@absolutejs/auth 0.68.1 → 0.69.0

package/dist/client/index.js.map

@@ -1,13 +1,14 @@
 {
   "version": 3,
-  "sources": ["../src/client/createAuthClient.ts", "../src/client/sessionExpiry.ts", "../src/redirect.ts", "../src/client/passkeyHelpers.ts"],
+  "sources": ["../src/client/createAuthClient.ts", "../src/client/sessionExpiry.ts", "../src/client/mobile.ts", "../src/redirect.ts", "../src/client/passkeyHelpers.ts"],
   "sourcesContent": [
-    "// Framework-agnostic client SDK over the auth endpoints. Thin fetch wrappers with\n// configurable routes, a uniform `{ data, error }` return, and same-origin cookies on by\n// default — the primitive the React hooks (`./react`) and future Vue/Solid composables wrap.\n// HTMX is the special case (declarative server fragments via `./htmx`); for every other UI\n// framework the natural primitive is this client + your framework's reactivity.\n\nimport type {\n\tPublicKeyCredentialCreationOptionsJSON,\n\tPublicKeyCredentialRequestOptionsJSON\n} from '@simplewebauthn/browser';\n\nexport type AuthClientError = {\n\tbody: unknown;\n\tmessage: string;\n\tstatus: number;\n};\n\nexport type AuthClientResult<T> =\n\t| { data: null; error: AuthClientError }\n\t| { data: T; error: null };\n\n// Each entry is the URL the consumer's auth() mounted that flow at. Defaults match the\n// package defaults; override to match your own custom routes.\nexport type AuthClientRoutes = {\n\temailVerify?: string;\n\temailVerifyRequest?: string;\n\tlogin?: string;\n\tmagicLinkRequest?: string;\n\tmagicLinkVerify?: string;\n\tmfaChallenge?: string;\n\tmfaManagement?: string;\n\tmfaSetup?: string;\n\tmfaVerifySetup?: string;\n\tpasskeyAuthenticateOptions?: string;\n\tpasskeyAuthenticateVerify?: string;\n\tpasskeyList?: string;\n\tpasskeyRegisterOptions?: string;\n\tpasskeyRegisterVerify?: string;\n\tpasskeyRemove?: string;\n\tpasswordReset?: string;\n\tpasswordResetRequest?: string;\n\tregister?: string;\n\tsessions?: string;\n\tsignout?: string;\n\tstatus?: string;\n};\n\nconst DEFAULT_ROUTES: Required<AuthClientRoutes> = {\n\temailVerify: '/auth/verify-email',\n\temailVerifyRequest: '/auth/verify-email/request',\n\tlogin: '/auth/login',\n\tmagicLinkRequest: '/auth/passwordless/magic-link',\n\tmagicLinkVerify: '/auth/passwordless/magic-link/verify',\n\tmfaChallenge: '/auth/mfa/totp/challenge',\n\tmfaManagement: '/auth/mfa',\n\tmfaSetup: '/auth/mfa/totp/setup',\n\tmfaVerifySetup: '/auth/mfa/totp/verify',\n\tpasskeyAuthenticateOptions: '/auth/webauthn/authenticate/options',\n\tpasskeyAuthenticateVerify: '/auth/webauthn/authenticate/verify',\n\tpasskeyList: '/auth/webauthn/credentials',\n\tpasskeyRegisterOptions: '/auth/webauthn/register/options',\n\tpasskeyRegisterVerify: '/auth/webauthn/register/verify',\n\tpasskeyRemove: '/auth/webauthn/credentials',\n\tpasswordReset: '/auth/reset-password',\n\tpasswordResetRequest: '/auth/reset-password/request',\n\tregister: '/auth/register',\n\tsessions: '/auth/sessions',\n\tsignout: '/oauth2/signout',\n\tstatus: '/oauth2/status'\n};\n\nexport type AuthClientConfig = {\n\tbaseUrl?: string;\n\tcredentials?: RequestCredentials;\n\tfetch?: typeof fetch;\n\troutes?: AuthClientRoutes;\n};\n\nconst succeed = <T>(data: T): AuthClientResult<T> => ({\n\tdata,\n\terror: null\n});\n\nconst fail = (error: AuthClientError): AuthClientResult<never> => ({\n\tdata: null,\n\terror\n});\n\nconst errorFor = (response: Response, body: unknown): AuthClientError => ({\n\tbody,\n\tmessage:\n\t\ttypeof body === 'string'\n\t\t\t? body\n\t\t\t: (readMessage(body) ?? response.statusText),\n\tstatus: response.status\n});\n\nexport const createAuthClient = ({\n\tbaseUrl = '',\n\tcredentials = 'same-origin',\n\tfetch: fetchImpl = fetch,\n\troutes\n}: AuthClientConfig = {}) => {\n\tconst resolvedRoutes: Required<AuthClientRoutes> = {\n\t\t...DEFAULT_ROUTES,\n\t\t...routes\n\t};\n\n\tconst request = async <T>(path: string, init: RequestInit) => {\n\t\ttry {\n\t\t\tconst response = await fetchImpl(`${baseUrl}${path}`, {\n\t\t\t\tcredentials,\n\t\t\t\t...init\n\t\t\t});\n\t\t\tconst text = await response.text();\n\t\t\tif (!response.ok) return fail(errorFor(response, safeJson(text)));\n\n\t\t\tconst data: T = JSON.parse(text === '' ? 'null' : text);\n\n\t\t\treturn succeed(data);\n\t\t} catch (caught) {\n\t\t\tconst message =\n\t\t\t\tcaught instanceof Error ? caught.message : 'network';\n\n\t\t\treturn fail({ body: null, message, status: 0 });\n\t\t}\n\t};\n\n\tconst post = <T>(path: string, body?: unknown, method = 'POST') =>\n\t\trequest<T>(path, {\n\t\t\tbody: body === undefined ? undefined : JSON.stringify(body),\n\t\t\theaders:\n\t\t\t\tbody === undefined\n\t\t\t\t\t? undefined\n\t\t\t\t\t: { 'content-type': 'application/json' },\n\t\t\tmethod\n\t\t});\n\n\tconst get = <T>(path: string) => request<T>(path, { method: 'GET' });\n\n\tconst del = <T>(path: string) => request<T>(path, { method: 'DELETE' });\n\n\treturn {\n\t\temailVerification: {\n\t\t\trequest: (body: { email: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.emailVerifyRequest, body),\n\t\t\tverify: (body: { token: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.emailVerify, body)\n\t\t},\n\t\tmfa: {\n\t\t\tchallenge: (body: { code: string }) =>\n\t\t\t\tpost<{ status: 'authenticated' }>(\n\t\t\t\t\tresolvedRoutes.mfaChallenge,\n\t\t\t\t\tbody\n\t\t\t\t),\n\t\t\tdisable: () =>\n\t\t\t\tdel<{ status: 'disabled' }>(resolvedRoutes.mfaManagement),\n\t\t\tsetup: () =>\n\t\t\t\tpost<{ secret: string; uri: string }>(resolvedRoutes.mfaSetup),\n\t\t\tstatus: () =>\n\t\t\t\tget<import('../mfa/management').MfaStatus>(\n\t\t\t\t\tresolvedRoutes.mfaManagement\n\t\t\t\t),\n\t\t\tverifySetup: (body: { code: string }) =>\n\t\t\t\tpost<{ backupCodes: string[] }>(\n\t\t\t\t\tresolvedRoutes.mfaVerifySetup,\n\t\t\t\t\tbody\n\t\t\t\t)\n\t\t},\n\t\tpasskeys: {\n\t\t\tauthenticateOptions: () =>\n\t\t\t\tpost<PublicKeyCredentialRequestOptionsJSON>(\n\t\t\t\t\tresolvedRoutes.passkeyAuthenticateOptions\n\t\t\t\t),\n\t\t\tauthenticateVerify: (response: unknown) =>\n\t\t\t\tpost<{ status: 'authenticated' }>(\n\t\t\t\t\tresolvedRoutes.passkeyAuthenticateVerify,\n\t\t\t\t\tresponse\n\t\t\t\t),\n\t\t\tlist: () => get<unknown[]>(resolvedRoutes.passkeyList),\n\t\t\tregisterOptions: () =>\n\t\t\t\tpost<PublicKeyCredentialCreationOptionsJSON>(\n\t\t\t\t\tresolvedRoutes.passkeyRegisterOptions\n\t\t\t\t),\n\t\t\tregisterVerify: (response: unknown) =>\n\t\t\t\tpost<{ ok: true }>(\n\t\t\t\t\tresolvedRoutes.passkeyRegisterVerify,\n\t\t\t\t\tresponse\n\t\t\t\t),\n\t\t\tremove: (credentialId: string) =>\n\t\t\t\tdel<{ ok: true }>(\n\t\t\t\t\t`${resolvedRoutes.passkeyRemove}/${encodeURIComponent(credentialId)}`\n\t\t\t\t)\n\t\t},\n\t\tpasswordless: {\n\t\t\trequestMagicLink: (body: { email: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.magicLinkRequest, body),\n\t\t\tverifyMagicLink: (body: { token: string }) =>\n\t\t\t\tpost<{ status: 'authenticated' }>(\n\t\t\t\t\tresolvedRoutes.magicLinkVerify,\n\t\t\t\t\tbody\n\t\t\t\t)\n\t\t},\n\t\tpasswordReset: {\n\t\t\tconfirm: (body: { password: string; token: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.passwordReset, body),\n\t\t\trequest: (body: { email: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.passwordResetRequest, body)\n\t\t},\n\t\tsessions: {\n\t\t\tlist: () => get<unknown[]>(resolvedRoutes.sessions),\n\t\t\trevoke: (sessionId: string) =>\n\t\t\t\tdel<{ ok: true }>(\n\t\t\t\t\t`${resolvedRoutes.sessions}/${encodeURIComponent(sessionId)}`\n\t\t\t\t)\n\t\t},\n\t\tsignIn: {\n\t\t\temail: (body: { email: string; password: string }) =>\n\t\t\t\tpost<{\n\t\t\t\t\tpasswordCompromised?: boolean;\n\t\t\t\t\tstatus: 'authenticated' | 'mfa_required';\n\t\t\t\t}>(resolvedRoutes.login, body)\n\t\t},\n\t\tsignUp: {\n\t\t\temail: (body: {\n\t\t\t\temail: string;\n\t\t\t\tpassword: string;\n\t\t\t\t[extra: string]: unknown;\n\t\t\t}) =>\n\t\t\t\tpost<\n\t\t\t\t\t| { status: 'authenticated' }\n\t\t\t\t\t| { status: 'verification_required' }\n\t\t\t\t>(resolvedRoutes.register, body)\n\t\t},\n\t\tsignOut: () => del<null>(resolvedRoutes.signout),\n\t\tstatus: () =>\n\t\t\tget<{ impersonator?: unknown; user: unknown | null }>(\n\t\t\t\tresolvedRoutes.status\n\t\t\t)\n\t};\n};\n\nconst safeJson = (text: string) => {\n\ttry {\n\t\treturn JSON.parse(text);\n\t} catch {\n\t\treturn text;\n\t}\n};\n\nconst readMessage = (body: unknown) => {\n\tif (typeof body !== 'object' || body === null) return undefined;\n\tconst message: unknown = Reflect.get(body, 'message');\n\n\treturn typeof message === 'string' ? message : undefined;\n};\n\nexport type AuthClient = ReturnType<typeof createAuthClient>;\n",
+    "// Framework-agnostic client SDK over the auth endpoints. Thin fetch wrappers with\n// configurable routes, a uniform `{ data, error }` return, and same-origin cookies on by\n// default — the primitive the React hooks (`./react`) and future Vue/Solid composables wrap.\n// HTMX is the special case (declarative server fragments via `./htmx`); for every other UI\n// framework the natural primitive is this client + your framework's reactivity.\n\nimport type {\n\tPublicKeyCredentialCreationOptionsJSON,\n\tPublicKeyCredentialRequestOptionsJSON\n} from '@simplewebauthn/browser';\n\nexport type AuthClientError = {\n\tbody: unknown;\n\tmessage: string;\n\tstatus: number;\n};\n\nexport type AuthClientResult<T> =\n\t| { data: null; error: AuthClientError }\n\t| { data: T; error: null };\n\n// Each entry is the URL the consumer's auth() mounted that flow at. Defaults match the\n// package defaults; override to match your own custom routes.\nexport type AuthClientRoutes = {\n\temailVerify?: string;\n\temailVerifyRequest?: string;\n\tlogin?: string;\n\tmagicLinkRequest?: string;\n\tmagicLinkVerify?: string;\n\tmfaChallenge?: string;\n\tmfaManagement?: string;\n\tmfaSetup?: string;\n\tmfaVerifySetup?: string;\n\tpasskeyAuthenticateOptions?: string;\n\tpasskeyAuthenticateVerify?: string;\n\tpasskeyList?: string;\n\tpasskeyRegisterOptions?: string;\n\tpasskeyRegisterVerify?: string;\n\tpasskeyRemove?: string;\n\tpasswordReset?: string;\n\tpasswordResetRequest?: string;\n\tregister?: string;\n\tsessions?: string;\n\tsignout?: string;\n\tstatus?: string;\n};\n\nconst DEFAULT_ROUTES: Required<AuthClientRoutes> = {\n\temailVerify: '/auth/verify-email',\n\temailVerifyRequest: '/auth/verify-email/request',\n\tlogin: '/auth/login',\n\tmagicLinkRequest: '/auth/passwordless/magic-link',\n\tmagicLinkVerify: '/auth/passwordless/magic-link/verify',\n\tmfaChallenge: '/auth/mfa/totp/challenge',\n\tmfaManagement: '/auth/mfa',\n\tmfaSetup: '/auth/mfa/totp/setup',\n\tmfaVerifySetup: '/auth/mfa/totp/verify',\n\tpasskeyAuthenticateOptions: '/auth/webauthn/authenticate/options',\n\tpasskeyAuthenticateVerify: '/auth/webauthn/authenticate/verify',\n\tpasskeyList: '/auth/webauthn/credentials',\n\tpasskeyRegisterOptions: '/auth/webauthn/register/options',\n\tpasskeyRegisterVerify: '/auth/webauthn/register/verify',\n\tpasskeyRemove: '/auth/webauthn/credentials',\n\tpasswordReset: '/auth/reset-password',\n\tpasswordResetRequest: '/auth/reset-password/request',\n\tregister: '/auth/register',\n\tsessions: '/auth/sessions',\n\tsignout: '/oauth2/signout',\n\tstatus: '/oauth2/status'\n};\n\nexport type AuthClientConfig = {\n\tbaseUrl?: string;\n\tcredentials?: RequestCredentials;\n\tfetch?: AuthClientFetch;\n\troutes?: AuthClientRoutes;\n\ttransport?: AuthClientTransport;\n};\n\nexport type AuthClientFetch = (\n\tinput: RequestInfo | URL,\n\tinit?: RequestInit\n) => Promise<Response>;\n\nexport type AuthClientTransport = {\n\tfetch?: AuthClientFetch;\n\tsignInEmail?: (body: { email: string; password: string }) => Promise<{\n\t\tpasswordCompromised?: boolean;\n\t\tstatus: 'authenticated' | 'mfa_required';\n\t}>;\n\tsignOut?: () => Promise<null>;\n\tsignUpEmail?: (body: {\n\t\temail: string;\n\t\tpassword: string;\n\t\t[extra: string]: unknown;\n\t}) => Promise<\n\t\t{ status: 'authenticated' } | { status: 'verification_required' }\n\t>;\n\tstatus?: () => Promise<{\n\t\timpersonator?: unknown;\n\t\tuser: unknown | null;\n\t}>;\n};\n\nconst succeed = <T>(data: T): AuthClientResult<T> => ({\n\tdata,\n\terror: null\n});\n\nconst fail = (error: AuthClientError): AuthClientResult<never> => ({\n\tdata: null,\n\terror\n});\n\nconst errorFor = (response: Response, body: unknown): AuthClientError => ({\n\tbody,\n\tmessage:\n\t\ttypeof body === 'string'\n\t\t\t? body\n\t\t\t: (readMessage(body) ?? response.statusText),\n\tstatus: response.status\n});\n\nexport const createAuthClient = ({\n\tbaseUrl = '',\n\tcredentials = 'same-origin',\n\tfetch: fetchImpl = fetch,\n\troutes,\n\ttransport\n}: AuthClientConfig = {}) => {\n\tconst resolvedFetch = transport?.fetch ?? fetchImpl;\n\tconst signInEmail = transport?.signInEmail;\n\tconst signOut = transport?.signOut;\n\tconst signUpEmail = transport?.signUpEmail;\n\tconst transportStatus = transport?.status;\n\tconst resolvedRoutes: Required<AuthClientRoutes> = {\n\t\t...DEFAULT_ROUTES,\n\t\t...routes\n\t};\n\n\tconst request = async <T>(path: string, init: RequestInit) => {\n\t\ttry {\n\t\t\tconst response = await resolvedFetch(`${baseUrl}${path}`, {\n\t\t\t\tcredentials,\n\t\t\t\t...init\n\t\t\t});\n\t\t\tconst text = await response.text();\n\t\t\tif (!response.ok) return fail(errorFor(response, safeJson(text)));\n\n\t\t\tconst data: T = JSON.parse(text === '' ? 'null' : text);\n\n\t\t\treturn succeed(data);\n\t\t} catch (caught) {\n\t\t\tconst message =\n\t\t\t\tcaught instanceof Error ? caught.message : 'network';\n\n\t\t\treturn fail({ body: null, message, status: 0 });\n\t\t}\n\t};\n\tconst runTransport = async <T>(operation: () => Promise<T>) => {\n\t\ttry {\n\t\t\treturn succeed(await operation());\n\t\t} catch (caught) {\n\t\t\tconst message =\n\t\t\t\tcaught instanceof Error ? caught.message : 'authentication';\n\n\t\t\treturn fail({ body: null, message, status: 0 });\n\t\t}\n\t};\n\n\tconst post = <T>(path: string, body?: unknown, method = 'POST') =>\n\t\trequest<T>(path, {\n\t\t\tbody: body === undefined ? undefined : JSON.stringify(body),\n\t\t\theaders:\n\t\t\t\tbody === undefined\n\t\t\t\t\t? undefined\n\t\t\t\t\t: { 'content-type': 'application/json' },\n\t\t\tmethod\n\t\t});\n\n\tconst get = <T>(path: string) => request<T>(path, { method: 'GET' });\n\n\tconst del = <T>(path: string) => request<T>(path, { method: 'DELETE' });\n\n\treturn {\n\t\temailVerification: {\n\t\t\trequest: (body: { email: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.emailVerifyRequest, body),\n\t\t\tverify: (body: { token: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.emailVerify, body)\n\t\t},\n\t\tmfa: {\n\t\t\tchallenge: (body: { code: string }) =>\n\t\t\t\tpost<{ status: 'authenticated' }>(\n\t\t\t\t\tresolvedRoutes.mfaChallenge,\n\t\t\t\t\tbody\n\t\t\t\t),\n\t\t\tdisable: () =>\n\t\t\t\tdel<{ status: 'disabled' }>(resolvedRoutes.mfaManagement),\n\t\t\tsetup: () =>\n\t\t\t\tpost<{ secret: string; uri: string }>(resolvedRoutes.mfaSetup),\n\t\t\tstatus: () =>\n\t\t\t\tget<import('../mfa/management').MfaStatus>(\n\t\t\t\t\tresolvedRoutes.mfaManagement\n\t\t\t\t),\n\t\t\tverifySetup: (body: { code: string }) =>\n\t\t\t\tpost<{ backupCodes: string[] }>(\n\t\t\t\t\tresolvedRoutes.mfaVerifySetup,\n\t\t\t\t\tbody\n\t\t\t\t)\n\t\t},\n\t\tpasskeys: {\n\t\t\tauthenticateOptions: () =>\n\t\t\t\tpost<PublicKeyCredentialRequestOptionsJSON>(\n\t\t\t\t\tresolvedRoutes.passkeyAuthenticateOptions\n\t\t\t\t),\n\t\t\tauthenticateVerify: (response: unknown) =>\n\t\t\t\tpost<{ status: 'authenticated' }>(\n\t\t\t\t\tresolvedRoutes.passkeyAuthenticateVerify,\n\t\t\t\t\tresponse\n\t\t\t\t),\n\t\t\tlist: () => get<unknown[]>(resolvedRoutes.passkeyList),\n\t\t\tregisterOptions: () =>\n\t\t\t\tpost<PublicKeyCredentialCreationOptionsJSON>(\n\t\t\t\t\tresolvedRoutes.passkeyRegisterOptions\n\t\t\t\t),\n\t\t\tregisterVerify: (response: unknown) =>\n\t\t\t\tpost<{ ok: true }>(\n\t\t\t\t\tresolvedRoutes.passkeyRegisterVerify,\n\t\t\t\t\tresponse\n\t\t\t\t),\n\t\t\tremove: (credentialId: string) =>\n\t\t\t\tdel<{ ok: true }>(\n\t\t\t\t\t`${resolvedRoutes.passkeyRemove}/${encodeURIComponent(credentialId)}`\n\t\t\t\t)\n\t\t},\n\t\tpasswordless: {\n\t\t\trequestMagicLink: (body: { email: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.magicLinkRequest, body),\n\t\t\tverifyMagicLink: (body: { token: string }) =>\n\t\t\t\tpost<{ status: 'authenticated' }>(\n\t\t\t\t\tresolvedRoutes.magicLinkVerify,\n\t\t\t\t\tbody\n\t\t\t\t)\n\t\t},\n\t\tpasswordReset: {\n\t\t\tconfirm: (body: { password: string; token: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.passwordReset, body),\n\t\t\trequest: (body: { email: string }) =>\n\t\t\t\tpost<{ ok: true }>(resolvedRoutes.passwordResetRequest, body)\n\t\t},\n\t\tsessions: {\n\t\t\tlist: () => get<unknown[]>(resolvedRoutes.sessions),\n\t\t\trevoke: (sessionId: string) =>\n\t\t\t\tdel<{ ok: true }>(\n\t\t\t\t\t`${resolvedRoutes.sessions}/${encodeURIComponent(sessionId)}`\n\t\t\t\t)\n\t\t},\n\t\tsignIn: {\n\t\t\temail: (body: { email: string; password: string }) =>\n\t\t\t\tsignInEmail\n\t\t\t\t\t? runTransport(() => signInEmail(body))\n\t\t\t\t\t: post<{\n\t\t\t\t\t\t\tpasswordCompromised?: boolean;\n\t\t\t\t\t\t\tstatus: 'authenticated' | 'mfa_required';\n\t\t\t\t\t\t}>(resolvedRoutes.login, body)\n\t\t},\n\t\tsignUp: {\n\t\t\temail: (body: {\n\t\t\t\temail: string;\n\t\t\t\tpassword: string;\n\t\t\t\t[extra: string]: unknown;\n\t\t\t}) =>\n\t\t\t\tsignUpEmail\n\t\t\t\t\t? runTransport(() => signUpEmail(body))\n\t\t\t\t\t: post<\n\t\t\t\t\t\t\t| { status: 'authenticated' }\n\t\t\t\t\t\t\t| { status: 'verification_required' }\n\t\t\t\t\t\t>(resolvedRoutes.register, body)\n\t\t},\n\t\tsignOut: () =>\n\t\t\tsignOut\n\t\t\t\t? runTransport(() => signOut())\n\t\t\t\t: del<null>(resolvedRoutes.signout),\n\t\tstatus: () =>\n\t\t\ttransportStatus\n\t\t\t\t? runTransport(() => transportStatus())\n\t\t\t\t: get<{ impersonator?: unknown; user: unknown | null }>(\n\t\t\t\t\t\tresolvedRoutes.status\n\t\t\t\t\t)\n\t};\n};\n\nconst safeJson = (text: string) => {\n\ttry {\n\t\treturn JSON.parse(text);\n\t} catch {\n\t\treturn text;\n\t}\n};\n\nconst readMessage = (body: unknown) => {\n\tif (typeof body !== 'object' || body === null) return undefined;\n\tconst message: unknown = Reflect.get(body, 'message');\n\n\treturn typeof message === 'string' ? message : undefined;\n};\n\nexport type AuthClient = ReturnType<typeof createAuthClient>;\n",
     "const DEFAULT_CHECK_INTERVAL_MS = 30_000;\nconst DEFAULT_REASON = 'session_expired';\nconst DEFAULT_REASON_PARAM = 'reason';\nconst DEFAULT_RETURN_URL_PARAM = 'returnUrl';\nconst DEFAULT_SIGN_IN_PATH = '/signin';\nconst DEFAULT_STATUS_PATH = '/oauth2/status';\nconst HTTP_UNAUTHORIZED = 401;\n\nexport type SessionExpiredContext = {\n\treturnTo: string;\n\tsignInUrl: string;\n};\n\nexport type SessionExpiryGuard = {\n\tcheck: () => Promise<boolean>;\n\tdispose: () => void;\n};\n\nexport type SessionExpiryGuardConfig = {\n\tcheckIntervalMs?: number;\n\tisProtectedRequest?: (url: URL) => boolean;\n\tonExpired?: (context: SessionExpiredContext) => void;\n\tprotectedPaths?: readonly string[];\n\treason?: string;\n\treasonParam?: string;\n\treturnUrlParam?: string;\n\tsignInPath?: string;\n\tstatusPath?: string;\n};\n\nlet activeGuard: SessionExpiryGuard | null = null;\n\nconst requestUrl = (input: RequestInfo | URL, origin: string) => {\n\tconst raw = input instanceof Request ? input.url : String(input);\n\n\ttry {\n\t\treturn new URL(raw, origin);\n\t} catch {\n\t\treturn null;\n\t}\n};\n\nexport const buildSessionExpiredSignInUrl = ({\n\tcurrentHref,\n\treason = DEFAULT_REASON,\n\treasonParam = DEFAULT_REASON_PARAM,\n\treturnUrlParam = DEFAULT_RETURN_URL_PARAM,\n\tsignInPath = DEFAULT_SIGN_IN_PATH\n}: {\n\tcurrentHref: string;\n\treason?: string;\n\treasonParam?: string;\n\treturnUrlParam?: string;\n\tsignInPath?: string;\n}) => {\n\tconst current = new URL(currentHref);\n\tconst returnTo = `${current.pathname}${current.search}${current.hash}`;\n\tconst destination = new URL(signInPath, current.origin);\n\tdestination.searchParams.set(reasonParam, reason);\n\tdestination.searchParams.set(returnUrlParam, returnTo);\n\n\treturn destination.origin === current.origin\n\t\t? `${destination.pathname}${destination.search}${destination.hash}`\n\t\t: destination.toString();\n};\n\n/**\n * Installs one browser-wide session-expiry guard. It intercepts 401 responses\n * only for explicitly protected same-origin requests and rechecks the auth\n * status route when a backgrounded or bfcached page becomes active again.\n */\nexport const installSessionExpiryGuard = (\n\tconfig: SessionExpiryGuardConfig = {}\n) => {\n\tif (typeof window === 'undefined' || typeof document === 'undefined') {\n\t\treturn { check: async () => false, dispose: () => undefined };\n\t}\n\tif (activeGuard) return activeGuard;\n\n\tconst {\n\t\tcheckIntervalMs = DEFAULT_CHECK_INTERVAL_MS,\n\t\tisProtectedRequest,\n\t\tonExpired,\n\t\tprotectedPaths = [],\n\t\treason = DEFAULT_REASON,\n\t\treasonParam = DEFAULT_REASON_PARAM,\n\t\treturnUrlParam = DEFAULT_RETURN_URL_PARAM,\n\t\tsignInPath = DEFAULT_SIGN_IN_PATH,\n\t\tstatusPath = DEFAULT_STATUS_PATH\n\t} = config;\n\tconst nativeFetch = window.fetch.bind(window);\n\tconst originalFetch = window.fetch;\n\tlet checking = false;\n\tlet disposed = false;\n\tlet expired = false;\n\tlet lastCheckedAt = Date.now();\n\n\tconst expire = () => {\n\t\tif (expired || disposed) return;\n\t\texpired = true;\n\t\tconst currentHref = window.location.href;\n\t\tconst signInUrl = buildSessionExpiredSignInUrl({\n\t\t\tcurrentHref,\n\t\t\treason,\n\t\t\treasonParam,\n\t\t\treturnUrlParam,\n\t\t\tsignInPath\n\t\t});\n\t\tconst current = new URL(currentHref);\n\t\tconst returnTo = `${current.pathname}${current.search}${current.hash}`;\n\t\tif (onExpired) {\n\t\t\tonExpired({ returnTo, signInUrl });\n\n\t\t\treturn;\n\t\t}\n\t\twindow.location.assign(signInUrl);\n\t};\n\n\tconst protectedRequest = (input: RequestInfo | URL) => {\n\t\tconst url = requestUrl(input, window.location.origin);\n\t\tif (!url || url.origin !== window.location.origin) return false;\n\t\tif (\n\t\t\tnew URL(statusPath, window.location.origin).pathname ===\n\t\t\turl.pathname\n\t\t)\n\t\t\treturn false;\n\n\t\treturn (\n\t\t\tisProtectedRequest?.(url) === true ||\n\t\t\tprotectedPaths.some((path) => url.pathname.startsWith(path))\n\t\t);\n\t};\n\n\tconst guardedFetch = new Proxy(originalFetch, {\n\t\tapply: async (target, thisArg, args) => {\n\t\t\tconst [input] = args;\n\t\t\tconst response = await Reflect.apply(target, thisArg, args);\n\t\t\tif (\n\t\t\t\tresponse.status === HTTP_UNAUTHORIZED &&\n\t\t\t\tprotectedRequest(input)\n\t\t\t) {\n\t\t\t\texpire();\n\t\t\t}\n\n\t\t\treturn response;\n\t\t}\n\t});\n\twindow.fetch = guardedFetch;\n\n\tconst check = async () => {\n\t\tif (checking || expired || disposed) return false;\n\t\tchecking = true;\n\t\tlastCheckedAt = Date.now();\n\t\ttry {\n\t\t\tconst response = await nativeFetch(statusPath, {\n\t\t\t\tcache: 'no-store',\n\t\t\t\tcredentials: 'include',\n\t\t\t\theaders: { accept: 'application/json' }\n\t\t\t});\n\t\t\tif (!response.ok) return false;\n\t\t\tconst payload: unknown = await response.json();\n\t\t\tconst sessionExpired =\n\t\t\t\ttypeof payload === 'object' &&\n\t\t\t\tpayload !== null &&\n\t\t\t\tReflect.get(payload, 'user') === null;\n\t\t\tif (!sessionExpired) return false;\n\t\t\texpire();\n\n\t\t\treturn true;\n\t\t} catch {\n\t\t\t// A connectivity failure is not proof that the session expired.\n\t\t\treturn false;\n\t\t} finally {\n\t\t\tchecking = false;\n\t\t}\n\t};\n\n\tconst checkIfDue = () => {\n\t\tif (\n\t\t\tdocument.visibilityState !== 'visible' ||\n\t\t\tDate.now() - lastCheckedAt < checkIntervalMs\n\t\t)\n\t\t\treturn;\n\t\tvoid check();\n\t};\n\tconst checkPersistedSession = (event: PageTransitionEvent) => {\n\t\tif (!event.persisted) return;\n\t\tvoid check();\n\t};\n\tconst dispose = () => {\n\t\tif (disposed) return;\n\t\tdisposed = true;\n\t\tdocument.removeEventListener('visibilitychange', checkIfDue);\n\t\twindow.removeEventListener('focus', checkIfDue);\n\t\twindow.removeEventListener('pageshow', checkPersistedSession);\n\t\tif (window.fetch === guardedFetch) window.fetch = originalFetch;\n\t\tactiveGuard = null;\n\t};\n\n\tdocument.addEventListener('visibilitychange', checkIfDue);\n\twindow.addEventListener('focus', checkIfDue);\n\twindow.addEventListener('pageshow', checkPersistedSession);\n\tactiveGuard = { check, dispose };\n\n\treturn activeGuard;\n};\n\nexport const isProtectedSessionRequest = ({\n\tinput,\n\torigin,\n\tprotectedPaths\n}: {\n\tinput: RequestInfo | URL;\n\torigin: string;\n\tprotectedPaths: readonly string[];\n}) => {\n\tconst url = requestUrl(input, origin);\n\n\treturn (\n\t\turl?.origin === origin &&\n\t\tprotectedPaths.some((path) => url.pathname.startsWith(path))\n\t);\n};\n",
+    "export type MobileAuthSecureStorage = {\n\tcapability?: () => Promise<{\n\t\tavailable: boolean;\n\t\tmessage?: string;\n\t}>;\n\tget(key: string): Promise<string | null>;\n\tremove(key: string): Promise<void>;\n\tset(key: string, value: string): Promise<void>;\n};\n\nexport type MobileAuthLinks = {\n\tgetLaunchUrl(): Promise<string | null>;\n\tonOpen(\n\t\tlistener: (url: string) => void\n\t): Promise<() => Promise<void> | void>;\n\topenExternal(url: string): Promise<void>;\n};\n\nexport type MobileAuthLifecycle = {\n\tonResume?(listener: () => void): Promise<() => Promise<void> | void>;\n};\n\nexport type MobileAuthDiscovery = {\n\tauthorization_endpoint: string;\n\tcode_challenge_methods_supported?: string[];\n\tissuer: string;\n\tjwks_uri: string;\n\trevocation_endpoint?: string;\n\tsocket_ticket_endpoint?: string;\n\ttoken_endpoint: string;\n\ttoken_endpoint_auth_methods_supported?: string[];\n\tuserinfo_endpoint: string;\n};\n\nexport type MobileAuthClientConfig = {\n\tallowedOrigins?: readonly string[];\n\tclientId: string;\n\tclockSkewMs?: number;\n\tfetch?: typeof globalThis.fetch;\n\tissuer: string;\n\tlifecycle?: MobileAuthLifecycle;\n\tlinks: MobileAuthLinks;\n\tnow?: () => number;\n\tredirectUri: string;\n\tresource?: string;\n\tscopes?: readonly string[];\n\tstorage: MobileAuthSecureStorage;\n};\n\nexport type MobileAuthSignInOptions = {\n\tauthorizationParameters?: Readonly<Record<string, string>>;\n\tsignal?: AbortSignal;\n};\n\nexport type MobileAuthTokens = {\n\taccessToken: string;\n\texpiresAt: number;\n\tidToken: string;\n\trefreshToken: string;\n\tscope: string[];\n\ttokenType: 'Bearer';\n};\n\nexport type MobileAuthUser = Record<string, unknown> & { sub: string };\n\nexport type MobileAuthErrorCode =\n\t| 'aborted'\n\t| 'callback'\n\t| 'discovery'\n\t| 'id-token'\n\t| 'network'\n\t| 'oauth'\n\t| 'origin'\n\t| 'secure-storage'\n\t| 'token';\n\nexport class MobileAuthError extends Error {\n\treadonly code: MobileAuthErrorCode;\n\treadonly cause?: unknown;\n\n\tconstructor(\n\t\tcode: MobileAuthErrorCode,\n\t\tmessage: string,\n\t\toptions?: { cause?: unknown }\n\t) {\n\t\tsuper(message);\n\t\tthis.name = 'MobileAuthError';\n\t\tthis.code = code;\n\t\tthis.cause = options?.cause;\n\t}\n}\n\ntype PendingAuthorization = {\n\tcreatedAt: number;\n\tnonce: string;\n\tstate: string;\n\tverifier: string;\n};\n\ntype TokenResponse = {\n\taccess_token: string;\n\texpires_in: number;\n\tid_token: string;\n\trefresh_token: string;\n\tscope?: string;\n\ttoken_type: string;\n};\n\ntype DeferredSignIn = {\n\treject: (error: unknown) => void;\n\tresolve: (tokens: MobileAuthTokens) => void;\n};\n\nconst PENDING_KEY = 'oidc.pending';\nconst REFRESH_KEY = 'oidc.refresh';\nconst DEFAULT_CLOCK_SKEW_MS = 30_000;\nconst PENDING_TTL_MS = 10 * 60_000;\nconst RANDOM_BYTES = 32;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n\ttypeof value === 'object' && value !== null && !Array.isArray(value);\n\nconst base64Url = (value: Uint8Array) => {\n\tlet binary = '';\n\tfor (const byte of value) binary += String.fromCharCode(byte);\n\n\treturn btoa(binary)\n\t\t.replaceAll('+', '-')\n\t\t.replaceAll('/', '_')\n\t\t.replace(/=+$/u, '');\n};\n\nconst decodeBase64Url = (value: string) => {\n\tconst normalized = value.replaceAll('-', '+').replaceAll('_', '/');\n\tconst padded = normalized.padEnd(\n\t\tnormalized.length + ((4 - (normalized.length % 4)) % 4),\n\t\t'='\n\t);\n\tconst binary = atob(padded);\n\n\treturn Uint8Array.from(binary, (character) => character.charCodeAt(0));\n};\n\nconst randomValue = () => {\n\tconst value = new Uint8Array(RANDOM_BYTES);\n\tcrypto.getRandomValues(value);\n\n\treturn base64Url(value);\n};\n\nconst pkceChallenge = async (verifier: string) =>\n\tbase64Url(\n\t\tnew Uint8Array(\n\t\t\tawait crypto.subtle.digest(\n\t\t\t\t'SHA-256',\n\t\t\t\tnew TextEncoder().encode(verifier)\n\t\t\t)\n\t\t)\n\t);\n\nconst normalizeIssuer = (value: string) => {\n\tconst issuer = new URL(value);\n\tconst loopback =\n\t\tissuer.protocol === 'http:' &&\n\t\t['127.0.0.1', '[::1]', 'localhost'].includes(issuer.hostname);\n\tif (issuer.protocol !== 'https:' && !loopback)\n\t\tthrow new TypeError('Mobile auth issuer must use HTTPS.');\n\tif (issuer.username || issuer.password || issuer.search || issuer.hash)\n\t\tthrow new TypeError(\n\t\t\t'Mobile auth issuer cannot contain credentials, query, or fragment.'\n\t\t);\n\tissuer.pathname = issuer.pathname.replace(/\\/$/u, '');\n\n\treturn issuer.href.replace(/\\/$/u, '');\n};\n\nconst exactRedirect = (actualValue: string, expectedValue: string) => {\n\tconst actual = new URL(actualValue);\n\tconst expected = new URL(expectedValue);\n\n\treturn (\n\t\tactual.protocol === expected.protocol &&\n\t\tactual.host === expected.host &&\n\t\tactual.pathname === expected.pathname &&\n\t\tactual.username === '' &&\n\t\tactual.password === ''\n\t);\n};\n\nconst parsePending = (value: string | null) => {\n\tif (value === null) return undefined;\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(value);\n\t\tif (\n\t\t\t!isRecord(parsed) ||\n\t\t\ttypeof parsed.createdAt !== 'number' ||\n\t\t\ttypeof parsed.nonce !== 'string' ||\n\t\t\ttypeof parsed.state !== 'string' ||\n\t\t\ttypeof parsed.verifier !== 'string'\n\t\t)\n\t\t\treturn undefined;\n\n\t\treturn {\n\t\t\tcreatedAt: parsed.createdAt,\n\t\t\tnonce: parsed.nonce,\n\t\t\tstate: parsed.state,\n\t\t\tverifier: parsed.verifier\n\t\t} satisfies PendingAuthorization;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\nconst parseTokenResponse = (value: unknown) => {\n\tif (\n\t\t!isRecord(value) ||\n\t\ttypeof value.access_token !== 'string' ||\n\t\ttypeof value.expires_in !== 'number' ||\n\t\t!Number.isFinite(value.expires_in) ||\n\t\tvalue.expires_in <= 0 ||\n\t\ttypeof value.id_token !== 'string' ||\n\t\ttypeof value.refresh_token !== 'string' ||\n\t\ttypeof value.token_type !== 'string'\n\t)\n\t\tthrow new MobileAuthError('token', 'The token response is malformed.');\n\tif (value.token_type.toLowerCase() !== 'bearer')\n\t\tthrow new MobileAuthError(\n\t\t\t'token',\n\t\t\t`Unsupported mobile token type ${value.token_type}; DPoP is not enabled for this client.`\n\t\t);\n\n\treturn {\n\t\taccess_token: value.access_token,\n\t\texpires_in: value.expires_in,\n\t\tid_token: value.id_token,\n\t\trefresh_token: value.refresh_token,\n\t\tscope: typeof value.scope === 'string' ? value.scope : undefined,\n\t\ttoken_type: value.token_type\n\t} satisfies TokenResponse;\n};\n\nconst responseBody = async (response: Response) => {\n\tconst text = await response.text();\n\ttry {\n\t\treturn JSON.parse(text);\n\t} catch {\n\t\treturn text;\n\t}\n};\n\nconst requireEndpoint = (value: unknown, name: string, issuer: string) => {\n\tif (typeof value !== 'string')\n\t\tthrow new MobileAuthError(\n\t\t\t'discovery',\n\t\t\t`OIDC discovery is missing ${name}.`\n\t\t);\n\tconst endpoint = new URL(value);\n\tif (endpoint.protocol !== 'https:' && new URL(issuer).protocol === 'https:')\n\t\tthrow new MobileAuthError(\n\t\t\t'discovery',\n\t\t\t`OIDC discovery ${name} must use HTTPS.`\n\t\t);\n\n\treturn endpoint.href;\n};\n\nconst parseDiscovery = (\n\tvalue: unknown,\n\tissuer: string\n): MobileAuthDiscovery => {\n\tif (!isRecord(value) || value.issuer !== issuer)\n\t\tthrow new MobileAuthError(\n\t\t\t'discovery',\n\t\t\t'OIDC discovery issuer does not match the configured issuer.'\n\t\t);\n\tconst methods = Array.isArray(value.code_challenge_methods_supported)\n\t\t? value.code_challenge_methods_supported.filter(\n\t\t\t\t(method): method is string => typeof method === 'string'\n\t\t\t)\n\t\t: undefined;\n\tif (!methods?.includes('S256'))\n\t\tthrow new MobileAuthError(\n\t\t\t'discovery',\n\t\t\t'OIDC provider does not advertise S256 PKCE.'\n\t\t);\n\tconst authMethods = Array.isArray(\n\t\tvalue.token_endpoint_auth_methods_supported\n\t)\n\t\t? value.token_endpoint_auth_methods_supported.filter(\n\t\t\t\t(method): method is string => typeof method === 'string'\n\t\t\t)\n\t\t: undefined;\n\tif (!authMethods?.includes('none'))\n\t\tthrow new MobileAuthError(\n\t\t\t'discovery',\n\t\t\t'OIDC provider does not accept public clients at the token endpoint.'\n\t\t);\n\n\treturn {\n\t\tauthorization_endpoint: requireEndpoint(\n\t\t\tvalue.authorization_endpoint,\n\t\t\t'authorization_endpoint',\n\t\t\tissuer\n\t\t),\n\t\tcode_challenge_methods_supported: methods,\n\t\tissuer,\n\t\tjwks_uri: requireEndpoint(value.jwks_uri, 'jwks_uri', issuer),\n\t\trevocation_endpoint:\n\t\t\ttypeof value.revocation_endpoint === 'string'\n\t\t\t\t? requireEndpoint(\n\t\t\t\t\t\tvalue.revocation_endpoint,\n\t\t\t\t\t\t'revocation_endpoint',\n\t\t\t\t\t\tissuer\n\t\t\t\t\t)\n\t\t\t\t: undefined,\n\t\tsocket_ticket_endpoint:\n\t\t\ttypeof value.socket_ticket_endpoint === 'string'\n\t\t\t\t? requireEndpoint(\n\t\t\t\t\t\tvalue.socket_ticket_endpoint,\n\t\t\t\t\t\t'socket_ticket_endpoint',\n\t\t\t\t\t\tissuer\n\t\t\t\t\t)\n\t\t\t\t: undefined,\n\t\ttoken_endpoint: requireEndpoint(\n\t\t\tvalue.token_endpoint,\n\t\t\t'token_endpoint',\n\t\t\tissuer\n\t\t),\n\t\ttoken_endpoint_auth_methods_supported: authMethods,\n\t\tuserinfo_endpoint: requireEndpoint(\n\t\t\tvalue.userinfo_endpoint,\n\t\t\t'userinfo_endpoint',\n\t\t\tissuer\n\t\t)\n\t};\n};\n\nconst verifyIdToken = async ({\n\tclientId,\n\tfetchImpl,\n\tidToken,\n\tissuer,\n\tjwksUri,\n\tnonce,\n\tnow\n}: {\n\tclientId: string;\n\tfetchImpl: typeof globalThis.fetch;\n\tidToken: string;\n\tissuer: string;\n\tjwksUri: string;\n\tnonce: string;\n\tnow: number;\n}) => {\n\tconst [encodedHeader, encodedPayload, encodedSignature, ...extra] =\n\t\tidToken.split('.');\n\tif (!encodedHeader || !encodedPayload || !encodedSignature || extra.length)\n\t\tthrow new MobileAuthError('id-token', 'The ID token is malformed.');\n\tlet header: unknown;\n\tlet payload: unknown;\n\ttry {\n\t\theader = JSON.parse(\n\t\t\tnew TextDecoder().decode(decodeBase64Url(encodedHeader))\n\t\t);\n\t\tpayload = JSON.parse(\n\t\t\tnew TextDecoder().decode(decodeBase64Url(encodedPayload))\n\t\t);\n\t} catch (cause) {\n\t\tthrow new MobileAuthError('id-token', 'The ID token is malformed.', {\n\t\t\tcause\n\t\t});\n\t}\n\tif (\n\t\t!isRecord(header) ||\n\t\theader.alg !== 'ES256' ||\n\t\ttypeof header.kid !== 'string' ||\n\t\t!isRecord(payload)\n\t)\n\t\tthrow new MobileAuthError(\n\t\t\t'id-token',\n\t\t\t'The ID token header or claims are invalid.'\n\t\t);\n\tconst response = await fetchImpl(jwksUri, { cache: 'no-store' });\n\tif (!response.ok)\n\t\tthrow new MobileAuthError(\n\t\t\t'network',\n\t\t\t'Unable to fetch OIDC signing keys.'\n\t\t);\n\tconst body: unknown = await response.json();\n\tconst keys = isRecord(body) && Array.isArray(body.keys) ? body.keys : [];\n\tconst jwk = keys.find(\n\t\t(candidate): candidate is JsonWebKey & { kid: string } =>\n\t\t\tisRecord(candidate) && candidate.kid === header.kid\n\t);\n\tif (!jwk)\n\t\tthrow new MobileAuthError(\n\t\t\t'id-token',\n\t\t\t'The ID token signing key is unknown.'\n\t\t);\n\tconst key = await crypto.subtle.importKey(\n\t\t'jwk',\n\t\tjwk,\n\t\t{ hash: 'SHA-256', name: 'ECDSA', namedCurve: 'P-256' },\n\t\tfalse,\n\t\t['verify']\n\t);\n\tconst valid = await crypto.subtle.verify(\n\t\t{ hash: 'SHA-256', name: 'ECDSA' },\n\t\tkey,\n\t\tdecodeBase64Url(encodedSignature),\n\t\tnew TextEncoder().encode(`${encodedHeader}.${encodedPayload}`)\n\t);\n\tconst audience = payload.aud;\n\tif (\n\t\t!valid ||\n\t\tpayload.iss !== issuer ||\n\t\t!(\n\t\t\taudience === clientId ||\n\t\t\t(Array.isArray(audience) && audience.includes(clientId))\n\t\t) ||\n\t\tpayload.nonce !== nonce ||\n\t\ttypeof payload.exp !== 'number' ||\n\t\tpayload.exp * 1000 <= now\n\t)\n\t\tthrow new MobileAuthError(\n\t\t\t'id-token',\n\t\t\t'The ID token signature or claims are invalid.'\n\t\t);\n};\n\nexport const createMobileAuthClient = (config: MobileAuthClientConfig) => {\n\tconst issuer = normalizeIssuer(config.issuer);\n\tconst redirectUri = new URL(config.redirectUri).href;\n\tconst fetchImpl = config.fetch ?? globalThis.fetch;\n\tconst now = config.now ?? Date.now;\n\tconst clockSkewMs = config.clockSkewMs ?? DEFAULT_CLOCK_SKEW_MS;\n\tconst scopes = [...new Set(config.scopes ?? ['openid', 'profile'])];\n\tconst resource = config.resource ?? issuer;\n\tif (!scopes.includes('openid')) scopes.unshift('openid');\n\tconst allowedOrigins = new Set(\n\t\t(config.allowedOrigins ?? [new URL(issuer).origin]).map(\n\t\t\t(value) => new URL(value).origin\n\t\t)\n\t);\n\tlet discoveryPromise: Promise<MobileAuthDiscovery> | undefined;\n\tlet access: Omit<MobileAuthTokens, 'refreshToken'> | undefined;\n\tlet refreshPromise: Promise<string> | undefined;\n\tlet stopLinks: (() => Promise<void> | void) | undefined;\n\tlet stopResume: (() => Promise<void> | void) | undefined;\n\tlet startPromise: Promise<void> | undefined;\n\tconst pendingSignIns = new Map<string, DeferredSignIn>();\n\n\tconst fetchDiscovery = async () => {\n\t\tconst url = new URL('/.well-known/openid-configuration', `${issuer}/`);\n\t\tconst response = await fetchImpl(url, {\n\t\t\tcache: 'no-store',\n\t\t\theaders: { accept: 'application/json' }\n\t\t});\n\t\tif (!response.ok)\n\t\t\tthrow new MobileAuthError(\n\t\t\t\t'discovery',\n\t\t\t\t`OIDC discovery failed with HTTP ${response.status}.`\n\t\t\t);\n\n\t\treturn parseDiscovery(await response.json(), issuer);\n\t};\n\n\tconst discovery = () => {\n\t\tdiscoveryPromise ??= fetchDiscovery();\n\n\t\treturn discoveryPromise;\n\t};\n\n\tconst assertSecureStorage = async () => {\n\t\tconst capability = await config.storage.capability?.();\n\t\tif (capability && !capability.available)\n\t\t\tthrow new MobileAuthError(\n\t\t\t\t'secure-storage',\n\t\t\t\tcapability.message ??\n\t\t\t\t\t'Native secure credential storage is unavailable.'\n\t\t\t);\n\t};\n\n\tconst tokenRequest = async (\n\t\tmetadata: MobileAuthDiscovery,\n\t\tbody: URLSearchParams,\n\t\tnonce?: string\n\t) => {\n\t\tlet response: Response;\n\t\ttry {\n\t\t\tresponse = await fetchImpl(metadata.token_endpoint, {\n\t\t\t\tbody,\n\t\t\t\tcredentials: 'omit',\n\t\t\t\theaders: {\n\t\t\t\t\taccept: 'application/json',\n\t\t\t\t\t'content-type': 'application/x-www-form-urlencoded'\n\t\t\t\t},\n\t\t\t\tmethod: 'POST'\n\t\t\t});\n\t\t} catch (cause) {\n\t\t\tthrow new MobileAuthError('network', 'The token request failed.', {\n\t\t\t\tcause\n\t\t\t});\n\t\t}\n\t\tconst value = await responseBody(response);\n\t\tif (!response.ok) {\n\t\t\tconst oauthCode =\n\t\t\t\tisRecord(value) && typeof value.error === 'string'\n\t\t\t\t\t? value.error\n\t\t\t\t\t: `HTTP ${response.status}`;\n\t\t\tthrow new MobileAuthError(\n\t\t\t\t'oauth',\n\t\t\t\t`The authorization server rejected the token request (${oauthCode}).`\n\t\t\t);\n\t\t}\n\t\tconst tokens = parseTokenResponse(value);\n\t\tif (nonce)\n\t\t\tawait verifyIdToken({\n\t\t\t\tclientId: config.clientId,\n\t\t\t\tfetchImpl,\n\t\t\t\tidToken: tokens.id_token,\n\t\t\t\tissuer,\n\t\t\t\tjwksUri: metadata.jwks_uri,\n\t\t\t\tnonce,\n\t\t\t\tnow: now()\n\t\t\t});\n\n\t\treturn tokens;\n\t};\n\n\tconst acceptTokens = async (\n\t\ttokens: TokenResponse\n\t): Promise<MobileAuthTokens> => {\n\t\ttry {\n\t\t\tawait config.storage.set(REFRESH_KEY, tokens.refresh_token);\n\t\t} catch (cause) {\n\t\t\taccess = undefined;\n\t\t\tawait config.storage.remove(REFRESH_KEY).catch(() => undefined);\n\t\t\tthrow new MobileAuthError(\n\t\t\t\t'secure-storage',\n\t\t\t\t'The rotated refresh credential could not be saved securely.',\n\t\t\t\t{ cause }\n\t\t\t);\n\t\t}\n\t\taccess = {\n\t\t\taccessToken: tokens.access_token,\n\t\t\texpiresAt: now() + tokens.expires_in * 1000,\n\t\t\tidToken: tokens.id_token,\n\t\t\tscope: tokens.scope?.split(' ').filter(Boolean) ?? scopes,\n\t\t\ttokenType: 'Bearer'\n\t\t};\n\n\t\treturn { ...access, refreshToken: tokens.refresh_token };\n\t};\n\n\tconst rotateAccessToken = async () => {\n\t\tawait assertSecureStorage();\n\t\tconst refreshToken = await config.storage.get(REFRESH_KEY);\n\t\tif (!refreshToken)\n\t\t\tthrow new MobileAuthError(\n\t\t\t\t'token',\n\t\t\t\t'This app has no renewable mobile session.'\n\t\t\t);\n\t\tconst metadata = await discovery();\n\t\tconst body = new URLSearchParams({\n\t\t\tclient_id: config.clientId,\n\t\t\tgrant_type: 'refresh_token',\n\t\t\trefresh_token: refreshToken\n\t\t});\n\t\tbody.set('resource', resource);\n\t\tconst tokens = await tokenRequest(metadata, body);\n\n\t\treturn (await acceptTokens(tokens)).accessToken;\n\t};\n\n\tconst refreshAccessToken = async () => {\n\t\tif (access && access.expiresAt - clockSkewMs > now())\n\t\t\treturn access.accessToken;\n\t\tif (refreshPromise) return refreshPromise;\n\t\trefreshPromise = rotateAccessToken().finally(() => {\n\t\t\trefreshPromise = undefined;\n\t\t});\n\n\t\treturn refreshPromise;\n\t};\n\n\tconst handleCallback = async (value: string) => {\n\t\tif (!exactRedirect(value, redirectUri))\n\t\t\tthrow new MobileAuthError(\n\t\t\t\t'callback',\n\t\t\t\t'The authorization callback does not match this app registration.'\n\t\t\t);\n\t\tconst url = new URL(value);\n\t\tconst pending = parsePending(await config.storage.get(PENDING_KEY));\n\t\tif (!pending || now() - pending.createdAt > PENDING_TTL_MS) {\n\t\t\tawait config.storage.remove(PENDING_KEY).catch(() => undefined);\n\t\t\tthrow new MobileAuthError(\n\t\t\t\t'callback',\n\t\t\t\t'The authorization transaction is missing or expired.'\n\t\t\t);\n\t\t}\n\t\tconst deferred = pendingSignIns.get(pending.state);\n\t\tconst reject = (error: unknown) => {\n\t\t\tpendingSignIns.delete(pending.state);\n\t\t\tvoid config.storage.remove(PENDING_KEY);\n\t\t\tdeferred?.reject(error);\n\t\t\tthrow error;\n\t\t};\n\t\tif (url.searchParams.get('state') !== pending.state)\n\t\t\treturn reject(\n\t\t\t\tnew MobileAuthError(\n\t\t\t\t\t'callback',\n\t\t\t\t\t'The authorization callback state does not match.'\n\t\t\t\t)\n\t\t\t);\n\t\tif (url.searchParams.get('iss') !== issuer)\n\t\t\treturn reject(\n\t\t\t\tnew MobileAuthError(\n\t\t\t\t\t'callback',\n\t\t\t\t\t'The authorization callback issuer does not match.'\n\t\t\t\t)\n\t\t\t);\n\t\tconst oauthError = url.searchParams.get('error');\n\t\tif (oauthError) {\n\t\t\tawait config.storage.remove(PENDING_KEY);\n\n\t\t\treturn reject(\n\t\t\t\tnew MobileAuthError(\n\t\t\t\t\t'oauth',\n\t\t\t\t\t`Authorization failed (${oauthError}).`\n\t\t\t\t)\n\t\t\t);\n\t\t}\n\t\tconst code = url.searchParams.get('code');\n\t\tif (!code)\n\t\t\treturn reject(\n\t\t\t\tnew MobileAuthError(\n\t\t\t\t\t'callback',\n\t\t\t\t\t'The authorization callback contains no code.'\n\t\t\t\t)\n\t\t\t);\n\t\tawait config.storage.remove(PENDING_KEY);\n\t\ttry {\n\t\t\tconst metadata = await discovery();\n\t\t\tconst body = new URLSearchParams({\n\t\t\t\tclient_id: config.clientId,\n\t\t\t\tcode,\n\t\t\t\tcode_verifier: pending.verifier,\n\t\t\t\tgrant_type: 'authorization_code',\n\t\t\t\tredirect_uri: redirectUri\n\t\t\t});\n\t\t\tbody.set('resource', resource);\n\t\t\tconst tokens = await acceptTokens(\n\t\t\t\tawait tokenRequest(metadata, body, pending.nonce)\n\t\t\t);\n\t\t\tpendingSignIns.delete(pending.state);\n\t\t\tdeferred?.resolve(tokens);\n\n\t\t\treturn tokens;\n\t\t} catch (error) {\n\t\t\treturn reject(error);\n\t\t}\n\t};\n\n\tconst initialize = async () => {\n\t\tawait assertSecureStorage();\n\t\tstopLinks = await config.links.onOpen((url) => {\n\t\t\tif (exactRedirect(url, redirectUri))\n\t\t\t\tvoid handleCallback(url).catch(() => undefined);\n\t\t});\n\t\tif (config.lifecycle?.onResume)\n\t\t\tstopResume = await config.lifecycle.onResume(() => {\n\t\t\t\tvoid refreshAccessToken().catch(() => undefined);\n\t\t\t});\n\t\tconst launchUrl = await config.links.getLaunchUrl();\n\t\tif (launchUrl && exactRedirect(launchUrl, redirectUri))\n\t\t\tawait handleCallback(launchUrl);\n\t};\n\n\tconst start = () => {\n\t\tstartPromise ??= initialize();\n\n\t\treturn startPromise;\n\t};\n\n\tconst signIn = async (options: MobileAuthSignInOptions = {}) => {\n\t\tawait start();\n\t\tif (options.signal?.aborted)\n\t\t\tthrow new MobileAuthError(\n\t\t\t\t'aborted',\n\t\t\t\t'Authorization was cancelled.'\n\t\t\t);\n\t\tconst metadata = await discovery();\n\t\tconst pending: PendingAuthorization = {\n\t\t\tcreatedAt: now(),\n\t\t\tnonce: randomValue(),\n\t\t\tstate: randomValue(),\n\t\t\tverifier: randomValue()\n\t\t};\n\t\tawait config.storage.set(PENDING_KEY, JSON.stringify(pending));\n\t\tconst url = new URL(metadata.authorization_endpoint);\n\t\turl.search = new URLSearchParams({\n\t\t\tclient_id: config.clientId,\n\t\t\tcode_challenge: await pkceChallenge(pending.verifier),\n\t\t\tcode_challenge_method: 'S256',\n\t\t\tnonce: pending.nonce,\n\t\t\tredirect_uri: redirectUri,\n\t\t\tresponse_type: 'code',\n\t\t\tscope: scopes.join(' '),\n\t\t\tstate: pending.state,\n\t\t\t...options.authorizationParameters\n\t\t}).toString();\n\t\turl.searchParams.set('resource', resource);\n\t\tconst result = new Promise<MobileAuthTokens>((resolve, reject) => {\n\t\t\tpendingSignIns.set(pending.state, { reject, resolve });\n\t\t\toptions.signal?.addEventListener(\n\t\t\t\t'abort',\n\t\t\t\t() => {\n\t\t\t\t\tpendingSignIns.delete(pending.state);\n\t\t\t\t\tvoid config.storage.remove(PENDING_KEY);\n\t\t\t\t\treject(\n\t\t\t\t\t\tnew MobileAuthError(\n\t\t\t\t\t\t\t'aborted',\n\t\t\t\t\t\t\t'Authorization was cancelled.'\n\t\t\t\t\t\t)\n\t\t\t\t\t);\n\t\t\t\t},\n\t\t\t\t{ once: true }\n\t\t\t);\n\t\t});\n\t\ttry {\n\t\t\tawait config.links.openExternal(url.href);\n\t\t} catch (error) {\n\t\t\tpendingSignIns.delete(pending.state);\n\t\t\tawait config.storage.remove(PENDING_KEY);\n\t\t\tthrow error;\n\t\t}\n\n\t\treturn result;\n\t};\n\n\tconst authenticatedFetch = async (\n\t\tinput: RequestInfo | URL,\n\t\tinit?: RequestInit\n\t) => {\n\t\tconst original = new Request(input, init);\n\t\tif (!allowedOrigins.has(new URL(original.url).origin))\n\t\t\tthrow new MobileAuthError(\n\t\t\t\t'origin',\n\t\t\t\t'Mobile auth refused to send a credential to an unregistered origin.'\n\t\t\t);\n\t\tconst send = async (forceRefresh: boolean) => {\n\t\t\tif (forceRefresh) access = undefined;\n\t\t\tconst token = await refreshAccessToken();\n\t\t\tconst request = original.clone();\n\t\t\tconst headers = new Headers(request.headers);\n\t\t\theaders.set('authorization', `Bearer ${token}`);\n\n\t\t\treturn fetchImpl(\n\t\t\t\tnew Request(request, { credentials: 'omit', headers })\n\t\t\t);\n\t\t};\n\t\tconst response = await send(false);\n\n\t\treturn response.status === 401 ? send(true) : response;\n\t};\n\n\tconst optionalAuthenticatedFetch = async (\n\t\tinput: RequestInfo | URL,\n\t\tinit?: RequestInit\n\t) => {\n\t\tconst request = new Request(input, init);\n\t\tif (!allowedOrigins.has(new URL(request.url).origin))\n\t\t\tthrow new MobileAuthError(\n\t\t\t\t'origin',\n\t\t\t\t'Mobile auth refused to send a request outside an allowed origin.'\n\t\t\t);\n\t\tconst refreshToken = await config.storage.get(REFRESH_KEY);\n\t\tif (access || refreshToken) return authenticatedFetch(request);\n\n\t\treturn fetchImpl(new Request(request, { credentials: 'omit' }));\n\t};\n\n\tconst status = async () => {\n\t\ttry {\n\t\t\tconst metadata = await discovery();\n\t\t\tconst response = await authenticatedFetch(\n\t\t\t\tmetadata.userinfo_endpoint\n\t\t\t);\n\t\t\tif (response.status === 401) return null;\n\t\t\tif (!response.ok)\n\t\t\t\tthrow new MobileAuthError(\n\t\t\t\t\t'network',\n\t\t\t\t\t`User info failed with HTTP ${response.status}.`\n\t\t\t\t);\n\t\t\tconst user: unknown = await response.json();\n\t\t\tif (!isRecord(user) || typeof user.sub !== 'string')\n\t\t\t\tthrow new MobileAuthError(\n\t\t\t\t\t'token',\n\t\t\t\t\t'The user-info response is malformed.'\n\t\t\t\t);\n\n\t\t\treturn { ...user, sub: user.sub } satisfies MobileAuthUser;\n\t\t} catch (error) {\n\t\t\tif (\n\t\t\t\terror instanceof MobileAuthError &&\n\t\t\t\t(error.code === 'oauth' || error.code === 'token')\n\t\t\t)\n\t\t\t\treturn null;\n\t\t\tthrow error;\n\t\t}\n\t};\n\n\tconst socketTicket = async (audience = resource) => {\n\t\tconst metadata = await discovery();\n\t\tif (!metadata.socket_ticket_endpoint)\n\t\t\tthrow new MobileAuthError(\n\t\t\t\t'discovery',\n\t\t\t\t'The authorization server does not advertise WebSocket tickets.'\n\t\t\t);\n\t\tconst response = await authenticatedFetch(\n\t\t\tmetadata.socket_ticket_endpoint,\n\t\t\t{\n\t\t\t\tbody: JSON.stringify({ audience }),\n\t\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\t\tmethod: 'POST'\n\t\t\t}\n\t\t);\n\t\tconst body: unknown = await responseBody(response);\n\t\tif (!response.ok || !isRecord(body) || typeof body.ticket !== 'string')\n\t\t\tthrow new MobileAuthError(\n\t\t\t\tresponse.ok ? 'token' : 'oauth',\n\t\t\t\t`WebSocket ticket request failed with HTTP ${response.status}.`\n\t\t\t);\n\n\t\treturn body.ticket;\n\t};\n\n\tconst revokeRefreshToken = async (refreshToken: string) => {\n\t\tconst metadata = await discovery();\n\t\tif (metadata.revocation_endpoint)\n\t\t\tawait fetchImpl(metadata.revocation_endpoint, {\n\t\t\t\tbody: new URLSearchParams({\n\t\t\t\t\tclient_id: config.clientId,\n\t\t\t\t\ttoken: refreshToken,\n\t\t\t\t\ttoken_type_hint: 'refresh_token'\n\t\t\t\t}),\n\t\t\t\tcredentials: 'omit',\n\t\t\t\theaders: {\n\t\t\t\t\t'content-type': 'application/x-www-form-urlencoded'\n\t\t\t\t},\n\t\t\t\tmethod: 'POST'\n\t\t\t});\n\t};\n\n\tconst signOut = async () => {\n\t\tconst refreshToken = await config.storage.get(REFRESH_KEY);\n\t\ttry {\n\t\t\tif (refreshToken) await revokeRefreshToken(refreshToken);\n\t\t} finally {\n\t\t\taccess = undefined;\n\t\t\tawait Promise.all([\n\t\t\t\tconfig.storage.remove(PENDING_KEY),\n\t\t\t\tconfig.storage.remove(REFRESH_KEY)\n\t\t\t]);\n\t\t}\n\t};\n\n\tconst stop = async () => {\n\t\tawait Promise.all([stopLinks?.(), stopResume?.()]);\n\t\tstopLinks = undefined;\n\t\tstopResume = undefined;\n\t\tstartPromise = undefined;\n\t};\n\n\treturn {\n\t\tfetch: authenticatedFetch,\n\t\tfetchOptional: optionalAuthenticatedFetch,\n\t\thandleCallback,\n\t\trefresh: refreshAccessToken,\n\t\tsignIn,\n\t\tsignOut,\n\t\tsocketTicket,\n\t\tstart,\n\t\tstatus,\n\t\tstop\n\t};\n};\n\nexport type MobileAuthClient = ReturnType<typeof createMobileAuthClient>;\n\n/** Adapts the native OAuth lifecycle behind the same createAuthClient API used\n * by web applications. Passwords stay out of the WebView request path; the\n * external authorization UI owns credential entry and MFA. */\nexport const createMobileAuthTransport = (\n\tclient: MobileAuthClient\n): import('./createAuthClient').AuthClientTransport => ({\n\tfetch: client.fetch,\n\tsignInEmail: async ({ email }) => {\n\t\tawait client.signIn({\n\t\t\tauthorizationParameters: { login_hint: email }\n\t\t});\n\n\t\treturn { status: 'authenticated' };\n\t},\n\tsignOut: async () => {\n\t\tawait client.signOut();\n\n\t\treturn null;\n\t},\n\tsignUpEmail: async ({ email }) => {\n\t\tawait client.signIn({\n\t\t\tauthorizationParameters: {\n\t\t\t\tlogin_hint: email,\n\t\t\t\tscreen_hint: 'signup'\n\t\t\t}\n\t\t});\n\n\t\treturn { status: 'authenticated' };\n\t},\n\tstatus: async () => {\n\t\tconst user = await client.status();\n\n\t\treturn { user };\n\t}\n});\n",
     "// A value is a safe SAME-ORIGIN redirect target iff it begins with a single\n// '/' that is NOT followed by '/' or '\\'. Browsers normalize backslashes to\n// forward slashes, so '/\\evil.com' (and '/\\\\evil.com') resolve to the\n// protocol-relative '//evil.com' — an open redirect. Absolute URLs,\n// protocol-relative '//…', and backslash-prefixed paths are all rejected.\nexport const isSafeLocalPath = (value: string) => /^\\/(?![/\\\\])/.test(value);\n\n// Reduce an untrusted post-login redirect target to a safe same-origin path,\n// falling back to `fallback` (default '/') when it is not one.\nexport const toSafeLocalPath = (value: string | undefined, fallback = '/') =>\n\tvalue !== undefined && isSafeLocalPath(value) ? value : fallback;\n",
     "// Framework-agnostic glue between the WebAuthn ceremonies the package exposes via\n// `createAuthClient` and the browser's `navigator.credentials.{get,create}` APIs.\n// Used by the framework composables (`./react`, `./vue`, `./solid`, `./svelte`) so the\n// React + Vue + Solid + Svelte hooks all share the same imperative core; the framework\n// wrappers only add reactivity.\n//\n// `@simplewebauthn/browser` is an OPTIONAL peer dep — consumers that don't import any\n// of the passkey composables never load it. We dynamic-import lazily on first call so a\n// non-passkey consumer pays nothing at module load.\n\nimport type { AuthClient, AuthClientError } from './createAuthClient';\n\nconst loadBrowser = () => import('@simplewebauthn/browser');\n\nconst errorFor = (caught: unknown): AuthClientError => ({\n\tbody: null,\n\tmessage: caught instanceof Error ? caught.message : 'webauthn_failed',\n\tstatus: 0\n});\n\n// Runs the WebAuthn authentication ceremony in conditional-UI mode (the browser surfaces\n// saved passkeys directly via autofill on a focused `<input autocomplete=\"webauthn\">`).\n// Returns the same `{ data, error }` shape `createAuthClient` already uses, so composables\n// can pipe the result into their state setters unchanged.\nexport const runConditionalAuthentication = async (client: AuthClient) => {\n\tif (typeof window === 'undefined' || !window.PublicKeyCredential) {\n\t\treturn {\n\t\t\tdata: null,\n\t\t\terror: errorFor(new Error('webauthn_unavailable'))\n\t\t};\n\t}\n\tconst options = await client.passkeys.authenticateOptions();\n\tif (options.error) return { data: null, error: options.error };\n\ttry {\n\t\tconst { startAuthentication } = await loadBrowser();\n\t\tconst credential = await startAuthentication({\n\t\t\toptionsJSON: options.data,\n\t\t\tuseBrowserAutofill: true\n\t\t});\n\n\t\treturn client.passkeys.authenticateVerify(credential);\n\t} catch (caught) {\n\t\treturn { data: null, error: errorFor(caught) };\n\t}\n};\n\n// Runs the WebAuthn registration ceremony for the currently authenticated user. Used by\n// the \"upgrade to passkey\" prompt — after a password sign-in, surface a \"save a passkey\n// to this device for next time?\" CTA.\nexport const runPasskeyRegistration = async (client: AuthClient) => {\n\tif (typeof window === 'undefined' || !window.PublicKeyCredential) {\n\t\treturn {\n\t\t\tdata: null,\n\t\t\terror: errorFor(new Error('webauthn_unavailable'))\n\t\t};\n\t}\n\tconst options = await client.passkeys.registerOptions();\n\tif (options.error) return { data: null, error: options.error };\n\ttry {\n\t\tconst { startRegistration } = await loadBrowser();\n\t\tconst credential = await startRegistration({\n\t\t\toptionsJSON: options.data\n\t\t});\n\n\t\treturn client.passkeys.registerVerify(credential);\n\t} catch (caught) {\n\t\treturn { data: null, error: errorFor(caught) };\n\t}\n};\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CA,IAAM,iBAA6C;AAAA,EAClD,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,OAAO;AAAA,EACP,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,eAAe;AAAA,EACf,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,4BAA4B;AAAA,EAC5B,2BAA2B;AAAA,EAC3B,aAAa;AAAA,EACb,wBAAwB;AAAA,EACxB,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AAAA,EACT,QAAQ;AACT;AASA,IAAM,UAAU,CAAI,UAAkC;AAAA,EACrD;AAAA,EACA,OAAO;AACR;AAEA,IAAM,OAAO,CAAC,WAAqD;AAAA,EAClE,MAAM;AAAA,EACN;AACD;AAEA,IAAM,WAAW,CAAC,UAAoB,UAAoC;AAAA,EACzE;AAAA,EACA,SACC,OAAO,SAAS,WACb,OACC,YAAY,IAAI,KAAK,SAAS;AAAA,EACnC,QAAQ,SAAS;AAClB;AAEO,IAAM,mBAAmB;AAAA,EAC/B,UAAU;AAAA,EACV,cAAc;AAAA,EACd,OAAO,YAAY;AAAA,EACnB;AAAA,IACqB,CAAC,MAAM;AAAA,EAC5B,MAAM,iBAA6C;AAAA,OAC/C;AAAA,OACA;AAAA,EACJ;AAAA,EAEA,MAAM,UAAU,OAAU,MAAc,SAAsB;AAAA,IAC7D,IAAI;AAAA,MACH,MAAM,WAAW,MAAM,UAAU,GAAG,UAAU,QAAQ;AAAA,QACrD;AAAA,WACG;AAAA,MACJ,CAAC;AAAA,MACD,MAAM,OAAO,MAAM,SAAS,KAAK;AAAA,MACjC,IAAI,CAAC,SAAS;AAAA,QAAI,OAAO,KAAK,SAAS,UAAU,SAAS,IAAI,CAAC,CAAC;AAAA,MAEhE,MAAM,OAAU,KAAK,MAAM,SAAS,KAAK,SAAS,IAAI;AAAA,MAEtD,OAAO,QAAQ,IAAI;AAAA,MAClB,OAAO,QAAQ;AAAA,MAChB,MAAM,UACL,kBAAkB,QAAQ,OAAO,UAAU;AAAA,MAE5C,OAAO,KAAK,EAAE,MAAM,MAAM,SAAS,QAAQ,EAAE,CAAC;AAAA;AAAA;AAAA,EAIhD,MAAM,OAAO,CAAI,MAAc,MAAgB,SAAS,WACvD,QAAW,MAAM;AAAA,IAChB,MAAM,SAAS,YAAY,YAAY,KAAK,UAAU,IAAI;AAAA,IAC1D,SACC,SAAS,YACN,YACA,EAAE,gBAAgB,mBAAmB;AAAA,IACzC;AAAA,EACD,CAAC;AAAA,EAEF,MAAM,MAAM,CAAI,SAAiB,QAAW,MAAM,EAAE,QAAQ,MAAM,CAAC;AAAA,EAEnE,MAAM,MAAM,CAAI,SAAiB,QAAW,MAAM,EAAE,QAAQ,SAAS,CAAC;AAAA,EAEtE,OAAO;AAAA,IACN,mBAAmB;AAAA,MAClB,SAAS,CAAC,SACT,KAAmB,eAAe,oBAAoB,IAAI;AAAA,MAC3D,QAAQ,CAAC,SACR,KAAmB,eAAe,aAAa,IAAI;AAAA,IACrD;AAAA,IACA,KAAK;AAAA,MACJ,WAAW,CAAC,SACX,KACC,eAAe,cACf,IACD;AAAA,MACD,SAAS,MACR,IAA4B,eAAe,aAAa;AAAA,MACzD,OAAO,MACN,KAAsC,eAAe,QAAQ;AAAA,MAC9D,QAAQ,MACP,IACC,eAAe,aAChB;AAAA,MACD,aAAa,CAAC,SACb,KACC,eAAe,gBACf,IACD;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACT,qBAAqB,MACpB,KACC,eAAe,0BAChB;AAAA,MACD,oBAAoB,CAAC,aACpB,KACC,eAAe,2BACf,QACD;AAAA,MACD,MAAM,MAAM,IAAe,eAAe,WAAW;AAAA,MACrD,iBAAiB,MAChB,KACC,eAAe,sBAChB;AAAA,MACD,gBAAgB,CAAC,aAChB,KACC,eAAe,uBACf,QACD;AAAA,MACD,QAAQ,CAAC,iBACR,IACC,GAAG,eAAe,iBAAiB,mBAAmB,YAAY,GACnE;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACb,kBAAkB,CAAC,SAClB,KAAmB,eAAe,kBAAkB,IAAI;AAAA,MACzD,iBAAiB,CAAC,SACjB,KACC,eAAe,iBACf,IACD;AAAA,IACF;AAAA,IACA,eAAe;AAAA,MACd,SAAS,CAAC,SACT,KAAmB,eAAe,eAAe,IAAI;AAAA,MACtD,SAAS,CAAC,SACT,KAAmB,eAAe,sBAAsB,IAAI;AAAA,IAC9D;AAAA,IACA,UAAU;AAAA,MACT,MAAM,MAAM,IAAe,eAAe,QAAQ;AAAA,MAClD,QAAQ,CAAC,cACR,IACC,GAAG,eAAe,YAAY,mBAAmB,SAAS,GAC3D;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACP,OAAO,CAAC,SACP,KAGG,eAAe,OAAO,IAAI;AAAA,IAC/B;AAAA,IACA,QAAQ;AAAA,MACP,OAAO,CAAC,SAKP,KAGE,eAAe,UAAU,IAAI;AAAA,IACjC;AAAA,IACA,SAAS,MAAM,IAAU,eAAe,OAAO;AAAA,IAC/C,QAAQ,MACP,IACC,eAAe,MAChB;AAAA,EACF;AAAA;AAGD,IAAM,WAAW,CAAC,SAAiB;AAAA,EAClC,IAAI;AAAA,IACH,OAAO,KAAK,MAAM,IAAI;AAAA,IACrB,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAIT,IAAM,cAAc,CAAC,SAAkB;AAAA,EACtC,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,UAAmB,QAAQ,IAAI,MAAM,SAAS;AAAA,EAEpD,OAAO,OAAO,YAAY,WAAW,UAAU;AAAA;;AC9PhD,IAAM,4BAA4B;AAClC,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAC7B,IAAM,2BAA2B;AACjC,IAAM,uBAAuB;AAC7B,IAAM,sBAAsB;AAC5B,IAAM,oBAAoB;AAwB1B,IAAI,cAAyC;AAE7C,IAAM,aAAa,CAAC,OAA0B,WAAmB;AAAA,EAChE,MAAM,MAAM,iBAAiB,UAAU,MAAM,MAAM,OAAO,KAAK;AAAA,EAE/D,IAAI;AAAA,IACH,OAAO,IAAI,IAAI,KAAK,MAAM;AAAA,IACzB,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAIF,IAAM,+BAA+B;AAAA,EAC3C;AAAA,EACA,SAAS;AAAA,EACT,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,aAAa;AAAA,MAOR;AAAA,EACL,MAAM,UAAU,IAAI,IAAI,WAAW;AAAA,EACnC,MAAM,WAAW,GAAG,QAAQ,WAAW,QAAQ,SAAS,QAAQ;AAAA,EAChE,MAAM,cAAc,IAAI,IAAI,YAAY,QAAQ,MAAM;AAAA,EACtD,YAAY,aAAa,IAAI,aAAa,MAAM;AAAA,EAChD,YAAY,aAAa,IAAI,gBAAgB,QAAQ;AAAA,EAErD,OAAO,YAAY,WAAW,QAAQ,SACnC,GAAG,YAAY,WAAW,YAAY,SAAS,YAAY,SAC3D,YAAY,SAAS;AAAA;AAQlB,IAAM,4BAA4B,CACxC,SAAmC,CAAC,MAChC;AAAA,EACJ,IAAI,OAAO,WAAW,eAAe,OAAO,aAAa,aAAa;AAAA,IACrE,OAAO,EAAE,OAAO,YAAY,OAAO,SAAS,MAAG;AAAA,MAAG;AAAA,MAAU;AAAA,EAC7D;AAAA,EACA,IAAI;AAAA,IAAa,OAAO;AAAA,EAExB;AAAA,IACC,kBAAkB;AAAA,IAClB;AAAA,IACA;AAAA,IACA,iBAAiB,CAAC;AAAA,IAClB,SAAS;AAAA,IACT,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb,aAAa;AAAA,MACV;AAAA,EACJ,MAAM,cAAc,OAAO,MAAM,KAAK,MAAM;AAAA,EAC5C,MAAM,gBAAgB,OAAO;AAAA,EAC7B,IAAI,WAAW;AAAA,EACf,IAAI,WAAW;AAAA,EACf,IAAI,UAAU;AAAA,EACd,IAAI,gBAAgB,KAAK,IAAI;AAAA,EAE7B,MAAM,SAAS,MAAM;AAAA,IACpB,IAAI,WAAW;AAAA,MAAU;AAAA,IACzB,UAAU;AAAA,IACV,MAAM,cAAc,OAAO,SAAS;AAAA,IACpC,MAAM,YAAY,6BAA6B;AAAA,MAC9C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACD,CAAC;AAAA,IACD,MAAM,UAAU,IAAI,IAAI,WAAW;AAAA,IACnC,MAAM,WAAW,GAAG,QAAQ,WAAW,QAAQ,SAAS,QAAQ;AAAA,IAChE,IAAI,WAAW;AAAA,MACd,UAAU,EAAE,UAAU,UAAU,CAAC;AAAA,MAEjC;AAAA,IACD;AAAA,IACA,OAAO,SAAS,OAAO,SAAS;AAAA;AAAA,EAGjC,MAAM,mBAAmB,CAAC,UAA6B;AAAA,IACtD,MAAM,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM;AAAA,IACpD,IAAI,CAAC,OAAO,IAAI,WAAW,OAAO,SAAS;AAAA,MAAQ,OAAO;AAAA,IAC1D,IACC,IAAI,IAAI,YAAY,OAAO,SAAS,MAAM,EAAE,aAC5C,IAAI;AAAA,MAEJ,OAAO;AAAA,IAER,OACC,qBAAqB,GAAG,MAAM,QAC9B,eAAe,KAAK,CAAC,SAAS,IAAI,SAAS,WAAW,IAAI,CAAC;AAAA;AAAA,EAI7D,MAAM,eAAe,IAAI,MAAM,eAAe;AAAA,IAC7C,OAAO,OAAO,QAAQ,SAAS,SAAS;AAAA,MACvC,OAAO,SAAS;AAAA,MAChB,MAAM,WAAW,MAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI;AAAA,MAC1D,IACC,SAAS,WAAW,qBACpB,iBAAiB,KAAK,GACrB;AAAA,QACD,OAAO;AAAA,MACR;AAAA,MAEA,OAAO;AAAA;AAAA,EAET,CAAC;AAAA,EACD,OAAO,QAAQ;AAAA,EAEf,MAAM,QAAQ,YAAY;AAAA,IACzB,IAAI,YAAY,WAAW;AAAA,MAAU,OAAO;AAAA,IAC5C,WAAW;AAAA,IACX,gBAAgB,KAAK,IAAI;AAAA,IACzB,IAAI;AAAA,MACH,MAAM,WAAW,MAAM,YAAY,YAAY;AAAA,QAC9C,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS,EAAE,QAAQ,mBAAmB;AAAA,MACvC,CAAC;AAAA,MACD,IAAI,CAAC,SAAS;AAAA,QAAI,OAAO;AAAA,MACzB,MAAM,UAAmB,MAAM,SAAS,KAAK;AAAA,MAC7C,MAAM,iBACL,OAAO,YAAY,YACnB,YAAY,QACZ,QAAQ,IAAI,SAAS,MAAM,MAAM;AAAA,MAClC,IAAI,CAAC;AAAA,QAAgB,OAAO;AAAA,MAC5B,OAAO;AAAA,MAEP,OAAO;AAAA,MACN,MAAM;AAAA,MAEP,OAAO;AAAA,cACN;AAAA,MACD,WAAW;AAAA;AAAA;AAAA,EAIb,MAAM,aAAa,MAAM;AAAA,IACxB,IACC,SAAS,oBAAoB,aAC7B,KAAK,IAAI,IAAI,gBAAgB;AAAA,MAE7B;AAAA,IACI,MAAM;AAAA;AAAA,EAEZ,MAAM,wBAAwB,CAAC,UAA+B;AAAA,IAC7D,IAAI,CAAC,MAAM;AAAA,MAAW;AAAA,IACjB,MAAM;AAAA;AAAA,EAEZ,MAAM,UAAU,MAAM;AAAA,IACrB,IAAI;AAAA,MAAU;AAAA,IACd,WAAW;AAAA,IACX,SAAS,oBAAoB,oBAAoB,UAAU;AAAA,IAC3D,OAAO,oBAAoB,SAAS,UAAU;AAAA,IAC9C,OAAO,oBAAoB,YAAY,qBAAqB;AAAA,IAC5D,IAAI,OAAO,UAAU;AAAA,MAAc,OAAO,QAAQ;AAAA,IAClD,cAAc;AAAA;AAAA,EAGf,SAAS,iBAAiB,oBAAoB,UAAU;AAAA,EACxD,OAAO,iBAAiB,SAAS,UAAU;AAAA,EAC3C,OAAO,iBAAiB,YAAY,qBAAqB;AAAA,EACzD,cAAc,EAAE,OAAO,QAAQ;AAAA,EAE/B,OAAO;AAAA;AAGD,IAAM,4BAA4B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,MAKK;AAAA,EACL,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,EAEpC,OACC,KAAK,WAAW,UAChB,eAAe,KAAK,CAAC,SAAS,IAAI,SAAS,WAAW,IAAI,CAAC;AAAA;;ACvNtD,IAAM,kBAAkB,CAAC,UAAkB,eAAe,KAAK,KAAK;AAIpE,IAAM,kBAAkB,CAAC,OAA2B,WAAW,QACrE,UAAU,aAAa,gBAAgB,KAAK,IAAI,QAAQ;;ACEzD,IAAM,cAAc,MAAa;AAEjC,IAAM,YAAW,CAAC,YAAsC;AAAA,EACvD,MAAM;AAAA,EACN,SAAS,kBAAkB,QAAQ,OAAO,UAAU;AAAA,EACpD,QAAQ;AACT;AAMO,IAAM,+BAA+B,OAAO,WAAuB;AAAA,EACzE,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,qBAAqB;AAAA,IACjE,OAAO;AAAA,MACN,MAAM;AAAA,MACN,OAAO,UAAS,IAAI,MAAM,sBAAsB,CAAC;AAAA,IAClD;AAAA,EACD;AAAA,EACA,MAAM,UAAU,MAAM,OAAO,SAAS,oBAAoB;AAAA,EAC1D,IAAI,QAAQ;AAAA,IAAO,OAAO,EAAE,MAAM,MAAM,OAAO,QAAQ,MAAM;AAAA,EAC7D,IAAI;AAAA,IACH,QAAQ,wBAAwB,MAAM,YAAY;AAAA,IAClD,MAAM,aAAa,MAAM,oBAAoB;AAAA,MAC5C,aAAa,QAAQ;AAAA,MACrB,oBAAoB;AAAA,IACrB,CAAC;AAAA,IAED,OAAO,OAAO,SAAS,mBAAmB,UAAU;AAAA,IACnD,OAAO,QAAQ;AAAA,IAChB,OAAO,EAAE,MAAM,MAAM,OAAO,UAAS,MAAM,EAAE;AAAA;AAAA;AAOxC,IAAM,yBAAyB,OAAO,WAAuB;AAAA,EACnE,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,qBAAqB;AAAA,IACjE,OAAO;AAAA,MACN,MAAM;AAAA,MACN,OAAO,UAAS,IAAI,MAAM,sBAAsB,CAAC;AAAA,IAClD;AAAA,EACD;AAAA,EACA,MAAM,UAAU,MAAM,OAAO,SAAS,gBAAgB;AAAA,EACtD,IAAI,QAAQ;AAAA,IAAO,OAAO,EAAE,MAAM,MAAM,OAAO,QAAQ,MAAM;AAAA,EAC7D,IAAI;AAAA,IACH,QAAQ,sBAAsB,MAAM,YAAY;AAAA,IAChD,MAAM,aAAa,MAAM,kBAAkB;AAAA,MAC1C,aAAa,QAAQ;AAAA,IACtB,CAAC;AAAA,IAED,OAAO,OAAO,SAAS,eAAe,UAAU;AAAA,IAC/C,OAAO,QAAQ;AAAA,IAChB,OAAO,EAAE,MAAM,MAAM,OAAO,UAAS,MAAM,EAAE;AAAA;AAAA;",
-  "debugId": "E8018F05FE86589464756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CA,IAAM,iBAA6C;AAAA,EAClD,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,OAAO;AAAA,EACP,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,eAAe;AAAA,EACf,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,4BAA4B;AAAA,EAC5B,2BAA2B;AAAA,EAC3B,aAAa;AAAA,EACb,wBAAwB;AAAA,EACxB,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AAAA,EACT,QAAQ;AACT;AAmCA,IAAM,UAAU,CAAI,UAAkC;AAAA,EACrD;AAAA,EACA,OAAO;AACR;AAEA,IAAM,OAAO,CAAC,WAAqD;AAAA,EAClE,MAAM;AAAA,EACN;AACD;AAEA,IAAM,WAAW,CAAC,UAAoB,UAAoC;AAAA,EACzE;AAAA,EACA,SACC,OAAO,SAAS,WACb,OACC,YAAY,IAAI,KAAK,SAAS;AAAA,EACnC,QAAQ,SAAS;AAClB;AAEO,IAAM,mBAAmB;AAAA,EAC/B,UAAU;AAAA,EACV,cAAc;AAAA,EACd,OAAO,YAAY;AAAA,EACnB;AAAA,EACA;AAAA,IACqB,CAAC,MAAM;AAAA,EAC5B,MAAM,gBAAgB,WAAW,SAAS;AAAA,EAC1C,MAAM,cAAc,WAAW;AAAA,EAC/B,MAAM,UAAU,WAAW;AAAA,EAC3B,MAAM,cAAc,WAAW;AAAA,EAC/B,MAAM,kBAAkB,WAAW;AAAA,EACnC,MAAM,iBAA6C;AAAA,OAC/C;AAAA,OACA;AAAA,EACJ;AAAA,EAEA,MAAM,UAAU,OAAU,MAAc,SAAsB;AAAA,IAC7D,IAAI;AAAA,MACH,MAAM,WAAW,MAAM,cAAc,GAAG,UAAU,QAAQ;AAAA,QACzD;AAAA,WACG;AAAA,MACJ,CAAC;AAAA,MACD,MAAM,OAAO,MAAM,SAAS,KAAK;AAAA,MACjC,IAAI,CAAC,SAAS;AAAA,QAAI,OAAO,KAAK,SAAS,UAAU,SAAS,IAAI,CAAC,CAAC;AAAA,MAEhE,MAAM,OAAU,KAAK,MAAM,SAAS,KAAK,SAAS,IAAI;AAAA,MAEtD,OAAO,QAAQ,IAAI;AAAA,MAClB,OAAO,QAAQ;AAAA,MAChB,MAAM,UACL,kBAAkB,QAAQ,OAAO,UAAU;AAAA,MAE5C,OAAO,KAAK,EAAE,MAAM,MAAM,SAAS,QAAQ,EAAE,CAAC;AAAA;AAAA;AAAA,EAGhD,MAAM,eAAe,OAAU,cAAgC;AAAA,IAC9D,IAAI;AAAA,MACH,OAAO,QAAQ,MAAM,UAAU,CAAC;AAAA,MAC/B,OAAO,QAAQ;AAAA,MAChB,MAAM,UACL,kBAAkB,QAAQ,OAAO,UAAU;AAAA,MAE5C,OAAO,KAAK,EAAE,MAAM,MAAM,SAAS,QAAQ,EAAE,CAAC;AAAA;AAAA;AAAA,EAIhD,MAAM,OAAO,CAAI,MAAc,MAAgB,SAAS,WACvD,QAAW,MAAM;AAAA,IAChB,MAAM,SAAS,YAAY,YAAY,KAAK,UAAU,IAAI;AAAA,IAC1D,SACC,SAAS,YACN,YACA,EAAE,gBAAgB,mBAAmB;AAAA,IACzC;AAAA,EACD,CAAC;AAAA,EAEF,MAAM,MAAM,CAAI,SAAiB,QAAW,MAAM,EAAE,QAAQ,MAAM,CAAC;AAAA,EAEnE,MAAM,MAAM,CAAI,SAAiB,QAAW,MAAM,EAAE,QAAQ,SAAS,CAAC;AAAA,EAEtE,OAAO;AAAA,IACN,mBAAmB;AAAA,MAClB,SAAS,CAAC,SACT,KAAmB,eAAe,oBAAoB,IAAI;AAAA,MAC3D,QAAQ,CAAC,SACR,KAAmB,eAAe,aAAa,IAAI;AAAA,IACrD;AAAA,IACA,KAAK;AAAA,MACJ,WAAW,CAAC,SACX,KACC,eAAe,cACf,IACD;AAAA,MACD,SAAS,MACR,IAA4B,eAAe,aAAa;AAAA,MACzD,OAAO,MACN,KAAsC,eAAe,QAAQ;AAAA,MAC9D,QAAQ,MACP,IACC,eAAe,aAChB;AAAA,MACD,aAAa,CAAC,SACb,KACC,eAAe,gBACf,IACD;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACT,qBAAqB,MACpB,KACC,eAAe,0BAChB;AAAA,MACD,oBAAoB,CAAC,aACpB,KACC,eAAe,2BACf,QACD;AAAA,MACD,MAAM,MAAM,IAAe,eAAe,WAAW;AAAA,MACrD,iBAAiB,MAChB,KACC,eAAe,sBAChB;AAAA,MACD,gBAAgB,CAAC,aAChB,KACC,eAAe,uBACf,QACD;AAAA,MACD,QAAQ,CAAC,iBACR,IACC,GAAG,eAAe,iBAAiB,mBAAmB,YAAY,GACnE;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACb,kBAAkB,CAAC,SAClB,KAAmB,eAAe,kBAAkB,IAAI;AAAA,MACzD,iBAAiB,CAAC,SACjB,KACC,eAAe,iBACf,IACD;AAAA,IACF;AAAA,IACA,eAAe;AAAA,MACd,SAAS,CAAC,SACT,KAAmB,eAAe,eAAe,IAAI;AAAA,MACtD,SAAS,CAAC,SACT,KAAmB,eAAe,sBAAsB,IAAI;AAAA,IAC9D;AAAA,IACA,UAAU;AAAA,MACT,MAAM,MAAM,IAAe,eAAe,QAAQ;AAAA,MAClD,QAAQ,CAAC,cACR,IACC,GAAG,eAAe,YAAY,mBAAmB,SAAS,GAC3D;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACP,OAAO,CAAC,SACP,cACG,aAAa,MAAM,YAAY,IAAI,CAAC,IACpC,KAGE,eAAe,OAAO,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,MACP,OAAO,CAAC,SAKP,cACG,aAAa,MAAM,YAAY,IAAI,CAAC,IACpC,KAGC,eAAe,UAAU,IAAI;AAAA,IACnC;AAAA,IACA,SAAS,MACR,UACG,aAAa,MAAM,QAAQ,CAAC,IAC5B,IAAU,eAAe,OAAO;AAAA,IACpC,QAAQ,MACP,kBACG,aAAa,MAAM,gBAAgB,CAAC,IACpC,IACA,eAAe,MAChB;AAAA,EACJ;AAAA;AAGD,IAAM,WAAW,CAAC,SAAiB;AAAA,EAClC,IAAI;AAAA,IACH,OAAO,KAAK,MAAM,IAAI;AAAA,IACrB,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAIT,IAAM,cAAc,CAAC,SAAkB;AAAA,EACtC,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,MAAM,UAAmB,QAAQ,IAAI,MAAM,SAAS;AAAA,EAEpD,OAAO,OAAO,YAAY,WAAW,UAAU;AAAA;;ACjThD,IAAM,4BAA4B;AAClC,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAC7B,IAAM,2BAA2B;AACjC,IAAM,uBAAuB;AAC7B,IAAM,sBAAsB;AAC5B,IAAM,oBAAoB;AAwB1B,IAAI,cAAyC;AAE7C,IAAM,aAAa,CAAC,OAA0B,WAAmB;AAAA,EAChE,MAAM,MAAM,iBAAiB,UAAU,MAAM,MAAM,OAAO,KAAK;AAAA,EAE/D,IAAI;AAAA,IACH,OAAO,IAAI,IAAI,KAAK,MAAM;AAAA,IACzB,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAIF,IAAM,+BAA+B;AAAA,EAC3C;AAAA,EACA,SAAS;AAAA,EACT,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,aAAa;AAAA,MAOR;AAAA,EACL,MAAM,UAAU,IAAI,IAAI,WAAW;AAAA,EACnC,MAAM,WAAW,GAAG,QAAQ,WAAW,QAAQ,SAAS,QAAQ;AAAA,EAChE,MAAM,cAAc,IAAI,IAAI,YAAY,QAAQ,MAAM;AAAA,EACtD,YAAY,aAAa,IAAI,aAAa,MAAM;AAAA,EAChD,YAAY,aAAa,IAAI,gBAAgB,QAAQ;AAAA,EAErD,OAAO,YAAY,WAAW,QAAQ,SACnC,GAAG,YAAY,WAAW,YAAY,SAAS,YAAY,SAC3D,YAAY,SAAS;AAAA;AAQlB,IAAM,4BAA4B,CACxC,SAAmC,CAAC,MAChC;AAAA,EACJ,IAAI,OAAO,WAAW,eAAe,OAAO,aAAa,aAAa;AAAA,IACrE,OAAO,EAAE,OAAO,YAAY,OAAO,SAAS,MAAG;AAAA,MAAG;AAAA,MAAU;AAAA,EAC7D;AAAA,EACA,IAAI;AAAA,IAAa,OAAO;AAAA,EAExB;AAAA,IACC,kBAAkB;AAAA,IAClB;AAAA,IACA;AAAA,IACA,iBAAiB,CAAC;AAAA,IAClB,SAAS;AAAA,IACT,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb,aAAa;AAAA,MACV;AAAA,EACJ,MAAM,cAAc,OAAO,MAAM,KAAK,MAAM;AAAA,EAC5C,MAAM,gBAAgB,OAAO;AAAA,EAC7B,IAAI,WAAW;AAAA,EACf,IAAI,WAAW;AAAA,EACf,IAAI,UAAU;AAAA,EACd,IAAI,gBAAgB,KAAK,IAAI;AAAA,EAE7B,MAAM,SAAS,MAAM;AAAA,IACpB,IAAI,WAAW;AAAA,MAAU;AAAA,IACzB,UAAU;AAAA,IACV,MAAM,cAAc,OAAO,SAAS;AAAA,IACpC,MAAM,YAAY,6BAA6B;AAAA,MAC9C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACD,CAAC;AAAA,IACD,MAAM,UAAU,IAAI,IAAI,WAAW;AAAA,IACnC,MAAM,WAAW,GAAG,QAAQ,WAAW,QAAQ,SAAS,QAAQ;AAAA,IAChE,IAAI,WAAW;AAAA,MACd,UAAU,EAAE,UAAU,UAAU,CAAC;AAAA,MAEjC;AAAA,IACD;AAAA,IACA,OAAO,SAAS,OAAO,SAAS;AAAA;AAAA,EAGjC,MAAM,mBAAmB,CAAC,UAA6B;AAAA,IACtD,MAAM,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM;AAAA,IACpD,IAAI,CAAC,OAAO,IAAI,WAAW,OAAO,SAAS;AAAA,MAAQ,OAAO;AAAA,IAC1D,IACC,IAAI,IAAI,YAAY,OAAO,SAAS,MAAM,EAAE,aAC5C,IAAI;AAAA,MAEJ,OAAO;AAAA,IAER,OACC,qBAAqB,GAAG,MAAM,QAC9B,eAAe,KAAK,CAAC,SAAS,IAAI,SAAS,WAAW,IAAI,CAAC;AAAA;AAAA,EAI7D,MAAM,eAAe,IAAI,MAAM,eAAe;AAAA,IAC7C,OAAO,OAAO,QAAQ,SAAS,SAAS;AAAA,MACvC,OAAO,SAAS;AAAA,MAChB,MAAM,WAAW,MAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI;AAAA,MAC1D,IACC,SAAS,WAAW,qBACpB,iBAAiB,KAAK,GACrB;AAAA,QACD,OAAO;AAAA,MACR;AAAA,MAEA,OAAO;AAAA;AAAA,EAET,CAAC;AAAA,EACD,OAAO,QAAQ;AAAA,EAEf,MAAM,QAAQ,YAAY;AAAA,IACzB,IAAI,YAAY,WAAW;AAAA,MAAU,OAAO;AAAA,IAC5C,WAAW;AAAA,IACX,gBAAgB,KAAK,IAAI;AAAA,IACzB,IAAI;AAAA,MACH,MAAM,WAAW,MAAM,YAAY,YAAY;AAAA,QAC9C,OAAO;AAAA,QACP,aAAa;AAAA,QACb,SAAS,EAAE,QAAQ,mBAAmB;AAAA,MACvC,CAAC;AAAA,MACD,IAAI,CAAC,SAAS;AAAA,QAAI,OAAO;AAAA,MACzB,MAAM,UAAmB,MAAM,SAAS,KAAK;AAAA,MAC7C,MAAM,iBACL,OAAO,YAAY,YACnB,YAAY,QACZ,QAAQ,IAAI,SAAS,MAAM,MAAM;AAAA,MAClC,IAAI,CAAC;AAAA,QAAgB,OAAO;AAAA,MAC5B,OAAO;AAAA,MAEP,OAAO;AAAA,MACN,MAAM;AAAA,MAEP,OAAO;AAAA,cACN;AAAA,MACD,WAAW;AAAA;AAAA;AAAA,EAIb,MAAM,aAAa,MAAM;AAAA,IACxB,IACC,SAAS,oBAAoB,aAC7B,KAAK,IAAI,IAAI,gBAAgB;AAAA,MAE7B;AAAA,IACI,MAAM;AAAA;AAAA,EAEZ,MAAM,wBAAwB,CAAC,UAA+B;AAAA,IAC7D,IAAI,CAAC,MAAM;AAAA,MAAW;AAAA,IACjB,MAAM;AAAA;AAAA,EAEZ,MAAM,UAAU,MAAM;AAAA,IACrB,IAAI;AAAA,MAAU;AAAA,IACd,WAAW;AAAA,IACX,SAAS,oBAAoB,oBAAoB,UAAU;AAAA,IAC3D,OAAO,oBAAoB,SAAS,UAAU;AAAA,IAC9C,OAAO,oBAAoB,YAAY,qBAAqB;AAAA,IAC5D,IAAI,OAAO,UAAU;AAAA,MAAc,OAAO,QAAQ;AAAA,IAClD,cAAc;AAAA;AAAA,EAGf,SAAS,iBAAiB,oBAAoB,UAAU;AAAA,EACxD,OAAO,iBAAiB,SAAS,UAAU;AAAA,EAC3C,OAAO,iBAAiB,YAAY,qBAAqB;AAAA,EACzD,cAAc,EAAE,OAAO,QAAQ;AAAA,EAE/B,OAAO;AAAA;AAGD,IAAM,4BAA4B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,MAKK;AAAA,EACL,MAAM,MAAM,WAAW,OAAO,MAAM;AAAA,EAEpC,OACC,KAAK,WAAW,UAChB,eAAe,KAAK,CAAC,SAAS,IAAI,SAAS,WAAW,IAAI,CAAC;AAAA;;AChJtD,MAAM,wBAAwB,MAAM;AAAA,EACjC;AAAA,EACA;AAAA,EAET,WAAW,CACV,MACA,SACA,SACC;AAAA,IACD,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,KAAK,OAAO;AAAA,IACZ,KAAK,QAAQ,SAAS;AAAA;AAExB;AAuBA,IAAM,cAAc;AACpB,IAAM,cAAc;AACpB,IAAM,wBAAwB;AAC9B,IAAM,iBAAiB,KAAK;AAC5B,IAAM,eAAe;AAErB,IAAM,WAAW,CAAC,UACjB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAEpE,IAAM,YAAY,CAAC,UAAsB;AAAA,EACxC,IAAI,SAAS;AAAA,EACb,WAAW,QAAQ;AAAA,IAAO,UAAU,OAAO,aAAa,IAAI;AAAA,EAE5D,OAAO,KAAK,MAAM,EAChB,WAAW,KAAK,GAAG,EACnB,WAAW,KAAK,GAAG,EACnB,QAAQ,QAAQ,EAAE;AAAA;AAGrB,IAAM,kBAAkB,CAAC,UAAkB;AAAA,EAC1C,MAAM,aAAa,MAAM,WAAW,KAAK,GAAG,EAAE,WAAW,KAAK,GAAG;AAAA,EACjE,MAAM,SAAS,WAAW,OACzB,WAAW,UAAW,IAAK,WAAW,SAAS,KAAM,GACrD,GACD;AAAA,EACA,MAAM,SAAS,KAAK,MAAM;AAAA,EAE1B,OAAO,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AAAA;AAGtE,IAAM,cAAc,MAAM;AAAA,EACzB,MAAM,QAAQ,IAAI,WAAW,YAAY;AAAA,EACzC,OAAO,gBAAgB,KAAK;AAAA,EAE5B,OAAO,UAAU,KAAK;AAAA;AAGvB,IAAM,gBAAgB,OAAO,aAC5B,UACC,IAAI,WACH,MAAM,OAAO,OAAO,OACnB,WACA,IAAI,YAAY,EAAE,OAAO,QAAQ,CAClC,CACD,CACD;AAED,IAAM,kBAAkB,CAAC,UAAkB;AAAA,EAC1C,MAAM,SAAS,IAAI,IAAI,KAAK;AAAA,EAC5B,MAAM,WACL,OAAO,aAAa,WACpB,CAAC,aAAa,SAAS,WAAW,EAAE,SAAS,OAAO,QAAQ;AAAA,EAC7D,IAAI,OAAO,aAAa,YAAY,CAAC;AAAA,IACpC,MAAM,IAAI,UAAU,oCAAoC;AAAA,EACzD,IAAI,OAAO,YAAY,OAAO,YAAY,OAAO,UAAU,OAAO;AAAA,IACjE,MAAM,IAAI,UACT,oEACD;AAAA,EACD,OAAO,WAAW,OAAO,SAAS,QAAQ,QAAQ,EAAE;AAAA,EAEpD,OAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE;AAAA;AAGtC,IAAM,gBAAgB,CAAC,aAAqB,kBAA0B;AAAA,EACrE,MAAM,SAAS,IAAI,IAAI,WAAW;AAAA,EAClC,MAAM,WAAW,IAAI,IAAI,aAAa;AAAA,EAEtC,OACC,OAAO,aAAa,SAAS,YAC7B,OAAO,SAAS,SAAS,QACzB,OAAO,aAAa,SAAS,YAC7B,OAAO,aAAa,MACpB,OAAO,aAAa;AAAA;AAItB,IAAM,eAAe,CAAC,UAAyB;AAAA,EAC9C,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,IAAI;AAAA,IACH,MAAM,SAAkB,KAAK,MAAM,KAAK;AAAA,IACxC,IACC,CAAC,SAAS,MAAM,KAChB,OAAO,OAAO,cAAc,YAC5B,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,aAAa;AAAA,MAE3B;AAAA,IAED,OAAO;AAAA,MACN,WAAW,OAAO;AAAA,MAClB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,UAAU,OAAO;AAAA,IAClB;AAAA,IACC,MAAM;AAAA,IACP;AAAA;AAAA;AAIF,IAAM,qBAAqB,CAAC,UAAmB;AAAA,EAC9C,IACC,CAAC,SAAS,KAAK,KACf,OAAO,MAAM,iBAAiB,YAC9B,OAAO,MAAM,eAAe,YAC5B,CAAC,OAAO,SAAS,MAAM,UAAU,KACjC,MAAM,cAAc,KACpB,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,kBAAkB,YAC/B,OAAO,MAAM,eAAe;AAAA,IAE5B,MAAM,IAAI,gBAAgB,SAAS,kCAAkC;AAAA,EACtE,IAAI,MAAM,WAAW,YAAY,MAAM;AAAA,IACtC,MAAM,IAAI,gBACT,SACA,iCAAiC,MAAM,kDACxC;AAAA,EAED,OAAO;AAAA,IACN,cAAc,MAAM;AAAA,IACpB,YAAY,MAAM;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,eAAe,MAAM;AAAA,IACrB,OAAO,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ;AAAA,IACvD,YAAY,MAAM;AAAA,EACnB;AAAA;AAGD,IAAM,eAAe,OAAO,aAAuB;AAAA,EAClD,MAAM,OAAO,MAAM,SAAS,KAAK;AAAA,EACjC,IAAI;AAAA,IACH,OAAO,KAAK,MAAM,IAAI;AAAA,IACrB,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAIT,IAAM,kBAAkB,CAAC,OAAgB,MAAc,WAAmB;AAAA,EACzE,IAAI,OAAO,UAAU;AAAA,IACpB,MAAM,IAAI,gBACT,aACA,6BAA6B,OAC9B;AAAA,EACD,MAAM,WAAW,IAAI,IAAI,KAAK;AAAA,EAC9B,IAAI,SAAS,aAAa,YAAY,IAAI,IAAI,MAAM,EAAE,aAAa;AAAA,IAClE,MAAM,IAAI,gBACT,aACA,kBAAkB,sBACnB;AAAA,EAED,OAAO,SAAS;AAAA;AAGjB,IAAM,iBAAiB,CACtB,OACA,WACyB;AAAA,EACzB,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,WAAW;AAAA,IACxC,MAAM,IAAI,gBACT,aACA,6DACD;AAAA,EACD,MAAM,UAAU,MAAM,QAAQ,MAAM,gCAAgC,IACjE,MAAM,iCAAiC,OACvC,CAAC,WAA6B,OAAO,WAAW,QACjD,IACC;AAAA,EACH,IAAI,CAAC,SAAS,SAAS,MAAM;AAAA,IAC5B,MAAM,IAAI,gBACT,aACA,6CACD;AAAA,EACD,MAAM,cAAc,MAAM,QACzB,MAAM,qCACP,IACG,MAAM,sCAAsC,OAC5C,CAAC,WAA6B,OAAO,WAAW,QACjD,IACC;AAAA,EACH,IAAI,CAAC,aAAa,SAAS,MAAM;AAAA,IAChC,MAAM,IAAI,gBACT,aACA,qEACD;AAAA,EAED,OAAO;AAAA,IACN,wBAAwB,gBACvB,MAAM,wBACN,0BACA,MACD;AAAA,IACA,kCAAkC;AAAA,IAClC;AAAA,IACA,UAAU,gBAAgB,MAAM,UAAU,YAAY,MAAM;AAAA,IAC5D,qBACC,OAAO,MAAM,wBAAwB,WAClC,gBACA,MAAM,qBACN,uBACA,MACD,IACC;AAAA,IACJ,wBACC,OAAO,MAAM,2BAA2B,WACrC,gBACA,MAAM,wBACN,0BACA,MACD,IACC;AAAA,IACJ,gBAAgB,gBACf,MAAM,gBACN,kBACA,MACD;AAAA,IACA,uCAAuC;AAAA,IACvC,mBAAmB,gBAClB,MAAM,mBACN,qBACA,MACD;AAAA,EACD;AAAA;AAGD,IAAM,gBAAgB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,MASK;AAAA,EACL,OAAO,eAAe,gBAAgB,qBAAqB,SAC1D,QAAQ,MAAM,GAAG;AAAA,EAClB,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,oBAAoB,MAAM;AAAA,IACnE,MAAM,IAAI,gBAAgB,YAAY,4BAA4B;AAAA,EACnE,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,IACH,SAAS,KAAK,MACb,IAAI,YAAY,EAAE,OAAO,gBAAgB,aAAa,CAAC,CACxD;AAAA,IACA,UAAU,KAAK,MACd,IAAI,YAAY,EAAE,OAAO,gBAAgB,cAAc,CAAC,CACzD;AAAA,IACC,OAAO,OAAO;AAAA,IACf,MAAM,IAAI,gBAAgB,YAAY,8BAA8B;AAAA,MACnE;AAAA,IACD,CAAC;AAAA;AAAA,EAEF,IACC,CAAC,SAAS,MAAM,KAChB,OAAO,QAAQ,WACf,OAAO,OAAO,QAAQ,YACtB,CAAC,SAAS,OAAO;AAAA,IAEjB,MAAM,IAAI,gBACT,YACA,4CACD;AAAA,EACD,MAAM,WAAW,MAAM,UAAU,SAAS,EAAE,OAAO,WAAW,CAAC;AAAA,EAC/D,IAAI,CAAC,SAAS;AAAA,IACb,MAAM,IAAI,gBACT,WACA,oCACD;AAAA,EACD,MAAM,OAAgB,MAAM,SAAS,KAAK;AAAA,EAC1C,MAAM,OAAO,SAAS,IAAI,KAAK,MAAM,QAAQ,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;AAAA,EACvE,MAAM,MAAM,KAAK,KAChB,CAAC,cACA,SAAS,SAAS,KAAK,UAAU,QAAQ,OAAO,GAClD;AAAA,EACA,IAAI,CAAC;AAAA,IACJ,MAAM,IAAI,gBACT,YACA,sCACD;AAAA,EACD,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,KACA,EAAE,MAAM,WAAW,MAAM,SAAS,YAAY,QAAQ,GACtD,OACA,CAAC,QAAQ,CACV;AAAA,EACA,MAAM,QAAQ,MAAM,OAAO,OAAO,OACjC,EAAE,MAAM,WAAW,MAAM,QAAQ,GACjC,KACA,gBAAgB,gBAAgB,GAChC,IAAI,YAAY,EAAE,OAAO,GAAG,iBAAiB,gBAAgB,CAC9D;AAAA,EACA,MAAM,WAAW,QAAQ;AAAA,EACzB,IACC,CAAC,SACD,QAAQ,QAAQ,UAChB,EACC,aAAa,YACZ,MAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS,QAAQ,MAEvD,QAAQ,UAAU,SAClB,OAAO,QAAQ,QAAQ,YACvB,QAAQ,MAAM,QAAQ;AAAA,IAEtB,MAAM,IAAI,gBACT,YACA,+CACD;AAAA;AAGK,IAAM,yBAAyB,CAAC,WAAmC;AAAA,EACzE,MAAM,SAAS,gBAAgB,OAAO,MAAM;AAAA,EAC5C,MAAM,cAAc,IAAI,IAAI,OAAO,WAAW,EAAE;AAAA,EAChD,MAAM,YAAY,OAAO,SAAS,WAAW;AAAA,EAC7C,MAAM,MAAM,OAAO,OAAO,KAAK;AAAA,EAC/B,MAAM,cAAc,OAAO,eAAe;AAAA,EAC1C,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,UAAU,CAAC,UAAU,SAAS,CAAC,CAAC;AAAA,EAClE,MAAM,WAAW,OAAO,YAAY;AAAA,EACpC,IAAI,CAAC,OAAO,SAAS,QAAQ;AAAA,IAAG,OAAO,QAAQ,QAAQ;AAAA,EACvD,MAAM,iBAAiB,IAAI,KACzB,OAAO,kBAAkB,CAAC,IAAI,IAAI,MAAM,EAAE,MAAM,GAAG,IACnD,CAAC,UAAU,IAAI,IAAI,KAAK,EAAE,MAC3B,CACD;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,MAAM,iBAAiB,IAAI;AAAA,EAE3B,MAAM,iBAAiB,YAAY;AAAA,IAClC,MAAM,MAAM,IAAI,IAAI,qCAAqC,GAAG,SAAS;AAAA,IACrE,MAAM,WAAW,MAAM,UAAU,KAAK;AAAA,MACrC,OAAO;AAAA,MACP,SAAS,EAAE,QAAQ,mBAAmB;AAAA,IACvC,CAAC;AAAA,IACD,IAAI,CAAC,SAAS;AAAA,MACb,MAAM,IAAI,gBACT,aACA,mCAAmC,SAAS,SAC7C;AAAA,IAED,OAAO,eAAe,MAAM,SAAS,KAAK,GAAG,MAAM;AAAA;AAAA,EAGpD,MAAM,YAAY,MAAM;AAAA,IACvB,qBAAqB,eAAe;AAAA,IAEpC,OAAO;AAAA;AAAA,EAGR,MAAM,sBAAsB,YAAY;AAAA,IACvC,MAAM,aAAa,MAAM,OAAO,QAAQ,aAAa;AAAA,IACrD,IAAI,cAAc,CAAC,WAAW;AAAA,MAC7B,MAAM,IAAI,gBACT,kBACA,WAAW,WACV,kDACF;AAAA;AAAA,EAGF,MAAM,eAAe,OACpB,UACA,MACA,UACI;AAAA,IACJ,IAAI;AAAA,IACJ,IAAI;AAAA,MACH,WAAW,MAAM,UAAU,SAAS,gBAAgB;AAAA,QACnD;AAAA,QACA,aAAa;AAAA,QACb,SAAS;AAAA,UACR,QAAQ;AAAA,UACR,gBAAgB;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,MACT,CAAC;AAAA,MACA,OAAO,OAAO;AAAA,MACf,MAAM,IAAI,gBAAgB,WAAW,6BAA6B;AAAA,QACjE;AAAA,MACD,CAAC;AAAA;AAAA,IAEF,MAAM,QAAQ,MAAM,aAAa,QAAQ;AAAA,IACzC,IAAI,CAAC,SAAS,IAAI;AAAA,MACjB,MAAM,YACL,SAAS,KAAK,KAAK,OAAO,MAAM,UAAU,WACvC,MAAM,QACN,QAAQ,SAAS;AAAA,MACrB,MAAM,IAAI,gBACT,SACA,wDAAwD,aACzD;AAAA,IACD;AAAA,IACA,MAAM,SAAS,mBAAmB,KAAK;AAAA,IACvC,IAAI;AAAA,MACH,MAAM,cAAc;AAAA,QACnB,UAAU,OAAO;AAAA,QACjB;AAAA,QACA,SAAS,OAAO;AAAA,QAChB;AAAA,QACA,SAAS,SAAS;AAAA,QAClB;AAAA,QACA,KAAK,IAAI;AAAA,MACV,CAAC;AAAA,IAEF,OAAO;AAAA;AAAA,EAGR,MAAM,eAAe,OACpB,WAC+B;AAAA,IAC/B,IAAI;AAAA,MACH,MAAM,OAAO,QAAQ,IAAI,aAAa,OAAO,aAAa;AAAA,MACzD,OAAO,OAAO;AAAA,MACf,SAAS;AAAA,MACT,MAAM,OAAO,QAAQ,OAAO,WAAW,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA,MAC9D,MAAM,IAAI,gBACT,kBACA,+DACA,EAAE,MAAM,CACT;AAAA;AAAA,IAED,SAAS;AAAA,MACR,aAAa,OAAO;AAAA,MACpB,WAAW,IAAI,IAAI,OAAO,aAAa;AAAA,MACvC,SAAS,OAAO;AAAA,MAChB,OAAO,OAAO,OAAO,MAAM,GAAG,EAAE,OAAO,OAAO,KAAK;AAAA,MACnD,WAAW;AAAA,IACZ;AAAA,IAEA,OAAO,KAAK,QAAQ,cAAc,OAAO,cAAc;AAAA;AAAA,EAGxD,MAAM,oBAAoB,YAAY;AAAA,IACrC,MAAM,oBAAoB;AAAA,IAC1B,MAAM,eAAe,MAAM,OAAO,QAAQ,IAAI,WAAW;AAAA,IACzD,IAAI,CAAC;AAAA,MACJ,MAAM,IAAI,gBACT,SACA,2CACD;AAAA,IACD,MAAM,WAAW,MAAM,UAAU;AAAA,IACjC,MAAM,OAAO,IAAI,gBAAgB;AAAA,MAChC,WAAW,OAAO;AAAA,MAClB,YAAY;AAAA,MACZ,eAAe;AAAA,IAChB,CAAC;AAAA,IACD,KAAK,IAAI,YAAY,QAAQ;AAAA,IAC7B,MAAM,SAAS,MAAM,aAAa,UAAU,IAAI;AAAA,IAEhD,QAAQ,MAAM,aAAa,MAAM,GAAG;AAAA;AAAA,EAGrC,MAAM,qBAAqB,YAAY;AAAA,IACtC,IAAI,UAAU,OAAO,YAAY,cAAc,IAAI;AAAA,MAClD,OAAO,OAAO;AAAA,IACf,IAAI;AAAA,MAAgB,OAAO;AAAA,IAC3B,iBAAiB,kBAAkB,EAAE,QAAQ,MAAM;AAAA,MAClD,iBAAiB;AAAA,KACjB;AAAA,IAED,OAAO;AAAA;AAAA,EAGR,MAAM,iBAAiB,OAAO,UAAkB;AAAA,IAC/C,IAAI,CAAC,cAAc,OAAO,WAAW;AAAA,MACpC,MAAM,IAAI,gBACT,YACA,kEACD;AAAA,IACD,MAAM,MAAM,IAAI,IAAI,KAAK;AAAA,IACzB,MAAM,UAAU,aAAa,MAAM,OAAO,QAAQ,IAAI,WAAW,CAAC;AAAA,IAClE,IAAI,CAAC,WAAW,IAAI,IAAI,QAAQ,YAAY,gBAAgB;AAAA,MAC3D,MAAM,OAAO,QAAQ,OAAO,WAAW,EAAE,MAAM,MAAG;AAAA,QAAG;AAAA,OAAS;AAAA,MAC9D,MAAM,IAAI,gBACT,YACA,sDACD;AAAA,IACD;AAAA,IACA,MAAM,WAAW,eAAe,IAAI,QAAQ,KAAK;AAAA,IACjD,MAAM,SAAS,CAAC,UAAmB;AAAA,MAClC,eAAe,OAAO,QAAQ,KAAK;AAAA,MAC9B,OAAO,QAAQ,OAAO,WAAW;AAAA,MACtC,UAAU,OAAO,KAAK;AAAA,MACtB,MAAM;AAAA;AAAA,IAEP,IAAI,IAAI,aAAa,IAAI,OAAO,MAAM,QAAQ;AAAA,MAC7C,OAAO,OACN,IAAI,gBACH,YACA,kDACD,CACD;AAAA,IACD,IAAI,IAAI,aAAa,IAAI,KAAK,MAAM;AAAA,MACnC,OAAO,OACN,IAAI,gBACH,YACA,mDACD,CACD;AAAA,IACD,MAAM,aAAa,IAAI,aAAa,IAAI,OAAO;AAAA,IAC/C,IAAI,YAAY;AAAA,MACf,MAAM,OAAO,QAAQ,OAAO,WAAW;AAAA,MAEvC,OAAO,OACN,IAAI,gBACH,SACA,yBAAyB,cAC1B,CACD;AAAA,IACD;AAAA,IACA,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AAAA,IACxC,IAAI,CAAC;AAAA,MACJ,OAAO,OACN,IAAI,gBACH,YACA,8CACD,CACD;AAAA,IACD,MAAM,OAAO,QAAQ,OAAO,WAAW;AAAA,IACvC,IAAI;AAAA,MACH,MAAM,WAAW,MAAM,UAAU;AAAA,MACjC,MAAM,OAAO,IAAI,gBAAgB;AAAA,QAChC,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,eAAe,QAAQ;AAAA,QACvB,YAAY;AAAA,QACZ,cAAc;AAAA,MACf,CAAC;AAAA,MACD,KAAK,IAAI,YAAY,QAAQ;AAAA,MAC7B,MAAM,SAAS,MAAM,aACpB,MAAM,aAAa,UAAU,MAAM,QAAQ,KAAK,CACjD;AAAA,MACA,eAAe,OAAO,QAAQ,KAAK;AAAA,MACnC,UAAU,QAAQ,MAAM;AAAA,MAExB,OAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACf,OAAO,OAAO,KAAK;AAAA;AAAA;AAAA,EAIrB,MAAM,aAAa,YAAY;AAAA,IAC9B,MAAM,oBAAoB;AAAA,IAC1B,YAAY,MAAM,OAAO,MAAM,OAAO,CAAC,QAAQ;AAAA,MAC9C,IAAI,cAAc,KAAK,WAAW;AAAA,QAC5B,eAAe,GAAG,EAAE,MAAM,MAAG;AAAA,UAAG;AAAA,SAAS;AAAA,KAC/C;AAAA,IACD,IAAI,OAAO,WAAW;AAAA,MACrB,aAAa,MAAM,OAAO,UAAU,SAAS,MAAM;AAAA,QAC7C,mBAAmB,EAAE,MAAM,MAAG;AAAA,UAAG;AAAA,SAAS;AAAA,OAC/C;AAAA,IACF,MAAM,YAAY,MAAM,OAAO,MAAM,aAAa;AAAA,IAClD,IAAI,aAAa,cAAc,WAAW,WAAW;AAAA,MACpD,MAAM,eAAe,SAAS;AAAA;AAAA,EAGhC,MAAM,QAAQ,MAAM;AAAA,IACnB,iBAAiB,WAAW;AAAA,IAE5B,OAAO;AAAA;AAAA,EAGR,MAAM,SAAS,OAAO,UAAmC,CAAC,MAAM;AAAA,IAC/D,MAAM,MAAM;AAAA,IACZ,IAAI,QAAQ,QAAQ;AAAA,MACnB,MAAM,IAAI,gBACT,WACA,8BACD;AAAA,IACD,MAAM,WAAW,MAAM,UAAU;AAAA,IACjC,MAAM,UAAgC;AAAA,MACrC,WAAW,IAAI;AAAA,MACf,OAAO,YAAY;AAAA,MACnB,OAAO,YAAY;AAAA,MACnB,UAAU,YAAY;AAAA,IACvB;AAAA,IACA,MAAM,OAAO,QAAQ,IAAI,aAAa,KAAK,UAAU,OAAO,CAAC;AAAA,IAC7D,MAAM,MAAM,IAAI,IAAI,SAAS,sBAAsB;AAAA,IACnD,IAAI,SAAS,IAAI,gBAAgB;AAAA,MAChC,WAAW,OAAO;AAAA,MAClB,gBAAgB,MAAM,cAAc,QAAQ,QAAQ;AAAA,MACpD,uBAAuB;AAAA,MACvB,OAAO,QAAQ;AAAA,MACf,cAAc;AAAA,MACd,eAAe;AAAA,MACf,OAAO,OAAO,KAAK,GAAG;AAAA,MACtB,OAAO,QAAQ;AAAA,SACZ,QAAQ;AAAA,IACZ,CAAC,EAAE,SAAS;AAAA,IACZ,IAAI,aAAa,IAAI,YAAY,QAAQ;AAAA,IACzC,MAAM,SAAS,IAAI,QAA0B,CAAC,SAAS,WAAW;AAAA,MACjE,eAAe,IAAI,QAAQ,OAAO,EAAE,QAAQ,QAAQ,CAAC;AAAA,MACrD,QAAQ,QAAQ,iBACf,SACA,MAAM;AAAA,QACL,eAAe,OAAO,QAAQ,KAAK;AAAA,QAC9B,OAAO,QAAQ,OAAO,WAAW;AAAA,QACtC,OACC,IAAI,gBACH,WACA,8BACD,CACD;AAAA,SAED,EAAE,MAAM,KAAK,CACd;AAAA,KACA;AAAA,IACD,IAAI;AAAA,MACH,MAAM,OAAO,MAAM,aAAa,IAAI,IAAI;AAAA,MACvC,OAAO,OAAO;AAAA,MACf,eAAe,OAAO,QAAQ,KAAK;AAAA,MACnC,MAAM,OAAO,QAAQ,OAAO,WAAW;AAAA,MACvC,MAAM;AAAA;AAAA,IAGP,OAAO;AAAA;AAAA,EAGR,MAAM,qBAAqB,OAC1B,OACA,SACI;AAAA,IACJ,MAAM,WAAW,IAAI,QAAQ,OAAO,IAAI;AAAA,IACxC,IAAI,CAAC,eAAe,IAAI,IAAI,IAAI,SAAS,GAAG,EAAE,MAAM;AAAA,MACnD,MAAM,IAAI,gBACT,UACA,qEACD;AAAA,IACD,MAAM,OAAO,OAAO,iBAA0B;AAAA,MAC7C,IAAI;AAAA,QAAc,SAAS;AAAA,MAC3B,MAAM,QAAQ,MAAM,mBAAmB;AAAA,MACvC,MAAM,UAAU,SAAS,MAAM;AAAA,MAC/B,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAAA,MAC3C,QAAQ,IAAI,iBAAiB,UAAU,OAAO;AAAA,MAE9C,OAAO,UACN,IAAI,QAAQ,SAAS,EAAE,aAAa,QAAQ,QAAQ,CAAC,CACtD;AAAA;AAAA,IAED,MAAM,WAAW,MAAM,KAAK,KAAK;AAAA,IAEjC,OAAO,SAAS,WAAW,MAAM,KAAK,IAAI,IAAI;AAAA;AAAA,EAG/C,MAAM,6BAA6B,OAClC,OACA,SACI;AAAA,IACJ,MAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AAAA,IACvC,IAAI,CAAC,eAAe,IAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,MAAM;AAAA,MAClD,MAAM,IAAI,gBACT,UACA,kEACD;AAAA,IACD,MAAM,eAAe,MAAM,OAAO,QAAQ,IAAI,WAAW;AAAA,IACzD,IAAI,UAAU;AAAA,MAAc,OAAO,mBAAmB,OAAO;AAAA,IAE7D,OAAO,UAAU,IAAI,QAAQ,SAAS,EAAE,aAAa,OAAO,CAAC,CAAC;AAAA;AAAA,EAG/D,MAAM,SAAS,YAAY;AAAA,IAC1B,IAAI;AAAA,MACH,MAAM,WAAW,MAAM,UAAU;AAAA,MACjC,MAAM,WAAW,MAAM,mBACtB,SAAS,iBACV;AAAA,MACA,IAAI,SAAS,WAAW;AAAA,QAAK,OAAO;AAAA,MACpC,IAAI,CAAC,SAAS;AAAA,QACb,MAAM,IAAI,gBACT,WACA,8BAA8B,SAAS,SACxC;AAAA,MACD,MAAM,OAAgB,MAAM,SAAS,KAAK;AAAA,MAC1C,IAAI,CAAC,SAAS,IAAI,KAAK,OAAO,KAAK,QAAQ;AAAA,QAC1C,MAAM,IAAI,gBACT,SACA,sCACD;AAAA,MAED,OAAO,KAAK,MAAM,KAAK,KAAK,IAAI;AAAA,MAC/B,OAAO,OAAO;AAAA,MACf,IACC,iBAAiB,oBAChB,MAAM,SAAS,WAAW,MAAM,SAAS;AAAA,QAE1C,OAAO;AAAA,MACR,MAAM;AAAA;AAAA;AAAA,EAIR,MAAM,eAAe,OAAO,WAAW,aAAa;AAAA,IACnD,MAAM,WAAW,MAAM,UAAU;AAAA,IACjC,IAAI,CAAC,SAAS;AAAA,MACb,MAAM,IAAI,gBACT,aACA,gEACD;AAAA,IACD,MAAM,WAAW,MAAM,mBACtB,SAAS,wBACT;AAAA,MACC,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,MACjC,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CACD;AAAA,IACA,MAAM,OAAgB,MAAM,aAAa,QAAQ;AAAA,IACjD,IAAI,CAAC,SAAS,MAAM,CAAC,SAAS,IAAI,KAAK,OAAO,KAAK,WAAW;AAAA,MAC7D,MAAM,IAAI,gBACT,SAAS,KAAK,UAAU,SACxB,6CAA6C,SAAS,SACvD;AAAA,IAED,OAAO,KAAK;AAAA;AAAA,EAGb,MAAM,qBAAqB,OAAO,iBAAyB;AAAA,IAC1D,MAAM,WAAW,MAAM,UAAU;AAAA,IACjC,IAAI,SAAS;AAAA,MACZ,MAAM,UAAU,SAAS,qBAAqB;AAAA,QAC7C,MAAM,IAAI,gBAAgB;AAAA,UACzB,WAAW,OAAO;AAAA,UAClB,OAAO;AAAA,UACP,iBAAiB;AAAA,QAClB,CAAC;AAAA,QACD,aAAa;AAAA,QACb,SAAS;AAAA,UACR,gBAAgB;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,MACT,CAAC;AAAA;AAAA,EAGH,MAAM,UAAU,YAAY;AAAA,IAC3B,MAAM,eAAe,MAAM,OAAO,QAAQ,IAAI,WAAW;AAAA,IACzD,IAAI;AAAA,MACH,IAAI;AAAA,QAAc,MAAM,mBAAmB,YAAY;AAAA,cACtD;AAAA,MACD,SAAS;AAAA,MACT,MAAM,QAAQ,IAAI;AAAA,QACjB,OAAO,QAAQ,OAAO,WAAW;AAAA,QACjC,OAAO,QAAQ,OAAO,WAAW;AAAA,MAClC,CAAC;AAAA;AAAA;AAAA,EAIH,MAAM,OAAO,YAAY;AAAA,IACxB,MAAM,QAAQ,IAAI,CAAC,YAAY,GAAG,aAAa,CAAC,CAAC;AAAA,IACjD,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,eAAe;AAAA;AAAA,EAGhB,OAAO;AAAA,IACN,OAAO;AAAA,IACP,eAAe;AAAA,IACf;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA;AAQM,IAAM,4BAA4B,CACxC,YACuD;AAAA,EACvD,OAAO,OAAO;AAAA,EACd,aAAa,SAAS,YAAY;AAAA,IACjC,MAAM,OAAO,OAAO;AAAA,MACnB,yBAAyB,EAAE,YAAY,MAAM;AAAA,IAC9C,CAAC;AAAA,IAED,OAAO,EAAE,QAAQ,gBAAgB;AAAA;AAAA,EAElC,SAAS,YAAY;AAAA,IACpB,MAAM,OAAO,QAAQ;AAAA,IAErB,OAAO;AAAA;AAAA,EAER,aAAa,SAAS,YAAY;AAAA,IACjC,MAAM,OAAO,OAAO;AAAA,MACnB,yBAAyB;AAAA,QACxB,YAAY;AAAA,QACZ,aAAa;AAAA,MACd;AAAA,IACD,CAAC;AAAA,IAED,OAAO,EAAE,QAAQ,gBAAgB;AAAA;AAAA,EAElC,QAAQ,YAAY;AAAA,IACnB,MAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAEjC,OAAO,EAAE,KAAK;AAAA;AAEhB;;ACx5BO,IAAM,kBAAkB,CAAC,UAAkB,eAAe,KAAK,KAAK;AAIpE,IAAM,kBAAkB,CAAC,OAA2B,WAAW,QACrE,UAAU,aAAa,gBAAgB,KAAK,IAAI,QAAQ;;ACEzD,IAAM,cAAc,MAAa;AAEjC,IAAM,YAAW,CAAC,YAAsC;AAAA,EACvD,MAAM;AAAA,EACN,SAAS,kBAAkB,QAAQ,OAAO,UAAU;AAAA,EACpD,QAAQ;AACT;AAMO,IAAM,+BAA+B,OAAO,WAAuB;AAAA,EACzE,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,qBAAqB;AAAA,IACjE,OAAO;AAAA,MACN,MAAM;AAAA,MACN,OAAO,UAAS,IAAI,MAAM,sBAAsB,CAAC;AAAA,IAClD;AAAA,EACD;AAAA,EACA,MAAM,UAAU,MAAM,OAAO,SAAS,oBAAoB;AAAA,EAC1D,IAAI,QAAQ;AAAA,IAAO,OAAO,EAAE,MAAM,MAAM,OAAO,QAAQ,MAAM;AAAA,EAC7D,IAAI;AAAA,IACH,QAAQ,wBAAwB,MAAM,YAAY;AAAA,IAClD,MAAM,aAAa,MAAM,oBAAoB;AAAA,MAC5C,aAAa,QAAQ;AAAA,MACrB,oBAAoB;AAAA,IACrB,CAAC;AAAA,IAED,OAAO,OAAO,SAAS,mBAAmB,UAAU;AAAA,IACnD,OAAO,QAAQ;AAAA,IAChB,OAAO,EAAE,MAAM,MAAM,OAAO,UAAS,MAAM,EAAE;AAAA;AAAA;AAOxC,IAAM,yBAAyB,OAAO,WAAuB;AAAA,EACnE,IAAI,OAAO,WAAW,eAAe,CAAC,OAAO,qBAAqB;AAAA,IACjE,OAAO;AAAA,MACN,MAAM;AAAA,MACN,OAAO,UAAS,IAAI,MAAM,sBAAsB,CAAC;AAAA,IAClD;AAAA,EACD;AAAA,EACA,MAAM,UAAU,MAAM,OAAO,SAAS,gBAAgB;AAAA,EACtD,IAAI,QAAQ;AAAA,IAAO,OAAO,EAAE,MAAM,MAAM,OAAO,QAAQ,MAAM;AAAA,EAC7D,IAAI;AAAA,IACH,QAAQ,sBAAsB,MAAM,YAAY;AAAA,IAChD,MAAM,aAAa,MAAM,kBAAkB;AAAA,MAC1C,aAAa,QAAQ;AAAA,IACtB,CAAC;AAAA,IAED,OAAO,OAAO,SAAS,eAAe,UAAU;AAAA,IAC/C,OAAO,QAAQ;AAAA,IAChB,OAAO,EAAE,MAAM,MAAM,OAAO,UAAS,MAAM,EAAE;AAAA;AAAA;",
+  "debugId": "1DC9AFB1303049A564756E2164756E21",
   "names": []
 }

package/dist/client/mobile.d.ts

@@ -0,0 +1,84 @@
+export type MobileAuthSecureStorage = {
+    capability?: () => Promise<{
+        available: boolean;
+        message?: string;
+    }>;
+    get(key: string): Promise<string | null>;
+    remove(key: string): Promise<void>;
+    set(key: string, value: string): Promise<void>;
+};
+export type MobileAuthLinks = {
+    getLaunchUrl(): Promise<string | null>;
+    onOpen(listener: (url: string) => void): Promise<() => Promise<void> | void>;
+    openExternal(url: string): Promise<void>;
+};
+export type MobileAuthLifecycle = {
+    onResume?(listener: () => void): Promise<() => Promise<void> | void>;
+};
+export type MobileAuthDiscovery = {
+    authorization_endpoint: string;
+    code_challenge_methods_supported?: string[];
+    issuer: string;
+    jwks_uri: string;
+    revocation_endpoint?: string;
+    socket_ticket_endpoint?: string;
+    token_endpoint: string;
+    token_endpoint_auth_methods_supported?: string[];
+    userinfo_endpoint: string;
+};
+export type MobileAuthClientConfig = {
+    allowedOrigins?: readonly string[];
+    clientId: string;
+    clockSkewMs?: number;
+    fetch?: typeof globalThis.fetch;
+    issuer: string;
+    lifecycle?: MobileAuthLifecycle;
+    links: MobileAuthLinks;
+    now?: () => number;
+    redirectUri: string;
+    resource?: string;
+    scopes?: readonly string[];
+    storage: MobileAuthSecureStorage;
+};
+export type MobileAuthSignInOptions = {
+    authorizationParameters?: Readonly<Record<string, string>>;
+    signal?: AbortSignal;
+};
+export type MobileAuthTokens = {
+    accessToken: string;
+    expiresAt: number;
+    idToken: string;
+    refreshToken: string;
+    scope: string[];
+    tokenType: 'Bearer';
+};
+export type MobileAuthUser = Record<string, unknown> & {
+    sub: string;
+};
+export type MobileAuthErrorCode = 'aborted' | 'callback' | 'discovery' | 'id-token' | 'network' | 'oauth' | 'origin' | 'secure-storage' | 'token';
+export declare class MobileAuthError extends Error {
+    readonly code: MobileAuthErrorCode;
+    readonly cause?: unknown;
+    constructor(code: MobileAuthErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare const createMobileAuthClient: (config: MobileAuthClientConfig) => {
+    fetch: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+    fetchOptional: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+    handleCallback: (value: string) => Promise<MobileAuthTokens>;
+    refresh: () => Promise<string>;
+    signIn: (options?: MobileAuthSignInOptions) => Promise<MobileAuthTokens>;
+    signOut: () => Promise<void>;
+    socketTicket: (audience?: string) => Promise<string>;
+    start: () => Promise<void>;
+    status: () => Promise<{
+        sub: string;
+    } | null>;
+    stop: () => Promise<void>;
+};
+export type MobileAuthClient = ReturnType<typeof createMobileAuthClient>;
+/** Adapts the native OAuth lifecycle behind the same createAuthClient API used
+ * by web applications. Passwords stay out of the WebView request path; the
+ * external authorization UI owns credential entry and MFA. */
+export declare const createMobileAuthTransport: (client: MobileAuthClient) => import("./createAuthClient").AuthClientTransport;

package/dist/htmx/configuredRoutes.d.ts

@@ -14,13 +14,14 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
         unregisteredSession: import("..").UnregisteredSessionRecord;
     };
     derive: {
+        readonly authPrincipal: import("..").AuthPrincipal<AuthHtmxUser> | undefined;
         readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: AuthHtmxUser) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
             readonly code: "Bad Request";
             readonly message: "Cookies are missing";
         } | {
             readonly code: "Unauthorized";
             readonly message: "User is not authenticated";
-        }) => AuthFailReturn) | undefined) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+        }) => AuthFailReturn) | undefined) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
     };
 }, {
     typebox: {};
@@ -37,13 +38,14 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
     macroFn: {};
     parser: {};
     response: import("elysia/types").ExtractErrorFromHandle<{
+        readonly authPrincipal: import("..").AuthPrincipal<AuthHtmxUser> | undefined;
         readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: AuthHtmxUser) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
             readonly code: "Bad Request";
             readonly message: "Cookies are missing";
         } | {
             readonly code: "Unauthorized";
             readonly message: "User is not authenticated";
-        }) => AuthFailReturn) | undefined) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+        }) => AuthFailReturn) | undefined) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
     }>;
 }, {
     htmx: {
@@ -210,9 +212,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
                 query: unknown;
                 headers: unknown;
                 response: {
-                    400: "Cookies are missing";
-                    401: "User is not authenticated";
-                    200: Response;
+                    200: {};
                     422: {
                         type: "validation";
                         title: "Validation Error";
@@ -241,9 +241,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
                         query: unknown;
                         headers: unknown;
                         response: {
-                            400: "Cookies are missing";
-                            401: "User is not authenticated";
-                            200: Response;
+                            200: {};
                             422: {
                                 type: "validation";
                                 title: "Validation Error";
@@ -273,9 +271,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
                     query: unknown;
                     headers: unknown;
                     response: {
-                        400: "Cookies are missing";
-                        401: "User is not authenticated";
-                        200: Response;
+                        200: {};
                         422: {
                             type: "validation";
                             title: "Validation Error";
@@ -304,9 +300,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
                     query: unknown;
                     headers: unknown;
                     response: {
-                        400: "Cookies are missing";
-                        401: "User is not authenticated";
-                        200: Response;
+                        200: {};
                         422: {
                             type: "validation";
                             title: "Validation Error";
@@ -335,9 +329,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
                     query: unknown;
                     headers: unknown;
                     response: {
-                        400: "Cookies are missing";
-                        401: "User is not authenticated";
-                        200: Response;
+                        200: {};
                         422: {
                             type: "validation";
                             title: "Validation Error";
@@ -394,9 +386,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
                         query: unknown;
                         headers: unknown;
                         response: {
-                            400: "Cookies are missing";
-                            401: "User is not authenticated";
-                            200: Response;
+                            200: {};
                             422: {
                                 type: "validation";
                                 title: "Validation Error";
@@ -427,9 +417,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
                         query: unknown;
                         headers: unknown;
                         response: {
-                            400: "Cookies are missing";
-                            401: "User is not authenticated";
-                            200: Response;
+                            200: {};
                             422: {
                                 type: "validation";
                                 title: "Validation Error";
@@ -481,9 +469,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
                 query: unknown;
                 headers: unknown;
                 response: {
-                    400: "Cookies are missing";
-                    401: "User is not authenticated";
-                    200: Response;
+                    200: {};
                     422: {
                         type: "validation";
                         title: "Validation Error";
@@ -662,13 +648,14 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
             unregisteredSession: import("..").UnregisteredSessionRecord;
         };
         derive: {
+            readonly authPrincipal: import("..").AuthPrincipal<AuthHtmxUser> | undefined;
             readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: AuthHtmxUser) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
                 readonly code: "Bad Request";
                 readonly message: "Cookies are missing";
             } | {
                 readonly code: "Unauthorized";
                 readonly message: "User is not authenticated";
-            }) => AuthFailReturn) | undefined) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+            }) => AuthFailReturn) | undefined) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
         };
     } & {
         derive: {};
@@ -681,11 +668,12 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
         session: import("..").SessionRecord<AuthHtmxUser>;
         unregisteredSession: import("..").UnregisteredSessionRecord;
     };
+    readonly authPrincipal: import("..").AuthPrincipal<AuthHtmxUser> | undefined;
     readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: AuthHtmxUser) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
         readonly code: "Bad Request";
         readonly message: "Cookies are missing";
     } | {
         readonly code: "Unauthorized";
         readonly message: "User is not authenticated";
-    }) => AuthFailReturn) | undefined) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+    }) => AuthFailReturn) | undefined) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
 }) => Promise<Response>>;

package/dist/htmx/routes.d.ts

@@ -9,13 +9,14 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
         unregisteredSession: import("..").UnregisteredSessionRecord;
     };
     derive: {
+        readonly authPrincipal: import("..").AuthPrincipal<UserType> | undefined;
         readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
             readonly code: "Bad Request";
             readonly message: "Cookies are missing";
         } | {
             readonly code: "Unauthorized";
             readonly message: "User is not authenticated";
-        }) => AuthFailReturn) | undefined) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+        }) => AuthFailReturn) | undefined) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
     };
 }, {
     typebox: {};
@@ -32,13 +33,14 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
     macroFn: {};
     parser: {};
     response: import("elysia/types").ExtractErrorFromHandle<{
+        readonly authPrincipal: import("..").AuthPrincipal<UserType> | undefined;
         readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
             readonly code: "Bad Request";
             readonly message: "Cookies are missing";
         } | {
             readonly code: "Unauthorized";
             readonly message: "User is not authenticated";
-        }) => AuthFailReturn) | undefined) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+        }) => AuthFailReturn) | undefined) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
     }>;
 }, {
     htmx: {
@@ -205,9 +207,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
                 query: unknown;
                 headers: unknown;
                 response: {
-                    400: "Cookies are missing";
-                    401: "User is not authenticated";
-                    200: Response;
+                    200: {};
                     422: {
                         type: "validation";
                         title: "Validation Error";
@@ -236,9 +236,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
                         query: unknown;
                         headers: unknown;
                         response: {
-                            400: "Cookies are missing";
-                            401: "User is not authenticated";
-                            200: Response;
+                            200: {};
                             422: {
                                 type: "validation";
                                 title: "Validation Error";
@@ -268,9 +266,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
                     query: unknown;
                     headers: unknown;
                     response: {
-                        400: "Cookies are missing";
-                        401: "User is not authenticated";
-                        200: Response;
+                        200: {};
                         422: {
                             type: "validation";
                             title: "Validation Error";
@@ -299,9 +295,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
                     query: unknown;
                     headers: unknown;
                     response: {
-                        400: "Cookies are missing";
-                        401: "User is not authenticated";
-                        200: Response;
+                        200: {};
                         422: {
                             type: "validation";
                             title: "Validation Error";
@@ -330,9 +324,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
                     query: unknown;
                     headers: unknown;
                     response: {
-                        400: "Cookies are missing";
-                        401: "User is not authenticated";
-                        200: Response;
+                        200: {};
                         422: {
                             type: "validation";
                             title: "Validation Error";
@@ -389,9 +381,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
                         query: unknown;
                         headers: unknown;
                         response: {
-                            400: "Cookies are missing";
-                            401: "User is not authenticated";
-                            200: Response;
+                            200: {};
                             422: {
                                 type: "validation";
                                 title: "Validation Error";
@@ -422,9 +412,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
                         query: unknown;
                         headers: unknown;
                         response: {
-                            400: "Cookies are missing";
-                            401: "User is not authenticated";
-                            200: Response;
+                            200: {};
                             422: {
                                 type: "validation";
                                 title: "Validation Error";
@@ -476,9 +464,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
                 query: unknown;
                 headers: unknown;
                 response: {
-                    400: "Cookies are missing";
-                    401: "User is not authenticated";
-                    200: Response;
+                    200: {};
                     422: {
                         type: "validation";
                         title: "Validation Error";
@@ -657,13 +643,14 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
             unregisteredSession: import("..").UnregisteredSessionRecord;
         };
         derive: {
+            readonly authPrincipal: import("..").AuthPrincipal<UserType> | undefined;
             readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
                 readonly code: "Bad Request";
                 readonly message: "Cookies are missing";
             } | {
                 readonly code: "Unauthorized";
                 readonly message: "User is not authenticated";
-            }) => AuthFailReturn) | undefined) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+            }) => AuthFailReturn) | undefined) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
         };
     } & {
         derive: {};
@@ -676,11 +663,12 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
         session: import("..").SessionRecord<UserType>;
         unregisteredSession: import("..").UnregisteredSessionRecord;
     };
+    readonly authPrincipal: import("..").AuthPrincipal<UserType> | undefined;
     readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
         readonly code: "Bad Request";
         readonly message: "Cookies are missing";
     } | {
         readonly code: "Unauthorized";
         readonly message: "User is not authenticated";
-    }) => AuthFailReturn) | undefined) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+    }) => AuthFailReturn) | undefined) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
 }) => Promise<Response>>;