@chipmobilesdk/rn-auth 0.5.0 → 0.6.0

package/lib/typescript/module/config/types.d.ts

@@ -0,0 +1,171 @@
+/**
+ * Public type contracts for @chipmobilesdk/rn-auth. Shapes follow
+ * specs/003-mobile-entra-auth/data-model.md.
+ */
+import type { AccessTokenRequestOptions } from '../tokens/accessToken.js';
+import type { SecureTokenStore } from '../tokens/secureStore.js';
+import type { OidcAuthClient } from '../oidc/authClient.js';
+import type { AuthError, AuthErrorCode } from '../diagnostics/errors.js';
+import type { AuthMessageKey, AuthMessageMap } from '../diagnostics/messageKeys.js';
+/** The providers this package has copy for out of the box. */
+export type KnownProviderId = 'google' | 'apple' | 'facebook';
+/**
+ * A provider id. Open on purpose: routing is `domain_hint` and nothing else, so
+ * adding an IdP the tenant federates — Microsoft account, an email one-time
+ * code — is a change to an app's config, not a release of this package
+ * (AUTH-14). `KnownProviderId` keeps the three familiar ones in autocomplete.
+ */
+export type ProviderId = KnownProviderId | (string & {});
+export type DevicePlatform = 'ios' | 'android';
+export declare const DEVICE_PLATFORMS: readonly DevicePlatform[];
+/** Provider Setup Configuration — non-secret public values only (FR-016/FR-017). */
+export interface ProviderConfig {
+    id: ProviderId;
+    platforms: DevicePlatform[];
+    /** External ID `domain_hint` routing the user flow to this IdP (R3). */
+    domainHint: string;
+    /**
+     * Message key for the button label (Continue with Google / Apple). A key of
+     * this package's catalogue, or one of the app's own for a provider it added.
+     */
+    labelKey: AuthMessageKey | (string & {});
+    available?: boolean;
+    /**
+     * Extra OIDC authorize parameters for this provider, merged after
+     * `domain_hint` — `prompt`, `login_hint`, whatever the tenant's user flow
+     * expects. `domain_hint` itself cannot be overridden here.
+     */
+    additionalParameters?: Record<string, string>;
+}
+/** One configured protected resource for delegated token requests (FR-007). */
+export interface ResourceConfig {
+    key: string;
+    scopes: string[];
+    displayName?: string;
+}
+export interface ClaimMatcher {
+    claim: string;
+    equals: string | number | boolean;
+}
+/** App-specific mapping from tenant indicators to access tiers (FR-019/FR-020). */
+export interface AccessTierMapping {
+    /** Stable group object ids granting premium — authoritative (FR-020). */
+    premiumGroupObjectIds: string[];
+    premiumRoleNames?: string[];
+    premiumClaimMatchers?: ClaimMatcher[];
+    /** Diagnostics-only object-id → name map; never used for decisions (FR-020). */
+    groupDisplayNames?: Record<string, string>;
+}
+/** App-supplied, public-only setup input (FR-015/FR-016/FR-017). */
+export interface AuthConfig {
+    authority: string;
+    clientId: string;
+    redirectUrl: string;
+    scopes: string[];
+    providers: ProviderConfig[];
+    resources?: ResourceConfig[];
+    accessTierMapping: AccessTierMapping;
+    secureStore: SecureTokenStore;
+    authClient?: OidcAuthClient;
+    /**
+     * Copy overrides for this package's own message keys, resolved over the
+     * English defaults and readable through `auth.getMessages()` and
+     * `useAuthMessages()`.
+     */
+    messages?: Partial<AuthMessageMap>;
+}
+/** Advanced/testing options. `platform` overrides the detected device platform. */
+export interface CreateAuthOptions {
+    platform?: DevicePlatform;
+}
+export type AuthStatus = 'loading' | 'signed-out' | 'authenticating' | 'authenticated' | 'token-refreshing' | 'access-denied' | 'cancelled' | 'error';
+export type RestoreStatus = 'pending' | 'restored' | 'unavailable' | 'offline';
+/** Customer User / app-visible profile (FR-006). */
+export interface Profile {
+    tenantUserId: string;
+    displayName?: string | undefined;
+    email?: string | undefined;
+    provider: string;
+    /**
+     * The id-token claims this profile was mapped from. Empty after a restore
+     * that could not reach the provider: the stored artifact holds the identity,
+     * not the token (AUTH-23). Read `restore` on the state to tell the two apart.
+     */
+    claims: Record<string, unknown>;
+}
+export interface ProviderIdentity {
+    provider: string;
+    subject: string;
+    emailBehavior: 'direct' | 'private-relay' | 'none';
+}
+/** Access Tier — local interpretation of tenant indicators (FR-010). */
+export interface AccessTier {
+    tier: 'free' | 'premium';
+    source: 'group' | 'role' | 'claim' | 'default';
+    verification: 'verified' | 'unverified';
+    lastRefreshAt?: number;
+}
+export type AccessTokenStatus = 'success' | 'denied' | 'unavailable' | 'error';
+/** Access Token Request result (FR-007). */
+export interface AccessTokenResult {
+    resourceKey: string;
+    status: AccessTokenStatus;
+    token?: string;
+    expiresAt?: number;
+    errorCode?: AuthErrorCode;
+}
+/** Single active app-visible authenticated state (FR-005/FR-022). */
+export interface AuthState {
+    status: AuthStatus;
+    profile?: Profile | undefined;
+    accessTier?: AccessTier | undefined;
+    restore: RestoreStatus;
+    error?: AuthError | undefined;
+}
+/** Result of a premium-only gate check (US3). */
+export interface PremiumGateResult {
+    allowed: boolean;
+    tier: AccessTier;
+}
+/**
+ * What `signOutGlobal` did beyond the device (added in 0.2.2). Local state is
+ * cleared either way; `failed` means the tenant session may still be alive, so
+ * the next interactive sign-in can complete without a password prompt.
+ */
+export interface GlobalSignOutResult {
+    global: 'ended' | 'failed';
+    /** Present when `global` is `failed`. Redacted like every AuthError. */
+    error?: AuthError;
+}
+/** The auth controller returned by `createAuth` (single active account). */
+export interface Auth {
+    getState(): AuthState;
+    subscribe(listener: (state: AuthState) => void): () => void;
+    restore(): Promise<AuthState>;
+    signIn(providerId: ProviderId): Promise<AuthState>;
+    signOut(): Promise<void>;
+    signOutGlobal(): Promise<GlobalSignOutResult>;
+    /**
+     * A delegated token for one configured resource. Answers from the in-memory
+     * cache while the token is unexpired; `forceRefresh` skips and drops that
+     * cache, which is what a caller whose token was just rejected needs.
+     */
+    requestAccessToken(resourceKey: string, options?: AccessTokenRequestOptions): Promise<AccessTokenResult>;
+    getAccessTier(): AccessTier;
+    /** Whether a premium-only path is open, and the tier behind the answer. Reads nothing else and changes nothing (FR-011). */
+    canAccessPremium(): PremiumGateResult;
+    /**
+     * @deprecated Use `canAccessPremium` and show the denial where it happened.
+     * This also moves the whole controller to `access-denied`, which every screen
+     * reading `status` then sees, and only a `restore` or a sign-in leaves
+     * (AUTH-12). Kept for 0.4.x.
+     */
+    requirePremium(): PremiumGateResult;
+    /** This package's copy: the English defaults with the app's `messages` over them. */
+    getMessages(): AuthMessageMap;
+    /** The first available provider to present on the current platform (UX-004), or undefined. */
+    getPlatformProvider(): ProviderConfig | undefined;
+    /** All available providers for the current platform, in configuration order (FR-003/FR-004). */
+    getPlatformProviders(): ProviderConfig[];
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/typescript/module/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/config/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,0BAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,+BAA4B,CAAC;AAEjF,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AACzD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,SAAS,CAAC;AAE/C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAuB,CAAC;AAE9E,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,UAAU,CAAC;IACf,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,EAAE,cAAc,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CAClC;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IACjC,yEAAyE;IACzE,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC;IACtC,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;IAC7B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACnC;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,MAAM,UAAU,GACnB,SAAS,GACT,YAAY,GACZ,gBAAgB,GAChB,eAAe,GACf,kBAAkB,GAClB,eAAe,GACf,WAAW,GACX,OAAO,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,CAAC;AAE/E,oDAAoD;AACpD,MAAM,WAAW,OAAO;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,QAAQ,GAAG,eAAe,GAAG,MAAM,CAAC;CACnD;AAED,wEAAwE;AACxE,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAC/C,YAAY,EAAE,UAAU,GAAG,YAAY,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,OAAO,CAAC;AAE/E,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACpC,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAC9B;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3B,wEAAwE;IACxE,KAAK,CAAC,EAAE,SAAS,CAAC;CAClB;AAED,4EAA4E;AAC5E,MAAM,WAAW,IAAI;IACpB,QAAQ,IAAI,SAAS,CAAC;IACtB,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5D,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9B,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C;;;;OAIG;IACH,kBAAkB,CACjB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,yBAAyB,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9B,aAAa,IAAI,UAAU,CAAC;IAC5B,4HAA4H;IAC5H,gBAAgB,IAAI,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,cAAc,IAAI,iBAAiB,CAAC;IACpC,qFAAqF;IACrF,WAAW,IAAI,cAAc,CAAC;IAC9B,8FAA8F;IAC9F,mBAAmB,IAAI,cAAc,GAAG,SAAS,CAAC;IAClD,gGAAgG;IAChG,oBAAoB,IAAI,cAAc,EAAE,CAAC;CACzC"}

package/lib/typescript/module/config/validateConfig.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Deterministic configuration validation (FR-005 → configuration-error).
+ * Throws AuthConfigError before any provider flow can start (US4 scenario 2).
+ * Covers the auth-config.md Section A–F rules.
+ */
+import { type AuthConfig } from './types.js';
+export declare function validateConfig(config: AuthConfig): void;
+//# sourceMappingURL=validateConfig.d.ts.map

package/lib/typescript/module/config/validateConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateConfig.d.ts","sourceRoot":"","sources":["../../../../src/config/validateConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,YAAS,CAAC;AAe5D,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CA2HvD"}

package/lib/typescript/module/core/authMachine.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Auth state machine / orchestrator (FR-005, FR-022, R5, R7). Holds the single
+ * active session, wires the OidcAuthClient + SecureTokenStore ports, profile
+ * mapping, access-tier evaluation, per-resource tokens, restore, and sign-out.
+ *
+ * Every operation that starts or ends a session bumps `sessionEpoch`. Work that
+ * awaited across such a change — a token refresh, a restore, an authorize —
+ * compares the epoch it started with before writing anything back, so a sign-out
+ * can never be undone by a request that was already in flight.
+ */
+import type { Auth, AuthConfig, CreateAuthOptions, Profile } from '../config/types.js';
+export declare function createAuthMachine(config: AuthConfig, options?: CreateAuthOptions): Auth;
+export type { Profile };
+//# sourceMappingURL=authMachine.d.ts.map

package/lib/typescript/module/core/authMachine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authMachine.d.ts","sourceRoot":"","sources":["../../../../src/core/authMachine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,KAAK,EACX,IAAI,EACJ,UAAU,EAEV,iBAAiB,EAIjB,OAAO,EAEP,MAAM,oBAAiB,CAAC;AAwBzB,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE,iBAAsB,GAAG,IAAI,CAmW3F;AAED,YAAY,EAAE,OAAO,EAAE,CAAC"}

package/lib/typescript/module/core/profile.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Claims → Profile mapping (FR-006). Tolerant of Apple private-relay emails and
+ * missing display name / given name (edge cases).
+ */
+import type { Profile, ProviderId, ProviderIdentity } from '../config/types.js';
+/** Map id-token claims to the app-visible Profile. */
+export declare function mapClaimsToProfile(claims: Record<string, unknown>, providerId?: ProviderId): Profile;
+/**
+ * Describe the external provider identity behind the profile (FR-004 edge
+ * cases). `emailBehavior` is what a screen needs to explain an address the user
+ * did not choose: Apple's private relay forwards mail and is not the address
+ * they type anywhere else.
+ */
+export declare function describeProviderIdentity(claims: Record<string, unknown>, providerId?: ProviderId): ProviderIdentity;
+//# sourceMappingURL=profile.d.ts.map

package/lib/typescript/module/core/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../src/core/profile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,oBAAiB,CAAC;AAU7E,sDAAsD;AACtD,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,UAAU,CAAC,EAAE,UAAU,GACrB,OAAO,CAsBT;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,UAAU,CAAC,EAAE,UAAU,GACrB,gBAAgB,CASlB"}

package/lib/typescript/module/core/session.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Session restoration (FR-008, R5). Reads the persisted artifact, attempts a
+ * silent refresh, and classifies the outcome:
+ *  - restored: fresh tokens + claims → authenticated
+ *  - offline:  the refresh could not complete for any reason other than the
+ *              session being invalid — no network, a timeout, a 5xx, an error we
+ *              cannot classify → cached profile read-only, tier unverified (fail
+ *              closed) — clarify Q3
+ *  - unavailable: no artifact, or the provider said the refresh token is no
+ *              longer valid → signed-out reauth
+ *
+ * Only `unavailable` deletes the stored session, so it is reserved for a verdict
+ * the provider actually gave. Treating every unclassified error as expiry signed
+ * users out whenever the token endpoint had a bad moment.
+ */
+import type { AccessTier, AccessTierMapping, Profile, RestoreStatus } from '../config/types.js';
+import type { OidcAuthClient } from '../oidc/authClient.js';
+import type { SecureTokenStore } from '../tokens/secureStore.js';
+/**
+ * The identity in the stored artifact: who, not what the token said.
+ *
+ * The whole claim set used to be written to the Keychain on every launch — all
+ * of it, groups included — for a value nothing reads back: the access tier is
+ * recomputed from fresh claims, and a restore that cannot reach the provider
+ * fails closed anyway (AUTH-23).
+ */
+export type StoredProfile = Omit<Profile, 'claims'>;
+export interface PersistedSession {
+    refreshToken: string;
+    profile: StoredProfile;
+    /** The id token hint for end-session (AUTH-04). Absent in artifacts written before 0.2.2. */
+    idToken?: string | undefined;
+}
+/** The artifact's identity as a profile. Artifacts written before 0.4.0 carry claims; they are kept. */
+export declare function profileFromStored(stored: StoredProfile | Profile): Profile;
+/** What goes to the store: everything but the claims. */
+export declare function storedProfileFrom(profile: Profile): StoredProfile;
+/** True when the artifact would be byte-identical, so the write can be skipped. */
+export declare function sameSession(a: PersistedSession, b: PersistedSession): boolean;
+export interface RestoreDeps {
+    secureStore: SecureTokenStore;
+    authority: string;
+    clientId: string;
+    redirectUrl: string;
+    scopes: string[];
+    authClient: OidcAuthClient;
+    mapping: AccessTierMapping;
+}
+export interface RestoreResult {
+    outcome: RestoreStatus;
+    profile?: Profile;
+    /** The artifact this restore read, so a rewrite that changes nothing can be skipped. */
+    persisted?: PersistedSession;
+    accessTier?: AccessTier;
+    refreshToken?: string;
+    idToken?: string | undefined;
+}
+export declare function parsePersistedSession(raw: string | null): PersistedSession | null;
+export declare function restoreSession(deps: RestoreDeps): Promise<RestoreResult>;
+//# sourceMappingURL=session.d.ts.map

package/lib/typescript/module/core/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../src/core/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAiB,CAAC;AAC7F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAAuB,CAAC;AAM9D;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAEpD,MAAM,WAAW,gBAAgB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC;IACvB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,wGAAwG;AACxG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,GAAG,OAAO,CAE1E;AAED,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAOjE;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAS7E;AAED,MAAM,WAAW,WAAW;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,EAAE,iBAAiB,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wFAAwF;IACxF,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,gBAAgB,GAAG,IAAI,CAajF;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CA+C9E"}

package/lib/typescript/module/diagnostics/errors.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Developer-facing diagnostics. AuthError carries a stable machine-readable
+ * code, an audience (user vs developer/tenant), and a localizable message key.
+ * `detail` is always passed through `redact` so tokens and secrets never appear
+ * in logs or error objects (FR-014).
+ */
+import { SdkError } from '@chipmobilesdk/rn-core';
+import type { AuthMessageKey } from './messageKeys.js';
+export type AuthErrorCode = 'configuration-error' | 'provider-cancelled' | 'redirect-mismatch' | 'token-acquisition-failed' | 'session-expired' | 'consent-denied' | 'network-unavailable';
+export type AuthErrorAudience = 'user' | 'developer';
+export interface AuthErrorArgs {
+    code: AuthErrorCode;
+    /** A key of this package's catalogue: the copy an app shows for this error. */
+    messageKey: AuthMessageKey;
+    audience?: AuthErrorAudience;
+    detail?: string | undefined;
+}
+/**
+ * Replace token-like substrings with a placeholder so diagnostics never leak
+ * secrets or token values (FR-014): JWTs become `[redacted-token]`; URLs, e-mail
+ * addresses, UUIDs and other opaque runs become `[redacted]` (rn-core's patterns).
+ */
+export declare function redact(value: string | undefined): string | undefined;
+/** The package's error; an `SdkError` (`@chipmobilesdk/rn-core`) with `pkg: 'rn-auth'`. */
+export declare class AuthError extends SdkError<AuthErrorCode> {
+    readonly audience: AuthErrorAudience;
+    readonly messageKey: AuthMessageKey;
+    readonly detail?: string | undefined;
+    constructor(args: AuthErrorArgs);
+}
+export declare class AuthConfigError extends AuthError {
+    constructor(messageKey: AuthMessageKey, detail?: string);
+}
+export declare function isAuthError(value: unknown): value is AuthError;
+/** Normalize any thrown value into an AuthError without leaking secrets. */
+export declare function toAuthError(value: unknown, fallbackCode?: AuthErrorCode, fallbackMessageKey?: AuthMessageKey): AuthError;
+//# sourceMappingURL=errors.d.ts.map

package/lib/typescript/module/diagnostics/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/diagnostics/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAmB,QAAQ,EAAkB,MAAM,wBAAwB,CAAC;AAEnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAe,CAAC;AAEpD,MAAM,MAAM,aAAa,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,mBAAmB,GACnB,0BAA0B,GAC1B,iBAAiB,GACjB,gBAAgB,GAChB,qBAAqB,CAAC;AAEzB,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,WAAW,CAAC;AAErD,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,+EAA+E;IAC/E,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAOD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAQpE;AAKD,2FAA2F;AAC3F,qBAAa,SAAU,SAAQ,QAAQ,CAAC,aAAa,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;gBAEzB,IAAI,EAAE,aAAa;CAY/B;AAED,qBAAa,eAAgB,SAAQ,SAAS;gBACjC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM;CAIvD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAC1B,KAAK,EAAE,OAAO,EACd,YAAY,GAAE,aAA0C,EACxD,kBAAkB,GAAE,cAAmC,GACrD,SAAS,CAWX"}

package/lib/typescript/module/diagnostics/messageKeys.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Stable, localizable message keys with English default copy (UX-006 / LIB-011).
+ * The library takes no i18n runtime dependency: consuming apps map these keys to
+ * localized strings via their own i18n system. User-actionable copy and
+ * developer/tenant-configuration copy are kept separate (UX-005).
+ */
+export interface AuthMessageMap {
+    'auth.action.continueGoogle': string;
+    'auth.action.continueApple': string;
+    'auth.action.continueFacebook': string;
+    'auth.state.signedOut': string;
+    'auth.state.authenticating': string;
+    'auth.state.signedIn': string;
+    'auth.state.signingOut': string;
+    'auth.tier.free': string;
+    'auth.tier.premium': string;
+    'auth.tier.unverified': string;
+    'auth.error.cancelled': string;
+    'auth.error.sessionExpired': string;
+    'auth.error.entitlement': string;
+    'auth.error.network': string;
+    'auth.error.configuration': string;
+    'auth.error.redirectMismatch': string;
+    'auth.error.token': string;
+    'auth.error.consentDenied': string;
+}
+export type AuthMessageKey = keyof AuthMessageMap;
+/**
+ * The catalog, as an rn-core message set: `user` copy may reach an end user,
+ * `developer` copy describes a tenant or configuration fault (UX-005). Register
+ * `authMessages.user` with rn-i18n to translate it like app copy.
+ */
+export declare const authMessages: import("@chipmobilesdk/rn-core").MessageSet<{
+    'auth.action.continueGoogle': string;
+    'auth.action.continueApple': string;
+    'auth.action.continueFacebook': string;
+    'auth.state.signedOut': string;
+    'auth.state.authenticating': string;
+    'auth.state.signedIn': string;
+    'auth.state.signingOut': string;
+    'auth.tier.free': string;
+    'auth.tier.premium': string;
+    'auth.tier.unverified': string;
+    'auth.error.cancelled': string;
+    'auth.error.sessionExpired': string;
+    'auth.error.entitlement': string;
+    'auth.error.network': string;
+}, {
+    'auth.error.configuration': string;
+    'auth.error.redirectMismatch': string;
+    'auth.error.token': string;
+    'auth.error.consentDenied': string;
+}>;
+export declare const DEFAULT_MESSAGES: AuthMessageMap;
+/** Resolve a message, preferring app overrides over the English defaults. */
+export declare function resolveMessages(overrides?: Partial<AuthMessageMap>): AuthMessageMap;
+//# sourceMappingURL=messageKeys.d.ts.map

package/lib/typescript/module/diagnostics/messageKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messageKeys.d.ts","sourceRoot":"","sources":["../../../../src/diagnostics/messageKeys.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,cAAc;IAE9B,4BAA4B,EAAE,MAAM,CAAC;IACrC,2BAA2B,EAAE,MAAM,CAAC;IACpC,8BAA8B,EAAE,MAAM,CAAC;IACvC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,2BAA2B,EAAE,MAAM,CAAC;IACpC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;IAEhC,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAE/B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,2BAA2B,EAAE,MAAM,CAAC;IACpC,wBAAwB,EAAE,MAAM,CAAC;IACjC,oBAAoB,EAAE,MAAM,CAAC;IAE7B,0BAA0B,EAAE,MAAM,CAAC;IACnC,6BAA6B,EAAE,MAAM,CAAC;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0BAA0B,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;EAuBvB,CAAC;AAEH,eAAO,MAAM,gBAAgB,EAAE,cAAsC,CAAC;AAEtE,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAEnF"}

package/lib/typescript/module/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @chipmobilesdk/rn-auth — reusable Microsoft Entra External ID authentication
+ * for ChipMobileSdk-family React Native apps (public OIDC/PKCE client, no
+ * backend). This is the single public entrypoint (LIB-003); modules under
+ * `core/`, `tokens/`, `oidc/`, `access/`, and `diagnostics/` are private.
+ */
+import type { Auth, AuthConfig, CreateAuthOptions } from './config/types.js';
+/** Create the auth controller. Throws AuthConfigError on invalid config (FR-005). */
+export declare function createAuth(config: AuthConfig, options?: CreateAuthOptions): Auth;
+export type { Auth, AuthConfig, CreateAuthOptions, AuthState, AuthStatus, RestoreStatus, Profile, ProviderIdentity, ProviderConfig, ProviderId, KnownProviderId, DevicePlatform, ResourceConfig, ClaimMatcher, AccessTierMapping, AccessTier, AccessTokenResult, AccessTokenStatus, PremiumGateResult, GlobalSignOutResult, } from './config/types.js';
+export { describeProviderIdentity, mapClaimsToProfile } from './core/profile.js';
+export type { AccessTokenRequestOptions } from './tokens/accessToken.js';
+export type { SecureTokenStore } from './tokens/secureStore.js';
+export { createKeychainSecureStore, AUTH_STORAGE_KEY } from './tokens/secureStore.js';
+export type { OidcAuthClient, OidcTokens, OidcServiceConfiguration, AppAuthClientOptions, AuthorizeParams, RefreshParams, EndSessionParams, } from './oidc/authClient.js';
+export { createAppAuthClient } from './oidc/authClient.js';
+export { evaluateAccessTier, failClosedTier } from './access/accessTier.js';
+export { AuthError, AuthConfigError, isAuthError, redact } from './diagnostics/errors.js';
+export type { AuthErrorCode, AuthErrorAudience } from './diagnostics/errors.js';
+export { DEFAULT_MESSAGES, authMessages, resolveMessages } from './diagnostics/messageKeys.js';
+export type { AuthMessageMap, AuthMessageKey } from './diagnostics/messageKeys.js';
+export { AuthProvider } from './react/AuthProvider.js';
+export { useAuthSelector } from './react/hooks.js';
+export type { AuthProviderProps } from './react/AuthProvider.js';
+export { useAuth, useAuthMessages, useProfile, useAccessTier, useAccessToken, useSignInProvider, useSignInProviders, } from './react/hooks.js';
+export type { UseAuthResult, UseAccessTokenResult, UseAccessTokenStatus } from './react/hooks.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,mBAAgB,CAAC;AAE1E,qFAAqF;AACrF,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAEhF;AAGD,YAAY,EACX,IAAI,EACJ,UAAU,EACV,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,aAAa,EACb,OAAO,EACP,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,GACnB,MAAM,mBAAgB,CAAC;AAGxB,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,mBAAgB,CAAC;AAE9E,YAAY,EAAE,yBAAyB,EAAE,MAAM,yBAAsB,CAAC;AACtE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAsB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,yBAAsB,CAAC;AACnF,YAAY,EACX,cAAc,EACd,UAAU,EACV,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,gBAAgB,GAChB,MAAM,sBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAmB,CAAC;AAGxD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,wBAAqB,CAAC;AAGzE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,yBAAsB,CAAC;AACvF,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,yBAAsB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA2B,CAAC;AAC5F,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8BAA2B,CAAC;AAGhF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAe,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAsB,CAAC;AAC9D,OAAO,EACN,OAAO,EACP,eAAe,EACf,UAAU,EACV,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,MAAM,kBAAe,CAAC;AACvB,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAe,CAAC"}

package/lib/typescript/module/keychain.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `@chipmobilesdk/rn-auth/keychain`: the default secure token store over
+ * react-native-keychain (AUTH-09). Its own entrypoint, so an app with its own
+ * secure storage never reaches this module.
+ */
+export { createKeychainSecureStore, type KeychainSecureStoreOptions } from './tokens/secureStore.js';
+//# sourceMappingURL=keychain.d.ts.map

package/lib/typescript/module/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,KAAK,0BAA0B,EAAE,MAAM,yBAAsB,CAAC"}

package/lib/typescript/module/oidc/authClient.d.ts

@@ -0,0 +1,75 @@
+/**
+ * OidcAuthClient port + default react-native-app-auth adapter (R1).
+ *
+ * The port abstracts the Authorization Code + PKCE public-client flow so the
+ * auth engine is testable without native code. The default adapter lazily
+ * requires react-native-app-auth and is validated on device.
+ */
+export interface OidcTokens {
+    /** Resource/audience access token (present for authorize and resource refresh). */
+    accessToken?: string | undefined;
+    /**
+     * Refresh token used for silent acquisition and restore. Absent when the
+     * provider issued none — a refresh that does not rotate, or an authorize the
+     * tenant answered without `offline_access`.
+     */
+    refreshToken?: string | undefined;
+    /** Raw id token (JWT). Absent from a refresh requested without `openid`. */
+    idToken?: string | undefined;
+    /** Decoded id-token (or access-token) claims used for profile + access tier. */
+    claims: Record<string, unknown>;
+    /** Access-token expiry in epoch milliseconds, when available. */
+    accessTokenExpiresAt?: number | undefined;
+}
+export interface AuthorizeParams {
+    authority: string;
+    clientId: string;
+    redirectUrl: string;
+    scopes: string[];
+    /** Additional OIDC parameters, e.g. `domain_hint` for social routing. */
+    additionalParameters?: Record<string, string>;
+}
+export interface RefreshParams {
+    authority: string;
+    clientId: string;
+    redirectUrl: string;
+    refreshToken: string;
+    scopes: string[];
+}
+export interface EndSessionParams {
+    authority: string;
+    clientId: string;
+    redirectUrl: string;
+    idToken?: string | undefined;
+}
+export interface OidcAuthClient {
+    authorize(params: AuthorizeParams): Promise<OidcTokens>;
+    refresh(params: RefreshParams): Promise<OidcTokens>;
+    endSession(params: EndSessionParams): Promise<void>;
+}
+/** Decode the payload segment of a JWT without any dependency (device-safe). */
+export declare function decodeJwtClaims(jwt: string | null | undefined): Record<string, unknown>;
+/** The endpoints discovery would have returned, when an app already knows them. */
+export interface OidcServiceConfiguration {
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    endSessionEndpoint?: string;
+    revocationEndpoint?: string;
+    registrationEndpoint?: string;
+}
+export interface AppAuthClientOptions {
+    /** When true, the OIDC discovery document is fetched from `${authority}`. */
+    useDiscovery?: boolean;
+    /**
+     * Static endpoints, used instead of discovery. Every authorize, refresh and
+     * sign-out otherwise costs the native module one `.well-known` round-trip,
+     * including the refresh on the startup path (AUTH-08).
+     */
+    serviceConfiguration?: OidcServiceConfiguration;
+}
+/**
+ * Default OidcAuthClient adapter wrapping react-native-app-auth (PKCE public
+ * client). Validated on device (R8).
+ */
+export declare function createAppAuthClient(options?: AppAuthClientOptions): OidcAuthClient;
+//# sourceMappingURL=authClient.d.ts.map

package/lib/typescript/module/oidc/authClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authClient.d.ts","sourceRoot":"","sources":["../../../../src/oidc/authClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,MAAM,WAAW,UAAU;IAC1B,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,iEAAiE;IACjE,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC9B,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAcvF;AA0CD,mFAAmF;AACnF,MAAM,WAAW,wBAAwB;IACxC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACpC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;CAChD;AAyCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,oBAAyB,GAAG,cAAc,CAwEtF"}

package/lib/typescript/module/oidc/classifyError.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Classifies a native OIDC error into an `AuthErrorCode`.
+ *
+ * The rules are an ordered table rather than a chain of substring checks, so a
+ * platform adapter (the iOS one, later) adds its own rows without touching the
+ * engine. Order matters: the first matching rule wins.
+ *
+ * The default is deliberately not "session expired". Restore clears the stored
+ * session only on `session-expired`, so anything this table cannot name — a
+ * timeout, a 5xx, a discovery failure, a localized message — must keep the
+ * session rather than sign the user out.
+ */
+import { AuthError, type AuthErrorCode } from '../diagnostics/errors.js';
+import type { AuthMessageKey } from '../diagnostics/messageKeys.js';
+export interface ClassificationRule {
+    readonly code: AuthErrorCode;
+    readonly messageKey: AuthMessageKey;
+    /** Matched against the native error's `code` and `message`, case-insensitively. */
+    readonly pattern: RegExp;
+}
+/**
+ * OAuth error codes (RFC 6749 §5.2, OIDC Core §3.1.2.6) and the Entra ID AADSTS
+ * codes that mean the same thing, plus the transport failures app-auth reports.
+ */
+export declare const DEFAULT_CLASSIFICATION_RULES: readonly ClassificationRule[];
+/** Maps a native app-auth error to a classified AuthError without leaking tokens. */
+export declare function classifyAppAuthError(error: unknown, rules?: readonly ClassificationRule[]): AuthError;
+//# sourceMappingURL=classifyError.d.ts.map

package/lib/typescript/module/oidc/classifyError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifyError.d.ts","sourceRoot":"","sources":["../../../../src/oidc/classifyError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,0BAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA4B,CAAC;AAEjE,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,kBAAkB,EA8BrE,CAAC;AAEF,qFAAqF;AACrF,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,SAAS,kBAAkB,EAAiC,GACjE,SAAS,CAaX"}

package/lib/typescript/module/oidc/socialRouting.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Social provider routing (FR-002/FR-003, R3). Google and Apple are federated
+ * inside the External ID tenant; the app presents the platform-correct action
+ * and starts the user flow with a per-provider `domain_hint`.
+ */
+import type { AuthConfig, DevicePlatform, ProviderConfig, ProviderId } from '../config/types.js';
+/** Find the configured provider, ensuring it is enabled for the platform. */
+export declare function resolveProvider(config: AuthConfig, providerId: ProviderId, platform: DevicePlatform): ProviderConfig;
+/** Build the OIDC additional parameters that route to the chosen IdP. */
+export declare function buildAdditionalParameters(provider: ProviderConfig): Record<string, string>;
+/**
+ * All providers to present on a given platform, in configuration array order
+ * (FR-003/FR-004). Filtered to providers enabled for the platform and not marked
+ * unavailable.
+ */
+export declare function availableProvidersForPlatform(config: AuthConfig, platform: DevicePlatform): ProviderConfig[];
+/**
+ * The first available provider for a platform (UX-004, back-compat). Equals
+ * `availableProvidersForPlatform(config, platform)[0]`.
+ */
+export declare function defaultProviderForPlatform(config: AuthConfig, platform: DevicePlatform): ProviderConfig | undefined;
+//# sourceMappingURL=socialRouting.d.ts.map

package/lib/typescript/module/oidc/socialRouting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socialRouting.d.ts","sourceRoot":"","sources":["../../../../src/oidc/socialRouting.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAiB,CAAC;AAG9F,6EAA6E;AAC7E,wBAAgB,eAAe,CAC9B,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,GACtB,cAAc,CAqBhB;AAED,yEAAyE;AACzE,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI1F;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC5C,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,cAAc,GACtB,cAAc,EAAE,CAIlB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,cAAc,GACtB,cAAc,GAAG,SAAS,CAE5B"}

package/lib/typescript/module/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/typescript/module/react/AuthProvider.d.ts

@@ -0,0 +1,17 @@
+/**
+ * React context boundary for the auth controller (LIB-002).
+ *
+ * The context carries the controller only, never its state: a context value that
+ * changed on every transition re-rendered every consumer on every transition
+ * (PERF-02). Hooks read the state through `useSyncExternalStore` with a selector,
+ * so a component re-renders only when the part it reads changes.
+ */
+import React from 'react';
+import type { Auth } from '../config/types.js';
+export interface AuthProviderProps {
+    auth: Auth;
+    children: React.ReactNode;
+}
+export declare function AuthProvider({ auth, children }: AuthProviderProps): React.JSX.Element;
+export declare function useAuthInstance(): Auth;
+//# sourceMappingURL=AuthProvider.d.ts.map

package/lib/typescript/module/react/AuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/react/AuthProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAoC,MAAM,OAAO,CAAC;AACzD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAiB,CAAC;AAI5C,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC1B;AAED,wBAAgB,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,iBAAiB,qBAEjE;AAED,wBAAgB,eAAe,IAAI,IAAI,CAMtC"}