@tktchurch/auth 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 All notable changes to this project will be documented in this file.
 
+## [Unreleased]
+
+### Added
+
+- Add strongly typed `user.avatarAssets.list()`, `.select(assetId)`, and
+  `.delete(assetId)` methods for private, versioned avatar history.
+- Validate avatar asset responses and expose metadata only; private object keys
+  and source URLs are never included in SDK results.
+
+### Changed
+
+- Clarify that the existing `user.deleteAvatar()` compatibility method
+  deselects the current avatar without deleting retained version history.
+
+## [0.11.0] - 2026-07-20
+
+### Added
+
+- New export `@tktchurch/auth/server` for shared browser session / SSO policy:
+  - Cookie kinds: `sso` (parent-domain `tkt_sid` only), `app` / `transient`
+    (always host-only — prevents Cookie header 431 bleed across microsites)
+  - Web Crypto AES-GCM `sealJson` / `unsealJson` (`iv.tag.ciphertext` format)
+  - `compactSession` / `createSessionCookies` for Nuxt + Deno
+  - Opaque `tkt_sid` helpers: `MemorySidStore`, `RedisSidStore`, sealed-cookie
+    fallback, `expireLegacyParentDomainCookies`
+  - `startSilentAuthorize` (`prompt=none`) and `hasSsoCookieHint`
+
 ## [0.10.0] - 2026-07-18
 
 ### Added

package/README.md

@@ -162,6 +162,46 @@ They follow server-first patterns:
 5. Refresh token rotation is performed on every refresh call.
 6. Logout revokes refresh token and clears cookies.
 
+## Server sessions (`@tktchurch/auth/server`)
+
+Shared cookie / SSO helpers for Accounts, Developers, Convoy, and Deno microsites.
+**Do not** set product JWT sessions with `Domain=.tktchurch.com` — that causes
+HTTP 431 on other subdomains (e.g. campaign sites on Deno Deploy).
+
+```ts
+import {
+  createSessionCookies,
+  cookieOptions,
+  expireLegacyParentDomainCookies,
+  mintSealedSsoCookieValue,
+  startSilentAuthorize,
+  hasSsoCookieHint,
+} from "@tktchurch/auth/server";
+
+// Host-only app session (Nuxt h3 or Deno Set-Cookie)
+const sessions = createSessionCookies({
+  secret: process.env.COOKIE_SECRET!,
+  cookieName: "dev_auth_session",
+  legacyParentDomainNames: ["dev_auth_session"],
+});
+const setCookie = await sessions.serializeSessionSetCookie(payload, {
+  hostname: "developers.tktchurch.com",
+});
+
+// Tiny parent-domain SSO hint (Accounts IdP only — no JWTs)
+const { cookieValue } = await mintSealedSsoCookieValue(ssoSecret, {
+  userId: user.id,
+  expiresAt: Date.now() + 30 * 24 * 3600 * 1000,
+});
+
+// Resume SSO without password when tkt_sid is present
+if (hasSsoCookieHint(req.headers.get("cookie"))) {
+  const authRequest = await startSilentAuthorize(client, {
+    redirectUri: "https://app.example/callback",
+  });
+}
+```
+
 ## Nuxt Module (`@tktchurch/auth/nuxt`)
 
 Register the module in `nuxt.config.ts`:
@@ -289,7 +329,7 @@ available in the **full** SDK from GitHub Packages — see
 | `oidc`          | `userInfo`, `discover`, `jwks`                                                                                                          | bearer / public                    |
 | `oauth`         | `publicClient`, `discoverAuthorizationServer`                                                                                           | public                             |
 | `flow`          | `initAuthentication`, `executeStep`, `initRegistration`, `executeRegistrationStep`, `initRecovery`, `executeRecoveryStep`, `getStatus`  | public / step session              |
-| `user`          | `me`, `updateMe`, `changePassword`, `deleteAvatar`, `verifyPhone`, `securityOverview`, `recoveryContacts.*`, `identities.*`, `deleteMe` | bearer                             |
+| `user`          | `me`, `updateMe`, `changePassword`, `uploadAvatar`, `avatarAssets.*`, `deleteAvatar`, `verifyPhone`, `securityOverview`, `recoveryContacts.*`, `identities.*`, `deleteMe` | bearer                             |
 | `sessions`      | `list`, `current`, `get`, `update`, `revoke`, `revokeAll`, `revokeAllDevices`                                                           | bearer                             |
 | `webauthn`      | `registerBegin/Finish`, `authenticateBegin/Finish`, `credentials`, `removeCredential`, `renameCredential`, `setPrimaryCredential`       | bearer / public begin              |
 | `passwordReset` | `request`, `validate`, `complete`                                                                                                       | public                             |
@@ -300,6 +340,13 @@ Integrators must pass an explicit `baseUrl` in
 `createAuthClient({ baseUrl, clientId, … })`. The public consumer build does not
 export `DEFAULT_BASE_URL`.
 
+`user.avatarAssets.list()` returns private history metadata only. Select a
+retained version with `user.avatarAssets.select(assetId)` and explicitly delete
+one with `user.avatarAssets.delete(assetId)`. The compatibility
+`user.deleteAvatar()` method only deselects the current version; it does not
+delete history. Since asset source URLs and object keys are intentionally
+private, render the active image from `user.me().picture`.
+
 ### Internal admin SDK (GitHub Packages only)
 
 The full build adds `consents`, admin `maintenance.*`, `clients` … `comms`,

package/dist/index.cjs

@@ -1 +1 @@
-"use strict";var W=Object.defineProperty;var Je=Object.getOwnPropertyDescriptor;var He=Object.getOwnPropertyNames;var Ve=Object.prototype.hasOwnProperty;var Qe=(e,t)=>{for(var n in t)W(e,n,{get:t[n],enumerable:!0})},We=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of He(t))!Ve.call(e,o)&&o!==n&&W(e,o,{get:()=>t[o],enumerable:!(r=Je(t,o))||r.enumerable});return e};var Ge=e=>We(W({},"__esModule",{value:!0}),e);var vt={};Qe(vt,{AuthContractError:()=>A,AuthError:()=>s,DEFAULT_AUTHORIZE_SCOPE:()=>B,DEFAULT_TOKEN_STORAGE_KEY:()=>Ie,MAX_STORED_TOKEN_BYTES:()=>V,MFARequiredAuthError:()=>v,PhoneOtpError:()=>k,assertValidAuthTokens:()=>I,createAuthClient:()=>N,createMemoryTokenStorage:()=>E,createPhoneOtpClient:()=>Le,deriveCodeChallenge:()=>Z,generateCodeVerifier:()=>X,generateNonce:()=>M,generatePkce:()=>$,generateState:()=>j,isAuthError:()=>q,isUnrecoverableAuthError:()=>de,parseStoredAuthTokens:()=>xe,randomUrlSafeString:()=>D,safeParseStoredJson:()=>De,sanitizePostAuthRedirect:()=>Be,serializeAuthTokens:()=>Me,timingSafeEqual:()=>F,validateStorageKey:()=>je});module.exports=Ge(vt);var s=class extends Error{code;status;details;constructor(t,n,r){super(n),this.name="AuthError",this.code=t,this.status=r?.status,this.details=r?.details}},v=class extends s{mfaMethods;constructor(t,n,r,o){super("mfa_required",t,{status:r,details:o}),this.name="MFARequiredAuthError",this.mfaMethods=n}},A=class extends s{constructor(t,n){super("contract_error",t,{details:n}),this.name="AuthContractError"}};function Ke(e){switch(e){case"mfa_required":case"invalid_request":case"invalid_client":case"invalid_grant":case"unauthorized_client":case"unsupported_grant_type":case"invalid_scope":case"access_denied":case"unsupported_response_type":case"server_error":case"temporarily_unavailable":case"invalid_token":case"insufficient_scope":case"authentication_required":case"insufficient_user_authentication":return e;default:return"unknown_error"}}function Ye(e,t){if(!t)return new s("http_error",`Request failed with status ${e}`,{status:e});let n=Ke(t.error),r=t.error_description??t.reason??(t.error?`Auth error: ${t.error}`:`Request failed with status ${e}`);if(n==="mfa_required"){let o=Array.isArray(t.mfa_methods)?t.mfa_methods.filter(i=>typeof i=="string"):[];return new v(r,o,e,t)}return new s(n,r,{status:e,details:t})}async function ue(e){let t,n=await e.text();if(n)try{t=JSON.parse(n)}catch{t={reason:n}}return Ye(e.status,t)}function q(e){return e instanceof s}function de(e){return q(e)?e.code==="invalid_client"||e.code==="invalid_grant"||e.code==="unauthorized_client"||e.code==="invalid_token":!1}function G(e){if(!Array.isArray(e))return;let t=e.filter(n=>typeof n=="object"&&n!==null&&typeof n.type=="string");return t.length>0?t:void 0}async function m(e){let t=await e.getTokens();if(!t?.accessToken)throw new s("invalid_token","No access token is available. Authenticate first.");return t.accessToken}function y(e){return Object.fromEntries(Object.entries(e).filter(([,t])=>typeof t<"u"))}function b(e,t){let n=e.access_token,r=e.token_type,o=e.expires_in;if(typeof n!="string"||typeof r!="string"||typeof o!="number")throw new s("unknown_error","Unexpected token response payload.",{details:e});let i={accessToken:n,tokenType:r,expiresIn:o},a=typeof e.refresh_token=="string"?e.refresh_token:t;a&&(i.refreshToken=a),typeof e.scope=="string"&&(i.scope=e.scope),typeof e.id_token=="string"&&(i.idToken=e.id_token);let u=G(e.authorization_details);return u&&(i.authorizationDetails=u),i}function Xe(e){return{id:String(e.id??""),deviceName:typeof e.device_name=="string"?e.device_name:void 0,deviceType:String(e.device_type??""),browser:typeof e.browser=="string"?e.browser:void 0,os:typeof e.os=="string"?e.os:void 0,ipAddress:String(e.ip_address??""),country:typeof e.country=="string"?e.country:void 0,city:typeof e.city=="string"?e.city:void 0,isActive:!!e.is_active,isCurrent:!!e.is_current,isTrusted:!!e.is_trusted,lastUsedAt:typeof e.last_used_at=="string"?e.last_used_at:void 0,createdAt:typeof e.created_at=="string"?e.created_at:void 0}}function K(e){return{id:String(e.id??""),deviceId:typeof e.device_id=="string"?e.device_id:void 0,deviceName:typeof e.device_name=="string"?e.device_name:void 0,deviceType:String(e.device_type??""),userAgent:typeof e.user_agent=="string"?e.user_agent:void 0,browser:typeof e.browser=="string"?e.browser:void 0,browserVersion:typeof e.browser_version=="string"?e.browser_version:void 0,os:typeof e.os=="string"?e.os:void 0,osVersion:typeof e.os_version=="string"?e.os_version:void 0,ipAddress:String(e.ip_address??""),country:typeof e.country=="string"?e.country:void 0,city:typeof e.city=="string"?e.city:void 0,isActive:!!e.is_active,isRevoked:!!e.is_revoked,isCurrent:!!e.is_current,isTrusted:!!e.is_trusted,requiresMfa:!!e.requires_mfa,accessTokenCount:typeof e.access_token_count=="number"?e.access_token_count:0,lastUsedAt:typeof e.last_used_at=="string"?e.last_used_at:void 0,expiresAt:typeof e.expires_at=="string"?e.expires_at:void 0,createdAt:typeof e.created_at=="string"?e.created_at:void 0,revokedAt:typeof e.revoked_at=="string"?e.revoked_at:void 0,revocationReason:typeof e.revocation_reason=="string"?e.revocation_reason:void 0}}function Y(e){return{success:!!e.success,sessionsRevoked:typeof e.sessions_revoked=="number"?e.sessions_revoked:0,tokensRevoked:typeof e.tokens_revoked=="number"?e.tokens_revoked:0}}function Ze(e){let t=Array.isArray(e.items)?e.items:[],r=e.metadata&&typeof e.metadata=="object"?e.metadata:{};return{items:t.filter(o=>typeof o=="object"&&o!==null).map(Xe),metadata:{page:typeof r.page=="number"?r.page:1,per:typeof r.per=="number"?r.per:t.length,total:typeof r.total=="number"?r.total:t.length}}}function ce(e){return{async list(t){let n=await m(e),r=new URLSearchParams;typeof t?.page=="number"&&r.set("page",String(t.page)),typeof t?.perPage=="number"&&r.set("per_page",String(t.perPage)),t?.userId&&r.set("user_id",t.userId);let o=`/api/v1/sessions${r.size?`?${r.toString()}`:""}`,i=await e.http.request(o,{token:n});return Ze(i)},async current(){let t=await m(e),n=await e.http.request("/api/v1/sessions/current",{token:t});return K(n)},async get(t){let n=await m(e),r=await e.http.request(`/api/v1/sessions/${encodeURIComponent(t)}`,{token:n});return K(r)},async update(t,n){let r=await m(e),o=await e.http.request(`/api/v1/sessions/${encodeURIComponent(t)}`,{method:"PATCH",token:r,body:y({device_name:n.deviceName,is_trusted:n.isTrusted})});return K(o)},async revoke(t,n){let r=await m(e),o=await e.http.request(`/api/v1/sessions/${encodeURIComponent(t)}`,{method:"DELETE",token:r,body:y({reason:n?.reason})});return Y(o)},async revokeAll(){let t=await m(e),n=await e.http.request("/api/v1/sessions/revoke-all",{method:"POST",token:t});return Y(n)},async revokeAllDevices(){let t=await m(e),n=await e.http.request("/api/v1/sessions/revoke-all-devices",{method:"POST",token:t});return Y(n)}}}function pe(){let e=globalThis.crypto;if(!e?.getRandomValues)throw new s("invalid_request","Web Crypto API is unavailable in this runtime. PKCE requires globalThis.crypto.");return e}function fe(e){let t="";for(let r of e)t+=String.fromCharCode(r);if(typeof btoa!="function")throw new s("server_error","base64UrlEncode requires globalThis.btoa (Web/Deno runtime).");return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function D(e=32){if(!Number.isInteger(e)||e<=0)throw new s("invalid_request","randomUrlSafeString length must be a positive integer.");let t=new Uint8Array(e);return pe().getRandomValues(t),fe(t)}function j(){return D(32)}function M(){return D(32)}function X(){return D(32)}async function Z(e){let t=pe();if(!t.subtle?.digest)throw new s("invalid_request","SubtleCrypto.digest is unavailable; cannot derive an S256 code challenge.");let n=new TextEncoder().encode(e),r=await t.subtle.digest("SHA-256",n);return fe(new Uint8Array(r))}async function $(e="S256"){let t=X();if(e==="plain")return{codeVerifier:t,codeChallenge:t,codeChallengeMethod:"plain"};let n=await Z(t);return{codeVerifier:t,codeChallenge:n,codeChallengeMethod:"S256"}}function F(e,t){let n=new TextEncoder().encode(e),r=new TextEncoder().encode(t),o=Math.max(n.length,r.length),i=n.length^r.length;for(let a=0;a<o;a+=1)i|=(n[a]??0)^(r[a]??0);return i===0}function et(e){return{active:!!e.active,scope:typeof e.scope=="string"?e.scope:void 0,clientId:typeof e.client_id=="string"?e.client_id:void 0,username:typeof e.username=="string"?e.username:void 0,tokenType:typeof e.token_type=="string"?e.token_type:void 0,exp:typeof e.exp=="number"?e.exp:void 0,iat:typeof e.iat=="number"?e.iat:void 0,sub:typeof e.sub=="string"?e.sub:void 0,authorizationDetails:G(e.authorization_details)}}function L(e){return{async password(t){let n=y({grant_type:"password",client_id:e.config.clientId,client_secret:e.config.clientSecret,username:t.username,email:t.email,password:t.password,scope:t.scope,mfa_code:t.mfaCode,mfa_backup_code:t.mfaBackupCode}),r=await e.http.request("/oauth/token",{method:"POST",body:n}),o=b(r);return await e.setTokens(o),o},async refresh(t){let n=await e.getTokens(),r=t?.refreshToken??n?.refreshToken;if(!r)throw new s("invalid_request","No refresh token is available.");let o=y({grant_type:"refresh_token",client_id:e.config.clientId,client_secret:e.config.clientSecret,refresh_token:r,scope:t?.scope}),i=await e.http.request("/oauth/token",{method:"POST",body:o}),a=b(i,r);return await e.setTokens(a),a},async clientCredentials(t){let n=y({grant_type:"client_credentials",client_id:e.config.clientId,client_secret:e.config.clientSecret,scope:t?.scope}),r=await e.http.request("/oauth/token",{method:"POST",body:n}),o=b(r);return await e.setTokens(o),o},async authorizationCode(t){let n=y({grant_type:"authorization_code",client_id:e.config.clientId,client_secret:e.config.clientSecret,code:t.code,redirect_uri:t.redirectUri,code_verifier:t.codeVerifier,scope:t.scope}),r=await e.http.request("/oauth/token",{method:"POST",body:n}),o=b(r);return await e.setTokens(o),o},async revoke(t){let n=await e.getTokens(),r=t?.token??n?.accessToken;if(!r)throw new s("invalid_request","No token provided for revocation.");await e.http.request("/oauth/revoke",{method:"POST",body:y({client_id:e.config.clientId,client_secret:e.config.clientSecret,token:r,token_type_hint:t?.tokenTypeHint})}),n&&(r===n.accessToken||r===n.refreshToken)&&await e.clearTokens()},async introspect(t){let n=await e.http.request("/oauth/introspect",{method:"POST",body:y({client_id:e.config.clientId,client_secret:e.config.clientSecret,token:t.token})});return et(n)},async tokenExchange(t){let n=y({grant_type:"urn:ietf:params:oauth:grant-type:token-exchange",client_id:e.config.clientId,client_secret:e.config.clientSecret,subject_token:t.subjectToken,subject_token_type:t.subjectTokenType??"urn:ietf:params:oauth:token-type:access_token",requested_subject:t.requestedSubject,scope:t.scope,audience:t.audience}),r=await e.http.request("/oauth/token",{method:"POST",body:n}),o=b(r);return await e.setTokens(o),o}}}function le(e,t){let n=e.trim();if(!n)throw new s("invalid_request",`${t} is required.`);return n}async function g(e,t,n){let r=await m(e),o=n?.query,i=o&&Object.keys(o).length>0?`?${new URLSearchParams(Object.entries(o).filter(([,a])=>typeof a<"u").map(([a,u])=>[a,String(u)])).toString()}`:"";return e.http.request(`${t}${i}`,{method:n?.method,body:n?.body,token:r})}async function S(e,t,n){await g(e,t,n)}function C(e,t){return encodeURIComponent(le(e,t))}function tt(e){let t=Array.isArray(e.mfa_methods)?e.mfa_methods.filter(n=>typeof n=="string"):void 0;return{redirectUri:String(e.redirect_uri??""),code:typeof e.code=="string"?e.code:void 0,state:typeof e.state=="string"?e.state:void 0,error:typeof e.error=="string"?e.error:void 0,errorDescription:typeof e.error_description=="string"?e.error_description:void 0,mfaMethods:t,accessToken:typeof e.access_token=="string"?e.access_token:void 0,tokenType:typeof e.token_type=="string"?e.token_type:void 0,expiresIn:typeof e.expires_in=="number"?e.expires_in:void 0,scope:typeof e.scope=="string"?e.scope:void 0,idToken:typeof e.id_token=="string"?e.id_token:void 0}}function nt(e){let t=Array.isArray(e.redirect_uris)?e.redirect_uris.filter(n=>typeof n=="string"&&n.length>0):[];return{clientId:String(e.client_id??""),name:String(e.name??""),description:typeof e.description=="string"?e.description:void 0,isFirstParty:!!e.is_first_party,redirectUris:t}}function rt(e){let t=Array.isArray(e.mfa_methods)?e.mfa_methods.filter(r=>typeof r=="string"):void 0,n=Array.isArray(e.uncovered_scopes)?e.uncovered_scopes.filter(r=>typeof r=="string"):void 0;return{consentSatisfied:!!e.consent_satisfied,requiresMfa:!!e.requires_mfa,mfaMethods:t,uncoveredScopes:n,error:typeof e.error=="string"?e.error:void 0,errorDescription:typeof e.error_description=="string"?e.error_description:void 0,code:typeof e.code=="string"?e.code:void 0,redirectUri:typeof e.redirect_uri=="string"?e.redirect_uri:void 0,state:typeof e.state=="string"?e.state:void 0}}function me(e){if(!e.password&&!e.accessToken)throw new s("invalid_request","Either password or accessToken is required for consent.")}function he(e,t){let n=new URL(e),r=new URL(t);if(n.origin!==r.origin||n.pathname!=="/oauth/authorize/consent")throw new s("invalid_request","callbackUrl must target /oauth/authorize/consent on the configured auth server.");return n}function ge(e){async function t(r,o){me(o);let i=he(r,e.config.baseUrl),a={username:o.username,approved:o.approved??!0,requested_scopes:o.requestedScopes,mfa_code:o.mfaCode,mfa_backup_code:o.mfaBackupCode};o.password!==void 0&&(a.password=o.password);let u=await e.http.request(`${i.pathname}${i.search}`,{method:"POST",token:o.accessToken,body:a}),p=tt(u);if(p.error==="mfa_required")throw new v(p.errorDescription??"Multi-factor authentication is required",p.mfaMethods??[],void 0,u);return p}async function n(r,o){me(o);let i=he(r,e.config.baseUrl),a={username:o.username,requested_scopes:o.requestedScopes,mfa_code:o.mfaCode,mfa_backup_code:o.mfaBackupCode};o.password!==void 0&&(a.password=o.password);let u=await e.http.request(`${i.pathname}/evaluate${i.search}`,{method:"POST",token:o.accessToken,body:a}),p=rt(u);if(p.error==="mfa_required"||p.requiresMfa)throw new v(p.errorDescription??"Multi-factor authentication is required",p.mfaMethods??[],void 0,u);return p}return{consent:t,evaluateConsent:n,consentWithCredentials(r){return t(r.callbackUrl,{username:r.username,password:r.password,accessToken:r.accessToken,approved:r.approved,requestedScopes:r.requestedScopes,mfaCode:r.mfaCode,mfaBackupCode:r.mfaBackupCode})},evaluateConsentWithCredentials(r){return n(r.callbackUrl,{username:r.username,password:r.password,accessToken:r.accessToken,requestedScopes:r.requestedScopes,mfaCode:r.mfaCode,mfaBackupCode:r.mfaBackupCode})}}}function ye(e){return{async publicClient(t){let n=await e.http.request(`/oauth/clients/${encodeURIComponent(t)}/public`);return nt(n)},async discoverAuthorizationServer(){let t=await e.http.request("/.well-known/oauth-authorization-server");return{issuer:String(t.issuer??""),authorizationEndpoint:String(t.authorization_endpoint??""),tokenEndpoint:String(t.token_endpoint??""),jwksUri:typeof t.jwks_uri=="string"?t.jwks_uri:void 0,revocationEndpoint:typeof t.revocation_endpoint=="string"?t.revocation_endpoint:void 0,introspectionEndpoint:typeof t.introspection_endpoint=="string"?t.introspection_endpoint:void 0,registrationEndpoint:typeof t.registration_endpoint=="string"?t.registration_endpoint:void 0,scopesSupported:Array.isArray(t.scopes_supported)?t.scopes_supported.filter(n=>typeof n=="string"):void 0,responseTypesSupported:Array.isArray(t.response_types_supported)?t.response_types_supported.filter(n=>typeof n=="string"):[],grantTypesSupported:Array.isArray(t.grant_types_supported)?t.grant_types_supported.filter(n=>typeof n=="string"):void 0,codeChallengeMethodsSupported:Array.isArray(t.code_challenge_methods_supported)?t.code_challenge_methods_supported.filter(n=>typeof n=="string"):void 0,pushedAuthorizationRequestEndpoint:typeof t.pushed_authorization_request_endpoint=="string"?t.pushed_authorization_request_endpoint:void 0,requirePushedAuthorizationRequests:typeof t.require_pushed_authorization_requests=="boolean"?t.require_pushed_authorization_requests:void 0,authorizationDetailsTypesSupported:Array.isArray(t.authorization_details_types_supported)?t.authorization_details_types_supported.filter(n=>typeof n=="string"):void 0,raw:t}}}}var B="openid profile email offline_access",_e=new Set(["response_type","client_id","redirect_uri","scope","state","nonce","code_challenge","code_challenge_method","prompt","max_age","acr_values","login_hint","authorization_details","request_uri"]);function ot(e){if(typeof e=="string"){let t=e.indexOf("?"),n=t>=0?e.slice(t+1):e;return new URLSearchParams(n)}return e instanceof URLSearchParams?e:"raw"in e&&typeof e.raw=="object"?new URLSearchParams(e.raw):new URLSearchParams(e)}function ke(e){let t=ot(e),n={};return t.forEach((r,o)=>{n[o]=r}),{code:t.get("code")??void 0,state:t.get("state")??void 0,error:t.get("error")??void 0,errorDescription:t.get("error_description")??void 0,errorUri:t.get("error_uri")??void 0,raw:n}}function be(e){let t=L(e);return{...ge(e),async createRequest(r){if(!r.redirectUri?.trim())throw new s("invalid_request","redirectUri is required to build an authorization request.");let o=r.scope??B,i=r.state??j(),a=r.nonce??M(),u=await $(r.codeChallengeMethod??"S256"),p=r.authorizationEndpoint??`${e.config.baseUrl}/oauth/authorize`,R=new URL(p),l=R.searchParams;if(l.set("response_type",r.responseType??"code"),l.set("client_id",e.config.clientId),l.set("redirect_uri",r.redirectUri),l.set("scope",o),l.set("state",i),l.set("nonce",a),l.set("code_challenge",u.codeChallenge),l.set("code_challenge_method",u.codeChallengeMethod),r.authorizationDetails&&r.authorizationDetails.length>0&&l.set("authorization_details",JSON.stringify(r.authorizationDetails)),r.prompt&&l.set("prompt",r.prompt),r.maxAge!=null){if(!Number.isSafeInteger(r.maxAge)||r.maxAge<0)throw new s("invalid_request","maxAge must be a non-negative integer.");l.set("max_age",String(r.maxAge))}r.acrValues?.length&&l.set("acr_values",r.acrValues.join(" ")),r.loginHint&&l.set("login_hint",r.loginHint);for(let[w,z]of Object.entries(r.extraParams??{})){if(_e.has(w))throw new s("invalid_request",`extraParams may not override the reserved authorization parameter "${w}".`);l.set(w,z)}return{url:R.toString(),state:i,nonce:a,codeVerifier:u.codeVerifier,codeChallenge:u.codeChallenge,redirectUri:r.redirectUri,scope:o}},async pushAuthorizationRequest(r){if(!r.redirectUri?.trim())throw new s("invalid_request","redirectUri is required to push an authorization request.");let o=r.scope??B,i=r.state??j(),a=r.nonce??M(),u=await $(r.codeChallengeMethod??"S256"),p={response_type:r.responseType??"code",client_id:e.config.clientId,redirect_uri:r.redirectUri,scope:o,state:i,nonce:a,code_challenge:u.codeChallenge,code_challenge_method:u.codeChallengeMethod};if(e.config.clientSecret&&(p.client_secret=e.config.clientSecret),r.authorizationDetails&&r.authorizationDetails.length>0&&(p.authorization_details=JSON.stringify(r.authorizationDetails)),r.prompt&&(p.prompt=r.prompt),r.maxAge!=null){if(!Number.isSafeInteger(r.maxAge)||r.maxAge<0)throw new s("invalid_request","maxAge must be a non-negative integer.");p.max_age=String(r.maxAge)}r.acrValues?.length&&(p.acr_values=r.acrValues.join(" "));for(let[h,c]of Object.entries(r.extraParams??{})){if(_e.has(h))throw new s("invalid_request",`extraParams may not override the reserved authorization parameter "${h}".`);p[h]=c}let R=await e.http.request("/oauth/par",{method:"POST",body:p}),l=R.request_uri,w=R.expires_in;if(typeof l!="string"||typeof w!="number")throw new s("unknown_error","Unexpected pushed authorization response payload.",{details:R});let z=r.authorizationEndpoint??`${e.config.baseUrl}/oauth/authorize`,f=new URL(z);return f.searchParams.set("client_id",e.config.clientId),f.searchParams.set("request_uri",l),{requestUri:l,expiresIn:w,request:{url:f.toString(),state:i,nonce:a,codeVerifier:u.codeVerifier,codeChallenge:u.codeChallenge,redirectUri:r.redirectUri,scope:o,requestUri:l}}},parseCallback:ke,async probeAuthorize(r){let o=await e.http.requestRaw(r,{headers:{Accept:"application/json"},redirect:"manual"}),i=o.headers.get("location");if(i&&o.status>=300&&o.status<400)return{kind:"redirect",location:i,status:o.status};let a=await o.text(),u=a?JSON.parse(a):{};if(!o.ok)throw new s("server_error",typeof u.error_description=="string"?u.error_description:"Authorization probe failed",{status:o.status,details:u});let p=typeof u.authorization_url=="string"?u.authorization_url:void 0;return{kind:"json",status:o.status,authorizationUrl:p,payload:u}},async handleCallback(r){let i=typeof r.callback=="object"&&!(r.callback instanceof URLSearchParams)&&"raw"in r.callback?r.callback:ke(r.callback);if(i.error)throw new s("access_denied",i.errorDescription??`Authorization failed: ${i.error}`,{details:i.raw});if(!i.state||!F(i.state,r.expectedState))throw new s("invalid_request","State mismatch on authorization callback (possible CSRF).");if(!i.code)throw new s("invalid_request","Authorization callback is missing the `code` parameter.");return t.authorizationCode({code:i.code,redirectUri:r.redirectUri,codeVerifier:r.codeVerifier,scope:r.scope})}}}function O(e){let t=e.step_id,n=e.step_type,r=e.name,o=e.order,i=e.is_required,a=e.timeout;if(typeof t!="string"||typeof n!="string"||typeof r!="string"||typeof o!="number"||typeof i!="boolean"||typeof a!="number")throw new s("unknown_error","Unexpected flow step payload.",{details:e});return{stepId:t,stepType:n,name:r,description:typeof e.description=="string"?e.description:void 0,order:o,isRequired:i,timeout:a,inputSchema:e.input_schema&&typeof e.input_schema=="object"?e.input_schema:void 0}}function ee(e){let t=e.current_step,n=e.remaining_steps;if(!t||typeof t!="object")throw new s("unknown_error","Missing current_step in flow response.",{details:e});let r=e.continuation_token;if(typeof r!="string"||!r)throw new s("unknown_error","Missing continuation_token in flow response.",{details:e});return{sessionId:String(e.session_id??""),flowId:String(e.flow_id??""),flowName:String(e.flow_name??""),currentStep:O(t),remainingSteps:Array.isArray(n)?n.filter(o=>typeof o=="object"&&o!==null).map(O):[],expiresAt:String(e.expires_at??""),continuationToken:r}}function it(e){return{sessionId:String(e.session_id??""),status:String(e.status??""),purpose:String(e.purpose??""),currentStep:e.current_step&&typeof e.current_step=="object"?O(e.current_step):void 0,completedSteps:Array.isArray(e.completed_steps)?e.completed_steps.filter(t=>typeof t=="string"):[],remainingSteps:Array.isArray(e.remaining_steps)?e.remaining_steps.filter(t=>typeof t=="object"&&t!==null).map(O):[],failedAttempts:typeof e.failed_attempts=="number"?e.failed_attempts:0,expiresAt:String(e.expires_at??""),lastActivityAt:String(e.last_activity_at??"")}}async function te(e,t){let n=t.status;if(n==="error"||typeof t.error=="string"&&n!=="in_progress"&&n!=="complete")throw new s("invalid_request",typeof t.error=="string"?t.error:"Flow step failed.",{details:t});if(n==="in_progress"){let r=t.next_step,o=t.remaining_steps;if(!r||typeof r!="object")throw new s("unknown_error","Missing next_step in flow step response.",{details:t});let i=t.debug&&typeof t.debug=="object"&&!Array.isArray(t.debug)?t.debug:void 0;return{status:"in_progress",sessionId:String(t.session_id??""),nextStep:O(r),completedSteps:Array.isArray(t.completed_steps)?t.completed_steps.filter(u=>typeof u=="string"):[],remainingSteps:Array.isArray(o)?o.filter(u=>typeof u=="object"&&u!==null).map(O):[],debug:i}}if(n==="complete"){let r=b(t);return await e.setTokens(r),{status:"complete",accessToken:r.accessToken,refreshToken:r.refreshToken,tokenType:r.tokenType,expiresIn:r.expiresIn,scope:r.scope,amr:Array.isArray(t.amr)?t.amr.filter(i=>typeof i=="string"):[],acr:typeof t.acr=="string"?t.acr:""}}throw new s("unknown_error","Unknown flow step status.",{details:t})}function Re(e){return{async initAuthentication(t){let n=await e.http.request("/oauth/authenticate/init",{method:"POST",body:y({client_id:t?.clientId??e.config.clientId,username:t?.username,flow_type:t?.flowType})});return ee(n)},async executeStep(t){let n=await e.http.request("/oauth/authenticate/step",{method:"POST",body:{session_id:t.sessionId,step_id:t.stepId,continuation_token:t.continuationToken,credential:t.credential}});return te(e,n)},async initRegistration(t){let n=await e.http.request("/oauth/register/init",{method:"POST",body:y({client_id:t?.clientId??e.config.clientId,invite_code:t?.inviteCode,flow_type:t?.flowType})});return ee(n)},async executeRegistrationStep(t){let n=await e.http.request("/oauth/register/step",{method:"POST",body:{session_id:t.sessionId,step_id:t.stepId,continuation_token:t.continuationToken,credential:t.credential}});return te(e,n)},async getStatus(t,n){let r=new URLSearchParams({continuation_token:n}),o=await e.http.request(`/oauth/flow/status/${encodeURIComponent(t)}?${r}`);return it(o)},async initRecovery(t){let n=await e.http.request("/oauth/recovery/init",{method:"POST",body:y({client_id:t?.clientId??e.config.clientId,recovery_type:t?.recoveryType,redirect_uri:t?.redirectUri})});return ee(n)},async executeRecoveryStep(t){let n=await e.http.request("/oauth/recovery/step",{method:"POST",body:{session_id:t.sessionId,step_id:t.stepId,continuation_token:t.continuationToken,credential:t.credential}});return te(e,n)}}}function J(e){return Array.isArray(e)?e.filter(t=>typeof t=="string"):[]}function st(e){return{issuer:String(e.issuer??""),authorizationEndpoint:String(e.authorization_endpoint??""),tokenEndpoint:String(e.token_endpoint??""),userinfoEndpoint:typeof e.userinfo_endpoint=="string"?e.userinfo_endpoint:void 0,jwksUri:String(e.jwks_uri??""),revocationEndpoint:typeof e.revocation_endpoint=="string"?e.revocation_endpoint:void 0,introspectionEndpoint:typeof e.introspection_endpoint=="string"?e.introspection_endpoint:void 0,responseTypesSupported:J(e.response_types_supported),grantTypesSupported:J(e.grant_types_supported),scopesSupported:J(e.scopes_supported),codeChallengeMethodsSupported:J(e.code_challenge_methods_supported),raw:e}}function at(e){return{sub:String(e.sub??""),name:typeof e.name=="string"?e.name:void 0,givenName:typeof e.given_name=="string"?e.given_name:void 0,familyName:typeof e.family_name=="string"?e.family_name:void 0,middleName:typeof e.middle_name=="string"?e.middle_name:void 0,nickname:typeof e.nickname=="string"?e.nickname:void 0,preferredUsername:typeof e.preferred_username=="string"?e.preferred_username:void 0,profile:typeof e.profile=="string"?e.profile:void 0,picture:typeof e.picture=="string"?e.picture:void 0,website:typeof e.website=="string"?e.website:void 0,gender:typeof e.gender=="string"?e.gender:void 0,birthdate:typeof e.birthdate=="string"?e.birthdate:void 0,zoneinfo:typeof e.zoneinfo=="string"?e.zoneinfo:void 0,locale:typeof e.locale=="string"?e.locale:void 0,updatedAt:typeof e.updated_at=="number"?e.updated_at:void 0,email:typeof e.email=="string"?e.email:void 0,emailVerified:typeof e.email_verified=="boolean"?e.email_verified:void 0,phoneNumber:typeof e.phone_number=="string"?e.phone_number:void 0,phoneNumberVerified:typeof e.phone_number_verified=="boolean"?e.phone_number_verified:void 0}}function we(e){return{async userInfo(){let t=await m(e),n=await e.http.request("/oauth/userinfo",{token:t});return at(n)},async discover(){let t=await e.http.request("/.well-known/openid-configuration");return st(t)},async jwks(){let t=await e.http.request("/oauth/jwks");return{keys:Array.isArray(t.keys)?t.keys.filter(r=>typeof r=="object"&&r!==null):[]}}}}function H(e){return{...e,id:typeof e.id=="string"?e.id:"",organizationId:typeof e.organization_id=="string"?e.organization_id:void 0,email:typeof e.email=="string"?e.email:void 0,emailVerified:typeof e.email_verified=="boolean"?e.email_verified:void 0,username:typeof e.username=="string"?e.username:void 0,firstName:typeof e.first_name=="string"?e.first_name:void 0,lastName:typeof e.last_name=="string"?e.last_name:void 0,isActive:typeof e.is_active=="boolean"?e.is_active:void 0,isVerified:typeof e.is_verified=="boolean"?e.is_verified:void 0,mfaEnabled:typeof e.mfa_enabled=="boolean"?e.mfa_enabled:void 0}}function ve(e){if(typeof e!="object"||e===null||Array.isArray(e))throw new A("Malformed primary-email verification response.",e);let t=e,n=t.status,r=t.email,o=t.email_verified;if(!((n==="sent"||n==="verified")&&typeof r=="string"&&r.length>0&&typeof o=="boolean"&&(n==="sent"&&o===!1||n==="verified"&&o===!0)))throw new A("Malformed primary-email verification response.",t);return{status:n,email:r,emailVerified:o}}function ne(e){return{id:String(e.id??""),name:typeof e.name=="string"?e.name:void 0,email:typeof e.email=="string"?e.email:void 0,phoneNumber:typeof e.phone_number=="string"?e.phone_number:void 0,relationship:typeof e.relationship=="string"?e.relationship:void 0,isVerified:typeof e.is_verified=="boolean"?e.is_verified:void 0}}function ut(e){return{id:String(e.id??""),provider:String(e.provider??""),providerUserId:typeof e.provider_user_id=="string"?e.provider_user_id:void 0,email:typeof e.email=="string"?e.email:void 0,isPrimary:typeof e.is_primary=="boolean"?e.is_primary:void 0}}function Se(e){return dt(e)}function dt(e){return{async me(){let t=await m(e),n=await e.http.request("/api/v1/users/me",{token:t});return H(n)},async updateMe(t){let n=await g(e,"/api/v1/users/me",{method:"PATCH",body:t});return H(n)},emailVerification:{async start(t){let n=await g(e,"/api/v1/users/me/email/verify",{method:"POST",body:{email:t.email}});return ve(n)},async verify(t){let n=await g(e,"/api/v1/users/me/email/verify",{method:"POST",body:{code:t.code}});return ve(n)}},async changePassword(t){await S(e,"/api/v1/users/me/password",{method:"POST",body:{current_password:t.currentPassword,new_password:t.newPassword}})},async deleteAvatar(){let t=await g(e,"/api/v1/users/me/avatar",{method:"DELETE"});return H(t)},async uploadAvatar(t,n="avatar.jpg"){let r=await m(e),o=new FormData,i=t instanceof Blob?t:new Blob([new Uint8Array(t)]);o.append("avatar",i,n);let a=await e.http.request("/api/v1/users/me/avatar",{method:"POST",token:r,body:o});return H(a)},async verifyPhone(t){return g(e,"/api/v1/users/me/phone/verify",{method:"POST",body:t})},async verifyRecoveryEmail(t){return g(e,"/api/v1/users/me/recovery-email/verify",{method:"POST",body:t})},async securityOverview(){return g(e,"/api/v1/users/me/security-overview")},recoveryContacts:{async list(){let t=await g(e,"/api/v1/users/me/recovery-contacts");return Array.isArray(t)?t.filter(n=>typeof n=="object"&&n!==null).map(ne):[]},async create(t){let n=await g(e,"/api/v1/users/me/recovery-contacts",{method:"POST",body:t});return ne(n)},async update(t,n){let r=await g(e,`/api/v1/users/me/recovery-contacts/${C(t,"contactId")}`,{method:"PATCH",body:n});return ne(r)},async delete(t){await S(e,`/api/v1/users/me/recovery-contacts/${C(t,"contactId")}`,{method:"DELETE"})}},identities:{async list(){let t=await g(e,"/api/v1/users/me/identities");return Array.isArray(t)?t.filter(n=>typeof n=="object"&&n!==null).map(ut):[]},async unlink(t){await S(e,`/api/v1/users/me/identities/${C(t,"identityId")}`,{method:"DELETE"})},async setPrimary(t){return g(e,`/api/v1/users/me/identities/${C(t,"identityId")}/primary`,{method:"PATCH"})}},async deleteMe(t){await S(e,"/api/v1/users/me",{method:"DELETE",body:{password:t.password}})}}}function P(e){return e&&typeof e=="object"?e:{}}function Te(e){return{async registerBegin(t){let n=await m(e),r=await e.http.request("/api/v1/users/me/webauthn/register/begin",{method:"POST",token:n,body:t});return P(r)},async registerFinish(t){let n=await m(e),r=await e.http.request("/api/v1/users/me/webauthn/register/finish",{method:"POST",token:n,body:t});return P(r)},async authenticateBegin(t){let n=await e.http.request("/api/v1/users/me/webauthn/authenticate/begin",{method:"POST",body:t});return P(n)},async authenticateFinish(t){let n=await e.http.request("/api/v1/users/me/webauthn/authenticate/finish",{method:"POST",body:t}),r=P(n);if(typeof r.access_token=="string"){let o=b(r);await e.setTokens(o)}return r},async credentials(){let t=await m(e),n=await e.http.request("/api/v1/users/me/webauthn/credentials",{token:t});return P(n)},async removeCredential(t,n){let r=await m(e);await e.http.request(`/api/v1/users/me/webauthn/credentials/${encodeURIComponent(t)}`,{method:"DELETE",token:r,body:n?.password?{password:n.password}:void 0})},async renameCredential(t,n){let r=await m(e),o=await e.http.request(`/api/v1/users/me/webauthn/credentials/${encodeURIComponent(t)}/rename`,{method:"PATCH",token:r,body:n});return P(o)},async setPrimaryCredential(t){let n=await m(e),r=await e.http.request(`/api/v1/users/me/webauthn/credentials/${encodeURIComponent(t)}/primary`,{method:"POST",token:n});return P(r)}}}function ct(e){return{isActive:!!(e.is_active??e.isActive),message:typeof e.message=="string"?e.message:void 0,scheduledStart:typeof e.scheduled_start=="string"?e.scheduled_start:void 0,scheduledEnd:typeof e.scheduled_end=="string"?e.scheduled_end:void 0,...e}}function Ae(e){return{async status(){let t=await e.http.request("/api/v1/maintenance/status");return ct(t)}}}var pt=128,re=254;function T(e,t){if(typeof e!="string")return;let n=e.trim();if(!(!n||n.length>t))return n}function Ce(e){return{async request(t){let n=y({email:T(t.email,re),identifier:T(t.identifier,re),recovery_email:T(t.recoveryEmail,re),phone_number:T(t.phoneNumber,32),member_id:T(t.memberId,64),security_question:T(t.securityQuestion,256),security_answer:T(t.securityAnswer,256),redirect_uri:T(t.redirectUri,2048)}),r=await e.http.request("/oauth/password/reset/request",{method:"POST",body:n});return{ok:!!r.ok,message:String(r.message??"")}},async validate(t){let n=t.trim();if(!n)throw new s("invalid_request","token is required.");let r=await e.http.request(`/oauth/password/reset/validate?token=${encodeURIComponent(n)}`);return{ok:!!r.ok,valid:!!r.valid,expiresAt:typeof r.expires_at=="string"?r.expires_at:void 0}},async complete(t){if(!t.token.trim())throw new s("invalid_request","token is required.");if(!t.password||t.password.length>pt)throw new s("invalid_request","password is required and must be <= 128 characters.");let n=await e.http.request("/oauth/password/reset/complete",{method:"POST",body:{token:t.token.trim(),password:t.password,password_confirm:t.passwordConfirm}});return{ok:!!n.ok,message:String(n.message??"")}}}}function ft(e){return{id:String(e.id??""),deviceName:String(e.device_name??""),isVerified:!!e.is_verified,isPrimary:!!e.is_primary,createdAt:typeof e.created_at=="string"?e.created_at:void 0,lastUsedAt:typeof e.last_used_at=="string"?e.last_used_at:void 0}}function Pe(e){return{async setup(t){let n=t.deviceName?.trim();if(!n||n.length>128)throw new s("invalid_request","deviceName is required.");let r=await g(e,"/api/v1/users/me/mfa/setup",{method:"POST",body:{device_name:n}});return{deviceId:String(r.device_id??""),secret:String(r.secret??""),qrCodeUri:String(r.qr_code_uri??""),backupCodes:Array.isArray(r.backup_codes)?r.backup_codes.filter(o=>typeof o=="string"):[],algorithm:String(r.algorithm??""),digits:typeof r.digits=="number"?r.digits:6,period:typeof r.period=="number"?r.period:30}},async verify(t){return g(e,"/api/v1/users/me/mfa/verify",{method:"POST",body:{device_id:t.deviceId,totp_code:t.totpCode}})},async devices(){let t=await g(e,"/api/v1/users/me/mfa/devices");return Array.isArray(t)?t.filter(n=>typeof n=="object"&&n!==null).map(ft):[]},async removeDevice(t){await S(e,`/api/v1/users/me/mfa/devices/${C(t,"deviceId")}`,{method:"DELETE"})},async regenerateBackupCodes(){let t=await g(e,"/api/v1/users/me/mfa/backup-codes/regenerate",{method:"POST"});return{backupCodes:Array.isArray(t.backup_codes)?t.backup_codes.filter(n=>typeof n=="string"):[]}},async disable(t){await S(e,"/api/v1/users/me/mfa/disable",{method:"POST",body:y({password:t?.password})})}}}var Ee="https://prod-auth.tktchurch.com",lt=new Set(["localhost","127.0.0.1","[::1]"]);function mt(e){return lt.has(e.toLowerCase())}function oe(e,t={}){let n=(e??Ee).trim();if(!n)return oe(Ee,t);let o=(/^https?:\/\//i.test(n)?n:`https://${n}`).replace(/\/+$/,""),i;try{i=new URL(o)}catch{throw new s("invalid_request","baseUrl must be a valid absolute URL.")}if(i.protocol==="http:"&&!t.allowInsecureTransport&&!mt(i.hostname))throw new s("invalid_request","baseUrl must use HTTPS. Set allowInsecureTransport=true only for trusted local development.");return o}function ht(e,t){if(!e&&t<=0)return{cleanup:()=>{}};let n=new AbortController,r,o=()=>{n.abort(e?.reason)};return e&&(e.aborted?n.abort(e.reason):e.addEventListener("abort",o,{once:!0})),t>0&&(r=setTimeout(()=>{n.abort(new Error(`Request timed out after ${t}ms`))},t)),{signal:n.signal,cleanup:()=>{r&&clearTimeout(r),e&&e.removeEventListener("abort",o)}}}function gt(e,t){return/^https?:\/\//i.test(t)?t:`${e}${t.startsWith("/")?t:`/${t}`}`}function yt(e,t,n){let r=new Headers(e);return t&&new Headers(t).forEach((i,a)=>{r.set(a,i)}),n&&!r.has("Authorization")&&r.set("Authorization",`Bearer ${n}`),r}function qe(e){return{async request(t,n){let r=await this.requestRaw(t,n);if(!r.ok)throw await ue(r);if(r.status===204)return;let o=await r.text();if(o)return JSON.parse(o)},async requestRaw(t,n){let r=gt(e.baseUrl,t),o=yt(e.defaultHeaders,n?.headers,n?.token),{signal:i,cleanup:a}=ht(n?.signal,e.timeoutMs),u={method:n?.method??"GET",headers:o,signal:i,redirect:n?.redirect};typeof n?.body<"u"&&(n.body instanceof FormData?u.body=n.body:(o.has("Content-Type")||o.set("Content-Type","application/json"),u.body=JSON.stringify(n.body)));try{return await e.fetch(r,u)}catch(p){throw i?.aborted??!1?new s("timeout",`Request timed out: ${r}`,{details:p}):new s("network_error",`Network request failed: ${r}`,{details:p})}finally{a()}}}}var Ie="@tktchurch/auth/tokens",V=32768,Ue=new Set(["accessToken","tokenType","expiresIn","refreshToken","scope","idToken","authorizationDetails"]),ze=new Set(["__proto__","constructor","prototype"]),_t=/^[\w@./:-]{1,128}$/;function se(e){if(typeof e!="object"||e===null||Array.isArray(e))return!1;let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}function Oe(e){return typeof e=="string"&&e.length>0}function ie(e){return typeof e=="string"&&e.length>0?e:void 0}function I(e){if(!se(e))throw new s("invalid_request","Token storage rejected a non-object token payload.");for(let i of Object.keys(e))if(!Ue.has(i))throw new s("invalid_request",`Token storage rejected unknown field "${i}".`);if(!Oe(e.accessToken))throw new s("invalid_request","Token storage requires a non-empty accessToken.");if(!Oe(e.tokenType))throw new s("invalid_request","Token storage requires a non-empty tokenType.");if(typeof e.expiresIn!="number"||!Number.isFinite(e.expiresIn)||e.expiresIn<0)throw new s("invalid_request","Token storage requires a non-negative numeric expiresIn.");let t={accessToken:e.accessToken,tokenType:e.tokenType,expiresIn:e.expiresIn},n=ie(e.refreshToken);n&&(t.refreshToken=n);let r=ie(e.scope);r&&(t.scope=r);let o=ie(e.idToken);if(o&&(t.idToken=o),typeof e.authorizationDetails<"u"){if(!Array.isArray(e.authorizationDetails)||!e.authorizationDetails.every(i=>se(i)&&typeof i.type=="string"))throw new s("invalid_request","Token storage rejected malformed authorizationDetails.");t.authorizationDetails=e.authorizationDetails}return t}function xe(e){if(!se(e))return null;for(let t of Object.keys(e))if(ze.has(t)||!Ue.has(t))return null;try{return I(e)}catch{return null}}function De(e){return JSON.parse(e,(t,n)=>{if(ze.has(t))throw new SyntaxError("Forbidden JSON key in stored token payload.");return n})}function je(e){let t=e.trim();if(!t)throw new s("invalid_request","Token storage key must be a non-empty string.");if(!_t.test(t))throw new s("invalid_request","Token storage key contains unsupported characters or exceeds 128 characters.");return t}function Me(e){let t=I(e),n=JSON.stringify(t);if(n.length>V)throw new s("invalid_request",`Serialized token payload exceeds ${V} bytes.`);return n}var ae=class{state=null;get(){return this.state}set(t){if(!t){this.clear();return}this.state=I(t)}clear(){this.state=null}};function E(){return new ae}function kt(){return typeof window<"u"&&typeof window.document<"u"}function bt(e){if(e)return e;if(typeof globalThis.fetch=="function")return globalThis.fetch.bind(globalThis);throw new s("invalid_request","No fetch implementation available. Provide config.fetch.")}function $e(e){if(!e.clientId?.trim())throw new s("invalid_request","clientId is required.");if(kt()&&e.clientSecret&&!e.allowClientSecretInBrowser)throw new s("invalid_request","clientSecret in browser runtime is blocked by default. Set allowClientSecretInBrowser=true to override.");return{clientId:e.clientId,clientSecret:e.clientSecret,baseUrl:oe(e.baseUrl,{allowInsecureTransport:e.allowInsecureTransport??!1}),fetch:bt(e.fetch),storage:e.storage??E(),timeoutMs:e.timeoutMs??15e3,defaultHeaders:e.defaultHeaders??{},autoRefresh:e.autoRefresh??!0,allowClientSecretInBrowser:e.allowClientSecretInBrowser??!1,allowInsecureTransport:e.allowInsecureTransport??!1}}function N(e){let t=$e(e),n=qe({baseUrl:t.baseUrl,fetch:t.fetch,timeoutMs:t.timeoutMs,defaultHeaders:t.defaultHeaders}),r=async()=>await t.storage.get(),o=async u=>{await t.storage.set(u)},i=async()=>{await t.storage.clear()},a={config:t,http:n,getTokens:r,setTokens:o,clearTokens:i};return{token:L(a),flow:Re(a),oidc:we(a),authorize:be(a),user:Se(a),sessions:ce(a),webauthn:Te(a),passwordReset:Ce(a),mfa:Pe(a),maintenance:Ae(a),oauth:ye(a),tokens:{get:r,set:o,clear:i}}}var k=class extends Error{name="PhoneOtpError"};function U(e,t){return e instanceof k?e:q(e)?new k(e.message||t):e instanceof Error&&e.message?new k(e.message):new k(t)}function Ne(e){if(!q(e)||typeof e.status!="number")return!1;let t=e.status;return t>=400&&t<500&&t!==429}function Fe(e){if(e.status!=="in_progress"||!e.debug)return;let t=e.debug.verification_code;return typeof t=="string"?t:void 0}function Rt(e){return{...e,id:typeof e.id=="string"?e.id:"",first_name:typeof e.first_name=="string"?e.first_name:typeof e.firstName=="string"?e.firstName:void 0,last_name:typeof e.last_name=="string"?e.last_name:typeof e.lastName=="string"?e.lastName:void 0,email:typeof e.email=="string"?e.email:void 0,phone_number:typeof e.phone_number=="string"?e.phone_number:typeof e.phoneNumber=="string"?e.phoneNumber:void 0,phone_country_code:typeof e.phone_country_code=="string"?e.phone_country_code:typeof e.phoneCountryCode=="string"?e.phoneCountryCode:void 0,phone_verified:typeof e.phone_verified=="boolean"?e.phone_verified:typeof e.phoneVerified=="boolean"?e.phoneVerified:void 0,profile_picture_url:typeof e.profile_picture_url=="string"?e.profile_picture_url:typeof e.profilePictureUrl=="string"?e.profilePictureUrl:void 0,picture:typeof e.picture=="string"?e.picture:void 0,birthdate:typeof e.birthdate=="string"?e.birthdate:void 0}}function Le(e){let t=e.auth,n=e.guestProfile??{firstName:"Guest",lastName:"User"},r=n.emailDomain??"registrations.tktchurch.local",o=n.emailLocalPrefix??"reg";function i(){return t||N({baseUrl:e.baseUrl,clientId:e.clientId,allowInsecureTransport:e.allowInsecureTransport,timeoutMs:e.timeoutMs??2e4,storage:E(),autoRefresh:!1})}async function a(f,h){let c=i(),d=await c.flow.initAuthentication({flowType:"phone_only",username:h}),_=await c.flow.executeStep({sessionId:d.sessionId,stepId:d.currentStep.stepId,continuationToken:d.continuationToken,credential:f});if(_.status!=="in_progress")throw new k("Unexpected sign-in response.");return{oauthSessionId:d.sessionId,verifyStepId:_.nextStep.stepId,mode:"authentication",continuationToken:d.continuationToken,debugCode:Fe(_)}}async function u(f){let h=i(),c=await h.flow.initRegistration({flowType:"phone_registration"}),d=await h.flow.executeRegistrationStep({sessionId:c.sessionId,stepId:c.currentStep.stepId,continuationToken:c.continuationToken,credential:f});if(d.status!=="in_progress")throw new k("Unexpected verification response.");return{oauthSessionId:c.sessionId,verifyStepId:d.nextStep.stepId,mode:"registration",continuationToken:c.continuationToken,debugCode:Fe(d)}}async function p(f,h,c){let d={phone_country_code:f,phone_number:h};try{return await u(d)}catch(_){if(!Ne(_))throw U(_,"Could not send the code. Please try again.");try{return await a(d,c)}catch{throw U(_,"Could not send the code. Please try again.")}}}async function R(f,h,c){let d={phone_country_code:f,phone_number:h};try{return await a(d,c)}catch(_){if(!Ne(_))throw U(_,"Could not start sign-in.");try{return await u(d)}catch{throw U(_,"Could not start sign-in.")}}}async function l(f,h,c,d,_,x){return h==="registration"?await f.flow.executeRegistrationStep({sessionId:c,stepId:d,continuationToken:_,credential:x}):await f.flow.executeStep({sessionId:c,stepId:d,continuationToken:_,credential:x})}async function w(f,h){let c=i();try{let d=await l(c,f.mode,f.oauthSessionId,f.verifyStepId,f.continuationToken,{code:h}),_=0;for(;d.status==="in_progress"&&_<6;){_++;let x=d.nextStep.stepType,Q={};x==="profile_info"?Q={first_name:n.firstName,last_name:n.lastName,email:`${o}+${f.oauthSessionId.slice(0,8).toLowerCase()}@${r}`}:x==="terms_acceptance"&&(Q={accepted:"true"}),d=await l(c,f.mode,f.oauthSessionId,d.nextStep.stepId,f.continuationToken,Q)}if(d.status!=="complete")throw new k("Sign-in did not complete. Please try again.");return{accessToken:d.accessToken,refreshToken:d.refreshToken,expiresIn:d.expiresIn}}catch(d){throw d instanceof k?d:U(d,"That code didn't match. Try again.")}}async function z(f){let h;if(t)h=t;else{let c=E();await c.set({accessToken:f,tokenType:"Bearer",expiresIn:3600}),h=N({baseUrl:e.baseUrl,clientId:e.clientId,allowInsecureTransport:e.allowInsecureTransport,timeoutMs:e.timeoutMs??2e4,storage:c,autoRefresh:!1})}try{let c=await h.user.me();return Rt(c)}catch(c){throw U(c,c instanceof s?`Profile fetch failed (${c.status??"error"})`:"Profile fetch failed")}}return{startPhoneOTP:p,startPhoneOTPForSignIn:R,verifyPhoneOTP:w,fetchProfile:z}}var wt=/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;function Be(e,t="/"){if(!e)return t;let n=e;try{n=decodeURIComponent(e)}catch{return t}return n.startsWith("/")&&!n.startsWith("//")&&!n.startsWith("/\\")&&!wt.test(n)&&!/^\/+[\\/]/.test(n)?n:t}0&&(module.exports={AuthContractError,AuthError,DEFAULT_AUTHORIZE_SCOPE,DEFAULT_TOKEN_STORAGE_KEY,MAX_STORED_TOKEN_BYTES,MFARequiredAuthError,PhoneOtpError,assertValidAuthTokens,createAuthClient,createMemoryTokenStorage,createPhoneOtpClient,deriveCodeChallenge,generateCodeVerifier,generateNonce,generatePkce,generateState,isAuthError,isUnrecoverableAuthError,parseStoredAuthTokens,randomUrlSafeString,safeParseStoredJson,sanitizePostAuthRedirect,serializeAuthTokens,timingSafeEqual,validateStorageKey});
+"use strict";var W=Object.defineProperty;var He=Object.getOwnPropertyDescriptor;var Ve=Object.getOwnPropertyNames;var Qe=Object.prototype.hasOwnProperty;var We=(e,t)=>{for(var n in t)W(e,n,{get:t[n],enumerable:!0})},Ge=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Ve(t))!Qe.call(e,o)&&o!==n&&W(e,o,{get:()=>t[o],enumerable:!(r=He(t,o))||r.enumerable});return e};var Ke=e=>Ge(W({},"__esModule",{value:!0}),e);var At={};We(At,{AuthContractError:()=>b,AuthError:()=>i,DEFAULT_AUTHORIZE_SCOPE:()=>B,DEFAULT_TOKEN_STORAGE_KEY:()=>Ue,MAX_STORED_TOKEN_BYTES:()=>V,MFARequiredAuthError:()=>T,PhoneOtpError:()=>k,assertValidAuthTokens:()=>I,createAuthClient:()=>N,createMemoryTokenStorage:()=>E,createPhoneOtpClient:()=>Be,deriveCodeChallenge:()=>Z,generateCodeVerifier:()=>X,generateNonce:()=>M,generatePkce:()=>$,generateState:()=>j,isAuthError:()=>q,isUnrecoverableAuthError:()=>de,parseStoredAuthTokens:()=>De,randomUrlSafeString:()=>D,safeParseStoredJson:()=>je,sanitizePostAuthRedirect:()=>Je,serializeAuthTokens:()=>$e,timingSafeEqual:()=>F,validateStorageKey:()=>Me});module.exports=Ke(At);var i=class extends Error{code;status;details;constructor(t,n,r){super(n),this.name="AuthError",this.code=t,this.status=r?.status,this.details=r?.details}},T=class extends i{mfaMethods;constructor(t,n,r,o){super("mfa_required",t,{status:r,details:o}),this.name="MFARequiredAuthError",this.mfaMethods=n}},b=class extends i{constructor(t,n){super("contract_error",t,{details:n}),this.name="AuthContractError"}};function Ye(e){switch(e){case"mfa_required":case"invalid_request":case"invalid_client":case"invalid_grant":case"unauthorized_client":case"unsupported_grant_type":case"invalid_scope":case"access_denied":case"unsupported_response_type":case"server_error":case"temporarily_unavailable":case"invalid_token":case"insufficient_scope":case"authentication_required":case"insufficient_user_authentication":return e;default:return"unknown_error"}}function Xe(e,t){if(!t)return new i("http_error",`Request failed with status ${e}`,{status:e});let n=Ye(t.error),r=t.error_description??t.reason??(t.error?`Auth error: ${t.error}`:`Request failed with status ${e}`);if(n==="mfa_required"){let o=Array.isArray(t.mfa_methods)?t.mfa_methods.filter(s=>typeof s=="string"):[];return new T(r,o,e,t)}return new i(n,r,{status:e,details:t})}async function ue(e){let t,n=await e.text();if(n)try{t=JSON.parse(n)}catch{t={reason:n}}return Xe(e.status,t)}function q(e){return e instanceof i}function de(e){return q(e)?e.code==="invalid_client"||e.code==="invalid_grant"||e.code==="unauthorized_client"||e.code==="invalid_token":!1}function G(e){if(!Array.isArray(e))return;let t=e.filter(n=>typeof n=="object"&&n!==null&&typeof n.type=="string");return t.length>0?t:void 0}async function m(e){let t=await e.getTokens();if(!t?.accessToken)throw new i("invalid_token","No access token is available. Authenticate first.");return t.accessToken}function y(e){return Object.fromEntries(Object.entries(e).filter(([,t])=>typeof t<"u"))}function R(e,t){let n=e.access_token,r=e.token_type,o=e.expires_in;if(typeof n!="string"||typeof r!="string"||typeof o!="number")throw new i("unknown_error","Unexpected token response payload.",{details:e});let s={accessToken:n,tokenType:r,expiresIn:o},a=typeof e.refresh_token=="string"?e.refresh_token:t;a&&(s.refreshToken=a),typeof e.scope=="string"&&(s.scope=e.scope),typeof e.id_token=="string"&&(s.idToken=e.id_token);let u=G(e.authorization_details);return u&&(s.authorizationDetails=u),s}function Ze(e){return{id:String(e.id??""),deviceName:typeof e.device_name=="string"?e.device_name:void 0,deviceType:String(e.device_type??""),browser:typeof e.browser=="string"?e.browser:void 0,os:typeof e.os=="string"?e.os:void 0,ipAddress:String(e.ip_address??""),country:typeof e.country=="string"?e.country:void 0,city:typeof e.city=="string"?e.city:void 0,isActive:!!e.is_active,isCurrent:!!e.is_current,isTrusted:!!e.is_trusted,lastUsedAt:typeof e.last_used_at=="string"?e.last_used_at:void 0,createdAt:typeof e.created_at=="string"?e.created_at:void 0}}function K(e){return{id:String(e.id??""),deviceId:typeof e.device_id=="string"?e.device_id:void 0,deviceName:typeof e.device_name=="string"?e.device_name:void 0,deviceType:String(e.device_type??""),userAgent:typeof e.user_agent=="string"?e.user_agent:void 0,browser:typeof e.browser=="string"?e.browser:void 0,browserVersion:typeof e.browser_version=="string"?e.browser_version:void 0,os:typeof e.os=="string"?e.os:void 0,osVersion:typeof e.os_version=="string"?e.os_version:void 0,ipAddress:String(e.ip_address??""),country:typeof e.country=="string"?e.country:void 0,city:typeof e.city=="string"?e.city:void 0,isActive:!!e.is_active,isRevoked:!!e.is_revoked,isCurrent:!!e.is_current,isTrusted:!!e.is_trusted,requiresMfa:!!e.requires_mfa,accessTokenCount:typeof e.access_token_count=="number"?e.access_token_count:0,lastUsedAt:typeof e.last_used_at=="string"?e.last_used_at:void 0,expiresAt:typeof e.expires_at=="string"?e.expires_at:void 0,createdAt:typeof e.created_at=="string"?e.created_at:void 0,revokedAt:typeof e.revoked_at=="string"?e.revoked_at:void 0,revocationReason:typeof e.revocation_reason=="string"?e.revocation_reason:void 0}}function Y(e){return{success:!!e.success,sessionsRevoked:typeof e.sessions_revoked=="number"?e.sessions_revoked:0,tokensRevoked:typeof e.tokens_revoked=="number"?e.tokens_revoked:0}}function et(e){let t=Array.isArray(e.items)?e.items:[],r=e.metadata&&typeof e.metadata=="object"?e.metadata:{};return{items:t.filter(o=>typeof o=="object"&&o!==null).map(Ze),metadata:{page:typeof r.page=="number"?r.page:1,per:typeof r.per=="number"?r.per:t.length,total:typeof r.total=="number"?r.total:t.length}}}function ce(e){return{async list(t){let n=await m(e),r=new URLSearchParams;typeof t?.page=="number"&&r.set("page",String(t.page)),typeof t?.perPage=="number"&&r.set("per_page",String(t.perPage)),t?.userId&&r.set("user_id",t.userId);let o=`/api/v1/sessions${r.size?`?${r.toString()}`:""}`,s=await e.http.request(o,{token:n});return et(s)},async current(){let t=await m(e),n=await e.http.request("/api/v1/sessions/current",{token:t});return K(n)},async get(t){let n=await m(e),r=await e.http.request(`/api/v1/sessions/${encodeURIComponent(t)}`,{token:n});return K(r)},async update(t,n){let r=await m(e),o=await e.http.request(`/api/v1/sessions/${encodeURIComponent(t)}`,{method:"PATCH",token:r,body:y({device_name:n.deviceName,is_trusted:n.isTrusted})});return K(o)},async revoke(t,n){let r=await m(e),o=await e.http.request(`/api/v1/sessions/${encodeURIComponent(t)}`,{method:"DELETE",token:r,body:y({reason:n?.reason})});return Y(o)},async revokeAll(){let t=await m(e),n=await e.http.request("/api/v1/sessions/revoke-all",{method:"POST",token:t});return Y(n)},async revokeAllDevices(){let t=await m(e),n=await e.http.request("/api/v1/sessions/revoke-all-devices",{method:"POST",token:t});return Y(n)}}}function pe(){let e=globalThis.crypto;if(!e?.getRandomValues)throw new i("invalid_request","Web Crypto API is unavailable in this runtime. PKCE requires globalThis.crypto.");return e}function fe(e){let t="";for(let r of e)t+=String.fromCharCode(r);if(typeof btoa!="function")throw new i("server_error","base64UrlEncode requires globalThis.btoa (Web/Deno runtime).");return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function D(e=32){if(!Number.isInteger(e)||e<=0)throw new i("invalid_request","randomUrlSafeString length must be a positive integer.");let t=new Uint8Array(e);return pe().getRandomValues(t),fe(t)}function j(){return D(32)}function M(){return D(32)}function X(){return D(32)}async function Z(e){let t=pe();if(!t.subtle?.digest)throw new i("invalid_request","SubtleCrypto.digest is unavailable; cannot derive an S256 code challenge.");let n=new TextEncoder().encode(e),r=await t.subtle.digest("SHA-256",n);return fe(new Uint8Array(r))}async function $(e="S256"){let t=X();if(e==="plain")return{codeVerifier:t,codeChallenge:t,codeChallengeMethod:"plain"};let n=await Z(t);return{codeVerifier:t,codeChallenge:n,codeChallengeMethod:"S256"}}function F(e,t){let n=new TextEncoder().encode(e),r=new TextEncoder().encode(t),o=Math.max(n.length,r.length),s=n.length^r.length;for(let a=0;a<o;a+=1)s|=(n[a]??0)^(r[a]??0);return s===0}function tt(e){return{active:!!e.active,scope:typeof e.scope=="string"?e.scope:void 0,clientId:typeof e.client_id=="string"?e.client_id:void 0,username:typeof e.username=="string"?e.username:void 0,tokenType:typeof e.token_type=="string"?e.token_type:void 0,exp:typeof e.exp=="number"?e.exp:void 0,iat:typeof e.iat=="number"?e.iat:void 0,sub:typeof e.sub=="string"?e.sub:void 0,authorizationDetails:G(e.authorization_details)}}function L(e){return{async password(t){let n=y({grant_type:"password",client_id:e.config.clientId,client_secret:e.config.clientSecret,username:t.username,email:t.email,password:t.password,scope:t.scope,mfa_code:t.mfaCode,mfa_backup_code:t.mfaBackupCode}),r=await e.http.request("/oauth/token",{method:"POST",body:n}),o=R(r);return await e.setTokens(o),o},async refresh(t){let n=await e.getTokens(),r=t?.refreshToken??n?.refreshToken;if(!r)throw new i("invalid_request","No refresh token is available.");let o=y({grant_type:"refresh_token",client_id:e.config.clientId,client_secret:e.config.clientSecret,refresh_token:r,scope:t?.scope}),s=await e.http.request("/oauth/token",{method:"POST",body:o}),a=R(s,r);return await e.setTokens(a),a},async clientCredentials(t){let n=y({grant_type:"client_credentials",client_id:e.config.clientId,client_secret:e.config.clientSecret,scope:t?.scope}),r=await e.http.request("/oauth/token",{method:"POST",body:n}),o=R(r);return await e.setTokens(o),o},async authorizationCode(t){let n=y({grant_type:"authorization_code",client_id:e.config.clientId,client_secret:e.config.clientSecret,code:t.code,redirect_uri:t.redirectUri,code_verifier:t.codeVerifier,scope:t.scope}),r=await e.http.request("/oauth/token",{method:"POST",body:n}),o=R(r);return await e.setTokens(o),o},async revoke(t){let n=await e.getTokens(),r=t?.token??n?.accessToken;if(!r)throw new i("invalid_request","No token provided for revocation.");await e.http.request("/oauth/revoke",{method:"POST",body:y({client_id:e.config.clientId,client_secret:e.config.clientSecret,token:r,token_type_hint:t?.tokenTypeHint})}),n&&(r===n.accessToken||r===n.refreshToken)&&await e.clearTokens()},async introspect(t){let n=await e.http.request("/oauth/introspect",{method:"POST",body:y({client_id:e.config.clientId,client_secret:e.config.clientSecret,token:t.token})});return tt(n)},async tokenExchange(t){let n=y({grant_type:"urn:ietf:params:oauth:grant-type:token-exchange",client_id:e.config.clientId,client_secret:e.config.clientSecret,subject_token:t.subjectToken,subject_token_type:t.subjectTokenType??"urn:ietf:params:oauth:token-type:access_token",requested_subject:t.requestedSubject,scope:t.scope,audience:t.audience}),r=await e.http.request("/oauth/token",{method:"POST",body:n}),o=R(r);return await e.setTokens(o),o}}}function le(e,t){let n=e.trim();if(!n)throw new i("invalid_request",`${t} is required.`);return n}async function h(e,t,n){let r=await m(e),o=n?.query,s=o&&Object.keys(o).length>0?`?${new URLSearchParams(Object.entries(o).filter(([,a])=>typeof a<"u").map(([a,u])=>[a,String(u)])).toString()}`:"";return e.http.request(`${t}${s}`,{method:n?.method,body:n?.body,token:r})}async function v(e,t,n){await h(e,t,n)}function S(e,t){return encodeURIComponent(le(e,t))}function nt(e){let t=Array.isArray(e.mfa_methods)?e.mfa_methods.filter(n=>typeof n=="string"):void 0;return{redirectUri:String(e.redirect_uri??""),code:typeof e.code=="string"?e.code:void 0,state:typeof e.state=="string"?e.state:void 0,error:typeof e.error=="string"?e.error:void 0,errorDescription:typeof e.error_description=="string"?e.error_description:void 0,mfaMethods:t,accessToken:typeof e.access_token=="string"?e.access_token:void 0,tokenType:typeof e.token_type=="string"?e.token_type:void 0,expiresIn:typeof e.expires_in=="number"?e.expires_in:void 0,scope:typeof e.scope=="string"?e.scope:void 0,idToken:typeof e.id_token=="string"?e.id_token:void 0}}function rt(e){let t=Array.isArray(e.redirect_uris)?e.redirect_uris.filter(n=>typeof n=="string"&&n.length>0):[];return{clientId:String(e.client_id??""),name:String(e.name??""),description:typeof e.description=="string"?e.description:void 0,isFirstParty:!!e.is_first_party,redirectUris:t}}function ot(e){let t=Array.isArray(e.mfa_methods)?e.mfa_methods.filter(r=>typeof r=="string"):void 0,n=Array.isArray(e.uncovered_scopes)?e.uncovered_scopes.filter(r=>typeof r=="string"):void 0;return{consentSatisfied:!!e.consent_satisfied,requiresMfa:!!e.requires_mfa,mfaMethods:t,uncoveredScopes:n,error:typeof e.error=="string"?e.error:void 0,errorDescription:typeof e.error_description=="string"?e.error_description:void 0,code:typeof e.code=="string"?e.code:void 0,redirectUri:typeof e.redirect_uri=="string"?e.redirect_uri:void 0,state:typeof e.state=="string"?e.state:void 0}}function me(e){if(!e.password&&!e.accessToken)throw new i("invalid_request","Either password or accessToken is required for consent.")}function he(e,t){let n=new URL(e),r=new URL(t);if(n.origin!==r.origin||n.pathname!=="/oauth/authorize/consent")throw new i("invalid_request","callbackUrl must target /oauth/authorize/consent on the configured auth server.");return n}function ge(e){async function t(r,o){me(o);let s=he(r,e.config.baseUrl),a={username:o.username,approved:o.approved??!0,requested_scopes:o.requestedScopes,mfa_code:o.mfaCode,mfa_backup_code:o.mfaBackupCode};o.password!==void 0&&(a.password=o.password);let u=await e.http.request(`${s.pathname}${s.search}`,{method:"POST",token:o.accessToken,body:a}),p=nt(u);if(p.error==="mfa_required")throw new T(p.errorDescription??"Multi-factor authentication is required",p.mfaMethods??[],void 0,u);return p}async function n(r,o){me(o);let s=he(r,e.config.baseUrl),a={username:o.username,requested_scopes:o.requestedScopes,mfa_code:o.mfaCode,mfa_backup_code:o.mfaBackupCode};o.password!==void 0&&(a.password=o.password);let u=await e.http.request(`${s.pathname}/evaluate${s.search}`,{method:"POST",token:o.accessToken,body:a}),p=ot(u);if(p.error==="mfa_required"||p.requiresMfa)throw new T(p.errorDescription??"Multi-factor authentication is required",p.mfaMethods??[],void 0,u);return p}return{consent:t,evaluateConsent:n,consentWithCredentials(r){return t(r.callbackUrl,{username:r.username,password:r.password,accessToken:r.accessToken,approved:r.approved,requestedScopes:r.requestedScopes,mfaCode:r.mfaCode,mfaBackupCode:r.mfaBackupCode})},evaluateConsentWithCredentials(r){return n(r.callbackUrl,{username:r.username,password:r.password,accessToken:r.accessToken,requestedScopes:r.requestedScopes,mfaCode:r.mfaCode,mfaBackupCode:r.mfaBackupCode})}}}function ye(e){return{async publicClient(t){let n=await e.http.request(`/oauth/clients/${encodeURIComponent(t)}/public`);return rt(n)},async discoverAuthorizationServer(){let t=await e.http.request("/.well-known/oauth-authorization-server");return{issuer:String(t.issuer??""),authorizationEndpoint:String(t.authorization_endpoint??""),tokenEndpoint:String(t.token_endpoint??""),jwksUri:typeof t.jwks_uri=="string"?t.jwks_uri:void 0,revocationEndpoint:typeof t.revocation_endpoint=="string"?t.revocation_endpoint:void 0,introspectionEndpoint:typeof t.introspection_endpoint=="string"?t.introspection_endpoint:void 0,registrationEndpoint:typeof t.registration_endpoint=="string"?t.registration_endpoint:void 0,scopesSupported:Array.isArray(t.scopes_supported)?t.scopes_supported.filter(n=>typeof n=="string"):void 0,responseTypesSupported:Array.isArray(t.response_types_supported)?t.response_types_supported.filter(n=>typeof n=="string"):[],grantTypesSupported:Array.isArray(t.grant_types_supported)?t.grant_types_supported.filter(n=>typeof n=="string"):void 0,codeChallengeMethodsSupported:Array.isArray(t.code_challenge_methods_supported)?t.code_challenge_methods_supported.filter(n=>typeof n=="string"):void 0,pushedAuthorizationRequestEndpoint:typeof t.pushed_authorization_request_endpoint=="string"?t.pushed_authorization_request_endpoint:void 0,requirePushedAuthorizationRequests:typeof t.require_pushed_authorization_requests=="boolean"?t.require_pushed_authorization_requests:void 0,authorizationDetailsTypesSupported:Array.isArray(t.authorization_details_types_supported)?t.authorization_details_types_supported.filter(n=>typeof n=="string"):void 0,raw:t}}}}var B="openid profile email offline_access",_e=new Set(["response_type","client_id","redirect_uri","scope","state","nonce","code_challenge","code_challenge_method","prompt","max_age","acr_values","login_hint","authorization_details","request_uri"]);function st(e){if(typeof e=="string"){let t=e.indexOf("?"),n=t>=0?e.slice(t+1):e;return new URLSearchParams(n)}return e instanceof URLSearchParams?e:"raw"in e&&typeof e.raw=="object"?new URLSearchParams(e.raw):new URLSearchParams(e)}function ke(e){let t=st(e),n={};return t.forEach((r,o)=>{n[o]=r}),{code:t.get("code")??void 0,state:t.get("state")??void 0,error:t.get("error")??void 0,errorDescription:t.get("error_description")??void 0,errorUri:t.get("error_uri")??void 0,raw:n}}function be(e){let t=L(e);return{...ge(e),async createRequest(r){if(!r.redirectUri?.trim())throw new i("invalid_request","redirectUri is required to build an authorization request.");let o=r.scope??B,s=r.state??j(),a=r.nonce??M(),u=await $(r.codeChallengeMethod??"S256"),p=r.authorizationEndpoint??`${e.config.baseUrl}/oauth/authorize`,w=new URL(p),l=w.searchParams;if(l.set("response_type",r.responseType??"code"),l.set("client_id",e.config.clientId),l.set("redirect_uri",r.redirectUri),l.set("scope",o),l.set("state",s),l.set("nonce",a),l.set("code_challenge",u.codeChallenge),l.set("code_challenge_method",u.codeChallengeMethod),r.authorizationDetails&&r.authorizationDetails.length>0&&l.set("authorization_details",JSON.stringify(r.authorizationDetails)),r.prompt&&l.set("prompt",r.prompt),r.maxAge!=null){if(!Number.isSafeInteger(r.maxAge)||r.maxAge<0)throw new i("invalid_request","maxAge must be a non-negative integer.");l.set("max_age",String(r.maxAge))}r.acrValues?.length&&l.set("acr_values",r.acrValues.join(" ")),r.loginHint&&l.set("login_hint",r.loginHint);for(let[A,z]of Object.entries(r.extraParams??{})){if(_e.has(A))throw new i("invalid_request",`extraParams may not override the reserved authorization parameter "${A}".`);l.set(A,z)}return{url:w.toString(),state:s,nonce:a,codeVerifier:u.codeVerifier,codeChallenge:u.codeChallenge,redirectUri:r.redirectUri,scope:o}},async pushAuthorizationRequest(r){if(!r.redirectUri?.trim())throw new i("invalid_request","redirectUri is required to push an authorization request.");let o=r.scope??B,s=r.state??j(),a=r.nonce??M(),u=await $(r.codeChallengeMethod??"S256"),p={response_type:r.responseType??"code",client_id:e.config.clientId,redirect_uri:r.redirectUri,scope:o,state:s,nonce:a,code_challenge:u.codeChallenge,code_challenge_method:u.codeChallengeMethod};if(e.config.clientSecret&&(p.client_secret=e.config.clientSecret),r.authorizationDetails&&r.authorizationDetails.length>0&&(p.authorization_details=JSON.stringify(r.authorizationDetails)),r.prompt&&(p.prompt=r.prompt),r.maxAge!=null){if(!Number.isSafeInteger(r.maxAge)||r.maxAge<0)throw new i("invalid_request","maxAge must be a non-negative integer.");p.max_age=String(r.maxAge)}r.acrValues?.length&&(p.acr_values=r.acrValues.join(" "));for(let[g,c]of Object.entries(r.extraParams??{})){if(_e.has(g))throw new i("invalid_request",`extraParams may not override the reserved authorization parameter "${g}".`);p[g]=c}let w=await e.http.request("/oauth/par",{method:"POST",body:p}),l=w.request_uri,A=w.expires_in;if(typeof l!="string"||typeof A!="number")throw new i("unknown_error","Unexpected pushed authorization response payload.",{details:w});let z=r.authorizationEndpoint??`${e.config.baseUrl}/oauth/authorize`,f=new URL(z);return f.searchParams.set("client_id",e.config.clientId),f.searchParams.set("request_uri",l),{requestUri:l,expiresIn:A,request:{url:f.toString(),state:s,nonce:a,codeVerifier:u.codeVerifier,codeChallenge:u.codeChallenge,redirectUri:r.redirectUri,scope:o,requestUri:l}}},parseCallback:ke,async probeAuthorize(r){let o=await e.http.requestRaw(r,{headers:{Accept:"application/json"},redirect:"manual"}),s=o.headers.get("location");if(s&&o.status>=300&&o.status<400)return{kind:"redirect",location:s,status:o.status};let a=await o.text(),u=a?JSON.parse(a):{};if(!o.ok)throw new i("server_error",typeof u.error_description=="string"?u.error_description:"Authorization probe failed",{status:o.status,details:u});let p=typeof u.authorization_url=="string"?u.authorization_url:void 0;return{kind:"json",status:o.status,authorizationUrl:p,payload:u}},async handleCallback(r){let s=typeof r.callback=="object"&&!(r.callback instanceof URLSearchParams)&&"raw"in r.callback?r.callback:ke(r.callback);if(s.error)throw new i("access_denied",s.errorDescription??`Authorization failed: ${s.error}`,{details:s.raw});if(!s.state||!F(s.state,r.expectedState))throw new i("invalid_request","State mismatch on authorization callback (possible CSRF).");if(!s.code)throw new i("invalid_request","Authorization callback is missing the `code` parameter.");return t.authorizationCode({code:s.code,redirectUri:r.redirectUri,codeVerifier:r.codeVerifier,scope:r.scope})}}}function O(e){let t=e.step_id,n=e.step_type,r=e.name,o=e.order,s=e.is_required,a=e.timeout;if(typeof t!="string"||typeof n!="string"||typeof r!="string"||typeof o!="number"||typeof s!="boolean"||typeof a!="number")throw new i("unknown_error","Unexpected flow step payload.",{details:e});return{stepId:t,stepType:n,name:r,description:typeof e.description=="string"?e.description:void 0,order:o,isRequired:s,timeout:a,inputSchema:e.input_schema&&typeof e.input_schema=="object"?e.input_schema:void 0}}function ee(e){let t=e.current_step,n=e.remaining_steps;if(!t||typeof t!="object")throw new i("unknown_error","Missing current_step in flow response.",{details:e});let r=e.continuation_token;if(typeof r!="string"||!r)throw new i("unknown_error","Missing continuation_token in flow response.",{details:e});return{sessionId:String(e.session_id??""),flowId:String(e.flow_id??""),flowName:String(e.flow_name??""),currentStep:O(t),remainingSteps:Array.isArray(n)?n.filter(o=>typeof o=="object"&&o!==null).map(O):[],expiresAt:String(e.expires_at??""),continuationToken:r}}function it(e){return{sessionId:String(e.session_id??""),status:String(e.status??""),purpose:String(e.purpose??""),currentStep:e.current_step&&typeof e.current_step=="object"?O(e.current_step):void 0,completedSteps:Array.isArray(e.completed_steps)?e.completed_steps.filter(t=>typeof t=="string"):[],remainingSteps:Array.isArray(e.remaining_steps)?e.remaining_steps.filter(t=>typeof t=="object"&&t!==null).map(O):[],failedAttempts:typeof e.failed_attempts=="number"?e.failed_attempts:0,expiresAt:String(e.expires_at??""),lastActivityAt:String(e.last_activity_at??"")}}async function te(e,t){let n=t.status;if(n==="error"||typeof t.error=="string"&&n!=="in_progress"&&n!=="complete")throw new i("invalid_request",typeof t.error=="string"?t.error:"Flow step failed.",{details:t});if(n==="in_progress"){let r=t.next_step,o=t.remaining_steps;if(!r||typeof r!="object")throw new i("unknown_error","Missing next_step in flow step response.",{details:t});let s=t.debug&&typeof t.debug=="object"&&!Array.isArray(t.debug)?t.debug:void 0;return{status:"in_progress",sessionId:String(t.session_id??""),nextStep:O(r),completedSteps:Array.isArray(t.completed_steps)?t.completed_steps.filter(u=>typeof u=="string"):[],remainingSteps:Array.isArray(o)?o.filter(u=>typeof u=="object"&&u!==null).map(O):[],debug:s}}if(n==="complete"){let r=R(t);return await e.setTokens(r),{status:"complete",accessToken:r.accessToken,refreshToken:r.refreshToken,tokenType:r.tokenType,expiresIn:r.expiresIn,scope:r.scope,amr:Array.isArray(t.amr)?t.amr.filter(s=>typeof s=="string"):[],acr:typeof t.acr=="string"?t.acr:""}}throw new i("unknown_error","Unknown flow step status.",{details:t})}function Re(e){return{async initAuthentication(t){let n=await e.http.request("/oauth/authenticate/init",{method:"POST",body:y({client_id:t?.clientId??e.config.clientId,username:t?.username,flow_type:t?.flowType})});return ee(n)},async executeStep(t){let n=await e.http.request("/oauth/authenticate/step",{method:"POST",body:{session_id:t.sessionId,step_id:t.stepId,continuation_token:t.continuationToken,credential:t.credential}});return te(e,n)},async initRegistration(t){let n=await e.http.request("/oauth/register/init",{method:"POST",body:y({client_id:t?.clientId??e.config.clientId,invite_code:t?.inviteCode,flow_type:t?.flowType})});return ee(n)},async executeRegistrationStep(t){let n=await e.http.request("/oauth/register/step",{method:"POST",body:{session_id:t.sessionId,step_id:t.stepId,continuation_token:t.continuationToken,credential:t.credential}});return te(e,n)},async getStatus(t,n){let r=new URLSearchParams({continuation_token:n}),o=await e.http.request(`/oauth/flow/status/${encodeURIComponent(t)}?${r}`);return it(o)},async initRecovery(t){let n=await e.http.request("/oauth/recovery/init",{method:"POST",body:y({client_id:t?.clientId??e.config.clientId,recovery_type:t?.recoveryType,redirect_uri:t?.redirectUri})});return ee(n)},async executeRecoveryStep(t){let n=await e.http.request("/oauth/recovery/step",{method:"POST",body:{session_id:t.sessionId,step_id:t.stepId,continuation_token:t.continuationToken,credential:t.credential}});return te(e,n)}}}function J(e){return Array.isArray(e)?e.filter(t=>typeof t=="string"):[]}function at(e){return{issuer:String(e.issuer??""),authorizationEndpoint:String(e.authorization_endpoint??""),tokenEndpoint:String(e.token_endpoint??""),userinfoEndpoint:typeof e.userinfo_endpoint=="string"?e.userinfo_endpoint:void 0,jwksUri:String(e.jwks_uri??""),revocationEndpoint:typeof e.revocation_endpoint=="string"?e.revocation_endpoint:void 0,introspectionEndpoint:typeof e.introspection_endpoint=="string"?e.introspection_endpoint:void 0,responseTypesSupported:J(e.response_types_supported),grantTypesSupported:J(e.grant_types_supported),scopesSupported:J(e.scopes_supported),codeChallengeMethodsSupported:J(e.code_challenge_methods_supported),raw:e}}function ut(e){return{sub:String(e.sub??""),name:typeof e.name=="string"?e.name:void 0,givenName:typeof e.given_name=="string"?e.given_name:void 0,familyName:typeof e.family_name=="string"?e.family_name:void 0,middleName:typeof e.middle_name=="string"?e.middle_name:void 0,nickname:typeof e.nickname=="string"?e.nickname:void 0,preferredUsername:typeof e.preferred_username=="string"?e.preferred_username:void 0,profile:typeof e.profile=="string"?e.profile:void 0,picture:typeof e.picture=="string"?e.picture:void 0,website:typeof e.website=="string"?e.website:void 0,gender:typeof e.gender=="string"?e.gender:void 0,birthdate:typeof e.birthdate=="string"?e.birthdate:void 0,zoneinfo:typeof e.zoneinfo=="string"?e.zoneinfo:void 0,locale:typeof e.locale=="string"?e.locale:void 0,updatedAt:typeof e.updated_at=="number"?e.updated_at:void 0,email:typeof e.email=="string"?e.email:void 0,emailVerified:typeof e.email_verified=="boolean"?e.email_verified:void 0,phoneNumber:typeof e.phone_number=="string"?e.phone_number:void 0,phoneNumberVerified:typeof e.phone_number_verified=="boolean"?e.phone_number_verified:void 0}}function we(e){return{async userInfo(){let t=await m(e),n=await e.http.request("/oauth/userinfo",{token:t});return ut(n)},async discover(){let t=await e.http.request("/.well-known/openid-configuration");return at(t)},async jwks(){let t=await e.http.request("/oauth/jwks");return{keys:Array.isArray(t.keys)?t.keys.filter(r=>typeof r=="object"&&r!==null):[]}}}}function H(e){return{...e,id:typeof e.id=="string"?e.id:"",organizationId:typeof e.organization_id=="string"?e.organization_id:void 0,email:typeof e.email=="string"?e.email:void 0,emailVerified:typeof e.email_verified=="boolean"?e.email_verified:void 0,username:typeof e.username=="string"?e.username:void 0,firstName:typeof e.first_name=="string"?e.first_name:void 0,lastName:typeof e.last_name=="string"?e.last_name:void 0,isActive:typeof e.is_active=="boolean"?e.is_active:void 0,isVerified:typeof e.is_verified=="boolean"?e.is_verified:void 0,mfaEnabled:typeof e.mfa_enabled=="boolean"?e.mfa_enabled:void 0}}var dt=new Set(["created","processing","active","deleted"]);function ve(e){if(typeof e!="object"||e===null||Array.isArray(e))throw new b("Malformed avatar asset response.",e);let t=e,n=t.state,r=s=>s===null||typeof s>"u"||typeof s=="string",o=s=>s===null||typeof s>"u"||typeof s=="number"&&Number.isSafeInteger(s)&&s>=0;if(typeof t.id!="string"||t.id.length===0||typeof n!="string"||!dt.has(n)||typeof t.is_active!="boolean"||t.is_active!==(n==="active")||typeof t.is_managed!="boolean"||!r(t.content_type)||!o(t.byte_count)||!r(t.created_at)||!r(t.deleted_at))throw new b("Malformed avatar asset response.",t);return{id:t.id,state:n,isActive:t.is_active,isManaged:t.is_managed,contentType:typeof t.content_type=="string"?t.content_type:void 0,byteCount:typeof t.byte_count=="number"?t.byte_count:void 0,createdAt:typeof t.created_at=="string"?t.created_at:void 0,deletedAt:typeof t.deleted_at=="string"?t.deleted_at:void 0}}function Se(e){if(typeof e!="object"||e===null||Array.isArray(e))throw new b("Malformed primary-email verification response.",e);let t=e,n=t.status,r=t.email,o=t.email_verified;if(!((n==="sent"||n==="verified")&&typeof r=="string"&&r.length>0&&typeof o=="boolean"&&(n==="sent"&&o===!1||n==="verified"&&o===!0)))throw new b("Malformed primary-email verification response.",t);return{status:n,email:r,emailVerified:o}}function ne(e){return{id:String(e.id??""),name:typeof e.name=="string"?e.name:void 0,email:typeof e.email=="string"?e.email:void 0,phoneNumber:typeof e.phone_number=="string"?e.phone_number:void 0,relationship:typeof e.relationship=="string"?e.relationship:void 0,isVerified:typeof e.is_verified=="boolean"?e.is_verified:void 0}}function ct(e){return{id:String(e.id??""),provider:String(e.provider??""),providerUserId:typeof e.provider_user_id=="string"?e.provider_user_id:void 0,email:typeof e.email=="string"?e.email:void 0,isPrimary:typeof e.is_primary=="boolean"?e.is_primary:void 0}}function Ae(e){return pt(e)}function pt(e){return{async me(){let t=await m(e),n=await e.http.request("/api/v1/users/me",{token:t});return H(n)},async updateMe(t){let n=await h(e,"/api/v1/users/me",{method:"PATCH",body:t});return H(n)},emailVerification:{async start(t){let n=await h(e,"/api/v1/users/me/email/verify",{method:"POST",body:{email:t.email}});return Se(n)},async verify(t){let n=await h(e,"/api/v1/users/me/email/verify",{method:"POST",body:{code:t.code}});return Se(n)}},async changePassword(t){await v(e,"/api/v1/users/me/password",{method:"POST",body:{current_password:t.currentPassword,new_password:t.newPassword}})},async deleteAvatar(){let t=await h(e,"/api/v1/users/me/avatar",{method:"DELETE"});return H(t)},async uploadAvatar(t,n="avatar.jpg"){let r=await m(e),o=new FormData,s=t instanceof Blob?t:new Blob([new Uint8Array(t)]);o.append("avatar",s,n);let a=await e.http.request("/api/v1/users/me/avatar",{method:"POST",token:r,body:o});return H(a)},avatarAssets:{async list(){let t=await h(e,"/api/v1/users/me/avatar/assets");if(!Array.isArray(t))throw new b("Malformed avatar asset list response.",t);return t.map(ve)},async select(t){let n=await h(e,`/api/v1/users/me/avatar/assets/${S(t,"assetId")}/select`,{method:"POST"});return ve(n)},async delete(t){await v(e,`/api/v1/users/me/avatar/assets/${S(t,"assetId")}`,{method:"DELETE"})}},async verifyPhone(t){return h(e,"/api/v1/users/me/phone/verify",{method:"POST",body:t})},async verifyRecoveryEmail(t){return h(e,"/api/v1/users/me/recovery-email/verify",{method:"POST",body:t})},async securityOverview(){return h(e,"/api/v1/users/me/security-overview")},recoveryContacts:{async list(){let t=await h(e,"/api/v1/users/me/recovery-contacts");return Array.isArray(t)?t.filter(n=>typeof n=="object"&&n!==null).map(ne):[]},async create(t){let n=await h(e,"/api/v1/users/me/recovery-contacts",{method:"POST",body:t});return ne(n)},async update(t,n){let r=await h(e,`/api/v1/users/me/recovery-contacts/${S(t,"contactId")}`,{method:"PATCH",body:n});return ne(r)},async delete(t){await v(e,`/api/v1/users/me/recovery-contacts/${S(t,"contactId")}`,{method:"DELETE"})}},identities:{async list(){let t=await h(e,"/api/v1/users/me/identities");return Array.isArray(t)?t.filter(n=>typeof n=="object"&&n!==null).map(ct):[]},async unlink(t){await v(e,`/api/v1/users/me/identities/${S(t,"identityId")}`,{method:"DELETE"})},async setPrimary(t){return h(e,`/api/v1/users/me/identities/${S(t,"identityId")}/primary`,{method:"PATCH"})}},async deleteMe(t){await v(e,"/api/v1/users/me",{method:"DELETE",body:{password:t.password}})}}}function P(e){return e&&typeof e=="object"?e:{}}function Te(e){return{async registerBegin(t){let n=await m(e),r=await e.http.request("/api/v1/users/me/webauthn/register/begin",{method:"POST",token:n,body:t});return P(r)},async registerFinish(t){let n=await m(e),r=await e.http.request("/api/v1/users/me/webauthn/register/finish",{method:"POST",token:n,body:t});return P(r)},async authenticateBegin(t){let n=await e.http.request("/api/v1/users/me/webauthn/authenticate/begin",{method:"POST",body:t});return P(n)},async authenticateFinish(t){let n=await e.http.request("/api/v1/users/me/webauthn/authenticate/finish",{method:"POST",body:t}),r=P(n);if(typeof r.access_token=="string"){let o=R(r);await e.setTokens(o)}return r},async credentials(){let t=await m(e),n=await e.http.request("/api/v1/users/me/webauthn/credentials",{token:t});return P(n)},async removeCredential(t,n){let r=await m(e);await e.http.request(`/api/v1/users/me/webauthn/credentials/${encodeURIComponent(t)}`,{method:"DELETE",token:r,body:n?.password?{password:n.password}:void 0})},async renameCredential(t,n){let r=await m(e),o=await e.http.request(`/api/v1/users/me/webauthn/credentials/${encodeURIComponent(t)}/rename`,{method:"PATCH",token:r,body:n});return P(o)},async setPrimaryCredential(t){let n=await m(e),r=await e.http.request(`/api/v1/users/me/webauthn/credentials/${encodeURIComponent(t)}/primary`,{method:"POST",token:n});return P(r)}}}function ft(e){return{isActive:!!(e.is_active??e.isActive),message:typeof e.message=="string"?e.message:void 0,scheduledStart:typeof e.scheduled_start=="string"?e.scheduled_start:void 0,scheduledEnd:typeof e.scheduled_end=="string"?e.scheduled_end:void 0,...e}}function Ce(e){return{async status(){let t=await e.http.request("/api/v1/maintenance/status");return ft(t)}}}var lt=128,re=254;function C(e,t){if(typeof e!="string")return;let n=e.trim();if(!(!n||n.length>t))return n}function Pe(e){return{async request(t){let n=y({email:C(t.email,re),identifier:C(t.identifier,re),recovery_email:C(t.recoveryEmail,re),phone_number:C(t.phoneNumber,32),member_id:C(t.memberId,64),security_question:C(t.securityQuestion,256),security_answer:C(t.securityAnswer,256),redirect_uri:C(t.redirectUri,2048)}),r=await e.http.request("/oauth/password/reset/request",{method:"POST",body:n});return{ok:!!r.ok,message:String(r.message??"")}},async validate(t){let n=t.trim();if(!n)throw new i("invalid_request","token is required.");let r=await e.http.request(`/oauth/password/reset/validate?token=${encodeURIComponent(n)}`);return{ok:!!r.ok,valid:!!r.valid,expiresAt:typeof r.expires_at=="string"?r.expires_at:void 0}},async complete(t){if(!t.token.trim())throw new i("invalid_request","token is required.");if(!t.password||t.password.length>lt)throw new i("invalid_request","password is required and must be <= 128 characters.");let n=await e.http.request("/oauth/password/reset/complete",{method:"POST",body:{token:t.token.trim(),password:t.password,password_confirm:t.passwordConfirm}});return{ok:!!n.ok,message:String(n.message??"")}}}}function mt(e){return{id:String(e.id??""),deviceName:String(e.device_name??""),isVerified:!!e.is_verified,isPrimary:!!e.is_primary,createdAt:typeof e.created_at=="string"?e.created_at:void 0,lastUsedAt:typeof e.last_used_at=="string"?e.last_used_at:void 0}}function Ee(e){return{async setup(t){let n=t.deviceName?.trim();if(!n||n.length>128)throw new i("invalid_request","deviceName is required.");let r=await h(e,"/api/v1/users/me/mfa/setup",{method:"POST",body:{device_name:n}});return{deviceId:String(r.device_id??""),secret:String(r.secret??""),qrCodeUri:String(r.qr_code_uri??""),backupCodes:Array.isArray(r.backup_codes)?r.backup_codes.filter(o=>typeof o=="string"):[],algorithm:String(r.algorithm??""),digits:typeof r.digits=="number"?r.digits:6,period:typeof r.period=="number"?r.period:30}},async verify(t){return h(e,"/api/v1/users/me/mfa/verify",{method:"POST",body:{device_id:t.deviceId,totp_code:t.totpCode}})},async devices(){let t=await h(e,"/api/v1/users/me/mfa/devices");return Array.isArray(t)?t.filter(n=>typeof n=="object"&&n!==null).map(mt):[]},async removeDevice(t){await v(e,`/api/v1/users/me/mfa/devices/${S(t,"deviceId")}`,{method:"DELETE"})},async regenerateBackupCodes(){let t=await h(e,"/api/v1/users/me/mfa/backup-codes/regenerate",{method:"POST"});return{backupCodes:Array.isArray(t.backup_codes)?t.backup_codes.filter(n=>typeof n=="string"):[]}},async disable(t){await v(e,"/api/v1/users/me/mfa/disable",{method:"POST",body:y({password:t?.password})})}}}var qe="https://prod-auth.tktchurch.com",ht=new Set(["localhost","127.0.0.1","[::1]"]);function gt(e){return ht.has(e.toLowerCase())}function oe(e,t={}){let n=(e??qe).trim();if(!n)return oe(qe,t);let o=(/^https?:\/\//i.test(n)?n:`https://${n}`).replace(/\/+$/,""),s;try{s=new URL(o)}catch{throw new i("invalid_request","baseUrl must be a valid absolute URL.")}if(s.protocol==="http:"&&!t.allowInsecureTransport&&!gt(s.hostname))throw new i("invalid_request","baseUrl must use HTTPS. Set allowInsecureTransport=true only for trusted local development.");return o}function yt(e,t){if(!e&&t<=0)return{cleanup:()=>{}};let n=new AbortController,r,o=()=>{n.abort(e?.reason)};return e&&(e.aborted?n.abort(e.reason):e.addEventListener("abort",o,{once:!0})),t>0&&(r=setTimeout(()=>{n.abort(new Error(`Request timed out after ${t}ms`))},t)),{signal:n.signal,cleanup:()=>{r&&clearTimeout(r),e&&e.removeEventListener("abort",o)}}}function _t(e,t){return/^https?:\/\//i.test(t)?t:`${e}${t.startsWith("/")?t:`/${t}`}`}function kt(e,t,n){let r=new Headers(e);return t&&new Headers(t).forEach((s,a)=>{r.set(a,s)}),n&&!r.has("Authorization")&&r.set("Authorization",`Bearer ${n}`),r}function Oe(e){return{async request(t,n){let r=await this.requestRaw(t,n);if(!r.ok)throw await ue(r);if(r.status===204)return;let o=await r.text();if(o)return JSON.parse(o)},async requestRaw(t,n){let r=_t(e.baseUrl,t),o=kt(e.defaultHeaders,n?.headers,n?.token),{signal:s,cleanup:a}=yt(n?.signal,e.timeoutMs),u={method:n?.method??"GET",headers:o,signal:s,redirect:n?.redirect};typeof n?.body<"u"&&(n.body instanceof FormData?u.body=n.body:(o.has("Content-Type")||o.set("Content-Type","application/json"),u.body=JSON.stringify(n.body)));try{return await e.fetch(r,u)}catch(p){throw s?.aborted??!1?new i("timeout",`Request timed out: ${r}`,{details:p}):new i("network_error",`Network request failed: ${r}`,{details:p})}finally{a()}}}}var Ue="@tktchurch/auth/tokens",V=32768,ze=new Set(["accessToken","tokenType","expiresIn","refreshToken","scope","idToken","authorizationDetails"]),xe=new Set(["__proto__","constructor","prototype"]),bt=/^[\w@./:-]{1,128}$/;function ie(e){if(typeof e!="object"||e===null||Array.isArray(e))return!1;let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}function Ie(e){return typeof e=="string"&&e.length>0}function se(e){return typeof e=="string"&&e.length>0?e:void 0}function I(e){if(!ie(e))throw new i("invalid_request","Token storage rejected a non-object token payload.");for(let s of Object.keys(e))if(!ze.has(s))throw new i("invalid_request",`Token storage rejected unknown field "${s}".`);if(!Ie(e.accessToken))throw new i("invalid_request","Token storage requires a non-empty accessToken.");if(!Ie(e.tokenType))throw new i("invalid_request","Token storage requires a non-empty tokenType.");if(typeof e.expiresIn!="number"||!Number.isFinite(e.expiresIn)||e.expiresIn<0)throw new i("invalid_request","Token storage requires a non-negative numeric expiresIn.");let t={accessToken:e.accessToken,tokenType:e.tokenType,expiresIn:e.expiresIn},n=se(e.refreshToken);n&&(t.refreshToken=n);let r=se(e.scope);r&&(t.scope=r);let o=se(e.idToken);if(o&&(t.idToken=o),typeof e.authorizationDetails<"u"){if(!Array.isArray(e.authorizationDetails)||!e.authorizationDetails.every(s=>ie(s)&&typeof s.type=="string"))throw new i("invalid_request","Token storage rejected malformed authorizationDetails.");t.authorizationDetails=e.authorizationDetails}return t}function De(e){if(!ie(e))return null;for(let t of Object.keys(e))if(xe.has(t)||!ze.has(t))return null;try{return I(e)}catch{return null}}function je(e){return JSON.parse(e,(t,n)=>{if(xe.has(t))throw new SyntaxError("Forbidden JSON key in stored token payload.");return n})}function Me(e){let t=e.trim();if(!t)throw new i("invalid_request","Token storage key must be a non-empty string.");if(!bt.test(t))throw new i("invalid_request","Token storage key contains unsupported characters or exceeds 128 characters.");return t}function $e(e){let t=I(e),n=JSON.stringify(t);if(n.length>V)throw new i("invalid_request",`Serialized token payload exceeds ${V} bytes.`);return n}var ae=class{state=null;get(){return this.state}set(t){if(!t){this.clear();return}this.state=I(t)}clear(){this.state=null}};function E(){return new ae}function Rt(){return typeof window<"u"&&typeof window.document<"u"}function wt(e){if(e)return e;if(typeof globalThis.fetch=="function")return globalThis.fetch.bind(globalThis);throw new i("invalid_request","No fetch implementation available. Provide config.fetch.")}function Ne(e){if(!e.clientId?.trim())throw new i("invalid_request","clientId is required.");if(Rt()&&e.clientSecret&&!e.allowClientSecretInBrowser)throw new i("invalid_request","clientSecret in browser runtime is blocked by default. Set allowClientSecretInBrowser=true to override.");return{clientId:e.clientId,clientSecret:e.clientSecret,baseUrl:oe(e.baseUrl,{allowInsecureTransport:e.allowInsecureTransport??!1}),fetch:wt(e.fetch),storage:e.storage??E(),timeoutMs:e.timeoutMs??15e3,defaultHeaders:e.defaultHeaders??{},autoRefresh:e.autoRefresh??!0,allowClientSecretInBrowser:e.allowClientSecretInBrowser??!1,allowInsecureTransport:e.allowInsecureTransport??!1}}function N(e){let t=Ne(e),n=Oe({baseUrl:t.baseUrl,fetch:t.fetch,timeoutMs:t.timeoutMs,defaultHeaders:t.defaultHeaders}),r=async()=>await t.storage.get(),o=async u=>{await t.storage.set(u)},s=async()=>{await t.storage.clear()},a={config:t,http:n,getTokens:r,setTokens:o,clearTokens:s};return{token:L(a),flow:Re(a),oidc:we(a),authorize:be(a),user:Ae(a),sessions:ce(a),webauthn:Te(a),passwordReset:Pe(a),mfa:Ee(a),maintenance:Ce(a),oauth:ye(a),tokens:{get:r,set:o,clear:s}}}var k=class extends Error{name="PhoneOtpError"};function U(e,t){return e instanceof k?e:q(e)?new k(e.message||t):e instanceof Error&&e.message?new k(e.message):new k(t)}function Fe(e){if(!q(e)||typeof e.status!="number")return!1;let t=e.status;return t>=400&&t<500&&t!==429}function Le(e){if(e.status!=="in_progress"||!e.debug)return;let t=e.debug.verification_code;return typeof t=="string"?t:void 0}function vt(e){return{...e,id:typeof e.id=="string"?e.id:"",first_name:typeof e.first_name=="string"?e.first_name:typeof e.firstName=="string"?e.firstName:void 0,last_name:typeof e.last_name=="string"?e.last_name:typeof e.lastName=="string"?e.lastName:void 0,email:typeof e.email=="string"?e.email:void 0,phone_number:typeof e.phone_number=="string"?e.phone_number:typeof e.phoneNumber=="string"?e.phoneNumber:void 0,phone_country_code:typeof e.phone_country_code=="string"?e.phone_country_code:typeof e.phoneCountryCode=="string"?e.phoneCountryCode:void 0,phone_verified:typeof e.phone_verified=="boolean"?e.phone_verified:typeof e.phoneVerified=="boolean"?e.phoneVerified:void 0,profile_picture_url:typeof e.profile_picture_url=="string"?e.profile_picture_url:typeof e.profilePictureUrl=="string"?e.profilePictureUrl:void 0,picture:typeof e.picture=="string"?e.picture:void 0,birthdate:typeof e.birthdate=="string"?e.birthdate:void 0}}function Be(e){let t=e.auth,n=e.guestProfile??{firstName:"Guest",lastName:"User"},r=n.emailDomain??"registrations.tktchurch.local",o=n.emailLocalPrefix??"reg";function s(){return t||N({baseUrl:e.baseUrl,clientId:e.clientId,allowInsecureTransport:e.allowInsecureTransport,timeoutMs:e.timeoutMs??2e4,storage:E(),autoRefresh:!1})}async function a(f,g){let c=s(),d=await c.flow.initAuthentication({flowType:"phone_only",username:g}),_=await c.flow.executeStep({sessionId:d.sessionId,stepId:d.currentStep.stepId,continuationToken:d.continuationToken,credential:f});if(_.status!=="in_progress")throw new k("Unexpected sign-in response.");return{oauthSessionId:d.sessionId,verifyStepId:_.nextStep.stepId,mode:"authentication",continuationToken:d.continuationToken,debugCode:Le(_)}}async function u(f){let g=s(),c=await g.flow.initRegistration({flowType:"phone_registration"}),d=await g.flow.executeRegistrationStep({sessionId:c.sessionId,stepId:c.currentStep.stepId,continuationToken:c.continuationToken,credential:f});if(d.status!=="in_progress")throw new k("Unexpected verification response.");return{oauthSessionId:c.sessionId,verifyStepId:d.nextStep.stepId,mode:"registration",continuationToken:c.continuationToken,debugCode:Le(d)}}async function p(f,g,c){let d={phone_country_code:f,phone_number:g};try{return await u(d)}catch(_){if(!Fe(_))throw U(_,"Could not send the code. Please try again.");try{return await a(d,c)}catch{throw U(_,"Could not send the code. Please try again.")}}}async function w(f,g,c){let d={phone_country_code:f,phone_number:g};try{return await a(d,c)}catch(_){if(!Fe(_))throw U(_,"Could not start sign-in.");try{return await u(d)}catch{throw U(_,"Could not start sign-in.")}}}async function l(f,g,c,d,_,x){return g==="registration"?await f.flow.executeRegistrationStep({sessionId:c,stepId:d,continuationToken:_,credential:x}):await f.flow.executeStep({sessionId:c,stepId:d,continuationToken:_,credential:x})}async function A(f,g){let c=s();try{let d=await l(c,f.mode,f.oauthSessionId,f.verifyStepId,f.continuationToken,{code:g}),_=0;for(;d.status==="in_progress"&&_<6;){_++;let x=d.nextStep.stepType,Q={};x==="profile_info"?Q={first_name:n.firstName,last_name:n.lastName,email:`${o}+${f.oauthSessionId.slice(0,8).toLowerCase()}@${r}`}:x==="terms_acceptance"&&(Q={accepted:"true"}),d=await l(c,f.mode,f.oauthSessionId,d.nextStep.stepId,f.continuationToken,Q)}if(d.status!=="complete")throw new k("Sign-in did not complete. Please try again.");return{accessToken:d.accessToken,refreshToken:d.refreshToken,expiresIn:d.expiresIn}}catch(d){throw d instanceof k?d:U(d,"That code didn't match. Try again.")}}async function z(f){let g;if(t)g=t;else{let c=E();await c.set({accessToken:f,tokenType:"Bearer",expiresIn:3600}),g=N({baseUrl:e.baseUrl,clientId:e.clientId,allowInsecureTransport:e.allowInsecureTransport,timeoutMs:e.timeoutMs??2e4,storage:c,autoRefresh:!1})}try{let c=await g.user.me();return vt(c)}catch(c){throw U(c,c instanceof i?`Profile fetch failed (${c.status??"error"})`:"Profile fetch failed")}}return{startPhoneOTP:p,startPhoneOTPForSignIn:w,verifyPhoneOTP:A,fetchProfile:z}}var St=/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;function Je(e,t="/"){if(!e)return t;let n=e;try{n=decodeURIComponent(e)}catch{return t}return n.startsWith("/")&&!n.startsWith("//")&&!n.startsWith("/\\")&&!St.test(n)&&!/^\/+[\\/]/.test(n)?n:t}0&&(module.exports={AuthContractError,AuthError,DEFAULT_AUTHORIZE_SCOPE,DEFAULT_TOKEN_STORAGE_KEY,MAX_STORED_TOKEN_BYTES,MFARequiredAuthError,PhoneOtpError,assertValidAuthTokens,createAuthClient,createMemoryTokenStorage,createPhoneOtpClient,deriveCodeChallenge,generateCodeVerifier,generateNonce,generatePkce,generateState,isAuthError,isUnrecoverableAuthError,parseStoredAuthTokens,randomUrlSafeString,safeParseStoredJson,sanitizePostAuthRedirect,serializeAuthTokens,timingSafeEqual,validateStorageKey});

package/dist/index.d.cts

@@ -1,5 +1,6 @@
-import { A as AuthClientConfig, C as ConsumerAuthClient, a as AuthClient, b as AuthTokens } from './memory-Dqbnhmkh.cjs';
-export { c as AuthorizationCodeTokenRequest, d as AuthorizationConsentBody, e as AuthorizationConsentResponse, f as AuthorizationDetail, g as AuthorizationProbeResult, h as AuthorizationRequest, i as AuthorizationUrlOptions, j as AuthorizeEndpoints, k as CallbackParams, l as ClientCredentialsRequest, m as ConsumerMaintenanceEndpoints, n as ConsumerUserEndpoints, E as EmailVerificationResponse, o as ExecuteStepRequest, F as FlowEndpoints, p as FlowInitResponse, q as FlowSessionStatus, r as FlowStep, s as FlowStepCompleteResult, t as FlowStepInProgressResult, u as FlowStepResult, H as HandleCallbackOptions, I as InitAuthenticationRequest, v as InitRegistrationRequest, w as IntrospectTokenRequest, M as MaintenanceStatus, x as MfaDevice, y as MfaEndpoints, O as OAuthAuthorizationServerMetadata, z as OAuthMetaEndpoints, B as OidcDiscoveryDocument, D as OidcEndpoints, P as PageQuery, G as PageResponse, J as PasswordResetEndpoints, K as PasswordTokenRequest, L as PublicClientInfo, N as PushAuthorizationRequestOptions, Q as PushedAuthorizationResult, R as RefreshTokenRequest, S as RevocationResponse, T as RevokeSessionRequest, U as RevokeTokenRequest, V as SessionDetail, W as SessionEndpoints, X as SessionListQuery, Y as SessionSummary, Z as StartEmailVerificationRequest, _ as TokenEndpoints, $ as TokenExchangeRequest, a0 as TokenIntrospectionResponse, a1 as TokenStorage, a2 as UpdateSessionRequest, a3 as UserEndpoints, a4 as UserInfoResponse, a5 as UserProfile, a6 as VerifyEmailVerificationRequest, a7 as WebAuthnEndpoints, a8 as createMemoryTokenStorage } from './memory-Dqbnhmkh.cjs';
+import { A as AuthClientConfig, C as ConsumerAuthClient, a as AuthClient, b as AuthTokens } from './types-1sQaP6TE.cjs';
+export { c as AuthorizationCodeTokenRequest, d as AuthorizationConsentBody, e as AuthorizationConsentResponse, f as AuthorizationDetail, g as AuthorizationProbeResult, h as AuthorizationRequest, i as AuthorizationUrlOptions, j as AuthorizeEndpoints, k as AvatarAsset, l as AvatarAssetState, m as CallbackParams, n as ClientCredentialsRequest, o as ConsumerMaintenanceEndpoints, p as ConsumerUserEndpoints, E as EmailVerificationResponse, q as ExecuteStepRequest, F as FlowEndpoints, r as FlowInitResponse, s as FlowSessionStatus, t as FlowStep, u as FlowStepCompleteResult, v as FlowStepInProgressResult, w as FlowStepResult, H as HandleCallbackOptions, I as InitAuthenticationRequest, x as InitRegistrationRequest, y as IntrospectTokenRequest, M as MaintenanceStatus, z as MfaDevice, B as MfaEndpoints, O as OAuthAuthorizationServerMetadata, D as OAuthMetaEndpoints, G as OidcDiscoveryDocument, J as OidcEndpoints, P as PageQuery, K as PageResponse, L as PasswordResetEndpoints, N as PasswordTokenRequest, Q as PublicClientInfo, R as PushAuthorizationRequestOptions, S as PushedAuthorizationResult, T as RefreshTokenRequest, U as RevocationResponse, V as RevokeSessionRequest, W as RevokeTokenRequest, X as SessionDetail, Y as SessionEndpoints, Z as SessionListQuery, _ as SessionSummary, $ as StartEmailVerificationRequest, a0 as TokenEndpoints, a1 as TokenExchangeRequest, a2 as TokenIntrospectionResponse, a3 as TokenStorage, a4 as UpdateSessionRequest, a5 as UserEndpoints, a6 as UserInfoResponse, a7 as UserProfile, a8 as VerifyEmailVerificationRequest, a9 as WebAuthnEndpoints } from './types-1sQaP6TE.cjs';
+export { createMemoryTokenStorage } from './storage/memory.cjs';
 
 /**
  * Creates a consumer-only auth client for public npm distribution.

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-import { A as AuthClientConfig, C as ConsumerAuthClient, a as AuthClient, b as AuthTokens } from './memory-Dqbnhmkh.js';
-export { c as AuthorizationCodeTokenRequest, d as AuthorizationConsentBody, e as AuthorizationConsentResponse, f as AuthorizationDetail, g as AuthorizationProbeResult, h as AuthorizationRequest, i as AuthorizationUrlOptions, j as AuthorizeEndpoints, k as CallbackParams, l as ClientCredentialsRequest, m as ConsumerMaintenanceEndpoints, n as ConsumerUserEndpoints, E as EmailVerificationResponse, o as ExecuteStepRequest, F as FlowEndpoints, p as FlowInitResponse, q as FlowSessionStatus, r as FlowStep, s as FlowStepCompleteResult, t as FlowStepInProgressResult, u as FlowStepResult, H as HandleCallbackOptions, I as InitAuthenticationRequest, v as InitRegistrationRequest, w as IntrospectTokenRequest, M as MaintenanceStatus, x as MfaDevice, y as MfaEndpoints, O as OAuthAuthorizationServerMetadata, z as OAuthMetaEndpoints, B as OidcDiscoveryDocument, D as OidcEndpoints, P as PageQuery, G as PageResponse, J as PasswordResetEndpoints, K as PasswordTokenRequest, L as PublicClientInfo, N as PushAuthorizationRequestOptions, Q as PushedAuthorizationResult, R as RefreshTokenRequest, S as RevocationResponse, T as RevokeSessionRequest, U as RevokeTokenRequest, V as SessionDetail, W as SessionEndpoints, X as SessionListQuery, Y as SessionSummary, Z as StartEmailVerificationRequest, _ as TokenEndpoints, $ as TokenExchangeRequest, a0 as TokenIntrospectionResponse, a1 as TokenStorage, a2 as UpdateSessionRequest, a3 as UserEndpoints, a4 as UserInfoResponse, a5 as UserProfile, a6 as VerifyEmailVerificationRequest, a7 as WebAuthnEndpoints, a8 as createMemoryTokenStorage } from './memory-Dqbnhmkh.js';
+import { A as AuthClientConfig, C as ConsumerAuthClient, a as AuthClient, b as AuthTokens } from './types-1sQaP6TE.js';
+export { c as AuthorizationCodeTokenRequest, d as AuthorizationConsentBody, e as AuthorizationConsentResponse, f as AuthorizationDetail, g as AuthorizationProbeResult, h as AuthorizationRequest, i as AuthorizationUrlOptions, j as AuthorizeEndpoints, k as AvatarAsset, l as AvatarAssetState, m as CallbackParams, n as ClientCredentialsRequest, o as ConsumerMaintenanceEndpoints, p as ConsumerUserEndpoints, E as EmailVerificationResponse, q as ExecuteStepRequest, F as FlowEndpoints, r as FlowInitResponse, s as FlowSessionStatus, t as FlowStep, u as FlowStepCompleteResult, v as FlowStepInProgressResult, w as FlowStepResult, H as HandleCallbackOptions, I as InitAuthenticationRequest, x as InitRegistrationRequest, y as IntrospectTokenRequest, M as MaintenanceStatus, z as MfaDevice, B as MfaEndpoints, O as OAuthAuthorizationServerMetadata, D as OAuthMetaEndpoints, G as OidcDiscoveryDocument, J as OidcEndpoints, P as PageQuery, K as PageResponse, L as PasswordResetEndpoints, N as PasswordTokenRequest, Q as PublicClientInfo, R as PushAuthorizationRequestOptions, S as PushedAuthorizationResult, T as RefreshTokenRequest, U as RevocationResponse, V as RevokeSessionRequest, W as RevokeTokenRequest, X as SessionDetail, Y as SessionEndpoints, Z as SessionListQuery, _ as SessionSummary, $ as StartEmailVerificationRequest, a0 as TokenEndpoints, a1 as TokenExchangeRequest, a2 as TokenIntrospectionResponse, a3 as TokenStorage, a4 as UpdateSessionRequest, a5 as UserEndpoints, a6 as UserInfoResponse, a7 as UserProfile, a8 as VerifyEmailVerificationRequest, a9 as WebAuthnEndpoints } from './types-1sQaP6TE.js';
+export { createMemoryTokenStorage } from './storage/memory.js';
 
 /**
  * Creates a consumer-only auth client for public npm distribution.