@burdenoff/microfe-auth 2026.510.127

package/dist/auth/constants/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/auth/constants/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;CAqBnB,CAAC;AAEX,MAAM,MAAM,cAAc,GACxB,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/auth/constants/permissions.js

@@ -0,0 +1,18 @@
+//#region src/auth/constants/permissions.ts
+var e = {
+	USER_READ: "user:read",
+	USER_UPDATE: "user:update",
+	USER_DELETE: "user:delete",
+	APP_READ: "app:read",
+	APP_CREATE: "app:create",
+	APP_UPDATE: "app:update",
+	SSO_CONFIG_MANAGE: "sso-config:manage",
+	SSO_CONFIG_DELETE: "sso-config:delete",
+	OIDC_CONFIG_MANAGE: "oidc-config:manage",
+	OIDC_CONFIG_DELETE: "oidc-config:delete",
+	AUTH_METHOD_UPDATE: "auth-method:update"
+};
+//#endregion
+export { e as AUTH_PERMISSIONS };
+
+//# sourceMappingURL=permissions.js.map

package/dist/auth/constants/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","names":[],"sources":["../../../src/auth/constants/permissions.ts"],"sourcesContent":["/**\n * Auth Permission Constants\n *\n * Permission strings matching the @rbac directives on global-auth-svc.\n * Only covers admin-facing operations — public auth flows (login, signup,\n * password reset, MFA verify, OAuth, SSO) don't need RBAC.\n * Self-service operations (own profile, sessions, API keys) are identity-scoped.\n *\n * Resource types and actions from global-rbac-svc seed:\n *   user:       read, update, delete\n *   app:        read, create, update\n *   sso-config: manage, delete\n *   oidc-config: manage, delete\n *   auth-method: update\n */\n\nexport const AUTH_PERMISSIONS = {\n  // User management (admin)\n  USER_READ: \"user:read\",\n  USER_UPDATE: \"user:update\",\n  USER_DELETE: \"user:delete\",\n\n  // OAuth app management\n  APP_READ: \"app:read\",\n  APP_CREATE: \"app:create\",\n  APP_UPDATE: \"app:update\",\n\n  // SSO configuration (admin)\n  SSO_CONFIG_MANAGE: \"sso-config:manage\",\n  SSO_CONFIG_DELETE: \"sso-config:delete\",\n\n  // OIDC configuration (admin)\n  OIDC_CONFIG_MANAGE: \"oidc-config:manage\",\n  OIDC_CONFIG_DELETE: \"oidc-config:delete\",\n\n  // Auth method configuration (admin)\n  AUTH_METHOD_UPDATE: \"auth-method:update\",\n} as const;\n\nexport type AuthPermission =\n  (typeof AUTH_PERMISSIONS)[keyof typeof AUTH_PERMISSIONS];\n"],"mappings":";AAgBA,IAAa,IAAmB;CAE9B,WAAW;CACX,aAAa;CACb,aAAa;CAGb,UAAU;CACV,YAAY;CACZ,YAAY;CAGZ,mBAAmB;CACnB,mBAAmB;CAGnB,oBAAoB;CACpB,oBAAoB;CAGpB,oBAAoB;CACrB"}

package/dist/auth/constants/sessionKeys.d.ts

@@ -0,0 +1,18 @@
+/**
+ * sessionStorage key constants for auth flows.
+ * Centralizing these avoids silent key mismatches across files.
+ */
+export declare const MFA_CHALLENGE_ID = "mfa_challenge_id";
+export declare const MFA_PENDING_TOKEN = "mfa_pending_token";
+export declare const MFA_PENDING_REFRESH = "mfa_pending_refresh";
+export declare const MFA_REDIRECT = "mfa_redirect";
+export declare const OIDC_CODE_VERIFIER = "oidc_code_verifier";
+export declare const OIDC_STATE = "oidc_state";
+export declare const OIDC_NONCE = "oidc_nonce";
+export declare const OIDC_TENANT_ID = "oidc_tenant_id";
+export declare const OIDC_FLOW = "oidc_flow";
+export declare const OIDC_REDIRECT = "oidc_redirect";
+export declare const OIDC_CLIENT_ID = "oidc_client_id";
+export declare const MFA_SESSION_KEYS: readonly ["mfa_challenge_id", "mfa_pending_token", "mfa_pending_refresh", "mfa_redirect"];
+export declare const OIDC_SESSION_KEYS: readonly ["oidc_code_verifier", "oidc_state", "oidc_nonce", "oidc_tenant_id", "oidc_flow", "oidc_redirect"];
+//# sourceMappingURL=sessionKeys.d.ts.map

package/dist/auth/constants/sessionKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionKeys.d.ts","sourceRoot":"","sources":["../../../src/auth/constants/sessionKeys.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAG3C,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAG/C,eAAO,MAAM,gBAAgB,2FAKnB,CAAC;AAEX,eAAO,MAAM,iBAAiB,6GAOpB,CAAC"}

package/dist/auth/constants/sessionKeys.js

@@ -0,0 +1,6 @@
+//#region src/auth/constants/sessionKeys.ts
+var e = "mfa_challenge_id", t = "mfa_pending_token", n = "mfa_pending_refresh", r = "mfa_redirect", i = "oidc_code_verifier", a = "oidc_state", o = "oidc_nonce", s = "oidc_tenant_id", c = "oidc_flow", l = "oidc_redirect";
+//#endregion
+export { e as MFA_CHALLENGE_ID, n as MFA_PENDING_REFRESH, t as MFA_PENDING_TOKEN, r as MFA_REDIRECT, i as OIDC_CODE_VERIFIER, c as OIDC_FLOW, o as OIDC_NONCE, l as OIDC_REDIRECT, a as OIDC_STATE, s as OIDC_TENANT_ID };
+
+//# sourceMappingURL=sessionKeys.js.map

package/dist/auth/constants/sessionKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionKeys.js","names":[],"sources":["../../../src/auth/constants/sessionKeys.ts"],"sourcesContent":["/**\n * sessionStorage key constants for auth flows.\n * Centralizing these avoids silent key mismatches across files.\n */\n\n// MFA verification flow\nexport const MFA_CHALLENGE_ID = \"mfa_challenge_id\";\nexport const MFA_PENDING_TOKEN = \"mfa_pending_token\";\nexport const MFA_PENDING_REFRESH = \"mfa_pending_refresh\";\nexport const MFA_REDIRECT = \"mfa_redirect\";\n\n// OIDC / SSO flow\nexport const OIDC_CODE_VERIFIER = \"oidc_code_verifier\";\nexport const OIDC_STATE = \"oidc_state\";\nexport const OIDC_NONCE = \"oidc_nonce\";\nexport const OIDC_TENANT_ID = \"oidc_tenant_id\";\nexport const OIDC_FLOW = \"oidc_flow\";\nexport const OIDC_REDIRECT = \"oidc_redirect\";\nexport const OIDC_CLIENT_ID = \"oidc_client_id\";\n\n// MFA key sets for bulk operations\nexport const MFA_SESSION_KEYS = [\n  MFA_CHALLENGE_ID,\n  MFA_PENDING_TOKEN,\n  MFA_PENDING_REFRESH,\n  MFA_REDIRECT,\n] as const;\n\nexport const OIDC_SESSION_KEYS = [\n  OIDC_CODE_VERIFIER,\n  OIDC_STATE,\n  OIDC_NONCE,\n  OIDC_TENANT_ID,\n  OIDC_FLOW,\n  OIDC_REDIRECT,\n] as const;\n"],"mappings":";AAMA,IAAa,IAAmB,oBACnB,IAAoB,qBACpB,IAAsB,uBACtB,IAAe,gBAGf,IAAqB,sBACrB,IAAa,cACb,IAAa,cACb,IAAiB,kBACjB,IAAY,aACZ,IAAgB"}

package/dist/auth/hooks/index.d.ts

@@ -0,0 +1,18 @@
+export { useAuthOperations } from './useAuthOperations';
+export { useMfaOperations } from './useMfaOperations';
+export { usePasswordOperations } from './usePasswordOperations';
+export { useSessionOperations } from './useSessionOperations';
+export { useApiKeyOperations } from './useApiKeyOperations';
+export { useAppOperations } from './useAppOperations';
+export { useWorkspaceOperations } from './useWorkspaceOperations';
+export { useMyWorkspaces } from './useMyWorkspaces';
+export { useContextSwitcherData, useWorkspaceSyncEffect, useProjectSyncEffect, } from './useContextSwitcherData';
+export type { UseContextSwitcherDataOptions } from './useContextSwitcherData';
+export { useDelegationOperations } from './useDelegationOperations';
+export { useUserOperations } from './useUserOperations';
+export { useSsoOperations } from './useSsoOperations';
+export { useOAuthOperations } from './useOAuthOperations';
+export { useAccountOperations } from './useAccountOperations';
+export { useAuthPermissions } from './useAuthPermissions';
+export { useAuthStore } from '../store/authStore';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/hooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAG9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAG5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAG9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAG9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/auth/hooks/index.js

@@ -0,0 +1,16 @@
+import "../store/authStore.js";
+import "./useAuthOperations.js";
+import "./useMfaOperations.js";
+import "./usePasswordOperations.js";
+import "./useSessionOperations.js";
+import "./useApiKeyOperations.js";
+import "./useAppOperations.js";
+import "./useWorkspaceOperations.js";
+import "./useMyWorkspaces.js";
+import "./useContextSwitcherData.js";
+import "./useDelegationOperations.js";
+import "./useUserOperations.js";
+import "./useSsoOperations.js";
+import "./useOAuthOperations.js";
+import "./useAccountOperations.js";
+import "./useAuthPermissions.js";

package/dist/auth/hooks/useAccountOperations.d.ts

@@ -0,0 +1,19 @@
+import { AuthResult } from '../types';
+
+export interface AccountActionResult {
+    success: boolean;
+    message: string;
+}
+/**
+ * Hook for account management operations (deactivate, delete, reactivate)
+ */
+export declare function useAccountOperations(): {
+    deactivateAccount: (password: string) => Promise<AccountActionResult>;
+    deleteAccount: (password: string, confirmPhrase: string) => Promise<AccountActionResult>;
+    reactivateAccount: (email: string, password: string) => Promise<AuthResult>;
+    isDeactivating: boolean;
+    isDeleting: boolean;
+    isReactivating: boolean;
+    isLoading: boolean;
+};
+//# sourceMappingURL=useAccountOperations.d.ts.map

package/dist/auth/hooks/useAccountOperations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAccountOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useAccountOperations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAqC3C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;GAEG;AACH,wBAAgB,oBAAoB;kCAqBtB,MAAM,KACf,OAAO,CAAC,mBAAmB,CAAC;8BAyBnB,MAAM,iBACD,MAAM,KACpB,OAAO,CAAC,mBAAmB,CAAC;+BA8BtB,MAAM,YACH,MAAM,KACf,OAAO,CAAC,UAAU,CAAC;;;;;EAuCvB"}

package/dist/auth/hooks/useAccountOperations.js

@@ -0,0 +1,52 @@
+import { useAuthStore as e } from "../store/authStore.js";
+import { DeactivateAccountDocument as t, DeleteAccountDocument as n, ReactivateAccountDocument as r } from "../../generated/global-operations.js";
+import { useMutation as i } from "@apollo/client/react";
+//#region src/auth/hooks/useAccountOperations.ts
+function a() {
+	let [a, { loading: o }] = i(t), [s, { loading: c }] = i(n), [l, { loading: u }] = i(r), d = e.getState();
+	return {
+		deactivateAccount: async (e) => {
+			try {
+				let { data: t } = await a({ variables: { password: e } }), n = t.deactivateAccount;
+				return n.success && d.clearAuth(), n;
+			} catch (e) {
+				throw console.error("Failed to deactivate account:", e), e;
+			}
+		},
+		deleteAccount: async (e, t) => {
+			if (t !== "DELETE MY ACCOUNT") throw Error("Please type \"DELETE MY ACCOUNT\" to confirm deletion");
+			try {
+				let { data: n } = await s({ variables: {
+					password: e,
+					confirmPhrase: t
+				} }), r = n.deleteAccount;
+				return r.success && d.clearAuth(), r;
+			} catch (e) {
+				throw console.error("Failed to delete account:", e), e;
+			}
+		},
+		reactivateAccount: async (e, t) => {
+			try {
+				d.setLoading(!0), d.setError(null);
+				let { data: n } = await l({ variables: {
+					email: e,
+					password: t
+				} }), r = n.reactivateAccount;
+				return r.success && r.user && r.token ? (d.setUser(r.user), d.setAuthTokens(r.token, r.refreshToken || ""), d.setAuthenticated(!0)) : r.error && d.setError(r.error), r;
+			} catch (e) {
+				let t = e instanceof Error ? e.message : "Failed to reactivate account";
+				throw d.setError(t), e;
+			} finally {
+				d.setLoading(!1);
+			}
+		},
+		isDeactivating: o,
+		isDeleting: c,
+		isReactivating: u,
+		isLoading: o || c || u
+	};
+}
+//#endregion
+export { a as useAccountOperations };
+
+//# sourceMappingURL=useAccountOperations.js.map

package/dist/auth/hooks/useAccountOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAccountOperations.js","names":[],"sources":["../../../src/auth/hooks/useAccountOperations.ts"],"sourcesContent":["import { useMutation } from \"@apollo/client/react\";\nimport { useAuthStore } from \"../store/authStore\";\nimport type { AuthResult } from \"../types\";\n\nimport {\n  DeactivateAccountDocument,\n  DeleteAccountDocument,\n  ReactivateAccountDocument,\n} from \"../../generated/global-operations\";\n// =============================================================================\n// Response Types (Apollo Client 4.x)\n// =============================================================================\n\ninterface DeactivateAccountResponse {\n  deactivateAccount: {\n    success: boolean;\n    message: string;\n  };\n}\n\ninterface DeleteAccountResponse {\n  deleteAccount: {\n    success: boolean;\n    message: string;\n  };\n}\n\ninterface ReactivateAccountResponse {\n  reactivateAccount: AuthResult;\n}\n\n// =============================================================================\n// GraphQL Operations\n// =============================================================================\n\n// =============================================================================\n// Types\n// =============================================================================\n\nexport interface AccountActionResult {\n  success: boolean;\n  message: string;\n}\n\n// =============================================================================\n// Hook\n// =============================================================================\n\n/**\n * Hook for account management operations (deactivate, delete, reactivate)\n */\nexport function useAccountOperations() {\n  const [deactivateAccountMutation, { loading: deactivating }] = useMutation<\n    DeactivateAccountResponse,\n    { password: string }\n  >(DeactivateAccountDocument);\n  const [deleteAccountMutation, { loading: deleting }] = useMutation<\n    DeleteAccountResponse,\n    { password: string; confirmPhrase: string }\n  >(DeleteAccountDocument);\n  const [reactivateAccountMutation, { loading: reactivating }] = useMutation<\n    ReactivateAccountResponse,\n    { email: string; password: string }\n  >(ReactivateAccountDocument);\n\n  const store = useAuthStore.getState();\n\n  /**\n   * Deactivate account (soft disable - can be reactivated)\n   * Requires password confirmation\n   */\n  const deactivateAccount = async (\n    password: string,\n  ): Promise<AccountActionResult> => {\n    try {\n      const { data } = await deactivateAccountMutation({\n        variables: { password },\n      });\n\n      const result = data!.deactivateAccount;\n\n      if (result.success) {\n        // Clear auth state after deactivation\n        store.clearAuth();\n      }\n\n      return result;\n    } catch (error) {\n      console.error(\"Failed to deactivate account:\", error);\n      throw error;\n    }\n  };\n\n  /**\n   * Delete account permanently\n   * Requires password AND confirmation phrase \"DELETE MY ACCOUNT\"\n   */\n  const deleteAccount = async (\n    password: string,\n    confirmPhrase: string,\n  ): Promise<AccountActionResult> => {\n    // Validate confirmation phrase\n    if (confirmPhrase !== \"DELETE MY ACCOUNT\") {\n      throw new Error('Please type \"DELETE MY ACCOUNT\" to confirm deletion');\n    }\n\n    try {\n      const { data } = await deleteAccountMutation({\n        variables: { password, confirmPhrase },\n      });\n\n      const result = data!.deleteAccount;\n\n      if (result.success) {\n        // Clear auth state after deletion\n        store.clearAuth();\n      }\n\n      return result;\n    } catch (error) {\n      console.error(\"Failed to delete account:\", error);\n      throw error;\n    }\n  };\n\n  /**\n   * Reactivate a deactivated account\n   * Returns new auth tokens\n   */\n  const reactivateAccount = async (\n    email: string,\n    password: string,\n  ): Promise<AuthResult> => {\n    try {\n      store.setLoading(true);\n      store.setError(null);\n\n      const { data } = await reactivateAccountMutation({\n        variables: { email, password },\n      });\n\n      const result = data!.reactivateAccount;\n\n      if (result.success && result.user && result.token) {\n        store.setUser(result.user);\n        store.setAuthTokens(result.token, result.refreshToken || \"\");\n        store.setAuthenticated(true);\n      } else if (result.error) {\n        store.setError(result.error);\n      }\n\n      return result;\n    } catch (error) {\n      const message =\n        error instanceof Error ? error.message : \"Failed to reactivate account\";\n      store.setError(message);\n      throw error;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  return {\n    deactivateAccount,\n    deleteAccount,\n    reactivateAccount,\n    isDeactivating: deactivating,\n    isDeleting: deleting,\n    isReactivating: reactivating,\n    isLoading: deactivating || deleting || reactivating,\n  };\n}\n"],"mappings":";;;;AAmDA,SAAgB,IAAuB;CACrC,IAAM,CAAC,GAA2B,EAAE,SAAS,OAAkB,EAG7D,EAA0B,EACtB,CAAC,GAAuB,EAAE,SAAS,OAAc,EAGrD,EAAsB,EAClB,CAAC,GAA2B,EAAE,SAAS,OAAkB,EAG7D,EAA0B,EAEtB,IAAQ,EAAa,UAAU;AAiGrC,QAAO;EACL,mBA5FwB,OACxB,MACiC;AACjC,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAA0B,EAC/C,WAAW,EAAE,aAAU,EACxB,CAAC,EAEI,IAAS,EAAM;AAOrB,WALI,EAAO,WAET,EAAM,WAAW,EAGZ;YACA,GAAO;AAEd,UADA,QAAQ,MAAM,iCAAiC,EAAM,EAC/C;;;EA2ER,eAnEoB,OACpB,GACA,MACiC;AAEjC,OAAI,MAAkB,oBACpB,OAAU,MAAM,wDAAsD;AAGxE,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAAsB,EAC3C,WAAW;KAAE;KAAU;KAAe,EACvC,CAAC,EAEI,IAAS,EAAM;AAOrB,WALI,EAAO,WAET,EAAM,WAAW,EAGZ;YACA,GAAO;AAEd,UADA,QAAQ,MAAM,6BAA6B,EAAM,EAC3C;;;EA4CR,mBApCwB,OACxB,GACA,MACwB;AACxB,OAAI;AAEF,IADA,EAAM,WAAW,GAAK,EACtB,EAAM,SAAS,KAAK;IAEpB,IAAM,EAAE,YAAS,MAAM,EAA0B,EAC/C,WAAW;KAAE;KAAO;KAAU,EAC/B,CAAC,EAEI,IAAS,EAAM;AAUrB,WARI,EAAO,WAAW,EAAO,QAAQ,EAAO,SAC1C,EAAM,QAAQ,EAAO,KAAK,EAC1B,EAAM,cAAc,EAAO,OAAO,EAAO,gBAAgB,GAAG,EAC5D,EAAM,iBAAiB,GAAK,IACnB,EAAO,SAChB,EAAM,SAAS,EAAO,MAAM,EAGvB;YACA,GAAO;IACd,IAAM,IACJ,aAAiB,QAAQ,EAAM,UAAU;AAE3C,UADA,EAAM,SAAS,EAAQ,EACjB;aACE;AACR,MAAM,WAAW,GAAM;;;EAQzB,gBAAgB;EAChB,YAAY;EACZ,gBAAgB;EAChB,WAAW,KAAgB,KAAY;EACxC"}

package/dist/auth/hooks/useApiKeyOperations.d.ts

@@ -0,0 +1,22 @@
+import { GenerateAPIKeyInput, APIKeyResult, APIKeyRotateResult, AuthResult, ApiKey } from '../types';
+
+interface MyApiKeysResponse {
+    myApiKeys: ApiKey[];
+}
+/**
+ * Hook for API key operations
+ */
+export declare function useApiKeyOperations(): {
+    generateAPIKey: (input: GenerateAPIKeyInput) => Promise<APIKeyResult>;
+    revokeAPIKey: (keyId: string) => Promise<boolean>;
+    rotateAPIKey: (keyId: string) => Promise<APIKeyRotateResult>;
+    authenticateAPIKey: (apiKey: string, apiSecret: string) => Promise<AuthResult>;
+    refetchApiKeys: () => Promise<void> | import("@apollo/client").ObservableQuery.ResultPromise<import("@apollo/client").ApolloClient.QueryResult<MyApiKeysResponse>>;
+    createApiKey: (input: GenerateAPIKeyInput) => Promise<APIKeyResult>;
+    revokeApiKey: (keyId: string) => Promise<boolean>;
+    apiKeys: ApiKey[];
+    isLoading: boolean;
+    error: import('@apollo/client').ErrorLike | undefined;
+};
+export {};
+//# sourceMappingURL=useApiKeyOperations.d.ts.map

package/dist/auth/hooks/useApiKeyOperations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useApiKeyOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useApiKeyOperations.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,MAAM,EACP,MAAM,UAAU,CAAC;AAGlB,UAAU,iBAAiB;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAoBD;;GAEG;AACH,wBAAgB,mBAAmB;4BAwDxB,mBAAmB,KACzB,OAAO,CAAC,YAAY,CAAC;0BAuBW,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;0BAgBzB,MAAM,KAAG,OAAO,CAAC,kBAAkB,CAAC;iCAqB7D,MAAM,aACH,MAAM,KAChB,OAAO,CAAC,UAAU,CAAC;;0BA/Db,mBAAmB,KACzB,OAAO,CAAC,YAAY,CAAC;0BAuBW,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;;;;EA0E7D"}

package/dist/auth/hooks/useApiKeyOperations.js

@@ -0,0 +1,4 @@
+import "../store/authStore.js";
+import "../../generated/global-operations.js";
+import "react";
+import "@apollo/client/react";

package/dist/auth/hooks/useAppOperations.d.ts

@@ -0,0 +1,26 @@
+import { App, AppCreateResponse, CreateAppInput, UpdateAppInput, AppTokenResponse, AppAsUserTokenResponse } from '../types';
+
+interface CurrentUserAppsResponse {
+    currentUserApps: App[];
+}
+/**
+ * Hook for app management operations
+ */
+export declare function useAppOperations(): {
+    getApp: (id: string) => Promise<App | null>;
+    refetchApps: () => Promise<void> | import("@apollo/client").ObservableQuery.ResultPromise<import("@apollo/client").ApolloClient.QueryResult<CurrentUserAppsResponse>>;
+    createApp: (input: CreateAppInput) => Promise<AppCreateResponse>;
+    updateApp: (id: string, input: UpdateAppInput) => Promise<App>;
+    deactivateApp: (id: string) => Promise<boolean>;
+    rotateAppSecret: (id: string) => Promise<AppCreateResponse>;
+    authenticateApp: (clientId: string, clientSecret: string, scopes?: string[]) => Promise<AppTokenResponse>;
+    generateAppToken: (clientId: string, clientSecret: string, scopes?: string[]) => Promise<AppTokenResponse>;
+    generateAppAsUserToken: (targetUserId: string, scopes?: string[]) => Promise<AppAsUserTokenResponse>;
+    exchangeToken: (appId: string, userId: string, scopes?: string[]) => Promise<AppAsUserTokenResponse>;
+    apps: App[];
+    currentApp: App | null;
+    isLoading: boolean;
+    error: import('@apollo/client').ErrorLike | undefined;
+};
+export {};
+//# sourceMappingURL=useAppOperations.d.ts.map

package/dist/auth/hooks/useAppOperations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAppOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useAppOperations.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,GAAG,EACH,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,UAAU,CAAC;AAMlB,UAAU,uBAAuB;IAC/B,eAAe,EAAE,GAAG,EAAE,CAAC;CACxB;AAoCD;;GAEG;AACH,wBAAgB,gBAAgB;iBA2EJ,MAAM,KAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;;uBAU7C,cAAc,KACpB,OAAO,CAAC,iBAAiB,CAAC;oBA2BA,MAAM,SAAS,cAAc,KAAG,OAAO,CAAC,GAAG,CAAC;wBA2BxC,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;0BAuBvB,MAAM,KAAG,OAAO,CAAC,iBAAiB,CAAC;gCAwB1D,MAAM,gBACF,MAAM,WACX,MAAM,EAAE,KAChB,OAAO,CAAC,gBAAgB,CAAC;iCAwBhB,MAAM,gBACF,MAAM,WACX,MAAM,EAAE,KAChB,OAAO,CAAC,gBAAgB,CAAC;2CAwBZ,MAAM,WACX,MAAM,EAAE,KAChB,OAAO,CAAC,sBAAsB,CAAC;2BAwBzB,MAAM,UACL,MAAM,WACL,MAAM,EAAE,KAChB,OAAO,CAAC,sBAAsB,CAAC;;;;;EAuCnC"}

package/dist/auth/hooks/useAppOperations.js

@@ -0,0 +1,4 @@
+import "../store/authStore.js";
+import "../../generated/global-operations.js";
+import "react";
+import "@apollo/client/react";

package/dist/auth/hooks/useAuthOperations.d.ts

@@ -0,0 +1,57 @@
+import { SignInInput, SignUpInput, User, AuthPayload, AuthResult } from '../types';
+
+interface CurrentUserResponse {
+    currentUser: User | null;
+}
+interface UseAuthOperationsOptions {
+    disableCurrentUserQuery?: boolean;
+}
+/**
+ * Hook for authentication operations
+ * Uses Zustand v5 pattern: selectors for state, getState() for actions
+ */
+export declare function useAuthOperations(options?: UseAuthOperationsOptions): {
+    signIn: (input: SignInInput) => Promise<AuthResult>;
+    signUp: (input: SignUpInput) => Promise<AuthPayload | {
+        requiresEmailVerification: boolean;
+        user: User | null;
+        accessToken: string | null;
+        refreshToken: string | null;
+        expiresIn: number | null;
+        requiresMFA?: boolean;
+        mfaChallengeId?: string;
+        mfaMethod?: import('..').MFAMethod;
+    }>;
+    signOut: () => Promise<void>;
+    refreshToken: () => Promise<AuthPayload>;
+    verifyEmail: (token: string) => Promise<{
+        success: boolean;
+        message: string;
+        email?: string;
+    }>;
+    resendVerification: (email: string) => Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    refetchCurrentUser: (variables?: Partial<import('@apollo/client').OperationVariables> | undefined) => Promise<import("@apollo/client").ApolloClient.QueryResult<CurrentUserResponse>>;
+    login: (input: SignInInput) => Promise<AuthResult>;
+    register: (input: SignUpInput) => Promise<AuthPayload | {
+        requiresEmailVerification: boolean;
+        user: User | null;
+        accessToken: string | null;
+        refreshToken: string | null;
+        expiresIn: number | null;
+        requiresMFA?: boolean;
+        mfaChallengeId?: string;
+        mfaMethod?: import('..').MFAMethod;
+    }>;
+    logout: () => Promise<void>;
+    isLoading: boolean;
+    error: string | null;
+    errorCode: string | null;
+    isAuthenticated: boolean;
+    user: User | null;
+    accessToken: string | null;
+};
+export {};
+//# sourceMappingURL=useAuthOperations.d.ts.map

package/dist/auth/hooks/useAuthOperations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useAuthOperations.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,IAAI,EACJ,WAAW,EACX,UAAU,EACX,MAAM,UAAU,CAAC;AA6IlB,UAAU,mBAAmB;IAC3B,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B;AAED,UAAU,wBAAwB;IAChC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AA4BD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B;oBAyCzC,WAAW,KAAG,OAAO,CAAC,UAAU,CAAC;oBAkJjC,WAAW;;;;;;;;;;;;yBAqO/B,MAAM,KACZ,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;gCAyBxB,MAAM;iBA3cpC,OAAO;iBACP,MAAM;;;mBAyDY,WAAW,KAAG,OAAO,CAAC,UAAU,CAAC;sBAkJjC,WAAW;;;;;;;;;;;;;;;;;EAqSzC"}

package/dist/auth/hooks/useAuthOperations.js

@@ -0,0 +1,236 @@
+import { useAuth as e } from "../providers/AuthProvider.js";
+import { useAuthStore as t } from "../store/authStore.js";
+import { CurrentUserDocument as n, RefreshTokenDocument as r, ResendVerificationEmailDocument as i, SignInDocument as a, SignOutDocument as o, SignUpDocument as s, VerifyEmailDocument as c } from "../../generated/global-operations.js";
+import { useEffect as l, useRef as u } from "react";
+import { loginProfile as d } from "@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager";
+import { useApolloClient as f, useMutation as p, useQuery as m } from "@apollo/client/react";
+import { useEventBus as h } from "@burdenoff/fe-libs/shared/events";
+//#region src/auth/hooks/useAuthOperations.ts
+function g(e, t) {
+	return e.includes("email or username already exists") || t === "BAD_USER_INPUT" ? "An account with this email or username already exists. Please sign in or use a different email." : t === "TENANT_CREATION_FAILED" ? "We couldn't finish setting up your account. Please try again in a few moments. If this persists, contact support." : e.includes("Failed to fetch") || e.includes("NetworkError") || e.includes("Load failed") ? "Unable to reach the server. Please check your internet connection and try again." : e.includes("CORS") || e.includes("cross-origin") ? "Unable to reach the server. Please try again or contact support." : t === "INTERNAL_SERVER_ERROR" ? "Something went wrong on our end. Please try again in a few moments." : e && e !== "Sign up failed" ? e : "Sign up failed. Please try again.";
+}
+function _(e) {
+	try {
+		let t = window.location.hostname.endsWith(".local.burdenoff.com") ? ".local.burdenoff.com" : void 0, n = t ? `; domain=${t}` : "", r = window.location.protocol === "https:" ? "; secure" : "", i = JSON.stringify({
+			id: e,
+			origin: window.location.origin
+		});
+		document.cookie = `bf-sso=${encodeURIComponent(i)}${n}; path=/; samesite=lax${r}; max-age=86400`, document.cookie = `bf-sso-profile=${encodeURIComponent(i)}${n}; path=/; samesite=lax${r}; max-age=86400`;
+	} catch {}
+}
+function v(e) {
+	return { ...e };
+}
+function y(e) {
+	return typeof e == "object" && !!e;
+}
+function b(e) {
+	return Array.isArray(e) ? e.filter((e) => y(e)) : [];
+}
+function x(e) {
+	if (!y(e)) return [];
+	let t = b(e.errors);
+	return t.length > 0 ? t : b(e.graphQLErrors);
+}
+function S(e) {
+	if (e instanceof Error || y(e) && typeof e.message == "string") return e.message;
+}
+function C(e) {
+	let t = e?.extensions?.code;
+	return typeof t == "string" ? t : null;
+}
+function w(y = {}) {
+	let b = t((e) => e.isLoading), w = t((e) => e.error), T = t((e) => e.errorCode), E = t((e) => e.isAuthenticated), D = t((e) => e.user), O = t((e) => e.accessToken), k = y.disableCurrentUserQuery ?? !1, A = u(!1), j = e(), M = h(), N = f(), [P] = p(a), [F] = p(s), [I] = p(o), [L] = p(r), [R] = p(c), [z] = p(i), B = async (e) => {
+		let n = t.getState();
+		try {
+			n.setLoading(!0), n.setError(null);
+			let t = await P({
+				variables: { input: e },
+				errorPolicy: "none"
+			});
+			if (!t.data || !t.data.signIn) {
+				let e = "Sign in failed. Please check your credentials and try again.";
+				return n.setError(e), {
+					success: !1,
+					error: e
+				};
+			}
+			let r = t.data.signIn;
+			if (r.requiresMFA && r.mfaChallengeId) return n.setMfaRequired(!0, r.mfaChallengeId), {
+				success: !0,
+				requiresMFA: !0,
+				mfaChallengeId: r.mfaChallengeId,
+				metadata: { mfaMethod: r.mfaMethod }
+			};
+			if (r.user && r.accessToken && r.refreshToken) {
+				A.current = !0, n.setUser(r.user), n.setAuthTokens(r.accessToken, r.refreshToken), n.setAuthenticated(!0), n.setMfaRequired(!1);
+				let e = r.expiresIn ? Date.now() + r.expiresIn * 1e3 : void 0;
+				return d(v(r.user), {
+					accessToken: r.accessToken,
+					refreshToken: r.refreshToken,
+					expiresAt: e
+				}), _(r.user.id), M.emit("auth.signed_in", {
+					userId: r.user.id,
+					tenantId: r.user.tenantId,
+					workspaceId: r.user.defaultWorkspaceId,
+					mfaEnabled: r.user.mfaEnabled,
+					emailVerified: r.user.emailVerified
+				}, { component: "useAuthOperations" }), j.onAuthSuccess?.(r.user, r.accessToken, r.refreshToken), {
+					success: !0,
+					user: r.user,
+					token: r.accessToken,
+					refreshToken: r.refreshToken,
+					expiresIn: r.expiresIn,
+					requiresMFA: !1
+				};
+			} else {
+				let e = "Login failed: Invalid response from server";
+				return n.setError(e), {
+					success: !1,
+					error: e
+				};
+			}
+		} catch (e) {
+			let t = "Sign in failed", r = null, i = x(e);
+			if (i.length > 0) {
+				let e = i[0];
+				t = e.message || t, r = C(e);
+			} else t = S(e) ?? t;
+			return console.error("[SignIn] Error:", t, r ? `(${r})` : ""), n.setError(t, r), {
+				success: !1,
+				error: t
+			};
+		} finally {
+			n.setLoading(!1);
+		}
+	}, V = async (e) => {
+		let n = t.getState();
+		try {
+			n.setLoading(!0), n.setError(null);
+			let t = await F({ variables: { input: e } }), r = x(t);
+			if (r.length > 0) {
+				let e = r[0].message ?? "Sign up failed";
+				throw console.error("[SignUp] GraphQL error:", e), n.setError(e), Error(e);
+			}
+			if (!t.data || !t.data.signUp) {
+				let e = "Sign up failed: No response from server";
+				throw console.error("[SignUp] No data:", e), n.setError(e), Error(e);
+			}
+			let i = t.data.signUp;
+			if (!i.user) throw Error("Sign up failed: No user data returned");
+			return !i.accessToken || !i.refreshToken || i.accessToken === "" || i.refreshToken === "" ? (n.setUser(i.user), n.setAuthenticated(!1), {
+				...i,
+				requiresEmailVerification: !0
+			}) : (n.setUser(i.user), n.setAuthTokens(i.accessToken, i.refreshToken), n.setAuthenticated(!0), M.emit("auth.signed_up", {
+				userId: i.user.id,
+				tenantId: i.user.tenantId,
+				workspaceId: i.user.defaultWorkspaceId,
+				mfaEnabled: i.user.mfaEnabled,
+				emailVerified: i.user.emailVerified
+			}, { component: "useAuthOperations" }), j.onAuthSuccess?.(i.user, i.accessToken, i.refreshToken), i);
+		} catch (e) {
+			let t = "Sign up failed. Please try again.", r, i = x(e);
+			if (i.length > 0) {
+				let e = i[0];
+				r = C(e) ?? void 0, t = g(e.message ?? "", r);
+			} else {
+				let n = S(e);
+				n && (t = g(n));
+			}
+			throw n.setError(t, r ?? null), Error(t);
+		} finally {
+			n.setLoading(!1);
+		}
+	}, H = async () => {
+		let e = t.getState(), n = e.user;
+		try {
+			await I();
+		} catch (e) {
+			console.error("Sign out failed:", e);
+		} finally {
+			await N.clearStore(), e.clearAuth(), M.emit("auth.signed_out", {
+				userId: n?.id,
+				tenantId: n?.tenantId,
+				workspaceId: n?.defaultWorkspaceId
+			}, { component: "useAuthOperations" }), j.onLogout?.();
+		}
+	}, U = async () => {
+		let e = t.getState();
+		try {
+			let t = e.refreshToken;
+			if (!t) throw Error("No refresh token available");
+			let { data: n } = await L({ variables: { token: t } }), r = n.refreshToken;
+			if (!r.accessToken || !r.refreshToken || !r.user) throw Error("Token refresh failed: Invalid response from server");
+			return e.setAuthTokens(r.accessToken, r.refreshToken), e.setUser(r.user), M.emit("auth.token_refreshed", {
+				userId: r.user.id,
+				tenantId: r.user.tenantId,
+				workspaceId: r.user.defaultWorkspaceId,
+				mfaEnabled: r.user.mfaEnabled,
+				emailVerified: r.user.emailVerified
+			}, { component: "useAuthOperations" }), r;
+		} catch (t) {
+			throw M.emit("auth.token_refresh_failed", {
+				userId: e.user?.id,
+				tenantId: e.user?.tenantId,
+				workspaceId: e.user?.defaultWorkspaceId,
+				reason: t instanceof Error ? t.message : "Token refresh failed"
+			}, { component: "useAuthOperations" }), e.clearAuth(), t;
+		}
+	}, { data: W, refetch: G } = m(n, {
+		skip: k || !E || A.current,
+		fetchPolicy: "network-only"
+	});
+	return l(() => {
+		W?.currentUser && t.getState().setUser(W.currentUser);
+	}, [W]), l(() => {
+		if (A.current && E) {
+			let e = setTimeout(() => {
+				A.current = !1;
+			}, 2e3);
+			return () => clearTimeout(e);
+		}
+	}, [E]), {
+		signIn: B,
+		signUp: V,
+		signOut: H,
+		refreshToken: U,
+		verifyEmail: async (e) => {
+			let n = t.getState();
+			try {
+				n.setLoading(!0);
+				let { data: t } = await R({ variables: { token: e } });
+				return t.verifyEmail.success && n.user && n.setUser({
+					...n.user,
+					emailVerified: !0
+				}), t.verifyEmail;
+			} catch (e) {
+				let t = e instanceof Error ? e.message : "Email verification failed";
+				throw n.setError(t), e;
+			} finally {
+				n.setLoading(!1);
+			}
+		},
+		resendVerification: async (e) => {
+			try {
+				let { data: t } = await z({ variables: { email: e } });
+				return t.resendVerificationEmail;
+			} catch (e) {
+				throw console.error("Failed to resend verification email:", e), e;
+			}
+		},
+		refetchCurrentUser: G,
+		login: B,
+		register: V,
+		logout: H,
+		isLoading: b,
+		error: w,
+		errorCode: T,
+		isAuthenticated: E,
+		user: D,
+		accessToken: O
+	};
+}
+//#endregion
+export { w as useAuthOperations };
+
+//# sourceMappingURL=useAuthOperations.js.map

package/dist/auth/hooks/useAuthOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthOperations.js","names":[],"sources":["../../../src/auth/hooks/useAuthOperations.ts"],"sourcesContent":["import { useEffect, useRef } from \"react\";\nimport { useMutation, useQuery, useApolloClient } from \"@apollo/client/react\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport {\n  loginProfile,\n  type ProfileUser,\n} from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport {\n  SignInDocument,\n  SignUpDocument,\n  SignOutDocument,\n  RefreshTokenDocument,\n  CurrentUserDocument,\n  VerifyEmailDocument,\n  ResendVerificationEmailDocument,\n} from \"../../generated/global-operations\";\nimport type {\n  SignInInput,\n  SignUpInput,\n  User,\n  AuthPayload,\n  AuthResult,\n} from \"../types\";\n\n// =============================================================================\n// ERROR MAPPING HELPERS\n// =============================================================================\n\n/**\n * Map raw backend error messages to user-friendly descriptions.\n * Keeps a single source of truth for all sign-up error copy.\n */\nfunction mapSignUpError(rawMessage: string, errorCode?: string): string {\n  // Exact matches from the backend\n  if (\n    rawMessage.includes(\"email or username already exists\") ||\n    errorCode === \"BAD_USER_INPUT\"\n  ) {\n    return \"An account with this email or username already exists. Please sign in or use a different email.\";\n  }\n\n  if (errorCode === \"TENANT_CREATION_FAILED\") {\n    return \"We couldn't finish setting up your account. Please try again in a few moments. If this persists, contact support.\";\n  }\n\n  // Network / fetch failures (Apollo wraps these)\n  if (\n    rawMessage.includes(\"Failed to fetch\") ||\n    rawMessage.includes(\"NetworkError\") ||\n    rawMessage.includes(\"Load failed\")\n  ) {\n    return \"Unable to reach the server. Please check your internet connection and try again.\";\n  }\n\n  // CORS or cross-origin issues\n  if (rawMessage.includes(\"CORS\") || rawMessage.includes(\"cross-origin\")) {\n    return \"Unable to reach the server. Please try again or contact support.\";\n  }\n\n  // Generic server errors\n  if (errorCode === \"INTERNAL_SERVER_ERROR\") {\n    return \"Something went wrong on our end. Please try again in a few moments.\";\n  }\n\n  // Pass through any already-descriptive message, or fall back\n  if (rawMessage && rawMessage !== \"Sign up failed\") {\n    return rawMessage;\n  }\n\n  return \"Sign up failed. Please try again.\";\n}\n\nfunction setShellSsoCookie(userId: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const ssoValue = JSON.stringify({\n      id: userId,\n      origin: window.location.origin,\n    });\n    document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n    document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    // Best effort only.\n  }\n}\n\nfunction toProfileUser(user: User): ProfileUser {\n  return { ...user };\n}\n\ninterface GraphQLErrorLike {\n  message?: string;\n  extensions?: Record<string, unknown>;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction asGraphQLErrorArray(value: unknown): GraphQLErrorLike[] {\n  if (!Array.isArray(value)) return [];\n  return value.filter((item): item is GraphQLErrorLike => isRecord(item));\n}\n\nfunction getGraphQLErrors(error: unknown): GraphQLErrorLike[] {\n  if (!isRecord(error)) return [];\n  const directErrors = asGraphQLErrorArray(error.errors);\n  if (directErrors.length > 0) return directErrors;\n  return asGraphQLErrorArray(error.graphQLErrors);\n}\n\nfunction getUnknownErrorMessage(error: unknown): string | undefined {\n  if (error instanceof Error) return error.message;\n  if (isRecord(error) && typeof error.message === \"string\") {\n    return error.message;\n  }\n  return undefined;\n}\n\nfunction getGraphQLErrorCode(\n  error: GraphQLErrorLike | undefined,\n): string | null {\n  const code = error?.extensions?.code;\n  return typeof code === \"string\" ? code : null;\n}\n\n// =============================================================================\n// GRAPHQL RESPONSE INTERFACES (Apollo Client 4.x)\n// =============================================================================\n\ninterface SignInResponse {\n  signIn: AuthPayload;\n}\n\ninterface SignInVariables {\n  input: SignInInput;\n}\n\ninterface SignUpResponse {\n  signUp: AuthPayload;\n}\n\ninterface SignUpVariables {\n  input: SignUpInput;\n}\n\ninterface SignOutResponse {\n  signOut: boolean;\n}\n\ninterface RefreshTokenResponse {\n  refreshToken: AuthPayload;\n}\n\ninterface RefreshTokenVariables {\n  token: string;\n}\n\ninterface CurrentUserResponse {\n  currentUser: User | null;\n}\n\ninterface UseAuthOperationsOptions {\n  disableCurrentUserQuery?: boolean;\n}\n\ninterface VerifyEmailResponse {\n  verifyEmail: {\n    success: boolean;\n    message: string;\n  };\n}\n\ninterface VerifyEmailVariables {\n  token: string;\n}\n\ninterface ResendVerificationEmailResponse {\n  resendVerificationEmail: {\n    success: boolean;\n    message: string;\n  };\n}\n\ninterface ResendVerificationEmailVariables {\n  email: string;\n}\n\n// GraphQL Operations\n\n// SignIn mutation with MFA support\n\n/**\n * Hook for authentication operations\n * Uses Zustand v5 pattern: selectors for state, getState() for actions\n */\nexport function useAuthOperations(options: UseAuthOperationsOptions = {}) {\n  // Use selectors for reactive state values\n  const isLoading = useAuthStore((state) => state.isLoading);\n  const error = useAuthStore((state) => state.error);\n  const errorCode = useAuthStore((state) => state.errorCode);\n  const isAuthenticated = useAuthStore((state) => state.isAuthenticated);\n  const user = useAuthStore((state) => state.user);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const disableCurrentUserQuery = options.disableCurrentUserQuery ?? false;\n\n  // Track whether signIn just completed — skip the CurrentUser refetch\n  // because signIn already returns the full user object.\n  const loginJustCompletedRef = useRef(false);\n\n  const context = useAuth();\n  const eventBus = useEventBus();\n  const apolloClient = useApolloClient();\n  const [signInMutation] = useMutation<SignInResponse, SignInVariables>(\n    SignInDocument,\n  );\n  const [signUpMutation] = useMutation<SignUpResponse, SignUpVariables>(\n    SignUpDocument,\n  );\n  const [signOutMutation] = useMutation<SignOutResponse>(SignOutDocument);\n  const [refreshTokenMutation] = useMutation<\n    RefreshTokenResponse,\n    RefreshTokenVariables\n  >(RefreshTokenDocument);\n  const [verifyEmailMutation] = useMutation<\n    VerifyEmailResponse,\n    VerifyEmailVariables\n  >(VerifyEmailDocument);\n  const [resendVerificationMutation] = useMutation<\n    ResendVerificationEmailResponse,\n    ResendVerificationEmailVariables\n  >(ResendVerificationEmailDocument);\n\n  /**\n   * Sign in with email/username and password\n   * Uses signIn mutation which returns correct token format (with 'sub' field)\n   */\n  const signIn = async (input: SignInInput): Promise<AuthResult> => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      store.setError(null);\n\n      // rememberMe is sent to the backend so the server can issue\n      // longer-lived refresh tokens (30 days instead of 7 days)\n\n      // Use signIn mutation (returns correct token format with 'sub' field)\n      const result = await signInMutation({\n        variables: { input },\n        // Override client-level errorPolicy to ensure errors are thrown\n        // and caught by our catch block for proper error message extraction\n        errorPolicy: \"none\",\n      });\n\n      // If we reach here, the mutation succeeded (no errors thrown)\n      // Check if data.signIn is present\n      if (!result.data || !result.data.signIn) {\n        const errorMessage =\n          \"Sign in failed. Please check your credentials and try again.\";\n        store.setError(errorMessage);\n        return {\n          success: false,\n          error: errorMessage,\n        } as AuthResult;\n      }\n\n      const data = result.data;\n\n      const authResult = data.signIn;\n\n      // Check if MFA is required\n      if (authResult.requiresMFA && authResult.mfaChallengeId) {\n        store.setMfaRequired(true, authResult.mfaChallengeId);\n\n        // Return success but with requiresMFA flag\n        return {\n          success: true,\n          requiresMFA: true,\n          mfaChallengeId: authResult.mfaChallengeId,\n          metadata: {\n            mfaMethod: authResult.mfaMethod,\n          },\n        } as AuthResult;\n      }\n\n      // Normal login without MFA - store the authentication result\n      if (\n        authResult.user &&\n        authResult.accessToken &&\n        authResult.refreshToken\n      ) {\n        // Signal that user data is fresh from signIn — skip CurrentUser refetch.\n        loginJustCompletedRef.current = true;\n        store.setUser(authResult.user);\n        store.setAuthTokens(authResult.accessToken, authResult.refreshToken);\n        store.setAuthenticated(true);\n        store.setMfaRequired(false);\n\n        const expiresAt = authResult.expiresIn\n          ? Date.now() + authResult.expiresIn * 1000\n          : undefined;\n        loginProfile(toProfileUser(authResult.user), {\n          accessToken: authResult.accessToken,\n          refreshToken: authResult.refreshToken,\n          expiresAt,\n        });\n        setShellSsoCookie(authResult.user.id);\n\n        eventBus.emit(\n          \"auth.signed_in\",\n          {\n            userId: authResult.user.id,\n            tenantId: authResult.user.tenantId,\n            workspaceId: authResult.user.defaultWorkspaceId,\n            mfaEnabled: authResult.user.mfaEnabled,\n            emailVerified: authResult.user.emailVerified,\n          },\n          { component: \"useAuthOperations\" },\n        );\n\n        context.onAuthSuccess?.(\n          authResult.user,\n          authResult.accessToken,\n          authResult.refreshToken,\n        );\n\n        // Convert AuthPayload to AuthResult for consistent return type\n        return {\n          success: true,\n          user: authResult.user,\n          token: authResult.accessToken,\n          refreshToken: authResult.refreshToken,\n          expiresIn: authResult.expiresIn,\n          requiresMFA: false,\n        } as AuthResult;\n      } else {\n        const errorMsg = \"Login failed: Invalid response from server\";\n        store.setError(errorMsg);\n        return {\n          success: false,\n          error: errorMsg,\n        } as AuthResult;\n      }\n    } catch (err: unknown) {\n      // Extract error message and code from GraphQL error responses.\n      // The backend sends user-friendly messages in gqlError.message and\n      // structured error codes in gqlError.extensions.code (e.g., ACCOUNT_DELETED,\n      // ACCOUNT_SUSPENDED, ACCOUNT_INACTIVE, OAUTH_ONLY_ACCOUNT, EMAIL_NOT_VERIFIED,\n      // UNAUTHENTICATED, INTERNAL_SERVER_ERROR).\n      // IMPORTANT: Never use gqlError.extensions.originalError — it may contain\n      // internal details that should not be shown to users.\n      let message = \"Sign in failed\";\n      let errorCode: string | null = null;\n      const graphQLErrors = getGraphQLErrors(err);\n      if (graphQLErrors.length > 0) {\n        // Apollo v4 CombinedGraphQLErrors\n        // Apollo v3 ApolloError — use message only, never originalError\n        const gqlError = graphQLErrors[0];\n        message = gqlError.message || message;\n        errorCode = getGraphQLErrorCode(gqlError);\n      } else {\n        message = getUnknownErrorMessage(err) ?? message;\n      }\n\n      console.error(\n        \"[SignIn] Error:\",\n        message,\n        errorCode ? `(${errorCode})` : \"\",\n      );\n      store.setError(message, errorCode);\n      return {\n        success: false,\n        error: message,\n      } as AuthResult;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Sign up new user\n   */\n  const signUp = async (input: SignUpInput) => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      store.setError(null);\n\n      const mutationResult = await signUpMutation({\n        variables: { input },\n      });\n\n      // With errorPolicy: 'all', errors are returned in result, not thrown\n      // Check for GraphQL errors first\n      const graphQLErrors = getGraphQLErrors(mutationResult);\n      if (graphQLErrors.length > 0) {\n        const errorMessage = graphQLErrors[0].message ?? \"Sign up failed\";\n        console.error(\"[SignUp] GraphQL error:\", errorMessage);\n        store.setError(errorMessage);\n        throw new Error(errorMessage);\n      }\n\n      // Check if data.signUp is null (indicates GraphQL error without explicit error)\n      if (!mutationResult.data || !mutationResult.data.signUp) {\n        const errorMessage = \"Sign up failed: No response from server\";\n        console.error(\"[SignUp] No data:\", errorMessage);\n        store.setError(errorMessage);\n        throw new Error(errorMessage);\n      }\n\n      const result = mutationResult.data.signUp;\n\n      // Check if user was created\n      if (!result.user) {\n        throw new Error(\"Sign up failed: No user data returned\");\n      }\n\n      // Check if email verification is required (empty tokens)\n      if (\n        !result.accessToken ||\n        !result.refreshToken ||\n        result.accessToken === \"\" ||\n        result.refreshToken === \"\"\n      ) {\n        // User created successfully but needs to verify email\n        // Don't set authenticated state, but store the user for display\n        store.setUser(result.user);\n        store.setAuthenticated(false);\n\n        // Return special result indicating email verification needed\n        return {\n          ...result,\n          requiresEmailVerification: true,\n        };\n      }\n\n      // Normal sign up with immediate access (tokens provided)\n      store.setUser(result.user);\n      store.setAuthTokens(result.accessToken, result.refreshToken);\n      store.setAuthenticated(true);\n\n      eventBus.emit(\n        \"auth.signed_up\",\n        {\n          userId: result.user.id,\n          tenantId: result.user.tenantId,\n          workspaceId: result.user.defaultWorkspaceId,\n          mfaEnabled: result.user.mfaEnabled,\n          emailVerified: result.user.emailVerified,\n        },\n        { component: \"useAuthOperations\" },\n      );\n\n      context.onAuthSuccess?.(\n        result.user,\n        result.accessToken,\n        result.refreshToken,\n      );\n\n      return result;\n    } catch (err: unknown) {\n      // Extract error message from Apollo error or regular error\n      let message = \"Sign up failed. Please try again.\";\n      let errorCode: string | undefined;\n\n      const graphQLErrors = getGraphQLErrors(err);\n      if (graphQLErrors.length > 0) {\n        const gqlError = graphQLErrors[0];\n        errorCode = getGraphQLErrorCode(gqlError) ?? undefined;\n        const rawMessage = gqlError.message ?? \"\";\n\n        // Map backend error codes to user-friendly messages\n        message = mapSignUpError(rawMessage, errorCode);\n      } else {\n        const rawMessage = getUnknownErrorMessage(err);\n        if (rawMessage) {\n          message = mapSignUpError(rawMessage);\n        }\n      }\n\n      store.setError(message, errorCode ?? null);\n      throw new Error(message);\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Sign out current session\n   */\n  const signOut = async () => {\n    const store = useAuthStore.getState();\n    const signedOutUser = store.user;\n\n    try {\n      await signOutMutation();\n    } catch (err) {\n      console.error(\"Sign out failed:\", err);\n    } finally {\n      // Always clear Apollo cache so stale user data doesn't survive re-login\n      await apolloClient.clearStore();\n      store.clearAuth();\n      eventBus.emit(\n        \"auth.signed_out\",\n        {\n          userId: signedOutUser?.id,\n          tenantId: signedOutUser?.tenantId,\n          workspaceId: signedOutUser?.defaultWorkspaceId,\n        },\n        { component: \"useAuthOperations\" },\n      );\n      context.onLogout?.();\n    }\n  };\n\n  /**\n   * Refresh access token\n   */\n  const refreshToken = async () => {\n    const store = useAuthStore.getState();\n\n    try {\n      const token = store.refreshToken;\n      if (!token) throw new Error(\"No refresh token available\");\n\n      const { data } = await refreshTokenMutation({\n        variables: { token },\n      });\n\n      const result = data!.refreshToken;\n\n      // Refresh token should always return valid tokens and user\n      if (!result.accessToken || !result.refreshToken || !result.user) {\n        throw new Error(\"Token refresh failed: Invalid response from server\");\n      }\n\n      store.setAuthTokens(result.accessToken, result.refreshToken);\n      store.setUser(result.user);\n\n      eventBus.emit(\n        \"auth.token_refreshed\",\n        {\n          userId: result.user.id,\n          tenantId: result.user.tenantId,\n          workspaceId: result.user.defaultWorkspaceId,\n          mfaEnabled: result.user.mfaEnabled,\n          emailVerified: result.user.emailVerified,\n        },\n        { component: \"useAuthOperations\" },\n      );\n\n      return result;\n    } catch (err) {\n      // Refresh failed, logout user\n      eventBus.emit(\n        \"auth.token_refresh_failed\",\n        {\n          userId: store.user?.id,\n          tenantId: store.user?.tenantId,\n          workspaceId: store.user?.defaultWorkspaceId,\n          reason: err instanceof Error ? err.message : \"Token refresh failed\",\n        },\n        { component: \"useAuthOperations\" },\n      );\n      store.clearAuth();\n      throw err;\n    }\n  };\n\n  /**\n   * Get current user.\n   * Skip when:\n   *  - Not authenticated\n   *  - Login just completed (user data is already fresh from signIn response)\n   *\n   * The loginJustCompletedRef is cleared after the first successful fetch\n   * or on the next render cycle after navigation.\n   */\n  const { data: currentUserData, refetch: refetchCurrentUser } =\n    useQuery<CurrentUserResponse>(CurrentUserDocument, {\n      skip:\n        disableCurrentUserQuery ||\n        !isAuthenticated ||\n        loginJustCompletedRef.current,\n      fetchPolicy: \"network-only\",\n    });\n\n  // Handle currentUser data updates (replaces onCompleted callback)\n  useEffect(() => {\n    if (currentUserData?.currentUser) {\n      useAuthStore.getState().setUser(currentUserData.currentUser);\n    }\n  }, [currentUserData]);\n\n  // Clear loginJustCompletedRef after navigation away from login page\n  // so subsequent CurrentUser queries work normally (e.g., profile page).\n  useEffect(() => {\n    if (loginJustCompletedRef.current && isAuthenticated) {\n      const timer = setTimeout(() => {\n        loginJustCompletedRef.current = false;\n      }, 2000);\n      return () => clearTimeout(timer);\n    }\n  }, [isAuthenticated]);\n\n  /**\n   * Verify email with token\n   * Returns { success, message, email } on success\n   */\n  const verifyEmail = async (\n    token: string,\n  ): Promise<{ success: boolean; message: string; email?: string }> => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      const { data } = await verifyEmailMutation({ variables: { token } });\n\n      if (data!.verifyEmail.success && store.user) {\n        store.setUser({ ...store.user, emailVerified: true });\n      }\n\n      return data!.verifyEmail;\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"Email verification failed\";\n      store.setError(message);\n      throw err;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Resend verification email\n   */\n  const resendVerification = async (email: string) => {\n    try {\n      const { data } = await resendVerificationMutation({\n        variables: { email },\n      });\n      return data!.resendVerificationEmail;\n    } catch (err) {\n      console.error(\"Failed to resend verification email:\", err);\n      throw err;\n    }\n  };\n\n  // Legacy aliases for backwards compatibility\n  const login = signIn;\n  const register = signUp;\n  const logout = signOut;\n\n  return {\n    // New API\n    signIn,\n    signUp,\n    signOut,\n    refreshToken,\n    verifyEmail,\n    resendVerification,\n    refetchCurrentUser,\n    // Legacy aliases\n    login,\n    register,\n    logout,\n    // State (reactive via selectors)\n    isLoading,\n    error,\n    errorCode,\n    isAuthenticated,\n    user,\n    accessToken,\n  };\n}\n"],"mappings":";;;;;;;;AAkCA,SAAS,EAAe,GAAoB,GAA4B;AAqCtE,QAlCE,EAAW,SAAS,mCAAmC,IACvD,MAAc,mBAEP,oGAGL,MAAc,2BACT,sHAKP,EAAW,SAAS,kBAAkB,IACtC,EAAW,SAAS,eAAe,IACnC,EAAW,SAAS,cAAc,GAE3B,qFAIL,EAAW,SAAS,OAAO,IAAI,EAAW,SAAS,eAAe,GAC7D,qEAIL,MAAc,0BACT,wEAIL,KAAc,MAAe,mBACxB,IAGF;;AAGT,SAAS,EAAkB,GAAsB;AAC/C,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAW,KAAK,UAAU;GAC9B,IAAI;GACJ,QAAQ,OAAO,SAAS;GACzB,CAAC;AAEF,EADA,SAAS,SAAS,UAAU,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW,kBACzG,SAAS,SAAS,kBAAkB,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW;SAC3G;;AAKV,SAAS,EAAc,GAAyB;AAC9C,QAAO,EAAE,GAAG,GAAM;;AAQpB,SAAS,EAAS,GAAkD;AAClE,QAAO,OAAO,KAAU,cAAY;;AAGtC,SAAS,EAAoB,GAAoC;AAE/D,QADK,MAAM,QAAQ,EAAM,GAClB,EAAM,QAAQ,MAAmC,EAAS,EAAK,CAAC,GADrC,EAAE;;AAItC,SAAS,EAAiB,GAAoC;AAC5D,KAAI,CAAC,EAAS,EAAM,CAAE,QAAO,EAAE;CAC/B,IAAM,IAAe,EAAoB,EAAM,OAAO;AAEtD,QADI,EAAa,SAAS,IAAU,IAC7B,EAAoB,EAAM,cAAc;;AAGjD,SAAS,EAAuB,GAAoC;AAElE,KADI,aAAiB,SACjB,EAAS,EAAM,IAAI,OAAO,EAAM,WAAY,SAC9C,QAAO,EAAM;;AAKjB,SAAS,EACP,GACe;CACf,IAAM,IAAO,GAAO,YAAY;AAChC,QAAO,OAAO,KAAS,WAAW,IAAO;;AAyE3C,SAAgB,EAAkB,IAAoC,EAAE,EAAE;CAExE,IAAM,IAAY,GAAc,MAAU,EAAM,UAAU,EACpD,IAAQ,GAAc,MAAU,EAAM,MAAM,EAC5C,IAAY,GAAc,MAAU,EAAM,UAAU,EACpD,IAAkB,GAAc,MAAU,EAAM,gBAAgB,EAChE,IAAO,GAAc,MAAU,EAAM,KAAK,EAC1C,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAA0B,EAAQ,2BAA2B,IAI7D,IAAwB,EAAO,GAAM,EAErC,IAAU,GAAS,EACnB,IAAW,GAAa,EACxB,IAAe,GAAiB,EAChC,CAAC,KAAkB,EACvB,EACD,EACK,CAAC,KAAkB,EACvB,EACD,EACK,CAAC,KAAmB,EAA6B,EAAgB,EACjE,CAAC,KAAwB,EAG7B,EAAqB,EACjB,CAAC,KAAuB,EAG5B,EAAoB,EAChB,CAAC,KAA8B,EAGnC,EAAgC,EAM5B,IAAS,OAAO,MAA4C;EAChE,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;AAEF,GADA,EAAM,WAAW,GAAK,EACtB,EAAM,SAAS,KAAK;GAMpB,IAAM,IAAS,MAAM,EAAe;IAClC,WAAW,EAAE,UAAO;IAGpB,aAAa;IACd,CAAC;AAIF,OAAI,CAAC,EAAO,QAAQ,CAAC,EAAO,KAAK,QAAQ;IACvC,IAAM,IACJ;AAEF,WADA,EAAM,SAAS,EAAa,EACrB;KACL,SAAS;KACT,OAAO;KACR;;GAKH,IAAM,IAFO,EAAO,KAEI;AAGxB,OAAI,EAAW,eAAe,EAAW,eAIvC,QAHA,EAAM,eAAe,IAAM,EAAW,eAAe,EAG9C;IACL,SAAS;IACT,aAAa;IACb,gBAAgB,EAAW;IAC3B,UAAU,EACR,WAAW,EAAW,WACvB;IACF;AAIH,OACE,EAAW,QACX,EAAW,eACX,EAAW,cACX;AAMA,IAJA,EAAsB,UAAU,IAChC,EAAM,QAAQ,EAAW,KAAK,EAC9B,EAAM,cAAc,EAAW,aAAa,EAAW,aAAa,EACpE,EAAM,iBAAiB,GAAK,EAC5B,EAAM,eAAe,GAAM;IAE3B,IAAM,IAAY,EAAW,YACzB,KAAK,KAAK,GAAG,EAAW,YAAY,MACpC,KAAA;AA2BJ,WA1BA,EAAa,EAAc,EAAW,KAAK,EAAE;KAC3C,aAAa,EAAW;KACxB,cAAc,EAAW;KACzB;KACD,CAAC,EACF,EAAkB,EAAW,KAAK,GAAG,EAErC,EAAS,KACP,kBACA;KACE,QAAQ,EAAW,KAAK;KACxB,UAAU,EAAW,KAAK;KAC1B,aAAa,EAAW,KAAK;KAC7B,YAAY,EAAW,KAAK;KAC5B,eAAe,EAAW,KAAK;KAChC,EACD,EAAE,WAAW,qBAAqB,CACnC,EAED,EAAQ,gBACN,EAAW,MACX,EAAW,aACX,EAAW,aACZ,EAGM;KACL,SAAS;KACT,MAAM,EAAW;KACjB,OAAO,EAAW;KAClB,cAAc,EAAW;KACzB,WAAW,EAAW;KACtB,aAAa;KACd;UACI;IACL,IAAM,IAAW;AAEjB,WADA,EAAM,SAAS,EAAS,EACjB;KACL,SAAS;KACT,OAAO;KACR;;WAEI,GAAc;GAQrB,IAAI,IAAU,kBACV,IAA2B,MACzB,IAAgB,EAAiB,EAAI;AAC3C,OAAI,EAAc,SAAS,GAAG;IAG5B,IAAM,IAAW,EAAc;AAE/B,IADA,IAAU,EAAS,WAAW,GAC9B,IAAY,EAAoB,EAAS;SAEzC,KAAU,EAAuB,EAAI,IAAI;AAS3C,UANA,QAAQ,MACN,mBACA,GACA,IAAY,IAAI,EAAU,KAAK,GAChC,EACD,EAAM,SAAS,GAAS,EAAU,EAC3B;IACL,SAAS;IACT,OAAO;IACR;YACO;AACR,KAAM,WAAW,GAAM;;IAOrB,IAAS,OAAO,MAAuB;EAC3C,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;AAEF,GADA,EAAM,WAAW,GAAK,EACtB,EAAM,SAAS,KAAK;GAEpB,IAAM,IAAiB,MAAM,EAAe,EAC1C,WAAW,EAAE,UAAO,EACrB,CAAC,EAII,IAAgB,EAAiB,EAAe;AACtD,OAAI,EAAc,SAAS,GAAG;IAC5B,IAAM,IAAe,EAAc,GAAG,WAAW;AAGjD,UAFA,QAAQ,MAAM,2BAA2B,EAAa,EACtD,EAAM,SAAS,EAAa,EAClB,MAAM,EAAa;;AAI/B,OAAI,CAAC,EAAe,QAAQ,CAAC,EAAe,KAAK,QAAQ;IACvD,IAAM,IAAe;AAGrB,UAFA,QAAQ,MAAM,qBAAqB,EAAa,EAChD,EAAM,SAAS,EAAa,EAClB,MAAM,EAAa;;GAG/B,IAAM,IAAS,EAAe,KAAK;AAGnC,OAAI,CAAC,EAAO,KACV,OAAU,MAAM,wCAAwC;AA6C1D,UAxCE,CAAC,EAAO,eACR,CAAC,EAAO,gBACR,EAAO,gBAAgB,MACvB,EAAO,iBAAiB,MAIxB,EAAM,QAAQ,EAAO,KAAK,EAC1B,EAAM,iBAAiB,GAAM,EAGtB;IACL,GAAG;IACH,2BAA2B;IAC5B,KAIH,EAAM,QAAQ,EAAO,KAAK,EAC1B,EAAM,cAAc,EAAO,aAAa,EAAO,aAAa,EAC5D,EAAM,iBAAiB,GAAK,EAE5B,EAAS,KACP,kBACA;IACE,QAAQ,EAAO,KAAK;IACpB,UAAU,EAAO,KAAK;IACtB,aAAa,EAAO,KAAK;IACzB,YAAY,EAAO,KAAK;IACxB,eAAe,EAAO,KAAK;IAC5B,EACD,EAAE,WAAW,qBAAqB,CACnC,EAED,EAAQ,gBACN,EAAO,MACP,EAAO,aACP,EAAO,aACR,EAEM;WACA,GAAc;GAErB,IAAI,IAAU,qCACV,GAEE,IAAgB,EAAiB,EAAI;AAC3C,OAAI,EAAc,SAAS,GAAG;IAC5B,IAAM,IAAW,EAAc;AAK/B,IAJA,IAAY,EAAoB,EAAS,IAAI,KAAA,GAI7C,IAAU,EAHS,EAAS,WAAW,IAGF,EAAU;UAC1C;IACL,IAAM,IAAa,EAAuB,EAAI;AAC9C,IAAI,MACF,IAAU,EAAe,EAAW;;AAKxC,SADA,EAAM,SAAS,GAAS,KAAa,KAAK,EAChC,MAAM,EAAQ;YAChB;AACR,KAAM,WAAW,GAAM;;IAOrB,IAAU,YAAY;EAC1B,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAgB,EAAM;AAE5B,MAAI;AACF,SAAM,GAAiB;WAChB,GAAK;AACZ,WAAQ,MAAM,oBAAoB,EAAI;YAC9B;AAaR,GAXA,MAAM,EAAa,YAAY,EAC/B,EAAM,WAAW,EACjB,EAAS,KACP,mBACA;IACE,QAAQ,GAAe;IACvB,UAAU,GAAe;IACzB,aAAa,GAAe;IAC7B,EACD,EAAE,WAAW,qBAAqB,CACnC,EACD,EAAQ,YAAY;;IAOlB,IAAe,YAAY;EAC/B,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;GACF,IAAM,IAAQ,EAAM;AACpB,OAAI,CAAC,EAAO,OAAU,MAAM,6BAA6B;GAEzD,IAAM,EAAE,YAAS,MAAM,EAAqB,EAC1C,WAAW,EAAE,UAAO,EACrB,CAAC,EAEI,IAAS,EAAM;AAGrB,OAAI,CAAC,EAAO,eAAe,CAAC,EAAO,gBAAgB,CAAC,EAAO,KACzD,OAAU,MAAM,qDAAqD;AAkBvE,UAfA,EAAM,cAAc,EAAO,aAAa,EAAO,aAAa,EAC5D,EAAM,QAAQ,EAAO,KAAK,EAE1B,EAAS,KACP,wBACA;IACE,QAAQ,EAAO,KAAK;IACpB,UAAU,EAAO,KAAK;IACtB,aAAa,EAAO,KAAK;IACzB,YAAY,EAAO,KAAK;IACxB,eAAe,EAAO,KAAK;IAC5B,EACD,EAAE,WAAW,qBAAqB,CACnC,EAEM;WACA,GAAK;AAaZ,SAXA,EAAS,KACP,6BACA;IACE,QAAQ,EAAM,MAAM;IACpB,UAAU,EAAM,MAAM;IACtB,aAAa,EAAM,MAAM;IACzB,QAAQ,aAAe,QAAQ,EAAI,UAAU;IAC9C,EACD,EAAE,WAAW,qBAAqB,CACnC,EACD,EAAM,WAAW,EACX;;IAaJ,EAAE,MAAM,GAAiB,SAAS,MACtC,EAA8B,GAAqB;EACjD,MACE,KACA,CAAC,KACD,EAAsB;EACxB,aAAa;EACd,CAAC;AAoEJ,QAjEA,QAAgB;AACd,EAAI,GAAiB,eACnB,EAAa,UAAU,CAAC,QAAQ,EAAgB,YAAY;IAE7D,CAAC,EAAgB,CAAC,EAIrB,QAAgB;AACd,MAAI,EAAsB,WAAW,GAAiB;GACpD,IAAM,IAAQ,iBAAiB;AAC7B,MAAsB,UAAU;MAC/B,IAAK;AACR,gBAAa,aAAa,EAAM;;IAEjC,CAAC,EAAgB,CAAC,EAkDd;EAEL;EACA;EACA;EACA;EACA,aAlDkB,OAClB,MACmE;GACnE,IAAM,IAAQ,EAAa,UAAU;AAErC,OAAI;AACF,MAAM,WAAW,GAAK;IACtB,IAAM,EAAE,YAAS,MAAM,EAAoB,EAAE,WAAW,EAAE,UAAO,EAAE,CAAC;AAMpE,WAJI,EAAM,YAAY,WAAW,EAAM,QACrC,EAAM,QAAQ;KAAE,GAAG,EAAM;KAAM,eAAe;KAAM,CAAC,EAGhD,EAAM;YACN,GAAK;IACZ,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAEvC,UADA,EAAM,SAAS,EAAQ,EACjB;aACE;AACR,MAAM,WAAW,GAAM;;;EA+BzB,oBAxByB,OAAO,MAAkB;AAClD,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAA2B,EAChD,WAAW,EAAE,UAAO,EACrB,CAAC;AACF,WAAO,EAAM;YACN,GAAK;AAEZ,UADA,QAAQ,MAAM,wCAAwC,EAAI,EACpD;;;EAiBR;EAEA,OAdY;EAeZ,UAde;EAef,QAda;EAgBb;EACA;EACA;EACA;EACA;EACA;EACD"}