@chipmobilesdk/rn-auth 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,144 @@
 # @chipmobilesdk/rn-auth
 
+## 0.6.0
+
+### Minor Changes
+
+- Every peer range has an upper bound, and no package declares a peer it does not use. ([#21](https://github.com/operationd8979/chip-mobile-sdk/pull/21))
+
+  A peer range is now a caret, a tilde or an explicit `<`, except for `react` and
+  `react-native`: an app brings exactly one of each, so a floor is the only useful thing
+  to say about them. Every other peer is a library the app installs beside us, and an
+  open `>=` was a promise about versions nobody had run — mmkv 3→4 lost entitlements and
+  pending purchases exactly that way.
+
+  **Four of the new ceilings exclude a version that is already published**, so an app
+  that took the open range at its word may now see a peer warning. The new bound is the
+  major this release is tested against, which is the thing the old range failed to say:
+
+  | Peer | Was | Now | Published above the ceiling |
+  |---|---|---|---|
+  | `react-native-app-auth` (rn-auth) | `>=8` | `^8.0.0` | 9.0.0 |
+  | `react-native-keychain` (rn-auth) | `>=10` | `^10.0.0` | 11.0.0 |
+  | `@op-engineering/op-sqlite` (rn-local-db) | `>=17.1.0` | `^17.1.0` | 18.x, 19.x |
+  | `@react-native-firebase/messaging` (rn-notification) | `>=26.0.0` | `^26.0.0` | 27.x |
+
+  The others — `react-native-vision-camera` `^5.1.1`, `react-native-svg` `^15.15.0`,
+  `react-native-unistyles` `^3.2.0`, `@dr.pogodin/react-native-fs` `^2.39.2`,
+  `react-native-quick-crypto` `^1.0.0`, `react-native-notify-kit` `^10.5.0`,
+  `react-native-localize` `^3.7.0`, `react-native-mmkv` `^4.0.0` — exclude nothing that
+  exists today. rn-payment's mmkv range was already bounded (`>=4.0.0 <5`) and is now
+  written as the caret that means the same thing.
+
+  Peers nothing imports are gone. `rn-theme`, `rn-local-db` and `rn-notification` asked
+  for `react` without having a component or a hook between them; `rn-auth`, `rn-ai` and
+  `rn-i18n` asked for `react-native` without touching a React Native API (rn-auth reaches
+  both native modules through `lazyPeer`, rn-i18n formats on `Intl`); `rn-notification`
+  asked for `@react-native-firebase/app`, which messaging declares itself. `rn-ai` no
+  longer peers on `@chipmobilesdk/rn-auth` at all — it asks for a `TokenProvider`, a
+  two-method interface rn-auth's `auth` satisfies, so an app with its own token source
+  installs nothing extra. An app that enables push or signs in through rn-auth installs
+  the same packages as before; it is the manifest that stopped overstating.
+
+  `react-native-localize` is declared optional, which is what the code already did: the
+  time-zone reader goes through `lazyPeer` and falls back to `Intl` without it. The
+  `peerDependenciesMeta` entries that said `optional: false` are gone — that is npm's
+  default, and writing it down only invited the question of which peers were undecided.
+
+  `npm run check:manifests` now fails on an unbounded peer range, a peer nothing in
+  `src/` imports, and a `peerDependenciesMeta` entry for either, so the policy holds
+  without anyone remembering it.
+
+- Every package now ships built JavaScript with declaration files, instead of asking the
+  app to compile its TypeScript. ([#22](https://github.com/operationd8979/chip-mobile-sdk/pull/22))
+
+  Each tarball carries `lib/commonjs`, `lib/module` and `lib/typescript` (built with
+  `react-native-builder-bob`), and `src/` alongside them. What that changes for a
+  consumer:
+
+  - **Nothing to add to `transformIgnorePatterns`.** `require` resolves to the CommonJS
+    build, so an app's Jest loads this package without being told to transform it. That
+    was the one thing every consuming app had to know about us (DEP-04).
+  - **Typechecking reads our `.d.ts`** rather than compiling our source under our
+    `tsconfig`. A consumer's stricter — or looser — settings no longer meet our code.
+  - **`import` resolves to ESM**, so a bundler can tree-shake what it does not use.
+
+  No exported name changed, and no subpath moved: `.`, `./testing`, `./push`,
+  `./advanced`, `./app-auth`, `./keychain` and rn-core's twelve subpaths resolve exactly
+  as before, each now with its own declarations for both module systems. publint and
+  `attw --profile node16` pass on all twelve packages, which they could not before.
+
+  Inside the monorepo nothing changed either, and that is deliberate: every subpath also
+  declares a private `chipmobilesdk-source` condition pointing at its TypeScript, and
+  Metro, Jest and `tsc` here ask for that condition first. The demo app bundles 371
+  modules straight from `packages/*/src`, so editing a package still changes the app with
+  no build step, and coverage is still measured on the source. The condition is named for
+  this organization rather than using the conventional `source` because third-party
+  packages declare that one too — `@dr.pogodin/react-native-fs` does — and asking for it
+  pulled their sources into our stricter compile.
+
+  `npm run build:packages` builds everything, `prepack` rebuilds before any `npm pack`,
+  and `lib/` is git-ignored: the published bytes are produced by the release, never
+  committed. `npm run check:manifests` now fails a package whose `main`, `module`,
+  `types`, `source` condition, `files`, build script or `prepack` do not match this shape.
+
+### Patch Changes
+
+- Each package's public API and its weight are now recorded in the repository, so a change
+  to either is reviewed rather than discovered. ([#23](https://github.com/operationd8979/chip-mobile-sdk/pull/23))
+
+  `packages/<pkg>/etc/*.api.md` is an api-extractor report per entrypoint — twenty-seven
+  of them, generated from the declarations the package publishes and committed. A renamed
+  type, a widened union, one more optional field: all of it shows up in a pull request's
+  diff. `npm run check:api` fails when a report is out of date and `npm run api:update`
+  rewrites them.
+
+  A report that moves now needs a **minor or major** changeset for that package.
+  `check:changesets` enforces it, because the report is generated from what the package
+  publishes, and a patch release that moves the public surface is how a consumer's build
+  breaks on `npm update`. A report added for the first time is a baseline, not a change.
+  `./testing` deliberately has no report: test doubles are not a surface a release is
+  gated on.
+
+  `npm run check:size` holds every entrypoint to a budget in `.size-limit.json`, measured
+  on the ESM build with peers and rn-core treated as external — they are what an app
+  installs beside us, not our weight. Each budget started at today's measurement plus five
+  per cent, so growth becomes a decision someone makes instead of a drift nobody sees. The
+  current figures run from 500 B (`rn-core/lazy`) to 19 kB (rn-notification).
+
+  No behaviour or API changed in this release; the entry is here so the changelog records
+  when the reports and the budgets began.
+- Updated dependencies ([#22](https://github.com/operationd8979/chip-mobile-sdk/pull/22), [#23](https://github.com/operationd8979/chip-mobile-sdk/pull/23)):
+  - @chipmobilesdk/rn-core@0.2.0
+
+## 0.5.0
+
+### Minor Changes
+
+- A restored session reports the provider the user signed in with. A refresh answers with the tenant's own `idp` (`google.com`), so after a restart the same session used to describe itself differently — `profile.provider` changed from `google` to `google.com`. ([#19](https://github.com/operationd8979/chip-mobile-sdk/pull/19))
+
+  `auth.canAccessPremium()` answers whether a premium path is open and changes nothing. `requirePremium()`, which also moves the whole controller to `access-denied` — a status every screen reading `state.status` then sees, and one only a sign-in or `restore()` leaves — is deprecated and will be removed in 0.5.0. Both are on `useAuth()`.
+
+  `ProviderId` is open (`KnownProviderId | (string & {})`), `labelKey` takes an app's own message key, and `ProviderConfig.additionalParameters` passes extra OIDC parameters such as `prompt`, so federating another identity provider is a change to an app's config rather than a release of this package. A provider's own parameters cannot override `domain_hint`.
+
+  `config.messages` is read at last: `auth.getMessages()` and `useAuthMessages()` return this package's copy with the app's overrides applied. Configuration validation refuses a plaintext `authority` (http is accepted only for localhost), a provider platform other than `ios`/`android`, and a provider with no `labelKey`. `createAppAuthClient({ serviceConfiguration })` takes the endpoints directly, so an authorize, refresh or sign-out no longer costs a `.well-known` round-trip. `mapClaimsToProfile` and `describeProviderIdentity` are exported, which is what the already-public `ProviderIdentity` type describes.
+
+  `useAccessToken(resourceKey)` drops a result that arrives after the component unmounted or moved to another resource, and starts from `idle` when the resource changes.
+
+  The stored session artifact holds an identity — tenant user id, display name, email, provider — and no longer the whole id-token claim set, group ids included; a restore that rotated nothing leaves the Keychain untouched. After an `offline` restore, `profile.claims` is empty and the tier fails closed, as before. The never-emitted `entitlement-unverified` error code is gone from `AuthErrorCode`, and `AuthError.messageKey` is typed as `AuthMessageKey` rather than `string`.
+
+- A 401 retry now gets a token the provider had to fetch again. `TokenProvider.requestAccessToken` takes `{ forceRefresh }`, which rn-auth implements by dropping the cached token for that resource, so the retry no longer re-sends the token the gateway had just refused — a cached token is still unexpired by the device's clock when the server rejects it. ([#19](https://github.com/operationd8979/chip-mobile-sdk/pull/19))
+
+  Failures an app can tell apart. `network` is a request that never arrived (no connection, a timeout, a dropped stream) and is retryable; `session-expired` is a session the user must renew. `AiError.cause` carries the code from the layer underneath — the gateway's own code, or rn-auth's — so a screen can explain *why*, and `retryAfterSeconds` is read from the `Retry-After` header when the body omits it. Both new codes have user copy, and the gateway's full code list is mapped rather than guessed from the status.
+
+  The remote behavior config is checked before it is trusted. `configUrl` and the document's `api.baseUrl` must be https (localhost excepted), the document must name the app it is for, its `schemaVersion` must be one this release understands, and `allowedHosts` pins where the client may send its bearer token. A broken TTL no longer means a revalidation on every request, and a retry count is bounded. A not-modified answer against a cache that is no longer there asks again without the ETag instead of reporting the 304 as a failure.
+
+  `configCacheFromKeyValue(port)` makes a durable config cache out of rn-core's `KeyValuePort`, so a second launch uses the last-good document instead of waiting for the network.
+
+  One quota figure: a chat's `done` event and `getQuota()` both record it on the client (`lastQuota()`), so `useAiQuota` and `useAiChat` cannot disagree, and a quota response that does not match the contract is refused rather than displayed. `getQuota()` recovers like a chat: a designated 404/410 reloads the configuration and retries, and a 401 retries once.
+
+  Streamed text reaches the screen on an interval (50 ms by default, `useAiChat(client, { flushIntervalMs })`) rather than once per token, and whatever arrived is flushed with the terminal state, so a half-answer stays on screen when a stream fails. A stream framed with CRLF is parsed incrementally, as the SSE specification allows. The transport seam is a published `StreamTransport` port instead of the internal reader's signature.
+
 ## 0.4.0
 
 ### Minor Changes

package/README.md

@@ -30,9 +30,12 @@ npm install @chipmobilesdk/rn-auth react-native-app-auth react-native-keychain
 cd ios && pod install
 ```
 
-`react`, `react-native`, `react-native-app-auth`, and `react-native-keychain`
-are **peer dependencies**. The two native libraries are only required by the
-default adapters — an app injecting custom ports may omit them.
+`react`, `react-native-app-auth` (`^8.0.0`) and `react-native-keychain`
+(`^10.0.0`) are the **peer dependencies**. The two native libraries are only
+required by the default adapters — an app injecting custom ports may omit them,
+and they are declared optional for that reason. There is no `react-native` peer:
+the controller is plain TypeScript, and both native modules are reached through
+`lazyPeer`.
 
 See [native setup](../../specs/003-mobile-entra-auth/contracts/native-setup.md)
 for the iOS `Info.plist` URL scheme and the Android `appAuthRedirectScheme`
@@ -74,11 +77,45 @@ export const App = () => (
 );
 ```
 
-Hooks: `useAuth()` (state + `signIn`/`signOut`/`signOutGlobal`/`restore`/`requirePremium`),
+Hooks: `useAuth()` (state + `signIn`/`signOut`/`signOutGlobal`/`restore`/`canAccessPremium`),
 `useProfile()`, `useAccessTier()`, `useAccessToken(resourceKey)`,
+`useAuthMessages()` (this package's copy, with your `messages` applied),
 `useSignInProviders()` (all platform providers, in config order — map to one
 button each) and `useSignInProvider()` (first available, for a single-button UI).
 
+### Gating a premium path
+
+```tsx
+const { canAccessPremium } = useAuth();
+const gate = canAccessPremium(); // { allowed, tier } — reads, changes nothing
+
+return gate.allowed ? <PremiumReport /> : <UpgradeNotice tier={gate.tier} />;
+```
+
+`canAccessPremium()` is a question. `requirePremium()`, which answers the same
+question *and* moves the whole controller to `access-denied` — a status every
+screen reading `state.status` then sees, and only a sign-in or `restore()`
+leaves — is deprecated and will go in 0.5.0.
+
+### Providers beyond the three with built-in copy
+
+A provider is a `domain_hint` and a label, so adding one the tenant federates is
+a change to this config and nothing else:
+
+```tsx
+providers: [
+  { id: 'microsoft', platforms: ['ios', 'android'], domainHint: 'live.com',
+    labelKey: 'app.action.continueMicrosoft',           // one of your own keys
+    additionalParameters: { prompt: 'select_account' }, // merged into authorize
+  },
+]
+```
+
+`ProviderId` is `KnownProviderId | (string & {})`: `'google' | 'apple' |
+'facebook'` stay in autocomplete, and any other id is accepted. A provider's
+`additionalParameters` cannot override `domain_hint`, so it can never route the
+flow to another IdP.
+
 ### Session lifecycle guarantees
 
 - **Restore deletes the stored session only when the provider rejects the refresh
@@ -91,6 +128,15 @@ button each) and `useSignInProvider()` (first available, for a single-button UI)
   `requestAccessToken` calls for one resource share one network refresh.
 - **`signOutGlobal()` returns `{ global: 'ended' | 'failed', error? }`.** Local state
   is cleared either way; `failed` means the tenant session may still be alive.
+- **A restored profile reports the provider the user signed in with.** The stored
+  artifact carries it, because a refresh answers with the tenant's own `idp`
+  (`google.com`), which is not the id the app passed to `signIn`.
+- **The stored artifact holds an identity, not a token's claims:** the tenant user
+  id, display name, email and provider. After a restore that reached the provider,
+  `profile.claims` is the fresh id-token claim set; after an `offline` restore it is
+  empty, and the access tier fails closed. Read `state.restore` to tell them apart.
+- **An unchanged session is not rewritten.** A restore that rotated nothing leaves
+  the Keychain untouched, off the startup path.
 
 ## Configuration contract (LIB-010)
 
@@ -106,10 +152,15 @@ client secrets are configured in the External ID tenant, never in the app
 | C2 — Facebook (optional) | `providers[facebook]`: `domainHint: 'facebook.com'`, `platforms: ['ios','android']`, `labelKey: 'auth.action.continueFacebook'`, optional `available` |
 | D — Resources | `resources[].key`, `resources[].scopes`, `resources[].displayName?` |
 | E — Access tier | `accessTierMapping.premiumGroupObjectIds` (+ optional role names / claim matchers; display names are diagnostics-only) |
-| F — Ports | `secureStore` (required), `authClient` (optional), `messages` (optional copy override) |
+| F — Ports | `secureStore` (required), `authClient` (optional), `messages` (optional copy override, readable through `useAuthMessages()`) |
 
-Full contract: [auth-config.md](../../specs/003-mobile-entra-auth/contracts/auth-config.md)
-and [public-api.md](../../specs/003-mobile-entra-auth/contracts/public-api.md).
+`createAuth` throws `AuthConfigError` before any flow can start when: `authority`
+is missing, relative, or not `https` (plain `http` is accepted only for
+`localhost`); `redirectUrl` has no scheme; `offline_access` is absent from
+`scopes`; no provider is configured, or one repeats an id, or lacks a
+`domainHint` or `labelKey`, or declares a platform other than `ios`/`android`; a
+resource repeats a key or declares no scope; `accessTierMapping` names no premium
+indicator; or no `secureStore` is supplied.
 
 ## Tenant / provider prerequisite checklist (LIB-018)
 
@@ -160,19 +211,28 @@ are unsupported.
 
 - Controller and configuration: `createAuth`, `Auth`, `AuthConfig`,
   `CreateAuthOptions`, `AuthState`, `AuthStatus`, `RestoreStatus`
-- Identity and access: `Profile`, `ProviderConfig`, `ProviderIdentity`,
-  `ResourceConfig`, `AccessTier`, `AccessTierMapping`, `AccessTokenResult`,
-  `PremiumGateResult`, `evaluateAccessTier`, `failClosedTier`
+- Identity and access: `Profile`, `ProviderConfig`, `ProviderId`,
+  `KnownProviderId`, `ProviderIdentity`, `ResourceConfig`, `AccessTier`,
+  `AccessTierMapping`, `AccessTokenResult`, `PremiumGateResult`,
+  `evaluateAccessTier`, `failClosedTier`, `mapClaimsToProfile`,
+  `describeProviderIdentity` (what an address is: `direct`, Apple's
+  `private-relay`, or `none`)
 - Ports and default adapters: `SecureTokenStore`, `createKeychainSecureStore`,
   `AUTH_STORAGE_KEY`, `OidcAuthClient`, `createAppAuthClient` and the public OIDC
-  request/token types. The two default adapters also have their own entrypoints,
+  request/token types. `createAppAuthClient({ serviceConfiguration })` takes the
+  authorization, token and end-session endpoints directly; without them the native
+  module fetches `.well-known` on every authorize, refresh and sign-out, including
+  the refresh on the startup path. The two default adapters also have their own entrypoints,
   `@chipmobilesdk/rn-auth/app-auth` and `@chipmobilesdk/rn-auth/keychain`, so an app
   that injects its own client or store can skip them. Neither loads its native
   module until it is used: react-native-app-auth on the first sign-in, refresh or
   sign-out, react-native-keychain on the first read or write. Creating `auth` at
   startup loads neither. A missing module is an `AuthConfigError` at that moment.
 - React: `AuthProvider`, `useAuth`, `useProfile`, `useAccessTier`,
-  `useAccessToken`, `useSignInProvider`, `useSignInProviders`, `useAuthSelector`.
+  `useAccessToken`, `useAuthMessages`, `useSignInProvider`, `useSignInProviders`,
+  `useAuthSelector`. `useAccessToken(resourceKey)` starts from `idle` again when
+  the resource changes, and a result that arrives after the component unmounted
+  or moved on is dropped rather than applied.
   Each hook reads the state through `useSyncExternalStore` and re-renders only when
   what it returns changes: `useProfile` does not render for a status change. Use
   `useAuthSelector(state => …, isEqual?)` for any other slice. `auth.getState()`
@@ -202,8 +262,8 @@ adapters; run them against a store or client you inject.
 
 ## Compatibility and validation
 
-React ≥19 · React Native ≥0.85 · `react-native-app-auth` ≥8 ·
-`react-native-keychain` ≥10 · iOS + Android · Node ≥22.11 for tooling.
+React ≥19 · React Native ≥0.85 · `react-native-app-auth` `^8.0.0` ·
+`react-native-keychain` `^10.0.0` · iOS + Android · Node ≥22.11 for tooling.
 
 The demo integration lives in `src/screens/AuthDemoScreen.tsx`. Run from the
 repository root:

package/lib/commonjs/access/accessTier.js

@@ -0,0 +1,111 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.evaluateAccessTier = evaluateAccessTier;
+exports.failClosedTier = failClosedTier;
+/**
+ * Access-tier evaluation (FR-010/FR-011/FR-019/FR-020, R6).
+ *
+ * Pure function over the authenticated token's claims and the app-specific
+ * mapping. Object ids are authoritative; display names never grant access.
+ * Missing, stale, ambiguous, or group-overage claims fail closed (premium
+ * denied, verification = 'unverified').
+ */
+
+/** The fail-closed default: free + unverified. */
+function failClosedTier() {
+  return {
+    tier: 'free',
+    source: 'default',
+    verification: 'unverified'
+  };
+}
+function toStringArray(value) {
+  if (Array.isArray(value)) {
+    return value.filter(entry => typeof entry === 'string');
+  }
+  if (typeof value === 'string') {
+    return [value];
+  }
+  return [];
+}
+
+/**
+ * Entra emits a groups overage indicator (`_claim_names.groups` or `hasgroups`)
+ * instead of inline groups when the list is too large. Reading the full list
+ * would require Graph (out of scope, FR-012), so overage fails closed.
+ */
+function hasGroupOverage(claims) {
+  if (claims.hasgroups === true) {
+    return true;
+  }
+  const claimNames = claims._claim_names;
+  if (claimNames && typeof claimNames === 'object' && 'groups' in claimNames) {
+    return true;
+  }
+  return false;
+}
+function matchesClaim(claims, matcher) {
+  const value = claims[matcher.claim];
+  if (Array.isArray(value)) {
+    return value.includes(matcher.equals);
+  }
+  return value === matcher.equals;
+}
+
+/** Evaluate the access tier, failing closed when entitlement is unverifiable. */
+function evaluateAccessTier(claims, mapping, now = Date.now()) {
+  // Object ids first (authoritative). Display names are never consulted.
+  const groups = toStringArray(claims.groups);
+  if (mapping.premiumGroupObjectIds.length > 0 && groups.some(group => mapping.premiumGroupObjectIds.includes(group))) {
+    return {
+      tier: 'premium',
+      source: 'group',
+      verification: 'verified',
+      lastRefreshAt: now
+    };
+  }
+
+  // Roles next.
+  const roles = toStringArray(claims.roles);
+  if (mapping.premiumRoleNames?.length && roles.some(role => mapping.premiumRoleNames.includes(role))) {
+    return {
+      tier: 'premium',
+      source: 'role',
+      verification: 'verified',
+      lastRefreshAt: now
+    };
+  }
+
+  // Custom claim matchers last.
+  if (mapping.premiumClaimMatchers?.some(matcher => matchesClaim(claims, matcher))) {
+    return {
+      tier: 'premium',
+      source: 'claim',
+      verification: 'verified',
+      lastRefreshAt: now
+    };
+  }
+
+  // No premium indicator matched. If group claims are unavailable due to
+  // overage and premium depends on groups, we cannot verify → fail closed.
+  if (mapping.premiumGroupObjectIds.length > 0 && hasGroupOverage(claims)) {
+    return {
+      tier: 'free',
+      source: 'default',
+      verification: 'unverified',
+      lastRefreshAt: now
+    };
+  }
+
+  // Verified free: claims were present and simply did not grant premium.
+  return {
+    tier: 'free',
+    source: 'default',
+    verification: 'verified',
+    lastRefreshAt: now
+  };
+}
+//# sourceMappingURL=accessTier.js.map

package/lib/commonjs/access/accessTier.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["failClosedTier","tier","source","verification","toStringArray","value","Array","isArray","filter","entry","hasGroupOverage","claims","hasgroups","claimNames","_claim_names","matchesClaim","matcher","claim","includes","equals","evaluateAccessTier","mapping","now","Date","groups","premiumGroupObjectIds","length","some","group","lastRefreshAt","roles","premiumRoleNames","role","premiumClaimMatchers"],"sourceRoot":"../../../src","sources":["access/accessTier.ts"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACO,SAASA,cAAcA,CAAA,EAAe;EAC5C,OAAO;IAAEC,IAAI,EAAE,MAAM;IAAEC,MAAM,EAAE,SAAS;IAAEC,YAAY,EAAE;EAAa,CAAC;AACvE;AAEA,SAASC,aAAaA,CAACC,KAAc,EAAY;EAChD,IAAIC,KAAK,CAACC,OAAO,CAACF,KAAK,CAAC,EAAE;IACzB,OAAOA,KAAK,CAACG,MAAM,CAAEC,KAAK,IAAsB,OAAOA,KAAK,KAAK,QAAQ,CAAC;EAC3E;EACA,IAAI,OAAOJ,KAAK,KAAK,QAAQ,EAAE;IAC9B,OAAO,CAACA,KAAK,CAAC;EACf;EACA,OAAO,EAAE;AACV;;AAEA;AACA;AACA;AACA;AACA;AACA,SAASK,eAAeA,CAACC,MAA+B,EAAW;EAClE,IAAIA,MAAM,CAACC,SAAS,KAAK,IAAI,EAAE;IAC9B,OAAO,IAAI;EACZ;EACA,MAAMC,UAAU,GAAGF,MAAM,CAACG,YAAmD;EAC7E,IAAID,UAAU,IAAI,OAAOA,UAAU,KAAK,QAAQ,IAAI,QAAQ,IAAIA,UAAU,EAAE;IAC3E,OAAO,IAAI;EACZ;EACA,OAAO,KAAK;AACb;AAEA,SAASE,YAAYA,CAACJ,MAA+B,EAAEK,OAAqB,EAAW;EACtF,MAAMX,KAAK,GAAGM,MAAM,CAACK,OAAO,CAACC,KAAK,CAAC;EACnC,IAAIX,KAAK,CAACC,OAAO,CAACF,KAAK,CAAC,EAAE;IACzB,OAAOA,KAAK,CAACa,QAAQ,CAACF,OAAO,CAACG,MAAM,CAAC;EACtC;EACA,OAAOd,KAAK,KAAKW,OAAO,CAACG,MAAM;AAChC;;AAEA;AACO,SAASC,kBAAkBA,CACjCT,MAA+B,EAC/BU,OAA0B,EAC1BC,GAAW,GAAGC,IAAI,CAACD,GAAG,CAAC,CAAC,EACX;EACb;EACA,MAAME,MAAM,GAAGpB,aAAa,CAACO,MAAM,CAACa,MAAM,CAAC;EAC3C,IACCH,OAAO,CAACI,qBAAqB,CAACC,MAAM,GAAG,CAAC,IACxCF,MAAM,CAACG,IAAI,CAACC,KAAK,IAAIP,OAAO,CAACI,qBAAqB,CAACP,QAAQ,CAACU,KAAK,CAAC,CAAC,EAClE;IACD,OAAO;MAAE3B,IAAI,EAAE,SAAS;MAAEC,MAAM,EAAE,OAAO;MAAEC,YAAY,EAAE,UAAU;MAAE0B,aAAa,EAAEP;IAAI,CAAC;EAC1F;;EAEA;EACA,MAAMQ,KAAK,GAAG1B,aAAa,CAACO,MAAM,CAACmB,KAAK,CAAC;EACzC,IACCT,OAAO,CAACU,gBAAgB,EAAEL,MAAM,IAChCI,KAAK,CAACH,IAAI,CAACK,IAAI,IAAIX,OAAO,CAACU,gBAAgB,CAAEb,QAAQ,CAACc,IAAI,CAAC,CAAC,EAC3D;IACD,OAAO;MAAE/B,IAAI,EAAE,SAAS;MAAEC,MAAM,EAAE,MAAM;MAAEC,YAAY,EAAE,UAAU;MAAE0B,aAAa,EAAEP;IAAI,CAAC;EACzF;;EAEA;EACA,IAAID,OAAO,CAACY,oBAAoB,EAAEN,IAAI,CAACX,OAAO,IAAID,YAAY,CAACJ,MAAM,EAAEK,OAAO,CAAC,CAAC,EAAE;IACjF,OAAO;MAAEf,IAAI,EAAE,SAAS;MAAEC,MAAM,EAAE,OAAO;MAAEC,YAAY,EAAE,UAAU;MAAE0B,aAAa,EAAEP;IAAI,CAAC;EAC1F;;EAEA;EACA;EACA,IAAID,OAAO,CAACI,qBAAqB,CAACC,MAAM,GAAG,CAAC,IAAIhB,eAAe,CAACC,MAAM,CAAC,EAAE;IACxE,OAAO;MAAEV,IAAI,EAAE,MAAM;MAAEC,MAAM,EAAE,SAAS;MAAEC,YAAY,EAAE,YAAY;MAAE0B,aAAa,EAAEP;IAAI,CAAC;EAC3F;;EAEA;EACA,OAAO;IAAErB,IAAI,EAAE,MAAM;IAAEC,MAAM,EAAE,SAAS;IAAEC,YAAY,EAAE,UAAU;IAAE0B,aAAa,EAAEP;EAAI,CAAC;AACzF","ignoreList":[]}

package/lib/commonjs/app-auth.js

@@ -0,0 +1,13 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+Object.defineProperty(exports, "createAppAuthClient", {
+  enumerable: true,
+  get: function () {
+    return _authClient.createAppAuthClient;
+  }
+});
+var _authClient = require("./oidc/authClient.js");
+//# sourceMappingURL=app-auth.js.map

package/lib/commonjs/app-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_authClient","require"],"sourceRoot":"../../src","sources":["app-auth.ts"],"mappings":";;;;;;;;;;;AAKA,IAAAA,WAAA,GAAAC,OAAA","ignoreList":[]}

package/lib/commonjs/config/types.js

@@ -0,0 +1,50 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.DEVICE_PLATFORMS = void 0;
+/**
+ * Public type contracts for @chipmobilesdk/rn-auth. Shapes follow
+ * specs/003-mobile-entra-auth/data-model.md.
+ */
+
+/** The providers this package has copy for out of the box. */
+
+/**
+ * A provider id. Open on purpose: routing is `domain_hint` and nothing else, so
+ * adding an IdP the tenant federates — Microsoft account, an email one-time
+ * code — is a change to an app's config, not a release of this package
+ * (AUTH-14). `KnownProviderId` keeps the three familiar ones in autocomplete.
+ */
+
+const DEVICE_PLATFORMS = exports.DEVICE_PLATFORMS = ['ios', 'android'];
+
+/** Provider Setup Configuration — non-secret public values only (FR-016/FR-017). */
+
+/** One configured protected resource for delegated token requests (FR-007). */
+
+/** App-specific mapping from tenant indicators to access tiers (FR-019/FR-020). */
+
+/** App-supplied, public-only setup input (FR-015/FR-016/FR-017). */
+
+/** Advanced/testing options. `platform` overrides the detected device platform. */
+
+/** Customer User / app-visible profile (FR-006). */
+
+/** Access Tier — local interpretation of tenant indicators (FR-010). */
+
+/** Access Token Request result (FR-007). */
+
+/** Single active app-visible authenticated state (FR-005/FR-022). */
+
+/** Result of a premium-only gate check (US3). */
+
+/**
+ * What `signOutGlobal` did beyond the device (added in 0.2.2). Local state is
+ * cleared either way; `failed` means the tenant session may still be alive, so
+ * the next interactive sign-in can complete without a password prompt.
+ */
+
+/** The auth controller returned by `createAuth` (single active account). */
+//# sourceMappingURL=types.js.map

package/lib/commonjs/config/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["DEVICE_PLATFORMS","exports"],"sourceRoot":"../../../src","sources":["config/types.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;;AAQA;;AAGA;AACA;AACA;AACA;AACA;AACA;;AAIO,MAAMA,gBAA2C,GAAAC,OAAA,CAAAD,gBAAA,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC;;AAE7E;;AAoBA;;AAYA;;AAUA;;AAmBA;;AAiBA;;AAoBA;;AAUA;;AASA;;AASA;;AAMA;AACA;AACA;AACA;AACA;;AAOA","ignoreList":[]}

package/lib/commonjs/config/validateConfig.js

@@ -0,0 +1,114 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.validateConfig = validateConfig;
+var _types = require("./types.js");
+var _errors = require("../diagnostics/errors.js");
+/**
+ * Deterministic configuration validation (FR-005 → configuration-error).
+ * Throws AuthConfigError before any provider flow can start (US4 scenario 2).
+ * Covers the auth-config.md Section A–F rules.
+ */
+
+function hasScheme(url) {
+  return /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(url);
+}
+
+/** https, or http on a development machine. */
+function isSecureAuthority(url) {
+  if (/^https:/i.test(url)) {
+    return true;
+  }
+  return /^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?(\/|$)/i.test(url);
+}
+function validateConfig(config) {
+  // Section A — tenant/client settings
+  if (!config.authority || !config.authority.trim()) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'Missing "authority"');
+  }
+  if (!hasScheme(config.authority)) {
+    throw new _errors.AuthConfigError('auth.error.configuration', '"authority" must be an absolute URL');
+  }
+  // Tokens travel over this. A tenant reachable over plaintext http is a
+  // configuration mistake, not a deployment choice — except on a dev machine.
+  if (!isSecureAuthority(config.authority)) {
+    throw new _errors.AuthConfigError('auth.error.configuration', '"authority" must use https (http is accepted only for localhost)');
+  }
+  if (!config.clientId || !config.clientId.trim()) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'Missing "clientId"');
+  }
+  if (!config.redirectUrl || !config.redirectUrl.trim()) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'Missing "redirectUrl"');
+  }
+  if (!hasScheme(config.redirectUrl)) {
+    throw new _errors.AuthConfigError('auth.error.redirectMismatch', '"redirectUrl" must include a scheme matching the native redirect configuration');
+  }
+  if (!Array.isArray(config.scopes) || config.scopes.length === 0) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'At least one OIDC scope is required');
+  }
+  if (!config.scopes.includes('offline_access')) {
+    throw new _errors.AuthConfigError('auth.error.configuration', '"offline_access" scope is required for session restore and silent refresh');
+  }
+
+  // Sections B/C — providers
+  if (!Array.isArray(config.providers) || config.providers.length === 0) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'At least one provider must be configured');
+  }
+  const providerIds = new Set();
+  for (const provider of config.providers) {
+    if (providerIds.has(provider.id)) {
+      throw new _errors.AuthConfigError('auth.error.configuration', `Duplicate provider "${provider.id}"`);
+    }
+    providerIds.add(provider.id);
+    if (!provider.domainHint || !provider.domainHint.trim()) {
+      throw new _errors.AuthConfigError('auth.error.configuration', `Provider "${provider.id}" is missing a domainHint`);
+    }
+    if (!Array.isArray(provider.platforms) || provider.platforms.length === 0) {
+      throw new _errors.AuthConfigError('auth.error.configuration', `Provider "${provider.id}" must declare at least one platform`);
+    }
+    for (const platform of provider.platforms) {
+      if (!_types.DEVICE_PLATFORMS.includes(platform)) {
+        // A typo here hides the provider on every device rather than failing.
+        throw new _errors.AuthConfigError('auth.error.configuration', `Provider "${provider.id}" declares unknown platform "${String(platform)}"`);
+      }
+    }
+    if (typeof provider.labelKey !== 'string' || !provider.labelKey.trim()) {
+      throw new _errors.AuthConfigError('auth.error.configuration', `Provider "${provider.id}" is missing a labelKey`);
+    }
+  }
+
+  // Section D — resources
+  if (config.resources) {
+    const resourceKeys = new Set();
+    for (const resource of config.resources) {
+      if (!resource.key || !resource.key.trim()) {
+        throw new _errors.AuthConfigError('auth.error.configuration', 'A resource is missing "key"');
+      }
+      if (resourceKeys.has(resource.key)) {
+        throw new _errors.AuthConfigError('auth.error.configuration', `Duplicate resource "${resource.key}"`);
+      }
+      resourceKeys.add(resource.key);
+      if (!Array.isArray(resource.scopes) || resource.scopes.length === 0) {
+        throw new _errors.AuthConfigError('auth.error.configuration', `Resource "${resource.key}" must declare at least one scope`);
+      }
+    }
+  }
+
+  // Section E — access-tier mapping
+  const mapping = config.accessTierMapping;
+  if (!mapping) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'Missing "accessTierMapping"');
+  }
+  const hasPremiumIndicator = (mapping.premiumGroupObjectIds?.length ?? 0) > 0 || (mapping.premiumRoleNames?.length ?? 0) > 0 || (mapping.premiumClaimMatchers?.length ?? 0) > 0;
+  if (!hasPremiumIndicator) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'accessTierMapping must define at least one premium group object id, role name, or claim matcher');
+  }
+
+  // Section F — injected ports
+  if (!config.secureStore) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'A secureStore is required (FR-021)');
+  }
+}
+//# sourceMappingURL=validateConfig.js.map

package/lib/commonjs/config/validateConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_types","require","_errors","hasScheme","url","test","isSecureAuthority","validateConfig","config","authority","trim","AuthConfigError","clientId","redirectUrl","Array","isArray","scopes","length","includes","providers","providerIds","Set","provider","has","id","add","domainHint","platforms","platform","DEVICE_PLATFORMS","String","labelKey","resources","resourceKeys","resource","key","mapping","accessTierMapping","hasPremiumIndicator","premiumGroupObjectIds","premiumRoleNames","premiumClaimMatchers","secureStore"],"sourceRoot":"../../../src","sources":["config/validateConfig.ts"],"mappings":";;;;;;AAMA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AAPA;AACA;AACA;AACA;AACA;;AAKA,SAASE,SAASA,CAACC,GAAW,EAAW;EACxC,OAAO,2BAA2B,CAACC,IAAI,CAACD,GAAG,CAAC;AAC7C;;AAEA;AACA,SAASE,iBAAiBA,CAACF,GAAW,EAAW;EAChD,IAAI,UAAU,CAACC,IAAI,CAACD,GAAG,CAAC,EAAE;IACzB,OAAO,IAAI;EACZ;EACA,OAAO,0DAA0D,CAACC,IAAI,CAACD,GAAG,CAAC;AAC5E;AAEO,SAASG,cAAcA,CAACC,MAAkB,EAAQ;EACxD;EACA,IAAI,CAACA,MAAM,CAACC,SAAS,IAAI,CAACD,MAAM,CAACC,SAAS,CAACC,IAAI,CAAC,CAAC,EAAE;IAClD,MAAM,IAAIC,uBAAe,CAAC,0BAA0B,EAAE,qBAAqB,CAAC;EAC7E;EACA,IAAI,CAACR,SAAS,CAACK,MAAM,CAACC,SAAS,CAAC,EAAE;IACjC,MAAM,IAAIE,uBAAe,CAAC,0BAA0B,EAAE,qCAAqC,CAAC;EAC7F;EACA;EACA;EACA,IAAI,CAACL,iBAAiB,CAACE,MAAM,CAACC,SAAS,CAAC,EAAE;IACzC,MAAM,IAAIE,uBAAe,CACxB,0BAA0B,EAC1B,kEACD,CAAC;EACF;EACA,IAAI,CAACH,MAAM,CAACI,QAAQ,IAAI,CAACJ,MAAM,CAACI,QAAQ,CAACF,IAAI,CAAC,CAAC,EAAE;IAChD,MAAM,IAAIC,uBAAe,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;EAC5E;EACA,IAAI,CAACH,MAAM,CAACK,WAAW,IAAI,CAACL,MAAM,CAACK,WAAW,CAACH,IAAI,CAAC,CAAC,EAAE;IACtD,MAAM,IAAIC,uBAAe,CAAC,0BAA0B,EAAE,uBAAuB,CAAC;EAC/E;EACA,IAAI,CAACR,SAAS,CAACK,MAAM,CAACK,WAAW,CAAC,EAAE;IACnC,MAAM,IAAIF,uBAAe,CACxB,6BAA6B,EAC7B,gFACD,CAAC;EACF;EACA,IAAI,CAACG,KAAK,CAACC,OAAO,CAACP,MAAM,CAACQ,MAAM,CAAC,IAAIR,MAAM,CAACQ,MAAM,CAACC,MAAM,KAAK,CAAC,EAAE;IAChE,MAAM,IAAIN,uBAAe,CAAC,0BAA0B,EAAE,qCAAqC,CAAC;EAC7F;EACA,IAAI,CAACH,MAAM,CAACQ,MAAM,CAACE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;IAC9C,MAAM,IAAIP,uBAAe,CACxB,0BAA0B,EAC1B,2EACD,CAAC;EACF;;EAEA;EACA,IAAI,CAACG,KAAK,CAACC,OAAO,CAACP,MAAM,CAACW,SAAS,CAAC,IAAIX,MAAM,CAACW,SAAS,CAACF,MAAM,KAAK,CAAC,EAAE;IACtE,MAAM,IAAIN,uBAAe,CACxB,0BAA0B,EAC1B,0CACD,CAAC;EACF;EACA,MAAMS,WAAW,GAAG,IAAIC,GAAG,CAAS,CAAC;EACrC,KAAK,MAAMC,QAAQ,IAAId,MAAM,CAACW,SAAS,EAAE;IACxC,IAAIC,WAAW,CAACG,GAAG,CAACD,QAAQ,CAACE,EAAE,CAAC,EAAE;MACjC,MAAM,IAAIb,uBAAe,CAAC,0BAA0B,EAAE,uBAAuBW,QAAQ,CAACE,EAAE,GAAG,CAAC;IAC7F;IACAJ,WAAW,CAACK,GAAG,CAACH,QAAQ,CAACE,EAAE,CAAC;IAC5B,IAAI,CAACF,QAAQ,CAACI,UAAU,IAAI,CAACJ,QAAQ,CAACI,UAAU,CAAChB,IAAI,CAAC,CAAC,EAAE;MACxD,MAAM,IAAIC,uBAAe,CACxB,0BAA0B,EAC1B,aAAaW,QAAQ,CAACE,EAAE,2BACzB,CAAC;IACF;IACA,IAAI,CAACV,KAAK,CAACC,OAAO,CAACO,QAAQ,CAACK,SAAS,CAAC,IAAIL,QAAQ,CAACK,SAAS,CAACV,MAAM,KAAK,CAAC,EAAE;MAC1E,MAAM,IAAIN,uBAAe,CACxB,0BAA0B,EAC1B,aAAaW,QAAQ,CAACE,EAAE,sCACzB,CAAC;IACF;IACA,KAAK,MAAMI,QAAQ,IAAIN,QAAQ,CAACK,SAAS,EAAE;MAC1C,IAAI,CAACE,uBAAgB,CAACX,QAAQ,CAACU,QAAQ,CAAC,EAAE;QACzC;QACA,MAAM,IAAIjB,uBAAe,CACxB,0BAA0B,EAC1B,aAAaW,QAAQ,CAACE,EAAE,gCAAgCM,MAAM,CAACF,QAAQ,CAAC,GACzE,CAAC;MACF;IACD;IACA,IAAI,OAAON,QAAQ,CAACS,QAAQ,KAAK,QAAQ,IAAI,CAACT,QAAQ,CAACS,QAAQ,CAACrB,IAAI,CAAC,CAAC,EAAE;MACvE,MAAM,IAAIC,uBAAe,CACxB,0BAA0B,EAC1B,aAAaW,QAAQ,CAACE,EAAE,yBACzB,CAAC;IACF;EACD;;EAEA;EACA,IAAIhB,MAAM,CAACwB,SAAS,EAAE;IACrB,MAAMC,YAAY,GAAG,IAAIZ,GAAG,CAAS,CAAC;IACtC,KAAK,MAAMa,QAAQ,IAAI1B,MAAM,CAACwB,SAAS,EAAE;MACxC,IAAI,CAACE,QAAQ,CAACC,GAAG,IAAI,CAACD,QAAQ,CAACC,GAAG,CAACzB,IAAI,CAAC,CAAC,EAAE;QAC1C,MAAM,IAAIC,uBAAe,CAAC,0BAA0B,EAAE,6BAA6B,CAAC;MACrF;MACA,IAAIsB,YAAY,CAACV,GAAG,CAACW,QAAQ,CAACC,GAAG,CAAC,EAAE;QACnC,MAAM,IAAIxB,uBAAe,CACxB,0BAA0B,EAC1B,uBAAuBuB,QAAQ,CAACC,GAAG,GACpC,CAAC;MACF;MACAF,YAAY,CAACR,GAAG,CAACS,QAAQ,CAACC,GAAG,CAAC;MAC9B,IAAI,CAACrB,KAAK,CAACC,OAAO,CAACmB,QAAQ,CAAClB,MAAM,CAAC,IAAIkB,QAAQ,CAAClB,MAAM,CAACC,MAAM,KAAK,CAAC,EAAE;QACpE,MAAM,IAAIN,uBAAe,CACxB,0BAA0B,EAC1B,aAAauB,QAAQ,CAACC,GAAG,mCAC1B,CAAC;MACF;IACD;EACD;;EAEA;EACA,MAAMC,OAAO,GAAG5B,MAAM,CAAC6B,iBAAiB;EACxC,IAAI,CAACD,OAAO,EAAE;IACb,MAAM,IAAIzB,uBAAe,CAAC,0BAA0B,EAAE,6BAA6B,CAAC;EACrF;EACA,MAAM2B,mBAAmB,GACxB,CAACF,OAAO,CAACG,qBAAqB,EAAEtB,MAAM,IAAI,CAAC,IAAI,CAAC,IAChD,CAACmB,OAAO,CAACI,gBAAgB,EAAEvB,MAAM,IAAI,CAAC,IAAI,CAAC,IAC3C,CAACmB,OAAO,CAACK,oBAAoB,EAAExB,MAAM,IAAI,CAAC,IAAI,CAAC;EAChD,IAAI,CAACqB,mBAAmB,EAAE;IACzB,MAAM,IAAI3B,uBAAe,CACxB,0BAA0B,EAC1B,iGACD,CAAC;EACF;;EAEA;EACA,IAAI,CAACH,MAAM,CAACkC,WAAW,EAAE;IACxB,MAAM,IAAI/B,uBAAe,CAAC,0BAA0B,EAAE,oCAAoC,CAAC;EAC5F;AACD","ignoreList":[]}