@chipmobilesdk/rn-auth 0.4.0 → 0.6.0

package/lib/module/diagnostics/errors.js

@@ -0,0 +1,74 @@
+"use strict";
+
+/**
+ * Developer-facing diagnostics. AuthError carries a stable machine-readable
+ * code, an audience (user vs developer/tenant), and a localizable message key.
+ * `detail` is always passed through `redact` so tokens and secrets never appear
+ * in logs or error objects (FR-014).
+ */
+
+import { COMMON_PATTERNS, SdkError, redactPatterns } from '@chipmobilesdk/rn-core';
+/** JWT-shaped values: three base64url segments separated by dots. */
+const JWT_PATTERN = /[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g;
+/** Any other long opaque token-like run; shorter than rn-core's payload run on purpose. */
+const TOKEN_PATTERN = /[A-Za-z0-9_-]{24,}/g;
+
+/**
+ * Replace token-like substrings with a placeholder so diagnostics never leak
+ * secrets or token values (FR-014): JWTs become `[redacted-token]`; URLs, e-mail
+ * addresses, UUIDs and other opaque runs become `[redacted]` (rn-core's patterns).
+ */
+export function redact(value) {
+  if (!value) {
+    return value;
+  }
+  return redactPatterns(value.replace(JWT_PATTERN, '[redacted-token]'), [...COMMON_PATTERNS, TOKEN_PATTERN]);
+}
+
+/** Retrying can only help when the network was the problem. */
+const RETRYABLE = new Set(['network-unavailable']);
+
+/** The package's error; an `SdkError` (`@chipmobilesdk/rn-core`) with `pkg: 'rn-auth'`. */
+export class AuthError extends SdkError {
+  constructor(args) {
+    const detail = redact(args.detail);
+    super('rn-auth', args.code, {
+      message: args.messageKey,
+      retryable: RETRYABLE.has(args.code),
+      redactedCause: detail
+    });
+    this.name = 'AuthError';
+    this.audience = args.audience ?? 'developer';
+    this.messageKey = args.messageKey;
+    this.detail = detail;
+  }
+}
+export class AuthConfigError extends AuthError {
+  constructor(messageKey, detail) {
+    super({
+      code: 'configuration-error',
+      messageKey,
+      audience: 'developer',
+      detail
+    });
+    this.name = 'AuthConfigError';
+  }
+}
+export function isAuthError(value) {
+  return value instanceof AuthError;
+}
+
+/** Normalize any thrown value into an AuthError without leaking secrets. */
+export function toAuthError(value, fallbackCode = 'token-acquisition-failed', fallbackMessageKey = 'auth.error.token') {
+  if (isAuthError(value)) {
+    return value;
+  }
+  const message = value instanceof Error ? value.message : String(value);
+  return new AuthError({
+    code: fallbackCode,
+    messageKey: fallbackMessageKey,
+    audience: 'developer',
+    detail: message
+  });
+}
+//# sourceMappingURL=errors.js.map

package/lib/module/diagnostics/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["COMMON_PATTERNS","SdkError","redactPatterns","JWT_PATTERN","TOKEN_PATTERN","redact","value","replace","RETRYABLE","Set","AuthError","constructor","args","detail","code","message","messageKey","retryable","has","redactedCause","name","audience","AuthConfigError","isAuthError","toAuthError","fallbackCode","fallbackMessageKey","Error","String"],"sourceRoot":"../../../src","sources":["diagnostics/errors.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,eAAe,EAAEC,QAAQ,EAAEC,cAAc,QAAQ,wBAAwB;AAuBlF;AACA,MAAMC,WAAW,GAAG,0DAA0D;AAC9E;AACA,MAAMC,aAAa,GAAG,qBAAqB;;AAE3C;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,MAAMA,CAACC,KAAyB,EAAsB;EACrE,IAAI,CAACA,KAAK,EAAE;IACX,OAAOA,KAAK;EACb;EACA,OAAOJ,cAAc,CAACI,KAAK,CAACC,OAAO,CAACJ,WAAW,EAAE,kBAAkB,CAAC,EAAE,CACrE,GAAGH,eAAe,EAClBI,aAAa,CACb,CAAC;AACH;;AAEA;AACA,MAAMI,SAAqC,GAAG,IAAIC,GAAG,CAAgB,CAAC,qBAAqB,CAAC,CAAC;;AAE7F;AACA,OAAO,MAAMC,SAAS,SAAST,QAAQ,CAAgB;EAKtDU,WAAWA,CAACC,IAAmB,EAAE;IAChC,MAAMC,MAAM,GAAGR,MAAM,CAACO,IAAI,CAACC,MAAM,CAAC;IAClC,KAAK,CAAC,SAAS,EAAED,IAAI,CAACE,IAAI,EAAE;MAC3BC,OAAO,EAAEH,IAAI,CAACI,UAAU;MACxBC,SAAS,EAAET,SAAS,CAACU,GAAG,CAACN,IAAI,CAACE,IAAI,CAAC;MACnCK,aAAa,EAAEN;IAChB,CAAC,CAAC;IACF,IAAI,CAACO,IAAI,GAAG,WAAW;IACvB,IAAI,CAACC,QAAQ,GAAGT,IAAI,CAACS,QAAQ,IAAI,WAAW;IAC5C,IAAI,CAACL,UAAU,GAAGJ,IAAI,CAACI,UAAU;IACjC,IAAI,CAACH,MAAM,GAAGA,MAAM;EACrB;AACD;AAEA,OAAO,MAAMS,eAAe,SAASZ,SAAS,CAAC;EAC9CC,WAAWA,CAACK,UAA0B,EAAEH,MAAe,EAAE;IACxD,KAAK,CAAC;MAAEC,IAAI,EAAE,qBAAqB;MAAEE,UAAU;MAAEK,QAAQ,EAAE,WAAW;MAAER;IAAO,CAAC,CAAC;IACjF,IAAI,CAACO,IAAI,GAAG,iBAAiB;EAC9B;AACD;AAEA,OAAO,SAASG,WAAWA,CAACjB,KAAc,EAAsB;EAC/D,OAAOA,KAAK,YAAYI,SAAS;AAClC;;AAEA;AACA,OAAO,SAASc,WAAWA,CAC1BlB,KAAc,EACdmB,YAA2B,GAAG,0BAA0B,EACxDC,kBAAkC,GAAG,kBAAkB,EAC3C;EACZ,IAAIH,WAAW,CAACjB,KAAK,CAAC,EAAE;IACvB,OAAOA,KAAK;EACb;EACA,MAAMS,OAAO,GAAGT,KAAK,YAAYqB,KAAK,GAAGrB,KAAK,CAACS,OAAO,GAAGa,MAAM,CAACtB,KAAK,CAAC;EACtE,OAAO,IAAII,SAAS,CAAC;IACpBI,IAAI,EAAEW,YAAY;IAClBT,UAAU,EAAEU,kBAAkB;IAC9BL,QAAQ,EAAE,WAAW;IACrBR,MAAM,EAAEE;EACT,CAAC,CAAC;AACH","ignoreList":[]}

package/lib/module/diagnostics/messageKeys.js

@@ -0,0 +1,46 @@
+"use strict";
+
+/**
+ * Stable, localizable message keys with English default copy (UX-006 / LIB-011).
+ * The library takes no i18n runtime dependency: consuming apps map these keys to
+ * localized strings via their own i18n system. User-actionable copy and
+ * developer/tenant-configuration copy are kept separate (UX-005).
+ */
+
+import { defineMessages } from '@chipmobilesdk/rn-core';
+/**
+ * The catalog, as an rn-core message set: `user` copy may reach an end user,
+ * `developer` copy describes a tenant or configuration fault (UX-005). Register
+ * `authMessages.user` with rn-i18n to translate it like app copy.
+ */
+export const authMessages = defineMessages({
+  user: {
+    'auth.action.continueGoogle': 'Continue with Google',
+    'auth.action.continueApple': 'Continue with Apple',
+    'auth.action.continueFacebook': 'Continue with Facebook',
+    'auth.state.signedOut': 'Sign in to continue',
+    'auth.state.authenticating': 'Signing you in…',
+    'auth.state.signedIn': 'You are signed in',
+    'auth.state.signingOut': 'Signing out…',
+    'auth.tier.free': 'Free',
+    'auth.tier.premium': 'Premium',
+    'auth.tier.unverified': 'Membership could not be verified',
+    'auth.error.cancelled': 'Sign-in was cancelled. You can try again.',
+    'auth.error.sessionExpired': 'Your session expired. Please sign in again.',
+    'auth.error.entitlement': 'This feature requires a verified premium membership.',
+    'auth.error.network': 'No connection. Some features are limited until you reconnect.'
+  },
+  developer: {
+    'auth.error.configuration': 'Authentication is not configured correctly.',
+    'auth.error.redirectMismatch': 'The sign-in redirect does not match the app configuration.',
+    'auth.error.token': 'We could not complete the request. Please try again.',
+    'auth.error.consentDenied': 'Access to this resource was denied.'
+  }
+});
+export const DEFAULT_MESSAGES = authMessages.defaults;
+
+/** Resolve a message, preferring app overrides over the English defaults. */
+export function resolveMessages(overrides) {
+  return authMessages.resolve(overrides);
+}
+//# sourceMappingURL=messageKeys.js.map

package/lib/module/diagnostics/messageKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["defineMessages","authMessages","user","developer","DEFAULT_MESSAGES","defaults","resolveMessages","overrides","resolve"],"sourceRoot":"../../../src","sources":["diagnostics/messageKeys.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,cAAc,QAAQ,wBAAwB;AA6BvD;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,YAAY,GAAGD,cAAc,CAAC;EAC1CE,IAAI,EAAE;IACL,4BAA4B,EAAE,sBAAsB;IACpD,2BAA2B,EAAE,qBAAqB;IAClD,8BAA8B,EAAE,wBAAwB;IACxD,sBAAsB,EAAE,qBAAqB;IAC7C,2BAA2B,EAAE,iBAAiB;IAC9C,qBAAqB,EAAE,mBAAmB;IAC1C,uBAAuB,EAAE,cAAc;IACvC,gBAAgB,EAAE,MAAM;IACxB,mBAAmB,EAAE,SAAS;IAC9B,sBAAsB,EAAE,kCAAkC;IAC1D,sBAAsB,EAAE,2CAA2C;IACnE,2BAA2B,EAAE,6CAA6C;IAC1E,wBAAwB,EAAE,sDAAsD;IAChF,oBAAoB,EAAE;EACvB,CAAC;EACDC,SAAS,EAAE;IACV,0BAA0B,EAAE,6CAA6C;IACzE,6BAA6B,EAAE,4DAA4D;IAC3F,kBAAkB,EAAE,sDAAsD;IAC1E,0BAA0B,EAAE;EAC7B;AACD,CAAC,CAAC;AAEF,OAAO,MAAMC,gBAAgC,GAAGH,YAAY,CAACI,QAAQ;;AAErE;AACA,OAAO,SAASC,eAAeA,CAACC,SAAmC,EAAkB;EACpF,OAAON,YAAY,CAACO,OAAO,CAACD,SAAS,CAAC;AACvC","ignoreList":[]}

package/lib/module/index.js

@@ -0,0 +1,33 @@
+"use strict";
+
+/**
+ * @chipmobilesdk/rn-auth — reusable Microsoft Entra External ID authentication
+ * for ChipMobileSdk-family React Native apps (public OIDC/PKCE client, no
+ * backend). This is the single public entrypoint (LIB-003); modules under
+ * `core/`, `tokens/`, `oidc/`, `access/`, and `diagnostics/` are private.
+ */
+
+import { createAuthMachine } from "./core/authMachine.js";
+/** Create the auth controller. Throws AuthConfigError on invalid config (FR-005). */
+export function createAuth(config, options) {
+  return createAuthMachine(config, options);
+}
+
+// Public types
+
+// Ports + default adapters
+export { describeProviderIdentity, mapClaimsToProfile } from "./core/profile.js";
+export { createKeychainSecureStore, AUTH_STORAGE_KEY } from "./tokens/secureStore.js";
+export { createAppAuthClient } from "./oidc/authClient.js";
+
+// Access-tier evaluation (also exported for app-side reuse/testing)
+export { evaluateAccessTier, failClosedTier } from "./access/accessTier.js";
+
+// Diagnostics
+export { AuthError, AuthConfigError, isAuthError, redact } from "./diagnostics/errors.js";
+export { DEFAULT_MESSAGES, authMessages, resolveMessages } from "./diagnostics/messageKeys.js";
+// React bindings
+export { AuthProvider } from "./react/AuthProvider.js";
+export { useAuthSelector } from "./react/hooks.js";
+export { useAuth, useAuthMessages, useProfile, useAccessTier, useAccessToken, useSignInProvider, useSignInProviders } from "./react/hooks.js";
+//# sourceMappingURL=index.js.map

package/lib/module/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createAuthMachine","createAuth","config","options","describeProviderIdentity","mapClaimsToProfile","createKeychainSecureStore","AUTH_STORAGE_KEY","createAppAuthClient","evaluateAccessTier","failClosedTier","AuthError","AuthConfigError","isAuthError","redact","DEFAULT_MESSAGES","authMessages","resolveMessages","AuthProvider","useAuthSelector","useAuth","useAuthMessages","useProfile","useAccessTier","useAccessToken","useSignInProvider","useSignInProviders"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,iBAAiB,QAAQ,uBAAoB;AAGtD;AACA,OAAO,SAASC,UAAUA,CAACC,MAAkB,EAAEC,OAA2B,EAAQ;EACjF,OAAOH,iBAAiB,CAACE,MAAM,EAAEC,OAAO,CAAC;AAC1C;;AAEA;;AAwBA;AACA,SAASC,wBAAwB,EAAEC,kBAAkB,QAAQ,mBAAgB;AAI7E,SAASC,yBAAyB,EAAEC,gBAAgB,QAAQ,yBAAsB;AAUlF,SAASC,mBAAmB,QAAQ,sBAAmB;;AAEvD;AACA,SAASC,kBAAkB,EAAEC,cAAc,QAAQ,wBAAqB;;AAExE;AACA,SAASC,SAAS,EAAEC,eAAe,EAAEC,WAAW,EAAEC,MAAM,QAAQ,yBAAsB;AAEtF,SAASC,gBAAgB,EAAEC,YAAY,EAAEC,eAAe,QAAQ,8BAA2B;AAG3F;AACA,SAASC,YAAY,QAAQ,yBAAsB;AACnD,SAASC,eAAe,QAAQ,kBAAe;AAE/C,SACCC,OAAO,EACPC,eAAe,EACfC,UAAU,EACVC,aAAa,EACbC,cAAc,EACdC,iBAAiB,EACjBC,kBAAkB,QACZ,kBAAe","ignoreList":[]}

package/lib/module/keychain.js

@@ -0,0 +1,9 @@
+"use strict";
+
+/**
+ * `@chipmobilesdk/rn-auth/keychain`: the default secure token store over
+ * react-native-keychain (AUTH-09). Its own entrypoint, so an app with its own
+ * secure storage never reaches this module.
+ */
+export { createKeychainSecureStore } from "./tokens/secureStore.js";
+//# sourceMappingURL=keychain.js.map

package/lib/module/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createKeychainSecureStore"],"sourceRoot":"../../src","sources":["keychain.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA,SAASA,yBAAyB,QAAyC,yBAAsB","ignoreList":[]}

package/lib/module/oidc/authClient.js

@@ -0,0 +1,152 @@
+"use strict";
+
+/**
+ * OidcAuthClient port + default react-native-app-auth adapter (R1).
+ *
+ * The port abstracts the Authorization Code + PKCE public-client flow so the
+ * auth engine is testable without native code. The default adapter lazily
+ * requires react-native-app-auth and is validated on device.
+ */
+
+import { lazyPeer } from '@chipmobilesdk/rn-core';
+import { AuthConfigError } from "../diagnostics/errors.js";
+import { classifyAppAuthError } from "./classifyError.js";
+/** Decode the payload segment of a JWT without any dependency (device-safe). */
+export function decodeJwtClaims(jwt) {
+  if (typeof jwt !== 'string') {
+    return {};
+  }
+  const [, payload] = jwt.split('.');
+  if (payload === undefined) {
+    return {};
+  }
+  try {
+    const json = base64UrlDecode(payload);
+    return JSON.parse(json);
+  } catch {
+    return {};
+  }
+}
+const BASE64_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+function base64UrlDecode(input) {
+  let base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+  while (base64.length % 4 !== 0) {
+    base64 += '=';
+  }
+  let bytes = '';
+  let buffer = 0;
+  let bits = 0;
+  for (const char of base64) {
+    if (char === '=') {
+      break;
+    }
+    const index = BASE64_CHARS.indexOf(char);
+    if (index === -1) {
+      continue;
+    }
+    // Standard base64 bit assembly; bitwise ops are intentional here.
+    // eslint-disable-next-line no-bitwise
+    buffer = buffer << 6 | index;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      // eslint-disable-next-line no-bitwise
+      bytes += String.fromCharCode(buffer >> bits & 0xff);
+    }
+  }
+  // Interpret the byte string (each char is a 0–255 byte) as UTF-8 without
+  // relying on the deprecated global `escape`.
+  try {
+    const percentEncoded = Array.from(bytes).map(char => '%' + char.charCodeAt(0).toString(16).padStart(2, '0')).join('');
+    return decodeURIComponent(percentEncoded);
+  } catch {
+    return bytes;
+  }
+}
+
+/** The endpoints discovery would have returned, when an app already knows them. */
+
+/**
+ * Loaded on the first sign-in, refresh or sign-out, never at startup (PERF-05):
+ * creating the client, or the whole auth instance, loads no native code.
+ */
+const appAuthPeer = lazyPeer('react-native-app-auth', () => {
+  // Inside `try`, so Metro bundles an app that leaves this optional peer out.
+  try {
+    return require('react-native-app-auth');
+  } catch (cause) {
+    throw cause;
+  }
+});
+function appAuth() {
+  return appAuthPeer.require(peer => new AuthConfigError('auth.error.configuration', `${peer} is not installed or its native module is not linked`));
+}
+
+/** The module's calls, resolved only when one is made. */
+const AppAuth = {
+  authorize: config => appAuth().authorize(config),
+  refresh: (config, params) => appAuth().refresh(config, params),
+  logout: (config, params) => appAuth().logout(config, params)
+};
+
+/**
+ * Default OidcAuthClient adapter wrapping react-native-app-auth (PKCE public
+ * client). Validated on device (R8).
+ */
+export function createAppAuthClient(options = {}) {
+  const serviceConfiguration = options.serviceConfiguration;
+  // Discovery is pointless once the endpoints are given, whatever was asked for.
+  const useDiscovery = serviceConfiguration ? false : options.useDiscovery ?? true;
+  const baseConfig = (authority, clientId, redirectUrl, scopes) => ({
+    issuer: useDiscovery ? authority : undefined,
+    ...(serviceConfiguration ? {
+      serviceConfiguration
+    } : {}),
+    clientId,
+    redirectUrl,
+    scopes
+  });
+  const toTokens = result => ({
+    accessToken: result.accessToken,
+    // Absent stays absent: an empty string was indistinguishable from a real
+    // token by type, and silently disabled session persistence.
+    refreshToken: result.refreshToken || undefined,
+    idToken: result.idToken || undefined,
+    claims: decodeJwtClaims(result.idToken),
+    accessTokenExpiresAt: result.accessTokenExpirationDate ? new Date(result.accessTokenExpirationDate).getTime() : undefined
+  });
+  return {
+    async authorize(params) {
+      try {
+        const result = await AppAuth.authorize({
+          ...baseConfig(params.authority, params.clientId, params.redirectUrl, params.scopes),
+          additionalParameters: params.additionalParameters
+        });
+        return toTokens(result);
+      } catch (error) {
+        throw classifyAppAuthError(error);
+      }
+    },
+    async refresh(params) {
+      try {
+        const result = await AppAuth.refresh(baseConfig(params.authority, params.clientId, params.redirectUrl, params.scopes), {
+          refreshToken: params.refreshToken
+        });
+        return toTokens(result);
+      } catch (error) {
+        throw classifyAppAuthError(error);
+      }
+    },
+    async endSession(params) {
+      try {
+        await AppAuth.logout(baseConfig(params.authority, params.clientId, params.redirectUrl, []), {
+          idToken: params.idToken ?? '',
+          postLogoutRedirectUrl: params.redirectUrl
+        });
+      } catch (error) {
+        throw classifyAppAuthError(error);
+      }
+    }
+  };
+}
+//# sourceMappingURL=authClient.js.map

package/lib/module/oidc/authClient.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["lazyPeer","AuthConfigError","classifyAppAuthError","decodeJwtClaims","jwt","payload","split","undefined","json","base64UrlDecode","JSON","parse","BASE64_CHARS","input","base64","replace","length","bytes","buffer","bits","char","index","indexOf","String","fromCharCode","percentEncoded","Array","from","map","charCodeAt","toString","padStart","join","decodeURIComponent","appAuthPeer","require","cause","appAuth","peer","AppAuth","authorize","config","refresh","params","logout","createAppAuthClient","options","serviceConfiguration","useDiscovery","baseConfig","authority","clientId","redirectUrl","scopes","issuer","toTokens","result","accessToken","refreshToken","idToken","claims","accessTokenExpiresAt","accessTokenExpirationDate","Date","getTime","additionalParameters","error","endSession","postLogoutRedirectUrl"],"sourceRoot":"../../../src","sources":["oidc/authClient.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,QAAQ,QAAQ,wBAAwB;AAEjD,SAASC,eAAe,QAAQ,0BAAuB;AAEvD,SAASC,oBAAoB,QAAQ,oBAAiB;AAiDtD;AACA,OAAO,SAASC,eAAeA,CAACC,GAA8B,EAA2B;EACxF,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;IAC5B,OAAO,CAAC,CAAC;EACV;EACA,MAAM,GAAGC,OAAO,CAAC,GAAGD,GAAG,CAACE,KAAK,CAAC,GAAG,CAAC;EAClC,IAAID,OAAO,KAAKE,SAAS,EAAE;IAC1B,OAAO,CAAC,CAAC;EACV;EACA,IAAI;IACH,MAAMC,IAAI,GAAGC,eAAe,CAACJ,OAAO,CAAC;IACrC,OAAOK,IAAI,CAACC,KAAK,CAACH,IAAI,CAAC;EACxB,CAAC,CAAC,MAAM;IACP,OAAO,CAAC,CAAC;EACV;AACD;AAEA,MAAMI,YAAY,GAAG,kEAAkE;AAEvF,SAASH,eAAeA,CAACI,KAAa,EAAU;EAC/C,IAAIC,MAAM,GAAGD,KAAK,CAACE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAACA,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;EACxD,OAAOD,MAAM,CAACE,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE;IAC/BF,MAAM,IAAI,GAAG;EACd;EACA,IAAIG,KAAK,GAAG,EAAE;EACd,IAAIC,MAAM,GAAG,CAAC;EACd,IAAIC,IAAI,GAAG,CAAC;EACZ,KAAK,MAAMC,IAAI,IAAIN,MAAM,EAAE;IAC1B,IAAIM,IAAI,KAAK,GAAG,EAAE;MACjB;IACD;IACA,MAAMC,KAAK,GAAGT,YAAY,CAACU,OAAO,CAACF,IAAI,CAAC;IACxC,IAAIC,KAAK,KAAK,CAAC,CAAC,EAAE;MACjB;IACD;IACA;IACA;IACAH,MAAM,GAAIA,MAAM,IAAI,CAAC,GAAIG,KAAK;IAC9BF,IAAI,IAAI,CAAC;IACT,IAAIA,IAAI,IAAI,CAAC,EAAE;MACdA,IAAI,IAAI,CAAC;MACT;MACAF,KAAK,IAAIM,MAAM,CAACC,YAAY,CAAEN,MAAM,IAAIC,IAAI,GAAI,IAAI,CAAC;IACtD;EACD;EACA;EACA;EACA,IAAI;IACH,MAAMM,cAAc,GAAGC,KAAK,CAACC,IAAI,CAACV,KAAK,CAAC,CACtCW,GAAG,CAACR,IAAI,IAAI,GAAG,GAAGA,IAAI,CAACS,UAAU,CAAC,CAAC,CAAC,CAACC,QAAQ,CAAC,EAAE,CAAC,CAACC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CACnEC,IAAI,CAAC,EAAE,CAAC;IACV,OAAOC,kBAAkB,CAACR,cAAc,CAAC;EAC1C,CAAC,CAAC,MAAM;IACP,OAAOR,KAAK;EACb;AACD;;AAEA;;AA6BA;AACA;AACA;AACA;AACA,MAAMiB,WAAW,GAAGlC,QAAQ,CAAC,uBAAuB,EAAE,MAAM;EAC3D;EACA,IAAI;IACH,OAAOmC,OAAO,CAAC,uBAAuB,CAAC;EACxC,CAAC,CAAC,OAAOC,KAAK,EAAE;IACf,MAAMA,KAAK;EACZ;AACD,CAAC,CAAC;AAEF,SAASC,OAAOA,CAAA,EAAkB;EACjC,OAAOH,WAAW,CAACC,OAAO,CACzBG,IAAI,IACH,IAAIrC,eAAe,CAClB,0BAA0B,EAC1B,GAAGqC,IAAI,sDACR,CACF,CAAC;AACF;;AAEA;AACA,MAAMC,OAAsB,GAAG;EAC9BC,SAAS,EAAEC,MAAM,IAAIJ,OAAO,CAAC,CAAC,CAACG,SAAS,CAACC,MAAM,CAAC;EAChDC,OAAO,EAAEA,CAACD,MAAM,EAAEE,MAAM,KAAKN,OAAO,CAAC,CAAC,CAACK,OAAO,CAACD,MAAM,EAAEE,MAAM,CAAC;EAC9DC,MAAM,EAAEA,CAACH,MAAM,EAAEE,MAAM,KAAKN,OAAO,CAAC,CAAC,CAACO,MAAM,CAACH,MAAM,EAAEE,MAAM;AAC5D,CAAC;;AAED;AACA;AACA;AACA;AACA,OAAO,SAASE,mBAAmBA,CAACC,OAA6B,GAAG,CAAC,CAAC,EAAkB;EACvF,MAAMC,oBAAoB,GAAGD,OAAO,CAACC,oBAAoB;EACzD;EACA,MAAMC,YAAY,GAAGD,oBAAoB,GAAG,KAAK,GAAID,OAAO,CAACE,YAAY,IAAI,IAAK;EAElF,MAAMC,UAAU,GAAGA,CAClBC,SAAiB,EACjBC,QAAgB,EAChBC,WAAmB,EACnBC,MAAgB,MACX;IACLC,MAAM,EAAEN,YAAY,GAAGE,SAAS,GAAG3C,SAAS;IAC5C,IAAIwC,oBAAoB,GAAG;MAAEA;IAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;IACzDI,QAAQ;IACRC,WAAW;IACXC;EACD,CAAC,CAAC;EAEF,MAAME,QAAQ,GAAIC,MAKjB,KAAkB;IAClBC,WAAW,EAAED,MAAM,CAACC,WAAW;IAC/B;IACA;IACAC,YAAY,EAAEF,MAAM,CAACE,YAAY,IAAInD,SAAS;IAC9CoD,OAAO,EAAEH,MAAM,CAACG,OAAO,IAAIpD,SAAS;IACpCqD,MAAM,EAAEzD,eAAe,CAACqD,MAAM,CAACG,OAAO,CAAC;IACvCE,oBAAoB,EAAEL,MAAM,CAACM,yBAAyB,GACnD,IAAIC,IAAI,CAACP,MAAM,CAACM,yBAAyB,CAAC,CAACE,OAAO,CAAC,CAAC,GACpDzD;EACJ,CAAC,CAAC;EAEF,OAAO;IACN,MAAMiC,SAASA,CAACG,MAAM,EAAE;MACvB,IAAI;QACH,MAAMa,MAAM,GAAG,MAAMjB,OAAO,CAACC,SAAS,CAAC;UACtC,GAAGS,UAAU,CAACN,MAAM,CAACO,SAAS,EAAEP,MAAM,CAACQ,QAAQ,EAAER,MAAM,CAACS,WAAW,EAAET,MAAM,CAACU,MAAM,CAAC;UACnFY,oBAAoB,EAAEtB,MAAM,CAACsB;QAC9B,CAAC,CAAC;QACF,OAAOV,QAAQ,CAACC,MAAM,CAAC;MACxB,CAAC,CAAC,OAAOU,KAAK,EAAE;QACf,MAAMhE,oBAAoB,CAACgE,KAAK,CAAC;MAClC;IACD,CAAC;IACD,MAAMxB,OAAOA,CAACC,MAAM,EAAE;MACrB,IAAI;QACH,MAAMa,MAAM,GAAG,MAAMjB,OAAO,CAACG,OAAO,CACnCO,UAAU,CAACN,MAAM,CAACO,SAAS,EAAEP,MAAM,CAACQ,QAAQ,EAAER,MAAM,CAACS,WAAW,EAAET,MAAM,CAACU,MAAM,CAAC,EAChF;UAAEK,YAAY,EAAEf,MAAM,CAACe;QAAa,CACrC,CAAC;QACD,OAAOH,QAAQ,CAACC,MAAM,CAAC;MACxB,CAAC,CAAC,OAAOU,KAAK,EAAE;QACf,MAAMhE,oBAAoB,CAACgE,KAAK,CAAC;MAClC;IACD,CAAC;IACD,MAAMC,UAAUA,CAACxB,MAAM,EAAE;MACxB,IAAI;QACH,MAAMJ,OAAO,CAACK,MAAM,CACnBK,UAAU,CAACN,MAAM,CAACO,SAAS,EAAEP,MAAM,CAACQ,QAAQ,EAAER,MAAM,CAACS,WAAW,EAAE,EAAE,CAAC,EACrE;UACCO,OAAO,EAAEhB,MAAM,CAACgB,OAAO,IAAI,EAAE;UAC7BS,qBAAqB,EAAEzB,MAAM,CAACS;QAC/B,CACD,CAAC;MACF,CAAC,CAAC,OAAOc,KAAK,EAAE;QACf,MAAMhE,oBAAoB,CAACgE,KAAK,CAAC;MAClC;IACD;EACD,CAAC;AACF","ignoreList":[]}

package/lib/module/oidc/classifyError.js

@@ -0,0 +1,60 @@
+"use strict";
+
+/**
+ * Classifies a native OIDC error into an `AuthErrorCode`.
+ *
+ * The rules are an ordered table rather than a chain of substring checks, so a
+ * platform adapter (the iOS one, later) adds its own rows without touching the
+ * engine. Order matters: the first matching rule wins.
+ *
+ * The default is deliberately not "session expired". Restore clears the stored
+ * session only on `session-expired`, so anything this table cannot name — a
+ * timeout, a 5xx, a discovery failure, a localized message — must keep the
+ * session rather than sign the user out.
+ */
+
+import { AuthError } from "../diagnostics/errors.js";
+/**
+ * OAuth error codes (RFC 6749 §5.2, OIDC Core §3.1.2.6) and the Entra ID AADSTS
+ * codes that mean the same thing, plus the transport failures app-auth reports.
+ */
+export const DEFAULT_CLASSIFICATION_RULES = [{
+  code: 'provider-cancelled',
+  messageKey: 'auth.error.cancelled',
+  pattern: /cancel|user_cancel|authorization flow (was )?dismissed/i
+}, {
+  code: 'session-expired',
+  messageKey: 'auth.error.sessionExpired',
+  // invalid_grant is the refresh-token verdict; the AADSTS codes are Entra's
+  // expired, revoked, or inactive refresh token and password-changed cases.
+  pattern: /\binvalid_grant\b|\binteraction_required\b|\blogin_required\b|AADSTS(700082|700084|50173|70043)\b/i
+}, {
+  code: 'redirect-mismatch',
+  messageKey: 'auth.error.redirectMismatch',
+  pattern: /redirect_uri|redirect uri|redirect_mismatch|AADSTS50011\b/i
+}, {
+  code: 'consent-denied',
+  messageKey: 'auth.error.consentDenied',
+  pattern: /\baccess_denied\b|\bconsent_required\b|AADSTS65001\b/i
+}, {
+  code: 'network-unavailable',
+  messageKey: 'auth.error.network',
+  pattern: /network|connection|offline|timed? ?out|unable to resolve host|unreachable|\bserver_error\b|\btemporarily_unavailable\b|\b5\d\d\b/i
+}];
+
+/** Maps a native app-auth error to a classified AuthError without leaking tokens. */
+export function classifyAppAuthError(error, rules = DEFAULT_CLASSIFICATION_RULES) {
+  const message = error instanceof Error ? error.message : String(error);
+  const nativeCode = error?.code;
+  const haystack = `${typeof nativeCode === 'string' ? nativeCode : ''} ${message}`;
+  const rule = rules.find(candidate => candidate.pattern.test(haystack));
+  const code = rule?.code ?? 'token-acquisition-failed';
+  return new AuthError({
+    code,
+    messageKey: rule?.messageKey ?? 'auth.error.token',
+    audience: code === 'redirect-mismatch' ? 'developer' : 'user',
+    // AuthError redacts `detail`, so token-shaped values never survive.
+    detail: message
+  });
+}
+//# sourceMappingURL=classifyError.js.map

package/lib/module/oidc/classifyError.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["AuthError","DEFAULT_CLASSIFICATION_RULES","code","messageKey","pattern","classifyAppAuthError","error","rules","message","Error","String","nativeCode","haystack","rule","find","candidate","test","audience","detail"],"sourceRoot":"../../../src","sources":["oidc/classifyError.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,SAAS,QAA4B,0BAAuB;AAUrE;AACA;AACA;AACA;AACA,OAAO,MAAMC,4BAA2D,GAAG,CAC1E;EACCC,IAAI,EAAE,oBAAoB;EAC1BC,UAAU,EAAE,sBAAsB;EAClCC,OAAO,EAAE;AACV,CAAC,EACD;EACCF,IAAI,EAAE,iBAAiB;EACvBC,UAAU,EAAE,2BAA2B;EACvC;EACA;EACAC,OAAO,EACN;AACF,CAAC,EACD;EACCF,IAAI,EAAE,mBAAmB;EACzBC,UAAU,EAAE,6BAA6B;EACzCC,OAAO,EAAE;AACV,CAAC,EACD;EACCF,IAAI,EAAE,gBAAgB;EACtBC,UAAU,EAAE,0BAA0B;EACtCC,OAAO,EAAE;AACV,CAAC,EACD;EACCF,IAAI,EAAE,qBAAqB;EAC3BC,UAAU,EAAE,oBAAoB;EAChCC,OAAO,EACN;AACF,CAAC,CACD;;AAED;AACA,OAAO,SAASC,oBAAoBA,CACnCC,KAAc,EACdC,KAAoC,GAAGN,4BAA4B,EACvD;EACZ,MAAMO,OAAO,GAAGF,KAAK,YAAYG,KAAK,GAAGH,KAAK,CAACE,OAAO,GAAGE,MAAM,CAACJ,KAAK,CAAC;EACtE,MAAMK,UAAU,GAAIL,KAAK,EAAqCJ,IAAI;EAClE,MAAMU,QAAQ,GAAG,GAAG,OAAOD,UAAU,KAAK,QAAQ,GAAGA,UAAU,GAAG,EAAE,IAAIH,OAAO,EAAE;EACjF,MAAMK,IAAI,GAAGN,KAAK,CAACO,IAAI,CAACC,SAAS,IAAIA,SAAS,CAACX,OAAO,CAACY,IAAI,CAACJ,QAAQ,CAAC,CAAC;EACtE,MAAMV,IAAI,GAAGW,IAAI,EAAEX,IAAI,IAAI,0BAA0B;EACrD,OAAO,IAAIF,SAAS,CAAC;IACpBE,IAAI;IACJC,UAAU,EAAEU,IAAI,EAAEV,UAAU,IAAI,kBAAkB;IAClDc,QAAQ,EAAEf,IAAI,KAAK,mBAAmB,GAAG,WAAW,GAAG,MAAM;IAC7D;IACAgB,MAAM,EAAEV;EACT,CAAC,CAAC;AACH","ignoreList":[]}

package/lib/module/oidc/socialRouting.js

@@ -0,0 +1,52 @@
+"use strict";
+
+/**
+ * Social provider routing (FR-002/FR-003, R3). Google and Apple are federated
+ * inside the External ID tenant; the app presents the platform-correct action
+ * and starts the user flow with a per-provider `domain_hint`.
+ */
+
+import { AuthConfigError } from "../diagnostics/errors.js";
+
+/** Find the configured provider, ensuring it is enabled for the platform. */
+export function resolveProvider(config, providerId, platform) {
+  const provider = config.providers.find(candidate => candidate.id === providerId);
+  if (!provider) {
+    throw new AuthConfigError('auth.error.configuration', `Provider "${providerId}" is not configured`);
+  }
+  if (!provider.platforms.includes(platform)) {
+    throw new AuthConfigError('auth.error.configuration', `Provider "${providerId}" is not enabled for platform "${platform}"`);
+  }
+  if (provider.available === false) {
+    throw new AuthConfigError('auth.error.configuration', `Provider "${providerId}" is marked unavailable`);
+  }
+  return provider;
+}
+
+/** Build the OIDC additional parameters that route to the chosen IdP. */
+export function buildAdditionalParameters(provider) {
+  // The routing hint last: a provider's own parameters cannot redirect the flow
+  // to a different IdP than the one the user tapped.
+  return {
+    ...provider.additionalParameters,
+    domain_hint: provider.domainHint
+  };
+}
+
+/**
+ * All providers to present on a given platform, in configuration array order
+ * (FR-003/FR-004). Filtered to providers enabled for the platform and not marked
+ * unavailable.
+ */
+export function availableProvidersForPlatform(config, platform) {
+  return config.providers.filter(provider => provider.platforms.includes(platform) && provider.available !== false);
+}
+
+/**
+ * The first available provider for a platform (UX-004, back-compat). Equals
+ * `availableProvidersForPlatform(config, platform)[0]`.
+ */
+export function defaultProviderForPlatform(config, platform) {
+  return availableProvidersForPlatform(config, platform)[0];
+}
+//# sourceMappingURL=socialRouting.js.map

package/lib/module/oidc/socialRouting.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["AuthConfigError","resolveProvider","config","providerId","platform","provider","providers","find","candidate","id","platforms","includes","available","buildAdditionalParameters","additionalParameters","domain_hint","domainHint","availableProvidersForPlatform","filter","defaultProviderForPlatform"],"sourceRoot":"../../../src","sources":["oidc/socialRouting.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;;AAGA,SAASA,eAAe,QAAQ,0BAAuB;;AAEvD;AACA,OAAO,SAASC,eAAeA,CAC9BC,MAAkB,EAClBC,UAAsB,EACtBC,QAAwB,EACP;EACjB,MAAMC,QAAQ,GAAGH,MAAM,CAACI,SAAS,CAACC,IAAI,CAACC,SAAS,IAAIA,SAAS,CAACC,EAAE,KAAKN,UAAU,CAAC;EAChF,IAAI,CAACE,QAAQ,EAAE;IACd,MAAM,IAAIL,eAAe,CACxB,0BAA0B,EAC1B,aAAaG,UAAU,qBACxB,CAAC;EACF;EACA,IAAI,CAACE,QAAQ,CAACK,SAAS,CAACC,QAAQ,CAACP,QAAQ,CAAC,EAAE;IAC3C,MAAM,IAAIJ,eAAe,CACxB,0BAA0B,EAC1B,aAAaG,UAAU,kCAAkCC,QAAQ,GAClE,CAAC;EACF;EACA,IAAIC,QAAQ,CAACO,SAAS,KAAK,KAAK,EAAE;IACjC,MAAM,IAAIZ,eAAe,CACxB,0BAA0B,EAC1B,aAAaG,UAAU,yBACxB,CAAC;EACF;EACA,OAAOE,QAAQ;AAChB;;AAEA;AACA,OAAO,SAASQ,yBAAyBA,CAACR,QAAwB,EAA0B;EAC3F;EACA;EACA,OAAO;IAAE,GAAGA,QAAQ,CAACS,oBAAoB;IAAEC,WAAW,EAAEV,QAAQ,CAACW;EAAW,CAAC;AAC9E;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,6BAA6BA,CAC5Cf,MAAkB,EAClBE,QAAwB,EACL;EACnB,OAAOF,MAAM,CAACI,SAAS,CAACY,MAAM,CAC7Bb,QAAQ,IAAIA,QAAQ,CAACK,SAAS,CAACC,QAAQ,CAACP,QAAQ,CAAC,IAAIC,QAAQ,CAACO,SAAS,KAAK,KAC7E,CAAC;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASO,0BAA0BA,CACzCjB,MAAkB,EAClBE,QAAwB,EACK;EAC7B,OAAOa,6BAA6B,CAACf,MAAM,EAAEE,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC1D","ignoreList":[]}

package/lib/module/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/module/react/AuthProvider.js

@@ -0,0 +1,31 @@
+"use strict";
+
+/**
+ * React context boundary for the auth controller (LIB-002).
+ *
+ * The context carries the controller only, never its state: a context value that
+ * changed on every transition re-rendered every consumer on every transition
+ * (PERF-02). Hooks read the state through `useSyncExternalStore` with a selector,
+ * so a component re-renders only when the part it reads changes.
+ */
+
+import React, { createContext, useContext } from 'react';
+import { jsx as _jsx } from "react/jsx-runtime";
+const AuthContext = /*#__PURE__*/createContext(null);
+export function AuthProvider({
+  auth,
+  children
+}) {
+  return /*#__PURE__*/_jsx(AuthContext.Provider, {
+    value: auth,
+    children: children
+  });
+}
+export function useAuthInstance() {
+  const auth = useContext(AuthContext);
+  if (!auth) {
+    throw new Error('useAuth must be used within an <AuthProvider>.');
+  }
+  return auth;
+}
+//# sourceMappingURL=AuthProvider.js.map

package/lib/module/react/AuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["React","createContext","useContext","jsx","_jsx","AuthContext","AuthProvider","auth","children","Provider","value","useAuthInstance","Error"],"sourceRoot":"../../../src","sources":["react/AuthProvider.tsx"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAOA,KAAK,IAAIC,aAAa,EAAEC,UAAU,QAAQ,OAAO;AAAC,SAAAC,GAAA,IAAAC,IAAA;AAGzD,MAAMC,WAAW,gBAAGJ,aAAa,CAAc,IAAI,CAAC;AAOpD,OAAO,SAASK,YAAYA,CAAC;EAAEC,IAAI;EAAEC;AAA4B,CAAC,EAAE;EACnE,oBAAOJ,IAAA,CAACC,WAAW,CAACI,QAAQ;IAACC,KAAK,EAAEH,IAAK;IAAAC,QAAA,EAAEA;EAAQ,CAAuB,CAAC;AAC5E;AAEA,OAAO,SAASG,eAAeA,CAAA,EAAS;EACvC,MAAMJ,IAAI,GAAGL,UAAU,CAACG,WAAW,CAAC;EACpC,IAAI,CAACE,IAAI,EAAE;IACV,MAAM,IAAIK,KAAK,CAAC,gDAAgD,CAAC;EAClE;EACA,OAAOL,IAAI;AACZ","ignoreList":[]}

package/lib/module/react/hooks.js

@@ -0,0 +1,111 @@
+"use strict";
+
+/**
+ * Public hooks (LIB-002). Each reads the controller's state through
+ * `useSyncExternalStore` (rn-core's `useExternalStore`), selecting only what it
+ * returns, so `useProfile` does not re-render when only the status changes.
+ */
+
+import { useExternalStore } from '@chipmobilesdk/rn-core/react';
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { useAuthInstance } from "./AuthProvider.js";
+import { failClosedTier } from "../access/accessTier.js";
+/**
+ * Any slice of the auth state; the component re-renders only when the slice
+ * changes by `isEqual` (default `Object.is`).
+ */
+export function useAuthSelector(select, isEqual) {
+  const auth = useAuthInstance();
+  return useExternalStore(auth.subscribe, auth.getState, select, isEqual);
+}
+const selectState = state => state;
+const selectProfile = state => state.profile;
+const selectAccessTier = state => state.accessTier;
+export function useAuth() {
+  const auth = useAuthInstance();
+  const state = useAuthSelector(selectState);
+  return {
+    state,
+    signIn: useCallback(providerId => auth.signIn(providerId), [auth]),
+    signOut: useCallback(() => auth.signOut(), [auth]),
+    signOutGlobal: useCallback(() => auth.signOutGlobal(), [auth]),
+    restore: useCallback(() => auth.restore(), [auth]),
+    canAccessPremium: useCallback(() => auth.canAccessPremium(), [auth]),
+    requirePremium: useCallback(() => auth.requirePremium(), [auth])
+  };
+}
+
+/** This package's copy, with the app's `messages` overrides applied. */
+export function useAuthMessages() {
+  return useAuthInstance().getMessages();
+}
+export function useProfile() {
+  return useAuthSelector(selectProfile);
+}
+export function useAccessTier() {
+  return useAuthSelector(selectAccessTier) ?? failClosedTier();
+}
+
+/** The first provider to present on the current platform (UX-004), or undefined. */
+export function useSignInProvider() {
+  const auth = useAuthInstance();
+  return auth.getPlatformProvider();
+}
+
+/** All available providers for the current platform, in configuration order (FR-003/FR-004). */
+export function useSignInProviders() {
+  const auth = useAuthInstance();
+  return auth.getPlatformProviders();
+}
+export function useAccessToken(resourceKey) {
+  const auth = useAuthInstance();
+  const [state, setState] = useState({
+    status: 'idle',
+    resourceKey
+  });
+
+  // Which request may still write. A result for a resource the component has
+  // moved on from, or for an unmounted one, is dropped rather than applied
+  // (AUTH-17, standard VII).
+  const live = useRef(0);
+  useEffect(() => () => {
+    live.current += 1;
+  }, []);
+  const request = useCallback(async options => {
+    live.current += 1;
+    const id = live.current;
+    setState({
+      status: 'loading',
+      resourceKey
+    });
+    const result = await auth.requestAccessToken(resourceKey, options);
+    if (id === live.current) {
+      setState({
+        status: result.status,
+        token: result.token,
+        resourceKey
+      });
+    }
+    return result;
+  }, [auth, resourceKey]);
+
+  // A new resource starts from `idle`, not from the previous resource's token.
+  if (state.resourceKey !== resourceKey) {
+    live.current += 1;
+    setState({
+      status: 'idle',
+      resourceKey
+    });
+    return {
+      status: 'idle',
+      token: undefined,
+      request
+    };
+  }
+  return {
+    status: state.status,
+    token: state.token,
+    request
+  };
+}
+//# sourceMappingURL=hooks.js.map

package/lib/module/react/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["useExternalStore","useCallback","useEffect","useRef","useState","useAuthInstance","failClosedTier","useAuthSelector","select","isEqual","auth","subscribe","getState","selectState","state","selectProfile","profile","selectAccessTier","accessTier","useAuth","signIn","providerId","signOut","signOutGlobal","restore","canAccessPremium","requirePremium","useAuthMessages","getMessages","useProfile","useAccessTier","useSignInProvider","getPlatformProvider","useSignInProviders","getPlatformProviders","useAccessToken","resourceKey","setState","status","live","current","request","options","id","result","requestAccessToken","token","undefined"],"sourceRoot":"../../../src","sources":["react/hooks.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;;AAEA,SAASA,gBAAgB,QAAQ,8BAA8B;AAC/D,SAASC,WAAW,EAAEC,SAAS,EAAEC,MAAM,EAAEC,QAAQ,QAAQ,OAAO;AAChE,SAASC,eAAe,QAAQ,mBAAgB;AAWhD,SAASC,cAAc,QAAQ,yBAAsB;AAgBrD;AACA;AACA;AACA;AACA,OAAO,SAASC,eAAeA,CAC9BC,MAAsC,EACtCC,OAA+C,EACpC;EACX,MAAMC,IAAI,GAAGL,eAAe,CAAC,CAAC;EAC9B,OAAOL,gBAAgB,CAACU,IAAI,CAACC,SAAS,EAAED,IAAI,CAACE,QAAQ,EAAEJ,MAAM,EAAEC,OAAO,CAAC;AACxE;AAEA,MAAMI,WAAW,GAAIC,KAAgB,IAAKA,KAAK;AAC/C,MAAMC,aAAa,GAAID,KAAgB,IAAKA,KAAK,CAACE,OAAO;AACzD,MAAMC,gBAAgB,GAAIH,KAAgB,IAAKA,KAAK,CAACI,UAAU;AAE/D,OAAO,SAASC,OAAOA,CAAA,EAAkB;EACxC,MAAMT,IAAI,GAAGL,eAAe,CAAC,CAAC;EAC9B,MAAMS,KAAK,GAAGP,eAAe,CAACM,WAAW,CAAC;EAC1C,OAAO;IACNC,KAAK;IACLM,MAAM,EAAEnB,WAAW,CAAEoB,UAAsB,IAAKX,IAAI,CAACU,MAAM,CAACC,UAAU,CAAC,EAAE,CAACX,IAAI,CAAC,CAAC;IAChFY,OAAO,EAAErB,WAAW,CAAC,MAAMS,IAAI,CAACY,OAAO,CAAC,CAAC,EAAE,CAACZ,IAAI,CAAC,CAAC;IAClDa,aAAa,EAAEtB,WAAW,CAAC,MAAMS,IAAI,CAACa,aAAa,CAAC,CAAC,EAAE,CAACb,IAAI,CAAC,CAAC;IAC9Dc,OAAO,EAAEvB,WAAW,CAAC,MAAMS,IAAI,CAACc,OAAO,CAAC,CAAC,EAAE,CAACd,IAAI,CAAC,CAAC;IAClDe,gBAAgB,EAAExB,WAAW,CAAC,MAAMS,IAAI,CAACe,gBAAgB,CAAC,CAAC,EAAE,CAACf,IAAI,CAAC,CAAC;IACpEgB,cAAc,EAAEzB,WAAW,CAAC,MAAMS,IAAI,CAACgB,cAAc,CAAC,CAAC,EAAE,CAAChB,IAAI,CAAC;EAChE,CAAC;AACF;;AAEA;AACA,OAAO,SAASiB,eAAeA,CAAA,EAAmB;EACjD,OAAOtB,eAAe,CAAC,CAAC,CAACuB,WAAW,CAAC,CAAC;AACvC;AAEA,OAAO,SAASC,UAAUA,CAAA,EAAwB;EACjD,OAAOtB,eAAe,CAACQ,aAAa,CAAC;AACtC;AAEA,OAAO,SAASe,aAAaA,CAAA,EAAe;EAC3C,OAAOvB,eAAe,CAACU,gBAAgB,CAAC,IAAIX,cAAc,CAAC,CAAC;AAC7D;;AAEA;AACA,OAAO,SAASyB,iBAAiBA,CAAA,EAA+B;EAC/D,MAAMrB,IAAI,GAAGL,eAAe,CAAC,CAAC;EAC9B,OAAOK,IAAI,CAACsB,mBAAmB,CAAC,CAAC;AAClC;;AAEA;AACA,OAAO,SAASC,kBAAkBA,CAAA,EAAqB;EACtD,MAAMvB,IAAI,GAAGL,eAAe,CAAC,CAAC;EAC9B,OAAOK,IAAI,CAACwB,oBAAoB,CAAC,CAAC;AACnC;AAYA,OAAO,SAASC,cAAcA,CAACC,WAAmB,EAAwB;EACzE,MAAM1B,IAAI,GAAGL,eAAe,CAAC,CAAC;EAC9B,MAAM,CAACS,KAAK,EAAEuB,QAAQ,CAAC,GAAGjC,QAAQ,CAI/B;IAAEkC,MAAM,EAAE,MAAM;IAAEF;EAAY,CAAC,CAAC;;EAEnC;EACA;EACA;EACA,MAAMG,IAAI,GAAGpC,MAAM,CAAC,CAAC,CAAC;EACtBD,SAAS,CACR,MAAM,MAAM;IACXqC,IAAI,CAACC,OAAO,IAAI,CAAC;EAClB,CAAC,EACD,EACD,CAAC;EAED,MAAMC,OAAO,GAAGxC,WAAW,CAC1B,MAAOyC,OAAmC,IAAK;IAC9CH,IAAI,CAACC,OAAO,IAAI,CAAC;IACjB,MAAMG,EAAE,GAAGJ,IAAI,CAACC,OAAO;IACvBH,QAAQ,CAAC;MAAEC,MAAM,EAAE,SAAS;MAAEF;IAAY,CAAC,CAAC;IAC5C,MAAMQ,MAAM,GAAG,MAAMlC,IAAI,CAACmC,kBAAkB,CAACT,WAAW,EAAEM,OAAO,CAAC;IAClE,IAAIC,EAAE,KAAKJ,IAAI,CAACC,OAAO,EAAE;MACxBH,QAAQ,CAAC;QAAEC,MAAM,EAAEM,MAAM,CAACN,MAAM;QAAEQ,KAAK,EAAEF,MAAM,CAACE,KAAK;QAAEV;MAAY,CAAC,CAAC;IACtE;IACA,OAAOQ,MAAM;EACd,CAAC,EACD,CAAClC,IAAI,EAAE0B,WAAW,CACnB,CAAC;;EAED;EACA,IAAItB,KAAK,CAACsB,WAAW,KAAKA,WAAW,EAAE;IACtCG,IAAI,CAACC,OAAO,IAAI,CAAC;IACjBH,QAAQ,CAAC;MAAEC,MAAM,EAAE,MAAM;MAAEF;IAAY,CAAC,CAAC;IACzC,OAAO;MAAEE,MAAM,EAAE,MAAM;MAAEQ,KAAK,EAAEC,SAAS;MAAEN;IAAQ,CAAC;EACrD;EAEA,OAAO;IAAEH,MAAM,EAAExB,KAAK,CAACwB,MAAM;IAAEQ,KAAK,EAAEhC,KAAK,CAACgC,KAAK;IAAEL;EAAQ,CAAC;AAC7D","ignoreList":[]}