@chipmobilesdk/rn-auth 0.4.0 → 0.6.0

package/lib/commonjs/diagnostics/errors.js

@@ -0,0 +1,83 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.AuthError = exports.AuthConfigError = void 0;
+exports.isAuthError = isAuthError;
+exports.redact = redact;
+exports.toAuthError = toAuthError;
+var _rnCore = require("@chipmobilesdk/rn-core");
+/**
+ * Developer-facing diagnostics. AuthError carries a stable machine-readable
+ * code, an audience (user vs developer/tenant), and a localizable message key.
+ * `detail` is always passed through `redact` so tokens and secrets never appear
+ * in logs or error objects (FR-014).
+ */
+
+/** JWT-shaped values: three base64url segments separated by dots. */
+const JWT_PATTERN = /[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g;
+/** Any other long opaque token-like run; shorter than rn-core's payload run on purpose. */
+const TOKEN_PATTERN = /[A-Za-z0-9_-]{24,}/g;
+
+/**
+ * Replace token-like substrings with a placeholder so diagnostics never leak
+ * secrets or token values (FR-014): JWTs become `[redacted-token]`; URLs, e-mail
+ * addresses, UUIDs and other opaque runs become `[redacted]` (rn-core's patterns).
+ */
+function redact(value) {
+  if (!value) {
+    return value;
+  }
+  return (0, _rnCore.redactPatterns)(value.replace(JWT_PATTERN, '[redacted-token]'), [..._rnCore.COMMON_PATTERNS, TOKEN_PATTERN]);
+}
+
+/** Retrying can only help when the network was the problem. */
+const RETRYABLE = new Set(['network-unavailable']);
+
+/** The package's error; an `SdkError` (`@chipmobilesdk/rn-core`) with `pkg: 'rn-auth'`. */
+class AuthError extends _rnCore.SdkError {
+  constructor(args) {
+    const detail = redact(args.detail);
+    super('rn-auth', args.code, {
+      message: args.messageKey,
+      retryable: RETRYABLE.has(args.code),
+      redactedCause: detail
+    });
+    this.name = 'AuthError';
+    this.audience = args.audience ?? 'developer';
+    this.messageKey = args.messageKey;
+    this.detail = detail;
+  }
+}
+exports.AuthError = AuthError;
+class AuthConfigError extends AuthError {
+  constructor(messageKey, detail) {
+    super({
+      code: 'configuration-error',
+      messageKey,
+      audience: 'developer',
+      detail
+    });
+    this.name = 'AuthConfigError';
+  }
+}
+exports.AuthConfigError = AuthConfigError;
+function isAuthError(value) {
+  return value instanceof AuthError;
+}
+
+/** Normalize any thrown value into an AuthError without leaking secrets. */
+function toAuthError(value, fallbackCode = 'token-acquisition-failed', fallbackMessageKey = 'auth.error.token') {
+  if (isAuthError(value)) {
+    return value;
+  }
+  const message = value instanceof Error ? value.message : String(value);
+  return new AuthError({
+    code: fallbackCode,
+    messageKey: fallbackMessageKey,
+    audience: 'developer',
+    detail: message
+  });
+}
+//# sourceMappingURL=errors.js.map

package/lib/commonjs/diagnostics/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_rnCore","require","JWT_PATTERN","TOKEN_PATTERN","redact","value","redactPatterns","replace","COMMON_PATTERNS","RETRYABLE","Set","AuthError","SdkError","constructor","args","detail","code","message","messageKey","retryable","has","redactedCause","name","audience","exports","AuthConfigError","isAuthError","toAuthError","fallbackCode","fallbackMessageKey","Error","String"],"sourceRoot":"../../../src","sources":["diagnostics/errors.ts"],"mappings":";;;;;;;;;AAOA,IAAAA,OAAA,GAAAC,OAAA;AAPA;AACA;AACA;AACA;AACA;AACA;;AAyBA;AACA,MAAMC,WAAW,GAAG,0DAA0D;AAC9E;AACA,MAAMC,aAAa,GAAG,qBAAqB;;AAE3C;AACA;AACA;AACA;AACA;AACO,SAASC,MAAMA,CAACC,KAAyB,EAAsB;EACrE,IAAI,CAACA,KAAK,EAAE;IACX,OAAOA,KAAK;EACb;EACA,OAAO,IAAAC,sBAAc,EAACD,KAAK,CAACE,OAAO,CAACL,WAAW,EAAE,kBAAkB,CAAC,EAAE,CACrE,GAAGM,uBAAe,EAClBL,aAAa,CACb,CAAC;AACH;;AAEA;AACA,MAAMM,SAAqC,GAAG,IAAIC,GAAG,CAAgB,CAAC,qBAAqB,CAAC,CAAC;;AAE7F;AACO,MAAMC,SAAS,SAASC,gBAAQ,CAAgB;EAKtDC,WAAWA,CAACC,IAAmB,EAAE;IAChC,MAAMC,MAAM,GAAGX,MAAM,CAACU,IAAI,CAACC,MAAM,CAAC;IAClC,KAAK,CAAC,SAAS,EAAED,IAAI,CAACE,IAAI,EAAE;MAC3BC,OAAO,EAAEH,IAAI,CAACI,UAAU;MACxBC,SAAS,EAAEV,SAAS,CAACW,GAAG,CAACN,IAAI,CAACE,IAAI,CAAC;MACnCK,aAAa,EAAEN;IAChB,CAAC,CAAC;IACF,IAAI,CAACO,IAAI,GAAG,WAAW;IACvB,IAAI,CAACC,QAAQ,GAAGT,IAAI,CAACS,QAAQ,IAAI,WAAW;IAC5C,IAAI,CAACL,UAAU,GAAGJ,IAAI,CAACI,UAAU;IACjC,IAAI,CAACH,MAAM,GAAGA,MAAM;EACrB;AACD;AAACS,OAAA,CAAAb,SAAA,GAAAA,SAAA;AAEM,MAAMc,eAAe,SAASd,SAAS,CAAC;EAC9CE,WAAWA,CAACK,UAA0B,EAAEH,MAAe,EAAE;IACxD,KAAK,CAAC;MAAEC,IAAI,EAAE,qBAAqB;MAAEE,UAAU;MAAEK,QAAQ,EAAE,WAAW;MAAER;IAAO,CAAC,CAAC;IACjF,IAAI,CAACO,IAAI,GAAG,iBAAiB;EAC9B;AACD;AAACE,OAAA,CAAAC,eAAA,GAAAA,eAAA;AAEM,SAASC,WAAWA,CAACrB,KAAc,EAAsB;EAC/D,OAAOA,KAAK,YAAYM,SAAS;AAClC;;AAEA;AACO,SAASgB,WAAWA,CAC1BtB,KAAc,EACduB,YAA2B,GAAG,0BAA0B,EACxDC,kBAAkC,GAAG,kBAAkB,EAC3C;EACZ,IAAIH,WAAW,CAACrB,KAAK,CAAC,EAAE;IACvB,OAAOA,KAAK;EACb;EACA,MAAMY,OAAO,GAAGZ,KAAK,YAAYyB,KAAK,GAAGzB,KAAK,CAACY,OAAO,GAAGc,MAAM,CAAC1B,KAAK,CAAC;EACtE,OAAO,IAAIM,SAAS,CAAC;IACpBK,IAAI,EAAEY,YAAY;IAClBV,UAAU,EAAEW,kBAAkB;IAC9BN,QAAQ,EAAE,WAAW;IACrBR,MAAM,EAAEE;EACT,CAAC,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/diagnostics/messageKeys.js

@@ -0,0 +1,51 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.authMessages = exports.DEFAULT_MESSAGES = void 0;
+exports.resolveMessages = resolveMessages;
+var _rnCore = require("@chipmobilesdk/rn-core");
+/**
+ * Stable, localizable message keys with English default copy (UX-006 / LIB-011).
+ * The library takes no i18n runtime dependency: consuming apps map these keys to
+ * localized strings via their own i18n system. User-actionable copy and
+ * developer/tenant-configuration copy are kept separate (UX-005).
+ */
+
+/**
+ * The catalog, as an rn-core message set: `user` copy may reach an end user,
+ * `developer` copy describes a tenant or configuration fault (UX-005). Register
+ * `authMessages.user` with rn-i18n to translate it like app copy.
+ */
+const authMessages = exports.authMessages = (0, _rnCore.defineMessages)({
+  user: {
+    'auth.action.continueGoogle': 'Continue with Google',
+    'auth.action.continueApple': 'Continue with Apple',
+    'auth.action.continueFacebook': 'Continue with Facebook',
+    'auth.state.signedOut': 'Sign in to continue',
+    'auth.state.authenticating': 'Signing you in…',
+    'auth.state.signedIn': 'You are signed in',
+    'auth.state.signingOut': 'Signing out…',
+    'auth.tier.free': 'Free',
+    'auth.tier.premium': 'Premium',
+    'auth.tier.unverified': 'Membership could not be verified',
+    'auth.error.cancelled': 'Sign-in was cancelled. You can try again.',
+    'auth.error.sessionExpired': 'Your session expired. Please sign in again.',
+    'auth.error.entitlement': 'This feature requires a verified premium membership.',
+    'auth.error.network': 'No connection. Some features are limited until you reconnect.'
+  },
+  developer: {
+    'auth.error.configuration': 'Authentication is not configured correctly.',
+    'auth.error.redirectMismatch': 'The sign-in redirect does not match the app configuration.',
+    'auth.error.token': 'We could not complete the request. Please try again.',
+    'auth.error.consentDenied': 'Access to this resource was denied.'
+  }
+});
+const DEFAULT_MESSAGES = exports.DEFAULT_MESSAGES = authMessages.defaults;
+
+/** Resolve a message, preferring app overrides over the English defaults. */
+function resolveMessages(overrides) {
+  return authMessages.resolve(overrides);
+}
+//# sourceMappingURL=messageKeys.js.map

package/lib/commonjs/diagnostics/messageKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_rnCore","require","authMessages","exports","defineMessages","user","developer","DEFAULT_MESSAGES","defaults","resolveMessages","overrides","resolve"],"sourceRoot":"../../../src","sources":["diagnostics/messageKeys.ts"],"mappings":";;;;;;;AAOA,IAAAA,OAAA,GAAAC,OAAA;AAPA;AACA;AACA;AACA;AACA;AACA;;AA+BA;AACA;AACA;AACA;AACA;AACO,MAAMC,YAAY,GAAAC,OAAA,CAAAD,YAAA,GAAG,IAAAE,sBAAc,EAAC;EAC1CC,IAAI,EAAE;IACL,4BAA4B,EAAE,sBAAsB;IACpD,2BAA2B,EAAE,qBAAqB;IAClD,8BAA8B,EAAE,wBAAwB;IACxD,sBAAsB,EAAE,qBAAqB;IAC7C,2BAA2B,EAAE,iBAAiB;IAC9C,qBAAqB,EAAE,mBAAmB;IAC1C,uBAAuB,EAAE,cAAc;IACvC,gBAAgB,EAAE,MAAM;IACxB,mBAAmB,EAAE,SAAS;IAC9B,sBAAsB,EAAE,kCAAkC;IAC1D,sBAAsB,EAAE,2CAA2C;IACnE,2BAA2B,EAAE,6CAA6C;IAC1E,wBAAwB,EAAE,sDAAsD;IAChF,oBAAoB,EAAE;EACvB,CAAC;EACDC,SAAS,EAAE;IACV,0BAA0B,EAAE,6CAA6C;IACzE,6BAA6B,EAAE,4DAA4D;IAC3F,kBAAkB,EAAE,sDAAsD;IAC1E,0BAA0B,EAAE;EAC7B;AACD,CAAC,CAAC;AAEK,MAAMC,gBAAgC,GAAAJ,OAAA,CAAAI,gBAAA,GAAGL,YAAY,CAACM,QAAQ;;AAErE;AACO,SAASC,eAAeA,CAACC,SAAmC,EAAkB;EACpF,OAAOR,YAAY,CAACS,OAAO,CAACD,SAAS,CAAC;AACvC","ignoreList":[]}

package/lib/commonjs/index.js

@@ -0,0 +1,175 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+Object.defineProperty(exports, "AUTH_STORAGE_KEY", {
+  enumerable: true,
+  get: function () {
+    return _secureStore.AUTH_STORAGE_KEY;
+  }
+});
+Object.defineProperty(exports, "AuthConfigError", {
+  enumerable: true,
+  get: function () {
+    return _errors.AuthConfigError;
+  }
+});
+Object.defineProperty(exports, "AuthError", {
+  enumerable: true,
+  get: function () {
+    return _errors.AuthError;
+  }
+});
+Object.defineProperty(exports, "AuthProvider", {
+  enumerable: true,
+  get: function () {
+    return _AuthProvider.AuthProvider;
+  }
+});
+Object.defineProperty(exports, "DEFAULT_MESSAGES", {
+  enumerable: true,
+  get: function () {
+    return _messageKeys.DEFAULT_MESSAGES;
+  }
+});
+Object.defineProperty(exports, "authMessages", {
+  enumerable: true,
+  get: function () {
+    return _messageKeys.authMessages;
+  }
+});
+Object.defineProperty(exports, "createAppAuthClient", {
+  enumerable: true,
+  get: function () {
+    return _authClient.createAppAuthClient;
+  }
+});
+exports.createAuth = createAuth;
+Object.defineProperty(exports, "createKeychainSecureStore", {
+  enumerable: true,
+  get: function () {
+    return _secureStore.createKeychainSecureStore;
+  }
+});
+Object.defineProperty(exports, "describeProviderIdentity", {
+  enumerable: true,
+  get: function () {
+    return _profile.describeProviderIdentity;
+  }
+});
+Object.defineProperty(exports, "evaluateAccessTier", {
+  enumerable: true,
+  get: function () {
+    return _accessTier.evaluateAccessTier;
+  }
+});
+Object.defineProperty(exports, "failClosedTier", {
+  enumerable: true,
+  get: function () {
+    return _accessTier.failClosedTier;
+  }
+});
+Object.defineProperty(exports, "isAuthError", {
+  enumerable: true,
+  get: function () {
+    return _errors.isAuthError;
+  }
+});
+Object.defineProperty(exports, "mapClaimsToProfile", {
+  enumerable: true,
+  get: function () {
+    return _profile.mapClaimsToProfile;
+  }
+});
+Object.defineProperty(exports, "redact", {
+  enumerable: true,
+  get: function () {
+    return _errors.redact;
+  }
+});
+Object.defineProperty(exports, "resolveMessages", {
+  enumerable: true,
+  get: function () {
+    return _messageKeys.resolveMessages;
+  }
+});
+Object.defineProperty(exports, "useAccessTier", {
+  enumerable: true,
+  get: function () {
+    return _hooks.useAccessTier;
+  }
+});
+Object.defineProperty(exports, "useAccessToken", {
+  enumerable: true,
+  get: function () {
+    return _hooks.useAccessToken;
+  }
+});
+Object.defineProperty(exports, "useAuth", {
+  enumerable: true,
+  get: function () {
+    return _hooks.useAuth;
+  }
+});
+Object.defineProperty(exports, "useAuthMessages", {
+  enumerable: true,
+  get: function () {
+    return _hooks.useAuthMessages;
+  }
+});
+Object.defineProperty(exports, "useAuthSelector", {
+  enumerable: true,
+  get: function () {
+    return _hooks.useAuthSelector;
+  }
+});
+Object.defineProperty(exports, "useProfile", {
+  enumerable: true,
+  get: function () {
+    return _hooks.useProfile;
+  }
+});
+Object.defineProperty(exports, "useSignInProvider", {
+  enumerable: true,
+  get: function () {
+    return _hooks.useSignInProvider;
+  }
+});
+Object.defineProperty(exports, "useSignInProviders", {
+  enumerable: true,
+  get: function () {
+    return _hooks.useSignInProviders;
+  }
+});
+var _authMachine = require("./core/authMachine.js");
+var _profile = require("./core/profile.js");
+var _secureStore = require("./tokens/secureStore.js");
+var _authClient = require("./oidc/authClient.js");
+var _accessTier = require("./access/accessTier.js");
+var _errors = require("./diagnostics/errors.js");
+var _messageKeys = require("./diagnostics/messageKeys.js");
+var _AuthProvider = require("./react/AuthProvider.js");
+var _hooks = require("./react/hooks.js");
+/**
+ * @chipmobilesdk/rn-auth — reusable Microsoft Entra External ID authentication
+ * for ChipMobileSdk-family React Native apps (public OIDC/PKCE client, no
+ * backend). This is the single public entrypoint (LIB-003); modules under
+ * `core/`, `tokens/`, `oidc/`, `access/`, and `diagnostics/` are private.
+ */
+
+/** Create the auth controller. Throws AuthConfigError on invalid config (FR-005). */
+function createAuth(config, options) {
+  return (0, _authMachine.createAuthMachine)(config, options);
+}
+
+// Public types
+
+// Ports + default adapters
+
+// Access-tier evaluation (also exported for app-side reuse/testing)
+
+// Diagnostics
+
+// React bindings
+//# sourceMappingURL=index.js.map

package/lib/commonjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_authMachine","require","_profile","_secureStore","_authClient","_accessTier","_errors","_messageKeys","_AuthProvider","_hooks","createAuth","config","options","createAuthMachine"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,IAAAA,YAAA,GAAAC,OAAA;AAiCA,IAAAC,QAAA,GAAAD,OAAA;AAIA,IAAAE,YAAA,GAAAF,OAAA;AAUA,IAAAG,WAAA,GAAAH,OAAA;AAGA,IAAAI,WAAA,GAAAJ,OAAA;AAGA,IAAAK,OAAA,GAAAL,OAAA;AAEA,IAAAM,YAAA,GAAAN,OAAA;AAIA,IAAAO,aAAA,GAAAP,OAAA;AACA,IAAAQ,MAAA,GAAAR,OAAA;AAnEA;AACA;AACA;AACA;AACA;AACA;;AAKA;AACO,SAASS,UAAUA,CAACC,MAAkB,EAAEC,OAA2B,EAAQ;EACjF,OAAO,IAAAC,8BAAiB,EAACF,MAAM,EAAEC,OAAO,CAAC;AAC1C;;AAEA;;AAwBA;;AAiBA;;AAGA;;AAMA","ignoreList":[]}

package/lib/commonjs/keychain.js

@@ -0,0 +1,13 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+Object.defineProperty(exports, "createKeychainSecureStore", {
+  enumerable: true,
+  get: function () {
+    return _secureStore.createKeychainSecureStore;
+  }
+});
+var _secureStore = require("./tokens/secureStore.js");
+//# sourceMappingURL=keychain.js.map

package/lib/commonjs/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_secureStore","require"],"sourceRoot":"../../src","sources":["keychain.ts"],"mappings":";;;;;;;;;;;AAKA,IAAAA,YAAA,GAAAC,OAAA","ignoreList":[]}

package/lib/commonjs/oidc/authClient.js

@@ -0,0 +1,157 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createAppAuthClient = createAppAuthClient;
+exports.decodeJwtClaims = decodeJwtClaims;
+var _rnCore = require("@chipmobilesdk/rn-core");
+var _errors = require("../diagnostics/errors.js");
+var _classifyError = require("./classifyError.js");
+/**
+ * OidcAuthClient port + default react-native-app-auth adapter (R1).
+ *
+ * The port abstracts the Authorization Code + PKCE public-client flow so the
+ * auth engine is testable without native code. The default adapter lazily
+ * requires react-native-app-auth and is validated on device.
+ */
+
+/** Decode the payload segment of a JWT without any dependency (device-safe). */
+function decodeJwtClaims(jwt) {
+  if (typeof jwt !== 'string') {
+    return {};
+  }
+  const [, payload] = jwt.split('.');
+  if (payload === undefined) {
+    return {};
+  }
+  try {
+    const json = base64UrlDecode(payload);
+    return JSON.parse(json);
+  } catch {
+    return {};
+  }
+}
+const BASE64_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+function base64UrlDecode(input) {
+  let base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+  while (base64.length % 4 !== 0) {
+    base64 += '=';
+  }
+  let bytes = '';
+  let buffer = 0;
+  let bits = 0;
+  for (const char of base64) {
+    if (char === '=') {
+      break;
+    }
+    const index = BASE64_CHARS.indexOf(char);
+    if (index === -1) {
+      continue;
+    }
+    // Standard base64 bit assembly; bitwise ops are intentional here.
+    // eslint-disable-next-line no-bitwise
+    buffer = buffer << 6 | index;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      // eslint-disable-next-line no-bitwise
+      bytes += String.fromCharCode(buffer >> bits & 0xff);
+    }
+  }
+  // Interpret the byte string (each char is a 0–255 byte) as UTF-8 without
+  // relying on the deprecated global `escape`.
+  try {
+    const percentEncoded = Array.from(bytes).map(char => '%' + char.charCodeAt(0).toString(16).padStart(2, '0')).join('');
+    return decodeURIComponent(percentEncoded);
+  } catch {
+    return bytes;
+  }
+}
+
+/** The endpoints discovery would have returned, when an app already knows them. */
+
+/**
+ * Loaded on the first sign-in, refresh or sign-out, never at startup (PERF-05):
+ * creating the client, or the whole auth instance, loads no native code.
+ */
+const appAuthPeer = (0, _rnCore.lazyPeer)('react-native-app-auth', () => {
+  // Inside `try`, so Metro bundles an app that leaves this optional peer out.
+  try {
+    return require('react-native-app-auth');
+  } catch (cause) {
+    throw cause;
+  }
+});
+function appAuth() {
+  return appAuthPeer.require(peer => new _errors.AuthConfigError('auth.error.configuration', `${peer} is not installed or its native module is not linked`));
+}
+
+/** The module's calls, resolved only when one is made. */
+const AppAuth = {
+  authorize: config => appAuth().authorize(config),
+  refresh: (config, params) => appAuth().refresh(config, params),
+  logout: (config, params) => appAuth().logout(config, params)
+};
+
+/**
+ * Default OidcAuthClient adapter wrapping react-native-app-auth (PKCE public
+ * client). Validated on device (R8).
+ */
+function createAppAuthClient(options = {}) {
+  const serviceConfiguration = options.serviceConfiguration;
+  // Discovery is pointless once the endpoints are given, whatever was asked for.
+  const useDiscovery = serviceConfiguration ? false : options.useDiscovery ?? true;
+  const baseConfig = (authority, clientId, redirectUrl, scopes) => ({
+    issuer: useDiscovery ? authority : undefined,
+    ...(serviceConfiguration ? {
+      serviceConfiguration
+    } : {}),
+    clientId,
+    redirectUrl,
+    scopes
+  });
+  const toTokens = result => ({
+    accessToken: result.accessToken,
+    // Absent stays absent: an empty string was indistinguishable from a real
+    // token by type, and silently disabled session persistence.
+    refreshToken: result.refreshToken || undefined,
+    idToken: result.idToken || undefined,
+    claims: decodeJwtClaims(result.idToken),
+    accessTokenExpiresAt: result.accessTokenExpirationDate ? new Date(result.accessTokenExpirationDate).getTime() : undefined
+  });
+  return {
+    async authorize(params) {
+      try {
+        const result = await AppAuth.authorize({
+          ...baseConfig(params.authority, params.clientId, params.redirectUrl, params.scopes),
+          additionalParameters: params.additionalParameters
+        });
+        return toTokens(result);
+      } catch (error) {
+        throw (0, _classifyError.classifyAppAuthError)(error);
+      }
+    },
+    async refresh(params) {
+      try {
+        const result = await AppAuth.refresh(baseConfig(params.authority, params.clientId, params.redirectUrl, params.scopes), {
+          refreshToken: params.refreshToken
+        });
+        return toTokens(result);
+      } catch (error) {
+        throw (0, _classifyError.classifyAppAuthError)(error);
+      }
+    },
+    async endSession(params) {
+      try {
+        await AppAuth.logout(baseConfig(params.authority, params.clientId, params.redirectUrl, []), {
+          idToken: params.idToken ?? '',
+          postLogoutRedirectUrl: params.redirectUrl
+        });
+      } catch (error) {
+        throw (0, _classifyError.classifyAppAuthError)(error);
+      }
+    }
+  };
+}
+//# sourceMappingURL=authClient.js.map

package/lib/commonjs/oidc/authClient.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_rnCore","require","_errors","_classifyError","decodeJwtClaims","jwt","payload","split","undefined","json","base64UrlDecode","JSON","parse","BASE64_CHARS","input","base64","replace","length","bytes","buffer","bits","char","index","indexOf","String","fromCharCode","percentEncoded","Array","from","map","charCodeAt","toString","padStart","join","decodeURIComponent","appAuthPeer","lazyPeer","cause","appAuth","peer","AuthConfigError","AppAuth","authorize","config","refresh","params","logout","createAppAuthClient","options","serviceConfiguration","useDiscovery","baseConfig","authority","clientId","redirectUrl","scopes","issuer","toTokens","result","accessToken","refreshToken","idToken","claims","accessTokenExpiresAt","accessTokenExpirationDate","Date","getTime","additionalParameters","error","classifyAppAuthError","endSession","postLogoutRedirectUrl"],"sourceRoot":"../../../src","sources":["oidc/authClient.ts"],"mappings":";;;;;;;AAQA,IAAAA,OAAA,GAAAC,OAAA;AAEA,IAAAC,OAAA,GAAAD,OAAA;AAEA,IAAAE,cAAA,GAAAF,OAAA;AAZA;AACA;AACA;AACA;AACA;AACA;AACA;;AAuDA;AACO,SAASG,eAAeA,CAACC,GAA8B,EAA2B;EACxF,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;IAC5B,OAAO,CAAC,CAAC;EACV;EACA,MAAM,GAAGC,OAAO,CAAC,GAAGD,GAAG,CAACE,KAAK,CAAC,GAAG,CAAC;EAClC,IAAID,OAAO,KAAKE,SAAS,EAAE;IAC1B,OAAO,CAAC,CAAC;EACV;EACA,IAAI;IACH,MAAMC,IAAI,GAAGC,eAAe,CAACJ,OAAO,CAAC;IACrC,OAAOK,IAAI,CAACC,KAAK,CAACH,IAAI,CAAC;EACxB,CAAC,CAAC,MAAM;IACP,OAAO,CAAC,CAAC;EACV;AACD;AAEA,MAAMI,YAAY,GAAG,kEAAkE;AAEvF,SAASH,eAAeA,CAACI,KAAa,EAAU;EAC/C,IAAIC,MAAM,GAAGD,KAAK,CAACE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAACA,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;EACxD,OAAOD,MAAM,CAACE,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE;IAC/BF,MAAM,IAAI,GAAG;EACd;EACA,IAAIG,KAAK,GAAG,EAAE;EACd,IAAIC,MAAM,GAAG,CAAC;EACd,IAAIC,IAAI,GAAG,CAAC;EACZ,KAAK,MAAMC,IAAI,IAAIN,MAAM,EAAE;IAC1B,IAAIM,IAAI,KAAK,GAAG,EAAE;MACjB;IACD;IACA,MAAMC,KAAK,GAAGT,YAAY,CAACU,OAAO,CAACF,IAAI,CAAC;IACxC,IAAIC,KAAK,KAAK,CAAC,CAAC,EAAE;MACjB;IACD;IACA;IACA;IACAH,MAAM,GAAIA,MAAM,IAAI,CAAC,GAAIG,KAAK;IAC9BF,IAAI,IAAI,CAAC;IACT,IAAIA,IAAI,IAAI,CAAC,EAAE;MACdA,IAAI,IAAI,CAAC;MACT;MACAF,KAAK,IAAIM,MAAM,CAACC,YAAY,CAAEN,MAAM,IAAIC,IAAI,GAAI,IAAI,CAAC;IACtD;EACD;EACA;EACA;EACA,IAAI;IACH,MAAMM,cAAc,GAAGC,KAAK,CAACC,IAAI,CAACV,KAAK,CAAC,CACtCW,GAAG,CAACR,IAAI,IAAI,GAAG,GAAGA,IAAI,CAACS,UAAU,CAAC,CAAC,CAAC,CAACC,QAAQ,CAAC,EAAE,CAAC,CAACC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CACnEC,IAAI,CAAC,EAAE,CAAC;IACV,OAAOC,kBAAkB,CAACR,cAAc,CAAC;EAC1C,CAAC,CAAC,MAAM;IACP,OAAOR,KAAK;EACb;AACD;;AAEA;;AA6BA;AACA;AACA;AACA;AACA,MAAMiB,WAAW,GAAG,IAAAC,gBAAQ,EAAC,uBAAuB,EAAE,MAAM;EAC3D;EACA,IAAI;IACH,OAAOnC,OAAO,CAAC,uBAAuB,CAAC;EACxC,CAAC,CAAC,OAAOoC,KAAK,EAAE;IACf,MAAMA,KAAK;EACZ;AACD,CAAC,CAAC;AAEF,SAASC,OAAOA,CAAA,EAAkB;EACjC,OAAOH,WAAW,CAAClC,OAAO,CACzBsC,IAAI,IACH,IAAIC,uBAAe,CAClB,0BAA0B,EAC1B,GAAGD,IAAI,sDACR,CACF,CAAC;AACF;;AAEA;AACA,MAAME,OAAsB,GAAG;EAC9BC,SAAS,EAAEC,MAAM,IAAIL,OAAO,CAAC,CAAC,CAACI,SAAS,CAACC,MAAM,CAAC;EAChDC,OAAO,EAAEA,CAACD,MAAM,EAAEE,MAAM,KAAKP,OAAO,CAAC,CAAC,CAACM,OAAO,CAACD,MAAM,EAAEE,MAAM,CAAC;EAC9DC,MAAM,EAAEA,CAACH,MAAM,EAAEE,MAAM,KAAKP,OAAO,CAAC,CAAC,CAACQ,MAAM,CAACH,MAAM,EAAEE,MAAM;AAC5D,CAAC;;AAED;AACA;AACA;AACA;AACO,SAASE,mBAAmBA,CAACC,OAA6B,GAAG,CAAC,CAAC,EAAkB;EACvF,MAAMC,oBAAoB,GAAGD,OAAO,CAACC,oBAAoB;EACzD;EACA,MAAMC,YAAY,GAAGD,oBAAoB,GAAG,KAAK,GAAID,OAAO,CAACE,YAAY,IAAI,IAAK;EAElF,MAAMC,UAAU,GAAGA,CAClBC,SAAiB,EACjBC,QAAgB,EAChBC,WAAmB,EACnBC,MAAgB,MACX;IACLC,MAAM,EAAEN,YAAY,GAAGE,SAAS,GAAG5C,SAAS;IAC5C,IAAIyC,oBAAoB,GAAG;MAAEA;IAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;IACzDI,QAAQ;IACRC,WAAW;IACXC;EACD,CAAC,CAAC;EAEF,MAAME,QAAQ,GAAIC,MAKjB,KAAkB;IAClBC,WAAW,EAAED,MAAM,CAACC,WAAW;IAC/B;IACA;IACAC,YAAY,EAAEF,MAAM,CAACE,YAAY,IAAIpD,SAAS;IAC9CqD,OAAO,EAAEH,MAAM,CAACG,OAAO,IAAIrD,SAAS;IACpCsD,MAAM,EAAE1D,eAAe,CAACsD,MAAM,CAACG,OAAO,CAAC;IACvCE,oBAAoB,EAAEL,MAAM,CAACM,yBAAyB,GACnD,IAAIC,IAAI,CAACP,MAAM,CAACM,yBAAyB,CAAC,CAACE,OAAO,CAAC,CAAC,GACpD1D;EACJ,CAAC,CAAC;EAEF,OAAO;IACN,MAAMkC,SAASA,CAACG,MAAM,EAAE;MACvB,IAAI;QACH,MAAMa,MAAM,GAAG,MAAMjB,OAAO,CAACC,SAAS,CAAC;UACtC,GAAGS,UAAU,CAACN,MAAM,CAACO,SAAS,EAAEP,MAAM,CAACQ,QAAQ,EAAER,MAAM,CAACS,WAAW,EAAET,MAAM,CAACU,MAAM,CAAC;UACnFY,oBAAoB,EAAEtB,MAAM,CAACsB;QAC9B,CAAC,CAAC;QACF,OAAOV,QAAQ,CAACC,MAAM,CAAC;MACxB,CAAC,CAAC,OAAOU,KAAK,EAAE;QACf,MAAM,IAAAC,mCAAoB,EAACD,KAAK,CAAC;MAClC;IACD,CAAC;IACD,MAAMxB,OAAOA,CAACC,MAAM,EAAE;MACrB,IAAI;QACH,MAAMa,MAAM,GAAG,MAAMjB,OAAO,CAACG,OAAO,CACnCO,UAAU,CAACN,MAAM,CAACO,SAAS,EAAEP,MAAM,CAACQ,QAAQ,EAAER,MAAM,CAACS,WAAW,EAAET,MAAM,CAACU,MAAM,CAAC,EAChF;UAAEK,YAAY,EAAEf,MAAM,CAACe;QAAa,CACrC,CAAC;QACD,OAAOH,QAAQ,CAACC,MAAM,CAAC;MACxB,CAAC,CAAC,OAAOU,KAAK,EAAE;QACf,MAAM,IAAAC,mCAAoB,EAACD,KAAK,CAAC;MAClC;IACD,CAAC;IACD,MAAME,UAAUA,CAACzB,MAAM,EAAE;MACxB,IAAI;QACH,MAAMJ,OAAO,CAACK,MAAM,CACnBK,UAAU,CAACN,MAAM,CAACO,SAAS,EAAEP,MAAM,CAACQ,QAAQ,EAAER,MAAM,CAACS,WAAW,EAAE,EAAE,CAAC,EACrE;UACCO,OAAO,EAAEhB,MAAM,CAACgB,OAAO,IAAI,EAAE;UAC7BU,qBAAqB,EAAE1B,MAAM,CAACS;QAC/B,CACD,CAAC;MACF,CAAC,CAAC,OAAOc,KAAK,EAAE;QACf,MAAM,IAAAC,mCAAoB,EAACD,KAAK,CAAC;MAClC;IACD;EACD,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/oidc/classifyError.js

@@ -0,0 +1,65 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.DEFAULT_CLASSIFICATION_RULES = void 0;
+exports.classifyAppAuthError = classifyAppAuthError;
+var _errors = require("../diagnostics/errors.js");
+/**
+ * Classifies a native OIDC error into an `AuthErrorCode`.
+ *
+ * The rules are an ordered table rather than a chain of substring checks, so a
+ * platform adapter (the iOS one, later) adds its own rows without touching the
+ * engine. Order matters: the first matching rule wins.
+ *
+ * The default is deliberately not "session expired". Restore clears the stored
+ * session only on `session-expired`, so anything this table cannot name — a
+ * timeout, a 5xx, a discovery failure, a localized message — must keep the
+ * session rather than sign the user out.
+ */
+
+/**
+ * OAuth error codes (RFC 6749 §5.2, OIDC Core §3.1.2.6) and the Entra ID AADSTS
+ * codes that mean the same thing, plus the transport failures app-auth reports.
+ */
+const DEFAULT_CLASSIFICATION_RULES = exports.DEFAULT_CLASSIFICATION_RULES = [{
+  code: 'provider-cancelled',
+  messageKey: 'auth.error.cancelled',
+  pattern: /cancel|user_cancel|authorization flow (was )?dismissed/i
+}, {
+  code: 'session-expired',
+  messageKey: 'auth.error.sessionExpired',
+  // invalid_grant is the refresh-token verdict; the AADSTS codes are Entra's
+  // expired, revoked, or inactive refresh token and password-changed cases.
+  pattern: /\binvalid_grant\b|\binteraction_required\b|\blogin_required\b|AADSTS(700082|700084|50173|70043)\b/i
+}, {
+  code: 'redirect-mismatch',
+  messageKey: 'auth.error.redirectMismatch',
+  pattern: /redirect_uri|redirect uri|redirect_mismatch|AADSTS50011\b/i
+}, {
+  code: 'consent-denied',
+  messageKey: 'auth.error.consentDenied',
+  pattern: /\baccess_denied\b|\bconsent_required\b|AADSTS65001\b/i
+}, {
+  code: 'network-unavailable',
+  messageKey: 'auth.error.network',
+  pattern: /network|connection|offline|timed? ?out|unable to resolve host|unreachable|\bserver_error\b|\btemporarily_unavailable\b|\b5\d\d\b/i
+}];
+
+/** Maps a native app-auth error to a classified AuthError without leaking tokens. */
+function classifyAppAuthError(error, rules = DEFAULT_CLASSIFICATION_RULES) {
+  const message = error instanceof Error ? error.message : String(error);
+  const nativeCode = error?.code;
+  const haystack = `${typeof nativeCode === 'string' ? nativeCode : ''} ${message}`;
+  const rule = rules.find(candidate => candidate.pattern.test(haystack));
+  const code = rule?.code ?? 'token-acquisition-failed';
+  return new _errors.AuthError({
+    code,
+    messageKey: rule?.messageKey ?? 'auth.error.token',
+    audience: code === 'redirect-mismatch' ? 'developer' : 'user',
+    // AuthError redacts `detail`, so token-shaped values never survive.
+    detail: message
+  });
+}
+//# sourceMappingURL=classifyError.js.map

package/lib/commonjs/oidc/classifyError.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_errors","require","DEFAULT_CLASSIFICATION_RULES","exports","code","messageKey","pattern","classifyAppAuthError","error","rules","message","Error","String","nativeCode","haystack","rule","find","candidate","test","AuthError","audience","detail"],"sourceRoot":"../../../src","sources":["oidc/classifyError.ts"],"mappings":";;;;;;;AAaA,IAAAA,OAAA,GAAAC,OAAA;AAbA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAYA;AACA;AACA;AACA;AACO,MAAMC,4BAA2D,GAAAC,OAAA,CAAAD,4BAAA,GAAG,CAC1E;EACCE,IAAI,EAAE,oBAAoB;EAC1BC,UAAU,EAAE,sBAAsB;EAClCC,OAAO,EAAE;AACV,CAAC,EACD;EACCF,IAAI,EAAE,iBAAiB;EACvBC,UAAU,EAAE,2BAA2B;EACvC;EACA;EACAC,OAAO,EACN;AACF,CAAC,EACD;EACCF,IAAI,EAAE,mBAAmB;EACzBC,UAAU,EAAE,6BAA6B;EACzCC,OAAO,EAAE;AACV,CAAC,EACD;EACCF,IAAI,EAAE,gBAAgB;EACtBC,UAAU,EAAE,0BAA0B;EACtCC,OAAO,EAAE;AACV,CAAC,EACD;EACCF,IAAI,EAAE,qBAAqB;EAC3BC,UAAU,EAAE,oBAAoB;EAChCC,OAAO,EACN;AACF,CAAC,CACD;;AAED;AACO,SAASC,oBAAoBA,CACnCC,KAAc,EACdC,KAAoC,GAAGP,4BAA4B,EACvD;EACZ,MAAMQ,OAAO,GAAGF,KAAK,YAAYG,KAAK,GAAGH,KAAK,CAACE,OAAO,GAAGE,MAAM,CAACJ,KAAK,CAAC;EACtE,MAAMK,UAAU,GAAIL,KAAK,EAAqCJ,IAAI;EAClE,MAAMU,QAAQ,GAAG,GAAG,OAAOD,UAAU,KAAK,QAAQ,GAAGA,UAAU,GAAG,EAAE,IAAIH,OAAO,EAAE;EACjF,MAAMK,IAAI,GAAGN,KAAK,CAACO,IAAI,CAACC,SAAS,IAAIA,SAAS,CAACX,OAAO,CAACY,IAAI,CAACJ,QAAQ,CAAC,CAAC;EACtE,MAAMV,IAAI,GAAGW,IAAI,EAAEX,IAAI,IAAI,0BAA0B;EACrD,OAAO,IAAIe,iBAAS,CAAC;IACpBf,IAAI;IACJC,UAAU,EAAEU,IAAI,EAAEV,UAAU,IAAI,kBAAkB;IAClDe,QAAQ,EAAEhB,IAAI,KAAK,mBAAmB,GAAG,WAAW,GAAG,MAAM;IAC7D;IACAiB,MAAM,EAAEX;EACT,CAAC,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/oidc/socialRouting.js

@@ -0,0 +1,58 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.availableProvidersForPlatform = availableProvidersForPlatform;
+exports.buildAdditionalParameters = buildAdditionalParameters;
+exports.defaultProviderForPlatform = defaultProviderForPlatform;
+exports.resolveProvider = resolveProvider;
+var _errors = require("../diagnostics/errors.js");
+/**
+ * Social provider routing (FR-002/FR-003, R3). Google and Apple are federated
+ * inside the External ID tenant; the app presents the platform-correct action
+ * and starts the user flow with a per-provider `domain_hint`.
+ */
+
+/** Find the configured provider, ensuring it is enabled for the platform. */
+function resolveProvider(config, providerId, platform) {
+  const provider = config.providers.find(candidate => candidate.id === providerId);
+  if (!provider) {
+    throw new _errors.AuthConfigError('auth.error.configuration', `Provider "${providerId}" is not configured`);
+  }
+  if (!provider.platforms.includes(platform)) {
+    throw new _errors.AuthConfigError('auth.error.configuration', `Provider "${providerId}" is not enabled for platform "${platform}"`);
+  }
+  if (provider.available === false) {
+    throw new _errors.AuthConfigError('auth.error.configuration', `Provider "${providerId}" is marked unavailable`);
+  }
+  return provider;
+}
+
+/** Build the OIDC additional parameters that route to the chosen IdP. */
+function buildAdditionalParameters(provider) {
+  // The routing hint last: a provider's own parameters cannot redirect the flow
+  // to a different IdP than the one the user tapped.
+  return {
+    ...provider.additionalParameters,
+    domain_hint: provider.domainHint
+  };
+}
+
+/**
+ * All providers to present on a given platform, in configuration array order
+ * (FR-003/FR-004). Filtered to providers enabled for the platform and not marked
+ * unavailable.
+ */
+function availableProvidersForPlatform(config, platform) {
+  return config.providers.filter(provider => provider.platforms.includes(platform) && provider.available !== false);
+}
+
+/**
+ * The first available provider for a platform (UX-004, back-compat). Equals
+ * `availableProvidersForPlatform(config, platform)[0]`.
+ */
+function defaultProviderForPlatform(config, platform) {
+  return availableProvidersForPlatform(config, platform)[0];
+}
+//# sourceMappingURL=socialRouting.js.map

package/lib/commonjs/oidc/socialRouting.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_errors","require","resolveProvider","config","providerId","platform","provider","providers","find","candidate","id","AuthConfigError","platforms","includes","available","buildAdditionalParameters","additionalParameters","domain_hint","domainHint","availableProvidersForPlatform","filter","defaultProviderForPlatform"],"sourceRoot":"../../../src","sources":["oidc/socialRouting.ts"],"mappings":";;;;;;;;;AAOA,IAAAA,OAAA,GAAAC,OAAA;AAPA;AACA;AACA;AACA;AACA;;AAKA;AACO,SAASC,eAAeA,CAC9BC,MAAkB,EAClBC,UAAsB,EACtBC,QAAwB,EACP;EACjB,MAAMC,QAAQ,GAAGH,MAAM,CAACI,SAAS,CAACC,IAAI,CAACC,SAAS,IAAIA,SAAS,CAACC,EAAE,KAAKN,UAAU,CAAC;EAChF,IAAI,CAACE,QAAQ,EAAE;IACd,MAAM,IAAIK,uBAAe,CACxB,0BAA0B,EAC1B,aAAaP,UAAU,qBACxB,CAAC;EACF;EACA,IAAI,CAACE,QAAQ,CAACM,SAAS,CAACC,QAAQ,CAACR,QAAQ,CAAC,EAAE;IAC3C,MAAM,IAAIM,uBAAe,CACxB,0BAA0B,EAC1B,aAAaP,UAAU,kCAAkCC,QAAQ,GAClE,CAAC;EACF;EACA,IAAIC,QAAQ,CAACQ,SAAS,KAAK,KAAK,EAAE;IACjC,MAAM,IAAIH,uBAAe,CACxB,0BAA0B,EAC1B,aAAaP,UAAU,yBACxB,CAAC;EACF;EACA,OAAOE,QAAQ;AAChB;;AAEA;AACO,SAASS,yBAAyBA,CAACT,QAAwB,EAA0B;EAC3F;EACA;EACA,OAAO;IAAE,GAAGA,QAAQ,CAACU,oBAAoB;IAAEC,WAAW,EAAEX,QAAQ,CAACY;EAAW,CAAC;AAC9E;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASC,6BAA6BA,CAC5ChB,MAAkB,EAClBE,QAAwB,EACL;EACnB,OAAOF,MAAM,CAACI,SAAS,CAACa,MAAM,CAC7Bd,QAAQ,IAAIA,QAAQ,CAACM,SAAS,CAACC,QAAQ,CAACR,QAAQ,CAAC,IAAIC,QAAQ,CAACQ,SAAS,KAAK,KAC7E,CAAC;AACF;;AAEA;AACA;AACA;AACA;AACO,SAASO,0BAA0BA,CACzClB,MAAkB,EAClBE,QAAwB,EACK;EAC7B,OAAOc,6BAA6B,CAAChB,MAAM,EAAEE,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC1D","ignoreList":[]}

package/lib/commonjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}