@confighub/react-auth 0.4.4 → 0.4.5

package/README.md

@@ -34,11 +34,14 @@ function App() {
   which is the redirect URI to register. It is fixed on purpose: the page the user
   started from travels in the PKCE `state` and is restored on return, so a login
   from `/space/x?tab=units` lands back there without registering every path.
-- `persist` (default `'none'`) — `'session'` keeps the session in `sessionStorage`,
-  so a reload or in-tab navigation does not round-trip through the IdP. Tab-scoped,
-  gone when the tab closes, dropped when the token has expired.
-- `onUnauthorized` (default `'login'`) — what a 401 from the API means. `'login'`
-  tries a silent re-authentication; `'logout'` just drops the session.
+- `persist` (default `'session'`) — the session is kept in `sessionStorage`, so a
+  reload or in-tab navigation does not round-trip through the IdP. Tab-scoped, gone
+  when the tab closes, dropped when the token has expired. `'none'` keeps it in memory
+  only, and every page load starts unauthenticated.
+- `onUnauthorized` (default `'login'`) — what a rejected token means. `'login'` tries a
+  silent re-authentication; `'logout'` just drops the session. Applied when
+  `getAccessToken` finds the token expired, and when a data client reports a 401
+  through `handleUnauthorized` (below).
 
 The IdP issuer and OIDC endpoints are discovered from `{baseUrl}/api/info`, so the
 same build runs against any ConfigHub instance (the bundled Keycloak for Cloud, an
@@ -71,12 +74,32 @@ const { status, user, error, login, logout, switchOrganization, reauthenticate,
   `unauthenticated`, so an app that auto-logs-in on `unauthenticated` does not race
   it. If the IdP session is gone too, the page comes back `unauthenticated`.
 
+## Outside React
+
+Two module-level functions carry the session to code that cannot use hooks, such as a
+data client's request setup:
+
+- `getAccessToken()` — the current token, or undefined. It never returns an expired
+  token: it starts the provider's recovery (per `onUnauthorized`) and returns undefined,
+  and the page comes back from the IdP where it was.
+- `handleUnauthorized()` — report a 401. Only needed for a token rejected before its
+  expiry (a server key rotation, a revoked session); expiry is handled by
+  `getAccessToken`. A no-op while a recovery is already under way.
+
+```ts
+import { getAccessToken, handleUnauthorized } from '@confighub/react-auth';
+import { configureConfigHub } from '@confighub/rtk-query';
+
+configureConfigHub({ baseUrl, getToken: getAccessToken, onUnauthorized: handleUnauthorized });
+```
+
 ## Token posture
 
-The minted token is kept in memory by default; opt in to `sessionStorage` with
-`persist: 'session'`. Never `localStorage`. The transient PKCE state is parked in
-`sessionStorage` across the authorize redirect. A 401 triggers a silent
-re-authentication (see `onUnauthorized`), which needs a live IdP session; refresh
-tokens are not used.
+The minted token is kept in `sessionStorage` (tab-scoped) by default, or in memory
+with `persist: 'none'`. Never `localStorage`. The transient PKCE state is parked in
+`sessionStorage` across the authorize redirect. A rejected or expired token triggers a
+silent re-authentication (see `onUnauthorized`), which needs a live IdP session; refresh
+tokens are not used, so the token's lifetime is the longest a page goes without a
+redirect.
 
 `react` (18 or 19) is a peer dependency.

package/dist/index.cjs

@@ -208,12 +208,28 @@ function resetPending() {
 
 // src/tokenStore.ts
 var currentToken;
+var unauthorizedHandler;
+var recovering = false;
 function setAccessToken(token) {
   currentToken = token;
+  if (token !== void 0) recovering = false;
+}
+function setUnauthorizedHandler(handler) {
+  unauthorizedHandler = handler;
+  recovering = false;
 }
 function getAccessToken() {
+  if (currentToken !== void 0 && isExpired(currentToken)) {
+    handleUnauthorized();
+    return void 0;
+  }
   return currentToken;
 }
+function handleUnauthorized() {
+  if (recovering || !unauthorizedHandler) return;
+  recovering = true;
+  unauthorizedHandler();
+}
 var ConfigHubAuthContext = react.createContext(null);
 var SESSION_KEY = "confighub_session";
 function readPersisted() {
@@ -234,7 +250,7 @@ function ConfigHubAuthProvider({
   baseUrl,
   clientId,
   callbackPath,
-  persist = "none",
+  persist = "session",
   onUnauthorized = "login",
   children
 }) {
@@ -352,14 +368,18 @@ function ConfigHubAuthProvider({
       setStatus("error");
     }
   }, [baseUrl, clientId, flow, persistSession]);
-  const handleUnauthorized = react.useCallback(() => {
+  const handleUnauthorized2 = react.useCallback(() => {
     if (!sessionRef.current) return;
     if (onUnauthorized === "login") void reauthenticate();
     else clearSession();
   }, [clearSession, reauthenticate, onUnauthorized]);
+  react.useEffect(() => {
+    setUnauthorizedHandler(handleUnauthorized2);
+    return () => setUnauthorizedHandler(void 0);
+  }, [handleUnauthorized2]);
   const client = react.useMemo(
-    () => api.createConfigHubClient({ baseUrl, getToken, onUnauthorized: handleUnauthorized }),
-    [baseUrl, getToken, handleUnauthorized]
+    () => api.createConfigHubClient({ baseUrl, getToken, onUnauthorized: handleUnauthorized2 }),
+    [baseUrl, getToken, handleUnauthorized2]
   );
   const value = react.useMemo(
     () => ({
@@ -394,6 +414,7 @@ exports.OrganizationMissing = OrganizationMissing;
 exports.callbackUri = callbackUri;
 exports.decodeJwtClaims = decodeJwtClaims;
 exports.getAccessToken = getAccessToken;
+exports.handleUnauthorized = handleUnauthorized;
 exports.isExpired = isExpired;
 exports.organizationAliasOf = organizationAliasOf;
 exports.rememberedOrganization = rememberedOrganization;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core.ts","../src/tokenStore.ts","../src/provider.tsx","../src/hooks.ts"],"names":["createContext","useState","useRef","useMemo","useCallback","useEffect","switchOrganization","createConfigHubClient","jsx","useContext"],"mappings":";;;;;;;;;AAiGO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC7C,YAA4B,QAAA,EAAkB;AAC5C,IAAA,KAAA,CAAM,2DAA2D,CAAA;AADvC,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOA,IAAM,QAAA,GAAW,gBAAA;AACjB,IAAM,YAAA,GAAe,oBAAA;AAIrB,IAAM,aAAa,CAAC,QAAA,KAA6B,CAAA,EAAG,YAAY,IAAI,QAAQ,CAAA,CAAA;AAGrE,SAAS,uBAAuB,QAAA,EAAsC;AAC3E,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAC,CAAA,IAAK,KAAA,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,oBAAA,CAAqB,UAAkB,KAAA,EAAiC;AACtF,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,GAAG,KAAK,CAAA;AAAA,SACtD,YAAA,CAAa,UAAA,CAAW,UAAA,CAAW,QAAQ,CAAC,CAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAMO,SAAS,oBAAoB,SAAA,EAAwD;AAC1F,EAAA,MAAM,MAAM,SAAA,CAAU,YAAA;AACtB,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,MAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,GAA8B,CAAA;AAC1D,EAAA,OAAO,OAAA,CAAQ,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,CAAC,CAAA,GAAI,MAAA;AAC7C;AAEA,IAAM,YAAY,CAAC,CAAA,KAAsB,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAGtD,IAAM,cAAc,CAAC,IAAA,KAC1B,OAAO,QAAA,CAAS,MAAA,IAAU,MAAM,YAAA,IAAgB,GAAA;AAElD,IAAM,WAAA,GAAc,MAClB,MAAA,CAAO,QAAA,CAAS,WAAW,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,IAAA;AAEtE,IAAM,MAAA,GAAS,CAAC,GAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,IAAI,UAAA,CAAW,GAAG,CAAC,CAAC,CAAA,CAC7C,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEtB,IAAM,YAAA,GAAe,CAAC,CAAA,GAAI,EAAA,KACxB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,MAAM,CAAA;AAEzD,eAAe,OAAO,CAAA,EAA4B;AAChD,EAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAClF;AAGO,SAAS,gBAAgB,KAAA,EAAwC;AACtE,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC/B,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAC,CAAA;AAAA,EACpE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAGO,SAAS,SAAA,CAAU,KAAA,EAAe,WAAA,GAAc,EAAA,EAAa;AAClE,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,KAAK,CAAA,CAAE,GAAA;AACnC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,KAAA;AACpC,EAAA,OAAO,GAAA,GAAM,GAAA,IAAQ,IAAA,CAAK,GAAA,KAAQ,WAAA,GAAc,GAAA;AAClD;AAEA,eAAsB,SAAS,IAAA,EAAkC;AAC/D,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,WAAW,CAAA;AACnD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,oBAAA,GAAuB,EAAE,MAAM,CAAA;AAC1D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAQA,eAAe,aAAa,MAAA,EAAuC;AACjE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,MAAM,IAAI,mCAAmC,CAAA;AAC7E,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,yBAAA,GAA4B,EAAE,MAAM,CAAA;AAC/D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,KAAA,GAAsB,EAAC,EACvB,IAAA,GAAoB,EAAC,EACrB,KAAA,GAAsB,EAAC,EACR;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,KAAK,qBAAA,EAAuB;AACnD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,WAAW,YAAA,EAAa;AAC9B,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,aAAa,EAAE,CAAA;AAC7B,EAAA,MAAM,WAAA,GAAc,YAAY,IAAI,CAAA;AAGpC,EAAA,MAAM,KAAA,GACJ,MAAM,YAAA,KAAiB,IAAA,GACnB,SACC,KAAA,CAAM,YAAA,IAAgB,uBAAuB,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAA,GAAK,cAAA;AACnD,EAAA,MAAM,IAAA,GAAkB;AAAA,IACtB,QAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAe,IAAA,CAAK,cAAA;AAAA,IACpB,kBAAkB,IAAA,CAAK,qBAAA;AAAA,IACvB,WAAA;AAAA,IACA,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY,WAAA,EAAY;AAAA,IACxC,MAAA,EAAQ,MAAM,MAAA,KAAW,MAAA;AAAA,IACzB,kBAAA,EAAoB,KAAA;AAAA,IACpB,wBAAwB,KAAA,CAAM;AAAA,GAChC;AACA,EAAA,cAAA,CAAe,OAAA,CAAQ,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AACrD,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,aAAA,EAAe,MAAA;AAAA,IACf,SAAA,EAAW,QAAA;AAAA,IACX,YAAA,EAAc,WAAA;AAAA,IACd,KAAA,EAAO,wBAAwB,QAAQ,CAAA,CAAA;AAAA,IACvC,cAAA,EAAgB,SAAA;AAAA,IAChB,qBAAA,EAAuB,MAAA;AAAA,IACvB;AAAA,GACF;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,KAAA,CAAM,MAAA;AAExC,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,sBAAsB,CAAA;AACnD,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AACtD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C;AAGA,IAAI,OAAA,GAAgD,IAAA;AAU7C,SAAS,yBAAA,GAA2D;AACzE,EAAA,IAAI,CAAC,OAAA,EAAS,OAAA,GAAU,eAAA,EAAgB;AACxC,EAAA,OAAO,OAAA;AACT;AAEA,IAAM,kCAAkB,IAAI,GAAA,CAAI,CAAC,gBAAA,EAAkB,sBAAA,EAAwB,kBAAkB,CAAC,CAAA;AAE9F,eAAe,eAAA,GAAiD;AAC9D,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,KAAA,EAAO,OAAO,IAAA;AAE5B,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,OAAA,CAAQ,QAAQ,CAAA;AAChD,EAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,EAAA,MAAM,KAAA,GAA0B,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,GAAI,IAAA;AAIlE,EAAA,OAAA,CAAQ,aAAa,EAAC,EAAG,IAAI,KAAA,EAAO,QAAA,IAAY,aAAa,CAAA;AAE7D,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,OAAO,MAAA,IAAU,eAAA,CAAgB,GAAA,CAAI,KAAK,GAAG,OAAO,IAAA;AACxD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,CAAA,EAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,IAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACzF;AAOA,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,IAAI,MAAA,CAAO,IAAI,OAAO,CAAA,KAAM,MAAM,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,0BAA0B,CAAA;AAGnF,EAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,KAAA,CAAM,aAAA,EAAe;AAAA,IACjD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,cAAc,KAAA,CAAM,WAAA;AAAA,MACpB,WAAW,KAAA,CAAM,QAAA;AAAA,MACjB,eAAe,KAAA,CAAM;AAAA,KACtB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,SAAA,CAAU,MAAM,KAAK,MAAM,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACrF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,IAAA,EAAK;AAGtC,EAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,QAAA,CAAS,YAAY,CAAA;AACvD,EAAA,IAAI,CAAC,mBAAA,CAAoB,SAAS,CAAA,IAAK,CAAC,MAAM,sBAAA,EAAwB;AAIpE,IAAA,IAAI,KAAA,CAAM,kBAAA,EAAoB,oBAAA,CAAqB,KAAA,CAAM,UAAU,MAAS,CAAA;AAC5E,IAAA,MAAM,IAAI,mBAAA,CAAoB,KAAA,CAAM,QAAQ,CAAA;AAAA,EAC9C;AACA,EAAA,MAAM,SAAS,MAAM,QAAA,CAAS,KAAA,CAAM,gBAAA,EAAkB,SAAS,YAAY,CAAA;AAC3E,EAAA,oBAAA,CAAqB,KAAA,CAAM,QAAA,EAAU,mBAAA,CAAoB,SAAS,CAAC,CAAA;AACnE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,SAAA;AAAA,IACA,SAAS,OAAO,QAAA,CAAS,QAAA,KAAa,QAAA,GAAW,SAAS,QAAA,GAAW;AAAA,GACvE;AACF;AAEA,eAAe,QAAA,CACb,kBACA,YAAA,EACgE;AAChE,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,iDAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,kBAAA,EAAoB;AAAA,KACrB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,MAAA,CAAO,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,MAAA,CAAO,MAAM,CAAA,EAAA,EAAK,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AACzF,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AACjC,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AAOA,eAAsB,kBAAA,CACpB,IAAA,EACA,WAAA,EACA,cAAA,EACgE;AAChE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,2BAAA,EAA6B;AAAA,IACnE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,WAAW,CAAA,CAAA;AAAA,MACpC,cAAA,EAAgB;AAAA,KAClB;AAAA,IACA,MAAM,IAAI,eAAA,CAAgB,EAAE,eAAA,EAAiB,gBAAgB;AAAA,GAC9D,CAAA;AACD,EAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,CAAA,CAAE,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAA;AACrF,EAAA,MAAM,MAAA,GAAS,MAAM,CAAA,CAAE,IAAA,EAAK;AAC5B,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,OAAA,EACA,qBAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,MAAM,OAAO,IAAA,CAAK,UAAA,GAAa,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA;AACrE,EAAA,IAAI,CAAC,MAAM,oBAAA,EAAsB;AAC/B,IAAA,MAAA,CAAO,QAAA,CAAS,OAAO,qBAAqB,CAAA;AAC5C,IAAA;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,SAAA,EAAW,QAAA;AAAA,IACX,wBAAA,EAA0B;AAAA,GAC5B;AACA,EAAA,IAAI,OAAA,SAAgB,aAAA,GAAgB,OAAA;AACpC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,CAAK,oBAAoB,CAAA;AAC7C,EAAA,GAAA,CAAI,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAClD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,CAAA;AACvC;AAGO,SAAS,YAAA,GAAqB;AACnC,EAAA,OAAA,GAAU,IAAA;AACZ;;;ACvZA,IAAI,YAAA;AAGG,SAAS,eAAe,KAAA,EAAiC;AAC9D,EAAA,YAAA,GAAe,KAAA;AACjB;AAOO,SAAS,cAAA,GAAqC;AACnD,EAAA,OAAO,YAAA;AACT;ACwDO,IAAM,oBAAA,GAAuBA,oBAAgD,IAAI;AA4BxF,IAAM,WAAA,GAAc,mBAAA;AAEpB,SAAS,aAAA,GAAsC;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AAC9C,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,OAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7C,IAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,IAAe,SAAA,CAAU,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1D,MAAA,cAAA,CAAe,WAAW,WAAW,CAAA;AACrC,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQO,SAAS,qBAAA,CAAsB;AAAA,EACpC,OAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA,GAAU,MAAA;AAAA,EACV,cAAA,GAAiB,OAAA;AAAA,EACjB;AACF,CAAA,EAA4C;AAC1C,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAIC,eAAqB,SAAS,CAAA;AAC1D,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIA,eAA+B,IAAI,CAAA;AAC3D,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAuB,IAAI,CAAA;AAIrD,EAAA,MAAM,UAAA,GAAaC,aAAkC,MAAS,CAAA;AAC9D,EAAA,MAAM,IAAA,GAAOC,cAAQ,OAAO,EAAE,cAAa,CAAA,EAAI,CAAC,YAAY,CAAC,CAAA;AAE7D,EAAA,MAAM,cAAA,GAAiBC,iBAAA;AAAA,IACrB,CAAC,OAAA,KAAuC;AACtC,MAAA,IAAI,YAAY,SAAA,EAAW;AAC3B,MAAA,IAAI;AACF,QAAA,IAAI,SAAS,cAAA,CAAe,OAAA,CAAQ,aAAa,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,aACnE,cAAA,CAAe,WAAW,WAAW,CAAA;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAO;AAAA,GACV;AAEA,EAAA,MAAM,YAAA,GAAeA,iBAAA;AAAA,IACnB,CAAC,OAAA,KAA2B;AAC1B,MAAA,UAAA,CAAW,OAAA,GAAU,OAAA;AACrB,MAAA,cAAA,CAAe,QAAQ,WAAW,CAAA;AAClC,MAAA,cAAA,CAAe,OAAO,CAAA;AACtB,MAAA,OAAA,CAAQ,EAAE,cAAA,EAAgB,OAAA,CAAQ,gBAAgB,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAChF,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,SAAA,CAAU,eAAe,CAAA;AAAA,IAC3B,CAAA;AAAA,IACA,CAAC,cAAc;AAAA,GACjB;AAEA,EAAA,MAAM,YAAA,GAAeA,kBAAY,MAAM;AACrC,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,EAC7B,CAAA,EAAG,CAAC,cAAc,CAAC,CAAA;AAEnB,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,yBAAA,EAA0B,CACvB,IAAA,CAAK,CAAC,OAAA,KAAY;AACjB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,OAAA,EAAS,OAAO,YAAA,CAAa,OAAO,CAAA;AACxC,MAAA,MAAM,SAAA,GAAY,OAAA,KAAY,SAAA,GAAY,aAAA,EAAc,GAAI,IAAA;AAC5D,MAAA,IAAI,SAAA,EAAW,OAAO,YAAA,CAAa,SAAS,CAAA;AAC5C,MAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,IAC7B,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,CAAA,KAAe;AACrB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,aAAa,mBAAA,EAAqB;AAEpC,QAAA,KAAK,UAAA;AAAA,UACH,OAAA;AAAA,UACA,QAAA;AAAA,UACA,EAAE,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,cAAc,IAAA,EAAK;AAAA,UAC3C,IAAA;AAAA,UACA,EAAE,wBAAwB,IAAA;AAAK,SACjC;AACA,QAAA;AAAA,MACF;AACA,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB,CAAC,CAAA;AACH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,GAAG,CAAC,YAAA,EAAc,SAAS,OAAA,EAAS,QAAA,EAAU,IAAI,CAAC,CAAA;AAEnD,EAAA,MAAM,KAAA,GAAQD,iBAAA;AAAA,IACZ,OAAO,OAAA,KAA2B;AAChC,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,EAAS,QAAA,EAAU,OAAA,EAAS,IAAI,CAAA;AAAA,MACnD,SAAS,CAAA,EAAY;AACnB,QAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,QAAA,SAAA,CAAU,OAAO,CAAA;AAAA,MACnB;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,IAAI;AAAA,GAC1B;AAEA,EAAA,MAAM,MAAA,GAASA,iBAAA;AAAA,IACb,OAAO,OAAA,KAA4B;AACjC,MAAA,MAAM,OAAA,GAAU,WAAW,OAAA,EAAS,OAAA;AACpC,MAAA,YAAA,EAAa;AACb,MAAA,IAAI,SAAS,UAAA,EAAY;AACvB,QAAA,MAAM,UAAA;AAAA,UACJ,OAAA;AAAA,UACA,QAAA;AAAA,UACA,OAAA;AAAA,UACA,OAAA,CAAQ,qBAAA,IAAyB,WAAA,CAAY,IAAI;AAAA,SACnD;AAAA,MACF;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,YAAA,EAAc,IAAI;AAAA,GACxC;AAEA,EAAA,MAAME,mBAAAA,GAAqBF,iBAAA;AAAA,IACzB,OAAO,cAAA,KAA2B;AAChC,MAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAC3B,MAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mBAAmB,CAAA;AACjD,MAAA,MAAM,SAAS,MAAM,kBAAA,CAAuB,OAAA,EAAS,OAAA,CAAQ,aAAa,cAAc,CAAA;AAGxF,MAAA,oBAAA,CAAqB,UAAU,MAAS,CAAA;AACxC,MAAA,YAAA,CAAa,EAAE,GAAG,OAAA,EAAS,GAAG,QAAQ,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,CAAC,YAAA,EAAc,OAAA,EAAS,QAAQ;AAAA,GAClC;AAEA,EAAA,MAAM,WAAWA,iBAAA,CAAY,MAAM,WAAW,OAAA,EAAS,WAAA,EAAa,EAAE,CAAA;AAEtE,EAAA,MAAM,cAAA,GAAiBA,kBAAY,YAAY;AAC7C,IAAA,MAAM,eAAe,mBAAA,CAAoB,UAAA,CAAW,OAAA,EAAS,SAAA,IAAa,EAAE,CAAA;AAG5E,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,CAAW,SAAS,QAAA,EAAU,EAAE,QAAQ,MAAA,EAAQ,YAAA,IAAgB,IAAI,CAAA;AAAA,IAC5E,SAAS,CAAA,EAAY;AACnB,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,cAAc,CAAC,CAAA;AAK5C,EAAA,MAAM,kBAAA,GAAqBA,kBAAY,MAAM;AAC3C,IAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACzB,IAAA,IAAI,cAAA,KAAmB,OAAA,EAAS,KAAK,cAAA,EAAe;AAAA,SAC/C,YAAA,EAAa;AAAA,EACpB,CAAA,EAAG,CAAC,YAAA,EAAc,cAAA,EAAgB,cAAc,CAAC,CAAA;AAGjD,EAAA,MAAM,MAAA,GAASD,aAAA;AAAA,IACb,MAAMI,yBAAA,CAAsB,EAAE,SAAS,QAAA,EAAU,cAAA,EAAgB,oBAAoB,CAAA;AAAA,IACrF,CAAC,OAAA,EAAS,QAAA,EAAU,kBAAkB;AAAA,GACxC;AAEA,EAAA,MAAM,KAAA,GAAQJ,aAAA;AAAA,IACZ,OAAO;AAAA,MACL,MAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,MACA,kBAAA,EAAAG,mBAAAA;AAAA,MACA,cAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF,CAAA;AAAA,IACA,CAAC,QAAQ,IAAA,EAAM,KAAA,EAAO,OAAO,MAAA,EAAQA,mBAAAA,EAAoB,cAAA,EAAgB,QAAA,EAAU,MAAM;AAAA,GAC3F;AAEA,EAAA,uBACEE,cAAA,CAAC,oBAAA,CAAqB,QAAA,EAArB,EAA8B,OAAe,QAAA,EAAS,CAAA;AAE3D;ACjSO,SAAS,OAAA,GAAqC;AACnD,EAAA,MAAM,GAAA,GAAMC,iBAAW,oBAAoB,CAAA;AAC3C,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,GAAA;AACT;AAYO,SAAS,YAAA,GAAgC;AAC9C,EAAA,OAAO,SAAQ,CAAE,MAAA;AACnB","file":"index.cjs","sourcesContent":["// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n//\n// Framework-neutral browser-auth engine for ConfigHub. Productionized from the\n// reference harness `test/browser-auth/src/confighubAuth.ts` in the ConfigHub\n// monorepo, which is validated end to end against staging and prod.\n//\n// Flow (design: third-party-browser-app-auth.md §6):\n//   GET {base}/api/info                 -> discovery { AuthIssuer, TokenExchangeEndpoint }\n//   OIDC discovery on AuthIssuer        -> authorize/token/end_session endpoints\n//   PKCE authorize + code->token        -> IdP token\n//   POST {TokenExchangeEndpoint} (8693) -> minted ConfigHub token\n//\n// The minted token then rides `Authorization: Bearer` against `/api`. The flow is\n// edition-agnostic: `AuthIssuer` is whatever discovery names (ConfigHub's bundled\n// Keycloak for Cloud, the org's own IdP for Enterprise), so the same code runs\n// against both. Tokens are held by the caller; only the transient PKCE state is\n// parked in sessionStorage across the authorize redirect.\n\nexport interface Discovery {\n  AuthIssuer?: string;\n  TokenExchangeEndpoint?: string;\n  TokenExchangeAudience?: string;\n}\n\nexport interface MintedSession {\n  accessToken: string;\n  organizationId: string;\n  /** Claims of the validated IdP token (owning-org, audience, organization shape). */\n  idpClaims: Record<string, unknown>;\n  /**\n   * The IdP's ID token, kept only so logout can pass it as `id_token_hint` to the\n   * end-session endpoint. Absent for sessions that did not come from an OIDC login.\n   */\n  idToken?: string;\n}\n\nexport interface LoginOptions {\n  /**\n   * Where to land after login, as a same-origin path (`/space/x?tab=units`). Carried\n   * through the authorize round trip in the PKCE state, never in the redirect URI:\n   * OAuth clients register exact redirect URIs, so the URI itself must not vary with\n   * the page the user started from. Defaults to the current path and query.\n   */\n  returnTo?: string;\n  /**\n   * Which organization to sign in to, as the Keycloak organization alias sent in\n   * the `organization:<alias>` scope.\n   *\n   * - a string: that organization, no prompt;\n   * - `undefined` (default): the organization of the last successful login in this\n   *   browser, remembered per client in `localStorage`, so a new tab or a login after\n   *   logout lands in the same organization without a prompt; with nothing\n   *   remembered, Keycloak decides (prompt for a multi-org user, or the org matching\n   *   the email domain on a fresh authentication);\n   * - `null`: no hint on purpose, so Keycloak prompts. This is \"switch organization\".\n   */\n  organization?: string | null;\n  /**\n   * `'none'` asks the IdP to re-authenticate without any UI, failing with\n   * `login_required` if the SSO session is gone -- the way to refresh an expired\n   * ConfigHub token when the user is still signed in at the IdP. `'login'` forces the\n   * login form even with a live SSO session.\n   */\n  prompt?: 'none' | 'login';\n}\n\nexport interface FlowOptions {\n  /**\n   * Same-origin path the IdP redirects back to, and therefore the redirect URI to\n   * register for the client: `{origin}{callbackPath}`. Defaults to `/`.\n   */\n  callbackPath?: string;\n}\n\ninterface PkceState {\n  verifier: string;\n  state: string;\n  clientId: string;\n  tokenEndpoint: string;\n  exchangeEndpoint: string;\n  redirectUri: string;\n  returnTo: string;\n  silent: boolean;\n  /** The organization alias the authorize request hinted, if any. */\n  hintedOrganization?: string;\n  /** This login is already the retry after a token without an organization. */\n  retriedForOrganization?: boolean;\n}\n\n/**\n * Thrown by `completeLoginFromRedirect` when the IdP token names no organization,\n * which the exchange would refuse. Seen on a fresh brokered (Google) login, where\n * Keycloak's organization step does not run; on the next login the SSO session is\n * alive and it does, so the caller logs in again, once, with no hint. Any\n * remembered alias has already been forgotten.\n */\nexport class OrganizationMissing extends Error {\n  constructor(public readonly returnTo: string) {\n    super('the identity provider issued a token with no organization');\n    this.name = 'OrganizationMissing';\n  }\n}\n\nexport interface RetryOptions {\n  /** @internal set by the provider on the one retry after OrganizationMissing. */\n  retriedForOrganization?: boolean;\n}\n\nconst PKCE_KEY = 'confighub_pkce';\nconst LAST_ORG_KEY = 'confighub_last_org';\n\n// The alias is a short public identifier, not a credential, so localStorage is the\n// right place: it must outlive the tab, which is exactly what the token must not.\nconst lastOrgKey = (clientId: string): string => `${LAST_ORG_KEY}:${clientId}`;\n\n/** The organization alias of the last successful login for this client, if any. */\nexport function rememberedOrganization(clientId: string): string | undefined {\n  try {\n    return localStorage.getItem(lastOrgKey(clientId)) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** @internal */\nexport function rememberOrganization(clientId: string, alias: string | undefined): void {\n  try {\n    if (alias) localStorage.setItem(lastOrgKey(clientId), alias);\n    else localStorage.removeItem(lastOrgKey(clientId));\n  } catch {\n    // Storage unavailable: the next login gets no hint.\n  }\n}\n\n/**\n * The alias in an IdP token's `organization` claim (`{ \"<alias>\": { id } }`), or\n * undefined when the claim is absent or names more than one organization.\n */\nexport function organizationAliasOf(idpClaims: Record<string, unknown>): string | undefined {\n  const org = idpClaims.organization;\n  if (!org || typeof org !== 'object') return undefined;\n  const aliases = Object.keys(org as Record<string, unknown>);\n  return aliases.length === 1 ? aliases[0] : undefined;\n}\n\nconst trimSlash = (s: string): string => s.replace(/\\/+$/, '');\n\n/** The fixed callback URI: the page origin plus the configured callback path. */\nexport const callbackUri = (opts?: FlowOptions): string =>\n  window.location.origin + (opts?.callbackPath ?? '/');\n\nconst currentPath = (): string =>\n  window.location.pathname + window.location.search + window.location.hash;\n\nconst b64url = (buf: ArrayBuffer): string =>\n  btoa(String.fromCharCode(...new Uint8Array(buf)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst randomString = (n = 64): string =>\n  b64url(crypto.getRandomValues(new Uint8Array(n)).buffer);\n\nasync function sha256(s: string): Promise<string> {\n  return b64url(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s)));\n}\n\n/** Decode a JWT's claims without verifying it. Returns {} for anything malformed. */\nexport function decodeJwtClaims(token: string): Record<string, unknown> {\n  const part = token.split('.')[1];\n  if (!part) return {};\n  try {\n    return JSON.parse(atob(part.replace(/-/g, '+').replace(/_/g, '/')));\n  } catch {\n    return {};\n  }\n}\n\n/** Whether a JWT's `exp` is in the past (with a small skew allowance). */\nexport function isExpired(token: string, skewSeconds = 30): boolean {\n  const exp = decodeJwtClaims(token).exp;\n  if (typeof exp !== 'number') return false;\n  return exp * 1000 <= Date.now() + skewSeconds * 1000;\n}\n\nexport async function discover(base: string): Promise<Discovery> {\n  const r = await fetch(trimSlash(base) + '/api/info');\n  if (!r.ok) throw new Error('/api/info failed: ' + r.status);\n  return r.json();\n}\n\ninterface OidcMetadata {\n  authorization_endpoint: string;\n  token_endpoint: string;\n  end_session_endpoint?: string;\n}\n\nasync function oidcMetadata(issuer: string): Promise<OidcMetadata> {\n  const r = await fetch(trimSlash(issuer) + '/.well-known/openid-configuration');\n  if (!r.ok) throw new Error('OIDC discovery failed: ' + r.status);\n  return r.json();\n}\n\n/**\n * Discover, build a PKCE request, and navigate to the IdP authorize endpoint.\n * Returns only by redirecting the page; `completeLoginFromRedirect()` finishes on\n * the way back.\n */\nexport async function startLogin(\n  base: string,\n  clientId: string,\n  login: LoginOptions = {},\n  flow: FlowOptions = {},\n  retry: RetryOptions = {},\n): Promise<void> {\n  const info = await discover(base);\n  if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {\n    throw new Error(\n      'this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)',\n    );\n  }\n  const meta = await oidcMetadata(info.AuthIssuer);\n  const verifier = randomString();\n  const challenge = await sha256(verifier);\n  const state = randomString(16);\n  const redirectUri = callbackUri(flow);\n  // The \"organization\" scope makes Keycloak emit the org claim the exchange resolves;\n  // \"organization:<alias>\" selects one without prompting.\n  const alias =\n    login.organization === null\n      ? undefined\n      : (login.organization ?? rememberedOrganization(clientId));\n  const orgScope = alias ? `organization:${alias}` : 'organization';\n  const pkce: PkceState = {\n    verifier,\n    state,\n    clientId,\n    tokenEndpoint: meta.token_endpoint,\n    exchangeEndpoint: info.TokenExchangeEndpoint,\n    redirectUri,\n    returnTo: login.returnTo ?? currentPath(),\n    silent: login.prompt === 'none',\n    hintedOrganization: alias,\n    retriedForOrganization: retry.retriedForOrganization,\n  };\n  sessionStorage.setItem(PKCE_KEY, JSON.stringify(pkce));\n  const params: Record<string, string> = {\n    response_type: 'code',\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    scope: `openid email profile ${orgScope}`,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state,\n  };\n  if (login.prompt) params.prompt = login.prompt;\n\n  const authURL = new URL(meta.authorization_endpoint);\n  authURL.search = new URLSearchParams(params).toString();\n  window.location.assign(authURL.toString());\n}\n\n// Memoize so React StrictMode's double-mount can't redeem the one-time code twice.\nlet pending: Promise<MintedSession | null> | null = null;\n\n/**\n * If the page is the IdP redirect (`?code=...`), exchange the code for an IdP token\n * and then exchange that for a minted ConfigHub token, and restore the URL the\n * login started from. Returns null on a normal load, when a `prompt=none` attempt\n * came back with `login_required` (the SSO session is gone; the caller should offer\n * an interactive login), and when the redirect carries a code this tab has no PKCE\n * state for (an IdP email flow landed here; the caller should start a login).\n */\nexport function completeLoginFromRedirect(): Promise<MintedSession | null> {\n  if (!pending) pending = doCompleteLogin();\n  return pending;\n}\n\nconst SILENT_FAILURES = new Set(['login_required', 'interaction_required', 'consent_required']);\n\nasync function doCompleteLogin(): Promise<MintedSession | null> {\n  const params = new URLSearchParams(window.location.search);\n  const code = params.get('code');\n  const error = params.get('error');\n  if (!code && !error) return null;\n\n  const savedRaw = sessionStorage.getItem(PKCE_KEY);\n  sessionStorage.removeItem(PKCE_KEY);\n  const saved: PkceState | null = savedRaw ? JSON.parse(savedRaw) : null;\n\n  // Put the URL back to where the user started before anything else can fail, so\n  // neither the code nor an error string lingers in the address bar or history.\n  history.replaceState({}, '', saved?.returnTo ?? callbackUri());\n\n  if (error) {\n    if (saved?.silent && SILENT_FAILURES.has(error)) return null;\n    throw new Error(`IdP returned error: ${error} ${params.get('error_description') ?? ''}`);\n  }\n  // A code with no PKCE state means this tab did not start the login: the IdP's\n  // email flows (password reset, verify email) finish the authentication in the tab\n  // the mail link opened and redirect it here, while the verifier sits in the tab\n  // that began. The code is unusable without it, so drop it and report a normal\n  // load; the caller starts a login, which the now-live IdP session completes\n  // without a prompt.\n  if (!saved) return null;\n  if (params.get('state') !== saved.state) throw new Error('state mismatch; aborting');\n\n  // Exchange the authorization code for an IdP token (PKCE, public client).\n  const tokenResp = await fetch(saved.tokenEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'authorization_code',\n      code: code!,\n      redirect_uri: saved.redirectUri,\n      client_id: saved.clientId,\n      code_verifier: saved.verifier,\n    }),\n  });\n  if (!tokenResp.ok) {\n    throw new Error(`IdP token endpoint ${tokenResp.status}: ${await tokenResp.text()}`);\n  }\n  const idpToken = await tokenResp.json();\n\n  // RFC 8693 token exchange against ConfigHub -> minted ConfigHub token.\n  const idpClaims = decodeJwtClaims(idpToken.access_token);\n  if (!organizationAliasOf(idpClaims) && !saved.retriedForOrganization) {\n    // The exchange would refuse this token. Rather than surface that, log in\n    // once more: with the SSO session now alive the IdP runs its organization\n    // step. A hint that was sent evidently did not help, so forget it.\n    if (saved.hintedOrganization) rememberOrganization(saved.clientId, undefined);\n    throw new OrganizationMissing(saved.returnTo);\n  }\n  const minted = await exchange(saved.exchangeEndpoint, idpToken.access_token);\n  rememberOrganization(saved.clientId, organizationAliasOf(idpClaims));\n  return {\n    ...minted,\n    idpClaims,\n    idToken: typeof idpToken.id_token === 'string' ? idpToken.id_token : undefined,\n  };\n}\n\nasync function exchange(\n  exchangeEndpoint: string,\n  subjectToken: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const exResp = await fetch(exchangeEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',\n      subject_token: subjectToken,\n      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',\n    }),\n  });\n  if (!exResp.ok) throw new Error(`/auth/exchange ${exResp.status}: ${await exResp.text()}`);\n  const minted = await exResp.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * Trade the current minted token for one scoped to another organization the user\n * belongs to (`POST {base}/auth/switch-organization`, bearer-authenticated). The\n * IdP session is untouched; only the ConfigHub token changes.\n */\nexport async function switchOrganization(\n  base: string,\n  accessToken: string,\n  organizationId: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const r = await fetch(trimSlash(base) + '/auth/switch-organization', {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n    body: new URLSearchParams({ organization_id: organizationId }),\n  });\n  if (!r.ok) throw new Error(`/auth/switch-organization ${r.status}: ${await r.text()}`);\n  const minted = await r.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * End the IdP session (RP-initiated logout) and land on `postLogoutRedirectUri`,\n * which must be registered for the client. Returns only by redirecting. If the\n * issuer publishes no end-session endpoint, navigates to the redirect URI directly.\n */\nexport async function endSession(\n  base: string,\n  clientId: string,\n  idToken: string | undefined,\n  postLogoutRedirectUri: string,\n): Promise<void> {\n  const info = await discover(base);\n  const meta = info.AuthIssuer ? await oidcMetadata(info.AuthIssuer) : undefined;\n  if (!meta?.end_session_endpoint) {\n    window.location.assign(postLogoutRedirectUri);\n    return;\n  }\n  const params: Record<string, string> = {\n    client_id: clientId,\n    post_logout_redirect_uri: postLogoutRedirectUri,\n  };\n  if (idToken) params.id_token_hint = idToken;\n  const url = new URL(meta.end_session_endpoint);\n  url.search = new URLSearchParams(params).toString();\n  window.location.assign(url.toString());\n}\n\n/** Discard the in-progress login memo (used on logout so a later login re-runs). */\nexport function resetPending(): void {\n  pending = null;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\n// A module-level holder for the current minted token, so non-React consumers can read\n// it. RTK Query's `prepareHeaders` (in @confighub/rtk-query) is not a hook and cannot\n// read React context, so it calls getAccessToken() instead. The provider keeps this in\n// sync with its React state.\nlet currentToken: string | undefined;\n\n/** @internal — called by the provider; not part of the public surface. */\nexport function setAccessToken(token: string | undefined): void {\n  currentToken = token;\n}\n\n/**\n * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as\n * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere\n * you need the token outside React.\n */\nexport function getAccessToken(): string | undefined {\n  return currentToken;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport { createConfigHubClient, type ConfigHubClient } from '@confighub/api';\nimport {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react';\nimport {\n  OrganizationMissing,\n  callbackUri,\n  completeLoginFromRedirect,\n  endSession,\n  isExpired,\n  organizationAliasOf,\n  rememberOrganization,\n  resetPending,\n  startLogin,\n  switchOrganization as switchOrganizationCore,\n  type LoginOptions,\n  type MintedSession,\n} from './core';\nimport { setAccessToken } from './tokenStore';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated' | 'error';\n\nexport interface ConfigHubUser {\n  organizationId: string;\n  idpClaims: Record<string, unknown>;\n}\n\nexport interface LogoutOptions {\n  /**\n   * Also end the IdP session (RP-initiated logout), so the next login asks for\n   * credentials instead of riding the SSO cookie. Redirects the page; the landing\n   * URI must be registered for the client. Default: false, which only forgets the\n   * token in this tab.\n   */\n  endSession?: boolean;\n  /** Where to land after IdP logout. Defaults to the callback URI. */\n  postLogoutRedirectUri?: string;\n}\n\nexport interface ConfigHubAuthContextValue {\n  status: AuthStatus;\n  user: ConfigHubUser | null;\n  error: Error | null;\n  /** Begin login: redirects the page to the IdP. */\n  login: (options?: LoginOptions) => Promise<void>;\n  /** Forget the session in this tab and, optionally, end the IdP session too. */\n  logout: (options?: LogoutOptions) => Promise<void>;\n  /**\n   * Re-mint the ConfigHub token for another organization the user belongs to. The\n   * IdP session is untouched. Rejects with the server's error if the user is not a\n   * member; the current session stays as it was.\n   */\n  switchOrganization: (organizationId: string) => Promise<void>;\n  /**\n   * The ConfigHub token stopped working (a 401). Try to get a new one without any\n   * UI: a `prompt=none` round trip through the IdP, for the organization the session\n   * already had. Status goes to `loading` meanwhile, not `unauthenticated`, so an\n   * app that auto-logs-in on `unauthenticated` does not race this with an\n   * interactive login. If the IdP session is gone too, the page comes back\n   * `unauthenticated`. Redirects the page.\n   */\n  reauthenticate: () => Promise<void>;\n  /** Current bearer token, or undefined when unauthenticated. */\n  getToken: () => string | undefined;\n  /** A typed API client pre-wired with the current token. Stable across renders. */\n  client: ConfigHubClient;\n}\n\nexport const ConfigHubAuthContext = createContext<ConfigHubAuthContextValue | null>(null);\n\nexport interface ConfigHubAuthProviderProps {\n  /** Absolute base URL of the ConfigHub instance, e.g. `https://hub.confighub.com`. */\n  baseUrl: string;\n  /** This app's registered OAuth `client_id` (from `cub oauthclient create`). */\n  clientId: string;\n  /**\n   * Same-origin path the IdP redirects back to; `{origin}{callbackPath}` is the\n   * redirect URI to register. Defaults to `/`. Fixed on purpose: the page a user\n   * starts login from travels in the PKCE state, not in the redirect URI.\n   */\n  callbackPath?: string;\n  /**\n   * `'session'` keeps the minted token in `sessionStorage` so a reload or an in-tab\n   * navigation does not round-trip through the IdP. Tab-scoped and gone when the tab\n   * closes. Default `'none'`: memory only, a reload starts unauthenticated.\n   */\n  persist?: 'none' | 'session';\n  /**\n   * What a 401 from the API means. `'login'` (default): the token is stale, try a\n   * silent re-authentication (`prompt=none`) and fall back to unauthenticated if the\n   * IdP session is gone too. `'logout'`: just drop the session.\n   */\n  onUnauthorized?: 'login' | 'logout';\n  children: ReactNode;\n}\n\nconst SESSION_KEY = 'confighub_session';\n\nfunction readPersisted(): MintedSession | null {\n  try {\n    const raw = sessionStorage.getItem(SESSION_KEY);\n    if (!raw) return null;\n    const session: MintedSession = JSON.parse(raw);\n    if (!session.accessToken || isExpired(session.accessToken)) {\n      sessionStorage.removeItem(SESSION_KEY);\n      return null;\n    }\n    return session;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Runs the browser-direct auth flow and manages the token lifecycle. On mount it\n * completes a redirect if the page is the IdP callback, restores a persisted\n * session if there is one, and otherwise starts unauthenticated until `login()`\n * is called.\n */\nexport function ConfigHubAuthProvider({\n  baseUrl,\n  clientId,\n  callbackPath,\n  persist = 'none',\n  onUnauthorized = 'login',\n  children,\n}: ConfigHubAuthProviderProps): JSX.Element {\n  const [status, setStatus] = useState<AuthStatus>('loading');\n  const [user, setUser] = useState<ConfigHubUser | null>(null);\n  const [error, setError] = useState<Error | null>(null);\n\n  // The session lives in a ref so getToken() reads the latest value synchronously\n  // without re-creating the API client on every render.\n  const sessionRef = useRef<MintedSession | undefined>(undefined);\n  const flow = useMemo(() => ({ callbackPath }), [callbackPath]);\n\n  const persistSession = useCallback(\n    (session: MintedSession | undefined) => {\n      if (persist !== 'session') return;\n      try {\n        if (session) sessionStorage.setItem(SESSION_KEY, JSON.stringify(session));\n        else sessionStorage.removeItem(SESSION_KEY);\n      } catch {\n        // Storage unavailable (private mode, quota): memory-only for this tab.\n      }\n    },\n    [persist],\n  );\n\n  const applySession = useCallback(\n    (session: MintedSession) => {\n      sessionRef.current = session;\n      setAccessToken(session.accessToken); // keep the non-React accessor in sync (rtk-query)\n      persistSession(session);\n      setUser({ organizationId: session.organizationId, idpClaims: session.idpClaims });\n      setError(null);\n      setStatus('authenticated');\n    },\n    [persistSession],\n  );\n\n  const clearSession = useCallback(() => {\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setUser(null);\n    setStatus('unauthenticated');\n  }, [persistSession]);\n\n  useEffect(() => {\n    let cancelled = false;\n    completeLoginFromRedirect()\n      .then((session) => {\n        if (cancelled) return;\n        if (session) return applySession(session);\n        const persisted = persist === 'session' ? readPersisted() : null;\n        if (persisted) return applySession(persisted);\n        setStatus('unauthenticated');\n      })\n      .catch((e: unknown) => {\n        if (cancelled) return;\n        if (e instanceof OrganizationMissing) {\n          // Once, with no hint, flagged so a second miss surfaces as an error.\n          void startLogin(\n            baseUrl,\n            clientId,\n            { returnTo: e.returnTo, organization: null },\n            flow,\n            { retriedForOrganization: true },\n          );\n          return;\n        }\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [applySession, persist, baseUrl, clientId, flow]);\n\n  const login = useCallback(\n    async (options?: LoginOptions) => {\n      setError(null);\n      try {\n        await startLogin(baseUrl, clientId, options, flow);\n      } catch (e: unknown) {\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      }\n    },\n    [baseUrl, clientId, flow],\n  );\n\n  const logout = useCallback(\n    async (options?: LogoutOptions) => {\n      const idToken = sessionRef.current?.idToken;\n      clearSession();\n      if (options?.endSession) {\n        await endSession(\n          baseUrl,\n          clientId,\n          idToken,\n          options.postLogoutRedirectUri ?? callbackUri(flow),\n        );\n      }\n    },\n    [baseUrl, clientId, clearSession, flow],\n  );\n\n  const switchOrganization = useCallback(\n    async (organizationId: string) => {\n      const current = sessionRef.current;\n      if (!current) throw new Error('not authenticated');\n      const minted = await switchOrganizationCore(baseUrl, current.accessToken, organizationId);\n      // The session's IdP claims still name the previous org, so its alias must not\n      // be remembered as the default for the next login.\n      rememberOrganization(clientId, undefined);\n      applySession({ ...current, ...minted });\n    },\n    [applySession, baseUrl, clientId],\n  );\n\n  const getToken = useCallback(() => sessionRef.current?.accessToken, []);\n\n  const reauthenticate = useCallback(async () => {\n    const organization = organizationAliasOf(sessionRef.current?.idpClaims ?? {});\n    // Forget the token but stay 'loading': the page is about to navigate away,\n    // and 'unauthenticated' would invite an interactive login in the meantime.\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setStatus('loading');\n    try {\n      await startLogin(baseUrl, clientId, { prompt: 'none', organization }, flow);\n    } catch (e: unknown) {\n      setError(e instanceof Error ? e : new Error(String(e)));\n      setStatus('error');\n    }\n  }, [baseUrl, clientId, flow, persistSession]);\n\n  // A 401 means the minted token no longer works. Silent re-auth keeps the user's\n  // place if the IdP session is still alive; otherwise the page comes back\n  // unauthenticated and the app offers a real login.\n  const handleUnauthorized = useCallback(() => {\n    if (!sessionRef.current) return;\n    if (onUnauthorized === 'login') void reauthenticate();\n    else clearSession();\n  }, [clearSession, reauthenticate, onUnauthorized]);\n\n  // One client for the provider's lifetime. getToken reads the session ref.\n  const client = useMemo(\n    () => createConfigHubClient({ baseUrl, getToken, onUnauthorized: handleUnauthorized }),\n    [baseUrl, getToken, handleUnauthorized],\n  );\n\n  const value = useMemo<ConfigHubAuthContextValue>(\n    () => ({\n      status,\n      user,\n      error,\n      login,\n      logout,\n      switchOrganization,\n      reauthenticate,\n      getToken,\n      client,\n    }),\n    [status, user, error, login, logout, switchOrganization, reauthenticate, getToken, client],\n  );\n\n  return (\n    <ConfigHubAuthContext.Provider value={value}>{children}</ConfigHubAuthContext.Provider>\n  );\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport type { ConfigHubClient } from '@confighub/api';\nimport { useContext } from 'react';\nimport { ConfigHubAuthContext, type ConfigHubAuthContextValue } from './provider';\n\n/**\n * Access the ConfigHub auth state and actions. Must be called under a\n * `<ConfigHubAuthProvider>`.\n *\n * ```ts\n * const { status, user, login, logout } = useAuth();\n * ```\n */\nexport function useAuth(): ConfigHubAuthContextValue {\n  const ctx = useContext(ConfigHubAuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within a <ConfigHubAuthProvider>');\n  }\n  return ctx;\n}\n\n/**\n * The typed ConfigHub API client, pre-wired with the current token. This is the\n * seam between `@confighub/react-auth` and `@confighub/api`: you never pass a\n * token by hand.\n *\n * ```ts\n * const api = useConfigHub();\n * const { data } = await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });\n * ```\n */\nexport function useConfigHub(): ConfigHubClient {\n  return useAuth().client;\n}\n"]}
+{"version":3,"sources":["../src/core.ts","../src/tokenStore.ts","../src/provider.tsx","../src/hooks.ts"],"names":["createContext","useState","useRef","useMemo","useCallback","useEffect","switchOrganization","handleUnauthorized","createConfigHubClient","jsx","useContext"],"mappings":";;;;;;;;;AAiGO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC7C,YAA4B,QAAA,EAAkB;AAC5C,IAAA,KAAA,CAAM,2DAA2D,CAAA;AADvC,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOA,IAAM,QAAA,GAAW,gBAAA;AACjB,IAAM,YAAA,GAAe,oBAAA;AAIrB,IAAM,aAAa,CAAC,QAAA,KAA6B,CAAA,EAAG,YAAY,IAAI,QAAQ,CAAA,CAAA;AAGrE,SAAS,uBAAuB,QAAA,EAAsC;AAC3E,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAC,CAAA,IAAK,KAAA,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,oBAAA,CAAqB,UAAkB,KAAA,EAAiC;AACtF,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,GAAG,KAAK,CAAA;AAAA,SACtD,YAAA,CAAa,UAAA,CAAW,UAAA,CAAW,QAAQ,CAAC,CAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAMO,SAAS,oBAAoB,SAAA,EAAwD;AAC1F,EAAA,MAAM,MAAM,SAAA,CAAU,YAAA;AACtB,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,MAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,GAA8B,CAAA;AAC1D,EAAA,OAAO,OAAA,CAAQ,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,CAAC,CAAA,GAAI,MAAA;AAC7C;AAEA,IAAM,YAAY,CAAC,CAAA,KAAsB,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAGtD,IAAM,cAAc,CAAC,IAAA,KAC1B,OAAO,QAAA,CAAS,MAAA,IAAU,MAAM,YAAA,IAAgB,GAAA;AAElD,IAAM,WAAA,GAAc,MAClB,MAAA,CAAO,QAAA,CAAS,WAAW,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,IAAA;AAEtE,IAAM,MAAA,GAAS,CAAC,GAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,IAAI,UAAA,CAAW,GAAG,CAAC,CAAC,CAAA,CAC7C,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEtB,IAAM,YAAA,GAAe,CAAC,CAAA,GAAI,EAAA,KACxB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,MAAM,CAAA;AAEzD,eAAe,OAAO,CAAA,EAA4B;AAChD,EAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAClF;AAGO,SAAS,gBAAgB,KAAA,EAAwC;AACtE,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC/B,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAC,CAAA;AAAA,EACpE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAGO,SAAS,SAAA,CAAU,KAAA,EAAe,WAAA,GAAc,EAAA,EAAa;AAClE,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,KAAK,CAAA,CAAE,GAAA;AACnC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,KAAA;AACpC,EAAA,OAAO,GAAA,GAAM,GAAA,IAAQ,IAAA,CAAK,GAAA,KAAQ,WAAA,GAAc,GAAA;AAClD;AAEA,eAAsB,SAAS,IAAA,EAAkC;AAC/D,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,WAAW,CAAA;AACnD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,oBAAA,GAAuB,EAAE,MAAM,CAAA;AAC1D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAQA,eAAe,aAAa,MAAA,EAAuC;AACjE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,MAAM,IAAI,mCAAmC,CAAA;AAC7E,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,yBAAA,GAA4B,EAAE,MAAM,CAAA;AAC/D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,KAAA,GAAsB,EAAC,EACvB,IAAA,GAAoB,EAAC,EACrB,KAAA,GAAsB,EAAC,EACR;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,KAAK,qBAAA,EAAuB;AACnD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,WAAW,YAAA,EAAa;AAC9B,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,aAAa,EAAE,CAAA;AAC7B,EAAA,MAAM,WAAA,GAAc,YAAY,IAAI,CAAA;AAGpC,EAAA,MAAM,KAAA,GACJ,MAAM,YAAA,KAAiB,IAAA,GACnB,SACC,KAAA,CAAM,YAAA,IAAgB,uBAAuB,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAA,GAAK,cAAA;AACnD,EAAA,MAAM,IAAA,GAAkB;AAAA,IACtB,QAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAe,IAAA,CAAK,cAAA;AAAA,IACpB,kBAAkB,IAAA,CAAK,qBAAA;AAAA,IACvB,WAAA;AAAA,IACA,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY,WAAA,EAAY;AAAA,IACxC,MAAA,EAAQ,MAAM,MAAA,KAAW,MAAA;AAAA,IACzB,kBAAA,EAAoB,KAAA;AAAA,IACpB,wBAAwB,KAAA,CAAM;AAAA,GAChC;AACA,EAAA,cAAA,CAAe,OAAA,CAAQ,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AACrD,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,aAAA,EAAe,MAAA;AAAA,IACf,SAAA,EAAW,QAAA;AAAA,IACX,YAAA,EAAc,WAAA;AAAA,IACd,KAAA,EAAO,wBAAwB,QAAQ,CAAA,CAAA;AAAA,IACvC,cAAA,EAAgB,SAAA;AAAA,IAChB,qBAAA,EAAuB,MAAA;AAAA,IACvB;AAAA,GACF;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,KAAA,CAAM,MAAA;AAExC,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,sBAAsB,CAAA;AACnD,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AACtD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C;AAGA,IAAI,OAAA,GAAgD,IAAA;AAU7C,SAAS,yBAAA,GAA2D;AACzE,EAAA,IAAI,CAAC,OAAA,EAAS,OAAA,GAAU,eAAA,EAAgB;AACxC,EAAA,OAAO,OAAA;AACT;AAEA,IAAM,kCAAkB,IAAI,GAAA,CAAI,CAAC,gBAAA,EAAkB,sBAAA,EAAwB,kBAAkB,CAAC,CAAA;AAE9F,eAAe,eAAA,GAAiD;AAC9D,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,KAAA,EAAO,OAAO,IAAA;AAE5B,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,OAAA,CAAQ,QAAQ,CAAA;AAChD,EAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,EAAA,MAAM,KAAA,GAA0B,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,GAAI,IAAA;AAIlE,EAAA,OAAA,CAAQ,aAAa,EAAC,EAAG,IAAI,KAAA,EAAO,QAAA,IAAY,aAAa,CAAA;AAE7D,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,OAAO,MAAA,IAAU,eAAA,CAAgB,GAAA,CAAI,KAAK,GAAG,OAAO,IAAA;AACxD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,CAAA,EAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,IAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACzF;AAOA,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,IAAI,MAAA,CAAO,IAAI,OAAO,CAAA,KAAM,MAAM,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,0BAA0B,CAAA;AAGnF,EAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,KAAA,CAAM,aAAA,EAAe;AAAA,IACjD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,cAAc,KAAA,CAAM,WAAA;AAAA,MACpB,WAAW,KAAA,CAAM,QAAA;AAAA,MACjB,eAAe,KAAA,CAAM;AAAA,KACtB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,SAAA,CAAU,MAAM,KAAK,MAAM,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACrF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,IAAA,EAAK;AAGtC,EAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,QAAA,CAAS,YAAY,CAAA;AACvD,EAAA,IAAI,CAAC,mBAAA,CAAoB,SAAS,CAAA,IAAK,CAAC,MAAM,sBAAA,EAAwB;AAIpE,IAAA,IAAI,KAAA,CAAM,kBAAA,EAAoB,oBAAA,CAAqB,KAAA,CAAM,UAAU,MAAS,CAAA;AAC5E,IAAA,MAAM,IAAI,mBAAA,CAAoB,KAAA,CAAM,QAAQ,CAAA;AAAA,EAC9C;AACA,EAAA,MAAM,SAAS,MAAM,QAAA,CAAS,KAAA,CAAM,gBAAA,EAAkB,SAAS,YAAY,CAAA;AAC3E,EAAA,oBAAA,CAAqB,KAAA,CAAM,QAAA,EAAU,mBAAA,CAAoB,SAAS,CAAC,CAAA;AACnE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,SAAA;AAAA,IACA,SAAS,OAAO,QAAA,CAAS,QAAA,KAAa,QAAA,GAAW,SAAS,QAAA,GAAW;AAAA,GACvE;AACF;AAEA,eAAe,QAAA,CACb,kBACA,YAAA,EACgE;AAChE,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,iDAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,kBAAA,EAAoB;AAAA,KACrB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,MAAA,CAAO,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,MAAA,CAAO,MAAM,CAAA,EAAA,EAAK,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AACzF,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AACjC,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AAOA,eAAsB,kBAAA,CACpB,IAAA,EACA,WAAA,EACA,cAAA,EACgE;AAChE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,2BAAA,EAA6B;AAAA,IACnE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,WAAW,CAAA,CAAA;AAAA,MACpC,cAAA,EAAgB;AAAA,KAClB;AAAA,IACA,MAAM,IAAI,eAAA,CAAgB,EAAE,eAAA,EAAiB,gBAAgB;AAAA,GAC9D,CAAA;AACD,EAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,CAAA,CAAE,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAA;AACrF,EAAA,MAAM,MAAA,GAAS,MAAM,CAAA,CAAE,IAAA,EAAK;AAC5B,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,OAAA,EACA,qBAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,MAAM,OAAO,IAAA,CAAK,UAAA,GAAa,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA;AACrE,EAAA,IAAI,CAAC,MAAM,oBAAA,EAAsB;AAC/B,IAAA,MAAA,CAAO,QAAA,CAAS,OAAO,qBAAqB,CAAA;AAC5C,IAAA;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,SAAA,EAAW,QAAA;AAAA,IACX,wBAAA,EAA0B;AAAA,GAC5B;AACA,EAAA,IAAI,OAAA,SAAgB,aAAA,GAAgB,OAAA;AACpC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,CAAK,oBAAoB,CAAA;AAC7C,EAAA,GAAA,CAAI,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAClD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,CAAA;AACvC;AAGO,SAAS,YAAA,GAAqB;AACnC,EAAA,OAAA,GAAU,IAAA;AACZ;;;ACrZA,IAAI,YAAA;AACJ,IAAI,mBAAA;AAEJ,IAAI,UAAA,GAAa,KAAA;AAGV,SAAS,eAAe,KAAA,EAAiC;AAC9D,EAAA,YAAA,GAAe,KAAA;AACf,EAAA,IAAI,KAAA,KAAU,QAAW,UAAA,GAAa,KAAA;AACxC;AAGO,SAAS,uBAAuB,OAAA,EAAyC;AAC9E,EAAA,mBAAA,GAAsB,OAAA;AACtB,EAAA,UAAA,GAAa,KAAA;AACf;AAYO,SAAS,cAAA,GAAqC;AACnD,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,SAAA,CAAU,YAAY,CAAA,EAAG;AACzD,IAAA,kBAAA,EAAmB;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,YAAA;AACT;AASO,SAAS,kBAAA,GAA2B;AACzC,EAAA,IAAI,UAAA,IAAc,CAAC,mBAAA,EAAqB;AACxC,EAAA,UAAA,GAAa,IAAA;AACb,EAAA,mBAAA,EAAoB;AACtB;ACsBO,IAAM,oBAAA,GAAuBA,oBAAgD,IAAI;AA4BxF,IAAM,WAAA,GAAc,mBAAA;AAEpB,SAAS,aAAA,GAAsC;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AAC9C,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,OAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7C,IAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,IAAe,SAAA,CAAU,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1D,MAAA,cAAA,CAAe,WAAW,WAAW,CAAA;AACrC,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQO,SAAS,qBAAA,CAAsB;AAAA,EACpC,OAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA,GAAU,SAAA;AAAA,EACV,cAAA,GAAiB,OAAA;AAAA,EACjB;AACF,CAAA,EAA4C;AAC1C,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAIC,eAAqB,SAAS,CAAA;AAC1D,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIA,eAA+B,IAAI,CAAA;AAC3D,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAuB,IAAI,CAAA;AAIrD,EAAA,MAAM,UAAA,GAAaC,aAAkC,MAAS,CAAA;AAC9D,EAAA,MAAM,IAAA,GAAOC,cAAQ,OAAO,EAAE,cAAa,CAAA,EAAI,CAAC,YAAY,CAAC,CAAA;AAE7D,EAAA,MAAM,cAAA,GAAiBC,iBAAA;AAAA,IACrB,CAAC,OAAA,KAAuC;AACtC,MAAA,IAAI,YAAY,SAAA,EAAW;AAC3B,MAAA,IAAI;AACF,QAAA,IAAI,SAAS,cAAA,CAAe,OAAA,CAAQ,aAAa,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,aACnE,cAAA,CAAe,WAAW,WAAW,CAAA;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAO;AAAA,GACV;AAEA,EAAA,MAAM,YAAA,GAAeA,iBAAA;AAAA,IACnB,CAAC,OAAA,KAA2B;AAC1B,MAAA,UAAA,CAAW,OAAA,GAAU,OAAA;AACrB,MAAA,cAAA,CAAe,QAAQ,WAAW,CAAA;AAClC,MAAA,cAAA,CAAe,OAAO,CAAA;AACtB,MAAA,OAAA,CAAQ,EAAE,cAAA,EAAgB,OAAA,CAAQ,gBAAgB,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAChF,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,SAAA,CAAU,eAAe,CAAA;AAAA,IAC3B,CAAA;AAAA,IACA,CAAC,cAAc;AAAA,GACjB;AAEA,EAAA,MAAM,YAAA,GAAeA,kBAAY,MAAM;AACrC,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,EAC7B,CAAA,EAAG,CAAC,cAAc,CAAC,CAAA;AAEnB,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,yBAAA,EAA0B,CACvB,IAAA,CAAK,CAAC,OAAA,KAAY;AACjB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,OAAA,EAAS,OAAO,YAAA,CAAa,OAAO,CAAA;AACxC,MAAA,MAAM,SAAA,GAAY,OAAA,KAAY,SAAA,GAAY,aAAA,EAAc,GAAI,IAAA;AAC5D,MAAA,IAAI,SAAA,EAAW,OAAO,YAAA,CAAa,SAAS,CAAA;AAC5C,MAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,IAC7B,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,CAAA,KAAe;AACrB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,aAAa,mBAAA,EAAqB;AAEpC,QAAA,KAAK,UAAA;AAAA,UACH,OAAA;AAAA,UACA,QAAA;AAAA,UACA,EAAE,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,cAAc,IAAA,EAAK;AAAA,UAC3C,IAAA;AAAA,UACA,EAAE,wBAAwB,IAAA;AAAK,SACjC;AACA,QAAA;AAAA,MACF;AACA,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB,CAAC,CAAA;AACH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,GAAG,CAAC,YAAA,EAAc,SAAS,OAAA,EAAS,QAAA,EAAU,IAAI,CAAC,CAAA;AAEnD,EAAA,MAAM,KAAA,GAAQD,iBAAA;AAAA,IACZ,OAAO,OAAA,KAA2B;AAChC,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,EAAS,QAAA,EAAU,OAAA,EAAS,IAAI,CAAA;AAAA,MACnD,SAAS,CAAA,EAAY;AACnB,QAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,QAAA,SAAA,CAAU,OAAO,CAAA;AAAA,MACnB;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,IAAI;AAAA,GAC1B;AAEA,EAAA,MAAM,MAAA,GAASA,iBAAA;AAAA,IACb,OAAO,OAAA,KAA4B;AACjC,MAAA,MAAM,OAAA,GAAU,WAAW,OAAA,EAAS,OAAA;AACpC,MAAA,YAAA,EAAa;AACb,MAAA,IAAI,SAAS,UAAA,EAAY;AACvB,QAAA,MAAM,UAAA;AAAA,UACJ,OAAA;AAAA,UACA,QAAA;AAAA,UACA,OAAA;AAAA,UACA,OAAA,CAAQ,qBAAA,IAAyB,WAAA,CAAY,IAAI;AAAA,SACnD;AAAA,MACF;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,YAAA,EAAc,IAAI;AAAA,GACxC;AAEA,EAAA,MAAME,mBAAAA,GAAqBF,iBAAA;AAAA,IACzB,OAAO,cAAA,KAA2B;AAChC,MAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAC3B,MAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mBAAmB,CAAA;AACjD,MAAA,MAAM,SAAS,MAAM,kBAAA,CAAuB,OAAA,EAAS,OAAA,CAAQ,aAAa,cAAc,CAAA;AAGxF,MAAA,oBAAA,CAAqB,UAAU,MAAS,CAAA;AACxC,MAAA,YAAA,CAAa,EAAE,GAAG,OAAA,EAAS,GAAG,QAAQ,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,CAAC,YAAA,EAAc,OAAA,EAAS,QAAQ;AAAA,GAClC;AAEA,EAAA,MAAM,WAAWA,iBAAA,CAAY,MAAM,WAAW,OAAA,EAAS,WAAA,EAAa,EAAE,CAAA;AAEtE,EAAA,MAAM,cAAA,GAAiBA,kBAAY,YAAY;AAC7C,IAAA,MAAM,eAAe,mBAAA,CAAoB,UAAA,CAAW,OAAA,EAAS,SAAA,IAAa,EAAE,CAAA;AAG5E,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,CAAW,SAAS,QAAA,EAAU,EAAE,QAAQ,MAAA,EAAQ,YAAA,IAAgB,IAAI,CAAA;AAAA,IAC5E,SAAS,CAAA,EAAY;AACnB,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,cAAc,CAAC,CAAA;AAK5C,EAAA,MAAMG,mBAAAA,GAAqBH,kBAAY,MAAM;AAC3C,IAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACzB,IAAA,IAAI,cAAA,KAAmB,OAAA,EAAS,KAAK,cAAA,EAAe;AAAA,SAC/C,YAAA,EAAa;AAAA,EACpB,CAAA,EAAG,CAAC,YAAA,EAAc,cAAA,EAAgB,cAAc,CAAC,CAAA;AAIjD,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,sBAAA,CAAuBE,mBAAkB,CAAA;AACzC,IAAA,OAAO,MAAM,uBAAuB,MAAS,CAAA;AAAA,EAC/C,CAAA,EAAG,CAACA,mBAAkB,CAAC,CAAA;AAGvB,EAAA,MAAM,MAAA,GAASJ,aAAA;AAAA,IACb,MAAMK,yBAAA,CAAsB,EAAE,SAAS,QAAA,EAAU,cAAA,EAAgBD,qBAAoB,CAAA;AAAA,IACrF,CAAC,OAAA,EAAS,QAAA,EAAUA,mBAAkB;AAAA,GACxC;AAEA,EAAA,MAAM,KAAA,GAAQJ,aAAA;AAAA,IACZ,OAAO;AAAA,MACL,MAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,MACA,kBAAA,EAAAG,mBAAAA;AAAA,MACA,cAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF,CAAA;AAAA,IACA,CAAC,QAAQ,IAAA,EAAM,KAAA,EAAO,OAAO,MAAA,EAAQA,mBAAAA,EAAoB,cAAA,EAAgB,QAAA,EAAU,MAAM;AAAA,GAC3F;AAEA,EAAA,uBACEG,cAAA,CAAC,oBAAA,CAAqB,QAAA,EAArB,EAA8B,OAAe,QAAA,EAAS,CAAA;AAE3D;ACxSO,SAAS,OAAA,GAAqC;AACnD,EAAA,MAAM,GAAA,GAAMC,iBAAW,oBAAoB,CAAA;AAC3C,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,GAAA;AACT;AAYO,SAAS,YAAA,GAAgC;AAC9C,EAAA,OAAO,SAAQ,CAAE,MAAA;AACnB","file":"index.cjs","sourcesContent":["// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n//\n// Framework-neutral browser-auth engine for ConfigHub. Productionized from the\n// reference harness `test/browser-auth/src/confighubAuth.ts` in the ConfigHub\n// monorepo, which is validated end to end against staging and prod.\n//\n// Flow (design: third-party-browser-app-auth.md §6):\n//   GET {base}/api/info                 -> discovery { AuthIssuer, TokenExchangeEndpoint }\n//   OIDC discovery on AuthIssuer        -> authorize/token/end_session endpoints\n//   PKCE authorize + code->token        -> IdP token\n//   POST {TokenExchangeEndpoint} (8693) -> minted ConfigHub token\n//\n// The minted token then rides `Authorization: Bearer` against `/api`. The flow is\n// edition-agnostic: `AuthIssuer` is whatever discovery names (ConfigHub's bundled\n// Keycloak for Cloud, the org's own IdP for Enterprise), so the same code runs\n// against both. Tokens are held by the caller; only the transient PKCE state is\n// parked in sessionStorage across the authorize redirect.\n\nexport interface Discovery {\n  AuthIssuer?: string;\n  TokenExchangeEndpoint?: string;\n  TokenExchangeAudience?: string;\n}\n\nexport interface MintedSession {\n  accessToken: string;\n  organizationId: string;\n  /** Claims of the validated IdP token (owning-org, audience, organization shape). */\n  idpClaims: Record<string, unknown>;\n  /**\n   * The IdP's ID token, kept only so logout can pass it as `id_token_hint` to the\n   * end-session endpoint. Absent for sessions that did not come from an OIDC login.\n   */\n  idToken?: string;\n}\n\nexport interface LoginOptions {\n  /**\n   * Where to land after login, as a same-origin path (`/space/x?tab=units`). Carried\n   * through the authorize round trip in the PKCE state, never in the redirect URI:\n   * OAuth clients register exact redirect URIs, so the URI itself must not vary with\n   * the page the user started from. Defaults to the current path and query.\n   */\n  returnTo?: string;\n  /**\n   * Which organization to sign in to, as the Keycloak organization alias sent in\n   * the `organization:<alias>` scope.\n   *\n   * - a string: that organization, no prompt;\n   * - `undefined` (default): the organization of the last successful login in this\n   *   browser, remembered per client in `localStorage`, so a new tab or a login after\n   *   logout lands in the same organization without a prompt; with nothing\n   *   remembered, Keycloak decides (prompt for a multi-org user, or the org matching\n   *   the email domain on a fresh authentication);\n   * - `null`: no hint on purpose, so Keycloak prompts. This is \"switch organization\".\n   */\n  organization?: string | null;\n  /**\n   * `'none'` asks the IdP to re-authenticate without any UI, failing with\n   * `login_required` if the SSO session is gone -- the way to refresh an expired\n   * ConfigHub token when the user is still signed in at the IdP. `'login'` forces the\n   * login form even with a live SSO session.\n   */\n  prompt?: 'none' | 'login';\n}\n\nexport interface FlowOptions {\n  /**\n   * Same-origin path the IdP redirects back to, and therefore the redirect URI to\n   * register for the client: `{origin}{callbackPath}`. Defaults to `/`.\n   */\n  callbackPath?: string;\n}\n\ninterface PkceState {\n  verifier: string;\n  state: string;\n  clientId: string;\n  tokenEndpoint: string;\n  exchangeEndpoint: string;\n  redirectUri: string;\n  returnTo: string;\n  silent: boolean;\n  /** The organization alias the authorize request hinted, if any. */\n  hintedOrganization?: string;\n  /** This login is already the retry after a token without an organization. */\n  retriedForOrganization?: boolean;\n}\n\n/**\n * Thrown by `completeLoginFromRedirect` when the IdP token names no organization,\n * which the exchange would refuse. Seen on a fresh brokered (Google) login, where\n * Keycloak's organization step does not run; on the next login the SSO session is\n * alive and it does, so the caller logs in again, once, with no hint. Any\n * remembered alias has already been forgotten.\n */\nexport class OrganizationMissing extends Error {\n  constructor(public readonly returnTo: string) {\n    super('the identity provider issued a token with no organization');\n    this.name = 'OrganizationMissing';\n  }\n}\n\nexport interface RetryOptions {\n  /** @internal set by the provider on the one retry after OrganizationMissing. */\n  retriedForOrganization?: boolean;\n}\n\nconst PKCE_KEY = 'confighub_pkce';\nconst LAST_ORG_KEY = 'confighub_last_org';\n\n// The alias is a short public identifier, not a credential, so localStorage is the\n// right place: it must outlive the tab, which is exactly what the token must not.\nconst lastOrgKey = (clientId: string): string => `${LAST_ORG_KEY}:${clientId}`;\n\n/** The organization alias of the last successful login for this client, if any. */\nexport function rememberedOrganization(clientId: string): string | undefined {\n  try {\n    return localStorage.getItem(lastOrgKey(clientId)) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** @internal */\nexport function rememberOrganization(clientId: string, alias: string | undefined): void {\n  try {\n    if (alias) localStorage.setItem(lastOrgKey(clientId), alias);\n    else localStorage.removeItem(lastOrgKey(clientId));\n  } catch {\n    // Storage unavailable: the next login gets no hint.\n  }\n}\n\n/**\n * The alias in an IdP token's `organization` claim (`{ \"<alias>\": { id } }`), or\n * undefined when the claim is absent or names more than one organization.\n */\nexport function organizationAliasOf(idpClaims: Record<string, unknown>): string | undefined {\n  const org = idpClaims.organization;\n  if (!org || typeof org !== 'object') return undefined;\n  const aliases = Object.keys(org as Record<string, unknown>);\n  return aliases.length === 1 ? aliases[0] : undefined;\n}\n\nconst trimSlash = (s: string): string => s.replace(/\\/+$/, '');\n\n/** The fixed callback URI: the page origin plus the configured callback path. */\nexport const callbackUri = (opts?: FlowOptions): string =>\n  window.location.origin + (opts?.callbackPath ?? '/');\n\nconst currentPath = (): string =>\n  window.location.pathname + window.location.search + window.location.hash;\n\nconst b64url = (buf: ArrayBuffer): string =>\n  btoa(String.fromCharCode(...new Uint8Array(buf)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst randomString = (n = 64): string =>\n  b64url(crypto.getRandomValues(new Uint8Array(n)).buffer);\n\nasync function sha256(s: string): Promise<string> {\n  return b64url(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s)));\n}\n\n/** Decode a JWT's claims without verifying it. Returns {} for anything malformed. */\nexport function decodeJwtClaims(token: string): Record<string, unknown> {\n  const part = token.split('.')[1];\n  if (!part) return {};\n  try {\n    return JSON.parse(atob(part.replace(/-/g, '+').replace(/_/g, '/')));\n  } catch {\n    return {};\n  }\n}\n\n/** Whether a JWT's `exp` is in the past (with a small skew allowance). */\nexport function isExpired(token: string, skewSeconds = 30): boolean {\n  const exp = decodeJwtClaims(token).exp;\n  if (typeof exp !== 'number') return false;\n  return exp * 1000 <= Date.now() + skewSeconds * 1000;\n}\n\nexport async function discover(base: string): Promise<Discovery> {\n  const r = await fetch(trimSlash(base) + '/api/info');\n  if (!r.ok) throw new Error('/api/info failed: ' + r.status);\n  return r.json();\n}\n\ninterface OidcMetadata {\n  authorization_endpoint: string;\n  token_endpoint: string;\n  end_session_endpoint?: string;\n}\n\nasync function oidcMetadata(issuer: string): Promise<OidcMetadata> {\n  const r = await fetch(trimSlash(issuer) + '/.well-known/openid-configuration');\n  if (!r.ok) throw new Error('OIDC discovery failed: ' + r.status);\n  return r.json();\n}\n\n/**\n * Discover, build a PKCE request, and navigate to the IdP authorize endpoint.\n * Returns only by redirecting the page; `completeLoginFromRedirect()` finishes on\n * the way back.\n */\nexport async function startLogin(\n  base: string,\n  clientId: string,\n  login: LoginOptions = {},\n  flow: FlowOptions = {},\n  retry: RetryOptions = {},\n): Promise<void> {\n  const info = await discover(base);\n  if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {\n    throw new Error(\n      'this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)',\n    );\n  }\n  const meta = await oidcMetadata(info.AuthIssuer);\n  const verifier = randomString();\n  const challenge = await sha256(verifier);\n  const state = randomString(16);\n  const redirectUri = callbackUri(flow);\n  // The \"organization\" scope makes Keycloak emit the org claim the exchange resolves;\n  // \"organization:<alias>\" selects one without prompting.\n  const alias =\n    login.organization === null\n      ? undefined\n      : (login.organization ?? rememberedOrganization(clientId));\n  const orgScope = alias ? `organization:${alias}` : 'organization';\n  const pkce: PkceState = {\n    verifier,\n    state,\n    clientId,\n    tokenEndpoint: meta.token_endpoint,\n    exchangeEndpoint: info.TokenExchangeEndpoint,\n    redirectUri,\n    returnTo: login.returnTo ?? currentPath(),\n    silent: login.prompt === 'none',\n    hintedOrganization: alias,\n    retriedForOrganization: retry.retriedForOrganization,\n  };\n  sessionStorage.setItem(PKCE_KEY, JSON.stringify(pkce));\n  const params: Record<string, string> = {\n    response_type: 'code',\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    scope: `openid email profile ${orgScope}`,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state,\n  };\n  if (login.prompt) params.prompt = login.prompt;\n\n  const authURL = new URL(meta.authorization_endpoint);\n  authURL.search = new URLSearchParams(params).toString();\n  window.location.assign(authURL.toString());\n}\n\n// Memoize so React StrictMode's double-mount can't redeem the one-time code twice.\nlet pending: Promise<MintedSession | null> | null = null;\n\n/**\n * If the page is the IdP redirect (`?code=...`), exchange the code for an IdP token\n * and then exchange that for a minted ConfigHub token, and restore the URL the\n * login started from. Returns null on a normal load, when a `prompt=none` attempt\n * came back with `login_required` (the SSO session is gone; the caller should offer\n * an interactive login), and when the redirect carries a code this tab has no PKCE\n * state for (an IdP email flow landed here; the caller should start a login).\n */\nexport function completeLoginFromRedirect(): Promise<MintedSession | null> {\n  if (!pending) pending = doCompleteLogin();\n  return pending;\n}\n\nconst SILENT_FAILURES = new Set(['login_required', 'interaction_required', 'consent_required']);\n\nasync function doCompleteLogin(): Promise<MintedSession | null> {\n  const params = new URLSearchParams(window.location.search);\n  const code = params.get('code');\n  const error = params.get('error');\n  if (!code && !error) return null;\n\n  const savedRaw = sessionStorage.getItem(PKCE_KEY);\n  sessionStorage.removeItem(PKCE_KEY);\n  const saved: PkceState | null = savedRaw ? JSON.parse(savedRaw) : null;\n\n  // Put the URL back to where the user started before anything else can fail, so\n  // neither the code nor an error string lingers in the address bar or history.\n  history.replaceState({}, '', saved?.returnTo ?? callbackUri());\n\n  if (error) {\n    if (saved?.silent && SILENT_FAILURES.has(error)) return null;\n    throw new Error(`IdP returned error: ${error} ${params.get('error_description') ?? ''}`);\n  }\n  // A code with no PKCE state means this tab did not start the login: the IdP's\n  // email flows (password reset, verify email) finish the authentication in the tab\n  // the mail link opened and redirect it here, while the verifier sits in the tab\n  // that began. The code is unusable without it, so drop it and report a normal\n  // load; the caller starts a login, which the now-live IdP session completes\n  // without a prompt.\n  if (!saved) return null;\n  if (params.get('state') !== saved.state) throw new Error('state mismatch; aborting');\n\n  // Exchange the authorization code for an IdP token (PKCE, public client).\n  const tokenResp = await fetch(saved.tokenEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'authorization_code',\n      code: code!,\n      redirect_uri: saved.redirectUri,\n      client_id: saved.clientId,\n      code_verifier: saved.verifier,\n    }),\n  });\n  if (!tokenResp.ok) {\n    throw new Error(`IdP token endpoint ${tokenResp.status}: ${await tokenResp.text()}`);\n  }\n  const idpToken = await tokenResp.json();\n\n  // RFC 8693 token exchange against ConfigHub -> minted ConfigHub token.\n  const idpClaims = decodeJwtClaims(idpToken.access_token);\n  if (!organizationAliasOf(idpClaims) && !saved.retriedForOrganization) {\n    // The exchange would refuse this token. Rather than surface that, log in\n    // once more: with the SSO session now alive the IdP runs its organization\n    // step. A hint that was sent evidently did not help, so forget it.\n    if (saved.hintedOrganization) rememberOrganization(saved.clientId, undefined);\n    throw new OrganizationMissing(saved.returnTo);\n  }\n  const minted = await exchange(saved.exchangeEndpoint, idpToken.access_token);\n  rememberOrganization(saved.clientId, organizationAliasOf(idpClaims));\n  return {\n    ...minted,\n    idpClaims,\n    idToken: typeof idpToken.id_token === 'string' ? idpToken.id_token : undefined,\n  };\n}\n\nasync function exchange(\n  exchangeEndpoint: string,\n  subjectToken: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const exResp = await fetch(exchangeEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',\n      subject_token: subjectToken,\n      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',\n    }),\n  });\n  if (!exResp.ok) throw new Error(`/auth/exchange ${exResp.status}: ${await exResp.text()}`);\n  const minted = await exResp.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * Trade the current minted token for one scoped to another organization the user\n * belongs to (`POST {base}/auth/switch-organization`, bearer-authenticated). The\n * IdP session is untouched; only the ConfigHub token changes.\n */\nexport async function switchOrganization(\n  base: string,\n  accessToken: string,\n  organizationId: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const r = await fetch(trimSlash(base) + '/auth/switch-organization', {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n    body: new URLSearchParams({ organization_id: organizationId }),\n  });\n  if (!r.ok) throw new Error(`/auth/switch-organization ${r.status}: ${await r.text()}`);\n  const minted = await r.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * End the IdP session (RP-initiated logout) and land on `postLogoutRedirectUri`,\n * which must be registered for the client. Returns only by redirecting. If the\n * issuer publishes no end-session endpoint, navigates to the redirect URI directly.\n */\nexport async function endSession(\n  base: string,\n  clientId: string,\n  idToken: string | undefined,\n  postLogoutRedirectUri: string,\n): Promise<void> {\n  const info = await discover(base);\n  const meta = info.AuthIssuer ? await oidcMetadata(info.AuthIssuer) : undefined;\n  if (!meta?.end_session_endpoint) {\n    window.location.assign(postLogoutRedirectUri);\n    return;\n  }\n  const params: Record<string, string> = {\n    client_id: clientId,\n    post_logout_redirect_uri: postLogoutRedirectUri,\n  };\n  if (idToken) params.id_token_hint = idToken;\n  const url = new URL(meta.end_session_endpoint);\n  url.search = new URLSearchParams(params).toString();\n  window.location.assign(url.toString());\n}\n\n/** Discard the in-progress login memo (used on logout so a later login re-runs). */\nexport function resetPending(): void {\n  pending = null;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\n// A module-level holder for the current minted token, so non-React consumers can read\n// it. RTK Query's `prepareHeaders` (in @confighub/rtk-query) is not a hook and cannot\n// read React context, so it calls getAccessToken() instead. The provider keeps this in\n// sync with its React state, and registers its 401 handling here for the same reason.\nimport { isExpired } from './core';\n\nlet currentToken: string | undefined;\nlet unauthorizedHandler: (() => void) | undefined;\n// Set while a recovery is under way, so a burst of failing requests starts one.\nlet recovering = false;\n\n/** @internal — called by the provider; not part of the public surface. */\nexport function setAccessToken(token: string | undefined): void {\n  currentToken = token;\n  if (token !== undefined) recovering = false;\n}\n\n/** @internal — the mounted provider's reaction to a rejected token. */\nexport function setUnauthorizedHandler(handler: (() => void) | undefined): void {\n  unauthorizedHandler = handler;\n  recovering = false;\n}\n\n/**\n * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as\n * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere\n * you need the token outside React.\n *\n * A token past its `exp` is never handed out: the server would reject it. Instead the\n * provider's recovery starts (a silent re-authentication, or a logout, per its\n * `onUnauthorized`) and the request goes without a token; the page is about to\n * navigate to the IdP and back to where it was.\n */\nexport function getAccessToken(): string | undefined {\n  if (currentToken !== undefined && isExpired(currentToken)) {\n    handleUnauthorized();\n    return undefined;\n  }\n  return currentToken;\n}\n\n/**\n * Tell the mounted provider the API rejected the token (401). Pass this as the\n * `onUnauthorized` for `@confighub/rtk-query`'s `configureConfigHub` to recover from a\n * token rejected before its expiry, e.g. after a server key rotation; expiry itself is\n * handled by `getAccessToken`. A no-op with no provider mounted, and while a recovery\n * is already under way.\n */\nexport function handleUnauthorized(): void {\n  if (recovering || !unauthorizedHandler) return;\n  recovering = true;\n  unauthorizedHandler();\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport { createConfigHubClient, type ConfigHubClient } from '@confighub/api';\nimport {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react';\nimport {\n  OrganizationMissing,\n  callbackUri,\n  completeLoginFromRedirect,\n  endSession,\n  isExpired,\n  organizationAliasOf,\n  rememberOrganization,\n  resetPending,\n  startLogin,\n  switchOrganization as switchOrganizationCore,\n  type LoginOptions,\n  type MintedSession,\n} from './core';\nimport { setAccessToken, setUnauthorizedHandler } from './tokenStore';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated' | 'error';\n\nexport interface ConfigHubUser {\n  organizationId: string;\n  idpClaims: Record<string, unknown>;\n}\n\nexport interface LogoutOptions {\n  /**\n   * Also end the IdP session (RP-initiated logout), so the next login asks for\n   * credentials instead of riding the SSO cookie. Redirects the page; the landing\n   * URI must be registered for the client. Default: false, which only forgets the\n   * token in this tab.\n   */\n  endSession?: boolean;\n  /** Where to land after IdP logout. Defaults to the callback URI. */\n  postLogoutRedirectUri?: string;\n}\n\nexport interface ConfigHubAuthContextValue {\n  status: AuthStatus;\n  user: ConfigHubUser | null;\n  error: Error | null;\n  /** Begin login: redirects the page to the IdP. */\n  login: (options?: LoginOptions) => Promise<void>;\n  /** Forget the session in this tab and, optionally, end the IdP session too. */\n  logout: (options?: LogoutOptions) => Promise<void>;\n  /**\n   * Re-mint the ConfigHub token for another organization the user belongs to. The\n   * IdP session is untouched. Rejects with the server's error if the user is not a\n   * member; the current session stays as it was.\n   */\n  switchOrganization: (organizationId: string) => Promise<void>;\n  /**\n   * The ConfigHub token stopped working (a 401). Try to get a new one without any\n   * UI: a `prompt=none` round trip through the IdP, for the organization the session\n   * already had. Status goes to `loading` meanwhile, not `unauthenticated`, so an\n   * app that auto-logs-in on `unauthenticated` does not race this with an\n   * interactive login. If the IdP session is gone too, the page comes back\n   * `unauthenticated`. Redirects the page.\n   */\n  reauthenticate: () => Promise<void>;\n  /** Current bearer token, or undefined when unauthenticated. */\n  getToken: () => string | undefined;\n  /** A typed API client pre-wired with the current token. Stable across renders. */\n  client: ConfigHubClient;\n}\n\nexport const ConfigHubAuthContext = createContext<ConfigHubAuthContextValue | null>(null);\n\nexport interface ConfigHubAuthProviderProps {\n  /** Absolute base URL of the ConfigHub instance, e.g. `https://hub.confighub.com`. */\n  baseUrl: string;\n  /** This app's registered OAuth `client_id` (from `cub oauthclient create`). */\n  clientId: string;\n  /**\n   * Same-origin path the IdP redirects back to; `{origin}{callbackPath}` is the\n   * redirect URI to register. Defaults to `/`. Fixed on purpose: the page a user\n   * starts login from travels in the PKCE state, not in the redirect URI.\n   */\n  callbackPath?: string;\n  /**\n   * `'session'` (default) keeps the minted token in `sessionStorage` so a reload or an\n   * in-tab navigation does not round-trip through the IdP. Tab-scoped and gone when the\n   * tab closes. `'none'`: memory only, every page load starts unauthenticated.\n   */\n  persist?: 'none' | 'session';\n  /**\n   * What a 401 from the API means. `'login'` (default): the token is stale, try a\n   * silent re-authentication (`prompt=none`) and fall back to unauthenticated if the\n   * IdP session is gone too. `'logout'`: just drop the session.\n   */\n  onUnauthorized?: 'login' | 'logout';\n  children: ReactNode;\n}\n\nconst SESSION_KEY = 'confighub_session';\n\nfunction readPersisted(): MintedSession | null {\n  try {\n    const raw = sessionStorage.getItem(SESSION_KEY);\n    if (!raw) return null;\n    const session: MintedSession = JSON.parse(raw);\n    if (!session.accessToken || isExpired(session.accessToken)) {\n      sessionStorage.removeItem(SESSION_KEY);\n      return null;\n    }\n    return session;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Runs the browser-direct auth flow and manages the token lifecycle. On mount it\n * completes a redirect if the page is the IdP callback, restores a persisted\n * session if there is one, and otherwise starts unauthenticated until `login()`\n * is called.\n */\nexport function ConfigHubAuthProvider({\n  baseUrl,\n  clientId,\n  callbackPath,\n  persist = 'session',\n  onUnauthorized = 'login',\n  children,\n}: ConfigHubAuthProviderProps): JSX.Element {\n  const [status, setStatus] = useState<AuthStatus>('loading');\n  const [user, setUser] = useState<ConfigHubUser | null>(null);\n  const [error, setError] = useState<Error | null>(null);\n\n  // The session lives in a ref so getToken() reads the latest value synchronously\n  // without re-creating the API client on every render.\n  const sessionRef = useRef<MintedSession | undefined>(undefined);\n  const flow = useMemo(() => ({ callbackPath }), [callbackPath]);\n\n  const persistSession = useCallback(\n    (session: MintedSession | undefined) => {\n      if (persist !== 'session') return;\n      try {\n        if (session) sessionStorage.setItem(SESSION_KEY, JSON.stringify(session));\n        else sessionStorage.removeItem(SESSION_KEY);\n      } catch {\n        // Storage unavailable (private mode, quota): memory-only for this tab.\n      }\n    },\n    [persist],\n  );\n\n  const applySession = useCallback(\n    (session: MintedSession) => {\n      sessionRef.current = session;\n      setAccessToken(session.accessToken); // keep the non-React accessor in sync (rtk-query)\n      persistSession(session);\n      setUser({ organizationId: session.organizationId, idpClaims: session.idpClaims });\n      setError(null);\n      setStatus('authenticated');\n    },\n    [persistSession],\n  );\n\n  const clearSession = useCallback(() => {\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setUser(null);\n    setStatus('unauthenticated');\n  }, [persistSession]);\n\n  useEffect(() => {\n    let cancelled = false;\n    completeLoginFromRedirect()\n      .then((session) => {\n        if (cancelled) return;\n        if (session) return applySession(session);\n        const persisted = persist === 'session' ? readPersisted() : null;\n        if (persisted) return applySession(persisted);\n        setStatus('unauthenticated');\n      })\n      .catch((e: unknown) => {\n        if (cancelled) return;\n        if (e instanceof OrganizationMissing) {\n          // Once, with no hint, flagged so a second miss surfaces as an error.\n          void startLogin(\n            baseUrl,\n            clientId,\n            { returnTo: e.returnTo, organization: null },\n            flow,\n            { retriedForOrganization: true },\n          );\n          return;\n        }\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [applySession, persist, baseUrl, clientId, flow]);\n\n  const login = useCallback(\n    async (options?: LoginOptions) => {\n      setError(null);\n      try {\n        await startLogin(baseUrl, clientId, options, flow);\n      } catch (e: unknown) {\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      }\n    },\n    [baseUrl, clientId, flow],\n  );\n\n  const logout = useCallback(\n    async (options?: LogoutOptions) => {\n      const idToken = sessionRef.current?.idToken;\n      clearSession();\n      if (options?.endSession) {\n        await endSession(\n          baseUrl,\n          clientId,\n          idToken,\n          options.postLogoutRedirectUri ?? callbackUri(flow),\n        );\n      }\n    },\n    [baseUrl, clientId, clearSession, flow],\n  );\n\n  const switchOrganization = useCallback(\n    async (organizationId: string) => {\n      const current = sessionRef.current;\n      if (!current) throw new Error('not authenticated');\n      const minted = await switchOrganizationCore(baseUrl, current.accessToken, organizationId);\n      // The session's IdP claims still name the previous org, so its alias must not\n      // be remembered as the default for the next login.\n      rememberOrganization(clientId, undefined);\n      applySession({ ...current, ...minted });\n    },\n    [applySession, baseUrl, clientId],\n  );\n\n  const getToken = useCallback(() => sessionRef.current?.accessToken, []);\n\n  const reauthenticate = useCallback(async () => {\n    const organization = organizationAliasOf(sessionRef.current?.idpClaims ?? {});\n    // Forget the token but stay 'loading': the page is about to navigate away,\n    // and 'unauthenticated' would invite an interactive login in the meantime.\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setStatus('loading');\n    try {\n      await startLogin(baseUrl, clientId, { prompt: 'none', organization }, flow);\n    } catch (e: unknown) {\n      setError(e instanceof Error ? e : new Error(String(e)));\n      setStatus('error');\n    }\n  }, [baseUrl, clientId, flow, persistSession]);\n\n  // A 401 means the minted token no longer works. Silent re-auth keeps the user's\n  // place if the IdP session is still alive; otherwise the page comes back\n  // unauthenticated and the app offers a real login.\n  const handleUnauthorized = useCallback(() => {\n    if (!sessionRef.current) return;\n    if (onUnauthorized === 'login') void reauthenticate();\n    else clearSession();\n  }, [clearSession, reauthenticate, onUnauthorized]);\n\n  // Non-React callers (getAccessToken on an expired token, handleUnauthorized from a\n  // data client's 401) reach this provider's handling through the token store.\n  useEffect(() => {\n    setUnauthorizedHandler(handleUnauthorized);\n    return () => setUnauthorizedHandler(undefined);\n  }, [handleUnauthorized]);\n\n  // One client for the provider's lifetime. getToken reads the session ref.\n  const client = useMemo(\n    () => createConfigHubClient({ baseUrl, getToken, onUnauthorized: handleUnauthorized }),\n    [baseUrl, getToken, handleUnauthorized],\n  );\n\n  const value = useMemo<ConfigHubAuthContextValue>(\n    () => ({\n      status,\n      user,\n      error,\n      login,\n      logout,\n      switchOrganization,\n      reauthenticate,\n      getToken,\n      client,\n    }),\n    [status, user, error, login, logout, switchOrganization, reauthenticate, getToken, client],\n  );\n\n  return (\n    <ConfigHubAuthContext.Provider value={value}>{children}</ConfigHubAuthContext.Provider>\n  );\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport type { ConfigHubClient } from '@confighub/api';\nimport { useContext } from 'react';\nimport { ConfigHubAuthContext, type ConfigHubAuthContextValue } from './provider';\n\n/**\n * Access the ConfigHub auth state and actions. Must be called under a\n * `<ConfigHubAuthProvider>`.\n *\n * ```ts\n * const { status, user, login, logout } = useAuth();\n * ```\n */\nexport function useAuth(): ConfigHubAuthContextValue {\n  const ctx = useContext(ConfigHubAuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within a <ConfigHubAuthProvider>');\n  }\n  return ctx;\n}\n\n/**\n * The typed ConfigHub API client, pre-wired with the current token. This is the\n * seam between `@confighub/react-auth` and `@confighub/api`: you never pass a\n * token by hand.\n *\n * ```ts\n * const api = useConfigHub();\n * const { data } = await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });\n * ```\n */\nexport function useConfigHub(): ConfigHubClient {\n  return useAuth().client;\n}\n"]}

package/dist/index.d.cts

@@ -136,9 +136,9 @@ interface ConfigHubAuthProviderProps {
      */
     callbackPath?: string;
     /**
-     * `'session'` keeps the minted token in `sessionStorage` so a reload or an in-tab
-     * navigation does not round-trip through the IdP. Tab-scoped and gone when the tab
-     * closes. Default `'none'`: memory only, a reload starts unauthenticated.
+     * `'session'` (default) keeps the minted token in `sessionStorage` so a reload or an
+     * in-tab navigation does not round-trip through the IdP. Tab-scoped and gone when the
+     * tab closes. `'none'`: memory only, every page load starts unauthenticated.
      */
     persist?: 'none' | 'session';
     /**
@@ -182,7 +182,20 @@ declare function useConfigHub(): ConfigHubClient;
  * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as
  * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere
  * you need the token outside React.
+ *
+ * A token past its `exp` is never handed out: the server would reject it. Instead the
+ * provider's recovery starts (a silent re-authentication, or a logout, per its
+ * `onUnauthorized`) and the request goes without a token; the page is about to
+ * navigate to the IdP and back to where it was.
  */
 declare function getAccessToken(): string | undefined;
+/**
+ * Tell the mounted provider the API rejected the token (401). Pass this as the
+ * `onUnauthorized` for `@confighub/rtk-query`'s `configureConfigHub` to recover from a
+ * token rejected before its expiry, e.g. after a server key rotation; expiry itself is
+ * handled by `getAccessToken`. A no-op with no provider mounted, and while a recovery
+ * is already under way.
+ */
+declare function handleUnauthorized(): void;
 
-export { type AuthStatus, ConfigHubAuthContext, type ConfigHubAuthContextValue, ConfigHubAuthProvider, type ConfigHubAuthProviderProps, type ConfigHubUser, type Discovery, type FlowOptions, type LoginOptions, type LogoutOptions, type MintedSession, OrganizationMissing, callbackUri, decodeJwtClaims, getAccessToken, isExpired, organizationAliasOf, rememberedOrganization, useAuth, useConfigHub };
+export { type AuthStatus, ConfigHubAuthContext, type ConfigHubAuthContextValue, ConfigHubAuthProvider, type ConfigHubAuthProviderProps, type ConfigHubUser, type Discovery, type FlowOptions, type LoginOptions, type LogoutOptions, type MintedSession, OrganizationMissing, callbackUri, decodeJwtClaims, getAccessToken, handleUnauthorized, isExpired, organizationAliasOf, rememberedOrganization, useAuth, useConfigHub };

package/dist/index.d.ts

@@ -136,9 +136,9 @@ interface ConfigHubAuthProviderProps {
      */
     callbackPath?: string;
     /**
-     * `'session'` keeps the minted token in `sessionStorage` so a reload or an in-tab
-     * navigation does not round-trip through the IdP. Tab-scoped and gone when the tab
-     * closes. Default `'none'`: memory only, a reload starts unauthenticated.
+     * `'session'` (default) keeps the minted token in `sessionStorage` so a reload or an
+     * in-tab navigation does not round-trip through the IdP. Tab-scoped and gone when the
+     * tab closes. `'none'`: memory only, every page load starts unauthenticated.
      */
     persist?: 'none' | 'session';
     /**
@@ -182,7 +182,20 @@ declare function useConfigHub(): ConfigHubClient;
  * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as
  * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere
  * you need the token outside React.
+ *
+ * A token past its `exp` is never handed out: the server would reject it. Instead the
+ * provider's recovery starts (a silent re-authentication, or a logout, per its
+ * `onUnauthorized`) and the request goes without a token; the page is about to
+ * navigate to the IdP and back to where it was.
  */
 declare function getAccessToken(): string | undefined;
+/**
+ * Tell the mounted provider the API rejected the token (401). Pass this as the
+ * `onUnauthorized` for `@confighub/rtk-query`'s `configureConfigHub` to recover from a
+ * token rejected before its expiry, e.g. after a server key rotation; expiry itself is
+ * handled by `getAccessToken`. A no-op with no provider mounted, and while a recovery
+ * is already under way.
+ */
+declare function handleUnauthorized(): void;
 
-export { type AuthStatus, ConfigHubAuthContext, type ConfigHubAuthContextValue, ConfigHubAuthProvider, type ConfigHubAuthProviderProps, type ConfigHubUser, type Discovery, type FlowOptions, type LoginOptions, type LogoutOptions, type MintedSession, OrganizationMissing, callbackUri, decodeJwtClaims, getAccessToken, isExpired, organizationAliasOf, rememberedOrganization, useAuth, useConfigHub };
+export { type AuthStatus, ConfigHubAuthContext, type ConfigHubAuthContextValue, ConfigHubAuthProvider, type ConfigHubAuthProviderProps, type ConfigHubUser, type Discovery, type FlowOptions, type LoginOptions, type LogoutOptions, type MintedSession, OrganizationMissing, callbackUri, decodeJwtClaims, getAccessToken, handleUnauthorized, isExpired, organizationAliasOf, rememberedOrganization, useAuth, useConfigHub };

package/dist/index.js

@@ -206,12 +206,28 @@ function resetPending() {
 
 // src/tokenStore.ts
 var currentToken;
+var unauthorizedHandler;
+var recovering = false;
 function setAccessToken(token) {
   currentToken = token;
+  if (token !== void 0) recovering = false;
+}
+function setUnauthorizedHandler(handler) {
+  unauthorizedHandler = handler;
+  recovering = false;
 }
 function getAccessToken() {
+  if (currentToken !== void 0 && isExpired(currentToken)) {
+    handleUnauthorized();
+    return void 0;
+  }
   return currentToken;
 }
+function handleUnauthorized() {
+  if (recovering || !unauthorizedHandler) return;
+  recovering = true;
+  unauthorizedHandler();
+}
 var ConfigHubAuthContext = createContext(null);
 var SESSION_KEY = "confighub_session";
 function readPersisted() {
@@ -232,7 +248,7 @@ function ConfigHubAuthProvider({
   baseUrl,
   clientId,
   callbackPath,
-  persist = "none",
+  persist = "session",
   onUnauthorized = "login",
   children
 }) {
@@ -350,14 +366,18 @@ function ConfigHubAuthProvider({
       setStatus("error");
     }
   }, [baseUrl, clientId, flow, persistSession]);
-  const handleUnauthorized = useCallback(() => {
+  const handleUnauthorized2 = useCallback(() => {
     if (!sessionRef.current) return;
     if (onUnauthorized === "login") void reauthenticate();
     else clearSession();
   }, [clearSession, reauthenticate, onUnauthorized]);
+  useEffect(() => {
+    setUnauthorizedHandler(handleUnauthorized2);
+    return () => setUnauthorizedHandler(void 0);
+  }, [handleUnauthorized2]);
   const client = useMemo(
-    () => createConfigHubClient({ baseUrl, getToken, onUnauthorized: handleUnauthorized }),
-    [baseUrl, getToken, handleUnauthorized]
+    () => createConfigHubClient({ baseUrl, getToken, onUnauthorized: handleUnauthorized2 }),
+    [baseUrl, getToken, handleUnauthorized2]
   );
   const value = useMemo(
     () => ({
@@ -386,6 +406,6 @@ function useConfigHub() {
   return useAuth().client;
 }
 
-export { ConfigHubAuthContext, ConfigHubAuthProvider, OrganizationMissing, callbackUri, decodeJwtClaims, getAccessToken, isExpired, organizationAliasOf, rememberedOrganization, useAuth, useConfigHub };
+export { ConfigHubAuthContext, ConfigHubAuthProvider, OrganizationMissing, callbackUri, decodeJwtClaims, getAccessToken, handleUnauthorized, isExpired, organizationAliasOf, rememberedOrganization, useAuth, useConfigHub };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core.ts","../src/tokenStore.ts","../src/provider.tsx","../src/hooks.ts"],"names":["switchOrganization"],"mappings":";;;;;;;AAiGO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC7C,YAA4B,QAAA,EAAkB;AAC5C,IAAA,KAAA,CAAM,2DAA2D,CAAA;AADvC,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOA,IAAM,QAAA,GAAW,gBAAA;AACjB,IAAM,YAAA,GAAe,oBAAA;AAIrB,IAAM,aAAa,CAAC,QAAA,KAA6B,CAAA,EAAG,YAAY,IAAI,QAAQ,CAAA,CAAA;AAGrE,SAAS,uBAAuB,QAAA,EAAsC;AAC3E,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAC,CAAA,IAAK,KAAA,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,oBAAA,CAAqB,UAAkB,KAAA,EAAiC;AACtF,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,GAAG,KAAK,CAAA;AAAA,SACtD,YAAA,CAAa,UAAA,CAAW,UAAA,CAAW,QAAQ,CAAC,CAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAMO,SAAS,oBAAoB,SAAA,EAAwD;AAC1F,EAAA,MAAM,MAAM,SAAA,CAAU,YAAA;AACtB,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,MAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,GAA8B,CAAA;AAC1D,EAAA,OAAO,OAAA,CAAQ,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,CAAC,CAAA,GAAI,MAAA;AAC7C;AAEA,IAAM,YAAY,CAAC,CAAA,KAAsB,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAGtD,IAAM,cAAc,CAAC,IAAA,KAC1B,OAAO,QAAA,CAAS,MAAA,IAAU,MAAM,YAAA,IAAgB,GAAA;AAElD,IAAM,WAAA,GAAc,MAClB,MAAA,CAAO,QAAA,CAAS,WAAW,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,IAAA;AAEtE,IAAM,MAAA,GAAS,CAAC,GAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,IAAI,UAAA,CAAW,GAAG,CAAC,CAAC,CAAA,CAC7C,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEtB,IAAM,YAAA,GAAe,CAAC,CAAA,GAAI,EAAA,KACxB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,MAAM,CAAA;AAEzD,eAAe,OAAO,CAAA,EAA4B;AAChD,EAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAClF;AAGO,SAAS,gBAAgB,KAAA,EAAwC;AACtE,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC/B,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAC,CAAA;AAAA,EACpE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAGO,SAAS,SAAA,CAAU,KAAA,EAAe,WAAA,GAAc,EAAA,EAAa;AAClE,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,KAAK,CAAA,CAAE,GAAA;AACnC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,KAAA;AACpC,EAAA,OAAO,GAAA,GAAM,GAAA,IAAQ,IAAA,CAAK,GAAA,KAAQ,WAAA,GAAc,GAAA;AAClD;AAEA,eAAsB,SAAS,IAAA,EAAkC;AAC/D,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,WAAW,CAAA;AACnD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,oBAAA,GAAuB,EAAE,MAAM,CAAA;AAC1D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAQA,eAAe,aAAa,MAAA,EAAuC;AACjE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,MAAM,IAAI,mCAAmC,CAAA;AAC7E,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,yBAAA,GAA4B,EAAE,MAAM,CAAA;AAC/D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,KAAA,GAAsB,EAAC,EACvB,IAAA,GAAoB,EAAC,EACrB,KAAA,GAAsB,EAAC,EACR;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,KAAK,qBAAA,EAAuB;AACnD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,WAAW,YAAA,EAAa;AAC9B,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,aAAa,EAAE,CAAA;AAC7B,EAAA,MAAM,WAAA,GAAc,YAAY,IAAI,CAAA;AAGpC,EAAA,MAAM,KAAA,GACJ,MAAM,YAAA,KAAiB,IAAA,GACnB,SACC,KAAA,CAAM,YAAA,IAAgB,uBAAuB,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAA,GAAK,cAAA;AACnD,EAAA,MAAM,IAAA,GAAkB;AAAA,IACtB,QAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAe,IAAA,CAAK,cAAA;AAAA,IACpB,kBAAkB,IAAA,CAAK,qBAAA;AAAA,IACvB,WAAA;AAAA,IACA,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY,WAAA,EAAY;AAAA,IACxC,MAAA,EAAQ,MAAM,MAAA,KAAW,MAAA;AAAA,IACzB,kBAAA,EAAoB,KAAA;AAAA,IACpB,wBAAwB,KAAA,CAAM;AAAA,GAChC;AACA,EAAA,cAAA,CAAe,OAAA,CAAQ,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AACrD,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,aAAA,EAAe,MAAA;AAAA,IACf,SAAA,EAAW,QAAA;AAAA,IACX,YAAA,EAAc,WAAA;AAAA,IACd,KAAA,EAAO,wBAAwB,QAAQ,CAAA,CAAA;AAAA,IACvC,cAAA,EAAgB,SAAA;AAAA,IAChB,qBAAA,EAAuB,MAAA;AAAA,IACvB;AAAA,GACF;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,KAAA,CAAM,MAAA;AAExC,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,sBAAsB,CAAA;AACnD,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AACtD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C;AAGA,IAAI,OAAA,GAAgD,IAAA;AAU7C,SAAS,yBAAA,GAA2D;AACzE,EAAA,IAAI,CAAC,OAAA,EAAS,OAAA,GAAU,eAAA,EAAgB;AACxC,EAAA,OAAO,OAAA;AACT;AAEA,IAAM,kCAAkB,IAAI,GAAA,CAAI,CAAC,gBAAA,EAAkB,sBAAA,EAAwB,kBAAkB,CAAC,CAAA;AAE9F,eAAe,eAAA,GAAiD;AAC9D,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,KAAA,EAAO,OAAO,IAAA;AAE5B,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,OAAA,CAAQ,QAAQ,CAAA;AAChD,EAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,EAAA,MAAM,KAAA,GAA0B,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,GAAI,IAAA;AAIlE,EAAA,OAAA,CAAQ,aAAa,EAAC,EAAG,IAAI,KAAA,EAAO,QAAA,IAAY,aAAa,CAAA;AAE7D,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,OAAO,MAAA,IAAU,eAAA,CAAgB,GAAA,CAAI,KAAK,GAAG,OAAO,IAAA;AACxD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,CAAA,EAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,IAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACzF;AAOA,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,IAAI,MAAA,CAAO,IAAI,OAAO,CAAA,KAAM,MAAM,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,0BAA0B,CAAA;AAGnF,EAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,KAAA,CAAM,aAAA,EAAe;AAAA,IACjD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,cAAc,KAAA,CAAM,WAAA;AAAA,MACpB,WAAW,KAAA,CAAM,QAAA;AAAA,MACjB,eAAe,KAAA,CAAM;AAAA,KACtB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,SAAA,CAAU,MAAM,KAAK,MAAM,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACrF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,IAAA,EAAK;AAGtC,EAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,QAAA,CAAS,YAAY,CAAA;AACvD,EAAA,IAAI,CAAC,mBAAA,CAAoB,SAAS,CAAA,IAAK,CAAC,MAAM,sBAAA,EAAwB;AAIpE,IAAA,IAAI,KAAA,CAAM,kBAAA,EAAoB,oBAAA,CAAqB,KAAA,CAAM,UAAU,MAAS,CAAA;AAC5E,IAAA,MAAM,IAAI,mBAAA,CAAoB,KAAA,CAAM,QAAQ,CAAA;AAAA,EAC9C;AACA,EAAA,MAAM,SAAS,MAAM,QAAA,CAAS,KAAA,CAAM,gBAAA,EAAkB,SAAS,YAAY,CAAA;AAC3E,EAAA,oBAAA,CAAqB,KAAA,CAAM,QAAA,EAAU,mBAAA,CAAoB,SAAS,CAAC,CAAA;AACnE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,SAAA;AAAA,IACA,SAAS,OAAO,QAAA,CAAS,QAAA,KAAa,QAAA,GAAW,SAAS,QAAA,GAAW;AAAA,GACvE;AACF;AAEA,eAAe,QAAA,CACb,kBACA,YAAA,EACgE;AAChE,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,iDAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,kBAAA,EAAoB;AAAA,KACrB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,MAAA,CAAO,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,MAAA,CAAO,MAAM,CAAA,EAAA,EAAK,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AACzF,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AACjC,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AAOA,eAAsB,kBAAA,CACpB,IAAA,EACA,WAAA,EACA,cAAA,EACgE;AAChE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,2BAAA,EAA6B;AAAA,IACnE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,WAAW,CAAA,CAAA;AAAA,MACpC,cAAA,EAAgB;AAAA,KAClB;AAAA,IACA,MAAM,IAAI,eAAA,CAAgB,EAAE,eAAA,EAAiB,gBAAgB;AAAA,GAC9D,CAAA;AACD,EAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,CAAA,CAAE,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAA;AACrF,EAAA,MAAM,MAAA,GAAS,MAAM,CAAA,CAAE,IAAA,EAAK;AAC5B,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,OAAA,EACA,qBAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,MAAM,OAAO,IAAA,CAAK,UAAA,GAAa,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA;AACrE,EAAA,IAAI,CAAC,MAAM,oBAAA,EAAsB;AAC/B,IAAA,MAAA,CAAO,QAAA,CAAS,OAAO,qBAAqB,CAAA;AAC5C,IAAA;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,SAAA,EAAW,QAAA;AAAA,IACX,wBAAA,EAA0B;AAAA,GAC5B;AACA,EAAA,IAAI,OAAA,SAAgB,aAAA,GAAgB,OAAA;AACpC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,CAAK,oBAAoB,CAAA;AAC7C,EAAA,GAAA,CAAI,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAClD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,CAAA;AACvC;AAGO,SAAS,YAAA,GAAqB;AACnC,EAAA,OAAA,GAAU,IAAA;AACZ;;;ACvZA,IAAI,YAAA;AAGG,SAAS,eAAe,KAAA,EAAiC;AAC9D,EAAA,YAAA,GAAe,KAAA;AACjB;AAOO,SAAS,cAAA,GAAqC;AACnD,EAAA,OAAO,YAAA;AACT;ACwDO,IAAM,oBAAA,GAAuB,cAAgD,IAAI;AA4BxF,IAAM,WAAA,GAAc,mBAAA;AAEpB,SAAS,aAAA,GAAsC;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AAC9C,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,OAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7C,IAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,IAAe,SAAA,CAAU,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1D,MAAA,cAAA,CAAe,WAAW,WAAW,CAAA;AACrC,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQO,SAAS,qBAAA,CAAsB;AAAA,EACpC,OAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA,GAAU,MAAA;AAAA,EACV,cAAA,GAAiB,OAAA;AAAA,EACjB;AACF,CAAA,EAA4C;AAC1C,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,SAAqB,SAAS,CAAA;AAC1D,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAI,SAA+B,IAAI,CAAA;AAC3D,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAI,SAAuB,IAAI,CAAA;AAIrD,EAAA,MAAM,UAAA,GAAa,OAAkC,MAAS,CAAA;AAC9D,EAAA,MAAM,IAAA,GAAO,QAAQ,OAAO,EAAE,cAAa,CAAA,EAAI,CAAC,YAAY,CAAC,CAAA;AAE7D,EAAA,MAAM,cAAA,GAAiB,WAAA;AAAA,IACrB,CAAC,OAAA,KAAuC;AACtC,MAAA,IAAI,YAAY,SAAA,EAAW;AAC3B,MAAA,IAAI;AACF,QAAA,IAAI,SAAS,cAAA,CAAe,OAAA,CAAQ,aAAa,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,aACnE,cAAA,CAAe,WAAW,WAAW,CAAA;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAO;AAAA,GACV;AAEA,EAAA,MAAM,YAAA,GAAe,WAAA;AAAA,IACnB,CAAC,OAAA,KAA2B;AAC1B,MAAA,UAAA,CAAW,OAAA,GAAU,OAAA;AACrB,MAAA,cAAA,CAAe,QAAQ,WAAW,CAAA;AAClC,MAAA,cAAA,CAAe,OAAO,CAAA;AACtB,MAAA,OAAA,CAAQ,EAAE,cAAA,EAAgB,OAAA,CAAQ,gBAAgB,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAChF,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,SAAA,CAAU,eAAe,CAAA;AAAA,IAC3B,CAAA;AAAA,IACA,CAAC,cAAc;AAAA,GACjB;AAEA,EAAA,MAAM,YAAA,GAAe,YAAY,MAAM;AACrC,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,EAC7B,CAAA,EAAG,CAAC,cAAc,CAAC,CAAA;AAEnB,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,yBAAA,EAA0B,CACvB,IAAA,CAAK,CAAC,OAAA,KAAY;AACjB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,OAAA,EAAS,OAAO,YAAA,CAAa,OAAO,CAAA;AACxC,MAAA,MAAM,SAAA,GAAY,OAAA,KAAY,SAAA,GAAY,aAAA,EAAc,GAAI,IAAA;AAC5D,MAAA,IAAI,SAAA,EAAW,OAAO,YAAA,CAAa,SAAS,CAAA;AAC5C,MAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,IAC7B,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,CAAA,KAAe;AACrB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,aAAa,mBAAA,EAAqB;AAEpC,QAAA,KAAK,UAAA;AAAA,UACH,OAAA;AAAA,UACA,QAAA;AAAA,UACA,EAAE,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,cAAc,IAAA,EAAK;AAAA,UAC3C,IAAA;AAAA,UACA,EAAE,wBAAwB,IAAA;AAAK,SACjC;AACA,QAAA;AAAA,MACF;AACA,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB,CAAC,CAAA;AACH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,GAAG,CAAC,YAAA,EAAc,SAAS,OAAA,EAAS,QAAA,EAAU,IAAI,CAAC,CAAA;AAEnD,EAAA,MAAM,KAAA,GAAQ,WAAA;AAAA,IACZ,OAAO,OAAA,KAA2B;AAChC,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,EAAS,QAAA,EAAU,OAAA,EAAS,IAAI,CAAA;AAAA,MACnD,SAAS,CAAA,EAAY;AACnB,QAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,QAAA,SAAA,CAAU,OAAO,CAAA;AAAA,MACnB;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,IAAI;AAAA,GAC1B;AAEA,EAAA,MAAM,MAAA,GAAS,WAAA;AAAA,IACb,OAAO,OAAA,KAA4B;AACjC,MAAA,MAAM,OAAA,GAAU,WAAW,OAAA,EAAS,OAAA;AACpC,MAAA,YAAA,EAAa;AACb,MAAA,IAAI,SAAS,UAAA,EAAY;AACvB,QAAA,MAAM,UAAA;AAAA,UACJ,OAAA;AAAA,UACA,QAAA;AAAA,UACA,OAAA;AAAA,UACA,OAAA,CAAQ,qBAAA,IAAyB,WAAA,CAAY,IAAI;AAAA,SACnD;AAAA,MACF;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,YAAA,EAAc,IAAI;AAAA,GACxC;AAEA,EAAA,MAAMA,mBAAAA,GAAqB,WAAA;AAAA,IACzB,OAAO,cAAA,KAA2B;AAChC,MAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAC3B,MAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mBAAmB,CAAA;AACjD,MAAA,MAAM,SAAS,MAAM,kBAAA,CAAuB,OAAA,EAAS,OAAA,CAAQ,aAAa,cAAc,CAAA;AAGxF,MAAA,oBAAA,CAAqB,UAAU,MAAS,CAAA;AACxC,MAAA,YAAA,CAAa,EAAE,GAAG,OAAA,EAAS,GAAG,QAAQ,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,CAAC,YAAA,EAAc,OAAA,EAAS,QAAQ;AAAA,GAClC;AAEA,EAAA,MAAM,WAAW,WAAA,CAAY,MAAM,WAAW,OAAA,EAAS,WAAA,EAAa,EAAE,CAAA;AAEtE,EAAA,MAAM,cAAA,GAAiB,YAAY,YAAY;AAC7C,IAAA,MAAM,eAAe,mBAAA,CAAoB,UAAA,CAAW,OAAA,EAAS,SAAA,IAAa,EAAE,CAAA;AAG5E,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,CAAW,SAAS,QAAA,EAAU,EAAE,QAAQ,MAAA,EAAQ,YAAA,IAAgB,IAAI,CAAA;AAAA,IAC5E,SAAS,CAAA,EAAY;AACnB,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,cAAc,CAAC,CAAA;AAK5C,EAAA,MAAM,kBAAA,GAAqB,YAAY,MAAM;AAC3C,IAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACzB,IAAA,IAAI,cAAA,KAAmB,OAAA,EAAS,KAAK,cAAA,EAAe;AAAA,SAC/C,YAAA,EAAa;AAAA,EACpB,CAAA,EAAG,CAAC,YAAA,EAAc,cAAA,EAAgB,cAAc,CAAC,CAAA;AAGjD,EAAA,MAAM,MAAA,GAAS,OAAA;AAAA,IACb,MAAM,qBAAA,CAAsB,EAAE,SAAS,QAAA,EAAU,cAAA,EAAgB,oBAAoB,CAAA;AAAA,IACrF,CAAC,OAAA,EAAS,QAAA,EAAU,kBAAkB;AAAA,GACxC;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA;AAAA,IACZ,OAAO;AAAA,MACL,MAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,MACA,kBAAA,EAAAA,mBAAAA;AAAA,MACA,cAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF,CAAA;AAAA,IACA,CAAC,QAAQ,IAAA,EAAM,KAAA,EAAO,OAAO,MAAA,EAAQA,mBAAAA,EAAoB,cAAA,EAAgB,QAAA,EAAU,MAAM;AAAA,GAC3F;AAEA,EAAA,uBACE,GAAA,CAAC,oBAAA,CAAqB,QAAA,EAArB,EAA8B,OAAe,QAAA,EAAS,CAAA;AAE3D;ACjSO,SAAS,OAAA,GAAqC;AACnD,EAAA,MAAM,GAAA,GAAM,WAAW,oBAAoB,CAAA;AAC3C,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,GAAA;AACT;AAYO,SAAS,YAAA,GAAgC;AAC9C,EAAA,OAAO,SAAQ,CAAE,MAAA;AACnB","file":"index.js","sourcesContent":["// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n//\n// Framework-neutral browser-auth engine for ConfigHub. Productionized from the\n// reference harness `test/browser-auth/src/confighubAuth.ts` in the ConfigHub\n// monorepo, which is validated end to end against staging and prod.\n//\n// Flow (design: third-party-browser-app-auth.md §6):\n//   GET {base}/api/info                 -> discovery { AuthIssuer, TokenExchangeEndpoint }\n//   OIDC discovery on AuthIssuer        -> authorize/token/end_session endpoints\n//   PKCE authorize + code->token        -> IdP token\n//   POST {TokenExchangeEndpoint} (8693) -> minted ConfigHub token\n//\n// The minted token then rides `Authorization: Bearer` against `/api`. The flow is\n// edition-agnostic: `AuthIssuer` is whatever discovery names (ConfigHub's bundled\n// Keycloak for Cloud, the org's own IdP for Enterprise), so the same code runs\n// against both. Tokens are held by the caller; only the transient PKCE state is\n// parked in sessionStorage across the authorize redirect.\n\nexport interface Discovery {\n  AuthIssuer?: string;\n  TokenExchangeEndpoint?: string;\n  TokenExchangeAudience?: string;\n}\n\nexport interface MintedSession {\n  accessToken: string;\n  organizationId: string;\n  /** Claims of the validated IdP token (owning-org, audience, organization shape). */\n  idpClaims: Record<string, unknown>;\n  /**\n   * The IdP's ID token, kept only so logout can pass it as `id_token_hint` to the\n   * end-session endpoint. Absent for sessions that did not come from an OIDC login.\n   */\n  idToken?: string;\n}\n\nexport interface LoginOptions {\n  /**\n   * Where to land after login, as a same-origin path (`/space/x?tab=units`). Carried\n   * through the authorize round trip in the PKCE state, never in the redirect URI:\n   * OAuth clients register exact redirect URIs, so the URI itself must not vary with\n   * the page the user started from. Defaults to the current path and query.\n   */\n  returnTo?: string;\n  /**\n   * Which organization to sign in to, as the Keycloak organization alias sent in\n   * the `organization:<alias>` scope.\n   *\n   * - a string: that organization, no prompt;\n   * - `undefined` (default): the organization of the last successful login in this\n   *   browser, remembered per client in `localStorage`, so a new tab or a login after\n   *   logout lands in the same organization without a prompt; with nothing\n   *   remembered, Keycloak decides (prompt for a multi-org user, or the org matching\n   *   the email domain on a fresh authentication);\n   * - `null`: no hint on purpose, so Keycloak prompts. This is \"switch organization\".\n   */\n  organization?: string | null;\n  /**\n   * `'none'` asks the IdP to re-authenticate without any UI, failing with\n   * `login_required` if the SSO session is gone -- the way to refresh an expired\n   * ConfigHub token when the user is still signed in at the IdP. `'login'` forces the\n   * login form even with a live SSO session.\n   */\n  prompt?: 'none' | 'login';\n}\n\nexport interface FlowOptions {\n  /**\n   * Same-origin path the IdP redirects back to, and therefore the redirect URI to\n   * register for the client: `{origin}{callbackPath}`. Defaults to `/`.\n   */\n  callbackPath?: string;\n}\n\ninterface PkceState {\n  verifier: string;\n  state: string;\n  clientId: string;\n  tokenEndpoint: string;\n  exchangeEndpoint: string;\n  redirectUri: string;\n  returnTo: string;\n  silent: boolean;\n  /** The organization alias the authorize request hinted, if any. */\n  hintedOrganization?: string;\n  /** This login is already the retry after a token without an organization. */\n  retriedForOrganization?: boolean;\n}\n\n/**\n * Thrown by `completeLoginFromRedirect` when the IdP token names no organization,\n * which the exchange would refuse. Seen on a fresh brokered (Google) login, where\n * Keycloak's organization step does not run; on the next login the SSO session is\n * alive and it does, so the caller logs in again, once, with no hint. Any\n * remembered alias has already been forgotten.\n */\nexport class OrganizationMissing extends Error {\n  constructor(public readonly returnTo: string) {\n    super('the identity provider issued a token with no organization');\n    this.name = 'OrganizationMissing';\n  }\n}\n\nexport interface RetryOptions {\n  /** @internal set by the provider on the one retry after OrganizationMissing. */\n  retriedForOrganization?: boolean;\n}\n\nconst PKCE_KEY = 'confighub_pkce';\nconst LAST_ORG_KEY = 'confighub_last_org';\n\n// The alias is a short public identifier, not a credential, so localStorage is the\n// right place: it must outlive the tab, which is exactly what the token must not.\nconst lastOrgKey = (clientId: string): string => `${LAST_ORG_KEY}:${clientId}`;\n\n/** The organization alias of the last successful login for this client, if any. */\nexport function rememberedOrganization(clientId: string): string | undefined {\n  try {\n    return localStorage.getItem(lastOrgKey(clientId)) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** @internal */\nexport function rememberOrganization(clientId: string, alias: string | undefined): void {\n  try {\n    if (alias) localStorage.setItem(lastOrgKey(clientId), alias);\n    else localStorage.removeItem(lastOrgKey(clientId));\n  } catch {\n    // Storage unavailable: the next login gets no hint.\n  }\n}\n\n/**\n * The alias in an IdP token's `organization` claim (`{ \"<alias>\": { id } }`), or\n * undefined when the claim is absent or names more than one organization.\n */\nexport function organizationAliasOf(idpClaims: Record<string, unknown>): string | undefined {\n  const org = idpClaims.organization;\n  if (!org || typeof org !== 'object') return undefined;\n  const aliases = Object.keys(org as Record<string, unknown>);\n  return aliases.length === 1 ? aliases[0] : undefined;\n}\n\nconst trimSlash = (s: string): string => s.replace(/\\/+$/, '');\n\n/** The fixed callback URI: the page origin plus the configured callback path. */\nexport const callbackUri = (opts?: FlowOptions): string =>\n  window.location.origin + (opts?.callbackPath ?? '/');\n\nconst currentPath = (): string =>\n  window.location.pathname + window.location.search + window.location.hash;\n\nconst b64url = (buf: ArrayBuffer): string =>\n  btoa(String.fromCharCode(...new Uint8Array(buf)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst randomString = (n = 64): string =>\n  b64url(crypto.getRandomValues(new Uint8Array(n)).buffer);\n\nasync function sha256(s: string): Promise<string> {\n  return b64url(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s)));\n}\n\n/** Decode a JWT's claims without verifying it. Returns {} for anything malformed. */\nexport function decodeJwtClaims(token: string): Record<string, unknown> {\n  const part = token.split('.')[1];\n  if (!part) return {};\n  try {\n    return JSON.parse(atob(part.replace(/-/g, '+').replace(/_/g, '/')));\n  } catch {\n    return {};\n  }\n}\n\n/** Whether a JWT's `exp` is in the past (with a small skew allowance). */\nexport function isExpired(token: string, skewSeconds = 30): boolean {\n  const exp = decodeJwtClaims(token).exp;\n  if (typeof exp !== 'number') return false;\n  return exp * 1000 <= Date.now() + skewSeconds * 1000;\n}\n\nexport async function discover(base: string): Promise<Discovery> {\n  const r = await fetch(trimSlash(base) + '/api/info');\n  if (!r.ok) throw new Error('/api/info failed: ' + r.status);\n  return r.json();\n}\n\ninterface OidcMetadata {\n  authorization_endpoint: string;\n  token_endpoint: string;\n  end_session_endpoint?: string;\n}\n\nasync function oidcMetadata(issuer: string): Promise<OidcMetadata> {\n  const r = await fetch(trimSlash(issuer) + '/.well-known/openid-configuration');\n  if (!r.ok) throw new Error('OIDC discovery failed: ' + r.status);\n  return r.json();\n}\n\n/**\n * Discover, build a PKCE request, and navigate to the IdP authorize endpoint.\n * Returns only by redirecting the page; `completeLoginFromRedirect()` finishes on\n * the way back.\n */\nexport async function startLogin(\n  base: string,\n  clientId: string,\n  login: LoginOptions = {},\n  flow: FlowOptions = {},\n  retry: RetryOptions = {},\n): Promise<void> {\n  const info = await discover(base);\n  if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {\n    throw new Error(\n      'this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)',\n    );\n  }\n  const meta = await oidcMetadata(info.AuthIssuer);\n  const verifier = randomString();\n  const challenge = await sha256(verifier);\n  const state = randomString(16);\n  const redirectUri = callbackUri(flow);\n  // The \"organization\" scope makes Keycloak emit the org claim the exchange resolves;\n  // \"organization:<alias>\" selects one without prompting.\n  const alias =\n    login.organization === null\n      ? undefined\n      : (login.organization ?? rememberedOrganization(clientId));\n  const orgScope = alias ? `organization:${alias}` : 'organization';\n  const pkce: PkceState = {\n    verifier,\n    state,\n    clientId,\n    tokenEndpoint: meta.token_endpoint,\n    exchangeEndpoint: info.TokenExchangeEndpoint,\n    redirectUri,\n    returnTo: login.returnTo ?? currentPath(),\n    silent: login.prompt === 'none',\n    hintedOrganization: alias,\n    retriedForOrganization: retry.retriedForOrganization,\n  };\n  sessionStorage.setItem(PKCE_KEY, JSON.stringify(pkce));\n  const params: Record<string, string> = {\n    response_type: 'code',\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    scope: `openid email profile ${orgScope}`,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state,\n  };\n  if (login.prompt) params.prompt = login.prompt;\n\n  const authURL = new URL(meta.authorization_endpoint);\n  authURL.search = new URLSearchParams(params).toString();\n  window.location.assign(authURL.toString());\n}\n\n// Memoize so React StrictMode's double-mount can't redeem the one-time code twice.\nlet pending: Promise<MintedSession | null> | null = null;\n\n/**\n * If the page is the IdP redirect (`?code=...`), exchange the code for an IdP token\n * and then exchange that for a minted ConfigHub token, and restore the URL the\n * login started from. Returns null on a normal load, when a `prompt=none` attempt\n * came back with `login_required` (the SSO session is gone; the caller should offer\n * an interactive login), and when the redirect carries a code this tab has no PKCE\n * state for (an IdP email flow landed here; the caller should start a login).\n */\nexport function completeLoginFromRedirect(): Promise<MintedSession | null> {\n  if (!pending) pending = doCompleteLogin();\n  return pending;\n}\n\nconst SILENT_FAILURES = new Set(['login_required', 'interaction_required', 'consent_required']);\n\nasync function doCompleteLogin(): Promise<MintedSession | null> {\n  const params = new URLSearchParams(window.location.search);\n  const code = params.get('code');\n  const error = params.get('error');\n  if (!code && !error) return null;\n\n  const savedRaw = sessionStorage.getItem(PKCE_KEY);\n  sessionStorage.removeItem(PKCE_KEY);\n  const saved: PkceState | null = savedRaw ? JSON.parse(savedRaw) : null;\n\n  // Put the URL back to where the user started before anything else can fail, so\n  // neither the code nor an error string lingers in the address bar or history.\n  history.replaceState({}, '', saved?.returnTo ?? callbackUri());\n\n  if (error) {\n    if (saved?.silent && SILENT_FAILURES.has(error)) return null;\n    throw new Error(`IdP returned error: ${error} ${params.get('error_description') ?? ''}`);\n  }\n  // A code with no PKCE state means this tab did not start the login: the IdP's\n  // email flows (password reset, verify email) finish the authentication in the tab\n  // the mail link opened and redirect it here, while the verifier sits in the tab\n  // that began. The code is unusable without it, so drop it and report a normal\n  // load; the caller starts a login, which the now-live IdP session completes\n  // without a prompt.\n  if (!saved) return null;\n  if (params.get('state') !== saved.state) throw new Error('state mismatch; aborting');\n\n  // Exchange the authorization code for an IdP token (PKCE, public client).\n  const tokenResp = await fetch(saved.tokenEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'authorization_code',\n      code: code!,\n      redirect_uri: saved.redirectUri,\n      client_id: saved.clientId,\n      code_verifier: saved.verifier,\n    }),\n  });\n  if (!tokenResp.ok) {\n    throw new Error(`IdP token endpoint ${tokenResp.status}: ${await tokenResp.text()}`);\n  }\n  const idpToken = await tokenResp.json();\n\n  // RFC 8693 token exchange against ConfigHub -> minted ConfigHub token.\n  const idpClaims = decodeJwtClaims(idpToken.access_token);\n  if (!organizationAliasOf(idpClaims) && !saved.retriedForOrganization) {\n    // The exchange would refuse this token. Rather than surface that, log in\n    // once more: with the SSO session now alive the IdP runs its organization\n    // step. A hint that was sent evidently did not help, so forget it.\n    if (saved.hintedOrganization) rememberOrganization(saved.clientId, undefined);\n    throw new OrganizationMissing(saved.returnTo);\n  }\n  const minted = await exchange(saved.exchangeEndpoint, idpToken.access_token);\n  rememberOrganization(saved.clientId, organizationAliasOf(idpClaims));\n  return {\n    ...minted,\n    idpClaims,\n    idToken: typeof idpToken.id_token === 'string' ? idpToken.id_token : undefined,\n  };\n}\n\nasync function exchange(\n  exchangeEndpoint: string,\n  subjectToken: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const exResp = await fetch(exchangeEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',\n      subject_token: subjectToken,\n      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',\n    }),\n  });\n  if (!exResp.ok) throw new Error(`/auth/exchange ${exResp.status}: ${await exResp.text()}`);\n  const minted = await exResp.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * Trade the current minted token for one scoped to another organization the user\n * belongs to (`POST {base}/auth/switch-organization`, bearer-authenticated). The\n * IdP session is untouched; only the ConfigHub token changes.\n */\nexport async function switchOrganization(\n  base: string,\n  accessToken: string,\n  organizationId: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const r = await fetch(trimSlash(base) + '/auth/switch-organization', {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n    body: new URLSearchParams({ organization_id: organizationId }),\n  });\n  if (!r.ok) throw new Error(`/auth/switch-organization ${r.status}: ${await r.text()}`);\n  const minted = await r.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * End the IdP session (RP-initiated logout) and land on `postLogoutRedirectUri`,\n * which must be registered for the client. Returns only by redirecting. If the\n * issuer publishes no end-session endpoint, navigates to the redirect URI directly.\n */\nexport async function endSession(\n  base: string,\n  clientId: string,\n  idToken: string | undefined,\n  postLogoutRedirectUri: string,\n): Promise<void> {\n  const info = await discover(base);\n  const meta = info.AuthIssuer ? await oidcMetadata(info.AuthIssuer) : undefined;\n  if (!meta?.end_session_endpoint) {\n    window.location.assign(postLogoutRedirectUri);\n    return;\n  }\n  const params: Record<string, string> = {\n    client_id: clientId,\n    post_logout_redirect_uri: postLogoutRedirectUri,\n  };\n  if (idToken) params.id_token_hint = idToken;\n  const url = new URL(meta.end_session_endpoint);\n  url.search = new URLSearchParams(params).toString();\n  window.location.assign(url.toString());\n}\n\n/** Discard the in-progress login memo (used on logout so a later login re-runs). */\nexport function resetPending(): void {\n  pending = null;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\n// A module-level holder for the current minted token, so non-React consumers can read\n// it. RTK Query's `prepareHeaders` (in @confighub/rtk-query) is not a hook and cannot\n// read React context, so it calls getAccessToken() instead. The provider keeps this in\n// sync with its React state.\nlet currentToken: string | undefined;\n\n/** @internal — called by the provider; not part of the public surface. */\nexport function setAccessToken(token: string | undefined): void {\n  currentToken = token;\n}\n\n/**\n * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as\n * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere\n * you need the token outside React.\n */\nexport function getAccessToken(): string | undefined {\n  return currentToken;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport { createConfigHubClient, type ConfigHubClient } from '@confighub/api';\nimport {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react';\nimport {\n  OrganizationMissing,\n  callbackUri,\n  completeLoginFromRedirect,\n  endSession,\n  isExpired,\n  organizationAliasOf,\n  rememberOrganization,\n  resetPending,\n  startLogin,\n  switchOrganization as switchOrganizationCore,\n  type LoginOptions,\n  type MintedSession,\n} from './core';\nimport { setAccessToken } from './tokenStore';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated' | 'error';\n\nexport interface ConfigHubUser {\n  organizationId: string;\n  idpClaims: Record<string, unknown>;\n}\n\nexport interface LogoutOptions {\n  /**\n   * Also end the IdP session (RP-initiated logout), so the next login asks for\n   * credentials instead of riding the SSO cookie. Redirects the page; the landing\n   * URI must be registered for the client. Default: false, which only forgets the\n   * token in this tab.\n   */\n  endSession?: boolean;\n  /** Where to land after IdP logout. Defaults to the callback URI. */\n  postLogoutRedirectUri?: string;\n}\n\nexport interface ConfigHubAuthContextValue {\n  status: AuthStatus;\n  user: ConfigHubUser | null;\n  error: Error | null;\n  /** Begin login: redirects the page to the IdP. */\n  login: (options?: LoginOptions) => Promise<void>;\n  /** Forget the session in this tab and, optionally, end the IdP session too. */\n  logout: (options?: LogoutOptions) => Promise<void>;\n  /**\n   * Re-mint the ConfigHub token for another organization the user belongs to. The\n   * IdP session is untouched. Rejects with the server's error if the user is not a\n   * member; the current session stays as it was.\n   */\n  switchOrganization: (organizationId: string) => Promise<void>;\n  /**\n   * The ConfigHub token stopped working (a 401). Try to get a new one without any\n   * UI: a `prompt=none` round trip through the IdP, for the organization the session\n   * already had. Status goes to `loading` meanwhile, not `unauthenticated`, so an\n   * app that auto-logs-in on `unauthenticated` does not race this with an\n   * interactive login. If the IdP session is gone too, the page comes back\n   * `unauthenticated`. Redirects the page.\n   */\n  reauthenticate: () => Promise<void>;\n  /** Current bearer token, or undefined when unauthenticated. */\n  getToken: () => string | undefined;\n  /** A typed API client pre-wired with the current token. Stable across renders. */\n  client: ConfigHubClient;\n}\n\nexport const ConfigHubAuthContext = createContext<ConfigHubAuthContextValue | null>(null);\n\nexport interface ConfigHubAuthProviderProps {\n  /** Absolute base URL of the ConfigHub instance, e.g. `https://hub.confighub.com`. */\n  baseUrl: string;\n  /** This app's registered OAuth `client_id` (from `cub oauthclient create`). */\n  clientId: string;\n  /**\n   * Same-origin path the IdP redirects back to; `{origin}{callbackPath}` is the\n   * redirect URI to register. Defaults to `/`. Fixed on purpose: the page a user\n   * starts login from travels in the PKCE state, not in the redirect URI.\n   */\n  callbackPath?: string;\n  /**\n   * `'session'` keeps the minted token in `sessionStorage` so a reload or an in-tab\n   * navigation does not round-trip through the IdP. Tab-scoped and gone when the tab\n   * closes. Default `'none'`: memory only, a reload starts unauthenticated.\n   */\n  persist?: 'none' | 'session';\n  /**\n   * What a 401 from the API means. `'login'` (default): the token is stale, try a\n   * silent re-authentication (`prompt=none`) and fall back to unauthenticated if the\n   * IdP session is gone too. `'logout'`: just drop the session.\n   */\n  onUnauthorized?: 'login' | 'logout';\n  children: ReactNode;\n}\n\nconst SESSION_KEY = 'confighub_session';\n\nfunction readPersisted(): MintedSession | null {\n  try {\n    const raw = sessionStorage.getItem(SESSION_KEY);\n    if (!raw) return null;\n    const session: MintedSession = JSON.parse(raw);\n    if (!session.accessToken || isExpired(session.accessToken)) {\n      sessionStorage.removeItem(SESSION_KEY);\n      return null;\n    }\n    return session;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Runs the browser-direct auth flow and manages the token lifecycle. On mount it\n * completes a redirect if the page is the IdP callback, restores a persisted\n * session if there is one, and otherwise starts unauthenticated until `login()`\n * is called.\n */\nexport function ConfigHubAuthProvider({\n  baseUrl,\n  clientId,\n  callbackPath,\n  persist = 'none',\n  onUnauthorized = 'login',\n  children,\n}: ConfigHubAuthProviderProps): JSX.Element {\n  const [status, setStatus] = useState<AuthStatus>('loading');\n  const [user, setUser] = useState<ConfigHubUser | null>(null);\n  const [error, setError] = useState<Error | null>(null);\n\n  // The session lives in a ref so getToken() reads the latest value synchronously\n  // without re-creating the API client on every render.\n  const sessionRef = useRef<MintedSession | undefined>(undefined);\n  const flow = useMemo(() => ({ callbackPath }), [callbackPath]);\n\n  const persistSession = useCallback(\n    (session: MintedSession | undefined) => {\n      if (persist !== 'session') return;\n      try {\n        if (session) sessionStorage.setItem(SESSION_KEY, JSON.stringify(session));\n        else sessionStorage.removeItem(SESSION_KEY);\n      } catch {\n        // Storage unavailable (private mode, quota): memory-only for this tab.\n      }\n    },\n    [persist],\n  );\n\n  const applySession = useCallback(\n    (session: MintedSession) => {\n      sessionRef.current = session;\n      setAccessToken(session.accessToken); // keep the non-React accessor in sync (rtk-query)\n      persistSession(session);\n      setUser({ organizationId: session.organizationId, idpClaims: session.idpClaims });\n      setError(null);\n      setStatus('authenticated');\n    },\n    [persistSession],\n  );\n\n  const clearSession = useCallback(() => {\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setUser(null);\n    setStatus('unauthenticated');\n  }, [persistSession]);\n\n  useEffect(() => {\n    let cancelled = false;\n    completeLoginFromRedirect()\n      .then((session) => {\n        if (cancelled) return;\n        if (session) return applySession(session);\n        const persisted = persist === 'session' ? readPersisted() : null;\n        if (persisted) return applySession(persisted);\n        setStatus('unauthenticated');\n      })\n      .catch((e: unknown) => {\n        if (cancelled) return;\n        if (e instanceof OrganizationMissing) {\n          // Once, with no hint, flagged so a second miss surfaces as an error.\n          void startLogin(\n            baseUrl,\n            clientId,\n            { returnTo: e.returnTo, organization: null },\n            flow,\n            { retriedForOrganization: true },\n          );\n          return;\n        }\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [applySession, persist, baseUrl, clientId, flow]);\n\n  const login = useCallback(\n    async (options?: LoginOptions) => {\n      setError(null);\n      try {\n        await startLogin(baseUrl, clientId, options, flow);\n      } catch (e: unknown) {\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      }\n    },\n    [baseUrl, clientId, flow],\n  );\n\n  const logout = useCallback(\n    async (options?: LogoutOptions) => {\n      const idToken = sessionRef.current?.idToken;\n      clearSession();\n      if (options?.endSession) {\n        await endSession(\n          baseUrl,\n          clientId,\n          idToken,\n          options.postLogoutRedirectUri ?? callbackUri(flow),\n        );\n      }\n    },\n    [baseUrl, clientId, clearSession, flow],\n  );\n\n  const switchOrganization = useCallback(\n    async (organizationId: string) => {\n      const current = sessionRef.current;\n      if (!current) throw new Error('not authenticated');\n      const minted = await switchOrganizationCore(baseUrl, current.accessToken, organizationId);\n      // The session's IdP claims still name the previous org, so its alias must not\n      // be remembered as the default for the next login.\n      rememberOrganization(clientId, undefined);\n      applySession({ ...current, ...minted });\n    },\n    [applySession, baseUrl, clientId],\n  );\n\n  const getToken = useCallback(() => sessionRef.current?.accessToken, []);\n\n  const reauthenticate = useCallback(async () => {\n    const organization = organizationAliasOf(sessionRef.current?.idpClaims ?? {});\n    // Forget the token but stay 'loading': the page is about to navigate away,\n    // and 'unauthenticated' would invite an interactive login in the meantime.\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setStatus('loading');\n    try {\n      await startLogin(baseUrl, clientId, { prompt: 'none', organization }, flow);\n    } catch (e: unknown) {\n      setError(e instanceof Error ? e : new Error(String(e)));\n      setStatus('error');\n    }\n  }, [baseUrl, clientId, flow, persistSession]);\n\n  // A 401 means the minted token no longer works. Silent re-auth keeps the user's\n  // place if the IdP session is still alive; otherwise the page comes back\n  // unauthenticated and the app offers a real login.\n  const handleUnauthorized = useCallback(() => {\n    if (!sessionRef.current) return;\n    if (onUnauthorized === 'login') void reauthenticate();\n    else clearSession();\n  }, [clearSession, reauthenticate, onUnauthorized]);\n\n  // One client for the provider's lifetime. getToken reads the session ref.\n  const client = useMemo(\n    () => createConfigHubClient({ baseUrl, getToken, onUnauthorized: handleUnauthorized }),\n    [baseUrl, getToken, handleUnauthorized],\n  );\n\n  const value = useMemo<ConfigHubAuthContextValue>(\n    () => ({\n      status,\n      user,\n      error,\n      login,\n      logout,\n      switchOrganization,\n      reauthenticate,\n      getToken,\n      client,\n    }),\n    [status, user, error, login, logout, switchOrganization, reauthenticate, getToken, client],\n  );\n\n  return (\n    <ConfigHubAuthContext.Provider value={value}>{children}</ConfigHubAuthContext.Provider>\n  );\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport type { ConfigHubClient } from '@confighub/api';\nimport { useContext } from 'react';\nimport { ConfigHubAuthContext, type ConfigHubAuthContextValue } from './provider';\n\n/**\n * Access the ConfigHub auth state and actions. Must be called under a\n * `<ConfigHubAuthProvider>`.\n *\n * ```ts\n * const { status, user, login, logout } = useAuth();\n * ```\n */\nexport function useAuth(): ConfigHubAuthContextValue {\n  const ctx = useContext(ConfigHubAuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within a <ConfigHubAuthProvider>');\n  }\n  return ctx;\n}\n\n/**\n * The typed ConfigHub API client, pre-wired with the current token. This is the\n * seam between `@confighub/react-auth` and `@confighub/api`: you never pass a\n * token by hand.\n *\n * ```ts\n * const api = useConfigHub();\n * const { data } = await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });\n * ```\n */\nexport function useConfigHub(): ConfigHubClient {\n  return useAuth().client;\n}\n"]}
+{"version":3,"sources":["../src/core.ts","../src/tokenStore.ts","../src/provider.tsx","../src/hooks.ts"],"names":["switchOrganization","handleUnauthorized"],"mappings":";;;;;;;AAiGO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC7C,YAA4B,QAAA,EAAkB;AAC5C,IAAA,KAAA,CAAM,2DAA2D,CAAA;AADvC,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOA,IAAM,QAAA,GAAW,gBAAA;AACjB,IAAM,YAAA,GAAe,oBAAA;AAIrB,IAAM,aAAa,CAAC,QAAA,KAA6B,CAAA,EAAG,YAAY,IAAI,QAAQ,CAAA,CAAA;AAGrE,SAAS,uBAAuB,QAAA,EAAsC;AAC3E,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAC,CAAA,IAAK,KAAA,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,oBAAA,CAAqB,UAAkB,KAAA,EAAiC;AACtF,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,GAAG,KAAK,CAAA;AAAA,SACtD,YAAA,CAAa,UAAA,CAAW,UAAA,CAAW,QAAQ,CAAC,CAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAMO,SAAS,oBAAoB,SAAA,EAAwD;AAC1F,EAAA,MAAM,MAAM,SAAA,CAAU,YAAA;AACtB,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,MAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,GAA8B,CAAA;AAC1D,EAAA,OAAO,OAAA,CAAQ,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,CAAC,CAAA,GAAI,MAAA;AAC7C;AAEA,IAAM,YAAY,CAAC,CAAA,KAAsB,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAGtD,IAAM,cAAc,CAAC,IAAA,KAC1B,OAAO,QAAA,CAAS,MAAA,IAAU,MAAM,YAAA,IAAgB,GAAA;AAElD,IAAM,WAAA,GAAc,MAClB,MAAA,CAAO,QAAA,CAAS,WAAW,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,IAAA;AAEtE,IAAM,MAAA,GAAS,CAAC,GAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,IAAI,UAAA,CAAW,GAAG,CAAC,CAAC,CAAA,CAC7C,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEtB,IAAM,YAAA,GAAe,CAAC,CAAA,GAAI,EAAA,KACxB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,MAAM,CAAA;AAEzD,eAAe,OAAO,CAAA,EAA4B;AAChD,EAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAClF;AAGO,SAAS,gBAAgB,KAAA,EAAwC;AACtE,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC/B,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAC,CAAA;AAAA,EACpE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAGO,SAAS,SAAA,CAAU,KAAA,EAAe,WAAA,GAAc,EAAA,EAAa;AAClE,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,KAAK,CAAA,CAAE,GAAA;AACnC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,KAAA;AACpC,EAAA,OAAO,GAAA,GAAM,GAAA,IAAQ,IAAA,CAAK,GAAA,KAAQ,WAAA,GAAc,GAAA;AAClD;AAEA,eAAsB,SAAS,IAAA,EAAkC;AAC/D,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,WAAW,CAAA;AACnD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,oBAAA,GAAuB,EAAE,MAAM,CAAA;AAC1D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAQA,eAAe,aAAa,MAAA,EAAuC;AACjE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,MAAM,IAAI,mCAAmC,CAAA;AAC7E,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,yBAAA,GAA4B,EAAE,MAAM,CAAA;AAC/D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,KAAA,GAAsB,EAAC,EACvB,IAAA,GAAoB,EAAC,EACrB,KAAA,GAAsB,EAAC,EACR;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,KAAK,qBAAA,EAAuB;AACnD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,WAAW,YAAA,EAAa;AAC9B,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,aAAa,EAAE,CAAA;AAC7B,EAAA,MAAM,WAAA,GAAc,YAAY,IAAI,CAAA;AAGpC,EAAA,MAAM,KAAA,GACJ,MAAM,YAAA,KAAiB,IAAA,GACnB,SACC,KAAA,CAAM,YAAA,IAAgB,uBAAuB,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAA,GAAK,cAAA;AACnD,EAAA,MAAM,IAAA,GAAkB;AAAA,IACtB,QAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAe,IAAA,CAAK,cAAA;AAAA,IACpB,kBAAkB,IAAA,CAAK,qBAAA;AAAA,IACvB,WAAA;AAAA,IACA,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY,WAAA,EAAY;AAAA,IACxC,MAAA,EAAQ,MAAM,MAAA,KAAW,MAAA;AAAA,IACzB,kBAAA,EAAoB,KAAA;AAAA,IACpB,wBAAwB,KAAA,CAAM;AAAA,GAChC;AACA,EAAA,cAAA,CAAe,OAAA,CAAQ,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AACrD,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,aAAA,EAAe,MAAA;AAAA,IACf,SAAA,EAAW,QAAA;AAAA,IACX,YAAA,EAAc,WAAA;AAAA,IACd,KAAA,EAAO,wBAAwB,QAAQ,CAAA,CAAA;AAAA,IACvC,cAAA,EAAgB,SAAA;AAAA,IAChB,qBAAA,EAAuB,MAAA;AAAA,IACvB;AAAA,GACF;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,KAAA,CAAM,MAAA;AAExC,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,sBAAsB,CAAA;AACnD,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AACtD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C;AAGA,IAAI,OAAA,GAAgD,IAAA;AAU7C,SAAS,yBAAA,GAA2D;AACzE,EAAA,IAAI,CAAC,OAAA,EAAS,OAAA,GAAU,eAAA,EAAgB;AACxC,EAAA,OAAO,OAAA;AACT;AAEA,IAAM,kCAAkB,IAAI,GAAA,CAAI,CAAC,gBAAA,EAAkB,sBAAA,EAAwB,kBAAkB,CAAC,CAAA;AAE9F,eAAe,eAAA,GAAiD;AAC9D,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,KAAA,EAAO,OAAO,IAAA;AAE5B,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,OAAA,CAAQ,QAAQ,CAAA;AAChD,EAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,EAAA,MAAM,KAAA,GAA0B,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,GAAI,IAAA;AAIlE,EAAA,OAAA,CAAQ,aAAa,EAAC,EAAG,IAAI,KAAA,EAAO,QAAA,IAAY,aAAa,CAAA;AAE7D,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,OAAO,MAAA,IAAU,eAAA,CAAgB,GAAA,CAAI,KAAK,GAAG,OAAO,IAAA;AACxD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,CAAA,EAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,IAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACzF;AAOA,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,IAAI,MAAA,CAAO,IAAI,OAAO,CAAA,KAAM,MAAM,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,0BAA0B,CAAA;AAGnF,EAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,KAAA,CAAM,aAAA,EAAe;AAAA,IACjD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,cAAc,KAAA,CAAM,WAAA;AAAA,MACpB,WAAW,KAAA,CAAM,QAAA;AAAA,MACjB,eAAe,KAAA,CAAM;AAAA,KACtB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,SAAA,CAAU,MAAM,KAAK,MAAM,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACrF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,IAAA,EAAK;AAGtC,EAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,QAAA,CAAS,YAAY,CAAA;AACvD,EAAA,IAAI,CAAC,mBAAA,CAAoB,SAAS,CAAA,IAAK,CAAC,MAAM,sBAAA,EAAwB;AAIpE,IAAA,IAAI,KAAA,CAAM,kBAAA,EAAoB,oBAAA,CAAqB,KAAA,CAAM,UAAU,MAAS,CAAA;AAC5E,IAAA,MAAM,IAAI,mBAAA,CAAoB,KAAA,CAAM,QAAQ,CAAA;AAAA,EAC9C;AACA,EAAA,MAAM,SAAS,MAAM,QAAA,CAAS,KAAA,CAAM,gBAAA,EAAkB,SAAS,YAAY,CAAA;AAC3E,EAAA,oBAAA,CAAqB,KAAA,CAAM,QAAA,EAAU,mBAAA,CAAoB,SAAS,CAAC,CAAA;AACnE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,SAAA;AAAA,IACA,SAAS,OAAO,QAAA,CAAS,QAAA,KAAa,QAAA,GAAW,SAAS,QAAA,GAAW;AAAA,GACvE;AACF;AAEA,eAAe,QAAA,CACb,kBACA,YAAA,EACgE;AAChE,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,iDAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,kBAAA,EAAoB;AAAA,KACrB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,MAAA,CAAO,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,MAAA,CAAO,MAAM,CAAA,EAAA,EAAK,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AACzF,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AACjC,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AAOA,eAAsB,kBAAA,CACpB,IAAA,EACA,WAAA,EACA,cAAA,EACgE;AAChE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,2BAAA,EAA6B;AAAA,IACnE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,WAAW,CAAA,CAAA;AAAA,MACpC,cAAA,EAAgB;AAAA,KAClB;AAAA,IACA,MAAM,IAAI,eAAA,CAAgB,EAAE,eAAA,EAAiB,gBAAgB;AAAA,GAC9D,CAAA;AACD,EAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,CAAA,CAAE,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAA;AACrF,EAAA,MAAM,MAAA,GAAS,MAAM,CAAA,CAAE,IAAA,EAAK;AAC5B,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,OAAA,EACA,qBAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,MAAM,OAAO,IAAA,CAAK,UAAA,GAAa,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA;AACrE,EAAA,IAAI,CAAC,MAAM,oBAAA,EAAsB;AAC/B,IAAA,MAAA,CAAO,QAAA,CAAS,OAAO,qBAAqB,CAAA;AAC5C,IAAA;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,SAAA,EAAW,QAAA;AAAA,IACX,wBAAA,EAA0B;AAAA,GAC5B;AACA,EAAA,IAAI,OAAA,SAAgB,aAAA,GAAgB,OAAA;AACpC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,CAAK,oBAAoB,CAAA;AAC7C,EAAA,GAAA,CAAI,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAClD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,CAAA;AACvC;AAGO,SAAS,YAAA,GAAqB;AACnC,EAAA,OAAA,GAAU,IAAA;AACZ;;;ACrZA,IAAI,YAAA;AACJ,IAAI,mBAAA;AAEJ,IAAI,UAAA,GAAa,KAAA;AAGV,SAAS,eAAe,KAAA,EAAiC;AAC9D,EAAA,YAAA,GAAe,KAAA;AACf,EAAA,IAAI,KAAA,KAAU,QAAW,UAAA,GAAa,KAAA;AACxC;AAGO,SAAS,uBAAuB,OAAA,EAAyC;AAC9E,EAAA,mBAAA,GAAsB,OAAA;AACtB,EAAA,UAAA,GAAa,KAAA;AACf;AAYO,SAAS,cAAA,GAAqC;AACnD,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,SAAA,CAAU,YAAY,CAAA,EAAG;AACzD,IAAA,kBAAA,EAAmB;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,YAAA;AACT;AASO,SAAS,kBAAA,GAA2B;AACzC,EAAA,IAAI,UAAA,IAAc,CAAC,mBAAA,EAAqB;AACxC,EAAA,UAAA,GAAa,IAAA;AACb,EAAA,mBAAA,EAAoB;AACtB;ACsBO,IAAM,oBAAA,GAAuB,cAAgD,IAAI;AA4BxF,IAAM,WAAA,GAAc,mBAAA;AAEpB,SAAS,aAAA,GAAsC;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AAC9C,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,OAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7C,IAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,IAAe,SAAA,CAAU,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1D,MAAA,cAAA,CAAe,WAAW,WAAW,CAAA;AACrC,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQO,SAAS,qBAAA,CAAsB;AAAA,EACpC,OAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA,GAAU,SAAA;AAAA,EACV,cAAA,GAAiB,OAAA;AAAA,EACjB;AACF,CAAA,EAA4C;AAC1C,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,SAAqB,SAAS,CAAA;AAC1D,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAI,SAA+B,IAAI,CAAA;AAC3D,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAI,SAAuB,IAAI,CAAA;AAIrD,EAAA,MAAM,UAAA,GAAa,OAAkC,MAAS,CAAA;AAC9D,EAAA,MAAM,IAAA,GAAO,QAAQ,OAAO,EAAE,cAAa,CAAA,EAAI,CAAC,YAAY,CAAC,CAAA;AAE7D,EAAA,MAAM,cAAA,GAAiB,WAAA;AAAA,IACrB,CAAC,OAAA,KAAuC;AACtC,MAAA,IAAI,YAAY,SAAA,EAAW;AAC3B,MAAA,IAAI;AACF,QAAA,IAAI,SAAS,cAAA,CAAe,OAAA,CAAQ,aAAa,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,aACnE,cAAA,CAAe,WAAW,WAAW,CAAA;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAO;AAAA,GACV;AAEA,EAAA,MAAM,YAAA,GAAe,WAAA;AAAA,IACnB,CAAC,OAAA,KAA2B;AAC1B,MAAA,UAAA,CAAW,OAAA,GAAU,OAAA;AACrB,MAAA,cAAA,CAAe,QAAQ,WAAW,CAAA;AAClC,MAAA,cAAA,CAAe,OAAO,CAAA;AACtB,MAAA,OAAA,CAAQ,EAAE,cAAA,EAAgB,OAAA,CAAQ,gBAAgB,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAChF,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,SAAA,CAAU,eAAe,CAAA;AAAA,IAC3B,CAAA;AAAA,IACA,CAAC,cAAc;AAAA,GACjB;AAEA,EAAA,MAAM,YAAA,GAAe,YAAY,MAAM;AACrC,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,EAC7B,CAAA,EAAG,CAAC,cAAc,CAAC,CAAA;AAEnB,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,yBAAA,EAA0B,CACvB,IAAA,CAAK,CAAC,OAAA,KAAY;AACjB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,OAAA,EAAS,OAAO,YAAA,CAAa,OAAO,CAAA;AACxC,MAAA,MAAM,SAAA,GAAY,OAAA,KAAY,SAAA,GAAY,aAAA,EAAc,GAAI,IAAA;AAC5D,MAAA,IAAI,SAAA,EAAW,OAAO,YAAA,CAAa,SAAS,CAAA;AAC5C,MAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,IAC7B,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,CAAA,KAAe;AACrB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,aAAa,mBAAA,EAAqB;AAEpC,QAAA,KAAK,UAAA;AAAA,UACH,OAAA;AAAA,UACA,QAAA;AAAA,UACA,EAAE,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,cAAc,IAAA,EAAK;AAAA,UAC3C,IAAA;AAAA,UACA,EAAE,wBAAwB,IAAA;AAAK,SACjC;AACA,QAAA;AAAA,MACF;AACA,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB,CAAC,CAAA;AACH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,GAAG,CAAC,YAAA,EAAc,SAAS,OAAA,EAAS,QAAA,EAAU,IAAI,CAAC,CAAA;AAEnD,EAAA,MAAM,KAAA,GAAQ,WAAA;AAAA,IACZ,OAAO,OAAA,KAA2B;AAChC,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,EAAS,QAAA,EAAU,OAAA,EAAS,IAAI,CAAA;AAAA,MACnD,SAAS,CAAA,EAAY;AACnB,QAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,QAAA,SAAA,CAAU,OAAO,CAAA;AAAA,MACnB;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,IAAI;AAAA,GAC1B;AAEA,EAAA,MAAM,MAAA,GAAS,WAAA;AAAA,IACb,OAAO,OAAA,KAA4B;AACjC,MAAA,MAAM,OAAA,GAAU,WAAW,OAAA,EAAS,OAAA;AACpC,MAAA,YAAA,EAAa;AACb,MAAA,IAAI,SAAS,UAAA,EAAY;AACvB,QAAA,MAAM,UAAA;AAAA,UACJ,OAAA;AAAA,UACA,QAAA;AAAA,UACA,OAAA;AAAA,UACA,OAAA,CAAQ,qBAAA,IAAyB,WAAA,CAAY,IAAI;AAAA,SACnD;AAAA,MACF;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,YAAA,EAAc,IAAI;AAAA,GACxC;AAEA,EAAA,MAAMA,mBAAAA,GAAqB,WAAA;AAAA,IACzB,OAAO,cAAA,KAA2B;AAChC,MAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAC3B,MAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mBAAmB,CAAA;AACjD,MAAA,MAAM,SAAS,MAAM,kBAAA,CAAuB,OAAA,EAAS,OAAA,CAAQ,aAAa,cAAc,CAAA;AAGxF,MAAA,oBAAA,CAAqB,UAAU,MAAS,CAAA;AACxC,MAAA,YAAA,CAAa,EAAE,GAAG,OAAA,EAAS,GAAG,QAAQ,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,CAAC,YAAA,EAAc,OAAA,EAAS,QAAQ;AAAA,GAClC;AAEA,EAAA,MAAM,WAAW,WAAA,CAAY,MAAM,WAAW,OAAA,EAAS,WAAA,EAAa,EAAE,CAAA;AAEtE,EAAA,MAAM,cAAA,GAAiB,YAAY,YAAY;AAC7C,IAAA,MAAM,eAAe,mBAAA,CAAoB,UAAA,CAAW,OAAA,EAAS,SAAA,IAAa,EAAE,CAAA;AAG5E,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,CAAW,SAAS,QAAA,EAAU,EAAE,QAAQ,MAAA,EAAQ,YAAA,IAAgB,IAAI,CAAA;AAAA,IAC5E,SAAS,CAAA,EAAY;AACnB,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,cAAc,CAAC,CAAA;AAK5C,EAAA,MAAMC,mBAAAA,GAAqB,YAAY,MAAM;AAC3C,IAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACzB,IAAA,IAAI,cAAA,KAAmB,OAAA,EAAS,KAAK,cAAA,EAAe;AAAA,SAC/C,YAAA,EAAa;AAAA,EACpB,CAAA,EAAG,CAAC,YAAA,EAAc,cAAA,EAAgB,cAAc,CAAC,CAAA;AAIjD,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,sBAAA,CAAuBA,mBAAkB,CAAA;AACzC,IAAA,OAAO,MAAM,uBAAuB,MAAS,CAAA;AAAA,EAC/C,CAAA,EAAG,CAACA,mBAAkB,CAAC,CAAA;AAGvB,EAAA,MAAM,MAAA,GAAS,OAAA;AAAA,IACb,MAAM,qBAAA,CAAsB,EAAE,SAAS,QAAA,EAAU,cAAA,EAAgBA,qBAAoB,CAAA;AAAA,IACrF,CAAC,OAAA,EAAS,QAAA,EAAUA,mBAAkB;AAAA,GACxC;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA;AAAA,IACZ,OAAO;AAAA,MACL,MAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,MACA,kBAAA,EAAAD,mBAAAA;AAAA,MACA,cAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF,CAAA;AAAA,IACA,CAAC,QAAQ,IAAA,EAAM,KAAA,EAAO,OAAO,MAAA,EAAQA,mBAAAA,EAAoB,cAAA,EAAgB,QAAA,EAAU,MAAM;AAAA,GAC3F;AAEA,EAAA,uBACE,GAAA,CAAC,oBAAA,CAAqB,QAAA,EAArB,EAA8B,OAAe,QAAA,EAAS,CAAA;AAE3D;ACxSO,SAAS,OAAA,GAAqC;AACnD,EAAA,MAAM,GAAA,GAAM,WAAW,oBAAoB,CAAA;AAC3C,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,GAAA;AACT;AAYO,SAAS,YAAA,GAAgC;AAC9C,EAAA,OAAO,SAAQ,CAAE,MAAA;AACnB","file":"index.js","sourcesContent":["// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n//\n// Framework-neutral browser-auth engine for ConfigHub. Productionized from the\n// reference harness `test/browser-auth/src/confighubAuth.ts` in the ConfigHub\n// monorepo, which is validated end to end against staging and prod.\n//\n// Flow (design: third-party-browser-app-auth.md §6):\n//   GET {base}/api/info                 -> discovery { AuthIssuer, TokenExchangeEndpoint }\n//   OIDC discovery on AuthIssuer        -> authorize/token/end_session endpoints\n//   PKCE authorize + code->token        -> IdP token\n//   POST {TokenExchangeEndpoint} (8693) -> minted ConfigHub token\n//\n// The minted token then rides `Authorization: Bearer` against `/api`. The flow is\n// edition-agnostic: `AuthIssuer` is whatever discovery names (ConfigHub's bundled\n// Keycloak for Cloud, the org's own IdP for Enterprise), so the same code runs\n// against both. Tokens are held by the caller; only the transient PKCE state is\n// parked in sessionStorage across the authorize redirect.\n\nexport interface Discovery {\n  AuthIssuer?: string;\n  TokenExchangeEndpoint?: string;\n  TokenExchangeAudience?: string;\n}\n\nexport interface MintedSession {\n  accessToken: string;\n  organizationId: string;\n  /** Claims of the validated IdP token (owning-org, audience, organization shape). */\n  idpClaims: Record<string, unknown>;\n  /**\n   * The IdP's ID token, kept only so logout can pass it as `id_token_hint` to the\n   * end-session endpoint. Absent for sessions that did not come from an OIDC login.\n   */\n  idToken?: string;\n}\n\nexport interface LoginOptions {\n  /**\n   * Where to land after login, as a same-origin path (`/space/x?tab=units`). Carried\n   * through the authorize round trip in the PKCE state, never in the redirect URI:\n   * OAuth clients register exact redirect URIs, so the URI itself must not vary with\n   * the page the user started from. Defaults to the current path and query.\n   */\n  returnTo?: string;\n  /**\n   * Which organization to sign in to, as the Keycloak organization alias sent in\n   * the `organization:<alias>` scope.\n   *\n   * - a string: that organization, no prompt;\n   * - `undefined` (default): the organization of the last successful login in this\n   *   browser, remembered per client in `localStorage`, so a new tab or a login after\n   *   logout lands in the same organization without a prompt; with nothing\n   *   remembered, Keycloak decides (prompt for a multi-org user, or the org matching\n   *   the email domain on a fresh authentication);\n   * - `null`: no hint on purpose, so Keycloak prompts. This is \"switch organization\".\n   */\n  organization?: string | null;\n  /**\n   * `'none'` asks the IdP to re-authenticate without any UI, failing with\n   * `login_required` if the SSO session is gone -- the way to refresh an expired\n   * ConfigHub token when the user is still signed in at the IdP. `'login'` forces the\n   * login form even with a live SSO session.\n   */\n  prompt?: 'none' | 'login';\n}\n\nexport interface FlowOptions {\n  /**\n   * Same-origin path the IdP redirects back to, and therefore the redirect URI to\n   * register for the client: `{origin}{callbackPath}`. Defaults to `/`.\n   */\n  callbackPath?: string;\n}\n\ninterface PkceState {\n  verifier: string;\n  state: string;\n  clientId: string;\n  tokenEndpoint: string;\n  exchangeEndpoint: string;\n  redirectUri: string;\n  returnTo: string;\n  silent: boolean;\n  /** The organization alias the authorize request hinted, if any. */\n  hintedOrganization?: string;\n  /** This login is already the retry after a token without an organization. */\n  retriedForOrganization?: boolean;\n}\n\n/**\n * Thrown by `completeLoginFromRedirect` when the IdP token names no organization,\n * which the exchange would refuse. Seen on a fresh brokered (Google) login, where\n * Keycloak's organization step does not run; on the next login the SSO session is\n * alive and it does, so the caller logs in again, once, with no hint. Any\n * remembered alias has already been forgotten.\n */\nexport class OrganizationMissing extends Error {\n  constructor(public readonly returnTo: string) {\n    super('the identity provider issued a token with no organization');\n    this.name = 'OrganizationMissing';\n  }\n}\n\nexport interface RetryOptions {\n  /** @internal set by the provider on the one retry after OrganizationMissing. */\n  retriedForOrganization?: boolean;\n}\n\nconst PKCE_KEY = 'confighub_pkce';\nconst LAST_ORG_KEY = 'confighub_last_org';\n\n// The alias is a short public identifier, not a credential, so localStorage is the\n// right place: it must outlive the tab, which is exactly what the token must not.\nconst lastOrgKey = (clientId: string): string => `${LAST_ORG_KEY}:${clientId}`;\n\n/** The organization alias of the last successful login for this client, if any. */\nexport function rememberedOrganization(clientId: string): string | undefined {\n  try {\n    return localStorage.getItem(lastOrgKey(clientId)) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** @internal */\nexport function rememberOrganization(clientId: string, alias: string | undefined): void {\n  try {\n    if (alias) localStorage.setItem(lastOrgKey(clientId), alias);\n    else localStorage.removeItem(lastOrgKey(clientId));\n  } catch {\n    // Storage unavailable: the next login gets no hint.\n  }\n}\n\n/**\n * The alias in an IdP token's `organization` claim (`{ \"<alias>\": { id } }`), or\n * undefined when the claim is absent or names more than one organization.\n */\nexport function organizationAliasOf(idpClaims: Record<string, unknown>): string | undefined {\n  const org = idpClaims.organization;\n  if (!org || typeof org !== 'object') return undefined;\n  const aliases = Object.keys(org as Record<string, unknown>);\n  return aliases.length === 1 ? aliases[0] : undefined;\n}\n\nconst trimSlash = (s: string): string => s.replace(/\\/+$/, '');\n\n/** The fixed callback URI: the page origin plus the configured callback path. */\nexport const callbackUri = (opts?: FlowOptions): string =>\n  window.location.origin + (opts?.callbackPath ?? '/');\n\nconst currentPath = (): string =>\n  window.location.pathname + window.location.search + window.location.hash;\n\nconst b64url = (buf: ArrayBuffer): string =>\n  btoa(String.fromCharCode(...new Uint8Array(buf)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst randomString = (n = 64): string =>\n  b64url(crypto.getRandomValues(new Uint8Array(n)).buffer);\n\nasync function sha256(s: string): Promise<string> {\n  return b64url(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s)));\n}\n\n/** Decode a JWT's claims without verifying it. Returns {} for anything malformed. */\nexport function decodeJwtClaims(token: string): Record<string, unknown> {\n  const part = token.split('.')[1];\n  if (!part) return {};\n  try {\n    return JSON.parse(atob(part.replace(/-/g, '+').replace(/_/g, '/')));\n  } catch {\n    return {};\n  }\n}\n\n/** Whether a JWT's `exp` is in the past (with a small skew allowance). */\nexport function isExpired(token: string, skewSeconds = 30): boolean {\n  const exp = decodeJwtClaims(token).exp;\n  if (typeof exp !== 'number') return false;\n  return exp * 1000 <= Date.now() + skewSeconds * 1000;\n}\n\nexport async function discover(base: string): Promise<Discovery> {\n  const r = await fetch(trimSlash(base) + '/api/info');\n  if (!r.ok) throw new Error('/api/info failed: ' + r.status);\n  return r.json();\n}\n\ninterface OidcMetadata {\n  authorization_endpoint: string;\n  token_endpoint: string;\n  end_session_endpoint?: string;\n}\n\nasync function oidcMetadata(issuer: string): Promise<OidcMetadata> {\n  const r = await fetch(trimSlash(issuer) + '/.well-known/openid-configuration');\n  if (!r.ok) throw new Error('OIDC discovery failed: ' + r.status);\n  return r.json();\n}\n\n/**\n * Discover, build a PKCE request, and navigate to the IdP authorize endpoint.\n * Returns only by redirecting the page; `completeLoginFromRedirect()` finishes on\n * the way back.\n */\nexport async function startLogin(\n  base: string,\n  clientId: string,\n  login: LoginOptions = {},\n  flow: FlowOptions = {},\n  retry: RetryOptions = {},\n): Promise<void> {\n  const info = await discover(base);\n  if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {\n    throw new Error(\n      'this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)',\n    );\n  }\n  const meta = await oidcMetadata(info.AuthIssuer);\n  const verifier = randomString();\n  const challenge = await sha256(verifier);\n  const state = randomString(16);\n  const redirectUri = callbackUri(flow);\n  // The \"organization\" scope makes Keycloak emit the org claim the exchange resolves;\n  // \"organization:<alias>\" selects one without prompting.\n  const alias =\n    login.organization === null\n      ? undefined\n      : (login.organization ?? rememberedOrganization(clientId));\n  const orgScope = alias ? `organization:${alias}` : 'organization';\n  const pkce: PkceState = {\n    verifier,\n    state,\n    clientId,\n    tokenEndpoint: meta.token_endpoint,\n    exchangeEndpoint: info.TokenExchangeEndpoint,\n    redirectUri,\n    returnTo: login.returnTo ?? currentPath(),\n    silent: login.prompt === 'none',\n    hintedOrganization: alias,\n    retriedForOrganization: retry.retriedForOrganization,\n  };\n  sessionStorage.setItem(PKCE_KEY, JSON.stringify(pkce));\n  const params: Record<string, string> = {\n    response_type: 'code',\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    scope: `openid email profile ${orgScope}`,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state,\n  };\n  if (login.prompt) params.prompt = login.prompt;\n\n  const authURL = new URL(meta.authorization_endpoint);\n  authURL.search = new URLSearchParams(params).toString();\n  window.location.assign(authURL.toString());\n}\n\n// Memoize so React StrictMode's double-mount can't redeem the one-time code twice.\nlet pending: Promise<MintedSession | null> | null = null;\n\n/**\n * If the page is the IdP redirect (`?code=...`), exchange the code for an IdP token\n * and then exchange that for a minted ConfigHub token, and restore the URL the\n * login started from. Returns null on a normal load, when a `prompt=none` attempt\n * came back with `login_required` (the SSO session is gone; the caller should offer\n * an interactive login), and when the redirect carries a code this tab has no PKCE\n * state for (an IdP email flow landed here; the caller should start a login).\n */\nexport function completeLoginFromRedirect(): Promise<MintedSession | null> {\n  if (!pending) pending = doCompleteLogin();\n  return pending;\n}\n\nconst SILENT_FAILURES = new Set(['login_required', 'interaction_required', 'consent_required']);\n\nasync function doCompleteLogin(): Promise<MintedSession | null> {\n  const params = new URLSearchParams(window.location.search);\n  const code = params.get('code');\n  const error = params.get('error');\n  if (!code && !error) return null;\n\n  const savedRaw = sessionStorage.getItem(PKCE_KEY);\n  sessionStorage.removeItem(PKCE_KEY);\n  const saved: PkceState | null = savedRaw ? JSON.parse(savedRaw) : null;\n\n  // Put the URL back to where the user started before anything else can fail, so\n  // neither the code nor an error string lingers in the address bar or history.\n  history.replaceState({}, '', saved?.returnTo ?? callbackUri());\n\n  if (error) {\n    if (saved?.silent && SILENT_FAILURES.has(error)) return null;\n    throw new Error(`IdP returned error: ${error} ${params.get('error_description') ?? ''}`);\n  }\n  // A code with no PKCE state means this tab did not start the login: the IdP's\n  // email flows (password reset, verify email) finish the authentication in the tab\n  // the mail link opened and redirect it here, while the verifier sits in the tab\n  // that began. The code is unusable without it, so drop it and report a normal\n  // load; the caller starts a login, which the now-live IdP session completes\n  // without a prompt.\n  if (!saved) return null;\n  if (params.get('state') !== saved.state) throw new Error('state mismatch; aborting');\n\n  // Exchange the authorization code for an IdP token (PKCE, public client).\n  const tokenResp = await fetch(saved.tokenEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'authorization_code',\n      code: code!,\n      redirect_uri: saved.redirectUri,\n      client_id: saved.clientId,\n      code_verifier: saved.verifier,\n    }),\n  });\n  if (!tokenResp.ok) {\n    throw new Error(`IdP token endpoint ${tokenResp.status}: ${await tokenResp.text()}`);\n  }\n  const idpToken = await tokenResp.json();\n\n  // RFC 8693 token exchange against ConfigHub -> minted ConfigHub token.\n  const idpClaims = decodeJwtClaims(idpToken.access_token);\n  if (!organizationAliasOf(idpClaims) && !saved.retriedForOrganization) {\n    // The exchange would refuse this token. Rather than surface that, log in\n    // once more: with the SSO session now alive the IdP runs its organization\n    // step. A hint that was sent evidently did not help, so forget it.\n    if (saved.hintedOrganization) rememberOrganization(saved.clientId, undefined);\n    throw new OrganizationMissing(saved.returnTo);\n  }\n  const minted = await exchange(saved.exchangeEndpoint, idpToken.access_token);\n  rememberOrganization(saved.clientId, organizationAliasOf(idpClaims));\n  return {\n    ...minted,\n    idpClaims,\n    idToken: typeof idpToken.id_token === 'string' ? idpToken.id_token : undefined,\n  };\n}\n\nasync function exchange(\n  exchangeEndpoint: string,\n  subjectToken: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const exResp = await fetch(exchangeEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',\n      subject_token: subjectToken,\n      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',\n    }),\n  });\n  if (!exResp.ok) throw new Error(`/auth/exchange ${exResp.status}: ${await exResp.text()}`);\n  const minted = await exResp.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * Trade the current minted token for one scoped to another organization the user\n * belongs to (`POST {base}/auth/switch-organization`, bearer-authenticated). The\n * IdP session is untouched; only the ConfigHub token changes.\n */\nexport async function switchOrganization(\n  base: string,\n  accessToken: string,\n  organizationId: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const r = await fetch(trimSlash(base) + '/auth/switch-organization', {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n    body: new URLSearchParams({ organization_id: organizationId }),\n  });\n  if (!r.ok) throw new Error(`/auth/switch-organization ${r.status}: ${await r.text()}`);\n  const minted = await r.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * End the IdP session (RP-initiated logout) and land on `postLogoutRedirectUri`,\n * which must be registered for the client. Returns only by redirecting. If the\n * issuer publishes no end-session endpoint, navigates to the redirect URI directly.\n */\nexport async function endSession(\n  base: string,\n  clientId: string,\n  idToken: string | undefined,\n  postLogoutRedirectUri: string,\n): Promise<void> {\n  const info = await discover(base);\n  const meta = info.AuthIssuer ? await oidcMetadata(info.AuthIssuer) : undefined;\n  if (!meta?.end_session_endpoint) {\n    window.location.assign(postLogoutRedirectUri);\n    return;\n  }\n  const params: Record<string, string> = {\n    client_id: clientId,\n    post_logout_redirect_uri: postLogoutRedirectUri,\n  };\n  if (idToken) params.id_token_hint = idToken;\n  const url = new URL(meta.end_session_endpoint);\n  url.search = new URLSearchParams(params).toString();\n  window.location.assign(url.toString());\n}\n\n/** Discard the in-progress login memo (used on logout so a later login re-runs). */\nexport function resetPending(): void {\n  pending = null;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\n// A module-level holder for the current minted token, so non-React consumers can read\n// it. RTK Query's `prepareHeaders` (in @confighub/rtk-query) is not a hook and cannot\n// read React context, so it calls getAccessToken() instead. The provider keeps this in\n// sync with its React state, and registers its 401 handling here for the same reason.\nimport { isExpired } from './core';\n\nlet currentToken: string | undefined;\nlet unauthorizedHandler: (() => void) | undefined;\n// Set while a recovery is under way, so a burst of failing requests starts one.\nlet recovering = false;\n\n/** @internal — called by the provider; not part of the public surface. */\nexport function setAccessToken(token: string | undefined): void {\n  currentToken = token;\n  if (token !== undefined) recovering = false;\n}\n\n/** @internal — the mounted provider's reaction to a rejected token. */\nexport function setUnauthorizedHandler(handler: (() => void) | undefined): void {\n  unauthorizedHandler = handler;\n  recovering = false;\n}\n\n/**\n * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as\n * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere\n * you need the token outside React.\n *\n * A token past its `exp` is never handed out: the server would reject it. Instead the\n * provider's recovery starts (a silent re-authentication, or a logout, per its\n * `onUnauthorized`) and the request goes without a token; the page is about to\n * navigate to the IdP and back to where it was.\n */\nexport function getAccessToken(): string | undefined {\n  if (currentToken !== undefined && isExpired(currentToken)) {\n    handleUnauthorized();\n    return undefined;\n  }\n  return currentToken;\n}\n\n/**\n * Tell the mounted provider the API rejected the token (401). Pass this as the\n * `onUnauthorized` for `@confighub/rtk-query`'s `configureConfigHub` to recover from a\n * token rejected before its expiry, e.g. after a server key rotation; expiry itself is\n * handled by `getAccessToken`. A no-op with no provider mounted, and while a recovery\n * is already under way.\n */\nexport function handleUnauthorized(): void {\n  if (recovering || !unauthorizedHandler) return;\n  recovering = true;\n  unauthorizedHandler();\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport { createConfigHubClient, type ConfigHubClient } from '@confighub/api';\nimport {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react';\nimport {\n  OrganizationMissing,\n  callbackUri,\n  completeLoginFromRedirect,\n  endSession,\n  isExpired,\n  organizationAliasOf,\n  rememberOrganization,\n  resetPending,\n  startLogin,\n  switchOrganization as switchOrganizationCore,\n  type LoginOptions,\n  type MintedSession,\n} from './core';\nimport { setAccessToken, setUnauthorizedHandler } from './tokenStore';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated' | 'error';\n\nexport interface ConfigHubUser {\n  organizationId: string;\n  idpClaims: Record<string, unknown>;\n}\n\nexport interface LogoutOptions {\n  /**\n   * Also end the IdP session (RP-initiated logout), so the next login asks for\n   * credentials instead of riding the SSO cookie. Redirects the page; the landing\n   * URI must be registered for the client. Default: false, which only forgets the\n   * token in this tab.\n   */\n  endSession?: boolean;\n  /** Where to land after IdP logout. Defaults to the callback URI. */\n  postLogoutRedirectUri?: string;\n}\n\nexport interface ConfigHubAuthContextValue {\n  status: AuthStatus;\n  user: ConfigHubUser | null;\n  error: Error | null;\n  /** Begin login: redirects the page to the IdP. */\n  login: (options?: LoginOptions) => Promise<void>;\n  /** Forget the session in this tab and, optionally, end the IdP session too. */\n  logout: (options?: LogoutOptions) => Promise<void>;\n  /**\n   * Re-mint the ConfigHub token for another organization the user belongs to. The\n   * IdP session is untouched. Rejects with the server's error if the user is not a\n   * member; the current session stays as it was.\n   */\n  switchOrganization: (organizationId: string) => Promise<void>;\n  /**\n   * The ConfigHub token stopped working (a 401). Try to get a new one without any\n   * UI: a `prompt=none` round trip through the IdP, for the organization the session\n   * already had. Status goes to `loading` meanwhile, not `unauthenticated`, so an\n   * app that auto-logs-in on `unauthenticated` does not race this with an\n   * interactive login. If the IdP session is gone too, the page comes back\n   * `unauthenticated`. Redirects the page.\n   */\n  reauthenticate: () => Promise<void>;\n  /** Current bearer token, or undefined when unauthenticated. */\n  getToken: () => string | undefined;\n  /** A typed API client pre-wired with the current token. Stable across renders. */\n  client: ConfigHubClient;\n}\n\nexport const ConfigHubAuthContext = createContext<ConfigHubAuthContextValue | null>(null);\n\nexport interface ConfigHubAuthProviderProps {\n  /** Absolute base URL of the ConfigHub instance, e.g. `https://hub.confighub.com`. */\n  baseUrl: string;\n  /** This app's registered OAuth `client_id` (from `cub oauthclient create`). */\n  clientId: string;\n  /**\n   * Same-origin path the IdP redirects back to; `{origin}{callbackPath}` is the\n   * redirect URI to register. Defaults to `/`. Fixed on purpose: the page a user\n   * starts login from travels in the PKCE state, not in the redirect URI.\n   */\n  callbackPath?: string;\n  /**\n   * `'session'` (default) keeps the minted token in `sessionStorage` so a reload or an\n   * in-tab navigation does not round-trip through the IdP. Tab-scoped and gone when the\n   * tab closes. `'none'`: memory only, every page load starts unauthenticated.\n   */\n  persist?: 'none' | 'session';\n  /**\n   * What a 401 from the API means. `'login'` (default): the token is stale, try a\n   * silent re-authentication (`prompt=none`) and fall back to unauthenticated if the\n   * IdP session is gone too. `'logout'`: just drop the session.\n   */\n  onUnauthorized?: 'login' | 'logout';\n  children: ReactNode;\n}\n\nconst SESSION_KEY = 'confighub_session';\n\nfunction readPersisted(): MintedSession | null {\n  try {\n    const raw = sessionStorage.getItem(SESSION_KEY);\n    if (!raw) return null;\n    const session: MintedSession = JSON.parse(raw);\n    if (!session.accessToken || isExpired(session.accessToken)) {\n      sessionStorage.removeItem(SESSION_KEY);\n      return null;\n    }\n    return session;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Runs the browser-direct auth flow and manages the token lifecycle. On mount it\n * completes a redirect if the page is the IdP callback, restores a persisted\n * session if there is one, and otherwise starts unauthenticated until `login()`\n * is called.\n */\nexport function ConfigHubAuthProvider({\n  baseUrl,\n  clientId,\n  callbackPath,\n  persist = 'session',\n  onUnauthorized = 'login',\n  children,\n}: ConfigHubAuthProviderProps): JSX.Element {\n  const [status, setStatus] = useState<AuthStatus>('loading');\n  const [user, setUser] = useState<ConfigHubUser | null>(null);\n  const [error, setError] = useState<Error | null>(null);\n\n  // The session lives in a ref so getToken() reads the latest value synchronously\n  // without re-creating the API client on every render.\n  const sessionRef = useRef<MintedSession | undefined>(undefined);\n  const flow = useMemo(() => ({ callbackPath }), [callbackPath]);\n\n  const persistSession = useCallback(\n    (session: MintedSession | undefined) => {\n      if (persist !== 'session') return;\n      try {\n        if (session) sessionStorage.setItem(SESSION_KEY, JSON.stringify(session));\n        else sessionStorage.removeItem(SESSION_KEY);\n      } catch {\n        // Storage unavailable (private mode, quota): memory-only for this tab.\n      }\n    },\n    [persist],\n  );\n\n  const applySession = useCallback(\n    (session: MintedSession) => {\n      sessionRef.current = session;\n      setAccessToken(session.accessToken); // keep the non-React accessor in sync (rtk-query)\n      persistSession(session);\n      setUser({ organizationId: session.organizationId, idpClaims: session.idpClaims });\n      setError(null);\n      setStatus('authenticated');\n    },\n    [persistSession],\n  );\n\n  const clearSession = useCallback(() => {\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setUser(null);\n    setStatus('unauthenticated');\n  }, [persistSession]);\n\n  useEffect(() => {\n    let cancelled = false;\n    completeLoginFromRedirect()\n      .then((session) => {\n        if (cancelled) return;\n        if (session) return applySession(session);\n        const persisted = persist === 'session' ? readPersisted() : null;\n        if (persisted) return applySession(persisted);\n        setStatus('unauthenticated');\n      })\n      .catch((e: unknown) => {\n        if (cancelled) return;\n        if (e instanceof OrganizationMissing) {\n          // Once, with no hint, flagged so a second miss surfaces as an error.\n          void startLogin(\n            baseUrl,\n            clientId,\n            { returnTo: e.returnTo, organization: null },\n            flow,\n            { retriedForOrganization: true },\n          );\n          return;\n        }\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [applySession, persist, baseUrl, clientId, flow]);\n\n  const login = useCallback(\n    async (options?: LoginOptions) => {\n      setError(null);\n      try {\n        await startLogin(baseUrl, clientId, options, flow);\n      } catch (e: unknown) {\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      }\n    },\n    [baseUrl, clientId, flow],\n  );\n\n  const logout = useCallback(\n    async (options?: LogoutOptions) => {\n      const idToken = sessionRef.current?.idToken;\n      clearSession();\n      if (options?.endSession) {\n        await endSession(\n          baseUrl,\n          clientId,\n          idToken,\n          options.postLogoutRedirectUri ?? callbackUri(flow),\n        );\n      }\n    },\n    [baseUrl, clientId, clearSession, flow],\n  );\n\n  const switchOrganization = useCallback(\n    async (organizationId: string) => {\n      const current = sessionRef.current;\n      if (!current) throw new Error('not authenticated');\n      const minted = await switchOrganizationCore(baseUrl, current.accessToken, organizationId);\n      // The session's IdP claims still name the previous org, so its alias must not\n      // be remembered as the default for the next login.\n      rememberOrganization(clientId, undefined);\n      applySession({ ...current, ...minted });\n    },\n    [applySession, baseUrl, clientId],\n  );\n\n  const getToken = useCallback(() => sessionRef.current?.accessToken, []);\n\n  const reauthenticate = useCallback(async () => {\n    const organization = organizationAliasOf(sessionRef.current?.idpClaims ?? {});\n    // Forget the token but stay 'loading': the page is about to navigate away,\n    // and 'unauthenticated' would invite an interactive login in the meantime.\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setStatus('loading');\n    try {\n      await startLogin(baseUrl, clientId, { prompt: 'none', organization }, flow);\n    } catch (e: unknown) {\n      setError(e instanceof Error ? e : new Error(String(e)));\n      setStatus('error');\n    }\n  }, [baseUrl, clientId, flow, persistSession]);\n\n  // A 401 means the minted token no longer works. Silent re-auth keeps the user's\n  // place if the IdP session is still alive; otherwise the page comes back\n  // unauthenticated and the app offers a real login.\n  const handleUnauthorized = useCallback(() => {\n    if (!sessionRef.current) return;\n    if (onUnauthorized === 'login') void reauthenticate();\n    else clearSession();\n  }, [clearSession, reauthenticate, onUnauthorized]);\n\n  // Non-React callers (getAccessToken on an expired token, handleUnauthorized from a\n  // data client's 401) reach this provider's handling through the token store.\n  useEffect(() => {\n    setUnauthorizedHandler(handleUnauthorized);\n    return () => setUnauthorizedHandler(undefined);\n  }, [handleUnauthorized]);\n\n  // One client for the provider's lifetime. getToken reads the session ref.\n  const client = useMemo(\n    () => createConfigHubClient({ baseUrl, getToken, onUnauthorized: handleUnauthorized }),\n    [baseUrl, getToken, handleUnauthorized],\n  );\n\n  const value = useMemo<ConfigHubAuthContextValue>(\n    () => ({\n      status,\n      user,\n      error,\n      login,\n      logout,\n      switchOrganization,\n      reauthenticate,\n      getToken,\n      client,\n    }),\n    [status, user, error, login, logout, switchOrganization, reauthenticate, getToken, client],\n  );\n\n  return (\n    <ConfigHubAuthContext.Provider value={value}>{children}</ConfigHubAuthContext.Provider>\n  );\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport type { ConfigHubClient } from '@confighub/api';\nimport { useContext } from 'react';\nimport { ConfigHubAuthContext, type ConfigHubAuthContextValue } from './provider';\n\n/**\n * Access the ConfigHub auth state and actions. Must be called under a\n * `<ConfigHubAuthProvider>`.\n *\n * ```ts\n * const { status, user, login, logout } = useAuth();\n * ```\n */\nexport function useAuth(): ConfigHubAuthContextValue {\n  const ctx = useContext(ConfigHubAuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within a <ConfigHubAuthProvider>');\n  }\n  return ctx;\n}\n\n/**\n * The typed ConfigHub API client, pre-wired with the current token. This is the\n * seam between `@confighub/react-auth` and `@confighub/api`: you never pass a\n * token by hand.\n *\n * ```ts\n * const api = useConfigHub();\n * const { data } = await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });\n * ```\n */\nexport function useConfigHub(): ConfigHubClient {\n  return useAuth().client;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@confighub/react-auth",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "React auth provider and hooks for ConfigHub browser apps (OIDC PKCE + RFC 8693 token exchange)",
   "license": "MIT",
   "repository": {
@@ -39,7 +39,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@confighub/api": "^0.4.4"
+    "@confighub/api": "^0.4.5"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0"