@trymellon/js 1.7.2 → 1.7.4

package/dist/index.d.cts

@@ -81,6 +81,8 @@ interface RegisterOptions {
      */
     external_user_id?: string | ExternalUserId;
     authenticatorType?: 'platform' | 'cross-platform';
+    /** Optional URL to redirect to after success; validated against application allowlist. API returns it as redirect_url when allowed. */
+    successUrl?: string;
     signal?: AbortSignal;
 }
 interface AuthenticateOptions {
@@ -93,6 +95,8 @@ interface AuthenticateOptions {
      */
     external_user_id?: string | ExternalUserId;
     hint?: string;
+    /** Optional URL to redirect to after success; validated against application allowlist. API returns it as redirect_url when allowed. */
+    successUrl?: string;
     signal?: AbortSignal;
     /** Conditional UI mediation for passkey autofill / conditional UI. */
     mediation?: 'optional' | 'conditional' | 'required';
@@ -124,9 +128,13 @@ type EmailFallbackStartOptions = {
 type EmailFallbackVerifyOptions = {
     userId: string;
     code: string;
+    /** Optional URL to redirect to after success; validated against application allowlist. */
+    successUrl?: string;
 };
 type EmailFallbackVerifyResult = {
     sessionToken: string;
+    /** Set when successUrl was passed and allowed by application allowlist */
+    redirectUrl?: string;
 };
 type RecoveryVerifyResponse = {
     challenge: Record<string, unknown>;
@@ -218,6 +226,8 @@ type CrossDeviceInitResult = {
     session_id: string;
     qr_url: string;
     expires_at: string;
+    /** Opaque token; send in X-Polling-Token header when calling GET status. Not included in qr_url. */
+    polling_token: string;
 };
 type CrossDeviceStatusResult = {
     status: 'pending' | 'authenticated' | 'completed';
@@ -272,6 +282,7 @@ type RegisterFinishRequest = {
         };
         type: 'public-key';
     };
+    success_url?: string;
 };
 type AuthFinishRequest = {
     session_id: string;
@@ -286,6 +297,7 @@ type AuthFinishRequest = {
         };
         type: 'public-key';
     };
+    success_url?: string;
 };
 type RegisterStartResponse = {
     challenge: {
@@ -341,6 +353,8 @@ interface RegisterFinishResponse {
         email?: string;
         metadata?: Record<string, unknown>;
     };
+    /** Present when success_url was sent and allowed by application allowlist */
+    redirect_url?: string;
 }
 interface AuthFinishResponse {
     authenticated: boolean;
@@ -356,6 +370,8 @@ interface AuthFinishResponse {
         backupStatus?: boolean;
     };
     session_token: string;
+    /** Present when success_url was sent and allowed by application allowlist */
+    redirect_url?: string;
 }
 interface RegisterResult {
     success: true;
@@ -373,6 +389,8 @@ interface RegisterResult {
         email?: string;
         metadata?: Record<string, unknown>;
     };
+    /** Set when successUrl was passed and allowed by application allowlist */
+    redirectUrl?: string;
 }
 interface AuthenticateResult {
     authenticated: boolean;
@@ -388,6 +406,8 @@ interface AuthenticateResult {
         backupEligible?: boolean;
         backupStatus?: boolean;
     };
+    /** Set when successUrl was passed and allowed by application allowlist */
+    redirectUrl?: string;
 }
 type SessionValidateResponse = {
     valid: boolean;
@@ -481,8 +501,13 @@ declare class ApiClient {
         userId: string;
         email: string;
     }): Promise<Result<void, TryMellonError>>;
-    verifyEmailCode(userId: string, code: string): Promise<Result<{
+    verifyEmailCode(options: {
+        userId: string;
+        code: string;
+        successUrl?: string;
+    }): Promise<Result<{
         sessionToken: string;
+        redirectUrl?: string;
     }, TryMellonError>>;
     startOnboarding(request: OnboardingStartRequest): Promise<Result<OnboardingStartResponse, TryMellonError>>;
     getOnboardingStatus(sessionId: string): Promise<Result<OnboardingStatusResponse, TryMellonError>>;
@@ -493,7 +518,7 @@ declare class ApiClient {
     initCrossDeviceRegistration(options: {
         externalUserId: string;
     }): Promise<Result<CrossDeviceInitResult, TryMellonError>>;
-    getCrossDeviceStatus(sessionId: string): Promise<Result<CrossDeviceStatusResult, TryMellonError>>;
+    getCrossDeviceStatus(sessionId: string, pollingToken?: string | null): Promise<Result<CrossDeviceStatusResult, TryMellonError>>;
     /**
      * Fetches WebAuthn options for the cross-device session.
      * Contract: response is CrossDeviceContextResult (auth | registration).
@@ -565,7 +590,7 @@ declare class TryMellon {
             initRegistration: (options: {
                 externalUserId: string;
             }) => Promise<Result<CrossDeviceInitResult, TryMellonError>>;
-            waitForSession: (sessionId: string, signal?: AbortSignal) => Promise<Result<{
+            waitForSession: (sessionId: string, signal?: AbortSignal, pollingToken?: string | null) => Promise<Result<{
                 session_token: string;
                 user_id: string;
             }, TryMellonError>>;

package/dist/index.d.ts

@@ -81,6 +81,8 @@ interface RegisterOptions {
      */
     external_user_id?: string | ExternalUserId;
     authenticatorType?: 'platform' | 'cross-platform';
+    /** Optional URL to redirect to after success; validated against application allowlist. API returns it as redirect_url when allowed. */
+    successUrl?: string;
     signal?: AbortSignal;
 }
 interface AuthenticateOptions {
@@ -93,6 +95,8 @@ interface AuthenticateOptions {
      */
     external_user_id?: string | ExternalUserId;
     hint?: string;
+    /** Optional URL to redirect to after success; validated against application allowlist. API returns it as redirect_url when allowed. */
+    successUrl?: string;
     signal?: AbortSignal;
     /** Conditional UI mediation for passkey autofill / conditional UI. */
     mediation?: 'optional' | 'conditional' | 'required';
@@ -124,9 +128,13 @@ type EmailFallbackStartOptions = {
 type EmailFallbackVerifyOptions = {
     userId: string;
     code: string;
+    /** Optional URL to redirect to after success; validated against application allowlist. */
+    successUrl?: string;
 };
 type EmailFallbackVerifyResult = {
     sessionToken: string;
+    /** Set when successUrl was passed and allowed by application allowlist */
+    redirectUrl?: string;
 };
 type RecoveryVerifyResponse = {
     challenge: Record<string, unknown>;
@@ -218,6 +226,8 @@ type CrossDeviceInitResult = {
     session_id: string;
     qr_url: string;
     expires_at: string;
+    /** Opaque token; send in X-Polling-Token header when calling GET status. Not included in qr_url. */
+    polling_token: string;
 };
 type CrossDeviceStatusResult = {
     status: 'pending' | 'authenticated' | 'completed';
@@ -272,6 +282,7 @@ type RegisterFinishRequest = {
         };
         type: 'public-key';
     };
+    success_url?: string;
 };
 type AuthFinishRequest = {
     session_id: string;
@@ -286,6 +297,7 @@ type AuthFinishRequest = {
         };
         type: 'public-key';
     };
+    success_url?: string;
 };
 type RegisterStartResponse = {
     challenge: {
@@ -341,6 +353,8 @@ interface RegisterFinishResponse {
         email?: string;
         metadata?: Record<string, unknown>;
     };
+    /** Present when success_url was sent and allowed by application allowlist */
+    redirect_url?: string;
 }
 interface AuthFinishResponse {
     authenticated: boolean;
@@ -356,6 +370,8 @@ interface AuthFinishResponse {
         backupStatus?: boolean;
     };
     session_token: string;
+    /** Present when success_url was sent and allowed by application allowlist */
+    redirect_url?: string;
 }
 interface RegisterResult {
     success: true;
@@ -373,6 +389,8 @@ interface RegisterResult {
         email?: string;
         metadata?: Record<string, unknown>;
     };
+    /** Set when successUrl was passed and allowed by application allowlist */
+    redirectUrl?: string;
 }
 interface AuthenticateResult {
     authenticated: boolean;
@@ -388,6 +406,8 @@ interface AuthenticateResult {
         backupEligible?: boolean;
         backupStatus?: boolean;
     };
+    /** Set when successUrl was passed and allowed by application allowlist */
+    redirectUrl?: string;
 }
 type SessionValidateResponse = {
     valid: boolean;
@@ -481,8 +501,13 @@ declare class ApiClient {
         userId: string;
         email: string;
     }): Promise<Result<void, TryMellonError>>;
-    verifyEmailCode(userId: string, code: string): Promise<Result<{
+    verifyEmailCode(options: {
+        userId: string;
+        code: string;
+        successUrl?: string;
+    }): Promise<Result<{
         sessionToken: string;
+        redirectUrl?: string;
     }, TryMellonError>>;
     startOnboarding(request: OnboardingStartRequest): Promise<Result<OnboardingStartResponse, TryMellonError>>;
     getOnboardingStatus(sessionId: string): Promise<Result<OnboardingStatusResponse, TryMellonError>>;
@@ -493,7 +518,7 @@ declare class ApiClient {
     initCrossDeviceRegistration(options: {
         externalUserId: string;
     }): Promise<Result<CrossDeviceInitResult, TryMellonError>>;
-    getCrossDeviceStatus(sessionId: string): Promise<Result<CrossDeviceStatusResult, TryMellonError>>;
+    getCrossDeviceStatus(sessionId: string, pollingToken?: string | null): Promise<Result<CrossDeviceStatusResult, TryMellonError>>;
     /**
      * Fetches WebAuthn options for the cross-device session.
      * Contract: response is CrossDeviceContextResult (auth | registration).
@@ -565,7 +590,7 @@ declare class TryMellon {
             initRegistration: (options: {
                 externalUserId: string;
             }) => Promise<Result<CrossDeviceInitResult, TryMellonError>>;
-            waitForSession: (sessionId: string, signal?: AbortSignal) => Promise<Result<{
+            waitForSession: (sessionId: string, signal?: AbortSignal, pollingToken?: string | null) => Promise<Result<{
                 session_token: string;
                 user_id: string;
             }, TryMellonError>>;

package/dist/index.global.js

@@ -1,3 +1,3 @@
-var TryMellon=(function(exports){'use strict';var c=e=>({ok:true,value:e}),l=e=>({ok:false,error:e});var D=class e extends Error{code;details;isTryMellonError=true;constructor(r,t,n){super(t),this.name="TryMellonError",this.code=r,this.details=n,Error.captureStackTrace&&Error.captureStackTrace(this,e);}},qe={NOT_SUPPORTED:"WebAuthn is not supported in this environment",USER_CANCELLED:"User cancelled the operation",PASSKEY_NOT_FOUND:"Passkey not found",SESSION_EXPIRED:"Session has expired",NETWORK_FAILURE:"Network request failed",INVALID_ARGUMENT:"Invalid argument provided",TIMEOUT:"Operation timed out",ABORTED:"Operation was aborted",ABORT_ERROR:"Operation aborted by user or timeout",CHALLENGE_MISMATCH:"This link was already used or expired. Please try again from your computer.",UNKNOWN_ERROR:"An unknown error occurred"};function m(e,r,t){return new D(e,r??qe[e],t)}function F(e){return e instanceof D||typeof e=="object"&&e!==null&&"isTryMellonError"in e&&e.isTryMellonError===true}function X(){return m("NOT_SUPPORTED")}function Ve(){return m("USER_CANCELLED")}function Be(e){return m("NETWORK_FAILURE",void 0,{cause:e?.message,originalError:e})}function We(){return m("TIMEOUT")}function y(e,r){return m("INVALID_ARGUMENT",`Invalid argument: ${e} - ${r}`,{field:e,reason:r})}function ve(e){return m("UNKNOWN_ERROR",`Failed to ${e} credential`,{operation:e})}function G(e){return m("NOT_SUPPORTED",`No base64 ${e==="encode"?"encoding":"decoding"} available`,{type:e})}function z(e,r){try{let t=new URL(e);if(t.protocol!=="https:"&&t.protocol!=="http:")throw y(r,"must use http or https protocol")}catch(t){throw F(t)?t:y(r,"must be a valid URL")}}function O(e,r,t,n){if(!Number.isFinite(e))throw y(r,"must be a finite number");if(e<t||e>n)throw y(r,`must be between ${t} and ${n}`)}function L(e,r){if(typeof e!="string"||e.length===0)throw y(r,"must be a non-empty string");if(!/^[A-Za-z0-9_-]+$/.test(e))throw y(r,"must be a valid base64url string")}var He={NotAllowedError:"USER_CANCELLED",AbortError:"ABORTED",NotSupportedError:"NOT_SUPPORTED",SecurityError:"NOT_SUPPORTED",InvalidStateError:"UNKNOWN_ERROR",UnknownError:"UNKNOWN_ERROR"};function w(e){if(typeof e!="string")return "UNKNOWN_ERROR";let r=e.toLowerCase().trim();return {challenge_mismatch:"CHALLENGE_MISMATCH",session_expired:"SESSION_EXPIRED",unauthorized:"SESSION_EXPIRED",validation_error:"INVALID_ARGUMENT",invalid_argument:"INVALID_ARGUMENT",user_not_found:"SESSION_EXPIRED",passkey_not_found:"PASSKEY_NOT_FOUND"}[r]??"UNKNOWN_ERROR"}function v(e){if(e instanceof DOMException){let r=e.name,t=e.message||"WebAuthn operation failed",n=He[r]??"UNKNOWN_ERROR";return m(n,t,{originalError:e})}return e instanceof Error?m("UNKNOWN_ERROR",e.message,{originalError:e}):m("UNKNOWN_ERROR","An unknown error occurred",{originalError:e})}function g(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function u(e){return typeof e=="string"}function T(e){return typeof e=="number"&&Number.isFinite(e)}function K(e){return typeof e=="boolean"}function k(e){return Array.isArray(e)}function o(e,r){return l(m("UNKNOWN_ERROR",e,{...r,originalData:r?.originalData}))}function p(e,r){return e[r]}function Ee(e,r){return !g(e)||!u(e.name)||!u(e.id)?o("Invalid API response: challenge.rp must have name and id strings",{originalData:r}):c(true)}function be(e,r){return !g(e)||!u(e.id)||!u(e.name)||!u(e.displayName)?o("Invalid API response: challenge.user must have id, name, displayName strings",{originalData:r}):c(true)}function _e(e,r){if(!k(e))return o("Invalid API response: challenge.pubKeyCredParams must be array",{originalData:r});for(let t of e)if(!g(t)||t.type!=="public-key"||!T(t.alg))return o("Invalid API response: pubKeyCredParams items must have type and alg",{originalData:r});return c(true)}function Y(e,r){if(!g(e))return o("Invalid API response: user must be object",{field:"user",originalData:r});let t=p(e,"user_id"),n=p(e,"external_user_id");if(!u(t)||!u(n))return o("Invalid API response: user must have user_id and external_user_id strings",{originalData:r});let s=e.email,i=e.metadata;return s!==void 0&&!u(s)?o("Invalid API response: user.email must be string",{originalData:r}):i!==void 0&&(typeof i!="object"||i===null)?o("Invalid API response: user.metadata must be object",{originalData:r}):c({user_id:t,external_user_id:n,...s!==void 0&&{email:s},...i!==void 0&&{metadata:i}})}function J(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"session_id");if(!u(r))return o("Invalid API response: session_id must be string",{field:"session_id",originalData:e});let t=p(e,"challenge");if(!g(t))return o("Invalid API response: challenge must be object",{field:"challenge",originalData:e});let n=Ee(p(t,"rp"),e);if(!n.ok)return n;let s=be(p(t,"user"),e);if(!s.ok)return s;let i=p(t,"challenge");if(!u(i))return o("Invalid API response: challenge.challenge must be string",{originalData:e});let a=_e(p(t,"pubKeyCredParams"),e);if(!a.ok)return a;let d=t.timeout;if(d!==void 0&&!T(d))return o("Invalid API response: challenge.timeout must be number",{originalData:e});let R=t.excludeCredentials;if(R!==void 0){if(!k(R))return o("Invalid API response: excludeCredentials must be array",{originalData:e});for(let f of R)if(!g(f)||f.type!=="public-key"||!u(f.id))return o("Invalid API response: excludeCredentials items must have id and type",{originalData:e})}let h=t.authenticatorSelection;return h!==void 0&&!g(h)?o("Invalid API response: authenticatorSelection must be object",{originalData:e}):c({session_id:r,challenge:{rp:t.rp,user:t.user,challenge:i,pubKeyCredParams:t.pubKeyCredParams,...d!==void 0&&{timeout:d},...R!==void 0&&{excludeCredentials:R},...h!==void 0&&{authenticatorSelection:h}}})}function Z(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"session_id");if(!u(r))return o("Invalid API response: session_id must be string",{field:"session_id",originalData:e});let t=p(e,"challenge");if(!g(t))return o("Invalid API response: challenge must be object",{field:"challenge",originalData:e});let n=p(t,"challenge"),s=p(t,"rpId"),i=t.allowCredentials;if(!u(n))return o("Invalid API response: challenge.challenge must be string",{originalData:e});if(!u(s))return o("Invalid API response: challenge.rpId must be string",{originalData:e});if(i!==void 0&&!k(i))return o("Invalid API response: allowCredentials must be array",{originalData:e});if(i){for(let R of i)if(!g(R)||R.type!=="public-key"||!u(R.id))return o("Invalid API response: allowCredentials items must have id and type",{originalData:e})}let a=t.timeout;if(a!==void 0&&!T(a))return o("Invalid API response: challenge.timeout must be number",{originalData:e});let d=t.userVerification;return d!==void 0&&!["required","preferred","discouraged"].includes(String(d))?o("Invalid API response: userVerification must be required|preferred|discouraged",{originalData:e}):c({session_id:r,challenge:{challenge:n,rpId:s,allowCredentials:i??[],...a!==void 0&&{timeout:a},...d!==void 0&&{userVerification:d}}})}function Q(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"credential_id"),t=p(e,"status"),n=p(e,"session_token"),s=p(e,"user");if(!u(r))return o("Invalid API response: credential_id must be string",{field:"credential_id",originalData:e});if(!u(t))return o("Invalid API response: status must be string",{field:"status",originalData:e});if(!u(n))return o("Invalid API response: session_token must be string",{field:"session_token",originalData:e});let i=Y(s,e);return i.ok?c({credential_id:r,status:t,session_token:n,user:i.value}):o(i.error.message,{originalData:e})}function ee(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"authenticated"),t=p(e,"session_token"),n=p(e,"user"),s=p(e,"signals");if(!K(r))return o("Invalid API response: authenticated must be boolean",{field:"authenticated",originalData:e});if(!u(t))return o("Invalid API response: session_token must be string",{field:"session_token",originalData:e});let i=Y(n,e);return i.ok?s!==void 0&&!g(s)?o("Invalid API response: signals must be object",{originalData:e}):c({authenticated:r,session_token:t,user:i.value,signals:s}):o(i.error.message,{originalData:e})}function re(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"valid"),t=p(e,"user_id"),n=p(e,"external_user_id"),s=p(e,"tenant_id"),i=p(e,"app_id");return K(r)?u(t)?u(n)?u(s)?u(i)?c({valid:r,user_id:t,external_user_id:n,tenant_id:s,app_id:i}):o("Invalid API response: app_id must be string",{field:"app_id",originalData:e}):o("Invalid API response: tenant_id must be string",{field:"tenant_id",originalData:e}):o("Invalid API response: external_user_id must be string",{field:"external_user_id",originalData:e}):o("Invalid API response: user_id must be string",{field:"user_id",originalData:e}):o("Invalid API response: valid must be boolean",{field:"valid",originalData:e})}function te(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"sessionToken");return u(r)?c({sessionToken:r}):o("Invalid API response: sessionToken must be string",{field:"sessionToken",originalData:e})}var $e=["pending_passkey","pending_data","completed"],Xe=["pending_data","completed"];function ne(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"session_id"),t=p(e,"onboarding_url"),n=p(e,"expires_in");return u(r)?u(t)?T(n)?c({session_id:r,onboarding_url:t,expires_in:n}):o("Invalid API response: expires_in must be number",{field:"expires_in",originalData:e}):o("Invalid API response: onboarding_url must be string",{field:"onboarding_url",originalData:e}):o("Invalid API response: session_id must be string",{field:"session_id",originalData:e})}function se(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"status"),t=p(e,"onboarding_url"),n=p(e,"expires_in");return !u(r)||!$e.includes(r)?o("Invalid API response: status must be pending_passkey|pending_data|completed",{field:"status",originalData:e}):u(t)?T(n)?c({status:r,onboarding_url:t,expires_in:n}):o("Invalid API response: expires_in must be number",{originalData:e}):o("Invalid API response: onboarding_url must be string",{originalData:e})}function ie(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"session_id"),t=p(e,"status"),n=p(e,"onboarding_url");if(!u(r))return o("Invalid API response: session_id must be string",{field:"session_id",originalData:e});if(t!=="pending_passkey")return o("Invalid API response: status must be pending_passkey",{field:"status",originalData:e});if(!u(n))return o("Invalid API response: onboarding_url must be string",{originalData:e});let s=e.challenge,i;if(s!==void 0){let a=Ge(s);if(!a.ok)return a;i=a.value;}return c({session_id:r,status:"pending_passkey",onboarding_url:n,...i!==void 0&&{challenge:i}})}function Ge(e){if(!g(e))return o("Invalid API response: challenge must be object",{originalData:e});let r=p(e,"rp"),t=p(e,"user"),n=p(e,"challenge"),s=p(e,"pubKeyCredParams");if(!g(r)||!u(r.name)||!u(r.id))return o("Invalid API response: challenge.rp must have name and id",{originalData:e});if(!g(t)||!u(t.id)||!u(t.name)||!u(t.displayName))return o("Invalid API response: challenge.user must have id, name, displayName",{originalData:e});if(!u(n))return o("Invalid API response: challenge.challenge must be string",{originalData:e});if(!k(s))return o("Invalid API response: challenge.pubKeyCredParams must be array",{originalData:e});for(let i of s)if(!g(i)||i.type!=="public-key"||!T(i.alg))return o("Invalid API response: pubKeyCredParams items must have type and alg",{originalData:e});return c({rp:r,user:t,challenge:n,pubKeyCredParams:s})}function oe(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"session_id"),t=p(e,"status"),n=p(e,"user_id"),s=p(e,"tenant_id");return u(r)?!u(t)||!Xe.includes(t)?o("Invalid API response: status must be pending_data|completed",{originalData:e}):u(n)?u(s)?c({session_id:r,status:t,user_id:n,tenant_id:s}):o("Invalid API response: tenant_id must be string",{originalData:e}):o("Invalid API response: user_id must be string",{originalData:e}):o("Invalid API response: session_id must be string",{originalData:e})}function ae(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"session_id"),t=p(e,"status"),n=p(e,"user_id"),s=p(e,"tenant_id"),i=p(e,"session_token");return u(r)?t!=="completed"?o("Invalid API response: status must be completed",{originalData:e}):!u(n)||!u(s)||!u(i)?o("Invalid API response: user_id, tenant_id, session_token must be strings",{originalData:e}):c({session_id:r,status:"completed",user_id:n,tenant_id:s,session_token:i}):o("Invalid API response: session_id must be string",{originalData:e})}function ze(e){if(!e||typeof e!="object")return  false;let r=e;return typeof r.challenge=="string"&&r.rp!=null&&typeof r.rp=="object"&&r.user!=null&&typeof r.user=="object"&&Array.isArray(r.pubKeyCredParams)}function Ye(e){if(!e||typeof e!="object")return  false;let r=e;return typeof r.challenge=="string"&&typeof r.rpId=="string"}function j(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r="resultado"in e&&g(e.resultado)?e.resultado:e,t=r.session_id,n=r.qr_url,s=r.expires_at;return !u(t)||!u(n)||!u(s)?o("Invalid API response: missing required fields",{originalData:e}):c({session_id:t,qr_url:n,expires_at:s})}function le(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=e.status;return !u(r)||!["pending","authenticated","completed"].includes(r)?o("Invalid API response: invalid status",{originalData:e}):c({status:r,user_id:e.user_id,session_token:e.session_token})}function ue(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=e.type,t=r==="registration"?"registration":"auth",n=e.options;if(!g(n))return o("Invalid API response: options are required",{originalData:e});let s=200,i=Te(e.approval_context,s),a=Te(e.application_name,s);if(i===false||a===false)return o("Invalid API response: approval_context/application_name must be string max 200 chars",{originalData:e});let d={};return typeof i=="string"&&(d.approval_context=i),typeof a=="string"&&(d.application_name=a),t==="registration"?ze(n)?c({type:"registration",options:n,...d}):o("Invalid API response: registration options must have challenge, rp, user, pubKeyCredParams",{originalData:e}):Ye(n)?c({type:"auth",options:n,...d}):o("Invalid API response: auth options must have challenge and rpId",{originalData:e})}function Te(e,r){if(e!=null)return typeof e!="string"||e.length>r?false:e}function pe(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"challenge"),t=p(e,"recovery_session_id");return g(r)?u(t)?c({challenge:r,recovery_session_id:t}):o("Invalid API response: recovery_session_id must be string",{field:"recovery_session_id",originalData:e}):o("Invalid API response: challenge must be object",{field:"challenge",originalData:e})}function ce(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=p(e,"status"),t=p(e,"session_token"),n=p(e,"user"),s=p(e,"credential_id");if(!u(r))return o("Invalid API response: status must be string",{field:"status",originalData:e});if(!u(t))return o("Invalid API response: session_token must be string",{field:"session_token",originalData:e});if(!u(s))return o("Invalid API response: credential_id must be string",{field:"credential_id",originalData:e});if(!g(n))return o("Invalid API response: user must be object",{field:"user",originalData:e});let i=p(n,"user_id");if(!u(i))return o("Invalid API response: user.user_id must be string",{field:"user.user_id",originalData:e});let a=n;return c({status:r,session_token:t,credential_id:s,user:{user_id:i,external_user_id:u(a.external_user_id)?a.external_user_id:void 0,email:u(a.email)?a.email:void 0,metadata:g(a.metadata)?a.metadata:void 0}})}var q=class{constructor(r,t,n={}){this.httpClient=r;this.baseUrl=t;this.defaultHeaders=n;}mergeHeaders(r){return {...this.defaultHeaders,...r}}async post(r,t,n){let s=`${this.baseUrl}${r}`,i=await this.httpClient.post(s,t,this.mergeHeaders());return i.ok?n(i.value):l(i.error)}async get(r,t,n){let s=`${this.baseUrl}${r}`,i=await this.httpClient.get(s,this.mergeHeaders(n));return i.ok?t(i.value):l(i.error)}async startRegister(r){return this.post("/v1/passkeys/register/start",r,J)}async startAuth(r){return this.post("/v1/passkeys/auth/start",r,Z)}async finishRegister(r){return this.post("/v1/passkeys/register/finish",r,Q)}async finishAuthentication(r){return this.post("/v1/passkeys/auth/finish",r,ee)}async validateSession(r){return this.get("/v1/sessions/validate",re,{Authorization:`Bearer ${r}`})}async startEmailFallback(r){let t=`${this.baseUrl}/v1/fallback/email/start`,n=await this.httpClient.post(t,{userId:r.userId,email:r.email},this.mergeHeaders());return n.ok?c(void 0):l(n.error)}async verifyEmailCode(r,t){return this.post("/v1/fallback/email/verify",{userId:r,code:t},te)}async startOnboarding(r){return this.post("/onboarding/start",r,ne)}async getOnboardingStatus(r){return this.get(`/onboarding/${r}/status`,se)}async getOnboardingRegister(r){return this.get(`/onboarding/${r}/register`,ie)}async registerOnboardingPasskey(r,t){return this.post(`/onboarding/${r}/register-passkey`,t,oe)}async completeOnboarding(r,t){return this.post(`/onboarding/${r}/complete`,t,ae)}async initCrossDeviceAuth(){return this.post("/v1/auth/cross-device/init",{},j)}async initCrossDeviceRegistration(r){return this.post("/v1/auth/cross-device/init-registration",{external_user_id:r.externalUserId},j)}async getCrossDeviceStatus(r){return this.get(`/v1/auth/cross-device/status/${r}`,le)}async getCrossDeviceContext(r){return this.get(`/v1/auth/cross-device/context/${r}`,ue)}async verifyCrossDeviceAuth(r){let t=`${this.baseUrl}/v1/auth/cross-device/verify`,n=await this.httpClient.post(t,r,this.mergeHeaders());return n.ok?c(void 0):l(n.error)}async verifyCrossDeviceRegistration(r){let t=`${this.baseUrl}/v1/auth/cross-device/verify-registration`,n=await this.httpClient.post(t,r,this.mergeHeaders());return n.ok?c(void 0):l(n.error)}async verifyAccountRecoveryOtp(r,t){return this.post("/v1/users/recovery/verify",{external_id:r,otp:t},pe)}async completeAccountRecovery(r,t){return this.post("/v1/users/recovery/complete",{recovery_session_id:r,credential:t},ce)}};function Je(e){return typeof e=="object"&&e!==null&&e.ok===true&&"resultado"in e}function Ze(e){if(typeof e!="object"||e===null)return  false;let r=e;if(r.ok!==false||!r.error||typeof r.error!="object")return  false;let t=r.error;return typeof t.code=="string"&&typeof t.message=="string"}function Qe(e,r){if(Ze(e))return {message:e.error.message,code:w(e.error.code)};let t=e,n=t?.error;if(typeof n=="object"&&n!==null&&"code"in n&&typeof n.code=="string")return {message:n.message??t?.message??r,code:w(n.code)};let s=t?.message??r,i=t?.error,a=typeof i=="string"?w(i):i===void 0?"NETWORK_FAILURE":w(String(i));return {message:s,code:a}}var er=3e4;function rr(){if(typeof globalThis.crypto<"u"&&typeof globalThis.crypto.randomUUID=="function")return globalThis.crypto.randomUUID();throw new Error("Web Crypto API is required but not available.")}function Ae(e,r){let t=r*Math.pow(2,e);return Math.min(t,er)}function tr(e,r){return e!=="GET"?false:r>=500||r===429}var V=class{constructor(r,t=0,n=1e3,s){this.timeoutMs=r;this.maxRetries=t;this.retryDelayMs=n;this.logger=s;}async get(r,t){return this.request(r,{method:"GET",headers:t})}async post(r,t,n){return this.request(r,{method:"POST",body:JSON.stringify(t),headers:{"Content-Type":"application/json",...n}})}async request(r,t){let n=(t.method??"GET").toUpperCase(),s=rr(),i=new Headers(t.headers);i.set("X-Request-Id",s),this.logger&&this.logger.debug("request",{requestId:s,url:r,method:n});let a;for(let d=0;d<=this.maxRetries;d++)try{let R=new AbortController,h=setTimeout(()=>R.abort(),this.timeoutMs);try{let f=await fetch(r,{...t,headers:i,signal:R.signal});if(!f.ok){let U;try{U=await f.json();}catch{}let{message:I,code:Ke}=Qe(U,f.statusText),he=m(Ke,I,{requestId:s,status:f.status,statusText:f.statusText,data:U});if(tr(n,f.status)&&d<this.maxRetries){a=he,clearTimeout(h),await new Promise(je=>setTimeout(je,Ae(d,this.retryDelayMs)));continue}return l(he)}if(f.status===204)return c(void 0);if(f.headers.get("content-length")==="0")return c(void 0);let b=await f.json();if(Je(b))return c(b.resultado);let P=b;return typeof b=="object"&&b!==null&&P.ok===true&&!("resultado"in P)?c(void 0):c(b)}finally{clearTimeout(h);}}catch(R){if(a=R,n==="GET"&&d<this.maxRetries)await new Promise(f=>setTimeout(f,Ae(d,this.retryDelayMs)));else break}return a instanceof Error&&a.name==="AbortError"?l(m("TIMEOUT","Request timed out",{requestId:s})):l(m("NETWORK_FAILURE",a instanceof Error?a.message:"Request failed",{requestId:s,cause:a}))}};function _(e){let r=new Uint8Array(e),t=Array.from(r,s=>String.fromCharCode(s)).join("");if(typeof globalThis.btoa>"u")throw G("encode");return globalThis.btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function nr(e){if(typeof globalThis.atob>"u")throw G("decode");let r=e.replace(/-/g,"+").replace(/_/g,"/"),t=r.length%4,n=t===0?r:r+"=".repeat(4-t),s=globalThis.atob(n);return Uint8Array.from(s,i=>i.charCodeAt(0))}function x(e){let r=nr(e),t=new ArrayBuffer(r.length);return new Uint8Array(t).set(r),t}function Ie(e){return e!==null&&typeof e=="object"&&"clientDataJSON"in e&&e.clientDataJSON instanceof ArrayBuffer}function A(e){if(!e.response)throw m("UNKNOWN_ERROR","Credential response is missing",{credential:e});let r=e.response;if(!Ie(r))throw m("UNKNOWN_ERROR","Invalid credential response structure",{response:r});if(!("attestationObject"in r))throw m("UNKNOWN_ERROR","Invalid credential response structure for register: attestationObject is missing",{response:r});let t=r.clientDataJSON,n=r.attestationObject;return {id:e.id,rawId:_(e.rawId),response:{clientDataJSON:_(t),attestationObject:_(n)},type:"public-key"}}function B(e){if(!e.response)throw m("UNKNOWN_ERROR","Credential response is missing",{credential:e});let r=e.response;if(!Ie(r))throw m("UNKNOWN_ERROR","Invalid credential response structure",{response:r});if(!("authenticatorData"in r)||!("signature"in r))throw m("UNKNOWN_ERROR","Invalid credential response structure for auth: authenticatorData or signature is missing",{response:r});let t=r.clientDataJSON,n=r.authenticatorData,s=r.signature,i=r.userHandle;return {id:e.id,rawId:_(e.rawId),response:{authenticatorData:_(n),clientDataJSON:_(t),signature:_(s),...i&&{userHandle:_(i)}},type:"public-key"}}function M(){try{return !(typeof navigator>"u"||!navigator.credentials||typeof PublicKeyCredential>"u")}catch{return  false}}async function sr(){try{return !M()||typeof PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable!="function"?false:await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable()}catch{return  false}}async function Oe(){let e=M(),r=await sr();return {isPasskeySupported:e,platformAuthenticatorAvailable:r,recommendedFlow:e?"passkey":"fallback"}}function C(e,r="create"){if(!e||typeof e!="object"||!("id"in e)||!("rawId"in e)||!("response"in e))throw ve(r)}async function N(e){let{operation:r,eventEmitter:t,start:n,createOptions:s,invoke:i,finish:a}=e;try{if(t.emit("start",{type:"start",operation:r}),!M()){let E=X();return t.emit("error",{type:"error",error:E}),l(E)}let d=await n();if(!d.ok)return t.emit("error",{type:"error",error:d.error}),l(d.error);let R=s(d.value);if(!R.ok)return t.emit("error",{type:"error",error:R.error}),l(R.error);let h=await i(R.value);if(!h){let E=y("credential",`${r==="register"?"creation":"retrieval"} failed`);return t.emit("error",{type:"error",error:E}),l(E)}try{C(h);}catch(E){let b=v(E);return t.emit("error",{type:"error",error:b}),l(b)}let f=await a(d.value,h);return f.ok?(t.emit("success",{type:"success",operation:r}),c(f.value)):(t.emit("error",{type:"error",error:f.error}),l(f.error))}catch(d){let R=v(d);return t.emit("error",{type:"error",error:R}),l(R)}}function S(e,r){try{L(e.challenge,"challenge"),L(e.user.id,"user.id");let t=x(e.challenge),n=x(e.user.id),s={userVerification:"preferred"};e.authenticatorSelection&&(s={...e.authenticatorSelection}),r&&(s={...s,authenticatorAttachment:r});let i={rp:{id:e.rp.id,name:e.rp.name},user:{id:n,name:e.user.name,displayName:e.user.displayName},challenge:t,pubKeyCredParams:e.pubKeyCredParams,...e.timeout!==void 0&&{timeout:e.timeout},attestation:"none",authenticatorSelection:s,...e.excludeCredentials&&{excludeCredentials:e.excludeCredentials.map(a=>({id:x(a.id),type:a.type,...a.transports&&{transports:a.transports}}))}};return c({publicKey:i})}catch(t){return l(v(t))}}function de(e,r){try{L(e.challenge,"challenge");let t=x(e.challenge);return c({publicKey:{challenge:t,rpId:e.rpId,...e.timeout!==void 0&&{timeout:e.timeout},userVerification:e.userVerification??"preferred",...e.allowCredentials&&{allowCredentials:e.allowCredentials.map(n=>({id:x(n.id),type:n.type,...n.transports&&{transports:n.transports}}))}},...r!==void 0&&{mediation:r}})}catch(t){return l(v(t))}}async function Ce(e,r,t){let n=e.externalUserId??e.external_user_id;if(!n||typeof n!="string"||n.trim()===""){let s=y("externalUserId","must be a non-empty string");return t.emit("error",{type:"error",error:s}),l(s)}return N({operation:"register",eventEmitter:t,start:()=>r.startRegister({external_user_id:n}),createOptions:s=>S(s.challenge,e.authenticatorType),invoke:async s=>{let i={...s,...e.signal&&{signal:e.signal}};return navigator.credentials.create(i)},finish:async(s,i)=>{let a=await r.finishRegister({session_id:s.session_id,credential:A(i)});return a.ok?c({success:true,credentialId:a.value.credential_id,credential_id:a.value.credential_id,status:a.value.status,sessionToken:a.value.session_token,user:{userId:a.value.user.user_id,externalUserId:a.value.user.external_user_id,email:a.value.user.email,metadata:a.value.user.metadata}}):l(a.error)}})}async function Se(e,r,t){let n=e.externalUserId??e.external_user_id,s=n!==void 0&&typeof n=="string"&&n.trim()!=="";return N({operation:"authenticate",eventEmitter:t,start:()=>r.startAuth(s?{external_user_id:n.trim()}:{}),createOptions:i=>de(i.challenge,e.mediation),invoke:async i=>{let a={...i,...e.signal&&{signal:e.signal}};return navigator.credentials.get(a)},finish:async(i,a)=>{let d=await r.finishAuthentication({session_id:i.session_id,credential:B(a)});return d.ok?c({authenticated:d.value.authenticated,sessionToken:d.value.session_token,user:{userId:d.value.user.user_id,externalUserId:d.value.user.external_user_id,email:d.value.user.email,metadata:d.value.user.metadata},signals:d.value.signals}):l(d.error)}})}var ir=2e3,or=60,W=class{constructor(r){this.apiClient=r;}async startFlow(r){let t=await this.apiClient.startOnboarding({user_role:r.user_role});if(!t.ok)return l(t.error);let{session_id:n}=t.value;for(let s=0;s<or;s++){await new Promise(R=>setTimeout(R,ir));let i=await this.apiClient.getOnboardingStatus(n);if(!i.ok)return l(i.error);let a=i.value.status,d=i.value.onboarding_url;if(a==="pending_passkey"){let R=await this.apiClient.getOnboardingRegister(n);if(!R.ok)return l(R.error);let h=R.value;if(!h.challenge)return l(m("NOT_SUPPORTED","Onboarding requires user action - complete passkey registration at the provided onboarding_url",{onboarding_url:d}));let f=S(h.challenge);if(!f.ok)return l(f.error);let E;try{E=await navigator.credentials.create(f.value);}catch(I){return l(v(I))}try{C(E,"create");}catch(I){return l(v(I))}let b;try{b=A(E);}catch(I){return l(v(I))}let P=await this.apiClient.registerOnboardingPasskey(n,{credential:b,challenge:h.challenge.challenge});return P.ok?await this.apiClient.completeOnboarding(n,{company_name:r.company_name}):l(P.error)}if(a==="completed")return await this.apiClient.completeOnboarding(n,{company_name:r.company_name})}return l(m("TIMEOUT","Onboarding timed out"))}};var ar=2e3,lr=60,H=class{constructor(r){this.apiClient=r;}async init(){return this.apiClient.initCrossDeviceAuth()}async initRegistration(r){return this.apiClient.initCrossDeviceRegistration(r)}async waitForSession(r,t){for(let n=0;n<lr;n++){if(t?.aborted)return l(m("ABORT_ERROR","Operation aborted by user or timeout"));let s=await this.apiClient.getCrossDeviceStatus(r);if(!s.ok)return l(s.error);if(s.value.status==="completed")return !s.value.session_token||!s.value.user_id?l(m("UNKNOWN_ERROR","Missing data in completed session")):c({session_token:s.value.session_token,user_id:s.value.user_id});if(t?.aborted)return l(m("ABORT_ERROR","Operation aborted by user or timeout"));if(await new Promise(i=>{let a=setTimeout(()=>{i(null),t?.removeEventListener("abort",d);},ar),d=()=>{clearTimeout(a),i(null);};t?.addEventListener("abort",d);}),t?.aborted)return l(m("ABORT_ERROR","Operation aborted by user or timeout"))}return l(m("TIMEOUT","Cross-device authentication timed out"))}async approve(r){let t=await this.apiClient.getCrossDeviceContext(r);if(!t.ok)return l(t.error);let n=t.value;return n.type==="registration"?this.executeRegistrationApproval(r,n):this.executeAuthApproval(r,n)}async executeRegistrationApproval(r,t){let n=S(t.options);if(!n.ok)return l(n.error);let s;try{s=await navigator.credentials.create(n.value);}catch(a){return l(v(a))}try{C(s,"create");}catch(a){return l(v(a))}let i;try{i=A(s);}catch(a){return l(v(a))}return this.apiClient.verifyCrossDeviceRegistration({session_id:r,credential:i})}async executeAuthApproval(r,t){let n=de(t.options);if(!n.ok)return l(n.error);let s;try{s=await navigator.credentials.get(n.value);}catch(a){return l(v(a))}try{C(s,"get");}catch(a){return l(v(a))}let i;try{i=B(s);}catch(a){return l(v(a))}return this.apiClient.verifyCrossDeviceAuth({session_id:r,credential:i})}};var $=class{handlers;constructor(){this.handlers=new Map;}on(r,t){let n=this.handlers.get(r);return n||(n=new Set,this.handlers.set(r,n)),n.add(t),()=>{this.off(r,t);}}off(r,t){let n=this.handlers.get(r);n&&(n.delete(t),n.size===0&&this.handlers.delete(r));}emit(r,t){let n=this.handlers.get(r);if(n)for(let s of n)try{s(t);}catch{}}removeAllListeners(){this.handlers.clear();}};async function ke(e,r,t){let n=e.externalUserId??e.external_user_id;if(!n||typeof n!="string"||n.trim()===""){let s=y("externalUserId","must be a non-empty string");return t.emit("error",{type:"error",error:s}),l(s)}if(!e.otp||typeof e.otp!="string"||e.otp.trim().length!==6){let s=y("otp","must be a 6-digit string");return t.emit("error",{type:"error",error:s}),l(s)}return N({operation:"register",eventEmitter:t,start:()=>r.verifyAccountRecoveryOtp(n,e.otp),createOptions:s=>S(s.challenge),invoke:async s=>navigator.credentials.create(s),finish:async(s,i)=>{let a=await r.completeAccountRecovery(s.recovery_session_id,A(i));return a.ok?c({success:true,credentialId:a.value.credential_id,status:a.value.status,sessionToken:a.value.session_token,user:{userId:a.value.user.user_id,externalUserId:a.value.user.external_user_id,email:a.value.user.email,metadata:a.value.user.metadata}}):l(a.error)}})}var ge="https://api.trymellonauth.com",xe="https://api.trymellonauth.com/v1/telemetry";var me="trymellon_sandbox_session_token_v1";function Me(e){return {async send(r){let t=JSON.stringify(r);if(typeof navigator<"u"&&typeof navigator.sendBeacon=="function"){navigator.sendBeacon(e,t);return}typeof fetch<"u"&&await fetch(e,{method:"POST",body:t,headers:{"Content-Type":"application/json"},keepalive:true});}}}function Re(e,r){return {event:e,latencyMs:r,ok:true}}var fe=class e{sandbox;sandboxToken;apiClient;eventEmitter;telemetrySender;crossDeviceManager;onboarding;static create(r){try{let t=r.appId,n=r.publishableKey;if(!t||typeof t!="string"||t.trim()==="")return l(y("appId","must be a non-empty string"));if(!n||typeof n!="string"||n.trim()==="")return l(y("publishableKey","must be a non-empty string"));let s=r.apiBaseUrl??ge;z(s,"apiBaseUrl");let i=r.timeoutMs??3e4;return O(i,"timeoutMs",1e3,3e5),r.maxRetries!==void 0&&O(r.maxRetries,"maxRetries",0,10),r.retryDelayMs!==void 0&&O(r.retryDelayMs,"retryDelayMs",100,1e4),c(new e(r))}catch(t){return F(t)?l(t):l(y("config",t.message))}}constructor(r){this.sandbox=r.sandbox===true,this.sandboxToken=this.sandbox&&r.sandboxToken!=null&&r.sandboxToken!==""?r.sandboxToken:me;let t=r.appId,n=r.publishableKey;if(!t||typeof t!="string"||t.trim()==="")throw y("appId","must be a non-empty string");if(!n||typeof n!="string"||n.trim()==="")throw y("publishableKey","must be a non-empty string");let s=r.apiBaseUrl??ge;z(s,"apiBaseUrl");let i=r.timeoutMs??3e4;O(i,"timeoutMs",1e3,3e5),r.maxRetries!==void 0&&O(r.maxRetries,"maxRetries",0,10),r.retryDelayMs!==void 0&&O(r.retryDelayMs,"retryDelayMs",100,1e4);let a=r.maxRetries??3,d=r.retryDelayMs??1e3,R=new V(i,a,d,r.logger),h=r.origin??(typeof window<"u"&&window?.location?.origin?window.location.origin:void 0),f={"X-App-Id":t.trim(),Authorization:`Bearer ${n.trim()}`,...h&&{Origin:h}};this.apiClient=new q(R,s,f),this.onboarding=new W(this.apiClient),this.crossDeviceManager=new H(this.apiClient),this.eventEmitter=new $,r.enableTelemetry&&(this.telemetrySender=r.telemetrySender??Me(r.telemetryEndpoint??xe));}static isSupported(){return M()}sandboxAuthResult(r,t){let n=t.externalUserId??t.external_user_id??"sandbox",s=typeof n=="string"?n:"sandbox";return r==="register"?Promise.resolve(c({success:true,credentialId:"",status:"sandbox",sessionToken:this.sandboxToken,user:{userId:"sandbox-user",externalUserId:s}})):Promise.resolve(c({authenticated:true,sessionToken:this.sandboxToken,user:{userId:"sandbox-user",externalUserId:s}}))}async register(r){if(this.sandbox)return this.sandboxAuthResult("register",r);let t=Date.now(),n=await Ce(r,this.apiClient,this.eventEmitter);return n.ok&&this.telemetrySender&&this.telemetrySender.send(Re("register",Date.now()-t)).catch(()=>{}),n}async authenticate(r){if(this.sandbox)return this.sandboxAuthResult("authenticate",r);let t=Date.now(),n=await Se(r,this.apiClient,this.eventEmitter);return n.ok&&this.telemetrySender&&this.telemetrySender.send(Re("authenticate",Date.now()-t)).catch(()=>{}),n}async validateSession(r){return this.sandbox&&r===this.sandboxToken?Promise.resolve(c({valid:true,user_id:"sandbox-user",external_user_id:"sandbox",tenant_id:"sandbox-tenant",app_id:"sandbox-app"})):this.apiClient.validateSession(r)}async getStatus(){return Oe()}on(r,t){return this.eventEmitter.on(r,t)}version(){return "1.7.2"}fallback={email:{start:async r=>this.apiClient.startEmailFallback(r),verify:async r=>this.apiClient.verifyEmailCode(r.userId,r.code)}};auth={crossDevice:{init:()=>this.crossDeviceManager.init(),initRegistration:r=>this.crossDeviceManager.initRegistration(r),waitForSession:(r,t)=>this.crossDeviceManager.waitForSession(r,t),getContext:r=>this.apiClient.getCrossDeviceContext(r),approve:r=>this.crossDeviceManager.approve(r)},recoverAccount:async r=>ke(r,this.apiClient,this.eventEmitter)}};var ye=class{debug(r,t){t&&Object.keys(t).length>0?console.debug(`[TryMellon] ${r}`,t):console.debug(`[TryMellon] ${r}`);}info(r,t){t&&Object.keys(t).length>0?console.info(`[TryMellon] ${r}`,t):console.info(`[TryMellon] ${r}`);}warn(r,t){t&&Object.keys(t).length>0?console.warn(`[TryMellon] ${r}`,t):console.warn(`[TryMellon] ${r}`);}error(r,t){t&&Object.keys(t).length>0?console.error(`[TryMellon] ${r}`,t):console.error(`[TryMellon] ${r}`);}};
-exports.ConsoleLogger=ye;exports.SANDBOX_SESSION_TOKEN=me;exports.TryMellon=fe;exports.TryMellonError=D;exports.createError=m;exports.createInvalidArgumentError=y;exports.createNetworkError=Be;exports.createNotSupportedError=X;exports.createTimeoutError=We;exports.createUserCancelledError=Ve;exports.err=l;exports.isTryMellonError=F;exports.mapWebAuthnError=v;exports.ok=c;return exports;})({});//# sourceMappingURL=index.global.js.map
+var TryMellon=(function(exports){'use strict';var p=e=>({ok:true,value:e}),u=e=>({ok:false,error:e});var D=class e extends Error{code;details;isTryMellonError=true;constructor(r,t,n){super(t),this.name="TryMellonError",this.code=r,this.details=n,Error.captureStackTrace&&Error.captureStackTrace(this,e);}},qe={NOT_SUPPORTED:"WebAuthn is not supported in this environment",USER_CANCELLED:"User cancelled the operation",PASSKEY_NOT_FOUND:"Passkey not found",SESSION_EXPIRED:"Session has expired",NETWORK_FAILURE:"Network request failed",INVALID_ARGUMENT:"Invalid argument provided",TIMEOUT:"Operation timed out",ABORTED:"Operation was aborted",ABORT_ERROR:"Operation aborted by user or timeout",CHALLENGE_MISMATCH:"This link was already used or expired. Please try again from your computer.",UNKNOWN_ERROR:"An unknown error occurred"};function R(e,r,t){return new D(e,r??qe[e],t)}function F(e){return e instanceof D||typeof e=="object"&&e!==null&&"isTryMellonError"in e&&e.isTryMellonError===true}function X(){return R("NOT_SUPPORTED")}function Ve(){return R("USER_CANCELLED")}function Be(e){return R("NETWORK_FAILURE",void 0,{cause:e?.message,originalError:e})}function We(){return R("TIMEOUT")}function y(e,r){return R("INVALID_ARGUMENT",`Invalid argument: ${e} - ${r}`,{field:e,reason:r})}function he(e){return R("UNKNOWN_ERROR",`Failed to ${e} credential`,{operation:e})}function G(e){return R("NOT_SUPPORTED",`No base64 ${e==="encode"?"encoding":"decoding"} available`,{type:e})}function z(e,r){try{let t=new URL(e);if(t.protocol!=="https:"&&t.protocol!=="http:")throw y(r,"must use http or https protocol")}catch(t){throw F(t)?t:y(r,"must be a valid URL")}}function O(e,r,t,n){if(!Number.isFinite(e))throw y(r,"must be a finite number");if(e<t||e>n)throw y(r,`must be between ${t} and ${n}`)}function L(e,r){if(typeof e!="string"||e.length===0)throw y(r,"must be a non-empty string");if(!/^[A-Za-z0-9_-]+$/.test(e))throw y(r,"must be a valid base64url string")}var He={NotAllowedError:"USER_CANCELLED",AbortError:"ABORTED",NotSupportedError:"NOT_SUPPORTED",SecurityError:"NOT_SUPPORTED",InvalidStateError:"UNKNOWN_ERROR",UnknownError:"UNKNOWN_ERROR"};function w(e){if(typeof e!="string")return "UNKNOWN_ERROR";let r=e.toLowerCase().trim();return {challenge_mismatch:"CHALLENGE_MISMATCH",session_expired:"SESSION_EXPIRED",unauthorized:"SESSION_EXPIRED",validation_error:"INVALID_ARGUMENT",invalid_argument:"INVALID_ARGUMENT",user_not_found:"SESSION_EXPIRED",passkey_not_found:"PASSKEY_NOT_FOUND"}[r]??"UNKNOWN_ERROR"}function h(e){if(e instanceof DOMException){let r=e.name,t=e.message||"WebAuthn operation failed",n=He[r]??"UNKNOWN_ERROR";return R(n,t,{originalError:e})}return e instanceof Error?R("UNKNOWN_ERROR",e.message,{originalError:e}):R("UNKNOWN_ERROR","An unknown error occurred",{originalError:e})}function g(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function l(e){return typeof e=="string"}function T(e){return typeof e=="number"&&Number.isFinite(e)}function K(e){return typeof e=="boolean"}function S(e){return Array.isArray(e)}function o(e,r){return u(R("UNKNOWN_ERROR",e,{...r,originalData:r?.originalData}))}function c(e,r){return e[r]}function Ee(e,r){return !g(e)||!l(e.name)||!l(e.id)?o("Invalid API response: challenge.rp must have name and id strings",{originalData:r}):p(true)}function be(e,r){return !g(e)||!l(e.id)||!l(e.name)||!l(e.displayName)?o("Invalid API response: challenge.user must have id, name, displayName strings",{originalData:r}):p(true)}function _e(e,r){if(!S(e))return o("Invalid API response: challenge.pubKeyCredParams must be array",{originalData:r});for(let t of e)if(!g(t)||t.type!=="public-key"||!T(t.alg))return o("Invalid API response: pubKeyCredParams items must have type and alg",{originalData:r});return p(true)}function Y(e,r){if(!g(e))return o("Invalid API response: user must be object",{field:"user",originalData:r});let t=c(e,"user_id"),n=c(e,"external_user_id");if(!l(t)||!l(n))return o("Invalid API response: user must have user_id and external_user_id strings",{originalData:r});let s=e.email,i=e.metadata;return s!==void 0&&!l(s)?o("Invalid API response: user.email must be string",{originalData:r}):i!==void 0&&(typeof i!="object"||i===null)?o("Invalid API response: user.metadata must be object",{originalData:r}):p({user_id:t,external_user_id:n,...s!==void 0&&{email:s},...i!==void 0&&{metadata:i}})}function J(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=c(e,"session_id");if(!l(r))return o("Invalid API response: session_id must be string",{field:"session_id",originalData:e});let t=c(e,"challenge");if(!g(t))return o("Invalid API response: challenge must be object",{field:"challenge",originalData:e});let n=Ee(c(t,"rp"),e);if(!n.ok)return n;let s=be(c(t,"user"),e);if(!s.ok)return s;let i=c(t,"challenge");if(!l(i))return o("Invalid API response: challenge.challenge must be string",{originalData:e});let a=_e(c(t,"pubKeyCredParams"),e);if(!a.ok)return a;let d=t.timeout;if(d!==void 0&&!T(d))return o("Invalid API response: challenge.timeout must be number",{originalData:e});let m=t.excludeCredentials;if(m!==void 0){if(!S(m))return o("Invalid API response: excludeCredentials must be array",{originalData:e});for(let f of m)if(!g(f)||f.type!=="public-key"||!l(f.id))return o("Invalid API response: excludeCredentials items must have id and type",{originalData:e})}let v=t.authenticatorSelection;return v!==void 0&&!g(v)?o("Invalid API response: authenticatorSelection must be object",{originalData:e}):p({session_id:r,challenge:{rp:t.rp,user:t.user,challenge:i,pubKeyCredParams:t.pubKeyCredParams,...d!==void 0&&{timeout:d},...m!==void 0&&{excludeCredentials:m},...v!==void 0&&{authenticatorSelection:v}}})}function Z(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=c(e,"session_id");if(!l(r))return o("Invalid API response: session_id must be string",{field:"session_id",originalData:e});let t=c(e,"challenge");if(!g(t))return o("Invalid API response: challenge must be object",{field:"challenge",originalData:e});let n=c(t,"challenge"),s=c(t,"rpId"),i=t.allowCredentials;if(!l(n))return o("Invalid API response: challenge.challenge must be string",{originalData:e});if(!l(s))return o("Invalid API response: challenge.rpId must be string",{originalData:e});if(i!==void 0&&!S(i))return o("Invalid API response: allowCredentials must be array",{originalData:e});if(i){for(let m of i)if(!g(m)||m.type!=="public-key"||!l(m.id))return o("Invalid API response: allowCredentials items must have id and type",{originalData:e})}let a=t.timeout;if(a!==void 0&&!T(a))return o("Invalid API response: challenge.timeout must be number",{originalData:e});let d=t.userVerification;return d!==void 0&&!["required","preferred","discouraged"].includes(String(d))?o("Invalid API response: userVerification must be required|preferred|discouraged",{originalData:e}):p({session_id:r,challenge:{challenge:n,rpId:s,allowCredentials:i??[],...a!==void 0&&{timeout:a},...d!==void 0&&{userVerification:d}}})}function Q(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=c(e,"credential_id"),t=c(e,"status"),n=c(e,"session_token"),s=c(e,"user");if(!l(r))return o("Invalid API response: credential_id must be string",{field:"credential_id",originalData:e});if(!l(t))return o("Invalid API response: status must be string",{field:"status",originalData:e});if(!l(n))return o("Invalid API response: session_token must be string",{field:"session_token",originalData:e});let i=Y(s,e);if(!i.ok)return o(i.error.message,{originalData:e});let a=e.redirect_url;return a!==void 0&&!l(a)?o("Invalid API response: redirect_url must be string",{originalData:e}):p({credential_id:r,status:t,session_token:n,user:i.value,...a!==void 0&&{redirect_url:a}})}function ee(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=c(e,"authenticated"),t=c(e,"session_token"),n=c(e,"user"),s=c(e,"signals");if(!K(r))return o("Invalid API response: authenticated must be boolean",{field:"authenticated",originalData:e});if(!l(t))return o("Invalid API response: session_token must be string",{field:"session_token",originalData:e});let i=Y(n,e);if(!i.ok)return o(i.error.message,{originalData:e});if(s!==void 0&&!g(s))return o("Invalid API response: signals must be object",{originalData:e});let a=e.redirect_url;return a!==void 0&&!l(a)?o("Invalid API response: redirect_url must be string",{originalData:e}):p({authenticated:r,session_token:t,user:i.value,signals:s,...a!==void 0&&{redirect_url:a}})}function re(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=c(e,"valid"),t=c(e,"user_id"),n=c(e,"external_user_id"),s=c(e,"tenant_id"),i=c(e,"app_id");return K(r)?l(t)?l(n)?l(s)?l(i)?p({valid:r,user_id:t,external_user_id:n,tenant_id:s,app_id:i}):o("Invalid API response: app_id must be string",{field:"app_id",originalData:e}):o("Invalid API response: tenant_id must be string",{field:"tenant_id",originalData:e}):o("Invalid API response: external_user_id must be string",{field:"external_user_id",originalData:e}):o("Invalid API response: user_id must be string",{field:"user_id",originalData:e}):o("Invalid API response: valid must be boolean",{field:"valid",originalData:e})}function te(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=e.session_token??e.sessionToken;if(!l(r))return o("Invalid API response: session_token/sessionToken must be string",{field:"session_token",originalData:e});let t=e.redirect_url;return t!==void 0&&!l(t)?o("Invalid API response: redirect_url must be string",{originalData:e}):p({sessionToken:r,...t!==void 0&&{redirectUrl:t}})}var $e=["pending_passkey","pending_data","completed"],Xe=["pending_data","completed"];function ne(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=c(e,"session_id"),t=c(e,"onboarding_url"),n=c(e,"expires_in");return l(r)?l(t)?T(n)?p({session_id:r,onboarding_url:t,expires_in:n}):o("Invalid API response: expires_in must be number",{field:"expires_in",originalData:e}):o("Invalid API response: onboarding_url must be string",{field:"onboarding_url",originalData:e}):o("Invalid API response: session_id must be string",{field:"session_id",originalData:e})}function se(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=c(e,"status"),t=c(e,"onboarding_url"),n=c(e,"expires_in");return !l(r)||!$e.includes(r)?o("Invalid API response: status must be pending_passkey|pending_data|completed",{field:"status",originalData:e}):l(t)?T(n)?p({status:r,onboarding_url:t,expires_in:n}):o("Invalid API response: expires_in must be number",{originalData:e}):o("Invalid API response: onboarding_url must be string",{originalData:e})}function ie(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=c(e,"session_id"),t=c(e,"status"),n=c(e,"onboarding_url");if(!l(r))return o("Invalid API response: session_id must be string",{field:"session_id",originalData:e});if(t!=="pending_passkey")return o("Invalid API response: status must be pending_passkey",{field:"status",originalData:e});if(!l(n))return o("Invalid API response: onboarding_url must be string",{originalData:e});let s=e.challenge,i;if(s!==void 0){let a=Ge(s);if(!a.ok)return a;i=a.value;}return p({session_id:r,status:"pending_passkey",onboarding_url:n,...i!==void 0&&{challenge:i}})}function Ge(e){if(!g(e))return o("Invalid API response: challenge must be object",{originalData:e});let r=c(e,"rp"),t=c(e,"user"),n=c(e,"challenge"),s=c(e,"pubKeyCredParams");if(!g(r)||!l(r.name)||!l(r.id))return o("Invalid API response: challenge.rp must have name and id",{originalData:e});if(!g(t)||!l(t.id)||!l(t.name)||!l(t.displayName))return o("Invalid API response: challenge.user must have id, name, displayName",{originalData:e});if(!l(n))return o("Invalid API response: challenge.challenge must be string",{originalData:e});if(!S(s))return o("Invalid API response: challenge.pubKeyCredParams must be array",{originalData:e});for(let i of s)if(!g(i)||i.type!=="public-key"||!T(i.alg))return o("Invalid API response: pubKeyCredParams items must have type and alg",{originalData:e});return p({rp:r,user:t,challenge:n,pubKeyCredParams:s})}function oe(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=c(e,"session_id"),t=c(e,"status"),n=c(e,"user_id"),s=c(e,"tenant_id");return l(r)?!l(t)||!Xe.includes(t)?o("Invalid API response: status must be pending_data|completed",{originalData:e}):l(n)?l(s)?p({session_id:r,status:t,user_id:n,tenant_id:s}):o("Invalid API response: tenant_id must be string",{originalData:e}):o("Invalid API response: user_id must be string",{originalData:e}):o("Invalid API response: session_id must be string",{originalData:e})}function ae(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=c(e,"session_id"),t=c(e,"status"),n=c(e,"user_id"),s=c(e,"tenant_id"),i=c(e,"session_token");return l(r)?t!=="completed"?o("Invalid API response: status must be completed",{originalData:e}):!l(n)||!l(s)||!l(i)?o("Invalid API response: user_id, tenant_id, session_token must be strings",{originalData:e}):p({session_id:r,status:"completed",user_id:n,tenant_id:s,session_token:i}):o("Invalid API response: session_id must be string",{originalData:e})}function ze(e){if(!e||typeof e!="object")return  false;let r=e;return typeof r.challenge=="string"&&r.rp!=null&&typeof r.rp=="object"&&r.user!=null&&typeof r.user=="object"&&Array.isArray(r.pubKeyCredParams)}function Ye(e){if(!e||typeof e!="object")return  false;let r=e;return typeof r.challenge=="string"&&typeof r.rpId=="string"}function j(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r="resultado"in e&&g(e.resultado)?e.resultado:e,t=r.session_id,n=r.qr_url,s=r.expires_at,i=r.polling_token;return !l(t)||!l(n)||!l(s)||!l(i)?o("Invalid API response: missing required fields",{originalData:e}):p({session_id:t,qr_url:n,expires_at:s,polling_token:i})}function le(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=e.status;return !l(r)||!["pending","authenticated","completed"].includes(r)?o("Invalid API response: invalid status",{originalData:e}):p({status:r,user_id:e.user_id,session_token:e.session_token})}function ue(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=e.type,t=r==="registration"?"registration":"auth",n=e.options;if(!g(n))return o("Invalid API response: options are required",{originalData:e});let s=200,i=Te(e.approval_context,s),a=Te(e.application_name,s);if(i===false||a===false)return o("Invalid API response: approval_context/application_name must be string max 200 chars",{originalData:e});let d={};return typeof i=="string"&&(d.approval_context=i),typeof a=="string"&&(d.application_name=a),t==="registration"?ze(n)?p({type:"registration",options:n,...d}):o("Invalid API response: registration options must have challenge, rp, user, pubKeyCredParams",{originalData:e}):Ye(n)?p({type:"auth",options:n,...d}):o("Invalid API response: auth options must have challenge and rpId",{originalData:e})}function Te(e,r){if(e!=null)return typeof e!="string"||e.length>r?false:e}function ce(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=c(e,"challenge"),t=c(e,"recovery_session_id");return g(r)?l(t)?p({challenge:r,recovery_session_id:t}):o("Invalid API response: recovery_session_id must be string",{field:"recovery_session_id",originalData:e}):o("Invalid API response: challenge must be object",{field:"challenge",originalData:e})}function pe(e){if(!g(e))return o("Invalid API response: expected object",{originalData:e});let r=c(e,"status"),t=c(e,"session_token"),n=c(e,"user"),s=c(e,"credential_id");if(!l(r))return o("Invalid API response: status must be string",{field:"status",originalData:e});if(!l(t))return o("Invalid API response: session_token must be string",{field:"session_token",originalData:e});if(!l(s))return o("Invalid API response: credential_id must be string",{field:"credential_id",originalData:e});if(!g(n))return o("Invalid API response: user must be object",{field:"user",originalData:e});let i=c(n,"user_id");if(!l(i))return o("Invalid API response: user.user_id must be string",{field:"user.user_id",originalData:e});let a=n;return p({status:r,session_token:t,credential_id:s,user:{user_id:i,external_user_id:l(a.external_user_id)?a.external_user_id:void 0,email:l(a.email)?a.email:void 0,metadata:g(a.metadata)?a.metadata:void 0}})}var q=class{constructor(r,t,n={}){this.httpClient=r;this.baseUrl=t;this.defaultHeaders=n;}mergeHeaders(r){return {...this.defaultHeaders,...r}}async post(r,t,n){let s=`${this.baseUrl}${r}`,i=await this.httpClient.post(s,t,this.mergeHeaders());return i.ok?n(i.value):u(i.error)}async get(r,t,n){let s=`${this.baseUrl}${r}`,i=await this.httpClient.get(s,this.mergeHeaders(n));return i.ok?t(i.value):u(i.error)}async startRegister(r){return this.post("/v1/passkeys/register/start",r,J)}async startAuth(r){return this.post("/v1/passkeys/auth/start",r,Z)}async finishRegister(r){return this.post("/v1/passkeys/register/finish",r,Q)}async finishAuthentication(r){return this.post("/v1/passkeys/auth/finish",r,ee)}async validateSession(r){return this.get("/v1/sessions/validate",re,{Authorization:`Bearer ${r}`})}async startEmailFallback(r){let t=`${this.baseUrl}/v1/fallback/email/start`,n=await this.httpClient.post(t,{userId:r.userId,email:r.email},this.mergeHeaders());return n.ok?p(void 0):u(n.error)}async verifyEmailCode(r){let t={userId:r.userId,code:r.code};return r.successUrl&&(t.success_url=r.successUrl),this.post("/v1/fallback/email/verify",t,te)}async startOnboarding(r){return this.post("/v1/onboarding/start",r,ne)}async getOnboardingStatus(r){return this.get(`/v1/onboarding/${r}/status`,se)}async getOnboardingRegister(r){return this.get(`/v1/onboarding/${r}/register`,ie)}async registerOnboardingPasskey(r,t){return this.post(`/v1/onboarding/${r}/register-passkey`,t,oe)}async completeOnboarding(r,t){return this.post(`/v1/onboarding/${r}/complete`,t,ae)}async initCrossDeviceAuth(){return this.post("/v1/auth/cross-device/init",{},j)}async initCrossDeviceRegistration(r){return this.post("/v1/auth/cross-device/init-registration",{external_user_id:r.externalUserId},j)}async getCrossDeviceStatus(r,t){let n={};return typeof t=="string"&&t.length>0&&(n["X-Polling-Token"]=t),this.get(`/v1/auth/cross-device/status/${r}`,le,Object.keys(n).length>0?n:void 0)}async getCrossDeviceContext(r){return this.get(`/v1/auth/cross-device/context/${r}`,ue)}async verifyCrossDeviceAuth(r){let t=`${this.baseUrl}/v1/auth/cross-device/verify`,n=await this.httpClient.post(t,r,this.mergeHeaders());return n.ok?p(void 0):u(n.error)}async verifyCrossDeviceRegistration(r){let t=`${this.baseUrl}/v1/auth/cross-device/verify-registration`,n=await this.httpClient.post(t,r,this.mergeHeaders());return n.ok?p(void 0):u(n.error)}async verifyAccountRecoveryOtp(r,t){return this.post("/v1/users/recovery/verify",{external_id:r,otp:t},ce)}async completeAccountRecovery(r,t){return this.post("/v1/users/recovery/complete",{recovery_session_id:r,credential:t},pe)}};function Je(e){return typeof e=="object"&&e!==null&&e.ok===true&&"resultado"in e}function Ze(e){if(typeof e!="object"||e===null)return  false;let r=e;if(r.ok!==false||!r.error||typeof r.error!="object")return  false;let t=r.error;return typeof t.code=="string"&&typeof t.message=="string"}function Qe(e,r){if(Ze(e))return {message:e.error.message,code:w(e.error.code)};let t=e,n=t?.error;if(typeof n=="object"&&n!==null&&"code"in n&&typeof n.code=="string")return {message:n.message??t?.message??r,code:w(n.code)};let s=t?.message??r,i=t?.error,a=typeof i=="string"?w(i):i===void 0?"NETWORK_FAILURE":w(String(i));return {message:s,code:a}}var er=3e4;function rr(){if(typeof globalThis.crypto<"u"&&typeof globalThis.crypto.randomUUID=="function")return globalThis.crypto.randomUUID();throw new Error("Web Crypto API is required but not available.")}function Ae(e,r){let t=r*Math.pow(2,e);return Math.min(t,er)}function tr(e,r){return e!=="GET"?false:r>=500||r===429}var V=class{constructor(r,t=0,n=1e3,s){this.timeoutMs=r;this.maxRetries=t;this.retryDelayMs=n;this.logger=s;}async get(r,t){return this.request(r,{method:"GET",headers:t})}async post(r,t,n){return this.request(r,{method:"POST",body:JSON.stringify(t),headers:{"Content-Type":"application/json",...n}})}async request(r,t){let n=(t.method??"GET").toUpperCase(),s=rr(),i=new Headers(t.headers);i.set("X-Request-Id",s),this.logger&&this.logger.debug("request",{requestId:s,url:r,method:n});let a;for(let d=0;d<=this.maxRetries;d++)try{let m=new AbortController,v=setTimeout(()=>m.abort(),this.timeoutMs);try{let f=await fetch(r,{...t,headers:i,signal:m.signal});if(!f.ok){let U;try{U=await f.json();}catch{}let{message:I,code:Ke}=Qe(U,f.statusText),ve=R(Ke,I,{requestId:s,status:f.status,statusText:f.statusText,data:U});if(tr(n,f.status)&&d<this.maxRetries){a=ve,clearTimeout(v),await new Promise(je=>setTimeout(je,Ae(d,this.retryDelayMs)));continue}return u(ve)}if(f.status===204)return p(void 0);if(f.headers.get("content-length")==="0")return p(void 0);let b=await f.json();if(Je(b))return p(b.resultado);let P=b;return typeof b=="object"&&b!==null&&P.ok===true&&!("resultado"in P)?p(void 0):p(b)}finally{clearTimeout(v);}}catch(m){if(a=m,n==="GET"&&d<this.maxRetries)await new Promise(f=>setTimeout(f,Ae(d,this.retryDelayMs)));else break}return a instanceof Error&&a.name==="AbortError"?u(R("TIMEOUT","Request timed out",{requestId:s})):u(R("NETWORK_FAILURE",a instanceof Error?a.message:"Request failed",{requestId:s,cause:a}))}};function _(e){let r=new Uint8Array(e),t=Array.from(r,s=>String.fromCharCode(s)).join("");if(typeof globalThis.btoa>"u")throw G("encode");return globalThis.btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function nr(e){if(typeof globalThis.atob>"u")throw G("decode");let r=e.replace(/-/g,"+").replace(/_/g,"/"),t=r.length%4,n=t===0?r:r+"=".repeat(4-t),s=globalThis.atob(n);return Uint8Array.from(s,i=>i.charCodeAt(0))}function x(e){let r=nr(e),t=new ArrayBuffer(r.length);return new Uint8Array(t).set(r),t}function Ie(e){return e!==null&&typeof e=="object"&&"clientDataJSON"in e&&e.clientDataJSON instanceof ArrayBuffer}function A(e){if(!e.response)throw R("UNKNOWN_ERROR","Credential response is missing",{credential:e});let r=e.response;if(!Ie(r))throw R("UNKNOWN_ERROR","Invalid credential response structure",{response:r});if(!("attestationObject"in r))throw R("UNKNOWN_ERROR","Invalid credential response structure for register: attestationObject is missing",{response:r});let t=r.clientDataJSON,n=r.attestationObject;return {id:e.id,rawId:_(e.rawId),response:{clientDataJSON:_(t),attestationObject:_(n)},type:"public-key"}}function B(e){if(!e.response)throw R("UNKNOWN_ERROR","Credential response is missing",{credential:e});let r=e.response;if(!Ie(r))throw R("UNKNOWN_ERROR","Invalid credential response structure",{response:r});if(!("authenticatorData"in r)||!("signature"in r))throw R("UNKNOWN_ERROR","Invalid credential response structure for auth: authenticatorData or signature is missing",{response:r});let t=r.clientDataJSON,n=r.authenticatorData,s=r.signature,i=r.userHandle;return {id:e.id,rawId:_(e.rawId),response:{authenticatorData:_(n),clientDataJSON:_(t),signature:_(s),...i&&{userHandle:_(i)}},type:"public-key"}}function M(){try{return !(typeof navigator>"u"||!navigator.credentials||typeof PublicKeyCredential>"u")}catch{return  false}}async function sr(){try{return !M()||typeof PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable!="function"?false:await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable()}catch{return  false}}async function Oe(){let e=M(),r=await sr();return {isPasskeySupported:e,platformAuthenticatorAvailable:r,recommendedFlow:e?"passkey":"fallback"}}function C(e,r="create"){if(!e||typeof e!="object"||!("id"in e)||!("rawId"in e)||!("response"in e))throw he(r)}async function N(e){let{operation:r,eventEmitter:t,start:n,createOptions:s,invoke:i,finish:a}=e;try{if(t.emit("start",{type:"start",operation:r}),!M()){let E=X();return t.emit("error",{type:"error",error:E}),u(E)}let d=await n();if(!d.ok)return t.emit("error",{type:"error",error:d.error}),u(d.error);let m=s(d.value);if(!m.ok)return t.emit("error",{type:"error",error:m.error}),u(m.error);let v=await i(m.value);if(!v){let E=y("credential",`${r==="register"?"creation":"retrieval"} failed`);return t.emit("error",{type:"error",error:E}),u(E)}try{C(v);}catch(E){let b=h(E);return t.emit("error",{type:"error",error:b}),u(b)}let f=await a(d.value,v);return f.ok?(t.emit("success",{type:"success",operation:r}),p(f.value)):(t.emit("error",{type:"error",error:f.error}),u(f.error))}catch(d){let m=h(d);return t.emit("error",{type:"error",error:m}),u(m)}}function k(e,r){try{L(e.challenge,"challenge"),L(e.user.id,"user.id");let t=x(e.challenge),n=x(e.user.id),s={userVerification:"preferred"};e.authenticatorSelection&&(s={...e.authenticatorSelection}),r&&(s={...s,authenticatorAttachment:r});let i={rp:{id:e.rp.id,name:e.rp.name},user:{id:n,name:e.user.name,displayName:e.user.displayName},challenge:t,pubKeyCredParams:e.pubKeyCredParams,...e.timeout!==void 0&&{timeout:e.timeout},attestation:"none",authenticatorSelection:s,...e.excludeCredentials&&{excludeCredentials:e.excludeCredentials.map(a=>({id:x(a.id),type:a.type,...a.transports&&{transports:a.transports}}))}};return p({publicKey:i})}catch(t){return u(h(t))}}function de(e,r){try{L(e.challenge,"challenge");let t=x(e.challenge);return p({publicKey:{challenge:t,rpId:e.rpId,...e.timeout!==void 0&&{timeout:e.timeout},userVerification:e.userVerification??"preferred",...e.allowCredentials&&{allowCredentials:e.allowCredentials.map(n=>({id:x(n.id),type:n.type,...n.transports&&{transports:n.transports}}))}},...r!==void 0&&{mediation:r}})}catch(t){return u(h(t))}}async function Ce(e,r,t){let n=e.externalUserId??e.external_user_id;if(!n||typeof n!="string"||n.trim()===""){let s=y("externalUserId","must be a non-empty string");return t.emit("error",{type:"error",error:s}),u(s)}return N({operation:"register",eventEmitter:t,start:()=>r.startRegister({external_user_id:n}),createOptions:s=>k(s.challenge,e.authenticatorType),invoke:async s=>{let i={...s,...e.signal&&{signal:e.signal}};return navigator.credentials.create(i)},finish:async(s,i)=>{let a=await r.finishRegister({session_id:s.session_id,credential:A(i),...e.successUrl&&{success_url:e.successUrl}});return a.ok?p({success:true,credentialId:a.value.credential_id,credential_id:a.value.credential_id,status:a.value.status,sessionToken:a.value.session_token,user:{userId:a.value.user.user_id,externalUserId:a.value.user.external_user_id,email:a.value.user.email,metadata:a.value.user.metadata},...a.value.redirect_url&&{redirectUrl:a.value.redirect_url}}):u(a.error)}})}async function ke(e,r,t){let n=e.externalUserId??e.external_user_id,s=n!==void 0&&typeof n=="string"&&n.trim()!=="";return N({operation:"authenticate",eventEmitter:t,start:()=>r.startAuth(s?{external_user_id:n.trim()}:{}),createOptions:i=>de(i.challenge,e.mediation),invoke:async i=>{let a={...i,...e.signal&&{signal:e.signal}};return navigator.credentials.get(a)},finish:async(i,a)=>{let d=await r.finishAuthentication({session_id:i.session_id,credential:B(a),...e.successUrl&&{success_url:e.successUrl}});return d.ok?p({authenticated:d.value.authenticated,sessionToken:d.value.session_token,user:{userId:d.value.user.user_id,externalUserId:d.value.user.external_user_id,email:d.value.user.email,metadata:d.value.user.metadata},signals:d.value.signals,...d.value.redirect_url&&{redirectUrl:d.value.redirect_url}}):u(d.error)}})}var ir=2e3,or=60,W=class{constructor(r){this.apiClient=r;}async startFlow(r){let t=await this.apiClient.startOnboarding({user_role:r.user_role});if(!t.ok)return u(t.error);let{session_id:n}=t.value;for(let s=0;s<or;s++){await new Promise(m=>setTimeout(m,ir));let i=await this.apiClient.getOnboardingStatus(n);if(!i.ok)return u(i.error);let a=i.value.status,d=i.value.onboarding_url;if(a==="pending_passkey"){let m=await this.apiClient.getOnboardingRegister(n);if(!m.ok)return u(m.error);let v=m.value;if(!v.challenge)return u(R("NOT_SUPPORTED","Onboarding requires user action - complete passkey registration at the provided onboarding_url",{onboarding_url:d}));let f=k(v.challenge);if(!f.ok)return u(f.error);let E;try{E=await navigator.credentials.create(f.value);}catch(I){return u(h(I))}try{C(E,"create");}catch(I){return u(h(I))}let b;try{b=A(E);}catch(I){return u(h(I))}let P=await this.apiClient.registerOnboardingPasskey(n,{credential:b,challenge:v.challenge.challenge});return P.ok?await this.apiClient.completeOnboarding(n,{company_name:r.company_name}):u(P.error)}if(a==="completed")return await this.apiClient.completeOnboarding(n,{company_name:r.company_name})}return u(R("TIMEOUT","Onboarding timed out"))}};var ar=2e3,lr=60,H=class{constructor(r){this.apiClient=r;}async init(){return this.apiClient.initCrossDeviceAuth()}async initRegistration(r){return this.apiClient.initCrossDeviceRegistration(r)}async waitForSession(r,t,n){for(let s=0;s<lr;s++){if(t?.aborted)return u(R("ABORT_ERROR","Operation aborted by user or timeout"));let i=await this.apiClient.getCrossDeviceStatus(r,n);if(!i.ok)return u(i.error);if(i.value.status==="completed")return !i.value.session_token||!i.value.user_id?u(R("UNKNOWN_ERROR","Missing data in completed session")):p({session_token:i.value.session_token,user_id:i.value.user_id});if(t?.aborted)return u(R("ABORT_ERROR","Operation aborted by user or timeout"));if(await new Promise(a=>{let d=setTimeout(()=>{a(null),t?.removeEventListener("abort",m);},ar),m=()=>{clearTimeout(d),a(null);};t?.addEventListener("abort",m);}),t?.aborted)return u(R("ABORT_ERROR","Operation aborted by user or timeout"))}return u(R("TIMEOUT","Cross-device authentication timed out"))}async approve(r){let t=await this.apiClient.getCrossDeviceContext(r);if(!t.ok)return u(t.error);let n=t.value;return n.type==="registration"?this.executeRegistrationApproval(r,n):this.executeAuthApproval(r,n)}async executeRegistrationApproval(r,t){let n=k(t.options);if(!n.ok)return u(n.error);let s;try{s=await navigator.credentials.create(n.value);}catch(a){return u(h(a))}try{C(s,"create");}catch(a){return u(h(a))}let i;try{i=A(s);}catch(a){return u(h(a))}return this.apiClient.verifyCrossDeviceRegistration({session_id:r,credential:i})}async executeAuthApproval(r,t){let n=de(t.options);if(!n.ok)return u(n.error);let s;try{s=await navigator.credentials.get(n.value);}catch(a){return u(h(a))}try{C(s,"get");}catch(a){return u(h(a))}let i;try{i=B(s);}catch(a){return u(h(a))}return this.apiClient.verifyCrossDeviceAuth({session_id:r,credential:i})}};var $=class{handlers;constructor(){this.handlers=new Map;}on(r,t){let n=this.handlers.get(r);return n||(n=new Set,this.handlers.set(r,n)),n.add(t),()=>{this.off(r,t);}}off(r,t){let n=this.handlers.get(r);n&&(n.delete(t),n.size===0&&this.handlers.delete(r));}emit(r,t){let n=this.handlers.get(r);if(n)for(let s of n)try{s(t);}catch{}}removeAllListeners(){this.handlers.clear();}};async function Se(e,r,t){let n=e.externalUserId??e.external_user_id;if(!n||typeof n!="string"||n.trim()===""){let s=y("externalUserId","must be a non-empty string");return t.emit("error",{type:"error",error:s}),u(s)}if(!e.otp||typeof e.otp!="string"||e.otp.trim().length!==6){let s=y("otp","must be a 6-digit string");return t.emit("error",{type:"error",error:s}),u(s)}return N({operation:"register",eventEmitter:t,start:()=>r.verifyAccountRecoveryOtp(n,e.otp),createOptions:s=>k(s.challenge),invoke:async s=>navigator.credentials.create(s),finish:async(s,i)=>{let a=await r.completeAccountRecovery(s.recovery_session_id,A(i));return a.ok?p({success:true,credentialId:a.value.credential_id,status:a.value.status,sessionToken:a.value.session_token,user:{userId:a.value.user.user_id,externalUserId:a.value.user.external_user_id,email:a.value.user.email,metadata:a.value.user.metadata}}):u(a.error)}})}var ge="https://api.trymellonauth.com",xe="https://api.trymellonauth.com/v1/telemetry";var me="trymellon_sandbox_session_token_v1";function Me(e){return {async send(r){let t=JSON.stringify(r);if(typeof navigator<"u"&&typeof navigator.sendBeacon=="function"){navigator.sendBeacon(e,t);return}typeof fetch<"u"&&await fetch(e,{method:"POST",body:t,headers:{"Content-Type":"application/json"},keepalive:true});}}}function Re(e,r){return {event:e,latencyMs:r,ok:true}}var fe=class e{sandbox;sandboxToken;apiClient;eventEmitter;telemetrySender;crossDeviceManager;onboarding;static create(r){try{let t=r.appId,n=r.publishableKey;if(!t||typeof t!="string"||t.trim()==="")return u(y("appId","must be a non-empty string"));if(!n||typeof n!="string"||n.trim()==="")return u(y("publishableKey","must be a non-empty string"));let s=r.apiBaseUrl??ge;z(s,"apiBaseUrl");let i=r.timeoutMs??3e4;return O(i,"timeoutMs",1e3,3e5),r.maxRetries!==void 0&&O(r.maxRetries,"maxRetries",0,10),r.retryDelayMs!==void 0&&O(r.retryDelayMs,"retryDelayMs",100,1e4),p(new e(r))}catch(t){return F(t)?u(t):u(y("config",t.message))}}constructor(r){this.sandbox=r.sandbox===true,this.sandboxToken=this.sandbox&&r.sandboxToken!=null&&r.sandboxToken!==""?r.sandboxToken:me;let t=r.appId,n=r.publishableKey;if(!t||typeof t!="string"||t.trim()==="")throw y("appId","must be a non-empty string");if(!n||typeof n!="string"||n.trim()==="")throw y("publishableKey","must be a non-empty string");let s=r.apiBaseUrl??ge;z(s,"apiBaseUrl");let i=r.timeoutMs??3e4;O(i,"timeoutMs",1e3,3e5),r.maxRetries!==void 0&&O(r.maxRetries,"maxRetries",0,10),r.retryDelayMs!==void 0&&O(r.retryDelayMs,"retryDelayMs",100,1e4);let a=r.maxRetries??3,d=r.retryDelayMs??1e3,m=new V(i,a,d,r.logger),v=r.origin??(typeof window<"u"&&window?.location?.origin?window.location.origin:void 0),f={"X-App-Id":t.trim(),Authorization:`Bearer ${n.trim()}`,...v&&{Origin:v}};this.apiClient=new q(m,s,f),this.onboarding=new W(this.apiClient),this.crossDeviceManager=new H(this.apiClient),this.eventEmitter=new $,r.enableTelemetry&&(this.telemetrySender=r.telemetrySender??Me(r.telemetryEndpoint??xe));}static isSupported(){return M()}sandboxAuthResult(r,t){let n=t.externalUserId??t.external_user_id??"sandbox",s=typeof n=="string"?n:"sandbox";return r==="register"?Promise.resolve(p({success:true,credentialId:"",status:"sandbox",sessionToken:this.sandboxToken,user:{userId:"sandbox-user",externalUserId:s}})):Promise.resolve(p({authenticated:true,sessionToken:this.sandboxToken,user:{userId:"sandbox-user",externalUserId:s}}))}async register(r){if(this.sandbox)return this.sandboxAuthResult("register",r);let t=Date.now(),n=await Ce(r,this.apiClient,this.eventEmitter);return n.ok&&this.telemetrySender&&this.telemetrySender.send(Re("register",Date.now()-t)).catch(()=>{}),n}async authenticate(r){if(this.sandbox)return this.sandboxAuthResult("authenticate",r);let t=Date.now(),n=await ke(r,this.apiClient,this.eventEmitter);return n.ok&&this.telemetrySender&&this.telemetrySender.send(Re("authenticate",Date.now()-t)).catch(()=>{}),n}async validateSession(r){return this.sandbox&&r===this.sandboxToken?Promise.resolve(p({valid:true,user_id:"sandbox-user",external_user_id:"sandbox",tenant_id:"sandbox-tenant",app_id:"sandbox-app"})):this.apiClient.validateSession(r)}async getStatus(){return Oe()}on(r,t){return this.eventEmitter.on(r,t)}version(){return "1.7.4"}fallback={email:{start:async r=>this.apiClient.startEmailFallback(r),verify:async r=>{let t=await this.apiClient.verifyEmailCode({userId:r.userId,code:r.code,...r.successUrl&&{successUrl:r.successUrl}});return t.ok?p({sessionToken:t.value.sessionToken,...t.value.redirectUrl&&{redirectUrl:t.value.redirectUrl}}):t}}};auth={crossDevice:{init:()=>this.crossDeviceManager.init(),initRegistration:r=>this.crossDeviceManager.initRegistration(r),waitForSession:(r,t,n)=>this.crossDeviceManager.waitForSession(r,t,n),getContext:r=>this.apiClient.getCrossDeviceContext(r),approve:r=>this.crossDeviceManager.approve(r)},recoverAccount:async r=>Se(r,this.apiClient,this.eventEmitter)}};var ye=class{debug(r,t){t&&Object.keys(t).length>0?console.debug(`[TryMellon] ${r}`,t):console.debug(`[TryMellon] ${r}`);}info(r,t){t&&Object.keys(t).length>0?console.info(`[TryMellon] ${r}`,t):console.info(`[TryMellon] ${r}`);}warn(r,t){t&&Object.keys(t).length>0?console.warn(`[TryMellon] ${r}`,t):console.warn(`[TryMellon] ${r}`);}error(r,t){t&&Object.keys(t).length>0?console.error(`[TryMellon] ${r}`,t):console.error(`[TryMellon] ${r}`);}};
+exports.ConsoleLogger=ye;exports.SANDBOX_SESSION_TOKEN=me;exports.TryMellon=fe;exports.TryMellonError=D;exports.createError=R;exports.createInvalidArgumentError=y;exports.createNetworkError=Be;exports.createNotSupportedError=X;exports.createTimeoutError=We;exports.createUserCancelledError=Ve;exports.err=u;exports.isTryMellonError=F;exports.mapWebAuthnError=h;exports.ok=p;return exports;})({});//# sourceMappingURL=index.global.js.map
 //# sourceMappingURL=index.global.js.map