@chipmobilesdk/rn-auth 0.4.0 → 0.6.0

package/lib/module/core/authMachine.js

@@ -0,0 +1,402 @@
+"use strict";
+
+/**
+ * Auth state machine / orchestrator (FR-005, FR-022, R5, R7). Holds the single
+ * active session, wires the OidcAuthClient + SecureTokenStore ports, profile
+ * mapping, access-tier evaluation, per-resource tokens, restore, and sign-out.
+ *
+ * Every operation that starts or ends a session bumps `sessionEpoch`. Work that
+ * awaited across such a change — a token refresh, a restore, an authorize —
+ * compares the epoch it started with before writing anything back, so a sign-out
+ * can never be undone by a request that was already in flight.
+ */
+
+import { createDiagnosticChannel, createListenerSet, currentPlatform, shallowEqual } from '@chipmobilesdk/rn-core';
+import { resolveMessages } from "../diagnostics/messageKeys.js";
+import { validateConfig } from "../config/validateConfig.js";
+import { createAppAuthClient } from "../oidc/authClient.js";
+import { availableProvidersForPlatform, buildAdditionalParameters, defaultProviderForPlatform, resolveProvider } from "../oidc/socialRouting.js";
+import { mapClaimsToProfile } from "./profile.js";
+import { evaluateAccessTier, failClosedTier } from "../access/accessTier.js";
+import { restoreSession, sameSession, storedProfileFrom } from "./session.js";
+import { AUTH_STORAGE_KEY } from "../tokens/secureStore.js";
+import { createAccessTokenManager } from "../tokens/accessToken.js";
+import { AuthError, toAuthError } from "../diagnostics/errors.js";
+const SIGNED_OUT = {
+  status: 'signed-out',
+  profile: undefined,
+  accessTier: undefined,
+  restore: 'unavailable',
+  error: undefined
+};
+export function createAuthMachine(config, options = {}) {
+  // Throws AuthConfigError before anything else (FR-005, US4 scenario 2).
+  validateConfig(config);
+
+  // rn-core's one platform source (CORE-09). Outside Android and iOS (tests on
+  // Node, web) the providers are resolved as for iOS, as before.
+  const detected = currentPlatform();
+  const platform = options.platform ?? (detected === 'unsupported' ? 'ios' : detected);
+  const secureStore = config.secureStore;
+  const authClient = config.authClient ?? createAppAuthClient();
+  const resources = config.resources ?? [];
+  // Declared since 0.1.0 and read by nothing until now (AUTH-15).
+  const messages = resolveMessages(config.messages);
+  let state = Object.freeze({
+    status: 'loading',
+    restore: 'pending'
+  });
+  let refreshToken = null;
+  /** Kept for the end-session `id_token_hint`; without it a global sign-out is a no-op. */
+  let idToken = null;
+  let sessionEpoch = 0;
+  const listeners = createListenerSet();
+  /**
+   * Every Keychain write and delete, in order. A rotation persisted while a
+   * sign-out runs must not land after the sign-out's delete and resurrect the
+   * session on the next launch.
+   */
+  let storeQueue = Promise.resolve();
+  const enqueueStoreOp = op => {
+    const next = storeQueue.then(op);
+    // The queue itself never rejects, so one failed write does not poison the
+    // writes after it; the caller still sees its own failure through `next`.
+    storeQueue = next.catch(() => undefined);
+    return next;
+  };
+
+  /** The artifact as last written or read, so an identical write is skipped. */
+  let storedSession = null;
+  const writeSession = (session, epoch) => enqueueStoreOp(async () => {
+    if (epoch !== sessionEpoch) {
+      return; // The session this belonged to has already ended.
+    }
+    const artifact = {
+      refreshToken: session.refreshToken,
+      profile: storedProfileFrom(session.profile),
+      idToken: session.idToken
+    };
+    // A restore that rotated nothing used to write the Keychain again on
+    // every launch, on the startup path (AUTH-23).
+    if (storedSession && sameSession(storedSession, artifact)) {
+      return;
+    }
+    await secureStore.setItem(AUTH_STORAGE_KEY, JSON.stringify(artifact));
+    storedSession = artifact;
+  });
+  const tokenManager = createAccessTokenManager({
+    authority: config.authority,
+    clientId: config.clientId,
+    redirectUrl: config.redirectUrl,
+    resources,
+    authClient,
+    getRefreshToken: () => refreshToken,
+    sessionEpoch: () => sessionEpoch,
+    async onRefreshTokenRotated(token, epoch) {
+      if (epoch !== sessionEpoch) {
+        return;
+      }
+      // Live immediately whatever happens to the write: the provider may
+      // already have retired the old token, so memory must not keep using it.
+      refreshToken = token;
+      if (!state.profile) {
+        return;
+      }
+      try {
+        await writeSession({
+          refreshToken: token,
+          profile: state.profile,
+          idToken: idToken ?? undefined
+        }, epoch);
+      } catch {
+        // The session stays usable in memory. The stored artifact keeps the
+        // previous token until the next successful write; a restart before
+        // then restores through it if the provider still accepts it, and
+        // otherwise lands on sign-in — never on a corrupted state.
+      }
+    }
+  });
+
+  /**
+   * The current snapshot, the same object until the state changes, so React reads
+   * it through `useSyncExternalStore` without re-rendering for nothing (PERF-02).
+   * Frozen: a consumer cannot change the machine's state by mutating it.
+   */
+  function getState() {
+    return state;
+  }
+  function setState(patch) {
+    const next = {
+      ...state,
+      ...patch
+    };
+    // No change, no new snapshot and no notification.
+    if (shallowEqual(state, next)) return;
+    state = Object.freeze(next);
+    if (patch.error) {
+      // The code and audience only; `detail` is already redacted but stays local.
+      channel.emit(patch.error.code, patch.error.audience === 'user' ? 'info' : 'warn', {
+        status: state.status,
+        retryable: patch.error.retryable
+      });
+    }
+    // Isolated: a subscriber that throws neither stops the others nor turns a
+    // completed sign-in into an error; rn-core reports it instead (CORE-03).
+    listeners.notify(getState());
+  }
+
+  /** Ends the local session: memory, cached access tokens, and the stored artifact. */
+  async function clearPersisted() {
+    sessionEpoch += 1;
+    refreshToken = null;
+    idToken = null;
+    storedSession = null;
+    tokenManager.clear();
+    await enqueueStoreOp(() => secureStore.removeItem(AUTH_STORAGE_KEY));
+  }
+  return {
+    getState,
+    subscribe: listener => listeners.add(listener),
+    async restore() {
+      sessionEpoch += 1;
+      const epoch = sessionEpoch;
+      setState({
+        status: 'loading',
+        restore: 'pending',
+        error: undefined
+      });
+      let result;
+      try {
+        result = await restoreSession({
+          secureStore,
+          authority: config.authority,
+          clientId: config.clientId,
+          redirectUrl: config.redirectUrl,
+          scopes: config.scopes,
+          authClient,
+          mapping: config.accessTierMapping
+        });
+      } catch (error) {
+        // The store could not be read. Nothing is known, nothing is deleted.
+        if (epoch === sessionEpoch) {
+          setState({
+            ...SIGNED_OUT,
+            status: 'error',
+            error: toAuthError(error)
+          });
+        }
+        return getState();
+      }
+      if (epoch !== sessionEpoch) {
+        // A sign-in or sign-out ran meanwhile; its outcome stands.
+        return getState();
+      }
+      storedSession = result.persisted ?? null;
+      if (result.outcome === 'restored' && result.profile && result.refreshToken) {
+        refreshToken = result.refreshToken;
+        idToken = result.idToken ?? null;
+        try {
+          await writeSession({
+            refreshToken: result.refreshToken,
+            profile: result.profile,
+            idToken: result.idToken
+          }, epoch);
+        } catch {
+          // The refresh succeeded, so the user is signed in for this run. Only
+          // the next launch is affected, and it falls back to sign-in.
+        }
+        if (epoch !== sessionEpoch) {
+          return getState();
+        }
+        setState({
+          status: 'authenticated',
+          profile: result.profile,
+          accessTier: result.accessTier,
+          restore: 'restored',
+          error: undefined
+        });
+      } else if (result.outcome === 'offline' && result.profile) {
+        refreshToken = result.refreshToken ?? null;
+        idToken = result.idToken ?? null;
+        setState({
+          status: 'authenticated',
+          profile: result.profile,
+          accessTier: result.accessTier ?? failClosedTier(),
+          restore: 'offline',
+          error: undefined
+        });
+      } else {
+        await clearPersisted();
+        setState(SIGNED_OUT);
+      }
+      return getState();
+    },
+    async signIn(providerId) {
+      sessionEpoch += 1;
+      const epoch = sessionEpoch;
+      setState({
+        status: 'authenticating',
+        error: undefined
+      });
+      let provider;
+      try {
+        provider = resolveProvider(config, providerId, platform);
+      } catch (error) {
+        setState({
+          status: 'error',
+          error: toAuthError(error, 'configuration-error', 'auth.error.configuration')
+        });
+        return getState();
+      }
+      try {
+        const tokens = await authClient.authorize({
+          authority: config.authority,
+          clientId: config.clientId,
+          redirectUrl: config.redirectUrl,
+          scopes: config.scopes,
+          additionalParameters: buildAdditionalParameters(provider)
+        });
+        if (epoch !== sessionEpoch) {
+          return getState();
+        }
+        if (!tokens.refreshToken) {
+          // `offline_access` is required by configuration, so its absence is the
+          // tenant's doing. Signing in anyway would give a session that silently
+          // never survives a restart.
+          setState({
+            status: 'error',
+            error: new AuthError({
+              code: 'configuration-error',
+              messageKey: 'auth.error.configuration',
+              audience: 'developer',
+              detail: 'authorize returned no refresh token; check that the app registration grants offline_access'
+            })
+          });
+          return getState();
+        }
+        const profile = mapClaimsToProfile(tokens.claims, providerId);
+        const accessTier = evaluateAccessTier(tokens.claims, config.accessTierMapping);
+        // Written first, committed to memory second: a failed write leaves no
+        // half-signed-in session holding a refresh token that was never stored.
+        await writeSession({
+          refreshToken: tokens.refreshToken,
+          profile,
+          idToken: tokens.idToken
+        }, epoch);
+        if (epoch !== sessionEpoch) {
+          return getState();
+        }
+        // Single active account: a new sign-in replaces any prior session.
+        refreshToken = tokens.refreshToken;
+        idToken = tokens.idToken ?? null;
+        tokenManager.clear();
+        setState({
+          status: 'authenticated',
+          profile,
+          accessTier,
+          restore: 'restored',
+          error: undefined
+        });
+      } catch (error) {
+        if (epoch !== sessionEpoch) {
+          return getState();
+        }
+        const authError = toAuthError(error);
+        if (authError.code === 'provider-cancelled') {
+          setState({
+            status: 'cancelled',
+            error: authError
+          });
+        } else {
+          setState({
+            status: 'error',
+            error: authError
+          });
+        }
+      }
+      return getState();
+    },
+    async signOut() {
+      await clearPersisted();
+      setState(SIGNED_OUT);
+    },
+    async signOutGlobal() {
+      let result = {
+        global: 'ended'
+      };
+      try {
+        await authClient.endSession({
+          authority: config.authority,
+          clientId: config.clientId,
+          redirectUrl: config.redirectUrl,
+          idToken: idToken ?? undefined
+        });
+      } catch (error) {
+        // Reported, not swallowed: the tenant session may still be alive. It
+        // still must not block clearing local state.
+        result = {
+          global: 'failed',
+          error: toAuthError(error)
+        };
+      }
+      await clearPersisted();
+      setState(SIGNED_OUT);
+      return result;
+    },
+    async requestAccessToken(resourceKey, tokenOptions) {
+      const epoch = sessionEpoch;
+      // Only a real network refresh is a `token-refreshing` phase; a cache hit
+      // would otherwise flash every subscriber twice for nothing.
+      const refreshing = state.status === 'authenticated' && (tokenOptions?.forceRefresh === true || !tokenManager.hasFreshToken(resourceKey));
+      if (refreshing) {
+        setState({
+          status: 'token-refreshing'
+        });
+      }
+      const result = await tokenManager.request(resourceKey, tokenOptions);
+      // Restored only if nothing else moved the session meanwhile: a sign-out
+      // during the refresh used to be overwritten back to `authenticated`.
+      if (refreshing && epoch === sessionEpoch && state.status === 'token-refreshing') {
+        setState({
+          status: 'authenticated'
+        });
+      }
+      return result;
+    },
+    getAccessTier() {
+      return state.accessTier ?? failClosedTier();
+    },
+    canAccessPremium() {
+      const tier = state.accessTier ?? failClosedTier();
+      return {
+        allowed: tier.tier === 'premium' && tier.verification === 'verified',
+        tier
+      };
+    },
+    requirePremium() {
+      const tier = state.accessTier ?? failClosedTier();
+      const allowed = tier.tier === 'premium' && tier.verification === 'verified';
+      if (!allowed) {
+        setState({
+          status: 'access-denied'
+        });
+      }
+      return {
+        allowed,
+        tier
+      };
+    },
+    getMessages() {
+      return messages;
+    },
+    getPlatformProvider() {
+      return defaultProviderForPlatform(config, platform);
+    },
+    getPlatformProviders() {
+      return availableProvidersForPlatform(config, platform);
+    }
+  };
+}
+/** Every error the machine lands in also goes to the app's SDK sinks (CORE-08). */
+const channel = createDiagnosticChannel('rn-auth');
+//# sourceMappingURL=authMachine.js.map

package/lib/module/core/authMachine.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createDiagnosticChannel","createListenerSet","currentPlatform","shallowEqual","resolveMessages","validateConfig","createAppAuthClient","availableProvidersForPlatform","buildAdditionalParameters","defaultProviderForPlatform","resolveProvider","mapClaimsToProfile","evaluateAccessTier","failClosedTier","restoreSession","sameSession","storedProfileFrom","AUTH_STORAGE_KEY","createAccessTokenManager","AuthError","toAuthError","SIGNED_OUT","status","profile","undefined","accessTier","restore","error","createAuthMachine","config","options","detected","platform","secureStore","authClient","resources","messages","state","Object","freeze","refreshToken","idToken","sessionEpoch","listeners","storeQueue","Promise","resolve","enqueueStoreOp","op","next","then","catch","storedSession","writeSession","session","epoch","artifact","setItem","JSON","stringify","tokenManager","authority","clientId","redirectUrl","getRefreshToken","onRefreshTokenRotated","token","getState","setState","patch","channel","emit","code","audience","retryable","notify","clearPersisted","clear","removeItem","subscribe","listener","add","result","scopes","mapping","accessTierMapping","persisted","outcome","signIn","providerId","provider","tokens","authorize","additionalParameters","messageKey","detail","claims","authError","signOut","signOutGlobal","global","endSession","requestAccessToken","resourceKey","tokenOptions","refreshing","forceRefresh","hasFreshToken","request","getAccessTier","canAccessPremium","tier","allowed","verification","requirePremium","getMessages","getPlatformProvider","getPlatformProviders"],"sourceRoot":"../../../src","sources":["core/authMachine.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SACCA,uBAAuB,EACvBC,iBAAiB,EACjBC,eAAe,EACfC,YAAY,QACN,wBAAwB;AAG/B,SAASC,eAAe,QAAQ,+BAA4B;AAY5D,SAASC,cAAc,QAAQ,6BAA0B;AACzD,SAASC,mBAAmB,QAAQ,uBAAoB;AACxD,SACCC,6BAA6B,EAC7BC,yBAAyB,EACzBC,0BAA0B,EAC1BC,eAAe,QACT,0BAAuB;AAC9B,SAASC,kBAAkB,QAAQ,cAAW;AAC9C,SAASC,kBAAkB,EAAEC,cAAc,QAAQ,yBAAsB;AACzE,SAASC,cAAc,EAAEC,WAAW,EAAEC,iBAAiB,QAA+B,cAAW;AACjG,SAASC,gBAAgB,QAAQ,0BAAuB;AACxD,SAASC,wBAAwB,QAAQ,0BAAuB;AAChE,SAASC,SAAS,EAAEC,WAAW,QAA4B,0BAAuB;AAElF,MAAMC,UAA8B,GAAG;EACtCC,MAAM,EAAE,YAAY;EACpBC,OAAO,EAAEC,SAAS;EAClBC,UAAU,EAAED,SAAS;EACrBE,OAAO,EAAE,aAAa;EACtBC,KAAK,EAAEH;AACR,CAAC;AAED,OAAO,SAASI,iBAAiBA,CAACC,MAAkB,EAAEC,OAA0B,GAAG,CAAC,CAAC,EAAQ;EAC5F;EACAzB,cAAc,CAACwB,MAAM,CAAC;;EAEtB;EACA;EACA,MAAME,QAAQ,GAAG7B,eAAe,CAAC,CAAC;EAClC,MAAM8B,QAAwB,GAC7BF,OAAO,CAACE,QAAQ,KAAKD,QAAQ,KAAK,aAAa,GAAG,KAAK,GAAGA,QAAQ,CAAC;EACpE,MAAME,WAAW,GAAGJ,MAAM,CAACI,WAAW;EACtC,MAAMC,UAAU,GAAGL,MAAM,CAACK,UAAU,IAAI5B,mBAAmB,CAAC,CAAC;EAC7D,MAAM6B,SAAS,GAAGN,MAAM,CAACM,SAAS,IAAI,EAAE;EACxC;EACA,MAAMC,QAAQ,GAAGhC,eAAe,CAACyB,MAAM,CAACO,QAAQ,CAAC;EAEjD,IAAIC,KAAgB,GAAGC,MAAM,CAACC,MAAM,CAAC;IAAEjB,MAAM,EAAE,SAAS;IAAEI,OAAO,EAAE;EAAU,CAAC,CAAC;EAC/E,IAAIc,YAA2B,GAAG,IAAI;EACtC;EACA,IAAIC,OAAsB,GAAG,IAAI;EACjC,IAAIC,YAAY,GAAG,CAAC;EACpB,MAAMC,SAAS,GAAG1C,iBAAiB,CAAc,CAAC;EAClD;AACD;AACA;AACA;AACA;EACC,IAAI2C,UAAyB,GAAGC,OAAO,CAACC,OAAO,CAAC,CAAC;EAEjD,MAAMC,cAAc,GAAIC,EAAuB,IAAoB;IAClE,MAAMC,IAAI,GAAGL,UAAU,CAACM,IAAI,CAACF,EAAE,CAAC;IAChC;IACA;IACAJ,UAAU,GAAGK,IAAI,CAACE,KAAK,CAAC,MAAM3B,SAAS,CAAC;IACxC,OAAOyB,IAAI;EACZ,CAAC;;EAED;EACA,IAAIG,aAAsC,GAAG,IAAI;EAEjD,MAAMC,YAAY,GAAGA,CACpBC,OAAiF,EACjFC,KAAa,KAEbR,cAAc,CAAC,YAAY;IAC1B,IAAIQ,KAAK,KAAKb,YAAY,EAAE;MAC3B,OAAO,CAAC;IACT;IACA,MAAMc,QAA0B,GAAG;MAClChB,YAAY,EAAEc,OAAO,CAACd,YAAY;MAClCjB,OAAO,EAAEP,iBAAiB,CAACsC,OAAO,CAAC/B,OAAO,CAAC;MAC3CkB,OAAO,EAAEa,OAAO,CAACb;IAClB,CAAC;IACD;IACA;IACA,IAAIW,aAAa,IAAIrC,WAAW,CAACqC,aAAa,EAAEI,QAAQ,CAAC,EAAE;MAC1D;IACD;IACA,MAAMvB,WAAW,CAACwB,OAAO,CAACxC,gBAAgB,EAAEyC,IAAI,CAACC,SAAS,CAACH,QAAQ,CAAC,CAAC;IACrEJ,aAAa,GAAGI,QAAQ;EACzB,CAAC,CAAC;EAEH,MAAMI,YAAY,GAAG1C,wBAAwB,CAAC;IAC7C2C,SAAS,EAAEhC,MAAM,CAACgC,SAAS;IAC3BC,QAAQ,EAAEjC,MAAM,CAACiC,QAAQ;IACzBC,WAAW,EAAElC,MAAM,CAACkC,WAAW;IAC/B5B,SAAS;IACTD,UAAU;IACV8B,eAAe,EAAEA,CAAA,KAAMxB,YAAY;IACnCE,YAAY,EAAEA,CAAA,KAAMA,YAAY;IAChC,MAAMuB,qBAAqBA,CAACC,KAAK,EAAEX,KAAK,EAAE;MACzC,IAAIA,KAAK,KAAKb,YAAY,EAAE;QAC3B;MACD;MACA;MACA;MACAF,YAAY,GAAG0B,KAAK;MACpB,IAAI,CAAC7B,KAAK,CAACd,OAAO,EAAE;QACnB;MACD;MACA,IAAI;QACH,MAAM8B,YAAY,CACjB;UAAEb,YAAY,EAAE0B,KAAK;UAAE3C,OAAO,EAAEc,KAAK,CAACd,OAAO;UAAEkB,OAAO,EAAEA,OAAO,IAAIjB;QAAU,CAAC,EAC9E+B,KACD,CAAC;MACF,CAAC,CAAC,MAAM;QACP;QACA;QACA;QACA;MAAA;IAEF;EACD,CAAC,CAAC;;EAEF;AACD;AACA;AACA;AACA;EACC,SAASY,QAAQA,CAAA,EAAc;IAC9B,OAAO9B,KAAK;EACb;EAEA,SAAS+B,QAAQA,CAACC,KAAyB,EAAQ;IAClD,MAAMpB,IAAI,GAAG;MAAE,GAAGZ,KAAK;MAAE,GAAGgC;IAAM,CAAC;IACnC;IACA,IAAIlE,YAAY,CAACkC,KAAK,EAAEY,IAAI,CAAC,EAAE;IAC/BZ,KAAK,GAAGC,MAAM,CAACC,MAAM,CAACU,IAAI,CAAC;IAC3B,IAAIoB,KAAK,CAAC1C,KAAK,EAAE;MAChB;MACA2C,OAAO,CAACC,IAAI,CAACF,KAAK,CAAC1C,KAAK,CAAC6C,IAAI,EAAEH,KAAK,CAAC1C,KAAK,CAAC8C,QAAQ,KAAK,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE;QACjFnD,MAAM,EAAEe,KAAK,CAACf,MAAM;QACpBoD,SAAS,EAAEL,KAAK,CAAC1C,KAAK,CAAC+C;MACxB,CAAC,CAAC;IACH;IACA;IACA;IACA/B,SAAS,CAACgC,MAAM,CAACR,QAAQ,CAAC,CAAC,CAAC;EAC7B;;EAEA;EACA,eAAeS,cAAcA,CAAA,EAAkB;IAC9ClC,YAAY,IAAI,CAAC;IACjBF,YAAY,GAAG,IAAI;IACnBC,OAAO,GAAG,IAAI;IACdW,aAAa,GAAG,IAAI;IACpBQ,YAAY,CAACiB,KAAK,CAAC,CAAC;IACpB,MAAM9B,cAAc,CAAC,MAAMd,WAAW,CAAC6C,UAAU,CAAC7D,gBAAgB,CAAC,CAAC;EACrE;EAEA,OAAO;IACNkD,QAAQ;IAERY,SAAS,EAAEC,QAAQ,IAAIrC,SAAS,CAACsC,GAAG,CAACD,QAAQ,CAAC;IAE9C,MAAMtD,OAAOA,CAAA,EAAG;MACfgB,YAAY,IAAI,CAAC;MACjB,MAAMa,KAAK,GAAGb,YAAY;MAC1B0B,QAAQ,CAAC;QAAE9C,MAAM,EAAE,SAAS;QAAEI,OAAO,EAAE,SAAS;QAAEC,KAAK,EAAEH;MAAU,CAAC,CAAC;MAErE,IAAI0D,MAAM;MACV,IAAI;QACHA,MAAM,GAAG,MAAMpE,cAAc,CAAC;UAC7BmB,WAAW;UACX4B,SAAS,EAAEhC,MAAM,CAACgC,SAAS;UAC3BC,QAAQ,EAAEjC,MAAM,CAACiC,QAAQ;UACzBC,WAAW,EAAElC,MAAM,CAACkC,WAAW;UAC/BoB,MAAM,EAAEtD,MAAM,CAACsD,MAAM;UACrBjD,UAAU;UACVkD,OAAO,EAAEvD,MAAM,CAACwD;QACjB,CAAC,CAAC;MACH,CAAC,CAAC,OAAO1D,KAAK,EAAE;QACf;QACA,IAAI4B,KAAK,KAAKb,YAAY,EAAE;UAC3B0B,QAAQ,CAAC;YAAE,GAAG/C,UAAU;YAAEC,MAAM,EAAE,OAAO;YAAEK,KAAK,EAAEP,WAAW,CAACO,KAAK;UAAE,CAAC,CAAC;QACxE;QACA,OAAOwC,QAAQ,CAAC,CAAC;MAClB;MAEA,IAAIZ,KAAK,KAAKb,YAAY,EAAE;QAC3B;QACA,OAAOyB,QAAQ,CAAC,CAAC;MAClB;MAEAf,aAAa,GAAG8B,MAAM,CAACI,SAAS,IAAI,IAAI;MAExC,IAAIJ,MAAM,CAACK,OAAO,KAAK,UAAU,IAAIL,MAAM,CAAC3D,OAAO,IAAI2D,MAAM,CAAC1C,YAAY,EAAE;QAC3EA,YAAY,GAAG0C,MAAM,CAAC1C,YAAY;QAClCC,OAAO,GAAGyC,MAAM,CAACzC,OAAO,IAAI,IAAI;QAChC,IAAI;UACH,MAAMY,YAAY,CACjB;YAAEb,YAAY,EAAE0C,MAAM,CAAC1C,YAAY;YAAEjB,OAAO,EAAE2D,MAAM,CAAC3D,OAAO;YAAEkB,OAAO,EAAEyC,MAAM,CAACzC;UAAQ,CAAC,EACvFc,KACD,CAAC;QACF,CAAC,CAAC,MAAM;UACP;UACA;QAAA;QAED,IAAIA,KAAK,KAAKb,YAAY,EAAE;UAC3B,OAAOyB,QAAQ,CAAC,CAAC;QAClB;QACAC,QAAQ,CAAC;UACR9C,MAAM,EAAE,eAAe;UACvBC,OAAO,EAAE2D,MAAM,CAAC3D,OAAO;UACvBE,UAAU,EAAEyD,MAAM,CAACzD,UAAU;UAC7BC,OAAO,EAAE,UAAU;UACnBC,KAAK,EAAEH;QACR,CAAC,CAAC;MACH,CAAC,MAAM,IAAI0D,MAAM,CAACK,OAAO,KAAK,SAAS,IAAIL,MAAM,CAAC3D,OAAO,EAAE;QAC1DiB,YAAY,GAAG0C,MAAM,CAAC1C,YAAY,IAAI,IAAI;QAC1CC,OAAO,GAAGyC,MAAM,CAACzC,OAAO,IAAI,IAAI;QAChC2B,QAAQ,CAAC;UACR9C,MAAM,EAAE,eAAe;UACvBC,OAAO,EAAE2D,MAAM,CAAC3D,OAAO;UACvBE,UAAU,EAAEyD,MAAM,CAACzD,UAAU,IAAIZ,cAAc,CAAC,CAAC;UACjDa,OAAO,EAAE,SAAS;UAClBC,KAAK,EAAEH;QACR,CAAC,CAAC;MACH,CAAC,MAAM;QACN,MAAMoD,cAAc,CAAC,CAAC;QACtBR,QAAQ,CAAC/C,UAAU,CAAC;MACrB;MACA,OAAO8C,QAAQ,CAAC,CAAC;IAClB,CAAC;IAED,MAAMqB,MAAMA,CAACC,UAAsB,EAAE;MACpC/C,YAAY,IAAI,CAAC;MACjB,MAAMa,KAAK,GAAGb,YAAY;MAC1B0B,QAAQ,CAAC;QAAE9C,MAAM,EAAE,gBAAgB;QAAEK,KAAK,EAAEH;MAAU,CAAC,CAAC;MACxD,IAAIkE,QAAQ;MACZ,IAAI;QACHA,QAAQ,GAAGhF,eAAe,CAACmB,MAAM,EAAE4D,UAAU,EAAEzD,QAAQ,CAAC;MACzD,CAAC,CAAC,OAAOL,KAAK,EAAE;QACfyC,QAAQ,CAAC;UACR9C,MAAM,EAAE,OAAO;UACfK,KAAK,EAAEP,WAAW,CAACO,KAAK,EAAE,qBAAqB,EAAE,0BAA0B;QAC5E,CAAC,CAAC;QACF,OAAOwC,QAAQ,CAAC,CAAC;MAClB;MAEA,IAAI;QACH,MAAMwB,MAAM,GAAG,MAAMzD,UAAU,CAAC0D,SAAS,CAAC;UACzC/B,SAAS,EAAEhC,MAAM,CAACgC,SAAS;UAC3BC,QAAQ,EAAEjC,MAAM,CAACiC,QAAQ;UACzBC,WAAW,EAAElC,MAAM,CAACkC,WAAW;UAC/BoB,MAAM,EAAEtD,MAAM,CAACsD,MAAM;UACrBU,oBAAoB,EAAErF,yBAAyB,CAACkF,QAAQ;QACzD,CAAC,CAAC;QACF,IAAInC,KAAK,KAAKb,YAAY,EAAE;UAC3B,OAAOyB,QAAQ,CAAC,CAAC;QAClB;QACA,IAAI,CAACwB,MAAM,CAACnD,YAAY,EAAE;UACzB;UACA;UACA;UACA4B,QAAQ,CAAC;YACR9C,MAAM,EAAE,OAAO;YACfK,KAAK,EAAE,IAAIR,SAAS,CAAC;cACpBqD,IAAI,EAAE,qBAAqB;cAC3BsB,UAAU,EAAE,0BAA0B;cACtCrB,QAAQ,EAAE,WAAW;cACrBsB,MAAM,EACL;YACF,CAAC;UACF,CAAC,CAAC;UACF,OAAO5B,QAAQ,CAAC,CAAC;QAClB;QACA,MAAM5C,OAAO,GAAGZ,kBAAkB,CAACgF,MAAM,CAACK,MAAM,EAAEP,UAAU,CAAC;QAC7D,MAAMhE,UAAU,GAAGb,kBAAkB,CAAC+E,MAAM,CAACK,MAAM,EAAEnE,MAAM,CAACwD,iBAAiB,CAAC;QAC9E;QACA;QACA,MAAMhC,YAAY,CACjB;UAAEb,YAAY,EAAEmD,MAAM,CAACnD,YAAY;UAAEjB,OAAO;UAAEkB,OAAO,EAAEkD,MAAM,CAAClD;QAAQ,CAAC,EACvEc,KACD,CAAC;QACD,IAAIA,KAAK,KAAKb,YAAY,EAAE;UAC3B,OAAOyB,QAAQ,CAAC,CAAC;QAClB;QACA;QACA3B,YAAY,GAAGmD,MAAM,CAACnD,YAAY;QAClCC,OAAO,GAAGkD,MAAM,CAAClD,OAAO,IAAI,IAAI;QAChCmB,YAAY,CAACiB,KAAK,CAAC,CAAC;QACpBT,QAAQ,CAAC;UACR9C,MAAM,EAAE,eAAe;UACvBC,OAAO;UACPE,UAAU;UACVC,OAAO,EAAE,UAAU;UACnBC,KAAK,EAAEH;QACR,CAAC,CAAC;MACH,CAAC,CAAC,OAAOG,KAAK,EAAE;QACf,IAAI4B,KAAK,KAAKb,YAAY,EAAE;UAC3B,OAAOyB,QAAQ,CAAC,CAAC;QAClB;QACA,MAAM8B,SAAS,GAAG7E,WAAW,CAACO,KAAK,CAAC;QACpC,IAAIsE,SAAS,CAACzB,IAAI,KAAK,oBAAoB,EAAE;UAC5CJ,QAAQ,CAAC;YAAE9C,MAAM,EAAE,WAAW;YAAEK,KAAK,EAAEsE;UAAU,CAAC,CAAC;QACpD,CAAC,MAAM;UACN7B,QAAQ,CAAC;YAAE9C,MAAM,EAAE,OAAO;YAAEK,KAAK,EAAEsE;UAAU,CAAC,CAAC;QAChD;MACD;MACA,OAAO9B,QAAQ,CAAC,CAAC;IAClB,CAAC;IAED,MAAM+B,OAAOA,CAAA,EAAG;MACf,MAAMtB,cAAc,CAAC,CAAC;MACtBR,QAAQ,CAAC/C,UAAU,CAAC;IACrB,CAAC;IAED,MAAM8E,aAAaA,CAAA,EAAiC;MACnD,IAAIjB,MAA2B,GAAG;QAAEkB,MAAM,EAAE;MAAQ,CAAC;MACrD,IAAI;QACH,MAAMlE,UAAU,CAACmE,UAAU,CAAC;UAC3BxC,SAAS,EAAEhC,MAAM,CAACgC,SAAS;UAC3BC,QAAQ,EAAEjC,MAAM,CAACiC,QAAQ;UACzBC,WAAW,EAAElC,MAAM,CAACkC,WAAW;UAC/BtB,OAAO,EAAEA,OAAO,IAAIjB;QACrB,CAAC,CAAC;MACH,CAAC,CAAC,OAAOG,KAAK,EAAE;QACf;QACA;QACAuD,MAAM,GAAG;UAAEkB,MAAM,EAAE,QAAQ;UAAEzE,KAAK,EAAEP,WAAW,CAACO,KAAK;QAAE,CAAC;MACzD;MACA,MAAMiD,cAAc,CAAC,CAAC;MACtBR,QAAQ,CAAC/C,UAAU,CAAC;MACpB,OAAO6D,MAAM;IACd,CAAC;IAED,MAAMoB,kBAAkBA,CAACC,WAAW,EAAEC,YAAY,EAAE;MACnD,MAAMjD,KAAK,GAAGb,YAAY;MAC1B;MACA;MACA,MAAM+D,UAAU,GACfpE,KAAK,CAACf,MAAM,KAAK,eAAe,KAC/BkF,YAAY,EAAEE,YAAY,KAAK,IAAI,IAAI,CAAC9C,YAAY,CAAC+C,aAAa,CAACJ,WAAW,CAAC,CAAC;MAClF,IAAIE,UAAU,EAAE;QACfrC,QAAQ,CAAC;UAAE9C,MAAM,EAAE;QAAmB,CAAC,CAAC;MACzC;MACA,MAAM4D,MAAM,GAAG,MAAMtB,YAAY,CAACgD,OAAO,CAACL,WAAW,EAAEC,YAAY,CAAC;MACpE;MACA;MACA,IAAIC,UAAU,IAAIlD,KAAK,KAAKb,YAAY,IAAIL,KAAK,CAACf,MAAM,KAAK,kBAAkB,EAAE;QAChF8C,QAAQ,CAAC;UAAE9C,MAAM,EAAE;QAAgB,CAAC,CAAC;MACtC;MACA,OAAO4D,MAAM;IACd,CAAC;IAED2B,aAAaA,CAAA,EAAG;MACf,OAAOxE,KAAK,CAACZ,UAAU,IAAIZ,cAAc,CAAC,CAAC;IAC5C,CAAC;IAEDiG,gBAAgBA,CAAA,EAAsB;MACrC,MAAMC,IAAI,GAAG1E,KAAK,CAACZ,UAAU,IAAIZ,cAAc,CAAC,CAAC;MACjD,OAAO;QAAEmG,OAAO,EAAED,IAAI,CAACA,IAAI,KAAK,SAAS,IAAIA,IAAI,CAACE,YAAY,KAAK,UAAU;QAAEF;MAAK,CAAC;IACtF,CAAC;IAEDG,cAAcA,CAAA,EAAsB;MACnC,MAAMH,IAAI,GAAG1E,KAAK,CAACZ,UAAU,IAAIZ,cAAc,CAAC,CAAC;MACjD,MAAMmG,OAAO,GAAGD,IAAI,CAACA,IAAI,KAAK,SAAS,IAAIA,IAAI,CAACE,YAAY,KAAK,UAAU;MAC3E,IAAI,CAACD,OAAO,EAAE;QACb5C,QAAQ,CAAC;UAAE9C,MAAM,EAAE;QAAgB,CAAC,CAAC;MACtC;MACA,OAAO;QAAE0F,OAAO;QAAED;MAAK,CAAC;IACzB,CAAC;IAEDI,WAAWA,CAAA,EAAmB;MAC7B,OAAO/E,QAAQ;IAChB,CAAC;IAEDgF,mBAAmBA,CAAA,EAAG;MACrB,OAAO3G,0BAA0B,CAACoB,MAAM,EAAEG,QAAQ,CAAC;IACpD,CAAC;IAEDqF,oBAAoBA,CAAA,EAAG;MACtB,OAAO9G,6BAA6B,CAACsB,MAAM,EAAEG,QAAQ,CAAC;IACvD;EACD,CAAC;AACF;AAGA;AACA,MAAMsC,OAAO,GAAGtE,uBAAuB,CAAgB,SAAS,CAAC","ignoreList":[]}

package/lib/module/core/profile.js

@@ -0,0 +1,54 @@
+"use strict";
+
+/**
+ * Claims → Profile mapping (FR-006). Tolerant of Apple private-relay emails and
+ * missing display name / given name (edge cases).
+ */
+
+function asString(value) {
+  return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function looksLikeEmail(value) {
+  return !!value && /.+@.+\..+/.test(value);
+}
+
+/** Map id-token claims to the app-visible Profile. */
+export function mapClaimsToProfile(claims, providerId) {
+  const tenantUserId = asString(claims.oid) ?? asString(claims.sub) ?? asString(claims.unique_name) ?? 'unknown';
+  const givenName = asString(claims.given_name);
+  const familyName = asString(claims.family_name);
+  const composedName = [givenName, familyName].filter(Boolean).join(' ') || undefined;
+  const displayName = asString(claims.name) ?? composedName;
+  const preferred = asString(claims.preferred_username);
+  const email = asString(claims.email) ?? (looksLikeEmail(preferred) ? preferred : undefined);
+  const provider = providerId ?? asString(claims.idp) ?? asString(claims.identityProvider) ?? 'unknown';
+  return {
+    tenantUserId,
+    displayName,
+    email,
+    provider,
+    claims
+  };
+}
+
+/**
+ * Describe the external provider identity behind the profile (FR-004 edge
+ * cases). `emailBehavior` is what a screen needs to explain an address the user
+ * did not choose: Apple's private relay forwards mail and is not the address
+ * they type anywhere else.
+ */
+export function describeProviderIdentity(claims, providerId) {
+  const provider = providerId ?? asString(claims.idp) ?? 'unknown';
+  const subject = asString(claims.sub) ?? asString(claims.oid) ?? 'unknown';
+  const email = asString(claims.email);
+  let emailBehavior = 'none';
+  if (email) {
+    emailBehavior = email.endsWith('@privaterelay.appleid.com') ? 'private-relay' : 'direct';
+  }
+  return {
+    provider,
+    subject,
+    emailBehavior
+  };
+}
+//# sourceMappingURL=profile.js.map

package/lib/module/core/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["asString","value","length","undefined","looksLikeEmail","test","mapClaimsToProfile","claims","providerId","tenantUserId","oid","sub","unique_name","givenName","given_name","familyName","family_name","composedName","filter","Boolean","join","displayName","name","preferred","preferred_username","email","provider","idp","identityProvider","describeProviderIdentity","subject","emailBehavior","endsWith"],"sourceRoot":"../../../src","sources":["core/profile.ts"],"mappings":";;AAAA;AACA;AACA;AACA;;AAIA,SAASA,QAAQA,CAACC,KAAc,EAAsB;EACrD,OAAO,OAAOA,KAAK,KAAK,QAAQ,IAAIA,KAAK,CAACC,MAAM,GAAG,CAAC,GAAGD,KAAK,GAAGE,SAAS;AACzE;AAEA,SAASC,cAAcA,CAACH,KAAyB,EAAW;EAC3D,OAAO,CAAC,CAACA,KAAK,IAAI,WAAW,CAACI,IAAI,CAACJ,KAAK,CAAC;AAC1C;;AAEA;AACA,OAAO,SAASK,kBAAkBA,CACjCC,MAA+B,EAC/BC,UAAuB,EACb;EACV,MAAMC,YAAY,GACjBT,QAAQ,CAACO,MAAM,CAACG,GAAG,CAAC,IAAIV,QAAQ,CAACO,MAAM,CAACI,GAAG,CAAC,IAAIX,QAAQ,CAACO,MAAM,CAACK,WAAW,CAAC,IAAI,SAAS;EAE1F,MAAMC,SAAS,GAAGb,QAAQ,CAACO,MAAM,CAACO,UAAU,CAAC;EAC7C,MAAMC,UAAU,GAAGf,QAAQ,CAACO,MAAM,CAACS,WAAW,CAAC;EAC/C,MAAMC,YAAY,GAAG,CAACJ,SAAS,EAAEE,UAAU,CAAC,CAACG,MAAM,CAACC,OAAO,CAAC,CAACC,IAAI,CAAC,GAAG,CAAC,IAAIjB,SAAS;EACnF,MAAMkB,WAAW,GAAGrB,QAAQ,CAACO,MAAM,CAACe,IAAI,CAAC,IAAIL,YAAY;EAEzD,MAAMM,SAAS,GAAGvB,QAAQ,CAACO,MAAM,CAACiB,kBAAkB,CAAC;EACrD,MAAMC,KAAK,GAAGzB,QAAQ,CAACO,MAAM,CAACkB,KAAK,CAAC,KAAKrB,cAAc,CAACmB,SAAS,CAAC,GAAGA,SAAS,GAAGpB,SAAS,CAAC;EAE3F,MAAMuB,QAAQ,GACblB,UAAU,IAAIR,QAAQ,CAACO,MAAM,CAACoB,GAAG,CAAC,IAAI3B,QAAQ,CAACO,MAAM,CAACqB,gBAAgB,CAAC,IAAI,SAAS;EAErF,OAAO;IACNnB,YAAY;IACZY,WAAW;IACXI,KAAK;IACLC,QAAQ;IACRnB;EACD,CAAC;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASsB,wBAAwBA,CACvCtB,MAA+B,EAC/BC,UAAuB,EACJ;EACnB,MAAMkB,QAAQ,GAAGlB,UAAU,IAAIR,QAAQ,CAACO,MAAM,CAACoB,GAAG,CAAC,IAAI,SAAS;EAChE,MAAMG,OAAO,GAAG9B,QAAQ,CAACO,MAAM,CAACI,GAAG,CAAC,IAAIX,QAAQ,CAACO,MAAM,CAACG,GAAG,CAAC,IAAI,SAAS;EACzE,MAAMe,KAAK,GAAGzB,QAAQ,CAACO,MAAM,CAACkB,KAAK,CAAC;EACpC,IAAIM,aAAgD,GAAG,MAAM;EAC7D,IAAIN,KAAK,EAAE;IACVM,aAAa,GAAGN,KAAK,CAACO,QAAQ,CAAC,2BAA2B,CAAC,GAAG,eAAe,GAAG,QAAQ;EACzF;EACA,OAAO;IAAEN,QAAQ;IAAEI,OAAO;IAAEC;EAAc,CAAC;AAC5C","ignoreList":[]}

package/lib/module/core/session.js

@@ -0,0 +1,118 @@
+"use strict";
+
+/**
+ * Session restoration (FR-008, R5). Reads the persisted artifact, attempts a
+ * silent refresh, and classifies the outcome:
+ *  - restored: fresh tokens + claims → authenticated
+ *  - offline:  the refresh could not complete for any reason other than the
+ *              session being invalid — no network, a timeout, a 5xx, an error we
+ *              cannot classify → cached profile read-only, tier unverified (fail
+ *              closed) — clarify Q3
+ *  - unavailable: no artifact, or the provider said the refresh token is no
+ *              longer valid → signed-out reauth
+ *
+ * Only `unavailable` deletes the stored session, so it is reserved for a verdict
+ * the provider actually gave. Treating every unclassified error as expiry signed
+ * users out whenever the token endpoint had a bad moment.
+ */
+
+import { AUTH_STORAGE_KEY } from "../tokens/secureStore.js";
+import { mapClaimsToProfile } from "./profile.js";
+import { evaluateAccessTier, failClosedTier } from "../access/accessTier.js";
+import { isAuthError } from "../diagnostics/errors.js";
+
+/**
+ * The identity in the stored artifact: who, not what the token said.
+ *
+ * The whole claim set used to be written to the Keychain on every launch — all
+ * of it, groups included — for a value nothing reads back: the access tier is
+ * recomputed from fresh claims, and a restore that cannot reach the provider
+ * fails closed anyway (AUTH-23).
+ */
+
+/** The artifact's identity as a profile. Artifacts written before 0.4.0 carry claims; they are kept. */
+export function profileFromStored(stored) {
+  return {
+    ...stored,
+    claims: 'claims' in stored ? stored.claims ?? {} : {}
+  };
+}
+
+/** What goes to the store: everything but the claims. */
+export function storedProfileFrom(profile) {
+  return {
+    tenantUserId: profile.tenantUserId,
+    displayName: profile.displayName,
+    email: profile.email,
+    provider: profile.provider
+  };
+}
+
+/** True when the artifact would be byte-identical, so the write can be skipped. */
+export function sameSession(a, b) {
+  return a.refreshToken === b.refreshToken && a.idToken === b.idToken && a.profile.tenantUserId === b.profile.tenantUserId && a.profile.displayName === b.profile.displayName && a.profile.email === b.profile.email && a.profile.provider === b.profile.provider;
+}
+export function parsePersistedSession(raw) {
+  if (!raw) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed.refreshToken === 'string' && parsed.profile) {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+export async function restoreSession(deps) {
+  const raw = await deps.secureStore.getItem(AUTH_STORAGE_KEY);
+  const persisted = parsePersistedSession(raw);
+  if (!persisted) {
+    return {
+      outcome: 'unavailable'
+    };
+  }
+  try {
+    const tokens = await deps.authClient.refresh({
+      authority: deps.authority,
+      clientId: deps.clientId,
+      redirectUrl: deps.redirectUrl,
+      refreshToken: persisted.refreshToken,
+      scopes: deps.scopes
+    });
+    // A refresh response may carry no id token, and so no claims. The stored
+    // profile is then still the best identity there is; an empty one is not.
+    const hasClaims = Object.keys(tokens.claims).length > 0;
+    return {
+      outcome: 'restored',
+      persisted,
+      // The provider id came from the sign-in and is not in the claims: a
+      // refresh answered `idp: 'google.com'`, so a restored profile used to
+      // report a different provider than the same session did before (AUTH-10).
+      profile: hasClaims ? mapClaimsToProfile(tokens.claims, persisted.profile.provider) : profileFromStored(persisted.profile),
+      accessTier: hasClaims ? evaluateAccessTier(tokens.claims, deps.mapping) : failClosedTier(),
+      refreshToken: tokens.refreshToken || persisted.refreshToken,
+      idToken: tokens.idToken || persisted.idToken
+    };
+  } catch (error) {
+    if (isAuthError(error) && error.code === 'session-expired') {
+      // The provider rejected the refresh token: reauthentication is required.
+      return {
+        outcome: 'unavailable'
+      };
+    }
+    // Anything else is no verdict on the session. Keep the cached identity
+    // read-only and fail closed on entitlement; the next restore tries again.
+    return {
+      outcome: 'offline',
+      persisted,
+      profile: profileFromStored(persisted.profile),
+      accessTier: failClosedTier(),
+      refreshToken: persisted.refreshToken,
+      idToken: persisted.idToken
+    };
+  }
+}
+//# sourceMappingURL=session.js.map

package/lib/module/core/session.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["AUTH_STORAGE_KEY","mapClaimsToProfile","evaluateAccessTier","failClosedTier","isAuthError","profileFromStored","stored","claims","storedProfileFrom","profile","tenantUserId","displayName","email","provider","sameSession","a","b","refreshToken","idToken","parsePersistedSession","raw","parsed","JSON","parse","restoreSession","deps","secureStore","getItem","persisted","outcome","tokens","authClient","refresh","authority","clientId","redirectUrl","scopes","hasClaims","Object","keys","length","accessTier","mapping","error","code"],"sourceRoot":"../../../src","sources":["core/session.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA,SAASA,gBAAgB,QAAQ,0BAAuB;AACxD,SAASC,kBAAkB,QAAQ,cAAW;AAC9C,SAASC,kBAAkB,EAAEC,cAAc,QAAQ,yBAAsB;AACzE,SAASC,WAAW,QAAQ,0BAAuB;;AAEnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAUA;AACA,OAAO,SAASC,iBAAiBA,CAACC,MAA+B,EAAW;EAC3E,OAAO;IAAE,GAAGA,MAAM;IAAEC,MAAM,EAAE,QAAQ,IAAID,MAAM,GAAIA,MAAM,CAACC,MAAM,IAAI,CAAC,CAAC,GAAI,CAAC;EAAE,CAAC;AAC9E;;AAEA;AACA,OAAO,SAASC,iBAAiBA,CAACC,OAAgB,EAAiB;EAClE,OAAO;IACNC,YAAY,EAAED,OAAO,CAACC,YAAY;IAClCC,WAAW,EAAEF,OAAO,CAACE,WAAW;IAChCC,KAAK,EAAEH,OAAO,CAACG,KAAK;IACpBC,QAAQ,EAAEJ,OAAO,CAACI;EACnB,CAAC;AACF;;AAEA;AACA,OAAO,SAASC,WAAWA,CAACC,CAAmB,EAAEC,CAAmB,EAAW;EAC9E,OACCD,CAAC,CAACE,YAAY,KAAKD,CAAC,CAACC,YAAY,IACjCF,CAAC,CAACG,OAAO,KAAKF,CAAC,CAACE,OAAO,IACvBH,CAAC,CAACN,OAAO,CAACC,YAAY,KAAKM,CAAC,CAACP,OAAO,CAACC,YAAY,IACjDK,CAAC,CAACN,OAAO,CAACE,WAAW,KAAKK,CAAC,CAACP,OAAO,CAACE,WAAW,IAC/CI,CAAC,CAACN,OAAO,CAACG,KAAK,KAAKI,CAAC,CAACP,OAAO,CAACG,KAAK,IACnCG,CAAC,CAACN,OAAO,CAACI,QAAQ,KAAKG,CAAC,CAACP,OAAO,CAACI,QAAQ;AAE3C;AAsBA,OAAO,SAASM,qBAAqBA,CAACC,GAAkB,EAA2B;EAClF,IAAI,CAACA,GAAG,EAAE;IACT,OAAO,IAAI;EACZ;EACA,IAAI;IACH,MAAMC,MAAM,GAAGC,IAAI,CAACC,KAAK,CAACH,GAAG,CAAqB;IAClD,IAAIC,MAAM,IAAI,OAAOA,MAAM,CAACJ,YAAY,KAAK,QAAQ,IAAII,MAAM,CAACZ,OAAO,EAAE;MACxE,OAAOY,MAAM;IACd;IACA,OAAO,IAAI;EACZ,CAAC,CAAC,MAAM;IACP,OAAO,IAAI;EACZ;AACD;AAEA,OAAO,eAAeG,cAAcA,CAACC,IAAiB,EAA0B;EAC/E,MAAML,GAAG,GAAG,MAAMK,IAAI,CAACC,WAAW,CAACC,OAAO,CAAC3B,gBAAgB,CAAC;EAC5D,MAAM4B,SAAS,GAAGT,qBAAqB,CAACC,GAAG,CAAC;EAC5C,IAAI,CAACQ,SAAS,EAAE;IACf,OAAO;MAAEC,OAAO,EAAE;IAAc,CAAC;EAClC;EAEA,IAAI;IACH,MAAMC,MAAM,GAAG,MAAML,IAAI,CAACM,UAAU,CAACC,OAAO,CAAC;MAC5CC,SAAS,EAAER,IAAI,CAACQ,SAAS;MACzBC,QAAQ,EAAET,IAAI,CAACS,QAAQ;MACvBC,WAAW,EAAEV,IAAI,CAACU,WAAW;MAC7BlB,YAAY,EAAEW,SAAS,CAACX,YAAY;MACpCmB,MAAM,EAAEX,IAAI,CAACW;IACd,CAAC,CAAC;IACF;IACA;IACA,MAAMC,SAAS,GAAGC,MAAM,CAACC,IAAI,CAACT,MAAM,CAACvB,MAAM,CAAC,CAACiC,MAAM,GAAG,CAAC;IACvD,OAAO;MACNX,OAAO,EAAE,UAAU;MACnBD,SAAS;MACT;MACA;MACA;MACAnB,OAAO,EAAE4B,SAAS,GACfpC,kBAAkB,CAAC6B,MAAM,CAACvB,MAAM,EAAEqB,SAAS,CAACnB,OAAO,CAACI,QAAQ,CAAC,GAC7DR,iBAAiB,CAACuB,SAAS,CAACnB,OAAO,CAAC;MACvCgC,UAAU,EAAEJ,SAAS,GAAGnC,kBAAkB,CAAC4B,MAAM,CAACvB,MAAM,EAAEkB,IAAI,CAACiB,OAAO,CAAC,GAAGvC,cAAc,CAAC,CAAC;MAC1Fc,YAAY,EAAEa,MAAM,CAACb,YAAY,IAAIW,SAAS,CAACX,YAAY;MAC3DC,OAAO,EAAEY,MAAM,CAACZ,OAAO,IAAIU,SAAS,CAACV;IACtC,CAAC;EACF,CAAC,CAAC,OAAOyB,KAAK,EAAE;IACf,IAAIvC,WAAW,CAACuC,KAAK,CAAC,IAAIA,KAAK,CAACC,IAAI,KAAK,iBAAiB,EAAE;MAC3D;MACA,OAAO;QAAEf,OAAO,EAAE;MAAc,CAAC;IAClC;IACA;IACA;IACA,OAAO;MACNA,OAAO,EAAE,SAAS;MAClBD,SAAS;MACTnB,OAAO,EAAEJ,iBAAiB,CAACuB,SAAS,CAACnB,OAAO,CAAC;MAC7CgC,UAAU,EAAEtC,cAAc,CAAC,CAAC;MAC5Bc,YAAY,EAAEW,SAAS,CAACX,YAAY;MACpCC,OAAO,EAAEU,SAAS,CAACV;IACpB,CAAC;EACF;AACD","ignoreList":[]}