herald-auth-web 0.5.1

package/dist/index.js

@@ -0,0 +1,1526 @@
+// src/generated/core/bodySerializer.gen.ts
+var jsonBodySerializer = {
+  bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value)
+};
+
+// src/generated/core/serverSentEvents.gen.ts
+var createSseClient = ({
+  onRequest,
+  onSseError,
+  onSseEvent,
+  responseTransformer,
+  responseValidator,
+  sseDefaultRetryDelay,
+  sseMaxRetryAttempts,
+  sseMaxRetryDelay,
+  sseSleepFn,
+  url,
+  ...options
+}) => {
+  let lastEventId;
+  const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const createStream = async function* () {
+    let retryDelay = sseDefaultRetryDelay ?? 3e3;
+    let attempt = 0;
+    const signal = options.signal ?? new AbortController().signal;
+    while (true) {
+      if (signal.aborted) break;
+      attempt++;
+      const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+      if (lastEventId !== void 0) {
+        headers.set("Last-Event-ID", lastEventId);
+      }
+      try {
+        const requestInit = {
+          redirect: "follow",
+          ...options,
+          body: options.serializedBody,
+          headers,
+          signal
+        };
+        let request = new Request(url, requestInit);
+        if (onRequest) {
+          request = await onRequest(url, requestInit);
+        }
+        const _fetch = options.fetch ?? globalThis.fetch;
+        const response = await _fetch(request);
+        if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);
+        if (!response.body) throw new Error("No body in SSE response");
+        const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
+        let buffer = "";
+        const abortHandler = () => {
+          try {
+            reader.cancel();
+          } catch {
+          }
+        };
+        signal.addEventListener("abort", abortHandler);
+        try {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            buffer += value;
+            buffer = buffer.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+            const chunks = buffer.split("\n\n");
+            buffer = chunks.pop() ?? "";
+            for (const chunk of chunks) {
+              const lines = chunk.split("\n");
+              const dataLines = [];
+              let eventName;
+              for (const line of lines) {
+                if (line.startsWith("data:")) {
+                  dataLines.push(line.replace(/^data:\s*/, ""));
+                } else if (line.startsWith("event:")) {
+                  eventName = line.replace(/^event:\s*/, "");
+                } else if (line.startsWith("id:")) {
+                  lastEventId = line.replace(/^id:\s*/, "");
+                } else if (line.startsWith("retry:")) {
+                  const parsed = Number.parseInt(line.replace(/^retry:\s*/, ""), 10);
+                  if (!Number.isNaN(parsed)) {
+                    retryDelay = parsed;
+                  }
+                }
+              }
+              let data;
+              let parsedJson = false;
+              if (dataLines.length) {
+                const rawData = dataLines.join("\n");
+                try {
+                  data = JSON.parse(rawData);
+                  parsedJson = true;
+                } catch {
+                  data = rawData;
+                }
+              }
+              if (parsedJson) {
+                if (responseValidator) {
+                  await responseValidator(data);
+                }
+                if (responseTransformer) {
+                  data = await responseTransformer(data);
+                }
+              }
+              onSseEvent?.({
+                data,
+                event: eventName,
+                id: lastEventId,
+                retry: retryDelay
+              });
+              if (dataLines.length) {
+                yield data;
+              }
+            }
+          }
+        } finally {
+          signal.removeEventListener("abort", abortHandler);
+          reader.releaseLock();
+        }
+        break;
+      } catch (error) {
+        onSseError?.(error);
+        if (sseMaxRetryAttempts !== void 0 && attempt >= sseMaxRetryAttempts) {
+          break;
+        }
+        const backoff = Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 3e4);
+        await sleep(backoff);
+      }
+    }
+  };
+  const stream = createStream();
+  return { stream };
+};
+
+// src/generated/core/pathSerializer.gen.ts
+var separatorArrayExplode = (style) => {
+  switch (style) {
+    case "label":
+      return ".";
+    case "matrix":
+      return ";";
+    case "simple":
+      return ",";
+    default:
+      return "&";
+  }
+};
+var separatorArrayNoExplode = (style) => {
+  switch (style) {
+    case "form":
+      return ",";
+    case "pipeDelimited":
+      return "|";
+    case "spaceDelimited":
+      return "%20";
+    default:
+      return ",";
+  }
+};
+var separatorObjectExplode = (style) => {
+  switch (style) {
+    case "label":
+      return ".";
+    case "matrix":
+      return ";";
+    case "simple":
+      return ",";
+    default:
+      return "&";
+  }
+};
+var serializeArrayParam = ({
+  allowReserved,
+  explode,
+  name,
+  style,
+  value
+}) => {
+  if (!explode) {
+    const joinedValues2 = (allowReserved ? value : value.map((v) => encodeURIComponent(v))).join(separatorArrayNoExplode(style));
+    switch (style) {
+      case "label":
+        return `.${joinedValues2}`;
+      case "matrix":
+        return `;${name}=${joinedValues2}`;
+      case "simple":
+        return joinedValues2;
+      default:
+        return `${name}=${joinedValues2}`;
+    }
+  }
+  const separator = separatorArrayExplode(style);
+  const joinedValues = value.map((v) => {
+    if (style === "label" || style === "simple") {
+      return allowReserved ? v : encodeURIComponent(v);
+    }
+    return serializePrimitiveParam({
+      allowReserved,
+      name,
+      value: v
+    });
+  }).join(separator);
+  return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+var serializePrimitiveParam = ({
+  allowReserved,
+  name,
+  value
+}) => {
+  if (value === void 0 || value === null) {
+    return "";
+  }
+  if (typeof value === "object") {
+    throw new Error(
+      "Deeply-nested arrays/objects aren\u2019t supported. Provide your own `querySerializer()` to handle these."
+    );
+  }
+  return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+};
+var serializeObjectParam = ({
+  allowReserved,
+  explode,
+  name,
+  style,
+  value,
+  valueOnly
+}) => {
+  if (value instanceof Date) {
+    return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+  }
+  if (style !== "deepObject" && !explode) {
+    let values = [];
+    Object.entries(value).forEach(([key, v]) => {
+      values = [...values, key, allowReserved ? v : encodeURIComponent(v)];
+    });
+    const joinedValues2 = values.join(",");
+    switch (style) {
+      case "form":
+        return `${name}=${joinedValues2}`;
+      case "label":
+        return `.${joinedValues2}`;
+      case "matrix":
+        return `;${name}=${joinedValues2}`;
+      default:
+        return joinedValues2;
+    }
+  }
+  const separator = separatorObjectExplode(style);
+  const joinedValues = Object.entries(value).map(
+    ([key, v]) => serializePrimitiveParam({
+      allowReserved,
+      name: style === "deepObject" ? `${name}[${key}]` : key,
+      value: v
+    })
+  ).join(separator);
+  return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+
+// src/generated/core/utils.gen.ts
+var PATH_PARAM_RE = /\{[^{}]+\}/g;
+var defaultPathSerializer = ({ path, url: _url }) => {
+  let url = _url;
+  const matches = _url.match(PATH_PARAM_RE);
+  if (matches) {
+    for (const match of matches) {
+      let explode = false;
+      let name = match.substring(1, match.length - 1);
+      let style = "simple";
+      if (name.endsWith("*")) {
+        explode = true;
+        name = name.substring(0, name.length - 1);
+      }
+      if (name.startsWith(".")) {
+        name = name.substring(1);
+        style = "label";
+      } else if (name.startsWith(";")) {
+        name = name.substring(1);
+        style = "matrix";
+      }
+      const value = path[name];
+      if (value === void 0 || value === null) {
+        continue;
+      }
+      if (Array.isArray(value)) {
+        url = url.replace(match, serializeArrayParam({ explode, name, style, value }));
+        continue;
+      }
+      if (typeof value === "object") {
+        url = url.replace(
+          match,
+          serializeObjectParam({
+            explode,
+            name,
+            style,
+            value,
+            valueOnly: true
+          })
+        );
+        continue;
+      }
+      if (style === "matrix") {
+        url = url.replace(
+          match,
+          `;${serializePrimitiveParam({
+            name,
+            value
+          })}`
+        );
+        continue;
+      }
+      const replaceValue = encodeURIComponent(
+        style === "label" ? `.${value}` : value
+      );
+      url = url.replace(match, replaceValue);
+    }
+  }
+  return url;
+};
+var getUrl = ({
+  baseUrl,
+  path,
+  query,
+  querySerializer,
+  url: _url
+}) => {
+  const pathUrl = _url.startsWith("/") ? _url : `/${_url}`;
+  let url = (baseUrl ?? "") + pathUrl;
+  if (path) {
+    url = defaultPathSerializer({ path, url });
+  }
+  let search = query ? querySerializer(query) : "";
+  if (search.startsWith("?")) {
+    search = search.substring(1);
+  }
+  if (search) {
+    url += `?${search}`;
+  }
+  return url;
+};
+function getValidRequestBody(options) {
+  const hasBody = options.body !== void 0;
+  const isSerializedBody = hasBody && options.bodySerializer;
+  if (isSerializedBody) {
+    if ("serializedBody" in options) {
+      const hasSerializedBody = options.serializedBody !== void 0 && options.serializedBody !== "";
+      return hasSerializedBody ? options.serializedBody : null;
+    }
+    return options.body !== "" ? options.body : null;
+  }
+  if (hasBody) {
+    return options.body;
+  }
+  return void 0;
+}
+
+// src/generated/core/auth.gen.ts
+var getAuthToken = async (auth, callback) => {
+  const token = typeof callback === "function" ? await callback(auth) : callback;
+  if (!token) {
+    return;
+  }
+  if (auth.scheme === "bearer") {
+    return `Bearer ${token}`;
+  }
+  if (auth.scheme === "basic") {
+    return `Basic ${btoa(token)}`;
+  }
+  return token;
+};
+
+// src/generated/client/utils.gen.ts
+var createQuerySerializer = ({
+  parameters = {},
+  ...args
+} = {}) => {
+  const querySerializer = (queryParams) => {
+    const search = [];
+    if (queryParams && typeof queryParams === "object") {
+      for (const name in queryParams) {
+        const value = queryParams[name];
+        if (value === void 0 || value === null) {
+          continue;
+        }
+        const options = parameters[name] || args;
+        if (Array.isArray(value)) {
+          const serializedArray = serializeArrayParam({
+            allowReserved: options.allowReserved,
+            explode: true,
+            name,
+            style: "form",
+            value,
+            ...options.array
+          });
+          if (serializedArray) search.push(serializedArray);
+        } else if (typeof value === "object") {
+          const serializedObject = serializeObjectParam({
+            allowReserved: options.allowReserved,
+            explode: true,
+            name,
+            style: "deepObject",
+            value,
+            ...options.object
+          });
+          if (serializedObject) search.push(serializedObject);
+        } else {
+          const serializedPrimitive = serializePrimitiveParam({
+            allowReserved: options.allowReserved,
+            name,
+            value
+          });
+          if (serializedPrimitive) search.push(serializedPrimitive);
+        }
+      }
+    }
+    return search.join("&");
+  };
+  return querySerializer;
+};
+var getParseAs = (contentType) => {
+  if (!contentType) {
+    return "stream";
+  }
+  const cleanContent = contentType.split(";")[0]?.trim();
+  if (!cleanContent) {
+    return;
+  }
+  if (cleanContent.startsWith("application/json") || cleanContent.endsWith("+json")) {
+    return "json";
+  }
+  if (cleanContent === "multipart/form-data") {
+    return "formData";
+  }
+  if (["application/", "audio/", "image/", "video/"].some((type) => cleanContent.startsWith(type))) {
+    return "blob";
+  }
+  if (cleanContent.startsWith("text/")) {
+    return "text";
+  }
+  return;
+};
+var checkForExistence = (options, name) => {
+  if (!name) {
+    return false;
+  }
+  if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) {
+    return true;
+  }
+  return false;
+};
+var setAuthParams = async ({
+  security,
+  ...options
+}) => {
+  for (const auth of security) {
+    if (checkForExistence(options, auth.name)) {
+      continue;
+    }
+    const token = await getAuthToken(auth, options.auth);
+    if (!token) {
+      continue;
+    }
+    const name = auth.name ?? "Authorization";
+    switch (auth.in) {
+      case "query":
+        if (!options.query) {
+          options.query = {};
+        }
+        options.query[name] = token;
+        break;
+      case "cookie":
+        options.headers.append("Cookie", `${name}=${token}`);
+        break;
+      case "header":
+      default:
+        options.headers.set(name, token);
+        break;
+    }
+  }
+};
+var buildUrl = (options) => getUrl({
+  baseUrl: options.baseUrl,
+  path: options.path,
+  query: options.query,
+  querySerializer: typeof options.querySerializer === "function" ? options.querySerializer : createQuerySerializer(options.querySerializer),
+  url: options.url
+});
+var mergeConfigs = (a, b) => {
+  const config = { ...a, ...b };
+  if (config.baseUrl?.endsWith("/")) {
+    config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
+  }
+  config.headers = mergeHeaders(a.headers, b.headers);
+  return config;
+};
+var headersEntries = (headers) => {
+  const entries = [];
+  headers.forEach((value, key) => {
+    entries.push([key, value]);
+  });
+  return entries;
+};
+var mergeHeaders = (...headers) => {
+  const mergedHeaders = new Headers();
+  for (const header of headers) {
+    if (!header) {
+      continue;
+    }
+    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    for (const [key, value] of iterator) {
+      if (value === null) {
+        mergedHeaders.delete(key);
+      } else if (Array.isArray(value)) {
+        for (const v of value) {
+          mergedHeaders.append(key, v);
+        }
+      } else if (value !== void 0) {
+        mergedHeaders.set(
+          key,
+          typeof value === "object" ? JSON.stringify(value) : value
+        );
+      }
+    }
+  }
+  return mergedHeaders;
+};
+var Interceptors = class {
+  constructor() {
+    this.fns = [];
+  }
+  clear() {
+    this.fns = [];
+  }
+  eject(id) {
+    const index = this.getInterceptorIndex(id);
+    if (this.fns[index]) {
+      this.fns[index] = null;
+    }
+  }
+  exists(id) {
+    const index = this.getInterceptorIndex(id);
+    return Boolean(this.fns[index]);
+  }
+  getInterceptorIndex(id) {
+    if (typeof id === "number") {
+      return this.fns[id] ? id : -1;
+    }
+    return this.fns.indexOf(id);
+  }
+  update(id, fn) {
+    const index = this.getInterceptorIndex(id);
+    if (this.fns[index]) {
+      this.fns[index] = fn;
+      return id;
+    }
+    return false;
+  }
+  use(fn) {
+    this.fns.push(fn);
+    return this.fns.length - 1;
+  }
+};
+var createInterceptors = () => ({
+  error: new Interceptors(),
+  request: new Interceptors(),
+  response: new Interceptors()
+});
+var defaultQuerySerializer = createQuerySerializer({
+  allowReserved: false,
+  array: {
+    explode: true,
+    style: "form"
+  },
+  object: {
+    explode: true,
+    style: "deepObject"
+  }
+});
+var defaultHeaders = {
+  "Content-Type": "application/json"
+};
+var createConfig = (override = {}) => ({
+  ...jsonBodySerializer,
+  headers: defaultHeaders,
+  parseAs: "auto",
+  querySerializer: defaultQuerySerializer,
+  ...override
+});
+
+// src/generated/client/client.gen.ts
+var createClient = (config = {}) => {
+  let _config = mergeConfigs(createConfig(), config);
+  const getConfig = () => ({ ..._config });
+  const setConfig = (config2) => {
+    _config = mergeConfigs(_config, config2);
+    return getConfig();
+  };
+  const interceptors = createInterceptors();
+  const beforeRequest = async (options) => {
+    const opts = {
+      ..._config,
+      ...options,
+      fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
+      headers: mergeHeaders(_config.headers, options.headers),
+      serializedBody: void 0
+    };
+    if (opts.security) {
+      await setAuthParams({
+        ...opts,
+        security: opts.security
+      });
+    }
+    if (opts.requestValidator) {
+      await opts.requestValidator(opts);
+    }
+    if (opts.body !== void 0 && opts.bodySerializer) {
+      opts.serializedBody = opts.bodySerializer(opts.body);
+    }
+    if (opts.body === void 0 || opts.serializedBody === "") {
+      opts.headers.delete("Content-Type");
+    }
+    const url = buildUrl(opts);
+    return { opts, url };
+  };
+  const request = async (options) => {
+    const { opts, url } = await beforeRequest(options);
+    const requestInit = {
+      redirect: "follow",
+      ...opts,
+      body: getValidRequestBody(opts)
+    };
+    let request2 = new Request(url, requestInit);
+    for (const fn of interceptors.request.fns) {
+      if (fn) {
+        request2 = await fn(request2, opts);
+      }
+    }
+    const _fetch = opts.fetch;
+    let response;
+    try {
+      response = await _fetch(request2);
+    } catch (error2) {
+      let finalError2 = error2;
+      for (const fn of interceptors.error.fns) {
+        if (fn) {
+          finalError2 = await fn(error2, void 0, request2, opts);
+        }
+      }
+      finalError2 = finalError2 || {};
+      if (opts.throwOnError) {
+        throw finalError2;
+      }
+      return opts.responseStyle === "data" ? void 0 : {
+        error: finalError2,
+        request: request2,
+        response: void 0
+      };
+    }
+    for (const fn of interceptors.response.fns) {
+      if (fn) {
+        response = await fn(response, request2, opts);
+      }
+    }
+    const result = {
+      request: request2,
+      response
+    };
+    if (response.ok) {
+      const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+      if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+        let emptyData;
+        switch (parseAs) {
+          case "arrayBuffer":
+          case "blob":
+          case "text":
+            emptyData = await response[parseAs]();
+            break;
+          case "formData":
+            emptyData = new FormData();
+            break;
+          case "stream":
+            emptyData = response.body;
+            break;
+          case "json":
+          default:
+            emptyData = {};
+            break;
+        }
+        return opts.responseStyle === "data" ? emptyData : {
+          data: emptyData,
+          ...result
+        };
+      }
+      let data;
+      switch (parseAs) {
+        case "arrayBuffer":
+        case "blob":
+        case "formData":
+        case "text":
+          data = await response[parseAs]();
+          break;
+        case "json": {
+          const text = await response.text();
+          data = text ? JSON.parse(text) : {};
+          break;
+        }
+        case "stream":
+          return opts.responseStyle === "data" ? response.body : {
+            data: response.body,
+            ...result
+          };
+      }
+      if (parseAs === "json") {
+        if (opts.responseValidator) {
+          await opts.responseValidator(data);
+        }
+        if (opts.responseTransformer) {
+          data = await opts.responseTransformer(data);
+        }
+      }
+      return opts.responseStyle === "data" ? data : {
+        data,
+        ...result
+      };
+    }
+    const textError = await response.text();
+    let jsonError;
+    try {
+      jsonError = JSON.parse(textError);
+    } catch {
+    }
+    const error = jsonError ?? textError;
+    let finalError = error;
+    for (const fn of interceptors.error.fns) {
+      if (fn) {
+        finalError = await fn(error, response, request2, opts);
+      }
+    }
+    finalError = finalError || {};
+    if (opts.throwOnError) {
+      throw finalError;
+    }
+    return opts.responseStyle === "data" ? void 0 : {
+      error: finalError,
+      ...result
+    };
+  };
+  const makeMethodFn = (method) => (options) => request({ ...options, method });
+  const makeSseFn = (method) => async (options) => {
+    const { opts, url } = await beforeRequest(options);
+    return createSseClient({
+      ...opts,
+      body: opts.body,
+      headers: opts.headers,
+      method,
+      onRequest: async (url2, init) => {
+        let request2 = new Request(url2, init);
+        for (const fn of interceptors.request.fns) {
+          if (fn) {
+            request2 = await fn(request2, opts);
+          }
+        }
+        return request2;
+      },
+      serializedBody: getValidRequestBody(opts),
+      url
+    });
+  };
+  return {
+    buildUrl,
+    connect: makeMethodFn("CONNECT"),
+    delete: makeMethodFn("DELETE"),
+    get: makeMethodFn("GET"),
+    getConfig,
+    head: makeMethodFn("HEAD"),
+    interceptors,
+    options: makeMethodFn("OPTIONS"),
+    patch: makeMethodFn("PATCH"),
+    post: makeMethodFn("POST"),
+    put: makeMethodFn("PUT"),
+    request,
+    setConfig,
+    sse: {
+      connect: makeSseFn("CONNECT"),
+      delete: makeSseFn("DELETE"),
+      get: makeSseFn("GET"),
+      head: makeSseFn("HEAD"),
+      options: makeSseFn("OPTIONS"),
+      patch: makeSseFn("PATCH"),
+      post: makeSseFn("POST"),
+      put: makeSseFn("PUT"),
+      trace: makeSseFn("TRACE")
+    },
+    trace: makeMethodFn("TRACE")
+  };
+};
+
+// src/generated/client.gen.ts
+var client = createClient(createConfig());
+
+// src/generated/sdk.gen.ts
+var refresh = (options) => (options.client ?? client).post({
+  url: "/api/auth/browser-token/refresh",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var logout = (options) => (options?.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/api/auth/logout",
+  ...options
+});
+var status = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/api/auth/status",
+  ...options
+});
+var login = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/login",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var send = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/login/email-otp/send",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var verify = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/login/email-otp/verify",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var handlePasskey2FaOptions = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/login/passkey/2fa/options",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var handlePasskey2FaVerify = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/login/passkey/2fa/verify",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var handlePasskeyOptions = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/login/passkey/options",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var handlePasskeyVerify = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/login/passkey/verify",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var handleVerifyTotp = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/login/verify-totp",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var register = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/register",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var resetPasswordRequest = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/reset_password/request",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var verifyEmailTrigger = (options) => (options.client ?? client).post({
+  url: "/api/auth/{realmId}/verify_email/trigger",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+
+// src/errors.ts
+var HeraldError = class extends Error {
+  constructor(init) {
+    super(init.message ?? init.kind);
+    this.name = "HeraldError";
+    this.kind = init.kind;
+    this.status = init.status;
+    this.code = init.code;
+    this.requestId = init.requestId;
+    this.details = init.details;
+  }
+};
+function kindForStatus(status2) {
+  switch (status2) {
+    case 400:
+      return "validation";
+    case 401:
+      return "unauthorized";
+    case 403:
+      return "forbidden";
+    case 404:
+      return "not-found";
+    case 429:
+      return "rate-limited";
+    default:
+      return "api";
+  }
+}
+function toHeraldError(error, response) {
+  if (!response) {
+    return new HeraldError({
+      kind: "network",
+      message: "Network request failed. For cross-origin integrations, ensure the page origin is pre-registered on the Client App (allowed_origins).",
+      details: error
+    });
+  }
+  const body = error ?? {};
+  return new HeraldError({
+    kind: kindForStatus(response.status),
+    status: response.status,
+    message: body.message ?? body.error ?? `HTTP ${response.status}`,
+    code: body.code,
+    requestId: body.requestId ?? void 0,
+    details: body.details
+  });
+}
+
+// src/transport.ts
+var RETRY_HEADER = "X-Herald-Refresh-Retried";
+var REFRESH_PATH = "/api/auth/browser-token/refresh";
+function refreshTokens(client2, deps) {
+  const rt = deps.storage.getRefreshToken();
+  if (!rt) {
+    deps.session.emit({ type: "session-expired", reason: "refresh-failed" });
+    return Promise.resolve(null);
+  }
+  const inFlight = client2.__heraldRefresh;
+  if (inFlight) return inFlight;
+  const promise = (async () => {
+    try {
+      const { data, error } = await refresh({ client: client2, body: { refreshToken: rt } });
+      if (error || !data) {
+        deps.session.emit({ type: "session-expired", reason: "family-revoked" });
+        return null;
+      }
+      deps.accessTokenHolder.set(data.accessToken);
+      deps.storage.setRefreshToken(data.refreshToken);
+      return data;
+    } catch {
+      deps.session.emit({ type: "session-expired", reason: "refresh-failed" });
+      return null;
+    } finally {
+      client2.__heraldRefresh = null;
+    }
+  })();
+  client2.__heraldRefresh = promise;
+  return promise;
+}
+async function replayRequest(client2, options) {
+  const result = await client2.request(options);
+  if (!result.response) {
+    return new Response(null, { status: 401 });
+  }
+  const headers = new Headers(result.response.headers);
+  const payload = result.data !== void 0 ? result.data : result.error;
+  const body = payload !== void 0 && payload !== null ? JSON.stringify(payload) : null;
+  return new Response(body, { status: result.response.status, headers });
+}
+function createTransport(deps) {
+  const client2 = createClient({ baseUrl: deps.baseUrl });
+  client2.interceptors.request.use((request, options) => {
+    if (options.url === REFRESH_PATH) {
+      return request;
+    }
+    const accessToken = deps.accessTokenHolder.get();
+    if (!accessToken) {
+      return request;
+    }
+    const headers = new Headers(request.headers);
+    if (!headers.has("Authorization")) {
+      headers.set("Authorization", `Bearer ${accessToken}`);
+    }
+    return new Request(request, { headers });
+  });
+  client2.interceptors.response.use(
+    async (response, request, options) => {
+      if (response.status !== 401) {
+        return response;
+      }
+      if (options.url === REFRESH_PATH) {
+        return response;
+      }
+      if (request.headers.get(RETRY_HEADER)) {
+        return response;
+      }
+      const refreshed = await refreshTokens(client2, deps) !== null;
+      if (!refreshed) {
+        return response;
+      }
+      const replayOptions = { ...options };
+      const headers = new Headers(
+        replayOptions.headers ?? void 0
+      );
+      headers.set(RETRY_HEADER, "1");
+      replayOptions.headers = headers;
+      return replayRequest(client2, replayOptions);
+    }
+  );
+  return { client: client2, refreshTokens: () => refreshTokens(client2, deps) };
+}
+async function resolveOp(promise) {
+  const { data, error, response } = await promise;
+  if (data === void 0) {
+    throw toHeraldError(error, response);
+  }
+  return data;
+}
+
+// src/auth.ts
+function applyTokens(tokens, deps) {
+  deps.accessTokenHolder.set(tokens.accessToken);
+  deps.storage.setRefreshToken(tokens.refreshToken);
+}
+function sessionFromLoginSuccess(deps) {
+  return {
+    authenticated: true,
+    realmId: deps.realmId,
+    userId: null,
+    clientAppId: null,
+    clientId: deps.clientId,
+    credentialClass: "custom_user_ui",
+    permissions: [],
+    scopes: []
+  };
+}
+function sessionFromStatus(s, deps) {
+  return {
+    authenticated: s.authenticated,
+    realmId: s.realmId ?? deps.realmId,
+    userId: s.userId ?? null,
+    clientAppId: s.clientAppId ?? null,
+    clientId: s.clientId ?? deps.clientId,
+    credentialClass: s.credentialClass ?? null,
+    permissions: s.permissions ?? [],
+    scopes: s.scopes ?? []
+  };
+}
+function normalizeAgreements(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.map((a) => {
+    const o = a ?? {};
+    return {
+      agreementType: String(o["agreementType"] ?? o["agreement_type"] ?? ""),
+      versionId: String(o["versionId"] ?? o["version_id"] ?? ""),
+      // Display passthrough for host apps that render the consent list.
+      ...a && typeof a === "object" ? { raw: o } : {}
+    };
+  });
+}
+function filterSecondFactors(arr) {
+  return arr.filter((f) => f === "totp" || f === "passkey");
+}
+function toLoginResult(body, deps) {
+  const b = body ?? null;
+  if (b && typeof b["accessToken"] === "string") {
+    applyTokens(b, deps);
+    const session = sessionFromLoginSuccess(deps);
+    deps.session.emit({ type: "authenticated", session });
+    return { kind: "success", session };
+  }
+  if (b && b["consentRequired"] === true) {
+    return { kind: "consent-required", agreements: normalizeAgreements(b["agreements"]) };
+  }
+  if (b && Array.isArray(b["secondFactors"]) && b["secondFactors"].length > 0) {
+    return {
+      kind: "requires-second-factor",
+      tempToken: String(b["tempToken"] ?? ""),
+      expiresInSeconds: Number(b["expiresInSeconds"] ?? 0),
+      secondFactors: filterSecondFactors(b["secondFactors"]),
+      userId: String(b["userId"] ?? ""),
+      realmId: String(b["realmId"] ?? deps.realmId)
+    };
+  }
+  if (b && typeof b["redirectTo"] === "string") {
+    return { kind: "oauth-redirect", redirectTo: b["redirectTo"] };
+  }
+  throw new HeraldError({ kind: "api", message: "Unrecognized login response shape." });
+}
+function createAuth(deps) {
+  const { realmId, client: client2 } = deps;
+  return {
+    async register(payload) {
+      const data = await resolveOp(
+        register({
+          client: client2,
+          path: { realmId },
+          body: {
+            clientId: deps.clientId,
+            email: payload.email,
+            password: payload.password,
+            ...payload.username ? { username: payload.username } : {},
+            ...payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {}
+          }
+        })
+      );
+      return { message: data.message, verificationRequired: data.verificationRequired };
+    },
+    async triggerVerifyEmail(payload) {
+      const data = await resolveOp(
+        verifyEmailTrigger({
+          client: client2,
+          path: { realmId },
+          body: {
+            clientId: deps.clientId,
+            email: payload.email,
+            ...payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {}
+          }
+        })
+      );
+      return { message: data.message };
+    },
+    async requestPasswordReset(payload) {
+      const data = await resolveOp(
+        resetPasswordRequest({
+          client: client2,
+          path: { realmId },
+          body: {
+            clientId: deps.clientId,
+            email: payload.email,
+            ...payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {}
+          }
+        })
+      );
+      return { message: data.message };
+    },
+    async login(payload) {
+      const body = await resolveOp(
+        login({
+          client: client2,
+          path: { realmId },
+          body: {
+            clientId: deps.clientId,
+            password: payload.password,
+            ...payload.username ? { username: payload.username } : {},
+            ...payload.email ? { email: payload.email } : {},
+            ...payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {},
+            ...payload.agreements ? { agreements: payload.agreements } : {},
+            ...payload.oauthClientId ? { oauthClientId: payload.oauthClientId } : {},
+            ...payload.redirectUri ? { redirectUri: payload.redirectUri } : {},
+            ...payload.state ? { state: payload.state } : {}
+          }
+        })
+      );
+      return toLoginResult(body, deps);
+    },
+    async verifyTotp(payload) {
+      const body = await resolveOp(
+        handleVerifyTotp({
+          client: client2,
+          path: { realmId },
+          body: {
+            tempToken: payload.tempToken,
+            ...payload.code ? { code: payload.code } : {},
+            ...payload.backupCode ? { backupCode: payload.backupCode } : {},
+            ...payload.agreements ? { agreements: payload.agreements } : {}
+          }
+        })
+      );
+      return toLoginResult(body, deps);
+    },
+    passkey: {
+      async loginBegin(payload) {
+        const data = payload.tempToken !== void 0 ? await resolveOp(
+          handlePasskey2FaOptions({
+            client: client2,
+            path: { realmId },
+            body: { tempToken: payload.tempToken }
+          })
+        ) : await resolveOp(
+          handlePasskeyOptions({
+            client: client2,
+            path: { realmId },
+            body: {
+              clientId: deps.clientId,
+              ...payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {},
+              ...payload.oauth ? { oauth: payload.oauth } : {}
+            }
+          })
+        );
+        return { authToken: data.authToken, options: data.options };
+      },
+      async loginFinish(payload) {
+        const body = await resolveOp(
+          payload.tempToken !== void 0 ? handlePasskey2FaVerify({
+            client: client2,
+            path: { realmId },
+            body: {
+              tempToken: payload.tempToken,
+              authToken: payload.authToken,
+              assertion: payload.assertion,
+              ...payload.agreements ? { agreements: payload.agreements } : {}
+            }
+          }) : handlePasskeyVerify({
+            client: client2,
+            path: { realmId },
+            body: {
+              authToken: payload.authToken,
+              assertion: payload.assertion,
+              ...payload.agreements ? { agreements: payload.agreements } : {}
+            }
+          })
+        );
+        return toLoginResult(body, deps);
+      }
+    },
+    loginWithEmailOtp: {
+      /**
+       * Send a passwordless login code. The two 409 control-flow outcomes
+       * (DEC-js-sdk-014) — `consent_required` (auto-register consent gate) and
+       * `email_not_registered` (auto-register off) — resolve as
+       * `{ kind: 'conflict' }` instead of throwing, mirroring the multi-branch
+       * normalization `login()` applies to its 200 bodies. All other HTTP
+       * failures throw `HeraldError`.
+       */
+      async send(payload) {
+        const { data, error, response } = await send({
+          client: client2,
+          path: { realmId },
+          body: {
+            clientId: deps.clientId,
+            email: payload.email,
+            ...payload.turnstileToken ? { turnstileToken: payload.turnstileToken } : {},
+            ...payload.agreements ? { agreements: payload.agreements } : {}
+          }
+        });
+        if (data) {
+          return { kind: "sent", message: data.message, expiresInSeconds: data.expiresInSeconds };
+        }
+        const body = error ?? {};
+        const code = body["code"];
+        if (response?.status === 409 && (code === "consent_required" || code === "email_not_registered")) {
+          return {
+            kind: "conflict",
+            code: String(code),
+            message: String(body["message"] ?? ""),
+            consentRequired: body["consentRequired"] === true,
+            agreements: normalizeAgreements(body["agreements"])
+          };
+        }
+        throw toHeraldError(error, response);
+      },
+      async verify(payload) {
+        const body = await resolveOp(
+          verify({
+            client: client2,
+            path: { realmId },
+            body: {
+              clientId: deps.clientId,
+              email: payload.email,
+              code: payload.code,
+              ...payload.agreements ? { agreements: payload.agreements } : {}
+            }
+          })
+        );
+        return toLoginResult(body, deps);
+      }
+    },
+    async getStatus() {
+      const data = await resolveOp(status({ client: client2 }));
+      deps.session.emit({ type: "authenticated", session: sessionFromStatus(data, deps) });
+      return data;
+    },
+    /**
+     * Explicitly refresh the Bearer token family (startup restore, proactive
+     * refresh). Single-flight: concurrent calls share one HTTP request with the
+     * 401 auto-refresh interceptor. On success both the in-memory access token
+     * and the stored refresh token are rotated.
+     *
+     * @throws {HeraldError} `kind: 'session-expired'` when no refresh token is
+     *   stored or the refresh failed (reuse / expiry / family revocation); a
+     *   `session-expired` event is emitted either way.
+     */
+    async refresh() {
+      const tokens = await deps.refreshTokens();
+      if (!tokens) {
+        throw new HeraldError({
+          kind: "session-expired",
+          message: "Session refresh failed; sign in again."
+        });
+      }
+      return tokens;
+    },
+    async logout() {
+      const data = await resolveOp(logout({ client: client2 }));
+      deps.accessTokenHolder.clear();
+      deps.storage.setRefreshToken(null);
+      deps.session.emit({ type: "logged-out" });
+      return { message: data?.message ?? "Logged out" };
+    }
+  };
+}
+
+// src/session.ts
+function createAccessTokenHolder() {
+  let token = null;
+  return {
+    get: () => token,
+    set: (t) => {
+      token = t;
+    },
+    clear: () => {
+      token = null;
+    }
+  };
+}
+var UNAUTHENTICATED_SESSION = {
+  authenticated: false,
+  realmId: null,
+  userId: null,
+  clientAppId: null,
+  clientId: null,
+  credentialClass: null,
+  permissions: [],
+  scopes: []
+};
+function createSessionStore(onChange) {
+  let session = { ...UNAUTHENTICATED_SESSION };
+  const listeners = /* @__PURE__ */ new Set();
+  return {
+    getSession: () => session,
+    setSession: (s) => {
+      session = s ?? { ...UNAUTHENTICATED_SESSION };
+    },
+    subscribe: (fn) => {
+      listeners.add(fn);
+      return () => {
+        listeners.delete(fn);
+      };
+    },
+    emit: (event) => {
+      if (event.type === "authenticated") {
+        session = event.session;
+      } else if (event.type === "session-expired" || event.type === "logged-out") {
+        session = { ...UNAUTHENTICATED_SESSION };
+      }
+      for (const fn of listeners) {
+        fn(event);
+      }
+      onChange?.(event);
+    }
+  };
+}
+
+// src/storage.ts
+function memoryStorage() {
+  let token = null;
+  return {
+    getRefreshToken: () => token,
+    setRefreshToken: (t) => {
+      token = t;
+    }
+  };
+}
+function localStorageStorage(key) {
+  if (typeof localStorage === "undefined" || localStorage === null) {
+    throw new HeraldError({
+      kind: "ssr-no-storage",
+      message: "localStorage is unavailable in this environment. Inject a TokenStorage adapter via `storage`, or use memoryStorage()."
+    });
+  }
+  return {
+    getRefreshToken: () => localStorage.getItem(key),
+    setRefreshToken: (t) => {
+      if (t === null) {
+        localStorage.removeItem(key);
+      } else {
+        localStorage.setItem(key, t);
+      }
+    }
+  };
+}
+
+// src/config.ts
+function createHeraldClient(config) {
+  const hasLocalStorage = typeof localStorage !== "undefined" && localStorage !== null;
+  let storage = config.storage;
+  if (!storage) {
+    if (!hasLocalStorage) {
+      throw new HeraldError({
+        kind: "ssr-no-storage",
+        message: "No TokenStorage adapter was provided and localStorage is unavailable (SSR/Node). Inject a `storage` adapter or use memoryStorage()."
+      });
+    }
+    storage = localStorageStorage(config.storageKey ?? "herald.refreshToken");
+  }
+  const accessTokenHolder = createAccessTokenHolder();
+  const session = createSessionStore(config.onSessionChange);
+  const transport = createTransport({
+    baseUrl: config.baseUrl,
+    accessTokenHolder,
+    storage,
+    session
+  });
+  const authDeps = {
+    realmId: config.realmId,
+    clientId: config.clientId,
+    client: transport.client,
+    accessTokenHolder,
+    storage,
+    session,
+    refreshTokens: transport.refreshTokens
+  };
+  const auth = createAuth(authDeps);
+  return {
+    ...auth,
+    storage,
+    session: {
+      getSession: () => session.getSession(),
+      subscribe: (listener) => session.subscribe(listener)
+    },
+    tokens: {
+      getAccessToken: () => accessTokenHolder.get(),
+      setTokens: (tokens) => {
+        accessTokenHolder.set(tokens.accessToken);
+        storage.setRefreshToken(tokens.refreshToken);
+        if (tokens.clientId !== void 0) {
+          authDeps.clientId = tokens.clientId;
+        }
+      },
+      clear: () => {
+        accessTokenHolder.clear();
+        storage.setRefreshToken(null);
+      },
+      bindClientId: (clientId) => {
+        authDeps.clientId = clientId;
+      }
+    }
+  };
+}
+
+// src/webauthn.ts
+function base64urlToBuffer(input) {
+  const b64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "===".slice((b64.length + 3) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes.buffer;
+}
+function bufferToBase64url(buffer) {
+  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 1) {
+    binary += String.fromCharCode(bytes[i] ?? 0);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/[=]/g, "");
+}
+async function performPasskeyAssertion(options) {
+  if (typeof navigator === "undefined" || !navigator.credentials?.get) {
+    throw new Error("WebAuthn (navigator.credentials.get) is not available in this environment.");
+  }
+  const publicKey = {
+    challenge: base64urlToBuffer(options.challenge),
+    ...options.rpId ? { rpId: options.rpId } : {},
+    ...options.timeout !== void 0 ? { timeout: options.timeout } : {},
+    ...options.userVerification ? { userVerification: options.userVerification } : {},
+    ...options.allowCredentials ? {
+      allowCredentials: options.allowCredentials.map((c) => ({
+        type: "public-key",
+        id: base64urlToBuffer(c.id),
+        ...c.transports ? { transports: c.transports } : {}
+      }))
+    } : {}
+  };
+  const credential = await navigator.credentials.get({ publicKey });
+  if (!credential) {
+    throw new Error("Passkey assertion returned no credential.");
+  }
+  const response = credential.response;
+  const result = {
+    id: credential.id,
+    rawId: bufferToBase64url(credential.rawId),
+    type: "public-key",
+    response: {
+      authenticatorData: bufferToBase64url(response.authenticatorData),
+      clientDataJSON: bufferToBase64url(response.clientDataJSON),
+      signature: bufferToBase64url(response.signature),
+      ...response.userHandle ? { userHandle: bufferToBase64url(response.userHandle) } : {}
+    }
+  };
+  if (typeof credential.getClientExtensionResults === "function") {
+    result.clientExtensionResults = credential.getClientExtensionResults();
+  }
+  return result;
+}
+
+export { HeraldError, createHeraldClient, localStorageStorage, memoryStorage, performPasskeyAssertion };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map