@ccatto/react-auth 1.2.0 → 1.3.0

package/dist/index.cjs

@@ -3,6 +3,47 @@
 
 var preferences = require('@capacitor/preferences');
 
+// src/client/native-social-signin.ts
+async function startNativeSocialSignIn(config) {
+  let Capacitor;
+  try {
+    ({ Capacitor } = await import('@capacitor/core'));
+  } catch {
+    return { error: "not_native" };
+  }
+  if (!Capacitor.isNativePlatform()) {
+    return { error: "not_native" };
+  }
+  if (!Capacitor.isPluginAvailable("InAppAuth")) {
+    return { error: "plugin_unavailable" };
+  }
+  const base = config.baseURL.replace(/\/$/, "");
+  const startPath = config.startPath ?? "/api/mobile-social-start";
+  const startUrl = `${base}${startPath}?provider=${encodeURIComponent(
+    config.provider
+  )}`;
+  const pluginSpecifier = "@ccatto/capacitor-inapp-auth";
+  try {
+    const { InAppAuth } = await import(pluginSpecifier);
+    const { url } = await InAppAuth.start({
+      url: startUrl,
+      callbackScheme: config.callbackScheme
+    });
+    const params = new URLSearchParams(url.split("?")[1] ?? "");
+    const code = params.get("code");
+    if (params.get("error") || !code) {
+      return { error: "failed" };
+    }
+    return { code };
+  } catch (err) {
+    const message = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+    if (message === "CANCELED") {
+      return { error: "canceled" };
+    }
+    return { error: "failed" };
+  }
+}
+
 // src/client/session-store.ts
 var currentSession = null;
 var listeners = /* @__PURE__ */ new Set();
@@ -63,6 +104,27 @@ var _JwtAuthService = class _JwtAuthService {
       throw error;
     }
   }
+  /**
+   * Exchange a one-time mobile-OAuth handoff code for app JWTs and store them.
+   * Used by the native deep-link / in-app-browser social sign-in flow after
+   * {@link startNativeSocialSignIn} returns a `code`. Requires the app's
+   * `IAuthApiService` to implement `exchangeAuthCode`.
+   */
+  async loginWithExchangeCode(code) {
+    if (!this.api.exchangeAuthCode) {
+      throw new Error("Exchange-code auth not configured");
+    }
+    try {
+      const data = await this.api.exchangeAuthCode(code);
+      await this.storage.setAccessToken(data.accessToken);
+      await this.storage.setRefreshToken(data.refreshToken);
+      this.log.info("Auth code exchange successful", { userId: data.user.id });
+      return data;
+    } catch (error) {
+      this.log.error("Auth code exchange failed", { error });
+      throw error;
+    }
+  }
   /** Register new user */
   async register(data) {
     try {
@@ -321,5 +383,6 @@ var CapacitorAuthStorage = class {
 exports.CapacitorAuthStorage = CapacitorAuthStorage;
 exports.JwtAuthService = JwtAuthService;
 exports.sessionStore = sessionStore;
+exports.startNativeSocialSignIn = startNativeSocialSignIn;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client/session-store.ts","../src/services/jwt-auth.service.ts","../src/storage/capacitor-auth-storage.ts"],"names":["Preferences"],"mappings":";;;;;AAgBA,IAAI,cAAA,GAAuC,IAAA;AAC3C,IAAM,SAAA,uBAA8D,GAAA,EAAI;AAEjE,IAAM,YAAA,GAAe;AAAA;AAAA,EAE1B,UAAA,GAAmC;AACjC,IAAA,OAAO,iBAAiB,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,cAAA,EAAgB,CAAA,GAAI,IAAA;AAAA,EACjE,CAAA;AAAA;AAAA,EAGA,WAAW,OAAA,EAAqC;AAC9C,IAAA,cAAA,GAAiB,OAAA;AACjB,IAAA,MAAM,QAAA,GAAW,CAAC,GAAG,SAAS,CAAA;AAC9B,IAAA,QAAA,CAAS,OAAA,CAAQ,CAAC,QAAA,KAAa,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,EAClD,CAAA;AAAA;AAAA,EAGA,UAAU,QAAA,EAA+D;AACvE,IAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,IAAA,OAAO,MAAM,SAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,EACxC,CAAA;AAAA;AAAA,EAGA,SAAA,GAA2B;AACzB,IAAA,OAAO,cAAA,EAAgB,MAAM,EAAA,IAAM,IAAA;AAAA,EACrC;AACF;;;ACJA,IAAM,UAAA,GAA0B;AAAA,EAC9B,MAAM,MAAM;AAAA,EAAC,CAAA;AAAA,EACb,MAAM,MAAM;AAAA,EAAC,CAAA;AAAA,EACb,OAAO,MAAM;AAAA,EAAC;AAChB,CAAA;AAOO,IAAM,eAAA,GAAN,MAAM,eAAA,CAAe;AAAA;AAAA,EAY1B,WAAA,CACU,OAAA,EACA,GAAA,EACR,MAAA,EACA,OAAA,EACA;AAJQ,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AATV;AAAA,IAAA,IAAA,CAAQ,cAAA,GAAwD,IAAA;AAGhE;AAAA,IAAA,IAAA,CAAQ,cAAA,GAAyC,IAAA;AACjD,IAAA,IAAA,CAAQ,kBAAA,GAA6B,CAAA;AASnC,IAAA,IAAA,CAAK,MAAM,MAAA,IAAU,UAAA;AACrB,IAAA,IAAA,CAAK,OAAA,GAAU,WAAW,EAAC;AAAA,EAC7B;AAAA;AAAA,EAGA,MAAM,MAAM,WAAA,EAAuD;AACjE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,MAAM,WAAW,CAAA;AAC7C,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,IAAA,CAAK,WAAW,CAAA;AAClD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,IAAA,CAAK,YAAY,CAAA;AACpD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,6BAAA,EAA+B,EAAE,QAAQ,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AACrE,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,cAAA,EAAgB,EAAE,OAAO,CAAA;AACxC,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAA4C;AACzD,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,SAAS,IAAI,CAAA;AAC3C,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,MAAA,CAAO,YAAY,CAAA;AACtD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,8BAAA,EAAgC,EAAE,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,qBAAA,EAAuB,EAAE,OAAO,CAAA;AAC/C,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,MAAA,GAAwB;AAC5B,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAgB;AACxD,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,MAAM,KAAK,GAAA,CAAI,MAAA,CAAO,YAAY,CAAA,CAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MACpD;AAAA,IACF,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,CAAK,QAAQ,WAAA,EAAY;AAC/B,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,iBAAiB,CAAA;AAAA,IACjC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,kBAAA,GAAsC;AAC1C,IAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAgB;AACxD,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,IAC9C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,aAAa,YAAY,CAAA;AACvD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IAChB,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAA,CAAK,QAAQ,WAAA,EAAY;AAC/B,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,sBAAA,EAAwB,EAAE,OAAO,CAAA;AAChD,MAAA,IAAA,CAAK,QAAQ,gBAAA,IAAmB;AAChC,MAAA,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAAA,IACnC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,GAAyC;AAC7C,IAAA,OAAO,IAAA,CAAK,QAAQ,cAAA,EAAe;AAAA,EACrC;AAAA;AAAA,EAGQ,wBAAA,CACN,KAAA,EACA,aAAA,GAAgB,GAAA,EACP;AACT,IAAA,IAAI;AACF,MAAA,IAAI,GAAA;AAGJ,MAAA,IAAI,IAAA,CAAK,cAAA,EAAgB,KAAA,KAAU,KAAA,EAAO;AACxC,QAAA,GAAA,GAAM,KAAK,cAAA,CAAe,GAAA;AAAA,MAC5B,CAAA,MAAO;AACL,QAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AACpC,QAAA,MAAM,MAAA,GAAS,UAAU,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA;AACvC,QAAA,GAAA,GAAM,OAAA,CAAQ,GAAA;AACd,QAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,QAAA,IAAA,CAAK,cAAA,GAAiB,EAAE,KAAA,EAAO,GAAA,EAAI;AAAA,MACrC;AAEA,MAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC/C,MAAA,OAAO,cAAc,GAAA,GAAM,aAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAAA,GAAkD;AACtD,IAAA,IAAI,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA,EAAe;AACtC,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAC;AAEpB,IAAA,IAAI,IAAA,CAAK,wBAAA,CAAyB,KAAK,CAAA,EAAG;AAExC,MAAA,MAAM,gBAAA,GAAmB,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,kBAAA;AAC3C,MAAA,IACE,IAAA,CAAK,kBAAA,GAAqB,CAAA,IAC1B,gBAAA,GAAmB,gBAAe,mBAAA,EAClC;AACA,QAAA,OAAO,EAAC;AAAA,MACV;AAEA,MAAA,IAAI;AACF,QAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AACxB,UAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,kBAAA,EAAmB,CAAE,QAAQ,MAAM;AAC5D,YAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,UACxB,CAAC,CAAA;AAAA,QACH;AACA,QAAA,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA;AACnB,QAAA,IAAA,CAAK,kBAAA,GAAqB,CAAA;AAAA,MAC5B,CAAA,CAAA,MAAQ;AACN,QAAA,IAAA,CAAK,kBAAA,GAAqB,KAAK,GAAA,EAAI;AACnC,QAAA,OAAO,EAAC;AAAA,MACV;AAAA,IACF;AAEA,IAAA,OAAO,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAAA,EAC5C;AAAA;AAAA,EAGA,MAAM,eAAA,GAAoC;AACxC,IAAA,OAAO,IAAA,CAAK,QAAQ,SAAA,EAAU;AAAA,EAChC;AAAA;AAAA,EAGA,MAAM,SAAA,GAA8B;AAClC,IAAA,OAAO,IAAA,CAAK,QAAQ,SAAA,EAAU;AAAA,EAChC;AAAA;AAAA,EAGA,YAAY,KAAA,EAAgC;AAC1C,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AACpC,MAAA,MAAM,MAAA,GAAS,UAAU,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,MAAA,MAAM,WAAA,GAAc,kBAAA;AAAA,QAClB,IAAA,CAAK,MAAM,CAAA,CACR,KAAA,CAAM,EAAE,CAAA,CACR,GAAA,CAAI,CAAC,CAAA,KAAM,GAAA,GAAA,CAAO,IAAA,GAAO,EAAE,UAAA,CAAW,CAAC,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,EAAG,MAAM,CAAA,CAAE,CAAC,CAAA,CAChE,IAAA,CAAK,EAAE;AAAA,OACZ;AACA,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,WAAW,CAAA;AACtC,MAAA,OAAO;AAAA,QACL,IAAI,OAAA,CAAQ,GAAA;AAAA,QACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,QACf,IAAA,EAAM,QAAQ,IAAA,IAAQ,IAAA;AAAA,QACtB,IAAA,EAAM,QAAQ,IAAA,IAAQ,MAAA;AAAA,QACtB,UAAU,OAAA,CAAQ,QAAA;AAAA,QAClB,gBAAgB,OAAA,CAAQ;AAAA,OAC1B;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,GAA2C;AAC/C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA,EAAe;AACxC,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,IAAA,OAAO,IAAA,CAAK,YAAY,KAAK,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAM,gBAAA,GAA2C;AAC/C,IAAA,IACE,CAAC,IAAA,CAAK,GAAA,CAAI,wCACV,CAAC,IAAA,CAAK,IAAI,2BAAA,EACV;AACA,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD;AAEA,IAAA,MAAM,EAAE,mBAAA,EAAqB,uBAAA,EAAwB,GACnD,MAAM,OAAO,yBAAyB,CAAA;AAExC,IAAA,IAAI,CAAC,yBAAwB,EAAG;AAC9B,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,OAAA,EAAS,SAAA,KACf,MAAM,IAAA,CAAK,IAAI,oCAAA,EAAqC;AAEtD,MAAA,MAAM,YAAA,GAAe,MAAM,mBAAA,CAAoB;AAAA,QAC7C,WAAA,EAAa,IAAA,CAAK,KAAA,CAAM,OAAO;AAAA,OAChC,CAAA;AAED,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,2BAAA;AAAA,QAC5B,SAAA;AAAA,QACA,IAAA,CAAK,UAAU,YAAY;AAAA,OAC7B;AAEA,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,MAAA,CAAO,YAAY,CAAA;AAEtD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,yBAAA,EAA2B,EAAE,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACnE,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,iBAAA,EAAmB;AAC9D,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,qBAAA,EAAuB,EAAE,OAAO,CAAA;AAC/C,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,aACJ,WAAA,EACmE;AACnE,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,YAAA,EAAc;AAC1B,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,aAAa,WAAW,CAAA;AACtD,MAAA,IAAI,OAAO,OAAA,EAAS;AAClB,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,UAAA,EAAY,EAAE,aAAa,WAAA,CAAY,KAAA,CAAM,CAAA,CAAE,CAAA,EAAG,CAAA;AAAA,MAClE,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,iBAAA,EAAmB;AAAA,UAC/B,WAAA,EAAa,WAAA,CAAY,KAAA,CAAM,CAAA,CAAE,CAAA;AAAA,UACjC,SAAS,MAAA,CAAO;AAAA,SACjB,CAAA;AAAA,MACH;AACA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,oBAAA,EAAsB,EAAE,OAAO,CAAA;AAC9C,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,CACJ,WAAA,EACA,IAAA,EACiD;AACjD,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,cAAA,EAAgB;AAC5B,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,MAAM,IAAA,CAAK,GAAA,CAAI,cAAA,CAAe,aAAa,IAAI,CAAA;AAE9D,MAAA,IAAI,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,WAAA,IAAe,CAAC,OAAO,YAAA,EAAc;AAClE,QAAA,MAAM,IAAI,KAAA,CAAM,MAAA,CAAO,OAAA,IAAW,qBAAqB,CAAA;AAAA,MACzD;AAEA,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,MAAA,CAAO,YAAY,CAAA;AAEtD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,WAAW,CAAA;AAChD,MAAA,IAAI,CAAC,IAAA,EAAM;AACT,QAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,MAC/C;AAEA,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,uBAAA,EAAyB;AAAA,QACrC,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,WAAW,MAAA,CAAO;AAAA,OACnB,CAAA;AAED,MAAA,OAAO;AAAA,QACL,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,cAAc,MAAA,CAAO,YAAA;AAAA,QACrB,IAAA;AAAA,QACA,SAAA,EAAW,OAAO,SAAA,IAAa;AAAA,OACjC;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,+BAAA,EAAiC,EAAE,OAAO,CAAA;AACzD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AACF,CAAA;AA9Sa,eAAA,CAUI,mBAAA,GAAsB,GAAA;AAVhC,IAAM,cAAA,GAAN;AC/BA,IAAM,uBAAN,MAAmD;AAAA,EAIxD,YAAY,OAAA,EAAuC;AACjD,IAAA,MAAM,MAAA,GAAS,SAAS,SAAA,IAAa,YAAA;AACrC,IAAA,IAAA,CAAK,gBAAA,GAAmB,GAAG,MAAM,CAAA,aAAA,CAAA;AACjC,IAAA,IAAA,CAAK,iBAAA,GAAoB,GAAG,MAAM,CAAA,cAAA,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,eAAe,KAAA,EAA8B;AACjD,IAAA,MAAMA,wBAAY,GAAA,CAAI;AAAA,MACpB,KAAK,IAAA,CAAK,gBAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,cAAA,GAAyC;AAC7C,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAMA,uBAAA,CAAY,IAAI,EAAE,GAAA,EAAK,IAAA,CAAK,gBAAA,EAAkB,CAAA;AACtE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,KAAA,EAA8B;AAClD,IAAA,MAAMA,wBAAY,GAAA,CAAI;AAAA,MACpB,KAAK,IAAA,CAAK,iBAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,eAAA,GAA0C;AAC9C,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAMA,uBAAA,CAAY,IAAI,EAAE,GAAA,EAAK,IAAA,CAAK,iBAAA,EAAmB,CAAA;AACvE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,WAAA,GAA6B;AACjC,IAAA,MAAM,QAAQ,GAAA,CAAI;AAAA,MAChBA,wBAAY,MAAA,CAAO,EAAE,GAAA,EAAK,IAAA,CAAK,kBAAkB,CAAA;AAAA,MACjDA,wBAAY,MAAA,CAAO,EAAE,GAAA,EAAK,IAAA,CAAK,mBAAmB;AAAA,KACnD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,SAAA,GAA8B;AAClC,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,cAAA,EAAe;AAC9C,IAAA,OAAO,WAAA,KAAgB,IAAA;AAAA,EACzB;AACF","file":"index.cjs","sourcesContent":["/**\n * @ccatto/react-auth - Session Store\n *\n * Synchronous session state store for sharing auth session with Apollo Client.\n * Avoids network calls in Apollo's authLink.\n *\n * @example\n * // Write (from SessionSync component in React tree)\n * sessionStore.setSession(session);\n *\n * // Read (from Apollo authLink — synchronous, no network call)\n * const session = sessionStore.getSession();\n */\n\nimport type { CompatSession } from '../types/session';\n\nlet currentSession: CompatSession | null = null;\nconst listeners: Set<(session: CompatSession | null) => void> = new Set();\n\nexport const sessionStore = {\n  /** Get the current session (synchronous, no network call) */\n  getSession(): CompatSession | null {\n    return currentSession ? Object.freeze({ ...currentSession }) : null;\n  },\n\n  /** Update the session (called by SessionSync component) */\n  setSession(session: CompatSession | null): void {\n    currentSession = session;\n    const snapshot = [...listeners];\n    snapshot.forEach((listener) => listener(session));\n  },\n\n  /** Subscribe to session changes */\n  subscribe(listener: (session: CompatSession | null) => void): () => void {\n    listeners.add(listener);\n    return () => listeners.delete(listener);\n  },\n\n  /** Get the user ID from the current session (convenience method) */\n  getUserId(): string | null {\n    return currentSession?.user?.id ?? null;\n  },\n};\n","/**\n * @ccatto/react-auth - JWT Auth Service\n *\n * Platform-agnostic JWT authentication service.\n * Handles token storage, login, register, refresh, and passkey auth.\n *\n * Uses IAuthStorage for token persistence and IAuthApiService for API calls.\n *\n * @example\n * ```typescript\n * import { JwtAuthService, CapacitorAuthStorage } from '@ccatto/react-auth';\n *\n * const storage = new CapacitorAuthStorage({ keyPrefix: 'myapp' });\n * const authService = new JwtAuthService(storage, myApiService, undefined, {\n *   onSessionExpired: () => router.push('/login'),\n * });\n * await authService.login({ email, password });\n * ```\n */\nimport type { IAuthStorage } from '../storage/auth-storage.interface';\nimport type {\n  AuthUser,\n  IAuthApiService,\n  IAuthLogger,\n  LoginCredentials,\n  LoginResponse,\n  RegisterData,\n} from './auth-api.interface';\n\n// Re-export types for convenience\nexport type {\n  AuthUser,\n  LoginCredentials,\n  RegisterData,\n  LoginResponse,\n  AuthTokens,\n} from './auth-api.interface';\n\nconst noopLogger: IAuthLogger = {\n  info: () => {},\n  warn: () => {},\n  error: () => {},\n};\n\nexport interface JwtAuthServiceOptions {\n  /** Called when session expires (refresh token fails). Use to redirect to login. */\n  onSessionExpired?: () => void;\n}\n\nexport class JwtAuthService {\n  private log: IAuthLogger;\n  private options: JwtAuthServiceOptions;\n\n  // Fix 7: Cache token expiry to avoid re-parsing JWT on every getAuthHeaders()\n  private cachedTokenExp: { token: string; exp: number } | null = null;\n\n  // Fix 5: Refresh deduplication + cooldown after failure\n  private refreshPromise: Promise<string> | null = null;\n  private lastRefreshFailure: number = 0;\n  private static REFRESH_COOLDOWN_MS = 5000; // 5 second cooldown after failure\n\n  constructor(\n    private storage: IAuthStorage,\n    private api: IAuthApiService,\n    logger?: IAuthLogger,\n    options?: JwtAuthServiceOptions,\n  ) {\n    this.log = logger || noopLogger;\n    this.options = options || {};\n  }\n\n  /** Login with email and password */\n  async login(credentials: LoginCredentials): Promise<LoginResponse> {\n    try {\n      const data = await this.api.login(credentials);\n      await this.storage.setAccessToken(data.accessToken);\n      await this.storage.setRefreshToken(data.refreshToken);\n      this.log.info('User logged in successfully', { userId: data.user.id });\n      return data;\n    } catch (error) {\n      this.log.error('Login failed', { error });\n      throw error;\n    }\n  }\n\n  /** Register new user */\n  async register(data: RegisterData): Promise<LoginResponse> {\n    try {\n      const result = await this.api.register(data);\n      await this.storage.setAccessToken(result.accessToken);\n      await this.storage.setRefreshToken(result.refreshToken);\n      this.log.info('User registered successfully', { userId: result.user.id });\n      return result;\n    } catch (error) {\n      this.log.error('Registration failed', { error });\n      throw error;\n    }\n  }\n\n  /** Logout (clear tokens) */\n  async logout(): Promise<void> {\n    try {\n      const refreshToken = await this.storage.getRefreshToken();\n      if (refreshToken) {\n        await this.api.logout(refreshToken).catch(() => {});\n      }\n    } finally {\n      await this.storage.clearTokens();\n      this.cachedTokenExp = null;\n      this.log.info('User logged out');\n    }\n  }\n\n  /** Refresh access token */\n  async refreshAccessToken(): Promise<string> {\n    const refreshToken = await this.storage.getRefreshToken();\n    if (!refreshToken) {\n      throw new Error('No refresh token available');\n    }\n\n    try {\n      const result = await this.api.refreshToken(refreshToken);\n      await this.storage.setAccessToken(result.accessToken);\n      return result.accessToken;\n    } catch (error) {\n      await this.storage.clearTokens();\n      this.cachedTokenExp = null;\n      this.log.error('Token refresh failed', { error });\n      this.options.onSessionExpired?.();\n      throw new Error('Session expired');\n    }\n  }\n\n  /** Get current access token */\n  async getAccessToken(): Promise<string | null> {\n    return this.storage.getAccessToken();\n  }\n\n  /** Check if a JWT token is expired or about to expire */\n  private isTokenExpiredOrExpiring(\n    token: string,\n    bufferSeconds = 120,\n  ): boolean {\n    try {\n      let exp: number;\n\n      // Fix 7: Use cached expiry if token hasn't changed\n      if (this.cachedTokenExp?.token === token) {\n        exp = this.cachedTokenExp.exp;\n      } else {\n        const base64Url = token.split('.')[1];\n        const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');\n        const payload = JSON.parse(atob(base64));\n        exp = payload.exp;\n        if (!exp) return true;\n        this.cachedTokenExp = { token, exp };\n      }\n\n      const nowSeconds = Math.floor(Date.now() / 1000);\n      return nowSeconds >= exp - bufferSeconds;\n    } catch {\n      return true;\n    }\n  }\n\n  /**\n   * Get auth headers for API requests.\n   * Proactively refreshes the access token if it's expired or about to expire.\n   * Includes cooldown to prevent repeated refresh attempts after failure.\n   */\n  async getAuthHeaders(): Promise<Record<string, string>> {\n    let token = await this.getAccessToken();\n    if (!token) return {};\n\n    if (this.isTokenExpiredOrExpiring(token)) {\n      // Fix 5: Skip refresh if we recently failed (cooldown)\n      const timeSinceFailure = Date.now() - this.lastRefreshFailure;\n      if (\n        this.lastRefreshFailure > 0 &&\n        timeSinceFailure < JwtAuthService.REFRESH_COOLDOWN_MS\n      ) {\n        return {};\n      }\n\n      try {\n        if (!this.refreshPromise) {\n          this.refreshPromise = this.refreshAccessToken().finally(() => {\n            this.refreshPromise = null;\n          });\n        }\n        token = await this.refreshPromise;\n        this.lastRefreshFailure = 0;\n      } catch {\n        this.lastRefreshFailure = Date.now();\n        return {};\n      }\n    }\n\n    return { Authorization: `Bearer ${token}` };\n  }\n\n  /** Check if user is authenticated */\n  async isAuthenticated(): Promise<boolean> {\n    return this.storage.hasTokens();\n  }\n\n  /** Check if tokens exist in storage */\n  async hasTokens(): Promise<boolean> {\n    return this.storage.hasTokens();\n  }\n\n  /** Decode JWT token (client-side only — for user info, NOT for security) */\n  decodeToken(token: string): AuthUser | null {\n    try {\n      const base64Url = token.split('.')[1];\n      const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');\n      const jsonPayload = decodeURIComponent(\n        atob(base64)\n          .split('')\n          .map((c) => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))\n          .join(''),\n      );\n      const payload = JSON.parse(jsonPayload);\n      return {\n        id: payload.sub,\n        email: payload.email,\n        name: payload.name || null,\n        role: payload.role || 'user',\n        playerID: payload.playerID,\n        organizationId: payload.organizationId,\n      };\n    } catch {\n      return null;\n    }\n  }\n\n  /** Get current user from token (client-side decode) */\n  async getCurrentUser(): Promise<AuthUser | null> {\n    const token = await this.getAccessToken();\n    if (!token) return null;\n    return this.decodeToken(token);\n  }\n\n  /** Login with passkey (WebAuthn/FIDO2) */\n  async loginWithPasskey(): Promise<LoginResponse> {\n    if (\n      !this.api.generatePasskeyAuthenticationOptions ||\n      !this.api.verifyPasskeyAuthentication\n    ) {\n      throw new Error('Passkey authentication not configured');\n    }\n\n    const { startAuthentication, browserSupportsWebAuthn } =\n      await import('@simplewebauthn/browser');\n\n    if (!browserSupportsWebAuthn()) {\n      throw new Error('WebAuthn is not supported on this device');\n    }\n\n    try {\n      const { options, sessionId } =\n        await this.api.generatePasskeyAuthenticationOptions();\n\n      const authResponse = await startAuthentication({\n        optionsJSON: JSON.parse(options),\n      });\n\n      const result = await this.api.verifyPasskeyAuthentication(\n        sessionId,\n        JSON.stringify(authResponse),\n      );\n\n      await this.storage.setAccessToken(result.accessToken);\n      await this.storage.setRefreshToken(result.refreshToken);\n\n      this.log.info('Passkey auth successful', { userId: result.user.id });\n      return result;\n    } catch (error) {\n      if (error instanceof Error && error.name === 'NotAllowedError') {\n        throw new Error('Passkey authentication was cancelled');\n      }\n      this.log.error('Passkey auth failed', { error });\n      throw error;\n    }\n  }\n\n  /** Send OTP to phone number for phone-based login */\n  async sendPhoneOtp(\n    phoneNumber: string,\n  ): Promise<{ success: boolean; message: string; expiresIn: number }> {\n    if (!this.api.sendPhoneOtp) {\n      throw new Error('Phone OTP not configured');\n    }\n\n    try {\n      const result = await this.api.sendPhoneOtp(phoneNumber);\n      if (result.success) {\n        this.log.info('OTP sent', { phoneNumber: phoneNumber.slice(-4) });\n      } else {\n        this.log.warn('OTP send failed', {\n          phoneNumber: phoneNumber.slice(-4),\n          message: result.message,\n        });\n      }\n      return result;\n    } catch (error) {\n      this.log.error('Failed to send OTP', { error });\n      throw error;\n    }\n  }\n\n  /** Verify OTP and login/register user */\n  async verifyPhoneOtp(\n    phoneNumber: string,\n    code: string,\n  ): Promise<LoginResponse & { isNewUser: boolean }> {\n    if (!this.api.verifyPhoneOtp) {\n      throw new Error('Phone OTP not configured');\n    }\n\n    try {\n      const result = await this.api.verifyPhoneOtp(phoneNumber, code);\n\n      if (!result.success || !result.accessToken || !result.refreshToken) {\n        throw new Error(result.message || 'Verification failed');\n      }\n\n      await this.storage.setAccessToken(result.accessToken);\n      await this.storage.setRefreshToken(result.refreshToken);\n\n      const user = this.decodeToken(result.accessToken);\n      if (!user) {\n        throw new Error('Failed to decode user token');\n      }\n\n      this.log.info('Phone auth successful', {\n        userId: user.id,\n        isNewUser: result.isNewUser,\n      });\n\n      return {\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n        user,\n        isNewUser: result.isNewUser ?? false,\n      };\n    } catch (error) {\n      this.log.error('Phone OTP verification failed', { error });\n      throw error;\n    }\n  }\n}\n","/**\n * @ccatto/react-auth - Capacitor Auth Storage\n *\n * Capacitor-based auth storage using @capacitor/preferences.\n * Works on BOTH web and mobile (no platform detection needed!).\n *\n * - Web: Uses localStorage\n * - iOS: Uses UserDefaults/Keychain\n * - Android: Uses SharedPreferences\n */\nimport { Preferences } from '@capacitor/preferences';\nimport type { IAuthStorage } from './auth-storage.interface';\n\nexport interface CapacitorAuthStorageOptions {\n  /** Key prefix for stored tokens (default: 'catto_auth') */\n  keyPrefix?: string;\n}\n\nexport class CapacitorAuthStorage implements IAuthStorage {\n  private readonly ACCESS_TOKEN_KEY: string;\n  private readonly REFRESH_TOKEN_KEY: string;\n\n  constructor(options?: CapacitorAuthStorageOptions) {\n    const prefix = options?.keyPrefix ?? 'catto_auth';\n    this.ACCESS_TOKEN_KEY = `${prefix}_access_token`;\n    this.REFRESH_TOKEN_KEY = `${prefix}_refresh_token`;\n  }\n\n  async setAccessToken(token: string): Promise<void> {\n    await Preferences.set({\n      key: this.ACCESS_TOKEN_KEY,\n      value: token,\n    });\n  }\n\n  async getAccessToken(): Promise<string | null> {\n    const { value } = await Preferences.get({ key: this.ACCESS_TOKEN_KEY });\n    return value;\n  }\n\n  async setRefreshToken(token: string): Promise<void> {\n    await Preferences.set({\n      key: this.REFRESH_TOKEN_KEY,\n      value: token,\n    });\n  }\n\n  async getRefreshToken(): Promise<string | null> {\n    const { value } = await Preferences.get({ key: this.REFRESH_TOKEN_KEY });\n    return value;\n  }\n\n  async clearTokens(): Promise<void> {\n    await Promise.all([\n      Preferences.remove({ key: this.ACCESS_TOKEN_KEY }),\n      Preferences.remove({ key: this.REFRESH_TOKEN_KEY }),\n    ]);\n  }\n\n  async hasTokens(): Promise<boolean> {\n    const accessToken = await this.getAccessToken();\n    return accessToken !== null;\n  }\n}\n"]}
+{"version":3,"sources":["../src/client/native-social-signin.ts","../src/client/session-store.ts","../src/services/jwt-auth.service.ts","../src/storage/capacitor-auth-storage.ts"],"names":["Preferences"],"mappings":";;;;;AAkEA,eAAsB,wBACpB,MAAA,EACmC;AACnC,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAC,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,iBAAiB,CAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,OAAO,YAAA,EAAa;AAAA,EAC/B;AAEA,EAAA,IAAI,CAAC,SAAA,CAAU,gBAAA,EAAiB,EAAG;AACjC,IAAA,OAAO,EAAE,OAAO,YAAA,EAAa;AAAA,EAC/B;AACA,EAAA,IAAI,CAAC,SAAA,CAAU,iBAAA,CAAkB,WAAW,CAAA,EAAG;AAC7C,IAAA,OAAO,EAAE,OAAO,oBAAA,EAAqB;AAAA,EACvC;AAEA,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7C,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,0BAAA;AACtC,EAAA,MAAM,QAAA,GAAW,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,UAAA,EAAa,kBAAA;AAAA,IAC/C,MAAA,CAAO;AAAA,GACR,CAAA,CAAA;AAcD,EAAA,MAAM,eAAA,GAAkB,8BAAA;AAExB,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,SAAA,EAAU,GAAK,MAAM,OAAO,eAAA,CAAA;AACpC,IAAA,MAAM,EAAE,GAAA,EAAI,GAAI,MAAM,UAAU,KAAA,CAAM;AAAA,MACpC,GAAA,EAAK,QAAA;AAAA,MACL,gBAAgB,MAAA,CAAO;AAAA,KACxB,CAAA;AAED,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,GAAA,CAAI,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAE,CAAA;AAC1D,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,CAAC,IAAA,EAAM;AAChC,MAAA,OAAO,EAAE,OAAO,QAAA,EAAS;AAAA,IAC3B;AACA,IAAA,OAAO,EAAE,IAAA,EAAK;AAAA,EAChB,SAAS,GAAA,EAAK;AAEZ,IAAA,MAAM,OAAA,GACJ,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,UAAU,GAAA,GACxC,MAAA,CAAQ,GAAA,CAA2B,IAAI,CAAA,GACvC,EAAA;AACN,IAAA,IAAI,YAAY,UAAA,EAAY;AAC1B,MAAA,OAAO,EAAE,OAAO,UAAA,EAAW;AAAA,IAC7B;AACA,IAAA,OAAO,EAAE,OAAO,QAAA,EAAS;AAAA,EAC3B;AACF;;;AC/GA,IAAI,cAAA,GAAuC,IAAA;AAC3C,IAAM,SAAA,uBAA8D,GAAA,EAAI;AAEjE,IAAM,YAAA,GAAe;AAAA;AAAA,EAE1B,UAAA,GAAmC;AACjC,IAAA,OAAO,iBAAiB,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,cAAA,EAAgB,CAAA,GAAI,IAAA;AAAA,EACjE,CAAA;AAAA;AAAA,EAGA,WAAW,OAAA,EAAqC;AAC9C,IAAA,cAAA,GAAiB,OAAA;AACjB,IAAA,MAAM,QAAA,GAAW,CAAC,GAAG,SAAS,CAAA;AAC9B,IAAA,QAAA,CAAS,OAAA,CAAQ,CAAC,QAAA,KAAa,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,EAClD,CAAA;AAAA;AAAA,EAGA,UAAU,QAAA,EAA+D;AACvE,IAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,IAAA,OAAO,MAAM,SAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,EACxC,CAAA;AAAA;AAAA,EAGA,SAAA,GAA2B;AACzB,IAAA,OAAO,cAAA,EAAgB,MAAM,EAAA,IAAM,IAAA;AAAA,EACrC;AACF;;;ACJA,IAAM,UAAA,GAA0B;AAAA,EAC9B,MAAM,MAAM;AAAA,EAAC,CAAA;AAAA,EACb,MAAM,MAAM;AAAA,EAAC,CAAA;AAAA,EACb,OAAO,MAAM;AAAA,EAAC;AAChB,CAAA;AAOO,IAAM,eAAA,GAAN,MAAM,eAAA,CAAe;AAAA;AAAA,EAY1B,WAAA,CACU,OAAA,EACA,GAAA,EACR,MAAA,EACA,OAAA,EACA;AAJQ,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AATV;AAAA,IAAA,IAAA,CAAQ,cAAA,GAAwD,IAAA;AAGhE;AAAA,IAAA,IAAA,CAAQ,cAAA,GAAyC,IAAA;AACjD,IAAA,IAAA,CAAQ,kBAAA,GAA6B,CAAA;AASnC,IAAA,IAAA,CAAK,MAAM,MAAA,IAAU,UAAA;AACrB,IAAA,IAAA,CAAK,OAAA,GAAU,WAAW,EAAC;AAAA,EAC7B;AAAA;AAAA,EAGA,MAAM,MAAM,WAAA,EAAuD;AACjE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,MAAM,WAAW,CAAA;AAC7C,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,IAAA,CAAK,WAAW,CAAA;AAClD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,IAAA,CAAK,YAAY,CAAA;AACpD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,6BAAA,EAA+B,EAAE,QAAQ,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AACrE,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,cAAA,EAAgB,EAAE,OAAO,CAAA;AACxC,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,sBAAsB,IAAA,EAAsC;AAChE,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,gBAAA,EAAkB;AAC9B,MAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,IACrD;AACA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,iBAAiB,IAAI,CAAA;AACjD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,IAAA,CAAK,WAAW,CAAA;AAClD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,IAAA,CAAK,YAAY,CAAA;AACpD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,+BAAA,EAAiC,EAAE,QAAQ,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AACvE,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,2BAAA,EAA6B,EAAE,OAAO,CAAA;AACrD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAA4C;AACzD,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,SAAS,IAAI,CAAA;AAC3C,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,MAAA,CAAO,YAAY,CAAA;AACtD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,8BAAA,EAAgC,EAAE,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,qBAAA,EAAuB,EAAE,OAAO,CAAA;AAC/C,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,MAAA,GAAwB;AAC5B,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAgB;AACxD,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,MAAM,KAAK,GAAA,CAAI,MAAA,CAAO,YAAY,CAAA,CAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MACpD;AAAA,IACF,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,CAAK,QAAQ,WAAA,EAAY;AAC/B,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,iBAAiB,CAAA;AAAA,IACjC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,kBAAA,GAAsC;AAC1C,IAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAgB;AACxD,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,IAC9C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,aAAa,YAAY,CAAA;AACvD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IAChB,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAA,CAAK,QAAQ,WAAA,EAAY;AAC/B,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,sBAAA,EAAwB,EAAE,OAAO,CAAA;AAChD,MAAA,IAAA,CAAK,QAAQ,gBAAA,IAAmB;AAChC,MAAA,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAAA,IACnC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,GAAyC;AAC7C,IAAA,OAAO,IAAA,CAAK,QAAQ,cAAA,EAAe;AAAA,EACrC;AAAA;AAAA,EAGQ,wBAAA,CACN,KAAA,EACA,aAAA,GAAgB,GAAA,EACP;AACT,IAAA,IAAI;AACF,MAAA,IAAI,GAAA;AAGJ,MAAA,IAAI,IAAA,CAAK,cAAA,EAAgB,KAAA,KAAU,KAAA,EAAO;AACxC,QAAA,GAAA,GAAM,KAAK,cAAA,CAAe,GAAA;AAAA,MAC5B,CAAA,MAAO;AACL,QAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AACpC,QAAA,MAAM,MAAA,GAAS,UAAU,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA;AACvC,QAAA,GAAA,GAAM,OAAA,CAAQ,GAAA;AACd,QAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,QAAA,IAAA,CAAK,cAAA,GAAiB,EAAE,KAAA,EAAO,GAAA,EAAI;AAAA,MACrC;AAEA,MAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC/C,MAAA,OAAO,cAAc,GAAA,GAAM,aAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAAA,GAAkD;AACtD,IAAA,IAAI,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA,EAAe;AACtC,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAC;AAEpB,IAAA,IAAI,IAAA,CAAK,wBAAA,CAAyB,KAAK,CAAA,EAAG;AAExC,MAAA,MAAM,gBAAA,GAAmB,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,kBAAA;AAC3C,MAAA,IACE,IAAA,CAAK,kBAAA,GAAqB,CAAA,IAC1B,gBAAA,GAAmB,gBAAe,mBAAA,EAClC;AACA,QAAA,OAAO,EAAC;AAAA,MACV;AAEA,MAAA,IAAI;AACF,QAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AACxB,UAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,kBAAA,EAAmB,CAAE,QAAQ,MAAM;AAC5D,YAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,UACxB,CAAC,CAAA;AAAA,QACH;AACA,QAAA,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA;AACnB,QAAA,IAAA,CAAK,kBAAA,GAAqB,CAAA;AAAA,MAC5B,CAAA,CAAA,MAAQ;AACN,QAAA,IAAA,CAAK,kBAAA,GAAqB,KAAK,GAAA,EAAI;AACnC,QAAA,OAAO,EAAC;AAAA,MACV;AAAA,IACF;AAEA,IAAA,OAAO,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAAA,EAC5C;AAAA;AAAA,EAGA,MAAM,eAAA,GAAoC;AACxC,IAAA,OAAO,IAAA,CAAK,QAAQ,SAAA,EAAU;AAAA,EAChC;AAAA;AAAA,EAGA,MAAM,SAAA,GAA8B;AAClC,IAAA,OAAO,IAAA,CAAK,QAAQ,SAAA,EAAU;AAAA,EAChC;AAAA;AAAA,EAGA,YAAY,KAAA,EAAgC;AAC1C,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AACpC,MAAA,MAAM,MAAA,GAAS,UAAU,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,MAAA,MAAM,WAAA,GAAc,kBAAA;AAAA,QAClB,IAAA,CAAK,MAAM,CAAA,CACR,KAAA,CAAM,EAAE,CAAA,CACR,GAAA,CAAI,CAAC,CAAA,KAAM,GAAA,GAAA,CAAO,IAAA,GAAO,EAAE,UAAA,CAAW,CAAC,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,EAAG,MAAM,CAAA,CAAE,CAAC,CAAA,CAChE,IAAA,CAAK,EAAE;AAAA,OACZ;AACA,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,WAAW,CAAA;AACtC,MAAA,OAAO;AAAA,QACL,IAAI,OAAA,CAAQ,GAAA;AAAA,QACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,QACf,IAAA,EAAM,QAAQ,IAAA,IAAQ,IAAA;AAAA,QACtB,IAAA,EAAM,QAAQ,IAAA,IAAQ,MAAA;AAAA,QACtB,UAAU,OAAA,CAAQ,QAAA;AAAA,QAClB,gBAAgB,OAAA,CAAQ;AAAA,OAC1B;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,GAA2C;AAC/C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA,EAAe;AACxC,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,IAAA,OAAO,IAAA,CAAK,YAAY,KAAK,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAM,gBAAA,GAA2C;AAC/C,IAAA,IACE,CAAC,IAAA,CAAK,GAAA,CAAI,wCACV,CAAC,IAAA,CAAK,IAAI,2BAAA,EACV;AACA,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD;AAEA,IAAA,MAAM,EAAE,mBAAA,EAAqB,uBAAA,EAAwB,GACnD,MAAM,OAAO,yBAAyB,CAAA;AAExC,IAAA,IAAI,CAAC,yBAAwB,EAAG;AAC9B,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,OAAA,EAAS,SAAA,KACf,MAAM,IAAA,CAAK,IAAI,oCAAA,EAAqC;AAEtD,MAAA,MAAM,YAAA,GAAe,MAAM,mBAAA,CAAoB;AAAA,QAC7C,WAAA,EAAa,IAAA,CAAK,KAAA,CAAM,OAAO;AAAA,OAChC,CAAA;AAED,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,2BAAA;AAAA,QAC5B,SAAA;AAAA,QACA,IAAA,CAAK,UAAU,YAAY;AAAA,OAC7B;AAEA,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,MAAA,CAAO,YAAY,CAAA;AAEtD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,yBAAA,EAA2B,EAAE,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACnE,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,iBAAA,EAAmB;AAC9D,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,qBAAA,EAAuB,EAAE,OAAO,CAAA;AAC/C,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,aACJ,WAAA,EACmE;AACnE,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,YAAA,EAAc;AAC1B,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,aAAa,WAAW,CAAA;AACtD,MAAA,IAAI,OAAO,OAAA,EAAS;AAClB,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,UAAA,EAAY,EAAE,aAAa,WAAA,CAAY,KAAA,CAAM,CAAA,CAAE,CAAA,EAAG,CAAA;AAAA,MAClE,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,iBAAA,EAAmB;AAAA,UAC/B,WAAA,EAAa,WAAA,CAAY,KAAA,CAAM,CAAA,CAAE,CAAA;AAAA,UACjC,SAAS,MAAA,CAAO;AAAA,SACjB,CAAA;AAAA,MACH;AACA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,oBAAA,EAAsB,EAAE,OAAO,CAAA;AAC9C,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,CACJ,WAAA,EACA,IAAA,EACiD;AACjD,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,cAAA,EAAgB;AAC5B,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,MAAM,IAAA,CAAK,GAAA,CAAI,cAAA,CAAe,aAAa,IAAI,CAAA;AAE9D,MAAA,IAAI,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,WAAA,IAAe,CAAC,OAAO,YAAA,EAAc;AAClE,QAAA,MAAM,IAAI,KAAA,CAAM,MAAA,CAAO,OAAA,IAAW,qBAAqB,CAAA;AAAA,MACzD;AAEA,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,MAAA,CAAO,YAAY,CAAA;AAEtD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,WAAW,CAAA;AAChD,MAAA,IAAI,CAAC,IAAA,EAAM;AACT,QAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,MAC/C;AAEA,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,uBAAA,EAAyB;AAAA,QACrC,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,WAAW,MAAA,CAAO;AAAA,OACnB,CAAA;AAED,MAAA,OAAO;AAAA,QACL,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,cAAc,MAAA,CAAO,YAAA;AAAA,QACrB,IAAA;AAAA,QACA,SAAA,EAAW,OAAO,SAAA,IAAa;AAAA,OACjC;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,+BAAA,EAAiC,EAAE,OAAO,CAAA;AACzD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AACF,CAAA;AApUa,eAAA,CAUI,mBAAA,GAAsB,GAAA;AAVhC,IAAM,cAAA,GAAN;AC/BA,IAAM,uBAAN,MAAmD;AAAA,EAIxD,YAAY,OAAA,EAAuC;AACjD,IAAA,MAAM,MAAA,GAAS,SAAS,SAAA,IAAa,YAAA;AACrC,IAAA,IAAA,CAAK,gBAAA,GAAmB,GAAG,MAAM,CAAA,aAAA,CAAA;AACjC,IAAA,IAAA,CAAK,iBAAA,GAAoB,GAAG,MAAM,CAAA,cAAA,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,eAAe,KAAA,EAA8B;AACjD,IAAA,MAAMA,wBAAY,GAAA,CAAI;AAAA,MACpB,KAAK,IAAA,CAAK,gBAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,cAAA,GAAyC;AAC7C,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAMA,uBAAA,CAAY,IAAI,EAAE,GAAA,EAAK,IAAA,CAAK,gBAAA,EAAkB,CAAA;AACtE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,KAAA,EAA8B;AAClD,IAAA,MAAMA,wBAAY,GAAA,CAAI;AAAA,MACpB,KAAK,IAAA,CAAK,iBAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,eAAA,GAA0C;AAC9C,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAMA,uBAAA,CAAY,IAAI,EAAE,GAAA,EAAK,IAAA,CAAK,iBAAA,EAAmB,CAAA;AACvE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,WAAA,GAA6B;AACjC,IAAA,MAAM,QAAQ,GAAA,CAAI;AAAA,MAChBA,wBAAY,MAAA,CAAO,EAAE,GAAA,EAAK,IAAA,CAAK,kBAAkB,CAAA;AAAA,MACjDA,wBAAY,MAAA,CAAO,EAAE,GAAA,EAAK,IAAA,CAAK,mBAAmB;AAAA,KACnD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,SAAA,GAA8B;AAClC,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,cAAA,EAAe;AAC9C,IAAA,OAAO,WAAA,KAAgB,IAAA;AAAA,EACzB;AACF","file":"index.cjs","sourcesContent":["/**\n * @ccatto/react-auth - Native social sign-in handoff\n *\n * Drives the in-app-browser OAuth flow on native (Capacitor/iOS) and returns the\n * one-time handoff code. Pair the returned code with\n * `JwtAuthService.loginWithExchangeCode(code)` to mint app JWTs.\n *\n * Why this exists (see @ccatto/capacitor-inapp-auth): OAuth can't run in an\n * embedded webview, and SFSafariViewController can't return to the app via a\n * custom scheme. ASWebAuthenticationSession (this plugin) can. The server flow:\n *\n *   start → `${baseURL}${startPath}?provider=…`  (initiates OAuth server-side)\n *   provider auth → web callback → 302 `${callbackScheme}://auth-callback?code=…`\n *   ASWebAuthenticationSession captures the redirect → we parse `code` here.\n *\n * This module hardcodes nothing app-specific — `baseURL` and `callbackScheme`\n * come from config. `@capacitor/core` and `@ccatto/capacitor-inapp-auth` are\n * optional peer deps, imported dynamically so web-only consumers never load them.\n */\n\nexport interface NativeSocialSignInConfig {\n  /** Provider key understood by the server route (e.g. 'google', 'apple', 'facebook'). */\n  provider: string;\n  /** Base URL of the web app that hosts the OAuth start route (no trailing slash needed). */\n  baseURL: string;\n  /** Custom URL scheme registered in Info.plist, WITHOUT '://' (e.g. 'myapp'). */\n  callbackScheme: string;\n  /** Server route that initiates OAuth in-session. Default: '/api/mobile-social-start'. */\n  startPath?: string;\n}\n\nexport type NativeSocialSignInReason =\n  /** Not running in a native Capacitor context — caller should use the web OAuth redirect. */\n  | 'not_native'\n  /** Native, but the InAppAuth plugin isn't installed (old build) — caller should fall back. */\n  | 'plugin_unavailable'\n  /** User dismissed the auth sheet. */\n  | 'canceled'\n  /** The provider/callback returned an error, or no code came back. */\n  | 'failed';\n\nexport type NativeSocialSignInResult =\n  | { code: string }\n  | { code?: undefined; error: NativeSocialSignInReason };\n\n/**\n * Run the native in-app-browser OAuth handoff. Resolves to `{ code }` on success,\n * or `{ error }` describing why it didn't complete (so the caller can fall back\n * to the standard web OAuth redirect when appropriate).\n *\n * Never throws — all failure modes are returned as `{ error }`.\n *\n * @example\n * ```ts\n * const res = await startNativeSocialSignIn({\n *   provider: 'google',\n *   baseURL: process.env.NEXT_PUBLIC_BASE_URL!,\n *   callbackScheme: 'myapp',\n * });\n * if ('code' in res && res.code) {\n *   await authService.loginWithExchangeCode(res.code);\n * } else if (res.error === 'not_native' || res.error === 'plugin_unavailable') {\n *   await signInSocialOnWeb(provider); // standard redirect\n * }\n * ```\n */\nexport async function startNativeSocialSignIn(\n  config: NativeSocialSignInConfig,\n): Promise<NativeSocialSignInResult> {\n  let Capacitor: typeof import('@capacitor/core').Capacitor;\n  try {\n    ({ Capacitor } = await import('@capacitor/core'));\n  } catch {\n    return { error: 'not_native' };\n  }\n\n  if (!Capacitor.isNativePlatform()) {\n    return { error: 'not_native' };\n  }\n  if (!Capacitor.isPluginAvailable('InAppAuth')) {\n    return { error: 'plugin_unavailable' };\n  }\n\n  const base = config.baseURL.replace(/\\/$/, '');\n  const startPath = config.startPath ?? '/api/mobile-social-start';\n  const startUrl = `${base}${startPath}?provider=${encodeURIComponent(\n    config.provider,\n  )}`;\n\n  // Optional peer dep: import via a non-literal specifier with a local type so\n  // react-auth's type build never hard-depends on the plugin's .d.ts (it may be\n  // unbuilt in a fresh monorepo checkout, or absent entirely in a web-only\n  // consumer that doesn't install it).\n  type InAppAuthModule = {\n    InAppAuth: {\n      start(opts: {\n        url: string;\n        callbackScheme: string;\n      }): Promise<{ url: string }>;\n    };\n  };\n  const pluginSpecifier = '@ccatto/capacitor-inapp-auth';\n\n  try {\n    const { InAppAuth } = (await import(pluginSpecifier)) as InAppAuthModule;\n    const { url } = await InAppAuth.start({\n      url: startUrl,\n      callbackScheme: config.callbackScheme,\n    });\n\n    const params = new URLSearchParams(url.split('?')[1] ?? '');\n    const code = params.get('code');\n    if (params.get('error') || !code) {\n      return { error: 'failed' };\n    }\n    return { code };\n  } catch (err) {\n    // The plugin rejects with code \"CANCELED\" when the user dismisses the sheet.\n    const message =\n      err && typeof err === 'object' && 'code' in err\n        ? String((err as { code?: unknown }).code)\n        : '';\n    if (message === 'CANCELED') {\n      return { error: 'canceled' };\n    }\n    return { error: 'failed' };\n  }\n}\n","/**\n * @ccatto/react-auth - Session Store\n *\n * Synchronous session state store for sharing auth session with Apollo Client.\n * Avoids network calls in Apollo's authLink.\n *\n * @example\n * // Write (from SessionSync component in React tree)\n * sessionStore.setSession(session);\n *\n * // Read (from Apollo authLink — synchronous, no network call)\n * const session = sessionStore.getSession();\n */\n\nimport type { CompatSession } from '../types/session';\n\nlet currentSession: CompatSession | null = null;\nconst listeners: Set<(session: CompatSession | null) => void> = new Set();\n\nexport const sessionStore = {\n  /** Get the current session (synchronous, no network call) */\n  getSession(): CompatSession | null {\n    return currentSession ? Object.freeze({ ...currentSession }) : null;\n  },\n\n  /** Update the session (called by SessionSync component) */\n  setSession(session: CompatSession | null): void {\n    currentSession = session;\n    const snapshot = [...listeners];\n    snapshot.forEach((listener) => listener(session));\n  },\n\n  /** Subscribe to session changes */\n  subscribe(listener: (session: CompatSession | null) => void): () => void {\n    listeners.add(listener);\n    return () => listeners.delete(listener);\n  },\n\n  /** Get the user ID from the current session (convenience method) */\n  getUserId(): string | null {\n    return currentSession?.user?.id ?? null;\n  },\n};\n","/**\n * @ccatto/react-auth - JWT Auth Service\n *\n * Platform-agnostic JWT authentication service.\n * Handles token storage, login, register, refresh, and passkey auth.\n *\n * Uses IAuthStorage for token persistence and IAuthApiService for API calls.\n *\n * @example\n * ```typescript\n * import { JwtAuthService, CapacitorAuthStorage } from '@ccatto/react-auth';\n *\n * const storage = new CapacitorAuthStorage({ keyPrefix: 'myapp' });\n * const authService = new JwtAuthService(storage, myApiService, undefined, {\n *   onSessionExpired: () => router.push('/login'),\n * });\n * await authService.login({ email, password });\n * ```\n */\nimport type { IAuthStorage } from '../storage/auth-storage.interface';\nimport type {\n  AuthUser,\n  IAuthApiService,\n  IAuthLogger,\n  LoginCredentials,\n  LoginResponse,\n  RegisterData,\n} from './auth-api.interface';\n\n// Re-export types for convenience\nexport type {\n  AuthUser,\n  LoginCredentials,\n  RegisterData,\n  LoginResponse,\n  AuthTokens,\n} from './auth-api.interface';\n\nconst noopLogger: IAuthLogger = {\n  info: () => {},\n  warn: () => {},\n  error: () => {},\n};\n\nexport interface JwtAuthServiceOptions {\n  /** Called when session expires (refresh token fails). Use to redirect to login. */\n  onSessionExpired?: () => void;\n}\n\nexport class JwtAuthService {\n  private log: IAuthLogger;\n  private options: JwtAuthServiceOptions;\n\n  // Fix 7: Cache token expiry to avoid re-parsing JWT on every getAuthHeaders()\n  private cachedTokenExp: { token: string; exp: number } | null = null;\n\n  // Fix 5: Refresh deduplication + cooldown after failure\n  private refreshPromise: Promise<string> | null = null;\n  private lastRefreshFailure: number = 0;\n  private static REFRESH_COOLDOWN_MS = 5000; // 5 second cooldown after failure\n\n  constructor(\n    private storage: IAuthStorage,\n    private api: IAuthApiService,\n    logger?: IAuthLogger,\n    options?: JwtAuthServiceOptions,\n  ) {\n    this.log = logger || noopLogger;\n    this.options = options || {};\n  }\n\n  /** Login with email and password */\n  async login(credentials: LoginCredentials): Promise<LoginResponse> {\n    try {\n      const data = await this.api.login(credentials);\n      await this.storage.setAccessToken(data.accessToken);\n      await this.storage.setRefreshToken(data.refreshToken);\n      this.log.info('User logged in successfully', { userId: data.user.id });\n      return data;\n    } catch (error) {\n      this.log.error('Login failed', { error });\n      throw error;\n    }\n  }\n\n  /**\n   * Exchange a one-time mobile-OAuth handoff code for app JWTs and store them.\n   * Used by the native deep-link / in-app-browser social sign-in flow after\n   * {@link startNativeSocialSignIn} returns a `code`. Requires the app's\n   * `IAuthApiService` to implement `exchangeAuthCode`.\n   */\n  async loginWithExchangeCode(code: string): Promise<LoginResponse> {\n    if (!this.api.exchangeAuthCode) {\n      throw new Error('Exchange-code auth not configured');\n    }\n    try {\n      const data = await this.api.exchangeAuthCode(code);\n      await this.storage.setAccessToken(data.accessToken);\n      await this.storage.setRefreshToken(data.refreshToken);\n      this.log.info('Auth code exchange successful', { userId: data.user.id });\n      return data;\n    } catch (error) {\n      this.log.error('Auth code exchange failed', { error });\n      throw error;\n    }\n  }\n\n  /** Register new user */\n  async register(data: RegisterData): Promise<LoginResponse> {\n    try {\n      const result = await this.api.register(data);\n      await this.storage.setAccessToken(result.accessToken);\n      await this.storage.setRefreshToken(result.refreshToken);\n      this.log.info('User registered successfully', { userId: result.user.id });\n      return result;\n    } catch (error) {\n      this.log.error('Registration failed', { error });\n      throw error;\n    }\n  }\n\n  /** Logout (clear tokens) */\n  async logout(): Promise<void> {\n    try {\n      const refreshToken = await this.storage.getRefreshToken();\n      if (refreshToken) {\n        await this.api.logout(refreshToken).catch(() => {});\n      }\n    } finally {\n      await this.storage.clearTokens();\n      this.cachedTokenExp = null;\n      this.log.info('User logged out');\n    }\n  }\n\n  /** Refresh access token */\n  async refreshAccessToken(): Promise<string> {\n    const refreshToken = await this.storage.getRefreshToken();\n    if (!refreshToken) {\n      throw new Error('No refresh token available');\n    }\n\n    try {\n      const result = await this.api.refreshToken(refreshToken);\n      await this.storage.setAccessToken(result.accessToken);\n      return result.accessToken;\n    } catch (error) {\n      await this.storage.clearTokens();\n      this.cachedTokenExp = null;\n      this.log.error('Token refresh failed', { error });\n      this.options.onSessionExpired?.();\n      throw new Error('Session expired');\n    }\n  }\n\n  /** Get current access token */\n  async getAccessToken(): Promise<string | null> {\n    return this.storage.getAccessToken();\n  }\n\n  /** Check if a JWT token is expired or about to expire */\n  private isTokenExpiredOrExpiring(\n    token: string,\n    bufferSeconds = 120,\n  ): boolean {\n    try {\n      let exp: number;\n\n      // Fix 7: Use cached expiry if token hasn't changed\n      if (this.cachedTokenExp?.token === token) {\n        exp = this.cachedTokenExp.exp;\n      } else {\n        const base64Url = token.split('.')[1];\n        const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');\n        const payload = JSON.parse(atob(base64));\n        exp = payload.exp;\n        if (!exp) return true;\n        this.cachedTokenExp = { token, exp };\n      }\n\n      const nowSeconds = Math.floor(Date.now() / 1000);\n      return nowSeconds >= exp - bufferSeconds;\n    } catch {\n      return true;\n    }\n  }\n\n  /**\n   * Get auth headers for API requests.\n   * Proactively refreshes the access token if it's expired or about to expire.\n   * Includes cooldown to prevent repeated refresh attempts after failure.\n   */\n  async getAuthHeaders(): Promise<Record<string, string>> {\n    let token = await this.getAccessToken();\n    if (!token) return {};\n\n    if (this.isTokenExpiredOrExpiring(token)) {\n      // Fix 5: Skip refresh if we recently failed (cooldown)\n      const timeSinceFailure = Date.now() - this.lastRefreshFailure;\n      if (\n        this.lastRefreshFailure > 0 &&\n        timeSinceFailure < JwtAuthService.REFRESH_COOLDOWN_MS\n      ) {\n        return {};\n      }\n\n      try {\n        if (!this.refreshPromise) {\n          this.refreshPromise = this.refreshAccessToken().finally(() => {\n            this.refreshPromise = null;\n          });\n        }\n        token = await this.refreshPromise;\n        this.lastRefreshFailure = 0;\n      } catch {\n        this.lastRefreshFailure = Date.now();\n        return {};\n      }\n    }\n\n    return { Authorization: `Bearer ${token}` };\n  }\n\n  /** Check if user is authenticated */\n  async isAuthenticated(): Promise<boolean> {\n    return this.storage.hasTokens();\n  }\n\n  /** Check if tokens exist in storage */\n  async hasTokens(): Promise<boolean> {\n    return this.storage.hasTokens();\n  }\n\n  /** Decode JWT token (client-side only — for user info, NOT for security) */\n  decodeToken(token: string): AuthUser | null {\n    try {\n      const base64Url = token.split('.')[1];\n      const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');\n      const jsonPayload = decodeURIComponent(\n        atob(base64)\n          .split('')\n          .map((c) => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))\n          .join(''),\n      );\n      const payload = JSON.parse(jsonPayload);\n      return {\n        id: payload.sub,\n        email: payload.email,\n        name: payload.name || null,\n        role: payload.role || 'user',\n        playerID: payload.playerID,\n        organizationId: payload.organizationId,\n      };\n    } catch {\n      return null;\n    }\n  }\n\n  /** Get current user from token (client-side decode) */\n  async getCurrentUser(): Promise<AuthUser | null> {\n    const token = await this.getAccessToken();\n    if (!token) return null;\n    return this.decodeToken(token);\n  }\n\n  /** Login with passkey (WebAuthn/FIDO2) */\n  async loginWithPasskey(): Promise<LoginResponse> {\n    if (\n      !this.api.generatePasskeyAuthenticationOptions ||\n      !this.api.verifyPasskeyAuthentication\n    ) {\n      throw new Error('Passkey authentication not configured');\n    }\n\n    const { startAuthentication, browserSupportsWebAuthn } =\n      await import('@simplewebauthn/browser');\n\n    if (!browserSupportsWebAuthn()) {\n      throw new Error('WebAuthn is not supported on this device');\n    }\n\n    try {\n      const { options, sessionId } =\n        await this.api.generatePasskeyAuthenticationOptions();\n\n      const authResponse = await startAuthentication({\n        optionsJSON: JSON.parse(options),\n      });\n\n      const result = await this.api.verifyPasskeyAuthentication(\n        sessionId,\n        JSON.stringify(authResponse),\n      );\n\n      await this.storage.setAccessToken(result.accessToken);\n      await this.storage.setRefreshToken(result.refreshToken);\n\n      this.log.info('Passkey auth successful', { userId: result.user.id });\n      return result;\n    } catch (error) {\n      if (error instanceof Error && error.name === 'NotAllowedError') {\n        throw new Error('Passkey authentication was cancelled');\n      }\n      this.log.error('Passkey auth failed', { error });\n      throw error;\n    }\n  }\n\n  /** Send OTP to phone number for phone-based login */\n  async sendPhoneOtp(\n    phoneNumber: string,\n  ): Promise<{ success: boolean; message: string; expiresIn: number }> {\n    if (!this.api.sendPhoneOtp) {\n      throw new Error('Phone OTP not configured');\n    }\n\n    try {\n      const result = await this.api.sendPhoneOtp(phoneNumber);\n      if (result.success) {\n        this.log.info('OTP sent', { phoneNumber: phoneNumber.slice(-4) });\n      } else {\n        this.log.warn('OTP send failed', {\n          phoneNumber: phoneNumber.slice(-4),\n          message: result.message,\n        });\n      }\n      return result;\n    } catch (error) {\n      this.log.error('Failed to send OTP', { error });\n      throw error;\n    }\n  }\n\n  /** Verify OTP and login/register user */\n  async verifyPhoneOtp(\n    phoneNumber: string,\n    code: string,\n  ): Promise<LoginResponse & { isNewUser: boolean }> {\n    if (!this.api.verifyPhoneOtp) {\n      throw new Error('Phone OTP not configured');\n    }\n\n    try {\n      const result = await this.api.verifyPhoneOtp(phoneNumber, code);\n\n      if (!result.success || !result.accessToken || !result.refreshToken) {\n        throw new Error(result.message || 'Verification failed');\n      }\n\n      await this.storage.setAccessToken(result.accessToken);\n      await this.storage.setRefreshToken(result.refreshToken);\n\n      const user = this.decodeToken(result.accessToken);\n      if (!user) {\n        throw new Error('Failed to decode user token');\n      }\n\n      this.log.info('Phone auth successful', {\n        userId: user.id,\n        isNewUser: result.isNewUser,\n      });\n\n      return {\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n        user,\n        isNewUser: result.isNewUser ?? false,\n      };\n    } catch (error) {\n      this.log.error('Phone OTP verification failed', { error });\n      throw error;\n    }\n  }\n}\n","/**\n * @ccatto/react-auth - Capacitor Auth Storage\n *\n * Capacitor-based auth storage using @capacitor/preferences.\n * Works on BOTH web and mobile (no platform detection needed!).\n *\n * - Web: Uses localStorage\n * - iOS: Uses UserDefaults/Keychain\n * - Android: Uses SharedPreferences\n */\nimport { Preferences } from '@capacitor/preferences';\nimport type { IAuthStorage } from './auth-storage.interface';\n\nexport interface CapacitorAuthStorageOptions {\n  /** Key prefix for stored tokens (default: 'catto_auth') */\n  keyPrefix?: string;\n}\n\nexport class CapacitorAuthStorage implements IAuthStorage {\n  private readonly ACCESS_TOKEN_KEY: string;\n  private readonly REFRESH_TOKEN_KEY: string;\n\n  constructor(options?: CapacitorAuthStorageOptions) {\n    const prefix = options?.keyPrefix ?? 'catto_auth';\n    this.ACCESS_TOKEN_KEY = `${prefix}_access_token`;\n    this.REFRESH_TOKEN_KEY = `${prefix}_refresh_token`;\n  }\n\n  async setAccessToken(token: string): Promise<void> {\n    await Preferences.set({\n      key: this.ACCESS_TOKEN_KEY,\n      value: token,\n    });\n  }\n\n  async getAccessToken(): Promise<string | null> {\n    const { value } = await Preferences.get({ key: this.ACCESS_TOKEN_KEY });\n    return value;\n  }\n\n  async setRefreshToken(token: string): Promise<void> {\n    await Preferences.set({\n      key: this.REFRESH_TOKEN_KEY,\n      value: token,\n    });\n  }\n\n  async getRefreshToken(): Promise<string | null> {\n    const { value } = await Preferences.get({ key: this.REFRESH_TOKEN_KEY });\n    return value;\n  }\n\n  async clearTokens(): Promise<void> {\n    await Promise.all([\n      Preferences.remove({ key: this.ACCESS_TOKEN_KEY }),\n      Preferences.remove({ key: this.REFRESH_TOKEN_KEY }),\n    ]);\n  }\n\n  async hasTokens(): Promise<boolean> {\n    const accessToken = await this.getAccessToken();\n    return accessToken !== null;\n  }\n}\n"]}

package/dist/index.d.cts

@@ -78,6 +78,73 @@ interface AuthStoreUser {
     }>;
 }
 
+/**
+ * @ccatto/react-auth - Native social sign-in handoff
+ *
+ * Drives the in-app-browser OAuth flow on native (Capacitor/iOS) and returns the
+ * one-time handoff code. Pair the returned code with
+ * `JwtAuthService.loginWithExchangeCode(code)` to mint app JWTs.
+ *
+ * Why this exists (see @ccatto/capacitor-inapp-auth): OAuth can't run in an
+ * embedded webview, and SFSafariViewController can't return to the app via a
+ * custom scheme. ASWebAuthenticationSession (this plugin) can. The server flow:
+ *
+ *   start → `${baseURL}${startPath}?provider=…`  (initiates OAuth server-side)
+ *   provider auth → web callback → 302 `${callbackScheme}://auth-callback?code=…`
+ *   ASWebAuthenticationSession captures the redirect → we parse `code` here.
+ *
+ * This module hardcodes nothing app-specific — `baseURL` and `callbackScheme`
+ * come from config. `@capacitor/core` and `@ccatto/capacitor-inapp-auth` are
+ * optional peer deps, imported dynamically so web-only consumers never load them.
+ */
+interface NativeSocialSignInConfig {
+    /** Provider key understood by the server route (e.g. 'google', 'apple', 'facebook'). */
+    provider: string;
+    /** Base URL of the web app that hosts the OAuth start route (no trailing slash needed). */
+    baseURL: string;
+    /** Custom URL scheme registered in Info.plist, WITHOUT '://' (e.g. 'myapp'). */
+    callbackScheme: string;
+    /** Server route that initiates OAuth in-session. Default: '/api/mobile-social-start'. */
+    startPath?: string;
+}
+type NativeSocialSignInReason = 
+/** Not running in a native Capacitor context — caller should use the web OAuth redirect. */
+'not_native'
+/** Native, but the InAppAuth plugin isn't installed (old build) — caller should fall back. */
+ | 'plugin_unavailable'
+/** User dismissed the auth sheet. */
+ | 'canceled'
+/** The provider/callback returned an error, or no code came back. */
+ | 'failed';
+type NativeSocialSignInResult = {
+    code: string;
+} | {
+    code?: undefined;
+    error: NativeSocialSignInReason;
+};
+/**
+ * Run the native in-app-browser OAuth handoff. Resolves to `{ code }` on success,
+ * or `{ error }` describing why it didn't complete (so the caller can fall back
+ * to the standard web OAuth redirect when appropriate).
+ *
+ * Never throws — all failure modes are returned as `{ error }`.
+ *
+ * @example
+ * ```ts
+ * const res = await startNativeSocialSignIn({
+ *   provider: 'google',
+ *   baseURL: process.env.NEXT_PUBLIC_BASE_URL!,
+ *   callbackScheme: 'myapp',
+ * });
+ * if ('code' in res && res.code) {
+ *   await authService.loginWithExchangeCode(res.code);
+ * } else if (res.error === 'not_native' || res.error === 'plugin_unavailable') {
+ *   await signInSocialOnWeb(provider); // standard redirect
+ * }
+ * ```
+ */
+declare function startNativeSocialSignIn(config: NativeSocialSignInConfig): Promise<NativeSocialSignInResult>;
+
 /**
  * @ccatto/react-auth - Session Store
  *
@@ -187,6 +254,12 @@ interface IAuthApiService {
     refreshToken(refreshToken: string): Promise<{
         accessToken: string;
     }>;
+    /**
+     * Exchange a one-time mobile-OAuth handoff code (minted by the web
+     * `mobile-auth-callback` route) for app JWTs. Required for native social
+     * sign-in via `startNativeSocialSignIn`; optional otherwise.
+     */
+    exchangeAuthCode?(code: string): Promise<LoginResponse>;
     forgotPassword?(email: string): Promise<{
         message: string;
         resetToken?: string;
@@ -245,6 +318,13 @@ declare class JwtAuthService {
     constructor(storage: IAuthStorage, api: IAuthApiService, logger?: IAuthLogger, options?: JwtAuthServiceOptions);
     /** Login with email and password */
     login(credentials: LoginCredentials): Promise<LoginResponse>;
+    /**
+     * Exchange a one-time mobile-OAuth handoff code for app JWTs and store them.
+     * Used by the native deep-link / in-app-browser social sign-in flow after
+     * {@link startNativeSocialSignIn} returns a `code`. Requires the app's
+     * `IAuthApiService` to implement `exchangeAuthCode`.
+     */
+    loginWithExchangeCode(code: string): Promise<LoginResponse>;
     /** Register new user */
     register(data: RegisterData): Promise<LoginResponse>;
     /** Logout (clear tokens) */
@@ -299,4 +379,4 @@ declare class CapacitorAuthStorage implements IAuthStorage {
     hasTokens(): Promise<boolean>;
 }
 
-export { type AuthStoreUser, type AuthTokens, type AuthUser, CapacitorAuthStorage, type CapacitorAuthStorageOptions, type CompatSession, type CompatSessionUser, type EnrichedSession, type EnrichedUser, type IAuthApiService, type IAuthLogger, type IAuthStorage, JwtAuthService, type LoginCredentials, type LoginResponse, type PasskeyAuthenticationOptions, type RegisterData, type SendOtpResponse, type VerifyOtpFailure, type VerifyOtpResponse, type VerifyOtpSuccess, sessionStore };
+export { type AuthStoreUser, type AuthTokens, type AuthUser, CapacitorAuthStorage, type CapacitorAuthStorageOptions, type CompatSession, type CompatSessionUser, type EnrichedSession, type EnrichedUser, type IAuthApiService, type IAuthLogger, type IAuthStorage, JwtAuthService, type LoginCredentials, type LoginResponse, type NativeSocialSignInConfig, type NativeSocialSignInReason, type NativeSocialSignInResult, type PasskeyAuthenticationOptions, type RegisterData, type SendOtpResponse, type VerifyOtpFailure, type VerifyOtpResponse, type VerifyOtpSuccess, sessionStore, startNativeSocialSignIn };

package/dist/index.d.ts

@@ -78,6 +78,73 @@ interface AuthStoreUser {
     }>;
 }
 
+/**
+ * @ccatto/react-auth - Native social sign-in handoff
+ *
+ * Drives the in-app-browser OAuth flow on native (Capacitor/iOS) and returns the
+ * one-time handoff code. Pair the returned code with
+ * `JwtAuthService.loginWithExchangeCode(code)` to mint app JWTs.
+ *
+ * Why this exists (see @ccatto/capacitor-inapp-auth): OAuth can't run in an
+ * embedded webview, and SFSafariViewController can't return to the app via a
+ * custom scheme. ASWebAuthenticationSession (this plugin) can. The server flow:
+ *
+ *   start → `${baseURL}${startPath}?provider=…`  (initiates OAuth server-side)
+ *   provider auth → web callback → 302 `${callbackScheme}://auth-callback?code=…`
+ *   ASWebAuthenticationSession captures the redirect → we parse `code` here.
+ *
+ * This module hardcodes nothing app-specific — `baseURL` and `callbackScheme`
+ * come from config. `@capacitor/core` and `@ccatto/capacitor-inapp-auth` are
+ * optional peer deps, imported dynamically so web-only consumers never load them.
+ */
+interface NativeSocialSignInConfig {
+    /** Provider key understood by the server route (e.g. 'google', 'apple', 'facebook'). */
+    provider: string;
+    /** Base URL of the web app that hosts the OAuth start route (no trailing slash needed). */
+    baseURL: string;
+    /** Custom URL scheme registered in Info.plist, WITHOUT '://' (e.g. 'myapp'). */
+    callbackScheme: string;
+    /** Server route that initiates OAuth in-session. Default: '/api/mobile-social-start'. */
+    startPath?: string;
+}
+type NativeSocialSignInReason = 
+/** Not running in a native Capacitor context — caller should use the web OAuth redirect. */
+'not_native'
+/** Native, but the InAppAuth plugin isn't installed (old build) — caller should fall back. */
+ | 'plugin_unavailable'
+/** User dismissed the auth sheet. */
+ | 'canceled'
+/** The provider/callback returned an error, or no code came back. */
+ | 'failed';
+type NativeSocialSignInResult = {
+    code: string;
+} | {
+    code?: undefined;
+    error: NativeSocialSignInReason;
+};
+/**
+ * Run the native in-app-browser OAuth handoff. Resolves to `{ code }` on success,
+ * or `{ error }` describing why it didn't complete (so the caller can fall back
+ * to the standard web OAuth redirect when appropriate).
+ *
+ * Never throws — all failure modes are returned as `{ error }`.
+ *
+ * @example
+ * ```ts
+ * const res = await startNativeSocialSignIn({
+ *   provider: 'google',
+ *   baseURL: process.env.NEXT_PUBLIC_BASE_URL!,
+ *   callbackScheme: 'myapp',
+ * });
+ * if ('code' in res && res.code) {
+ *   await authService.loginWithExchangeCode(res.code);
+ * } else if (res.error === 'not_native' || res.error === 'plugin_unavailable') {
+ *   await signInSocialOnWeb(provider); // standard redirect
+ * }
+ * ```
+ */
+declare function startNativeSocialSignIn(config: NativeSocialSignInConfig): Promise<NativeSocialSignInResult>;
+
 /**
  * @ccatto/react-auth - Session Store
  *
@@ -187,6 +254,12 @@ interface IAuthApiService {
     refreshToken(refreshToken: string): Promise<{
         accessToken: string;
     }>;
+    /**
+     * Exchange a one-time mobile-OAuth handoff code (minted by the web
+     * `mobile-auth-callback` route) for app JWTs. Required for native social
+     * sign-in via `startNativeSocialSignIn`; optional otherwise.
+     */
+    exchangeAuthCode?(code: string): Promise<LoginResponse>;
     forgotPassword?(email: string): Promise<{
         message: string;
         resetToken?: string;
@@ -245,6 +318,13 @@ declare class JwtAuthService {
     constructor(storage: IAuthStorage, api: IAuthApiService, logger?: IAuthLogger, options?: JwtAuthServiceOptions);
     /** Login with email and password */
     login(credentials: LoginCredentials): Promise<LoginResponse>;
+    /**
+     * Exchange a one-time mobile-OAuth handoff code for app JWTs and store them.
+     * Used by the native deep-link / in-app-browser social sign-in flow after
+     * {@link startNativeSocialSignIn} returns a `code`. Requires the app's
+     * `IAuthApiService` to implement `exchangeAuthCode`.
+     */
+    loginWithExchangeCode(code: string): Promise<LoginResponse>;
     /** Register new user */
     register(data: RegisterData): Promise<LoginResponse>;
     /** Logout (clear tokens) */
@@ -299,4 +379,4 @@ declare class CapacitorAuthStorage implements IAuthStorage {
     hasTokens(): Promise<boolean>;
 }
 
-export { type AuthStoreUser, type AuthTokens, type AuthUser, CapacitorAuthStorage, type CapacitorAuthStorageOptions, type CompatSession, type CompatSessionUser, type EnrichedSession, type EnrichedUser, type IAuthApiService, type IAuthLogger, type IAuthStorage, JwtAuthService, type LoginCredentials, type LoginResponse, type PasskeyAuthenticationOptions, type RegisterData, type SendOtpResponse, type VerifyOtpFailure, type VerifyOtpResponse, type VerifyOtpSuccess, sessionStore };
+export { type AuthStoreUser, type AuthTokens, type AuthUser, CapacitorAuthStorage, type CapacitorAuthStorageOptions, type CompatSession, type CompatSessionUser, type EnrichedSession, type EnrichedUser, type IAuthApiService, type IAuthLogger, type IAuthStorage, JwtAuthService, type LoginCredentials, type LoginResponse, type NativeSocialSignInConfig, type NativeSocialSignInReason, type NativeSocialSignInResult, type PasskeyAuthenticationOptions, type RegisterData, type SendOtpResponse, type VerifyOtpFailure, type VerifyOtpResponse, type VerifyOtpSuccess, sessionStore, startNativeSocialSignIn };

package/dist/index.js

@@ -1,6 +1,47 @@
 "use client";
 import { Preferences } from '@capacitor/preferences';
 
+// src/client/native-social-signin.ts
+async function startNativeSocialSignIn(config) {
+  let Capacitor;
+  try {
+    ({ Capacitor } = await import('@capacitor/core'));
+  } catch {
+    return { error: "not_native" };
+  }
+  if (!Capacitor.isNativePlatform()) {
+    return { error: "not_native" };
+  }
+  if (!Capacitor.isPluginAvailable("InAppAuth")) {
+    return { error: "plugin_unavailable" };
+  }
+  const base = config.baseURL.replace(/\/$/, "");
+  const startPath = config.startPath ?? "/api/mobile-social-start";
+  const startUrl = `${base}${startPath}?provider=${encodeURIComponent(
+    config.provider
+  )}`;
+  const pluginSpecifier = "@ccatto/capacitor-inapp-auth";
+  try {
+    const { InAppAuth } = await import(pluginSpecifier);
+    const { url } = await InAppAuth.start({
+      url: startUrl,
+      callbackScheme: config.callbackScheme
+    });
+    const params = new URLSearchParams(url.split("?")[1] ?? "");
+    const code = params.get("code");
+    if (params.get("error") || !code) {
+      return { error: "failed" };
+    }
+    return { code };
+  } catch (err) {
+    const message = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+    if (message === "CANCELED") {
+      return { error: "canceled" };
+    }
+    return { error: "failed" };
+  }
+}
+
 // src/client/session-store.ts
 var currentSession = null;
 var listeners = /* @__PURE__ */ new Set();
@@ -61,6 +102,27 @@ var _JwtAuthService = class _JwtAuthService {
       throw error;
     }
   }
+  /**
+   * Exchange a one-time mobile-OAuth handoff code for app JWTs and store them.
+   * Used by the native deep-link / in-app-browser social sign-in flow after
+   * {@link startNativeSocialSignIn} returns a `code`. Requires the app's
+   * `IAuthApiService` to implement `exchangeAuthCode`.
+   */
+  async loginWithExchangeCode(code) {
+    if (!this.api.exchangeAuthCode) {
+      throw new Error("Exchange-code auth not configured");
+    }
+    try {
+      const data = await this.api.exchangeAuthCode(code);
+      await this.storage.setAccessToken(data.accessToken);
+      await this.storage.setRefreshToken(data.refreshToken);
+      this.log.info("Auth code exchange successful", { userId: data.user.id });
+      return data;
+    } catch (error) {
+      this.log.error("Auth code exchange failed", { error });
+      throw error;
+    }
+  }
   /** Register new user */
   async register(data) {
     try {
@@ -316,6 +378,6 @@ var CapacitorAuthStorage = class {
   }
 };
 
-export { CapacitorAuthStorage, JwtAuthService, sessionStore };
+export { CapacitorAuthStorage, JwtAuthService, sessionStore, startNativeSocialSignIn };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client/session-store.ts","../src/services/jwt-auth.service.ts","../src/storage/capacitor-auth-storage.ts"],"names":[],"mappings":";;;AAgBA,IAAI,cAAA,GAAuC,IAAA;AAC3C,IAAM,SAAA,uBAA8D,GAAA,EAAI;AAEjE,IAAM,YAAA,GAAe;AAAA;AAAA,EAE1B,UAAA,GAAmC;AACjC,IAAA,OAAO,iBAAiB,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,cAAA,EAAgB,CAAA,GAAI,IAAA;AAAA,EACjE,CAAA;AAAA;AAAA,EAGA,WAAW,OAAA,EAAqC;AAC9C,IAAA,cAAA,GAAiB,OAAA;AACjB,IAAA,MAAM,QAAA,GAAW,CAAC,GAAG,SAAS,CAAA;AAC9B,IAAA,QAAA,CAAS,OAAA,CAAQ,CAAC,QAAA,KAAa,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,EAClD,CAAA;AAAA;AAAA,EAGA,UAAU,QAAA,EAA+D;AACvE,IAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,IAAA,OAAO,MAAM,SAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,EACxC,CAAA;AAAA;AAAA,EAGA,SAAA,GAA2B;AACzB,IAAA,OAAO,cAAA,EAAgB,MAAM,EAAA,IAAM,IAAA;AAAA,EACrC;AACF;;;ACJA,IAAM,UAAA,GAA0B;AAAA,EAC9B,MAAM,MAAM;AAAA,EAAC,CAAA;AAAA,EACb,MAAM,MAAM;AAAA,EAAC,CAAA;AAAA,EACb,OAAO,MAAM;AAAA,EAAC;AAChB,CAAA;AAOO,IAAM,eAAA,GAAN,MAAM,eAAA,CAAe;AAAA;AAAA,EAY1B,WAAA,CACU,OAAA,EACA,GAAA,EACR,MAAA,EACA,OAAA,EACA;AAJQ,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AATV;AAAA,IAAA,IAAA,CAAQ,cAAA,GAAwD,IAAA;AAGhE;AAAA,IAAA,IAAA,CAAQ,cAAA,GAAyC,IAAA;AACjD,IAAA,IAAA,CAAQ,kBAAA,GAA6B,CAAA;AASnC,IAAA,IAAA,CAAK,MAAM,MAAA,IAAU,UAAA;AACrB,IAAA,IAAA,CAAK,OAAA,GAAU,WAAW,EAAC;AAAA,EAC7B;AAAA;AAAA,EAGA,MAAM,MAAM,WAAA,EAAuD;AACjE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,MAAM,WAAW,CAAA;AAC7C,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,IAAA,CAAK,WAAW,CAAA;AAClD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,IAAA,CAAK,YAAY,CAAA;AACpD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,6BAAA,EAA+B,EAAE,QAAQ,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AACrE,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,cAAA,EAAgB,EAAE,OAAO,CAAA;AACxC,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAA4C;AACzD,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,SAAS,IAAI,CAAA;AAC3C,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,MAAA,CAAO,YAAY,CAAA;AACtD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,8BAAA,EAAgC,EAAE,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,qBAAA,EAAuB,EAAE,OAAO,CAAA;AAC/C,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,MAAA,GAAwB;AAC5B,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAgB;AACxD,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,MAAM,KAAK,GAAA,CAAI,MAAA,CAAO,YAAY,CAAA,CAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MACpD;AAAA,IACF,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,CAAK,QAAQ,WAAA,EAAY;AAC/B,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,iBAAiB,CAAA;AAAA,IACjC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,kBAAA,GAAsC;AAC1C,IAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAgB;AACxD,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,IAC9C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,aAAa,YAAY,CAAA;AACvD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IAChB,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAA,CAAK,QAAQ,WAAA,EAAY;AAC/B,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,sBAAA,EAAwB,EAAE,OAAO,CAAA;AAChD,MAAA,IAAA,CAAK,QAAQ,gBAAA,IAAmB;AAChC,MAAA,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAAA,IACnC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,GAAyC;AAC7C,IAAA,OAAO,IAAA,CAAK,QAAQ,cAAA,EAAe;AAAA,EACrC;AAAA;AAAA,EAGQ,wBAAA,CACN,KAAA,EACA,aAAA,GAAgB,GAAA,EACP;AACT,IAAA,IAAI;AACF,MAAA,IAAI,GAAA;AAGJ,MAAA,IAAI,IAAA,CAAK,cAAA,EAAgB,KAAA,KAAU,KAAA,EAAO;AACxC,QAAA,GAAA,GAAM,KAAK,cAAA,CAAe,GAAA;AAAA,MAC5B,CAAA,MAAO;AACL,QAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AACpC,QAAA,MAAM,MAAA,GAAS,UAAU,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA;AACvC,QAAA,GAAA,GAAM,OAAA,CAAQ,GAAA;AACd,QAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,QAAA,IAAA,CAAK,cAAA,GAAiB,EAAE,KAAA,EAAO,GAAA,EAAI;AAAA,MACrC;AAEA,MAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC/C,MAAA,OAAO,cAAc,GAAA,GAAM,aAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAAA,GAAkD;AACtD,IAAA,IAAI,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA,EAAe;AACtC,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAC;AAEpB,IAAA,IAAI,IAAA,CAAK,wBAAA,CAAyB,KAAK,CAAA,EAAG;AAExC,MAAA,MAAM,gBAAA,GAAmB,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,kBAAA;AAC3C,MAAA,IACE,IAAA,CAAK,kBAAA,GAAqB,CAAA,IAC1B,gBAAA,GAAmB,gBAAe,mBAAA,EAClC;AACA,QAAA,OAAO,EAAC;AAAA,MACV;AAEA,MAAA,IAAI;AACF,QAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AACxB,UAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,kBAAA,EAAmB,CAAE,QAAQ,MAAM;AAC5D,YAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,UACxB,CAAC,CAAA;AAAA,QACH;AACA,QAAA,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA;AACnB,QAAA,IAAA,CAAK,kBAAA,GAAqB,CAAA;AAAA,MAC5B,CAAA,CAAA,MAAQ;AACN,QAAA,IAAA,CAAK,kBAAA,GAAqB,KAAK,GAAA,EAAI;AACnC,QAAA,OAAO,EAAC;AAAA,MACV;AAAA,IACF;AAEA,IAAA,OAAO,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAAA,EAC5C;AAAA;AAAA,EAGA,MAAM,eAAA,GAAoC;AACxC,IAAA,OAAO,IAAA,CAAK,QAAQ,SAAA,EAAU;AAAA,EAChC;AAAA;AAAA,EAGA,MAAM,SAAA,GAA8B;AAClC,IAAA,OAAO,IAAA,CAAK,QAAQ,SAAA,EAAU;AAAA,EAChC;AAAA;AAAA,EAGA,YAAY,KAAA,EAAgC;AAC1C,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AACpC,MAAA,MAAM,MAAA,GAAS,UAAU,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,MAAA,MAAM,WAAA,GAAc,kBAAA;AAAA,QAClB,IAAA,CAAK,MAAM,CAAA,CACR,KAAA,CAAM,EAAE,CAAA,CACR,GAAA,CAAI,CAAC,CAAA,KAAM,GAAA,GAAA,CAAO,IAAA,GAAO,EAAE,UAAA,CAAW,CAAC,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,EAAG,MAAM,CAAA,CAAE,CAAC,CAAA,CAChE,IAAA,CAAK,EAAE;AAAA,OACZ;AACA,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,WAAW,CAAA;AACtC,MAAA,OAAO;AAAA,QACL,IAAI,OAAA,CAAQ,GAAA;AAAA,QACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,QACf,IAAA,EAAM,QAAQ,IAAA,IAAQ,IAAA;AAAA,QACtB,IAAA,EAAM,QAAQ,IAAA,IAAQ,MAAA;AAAA,QACtB,UAAU,OAAA,CAAQ,QAAA;AAAA,QAClB,gBAAgB,OAAA,CAAQ;AAAA,OAC1B;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,GAA2C;AAC/C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA,EAAe;AACxC,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,IAAA,OAAO,IAAA,CAAK,YAAY,KAAK,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAM,gBAAA,GAA2C;AAC/C,IAAA,IACE,CAAC,IAAA,CAAK,GAAA,CAAI,wCACV,CAAC,IAAA,CAAK,IAAI,2BAAA,EACV;AACA,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD;AAEA,IAAA,MAAM,EAAE,mBAAA,EAAqB,uBAAA,EAAwB,GACnD,MAAM,OAAO,yBAAyB,CAAA;AAExC,IAAA,IAAI,CAAC,yBAAwB,EAAG;AAC9B,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,OAAA,EAAS,SAAA,KACf,MAAM,IAAA,CAAK,IAAI,oCAAA,EAAqC;AAEtD,MAAA,MAAM,YAAA,GAAe,MAAM,mBAAA,CAAoB;AAAA,QAC7C,WAAA,EAAa,IAAA,CAAK,KAAA,CAAM,OAAO;AAAA,OAChC,CAAA;AAED,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,2BAAA;AAAA,QAC5B,SAAA;AAAA,QACA,IAAA,CAAK,UAAU,YAAY;AAAA,OAC7B;AAEA,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,MAAA,CAAO,YAAY,CAAA;AAEtD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,yBAAA,EAA2B,EAAE,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACnE,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,iBAAA,EAAmB;AAC9D,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,qBAAA,EAAuB,EAAE,OAAO,CAAA;AAC/C,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,aACJ,WAAA,EACmE;AACnE,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,YAAA,EAAc;AAC1B,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,aAAa,WAAW,CAAA;AACtD,MAAA,IAAI,OAAO,OAAA,EAAS;AAClB,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,UAAA,EAAY,EAAE,aAAa,WAAA,CAAY,KAAA,CAAM,CAAA,CAAE,CAAA,EAAG,CAAA;AAAA,MAClE,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,iBAAA,EAAmB;AAAA,UAC/B,WAAA,EAAa,WAAA,CAAY,KAAA,CAAM,CAAA,CAAE,CAAA;AAAA,UACjC,SAAS,MAAA,CAAO;AAAA,SACjB,CAAA;AAAA,MACH;AACA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,oBAAA,EAAsB,EAAE,OAAO,CAAA;AAC9C,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,CACJ,WAAA,EACA,IAAA,EACiD;AACjD,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,cAAA,EAAgB;AAC5B,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,MAAM,IAAA,CAAK,GAAA,CAAI,cAAA,CAAe,aAAa,IAAI,CAAA;AAE9D,MAAA,IAAI,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,WAAA,IAAe,CAAC,OAAO,YAAA,EAAc;AAClE,QAAA,MAAM,IAAI,KAAA,CAAM,MAAA,CAAO,OAAA,IAAW,qBAAqB,CAAA;AAAA,MACzD;AAEA,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,MAAA,CAAO,YAAY,CAAA;AAEtD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,WAAW,CAAA;AAChD,MAAA,IAAI,CAAC,IAAA,EAAM;AACT,QAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,MAC/C;AAEA,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,uBAAA,EAAyB;AAAA,QACrC,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,WAAW,MAAA,CAAO;AAAA,OACnB,CAAA;AAED,MAAA,OAAO;AAAA,QACL,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,cAAc,MAAA,CAAO,YAAA;AAAA,QACrB,IAAA;AAAA,QACA,SAAA,EAAW,OAAO,SAAA,IAAa;AAAA,OACjC;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,+BAAA,EAAiC,EAAE,OAAO,CAAA;AACzD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AACF,CAAA;AA9Sa,eAAA,CAUI,mBAAA,GAAsB,GAAA;AAVhC,IAAM,cAAA,GAAN;AC/BA,IAAM,uBAAN,MAAmD;AAAA,EAIxD,YAAY,OAAA,EAAuC;AACjD,IAAA,MAAM,MAAA,GAAS,SAAS,SAAA,IAAa,YAAA;AACrC,IAAA,IAAA,CAAK,gBAAA,GAAmB,GAAG,MAAM,CAAA,aAAA,CAAA;AACjC,IAAA,IAAA,CAAK,iBAAA,GAAoB,GAAG,MAAM,CAAA,cAAA,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,eAAe,KAAA,EAA8B;AACjD,IAAA,MAAM,YAAY,GAAA,CAAI;AAAA,MACpB,KAAK,IAAA,CAAK,gBAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,cAAA,GAAyC;AAC7C,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,WAAA,CAAY,IAAI,EAAE,GAAA,EAAK,IAAA,CAAK,gBAAA,EAAkB,CAAA;AACtE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,KAAA,EAA8B;AAClD,IAAA,MAAM,YAAY,GAAA,CAAI;AAAA,MACpB,KAAK,IAAA,CAAK,iBAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,eAAA,GAA0C;AAC9C,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,WAAA,CAAY,IAAI,EAAE,GAAA,EAAK,IAAA,CAAK,iBAAA,EAAmB,CAAA;AACvE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,WAAA,GAA6B;AACjC,IAAA,MAAM,QAAQ,GAAA,CAAI;AAAA,MAChB,YAAY,MAAA,CAAO,EAAE,GAAA,EAAK,IAAA,CAAK,kBAAkB,CAAA;AAAA,MACjD,YAAY,MAAA,CAAO,EAAE,GAAA,EAAK,IAAA,CAAK,mBAAmB;AAAA,KACnD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,SAAA,GAA8B;AAClC,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,cAAA,EAAe;AAC9C,IAAA,OAAO,WAAA,KAAgB,IAAA;AAAA,EACzB;AACF","file":"index.js","sourcesContent":["/**\n * @ccatto/react-auth - Session Store\n *\n * Synchronous session state store for sharing auth session with Apollo Client.\n * Avoids network calls in Apollo's authLink.\n *\n * @example\n * // Write (from SessionSync component in React tree)\n * sessionStore.setSession(session);\n *\n * // Read (from Apollo authLink — synchronous, no network call)\n * const session = sessionStore.getSession();\n */\n\nimport type { CompatSession } from '../types/session';\n\nlet currentSession: CompatSession | null = null;\nconst listeners: Set<(session: CompatSession | null) => void> = new Set();\n\nexport const sessionStore = {\n  /** Get the current session (synchronous, no network call) */\n  getSession(): CompatSession | null {\n    return currentSession ? Object.freeze({ ...currentSession }) : null;\n  },\n\n  /** Update the session (called by SessionSync component) */\n  setSession(session: CompatSession | null): void {\n    currentSession = session;\n    const snapshot = [...listeners];\n    snapshot.forEach((listener) => listener(session));\n  },\n\n  /** Subscribe to session changes */\n  subscribe(listener: (session: CompatSession | null) => void): () => void {\n    listeners.add(listener);\n    return () => listeners.delete(listener);\n  },\n\n  /** Get the user ID from the current session (convenience method) */\n  getUserId(): string | null {\n    return currentSession?.user?.id ?? null;\n  },\n};\n","/**\n * @ccatto/react-auth - JWT Auth Service\n *\n * Platform-agnostic JWT authentication service.\n * Handles token storage, login, register, refresh, and passkey auth.\n *\n * Uses IAuthStorage for token persistence and IAuthApiService for API calls.\n *\n * @example\n * ```typescript\n * import { JwtAuthService, CapacitorAuthStorage } from '@ccatto/react-auth';\n *\n * const storage = new CapacitorAuthStorage({ keyPrefix: 'myapp' });\n * const authService = new JwtAuthService(storage, myApiService, undefined, {\n *   onSessionExpired: () => router.push('/login'),\n * });\n * await authService.login({ email, password });\n * ```\n */\nimport type { IAuthStorage } from '../storage/auth-storage.interface';\nimport type {\n  AuthUser,\n  IAuthApiService,\n  IAuthLogger,\n  LoginCredentials,\n  LoginResponse,\n  RegisterData,\n} from './auth-api.interface';\n\n// Re-export types for convenience\nexport type {\n  AuthUser,\n  LoginCredentials,\n  RegisterData,\n  LoginResponse,\n  AuthTokens,\n} from './auth-api.interface';\n\nconst noopLogger: IAuthLogger = {\n  info: () => {},\n  warn: () => {},\n  error: () => {},\n};\n\nexport interface JwtAuthServiceOptions {\n  /** Called when session expires (refresh token fails). Use to redirect to login. */\n  onSessionExpired?: () => void;\n}\n\nexport class JwtAuthService {\n  private log: IAuthLogger;\n  private options: JwtAuthServiceOptions;\n\n  // Fix 7: Cache token expiry to avoid re-parsing JWT on every getAuthHeaders()\n  private cachedTokenExp: { token: string; exp: number } | null = null;\n\n  // Fix 5: Refresh deduplication + cooldown after failure\n  private refreshPromise: Promise<string> | null = null;\n  private lastRefreshFailure: number = 0;\n  private static REFRESH_COOLDOWN_MS = 5000; // 5 second cooldown after failure\n\n  constructor(\n    private storage: IAuthStorage,\n    private api: IAuthApiService,\n    logger?: IAuthLogger,\n    options?: JwtAuthServiceOptions,\n  ) {\n    this.log = logger || noopLogger;\n    this.options = options || {};\n  }\n\n  /** Login with email and password */\n  async login(credentials: LoginCredentials): Promise<LoginResponse> {\n    try {\n      const data = await this.api.login(credentials);\n      await this.storage.setAccessToken(data.accessToken);\n      await this.storage.setRefreshToken(data.refreshToken);\n      this.log.info('User logged in successfully', { userId: data.user.id });\n      return data;\n    } catch (error) {\n      this.log.error('Login failed', { error });\n      throw error;\n    }\n  }\n\n  /** Register new user */\n  async register(data: RegisterData): Promise<LoginResponse> {\n    try {\n      const result = await this.api.register(data);\n      await this.storage.setAccessToken(result.accessToken);\n      await this.storage.setRefreshToken(result.refreshToken);\n      this.log.info('User registered successfully', { userId: result.user.id });\n      return result;\n    } catch (error) {\n      this.log.error('Registration failed', { error });\n      throw error;\n    }\n  }\n\n  /** Logout (clear tokens) */\n  async logout(): Promise<void> {\n    try {\n      const refreshToken = await this.storage.getRefreshToken();\n      if (refreshToken) {\n        await this.api.logout(refreshToken).catch(() => {});\n      }\n    } finally {\n      await this.storage.clearTokens();\n      this.cachedTokenExp = null;\n      this.log.info('User logged out');\n    }\n  }\n\n  /** Refresh access token */\n  async refreshAccessToken(): Promise<string> {\n    const refreshToken = await this.storage.getRefreshToken();\n    if (!refreshToken) {\n      throw new Error('No refresh token available');\n    }\n\n    try {\n      const result = await this.api.refreshToken(refreshToken);\n      await this.storage.setAccessToken(result.accessToken);\n      return result.accessToken;\n    } catch (error) {\n      await this.storage.clearTokens();\n      this.cachedTokenExp = null;\n      this.log.error('Token refresh failed', { error });\n      this.options.onSessionExpired?.();\n      throw new Error('Session expired');\n    }\n  }\n\n  /** Get current access token */\n  async getAccessToken(): Promise<string | null> {\n    return this.storage.getAccessToken();\n  }\n\n  /** Check if a JWT token is expired or about to expire */\n  private isTokenExpiredOrExpiring(\n    token: string,\n    bufferSeconds = 120,\n  ): boolean {\n    try {\n      let exp: number;\n\n      // Fix 7: Use cached expiry if token hasn't changed\n      if (this.cachedTokenExp?.token === token) {\n        exp = this.cachedTokenExp.exp;\n      } else {\n        const base64Url = token.split('.')[1];\n        const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');\n        const payload = JSON.parse(atob(base64));\n        exp = payload.exp;\n        if (!exp) return true;\n        this.cachedTokenExp = { token, exp };\n      }\n\n      const nowSeconds = Math.floor(Date.now() / 1000);\n      return nowSeconds >= exp - bufferSeconds;\n    } catch {\n      return true;\n    }\n  }\n\n  /**\n   * Get auth headers for API requests.\n   * Proactively refreshes the access token if it's expired or about to expire.\n   * Includes cooldown to prevent repeated refresh attempts after failure.\n   */\n  async getAuthHeaders(): Promise<Record<string, string>> {\n    let token = await this.getAccessToken();\n    if (!token) return {};\n\n    if (this.isTokenExpiredOrExpiring(token)) {\n      // Fix 5: Skip refresh if we recently failed (cooldown)\n      const timeSinceFailure = Date.now() - this.lastRefreshFailure;\n      if (\n        this.lastRefreshFailure > 0 &&\n        timeSinceFailure < JwtAuthService.REFRESH_COOLDOWN_MS\n      ) {\n        return {};\n      }\n\n      try {\n        if (!this.refreshPromise) {\n          this.refreshPromise = this.refreshAccessToken().finally(() => {\n            this.refreshPromise = null;\n          });\n        }\n        token = await this.refreshPromise;\n        this.lastRefreshFailure = 0;\n      } catch {\n        this.lastRefreshFailure = Date.now();\n        return {};\n      }\n    }\n\n    return { Authorization: `Bearer ${token}` };\n  }\n\n  /** Check if user is authenticated */\n  async isAuthenticated(): Promise<boolean> {\n    return this.storage.hasTokens();\n  }\n\n  /** Check if tokens exist in storage */\n  async hasTokens(): Promise<boolean> {\n    return this.storage.hasTokens();\n  }\n\n  /** Decode JWT token (client-side only — for user info, NOT for security) */\n  decodeToken(token: string): AuthUser | null {\n    try {\n      const base64Url = token.split('.')[1];\n      const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');\n      const jsonPayload = decodeURIComponent(\n        atob(base64)\n          .split('')\n          .map((c) => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))\n          .join(''),\n      );\n      const payload = JSON.parse(jsonPayload);\n      return {\n        id: payload.sub,\n        email: payload.email,\n        name: payload.name || null,\n        role: payload.role || 'user',\n        playerID: payload.playerID,\n        organizationId: payload.organizationId,\n      };\n    } catch {\n      return null;\n    }\n  }\n\n  /** Get current user from token (client-side decode) */\n  async getCurrentUser(): Promise<AuthUser | null> {\n    const token = await this.getAccessToken();\n    if (!token) return null;\n    return this.decodeToken(token);\n  }\n\n  /** Login with passkey (WebAuthn/FIDO2) */\n  async loginWithPasskey(): Promise<LoginResponse> {\n    if (\n      !this.api.generatePasskeyAuthenticationOptions ||\n      !this.api.verifyPasskeyAuthentication\n    ) {\n      throw new Error('Passkey authentication not configured');\n    }\n\n    const { startAuthentication, browserSupportsWebAuthn } =\n      await import('@simplewebauthn/browser');\n\n    if (!browserSupportsWebAuthn()) {\n      throw new Error('WebAuthn is not supported on this device');\n    }\n\n    try {\n      const { options, sessionId } =\n        await this.api.generatePasskeyAuthenticationOptions();\n\n      const authResponse = await startAuthentication({\n        optionsJSON: JSON.parse(options),\n      });\n\n      const result = await this.api.verifyPasskeyAuthentication(\n        sessionId,\n        JSON.stringify(authResponse),\n      );\n\n      await this.storage.setAccessToken(result.accessToken);\n      await this.storage.setRefreshToken(result.refreshToken);\n\n      this.log.info('Passkey auth successful', { userId: result.user.id });\n      return result;\n    } catch (error) {\n      if (error instanceof Error && error.name === 'NotAllowedError') {\n        throw new Error('Passkey authentication was cancelled');\n      }\n      this.log.error('Passkey auth failed', { error });\n      throw error;\n    }\n  }\n\n  /** Send OTP to phone number for phone-based login */\n  async sendPhoneOtp(\n    phoneNumber: string,\n  ): Promise<{ success: boolean; message: string; expiresIn: number }> {\n    if (!this.api.sendPhoneOtp) {\n      throw new Error('Phone OTP not configured');\n    }\n\n    try {\n      const result = await this.api.sendPhoneOtp(phoneNumber);\n      if (result.success) {\n        this.log.info('OTP sent', { phoneNumber: phoneNumber.slice(-4) });\n      } else {\n        this.log.warn('OTP send failed', {\n          phoneNumber: phoneNumber.slice(-4),\n          message: result.message,\n        });\n      }\n      return result;\n    } catch (error) {\n      this.log.error('Failed to send OTP', { error });\n      throw error;\n    }\n  }\n\n  /** Verify OTP and login/register user */\n  async verifyPhoneOtp(\n    phoneNumber: string,\n    code: string,\n  ): Promise<LoginResponse & { isNewUser: boolean }> {\n    if (!this.api.verifyPhoneOtp) {\n      throw new Error('Phone OTP not configured');\n    }\n\n    try {\n      const result = await this.api.verifyPhoneOtp(phoneNumber, code);\n\n      if (!result.success || !result.accessToken || !result.refreshToken) {\n        throw new Error(result.message || 'Verification failed');\n      }\n\n      await this.storage.setAccessToken(result.accessToken);\n      await this.storage.setRefreshToken(result.refreshToken);\n\n      const user = this.decodeToken(result.accessToken);\n      if (!user) {\n        throw new Error('Failed to decode user token');\n      }\n\n      this.log.info('Phone auth successful', {\n        userId: user.id,\n        isNewUser: result.isNewUser,\n      });\n\n      return {\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n        user,\n        isNewUser: result.isNewUser ?? false,\n      };\n    } catch (error) {\n      this.log.error('Phone OTP verification failed', { error });\n      throw error;\n    }\n  }\n}\n","/**\n * @ccatto/react-auth - Capacitor Auth Storage\n *\n * Capacitor-based auth storage using @capacitor/preferences.\n * Works on BOTH web and mobile (no platform detection needed!).\n *\n * - Web: Uses localStorage\n * - iOS: Uses UserDefaults/Keychain\n * - Android: Uses SharedPreferences\n */\nimport { Preferences } from '@capacitor/preferences';\nimport type { IAuthStorage } from './auth-storage.interface';\n\nexport interface CapacitorAuthStorageOptions {\n  /** Key prefix for stored tokens (default: 'catto_auth') */\n  keyPrefix?: string;\n}\n\nexport class CapacitorAuthStorage implements IAuthStorage {\n  private readonly ACCESS_TOKEN_KEY: string;\n  private readonly REFRESH_TOKEN_KEY: string;\n\n  constructor(options?: CapacitorAuthStorageOptions) {\n    const prefix = options?.keyPrefix ?? 'catto_auth';\n    this.ACCESS_TOKEN_KEY = `${prefix}_access_token`;\n    this.REFRESH_TOKEN_KEY = `${prefix}_refresh_token`;\n  }\n\n  async setAccessToken(token: string): Promise<void> {\n    await Preferences.set({\n      key: this.ACCESS_TOKEN_KEY,\n      value: token,\n    });\n  }\n\n  async getAccessToken(): Promise<string | null> {\n    const { value } = await Preferences.get({ key: this.ACCESS_TOKEN_KEY });\n    return value;\n  }\n\n  async setRefreshToken(token: string): Promise<void> {\n    await Preferences.set({\n      key: this.REFRESH_TOKEN_KEY,\n      value: token,\n    });\n  }\n\n  async getRefreshToken(): Promise<string | null> {\n    const { value } = await Preferences.get({ key: this.REFRESH_TOKEN_KEY });\n    return value;\n  }\n\n  async clearTokens(): Promise<void> {\n    await Promise.all([\n      Preferences.remove({ key: this.ACCESS_TOKEN_KEY }),\n      Preferences.remove({ key: this.REFRESH_TOKEN_KEY }),\n    ]);\n  }\n\n  async hasTokens(): Promise<boolean> {\n    const accessToken = await this.getAccessToken();\n    return accessToken !== null;\n  }\n}\n"]}
+{"version":3,"sources":["../src/client/native-social-signin.ts","../src/client/session-store.ts","../src/services/jwt-auth.service.ts","../src/storage/capacitor-auth-storage.ts"],"names":[],"mappings":";;;AAkEA,eAAsB,wBACpB,MAAA,EACmC;AACnC,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAC,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,iBAAiB,CAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,OAAO,YAAA,EAAa;AAAA,EAC/B;AAEA,EAAA,IAAI,CAAC,SAAA,CAAU,gBAAA,EAAiB,EAAG;AACjC,IAAA,OAAO,EAAE,OAAO,YAAA,EAAa;AAAA,EAC/B;AACA,EAAA,IAAI,CAAC,SAAA,CAAU,iBAAA,CAAkB,WAAW,CAAA,EAAG;AAC7C,IAAA,OAAO,EAAE,OAAO,oBAAA,EAAqB;AAAA,EACvC;AAEA,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7C,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,0BAAA;AACtC,EAAA,MAAM,QAAA,GAAW,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,UAAA,EAAa,kBAAA;AAAA,IAC/C,MAAA,CAAO;AAAA,GACR,CAAA,CAAA;AAcD,EAAA,MAAM,eAAA,GAAkB,8BAAA;AAExB,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,SAAA,EAAU,GAAK,MAAM,OAAO,eAAA,CAAA;AACpC,IAAA,MAAM,EAAE,GAAA,EAAI,GAAI,MAAM,UAAU,KAAA,CAAM;AAAA,MACpC,GAAA,EAAK,QAAA;AAAA,MACL,gBAAgB,MAAA,CAAO;AAAA,KACxB,CAAA;AAED,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,GAAA,CAAI,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAE,CAAA;AAC1D,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,CAAC,IAAA,EAAM;AAChC,MAAA,OAAO,EAAE,OAAO,QAAA,EAAS;AAAA,IAC3B;AACA,IAAA,OAAO,EAAE,IAAA,EAAK;AAAA,EAChB,SAAS,GAAA,EAAK;AAEZ,IAAA,MAAM,OAAA,GACJ,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,UAAU,GAAA,GACxC,MAAA,CAAQ,GAAA,CAA2B,IAAI,CAAA,GACvC,EAAA;AACN,IAAA,IAAI,YAAY,UAAA,EAAY;AAC1B,MAAA,OAAO,EAAE,OAAO,UAAA,EAAW;AAAA,IAC7B;AACA,IAAA,OAAO,EAAE,OAAO,QAAA,EAAS;AAAA,EAC3B;AACF;;;AC/GA,IAAI,cAAA,GAAuC,IAAA;AAC3C,IAAM,SAAA,uBAA8D,GAAA,EAAI;AAEjE,IAAM,YAAA,GAAe;AAAA;AAAA,EAE1B,UAAA,GAAmC;AACjC,IAAA,OAAO,iBAAiB,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,cAAA,EAAgB,CAAA,GAAI,IAAA;AAAA,EACjE,CAAA;AAAA;AAAA,EAGA,WAAW,OAAA,EAAqC;AAC9C,IAAA,cAAA,GAAiB,OAAA;AACjB,IAAA,MAAM,QAAA,GAAW,CAAC,GAAG,SAAS,CAAA;AAC9B,IAAA,QAAA,CAAS,OAAA,CAAQ,CAAC,QAAA,KAAa,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,EAClD,CAAA;AAAA;AAAA,EAGA,UAAU,QAAA,EAA+D;AACvE,IAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,IAAA,OAAO,MAAM,SAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,EACxC,CAAA;AAAA;AAAA,EAGA,SAAA,GAA2B;AACzB,IAAA,OAAO,cAAA,EAAgB,MAAM,EAAA,IAAM,IAAA;AAAA,EACrC;AACF;;;ACJA,IAAM,UAAA,GAA0B;AAAA,EAC9B,MAAM,MAAM;AAAA,EAAC,CAAA;AAAA,EACb,MAAM,MAAM;AAAA,EAAC,CAAA;AAAA,EACb,OAAO,MAAM;AAAA,EAAC;AAChB,CAAA;AAOO,IAAM,eAAA,GAAN,MAAM,eAAA,CAAe;AAAA;AAAA,EAY1B,WAAA,CACU,OAAA,EACA,GAAA,EACR,MAAA,EACA,OAAA,EACA;AAJQ,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AATV;AAAA,IAAA,IAAA,CAAQ,cAAA,GAAwD,IAAA;AAGhE;AAAA,IAAA,IAAA,CAAQ,cAAA,GAAyC,IAAA;AACjD,IAAA,IAAA,CAAQ,kBAAA,GAA6B,CAAA;AASnC,IAAA,IAAA,CAAK,MAAM,MAAA,IAAU,UAAA;AACrB,IAAA,IAAA,CAAK,OAAA,GAAU,WAAW,EAAC;AAAA,EAC7B;AAAA;AAAA,EAGA,MAAM,MAAM,WAAA,EAAuD;AACjE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,MAAM,WAAW,CAAA;AAC7C,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,IAAA,CAAK,WAAW,CAAA;AAClD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,IAAA,CAAK,YAAY,CAAA;AACpD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,6BAAA,EAA+B,EAAE,QAAQ,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AACrE,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,cAAA,EAAgB,EAAE,OAAO,CAAA;AACxC,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,sBAAsB,IAAA,EAAsC;AAChE,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,gBAAA,EAAkB;AAC9B,MAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,IACrD;AACA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,iBAAiB,IAAI,CAAA;AACjD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,IAAA,CAAK,WAAW,CAAA;AAClD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,IAAA,CAAK,YAAY,CAAA;AACpD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,+BAAA,EAAiC,EAAE,QAAQ,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AACvE,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,2BAAA,EAA6B,EAAE,OAAO,CAAA;AACrD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAA4C;AACzD,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,SAAS,IAAI,CAAA;AAC3C,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,MAAA,CAAO,YAAY,CAAA;AACtD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,8BAAA,EAAgC,EAAE,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,qBAAA,EAAuB,EAAE,OAAO,CAAA;AAC/C,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,MAAA,GAAwB;AAC5B,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAgB;AACxD,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,MAAM,KAAK,GAAA,CAAI,MAAA,CAAO,YAAY,CAAA,CAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MACpD;AAAA,IACF,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,CAAK,QAAQ,WAAA,EAAY;AAC/B,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,iBAAiB,CAAA;AAAA,IACjC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,kBAAA,GAAsC;AAC1C,IAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAgB;AACxD,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,IAC9C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,aAAa,YAAY,CAAA;AACvD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IAChB,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAA,CAAK,QAAQ,WAAA,EAAY;AAC/B,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,sBAAA,EAAwB,EAAE,OAAO,CAAA;AAChD,MAAA,IAAA,CAAK,QAAQ,gBAAA,IAAmB;AAChC,MAAA,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAAA,IACnC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,GAAyC;AAC7C,IAAA,OAAO,IAAA,CAAK,QAAQ,cAAA,EAAe;AAAA,EACrC;AAAA;AAAA,EAGQ,wBAAA,CACN,KAAA,EACA,aAAA,GAAgB,GAAA,EACP;AACT,IAAA,IAAI;AACF,MAAA,IAAI,GAAA;AAGJ,MAAA,IAAI,IAAA,CAAK,cAAA,EAAgB,KAAA,KAAU,KAAA,EAAO;AACxC,QAAA,GAAA,GAAM,KAAK,cAAA,CAAe,GAAA;AAAA,MAC5B,CAAA,MAAO;AACL,QAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AACpC,QAAA,MAAM,MAAA,GAAS,UAAU,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA;AACvC,QAAA,GAAA,GAAM,OAAA,CAAQ,GAAA;AACd,QAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,QAAA,IAAA,CAAK,cAAA,GAAiB,EAAE,KAAA,EAAO,GAAA,EAAI;AAAA,MACrC;AAEA,MAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC/C,MAAA,OAAO,cAAc,GAAA,GAAM,aAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAAA,GAAkD;AACtD,IAAA,IAAI,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA,EAAe;AACtC,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAC;AAEpB,IAAA,IAAI,IAAA,CAAK,wBAAA,CAAyB,KAAK,CAAA,EAAG;AAExC,MAAA,MAAM,gBAAA,GAAmB,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,kBAAA;AAC3C,MAAA,IACE,IAAA,CAAK,kBAAA,GAAqB,CAAA,IAC1B,gBAAA,GAAmB,gBAAe,mBAAA,EAClC;AACA,QAAA,OAAO,EAAC;AAAA,MACV;AAEA,MAAA,IAAI;AACF,QAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AACxB,UAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,kBAAA,EAAmB,CAAE,QAAQ,MAAM;AAC5D,YAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,UACxB,CAAC,CAAA;AAAA,QACH;AACA,QAAA,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA;AACnB,QAAA,IAAA,CAAK,kBAAA,GAAqB,CAAA;AAAA,MAC5B,CAAA,CAAA,MAAQ;AACN,QAAA,IAAA,CAAK,kBAAA,GAAqB,KAAK,GAAA,EAAI;AACnC,QAAA,OAAO,EAAC;AAAA,MACV;AAAA,IACF;AAEA,IAAA,OAAO,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAAA,EAC5C;AAAA;AAAA,EAGA,MAAM,eAAA,GAAoC;AACxC,IAAA,OAAO,IAAA,CAAK,QAAQ,SAAA,EAAU;AAAA,EAChC;AAAA;AAAA,EAGA,MAAM,SAAA,GAA8B;AAClC,IAAA,OAAO,IAAA,CAAK,QAAQ,SAAA,EAAU;AAAA,EAChC;AAAA;AAAA,EAGA,YAAY,KAAA,EAAgC;AAC1C,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AACpC,MAAA,MAAM,MAAA,GAAS,UAAU,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,MAAA,MAAM,WAAA,GAAc,kBAAA;AAAA,QAClB,IAAA,CAAK,MAAM,CAAA,CACR,KAAA,CAAM,EAAE,CAAA,CACR,GAAA,CAAI,CAAC,CAAA,KAAM,GAAA,GAAA,CAAO,IAAA,GAAO,EAAE,UAAA,CAAW,CAAC,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,EAAG,MAAM,CAAA,CAAE,CAAC,CAAA,CAChE,IAAA,CAAK,EAAE;AAAA,OACZ;AACA,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,WAAW,CAAA;AACtC,MAAA,OAAO;AAAA,QACL,IAAI,OAAA,CAAQ,GAAA;AAAA,QACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,QACf,IAAA,EAAM,QAAQ,IAAA,IAAQ,IAAA;AAAA,QACtB,IAAA,EAAM,QAAQ,IAAA,IAAQ,MAAA;AAAA,QACtB,UAAU,OAAA,CAAQ,QAAA;AAAA,QAClB,gBAAgB,OAAA,CAAQ;AAAA,OAC1B;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,GAA2C;AAC/C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA,EAAe;AACxC,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,IAAA,OAAO,IAAA,CAAK,YAAY,KAAK,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAM,gBAAA,GAA2C;AAC/C,IAAA,IACE,CAAC,IAAA,CAAK,GAAA,CAAI,wCACV,CAAC,IAAA,CAAK,IAAI,2BAAA,EACV;AACA,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD;AAEA,IAAA,MAAM,EAAE,mBAAA,EAAqB,uBAAA,EAAwB,GACnD,MAAM,OAAO,yBAAyB,CAAA;AAExC,IAAA,IAAI,CAAC,yBAAwB,EAAG;AAC9B,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,OAAA,EAAS,SAAA,KACf,MAAM,IAAA,CAAK,IAAI,oCAAA,EAAqC;AAEtD,MAAA,MAAM,YAAA,GAAe,MAAM,mBAAA,CAAoB;AAAA,QAC7C,WAAA,EAAa,IAAA,CAAK,KAAA,CAAM,OAAO;AAAA,OAChC,CAAA;AAED,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,2BAAA;AAAA,QAC5B,SAAA;AAAA,QACA,IAAA,CAAK,UAAU,YAAY;AAAA,OAC7B;AAEA,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,MAAA,CAAO,YAAY,CAAA;AAEtD,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,yBAAA,EAA2B,EAAE,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACnE,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,iBAAA,EAAmB;AAC9D,QAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,MACxD;AACA,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,qBAAA,EAAuB,EAAE,OAAO,CAAA;AAC/C,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,aACJ,WAAA,EACmE;AACnE,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,YAAA,EAAc;AAC1B,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI,aAAa,WAAW,CAAA;AACtD,MAAA,IAAI,OAAO,OAAA,EAAS;AAClB,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,UAAA,EAAY,EAAE,aAAa,WAAA,CAAY,KAAA,CAAM,CAAA,CAAE,CAAA,EAAG,CAAA;AAAA,MAClE,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,iBAAA,EAAmB;AAAA,UAC/B,WAAA,EAAa,WAAA,CAAY,KAAA,CAAM,CAAA,CAAE,CAAA;AAAA,UACjC,SAAS,MAAA,CAAO;AAAA,SACjB,CAAA;AAAA,MACH;AACA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,oBAAA,EAAsB,EAAE,OAAO,CAAA;AAC9C,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,CACJ,WAAA,EACA,IAAA,EACiD;AACjD,IAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,cAAA,EAAgB;AAC5B,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,MAAM,IAAA,CAAK,GAAA,CAAI,cAAA,CAAe,aAAa,IAAI,CAAA;AAE9D,MAAA,IAAI,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,WAAA,IAAe,CAAC,OAAO,YAAA,EAAc;AAClE,QAAA,MAAM,IAAI,KAAA,CAAM,MAAA,CAAO,OAAA,IAAW,qBAAqB,CAAA;AAAA,MACzD;AAEA,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,cAAA,CAAe,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,eAAA,CAAgB,MAAA,CAAO,YAAY,CAAA;AAEtD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,WAAW,CAAA;AAChD,MAAA,IAAI,CAAC,IAAA,EAAM;AACT,QAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,MAC/C;AAEA,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,uBAAA,EAAyB;AAAA,QACrC,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,WAAW,MAAA,CAAO;AAAA,OACnB,CAAA;AAED,MAAA,OAAO;AAAA,QACL,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,cAAc,MAAA,CAAO,YAAA;AAAA,QACrB,IAAA;AAAA,QACA,SAAA,EAAW,OAAO,SAAA,IAAa;AAAA,OACjC;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,+BAAA,EAAiC,EAAE,OAAO,CAAA;AACzD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AACF,CAAA;AApUa,eAAA,CAUI,mBAAA,GAAsB,GAAA;AAVhC,IAAM,cAAA,GAAN;AC/BA,IAAM,uBAAN,MAAmD;AAAA,EAIxD,YAAY,OAAA,EAAuC;AACjD,IAAA,MAAM,MAAA,GAAS,SAAS,SAAA,IAAa,YAAA;AACrC,IAAA,IAAA,CAAK,gBAAA,GAAmB,GAAG,MAAM,CAAA,aAAA,CAAA;AACjC,IAAA,IAAA,CAAK,iBAAA,GAAoB,GAAG,MAAM,CAAA,cAAA,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,eAAe,KAAA,EAA8B;AACjD,IAAA,MAAM,YAAY,GAAA,CAAI;AAAA,MACpB,KAAK,IAAA,CAAK,gBAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,cAAA,GAAyC;AAC7C,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,WAAA,CAAY,IAAI,EAAE,GAAA,EAAK,IAAA,CAAK,gBAAA,EAAkB,CAAA;AACtE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,KAAA,EAA8B;AAClD,IAAA,MAAM,YAAY,GAAA,CAAI;AAAA,MACpB,KAAK,IAAA,CAAK,iBAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,eAAA,GAA0C;AAC9C,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,WAAA,CAAY,IAAI,EAAE,GAAA,EAAK,IAAA,CAAK,iBAAA,EAAmB,CAAA;AACvE,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,WAAA,GAA6B;AACjC,IAAA,MAAM,QAAQ,GAAA,CAAI;AAAA,MAChB,YAAY,MAAA,CAAO,EAAE,GAAA,EAAK,IAAA,CAAK,kBAAkB,CAAA;AAAA,MACjD,YAAY,MAAA,CAAO,EAAE,GAAA,EAAK,IAAA,CAAK,mBAAmB;AAAA,KACnD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,SAAA,GAA8B;AAClC,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,cAAA,EAAe;AAC9C,IAAA,OAAO,WAAA,KAAgB,IAAA;AAAA,EACzB;AACF","file":"index.js","sourcesContent":["/**\n * @ccatto/react-auth - Native social sign-in handoff\n *\n * Drives the in-app-browser OAuth flow on native (Capacitor/iOS) and returns the\n * one-time handoff code. Pair the returned code with\n * `JwtAuthService.loginWithExchangeCode(code)` to mint app JWTs.\n *\n * Why this exists (see @ccatto/capacitor-inapp-auth): OAuth can't run in an\n * embedded webview, and SFSafariViewController can't return to the app via a\n * custom scheme. ASWebAuthenticationSession (this plugin) can. The server flow:\n *\n *   start → `${baseURL}${startPath}?provider=…`  (initiates OAuth server-side)\n *   provider auth → web callback → 302 `${callbackScheme}://auth-callback?code=…`\n *   ASWebAuthenticationSession captures the redirect → we parse `code` here.\n *\n * This module hardcodes nothing app-specific — `baseURL` and `callbackScheme`\n * come from config. `@capacitor/core` and `@ccatto/capacitor-inapp-auth` are\n * optional peer deps, imported dynamically so web-only consumers never load them.\n */\n\nexport interface NativeSocialSignInConfig {\n  /** Provider key understood by the server route (e.g. 'google', 'apple', 'facebook'). */\n  provider: string;\n  /** Base URL of the web app that hosts the OAuth start route (no trailing slash needed). */\n  baseURL: string;\n  /** Custom URL scheme registered in Info.plist, WITHOUT '://' (e.g. 'myapp'). */\n  callbackScheme: string;\n  /** Server route that initiates OAuth in-session. Default: '/api/mobile-social-start'. */\n  startPath?: string;\n}\n\nexport type NativeSocialSignInReason =\n  /** Not running in a native Capacitor context — caller should use the web OAuth redirect. */\n  | 'not_native'\n  /** Native, but the InAppAuth plugin isn't installed (old build) — caller should fall back. */\n  | 'plugin_unavailable'\n  /** User dismissed the auth sheet. */\n  | 'canceled'\n  /** The provider/callback returned an error, or no code came back. */\n  | 'failed';\n\nexport type NativeSocialSignInResult =\n  | { code: string }\n  | { code?: undefined; error: NativeSocialSignInReason };\n\n/**\n * Run the native in-app-browser OAuth handoff. Resolves to `{ code }` on success,\n * or `{ error }` describing why it didn't complete (so the caller can fall back\n * to the standard web OAuth redirect when appropriate).\n *\n * Never throws — all failure modes are returned as `{ error }`.\n *\n * @example\n * ```ts\n * const res = await startNativeSocialSignIn({\n *   provider: 'google',\n *   baseURL: process.env.NEXT_PUBLIC_BASE_URL!,\n *   callbackScheme: 'myapp',\n * });\n * if ('code' in res && res.code) {\n *   await authService.loginWithExchangeCode(res.code);\n * } else if (res.error === 'not_native' || res.error === 'plugin_unavailable') {\n *   await signInSocialOnWeb(provider); // standard redirect\n * }\n * ```\n */\nexport async function startNativeSocialSignIn(\n  config: NativeSocialSignInConfig,\n): Promise<NativeSocialSignInResult> {\n  let Capacitor: typeof import('@capacitor/core').Capacitor;\n  try {\n    ({ Capacitor } = await import('@capacitor/core'));\n  } catch {\n    return { error: 'not_native' };\n  }\n\n  if (!Capacitor.isNativePlatform()) {\n    return { error: 'not_native' };\n  }\n  if (!Capacitor.isPluginAvailable('InAppAuth')) {\n    return { error: 'plugin_unavailable' };\n  }\n\n  const base = config.baseURL.replace(/\\/$/, '');\n  const startPath = config.startPath ?? '/api/mobile-social-start';\n  const startUrl = `${base}${startPath}?provider=${encodeURIComponent(\n    config.provider,\n  )}`;\n\n  // Optional peer dep: import via a non-literal specifier with a local type so\n  // react-auth's type build never hard-depends on the plugin's .d.ts (it may be\n  // unbuilt in a fresh monorepo checkout, or absent entirely in a web-only\n  // consumer that doesn't install it).\n  type InAppAuthModule = {\n    InAppAuth: {\n      start(opts: {\n        url: string;\n        callbackScheme: string;\n      }): Promise<{ url: string }>;\n    };\n  };\n  const pluginSpecifier = '@ccatto/capacitor-inapp-auth';\n\n  try {\n    const { InAppAuth } = (await import(pluginSpecifier)) as InAppAuthModule;\n    const { url } = await InAppAuth.start({\n      url: startUrl,\n      callbackScheme: config.callbackScheme,\n    });\n\n    const params = new URLSearchParams(url.split('?')[1] ?? '');\n    const code = params.get('code');\n    if (params.get('error') || !code) {\n      return { error: 'failed' };\n    }\n    return { code };\n  } catch (err) {\n    // The plugin rejects with code \"CANCELED\" when the user dismisses the sheet.\n    const message =\n      err && typeof err === 'object' && 'code' in err\n        ? String((err as { code?: unknown }).code)\n        : '';\n    if (message === 'CANCELED') {\n      return { error: 'canceled' };\n    }\n    return { error: 'failed' };\n  }\n}\n","/**\n * @ccatto/react-auth - Session Store\n *\n * Synchronous session state store for sharing auth session with Apollo Client.\n * Avoids network calls in Apollo's authLink.\n *\n * @example\n * // Write (from SessionSync component in React tree)\n * sessionStore.setSession(session);\n *\n * // Read (from Apollo authLink — synchronous, no network call)\n * const session = sessionStore.getSession();\n */\n\nimport type { CompatSession } from '../types/session';\n\nlet currentSession: CompatSession | null = null;\nconst listeners: Set<(session: CompatSession | null) => void> = new Set();\n\nexport const sessionStore = {\n  /** Get the current session (synchronous, no network call) */\n  getSession(): CompatSession | null {\n    return currentSession ? Object.freeze({ ...currentSession }) : null;\n  },\n\n  /** Update the session (called by SessionSync component) */\n  setSession(session: CompatSession | null): void {\n    currentSession = session;\n    const snapshot = [...listeners];\n    snapshot.forEach((listener) => listener(session));\n  },\n\n  /** Subscribe to session changes */\n  subscribe(listener: (session: CompatSession | null) => void): () => void {\n    listeners.add(listener);\n    return () => listeners.delete(listener);\n  },\n\n  /** Get the user ID from the current session (convenience method) */\n  getUserId(): string | null {\n    return currentSession?.user?.id ?? null;\n  },\n};\n","/**\n * @ccatto/react-auth - JWT Auth Service\n *\n * Platform-agnostic JWT authentication service.\n * Handles token storage, login, register, refresh, and passkey auth.\n *\n * Uses IAuthStorage for token persistence and IAuthApiService for API calls.\n *\n * @example\n * ```typescript\n * import { JwtAuthService, CapacitorAuthStorage } from '@ccatto/react-auth';\n *\n * const storage = new CapacitorAuthStorage({ keyPrefix: 'myapp' });\n * const authService = new JwtAuthService(storage, myApiService, undefined, {\n *   onSessionExpired: () => router.push('/login'),\n * });\n * await authService.login({ email, password });\n * ```\n */\nimport type { IAuthStorage } from '../storage/auth-storage.interface';\nimport type {\n  AuthUser,\n  IAuthApiService,\n  IAuthLogger,\n  LoginCredentials,\n  LoginResponse,\n  RegisterData,\n} from './auth-api.interface';\n\n// Re-export types for convenience\nexport type {\n  AuthUser,\n  LoginCredentials,\n  RegisterData,\n  LoginResponse,\n  AuthTokens,\n} from './auth-api.interface';\n\nconst noopLogger: IAuthLogger = {\n  info: () => {},\n  warn: () => {},\n  error: () => {},\n};\n\nexport interface JwtAuthServiceOptions {\n  /** Called when session expires (refresh token fails). Use to redirect to login. */\n  onSessionExpired?: () => void;\n}\n\nexport class JwtAuthService {\n  private log: IAuthLogger;\n  private options: JwtAuthServiceOptions;\n\n  // Fix 7: Cache token expiry to avoid re-parsing JWT on every getAuthHeaders()\n  private cachedTokenExp: { token: string; exp: number } | null = null;\n\n  // Fix 5: Refresh deduplication + cooldown after failure\n  private refreshPromise: Promise<string> | null = null;\n  private lastRefreshFailure: number = 0;\n  private static REFRESH_COOLDOWN_MS = 5000; // 5 second cooldown after failure\n\n  constructor(\n    private storage: IAuthStorage,\n    private api: IAuthApiService,\n    logger?: IAuthLogger,\n    options?: JwtAuthServiceOptions,\n  ) {\n    this.log = logger || noopLogger;\n    this.options = options || {};\n  }\n\n  /** Login with email and password */\n  async login(credentials: LoginCredentials): Promise<LoginResponse> {\n    try {\n      const data = await this.api.login(credentials);\n      await this.storage.setAccessToken(data.accessToken);\n      await this.storage.setRefreshToken(data.refreshToken);\n      this.log.info('User logged in successfully', { userId: data.user.id });\n      return data;\n    } catch (error) {\n      this.log.error('Login failed', { error });\n      throw error;\n    }\n  }\n\n  /**\n   * Exchange a one-time mobile-OAuth handoff code for app JWTs and store them.\n   * Used by the native deep-link / in-app-browser social sign-in flow after\n   * {@link startNativeSocialSignIn} returns a `code`. Requires the app's\n   * `IAuthApiService` to implement `exchangeAuthCode`.\n   */\n  async loginWithExchangeCode(code: string): Promise<LoginResponse> {\n    if (!this.api.exchangeAuthCode) {\n      throw new Error('Exchange-code auth not configured');\n    }\n    try {\n      const data = await this.api.exchangeAuthCode(code);\n      await this.storage.setAccessToken(data.accessToken);\n      await this.storage.setRefreshToken(data.refreshToken);\n      this.log.info('Auth code exchange successful', { userId: data.user.id });\n      return data;\n    } catch (error) {\n      this.log.error('Auth code exchange failed', { error });\n      throw error;\n    }\n  }\n\n  /** Register new user */\n  async register(data: RegisterData): Promise<LoginResponse> {\n    try {\n      const result = await this.api.register(data);\n      await this.storage.setAccessToken(result.accessToken);\n      await this.storage.setRefreshToken(result.refreshToken);\n      this.log.info('User registered successfully', { userId: result.user.id });\n      return result;\n    } catch (error) {\n      this.log.error('Registration failed', { error });\n      throw error;\n    }\n  }\n\n  /** Logout (clear tokens) */\n  async logout(): Promise<void> {\n    try {\n      const refreshToken = await this.storage.getRefreshToken();\n      if (refreshToken) {\n        await this.api.logout(refreshToken).catch(() => {});\n      }\n    } finally {\n      await this.storage.clearTokens();\n      this.cachedTokenExp = null;\n      this.log.info('User logged out');\n    }\n  }\n\n  /** Refresh access token */\n  async refreshAccessToken(): Promise<string> {\n    const refreshToken = await this.storage.getRefreshToken();\n    if (!refreshToken) {\n      throw new Error('No refresh token available');\n    }\n\n    try {\n      const result = await this.api.refreshToken(refreshToken);\n      await this.storage.setAccessToken(result.accessToken);\n      return result.accessToken;\n    } catch (error) {\n      await this.storage.clearTokens();\n      this.cachedTokenExp = null;\n      this.log.error('Token refresh failed', { error });\n      this.options.onSessionExpired?.();\n      throw new Error('Session expired');\n    }\n  }\n\n  /** Get current access token */\n  async getAccessToken(): Promise<string | null> {\n    return this.storage.getAccessToken();\n  }\n\n  /** Check if a JWT token is expired or about to expire */\n  private isTokenExpiredOrExpiring(\n    token: string,\n    bufferSeconds = 120,\n  ): boolean {\n    try {\n      let exp: number;\n\n      // Fix 7: Use cached expiry if token hasn't changed\n      if (this.cachedTokenExp?.token === token) {\n        exp = this.cachedTokenExp.exp;\n      } else {\n        const base64Url = token.split('.')[1];\n        const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');\n        const payload = JSON.parse(atob(base64));\n        exp = payload.exp;\n        if (!exp) return true;\n        this.cachedTokenExp = { token, exp };\n      }\n\n      const nowSeconds = Math.floor(Date.now() / 1000);\n      return nowSeconds >= exp - bufferSeconds;\n    } catch {\n      return true;\n    }\n  }\n\n  /**\n   * Get auth headers for API requests.\n   * Proactively refreshes the access token if it's expired or about to expire.\n   * Includes cooldown to prevent repeated refresh attempts after failure.\n   */\n  async getAuthHeaders(): Promise<Record<string, string>> {\n    let token = await this.getAccessToken();\n    if (!token) return {};\n\n    if (this.isTokenExpiredOrExpiring(token)) {\n      // Fix 5: Skip refresh if we recently failed (cooldown)\n      const timeSinceFailure = Date.now() - this.lastRefreshFailure;\n      if (\n        this.lastRefreshFailure > 0 &&\n        timeSinceFailure < JwtAuthService.REFRESH_COOLDOWN_MS\n      ) {\n        return {};\n      }\n\n      try {\n        if (!this.refreshPromise) {\n          this.refreshPromise = this.refreshAccessToken().finally(() => {\n            this.refreshPromise = null;\n          });\n        }\n        token = await this.refreshPromise;\n        this.lastRefreshFailure = 0;\n      } catch {\n        this.lastRefreshFailure = Date.now();\n        return {};\n      }\n    }\n\n    return { Authorization: `Bearer ${token}` };\n  }\n\n  /** Check if user is authenticated */\n  async isAuthenticated(): Promise<boolean> {\n    return this.storage.hasTokens();\n  }\n\n  /** Check if tokens exist in storage */\n  async hasTokens(): Promise<boolean> {\n    return this.storage.hasTokens();\n  }\n\n  /** Decode JWT token (client-side only — for user info, NOT for security) */\n  decodeToken(token: string): AuthUser | null {\n    try {\n      const base64Url = token.split('.')[1];\n      const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');\n      const jsonPayload = decodeURIComponent(\n        atob(base64)\n          .split('')\n          .map((c) => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))\n          .join(''),\n      );\n      const payload = JSON.parse(jsonPayload);\n      return {\n        id: payload.sub,\n        email: payload.email,\n        name: payload.name || null,\n        role: payload.role || 'user',\n        playerID: payload.playerID,\n        organizationId: payload.organizationId,\n      };\n    } catch {\n      return null;\n    }\n  }\n\n  /** Get current user from token (client-side decode) */\n  async getCurrentUser(): Promise<AuthUser | null> {\n    const token = await this.getAccessToken();\n    if (!token) return null;\n    return this.decodeToken(token);\n  }\n\n  /** Login with passkey (WebAuthn/FIDO2) */\n  async loginWithPasskey(): Promise<LoginResponse> {\n    if (\n      !this.api.generatePasskeyAuthenticationOptions ||\n      !this.api.verifyPasskeyAuthentication\n    ) {\n      throw new Error('Passkey authentication not configured');\n    }\n\n    const { startAuthentication, browserSupportsWebAuthn } =\n      await import('@simplewebauthn/browser');\n\n    if (!browserSupportsWebAuthn()) {\n      throw new Error('WebAuthn is not supported on this device');\n    }\n\n    try {\n      const { options, sessionId } =\n        await this.api.generatePasskeyAuthenticationOptions();\n\n      const authResponse = await startAuthentication({\n        optionsJSON: JSON.parse(options),\n      });\n\n      const result = await this.api.verifyPasskeyAuthentication(\n        sessionId,\n        JSON.stringify(authResponse),\n      );\n\n      await this.storage.setAccessToken(result.accessToken);\n      await this.storage.setRefreshToken(result.refreshToken);\n\n      this.log.info('Passkey auth successful', { userId: result.user.id });\n      return result;\n    } catch (error) {\n      if (error instanceof Error && error.name === 'NotAllowedError') {\n        throw new Error('Passkey authentication was cancelled');\n      }\n      this.log.error('Passkey auth failed', { error });\n      throw error;\n    }\n  }\n\n  /** Send OTP to phone number for phone-based login */\n  async sendPhoneOtp(\n    phoneNumber: string,\n  ): Promise<{ success: boolean; message: string; expiresIn: number }> {\n    if (!this.api.sendPhoneOtp) {\n      throw new Error('Phone OTP not configured');\n    }\n\n    try {\n      const result = await this.api.sendPhoneOtp(phoneNumber);\n      if (result.success) {\n        this.log.info('OTP sent', { phoneNumber: phoneNumber.slice(-4) });\n      } else {\n        this.log.warn('OTP send failed', {\n          phoneNumber: phoneNumber.slice(-4),\n          message: result.message,\n        });\n      }\n      return result;\n    } catch (error) {\n      this.log.error('Failed to send OTP', { error });\n      throw error;\n    }\n  }\n\n  /** Verify OTP and login/register user */\n  async verifyPhoneOtp(\n    phoneNumber: string,\n    code: string,\n  ): Promise<LoginResponse & { isNewUser: boolean }> {\n    if (!this.api.verifyPhoneOtp) {\n      throw new Error('Phone OTP not configured');\n    }\n\n    try {\n      const result = await this.api.verifyPhoneOtp(phoneNumber, code);\n\n      if (!result.success || !result.accessToken || !result.refreshToken) {\n        throw new Error(result.message || 'Verification failed');\n      }\n\n      await this.storage.setAccessToken(result.accessToken);\n      await this.storage.setRefreshToken(result.refreshToken);\n\n      const user = this.decodeToken(result.accessToken);\n      if (!user) {\n        throw new Error('Failed to decode user token');\n      }\n\n      this.log.info('Phone auth successful', {\n        userId: user.id,\n        isNewUser: result.isNewUser,\n      });\n\n      return {\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n        user,\n        isNewUser: result.isNewUser ?? false,\n      };\n    } catch (error) {\n      this.log.error('Phone OTP verification failed', { error });\n      throw error;\n    }\n  }\n}\n","/**\n * @ccatto/react-auth - Capacitor Auth Storage\n *\n * Capacitor-based auth storage using @capacitor/preferences.\n * Works on BOTH web and mobile (no platform detection needed!).\n *\n * - Web: Uses localStorage\n * - iOS: Uses UserDefaults/Keychain\n * - Android: Uses SharedPreferences\n */\nimport { Preferences } from '@capacitor/preferences';\nimport type { IAuthStorage } from './auth-storage.interface';\n\nexport interface CapacitorAuthStorageOptions {\n  /** Key prefix for stored tokens (default: 'catto_auth') */\n  keyPrefix?: string;\n}\n\nexport class CapacitorAuthStorage implements IAuthStorage {\n  private readonly ACCESS_TOKEN_KEY: string;\n  private readonly REFRESH_TOKEN_KEY: string;\n\n  constructor(options?: CapacitorAuthStorageOptions) {\n    const prefix = options?.keyPrefix ?? 'catto_auth';\n    this.ACCESS_TOKEN_KEY = `${prefix}_access_token`;\n    this.REFRESH_TOKEN_KEY = `${prefix}_refresh_token`;\n  }\n\n  async setAccessToken(token: string): Promise<void> {\n    await Preferences.set({\n      key: this.ACCESS_TOKEN_KEY,\n      value: token,\n    });\n  }\n\n  async getAccessToken(): Promise<string | null> {\n    const { value } = await Preferences.get({ key: this.ACCESS_TOKEN_KEY });\n    return value;\n  }\n\n  async setRefreshToken(token: string): Promise<void> {\n    await Preferences.set({\n      key: this.REFRESH_TOKEN_KEY,\n      value: token,\n    });\n  }\n\n  async getRefreshToken(): Promise<string | null> {\n    const { value } = await Preferences.get({ key: this.REFRESH_TOKEN_KEY });\n    return value;\n  }\n\n  async clearTokens(): Promise<void> {\n    await Promise.all([\n      Preferences.remove({ key: this.ACCESS_TOKEN_KEY }),\n      Preferences.remove({ key: this.REFRESH_TOKEN_KEY }),\n    ]);\n  }\n\n  async hasTokens(): Promise<boolean> {\n    const accessToken = await this.getAccessToken();\n    return accessToken !== null;\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ccatto/react-auth",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Catto Auth - React/Next.js authentication with Better Auth, JWT, and mobile support",
   "license": "MIT",
   "author": "Chris Catto",
@@ -50,6 +50,7 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
+    "@ccatto/capacitor-inapp-auth": "^1.0.0",
     "@types/react": "^19.0.0",
     "better-auth": "^1.2.8",
     "glob": "^13.0.0",
@@ -68,6 +69,7 @@
     "@apollo/client": ">=3.0.0",
     "@capacitor/core": ">=5.0.0",
     "@capacitor/preferences": ">=5.0.0",
+    "@ccatto/capacitor-inapp-auth": ">=1.0.0",
     "@simplewebauthn/browser": ">=13.0.0",
     "graphql": ">=16.0.0"
   },
@@ -75,6 +77,9 @@
     "@apollo/client": {
       "optional": true
     },
+    "@ccatto/capacitor-inapp-auth": {
+      "optional": true
+    },
     "@capacitor/core": {
       "optional": true
     },