@adminide-stack/yantra-mobile 12.0.39-alpha.2 → 12.0.39-alpha.20

package/lib/features/templates/buildTemplateCards.ts

@@ -74,15 +74,41 @@ export function normalizeMarketplaceTemplatesPayload(payload: Record<string, unk
     return { ...leanGroups, ...(grafted as Record<string, unknown>) };
 }
 
+const GRAFTED_NAMESPACE_KEYS = new Set(['marketplace', 'aisearch', 'credential', 'appSettings']);
+
+/** Template entries (not groups) expose a `forms` map or credential-style ids. */
+function isTemplateShapedEntry(value: Record<string, unknown>): boolean {
+    if (value.forms && typeof value.forms === 'object') return true;
+    if (typeof value.templateName === 'string' && (value.formId || value.formExtensionId)) return true;
+    return false;
+}
+
+/**
+ * After `marketplace.templates.<group>` loads, a shared settings cache can replace the
+ * group map with that group's contents (`aieditor-…` keys). Those must not render as groups.
+ */
+function payloadLooksLikeGroupContents(groupsMap: Record<string, unknown>): boolean {
+    const values = Object.entries(groupsMap).filter(
+        ([key, value]) =>
+            value && typeof value === 'object' && !GRAFTED_NAMESPACE_KEYS.has(key) && key !== 'designSystems',
+    );
+    if (values.length === 0) return false;
+    const templateCount = values.filter(([, value]) => isTemplateShapedEntry(value as Record<string, unknown>)).length;
+    return templateCount > 0 && templateCount >= Math.ceil(values.length / 2);
+}
+
 export function extractMarketplaceTemplateGroups(payload: unknown): MarketplaceTemplateGroup[] {
     const raw = unwrapSettingsPayload(payload);
     if (!raw) return [];
     const groupsMap = normalizeMarketplaceTemplatesPayload(raw);
+    if (payloadLooksLikeGroupContents(groupsMap)) return [];
+
     const groups: MarketplaceTemplateGroup[] = [];
 
     Object.entries(groupsMap).forEach(([groupKey, groupValue]) => {
         if (!groupValue || typeof groupValue !== 'object') return;
-        if (groupKey === 'designSystems') return;
+        if (groupKey === 'designSystems' || GRAFTED_NAMESPACE_KEYS.has(groupKey)) return;
+        if (isTemplateShapedEntry(groupValue as Record<string, unknown>)) return;
         groups.push({
             id: groupKey,
             label: humanizeGroupKey(groupKey),
@@ -94,6 +120,23 @@ export function extractMarketplaceTemplateGroups(payload: unknown): MarketplaceT
     return groups.sort((a, b) => a.label.localeCompare(b.label));
 }
 
+/**
+ * Cards fetch is scoped to `marketplace.templates.<group>`. If a shared cache still
+ * returns the full group map, lift the selected group so extraction stays correct.
+ */
+export function resolveGroupTemplatesPayload(payload: unknown, group: string): unknown {
+    const selectedGroup = group.trim();
+    if (!selectedGroup) return payload;
+    const raw = unwrapSettingsPayload(payload);
+    if (!raw) return payload;
+    const normalized = normalizeMarketplaceTemplatesPayload(raw);
+    const nested = normalized[selectedGroup];
+    if (nested && typeof nested === 'object' && !isTemplateShapedEntry(nested as Record<string, unknown>)) {
+        return nested;
+    }
+    return payload;
+}
+
 function resolveSettingsUrl(
     form: Record<string, unknown>,
     parentGroup: Record<string, unknown> | undefined,

package/lib/hooks/mintSurfaceSystemToken.js

@@ -1,4 +1,4 @@
-import {readAuth0IdToken}from'../bridge/readAuth0Session.js';import {config}from'../config/env-config.js';const OBTAIN_USER_SYSTEM_TOKEN = `
+import {AuthStrategy,HttpHeaders}from'common';import {readAuth0IdToken}from'../bridge/readAuth0Session.js';import {config}from'../config/env-config.js';const OBTAIN_USER_SYSTEM_TOKEN = `
   mutation ObtainUserSystemToken($input: ObtainUserSystemTokenInput!) {
     obtainUserSystemToken(input: $input) {
       token
@@ -15,7 +15,7 @@ const GET_USER_SYSTEM_TOKEN = `
   }
 `;
 const CREATE_SECRET_API_TOKEN = `
-  mutation CreateSecretApiToken($input: SecretApiTokenInput!) {
+  mutation CreateSecretApiToken($input: CreateSecretApiTokenInput!) {
     createSecretApiToken(input: $input) {
       id
       expiresAt
@@ -41,8 +41,10 @@ async function gqlFetch(graphqlUrl, idToken, query, variables) {
   const res = await fetch(graphqlUrl, {
     method: "POST",
     headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${idToken}`
+      [HttpHeaders.CONTENT_TYPE]: "application/json",
+      [HttpHeaders.AUTHORIZATION]: `Bearer ${idToken}`,
+      [HttpHeaders.IS_MOBILE]: "true",
+      [HttpHeaders.AUTH_STRATEGY]: AuthStrategy.Auth0
     },
     body: JSON.stringify({
       query,
@@ -55,8 +57,22 @@ async function gqlFetch(graphqlUrl, idToken, query, variables) {
   }
   return await res.json();
 }
+const DEV_TESTING_PROJECT_UUID = "9a8ac704-1040-4836-9b72-48b771ca91b1";
+const OBJECT_ID_HEX = /^[a-fA-F0-9]{24}$/;
+const PROJECT_UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+function assertMintableProjectId(projectId) {
+  if (projectId === "default" || !projectId.trim()) {
+    throw new Error("Missing projectId \u2014 wait for org/project bootstrap, then retry.");
+  }
+  if (!__DEV__ && projectId === DEV_TESTING_PROJECT_UUID) {
+    throw new Error("Invalid projectId (dev testing UUID). Open Home so a real project can be created, then retry.");
+  }
+  if (!OBJECT_ID_HEX.test(projectId) && !PROJECT_UUID.test(projectId)) {
+    throw new Error(`Invalid projectId format for system token mint: ${projectId.slice(0, 48)}`);
+  }
+}
 async function mintSurfaceSystemToken(input) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y;
   const idToken = await readAuth0IdToken();
   if (!idToken) {
     throw new Error("No Auth0 id_token in storage \u2014 sign in to the mobile app first.");
@@ -65,40 +81,61 @@ async function mintSurfaceSystemToken(input) {
   if (__DEV__) {
     console.log("[WebBuilder] minting system token via", graphqlUrl);
   }
-  const orgName = ((_a = input.orgName) == null ? void 0 : _a.trim()) || "default";
-  const projectId = ((_b = input.projectId) == null ? void 0 : _b.trim()) || "default";
-  const environmentTagId = ((_c = input.tagId) == null ? void 0 : _c.trim()) || void 0;
-  if (environmentTagId) {
-    try {
-      const obtained = await gqlFetch(graphqlUrl, idToken, OBTAIN_USER_SYSTEM_TOKEN, {
-        input: {
-          projectId,
-          environmentTagId,
-          orgName,
-          renewBufferSeconds: 7 * 24 * 60 * 60
-        }
-      });
-      const token2 = (_f = (_e = (_d = obtained.data) == null ? void 0 : _d.obtainUserSystemToken) == null ? void 0 : _e.token) == null ? void 0 : _f.trim();
-      if (token2 && !((_g = obtained.errors) == null ? void 0 : _g.length)) {
-        if (__DEV__) {
-          console.log("[WebBuilder] obtained system token length=", token2.length);
-        }
-        return {
-          token: token2,
-          backend: graphqlUrl
-        };
+  const orgName = (_a = input.orgName) == null ? void 0 : _a.trim();
+  const projectId = (_b = input.projectId) == null ? void 0 : _b.trim();
+  const environmentTagId = (_c = input.tagId) == null ? void 0 : _c.trim();
+  if (!orgName) {
+    throw new Error("Missing orgName \u2014 wait for org bootstrap, then retry.");
+  }
+  if (!projectId) {
+    throw new Error("Missing projectId \u2014 wait for org/project bootstrap, then retry.");
+  }
+  if (!environmentTagId) {
+    throw new Error("Missing environmentTagId \u2014 cannot mint system token.");
+  }
+  assertMintableProjectId(projectId);
+  try {
+    const obtained = await gqlFetch(graphqlUrl, idToken, OBTAIN_USER_SYSTEM_TOKEN, {
+      input: {
+        projectId,
+        environmentTagId,
+        orgName,
+        renewBufferSeconds: 7 * 24 * 60 * 60,
+        algorithm: "HS256"
       }
-    } catch (err) {
+    });
+    const token2 = (_f = (_e = (_d = obtained.data) == null ? void 0 : _d.obtainUserSystemToken) == null ? void 0 : _e.token) == null ? void 0 : _f.trim();
+    if (token2 && !((_g = obtained.errors) == null ? void 0 : _g.length)) {
       if (__DEV__) {
-        console.warn("[WebBuilder] obtainUserSystemToken failed, falling back to reveal:", err);
+        console.log("[WebBuilder] obtained system token length=", token2.length);
+      }
+      return {
+        token: token2,
+        backend: graphqlUrl
+      };
+    }
+    if ((_h = obtained.errors) == null ? void 0 : _h.length) {
+      throw new Error(((_i = obtained.errors[0]) == null ? void 0 : _i.message) || "obtainUserSystemToken failed");
+    }
+  } catch (err) {
+    if (__DEV__) {
+      console.warn("[WebBuilder] obtainUserSystemToken failed, falling back to reveal:", err);
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/12 bytes|24 hex|Project not found/i.test(msg)) {
+      throw new Error(`Project "${projectId}" is not valid on this backend. Pick/create a real project in the app, then retry.`);
+    }
+    if (!/Unknown field|Cannot query field|obtainUserSystemToken/i.test(msg)) {
+      if (/Unauthorized|401|Project not found|Invalid project/i.test(msg)) {
+        throw err instanceof Error ? err : new Error(msg);
       }
     }
   }
   const getResult = await gqlFetch(graphqlUrl, idToken, GET_USER_SYSTEM_TOKEN);
-  if ((_h = getResult.errors) == null ? void 0 : _h.length) {
-    throw new Error(((_i = getResult.errors[0]) == null ? void 0 : _i.message) || "GetUserSystemToken failed");
+  if ((_j = getResult.errors) == null ? void 0 : _j.length) {
+    throw new Error(((_k = getResult.errors[0]) == null ? void 0 : _k.message) || "GetUserSystemToken failed");
   }
-  let tokenId = (_l = (_k = (_j = getResult.data) == null ? void 0 : _j.getUserSystemToken) == null ? void 0 : _k.id) != null ? _l : null;
+  let tokenId = (_n = (_m = (_l = getResult.data) == null ? void 0 : _l.getUserSystemToken) == null ? void 0 : _m.id) != null ? _n : null;
   if (!tokenId) {
     const createResult = await gqlFetch(graphqlUrl, idToken, CREATE_SECRET_API_TOKEN, {
       input: {
@@ -111,15 +148,18 @@ async function mintSurfaceSystemToken(input) {
         algorithm: "HS256"
       }
     });
-    const createErr = ((_n = (_m = createResult.errors) == null ? void 0 : _m[0]) == null ? void 0 : _n.message) || "";
+    const createErr = ((_p = (_o = createResult.errors) == null ? void 0 : _o[0]) == null ? void 0 : _p.message) || "";
     if (createErr && !/already have a system token/i.test(createErr)) {
+      if (/12 bytes|24 hex/i.test(createErr)) {
+        throw new Error(`Project "${projectId}" is not valid on this backend. Pick/create a real project in the app, then retry.`);
+      }
       throw new Error(createErr);
     }
-    if ((_p = (_o = createResult.data) == null ? void 0 : _o.createSecretApiToken) == null ? void 0 : _p.id) {
+    if ((_r = (_q = createResult.data) == null ? void 0 : _q.createSecretApiToken) == null ? void 0 : _r.id) {
       tokenId = createResult.data.createSecretApiToken.id;
     } else {
       const refetch = await gqlFetch(graphqlUrl, idToken, GET_USER_SYSTEM_TOKEN);
-      tokenId = (_s = (_r = (_q = refetch.data) == null ? void 0 : _q.getUserSystemToken) == null ? void 0 : _r.id) != null ? _s : null;
+      tokenId = (_u = (_t = (_s = refetch.data) == null ? void 0 : _s.getUserSystemToken) == null ? void 0 : _t.id) != null ? _u : null;
     }
   }
   if (!tokenId) {
@@ -128,10 +168,10 @@ async function mintSurfaceSystemToken(input) {
   const reveal = await gqlFetch(graphqlUrl, idToken, REVEAL_SECRET_API_TOKEN, {
     id: tokenId
   });
-  if ((_t = reveal.errors) == null ? void 0 : _t.length) {
-    throw new Error(((_u = reveal.errors[0]) == null ? void 0 : _u.message) || "RevealSecretApiToken failed");
+  if ((_v = reveal.errors) == null ? void 0 : _v.length) {
+    throw new Error(((_w = reveal.errors[0]) == null ? void 0 : _w.message) || "RevealSecretApiToken failed");
   }
-  const token = (_w = (_v = reveal.data) == null ? void 0 : _v.revealSecretApiToken) == null ? void 0 : _w.trim();
+  const token = (_y = (_x = reveal.data) == null ? void 0 : _x.revealSecretApiToken) == null ? void 0 : _y.trim();
   if (!token) {
     throw new Error("RevealSecretApiToken returned empty token");
   }

package/lib/hooks/mintSurfaceSystemToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"mintSurfaceSystemToken.js","sources":["../../src/hooks/mintSurfaceSystemToken.ts"],"sourcesContent":["import { readAuth0IdToken } from '../bridge/readAuth0Session';\nimport { config } from '../config/env-config';\n\nconst OBTAIN_USER_SYSTEM_TOKEN = `\n  mutation ObtainUserSystemToken($input: ObtainUserSystemTokenInput!) {\n    obtainUserSystemToken(input: $input) {\n      token\n    }\n  }\n`;\n\nconst GET_USER_SYSTEM_TOKEN = `\n  query GetUserSystemToken {\n    getUserSystemToken {\n      id\n      expiresAt\n      isSystemToken\n    }\n  }\n`;\n\nconst CREATE_SECRET_API_TOKEN = `\n  mutation CreateSecretApiToken($input: SecretApiTokenInput!) {\n    createSecretApiToken(input: $input) {\n      id\n      expiresAt\n    }\n  }\n`;\n\nconst REVEAL_SECRET_API_TOKEN = `\n  mutation RevealSecretApiToken($id: ID!) {\n    revealSecretApiToken(id: $id)\n  }\n`;\n\ntype GqlResult<T> = {\n    data?: T;\n    errors?: Array<{ message?: string }>;\n};\n\nfunction normalizeGraphqlUrl(url: string): string {\n    return url.trim().replace(/\\/$/, '');\n}\n\n/** App GRAPHQL_URL from env (optional override for device LAN rewrite). */\nexport function resolveSurfaceCatalogBackend(graphqlUrl?: string): string {\n    const raw = graphqlUrl?.trim() || config.GRAPHQL_URL;\n    if (!raw?.trim()) {\n        throw new Error('GRAPHQL_URL is not configured');\n    }\n    return normalizeGraphqlUrl(raw);\n}\n\nasync function gqlFetch<T>(\n    graphqlUrl: string,\n    idToken: string,\n    query: string,\n    variables?: Record<string, unknown>,\n): Promise<GqlResult<T>> {\n    const res = await fetch(graphqlUrl, {\n        method: 'POST',\n        headers: {\n            'content-type': 'application/json',\n            authorization: `Bearer ${idToken}`,\n        },\n        body: JSON.stringify({ query, variables }),\n    });\n    if (!res.ok) {\n        const text = await res.text().catch(() => '');\n        throw new Error(`GraphQL HTTP ${res.status}: ${text.slice(0, 200)}`);\n    }\n    return (await res.json()) as GqlResult<T>;\n}\n\nexport type MintSurfaceTokenInput = {\n    /** App GRAPHQL_URL (e.g. device-rewritten). Defaults to env GRAPHQL_URL. */\n    graphqlUrl?: string;\n    orgName?: string | null;\n    projectId?: string | null;\n    tagId?: string | null;\n};\n\nexport type MintSurfaceTokenResult = {\n    token: string;\n    /** Exact backend URL string to stamp into cdecli_token_meta. */\n    backend: string;\n};\n\n/**\n * Reveal (or obtain) a system token on GRAPHQL_URL.\n */\nexport async function mintSurfaceSystemToken(input: MintSurfaceTokenInput): Promise<MintSurfaceTokenResult> {\n    const idToken = await readAuth0IdToken();\n    if (!idToken) {\n        throw new Error('No Auth0 id_token in storage — sign in to the mobile app first.');\n    }\n\n    const graphqlUrl = resolveSurfaceCatalogBackend(input.graphqlUrl);\n    if (__DEV__) {\n        // eslint-disable-next-line no-console\n        console.log('[WebBuilder] minting system token via', graphqlUrl);\n    }\n\n    const orgName = input.orgName?.trim() || 'default';\n    const projectId = input.projectId?.trim() || 'default';\n    const environmentTagId = input.tagId?.trim() || undefined;\n\n    if (environmentTagId) {\n        try {\n            const obtained = await gqlFetch<{ obtainUserSystemToken?: { token?: string } | null }>(\n                graphqlUrl,\n                idToken,\n                OBTAIN_USER_SYSTEM_TOKEN,\n                {\n                    input: {\n                        projectId,\n                        environmentTagId,\n                        orgName,\n                        renewBufferSeconds: 7 * 24 * 60 * 60,\n                    },\n                },\n            );\n            const token = obtained.data?.obtainUserSystemToken?.token?.trim();\n            if (token && !obtained.errors?.length) {\n                if (__DEV__) {\n                    // eslint-disable-next-line no-console\n                    console.log('[WebBuilder] obtained system token length=', token.length);\n                }\n                return { token, backend: graphqlUrl };\n            }\n        } catch (err) {\n            if (__DEV__) {\n                // eslint-disable-next-line no-console\n                console.warn('[WebBuilder] obtainUserSystemToken failed, falling back to reveal:', err);\n            }\n        }\n    }\n\n    const getResult = await gqlFetch<{ getUserSystemToken?: { id?: string } | null }>(\n        graphqlUrl,\n        idToken,\n        GET_USER_SYSTEM_TOKEN,\n    );\n    if (getResult.errors?.length) {\n        throw new Error(getResult.errors[0]?.message || 'GetUserSystemToken failed');\n    }\n\n    let tokenId = getResult.data?.getUserSystemToken?.id ?? null;\n\n    if (!tokenId) {\n        const createResult = await gqlFetch<{ createSecretApiToken?: { id?: string } | null }>(\n            graphqlUrl,\n            idToken,\n            CREATE_SECRET_API_TOKEN,\n            {\n                input: {\n                    name: 'System Token',\n                    expiryInSeconds: 31536000,\n                    isSystemToken: true,\n                    environmentTagId,\n                    orgName,\n                    projectId,\n                    algorithm: 'HS256',\n                },\n            },\n        );\n\n        const createErr = createResult.errors?.[0]?.message || '';\n        if (createErr && !/already have a system token/i.test(createErr)) {\n            throw new Error(createErr);\n        }\n\n        if (createResult.data?.createSecretApiToken?.id) {\n            tokenId = createResult.data.createSecretApiToken.id;\n        } else {\n            const refetch = await gqlFetch<{ getUserSystemToken?: { id?: string } | null }>(\n                graphqlUrl,\n                idToken,\n                GET_USER_SYSTEM_TOKEN,\n            );\n            tokenId = refetch.data?.getUserSystemToken?.id ?? null;\n        }\n    }\n\n    if (!tokenId) {\n        throw new Error('No system token id on GraphQL backend — cannot reveal.');\n    }\n\n    const reveal = await gqlFetch<{ revealSecretApiToken?: string | null }>(\n        graphqlUrl,\n        idToken,\n        REVEAL_SECRET_API_TOKEN,\n        { id: tokenId },\n    );\n    if (reveal.errors?.length) {\n        throw new Error(reveal.errors[0]?.message || 'RevealSecretApiToken failed');\n    }\n\n    const token = reveal.data?.revealSecretApiToken?.trim();\n    if (!token) {\n        throw new Error('RevealSecretApiToken returned empty token');\n    }\n\n    if (__DEV__) {\n        // eslint-disable-next-line no-console\n        console.log('[WebBuilder] minted system token length=', token.length);\n    }\n    return { token, backend: graphqlUrl };\n}\n\nexport function appendSurfaceAuthParams(baseUrl: string, token: string, state: string): string {\n    try {\n        const url = new URL(baseUrl);\n        url.searchParams.set('token', token);\n        url.searchParams.set('code', token);\n        url.searchParams.set('state', state);\n        return url.toString();\n    } catch {\n        const sep = baseUrl.includes('?') ? '&' : '?';\n        return `${baseUrl}${sep}token=${encodeURIComponent(token)}&code=${encodeURIComponent(token)}&state=${encodeURIComponent(state)}`;\n    }\n}\n\nfunction tokenFingerprint(token: string): string {\n    const sig = token.split('.')[2] ?? token;\n    return sig.slice(-24);\n}\n\n/** Shared WebView boot script: token + meta + fetch shims for surface-kit auth. */\nfunction buildSurfaceHandoffScript(token: string, backend: string, state: string, withGateRecovery: boolean): string {\n    const safeToken = JSON.stringify(token);\n    const safeBackend = JSON.stringify(backend);\n    const safeState = JSON.stringify(state);\n    const fp = JSON.stringify(tokenFingerprint(token));\n    const recovery = withGateRecovery\n        ? `\n    function tryRecover() {\n      stamp();\n      var gate = document.querySelector('[data-surface-login]');\n      if (!gate) return;\n      if (sessionStorage.getItem('__yantra_wb_token_reload')) return;\n      sessionStorage.setItem('__yantra_wb_token_reload', '1');\n      var u = new URL(window.location.href);\n      u.searchParams.set('token', t);\n      u.searchParams.set('code', t);\n      u.searchParams.set('state', state);\n      window.location.replace(u.toString());\n    }\n    tryRecover();\n    var i = 0;\n    var timer = setInterval(function () {\n      i += 1;\n      tryRecover();\n      if (i >= 40 || !document.querySelector('[data-surface-login]')) clearInterval(timer);\n    }, 250);\n`\n        : `\n    var n = 0;\n    var id = setInterval(function () {\n      stamp();\n      n += 1;\n      if (n >= 80) clearInterval(id);\n    }, 50);\n`;\n\n    return `\n(function () {\n  try {\n    var t = ${safeToken};\n    var backend = ${safeBackend};\n    var state = ${safeState};\n    var fp = ${fp};\n    var PROBE_Q = 'query { getUserAccount { id } }';\n\n    if (!window.__yantraWbFetchPatched) {\n      window.__yantraWbFetchPatched = true;\n      var origFetch = window.fetch.bind(window);\n      window.fetch = function (input, init) {\n        try {\n          var url = typeof input === 'string' ? input : (input && input.url) ? String(input.url) : '';\n          // Force surface-kit resolveCatalogBackend() to our GRAPHQL_URL (not remote agent → ideback).\n          if (url.indexOf('/v1/auth/context') !== -1) {\n            return Promise.resolve(new Response(\n              JSON.stringify({ backendGraphqlUrl: backend }),\n              { status: 200, headers: { 'Content-Type': 'application/json' } }\n            ));\n          }\n          var body = init && typeof init.body === 'string' ? init.body : '';\n          if (body && body.indexOf('getUserAccount') !== -1) {\n            var parsed = JSON.parse(body);\n            var q = parsed && typeof parsed.query === 'string' ? parsed.query.replace(/\\\\s+/g, ' ').trim() : '';\n            if (q === PROBE_Q) {\n              return Promise.resolve(new Response(\n                JSON.stringify({ data: { getUserAccount: { id: 'mobile-webview-handoff' } } }),\n                { status: 200, headers: { 'Content-Type': 'application/json' } }\n              ));\n            }\n          }\n        } catch (e0) {}\n        return origFetch(input, init);\n      };\n    }\n\n    function stamp() {\n      try {\n        sessionStorage.setItem('cdecli_oauth_state', state);\n        localStorage.setItem('cdecli_token', t);\n        sessionStorage.setItem('cdecli_token', t);\n        localStorage.setItem('cdecli_system_token', t);\n        localStorage.setItem('cdecli_token_meta', JSON.stringify({\n          backend: backend,\n          verifiedAt: Date.now(),\n          fp: fp\n        }));\n      } catch (e1) {}\n    }\n    stamp();\n    ${recovery}\n  } catch (e) {}\n  true;\n})();\ntrue;\n`;\n}\n\nexport function buildCdecliTokenInjection(token: string, backend: string, state: string): string {\n    return buildSurfaceHandoffScript(token, backend, state, false);\n}\n\nexport function buildSurfaceGateRecoveryScript(token: string, backend: string, state: string): string {\n    return buildSurfaceHandoffScript(token, backend, state, true);\n}\n"],"names":["token"],"mappings":"0GAEA,MAAM,wBAA2B,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAOjC,MAAM,qBAAwB,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAS9B,MAAM,uBAA0B,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQhC,MAAM,uBAA0B,GAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWhC,SAAS,oBAAoB,GAAqB,EAAA;AAChD,EAAA,OAAO,GAAI,CAAA,IAAA,EAAO,CAAA,OAAA,CAAQ,OAAO,EAAE,CAAA;AACrC;AAGO,SAAS,6BAA6B,UAA6B,EAAA;AACxE,EAAM,MAAA,GAAA,GAAA,CAAM,UAAY,IAAA,IAAA,GAAA,MAAA,GAAA,UAAA,CAAA,IAAA,EAAA,KAAU,MAAO,CAAA,WAAA;AACzC,EAAI,IAAA,EAAC,2BAAK,IAAQ,EAAA,CAAA,EAAA;AAChB,IAAM,MAAA,IAAI,MAAM,+BAA+B,CAAA;AAAA;AAEjD,EAAA,OAAO,oBAAoB,GAAG,CAAA;AAChC;AACA,eAAe,QAAY,CAAA,UAAA,EAAoB,OAAiB,EAAA,KAAA,EAAe,SAA4D,EAAA;AACzI,EAAM,MAAA,GAAA,GAAM,MAAM,KAAA,CAAM,UAAY,EAAA;AAAA,IAClC,MAAQ,EAAA,MAAA;AAAA,IACR,OAAS,EAAA;AAAA,MACP,cAAgB,EAAA,kBAAA;AAAA,MAChB,aAAA,EAAe,UAAU,OAAO,CAAA;AAAA,KAClC;AAAA,IACA,IAAA,EAAM,KAAK,SAAU,CAAA;AAAA,MACnB,KAAA;AAAA,MACA;AAAA,KACD;AAAA,GACF,CAAA;AACD,EAAI,IAAA,CAAC,IAAI,EAAI,EAAA;AACX,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAO,CAAA,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,IAAM,MAAA,IAAI,KAAM,CAAA,CAAA,aAAA,EAAgB,GAAI,CAAA,MAAM,CAAK,EAAA,EAAA,IAAA,CAAK,KAAM,CAAA,CAAA,EAAG,GAAG,CAAC,CAAE,CAAA,CAAA;AAAA;AAErE,EAAQ,OAAA,MAAM,IAAI,IAAK,EAAA;AACzB;AAiBA,eAAsB,uBAAuB,KAA+D,EAAA;AAnF5G,EAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AAoFE,EAAM,MAAA,OAAA,GAAU,MAAM,gBAAiB,EAAA;AACvC,EAAA,IAAI,CAAC,OAAS,EAAA;AACZ,IAAM,MAAA,IAAI,MAAM,sEAAiE,CAAA;AAAA;AAEnF,EAAM,MAAA,UAAA,GAAa,4BAA6B,CAAA,KAAA,CAAM,UAAU,CAAA;AAChE,EAAA,IAAI,OAAS,EAAA;AAEX,IAAQ,OAAA,CAAA,GAAA,CAAI,yCAAyC,UAAU,CAAA;AAAA;AAEjE,EAAA,MAAM,OAAU,GAAA,CAAA,CAAA,EAAA,GAAA,KAAA,CAAM,OAAN,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAe,IAAU,EAAA,KAAA,SAAA;AACzC,EAAA,MAAM,SAAY,GAAA,CAAA,CAAA,EAAA,GAAA,KAAA,CAAM,SAAN,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAiB,IAAU,EAAA,KAAA,SAAA;AAC7C,EAAA,MAAM,gBAAmB,GAAA,CAAA,CAAA,EAAA,GAAA,KAAA,CAAM,KAAN,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAa,IAAU,EAAA,KAAA,MAAA;AAChD,EAAA,IAAI,gBAAkB,EAAA;AACpB,IAAI,IAAA;AACF,MAAA,MAAM,QAAW,GAAA,MAAM,QAIpB,CAAA,UAAA,EAAY,SAAS,wBAA0B,EAAA;AAAA,QAChD,KAAO,EAAA;AAAA,UACL,SAAA;AAAA,UACA,gBAAA;AAAA,UACA,OAAA;AAAA,UACA,kBAAA,EAAoB,CAAI,GAAA,EAAA,GAAK,EAAK,GAAA;AAAA;AACpC,OACD,CAAA;AACD,MAAA,MAAMA,UAAQ,EAAS,GAAA,CAAA,EAAA,GAAA,CAAA,EAAA,GAAA,QAAA,CAAA,IAAA,KAAT,mBAAe,qBAAf,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAsC,UAAtC,IAA6C,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,IAAA,EAAA;AAC3D,MAAA,IAAIA,MAAS,IAAA,EAAA,CAAC,EAAS,GAAA,QAAA,CAAA,MAAA,KAAT,mBAAiB,MAAQ,CAAA,EAAA;AACrC,QAAA,IAAI,OAAS,EAAA;AAEX,UAAQ,OAAA,CAAA,GAAA,CAAI,4CAA8CA,EAAAA,MAAAA,CAAM,MAAM,CAAA;AAAA;AAExE,QAAO,OAAA;AAAA,UACL,KAAAA,EAAAA,MAAAA;AAAA,UACA,OAAS,EAAA;AAAA,SACX;AAAA;AACF,aACO,GAAK,EAAA;AACZ,MAAA,IAAI,OAAS,EAAA;AAEX,QAAQ,OAAA,CAAA,IAAA,CAAK,sEAAsE,GAAG,CAAA;AAAA;AACxF;AACF;AAEF,EAAA,MAAM,SAAY,GAAA,MAAM,QAIrB,CAAA,UAAA,EAAY,SAAS,qBAAqB,CAAA;AAC7C,EAAI,IAAA,CAAA,EAAA,GAAA,SAAA,CAAU,MAAV,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAkB,MAAQ,EAAA;AAC5B,IAAM,MAAA,IAAI,QAAM,EAAU,GAAA,SAAA,CAAA,MAAA,CAAO,CAAC,CAAlB,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAqB,YAAW,2BAA2B,CAAA;AAAA;AAE7E,EAAA,IAAI,WAAU,EAAU,GAAA,CAAA,EAAA,GAAA,CAAA,EAAA,GAAA,SAAA,CAAA,IAAA,KAAV,mBAAgB,kBAAhB,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAoC,OAApC,IAA0C,GAAA,EAAA,GAAA,IAAA;AACxD,EAAA,IAAI,CAAC,OAAS,EAAA;AACZ,IAAA,MAAM,YAAe,GAAA,MAAM,QAIxB,CAAA,UAAA,EAAY,SAAS,uBAAyB,EAAA;AAAA,MAC/C,KAAO,EAAA;AAAA,QACL,IAAM,EAAA,cAAA;AAAA,QACN,eAAiB,EAAA,OAAA;AAAA,QACjB,aAAe,EAAA,IAAA;AAAA,QACf,gBAAA;AAAA,QACA,OAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAW,EAAA;AAAA;AACb,KACD,CAAA;AACD,IAAA,MAAM,cAAY,EAAa,GAAA,CAAA,EAAA,GAAA,YAAA,CAAA,MAAA,KAAb,IAAsB,GAAA,MAAA,GAAA,EAAA,CAAA,CAAA,CAAA,KAAtB,mBAA0B,OAAW,KAAA,EAAA;AACvD,IAAA,IAAI,SAAa,IAAA,CAAC,8BAA+B,CAAA,IAAA,CAAK,SAAS,CAAG,EAAA;AAChE,MAAM,MAAA,IAAI,MAAM,SAAS,CAAA;AAAA;AAE3B,IAAA,IAAA,CAAI,EAAa,GAAA,CAAA,EAAA,GAAA,YAAA,CAAA,IAAA,KAAb,IAAmB,GAAA,MAAA,GAAA,EAAA,CAAA,oBAAA,KAAnB,mBAAyC,EAAI,EAAA;AAC/C,MAAU,OAAA,GAAA,YAAA,CAAa,KAAK,oBAAqB,CAAA,EAAA;AAAA,KAC5C,MAAA;AACL,MAAA,MAAM,OAAU,GAAA,MAAM,QAInB,CAAA,UAAA,EAAY,SAAS,qBAAqB,CAAA;AAC7C,MAAA,OAAA,GAAA,CAAU,yBAAQ,IAAR,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAc,kBAAd,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAkC,OAAlC,IAAwC,GAAA,EAAA,GAAA,IAAA;AAAA;AACpD;AAEF,EAAA,IAAI,CAAC,OAAS,EAAA;AACZ,IAAM,MAAA,IAAI,MAAM,6DAAwD,CAAA;AAAA;AAE1E,EAAA,MAAM,MAAS,GAAA,MAAM,QAElB,CAAA,UAAA,EAAY,SAAS,uBAAyB,EAAA;AAAA,IAC/C,EAAI,EAAA;AAAA,GACL,CAAA;AACD,EAAI,IAAA,CAAA,EAAA,GAAA,MAAA,CAAO,MAAP,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAe,MAAQ,EAAA;AACzB,IAAM,MAAA,IAAI,QAAM,EAAO,GAAA,MAAA,CAAA,MAAA,CAAO,CAAC,CAAf,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAkB,YAAW,6BAA6B,CAAA;AAAA;AAE5E,EAAA,MAAM,KAAQ,GAAA,CAAA,EAAA,GAAA,CAAA,EAAA,GAAA,MAAA,CAAO,IAAP,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAa,yBAAb,IAAmC,GAAA,MAAA,GAAA,EAAA,CAAA,IAAA,EAAA;AACjD,EAAA,IAAI,CAAC,KAAO,EAAA;AACV,IAAM,MAAA,IAAI,MAAM,2CAA2C,CAAA;AAAA;AAE7D,EAAA,IAAI,OAAS,EAAA;AAEX,IAAQ,OAAA,CAAA,GAAA,CAAI,0CAA4C,EAAA,KAAA,CAAM,MAAM,CAAA;AAAA;AAEtE,EAAO,OAAA;AAAA,IACL,KAAA;AAAA,IACA,OAAS,EAAA;AAAA,GACX;AACF;AACgB,SAAA,uBAAA,CAAwB,OAAiB,EAAA,KAAA,EAAe,KAAuB,EAAA;AAC7F,EAAI,IAAA;AACF,IAAM,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,OAAO,CAAA;AAC3B,IAAI,GAAA,CAAA,YAAA,CAAa,GAAI,CAAA,OAAA,EAAS,KAAK,CAAA;AACnC,IAAI,GAAA,CAAA,YAAA,CAAa,GAAI,CAAA,MAAA,EAAQ,KAAK,CAAA;AAClC,IAAI,GAAA,CAAA,YAAA,CAAa,GAAI,CAAA,OAAA,EAAS,KAAK,CAAA;AACnC,IAAA,OAAO,IAAI,QAAS,EAAA;AAAA,GACd,CAAA,OAAA,CAAA,EAAA;AACN,IAAA,MAAM,GAAM,GAAA,OAAA,CAAQ,QAAS,CAAA,GAAG,IAAI,GAAM,GAAA,GAAA;AAC1C,IAAA,OAAO,CAAG,EAAA,OAAO,CAAG,EAAA,GAAG,SAAS,kBAAmB,CAAA,KAAK,CAAC,CAAA,MAAA,EAAS,mBAAmB,KAAK,CAAC,CAAU,OAAA,EAAA,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA;AAElI;AACA,SAAS,iBAAiB,KAAuB,EAAA;AA5MjD,EAAA,IAAA,EAAA;AA6ME,EAAA,MAAM,OAAM,EAAM,GAAA,KAAA,CAAA,KAAA,CAAM,GAAG,CAAE,CAAA,CAAC,MAAlB,IAAuB,GAAA,EAAA,GAAA,KAAA;AACnC,EAAO,OAAA,GAAA,CAAI,MAAM,GAAG,CAAA;AACtB;AAGA,SAAS,yBAA0B,CAAA,KAAA,EAAe,OAAiB,EAAA,KAAA,EAAe,gBAAmC,EAAA;AACnH,EAAM,MAAA,SAAA,GAAY,IAAK,CAAA,SAAA,CAAU,KAAK,CAAA;AACtC,EAAM,MAAA,WAAA,GAAc,IAAK,CAAA,SAAA,CAAU,OAAO,CAAA;AAC1C,EAAM,MAAA,SAAA,GAAY,IAAK,CAAA,SAAA,CAAU,KAAK,CAAA;AACtC,EAAA,MAAM,EAAK,GAAA,IAAA,CAAK,SAAU,CAAA,gBAAA,CAAiB,KAAK,CAAC,CAAA;AACjD,EAAA,MAAM,WAAW,gBAAmB,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAoBlC,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQF,EAAO,OAAA;AAAA;AAAA;AAAA,YAAA,EAGK,SAAS,CAAA;AAAA,kBAAA,EACH,WAAW,CAAA;AAAA,gBAAA,EACb,SAAS,CAAA;AAAA,aAAA,EACZ,EAAE,CAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAA,EA8CX,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAMd;AACgB,SAAA,yBAAA,CAA0B,KAAe,EAAA,OAAA,EAAiB,KAAuB,EAAA;AAC/F,EAAA,OAAO,yBAA0B,CAAA,KAAA,EAAO,OAAS,EAAA,KAAA,EAAO,KAAK,CAAA;AAC/D;AACgB,SAAA,8BAAA,CAA+B,KAAe,EAAA,OAAA,EAAiB,KAAuB,EAAA;AACpG,EAAA,OAAO,yBAA0B,CAAA,KAAA,EAAO,OAAS,EAAA,KAAA,EAAO,IAAI,CAAA;AAC9D"}
+{"version":3,"file":"mintSurfaceSystemToken.js","sources":["../../src/hooks/mintSurfaceSystemToken.ts"],"sourcesContent":["import { AuthStrategy, HttpHeaders } from 'common';\nimport { readAuth0IdToken } from '../bridge/readAuth0Session';\nimport { config } from '../config/env-config';\n\nconst OBTAIN_USER_SYSTEM_TOKEN = `\n  mutation ObtainUserSystemToken($input: ObtainUserSystemTokenInput!) {\n    obtainUserSystemToken(input: $input) {\n      token\n    }\n  }\n`;\n\nconst GET_USER_SYSTEM_TOKEN = `\n  query GetUserSystemToken {\n    getUserSystemToken {\n      id\n      expiresAt\n      isSystemToken\n    }\n  }\n`;\n\nconst CREATE_SECRET_API_TOKEN = `\n  mutation CreateSecretApiToken($input: CreateSecretApiTokenInput!) {\n    createSecretApiToken(input: $input) {\n      id\n      expiresAt\n    }\n  }\n`;\n\nconst REVEAL_SECRET_API_TOKEN = `\n  mutation RevealSecretApiToken($id: ID!) {\n    revealSecretApiToken(id: $id)\n  }\n`;\n\ntype GqlResult<T> = {\n    data?: T;\n    errors?: Array<{ message?: string }>;\n};\n\nfunction normalizeGraphqlUrl(url: string): string {\n    return url.trim().replace(/\\/$/, '');\n}\n\n/** App GRAPHQL_URL from env (optional override for device LAN rewrite). */\nexport function resolveSurfaceCatalogBackend(graphqlUrl?: string): string {\n    const raw = graphqlUrl?.trim() || config.GRAPHQL_URL;\n    if (!raw?.trim()) {\n        throw new Error('GRAPHQL_URL is not configured');\n    }\n    return normalizeGraphqlUrl(raw);\n}\n\nasync function gqlFetch<T>(\n    graphqlUrl: string,\n    idToken: string,\n    query: string,\n    variables?: Record<string, unknown>,\n): Promise<GqlResult<T>> {\n    // Staging JWT middleware only treats Bearer as mobile/SPA when\n    // `ismobile` (or `isspa`) is set — without it we get HTTP 401 Unauthorized.\n    // Match Apollo mobile authHeadersLink + Auth0Client.commonFetchRequestHeaders.\n    const res = await fetch(graphqlUrl, {\n        method: 'POST',\n        headers: {\n            [HttpHeaders.CONTENT_TYPE]: 'application/json',\n            [HttpHeaders.AUTHORIZATION]: `Bearer ${idToken}`,\n            [HttpHeaders.IS_MOBILE]: 'true',\n            [HttpHeaders.AUTH_STRATEGY]: AuthStrategy.Auth0,\n        },\n        body: JSON.stringify({ query, variables }),\n    });\n    if (!res.ok) {\n        const text = await res.text().catch(() => '');\n        throw new Error(`GraphQL HTTP ${res.status}: ${text.slice(0, 200)}`);\n    }\n    return (await res.json()) as GqlResult<T>;\n}\n\nexport type MintSurfaceTokenInput = {\n    /** App GRAPHQL_URL (e.g. device-rewritten). Defaults to env GRAPHQL_URL. */\n    graphqlUrl?: string;\n    orgName?: string | null;\n    projectId?: string | null;\n    tagId?: string | null;\n};\n\nexport type MintSurfaceTokenResult = {\n    token: string;\n    /** Exact backend URL string to stamp into cdecli_token_meta. */\n    backend: string;\n};\n\n/**\n * Reveal (or obtain) a system token on GRAPHQL_URL.\n */\n/** Local-dev testing project — must never mint against this on staging/prod. */\nconst DEV_TESTING_PROJECT_UUID = '9a8ac704-1040-4836-9b72-48b771ca91b1';\n\nconst OBJECT_ID_HEX = /^[a-fA-F0-9]{24}$/;\nconst PROJECT_UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;\n\nfunction assertMintableProjectId(projectId: string): void {\n    if (projectId === 'default' || !projectId.trim()) {\n        throw new Error('Missing projectId — wait for org/project bootstrap, then retry.');\n    }\n    if (!__DEV__ && projectId === DEV_TESTING_PROJECT_UUID) {\n        throw new Error(\n            'Invalid projectId (dev testing UUID). Open Home so a real project can be created, then retry.',\n        );\n    }\n    if (!OBJECT_ID_HEX.test(projectId) && !PROJECT_UUID.test(projectId)) {\n        throw new Error(`Invalid projectId format for system token mint: ${projectId.slice(0, 48)}`);\n    }\n}\n\nexport async function mintSurfaceSystemToken(input: MintSurfaceTokenInput): Promise<MintSurfaceTokenResult> {\n    const idToken = await readAuth0IdToken();\n    if (!idToken) {\n        throw new Error('No Auth0 id_token in storage — sign in to the mobile app first.');\n    }\n\n    const graphqlUrl = resolveSurfaceCatalogBackend(input.graphqlUrl);\n    if (__DEV__) {\n        // eslint-disable-next-line no-console\n        console.log('[WebBuilder] minting system token via', graphqlUrl);\n    }\n\n    const orgName = input.orgName?.trim();\n    const projectId = input.projectId?.trim();\n    const environmentTagId = input.tagId?.trim();\n\n    if (!orgName) {\n        throw new Error('Missing orgName — wait for org bootstrap, then retry.');\n    }\n    if (!projectId) {\n        throw new Error('Missing projectId — wait for org/project bootstrap, then retry.');\n    }\n    if (!environmentTagId) {\n        throw new Error('Missing environmentTagId — cannot mint system token.');\n    }\n    assertMintableProjectId(projectId);\n\n    // Canonical get-or-create (resolves project UUID → Mongo id server-side).\n    try {\n        const obtained = await gqlFetch<{ obtainUserSystemToken?: { token?: string } | null }>(\n            graphqlUrl,\n            idToken,\n            OBTAIN_USER_SYSTEM_TOKEN,\n            {\n                input: {\n                    projectId,\n                    environmentTagId,\n                    orgName,\n                    renewBufferSeconds: 7 * 24 * 60 * 60,\n                    algorithm: 'HS256',\n                },\n            },\n        );\n        const token = obtained.data?.obtainUserSystemToken?.token?.trim();\n        if (token && !obtained.errors?.length) {\n            if (__DEV__) {\n                // eslint-disable-next-line no-console\n                console.log('[WebBuilder] obtained system token length=', token.length);\n            }\n            return { token, backend: graphqlUrl };\n        }\n        if (obtained.errors?.length) {\n            throw new Error(obtained.errors[0]?.message || 'obtainUserSystemToken failed');\n        }\n    } catch (err) {\n        if (__DEV__) {\n            // eslint-disable-next-line no-console\n            console.warn('[WebBuilder] obtainUserSystemToken failed, falling back to reveal:', err);\n        }\n        // Fall through to get/create/reveal only when obtain is unavailable.\n        const msg = err instanceof Error ? err.message : String(err);\n        if (/12 bytes|24 hex|Project not found/i.test(msg)) {\n            throw new Error(\n                `Project \"${projectId}\" is not valid on this backend. Pick/create a real project in the app, then retry.`,\n            );\n        }\n        // Continue to legacy path for older backends without obtainUserSystemToken.\n        if (!/Unknown field|Cannot query field|obtainUserSystemToken/i.test(msg)) {\n            // Non-schema errors from obtain should surface (auth, project, etc.).\n            if (/Unauthorized|401|Project not found|Invalid project/i.test(msg)) {\n                throw err instanceof Error ? err : new Error(msg);\n            }\n        }\n    }\n\n    const getResult = await gqlFetch<{ getUserSystemToken?: { id?: string } | null }>(\n        graphqlUrl,\n        idToken,\n        GET_USER_SYSTEM_TOKEN,\n    );\n    if (getResult.errors?.length) {\n        throw new Error(getResult.errors[0]?.message || 'GetUserSystemToken failed');\n    }\n\n    let tokenId = getResult.data?.getUserSystemToken?.id ?? null;\n\n    if (!tokenId) {\n        const createResult = await gqlFetch<{ createSecretApiToken?: { id?: string } | null }>(\n            graphqlUrl,\n            idToken,\n            CREATE_SECRET_API_TOKEN,\n            {\n                input: {\n                    name: 'System Token',\n                    expiryInSeconds: 31536000,\n                    isSystemToken: true,\n                    environmentTagId,\n                    orgName,\n                    projectId,\n                    algorithm: 'HS256',\n                },\n            },\n        );\n\n        const createErr = createResult.errors?.[0]?.message || '';\n        if (createErr && !/already have a system token/i.test(createErr)) {\n            if (/12 bytes|24 hex/i.test(createErr)) {\n                throw new Error(\n                    `Project \"${projectId}\" is not valid on this backend. Pick/create a real project in the app, then retry.`,\n                );\n            }\n            throw new Error(createErr);\n        }\n\n        if (createResult.data?.createSecretApiToken?.id) {\n            tokenId = createResult.data.createSecretApiToken.id;\n        } else {\n            const refetch = await gqlFetch<{ getUserSystemToken?: { id?: string } | null }>(\n                graphqlUrl,\n                idToken,\n                GET_USER_SYSTEM_TOKEN,\n            );\n            tokenId = refetch.data?.getUserSystemToken?.id ?? null;\n        }\n    }\n\n    if (!tokenId) {\n        throw new Error('No system token id on GraphQL backend — cannot reveal.');\n    }\n\n    const reveal = await gqlFetch<{ revealSecretApiToken?: string | null }>(\n        graphqlUrl,\n        idToken,\n        REVEAL_SECRET_API_TOKEN,\n        { id: tokenId },\n    );\n    if (reveal.errors?.length) {\n        throw new Error(reveal.errors[0]?.message || 'RevealSecretApiToken failed');\n    }\n\n    const token = reveal.data?.revealSecretApiToken?.trim();\n    if (!token) {\n        throw new Error('RevealSecretApiToken returned empty token');\n    }\n\n    if (__DEV__) {\n        // eslint-disable-next-line no-console\n        console.log('[WebBuilder] minted system token length=', token.length);\n    }\n    return { token, backend: graphqlUrl };\n}\n\nexport function appendSurfaceAuthParams(baseUrl: string, token: string, state: string): string {\n    try {\n        const url = new URL(baseUrl);\n        url.searchParams.set('token', token);\n        url.searchParams.set('code', token);\n        url.searchParams.set('state', state);\n        return url.toString();\n    } catch {\n        const sep = baseUrl.includes('?') ? '&' : '?';\n        return `${baseUrl}${sep}token=${encodeURIComponent(token)}&code=${encodeURIComponent(token)}&state=${encodeURIComponent(state)}`;\n    }\n}\n\nfunction tokenFingerprint(token: string): string {\n    const sig = token.split('.')[2] ?? token;\n    return sig.slice(-24);\n}\n\n/** Shared WebView boot script: token + meta + fetch shims for surface-kit auth. */\nfunction buildSurfaceHandoffScript(token: string, backend: string, state: string, withGateRecovery: boolean): string {\n    const safeToken = JSON.stringify(token);\n    const safeBackend = JSON.stringify(backend);\n    const safeState = JSON.stringify(state);\n    const fp = JSON.stringify(tokenFingerprint(token));\n    const recovery = withGateRecovery\n        ? `\n    function tryRecover() {\n      stamp();\n      var gate = document.querySelector('[data-surface-login]');\n      if (!gate) return;\n      if (sessionStorage.getItem('__yantra_wb_token_reload')) return;\n      sessionStorage.setItem('__yantra_wb_token_reload', '1');\n      var u = new URL(window.location.href);\n      u.searchParams.set('token', t);\n      u.searchParams.set('code', t);\n      u.searchParams.set('state', state);\n      window.location.replace(u.toString());\n    }\n    tryRecover();\n    var i = 0;\n    var timer = setInterval(function () {\n      i += 1;\n      tryRecover();\n      if (i >= 40 || !document.querySelector('[data-surface-login]')) clearInterval(timer);\n    }, 250);\n`\n        : `\n    var n = 0;\n    var id = setInterval(function () {\n      stamp();\n      n += 1;\n      if (n >= 80) clearInterval(id);\n    }, 50);\n`;\n\n    return `\n(function () {\n  try {\n    var t = ${safeToken};\n    var backend = ${safeBackend};\n    var state = ${safeState};\n    var fp = ${fp};\n    var PROBE_Q = 'query { getUserAccount { id } }';\n\n    if (!window.__yantraWbFetchPatched) {\n      window.__yantraWbFetchPatched = true;\n      var origFetch = window.fetch.bind(window);\n      window.fetch = function (input, init) {\n        try {\n          var url = typeof input === 'string' ? input : (input && input.url) ? String(input.url) : '';\n          // Force surface-kit resolveCatalogBackend() to our GRAPHQL_URL (not remote agent → ideback).\n          if (url.indexOf('/v1/auth/context') !== -1) {\n            return Promise.resolve(new Response(\n              JSON.stringify({ backendGraphqlUrl: backend }),\n              { status: 200, headers: { 'Content-Type': 'application/json' } }\n            ));\n          }\n          var body = init && typeof init.body === 'string' ? init.body : '';\n          if (body && body.indexOf('getUserAccount') !== -1) {\n            var parsed = JSON.parse(body);\n            var q = parsed && typeof parsed.query === 'string' ? parsed.query.replace(/\\\\s+/g, ' ').trim() : '';\n            if (q === PROBE_Q) {\n              return Promise.resolve(new Response(\n                JSON.stringify({ data: { getUserAccount: { id: 'mobile-webview-handoff' } } }),\n                { status: 200, headers: { 'Content-Type': 'application/json' } }\n              ));\n            }\n          }\n        } catch (e0) {}\n        return origFetch(input, init);\n      };\n    }\n\n    function stamp() {\n      try {\n        sessionStorage.setItem('cdecli_oauth_state', state);\n        localStorage.setItem('cdecli_token', t);\n        sessionStorage.setItem('cdecli_token', t);\n        localStorage.setItem('cdecli_system_token', t);\n        localStorage.setItem('cdecli_token_meta', JSON.stringify({\n          backend: backend,\n          verifiedAt: Date.now(),\n          fp: fp\n        }));\n      } catch (e1) {}\n    }\n    stamp();\n    ${recovery}\n  } catch (e) {}\n  true;\n})();\ntrue;\n`;\n}\n\nexport function buildCdecliTokenInjection(token: string, backend: string, state: string): string {\n    return buildSurfaceHandoffScript(token, backend, state, false);\n}\n\nexport function buildSurfaceGateRecoveryScript(token: string, backend: string, state: string): string {\n    return buildSurfaceHandoffScript(token, backend, state, true);\n}\n"],"names":["token"],"mappings":"wJAGA,MAAM,wBAA2B,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAOjC,MAAM,qBAAwB,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAS9B,MAAM,uBAA0B,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQhC,MAAM,uBAA0B,GAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWhC,SAAS,oBAAoB,GAAqB,EAAA;AAChD,EAAA,OAAO,GAAI,CAAA,IAAA,EAAO,CAAA,OAAA,CAAQ,OAAO,EAAE,CAAA;AACrC;AAGO,SAAS,6BAA6B,UAA6B,EAAA;AACxE,EAAM,MAAA,GAAA,GAAA,CAAM,UAAY,IAAA,IAAA,GAAA,MAAA,GAAA,UAAA,CAAA,IAAA,EAAA,KAAU,MAAO,CAAA,WAAA;AACzC,EAAI,IAAA,EAAC,2BAAK,IAAQ,EAAA,CAAA,EAAA;AAChB,IAAM,MAAA,IAAI,MAAM,+BAA+B,CAAA;AAAA;AAEjD,EAAA,OAAO,oBAAoB,GAAG,CAAA;AAChC;AACA,eAAe,QAAY,CAAA,UAAA,EAAoB,OAAiB,EAAA,KAAA,EAAe,SAA4D,EAAA;AAIzI,EAAM,MAAA,GAAA,GAAM,MAAM,KAAA,CAAM,UAAY,EAAA;AAAA,IAClC,MAAQ,EAAA,MAAA;AAAA,IACR,OAAS,EAAA;AAAA,MACP,CAAC,WAAY,CAAA,YAAY,GAAG,kBAAA;AAAA,MAC5B,CAAC,WAAA,CAAY,aAAa,GAAG,UAAU,OAAO,CAAA,CAAA;AAAA,MAC9C,CAAC,WAAY,CAAA,SAAS,GAAG,MAAA;AAAA,MACzB,CAAC,WAAA,CAAY,aAAa,GAAG,YAAa,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,KAAK,SAAU,CAAA;AAAA,MACnB,KAAA;AAAA,MACA;AAAA,KACD;AAAA,GACF,CAAA;AACD,EAAI,IAAA,CAAC,IAAI,EAAI,EAAA;AACX,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAO,CAAA,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,IAAM,MAAA,IAAI,KAAM,CAAA,CAAA,aAAA,EAAgB,GAAI,CAAA,MAAM,CAAK,EAAA,EAAA,IAAA,CAAK,KAAM,CAAA,CAAA,EAAG,GAAG,CAAC,CAAE,CAAA,CAAA;AAAA;AAErE,EAAQ,OAAA,MAAM,IAAI,IAAK,EAAA;AACzB;AAkBA,MAAM,wBAA2B,GAAA,sCAAA;AACjC,MAAM,aAAgB,GAAA,mBAAA;AACtB,MAAM,YAAe,GAAA,+EAAA;AACrB,SAAS,wBAAwB,SAAyB,EAAA;AACxD,EAAA,IAAI,SAAc,KAAA,SAAA,IAAa,CAAC,SAAA,CAAU,MAAQ,EAAA;AAChD,IAAM,MAAA,IAAI,MAAM,sEAAiE,CAAA;AAAA;AAEnF,EAAI,IAAA,CAAC,OAAW,IAAA,SAAA,KAAc,wBAA0B,EAAA;AACtD,IAAM,MAAA,IAAI,MAAM,+FAA+F,CAAA;AAAA;AAEjH,EAAI,IAAA,CAAC,cAAc,IAAK,CAAA,SAAS,KAAK,CAAC,YAAA,CAAa,IAAK,CAAA,SAAS,CAAG,EAAA;AACnE,IAAM,MAAA,IAAI,MAAM,CAAmD,gDAAA,EAAA,SAAA,CAAU,MAAM,CAAG,EAAA,EAAE,CAAC,CAAE,CAAA,CAAA;AAAA;AAE/F;AACA,eAAsB,uBAAuB,KAA+D,EAAA;AAxG5G,EAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AAyGE,EAAM,MAAA,OAAA,GAAU,MAAM,gBAAiB,EAAA;AACvC,EAAA,IAAI,CAAC,OAAS,EAAA;AACZ,IAAM,MAAA,IAAI,MAAM,sEAAiE,CAAA;AAAA;AAEnF,EAAM,MAAA,UAAA,GAAa,4BAA6B,CAAA,KAAA,CAAM,UAAU,CAAA;AAChE,EAAA,IAAI,OAAS,EAAA;AAEX,IAAQ,OAAA,CAAA,GAAA,CAAI,yCAAyC,UAAU,CAAA;AAAA;AAEjE,EAAM,MAAA,OAAA,GAAA,CAAU,EAAM,GAAA,KAAA,CAAA,OAAA,KAAN,IAAe,GAAA,MAAA,GAAA,EAAA,CAAA,IAAA,EAAA;AAC/B,EAAM,MAAA,SAAA,GAAA,CAAY,EAAM,GAAA,KAAA,CAAA,SAAA,KAAN,IAAiB,GAAA,MAAA,GAAA,EAAA,CAAA,IAAA,EAAA;AACnC,EAAM,MAAA,gBAAA,GAAA,CAAmB,EAAM,GAAA,KAAA,CAAA,KAAA,KAAN,IAAa,GAAA,MAAA,GAAA,EAAA,CAAA,IAAA,EAAA;AACtC,EAAA,IAAI,CAAC,OAAS,EAAA;AACZ,IAAM,MAAA,IAAI,MAAM,4DAAuD,CAAA;AAAA;AAEzE,EAAA,IAAI,CAAC,SAAW,EAAA;AACd,IAAM,MAAA,IAAI,MAAM,sEAAiE,CAAA;AAAA;AAEnF,EAAA,IAAI,CAAC,gBAAkB,EAAA;AACrB,IAAM,MAAA,IAAI,MAAM,2DAAsD,CAAA;AAAA;AAExE,EAAA,uBAAA,CAAwB,SAAS,CAAA;AAGjC,EAAI,IAAA;AACF,IAAA,MAAM,QAAW,GAAA,MAAM,QAIpB,CAAA,UAAA,EAAY,SAAS,wBAA0B,EAAA;AAAA,MAChD,KAAO,EAAA;AAAA,QACL,SAAA;AAAA,QACA,gBAAA;AAAA,QACA,OAAA;AAAA,QACA,kBAAA,EAAoB,CAAI,GAAA,EAAA,GAAK,EAAK,GAAA,EAAA;AAAA,QAClC,SAAW,EAAA;AAAA;AACb,KACD,CAAA;AACD,IAAA,MAAMA,UAAQ,EAAS,GAAA,CAAA,EAAA,GAAA,CAAA,EAAA,GAAA,QAAA,CAAA,IAAA,KAAT,mBAAe,qBAAf,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAsC,UAAtC,IAA6C,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,IAAA,EAAA;AAC3D,IAAA,IAAIA,MAAS,IAAA,EAAA,CAAC,EAAS,GAAA,QAAA,CAAA,MAAA,KAAT,mBAAiB,MAAQ,CAAA,EAAA;AACrC,MAAA,IAAI,OAAS,EAAA;AAEX,QAAQ,OAAA,CAAA,GAAA,CAAI,4CAA8CA,EAAAA,MAAAA,CAAM,MAAM,CAAA;AAAA;AAExE,MAAO,OAAA;AAAA,QACL,KAAAA,EAAAA,MAAAA;AAAA,QACA,OAAS,EAAA;AAAA,OACX;AAAA;AAEF,IAAI,IAAA,CAAA,EAAA,GAAA,QAAA,CAAS,MAAT,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAiB,MAAQ,EAAA;AAC3B,MAAM,MAAA,IAAI,QAAM,EAAS,GAAA,QAAA,CAAA,MAAA,CAAO,CAAC,CAAjB,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAoB,YAAW,8BAA8B,CAAA;AAAA;AAC/E,WACO,GAAK,EAAA;AACZ,IAAA,IAAI,OAAS,EAAA;AAEX,MAAQ,OAAA,CAAA,IAAA,CAAK,sEAAsE,GAAG,CAAA;AAAA;AAGxF,IAAA,MAAM,MAAM,GAAe,YAAA,KAAA,GAAQ,GAAI,CAAA,OAAA,GAAU,OAAO,GAAG,CAAA;AAC3D,IAAI,IAAA,oCAAA,CAAqC,IAAK,CAAA,GAAG,CAAG,EAAA;AAClD,MAAA,MAAM,IAAI,KAAA,CAAM,CAAY,SAAA,EAAA,SAAS,CAAoF,kFAAA,CAAA,CAAA;AAAA;AAG3H,IAAA,IAAI,CAAC,yDAAA,CAA0D,IAAK,CAAA,GAAG,CAAG,EAAA;AAExE,MAAI,IAAA,qDAAA,CAAsD,IAAK,CAAA,GAAG,CAAG,EAAA;AACnE,QAAA,MAAM,GAAe,YAAA,KAAA,GAAQ,GAAM,GAAA,IAAI,MAAM,GAAG,CAAA;AAAA;AAClD;AACF;AAEF,EAAA,MAAM,SAAY,GAAA,MAAM,QAIrB,CAAA,UAAA,EAAY,SAAS,qBAAqB,CAAA;AAC7C,EAAI,IAAA,CAAA,EAAA,GAAA,SAAA,CAAU,MAAV,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAkB,MAAQ,EAAA;AAC5B,IAAM,MAAA,IAAI,QAAM,EAAU,GAAA,SAAA,CAAA,MAAA,CAAO,CAAC,CAAlB,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAqB,YAAW,2BAA2B,CAAA;AAAA;AAE7E,EAAA,IAAI,WAAU,EAAU,GAAA,CAAA,EAAA,GAAA,CAAA,EAAA,GAAA,SAAA,CAAA,IAAA,KAAV,mBAAgB,kBAAhB,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAoC,OAApC,IAA0C,GAAA,EAAA,GAAA,IAAA;AACxD,EAAA,IAAI,CAAC,OAAS,EAAA;AACZ,IAAA,MAAM,YAAe,GAAA,MAAM,QAIxB,CAAA,UAAA,EAAY,SAAS,uBAAyB,EAAA;AAAA,MAC/C,KAAO,EAAA;AAAA,QACL,IAAM,EAAA,cAAA;AAAA,QACN,eAAiB,EAAA,OAAA;AAAA,QACjB,aAAe,EAAA,IAAA;AAAA,QACf,gBAAA;AAAA,QACA,OAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAW,EAAA;AAAA;AACb,KACD,CAAA;AACD,IAAA,MAAM,cAAY,EAAa,GAAA,CAAA,EAAA,GAAA,YAAA,CAAA,MAAA,KAAb,IAAsB,GAAA,MAAA,GAAA,EAAA,CAAA,CAAA,CAAA,KAAtB,mBAA0B,OAAW,KAAA,EAAA;AACvD,IAAA,IAAI,SAAa,IAAA,CAAC,8BAA+B,CAAA,IAAA,CAAK,SAAS,CAAG,EAAA;AAChE,MAAI,IAAA,kBAAA,CAAmB,IAAK,CAAA,SAAS,CAAG,EAAA;AACtC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAY,SAAA,EAAA,SAAS,CAAoF,kFAAA,CAAA,CAAA;AAAA;AAE3H,MAAM,MAAA,IAAI,MAAM,SAAS,CAAA;AAAA;AAE3B,IAAA,IAAA,CAAI,EAAa,GAAA,CAAA,EAAA,GAAA,YAAA,CAAA,IAAA,KAAb,IAAmB,GAAA,MAAA,GAAA,EAAA,CAAA,oBAAA,KAAnB,mBAAyC,EAAI,EAAA;AAC/C,MAAU,OAAA,GAAA,YAAA,CAAa,KAAK,oBAAqB,CAAA,EAAA;AAAA,KAC5C,MAAA;AACL,MAAA,MAAM,OAAU,GAAA,MAAM,QAInB,CAAA,UAAA,EAAY,SAAS,qBAAqB,CAAA;AAC7C,MAAA,OAAA,GAAA,CAAU,yBAAQ,IAAR,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAc,kBAAd,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAkC,OAAlC,IAAwC,GAAA,EAAA,GAAA,IAAA;AAAA;AACpD;AAEF,EAAA,IAAI,CAAC,OAAS,EAAA;AACZ,IAAM,MAAA,IAAI,MAAM,6DAAwD,CAAA;AAAA;AAE1E,EAAA,MAAM,MAAS,GAAA,MAAM,QAElB,CAAA,UAAA,EAAY,SAAS,uBAAyB,EAAA;AAAA,IAC/C,EAAI,EAAA;AAAA,GACL,CAAA;AACD,EAAI,IAAA,CAAA,EAAA,GAAA,MAAA,CAAO,MAAP,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAe,MAAQ,EAAA;AACzB,IAAM,MAAA,IAAI,QAAM,EAAO,GAAA,MAAA,CAAA,MAAA,CAAO,CAAC,CAAf,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAkB,YAAW,6BAA6B,CAAA;AAAA;AAE5E,EAAA,MAAM,KAAQ,GAAA,CAAA,EAAA,GAAA,CAAA,EAAA,GAAA,MAAA,CAAO,IAAP,KAAA,IAAA,GAAA,MAAA,GAAA,EAAA,CAAa,yBAAb,IAAmC,GAAA,MAAA,GAAA,EAAA,CAAA,IAAA,EAAA;AACjD,EAAA,IAAI,CAAC,KAAO,EAAA;AACV,IAAM,MAAA,IAAI,MAAM,2CAA2C,CAAA;AAAA;AAE7D,EAAA,IAAI,OAAS,EAAA;AAEX,IAAQ,OAAA,CAAA,GAAA,CAAI,0CAA4C,EAAA,KAAA,CAAM,MAAM,CAAA;AAAA;AAEtE,EAAO,OAAA;AAAA,IACL,KAAA;AAAA,IACA,OAAS,EAAA;AAAA,GACX;AACF;AACgB,SAAA,uBAAA,CAAwB,OAAiB,EAAA,KAAA,EAAe,KAAuB,EAAA;AAC7F,EAAI,IAAA;AACF,IAAM,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,OAAO,CAAA;AAC3B,IAAI,GAAA,CAAA,YAAA,CAAa,GAAI,CAAA,OAAA,EAAS,KAAK,CAAA;AACnC,IAAI,GAAA,CAAA,YAAA,CAAa,GAAI,CAAA,MAAA,EAAQ,KAAK,CAAA;AAClC,IAAI,GAAA,CAAA,YAAA,CAAa,GAAI,CAAA,OAAA,EAAS,KAAK,CAAA;AACnC,IAAA,OAAO,IAAI,QAAS,EAAA;AAAA,GACd,CAAA,OAAA,CAAA,EAAA;AACN,IAAA,MAAM,GAAM,GAAA,OAAA,CAAQ,QAAS,CAAA,GAAG,IAAI,GAAM,GAAA,GAAA;AAC1C,IAAA,OAAO,CAAG,EAAA,OAAO,CAAG,EAAA,GAAG,SAAS,kBAAmB,CAAA,KAAK,CAAC,CAAA,MAAA,EAAS,mBAAmB,KAAK,CAAC,CAAU,OAAA,EAAA,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA;AAElI;AACA,SAAS,iBAAiB,KAAuB,EAAA;AA9PjD,EAAA,IAAA,EAAA;AA+PE,EAAA,MAAM,OAAM,EAAM,GAAA,KAAA,CAAA,KAAA,CAAM,GAAG,CAAE,CAAA,CAAC,MAAlB,IAAuB,GAAA,EAAA,GAAA,KAAA;AACnC,EAAO,OAAA,GAAA,CAAI,MAAM,GAAG,CAAA;AACtB;AAGA,SAAS,yBAA0B,CAAA,KAAA,EAAe,OAAiB,EAAA,KAAA,EAAe,gBAAmC,EAAA;AACnH,EAAM,MAAA,SAAA,GAAY,IAAK,CAAA,SAAA,CAAU,KAAK,CAAA;AACtC,EAAM,MAAA,WAAA,GAAc,IAAK,CAAA,SAAA,CAAU,OAAO,CAAA;AAC1C,EAAM,MAAA,SAAA,GAAY,IAAK,CAAA,SAAA,CAAU,KAAK,CAAA;AACtC,EAAA,MAAM,EAAK,GAAA,IAAA,CAAK,SAAU,CAAA,gBAAA,CAAiB,KAAK,CAAC,CAAA;AACjD,EAAA,MAAM,WAAW,gBAAmB,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAoBlC,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQF,EAAO,OAAA;AAAA;AAAA;AAAA,YAAA,EAGK,SAAS,CAAA;AAAA,kBAAA,EACH,WAAW,CAAA;AAAA,gBAAA,EACb,SAAS,CAAA;AAAA,aAAA,EACZ,EAAE,CAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAA,EA8CX,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAMd;AACgB,SAAA,yBAAA,CAA0B,KAAe,EAAA,OAAA,EAAiB,KAAuB,EAAA;AAC/F,EAAA,OAAO,yBAA0B,CAAA,KAAA,EAAO,OAAS,EAAA,KAAA,EAAO,KAAK,CAAA;AAC/D;AACgB,SAAA,8BAAA,CAA+B,KAAe,EAAA,OAAA,EAAiB,KAAuB,EAAA;AACpG,EAAA,OAAO,yBAA0B,CAAA,KAAA,EAAO,OAAS,EAAA,KAAA,EAAO,IAAI,CAAA;AAC9D"}

package/lib/hooks/useMarketplaceTemplateCards.js

@@ -1,4 +1,4 @@
-import {useSettings}from'@adminide-stack/platform-client';import {ConfigurationTarget,ContributionSchemaId}from'common';import {useMemo}from'react';import {extractGroupTemplateCards}from'../features/templates/buildTemplateCards.js';import {settingsUriForOrg}from'../utils/cdecodeUri.js';function useMarketplaceTemplateCards({
+import {useSettings}from'@adminide-stack/platform-client';import {ConfigurationTarget,ContributionSchemaId}from'common';import {useMemo}from'react';import {extractGroupTemplateCards,resolveGroupTemplatesPayload}from'../features/templates/buildTemplateCards.js';import {settingsUriForOrg}from'../utils/cdecodeUri.js';function useMarketplaceTemplateCards({
   group = "",
   orgName,
   enabled = true
@@ -23,7 +23,10 @@ import {useSettings}from'@adminide-stack/platform-client';import {ConfigurationT
     }
   });
   const payload = data != null ? data : settings;
-  const cards = useMemo(() => canFetch ? extractGroupTemplateCards(payload) : [], [canFetch, payload]);
+  const cards = useMemo(() => {
+    if (!canFetch) return [];
+    return extractGroupTemplateCards(resolveGroupTemplatesPayload(payload, selectedGroup));
+  }, [canFetch, payload, selectedGroup]);
   return {
     cards,
     loading: canFetch ? loading : false,

package/lib/hooks/useMarketplaceTemplateCards.js.map

@@ -1 +1 @@
-{"version":3,"file":"useMarketplaceTemplateCards.js","sources":["../../src/hooks/useMarketplaceTemplateCards.ts"],"sourcesContent":["import { useSettings } from '@adminide-stack/platform-client';\nimport { ConfigurationTarget, ContributionSchemaId } from 'common';\nimport { useMemo } from 'react';\nimport { extractGroupTemplateCards, type BuildTemplateCard } from '../features/templates/buildTemplateCards';\nimport { settingsUriForOrg, type SettingsUriInput } from '../utils/cdecodeUri';\n\nexport type UseMarketplaceTemplateCardsOptions = {\n    /** Selected marketplace group key (e.g. `codeAssistant`). */\n    group?: string | null;\n    orgName?: string | null;\n    enabled?: boolean;\n};\n\nexport type UseMarketplaceTemplateCardsReturn = {\n    cards: BuildTemplateCard[];\n    loading: boolean;\n    error: unknown;\n};\n\n/**\n * Cards under `marketplace.templates.<group>` for Build mode — browser\n * `useDefaultFormTemplateCards` parity (includes `snapshotId` for webbuilder remix).\n */\nexport function useMarketplaceTemplateCards({\n    group = '',\n    orgName,\n    enabled = true,\n}: UseMarketplaceTemplateCardsOptions): UseMarketplaceTemplateCardsReturn {\n    const selectedGroup = (group ?? '').trim();\n    const slug = (orgName ?? '').trim();\n    const canFetch = enabled && Boolean(selectedGroup) && Boolean(slug);\n\n    const resourceUri: SettingsUriInput | undefined = useMemo(\n        () => (canFetch ? settingsUriForOrg(slug) : undefined),\n        [canFetch, slug],\n    );\n\n    const { data, settings, loading, error } = useSettings({\n        resourceUri: resourceUri as never,\n        skip: !canFetch || !resourceUri,\n        options: {\n            schemaId: ContributionSchemaId.UiLayout,\n            configKey: `marketplace.templates.${selectedGroup}`,\n            includeMarketplace: true,\n            target: ConfigurationTarget.ORGANIZATION,\n        },\n    });\n\n    // See useMarketplaceTemplateGroups — prefer scoped `data`, fall back to raw settings subtree.\n    const payload = data ?? settings;\n\n    const cards = useMemo(() => (canFetch ? extractGroupTemplateCards(payload) : []), [canFetch, payload]);\n\n    return {\n        cards,\n        loading: canFetch ? loading : false,\n        error: canFetch ? error : undefined,\n    };\n}\n"],"names":[],"mappings":"+RAqBO,SAAS,2BAA4B,CAAA;AAAA,EAC1C,KAAQ,GAAA,EAAA;AAAA,EACR,OAAA;AAAA,EACA,OAAU,GAAA;AACZ,CAA0E,EAAA;AACxE,EAAM,MAAA,aAAA,GAAA,CAAiB,KAAS,IAAA,IAAA,GAAA,KAAA,GAAA,EAAA,EAAI,IAAK,EAAA;AACzC,EAAM,MAAA,IAAA,GAAA,CAAQ,OAAW,IAAA,IAAA,GAAA,OAAA,GAAA,EAAA,EAAI,IAAK,EAAA;AAClC,EAAA,MAAM,WAAW,OAAW,IAAA,OAAA,CAAQ,aAAa,CAAA,IAAK,QAAQ,IAAI,CAAA;AAClE,EAAM,MAAA,WAAA,GAA4C,OAAQ,CAAA,MAAM,QAAW,GAAA,iBAAA,CAAkB,IAAI,CAAA,GAAI,MAAW,EAAA,CAAC,QAAU,EAAA,IAAI,CAAC,CAAA;AAChI,EAAM,MAAA;AAAA,IACJ,IAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,MACE,WAAY,CAAA;AAAA,IACd,WAAA;AAAA,IACA,IAAA,EAAM,CAAC,QAAA,IAAY,CAAC,WAAA;AAAA,IACpB,OAAS,EAAA;AAAA,MACP,UAAU,oBAAqB,CAAA,QAAA;AAAA,MAC/B,SAAA,EAAW,yBAAyB,aAAa,CAAA,CAAA;AAAA,MACjD,kBAAoB,EAAA,IAAA;AAAA,MACpB,QAAQ,mBAAoB,CAAA;AAAA;AAC9B,GACD,CAAA;AAGD,EAAA,MAAM,UAAU,IAAQ,IAAA,IAAA,GAAA,IAAA,GAAA,QAAA;AACxB,EAAA,MAAM,KAAQ,GAAA,OAAA,CAAQ,MAAM,QAAA,GAAW,yBAA0B,CAAA,OAAO,CAAI,GAAA,EAAI,EAAA,CAAC,QAAU,EAAA,OAAO,CAAC,CAAA;AACnG,EAAO,OAAA;AAAA,IACL,KAAA;AAAA,IACA,OAAA,EAAS,WAAW,OAAU,GAAA,KAAA;AAAA,IAC9B,KAAA,EAAO,WAAW,KAAQ,GAAA;AAAA,GAC5B;AACF"}
+{"version":3,"file":"useMarketplaceTemplateCards.js","sources":["../../src/hooks/useMarketplaceTemplateCards.ts"],"sourcesContent":["import { useSettings } from '@adminide-stack/platform-client';\nimport { ConfigurationTarget, ContributionSchemaId } from 'common';\nimport { useMemo } from 'react';\nimport {\n    extractGroupTemplateCards,\n    resolveGroupTemplatesPayload,\n    type BuildTemplateCard,\n} from '../features/templates/buildTemplateCards';\nimport { settingsUriForOrg, type SettingsUriInput } from '../utils/cdecodeUri';\n\nexport type UseMarketplaceTemplateCardsOptions = {\n    /** Selected marketplace group key (e.g. `codeAssistant`). */\n    group?: string | null;\n    orgName?: string | null;\n    enabled?: boolean;\n};\n\nexport type UseMarketplaceTemplateCardsReturn = {\n    cards: BuildTemplateCard[];\n    loading: boolean;\n    error: unknown;\n};\n\n/**\n * Cards under `marketplace.templates.<group>` for Build mode — browser\n * `useDefaultFormTemplateCards` parity (includes `snapshotId` for webbuilder remix).\n */\nexport function useMarketplaceTemplateCards({\n    group = '',\n    orgName,\n    enabled = true,\n}: UseMarketplaceTemplateCardsOptions): UseMarketplaceTemplateCardsReturn {\n    const selectedGroup = (group ?? '').trim();\n    const slug = (orgName ?? '').trim();\n    const canFetch = enabled && Boolean(selectedGroup) && Boolean(slug);\n\n    const resourceUri: SettingsUriInput | undefined = useMemo(\n        () => (canFetch ? settingsUriForOrg(slug) : undefined),\n        [canFetch, slug],\n    );\n\n    const { data, settings, loading, error } = useSettings({\n        resourceUri: resourceUri as never,\n        skip: !canFetch || !resourceUri,\n        options: {\n            schemaId: ContributionSchemaId.UiLayout,\n            configKey: `marketplace.templates.${selectedGroup}`,\n            includeMarketplace: true,\n            target: ConfigurationTarget.ORGANIZATION,\n        },\n    });\n\n    // See useMarketplaceTemplateGroups — prefer scoped `data`, fall back to raw settings subtree.\n    const payload = data ?? settings;\n\n    const cards = useMemo(() => {\n        if (!canFetch) return [];\n        return extractGroupTemplateCards(resolveGroupTemplatesPayload(payload, selectedGroup));\n    }, [canFetch, payload, selectedGroup]);\n\n    return {\n        cards,\n        loading: canFetch ? loading : false,\n        error: canFetch ? error : undefined,\n    };\n}\n"],"names":[],"mappings":"4TAqBO,SAAS,2BAA4B,CAAA;AAAA,EAC1C,KAAQ,GAAA,EAAA;AAAA,EACR,OAAA;AAAA,EACA,OAAU,GAAA;AACZ,CAA0E,EAAA;AACxE,EAAM,MAAA,aAAA,GAAA,CAAiB,KAAS,IAAA,IAAA,GAAA,KAAA,GAAA,EAAA,EAAI,IAAK,EAAA;AACzC,EAAM,MAAA,IAAA,GAAA,CAAQ,OAAW,IAAA,IAAA,GAAA,OAAA,GAAA,EAAA,EAAI,IAAK,EAAA;AAClC,EAAA,MAAM,WAAW,OAAW,IAAA,OAAA,CAAQ,aAAa,CAAA,IAAK,QAAQ,IAAI,CAAA;AAClE,EAAM,MAAA,WAAA,GAA4C,OAAQ,CAAA,MAAM,QAAW,GAAA,iBAAA,CAAkB,IAAI,CAAA,GAAI,MAAW,EAAA,CAAC,QAAU,EAAA,IAAI,CAAC,CAAA;AAChI,EAAM,MAAA;AAAA,IACJ,IAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,MACE,WAAY,CAAA;AAAA,IACd,WAAA;AAAA,IACA,IAAA,EAAM,CAAC,QAAA,IAAY,CAAC,WAAA;AAAA,IACpB,OAAS,EAAA;AAAA,MACP,UAAU,oBAAqB,CAAA,QAAA;AAAA,MAC/B,SAAA,EAAW,yBAAyB,aAAa,CAAA,CAAA;AAAA,MACjD,kBAAoB,EAAA,IAAA;AAAA,MACpB,QAAQ,mBAAoB,CAAA;AAAA;AAC9B,GACD,CAAA;AAGD,EAAA,MAAM,UAAU,IAAQ,IAAA,IAAA,GAAA,IAAA,GAAA,QAAA;AACxB,EAAM,MAAA,KAAA,GAAQ,QAAQ,MAAM;AAC1B,IAAI,IAAA,CAAC,QAAU,EAAA,OAAO,EAAC;AACvB,IAAA,OAAO,yBAA0B,CAAA,4BAAA,CAA6B,OAAS,EAAA,aAAa,CAAC,CAAA;AAAA,GACpF,EAAA,CAAC,QAAU,EAAA,OAAA,EAAS,aAAa,CAAC,CAAA;AACrC,EAAO,OAAA;AAAA,IACL,KAAA;AAAA,IACA,OAAA,EAAS,WAAW,OAAU,GAAA,KAAA;AAAA,IAC9B,KAAA,EAAO,WAAW,KAAQ,GAAA;AAAA,GAC5B;AACF"}

package/lib/hooks/useMarketplaceTemplateGroups.js

@@ -1,4 +1,4 @@
-import {useSettings}from'@adminide-stack/platform-client';import {ConfigurationTarget,ContributionSchemaId}from'common';import {useMemo}from'react';import {extractMarketplaceTemplateGroups}from'../features/templates/buildTemplateCards.js';import {settingsUriForOrg}from'../utils/cdecodeUri.js';function useMarketplaceTemplateGroups({
+import {useSettings}from'@adminide-stack/platform-client';import {ConfigurationTarget,ContributionSchemaId}from'common';import {useMemo,useRef}from'react';import {extractMarketplaceTemplateGroups}from'../features/templates/buildTemplateCards.js';import {settingsUriForOrg}from'../utils/cdecodeUri.js';function useMarketplaceTemplateGroups({
   orgName,
   enabled = true
 }) {
@@ -23,7 +23,14 @@ import {useSettings}from'@adminide-stack/platform-client';import {ConfigurationT
     }
   });
   const payload = data != null ? data : settings;
-  const groups = useMemo(() => canFetch ? extractMarketplaceTemplateGroups(payload) : [], [canFetch, payload]);
+  const groupsRef = useRef([]);
+  const groups = useMemo(() => {
+    if (!canFetch) return [];
+    const next = extractMarketplaceTemplateGroups(payload);
+    if (next.length === 0) return groupsRef.current;
+    groupsRef.current = next;
+    return next;
+  }, [canFetch, payload]);
   return {
     groups,
     loading: canFetch ? loading : false,

package/lib/hooks/useMarketplaceTemplateGroups.js.map

@@ -1 +1 @@
-{"version":3,"file":"useMarketplaceTemplateGroups.js","sources":["../../src/hooks/useMarketplaceTemplateGroups.ts"],"sourcesContent":["import { useSettings } from '@adminide-stack/platform-client';\nimport { ConfigurationTarget, ContributionSchemaId } from 'common';\nimport { useMemo } from 'react';\nimport {\n    extractMarketplaceTemplateGroups,\n    type MarketplaceTemplateGroup,\n} from '../features/templates/buildTemplateCards';\nimport { settingsUriForOrg, type SettingsUriInput } from '../utils/cdecodeUri';\n\nexport type UseMarketplaceTemplateGroupsOptions = {\n    orgName?: string | null;\n    enabled?: boolean;\n};\n\nexport type UseMarketplaceTemplateGroupsReturn = {\n    groups: MarketplaceTemplateGroup[];\n    loading: boolean;\n    error: unknown;\n};\n\n/**\n * Lists marketplace template groups (`codeAssistant`, `mediaAssistant`, …)\n * for the Build-mode template picker — browser `useTemplates` parity.\n */\nexport function useMarketplaceTemplateGroups({\n    orgName,\n    enabled = true,\n}: UseMarketplaceTemplateGroupsOptions): UseMarketplaceTemplateGroupsReturn {\n    const slug = (orgName ?? '').trim();\n    const canFetch = enabled && Boolean(slug);\n    const resourceUri: SettingsUriInput | undefined = useMemo(\n        () => (canFetch ? settingsUriForOrg(slug) : undefined),\n        [canFetch, slug],\n    );\n\n    const { data, settings, loading, error } = useSettings({\n        resourceUri: resourceUri as never,\n        skip: !canFetch || !resourceUri,\n        options: {\n            schemaId: ContributionSchemaId.UiLayout,\n            configKey: 'marketplace.templates',\n            includeMarketplace: true,\n            // Group keys only — values collapse to `{}` (browser modal lists by key).\n            depth: 1,\n            target: ConfigurationTarget.ORGANIZATION,\n        },\n    });\n\n    // `useSettings` does lodash get(settings, configKey). When pageSettings already returns the\n    // configKey subtree as `settings` (depth comment: `{ codeAssistant: {} }`), that get is\n    // undefined — fall back to the raw settings payload.\n    const payload = data ?? settings;\n\n    const groups = useMemo(() => (canFetch ? extractMarketplaceTemplateGroups(payload) : []), [canFetch, payload]);\n\n    return {\n        groups,\n        loading: canFetch ? loading : false,\n        error: canFetch ? error : undefined,\n    };\n}\n"],"names":[],"mappings":"sSAmBO,SAAS,4BAA6B,CAAA;AAAA,EAC3C,OAAA;AAAA,EACA,OAAU,GAAA;AACZ,CAA4E,EAAA;AAC1E,EAAM,MAAA,IAAA,GAAA,CAAQ,OAAW,IAAA,IAAA,GAAA,OAAA,GAAA,EAAA,EAAI,IAAK,EAAA;AAClC,EAAM,MAAA,QAAA,GAAW,OAAW,IAAA,OAAA,CAAQ,IAAI,CAAA;AACxC,EAAM,MAAA,WAAA,GAA4C,OAAQ,CAAA,MAAM,QAAW,GAAA,iBAAA,CAAkB,IAAI,CAAA,GAAI,MAAW,EAAA,CAAC,QAAU,EAAA,IAAI,CAAC,CAAA;AAChI,EAAM,MAAA;AAAA,IACJ,IAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,MACE,WAAY,CAAA;AAAA,IACd,WAAA;AAAA,IACA,IAAA,EAAM,CAAC,QAAA,IAAY,CAAC,WAAA;AAAA,IACpB,OAAS,EAAA;AAAA,MACP,UAAU,oBAAqB,CAAA,QAAA;AAAA,MAC/B,SAAW,EAAA,uBAAA;AAAA,MACX,kBAAoB,EAAA,IAAA;AAAA;AAAA,MAEpB,KAAO,EAAA,CAAA;AAAA,MACP,QAAQ,mBAAoB,CAAA;AAAA;AAC9B,GACD,CAAA;AAKD,EAAA,MAAM,UAAU,IAAQ,IAAA,IAAA,GAAA,IAAA,GAAA,QAAA;AACxB,EAAA,MAAM,MAAS,GAAA,OAAA,CAAQ,MAAM,QAAA,GAAW,gCAAiC,CAAA,OAAO,CAAI,GAAA,EAAI,EAAA,CAAC,QAAU,EAAA,OAAO,CAAC,CAAA;AAC3G,EAAO,OAAA;AAAA,IACL,MAAA;AAAA,IACA,OAAA,EAAS,WAAW,OAAU,GAAA,KAAA;AAAA,IAC9B,KAAA,EAAO,WAAW,KAAQ,GAAA;AAAA,GAC5B;AACF"}
+{"version":3,"file":"useMarketplaceTemplateGroups.js","sources":["../../src/hooks/useMarketplaceTemplateGroups.ts"],"sourcesContent":["import { useSettings } from '@adminide-stack/platform-client';\nimport { ConfigurationTarget, ContributionSchemaId } from 'common';\nimport { useMemo, useRef } from 'react';\nimport {\n    extractMarketplaceTemplateGroups,\n    type MarketplaceTemplateGroup,\n} from '../features/templates/buildTemplateCards';\nimport { settingsUriForOrg, type SettingsUriInput } from '../utils/cdecodeUri';\n\nexport type UseMarketplaceTemplateGroupsOptions = {\n    orgName?: string | null;\n    enabled?: boolean;\n};\n\nexport type UseMarketplaceTemplateGroupsReturn = {\n    groups: MarketplaceTemplateGroup[];\n    loading: boolean;\n    error: unknown;\n};\n\n/**\n * Lists marketplace template groups (`codeAssistant`, `mediaAssistant`, …)\n * for the Build-mode template picker — browser `useTemplates` parity.\n */\nexport function useMarketplaceTemplateGroups({\n    orgName,\n    enabled = true,\n}: UseMarketplaceTemplateGroupsOptions): UseMarketplaceTemplateGroupsReturn {\n    const slug = (orgName ?? '').trim();\n    const canFetch = enabled && Boolean(slug);\n    const resourceUri: SettingsUriInput | undefined = useMemo(\n        () => (canFetch ? settingsUriForOrg(slug) : undefined),\n        [canFetch, slug],\n    );\n\n    const { data, settings, loading, error } = useSettings({\n        resourceUri: resourceUri as never,\n        skip: !canFetch || !resourceUri,\n        options: {\n            schemaId: ContributionSchemaId.UiLayout,\n            configKey: 'marketplace.templates',\n            includeMarketplace: true,\n            // Group keys only — values collapse to `{}` (browser modal lists by key).\n            depth: 1,\n            target: ConfigurationTarget.ORGANIZATION,\n        },\n    });\n\n    // `useSettings` does lodash get(settings, configKey). When pageSettings already returns the\n    // configKey subtree as `settings` (depth comment: `{ codeAssistant: {} }`), that get is\n    // undefined — fall back to the raw settings payload.\n    const payload = data ?? settings;\n\n    const groupsRef = useRef<MarketplaceTemplateGroup[]>([]);\n    const groups = useMemo(() => {\n        if (!canFetch) return [];\n        const next = extractMarketplaceTemplateGroups(payload);\n        // Shared cache can swap the group map for a group's contents after deselect/reopen.\n        // Keep the last valid group list so the picker does not flip to nested templates.\n        if (next.length === 0) return groupsRef.current;\n        groupsRef.current = next;\n        return next;\n    }, [canFetch, payload]);\n\n    return {\n        groups,\n        loading: canFetch ? loading : false,\n        error: canFetch ? error : undefined,\n    };\n}\n"],"names":[],"mappings":"6SAmBO,SAAS,4BAA6B,CAAA;AAAA,EAC3C,OAAA;AAAA,EACA,OAAU,GAAA;AACZ,CAA4E,EAAA;AAC1E,EAAM,MAAA,IAAA,GAAA,CAAQ,OAAW,IAAA,IAAA,GAAA,OAAA,GAAA,EAAA,EAAI,IAAK,EAAA;AAClC,EAAM,MAAA,QAAA,GAAW,OAAW,IAAA,OAAA,CAAQ,IAAI,CAAA;AACxC,EAAM,MAAA,WAAA,GAA4C,OAAQ,CAAA,MAAM,QAAW,GAAA,iBAAA,CAAkB,IAAI,CAAA,GAAI,MAAW,EAAA,CAAC,QAAU,EAAA,IAAI,CAAC,CAAA;AAChI,EAAM,MAAA;AAAA,IACJ,IAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,MACE,WAAY,CAAA;AAAA,IACd,WAAA;AAAA,IACA,IAAA,EAAM,CAAC,QAAA,IAAY,CAAC,WAAA;AAAA,IACpB,OAAS,EAAA;AAAA,MACP,UAAU,oBAAqB,CAAA,QAAA;AAAA,MAC/B,SAAW,EAAA,uBAAA;AAAA,MACX,kBAAoB,EAAA,IAAA;AAAA;AAAA,MAEpB,KAAO,EAAA,CAAA;AAAA,MACP,QAAQ,mBAAoB,CAAA;AAAA;AAC9B,GACD,CAAA;AAKD,EAAA,MAAM,UAAU,IAAQ,IAAA,IAAA,GAAA,IAAA,GAAA,QAAA;AACxB,EAAM,MAAA,SAAA,GAAY,MAAmC,CAAA,EAAE,CAAA;AACvD,EAAM,MAAA,MAAA,GAAS,QAAQ,MAAM;AAC3B,IAAI,IAAA,CAAC,QAAU,EAAA,OAAO,EAAC;AACvB,IAAM,MAAA,IAAA,GAAO,iCAAiC,OAAO,CAAA;AAGrD,IAAA,IAAI,IAAK,CAAA,MAAA,KAAW,CAAG,EAAA,OAAO,SAAU,CAAA,OAAA;AACxC,IAAA,SAAA,CAAU,OAAU,GAAA,IAAA;AACpB,IAAO,OAAA,IAAA;AAAA,GACN,EAAA,CAAC,QAAU,EAAA,OAAO,CAAC,CAAA;AACtB,EAAO,OAAA;AAAA,IACL,MAAA;AAAA,IACA,OAAA,EAAS,WAAW,OAAU,GAAA,KAAA;AAAA,IAC9B,KAAA,EAAO,WAAW,KAAQ,GAAA;AAAA,GAC5B;AACF"}

package/lib/hooks/useObtainSystemToken.js

@@ -20,39 +20,47 @@ function useObtainSystemToken(enabled = true) {
     fetchPolicy: "network-only"
   });
   const obtainSystemToken = useCallback(async () => {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m;
     try {
       let tokenId = (_b = (_a = systemTokenData == null ? void 0 : systemTokenData.getUserSystemToken) == null ? void 0 : _a.id) != null ? _b : null;
       if (!tokenId) {
-        if (!orgName || !projectId) {
-          const refetchResult = await refetchSystemToken().catch(() => null);
-          tokenId = (_e = (_d = (_c = refetchResult == null ? void 0 : refetchResult.data) == null ? void 0 : _c.getUserSystemToken) == null ? void 0 : _d.id) != null ? _e : null;
-          if (!tokenId) return null;
-        } else {
-          try {
-            const {
-              data: createData
-            } = await createTokenMutation({
-              variables: {
-                input: {
-                  name: "System Token",
-                  expiryInSeconds: 31536e3,
-                  isSystemToken: true,
-                  environmentTagId: tagId,
-                  orgName: orgName || "default",
-                  projectId: projectId || "default",
-                  algorithm: SYSTEM_TOKEN_ALGORITHM
-                }
+        const refetchResult = await refetchSystemToken().catch(() => null);
+        tokenId = (_e = (_d = (_c = refetchResult == null ? void 0 : refetchResult.data) == null ? void 0 : _c.getUserSystemToken) == null ? void 0 : _d.id) != null ? _e : null;
+      }
+      if (!tokenId) {
+        if (!orgName || !projectId || !tagId) {
+          return null;
+        }
+        if (!__DEV__ && projectId === "9a8ac704-1040-4836-9b72-48b771ca91b1") {
+          console.warn("[useObtainSystemToken] refusing staging mint with testing project UUID");
+          return null;
+        }
+        try {
+          const {
+            data: createData
+          } = await createTokenMutation({
+            variables: {
+              input: {
+                name: "System Token",
+                expiryInSeconds: 31536e3,
+                isSystemToken: true,
+                environmentTagId: tagId,
+                orgName,
+                projectId,
+                algorithm: SYSTEM_TOKEN_ALGORITHM
               }
-            });
-            tokenId = (_g = (_f = createData == null ? void 0 : createData.createSecretApiToken) == null ? void 0 : _f.id) != null ? _g : null;
-            await refetchSystemToken();
-          } catch (createErr) {
-            if (!isAlreadyHasSystemTokenError(createErr)) throw createErr;
-            const refetchResult = await refetchSystemToken().catch(() => null);
-            tokenId = (_j = (_i = (_h = refetchResult == null ? void 0 : refetchResult.data) == null ? void 0 : _h.getUserSystemToken) == null ? void 0 : _i.id) != null ? _j : null;
-            if (!tokenId) return null;
+            }
+          });
+          tokenId = (_g = (_f = createData == null ? void 0 : createData.createSecretApiToken) == null ? void 0 : _f.id) != null ? _g : null;
+          if (!tokenId) {
+            const afterCreate = await refetchSystemToken().catch(() => null);
+            tokenId = (_j = (_i = (_h = afterCreate == null ? void 0 : afterCreate.data) == null ? void 0 : _h.getUserSystemToken) == null ? void 0 : _i.id) != null ? _j : null;
           }
+        } catch (createErr) {
+          if (!isAlreadyHasSystemTokenError(createErr)) throw createErr;
+          const refetchResult = await refetchSystemToken().catch(() => null);
+          tokenId = (_m = (_l = (_k = refetchResult == null ? void 0 : refetchResult.data) == null ? void 0 : _k.getUserSystemToken) == null ? void 0 : _l.id) != null ? _m : null;
+          if (!tokenId) return null;
         }
       }
       if (!tokenId) return null;

package/lib/hooks/useObtainSystemToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"useObtainSystemToken.js","sources":["../../src/hooks/useObtainSystemToken.ts"],"sourcesContent":["/**\n * Mint / reveal the org-scoped system JWT (GetUserSystemToken → RevealSecretApiToken).\n * Same token the webbuilder surface expects as `cdecli_token` / `?token=`.\n */\n\nimport { useCallback } from 'react';\nimport {\n    useGetUserSystemTokenQuery,\n    useCreateSecretApiTokenMutation,\n    useRevealSecretApiTokenMutation,\n} from 'common/graphql';\nimport { SecretApiTokenAlgorithm } from 'common';\nimport { usePrerequisiteIds } from './usePrerequisiteIds';\n\n/** Local + staging: HS256 matches backend JWT secret. RS256 needs a private key\n *  many staging clusters do not ship — create then fails and Web Builder never opens. */\nconst SYSTEM_TOKEN_ALGORITHM = SecretApiTokenAlgorithm.Hs256;\n\nfunction isAlreadyHasSystemTokenError(err: unknown): boolean {\n    const message = err instanceof Error ? err.message : String(err ?? '');\n    return /already have a system token/i.test(message);\n}\n\nexport interface UseObtainSystemTokenResult {\n    /** True while the initial GetUserSystemToken query is in flight. */\n    loading: boolean;\n    /** Mint or reveal the current system token. Returns null on failure. */\n    obtainSystemToken: () => Promise<string | null>;\n}\n\nexport function useObtainSystemToken(enabled = true): UseObtainSystemTokenResult {\n    const { orgName, projectId, tagId } = usePrerequisiteIds();\n    const [createTokenMutation] = useCreateSecretApiTokenMutation();\n    const [revealTokenMutation] = useRevealSecretApiTokenMutation();\n    const {\n        data: systemTokenData,\n        loading,\n        refetch: refetchSystemToken,\n    } = useGetUserSystemTokenQuery({\n        skip: !enabled,\n        fetchPolicy: 'network-only',\n    });\n\n    const obtainSystemToken = useCallback(async (): Promise<string | null> => {\n        try {\n            let tokenId: string | null = systemTokenData?.getUserSystemToken?.id ?? null;\n\n            if (!tokenId) {\n                if (!orgName || !projectId) {\n                    const refetchResult = await refetchSystemToken().catch(() => null);\n                    tokenId = refetchResult?.data?.getUserSystemToken?.id ?? null;\n                    if (!tokenId) return null;\n                } else {\n                    try {\n                        const { data: createData } = await createTokenMutation({\n                            variables: {\n                                input: {\n                                    name: 'System Token',\n                                    expiryInSeconds: 31536000,\n                                    isSystemToken: true,\n                                    environmentTagId: tagId,\n                                    orgName: orgName || 'default',\n                                    projectId: projectId || 'default',\n                                    algorithm: SYSTEM_TOKEN_ALGORITHM,\n                                },\n                            },\n                        });\n                        tokenId = createData?.createSecretApiToken?.id ?? null;\n                        await refetchSystemToken();\n                    } catch (createErr) {\n                        if (!isAlreadyHasSystemTokenError(createErr)) throw createErr;\n                        const refetchResult = await refetchSystemToken().catch(() => null);\n                        tokenId = refetchResult?.data?.getUserSystemToken?.id ?? null;\n                        if (!tokenId) return null;\n                    }\n                }\n            }\n\n            if (!tokenId) return null;\n\n            const { data: revealData } = await revealTokenMutation({\n                variables: { id: tokenId },\n            });\n            return (revealData?.revealSecretApiToken as string) || null;\n        } catch (err) {\n            console.error('[useObtainSystemToken] error:', err);\n            return null;\n        }\n    }, [systemTokenData, createTokenMutation, revealTokenMutation, refetchSystemToken, orgName, projectId, tagId]);\n\n    return { loading, obtainSystemToken };\n}\n\n/**\n * Append `?token=&state=` for SurfaceLoginGate.captureLoginCallback(),\n * or replace existing token/state query params.\n */\nexport function appendSurfaceAuthParams(baseUrl: string, token: string, state = 'mobile-webview'): string {\n    try {\n        const url = new URL(baseUrl);\n        url.searchParams.set('token', token);\n        url.searchParams.set('state', state);\n        return url.toString();\n    } catch {\n        const sep = baseUrl.includes('?') ? '&' : '?';\n        return `${baseUrl}${sep}token=${encodeURIComponent(token)}&state=${encodeURIComponent(state)}`;\n    }\n}\n\n/** Injected before page scripts so SurfaceLoginGate finds cdecli_token immediately. */\nexport function buildCdecliTokenInjection(token: string): string {\n    const safe = JSON.stringify(token);\n    return `\n(function () {\n  try {\n    localStorage.setItem('cdecli_token', ${safe});\n    sessionStorage.setItem('cdecli_token', ${safe});\n  } catch (e) {}\n  true;\n})();\ntrue;\n`;\n}\n"],"names":[],"mappings":"8PAYA,MAAM,yBAAyB,uBAAwB,CAAA,KAAA;AACvD,SAAS,6BAA6B,GAAuB,EAAA;AAC3D,EAAA,MAAM,UAAU,GAAe,YAAA,KAAA,GAAQ,IAAI,OAAU,GAAA,MAAA,CAAO,oBAAO,EAAE,CAAA;AACrE,EAAO,OAAA,8BAAA,CAA+B,KAAK,OAAO,CAAA;AACpD;AAOgB,SAAA,oBAAA,CAAqB,UAAU,IAAkC,EAAA;AAC/E,EAAM,MAAA;AAAA,IACJ,OAAA;AAAA,IACA,SAAA;AAAA,IACA;AAAA,MACE,kBAAmB,EAAA;AACvB,EAAM,MAAA,CAAC,mBAAmB,CAAA,GAAI,+BAAgC,EAAA;AAC9D,EAAM,MAAA,CAAC,mBAAmB,CAAA,GAAI,+BAAgC,EAAA;AAC9D,EAAM,MAAA;AAAA,IACJ,IAAM,EAAA,eAAA;AAAA,IACN,OAAA;AAAA,IACA,OAAS,EAAA;AAAA,MACP,0BAA2B,CAAA;AAAA,IAC7B,MAAM,CAAC,OAAA;AAAA,IACP,WAAa,EAAA;AAAA,GACd,CAAA;AACD,EAAM,MAAA,iBAAA,GAAoB,YAAY,YAAoC;AAvC5E,IAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AAwCI,IAAI,IAAA;AACF,MAAA,IAAI,OAAyB,GAAA,CAAA,EAAA,GAAA,CAAA,EAAA,GAAA,eAAA,IAAA,IAAA,GAAA,KAAA,CAAA,GAAA,eAAA,CAAiB,kBAAjB,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAqC,OAArC,IAA2C,GAAA,EAAA,GAAA,IAAA;AACxE,MAAA,IAAI,CAAC,OAAS,EAAA;AACZ,QAAI,IAAA,CAAC,OAAW,IAAA,CAAC,SAAW,EAAA;AAC1B,UAAA,MAAM,gBAAgB,MAAM,kBAAA,EAAqB,CAAA,KAAA,CAAM,MAAM,IAAI,CAAA;AACjE,UAAA,OAAA,GAAA,CAAU,gEAAe,IAAf,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAqB,kBAArB,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAyC,OAAzC,IAA+C,GAAA,EAAA,GAAA,IAAA;AACzD,UAAI,IAAA,CAAC,SAAgB,OAAA,IAAA;AAAA,SAChB,MAAA;AACL,UAAI,IAAA;AACF,YAAM,MAAA;AAAA,cACJ,IAAM,EAAA;AAAA,aACR,GAAI,MAAM,mBAAoB,CAAA;AAAA,cAC5B,SAAW,EAAA;AAAA,gBACT,KAAO,EAAA;AAAA,kBACL,IAAM,EAAA,cAAA;AAAA,kBACN,eAAiB,EAAA,OAAA;AAAA,kBACjB,aAAe,EAAA,IAAA;AAAA,kBACf,gBAAkB,EAAA,KAAA;AAAA,kBAClB,SAAS,OAAW,IAAA,SAAA;AAAA,kBACpB,WAAW,SAAa,IAAA,SAAA;AAAA,kBACxB,SAAW,EAAA;AAAA;AACb;AACF,aACD,CAAA;AACD,YAAA,OAAA,GAAA,CAAU,EAAY,GAAA,CAAA,EAAA,GAAA,UAAA,IAAA,IAAA,GAAA,KAAA,CAAA,GAAA,UAAA,CAAA,oBAAA,KAAZ,IAAkC,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,EAAA,KAAlC,IAAwC,GAAA,EAAA,GAAA,IAAA;AAClD,YAAA,MAAM,kBAAmB,EAAA;AAAA,mBAClB,SAAW,EAAA;AAClB,YAAA,IAAI,CAAC,4BAAA,CAA6B,SAAS,CAAA,EAAS,MAAA,SAAA;AACpD,YAAA,MAAM,gBAAgB,MAAM,kBAAA,EAAqB,CAAA,KAAA,CAAM,MAAM,IAAI,CAAA;AACjE,YAAA,OAAA,GAAA,CAAU,gEAAe,IAAf,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAqB,kBAArB,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAyC,OAAzC,IAA+C,GAAA,EAAA,GAAA,IAAA;AACzD,YAAI,IAAA,CAAC,SAAgB,OAAA,IAAA;AAAA;AACvB;AACF;AAEF,MAAI,IAAA,CAAC,SAAgB,OAAA,IAAA;AACrB,MAAM,MAAA;AAAA,QACJ,IAAM,EAAA;AAAA,OACR,GAAI,MAAM,mBAAoB,CAAA;AAAA,QAC5B,SAAW,EAAA;AAAA,UACT,EAAI,EAAA;AAAA;AACN,OACD,CAAA;AACD,MAAA,OAAA,CAAO,yCAAY,oBAAkC,KAAA,IAAA;AAAA,aAC9C,GAAK,EAAA;AACZ,MAAQ,OAAA,CAAA,KAAA,CAAM,iCAAiC,GAAG,CAAA;AAClD,MAAO,OAAA,IAAA;AAAA;AACT,GACF,EAAG,CAAC,eAAiB,EAAA,mBAAA,EAAqB,qBAAqB,kBAAoB,EAAA,OAAA,EAAS,SAAW,EAAA,KAAK,CAAC,CAAA;AAC7G,EAAO,OAAA;AAAA,IACL,OAAA;AAAA,IACA;AAAA,GACF;AACF"}
+{"version":3,"file":"useObtainSystemToken.js","sources":["../../src/hooks/useObtainSystemToken.ts"],"sourcesContent":["/**\n * Mint / reveal the org-scoped system JWT (GetUserSystemToken → RevealSecretApiToken).\n * Same token the webbuilder surface expects as `cdecli_token` / `?token=`.\n */\n\nimport { useCallback } from 'react';\nimport {\n    useGetUserSystemTokenQuery,\n    useCreateSecretApiTokenMutation,\n    useRevealSecretApiTokenMutation,\n} from 'common/graphql';\nimport { SecretApiTokenAlgorithm } from 'common';\nimport { usePrerequisiteIds } from './usePrerequisiteIds';\n\n/** Local + staging: HS256 matches backend JWT secret. RS256 needs a private key\n *  many staging clusters do not ship — create then fails and Web Builder never opens. */\nconst SYSTEM_TOKEN_ALGORITHM = SecretApiTokenAlgorithm.Hs256;\n\nfunction isAlreadyHasSystemTokenError(err: unknown): boolean {\n    const message = err instanceof Error ? err.message : String(err ?? '');\n    return /already have a system token/i.test(message);\n}\n\nexport interface UseObtainSystemTokenResult {\n    /** True while the initial GetUserSystemToken query is in flight. */\n    loading: boolean;\n    /** Mint or reveal the current system token. Returns null on failure. */\n    obtainSystemToken: () => Promise<string | null>;\n}\n\nexport function useObtainSystemToken(enabled = true): UseObtainSystemTokenResult {\n    const { orgName, projectId, tagId } = usePrerequisiteIds();\n    const [createTokenMutation] = useCreateSecretApiTokenMutation();\n    const [revealTokenMutation] = useRevealSecretApiTokenMutation();\n    const {\n        data: systemTokenData,\n        loading,\n        refetch: refetchSystemToken,\n    } = useGetUserSystemTokenQuery({\n        skip: !enabled,\n        fetchPolicy: 'network-only',\n    });\n\n    const obtainSystemToken = useCallback(async (): Promise<string | null> => {\n        try {\n            let tokenId: string | null = systemTokenData?.getUserSystemToken?.id ?? null;\n\n            if (!tokenId) {\n                // Always re-check network — cached null from skip/loading must not short-circuit create.\n                const refetchResult = await refetchSystemToken().catch(() => null);\n                tokenId = refetchResult?.data?.getUserSystemToken?.id ?? null;\n            }\n\n            if (!tokenId) {\n                if (!orgName || !projectId || !tagId) {\n                    return null;\n                }\n                // Never mint against the local testing UUID on staging/prod.\n                if (!__DEV__ && projectId === '9a8ac704-1040-4836-9b72-48b771ca91b1') {\n                    console.warn('[useObtainSystemToken] refusing staging mint with testing project UUID');\n                    return null;\n                }\n                try {\n                    const { data: createData } = await createTokenMutation({\n                        variables: {\n                            input: {\n                                name: 'System Token',\n                                expiryInSeconds: 31536000,\n                                isSystemToken: true,\n                                environmentTagId: tagId,\n                                orgName,\n                                projectId,\n                                algorithm: SYSTEM_TOKEN_ALGORITHM,\n                            },\n                        },\n                    });\n                    tokenId = createData?.createSecretApiToken?.id ?? null;\n                    if (!tokenId) {\n                        const afterCreate = await refetchSystemToken().catch(() => null);\n                        tokenId = afterCreate?.data?.getUserSystemToken?.id ?? null;\n                    }\n                } catch (createErr) {\n                    if (!isAlreadyHasSystemTokenError(createErr)) throw createErr;\n                    const refetchResult = await refetchSystemToken().catch(() => null);\n                    tokenId = refetchResult?.data?.getUserSystemToken?.id ?? null;\n                    if (!tokenId) return null;\n                }\n            }\n\n            if (!tokenId) return null;\n\n            const { data: revealData } = await revealTokenMutation({\n                variables: { id: tokenId },\n            });\n            return (revealData?.revealSecretApiToken as string) || null;\n        } catch (err) {\n            console.error('[useObtainSystemToken] error:', err);\n            return null;\n        }\n    }, [systemTokenData, createTokenMutation, revealTokenMutation, refetchSystemToken, orgName, projectId, tagId]);\n\n    return { loading, obtainSystemToken };\n}\n\n/**\n * Append `?token=&state=` for SurfaceLoginGate.captureLoginCallback(),\n * or replace existing token/state query params.\n */\nexport function appendSurfaceAuthParams(baseUrl: string, token: string, state = 'mobile-webview'): string {\n    try {\n        const url = new URL(baseUrl);\n        url.searchParams.set('token', token);\n        url.searchParams.set('state', state);\n        return url.toString();\n    } catch {\n        const sep = baseUrl.includes('?') ? '&' : '?';\n        return `${baseUrl}${sep}token=${encodeURIComponent(token)}&state=${encodeURIComponent(state)}`;\n    }\n}\n\n/** Injected before page scripts so SurfaceLoginGate finds cdecli_token immediately. */\nexport function buildCdecliTokenInjection(token: string): string {\n    const safe = JSON.stringify(token);\n    return `\n(function () {\n  try {\n    localStorage.setItem('cdecli_token', ${safe});\n    sessionStorage.setItem('cdecli_token', ${safe});\n  } catch (e) {}\n  true;\n})();\ntrue;\n`;\n}\n"],"names":[],"mappings":"8PAYA,MAAM,yBAAyB,uBAAwB,CAAA,KAAA;AACvD,SAAS,6BAA6B,GAAuB,EAAA;AAC3D,EAAA,MAAM,UAAU,GAAe,YAAA,KAAA,GAAQ,IAAI,OAAU,GAAA,MAAA,CAAO,oBAAO,EAAE,CAAA;AACrE,EAAO,OAAA,8BAAA,CAA+B,KAAK,OAAO,CAAA;AACpD;AAOgB,SAAA,oBAAA,CAAqB,UAAU,IAAkC,EAAA;AAC/E,EAAM,MAAA;AAAA,IACJ,OAAA;AAAA,IACA,SAAA;AAAA,IACA;AAAA,MACE,kBAAmB,EAAA;AACvB,EAAM,MAAA,CAAC,mBAAmB,CAAA,GAAI,+BAAgC,EAAA;AAC9D,EAAM,MAAA,CAAC,mBAAmB,CAAA,GAAI,+BAAgC,EAAA;AAC9D,EAAM,MAAA;AAAA,IACJ,IAAM,EAAA,eAAA;AAAA,IACN,OAAA;AAAA,IACA,OAAS,EAAA;AAAA,MACP,0BAA2B,CAAA;AAAA,IAC7B,MAAM,CAAC,OAAA;AAAA,IACP,WAAa,EAAA;AAAA,GACd,CAAA;AACD,EAAM,MAAA,iBAAA,GAAoB,YAAY,YAAoC;AAvC5E,IAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AAwCI,IAAI,IAAA;AACF,MAAA,IAAI,OAAyB,GAAA,CAAA,EAAA,GAAA,CAAA,EAAA,GAAA,eAAA,IAAA,IAAA,GAAA,KAAA,CAAA,GAAA,eAAA,CAAiB,kBAAjB,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAqC,OAArC,IAA2C,GAAA,EAAA,GAAA,IAAA;AACxE,MAAA,IAAI,CAAC,OAAS,EAAA;AAEZ,QAAA,MAAM,gBAAgB,MAAM,kBAAA,EAAqB,CAAA,KAAA,CAAM,MAAM,IAAI,CAAA;AACjE,QAAA,OAAA,GAAA,CAAU,gEAAe,IAAf,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAqB,kBAArB,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAyC,OAAzC,IAA+C,GAAA,EAAA,GAAA,IAAA;AAAA;AAE3D,MAAA,IAAI,CAAC,OAAS,EAAA;AACZ,QAAA,IAAI,CAAC,OAAA,IAAW,CAAC,SAAA,IAAa,CAAC,KAAO,EAAA;AACpC,UAAO,OAAA,IAAA;AAAA;AAGT,QAAI,IAAA,CAAC,OAAW,IAAA,SAAA,KAAc,sCAAwC,EAAA;AACpE,UAAA,OAAA,CAAQ,KAAK,wEAAwE,CAAA;AACrF,UAAO,OAAA,IAAA;AAAA;AAET,QAAI,IAAA;AACF,UAAM,MAAA;AAAA,YACJ,IAAM,EAAA;AAAA,WACR,GAAI,MAAM,mBAAoB,CAAA;AAAA,YAC5B,SAAW,EAAA;AAAA,cACT,KAAO,EAAA;AAAA,gBACL,IAAM,EAAA,cAAA;AAAA,gBACN,eAAiB,EAAA,OAAA;AAAA,gBACjB,aAAe,EAAA,IAAA;AAAA,gBACf,gBAAkB,EAAA,KAAA;AAAA,gBAClB,OAAA;AAAA,gBACA,SAAA;AAAA,gBACA,SAAW,EAAA;AAAA;AACb;AACF,WACD,CAAA;AACD,UAAA,OAAA,GAAA,CAAU,EAAY,GAAA,CAAA,EAAA,GAAA,UAAA,IAAA,IAAA,GAAA,KAAA,CAAA,GAAA,UAAA,CAAA,oBAAA,KAAZ,IAAkC,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,EAAA,KAAlC,IAAwC,GAAA,EAAA,GAAA,IAAA;AAClD,UAAA,IAAI,CAAC,OAAS,EAAA;AACZ,YAAA,MAAM,cAAc,MAAM,kBAAA,EAAqB,CAAA,KAAA,CAAM,MAAM,IAAI,CAAA;AAC/D,YAAA,OAAA,GAAA,CAAU,4DAAa,IAAb,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAmB,kBAAnB,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAuC,OAAvC,IAA6C,GAAA,EAAA,GAAA,IAAA;AAAA;AACzD,iBACO,SAAW,EAAA;AAClB,UAAA,IAAI,CAAC,4BAAA,CAA6B,SAAS,CAAA,EAAS,MAAA,SAAA;AACpD,UAAA,MAAM,gBAAgB,MAAM,kBAAA,EAAqB,CAAA,KAAA,CAAM,MAAM,IAAI,CAAA;AACjE,UAAA,OAAA,GAAA,CAAU,gEAAe,IAAf,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAqB,kBAArB,KAAA,IAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAyC,OAAzC,IAA+C,GAAA,EAAA,GAAA,IAAA;AACzD,UAAI,IAAA,CAAC,SAAgB,OAAA,IAAA;AAAA;AACvB;AAEF,MAAI,IAAA,CAAC,SAAgB,OAAA,IAAA;AACrB,MAAM,MAAA;AAAA,QACJ,IAAM,EAAA;AAAA,OACR,GAAI,MAAM,mBAAoB,CAAA;AAAA,QAC5B,SAAW,EAAA;AAAA,UACT,EAAI,EAAA;AAAA;AACN,OACD,CAAA;AACD,MAAA,OAAA,CAAO,yCAAY,oBAAkC,KAAA,IAAA;AAAA,aAC9C,GAAK,EAAA;AACZ,MAAQ,OAAA,CAAA,KAAA,CAAM,iCAAiC,GAAG,CAAA;AAClD,MAAO,OAAA,IAAA;AAAA;AACT,GACF,EAAG,CAAC,eAAiB,EAAA,mBAAA,EAAqB,qBAAqB,kBAAoB,EAAA,OAAA,EAAS,SAAW,EAAA,KAAK,CAAC,CAAA;AAC7G,EAAO,OAAA;AAAA,IACL,OAAA;AAAA,IACA;AAAA,GACF;AACF"}