=","")};async function he(e){let{rootPrivateKey:t,rootPublicJwk:r,childJkt:n,clientId:a,sid:i,ttlSec:o=300}=e,s=Math.floor(Date.now()/1e3),l=s+Math.max(60,Math.min(o,3600)),u={child_jkt:n,client_id:a,aud:"issuer",iat:s,exp:l,jti:crypto.randomUUID()};return i&&(u.sid=i),await new pe(u).setProtectedHeader({alg:"ES256",typ:"pode+jwt",jwk:r}).sign(t)}function Me(e,t=300){return e.replace(/<[^>]*>/g,"").slice(0,t)}async function Le(e){let t=e.status,r=Array.from(e.headers.keys()).some(s=>{let l=s.toLowerCase();return l.startsWith("x-amzn-")&&l.includes("waf")}),n,a,i=e.headers.get("content-type")||"";if(i.includes("application/json"))try{let s=await e.clone().json();n=typeof s?.error=="string"?s.error:void 0,a=typeof s?.detail=="string"?s.detail:void 0;}catch{}let o=t===403&&!r&&!i.includes("application/json");return {status:t,code:n,detail:a,edgeBlocked:r,originBlocked:o}}function me(e,t){let r=new Error(e);return r.status=t.status,r.code=t.code,r.detail=t.detail,r.edgeBlocked=t.edgeBlocked,r.originBlocked=t.originBlocked,r}var ot=e=>/^0x[a-fA-F0-9]{40}$/.test(e),ce=e=>ot(e)?e.toLowerCase():e,x=(e,t)=>!e||!t?false:ot(e)&&ot(t)?e.toLowerCase()===t.toLowerCase():e===t;var Pe={boundWallet:null,clientId:null,jkt:null,refreshId:null,lastPolicyHash:null,lastPolicyProof:null,lastHost:null,rootJkt:null,registeredProofId:null},Ct=react.createContext(void 0);function Ir(e){try{return JSON.parse(localStorage.getItem(e)||"null")??Pe}catch{return Pe}}function Fn(e,t){try{localStorage.setItem(e,JSON.stringify(t));}catch{}}var It=({children:e,clientId:t})=>{let[r,n]=react.useState(Pe),a=react.useRef(false),[i,o]=react.useState(false),s=react.useMemo(()=>We(t),[t]);react.useEffect(()=>{let h=true;return (async()=>{let y=await T(s)??await T(Xe)??Ir(s);h&&(n({...Pe,...y}),a.current=true,o(true));})(),()=>{h=false;}},[s]),react.useEffect(()=>{a.current&&(async()=>(await R(s,r),Fn(s,r)))();},[r,s]);let l=react.useCallback(h=>n(f=>({...f,refreshId:h})),[]),u=react.useCallback(h=>n(f=>({...f,lastPolicyHash:h})),[]),c=react.useCallback(h=>n(f=>({...f,lastPolicyProof:h})),[]),p=react.useCallback(h=>n(f=>({...f,lastHost:h})),[]),d=react.useCallback(h=>n(f=>({...f,rootJkt:h})),[]),g=react.useCallback(h=>n(f=>({...f,registeredProofId:h})),[]),S=async()=>{try{let h=localStorage.getItem(s);if(h){let f=JSON.parse(h);if(typeof f?.refreshId=="string"&&f.refreshId)return f.refreshId}}catch{}try{let h=await T(s);if(typeof h?.refreshId=="string"&&h.refreshId)return h.refreshId}catch{}return null},v=react.useCallback(h=>n(f=>({...f,boundWallet:h})),[]),w=react.useCallback(h=>n(f=>({...f,clientId:h})),[]),k=react.useCallback(h=>n(f=>({...f,jkt:h})),[]),b=react.useCallback(()=>n(Pe),[]),_=react.useCallback(async()=>{let f=await T(s)??Ir(s);n({...Pe,...f});},[]),M=react.useMemo(()=>({meta:r,setBoundWallet:v,setClientId:w,setJkt:k,resetMeta:b,reload:_,setRefreshId:l,getRefreshId:S,ready:i,setLastPolicyHash:u,setLastPolicyProof:c,setLastHost:p,setRootJkt:d,setRegisteredProofId:g}),[r,v,w,k,b,_,i,l,S,u,c,p,d,g]);return jsxRuntime.jsx(Ct.Provider,{value:M,children:e})};function Tt(){let e=react.useContext(Ct);if(!e)throw new Error("useMeta must be used within <MetaProvider>");return e}var Wr=`${I}:wrap`;async function at(){try{let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},!1,["sign","verify"]),t=`${I}:probe_safe`;await R(t,{fmt:"cryptokey",privKey:e.privateKey});let r=await T(t);return await R(t,void 0),!!(r&&r.privKey)}catch{return  false}}async function qn(){try{let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},!0,["sign","verify"]),t=`${I}:probe`;await R(t,{fmt:"cryptokey",privKey:e.privateKey});let r=await T(t);return await R(t,void 0),!!(r&&r.privKey)}catch{return  false}}function Ae(e){let{d:t,...r}=e;return {...r,kty:"EC",crv:E,alg:Te,use:"sig"}}async function _r(){let e=await T(Wr);if(!e){let t=new Uint8Array(32);crypto.getRandomValues(t),e=t.buffer,await R(Wr,e);}return crypto.subtle.importKey("raw",e,{name:"AES-GCM",length:256},false,["encrypt","decrypt"])}async function Wt(e){let t=await _r(),r=new Uint8Array(12);crypto.getRandomValues(r);let n=new TextEncoder().encode(JSON.stringify(e));return {encPrivJwk:await crypto.subtle.encrypt({name:"AES-GCM",iv:r},t,n),iv:r.buffer}}async function zn(e,t){let r=await _r(),n=await crypto.subtle.decrypt({name:"AES-GCM",iv:t},r,e);return JSON.parse(new TextDecoder().decode(new Uint8Array(n)))}var _t=()=>{let e=react.useRef(null),t=react.useRef(null),r=react.useCallback(async()=>{let l=await T(I);if(!l)return  false;if(l.fmt==="cryptokey"){let c=l;if(!c.privKey)return await R(I,void 0),false;let p=c.privKey;try{if(p.extractable&&await at()){let g=await crypto.subtle.exportKey("jwk",p),S=await crypto.subtle.importKey("jwk",g,{name:"ECDSA",namedCurve:E},!1,["sign"]),v={fmt:"cryptokey",privKey:S,pubJwk:Ae(c.pubJwk)};await R(I,v),p=S;}}catch{}return e.current=p,t.current=Ae(c.pubJwk),true}if(l.fmt==="encjwk"){let c=l;try{let p=await zn(c.encPrivJwk,c.iv),d=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},!1,["sign"]);return e.current=d,t.current=Ae(c.pubJwk),!0}catch{return await R(I,void 0),false}}let u=l;if(u&&u.d){let{d:c,...p}=u,d=Ae(p),g=await at(),S=g||await qn();if(S&&g){let b=await crypto.subtle.importKey("jwk",u,{name:"ECDSA",namedCurve:E},false,["sign"]);return await R(I,{fmt:"cryptokey",privKey:b,pubJwk:d}),e.current=b,t.current=d,true}if(S){let b=await crypto.subtle.importKey("jwk",u,{name:"ECDSA",namedCurve:E},true,["sign"]);return await R(I,{fmt:"cryptokey",privKey:b,pubJwk:d}),e.current=b,t.current=d,true}let{encPrivJwk:v,iv:w}=await Wt(u);await R(I,{fmt:"encjwk",encPrivJwk:v,iv:w,pubJwk:d});let k=await crypto.subtle.importKey("jwk",u,{name:"ECDSA",namedCurve:E},false,["sign"]);return e.current=k,t.current=d,true}return await R(I,void 0),false},[]),n=react.useCallback(async(l,u)=>{await R(I,{fmt:"cryptokey",privKey:l,pubJwk:u});},[]),a=react.useCallback(async(l,u)=>{let{encPrivJwk:c,iv:p}=await Wt(l);await R(I,{fmt:"encjwk",encPrivJwk:c,iv:p,pubJwk:u});},[]),i=react.useCallback(async()=>{if(e.current&&t.current||await r())return;let l=await at(),u=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},true,["sign","verify"]),c=Ae(await crypto.subtle.exportKey("jwk",u.publicKey)),p=await crypto.subtle.exportKey("jwk",u.privateKey);if(l){let d=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},false,["sign"]);await n(d,c),e.current=d,t.current=c;}else {await a(p,c);let d=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},false,["sign"]);e.current=d,t.current=c;}},[r,n,a]),o=react.useCallback(async()=>{let l=await at(),u=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},true,["sign","verify"]),c=Ae(await crypto.subtle.exportKey("jwk",u.publicKey)),p=await crypto.subtle.exportKey("jwk",u.privateKey);if(l){let d=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},false,["sign"]);await R(I,{fmt:"cryptokey",privKey:d,pubJwk:c}),e.current=d,t.current=c;}else {let{encPrivJwk:d,iv:g}=await Wt(p);await R(I,{fmt:"encjwk",encPrivJwk:d,iv:g,pubJwk:c});let S=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},false,["sign"]);e.current=S,t.current=c;}},[]),s=react.useCallback(async()=>{await R(I,void 0),e.current=null,t.current=null;},[]);return {ensureKeypair:i,rotate:o,clear:s,privRef:e,pubJwkRef:t}};var Q="sunbreak_root_key_v1",Dr=`${Q}:wrap`;async function Mr(){try{let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},!1,["sign","verify"]),t=`${Q}:probe_safe`;await R(t,{fmt:"cryptokey",privKey:e.privateKey,createdAt:Date.now(),pubJwk:{}});let r=await T(t);return await R(t,void 0),!!(r&&r.privKey)}catch{return  false}}function it(e){let{d:t,...r}=e;return {...r,kty:"EC",crv:E,alg:Te,use:"sig"}}async function Lr(){let e=await T(Dr);if(!e){let t=new Uint8Array(32);crypto.getRandomValues(t),e=t.buffer,await R(Dr,e);}return crypto.subtle.importKey("raw",e,{name:"AES-GCM",length:256},false,["encrypt","decrypt"])}async function Xn(e){let t=await Lr(),r=new Uint8Array(12);crypto.getRandomValues(r);let n=new TextEncoder().encode(JSON.stringify(e));return {encPrivJwk:await crypto.subtle.encrypt({name:"AES-GCM",iv:r},t,n),iv:r.buffer}}async function Yn(e,t){let r=await Lr(),n=await crypto.subtle.decrypt({name:"AES-GCM",iv:t},r,e);return JSON.parse(new TextDecoder().decode(new Uint8Array(n)))}var Dt=()=>{let e=react.useRef(null),t=react.useRef(null),r=react.useCallback(async()=>{let i=await T(Q);if(!i)return  false;if(i.fmt==="cryptokey"){let o=i;if(!o.privKey)return await R(Q,void 0),false;let s=o.privKey;try{if(s.extractable&&await Mr()){let u=await crypto.subtle.exportKey("jwk",s),c=await crypto.subtle.importKey("jwk",u,{name:"ECDSA",namedCurve:E},!1,["sign"]),p={fmt:"cryptokey",privKey:c,pubJwk:it(o.pubJwk),createdAt:o.createdAt};await R(Q,p),s=c;}}catch{}return e.current=s,t.current=it(o.pubJwk),true}if(i.fmt==="encjwk"){let o=i;try{let s=await Yn(o.encPrivJwk,o.iv),l=await crypto.subtle.importKey("jwk",s,{name:"ECDSA",namedCurve:E},!1,["sign"]);return e.current=l,t.current=it(o.pubJwk),!0}catch{return await R(Q,void 0),false}}return await R(Q,void 0),false},[]),n=react.useCallback(async()=>{if(e.current&&t.current||await r())return;let i=await Mr(),o=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},true,["sign","verify"]),s=it(await crypto.subtle.exportKey("jwk",o.publicKey)),l=Date.now(),u=await crypto.subtle.exportKey("jwk",o.privateKey);if(i){let c=await crypto.subtle.importKey("jwk",u,{name:"ECDSA",namedCurve:E},false,["sign"]);await R(Q,{fmt:"cryptokey",privKey:c,pubJwk:s,createdAt:l}),e.current=c,t.current=s;}else {let{encPrivJwk:c,iv:p}=await Xn(u);await R(Q,{fmt:"encjwk",encPrivJwk:c,iv:p,pubJwk:s,createdAt:l});let g=await crypto.subtle.importKey("jwk",u,{name:"ECDSA",namedCurve:E},false,["sign"]);e.current=g,t.current=s;}},[r]),a=react.useCallback(async()=>{await R(Q,void 0),e.current=null,t.current=null;},[]);return {ensureRootKeypair:n,clear:a,rootPrivRef:e,rootPubJwkRef:t}};var Hr="0.2.2",He=class e{constructor(t,r=false){this.colors={flow:"#00D9FF",state:"#00FF88",decision:"#FFB800",api:"#B388FF",guard:"#FFEA00",error:"#FF5252",warn:"#FF9100",info:"#90CAF9"};this.enabled=r,this.prefix=t?`[Sunbreak v${Hr}:${t.slice(0,8)}]`:`[Sunbreak v${Hr}]`;}log(t,r,n){if(!this.enabled)return;let a=this.colors[t],i=new Date().toISOString().slice(11,23),o=this.getEmoji(t);console.log(`%c${o} ${this.prefix} [${i}] [${t.toUpperCase()}]%c ${r}`,`color: ${a}; font-weight: bold`,"color: inherit; font-weight: normal",n!==void 0?n:"");}getEmoji(t){switch(t){case "flow":return "\u{1F504}";case "state":return "\u{1F500}";case "decision":return "\u{1F914}";case "api":return "\u{1F4E1}";case "guard":return "\u{1F6E1}\uFE0F";case "error":return "\u274C";case "warn":return "\u26A0\uFE0F";case "info":return "\u2139\uFE0F";default:return "\u2022"}}flow(t,r,n){this.log("flow",`[${t.toUpperCase()}] ${r}`,n);}state(t,r,n,a){this.log("state",`${t} \u2192 ${r}: ${n}`,a);}decision(t,r,n,a){this.log("decision",`${t} = ${r?"\u2713 YES":"\u2717 NO"} (${n})`,a);}api(t,r,n){let a=n.status,o=a>=200&&a<300?"\u2713":"\u2717";this.log("api",`${o} ${t} ${r} \u2192 ${a}${n.error?` (${n.error})`:""}`,n.data);}guard(t,r,n,a){this.log("guard",`${t}: ${r?"\u2713 PASS":"\u2717 BLOCK"} (${n})`,a);}error(t,r){this.log("error",t,r);}warn(t,r){this.log("warn",t,r);}info(t,r){this.log("info",t,r);}group(t){this.enabled&&console.group(`${this.prefix} ${t}`);}groupEnd(){this.enabled&&console.groupEnd();}child(t){let r=new e(void 0,this.enabled);return r.prefix=`${this.prefix}[${t}]`,r}},Mt=null;function $r(){return Mt||(Mt=new He(void 0,false)),Mt}var $e=class{constructor(t){this.currentState="unknown";this.previousState="unknown";this.logger=$r();this.hadSessionHistory=false;this.inActiveSession=false;t&&this.initialize(t);}initialize(t){if(this.currentState!=="unknown"){this.logger.info(`Skipping initialization - state already set to ${this.currentState}`);let n=!!(t.boundWallet||t.refreshId);this.hadSessionHistory=n;return}this.logger.group("\u{1F527} Initializing Session State Machine");let r=!!(t.boundWallet||t.refreshId);this.hadSessionHistory=r,this.logger.info("Initial context",{wallet:t.wallet,boundWallet:t.boundWallet,refreshId:t.refreshId?"present":"null",hasToken:t.hasToken,authenticated:t.authenticated,hasHistory:r}),t.authenticated&&t.hasToken?(this.transition("authenticated","Has valid token"),this.inActiveSession=true):r?this.transition("refreshable","Has session history"):this.transition("unregistered","No session history"),this.logger.groupEnd();}transition(t,r){if(this.currentState===t){this.logger.info(`State unchanged: ${t} (${r})`);return}this.previousState=this.currentState,this.currentState=t,this.logger.state(this.previousState,t,r);}getState(){return this.currentState}isInActiveSession(){return this.inActiveSession}markHadSession(){this.hadSessionHistory||(this.logger.info("Marked hadSessionHistory = true"),this.hadSessionHistory=true);}clearSessionHistory(){this.logger.info("Cleared session history"),this.hadSessionHistory=false,this.inActiveSession=false;}onNewCredentialsReceived(){this.inActiveSession&&(this.logger.info("New credentials received while in active session - allowing re-registration"),this.inActiveSession=false,this.transition("unregistered","New credentials received"));}onProbeComplete(t){if(this.logger.flow("probe","Probe completed, determining initial state"),this.currentState!=="unknown"){this.logger.warn("Probe called but state is not UNKNOWN",{currentState:this.currentState});return}!!(t.boundWallet||t.refreshId)||this.hadSessionHistory?this.transition("refreshable","Session history found"):this.transition("unregistered","No session history");}onRegisterSuccess(t){this.logger.flow("register","Register succeeded"),this.transition("authenticated","Register succeeded"),this.inActiveSession=true,this.hadSessionHistory=true;}onRegisterFailure(t){this.logger.flow("register",`Register failed: ${t}`);}onRefreshSuccess(t){this.logger.flow("refresh","Refresh succeeded"),this.transition("authenticated","Refresh succeeded"),this.inActiveSession=true;}onRefreshExpired(){this.logger.flow("refresh","Refresh failed: session expired (missing refresh identifier)"),this.transition("expired","Session expired"),this.inActiveSession=false;}onRefreshFailure(t){this.logger.flow("refresh",`Refresh failed: ${t}`);}onTokenExpired(){this.logger.flow("token","Token expired"),this.currentState==="authenticated"&&this.transition("refreshable","Token expired");}onWalletChange(t,r,n){if(this.logger.flow("wallet",`Wallet changed: ${t||"null"} \u2192 ${r||"null"}`),!r){this.transition("unknown","Wallet disconnected"),this.inActiveSession=false;return}x(r,n.boundWallet)?(this.hadSessionHistory=true,this.transition("refreshable","Wallet reconnected with session history")):(this.transition("unregistered","Wallet changed to different address"),this.inActiveSession=false);}onWalletDisconnect(){this.logger.flow("wallet","Wallet disconnected"),this.transition("unknown","Wallet disconnected"),this.inActiveSession=false;}shouldAttemptProbe(){let t=this.currentState==="unknown";return this.logger.decision("Should attempt probe?",t,`State is ${this.currentState}`),t}shouldAttemptRefresh(t){if(this.currentState!=="refreshable"&&this.currentState!=="authenticated")return this.logger.decision("Should attempt refresh?",false,`State is ${this.currentState}, not REFRESHABLE or AUTHENTICATED`),false;if(!(t.boundWallet||t.wallet))return this.logger.decision("Should attempt refresh?",false,"No wallet available (neither boundWallet nor current wallet)"),false;if(t.wallet&&t.boundWallet&&!x(t.wallet,t.boundWallet))return this.logger.decision("Should attempt refresh?",false,"Wallet mismatch"),false;if(t.hasToken&&t.tokenExpiry){let n=Math.floor(Date.now()/1e3);if(t.tokenExpiry-n>5&&this.currentState==="authenticated")return this.logger.decision("Should attempt refresh?",false,"Token still valid"),false}return this.logger.decision("Should attempt refresh?",true,`State is ${this.currentState}, token ${t.hasToken?"present":"missing"}`),true}shouldAttemptRegister(t){return this.inActiveSession?(this.logger.decision("Should attempt register?",false,"Already in active session - proof changes ignored"),false):this.currentState!=="unregistered"&&this.currentState!=="expired"?(this.logger.decision("Should attempt register?",false,`State is ${this.currentState}, not UNREGISTERED or EXPIRED`),false):t.wallet?t.hasProof?t.authenticated&&t.hasToken?(this.logger.decision("Should attempt register?",false,"Already authenticated"),false):(this.logger.decision("Should attempt register?",true,`State is ${this.currentState}, have wallet + proof`),true):(this.logger.decision("Should attempt register?",false,"No proof available"),false):(this.logger.decision("Should attempt register?",false,"No wallet connected"),false)}shouldWaitForInitialRefresh(t,r){return this.currentState!=="refreshable"||t?false:r.wallet&&r.boundWallet&&x(r.wallet,r.boundWallet)?(this.logger.decision("Should wait for initial refresh?",true,"Returning user - let refresh attempt first"),true):false}getStateReport(t){return `
+\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
+\u2502  Session State Machine Report          \u2502
+\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
+\u2502 Current State:    ${this.currentState.padEnd(20)} \u2502
+\u2502 Previous State:   ${this.previousState.padEnd(20)} \u2502
+\u2502 Active Session:   ${String(this.inActiveSession).padEnd(20)} \u2502
+\u2502 Had History:      ${String(this.hadSessionHistory).padEnd(20)} \u2502
+\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
+\u2502 Wallet:           ${(t.wallet||"null").padEnd(20)} \u2502
+\u2502 Bound Wallet:     ${(t.boundWallet||"null").padEnd(20)} \u2502
+\u2502 Refresh ID:       ${(t.refreshId?"present":"null").padEnd(20)} \u2502
+\u2502 Has Token:        ${String(t.hasToken).padEnd(20)} \u2502
+\u2502 Authenticated:    ${String(t.authenticated).padEnd(20)} \u2502
+\u2502 Has Proof:        ${String(t.hasProof).padEnd(20)} \u2502
+\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
+    `.trim()}};var Zn=()=>crypto.randomUUID(),Or=e=>{let{clientId:t,wallet:r,base:n="https://api.sunbreak.com",fetchImpl:a,timeoutMs:i=15e3,proof:o=null,providerAdapter:s,refreshDeps:l=[],debug:u}=e,c=yt(n),p=typeof window<"u"?(a??fetch).bind(window):a??fetch,{meta:d,setBoundWallet:g,setJkt:S,setRefreshId:v,getRefreshId:w,setLastPolicyHash:k,setLastPolicyProof:b,setLastHost:_,setRootJkt:M,setRegisteredProofId:h,ready:f}=Tt(),{ensureRootKeypair:y,rootPrivRef:C,rootPubJwkRef:J}=Dt(),Ke=react.useCallback(async()=>{await y();try{if(!d.rootJkt&&J.current){let re=await $(J.current);M(re);}}catch{}},[y,d.rootJkt,J]),{ensureKeypair:K,rotate:je,privRef:Be,pubJwkRef:qt}=_t(),[D,X]=react.useState(false),[j,te]=react.useState(0),[le,ae]=react.useState(null),[ut,ft]=react.useState(null),[dt,Yr]=react.useState(null),[Zr,Qr]=react.useState(null),en=react.useRef(null),tn=react.useRef(null),rn=react.useRef(null),nn=react.useRef(null),on=react.useRef(null),an=react.useRef(null),sn=react.useRef(null),cn=react.useRef(false),ln=react.useRef(false),un=react.useRef(void 0),Fe=react.useRef(false),pt=react.useRef(false),zt=react.useRef(null),ue=react.useRef(null);ue.current||(ue.current=new Promise(re=>{zt.current=re;}));let ht=react.useRef(null),fn=react.useRef(o),dn=react.useRef(null),we=react.useRef(null);if(!we.current){let re=u??false;we.current=new He(t,re);}let Xt=u??false;we.current&&we.current.enabled!==Xt&&(we.current.enabled=Xt);let mt=react.useRef(null);mt.current||(mt.current=new $e);let Ve=react.useRef(null),Yt=react.useRef(null),Ge=react.useRef(null),Zt=()=>Date.now(),pn=()=>(Ge.current??0)>0&&Ge.current<Zt(),gt=react.useCallback((re,Sn=15e3)=>{let Qt=Zn();return Ve.current=Qt,Yt.current=re,Ge.current=Zt()+Math.max(1e3,Sn),Qt},[]),hn=react.useCallback(()=>((!Ve.current||pn())&&gt("adhoc",1e4),Ve.current),[gt]),wt=react.useRef(null),qe=react.useRef(null);qe.current||(qe.current=new Promise(re=>{wt.current=re;}));let mn=react.useCallback(async()=>{!Fe.current&&qe.current&&await qe.current;},[]),gn=react.useCallback(()=>{Fe.current||(Fe.current=true,wt.current?.(),wt.current=null);},[]),wn=react.useCallback(async()=>{!pt.current&&ue.current&&await ue.current;},[]),yn=react.useCallback(async()=>{!pt.current&&ue.current&&await ue.current,ht.current&&await ht.current;},[]);return {clientId:t,wallet:r,baseUrl:c,fetchImpl:p,timeoutMs:i,providerAdapter:s,refreshDeps:l,ensureKeypair:K,rotate:je,ensureRootKeypair:Ke,rootPrivRef:C,rootPubJwkRef:J,privRef:Be,pubJwkRef:qt,meta:d,setBoundWallet:g,setJkt:S,setRefreshId:v,accessTokenRef:rn,tokenExpRef:nn,authenticated:D,setAuthenticated:X,loadingCount:j,setLoadingCount:te,error:le,setError:ae,allowed:ut,setAllowed:ft,sessionExpiry:dt,setSessionExpiry:Yr,sessionData:Zr,setSessionData:Qr,authWalletRef:tn,refreshLock:on,registerLock:an,sessionLock:sn,didInitialRefresh:cn,didInitialSession:ln,prevWalletRef:un,initResolvedRef:pt,initReady:ue,initResolveRef:zt,rotateLock:ht,waitReady:wn,awaitKeyStable:yn,proofRef:fn,registerCooldownUntilRef:en,reqIdRef:Ve,flowLabelRef:Yt,flowExpireRef:Ge,beginFlow:gt,currentReqId:hn,awaitProbe:mn,markProbed:gn,hasProbedRef:Fe,getRefreshId:w,setLastPolicyHash:k,setLastPolicyProof:b,setLastHost:_,setRootJkt:M,setRegisteredProofId:h,metaReady:f,probeLock:dn,stateMachine:mt.current,logger:we.current}};var z=e=>e.accessTokenRef.current??null,ee=e=>{let t=e.privRef.current;if(!t)throw new Error("Sunbreak: private key not initialized");return t},W=e=>{let t=e.pubJwkRef.current;if(!t)throw new Error("Sunbreak: public JWK not initialized");return t};var Qn=(e,t)=>`${e.toUpperCase()} ${t}`;async function Oe(e,t,r,n){if(!t)return e.logger.guard("register",false,"No wallet provided"),false;if(!e.clientId)return e.logger.guard("register",false,"No client ID configured"),e.setError("Missing client ID. Please configure a valid client ID."),false;e.logger.flow("register","Starting register flow",{wallet:t});let a=Oe._nonceCacheRef||(Oe._nonceCacheRef={map:new Map});try{await e.waitReady(),await e.awaitKeyStable(),await e.awaitProbe(),await e.ensureKeypair(),e.setError(null),e.beginFlow("register",2e4);let i;try{if(await e.ensureRootKeypair(),e.rootPrivRef.current&&e.rootPubJwkRef.current){if(!e.meta.rootJkt)try{let y=await $(e.rootPubJwkRef.current);e.setRootJkt?.(y);}catch{}let h=await $(W(e)),f=await e.getRefreshId();i=await he({rootPrivateKey:e.rootPrivRef.current,rootPublicJwk:e.rootPubJwkRef.current,childJkt:h,clientId:e.clientId,sid:f||void 0,ttlSec:300});}}catch(h){e.logger.warn("Failed to create PODE for register",h);}let o=e.currentReqId(),s="/auth/register",l=`${e.baseUrl}${s}`,u=new URL(e.baseUrl).origin,c="POST",p=`${u}${s}`,d=Qn(c,p),g=a.map.get(d),S=await G({method:c,url:p,nonce:g,privateKey:ee(e),publicJwk:W(e)}),v=async h=>e.fetchImpl(l,{method:c,headers:{"content-type":"application/json","x-sunbreak-meta":V(e,{reqId:o,pode:i||void 0,wallet:t}),...h},credentials:"include",body:JSON.stringify({wallet:t,proof:r})}),w=await v({DPoP:S}),k=h=>{let f=h.headers.get("dpop-nonce");f&&a.map.set(d,f);};if(w.status===401){e.logger.info("Register got 401, retrying with nonce");let h=w.headers.get("www-authenticate"),y=(h&&h.match(/dpop-nonce="([^"]+)"/i))?.[1];if(y){a.map.set(d,y);let C=await G({method:c,url:p,nonce:y,privateKey:ee(e),publicJwk:W(e)});w=await v({DPoP:C});}}if(k(w),e.logger.api(c,s,{status:w.status}),!w.ok){let h=await Le(w);if((w.headers.get("content-type")||"").includes("application/json")){let y;try{y=await w.clone().json();}catch{}let C=Me(y&&(y.error||y.message||y.detail)||`HTTP ${w.status}`);throw me(C,h)}else {let y=h.edgeBlocked?"Blocked (403)":h.originBlocked?"Request rejected (403)":`HTTP ${w.status}`;throw me(y,h)}}let b=await w.json();e.logger.info("Register succeeded",{expiresIn:b.expiresIn,hasRefreshId:!!b.refreshId}),e.accessTokenRef.current=b.access,e.authWalletRef.current=ce(t),e.setAuthenticated(!0);try{let h=Math.floor(Date.now()/1e3);e.tokenExpRef.current=h+(b.expiresIn??0);}catch{}e.didInitialRefresh.current=!0,e.setBoundWallet(ce(t)),e.setLastPolicyHash(null),e.setLastPolicyProof(null);try{e.setJkt(await $(W(e)));}catch{}let _=Ce(r);e.setRegisteredProofId(_);try{let h={...e.meta,boundWallet:t,clientId:e.meta.clientId??e.clientId,jkt:e.meta.jkt??null,refreshId:b.refreshId??null,registeredProofId:_};e.setRefreshId(b.refreshId??null);let f=We(e.clientId);await R(f,h);try{localStorage.setItem(f,JSON.stringify(h));}catch(y){e.logger.warn("Failed to persist meta to localStorage",y);}}catch(h){e.logger.warn("Failed to persist session metadata",h);}let M={wallet:t,boundWallet:t,refreshId:b.refreshId??null,hasToken:!0,tokenExpiry:e.tokenExpRef.current,hasProof:!0,authenticated:!0};return e.stateMachine.onRegisterSuccess(M),!0}catch(i){let o=i,s=Number(o?.status||0),l=String(o?.code||"").toLowerCase(),u=String(o?.message||"").toLowerCase(),c=Math.floor(Math.random()*1e3);e.logger.error("Register failed",{status:s,code:l,msg:u}),e.stateMachine.onRegisterFailure(`${l||u||"Unknown error"}`);let p=l==="session_exists"||l==="already_authenticated"||u.includes("already")&&(u.includes("session")||u.includes("authenticated")),d=(s===401||s===403)&&l==="replay";if((p||d)&&n?.refreshFallback&&(!e.meta.boundWallet||x(e.meta.boundWallet,t))){e.logger.info("Register failed with recoverable error, attempting refresh fallback",{code:l,isSessionExists:p,isReplay:d});try{if(await n.refreshFallback())return e.logger.info("Refresh fallback succeeded after register failure"),e.meta.boundWallet||e.setBoundWallet(t),!0}catch(v){e.logger.warn("Refresh fallback failed",v);}}if(d){if(e.providerAdapter)try{let S=await e.providerAdapter.getToken()??null;if(S)return await e.awaitKeyStable(),await e.ensureKeypair(),await e.rotate(),e.proofRef.current=await ye(e.providerAdapter,S),e.registerCooldownUntilRef.current=Date.now()+5e3+c,!1}catch{}else return e.proofRef.current=null,e.setError("Proof replayed; please sign a fresh proof."),e.registerCooldownUntilRef.current=Date.now()+1e4+c,false;return e.registerCooldownUntilRef.current=Date.now()+8e3+c,false}if(p)return e.setError("Session already exists. Try refreshing the page."),e.registerCooldownUntilRef.current=Date.now()+3e3+c,false;if(l==="siwe_invalid"||l==="eip191_invalid"||l==="ed25519_invalid"||l==="sig_wallet_mismatch"||u.includes("invalid")&&u.includes("signature")){if(e.logger.warn("Proof invalid for wallet, clearing proof",{code:l,msg:u}),e.proofRef.current=null,e.providerAdapter)try{let S=await e.providerAdapter.getToken()??null;if(S)return e.proofRef.current=await ye(e.providerAdapter,S),e.registerCooldownUntilRef.current=Date.now()+3e3+c,!1}catch{}return e.setError("Proof doesn't match wallet. Please sign again."),e.registerCooldownUntilRef.current=Date.now()+5e3+c,false}if(s===403&&(o?.edgeBlocked||o?.originBlocked))return e.setError(u||"Forbidden"),e.registerCooldownUntilRef.current=Date.now()+3e4+c,false;if(s===403)return e.setError(l||u||"Forbidden"),e.registerCooldownUntilRef.current=Date.now()+15e3+c,false;if(s===429||s===503){e.setError(l||u||"Rate limited / unavailable");let S=s===429?5e3:8e3;return e.registerCooldownUntilRef.current=Date.now()+S+c,false}return e.setError(l||u||"Register failed"),e.registerCooldownUntilRef.current=Date.now()+5e3+c,false}}var eo=(e,t)=>`${e.toUpperCase()} ${t}`;function Ne(e){if(e.refreshLock.current)return e.logger.guard("refreshLock",false,"Refresh already in progress"),e.refreshLock.current;if(e.registerLock.current){e.logger.guard("registerLock",false,"Registration in progress, waiting");let t=e.registerLock.current.then(()=>{if(e.authenticated&&z(e))return  true;if(z(e)){let n=e.tokenExpRef.current,a=Math.floor(Date.now()/1e3);if(!!n&&n-a>5)return  true}return  false});return e.refreshLock.current=t.finally(()=>{e.refreshLock.current=null;}),e.refreshLock.current}return e.logger.flow("refresh","Starting refresh flow"),e.refreshLock.current=(async()=>{try{await e.waitReady(),await e.awaitKeyStable(),await e.awaitProbe();let t=e.meta.boundWallet||e.wallet;if(!t)return e.logger.warn("No wallet available for refresh (neither boundWallet nor current wallet)"),!1;if(!e.clientId)return e.logger.warn("No client ID configured for refresh"),e.setError("Missing client ID. Please configure a valid client ID."),!1;if(e.wallet&&e.meta.boundWallet&&!x(e.wallet,e.meta.boundWallet))return e.logger.warn("Wallet mismatch during refresh",{current:e.wallet,bound:e.meta.boundWallet}),e.accessTokenRef.current=null,e.setAuthenticated(!1),!1;let r=z(e);if(r){let f=e.tokenExpRef.current,y=Math.floor(Date.now()/1e3);if(!!r&&!!f&&f-y>5)return e.logger.info("Token still valid, skipping refresh"),!0}e.beginFlow("refresh",15e3);let n=e.currentReqId();await e.ensureKeypair();let a;try{if(await e.ensureRootKeypair(),e.rootPrivRef.current&&e.rootPubJwkRef.current){if(!e.meta.rootJkt)try{let C=await $(e.rootPubJwkRef.current);e.setRootJkt?.(C);}catch{}let f=await $(W(e)),y=await e.getRefreshId();a=await he({rootPrivateKey:e.rootPrivRef.current,rootPublicJwk:e.rootPubJwkRef.current,childJkt:f,clientId:e.clientId,sid:y||void 0,ttlSec:300});}}catch(f){e.logger.warn("Failed to create PODE for refresh",f);}let i="/auth/refresh",o=`${e.baseUrl}${i}`,s=new URL(e.baseUrl).origin,l="POST",u=`${s}${i}`,c=eo(l,u),p=Ne._nonceCacheRef||(Ne._nonceCacheRef={map:new Map}),d=async f=>await G({method:l,url:u,nonce:f,privateKey:ee(e),publicJwk:W(e)}),g=await e.getRefreshId(),S={"x-sunbreak-meta":V(e,{reqId:n,refreshId:g||void 0,pode:a||void 0,wallet:t}),"content-type":"application/json"},v=async f=>e.fetchImpl(o,{method:l,headers:{DPoP:f,...S},credentials:"include",body:"{}"}),w=f=>{let y=f.headers.get("dpop-nonce");y&&p.map.set(c,y);},k=await v(await d(p.map.get(c)));if(k.status===401){e.logger.info("Refresh got 401, retrying with nonce");let f=k.headers.get("www-authenticate"),C=(f&&f.match(/dpop-nonce="([^"]+)"/i))?.[1];C&&(p.map.set(c,C),k=await v(await d(C)));}if(w(k),e.logger.api(l,i,{status:k.status}),!k.ok){try{if((k.headers.get("content-type")||"").includes("application/json")){let y=await k.clone().json().catch(()=>{}),C=y&&(y.error||y.code||y.message)||"",J=String(C).toLowerCase();if(J.includes("missing")&&J.includes("refresh")){e.logger.warn("Refresh session expired (missing refresh identifier)"),e.stateMachine.onRefreshExpired();try{e.setRefreshId?.(null);}catch{}e.accessTokenRef.current=null,e.setAuthenticated(!1);}else e.logger.warn("Refresh failed",{error:C}),e.stateMachine.onRefreshFailure(String(C));}}catch{}return !1}let b=await k.json();e.logger.info("Refresh succeeded",{expiresIn:b.expiresIn,hasRefreshId:!!b.refreshId}),e.accessTokenRef.current=b.access,e.setAuthenticated(!0);let _=(e.wallet&&(!e.meta.boundWallet||e.meta.boundWallet===e.wallet)?e.wallet:e.meta.boundWallet)||null;e.authWalletRef.current=_?ce(_):null;try{let f=Math.floor(Date.now()/1e3);e.tokenExpRef.current=f+(b.expiresIn??0);}catch{}try{e.setJkt(await $(W(e)));}catch{}b.refreshId&&e.setRefreshId(b.refreshId);let M=f=>!f||f==="null"||f==="undefined"?null:f,h={wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:M(b.refreshId??e.meta.refreshId??null),hasToken:!0,tokenExpiry:e.tokenExpRef.current,hasProof:!!e.proofRef.current,authenticated:!0};return e.stateMachine.onRefreshSuccess(h),!0}finally{e.refreshLock.current=null;}})(),e.refreshLock.current}var to=(e,t)=>`${e.toUpperCase()} ${t}`,Lt=new Map,Ue;try{let e=globalThis;Ue=e.__sunbreak_page_probe_guard??(e.__sunbreak_page_probe_guard=new Set);}catch{Ue=new Set;}var ro=e=>{try{let t=new URL(e.baseUrl).origin;return `${e.clientId}::${t}`}catch{return `${e.clientId}::${e.baseUrl}`}};async function Nr(e){let t=ro(e);if(e.probeLock.current){e.logger.guard("probeLock",false,"Probe already in progress, waiting"),await e.probeLock.current,e.markProbed();return}if(e.hasProbedRef.current){e.logger.guard("hasProbedRef",false,"Already probed in this session"),e.markProbed();return}if(Ue.has(t)){e.logger.guard("pageProbeGuard",false,"Already probed for this page load"),e.markProbed();return}if(Ue.add(t),!e.clientId){e.logger.warn("No client ID configured, skipping probe"),e.markProbed();return}e.logger.flow("probe","Starting probe flow",{clientId:e.clientId,pageKey:t});let r=(async()=>{let n=new URL(e.baseUrl).origin;try{if(await e.awaitKeyStable(),await e.ensureKeypair(),!e.rootPrivRef.current)try{await e.ensureRootKeypair();}catch{}let a;if(e.rootPrivRef.current&&e.rootPubJwkRef.current)try{let w=await $(W(e));a=await he({rootPrivateKey:e.rootPrivRef.current,rootPublicJwk:e.rootPubJwkRef.current,childJkt:w,clientId:e.clientId,ttlSec:300});}catch(w){e.logger.warn("Failed to create PODE for probe",w);}let i="POST",o="/auth/probe",s=`${e.baseUrl}${o}`,l=`${n}${o}`,u=to(i,l),c=async w=>G({method:i,url:l,nonce:w,privateKey:ee(e),publicJwk:W(e)}),p=async w=>e.fetchImpl(s,{method:i,headers:{DPoP:w,"x-sunbreak-meta":V(e,{pode:a}),"content-type":"application/json"},credentials:"include",body:"{}"}),d=w=>{let k=w.headers.get("dpop-nonce");k&&Lt.set(u,k);},g=await p(await c(Lt.get(u)));if(d(g),g.status===401){e.logger.info("Probe got 401, retrying with nonce from www-authenticate");let w=g.headers.get("www-authenticate"),b=(w&&w.match(/dpop-nonce="([^"]+)"/i))?.[1];b&&(Lt.set(u,b),g=await p(await c(b)),d(g));}e.logger.api(i,o,{status:g.status});let S=w=>!w||w==="null"||w==="undefined"?null:w,v={wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:S(e.meta.refreshId),hasToken:!!e.accessTokenRef.current,tokenExpiry:e.tokenExpRef.current||null,hasProof:!!e.proofRef.current,authenticated:e.authenticated};e.stateMachine.onProbeComplete(v);}catch(a){e.logger.error("Probe failed",a);try{Ue.delete(t);}catch{}}finally{e.markProbed(),e.logger.flow("probe","Probe flow completed");}})();e.probeLock.current=r;try{await r;}finally{e.probeLock.current=null;}}var Ur=e=>{let t=react.useRef(e);t.current=e;let r=react.useCallback(()=>Ne(t.current),[]),n=react.useCallback(async()=>{let o=t.current,s=Date.now(),l=o.registerCooldownUntilRef.current??0;if(s<l){o.logger.guard("registerCooldown",false,"Cooldown active");return}if(!o.wallet){o.logger.guard("attemptRegister",false,"No wallet");return}if(!o.initResolvedRef.current){o.logger.guard("attemptRegister",false,"Not initialized");return}if(o.refreshLock.current){o.logger.guard("attemptRegister",false,"Refresh in progress");return}if(o.registerLock.current){o.logger.guard("attemptRegister",false,"Register already in progress");return}let u=g=>!g||g==="null"||g==="undefined"?null:g,c={wallet:o.wallet||null,boundWallet:o.meta.boundWallet||null,refreshId:u(o.meta.refreshId),hasToken:!!z(o),tokenExpiry:o.tokenExpRef.current||null,hasProof:!!o.proofRef.current,authenticated:o.authenticated};if(!o.stateMachine.shouldAttemptRegister(c)){o.logger.guard("attemptRegister",false,`State machine blocked (state: ${o.stateMachine.getState()}, inActiveSession: ${o.stateMachine.isInActiveSession()})`);return}let p=o.proofRef.current;if(!p){o.logger.guard("attemptRegister",false,"No proof available");return}o.logger.guard("attemptRegister",true,"All guards passed, proceeding");let d=(async()=>{try{await o.awaitKeyStable(),await Oe(o,o.wallet,p,{refreshFallback:async()=>{o.logger.info("Attempting refresh as fallback after register failure");let g=!!o.meta.boundWallet;!g&&o.wallet&&o.setBoundWallet(o.wallet);try{return await Ne(o)}catch{return g||o.setBoundWallet(null),!1}}});}catch(g){let S=g;o.setError(S?.message||String(g)||"Register failed");}finally{o.registerLock.current=null;}})();o.registerLock.current=d;},[]),a=react.useCallback(async o=>{let s=t.current,l=()=>(s.registerCooldownUntilRef.current??0)>Date.now();if(!s.providerAdapter||l())return;let u=await ye(s.providerAdapter,o);s.proofRef.current=u;},[]),i=react.useCallback((o,s,l)=>Oe(t.current,o,s,l),[]);return {refresh:r,register:i,attemptRegister:n,setProofFromAdapterToken:a}};var oo=(e,t)=>`${e.toUpperCase()} ${t}`;async function ct(e,t,r,n,a,i={}){e.setLoadingCount(u=>u+1),e.setError(null);let o=n.startsWith("/api/session"),s=new AbortController,l=setTimeout(()=>s.abort(),e.timeoutMs);try{await e.waitReady(),await e.awaitKeyStable(),await e.awaitProbe(),await e.ensureKeypair();let c=`${o?bt(e):e.baseUrl}${n.startsWith("/")?"":"/"}${n}`,d=`${new URL(e.baseUrl).origin}${n.startsWith("/")?"":"/"}${n}`,g=oo(r,d),S=n.startsWith("/auth/"),v=!1,w=!1,k=e.currentReqId(),b=ct._nonceCacheRef||(ct._nonceCacheRef={map:new Map}),_=D=>{let X=D.headers.get("dpop-nonce");X&&b.map.set(g,X);},M=!!e.wallet&&!!e.authWalletRef.current&&!x(e.wallet,e.authWalletRef.current),h=()=>S||!e.wallet?!1:!!(e.authenticated||x(e.wallet,e.meta.boundWallet)||typeof e.meta.refreshId=="string"&&e.meta.refreshId),f,y,C=async()=>{if(S||M)return;try{let le=z(e),ae=e.tokenExpRef.current,ut=Math.floor(Date.now()/1e3),ft=!!ae&&ae-ut<=60;if(le){if(ft&&!await t().catch(()=>!1))return}else if(!h()||!await t().catch(()=>!1))return}catch{}let D=z(e);if(!D)return;let X=await nt(D),j=b.map.get(g),te=await G({method:r,url:d,nonce:j,ath:X,privateKey:ee(e),publicJwk:W(e)});f=`Bearer ${e.accessTokenRef.current}`,y=te;};await C();let J={"content-type":"application/json","x-sunbreak-auth":f||"","x-sunbreak-meta":V(e,{reqId:k,auth:f,ifPolicyHash:e.meta.lastPolicyHash||void 0,ifPolicyProof:e.meta.lastPolicyProof||void 0}),...Rt(i.headers)};y&&(J.DPoP=y);let Ke=async()=>e.fetchImpl(c,{...i,method:r,headers:J,body:a!==void 0?JSON.stringify(a):void 0,credentials:"include",signal:s.signal}),K=await Ke(),je=K.headers.get("x-sunbreak-policy-hash"),Be=K.headers.get("x-sunbreak-policy-proof");if(je&&e.setLastPolicyHash(je),Be&&e.setLastPolicyProof(Be),_(K),K.status===401&&!S){let D=z(e),X=K.headers.get("www-authenticate"),te=(X&&X.match(/dpop-nonce="([^"]+)"/i))?.[1];if(!M&&te&&D&&!w){w=!0,b.map.set(g,te);let le=await nt(D),ae=await G({method:r,url:d,nonce:te,ath:le,privateKey:ee(e),publicJwk:W(e)});f=`Bearer ${e.accessTokenRef.current}`,y=ae,J["x-sunbreak-meta"]=V(e,{reqId:k,auth:f}),J.DPoP=y,K=await Ke(),_(K);}if(K.status===401&&!v&&(v=!0,!M&&h())){let le=await t(),ae=z(e);le&&ae&&!M&&(await C(),J["x-sunbreak-meta"]=V(e,{reqId:k,auth:f}),y&&(J.DPoP=y),K=await Ke(),_(K));}if(K.status===401)throw new Error("Unauthorized")}if(!K.ok){let D=await Le(K);if((K.headers.get("content-type")||"").includes("application/json")){let j=await K.json().catch(()=>{}),te=Me(j&&(j.error||j.message||j.detail)||`HTTP ${K.status}`);throw me(te,D)}else {let j=D.edgeBlocked?"Blocked (403)":D.originBlocked?"Request rejected (403)":`HTTP ${K.status}`;throw me(j,D)}}return (K.headers.get("content-type")||"").includes("application/json")?await K.json():void 0}finally{clearTimeout(l),e.setLoadingCount(u=>Math.max(0,u-1));}}var Br=(e,t)=>{let r=react.useRef(e),n=react.useRef(t);return r.current=e,n.current=t,react.useCallback(async(a,i,o,s={})=>ct(r.current,n.current,a,i,o,s),[])};async function Fr(e,t){let r=await t("GET","/api/session");if(r){e.setAllowed(!!r.allowed),e.setSessionData(r),e.setSessionExpiry(r.expiry??null);let n=r?.wallet;typeof n=="string"&&n&&e.setBoundWallet(ce(n));}return r}var Gr=(e,t)=>{let r=react.useRef(e),n=react.useRef(t);return r.current=e,n.current=t,{session:react.useCallback(async()=>{let i=r.current,o=n.current;if(i.wallet&&!(i.meta.boundWallet&&!x(i.wallet,i.meta.boundWallet)))return i.sessionLock.current||(i.sessionLock.current=(async()=>{try{return await Fr(i,o)}catch(s){throw i.logger.error("Session request failed",s),s}finally{i.sessionLock.current=null;}})()),i.sessionLock.current},[])}};var lt=e=>(e.registerCooldownUntilRef.current??0)>Date.now(),qr=e=>{if(!e)return null;let t=e.indexOf(":");return t>0?e.slice(0,t):null},so=e=>!e||e==="null"||e==="undefined"?null:e,U=e=>({wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:so(e.meta.refreshId),hasToken:!!e.accessTokenRef.current,tokenExpiry:e.tokenExpRef.current||null,hasProof:!!e.proofRef.current,authenticated:e.authenticated});var Ht=e=>{react.useEffect(()=>{if(!e.metaReady)return;let t=true;return (async()=>{try{if(await e.waitReady(),!t||(await e.awaitKeyStable(),!t)||(await e.ensureRootKeypair(),!t))return;let r=U(e);e.stateMachine.initialize(r),await Nr(e);}catch(r){if(!t)return;e.logger.error("Probe initialization failed",r);}})(),()=>{t=false;}},[e.metaReady]);};var $t=e=>{react.useEffect(()=>{let t=e.prevWalletRef.current;if(e.prevWalletRef.current=e.wallet,e.wallet!==t&&e.hasProbedRef.current&&!e.refreshLock.current&&(e.didInitialRefresh.current=false),!e.wallet){e.logger.flow("wallet","Wallet disconnected"),e.stateMachine.onWalletDisconnect(),e.setAllowed(null),e.setSessionExpiry(null),e.setSessionData(null),e.setAuthenticated(false),e.accessTokenRef.current=null,e.proofRef.current=null,e.setError(null),e.didInitialSession.current=false,e.authWalletRef.current=null,e.setLastPolicyHash(null),e.setLastPolicyProof(null),e.hasProbedRef.current&&!e.refreshLock.current&&(e.didInitialRefresh.current=false);return}if(t&&e.wallet&&t!==e.wallet){e.logger.flow("wallet",`Wallet changed: ${t} \u2192 ${e.wallet}`);let r=U(e);e.stateMachine.onWalletChange(t,e.wallet,r),e.proofRef.current=null,e.accessTokenRef.current=null,e.setAuthenticated(false),e.didInitialSession.current=false,e.authWalletRef.current=null,e.setLastPolicyHash(null),e.setLastPolicyProof(null),e.rotateLock.current=(async()=>{await e.rotate();})().catch(()=>{}).finally(()=>{e.rotateLock.current=null;});}if(!t&&e.wallet){if(e.logger.flow("wallet",`Wallet connected: ${e.wallet}`),e.didInitialSession.current=false,!e.metaReady){e.logger.info("Wallet connected but meta not ready, deferring state machine update");return}let r=U(e);e.stateMachine.onWalletChange(null,e.wallet,r);}},[e.wallet,e.metaReady]);};var Ot=(e,t)=>{let{attemptRegister:r,setProofFromAdapterToken:n}=t;react.useEffect(()=>{if(!e.providerAdapter||lt(e)||!e.metaReady||!e.wallet)return;let a=U(e);if(e.stateMachine.isInActiveSession()){e.logger.decision("Provider adapter should trigger register?",false,`Already in active session (state: ${e.stateMachine.getState()})`);return}if(e.stateMachine.shouldWaitForInitialRefresh(e.didInitialRefresh.current,a)){e.logger.decision("Provider adapter should wait for initial refresh?",true,"Returning user - refresh first");return}e.logger.decision("Provider adapter should trigger register?",true,`Fetching token (state: ${e.stateMachine.getState()})`);let i=false;return (async()=>{try{let o=e.providerAdapter.getToken(),s=new Promise((u,c)=>setTimeout(()=>c(new Error("Provider adapter timeout (30s)")),3e4)),l=await Promise.race([o,s]).catch(u=>(e.logger.warn("Provider adapter getToken failed",u),null))??null;if(await e.awaitKeyStable(),i||!l)return;try{let u=l.split(".");if(u[1]){let c=JSON.parse(atob(u[1]));e.logger.info("Provider adapter: got token",{wallet:e.wallet,jwtSub:c.sub,jwtWallet:c.wallet||c.linked_accounts?.[0]?.address,jwtExp:c.exp,jwtIat:c.iat});}}catch{e.logger.info("Provider adapter: got token (could not decode)");}await n(l),await r();}catch(o){e.logger.error("Provider adapter flow failed",o);}})(),()=>{i=true;}},[e.providerAdapter,e.wallet,e.meta.boundWallet,e.metaReady,...e.refreshDeps]);};var Nt=(e,t)=>{let{proofProp:r,attemptRegister:n}=t;react.useEffect(()=>{if(typeof r<"u"&&(e.proofRef.current=r??null,r&&e.logger.info("Proof prop updated",{hasProof:!!r})),!e.metaReady)return;let a=U(e),i=!!e.wallet,o=!!e.proofRef.current,s=false,l=e.proofRef.current?.method,u=l==="siwe"||l==="eip191";if(o&&e.stateMachine.isInActiveSession())if(u){let p=Ce(e.proofRef.current),d=e.meta.registeredProofId;if(p&&d){let g=qr(d),S=g==="siwe"||g==="eip191";if(S&&p!==d)e.logger.info("Proof prop: SIWE/EIP191 credentials changed, allowing re-registration",{old:d,new:p}),e.stateMachine.onNewCredentialsReceived(),e.accessTokenRef.current=null,e.setAuthenticated(false),e.didInitialSession.current=false,s=true;else if(S){e.logger.decision("Proof prop should trigger register?",false,"Already authenticated with same SIWE/EIP191 credentials");return}else e.logger.info("Proof prop: switching from provider JWT to SIWE/EIP191, allowing re-registration",{old:d,new:p}),e.stateMachine.onNewCredentialsReceived(),e.accessTokenRef.current=null,e.setAuthenticated(false),e.didInitialSession.current=false,s=true;}}else {e.logger.decision("Proof prop should trigger register?",false,`Already in active session, no credential change detection for ${l}`);return}let c=s?U(e):a;if(!e.stateMachine.shouldAttemptRegister(c)){e.logger.decision("Proof prop should trigger register?",false,`State machine says no (state: ${e.stateMachine.getState()}, inActiveSession: ${e.stateMachine.isInActiveSession()})`);return}if(e.stateMachine.shouldWaitForInitialRefresh(e.didInitialRefresh.current,c)){e.logger.decision("Proof prop should wait for initial refresh?",true,"Returning user - refresh first");return}i&&o&&e.initResolvedRef.current&&!lt(e)&&(e.logger.info("Proof prop conditions met, attempting register"),n());},[r,e.wallet,e.authenticated,e.meta.boundWallet,e.meta.registeredProofId,e.metaReady,e.providerAdapter,n]);};var Ut=(e,t)=>{let{refresh:r,session:n}=t;react.useEffect(()=>{if(!e.metaReady||e.didInitialRefresh.current)return;e.didInitialRefresh.current=true;let a=true;return (async()=>{try{await e.waitReady(),await e.awaitProbe();let i=U(e);if(e.accessTokenRef.current||e.authenticated){e.logger.info("Already authenticated, skipping initial refresh"),e.wallet&&!e.didInitialSession.current&&await n()!==void 0&&(e.didInitialSession.current=!0);return}if(!e.stateMachine.shouldAttemptRefresh(i)){e.logger.decision("Should attempt initial refresh?",!1,`State: ${e.stateMachine.getState()}`);return}e.logger.decision("Should attempt initial refresh?",!0,`State: ${e.stateMachine.getState()}`);let s=await r();if(!a)return;e.setAuthenticated(s),s&&e.wallet&&!e.didInitialSession.current&&await n()!==void 0&&(e.didInitialSession.current=!0);}catch(i){if(!a)return;let o=i;e.setAuthenticated(false),e.setError(o?.message||String(i)||"Unknown error");}})(),()=>{a=false;}},[e.wallet,e.meta.boundWallet,e.meta.refreshId,e.metaReady,r,n]);};var jt=e=>{react.useEffect(()=>{e.initResolvedRef.current||(async()=>{if(await e.ensureKeypair(),!e.wallet){e.initResolvedRef.current=true,e.initResolveRef.current?.();return}e.meta.boundWallet&&!x(e.meta.boundWallet,e.wallet)&&(e.rotateLock.current=(async()=>{e.accessTokenRef.current=null,e.setAuthenticated(false);})().catch(()=>{}).finally(()=>{e.rotateLock.current=null;}),e.rotateLock.current&&await e.rotateLock.current),e.initResolvedRef.current=true,e.initResolveRef.current?.();})();},[e]);};var Bt=(e,t)=>{let{session:r}=t;react.useEffect(()=>{(async()=>{if(e.authenticated&&e.wallet&&e.accessTokenRef.current&&!(e.meta.boundWallet&&!x(e.wallet,e.meta.boundWallet))&&!e.didInitialSession.current)try{e.logger.flow("session","Calling session after authentication"),await r()!==void 0&&(e.didInitialSession.current=!0);}catch(n){let a=n;e.setError(a?.message||String(n));}})();},[e.authenticated,e.wallet,e.meta.boundWallet,r]);};var Ft=e=>{react.useEffect(()=>{e.wallet&&e.authWalletRef.current&&!x(e.wallet,e.authWalletRef.current)&&(e.logger.warn("Wallet mismatch detected, clearing auth and proof",{current:e.wallet,authWallet:e.authWalletRef.current}),e.accessTokenRef.current=null,e.setAuthenticated(false),e.proofRef.current=null);},[e.wallet,e.authWalletRef.current]);};var Vt=(e,t)=>{let{refresh:r,session:n}=t;react.useEffect(()=>{let o=()=>{let u=Math.floor(Date.now()/1e3),c=e.tokenExpRef.current,p=e.sessionExpiry,d=!!c&&c-u<=30&&c-u>0,g=!!p&&p-u<=3600&&p-u>0;return {tokenSoon:d,sessionSoon:g}},s=async()=>{try{if(!e.authenticated||!e.wallet||e.meta.boundWallet&&!x(e.wallet,e.meta.boundWallet))return;let{tokenSoon:u,sessionSoon:c}=o();(u||c)&&(e.logger.info("Refreshing on focus",{tokenSoon:u,sessionSoon:c}),await r()&&c&&await n());}catch{}},l=async()=>{document.visibilityState==="visible"&&await s();};return window.addEventListener("focus",s),document.addEventListener("visibilitychange",l),()=>{window.removeEventListener("focus",s),document.removeEventListener("visibilitychange",l);}},[e,e.sessionExpiry,r,n]);};var zr=(e,t)=>{let{refresh:r,session:n,attemptRegister:a,setProofFromAdapterToken:i,proofProp:o}=t;Ht(e),$t(e),Ot(e,{attemptRegister:a,setProofFromAdapterToken:i}),Nt(e,{proofProp:o,attemptRegister:a}),Ut(e,{refresh:r,session:n}),jt(e),Bt(e,{session:n}),Ft(e),Vt(e,{refresh:r,session:n});};var Xr=react.createContext(void 0),Ro=e=>{let t=Or(e),{refresh:r,attemptRegister:n,setProofFromAdapterToken:a}=Ur(t),i=Br(t,r),{session:o}=Gr(t,i);zr(t,{refresh:r,session:o,attemptRegister:n,setProofFromAdapterToken:a,proofProp:e.proof});let s=react.useMemo(()=>({get:(l,u)=>i("GET",l,void 0,u),post:(l,u,c)=>i("POST",l,u,c),session:o,refresh:r,authenticated:t.authenticated,loading:t.loadingCount>0,error:t.error,allowed:t.allowed,sessionExpiry:t.sessionExpiry,sessionData:t.sessionData,wallet:t.wallet}),[i,o,r,t.authenticated,t.loadingCount,t.error,t.allowed,t.sessionExpiry,t.sessionData,t.wallet]);return jsxRuntime.jsx(Xr.Provider,{value:s,children:e.children})},ko=e=>jsxRuntime.jsx(It,{clientId:e.clientId,children:jsxRuntime.jsx(Ro,{...e})}),Eo=()=>{let e=react.useContext(Xr);if(!e)throw new Error("useSunbreak must be used within a SunbreakProvider");return e};var fc="0.2.2";
+
+exports.SunbreakProvider = ko;
+exports.useSunbreak = Eo;
+exports.version = fc;

package/dist/index.d.cts

@@ -1,19 +1,61 @@
-import React from 'react';
-import { SessionResp, Proof, ProviderAdapter } from '@tdfc/sunbreak-core';
-export { Ed25519Proof, Eip191Proof, Proof, ProviderAdapter, ProviderIssuer, ProviderJwtProof, SessionMetadata, SessionResp, SiweProof, SunbreakClientEvents, SunbreakClientState, SunbreakConfig, SunbreakMetaHeader, isEvmAddress, normalizeWallet, walletsMatch } from '@tdfc/sunbreak-core';
+import React$1 from 'react';
 
-interface SunbreakProviderProps {
-    children: React.ReactNode;
-    clientId: string;
-    baseUrl?: string;
-    base?: string;
-    wallet?: string;
-    proof?: Proof | null;
-    providerAdapter?: ProviderAdapter;
-    debug?: boolean;
-    fetchImpl?: typeof fetch;
-    timeoutMs?: number;
-    refreshDeps?: unknown[];
+type ProviderJwtProof = {
+    method: "provider_jwt";
+    issuer: "privy";
+    token: string;
+    meta: {
+        app_id: string;
+    };
+} | {
+    method: "provider_jwt";
+    issuer: "dynamic";
+    token: string;
+    meta: {
+        env_id: string;
+        expected_aud?: string;
+    };
+} | {
+    method: "provider_jwt";
+    issuer: "custom";
+    token: string;
+    meta: Record<string, unknown>;
+};
+type SiweProof = {
+    method: "siwe";
+    message: string;
+    signature: string;
+};
+type Eip191Proof = {
+    method: "eip191";
+    message: string;
+    signature: string;
+};
+type Ed25519Proof = {
+    method: "ed25519";
+    messageBase64: string;
+    signatureBase64: string;
+};
+type Proof = ProviderJwtProof | SiweProof | Eip191Proof | Ed25519Proof;
+type ProviderAdapter = {
+    name: "privy";
+    getToken: () => Promise<string | null | undefined>;
+    appId: string;
+} | {
+    name: "dynamic";
+    getToken: () => Promise<string | null | undefined>;
+    envId: string;
+    expectedAud?: string;
+} | {
+    name: "custom";
+    getToken: () => Promise<string | null | undefined>;
+    meta: Record<string, unknown>;
+};
+interface SessionResp {
+    allowed: boolean;
+    expiry: number;
+    country: string;
+    wallet: string;
 }
 interface SunbreakContextType {
     get: <T = unknown>(path: string, opts?: RequestInit) => Promise<T | undefined>;
@@ -23,15 +65,27 @@ interface SunbreakContextType {
     authenticated: boolean;
     loading: boolean;
     error: string | null;
-    errorDetail?: Error;
     allowed: boolean | null;
     sessionExpiry: number | null;
     sessionData: SessionResp | null;
     wallet?: string;
 }
-declare const SunbreakProvider: React.FC<SunbreakProviderProps>;
+interface SunbreakProviderProps {
+    children: React.ReactNode;
+    clientId: string;
+    wallet?: string;
+    base?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    proof?: Proof | null;
+    providerAdapter?: ProviderAdapter;
+    refreshDeps?: unknown[];
+    debug?: boolean;
+}
+
+declare const SunbreakProvider: React$1.FC<SunbreakProviderProps>;
 declare const useSunbreak: () => SunbreakContextType;
 
-declare const version = "0.2.0";
+declare const version: string;
 
-export { type SunbreakContextType as SunbreakContextProps, type SunbreakContextType, SunbreakProvider, type SunbreakProviderProps, useSunbreak, version };
+export { type Proof, type ProviderAdapter, type ProviderJwtProof, type SessionResp, type SunbreakContextType, SunbreakProvider, type SunbreakProviderProps, useSunbreak, version };

package/dist/index.d.ts

@@ -1,19 +1,61 @@
-import React from 'react';
-import { SessionResp, Proof, ProviderAdapter } from '@tdfc/sunbreak-core';
-export { Ed25519Proof, Eip191Proof, Proof, ProviderAdapter, ProviderIssuer, ProviderJwtProof, SessionMetadata, SessionResp, SiweProof, SunbreakClientEvents, SunbreakClientState, SunbreakConfig, SunbreakMetaHeader, isEvmAddress, normalizeWallet, walletsMatch } from '@tdfc/sunbreak-core';
+import React$1 from 'react';
 
-interface SunbreakProviderProps {
-    children: React.ReactNode;
-    clientId: string;
-    baseUrl?: string;
-    base?: string;
-    wallet?: string;
-    proof?: Proof | null;
-    providerAdapter?: ProviderAdapter;
-    debug?: boolean;
-    fetchImpl?: typeof fetch;
-    timeoutMs?: number;
-    refreshDeps?: unknown[];
+type ProviderJwtProof = {
+    method: "provider_jwt";
+    issuer: "privy";
+    token: string;
+    meta: {
+        app_id: string;
+    };
+} | {
+    method: "provider_jwt";
+    issuer: "dynamic";
+    token: string;
+    meta: {
+        env_id: string;
+        expected_aud?: string;
+    };
+} | {
+    method: "provider_jwt";
+    issuer: "custom";
+    token: string;
+    meta: Record<string, unknown>;
+};
+type SiweProof = {
+    method: "siwe";
+    message: string;
+    signature: string;
+};
+type Eip191Proof = {
+    method: "eip191";
+    message: string;
+    signature: string;
+};
+type Ed25519Proof = {
+    method: "ed25519";
+    messageBase64: string;
+    signatureBase64: string;
+};
+type Proof = ProviderJwtProof | SiweProof | Eip191Proof | Ed25519Proof;
+type ProviderAdapter = {
+    name: "privy";
+    getToken: () => Promise<string | null | undefined>;
+    appId: string;
+} | {
+    name: "dynamic";
+    getToken: () => Promise<string | null | undefined>;
+    envId: string;
+    expectedAud?: string;
+} | {
+    name: "custom";
+    getToken: () => Promise<string | null | undefined>;
+    meta: Record<string, unknown>;
+};
+interface SessionResp {
+    allowed: boolean;
+    expiry: number;
+    country: string;
+    wallet: string;
 }
 interface SunbreakContextType {
     get: <T = unknown>(path: string, opts?: RequestInit) => Promise<T | undefined>;
@@ -23,15 +65,27 @@ interface SunbreakContextType {
     authenticated: boolean;
     loading: boolean;
     error: string | null;
-    errorDetail?: Error;
     allowed: boolean | null;
     sessionExpiry: number | null;
     sessionData: SessionResp | null;
     wallet?: string;
 }
-declare const SunbreakProvider: React.FC<SunbreakProviderProps>;
+interface SunbreakProviderProps {
+    children: React.ReactNode;
+    clientId: string;
+    wallet?: string;
+    base?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    proof?: Proof | null;
+    providerAdapter?: ProviderAdapter;
+    refreshDeps?: unknown[];
+    debug?: boolean;
+}
+
+declare const SunbreakProvider: React$1.FC<SunbreakProviderProps>;
 declare const useSunbreak: () => SunbreakContextType;
 
-declare const version = "0.2.0";
+declare const version: string;
 
-export { type SunbreakContextType as SunbreakContextProps, type SunbreakContextType, SunbreakProvider, type SunbreakProviderProps, useSunbreak, version };
+export { type Proof, type ProviderAdapter, type ProviderJwtProof, type SessionResp, type SunbreakContextType, SunbreakProvider, type SunbreakProviderProps, useSunbreak, version };

package/dist/index.mjs

@@ -1,2 +1,22 @@
-import A,{createContext,useRef,useState,useEffect,useMemo,useContext}from'react';import {createStorageAdapter,SunbreakClient,makeProviderProofFromAdapter,computeProofFingerprint,walletsMatch}from'@tdfc/sunbreak-core';export{isEvmAddress,normalizeWallet,walletsMatch}from'@tdfc/sunbreak-core';import {jsx}from'react/jsx-runtime';var C;try{let e=globalThis;C=e.__sunbreak_page_refresh_guard??(e.__sunbreak_page_refresh_guard=new Map);}catch{C=new Map;}function $(e,r){try{let t=new URL(r).origin;return `${e}::${t}`}catch{return `${e}::${r}`}}function z(e,r,t,a=[],n={current:false}){let i=useRef(null);useEffect(()=>{if(!e||!r||!t)return;let o=`${r}:${t.name}`;if(i.current===o||e.registerCooldownActive()||e.isInActiveSession())return;let u=false;return (async()=>{try{if(await e.awaitProbeReady(),u||e.isInActiveSession()||e.shouldWaitForInitialRefresh(n.current))return;let c=t.getToken(),f=new Promise((b,k)=>setTimeout(()=>k(new Error("Provider timeout (30s)")),3e4)),g=await Promise.race([c,f]).catch(()=>null);if(await e.awaitKeyStable(),u||!g)return;let l=await makeProviderProofFromAdapter(t,g);await e.register(r,l)&&!u&&(i.current=o);}catch(c){!u&&e&&e.setError(c instanceof Error?c:new Error(String(c))),e.logger.error("Provider adapter auth failed",c);}})(),()=>{u=true;}},[e,r,t,JSON.stringify(a)]);}function J(e,r,t,a={current:false}){let n=useRef(null);useEffect(()=>{if(!e||!r||!t)return;let i=computeProofFingerprint(t);if(n.current===i)return;let o=e.getRegisteredProofId();if(e.authenticated&&o&&i!==o&&(t.method==="siwe"||t.method==="eip191")&&(e.logger.info("Detected credential change (SIWE/EIP-191 signature changed), clearing session"),e.handleProofChange(t)),e.isInActiveSession()||e.registerCooldownActive()||e.shouldWaitForInitialRefresh(a.current))return;let s=false;return (async()=>{try{if(await e.awaitProbeReady(),s)return;await e.register(r,t)&&!s&&(n.current=i);}catch(f){!s&&e&&e.setError(f instanceof Error?f:new Error(String(f))),e.logger.error("Manual proof auth failed",f);}})(),()=>{s=true;}},[e,r,t,e?.authenticated]);}function V(e,r,t,a,n={current:false},i={current:false}){let o=useRef(false),u=useRef(r);useEffect(()=>{let s=u.current;u.current=r,s!==r&&e&&e.probeCompleted!==false&&!e?.isRefreshInProgress()&&(o.current=false,i.current=false,n.current=false,C.delete($(t,a)));},[e,r,t,a,n]),useEffect(()=>{if(!e||o.current)return;o.current=true;let s=false;return (async()=>{try{if(await e.awaitProbeReady(),s||(n.current=!0,!e.shouldAttemptRefresh()))return;let f=$(t,a),g=C.get(f);if(g){let b=await g;if(s)return;b&&!i.current&&(i.current=!0,await e.session());return}let l=e.refresh();C.set(f,l);let d;try{d=await l;}catch(b){throw C.delete(f),b}if(s)return;d&&!i.current&&(i.current=!0,await e.session());}catch(f){!s&&e&&e.setError(f instanceof Error?f:new Error(String(f))),e.logger.warn("Initial refresh failed",f);}})(),()=>{s=true;}},[e,r,t,a]);}function X(e,r,t={current:false}){let a=useRef(false);useEffect(()=>{if(!e)return;let n=e.authenticated,i=a.current;if(a.current=n,!i&&n&&!t.current){if(!r||!e.getAccessToken())return;let o=e.getBoundWallet();if(o&&!walletsMatch(r,o))return;t.current=true;let u=false;return e.session().then(()=>{u||e.logger.info("Session data loaded after authentication");}).catch(s=>{u||(e&&e.setError(s instanceof Error?s:new Error(String(s))),e.logger.warn("Failed to load session after auth",s));}),()=>{u=true;}}n||(t.current=false);},[e,e?.authenticated,r]);}function H(e,r){let t=useRef(void 0);useEffect(()=>{if(!e)return;let a=t.current;t.current=r;let n=false;return (async()=>{try{if(a===void 0){r&&await e.notifyWalletChange(null,r);return}if(n)return;if(a&&r&&!walletsMatch(a,r)){await e.walletSwitch(a,r);return}if(a&&!r){if(await e.disconnect(),n)return;e.notifyWalletDisconnect();return}if(!a&&r){await e.notifyWalletChange(null,r);return}if(e.authenticated&&r){let o=e.getBoundWallet();if(o&&!walletsMatch(r,o)){if(e.logger.warn("Wallet mismatch detected, clearing auth",{current:r?.slice(0,8),bound:o?.slice(0,8)}),await e.disconnect(),n)return;await e.notifyWalletChange(o,r);}}}catch(o){n||e.logger.error("Wallet change failed",o);}})(),()=>{n=true;}},[e,r]);}function Q(e){useEffect(()=>{if(!e)return;let r=new AbortController,t=false,a=async()=>{if(!(t||r.signal.aborted))try{t=!0;let i=e.getState();if(!i.authenticated)return;let o=e.getBoundWallet(),u=e.getWallet();if(!u||o&&!walletsMatch(u,o))return;let s=Math.floor(Date.now()/1e3),c=30,f=3600,g=e.getTokenExpiry(),l=g?g-s<=c&&g-s>0:!1,d=i.session?.expiry,b=d?d-s<=f&&d-s>0:!1;if(l||b){if(r.signal.aborted)return;let k=await e.refresh();if(r.signal.aborted)return;k&&b&&await e.session();}}catch(i){r.signal.aborted||e.logger.error("Focus refresh failed",i);}finally{t=false;}},n=()=>{document.visibilityState==="visible"&&a();};return window.addEventListener("focus",a),document.addEventListener("visibilitychange",n),()=>{r.abort(),window.removeEventListener("focus",a),document.removeEventListener("visibilitychange",n);}},[e]);}function j(e){let{client:r,clientId:t,baseUrl:a,wallet:n,proof:i,providerAdapter:o,refreshDeps:u=[]}=e,s=useRef(false),c=useRef(false);z(r,n,o,u,s),J(r,n,i,s),V(r,n,t,a,s,c),X(r,n,c),H(r,n),Q(r);}var q=createContext(void 0),oe=({children:e,clientId:r,baseUrl:t,base:a,wallet:n,proof:i,providerAdapter:o,debug:u=false,fetchImpl:s,timeoutMs:c,refreshDeps:f=[]})=>{let g=t||a||"https://api.sunbreak.com",l=useRef(null),[d,b]=useState(null),[k,I]=useState(false),[O,D]=useState(0),[F,L]=useState(null),[v,N]=useState(null);useEffect(()=>{l.current&&l.current.updateConfig({wallet:n,providerAdapter:o,debug:u});},[d,n,o,u]),j({client:d,clientId:r,baseUrl:g,wallet:n,proof:i,providerAdapter:o,refreshDeps:f}),useEffect(()=>{let p=true;return (async()=>{let{adapter:y}=await createStorageAdapter(),h=new SunbreakClient({clientId:r,baseUrl:g,wallet:n,providerAdapter:o,debug:u,fetchImpl:s,timeoutMs:c},y);if(!p)return;l.current=h,b(h),h.on("stateChange",()=>{let P=h.getState();I(P.authenticated),D(P.loading),L(P.error),N(P.session);}),u&&h.on("policyChange",P=>{h.logger.info("Policy changed:",P);});let R=h.getState();I(R.authenticated),D(R.loading),L(R.error),N(R.session);try{await h.probe();}catch(P){h.logger.error("Probe initialization failed",P);}})(),()=>{p=false,l.current&&l.current.removeAllListeners();}},[]);let W=A.useCallback((p,E)=>{let y=l.current;return y?y.get(p,E):Promise.resolve(void 0)},[]),_=A.useCallback((p,E,y)=>{let h=l.current;return h?h.post(p,E,y):Promise.resolve(void 0)},[]),T=A.useCallback(()=>{let p=l.current;return p?p.session():Promise.resolve(void 0)},[]),M=A.useCallback(()=>{let p=l.current;return p?p.refresh():Promise.resolve(false)},[]),B=useMemo(()=>d?{get:W,post:_,session:T,refresh:M,authenticated:k,loading:O>0,error:F,errorDetail:d.getState().lastError,allowed:v?.allowed??null,sessionExpiry:v?.expiry??null,sessionData:v,wallet:n}:{get:W,post:_,session:T,refresh:M,authenticated:false,loading:false,error:null,errorDetail:void 0,allowed:null,sessionExpiry:null,sessionData:null,wallet:n},[d,k,O,F,v,n,W,_,T,M]);return jsx(q.Provider,{value:B,children:e})},se=()=>{let e=useContext(q);if(!e)throw new Error("useSunbreak must be used within a SunbreakProvider");return e};var he="0.2.0";
-export{oe as SunbreakProvider,se as useSunbreak,he as version};
+import { createContext, useContext, useState, useRef, useMemo, useEffect, useCallback } from 'react';
+import { jsx } from 'react/jsx-runtime';
+
+var bn=Object.defineProperty;var er=e=>{throw TypeError(e)};var Rn=(e,t,r)=>t in e?bn(e,t,{enumerable:true,configurable:true,writable:true,value:r}):e[t]=r;var O=(e,t,r)=>Rn(e,typeof t!="symbol"?t+"":t,r),tr=(e,t,r)=>t.has(e)||er("Cannot "+r);var m=(e,t,r)=>(tr(e,t,"read from private field"),r?r.call(e):t.get(e)),B=(e,t,r)=>t.has(e)?er("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,r),F=(e,t,r,n)=>(tr(e,t,"write to private field"),t.set(e,r),r);var ze=e=>{let t=5381;for(let r=0;r<e.length;r++)t=t*33^e.charCodeAt(r);return (t>>>0).toString(16).padStart(8,"0")},Ce=e=>{try{return e.method==="provider_jwt"?`${e.issuer}:${ze(e.token)}`:e.method==="siwe"||e.method==="eip191"?`${e.method}:${ze(e.signature)}`:e.method==="ed25519"?`ed25519:${ze(e.signatureBase64)}`:null}catch{return null}},ye=async(e,t,r)=>{switch(e.name){case "custom":return {method:"provider_jwt",issuer:"custom",token:t,meta:r||{}};case "privy":return {method:"provider_jwt",issuer:"privy",token:t,meta:{app_id:e.appId}};case "dynamic":return e.expectedAud?{method:"provider_jwt",issuer:"dynamic",token:t,meta:{env_id:e.envId,expected_aud:e.expectedAud}}:{method:"provider_jwt",issuer:"dynamic",token:t,meta:{env_id:e.envId}};default:throw new Error(`Unknown adapter: ${e}`)}};var kn="sunbreak-kv",Ie="kv",Xe="sunbreak_dpop_meta_v1",I="sunbreak_dpop_key_v1",Te="ES256",E="P-256",We=e=>`${Xe}:${e}`,rr=()=>new Promise((e,t)=>{let r=indexedDB.open(kn,1);r.onupgradeneeded=()=>r.result.createObjectStore(Ie),r.onsuccess=()=>e(r.result),r.onerror=()=>t(r.error);}),T=async e=>{try{let t=await rr();return await new Promise((r,n)=>{let i=t.transaction(Ie,"readonly").objectStore(Ie).get(e);i.onsuccess=()=>r(i.result),i.onerror=()=>n(i.error);})}catch{return}},R=async(e,t)=>{let r=await rr();await new Promise((n,a)=>{let o=r.transaction(Ie,"readwrite").objectStore(Ie).put(t,e);o.onsuccess=()=>n(),o.onerror=()=>a(o.error);});};var En=e=>{let t=new URL(e);if(t.protocol!=="https:"&&t.hostname!=="localhost"&&t.hostname!=="127.0.0.1")throw new Error("Sunbreak: insecure base URL");return t.hash="",t.origin},Pn=e=>e.replace(/\/+$/,""),yt=e=>{let t=Pn(e);return En(t)};function bt(e){let t=new URL(e.baseUrl),r=t.host,n=e.meta.lastHost??null,a=vn(n);return e.setLastHost(a),t.host=`${a}.${r}`,t.origin}var vn=e=>{for(let t=0;t<St.length;t++){let r=St[Math.floor(Math.random()*St.length)].toLowerCase();if(r!==e)return r}return "alpha"},St=["Alpha","Bravo","Charlie","Delta","Echo","Foxtrot","Golf","Hotel","India","Juliett","Kilo","Lima","Mike","November","Oscar","Papa","Quebec","Romeo","Sierra","Tango","Uniform","Victor","Whiskey","X-ray","Yankee","Zulu"];var V=(e,t)=>{let r={clientId:e.clientId,wallet:e.wallet,ifPolicyHash:e.meta.lastPolicyHash||void 0,ifPolicyProof:e.meta.lastPolicyProof||void 0,...t};Object.keys(r).forEach(a=>r[a]===void 0&&delete r[a]);let n=JSON.stringify(r);return btoa(n)};var An=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","via"]),xn=new Set(["user-agent","referer","origin","host","content-length","sec-fetch-site","sec-fetch-mode","sec-fetch-dest","sec-fetch-user","sec-ch-ua","sec-ch-ua-mobile","sec-ch-ua-platform","sec-ch-ua-platform-version","sec-ch-ua-full-version","sec-ch-ua-arch","sec-ch-ua-model","sec-ch-ua-bitness","cookie","set-cookie"]),Kn=new Set(["dpop","x-sunbreak-meta"]),Cn=64,nr=2048,In=64;function Rt(e){let t={};if(!e)return t;let r=e instanceof Headers?Array.from(e.entries()):Object.entries(e),n=0;for(let[a,i]of r){if(n>=In)break;if(a==null||i==null)continue;let o=String(a).toLowerCase().trim();if(!o||o.length>Cn||An.has(o)||xn.has(o)||Kn.has(o))continue;let s=String(i);s.length>nr&&(s=s.slice(0,nr)),t[o]=s,n++;}return t}var ne=new TextEncoder,Se=new TextDecoder;function or(...e){let t=e.reduce((a,{length:i})=>a+i,0),r=new Uint8Array(t),n=0;for(let a of e)r.set(a,n),n+=a.length;return r}function ar(e){if(Uint8Array.prototype.toBase64)return e.toBase64();let t=32768,r=[];for(let n=0;n<e.length;n+=t)r.push(String.fromCharCode.apply(null,e.subarray(n,n+t)));return btoa(r.join(""))}function ir(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}function sr(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(typeof e=="string"?e:Se.decode(e),{alphabet:"base64url"});let t=e;t instanceof Uint8Array&&(t=Se.decode(t)),t=t.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"");try{return ir(t)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}}function Ye(e){let t=e;return typeof t=="string"&&(t=ne.encode(t)),Uint8Array.prototype.toBase64?t.toBase64({alphabet:"base64url",omitPadding:true}):ar(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}var fe=class extends Error{constructor(r,n){super(r,n);O(this,"code","ERR_JOSE_GENERIC");this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor);}};O(fe,"code","ERR_JOSE_GENERIC");var L=class extends fe{constructor(){super(...arguments);O(this,"code","ERR_JOSE_NOT_SUPPORTED");}};O(L,"code","ERR_JOSE_NOT_SUPPORTED");var oe=class extends fe{constructor(){super(...arguments);O(this,"code","ERR_JWS_INVALID");}};O(oe,"code","ERR_JWS_INVALID");var _e=class extends fe{constructor(){super(...arguments);O(this,"code","ERR_JWT_INVALID");}};O(_e,"code","ERR_JWT_INVALID");var cr,lr,kt=class extends(lr=fe,cr=Symbol.asyncIterator,lr){constructor(r="multiple matching keys found in the JSON Web Key Set",n){super(r,n);O(this,cr);O(this,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");}};O(kt,"code","ERR_JWKS_MULTIPLE_MATCHING_KEYS");function Y(e,t="algorithm.name"){return new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`)}function be(e,t){return e.name===t}function Et(e){return parseInt(e.name.slice(4),10)}function _n(e){switch(e){case "ES256":return "P-256";case "ES384":return "P-384";case "ES512":return "P-521";default:throw new Error("unreachable")}}function Jn(e,t){if(!e.usages.includes(t))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function ur(e,t,r){switch(t){case "HS256":case "HS384":case "HS512":{if(!be(e.algorithm,"HMAC"))throw Y("HMAC");let n=parseInt(t.slice(2),10);if(Et(e.algorithm.hash)!==n)throw Y(`SHA-${n}`,"algorithm.hash");break}case "RS256":case "RS384":case "RS512":{if(!be(e.algorithm,"RSASSA-PKCS1-v1_5"))throw Y("RSASSA-PKCS1-v1_5");let n=parseInt(t.slice(2),10);if(Et(e.algorithm.hash)!==n)throw Y(`SHA-${n}`,"algorithm.hash");break}case "PS256":case "PS384":case "PS512":{if(!be(e.algorithm,"RSA-PSS"))throw Y("RSA-PSS");let n=parseInt(t.slice(2),10);if(Et(e.algorithm.hash)!==n)throw Y(`SHA-${n}`,"algorithm.hash");break}case "Ed25519":case "EdDSA":{if(!be(e.algorithm,"Ed25519"))throw Y("Ed25519");break}case "ML-DSA-44":case "ML-DSA-65":case "ML-DSA-87":{if(!be(e.algorithm,t))throw Y(t);break}case "ES256":case "ES384":case "ES512":{if(!be(e.algorithm,"ECDSA"))throw Y("ECDSA");let n=_n(t);if(e.algorithm.namedCurve!==n)throw Y(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}Jn(e,r);}function fr(e,t,...r){if(r=r.filter(Boolean),r.length>2){let n=r.pop();e+=`one of type ${r.join(", ")}, or ${n}.`;}else r.length===2?e+=`one of type ${r[0]} or ${r[1]}.`:e+=`of type ${r[0]}.`;return t==null?e+=` Received ${t}`:typeof t=="function"&&t.name?e+=` Received function ${t.name}`:typeof t=="object"&&t!=null&&t.constructor?.name&&(e+=` Received an instance of ${t.constructor.name}`),e}var dr=(e,...t)=>fr("Key must be ",e,...t);function Pt(e,t,...r){return fr(`Key for the ${e} algorithm must be `,t,...r)}function vt(e){return e?.[Symbol.toStringTag]==="CryptoKey"}function At(e){return e?.[Symbol.toStringTag]==="KeyObject"}var xt=e=>vt(e)||At(e);var pr=(...e)=>{let t=e.filter(Boolean);if(t.length===0||t.length===1)return  true;let r;for(let n of t){let a=Object.keys(n);if(!r||r.size===0){r=new Set(a);continue}for(let i of a){if(r.has(i))return  false;r.add(i);}}return  true};function Dn(e){return typeof e=="object"&&e!==null}var Ze=e=>{if(!Dn(e)||Object.prototype.toString.call(e)!=="[object Object]")return  false;if(Object.getPrototypeOf(e)===null)return  true;let t=e;for(;Object.getPrototypeOf(t)!==null;)t=Object.getPrototypeOf(t);return Object.getPrototypeOf(e)===t};var hr=(e,t)=>{if(e.startsWith("RS")||e.startsWith("PS")){let{modulusLength:r}=t.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}};function Mn(e){let t,r;switch(e.kty){case "AKP":{switch(e.alg){case "ML-DSA-44":case "ML-DSA-65":case "ML-DSA-87":t={name:e.alg},r=e.priv?["sign"]:["verify"];break;default:throw new L('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case "RSA":{switch(e.alg){case "PS256":case "PS384":case "PS512":t={name:"RSA-PSS",hash:`SHA-${e.alg.slice(-3)}`},r=e.d?["sign"]:["verify"];break;case "RS256":case "RS384":case "RS512":t={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${e.alg.slice(-3)}`},r=e.d?["sign"]:["verify"];break;case "RSA-OAEP":case "RSA-OAEP-256":case "RSA-OAEP-384":case "RSA-OAEP-512":t={name:"RSA-OAEP",hash:`SHA-${parseInt(e.alg.slice(-3),10)||1}`},r=e.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new L('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case "EC":{switch(e.alg){case "ES256":t={name:"ECDSA",namedCurve:"P-256"},r=e.d?["sign"]:["verify"];break;case "ES384":t={name:"ECDSA",namedCurve:"P-384"},r=e.d?["sign"]:["verify"];break;case "ES512":t={name:"ECDSA",namedCurve:"P-521"},r=e.d?["sign"]:["verify"];break;case "ECDH-ES":case "ECDH-ES+A128KW":case "ECDH-ES+A192KW":case "ECDH-ES+A256KW":t={name:"ECDH",namedCurve:e.crv},r=e.d?["deriveBits"]:[];break;default:throw new L('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case "OKP":{switch(e.alg){case "Ed25519":case "EdDSA":t={name:"Ed25519"},r=e.d?["sign"]:["verify"];break;case "ECDH-ES":case "ECDH-ES+A128KW":case "ECDH-ES+A192KW":case "ECDH-ES+A256KW":t={name:e.crv},r=e.d?["deriveBits"]:[];break;default:throw new L('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}default:throw new L('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return {algorithm:t,keyUsages:r}}var mr=async e=>{if(!e.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:t,keyUsages:r}=Mn(e),n={...e};return n.kty!=="AKP"&&delete n.alg,delete n.use,crypto.subtle.importKey("jwk",n,t,e.ext??!(e.d||e.priv),e.key_ops??r)};var gr=(e,t,r,n,a)=>{if(a.crit!==void 0&&n?.crit===void 0)throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return new Set;if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(o=>typeof o!="string"||o.length===0))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let i;r!==void 0?i=new Map([...Object.entries(r),...t.entries()]):i=t;for(let o of n.crit){if(!i.has(o))throw new L(`Extension Header Parameter "${o}" is not recognized`);if(a[o]===void 0)throw new e(`Extension Header Parameter "${o}" is missing`);if(i.get(o)&&n[o]===void 0)throw new e(`Extension Header Parameter "${o}" MUST be integrity protected`)}return new Set(n.crit)};function Je(e){return Ze(e)&&typeof e.kty=="string"}function wr(e){return e.kty!=="oct"&&(e.kty==="AKP"&&typeof e.priv=="string"||typeof e.d=="string")}function yr(e){return e.kty!=="oct"&&typeof e.d>"u"&&typeof e.priv>"u"}function Sr(e){return e.kty==="oct"&&typeof e.k=="string"}var Re,br=async(e,t,r,n=false)=>{Re||(Re=new WeakMap);let a=Re.get(e);if(a?.[r])return a[r];let i=await mr({...t,alg:r});return n&&Object.freeze(e),a?a[r]=i:Re.set(e,{[r]:i}),i},Hn=(e,t)=>{Re||(Re=new WeakMap);let r=Re.get(e);if(r?.[t])return r[t];let n=e.type==="public",a=!!n,i;if(e.asymmetricKeyType==="x25519"){switch(t){case "ECDH-ES":case "ECDH-ES+A128KW":case "ECDH-ES+A192KW":case "ECDH-ES+A256KW":break;default:throw new TypeError("given KeyObject instance cannot be used for this algorithm")}i=e.toCryptoKey(e.asymmetricKeyType,a,n?[]:["deriveBits"]);}if(e.asymmetricKeyType==="ed25519"){if(t!=="EdDSA"&&t!=="Ed25519")throw new TypeError("given KeyObject instance cannot be used for this algorithm");i=e.toCryptoKey(e.asymmetricKeyType,a,[n?"verify":"sign"]);}switch(e.asymmetricKeyType){case "ml-dsa-44":case "ml-dsa-65":case "ml-dsa-87":{if(t!==e.asymmetricKeyType.toUpperCase())throw new TypeError("given KeyObject instance cannot be used for this algorithm");i=e.toCryptoKey(e.asymmetricKeyType,a,[n?"verify":"sign"]);}}if(e.asymmetricKeyType==="rsa"){let o;switch(t){case "RSA-OAEP":o="SHA-1";break;case "RS256":case "PS256":case "RSA-OAEP-256":o="SHA-256";break;case "RS384":case "PS384":case "RSA-OAEP-384":o="SHA-384";break;case "RS512":case "PS512":case "RSA-OAEP-512":o="SHA-512";break;default:throw new TypeError("given KeyObject instance cannot be used for this algorithm")}if(t.startsWith("RSA-OAEP"))return e.toCryptoKey({name:"RSA-OAEP",hash:o},a,n?["encrypt"]:["decrypt"]);i=e.toCryptoKey({name:t.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:o},a,[n?"verify":"sign"]);}if(e.asymmetricKeyType==="ec"){let s=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(e.asymmetricKeyDetails?.namedCurve);if(!s)throw new TypeError("given KeyObject instance cannot be used for this algorithm");t==="ES256"&&s==="P-256"&&(i=e.toCryptoKey({name:"ECDSA",namedCurve:s},a,[n?"verify":"sign"])),t==="ES384"&&s==="P-384"&&(i=e.toCryptoKey({name:"ECDSA",namedCurve:s},a,[n?"verify":"sign"])),t==="ES512"&&s==="P-521"&&(i=e.toCryptoKey({name:"ECDSA",namedCurve:s},a,[n?"verify":"sign"])),t.startsWith("ECDH-ES")&&(i=e.toCryptoKey({name:"ECDH",namedCurve:s},a,n?[]:["deriveBits"]));}if(!i)throw new TypeError("given KeyObject instance cannot be used for this algorithm");return r?r[t]=i:Re.set(e,{[t]:i}),i},Rr=async(e,t)=>{if(e instanceof Uint8Array||vt(e))return e;if(At(e)){if(e.type==="secret")return e.export();if("toCryptoKey"in e&&typeof e.toCryptoKey=="function")try{return Hn(e,t)}catch(n){if(n instanceof TypeError)throw n}let r=e.export({format:"jwk"});return br(e,r,t)}if(Je(e))return e.k?sr(e.k):br(e,e,t,true);throw new Error("unreachable")};var ke=e=>e?.[Symbol.toStringTag],Kt=(e,t,r)=>{if(t.use!==void 0){let n;switch(r){case "sign":case "verify":n="sig";break;case "encrypt":case "decrypt":n="enc";break}if(t.use!==n)throw new TypeError(`Invalid key for this operation, its "use" must be "${n}" when present`)}if(t.alg!==void 0&&t.alg!==e)throw new TypeError(`Invalid key for this operation, its "alg" must be "${e}" when present`);if(Array.isArray(t.key_ops)){let n;switch(true){case(r==="sign"):case e==="dir":case e.includes("CBC-HS"):n=r;break;case e.startsWith("PBES2"):n="deriveBits";break;case /^A\d{3}(?:GCM)?(?:KW)?$/.test(e):!e.includes("GCM")&&e.endsWith("KW")?n="unwrapKey":n=r;break;case(r==="encrypt"):n="wrapKey";break;case r==="decrypt":n=e.startsWith("RSA")?"unwrapKey":"deriveBits";break}if(n&&t.key_ops?.includes?.(n)===false)throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${n}" when present`)}return  true},$n=(e,t,r)=>{if(!(t instanceof Uint8Array)){if(Je(t)){if(Sr(t)&&Kt(e,t,r))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!xt(t))throw new TypeError(Pt(e,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if(t.type!=="secret")throw new TypeError(`${ke(t)} instances for symmetric algorithms must be of type "secret"`)}},On=(e,t,r)=>{if(Je(t))switch(r){case "decrypt":case "sign":if(wr(t)&&Kt(e,t,r))return;throw new TypeError("JSON Web Key for this operation be a private JWK");case "encrypt":case "verify":if(yr(t)&&Kt(e,t,r))return;throw new TypeError("JSON Web Key for this operation be a public JWK")}if(!xt(t))throw new TypeError(Pt(e,t,"CryptoKey","KeyObject","JSON Web Key"));if(t.type==="secret")throw new TypeError(`${ke(t)} instances for asymmetric algorithms must not be of type "secret"`);if(t.type==="public")switch(r){case "sign":throw new TypeError(`${ke(t)} instances for asymmetric algorithm signing must be of type "private"`);case "decrypt":throw new TypeError(`${ke(t)} instances for asymmetric algorithm decryption must be of type "private"`);}if(t.type==="private")switch(r){case "verify":throw new TypeError(`${ke(t)} instances for asymmetric algorithm verifying must be of type "public"`);case "encrypt":throw new TypeError(`${ke(t)} instances for asymmetric algorithm encryption must be of type "public"`);}},kr=(e,t,r)=>{e.startsWith("HS")||e==="dir"||e.startsWith("PBES2")||/^A(?:128|192|256)(?:GCM)?(?:KW)?$/.test(e)||/^A(?:128|192|256)CBC-HS(?:256|384|512)$/.test(e)?$n(e,t,r):On(e,t,r);};var Er=(e,t)=>{let r=`SHA-${e.slice(-3)}`;switch(e){case "HS256":case "HS384":case "HS512":return {hash:r,name:"HMAC"};case "PS256":case "PS384":case "PS512":return {hash:r,name:"RSA-PSS",saltLength:parseInt(e.slice(-3),10)>>3};case "RS256":case "RS384":case "RS512":return {hash:r,name:"RSASSA-PKCS1-v1_5"};case "ES256":case "ES384":case "ES512":return {hash:r,name:"ECDSA",namedCurve:t.namedCurve};case "Ed25519":case "EdDSA":return {name:"Ed25519"};case "ML-DSA-44":case "ML-DSA-65":case "ML-DSA-87":return {name:e};default:throw new L(`alg ${e} is not supported either by JOSE or your javascript runtime`)}};var Pr=async(e,t,r)=>{if(t instanceof Uint8Array){if(!e.startsWith("HS"))throw new TypeError(dr(t,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",t,{hash:`SHA-${e.slice(-3)}`,name:"HMAC"},false,[r])}return ur(t,e,r),t};var ie=e=>Math.floor(e.getTime()/1e3);var Nn=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,Qe=e=>{let t=Nn.exec(e);if(!t||t[4]&&t[1])throw new TypeError("Invalid time period format");let r=parseFloat(t[2]),n=t[3].toLowerCase(),a;switch(n){case "sec":case "secs":case "second":case "seconds":case "s":a=Math.round(r);break;case "minute":case "minutes":case "min":case "mins":case "m":a=Math.round(r*60);break;case "hour":case "hours":case "hr":case "hrs":case "h":a=Math.round(r*3600);break;case "day":case "days":case "d":a=Math.round(r*86400);break;case "week":case "weeks":case "w":a=Math.round(r*604800);break;default:a=Math.round(r*31557600);break}return t[1]==="-"||t[4]==="ago"?-a:a};function de(e,t){if(!Number.isFinite(t))throw new TypeError(`Invalid ${e} input`);return t}var A,et=class{constructor(t){B(this,A);if(!Ze(t))throw new TypeError("JWT Claims Set MUST be an object");F(this,A,structuredClone(t));}data(){return ne.encode(JSON.stringify(m(this,A)))}get iss(){return m(this,A).iss}set iss(t){m(this,A).iss=t;}get sub(){return m(this,A).sub}set sub(t){m(this,A).sub=t;}get aud(){return m(this,A).aud}set aud(t){m(this,A).aud=t;}set jti(t){m(this,A).jti=t;}set nbf(t){typeof t=="number"?m(this,A).nbf=de("setNotBefore",t):t instanceof Date?m(this,A).nbf=de("setNotBefore",ie(t)):m(this,A).nbf=ie(new Date)+Qe(t);}set exp(t){typeof t=="number"?m(this,A).exp=de("setExpirationTime",t):t instanceof Date?m(this,A).exp=de("setExpirationTime",ie(t)):m(this,A).exp=ie(new Date)+Qe(t);}set iat(t){typeof t>"u"?m(this,A).iat=ie(new Date):t instanceof Date?m(this,A).iat=de("setIssuedAt",ie(t)):typeof t=="string"?m(this,A).iat=de("setIssuedAt",ie(new Date)+Qe(t)):m(this,A).iat=de("setIssuedAt",t);}};A=new WeakMap;var vr=async(e,t,r)=>{let n=await Pr(e,t,"sign");hr(e,n);let a=await crypto.subtle.sign(Er(e,n.algorithm),n,r);return new Uint8Array(a)};var De,H,Z,tt=class{constructor(t){B(this,De);B(this,H);B(this,Z);if(!(t instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");F(this,De,t);}setProtectedHeader(t){if(m(this,H))throw new TypeError("setProtectedHeader can only be called once");return F(this,H,t),this}setUnprotectedHeader(t){if(m(this,Z))throw new TypeError("setUnprotectedHeader can only be called once");return F(this,Z,t),this}async sign(t,r){if(!m(this,H)&&!m(this,Z))throw new oe("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!pr(m(this,H),m(this,Z)))throw new oe("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let n={...m(this,H),...m(this,Z)},a=gr(oe,new Map([["b64",true]]),r?.crit,m(this,H),n),i=true;if(a.has("b64")&&(i=m(this,H).b64,typeof i!="boolean"))throw new oe('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:o}=n;if(typeof o!="string"||!o)throw new oe('JWS "alg" (Algorithm) Header Parameter missing or invalid');kr(o,t,"sign");let s=m(this,De);i&&(s=ne.encode(Ye(s)));let l;m(this,H)?l=ne.encode(Ye(JSON.stringify(m(this,H)))):l=ne.encode("");let u=or(l,ne.encode("."),s),c=await Rr(t,o),p=await vr(o,c,u),d={signature:Ye(p),payload:""};return i&&(d.payload=Se.decode(s)),m(this,Z)&&(d.header=m(this,Z)),m(this,H)&&(d.protected=Se.decode(l)),d}};De=new WeakMap,H=new WeakMap,Z=new WeakMap;var Ee,rt=class{constructor(t){B(this,Ee);F(this,Ee,new tt(t));}setProtectedHeader(t){return m(this,Ee).setProtectedHeader(t),this}async sign(t,r){let n=await m(this,Ee).sign(t,r);if(n.payload===void 0)throw new TypeError("use the flattened module for creating JWS with b64: false");return `${n.protected}.${n.payload}.${n.signature}`}};Ee=new WeakMap;var se,N,pe=class{constructor(t={}){B(this,se);B(this,N);F(this,N,new et(t));}setIssuer(t){return m(this,N).iss=t,this}setSubject(t){return m(this,N).sub=t,this}setAudience(t){return m(this,N).aud=t,this}setJti(t){return m(this,N).jti=t,this}setNotBefore(t){return m(this,N).nbf=t,this}setExpirationTime(t){return m(this,N).exp=t,this}setIssuedAt(t){return m(this,N).iat=t,this}setProtectedHeader(t){return F(this,se,t),this}async sign(t,r){let n=new rt(m(this,N).data());if(n.setProtectedHeader(m(this,se)),Array.isArray(m(this,se)?.crit)&&m(this,se).crit.includes("b64")&&m(this,se).b64===false)throw new _e("JWTs MUST NOT use unencoded payload");return n.sign(t,r)}};se=new WeakMap,N=new WeakMap;var Un=e=>btoa(String.fromCharCode(...new Uint8Array(e))).replaceAll("+","-").replaceAll("/","_").replaceAll("=",""),nt=async e=>{let t=new TextEncoder().encode(e),r=await crypto.subtle.digest("SHA-256",t);return Un(r)},G=async e=>{let{method:t,url:r,nonce:n,ath:a,privateKey:i,publicJwk:o}=e,s={htm:t.toUpperCase(),htu:r,jti:crypto.randomUUID(),iat:Math.floor(Date.now()/1e3)};return n&&(s.nonce=n),a&&(s.ath=a),await new pe(s).setProtectedHeader({alg:"ES256",typ:"dpop+jwt",jwk:o}).sign(i)};var $=async e=>{let t={crv:e.crv,kty:"EC",x:e.x,y:e.y},r=JSON.stringify(t),n=new TextEncoder().encode(r),a=await crypto.subtle.digest("SHA-256",n);return btoa(String.fromCharCode(...new Uint8Array(a))).replaceAll("+","-").replaceAll("/","_").replaceAll("=","")};async function he(e){let{rootPrivateKey:t,rootPublicJwk:r,childJkt:n,clientId:a,sid:i,ttlSec:o=300}=e,s=Math.floor(Date.now()/1e3),l=s+Math.max(60,Math.min(o,3600)),u={child_jkt:n,client_id:a,aud:"issuer",iat:s,exp:l,jti:crypto.randomUUID()};return i&&(u.sid=i),await new pe(u).setProtectedHeader({alg:"ES256",typ:"pode+jwt",jwk:r}).sign(t)}function Me(e,t=300){return e.replace(/<[^>]*>/g,"").slice(0,t)}async function Le(e){let t=e.status,r=Array.from(e.headers.keys()).some(s=>{let l=s.toLowerCase();return l.startsWith("x-amzn-")&&l.includes("waf")}),n,a,i=e.headers.get("content-type")||"";if(i.includes("application/json"))try{let s=await e.clone().json();n=typeof s?.error=="string"?s.error:void 0,a=typeof s?.detail=="string"?s.detail:void 0;}catch{}let o=t===403&&!r&&!i.includes("application/json");return {status:t,code:n,detail:a,edgeBlocked:r,originBlocked:o}}function me(e,t){let r=new Error(e);return r.status=t.status,r.code=t.code,r.detail=t.detail,r.edgeBlocked=t.edgeBlocked,r.originBlocked=t.originBlocked,r}var ot=e=>/^0x[a-fA-F0-9]{40}$/.test(e),ce=e=>ot(e)?e.toLowerCase():e,x=(e,t)=>!e||!t?false:ot(e)&&ot(t)?e.toLowerCase()===t.toLowerCase():e===t;var Pe={boundWallet:null,clientId:null,jkt:null,refreshId:null,lastPolicyHash:null,lastPolicyProof:null,lastHost:null,rootJkt:null,registeredProofId:null},Ct=createContext(void 0);function Ir(e){try{return JSON.parse(localStorage.getItem(e)||"null")??Pe}catch{return Pe}}function Fn(e,t){try{localStorage.setItem(e,JSON.stringify(t));}catch{}}var It=({children:e,clientId:t})=>{let[r,n]=useState(Pe),a=useRef(false),[i,o]=useState(false),s=useMemo(()=>We(t),[t]);useEffect(()=>{let h=true;return (async()=>{let y=await T(s)??await T(Xe)??Ir(s);h&&(n({...Pe,...y}),a.current=true,o(true));})(),()=>{h=false;}},[s]),useEffect(()=>{a.current&&(async()=>(await R(s,r),Fn(s,r)))();},[r,s]);let l=useCallback(h=>n(f=>({...f,refreshId:h})),[]),u=useCallback(h=>n(f=>({...f,lastPolicyHash:h})),[]),c=useCallback(h=>n(f=>({...f,lastPolicyProof:h})),[]),p=useCallback(h=>n(f=>({...f,lastHost:h})),[]),d=useCallback(h=>n(f=>({...f,rootJkt:h})),[]),g=useCallback(h=>n(f=>({...f,registeredProofId:h})),[]),S=async()=>{try{let h=localStorage.getItem(s);if(h){let f=JSON.parse(h);if(typeof f?.refreshId=="string"&&f.refreshId)return f.refreshId}}catch{}try{let h=await T(s);if(typeof h?.refreshId=="string"&&h.refreshId)return h.refreshId}catch{}return null},v=useCallback(h=>n(f=>({...f,boundWallet:h})),[]),w=useCallback(h=>n(f=>({...f,clientId:h})),[]),k=useCallback(h=>n(f=>({...f,jkt:h})),[]),b=useCallback(()=>n(Pe),[]),_=useCallback(async()=>{let f=await T(s)??Ir(s);n({...Pe,...f});},[]),M=useMemo(()=>({meta:r,setBoundWallet:v,setClientId:w,setJkt:k,resetMeta:b,reload:_,setRefreshId:l,getRefreshId:S,ready:i,setLastPolicyHash:u,setLastPolicyProof:c,setLastHost:p,setRootJkt:d,setRegisteredProofId:g}),[r,v,w,k,b,_,i,l,S,u,c,p,d,g]);return jsx(Ct.Provider,{value:M,children:e})};function Tt(){let e=useContext(Ct);if(!e)throw new Error("useMeta must be used within <MetaProvider>");return e}var Wr=`${I}:wrap`;async function at(){try{let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},!1,["sign","verify"]),t=`${I}:probe_safe`;await R(t,{fmt:"cryptokey",privKey:e.privateKey});let r=await T(t);return await R(t,void 0),!!(r&&r.privKey)}catch{return  false}}async function qn(){try{let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},!0,["sign","verify"]),t=`${I}:probe`;await R(t,{fmt:"cryptokey",privKey:e.privateKey});let r=await T(t);return await R(t,void 0),!!(r&&r.privKey)}catch{return  false}}function Ae(e){let{d:t,...r}=e;return {...r,kty:"EC",crv:E,alg:Te,use:"sig"}}async function _r(){let e=await T(Wr);if(!e){let t=new Uint8Array(32);crypto.getRandomValues(t),e=t.buffer,await R(Wr,e);}return crypto.subtle.importKey("raw",e,{name:"AES-GCM",length:256},false,["encrypt","decrypt"])}async function Wt(e){let t=await _r(),r=new Uint8Array(12);crypto.getRandomValues(r);let n=new TextEncoder().encode(JSON.stringify(e));return {encPrivJwk:await crypto.subtle.encrypt({name:"AES-GCM",iv:r},t,n),iv:r.buffer}}async function zn(e,t){let r=await _r(),n=await crypto.subtle.decrypt({name:"AES-GCM",iv:t},r,e);return JSON.parse(new TextDecoder().decode(new Uint8Array(n)))}var _t=()=>{let e=useRef(null),t=useRef(null),r=useCallback(async()=>{let l=await T(I);if(!l)return  false;if(l.fmt==="cryptokey"){let c=l;if(!c.privKey)return await R(I,void 0),false;let p=c.privKey;try{if(p.extractable&&await at()){let g=await crypto.subtle.exportKey("jwk",p),S=await crypto.subtle.importKey("jwk",g,{name:"ECDSA",namedCurve:E},!1,["sign"]),v={fmt:"cryptokey",privKey:S,pubJwk:Ae(c.pubJwk)};await R(I,v),p=S;}}catch{}return e.current=p,t.current=Ae(c.pubJwk),true}if(l.fmt==="encjwk"){let c=l;try{let p=await zn(c.encPrivJwk,c.iv),d=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},!1,["sign"]);return e.current=d,t.current=Ae(c.pubJwk),!0}catch{return await R(I,void 0),false}}let u=l;if(u&&u.d){let{d:c,...p}=u,d=Ae(p),g=await at(),S=g||await qn();if(S&&g){let b=await crypto.subtle.importKey("jwk",u,{name:"ECDSA",namedCurve:E},false,["sign"]);return await R(I,{fmt:"cryptokey",privKey:b,pubJwk:d}),e.current=b,t.current=d,true}if(S){let b=await crypto.subtle.importKey("jwk",u,{name:"ECDSA",namedCurve:E},true,["sign"]);return await R(I,{fmt:"cryptokey",privKey:b,pubJwk:d}),e.current=b,t.current=d,true}let{encPrivJwk:v,iv:w}=await Wt(u);await R(I,{fmt:"encjwk",encPrivJwk:v,iv:w,pubJwk:d});let k=await crypto.subtle.importKey("jwk",u,{name:"ECDSA",namedCurve:E},false,["sign"]);return e.current=k,t.current=d,true}return await R(I,void 0),false},[]),n=useCallback(async(l,u)=>{await R(I,{fmt:"cryptokey",privKey:l,pubJwk:u});},[]),a=useCallback(async(l,u)=>{let{encPrivJwk:c,iv:p}=await Wt(l);await R(I,{fmt:"encjwk",encPrivJwk:c,iv:p,pubJwk:u});},[]),i=useCallback(async()=>{if(e.current&&t.current||await r())return;let l=await at(),u=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},true,["sign","verify"]),c=Ae(await crypto.subtle.exportKey("jwk",u.publicKey)),p=await crypto.subtle.exportKey("jwk",u.privateKey);if(l){let d=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},false,["sign"]);await n(d,c),e.current=d,t.current=c;}else {await a(p,c);let d=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},false,["sign"]);e.current=d,t.current=c;}},[r,n,a]),o=useCallback(async()=>{let l=await at(),u=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},true,["sign","verify"]),c=Ae(await crypto.subtle.exportKey("jwk",u.publicKey)),p=await crypto.subtle.exportKey("jwk",u.privateKey);if(l){let d=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},false,["sign"]);await R(I,{fmt:"cryptokey",privKey:d,pubJwk:c}),e.current=d,t.current=c;}else {let{encPrivJwk:d,iv:g}=await Wt(p);await R(I,{fmt:"encjwk",encPrivJwk:d,iv:g,pubJwk:c});let S=await crypto.subtle.importKey("jwk",p,{name:"ECDSA",namedCurve:E},false,["sign"]);e.current=S,t.current=c;}},[]),s=useCallback(async()=>{await R(I,void 0),e.current=null,t.current=null;},[]);return {ensureKeypair:i,rotate:o,clear:s,privRef:e,pubJwkRef:t}};var Q="sunbreak_root_key_v1",Dr=`${Q}:wrap`;async function Mr(){try{let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},!1,["sign","verify"]),t=`${Q}:probe_safe`;await R(t,{fmt:"cryptokey",privKey:e.privateKey,createdAt:Date.now(),pubJwk:{}});let r=await T(t);return await R(t,void 0),!!(r&&r.privKey)}catch{return  false}}function it(e){let{d:t,...r}=e;return {...r,kty:"EC",crv:E,alg:Te,use:"sig"}}async function Lr(){let e=await T(Dr);if(!e){let t=new Uint8Array(32);crypto.getRandomValues(t),e=t.buffer,await R(Dr,e);}return crypto.subtle.importKey("raw",e,{name:"AES-GCM",length:256},false,["encrypt","decrypt"])}async function Xn(e){let t=await Lr(),r=new Uint8Array(12);crypto.getRandomValues(r);let n=new TextEncoder().encode(JSON.stringify(e));return {encPrivJwk:await crypto.subtle.encrypt({name:"AES-GCM",iv:r},t,n),iv:r.buffer}}async function Yn(e,t){let r=await Lr(),n=await crypto.subtle.decrypt({name:"AES-GCM",iv:t},r,e);return JSON.parse(new TextDecoder().decode(new Uint8Array(n)))}var Dt=()=>{let e=useRef(null),t=useRef(null),r=useCallback(async()=>{let i=await T(Q);if(!i)return  false;if(i.fmt==="cryptokey"){let o=i;if(!o.privKey)return await R(Q,void 0),false;let s=o.privKey;try{if(s.extractable&&await Mr()){let u=await crypto.subtle.exportKey("jwk",s),c=await crypto.subtle.importKey("jwk",u,{name:"ECDSA",namedCurve:E},!1,["sign"]),p={fmt:"cryptokey",privKey:c,pubJwk:it(o.pubJwk),createdAt:o.createdAt};await R(Q,p),s=c;}}catch{}return e.current=s,t.current=it(o.pubJwk),true}if(i.fmt==="encjwk"){let o=i;try{let s=await Yn(o.encPrivJwk,o.iv),l=await crypto.subtle.importKey("jwk",s,{name:"ECDSA",namedCurve:E},!1,["sign"]);return e.current=l,t.current=it(o.pubJwk),!0}catch{return await R(Q,void 0),false}}return await R(Q,void 0),false},[]),n=useCallback(async()=>{if(e.current&&t.current||await r())return;let i=await Mr(),o=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:E},true,["sign","verify"]),s=it(await crypto.subtle.exportKey("jwk",o.publicKey)),l=Date.now(),u=await crypto.subtle.exportKey("jwk",o.privateKey);if(i){let c=await crypto.subtle.importKey("jwk",u,{name:"ECDSA",namedCurve:E},false,["sign"]);await R(Q,{fmt:"cryptokey",privKey:c,pubJwk:s,createdAt:l}),e.current=c,t.current=s;}else {let{encPrivJwk:c,iv:p}=await Xn(u);await R(Q,{fmt:"encjwk",encPrivJwk:c,iv:p,pubJwk:s,createdAt:l});let g=await crypto.subtle.importKey("jwk",u,{name:"ECDSA",namedCurve:E},false,["sign"]);e.current=g,t.current=s;}},[r]),a=useCallback(async()=>{await R(Q,void 0),e.current=null,t.current=null;},[]);return {ensureRootKeypair:n,clear:a,rootPrivRef:e,rootPubJwkRef:t}};var Hr="0.2.2",He=class e{constructor(t,r=false){this.colors={flow:"#00D9FF",state:"#00FF88",decision:"#FFB800",api:"#B388FF",guard:"#FFEA00",error:"#FF5252",warn:"#FF9100",info:"#90CAF9"};this.enabled=r,this.prefix=t?`[Sunbreak v${Hr}:${t.slice(0,8)}]`:`[Sunbreak v${Hr}]`;}log(t,r,n){if(!this.enabled)return;let a=this.colors[t],i=new Date().toISOString().slice(11,23),o=this.getEmoji(t);console.log(`%c${o} ${this.prefix} [${i}] [${t.toUpperCase()}]%c ${r}`,`color: ${a}; font-weight: bold`,"color: inherit; font-weight: normal",n!==void 0?n:"");}getEmoji(t){switch(t){case "flow":return "\u{1F504}";case "state":return "\u{1F500}";case "decision":return "\u{1F914}";case "api":return "\u{1F4E1}";case "guard":return "\u{1F6E1}\uFE0F";case "error":return "\u274C";case "warn":return "\u26A0\uFE0F";case "info":return "\u2139\uFE0F";default:return "\u2022"}}flow(t,r,n){this.log("flow",`[${t.toUpperCase()}] ${r}`,n);}state(t,r,n,a){this.log("state",`${t} \u2192 ${r}: ${n}`,a);}decision(t,r,n,a){this.log("decision",`${t} = ${r?"\u2713 YES":"\u2717 NO"} (${n})`,a);}api(t,r,n){let a=n.status,o=a>=200&&a<300?"\u2713":"\u2717";this.log("api",`${o} ${t} ${r} \u2192 ${a}${n.error?` (${n.error})`:""}`,n.data);}guard(t,r,n,a){this.log("guard",`${t}: ${r?"\u2713 PASS":"\u2717 BLOCK"} (${n})`,a);}error(t,r){this.log("error",t,r);}warn(t,r){this.log("warn",t,r);}info(t,r){this.log("info",t,r);}group(t){this.enabled&&console.group(`${this.prefix} ${t}`);}groupEnd(){this.enabled&&console.groupEnd();}child(t){let r=new e(void 0,this.enabled);return r.prefix=`${this.prefix}[${t}]`,r}},Mt=null;function $r(){return Mt||(Mt=new He(void 0,false)),Mt}var $e=class{constructor(t){this.currentState="unknown";this.previousState="unknown";this.logger=$r();this.hadSessionHistory=false;this.inActiveSession=false;t&&this.initialize(t);}initialize(t){if(this.currentState!=="unknown"){this.logger.info(`Skipping initialization - state already set to ${this.currentState}`);let n=!!(t.boundWallet||t.refreshId);this.hadSessionHistory=n;return}this.logger.group("\u{1F527} Initializing Session State Machine");let r=!!(t.boundWallet||t.refreshId);this.hadSessionHistory=r,this.logger.info("Initial context",{wallet:t.wallet,boundWallet:t.boundWallet,refreshId:t.refreshId?"present":"null",hasToken:t.hasToken,authenticated:t.authenticated,hasHistory:r}),t.authenticated&&t.hasToken?(this.transition("authenticated","Has valid token"),this.inActiveSession=true):r?this.transition("refreshable","Has session history"):this.transition("unregistered","No session history"),this.logger.groupEnd();}transition(t,r){if(this.currentState===t){this.logger.info(`State unchanged: ${t} (${r})`);return}this.previousState=this.currentState,this.currentState=t,this.logger.state(this.previousState,t,r);}getState(){return this.currentState}isInActiveSession(){return this.inActiveSession}markHadSession(){this.hadSessionHistory||(this.logger.info("Marked hadSessionHistory = true"),this.hadSessionHistory=true);}clearSessionHistory(){this.logger.info("Cleared session history"),this.hadSessionHistory=false,this.inActiveSession=false;}onNewCredentialsReceived(){this.inActiveSession&&(this.logger.info("New credentials received while in active session - allowing re-registration"),this.inActiveSession=false,this.transition("unregistered","New credentials received"));}onProbeComplete(t){if(this.logger.flow("probe","Probe completed, determining initial state"),this.currentState!=="unknown"){this.logger.warn("Probe called but state is not UNKNOWN",{currentState:this.currentState});return}!!(t.boundWallet||t.refreshId)||this.hadSessionHistory?this.transition("refreshable","Session history found"):this.transition("unregistered","No session history");}onRegisterSuccess(t){this.logger.flow("register","Register succeeded"),this.transition("authenticated","Register succeeded"),this.inActiveSession=true,this.hadSessionHistory=true;}onRegisterFailure(t){this.logger.flow("register",`Register failed: ${t}`);}onRefreshSuccess(t){this.logger.flow("refresh","Refresh succeeded"),this.transition("authenticated","Refresh succeeded"),this.inActiveSession=true;}onRefreshExpired(){this.logger.flow("refresh","Refresh failed: session expired (missing refresh identifier)"),this.transition("expired","Session expired"),this.inActiveSession=false;}onRefreshFailure(t){this.logger.flow("refresh",`Refresh failed: ${t}`);}onTokenExpired(){this.logger.flow("token","Token expired"),this.currentState==="authenticated"&&this.transition("refreshable","Token expired");}onWalletChange(t,r,n){if(this.logger.flow("wallet",`Wallet changed: ${t||"null"} \u2192 ${r||"null"}`),!r){this.transition("unknown","Wallet disconnected"),this.inActiveSession=false;return}x(r,n.boundWallet)?(this.hadSessionHistory=true,this.transition("refreshable","Wallet reconnected with session history")):(this.transition("unregistered","Wallet changed to different address"),this.inActiveSession=false);}onWalletDisconnect(){this.logger.flow("wallet","Wallet disconnected"),this.transition("unknown","Wallet disconnected"),this.inActiveSession=false;}shouldAttemptProbe(){let t=this.currentState==="unknown";return this.logger.decision("Should attempt probe?",t,`State is ${this.currentState}`),t}shouldAttemptRefresh(t){if(this.currentState!=="refreshable"&&this.currentState!=="authenticated")return this.logger.decision("Should attempt refresh?",false,`State is ${this.currentState}, not REFRESHABLE or AUTHENTICATED`),false;if(!(t.boundWallet||t.wallet))return this.logger.decision("Should attempt refresh?",false,"No wallet available (neither boundWallet nor current wallet)"),false;if(t.wallet&&t.boundWallet&&!x(t.wallet,t.boundWallet))return this.logger.decision("Should attempt refresh?",false,"Wallet mismatch"),false;if(t.hasToken&&t.tokenExpiry){let n=Math.floor(Date.now()/1e3);if(t.tokenExpiry-n>5&&this.currentState==="authenticated")return this.logger.decision("Should attempt refresh?",false,"Token still valid"),false}return this.logger.decision("Should attempt refresh?",true,`State is ${this.currentState}, token ${t.hasToken?"present":"missing"}`),true}shouldAttemptRegister(t){return this.inActiveSession?(this.logger.decision("Should attempt register?",false,"Already in active session - proof changes ignored"),false):this.currentState!=="unregistered"&&this.currentState!=="expired"?(this.logger.decision("Should attempt register?",false,`State is ${this.currentState}, not UNREGISTERED or EXPIRED`),false):t.wallet?t.hasProof?t.authenticated&&t.hasToken?(this.logger.decision("Should attempt register?",false,"Already authenticated"),false):(this.logger.decision("Should attempt register?",true,`State is ${this.currentState}, have wallet + proof`),true):(this.logger.decision("Should attempt register?",false,"No proof available"),false):(this.logger.decision("Should attempt register?",false,"No wallet connected"),false)}shouldWaitForInitialRefresh(t,r){return this.currentState!=="refreshable"||t?false:r.wallet&&r.boundWallet&&x(r.wallet,r.boundWallet)?(this.logger.decision("Should wait for initial refresh?",true,"Returning user - let refresh attempt first"),true):false}getStateReport(t){return `
+\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
+\u2502  Session State Machine Report          \u2502
+\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
+\u2502 Current State:    ${this.currentState.padEnd(20)} \u2502
+\u2502 Previous State:   ${this.previousState.padEnd(20)} \u2502
+\u2502 Active Session:   ${String(this.inActiveSession).padEnd(20)} \u2502
+\u2502 Had History:      ${String(this.hadSessionHistory).padEnd(20)} \u2502
+\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
+\u2502 Wallet:           ${(t.wallet||"null").padEnd(20)} \u2502
+\u2502 Bound Wallet:     ${(t.boundWallet||"null").padEnd(20)} \u2502
+\u2502 Refresh ID:       ${(t.refreshId?"present":"null").padEnd(20)} \u2502
+\u2502 Has Token:        ${String(t.hasToken).padEnd(20)} \u2502
+\u2502 Authenticated:    ${String(t.authenticated).padEnd(20)} \u2502
+\u2502 Has Proof:        ${String(t.hasProof).padEnd(20)} \u2502
+\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
+    `.trim()}};var Zn=()=>crypto.randomUUID(),Or=e=>{let{clientId:t,wallet:r,base:n="https://api.sunbreak.com",fetchImpl:a,timeoutMs:i=15e3,proof:o=null,providerAdapter:s,refreshDeps:l=[],debug:u}=e,c=yt(n),p=typeof window<"u"?(a??fetch).bind(window):a??fetch,{meta:d,setBoundWallet:g,setJkt:S,setRefreshId:v,getRefreshId:w,setLastPolicyHash:k,setLastPolicyProof:b,setLastHost:_,setRootJkt:M,setRegisteredProofId:h,ready:f}=Tt(),{ensureRootKeypair:y,rootPrivRef:C,rootPubJwkRef:J}=Dt(),Ke=useCallback(async()=>{await y();try{if(!d.rootJkt&&J.current){let re=await $(J.current);M(re);}}catch{}},[y,d.rootJkt,J]),{ensureKeypair:K,rotate:je,privRef:Be,pubJwkRef:qt}=_t(),[D,X]=useState(false),[j,te]=useState(0),[le,ae]=useState(null),[ut,ft]=useState(null),[dt,Yr]=useState(null),[Zr,Qr]=useState(null),en=useRef(null),tn=useRef(null),rn=useRef(null),nn=useRef(null),on=useRef(null),an=useRef(null),sn=useRef(null),cn=useRef(false),ln=useRef(false),un=useRef(void 0),Fe=useRef(false),pt=useRef(false),zt=useRef(null),ue=useRef(null);ue.current||(ue.current=new Promise(re=>{zt.current=re;}));let ht=useRef(null),fn=useRef(o),dn=useRef(null),we=useRef(null);if(!we.current){let re=u??false;we.current=new He(t,re);}let Xt=u??false;we.current&&we.current.enabled!==Xt&&(we.current.enabled=Xt);let mt=useRef(null);mt.current||(mt.current=new $e);let Ve=useRef(null),Yt=useRef(null),Ge=useRef(null),Zt=()=>Date.now(),pn=()=>(Ge.current??0)>0&&Ge.current<Zt(),gt=useCallback((re,Sn=15e3)=>{let Qt=Zn();return Ve.current=Qt,Yt.current=re,Ge.current=Zt()+Math.max(1e3,Sn),Qt},[]),hn=useCallback(()=>((!Ve.current||pn())&&gt("adhoc",1e4),Ve.current),[gt]),wt=useRef(null),qe=useRef(null);qe.current||(qe.current=new Promise(re=>{wt.current=re;}));let mn=useCallback(async()=>{!Fe.current&&qe.current&&await qe.current;},[]),gn=useCallback(()=>{Fe.current||(Fe.current=true,wt.current?.(),wt.current=null);},[]),wn=useCallback(async()=>{!pt.current&&ue.current&&await ue.current;},[]),yn=useCallback(async()=>{!pt.current&&ue.current&&await ue.current,ht.current&&await ht.current;},[]);return {clientId:t,wallet:r,baseUrl:c,fetchImpl:p,timeoutMs:i,providerAdapter:s,refreshDeps:l,ensureKeypair:K,rotate:je,ensureRootKeypair:Ke,rootPrivRef:C,rootPubJwkRef:J,privRef:Be,pubJwkRef:qt,meta:d,setBoundWallet:g,setJkt:S,setRefreshId:v,accessTokenRef:rn,tokenExpRef:nn,authenticated:D,setAuthenticated:X,loadingCount:j,setLoadingCount:te,error:le,setError:ae,allowed:ut,setAllowed:ft,sessionExpiry:dt,setSessionExpiry:Yr,sessionData:Zr,setSessionData:Qr,authWalletRef:tn,refreshLock:on,registerLock:an,sessionLock:sn,didInitialRefresh:cn,didInitialSession:ln,prevWalletRef:un,initResolvedRef:pt,initReady:ue,initResolveRef:zt,rotateLock:ht,waitReady:wn,awaitKeyStable:yn,proofRef:fn,registerCooldownUntilRef:en,reqIdRef:Ve,flowLabelRef:Yt,flowExpireRef:Ge,beginFlow:gt,currentReqId:hn,awaitProbe:mn,markProbed:gn,hasProbedRef:Fe,getRefreshId:w,setLastPolicyHash:k,setLastPolicyProof:b,setLastHost:_,setRootJkt:M,setRegisteredProofId:h,metaReady:f,probeLock:dn,stateMachine:mt.current,logger:we.current}};var z=e=>e.accessTokenRef.current??null,ee=e=>{let t=e.privRef.current;if(!t)throw new Error("Sunbreak: private key not initialized");return t},W=e=>{let t=e.pubJwkRef.current;if(!t)throw new Error("Sunbreak: public JWK not initialized");return t};var Qn=(e,t)=>`${e.toUpperCase()} ${t}`;async function Oe(e,t,r,n){if(!t)return e.logger.guard("register",false,"No wallet provided"),false;if(!e.clientId)return e.logger.guard("register",false,"No client ID configured"),e.setError("Missing client ID. Please configure a valid client ID."),false;e.logger.flow("register","Starting register flow",{wallet:t});let a=Oe._nonceCacheRef||(Oe._nonceCacheRef={map:new Map});try{await e.waitReady(),await e.awaitKeyStable(),await e.awaitProbe(),await e.ensureKeypair(),e.setError(null),e.beginFlow("register",2e4);let i;try{if(await e.ensureRootKeypair(),e.rootPrivRef.current&&e.rootPubJwkRef.current){if(!e.meta.rootJkt)try{let y=await $(e.rootPubJwkRef.current);e.setRootJkt?.(y);}catch{}let h=await $(W(e)),f=await e.getRefreshId();i=await he({rootPrivateKey:e.rootPrivRef.current,rootPublicJwk:e.rootPubJwkRef.current,childJkt:h,clientId:e.clientId,sid:f||void 0,ttlSec:300});}}catch(h){e.logger.warn("Failed to create PODE for register",h);}let o=e.currentReqId(),s="/auth/register",l=`${e.baseUrl}${s}`,u=new URL(e.baseUrl).origin,c="POST",p=`${u}${s}`,d=Qn(c,p),g=a.map.get(d),S=await G({method:c,url:p,nonce:g,privateKey:ee(e),publicJwk:W(e)}),v=async h=>e.fetchImpl(l,{method:c,headers:{"content-type":"application/json","x-sunbreak-meta":V(e,{reqId:o,pode:i||void 0,wallet:t}),...h},credentials:"include",body:JSON.stringify({wallet:t,proof:r})}),w=await v({DPoP:S}),k=h=>{let f=h.headers.get("dpop-nonce");f&&a.map.set(d,f);};if(w.status===401){e.logger.info("Register got 401, retrying with nonce");let h=w.headers.get("www-authenticate"),y=(h&&h.match(/dpop-nonce="([^"]+)"/i))?.[1];if(y){a.map.set(d,y);let C=await G({method:c,url:p,nonce:y,privateKey:ee(e),publicJwk:W(e)});w=await v({DPoP:C});}}if(k(w),e.logger.api(c,s,{status:w.status}),!w.ok){let h=await Le(w);if((w.headers.get("content-type")||"").includes("application/json")){let y;try{y=await w.clone().json();}catch{}let C=Me(y&&(y.error||y.message||y.detail)||`HTTP ${w.status}`);throw me(C,h)}else {let y=h.edgeBlocked?"Blocked (403)":h.originBlocked?"Request rejected (403)":`HTTP ${w.status}`;throw me(y,h)}}let b=await w.json();e.logger.info("Register succeeded",{expiresIn:b.expiresIn,hasRefreshId:!!b.refreshId}),e.accessTokenRef.current=b.access,e.authWalletRef.current=ce(t),e.setAuthenticated(!0);try{let h=Math.floor(Date.now()/1e3);e.tokenExpRef.current=h+(b.expiresIn??0);}catch{}e.didInitialRefresh.current=!0,e.setBoundWallet(ce(t)),e.setLastPolicyHash(null),e.setLastPolicyProof(null);try{e.setJkt(await $(W(e)));}catch{}let _=Ce(r);e.setRegisteredProofId(_);try{let h={...e.meta,boundWallet:t,clientId:e.meta.clientId??e.clientId,jkt:e.meta.jkt??null,refreshId:b.refreshId??null,registeredProofId:_};e.setRefreshId(b.refreshId??null);let f=We(e.clientId);await R(f,h);try{localStorage.setItem(f,JSON.stringify(h));}catch(y){e.logger.warn("Failed to persist meta to localStorage",y);}}catch(h){e.logger.warn("Failed to persist session metadata",h);}let M={wallet:t,boundWallet:t,refreshId:b.refreshId??null,hasToken:!0,tokenExpiry:e.tokenExpRef.current,hasProof:!0,authenticated:!0};return e.stateMachine.onRegisterSuccess(M),!0}catch(i){let o=i,s=Number(o?.status||0),l=String(o?.code||"").toLowerCase(),u=String(o?.message||"").toLowerCase(),c=Math.floor(Math.random()*1e3);e.logger.error("Register failed",{status:s,code:l,msg:u}),e.stateMachine.onRegisterFailure(`${l||u||"Unknown error"}`);let p=l==="session_exists"||l==="already_authenticated"||u.includes("already")&&(u.includes("session")||u.includes("authenticated")),d=(s===401||s===403)&&l==="replay";if((p||d)&&n?.refreshFallback&&(!e.meta.boundWallet||x(e.meta.boundWallet,t))){e.logger.info("Register failed with recoverable error, attempting refresh fallback",{code:l,isSessionExists:p,isReplay:d});try{if(await n.refreshFallback())return e.logger.info("Refresh fallback succeeded after register failure"),e.meta.boundWallet||e.setBoundWallet(t),!0}catch(v){e.logger.warn("Refresh fallback failed",v);}}if(d){if(e.providerAdapter)try{let S=await e.providerAdapter.getToken()??null;if(S)return await e.awaitKeyStable(),await e.ensureKeypair(),await e.rotate(),e.proofRef.current=await ye(e.providerAdapter,S),e.registerCooldownUntilRef.current=Date.now()+5e3+c,!1}catch{}else return e.proofRef.current=null,e.setError("Proof replayed; please sign a fresh proof."),e.registerCooldownUntilRef.current=Date.now()+1e4+c,false;return e.registerCooldownUntilRef.current=Date.now()+8e3+c,false}if(p)return e.setError("Session already exists. Try refreshing the page."),e.registerCooldownUntilRef.current=Date.now()+3e3+c,false;if(l==="siwe_invalid"||l==="eip191_invalid"||l==="ed25519_invalid"||l==="sig_wallet_mismatch"||u.includes("invalid")&&u.includes("signature")){if(e.logger.warn("Proof invalid for wallet, clearing proof",{code:l,msg:u}),e.proofRef.current=null,e.providerAdapter)try{let S=await e.providerAdapter.getToken()??null;if(S)return e.proofRef.current=await ye(e.providerAdapter,S),e.registerCooldownUntilRef.current=Date.now()+3e3+c,!1}catch{}return e.setError("Proof doesn't match wallet. Please sign again."),e.registerCooldownUntilRef.current=Date.now()+5e3+c,false}if(s===403&&(o?.edgeBlocked||o?.originBlocked))return e.setError(u||"Forbidden"),e.registerCooldownUntilRef.current=Date.now()+3e4+c,false;if(s===403)return e.setError(l||u||"Forbidden"),e.registerCooldownUntilRef.current=Date.now()+15e3+c,false;if(s===429||s===503){e.setError(l||u||"Rate limited / unavailable");let S=s===429?5e3:8e3;return e.registerCooldownUntilRef.current=Date.now()+S+c,false}return e.setError(l||u||"Register failed"),e.registerCooldownUntilRef.current=Date.now()+5e3+c,false}}var eo=(e,t)=>`${e.toUpperCase()} ${t}`;function Ne(e){if(e.refreshLock.current)return e.logger.guard("refreshLock",false,"Refresh already in progress"),e.refreshLock.current;if(e.registerLock.current){e.logger.guard("registerLock",false,"Registration in progress, waiting");let t=e.registerLock.current.then(()=>{if(e.authenticated&&z(e))return  true;if(z(e)){let n=e.tokenExpRef.current,a=Math.floor(Date.now()/1e3);if(!!n&&n-a>5)return  true}return  false});return e.refreshLock.current=t.finally(()=>{e.refreshLock.current=null;}),e.refreshLock.current}return e.logger.flow("refresh","Starting refresh flow"),e.refreshLock.current=(async()=>{try{await e.waitReady(),await e.awaitKeyStable(),await e.awaitProbe();let t=e.meta.boundWallet||e.wallet;if(!t)return e.logger.warn("No wallet available for refresh (neither boundWallet nor current wallet)"),!1;if(!e.clientId)return e.logger.warn("No client ID configured for refresh"),e.setError("Missing client ID. Please configure a valid client ID."),!1;if(e.wallet&&e.meta.boundWallet&&!x(e.wallet,e.meta.boundWallet))return e.logger.warn("Wallet mismatch during refresh",{current:e.wallet,bound:e.meta.boundWallet}),e.accessTokenRef.current=null,e.setAuthenticated(!1),!1;let r=z(e);if(r){let f=e.tokenExpRef.current,y=Math.floor(Date.now()/1e3);if(!!r&&!!f&&f-y>5)return e.logger.info("Token still valid, skipping refresh"),!0}e.beginFlow("refresh",15e3);let n=e.currentReqId();await e.ensureKeypair();let a;try{if(await e.ensureRootKeypair(),e.rootPrivRef.current&&e.rootPubJwkRef.current){if(!e.meta.rootJkt)try{let C=await $(e.rootPubJwkRef.current);e.setRootJkt?.(C);}catch{}let f=await $(W(e)),y=await e.getRefreshId();a=await he({rootPrivateKey:e.rootPrivRef.current,rootPublicJwk:e.rootPubJwkRef.current,childJkt:f,clientId:e.clientId,sid:y||void 0,ttlSec:300});}}catch(f){e.logger.warn("Failed to create PODE for refresh",f);}let i="/auth/refresh",o=`${e.baseUrl}${i}`,s=new URL(e.baseUrl).origin,l="POST",u=`${s}${i}`,c=eo(l,u),p=Ne._nonceCacheRef||(Ne._nonceCacheRef={map:new Map}),d=async f=>await G({method:l,url:u,nonce:f,privateKey:ee(e),publicJwk:W(e)}),g=await e.getRefreshId(),S={"x-sunbreak-meta":V(e,{reqId:n,refreshId:g||void 0,pode:a||void 0,wallet:t}),"content-type":"application/json"},v=async f=>e.fetchImpl(o,{method:l,headers:{DPoP:f,...S},credentials:"include",body:"{}"}),w=f=>{let y=f.headers.get("dpop-nonce");y&&p.map.set(c,y);},k=await v(await d(p.map.get(c)));if(k.status===401){e.logger.info("Refresh got 401, retrying with nonce");let f=k.headers.get("www-authenticate"),C=(f&&f.match(/dpop-nonce="([^"]+)"/i))?.[1];C&&(p.map.set(c,C),k=await v(await d(C)));}if(w(k),e.logger.api(l,i,{status:k.status}),!k.ok){try{if((k.headers.get("content-type")||"").includes("application/json")){let y=await k.clone().json().catch(()=>{}),C=y&&(y.error||y.code||y.message)||"",J=String(C).toLowerCase();if(J.includes("missing")&&J.includes("refresh")){e.logger.warn("Refresh session expired (missing refresh identifier)"),e.stateMachine.onRefreshExpired();try{e.setRefreshId?.(null);}catch{}e.accessTokenRef.current=null,e.setAuthenticated(!1);}else e.logger.warn("Refresh failed",{error:C}),e.stateMachine.onRefreshFailure(String(C));}}catch{}return !1}let b=await k.json();e.logger.info("Refresh succeeded",{expiresIn:b.expiresIn,hasRefreshId:!!b.refreshId}),e.accessTokenRef.current=b.access,e.setAuthenticated(!0);let _=(e.wallet&&(!e.meta.boundWallet||e.meta.boundWallet===e.wallet)?e.wallet:e.meta.boundWallet)||null;e.authWalletRef.current=_?ce(_):null;try{let f=Math.floor(Date.now()/1e3);e.tokenExpRef.current=f+(b.expiresIn??0);}catch{}try{e.setJkt(await $(W(e)));}catch{}b.refreshId&&e.setRefreshId(b.refreshId);let M=f=>!f||f==="null"||f==="undefined"?null:f,h={wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:M(b.refreshId??e.meta.refreshId??null),hasToken:!0,tokenExpiry:e.tokenExpRef.current,hasProof:!!e.proofRef.current,authenticated:!0};return e.stateMachine.onRefreshSuccess(h),!0}finally{e.refreshLock.current=null;}})(),e.refreshLock.current}var to=(e,t)=>`${e.toUpperCase()} ${t}`,Lt=new Map,Ue;try{let e=globalThis;Ue=e.__sunbreak_page_probe_guard??(e.__sunbreak_page_probe_guard=new Set);}catch{Ue=new Set;}var ro=e=>{try{let t=new URL(e.baseUrl).origin;return `${e.clientId}::${t}`}catch{return `${e.clientId}::${e.baseUrl}`}};async function Nr(e){let t=ro(e);if(e.probeLock.current){e.logger.guard("probeLock",false,"Probe already in progress, waiting"),await e.probeLock.current,e.markProbed();return}if(e.hasProbedRef.current){e.logger.guard("hasProbedRef",false,"Already probed in this session"),e.markProbed();return}if(Ue.has(t)){e.logger.guard("pageProbeGuard",false,"Already probed for this page load"),e.markProbed();return}if(Ue.add(t),!e.clientId){e.logger.warn("No client ID configured, skipping probe"),e.markProbed();return}e.logger.flow("probe","Starting probe flow",{clientId:e.clientId,pageKey:t});let r=(async()=>{let n=new URL(e.baseUrl).origin;try{if(await e.awaitKeyStable(),await e.ensureKeypair(),!e.rootPrivRef.current)try{await e.ensureRootKeypair();}catch{}let a;if(e.rootPrivRef.current&&e.rootPubJwkRef.current)try{let w=await $(W(e));a=await he({rootPrivateKey:e.rootPrivRef.current,rootPublicJwk:e.rootPubJwkRef.current,childJkt:w,clientId:e.clientId,ttlSec:300});}catch(w){e.logger.warn("Failed to create PODE for probe",w);}let i="POST",o="/auth/probe",s=`${e.baseUrl}${o}`,l=`${n}${o}`,u=to(i,l),c=async w=>G({method:i,url:l,nonce:w,privateKey:ee(e),publicJwk:W(e)}),p=async w=>e.fetchImpl(s,{method:i,headers:{DPoP:w,"x-sunbreak-meta":V(e,{pode:a}),"content-type":"application/json"},credentials:"include",body:"{}"}),d=w=>{let k=w.headers.get("dpop-nonce");k&&Lt.set(u,k);},g=await p(await c(Lt.get(u)));if(d(g),g.status===401){e.logger.info("Probe got 401, retrying with nonce from www-authenticate");let w=g.headers.get("www-authenticate"),b=(w&&w.match(/dpop-nonce="([^"]+)"/i))?.[1];b&&(Lt.set(u,b),g=await p(await c(b)),d(g));}e.logger.api(i,o,{status:g.status});let S=w=>!w||w==="null"||w==="undefined"?null:w,v={wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:S(e.meta.refreshId),hasToken:!!e.accessTokenRef.current,tokenExpiry:e.tokenExpRef.current||null,hasProof:!!e.proofRef.current,authenticated:e.authenticated};e.stateMachine.onProbeComplete(v);}catch(a){e.logger.error("Probe failed",a);try{Ue.delete(t);}catch{}}finally{e.markProbed(),e.logger.flow("probe","Probe flow completed");}})();e.probeLock.current=r;try{await r;}finally{e.probeLock.current=null;}}var Ur=e=>{let t=useRef(e);t.current=e;let r=useCallback(()=>Ne(t.current),[]),n=useCallback(async()=>{let o=t.current,s=Date.now(),l=o.registerCooldownUntilRef.current??0;if(s<l){o.logger.guard("registerCooldown",false,"Cooldown active");return}if(!o.wallet){o.logger.guard("attemptRegister",false,"No wallet");return}if(!o.initResolvedRef.current){o.logger.guard("attemptRegister",false,"Not initialized");return}if(o.refreshLock.current){o.logger.guard("attemptRegister",false,"Refresh in progress");return}if(o.registerLock.current){o.logger.guard("attemptRegister",false,"Register already in progress");return}let u=g=>!g||g==="null"||g==="undefined"?null:g,c={wallet:o.wallet||null,boundWallet:o.meta.boundWallet||null,refreshId:u(o.meta.refreshId),hasToken:!!z(o),tokenExpiry:o.tokenExpRef.current||null,hasProof:!!o.proofRef.current,authenticated:o.authenticated};if(!o.stateMachine.shouldAttemptRegister(c)){o.logger.guard("attemptRegister",false,`State machine blocked (state: ${o.stateMachine.getState()}, inActiveSession: ${o.stateMachine.isInActiveSession()})`);return}let p=o.proofRef.current;if(!p){o.logger.guard("attemptRegister",false,"No proof available");return}o.logger.guard("attemptRegister",true,"All guards passed, proceeding");let d=(async()=>{try{await o.awaitKeyStable(),await Oe(o,o.wallet,p,{refreshFallback:async()=>{o.logger.info("Attempting refresh as fallback after register failure");let g=!!o.meta.boundWallet;!g&&o.wallet&&o.setBoundWallet(o.wallet);try{return await Ne(o)}catch{return g||o.setBoundWallet(null),!1}}});}catch(g){let S=g;o.setError(S?.message||String(g)||"Register failed");}finally{o.registerLock.current=null;}})();o.registerLock.current=d;},[]),a=useCallback(async o=>{let s=t.current,l=()=>(s.registerCooldownUntilRef.current??0)>Date.now();if(!s.providerAdapter||l())return;let u=await ye(s.providerAdapter,o);s.proofRef.current=u;},[]),i=useCallback((o,s,l)=>Oe(t.current,o,s,l),[]);return {refresh:r,register:i,attemptRegister:n,setProofFromAdapterToken:a}};var oo=(e,t)=>`${e.toUpperCase()} ${t}`;async function ct(e,t,r,n,a,i={}){e.setLoadingCount(u=>u+1),e.setError(null);let o=n.startsWith("/api/session"),s=new AbortController,l=setTimeout(()=>s.abort(),e.timeoutMs);try{await e.waitReady(),await e.awaitKeyStable(),await e.awaitProbe(),await e.ensureKeypair();let c=`${o?bt(e):e.baseUrl}${n.startsWith("/")?"":"/"}${n}`,d=`${new URL(e.baseUrl).origin}${n.startsWith("/")?"":"/"}${n}`,g=oo(r,d),S=n.startsWith("/auth/"),v=!1,w=!1,k=e.currentReqId(),b=ct._nonceCacheRef||(ct._nonceCacheRef={map:new Map}),_=D=>{let X=D.headers.get("dpop-nonce");X&&b.map.set(g,X);},M=!!e.wallet&&!!e.authWalletRef.current&&!x(e.wallet,e.authWalletRef.current),h=()=>S||!e.wallet?!1:!!(e.authenticated||x(e.wallet,e.meta.boundWallet)||typeof e.meta.refreshId=="string"&&e.meta.refreshId),f,y,C=async()=>{if(S||M)return;try{let le=z(e),ae=e.tokenExpRef.current,ut=Math.floor(Date.now()/1e3),ft=!!ae&&ae-ut<=60;if(le){if(ft&&!await t().catch(()=>!1))return}else if(!h()||!await t().catch(()=>!1))return}catch{}let D=z(e);if(!D)return;let X=await nt(D),j=b.map.get(g),te=await G({method:r,url:d,nonce:j,ath:X,privateKey:ee(e),publicJwk:W(e)});f=`Bearer ${e.accessTokenRef.current}`,y=te;};await C();let J={"content-type":"application/json","x-sunbreak-auth":f||"","x-sunbreak-meta":V(e,{reqId:k,auth:f,ifPolicyHash:e.meta.lastPolicyHash||void 0,ifPolicyProof:e.meta.lastPolicyProof||void 0}),...Rt(i.headers)};y&&(J.DPoP=y);let Ke=async()=>e.fetchImpl(c,{...i,method:r,headers:J,body:a!==void 0?JSON.stringify(a):void 0,credentials:"include",signal:s.signal}),K=await Ke(),je=K.headers.get("x-sunbreak-policy-hash"),Be=K.headers.get("x-sunbreak-policy-proof");if(je&&e.setLastPolicyHash(je),Be&&e.setLastPolicyProof(Be),_(K),K.status===401&&!S){let D=z(e),X=K.headers.get("www-authenticate"),te=(X&&X.match(/dpop-nonce="([^"]+)"/i))?.[1];if(!M&&te&&D&&!w){w=!0,b.map.set(g,te);let le=await nt(D),ae=await G({method:r,url:d,nonce:te,ath:le,privateKey:ee(e),publicJwk:W(e)});f=`Bearer ${e.accessTokenRef.current}`,y=ae,J["x-sunbreak-meta"]=V(e,{reqId:k,auth:f}),J.DPoP=y,K=await Ke(),_(K);}if(K.status===401&&!v&&(v=!0,!M&&h())){let le=await t(),ae=z(e);le&&ae&&!M&&(await C(),J["x-sunbreak-meta"]=V(e,{reqId:k,auth:f}),y&&(J.DPoP=y),K=await Ke(),_(K));}if(K.status===401)throw new Error("Unauthorized")}if(!K.ok){let D=await Le(K);if((K.headers.get("content-type")||"").includes("application/json")){let j=await K.json().catch(()=>{}),te=Me(j&&(j.error||j.message||j.detail)||`HTTP ${K.status}`);throw me(te,D)}else {let j=D.edgeBlocked?"Blocked (403)":D.originBlocked?"Request rejected (403)":`HTTP ${K.status}`;throw me(j,D)}}return (K.headers.get("content-type")||"").includes("application/json")?await K.json():void 0}finally{clearTimeout(l),e.setLoadingCount(u=>Math.max(0,u-1));}}var Br=(e,t)=>{let r=useRef(e),n=useRef(t);return r.current=e,n.current=t,useCallback(async(a,i,o,s={})=>ct(r.current,n.current,a,i,o,s),[])};async function Fr(e,t){let r=await t("GET","/api/session");if(r){e.setAllowed(!!r.allowed),e.setSessionData(r),e.setSessionExpiry(r.expiry??null);let n=r?.wallet;typeof n=="string"&&n&&e.setBoundWallet(ce(n));}return r}var Gr=(e,t)=>{let r=useRef(e),n=useRef(t);return r.current=e,n.current=t,{session:useCallback(async()=>{let i=r.current,o=n.current;if(i.wallet&&!(i.meta.boundWallet&&!x(i.wallet,i.meta.boundWallet)))return i.sessionLock.current||(i.sessionLock.current=(async()=>{try{return await Fr(i,o)}catch(s){throw i.logger.error("Session request failed",s),s}finally{i.sessionLock.current=null;}})()),i.sessionLock.current},[])}};var lt=e=>(e.registerCooldownUntilRef.current??0)>Date.now(),qr=e=>{if(!e)return null;let t=e.indexOf(":");return t>0?e.slice(0,t):null},so=e=>!e||e==="null"||e==="undefined"?null:e,U=e=>({wallet:e.wallet||null,boundWallet:e.meta.boundWallet||null,refreshId:so(e.meta.refreshId),hasToken:!!e.accessTokenRef.current,tokenExpiry:e.tokenExpRef.current||null,hasProof:!!e.proofRef.current,authenticated:e.authenticated});var Ht=e=>{useEffect(()=>{if(!e.metaReady)return;let t=true;return (async()=>{try{if(await e.waitReady(),!t||(await e.awaitKeyStable(),!t)||(await e.ensureRootKeypair(),!t))return;let r=U(e);e.stateMachine.initialize(r),await Nr(e);}catch(r){if(!t)return;e.logger.error("Probe initialization failed",r);}})(),()=>{t=false;}},[e.metaReady]);};var $t=e=>{useEffect(()=>{let t=e.prevWalletRef.current;if(e.prevWalletRef.current=e.wallet,e.wallet!==t&&e.hasProbedRef.current&&!e.refreshLock.current&&(e.didInitialRefresh.current=false),!e.wallet){e.logger.flow("wallet","Wallet disconnected"),e.stateMachine.onWalletDisconnect(),e.setAllowed(null),e.setSessionExpiry(null),e.setSessionData(null),e.setAuthenticated(false),e.accessTokenRef.current=null,e.proofRef.current=null,e.setError(null),e.didInitialSession.current=false,e.authWalletRef.current=null,e.setLastPolicyHash(null),e.setLastPolicyProof(null),e.hasProbedRef.current&&!e.refreshLock.current&&(e.didInitialRefresh.current=false);return}if(t&&e.wallet&&t!==e.wallet){e.logger.flow("wallet",`Wallet changed: ${t} \u2192 ${e.wallet}`);let r=U(e);e.stateMachine.onWalletChange(t,e.wallet,r),e.proofRef.current=null,e.accessTokenRef.current=null,e.setAuthenticated(false),e.didInitialSession.current=false,e.authWalletRef.current=null,e.setLastPolicyHash(null),e.setLastPolicyProof(null),e.rotateLock.current=(async()=>{await e.rotate();})().catch(()=>{}).finally(()=>{e.rotateLock.current=null;});}if(!t&&e.wallet){if(e.logger.flow("wallet",`Wallet connected: ${e.wallet}`),e.didInitialSession.current=false,!e.metaReady){e.logger.info("Wallet connected but meta not ready, deferring state machine update");return}let r=U(e);e.stateMachine.onWalletChange(null,e.wallet,r);}},[e.wallet,e.metaReady]);};var Ot=(e,t)=>{let{attemptRegister:r,setProofFromAdapterToken:n}=t;useEffect(()=>{if(!e.providerAdapter||lt(e)||!e.metaReady||!e.wallet)return;let a=U(e);if(e.stateMachine.isInActiveSession()){e.logger.decision("Provider adapter should trigger register?",false,`Already in active session (state: ${e.stateMachine.getState()})`);return}if(e.stateMachine.shouldWaitForInitialRefresh(e.didInitialRefresh.current,a)){e.logger.decision("Provider adapter should wait for initial refresh?",true,"Returning user - refresh first");return}e.logger.decision("Provider adapter should trigger register?",true,`Fetching token (state: ${e.stateMachine.getState()})`);let i=false;return (async()=>{try{let o=e.providerAdapter.getToken(),s=new Promise((u,c)=>setTimeout(()=>c(new Error("Provider adapter timeout (30s)")),3e4)),l=await Promise.race([o,s]).catch(u=>(e.logger.warn("Provider adapter getToken failed",u),null))??null;if(await e.awaitKeyStable(),i||!l)return;try{let u=l.split(".");if(u[1]){let c=JSON.parse(atob(u[1]));e.logger.info("Provider adapter: got token",{wallet:e.wallet,jwtSub:c.sub,jwtWallet:c.wallet||c.linked_accounts?.[0]?.address,jwtExp:c.exp,jwtIat:c.iat});}}catch{e.logger.info("Provider adapter: got token (could not decode)");}await n(l),await r();}catch(o){e.logger.error("Provider adapter flow failed",o);}})(),()=>{i=true;}},[e.providerAdapter,e.wallet,e.meta.boundWallet,e.metaReady,...e.refreshDeps]);};var Nt=(e,t)=>{let{proofProp:r,attemptRegister:n}=t;useEffect(()=>{if(typeof r<"u"&&(e.proofRef.current=r??null,r&&e.logger.info("Proof prop updated",{hasProof:!!r})),!e.metaReady)return;let a=U(e),i=!!e.wallet,o=!!e.proofRef.current,s=false,l=e.proofRef.current?.method,u=l==="siwe"||l==="eip191";if(o&&e.stateMachine.isInActiveSession())if(u){let p=Ce(e.proofRef.current),d=e.meta.registeredProofId;if(p&&d){let g=qr(d),S=g==="siwe"||g==="eip191";if(S&&p!==d)e.logger.info("Proof prop: SIWE/EIP191 credentials changed, allowing re-registration",{old:d,new:p}),e.stateMachine.onNewCredentialsReceived(),e.accessTokenRef.current=null,e.setAuthenticated(false),e.didInitialSession.current=false,s=true;else if(S){e.logger.decision("Proof prop should trigger register?",false,"Already authenticated with same SIWE/EIP191 credentials");return}else e.logger.info("Proof prop: switching from provider JWT to SIWE/EIP191, allowing re-registration",{old:d,new:p}),e.stateMachine.onNewCredentialsReceived(),e.accessTokenRef.current=null,e.setAuthenticated(false),e.didInitialSession.current=false,s=true;}}else {e.logger.decision("Proof prop should trigger register?",false,`Already in active session, no credential change detection for ${l}`);return}let c=s?U(e):a;if(!e.stateMachine.shouldAttemptRegister(c)){e.logger.decision("Proof prop should trigger register?",false,`State machine says no (state: ${e.stateMachine.getState()}, inActiveSession: ${e.stateMachine.isInActiveSession()})`);return}if(e.stateMachine.shouldWaitForInitialRefresh(e.didInitialRefresh.current,c)){e.logger.decision("Proof prop should wait for initial refresh?",true,"Returning user - refresh first");return}i&&o&&e.initResolvedRef.current&&!lt(e)&&(e.logger.info("Proof prop conditions met, attempting register"),n());},[r,e.wallet,e.authenticated,e.meta.boundWallet,e.meta.registeredProofId,e.metaReady,e.providerAdapter,n]);};var Ut=(e,t)=>{let{refresh:r,session:n}=t;useEffect(()=>{if(!e.metaReady||e.didInitialRefresh.current)return;e.didInitialRefresh.current=true;let a=true;return (async()=>{try{await e.waitReady(),await e.awaitProbe();let i=U(e);if(e.accessTokenRef.current||e.authenticated){e.logger.info("Already authenticated, skipping initial refresh"),e.wallet&&!e.didInitialSession.current&&await n()!==void 0&&(e.didInitialSession.current=!0);return}if(!e.stateMachine.shouldAttemptRefresh(i)){e.logger.decision("Should attempt initial refresh?",!1,`State: ${e.stateMachine.getState()}`);return}e.logger.decision("Should attempt initial refresh?",!0,`State: ${e.stateMachine.getState()}`);let s=await r();if(!a)return;e.setAuthenticated(s),s&&e.wallet&&!e.didInitialSession.current&&await n()!==void 0&&(e.didInitialSession.current=!0);}catch(i){if(!a)return;let o=i;e.setAuthenticated(false),e.setError(o?.message||String(i)||"Unknown error");}})(),()=>{a=false;}},[e.wallet,e.meta.boundWallet,e.meta.refreshId,e.metaReady,r,n]);};var jt=e=>{useEffect(()=>{e.initResolvedRef.current||(async()=>{if(await e.ensureKeypair(),!e.wallet){e.initResolvedRef.current=true,e.initResolveRef.current?.();return}e.meta.boundWallet&&!x(e.meta.boundWallet,e.wallet)&&(e.rotateLock.current=(async()=>{e.accessTokenRef.current=null,e.setAuthenticated(false);})().catch(()=>{}).finally(()=>{e.rotateLock.current=null;}),e.rotateLock.current&&await e.rotateLock.current),e.initResolvedRef.current=true,e.initResolveRef.current?.();})();},[e]);};var Bt=(e,t)=>{let{session:r}=t;useEffect(()=>{(async()=>{if(e.authenticated&&e.wallet&&e.accessTokenRef.current&&!(e.meta.boundWallet&&!x(e.wallet,e.meta.boundWallet))&&!e.didInitialSession.current)try{e.logger.flow("session","Calling session after authentication"),await r()!==void 0&&(e.didInitialSession.current=!0);}catch(n){let a=n;e.setError(a?.message||String(n));}})();},[e.authenticated,e.wallet,e.meta.boundWallet,r]);};var Ft=e=>{useEffect(()=>{e.wallet&&e.authWalletRef.current&&!x(e.wallet,e.authWalletRef.current)&&(e.logger.warn("Wallet mismatch detected, clearing auth and proof",{current:e.wallet,authWallet:e.authWalletRef.current}),e.accessTokenRef.current=null,e.setAuthenticated(false),e.proofRef.current=null);},[e.wallet,e.authWalletRef.current]);};var Vt=(e,t)=>{let{refresh:r,session:n}=t;useEffect(()=>{let o=()=>{let u=Math.floor(Date.now()/1e3),c=e.tokenExpRef.current,p=e.sessionExpiry,d=!!c&&c-u<=30&&c-u>0,g=!!p&&p-u<=3600&&p-u>0;return {tokenSoon:d,sessionSoon:g}},s=async()=>{try{if(!e.authenticated||!e.wallet||e.meta.boundWallet&&!x(e.wallet,e.meta.boundWallet))return;let{tokenSoon:u,sessionSoon:c}=o();(u||c)&&(e.logger.info("Refreshing on focus",{tokenSoon:u,sessionSoon:c}),await r()&&c&&await n());}catch{}},l=async()=>{document.visibilityState==="visible"&&await s();};return window.addEventListener("focus",s),document.addEventListener("visibilitychange",l),()=>{window.removeEventListener("focus",s),document.removeEventListener("visibilitychange",l);}},[e,e.sessionExpiry,r,n]);};var zr=(e,t)=>{let{refresh:r,session:n,attemptRegister:a,setProofFromAdapterToken:i,proofProp:o}=t;Ht(e),$t(e),Ot(e,{attemptRegister:a,setProofFromAdapterToken:i}),Nt(e,{proofProp:o,attemptRegister:a}),Ut(e,{refresh:r,session:n}),jt(e),Bt(e,{session:n}),Ft(e),Vt(e,{refresh:r,session:n});};var Xr=createContext(void 0),Ro=e=>{let t=Or(e),{refresh:r,attemptRegister:n,setProofFromAdapterToken:a}=Ur(t),i=Br(t,r),{session:o}=Gr(t,i);zr(t,{refresh:r,session:o,attemptRegister:n,setProofFromAdapterToken:a,proofProp:e.proof});let s=useMemo(()=>({get:(l,u)=>i("GET",l,void 0,u),post:(l,u,c)=>i("POST",l,u,c),session:o,refresh:r,authenticated:t.authenticated,loading:t.loadingCount>0,error:t.error,allowed:t.allowed,sessionExpiry:t.sessionExpiry,sessionData:t.sessionData,wallet:t.wallet}),[i,o,r,t.authenticated,t.loadingCount,t.error,t.allowed,t.sessionExpiry,t.sessionData,t.wallet]);return jsx(Xr.Provider,{value:s,children:e.children})},ko=e=>jsx(It,{clientId:e.clientId,children:jsx(Ro,{...e})}),Eo=()=>{let e=useContext(Xr);if(!e)throw new Error("useSunbreak must be used within a SunbreakProvider");return e};var fc="0.2.2";
+
+export { ko as SunbreakProvider, Eo as useSunbreak, fc as version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdfc/sunbreak-react",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "React bindings for Sunbreak SDK",
   "license": "UNLICENSED",
   "homepage": "https://docs.sunbreak.com",
@@ -20,20 +20,21 @@
   },
   "files": [
     "dist",
+    "README.md",
     "LICENSE"
   ],
   "scripts": {
+    "prepack": "npm run build",
+    "prepare": "npm run build",
     "clean": "rimraf dist",
     "build": "tsup",
     "dev": "tsup --watch",
     "lint": "eslint .",
-    "typecheck": "tsc --noEmit",
-    "prepack": "npm run build",
-    "prepare": "npm run build",
+    "typecheck": "tsc -p tsconfig.typecheck.json",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "resolve-deps": "node scripts/resolve-deps.mjs"
+    "release": "changeset version && git add -A && git commit -m \"chore: version\" || true && git push",
+    "publish:pkg": "changeset publish"
   },
   "engines": {
     "node": ">=18.17"
@@ -47,28 +48,29 @@
       "optional": true
     }
   },
-  "dependencies": {
-    "@tdfc/sunbreak-core": "^0.1.3"
-  },
   "devDependencies": {
-    "@eslint/js": "^9.37.0",
-    "@testing-library/jest-dom": "^6.9.1",
-    "@testing-library/react": "^16.3.0",
-    "@types/node": "^24.8.1",
-    "@types/react": "^19.2.2",
-    "@types/react-dom": "^19.2.1",
-    "eslint": "^9.11.1",
-    "eslint-plugin-security": "^3.0.1",
-    "fake-indexeddb": "^6.2.4",
-    "globals": "^16.0.0",
-    "happy-dom": "^20.5.0",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
-    "rimraf": "^6.0.1",
-    "tsup": "^8.1.0",
-    "typescript": "^5.6.2",
-    "typescript-eslint": "^8.46.0",
-    "vitest": "^3.2.4"
+    "@changesets/cli": "^2.29.8",
+    "@eslint/js": "9.37.0",
+    "@testing-library/jest-dom": "6.9.1",
+    "@testing-library/react": "16.3.0",
+    "@types/node": "24.8.1",
+    "@types/react": "19.2.2",
+    "@types/react-dom": "19.2.1",
+    "@typescript-eslint/eslint-plugin": "8.8.0",
+    "@typescript-eslint/parser": "8.8.0",
+    "@vitest/coverage-v8": "3.2.4",
+    "eslint": "9.11.1",
+    "eslint-plugin-security": "3.0.1",
+    "fake-indexeddb": "6.2.4",
+    "globals": "16.4.0",
+    "jose": "6.1.0",
+    "jsdom": "27.0.0",
+    "rimraf": "6.0.1",
+    "tsup": "8.1.0",
+    "typescript": "5.6.2",
+    "typescript-eslint": "8.46.0",
+    "vite-tsconfig-paths": "5.1.4",
+    "vitest": "3.2.4"
   },
   "publishConfig": {
     "access": "public"