@chipmobilesdk/rn-auth 0.4.0 → 0.6.0

package/lib/module/testing/conformance.js

@@ -0,0 +1,140 @@
+"use strict";
+
+/**
+ * What any `SecureTokenStore` and `OidcAuthClient` must do (IOS-12, AUTH-13).
+ *
+ * The same checks run against the in-memory doubles and against the keychain and
+ * app-auth adapters (native modules mocked in Jest, or for real from a demo
+ * screen on a device), so a test that drives a double proves something about the
+ * device path. Each check builds its own subject through a harness.
+ */
+import { ensure, runChecks } from '@chipmobilesdk/rn-core/testing';
+const KEY = '@chipmobilesdk/rn-auth/conformance';
+const OTHER_KEY = '@chipmobilesdk/rn-auth/conformance-other';
+export const secureTokenStoreChecks = [{
+  name: 'reads nothing for a key never written',
+  async run(harness) {
+    const value = await harness.create().getItem(KEY);
+    ensure(value === null, `expected null, got ${JSON.stringify(value)}`);
+  }
+}, {
+  name: 'reads back the last value written',
+  async run(harness) {
+    const store = harness.create();
+    await store.setItem(KEY, 'first');
+    await store.setItem(KEY, 'second');
+    const value = await store.getItem(KEY);
+    ensure(value === 'second', `expected the last write, got ${JSON.stringify(value)}`);
+  }
+}, {
+  name: 'keeps keys apart',
+  async run(harness) {
+    const store = harness.create();
+    await store.setItem(KEY, 'one');
+    await store.setItem(OTHER_KEY, 'two');
+    await store.removeItem(OTHER_KEY);
+    ensure((await store.getItem(KEY)) === 'one', 'removing one key touched another');
+  }
+}, {
+  name: 'forgets a removed key, and removes a missing key safely',
+  async run(harness) {
+    const store = harness.create();
+    await store.removeItem(KEY);
+    await store.setItem(KEY, 'value');
+    await store.removeItem(KEY);
+    ensure((await store.getItem(KEY)) === null, 'a removed key still reads back');
+  }
+}, {
+  name: 'keeps a long session artifact with non-ASCII text intact',
+  async run(harness) {
+    const store = harness.create();
+    const artifact = JSON.stringify({
+      name: 'Nguyễn Ánh',
+      pad: 'x'.repeat(4096)
+    });
+    await store.setItem(KEY, artifact);
+    ensure((await store.getItem(KEY)) === artifact, 'the artifact changed on the way back');
+  }
+}];
+const SIGN_IN = {
+  authority: 'https://login.example.com/tenant/v2.0',
+  clientId: 'conformance-client',
+  redirectUrl: 'com.example.app://auth',
+  scopes: ['openid', 'offline_access']
+};
+function codeOf(error) {
+  return error?.code;
+}
+export const oidcAuthClientChecks = [{
+  name: 'signs in with an access token, the id-token claims and a future expiry',
+  async run(harness) {
+    const subject = harness.create();
+    subject.issues({
+      oid: 'user-1',
+      name: 'Ada'
+    });
+    const before = Date.now();
+    const tokens = await subject.client.authorize(SIGN_IN);
+    ensure(typeof tokens.accessToken === 'string' && tokens.accessToken !== '', 'no access token');
+    ensure(tokens.claims.oid === 'user-1', `claims ${JSON.stringify(tokens.claims)}`);
+    ensure(tokens.accessTokenExpiresAt === undefined || tokens.accessTokenExpiresAt > before, 'the access token expires in the past');
+  }
+}, {
+  name: 'refreshes with a refresh token',
+  async run(harness) {
+    const subject = harness.create();
+    subject.issues({
+      oid: 'user-1'
+    });
+    const tokens = await subject.client.refresh({
+      ...SIGN_IN,
+      refreshToken: 'refresh-1'
+    });
+    ensure(typeof tokens.accessToken === 'string' && tokens.accessToken !== '', 'no access token');
+  }
+}, {
+  name: 'reports a closed sign-in sheet as provider-cancelled',
+  async run(harness) {
+    const subject = harness.create();
+    subject.userCancels();
+    let code;
+    try {
+      await subject.client.authorize(SIGN_IN);
+    } catch (error) {
+      code = codeOf(error);
+    }
+    ensure(code === 'provider-cancelled', `expected provider-cancelled, got ${String(code)}`);
+  }
+}, {
+  name: 'reports a rejected refresh token as session-expired',
+  async run(harness) {
+    const subject = harness.create();
+    subject.rejectsRefresh();
+    let code;
+    try {
+      await subject.client.refresh({
+        ...SIGN_IN,
+        refreshToken: 'revoked'
+      });
+    } catch (error) {
+      code = codeOf(error);
+    }
+    ensure(code === 'session-expired', `expected session-expired, got ${String(code)}`);
+  }
+}, {
+  name: 'ends the session',
+  async run(harness) {
+    const subject = harness.create();
+    await subject.client.endSession({
+      ...SIGN_IN,
+      idToken: undefined
+    });
+  }
+}];
+export function runSecureTokenStoreConformance(harness) {
+  return runChecks(() => harness, secureTokenStoreChecks);
+}
+export function runOidcAuthClientConformance(harness) {
+  return runChecks(() => harness, oidcAuthClientChecks);
+}
+//# sourceMappingURL=conformance.js.map

package/lib/module/testing/conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ensure","runChecks","KEY","OTHER_KEY","secureTokenStoreChecks","name","run","harness","value","create","getItem","JSON","stringify","store","setItem","removeItem","artifact","pad","repeat","SIGN_IN","authority","clientId","redirectUrl","scopes","codeOf","error","code","oidcAuthClientChecks","subject","issues","oid","before","Date","now","tokens","client","authorize","accessToken","claims","accessTokenExpiresAt","undefined","refresh","refreshToken","userCancels","String","rejectsRefresh","endSession","idToken","runSecureTokenStoreConformance","runOidcAuthClientConformance"],"sourceRoot":"../../../src","sources":["testing/conformance.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SACCA,MAAM,EACNC,SAAS,QAGH,gCAAgC;AAwBvC,MAAMC,GAAG,GAAG,oCAAoC;AAChD,MAAMC,SAAS,GAAG,0CAA0C;AAE5D,OAAO,MAAMC,sBAA4D,GAAG,CAC3E;EACCC,IAAI,EAAE,uCAAuC;EAC7C,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMC,KAAK,GAAG,MAAMD,OAAO,CAACE,MAAM,CAAC,CAAC,CAACC,OAAO,CAACR,GAAG,CAAC;IACjDF,MAAM,CAACQ,KAAK,KAAK,IAAI,EAAE,sBAAsBG,IAAI,CAACC,SAAS,CAACJ,KAAK,CAAC,EAAE,CAAC;EACtE;AACD,CAAC,EACD;EACCH,IAAI,EAAE,mCAAmC;EACzC,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMM,KAAK,GAAGN,OAAO,CAACE,MAAM,CAAC,CAAC;IAC9B,MAAMI,KAAK,CAACC,OAAO,CAACZ,GAAG,EAAE,OAAO,CAAC;IACjC,MAAMW,KAAK,CAACC,OAAO,CAACZ,GAAG,EAAE,QAAQ,CAAC;IAClC,MAAMM,KAAK,GAAG,MAAMK,KAAK,CAACH,OAAO,CAACR,GAAG,CAAC;IACtCF,MAAM,CAACQ,KAAK,KAAK,QAAQ,EAAE,gCAAgCG,IAAI,CAACC,SAAS,CAACJ,KAAK,CAAC,EAAE,CAAC;EACpF;AACD,CAAC,EACD;EACCH,IAAI,EAAE,kBAAkB;EACxB,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMM,KAAK,GAAGN,OAAO,CAACE,MAAM,CAAC,CAAC;IAC9B,MAAMI,KAAK,CAACC,OAAO,CAACZ,GAAG,EAAE,KAAK,CAAC;IAC/B,MAAMW,KAAK,CAACC,OAAO,CAACX,SAAS,EAAE,KAAK,CAAC;IACrC,MAAMU,KAAK,CAACE,UAAU,CAACZ,SAAS,CAAC;IACjCH,MAAM,CAAC,CAAC,MAAMa,KAAK,CAACH,OAAO,CAACR,GAAG,CAAC,MAAM,KAAK,EAAE,kCAAkC,CAAC;EACjF;AACD,CAAC,EACD;EACCG,IAAI,EAAE,yDAAyD;EAC/D,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMM,KAAK,GAAGN,OAAO,CAACE,MAAM,CAAC,CAAC;IAC9B,MAAMI,KAAK,CAACE,UAAU,CAACb,GAAG,CAAC;IAC3B,MAAMW,KAAK,CAACC,OAAO,CAACZ,GAAG,EAAE,OAAO,CAAC;IACjC,MAAMW,KAAK,CAACE,UAAU,CAACb,GAAG,CAAC;IAC3BF,MAAM,CAAC,CAAC,MAAMa,KAAK,CAACH,OAAO,CAACR,GAAG,CAAC,MAAM,IAAI,EAAE,gCAAgC,CAAC;EAC9E;AACD,CAAC,EACD;EACCG,IAAI,EAAE,0DAA0D;EAChE,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMM,KAAK,GAAGN,OAAO,CAACE,MAAM,CAAC,CAAC;IAC9B,MAAMO,QAAQ,GAAGL,IAAI,CAACC,SAAS,CAAC;MAAEP,IAAI,EAAE,YAAY;MAAEY,GAAG,EAAE,GAAG,CAACC,MAAM,CAAC,IAAI;IAAE,CAAC,CAAC;IAC9E,MAAML,KAAK,CAACC,OAAO,CAACZ,GAAG,EAAEc,QAAQ,CAAC;IAClChB,MAAM,CAAC,CAAC,MAAMa,KAAK,CAACH,OAAO,CAACR,GAAG,CAAC,MAAMc,QAAQ,EAAE,sCAAsC,CAAC;EACxF;AACD,CAAC,CACD;AAED,MAAMG,OAAO,GAAG;EACfC,SAAS,EAAE,uCAAuC;EAClDC,QAAQ,EAAE,oBAAoB;EAC9BC,WAAW,EAAE,wBAAwB;EACrCC,MAAM,EAAE,CAAC,QAAQ,EAAE,gBAAgB;AACpC,CAAC;AAED,SAASC,MAAMA,CAACC,KAAc,EAAW;EACxC,OAAQA,KAAK,EAAgCC,IAAI;AAClD;AAEA,OAAO,MAAMC,oBAAmD,GAAG,CAClE;EACCtB,IAAI,EAAE,wEAAwE;EAC9E,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMqB,OAAO,GAAGrB,OAAO,CAACE,MAAM,CAAC,CAAC;IAChCmB,OAAO,CAACC,MAAM,CAAC;MAAEC,GAAG,EAAE,QAAQ;MAAEzB,IAAI,EAAE;IAAM,CAAC,CAAC;IAC9C,MAAM0B,MAAM,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC;IACzB,MAAMC,MAAM,GAAG,MAAMN,OAAO,CAACO,MAAM,CAACC,SAAS,CAACjB,OAAO,CAAC;IACtDnB,MAAM,CACL,OAAOkC,MAAM,CAACG,WAAW,KAAK,QAAQ,IAAIH,MAAM,CAACG,WAAW,KAAK,EAAE,EACnE,iBACD,CAAC;IACDrC,MAAM,CAACkC,MAAM,CAACI,MAAM,CAACR,GAAG,KAAK,QAAQ,EAAE,UAAUnB,IAAI,CAACC,SAAS,CAACsB,MAAM,CAACI,MAAM,CAAC,EAAE,CAAC;IACjFtC,MAAM,CACLkC,MAAM,CAACK,oBAAoB,KAAKC,SAAS,IAAIN,MAAM,CAACK,oBAAoB,GAAGR,MAAM,EACjF,sCACD,CAAC;EACF;AACD,CAAC,EACD;EACC1B,IAAI,EAAE,gCAAgC;EACtC,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMqB,OAAO,GAAGrB,OAAO,CAACE,MAAM,CAAC,CAAC;IAChCmB,OAAO,CAACC,MAAM,CAAC;MAAEC,GAAG,EAAE;IAAS,CAAC,CAAC;IACjC,MAAMI,MAAM,GAAG,MAAMN,OAAO,CAACO,MAAM,CAACM,OAAO,CAAC;MAAE,GAAGtB,OAAO;MAAEuB,YAAY,EAAE;IAAY,CAAC,CAAC;IACtF1C,MAAM,CACL,OAAOkC,MAAM,CAACG,WAAW,KAAK,QAAQ,IAAIH,MAAM,CAACG,WAAW,KAAK,EAAE,EACnE,iBACD,CAAC;EACF;AACD,CAAC,EACD;EACChC,IAAI,EAAE,sDAAsD;EAC5D,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMqB,OAAO,GAAGrB,OAAO,CAACE,MAAM,CAAC,CAAC;IAChCmB,OAAO,CAACe,WAAW,CAAC,CAAC;IACrB,IAAIjB,IAAa;IACjB,IAAI;MACH,MAAME,OAAO,CAACO,MAAM,CAACC,SAAS,CAACjB,OAAO,CAAC;IACxC,CAAC,CAAC,OAAOM,KAAK,EAAE;MACfC,IAAI,GAAGF,MAAM,CAACC,KAAK,CAAC;IACrB;IACAzB,MAAM,CAAC0B,IAAI,KAAK,oBAAoB,EAAE,oCAAoCkB,MAAM,CAAClB,IAAI,CAAC,EAAE,CAAC;EAC1F;AACD,CAAC,EACD;EACCrB,IAAI,EAAE,qDAAqD;EAC3D,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMqB,OAAO,GAAGrB,OAAO,CAACE,MAAM,CAAC,CAAC;IAChCmB,OAAO,CAACiB,cAAc,CAAC,CAAC;IACxB,IAAInB,IAAa;IACjB,IAAI;MACH,MAAME,OAAO,CAACO,MAAM,CAACM,OAAO,CAAC;QAAE,GAAGtB,OAAO;QAAEuB,YAAY,EAAE;MAAU,CAAC,CAAC;IACtE,CAAC,CAAC,OAAOjB,KAAK,EAAE;MACfC,IAAI,GAAGF,MAAM,CAACC,KAAK,CAAC;IACrB;IACAzB,MAAM,CAAC0B,IAAI,KAAK,iBAAiB,EAAE,iCAAiCkB,MAAM,CAAClB,IAAI,CAAC,EAAE,CAAC;EACpF;AACD,CAAC,EACD;EACCrB,IAAI,EAAE,kBAAkB;EACxB,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMqB,OAAO,GAAGrB,OAAO,CAACE,MAAM,CAAC,CAAC;IAChC,MAAMmB,OAAO,CAACO,MAAM,CAACW,UAAU,CAAC;MAAE,GAAG3B,OAAO;MAAE4B,OAAO,EAAEP;IAAU,CAAC,CAAC;EACpE;AACD,CAAC,CACD;AAED,OAAO,SAASQ,8BAA8BA,CAC7CzC,OAA2B,EACE;EAC7B,OAAON,SAAS,CAAC,MAAMM,OAAO,EAAEH,sBAAsB,CAAC;AACxD;AAEA,OAAO,SAAS6C,4BAA4BA,CAAC1C,OAAoB,EAA8B;EAC9F,OAAON,SAAS,CAAC,MAAMM,OAAO,EAAEoB,oBAAoB,CAAC;AACtD","ignoreList":[]}

package/lib/module/testing/index.js

@@ -0,0 +1,25 @@
+"use strict";
+
+/**
+ * `@chipmobilesdk/rn-auth/testing`: test doubles and the port conformance suites.
+ *
+ * A separate entrypoint so neither can reach a production bundle.
+ */
+
+/** A `SecureTokenStore` held in memory, for tests and for the conformance suite. */
+export function createMemorySecureStore(seed = {}) {
+  const values = new Map(Object.entries(seed));
+  return {
+    async getItem(key) {
+      return values.get(key) ?? null;
+    },
+    async setItem(key, value) {
+      values.set(key, value);
+    },
+    async removeItem(key) {
+      values.delete(key);
+    }
+  };
+}
+export { oidcAuthClientChecks, runOidcAuthClientConformance, runSecureTokenStoreConformance, secureTokenStoreChecks } from "./conformance.js";
+//# sourceMappingURL=index.js.map

package/lib/module/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createMemorySecureStore","seed","values","Map","Object","entries","getItem","key","get","setItem","value","set","removeItem","delete","oidcAuthClientChecks","runOidcAuthClientConformance","runSecureTokenStoreConformance","secureTokenStoreChecks"],"sourceRoot":"../../../src","sources":["testing/index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;;AAGA;AACA,OAAO,SAASA,uBAAuBA,CAACC,IAA4B,GAAG,CAAC,CAAC,EAAoB;EAC5F,MAAMC,MAAM,GAAG,IAAIC,GAAG,CAAiBC,MAAM,CAACC,OAAO,CAACJ,IAAI,CAAC,CAAC;EAC5D,OAAO;IACN,MAAMK,OAAOA,CAACC,GAAG,EAAE;MAClB,OAAOL,MAAM,CAACM,GAAG,CAACD,GAAG,CAAC,IAAI,IAAI;IAC/B,CAAC;IACD,MAAME,OAAOA,CAACF,GAAG,EAAEG,KAAK,EAAE;MACzBR,MAAM,CAACS,GAAG,CAACJ,GAAG,EAAEG,KAAK,CAAC;IACvB,CAAC;IACD,MAAME,UAAUA,CAACL,GAAG,EAAE;MACrBL,MAAM,CAACW,MAAM,CAACN,GAAG,CAAC;IACnB;EACD,CAAC;AACF;AAEA,SACCO,oBAAoB,EACpBC,4BAA4B,EAC5BC,8BAA8B,EAC9BC,sBAAsB,QAChB,kBAAe","ignoreList":[]}

package/lib/module/tokens/accessToken.js

@@ -0,0 +1,161 @@
+"use strict";
+
+/**
+ * Per-resource delegated access-token acquisition with an in-memory cache and
+ * silent refresh (FR-007, PERF-003, R4). Access tokens are never persisted to
+ * disk (FR-021) — only kept in memory keyed by resource until expiry.
+ */
+
+import { isAuthError } from "../diagnostics/errors.js";
+const EXPIRY_SKEW_MS = 60_000;
+const SESSION_ENDED = {
+  status: 'unavailable',
+  errorCode: 'session-expired'
+};
+export function createAccessTokenManager(deps) {
+  const cache = new Map();
+  /**
+   * Refreshes in progress, by resource. Concurrent callers for one resource
+   * share a single network call; with a rotating refresh token, a second call
+   * would race the first with a token the first may have just retired.
+   */
+  const inFlight = new Map();
+  const fresh = resourceKey => {
+    const cached = cache.get(resourceKey);
+    return cached && cached.expiresAt - EXPIRY_SKEW_MS > Date.now() ? cached : undefined;
+  };
+  const refresh = async resource => {
+    const resourceKey = resource.key;
+    const epoch = deps.sessionEpoch();
+    const refreshToken = deps.getRefreshToken();
+    if (!refreshToken) {
+      return {
+        resourceKey,
+        ...SESSION_ENDED
+      };
+    }
+    try {
+      const tokens = await deps.authClient.refresh({
+        authority: deps.authority,
+        clientId: deps.clientId,
+        redirectUrl: deps.redirectUrl,
+        refreshToken,
+        scopes: resource.scopes
+      });
+      // Signed out, or signed in as someone else, while this was in flight:
+      // nothing from it may be written back, and its token is not handed out.
+      if (deps.sessionEpoch() !== epoch) {
+        return {
+          resourceKey,
+          ...SESSION_ENDED
+        };
+      }
+      if (tokens.refreshToken && tokens.refreshToken !== refreshToken) {
+        await deps.onRefreshTokenRotated(tokens.refreshToken, epoch);
+        if (deps.sessionEpoch() !== epoch) {
+          return {
+            resourceKey,
+            ...SESSION_ENDED
+          };
+        }
+      }
+      if (!tokens.accessToken) {
+        return {
+          resourceKey,
+          status: 'error',
+          errorCode: 'token-acquisition-failed'
+        };
+      }
+      const expiresAt = tokens.accessTokenExpiresAt ?? Date.now() + 3_600_000;
+      cache.set(resourceKey, {
+        token: tokens.accessToken,
+        expiresAt
+      });
+      return {
+        resourceKey,
+        status: 'success',
+        token: tokens.accessToken,
+        expiresAt
+      };
+    } catch (error) {
+      if (isAuthError(error)) {
+        if (error.code === 'consent-denied') {
+          return {
+            resourceKey,
+            status: 'denied',
+            errorCode: error.code
+          };
+        }
+        if (error.code === 'network-unavailable') {
+          return {
+            resourceKey,
+            status: 'unavailable',
+            errorCode: error.code
+          };
+        }
+        if (error.code === 'session-expired') {
+          return {
+            resourceKey,
+            status: 'unavailable',
+            errorCode: error.code
+          };
+        }
+        return {
+          resourceKey,
+          status: 'error',
+          errorCode: error.code
+        };
+      }
+      return {
+        resourceKey,
+        status: 'error',
+        errorCode: 'token-acquisition-failed'
+      };
+    }
+  };
+  return {
+    clear() {
+      cache.clear();
+      inFlight.clear();
+    },
+    hasFreshToken(resourceKey) {
+      return fresh(resourceKey) !== undefined;
+    },
+    request(resourceKey, options = {}) {
+      const resource = deps.resources.find(entry => entry.key === resourceKey);
+      if (!resource) {
+        return Promise.resolve({
+          resourceKey,
+          status: 'error',
+          errorCode: 'configuration-error'
+        });
+      }
+      if (options.forceRefresh === true) {
+        // Dropped, not just skipped: the token is known bad, so no later
+        // caller should be handed it either.
+        cache.delete(resourceKey);
+      }
+      const cached = options.forceRefresh === true ? undefined : fresh(resourceKey);
+      if (cached) {
+        return Promise.resolve({
+          resourceKey,
+          status: 'success',
+          token: cached.token,
+          expiresAt: cached.expiresAt
+        });
+      }
+      const running = inFlight.get(resourceKey);
+      if (running) {
+        return running;
+      }
+      const flight = refresh(resource).finally(() => {
+        if (inFlight.get(resourceKey) === flight) {
+          inFlight.delete(resourceKey);
+        }
+      });
+      inFlight.set(resourceKey, flight);
+      return flight;
+    }
+  };
+}
+//# sourceMappingURL=accessToken.js.map

package/lib/module/tokens/accessToken.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["isAuthError","EXPIRY_SKEW_MS","SESSION_ENDED","status","errorCode","createAccessTokenManager","deps","cache","Map","inFlight","fresh","resourceKey","cached","get","expiresAt","Date","now","undefined","refresh","resource","key","epoch","sessionEpoch","refreshToken","getRefreshToken","tokens","authClient","authority","clientId","redirectUrl","scopes","onRefreshTokenRotated","accessToken","accessTokenExpiresAt","set","token","error","code","clear","hasFreshToken","request","options","resources","find","entry","Promise","resolve","forceRefresh","delete","running","flight","finally"],"sourceRoot":"../../../src","sources":["tokens/accessToken.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;;AAIA,SAASA,WAAW,QAAQ,0BAAuB;AAEnD,MAAMC,cAAc,GAAG,MAAM;AA8C7B,MAAMC,aAAqD,GAAG;EAC7DC,MAAM,EAAE,aAAa;EACrBC,SAAS,EAAE;AACZ,CAAC;AAED,OAAO,SAASC,wBAAwBA,CAACC,IAA4B,EAAsB;EAC1F,MAAMC,KAAK,GAAG,IAAIC,GAAG,CAAsB,CAAC;EAC5C;AACD;AACA;AACA;AACA;EACC,MAAMC,QAAQ,GAAG,IAAID,GAAG,CAAqC,CAAC;EAE9D,MAAME,KAAK,GAAIC,WAAmB,IAA8B;IAC/D,MAAMC,MAAM,GAAGL,KAAK,CAACM,GAAG,CAACF,WAAW,CAAC;IACrC,OAAOC,MAAM,IAAIA,MAAM,CAACE,SAAS,GAAGb,cAAc,GAAGc,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGJ,MAAM,GAAGK,SAAS;EACrF,CAAC;EAED,MAAMC,OAAO,GAAG,MAAOC,QAAwB,IAAiC;IAC/E,MAAMR,WAAW,GAAGQ,QAAQ,CAACC,GAAG;IAChC,MAAMC,KAAK,GAAGf,IAAI,CAACgB,YAAY,CAAC,CAAC;IACjC,MAAMC,YAAY,GAAGjB,IAAI,CAACkB,eAAe,CAAC,CAAC;IAC3C,IAAI,CAACD,YAAY,EAAE;MAClB,OAAO;QAAEZ,WAAW;QAAE,GAAGT;MAAc,CAAC;IACzC;IAEA,IAAI;MACH,MAAMuB,MAAM,GAAG,MAAMnB,IAAI,CAACoB,UAAU,CAACR,OAAO,CAAC;QAC5CS,SAAS,EAAErB,IAAI,CAACqB,SAAS;QACzBC,QAAQ,EAAEtB,IAAI,CAACsB,QAAQ;QACvBC,WAAW,EAAEvB,IAAI,CAACuB,WAAW;QAC7BN,YAAY;QACZO,MAAM,EAAEX,QAAQ,CAACW;MAClB,CAAC,CAAC;MACF;MACA;MACA,IAAIxB,IAAI,CAACgB,YAAY,CAAC,CAAC,KAAKD,KAAK,EAAE;QAClC,OAAO;UAAEV,WAAW;UAAE,GAAGT;QAAc,CAAC;MACzC;MACA,IAAIuB,MAAM,CAACF,YAAY,IAAIE,MAAM,CAACF,YAAY,KAAKA,YAAY,EAAE;QAChE,MAAMjB,IAAI,CAACyB,qBAAqB,CAACN,MAAM,CAACF,YAAY,EAAEF,KAAK,CAAC;QAC5D,IAAIf,IAAI,CAACgB,YAAY,CAAC,CAAC,KAAKD,KAAK,EAAE;UAClC,OAAO;YAAEV,WAAW;YAAE,GAAGT;UAAc,CAAC;QACzC;MACD;MACA,IAAI,CAACuB,MAAM,CAACO,WAAW,EAAE;QACxB,OAAO;UAAErB,WAAW;UAAER,MAAM,EAAE,OAAO;UAAEC,SAAS,EAAE;QAA2B,CAAC;MAC/E;MACA,MAAMU,SAAS,GAAGW,MAAM,CAACQ,oBAAoB,IAAIlB,IAAI,CAACC,GAAG,CAAC,CAAC,GAAG,SAAS;MACvET,KAAK,CAAC2B,GAAG,CAACvB,WAAW,EAAE;QAAEwB,KAAK,EAAEV,MAAM,CAACO,WAAW;QAAElB;MAAU,CAAC,CAAC;MAChE,OAAO;QAAEH,WAAW;QAAER,MAAM,EAAE,SAAS;QAAEgC,KAAK,EAAEV,MAAM,CAACO,WAAW;QAAElB;MAAU,CAAC;IAChF,CAAC,CAAC,OAAOsB,KAAK,EAAE;MACf,IAAIpC,WAAW,CAACoC,KAAK,CAAC,EAAE;QACvB,IAAIA,KAAK,CAACC,IAAI,KAAK,gBAAgB,EAAE;UACpC,OAAO;YAAE1B,WAAW;YAAER,MAAM,EAAE,QAAQ;YAAEC,SAAS,EAAEgC,KAAK,CAACC;UAAK,CAAC;QAChE;QACA,IAAID,KAAK,CAACC,IAAI,KAAK,qBAAqB,EAAE;UACzC,OAAO;YAAE1B,WAAW;YAAER,MAAM,EAAE,aAAa;YAAEC,SAAS,EAAEgC,KAAK,CAACC;UAAK,CAAC;QACrE;QACA,IAAID,KAAK,CAACC,IAAI,KAAK,iBAAiB,EAAE;UACrC,OAAO;YAAE1B,WAAW;YAAER,MAAM,EAAE,aAAa;YAAEC,SAAS,EAAEgC,KAAK,CAACC;UAAK,CAAC;QACrE;QACA,OAAO;UAAE1B,WAAW;UAAER,MAAM,EAAE,OAAO;UAAEC,SAAS,EAAEgC,KAAK,CAACC;QAAK,CAAC;MAC/D;MACA,OAAO;QAAE1B,WAAW;QAAER,MAAM,EAAE,OAAO;QAAEC,SAAS,EAAE;MAA2B,CAAC;IAC/E;EACD,CAAC;EAED,OAAO;IACNkC,KAAKA,CAAA,EAAG;MACP/B,KAAK,CAAC+B,KAAK,CAAC,CAAC;MACb7B,QAAQ,CAAC6B,KAAK,CAAC,CAAC;IACjB,CAAC;IAEDC,aAAaA,CAAC5B,WAAW,EAAE;MAC1B,OAAOD,KAAK,CAACC,WAAW,CAAC,KAAKM,SAAS;IACxC,CAAC;IAEDuB,OAAOA,CAAC7B,WAAW,EAAE8B,OAAO,GAAG,CAAC,CAAC,EAA8B;MAC9D,MAAMtB,QAAQ,GAAGb,IAAI,CAACoC,SAAS,CAACC,IAAI,CAACC,KAAK,IAAIA,KAAK,CAACxB,GAAG,KAAKT,WAAW,CAAC;MACxE,IAAI,CAACQ,QAAQ,EAAE;QACd,OAAO0B,OAAO,CAACC,OAAO,CAAC;UAAEnC,WAAW;UAAER,MAAM,EAAE,OAAO;UAAEC,SAAS,EAAE;QAAsB,CAAC,CAAC;MAC3F;MAEA,IAAIqC,OAAO,CAACM,YAAY,KAAK,IAAI,EAAE;QAClC;QACA;QACAxC,KAAK,CAACyC,MAAM,CAACrC,WAAW,CAAC;MAC1B;MACA,MAAMC,MAAM,GAAG6B,OAAO,CAACM,YAAY,KAAK,IAAI,GAAG9B,SAAS,GAAGP,KAAK,CAACC,WAAW,CAAC;MAC7E,IAAIC,MAAM,EAAE;QACX,OAAOiC,OAAO,CAACC,OAAO,CAAC;UACtBnC,WAAW;UACXR,MAAM,EAAE,SAAS;UACjBgC,KAAK,EAAEvB,MAAM,CAACuB,KAAK;UACnBrB,SAAS,EAAEF,MAAM,CAACE;QACnB,CAAC,CAAC;MACH;MAEA,MAAMmC,OAAO,GAAGxC,QAAQ,CAACI,GAAG,CAACF,WAAW,CAAC;MACzC,IAAIsC,OAAO,EAAE;QACZ,OAAOA,OAAO;MACf;MACA,MAAMC,MAAM,GAAGhC,OAAO,CAACC,QAAQ,CAAC,CAACgC,OAAO,CAAC,MAAM;QAC9C,IAAI1C,QAAQ,CAACI,GAAG,CAACF,WAAW,CAAC,KAAKuC,MAAM,EAAE;UACzCzC,QAAQ,CAACuC,MAAM,CAACrC,WAAW,CAAC;QAC7B;MACD,CAAC,CAAC;MACFF,QAAQ,CAACyB,GAAG,CAACvB,WAAW,EAAEuC,MAAM,CAAC;MACjC,OAAOA,MAAM;IACd;EACD,CAAC;AACF","ignoreList":[]}

package/lib/module/tokens/secureStore.js

@@ -0,0 +1,56 @@
+"use strict";
+
+/**
+ * SecureTokenStore port + default react-native-keychain adapter (FR-021, R2).
+ *
+ * Refresh tokens and the session-restore artifact persist ONLY through this
+ * port, backed by platform secure storage (iOS Keychain / Android Keystore).
+ * Access tokens are never written here — they stay in memory (see accessToken).
+ * The default adapter loads the native module on its first read or write, so
+ * creating it, and unit tests that inject a fake, load no native code.
+ */
+
+import { lazyPeer } from '@chipmobilesdk/rn-core';
+import { AuthConfigError } from "../diagnostics/errors.js";
+
+/** Single key under which the persisted session artifact is stored. */
+export const AUTH_STORAGE_KEY = '@chipmobilesdk/rn-auth/session';
+/**
+ * Default secure store backed by react-native-keychain. Each logical key maps to
+ * a Keychain "service" so multiple keys can coexist. Validated on device.
+ */
+export function createKeychainSecureStore(options = {}) {
+  // The native module loads on the first read or write, never at startup (PERF-05).
+  const accessible = () => options.accessible ?? keychain().ACCESSIBLE?.WHEN_UNLOCKED_THIS_DEVICE_ONLY;
+  return {
+    async getItem(key) {
+      const result = await keychain().getGenericPassword({
+        service: key
+      });
+      return result ? result.password : null;
+    },
+    async setItem(key, value) {
+      await keychain().setGenericPassword('token', value, {
+        service: key,
+        accessible: accessible()
+      });
+    },
+    async removeItem(key) {
+      await keychain().resetGenericPassword({
+        service: key
+      });
+    }
+  };
+}
+const keychainPeer = lazyPeer('react-native-keychain', () => {
+  // Inside `try`, so Metro bundles an app that leaves this optional peer out.
+  try {
+    return require('react-native-keychain');
+  } catch (cause) {
+    throw cause;
+  }
+});
+function keychain() {
+  return keychainPeer.require(peer => new AuthConfigError('auth.error.configuration', `${peer} is not installed or its native module is not linked`));
+}
+//# sourceMappingURL=secureStore.js.map

package/lib/module/tokens/secureStore.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["lazyPeer","AuthConfigError","AUTH_STORAGE_KEY","createKeychainSecureStore","options","accessible","keychain","ACCESSIBLE","WHEN_UNLOCKED_THIS_DEVICE_ONLY","getItem","key","result","getGenericPassword","service","password","setItem","value","setGenericPassword","removeItem","resetGenericPassword","keychainPeer","require","cause","peer"],"sourceRoot":"../../../src","sources":["tokens/secureStore.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,QAAQ,QAAQ,wBAAwB;AAEjD,SAASC,eAAe,QAAQ,0BAAuB;;AAEvD;AACA,OAAO,MAAMC,gBAAgB,GAAG,gCAAgC;AAahE;AACA;AACA;AACA;AACA,OAAO,SAASC,yBAAyBA,CACxCC,OAAmC,GAAG,CAAC,CAAC,EACrB;EACnB;EACA,MAAMC,UAAU,GAAGA,CAAA,KAClBD,OAAO,CAACC,UAAU,IAAIC,QAAQ,CAAC,CAAC,CAACC,UAAU,EAAEC,8BAA8B;EAE5E,OAAO;IACN,MAAMC,OAAOA,CAACC,GAAG,EAAE;MAClB,MAAMC,MAAM,GAAG,MAAML,QAAQ,CAAC,CAAC,CAACM,kBAAkB,CAAC;QAAEC,OAAO,EAAEH;MAAI,CAAC,CAAC;MACpE,OAAOC,MAAM,GAAGA,MAAM,CAACG,QAAQ,GAAG,IAAI;IACvC,CAAC;IACD,MAAMC,OAAOA,CAACL,GAAG,EAAEM,KAAK,EAAE;MACzB,MAAMV,QAAQ,CAAC,CAAC,CAACW,kBAAkB,CAAC,OAAO,EAAED,KAAK,EAAE;QACnDH,OAAO,EAAEH,GAAG;QACZL,UAAU,EAAEA,UAAU,CAAC;MACxB,CAAC,CAAC;IACH,CAAC;IACD,MAAMa,UAAUA,CAACR,GAAG,EAAE;MACrB,MAAMJ,QAAQ,CAAC,CAAC,CAACa,oBAAoB,CAAC;QAAEN,OAAO,EAAEH;MAAI,CAAC,CAAC;IACxD;EACD,CAAC;AACF;AAaA,MAAMU,YAAY,GAAGpB,QAAQ,CAAC,uBAAuB,EAAE,MAAM;EAC5D;EACA,IAAI;IACH,OAAOqB,OAAO,CAAC,uBAAuB,CAAC;EACxC,CAAC,CAAC,OAAOC,KAAK,EAAE;IACf,MAAMA,KAAK;EACZ;AACD,CAAC,CAAC;AAEF,SAAShB,QAAQA,CAAA,EAAmB;EACnC,OAAOc,YAAY,CAACC,OAAO,CAC1BE,IAAI,IACH,IAAItB,eAAe,CAClB,0BAA0B,EAC1B,GAAGsB,IAAI,sDACR,CACF,CAAC;AACF","ignoreList":[]}

package/lib/typescript/commonjs/access/accessTier.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Access-tier evaluation (FR-010/FR-011/FR-019/FR-020, R6).
+ *
+ * Pure function over the authenticated token's claims and the app-specific
+ * mapping. Object ids are authoritative; display names never grant access.
+ * Missing, stale, ambiguous, or group-overage claims fail closed (premium
+ * denied, verification = 'unverified').
+ */
+import type { AccessTier, AccessTierMapping } from '../config/types';
+/** The fail-closed default: free + unverified. */
+export declare function failClosedTier(): AccessTier;
+/** Evaluate the access tier, failing closed when entitlement is unverifiable. */
+export declare function evaluateAccessTier(claims: Record<string, unknown>, mapping: AccessTierMapping, now?: number): AccessTier;
+//# sourceMappingURL=accessTier.d.ts.map

package/lib/typescript/commonjs/access/accessTier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessTier.d.ts","sourceRoot":"","sources":["../../../../src/access/accessTier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAgB,MAAM,iBAAiB,CAAC;AAEnF,kDAAkD;AAClD,wBAAgB,cAAc,IAAI,UAAU,CAE3C;AAoCD,iFAAiF;AACjF,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,iBAAiB,EAC1B,GAAG,GAAE,MAAmB,GACtB,UAAU,CAgCZ"}

package/lib/typescript/commonjs/app-auth.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `@chipmobilesdk/rn-auth/app-auth`: the default OIDC client over
+ * react-native-app-auth (AUTH-09). Its own entrypoint, so an app that injects its
+ * own client never reaches this module.
+ */
+export { createAppAuthClient, type AppAuthClientOptions } from './oidc/authClient';
+//# sourceMappingURL=app-auth.d.ts.map

package/lib/typescript/commonjs/app-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-auth.d.ts","sourceRoot":"","sources":["../../../src/app-auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC"}

package/lib/typescript/commonjs/config/types.d.ts

@@ -0,0 +1,171 @@
+/**
+ * Public type contracts for @chipmobilesdk/rn-auth. Shapes follow
+ * specs/003-mobile-entra-auth/data-model.md.
+ */
+import type { AccessTokenRequestOptions } from '../tokens/accessToken';
+import type { SecureTokenStore } from '../tokens/secureStore';
+import type { OidcAuthClient } from '../oidc/authClient';
+import type { AuthError, AuthErrorCode } from '../diagnostics/errors';
+import type { AuthMessageKey, AuthMessageMap } from '../diagnostics/messageKeys';
+/** The providers this package has copy for out of the box. */
+export type KnownProviderId = 'google' | 'apple' | 'facebook';
+/**
+ * A provider id. Open on purpose: routing is `domain_hint` and nothing else, so
+ * adding an IdP the tenant federates — Microsoft account, an email one-time
+ * code — is a change to an app's config, not a release of this package
+ * (AUTH-14). `KnownProviderId` keeps the three familiar ones in autocomplete.
+ */
+export type ProviderId = KnownProviderId | (string & {});
+export type DevicePlatform = 'ios' | 'android';
+export declare const DEVICE_PLATFORMS: readonly DevicePlatform[];
+/** Provider Setup Configuration — non-secret public values only (FR-016/FR-017). */
+export interface ProviderConfig {
+    id: ProviderId;
+    platforms: DevicePlatform[];
+    /** External ID `domain_hint` routing the user flow to this IdP (R3). */
+    domainHint: string;
+    /**
+     * Message key for the button label (Continue with Google / Apple). A key of
+     * this package's catalogue, or one of the app's own for a provider it added.
+     */
+    labelKey: AuthMessageKey | (string & {});
+    available?: boolean;
+    /**
+     * Extra OIDC authorize parameters for this provider, merged after
+     * `domain_hint` — `prompt`, `login_hint`, whatever the tenant's user flow
+     * expects. `domain_hint` itself cannot be overridden here.
+     */
+    additionalParameters?: Record<string, string>;
+}
+/** One configured protected resource for delegated token requests (FR-007). */
+export interface ResourceConfig {
+    key: string;
+    scopes: string[];
+    displayName?: string;
+}
+export interface ClaimMatcher {
+    claim: string;
+    equals: string | number | boolean;
+}
+/** App-specific mapping from tenant indicators to access tiers (FR-019/FR-020). */
+export interface AccessTierMapping {
+    /** Stable group object ids granting premium — authoritative (FR-020). */
+    premiumGroupObjectIds: string[];
+    premiumRoleNames?: string[];
+    premiumClaimMatchers?: ClaimMatcher[];
+    /** Diagnostics-only object-id → name map; never used for decisions (FR-020). */
+    groupDisplayNames?: Record<string, string>;
+}
+/** App-supplied, public-only setup input (FR-015/FR-016/FR-017). */
+export interface AuthConfig {
+    authority: string;
+    clientId: string;
+    redirectUrl: string;
+    scopes: string[];
+    providers: ProviderConfig[];
+    resources?: ResourceConfig[];
+    accessTierMapping: AccessTierMapping;
+    secureStore: SecureTokenStore;
+    authClient?: OidcAuthClient;
+    /**
+     * Copy overrides for this package's own message keys, resolved over the
+     * English defaults and readable through `auth.getMessages()` and
+     * `useAuthMessages()`.
+     */
+    messages?: Partial<AuthMessageMap>;
+}
+/** Advanced/testing options. `platform` overrides the detected device platform. */
+export interface CreateAuthOptions {
+    platform?: DevicePlatform;
+}
+export type AuthStatus = 'loading' | 'signed-out' | 'authenticating' | 'authenticated' | 'token-refreshing' | 'access-denied' | 'cancelled' | 'error';
+export type RestoreStatus = 'pending' | 'restored' | 'unavailable' | 'offline';
+/** Customer User / app-visible profile (FR-006). */
+export interface Profile {
+    tenantUserId: string;
+    displayName?: string | undefined;
+    email?: string | undefined;
+    provider: string;
+    /**
+     * The id-token claims this profile was mapped from. Empty after a restore
+     * that could not reach the provider: the stored artifact holds the identity,
+     * not the token (AUTH-23). Read `restore` on the state to tell the two apart.
+     */
+    claims: Record<string, unknown>;
+}
+export interface ProviderIdentity {
+    provider: string;
+    subject: string;
+    emailBehavior: 'direct' | 'private-relay' | 'none';
+}
+/** Access Tier — local interpretation of tenant indicators (FR-010). */
+export interface AccessTier {
+    tier: 'free' | 'premium';
+    source: 'group' | 'role' | 'claim' | 'default';
+    verification: 'verified' | 'unverified';
+    lastRefreshAt?: number;
+}
+export type AccessTokenStatus = 'success' | 'denied' | 'unavailable' | 'error';
+/** Access Token Request result (FR-007). */
+export interface AccessTokenResult {
+    resourceKey: string;
+    status: AccessTokenStatus;
+    token?: string;
+    expiresAt?: number;
+    errorCode?: AuthErrorCode;
+}
+/** Single active app-visible authenticated state (FR-005/FR-022). */
+export interface AuthState {
+    status: AuthStatus;
+    profile?: Profile | undefined;
+    accessTier?: AccessTier | undefined;
+    restore: RestoreStatus;
+    error?: AuthError | undefined;
+}
+/** Result of a premium-only gate check (US3). */
+export interface PremiumGateResult {
+    allowed: boolean;
+    tier: AccessTier;
+}
+/**
+ * What `signOutGlobal` did beyond the device (added in 0.2.2). Local state is
+ * cleared either way; `failed` means the tenant session may still be alive, so
+ * the next interactive sign-in can complete without a password prompt.
+ */
+export interface GlobalSignOutResult {
+    global: 'ended' | 'failed';
+    /** Present when `global` is `failed`. Redacted like every AuthError. */
+    error?: AuthError;
+}
+/** The auth controller returned by `createAuth` (single active account). */
+export interface Auth {
+    getState(): AuthState;
+    subscribe(listener: (state: AuthState) => void): () => void;
+    restore(): Promise<AuthState>;
+    signIn(providerId: ProviderId): Promise<AuthState>;
+    signOut(): Promise<void>;
+    signOutGlobal(): Promise<GlobalSignOutResult>;
+    /**
+     * A delegated token for one configured resource. Answers from the in-memory
+     * cache while the token is unexpired; `forceRefresh` skips and drops that
+     * cache, which is what a caller whose token was just rejected needs.
+     */
+    requestAccessToken(resourceKey: string, options?: AccessTokenRequestOptions): Promise<AccessTokenResult>;
+    getAccessTier(): AccessTier;
+    /** Whether a premium-only path is open, and the tier behind the answer. Reads nothing else and changes nothing (FR-011). */
+    canAccessPremium(): PremiumGateResult;
+    /**
+     * @deprecated Use `canAccessPremium` and show the denial where it happened.
+     * This also moves the whole controller to `access-denied`, which every screen
+     * reading `status` then sees, and only a `restore` or a sign-in leaves
+     * (AUTH-12). Kept for 0.4.x.
+     */
+    requirePremium(): PremiumGateResult;
+    /** This package's copy: the English defaults with the app's `messages` over them. */
+    getMessages(): AuthMessageMap;
+    /** The first available provider to present on the current platform (UX-004), or undefined. */
+    getPlatformProvider(): ProviderConfig | undefined;
+    /** All available providers for the current platform, in configuration order (FR-003/FR-004). */
+    getPlatformProviders(): ProviderConfig[];
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/typescript/commonjs/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/config/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjF,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AACzD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,SAAS,CAAC;AAE/C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAuB,CAAC;AAE9E,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,UAAU,CAAC;IACf,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,EAAE,cAAc,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CAClC;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IACjC,yEAAyE;IACzE,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC;IACtC,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;IAC7B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACnC;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,MAAM,UAAU,GACnB,SAAS,GACT,YAAY,GACZ,gBAAgB,GAChB,eAAe,GACf,kBAAkB,GAClB,eAAe,GACf,WAAW,GACX,OAAO,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,CAAC;AAE/E,oDAAoD;AACpD,MAAM,WAAW,OAAO;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,QAAQ,GAAG,eAAe,GAAG,MAAM,CAAC;CACnD;AAED,wEAAwE;AACxE,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAC/C,YAAY,EAAE,UAAU,GAAG,YAAY,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,OAAO,CAAC;AAE/E,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACpC,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAC9B;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3B,wEAAwE;IACxE,KAAK,CAAC,EAAE,SAAS,CAAC;CAClB;AAED,4EAA4E;AAC5E,MAAM,WAAW,IAAI;IACpB,QAAQ,IAAI,SAAS,CAAC;IACtB,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5D,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9B,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C;;;;OAIG;IACH,kBAAkB,CACjB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,yBAAyB,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9B,aAAa,IAAI,UAAU,CAAC;IAC5B,4HAA4H;IAC5H,gBAAgB,IAAI,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,cAAc,IAAI,iBAAiB,CAAC;IACpC,qFAAqF;IACrF,WAAW,IAAI,cAAc,CAAC;IAC9B,8FAA8F;IAC9F,mBAAmB,IAAI,cAAc,GAAG,SAAS,CAAC;IAClD,gGAAgG;IAChG,oBAAoB,IAAI,cAAc,EAAE,CAAC;CACzC"}

package/lib/typescript/commonjs/config/validateConfig.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Deterministic configuration validation (FR-005 → configuration-error).
+ * Throws AuthConfigError before any provider flow can start (US4 scenario 2).
+ * Covers the auth-config.md Section A–F rules.
+ */
+import { type AuthConfig } from './types';
+export declare function validateConfig(config: AuthConfig): void;
+//# sourceMappingURL=validateConfig.d.ts.map

package/lib/typescript/commonjs/config/validateConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateConfig.d.ts","sourceRoot":"","sources":["../../../../src/config/validateConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAe5D,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CA2HvD"}

package/lib/typescript/commonjs/core/authMachine.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Auth state machine / orchestrator (FR-005, FR-022, R5, R7). Holds the single
+ * active session, wires the OidcAuthClient + SecureTokenStore ports, profile
+ * mapping, access-tier evaluation, per-resource tokens, restore, and sign-out.
+ *
+ * Every operation that starts or ends a session bumps `sessionEpoch`. Work that
+ * awaited across such a change — a token refresh, a restore, an authorize —
+ * compares the epoch it started with before writing anything back, so a sign-out
+ * can never be undone by a request that was already in flight.
+ */
+import type { Auth, AuthConfig, CreateAuthOptions, Profile } from '../config/types';
+export declare function createAuthMachine(config: AuthConfig, options?: CreateAuthOptions): Auth;
+export type { Profile };
+//# sourceMappingURL=authMachine.d.ts.map

package/lib/typescript/commonjs/core/authMachine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authMachine.d.ts","sourceRoot":"","sources":["../../../../src/core/authMachine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,KAAK,EACX,IAAI,EACJ,UAAU,EAEV,iBAAiB,EAIjB,OAAO,EAEP,MAAM,iBAAiB,CAAC;AAwBzB,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE,iBAAsB,GAAG,IAAI,CAmW3F;AAED,YAAY,EAAE,OAAO,EAAE,CAAC"}