herald-auth-web 0.6.1 → 0.6.3

package/README.md

@@ -58,8 +58,13 @@ const client = createHeraldClient({
   },
 })
 
-// Register
-await client.register({ email: 'user@example.com', password: '••••••••' })
+// Register (nickname is persisted as the user's profile row; the first-party
+// UI treats it as required, the API keeps it optional)
+await client.register({
+  email: 'user@example.com',
+  nickname: 'Ada Lovelace',
+  password: '••••••••',
+})
 
 // Email verification / password reset: the backend sends an email with a link
 // that 302-redirects to your pre-registered Client App page. The SDK only

package/dist/index.d.ts

@@ -523,7 +523,10 @@ declare function performPasskeyAssertion(options: PublicKeyCredentialRequestOpti
 interface RegisterPayload {
     email: string;
     password: string;
+    /** Deprecated: ignored by the backend. Use `nickname` instead. */
     username?: string;
+    /** Registration nickname, persisted as the user's profile row. */
+    nickname?: string;
     turnstileToken?: string;
 }
 interface TriggerVerifyEmailPayload {

package/dist/index.global.js

@@ -1,8 +1,8 @@
-"use strict";var Herald=(()=>{var K=Object.defineProperty;var je=Object.getOwnPropertyDescriptor;var Be=Object.getOwnPropertyNames;var qe=Object.prototype.hasOwnProperty;var Me=(e,t)=>{for(var s in t)K(e,s,{get:t[s],enumerable:!0})},ze=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Be(t))!qe.call(e,o)&&o!==s&&K(e,o,{get:()=>t[o],enumerable:!(r=je(t,o))||r.enumerable});return e};var Ke=e=>ze(K({},"__esModule",{value:!0}),e);var or={};Me(or,{HeraldError:()=>y,createHeraldClient:()=>Ae,localStorageStorage:()=>z,memoryStorage:()=>ke,performPasskeyAssertion:()=>Ie});var Y={bodySerializer:e=>JSON.stringify(e,(t,s)=>typeof s=="bigint"?s.toString():s)};var Z=({onRequest:e,onSseError:t,onSseEvent:s,responseTransformer:r,responseValidator:o,sseDefaultRetryDelay:n,sseMaxRetryAttempts:a,sseMaxRetryDelay:l,sseSleepFn:i,url:d,...p})=>{let m,P=i??(c=>new Promise(f=>setTimeout(f,c)));return{stream:async function*(){let c=n??3e3,f=0,b=p.signal??new AbortController().signal;for(;!b.aborted;){f++;let S=p.headers instanceof Headers?p.headers:new Headers(p.headers);m!==void 0&&S.set("Last-Event-ID",m);try{let C={redirect:"follow",...p,body:p.serializedBody,headers:S,signal:b},w=new Request(d,C);e&&(w=await e(d,C));let h=await(p.fetch??globalThis.fetch)(w);if(!h.ok)throw new Error(`SSE failed: ${h.status} ${h.statusText}`);if(!h.body)throw new Error("No body in SSE response");let E=h.body.pipeThrough(new TextDecoderStream).getReader(),k="",_=()=>{try{E.cancel()}catch{}};b.addEventListener("abort",_);try{for(;;){let{done:Ge,value:He}=await E.read();if(Ge)break;k+=He,k=k.replace(/\r\n/g,`
+"use strict";var Herald=(()=>{var K=Object.defineProperty;var je=Object.getOwnPropertyDescriptor;var Be=Object.getOwnPropertyNames;var qe=Object.prototype.hasOwnProperty;var Me=(e,t)=>{for(var s in t)K(e,s,{get:t[s],enumerable:!0})},ze=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Be(t))!qe.call(e,o)&&o!==s&&K(e,o,{get:()=>t[o],enumerable:!(r=je(t,o))||r.enumerable});return e};var Ke=e=>ze(K({},"__esModule",{value:!0}),e);var or={};Me(or,{HeraldError:()=>y,createHeraldClient:()=>Ae,localStorageStorage:()=>z,memoryStorage:()=>ke,performPasskeyAssertion:()=>Ie});var Y={bodySerializer:e=>JSON.stringify(e,(t,s)=>typeof s=="bigint"?s.toString():s)};var Z=({onRequest:e,onSseError:t,onSseEvent:s,responseTransformer:r,responseValidator:o,sseDefaultRetryDelay:n,sseMaxRetryAttempts:a,sseMaxRetryDelay:l,sseSleepFn:i,url:d,...p})=>{let m,S=i??(c=>new Promise(f=>setTimeout(f,c)));return{stream:async function*(){let c=n??3e3,f=0,b=p.signal??new AbortController().signal;for(;!b.aborted;){f++;let P=p.headers instanceof Headers?p.headers:new Headers(p.headers);m!==void 0&&P.set("Last-Event-ID",m);try{let C={redirect:"follow",...p,body:p.serializedBody,headers:P,signal:b},w=new Request(d,C);e&&(w=await e(d,C));let h=await(p.fetch??globalThis.fetch)(w);if(!h.ok)throw new Error(`SSE failed: ${h.status} ${h.statusText}`);if(!h.body)throw new Error("No body in SSE response");let E=h.body.pipeThrough(new TextDecoderStream).getReader(),k="",_=()=>{try{E.cancel()}catch{}};b.addEventListener("abort",_);try{for(;;){let{done:Ge,value:He}=await E.read();if(Ge)break;k+=He,k=k.replace(/\r\n/g,`
 `).replace(/\r/g,`
 `);let $=k.split(`
 
 `);k=$.pop()??"";for(let Ue of $){let Le=Ue.split(`
 `),L=[],J;for(let R of Le)if(R.startsWith("data:"))L.push(R.replace(/^data:\s*/,""));else if(R.startsWith("event:"))J=R.replace(/^event:\s*/,"");else if(R.startsWith("id:"))m=R.replace(/^id:\s*/,"");else if(R.startsWith("retry:")){let Q=Number.parseInt(R.replace(/^retry:\s*/,""),10);Number.isNaN(Q)||(c=Q)}let D,X=!1;if(L.length){let R=L.join(`
-`);try{D=JSON.parse(R),X=!0}catch{D=R}}X&&(o&&await o(D),r&&(D=await r(D))),s?.({data:D,event:J,id:m,retry:c}),L.length&&(yield D)}}}finally{b.removeEventListener("abort",_),E.releaseLock()}break}catch(C){if(t?.(C),a!==void 0&&f>=a)break;let w=Math.min(c*2**(f-1),l??3e4);await P(w)}}}()}};var We=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},Fe=e=>{switch(e){case"form":return",";case"pipeDelimited":return"|";case"spaceDelimited":return"%20";default:return","}},Ve=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},j=({allowReserved:e,explode:t,name:s,style:r,value:o})=>{if(!t){let l=(e?o:o.map(i=>encodeURIComponent(i))).join(Fe(r));switch(r){case"label":return`.${l}`;case"matrix":return`;${s}=${l}`;case"simple":return l;default:return`${s}=${l}`}}let n=We(r),a=o.map(l=>r==="label"||r==="simple"?e?l:encodeURIComponent(l):x({allowReserved:e,name:s,value:l})).join(n);return r==="label"||r==="matrix"?n+a:a},x=({allowReserved:e,name:t,value:s})=>{if(s==null)return"";if(typeof s=="object")throw new Error("Deeply-nested arrays/objects aren\u2019t supported. Provide your own `querySerializer()` to handle these.");return`${t}=${e?s:encodeURIComponent(s)}`},B=({allowReserved:e,explode:t,name:s,style:r,value:o,valueOnly:n})=>{if(o instanceof Date)return n?o.toISOString():`${s}=${o.toISOString()}`;if(r!=="deepObject"&&!t){let i=[];Object.entries(o).forEach(([p,m])=>{i=[...i,p,e?m:encodeURIComponent(m)]});let d=i.join(",");switch(r){case"form":return`${s}=${d}`;case"label":return`.${d}`;case"matrix":return`;${s}=${d}`;default:return d}}let a=Ve(r),l=Object.entries(o).map(([i,d])=>x({allowReserved:e,name:r==="deepObject"?`${s}[${i}]`:i,value:d})).join(a);return r==="label"||r==="matrix"?a+l:l};var Ne=/\{[^{}]+\}/g,_e=({path:e,url:t})=>{let s=t,r=t.match(Ne);if(r)for(let o of r){let n=!1,a=o.substring(1,o.length-1),l="simple";a.endsWith("*")&&(n=!0,a=a.substring(0,a.length-1)),a.startsWith(".")?(a=a.substring(1),l="label"):a.startsWith(";")&&(a=a.substring(1),l="matrix");let i=e[a];if(i==null)continue;if(Array.isArray(i)){s=s.replace(o,j({explode:n,name:a,style:l,value:i}));continue}if(typeof i=="object"){s=s.replace(o,B({explode:n,name:a,style:l,value:i,valueOnly:!0}));continue}if(l==="matrix"){s=s.replace(o,`;${x({name:a,value:i})}`);continue}let d=encodeURIComponent(l==="label"?`.${i}`:i);s=s.replace(o,d)}return s},ee=({baseUrl:e,path:t,query:s,querySerializer:r,url:o})=>{let n=o.startsWith("/")?o:`/${o}`,a=(e??"")+n;t&&(a=_e({path:t,url:a}));let l=s?r(s):"";return l.startsWith("?")&&(l=l.substring(1)),l&&(a+=`?${l}`),a};function W(e){let t=e.body!==void 0;if(t&&e.bodySerializer)return"serializedBody"in e?e.serializedBody!==void 0&&e.serializedBody!==""?e.serializedBody:null:e.body!==""?e.body:null;if(t)return e.body}var re=async(e,t)=>{let s=typeof t=="function"?await t(e):t;if(s)return e.scheme==="bearer"?`Bearer ${s}`:e.scheme==="basic"?`Basic ${btoa(s)}`:s};var te=({parameters:e={},...t}={})=>r=>{let o=[];if(r&&typeof r=="object")for(let n in r){let a=r[n];if(a==null)continue;let l=e[n]||t;if(Array.isArray(a)){let i=j({allowReserved:l.allowReserved,explode:!0,name:n,style:"form",value:a,...l.array});i&&o.push(i)}else if(typeof a=="object"){let i=B({allowReserved:l.allowReserved,explode:!0,name:n,style:"deepObject",value:a,...l.object});i&&o.push(i)}else{let i=x({allowReserved:l.allowReserved,name:n,value:a});i&&o.push(i)}}return o.join("&")},se=e=>{if(!e)return"stream";let t=e.split(";")[0]?.trim();if(t){if(t.startsWith("application/json")||t.endsWith("+json"))return"json";if(t==="multipart/form-data")return"formData";if(["application/","audio/","image/","video/"].some(s=>t.startsWith(s)))return"blob";if(t.startsWith("text/"))return"text"}},$e=(e,t)=>t?!!(e.headers.has(t)||e.query?.[t]||e.headers.get("Cookie")?.includes(`${t}=`)):!1,oe=async({security:e,...t})=>{for(let s of e){if($e(t,s.name))continue;let r=await re(s,t.auth);if(!r)continue;let o=s.name??"Authorization";switch(s.in){case"query":t.query||(t.query={}),t.query[o]=r;break;case"cookie":t.headers.append("Cookie",`${o}=${r}`);break;default:t.headers.set(o,r);break}}},F=e=>ee({baseUrl:e.baseUrl,path:e.path,query:e.query,querySerializer:typeof e.querySerializer=="function"?e.querySerializer:te(e.querySerializer),url:e.url}),V=(e,t)=>{let s={...e,...t};return s.baseUrl?.endsWith("/")&&(s.baseUrl=s.baseUrl.substring(0,s.baseUrl.length-1)),s.headers=q(e.headers,t.headers),s},Je=e=>{let t=[];return e.forEach((s,r)=>{t.push([r,s])}),t},q=(...e)=>{let t=new Headers;for(let s of e){if(!s)continue;let r=s instanceof Headers?Je(s):Object.entries(s);for(let[o,n]of r)if(n===null)t.delete(o);else if(Array.isArray(n))for(let a of n)t.append(o,a);else n!==void 0&&t.set(o,typeof n=="object"?JSON.stringify(n):n)}return t},A=class{constructor(){this.fns=[]}clear(){this.fns=[]}eject(t){let s=this.getInterceptorIndex(t);this.fns[s]&&(this.fns[s]=null)}exists(t){let s=this.getInterceptorIndex(t);return!!this.fns[s]}getInterceptorIndex(t){return typeof t=="number"?this.fns[t]?t:-1:this.fns.indexOf(t)}update(t,s){let r=this.getInterceptorIndex(t);return this.fns[r]?(this.fns[r]=s,t):!1}use(t){return this.fns.push(t),this.fns.length-1}},ne=()=>({error:new A,request:new A,response:new A}),Xe=te({allowReserved:!1,array:{explode:!0,style:"form"},object:{explode:!0,style:"deepObject"}}),Qe={"Content-Type":"application/json"},v=(e={})=>({...Y,headers:Qe,parseAs:"auto",querySerializer:Xe,...e});var I=(e={})=>{let t=V(v(),e),s=()=>({...t}),r=d=>(t=V(t,d),s()),o=ne(),n=async d=>{let p={...t,...d,fetch:d.fetch??t.fetch??globalThis.fetch,headers:q(t.headers,d.headers),serializedBody:void 0};p.security&&await oe({...p,security:p.security}),p.requestValidator&&await p.requestValidator(p),p.body!==void 0&&p.bodySerializer&&(p.serializedBody=p.bodySerializer(p.body)),(p.body===void 0||p.serializedBody==="")&&p.headers.delete("Content-Type");let m=F(p);return{opts:p,url:m}},a=async d=>{let{opts:p,url:m}=await n(d),P={redirect:"follow",...p,body:W(p)},g=new Request(m,P);for(let u of o.request.fns)u&&(g=await u(g,p));let U=p.fetch,c;try{c=await U(g)}catch(u){let h=u;for(let E of o.error.fns)E&&(h=await E(u,void 0,g,p));if(h=h||{},p.throwOnError)throw h;return p.responseStyle==="data"?void 0:{error:h,request:g,response:void 0}}for(let u of o.response.fns)u&&(c=await u(c,g,p));let f={request:g,response:c};if(c.ok){let u=(p.parseAs==="auto"?se(c.headers.get("Content-Type")):p.parseAs)??"json";if(c.status===204||c.headers.get("Content-Length")==="0"){let E;switch(u){case"arrayBuffer":case"blob":case"text":E=await c[u]();break;case"formData":E=new FormData;break;case"stream":E=c.body;break;default:E={};break}return p.responseStyle==="data"?E:{data:E,...f}}let h;switch(u){case"arrayBuffer":case"blob":case"formData":case"text":h=await c[u]();break;case"json":{let E=await c.text();h=E?JSON.parse(E):{};break}case"stream":return p.responseStyle==="data"?c.body:{data:c.body,...f}}return u==="json"&&(p.responseValidator&&await p.responseValidator(h),p.responseTransformer&&(h=await p.responseTransformer(h))),p.responseStyle==="data"?h:{data:h,...f}}let b=await c.text(),S;try{S=JSON.parse(b)}catch{}let C=S??b,w=C;for(let u of o.error.fns)u&&(w=await u(C,c,g,p));if(w=w||{},p.throwOnError)throw w;return p.responseStyle==="data"?void 0:{error:w,...f}},l=d=>p=>a({...p,method:d}),i=d=>async p=>{let{opts:m,url:P}=await n(p);return Z({...m,body:m.body,headers:m.headers,method:d,onRequest:async(g,U)=>{let c=new Request(g,U);for(let f of o.request.fns)f&&(c=await f(c,m));return c},serializedBody:W(m),url:P})};return{buildUrl:F,connect:l("CONNECT"),delete:l("DELETE"),get:l("GET"),getConfig:s,head:l("HEAD"),interceptors:o,options:l("OPTIONS"),patch:l("PATCH"),post:l("POST"),put:l("PUT"),request:a,setConfig:r,sse:{connect:i("CONNECT"),delete:i("DELETE"),get:i("GET"),head:i("HEAD"),options:i("OPTIONS"),patch:i("PATCH"),post:i("POST"),put:i("PUT"),trace:i("TRACE")},trace:l("TRACE")}};var O=I(v());var ae=e=>(e.client??O).post({url:"/api/auth/browser-token/refresh",...e,headers:{"Content-Type":"application/json",...e.headers}});var ie=e=>(e?.client??O).post({security:[{scheme:"bearer",type:"http"}],url:"/api/auth/logout",...e}),le=e=>(e?.client??O).get({security:[{scheme:"bearer",type:"http"}],url:"/api/auth/status",...e});var pe=e=>(e.client??O).post({url:"/api/auth/{realmId}/login",...e,headers:{"Content-Type":"application/json",...e.headers}}),ce=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/email-otp/send",...e,headers:{"Content-Type":"application/json",...e.headers}}),de=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/email-otp/verify",...e,headers:{"Content-Type":"application/json",...e.headers}}),he=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/ldap",...e,headers:{"Content-Type":"application/json",...e.headers}}),ue=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/passkey/2fa/options",...e,headers:{"Content-Type":"application/json",...e.headers}}),me=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/passkey/2fa/verify",...e,headers:{"Content-Type":"application/json",...e.headers}}),Ee=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/passkey/options",...e,headers:{"Content-Type":"application/json",...e.headers}}),Oe=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/passkey/verify",...e,headers:{"Content-Type":"application/json",...e.headers}}),fe=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/verify-totp",...e,headers:{"Content-Type":"application/json",...e.headers}});var ye=e=>(e.client??O).post({url:"/api/auth/{realmId}/register",...e,headers:{"Content-Type":"application/json",...e.headers}});var Te=e=>(e.client??O).post({url:"/api/auth/{realmId}/reset_password/request",...e,headers:{"Content-Type":"application/json",...e.headers}});var ge=e=>(e.client??O).post({url:"/api/auth/{realmId}/verify_email/trigger",...e,headers:{"Content-Type":"application/json",...e.headers}});var y=class extends Error{constructor(t){super(t.message??t.kind),this.name="HeraldError",this.kind=t.kind,this.status=t.status,this.code=t.code,this.requestId=t.requestId,this.details=t.details}};function Ye(e){switch(e){case 400:return"validation";case 401:return"unauthorized";case 403:return"forbidden";case 404:return"not-found";case 429:return"rate-limited";default:return"api"}}function M(e,t){if(!t)return new y({kind:"network",message:"Network request failed. For cross-origin integrations, ensure the page origin is pre-registered on the Client App (allowed_origins).",details:e});let s=e??{};return new y({kind:Ye(t.status),status:t.status,message:s.message??s.error??`HTTP ${t.status}`,code:s.code,requestId:s.requestId??void 0,details:s.details})}var Re="X-Herald-Refresh-Retried",we="/api/auth/browser-token/refresh";function be(e,t){let s=t.storage.getRefreshToken();if(!s)return t.session.emit({type:"session-expired",reason:"refresh-failed"}),Promise.resolve(null);let r=e.__heraldRefresh;if(r)return r;let o=(async()=>{try{let{data:n,error:a}=await ae({client:e,body:{refreshToken:s}});return a||!n?(t.session.emit({type:"session-expired",reason:"family-revoked"}),null):(t.accessTokenHolder.set(n.accessToken),t.storage.setRefreshToken(n.refreshToken),n)}catch{return t.session.emit({type:"session-expired",reason:"refresh-failed"}),null}finally{e.__heraldRefresh=null}})();return e.__heraldRefresh=o,o}async function Ze(e,t){let s=await e.request(t);if(!s.response)return new Response(null,{status:401});let r=new Headers(s.response.headers),o=s.data!==void 0?s.data:s.error,n=o!=null?JSON.stringify(o):null;return new Response(n,{status:s.response.status,headers:r})}function Ce(e){let t=I({baseUrl:e.baseUrl});return t.interceptors.request.use((s,r)=>{if(r.url===we)return s;let o=e.accessTokenHolder.get();if(!o)return s;let n=new Headers(s.headers);return n.has("Authorization")||n.set("Authorization",`Bearer ${o}`),new Request(s,{headers:n})}),t.interceptors.response.use(async(s,r,o)=>{if(s.status!==401||o.url===we||r.headers.get(Re)||!(await be(t,e)!==null))return s;let a={...o},l=new Headers(a.headers??void 0);return l.set(Re,"1"),a.headers=l,Ze(t,a)}),{client:t,refreshTokens:()=>be(t,e)}}async function T(e){let{data:t,error:s,response:r}=await e;if(t===void 0)throw M(s,r);return t}function er(e,t){t.accessTokenHolder.set(e.accessToken),t.storage.setRefreshToken(e.refreshToken)}function rr(e){return{authenticated:!0,realmId:e.realmId,userId:null,clientAppId:null,clientId:e.clientId,credentialClass:"custom_user_ui",permissions:[],scopes:[]}}function tr(e,t){return{authenticated:e.authenticated,realmId:e.realmId??t.realmId,userId:e.userId??null,clientAppId:e.clientAppId??null,clientId:e.clientId??t.clientId,credentialClass:e.credentialClass??null,permissions:e.permissions??[],scopes:e.scopes??[]}}function De(e){return Array.isArray(e)?e.map(t=>{let s=t??{};return{agreementType:String(s.agreementType??s.agreement_type??""),versionId:String(s.versionId??s.version_id??""),...t&&typeof t=="object"?{raw:s}:{}}}):[]}function sr(e){return e.filter(t=>t==="totp"||t==="passkey")}function G(e,t){let s=e??null;if(s&&typeof s.accessToken=="string"){er(s,t);let r=rr(t);return t.session.emit({type:"authenticated",session:r}),{kind:"success",session:r}}if(s&&s.consentRequired===!0)return{kind:"consent-required",agreements:De(s.agreements)};if(s&&Array.isArray(s.secondFactors)&&s.secondFactors.length>0)return{kind:"requires-second-factor",tempToken:String(s.tempToken??""),expiresInSeconds:Number(s.expiresInSeconds??0),secondFactors:sr(s.secondFactors),userId:String(s.userId??""),realmId:String(s.realmId??t.realmId)};if(s&&typeof s.redirectTo=="string")return{kind:"oauth-redirect",redirectTo:s.redirectTo};throw new y({kind:"api",message:"Unrecognized login response shape."})}function xe(e){let{realmId:t,client:s}=e;return{async register(r){let o=await T(ye({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,password:r.password,...r.username?{username:r.username}:{},...r.turnstileToken?{turnstileToken:r.turnstileToken}:{}}}));return{message:o.message,verificationRequired:o.verificationRequired}},async triggerVerifyEmail(r){return{message:(await T(ge({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{}}}))).message}},async requestPasswordReset(r){return{message:(await T(Te({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{}}}))).message}},async login(r){let o=await T(pe({client:s,path:{realmId:t},body:{clientId:e.clientId,password:r.password,...r.username?{username:r.username}:{},...r.email?{email:r.email}:{},...r.turnstileToken?{turnstileToken:r.turnstileToken}:{},...r.agreements?{agreements:r.agreements}:{},...r.oauthClientId?{oauthClientId:r.oauthClientId}:{},...r.redirectUri?{redirectUri:r.redirectUri}:{},...r.state?{state:r.state}:{}}}));return G(o,e)},async loginWithLdap(r){let o=await T(he({client:s,path:{realmId:t},body:{clientId:e.clientId,username:r.username,password:r.password,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{},...r.agreements?{agreements:r.agreements}:{},...r.oauthClientId?{oauthClientId:r.oauthClientId}:{},...r.redirectUri?{redirectUri:r.redirectUri}:{},...r.state?{state:r.state}:{}}}));return G(o,e)},async verifyTotp(r){let o=await T(fe({client:s,path:{realmId:t},body:{tempToken:r.tempToken,...r.code?{code:r.code}:{},...r.backupCode?{backupCode:r.backupCode}:{},...r.agreements?{agreements:r.agreements}:{}}}));return G(o,e)},passkey:{async loginBegin(r){let o=r.tempToken!==void 0?await T(ue({client:s,path:{realmId:t},body:{tempToken:r.tempToken}})):await T(Ee({client:s,path:{realmId:t},body:{clientId:e.clientId,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{},...r.oauth?{oauth:r.oauth}:{}}}));return{authToken:o.authToken,options:o.options}},async loginFinish(r){let o=await T(r.tempToken!==void 0?me({client:s,path:{realmId:t},body:{tempToken:r.tempToken,authToken:r.authToken,assertion:r.assertion,...r.agreements?{agreements:r.agreements}:{}}}):Oe({client:s,path:{realmId:t},body:{authToken:r.authToken,assertion:r.assertion,...r.agreements?{agreements:r.agreements}:{}}}));return G(o,e)}},loginWithEmailOtp:{async send(r){let{data:o,error:n,response:a}=await ce({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{},...r.agreements?{agreements:r.agreements}:{}}});if(o)return{kind:"sent",message:o.message,expiresInSeconds:o.expiresInSeconds};let l=n??{},i=l.code;if(a?.status===409&&(i==="consent_required"||i==="email_not_registered"))return{kind:"conflict",code:String(i),message:String(l.message??""),consentRequired:l.consentRequired===!0,agreements:De(l.agreements)};throw M(n,a)},async verify(r){let o=await T(de({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,code:r.code,...r.agreements?{agreements:r.agreements}:{}}}));return G(o,e)}},async getStatus(){let r=await T(le({client:s}));return e.session.emit({type:"authenticated",session:tr(r,e)}),r},async refresh(){let r=await e.refreshTokens();if(!r)throw new y({kind:"session-expired",message:"Session refresh failed; sign in again."});return r},async logout(){let r=await T(ie({client:s}));return e.accessTokenHolder.clear(),e.storage.setRefreshToken(null),e.session.emit({type:"logged-out"}),{message:r?.message??"Logged out"}}}}function Pe(){let e=null;return{get:()=>e,set:t=>{e=t},clear:()=>{e=null}}}var N={authenticated:!1,realmId:null,userId:null,clientAppId:null,clientId:null,credentialClass:null,permissions:[],scopes:[]};function Se(e){let t={...N},s=new Set;return{getSession:()=>t,setSession:r=>{t=r??{...N}},subscribe:r=>(s.add(r),()=>{s.delete(r)}),emit:r=>{r.type==="authenticated"?t=r.session:(r.type==="session-expired"||r.type==="logged-out")&&(t={...N});for(let o of s)o(r);e?.(r)}}}function ke(){let e=null;return{getRefreshToken:()=>e,setRefreshToken:t=>{e=t}}}function z(e){if(typeof localStorage>"u"||localStorage===null)throw new y({kind:"ssr-no-storage",message:"localStorage is unavailable in this environment. Inject a TokenStorage adapter via `storage`, or use memoryStorage()."});return{getRefreshToken:()=>localStorage.getItem(e),setRefreshToken:t=>{t===null?localStorage.removeItem(e):localStorage.setItem(e,t)}}}function Ae(e){let t=typeof localStorage<"u"&&localStorage!==null,s=e.storage;if(!s){if(!t)throw new y({kind:"ssr-no-storage",message:"No TokenStorage adapter was provided and localStorage is unavailable (SSR/Node). Inject a `storage` adapter or use memoryStorage()."});s=z(e.storageKey??"herald.refreshToken")}let r=Pe(),o=Se(e.onSessionChange),n=Ce({baseUrl:e.baseUrl,accessTokenHolder:r,storage:s,session:o}),a={realmId:e.realmId,clientId:e.clientId,client:n.client,accessTokenHolder:r,storage:s,session:o,refreshTokens:n.refreshTokens};return{...xe(a),storage:s,session:{getSession:()=>o.getSession(),subscribe:i=>o.subscribe(i)},tokens:{getAccessToken:()=>r.get(),setTokens:i=>{r.set(i.accessToken),s.setRefreshToken(i.refreshToken),i.clientId!==void 0&&(a.clientId=i.clientId)},clear:()=>{r.clear(),s.setRefreshToken(null)},bindClientId:i=>{a.clientId=i}}}}function ve(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),s=t+"===".slice((t.length+3)%4),r=atob(s),o=new Uint8Array(r.length);for(let n=0;n<r.length;n+=1)o[n]=r.charCodeAt(n);return o.buffer}function H(e){let t=e instanceof Uint8Array?e:new Uint8Array(e),s="";for(let r=0;r<t.length;r+=1)s+=String.fromCharCode(t[r]??0);return btoa(s).replace(/\+/g,"-").replace(/\//g,"_").replace(/[=]/g,"")}async function Ie(e){if(typeof navigator>"u"||!navigator.credentials?.get)throw new Error("WebAuthn (navigator.credentials.get) is not available in this environment.");let t={challenge:ve(e.challenge),...e.rpId?{rpId:e.rpId}:{},...e.timeout!==void 0?{timeout:e.timeout}:{},...e.userVerification?{userVerification:e.userVerification}:{},...e.allowCredentials?{allowCredentials:e.allowCredentials.map(n=>({type:"public-key",id:ve(n.id),...n.transports?{transports:n.transports}:{}}))}:{}},s=await navigator.credentials.get({publicKey:t});if(!s)throw new Error("Passkey assertion returned no credential.");let r=s.response,o={id:s.id,rawId:H(s.rawId),type:"public-key",response:{authenticatorData:H(r.authenticatorData),clientDataJSON:H(r.clientDataJSON),signature:H(r.signature),...r.userHandle?{userHandle:H(r.userHandle)}:{}}};return typeof s.getClientExtensionResults=="function"&&(o.clientExtensionResults=s.getClientExtensionResults()),o}return Ke(or);})();
+`);try{D=JSON.parse(R),X=!0}catch{D=R}}X&&(o&&await o(D),r&&(D=await r(D))),s?.({data:D,event:J,id:m,retry:c}),L.length&&(yield D)}}}finally{b.removeEventListener("abort",_),E.releaseLock()}break}catch(C){if(t?.(C),a!==void 0&&f>=a)break;let w=Math.min(c*2**(f-1),l??3e4);await S(w)}}}()}};var We=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},Fe=e=>{switch(e){case"form":return",";case"pipeDelimited":return"|";case"spaceDelimited":return"%20";default:return","}},Ve=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},j=({allowReserved:e,explode:t,name:s,style:r,value:o})=>{if(!t){let l=(e?o:o.map(i=>encodeURIComponent(i))).join(Fe(r));switch(r){case"label":return`.${l}`;case"matrix":return`;${s}=${l}`;case"simple":return l;default:return`${s}=${l}`}}let n=We(r),a=o.map(l=>r==="label"||r==="simple"?e?l:encodeURIComponent(l):x({allowReserved:e,name:s,value:l})).join(n);return r==="label"||r==="matrix"?n+a:a},x=({allowReserved:e,name:t,value:s})=>{if(s==null)return"";if(typeof s=="object")throw new Error("Deeply-nested arrays/objects aren\u2019t supported. Provide your own `querySerializer()` to handle these.");return`${t}=${e?s:encodeURIComponent(s)}`},B=({allowReserved:e,explode:t,name:s,style:r,value:o,valueOnly:n})=>{if(o instanceof Date)return n?o.toISOString():`${s}=${o.toISOString()}`;if(r!=="deepObject"&&!t){let i=[];Object.entries(o).forEach(([p,m])=>{i=[...i,p,e?m:encodeURIComponent(m)]});let d=i.join(",");switch(r){case"form":return`${s}=${d}`;case"label":return`.${d}`;case"matrix":return`;${s}=${d}`;default:return d}}let a=Ve(r),l=Object.entries(o).map(([i,d])=>x({allowReserved:e,name:r==="deepObject"?`${s}[${i}]`:i,value:d})).join(a);return r==="label"||r==="matrix"?a+l:l};var Ne=/\{[^{}]+\}/g,_e=({path:e,url:t})=>{let s=t,r=t.match(Ne);if(r)for(let o of r){let n=!1,a=o.substring(1,o.length-1),l="simple";a.endsWith("*")&&(n=!0,a=a.substring(0,a.length-1)),a.startsWith(".")?(a=a.substring(1),l="label"):a.startsWith(";")&&(a=a.substring(1),l="matrix");let i=e[a];if(i==null)continue;if(Array.isArray(i)){s=s.replace(o,j({explode:n,name:a,style:l,value:i}));continue}if(typeof i=="object"){s=s.replace(o,B({explode:n,name:a,style:l,value:i,valueOnly:!0}));continue}if(l==="matrix"){s=s.replace(o,`;${x({name:a,value:i})}`);continue}let d=encodeURIComponent(l==="label"?`.${i}`:i);s=s.replace(o,d)}return s},ee=({baseUrl:e,path:t,query:s,querySerializer:r,url:o})=>{let n=o.startsWith("/")?o:`/${o}`,a=(e??"")+n;t&&(a=_e({path:t,url:a}));let l=s?r(s):"";return l.startsWith("?")&&(l=l.substring(1)),l&&(a+=`?${l}`),a};function W(e){let t=e.body!==void 0;if(t&&e.bodySerializer)return"serializedBody"in e?e.serializedBody!==void 0&&e.serializedBody!==""?e.serializedBody:null:e.body!==""?e.body:null;if(t)return e.body}var re=async(e,t)=>{let s=typeof t=="function"?await t(e):t;if(s)return e.scheme==="bearer"?`Bearer ${s}`:e.scheme==="basic"?`Basic ${btoa(s)}`:s};var te=({parameters:e={},...t}={})=>r=>{let o=[];if(r&&typeof r=="object")for(let n in r){let a=r[n];if(a==null)continue;let l=e[n]||t;if(Array.isArray(a)){let i=j({allowReserved:l.allowReserved,explode:!0,name:n,style:"form",value:a,...l.array});i&&o.push(i)}else if(typeof a=="object"){let i=B({allowReserved:l.allowReserved,explode:!0,name:n,style:"deepObject",value:a,...l.object});i&&o.push(i)}else{let i=x({allowReserved:l.allowReserved,name:n,value:a});i&&o.push(i)}}return o.join("&")},se=e=>{if(!e)return"stream";let t=e.split(";")[0]?.trim();if(t){if(t.startsWith("application/json")||t.endsWith("+json"))return"json";if(t==="multipart/form-data")return"formData";if(["application/","audio/","image/","video/"].some(s=>t.startsWith(s)))return"blob";if(t.startsWith("text/"))return"text"}},$e=(e,t)=>t?!!(e.headers.has(t)||e.query?.[t]||e.headers.get("Cookie")?.includes(`${t}=`)):!1,oe=async({security:e,...t})=>{for(let s of e){if($e(t,s.name))continue;let r=await re(s,t.auth);if(!r)continue;let o=s.name??"Authorization";switch(s.in){case"query":t.query||(t.query={}),t.query[o]=r;break;case"cookie":t.headers.append("Cookie",`${o}=${r}`);break;default:t.headers.set(o,r);break}}},F=e=>ee({baseUrl:e.baseUrl,path:e.path,query:e.query,querySerializer:typeof e.querySerializer=="function"?e.querySerializer:te(e.querySerializer),url:e.url}),V=(e,t)=>{let s={...e,...t};return s.baseUrl?.endsWith("/")&&(s.baseUrl=s.baseUrl.substring(0,s.baseUrl.length-1)),s.headers=q(e.headers,t.headers),s},Je=e=>{let t=[];return e.forEach((s,r)=>{t.push([r,s])}),t},q=(...e)=>{let t=new Headers;for(let s of e){if(!s)continue;let r=s instanceof Headers?Je(s):Object.entries(s);for(let[o,n]of r)if(n===null)t.delete(o);else if(Array.isArray(n))for(let a of n)t.append(o,a);else n!==void 0&&t.set(o,typeof n=="object"?JSON.stringify(n):n)}return t},A=class{constructor(){this.fns=[]}clear(){this.fns=[]}eject(t){let s=this.getInterceptorIndex(t);this.fns[s]&&(this.fns[s]=null)}exists(t){let s=this.getInterceptorIndex(t);return!!this.fns[s]}getInterceptorIndex(t){return typeof t=="number"?this.fns[t]?t:-1:this.fns.indexOf(t)}update(t,s){let r=this.getInterceptorIndex(t);return this.fns[r]?(this.fns[r]=s,t):!1}use(t){return this.fns.push(t),this.fns.length-1}},ne=()=>({error:new A,request:new A,response:new A}),Xe=te({allowReserved:!1,array:{explode:!0,style:"form"},object:{explode:!0,style:"deepObject"}}),Qe={"Content-Type":"application/json"},v=(e={})=>({...Y,headers:Qe,parseAs:"auto",querySerializer:Xe,...e});var I=(e={})=>{let t=V(v(),e),s=()=>({...t}),r=d=>(t=V(t,d),s()),o=ne(),n=async d=>{let p={...t,...d,fetch:d.fetch??t.fetch??globalThis.fetch,headers:q(t.headers,d.headers),serializedBody:void 0};p.security&&await oe({...p,security:p.security}),p.requestValidator&&await p.requestValidator(p),p.body!==void 0&&p.bodySerializer&&(p.serializedBody=p.bodySerializer(p.body)),(p.body===void 0||p.serializedBody==="")&&p.headers.delete("Content-Type");let m=F(p);return{opts:p,url:m}},a=async d=>{let{opts:p,url:m}=await n(d),S={redirect:"follow",...p,body:W(p)},g=new Request(m,S);for(let u of o.request.fns)u&&(g=await u(g,p));let U=p.fetch,c;try{c=await U(g)}catch(u){let h=u;for(let E of o.error.fns)E&&(h=await E(u,void 0,g,p));if(h=h||{},p.throwOnError)throw h;return p.responseStyle==="data"?void 0:{error:h,request:g,response:void 0}}for(let u of o.response.fns)u&&(c=await u(c,g,p));let f={request:g,response:c};if(c.ok){let u=(p.parseAs==="auto"?se(c.headers.get("Content-Type")):p.parseAs)??"json";if(c.status===204||c.headers.get("Content-Length")==="0"){let E;switch(u){case"arrayBuffer":case"blob":case"text":E=await c[u]();break;case"formData":E=new FormData;break;case"stream":E=c.body;break;default:E={};break}return p.responseStyle==="data"?E:{data:E,...f}}let h;switch(u){case"arrayBuffer":case"blob":case"formData":case"text":h=await c[u]();break;case"json":{let E=await c.text();h=E?JSON.parse(E):{};break}case"stream":return p.responseStyle==="data"?c.body:{data:c.body,...f}}return u==="json"&&(p.responseValidator&&await p.responseValidator(h),p.responseTransformer&&(h=await p.responseTransformer(h))),p.responseStyle==="data"?h:{data:h,...f}}let b=await c.text(),P;try{P=JSON.parse(b)}catch{}let C=P??b,w=C;for(let u of o.error.fns)u&&(w=await u(C,c,g,p));if(w=w||{},p.throwOnError)throw w;return p.responseStyle==="data"?void 0:{error:w,...f}},l=d=>p=>a({...p,method:d}),i=d=>async p=>{let{opts:m,url:S}=await n(p);return Z({...m,body:m.body,headers:m.headers,method:d,onRequest:async(g,U)=>{let c=new Request(g,U);for(let f of o.request.fns)f&&(c=await f(c,m));return c},serializedBody:W(m),url:S})};return{buildUrl:F,connect:l("CONNECT"),delete:l("DELETE"),get:l("GET"),getConfig:s,head:l("HEAD"),interceptors:o,options:l("OPTIONS"),patch:l("PATCH"),post:l("POST"),put:l("PUT"),request:a,setConfig:r,sse:{connect:i("CONNECT"),delete:i("DELETE"),get:i("GET"),head:i("HEAD"),options:i("OPTIONS"),patch:i("PATCH"),post:i("POST"),put:i("PUT"),trace:i("TRACE")},trace:l("TRACE")}};var O=I(v());var ae=e=>(e.client??O).post({url:"/api/auth/browser-token/refresh",...e,headers:{"Content-Type":"application/json",...e.headers}});var ie=e=>(e?.client??O).post({security:[{scheme:"bearer",type:"http"}],url:"/api/auth/logout",...e}),le=e=>(e?.client??O).get({security:[{scheme:"bearer",type:"http"}],url:"/api/auth/status",...e});var pe=e=>(e.client??O).post({url:"/api/auth/{realmId}/login",...e,headers:{"Content-Type":"application/json",...e.headers}}),ce=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/email-otp/send",...e,headers:{"Content-Type":"application/json",...e.headers}}),de=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/email-otp/verify",...e,headers:{"Content-Type":"application/json",...e.headers}}),he=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/ldap",...e,headers:{"Content-Type":"application/json",...e.headers}}),ue=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/passkey/2fa/options",...e,headers:{"Content-Type":"application/json",...e.headers}}),me=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/passkey/2fa/verify",...e,headers:{"Content-Type":"application/json",...e.headers}}),Ee=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/passkey/options",...e,headers:{"Content-Type":"application/json",...e.headers}}),Oe=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/passkey/verify",...e,headers:{"Content-Type":"application/json",...e.headers}}),fe=e=>(e.client??O).post({url:"/api/auth/{realmId}/login/verify-totp",...e,headers:{"Content-Type":"application/json",...e.headers}});var ye=e=>(e.client??O).post({url:"/api/auth/{realmId}/register",...e,headers:{"Content-Type":"application/json",...e.headers}});var Te=e=>(e.client??O).post({url:"/api/auth/{realmId}/reset_password/request",...e,headers:{"Content-Type":"application/json",...e.headers}});var ge=e=>(e.client??O).post({url:"/api/auth/{realmId}/verify_email/trigger",...e,headers:{"Content-Type":"application/json",...e.headers}});var y=class extends Error{constructor(t){super(t.message??t.kind),this.name="HeraldError",this.kind=t.kind,this.status=t.status,this.code=t.code,this.requestId=t.requestId,this.details=t.details}};function Ye(e){switch(e){case 400:return"validation";case 401:return"unauthorized";case 403:return"forbidden";case 404:return"not-found";case 429:return"rate-limited";default:return"api"}}function M(e,t){if(!t)return new y({kind:"network",message:"Network request failed. For cross-origin integrations, ensure the page origin is pre-registered on the Client App (allowed_origins).",details:e});let s=e??{};return new y({kind:Ye(t.status),status:t.status,message:s.message??s.error??`HTTP ${t.status}`,code:s.code,requestId:s.requestId??void 0,details:s.details})}var Re="X-Herald-Refresh-Retried",we="/api/auth/browser-token/refresh";function be(e,t){let s=t.storage.getRefreshToken();if(!s)return t.session.emit({type:"session-expired",reason:"refresh-failed"}),Promise.resolve(null);let r=e.__heraldRefresh;if(r)return r;let o=(async()=>{try{let{data:n,error:a}=await ae({client:e,body:{refreshToken:s}});return a||!n?(t.session.emit({type:"session-expired",reason:"family-revoked"}),null):(t.accessTokenHolder.set(n.accessToken),t.storage.setRefreshToken(n.refreshToken),n)}catch{return t.session.emit({type:"session-expired",reason:"refresh-failed"}),null}finally{e.__heraldRefresh=null}})();return e.__heraldRefresh=o,o}async function Ze(e,t){let s=await e.request(t);if(!s.response)return new Response(null,{status:401});let r=new Headers(s.response.headers),o=s.data!==void 0?s.data:s.error,n=o!=null?JSON.stringify(o):null;return new Response(n,{status:s.response.status,headers:r})}function Ce(e){let t=I({baseUrl:e.baseUrl});return t.interceptors.request.use((s,r)=>{if(r.url===we)return s;let o=e.accessTokenHolder.get();if(!o)return s;let n=new Headers(s.headers);return n.has("Authorization")||n.set("Authorization",`Bearer ${o}`),new Request(s,{headers:n})}),t.interceptors.response.use(async(s,r,o)=>{if(s.status!==401||o.url===we||r.headers.get(Re)||!(await be(t,e)!==null))return s;let a={...o},l=new Headers(a.headers??void 0);return l.set(Re,"1"),a.headers=l,Ze(t,a)}),{client:t,refreshTokens:()=>be(t,e)}}async function T(e){let{data:t,error:s,response:r}=await e;if(t===void 0)throw M(s,r);return t}function er(e,t){t.accessTokenHolder.set(e.accessToken),t.storage.setRefreshToken(e.refreshToken)}function rr(e){return{authenticated:!0,realmId:e.realmId,userId:null,clientAppId:null,clientId:e.clientId,credentialClass:"custom_user_ui",permissions:[],scopes:[]}}function tr(e,t){return{authenticated:e.authenticated,realmId:e.realmId??t.realmId,userId:e.userId??null,clientAppId:e.clientAppId??null,clientId:e.clientId??t.clientId,credentialClass:e.credentialClass??null,permissions:e.permissions??[],scopes:e.scopes??[]}}function De(e){return Array.isArray(e)?e.map(t=>{let s=t??{};return{agreementType:String(s.agreementType??s.agreement_type??""),versionId:String(s.versionId??s.version_id??""),...t&&typeof t=="object"?{raw:s}:{}}}):[]}function sr(e){return e.filter(t=>t==="totp"||t==="passkey")}function G(e,t){let s=e??null;if(s&&typeof s.accessToken=="string"){er(s,t);let r=rr(t);return t.session.emit({type:"authenticated",session:r}),{kind:"success",session:r}}if(s&&s.consentRequired===!0)return{kind:"consent-required",agreements:De(s.agreements)};if(s&&Array.isArray(s.secondFactors)&&s.secondFactors.length>0)return{kind:"requires-second-factor",tempToken:String(s.tempToken??""),expiresInSeconds:Number(s.expiresInSeconds??0),secondFactors:sr(s.secondFactors),userId:String(s.userId??""),realmId:String(s.realmId??t.realmId)};if(s&&typeof s.redirectTo=="string")return{kind:"oauth-redirect",redirectTo:s.redirectTo};throw new y({kind:"api",message:"Unrecognized login response shape."})}function xe(e){let{realmId:t,client:s}=e;return{async register(r){let o=await T(ye({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,password:r.password,...r.username?{username:r.username}:{},...r.nickname?{nickname:r.nickname}:{},...r.turnstileToken?{turnstileToken:r.turnstileToken}:{}}}));return{message:o.message,verificationRequired:o.verificationRequired}},async triggerVerifyEmail(r){return{message:(await T(ge({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{}}}))).message}},async requestPasswordReset(r){return{message:(await T(Te({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{}}}))).message}},async login(r){let o=await T(pe({client:s,path:{realmId:t},body:{clientId:e.clientId,password:r.password,...r.username?{username:r.username}:{},...r.email?{email:r.email}:{},...r.turnstileToken?{turnstileToken:r.turnstileToken}:{},...r.agreements?{agreements:r.agreements}:{},...r.oauthClientId?{oauthClientId:r.oauthClientId}:{},...r.redirectUri?{redirectUri:r.redirectUri}:{},...r.state?{state:r.state}:{}}}));return G(o,e)},async loginWithLdap(r){let o=await T(he({client:s,path:{realmId:t},body:{clientId:e.clientId,username:r.username,password:r.password,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{},...r.agreements?{agreements:r.agreements}:{},...r.oauthClientId?{oauthClientId:r.oauthClientId}:{},...r.redirectUri?{redirectUri:r.redirectUri}:{},...r.state?{state:r.state}:{}}}));return G(o,e)},async verifyTotp(r){let o=await T(fe({client:s,path:{realmId:t},body:{tempToken:r.tempToken,...r.code?{code:r.code}:{},...r.backupCode?{backupCode:r.backupCode}:{},...r.agreements?{agreements:r.agreements}:{}}}));return G(o,e)},passkey:{async loginBegin(r){let o=r.tempToken!==void 0?await T(ue({client:s,path:{realmId:t},body:{tempToken:r.tempToken}})):await T(Ee({client:s,path:{realmId:t},body:{clientId:e.clientId,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{},...r.oauth?{oauth:r.oauth}:{}}}));return{authToken:o.authToken,options:o.options}},async loginFinish(r){let o=await T(r.tempToken!==void 0?me({client:s,path:{realmId:t},body:{tempToken:r.tempToken,authToken:r.authToken,assertion:r.assertion,...r.agreements?{agreements:r.agreements}:{}}}):Oe({client:s,path:{realmId:t},body:{authToken:r.authToken,assertion:r.assertion,...r.agreements?{agreements:r.agreements}:{}}}));return G(o,e)}},loginWithEmailOtp:{async send(r){let{data:o,error:n,response:a}=await ce({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{},...r.agreements?{agreements:r.agreements}:{}}});if(o)return{kind:"sent",message:o.message,expiresInSeconds:o.expiresInSeconds};let l=n??{},i=l.code;if(a?.status===409&&(i==="consent_required"||i==="email_not_registered"))return{kind:"conflict",code:String(i),message:String(l.message??""),consentRequired:l.consentRequired===!0,agreements:De(l.agreements)};throw M(n,a)},async verify(r){let o=await T(de({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,code:r.code,...r.agreements?{agreements:r.agreements}:{}}}));return G(o,e)}},async getStatus(){let r=await T(le({client:s}));return e.session.emit({type:"authenticated",session:tr(r,e)}),r},async refresh(){let r=await e.refreshTokens();if(!r)throw new y({kind:"session-expired",message:"Session refresh failed; sign in again."});return r},async logout(){let r=await T(ie({client:s}));return e.accessTokenHolder.clear(),e.storage.setRefreshToken(null),e.session.emit({type:"logged-out"}),{message:r?.message??"Logged out"}}}}function Se(){let e=null;return{get:()=>e,set:t=>{e=t},clear:()=>{e=null}}}var N={authenticated:!1,realmId:null,userId:null,clientAppId:null,clientId:null,credentialClass:null,permissions:[],scopes:[]};function Pe(e){let t={...N},s=new Set;return{getSession:()=>t,setSession:r=>{t=r??{...N}},subscribe:r=>(s.add(r),()=>{s.delete(r)}),emit:r=>{r.type==="authenticated"?t=r.session:(r.type==="session-expired"||r.type==="logged-out")&&(t={...N});for(let o of s)o(r);e?.(r)}}}function ke(){let e=null;return{getRefreshToken:()=>e,setRefreshToken:t=>{e=t}}}function z(e){if(typeof localStorage>"u"||localStorage===null)throw new y({kind:"ssr-no-storage",message:"localStorage is unavailable in this environment. Inject a TokenStorage adapter via `storage`, or use memoryStorage()."});return{getRefreshToken:()=>localStorage.getItem(e),setRefreshToken:t=>{t===null?localStorage.removeItem(e):localStorage.setItem(e,t)}}}function Ae(e){let t=typeof localStorage<"u"&&localStorage!==null,s=e.storage;if(!s){if(!t)throw new y({kind:"ssr-no-storage",message:"No TokenStorage adapter was provided and localStorage is unavailable (SSR/Node). Inject a `storage` adapter or use memoryStorage()."});s=z(e.storageKey??"herald.refreshToken")}let r=Se(),o=Pe(e.onSessionChange),n=Ce({baseUrl:e.baseUrl,accessTokenHolder:r,storage:s,session:o}),a={realmId:e.realmId,clientId:e.clientId,client:n.client,accessTokenHolder:r,storage:s,session:o,refreshTokens:n.refreshTokens};return{...xe(a),storage:s,session:{getSession:()=>o.getSession(),subscribe:i=>o.subscribe(i)},tokens:{getAccessToken:()=>r.get(),setTokens:i=>{r.set(i.accessToken),s.setRefreshToken(i.refreshToken),i.clientId!==void 0&&(a.clientId=i.clientId)},clear:()=>{r.clear(),s.setRefreshToken(null)},bindClientId:i=>{a.clientId=i}}}}function ve(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),s=t+"===".slice((t.length+3)%4),r=atob(s),o=new Uint8Array(r.length);for(let n=0;n<r.length;n+=1)o[n]=r.charCodeAt(n);return o.buffer}function H(e){let t=e instanceof Uint8Array?e:new Uint8Array(e),s="";for(let r=0;r<t.length;r+=1)s+=String.fromCharCode(t[r]??0);return btoa(s).replace(/\+/g,"-").replace(/\//g,"_").replace(/[=]/g,"")}async function Ie(e){if(typeof navigator>"u"||!navigator.credentials?.get)throw new Error("WebAuthn (navigator.credentials.get) is not available in this environment.");let t={challenge:ve(e.challenge),...e.rpId?{rpId:e.rpId}:{},...e.timeout!==void 0?{timeout:e.timeout}:{},...e.userVerification?{userVerification:e.userVerification}:{},...e.allowCredentials?{allowCredentials:e.allowCredentials.map(n=>({type:"public-key",id:ve(n.id),...n.transports?{transports:n.transports}:{}}))}:{}},s=await navigator.credentials.get({publicKey:t});if(!s)throw new Error("Passkey assertion returned no credential.");let r=s.response,o={id:s.id,rawId:H(s.rawId),type:"public-key",response:{authenticatorData:H(r.authenticatorData),clientDataJSON:H(r.clientDataJSON),signature:H(r.signature),...r.userHandle?{userHandle:H(r.userHandle)}:{}}};return typeof s.getClientExtensionResults=="function"&&(o.clientExtensionResults=s.getClientExtensionResults()),o}return Ke(or);})();
 //# sourceMappingURL=index.global.js.map